diff --git a/.github/PULL_REQUEST_TEMPLATE/agents.md b/.github/PULL_REQUEST_TEMPLATE/agents.md
index 84541e60a9..e1b12cf000 100644
--- a/.github/PULL_REQUEST_TEMPLATE/agents.md
+++ b/.github/PULL_REQUEST_TEMPLATE/agents.md
@@ -5,8 +5,8 @@ Briefly describe the change to the agent instruction files and the expected effe
 Examples:
 
 * Add a new repository rule to `AGENTS.md`
-* Fix contradictory guidance between `AGENTS.md` and `CLAUDE.md`
-* Improve instruction clarity for `GEMINI.md`
+* Fix contradictory guidance between `AGENTS.md` and `docs/agents/*`
+* Improve instruction clarity for `AGENTS.md`
 
 ---
 
@@ -24,8 +24,8 @@ Select the primary intent of this PR:
 List the touched agent instruction files.
 
 * [ ] `AGENTS.md`
-* [ ] `CLAUDE.md`
-* [ ] `GEMINI.md`
+* [ ] `roles/<role>/AGENTS.md`
+* [ ] `docs/agents/*`
 
 Additional notes:
 
@@ -61,7 +61,7 @@ Key points:
 Describe how the instruction change was validated.
 
 * [ ] Conflicting or ambiguous guidance checked
-* [ ] Consistency between `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md` verified
+* [ ] Consistency between `AGENTS.md`, `roles/<role>/AGENTS.md`, and `docs/agents/*` verified
 * [ ] Examples, workflows, or affected contributor paths reviewed
 
 ---
diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 51196e8af2..bd2ad4ef11 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -13,21 +13,21 @@ flowchart TB
     pr["pull_request: opened, synchronize, reopened, ready_for_review"] --> eprc["entry-pr-change-orchestrate.yml"]
     dispatch["workflow_dispatch"] --> eman["entry-manual-steer.yml"]
 
-    epl --> orch["ci-orchestrator.yml"]
-    epl -->|"version tag on main"| relv["release-version.yml"]
+    epl --> orch["call-orchestrator.yml"]
+    epl -->|"version tag on main"| relv["call-release-version.yml"]
     eprc --> orch
-    eprc -->|"fork PRs: privileged prebuild"| imgbuild["images-build-ci.yml"]
-    eprc -->|"fork PRs: privileged prebuild"| imgmirror["images-mirror-missing.yml"]
+    eprc -->|"fork PRs: privileged prebuild"| imgbuild["call-images-build-ci.yml"]
+    eprc -->|"fork PRs: privileged prebuild"| imgmirror["call-images-mirror-missing.yml"]
     eman --> orch
 
-    subgraph orchestrator["ci-orchestrator.yml jobs"]
+    subgraph orchestrator["call-orchestrator.yml jobs"]
         waitfork["wait-fork-prereq-run"] --> forkready["fork-prereqs-ready"]
 
-        lintwf["lint.yml: make lint + hadolint"]
-        testwf["test.yml: make test"]
+        lintwf["call-lint.yml: make lint + hadolint"]
+        testwf["call-test.yml: make test"]
         codeql["cron-security-codeql.yml"]
-        buildci["build-ci-images: images-build-ci.yml"] --> dns["test-dns.yml"]
-        mirror["images-mirror-missing.yml"]
+        buildci["build-ci-images: call-images-build-ci.yml"] --> dns["call-test-dns.yml"]
+        mirror["call-images-mirror-missing.yml"]
 
         subgraph chain["serial chunk chain"]
             chunk0["test-deploy-chunk-0"]
@@ -42,12 +42,12 @@ flowchart TB
         mirror --> chain
         buildci --> chain
 
-        chunk0 --> smoke["test-runner-smoke.yml"]
+        chunk0 --> smoke["call-test-runner-smoke.yml"]
         chain --> report["report-main-failures"]
 
-        instmake["test-install-make.yml"]
-        instpkgmgr["test-install-pkgmgr.yml"]
-        mirror --> devenv["test-workspace: test-workspace.yml"]
+        instmake["call-test-install-make.yml"]
+        instpkgmgr["call-test-install-pkgmgr.yml"]
+        mirror --> devenv["test-workspace: call-test-workspace.yml"]
 
         chain --> donegate["done"]
         smoke --> donegate
@@ -301,12 +301,12 @@ flowchart TB
     pushmain["push: main"] --> updatewf
     prtarget["pull_request_target: opened, reopened"] --> depclose["entry-pr-open-dependabot-close.yml"]
 
-    relhighest -.->|"gh workflow run"| relver["release-version.yml"]
-    relver --> imgbuildci["images-build-ci.yml"]
-    manual["workflow_dispatch"] --> mirrorcleanup["images-mirror-cleanup.yml"]
+    relhighest -.->|"gh workflow run"| relver["call-release-version.yml"]
+    relver --> imgbuildci["call-images-build-ci.yml"]
+    manual["workflow_dispatch"] --> mirrorcleanup["entry-manual-mirror-cleanup.yml"]
 ```
 
 Also manually dispatchable: `cron-images-mirror-all.yml`, `cron-images-cleanup-ci.yml`,
 `cron-cleanup-stale.yml`, `cron-update.yml`, `cron-release-highest.yml`, `call-release-version.yml`,
 `call-lint.yml`, `call-test.yml`, `call-test-dns.yml`,
-`test-workspace.yml`, `test-runner-smoke.yml`.
+`call-test-workspace.yml`, `call-test-runner-smoke.yml`.
diff --git a/.github/workflows/call-images-build-ci.yml b/.github/workflows/call-images-build-ci.yml
index 1719d9a623..6167740b27 100644
--- a/.github/workflows/call-images-build-ci.yml
+++ b/.github/workflows/call-images-build-ci.yml
@@ -41,35 +41,13 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  prepare:
-    name: 📋 Build Matrix
-    runs-on: ubuntu-latest
-    outputs:
-      matrix: ${{ steps.out.outputs.matrix }}
-      image_tag: ${{ steps.out.outputs.image_tag }}
-    steps:
-      - uses: actions/checkout@v7.0.0
-
-      - name: 📦 Install jq
-        run: ./scripts/install/apt.sh jq
-
-      - name: 🧮 Compute matrix JSON
-        id: out
-        run: scripts/github/runner/images_build_outputs.sh "${{ inputs.distros }}" "${{ inputs.image_tag }}"
-
   build:
-    name: 🏗️ Build (${{ matrix.distro }})
-    needs: prepare
+    name: 💿 Image
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
 
-    strategy:
-      fail-fast: false
-      matrix:
-        distro: ${{ fromJson(needs.prepare.outputs.matrix) }}
-
     steps:
       - name: ⬇️ Checkout trusted workflow repo (helpers)
         uses: actions/checkout@v7.0.0
@@ -86,6 +64,13 @@ jobs:
           persist-credentials: false
           allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_checkout }}
 
+      - name: 📦 Install jq
+        run: ./scripts/install/apt.sh jq
+
+      - name: 🧮 Compute the distro list and image tag
+        id: out
+        run: scripts/github/runner/images_build_outputs.sh "${{ inputs.distros }}" "${{ inputs.image_tag }}"
+
       - name: 💽 Disk pressure (start)
         shell: bash
         run: bash scripts/github/runner/disk_pressure_report.sh START
@@ -127,20 +112,42 @@ jobs:
         run: |
           set -euo pipefail
           echo "owner=$(scripts/meta/resolve/repository/owner.sh)" >> "$GITHUB_OUTPUT"
+          echo "name=$(scripts/meta/resolve/repository/name.sh)" >> "$GITHUB_OUTPUT"
 
-      - name: 🔨 Build & push (retry 7x, 20s)
+      - name: 🔨 Build & push every distro (retry 7x, 20s)
         if: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
         shell: bash
         env:
           GITHUB_REPOSITORY_OWNER: ${{ steps.owner.outputs.owner }}
           BUILD_CONTEXT_DIR: _src
-          MATRIX_DISTRO: ${{ matrix.distro }}
-          IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
+          INFINITO_DISTROS: ${{ join(fromJson(steps.out.outputs.matrix), ' ') }}
+          IMAGE_TAG: ${{ steps.out.outputs.image_tag }}
           USE_NIX_TOKEN: ${{ !(github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository) }}
           NIX_GITHUB_TOKEN: ${{ github.token }}
           MAX_ATTEMPTS: "7"
           RETRY_DELAY_SECONDS: "20"
-        run: ./scripts/image/push.sh
+        run: ./scripts/image/push_all.sh
+
+      - name: ⏳ Assert every distro image is in the registry
+        shell: bash
+        env:
+          REGISTRY: ghcr.io
+          OWNER: ${{ steps.owner.outputs.owner }}
+          REPO_PREFIX: ${{ steps.owner.outputs.name }}
+          CI_TAG: ${{ steps.out.outputs.image_tag }}
+          INFINITO_DISTROS: ${{ join(fromJson(steps.out.outputs.matrix), ' ') }}
+          WAIT_ATTEMPTS: "90"
+          WAIT_SLEEP_SECONDS: "10"
+        run: ./scripts/meta/wait/ci_images.sh
+
+      - name: 📤 Upload per-distro build logs
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: image-build-logs
+          path: build/image-logs/
+          retention-days: 7
+          if-no-files-found: ignore
 
       - name: 💽 Disk pressure (post-build)
         if: always()
diff --git a/.github/workflows/call-orchestrator.yml b/.github/workflows/call-orchestrator.yml
index 72d9f67507..f37831656c 100644
--- a/.github/workflows/call-orchestrator.yml
+++ b/.github/workflows/call-orchestrator.yml
@@ -37,6 +37,11 @@ on:
         required: false
         type: string
         default: "0"
+      chunk_size:
+        description: "📦 Rows one chunk holds. Empty or 0 derives it from the runner slots a chunk may assume and the waves the queue window affords. Typed string for the same reason as resume_from_chunk."
+        required: false
+        type: string
+        default: "0"
       resume_from_chunk:
         description: "⏭️ Skip every chunk below this index. Use to continue a sweep after fixing what broke it, instead of re-running the green chunks. Typed string, not number: a workflow_dispatch number input reaches the caller as a string, and handing that to a number-typed workflow_call input makes GitHub reject the job before it is created."
         required: false
@@ -161,14 +166,12 @@ jobs:
           && needs.lint.result == 'success'
           && needs.test.result == 'success'
           && needs.build-ci-images.result == 'success'
-          && needs.images-mirror-missing.result == 'success'
-          && needs.test-dns.result == 'success' }}
+          && needs.images-mirror-missing.result == 'success' }}
     needs:
       - lint
       - test
       - build-ci-images
       - images-mirror-missing
-      - test-dns
       - validate-selection
     uses: ./.github/workflows/call-test-deploy.yml
     with:
@@ -176,6 +179,7 @@ jobs:
       index: "0"
       sweep: ${{ inputs.sweep != '' && inputs.sweep || github.run_number }}
       offset: ${{ inputs.offset }}
+      chunk_size: ${{ inputs.chunk_size }}
       whitelist: ${{ inputs.whitelist }}
       priority: ${{ inputs.priority }}
       lifecycles: ${{ inputs.lifecycles }}
@@ -192,7 +196,6 @@ jobs:
           && needs.test.result == 'success'
           && needs.build-ci-images.result == 'success'
           && needs.images-mirror-missing.result == 'success'
-          && needs.test-dns.result == 'success'
           && (!inputs.chunk_gate
               || contains(fromJSON('["success","skipped"]'), needs.test-deploy-chunk-0.result)) }}
     needs:
@@ -200,7 +203,7 @@ jobs:
       - test
       - build-ci-images
       - images-mirror-missing
-      - test-dns
+      - validate-selection
       - test-deploy-chunk-0
     uses: ./.github/workflows/call-test-deploy.yml
     with:
@@ -208,6 +211,7 @@ jobs:
       index: "1"
       sweep: ${{ inputs.sweep != '' && inputs.sweep || github.run_number }}
       offset: ${{ inputs.offset }}
+      chunk_size: ${{ inputs.chunk_size }}
       whitelist: ${{ inputs.whitelist }}
       priority: ${{ inputs.priority }}
       lifecycles: ${{ inputs.lifecycles }}
@@ -224,7 +228,6 @@ jobs:
           && needs.test.result == 'success'
           && needs.build-ci-images.result == 'success'
           && needs.images-mirror-missing.result == 'success'
-          && needs.test-dns.result == 'success'
           && (!inputs.chunk_gate
               || (contains(fromJSON('["success","skipped"]'), needs.test-deploy-chunk-0.result)
                   && contains(fromJSON('["success","skipped"]'), needs.test-deploy-chunk-1.result))) }}
@@ -233,7 +236,7 @@ jobs:
       - test
       - build-ci-images
       - images-mirror-missing
-      - test-dns
+      - validate-selection
       - test-deploy-chunk-0
       - test-deploy-chunk-1
     uses: ./.github/workflows/call-test-deploy.yml
@@ -242,6 +245,7 @@ jobs:
       index: "2"
       sweep: ${{ inputs.sweep != '' && inputs.sweep || github.run_number }}
       offset: ${{ inputs.offset }}
+      chunk_size: ${{ inputs.chunk_size }}
       whitelist: ${{ inputs.whitelist }}
       priority: ${{ inputs.priority }}
       lifecycles: ${{ inputs.lifecycles }}
@@ -258,7 +262,6 @@ jobs:
           && needs.test.result == 'success'
           && needs.build-ci-images.result == 'success'
           && needs.images-mirror-missing.result == 'success'
-          && needs.test-dns.result == 'success'
           && (!inputs.chunk_gate
               || (contains(fromJSON('["success","skipped"]'), needs.test-deploy-chunk-0.result)
                   && contains(fromJSON('["success","skipped"]'), needs.test-deploy-chunk-1.result)
@@ -268,7 +271,7 @@ jobs:
       - test
       - build-ci-images
       - images-mirror-missing
-      - test-dns
+      - validate-selection
       - test-deploy-chunk-0
       - test-deploy-chunk-1
       - test-deploy-chunk-2
@@ -278,6 +281,7 @@ jobs:
       index: "3"
       sweep: ${{ inputs.sweep != '' && inputs.sweep || github.run_number }}
       offset: ${{ inputs.offset }}
+      chunk_size: ${{ inputs.chunk_size }}
       whitelist: ${{ inputs.whitelist }}
       priority: ${{ inputs.priority }}
       lifecycles: ${{ inputs.lifecycles }}
diff --git a/.github/workflows/call-test-deploy.yml b/.github/workflows/call-test-deploy.yml
index 82de4d6579..8cd37c3bf6 100644
--- a/.github/workflows/call-test-deploy.yml
+++ b/.github/workflows/call-test-deploy.yml
@@ -21,6 +21,11 @@ on:
         required: false
         type: string
         default: "0"
+      chunk_size:
+        description: "Rows one chunk holds; 0 derives it from the runner slots and the queue window."
+        required: false
+        type: string
+        default: "0"
       whitelist:
         description: "Optional space-separated whitelist of app ids"
         required: false
@@ -125,6 +130,9 @@ env:
   INFINITO_IMAGE_TAG: ci-${{ github.sha }}
   INFINITO_GHCR_MIRROR_PREFIX: mirror
   INFINITO_PLAYWRIGHT_KEEP: ${{ vars.PLAYWRIGHT_KEEP_ALL }}
+  INFINITO_API_OPENAI_KEY: ${{ secrets.API_OPENAI_KEY || vars.API_OPENAI_KEY }}
+  INFINITO_API_ANTHROPIC_KEY: ${{ secrets.API_ANTHROPIC_KEY || vars.API_ANTHROPIC_KEY }}
+  INFINITO_API_OPENROUTER_KEY: ${{ secrets.API_OPENROUTER_KEY || vars.API_OPENROUTER_KEY }}
   INFINITO_APP_DISCOVERY_RUNNER: host
   INFINITO_DOCKER_FILESYSTEM_ALLOWED: ${{ inputs.filesystem }}
   INFINITO_LIFECYCLES: ${{ inputs.lifecycles }}
@@ -186,12 +194,14 @@ jobs:
           INFINITO_CI_SWEEP: ${{ inputs.sweep }}
           INFINITO_CI_CHUNK: ${{ inputs.index }}
           INFINITO_CI_OFFSET: ${{ inputs.offset }}
+          INFINITO_CI_CHUNK_SIZE: ${{ inputs.chunk_size }}
         run: ./scripts/github/resolve/output_apps.sh
 
       - name: 🗺️ Render the plan into the run summary
         shell: bash
         env:
           INFINITO_CI_SWEEP: ${{ inputs.sweep }}
+          INFINITO_CI_CHUNK_SIZE: ${{ inputs.chunk_size }}
           PLAN_DISTROS: ${{ inputs.distros }}
           PLAN_FILESYSTEM: ${{ inputs.filesystem }}
           PLAN_WHITELIST: ${{ steps.resolve_wl.outputs.whitelist }}
diff --git a/.github/workflows/cron-collection-source.yml b/.github/workflows/cron-collection-source.yml
new file mode 100644
index 0000000000..50dc753b10
--- /dev/null
+++ b/.github/workflows/cron-collection-source.yml
@@ -0,0 +1,80 @@
+name: "⚖️ Source benchmark"
+run-name: "${{ github.event_name == 'schedule' && '⏰ ' || '' }}⚖️ Benchmark collection sources"
+
+on:
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: collection-source-${{ github.repository }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  benchmark-collection-sources:
+    name: ⚖️ Time Galaxy against the git fallback
+    if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
+    runs-on: ubuntu-latest
+    env:
+      HISTORY_PATH: build/collection-source-history.json
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@v7.0.0
+        with:
+          ref: main
+
+      - name: 🔧 Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: 📦 Install project with the deploy extra
+        env:
+          PYTHON: python3
+        run: bash scripts/install/python.sh deploy
+
+      - name: ♻️ Restore the sample history from the last run
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HISTORY_WORKFLOW: cron-collection-source.yml
+        run: bash scripts/github/update/restore_collection_history.sh
+
+      - name: ⏱️ Time both collection sources
+        run: bash scripts/github/update/collection_source.sh --history "${HISTORY_PATH}"
+
+      - name: 💾 Keep the sample history for the next run
+        uses: actions/upload-artifact@v7
+        with:
+          name: collection-source-history
+          path: ${{ env.HISTORY_PATH }}
+          retention-days: 90
+
+      - name: 🔎 Check for changes
+        id: diff
+        run: bash scripts/github/resolve/check_git_changes.sh default.env
+
+      - name: ⚙️ Generate app token
+        if: steps.diff.outputs.changed == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+
+      - name: 📂 Open PR if the preferred source changed
+        if: steps.diff.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+          UPDATE_BRANCH_PREFIX: update/collection-source
+          UPDATE_COMMIT_MESSAGE: "update(galaxy): retune the preferred collection source"
+          UPDATE_PR_TITLE: "update(galaxy): retune the preferred collection source"
+          UPDATE_PR_BODY: "Automated retune of `INFINITO_ANSIBLE_COLLECTIONS_SOURCE` in `default.env`. The preferred source's median install time reached at least 3x the other's over the last 12 daily samples; a failed install counts as worse than any duration."
+          UPDATE_BASE_BRANCH: main
+        run: bash scripts/github/update/open/pr.sh default.env
diff --git a/.github/workflows/cron-release-highest.yml b/.github/workflows/cron-release-highest.yml
index 75183086d3..8e17fadbae 100644
--- a/.github/workflows/cron-release-highest.yml
+++ b/.github/workflows/cron-release-highest.yml
@@ -79,4 +79,4 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ steps.pick.outputs.tag }}
-        run: gh workflow run release-version.yml -f tag="${TAG}"
+        run: gh workflow run call-release-version.yml -f tag="${TAG}"
diff --git a/.github/workflows/cron-update.yml b/.github/workflows/cron-update.yml
index cf43307701..6e827796f2 100644
--- a/.github/workflows/cron-update.yml
+++ b/.github/workflows/cron-update.yml
@@ -112,6 +112,53 @@ jobs:
           UPDATE_BASE_BRANCH: main
         run: bash scripts/github/update/open/role_prs.sh roles
 
+  update-galaxy-pins:
+    name: 🌌 Update pinned Ansible collections
+    if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@v7.0.0
+        with:
+          ref: main
+
+      - name: 🔧 Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: 📦 Install update dependencies
+        run: bash scripts/github/update/install_python.sh
+
+      - name: 🔄 Update pinned Ansible collections
+        run: bash scripts/github/update/galaxy_pins.sh
+
+      - name: 🔎 Check for changes
+        id: diff
+        run: bash scripts/github/resolve/check_git_changes.sh requirements
+
+      - name: ⚙️ Generate app token
+        if: steps.diff.outputs.changed == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+
+      - name: 📂 Open PR if collection pins changed
+        if: steps.diff.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+          UPDATE_BRANCH_PREFIX: update/galaxy-pins
+          UPDATE_COMMIT_MESSAGE: "update(galaxy): bump pinned Ansible collections"
+          UPDATE_PR_TITLE: "update(galaxy): bump pinned Ansible collections"
+          UPDATE_PR_BODY: "Automated update of the collection `version:` pins in `requirements/`. Both the Galaxy file and the git fallback are bumped together; upstream releases resolved via `git ls-remote --tags`."
+          UPDATE_BASE_BRANCH: main
+        run: bash scripts/github/update/open/pr.sh requirements
+
   update-repository-refs:
     name: 🌿 Update repository refs
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
diff --git a/.github/workflows/entry-manual-steer.yml b/.github/workflows/entry-manual-steer.yml
index 8fd1c6f438..edcad68b70 100644
--- a/.github/workflows/entry-manual-steer.yml
+++ b/.github/workflows/entry-manual-steer.yml
@@ -58,6 +58,11 @@ on:
         required: false
         default: "0"
         type: string
+      chunk_size:
+        description: "📦 Rows one chunk holds. Empty: derive it from slots and queue window"
+        required: false
+        default: ""
+        type: string
       chunk_gate:
         description: "🛑 Stop the chunk chain at its first failed chunk"
         required: false
@@ -107,6 +112,7 @@ jobs:
       priority: ${{ inputs.priority }}
       sweep: ${{ inputs.sweep }}
       offset: ${{ inputs.offset }}
+      chunk_size: ${{ inputs.chunk_size != '' && inputs.chunk_size || '0' }}
       chunk_gate: ${{ inputs.chunk_gate }}
       filesystem: ${{ inputs.filesystem }}
       workspace: ${{ inputs.workspace }}
diff --git a/AGENTS.md b/AGENTS.md
index 5cd5e69a96..14b5e52c05 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -6,21 +6,17 @@
 - You MUST read every file under `docs/contributing/` (full directory walk, including subdirectories) for the full contributor guidance.
 - You MUST read every file under `docs/agents/` (full directory walk, including subdirectories) for the agent execution flow.
 - This file extends CONTRIBUTING.md with agent-specific instructions; on conflict between CONTRIBUTING.md and this file, this file wins.
+- This file is runtime-agnostic and binding for every agent (Claude Code, Codex, Gemini CLI, other). There are no tool-specific extension files.
 
-## Tool-Specific Extensions 🧩
+## Permission State Announcement at Session Start 📢
 
-At the start of every conversation, the agent MUST load its matching extension file in addition to AGENTS.md:
-
-- Claude Code → [CLAUDE.md](CLAUDE.md)
-- Gemini CLI → [GEMINI.md](GEMINI.md)
-
-Agents MUST NOT read another tool's extension file. On conflict between AGENTS.md and the agent's own tool-specific extension file, the tool-specific file wins.
+At the start of every new conversation, you MUST read [.claude/settings.json](.claude/settings.json) and output a one-time summary: sandbox status with concrete `allowWrite`/`denyRead` paths, plus the counts of `permissions.allow`/`ask`/`deny`. Derive content from the live file; do not hardcode. Do not repeat unless the operator asks, and do not propose `/sandbox` when it is already active.
 
 ## Reloading Instructions 🔄
 
-If agent instructions change mid-conversation (AGENTS.md, the tool-specific extension file, or any file referenced from them), the agent might not reload them automatically. Trigger a reload with:
+If agent instructions change mid-conversation (AGENTS.md or any file referenced from it), the agent might not reload them automatically. Trigger a reload with:
 
-> "Re-read AGENTS.md and the tool-specific extension file (CLAUDE.md or GEMINI.md) and apply all updated instructions."
+> "Re-read AGENTS.md and apply all updated instructions."
 
 ## Permission Model 🔐
 
@@ -41,6 +37,50 @@ Agents whose runtime does not consult `.claude/settings.json` MUST still enforce
 
 Changes to the policy MUST edit [`.claude/settings.json`](.claude/settings.json). Per-entry rationale: [settings.md](docs/contributing/tools/agents/claude/settings.md); sandbox layer: [sandbox.md](docs/contributing/tools/agents/claude/sandbox.md).
 
+## Interaction Rules 💬
+
+- A question MUST NOT modify files, code, or state. Only explicit commands MAY.
+- You MUST prefer commands permitted in [.claude/settings.json](.claude/settings.json) over commands that require interactive approval when an equivalent exists.
+
+## Code Execution ⚙️
+
+- You MUST prefer `make` targets over raw `docker`/`docker compose`/`ansible-playbook`/`python`/shell invocations whenever an equivalent target exists in the [`Makefile`](Makefile). Inspect the `Makefile` first; fall back to the raw command only when no target covers the operation. The reason is operational consistency, not permissioning. Raw commands also auto-allow under the sandbox.
+- **`docker exec` is FORBIDDEN. ⛔** You MUST NEVER invoke `docker exec` (nor nested `docker exec … docker exec …` into the DiD stack) directly. Always reach the live stack through `make` targets (e.g. `make compose-exec`, or the role-specific targets the `Makefile` exposes). If no `make` target covers what you need, ask the operator instead of falling back to raw `docker exec`.
+- You SHOULD run sandbox-confined commands directly on the host. The sandbox bounds what they can read, write, and reach. See [sandbox.md](docs/contributing/tools/agents/claude/sandbox.md).
+- For commands that legitimately cannot run inside the sandbox (e.g. operations needing access to `~/.ssh` or `~/.gnupg`), use `make compose-up` to start the stack and `make compose-exec` to drop into a container shell. The repository is mounted at `/opt/src/infinito` (see [compose.yml](compose.yml)), so code changes are immediately available there.
+- Commands listed under `permissions.ask` in [.claude/settings.json](.claude/settings.json) still pause for explicit operator confirmation regardless of sandbox state.
+- **Shell loops are FORBIDDEN. ⛔** You MUST NOT use `for`, `while`, `until`, or any other shell loop construct in any Bash tool call. Reason: shell control structures fall outside the sandbox auto-allow heuristic and trigger approval prompts even when every subcommand would individually auto-allow.
+- **Multi-statement chains in shell invocations are FORBIDDEN. ⛔** You MUST NOT chain independent statements inside a single Bash tool call with **any** statement separator (`;`, literal newline, `&&`, `||`, `&` background operator, or subshell/brace groups around the same). The ban covers causally-dependent chains (`cd X && cmd`) just as much as optional ones, and applies to trailing `&` used to background a command (use the Bash tool's `run_in_background: true` parameter instead). Reason: identical to the loop rule. Split the work across **separate Bash tool calls** or use a single-command equivalent (`xargs`, `grep` with multiple args, a make target).
+- **File creation via shell heredoc is FORBIDDEN. ⛔** You MUST NOT use `cat > file <<EOF … EOF` or any variant (`tee > file <<EOF`, `printf "…" > file`, `echo "…" > file` for multi-line content) to create or overwrite files. Use the **Write tool**. For editing an existing file, use **Edit**, not `sed -i`/`awk -i`. Reason: Write/Edit land structured in the transcript and diff; heredoc + redirect shapes also fall out of the auto-allow heuristic and drop into ask.
+- **For searching file contents, use the Grep tool.** If shelling out is unavoidable, use a single `grep` invocation with multiple file arguments (e.g. `grep -nE 'pattern' file1 file2 file3`) or a recursive call with a path/glob (e.g. `grep -rnE 'pattern' path/`).
+
+## Command output logging 📜
+
+- For ANY non-trivial command (test runs, deploys, long pipelines), you MUST stream the FULL output to a file under `/tmp/` via `… 2>&1 | tee /tmp/<name>.log` and grep / inspect that file repeatedly instead of re-running the command. Reason: re-running `make test` to "find the failure I just lost" costs 2 minutes per cycle; grepping the saved log costs milliseconds.
+- Default the filename to a meaningful slug + monotonically increasing index (`/tmp/make-test-<slug>-<N>.log`, `/tmp/act-<slug>-<N>.log`) so you can compare runs.
+- **When a long-running command streams its output to a `/tmp/<name>.log` file** (e.g. background `make compose-deploy`, `make act-*`, or any `… 2>&1 | tee /tmp/<name>.log`), you MUST tell the operator the concrete `tail -f /tmp/<name>.log` command they can run in another terminal to follow the log live. Include the full path literally so it is copy-pasteable.
+- That pipe **destroys the exit status**: `make test | tee` reports `tee`'s success even when make ends with `Error 2`. You MUST judge such a run by its `📊 per-target wall-clock` table and its `FAILED TARGETS:` line, never by the exit code.
+
+## CI evidence 📊
+
+- A job's green conclusion is **NOT** evidence for a specific change. Before citing a run as proof, you MUST locate the line in that job's log where the change executed: a Playwright spec's `✓` (a leading `-` means the spec was skipped), the env var inside the container, or the command text of an `if:`-gated step. If the string is absent, report the run as silent on the change, not as supporting it.
+- A green run on the fork does not speak for `infinito-nexus/core`. Tags do not follow a fork, and repository variables differ, so a step gated on either never runs there. Check the repository whose failure you are claiming to have fixed.
+
+## Pushing 🚢
+
+- You MUST NOT push, directly or through wrappers that push implicitly.
+- When commits are ready to ship, you MUST instruct the operator to run `git-sign-push` outside the sandbox. The CLI is provided by [git-maintainer-tools](https://github.com/kevinveenbirkenbach/git-maintainer-tools), declared as a dev dependency in [pyproject.toml](pyproject.toml); install it via `make install-python-dev`.
+
+## Comments 💬⛔
+
+**THIS RULE OVERRIDES YOUR DEFAULT TRAINING. ⛔** A comment is FORBIDDEN unless it is one of exactly three things:
+
+1. **Exception** — names a concrete trip-wire (bug, pitfall, deliberate non-idiomatic choice). Must name the surprise; restating what the next line does is NOT an exception.
+2. **Parameter doc** — enumerates inputs/outputs (Python docstring `Args:`, Make `# Param:`, Ansible defaults header, Jinja macro doc).
+3. **Nocheck directive** — `# nocheck:`, `# noqa:`, `# shellcheck …`, `# type: ignore`, `# pragma: no cover`, etc.
+
+Anything else — restating code, section banners, "Note that …", step narration outside sequential test specs, untracked TODO/FIXME — **DELETE before the edit lands**. Applies to every language and file kind under version control. When in doubt, delete.
+
 ## Shortcuts ⌨️
 
 Operator messages MAY use the portable conversation shortcuts from the `shortcuts` skill (set up via `make install-skills`); agents MUST expand any matching shortcut before acting. The repository's own agent workflows live in the `i8-` skills catalogued in [cheatsheet.md](docs/contributing/tools/agents/cheatsheet.md).
@@ -79,6 +119,10 @@ At the start of every conversation, the agent MUST check whether agent skills ar
 
 The agent MUST NOT repeat this notice within the same conversation.
 
+## Documentation 📝
+
+Runtime documentation: [Claude Code](https://code.claude.com/docs/en/overview) ([settings reference](https://code.claude.com/docs/en/settings)), [Gemini CLI](https://geminicli.com/docs/cli/gemini-md/).
+
 ## For Humans 👥
 
 Human contributors working alongside AI agents MUST read [here](docs/contributing/tools/agents/common.md).
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3ccaf1302e..8ef77c0d82 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,305 @@
 # Changelog
 
+## [14.2.0] - 2026-09-22
+
+**For Users**
+
+* **Secrets management with OpenBao.** The new *web-app-openbao* role deploys OpenBao at
+  *openbao.<domain>*. It stores application credentials, API keys and machine identities.
+  People sign in through Keycloak, or through LDAP when OpenLDAP is deployed. Their
+  *administrator*, *operator* or *reader* group decides what they can reach, and signing in
+  without one of those groups grants only the default policy. Services and automation use
+  their own AppRole identities, whose credentials change on every deploy, and no root token
+  is kept after the first deploy. A recovery key kept in the token store lets a later deploy
+  get back in if those credentials are lost. A static seal unseals the node on its own after
+  every restart. An internal PKI can be switched on, and Prometheus alerts when the node is
+  sealed or unreachable. The seal key lives only in the encrypted inventory, and a backup of
+  the store cannot be read without it, so back up the inventory together with the volume.
+  See [web-app-openbao](roles/web-app-openbao/README.md).
+
+* **LDAP import, export and Multi edit finish again in LAM.** The Content Security Policy
+  blocked the inline script that checks on LAM's background jobs, so these tools stayed
+  "in progress" forever. That script is allowed again.
+
+* **Swarm deploys no longer abort on a network that already exists.** Some networks are
+  created before their application's stack, as Prometheus does for every application it
+  scrapes. Those networks now carry the stack label, so the application's own deploy uses
+  the existing network instead of failing with "network with name <entity> already exists".
+
+**For Developers**
+
+* **Alert rules live in the role that owns the metric.** A role ships its Prometheus rules
+  in *templates/prometheus/alert_rules.yml.j2*. The new *alert_rule_roles* lookup includes
+  them only for roles that Prometheus actually scrapes, so a rules file needs no activation
+  check of its own. It must start at the *groups:* item level. OpenBao's seal alert is the
+  first rule to use it.
+
+* **Video for hand-built Playwright contexts.** A context created with
+  *browser.newContext()* ignored the project's video setting, so its artefact had a trace
+  but no video. Spread *recordVideoOptions(testInfo)* from *personas/utils/env.js* into the
+  context options to record one.
+
+* Image and dependency version jumps (net since 14.1.0):
+  * *web-app-pgadmin*: 9.17 to 9.18
+
+**Contributors**
+
+* [Evangelos Tsakoudis](https://evangelostsak.com): the OpenBao role with its seal,
+  credential rotation, recovery and RBAC end-to-end suite, role-local Prometheus alert
+  rules, and the LAM and swarm network fixes that work uncovered
+* [Alejandro Roman Ibanez](https://github.com/AlejandroRomanIbanez): video recording for
+  hand-built Playwright contexts
+* [Kevin Veen-Birkenbach](https://veen.world): review and version maintenance
+
+## [14.1.0] - 2026-09-21
+
+**For Users**
+
+* **Local models reach the gateway again.** Upstream re-pushed the *svc-ai-lmstudio* CPU
+  image with a server that listens on loopback only, so the role stayed green while litellm
+  could not connect and the AI features of Mattermost, Matrix, xWiki, Moodle and Zammad
+  failed their warm-up. The server binds the container network again and stays unpublished.
+  The model preload now waits until the daemon has finished starting, so a slow host no
+  longer ends up with a daemon that fails every later model load, and the readiness probe
+  is capped per attempt so a silent peer cannot hang it. See
+  [svc-ai-lmstudio](roles/svc-ai-lmstudio/README.md).
+
+**For Developers**
+
+* **CI deploys only the variants a change reaches.** An image bump in a provider no longer
+  redeploys the variants of its consumers that switch that provider off. The diff-derived
+  whitelist, used by the weekly update PRs, Dependabot and every other diff-driven run,
+  narrows each affected role to the variants whose round closure still reaches a changed
+  role, emitted as *role#0,2* selection tokens. A changed role and a role reached only
+  through *run_after* keep every variant. A pinned token naming a role that discovery does
+  not return now warns instead of aborting the run; role names are still checked against
+  *roles/* before the run starts.
+
+* **One instruction file for every agent.** *AGENTS.md* now holds every agent rule, and
+  *CLAUDE.md* and *GEMINI.md* are gone. The rules they carried bind every runtime anyway,
+  and the PR templates, scope tables, requirement documents and docs that named the old
+  files now name *AGENTS.md*.
+
+* Image and dependency version jumps (net since 14.0.0):
+  * *svc-ai-ollama*: 0.34.0 to 0.34.2
+  * *svc-net-tor* (Debian base): 13.6-slim to 13.7-slim
+  * *web-app-baserow*: 2.3.3 to 2.3.4
+  * *web-app-erpnext*: v16.34.2 to v16.35.0
+  * *web-app-funkwhale* (front, api): 2.0.10 to 2.0.11
+  * *web-app-jitsi* (web, prosody, jicofo, jvb): stable-9646 to stable-11031
+  * *web-app-keycloak*: 26.7.3 to 26.7.4
+  * *web-app-opentalk* (LiveKit): v1.13.6 to v1.13.7
+  * *web-app-opentalk* (RabbitMQ): 4.3.5 to 4.3.6
+  * *web-app-peertube*: v8.2.4 to v8.3.0
+  * *web-app-pihole*: 2026.07.2 to 2026.09.0
+  * *web-app-prometheus* (Alertmanager): v0.34.0 to v0.34.1
+  * Ansible collection *hetzner.hcloud*: 7.0.1 to 7.1.0
+  * *ruff* (dev): 0.16.6 to 0.16.7
+
+**Contributors**
+
+* [Kevin Veen-Birkenbach](https://veen.world): LM Studio reachability and startup,
+  variant-narrowed CI selection, the single agent instruction file, and version maintenance
+
+## [14.0.0] - 2026-09-19
+
+**For Users**
+
+* **AI assistance inside the applications you already run.** A gateway role,
+  *svc-ai-litellm*, fronts OpenAI, Anthropic and OpenRouter from declared keys, with
+  *svc-ai-ollama* and the new *svc-ai-lmstudio* serving local models from one shared
+  catalogue, so inference can stay inside the deployment. Sixteen applications use it for
+  their own built-in AI features instead of calling a vendor directly: WordPress AI Engine,
+  MediaWiki AIEditingAssistant, Moodle's AI subsystem, Zammad Smart Assist, the xWiki LLM
+  extension, Discourse AI, the Matrix ChatGPT bridge, Nextcloud, Mattermost Agents, n8n,
+  Open WebUI and Flowise. The gateway's admin UI signs in through Keycloak. See
+  [svc-ai-litellm](roles/svc-ai-litellm/README.md) and
+  [svc-ai-lmstudio](roles/svc-ai-lmstudio/README.md).
+
+* **Your tools reachable from your assistants.** About twenty applications now speak MCP.
+  Gitea, GitLab, Mattermost, Nextcloud, n8n, Baserow, Jenkins, Home Assistant, Moodle,
+  Snipe-IT and WordPress serve their own endpoints; ten more get one through a locked-down
+  sidecar. Open WebUI, Flowise and the agents discover what the deployment offers and
+  register it automatically. Access is bounded rather than assumed: blocked paths are
+  declared, every served path is gated, tools a provider calls mutating are withheld,
+  reader and writer roles are separate, and each provider authenticates callers as its own
+  service account. See [svc-ai-mcp-adapter](roles/svc-ai-mcp-adapter/README.md).
+
+* **Agents as employees, with a kernel between them and the host.** *web-app-hermes* and
+  *web-app-openclaw* deploy agents behind the single sign-on gate, wired to the gateway's
+  models and to the MCP servers discovery hands them, each proving on deploy that it can
+  actually reach them. *svc-virt-kata* runs that tier under a kernel-isolating container
+  runtime, and *svc-ai-robot* embodies an agent on a dedicated device. Every sandboxed
+  agent acts as its own platform account rather than borrowing yours. See
+  [web-app-hermes](roles/web-app-hermes/README.md),
+  [web-app-openclaw](roles/web-app-openclaw/README.md) and
+  [svc-virt-kata](roles/svc-virt-kata/README.md).
+
+* **Home automation joins the platform.** *web-app-homeassistant* deploys the automation
+  hub, exposes it as an MCP server so agents can drive it, persists the token it mints, and
+  is reachable over tor. See [web-app-homeassistant](roles/web-app-homeassistant/README.md).
+
+* **Changing a password changes it everywhere.** A user declares how its password must be
+  generated, the inventory pins one for every declared user, a new generator produces
+  API-key shapes, the deploy rotates credentials between its two passes, and a reset command
+  exists. Applications that persist an administrator password at install now realign it when
+  the declared one changes: Nextcloud, Moodle, EspoCRM, Jellyfin, Listmonk, Discourse,
+  Checkmk, xWiki, n8n, Matrix and the dedicated MariaDB and Postgres engines. Checkmk keeps
+  a 401 fatal so a wrong password cannot lock the account out.
+
+* **Onions, firewall and name resolution.** *svc-net-firewall* owns the packet filter as one
+  nftables table per role. Tor carries mail to a .onion in both deploy modes, rejects forged
+  sources on the guarded ports, and binds its dnsmasq listeners statically so a failed
+  re-enumeration can no longer drop every one of them. The deployment declares its own
+  address space once, the egress range moved out of the Docker pool, and the container
+  resolver follows the live bridge instead of a guessed address. Every host-bound port
+  requires an explicit onion decision. See
+  [svc-net-firewall](roles/svc-net-firewall/README.md).
+
+* **Application fixes you will notice.** Nextcloud installs an OnlyOffice release upstream
+  actually published, keeps social login working over tor, and makes its OIDC account an
+  administrator. Element shows invites again through the new room list. Moodle survives the
+  container roll during installation. Mattermost keeps its configuration in Postgres instead
+  of on a shared volume, and its plugin tree is per node. GitLab creates the default
+  organization a headless install never gets. Jellyfin waits for health before driving the
+  setup wizard. Keycloak registers redirect URIs only for the apps a play deploys, keeps the
+  allowed-origins claim out of the access token, and no longer caches LDAP federation past a
+  fresh grant. The platform's own health mail no longer eats the sender quota.
+
+* **Operating a deployment.** New make targets reach a single deployed application:
+  *compose-app-exec*, *compose-app-logs* and *compose-app-restart*. Diagnostics collect the
+  logs an application writes to a file, including from busybox containers. Health probes use
+  a fast start cadence with a window that outlasts a real boot, so a slow starter is no
+  longer reaped. The CSP health check accepts a status code a vhost declares instead of
+  dropping the vhost, and gives onion vhosts a navigation budget Tor can meet.
+
+**For Developers**
+
+* **MCP is declared, not wired.** A role states an *mcp* block in *meta/services.yml*, and
+  the vocabulary, discovery and rendering layer derives endpoints, clients, credentials and
+  network edges from it. A client-provider pairing is declared once, on the provider;
+  *sys-svc-mcp-reconcile* converges clients from the complete provider set; a refused pairing
+  is expressed as off rather than gated at the call site; and *svc-ai-mcp-adapter* is a
+  reusable per-provider sidecar rather than a standalone application. The contract is proven
+  on deploy, including refusal on *initialize* and the tool inventory itself. The design,
+  its delegation rules and a machine-checkable audit live under
+  [docs/contributing/design/role/services/mcp.md](docs/contributing/design/role/services/mcp.md).
+
+* **Registry and variant changes.** A variant can dictate the configuration of the providers
+  it pulls in, and an MCP round decides for itself what it carries, which is the breaking
+  change in this release. Fifteen moving pins gained names the registry can order, every MCP
+  provider is registered as a shared service, *meta/schema.yml* finished its rename to
+  *meta/secrets.yml*, role scripts are sorted into per-language folders, and *meta/addons* is
+  now an accepted declaration site for pins and plugins.
+
+* **Lints that fail closed.** Five properties that used to pass silently now fail. The PHP
+  and Ruby that roles ship are syntax-checked, and so are shell scripts that ship as Jinja
+  templates. *sys-service* owns every systemd unit a role installs. Healthcheck timings are
+  judged against what the base image was measured to hold, a variable-free healthcheck
+  belongs in *meta/services.yml*, an unenforceable NFS state layout fails at author time, a
+  sandboxed role cannot be pinned to the manager, credentials are kept out of volumes
+  declared non-secret, *no_log* is required on every task carrying one and forbidden in the
+  test roles, and a JavaScript default for an unset environment variable is rejected.
+
+* **Pins that cannot age unnoticed.** Image pins are classified and pull references built
+  from the class, a moving tag declares itself with the marker it already carries, and a
+  role's images move as one release or not at all. The updater reads addon declarations,
+  orders vendor patch counters and five-component versions, reads a release line written
+  before the number as a family, and now also watches pinned pip requirements and Ansible
+  collections. Seven roles moved off the Debian codename base onto slim, and one Ubuntu
+  mirror list with failover, a short timeout and a health test serves both the package cache
+  and the image builds. *js-yaml* was lifted to 4.3.2 for GHSA-2883-xcg3-v3hh.
+
+* **CI selects, resumes and proves.** A fourth deploy chunk stops a short priority chunk
+  stranding budget, a manual run can set the chunk size the formula would derive, and a
+  retrigger can override the chunk gate. Retriggering works by role and by what never got a
+  verdict, resumes behind the green window rather than the deployed one, retires suites the
+  source run already passed, and cancels the run before retriggering its failed roles. Each
+  role's README instructions are replayed on its smallest deploy row, in the mode its
+  *services.yml* declares. Distro images build concurrently on one runner, the matrix job
+  folds into the image job, and the deploy chunks no longer wait on the DNS test.
+
+* **Swarm, measured rather than assumed.** The deploy waits for its own update instead of
+  guessing after it, refuses to call a stack converged while it is still updating, survives a
+  task that failed and came back, reports what converged rather than only what did not, and
+  says why the convergence probe refused. Placement is constrained to a role's declared
+  platform arch, redis and memcached sidecars get a deploy block, and a run-once service no
+  longer strands the stack deploy waiting for a replica it never has. The rescue dump
+  captures the contents of the state volumes. In the test lab, workers are labelled
+  kata-capable only when the app is sandboxed, NFS detaches before the node containers die,
+  and the sandbox tier gets a second node.
+
+* **Faster gates.** Per-host setup runs once per host instead of once per application, a
+  role's volumes are answered from its own file instead of a whole-tree build, the Keycloak
+  RBAC root group resolves once rather than once per app, the Playwright fixture copy the
+  tree copy already made is dropped, logout helpers wait for a control instead of sleeping,
+  and the OIDC login helper stops waiting out probes that cannot match. Onion timeouts scale
+  by tor flavor instead of a flat multiplier, and every Playwright timeout has one source.
+
+* **Documentation and agent instructions.** Six new requirement documents cover the LLM
+  gateway and model backends, agent employees, Home Assistant, the robot role, the MCP proxy
+  expansion and native AI gateway integration. The MCP design docs are nested under their own
+  folder with an audit the lints can check. The role README template asks the reader for a
+  domain the deployment can resolve, enforces consistent Credits attribution, and drops the em
+  dash. Documentation generators are gathered under *cli/build/docs*, and a new CLI edits role
+  bonds in a matrix instead of hunting through files.
+
+* Image and dependency version jumps (net since 13.0.0):
+  * *svc-ai-ollama*: 0.32.15 to 0.34.0
+  * *svc-db-elasticsearch*: 9.5.2 to 9.5.3
+  * *svc-db-qdrant*: v1.19.0 to v1.19.1
+  * *sys-ctl-hlth-csp* (csp-checker): 2.2.1 to 3.0.4
+  * *sys-lint* (shfmt): v3.13.1 to v3.14.1
+  * *test-e2e-playwright*: v1.62.1-noble to v1.63.0-noble
+  * *web-app-bluesky* (view): 1.131.1 to 1.132.0
+  * *web-app-bookwyrm*: v0.9.2 to v0.9.3
+  * *web-app-confluence*: 10.2.15 to 10.2.18
+  * *web-app-dashboard*: 2.0.0 to 2.1.3
+  * *web-app-erpnext*: v16.32.3 to v16.34.2
+  * *web-app-espocrm*: 10.0.6 to 10.0.8
+  * *web-app-funkwhale*: 2.0.9 to 2.0.10
+  * *web-app-gitea*: 1.27.2 to 1.27.3
+  * *web-app-gitlab* (webservice, sidekiq, workhorse, gitaly, shell, rails): v19.3.0 to v19.3.2
+  * *web-app-jira*: 11.3.10 to 11.3.11
+  * *web-app-keycloak*: 26.7.2 to 26.7.3
+  * *web-app-matrix* (Synapse): v1.159.0 to v1.160.0
+  * *web-app-matrix* (Element): v1.12.26 to v1.12.28
+  * *web-app-mattermost*: 11.10.1 to 11.11.0
+  * *web-app-n8n*: 1.95.3 to 1.100.1
+  * *web-app-nextcloud* (proxy): 1.31.3-alpine to 1.31.5-alpine
+  * *web-app-opentalk* (LiveKit): v1.13.5 to v1.13.6
+  * *web-app-opentalk* (RabbitMQ): 4.3.4 to 4.3.5
+  * *web-app-penpot* (frontend, backend, exporter): 2.17.1 to 2.17.2
+  * *web-app-seaweedfs*: 4.44 to 4.46
+  * *web-app-semaphore*: v2.19.8 to v2.19.14
+  * *web-app-socialhome*: 2026.6.16 to 2026.9.18
+  * *web-app-yourls*: 1.10.4-apache to 1.10.6-apache
+  * *web-app-zammad*: 6.5.0 to 7.1.2
+  * *web-svc-coturn*: 4.17.2 to 4.18.0
+
+* Moving tags that now carry a release, one per role: *web-app-discourse* master to
+  v2026.8.0, *web-app-jenkins* lts to 2.568.3-lts, *web-app-openwebui* main to 0.11.0,
+  *web-app-pretix* stable to 2026.7.0, *web-app-xwiki* lts-postgres-tomcat to
+  17.10.13-postgres-tomcat, *web-app-pixelfed* latest to 20260917, *web-app-matrix* (upstream
+  playbook ref) master to a commit pin, *svc-db-memcached* alpine to 1.6.45-alpine,
+  *svc-db-redis* alpine to 8.10.1-alpine, *svc-prx-openresty* alpine to 1.31.1.1-alpine,
+  *svc-runner* (BuildKit) buildx-stable-1 to v0.33.0, *web-app-bigbluebutton* (dockerize)
+  latest to v0.15.1, and the nginx sidecars of *web-app-fediwall*, *web-app-littlejs*,
+  *web-app-taiga* and *web-svc-coturn* to 1.31.6-alpine. The Debian codename bases became numeric slim tags in
+  *svc-db-openldap* (12.15-slim), *svc-net-tor* (13.6-slim), *web-app-bookwyrm*,
+  *web-app-bridgy-fed*, *web-app-postmarks*, *web-app-roulette-wheel*, *web-svc-cdn* and
+  *web-svc-simpleicons*, and *web-app-flowise* is built from node 24-slim instead of pulled
+  (Flowise itself stays at 3.1.4).
+
+**Contributors**
+
+* [Kevin Veen-Birkenbach](https://veen.world): LLM gateway and model backends, the declared
+  MCP layer and its sidecar, agent employees and the kernel-isolated tier, Home Assistant,
+  credential declaration and rotation, firewall/tor/DNS ownership, variant-dictated provider
+  configuration, the fail-closed lints, CI selection and resume, swarm convergence, and
+  version maintenance
+* [Prageeth Panicker](https://github.com/pragepani): .ansible cache directory ignored
+
 ## [13.0.0] - 2026-08-26
 
 * **Tor as a first-class deployment axis.** The new *svc-net-tor* role routes onion
diff --git a/CLAUDE.md b/CLAUDE.md
deleted file mode 100644
index c468b65997..0000000000
--- a/CLAUDE.md
+++ /dev/null
@@ -1,57 +0,0 @@
-# CLAUDE.md
-
-## Startup: MUST DO at the Start of Every Conversation 🚀
-
-You MUST read `AGENTS.md` and follow all instructions in it at the start of every conversation before doing anything else.
-
-## Permission State Announcement at Session Start 📢
-
-At the start of every new conversation (after reading `AGENTS.md`), you MUST read [.claude/settings.json](.claude/settings.json) and output a one-time summary: sandbox status with concrete `allowWrite`/`denyRead` paths, plus the counts of `permissions.allow`/`ask`/`deny`. Derive content from the live file; do not hardcode. Do not repeat unless the operator asks, and do not propose `/sandbox` when it is already active.
-
-## Interaction Rules 💬
-
-- A question MUST NOT modify files, code, or state. Only explicit commands MAY.
-- You MUST prefer commands permitted in [.claude/settings.json](.claude/settings.json) over commands that require interactive approval when an equivalent exists.
-
-## Code Execution ⚙️
-
-- You MUST prefer `make` targets over raw `docker`/`docker compose`/`ansible-playbook`/`python`/shell invocations whenever an equivalent target exists in the [`Makefile`](Makefile). Inspect the `Makefile` first; fall back to the raw command only when no target covers the operation. The reason is operational consistency, not permissioning. Raw commands also auto-allow under the sandbox.
-- **`docker exec` is FORBIDDEN. ⛔** You MUST NEVER invoke `docker exec` (nor nested `docker exec … docker exec …` into the DiD stack) directly. Always reach the live stack through `make` targets (e.g. `make compose-exec`, or the role-specific targets the `Makefile` exposes). If no `make` target covers what you need, ask the operator instead of falling back to raw `docker exec`.
-- You SHOULD run sandbox-confined commands directly on the host. The sandbox bounds what they can read, write, and reach. See [sandbox.md](docs/contributing/tools/agents/claude/sandbox.md).
-- For commands that legitimately cannot run inside the sandbox (e.g. operations needing access to `~/.ssh` or `~/.gnupg`), use `make compose-up` to start the stack and `make compose-exec` to drop into a container shell. The repository is mounted at `/opt/src/infinito` (see [compose.yml](compose.yml)), so code changes are immediately available there.
-- Commands listed under `permissions.ask` in [.claude/settings.json](.claude/settings.json) still pause for explicit operator confirmation regardless of sandbox state.
-- **Shell loops are FORBIDDEN. ⛔** You MUST NOT use `for`, `while`, `until`, or any other shell loop construct in any Bash tool call. Reason: shell control structures fall outside the sandbox auto-allow heuristic and trigger approval prompts even when every subcommand would individually auto-allow.
-- **Multi-statement chains in shell invocations are FORBIDDEN. ⛔** You MUST NOT chain independent statements inside a single Bash tool call with **any** statement separator (`;`, literal newline, `&&`, `||`, `&` background operator, or subshell/brace groups around the same). The ban covers causally-dependent chains (`cd X && cmd`) just as much as optional ones, and applies to trailing `&` used to background a command (use the Bash tool's `run_in_background: true` parameter instead). Reason: identical to the loop rule. Split the work across **separate Bash tool calls** or use a single-command equivalent (`xargs`, `grep` with multiple args, a make target).
-- **File creation via shell heredoc is FORBIDDEN. ⛔** You MUST NOT use `cat > file <<EOF … EOF` or any variant (`tee > file <<EOF`, `printf "…" > file`, `echo "…" > file` for multi-line content) to create or overwrite files. Use the **Write tool**. For editing an existing file, use **Edit**, not `sed -i`/`awk -i`. Reason: Write/Edit land structured in the transcript and diff; heredoc + redirect shapes also fall out of the auto-allow heuristic and drop into ask.
-- **For searching file contents, use the Grep tool.** If shelling out is unavoidable, use a single `grep` invocation with multiple file arguments (e.g. `grep -nE 'pattern' file1 file2 file3`) or a recursive call with a path/glob (e.g. `grep -rnE 'pattern' path/`).
-- **When a long-running command streams its output to a `/tmp/<name>.log` file** (e.g. background `make compose-deploy`, `make act-*`, or any `… 2>&1 | tee /tmp/<name>.log`), you MUST tell the operator the concrete `tail -f /tmp/<name>.log` command they can run in another terminal to follow the log live. Include the full path literally so it is copy-pasteable.
-
-## Comments 💬⛔
-
-**THIS RULE OVERRIDES YOUR DEFAULT TRAINING. ⛔** A comment is FORBIDDEN unless it is one of exactly three things:
-
-1. **Exception** — names a concrete trip-wire (bug, pitfall, deliberate non-idiomatic choice). Must name the surprise; restating what the next line does is NOT an exception.
-2. **Parameter doc** — enumerates inputs/outputs (Python docstring `Args:`, Make `# Param:`, Ansible defaults header, Jinja macro doc).
-3. **Nocheck directive** — `# nocheck:`, `# noqa:`, `# shellcheck …`, `# type: ignore`, `# pragma: no cover`, etc.
-
-Anything else — restating code, section banners, "Note that …", step narration outside sequential test specs, untracked TODO/FIXME — **DELETE before the edit lands**. Applies to every language and file kind under version control. When in doubt, delete.
-
-## Command output logging 📜
-
-- For ANY non-trivial command (test runs, deploys, long pipelines), you MUST stream the FULL output to a file under `/tmp/` via `… 2>&1 | tee /tmp/<name>.log` and grep / inspect that file repeatedly instead of re-running the command. Reason: re-running `make test` to "find the failure I just lost" costs 2 minutes per cycle; grepping the saved log costs milliseconds.
-- Default the filename to a meaningful slug + monotonically increasing index (`/tmp/make-test-<slug>-<N>.log`, `/tmp/act-<slug>-<N>.log`) so you can compare runs.
-- Tell the operator the exact `tail -f /tmp/<name>.log` command for background runs, per the existing rule.
-
-## Pushing 🚢
-
-- You MUST NOT push, directly or through wrappers that push implicitly.
-- When commits are ready to ship, you MUST instruct the operator to run `git-sign-push` outside the sandbox. The CLI is provided by [git-maintainer-tools](https://github.com/kevinveenbirkenbach/git-maintainer-tools), declared as a dev dependency in [pyproject.toml](pyproject.toml); install it via `make install-python-dev`.
-
-## Configuration 🛠️
-
-- Project-level permissions and sandbox rules are defined in [.claude/settings.json](.claude/settings.json).
-- See [code.claude.com](https://code.claude.com/docs/en/settings) for documentation on how to modify it.
-
-## Documentation 📝
-
-See the [Claude Code documentation](https://code.claude.com/docs/en/overview) for further information. For human contributor guidance on working with agents, see [here](docs/contributing/tools/agents/common.md).
diff --git a/Dockerfile b/Dockerfile
index b1f8bfc0f8..25e3f98710 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,6 +26,24 @@ RUN set -euo pipefail; \
     echo 'accept-flake-config = true' >> /etc/nix/nix.conf; \
   fi
 
+COPY default.env ${INFINITO_SRC_DIR}/default.env
+COPY scripts/install ${INFINITO_SRC_DIR}/scripts/install
+COPY roles/dev-python/files/shell ${INFINITO_SRC_DIR}/roles/dev-python/files/shell
+COPY requirements ${INFINITO_SRC_DIR}/requirements
+COPY utils/__init__.py ${INFINITO_SRC_DIR}/utils/__init__.py
+COPY utils/install/__init__.py ${INFINITO_SRC_DIR}/utils/install/__init__.py
+COPY utils/install/collections.py ${INFINITO_SRC_DIR}/utils/install/collections.py
+
+# hadolint ignore=DL3008,DL3033,DL3041,SC1090,SC3040
+RUN set -euo pipefail; \
+  source <(grep -hE '^INFINITO_PYTHON_INSTALL_SCRIPT=' "${INFINITO_SRC_DIR}/default.env"); \
+  /bin/bash "${INFINITO_SRC_DIR}/${INFINITO_PYTHON_INSTALL_SCRIPT:?}" ensure; \
+  VENV="${INFINITO_VENV_DIR}" bash "${INFINITO_SRC_DIR}/scripts/install/venv.sh"; \
+  ${PIP} install --upgrade pip setuptools wheel; \
+  ${PIP} install ansible PyYAML; \
+  ANSIBLE_COLLECTIONS_DIR="${HOME}/.ansible/collections" \
+    bash "${INFINITO_SRC_DIR}/scripts/install/ansible.sh"
+
 COPY . ${INFINITO_SRC_DIR}
 
 # hadolint ignore=DL3008,DL3033,DL3041,SC1090
diff --git a/GEMINI.md b/GEMINI.md
deleted file mode 100644
index 0b42f87f5a..0000000000
--- a/GEMINI.md
+++ /dev/null
@@ -1,13 +0,0 @@
-# GEMINI.md
-
-## Purpose
-
-This file extends [AGENTS.md](AGENTS.md) with Gemini-specific additions. You MUST read `AGENTS.md` first as the entry point for all agent instructions.
-
-## Current Status
-
-- No Gemini-specific additions are currently defined.
-
-## Documentation
-
-See the [Gemini CLI documentation](https://geminicli.com/docs/cli/gemini-md/). For human contributor guidance on working with agents, see [here](docs/contributing/tools/agents/common.md).
diff --git a/Makefile b/Makefile
index 3845d55688..605131bfe7 100644
--- a/Makefile
+++ b/Makefile
@@ -448,7 +448,6 @@ lint: install-lint
 		lint-packages \
 		lint-php \
 		lint-playwright \
-		lint-php \
 		lint-python \
 		lint-ruby \
 		lint-shellcheck \
@@ -808,7 +807,7 @@ swarm-zombie: install-act
 	 ACT_WORKFLOW=.github/workflows/call-test-deploy.yml \
 	 ACT_JOB=deploy \
 	 ACT_MATRIX="apps:$(app);variant:$(or $(variant),0);mode:swarm" \
-	 ACT_INPUTS="whitelist=$(app) distros=$(SWARM_DISTROS) index=0 sweep=0 modes=swarm disable=$(disable)" \
+	 ACT_INPUTS="whitelist=$(app)#$(or $(variant),0)@swarm distros=$(SWARM_DISTROS) index=0 sweep=0 modes=swarm disable=$(disable)" \
 	 bash scripts/tests/deploy/act/workflow.sh
 
 .PHONY: system-purge
diff --git a/README.md b/README.md
index bd41331f35..619a9d0c95 100644
--- a/README.md
+++ b/README.md
@@ -92,6 +92,7 @@ Every invokable role in the tested lifecycle envelope, with its upstream homepag
 | [Fediwall](roles/web-app-fediwall/) | beta | Self-hosted Fediverse wall for showing recent public posts by hashtag or account in a live masonry grid | [🌐](https://github.com/defnull/fediwall) [🛠️](roles/web-app-fediwall/README.md#quick-setup) | [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Friendica](roles/web-app-friendica/), [Mastodon](roles/web-app-mastodon/), [Matomo](roles/web-app-matomo/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/) |
 | [Fider](roles/web-app-fider/) | beta | Open-source community feedback platform for collecting, voting on, and prioritizing feature requests and ideas | [🌐](https://www.fider.io/) [🛠️](roles/web-app-fider/README.md#quick-setup) | [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Hermes Agent](roles/web-app-hermes/), [Keycloak](roles/web-app-keycloak/), [Mailu](roles/web-app-mailu/), [Matomo](roles/web-app-matomo/), [Open WebUI](roles/web-app-openwebui/), [OpenClaw](roles/web-app-openclaw/), [PostgreSQL](roles/svc-db-postgres/), [Prometheus](roles/web-app-prometheus/), [SeaweedFS](roles/web-app-seaweedfs/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
 | [File Server](roles/web-svc-file/) | beta | Static file server over HTTPS with directory listing, .well-known handling, and automatic TLS certificates | [🛠️](roles/web-svc-file/README.md#quick-setup) | [Corporate Design](roles/web-svc-css/), [Matomo](roles/web-app-matomo/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/) |
+| [Firewall ruleset](roles/svc-net-firewall/) | beta | nftables packet filter whose rules each role owns as its own table, replaced atomically and reloaded at boot | [🌐](https://www.netfilter.org/projects/nftables/) [🎬](https://www.youtube.com/watch?v=EGKhIljDPCw) [🛠️](roles/svc-net-firewall/README.md#quick-setup) |  |
 | [Flowise](roles/web-app-flowise/) | beta | Low-code visual builder for creating, testing, and publishing LLM and RAG workflows as HTTP endpoints | [🌐](https://flowiseai.com/) [🎬](https://www.youtube.com/watch?v=h_0TJTY6Ulg) [🛠️](roles/web-app-flowise/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [LiteLLM Gateway](roles/svc-ai-litellm/), [Mailu](roles/web-app-mailu/), [Matomo](roles/web-app-matomo/), [Ollama](roles/svc-ai-ollama/), [PostgreSQL](roles/svc-db-postgres/), [Prometheus](roles/web-app-prometheus/), [Qdrant](roles/svc-db-qdrant/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
 | [Friendica](roles/web-app-friendica/) | beta | Decentralized, federated social-networking platform for peer-to-peer communication and community building | [🌐](https://friendi.ca/) [🛠️](roles/web-app-friendica/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [Mailu](roles/web-app-mailu/), [MariaDB](roles/svc-db-mariadb/), [Matomo](roles/web-app-matomo/), [OpenLDAP](roles/svc-db-openldap/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
 | [Funkwhale](roles/web-app-funkwhale/) | beta | Self-hosted, federated platform for sharing, hosting, and streaming your own music and audio library | [🌐](https://www.funkwhale.audio/) [🛠️](roles/web-app-funkwhale/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [Mailu](roles/web-app-mailu/), [Matomo](roles/web-app-matomo/), [OpenLDAP](roles/svc-db-openldap/), [PostgreSQL](roles/svc-db-postgres/), [Prometheus](roles/web-app-prometheus/), [Redis](roles/svc-db-redis/), [SeaweedFS](roles/web-app-seaweedfs/), [Tor Onion Service](roles/svc-net-tor/), [Typesense](roles/svc-db-typesense/), [Universal Logout](roles/web-svc-logout/) |
@@ -176,7 +177,7 @@ Every invokable role in the tested lifecycle envelope, with its upstream homepag
 | [SuiteCRM](roles/web-app-suitecrm/) | beta | Open-source CRM platform for sales, service, cases, and campaign management with workflow automation | [🌐](https://suitecrm.com/) [🎬](https://www.youtube.com/watch?v=pOAs_C3Fp_E) [🛠️](roles/web-app-suitecrm/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [Mailu](roles/web-app-mailu/), [MariaDB](roles/svc-db-mariadb/), [Matomo](roles/web-app-matomo/), [OpenLDAP](roles/svc-db-openldap/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
 | [Swapfile](roles/svc-opt-swapfile/) | beta | On-target automation for creating and activating swap space via a cloned swapfile script | [🛠️](roles/svc-opt-swapfile/README.md#quick-setup) |  |
 | [Taiga](roles/web-app-taiga/) | beta | Open-source agile project management platform for Scrum, Kanban, and hybrid team workflows | [🌐](https://taiga.io/) [🎬](https://www.youtube.com/watch?v=TYPX8nQEU5I) [🛠️](roles/web-app-taiga/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [Mailu](roles/web-app-mailu/), [Matomo](roles/web-app-matomo/), [OpenLDAP](roles/svc-db-openldap/), [PostgreSQL](roles/svc-db-postgres/), [Prometheus](roles/web-app-prometheus/), [SeaweedFS](roles/web-app-seaweedfs/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
-| [Tor Onion Service](roles/svc-net-tor/) | alpha | Tor daemon publishing the node as a v3 onion service | [🛠️](roles/svc-net-tor/README.md#quick-setup) | [Asset Mirror (Privacy Proxy)](roles/web-svc-mirror/) |
+| [Tor Onion Service](roles/svc-net-tor/) | beta | Tor daemon publishing the node as a v3 onion service | [🛠️](roles/svc-net-tor/README.md#quick-setup) | [Asset Mirror (Privacy Proxy)](roles/web-svc-mirror/) |
 | [Typesense](roles/svc-db-typesense/) | beta | Central Dockerized search engine shared by multiple apps with per-consumer scoped API keys | [🌐](https://typesense.org/) [🛠️](roles/svc-db-typesense/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Tor Onion Service](roles/svc-net-tor/) |
 | [Unbound](roles/svc-dns-unbound/) | beta | Central recursive/forwarding DNSSEC resolver on a static IP for consumer stacks to target as their DNS | [🌐](https://nlnetlabs.nl/projects/unbound/about/) [🛠️](roles/svc-dns-unbound/README.md#quick-setup) |  |
 | [Universal Logout](roles/web-svc-logout/) | beta | Central logout proxy for single-action sign-out across all OIDC-connected apps, with Nginx snippets and a live status UI | [🛠️](roles/web-svc-logout/README.md#quick-setup) | [Corporate Design](roles/web-svc-css/), [Matomo](roles/web-app-matomo/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/) |
diff --git a/cli/administration/deploy/development/init.py b/cli/administration/deploy/development/init.py
index 6b69dd919b..de711ef911 100644
--- a/cli/administration/deploy/development/init.py
+++ b/cli/administration/deploy/development/init.py
@@ -175,9 +175,9 @@ def handler(args: argparse.Namespace) -> int:
 
     if len(plan) == 1:
         _, inv_dir, round_variants, include_R, _purge_set = plan[0]
-        non_zero = {a: i for a, i in round_variants.items() if i}
-        suffix = f" variants={non_zero}" if non_zero else ""
         shown = built_includes.get(inv_dir, include_R)
+        non_zero = {a: i for a, i in round_variants.items() if i and a in shown}
+        suffix = f" variants={non_zero}" if non_zero else ""
         print(
             f">>> Inventory initialized at {inv_dir} "
             f"(include={','.join(shown)} "
@@ -189,8 +189,8 @@ def handler(args: argparse.Namespace) -> int:
             f"(primary_apps={','.join(primary_apps)}):"
         )
         for round_index, inv_dir, round_variants, include_R, _purge_set in plan:
-            non_zero = {a: i for a, i in round_variants.items() if i}
             shown = built_includes.get(inv_dir, include_R)
+            non_zero = {a: i for a, i in round_variants.items() if i and a in shown}
             print(
                 f"    [round {round_index}] {inv_dir} "
                 f"include={','.join(shown)} "
diff --git a/cli/administration/deploy/development/inventory/legacy_resolver.py b/cli/administration/deploy/development/inventory/legacy_resolver.py
index 5b70ba0698..0ea121f90c 100644
--- a/cli/administration/deploy/development/inventory/legacy_resolver.py
+++ b/cli/administration/deploy/development/inventory/legacy_resolver.py
@@ -6,96 +6,22 @@ to this path — the `CombinedResolver` walks `dependencies` and
 evaluated at deploy time against `group_names`. `run_after` is NOT
 followed for inclusion (it is a pure ordering hint), so a variant that
 disables a service does not get the provider re-added through the
-ordering edge. This module owns the two helpers that path needs and
-nothing else; the variant-only path lives in `.variants`.
+ordering edge. This module owns the include resolution that path needs
+and nothing else; the round's variant-merged services maps come from
+`utils.roles.applications.variants`, which the CI selection resolves its
+closure from as well.
 """
 
 from __future__ import annotations
 
-from collections.abc import Iterable, Mapping, Sequence
-from pathlib import Path
+from typing import TYPE_CHECKING
 
-from utils.cache.applications import get_variants
-from utils.cache.base import _deep_merge
-from utils.cache.yaml import load_yaml_any
-from utils.roles.mapping import ROLE_FILE_META_SERVICES
+from utils.roles.applications.variants import services_overrides_for_round
 
-from .nested_overrides import apply_topic, collect_provider_overrides
+if TYPE_CHECKING:
+    from collections.abc import Iterable, Sequence
 
-
-def _build_services_overrides_for_round(
-    *,
-    roles_dir: str,
-    round_index: int,
-    primary_app_variants: Mapping[str, int],
-) -> dict[str, dict]:
-    """For every role with `meta/variants.yml`, return the services map
-    that results from merging the round's variant payload onto the
-    role's on-disk `meta/services.yml`.
-
-    Apps in `primary_app_variants` use the supplied (already clamped)
-    index. Other roles with their own variants clamp `round_index` to
-    their own variant count. Roles without variants are absent from the
-    result so the resolver falls through to its disk-read path.
-
-    The merged map is what the inventory ALSO bakes into host_vars, so
-    feeding the same dict into `CombinedResolver(services_overrides=...)`
-    eliminates the topology-vs-host_vars drift that variant-blind
-    resolution produced.
-    """
-    variants_per_app = get_variants(roles_dir=roles_dir)
-    overrides: dict[str, dict] = {}
-    roles_path = Path(roles_dir)
-    for role_name, variant_list in variants_per_app.items():
-        if not variant_list:
-            continue
-        variant_count = max(1, len(variant_list))
-        if role_name in primary_app_variants:
-            idx = primary_app_variants[role_name]
-        else:
-            idx = round_index if round_index < variant_count else 0
-        if not 0 <= idx < len(variant_list):
-            idx = 0
-        variant_payload = variant_list[idx] if variant_list else {}
-        if not isinstance(variant_payload, Mapping):
-            variant_payload = {}
-        variant_services = variant_payload.get("services", {})
-        if not isinstance(variant_services, Mapping):
-            continue
-        services_path = roles_path / role_name / ROLE_FILE_META_SERVICES
-        if not services_path.exists():
-            continue
-        try:
-            base_services = load_yaml_any(services_path) or {}
-        except Exception:  # noqa: S112  best-effort iteration over role files; skip malformed input
-            continue
-        if not isinstance(base_services, Mapping):
-            continue
-        merged = _deep_merge(dict(base_services), dict(variant_services))
-        if isinstance(merged, dict):
-            overrides[role_name] = merged
-    _apply_nested_service_maps(overrides, roles_dir=roles_dir)
-    return overrides
-
-
-def _apply_nested_service_maps(overrides: dict[str, dict], *, roles_dir: str) -> None:
-    """Replace a pulled-in provider's services map with what the round demands.
-
-    Only the ``services`` topic reaches this path: the closure walks service
-    edges, so the other config topics a variant may override are the inventory
-    bake's business.
-
-    Args:
-        overrides: ``{role: services map}``, mutated in place.
-        roles_dir: roles directory the service registry is built from.
-    """
-    payloads = {role: {"services": services} for role, services in overrides.items()}
-    for provider, topics in collect_provider_overrides(
-        payloads, roles_dir=roles_dir
-    ).items():
-        if "services" not in topics:
-            continue
-        overrides[provider] = apply_topic(overrides.get(provider), topics["services"])
+_build_services_overrides_for_round = services_overrides_for_round
 
 
 def _resolve_round_include(
diff --git a/cli/administration/deploy/development/inventory/nested_overrides.py b/cli/administration/deploy/development/inventory/nested_overrides.py
deleted file mode 100644
index b17a362b13..0000000000
--- a/cli/administration/deploy/development/inventory/nested_overrides.py
+++ /dev/null
@@ -1,90 +0,0 @@
-"""Collect the provider config a round's variants dictate.
-
-The topic vocabulary and merge semantics live in
-``utils.roles.applications.topics``; this module resolves which role demands
-what, and refuses two roles demanding different things for one provider.
-
-Only a config topic counts, and only on an entry naming another role's
-service. A role's own entity entry is skipped, which is what keeps the two
-existing `services.<own>.users` / `services.<own>.domains` declarations from
-being read as overrides.
-"""
-
-from __future__ import annotations
-
-from collections.abc import Mapping
-from pathlib import Path
-from typing import Any
-
-from utils.roles.applications.services.registry import (
-    build_service_registry_from_roles_dir,
-)
-from utils.roles.applications.topics import CONFIG_TOPICS, apply_topic, provider_of
-
-__all__ = ["CONFIG_TOPICS", "NestedOverrideConflictError", "apply_topic"]
-
-
-class NestedOverrideConflictError(RuntimeError):
-    """Two roles in one round demand different config for one provider."""
-
-
-def _claims(payloads: Mapping[str, Any]) -> list[tuple[str, str, str, Any]]:
-    """Return the ``(role, service_key, topic, value)`` a round's payloads carry.
-
-    Args:
-        payloads: ``{role: variant payload}`` for one round.
-
-    Reading this before the service registry keeps a round whose variants
-    override nothing from paying for the registry at all.
-    """
-    claims: list[tuple[str, str, str, Any]] = []
-    for role_name, payload in payloads.items():
-        if not isinstance(payload, Mapping):
-            continue
-        services = payload.get("services")
-        if not isinstance(services, Mapping):
-            continue
-        for service_key, entry in services.items():
-            if not isinstance(entry, Mapping):
-                continue
-            claims.extend(
-                (role_name, service_key, topic, entry[topic])
-                for topic in sorted(CONFIG_TOPICS & set(entry))
-            )
-    return claims
-
-
-def collect_provider_overrides(
-    payloads: Mapping[str, Any], *, roles_dir: str
-) -> dict[str, dict[str, Any]]:
-    """Return ``{provider: {topic: value}}`` demanded by the round's payloads.
-
-    Args:
-        payloads: ``{role: variant payload}`` for one round.
-        roles_dir: roles directory the service registry is built from.
-
-    Raises:
-        NestedOverrideConflictError: two roles demand different values for the
-            same topic of the same provider.
-    """
-    claims = _claims(payloads)
-    if not claims:
-        return {}
-
-    registry = build_service_registry_from_roles_dir(Path(roles_dir))
-    demanded: dict[str, dict[str, Any]] = {}
-    claimed_by: dict[tuple[str, str], str] = {}
-    for role_name, service_key, topic, value in claims:
-        provider = provider_of(service_key, registry)
-        if not provider or provider == role_name:
-            continue
-        previous = claimed_by.get((provider, topic))
-        if previous and demanded[provider][topic] != value:
-            raise NestedOverrideConflictError(
-                f"{role_name} and {previous} demand different "
-                f"{topic!r} for {provider!r} in the same round; a "
-                f"round deploys it once, so the two cannot both hold"
-            )
-        demanded.setdefault(provider, {})[topic] = value
-        claimed_by[(provider, topic)] = role_name
-    return demanded
diff --git a/cli/administration/deploy/development/inventory/payload.py b/cli/administration/deploy/development/inventory/payload.py
index 6421739441..ce9b6a4561 100644
--- a/cli/administration/deploy/development/inventory/payload.py
+++ b/cli/administration/deploy/development/inventory/payload.py
@@ -14,8 +14,8 @@ from collections.abc import Mapping, Sequence
 from typing import Any
 
 from utils.cache.applications import get_variant_overrides_only
-
-from .nested_overrides import apply_topic, collect_provider_overrides
+from utils.roles.applications.topics import apply_topic
+from utils.roles.applications.variants import collect_provider_overrides
 
 
 def _resolve_variant_payloads(
diff --git a/cli/administration/deploy/development/inventory/planner.py b/cli/administration/deploy/development/inventory/planner.py
index 8dcfdff18d..99e64a74c4 100644
--- a/cli/administration/deploy/development/inventory/planner.py
+++ b/cli/administration/deploy/development/inventory/planner.py
@@ -103,11 +103,10 @@ def plan_dev_inventory_matrix(
         round_include = per_variant_includes[round_index]
 
         round_variants = dict(primary_round_variants)
-        for dep in round_include:
+        for dep, dep_variants in variants_per_app.items():
             if dep in round_variants:
                 continue
-            dep_variants = variants_per_app.get(dep) or [{}]
-            dep_count = max(1, len(dep_variants))
+            dep_count = max(1, len(dep_variants or [{}]))
             round_variants[dep] = round_index if round_index < dep_count else 0
 
         inv_dir = f"{base}-{round_index}" if total_rounds > 1 else base
diff --git a/cli/administration/inventory/credentials/reset/cli.py b/cli/administration/inventory/credentials/reset/cli.py
index 0d901aec54..9287c30b65 100644
--- a/cli/administration/inventory/credentials/reset/cli.py
+++ b/cli/administration/inventory/credentials/reset/cli.py
@@ -119,6 +119,18 @@ def main(argv: list[str] | None = None) -> int:
         default=[],
         help="Application ids and user keys to leave untouched (e.g. administrator).",
     )
+    parser.add_argument(
+        "--include",
+        nargs="*",
+        default=None,
+        help=(
+            "Application ids whose credentials rotate. Absent rotates every "
+            "application block in the file, which on a matrix inventory is "
+            "every mirror artefact too, not just the ids the round "
+            "provisioned. User passwords ignore this and always rotate in "
+            "full."
+        ),
+    )
     parser.add_argument(
         "--app-variants",
         default=None,
@@ -161,16 +173,26 @@ def main(argv: list[str] | None = None) -> int:
     if not application_ids:
         raise SystemExit(f"No applications block to rotate in {host_vars_file}")
 
+    credential_ids = None
+    if args.include is not None:
+        wanted = set(args.include)
+        credential_ids = [app_id for app_id in application_ids if app_id in wanted]
+        if not credential_ids:
+            raise SystemExit(f"--include matches no block in {host_vars_file}")
+
     if args.backup:
         print(f"[INFO] Pre-rotation copy: {_backup(host_vars_file)}")
 
     exclude = set(args.exclude)
     print(
         f"[INFO] Rotating credentials in {host_vars_file} "
-        f"({len(application_ids)} applications, excluding {sorted(exclude) or 'nothing'})"
+        f"({len(credential_ids or application_ids)} applications, "
+        f"{len(application_ids)} for users, "
+        f"excluding {sorted(exclude) or 'nothing'})"
     )
     rotated = reset_credentials(
         application_ids=application_ids,
+        credential_ids=credential_ids,
         roles_dir=(project_root / "roles").resolve(),
         host_vars_file=host_vars_file,
         vault_password_file=vault_password_file,
diff --git a/cli/administration/inventory/provision/reset.py b/cli/administration/inventory/provision/reset.py
index 19f24de29c..54e5bfba82 100644
--- a/cli/administration/inventory/provision/reset.py
+++ b/cli/administration/inventory/provision/reset.py
@@ -117,13 +117,17 @@ def _drop_app_credentials(
     document: CommentedMap,
     exclude: set[str],
     pinned: dict[str, set[tuple[str, ...]]],
+    application_ids: list[str],
 ) -> int:
-    """Remove the generated credentials of every application in ``document``.
+    """Remove the generated credentials of the applications being rotated.
 
     Args:
         document: the host_vars document.
         exclude: application ids to leave untouched.
         pinned: per-application credential paths that must survive a rotation.
+        application_ids: the ids the caller regenerates afterwards. Passing a
+            narrower set here than the caller regenerates would drop
+            credentials nothing writes back.
 
     Returns:
         How many values were removed.
@@ -132,10 +136,13 @@ def _drop_app_credentials(
     if not isinstance(applications, CommentedMap):
         return 0
 
+    rotated = set(application_ids)
     dropped = 0
     for application_id, application in applications.items():
         if application_id in exclude or not isinstance(application, CommentedMap):
             continue
+        if str(application_id) not in rotated:
+            continue
         secrets = application.get(SECRETS_KEY)
         if not isinstance(secrets, CommentedMap):
             continue
@@ -194,6 +201,7 @@ def reset_credentials(
     exclude: set[str],
     workers: int = 4,
     app_variants: dict[str, int] | None = None,
+    credential_ids: list[str] | None = None,
 ) -> int:
     """Replace every generated credential in ``host_vars_file`` with a fresh one.
 
@@ -209,6 +217,9 @@ def reset_credentials(
         exclude: application ids and user keys to leave untouched.
         workers: worker threads for credentials generation.
         app_variants: variant index per app, as at provision time.
+        credential_ids: application ids whose credentials rotate; ``None``
+            rotates all of ``application_ids``. User passwords ignore it and
+            always resolve through the full ``application_ids``.
 
     Returns:
         How many values were rotated.
@@ -216,11 +227,12 @@ def reset_credentials(
     if not schema and not users:
         raise SystemExit("reset_credentials: pick at least one of schema, users")
 
+    rotated_ids = application_ids if credential_ids is None else credential_ids
     document = load_document(host_vars_file)
     dropped = 0
     if schema:
         dropped += _drop_app_credentials(
-            document, exclude, _pinned_credentials(roles_dir)
+            document, exclude, _pinned_credentials(roles_dir), rotated_ids
         )
     if users:
         dropped += _drop_user_passwords(document, roles_dir, application_ids, exclude)
@@ -228,7 +240,7 @@ def reset_credentials(
 
     if schema:
         generate_credentials_for_roles(
-            application_ids=application_ids,
+            application_ids=rotated_ids,
             roles_dir=roles_dir,
             host_vars_file=host_vars_file,
             vault_password_file=vault_password_file,
diff --git a/cli/administration/inventory/provision/services_disabler.py b/cli/administration/inventory/provision/services_disabler.py
index 7f01e59260..33b4ac0cb1 100644
--- a/cli/administration/inventory/provision/services_disabler.py
+++ b/cli/administration/inventory/provision/services_disabler.py
@@ -86,6 +86,21 @@ def find_roles_with_service(service_name: str, roles_dir: Path) -> set[str]:
     return role_ids
 
 
+def _declared_toggles(app_id: str, svc_name: str, roles_dir: Path) -> list[str]:
+    """The toggles this role's contract carries for this service, in file order.
+
+    `compare_application_keys` rejects any host_vars key the role contract does
+    not declare, so writing a toggle the role never had turns a `disable=` run
+    into an inventory the validator refuses. 34 service blocks declare
+    `enabled` without `shared`.
+    """
+    services = _load_yaml_mapping_tolerant(roles_dir / app_id / ROLE_FILE_META_SERVICES)
+    entry = services.get(svc_name) if services else None
+    if not isinstance(entry, dict):
+        return []
+    return [flag for flag in ("enabled", "shared") if flag in entry]
+
+
 def find_provider_roles(services: list[str], roles_dir: Path) -> dict[str, str]:
     """
     Return mapping of service_name -> application_id for the provider role of each
@@ -204,17 +219,19 @@ def apply_services_disabled(
                 svc_map = CommentedMap()
                 app_data["services"] = svc_map
 
+            flags = _declared_toggles(app_id, svc_name, roles_dir)
+            if not flags:
+                continue
+
             svc = svc_map.get(svc_name)
             if not isinstance(svc, CommentedMap):
                 svc = CommentedMap()
                 svc_map[svc_name] = svc
-            svc["enabled"] = False
-            svc["shared"] = False
+            for flag in flags:
+                svc[flag] = False
             changed = True
-            print(
-                f"[INFO] disable: {app_id}.services.{svc_name} "
-                "→ enabled=false, shared=false"
-            )
+            written = ", ".join(f"{flag}=false" for flag in flags)
+            print(f"[INFO] disable: {app_id}.services.{svc_name} → {written}")
 
     if changed:
         with host_vars_file.open("w", encoding="utf-8") as f:
diff --git a/cli/build/docs/readme/generate.py b/cli/build/docs/readme/generate.py
index 40a76041ab..201362567f 100644
--- a/cli/build/docs/readme/generate.py
+++ b/cli/build/docs/readme/generate.py
@@ -70,6 +70,19 @@ def _app_name(preamble: str, role_name: str) -> str:
     return entity.replace("-", " ").title()
 
 
+def _needs_clearnet_resolver(role_dir) -> bool:
+    """Whether the role refuses to deploy without ``networks.internet.dns``.
+
+    Only the inventories under ``inventories/development/`` set that value, so a
+    role asserting it has to name it in the block an operator copies, or the
+    documented deploy aborts on the assert.
+    """
+    return any(
+        "networks.internet.dns" in read_text(str(path))
+        for path in sorted((role_dir / "tasks").rglob("*.yml"))
+    )
+
+
 def _base_context(role_dir, role_name: str, app_name: str, *, invokable: bool) -> dict:
     return {
         "application_id": role_name,
@@ -84,6 +97,7 @@ def _base_context(role_dir, role_name: str, app_name: str, *, invokable: bool) -
         "application_author": _role_author(role_dir),
         "application_author_url": author_urls().get(_role_author(role_dir)),
         "application_is_host": not role_has_stack(role_dir),
+        "application_needs_clearnet_resolver": _needs_clearnet_resolver(role_dir),
         "cosmos_mermaid": derive_cosmos_mermaid(role_dir, role_name),
         "cosmos_legend": _cosmos_legend(),
     }
diff --git a/cli/contributing/update/collection_source/__init__.py b/cli/contributing/update/collection_source/__init__.py
new file mode 100644
index 0000000000..ab2c0b6137
--- /dev/null
+++ b/cli/contributing/update/collection_source/__init__.py
@@ -0,0 +1,5 @@
+"""CLI entry point package for retuning the preferred collection source."""
+
+from pathlib import Path
+
+PROJECT_ROOT: Path = Path(__file__).resolve().parents[4]
diff --git a/cli/contributing/update/collection_source/__main__.py b/cli/contributing/update/collection_source/__main__.py
new file mode 100755
index 0000000000..f0ffb7694e
--- /dev/null
+++ b/cli/contributing/update/collection_source/__main__.py
@@ -0,0 +1,158 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import subprocess
+import sys
+import time
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from utils.update.collection_source import (
+    RATIO,
+    SOURCES,
+    WINDOW,
+    append_sample,
+    decide,
+    load_history,
+)
+
+from . import PROJECT_ROOT
+
+SETTING = "INFINITO_ANSIBLE_COLLECTIONS_SOURCE"
+REQUIREMENTS = {
+    "galaxy": Path("requirements/requirements.galaxy.yml"),
+    "git": Path("requirements/requirements.git.yml"),
+}
+
+
+def read_preferred(env_file: Path) -> str:
+    """The source currently tried first, as declared in default.env.
+
+    Args:
+        env_file: the default.env holding the setting.
+    """
+    match = re.search(
+        rf"^{SETTING}=(\S+)\s*$",
+        env_file.read_text(
+            encoding="utf-8"
+        ),  # nocheck: cache-read -- write_preferred rewrites this file in the same run
+        re.MULTILINE,
+    )
+    if match is None:
+        raise SystemExit(f"{SETTING} is not declared in {env_file}")
+    return match.group(1)
+
+
+def write_preferred(env_file: Path, source: str) -> None:
+    """Point the setting at SOURCE.
+
+    Args:
+        env_file: the default.env holding the setting.
+        source: the source to try first from now on.
+    """
+    text = env_file.read_text(
+        encoding="utf-8"
+    )  # nocheck: cache-read -- rewritten on the next line
+    env_file.write_text(
+        re.sub(rf"^{SETTING}=\S+$", f"{SETTING}={source}", text, flags=re.MULTILINE),
+        encoding="utf-8",
+    )
+
+
+def measure(repo_root: Path, requirements: Path, timeout: int) -> float | None:
+    """Seconds a cold install from REQUIREMENTS takes, or None when it fails.
+
+    Args:
+        repo_root: repository root the requirements path is relative to.
+        requirements: the requirements file to install from.
+        timeout: seconds after which the install counts as failed.
+    """
+    with TemporaryDirectory() as target:
+        started = time.monotonic()
+        try:
+            completed = subprocess.run(
+                [
+                    sys.executable,
+                    "-m",
+                    "ansible.cli.galaxy",
+                    "collection",
+                    "install",
+                    "-r",
+                    str(repo_root / requirements),
+                    "-p",
+                    target,
+                    "--force-with-deps",
+                ],
+                capture_output=True,
+                text=True,
+                timeout=timeout,
+                check=False,
+            )
+        except subprocess.TimeoutExpired:
+            return None
+        elapsed = time.monotonic() - started
+    return elapsed if completed.returncode == 0 else None
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description=(
+            "Time both collection sources, record the sample, and retune the "
+            "preferred default when one source is durably slower."
+        )
+    )
+    parser.add_argument("--repo-root", type=Path, default=PROJECT_ROOT)
+    parser.add_argument(
+        "--history",
+        type=Path,
+        default=None,
+        help="JSON file holding the rolling window of samples",
+    )
+    parser.add_argument(
+        "--timeout",
+        type=int,
+        default=900,
+        help="Seconds after which one install counts as failed",
+    )
+    args = parser.parse_args()
+
+    repo_root = args.repo_root.resolve()
+    env_file = repo_root / "default.env"
+    history_file = (
+        args.history or repo_root / "build" / "collection-source-history.json"
+    )
+
+    sample: dict[str, float | None] = {}
+    for source in SOURCES:
+        seconds = measure(repo_root, REQUIREMENTS[source], args.timeout)
+        sample[source] = seconds
+        print(f"{source}: {'failed' if seconds is None else f'{seconds:.1f}s'}")
+
+    history = append_sample(load_history(history_file), sample)
+    history_file.parent.mkdir(parents=True, exist_ok=True)
+    history_file.write_text(json.dumps(history, indent=2), encoding="utf-8")
+
+    preferred = read_preferred(env_file)
+    verdict = decide(history, preferred)
+    print(
+        f"samples: {verdict.samples}/{WINDOW}, "
+        f"medians: {verdict.medians}, preferred: {verdict.preferred}"
+    )
+
+    if not verdict.changed:
+        print("Preferred collection source stays unchanged.")
+        return 0
+
+    write_preferred(env_file, verdict.proposed)
+    print(
+        f"Preferred collection source {verdict.preferred} -> {verdict.proposed}: "
+        f"its median is at least {RATIO}x the other's over {WINDOW} samples."
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/cli/contributing/update/galaxy/__init__.py b/cli/contributing/update/galaxy/__init__.py
new file mode 100644
index 0000000000..f79db0b735
--- /dev/null
+++ b/cli/contributing/update/galaxy/__init__.py
@@ -0,0 +1,5 @@
+"""CLI entry point package for pinned Ansible collection updates."""
+
+from pathlib import Path
+
+PROJECT_ROOT: Path = Path(__file__).resolve().parents[4]
diff --git a/cli/contributing/update/galaxy/__main__.py b/cli/contributing/update/galaxy/__main__.py
new file mode 100755
index 0000000000..c83fb083be
--- /dev/null
+++ b/cli/contributing/update/galaxy/__main__.py
@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+from utils.update.galaxy import apply_updates, find_outdated_updates
+
+from . import PROJECT_ROOT
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description=(
+            "Update pinned Ansible collection versions in requirements/ to their "
+            "latest upstream release tag."
+        )
+    )
+    parser.add_argument(
+        "--repo-root",
+        type=Path,
+        default=PROJECT_ROOT,
+        help="Repository root to scan and update",
+    )
+    parser.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Print planned updates without modifying files",
+    )
+    args = parser.parse_args()
+
+    repo_root = args.repo_root.resolve()
+    updates = find_outdated_updates(repo_root)
+
+    if not updates:
+        print("Pinned Ansible collections are already up to date.")
+        return 0
+
+    print("Planned collection pin updates:")
+    for update in updates:
+        print(f"- {update.pin.fqcn} {update.pin.version} -> {update.latest}")
+
+    if args.dry_run:
+        return 0
+
+    changed_paths = apply_updates(repo_root, updates)
+    if changed_paths:
+        print("\nUpdated files:")
+        for path in changed_paths:
+            print(f"- {path.relative_to(repo_root)}")
+    else:
+        print("\nNo files changed.")
+
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/cli/meta/ci/dev_runtime.py b/cli/meta/ci/dev_runtime.py
index ff4f248163..ebb196d178 100644
--- a/cli/meta/ci/dev_runtime.py
+++ b/cli/meta/ci/dev_runtime.py
@@ -28,7 +28,7 @@ def image_label(image: str) -> str:
     """Shorten a dev-runtime image to its last two registry segments.
 
     ``quay.io/centos/centos:latest`` becomes ``centos:latest``; a two-segment
-    image such as ``debian:bookworm`` is returned unchanged.
+    image such as ``debian:13`` is returned unchanged.
 
     Args:
         image: full image reference.
diff --git a/cli/meta/ci/slots.py b/cli/meta/ci/slots.py
index 2a59db7fd0..bffd2df69e 100644
--- a/cli/meta/ci/slots.py
+++ b/cli/meta/ci/slots.py
@@ -142,7 +142,15 @@ def waves(repo_root: Path | None = None) -> int:
 
 
 def chunk_size(repo_root: Path | None = None) -> int:
-    """Rows one chunk may hold before its tail risks the queue cancel."""
+    """Rows one chunk may hold before its tail risks the queue cancel.
+
+    ``INFINITO_CI_CHUNK_SIZE`` takes precedence when set; 0 derives the value
+    from the runner slots a chunk may assume and the waves the queue window
+    affords.
+    """
+    override = setting("INFINITO_CI_CHUNK_SIZE")
+    if override > 0:
+        return override
     return setting("INFINITO_CI_CONCURRENCY") * waves(repo_root)
 
 
diff --git a/cli/meta/ci/validate.py b/cli/meta/ci/validate.py
index 97708c884d..abc3943f76 100644
--- a/cli/meta/ci/validate.py
+++ b/cli/meta/ci/validate.py
@@ -15,16 +15,18 @@ here instead, and the exit code gates the run.
 What makes a token bad, in the order this checks it:
 
 * it does not parse, or names a mode or onion state that does not exist;
-* it names a role the discovery query does not return -- a typo, a role
-  outside the run's lifecycle envelope, or a role that no longer exists;
 * it pins a variant the role does not declare (any more): the usual case is a
   list carried over from an older run whose variants have since been renumbered;
 * it pins a mode the row cannot take, an onion state the row, the mode or the
   run's own tor axis rules out, or a distro or filesystem the run's own pool
   does not hold.
 
-A bare role name that matches nothing is reported too, but as a warning: the
-diff-derived whitelist legitimately names roles the envelope filters out.
+A token naming a role the discovery query does not return at all is reported
+too, but as a warning, whether or not it pins axes: the diff-derived whitelist
+legitimately names roles the envelope filters out, and it pins the variants a
+change reaches. Role names themselves are checked against `roles/` before the
+run starts (scripts/github/resolve/effective_whitelist.sh), so a typo is caught
+there rather than swallowed here.
 """
 
 from __future__ import annotations
@@ -85,12 +87,13 @@ def problems(
     warnings: list[str] = []
     for pin in pins:
         token = selection.describe(pin)
+        if pin.app not in discovered_apps:
+            warnings.append(
+                f"{label}: {token!r} matches no discovered row "
+                f"(no row in this run's mode and lifecycle envelope)"
+            )
+            continue
         if not pin.pinned:
-            if pin.app not in discovered_apps:
-                warnings.append(
-                    f"{label}: {token!r} matches no discovered row "
-                    f"(no row in this run's mode and lifecycle envelope)"
-                )
             continue
         variants = pin.variants or (None,)
         for variant in variants:
diff --git a/cli/meta/roles/applications/resolution/affected/__main__.py b/cli/meta/roles/applications/resolution/affected/__main__.py
index 7a600e0056..b834fd2eb4 100755
--- a/cli/meta/roles/applications/resolution/affected/__main__.py
+++ b/cli/meta/roles/applications/resolution/affected/__main__.py
@@ -10,8 +10,13 @@ Usage:
   python -m cli.meta.roles.applications.resolution.affected --changed-roles ROLE [ROLE ...]
 
 Output:
-  Whitespace-separated, sorted list of affected role names (single line),
-  including the seed roles themselves.
+  Whitespace-separated, sorted list of selection tokens (single line),
+  including the seed roles themselves. A role whose variants do not all
+  reach a seed is narrowed to the ones that do (``role#0,2``,
+  :mod:`utils.github.variant.selection`): a variant that switches its
+  provider off does not inherit the seed's change, so deploying it verifies
+  nothing. The narrowing is transitive over the whole chain, because each
+  round's closure is walked on that round's variant-merged services maps.
 
 Exit codes:
   0  Success. The closure was computed and printed.
@@ -38,9 +43,13 @@ from cli.meta.roles.applications.resolution.combined.role_introspection import (
     has_application_id,
     load_run_after,
 )
+from utils.cache.applications import get_variants
+from utils.roles.applications.variants import services_overrides_for_round
+from utils.roles.display import VARIANT_SEPARATOR
 
 if TYPE_CHECKING:
-    from collections.abc import Iterable
+    from collections.abc import Iterable, Sequence
+    from pathlib import Path
 
 EXIT_NON_MODELLABLE_SEED = 2
 
@@ -122,12 +131,85 @@ def affected_roles(changed: Iterable[str]) -> list[str]:
     return sorted(affected)
 
 
+def _round_resolvers(roles_path: Path, rounds: int) -> list[CombinedResolver]:
+    """One resolver per deploy round, each walking that round's
+    variant-merged services maps.
+
+    The maps are built by the same helper
+    (:func:`utils.roles.applications.variants.services_overrides_for_round`)
+    the matrix planner feeds its rounds from, so the topology this reads is
+    the topology round ``i`` deploys -- including every pulled-in role's own
+    variant, which is what carries the narrowing across generations.
+    ``run_after`` is not followed, for the reason the planner does not follow
+    it either: an ordering hint would re-add a provider the variant switched
+    off.
+    """
+    return [
+        CombinedResolver(
+            services_overrides=services_overrides_for_round(
+                roles_dir=str(roles_path),
+                round_index=index,
+                primary_app_variants={},
+            ),
+            follow_run_after=False,
+        )
+        for index in range(rounds)
+    ]
+
+
+def _pinned(
+    role: str, seeds: set[str], resolvers: Sequence[CombinedResolver], count: int
+) -> str:
+    """*role*, narrowed to the variants whose own closure reaches a seed.
+
+    Returns the bare role id whenever the narrowing cannot be trusted: no
+    variant reaching a seed means the role is affected through an edge the
+    round closure does not model (a ``run_after`` hint, or a resolution the
+    variant merge refused), and verifying none of it is worse than verifying
+    all of it.
+    """
+    try:
+        hits = [
+            index
+            for index in range(count)
+            if seeds.intersection(resolvers[index].resolve(role))
+        ]
+    except CombinedResolutionError:
+        return role
+    if not hits or len(hits) == count:
+        return role
+    return role + VARIANT_SEPARATOR + ",".join(str(index) for index in hits)
+
+
+def affected_selection(changed: Iterable[str]) -> list[str]:
+    """:func:`affected_roles` as selection tokens, variant-narrowed.
+
+    A seed role keeps every variant: its own files changed, so each of them
+    has to redeploy regardless of which providers it pulls.
+    """
+    seeds: set[str] = {r.strip() for r in changed if r and r.strip()}
+    affected = affected_roles(changed)
+    variants = get_variants(roles_dir=str(roles_dir()))
+    counts = {role: len(variants.get(role) or ()) for role in affected}
+    rounds = max(counts.values(), default=0)
+    if rounds < 2:
+        return affected
+    resolvers = _round_resolvers(roles_dir(), rounds)
+    return [
+        role
+        if role in seeds or counts[role] < 2
+        else _pinned(role, seeds, resolvers, counts[role])
+        for role in affected
+    ]
+
+
 def main() -> None:
     parser = argparse.ArgumentParser(
         description=(
             "Print all roles whose transitive prerequisite closure "
             "(run_after + dependencies + services) contains any of the "
-            "given seed roles. Seed roles themselves are included."
+            "given seed roles, each narrowed to the variants that reach one. "
+            "Seed roles themselves are included, with every variant."
         )
     )
     parser.add_argument(
@@ -137,7 +219,7 @@ def main() -> None:
         help="Seed role names (folder names under ./roles).",
     )
     args = parser.parse_args()
-    print(" ".join(affected_roles(args.changed_roles)))
+    print(" ".join(affected_selection(args.changed_roles)))
 
 
 if __name__ == "__main__":
diff --git a/compose.yml b/compose.yml
index f7d2be5738..635f1cea9a 100644
--- a/compose.yml
+++ b/compose.yml
@@ -71,6 +71,9 @@ services:
       - letsencrypt:/etc/letsencrypt/
 
     environment:
+      INFINITO_API_ANTHROPIC_KEY: ${INFINITO_API_ANTHROPIC_KEY}
+      INFINITO_API_OPENAI_KEY: ${INFINITO_API_OPENAI_KEY}
+      INFINITO_API_OPENROUTER_KEY: ${INFINITO_API_OPENROUTER_KEY}
       INFINITO_BUILDKIT_ENABLED: ${INFINITO_BUILDKIT_ENABLED}
       INFINITO_CONTAINER_CA_ENABLED: ${INFINITO_CONTAINER_CA_ENABLED}
       INFINITO_DIR_VAR_LIB: ${INFINITO_DIR_VAR_LIB}
diff --git a/compose/swarm/playbook.yml b/compose/swarm/playbook.yml
index a4e11016c3..6be12b1fb1 100644
--- a/compose/swarm/playbook.yml
+++ b/compose/swarm/playbook.yml
@@ -134,7 +134,7 @@
       timeout: 30
       when: lab_is_mgr or inventory_hostname in [lab_nfs, lab_backup]
 
-    - name: own the whole dnsmasq config (fedora and centos ship local-service, which implies bind-interfaces and dnsmasq refuses next to our bind-dynamic)
+    - name: own the whole dnsmasq config (the packaging appends --local-service unconditionally and only an interface, except-interface, listen-address or auth-server directive resets it; without that reset a failed interface re-enumeration empties dnsmasq's local-subnet list and it rejects every query, loopback included, until an address event rebuilds it)
       template: # nocheck: stack-host-template - lab node system config, every DNS node writes its own /etc/dnsmasq.conf and IS_STACK_HOST does not exist in this play
         src: dnsmasq.conf.j2
         dest: /etc/dnsmasq.conf
diff --git a/compose/swarm/templates/dnsmasq.conf.j2 b/compose/swarm/templates/dnsmasq.conf.j2
index ef198a34b5..48dfe761fb 100644
--- a/compose/swarm/templates/dnsmasq.conf.j2
+++ b/compose/swarm/templates/dnsmasq.conf.j2
@@ -5,3 +5,4 @@ server={{ resolver }}
 {% endfor %}
 address=/{{ lab_domain }}/{{ lab_domain_target }}
 local=/{{ lab_domain }}/
+interface=*
diff --git a/default.env b/default.env
index 6f4233db7a..f079196ae4 100644
--- a/default.env
+++ b/default.env
@@ -16,6 +16,18 @@
 # Git repository holding the operator's terminal aliases (an `aliases` file at repo root); developers override this with their own repo.
 INFINITO_ALIAS_REPOSITORY=https://github.com/kevinveenbirkenbach/alias
 
+# Requirements file scripts/install/ansible.sh tries first, `galaxy` or `git`; the other one stays the fallback.
+INFINITO_ANSIBLE_COLLECTIONS_SOURCE=galaxy
+
+# Anthropic API key the development inventory feeds into API.anthropic.api_key; empty leaves the anthropic routes unpublished.
+INFINITO_API_ANTHROPIC_KEY=""
+
+# OpenAI API key the development inventory feeds into API.openai.api_key; empty leaves the openai routes unpublished.
+INFINITO_API_OPENAI_KEY=""
+
+# OpenRouter API key the development inventory feeds into API.openrouter.api_key; empty leaves openrouter/auto unpublished.
+INFINITO_API_OPENROUTER_KEY=""
+
 # Where scripts/meta/resolve/apps.sh runs the meta-CLI: host | docker.
 INFINITO_APP_DISCOVERY_RUNNER=docker
 
@@ -94,6 +106,9 @@ INFINITO_CACHE_STACK=true
 # Index of the deploy chunk the discovery emits; each chunk block of call-orchestrator.yml passes its own.
 INFINITO_CI_CHUNK=0
 
+# Rows one deploy chunk holds, overriding the concurrency-times-waves derivation; 0 derives it.
+INFINITO_CI_CHUNK_SIZE=0
+
 # Runner slots a deploy chunk may assume are free; with the job timeout it sizes a chunk in cli.meta.ci.slots.
 INFINITO_CI_CONCURRENCY=20
 
diff --git a/docs/contributing/actions/testing/suppression.md b/docs/contributing/actions/testing/suppression.md
index 8746107ca3..b0f3939497 100644
--- a/docs/contributing/actions/testing/suppression.md
+++ b/docs/contributing/actions/testing/suppression.md
@@ -44,9 +44,11 @@ The placement rule is per check. The catalog "Position" column uses these labels
 | Rule                        | Position                              | Affected test                                                                                                                                                                                                                | Effect                                                                                                                                                                                                                |
 | --------------------------- | ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `url`                       | same or above                         | [test_urls_reachable.py](../../../../tests/external/repository/test_urls_reachable.py)                                                                                                                                       | Skips probing the literal HTTP(S) URL. Use for CDN roots and API base URLs that 4xx without a path.                                                                                                                   |
+| `onion-flag`                | same or above                         | [test_onion_port_flag.py](../../../../tests/lint/ansible/services/test_onion_port_flag.py)                                                                                                                                   | Accepts a `false` under `ports.onion`. The marker MUST carry a reason naming why that port stays off the node onion; a bare marker is rejected.                                                                        |
 | `docker-version`            | same or above                         | [test_image_versions.py](../../../../tests/external/update/docker/test_image_versions.py), [test_semver_pinning.py](../../../../tests/lint/ansible/services/test_semver_pinning.py)                                          | Skips both the live version-update warning and the non-semver-pin lint for that image's `version:` key.                                                                                                                |
 | `repository-version`        | same or above                         | [test_repository_versions.py](../../../../tests/external/update/repository/test_repository_versions.py), [test_semver_pinning.py](../../../../tests/lint/ansible/services/test_semver_pinning.py)                            | Skips both the live ref-update warning and the non-semver-pin lint for that entity's `ref:` key.                                                                                                                       |
 | `dockerfile-arg-default`    | same or above                         | [test_arg_without_default.py](../../../../tests/lint/docker/dockerfile/test_arg_without_default.py)                                                                                                                    | Allows the marked `ARG` to carry a default. The caller normally supplies every build argument so a missing one fails the build instead of selecting a base image nobody chose.                                          |
+| `debian-codename`           | same or above                         | [test_no_debian_codename_tags.py](../../../../tests/lint/repository/test_no_debian_codename_tags.py)                                                                                                                   | Allows an image reference whose tag names a Debian release by codename. Reserved for an upstream that publishes no numeric tag; the marker MUST name which upstream, because a codename pin can never be raised by the updater.                                                                                                                                                                          |
 | `direct-yaml`               | same line / span                      | [test_no_direct_calls.py](../../../../tests/lint/repository/yaml/test_no_direct_calls.py)                                                                                                                              | Allows the marked `yaml.safe_load` / `safe_dump` call to bypass `utils.cache.yaml`. MUST use `nocheck:`, not `noqa:`.                                                                                                  |
 | `curl-timeout`              | same or above                         | [test_curl_via_filter.py](../../../../tests/lint/repository/test_curl_via_filter.py)                                                                                                                                   | Allows a bare curl invocation without the `curl` filter or inline `--max-time`.                                                                                                                                        |
 | `redundant-bool-ternary`    | same line                             | [test_no_redundant_bool_patterns.py](../../../../tests/lint/filesystem/python/test_no_redundant_bool_patterns.py)                                                                                                                 | Allows the redundant `\| bool \| ternary('true','false')` pattern when a consumer requires the lowercase tokens.                                                                                                       |
@@ -106,7 +108,13 @@ The placement rule is per check. The catalog "Position" column uses these labels
 | `image-healthcheck`         | same or above the service key         | [test_image_healthcheck_declared.py](../../../../tests/integration/roles/test_image_healthcheck_declared.py)                                                                                                                             | Allows a `roles/*/meta/services.yml` entry whose image ships no `HEALTHCHECK` to declare none either. Default path: add `healthcheck:` to the entry, because a container without a probe counts as healthy the moment its process starts — which is how a service that came back empty passes a restore drill. Reserved for containers nothing can probe: a one-shot process that exits, or an image with neither a port nor a shell. |
 | `csp-unsafe`                | same line                             | [test_csp_unsafe_requires_justification.py](../../../../tests/lint/ansible/roles/meta/test_csp_unsafe_requires_justification.py)                                                                                                         | Documents an `unsafe-*: true` flag in `roles/*/meta/csp.yml`. MUST be paired with a `Reason:` on the same line naming what breaks without the relaxation. `unsafe-inline` re-admits the inline execution an XSS needs and `unsafe-eval` re-admits string-to-code, so the flag has to be verified against the running app, not copied from another role. |
 | `min-storage-headroom`      | same line OR comment block above key  | [test_min_storage_headroom.py](../../../../tests/external/update/docker/test_min_storage_headroom.py)                                                                                                                                    | Allows a `roles/*/meta/services.yml` `min_storage` to exceed the measured compressed size of its own `image:`/`version:` by more than 1 GB. MUST be paired with a `Reason:` on the same comment line naming what occupies the space. Reserved for services whose data volume genuinely dominates the footprint; the default path is to lower the value, because an over-declared budget makes a host look too small and prunes a cache the deploy did not need to lose. |
+| `healthcheck-binary`        | same or above                         | [test_healthcheck_binary_on_slim_base.py](../../../../tests/lint/ansible/roles/meta/test_healthcheck_binary_on_slim_base.py)                                                                                                             | Exempts a `roles/*/meta/services.yml` healthcheck flavor from the requirement that the role's `files/Dockerfile` install the binary the probe runs, when the service sits on a `-slim` image. MUST name where the binary comes from instead. A `-slim` tag carries the runtime and nothing around it, so `curl` is absent and the probe fails from the first beat; under swarm the task is then reaped with exit 137 and every deployment holding the service in its closure fails on the convergence wait, naming the service rather than the missing binary. |
 | `galaxy-git-parity`         | same or above                         | [test_galaxy_entries_have_git_source.py](../../../../tests/lint/repository/dependencies/test_galaxy_entries_have_git_source.py)                                                                                                          | Exempts a `requirements/requirements.galaxy.yml` collection from the requirement to also carry a `type: git` entry in `requirements/requirements.git.yml`. Reserved for collections that publish no usable git remote; without the git entry a `galaxy.ansible.com` outage fails `make install`, because the fallback in `scripts/install/ansible.sh` cannot resolve the collection either. |
+| `loop-var-shadow`           | same or above                         | [test_loop_var_shadowing.py](../../../../tests/lint/ansible/tasks/test_loop_var_shadowing.py)                                                                                                                                            | Allows a `loop_var` to take the name of a variable declared in `group_vars/**` or in a role's `vars`/`defaults`. Inside the loop that name carries the item, so every lookup, template and nested include reading it sees the item instead, and ansible only warns. Reserved for a loop whose body reads the name as the item on purpose, typically because the item IS that value: state which meaning the body relies on. |
+| `firewall-fragment-accept`  | same or above                         | [test_firewall_fragment_verdicts.py](../../../../tests/lint/ansible/jinja/test_firewall_fragment_verdicts.py)                                                                                                                            | Allows a rule in a `roles/*/templates/nftables.conf.j2` fragment to end in an `accept` verdict. Default path: express the intent as a `drop` of what must not pass, or put the rule in the chain carrying the policy it has to overrule, because an `accept` terminates only its own base chain and every other chain at that hook still runs, docker's `drop` policy on forwarded packets included. Reserved for an accept whose only job is to skip the fragment's own later rules. |
+| `shell-template`            | head (first 30 lines)                 | [test_no_shell_templates.py](../../../../tests/lint/filesystem/shell/test_no_shell_templates.py)                                                                                                                                         | Allows a `*.sh.j2` to exist. Default path: ship the script as a plain `.sh` under `files/shell/` and pass its values as `ExecStart` arguments or `Environment=` entries, because shellcheck, the repository's `.sh` guards and every test skip a Jinja template, so nothing reads what actually runs on the host. Reserved for a script whose shape is generated, not just its values. Place the marker BELOW the shebang, never above it, and prefer the Jinja comment form so it does not reach the rendered script. |
+| `systemd-via-sys-service`   | same or above                         | [test_systemd_units_via_sys_service.py](../../../../tests/lint/ansible/modules/test_systemd_units_via_sys_service.py)                                                                                                                    | Allows a role task to render a `*.service.j2` itself instead of handing the unit to `sys-service`. Default path: name the template `templates/systemctl.service.j2` and include `sys-service` with `system_service_id`, so the unit also gets the daemon reload, the enable, and the timer, async and flush behaviour. Reserved for units `sys-service` cannot carry, such as a user-scope unit under `$HOME`. |
+| `software-identity`         | same or above                         | [test_software_identity_variables.py](../../../../tests/lint/ansible/jinja/test_software_identity_variables.py)                                                                                                                          | Allows a `.j2` template to write the software's name, domain or URL as a literal. Default path: render `SOFTWARE_NAME`, `SOFTWARE_DOMAIN`, `SOFTWARE_URL` or `ORGANIZATION`, which `group_vars/all/00_general.yml` declares once and derives from each other, so a rename reaches the template too. Reserved for a literal that must survive a rename, such as an identifier a third party issued under the old name. |
 
 ## Tool-Native `noqa` Codes 🧹
 
diff --git a/docs/contributing/artefact/git/branch.md b/docs/contributing/artefact/git/branch.md
index b7933d5111..020cded368 100644
--- a/docs/contributing/artefact/git/branch.md
+++ b/docs/contributing/artefact/git/branch.md
@@ -6,7 +6,7 @@ The branch prefix MUST match the type of change. The [PR workflow](pull-request.
 
 | Branch prefix | Scope | Matching files | CI behavior |
 |---|---|---|---|
-| `agent` | Changes to agent instructions or prompts | `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `docs/agents/*` | Skips [orchestrator](../../../../.github/workflows/call-orchestrator.yml), finishes green through the lightweight scope gate. |
+| `agent` | Changes to agent instructions or prompts | `AGENTS.md`, `roles/<role>/AGENTS.md`, `docs/agents/*` | Skips [orchestrator](../../../../.github/workflows/call-orchestrator.yml), finishes green through the lightweight scope gate. |
 | `documentation` | Documentation-only changes | `**/*.md`, `**/*.rst` (outside agent paths) | Skips [orchestrator](../../../../.github/workflows/call-orchestrator.yml), finishes green through the lightweight scope gate. |
 | `feature` | New features or enhancements | `*` | Runs the full [orchestrator](../../../../.github/workflows/call-orchestrator.yml) pipeline. |
 | `fix` | Bug fixes | `*` | Runs the full [orchestrator](../../../../.github/workflows/call-orchestrator.yml) pipeline. |
diff --git a/docs/contributing/artefact/git/pipeline.md b/docs/contributing/artefact/git/pipeline.md
index e5d8a4f3d2..3cb37ddba5 100644
--- a/docs/contributing/artefact/git/pipeline.md
+++ b/docs/contributing/artefact/git/pipeline.md
@@ -80,7 +80,9 @@ The two deploy-test workflows listed in the `Infrastructure tests` table of [wor
    - **No diff at all** OR **any changed path outside `roles/<role>/...`**: no whitelist is set, so the full deploy across the workflow's scope runs.
    - **All changed paths under `roles/<role>/...`**: the changed roles become the seed set, and the whitelist is the transitive closure of those seeds expanded upwards over `run_after`, `dependencies`, and shared services. In other words, every role whose prerequisite set as defined by [combined resolver](../../../../cli/meta/roles/applications/resolution/combined/resolver.py) contains one of the seeds is included, together with the seeds themselves.
 
-The reverse closure is fail-safe: any seed that is not modellable in the resolver (no `application_id` and not referenced by any role's `run_after`) MUST trigger a fall-back to a full deploy, as MUST any resolver runtime error. The closure MUST NOT silently shrink the deploy matrix on partial information.
+Each role in that closure is then narrowed to the variants that actually reach a seed: variant `i` of a role is kept only when round `i`'s closure — walked on the same variant-merged services maps [the matrix planner](../../../../cli/administration/deploy/development/inventory/planner.py) builds its rounds from, and therefore variant-aware at every generation of the chain — contains one of the seeds. A role whose variants do not all qualify enters the whitelist as a `role#0,2` selection token, so an image bump in a provider no longer redeploys the variants that switch that provider off. This applies to every auto-derived whitelist — the weekly update PRs, Dependabot, and any other diff-driven run — because they all resolve through this one path.
+
+The reverse closure is fail-safe: any seed that is not modellable in the resolver (no `application_id` and not referenced by any role's `run_after`) MUST trigger a fall-back to a full deploy, as MUST any resolver runtime error. The closure MUST NOT silently shrink the deploy matrix on partial information. The variant narrowing follows the same rule: a role reached only through a `run_after` edge (which the round closure does not follow) keeps every variant, and so does a seed role itself, whose own files changed.
 
 The PR-scope short-circuits in [scope.sh](../../../../scripts/meta/resolve/pr/scope.sh) (documentation-only, agent-only) still apply at the entry layer. They skip the orchestrator entirely and are independent of the diff-driven whitelist resolution above.
 
diff --git a/docs/contributing/artefact/git/pull-request.md b/docs/contributing/artefact/git/pull-request.md
index 9b3d37233e..a848bcbf55 100644
--- a/docs/contributing/artefact/git/pull-request.md
+++ b/docs/contributing/artefact/git/pull-request.md
@@ -10,8 +10,8 @@ You MUST pick the template that matches your change. The table below links the a
 | Workstation and `desk-*` changes | [workstation.md](../../../../.github/PULL_REQUEST_TEMPLATE/workstation.md) |
 | Shared system changes such as `sys-*`, `svc-*`, `dev-*`, `drv-*`, `pkgmgr`, `update-*`, or `user-*` | [system.md](../../../../.github/PULL_REQUEST_TEMPLATE/system.md) |
 | CI/CD and workflow changes | [pipeline.md](../../../../.github/PULL_REQUEST_TEMPLATE/pipeline.md) |
-| Documentation-only changes limited to `.md` or `.rst` files outside `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, and `docs/agents/*` | [documentation.md](../../../../.github/PULL_REQUEST_TEMPLATE/documentation.md) |
-| Agent-specific changes limited to `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, or `docs/agents/*` | [agents.md](../../../../.github/PULL_REQUEST_TEMPLATE/agents.md) |
+| Documentation-only changes limited to `.md` or `.rst` files outside `AGENTS.md` and `docs/agents/*` | [documentation.md](../../../../.github/PULL_REQUEST_TEMPLATE/documentation.md) |
+| Agent-specific changes limited to `AGENTS.md` or `docs/agents/*` | [agents.md](../../../../.github/PULL_REQUEST_TEMPLATE/agents.md) |
 
 ## Branch Naming 🏷️
 
diff --git a/docs/contributing/design/role/services/layout.md b/docs/contributing/design/role/services/layout.md
index 3ac1b7c16e..809303a385 100644
--- a/docs/contributing/design/role/services/layout.md
+++ b/docs/contributing/design/role/services/layout.md
@@ -87,6 +87,8 @@ The unified schema supports:
 
 - **Nested keys.** Both flat and nested credential keys are accepted, so e.g. `recaptcha.key` and `recaptcha.secret` remain nested.
 - **`algorithm:` defaults to `plain`** when the field is omitted.
+- **`type:` (optional)** is one of `string`, `integer`, `boolean`. A supplied value of another type aborts inventory creation.
+- **`regex:` (optional)** is a pattern the supplied value MUST match in full (`re.fullmatch`). Anchors are implicit; `sk-[A-Za-z0-9]{16,}` needs no `^` or `$`.
 - **`default:` (optional)** is a Jinja string used as the credential's value when the inventory does not provide one.
   - `default:` is **NOT rendered at inventory creation time.** The literal Jinja string is written verbatim into the inventory so that referenced variables (`CAPTCHA.RECAPTCHA.KEY`, `lookup(...)`, …) resolve only at deploy/runtime when those variables are actually defined.
   - `default:` values are **NOT validated.** `validation:` only applies to user-provided values, so the schema default is exempt.
@@ -108,6 +110,58 @@ credentials:
       default:     "{{ CAPTCHA.RECAPTCHA.SECRET | default('') }}"
 ```
 
+### What is checked, and when 🔎
+
+`type:` and `regex:` are enforced by `validate_supplied_value()` in
+[inventory.py](../../../../../utils/manager/inventory.py) at inventory-creation
+time, on every path where a value arrives from outside:
+
+| Source | Checked |
+|---|---|
+| `--set applications.<app>.secrets.credentials.<path>=<value>` | yes |
+| A value already present in the inventory | yes |
+| The literal written from `default:` | no |
+| A value produced from `algorithm:` | no |
+
+A generated value is exempt because the algorithm that produced it is named by
+the same schema, and `generate_value()` takes no schema argument.
+
+An empty string means "not configured" and passes every check, which is what
+makes an optional provider key expressible: declare the shape, leave the value
+empty, and the consumer gates on emptiness.
+
+`validation.min_length` is declared in many role schemas but enforced nowhere.
+Do not read it as a guarantee.
+
+### Worked Example: an optional external key
+
+```yaml
+# roles/svc-ai-litellm/meta/secrets.yml
+credentials:
+  openai_api_key:
+    description: "OpenAI API key; empty leaves the openai/* models unpublished"
+    type:        "string"
+    regex:       "\\S{20,}"
+    default:     "{{ API.openai.api_key }}"
+```
+
+The `default:` points at the central `API` block in
+[group_vars/all/18_api.yml](../../../../../group_vars/all/18_api.yml), so an
+operator fills the provider in one place while the role keeps the shape the
+value must have.
+
+### Write a pattern for the paste, not for the vendor 🚫
+
+`regex:` MUST NOT pin a vendor's key prefix. OpenAI moved issuance from `sk-` to
+`sk-proj-` without notice, and Anthropic issues `sk-ant-api03-`; a schema that
+encoded either would reject a valid key and abort inventory creation, which is a
+hard failure for a value that was correct.
+
+Write the pattern against the mistakes a paste makes — a trailing newline, an
+embedded space, a truncated copy, a `<placeholder>` — and leave the provider's
+format alone. A key pasted into the wrong provider's slot is not caught here;
+it is caught at deploy time, where the route it publishes answers nothing.
+
 Flat schema entries keep the same shape:
 
 ```yaml
@@ -159,6 +213,8 @@ All port data lives under `<entity>.ports` in `meta/services.yml` (no `ports:` s
       relay:                          # for port-ranges (coturn, BBB, nextcloud TURN)
         start: <int>
         end:   <int>
+    onion:
+      <category>: <bool>              # forward this category over the node onion
 ```
 
 ### `internal` / `local` / `public` Split 🧭
@@ -168,6 +224,7 @@ All port data lives under `<entity>.ports` in `meta/services.yml` (no `ports:` s
 | `internal` | **Internal container port.** Lives inside the container's network namespace, addressed by other containers on the same role-local network. NOT a host-bound port. Multiple roles MAY legitimately declare the same value (e.g. several nginx-based apps with `internal: { http: 80 }`). |
 | `local`    | **Localhost-bound host port.** Bound on `127.0.0.1` and only reachable through the front-proxy / SSH tunnels. The OS-level binding namespace is shared across all roles, so `local` values MUST be unique across the whole repo. |
 | `public`   | **Public-facing host port.** Bound on `0.0.0.0` and exposed to the public internet (or to whatever the operator's firewall allows). Same uniqueness rule as `local`. |
+| `onion`    | **Onion opt-in, not a port.** A category-keyed map of booleans naming which of the entity's own categories get a `HiddenServicePort` on the node onion. It declares no numbers: the port is read from `local` when the category is declared there and from `public` otherwise, matching what `container_ports` publishes. Collision detection ignores it. |
 
 ### Always Category-Keyed Maps 🗂️
 
@@ -202,6 +259,34 @@ coturn:
         end:   39999
 ```
 
+### `onion` Forwarding Opt-In 🧅
+
+`ports.onion` names the categories that answer on the node onion. Only the named
+categories are forwarded.
+
+The flag is mandatory, enforced by [test_onion_port_flag.py](../../../../../tests/lint/ansible/services/test_onion_port_flag.py):
+every category declared under `local` or `public` needs a `true` or a `false`,
+and every `false` needs `# nocheck: onion-flag` plus the reason it is false.
+Four groups are settled centrally instead and take no flag: the categories a
+hidden service cannot carry (`relay`, `media`, `stun_turn`, `stun_turn_tls`),
+the proxy-fronted `http`, `sso` and `websocket`, the implicit-TLS variants
+(`smtps`, `imaps`, `pop3s`, `ldaps`), and any entity that already answers the
+question through `exposed:`.
+
+```yaml
+mailu:
+  ports:
+    public:
+      smtp:   25
+      smtps:  465
+      imap:   143
+    onion:
+      smtp: true          # 25 gets a HiddenServicePort; 465 and 143 do not
+```
+
+The forward is per-variant: `meta/variants.yml` may drop the flag, and the role
+then loses the `HiddenServicePort` in that variant.
+
 ### Multi-Entity Roles 🎛️
 
 Each entity carries its own `ports` block:
diff --git a/docs/contributing/design/role/services/mcp/audit.md b/docs/contributing/design/role/services/mcp/audit.md
index 8fd7c84b0f..16d629ee0f 100644
--- a/docs/contributing/design/role/services/mcp/audit.md
+++ b/docs/contributing/design/role/services/mcp/audit.md
@@ -13,16 +13,16 @@ not the version the MCP surface was verified against.
 | role | version | source | transport | auth | subject | scope | tools | implementation | consumers | blocker |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
 | `svc-db-qdrant` | v1.19.1 | [link](https://s.infinito.nexus/code) | streamable_http | bearer_token | service_account (`mcp-svc-db-qdrant`) | read-only | 2 | adapter | `web-app-flowise`, `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
-| `web-app-baserow` | 2.3.3 | [link](https://baserow.io/user-docs/mcp-server) | streamable_http | bearer_token | service_account (`mcp-web-app-baserow`) | read-only | 4 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
+| `web-app-baserow` | 2.3.4 | [link](https://baserow.io/user-docs/mcp-server) | streamable_http | bearer_token | service_account (`mcp-web-app-baserow`) | read-only | 4 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-checkmk` | 2.4.0p32 | [link](https://s.infinito.nexus/code) | streamable_http | bearer_token | service_account (`mcp-web-app-checkmk`) | read-only | 3 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-fider` | stable | [link](https://s.infinito.nexus/code) | streamable_http | bearer_token | service_account (`mcp-web-app-fider`) | read-only | 3 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
-| `web-app-flowise` | 24-bookworm-slim | [link](https://github.com/FlowiseAI/Flowise/tree/flowise%403.1.4/packages/server/src/routes/custom-mcp-servers) | — | — | — | read-only | — | native | — | — |
+| `web-app-flowise` | 24-slim | [link](https://github.com/FlowiseAI/Flowise/tree/flowise%403.1.4/packages/server/src/routes/custom-mcp-servers) | — | — | — | read-only | — | native | — | — |
 | `web-app-gitea` | 1.27.3 | [link](https://pkg.go.dev/gitea.com/gitea/gitea-mcp) | streamable_http | bearer_token | service_account (`mcp-web-app-gitea`) | read-only | 24 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-gitlab` | — | [link](https://docs.gitlab.com/user/gitlab_duo/model_context_protocol/mcp_server/) | streamable_http | bearer_token | service_account (`mcp-web-app-gitlab`) | read-only | 14 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-hermes` | v2026.9.7 | [link](https://hermes-agent.nousresearch.com/) | — | — | — | read-only | — | native | — | — |
 | `web-app-homeassistant` | 2026.7 | [link](https://www.home-assistant.io/integrations/mcp_server/) | streamable_http | bearer_token | service_account (`mcp-web-app-homeassistant`) | read-only | 10 | native | `web-app-flowise`, `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-jellyfin` | 10.11.11 | [link](https://s.infinito.nexus/code) | streamable_http | bearer_token | service_account (`mcp-web-app-jellyfin`) | read-only | 3 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
-| `web-app-jenkins` | lts | [link](https://plugins.jenkins.io/mcp-server/) | streamable_http | bearer_token | service_account (`mcp-web-app-jenkins`) | read-only | 15 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
+| `web-app-jenkins` | 2.568.3-lts | [link](https://plugins.jenkins.io/mcp-server/) | streamable_http | bearer_token | service_account (`mcp-web-app-jenkins`) | read-only | 15 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-listmonk` | v6.2.0 | [link](https://s.infinito.nexus/code) | streamable_http | bearer_token | service_account (`mcp-web-app-listmonk`) | read-only | 3 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-mattermost` | 11.11.0 | [link](https://github.com/mattermost/mattermost-plugin-agents/blob/master/mcpserver/README.md) | streamable_http | bearer_token | service_account (`mcp-web-app-mattermost`) | read-only | 11 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-moodle` | 8.3-fpm | [link](https://moodle.org/plugins/webservice_mcp) | streamable_http | bearer_token | service_account (`mcp-web-app-moodle`) | read-only | 5 | plugin | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
@@ -30,7 +30,7 @@ not the version the MCP surface was verified against.
 | `web-app-nextcloud` | 34-fpm-alpine | [link](https://docs.nextcloud.com/server/latest/admin_manual/ai/app_context_agent.html) | streamable_http | bearer_token | service_account (`mcp-web-app-nextcloud`) | read-only | 9 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-openclaw` | 2026.7.1 | [link](https://openclaw.ai/) | — | — | — | read-only | — | native | — | — |
 | `web-app-openwebui` | 0.11.0 | [link](https://docs.openwebui.com/features/extensibility/mcp/) | — | — | — | read-only | — | native | — | — |
-| `web-app-pretix` | stable | [link](https://s.infinito.nexus/code) | streamable_http | bearer_token | service_account (`mcp-web-app-pretix`) | read-only | 3 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
+| `web-app-pretix` | 2026.7.0 | [link](https://s.infinito.nexus/code) | streamable_http | bearer_token | service_account (`mcp-web-app-pretix`) | read-only | 3 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-prometheus` | v3.14.0 | [link](https://s.infinito.nexus/code) | streamable_http | bearer_token | service_account (`mcp-web-app-prometheus`) | read-only | 3 | adapter | `web-app-flowise`, `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-snipe-it` | — | [link](https://s.infinito.nexus/code) | streamable_http | bearer_token | service_account (`mcp-web-app-snipe-it`) | read-only | 3 | adapter | `web-app-hermes`, `web-app-openclaw`, `web-app-openwebui` | — |
 | `web-app-wordpress` | 7.1.0 | [link](https://github.com/WordPress/mcp-adapter/tree/v0.5.0) | streamable_http | basic_auth | service_account (`mcp-web-app-wordpress`) | read-only | 3 | plugin | `web-app-hermes`, `web-app-openclaw` | — |
diff --git a/docs/contributing/tools/agents/claude/security.md b/docs/contributing/tools/agents/claude/security.md
index ddbe8cfa55..f099cdb17c 100644
--- a/docs/contributing/tools/agents/claude/security.md
+++ b/docs/contributing/tools/agents/claude/security.md
@@ -72,7 +72,7 @@ The `Bash(*)` allow lets the agent run any Makefile target without prompting. Th
 
 ## Assumption 8: Shell control-flow loops are never necessary 🔁
 
-[CLAUDE.md](../../../../../CLAUDE.md) forbids `for` / `while` / `until` loops in Bash invocations, and `Bash(for *)` / `Bash(while *)` / `Bash(until *)` are in `deny` to enforce the rule. Every task has a flat-form equivalent: a single `grep` with multiple file arguments, `xargs`, a recursive glob, or a dedicated tool.
+[AGENTS.md](../../../../../AGENTS.md) forbids `for` / `while` / `until` loops in Bash invocations, and `Bash(for *)` / `Bash(while *)` / `Bash(until *)` are in `deny` to enforce the rule. Every task has a flat-form equivalent: a single `grep` with multiple file arguments, `xargs`, a recursive glob, or a dedicated tool.
 
 **Why this matters:** Loops can hide destructive operations (for example `for f in $(ls); do rm "$f"; done`) behind a single approval step. The deny rule converts a rule violation into a hard failure, so the agent receives concrete feedback and refactors to the flat form.
 
diff --git a/docs/contributing/tools/agents/claude/settings.md b/docs/contributing/tools/agents/claude/settings.md
index 9b3668d16b..3faedd79fb 100644
--- a/docs/contributing/tools/agents/claude/settings.md
+++ b/docs/contributing/tools/agents/claude/settings.md
@@ -97,7 +97,7 @@ These operations are unconditionally blocked, regardless of any `allow` entry or
 
 | Permission | Reason |
 |---|---|
-| `for *` / `while *` / `until *` | Shell control-flow loops (`for f in ...; do ...; done`, `while read ...`, `until cond; do ...`). See Assumption 8 in [security.md](security.md) for why loops are banned at the policy layer rather than in the textual [CLAUDE.md](../../../../../CLAUDE.md) rule alone. The sandbox auto-allow heuristic does not recognise loop keywords, so this deny has no cost versus any alternative (allow would also require explicit entries; ask would deadlock). |
+| `for *` / `while *` / `until *` | Shell control-flow loops (`for f in ...; do ...; done`, `while read ...`, `until cond; do ...`). See Assumption 8 in [security.md](security.md) for why loops are banned at the policy layer rather than in the textual [AGENTS.md](../../../../../AGENTS.md) rule alone. The sandbox auto-allow heuristic does not recognise loop keywords, so this deny has no cost versus any alternative (allow would also require explicit entries; ask would deadlock). |
 | `gh api * -X DELETE *` / `gh api * --method DELETE *` | DELETE is irreversible from the API surface: deleting a release, branch ref, deploy key, or webhook destroys data with no undo. Both `-X` and `--method` spellings are blocked so neither shorthand slips through. |
 | `gh api * -X PUT *` / `gh api * --method PUT *` | PUT replaces a resource wholesale. On endpoints like branch protection or rulesets, a PUT silently overwrites the entire policy with whatever payload is sent; partial JSON drops every unspecified field. PATCH (the merge variant) still goes through `ask`. |
 | `gh api * /actions/secrets*:*` | Touches GitHub Actions secrets: reading metadata, creating, updating, or deleting. Even GETs leak secret names; mutations rotate credentials CI depends on. Out-of-band secret management only. |
diff --git a/docs/contributing/tools/agents/common.md b/docs/contributing/tools/agents/common.md
index 9144b9517e..9804b77522 100644
--- a/docs/contributing/tools/agents/common.md
+++ b/docs/contributing/tools/agents/common.md
@@ -2,14 +2,13 @@
 
 AI assistants are welcome, but they MUST follow the same workflow as humans.
 
-- You MUST treat [AGENTS.md](../../../../AGENTS.md) as the entry point for all agent-specific execution instructions. Tool-specific files such as `CLAUDE.md` and `GEMINI.md` extend `AGENTS.md` and MUST NOT contradict it.
+- You MUST treat [AGENTS.md](../../../../AGENTS.md) as the single, runtime-agnostic source of agent-specific execution instructions. There are no tool-specific extension files.
 - You MUST NOT invent commands, workflows, or files that do not exist.
 - You MUST NEVER expose secrets in prompts, code, screenshots, or logs.
 - You MUST treat AI output as a draft that must be reviewed for wrong assumptions, duplicate logic, and security mistakes.
 - You MUST keep explanations simple and explicit.
 - You MUST state assumptions clearly.
 
-For tool-specific configuration and additional instructions, see [CLAUDE.md](../../../../CLAUDE.md) and [GEMINI.md](../../../../GEMINI.md).
 For a full reference of permitted Claude Code operations and their security rationale, see [claude/](claude/README.md).
 
 For further support, visit the AI forum at [s.infinito.nexus/aihub](https://s.infinito.nexus/aihub) or join the Matrix group #ai:infinito.nexus.
diff --git a/docs/contributing/tools/github/actions/configuration.md b/docs/contributing/tools/github/actions/configuration.md
index e6d8cd29e8..f069964ae8 100644
--- a/docs/contributing/tools/github/actions/configuration.md
+++ b/docs/contributing/tools/github/actions/configuration.md
@@ -11,7 +11,32 @@ Repository variables are set under **Settings → Secrets and variables → Acti
 | `CI_SYNC_MAIN_SOURCE_REPOSITORY` | [entry-push-latest.yml](../../../../../.github/workflows/entry-push-latest.yml) | Syncs `main` from `infinito-nexus/core` before CI scope discovery | `<owner>/<repo>` to use another source, or `false`, empty, or the current repository to skip |
 | `CI_RUN_ON_MAIN` | [entry-push-latest.yml](../../../../../.github/workflows/entry-push-latest.yml) | Pushes to `main` skip CI | `true` to run CI on `main` pushes too |
 | `CI_ENABLE_AUTO_UPDATES` | [cron-update.yml](../../../../../.github/workflows/cron-update.yml), [entry-pr-open-dependabot-close.yml](../../../../../.github/workflows/entry-pr-open-dependabot-close.yml) | Update jobs skipped; Dependabot PRs auto-closed | `true` to allow update PRs (workflow-driven and Dependabot) |
-| `INFINITO_PLAYWRIGHT_KEEP` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | Playwright keeps trace, screenshot and video only when a test fails | `true` to keep them for every test (passing runs included) |
+| `PLAYWRIGHT_KEEP_ALL` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | Playwright keeps trace, screenshot and video only when a test fails | `true` to keep them for every test (passing runs included); the workflow forwards it as `INFINITO_PLAYWRIGHT_KEEP` |
+| `API_OPENAI_KEY` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | The gateway publishes no `openai/*` model, and the CLI test asserts their absence | An OpenAI key, to deploy and test the route |
+| `API_ANTHROPIC_KEY` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | The gateway publishes no `anthropic/*` model | An Anthropic key |
+| `API_OPENROUTER_KEY` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | The gateway publishes no `openrouter/auto` model | An OpenRouter key |
+
+## Provider keys: variable or secret? 🔑
+
+The three `API_*_KEY` entries are read as `${{ secrets.X || vars.X }}`, so a
+secret of the same name wins and the variable is the fallback. Prefer the
+secret: a repository **variable is not masked**, and the development inventory
+sets `MASK_CREDENTIALS_IN_LOGS: false`, so a key supplied as a variable can be
+printed by a task that echoes its own arguments.
+
+An unset key is not an error. The provider's route stays unpublished, the
+gateway serves whatever local backend the round deploys, and
+[the litellm CLI test](../../../../../roles/svc-ai-litellm/files/test/probe.py)
+asserts the absence rather than skipping.
+
+They travel as `INFINITO_API_OPENAI_KEY`, `INFINITO_API_ANTHROPIC_KEY` and
+`INFINITO_API_OPENROUTER_KEY` through the workflow `env:` block, the passthrough
+allowlist in [passthrough.py](../../../../../utils/env/handlers/passthrough.py),
+the `infinito` service environment in
+[compose.yml](../../../../../compose.yml), and land in `API.<provider>.api_key`
+in the development inventory, whose path is the SPOT behind
+`INFINITO_INVENTORY_VARS_FILE`. Skipping the compose forwarding makes them
+resolve to empty inside the container without any error.
 
 ## Cancelling in-progress runs 🛑
 
diff --git a/docs/contributing/tools/github/actions/secrets.md b/docs/contributing/tools/github/actions/secrets.md
index 6679053894..54cefb8974 100644
--- a/docs/contributing/tools/github/actions/secrets.md
+++ b/docs/contributing/tools/github/actions/secrets.md
@@ -10,6 +10,31 @@ Repository secrets MUST be set under **Settings → Secrets and variables → Ac
 |---|---|---|---|
 | `BOT_APP_CLIENT_ID` | [cron-update.yml](../../../../../.github/workflows/cron-update.yml) | GitHub App Client ID (OAuth-style `Iv…` identifier shown on the App's General page) used to mint a short-lived installation token for the update PR. | `CI_ENABLE_AUTO_UPDATES == 'true'` |
 | `BOT_APP_PRIVATE_KEY` | [cron-update.yml](../../../../../.github/workflows/cron-update.yml) | PEM-encoded private key of the same GitHub App. Used to sign the JWT that exchanges for the installation token. | `CI_ENABLE_AUTO_UPDATES == 'true'` |
+| `API_OPENAI_KEY` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | Publishes the `openai/*` models on the LiteLLM gateway and lets the CLI test exercise the route. | Never. Unset leaves the route unpublished. |
+| `API_ANTHROPIC_KEY` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | Publishes the `anthropic/*` models. | Never. |
+| `API_OPENROUTER_KEY` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | Publishes `openrouter/auto`. | Never. |
+| `DOCKERHUB_USERNAME` | [cron-images-mirror-all.yml](../../../../../.github/workflows/cron-images-mirror-all.yml), [call-images-mirror-missing.yml](../../../../../.github/workflows/call-images-mirror-missing.yml) | Authenticates the mirror job against Docker Hub, which raises the anonymous pull-rate limit the mirror would otherwise hit. | Never. Both workflows declare the secret `required: false` and gate the login step on both values being non-empty. |
+| `DOCKERHUB_TOKEN` | [cron-images-mirror-all.yml](../../../../../.github/workflows/cron-images-mirror-all.yml), [call-images-mirror-missing.yml](../../../../../.github/workflows/call-images-mirror-missing.yml) | The access token paired with `DOCKERHUB_USERNAME`. | Never, and only together with the username. |
+
+## `API_OPENAI_KEY`, `API_ANTHROPIC_KEY`, `API_OPENROUTER_KEY` 🤖
+
+These are optional and fail soft: unset means the provider's route is never
+published, and the deployment falls back to whatever local backend the round
+deploys. The workflow reads each as `${{ secrets.X || vars.X }}`, so the same
+name works as a repository variable; see
+[configuration.md](configuration.md#provider-keys-variable-or-secret-) for why
+the secret is the better half of that pair.
+
+Set them the same way as the App credentials: **Settings → Secrets and variables
+→ Actions → Secrets → New repository secret**, one per provider, the value being
+the provider's key verbatim.
+
+The shape each key must have is declared per role rather than here, in
+[roles/svc-ai-litellm/meta/secrets.yml](../../../../../roles/svc-ai-litellm/meta/secrets.yml)
+with a `type:` and a `regex:`. The pattern rejects a truncated or
+whitespace-carrying paste and deliberately accepts any vendor prefix, so a
+provider changing its issuance format cannot turn a valid key into a failed
+inventory run.
 
 ## `BOT_APP_CLIENT_ID` and `BOT_APP_PRIVATE_KEY` 🤖
 
diff --git a/docs/requirements/014-svc-runner-ci.md b/docs/requirements/014-svc-runner-ci.md
index 8791fa1106..8ad7faeec0 100644
--- a/docs/requirements/014-svc-runner-ci.md
+++ b/docs/requirements/014-svc-runner-ci.md
@@ -44,4 +44,4 @@ The implementation of this requirement MUST be executed autonomously by the agen
 - [x] **Iteration loop.** The agent MUST follow the [Workflow Loop](../agents/action/iteration/workflow.md) for every change to GitHub Actions workflows the implementation touches, and the [Compose Loop](../agents/action/iteration/compose.md) for every change inside `roles/svc-runner/`. The agent MUST NOT skip the loop's debug-locally step in favour of remote CI reruns.
 - [x] **No `ask` prompts mid-run.** The agent MUST NOT trigger any tool call that routes through `permissions.ask` in [.claude/settings.json](../../.claude/settings.json) during implementation. Where a tool would otherwise route through `ask`, the agent MUST select an equivalent already covered by `permissions.allow`, or rephrase the operation to fit the sandbox. The single permitted exception is the final commit at the end of the run.
 - [x] **No interruptions.** Bug fixes, deploy failures, lint failures, `make test` failures, healthcheck flaps, and similar issues MUST be resolved at their root inside this same iteration without prompting the operator. Workarounds, ad-hoc skips, retry-until-green loops, or "track in a follow-up" deferrals MUST NOT be used.
-- [x] **One commit at the end.** The agent MUST NOT create any intermediate commit. ALL changes (role, CLI, tests, documentation, and the ticked checkboxes in this document) MUST be combined into ONE commit, created only after every Acceptance Criterion above is checked off (`- [x]`) and `make test` is green. Per-step commits, checkpoint commits, and partial commits MUST NOT be created. The agent MUST NOT push; the operator runs `git-sign-push` outside the sandbox per [CLAUDE.md](../../CLAUDE.md).
+- [x] **One commit at the end.** The agent MUST NOT create any intermediate commit. ALL changes (role, CLI, tests, documentation, and the ticked checkboxes in this document) MUST be combined into ONE commit, created only after every Acceptance Criterion above is checked off (`- [x]`) and `make test` is green. Per-step commits, checkpoint commits, and partial commits MUST NOT be created. The agent MUST NOT push; the operator runs `git-sign-push` outside the sandbox per [AGENTS.md](../../AGENTS.md).
diff --git a/docs/requirements/023-docker-swarm-nfs.md b/docs/requirements/023-docker-swarm-nfs.md
index 8403680527..3cb0989d1e 100644
--- a/docs/requirements/023-docker-swarm-nfs.md
+++ b/docs/requirements/023-docker-swarm-nfs.md
@@ -202,7 +202,7 @@ The implementation of this requirement MUST be executed autonomously by the agen
 - [ ] **Iteration loop.** The agent MUST follow the [Compose Loop](../agents/action/iteration/compose.md) for every change inside `roles/svc-swarm-node/`, `roles/svc-prx-openresty/` (swarm-mode adaptations), `roles/svc-storage-nfs-server/`, `roles/svc-storage-nfs-client/`, and `roles/web-app-mediawiki/` (pilot). The agent MUST follow the [Workflow Loop](../agents/action/iteration/workflow.md) for every change to `.github/workflows/test-deploy-swarm-nfs.yml`. The agent MUST NOT skip the loop's debug-locally step in favour of remote CI reruns.
 - [ ] **No `ask` prompts mid-run.** The agent MUST NOT trigger any tool call that routes through `permissions.ask` in [.claude/settings.json](../../.claude/settings.json) during implementation. Where a tool would otherwise route through `ask`, the agent MUST select an equivalent already covered by `permissions.allow`, or rephrase the operation to fit the sandbox. The single permitted exception is the final commit at the end of the run.
 - [ ] **No interruptions.** Bug fixes, deploy failures, lint failures, `make test` failures, healthcheck flaps, swarm-init flakes, NFS mount races, workflow reruns until green — every issue MUST be resolved at its root inside this same iteration without prompting the operator. Workarounds, ad-hoc skips, retry-until-green loops, or "track in a follow-up" deferrals MUST NOT be used.
-- [ ] **One commit at the end.** The agent MUST NOT create any intermediate commit. ALL changes (the three new roles, the openresty swarm-mode adaptations, the pilot role updates, the CI workflow, schema entries, group_vars defaults, documentation, and the ticked checkboxes in this document) MUST be combined into ONE commit, created only after every Acceptance Criterion above is checked off (`- [x]`), `make test` is green, and `.github/workflows/test-deploy-swarm-nfs.yml` is green on its first scheduled run. Per-step commits, checkpoint commits, and partial commits MUST NOT be created. The agent MUST NOT push; the operator runs `git-sign-push` outside the sandbox per [CLAUDE.md](../../CLAUDE.md).
+- [ ] **One commit at the end.** The agent MUST NOT create any intermediate commit. ALL changes (the three new roles, the openresty swarm-mode adaptations, the pilot role updates, the CI workflow, schema entries, group_vars defaults, documentation, and the ticked checkboxes in this document) MUST be combined into ONE commit, created only after every Acceptance Criterion above is checked off (`- [x]`), `make test` is green, and `.github/workflows/test-deploy-swarm-nfs.yml` is green on its first scheduled run. Per-step commits, checkpoint commits, and partial commits MUST NOT be created. The agent MUST NOT push; the operator runs `git-sign-push` outside the sandbox per [AGENTS.md](../../AGENTS.md).
 
 ## See Also
 
diff --git a/docs/requirements/023-setup-penpot.md b/docs/requirements/023-setup-penpot.md
index b708d6c124..cca1c9cfd5 100644
--- a/docs/requirements/023-setup-penpot.md
+++ b/docs/requirements/023-setup-penpot.md
@@ -90,7 +90,7 @@ The implementation of this requirement MUST be executed autonomously by the agen
 - [x] **Iteration loops.** The agent MUST follow the [Compose Loop](../agents/action/iteration/compose.md) for every change inside `roles/web-app-penpot/`, and the [Playwright Loop](../agents/action/iteration/playwright.md) for every change to the role's Playwright spec. The debug-locally step MUST NOT be skipped in favour of remote CI reruns.
 - [x] **No `ask` prompts mid-run.** The agent MUST NOT trigger any tool call that routes through `permissions.ask` in [.claude/settings.json](../../.claude/settings.json) during implementation. Where a tool would otherwise route through `ask`, the agent MUST select an equivalent covered by `permissions.allow`, or rephrase the operation to fit the sandbox. The single permitted exception is the final commit.
 - [x] **No interruptions.** Bug fixes, deploy failures, lint failures, `make test` failures, and healthcheck flaps MUST be resolved at their root inside this same iteration without prompting the operator. Workarounds, ad-hoc skips, retry-until-green loops, or "track in a follow-up" deferrals MUST NOT be used.
-- [ ] **One commit at the end.** ALL changes (role, meta, Playwright spec, documentation, marketplace entry, and the ticked checkboxes in this document) MUST be combined into ONE commit, created only after every Acceptance Criterion above is checked off (`- [x]`) and `make test` is green. The agent MUST NOT push; the operator runs `git-sign-push` outside the sandbox per [CLAUDE.md](../../CLAUDE.md).
+- [ ] **One commit at the end.** ALL changes (role, meta, Playwright spec, documentation, marketplace entry, and the ticked checkboxes in this document) MUST be combined into ONE commit, created only after every Acceptance Criterion above is checked off (`- [x]`) and `make test` is green. The agent MUST NOT push; the operator runs `git-sign-push` outside the sandbox per [AGENTS.md](../../AGENTS.md).
 
 ## See Also
 
diff --git a/docs/requirements/024-web-app-erpnext.md b/docs/requirements/024-web-app-erpnext.md
index d0adeb2676..239e87b4a5 100644
--- a/docs/requirements/024-web-app-erpnext.md
+++ b/docs/requirements/024-web-app-erpnext.md
@@ -301,7 +301,7 @@ The agent MUST execute this requirement **autonomously**. Open clarifications on
 
 - The agent MUST NOT create any git commit until every Acceptance Criterion in this document is checked off (`- [x]`).
 - A single commit (or a tight, related sequence) lands the whole role addition; no half-scaffolded intermediate commits.
-- When all ACs are met, `make test` is green, and the three variants deploy cleanly, the agent instructs the operator to run `git-sign-push` outside the sandbox (per [CLAUDE.md](../../CLAUDE.md)). The agent MUST NOT push.
+- When all ACs are met, `make test` is green, and the three variants deploy cleanly, the agent instructs the operator to run `git-sign-push` outside the sandbox (per [AGENTS.md](../../AGENTS.md)). The agent MUST NOT push.
 
 ## Context
 
diff --git a/docs/requirements/025-web-app-matrix-ansible-flavor.md b/docs/requirements/025-web-app-matrix-ansible-flavor.md
index 4e78f783f2..6b483b4770 100644
--- a/docs/requirements/025-web-app-matrix-ansible-flavor.md
+++ b/docs/requirements/025-web-app-matrix-ansible-flavor.md
@@ -230,7 +230,7 @@ The agent MUST execute this requirement **autonomously** once Proposed Decisions
 ## Commit Policy
 
 - Single commit (or a tight, related sequence) lands the whole ansible-flavor addition; no half-scaffolded intermediate commits.
-- When all ACs are checked off, `make test` is green, and the four variants deploy cleanly, the agent instructs the operator to run `git-sign-push` outside the sandbox (per [CLAUDE.md](../../CLAUDE.md)). The agent MUST NOT push.
+- When all ACs are checked off, `make test` is green, and the four variants deploy cleanly, the agent instructs the operator to run `git-sign-push` outside the sandbox (per [AGENTS.md](../../AGENTS.md)). The agent MUST NOT push.
 
 ## Context
 
diff --git a/docs/requirements/028-web-app-semaphore.md b/docs/requirements/028-web-app-semaphore.md
index 1bc579617f..fc04173124 100644
--- a/docs/requirements/028-web-app-semaphore.md
+++ b/docs/requirements/028-web-app-semaphore.md
@@ -209,7 +209,7 @@ Execute autonomously; open a clarification only when a decision is genuinely amb
 
 - No git commit until every Acceptance Criterion is checked off (`- [x]`).
 - A single commit (or a tight related sequence) lands the whole role addition.
-- When all ACs are met and the variants deploy cleanly, instruct the operator to run `git-sign-push` outside the sandbox (per [CLAUDE.md](../../CLAUDE.md)). The agent MUST NOT push.
+- When all ACs are met and the variants deploy cleanly, instruct the operator to run `git-sign-push` outside the sandbox (per [AGENTS.md](../../AGENTS.md)). The agent MUST NOT push.
 
 ## Context
 
diff --git a/docs/requirements/035-mcp-proxy-expansion.md b/docs/requirements/035-mcp-proxy-expansion.md
index 6b13cbd419..ec7d6438f6 100644
--- a/docs/requirements/035-mcp-proxy-expansion.md
+++ b/docs/requirements/035-mcp-proxy-expansion.md
@@ -488,7 +488,7 @@ A future exception requires a new requirement with a fixed operation list, dedic
 **`host_execution_boundary` (39):** `desk-bluray-player`, `desk-chromium`, `desk-copyq`, `desk-docker`, `desk-dotlinker`, `desk-firefox`, `desk-git`, `desk-gnome`, `desk-gnome-caffeine`, `desk-gnome-extensions`, `desk-gnome-terminal`, `desk-gnucash`, `desk-jrnl`, `desk-keepassxc`, `desk-libreoffice`, `desk-micro`, `desk-neovim`, `desk-nextcloud`, `desk-obs`, `desk-qbittorrent`, `desk-retroarch`, `desk-spotify`, `desk-ssh`, `desk-torbrowser`, `desk-virtualbox`, `desk-zoom`, `dev-arduino`, `dev-core`, `dev-java`, `dev-locales`, `dev-make`, `dev-nix`, `dev-nodejs`, `dev-python`, `drv-epson-multiprinter`, `drv-intel`, `drv-lid-switch`, `drv-non-free`, `gen-hunspell`.
 These roles operate a workstation, developer toolchain, device, or host package; bridging them would amount to shared shell, filesystem, browser-session, device, or host execution without an application-specific remote identity.
 
-**`privileged_control_plane` (22):** `svc-bkp-local-2-device`, `svc-bkp-nfs-2-local`, `svc-bkp-remote-2-local`, `svc-bkp-secrets-2-local`, `svc-bkp-volume-2-local`, `svc-dns-unbound`, `svc-net-tor`, `svc-net-wireguard`, `svc-opt-keyboard-color`, `svc-opt-ssd-hdd`, `svc-opt-swapfile`, `svc-prx-openresty`, `svc-registry-cache`, `svc-registry-docker`, `svc-runner`, `svc-storage-nfs-client`, `svc-storage-nfs-server`, `svc-swarm-manager`, `svc-swarm-node`, `svc-virt-kata`, `update`, `web-app-openbao`.
+**`privileged_control_plane` (23):** `svc-bkp-local-2-device`, `svc-bkp-nfs-2-local`, `svc-bkp-remote-2-local`, `svc-bkp-secrets-2-local`, `svc-bkp-volume-2-local`, `svc-dns-unbound`, `svc-net-firewall`, `svc-net-tor`, `svc-net-wireguard`, `svc-opt-keyboard-color`, `svc-opt-ssd-hdd`, `svc-opt-swapfile`, `svc-prx-openresty`, `svc-registry-cache`, `svc-registry-docker`, `svc-runner`, `svc-storage-nfs-client`, `svc-storage-nfs-server`, `svc-swarm-manager`, `svc-swarm-node`, `svc-virt-kata`, `update`, `web-app-openbao`.
 These roles can recover secrets, alter routing or host state, run code, change deployment state, or reach storage/control-plane sockets; they require a separate audited operations gateway and human approval rather than general-purpose application MCP.
 
 **`shared_engine_isolation` (4):** `svc-db-memcached`, `svc-db-openldap`, `svc-db-postgres`, `svc-db-rabbitmq`.
diff --git a/group_vars/all/05_paths.yml b/group_vars/all/05_paths.yml
index 270384ce19..d0a2ab7734 100644
--- a/group_vars/all/05_paths.yml
+++ b/group_vars/all/05_paths.yml
@@ -5,6 +5,7 @@ DIR_SCRIPTS_ROOT: "/opt/scripts/"
 DIR_SCRIPTS_SYSTEMCTL: "{{ [ DIR_SCRIPTS_ROOT, 'systemctl' ] | path_join }}"
 DIR_COMPOSITIONS: "/opt/compose/"
 DIR_SYSTEM_SERVICE: "/etc/systemd/system"
+DIR_SYSTEM_SERVICE_USER: "$HOME/.config/systemd/user"
 DIR_COMPOSE_PULL_LOCK: "/run/ansible/compose-pull/"
 
 DIR_BIN: "/usr/bin"
diff --git a/group_vars/all/08_networks.yml b/group_vars/all/08_networks.yml
index fa1920561c..f757e83a3e 100644
--- a/group_vars/all/08_networks.yml
+++ b/group_vars/all/08_networks.yml
@@ -5,16 +5,23 @@ NETWORK_PUBLIC_DNS_RESOLVERS:
   - 8.8.8.8 # nocheck: hardcoded-dns-resolver
   - 1.0.0.1 # nocheck: hardcoded-dns-resolver
 NETWORK_DOCKER_EMBEDDED_DNS_RESOLVER: "127.0.0.11" # nocheck: hardcoded-dns-resolver
+NETWORK_DNS_PORT: 53 # Well-known resolver port a host DNS listener binds
 NETWORK_DOCKER_DNS_NGINX_DIRECTIVE: "resolver {{ NETWORK_DOCKER_EMBEDDED_DNS_RESOLVER }} valid=30s ipv6={{ NETWORK_IPV6_ENABLED | on_off }};"
-NETWORK_TRUSTED_PROXY_CIDRS:
-  - 127.0.0.1
-  - "::1"
-  - 10.0.0.0/8
-  - 172.16.0.0/12
-  - 192.168.0.0/16
+NETWORK_LOOPBACK_CIDR: "127.0.0.0/8"
+NETWORK_PRIVATE_CIDRS:
+  class_a: "10.0.0.0/8"
+  class_b: "172.16.0.0/12"
+  class_c: "192.168.0.0/16"
+NETWORK_INTERNAL_CIDRS: "{{ [NETWORK_LOOPBACK_CIDR] + (NETWORK_PRIVATE_CIDRS.values() | list) }}"
+NETWORK_ROLE_SUBNET_POOL: "{{ NETWORK_PRIVATE_CIDRS.class_c }}"
+NETWORK_ROLE_SUBNET_EXCEPTION_ROLES:
+  - web-app-bigbluebutton
+NETWORK_SWARM_GWBRIDGE_POOL: "{{ NETWORK_PRIVATE_CIDRS.class_b }}"
+NETWORK_TRUSTED_PROXY_CIDRS: "{{ ['127.0.0.1', '::1'] + (NETWORK_PRIVATE_CIDRS.values() | list) }}"
 NETWORK_DOCKER_ADDRESS_POOLS:
   - base: "10.208.0.0/12"
     size: 24
+NETWORK_TOR_VIRTUAL_CIDR: "10.240.0.0/12" # Range tor answers for .onion instead of routing; must not overlap the pool above
 NETWORK_CONTAINER_BRIDGE_RESOLVER: false
 NETWORK_NESTED_DOCKER_BIP: "192.168.67.1/24"
 NETWORK_NESTED_DOCKER_ADDRESS_POOLS:
@@ -82,6 +89,12 @@ PORT_BANDS: # nocheck: unused-var  # consumed by the port-allocation plugin outs
       start: 9053
       end: 9053
   public:
+    http:
+      start: 80
+      end: 80
+    https:
+      start: 443
+      end: 443
     ssh:
       start: 2201
       end: 2299
diff --git a/group_vars/all/16_ai.yml b/group_vars/all/16_ai.yml
index 6f08d29595..c79faa45c5 100644
--- a/group_vars/all/16_ai.yml
+++ b/group_vars/all/16_ai.yml
@@ -13,17 +13,43 @@ LITELLM_OPENAI_BASE_LOCAL_URL: "{{ LITELLM_BASE_LOCAL_URL }}/v1"
 
 LITELLM_BACKEND_ROLES: "{{ lookup('deployment').inventory }}"
 
-LITELLM_CHAT_MODEL: "{{ (lookup('config', 'svc-ai-ollama', 'services.ollama.preload_models') | reject('search', 'embed') | list | first) if 'svc-ai-ollama' in LITELLM_BACKEND_ROLES
-  else ('lmstudio/default' if 'svc-ai-lmstudio' in LITELLM_BACKEND_ROLES else ('openrouter/auto' if ((OPENROUTER_API_KEY | string) | length > 0) else '')) }}"
+LITELLM_OLLAMA_BACKEND: >-
+  {{ (lookup('config', 'svc-ai-litellm', 'services.ollama.enabled') | bool)
+     and (lookup('config', 'svc-ai-litellm', 'services.ollama.shared') | bool) }}
+
+LITELLM_LMSTUDIO_BACKEND: >-
+  {{ (lookup('config', 'svc-ai-litellm', 'services.lmstudio.enabled') | bool)
+     and (lookup('config', 'svc-ai-litellm', 'services.lmstudio.shared') | bool) }}
+
+AI_LOCAL_MODELS:
+  - alias: qwen2.5:0.5b
+    name: qwen2.5-0.5b-instruct
+    repo: lmstudio-community/Qwen2.5-0.5B-Instruct-GGUF
+    url: https://huggingface.co/lmstudio-community/Qwen2.5-0.5B-Instruct-GGUF/resolve/main/Qwen2.5-0.5B-Instruct-Q8_0.gguf
+    source: https://huggingface.co/lmstudio-community/Qwen2.5-0.5B-Instruct-GGUF
+    file: Qwen2.5-0.5B-Instruct-Q8_0.gguf
+    sha256: "1d96e30253a76970864323987e3e77eeaf170312952fd61d18d343c25cfd6e52"
+    bytes: 531068224
+
+AI_REMOTE_ALIASES: >-
+  {{ ['openai/gpt-4o-mini'] * (lookup('api_enabled', 'openai') | int)
+     + ['anthropic/claude-sonnet-4-5'] * (lookup('api_enabled', 'anthropic') | int)
+     + ['openrouter/auto'] * (lookup('api_enabled', 'openrouter') | int) }}
+
+LITELLM_CHAT_MODEL: "{{ (lookup('config', 'svc-ai-ollama', 'services.ollama.preload_models') | map(attribute='alias') | reject('search', 'embed') | list | first |
+  default('')) if 'svc-ai-ollama' in LITELLM_BACKEND_ROLES else ((lookup('config', 'svc-ai-lmstudio', 'services.lmstudio.preload_models') | map(attribute='alias')
+  | reject('search', 'embed') | list | first | default('')) if 'svc-ai-lmstudio' in LITELLM_BACKEND_ROLES else (AI_REMOTE_ALIASES | first | default(''))) }}"
 
 LITELLM_CHAT_MODEL_SERVED: >-
-  {{ (('svc-ai-ollama' in LITELLM_BACKEND_ROLES)
+  {{ ((LITELLM_OLLAMA_BACKEND | bool)
       and ((lookup('config', 'svc-ai-ollama', 'services.ollama.preload_models')
-            | reject('search', 'embed') | list) | length > 0))
-     or ('svc-ai-lmstudio' in LITELLM_BACKEND_ROLES)
-     or ((OPENROUTER_API_KEY | string) | length > 0) }}
+            | map(attribute='alias') | reject('search', 'embed') | list) | length > 0))
+     or ((LITELLM_LMSTUDIO_BACKEND | bool)
+         and ((lookup('config', 'svc-ai-lmstudio', 'services.lmstudio.preload_models')
+               | map(attribute='alias') | reject('search', 'embed') | list) | length > 0))
+     or ((AI_REMOTE_ALIASES | length) > 0) }}
 
-OPENROUTER_API_KEY: ""
+LITELLM_USABLE: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
 
 MCP_DISCOVERY: "{{ lookup('mcp_servers') }}"
 MCP_DISCOVERED_SERVERS: "{{ MCP_DISCOVERY.selected }}"
diff --git a/group_vars/all/18_api.yml b/group_vars/all/18_api.yml
index 7b05738278..5dd167098a 100644
--- a/group_vars/all/18_api.yml
+++ b/group_vars/all/18_api.yml
@@ -1,13 +1,18 @@
 ---
 # Central SPOT for proprietary / external (non-self-hosted) API credentials.
-# Each entry is empty by default; an integration that depends on a provider is
-# only activated when its credentials are present (see the addons that gate
-# their `enabled` on `API.<provider>`). Override per provider in the (vault-
-# encrypted) inventory; access ONLY via lookup('api', '<provider>.<key>').
-# nocheck: unused-var: consumed by the api lookup plugin (plugins/lookup/api.py) via lookup('api', ...), not referenced directly in YAML/Jinja.
+# Each entry is empty by default. Override per provider in the (vault-
+# encrypted) inventory; read ONLY via lookup('api', '<provider>.<key>') and
+# gate ONLY on lookup('api_enabled', '<provider>') (see utils/api.py).
+# nocheck: unused-var: consumed by the api lookup plugins (plugins/lookup/api.py, plugins/lookup/api_enabled.py) via lookup('api', ...), not referenced directly in YAML/Jinja.
 API:
+  anthropic:
+    api_key: ""
   cloudflare:
     api_token: ""
+  openai:
+    api_key: ""
+  openrouter:
+    api_key: ""
   telegram:
     bot_token: ""
     api_id: ""
diff --git a/group_vars/all/19_tor.yml b/group_vars/all/19_tor.yml
deleted file mode 100644
index 691a0e1a99..0000000000
--- a/group_vars/all/19_tor.yml
+++ /dev/null
@@ -1,7 +0,0 @@
----
-TOR_ONION_SSH_ENABLED: true
-
-TOR_EGRESS_ROUTER_ENABLED: true
-TOR_EGRESS_VIRTUAL_NET_IPV4: "10.240.0.0/12"
-
-TOR_ONION_EXTRA_PORTS: "{{ ([{'onion_port': 22, 'target': '127.0.0.1:22'}] if (TOR_ONION_SSH_ENABLED | bool) else []) + lookup('tor_ports') }}"
diff --git a/group_vars/all/README.md b/group_vars/all/README.md
index 2def1b4732..233e6be0f0 100644
--- a/group_vars/all/README.md
+++ b/group_vars/all/README.md
@@ -6,7 +6,10 @@ This directory contains the [Ansible](https://docs.ansible.com/ansible/latest/pl
 
 Variables in this directory MUST apply across all hosts and all roles. Typical examples are the software identity, deployment toggles, domain defaults, the central network and port registries, OIDC and LDAP endpoints, design tokens, and resource defaults.
 
-Role-specific configuration MUST NOT live here. Such values belong in the corresponding role under `roles/<role>/config/main.yml` or `roles/<role>/vars/main.yml`.
+Role-specific configuration MUST NOT live here, even when only one role reads it today. Such values belong in the corresponding role:
+
+- `roles/<role>/meta/services.yml` for anything an operator may override, because the inventory's `applications.<role>` block is deep-merged on top of it and `lookup('config', application_id, '<path>')` reads the result.
+- `roles/<role>/vars/main.yml` for values derived from that configuration, and for those the role fixes. Role vars outrank inventory variables, so a value placed here cannot be overridden per host.
 
 ## File naming and load order 🔢
 
diff --git a/inventories/development/default.yml b/inventories/development/default.yml
index 61421409f4..e498260df5 100644
--- a/inventories/development/default.yml
+++ b/inventories/development/default.yml
@@ -35,6 +35,14 @@ design:
     colors:
       base: "#FFA500"
 
+API:
+  openai:
+    api_key: "{{ lookup('env', 'INFINITO_API_OPENAI_KEY') }}"
+  anthropic:
+    api_key: "{{ lookup('env', 'INFINITO_API_ANTHROPIC_KEY') }}"
+  openrouter:
+    api_key: "{{ lookup('env', 'INFINITO_API_OPENROUTER_KEY') }}"
+
 OIDC_OVERRIDE:
   CLIENT:
     SECRET: VERYUNSAFESAMPLEPASSWORD1234
diff --git a/meta/distros.yml b/meta/distros.yml
index 0d6d719b38..977c0d8c72 100644
--- a/meta/distros.yml
+++ b/meta/distros.yml
@@ -46,7 +46,7 @@ distros:
   debian:
     slug: debian
     family: Debian
-    dev_runtime_image: debian:bookworm
+    dev_runtime_image: debian:13
     galaxy_platform: Debian
   ubuntu:
     slug: ubuntu
diff --git a/packaging/arch/PKGBUILD b/packaging/arch/PKGBUILD
index 16e17e6341..08a16cc965 100644
--- a/packaging/arch/PKGBUILD
+++ b/packaging/arch/PKGBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Kevin Veen-Birkenbach <info@veen.world>
 
 pkgname=infinito-nexus
-pkgver=13.0.0
+pkgver=14.2.0
 pkgrel=1
 pkgdesc="Meta package for Infinito.Nexus host dependencies (dev + CI)."
 arch=('any')
diff --git a/packaging/debian/changelog b/packaging/debian/changelog
index f42e064389..86c653a99b 100644
--- a/packaging/debian/changelog
+++ b/packaging/debian/changelog
@@ -1,3 +1,255 @@
+infinito-nexus (14.2.0-1) unstable; urgency=medium
+
+  **For Users**
+
+  * **Secrets management with OpenBao.** The new *web-app-openbao* role deploys OpenBao at
+    *openbao.<domain>*. It stores application credentials, API keys and machine identities.
+    People sign in through Keycloak, or through LDAP when OpenLDAP is deployed. Their
+    *administrator*, *operator* or *reader* group decides what they can reach, and signing in
+    without one of those groups grants only the default policy. Services and automation use
+    their own AppRole identities, whose credentials change on every deploy, and no root token
+    is kept after the first deploy. A recovery key kept in the token store lets a later deploy
+    get back in if those credentials are lost. A static seal unseals the node on its own after
+    every restart. An internal PKI can be switched on, and Prometheus alerts when the node is
+    sealed or unreachable. The seal key lives only in the encrypted inventory, and a backup of
+    the store cannot be read without it, so back up the inventory together with the volume.
+    See [web-app-openbao](roles/web-app-openbao/README.md).
+
+  * **LDAP import, export and Multi edit finish again in LAM.** The Content Security Policy
+    blocked the inline script that checks on LAM's background jobs, so these tools stayed
+    "in progress" forever. That script is allowed again.
+
+  * **Swarm deploys no longer abort on a network that already exists.** Some networks are
+    created before their application's stack, as Prometheus does for every application it
+    scrapes. Those networks now carry the stack label, so the application's own deploy uses
+    the existing network instead of failing with "network with name <entity> already exists".
+
+  **For Developers**
+
+  * **Alert rules live in the role that owns the metric.** A role ships its Prometheus rules
+    in *templates/prometheus/alert_rules.yml.j2*. The new *alert_rule_roles* lookup includes
+    them only for roles that Prometheus actually scrapes, so a rules file needs no activation
+    check of its own. It must start at the *groups:* item level. OpenBao's seal alert is the
+    first rule to use it.
+
+  * **Video for hand-built Playwright contexts.** A context created with
+    *browser.newContext()* ignored the project's video setting, so its artefact had a trace
+    but no video. Spread *recordVideoOptions(testInfo)* from *personas/utils/env.js* into the
+    context options to record one.
+
+  * Image and dependency version jumps (net since 14.1.0):
+    * *web-app-pgadmin*: 9.17 to 9.18
+
+  **Contributors**
+
+  * [Evangelos Tsakoudis](https://evangelostsak.com): the OpenBao role with its seal,
+    credential rotation, recovery and RBAC end-to-end suite, role-local Prometheus alert
+    rules, and the LAM and swarm network fixes that work uncovered
+  * [Alejandro Roman Ibanez](https://github.com/AlejandroRomanIbanez): video recording for
+    hand-built Playwright contexts
+  * [Kevin Veen-Birkenbach](https://veen.world): review and version maintenance
+
+ -- Kevin Veen-Birkenbach <kevin@veen.world>  Tue, 22 Sep 2026 15:22:09 +0200
+
+infinito-nexus (14.1.0-1) unstable; urgency=medium
+
+  **[14.1.0] - 2026-09-21**
+
+  **For Users**
+
+  * **Local models reach the gateway again.** Upstream re-pushed the *svc-ai-lmstudio* CPU
+    image with a server that listens on loopback only, so the role stayed green while litellm
+    could not connect and the AI features of Mattermost, Matrix, xWiki, Moodle and Zammad
+    failed their warm-up. The server binds the container network again and stays unpublished.
+    The model preload now waits until the daemon has finished starting, so a slow host no
+    longer ends up with a daemon that fails every later model load, and the readiness probe
+    is capped per attempt so a silent peer cannot hang it. See
+    [svc-ai-lmstudio](roles/svc-ai-lmstudio/README.md).
+
+  **For Developers**
+
+  * **CI deploys only the variants a change reaches.** An image bump in a provider no longer
+    redeploys the variants of its consumers that switch that provider off. The diff-derived
+    whitelist, used by the weekly update PRs, Dependabot and every other diff-driven run,
+    narrows each affected role to the variants whose round closure still reaches a changed
+    role, emitted as *role#0,2* selection tokens. A changed role and a role reached only
+    through *run_after* keep every variant. A pinned token naming a role that discovery does
+    not return now warns instead of aborting the run; role names are still checked against
+    *roles/* before the run starts.
+
+  * **One instruction file for every agent.** *AGENTS.md* now holds every agent rule, and
+    *CLAUDE.md* and *GEMINI.md* are gone. The rules they carried bind every runtime anyway,
+    and the PR templates, scope tables, requirement documents and docs that named the old
+    files now name *AGENTS.md*.
+
+  * Image and dependency version jumps (net since 14.0.0):
+    * *svc-ai-ollama*: 0.34.0 to 0.34.2
+    * *svc-net-tor* (Debian base): 13.6-slim to 13.7-slim
+    * *web-app-baserow*: 2.3.3 to 2.3.4
+    * *web-app-erpnext*: v16.34.2 to v16.35.0
+    * *web-app-funkwhale* (front, api): 2.0.10 to 2.0.11
+    * *web-app-jitsi* (web, prosody, jicofo, jvb): stable-9646 to stable-11031
+    * *web-app-keycloak*: 26.7.3 to 26.7.4
+    * *web-app-opentalk* (LiveKit): v1.13.6 to v1.13.7
+    * *web-app-opentalk* (RabbitMQ): 4.3.5 to 4.3.6
+    * *web-app-peertube*: v8.2.4 to v8.3.0
+    * *web-app-pihole*: 2026.07.2 to 2026.09.0
+    * *web-app-prometheus* (Alertmanager): v0.34.0 to v0.34.1
+    * Ansible collection *hetzner.hcloud*: 7.0.1 to 7.1.0
+    * *ruff* (dev): 0.16.6 to 0.16.7
+
+  **Contributors**
+
+  * [Kevin Veen-Birkenbach](https://veen.world): LM Studio reachability and startup,
+    variant-narrowed CI selection, the single agent instruction file, and version maintenance
+
+ -- Kevin Veen-Birkenbach <kevin@veen.world>  Mon, 21 Sep 2026 23:12:35 +0200
+
+infinito-nexus (14.0.0-1) unstable; urgency=medium
+
+  **For Users**
+
+  * **AI assistance inside the applications you already run.** A gateway role,
+    *svc-ai-litellm*, fronts OpenAI, Anthropic and OpenRouter from declared keys, with
+    *svc-ai-ollama* and the new *svc-ai-lmstudio* serving local models from one shared
+    catalogue, so inference can stay inside the deployment. Sixteen applications use it for
+    their own built-in AI features instead of calling a vendor directly: WordPress AI Engine,
+    MediaWiki AIEditingAssistant, Moodle's AI subsystem, Zammad Smart Assist, the xWiki LLM
+    extension, Discourse AI, the Matrix ChatGPT bridge, Nextcloud, Mattermost Agents, n8n,
+    Open WebUI and Flowise. The gateway's admin UI signs in through Keycloak. See
+    [svc-ai-litellm](roles/svc-ai-litellm/README.md) and
+    [svc-ai-lmstudio](roles/svc-ai-lmstudio/README.md).
+
+  * **Your tools reachable from your assistants.** About twenty applications now speak MCP.
+    Gitea, GitLab, Mattermost, Nextcloud, n8n, Baserow, Jenkins, Home Assistant, Moodle,
+    Snipe-IT and WordPress serve their own endpoints; ten more get one through a locked-down
+    sidecar. Open WebUI, Flowise and the agents discover what the deployment offers and
+    register it automatically. Access is bounded rather than assumed: blocked paths are
+    declared, every served path is gated, tools a provider calls mutating are withheld,
+    reader and writer roles are separate, and each provider authenticates callers as its own
+    service account. See [svc-ai-mcp-adapter](roles/svc-ai-mcp-adapter/README.md).
+
+  * **Agents as employees, with a kernel between them and the host.** *web-app-hermes* and
+    *web-app-openclaw* deploy agents behind the single sign-on gate, wired to the gateway's
+    models and to the MCP servers discovery hands them, each proving on deploy that it can
+    actually reach them. *svc-virt-kata* runs that tier under a kernel-isolating container
+    runtime, and *svc-ai-robot* embodies an agent on a dedicated device. Every sandboxed
+    agent acts as its own platform account rather than borrowing yours. See
+    [web-app-hermes](roles/web-app-hermes/README.md),
+    [web-app-openclaw](roles/web-app-openclaw/README.md) and
+    [svc-virt-kata](roles/svc-virt-kata/README.md).
+
+  * **Home automation joins the platform.** *web-app-homeassistant* deploys the automation
+    hub, exposes it as an MCP server so agents can drive it, persists the token it mints, and
+    is reachable over tor. See [web-app-homeassistant](roles/web-app-homeassistant/README.md).
+
+  * **Changing a password changes it everywhere.** A user declares how its password must be
+    generated, the inventory pins one for every declared user, a new generator produces
+    API-key shapes, the deploy rotates credentials between its two passes, and a reset command
+    exists. Applications that persist an administrator password at install now realign it when
+    the declared one changes: Nextcloud, Moodle, EspoCRM, Jellyfin, Listmonk, Discourse,
+    Checkmk, xWiki, n8n, Matrix and the dedicated MariaDB and Postgres engines. Checkmk keeps
+    a 401 fatal so a wrong password cannot lock the account out.
+
+  * **Onions, firewall and name resolution.** *svc-net-firewall* owns the packet filter as one
+    nftables table per role. Tor carries mail to a .onion in both deploy modes, rejects forged
+    sources on the guarded ports, and binds its dnsmasq listeners statically so a failed
+    re-enumeration can no longer drop every one of them. The deployment declares its own
+    address space once, the egress range moved out of the Docker pool, and the container
+    resolver follows the live bridge instead of a guessed address. Every host-bound port
+    requires an explicit onion decision. See
+    [svc-net-firewall](roles/svc-net-firewall/README.md).
+
+  * **Application fixes you will notice.** Nextcloud installs an OnlyOffice release upstream
+    actually published, keeps social login working over tor, and makes its OIDC account an
+    administrator. Element shows invites again through the new room list. Moodle survives the
+    container roll during installation. Mattermost keeps its configuration in Postgres instead
+    of on a shared volume, and its plugin tree is per node. GitLab creates the default
+    organization a headless install never gets. Jellyfin waits for health before driving the
+    setup wizard. Keycloak registers redirect URIs only for the apps a play deploys, keeps the
+    allowed-origins claim out of the access token, and no longer caches LDAP federation past a
+    fresh grant. The platform's own health mail no longer eats the sender quota.
+
+  * **Operating a deployment.** New make targets reach a single deployed application:
+    *compose-app-exec*, *compose-app-logs* and *compose-app-restart*. Diagnostics collect the
+    logs an application writes to a file, including from busybox containers. Health probes use
+    a fast start cadence with a window that outlasts a real boot, so a slow starter is no
+    longer reaped. The CSP health check accepts a status code a vhost declares instead of
+    dropping the vhost, and gives onion vhosts a navigation budget Tor can meet.
+
+  **For Developers**
+
+  * **MCP is declared, not wired.** A role states an *mcp* block in *meta/services.yml*, and
+    the vocabulary, discovery and rendering layer derives endpoints, clients, credentials and
+    network edges from it. A client-provider pairing is declared once, on the provider;
+    *sys-svc-mcp-reconcile* converges clients from the complete provider set; a refused pairing
+    is expressed as off rather than gated at the call site; and *svc-ai-mcp-adapter* is a
+    reusable per-provider sidecar rather than a standalone application. The contract is proven
+    on deploy, including refusal on *initialize* and the tool inventory itself. The design,
+    its delegation rules and a machine-checkable audit live under
+    [docs/contributing/design/role/services/mcp.md](docs/contributing/design/role/services/mcp.md).
+
+  * **Registry and variant changes.** A variant can dictate the configuration of the providers
+    it pulls in, and an MCP round decides for itself what it carries, which is the breaking
+    change in this release. Fifteen moving pins gained names the registry can order, every MCP
+    provider is registered as a shared service, *meta/schema.yml* finished its rename to
+    *meta/secrets.yml*, role scripts are sorted into per-language folders, and *meta/addons* is
+    now an accepted declaration site for pins and plugins.
+
+  * **Lints that fail closed.** Five properties that used to pass silently now fail. The PHP
+    and Ruby that roles ship are syntax-checked, and so are shell scripts that ship as Jinja
+    templates. *sys-service* owns every systemd unit a role installs. Healthcheck timings are
+    judged against what the base image was measured to hold, a variable-free healthcheck
+    belongs in *meta/services.yml*, an unenforceable NFS state layout fails at author time, a
+    sandboxed role cannot be pinned to the manager, credentials are kept out of volumes
+    declared non-secret, *no_log* is required on every task carrying one and forbidden in the
+    test roles, and a JavaScript default for an unset environment variable is rejected.
+
+  * **Pins that cannot age unnoticed.** Image pins are classified and pull references built
+    from the class, a moving tag declares itself with the marker it already carries, and a
+    role's images move as one release or not at all. The updater reads addon declarations,
+    orders vendor patch counters and five-component versions, reads a release line written
+    before the number as a family, and now also watches pinned pip requirements and Ansible
+    collections. Seven roles moved off the Debian codename base onto slim, and one Ubuntu
+    mirror list with failover, a short timeout and a health test serves both the package cache
+    and the image builds. *js-yaml* was lifted to 4.3.2 for GHSA-2883-xcg3-v3hh.
+
+  * **CI selects, resumes and proves.** A fourth deploy chunk stops a short priority chunk
+    stranding budget, a manual run can set the chunk size the formula would derive, and a
+    retrigger can override the chunk gate. Retriggering works by role and by what never got a
+    verdict, resumes behind the green window rather than the deployed one, retires suites the
+    source run already passed, and cancels the run before retriggering its failed roles. Each
+    role's README instructions are replayed on its smallest deploy row, in the mode its
+    *services.yml* declares. Distro images build concurrently on one runner, the matrix job
+    folds into the image job, and the deploy chunks no longer wait on the DNS test.
+
+  * **Swarm, measured rather than assumed.** The deploy waits for its own update instead of
+    guessing after it, refuses to call a stack converged while it is still updating, survives a
+    task that failed and came back, reports what converged rather than only what did not, and
+    says why the convergence probe refused. Placement is constrained to a role's declared
+    platform arch, redis and memcached sidecars get a deploy block, and a run-once service no
+    longer strands the stack deploy waiting for a replica it never has. The rescue dump
+    captures the contents of the state volumes. In the test lab, workers are labelled
+    kata-capable only when the app is sandboxed, NFS detaches before the node containers die,
+    and the sandbox tier gets a second node.
+
+  * **Faster gates.** Per-host setup runs once per host instead of once per application, a
+    role's volumes are answered from its own file instead of a whole-tree build, the Keycloak
+    RBAC root group resolves once rather than once per app, the Playwright fixture copy the
+    tree copy already made is dropped, logout helpers wait for a control instead of sleeping,
+    and the OIDC login helper stops waiting out probes that cannot match. Onion timeouts scale
+    by tor flavor instead of a flat multiplier, and every Playwright timeout has one source.
+
+  * **Documentation and agent instructions.** Six new requirement documents cover the LLM
+    gateway and model backends, agent employees, Home Assistant, the robot role, the MCP proxy
+    expansion and native AI gateway integration. The MCP design docs are nested under their own
+    folder with an audit the lints can check. The role README template asks the reader for a
+    domain the deployment can resolve, enforces consistent Credits attribution, and drops the em
+    dash. Documentation generators are gathered under *cli/build/docs*, and a new CLI edits role
+    bonds in a matrix instead of hunting through files.
+
+ -- Kevin Veen-Birkenbach <kevin@veen.world>  Sat, 19 Sep 2026 16:35:48 +0200
+
 infinito-nexus (13.0.0-1) unstable; urgency=medium
 
   * **Tor as a first-class deployment axis.** The new *svc-net-tor* role routes onion
diff --git a/packaging/fedora/infinito-nexus.spec b/packaging/fedora/infinito-nexus.spec
index 51e99a8f89..9c97657c75 100644
--- a/packaging/fedora/infinito-nexus.spec
+++ b/packaging/fedora/infinito-nexus.spec
@@ -1,5 +1,5 @@
 Name:           infinito-nexus
-Version:        13.0.0
+Version:        14.2.0
 Release:        1%{?dist}
 Summary:        Meta package for Infinito.Nexus host dependencies
 
@@ -58,6 +58,249 @@ install -d %{buildroot}%{_docdir}/%{name}
 %doc %{_docdir}/%{name}/DEPENDENCIES
 
 %changelog
+* Tue Sep 22 2026 Kevin Veen-Birkenbach <kevin@veen.world> - 14.2.0-1
+- **For Users**
+
+- * **Secrets management with OpenBao.** The new *web-app-openbao* role deploys OpenBao at
+-   *openbao.<domain>*. It stores application credentials, API keys and machine identities.
+-   People sign in through Keycloak, or through LDAP when OpenLDAP is deployed. Their
+-   *administrator*, *operator* or *reader* group decides what they can reach, and signing in
+-   without one of those groups grants only the default policy. Services and automation use
+-   their own AppRole identities, whose credentials change on every deploy, and no root token
+-   is kept after the first deploy. A recovery key kept in the token store lets a later deploy
+-   get back in if those credentials are lost. A static seal unseals the node on its own after
+-   every restart. An internal PKI can be switched on, and Prometheus alerts when the node is
+-   sealed or unreachable. The seal key lives only in the encrypted inventory, and a backup of
+-   the store cannot be read without it, so back up the inventory together with the volume.
+-   See [web-app-openbao](roles/web-app-openbao/README.md).
+
+- * **LDAP import, export and Multi edit finish again in LAM.** The Content Security Policy
+-   blocked the inline script that checks on LAM's background jobs, so these tools stayed
+-   "in progress" forever. That script is allowed again.
+
+- * **Swarm deploys no longer abort on a network that already exists.** Some networks are
+-   created before their application's stack, as Prometheus does for every application it
+-   scrapes. Those networks now carry the stack label, so the application's own deploy uses
+-   the existing network instead of failing with "network with name <entity> already exists".
+
+- **For Developers**
+
+- * **Alert rules live in the role that owns the metric.** A role ships its Prometheus rules
+-   in *templates/prometheus/alert_rules.yml.j2*. The new *alert_rule_roles* lookup includes
+-   them only for roles that Prometheus actually scrapes, so a rules file needs no activation
+-   check of its own. It must start at the *groups:* item level. OpenBao's seal alert is the
+-   first rule to use it.
+
+- * **Video for hand-built Playwright contexts.** A context created with
+-   *browser.newContext()* ignored the project's video setting, so its artefact had a trace
+-   but no video. Spread *recordVideoOptions(testInfo)* from *personas/utils/env.js* into the
+-   context options to record one.
+
+- * Image and dependency version jumps (net since 14.1.0):
+-   * *web-app-pgadmin*: 9.17 to 9.18
+
+- **Contributors**
+
+- * [Evangelos Tsakoudis](https://evangelostsak.com): the OpenBao role with its seal,
+-   credential rotation, recovery and RBAC end-to-end suite, role-local Prometheus alert
+-   rules, and the LAM and swarm network fixes that work uncovered
+- * [Alejandro Roman Ibanez](https://github.com/AlejandroRomanIbanez): video recording for
+-   hand-built Playwright contexts
+- * [Kevin Veen-Birkenbach](https://veen.world): review and version maintenance
+
+* Mon Sep 21 2026 Kevin Veen-Birkenbach <kevin@veen.world> - 14.1.0-1
+- **[14.1.0] - 2026-09-21**
+
+- **For Users**
+
+- * **Local models reach the gateway again.** Upstream re-pushed the *svc-ai-lmstudio* CPU
+-   image with a server that listens on loopback only, so the role stayed green while litellm
+-   could not connect and the AI features of Mattermost, Matrix, xWiki, Moodle and Zammad
+-   failed their warm-up. The server binds the container network again and stays unpublished.
+-   The model preload now waits until the daemon has finished starting, so a slow host no
+-   longer ends up with a daemon that fails every later model load, and the readiness probe
+-   is capped per attempt so a silent peer cannot hang it. See
+-   [svc-ai-lmstudio](roles/svc-ai-lmstudio/README.md).
+
+- **For Developers**
+
+- * **CI deploys only the variants a change reaches.** An image bump in a provider no longer
+-   redeploys the variants of its consumers that switch that provider off. The diff-derived
+-   whitelist, used by the weekly update PRs, Dependabot and every other diff-driven run,
+-   narrows each affected role to the variants whose round closure still reaches a changed
+-   role, emitted as *role#0,2* selection tokens. A changed role and a role reached only
+-   through *run_after* keep every variant. A pinned token naming a role that discovery does
+-   not return now warns instead of aborting the run; role names are still checked against
+-   *roles/* before the run starts.
+
+- * **One instruction file for every agent.** *AGENTS.md* now holds every agent rule, and
+-   *CLAUDE.md* and *GEMINI.md* are gone. The rules they carried bind every runtime anyway,
+-   and the PR templates, scope tables, requirement documents and docs that named the old
+-   files now name *AGENTS.md*.
+
+- * Image and dependency version jumps (net since 14.0.0):
+-   * *svc-ai-ollama*: 0.34.0 to 0.34.2
+-   * *svc-net-tor* (Debian base): 13.6-slim to 13.7-slim
+-   * *web-app-baserow*: 2.3.3 to 2.3.4
+-   * *web-app-erpnext*: v16.34.2 to v16.35.0
+-   * *web-app-funkwhale* (front, api): 2.0.10 to 2.0.11
+-   * *web-app-jitsi* (web, prosody, jicofo, jvb): stable-9646 to stable-11031
+-   * *web-app-keycloak*: 26.7.3 to 26.7.4
+-   * *web-app-opentalk* (LiveKit): v1.13.6 to v1.13.7
+-   * *web-app-opentalk* (RabbitMQ): 4.3.5 to 4.3.6
+-   * *web-app-peertube*: v8.2.4 to v8.3.0
+-   * *web-app-pihole*: 2026.07.2 to 2026.09.0
+-   * *web-app-prometheus* (Alertmanager): v0.34.0 to v0.34.1
+-   * Ansible collection *hetzner.hcloud*: 7.0.1 to 7.1.0
+-   * *ruff* (dev): 0.16.6 to 0.16.7
+
+- **Contributors**
+
+- * [Kevin Veen-Birkenbach](https://veen.world): LM Studio reachability and startup,
+-   variant-narrowed CI selection, the single agent instruction file, and version maintenance
+
+* Sat Sep 19 2026 Kevin Veen-Birkenbach <kevin@veen.world> - 14.0.0-1
+- **For Users**
+
+- * **AI assistance inside the applications you already run.** A gateway role,
+-   *svc-ai-litellm*, fronts OpenAI, Anthropic and OpenRouter from declared keys, with
+-   *svc-ai-ollama* and the new *svc-ai-lmstudio* serving local models from one shared
+-   catalogue, so inference can stay inside the deployment. Sixteen applications use it for
+-   their own built-in AI features instead of calling a vendor directly: WordPress AI Engine,
+-   MediaWiki AIEditingAssistant, Moodle's AI subsystem, Zammad Smart Assist, the xWiki LLM
+-   extension, Discourse AI, the Matrix ChatGPT bridge, Nextcloud, Mattermost Agents, n8n,
+-   Open WebUI and Flowise. The gateway's admin UI signs in through Keycloak. See
+-   [svc-ai-litellm](roles/svc-ai-litellm/README.md) and
+-   [svc-ai-lmstudio](roles/svc-ai-lmstudio/README.md).
+
+- * **Your tools reachable from your assistants.** About twenty applications now speak MCP.
+-   Gitea, GitLab, Mattermost, Nextcloud, n8n, Baserow, Jenkins, Home Assistant, Moodle,
+-   Snipe-IT and WordPress serve their own endpoints; ten more get one through a locked-down
+-   sidecar. Open WebUI, Flowise and the agents discover what the deployment offers and
+-   register it automatically. Access is bounded rather than assumed: blocked paths are
+-   declared, every served path is gated, tools a provider calls mutating are withheld,
+-   reader and writer roles are separate, and each provider authenticates callers as its own
+-   service account. See [svc-ai-mcp-adapter](roles/svc-ai-mcp-adapter/README.md).
+
+- * **Agents as employees, with a kernel between them and the host.** *web-app-hermes* and
+-   *web-app-openclaw* deploy agents behind the single sign-on gate, wired to the gateway's
+-   models and to the MCP servers discovery hands them, each proving on deploy that it can
+-   actually reach them. *svc-virt-kata* runs that tier under a kernel-isolating container
+-   runtime, and *svc-ai-robot* embodies an agent on a dedicated device. Every sandboxed
+-   agent acts as its own platform account rather than borrowing yours. See
+-   [web-app-hermes](roles/web-app-hermes/README.md),
+-   [web-app-openclaw](roles/web-app-openclaw/README.md) and
+-   [svc-virt-kata](roles/svc-virt-kata/README.md).
+
+- * **Home automation joins the platform.** *web-app-homeassistant* deploys the automation
+-   hub, exposes it as an MCP server so agents can drive it, persists the token it mints, and
+-   is reachable over tor. See [web-app-homeassistant](roles/web-app-homeassistant/README.md).
+
+- * **Changing a password changes it everywhere.** A user declares how its password must be
+-   generated, the inventory pins one for every declared user, a new generator produces
+-   API-key shapes, the deploy rotates credentials between its two passes, and a reset command
+-   exists. Applications that persist an administrator password at install now realign it when
+-   the declared one changes: Nextcloud, Moodle, EspoCRM, Jellyfin, Listmonk, Discourse,
+-   Checkmk, xWiki, n8n, Matrix and the dedicated MariaDB and Postgres engines. Checkmk keeps
+-   a 401 fatal so a wrong password cannot lock the account out.
+
+- * **Onions, firewall and name resolution.** *svc-net-firewall* owns the packet filter as one
+-   nftables table per role. Tor carries mail to a .onion in both deploy modes, rejects forged
+-   sources on the guarded ports, and binds its dnsmasq listeners statically so a failed
+-   re-enumeration can no longer drop every one of them. The deployment declares its own
+-   address space once, the egress range moved out of the Docker pool, and the container
+-   resolver follows the live bridge instead of a guessed address. Every host-bound port
+-   requires an explicit onion decision. See
+-   [svc-net-firewall](roles/svc-net-firewall/README.md).
+
+- * **Application fixes you will notice.** Nextcloud installs an OnlyOffice release upstream
+-   actually published, keeps social login working over tor, and makes its OIDC account an
+-   administrator. Element shows invites again through the new room list. Moodle survives the
+-   container roll during installation. Mattermost keeps its configuration in Postgres instead
+-   of on a shared volume, and its plugin tree is per node. GitLab creates the default
+-   organization a headless install never gets. Jellyfin waits for health before driving the
+-   setup wizard. Keycloak registers redirect URIs only for the apps a play deploys, keeps the
+-   allowed-origins claim out of the access token, and no longer caches LDAP federation past a
+-   fresh grant. The platform's own health mail no longer eats the sender quota.
+
+- * **Operating a deployment.** New make targets reach a single deployed application:
+-   *compose-app-exec*, *compose-app-logs* and *compose-app-restart*. Diagnostics collect the
+-   logs an application writes to a file, including from busybox containers. Health probes use
+-   a fast start cadence with a window that outlasts a real boot, so a slow starter is no
+-   longer reaped. The CSP health check accepts a status code a vhost declares instead of
+-   dropping the vhost, and gives onion vhosts a navigation budget Tor can meet.
+
+- **For Developers**
+
+- * **MCP is declared, not wired.** A role states an *mcp* block in *meta/services.yml*, and
+-   the vocabulary, discovery and rendering layer derives endpoints, clients, credentials and
+-   network edges from it. A client-provider pairing is declared once, on the provider;
+-   *sys-svc-mcp-reconcile* converges clients from the complete provider set; a refused pairing
+-   is expressed as off rather than gated at the call site; and *svc-ai-mcp-adapter* is a
+-   reusable per-provider sidecar rather than a standalone application. The contract is proven
+-   on deploy, including refusal on *initialize* and the tool inventory itself. The design,
+-   its delegation rules and a machine-checkable audit live under
+-   [docs/contributing/design/role/services/mcp.md](docs/contributing/design/role/services/mcp.md).
+
+- * **Registry and variant changes.** A variant can dictate the configuration of the providers
+-   it pulls in, and an MCP round decides for itself what it carries, which is the breaking
+-   change in this release. Fifteen moving pins gained names the registry can order, every MCP
+-   provider is registered as a shared service, *meta/schema.yml* finished its rename to
+-   *meta/secrets.yml*, role scripts are sorted into per-language folders, and *meta/addons* is
+-   now an accepted declaration site for pins and plugins.
+
+- * **Lints that fail closed.** Five properties that used to pass silently now fail. The PHP
+-   and Ruby that roles ship are syntax-checked, and so are shell scripts that ship as Jinja
+-   templates. *sys-service* owns every systemd unit a role installs. Healthcheck timings are
+-   judged against what the base image was measured to hold, a variable-free healthcheck
+-   belongs in *meta/services.yml*, an unenforceable NFS state layout fails at author time, a
+-   sandboxed role cannot be pinned to the manager, credentials are kept out of volumes
+-   declared non-secret, *no_log* is required on every task carrying one and forbidden in the
+-   test roles, and a JavaScript default for an unset environment variable is rejected.
+
+- * **Pins that cannot age unnoticed.** Image pins are classified and pull references built
+-   from the class, a moving tag declares itself with the marker it already carries, and a
+-   role's images move as one release or not at all. The updater reads addon declarations,
+-   orders vendor patch counters and five-component versions, reads a release line written
+-   before the number as a family, and now also watches pinned pip requirements and Ansible
+-   collections. Seven roles moved off the Debian codename base onto slim, and one Ubuntu
+-   mirror list with failover, a short timeout and a health test serves both the package cache
+-   and the image builds. *js-yaml* was lifted to 4.3.2 for GHSA-2883-xcg3-v3hh.
+
+- * **CI selects, resumes and proves.** A fourth deploy chunk stops a short priority chunk
+-   stranding budget, a manual run can set the chunk size the formula would derive, and a
+-   retrigger can override the chunk gate. Retriggering works by role and by what never got a
+-   verdict, resumes behind the green window rather than the deployed one, retires suites the
+-   source run already passed, and cancels the run before retriggering its failed roles. Each
+-   role's README instructions are replayed on its smallest deploy row, in the mode its
+-   *services.yml* declares. Distro images build concurrently on one runner, the matrix job
+-   folds into the image job, and the deploy chunks no longer wait on the DNS test.
+
+- * **Swarm, measured rather than assumed.** The deploy waits for its own update instead of
+-   guessing after it, refuses to call a stack converged while it is still updating, survives a
+-   task that failed and came back, reports what converged rather than only what did not, and
+-   says why the convergence probe refused. Placement is constrained to a role's declared
+-   platform arch, redis and memcached sidecars get a deploy block, and a run-once service no
+-   longer strands the stack deploy waiting for a replica it never has. The rescue dump
+-   captures the contents of the state volumes. In the test lab, workers are labelled
+-   kata-capable only when the app is sandboxed, NFS detaches before the node containers die,
+-   and the sandbox tier gets a second node.
+
+- * **Faster gates.** Per-host setup runs once per host instead of once per application, a
+-   role's volumes are answered from its own file instead of a whole-tree build, the Keycloak
+-   RBAC root group resolves once rather than once per app, the Playwright fixture copy the
+-   tree copy already made is dropped, logout helpers wait for a control instead of sleeping,
+-   and the OIDC login helper stops waiting out probes that cannot match. Onion timeouts scale
+-   by tor flavor instead of a flat multiplier, and every Playwright timeout has one source.
+
+- * **Documentation and agent instructions.** Six new requirement documents cover the LLM
+-   gateway and model backends, agent employees, Home Assistant, the robot role, the MCP proxy
+-   expansion and native AI gateway integration. The MCP design docs are nested under their own
+-   folder with an audit the lints can check. The role README template asks the reader for a
+-   domain the deployment can resolve, enforces consistent Credits attribution, and drops the em
+-   dash. Documentation generators are gathered under *cli/build/docs*, and a new CLI edits role
+-   bonds in a matrix instead of hunting through files.
+
 * Wed Aug 26 2026 Kevin Veen-Birkenbach <kevin@veen.world> - 13.0.0-1
 - * **Tor as a first-class deployment axis.** The new *svc-net-tor* role routes onion
 -   names through Tor via DNS instead of per-app proxies, offers a chutney flavor for
diff --git a/plugins/action/applications_carrier.py b/plugins/action/applications_carrier.py
index 5991ff5cd8..f7711ed295 100644
--- a/plugins/action/applications_carrier.py
+++ b/plugins/action/applications_carrier.py
@@ -5,19 +5,31 @@ Ansible forks a fresh worker per task, so the in-process render cache of
 a place all later workers inherit. This action renders in the worker of one
 constructor task and returns the payload as a host fact; every later worker
 inherits that fact at fork time and ``get_merged_applications`` serves it
-instead of rendering. Sits after the token store in
-``tasks/stages/01_constructor.yml`` so the embedded user records already
-carry the loaded tokens::
+instead of rendering::
 
     - name: 🧊 Render the applications SPOT once and carry it into every task's worker
       applications_carrier: {}
 
+``tasks/stages/01_constructor.yml`` parks two of them. The stage-wide one
+sits after the token store so the embedded user records already carry the
+loaded tokens, and after the ``add_host`` tasks because 114 roles gate
+services on ``group_names`` and the payload bakes those in. The
+merge block opens an earlier, block-scoped one and drops it again at the
+block's end, because ``merged_applications_cache_key`` reads neither
+``group_names`` nor the token file: a carrier left standing across either
+would be served unchanged where a fresh render belongs::
+
+    - name: 🧊 Drop the merge-block carrier so later stages re-render
+      applications_carrier:
+        clear: true
+
 The result is masked by the action itself: the fact is the whole rendered
 tree, about 0.4 MB with every application's credentials, and printing it at
 ``-v`` is neither credential debugging nor readable.
 
 Args:
-    none. Any argument is an error.
+    clear: drop the carrier fact instead of rendering. Defaults to false.
+        Any other argument is an error.
 """
 
 from __future__ import annotations
@@ -25,6 +37,7 @@ from __future__ import annotations
 from typing import Any
 
 from ansible.errors import AnsibleActionFail
+from ansible.module_utils.parsing.convert_bool import boolean
 from ansible.plugins.action import ActionBase
 from ansible.plugins.loader import lookup_loader
 
@@ -39,8 +52,19 @@ class ActionModule(ActionBase):
     ) -> dict[str, Any]:
         result = super().run(tmp, task_vars)
         task_vars = task_vars or {}
-        if self._task.args:
-            raise AnsibleActionFail("applications_carrier takes no arguments")
+        args = self._task.args or {}
+        unexpected = sorted(set(args) - {"clear"})
+        if unexpected:
+            raise AnsibleActionFail(
+                f"applications_carrier: unknown argument(s) {', '.join(unexpected)}; "
+                "the only argument is 'clear'"
+            )
+
+        if boolean(args.get("clear", False)):
+            result.update(
+                changed=False, ansible_facts={APPLICATIONS_RENDERED_FACT: None}
+            )
+            return result
 
         lookup = lookup_loader.get(
             "applications", loader=self._loader, templar=self._templar
diff --git a/plugins/filter/README.md b/plugins/filter/README.md
index 8ad96bd0ab..7312a1d39a 100644
--- a/plugins/filter/README.md
+++ b/plugins/filter/README.md
@@ -21,6 +21,39 @@ This directory contains custom **Ansible filter plugins** used within the Infini
 - If you need to **load data from an external source** (e.g., file, environment, API), use a lookup plugin instead.
 - If your logic requires **access to inventory, facts, or host-level information** that is not passed as a parameter.
 
+## Schema 🗺️
+
+How `csp_filters.py` assembles one application's Content-Security-Policy. Scope is the header build, not the other filters in this directory.
+
+```mermaid
+flowchart TD
+    decl["meta/csp.yml<br/>whitelist, flags, hashes"]
+    svc["meta/services.yml<br/>services.logout.enabled"]
+    flags["csp_filters.py:136<br/>get_csp_flags"]
+    grant["csp_filters.py:354<br/>logout grant"]
+    wl["csp_filters.py:123<br/>get_csp_whitelist"]
+    inj["sys-front-inj-dashboard,<br/>-javascript, -matomo, -logout<br/>add_csp_hash"]
+    gate["csp_filters.py:365<br/>hash gate"]
+    build["csp_filters.py:203<br/>build_csp_header"]
+    header["set $csp<br/>nginx vhost"]
+
+    decl -->|"1. flags read by"| flags
+    flags -->|"2. tokens"| build
+    svc -->|"3. read by"| grant
+    grant -->|"4. adds 'unsafe-inline'<br/>to script-src-elem and -attr"| build
+    decl -->|"5. whitelist read by"| wl
+    wl -->|"6. tokens"| build
+    inj -->|"7. snippets"| gate
+    gate -->|"8. hashes, only when<br/>'unsafe-inline' is absent"| build
+    build -->|"9. joined string"| header
+
+    grant -.->|"TRIP-WIRE: the token it adds<br/>closes the gate below, so every<br/>registered hash is discarded"| gate
+    svc -.->|"TRIP-WIRE: the flag derives from<br/>group_names, so the script policy<br/>follows the round, not the app"| grant
+    grant -.->|"TRIP-WIRE: absent from the<br/>smart-defaults docstring, which<br/>names logout only for frame-ancestors"| build
+```
+
+Styles carry `'unsafe-inline'` by default; scripts do not. The logout grant is the only path that puts it into a script directive.
+
 ## Further Reading
 
 - [Ansible Filter Plugins Documentation](https://docs.ansible.com/ansible/latest/plugins/filter.html)
diff --git a/plugins/filter/redirect_sources.py b/plugins/filter/redirect_sources.py
new file mode 100644
index 0000000000..f826647bb7
--- /dev/null
+++ b/plugins/filter/redirect_sources.py
@@ -0,0 +1,28 @@
+from ansible.errors import AnsibleFilterError
+
+
+def redirect_sources(host: str) -> list[str]:
+    """Ordered match prefixes for a redirect that targets ``host``.
+
+    Args:
+        host: the upstream host, as it appears in the proxied URL.
+
+    Returns:
+        The two host-qualified forms, then the bare ``/`` for a target the
+        upstream expressed as an absolute path.
+    """
+    if not isinstance(host, str) or not host.strip():
+        raise AnsibleFilterError("redirect_sources: host must be a non-empty string")
+    stripped = host.strip()
+    return [
+        f"https://{stripped}/",
+        f"http://{stripped}/",
+        "/",
+    ]
+
+
+class FilterModule:
+    def filters(self):
+        return {
+            "redirect_sources": redirect_sources,
+        }
diff --git a/plugins/lookup/alert_rule_roles.py b/plugins/lookup/alert_rule_roles.py
index 05096c9ca5..dd4e139c8e 100644
--- a/plugins/lookup/alert_rule_roles.py
+++ b/plugins/lookup/alert_rule_roles.py
@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from typing import Any
 
+from ansible.plugins.loader import lookup_loader
 from ansible.plugins.lookup import LookupBase
 
 from utils.cache import ROLES_DIR
@@ -11,14 +12,19 @@ ALERT_RULES_TEMPLATE = ("templates", "prometheus", "alert_rules.yml.j2")
 
 class LookupModule(LookupBase):
     """
-    Return a sorted list of deployed role IDs that ship their own Prometheus
-    alert rules, i.e. every role in ``group_names`` that has a template at
-    ``roles/<role_id>/templates/prometheus/alert_rules.yml.j2``.
+    Return a sorted list of role IDs whose Prometheus alert rules belong in
+    this deploy: every role that ships a template at
+    ``roles/<role_id>/templates/prometheus/alert_rules.yml.j2`` and is actually
+    scraped, i.e. appears in ``native_metrics_apps``.
 
     Keeps alert rules at the role that owns the metric instead of collecting
     them in web-app-prometheus: a role declares what "unhealthy" means for
     itself, and the Prometheus role only concatenates what the play enabled.
 
+    Filtering on activation here rather than inside each fragment is what keeps
+    the fragments free of boilerplate. A rule that fires on a series nothing
+    scrapes is worse than no rule: it alerts on ``absent()`` forever.
+
     Usage in a template:
       {% for role_id in lookup('alert_rule_roles') %}
       {% include 'roles/' + role_id + '/templates/prometheus/alert_rules.yml.j2' %}
@@ -39,11 +45,16 @@ class LookupModule(LookupBase):
             raise ValueError("alert_rule_roles lookup takes no positional terms")
 
         vars_ = variables or getattr(self._templar, "available_variables", {}) or {}
-        group_names: list[str] = vars_.get("group_names", []) or []
+
+        scraped: list[str] = lookup_loader.get(
+            "native_metrics_apps",
+            loader=self._loader,
+            templar=getattr(self, "_templar", None),
+        ).run([], variables=vars_)[0]
 
         result = [
             role_id
-            for role_id in sorted(set(group_names))
+            for role_id in sorted(set(scraped))
             if (ROLES_DIR / role_id).joinpath(*ALERT_RULES_TEMPLATE).exists()
         ]
 
diff --git a/plugins/lookup/api.py b/plugins/lookup/api.py
index 9740e8d16b..a10e26c2f2 100644
--- a/plugins/lookup/api.py
+++ b/plugins/lookup/api.py
@@ -5,13 +5,16 @@ from typing import Any
 from ansible.errors import AnsibleError
 from ansible.plugins.lookup import LookupBase
 
+from utils.api import resolve_api
+
 
 class LookupModule(LookupBase):
     """
     lookup('api', '<provider>.<key>')  e.g. lookup('api', 'github.client_id')
 
     Single point of truth for proprietary / external API credentials. Resolves a
-    dotted path against the global ``API`` mapping (group_vars/all/18_api.yml).
+    dotted path against the effective ``API`` mapping: the declaration in
+    group_vars/all/18_api.yml with the calling scope's override merged over it.
     Routing every access through this plugin keeps one place to change how
     proprietary API credentials are sourced (vault, env, secret manager, a
     different provider abstraction) without touching the call sites.
@@ -31,11 +34,10 @@ class LookupModule(LookupBase):
         if not path:
             raise AnsibleError("lookup('api'): empty key path.")
 
-        api = variables.get("API", {})
-        if templar is not None:
-            api = templar.template(api)
-        if not isinstance(api, dict):
-            raise AnsibleError("lookup('api'): global 'API' is not a mapping.")
+        try:
+            api = resolve_api(variables, templar=templar)
+        except TypeError as error:
+            raise AnsibleError(f"lookup('api'): {error}") from error
 
         node: Any = api
         for part in path.split("."):
diff --git a/plugins/lookup/api_enabled.py b/plugins/lookup/api_enabled.py
new file mode 100644
index 0000000000..c5f189070b
--- /dev/null
+++ b/plugins/lookup/api_enabled.py
@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from typing import Any
+
+from ansible.errors import AnsibleError
+from ansible.plugins.lookup import LookupBase
+
+from utils.api import provider_enabled, resolve_api
+
+
+class LookupModule(LookupBase):
+    """
+    lookup('api_enabled', '<provider>')  e.g. lookup('api_enabled', 'github')
+
+    True when every credential the provider declares in group_vars/all/18_api.yml
+    carries a value in the effective ``API`` mapping. Integrations that depend on
+    a proprietary provider gate on this instead of spelling the emptiness test
+    out per call site, so an added credential key extends the gate everywhere and
+    the result is a real boolean rather than a string a filter has to coerce.
+    """
+
+    def run(self, terms, variables: dict[str, Any] | None = None, **kwargs):
+        if not terms or len(terms) != 1:
+            raise AnsibleError(
+                "lookup('api_enabled') takes exactly one term: '<provider>' "
+                "(e.g. 'github')."
+            )
+
+        templar = getattr(self, "_templar", None)
+        variables = variables or getattr(templar, "available_variables", {}) or {}
+
+        provider = str(terms[0]).strip()
+        if not provider:
+            raise AnsibleError("lookup('api_enabled'): empty provider name.")
+
+        try:
+            api = resolve_api(variables, templar=templar)
+            return [provider_enabled(api, provider)]
+        except (KeyError, TypeError) as error:
+            raise AnsibleError(f"lookup('api_enabled'): {error}") from error
diff --git a/plugins/lookup/container_ports.py b/plugins/lookup/container_ports.py
index 87ce236006..f6cb5504a2 100644
--- a/plugins/lookup/container_ports.py
+++ b/plugins/lookup/container_ports.py
@@ -1,33 +1,67 @@
-"""Lookup `container_ports`: build a compose ``ports:`` publish block from
-``[service_name, protocol]`` or ``[service_name, protocol, host_ip]`` terms.
+"""Lookup `container_ports`: build a compose ``ports:`` block from declared ports.
 
-Single SPOT replacing the repeated, verbose port lookups. Each term is a
-two- or three-element list; pass one or more. The optional third element is
-the host IP to bind that port to; omit it to publish on every interface:
+Single SPOT for every published port in the repo. A term is either the short
+list form or the dict form; pass one or more.
+
+List form, unchanged::
 
     {{ lookup('container_ports',
               ['gitea', 'http', DOCKER_BIND_HOST],
               ['gitea', 'ssh']) | indent(4) }}
 
-produces
+produces::
 
     ports:
-      - "<DOCKER_BIND_HOST>:<services.gitea.ports.local.http>:<services.gitea.ports.internal.http>"
+      - "<DOCKER_BIND_HOST>:<services.gitea.ports.local.http>:<...internal.http>"
       - "<services.gitea.ports.public.ssh>:<services.gitea.ports.internal.ssh>"
 
-Per term the published (host) port is ``services.<svc>.ports.local.<proto>``
-when declared, else ``services.<svc>.ports.public.<proto>``; the container
-port is always ``services.<svc>.ports.internal.<proto>``. A third element
-prefixes ``<host_ip>:``; without it the port binds to all interfaces. This
-makes every mapping expressible, including binds to a specific public IP
-(e.g. ``['mailu', 'smtp', MAILU_IP4_PUBLIC]``).
+The published (host) port is ``ports.local.<proto>`` when declared, else
+``ports.public.<proto>``; the container port is ``ports.internal.<proto>``.
 
-``application_id`` is read from the play variables unless given as ``application_id=``.
+Dict form, for the shapes the list form cannot express::
+
+    {{ lookup('container_ports',
+              {'service': 'coturn', 'protocol': 'stun_turn',
+               'transport': ['udp', 'tcp'], 'container': 'same'},
+              {'service': 'coturn', 'protocol': 'relay', 'transport': 'udp',
+               'container': 'same'},
+              {'service': 'openresty', 'protocol': 'http', 'mode': 'host'},
+              {'service': 'funkwhale', 'protocol': 'api',
+               'publish': 'ephemeral'}) | indent(4) }}
+
+Keys:
+
+``service``, ``protocol``
+    Required, as in the list form.
+``ip``
+    Host address to bind to; omit to publish on every interface.
+``transport``
+    ``tcp``, ``udp``, or a list of both. One list item per transport. Omit for
+    compose's own default, which publishes no suffix.
+``container``
+    ``internal`` (default) reads ``ports.internal.<proto>``; ``same`` reuses the
+    published port, for services that cannot remap (STUN/TURN, media relays).
+``mode``
+    ``ingress`` (default) emits the short ``"host:published:container"`` string;
+    ``host`` emits the long block with ``mode: host``, which is what an edge
+    role needs in swarm so the client address survives the hop.
+``publish``
+    ``ephemeral`` publishes the container port on a host port docker picks, for
+    a service addressed only through the compose network.
+
+A declared value that is a ``{start, end}`` mapping renders as ``start-end`` on
+both sides, so a relay range needs no special term.
+
+``application_id`` is read from the play variables unless given as
+``application_id=``. ``key='expose'`` names the block instead of ``ports``, for
+Discourse's launcher file, whose ``expose:`` list is what becomes ``docker run
+-p`` there.
 """
 
 from __future__ import annotations
 
 import contextlib
+from collections.abc import Mapping
 from typing import Any
 
 from ansible.errors import AnsibleError
@@ -37,11 +71,115 @@ from ansible.template import trust_as_template
 
 from utils.roles.applications.config import get
 
+_TERM_KEYS = frozenset(
+    {"service", "protocol", "ip", "transport", "container", "mode", "publish"}
+)
+_TRANSPORTS = ("tcp", "udp")
+_CONTAINER_SOURCES = ("internal", "same")
+_MODES = ("ingress", "host")
+
 
 def _as_str(value: Any) -> str:
     return "" if value is None else str(value).strip()
 
 
+def _rendered(value: Any) -> str:
+    """A declared port value as compose writes it, ranges included."""
+    if isinstance(value, Mapping):
+        start, end = value.get("start"), value.get("end")
+        if start is None or end is None:
+            return ""
+        return f"{_as_str(start)}-{_as_str(end)}"
+    return _as_str(value)
+
+
+def _transports_of(term: Mapping) -> list[str]:
+    declared = term.get("transport")
+    if declared is None:
+        return [""]
+    wanted = [declared] if isinstance(declared, str) else list(declared)
+    for transport in wanted:
+        if transport not in _TRANSPORTS:
+            raise AnsibleError(
+                f"container_ports: transport must be one of {_TRANSPORTS}, "
+                f"got {transport!r}"
+            )
+    return wanted
+
+
+def _normalised(term: Any) -> dict[str, Any]:
+    """One term as a dict, accepting the legacy list form."""
+    if isinstance(term, (list, tuple)):
+        if len(term) not in (2, 3):
+            raise AnsibleError(
+                "container_ports: a list term must be [service_name, protocol] "
+                f"or [service_name, protocol, host_ip], got {term!r}"
+            )
+        term = {
+            "service": term[0],
+            "protocol": term[1],
+            **({"ip": term[2]} if len(term) == 3 else {}),
+        }
+    if not isinstance(term, Mapping):
+        raise AnsibleError(
+            f"container_ports: each term must be a list or a mapping, got {term!r}"
+        )
+    unknown = set(term) - _TERM_KEYS
+    if unknown:
+        raise AnsibleError(
+            f"container_ports: unknown term key(s) {sorted(unknown)}; "
+            f"valid keys are {sorted(_TERM_KEYS)}"
+        )
+    normalised = {
+        "service": _as_str(term.get("service")),
+        "protocol": _as_str(term.get("protocol")),
+        "ip": _as_str(term.get("ip")),
+        "transport": term.get("transport"),
+        "container": _as_str(term.get("container")) or "internal",
+        "mode": _as_str(term.get("mode")) or "ingress",
+        "publish": _as_str(term.get("publish")),
+    }
+    if not normalised["service"] or not normalised["protocol"]:
+        raise AnsibleError("container_ports: service and protocol must be non-empty")
+    if normalised["container"] not in _CONTAINER_SOURCES:
+        raise AnsibleError(
+            f"container_ports: container must be one of {_CONTAINER_SOURCES}, "
+            f"got {normalised['container']!r}"
+        )
+    if normalised["mode"] not in _MODES:
+        raise AnsibleError(
+            f"container_ports: mode must be one of {_MODES}, got {normalised['mode']!r}"
+        )
+    if normalised["publish"] and normalised["publish"] != "ephemeral":
+        raise AnsibleError(
+            "container_ports: publish accepts only 'ephemeral', "
+            f"got {normalised['publish']!r}"
+        )
+    if normalised["mode"] == "host" and normalised["ip"]:
+        raise AnsibleError(
+            "container_ports: mode 'host' binds the node's own interface and "
+            "takes no ip"
+        )
+    return normalised
+
+
+def _short_line(term: Mapping, published: str, container: str, transport: str) -> str:
+    suffix = f"/{transport}" if transport else ""
+    if term["publish"] == "ephemeral":
+        return f'  - "{container}{suffix}"'
+    head = f"{term['ip']}:" if term["ip"] else ""
+    return f'  - "{head}{published}:{container}{suffix}"'
+
+
+def _host_lines(published: str, container: str, transport: str) -> list[str]:
+    return [
+        f"  - target: {container}",
+        f"    published: {published}",
+        f"    protocol: {transport or 'tcp'}",
+        "    mode: host",
+    ]
+
+
 class LookupModule(LookupBase):
     def run(
         self,
@@ -58,22 +196,9 @@ class LookupModule(LookupBase):
         if not terms:
             raise AnsibleError(
                 "lookup('container_ports', [service_name, protocol[, host_ip]], ...) "
-                "expects one or more [service_name, protocol] terms"
+                "expects one or more terms"
             )
-        triples: list[tuple[str, str, str]] = []
-        for term in terms:
-            if not (isinstance(term, (list, tuple)) and len(term) in (2, 3)):
-                raise AnsibleError(
-                    "container_ports: each term must be a [service_name, protocol] "
-                    f"or [service_name, protocol, host_ip] list, got {term!r}"
-                )
-            service, protocol = _as_str(term[0]), _as_str(term[1])
-            host = _as_str(term[2]) if len(term) == 3 else ""
-            if not service or not protocol:
-                raise AnsibleError(
-                    "container_ports: service_name and protocol must be non-empty"
-                )
-            triples.append((service, protocol, host))
+        parsed = [_normalised(term) for term in terms]
 
         templar = getattr(self, "_templar", None)
         variables = variables or getattr(self._templar, "available_variables", {}) or {}
@@ -96,7 +221,7 @@ class LookupModule(LookupBase):
         ).run([], variables=variables)[0]
 
         def _port(service: str, scope: str, protocol: str, *, required: bool) -> str:
-            value = _as_str(
+            value = _rendered(
                 get(
                     applications=applications,
                     application_id=application_id,
@@ -112,14 +237,24 @@ class LookupModule(LookupBase):
                 )
             return value
 
-        lines = ["ports:"]
-        for service, protocol, host in triples:
-            internal = _port(service, "internal", protocol, required=True)
-            published = _port(service, "local", protocol, required=False) or _port(
-                service, "public", protocol, required=True
+        block_key = _as_str(kwargs.get("key")) or "ports"
+        if block_key not in ("ports", "expose"):
+            raise AnsibleError(
+                f"container_ports: key must be 'ports' or 'expose', got {block_key!r}"
             )
-            if host:
-                lines.append(f'  - "{host}:{published}:{internal}"')
+        lines = [f"{block_key}:"]
+        for term in parsed:
+            service, protocol = term["service"], term["protocol"]
+            published = _port(service, "local", protocol, required=False) or _port(
+                service, "public", protocol, required=term["publish"] != "ephemeral"
+            )
+            if term["container"] == "same":
+                container = published
             else:
-                lines.append(f'  - "{published}:{internal}"')
+                container = _port(service, "internal", protocol, required=True)
+            for transport in _transports_of(term):
+                if term["mode"] == "host":
+                    lines.extend(_host_lines(published, container, transport))
+                else:
+                    lines.append(_short_line(term, published, container, transport))
         return ["\n".join(lines)]
diff --git a/plugins/lookup/role_subnets.py b/plugins/lookup/role_subnets.py
new file mode 100644
index 0000000000..b3a06976a1
--- /dev/null
+++ b/plugins/lookup/role_subnets.py
@@ -0,0 +1,64 @@
+"""Lookup `role_subnets`: the local subnets other roles declare.
+
+Single SPOT for "which address block does role X own". The block is declared
+once, in that role's ``meta/networks.yml``; anything that has to reason about
+the deployment's own address space reads it from here instead of repeating the
+literal, which is how a CIDR ends up stated twice and then drifts.
+
+Usage:
+
+    {{ lookup('role_subnets', 'web-app-bigbluebutton') }}   # ['10.7.7.0/24']
+    {{ lookup('role_subnets', SOME_ROLE_LIST) }}            # one entry per role
+
+Terms may be role ids or lists of them, mixed. A role that declares no local
+subnet raises, because a silently dropped entry would narrow whatever firewall
+or trust list consumes the result.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ansible.errors import AnsibleError
+from ansible.plugins.loader import lookup_loader
+from ansible.plugins.lookup import LookupBase
+
+_SUBNET_PATH = "networks.local.subnet"
+
+
+def _flattened(terms: list[Any]) -> list[str]:
+    roles: list[str] = []
+    for term in terms:
+        if isinstance(term, (list, tuple)):
+            roles.extend(str(entry).strip() for entry in term)
+        else:
+            roles.append(str(term).strip())
+    return [role for role in roles if role]
+
+
+class LookupModule(LookupBase):
+    def run(
+        self,
+        terms: list[Any] | None,
+        variables: dict[str, Any] | None = None,
+        **kwargs: Any,
+    ) -> list[Any]:
+        roles = _flattened(terms or [])
+        if not roles:
+            raise AnsibleError(
+                "lookup('role_subnets', <role id or list of role ids>) expects "
+                "at least one role id"
+            )
+        config = lookup_loader.get(
+            "config",
+            loader=getattr(self, "_loader", None),
+            templar=getattr(self, "_templar", None),
+        )
+        subnets: list[str] = []
+        for role in roles:
+            value = config.run([role, _SUBNET_PATH], variables=variables)[0]
+            text = "" if value is None else str(value).strip()
+            if not text:
+                raise AnsibleError(f"role_subnets: '{role}' declares no {_SUBNET_PATH}")
+            subnets.append(text)
+        return [subnets]
diff --git a/plugins/lookup/sso_oidc_plugin.py b/plugins/lookup/sso_oidc_plugin.py
index 3e895dffc2..50c293009c 100644
--- a/plugins/lookup/sso_oidc_plugin.py
+++ b/plugins/lookup/sso_oidc_plugin.py
@@ -6,9 +6,6 @@ from ansible.errors import AnsibleError
 from ansible.plugins.loader import lookup_loader
 from ansible.plugins.lookup import LookupBase
 
-from utils.roles.applications.config import get
-from utils.roles.applications.services.sso import get_sso_config
-
 _APPLICATION_ID = "web-app-nextcloud"
 
 
@@ -40,33 +37,18 @@ class LookupModule(LookupBase):
         templar = getattr(self, "_templar", None)
         variables = variables or getattr(self._templar, "available_variables", {}) or {}
 
-        applications = lookup_loader.get(
-            "applications", loader=self._loader, templar=templar
-        ).run([], variables=variables)[0]
+        config = lookup_loader.get("config", loader=self._loader, templar=templar)
 
-        if not get_sso_config(applications, _APPLICATION_ID)["is_enabled"]:
+        def _setting(path: str, default: Any) -> Any:
+            return config.run([_APPLICATION_ID, path, default], variables=variables)[0]
+
+        if not bool(_setting("services.sso.enabled", False)):
             return [""]
 
-        explicit = get(
-            applications=applications,
-            application_id=_APPLICATION_ID,
-            config_path="services.sso.oidc.plugin",
-            strict=False,
-            default=None,
-            skip_missing_app=True,
-        )
+        explicit = _setting("services.sso.oidc.plugin", None)
         if isinstance(explicit, str) and explicit.strip():
             return [explicit.strip()]
 
-        ldap_enabled = bool(
-            get(
-                applications=applications,
-                application_id=_APPLICATION_ID,
-                config_path="services.ldap.enabled",
-                strict=False,
-                default=False,
-                skip_missing_app=True,
-            )
-        )
+        ldap_enabled = bool(_setting("services.ldap.enabled", False))
 
         return ["oidc_login" if ldap_enabled else "sociallogin"]
diff --git a/plugins/lookup/tor_ports.py b/plugins/lookup/tor_ports.py
index ec24f33741..fea32575f8 100644
--- a/plugins/lookup/tor_ports.py
+++ b/plugins/lookup/tor_ports.py
@@ -1,19 +1,18 @@
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Any
-
-if TYPE_CHECKING:
-    from pathlib import Path
+from typing import Any
 
 from ansible.errors import AnsibleError
 from ansible.plugins.loader import lookup_loader
 from ansible.plugins.lookup import LookupBase
 
-from utils.cache.base import _resolve_roles_dir
-from utils.cache.yaml import load_yaml_any
-from utils.roles.mapping import ROLE_FILE_META_SERVICES
+UDP_ONLY_CATEGORIES = frozenset({"relay", "media", "stun_turn", "stun_turn_tls"})
+"""Categories a hidden service cannot carry.
 
-_UDP_ONLY_CATEGORIES = frozenset({"relay", "media"})
+``relay`` and ``media`` are UDP. ``stun_turn`` and its TLS variant do speak TCP,
+but the allocation they hand out is a UDP relay address the onion client can
+never receive on, so forwarding the signalling port buys nothing.
+"""
 
 
 def _as_bool(value: object) -> bool:
@@ -24,6 +23,10 @@ def _as_bool(value: object) -> bool:
     return bool(value)
 
 
+def _mapping(value: object) -> dict[str, Any]:
+    return value if isinstance(value, dict) else {}
+
+
 def _collect_local_tcp_ports(port_categories: Any, into: set[int]) -> None:
     """Add single-int TCP ports of the loopback-published ``ports.local`` group
     only. An exposed service publishes just its local plaintext port to
@@ -36,37 +39,57 @@ def _collect_local_tcp_ports(port_categories: Any, into: set[int]) -> None:
     if not isinstance(local, dict):
         return
     for category, value in local.items():
-        if category in _UDP_ONLY_CATEGORIES:
+        if category in UDP_ONLY_CATEGORIES:
             continue
         if isinstance(value, int):
             into.add(value)
 
 
-def collect_public_ports(
+def collect_onion_ports(
+    applications: dict[str, Any],
     deployed_roles: list[str],
-    roles_dir: Path,
 ) -> list[int]:
-    """Single-int TCP ``ports.public`` entries of the deployed roles, sorted."""
+    """Single-int TCP ports a deployed role asks for by name under ``ports.onion``.
+
+    ``ports.onion`` is a category-keyed map of booleans alongside ``internal`` /
+    ``local`` / ``public``: it names which of a service's already-declared ports
+    should answer on the node onion, and nothing else. The port number comes
+    from ``ports.local`` when that category is declared there and from
+    ``ports.public`` otherwise, which is the precedence ``container_ports``
+    publishes by, so the forward always targets the port the service is actually
+    reachable on.
+
+    Naming the category is what makes this safe. Sweeping ``ports.public``
+    wholesale forwards ports the deployment never publishes -- ldaps 636 is
+    declared next to ``network.public: false``, and Mailu's implicit-TLS ports
+    are dropped from the publish list whenever TLS is off, which an onion
+    deployment always is.
+    """
     ports: set[int] = set()
-    for role in deployed_roles:
-        services_yml = roles_dir / role / ROLE_FILE_META_SERVICES
-        if not services_yml.is_file():
+    deployed = set(deployed_roles)
+    if not isinstance(applications, dict):
+        return []
+    for app_id, cfg in applications.items():
+        if app_id not in deployed:
             continue
-        data = load_yaml_any(str(services_yml), default_if_missing={})
-        if not isinstance(data, dict):
+        services = (cfg or {}).get("services") if isinstance(cfg, dict) else None
+        if not isinstance(services, dict):
             continue
-        tor = data.get("tor")
-        if not (isinstance(tor, dict) and _as_bool(tor.get("enabled"))):
-            continue
-        for entity in data.values():
+        for entity in services.values():
             if not isinstance(entity, dict):
                 continue
-            public = (entity.get("ports") or {}).get("public")
-            if not isinstance(public, dict):
+            declared = entity.get("ports")
+            if not isinstance(declared, dict):
                 continue
-            for category, value in public.items():
-                if category in _UDP_ONLY_CATEGORIES:
+            wanted = declared.get("onion")
+            if not isinstance(wanted, dict):
+                continue
+            local = _mapping(declared.get("local"))
+            public = _mapping(declared.get("public"))
+            for category, flag in wanted.items():
+                if category in UDP_ONLY_CATEGORIES or not _as_bool(flag):
                     continue
+                value = local.get(category, public.get(category))
                 if isinstance(value, int):
                     ports.add(value)
     return sorted(ports)
@@ -111,16 +134,18 @@ class LookupModule(LookupBase):
 
     Returns the HiddenServicePort mappings for the roles in the current deploy
     (``group_names``): a list of ``{'onion_port': <port>, 'target':
-    '127.0.0.1:<port>'}`` dicts, sorted by port. Two sources are unioned:
+    '127.0.0.1:<port>'}`` dicts, sorted by port. Two opt-ins are unioned:
 
-      * every ``ports.public`` TCP port of tor-enabled roles, and
-      * every port of a service that opts in with ``exposed: true`` (resolved
-        against the variant-merged applications view, so per-variant).
+      * every port a service names under ``ports.onion`` in meta/services.yml,
+        and
+      * every port of a service that opts in with ``exposed: true``.
 
-    Public/exposed ports bind the host interface, so the loopback target reaches
-    them from svc-net-tor's host-network container. Consumed by
-    ``TOR_ONION_EXTRA_PORTS`` (group_vars/all/19_tor.yml) and rendered as
-    ``HiddenServicePort`` lines in svc-net-tor's torrc.
+    Both are read from the variant-merged applications view, so a variant that
+    drops the opt-in drops the forward with it. The published port binds the
+    host interface, so the loopback target reaches it from svc-net-tor's
+    host-network container. Composed with the flagged forwards by
+    ``lookup('tor_extra_ports')`` and rendered as ``HiddenServicePort`` lines in
+    svc-net-tor's torrc.
     """
 
     def run(
@@ -138,17 +163,15 @@ class LookupModule(LookupBase):
             group_names = []
         deployed = [str(g) for g in group_names]
 
-        roles_dir = _resolve_roles_dir(roles_dir=kwargs.get("roles_dir"))
-        ports = set(collect_public_ports(deployed, roles_dir))
-
         try:
             applications = lookup_loader.get(
                 "applications",
                 loader=getattr(self, "_loader", None),
                 templar=getattr(self, "_templar", None),
             ).run([], variables=variables, roles_dir=kwargs.get("roles_dir"))[0]
-        except Exception:  # noqa: BLE001  no merged view -> exposed ports simply unavailable
+        except Exception:  # noqa: BLE001  no merged view -> no ports to forward
             applications = {}
+        ports = set(collect_onion_ports(applications, deployed))
         ports.update(collect_exposed_ports(applications, deployed))
 
         return [
diff --git a/pyproject.toml b/pyproject.toml
index 606ff87fab..9a8f0df95c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "infinito-nexus"
-version = "13.0.0"
+version = "14.2.0"
 description = "Infinito.Nexus"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -33,7 +33,7 @@ deploy = [
   "requests",
 ]
 dev = [
-  "ruff==0.16.6",
+  "ruff==0.16.7",
   "import-linter",
   "pre-commit",
   "git-maintainer-tools",
diff --git a/requirements/requirements.galaxy.yml b/requirements/requirements.galaxy.yml
index 33ae9d1493..30d8759605 100644
--- a/requirements/requirements.galaxy.yml
+++ b/requirements/requirements.galaxy.yml
@@ -1,9 +1,16 @@
 ---
 collections:
   - name: ansible.posix
-  - name: kewlfft.aur
-  - name: community.general
-  - name: community.docker
-  - name: hetzner.hcloud
-  - name: ansible.posix
+    version: 2.2.2
   - name: ansible.mysql
+    version: 5.2.0
+  - name: kewlfft.aur
+    version: 0.13.0
+  - name: community.general
+    version: 13.4.0
+  - name: community.docker
+    version: 5.3.0
+  - name: community.library_inventory_filtering_v1
+    version: 1.1.5
+  - name: hetzner.hcloud
+    version: 7.1.0
diff --git a/requirements/requirements.git.yml b/requirements/requirements.git.yml
index 31ddb7279d..fbc7e57776 100644
--- a/requirements/requirements.git.yml
+++ b/requirements/requirements.git.yml
@@ -3,34 +3,34 @@ collections:
   - name: ansible.posix
     source: https://github.com/ansible-collections/ansible.posix.git
     type: git
-    version: main
+    version: 2.2.2
 
   - name: ansible.mysql
     source: https://github.com/ansible-collections/ansible.mysql.git
     type: git
-    version: main
+    version: 5.2.0
 
   - name: kewlfft.aur
     source: https://github.com/kewlfft/ansible-aur.git
     type: git
-    version: master
+    version: 7affd00193b03bf820ebcd8b13dfa81aab59803e
 
   - name: community.general
     source: https://github.com/ansible-collections/community.general.git
     type: git
-    version: main
+    version: 13.4.0
 
   - name: community.docker
     source: https://github.com/ansible-collections/community.docker.git
     type: git
-    version: main
+    version: 5.3.0
 
   - name: community.library_inventory_filtering_v1
     source: https://github.com/ansible-collections/community.library_inventory_filtering.git
     type: git
-    version: stable-1
+    version: 1.1.5
 
   - name: hetzner.hcloud
     source: https://github.com/ansible-collections/hetzner.hcloud.git
     type: git
-    version: main
+    version: 7.1.0
diff --git a/roles/desk-ssh/tasks/00_core.yml b/roles/desk-ssh/tasks/00_core.yml
index 8996de8785..a6c37710c1 100644
--- a/roles/desk-ssh/tasks/00_core.yml
+++ b/roles/desk-ssh/tasks/00_core.yml
@@ -21,26 +21,49 @@
 
 - name: ✅ Ensure systemd user directory exists
   file:
-    path: "$HOME/.config/systemd/user"
+    path: "{{ DIR_SYSTEM_SERVICE_USER }}"
     state: directory
     mode: "0700"
   become: false
 
-- name: 🚀 Deploy ssh-agent systemd unit file
-  template: # nocheck: stack-host-template (per-host/user workstation systemd unit)
-    src: ssh-agent.service.j2
-    dest: "$HOME/.config/systemd/user/ssh-agent.service"
-    mode: "0644"
+- name: 🔍 Look for the unversioned ssh-agent unit
+  stat:
+    path: "{{ desk_ssh_legacy_unit }}"
+  register: desk_ssh_legacy_unit_state
   become: false
 
-- name: 🟢 Enable and start ssh-agent service
-  systemd:
-    name: ssh-agent.service
-    scope: user
-    enabled: true
-    state: started
-    daemon_reload: true
-  become: false
+- name: 🧹 Retire the unversioned ssh-agent unit
+  block:
+    - name: 🛑 Stop and disable the unversioned ssh-agent unit
+      systemd:
+        name: "{{ desk_ssh_legacy_unit | basename }}"
+        scope: user
+        state: stopped
+        enabled: false
+      become: false
+
+    - name: 🗑️ Delete the unversioned ssh-agent unit
+      file:
+        path: "{{ desk_ssh_legacy_unit }}"
+        state: absent
+      become: false
+  when: desk_ssh_legacy_unit_state.stat.exists
+
+- name: 🚀 Deploy ssh-agent systemd unit file
+  include_role:
+    name: sys-service
+  vars:
+    system_service_scope: user
+    system_service_copy_files: false
+    system_service_state: started
+    system_service_tpl_on_failure: ""
+    system_service_tpl_type: simple
+    system_service_tpl_runtime: ""
+    system_service_tpl_before: default.target
+    system_service_tpl_wanted_by: default.target
+    system_service_tpl_environment:
+      - "SSH_AUTH_SOCK=%t/ssh-agent.socket"
+    system_service_tpl_exec_start: "/usr/bin/ssh-agent -D -a $SSH_AUTH_SOCK"
 
 - name: ✅ Ensure ~/.profile exists with common environment
   lineinfile:
diff --git a/roles/desk-ssh/templates/ssh-agent.service.j2 b/roles/desk-ssh/templates/ssh-agent.service.j2
deleted file mode 100644
index 3125724f18..0000000000
--- a/roles/desk-ssh/templates/ssh-agent.service.j2
+++ /dev/null
@@ -1,11 +0,0 @@
-[Unit]
-Description=User SSH Agent
-Before=default.target
-
-[Service]
-Type=simple
-Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket
-ExecStart=/usr/bin/ssh-agent -D -a $SSH_AUTH_SOCK
-
-[Install]
-WantedBy=default.target
\ No newline at end of file
diff --git a/roles/desk-ssh/vars/main.yml b/roles/desk-ssh/vars/main.yml
index 7d866e2329..d8bb7879e0 100644
--- a/roles/desk-ssh/vars/main.yml
+++ b/roles/desk-ssh/vars/main.yml
@@ -1,3 +1,5 @@
 ---
 application_id: desk-ssh
+system_service_id: "{{ application_id }}"
 desk_ssh_repository: "{{ lookup('config', application_id, 'services.ssh.repository') }}"
+desk_ssh_legacy_unit: "{{ [ DIR_SYSTEM_SERVICE_USER, 'ssh-agent.service' ] | path_join }}"
diff --git a/roles/svc-ai-litellm/README.md b/roles/svc-ai-litellm/README.md
index a87bcb9b7b..a975a2d0b9 100644
--- a/roles/svc-ai-litellm/README.md
+++ b/roles/svc-ai-litellm/README.md
@@ -6,7 +6,7 @@
 
 ## Overview
 
-This role deploys LiteLLM as a shared gateway container in Compose and Swarm deployments, backed by the central PostgreSQL service. The gateway is headless: it binds its HTTP port on the container host and claims no domain of its own, and the browser-facing surface is published separately by the LiteLLM Admin UI. It renders the model list from the interchangeable local backends available on the host, Ollama and LM Studio, and adds an OpenRouter entry when an OpenRouter API key is configured. Once the gateway is up, it provisions one virtual key per consuming application through the gateway admin API.
+This role deploys LiteLLM as a shared gateway container in Compose and Swarm deployments, backed by the central PostgreSQL service. The gateway is headless: it binds its HTTP port on the container host and claims no domain of its own, and the browser-facing surface is published separately by the LiteLLM Admin UI. It renders the model list from the interchangeable local backends available on the host, Ollama and LM Studio, and adds the OpenAI, Anthropic and OpenRouter entries whose API key is configured. Once the gateway is up, it provisions one virtual key per consuming application through the gateway admin API.
 
 ## Cosmos
 
@@ -63,7 +63,8 @@ Solid `1:1` edges are fixed relationships; dashed `0..1` edges are conditional (
 ## Features
 
 - **OpenAI-compatible API:** One HTTP endpoint serves every model listed in the gateway configuration.
-- **Backend routing:** Model entries are generated for Ollama and LM Studio when those services run on the host, and for OpenRouter when its API key is set.
+- **Backend routing:** Model entries are generated for Ollama and LM Studio when those services run on the host, under the shared alias each model carries so a consumer names one model whichever local backend answers it.
+- **Remote providers:** OpenAI, Anthropic and OpenRouter each add their models when a key is configured. The keys are declared in `meta/secrets.yml` with the `type` and `regex` their value must satisfy, and default to the central `API.<provider>.api_key` entry; an unset key leaves that provider's routes unpublished.
 - **Per-consumer virtual keys:** Each consuming application receives its own virtual key, created through the gateway admin API under an alias naming that application.
 - **File-based model list:** The model list is mounted as a read-only config file, with database-stored model entries turned off.
 - **Managed credentials:** The gateway master key and the admin UI password are generated and kept as role credentials, and the admin UI username is the platform administrator name.
diff --git a/roles/svc-ai-litellm/files/test/.nocheck b/roles/svc-ai-litellm/files/test/.nocheck
new file mode 100644
index 0000000000..2b9d82d840
--- /dev/null
+++ b/roles/svc-ai-litellm/files/test/.nocheck
@@ -0,0 +1 @@
+# nocheck: role-files-layout - Role test harness with test.sh as its entry point; test-e2e-cli stages files/test/ by that fixed path.
diff --git a/roles/svc-ai-litellm/files/test/probe.py b/roles/svc-ai-litellm/files/test/probe.py
new file mode 100644
index 0000000000..f6ad07ce32
--- /dev/null
+++ b/roles/svc-ai-litellm/files/test/probe.py
@@ -0,0 +1,190 @@
+"""Assert the gateway routes to exactly the backends this deployment enabled.
+
+Runs inside the litellm container, where the gateway answers on loopback and
+the backend containers resolve by name. Standard library only: the image ships
+the litellm app, not a test toolchain.
+
+Env (rendered into test.env from templates/test.env.j2):
+    PORT               gateway http port inside the container
+    MASTER_KEY         gateway master key
+    CHAT_MODEL         the model every consumer asks for (LITELLM_CHAT_MODEL)
+    CHAT_MODEL_SERVED  true|false, whether a backend can answer it
+    EXPECTED_MODELS    JSON list the config template published
+    LMSTUDIO_ALIASES   JSON list of aliases only LM Studio provides, rendered
+                       whether or not the backend is deployed so the absent
+                       case stays assertable
+    REMOTE_ALIASES     JSON list of aliases a configured provider key publishes
+                       (OpenAI, Anthropic, OpenRouter)
+    OLLAMA_ENABLED     true|false
+    LMSTUDIO_ENABLED   true|false
+    RETRIES            completion attempts (default 10)
+    SLEEP_SECONDS      wait between attempts (default 6)
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import time
+import urllib.error
+import urllib.request
+
+
+def evaluate(
+    *,
+    served: set[str],
+    expected: list[str],
+    chat_model: str,
+    chat_model_served: bool,
+    ollama_enabled: bool,
+    lmstudio_enabled: bool,
+    lmstudio_aliases: list[str],
+    remote_aliases: list[str],
+) -> list[str]:
+    """Every routing violation the published model list shows, as messages.
+
+    Args:
+        served: model ids the gateway answers ``/v1/models`` with.
+        expected: model ids the rendered config declared.
+        chat_model: the id consumers are configured to ask for.
+        chat_model_served: whether any backend can answer *chat_model*.
+        ollama_enabled: svc-ai-ollama is deployed on the gateway's host.
+        lmstudio_enabled: svc-ai-lmstudio is deployed on the gateway's host.
+        lmstudio_aliases: aliases only LM Studio provides, whatever is deployed.
+        remote_aliases: aliases a configured remote provider key publishes.
+
+    Returns:
+        One message per violation; empty when the routing is consistent.
+    """
+    failures: list[str] = []
+
+    undelivered = sorted(set(expected) - served)
+    if undelivered:
+        failures.append(
+            f"the config declares {undelivered} but the gateway does not serve "
+            f"them; the rendered config.yaml and the running gateway disagree"
+        )
+
+    exclusive = set(lmstudio_aliases)
+    if lmstudio_enabled and not exclusive <= served:
+        failures.append(
+            f"svc-ai-lmstudio is deployed but the gateway does not serve "
+            f"{sorted(exclusive - served)}; its models were declared and not routed"
+        )
+    if not lmstudio_enabled and exclusive & served:
+        failures.append(
+            f"svc-ai-lmstudio is not deployed yet the gateway publishes "
+            f"{sorted(exclusive & served)}; a route stands without its backend"
+        )
+
+    unbacked = sorted(served - exclusive - set(remote_aliases))
+    if not ollama_enabled and unbacked:
+        failures.append(
+            f"svc-ai-ollama is not deployed yet the gateway publishes {unbacked}"
+        )
+
+    if not chat_model_served:
+        if served:
+            failures.append(
+                f"no backend is deployed but the gateway publishes {sorted(served)}"
+            )
+        return failures
+
+    if chat_model not in served:
+        failures.append(
+            f"consumers are configured for '{chat_model}' (LITELLM_CHAT_MODEL, "
+            f"built from the deployment inventory) but the gateway serves "
+            f"{sorted(served)} (built from this host's group_names); the two "
+            f"sources disagree"
+        )
+
+    return failures
+
+
+def _call(base: str, key: str, path: str, payload: dict | None = None):
+    body = None if payload is None else json.dumps(payload).encode()
+    request = urllib.request.Request(  # noqa: S310 - literal http:// to loopback
+        base + path,
+        data=body,
+        headers={
+            "Authorization": f"Bearer {key}",
+            "Content-Type": "application/json",
+        },
+    )
+    with urllib.request.urlopen(  # noqa: S310 - literal http:// to loopback
+        request, timeout=120
+    ) as response:
+        return json.loads(response.read().decode() or "{}")
+
+
+def _completion(base: str, key: str, model: str, retries: int, pause: float) -> str:
+    last_error = "no attempt ran"
+    for attempt in range(1, retries + 1):
+        try:
+            completion = _call(
+                base,
+                key,
+                "/v1/chat/completions",
+                {
+                    "model": model,
+                    "messages": [
+                        {"role": "user", "content": "Reply with the word pong."}
+                    ],
+                    "max_tokens": 16,
+                },
+            )
+            choices = completion.get("choices") or [{}]
+            answer = (choices[0].get("message", {}).get("content") or "").strip()
+            if answer:
+                return answer
+            last_error = "empty content"
+        except (urllib.error.URLError, TimeoutError, ValueError) as exc:
+            last_error = f"{type(exc).__name__}: {exc}"
+        if attempt < retries:
+            time.sleep(pause)
+    raise RuntimeError(last_error)
+
+
+def main() -> int:
+    key = os.environ["MASTER_KEY"]
+    base = f"http://127.0.0.1:{os.environ['PORT']}"
+    chat_model = os.environ["CHAT_MODEL"].strip()
+    chat_model_served = os.environ["CHAT_MODEL_SERVED"] == "true"
+    retries = int(os.environ.get("RETRIES", "10"))
+    pause = float(os.environ.get("SLEEP_SECONDS", "6"))
+
+    listing = _call(base, key, "/v1/models")
+    served = {entry.get("id") for entry in listing.get("data", [])}
+    print(f"[INFO] gateway answered /v1/models, serving {sorted(served)}")
+
+    failures = evaluate(
+        served=served,
+        expected=json.loads(os.environ["EXPECTED_MODELS"]),
+        chat_model=chat_model,
+        chat_model_served=chat_model_served,
+        ollama_enabled=os.environ["OLLAMA_ENABLED"] == "true",
+        lmstudio_enabled=os.environ["LMSTUDIO_ENABLED"] == "true",
+        lmstudio_aliases=json.loads(os.environ["LMSTUDIO_ALIASES"]),
+        remote_aliases=json.loads(os.environ["REMOTE_ALIASES"]),
+    )
+
+    if chat_model_served and not failures:
+        try:
+            answer = _completion(base, key, chat_model, retries, pause)
+            print(f"[OK]   '{chat_model}' answered: {answer[:60]}")
+        except RuntimeError as exc:
+            failures.append(
+                f"'{chat_model}' is published but answered nothing after "
+                f"{retries} attempts; last failure: {exc}"
+            )
+
+    for failure in failures:
+        print(f"[FAIL] {failure}", file=sys.stderr)
+    if not failures:
+        print("[OK]   the published routes match the deployed backends")
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/roles/svc-ai-litellm/files/test/test.sh b/roles/svc-ai-litellm/files/test/test.sh
new file mode 100644
index 0000000000..f8e8a895f1
--- /dev/null
+++ b/roles/svc-ai-litellm/files/test/test.sh
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# shellcheck shell=bash
+#
+# svc-ai-litellm routing test. Runs probe.py inside the gateway container, where
+# the API answers on loopback and the backends resolve by container name, and
+# asserts the published model list matches the backends this deployment enabled.
+#
+# Env (rendered into test.env from templates/test.env.j2):
+#   LITELLM_CONTAINER          resolved gateway container (CLI_LOCAL_CID)
+#   LITELLM_PORT               gateway http port inside the container
+#   LITELLM_MASTER_KEY_B64     base64 master key (avoids shell-quoting issues)
+#   LITELLM_CHAT_MODEL         the model every consumer asks for
+#   LITELLM_CHAT_MODEL_SERVED  true|false
+#   LITELLM_EXPECTED_MODELS    JSON list the config template published
+#   LITELLM_LMSTUDIO_ALIASES   JSON list of aliases only LM Studio provides
+#   LITELLM_REMOTE_ALIASES     JSON list of aliases a configured provider key adds
+#   LITELLM_OLLAMA_ENABLED     true|false
+#   LITELLM_LMSTUDIO_ENABLED   true|false
+#   READY_RETRIES              gateway readiness attempts (default 30)
+#   READY_SLEEP_SECONDS        wait between attempts (default 5)
+
+set -uo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+READY_RETRIES="${READY_RETRIES:-30}"
+READY_SLEEP_SECONDS="${READY_SLEEP_SECONDS:-5}"
+
+MASTER_KEY="$(printf '%s' "${LITELLM_MASTER_KEY_B64}" | base64 -d 2>/dev/null)"
+[ -n "${MASTER_KEY}" ] || {
+	echo "[FATAL] LITELLM_MASTER_KEY_B64 missing or undecodable" >&2
+	exit 2
+}
+[ -n "${LITELLM_CONTAINER}" ] || {
+	echo "[FATAL] LITELLM_CONTAINER unset; the gateway container was not resolved" >&2
+	exit 2
+}
+
+# The image ships the litellm app, so a python interpreter is present, but the
+# upstream tag has changed which of the two names is on PATH.
+interpreter() {
+	# nocheck: container-exec-resolver  address resolved by the caller and passed in
+	if container exec -i "${LITELLM_CONTAINER}" python3 -c '' 2>/dev/null; then
+		echo python3
+	else
+		echo python
+	fi
+}
+
+probe() {
+	# nocheck: container-exec-resolver  address resolved by the caller and passed in
+	container exec -i \
+		-e "PORT=${LITELLM_PORT}" \
+		-e "MASTER_KEY=${MASTER_KEY}" \
+		-e "CHAT_MODEL=${LITELLM_CHAT_MODEL}" \
+		-e "CHAT_MODEL_SERVED=${LITELLM_CHAT_MODEL_SERVED}" \
+		-e "EXPECTED_MODELS=${LITELLM_EXPECTED_MODELS}" \
+		-e "LMSTUDIO_ALIASES=${LITELLM_LMSTUDIO_ALIASES}" \
+		-e "REMOTE_ALIASES=${LITELLM_REMOTE_ALIASES}" \
+		-e "OLLAMA_ENABLED=${LITELLM_OLLAMA_ENABLED}" \
+		-e "LMSTUDIO_ENABLED=${LITELLM_LMSTUDIO_ENABLED}" \
+		"${LITELLM_CONTAINER}" "$(interpreter)" - <"${here}/probe.py"
+}
+
+attempt=1
+while [ "${attempt}" -le "${READY_RETRIES}" ]; do
+	output="$(probe 2>&1)"
+	rc=$?
+	case "${output}" in
+	*"gateway answered /v1/models"*)
+		echo "${output}"
+		exit "${rc}"
+		;;
+	esac
+	attempt=$((attempt + 1))
+	[ "${attempt}" -le "${READY_RETRIES}" ] && sleep "${READY_SLEEP_SECONDS}"
+done
+
+echo "[FAIL] the gateway never answered /v1/models after ${READY_RETRIES} attempts" >&2
+echo "${output}" >&2
+exit 1
diff --git a/roles/svc-ai-litellm/meta/secrets.yml b/roles/svc-ai-litellm/meta/secrets.yml
index 3a0c374abc..a2fb9ce606 100644
--- a/roles/svc-ai-litellm/meta/secrets.yml
+++ b/roles/svc-ai-litellm/meta/secrets.yml
@@ -10,3 +10,19 @@ credentials:
     algorithm: "alphanumeric"
     validation:
       min_length: 32
+  openai_api_key:
+    description: "OpenAI API key; empty leaves the openai/* models unpublished. The pattern rejects a truncated or whitespace-carrying paste, not a vendor prefix:
+      OpenAI moved from sk- to sk-proj- without notice, and a schema that pinned the prefix would reject a valid key"
+    type: "string"
+    regex: "\\S{20,}"
+    default: "{{ lookup('api', 'openai.api_key') }}"
+  anthropic_api_key:
+    description: "Anthropic API key; empty leaves the anthropic/* models unpublished"
+    type: "string"
+    regex: "\\S{20,}"
+    default: "{{ lookup('api', 'anthropic.api_key') }}"
+  openrouter_api_key:
+    description: "OpenRouter API key; empty leaves openrouter/auto unpublished"
+    type: "string"
+    regex: "\\S{20,}"
+    default: "{{ lookup('api', 'openrouter.api_key') }}"
diff --git a/roles/svc-ai-litellm/meta/services.yml b/roles/svc-ai-litellm/meta/services.yml
index 39c3430c6e..663f5e67c0 100644
--- a/roles/svc-ai-litellm/meta/services.yml
+++ b/roles/svc-ai-litellm/meta/services.yml
@@ -11,7 +11,7 @@ litellm:
   backup:
     no_stop_required: true
   image: ghcr.io/berriai/litellm
-  version: main-v1.77.3.dynamic_rates
+  version: main-v1.77.7-stable
   name: litellm
   max_output_tokens: 512
   upstream_timeout: 240
@@ -42,6 +42,6 @@ ollama:
 
 # nocheck: playwright-service-flag, dynamic-flag
 lmstudio:
-  bond: 1
+  bond: 0.5
   enabled: "{{ 'svc-ai-lmstudio' in group_names }}"
   shared: "{{ 'svc-ai-lmstudio' in group_names }}"
diff --git a/roles/svc-ai-litellm/meta/tests.yml b/roles/svc-ai-litellm/meta/tests.yml
new file mode 100644
index 0000000000..89594be937
--- /dev/null
+++ b/roles/svc-ai-litellm/meta/tests.yml
@@ -0,0 +1,4 @@
+---
+cli:
+  timeout: 600
+  container_service_key: litellm
diff --git a/roles/svc-ai-litellm/meta/variants.yml b/roles/svc-ai-litellm/meta/variants.yml
index be12f8165f..8ae1ddd8aa 100644
--- a/roles/svc-ai-litellm/meta/variants.yml
+++ b/roles/svc-ai-litellm/meta/variants.yml
@@ -7,8 +7,8 @@
       enabled: true
       shared: true
     lmstudio:
-      enabled: true
-      shared: true
+      enabled: false
+      shared: false
     postgres:
       shared: true
 
@@ -21,3 +21,14 @@
     lmstudio:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
+
+- services:
+    ollama:
+      enabled: false
+      shared: false
+    lmstudio:
+      bond: 0.5
+      enabled: true
+      shared: true
+    postgres:
+      shared: true
diff --git a/roles/svc-ai-litellm/tasks/00_core.yml b/roles/svc-ai-litellm/tasks/00_core.yml
index db70913e93..9076c123b0 100644
--- a/roles/svc-ai-litellm/tasks/00_core.yml
+++ b/roles/svc-ai-litellm/tasks/00_core.yml
@@ -21,6 +21,15 @@
       - src: "config.yaml.j2"
         dest: "{{ LITELLM_CONFIG_PATH_HOST }}"
 
+- name: "🧮 Freeze the routing contract the CLI test asserts against"
+  ansible.builtin.set_fact:
+    LITELLM_TEST_CONTRACT:
+      ollama: "{{ LITELLM_OLLAMA_BACKEND | bool }}"
+      lmstudio: "{{ LITELLM_LMSTUDIO_BACKEND | bool }}"
+      served: "{{ LITELLM_CHAT_MODEL_SERVED | bool }}"
+  delegate_to: "{{ STACK_HOST }}"
+  run_once: true
+
 - name: "🔧 Setup container network for {{ application_id }}"
   include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/network/routine.yml') }}"
   vars:
diff --git a/roles/svc-ai-litellm/templates/config.yaml.j2 b/roles/svc-ai-litellm/templates/config.yaml.j2
index 1b55fbc39e..c4bed5dcce 100644
--- a/roles/svc-ai-litellm/templates/config.yaml.j2
+++ b/roles/svc-ai-litellm/templates/config.yaml.j2
@@ -1,31 +1,35 @@
-{% set _ollama_models = lookup('config', 'svc-ai-ollama', 'services.ollama.preload_models') if 'svc-ai-ollama' in group_names else [] %}
-{% set has_backend = _ollama_models or ('svc-ai-lmstudio' in group_names) or LITELLM_OPENROUTER_API_KEY %}
+{% set _ollama_models = lookup('config', 'svc-ai-ollama', 'services.ollama.preload_models') if LITELLM_OLLAMA_BACKEND | bool else [] %}
+{% set _lmstudio_models = lookup('config', 'svc-ai-lmstudio', 'services.lmstudio.preload_models') if LITELLM_LMSTUDIO_BACKEND | bool else [] %}
+{% set _remote_models = LITELLM_REMOTE_BACKENDS | selectattr('key') | list %}
+{% set has_backend = _ollama_models or _lmstudio_models or _remote_models %}
 model_list:{{ ' []' if not has_backend else '' }}
 {% for _model in _ollama_models %}
-  - model_name: "{{ _model }}"
+  - model_name: "{{ _model.alias }}"
     litellm_params:
-      model: "ollama/{{ _model }}"
+      model: "ollama/{{ _model.alias }}"
       api_base: {{ OLLAMA_BASE_LOCAL_URL }}
       rpm: 1000
       max_tokens: {{ LITELLM_MAX_OUTPUT_TOKENS }}
       timeout: {{ LITELLM_UPSTREAM_TIMEOUT }}
 {% endfor %}
-{% if 'svc-ai-lmstudio' in group_names %}
-  - model_name: lmstudio/default
+{% for _model in _lmstudio_models if _model.alias not in (_ollama_models | map(attribute='alias') | list) %}
+  - model_name: "{{ _model.alias }}"
     litellm_params:
-      model: openai/local-model
+      model: "openai/{{ _model.name }}"
       api_base: {{ LMSTUDIO_BASE_LOCAL_URL }}/v1
       api_key: lm-studio
       rpm: 1000
       max_tokens: {{ LITELLM_MAX_OUTPUT_TOKENS }}
       timeout: {{ LITELLM_UPSTREAM_TIMEOUT }}
-{% endif %}
-{% if LITELLM_OPENROUTER_API_KEY %}
-  - model_name: openrouter/auto
+{% endfor %}
+{% for _backend in _remote_models %}
+  - model_name: "{{ _backend.alias }}"
     litellm_params:
-      model: openrouter/openrouter/auto
-      api_key: os.environ/OPENROUTER_API_KEY
-{% endif %}
+      model: "{{ _backend.model }}"
+      api_key: os.environ/{{ _backend.env }}
+      max_tokens: {{ LITELLM_MAX_OUTPUT_TOKENS }}
+      timeout: {{ LITELLM_UPSTREAM_TIMEOUT }}
+{% endfor %}
 
 litellm_settings:
   drop_params: true
diff --git a/roles/svc-ai-litellm/templates/env.j2 b/roles/svc-ai-litellm/templates/env.j2
index c435fd3aa7..e77c43da8e 100644
--- a/roles/svc-ai-litellm/templates/env.j2
+++ b/roles/svc-ai-litellm/templates/env.j2
@@ -5,9 +5,9 @@ DATABASE_URL={{ lookup('database', application_id, 'url_full') | dotenv_quote }}
 STORE_MODEL_IN_DB=False
 UI_USERNAME={{ lookup('users', 'administrator').username }}
 UI_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.ui_password') | dotenv_quote }}
-{% if LITELLM_OPENROUTER_API_KEY %}
-OPENROUTER_API_KEY={{ LITELLM_OPENROUTER_API_KEY | dotenv_quote }}
-{% endif %}
+{% for _backend in LITELLM_REMOTE_BACKENDS if _backend.key %}
+{{ _backend.env }}={{ _backend.key | dotenv_quote }}
+{% endfor %}
 {% if LITELLM_UI_SSO | bool %}
 PROXY_BASE_URL={{ LITELLM_UI_BASE_URL }}
 PROXY_ADMIN_ID={{ LITELLM_UI_ADMIN }}
diff --git a/roles/svc-ai-litellm/templates/test.env.j2 b/roles/svc-ai-litellm/templates/test.env.j2
new file mode 100644
index 0000000000..a3a33b2cc6
--- /dev/null
+++ b/roles/svc-ai-litellm/templates/test.env.j2
@@ -0,0 +1,15 @@
+{%- set _ollama_models = (lookup('config', 'svc-ai-ollama', 'services.ollama.preload_models') | map(attribute='alias') | list) if LITELLM_TEST_CONTRACT.ollama | bool else [] -%}
+{%- set _lmstudio_declared = lookup('config', 'svc-ai-lmstudio', 'services.lmstudio.preload_models') | map(attribute='alias') | list -%}
+{%- set _lmstudio_only = _lmstudio_declared | reject('in', _ollama_models) | list -%}
+{%- set _remote = LITELLM_REMOTE_BACKENDS | selectattr('key') | map(attribute='alias') | list -%}
+{%- set _expected = _ollama_models + (_lmstudio_only if LITELLM_TEST_CONTRACT.lmstudio | bool else []) + _remote -%}
+LITELLM_CONTAINER={{ CLI_LOCAL_CID }}
+LITELLM_PORT={{ LITELLM_PORT }}
+LITELLM_MASTER_KEY_B64={{ LITELLM_MASTER_KEY | b64encode }}
+LITELLM_CHAT_MODEL={{ LITELLM_CHAT_MODEL }}
+LITELLM_CHAT_MODEL_SERVED={{ LITELLM_TEST_CONTRACT.served | bool | string | lower }}
+LITELLM_OLLAMA_ENABLED={{ LITELLM_TEST_CONTRACT.ollama | bool | string | lower }}
+LITELLM_LMSTUDIO_ENABLED={{ LITELLM_TEST_CONTRACT.lmstudio | bool | string | lower }}
+LITELLM_LMSTUDIO_ALIASES='{{ _lmstudio_only | to_json }}'
+LITELLM_REMOTE_ALIASES='{{ _remote | to_json }}'
+LITELLM_EXPECTED_MODELS='{{ _expected | to_json }}'
diff --git a/roles/svc-ai-litellm/vars/main.yml b/roles/svc-ai-litellm/vars/main.yml
index 8d9da03e66..a2cbbf9cef 100644
--- a/roles/svc-ai-litellm/vars/main.yml
+++ b/roles/svc-ai-litellm/vars/main.yml
@@ -9,7 +9,22 @@ LITELLM_MAX_OUTPUT_TOKENS: "{{ lookup('config', application_id, 'services.litell
 LITELLM_UPSTREAM_TIMEOUT: "{{ lookup('config', application_id, 'services.litellm.upstream_timeout') }}"
 LITELLM_CONFIG_PATH_HOST: "{{ [ lookup('container', application_id, 'directories.config'), 'config.yaml' ] | path_join }}"
 LITELLM_CONFIG_PATH_DOCKER: "{{ lookup('volume', application_id, 'litellm_config').target }}"
-LITELLM_OPENROUTER_API_KEY: "{{ OPENROUTER_API_KEY }}"
+LITELLM_OPENAI_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.openai_api_key') }}"
+LITELLM_ANTHROPIC_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.anthropic_api_key') }}"
+LITELLM_OPENROUTER_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.openrouter_api_key') }}"
+LITELLM_REMOTE_BACKENDS:
+  - alias: openai/gpt-4o-mini
+    model: openai/gpt-4o-mini
+    key: "{{ LITELLM_OPENAI_API_KEY }}"
+    env: OPENAI_API_KEY
+  - alias: anthropic/claude-sonnet-4-5
+    model: anthropic/claude-sonnet-4-5
+    key: "{{ LITELLM_ANTHROPIC_API_KEY }}"
+    env: ANTHROPIC_API_KEY
+  - alias: openrouter/auto
+    model: openrouter/openrouter/auto
+    key: "{{ LITELLM_OPENROUTER_API_KEY }}"
+    env: OPENROUTER_API_KEY
 LITELLM_UI_ROLE: "web-app-litellm"
 LITELLM_UI_SSO: "{{ (LITELLM_UI_ROLE in group_names) and (lookup('sso', LITELLM_UI_ROLE, 'is_oidc_native') | bool) }}"
 LITELLM_UI_BASE_URL: "{{ lookup('tls', LITELLM_UI_ROLE, 'url.base') }}"
diff --git a/roles/svc-ai-lmstudio/README.md b/roles/svc-ai-lmstudio/README.md
index 4e311ba7c7..bb671103ee 100644
--- a/roles/svc-ai-lmstudio/README.md
+++ b/roles/svc-ai-lmstudio/README.md
@@ -6,7 +6,7 @@
 
 ## Overview
 
-This role deploys LM Studio as a headless model server in a single container, in both Docker Compose and Docker Swarm deployments. The server listens on port 1234 on the internal container network and is not published through the reverse proxy, while downloaded models and server settings persist in a dedicated volume. Deployed together with the LiteLLM Gateway, the instance is reachable through the gateway under the model alias `lmstudio/default`, next to or instead of the Ollama backend.
+This role deploys LM Studio as a headless model server in a single container, in both Docker Compose and Docker Swarm deployments. The server listens on port 1234 on the internal container network and is not published through the reverse proxy, while downloaded models and server settings persist in a dedicated volume. The role downloads its declared models at deploy time and the LiteLLM Gateway publishes them under the same aliases Ollama uses, so a consumer asks for one model name and reaches whichever backend the deployment provides.
 
 ## Cosmos
 
@@ -35,7 +35,9 @@ Solid `1:1` edges are fixed relationships; dashed `0..1` edges are conditional (
 - **OpenAI-compatible endpoint:** The headless server answers `/v1` requests on port 1234 inside the container network.
 - **CPU inference:** The role pins the CPU build of the upstream image and passes no GPU device into the container.
 - **Persistent model store:** A named volume mounted at `/root/.lmstudio` keeps downloaded models and server settings across redeploys.
-- **Gateway backend:** The LiteLLM Gateway routes the model alias `lmstudio/default` to this instance when both roles are deployed together, as one of the interchangeable local backends alongside Ollama.
+- **Preloaded models:** Every entry of `services.lmstudio.preload_models` is downloaded on the hosting node with `lms get --gguf`, overlapped and reaped like the Ollama pre-pull. Each entry carries the `source` repository to download, the `name` LM Studio indexes that repository under and the gateway addresses it by, and the `alias` the gateway publishes it as. `source` is a full Hugging Face URL, never a search term: a search term resolves to whichever model the catalogue lists first.
+- **Loading:** The pre-pull downloads without loading. LM Studio serves with just-in-time loading, so the first `/v1/chat/completions` naming a `name` loads that model; the gateway's warm task issues that first request at deploy time.
+- **Gateway backend:** The LiteLLM Gateway publishes those aliases, which are the names Ollama serves too, so the same model name routes to whichever local backend a deployment runs.
 - **Bounded resources:** The container is capped at 4 CPUs, 8 GB of memory and 2048 processes, and the role declares a minimum of 588 MB free storage for the image; downloaded models grow the volume beyond that.
 - **Backup integration:** Backup Docker Volumes snapshots the model volume when that role is present, without stopping the container.
 
diff --git a/roles/svc-ai-lmstudio/files/test/.nocheck b/roles/svc-ai-lmstudio/files/test/.nocheck
new file mode 100644
index 0000000000..a0fdb0bf8c
--- /dev/null
+++ b/roles/svc-ai-lmstudio/files/test/.nocheck
@@ -0,0 +1 @@
+# nocheck: role-files-layout - Role test harness with test.sh as its entry point; the CLI runner stages roles/<id>/files/test/ by path.
diff --git a/roles/svc-ai-lmstudio/files/test/test.sh b/roles/svc-ai-lmstudio/files/test/test.sh
new file mode 100644
index 0000000000..d30ca9b919
--- /dev/null
+++ b/roles/svc-ai-lmstudio/files/test/test.sh
@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# shellcheck shell=bash
+#
+# Env (rendered into test.env from templates/test.env.j2):
+#   LMSTUDIO_CONTAINER        resolved container id on this node
+#   LMSTUDIO_PORT             the daemon's HTTP port
+#   LMSTUDIO_EXPECTED_MODELS  JSON array of model names the daemon must serve
+#   LMSTUDIO_EXPECTED_BLOBS   JSON array of <repo>/<file> paths under models/
+#   LMSTUDIO_EXPECTED_DIGESTS JSON array of sha256, aligned with the blobs
+#   LMSTUDIO_MODELS_DIR       the models mount inside the container
+#   RETRIES                   attempts       (default 30)
+#   SLEEP_SECONDS             wait between   (default 10)
+
+set -uo pipefail
+
+RETRIES="${RETRIES:-30}"
+SLEEP_SECONDS="${SLEEP_SECONDS:-10}"
+MODELS_DIR="${LMSTUDIO_MODELS_DIR}"
+
+[ -n "${LMSTUDIO_CONTAINER}" ] || {
+	echo "[FATAL] LMSTUDIO_CONTAINER unset; the harness did not resolve a container" >&2
+	exit 2
+}
+
+in_container() {
+	container exec "${LMSTUDIO_CONTAINER}" "$@"
+}
+
+json_items() {
+	python3 -c 'import json,sys; [print(x) for x in json.loads(sys.argv[1])]' "$1"
+}
+
+server_url=""
+
+serves_model() {
+	in_container curl -fsS --connect-timeout 5 --max-time 30 "${server_url}/v1/models" 2>/dev/null |
+		python3 -c 'import json,sys; d=json.load(sys.stdin); print("\n".join(m.get("id","") for m in d.get("data",[])))' 2>/dev/null |
+		grep -qxF "$1"
+}
+
+failed=0
+
+echo "=== 1. the CLI authenticates against its own daemon ==="
+attempt=1
+auth_out=""
+while [ "${attempt}" -le "${RETRIES}" ]; do
+	if auth_out="$(in_container /app/.bundle/lms ls 2>&1)"; then
+		echo "[OK]   lms ls authenticated"
+		break
+	fi
+	if printf '%s' "${auth_out}" | grep -q 'authPacket'; then
+		echo "[FAIL] the daemon rejected its own CLI: $(printf '%s' "${auth_out}" | grep -m1 authPacket)" >&2
+		echo "       a second daemon shares /root/.lmstudio and rewrote .internal/lms-key-2" >&2
+		exit 1
+	fi
+	attempt=$((attempt + 1))
+	[ "${attempt}" -le "${RETRIES}" ] && sleep "${SLEEP_SECONDS}"
+done
+if [ "${attempt}" -gt "${RETRIES}" ]; then
+	echo "[FAIL] lms ls never succeeded after ${RETRIES} attempts: ${auth_out}" >&2
+	exit 1
+fi
+
+echo "=== 2. every declared blob is in place with its declared digest ==="
+mapfile -t blobs < <(json_items "${LMSTUDIO_EXPECTED_BLOBS}")
+mapfile -t digests < <(json_items "${LMSTUDIO_EXPECTED_DIGESTS}")
+for i in "${!blobs[@]}"; do
+	path="${MODELS_DIR}/${blobs[$i]}"
+	if ! in_container test -f "${path}"; then
+		echo "[FAIL] ${blobs[$i]} is not in the model store" >&2
+		failed=1
+		continue
+	fi
+	actual="$(in_container sha256sum "${path}" 2>/dev/null | awk '{print $1}')"
+	if [ "${actual}" != "${digests[$i]}" ]; then
+		echo "[FAIL] ${blobs[$i]} hashes to ${actual}, declared ${digests[$i]}" >&2
+		failed=1
+		continue
+	fi
+	echo "[OK]   ${blobs[$i]} present and matching"
+done
+
+echo "=== 3. the daemon serves every declared model on its network address ==="
+address="$(in_container hostname -I | tr ' ' '\n' | grep -m1 -E '^[0-9]+(\.[0-9]+){3}$')"
+if [ -z "${address}" ]; then
+	echo "[FAIL] hostname -I reported no IPv4 address inside the container" >&2
+	exit 1
+fi
+server_url="http://${address}:${LMSTUDIO_PORT}"
+mapfile -t models < <(json_items "${LMSTUDIO_EXPECTED_MODELS}")
+for model in "${models[@]}"; do
+	attempt=1
+	while [ "${attempt}" -le "${RETRIES}" ]; do
+		if serves_model "${model}"; then
+			echo "[OK]   ${model} is served"
+			break
+		fi
+		attempt=$((attempt + 1))
+		[ "${attempt}" -le "${RETRIES}" ] && sleep "${SLEEP_SECONDS}"
+	done
+	if [ "${attempt}" -gt "${RETRIES}" ]; then
+		if ! in_container curl -fsS --connect-timeout 5 --max-time 30 -o /dev/null "${server_url}/v1/models"; then
+			echo "[FAIL] ${server_url} does not answer" >&2
+			echo "       other containers cannot reach the server; check that LMS_SERVER_HOST binds it beyond loopback" >&2
+		else
+			echo "[FAIL] ${model} is on disk but /v1/models never listed it" >&2
+			echo "       the daemon did not index the store it was given at startup" >&2
+		fi
+		failed=1
+	fi
+done
+
+[ "${failed}" -eq 0 ] || exit 1
+echo "[OK]   svc-ai-lmstudio serves every declared model from the seeded store"
diff --git a/roles/svc-ai-lmstudio/meta/services.yml b/roles/svc-ai-lmstudio/meta/services.yml
index d3471ca63e..53bab2e9c2 100644
--- a/roles/svc-ai-lmstudio/meta/services.yml
+++ b/roles/svc-ai-lmstudio/meta/services.yml
@@ -11,6 +11,7 @@ lmstudio:
   backup:
     no_stop_required: true
   image: lmstudio/llmster-preview
+  # nocheck: docker-version -- the repository publishes 2 tags and neither is a version; 'cpu' selects the backend, not a release
   version: cpu
   name: lmstudio
   platform_arch: x86_64
@@ -22,6 +23,10 @@ lmstudio:
   ports:
     internal:
       http: 1234
+  preload_models: "{{ AI_LOCAL_MODELS }}"
+  preload_async_time: 3600
+  preload_floor_seconds: 600
+  preload_min_bytes_per_second: 1000000
   lifecycle: beta
 
 # nocheck: playwright-service-flag, dynamic-flag
diff --git a/roles/svc-ai-lmstudio/meta/tests.yml b/roles/svc-ai-lmstudio/meta/tests.yml
new file mode 100644
index 0000000000..712dbdf2f8
--- /dev/null
+++ b/roles/svc-ai-lmstudio/meta/tests.yml
@@ -0,0 +1,4 @@
+---
+cli:
+  container_service_key: lmstudio
+  timeout: 900
diff --git a/roles/svc-ai-lmstudio/meta/volumes.yml b/roles/svc-ai-lmstudio/meta/volumes.yml
index 51f7e8af72..0250216548 100644
--- a/roles/svc-ai-lmstudio/meta/volumes.yml
+++ b/roles/svc-ai-lmstudio/meta/volumes.yml
@@ -1,7 +1,17 @@
 ---
-# nocheck: embedded-state-on-nfs model blobs written once on pull and read back afterwards
 lmstudio_data:
   type: volume
+  name: lmstudio_data
+  # nocheck: nfs-false-data-loss  Reason: per-daemon state LM Studio rewrites in place (lms-key-2, settings.json, extensions/plugins, bin/lms, server-logs), regenerated on every start; the models it indexes live in lmstudio_models
+  nfs: false
   mounts:
     - service: lmstudio
       target: /root/.lmstudio
+
+# nocheck: embedded-state-on-nfs content-addressed model blobs only; every writer fetches against the sha256 AI_LOCAL_MODELS declares and the play fails unless the store reads back at that digest, so concurrent writers of one file write identical bytes
+lmstudio_models:
+  type: volume
+  name: lmstudio_models
+  mounts:
+    - service: lmstudio
+      target: /root/.lmstudio/models
diff --git a/roles/svc-ai-lmstudio/tasks/00_core.yml b/roles/svc-ai-lmstudio/tasks/00_core.yml
index bd183d0e32..e29cf2a6f2 100644
--- a/roles/svc-ai-lmstudio/tasks/00_core.yml
+++ b/roles/svc-ai-lmstudio/tasks/00_core.yml
@@ -1,7 +1,19 @@
 ---
 - include_tasks: utils/once/flag.yml
 
+- name: "⬇️ Seed the shared model store before the daemons index it"
+  ansible.builtin.include_tasks:
+    file: utils/preseed.yml
+    apply:
+      delegate_to: "{{ LMSTUDIO_NFS_SERVER }}"
+      run_once: true
+  when: LMSTUDIO_PRESEED_ENABLED | bool
+
 - name: "🔧 Setup container network for {{ application_id }}"
   include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/network/routine.yml') }}"
   vars:
     compose_handlers_flush: true
+
+- name: "⬇️ Manager-side model pre-pull on the hosting node"
+  ansible.builtin.include_tasks: 01_manager_ops.yml
+  when: IS_STACK_HOST | bool
diff --git a/roles/svc-ai-lmstudio/tasks/01_manager_ops.yml b/roles/svc-ai-lmstudio/tasks/01_manager_ops.yml
new file mode 100644
index 0000000000..a4362e07d8
--- /dev/null
+++ b/roles/svc-ai-lmstudio/tasks/01_manager_ops.yml
@@ -0,0 +1,10 @@
+---
+- name: "🔍 Resolve every node that hosts an {{ application_id }} task"
+  ansible.builtin.include_tasks: utils/nodes.yml
+
+- name: "⬇️ Preload LM Studio on each hosting node"
+  ansible.builtin.include_tasks: utils/preload/node.yml
+  loop: "{{ LMSTUDIO_HOST_NODES }}"
+  loop_control:
+    loop_var: lmstudio_node
+    label: "{{ lmstudio_node }}"
diff --git a/roles/svc-ai-lmstudio/tasks/utils/cid.yml b/roles/svc-ai-lmstudio/tasks/utils/cid.yml
new file mode 100644
index 0000000000..e29b8fafba
--- /dev/null
+++ b/roles/svc-ai-lmstudio/tasks/utils/cid.yml
@@ -0,0 +1,22 @@
+---
+- name: "🔍 Resolve the LM Studio container on '{{ lmstudio_node }}'"
+  ansible.builtin.shell: |
+    {% if DEPLOYMENT_MODE == 'swarm' %}
+    container ps \
+      --filter "label=com.docker.swarm.service.name={{ lmstudio_service_name }}" \
+      --filter status=running \
+      --format '{{ "{{.ID}}" }}' | head -1
+    {% else %}
+    echo {{ LMSTUDIO_CONTAINER | quote }}
+    {% endif %}
+  register: lmstudio_node_cid
+  changed_when: false
+  retries: 30
+  delay: 2
+  until: DEPLOYMENT_MODE == 'compose' or (lmstudio_node_cid.stdout | trim) | length > 0
+  delegate_to: "{{ lmstudio_node }}"
+
+- name: "🔧 Target '{{ lmstudio_node }}' for the next LM Studio step"
+  ansible.builtin.set_fact:
+    LMSTUDIO_HOST_NODE: "{{ lmstudio_node }}"
+    LMSTUDIO_LOCAL_CID: "{{ lmstudio_node_cid.stdout | trim }}"
diff --git a/roles/svc-ai-lmstudio/tasks/utils/nodes.yml b/roles/svc-ai-lmstudio/tasks/utils/nodes.yml
new file mode 100644
index 0000000000..b3ee1a6726
--- /dev/null
+++ b/roles/svc-ai-lmstudio/tasks/utils/nodes.yml
@@ -0,0 +1,29 @@
+---
+- name: "🔧 Resolve the swarm service name of '{{ entity_name }}'"
+  ansible.builtin.set_fact:
+    lmstudio_service_name: "{{ lookup('container_service', application_id, entity_name) if DEPLOYMENT_MODE == 'swarm' else '' }}"
+
+- name: "⏳ Wait until every LM Studio task has converged"
+  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/wait_converged.yml') }}"
+  vars:
+    wait_service_key: "{{ entity_name }}"
+    wait_service_name: "{{ lmstudio_service_name }}"
+
+- name: "🔍 List every node that runs an LM Studio task"
+  ansible.builtin.shell: |
+    container service ps {{ lmstudio_service_name | quote }} \
+      --filter desired-state=running \
+      --format '{{ "{{.Node}}" }}' | sort -u
+  register: lmstudio_node_scan
+  changed_when: false
+  retries: 30
+  delay: 2
+  until: (lmstudio_node_scan.stdout | trim) | length > 0
+  delegate_to: "{{ STACK_HOST }}"
+  when: DEPLOYMENT_MODE == 'swarm'
+
+- name: "🔧 Set the LM Studio hosting nodes"
+  ansible.builtin.set_fact:
+    LMSTUDIO_HOST_NODES: >-
+      {{ (lmstudio_node_scan.stdout_lines | map('trim') | select | list)
+         if DEPLOYMENT_MODE == 'swarm' else [inventory_hostname] }}
diff --git a/roles/svc-ai-lmstudio/tasks/utils/preload/node.yml b/roles/svc-ai-lmstudio/tasks/utils/preload/node.yml
new file mode 100644
index 0000000000..d4a0aeb063
--- /dev/null
+++ b/roles/svc-ai-lmstudio/tasks/utils/preload/node.yml
@@ -0,0 +1,52 @@
+---
+- name: "🔍 Resolve the container before preloading on '{{ lmstudio_node }}'"
+  ansible.builtin.include_tasks: utils/cid.yml
+
+- name: "⏳ Wait until the LM Studio daemon has finished starting on '{{ lmstudio_node }}'"
+  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+    container exec {{ LMSTUDIO_LOCAL_CID | quote }} {{ 10 | curl(retries=0) }} -fS -o /dev/null http://127.0.0.1:{{ LMSTUDIO_PORT }}/lmstudio-greeting
+  register: lmstudio_daemon_ready
+  changed_when: false
+  retries: 60
+  delay: 5
+  until: lmstudio_daemon_ready.rc == 0
+  delegate_to: "{{ lmstudio_node }}"
+
+- name: "🗄️ Measure the space the model store offers on '{{ lmstudio_node }}'"
+  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+    container exec {{ LMSTUDIO_LOCAL_CID | quote }} df -P -B1 {{ LMSTUDIO_MODELS_TARGET | quote }}
+  register: lmstudio_store_space
+  changed_when: false
+  retries: 30
+  delay: 2
+  until: lmstudio_store_space.rc == 0
+  delegate_to: "{{ lmstudio_node }}"
+  when: not (LMSTUDIO_PRESEED_ENABLED | bool)
+
+- name: "🛑 Refuse to preload models the store on '{{ lmstudio_node }}' cannot hold"
+  vars:
+    _free: "{{ lmstudio_store_space.stdout_lines[1].split()[3] | int }}"
+    _required: "{{ LMSTUDIO_PRELOAD_LARGEST_BYTES | int }}"
+  ansible.builtin.fail:
+    msg: >-
+      The model store on {{ lmstudio_node }} has
+      {{ (_free | int / 1024 / 1024 / 1024) | round(1) }} GiB free, less than the
+      {{ (_required | int / 1024 / 1024 / 1024) | round(1) }} GiB the largest
+      declared model needs. Shrink AI_LOCAL_MODELS in group_vars/all/16_ai.yml or
+      give the node more disk.
+  when:
+    - not (LMSTUDIO_PRESEED_ENABLED | bool)
+    - _free | int < _required | int
+
+- name: "⬇️ Preload the LM Studio models on '{{ lmstudio_node }}'"
+  block:
+    - name: "⬇️ Preload the LM Studio models (first pass)"
+      ansible.builtin.include_tasks: utils/preload/pull.yml
+  rescue:
+    - name: "🐝 Re-raise the preload failure unchanged in swarm" # nocheck: rescue-recovery a timed-out transfer leaves the daemon reporting 0.00% for every further pull, and restarting the container it owns is the only lever the role has, though CI job 105558224377 shows a restart returning rc 0 without clearing it; the generic capture cannot even try, so swarm re-raises here instead, because under any_errors_fatal a rescued host keeps running while every other host is already marked failed, and compose ends the block by preloading again so an unrecovered failure still re-raises
+      ansible.builtin.fail:
+        msg: "{{ ansible_failed_result.msg | default('LM Studio preload failed') }}"
+      when: DEPLOYMENT_MODE == 'swarm'
+
+    - name: "♻️ Recover the wedged transfer and preload again"
+      ansible.builtin.include_tasks: utils/preload/recover.yml
diff --git a/roles/svc-ai-lmstudio/tasks/utils/preload/pull.yml b/roles/svc-ai-lmstudio/tasks/utils/preload/pull.yml
new file mode 100644
index 0000000000..162812fb1c
--- /dev/null
+++ b/roles/svc-ai-lmstudio/tasks/utils/preload/pull.yml
@@ -0,0 +1,39 @@
+---
+- name: ⬇️ Pre-pull LM Studio models
+  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+    container exec -i {{ LMSTUDIO_LOCAL_CID | quote }} lms get --yes --gguf {{ model.source | quote }}
+  environment:
+    CONTAINER_EXEC_TIMEOUT: >-
+      {{ [ LMSTUDIO_PRELOAD_FLOOR_SECONDS | int,
+           ((model.bytes | int) / (LMSTUDIO_PRELOAD_MIN_BYTES_PER_SECOND | int))
+           | round(0, 'ceil') | int ] | max }}
+  register: lmstudio_pull_result
+  loop: "{{ LMSTUDIO_PRELOAD_MODELS }}"
+  loop_control:
+    loop_var: model
+    label: "{{ model.alias }}"
+  # rationale: async; the reap below reads every job back before the play continues, so no model is still downloading when playwright starts
+  async: "{{ LMSTUDIO_PRELOAD_ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
+  poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
+  retries: "{{ 0 if ASYNC_ENABLED | bool else 1 }}"
+  delay: 15
+  until: >
+    (lmstudio_pull_result.rc | default(0)) == 0 or
+    ('You already have this model' in (lmstudio_pull_result.stderr | default('')))
+  changed_when: false
+  failed_when: >-
+    (lmstudio_pull_result.failed | default(false))
+    and 'You already have this model' not in ((lmstudio_pull_result.stdout | default('')) ~ (lmstudio_pull_result.stderr | default('')))
+  delegate_to: "{{ LMSTUDIO_HOST_NODE }}"
+
+- name: "⏳ Reap the LM Studio model pre-pulls"
+  ansible.builtin.include_tasks:
+    file: utils/async/reap.yml
+    apply:
+      delegate_to: "{{ LMSTUDIO_HOST_NODE }}"
+  vars:
+    async_reap_jobs: "{{ lmstudio_pull_result.results | default([]) }}"
+    async_reap_label: "LM Studio model pre-pull"
+    async_reap_tolerate:
+      - "You already have this model"
+    ASYNC_TIME: "{{ LMSTUDIO_PRELOAD_ASYNC_TIME }}"
diff --git a/roles/svc-ai-lmstudio/tasks/utils/preload/recover.yml b/roles/svc-ai-lmstudio/tasks/utils/preload/recover.yml
new file mode 100644
index 0000000000..e8f526456f
--- /dev/null
+++ b/roles/svc-ai-lmstudio/tasks/utils/preload/recover.yml
@@ -0,0 +1,28 @@
+---
+- name: "🩺 Dump the LM Studio transfer record"
+  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+    container exec -i {{ LMSTUDIO_LOCAL_CID | quote }}
+    cat /root/.lmstudio/.internal/single-downloads-info.json
+  register: lmstudio_transfer_record
+  changed_when: false
+  failed_when: false
+  delegate_to: "{{ LMSTUDIO_HOST_NODE }}"
+
+- name: "🩺 Report the LM Studio transfer record"
+  ansible.builtin.debug:
+    var: lmstudio_transfer_record.stdout
+
+- name: "♻️ Restart LM Studio to release the wedged transfer"
+  ansible.builtin.command: container restart {{ LMSTUDIO_LOCAL_CID }}
+  changed_when: true
+  delegate_to: "{{ LMSTUDIO_HOST_NODE }}"
+
+- name: "🔍 Re-resolve the {{ application_id }} hosting node + container id"
+  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
+  vars:
+    resolve_service_key: "{{ entity_name }}"
+    resolve_output_prefix: LMSTUDIO
+    resolve_compose_cid: "{{ LMSTUDIO_CONTAINER }}"
+
+- name: "⬇️ Preload the LM Studio models (after the restart)"
+  ansible.builtin.include_tasks: utils/preload/pull.yml
diff --git a/roles/svc-ai-lmstudio/tasks/utils/preseed.yml b/roles/svc-ai-lmstudio/tasks/utils/preseed.yml
new file mode 100644
index 0000000000..49fa570841
--- /dev/null
+++ b/roles/svc-ai-lmstudio/tasks/utils/preseed.yml
@@ -0,0 +1,118 @@
+---
+- name: "📁 Create the shared model store before the daemons start"
+  ansible.builtin.file:
+    path: "{{ LMSTUDIO_SHARED_MODELS_PATH }}/{{ model.repo }}"
+    state: directory
+    mode: "0755"
+  loop: "{{ LMSTUDIO_PRELOAD_MODELS }}"
+  loop_control:
+    loop_var: model
+    label: "{{ model.file }}"
+
+- name: "📁 Create the staging directory beside the model store"
+  ansible.builtin.file:
+    path: "{{ LMSTUDIO_SHARED_STAGING_PATH }}"
+    state: directory
+    mode: "0755"
+
+- name: "🔍 Read what the shared model store already holds"
+  ansible.builtin.stat:
+    path: "{{ LMSTUDIO_SHARED_MODELS_PATH }}/{{ model.repo }}/{{ model.file }}"
+    checksum_algorithm: sha256
+  register: lmstudio_present
+  changed_when: false
+  loop: "{{ LMSTUDIO_PRELOAD_MODELS }}"
+  loop_control:
+    loop_var: model
+    label: "{{ model.file }}"
+
+- name: "🗄️ Measure the free space the shared model store offers"
+  ansible.builtin.command: "df -P -B1 {{ LMSTUDIO_SHARED_MODELS_PATH | quote }}"
+  register: lmstudio_export_space
+  changed_when: false
+
+- name: "🛑 Refuse to fetch models the shared store cannot hold"
+  vars:
+    _free: "{{ lmstudio_export_space.stdout_lines[1].split()[3] | int }}"
+    _absent: >-
+      {{ lmstudio_present.results
+         | rejectattr('stat.exists')
+         | map(attribute='model.bytes') | map('int') | sum }}
+    _required: "{{ (_absent | int) + (LMSTUDIO_PRELOAD_LARGEST_BYTES | int) }}"
+  ansible.builtin.fail:
+    msg: >-
+      The shared model store on {{ LMSTUDIO_NFS_SERVER }} has
+      {{ (_free | int / 1024 / 1024 / 1024) | round(1) }} GiB free but needs
+      {{ (_required | int / 1024 / 1024 / 1024) | round(1) }} GiB: it is missing
+      {{ (_absent | int / 1024 / 1024 / 1024) | round(1) }} GiB of declared models,
+      plus {{ (LMSTUDIO_PRELOAD_LARGEST_BYTES | int / 1024 / 1024 / 1024) | round(1) }}
+      GiB for the largest one while it stages. Shrink AI_LOCAL_MODELS in
+      group_vars/all/16_ai.yml or grow the export.
+  when: _free | int < _required | int
+
+- name: "⬇️ Fetch the models into the shared store"
+  get_url_retry:
+    url: "{{ model.url }}"
+    dest: "{{ LMSTUDIO_SHARED_MODELS_PATH }}/{{ model.repo }}/{{ model.file }}"
+    tmp_dest: "{{ LMSTUDIO_SHARED_STAGING_PATH }}"
+    checksum: "sha256:{{ model.sha256 }}"
+    mode: "0644"
+  loop: "{{ LMSTUDIO_PRELOAD_MODELS }}"
+  loop_control:
+    loop_var: model
+    label: "{{ model.file }}"
+  register: lmstudio_fetch
+  changed_when: false
+  failed_when: false
+
+- name: "🪞 Fetch from a mirror when the source did not deliver"
+  get_url_retry:
+    url: "{{ item.1 }}"
+    dest: "{{ LMSTUDIO_SHARED_MODELS_PATH }}/{{ item.0.repo }}/{{ item.0.file }}"
+    tmp_dest: "{{ LMSTUDIO_SHARED_STAGING_PATH }}"
+    checksum: "sha256:{{ item.0.sha256 }}"
+    mode: "0644"
+  loop: "{{ LMSTUDIO_PRELOAD_MODELS | subelements('mirrors', skip_missing=True) }}"
+  loop_control:
+    label: "{{ item.0.file }} from {{ item.1 }}"
+  register: lmstudio_fetch_mirror
+  changed_when: false
+  failed_when: false
+
+- name: "🔍 Read back what the shared model store now holds"
+  ansible.builtin.stat:
+    path: "{{ LMSTUDIO_SHARED_MODELS_PATH }}/{{ model.repo }}/{{ model.file }}"
+    checksum_algorithm: sha256
+  register: lmstudio_seeded
+  changed_when: false
+  loop: "{{ LMSTUDIO_PRELOAD_MODELS }}"
+  loop_control:
+    loop_var: model
+    label: "{{ model.file }}"
+
+- name: "🛑 Fail when no source delivered a declared model"
+  vars:
+    _missing: >-
+      {{ lmstudio_seeded.results
+         | rejectattr('stat.exists')
+         | map(attribute='model.file') | list }}
+    _said: >-
+      {{ (lmstudio_fetch.results | map(attribute='msg') | select | list)
+         + (lmstudio_fetch_mirror.results | default([]) | map(attribute='msg') | select | list) }}
+  ansible.builtin.fail:
+    msg: >-
+      The shared model store on {{ LMSTUDIO_NFS_SERVER }} is missing
+      {{ _missing | join(', ') }}. What the sources answered:
+      {{ _said | join(' | ') }}
+  when: _missing | length > 0
+
+- name: "🛑 Fail when a seeded model does not match its checksum"
+  ansible.builtin.fail:
+    msg: >-
+      {{ item.model.file }} in the shared model store on {{ LMSTUDIO_NFS_SERVER }}
+      hashes to {{ item.stat.checksum }}, but AI_LOCAL_MODELS declares
+      {{ item.model.sha256 }}.
+  loop: "{{ lmstudio_seeded.results | selectattr('stat.exists') | list }}"
+  loop_control:
+    label: "{{ item.model.file }}"
+  when: item.stat.checksum != item.model.sha256
diff --git a/roles/svc-ai-lmstudio/templates/compose.yml.j2 b/roles/svc-ai-lmstudio/templates/compose.yml.j2
index 3e05c26133..ba14ab4e22 100644
--- a/roles/svc-ai-lmstudio/templates/compose.yml.j2
+++ b/roles/svc-ai-lmstudio/templates/compose.yml.j2
@@ -7,6 +7,8 @@
     {{ lookup('compose_only', 'container_name', LMSTUDIO_CONTAINER) }}
     expose:
       - "{{ LMSTUDIO_PORT }}"
+    environment:
+      LMS_SERVER_HOST: "0.0.0.0"
     {{ lookup('container_volumes', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 
diff --git a/roles/svc-ai-lmstudio/templates/test.env.j2 b/roles/svc-ai-lmstudio/templates/test.env.j2
new file mode 100644
index 0000000000..019aeb6e20
--- /dev/null
+++ b/roles/svc-ai-lmstudio/templates/test.env.j2
@@ -0,0 +1,6 @@
+LMSTUDIO_CONTAINER={{ CLI_LOCAL_CID }}
+LMSTUDIO_EXPECTED_BLOBS='{{ LMSTUDIO_PRELOAD_MODELS | map(attribute='repo') | zip(LMSTUDIO_PRELOAD_MODELS | map(attribute='file')) | map('join', '/') | list | to_json }}'
+LMSTUDIO_EXPECTED_DIGESTS='{{ LMSTUDIO_PRELOAD_MODELS | map(attribute='sha256') | list | to_json }}'
+LMSTUDIO_EXPECTED_MODELS='{{ LMSTUDIO_PRELOAD_MODELS | map(attribute='name') | list | to_json }}'
+LMSTUDIO_MODELS_DIR={{ LMSTUDIO_MODELS_TARGET }}
+LMSTUDIO_PORT={{ LMSTUDIO_PORT }}
diff --git a/roles/svc-ai-lmstudio/vars/main.yml b/roles/svc-ai-lmstudio/vars/main.yml
index cea5302881..8314305c99 100644
--- a/roles/svc-ai-lmstudio/vars/main.yml
+++ b/roles/svc-ai-lmstudio/vars/main.yml
@@ -4,3 +4,19 @@ entity_name: "{{ application_id | get_entity_name }}"
 
 LMSTUDIO_CONTAINER: "{{ lookup('config', application_id, 'services.lmstudio.name') }}"
 LMSTUDIO_PORT: "{{ lookup('config', application_id, 'services.lmstudio.ports.internal.http') }}"
+LMSTUDIO_PRELOAD_MODELS: "{{ lookup('config', application_id, 'services.lmstudio.preload_models') }}"
+LMSTUDIO_PRELOAD_ASYNC_TIME: "{{ lookup('config', application_id, 'services.lmstudio.preload_async_time') }}"
+LMSTUDIO_PRELOAD_FLOOR_SECONDS: "{{ lookup('config', application_id, 'services.lmstudio.preload_floor_seconds') }}"
+LMSTUDIO_PRELOAD_MIN_BYTES_PER_SECOND: "{{ lookup('config', application_id, 'services.lmstudio.preload_min_bytes_per_second') }}"
+LMSTUDIO_PRELOAD_LARGEST_BYTES: >-
+  {{ LMSTUDIO_PRELOAD_MODELS | map(attribute='bytes') | map('int') | max }}
+LMSTUDIO_MODELS_TARGET: "{{ lookup('volume', application_id, 'lmstudio_models').target }}"
+LMSTUDIO_NFS_SERVER: "{{ (groups['svc-storage-nfs-server'] | default([]))[0] | default(inventory_hostname) }}"
+LMSTUDIO_SHARED_MODELS_PATH: "{{ [ STORAGE_NFS_STATE_PATH, lookup('volume', application_id, 'lmstudio_models').name ] | path_join }}"
+LMSTUDIO_SHARED_STAGING_PATH: "{{ [ STORAGE_NFS_STATE_PATH, '.lmstudio-staging' ] | path_join }}"
+LMSTUDIO_PRESEED_ENABLED: >-
+  {{ (DEPLOYMENT_MODE == 'swarm')
+     and (storage.backend == 'nfs')
+     and ((groups['svc-storage-nfs-server'] | default([])) | length > 0)
+     and (lookup('volume', application_id, 'lmstudio_models').nfs is not false)
+     and (application_id not in lookup('roles_with_placement', 'manager')) }}
diff --git a/roles/svc-ai-ollama/meta/services.yml b/roles/svc-ai-ollama/meta/services.yml
index 6b3fda75b0..751717156b 100644
--- a/roles/svc-ai-ollama/meta/services.yml
+++ b/roles/svc-ai-ollama/meta/services.yml
@@ -13,7 +13,7 @@ ollama:
   backup:
     no_stop_required: true
   image: ollama/ollama
-  version: 0.34.0
+  version: 0.34.2
   name: ollama
   min_storage: 3473MB
   cpus: "4.0"
@@ -23,10 +23,7 @@ ollama:
   ports:
     internal:
       http: 11434
-  preload_models:
-    - llama3:latest
-    - mistral:latest
-    - nomic-embed-text:latest
+  preload_models: "{{ AI_LOCAL_MODELS }}"
   preload_async_time: 3600
   keep_alive: "-1"
   lifecycle: beta
diff --git a/roles/svc-ai-ollama/meta/variants.yml b/roles/svc-ai-ollama/meta/variants.yml
index 43b327aa21..6b9ad2d919 100644
--- a/roles/svc-ai-ollama/meta/variants.yml
+++ b/roles/svc-ai-ollama/meta/variants.yml
@@ -11,7 +11,5 @@
     container_backup:
       enabled: true
     ollama:
-      preload_models:
-        - qwen2.5:0.5b
       mem_reservation: 1g
       mem_limit: 2g
diff --git a/roles/svc-ai-ollama/tasks/01_manager_ops.yml b/roles/svc-ai-ollama/tasks/01_manager_ops.yml
index c192f0272a..11fc3a70fb 100644
--- a/roles/svc-ai-ollama/tasks/01_manager_ops.yml
+++ b/roles/svc-ai-ollama/tasks/01_manager_ops.yml
@@ -8,11 +8,12 @@
 
 - name: ⬇️ Pre-pull Ollama models
   ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
-    container exec -i {{ OLLAMA_LOCAL_CID | quote }} ollama pull {{ model }}
+    container exec -i {{ OLLAMA_LOCAL_CID | quote }} ollama pull {{ model.alias }}
   register: pull_result
   loop: "{{ OLLAMA_PRELOAD_MODELS }}"
   loop_control:
     loop_var: model
+    label: "{{ model.alias }}"
   # rationale: async; model pulls run overlapped, results reaped below before playwright
   async: "{{ OLLAMA_PRELOAD_ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
   poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
diff --git a/roles/svc-bkp-remote-2-local/templates/script.sh.j2 b/roles/svc-bkp-remote-2-local/templates/script.sh.j2
index 0000b7c862..4cdffc1dc8 100644
--- a/roles/svc-bkp-remote-2-local/templates/script.sh.j2
+++ b/roles/svc-bkp-remote-2-local/templates/script.sh.j2
@@ -1,4 +1,5 @@
 #!/bin/bash
+{# nocheck: shell-template  grandfathered, values only: the provider list and two paths #}
 # Pulls the remote backups from multiple hosts
 
 hosts="{{ DOCKER_BACKUP_REMOTE_2_LOCAL_BACKUP_PROVIDERS | join(' ') }}"
diff --git a/roles/svc-db-elasticsearch/meta/services.yml b/roles/svc-db-elasticsearch/meta/services.yml
index 64c6d96b81..6f13b566e6 100644
--- a/roles/svc-db-elasticsearch/meta/services.yml
+++ b/roles/svc-db-elasticsearch/meta/services.yml
@@ -25,6 +25,9 @@ elasticsearch:
       elasticsearch: 9200
     internal:
       elasticsearch: 9200
+    onion:
+      # nocheck: onion-flag  the index is queried by the search backends of the apps sharing this stack, never by a client off the node
+      elasticsearch: false
   lifecycle: beta
 # nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
 tor:
diff --git a/roles/svc-db-elasticsearch/meta/variants.yml b/roles/svc-db-elasticsearch/meta/variants.yml
index 1576e2511e..a5e59537b6 100644
--- a/roles/svc-db-elasticsearch/meta/variants.yml
+++ b/roles/svc-db-elasticsearch/meta/variants.yml
@@ -2,6 +2,3 @@
 - services:
     tor:
       enabled: true
-- services:
-    tor:
-      enabled: true
diff --git a/roles/svc-db-memcached/meta/services.yml b/roles/svc-db-memcached/meta/services.yml
index d47db749a6..0af5df1e7b 100644
--- a/roles/svc-db-memcached/meta/services.yml
+++ b/roles/svc-db-memcached/meta/services.yml
@@ -11,7 +11,7 @@ memcached:
   enabled: true
   shared: true
   image: memcached
-  version: alpine
+  version: 1.6.45-alpine
   name: memcached
   min_storage: 206MB
   backup:
@@ -28,6 +28,9 @@ memcached:
       memcached: 11211
     internal:
       memcached: 11211
+    onion:
+      # nocheck: onion-flag  the session cache speaks an unauthenticated text protocol and is read only by app containers on the role network
+      memcached: false
   lifecycle: beta
 # nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
 tor:
diff --git a/roles/svc-db-memcached/meta/variants.yml b/roles/svc-db-memcached/meta/variants.yml
index 1576e2511e..a5e59537b6 100644
--- a/roles/svc-db-memcached/meta/variants.yml
+++ b/roles/svc-db-memcached/meta/variants.yml
@@ -2,6 +2,3 @@
 - services:
     tor:
       enabled: true
-- services:
-    tor:
-      enabled: true
diff --git a/roles/svc-db-openldap/meta/services.yml b/roles/svc-db-openldap/meta/services.yml
index 08111859de..0372a514db 100644
--- a/roles/svc-db-openldap/meta/services.yml
+++ b/roles/svc-db-openldap/meta/services.yml
@@ -12,7 +12,7 @@ openldap:
   shared: true
   provides: ldap
   image: debian
-  version: bookworm-slim
+  version: 12.15-slim
   custom: true
   name: openldap
   min_storage: 229MB
diff --git a/roles/svc-db-qdrant/meta/services.yml b/roles/svc-db-qdrant/meta/services.yml
index fd8ee4690d..50a5a5fb7c 100644
--- a/roles/svc-db-qdrant/meta/services.yml
+++ b/roles/svc-db-qdrant/meta/services.yml
@@ -28,6 +28,9 @@ qdrant:
       qdrant: 6333
     internal:
       qdrant: 6333
+    onion:
+      # nocheck: onion-flag  the vector store is read by the svc-ai roles in this stack; its MCP sidecar is the surface meant for outside callers
+      qdrant: false
   lifecycle: beta
 # nocheck: playwright-service-flag  internal adapter sidecar, covered by the role's MCP integration test
 # nocheck: dockerfile-custom  the Dockerfile is owned by svc-ai-mcp-adapter and staged per instance, so every adapter-backed provider shares one audited build
diff --git a/roles/svc-db-rabbitmq/meta/services.yml b/roles/svc-db-rabbitmq/meta/services.yml
index 330ec8ef2c..b3183f721d 100644
--- a/roles/svc-db-rabbitmq/meta/services.yml
+++ b/roles/svc-db-rabbitmq/meta/services.yml
@@ -28,6 +28,9 @@ rabbitmq:
       rabbitmq: 5672
     internal:
       rabbitmq: 5672
+    onion:
+      # nocheck: onion-flag  AMQP carries the apps' own worker queues; a broker reachable off the node would let anyone enqueue jobs
+      rabbitmq: false
   lifecycle: beta
 # nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
 tor:
diff --git a/roles/svc-db-rabbitmq/meta/variants.yml b/roles/svc-db-rabbitmq/meta/variants.yml
index 1576e2511e..a5e59537b6 100644
--- a/roles/svc-db-rabbitmq/meta/variants.yml
+++ b/roles/svc-db-rabbitmq/meta/variants.yml
@@ -2,6 +2,3 @@
 - services:
     tor:
       enabled: true
-- services:
-    tor:
-      enabled: true
diff --git a/roles/svc-db-redis/meta/services.yml b/roles/svc-db-redis/meta/services.yml
index b22b73508c..d8d43fba90 100644
--- a/roles/svc-db-redis/meta/services.yml
+++ b/roles/svc-db-redis/meta/services.yml
@@ -12,7 +12,7 @@ redis:
   shared: true
   image: redis
   name: redis-central
-  version: alpine
+  version: 8.10.1-alpine
   min_storage: 238MB
   backup:
     disabled: true
@@ -25,6 +25,9 @@ redis:
       redis: 6379
     internal:
       redis: 6379
+    onion:
+      # nocheck: onion-flag  the shared cache and queue runs without AUTH inside the stack, so its reachability must stay bounded by the role network
+      redis: false
   lifecycle: beta
 # nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
 tor:
diff --git a/roles/svc-db-redis/meta/variants.yml b/roles/svc-db-redis/meta/variants.yml
index 1576e2511e..a5e59537b6 100644
--- a/roles/svc-db-redis/meta/variants.yml
+++ b/roles/svc-db-redis/meta/variants.yml
@@ -2,6 +2,3 @@
 - services:
     tor:
       enabled: true
-- services:
-    tor:
-      enabled: true
diff --git a/roles/svc-db-typesense/meta/services.yml b/roles/svc-db-typesense/meta/services.yml
index fe07bdae91..8304c9e73a 100644
--- a/roles/svc-db-typesense/meta/services.yml
+++ b/roles/svc-db-typesense/meta/services.yml
@@ -28,6 +28,9 @@ typesense:
       typesense: 8108
     internal:
       typesense: 8108
+    onion:
+      # nocheck: onion-flag  the search index is queried by the app containers holding its API key, and the apps themselves are served through the onion's port 80
+      typesense: false
   lifecycle: beta
 # nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
 tor:
diff --git a/roles/svc-db-typesense/meta/variants.yml b/roles/svc-db-typesense/meta/variants.yml
index 1576e2511e..a5e59537b6 100644
--- a/roles/svc-db-typesense/meta/variants.yml
+++ b/roles/svc-db-typesense/meta/variants.yml
@@ -2,6 +2,3 @@
 - services:
     tor:
       enabled: true
-- services:
-    tor:
-      enabled: true
diff --git a/roles/svc-dns-unbound/meta/services.yml b/roles/svc-dns-unbound/meta/services.yml
index bb8b51983d..e440222e4b 100644
--- a/roles/svc-dns-unbound/meta/services.yml
+++ b/roles/svc-dns-unbound/meta/services.yml
@@ -21,8 +21,13 @@ unbound:
   mem_limit: "512m"
   pids_limit: 256
   ports:
+    internal:
+      unbound: 53
     local:
       unbound: 53
+    onion:
+      # nocheck: onion-flag  a recursive resolver published on the onion is an open resolver, and the containers it serves reach it on the role network
+      unbound: false
   lifecycle: beta
 
 # nocheck: dynamic-flag - the resolver state volume is backup-disabled rebuildable cache, the backup consumer stays permanently off
diff --git a/roles/svc-dns-unbound/templates/compose.yml.j2 b/roles/svc-dns-unbound/templates/compose.yml.j2
index f6371fed79..86f759571d 100644
--- a/roles/svc-dns-unbound/templates/compose.yml.j2
+++ b/roles/svc-dns-unbound/templates/compose.yml.j2
@@ -6,9 +6,9 @@
     {{ lookup('container_image', application_id, 'unbound') }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {% if DEPLOYMENT_MODE == 'compose' and not (DOCKER_IN_CONTAINER | bool) %}
-    ports:
-      - "{{ DOCKER_BIND_HOST }}:{{ UNBOUND_PORT }}:53/udp"  # nocheck: compose-ports-must-use-container-ports
-      - "{{ DOCKER_BIND_HOST }}:{{ UNBOUND_PORT }}:53/tcp"  # nocheck: compose-ports-must-use-container-ports
+    {{ lookup('container_ports',
+              {'service': 'unbound', 'protocol': 'unbound', 'ip': DOCKER_BIND_HOST,
+               'transport': ['udp', 'tcp']}) | indent(4) }}
     {% endif %}
     {{ lookup('container_volumes', service_name) | indent(4) }}
     networks:  # nocheck: networks-literal  static-IP resolver on its own engine overlay so consumers can point dns: at it
diff --git a/roles/svc-dns-unbound/templates/unbound.conf.j2 b/roles/svc-dns-unbound/templates/unbound.conf.j2
index d9f07c33b3..047486d8da 100644
--- a/roles/svc-dns-unbound/templates/unbound.conf.j2
+++ b/roles/svc-dns-unbound/templates/unbound.conf.j2
@@ -7,10 +7,9 @@ server:
   do-udp: yes
   do-tcp: yes
   do-daemonize: no
-  access-control: 127.0.0.0/8 allow
-  access-control: 10.0.0.0/8 allow
-  access-control: 172.16.0.0/12 allow
-  access-control: 192.168.0.0/16 allow
+{% for _cidr in NETWORK_INTERNAL_CIDRS %}
+  access-control: {{ _cidr }} allow
+{% endfor %}
   directory: "{{ lookup('volume', 'svc-dns-unbound', 'data').target }}"
   username: unbound
   auto-trust-anchor-file: trusted-key.key
@@ -18,6 +17,9 @@ server:
   hide-identity: yes
   hide-version: yes
   cache-min-ttl: 300
+{% if UNBOUND_ONION_FORWARD_ADDR | length > 0 %}
+  domain-insecure: "onion."
+{% endif %}
 
 remote-control:
   control-enable: yes
@@ -30,3 +32,9 @@ forward-zone:
   forward-addr: {{ resolver }}
 {% endfor %}
 {% endif %}
+{% if UNBOUND_ONION_FORWARD_ADDR | length > 0 %}
+
+forward-zone:
+  name: "onion."
+  forward-addr: {{ UNBOUND_ONION_FORWARD_ADDR }}
+{% endif %}
diff --git a/roles/svc-dns-unbound/vars/main.yml b/roles/svc-dns-unbound/vars/main.yml
index 918bac40d0..75207698c0 100644
--- a/roles/svc-dns-unbound/vars/main.yml
+++ b/roles/svc-dns-unbound/vars/main.yml
@@ -4,7 +4,6 @@ entity_name: "{{ application_id | get_entity_name }}"
 
 UNBOUND_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.name') }}"
 UNBOUND_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, UNBOUND_CONTAINER) }}"
-UNBOUND_PORT: "{{ lookup('config', application_id, 'services.unbound.ports.local.unbound') }}"
 UNBOUND_NETWORK_NAME: "{{ entity_name }}"
 UNBOUND_RESOLVER_IP: "{{ lookup('config', application_id, 'networks.local.dns_resolver') }}"
 
@@ -12,3 +11,7 @@ UNBOUND_VOLUMES_DIR: "{{ lookup('container', application_id, 'directories.volume
 UNBOUND_CONF_FILE: "{{ [ UNBOUND_VOLUMES_DIR, 'unbound.conf' ] | path_join }}"
 
 UNBOUND_FORWARD_DNS: "{{ (DOCKER_IN_CONTAINER | bool) or ('microsoft' in lookup('file', '/proc/version') | lower) }}"
+
+UNBOUND_ONION_FORWARD_ADDR: >-
+  {{ (lookup('subnet_gateway') ~ '@' ~ lookup('config', 'svc-net-tor', 'services.tor.ports.local.dns'))
+     if ('svc-net-tor' in group_names and DEPLOYMENT_MODE == 'compose') else '' }}
diff --git a/roles/svc-net-firewall/README.md b/roles/svc-net-firewall/README.md
new file mode 100644
index 0000000000..9556984acb
--- /dev/null
+++ b/roles/svc-net-firewall/README.md
@@ -0,0 +1,92 @@
+# Firewall ruleset
+
+## Description
+
+[nftables](https://www.netfilter.org/projects/nftables/) is the packet filtering framework of the Linux kernel and the successor to `iptables`. Its rules live in memory: a reboot drops them unless something loads them again.
+
+## Overview
+
+This role gives every other role one place to put packet filter rules. A role that needs them writes `templates/nftables.conf.j2` declaring its own nftables table and includes this role; the fragment is rendered to `/etc/nftables.d/<role>.conf`, checked, loaded, and read back, so a deploy fails rather than quietly leaving a gap. Deployed on its own, the role installs nftables, the ruleset that loads every fragment, and the `nftables.service` that replays them at boot.
+
+One table per role is what makes the rules composable. A fragment replaces its own table and touches no other, so two roles on one host neither overwrite nor merge into each other, and a broken fragment fails alone instead of freezing everyone's rules.
+
+Replacing beats adding. `nft -f` on an existing table merges, so a rule dropped from the declaration would stay in the kernel and the ruleset could only ever grow. Each fragment therefore creates, deletes and redeclares its table in one transaction, which is also why the table is never observed empty: unlike a flush followed by rules, there is no window in which the boundary is gone.
+
+## Cosmos
+
+The diagram places Firewall ruleset in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).
+
+```mermaid
+flowchart LR
+    subgraph role [svc-net-firewall 💻]
+        svc_firewall["firewall"]
+    end
+```
+
+Solid `1:1` edges are fixed relationships; dashed `0..1` edges are conditional (enabled only in matching deployments); red `0..0` edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in `meta/main.yml`.
+
+## Features
+
+- **Owned per role:** Each consumer declares one table under its own name, so rules are added and retired with the role that needs them.
+- **Atomic:** A fragment is applied in a single `nft -f` transaction, so the table is never observed half built.
+- **Persistent:** `nftables.service` loads every fragment at boot, so rules outlive a reboot without a unit of this project's own. The ruleset it reads is a distribution decision, so the path follows `os_family`: RedHat reads `/etc/sysconfig/nftables.conf`, the others `/etc/nftables.conf`.
+- **Independent of docker:** Docker owns its own tables and never touches these, so no rule has to be inserted into a chain another component controls. The unit is only enabled, never started or restarted: on Debian its `ExecStop` flushes the entire ruleset, docker's tables included, and the fragments are loaded explicitly anyway.
+- **Verified:** `nft -c` rejects a fragment before it is written, and the loaded table is read back and refused when it carries no chain. A table that exists is not a rule that runs, so the policy itself is proven by the role that owns it.
+
+## Use Cases
+
+- Bounding a service port that carries no access policy of its own, where the packet filter is the only boundary available.
+- Redirecting or translating traffic a role owns, scoped to an address range nothing else claims.
+
+A fragment can only ever be stricter than the host already is. In nftables an `accept` terminates its own base chain and nothing more: the packet still traverses every other chain at that hook, and a `drop` in any of them wins. A rule that has to overrule a policy someone else set, such as the `DROP` docker installs on forwarded packets, does not belong in a fragment at all; it belongs in the chain that carries that policy.
+
+## Quick Setup
+
+### Development
+
+Clone, set up the workstation, and deploy Firewall ruleset onto the local stack:
+
+```bash
+git clone https://github.com/infinito-nexus/core.git
+cd core
+make onboard
+make compose-deploy mode=reinstall apps=svc-net-firewall full_cycle=false
+```
+
+### Production
+
+Install Firewall ruleset directly onto the target machine: clone the repository, install the OS prerequisites and the repository toolchain, then deploy against localhost over a local connection (no SSH, no container):
+
+```bash
+git clone https://github.com/infinito-nexus/core.git
+cd core
+bash scripts/install/package.sh
+make install
+source scripts/meta/env/load.sh
+
+APP=svc-net-firewall
+DOMAIN=<your-domain>
+TLS_MODE=self_signed
+SSH_PUBLIC_KEY="<your-ssh-public-key>"
+INVENTORY=inventories/production
+infinito administration inventory provision "$INVENTORY" \
+  --inventory-file "$INVENTORY/devices.yml" \
+  --host localhost \
+  --include "$APP" \
+  --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", \"users\": {\"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}"
+infinito administration deploy dedicated "$INVENTORY/devices.yml" \
+  --password-file "$INVENTORY/.password" \
+  --diff -vv
+```
+
+## Further Resources
+
+- [nftables Wiki](https://wiki.nftables.org/)
+- [nft(8) manual page](https://www.netfilter.org/projects/nftables/manpage.html)
+- [Moving from iptables to nftables](https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables)
+
+## Credits
+
+Implemented by **[Kevin Veen-Birkenbach](https://www.veen.world)**.
+Part of the [Infinito.Nexus Project](https://s.infinito.nexus/code) and maintained by [Kevin Veen-Birkenbach](https://www.veen.world).
+Licensed under the [Infinito.Nexus Community License (Non-Commercial)](https://s.infinito.nexus/license).
diff --git a/roles/svc-net-firewall/meta/info.yml b/roles/svc-net-firewall/meta/info.yml
new file mode 100644
index 0000000000..ca99331c28
--- /dev/null
+++ b/roles/svc-net-firewall/meta/info.yml
@@ -0,0 +1,5 @@
+---
+logo:
+  class: fa-solid fa-shield-halved
+homepage: https://www.netfilter.org/projects/nftables/
+video: https://www.youtube.com/watch?v=EGKhIljDPCw
diff --git a/roles/svc-net-firewall/meta/main.yml b/roles/svc-net-firewall/meta/main.yml
new file mode 100644
index 0000000000..93ca3d7d86
--- /dev/null
+++ b/roles/svc-net-firewall/meta/main.yml
@@ -0,0 +1,27 @@
+---
+galaxy_info:
+  author: Kevin Veen-Birkenbach
+  description: nftables packet filter whose rules each role owns as its own table, replaced atomically and reloaded at boot
+  company: |
+    Kevin Veen-Birkenbach
+    https://www.veen.world
+  license: Infinito.Nexus Community License (Non-Commercial)
+  min_ansible_version: "2.9"
+  galaxy_tags:
+    - firewall
+    - nftables
+    - netfilter
+    - security
+  issue_tracker_url: https://s.infinito.nexus/issues
+  platforms:
+    - name: ArchLinux
+      versions: [all]
+    - name: Debian
+      versions: [all]
+    - name: EL
+      versions: [all]
+    - name: Fedora
+      versions: [all]
+    - name: Ubuntu
+      versions: [all]
+dependencies: []
diff --git a/roles/svc-net-firewall/meta/packages.yml b/roles/svc-net-firewall/meta/packages.yml
new file mode 100644
index 0000000000..06709ff242
--- /dev/null
+++ b/roles/svc-net-firewall/meta/packages.yml
@@ -0,0 +1,8 @@
+---
+nftables:
+  Archlinux:
+    - nftables
+  Debian:
+    - nftables
+  RedHat:
+    - nftables
diff --git a/roles/svc-net-firewall/meta/services.yml b/roles/svc-net-firewall/meta/services.yml
new file mode 100644
index 0000000000..15c0b390d5
--- /dev/null
+++ b/roles/svc-net-firewall/meta/services.yml
@@ -0,0 +1,16 @@
+---
+# nocheck: playwright-service-flag  host packet filter, no container and no web surface
+firewall:
+  modes:
+    host:
+      enabled: true
+    compose:
+      enabled: false
+    swarm:
+      enabled: false
+  lifecycle: beta
+  min_storage: "50MB"
+  cpus: "0.1"
+  mem_reservation: "32m"
+  mem_limit: "64m"
+  pids_limit: 64
diff --git a/roles/svc-net-firewall/tasks/01_host.yml b/roles/svc-net-firewall/tasks/01_host.yml
new file mode 100644
index 0000000000..9474747829
--- /dev/null
+++ b/roles/svc-net-firewall/tasks/01_host.yml
@@ -0,0 +1,32 @@
+---
+- name: "📦 Firewall | Install nftables"
+  become: true
+  package_install:
+    id: nftables
+
+- name: "📁 Firewall | Ensure the fragment directory exists"
+  become: true
+  ansible.builtin.file:
+    path: "{{ FIREWALL_FRAGMENT_DIR }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0750"
+
+- name: "🧱 Firewall | Install the ruleset every fragment is loaded from"
+  become: true
+  ansible.builtin.template: # nocheck: stack-host-template  per-host packet filter: every host carrying rules needs the ruleset, not only the stack host
+    src: main.nft.j2
+    dest: "{{ FIREWALL_MAIN_CONF }}"
+    owner: root
+    group: root
+    mode: "0640"
+    backup: true
+
+- name: "🚀 Firewall | Arm the ruleset for boot without touching the live one"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "{{ FIREWALL_SERVICE }}"
+    enabled: true
+
+- include_tasks: utils/once/flag.yml
diff --git a/roles/svc-net-firewall/tasks/02_fragment.yml b/roles/svc-net-firewall/tasks/02_fragment.yml
new file mode 100644
index 0000000000..5ed9c5900e
--- /dev/null
+++ b/roles/svc-net-firewall/tasks/02_fragment.yml
@@ -0,0 +1,43 @@
+---
+- name: "🔍 Firewall | Resolve the fragment of '{{ FIREWALL_FRAGMENT_ROLE }}'"
+  ansible.builtin.set_fact:
+    firewall_fragment_src: >-
+      {{ lookup('first_found',
+           {
+             'files': [ FIREWALL_FRAGMENT_SRC ],
+             'paths': [ lookup('path_absolute', 'roles', FIREWALL_FRAGMENT_ROLE) ]
+           }
+         ) }}
+    firewall_loaded_table: "{{ FIREWALL_TABLE }}"
+
+- name: "🧱 Firewall | Stage the ruleset of '{{ FIREWALL_FRAGMENT_ROLE }}'"
+  become: true
+  ansible.builtin.template: # nocheck: stack-host-template  per-host packet filter: every host carrying the rules needs the fragment, not only the stack host
+    src: "{{ firewall_fragment_src }}"
+    dest: "{{ FIREWALL_FRAGMENT_FILE }}"
+    owner: root
+    group: root
+    mode: "0640"
+    validate: "nft -c -f %s"
+
+- name: "🚀 Firewall | Load the ruleset of '{{ FIREWALL_FRAGMENT_ROLE }}'"
+  become: true
+  ansible.builtin.command:
+    argv: [nft, -f, "{{ FIREWALL_FRAGMENT_FILE }}"]
+  changed_when: true
+
+- name: "🔍 Firewall | Read back the table of '{{ FIREWALL_FRAGMENT_ROLE }}'"
+  become: true
+  ansible.builtin.command:
+    argv: [nft, list, table, inet, "{{ FIREWALL_TABLE }}"]
+  register: firewall_loaded_ruleset
+  changed_when: false
+
+- name: "✅ Firewall | Refuse a table that carries no chain"
+  ansible.builtin.assert:
+    that:
+      - "'chain ' in firewall_loaded_ruleset.stdout"
+    fail_msg: >-
+      {{ FIREWALL_FRAGMENT_ROLE }} loaded {{ FIREWALL_TABLE }} but the table
+      holds no chain, so nothing it declares is hooked into the packet path.
+      A table that exists is not a rule that runs.
diff --git a/roles/svc-net-firewall/tasks/main.yml b/roles/svc-net-firewall/tasks/main.yml
new file mode 100644
index 0000000000..435c971317
--- /dev/null
+++ b/roles/svc-net-firewall/tasks/main.yml
@@ -0,0 +1,8 @@
+---
+- name: "🧱 Firewall | Prepare the host ruleset"
+  ansible.builtin.include_tasks: 01_host.yml
+  when: run_once_svc_net_firewall is not defined
+
+- name: "🧱 Firewall | Apply the ruleset of '{{ FIREWALL_FRAGMENT_ROLE }}'"
+  ansible.builtin.include_tasks: 02_fragment.yml
+  when: FIREWALL_FRAGMENT_ROLE | length > 0
diff --git a/roles/svc-net-firewall/templates/main.nft.j2 b/roles/svc-net-firewall/templates/main.nft.j2
new file mode 100644
index 0000000000..ef967514c8
--- /dev/null
+++ b/roles/svc-net-firewall/templates/main.nft.j2
@@ -0,0 +1,3 @@
+#!/usr/sbin/nft -f
+# Managed by {{ SOFTWARE_NAME }} (roles/svc-net-firewall). Do not edit by hand.
+include "{{ FIREWALL_FRAGMENT_DIR }}/*.conf"
diff --git a/roles/svc-net-firewall/vars/main.yml b/roles/svc-net-firewall/vars/main.yml
new file mode 100644
index 0000000000..0303fda6d6
--- /dev/null
+++ b/roles/svc-net-firewall/vars/main.yml
@@ -0,0 +1,15 @@
+---
+application_id: svc-net-firewall
+
+FIREWALL_MAIN_CONF_BY_OS_FAMILY:
+  Archlinux: "/etc/nftables.conf"
+  Debian: "/etc/nftables.conf"
+  RedHat: "/etc/sysconfig/nftables.conf"
+
+FIREWALL_MAIN_CONF: "{{ FIREWALL_MAIN_CONF_BY_OS_FAMILY[ansible_facts['os_family']] }}"
+FIREWALL_FRAGMENT_DIR: "/etc/nftables.d"
+FIREWALL_SERVICE: "nftables.service"
+FIREWALL_FRAGMENT_SRC: "templates/nftables.conf.j2"
+FIREWALL_FRAGMENT_ROLE: "{{ ansible_parent_role_names | default([]) | first | default('') }}"
+FIREWALL_FRAGMENT_FILE: "{{ [ FIREWALL_FRAGMENT_DIR, FIREWALL_FRAGMENT_ROLE ~ '.conf' ] | path_join }}"
+FIREWALL_TABLE: "infinito_{{ FIREWALL_FRAGMENT_ROLE | regex_replace('[^a-zA-Z0-9]', '_') }}"
diff --git a/roles/svc-net-tor/README.md b/roles/svc-net-tor/README.md
index 0dfdf7a21c..1091186daf 100644
--- a/roles/svc-net-tor/README.md
+++ b/roles/svc-net-tor/README.md
@@ -86,19 +86,20 @@ Run the published image to provision the inventory and deploy Tor Onion Service
 APP=svc-net-tor
 HOST=<your-server>
 DOMAIN=<your-domain>
+DNS=<your-clearnet-resolver>
 TLS_MODE=self_signed
 SSH_PUBLIC_KEY="<your-ssh-public-key>"
 
 docker run --rm -it \
   -v "$PWD/inventories:/etc/infinito.nexus/inventories" \
-  -e APP="$APP" -e HOST="$HOST" -e DOMAIN="$DOMAIN" -e TLS_MODE="$TLS_MODE" -e SSH_PUBLIC_KEY="$SSH_PUBLIC_KEY" \
+  -e APP="$APP" -e HOST="$HOST" -e DOMAIN="$DOMAIN" -e DNS="$DNS" -e TLS_MODE="$TLS_MODE" -e SSH_PUBLIC_KEY="$SSH_PUBLIC_KEY" \
   ghcr.io/infinito-nexus/core/debian bash -c '
     INVENTORY=/etc/infinito.nexus/inventories/production
     infinito administration inventory provision "$INVENTORY" \
       --inventory-file "$INVENTORY/devices.yml" \
       --host "$HOST" \
       --include "$APP" \
-      --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", \"users\": {\"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}" &&
+      --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", \"networks\": {\"internet\": {\"dns\": \"$DNS\"}}, \"users\": {\"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}" &&
     infinito administration deploy dedicated "$INVENTORY/devices.yml" \
       --password-file "$INVENTORY/.password" \
       --diff -vv'
diff --git a/roles/svc-net-tor/files/test/onion_ports.py b/roles/svc-net-tor/files/test/onion_ports.py
new file mode 100755
index 0000000000..adb6a81c66
--- /dev/null
+++ b/roles/svc-net-tor/files/test/onion_ports.py
@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+"""Assert every TCP port the node onion forwards actually accepts a connection.
+
+The ports are the ones roles ask for by name under ports.onion, plus any
+service opting in with exposed: true, which is what lookup('tor_ports') returns
+and what torrc turns into HiddenServicePort lines. The unconditional SSH forward
+is deliberately not probed: it targets a host service this role does not deploy,
+so its absence says nothing about the forwards under test.
+
+The HTTP probe in test.sh only sees the reverse proxy's vhosts, so mail and
+every other named port went unchecked, and from outside a forwarded port that
+reaches nothing looks exactly like a port that never reached torrc at all.
+
+A port passes when the SOCKS proxy reports CONNECT success, which it does only
+after Tor has established the stream to the target behind the onion. One pass
+probes every port and only the failures are retried, so a green run costs one
+connect per port and a red one cannot multiply the retry budget by the number of
+healthy ports.
+
+Standard library only: this runs wherever the CLI test runs, not in a container
+carrying a test toolchain.
+
+Env (rendered into test.env from templates/test.env.j2):
+    TOR_SOCKS           SOCKS proxy, host:port
+    ONION_HOST          the node onion host
+    ONION_PORTS         space-separated forwarded ports; empty means there is
+                        nothing to check
+    ONION_PORT_TIMEOUT  seconds per connect attempt. 60 for the same reason the
+                        domain probe uses it: Tor's SocksTimeout default is 120s
+                        and abandoning earlier is destructive, because the next
+                        attempt opens a fresh SOCKS connection and throws away
+                        the descriptor fetches and rendezvous retries the last
+                        one was still working through
+    ONION_PORT_RETRIES  passes over the failing ports. Below the domain probe's
+                        RETRIES because this phase multiplies by the port count,
+                        and meta/tests.yml caps the whole CLI test
+    SLEEP_SECONDS       wait between passes
+"""
+
+from __future__ import annotations
+
+import os
+import secrets
+import socket
+import sys
+import time
+
+_GREETING_USER_PASS = b"\x05\x01\x02"
+_GREETING_OK = b"\x05\x02"
+_AUTH_VERSION = 0x01
+_AUTH_OK = b"\x01\x00"
+_CONNECT_TO_DOMAIN = b"\x05\x01\x00\x03"
+_REPLY_SUCCESS = 0x00
+
+
+class ProbeError(RuntimeError):
+    """A port did not answer, with the reason a reader needs to act on it."""
+
+
+def _required(name: str, hint: str) -> str:
+    value = os.environ.get(name, "").strip()
+    if not value:
+        raise SystemExit(f"pass {name} as env ({hint})")
+    return value
+
+
+def connect_through_socks(proxy: str, host: str, port: int, timeout: float) -> None:
+    """Open a SOCKS5 CONNECT to ``host:port`` and raise when it is refused.
+
+    Every call authenticates with fresh random credentials. Tor accepts any and,
+    under its default IsolateSOCKSAuth, builds a separate rendezvous circuit for
+    each. Tor never moves an onion stream off the rendezvous circuit it attached
+    to, so a retry sharing the credentials of the failed attempt would wait on
+    the same dead circuit again.
+    """
+    proxy_host, _, proxy_port = proxy.rpartition(":")
+    token = secrets.token_hex(8).encode()
+    try:
+        sock = socket.create_connection((proxy_host, int(proxy_port)), timeout=timeout)
+    except OSError as error:
+        raise ProbeError(f"socks proxy unreachable: {error}") from None
+
+    with sock:
+        sock.settimeout(timeout)
+        try:
+            sock.sendall(_GREETING_USER_PASS)
+            if sock.recv(2) != _GREETING_OK:
+                raise ProbeError("socks proxy refused the username/password method")
+            sock.sendall(
+                bytes([_AUTH_VERSION, len(token)]) + token + bytes([len(token)]) + token
+            )
+            if sock.recv(2) != _AUTH_OK:
+                raise ProbeError("socks proxy rejected the isolation credentials")
+            target = host.encode()
+            sock.sendall(
+                _CONNECT_TO_DOMAIN
+                + bytes([len(target)])
+                + target
+                + port.to_bytes(2, "big")
+            )
+            reply = sock.recv(4)
+        except OSError as error:
+            raise ProbeError(f"socks handshake failed: {error}") from None
+        if len(reply) < 2:
+            raise ProbeError("socks proxy closed the connection")
+        if reply[1] != _REPLY_SUCCESS:
+            raise ProbeError(f"socks CONNECT failed with reply 0x{reply[1]:02x}")
+
+
+def probe(
+    *,
+    proxy: str,
+    host: str,
+    ports: list[int],
+    timeout: float,
+    retries: int,
+    sleep_seconds: float,
+    sleeper=time.sleep,
+) -> dict[int, str]:
+    """Return the ports still failing after the retries, with their reason."""
+    pending = list(ports)
+    reasons: dict[int, str] = {}
+    for attempt in range(1, retries + 1):
+        still: list[int] = []
+        for port in pending:
+            try:
+                connect_through_socks(proxy, host, port, timeout)
+            except ProbeError as error:
+                reasons[port] = str(error)
+                still.append(port)
+            else:
+                reasons.pop(port, None)
+                print(f"[OK]   {host}:{port} connect")
+        pending = still
+        if not pending or attempt == retries:
+            break
+        print(
+            f"[INFO] pass {attempt + 1}/{retries} retries "
+            f"{len(pending)} port(s) in {sleep_seconds}s"
+        )
+        sleeper(sleep_seconds)
+    return {port: reasons[port] for port in pending}
+
+
+def main() -> int:
+    proxy = _required("TOR_SOCKS", "host:port of the node SOCKS proxy")
+    host = _required("ONION_HOST", "svc-net-tor services.tor.node")
+    retries = int(_required("ONION_PORT_RETRIES", "passes over the failing ports"))
+    sleep_seconds = float(_required("SLEEP_SECONDS", "wait between passes"))
+    timeout = float(
+        _required("ONION_PORT_TIMEOUT", "seconds per connect, flavor-dependent")
+    )
+    ports = [int(entry) for entry in os.environ.get("ONION_PORTS", "").split()]
+
+    if not ports:
+        print("[INFO] no onion-forwarded ports declared; nothing to probe")
+        return 0
+
+    print(
+        f"[INFO] probing {len(ports)} onion-forwarded port(s) on {host} "
+        f"via socks5://{proxy} ({timeout}s per connect)"
+    )
+    failures = probe(
+        proxy=proxy,
+        host=host,
+        ports=ports,
+        timeout=timeout,
+        retries=retries,
+        sleep_seconds=sleep_seconds,
+    )
+    for port, reason in failures.items():
+        print(f"[FAIL] {host}:{port} {reason}")
+    print(f"[INFO] {len(ports)} port(s) probed, {len(failures)} failed")
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/roles/svc-net-tor/files/test/test.sh b/roles/svc-net-tor/files/test/test.sh
index 67bb92e08e..68677e034b 100755
--- a/roles/svc-net-tor/files/test/test.sh
+++ b/roles/svc-net-tor/files/test/test.sh
@@ -99,4 +99,7 @@ for domain in "${domains[@]}"; do
 done
 
 echo "[INFO] ${#domains[@]} probed, ${failed} failed"
+
+"$(dirname "${BASH_SOURCE[0]}")/onion_ports.py" || failed=$((failed + 1))
+
 [[ "${failed}" -eq 0 ]]
diff --git a/roles/svc-net-tor/lookup_plugins/tor_egress_clients.py b/roles/svc-net-tor/lookup_plugins/tor_egress_clients.py
new file mode 100644
index 0000000000..bd0a9647ae
--- /dev/null
+++ b/roles/svc-net-tor/lookup_plugins/tor_egress_clients.py
@@ -0,0 +1,101 @@
+"""Lookup `tor_egress_clients`: the address space Tor's egress ports admit.
+
+Deliberately not the three RFC1918 blocks: 10.0.0.0/8 would hand the operator's
+whole LAN a resolver and a transparent proxy that carry no access policy of
+their own. What is admitted is what this deployment declares for itself, in rule
+order: loopback, docker's address pools, the swarm gateway bridge, the role
+subnet pool, and the subnets of the roles that sit outside it.
+
+Usage:
+
+    {{ lookup('tor_egress_clients') }}
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ansible.errors import AnsibleError
+from ansible.plugins.loader import lookup_loader
+from ansible.plugins.lookup import LookupBase
+from ansible.template import trust_as_template
+
+_REQUIRED = (
+    "NETWORK_LOOPBACK_CIDR",
+    "NETWORK_DOCKER_ADDRESS_POOLS",
+    "NETWORK_SWARM_GWBRIDGE_POOL",
+    "NETWORK_ROLE_SUBNET_POOL",
+    "NETWORK_ROLE_SUBNET_EXCEPTION_ROLES",
+)
+
+
+def _rendered(templar: Any, value: Any) -> str:
+    """A variable's value with its Jinja resolved.
+
+    Group vars reach a lookup as whatever the file holds, and several of these
+    are references rather than literals. Passing one through unrendered would
+    put the template text itself into a source address, where it cannot match
+    and therefore silently narrows the admitted set.
+    """
+    text = "" if value is None else str(value).strip()
+    if "{{" not in text or templar is None:
+        return text
+    rendered = str(templar.template(trust_as_template(text))).strip()
+    if "{{" in rendered:
+        raise AnsibleError(f"tor_egress_clients: {text!r} did not render to an address")
+    return rendered
+
+
+class LookupModule(LookupBase):
+    def run(
+        self,
+        terms: list[Any] | None,
+        variables: dict[str, Any] | None = None,
+        **kwargs: Any,
+    ) -> list[Any]:
+        if terms:
+            raise AnsibleError("lookup('tor_egress_clients') expects no terms.")
+        variables = variables or getattr(self._templar, "available_variables", {}) or {}
+        missing = [name for name in _REQUIRED if variables.get(name) is None]
+        if missing:
+            raise AnsibleError(
+                "tor_egress_clients: missing variable(s) "
+                f"{', '.join(missing)}; an incomplete list would install a guard "
+                "that admits more than it was asked to"
+            )
+
+        templar = getattr(self, "_templar", None)
+        excepted = lookup_loader.get(
+            "role_subnets",
+            loader=getattr(self, "_loader", None),
+            templar=templar,
+        ).run(
+            [variables["NETWORK_ROLE_SUBNET_EXCEPTION_ROLES"]],
+            variables=variables,
+        )[0]
+
+        pools = variables["NETWORK_DOCKER_ADDRESS_POOLS"]
+        if not isinstance(pools, (list, tuple)):
+            raise AnsibleError(
+                "tor_egress_clients: NETWORK_DOCKER_ADDRESS_POOLS must be a list"
+            )
+        bases = []
+        for pool in pools:
+            base = pool.get("base") if isinstance(pool, dict) else None
+            if not base:
+                raise AnsibleError(
+                    f"tor_egress_clients: address pool {pool!r} declares no base"
+                )
+            bases.append(_rendered(templar, base))
+
+        ordered = [
+            _rendered(templar, variables["NETWORK_LOOPBACK_CIDR"]),
+            *bases,
+            _rendered(templar, variables["NETWORK_SWARM_GWBRIDGE_POOL"]),
+            _rendered(templar, variables["NETWORK_ROLE_SUBNET_POOL"]),
+            *[_rendered(templar, subnet) for subnet in excepted],
+        ]
+        seen: dict[str, None] = {}
+        for cidr in ordered:
+            seen.setdefault(cidr, None)
+        return [list(seen)]
diff --git a/roles/svc-net-tor/lookup_plugins/tor_extra_ports.py b/roles/svc-net-tor/lookup_plugins/tor_extra_ports.py
new file mode 100644
index 0000000000..f5f90a95d1
--- /dev/null
+++ b/roles/svc-net-tor/lookup_plugins/tor_extra_ports.py
@@ -0,0 +1,100 @@
+"""Lookup `tor_extra_ports`: every port the node onion forwards.
+
+Two of them are flags rather than derivations, because no inventory carries
+them. ``lookup('tor_ports')`` walks ``group_names`` and collects what the roles
+listed there declare under ``ports.onion``; SSH belongs to no role at all, and
+HTTP belongs to ``svc-prx-openresty``, which a node acquires through
+``sys-stk-front-proxy`` and which therefore appears in no dependency list an
+inventory holds. A node provisioned with ``--include svc-net-tor`` alone
+published an onion forwarding SSH and nothing else, leaving every app it serves
+unreachable over that onion.
+
+Forwarding HTTP is what this role exists for, so it is declared, and a node that
+must not answer HTTP over its onion turns ``TOR_ONION_HTTP_ENABLED`` off.
+
+The derived ports still come from ``tor_ports``; a port named twice collapses,
+since ``torrc.j2`` writes one ``HiddenServicePort`` line per entry.
+
+Usage:
+
+    {{ lookup('tor_extra_ports') }}
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ansible.errors import AnsibleError
+from ansible.module_utils.parsing.convert_bool import boolean
+from ansible.plugins.loader import lookup_loader
+from ansible.plugins.lookup import LookupBase
+from ansible.template import trust_as_template
+
+FLAGGED_PORTS: tuple[tuple[str, int], ...] = (
+    ("TOR_ONION_SSH_ENABLED", 22),
+    ("TOR_ONION_HTTP_ENABLED", 80),
+)
+
+
+def _flag(templar: Any, name: str, value: Any) -> bool:
+    """A declared flag as a boolean, with its Jinja resolved first.
+
+    Args:
+        templar: the lookup's templar, or None when it has none.
+        name: the variable the flag came from, for the error message.
+        value: whatever the variable holds; group vars reach a lookup
+            unrendered, so a reference arrives as its own template text.
+    """
+    if isinstance(value, str) and "{{" in value and templar is not None:
+        value = templar.template(trust_as_template(value))
+    try:
+        return boolean(value)
+    except TypeError as exc:
+        raise AnsibleError(
+            f"lookup('tor_extra_ports'): {name} is not a boolean: {value!r}"
+        ) from exc
+
+
+def _entry(port: int) -> dict[str, Any]:
+    """One forward, in the shape ``torrc.j2`` consumes.
+
+    Args:
+        port: the port the onion answers on; the backend host is substituted by
+            the template, so the target carries the port alone.
+    """
+    return {"onion_port": port, "target": f"127.0.0.1:{port}"}
+
+
+class LookupModule(LookupBase):
+    def run(
+        self,
+        terms: list[Any] | None,
+        variables: dict[str, Any] | None = None,
+        **kwargs: Any,
+    ) -> list[Any]:
+        if terms:
+            raise AnsibleError("lookup('tor_extra_ports') expects no terms.")
+
+        variables = variables or getattr(self._templar, "available_variables", {}) or {}
+
+        entries: list[dict[str, Any]] = []
+        for name, port in FLAGGED_PORTS:
+            if name not in variables:
+                raise AnsibleError(f"lookup('tor_extra_ports'): {name} is not defined")
+            if _flag(getattr(self, "_templar", None), name, variables[name]):
+                entries.append(_entry(port))
+
+        derived = lookup_loader.get(
+            "tor_ports",
+            loader=getattr(self, "_loader", None),
+            templar=getattr(self, "_templar", None),
+        ).run([], variables=variables, **kwargs)[0]
+
+        seen = {entry["onion_port"] for entry in entries}
+        for entry in derived:
+            if entry["onion_port"] in seen:
+                continue
+            seen.add(entry["onion_port"])
+            entries.append(entry)
+
+        return [entries]
diff --git a/roles/svc-net-tor/meta/services.yml b/roles/svc-net-tor/meta/services.yml
index 0b3345feac..8ea686d6c8 100644
--- a/roles/svc-net-tor/meta/services.yml
+++ b/roles/svc-net-tor/meta/services.yml
@@ -20,12 +20,17 @@ tor: # nocheck: category-modes
   exclusive: true
   primary: true
   image: debian
-  version: trixie-slim
+  version: 13.7-slim
   custom: true
   name: tor
   node: ""
   use_entry_guards: true
   flavor: public
+  forwards:
+    ssh: true
+    http: true
+  egress:
+    enabled: true
   timeout_multipliers:
     chutney: 2
     public: 5
@@ -34,9 +39,16 @@ tor: # nocheck: category-modes
       socks: 9050
       trans: 9040
       dns: 9053
+    onion:
+      # nocheck: onion-flag  a SOCKS port anyone can reach is an open proxy, and SocksPolicy cannot refuse it because the forward arrives from the node's own address
+      socks: false
+      # nocheck: onion-flag  the transparent port takes its destination from the caller's routing, which an onion client does not share
+      trans: false
+      # nocheck: onion-flag  publishing the resolver would answer recursive queries for anyone holding the onion address
+      dns: false
   min_storage: 100MB
   cpus: "0.25"
   mem_reservation: 128m
   mem_limit: 256m
   pids_limit: 128
-  lifecycle: alpha
+  lifecycle: beta
diff --git a/roles/svc-net-tor/tasks/00_core.yml b/roles/svc-net-tor/tasks/00_core.yml
index 7cf9dfc626..b7cbc59ccb 100644
--- a/roles/svc-net-tor/tasks/00_core.yml
+++ b/roles/svc-net-tor/tasks/00_core.yml
@@ -125,7 +125,9 @@
     file: router.yml
     apply:
       become: true
-  when: TOR_EGRESS_ROUTER_ENABLED | bool
+  when:
+    - TOR_EGRESS_ROUTER_ENABLED | bool
+    - DEPLOYMENT_MODE == 'compose' or (IS_STACK_HOST | bool)
 
 - name: "🧅 Verify the node onion is reachable"
   ansible.builtin.include_tasks: onion_reach.yml
diff --git a/roles/svc-net-tor/tasks/router.yml b/roles/svc-net-tor/tasks/router.yml
index 3ab0421d00..08f4119e8e 100644
--- a/roles/svc-net-tor/tasks/router.yml
+++ b/roles/svc-net-tor/tasks/router.yml
@@ -68,7 +68,7 @@
   ansible.builtin.systemd:
     name: dnsmasq
     enabled: true
-    daemon_reload: "{{ _tor_dnsmasq_dropin is changed }}"
+    daemon_reload: "{{ TOR_DNSMASQ_OWNS_LISTENER | bool and _tor_dnsmasq_dropin is changed }}"
     state: "{{ 'restarted' if (_tor_dnsmasq_conf is changed or _tor_dnsmasq_confdir is changed) else 'started' }}"
 - name: "🔀 Egress router | Route host name resolution through dnsmasq"
   when: TOR_DNSMASQ_OWNS_LISTENER | bool
@@ -88,12 +88,22 @@
         regexp: "^(hosts:.*\\bresolve)\\s*\\[!UNAVAIL=return\\](.*)$"
         line: "\\1 [SUCCESS=return NOTFOUND=continue TRYAGAIN=return]\\2"
         backrefs: true
-- name: "🔀 Egress router | Redirect .onion virtual-IP TCP to Tor TransPort"
-  ansible.builtin.iptables:
-    table: nat
-    chain: OUTPUT
-    protocol: tcp
-    destination: "{{ TOR_EGRESS_VIRTUAL_NET_IPV4 }}"
-    jump: REDIRECT
-    to_ports: "{{ TOR_TRANS_PORT | string }}"
-    comment: "Tor egress router: .onion virtual range -> TransPort"
+- name: "🔀 Egress router | Route .onion traffic and bound the ports that carry no policy"
+  ansible.builtin.include_role:
+    name: svc-net-firewall
+
+- name: "🛡️ Egress guard | Read back the chain that bounds the ports"
+  become: true
+  ansible.builtin.command:
+    argv: [nft, list, chain, inet, "{{ firewall_loaded_table }}", guard]
+  register: tor_egress_guard_chain
+  changed_when: false
+
+- name: "🛡️ Egress guard | Refuse a guard that drops nothing"
+  ansible.builtin.assert:
+    that:
+      - "'drop' in tor_egress_guard_chain.stdout"
+    fail_msg: >-
+      The guard chain in {{ firewall_loaded_table }} carries no drop, so
+      TransPort and DNSPort are reachable from every source. These two ports
+      have no access policy of their own; this chain is the only boundary.
diff --git a/roles/svc-net-tor/templates/compose.yml.j2 b/roles/svc-net-tor/templates/compose.yml.j2
index 4284a342ca..81c0ffdaec 100644
--- a/roles/svc-net-tor/templates/compose.yml.j2
+++ b/roles/svc-net-tor/templates/compose.yml.j2
@@ -12,11 +12,13 @@
     {{ lookup('compose_only', 'container_name', TOR_CONTAINER) }}
     {{ lookup('container_image', application_id, 'tor') }}
     {% if DEPLOYMENT_MODE == 'swarm' %}
-    ports:
-      - target: {{ TOR_SOCKS_PORT }}
-        published: {{ TOR_SOCKS_PORT }}
-        protocol: tcp
-        mode: host
+    {{ lookup('container_ports',
+              {'service': 'tor', 'protocol': 'socks', 'mode': 'host',
+               'container': 'same'},
+              {'service': 'tor', 'protocol': 'dns', 'mode': 'host',
+               'container': 'same', 'transport': ['udp', 'tcp']},
+              {'service': 'tor', 'protocol': 'trans', 'mode': 'host',
+               'container': 'same', 'transport': 'tcp'}) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
     {% else %}
     network_mode: "host"
diff --git a/roles/svc-net-tor/templates/nftables.conf.j2 b/roles/svc-net-tor/templates/nftables.conf.j2
new file mode 100644
index 0000000000..eab3aa5bb0
--- /dev/null
+++ b/roles/svc-net-tor/templates/nftables.conf.j2
@@ -0,0 +1,52 @@
+{# Loaded by roles/svc-net-firewall into {{ FIREWALL_TABLE }}. #}
+table inet {{ FIREWALL_TABLE }}
+delete table inet {{ FIREWALL_TABLE }}
+table inet {{ FIREWALL_TABLE }} {
+  set containers {
+    type ipv4_addr
+    flags interval
+    elements = { {{ TOR_EGRESS_CLIENT_CIDRS | join(', ') }} }
+  }
+
+  set internal {
+    type ipv4_addr
+    flags interval
+    elements = { {{ NETWORK_INTERNAL_CIDRS | join(', ') }} }
+  }
+
+{% set _tcp_guarded = TOR_EGRESS_GUARDED_PORTS | selectattr('protocol', 'equalto', 'tcp') | map(attribute='port') | unique | list %}
+{% set _udp_guarded = TOR_EGRESS_GUARDED_PORTS | selectattr('protocol', 'equalto', 'udp') | map(attribute='port') | unique | list %}
+  chain guard {
+{% for entry in TOR_EGRESS_GUARDED_PORTS %}
+    ip saddr != @{{ entry.admitted }} {{ entry.protocol }} dport {{ entry.port }} drop
+{% endfor %}
+{% if _tcp_guarded | length > 0 %}
+    fib saddr . iif oif missing tcp dport { {{ _tcp_guarded | join(', ') }} } drop
+{% endif %}
+{% if _udp_guarded | length > 0 %}
+    fib saddr . iif oif missing udp dport { {{ _udp_guarded | join(', ') }} } drop
+{% endif %}
+  }
+
+  chain input {
+    type filter hook input priority -10; policy accept;
+    jump guard
+  }
+
+  chain forward {
+    type filter hook forward priority -10; policy accept;
+    jump guard
+  }
+
+  chain output {
+    type nat hook output priority -150; policy accept;
+    ip daddr {{ TOR_EGRESS_VIRTUAL_NET_IPV4 }} meta l4proto tcp redirect to :{{ TOR_TRANS_PORT }}
+  }
+{% if TOR_CONTAINER_DNS_HOST | length > 0 %}
+
+  chain prerouting {
+    type nat hook prerouting priority -150; policy accept;
+    ip daddr {{ TOR_EGRESS_VIRTUAL_NET_IPV4 }} meta l4proto tcp dnat ip to {{ TOR_CONTAINER_DNS_HOST }}:{{ TOR_TRANS_PORT }}
+  }
+{% endif %}
+}
diff --git a/roles/svc-net-tor/templates/test.env.j2 b/roles/svc-net-tor/templates/test.env.j2
index 10028ca3a0..6e0bec9054 100644
--- a/roles/svc-net-tor/templates/test.env.j2
+++ b/roles/svc-net-tor/templates/test.env.j2
@@ -1,4 +1,8 @@
 NGINX_SERVERS_DIR={{ lookup('nginx', 'directories.configuration.servers') }}
+ONION_HOST={{ lookup('config', 'svc-net-tor', 'services.tor.node') }}
+ONION_PORTS={{ lookup('tor_ports') | map(attribute='onion_port') | unique | sort | join(' ') | dotenv_quote }}
+ONION_PORT_RETRIES=2
+ONION_PORT_TIMEOUT=60
 RETRIES=5
 SLEEP_SECONDS=10
 TOR_DNSMASQ_CONF={{ TOR_DNSMASQ_CONF }}
diff --git a/roles/svc-net-tor/templates/torrc.j2 b/roles/svc-net-tor/templates/torrc.j2
index b2167aeea9..20e1dddbbb 100644
--- a/roles/svc-net-tor/templates/torrc.j2
+++ b/roles/svc-net-tor/templates/torrc.j2
@@ -1,13 +1,12 @@
-# Managed by Infinito.Nexus (roles/svc-net-tor) — do not edit by hand.
+# Managed by {{ SOFTWARE_NAME }} (roles/svc-net-tor) — do not edit by hand.
 RunAsDaemon 0
 Log notice stdout
 DataDirectory {{ lookup('volume', 'svc-net-tor', 'tor_data').target }}
 
 SocksPort {{ lookup('tor_socks', '0.0.0.0') }}
-SocksPolicy accept 127.0.0.0/8
-SocksPolicy accept 10.0.0.0/8
-SocksPolicy accept 172.16.0.0/12
-SocksPolicy accept 192.168.0.0/16
+{% for _cidr in NETWORK_INTERNAL_CIDRS %}
+SocksPolicy accept {{ _cidr }}
+{% endfor %}
 SocksPolicy reject *
 ControlPort 127.0.0.1:9051
 CookieAuthentication 1
@@ -24,12 +23,20 @@ UseEntryGuards 0
 AutomapHostsOnResolve 1
 AutomapHostsSuffixes .onion
 VirtualAddrNetworkIPv4 {{ TOR_EGRESS_VIRTUAL_NET_IPV4 }}
+{% if DEPLOYMENT_MODE == 'swarm' %}
+TransPort 0.0.0.0:{{ TOR_TRANS_PORT }}
+DNSPort 0.0.0.0:{{ TOR_DNS_PORT }}
+{% else %}
 TransPort 127.0.0.1:{{ TOR_TRANS_PORT }}
 DNSPort 127.0.0.1:{{ TOR_DNS_PORT }}
+{% if TOR_CONTAINER_DNS_HOST | length > 0 %}
+TransPort {{ TOR_CONTAINER_DNS_HOST }}:{{ TOR_TRANS_PORT }}
+DNSPort {{ TOR_CONTAINER_DNS_HOST }}:{{ TOR_DNS_PORT }}
+{% endif %}
+{% endif %}
 {% endif %}
 HiddenServiceDir /var/lib/tor/infinito/node/
 HiddenServiceVersion 3
-HiddenServicePort 80 {{ TOR_HS_BACKEND_HOST }}:80
 {% for _p in TOR_ONION_EXTRA_PORTS %}
 HiddenServicePort {{ _p.onion_port }} {{ TOR_HS_BACKEND_HOST }}:{{ _p.target.rsplit(':', 1) | last }}
 {% endfor %}
diff --git a/roles/svc-net-tor/vars/main.yml b/roles/svc-net-tor/vars/main.yml
index 482668303f..f8245d1817 100644
--- a/roles/svc-net-tor/vars/main.yml
+++ b/roles/svc-net-tor/vars/main.yml
@@ -6,13 +6,40 @@ TOR_IMAGE: "{{ lookup('config', application_id, 'services.tor.image') }}"
 TOR_VERSION: "{{ lookup('config', application_id, 'services.tor.version') }}"
 TOR_CONTAINER: "{{ lookup('config', application_id, 'services.tor.name') }}"
 
-TOR_SOCKS_PORT: "{{ lookup('config', application_id, 'services.tor.ports.local.socks') }}"
 TOR_NODE_ONION: "{{ lookup('config', application_id, 'services.tor.node', '') }}"
 TOR_USE_ENTRY_GUARDS: "{{ lookup('config', application_id, 'services.tor.use_entry_guards') | bool }}"
 TOR_FLAVOR: "{{ lookup('config', application_id, 'services.tor.flavor') }}"
+TOR_ONION_SSH_ENABLED: "{{ lookup('config', application_id, 'services.tor.forwards.ssh') | bool }}"
+TOR_ONION_HTTP_ENABLED: "{{ lookup('config', application_id, 'services.tor.forwards.http') | bool }}"
+TOR_ONION_EXTRA_PORTS: "{{ lookup('tor_extra_ports') }}"
+TOR_EGRESS_ROUTER_ENABLED: "{{ lookup('config', application_id, 'services.tor.egress.enabled') | bool }}"
+TOR_EGRESS_VIRTUAL_NET_IPV4: "{{ NETWORK_TOR_VIRTUAL_CIDR }}"
 TOR_TRANS_PORT: "{{ lookup('config', application_id, 'services.tor.ports.local.trans') }}"
 TOR_DNS_PORT: "{{ lookup('config', application_id, 'services.tor.ports.local.dns') }}"
+TOR_SOCKS_PORT: "{{ lookup('config', application_id, 'services.tor.ports.local.socks') }}"
+TOR_DNSMASQ_PORT: "{{ NETWORK_DNS_PORT }}"
 TOR_DNSMASQ_CONF: "/etc/dnsmasq.d/tor-onion.conf"
+
+TOR_EGRESS_GUARDED_PORTS:
+  - port: "{{ TOR_TRANS_PORT }}"
+    protocol: tcp
+    admitted: containers
+  - port: "{{ TOR_DNS_PORT }}"
+    protocol: tcp
+    admitted: containers
+  - port: "{{ TOR_DNS_PORT }}"
+    protocol: udp
+    admitted: containers
+  - port: "{{ TOR_SOCKS_PORT }}"
+    protocol: tcp
+    admitted: internal
+  - port: "{{ TOR_DNSMASQ_PORT }}"
+    protocol: tcp
+    admitted: internal
+  - port: "{{ TOR_DNSMASQ_PORT }}"
+    protocol: udp
+    admitted: internal
+TOR_EGRESS_CLIENT_CIDRS: "{{ lookup('tor_egress_clients') }}"
 TOR_DNSMASQ_DROPIN: "/etc/systemd/system/dnsmasq.service.d/infinito-restart.conf"
 # nocheck: host-local-fact  meta/services.yml pins this role to the manager, so the fact describes the node the hidden service forwards on
 TOR_CONTAINER_DNS_HOST: "{{ ansible_facts['docker0']['ipv4']['address'] | default('', true) }}"
diff --git a/roles/svc-prx-openresty/meta/services.yml b/roles/svc-prx-openresty/meta/services.yml
index d94903c97f..70f57222ff 100644
--- a/roles/svc-prx-openresty/meta/services.yml
+++ b/roles/svc-prx-openresty/meta/services.yml
@@ -11,6 +11,17 @@ openresty:
   enabled: true
   shared: true
   name: openresty
+  ports:
+    internal:
+      http: 80
+      https: 443
+    public:
+      http: 80
+      https: 443
+    onion:
+      http: true
+      # nocheck: onion-flag  the hidden service is already the transport encryption, and the onion address has no certificate a TLS listener could present
+      https: false
   healthcheck:
     test: ["CMD", "openresty", "-t", "-q"]
   min_storage: 264MB
@@ -20,7 +31,7 @@ openresty:
   mem_reservation: 1g
   mem_limit: 2g
   image: openresty/openresty
-  version: alpine
+  version: 1.31.1.1-alpine
   custom: true
   lifecycle: beta
   pids_limit: 256
diff --git a/roles/svc-prx-openresty/meta/variants.yml b/roles/svc-prx-openresty/meta/variants.yml
index 1576e2511e..a5e59537b6 100644
--- a/roles/svc-prx-openresty/meta/variants.yml
+++ b/roles/svc-prx-openresty/meta/variants.yml
@@ -2,6 +2,3 @@
 - services:
     tor:
       enabled: true
-- services:
-    tor:
-      enabled: true
diff --git a/roles/svc-prx-openresty/templates/compose.yml.j2 b/roles/svc-prx-openresty/templates/compose.yml.j2
index 7d8f791608..b3bbe4721a 100644
--- a/roles/svc-prx-openresty/templates/compose.yml.j2
+++ b/roles/svc-prx-openresty/templates/compose.yml.j2
@@ -14,15 +14,9 @@
     {{ lookup('compose_only', 'container_name', OPENRESTY_CONTAINER) }}
     {{ lookup('container_image', application_id, 'openresty') }}
     {% if DEPLOYMENT_MODE == 'swarm' %}
-    ports:
-      - target: 80
-        published: 80
-        protocol: tcp
-        mode: host
-      - target: 443
-        published: 443
-        protocol: tcp
-        mode: host
+    {{ lookup('container_ports',
+              {'service': 'openresty', 'protocol': 'http', 'mode': 'host'},
+              {'service': 'openresty', 'protocol': 'https', 'mode': 'host'}) | indent(4) }}
     {{ lookup('container_extra_hosts', extra_hosts=['host.docker.internal:host-gateway']) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
     {% else %}
diff --git a/roles/svc-registry-cache/meta/services.yml b/roles/svc-registry-cache/meta/services.yml
index 582e5433bd..69a32710b8 100644
--- a/roles/svc-registry-cache/meta/services.yml
+++ b/roles/svc-registry-cache/meta/services.yml
@@ -34,6 +34,9 @@ cache:
       registry: 5001
     internal:
       registry: 5000
+    onion:
+      # nocheck: onion-flag  the pull-through mirror exists to serve this node's own image pulls; publishing it would relay Docker Hub for strangers
+      registry: false
   proxy:
     remote_url: "https://registry-1.docker.io" # nocheck: url
   lifecycle: beta
diff --git a/roles/svc-registry-docker/meta/services.yml b/roles/svc-registry-docker/meta/services.yml
index 5b2d65525d..66774e620e 100644
--- a/roles/svc-registry-docker/meta/services.yml
+++ b/roles/svc-registry-docker/meta/services.yml
@@ -34,6 +34,9 @@ docker:
       registry: 5000
     internal:
       registry: 5000
+    onion:
+      # nocheck: onion-flag  the registry accepts unauthenticated pushes from the node that builds into it, so its reach must stay the node
+      registry: false
   lifecycle: beta
 # nocheck: dynamic-flag - locally built images are rebuildable, the backup consumer stays permanently off
 container_backup:
diff --git a/roles/svc-runner/files/test/external.sh b/roles/svc-runner/files/test/external.sh
index 28378ec774..6a36661122 100644
--- a/roles/svc-runner/files/test/external.sh
+++ b/roles/svc-runner/files/test/external.sh
@@ -33,7 +33,7 @@ else
     echo "OK: ${online_count} runner(s) online on GitHub (${RUNNER_GITHUB_OWNER}/${RUNNER_GITHUB_REPO})"
 fi
 
-echo "Dispatching test-runner-smoke.yml against ref=${RUNNER_GIT_REF}..."
+echo "Dispatching call-test-runner-smoke.yml against ref=${RUNNER_GIT_REF}..."
 dispatch_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 
 dispatch_http=$(${CURL} -sf -o /dev/null -w "%{http_code}" \
diff --git a/roles/svc-runner/meta/services.yml b/roles/svc-runner/meta/services.yml
index c02f122847..025ae72661 100644
--- a/roles/svc-runner/meta/services.yml
+++ b/roles/svc-runner/meta/services.yml
@@ -30,8 +30,7 @@ buildkit:
   enabled: false
   shared: false
   image: moby/buildkit
-  # nocheck: docker-version
-  version: "buildx-stable-1"
+  version: "v0.33.0"
 # nocheck: dynamic-flag
 act-runner:
   enabled: false
diff --git a/roles/svc-storage-nfs-server/templates/exports.j2 b/roles/svc-storage-nfs-server/templates/exports.j2
index 471a61869d..830dfceee0 100644
--- a/roles/svc-storage-nfs-server/templates/exports.j2
+++ b/roles/svc-storage-nfs-server/templates/exports.j2
@@ -1,4 +1,4 @@
-# Managed by Infinito.Nexus Ansible role svc-storage-nfs-server.
+# Managed by {{ SOFTWARE_NAME }} Ansible role svc-storage-nfs-server.
 {% for ip in svc_storage_nfs_server_allowed_ips %}
 {{ STORAGE_NFS_STATE_PATH }} {{ ip }}({{ SVC_STORAGE_NFS_SERVER_STATE_EXPORT_OPTIONS }},fsid=0)
 {% endfor %}
diff --git a/roles/sys-ctl-alm-compose/templates/script.sh.j2 b/roles/sys-ctl-alm-compose/templates/script.sh.j2
index d9007ff9d5..ff85bcf637 100644
--- a/roles/sys-ctl-alm-compose/templates/script.sh.j2
+++ b/roles/sys-ctl-alm-compose/templates/script.sh.j2
@@ -1,4 +1,5 @@
 #!/bin/bash
+{# nocheck: shell-template  grandfathered: one start block per subservice, each naming a unit only unit_name can resolve #}
 err=0
 set -u
 start_timeout="{{ SYSTEMCTL_ALARM_COMPOSER_START_TIMEOUT_SECONDS }}"
diff --git a/roles/sys-ctl-alm-email/templates/script.sh.j2 b/roles/sys-ctl-alm-email/templates/script.sh.j2
index b8b89bf89d..c9ec0bdf61 100644
--- a/roles/sys-ctl-alm-email/templates/script.sh.j2
+++ b/roles/sys-ctl-alm-email/templates/script.sh.j2
@@ -1,4 +1,5 @@
 #!/bin/bash
+{# nocheck: shell-template  grandfathered, values only: the mail envelope, charset and timeout #}
 set -u
 # Reverse systemd escaping for human-readable mail subject/body
 friendly="$(systemd-escape --unescape "$1")"
diff --git a/roles/sys-ctl-alm-telegram/templates/script.sh.j2 b/roles/sys-ctl-alm-telegram/templates/script.sh.j2
index 32a1fb0f94..726a842e4f 100644
--- a/roles/sys-ctl-alm-telegram/templates/script.sh.j2
+++ b/roles/sys-ctl-alm-telegram/templates/script.sh.j2
@@ -1,4 +1,5 @@
 #!/bin/bash
+{# nocheck: shell-template  grandfathered, values only: bot token, chat id and the curl filter's timeout #}
 set -u
 
 # Make the instance text human readable again (reverse systemd escaping)
diff --git a/roles/sys-ctl-cln-docker/templates/script.sh.j2 b/roles/sys-ctl-cln-docker/templates/script.sh.j2
index 4a7bd76017..5d66f0f6d7 100644
--- a/roles/sys-ctl-cln-docker/templates/script.sh.j2
+++ b/roles/sys-ctl-cln-docker/templates/script.sh.j2
@@ -1,4 +1,5 @@
 #!/bin/sh
+{# nocheck: shell-template  grandfathered, values only: the versioned unit name it starts #}
 # Cleans up anonymous Docker volumes and performs a full Docker system prune.
 
 set -e
diff --git a/roles/sys-ctl-hlth-csp/files/python/script.py b/roles/sys-ctl-hlth-csp/files/python/script.py
index c79e8ddb2b..7d085e23eb 100755
--- a/roles/sys-ctl-hlth-csp/files/python/script.py
+++ b/roles/sys-ctl-hlth-csp/files/python/script.py
@@ -57,6 +57,33 @@ def is_skipped_domain(domain: str, skip_set: set[str], skip_labels: set[str]) ->
     return domain.endswith(".onion") and domain.split(".", 1)[0] in skip_labels
 
 
+def expand_accept_status(accept_status: list[str], domains: list[str]) -> list[str]:
+    """ACCEPT_STATUS plus the same codes for every ``.onion`` sibling it covers.
+
+    The checker matches accepted codes by hostname, and a clearnet vhost and
+    its onion twin share only the leftmost subdomain label, so a code declared
+    for ``mirror.<primary-domain>`` never reaches ``mirror.<host>.onion`` —
+    which serves that same by-design status and would fail the probe.
+
+    Args:
+        accept_status: ``<domain>=<code>[,<code>]`` entries as declared.
+        domains: every vhost the probe covers, clearnet and onion alike.
+    """
+    onion = [d for d in domains if d.endswith(".onion")]
+    expanded = list(accept_status)
+    for entry in accept_status:
+        host, _, codes = entry.partition("=")
+        if not codes or host.endswith(".onion"):
+            continue
+        label = host.split(".", 1)[0]
+        expanded.extend(
+            f"{sibling}={codes}"
+            for sibling in onion
+            if sibling.split(".", 1)[0] == label
+        )
+    return expanded
+
+
 def detect_scheme_from_conf(conf_path: Path) -> str | None:
     """
     Decide whether this conf listens on HTTP or HTTPS.
@@ -131,6 +158,7 @@ def build_docker_cmd(
     use_host_network: bool = True,
     proxy: str = "",
     timeout_ms: int = 0,
+    accept_status: list[str] | None = None,
 ) -> list[str]:
     cmd = ["container", "run", "--rm"]
 
@@ -155,6 +183,12 @@ def build_docker_cmd(
     if ignore_network_blocks_from:
         cmd.append("--ignore-network-blocks-from")
         cmd.extend(ignore_network_blocks_from)
+
+    if accept_status:
+        cmd.append("--accept-status")
+        cmd.extend(accept_status)
+
+    if ignore_network_blocks_from or accept_status:
         cmd.append("--")
 
     cmd.extend(urls)
@@ -170,6 +204,7 @@ def run_checker(
     use_host_network: bool = True,
     proxy: str = "",
     timeout_ms: int = 0,
+    accept_status: list[str] | None = None,
 ) -> int:
     """
     Runs the CSP checker container and returns its exit code.
@@ -186,6 +221,7 @@ def run_checker(
         use_host_network=use_host_network,
         proxy=proxy,
         timeout_ms=timeout_ms,
+        accept_status=accept_status,
     )
 
     try:
@@ -245,6 +281,17 @@ def main() -> None:
             "otherwise treat as unreachable."
         ),
     )
+    parser.add_argument(
+        "--accept-status",
+        nargs="*",
+        default=[],
+        help=(
+            "Per-vhost status codes the probe must treat as healthy, as "
+            "<domain>=<code>[,<code>]. Declared in the role's "
+            "server.status_codes; everything below 300 passes without being "
+            "listed."
+        ),
+    )
     parser.add_argument(
         "--onion-timeout",
         type=int,
@@ -290,6 +337,8 @@ def main() -> None:
                 f"--skip-domain: {skipped_present}"
             )
 
+    accept_status = expand_accept_status(list(args.accept_status or []), domains)
+
     clearnet_domains, onion_domains = split_onion_domains(domains)
     if onion_domains and not args.tor_proxy:
         print(
@@ -322,6 +371,7 @@ def main() -> None:
             use_host_network=not bool(args.no_host_network),
             proxy=batch_proxy,
             timeout_ms=batch_timeout,
+            accept_status=accept_status,
         )
         rc = rc or batch_rc
     sys.exit(rc)
diff --git a/roles/sys-ctl-hlth-csp/lookup_plugins/csp_accept_status.py b/roles/sys-ctl-hlth-csp/lookup_plugins/csp_accept_status.py
new file mode 100644
index 0000000000..56a815d8ab
--- /dev/null
+++ b/roles/sys-ctl-hlth-csp/lookup_plugins/csp_accept_status.py
@@ -0,0 +1,83 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any
+
+from ansible.plugins.loader import lookup_loader
+from ansible.plugins.lookup import LookupBase
+
+from utils.roles.applications.config import get
+from utils.roles.applications.status_codes import declared_status_codes
+
+_CHECKER_ACCEPTS_BELOW = 300
+
+
+def _domains(value: Any) -> list[str]:
+    if isinstance(value, str):
+        return [value] if value else []
+    if isinstance(value, Mapping):
+        out: list[str] = []
+        for entry in value.values():
+            out.extend(_domains(entry))
+        return out
+    if isinstance(value, (list, tuple, set)):
+        out = []
+        for entry in value:
+            out.extend(_domains(entry))
+        return out
+    return []
+
+
+class LookupModule(LookupBase):
+    """Return ``<domain>=<code>[,<code>]`` for every declared non-2xx status.
+
+    The checker treats anything outside 2xx as unreachable, so a vhost that
+    serves a 4xx by design needs its code named. Naming it keeps the page
+    under CSP inspection, which excluding the domain would not.
+
+    The declaration is per vhost: ``server.status_codes`` is keyed like
+    ``domains.canonical``, so two domains of one role can differ.
+    """
+
+    def run(
+        self,
+        terms: list[Any] | None,
+        variables: dict[str, Any] | None = None,
+        **kwargs: Any,
+    ) -> list[list[str]]:
+        applications = lookup_loader.get(
+            "applications",
+            loader=self._loader,
+            templar=getattr(self, "_templar", None),
+        ).run(
+            [],
+            variables=variables
+            or getattr(self._templar, "available_variables", {})
+            or {},
+        )[0]
+
+        if not isinstance(applications, Mapping):
+            return [[]]
+
+        accepted: dict[str, set[int]] = {}
+        for app_id in applications:
+            domains = _domains(
+                get(applications, app_id, "domains.canonical", strict=False, default=[])
+            ) + _domains(
+                get(applications, app_id, "domains.aliases", strict=False, default=[])
+            )
+            for domain in domains:
+                codes = {
+                    code
+                    for code in declared_status_codes(applications, app_id, domain)
+                    if code >= _CHECKER_ACCEPTS_BELOW
+                }
+                if codes:
+                    accepted.setdefault(domain, set()).update(codes)
+
+        return [
+            [
+                f"{domain}={','.join(str(code) for code in sorted(codes))}"
+                for domain, codes in sorted(accepted.items())
+            ]
+        ]
diff --git a/roles/sys-ctl-hlth-csp/lookup_plugins/csp_skip_domains.py b/roles/sys-ctl-hlth-csp/lookup_plugins/csp_skip_domains.py
index 08d344c073..16af34bded 100644
--- a/roles/sys-ctl-hlth-csp/lookup_plugins/csp_skip_domains.py
+++ b/roles/sys-ctl-hlth-csp/lookup_plugins/csp_skip_domains.py
@@ -32,21 +32,6 @@ def _to_list(x: Any) -> list[str]:
     return []
 
 
-def _has_code_ge_400(codes: Any) -> bool:
-    if codes is None:
-        return False
-    if not isinstance(codes, (list, tuple, set)):
-        codes = [codes]
-    for c in codes:
-        try:
-            n = int(c)
-        except (TypeError, ValueError):
-            continue
-        if n >= 400:
-            return True
-    return False
-
-
 def _selection_from(group_names: Any) -> set[str]:
     if isinstance(group_names, (list, set, tuple)):
         return {str(x) for x in group_names if str(x)}
@@ -58,11 +43,7 @@ def _selection_from(group_names: Any) -> set[str]:
 class LookupModule(LookupBase):
     """Return domains the CSP probe should skip.
 
-    Skips canonical + alias domains of every selected application whose
-    ``server.status_codes.default`` declares any HTTP code >= 400
-    (e.g. federation-only roles that legitimately serve 4xx at ``/``).
-
-    Additionally skips canonical domains owned by a disabled service: a
+    Skips canonical domains owned by a disabled service: a
     service entry may declare ``domains: [<canonical key>, ...]``; when its
     ``enabled`` resolves falsy those canonicals get no vhost (e.g. the
     seaweedfs filer/master frontend on an onion node), so probing them can
@@ -118,37 +99,7 @@ class LookupModule(LookupBase):
 
         skip: set[str] = set()
         for app_id in applications:
-            if selection and app_id not in selection:
-                continue
-
-            skip |= self._service_disabled_domains(applications, app_id)
-
-            default = get(
-                applications,
-                app_id,
-                "server.status_codes.default",
-                strict=False,
-                default=None,
-            )
-            if not _has_code_ge_400(default):
-                continue
-
-            canonical = get(
-                applications,
-                app_id,
-                "domains.canonical",
-                strict=False,
-                default=[],
-            )
-            aliases = get(
-                applications,
-                app_id,
-                "domains.aliases",
-                strict=False,
-                default=[],
-            )
-            for d in _to_list(canonical) + _to_list(aliases):
-                if d:
-                    skip.add(d)
+            if not selection or app_id in selection:
+                skip |= self._service_disabled_domains(applications, app_id)
 
         return [sorted(skip)]
diff --git a/roles/sys-ctl-hlth-csp/meta/services.yml b/roles/sys-ctl-hlth-csp/meta/services.yml
index acec2b10aa..a6e9695221 100644
--- a/roles/sys-ctl-hlth-csp/meta/services.yml
+++ b/roles/sys-ctl-hlth-csp/meta/services.yml
@@ -8,4 +8,4 @@ csp:
       categories: [web]
 csp-checker:
   image: ghcr.io/kevinveenbirkenbach/csp-checker
-  version: 2.3.0
+  version: 3.0.4
diff --git a/roles/sys-ctl-hlth-csp/tasks/00_core.yml b/roles/sys-ctl-hlth-csp/tasks/00_core.yml
index 4ca506c279..2d965b1a5c 100644
--- a/roles/sys-ctl-hlth-csp/tasks/00_core.yml
+++ b/roles/sys-ctl-hlth-csp/tasks/00_core.yml
@@ -60,6 +60,10 @@
             '--skip-domain ' ~ (HEALTH_CSP_SKIP_DOMAINS | join(' ')),
             ''
           ),
+          (HEALTH_CSP_ACCEPT_STATUS | length > 0) | ternary(
+            '--accept-status ' ~ (HEALTH_CSP_ACCEPT_STATUS | join(' ')),
+            ''
+          ),
           (lookup('config', 'svc-net-tor', 'services.tor.node', '') | length > 0) | ternary(
             '--tor-proxy=socks5://' ~ lookup('tor_socks')
             ~ ' --onion-timeout=' ~ HEALTH_CSP_ONION_TIMEOUT_MS,
diff --git a/roles/sys-ctl-hlth-csp/vars/main.yml b/roles/sys-ctl-hlth-csp/vars/main.yml
index 61cad831c2..ea8d4a0ce0 100644
--- a/roles/sys-ctl-hlth-csp/vars/main.yml
+++ b/roles/sys-ctl-hlth-csp/vars/main.yml
@@ -3,6 +3,7 @@ system_service_id: sys-ctl-hlth-csp
 HEALTH_CSP_ONION_TIMEOUT_MS: "{{ (HEALTH_CSP_TIMEOUT_MS | int) * (lookup('config', 'svc-net-tor', 'services.tor.timeout_multipliers')[lookup('config', 'svc-net-tor',
   'services.tor.flavor')] | int) }}"
 HEALTH_CSP_ONION_DOMAIN_SECONDS: "{{ ((HEALTH_CSP_ONION_TIMEOUT_MS | int) // 1000) + (HEALTH_CSP_DOMAIN_RESERVE_SECONDS | int) }}"
+HEALTH_CSP_ACCEPT_STATUS: "{{ lookup('csp_accept_status') }}"
 HEALTH_CSP_SKIP_DOMAINS: >-
   {{ (
        lookup('csp_skip_domains', group_names=lookup('deployment').deployed)
diff --git a/roles/sys-pip-install/tasks/00_core.yml b/roles/sys-pip-install/tasks/00_core.yml
index 65dd4be738..7c25a2fc10 100644
--- a/roles/sys-pip-install/tasks/00_core.yml
+++ b/roles/sys-pip-install/tasks/00_core.yml
@@ -5,3 +5,69 @@
   when: run_once_sys_pip is not defined
 
 - include_tasks: utils/once/flag.yml
+
+- name: 🔍 Resolve active Python executable for sys-pip-install
+  ansible.builtin.set_fact:
+    sys_pip_install_python_executable: "{{ ansible_python_interpreter }}"
+  changed_when: false
+
+- block:
+    - name: 🔍 Probe pip for ansible_python_interpreter accepts --break-system-packages
+      ansible.builtin.command:
+        argv:
+          - "{{ sys_pip_install_python_executable }}"
+          - -m
+          - pip
+          - install
+          - --break-system-packages
+          - --help
+      register: sys_pip_install_break_system_packages_probe
+      changed_when: false
+      failed_when: false
+      become: "{{ true if global_install | bool else false }}"
+
+    - name: 🔧 Set fact for --break-system-packages support
+      ansible.builtin.set_fact:
+        sys_pip_install_supports_break_system_packages: "{{ (sys_pip_install_break_system_packages_probe.rc | int) == 0 }}"
+      changed_when: false
+
+  when: global_install | bool
+
+- name: 🔎 Check whether selected Python interpreter has 'packaging'
+  ansible.builtin.command:
+    argv:
+      - "{{ sys_pip_install_python_executable }}"
+      - -I
+      - -c
+      - import packaging
+  register: sys_pip_install_python_packaging_check
+  changed_when: false
+  failed_when: false
+
+- name: 🥾 Bootstrap 'packaging' for selected Python interpreter
+  ansible.builtin.command:
+    argv: >-
+      {{
+        [sys_pip_install_python_executable, '-m', 'pip', 'install', '--upgrade', 'packaging']
+        + (
+            ['--break-system-packages']
+            if (global_install | bool and sys_pip_install_supports_break_system_packages | default(false) | bool)
+            else []
+          )
+      }}
+  environment: >-
+    {{
+      (
+        {'PIP_BREAK_SYSTEM_PACKAGES': '1'}
+        if sys_pip_install_supports_break_system_packages | default(false) | bool
+        else {}
+      )
+      if global_install | bool
+      else omit
+    }}
+  become: "{{ true if global_install | bool else false }}"
+  register: sys_pip_install_packaging_bootstrap
+  retries: 5
+  delay: 15
+  until: sys_pip_install_packaging_bootstrap is succeeded
+  when: sys_pip_install_python_packaging_check.rc != 0
diff --git a/roles/sys-pip-install/tasks/main.yml b/roles/sys-pip-install/tasks/main.yml
index 0709680650..415eae462e 100644
--- a/roles/sys-pip-install/tasks/main.yml
+++ b/roles/sys-pip-install/tasks/main.yml
@@ -4,55 +4,12 @@
 - include_tasks: 00_core.yml
   when: run_once_sys_pip_install is not defined
 
-- name: 🔍 Resolve active Python executable for sys-pip-install
-  ansible.builtin.set_fact:
-    sys_pip_install_python_executable: "{{ ansible_python_interpreter }}"
-  changed_when: false
-
-- block:
-    - name: 🔍 Probe pip for ansible_python_interpreter accepts --break-system-packages
-      ansible.builtin.command:
-        argv:
-          - "{{ sys_pip_install_python_executable }}"
-          - -m
-          - pip
-          - install
-          - --break-system-packages
-          - --help
-      register: sys_pip_install_break_system_packages_probe
-      changed_when: false
-      failed_when: false
-      become: "{{ true if global_install | bool else false }}"
-
-    - name: 🔧 Set fact for --break-system-packages support
-      ansible.builtin.set_fact:
-        sys_pip_install_supports_break_system_packages: "{{ (sys_pip_install_break_system_packages_probe.rc | int) == 0 }}"
-      changed_when: false
-
-  when: global_install | bool
-
-- name: 🔎 Check whether selected Python interpreter has 'packaging'
-  ansible.builtin.command:
-    argv:
-      - "{{ sys_pip_install_python_executable }}"
-      - -I
-      - -c
-      - import packaging
-  register: sys_pip_install_python_packaging_check
-  changed_when: false
-  failed_when: false
-
-- name: 🥾 Bootstrap 'packaging' for selected Python interpreter
-  ansible.builtin.command:
-    argv: >-
-      {{
-        [sys_pip_install_python_executable, '-m', 'pip', 'install', '--upgrade', 'packaging']
-        + (
-            ['--break-system-packages']
-            if (global_install | bool and sys_pip_install_supports_break_system_packages | default(false) | bool)
-            else []
-          )
-      }}
+- name: 📦 Install or upgrade {{ package_name }} system-wide via pip
+  ansible.builtin.pip:
+    name: "{{ package_name }}"
+    state: "{{ package_state }}"
+    extra_args: "{{ '--break-system-packages' if (global_install | bool and sys_pip_install_supports_break_system_packages | default(false) | bool) else omit }}"
+    virtualenv: "{{ omit if global_install | bool else (sys_pip_install_python_executable | dirname | dirname) }}"
   environment: >-
     {{
       (
@@ -64,29 +21,6 @@
       else omit
     }}
   become: "{{ true if global_install | bool else false }}"
-  register: sys_pip_install_packaging_bootstrap
-  retries: 5
-  delay: 15
-  until: sys_pip_install_packaging_bootstrap is succeeded
-  when: sys_pip_install_python_packaging_check.rc != 0
-
-- name: 📦 Install or upgrade {{ package_name }} system-wide via pip
-  ansible.builtin.pip:
-    name: "{{ package_name }}"
-    state: "{{ package_state }}"
-    extra_args: "{{ '--break-system-packages' if (global_install | bool and sys_pip_install_supports_break_system_packages | bool) else omit }}"
-    virtualenv: "{{ omit if global_install | bool else (sys_pip_install_python_executable | dirname | dirname) }}"
-  environment: >-
-    {{
-      (
-        {'PIP_BREAK_SYSTEM_PACKAGES': '1'}
-        if sys_pip_install_supports_break_system_packages | bool
-        else {}
-      )
-      if global_install | bool
-      else omit
-    }}
-  become: "{{ true if global_install | bool else false }}"
   register: sys_pip_install_result
   retries: 5
   delay: 15
diff --git a/roles/sys-service/handlers/refresh_systemctl_service.yml b/roles/sys-service/handlers/refresh_systemctl_service.yml
index 879a7dd6e9..ac19505e55 100644
--- a/roles/sys-service/handlers/refresh_systemctl_service.yml
+++ b/roles/sys-service/handlers/refresh_systemctl_service.yml
@@ -2,9 +2,10 @@
 - name: "🔧 Enable systemctl service"
   systemd:
     name: "{{ system_service_name }}"
+    scope: "{{ system_service_scope }}"
     enabled: true
     daemon_reload: true
-  become: true
+  become: "{{ system_service_unit_become }}"
   # rationale: async; opt-out per caller, a role that reads the unit state sets system_service_force_linear_sync
   async: "{{ system_service_async }}"
   poll: "{{ system_service_poll }}"
@@ -12,8 +13,9 @@
 - name: "🔧 Set systemctl service state"
   systemd:
     name: "{{ system_service_name }}"
+    scope: "{{ system_service_scope }}"
     state: "{{ system_service_state }}"
-  become: true
+  become: "{{ system_service_unit_become }}"
   # rationale: async; the Result gate below only runs meaningfully for callers that set system_service_force_linear_sync
   async: "{{ system_service_async }}"
   poll: "{{ system_service_poll }}"
@@ -23,28 +25,14 @@
 
 - name: 🔍 sys-service | Read unit Result (oneshot-safe)
   ansible.builtin.command:
-    argv:
-      - systemctl
-      - --no-pager
-      - show
-      - -p
-      - Result
-      - --value
-      - "{{ system_service_name }}"
+    argv: "{{ system_service_systemctl_show + ['Result', system_service_name] }}"
   register: system_service_result
   changed_when: false
   failed_when: false
 
 - name: 🔍 sys-service | Read unit ExecMainStatus (oneshot-safe)
   ansible.builtin.command:
-    argv:
-      - systemctl
-      - --no-pager
-      - show
-      - -p
-      - ExecMainStatus
-      - --value
-      - "{{ system_service_name }}"
+    argv: "{{ system_service_systemctl_show + ['ExecMainStatus', system_service_name] }}"
   register: system_service_exec_status
   changed_when: false
   failed_when: false
diff --git a/roles/sys-service/tasks/06_service.yml b/roles/sys-service/tasks/06_service.yml
index 639c21ba32..a89a63ad6d 100644
--- a/roles/sys-service/tasks/06_service.yml
+++ b/roles/sys-service/tasks/06_service.yml
@@ -28,10 +28,11 @@
 - name: "🔧 setup systemctl '{{ system_service_id }}'"
   template: # nocheck: stack-host-template (per-host systemd service unit)
     src: "{{ system_service_template_src }}"
-    dest: "{{ [ DIR_SYSTEM_SERVICE, system_service_name ] | path_join }}"
-    owner: root
-    group: root
+    dest: "{{ [ system_service_unit_dir, system_service_name ] | path_join }}"
+    owner: "{{ system_service_unit_owner }}"
+    group: "{{ system_service_unit_owner }}"
     mode: "0644"
+  become: "{{ system_service_unit_become }}"
   notify: "{{ 'reload-system-daemon' if system_service_is_template | bool else 'refresh-systemctl-service' }}"
 
 - name: 🔄 refresh systemctl service when SYS_SERVICE_ALL_ENABLE
diff --git a/roles/sys-service/tasks/07_timer.yml b/roles/sys-service/tasks/07_timer.yml
index 1701ebaaf3..4814d6ad92 100644
--- a/roles/sys-service/tasks/07_timer.yml
+++ b/roles/sys-service/tasks/07_timer.yml
@@ -1,4 +1,14 @@
 ---
+- name: 🛑 Fail if a timer is asked for outside the system scope
+  assert:
+    that:
+      - system_service_scope == 'system'
+    fail_msg: >-
+      '{{ system_service_id }}' asks for a timer in the '{{ system_service_scope }}'
+      scope, but sys-timer writes into {{ DIR_SYSTEM_SERVICE }} and drives the unit
+      in the system scope, so the timer would look for a service that only exists
+      for the user.
+
 - name: 🛑 Fail if system_service_id contains "@"
   assert:
     that:
diff --git a/roles/sys-service/tasks/main.yml b/roles/sys-service/tasks/main.yml
index ff13725fc0..c759025647 100644
--- a/roles/sys-service/tasks/main.yml
+++ b/roles/sys-service/tasks/main.yml
@@ -6,7 +6,9 @@
   when: run_once_sys_service is defined
 
 - include_tasks: 00_core.yml
-  when: run_once_sys_service is not defined
+  when:
+    - run_once_sys_service is not defined
+    - system_service_scope == 'system'
 
 - name: "▶️ Execute service routines for '{{ system_service_id }}'"
   block:
diff --git a/roles/sys-service/templates/systemctl.service.j2 b/roles/sys-service/templates/systemctl.service.j2
index 4ec2bcb6b8..5f9a7dd7d1 100644
--- a/roles/sys-service/templates/systemctl.service.j2
+++ b/roles/sys-service/templates/systemctl.service.j2
@@ -1,6 +1,16 @@
 [Unit]
 Description={{ SOFTWARE_NAME }} - Service for role '{{ system_service_id }}'
-{{ system_service_tpl_on_failure | systemd_directive('OnFailure') }}
+{% for key, val in [
+  ('OnFailure', system_service_tpl_on_failure),
+  ('After',     system_service_tpl_after),
+  ('Before',    system_service_tpl_before),
+  ('Wants',     system_service_tpl_wants),
+] %}
+{% set directive = val | systemd_directive(key) %}
+{% if directive %}
+{{ directive }}
+{% endif %}
+{% endfor %}
 StartLimitIntervalSec=60
 StartLimitBurst=3
 OnFailureJobMode=replace-irreversibly
@@ -10,13 +20,21 @@ Type={{ system_service_tpl_type }}
 {% for _environment in system_service_tpl_environment %}
 Environment={{ _environment }}
 {% endfor %}
-
 {% for key, val in [
+  ('RemainAfterExit', system_service_tpl_remain_after_exit),
   ('TimeoutStartSec', system_service_tpl_timeout_start_sec),
   ('ExecStartPre',    system_service_tpl_exec_start_pre),
   ('ExecStart',       system_service_tpl_exec_start),
   ('ExecStartPost',   system_service_tpl_exec_start_post),
   ('RuntimeMaxSec',   system_service_tpl_runtime),
 ] %}
-{{ val | systemd_directive(key) }}
+{% set directive = val | systemd_directive(key) %}
+{% if directive %}
+{{ directive }}
+{% endif %}
 {% endfor %}
+{% if system_service_tpl_wanted_by | length > 0 %}
+
+[Install]
+WantedBy={{ system_service_tpl_wanted_by }}
+{% endif %}
diff --git a/roles/sys-service/vars/main.yml b/roles/sys-service/vars/main.yml
index 2a91e808bf..24b8e3fae9 100644
--- a/roles/sys-service/vars/main.yml
+++ b/roles/sys-service/vars/main.yml
@@ -4,6 +4,12 @@ UNIT_SUFFIX_REMOVER_PACKAGE: "unsure"
 system_service_name: "{{ lookup('unit_name', system_service_id) }}"
 system_service_is_template: "{{ system_service_id.endswith('@') }}"
 
+system_service_scope: "system" # 'system' for root units, 'user' for per-login units
+system_service_unit_dir: "{{ DIR_SYSTEM_SERVICE if system_service_scope == 'system' else DIR_SYSTEM_SERVICE_USER }}"
+system_service_unit_owner: "{{ 'root' if system_service_scope == 'system' else omit }}"
+system_service_unit_become: "{{ system_service_scope == 'system' }}"
+system_service_systemctl_show: "{{ ['systemctl'] + (['--user'] if system_service_scope == 'user' else []) + ['--no-pager', 'show', '--value', '-p'] }}"
+
 system_service_role_name: "{{ system_service_id | regex_replace('@','') }}"
 system_service_role_dir: "{{ lookup('path_absolute', 'roles', system_service_role_name) }}"
 system_service_script_dir: "{{ [ DIR_SCRIPTS_SYSTEMCTL, system_service_id ] | path_join }}"
@@ -25,7 +31,12 @@ system_service_script_inter: "{{ '/bin/bash' if system_service_script_type == 's
 system_service_script_exec: "{{ system_service_script_inter }} {{ system_service_id | get_service_script_path( system_service_script_type ) }}"
 
 system_service_tpl_on_failure: "{{ SYS_SERVICE_ON_FAILURE_COMPOSE }}"
+system_service_tpl_after: ""
+system_service_tpl_before: ""
+system_service_tpl_wants: ""
 system_service_tpl_type: "oneshot"
+system_service_tpl_remain_after_exit: ""
+system_service_tpl_wanted_by: "" # Empty installs no [Install] section, which leaves the unit static
 system_service_tpl_environment: [] # Environment variables
 system_service_tpl_runtime: "{{ '' if system_service_tpl_type == 'oneshot' else SYS_SERVICE_DEFAULT_RUNTIME }}"
 system_service_tpl_exec_start_pre: ""
diff --git a/roles/sys-svc-compose/tasks/00_core.yml b/roles/sys-svc-compose/tasks/00_core.yml
index c0d631675f..9e53702465 100644
--- a/roles/sys-svc-compose/tasks/00_core.yml
+++ b/roles/sys-svc-compose/tasks/00_core.yml
@@ -44,3 +44,11 @@
     mode: "0755"
     owner: root
     group: root
+
+- name: "🛡️ Assert the NFS client mount is active on this swarm node"
+  ansible.builtin.command: "mountpoint -q {{ DIR_VAR_LIB }}"
+  changed_when: false
+  when:
+    - DEPLOYMENT_MODE == 'swarm'
+    - (storage.backend | default('local')) == 'nfs'
+    - (groups['svc-storage-nfs-server'] | default([])) | length > 0
diff --git a/roles/sys-svc-compose/tasks/utils/nfs_prep.yml b/roles/sys-svc-compose/tasks/utils/nfs_prep.yml
index f22615d86d..f7f528da7b 100644
--- a/roles/sys-svc-compose/tasks/utils/nfs_prep.yml
+++ b/roles/sys-svc-compose/tasks/utils/nfs_prep.yml
@@ -19,19 +19,6 @@
     - item.value.driver_opts is defined
     - application_id not in lookup('roles_with_placement', 'manager')
 
-- name: "🛡️ Assert the NFS client mount is active on every swarm node"
-  ansible.builtin.command: "mountpoint -q {{ DIR_VAR_LIB }}"
-  changed_when: false
-  delegate_to: "{{ item }}"
-  run_once: true
-  loop: "{{ groups['svc-swarm-node'] | default([]) }}"
-  when:
-    - DEPLOYMENT_MODE == 'swarm'
-    - (storage.backend | default('local')) == 'nfs'
-    - (groups['svc-storage-nfs-server'] | default([])) | length > 0
-    - (lookup('compose_volumes') | from_yaml).volumes | default({}) | length > 0
-    - application_id not in lookup('roles_with_placement', 'manager')
-
 - name: "🔁 Materialize NFS subdirs for '{{ application_id }}' on every swarm node"
   ansible.builtin.file:
     path: "{{ DIR_VAR_LIB }}/{{ item.0.value.name | default(item.0.key) }}"
diff --git a/roles/test-e2e-cli/tasks/main.yml b/roles/test-e2e-cli/tasks/main.yml
index 78e2190aea..cfb3092bf3 100644
--- a/roles/test-e2e-cli/tasks/main.yml
+++ b/roles/test-e2e-cli/tasks/main.yml
@@ -44,7 +44,7 @@
       ansible.builtin.include_tasks: run_one.yml
       loop: "{{ _cli_apps }}"
       loop_control:
-        loop_var: application_id
+        loop_var: application_id # nocheck: loop-var-shadow  the item IS the role id, so run_one reads the same value the tested role declares
         label: "{{ application_id }}"
 
     - name: ✅ Fail if there were CLI test failures
diff --git a/roles/test-e2e-playwright/tasks/01_setup/orchestrate.yml b/roles/test-e2e-playwright/tasks/01_setup/orchestrate.yml
index 0a0db3cd4b..9580f19f34 100644
--- a/roles/test-e2e-playwright/tasks/01_setup/orchestrate.yml
+++ b/roles/test-e2e-playwright/tasks/01_setup/orchestrate.yml
@@ -18,7 +18,7 @@
   ansible.builtin.include_tasks: 02_run_one.yml
   loop: "{{ TEST_E2E_PLAYWRIGHT_APPS }}"
   loop_control:
-    loop_var: application_id
+    loop_var: application_id # nocheck: loop-var-shadow  the item IS the role id, so 02_run_one reads the same value the tested role's own vars declare
     label: "{{ application_id }}"
 
 - name: 🔁 Stash first-pass failures for one flake retry
@@ -31,7 +31,7 @@
   ansible.builtin.include_tasks: 02_run_one.yml
   loop: "{{ _playwright_retry_roles | default([]) }}"
   loop_control:
-    loop_var: application_id
+    loop_var: application_id # nocheck: loop-var-shadow  same loop body, same identity between item and role id
     label: "{{ application_id }} (retry)"
 
 - name: 🛑 Fail if there were Playwright failures
diff --git a/roles/user-backup/templates/ssh-wrapper.sh.j2 b/roles/user-backup/templates/ssh-wrapper.sh.j2
index fdffae7363..86e03d9763 100644
--- a/roles/user-backup/templates/ssh-wrapper.sh.j2
+++ b/roles/user-backup/templates/ssh-wrapper.sh.j2
@@ -1,9 +1,10 @@
 #!/bin/sh
+{# nocheck: shell-template  grandfathered, values only: the backup directory and the repository list #}
 
 # log command
 if [ -n "$SSH_ORIGINAL_COMMAND" ]
 then
-  echo "`/bin/date`: $SSH_ORIGINAL_COMMAND" | systemd-cat -t "ssh-wrapper.sh"
+  echo "$(/bin/date): $SSH_ORIGINAL_COMMAND" | systemd-cat -t "ssh-wrapper.sh"
 fi
 
 get_hashed_machine_id="sha256sum /etc/machine-id";
diff --git a/roles/web-app-baserow/meta/services.yml b/roles/web-app-baserow/meta/services.yml
index 36be76d639..af5c21390b 100644
--- a/roles/web-app-baserow/meta/services.yml
+++ b/roles/web-app-baserow/meta/services.yml
@@ -66,7 +66,7 @@ baserow:
   backup:
     no_stop_required: true
   image: baserow/baserow
-  version: 2.3.3
+  version: 2.3.4
   custom: true
   name: baserow
   min_storage: 785MB
diff --git a/roles/web-app-bigbluebutton/meta/services.yml b/roles/web-app-bigbluebutton/meta/services.yml
index b2985248f6..85af312fbb 100644
--- a/roles/web-app-bigbluebutton/meta/services.yml
+++ b/roles/web-app-bigbluebutton/meta/services.yml
@@ -194,8 +194,8 @@ bbb-webrtc-recorder:
 # nocheck: playwright-service-flag: script-time helper of upstream generate-compose, mirror pre-pull only
 # nocheck: dynamic-flag: fixed upstream-compose helper, not group-gated
 dockerize:
-  image: jwilder/dockerize
-  version: "latest"
+  image: ghcr.io/jwilder/dockerize
+  version: "v0.15.1"
   enabled: false
 
 # nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer
diff --git a/roles/web-app-bigbluebutton/templates/compose.override.yml.j2 b/roles/web-app-bigbluebutton/templates/compose.override.yml.j2
index 58c4a51d5e..70439e95fa 100644
--- a/roles/web-app-bigbluebutton/templates/compose.override.yml.j2
+++ b/roles/web-app-bigbluebutton/templates/compose.override.yml.j2
@@ -90,12 +90,12 @@ services:
 {% set service_name = 'coturn' %}
   {{ service_name }}:
     {{ lookup('container_volumes', service_name) | indent(4) }}
-    ports:
-      - "{{ BBB_TURN_PORT }}:{{ BBB_TURN_PORT }}/udp"
-      - "{{ BBB_TURN_PORT }}:{{ BBB_TURN_PORT }}/tcp"
-      - "{{ BBB_STUN_PORT }}:{{ BBB_STUN_PORT }}/udp"
-      - "{{ BBB_STUN_PORT }}:{{ BBB_STUN_PORT }}/tcp"
-      - "{{ BBB_RELAY_PORT_RANGE }}/udp"
+    {{ lookup('container_ports',
+              {'service': 'bigbluebutton', 'protocol': 'stun_turn',
+               'transport': ['udp', 'tcp'], 'container': 'same'},
+              {'service': 'bigbluebutton', 'protocol': 'relay',
+               'transport': 'udp', 'container': 'same',
+               'publish': 'ephemeral'}) | indent(4) }}
     command: >-
       --use-auth-secret
       --static-auth-secret=${TURN_SECRET}
diff --git a/roles/web-app-bigbluebutton/vars/main.yml b/roles/web-app-bigbluebutton/vars/main.yml
index 359128cfe8..b7eafd9df5 100644
--- a/roles/web-app-bigbluebutton/vars/main.yml
+++ b/roles/web-app-bigbluebutton/vars/main.yml
@@ -33,7 +33,6 @@ BBB_STUN_PORT: "{{ lookup('config', application_id, 'services.bigbluebutton.port
   'services.coturn.ports.public.stun_turn_tls') }}"
 BBB_RELAY_PORT_START: "{{ lookup('config', application_id, 'services.bigbluebutton.ports.public.relay.start') }}"
 BBB_RELAY_PORT_END: "{{ lookup('config', application_id, 'services.bigbluebutton.ports.public.relay.end') }}"
-BBB_RELAY_PORT_RANGE: "{{ BBB_RELAY_PORT_START }}-{{ BBB_RELAY_PORT_END }}"
 
 BBB_COLLABORA_ENABLED: "{{ not (lookup('config',application_id, 'services.collabora.shared')) }}"
 BBB_COLLABORA_PORT: "{{ lookup('config', 'web-svc-collabora', 'services.collabora.ports.internal.http') }}"
diff --git a/roles/web-app-bookwyrm/meta/services.yml b/roles/web-app-bookwyrm/meta/services.yml
index 3bd70141b8..6bd6c005ea 100644
--- a/roles/web-app-bookwyrm/meta/services.yml
+++ b/roles/web-app-bookwyrm/meta/services.yml
@@ -59,7 +59,7 @@ bookwyrm:
   image: python
   # TODO: bump when upstream Bookwyrm declares support for Python >= 3.12 in requirements.txt
   # nocheck: docker-version
-  version: 3.11-bookworm
+  version: 3.11-slim
   custom: true
   repository: https://github.com/bookwyrm-social/bookwyrm.git
   ref: v0.9.3
diff --git a/roles/web-app-bridgy-fed/files/Dockerfile b/roles/web-app-bridgy-fed/files/Dockerfile
index 91f07076a6..2446818fdc 100644
--- a/roles/web-app-bridgy-fed/files/Dockerfile
+++ b/roles/web-app-bridgy-fed/files/Dockerfile
@@ -18,7 +18,7 @@ ARG BRIDGY_REF
 
 RUN rm -rf /var/lib/apt/lists/* && \
     apt-get -o Acquire::Retries=3 update && apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
-    git build-essential curl ca-certificates && \
+    git build-essential pkg-config autoconf automake libtool curl ca-certificates && \
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
diff --git a/roles/web-app-bridgy-fed/meta/services.yml b/roles/web-app-bridgy-fed/meta/services.yml
index 41b3d862d3..1678d4b203 100644
--- a/roles/web-app-bridgy-fed/meta/services.yml
+++ b/roles/web-app-bridgy-fed/meta/services.yml
@@ -47,7 +47,7 @@ bridgy-fed:
     swarm:
       enabled: true
   image: python
-  version: 3.14-bookworm
+  version: 3.14-slim
   name: web-app-bridgy-fed
   repository: https://github.com/snarfed/bridgy-fed.git
   # nocheck: repository-version -- upstream publishes no tags, so the pin is a commit
diff --git a/roles/web-app-checkmk/meta/services.yml b/roles/web-app-checkmk/meta/services.yml
index 16a28d1907..ab52dec53c 100644
--- a/roles/web-app-checkmk/meta/services.yml
+++ b/roles/web-app-checkmk/meta/services.yml
@@ -83,6 +83,9 @@ checkmk:
       http: 8087
       sso: 16509
       agent: 8500
+    onion:
+      # nocheck: onion-flag  the monitoring server dials its agents, so nothing connects inward here, and the agent speaks no authentication of its own
+      agent: false
   run_after:
     - web-app-keycloak
     - svc-db-openldap
diff --git a/roles/web-app-dashboard/templates/compose.yml.j2 b/roles/web-app-dashboard/templates/compose.yml.j2
index fe3ae4bc30..619e8c6420 100644
--- a/roles/web-app-dashboard/templates/compose.yml.j2
+++ b/roles/web-app-dashboard/templates/compose.yml.j2
@@ -1,12 +1,10 @@
 {% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
   {% set service_name = 'dashboard' %}
-  {% set container_port = lookup('config', application_id, 'services.' ~ service_name ~ '.ports.internal.http') %}
   {{ service_name }}:
     {% include 'roles/sys-svc-container/templates/deploy.yml.j2' %}
     {{ lookup('container_image', application_id, 'dashboard') }}
     {{ lookup('compose_only', 'container_name', DASHBOARD_CONTAINER) }}
-    ports:
-      - {{ DOCKER_BIND_HOST }}:{{ http_port }}:{{ container_port }}
+    {{ lookup('container_ports', ['dashboard', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_volumes', service_name) | indent(4) }}
     {{ lookup('compose_restart') }}
     {{ lookup('container_networks') | indent(4) }}
diff --git a/roles/web-app-dashboard/templates/javascript/oidc.js.j2 b/roles/web-app-dashboard/templates/javascript/oidc.js.j2
index 2d641ae521..52b28a94a4 100644
--- a/roles/web-app-dashboard/templates/javascript/oidc.js.j2
+++ b/roles/web-app-dashboard/templates/javascript/oidc.js.j2
@@ -8,7 +8,7 @@
    1) Configuration (filled by Jinja/Ansible)
    ======================= */
 const KC_CONFIG = {
-  url: "{{ OIDC.URL }}",                 // e.g. https://auth.infinito.nexus
+  url: "{{ OIDC.URL }}",                 // e.g. https://auth.{{ SOFTWARE_DOMAIN }}
   realm: "{{ OIDC.CLIENT.REALM }}",      // e.g. cymais.cloud
   clientId: "{{ OIDC.CLIENT.ID }}",      // e.g. cymais.cloud
   redirectUri: "{{ DASHBOARD_APP_BASE_URL }}",   // canonical app URL for login/logout round-trips
diff --git a/roles/web-app-discourse/files/ruby/apply_settings.rb b/roles/web-app-discourse/files/ruby/apply_settings.rb
new file mode 100644
index 0000000000..6c212121f5
--- /dev/null
+++ b/roles/web-app-discourse/files/ruby/apply_settings.rb
@@ -0,0 +1,35 @@
+# nocheck: mirrored-unit-test - runs in the Discourse console against SiteSetting and
+# Discourse.cache; both only exist once the application has booted
+
+require "json"
+
+SiteSetting.force_https = ENV.fetch("DISCOURSE_FORCE_HTTPS") == "true"
+SiteSetting.enable_local_logins = ENV.fetch("DISCOURSE_LOCAL_LOGINS") == "true"
+
+JSON.parse(ENV.fetch("DISCOURSE_LDAP_SITE_SETTINGS")).each do |key, value|
+  SiteSetting.public_send("#{key}=", value)
+end
+
+if ENV.fetch("DISCOURSE_OIDC_ENABLED") == "true"
+  SiteSetting.openid_connect_verbose_logging = ENV.fetch("DISCOURSE_OIDC_VERBOSE") == "true"
+  SiteSetting.enable_passkeys = false
+  SiteSetting.username_change_period = 0
+
+  SiteSetting.openid_connect_discovery_document = ENV.fetch("DISCOURSE_OIDC_DISCOVERY_DOCUMENT")
+  SiteSetting.openid_connect_client_id = ENV.fetch("DISCOURSE_OIDC_CLIENT_ID")
+  SiteSetting.openid_connect_client_secret = ENV.fetch("DISCOURSE_OIDC_CLIENT_SECRET")
+  SiteSetting.openid_connect_enabled = true
+  SiteSetting.openid_connect_rp_initiated_logout_redirect = ENV.fetch("DISCOURSE_OIDC_LOGOUT_REDIRECT")
+  SiteSetting.openid_connect_allow_association_change = false
+  SiteSetting.openid_connect_rp_initiated_logout = true
+
+  url = SiteSetting.openid_connect_discovery_document.to_s.strip
+  host = url.sub(%r{\Ahttps?://}i, "").split("/").first.to_s.strip.split(":").first.to_s.strip
+  list = SiteSetting.allowed_internal_hosts.to_s.split("|").map(&:strip).reject(&:empty?)
+  if !host.empty? && host =~ /\A[a-z0-9.-]+\z/i && !list.include?(host)
+    list << host
+    SiteSetting.allowed_internal_hosts = list.join("|")
+  end
+
+  Discourse.cache.delete("openid-connect-discovery-#{url}")
+end
diff --git a/roles/web-app-discourse/files/ruby/ensure_admin_user.rb b/roles/web-app-discourse/files/ruby/ensure_admin_user.rb
new file mode 100644
index 0000000000..15bb55151e
--- /dev/null
+++ b/roles/web-app-discourse/files/ruby/ensure_admin_user.rb
@@ -0,0 +1,17 @@
+# nocheck: mirrored-unit-test - runs in the Discourse console against User and its
+# password validators; the models only exist once the application has booted
+
+email = ENV.fetch("DISCOURSE_ADMIN_EMAIL")
+username = ENV.fetch("DISCOURSE_ADMIN_USERNAME")
+password = ENV.fetch("DISCOURSE_ADMIN_PASSWORD")
+
+user = User.find_by_email(email) || User.new(email: email)
+user.username = username
+user.password = password unless user.confirm_password?(password)
+user.active = true
+user.save!
+
+user.grant_admin!
+user.change_trust_level!(1) if user.trust_level < 1
+user.email_tokens.update_all(confirmed: true)
+user.activate
diff --git a/roles/web-app-discourse/files/ruby/verify_settings.rb b/roles/web-app-discourse/files/ruby/verify_settings.rb
new file mode 100644
index 0000000000..202ab7300a
--- /dev/null
+++ b/roles/web-app-discourse/files/ruby/verify_settings.rb
@@ -0,0 +1,17 @@
+# nocheck: mirrored-unit-test - reads SiteSetting and User out of the booted
+# application, neither of which exists outside the Discourse console
+
+email = ENV.fetch("DISCOURSE_ADMIN_EMAIL")
+password = ENV.fetch("DISCOURSE_ADMIN_PASSWORD")
+
+user = User.find_by_email(email)
+puts "administrator_present=#{!user.nil?}"
+puts "administrator_admin=#{user&.admin == true}"
+puts "administrator_active=#{user&.active == true}"
+puts "administrator_password_matches=#{user&.confirm_password?(password) == true}"
+
+if ENV.fetch("DISCOURSE_OIDC_ENABLED") == "true"
+  puts "oidc_secret_matches=#{SiteSetting.openid_connect_client_secret == ENV.fetch('DISCOURSE_OIDC_CLIENT_SECRET')}"
+  puts "oidc_enabled=#{SiteSetting.openid_connect_enabled == true}"
+  puts "oidc_host_allowed=#{SiteSetting.allowed_internal_hosts.to_s.split('|').any? { |h| SiteSetting.openid_connect_discovery_document.to_s.include?(h.strip) }}"
+end
diff --git a/roles/web-app-discourse/handlers/main.yml b/roles/web-app-discourse/handlers/main.yml
index 524a11676f..94708c8d57 100644
--- a/roles/web-app-discourse/handlers/main.yml
+++ b/roles/web-app-discourse/handlers/main.yml
@@ -1,5 +1,21 @@
 ---
+- name: "🔨 Bootstrap the stack host image"
+  include_tasks: stack_host.yml
+  vars:
+    DISCOURSE_LAUNCHER_ACTION: rebuild
+  when: IS_STACK_HOST | bool
+  listen: rebuild-discourse
+
+- name: "📝 Record that the bootstrap already recreated the container"
+  ansible.builtin.set_fact:
+    DISCOURSE_REBUILT: true
+  listen: rebuild-discourse
+
 - name: "🖥️ Handle stack host"
   include_tasks: stack_host.yml
-  when: IS_STACK_HOST | bool
+  vars:
+    DISCOURSE_LAUNCHER_ACTION: start
+  when:
+    - IS_STACK_HOST | bool
+    - not DISCOURSE_REBUILT | bool
   listen: recreate-discourse
diff --git a/roles/web-app-discourse/handlers/stack_host.yml b/roles/web-app-discourse/handlers/stack_host.yml
index 067ad6ac64..e6b013829d 100644
--- a/roles/web-app-discourse/handlers/stack_host.yml
+++ b/roles/web-app-discourse/handlers/stack_host.yml
@@ -25,9 +25,9 @@
     - DISCOURSE_DATABASE_IS_SHARED | bool
     - DEPLOYMENT_MODE == 'compose'
 
-- name: 🔨 rebuild discourse
+- name: "🔨 {{ DISCOURSE_LAUNCHER_ACTION }} discourse"
   shell: >
-    ./launcher rebuild {{ DISCOURSE_CONTAINER }}
+    ./launcher {{ DISCOURSE_LAUNCHER_ACTION }} {{ DISCOURSE_CONTAINER }}
     {% if DOCKER_IN_CONTAINER | bool %}--skip-prereqs{% endif %}
   args:
     executable: /bin/bash
diff --git a/roles/web-app-discourse/meta/addons/discourse-activity-pub.yml b/roles/web-app-discourse/meta/addons/discourse-activity-pub.yml
index c7dca961bf..05bcb24e16 100644
--- a/roles/web-app-discourse/meta/addons/discourse-activity-pub.yml
+++ b/roles/web-app-discourse/meta/addons/discourse-activity-pub.yml
@@ -1,6 +1,13 @@
 ---
-# nocheck: addons-variant-pinning: compiled into the image from services.discourse.plugins, so an addon-level disable saves no deploy time and only silences the spec
+# nocheck: addons-variant-pinning: compiled into the image from the addon's ref, so an addon-level disable saves no deploy time and only silences the spec
 enabled: true
 required: false
 mechanism: plugin
 source: upstream
+update:
+  monitored: true
+  catalog: discourse-meta
+  upstream_id: discourse-activity-pub
+config:
+  repository: https://github.com/discourse/discourse-activity-pub.git
+  ref: main
diff --git a/roles/web-app-discourse/meta/addons/discourse-akismet.yml b/roles/web-app-discourse/meta/addons/discourse-akismet.yml
index c7dca961bf..770e3fa21d 100644
--- a/roles/web-app-discourse/meta/addons/discourse-akismet.yml
+++ b/roles/web-app-discourse/meta/addons/discourse-akismet.yml
@@ -1,6 +1,13 @@
 ---
-# nocheck: addons-variant-pinning: compiled into the image from services.discourse.plugins, so an addon-level disable saves no deploy time and only silences the spec
+# nocheck: addons-variant-pinning: compiled into the image from the addon's ref, so an addon-level disable saves no deploy time and only silences the spec
 enabled: true
 required: false
 mechanism: plugin
 source: upstream
+update:
+  monitored: true
+  catalog: discourse-meta
+  upstream_id: discourse-akismet
+config:
+  repository: https://github.com/discourse/discourse-akismet.git
+  ref: main
diff --git a/roles/web-app-discourse/meta/addons/docker_manager.yml b/roles/web-app-discourse/meta/addons/docker_manager.yml
index c7dca961bf..8af7b2512d 100644
--- a/roles/web-app-discourse/meta/addons/docker_manager.yml
+++ b/roles/web-app-discourse/meta/addons/docker_manager.yml
@@ -1,6 +1,13 @@
 ---
-# nocheck: addons-variant-pinning: compiled into the image from services.discourse.plugins, so an addon-level disable saves no deploy time and only silences the spec
+# nocheck: addons-variant-pinning: compiled into the image from the addon's ref, so an addon-level disable saves no deploy time and only silences the spec
 enabled: true
 required: false
 mechanism: plugin
 source: upstream
+update:
+  monitored: true
+  catalog: discourse-meta
+  upstream_id: docker_manager
+config:
+  repository: https://github.com/discourse/docker_manager.git
+  ref: main
diff --git a/roles/web-app-discourse/meta/services.yml b/roles/web-app-discourse/meta/services.yml
index c3694d4013..3fbcfa6ea3 100644
--- a/roles/web-app-discourse/meta/services.yml
+++ b/roles/web-app-discourse/meta/services.yml
@@ -1,10 +1,10 @@
 ---
 # nocheck: seaweedfs-required — Discourse's aws-sdk-s3 defaults a custom endpoint to virtual-host addressing and exposes no force_path_style option, incompatible with SeaweedFS path-style without a global SeaweedFS virtual-host/wildcard-DNS change affecting all consumers; uploads stay on the local volume
-# nocheck: playwright-service-flag - shared gateway consumer; inference wiring is covered by the gateway role
+# nocheck: playwright-service-flag, dynamic-flag - shared gateway consumer; inference wiring is covered by the gateway role, and the gateway is a single shared instance
 litellm:
   bond: 0.5
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 # nocheck: playwright-service-flag — static-asset provider, no Playwright surface
 asset:
   bond: 1
@@ -69,17 +69,9 @@ discourse:
   ref: main
   min_storage: 15GB
   repository: https://github.com/discourse/discourse_docker.git
-  plugins:
-    docker_manager:
-      enabled: true
-    discourse-activity-pub:
-      enabled: true
-    discourse-akismet:
-      enabled: true
-    discourse-ldap-auth:
-      enabled: "{{ lookup('config', 'web-app-discourse', 'services.ldap.enabled') | bool }}"
-      repository: https://github.com/jonmbake/discourse-ldap-auth.git
-      ref: master
+  application:
+    repository: https://github.com/discourse/discourse.git
+    ref: v2026.8.0
   ports:
     local:
       http: 8020
diff --git a/roles/web-app-discourse/meta/variants.yml b/roles/web-app-discourse/meta/variants.yml
index 397fa8ca4d..d36f140319 100644
--- a/roles/web-app-discourse/meta/variants.yml
+++ b/roles/web-app-discourse/meta/variants.yml
@@ -22,7 +22,6 @@
       shared: true
     litellm:
       enabled: true
-      shared: true
     sso:
       enabled: true
       shared: true
@@ -59,7 +58,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false
     sso:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
diff --git a/roles/web-app-discourse/tasks/00_core.yml b/roles/web-app-discourse/tasks/00_core.yml
index ffa18be27b..00f0e35171 100644
--- a/roles/web-app-discourse/tasks/00_core.yml
+++ b/roles/web-app-discourse/tasks/00_core.yml
@@ -9,14 +9,6 @@
 - name: "🔧 Setup '{{ application_id }}' docker"
   include_tasks: 02_docker.yml
 
-- name: "🔧 Setup '{{ application_id }}' network"
-  include_tasks: 04_network.yml
-  when:
-    - IS_STACK_HOST | bool
-    - lookup('database', application_id, 'shared')
-
-- name: "🤖 Bind the native AI surface to the platform gateway"
-  include_tasks: addons/discourse-ai.yml
-  when:
-    - IS_STACK_HOST | bool
-    - DISCOURSE_LITELLM_ENABLED | bool
+- name: "🖥️ Setup what only the stack host owns"
+  include_tasks: 04_stack_host.yml
+  when: IS_STACK_HOST | bool
diff --git a/roles/web-app-discourse/tasks/03_launcher.yml b/roles/web-app-discourse/tasks/03_launcher.yml
index 6a692add06..f816df8bcc 100644
--- a/roles/web-app-discourse/tasks/03_launcher.yml
+++ b/roles/web-app-discourse/tasks/03_launcher.yml
@@ -1,4 +1,8 @@
 ---
+- name: "🧹 Clear the bootstrap marker of an earlier play"
+  ansible.builtin.set_fact:
+    DISCOURSE_REBUILT: false
+
 - name: ⬇️ Pull Discourse docker repository
   git:
     repo: "{{ DISCOURSE_REPOSITORY_URL }}"
@@ -10,7 +14,7 @@
   retries: 12
   delay: 30
   until: discourse_repo_pull is succeeded
-  notify: recreate-discourse
+  notify: rebuild-discourse
   become: true
 
 - name: 🔧 set chmod 700 for '{{ DISCOURSE_CONTAINERS_DIR }}'
@@ -26,6 +30,13 @@
     mode: "0640"
   notify: recreate-discourse
 
+- name: "🔑 Record the digest of everything the bootstrap consumes"
+  stack_host_copy:
+    content: "{{ lookup('template', 'config.yml.j2') | from_yaml | dict2items | rejectattr('key', 'eq', 'env') | items2dict | to_json | hash('sha256') }}"
+    dest: "{{ DISCOURSE_BOOTSTRAP_DIGEST_DEST }}"
+    mode: "0640"
+  notify: rebuild-discourse
+
 - name: "✅ Verify that '{{ DISCOURSE_CONTAINER }}' is running"
   ansible.builtin.command:
     argv:
@@ -40,7 +51,7 @@
   register: docker_ps
   changed_when: docker_ps.stdout.strip() == ""
   failed_when: docker_ps.rc != 0
-  notify: recreate-discourse
+  notify: rebuild-discourse
 
 - name: 📂 Load discourse handlers explicitly
   include_tasks: utils/load/handlers.yml
diff --git a/roles/web-app-discourse/tasks/04_stack_host.yml b/roles/web-app-discourse/tasks/04_stack_host.yml
new file mode 100644
index 0000000000..bbf7175342
--- /dev/null
+++ b/roles/web-app-discourse/tasks/04_stack_host.yml
@@ -0,0 +1,11 @@
+---
+- name: "🔧 Setup '{{ application_id }}' network"
+  include_tasks: stack_host/01_network.yml
+  when: lookup('database', application_id, 'shared')
+
+- name: "🔑 Apply the credentials the bootstrap must not carry"
+  include_tasks: stack_host/02_credentials.yml
+
+- name: "🤖 Bind the native AI surface to the platform gateway"
+  include_tasks: addons/discourse-ai.yml
+  when: DISCOURSE_LITELLM_ENABLED | bool
diff --git a/roles/web-app-discourse/tasks/04_network.yml b/roles/web-app-discourse/tasks/stack_host/01_network.yml
similarity index 100%
rename from roles/web-app-discourse/tasks/04_network.yml
rename to roles/web-app-discourse/tasks/stack_host/01_network.yml
diff --git a/roles/web-app-discourse/tasks/stack_host/02_credentials.yml b/roles/web-app-discourse/tasks/stack_host/02_credentials.yml
new file mode 100644
index 0000000000..5e6efbb6c2
--- /dev/null
+++ b/roles/web-app-discourse/tasks/stack_host/02_credentials.yml
@@ -0,0 +1,87 @@
+---
+- name: "⚙️ Apply the site settings to the running instance"
+  ansible.builtin.command:
+    argv:
+      - container
+      - exec
+      - -i
+      - -e
+      - "DISCOURSE_FORCE_HTTPS={{ DISCOURSE_TLS_ENABLED | bool | string | lower }}"
+      - -e
+      - "DISCOURSE_LOCAL_LOGINS={{ DISCOURSE_LOCAL_LOGIN_ENABLED | bool | string | lower }}"
+      - -e
+      - "DISCOURSE_LDAP_SITE_SETTINGS={{ (DISCOURSE_PLUGINS['discourse-ldap-auth'].config.site_settings if DISCOURSE_LDAP_ENABLED | bool else {}) | to_json }}"
+      - -e
+      - "DISCOURSE_OIDC_ENABLED={{ DISCOURSE_OIDC_ENABLED | bool | string | lower }}"
+      - -e
+      - "DISCOURSE_OIDC_VERBOSE={{ MODE_DEBUG | bool | string | lower }}"
+      - -e
+      - "DISCOURSE_OIDC_DISCOVERY_DOCUMENT={{ OIDC.CLIENT.DISCOVERY_DOCUMENT if DISCOURSE_OIDC_ENABLED | bool else '' }}"
+      - -e
+      - "DISCOURSE_OIDC_CLIENT_ID={{ OIDC.CLIENT.ID if DISCOURSE_OIDC_ENABLED | bool else '' }}"
+      - -e
+      - "DISCOURSE_OIDC_CLIENT_SECRET={{ OIDC.CLIENT.SECRET if DISCOURSE_OIDC_ENABLED | bool else '' }}"
+      - -e
+      - "DISCOURSE_OIDC_LOGOUT_REDIRECT={{ DISCOURSE_OIDC_LOGOUT_REDIRECT_URL if DISCOURSE_OIDC_ENABLED | bool else '' }}"
+      - "{{ DISCOURSE_CONTAINER }}" # nocheck: container-exec-resolver  the launcher names the container itself, so the bare name resolves in both modes
+      - rails
+      - r
+      - "{{ lookup('file', 'ruby/apply_settings.rb') }}"
+  changed_when: false
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
+- name: "🔑 Ensure the administrator account carries the current password"
+  ansible.builtin.command:
+    argv:
+      - container
+      - exec
+      - -i
+      - -e
+      - "DISCOURSE_ADMIN_EMAIL={{ lookup('users', 'administrator').email }}"
+      - -e
+      - "DISCOURSE_ADMIN_USERNAME={{ lookup('users', 'administrator').username }}"
+      - -e
+      - "DISCOURSE_ADMIN_PASSWORD={{ lookup('users', 'administrator').password }}"
+      - "{{ DISCOURSE_CONTAINER }}" # nocheck: container-exec-resolver  the launcher names the container itself, so the bare name resolves in both modes
+      - rails
+      - r
+      - "{{ lookup('file', 'ruby/ensure_admin_user.rb') }}"
+  changed_when: false
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
+- name: "🔎 Read the applied settings back out of the running instance"
+  ansible.builtin.command:
+    argv:
+      - container
+      - exec
+      - -i
+      - -e
+      - "DISCOURSE_ADMIN_EMAIL={{ lookup('users', 'administrator').email }}"
+      - -e
+      - "DISCOURSE_ADMIN_PASSWORD={{ lookup('users', 'administrator').password }}"
+      - -e
+      - "DISCOURSE_OIDC_ENABLED={{ DISCOURSE_OIDC_ENABLED | bool | string | lower }}"
+      - -e
+      - "DISCOURSE_OIDC_CLIENT_SECRET={{ OIDC.CLIENT.SECRET if DISCOURSE_OIDC_ENABLED | bool else '' }}"
+      - "{{ DISCOURSE_CONTAINER }}" # nocheck: container-exec-resolver  the launcher names the container itself, so the bare name resolves in both modes
+      - rails
+      - r
+      - "{{ lookup('file', 'ruby/verify_settings.rb') }}"
+  register: discourse_settings_readback
+  changed_when: false
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
+- name: "🛑 Refuse an instance the rotated credentials did not reach"
+  ansible.builtin.assert:
+    that:
+      - "'administrator_present=true' in discourse_settings_readback.stdout_lines"
+      - "'administrator_admin=true' in discourse_settings_readback.stdout_lines"
+      - "'administrator_active=true' in discourse_settings_readback.stdout_lines"
+      - "'administrator_password_matches=true' in discourse_settings_readback.stdout_lines"
+      - "not DISCOURSE_OIDC_ENABLED | bool or 'oidc_secret_matches=true' in discourse_settings_readback.stdout_lines"
+      - "not DISCOURSE_OIDC_ENABLED | bool or 'oidc_enabled=true' in discourse_settings_readback.stdout_lines"
+      - "not DISCOURSE_OIDC_ENABLED | bool or 'oidc_host_allowed=true' in discourse_settings_readback.stdout_lines"
+    fail_msg: >-
+      The administrator account, the OIDC client secret or the internal-host allowlist
+      of the running Discourse does not match the inventory, so a rotated credential
+      or a site setting never reached it.
diff --git a/roles/web-app-discourse/templates/config.yml.j2 b/roles/web-app-discourse/templates/config.yml.j2
index 1cca0ac788..f09ede8f90 100644
--- a/roles/web-app-discourse/templates/config.yml.j2
+++ b/roles/web-app-discourse/templates/config.yml.j2
@@ -15,8 +15,7 @@ templates:
 ## which TCP/IP ports should this container expose?
 ## If you want Discourse to share a port with another webserver like Apache or nginx,
 ## see https://meta.discourse.org/t/17247 for details
-expose:
-  - "{{ DOCKER_BIND_HOST }}:{{ lookup('config', application_id, 'services.discourse.ports.local.http') }}:80"   # http
+{{ lookup('container_ports', ['discourse', 'http', DOCKER_BIND_HOST], key='expose') }}
 
 params:
   db_default_text_search_config: "pg_catalog.english"
@@ -29,7 +28,7 @@ params:
   #db_work_mem: "40MB"
 
   ## Which Git revision should this container use? (default: tests-passed)
-  #version: tests-passed
+  version: {{ DISCOURSE_VERSION }}
 
 env:
   LC_ALL:   "{{ DISCOURSE_LOCAL }}"
@@ -138,89 +137,16 @@ hooks:
         cmd:
 {% for plugin_name, plugin_config in DISCOURSE_PLUGINS.items() %}
 {% if plugin_config.enabled and plugin_config.source != 'bundled' %}
-          - git clone --depth=1 https://github.com/discourse/{{ plugin_name }}.git
+          - git clone --depth=1 --branch {{ plugin_config.config.ref }} {{ plugin_config.config.repository }}
 {% endif %}
 {% endfor %}
 
-{% if DISCOURSE_LDAP_ENABLED | bool %}
-          - git clone --depth=1 --branch {{ DISCOURSE_LDAP_AUTH_PLUGIN_REF }} {{ DISCOURSE_LDAP_AUTH_PLUGIN_REPOSITORY }}
-{% endif %}
-
 ## Any custom commands to run after building
 run:
   - exec: echo "Beginning of custom commands"
-  - exec: rails r "SiteSetting.force_https = {{ DISCOURSE_TLS_ENABLED | bool | string | lower }}"
 {% if DISCOURSE_TLS_SELFSIGNED_ENABLED | bool %}
   - exec: {{ BIN_CA_TRUST }}
 {% endif %}
-  ## If you want to set the 'From' email address for your first registration, uncomment and change:
-  ## After getting the first signup email, re-comment the line. It only needs to run once.
-  #- exec: rails r "SiteSetting.notification_email='info@unconfigured.discourse.org'"
-  - exec: rails r "SiteSetting.enable_local_logins = {{ DISCOURSE_LOCAL_LOGIN_ENABLED | bool | string | lower }}"
-{% if DISCOURSE_OIDC_ENABLED | bool %}
-  # Deactivate Default Login
-  - exec: rails r "SiteSetting.openid_connect_verbose_logging = {{ MODE_DEBUG | bool | string | lower }}"
-  - exec: rails r "SiteSetting.enable_passkeys = false" # https://meta.discourse.org/t/passwordless-login-using-passkeys/285589
-
-  - exec: rails r "SiteSetting.username_change_period = 0" # Deactivate changing of username
-
-  # OIDC Activation
-  - exec: rails r "SiteSetting.openid_connect_discovery_document = '{{OIDC.CLIENT.DISCOVERY_DOCUMENT}}'"
-  - exec: rails r "SiteSetting.openid_connect_client_id = '{{ OIDC.CLIENT.ID }}'"         
-  - exec: rails r "SiteSetting.openid_connect_client_secret = '{{ OIDC.CLIENT.SECRET }}'"
-  - exec: rails r "SiteSetting.openid_connect_enabled = true"
-  - exec: rails r "SiteSetting.openid_connect_rp_initiated_logout_redirect = '{{ DISCOURSE_OIDC_LOGOUT_REDIRECT_URL }}'"
-  - exec: rails r "SiteSetting.openid_connect_allow_association_change = false"
-  - exec: rails r "SiteSetting.openid_connect_rp_initiated_logout = true"
-
-  # ---- FinalDestination allowlist (IMPORTANT) ----
-  # Discourse blocks requests to internal/private IPs unless the host is allowlisted.
-  # Extract host from discovery document URL and append to allowed_internal_hosts.
-  - exec: >
-      rails r "url=SiteSetting.openid_connect_discovery_document.to_s.strip;
-      host=url.sub(%r{\Ahttps?://}i,'').split('/').first.to_s.strip;
-      host=host.split(':').first.to_s.strip;
-      list=SiteSetting.allowed_internal_hosts.to_s.split('|').map{|x| x.strip}.reject{|x| x.empty?};
-      if !host.empty? && host =~ /\A[a-z0-9.-]+\z/i && !list.include?(host)
-        list << host;
-        SiteSetting.allowed_internal_hosts = list.join('|');
-      end;
-      puts \"allowed_internal_hosts=#{SiteSetting.allowed_internal_hosts}\";"
-
-  # Clear OIDC discovery cache so the next login attempt refetches with the new allowlist
-  - exec: >
-      rails r "url=SiteSetting.openid_connect_discovery_document.to_s.strip;
-      key=\"openid-connect-discovery-#{url}\";
-      Discourse.cache.delete(key);
-      puts \"deleted_cache_key=#{key}\";"
-
-{% endif %}
-
-  # Activate Administrator User (always yes, non-interactive)
-  - exec: |
-      cat <<'EOF' | rake admin:create
-      {{ lookup('users', 'administrator').email }}
-      {{ lookup('users', 'administrator').password }}
-      {{ lookup('users', 'administrator').password }}
-      Y
-      Y
-      EOF
-
-  - exec: >
-      rails r "User.find_by_email('{{ lookup('users', 'administrator').email }}')&.update!(username: '{{ lookup('users', 'administrator').username }}')"
-
-{% if DISCOURSE_LDAP_ENABLED | bool %}
-{% for setting_key, setting_value in DISCOURSE_PLUGINS['discourse-ldap-auth'].config.site_settings.items() %}
-{% if setting_value is boolean %}
-  - exec: rails r "SiteSetting.{{ setting_key }} = {{ setting_value | string | lower }}"
-{% elif setting_value is string %}
-  - exec: rails r "SiteSetting.{{ setting_key }} = '{{ setting_value }}'"
-{% else %}
-  - exec: rails r "SiteSetting.{{ setting_key }} = {{ setting_value }}"
-{% endif %}
-{% endfor %}
-{% endif %}
-
   - exec: echo "End of custom commands"
 
 docker_args:
diff --git a/roles/web-app-discourse/vars/main.yml b/roles/web-app-discourse/vars/main.yml
index 909fb515cc..8e423d3f92 100644
--- a/roles/web-app-discourse/vars/main.yml
+++ b/roles/web-app-discourse/vars/main.yml
@@ -17,8 +17,7 @@ DISCOURSE_REDIS_PORT: "{{ lookup('engine', 'redis', application_id, 'port') }}"
 DISCOURSE_REDIS_PASSWORD: "{{ lookup('engine', 'redis', application_id, 'password') }}"
 DISCOURSE_REPOSITORY_URL: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.repository') }}"
 DISCOURSE_REF: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.ref') }}"
-DISCOURSE_LDAP_AUTH_PLUGIN_REPOSITORY: "{{ lookup('config', application_id, 'addons.discourse-ldap-auth.config.repository') }}"
-DISCOURSE_LDAP_AUTH_PLUGIN_REF: "{{ lookup('config', application_id, 'addons.discourse-ldap-auth.config.ref') }}"
+DISCOURSE_VERSION: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.application.ref') }}"
 
 DISCOURSE_DATABASE: "{{ lookup('database', application_id ) }}"
 DISCOURSE_DATABASE_TYPE: "{{ DISCOURSE_DATABASE.type }}"
@@ -30,6 +29,8 @@ DISCOURSE_CONTAINERS_DIR: "{{ [ DISCOURSE_REPOSITORY_DIR, 'containers' ] | path_
 
 DISCOURSE_APPLICATION_YML_DEST: "{{ [ DISCOURSE_CONTAINERS_DIR, DISCOURSE_CONTAINER ~ '.yml' ] | path_join }}"
 
+DISCOURSE_BOOTSTRAP_DIGEST_DEST: "{{ [ DISCOURSE_CONTAINERS_DIR, DISCOURSE_CONTAINER ~ '.bootstrap.sha256' ] | path_join }}"
+
 DISCOURSE_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
 
 DISCOURSE_LITELLM_ENABLED: "{{ lookup('config', application_id, 'services.litellm.enabled') | bool }}"
diff --git a/roles/web-app-erpnext/meta/services.yml b/roles/web-app-erpnext/meta/services.yml
index ae0a6e536b..fbddf587c1 100644
--- a/roles/web-app-erpnext/meta/services.yml
+++ b/roles/web-app-erpnext/meta/services.yml
@@ -65,7 +65,7 @@ erpnext:
   enabled: true
   shared: true
   image: frappe/erpnext
-  version: "v16.34.2"
+  version: "v16.35.0"
   name: erpnext
   min_storage: 1017MB
   ports:
diff --git a/roles/web-app-fediwall/meta/services.yml b/roles/web-app-fediwall/meta/services.yml
index 58ebaf38ed..91af39c490 100644
--- a/roles/web-app-fediwall/meta/services.yml
+++ b/roles/web-app-fediwall/meta/services.yml
@@ -52,7 +52,7 @@ fediwall:
     swarm:
       enabled: true
   image: nginx
-  version: alpine
+  version: 1.31.6-alpine
   custom: true
   upstream:
     version: "1.4.0"
diff --git a/roles/web-app-fider/meta/services.yml b/roles/web-app-fider/meta/services.yml
index 08814c2566..072028c8e7 100644
--- a/roles/web-app-fider/meta/services.yml
+++ b/roles/web-app-fider/meta/services.yml
@@ -36,7 +36,7 @@ fider:
     swarm:
       enabled: true
   image: getfider/fider
-  version: stable
+  version: stable # nocheck: docker-version  upstream released v0.36.1 on GitHub but never pushed that tag; its build ships only as `stable`, and v0.36.0 predates ALLOW_PRIVATE_NETWORK_TARGETS, without which the OAuth token exchange against an internally resolving Keycloak is refused. TODO: pin the semver tag once upstream publishes one.
   name: fider
   min_storage: 400MB
   backup:
diff --git a/roles/web-app-flowise/meta/services.yml b/roles/web-app-flowise/meta/services.yml
index f668766d59..fd68bc35fe 100644
--- a/roles/web-app-flowise/meta/services.yml
+++ b/roles/web-app-flowise/meta/services.yml
@@ -28,11 +28,11 @@ sso:
 ldap:
   enabled: false
   shared: false
-# nocheck: playwright-service-flag - shared gateway consumer; inference wiring is covered by the gateway role
+# nocheck: playwright-service-flag, dynamic-flag - shared gateway consumer; inference wiring is covered by the gateway role, and the gateway is a single shared instance
 litellm:
   bond: 1
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 # nocheck: playwright-service-flag - DB engine, covered by role-local integration tests
 qdrant:
   bond: 1
@@ -60,12 +60,12 @@ flowise:
     no_stop_required: false
   image: node
   # nocheck: docker-version
-  version: "24-bookworm-slim"
+  version: "24-slim"
   npm_version: 3.1.4
   sqlite_version: 12.11.1
   custom: true
   name: flowise
-  # nocheck: min-storage-headroom  Reason: the deployed image is built here from node:24-bookworm-slim and measures 4.8 GB, so the base image transfer is not its footprint
+  # nocheck: min-storage-headroom  Reason: the deployed image is built here from node:24-slim and measures 4.8 GB, so the base image transfer is not its footprint
   min_storage: 6GB
   cpus: "1.0"
   mem_reservation: 1g
diff --git a/roles/web-app-flowise/meta/variants.yml b/roles/web-app-flowise/meta/variants.yml
index 2ee01b19b7..6464f2d6b0 100644
--- a/roles/web-app-flowise/meta/variants.yml
+++ b/roles/web-app-flowise/meta/variants.yml
@@ -28,7 +28,6 @@
       shared: true
     litellm:
       enabled: true
-      shared: true
     qdrant:
       enabled: true
       shared: true
@@ -68,7 +67,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     qdrant:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -108,7 +106,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     qdrant:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
diff --git a/roles/web-app-funkwhale/meta/services.yml b/roles/web-app-funkwhale/meta/services.yml
index d102779090..92cd7265dc 100644
--- a/roles/web-app-funkwhale/meta/services.yml
+++ b/roles/web-app-funkwhale/meta/services.yml
@@ -11,7 +11,7 @@ funkwhale:
   # nocheck: default-placement-manager  embedded typesense index; node-local in swarm
   placement: manager
   image: funkwhale/front
-  version: 2.0.10
+  version: 2.0.11
   min_storage: 224MB
   ports:
     internal:
@@ -35,7 +35,7 @@ api:
     flavor: curl
     path: api/v1/instance/nodeinfo/2.0
   image: funkwhale/api
-  version: 2.0.10
+  version: 2.0.11
   min_storage: 588MB
   ports:
     internal:
diff --git a/roles/web-app-funkwhale/templates/compose.yml.j2 b/roles/web-app-funkwhale/templates/compose.yml.j2
index 5d91f8e574..813ccd6228 100644
--- a/roles/web-app-funkwhale/templates/compose.yml.j2
+++ b/roles/web-app-funkwhale/templates/compose.yml.j2
@@ -30,8 +30,9 @@
     {{ lookup('container_image', application_id, 'api') }}
     command: gunicorn
     {{ lookup('container_volumes', service_name) | indent(4) }}
-    ports:
-      - "{{ FUNKWHALE_DOCKER_API_PORT }}"
+    {{ lookup('container_ports',
+              {'service': 'api', 'protocol': 'http',
+               'publish': 'ephemeral'}) | indent(4) }}
     {{ lookup('container_depends_on', application_id, extra={
   'migrate': {'condition': 'service_completed_successfully'},
 }) | indent(4) }}
diff --git a/roles/web-app-fusiondirectory/meta/variants.yml b/roles/web-app-fusiondirectory/meta/variants.yml
index bf19c2930c..ff10fee77b 100644
--- a/roles/web-app-fusiondirectory/meta/variants.yml
+++ b/roles/web-app-fusiondirectory/meta/variants.yml
@@ -60,30 +60,3 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     tor:
       enabled: true
-- services:
-    container_backup:
-      enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
-    sso:
-      enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
-    css:
-      enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
-    dashboard:
-      enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
-    email:
-      enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
-    logout:
-      enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
-    matomo:
-      enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
-    prometheus:
-      enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
-    tor:
-      enabled: true
diff --git a/roles/web-app-gitea/meta/services.yml b/roles/web-app-gitea/meta/services.yml
index 751acb0134..d9d25c94e3 100644
--- a/roles/web-app-gitea/meta/services.yml
+++ b/roles/web-app-gitea/meta/services.yml
@@ -76,6 +76,9 @@ gitea:
       http: 8002
     public:
       ssh: 2201
+    onion:
+      # nocheck: onion-flag  git over the onion runs on the HTTP transport the proxy already serves on port 80; a second sshd on the onion would need its own host key policy
+      ssh: false
   run_after:
     - web-app-matomo
     - web-app-keycloak
diff --git a/roles/web-app-gitlab/meta/services.yml b/roles/web-app-gitlab/meta/services.yml
index 0eaf633988..146427958e 100644
--- a/roles/web-app-gitlab/meta/services.yml
+++ b/roles/web-app-gitlab/meta/services.yml
@@ -63,6 +63,9 @@ gitlab:
     internal:
       http: 8181
       ssh: 2222
+    onion:
+      # nocheck: onion-flag  GitLab Shell is published for clearnet git clients and authenticates them against the internal API by host key; onion clients clone over the HTTP transport on port 80 instead
+      ssh: false
   proxy:
     service_key: workhorse
   run_after:
diff --git a/roles/web-app-hermes/meta/services.yml b/roles/web-app-hermes/meta/services.yml
index 883cbff9ff..eeb8442dc1 100644
--- a/roles/web-app-hermes/meta/services.yml
+++ b/roles/web-app-hermes/meta/services.yml
@@ -60,11 +60,11 @@ logout:
   enabled: false
   shared: false
 
-# nocheck: playwright-service-flag
+# nocheck: playwright-service-flag, dynamic-flag - the gateway is a single shared instance, never deployed per consumer
 litellm:
   bond: 1
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 
 dashboard:
   bond: 1
diff --git a/roles/web-app-hermes/meta/variants.yml b/roles/web-app-hermes/meta/variants.yml
index ca2f16924d..676b2d63da 100644
--- a/roles/web-app-hermes/meta/variants.yml
+++ b/roles/web-app-hermes/meta/variants.yml
@@ -10,7 +10,6 @@
       shared: true
     litellm:
       enabled: true
-      shared: true
     dashboard:
       enabled: true
       shared: true
@@ -34,7 +33,6 @@
       shared: true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override variant pins a literal off-switch
     dashboard:
       enabled: false
       shared: false # nocheck: variants-static-override variant pins a literal off-switch
@@ -58,7 +56,6 @@
       shared: false # nocheck: variants-static-override variant pins a literal off-switch
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override variant pins a literal off-switch
     dashboard:
       enabled: false
       shared: false # nocheck: variants-static-override variant pins a literal off-switch
diff --git a/roles/web-app-jenkins/meta/services.yml b/roles/web-app-jenkins/meta/services.yml
index b87b3cee70..5de40828aa 100644
--- a/roles/web-app-jenkins/meta/services.yml
+++ b/roles/web-app-jenkins/meta/services.yml
@@ -46,7 +46,7 @@ jenkins:
   # nocheck: single-replica
   replicas: 1
   image: jenkins/jenkins
-  version: lts
+  version: 2.568.3-lts
   custom: true
   name: jenkins
   ports:
diff --git a/roles/web-app-jenkins/templates/casc.yaml.j2 b/roles/web-app-jenkins/templates/casc.yaml.j2
index b40e863375..e66a916a60 100644
--- a/roles/web-app-jenkins/templates/casc.yaml.j2
+++ b/roles/web-app-jenkins/templates/casc.yaml.j2
@@ -5,7 +5,7 @@
 # Keycloak group / LDAP group memberships onto Jenkins authorities.
 
 jenkins:
-  systemMessage: "Managed by Infinito.Nexus."
+  systemMessage: "Managed by {{ SOFTWARE_NAME }}."
   numExecutors: 2
   mode: NORMAL
 
diff --git a/roles/web-app-jitsi/meta/services.yml b/roles/web-app-jitsi/meta/services.yml
index b105470533..21051d1b6c 100644
--- a/roles/web-app-jitsi/meta/services.yml
+++ b/roles/web-app-jitsi/meta/services.yml
@@ -53,7 +53,7 @@ jitsi:
     swarm:
       enabled: true
   image: jitsi/web
-  version: "stable-9646"
+  version: "stable-11031"
   min_storage: 315MB
   # nocheck: default-placement-manager  meta/volumes.yml uses type:bind config dirs staged on the stack host; a worker-scheduled task lacks the source paths (unpinning requires migrating them to nfs-backed named volumes)
   placement: manager
@@ -87,7 +87,7 @@ prosody:
     port_key: http
   name: jitsi-prosody
   image: jitsi/prosody
-  version: "stable-9646"
+  version: "stable-11031"
   ports:
     internal:
       xmpp: 5222
@@ -102,7 +102,7 @@ prosody:
 jicofo:
   name: jitsi-jicofo
   image: jitsi/jicofo
-  version: "stable-9646"
+  version: "stable-11031"
   cpus: "1.0"
   mem_reservation: 512m
   mem_limit: 1g
@@ -112,7 +112,7 @@ jicofo:
 jvb:
   name: jitsi-jvb
   image: jitsi/jvb
-  version: "stable-9646"
+  version: "stable-11031"
   cpus: "2.0"
   mem_reservation: 1g
   mem_limit: 2g
diff --git a/roles/web-app-jitsi/templates/compose.yml.j2 b/roles/web-app-jitsi/templates/compose.yml.j2
index b893265663..d69c1d1fca 100644
--- a/roles/web-app-jitsi/templates/compose.yml.j2
+++ b/roles/web-app-jitsi/templates/compose.yml.j2
@@ -28,8 +28,9 @@
     {{ lookup('compose_only', 'container_name', JITSI_JVB_CONTAINER) }}
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('depends_on', {JITSI_PROSODY_SERVICE: 'service_started'}) }}
-    ports:
-      - "{{ JITSI_JVB_MEDIA_PORT }}:{{ JITSI_JVB_MEDIA_PORT }}/udp"  # nocheck: compose-ports-must-use-container-ports
+    {{ lookup('container_ports',
+              {'service': 'jitsi', 'protocol': 'media',
+               'transport': 'udp', 'container': 'same'}) | indent(4) }}
     {{ lookup('container_volumes', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 
diff --git a/roles/web-app-joomla/tasks/main.yml b/roles/web-app-joomla/tasks/main.yml
index d26681fb8d..0c2adc2ad8 100644
--- a/roles/web-app-joomla/tasks/main.yml
+++ b/roles/web-app-joomla/tasks/main.yml
@@ -4,7 +4,7 @@
     name: sys-stk-front-proxy
   loop: "{{ JOOMLA_DOMAINS }}"
   loop_control:
-    loop_var: domain
+    loop_var: domain # nocheck: loop-var-shadow  sys-stk-front-proxy takes the vhost through this name, see its tasks/main.yml front_proxy_domain
   vars:
     http_port: "{{ lookup('config', application_id, 'services.joomla.ports.local.http') }}"
     webserver_client_max_body_size: "{{ JOOMLA_POST_MAX_SIZE }}"
diff --git a/roles/web-app-keycloak/meta/services.yml b/roles/web-app-keycloak/meta/services.yml
index 7366782b3a..9625e85359 100644
--- a/roles/web-app-keycloak/meta/services.yml
+++ b/roles/web-app-keycloak/meta/services.yml
@@ -51,7 +51,7 @@ keycloak:
   shared: true
   provides: sso
   image: quay.io/keycloak/keycloak
-  version: "26.7.3"
+  version: "26.7.4"
   name: keycloak
   min_storage: 468MB
   cpus: "2.0"
diff --git a/roles/web-app-keycloak/templates/sso_proxy/container.yml.j2 b/roles/web-app-keycloak/templates/sso_proxy/container.yml.j2
index 9ca1d59d3b..806fb3cd63 100644
--- a/roles/web-app-keycloak/templates/sso_proxy/container.yml.j2
+++ b/roles/web-app-keycloak/templates/sso_proxy/container.yml.j2
@@ -8,6 +8,7 @@
     labels:
       infinito.sso-proxy.config-sha256: "{{ lookup('template', lookup('path_absolute', 'roles/web-app-keycloak/templates/sso_proxy/oauth2-proxy-keycloak.cfg.j2'), template_vars={'sso_proxy_application_id': application_id}) | hash('sha256') }}"
     ports:
+      # nocheck: compose-ports-must-use-container-ports  the published port belongs to the consuming role's own entity and the container port to web-app-keycloak's sso_proxy, so the mapping spans two application_ids and no single container_ports call can read both
       - {{ DOCKER_BIND_HOST }}:{{ lookup('config', application_id, 'services.' ~ (application_id | get_entity_name) ~ '.ports.local.sso') }}:{{ lookup('config', 'web-app-keycloak', 'services.sso_proxy.ports.internal.http') }}/tcp
     volumes:
       - "{{ lookup('container', application_id, 'directories.volumes') }}{{ lookup('config', 'web-app-keycloak', 'services.sso_proxy.configuration_file') }}:/oauth2-proxy.cfg"
diff --git a/roles/web-app-kix/templates/zzz_auth_ldap.xml.j2 b/roles/web-app-kix/templates/zzz_auth_ldap.xml.j2
index a5cd11055c..209028dcf8 100644
--- a/roles/web-app-kix/templates/zzz_auth_ldap.xml.j2
+++ b/roles/web-app-kix/templates/zzz_auth_ldap.xml.j2
@@ -1,12 +1,12 @@
 <?xml version="1.0" encoding="utf-8"?>
 <kix_config version="1.0" init="Application">
     <ConfigItem AccessLevel="confidential" Name="Authentication###100-Infinito-LDAP" Required="1" Valid="1" ConfigLevel="200">
-        <Description Translatable="1">Infinito.Nexus LDAP backend (svc-db-openldap) for the web-app-kix-administrator role group. Authenticates KIX agents via Auth::LDAP and provisions the contact via Auth::Sync::LDAP.</Description>
+        <Description Translatable="1">{{ SOFTWARE_NAME }} LDAP backend (svc-db-openldap) for the web-app-kix-administrator role group. Authenticates KIX agents via Auth::LDAP and provisions the contact via Auth::Sync::LDAP.</Description>
         <Group>Framework</Group>
         <Setting>
             <Object>[
     {
-        "Name": "Infinito.Nexus svc-db-openldap (Agent, web-app-kix-administrator)",
+        "Name": "{{ SOFTWARE_NAME }} svc-db-openldap (Agent, web-app-kix-administrator)",
         "Enabled": 1,
         "UsageContext": "Agent",
         "Module": "Kernel::System::Auth::LDAP",
@@ -57,12 +57,12 @@
         </Setting>
     </ConfigItem>
     <ConfigItem AccessLevel="confidential" Name="Authentication###200-Infinito-LDAP-User" Required="1" Valid="1" ConfigLevel="200">
-        <Description Translatable="1">Second Infinito.Nexus LDAP backend for the web-app-kix-user role group. KIX iterates over Authentication entries; if the administrator backend (###100) refuses (user not in admin group), this one tries the user group. The OAuth2-proxy `allowed_groups` filter still lets only members of either group through, so this backend never sees a user without an Infinito.Nexus role.</Description>
+        <Description Translatable="1">Second {{ SOFTWARE_NAME }} LDAP backend for the web-app-kix-user role group. KIX iterates over Authentication entries; if the administrator backend (###100) refuses (user not in admin group), this one tries the user group. The OAuth2-proxy `allowed_groups` filter still lets only members of either group through, so this backend never sees a user without an {{ SOFTWARE_NAME }} role.</Description>
         <Group>Framework</Group>
         <Setting>
             <Object>[
     {
-        "Name": "Infinito.Nexus svc-db-openldap (Agent, web-app-kix-user)",
+        "Name": "{{ SOFTWARE_NAME }} svc-db-openldap (Agent, web-app-kix-user)",
         "Enabled": 1,
         "UsageContext": "Agent",
         "Module": "Kernel::System::Auth::LDAP",
diff --git a/roles/web-app-lam/meta/csp.yml b/roles/web-app-lam/meta/csp.yml
index 8f479faa84..c7abf2597a 100644
--- a/roles/web-app-lam/meta/csp.yml
+++ b/roles/web-app-lam/meta/csp.yml
@@ -3,7 +3,7 @@ flags:
   style-src-attr:
     unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
   script-src-elem:
-    unsafe-inline: true # nocheck: csp-unsafe  Reason: LAM renders the progress driver of its asynchronous tools as an inline script; with this off, LDAP import/export and multi edit post their job, display "Status: in progress" and never poll it, so both tools hang for every user
+    unsafe-inline: true # nocheck: csp-unsafe  Reason: LAM emits inline <script> elements from 18 files (htmlJavaScript in lib/html.inc), so this was always required and only surfaced when a test first drove multi edit; hashing is not an option because one hash makes browsers ignore unsafe-inline for the whole directive and the dynamic snippets cannot be hashed
     unsafe-eval: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
   script-src-attr:
     unsafe-inline: true # nocheck: csp-unsafe  Reason: historical, TODO: re-verify it is really required and does not open attack surface
diff --git a/roles/web-app-littlejs/meta/services.yml b/roles/web-app-littlejs/meta/services.yml
index a4ad9637e4..b1b6376874 100644
--- a/roles/web-app-littlejs/meta/services.yml
+++ b/roles/web-app-littlejs/meta/services.yml
@@ -38,7 +38,7 @@ littlejs:
   repository: https://github.com/KilledByAPixel/LittleJS.git
   ref: main
   image: nginx
-  version: alpine
+  version: 1.31.6-alpine
   custom: true
   ports:
     local:
diff --git a/roles/web-app-littlejs/templates/html/nav/bottom.html.j2 b/roles/web-app-littlejs/templates/html/nav/bottom.html.j2
index 709d70be95..94b2eac154 100644
--- a/roles/web-app-littlejs/templates/html/nav/bottom.html.j2
+++ b/roles/web-app-littlejs/templates/html/nav/bottom.html.j2
@@ -7,13 +7,13 @@
         <i class="fa-brands fa-github me-1"></i>LittleJS Repository
       </a>
 
-      <a class="btn btn-sm btn-link text-light" href="https://s.infinito.nexus/littlejscode" target="_blank">
+      <a class="btn btn-sm btn-link text-light" href="https://s.{{ SOFTWARE_DOMAIN }}/littlejscode" target="_blank">
         <i class="fa-solid fa-code me-1"></i>{{ LITTLEJS_HEADLINE }} Code
       </a>
     </div>
 
     <div class="d-flex align-items-center">
-      <a class="btn btn-sm btn-link text-light" href="https://infinito.nexus" target="_blank">
+      <a class="btn btn-sm btn-link text-light" href="{{ SOFTWARE_URL }}" target="_blank">
         <i class="fa-solid fa-globe me-1"></i>{{ SOFTWARE_NAME }}
       </a>
     </div>
diff --git a/roles/web-app-mailu/meta/services.yml b/roles/web-app-mailu/meta/services.yml
index 99eb7abc1d..6a830b3e08 100644
--- a/roles/web-app-mailu/meta/services.yml
+++ b/roles/web-app-mailu/meta/services.yml
@@ -61,6 +61,13 @@ mailu:
       imap: 143
       imaps: 993
       sieve: 4190
+    onion:
+      smtp: true
+      submission: true
+      imap: true
+      pop3: true
+      # nocheck: onion-flag  ManageSieve edits server-side filters, which is administration rather than the sending and receiving the onion transport is for
+      sieve: false
   proxy:
     service_key: front
   run_after:
diff --git a/roles/web-app-mastodon/tasks/00_core.yml b/roles/web-app-mastodon/tasks/00_core.yml
index 53b877980b..4e60f56b9b 100644
--- a/roles/web-app-mastodon/tasks/00_core.yml
+++ b/roles/web-app-mastodon/tasks/00_core.yml
@@ -6,7 +6,7 @@
     name: sys-stk-front-proxy
   loop: "{{ lookup('domains', 'web-app-mastodon') }}"
   loop_control:
-    loop_var: domain
+    loop_var: domain # nocheck: loop-var-shadow  sys-stk-front-proxy takes the vhost through this name, see its tasks/main.yml front_proxy_domain
   vars:
     http_port: "{{ lookup('config', application_id, 'services.mastodon.ports.local.http') }}"
     webserver_websocket_location: "/api/v1/streaming"
diff --git a/roles/web-app-matrix/files/playwright/test-dm-admin-biber.js b/roles/web-app-matrix/files/playwright/test-dm-admin-biber.js
index d54eda93eb..d60069523d 100644
--- a/roles/web-app-matrix/files/playwright/test-dm-admin-biber.js
+++ b/roles/web-app-matrix/files/playwright/test-dm-admin-biber.js
@@ -97,28 +97,31 @@ exports.register = function (shared) {
       await adminPage.keyboard.type(bootstrap);
       await adminPage.keyboard.press("Enter");
 
-      // Biber: wait for admin's invite to propagate, then accept. The flow
-      // mirrors Element's invite UX: (1) click the sidebar tile for admin's
-      // invite (the tile renders with admin's display name but no standalone
-      // Accept button), then (2) click the primary accept action in the invite
-      // view (modern Element labels this "Start chatting" for DMs; older
-      // builds / non-DM invites use "Accept" / "Join"). MUST NOT match
-      // "Decline" / "Decline and block".
       await expect
         .poll(async () => {
           return await biberPage.evaluate(() => {
-            // Step 1: open the invite.
+            const sections = document.querySelectorAll(
+              'button[aria-expanded="false"][aria-label^="Toggle "]',
+            );
+            for (const section of sections) {
+              section.click();
+            }
+
+            // Not scoped to a row wrapper: the list is virtualised and 1.12.27
+            // renders no role=row, aria-level or aria-expanded at all.
             const roomTiles = document.querySelectorAll(
-              "[role='treeitem'], [role='option'], .mx_RoomTile, [data-testid^='room-tile']",
+              'button[aria-label^="Open room"]',
             );
             for (const tile of roomTiles) {
-              const text = (tile.textContent || "").trim();
-              if (/administrator/i.test(text)) {
+              const name = `${tile.getAttribute("aria-label") || ""} ${tile.textContent || ""}`;
+              if (/administrator/i.test(name)) {
                 tile.click();
                 break;
               }
             }
-            // Step 2: click accept.
+
+            // Anchored: "Decline and block" contains an accept-looking word and
+            // clicking it destroys the invite.
             const acceptCandidates = document.querySelectorAll(
               "button, a, [role='button']",
             );
@@ -128,9 +131,6 @@ exports.register = function (shared) {
                 b.click();
               }
             }
-            // Success: invite accepted when the room timeline renders a
-            // message composer for biber (only appears once membership is
-            // `join`). Use the same composer signature as admin's side.
             return !!document.querySelector(
               "div[role='textbox'][contenteditable='true'], textarea[aria-label*='message' i]",
             );
diff --git a/roles/web-app-matrix/meta/services.yml b/roles/web-app-matrix/meta/services.yml
index fe06542181..232a0b2a34 100644
--- a/roles/web-app-matrix/meta/services.yml
+++ b/roles/web-app-matrix/meta/services.yml
@@ -1,8 +1,9 @@
 ---
+# nocheck: dynamic-flag - the gateway is a single shared instance, never deployed per consumer
 litellm:
   bond: 0.5
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 # nocheck: dockerfile-custom
 sso:
   bond: 1
@@ -54,6 +55,9 @@ synapse:
       http: 8021
     public:
       federation: 8448
+    onion:
+      # nocheck: onion-flag  federation is dialled by clearnet homeservers resolving this server_name; serving it on the onion needs an onion server_name, which is a different deployment
+      federation: false
   min_storage: 311MB
   cpus: "1.5"
   mem_reservation: "1g"
@@ -62,7 +66,7 @@ synapse:
 element:
   healthcheck:
     flavor: wget
-  version: v1.12.27
+  version: v1.12.28
   image: vectorim/element-web
   name: matrix-element
   ports:
@@ -127,7 +131,7 @@ matrix:
   flavor: ansible
   upstream:
     repo: https://github.com/spantaleev/matrix-docker-ansible-deploy
-    ref: master
+    ref: 40179e6d4a36513eb77c4ef2eff067716ebb1821
     migration_validated_version: v2026.05.18.0
   runner:
     image: infinito/web-app-matrix-mdad-runner:1
diff --git a/roles/web-app-matrix/meta/variants.yml b/roles/web-app-matrix/meta/variants.yml
index 13577c808b..59965eb1f1 100644
--- a/roles/web-app-matrix/meta/variants.yml
+++ b/roles/web-app-matrix/meta/variants.yml
@@ -29,7 +29,6 @@
       shared: true
     litellm:
       enabled: false
-      shared: false
     sso:
       enabled: true
       shared: true
@@ -73,7 +72,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false
     sso:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -120,7 +118,6 @@
       shared: true
     litellm:
       enabled: true
-      shared: true
     sso:
       enabled: true
       shared: true
diff --git a/roles/web-app-matrix/templates/flavor/ansible/services.yml.j2 b/roles/web-app-matrix/templates/flavor/ansible/services.yml.j2
index d0bb2d80ea..3746b3eb25 100644
--- a/roles/web-app-matrix/templates/flavor/ansible/services.yml.j2
+++ b/roles/web-app-matrix/templates/flavor/ansible/services.yml.j2
@@ -35,7 +35,8 @@
       - /run
       - /run/lock
       - /tmp
-    ports:
-      - "{{ DOCKER_BIND_HOST }}:{{ MATRIX_SYNAPSE_PORT }}:8008"
+    {{ lookup('container_ports', ['synapse', 'http', DOCKER_BIND_HOST]) | indent(4) }}
+      # nocheck: compose-ports-must-use-container-ports  matrix-docker-ansible-deploy fixes element on 8080 while this repo declares element.ports.internal.http 80; the two disagree and the playbook owns the container
       - "{{ DOCKER_BIND_HOST }}:{{ MATRIX_ELEMENT_PORT }}:8080"
+      # nocheck: compose-ports-must-use-container-ports  the upstream playbook serves federation on 8048 and no ports.internal.federation is declared for it
       - "{{ DOCKER_BIND_HOST }}:{{ MATRIX_FEDERATION_PORT }}:8048"
diff --git a/roles/web-app-matrix/templates/flavor/compose/services.yml.j2 b/roles/web-app-matrix/templates/flavor/compose/services.yml.j2
index 16e4954ca0..e24e06d6f3 100644
--- a/roles/web-app-matrix/templates/flavor/compose/services.yml.j2
+++ b/roles/web-app-matrix/templates/flavor/compose/services.yml.j2
@@ -1,7 +1,6 @@
 {% set service_name = 'synapse' %}
   {{ service_name }}:
 {% include 'roles/sys-svc-container/templates/deploy.yml.j2' %}
-{% set container_port = MATRIX_SYNAPSE_CONTAINER_PORT %}
     {{ lookup('container_image', application_id, 'synapse') }}
     {{ lookup('compose_only', 'container_name', MATRIX_SYNAPSE_NAME) }}
     {{ lookup('compose_restart') }}
@@ -11,8 +10,7 @@
     environment:
       - SYNAPSE_SERVER_NAME={{ MATRIX_SYNAPSE_DOMAIN }}
       - SYNAPSE_REPORT_STATS=no
-    ports:
-      - "{{ DOCKER_BIND_HOST }}:{{lookup('config', 'web-app-matrix', 'services.synapse.ports.local.http')}}:{{ container_port }}"
+    {{ lookup('container_ports', ['synapse', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_extra_hosts') | indent(4) }}
     {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_depends_on', application_id) | indent(4) }}
@@ -20,13 +18,11 @@
 {% set service_name = 'element' %}
   {{ service_name }}:
 {% include 'roles/sys-svc-container/templates/deploy.yml.j2' %}
-{% set container_port = lookup('config', application_id, 'services.' ~ service_name ~ '.ports.internal.http') %}
     {{ lookup('container_image', application_id, 'element') }}
     {{ lookup('compose_only', 'container_name', MATRIX_ELEMENT_NAME) }}
     {{ lookup('compose_restart') }}
     {{ lookup('container_volumes', service_name) | indent(4) }}
-    ports:
-      - "{{ DOCKER_BIND_HOST }}:{{ MATRIX_ELEMENT_PORT }}:{{ container_port }}"
+    {{ lookup('container_ports', ['element', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_healthcheck', service_name) | indent(4) }}
     {{ lookup('container_networks') | indent(4) }}
 
diff --git a/roles/web-app-mattermost/meta/services.yml b/roles/web-app-mattermost/meta/services.yml
index 7964054a8d..c02e2a8a69 100644
--- a/roles/web-app-mattermost/meta/services.yml
+++ b/roles/web-app-mattermost/meta/services.yml
@@ -113,10 +113,11 @@ container_backup: # nocheck: bond-baseline backup host joins outside the variant
   bond: 1
   enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
   shared: true
+# nocheck: dynamic-flag - the gateway is a single shared instance, never deployed per consumer
 litellm:
   bond: 0.5
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 # nocheck: playwright-service-flag  internal adapter sidecar, covered by the role's MCP spec
 # nocheck: dockerfile-custom  the Dockerfile is owned by svc-ai-mcp-adapter and staged per instance, so every adapter-backed provider shares one audited build
 # nocheck: dynamic-flag  the sidecar tracks this role's own mcp flag, not another role's presence; a group_names expression would decide its exposure from an unrelated deployment
diff --git a/roles/web-app-mattermost/meta/variants.yml b/roles/web-app-mattermost/meta/variants.yml
index a4d3ad527a..6f53b2a005 100644
--- a/roles/web-app-mattermost/meta/variants.yml
+++ b/roles/web-app-mattermost/meta/variants.yml
@@ -37,7 +37,6 @@
       shared: true
     litellm:
       enabled: false
-      shared: false
     tor:
       enabled: true
     openwebui:
@@ -83,7 +82,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false
     tor:
       enabled: true
     openwebui:
@@ -130,7 +128,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: true
-      shared: true
     tor:
       enabled: true
     openwebui:
diff --git a/roles/web-app-mattermost/tasks/utils/ai_gateway.yml b/roles/web-app-mattermost/tasks/utils/ai_gateway.yml
index be9ad2edfb..12cf167c38 100644
--- a/roles/web-app-mattermost/tasks/utils/ai_gateway.yml
+++ b/roles/web-app-mattermost/tasks/utils/ai_gateway.yml
@@ -107,7 +107,7 @@
       model {{ LITELLM_CHAT_MODEL }}), so prompts would leave the deployment,
       use a model the gateway does not serve, or carry a stale virtual key.
       An empty model means the gateway serves none: neither svc-ai-ollama nor
-      svc-ai-lmstudio is in this deployment and OPENROUTER_API_KEY is empty.
+      svc-ai-lmstudio is in this deployment and no remote provider key is set.
 
 - name: "🔎 Mattermost | Wait for the Agents plugin to provision its bot account"
   database_query:
diff --git a/roles/web-app-mattermost/templates/javascript.js.j2 b/roles/web-app-mattermost/templates/javascript.js.j2
index b96dc1378e..4dec5e539a 100644
--- a/roles/web-app-mattermost/templates/javascript.js.j2
+++ b/roles/web-app-mattermost/templates/javascript.js.j2
@@ -5,7 +5,7 @@ window.addEventListener("DOMContentLoaded", function () {
         // Rename if Mattermost ever renders the GitLab button natively
         document.querySelectorAll("a[href*='/oauth/gitlab/']").forEach(function (el) {
             if (el.textContent.trim() === "GitLab") {
-                el.textContent = "SSO with Infinito.Nexus";
+                el.textContent = "SSO with {{ SOFTWARE_NAME }}";
             }
         });
 
@@ -19,7 +19,7 @@ window.addEventListener("DOMContentLoaded", function () {
 
         var a = document.createElement("a");
         a.href = "/oauth/gitlab/login";
-        a.textContent = "SSO with Infinito.Nexus";
+        a.textContent = "SSO with {{ SOFTWARE_NAME }}";
         a.className = "btn btn-primary login-body-card-form-button-submit large";
         a.style.cssText = "display:flex;align-items:center;justify-content:center;width:100%;box-sizing:border-box;margin:20px 0 0 0;";
         btn.parentNode.insertBefore(a, btn.nextSibling);
diff --git a/roles/web-app-mattermost/templates/playwright.env.j2 b/roles/web-app-mattermost/templates/playwright.env.j2
index 44e5be9c6e..4f807ed924 100644
--- a/roles/web-app-mattermost/templates/playwright.env.j2
+++ b/roles/web-app-mattermost/templates/playwright.env.j2
@@ -36,7 +36,7 @@ MCP_SERVICE_ENABLED={{ lookup('config', application_id, 'mcp.enabled') | string
 OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}
 
 
-# nocheck: persona-block-rationale — Mattermost Team Edition has no native OIDC provider, so this role piggybacks Keycloak onto the GitLab OAuth slot (vars/main.yml, MM_GITLABSETTINGS_* in templates/env.j2); the entry point is a[href='/oauth/gitlab/login'] relabelled "SSO with Infinito.Nexus" by templates/javascript.js.j2, which the shared helper's name-based login matcher does not match, and Mattermost v11+ first serves a /landing interstitial that only clears once localStorage.__landingPageSeen__ is seeded before navigation — the shared helper has no init-script hook (see README "Persona contract opt-outs").
+# nocheck: persona-block-rationale — Mattermost Team Edition has no native OIDC provider, so this role piggybacks Keycloak onto the GitLab OAuth slot (vars/main.yml, MM_GITLABSETTINGS_* in templates/env.j2); the entry point is a[href='/oauth/gitlab/login'] relabelled "SSO with {{ SOFTWARE_NAME }}" by templates/javascript.js.j2, which the shared helper's name-based login matcher does not match, and Mattermost v11+ first serves a /landing interstitial that only clears once localStorage.__landingPageSeen__ is seeded before navigation — the shared helper has no init-script hook (see README "Persona contract opt-outs").
 PERSONA_ADMINISTRATOR_BLOCKED=true
 
 # nocheck: persona-block-rationale — see PERSONA_ADMINISTRATOR_BLOCKED above.
diff --git a/roles/web-app-mediawiki/meta/services.yml b/roles/web-app-mediawiki/meta/services.yml
index b1057e1216..8bd87a6e9c 100644
--- a/roles/web-app-mediawiki/meta/services.yml
+++ b/roles/web-app-mediawiki/meta/services.yml
@@ -1,9 +1,9 @@
 ---
-# nocheck: playwright-service-flag - shared gateway consumer; inference wiring is covered by the gateway role
+# nocheck: playwright-service-flag, dynamic-flag - shared gateway consumer; inference wiring is covered by the gateway role, and the gateway is a single shared instance
 litellm:
   bond: 0.5
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 # nocheck: seaweedfs-required — object storage not implemented for this role
 sso:
   bond: 1
diff --git a/roles/web-app-mediawiki/meta/variants.yml b/roles/web-app-mediawiki/meta/variants.yml
index 03d842033d..bd762b7a90 100644
--- a/roles/web-app-mediawiki/meta/variants.yml
+++ b/roles/web-app-mediawiki/meta/variants.yml
@@ -26,7 +26,6 @@
       shared: true
     litellm:
       enabled: true
-      shared: true
     sso:
       enabled: true
       shared: true
@@ -58,7 +57,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false
     sso:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -91,7 +89,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: true
-      shared: true
     sso:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
diff --git a/roles/web-app-mediawiki/templates/style.css.j2 b/roles/web-app-mediawiki/templates/style.css.j2
index b5b5fcfb1d..68379bc125 100644
--- a/roles/web-app-mediawiki/templates/style.css.j2
+++ b/roles/web-app-mediawiki/templates/style.css.j2
@@ -1,4 +1,4 @@
-/* MediaWiki (Vector 2022 + OOUI) color remap via Infinito.Nexus palette
+/* MediaWiki (Vector 2022 + OOUI) color remap via {{ SOFTWARE_NAME }} palette
    - Keep changes scoped and variable-driven
    - Prefer variables over hard values
    - Avoid !important unless an inline style or strong OOUI rule requires it
diff --git a/roles/web-app-mig/meta/services.yml b/roles/web-app-mig/meta/services.yml
index a21a0d5290..feb3a06616 100644
--- a/roles/web-app-mig/meta/services.yml
+++ b/roles/web-app-mig/meta/services.yml
@@ -34,6 +34,7 @@ mig:
     swarm:
       enabled: true
   image: ghcr.io/kevinveenbirkenbach/infinito-mig
+  # nocheck: docker-version -- this registry carries exactly 1 tag; the image is built from this project and has no release line yet
   version: latest
   name: mig
   min_storage: 1224MB
diff --git a/roles/web-app-moodle/meta/services.yml b/roles/web-app-moodle/meta/services.yml
index 4775c187a6..b80661b5db 100644
--- a/roles/web-app-moodle/meta/services.yml
+++ b/roles/web-app-moodle/meta/services.yml
@@ -1,8 +1,9 @@
 ---
+# nocheck: dynamic-flag - the gateway is a single shared instance, never deployed per consumer
 litellm:
   bond: 0.5
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 # nocheck: seaweedfs-required — object storage not implemented for this role
 sso:
   bond: 1
diff --git a/roles/web-app-moodle/meta/variants.yml b/roles/web-app-moodle/meta/variants.yml
index 73a44039ba..37f229dd12 100644
--- a/roles/web-app-moodle/meta/variants.yml
+++ b/roles/web-app-moodle/meta/variants.yml
@@ -38,7 +38,6 @@
       shared: true
     litellm:
       enabled: false
-      shared: false
     tor:
       enabled: true
 
@@ -83,7 +82,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false
     tor:
       enabled: true
     openwebui:
@@ -128,7 +126,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: true
-      shared: true
     tor:
       enabled: true
     openwebui:
diff --git a/roles/web-app-moodle/templates/compose.yml.j2 b/roles/web-app-moodle/templates/compose.yml.j2
index 5ce0b89800..0bb8966b57 100644
--- a/roles/web-app-moodle/templates/compose.yml.j2
+++ b/roles/web-app-moodle/templates/compose.yml.j2
@@ -40,8 +40,7 @@
     {{ lookup('compose_only', 'container_name', MOODLE_NGINX_CONTAINER) }}
     {{ lookup('container_image', application_id, 'nginx') }}
     {{ lookup('depends_on', {'moodle': 'service_healthy'}) }}
-    ports:
-      - {{ DOCKER_BIND_HOST }}:{{ lookup('config', application_id, 'services.moodle.ports.local.http') }}:{{ MOODLE_NGINX_PORT }}
+    {{ lookup('container_ports', ['moodle', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_volumes', service_name) | indent(4) }}
     {{ lookup('compose_restart') }}
     {{ lookup('container_networks') | indent(4) }}
diff --git a/roles/web-app-n8n/meta/services.yml b/roles/web-app-n8n/meta/services.yml
index f207224900..9fceb2650a 100644
--- a/roles/web-app-n8n/meta/services.yml
+++ b/roles/web-app-n8n/meta/services.yml
@@ -93,10 +93,11 @@ container_backup: # nocheck: bond-baseline backup host joins outside the variant
   bond: 1
   enabled: "{{ 'svc-bkp-volume-2-local' in group_names }}"
   shared: true
+# nocheck: dynamic-flag - the gateway is a single shared instance, never deployed per consumer
 litellm:
   bond: 0.5
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 # nocheck: playwright-service-flag  MCP pairing is proven by the role's own MCP spec, not by a per-consumer gate
 openwebui:
   bond: 0.5
diff --git a/roles/web-app-n8n/meta/variants.yml b/roles/web-app-n8n/meta/variants.yml
index ff9e40548d..a4de279d1d 100644
--- a/roles/web-app-n8n/meta/variants.yml
+++ b/roles/web-app-n8n/meta/variants.yml
@@ -27,7 +27,6 @@
       shared: true
     litellm:
       enabled: true
-      shared: true
     tor:
       enabled: true
 
@@ -69,7 +68,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false
     tor:
       enabled: true
     openwebui:
diff --git a/roles/web-app-nextcloud/meta/addons/integration_github.yml b/roles/web-app-nextcloud/meta/addons/integration_github.yml
index 5e3f59fab0..b409c441a0 100644
--- a/roles/web-app-nextcloud/meta/addons/integration_github.yml
+++ b/roles/web-app-nextcloud/meta/addons/integration_github.yml
@@ -1,5 +1,5 @@
 ---
-enabled: "{{ (lookup('api', 'github.client_id') | length > 0) and (lookup('api', 'github.client_secret') | length > 0) }}"
+enabled: "{{ lookup('api_enabled', 'github') }}"
 required: true
 mechanism: plugin
 source: upstream
diff --git a/roles/web-app-nextcloud/meta/addons/integration_google.yml b/roles/web-app-nextcloud/meta/addons/integration_google.yml
index 98e6def4dd..c96349ab13 100644
--- a/roles/web-app-nextcloud/meta/addons/integration_google.yml
+++ b/roles/web-app-nextcloud/meta/addons/integration_google.yml
@@ -1,5 +1,5 @@
 ---
-enabled: "{{ (lookup('api', 'google.client_id') | length > 0) and (lookup('api', 'google.client_secret') | length > 0) }}"
+enabled: "{{ lookup('api_enabled', 'google') }}"
 required: true
 mechanism: plugin
 source: upstream
diff --git a/roles/web-app-nextcloud/meta/addons/integration_jira.yml b/roles/web-app-nextcloud/meta/addons/integration_jira.yml
index 0b08bd9d25..94c1f2a096 100644
--- a/roles/web-app-nextcloud/meta/addons/integration_jira.yml
+++ b/roles/web-app-nextcloud/meta/addons/integration_jira.yml
@@ -1,5 +1,5 @@
 ---
-enabled: "{{ (lookup('api', 'jira.client_id') | length > 0) and (lookup('api', 'jira.client_secret') | length > 0) }}"
+enabled: "{{ lookup('api_enabled', 'jira') }}"
 required: true
 mechanism: plugin
 source: upstream
diff --git a/roles/web-app-nextcloud/meta/addons/onlyoffice.yml b/roles/web-app-nextcloud/meta/addons/onlyoffice.yml
index c319f03d69..00a09a6158 100644
--- a/roles/web-app-nextcloud/meta/addons/onlyoffice.yml
+++ b/roles/web-app-nextcloud/meta/addons/onlyoffice.yml
@@ -10,6 +10,7 @@ update:
   catalog: nextcloud-appstore
   upstream_id: onlyoffice
 config:
+  archive: "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v10.1.2/onlyoffice.tar.gz"
   incompatible_plugins:
     - richdocuments
     - fileslibreofficeedit
diff --git a/roles/web-app-nextcloud/meta/services.yml b/roles/web-app-nextcloud/meta/services.yml
index a50f1ac4ed..228a5b4300 100644
--- a/roles/web-app-nextcloud/meta/services.yml
+++ b/roles/web-app-nextcloud/meta/services.yml
@@ -197,6 +197,7 @@ talk:
   shared: "{{ 'web-svc-coturn' in group_names }}"
   name: nextcloud-talk
   image: nextcloud/aio-talk
+  # nocheck: docker-version -- all 174 tags upstream publishes are AIO build stamps, none is a version
   version: latest
   backup:
     no_stop_required: false
@@ -271,6 +272,7 @@ talk_recording:
   shared: false
   name: nextcloud-talk-recording
   image: nextcloud/aio-talk-recording
+  # nocheck: docker-version -- all 104 tags upstream publishes are AIO build stamps, none is a version
   version: latest
   backup:
     no_stop_required: true
@@ -335,11 +337,11 @@ openwebui:
   bond: 0.5
   enabled: "{{ 'web-app-openwebui' in group_names }}"
   shared: "{{ 'web-app-openwebui' in group_names }}"
-# nocheck: playwright-service-flag: bridged litellm gateway partner, covered by partner role spec
+# nocheck: playwright-service-flag, dynamic-flag - bridged litellm gateway partner, covered by partner role spec, and a single shared instance
 litellm:
   bond: 0.5
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 # nocheck: playwright-service-flag: bridged mastodon partner, covered by partner role spec
 mastodon:
   bond: 0.5
diff --git a/roles/web-app-nextcloud/meta/variants.yml b/roles/web-app-nextcloud/meta/variants.yml
index 29528ef52e..5dad822253 100644
--- a/roles/web-app-nextcloud/meta/variants.yml
+++ b/roles/web-app-nextcloud/meta/variants.yml
@@ -96,7 +96,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -193,7 +192,6 @@
       shared: true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -332,7 +330,6 @@
       shared: true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -427,7 +424,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -522,7 +518,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: true
       shared: true
@@ -617,7 +612,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -712,7 +706,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -807,7 +800,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: true
-      shared: true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -902,7 +894,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -997,7 +988,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -1092,7 +1082,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -1187,7 +1176,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -1282,7 +1270,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -1377,7 +1364,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: true
-      shared: true
     mastodon:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
diff --git a/roles/web-app-nextcloud/tasks/02_manager_ops/03_upgrade.yml b/roles/web-app-nextcloud/tasks/02_manager_ops/03_upgrade.yml
index 9b7abf8f3b..c4960649e0 100644
--- a/roles/web-app-nextcloud/tasks/02_manager_ops/03_upgrade.yml
+++ b/roles/web-app-nextcloud/tasks/02_manager_ops/03_upgrade.yml
@@ -22,6 +22,30 @@
   retries: 2
   delay: 3
   until: occ_app_update.rc == 0
+  when: NEXTCLOUD_PINNED_PLUGINS | length == 0
+
+- name: 🔍 Nextcloud | List the apps the appstore offers an update for
+  shell: "{{ NEXTCLOUD_DOCKER_EXEC_OCC }} app:update --all --showonly"
+  register: occ_app_updatable
+  changed_when: false
+  retries: 2
+  delay: 3
+  until: occ_app_updatable.rc == 0
+  when: NEXTCLOUD_PINNED_PLUGINS | length > 0
+
+- name: 🔄 Nextcloud | App update, leaving the pinned releases alone
+  shell: "{{ NEXTCLOUD_DOCKER_EXEC_OCC }} app:update {{ item | quote }}"
+  register: occ_app_update_unpinned
+  changed_when: "'No apps found for update' not in occ_app_update_unpinned.stdout"
+  retries: 2
+  delay: 3
+  until: occ_app_update_unpinned.rc == 0
+  when: NEXTCLOUD_PINNED_PLUGINS | length > 0
+  loop: >-
+    {{ occ_app_updatable.stdout_lines | default([])
+       | select('search', ' new version available')
+       | map('regex_replace', ' new version available.*$', '')
+       | difference(NEXTCLOUD_PINNED_PLUGINS) }}
 
 - name: ➕ Nextcloud | Add missing columns
   shell: "{{ NEXTCLOUD_DOCKER_EXEC_OCC }} db:add-missing-columns"
diff --git a/roles/web-app-nextcloud/tasks/02_manager_ops/06_plugin/01_install.yml b/roles/web-app-nextcloud/tasks/02_manager_ops/06_plugin/01_install.yml
index c92cb89644..a9810511df 100644
--- a/roles/web-app-nextcloud/tasks/02_manager_ops/06_plugin/01_install.yml
+++ b/roles/web-app-nextcloud/tasks/02_manager_ops/06_plugin/01_install.yml
@@ -4,6 +4,24 @@
   ansible.builtin.set_fact:
     plugin_incompatible: "{{ plugin_value.config.incompatible_plugins | default(plugin_value.incompatible_plugins | default([])) }}"
     plugin_mandatory: "{{ plugin_value.config.mandatory | default(plugin_value.mandatory | default(false)) }}"
+    plugin_archive: "{{ plugin_value.config.archive | default(plugin_value.archive | default('')) }}"
+  changed_when: false
+
+- name: "⬇️ Stage the pinned {{ plugin_key }} release on the node"
+  get_url_retry:
+    url: "{{ plugin_archive }}"
+    dest: "/tmp/nextcloud-plugin-{{ plugin_key }}.tar.gz"
+    mode: "0644"
+  when: plugin_archive | length > 0
+
+- name: "📦 Unpack the pinned {{ plugin_key }} release so occ finds it installed"
+  ansible.builtin.shell: >-
+    cat /tmp/nextcloud-plugin-{{ plugin_key }}.tar.gz
+    | {{ NEXTCLOUD_DOCKER_EXEC_INTERACTIVE }}
+    tar -xzf - -C {{ NEXTCLOUD_APPS_DIRECTORY | quote }}
+  args:
+    executable: /bin/bash
+  when: plugin_archive | length > 0
   changed_when: false
 
 - name: "🔴 Disable incompatible plugins for {{ plugin_key }} (batched shell, no async)"
diff --git a/roles/web-app-nextcloud/templates/compose.yml.j2 b/roles/web-app-nextcloud/templates/compose.yml.j2
index cb6e1b68a1..c4a1edb7ee 100644
--- a/roles/web-app-nextcloud/templates/compose.yml.j2
+++ b/roles/web-app-nextcloud/templates/compose.yml.j2
@@ -75,11 +75,13 @@
     init: true
     {% if NEXTCLOUD_HPB_NETWORK_MODE == 'bridge' %}
     {% if NEXTCLOUD_HPB_TURN_ONBOARD_ENABLED | bool and NEXTCLOUD_HPB_TURN_ONBOARD_PUBLISH_PORTS | bool %}
-    ports:
-      - {{ NEXTCLOUD_HPB_TURN_ONBOARD_BIND_HOST }}:{{ NEXTCLOUD_HPB_TURN_ONBOARD_PORT }}:{{ NEXTCLOUD_HPB_TURN_ONBOARD_PORT }}/tcp # nocheck: compose-ports-must-use-container-ports
-      - {{ NEXTCLOUD_HPB_TURN_ONBOARD_BIND_HOST }}:{{ NEXTCLOUD_HPB_TURN_ONBOARD_PORT }}:{{ NEXTCLOUD_HPB_TURN_ONBOARD_PORT }}/udp # nocheck: compose-ports-must-use-container-ports
-      - {{ NEXTCLOUD_HPB_TURN_ONBOARD_BIND_HOST }}:{{ NEXTCLOUD_HPB_TURN_ONBOARD_RELAY_PORT_START }}-{{ NEXTCLOUD_HPB_TURN_ONBOARD_RELAY_PORT_END }}:{{ NEXTCLOUD_HPB_TURN_ONBOARD_RELAY_PORT_START }}-{{ NEXTCLOUD_HPB_TURN_ONBOARD_RELAY_PORT_END }}/udp # nocheck: compose-ports-must-use-container-ports
-      - {{ NEXTCLOUD_HPB_TURN_ONBOARD_BIND_HOST }}:{{ NEXTCLOUD_HPB_TURN_ONBOARD_RELAY_PORT_START }}-{{ NEXTCLOUD_HPB_TURN_ONBOARD_RELAY_PORT_END }}:{{ NEXTCLOUD_HPB_TURN_ONBOARD_RELAY_PORT_START }}-{{ NEXTCLOUD_HPB_TURN_ONBOARD_RELAY_PORT_END }}/tcp # nocheck: compose-ports-must-use-container-ports
+    {{ lookup('container_ports',
+              {'service': 'nextcloud', 'protocol': 'stun_turn',
+               'ip': NEXTCLOUD_HPB_TURN_ONBOARD_BIND_HOST,
+               'transport': ['tcp', 'udp'], 'container': 'same'},
+              {'service': 'nextcloud', 'protocol': 'relay',
+               'ip': NEXTCLOUD_HPB_TURN_ONBOARD_BIND_HOST,
+               'transport': ['udp', 'tcp'], 'container': 'same'}) | indent(4) }}
     {% endif %}
     expose:
       - "{{ container_port }}"
diff --git a/roles/web-app-nextcloud/vars/main.yml b/roles/web-app-nextcloud/vars/main.yml
index cee723dad1..f0cdb2c8c5 100644
--- a/roles/web-app-nextcloud/vars/main.yml
+++ b/roles/web-app-nextcloud/vars/main.yml
@@ -18,6 +18,11 @@ NEXTCLOUD_OIDC_HOST: "{{ lookup('tls', 'web-app-keycloak', 'domain') }}"
 NEXTCLOUD_TOR_SOCKS_PROXY: "{{ lookup('tor_socks_proxy') }}"
 
 NEXTCLOUD_PLUGIN_ITEMS: "{{ lookup('config', application_id, 'addons') | dict2items }}"
+NEXTCLOUD_PINNED_PLUGINS: >-
+  {{ NEXTCLOUD_PLUGIN_ITEMS
+     | selectattr('value.config.archive', 'defined')
+     | selectattr('value.enabled', 'true')
+     | map(attribute='key') | list }}
 NEXTCLOUD_PLUGINS_ENABLED: "{{ lookup('config', application_id, 'services.nextcloud.plugins_enabled') }}"
 NEXTCLOUD_USER_LDAP_ENABLED: "{{ lookup('config', application_id, 'addons.user_ldap.enabled') }}"
 NEXTCLOUD_LDAP_CONFIG_PREFIX: "s01"
@@ -221,7 +226,9 @@ NEXTCLOUD_DOCKER_USER: "www-data"
 NEXTCLOUD_FPM_PORT: "{{ lookup('config', application_id, 'services.nextcloud.ports.internal.fpm') }}"
 
 NEXTCLOUD_INTERNAL_OCC_COMMAND: "{{ [ NEXTCLOUD_DOCKER_WORK_DIRECTORY, 'occ'] | path_join }}"
+NEXTCLOUD_APPS_DIRECTORY: "{{ [ NEXTCLOUD_DOCKER_WORK_DIRECTORY, 'custom_apps'] | path_join }}"
 NEXTCLOUD_DOCKER_EXEC: "container exec -u {{ NEXTCLOUD_DOCKER_USER }} {{ NEXTCLOUD_LOCAL_CID | quote }}" # nocheck: container-exec-resolver  NEXTCLOUD_LOCAL_CID resolved at delegate_to runtime; container_address would return a manager-only subshell
 NEXTCLOUD_DOCKER_EXEC_OCC: "{{ NEXTCLOUD_DOCKER_EXEC }} {{ NEXTCLOUD_INTERNAL_OCC_COMMAND }}"
+NEXTCLOUD_DOCKER_EXEC_INTERACTIVE: "container exec -i -u {{ NEXTCLOUD_DOCKER_USER }} {{ NEXTCLOUD_LOCAL_CID | quote }}" # nocheck: container-exec-resolver  NEXTCLOUD_LOCAL_CID resolved at delegate_to runtime, as for NEXTCLOUD_DOCKER_EXEC
 
 NEXTCLOUD_REDIS_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, 'redis') }}"
diff --git a/roles/web-app-openbao/README.md b/roles/web-app-openbao/README.md
index 635589502a..d5226a022f 100644
--- a/roles/web-app-openbao/README.md
+++ b/roles/web-app-openbao/README.md
@@ -106,28 +106,16 @@ docker run --rm -it \
 
 ## Developer Notes
 
-- **The seal key is the whole ballgame.** The `static` seal encrypts the raft root key with a 32-byte key generated into the ansible-vault-encrypted inventory as `secrets.credentials.seal_key` and injected as `env://OPENBAO_SEAL_KEY`. A backup of the raft volume is **undecryptable without that key**, and the key is *not* covered by `svc-bkp-secrets-2-local` (whose sources are `DIR_SECRETS`, the root CA and the ACME material). The inventory is its authoritative home — back the inventory up accordingly. Upstream considers a static seal appropriate only where an existing source of trust already holds the key; here that source is the encrypted inventory, at the same trust level as every other platform credential.
-- **Recovery keys are generated and then deliberately discarded.** Initialising with an auto-seal yields *recovery* keys rather than unseal shares. They cannot decrypt the root key — only the seal key can — so they are not disaster-recovery material for the data; they only authorise `operator generate-root` and `operator rekey`. Persisting them would mean writing OpenBao-generated secrets back into the inventory, which is exactly what the AppRole bootstrap exists to avoid, so the play does not keep them. **The consequence is explicit: the Ansible AppRole is the only administrative path into this instance.** If its RoleID/SecretID are changed out-of-band inside OpenBao, there is no way back in and the instance must be rebuilt from the volume backup plus the seal key. Re-running the role does not repair that, because reconciliation itself authenticates with the AppRole — the rotation fallback below only covers the credentials the role itself applied.
-- **Bootstrap leaves no stored root token.** The first deploy runs `bao operator init`, holds the root token in memory only, enables AppRole, pins both the RoleID and the SecretID to inventory-generated values via `auth/approle/role/<role>/role-id` and `.../custom-secret-id`, then revokes the root token. Every later deploy logs in with those inventory credentials, so nothing OpenBao generates is ever written back into the inventory. Tokens reach the CLI through stdin and the container token helper, never through process arguments, and the helper file is removed at the end of the run.
-- **Policies live outside the config directory.** OpenBao parses every file in `-config` as server configuration, so the RBAC policy `.hcl` files are mounted at `/openbao/policies/` instead of `/openbao/config/`.
-- **Storage path is `/openbao/file`, not `/openbao/data`.** The image runs as the non-root `openbao` user and pre-chowns only `/openbao/{config,logs,file}`. A fresh named volume inherits ownership from the image path, so raft can write there; a volume at `/openbao/data` would land root-owned and fail.
-- **`command:` is just `server`.** The image entrypoint appends `-config=/openbao/config` itself; passing an explicit `-config` duplicates the flag.
-- **CLI OIDC login is out of scope.** The `redirect_uris` lookup registers `https://<domain>/*` per SSO consumer, which covers the UI and API callbacks but not the CLI's `http://localhost:8250/oidc/callback`. Use AppRole for non-interactive access.
-- **Visiting `/ui/vault/logout` does not end the session.** Measured against a live instance: after that navigation the UI returns to `/ui/vault/secrets` still authenticated, because the Ember app restores its token from browser storage. Use the UI's own logout control, or clear site data, when you actually need the session gone.
-- **Do not alert on `vault_core_unsealed`.** OpenBao keeps Vault's `vault_*` metric namespace, and on a healthy unsealed node this gauge is emitted as `vault_core_unsealed{cluster=""} 0` — an alert on `== 0` fires permanently. Use `/v1/sys/health` (503 while sealed) as the seal signal; `vault_core_active{cluster="…"} == 1` corroborates from the metrics side.
-- **Swarm:** single replica, `placement: manager`, `nfs: false` on the raft volume and `service_update_order = stop-first` — raft's BoltDB store is mmap + `fsync` based, so it must stay node-local and must never have two tasks writing the same directory.
-- **The RBAC tiers are proven by moving `biber` through the groups, not by dedicated accounts.** `files/playwright/test-rbac-groups.js` signs the administrator into LAM, adds `biber` to `cn=web-app-openbao-<role>,ou=roles` through LAM's Multi edit tool, logs `biber` into OpenBao over LDAP and asserts both the policy set and the capability that tier grants, then removes him again and asserts the revoke. One account covers all three tiers, and the grant and the revoke are observed rather than assumed — a permanently-assigned member can only ever show a steady state. LAM's *group list* cannot be used for this: it renders `posixGroup` entries, while the RBAC role groups are `groupOfNames` under `ou=roles`. LAM applies the change asynchronously, so the spec polls the resulting policy set instead of LAM's own progress wording.
-- **Every deploy rotates the credentials, and the role is built around that.** The platform regenerates generated-algorithm credentials on each deploy — that is how a changed Ansible password reaches the application instead of silently diverging from it. For OpenBao it means the `seal_key` and the AppRole `role_id`/`secret_id` a run is handed are *not* the ones the running instance was configured with, which would otherwise leave the node sealed (`initialized: true, sealed: true`) and the AppRole answering `invalid role or secret ID`. The role therefore carries the transition itself:
-  - `tasks/06_rotate.yml` records what each deploy actually applied in `.applied.json` inside the compose project directory, `0600`, root-owned. The directory already holds the seal key in plaintext in `.env/env`, so this adds no new exposure class.
-  - `tasks/00_core.yml` reads that file back **before** `sys-stk-backend` renders `env.j2` — the rendered env must already carry `OPENBAO_SEAL_KEY_PREVIOUS`, or the node comes up with no way to decrypt its own store.
-  - `templates/openbao.hcl.j2` emits the `previous_key_id`/`previous_key` pair only while the two keys differ. The static seal supports `n-1` → `n` rotation, so the node unseals with the old key and rewraps to the new one.
-  - `tasks/01_init.yml` attempts the AppRole login with the inventory credentials, falls back to the recorded ones, and fails loudly when neither is accepted. Whichever one was accepted is the SecretID OpenBao actually holds, so that is what `tasks/06_rotate.yml` destroys after registering the new one — rotation that only adds would revoke nothing.
-  - `auth/approle/role/<role>/custom-secret-id` is **not** idempotent: writing a SecretID the role already holds answers `500 … SecretID is already registered`. The swap is therefore gated on the value having actually changed, which is also why the bootstrap in `tasks/02_auth.yml` pins directly instead of sharing the rotation path — at that point nothing is registered yet.
-  - `current_key_id` is derived as a short hash of the key rather than a counter. Upstream requires the identifier to match its key; a derived id cannot drift out of step with one, and no deploy has to know which generation it is.
-  The record is written last, after both pins, so a run that dies partway leaves the previous generation intact and the next deploy still authenticates. The one uncovered window is a failure *between* the two pins — the RoleID re-pinned, the SecretID not, or the reverse — which leaves a pairing neither the inventory nor the state file describes. Two generations is the whole window. Anything that skips a rotation puts the store outside it, and the instance is then recoverable only from its volume backup plus the matching seal key. The concrete way to do that is `MODE_RESET`: `sys-svc-compose/tasks/01_reset.yml` removes `DIR_COMPOSITIONS` wholesale while the named volumes survive, so the raft store outlives the record of the key that wraps it. Purge the entity's volumes too when you reset — the same asymmetry breaks every entity that keeps a credential inside its volume.
-- **Other entities still desynchronise the same way, and those are not defects.** A surviving `mariadb_data` fails its healthcheck with `Access denied for user 'root'@'127.0.0.1'` for exactly the reason above, without a rotation path of its own. CI never sees it because every run starts clean; locally, run `make compose-entity-purge apps=<entity>` before redeploying.
-- **A role-declared account cannot be logged in as unless it sets a password.** The tiers were first covered by two role-local accounts, `baooperator` and `baoreader`, which deployed and joined their RBAC groups correctly but returned 403 on every LDAP bind: a user declared without an explicit `password` inherits the `strong_password` fallback expression, which is re-evaluated on every render (`secrets.choice`, nothing persisted), so the value `svc-db-openldap` writes with `ldap_passwd` and the value `playwright.env.j2` renders can be different strings. Both accounts are gone now — the tiers are covered by moving `biber` through the groups instead — but the trap applies to any future role-declared account something has to authenticate as. Until [`f4398e1c5`](https://github.com/kevinveenbirkenbach/infinito-nexus-core/commit/f4398e1c58f3ce7d8d429472b2a023033242d747) is available here (it pins a password per declared user at inventory creation), such an account needs an explicit `password:`, as `user-administrator` and `web-app-semaphore` do.
-- **Alert rules ship with the role.** `templates/prometheus/alert_rules.yml.j2` is discovered by the `alert_rule_roles` lookup and concatenated into the Prometheus rule file, so the seal alert lives next to the thing it watches. The fragment must start at the `groups:` item level (two-space-indented `- name:` entries).
+- **The seal key is the whole ballgame.** The `static` seal wraps the raft root key with `secrets.credentials.seal_key`, injected as `env://OPENBAO_SEAL_KEY`. A backup of the raft volume is **undecryptable without it**, and `svc-bkp-secrets-2-local` does not cover it — the encrypted inventory is its only home, so back the inventory up accordingly. It is pinned `rotatable: false`: the static seal carries one generation of slack, and spending that every deploy makes any skipped generation unrecoverable. Rotate it deliberately by changing the inventory value; `openbao.hcl.j2` then emits the `previous_key`/`previous_key_id` pair, the node unseals with the old key and rewraps to the new one.
+- **The recovery key is the way back in.** `bao operator init` issues it once and nothing reissues it, which is what makes it useful — it is the only authority here that does not rotate. It is persisted through `sys-token-store` (`DIR_SECRETS`, backed up, and it survives both `MODE_RESET` and a replaced manager, each of which takes `.applied.json` with it). When neither the inventory AppRole nor the recorded one is accepted, `tasks/utils/recover.yml` mints a root token from it and re-pins the AppRole. It cannot decrypt the store — only the seal key can — so it is not a substitute for backing up the inventory.
+- **Every deploy rotates the AppRole.** The `role_id`/`secret_id` a run is handed are not the ones the running instance holds. `tasks/01_init.yml` tries the inventory pair, falls back to the pair recorded in `.applied.json`, then `tasks/06_rotate.yml` re-pins to this run's values and destroys the old SecretID. The record is written last, so a run that dies partway leaves the previous generation intact. `custom-secret-id` is **not** idempotent — re-writing a held SecretID answers `500` — so the swap is gated on the value having changed.
+- **Bootstrap leaves no stored root token.** The first deploy holds it in memory, pins both AppRole halves to inventory values, then revokes it. Tokens reach the CLI through stdin and the container token helper, never through process arguments, and the helper file is removed at the end of the run.
+- **Paths that look wrong and are not.** Policies mount at `/openbao/policies/`, because OpenBao parses *every* file under `-config` as server configuration. Storage is `/openbao/file`, not `/openbao/data`: the image pre-chowns only `/openbao/{config,logs,file}` for the non-root `openbao` user, so a volume elsewhere lands root-owned and raft cannot write. `command:` is just `server` — the entrypoint appends `-config` itself, and passing it duplicates the flag.
+- **Do not alert on `vault_core_unsealed`.** OpenBao keeps Vault's metric namespace, and a healthy unsealed node emits `vault_core_unsealed{cluster=""} 0`, so an alert on `== 0` fires permanently. Use `/v1/sys/health` (503 while sealed); `vault_core_active{cluster="…"} == 1` corroborates.
+- **Alert rules ship with the role.** `templates/prometheus/alert_rules.yml.j2` is discovered by the `alert_rule_roles` lookup, which returns only roles that are actually scraped, so the fragment carries no activation guard of its own. It must start at the `groups:` item level.
+- **Swarm:** single replica, `placement: manager`, `nfs: false` on the raft volume, `service_update_order = stop-first`. Raft's BoltDB store is mmap + `fsync` based, so it must stay node-local and must never have two tasks writing one directory.
+- **CLI OIDC login is out of scope.** `redirect_uris` registers `https://<domain>/*`, covering UI and API callbacks but not the CLI's `http://localhost:8250/oidc/callback`. Use AppRole for non-interactive access.
+- **Test notes.** The RBAC tiers are proven by moving `biber` through the groups with LAM's Multi edit tool and asserting both the grant and the revoke, rather than by dedicated accounts. `/ui/vault/logout` does not end a session — the Ember app restores its token from browser storage — so use the UI's own logout control when the session must actually be gone.
 
 ### Backup and restore
 
diff --git a/roles/web-app-openbao/meta/secrets.yml b/roles/web-app-openbao/meta/secrets.yml
index 8bc1ec482a..bcf1f917fd 100644
--- a/roles/web-app-openbao/meta/secrets.yml
+++ b/roles/web-app-openbao/meta/secrets.yml
@@ -2,9 +2,12 @@
 credentials:
   seal_key:
     description: 32-byte AES-256-GCM-96 key for the OpenBao static seal, injected as env://OPENBAO_SEAL_KEY. Every backup of the raft volume is undecryptable
-      without it; its authoritative home is the encrypted inventory.
+      without it; its authoritative home is the encrypted inventory. Pinned because the static seal carries only one generation, so a deploy that skips a
+      generation, or dies between the two AppRole pins, puts the store outside that window and leaves it recoverable only from a volume backup plus the key
+      that wraps it. Rotate it deliberately by changing the inventory value; openbao.hcl.j2 still renders the previous_key pair for that.
     algorithm: random_hex_32
     validation: non_empty_string
+    rotatable: false
   approle_role_id:
     description: RoleID of the Ansible AppRole, written to auth/approle/role/ansible/role-id at bootstrap so later deploys authenticate without a stored root
       token.
diff --git a/roles/web-app-openbao/meta/services.yml b/roles/web-app-openbao/meta/services.yml
index bfe825ad8b..1f6c913ce8 100644
--- a/roles/web-app-openbao/meta/services.yml
+++ b/roles/web-app-openbao/meta/services.yml
@@ -67,12 +67,11 @@ openbao:
       http: 8093
   healthcheck:
     flavor: wget
-    # Exception: an uninitialised container must report healthy or the init task can never reach it.
     path: "v1/sys/health?uninitcode=200&sealedcode=200&standbyok=true"
   run_after:
     - web-app-keycloak
     - svc-db-openldap
-  lifecycle: alpha
+  lifecycle: beta
 
 # nocheck: playwright-service-flag
 # nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
diff --git a/roles/web-app-openbao/tasks/00_core.yml b/roles/web-app-openbao/tasks/00_core.yml
index fae44950be..1201b61e79 100644
--- a/roles/web-app-openbao/tasks/00_core.yml
+++ b/roles/web-app-openbao/tasks/00_core.yml
@@ -1,9 +1,6 @@
 ---
 - include_tasks: utils/once/flag.yml
 
-# Exception: must precede sys-stk-backend — that role renders env.j2, which
-# carries the previous seal key the node needs to unseal data the last deploy's
-# key wrapped. Moving it after leaves the node sealed with no way back.
 - name: "🔍 Read the credentials the previous deploy applied"
   ansible.builtin.slurp:
     src: "{{ OPENBAO_APPLIED_STATE_HOST }}"
diff --git a/roles/web-app-openbao/tasks/01_init.yml b/roles/web-app-openbao/tasks/01_init.yml
index b22bf3ecb5..2f268a1271 100644
--- a/roles/web-app-openbao/tasks/01_init.yml
+++ b/roles/web-app-openbao/tasks/01_init.yml
@@ -25,22 +25,34 @@
          if (openbao_status_raw.stdout | default('') | trim) | length > 0
          else false }}
 
-- name: "🔐 Initialise OpenBao (first deploy only)"
-  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
-    container exec {{ OPENBAO_LOCAL_CID | quote }}
-    bao operator init -format=json -recovery-shares=1 -recovery-threshold=1
-  register: openbao_init_raw
-  changed_when: openbao_init_raw.rc == 0
-  delegate_to: "{{ OPENBAO_HOST_NODE }}"
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+- name: "🔐 Initialise OpenBao and keep what only the first deploy ever sees"
   when: not (openbao_initialized | bool)
+  block:
+    - name: "🔐 Initialise OpenBao (first deploy only)"
+      ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+        container exec {{ OPENBAO_LOCAL_CID | quote }}
+        bao operator init -format=json -recovery-shares=1 -recovery-threshold=1
+      register: openbao_init_raw
+      changed_when: openbao_init_raw.rc == 0
+      delegate_to: "{{ OPENBAO_HOST_NODE }}"
+      no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
-- name: "🔧 Hold the bootstrap root token in memory only"
-  ansible.builtin.set_fact:
-    openbao_root_token: >-
-      {{ (openbao_init_raw.stdout | from_json).root_token }}
-  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
-  when: not (openbao_initialized | bool)
+    - name: "🔧 Hold the bootstrap root token in memory only"
+      ansible.builtin.set_fact:
+        openbao_root_token: >-
+          {{ (openbao_init_raw.stdout | from_json).root_token }}
+      no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
+    - name: "💾 Persist the recovery key through sys-token-store"
+      ansible.builtin.include_role:
+        name: sys-token-store
+        tasks_from: write.yml
+      vars:
+        sys_token_store_user_key: "{{ OPENBAO_RECOVERY_USER_KEY }}"
+        sys_token_store_app: "{{ OPENBAO_RECOVERY_TOKEN_APP }}"
+        sys_token_store_token: >-
+          {{ (openbao_init_raw.stdout | from_json).recovery_keys_b64 | first }}
+      no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
 - name: "⏳ Wait until the static seal has auto-unsealed the node"
   ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
@@ -59,6 +71,12 @@
   include_tasks: 02_auth.yml
   when: not (openbao_initialized | bool)
 
+- name: "🧩 Load the recovery key from the platform token store"
+  ansible.builtin.include_role:
+    name: sys-token-store
+    tasks_from: 01_load.yml
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
 - name: "🔐 Log in with the Ansible AppRole"
   ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
     container exec -i {{ OPENBAO_LOCAL_CID | quote }}
@@ -73,9 +91,6 @@
   delegate_to: "{{ OPENBAO_HOST_NODE }}"
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
-# Rationale: the credentials rotate every deploy, so the values this run was
-# handed are not yet the ones pinned inside OpenBao. Fall back to what the
-# previous deploy applied; 06_rotate.yml then re-pins to this run's values.
 - name: "🔐 Log in with the AppRole the previous deploy applied"
   ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
     container exec -i {{ OPENBAO_LOCAL_CID | quote }}
@@ -93,24 +108,51 @@
     - openbao_approle_login.rc != 0
     - OPENBAO_APPLIED.approle_role_id is defined
 
+- name: "🚑 Rebuild the AppRole from the recovery key when neither login is accepted"
+  when:
+    - openbao_approle_login.rc != 0
+    - (openbao_approle_login_previous.rc | default(1)) != 0
+    - (OPENBAO_RECOVERY_KEY | trim) | length > 0
+  block:
+    - name: "🚑 Mint a root token and re-pin the AppRole"
+      ansible.builtin.include_tasks: utils/recover.yml
+
+    - name: "🔐 Log in with the rebuilt AppRole"
+      ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+        container exec -i {{ OPENBAO_LOCAL_CID | quote }}
+        bao write -field=token auth/approle/login
+        role_id={{ OPENBAO_APPROLE_ROLE_ID | quote }} secret_id=-
+      args:
+        stdin: "{{ OPENBAO_APPROLE_SECRET_ID }}"
+        stdin_add_newline: false
+      register: openbao_approle_login_recovered
+      changed_when: false
+      failed_when: false
+      delegate_to: "{{ OPENBAO_HOST_NODE }}"
+      no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
 - name: "🔧 Keep whichever AppRole login succeeded"
   ansible.builtin.set_fact:
     openbao_approle_token: >-
       {{ openbao_approle_login.stdout
          if openbao_approle_login.rc == 0
-         else openbao_approle_login_previous.stdout | default('') }}
+         else (openbao_approle_login_previous.stdout
+               if (openbao_approle_login_previous.rc | default(1)) == 0
+               else openbao_approle_login_recovered.stdout | default('')) }}
     openbao_secret_id_registered: >-
       {{ OPENBAO_APPROLE_SECRET_ID
-         if openbao_approle_login.rc == 0
+         if (openbao_approle_login.rc == 0
+             or (openbao_approle_login_recovered.rc | default(1)) == 0)
          else OPENBAO_APPLIED.approle_secret_id | default('') }}
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
-- name: "🛑 Fail when neither the current nor the previously applied AppRole is accepted"
+- name: "🛑 Fail when no AppRole and no recovery key are accepted"
   ansible.builtin.fail:
     msg: >-
-      Neither the AppRole credentials from the inventory nor the ones recorded in
-      {{ OPENBAO_APPLIED_STATE_HOST }} were accepted. The instance can only be
-      recovered from its volume backup plus the matching seal key.
+      Neither the AppRole credentials from the inventory, nor the ones recorded
+      in {{ OPENBAO_APPLIED_STATE_HOST }}, nor a recovery key in the platform
+      token store were accepted. The instance can only be recovered from its
+      volume backup plus the matching seal key.
   when: (openbao_approle_token | trim) | length == 0
 
 - name: "🔧 Store the AppRole token in the container token helper"
diff --git a/roles/web-app-openbao/tasks/04_auth_methods.yml b/roles/web-app-openbao/tasks/04_auth_methods.yml
index 346a452543..ac49e7ab29 100644
--- a/roles/web-app-openbao/tasks/04_auth_methods.yml
+++ b/roles/web-app-openbao/tasks/04_auth_methods.yml
@@ -134,6 +134,5 @@
     loop_var: openbao_group
   vars:
     alias_mount: "ldap/"
-    # Rationale: the RBAC LDAP layout contract encodes the application into the group CN.
     alias_name: "{{ application_id }}-{{ openbao_group.item }}"
   when: OPENBAO_LDAP_ENABLED | bool
diff --git a/roles/web-app-openbao/tasks/06_rotate.yml b/roles/web-app-openbao/tasks/06_rotate.yml
index aa8fd31be8..481f61505f 100644
--- a/roles/web-app-openbao/tasks/06_rotate.yml
+++ b/roles/web-app-openbao/tasks/06_rotate.yml
@@ -1,8 +1,8 @@
 ---
 # Re-pin the AppRole to the credentials this deploy was handed, then record what
-# was applied. The platform rotates every generated credential per deploy, so the
-# values the next deploy receives will differ from these; the state file is what
-# lets that deploy still authenticate before it re-pins in turn.
+# was applied. The AppRole rotates per deploy, so the state file is what lets the
+# next one authenticate before it re-pins in turn. The seal key is pinned and
+# normally repeats; it is recorded for the deploy after an operator changes it.
 - name: "🔑 Re-pin the RoleID to the value this deploy was handed"
   ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
     container exec {{ OPENBAO_LOCAL_CID | quote }}
@@ -11,9 +11,6 @@
   changed_when: true
   delegate_to: "{{ OPENBAO_HOST_NODE }}"
 
-# Exception: writing custom-secret-id with a SecretID the role already holds is a
-# 500 "SecretID is already registered", not a no-op, so the swap has to be gated
-# on the value actually having changed.
 - name: "🔑 Register the SecretID this deploy was handed"
   ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
     container exec -i {{ OPENBAO_LOCAL_CID | quote }}
diff --git a/roles/web-app-openbao/tasks/utils/recover.yml b/roles/web-app-openbao/tasks/utils/recover.yml
new file mode 100644
index 0000000000..821ea6e762
--- /dev/null
+++ b/roles/web-app-openbao/tasks/utils/recover.yml
@@ -0,0 +1,75 @@
+---
+# Break-glass: mint a root token from the recovery key, then hand to 02_auth.yml
+# to re-pin the AppRole to the inventory values. Reached only when neither the
+# credentials this deploy was handed nor the recorded ones are accepted.
+#
+# Each protocol step runs through the bao CLI and Ansible parses the result: the
+# token comes back XOR-wrapped with a one-time password and the image carries
+# neither python nor jq to unwrap it in-container.
+
+- name: "🧹 Cancel any root generation left in progress"
+  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+    container exec {{ OPENBAO_LOCAL_CID | quote }}
+    bao operator generate-root -cancel
+  changed_when: false
+  failed_when: false
+  delegate_to: "{{ OPENBAO_HOST_NODE }}"
+
+- name: "🎲 Generate the one-time password the root token is wrapped with"
+  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+    container exec {{ OPENBAO_LOCAL_CID | quote }}
+    bao operator generate-root -generate-otp
+  register: openbao_root_otp
+  changed_when: false
+  delegate_to: "{{ OPENBAO_HOST_NODE }}"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
+- name: "🚑 Begin root generation"
+  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+    container exec {{ OPENBAO_LOCAL_CID | quote }}
+    bao operator generate-root -format=json
+    -init -otp={{ openbao_root_otp.stdout | trim | quote }}
+  register: openbao_root_attempt
+  changed_when: true
+  delegate_to: "{{ OPENBAO_HOST_NODE }}"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
+- name: "🔑 Authorise the attempt with the recovery key"
+  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+    container exec -i {{ OPENBAO_LOCAL_CID | quote }}
+    bao operator generate-root -format=json
+    -nonce={{ (openbao_root_attempt.stdout | from_json).nonce | quote }} -
+  args:
+    stdin: "{{ OPENBAO_RECOVERY_KEY }}"
+    stdin_add_newline: false
+  register: openbao_root_update
+  changed_when: true
+  delegate_to: "{{ OPENBAO_HOST_NODE }}"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
+- name: "🛑 Fail when the recovery key did not complete root generation"
+  ansible.builtin.fail:
+    msg: >-
+      The recovery key held for {{ application_id }} was rejected. Neither
+      AppRole is accepted either, so this instance has no administrative path
+      left and must be rebuilt from its volume backup plus the seal key.
+  when: not ((openbao_root_update.stdout | from_json).complete | default(false) | bool)
+
+- name: "🔓 Unwrap the generated root token"
+  ansible.builtin.shell: > # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
+    container exec {{ OPENBAO_LOCAL_CID | quote }}
+    bao operator generate-root
+    -decode={{ (openbao_root_update.stdout | from_json).encoded_token | quote }}
+    -otp={{ openbao_root_otp.stdout | trim | quote }}
+  register: openbao_root_decoded
+  changed_when: false
+  delegate_to: "{{ OPENBAO_HOST_NODE }}"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
+- name: "🔧 Hold the generated root token in memory only"
+  ansible.builtin.set_fact:
+    openbao_root_token: "{{ openbao_root_decoded.stdout | trim }}"
+  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
+
+- name: "🔑 Rebuild the Ansible AppRole from the inventory credentials"
+  ansible.builtin.include_tasks: ../02_auth.yml
diff --git a/roles/web-app-openbao/templates/compose.yml.j2 b/roles/web-app-openbao/templates/compose.yml.j2
index 5f36f67fe0..637acc3d86 100644
--- a/roles/web-app-openbao/templates/compose.yml.j2
+++ b/roles/web-app-openbao/templates/compose.yml.j2
@@ -7,7 +7,6 @@
     {% include 'roles/sys-svc-container/templates/base.yml.j2' %}
     {{ lookup('container_ports', ['openbao', 'http', DOCKER_BIND_HOST]) | indent(4) }}
     {{ lookup('container_healthcheck', service_name) | indent(4) }}
-    # Exception: no -config here; the image entrypoint appends -config=/openbao/config itself.
     command:
       - "server"
     {{ lookup('container_depends_on', application_id) | indent(4) }}
diff --git a/roles/web-app-openbao/templates/prometheus/alert_rules.yml.j2 b/roles/web-app-openbao/templates/prometheus/alert_rules.yml.j2
index b2ce3a9243..f944990828 100644
--- a/roles/web-app-openbao/templates/prometheus/alert_rules.yml.j2
+++ b/roles/web-app-openbao/templates/prometheus/alert_rules.yml.j2
@@ -1,4 +1,3 @@
-{% if 'web-app-openbao' in lookup('native_metrics_apps') %}
   - name: openbao_seal
     interval: 30s
     rules:
@@ -13,4 +12,3 @@
             OpenBao has not reported an active, unsealed core for more than 2 minutes.
             Secrets, PKI issuance and machine logins are unavailable while it is sealed.
             Check the container and confirm the static seal key reached its environment.
-{% endif %}
diff --git a/roles/web-app-openbao/templates/proxy.conf.j2 b/roles/web-app-openbao/templates/proxy.conf.j2
index 75be4dbb20..97d5a2c23c 100644
--- a/roles/web-app-openbao/templates/proxy.conf.j2
+++ b/roles/web-app-openbao/templates/proxy.conf.j2
@@ -17,7 +17,6 @@ server
 
   {% include 'roles/sys-front-tls/templates/nginx_ssl_header.j2' %}
 
-  # Exception: the listener serves metrics unauthenticated for the internal scrape; this keeps them off the public surface.
   location = /v1/sys/metrics {
     deny all;
   }
diff --git a/roles/web-app-openbao/vars/main.yml b/roles/web-app-openbao/vars/main.yml
index d5caa506b1..8117f89516 100644
--- a/roles/web-app-openbao/vars/main.yml
+++ b/roles/web-app-openbao/vars/main.yml
@@ -20,23 +20,22 @@ OPENBAO_SEAL_KEY: "{{ lookup('config', application_id, 'secrets.credentials.seal
 OPENBAO_APPROLE_ROLE_ID: "{{ lookup('config', application_id, 'secrets.credentials.approle_role_id') }}"
 OPENBAO_APPROLE_SECRET_ID: "{{ lookup('config', application_id, 'secrets.credentials.approle_secret_id') }}"
 
-# Rationale: the platform rotates every generated credential on each deploy, so
-# the key id is derived from the key instead of counted — upstream requires the
-# identifier to match its key, and a derived id cannot drift out of step with one.
 OPENBAO_SEAL_KEY_ID: "{{ (OPENBAO_SEAL_KEY | hash('sha256'))[:16] }}"
 
-# Rationale: what the previous deploy applied, read back before the config is
-# rendered so the node can unseal with the old key and rewrap to the new one, and
-# so the AppRole can still authenticate after its credentials rotated.
 OPENBAO_APPLIED_STATE_HOST: "{{ [lookup('container', application_id, 'directories.instance'), '.applied.json'] | path_join }}"
 OPENBAO_APPLIED: "{{ openbao_applied_state | default({}, true) }}"
 OPENBAO_SEAL_KEY_PREVIOUS: "{{ OPENBAO_APPLIED.seal_key | default('', true) }}"
 OPENBAO_SEAL_KEY_PREVIOUS_ID: "{{ (OPENBAO_SEAL_KEY_PREVIOUS | hash('sha256'))[:16] if OPENBAO_SEAL_KEY_PREVIOUS else '' }}"
 OPENBAO_SEAL_ROTATING: "{{ (OPENBAO_SEAL_KEY_PREVIOUS | length > 0) and (OPENBAO_SEAL_KEY_PREVIOUS != OPENBAO_SEAL_KEY) }}"
 
-# Rationale: resolved from the login rather than from the state file — the
-# SecretID OpenBao actually holds is whichever one was just accepted, and
-# re-registering that same value answers 500, not a no-op.
+OPENBAO_RECOVERY_USER_KEY: "administrator"
+OPENBAO_RECOVERY_TOKEN_APP: "{{ application_id }}-recovery"
+OPENBAO_RECOVERY_KEY: >-
+  {{ (sys_token_store_users | default({}, true))
+     .get(OPENBAO_RECOVERY_USER_KEY, {})
+     .get('tokens', {})
+     .get(OPENBAO_RECOVERY_TOKEN_APP, '') }}
+
 OPENBAO_SECRET_ID_REGISTERED: "{{ openbao_secret_id_registered | default('', true) }}"
 OPENBAO_SECRET_ID_ROTATING: "{{ (OPENBAO_SECRET_ID_REGISTERED | length > 0) and (OPENBAO_SECRET_ID_REGISTERED != OPENBAO_APPROLE_SECRET_ID) }}"
 OPENBAO_KV_MOUNT: "infinito"
diff --git a/roles/web-app-openclaw/meta/services.yml b/roles/web-app-openclaw/meta/services.yml
index ed34538b62..ba79f514df 100644
--- a/roles/web-app-openclaw/meta/services.yml
+++ b/roles/web-app-openclaw/meta/services.yml
@@ -50,11 +50,11 @@ sso:
       - "{{ lookup('rbac_group_path', application_id='web-app-openclaw', role='administrator') }}"
       - "{{ lookup('rbac_group_path', application_id='web-app-openclaw', role='mcp') }}"
 
-# nocheck: playwright-service-flag
+# nocheck: playwright-service-flag, dynamic-flag - the gateway is a single shared instance, never deployed per consumer
 litellm:
   bond: 1
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 
 logout:
   bond: 1
diff --git a/roles/web-app-openclaw/meta/variants.yml b/roles/web-app-openclaw/meta/variants.yml
index 355bd2f447..5f0c5ee5b0 100644
--- a/roles/web-app-openclaw/meta/variants.yml
+++ b/roles/web-app-openclaw/meta/variants.yml
@@ -10,7 +10,6 @@
       shared: true
     litellm:
       enabled: true
-      shared: true
     logout:
       enabled: true
       shared: true
@@ -37,7 +36,6 @@
       shared: true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     logout:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -64,7 +62,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     logout:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
diff --git a/roles/web-app-opentalk/meta/services.yml b/roles/web-app-opentalk/meta/services.yml
index a5e60c7b18..4e78c82a90 100644
--- a/roles/web-app-opentalk/meta/services.yml
+++ b/roles/web-app-opentalk/meta/services.yml
@@ -96,7 +96,7 @@ controller:
 livekit:
   name: opentalk-livekit
   image: livekit/livekit-server
-  version: v1.13.6
+  version: v1.13.7
   min_storage: 238MB
   cpus: "2.0"
   mem_reservation: 512m
@@ -134,7 +134,7 @@ rabbit:
     retries: 5
   name: opentalk-rabbit
   image: rabbitmq
-  version: 4.3.5
+  version: 4.3.6
   min_storage: 314MB
   cpus: "0.5"
   mem_reservation: 256m
diff --git a/roles/web-app-openwebui/meta/services.yml b/roles/web-app-openwebui/meta/services.yml
index 1fe7754ea7..69ea6a7ae6 100644
--- a/roles/web-app-openwebui/meta/services.yml
+++ b/roles/web-app-openwebui/meta/services.yml
@@ -81,11 +81,11 @@ css:
 javascript:
   enabled: false # nocheck: dynamic-flag
   shared: true
-# nocheck: playwright-service-flag — AI backend, infrastructural
+# nocheck: playwright-service-flag, dynamic-flag — AI backend, infrastructural, and a single shared instance
 litellm:
   bond: 1
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 
 email:
   bond: 1
diff --git a/roles/web-app-openwebui/meta/variants.yml b/roles/web-app-openwebui/meta/variants.yml
index c47c1396c1..13acca7e3c 100644
--- a/roles/web-app-openwebui/meta/variants.yml
+++ b/roles/web-app-openwebui/meta/variants.yml
@@ -27,7 +27,6 @@
       shared: true
     litellm:
       enabled: true
-      shared: true
     prometheus:
       enabled: true
       shared: true
@@ -63,7 +62,6 @@
       shared: true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     prometheus:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -102,7 +100,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false # nocheck: variants-static-override backup shared stays literally true
     prometheus:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
diff --git a/roles/web-app-peertube/meta/services.yml b/roles/web-app-peertube/meta/services.yml
index 9132986606..dad88b5467 100644
--- a/roles/web-app-peertube/meta/services.yml
+++ b/roles/web-app-peertube/meta/services.yml
@@ -61,7 +61,7 @@ peertube:
   enabled: true # nocheck: dynamic-flag
   shared: true
   name: peertube
-  version: v8.2.4
+  version: v8.3.0
   image: chocobozzz/peertube
   min_storage: 841MB
   live:
@@ -79,6 +79,9 @@ peertube:
       http: 8011
     public:
       rtmp: 1935
+    onion:
+      # nocheck: onion-flag  RTMP is an ingest the broadcaster pushes in, and the encoders that push it speak no SOCKS
+      rtmp: false
     internal:
       http: 9000
       rtmp: 1935
diff --git a/roles/web-app-peertube/tasks/00_core.yml b/roles/web-app-peertube/tasks/00_core.yml
index 596c18e492..e4aa750ef9 100644
--- a/roles/web-app-peertube/tasks/00_core.yml
+++ b/roles/web-app-peertube/tasks/00_core.yml
@@ -6,7 +6,7 @@
     name: sys-stk-front-proxy
   loop: "{{ lookup('domains', application_id) }}"
   loop_control:
-    loop_var: domain
+    loop_var: domain # nocheck: loop-var-shadow  sys-stk-front-proxy takes the vhost through this name, see its tasks/main.yml front_proxy_domain
   vars:
     http_port: "{{ lookup('config', application_id, 'services.peertube.ports.local.http') }}"
     websocket_port: "{{ lookup('config', application_id, 'services.peertube.ports.local.http') }}"
diff --git a/roles/web-app-pgadmin/meta/services.yml b/roles/web-app-pgadmin/meta/services.yml
index 400e12388e..20b16398f4 100644
--- a/roles/web-app-pgadmin/meta/services.yml
+++ b/roles/web-app-pgadmin/meta/services.yml
@@ -11,7 +11,7 @@ pgadmin:
   # nocheck: default-placement-manager  embedded sqlite config db; node-local in swarm
   placement: manager
   image: dpage/pgadmin4
-  version: "9.17"
+  version: "9.18"
   min_storage: 378MB
   server_mode: false
   master_password_required: true
diff --git a/roles/web-app-phpldapadmin/meta/variants.yml b/roles/web-app-phpldapadmin/meta/variants.yml
index f81db4c599..c986849575 100644
--- a/roles/web-app-phpldapadmin/meta/variants.yml
+++ b/roles/web-app-phpldapadmin/meta/variants.yml
@@ -52,24 +52,3 @@
       shared: false
     tor:
       enabled: true
-- services:
-    sso:
-      enabled: false
-      shared: false
-    css:
-      enabled: false
-      shared: false
-    dashboard:
-      enabled: false
-      shared: false
-    logout:
-      enabled: false
-      shared: false
-    matomo:
-      enabled: false
-      shared: false
-    prometheus:
-      enabled: false
-      shared: false
-    tor:
-      enabled: true
diff --git a/roles/web-app-pihole/meta/services.yml b/roles/web-app-pihole/meta/services.yml
index 2abe5f7b63..e30e2bd67c 100644
--- a/roles/web-app-pihole/meta/services.yml
+++ b/roles/web-app-pihole/meta/services.yml
@@ -68,7 +68,7 @@ pihole:
     swarm:
       enabled: false
   image: pihole/pihole
-  version: "2026.07.2"
+  version: "2026.09.0"
   upstream_dns: "{{ NETWORK_PUBLIC_DNS_RESOLVERS }}"
   cpus: "0.5"
   mem_reservation: "128m"
diff --git a/roles/web-app-pixelfed/meta/services.yml b/roles/web-app-pixelfed/meta/services.yml
index fe9b2eb8d0..222a5ee5b1 100644
--- a/roles/web-app-pixelfed/meta/services.yml
+++ b/roles/web-app-pixelfed/meta/services.yml
@@ -49,7 +49,7 @@ pixelfed:
   shared: true
   enabled: true # nocheck: dynamic-flag
   image: zknt/pixelfed
-  version: latest
+  version: "20260917"
   name: pixelfed
   min_storage: 588MB
   backup:
diff --git a/roles/web-app-pixelfed/templates/playwright.env.j2 b/roles/web-app-pixelfed/templates/playwright.env.j2
index 7cf2bd23f0..df0ab60782 100644
--- a/roles/web-app-pixelfed/templates/playwright.env.j2
+++ b/roles/web-app-pixelfed/templates/playwright.env.j2
@@ -7,7 +7,7 @@ ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
 
 APP_BASE_URL={{ lookup('tls', application_id, 'url.base') }}
 
-BIBER_OIDC_EMAIL_OVERRIDE={{ (lookup('users', 'biber').username ~ '@infinito.nexus') | dotenv_quote }}
+BIBER_OIDC_EMAIL_OVERRIDE={{ (lookup('users', 'biber').username ~ '@' ~ SOFTWARE_DOMAIN) | dotenv_quote }}
 
 BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
 
diff --git a/roles/web-app-postmarks/meta/services.yml b/roles/web-app-postmarks/meta/services.yml
index 6dd146a1f1..fa6100d4ee 100644
--- a/roles/web-app-postmarks/meta/services.yml
+++ b/roles/web-app-postmarks/meta/services.yml
@@ -46,7 +46,7 @@ postmarks:
     swarm:
       enabled: true
   image: node
-  version: 26-bookworm
+  version: 26-slim
   custom: true
   name: web-app-postmarks
   repository: https://github.com/ckolderup/postmarks.git
diff --git a/roles/web-app-pretix/meta/services.yml b/roles/web-app-pretix/meta/services.yml
index 9058260c92..bcccb16e2c 100644
--- a/roles/web-app-pretix/meta/services.yml
+++ b/roles/web-app-pretix/meta/services.yml
@@ -53,7 +53,7 @@ pretix:
     swarm:
       enabled: true
   image: pretix/standalone
-  version: stable
+  version: 2026.7.0
   custom: true
   name: pretix
   min_storage: 1003MB
diff --git a/roles/web-app-prometheus/meta/services.yml b/roles/web-app-prometheus/meta/services.yml
index e2745043d5..54ace45103 100644
--- a/roles/web-app-prometheus/meta/services.yml
+++ b/roles/web-app-prometheus/meta/services.yml
@@ -79,7 +79,7 @@ alertmanager:
     flavor: wget
     path: -/healthy
   image: prom/alertmanager # nocheck: volumes-path-single-spot: the repository path of an image name, not a mount target
-  version: v0.34.0
+  version: v0.34.1
   name: prometheus-alertmanager
   cpus: "0.25"
   mem_reservation: 64m
diff --git a/roles/web-app-roulette-wheel/files/Dockerfile b/roles/web-app-roulette-wheel/files/Dockerfile
index a2df2dfca1..349dae69b6 100644
--- a/roles/web-app-roulette-wheel/files/Dockerfile
+++ b/roles/web-app-roulette-wheel/files/Dockerfile
@@ -1,6 +1,12 @@
 ARG ROULETTE_IMAGE
 ARG ROULETTE_VERSION
 FROM ${ROULETTE_IMAGE}:${ROULETTE_VERSION}
+
+RUN rm -rf /var/lib/apt/lists/* \
+  && apt-get -o Acquire::Retries=3 update && apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
+    curl \
+  && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
 ARG ROULETTE_WHEEL_APP_REL
 COPY ./${ROULETTE_WHEEL_APP_REL}/package.json ./${ROULETTE_WHEEL_APP_REL}/package-lock.json ./
diff --git a/roles/web-app-roulette-wheel/meta/services.yml b/roles/web-app-roulette-wheel/meta/services.yml
index 9dfbe51a38..f7ef64e6d9 100644
--- a/roles/web-app-roulette-wheel/meta/services.yml
+++ b/roles/web-app-roulette-wheel/meta/services.yml
@@ -31,7 +31,7 @@ roulette-wheel:
     swarm:
       enabled: true
   image: node
-  version: 26-bookworm
+  version: 26-slim
   custom: true
   repository: https://github.com/kevinveenbirkenbach/roulette-wheel.git
   ref: master
diff --git a/roles/web-app-socialhome/meta/csp.yml b/roles/web-app-socialhome/meta/csp.yml
index 5d7ccc87ce..5896abc89e 100644
--- a/roles/web-app-socialhome/meta/csp.yml
+++ b/roles/web-app-socialhome/meta/csp.yml
@@ -4,3 +4,10 @@ whitelist:
     - "blob:"
   script-src:
     - "blob:"
+  style-src-elem:
+    - https://fonts.googleapis.com # nocheck: external-cdn,url
+  font-src:
+    - https://fonts.gstatic.com # nocheck: external-cdn,url
+flags:
+  script-src-elem:
+    unsafe-inline: true # nocheck: csp-unsafe  Reason: the served document carries an inline script of its own at line 38, which csp-checker reports and hlth-csp then fails on
diff --git a/roles/web-app-socialhome/meta/services.yml b/roles/web-app-socialhome/meta/services.yml
index 388c650bc1..59ddf807e3 100644
--- a/roles/web-app-socialhome/meta/services.yml
+++ b/roles/web-app-socialhome/meta/services.yml
@@ -13,7 +13,7 @@ socialhome:
   # nocheck: default-placement-manager  embedded sqlite in a node-local volume; no clustered storage
   placement: manager
   image: ghcr.io/social-home-io/socialhome
-  version: "2026.9.11"
+  version: "2026.9.18"
   ports:
     local:
       http: 8089
diff --git a/roles/web-app-taiga/meta/services.yml b/roles/web-app-taiga/meta/services.yml
index 400a570ce3..6b960b487e 100644
--- a/roles/web-app-taiga/meta/services.yml
+++ b/roles/web-app-taiga/meta/services.yml
@@ -92,7 +92,7 @@ gateway:
     internal:
       http: 80
   image: nginx
-  version: alpine
+  version: 1.31.6-alpine
   cpus: "0.3"
   mem_reservation: 256m
   mem_limit: 512m
diff --git a/roles/web-app-wordpress/meta/services.yml b/roles/web-app-wordpress/meta/services.yml
index 04328dda3a..956a880dbc 100644
--- a/roles/web-app-wordpress/meta/services.yml
+++ b/roles/web-app-wordpress/meta/services.yml
@@ -1,9 +1,9 @@
 ---
-# nocheck: playwright-service-flag - shared gateway consumer; inference wiring is covered by the gateway role
+# nocheck: playwright-service-flag, dynamic-flag - shared gateway consumer; inference wiring is covered by the gateway role, and the gateway is a single shared instance
 litellm:
   bond: 0.5
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 # nocheck: seaweedfs-required, object storage not implemented for this role
 sso:
   bond: 1
diff --git a/roles/web-app-wordpress/meta/variants.yml b/roles/web-app-wordpress/meta/variants.yml
index 410f2b4110..1416c0955b 100644
--- a/roles/web-app-wordpress/meta/variants.yml
+++ b/roles/web-app-wordpress/meta/variants.yml
@@ -35,7 +35,6 @@
       shared: true
     litellm:
       enabled: true
-      shared: true
     sso:
       enabled: true
       shared: true
@@ -79,7 +78,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false
     sso:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
diff --git a/roles/web-app-wordpress/tasks/00_core.yml b/roles/web-app-wordpress/tasks/00_core.yml
index 4aa2ed8fa5..2e3806e1a2 100644
--- a/roles/web-app-wordpress/tasks/00_core.yml
+++ b/roles/web-app-wordpress/tasks/00_core.yml
@@ -10,7 +10,7 @@
     name: sys-stk-front-proxy
   loop: "{{ WORDPRESS_DOMAINS }}"
   loop_control:
-    loop_var: domain
+    loop_var: domain # nocheck: loop-var-shadow  sys-stk-front-proxy takes the vhost through this name, see its tasks/main.yml front_proxy_domain
   vars:
     webserver_extra_configuration: "client_max_body_size {{ WORDPRESS_MAX_UPLOAD_SIZE }};"
     http_port: "{{ lookup('config', application_id, 'services.wordpress.ports.local.http') }}"
diff --git a/roles/web-app-xwiki/meta/services.yml b/roles/web-app-xwiki/meta/services.yml
index 874eab7b6d..f4cd9d48c0 100644
--- a/roles/web-app-xwiki/meta/services.yml
+++ b/roles/web-app-xwiki/meta/services.yml
@@ -1,8 +1,9 @@
 ---
+# nocheck: dynamic-flag - the gateway is a single shared instance, never deployed per consumer
 litellm:
   bond: 0.5
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 # nocheck: seaweedfs-required — object storage not implemented for this role
 sso:
   bond: 1
@@ -55,7 +56,7 @@ xwiki:
   enabled: true # nocheck: dynamic-flag
   shared: true
   image: xwiki
-  version: lts-postgres-tomcat
+  version: 17.10.13-postgres-tomcat
   custom: true
   name: xwiki
   min_storage: 965MB
diff --git a/roles/web-app-xwiki/meta/variants.yml b/roles/web-app-xwiki/meta/variants.yml
index b9265fdd57..97baf06457 100644
--- a/roles/web-app-xwiki/meta/variants.yml
+++ b/roles/web-app-xwiki/meta/variants.yml
@@ -7,7 +7,6 @@
 - services:
     litellm:
       enabled: false
-      shared: false
     container_backup:
       enabled: true
     dashboard:
@@ -40,7 +39,6 @@
 - services:
     litellm:
       enabled: false
-      shared: false
     container_backup:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
@@ -74,7 +72,6 @@
 - services: # nocheck: variants-auth-isolation
     litellm:
       enabled: true
-      shared: true
     container_backup:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
diff --git a/roles/web-app-zammad/meta/services.yml b/roles/web-app-zammad/meta/services.yml
index 254bc7e88d..35ffa8e682 100644
--- a/roles/web-app-zammad/meta/services.yml
+++ b/roles/web-app-zammad/meta/services.yml
@@ -1,8 +1,9 @@
 ---
+# nocheck: dynamic-flag - the gateway is a single shared instance, never deployed per consumer
 litellm:
   bond: 0.5
-  enabled: "{{ ('svc-ai-litellm' in group_names) and (LITELLM_CHAT_MODEL_SERVED | bool) }}"
-  shared: "{{ 'svc-ai-litellm' in group_names }}"
+  enabled: "{{ LITELLM_USABLE }}"
+  shared: true
 # nocheck: seaweedfs-required - object storage not implemented for this role
 sso:
   bond: 1
diff --git a/roles/web-app-zammad/meta/variants.yml b/roles/web-app-zammad/meta/variants.yml
index b432f5a7d4..38cb4ddfb5 100644
--- a/roles/web-app-zammad/meta/variants.yml
+++ b/roles/web-app-zammad/meta/variants.yml
@@ -38,7 +38,6 @@
       shared: true
     litellm:
       enabled: false
-      shared: false
     tor:
       enabled: true
     openwebui:
@@ -86,7 +85,6 @@
       shared: false # nocheck: variants-static-override backup shared stays literally true
     litellm:
       enabled: false
-      shared: false
     tor:
       enabled: true
 
@@ -117,7 +115,6 @@
       shared: true
     litellm:
       enabled: true
-      shared: true
     logout:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
diff --git a/roles/web-svc-cdn/meta/services.yml b/roles/web-svc-cdn/meta/services.yml
index 7ec49c1f4b..d23364961d 100644
--- a/roles/web-svc-cdn/meta/services.yml
+++ b/roles/web-svc-cdn/meta/services.yml
@@ -30,7 +30,7 @@ build:
   # nocheck: single-replica  one-shot npm-mirror build writing the shared served root; parallel replicas would race and duplicate work
   replicas: 1
   image: node
-  version: "26-bookworm"
+  version: "26-slim"
   cpus: "1.0"
   mem_reservation: 128m
   mem_limit: 256m
diff --git a/roles/web-svc-coturn/meta/services.yml b/roles/web-svc-coturn/meta/services.yml
index de4c0474e5..46fd83e125 100644
--- a/roles/web-svc-coturn/meta/services.yml
+++ b/roles/web-svc-coturn/meta/services.yml
@@ -31,7 +31,7 @@ coturn:
   lifecycle: beta
 gateway:
   image: nginx
-  version: alpine
+  version: 1.31.6-alpine
   cpus: "0.3"
   mem_reservation: 256m
   mem_limit: 512m
diff --git a/roles/web-svc-coturn/templates/compose.yml.j2 b/roles/web-svc-coturn/templates/compose.yml.j2
index c54c7efdfd..e9b4b8dc58 100644
--- a/roles/web-svc-coturn/templates/compose.yml.j2
+++ b/roles/web-svc-coturn/templates/compose.yml.j2
@@ -18,13 +18,23 @@
     {{ lookup('compose_only', 'container_name', COTURN_CONTAINER) }}
     network_mode: {{ COTURN_NETWORK_MODE }}
     {% if COTURN_NETWORK_MODE == 'bridge' %}
-    ports:
-      - "{{ COTURN_STUN_TURN_PORT }}:{{ COTURN_STUN_TURN_PORT }}/udp"  # nocheck: compose-ports-must-use-container-ports
-      - "{{ COTURN_STUN_TURN_PORT }}:{{ COTURN_STUN_TURN_PORT }}/tcp"  # nocheck: compose-ports-must-use-container-ports
-      {% if COTURN_TLS_ENABLED| bool %}
-      - "{{ COTURN_STUN_TURN_PORT_TLS }}:{{ COTURN_STUN_TURN_PORT_TLS }}/tcp"  # nocheck: compose-ports-must-use-container-ports
-      {% endif %}
-      - "{{ COTURN_RELAY_PORT_RANGE }}/udp"  # nocheck: compose-ports-must-use-container-ports
+    {% if COTURN_TLS_ENABLED | bool %}
+    {{ lookup('container_ports',
+              {'service': 'coturn', 'protocol': 'stun_turn',
+               'transport': ['udp', 'tcp'], 'container': 'same'},
+              {'service': 'coturn', 'protocol': 'stun_turn_tls',
+               'transport': 'tcp', 'container': 'same'},
+              {'service': 'coturn', 'protocol': 'relay',
+               'transport': 'udp', 'container': 'same',
+               'publish': 'ephemeral'}) | indent(4) }}
+    {% else %}
+    {{ lookup('container_ports',
+              {'service': 'coturn', 'protocol': 'stun_turn',
+               'transport': ['udp', 'tcp'], 'container': 'same'},
+              {'service': 'coturn', 'protocol': 'relay',
+               'transport': 'udp', 'container': 'same',
+               'publish': 'ephemeral'}) | indent(4) }}
+    {% endif %}
     {{ lookup('container_networks') | indent(4) }}
     {% endif %}
     {{ lookup('container_volumes', service_name) | indent(4) }}
diff --git a/roles/web-svc-coturn/vars/main.yml b/roles/web-svc-coturn/vars/main.yml
index c1bb58cc5f..1fd172c9aa 100644
--- a/roles/web-svc-coturn/vars/main.yml
+++ b/roles/web-svc-coturn/vars/main.yml
@@ -11,7 +11,6 @@ COTURN_STUN_TURN_PORT: "{{ lookup('config', application_id, 'services.coturn.por
 COTURN_STUN_TURN_PORT_TLS: "{{ lookup('config', application_id, 'services.coturn.ports.public.stun_turn_tls') }}"
 COTURN_RELAY_PORT_START: "{{ lookup('config', application_id, 'services.coturn.ports.public.relay.start') }}"
 COTURN_RELAY_PORT_END: "{{ lookup('config', application_id, 'services.coturn.ports.public.relay.end') }}"
-COTURN_RELAY_PORT_RANGE: "{{ COTURN_RELAY_PORT_START }}-{{ COTURN_RELAY_PORT_END }}"
 
 COTURN_USER_NAME: "{{ lookup('users', 'coturnconsumer').username }}"
 COTURN_USER_PASSWORD: "{{ lookup('users', 'coturnconsumer').password }}"
diff --git a/roles/web-svc-mirror/templates/proxy.conf.j2 b/roles/web-svc-mirror/templates/proxy.conf.j2
index 4dc8bd6c80..0f2016d735 100644
--- a/roles/web-svc-mirror/templates/proxy.conf.j2
+++ b/roles/web-svc-mirror/templates/proxy.conf.j2
@@ -22,6 +22,9 @@ server
     proxy_ssl_server_name on;
     proxy_ssl_name {{ origin_host }};
     proxy_set_header Host {{ origin_host }};
+{% for redirect_source in origin_host | redirect_sources %}
+    proxy_redirect {{ redirect_source }} /{{ origin_host }}/;
+{% endfor %}
     proxy_cache cache;
     proxy_cache_valid 200 301 302 168h;
     proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
diff --git a/roles/web-svc-simpleicons/files/Dockerfile b/roles/web-svc-simpleicons/files/Dockerfile
index 4fc72dd4e9..9bbaaf8858 100644
--- a/roles/web-svc-simpleicons/files/Dockerfile
+++ b/roles/web-svc-simpleicons/files/Dockerfile
@@ -10,6 +10,11 @@ RUN npm install
 ARG container_port
 FROM ${SIMPLEICONS_IMAGE}:${SIMPLEICONS_VERSION}
 
+RUN rm -rf /var/lib/apt/lists/* \
+  && apt-get -o Acquire::Retries=3 update && apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
+    curl \
+  && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
 COPY --from=builder /app/node_modules ./node_modules
 COPY ./config/server.js .
diff --git a/roles/web-svc-simpleicons/meta/services.yml b/roles/web-svc-simpleicons/meta/services.yml
index 316dbfa8e7..4a12b9ad13 100644
--- a/roles/web-svc-simpleicons/meta/services.yml
+++ b/roles/web-svc-simpleicons/meta/services.yml
@@ -40,7 +40,7 @@ simpleicons:
   enabled: true
   shared: true
   image: node
-  version: 26-bookworm
+  version: 26-slim
   local_image: simpleicons-server
   local_version: latest
   min_storage: 612MB
diff --git a/roles/web-svc-xmpp/meta/services.yml b/roles/web-svc-xmpp/meta/services.yml
index 4fbbdadc6e..6229ec6578 100644
--- a/roles/web-svc-xmpp/meta/services.yml
+++ b/roles/web-svc-xmpp/meta/services.yml
@@ -38,6 +38,11 @@ xmpp:
     public:
       c2s: 5222
       s2s: 5269
+    onion:
+      # nocheck: onion-flag  onion clients reach the same sessions over the BOSH and websocket endpoints the proxy serves on port 80
+      c2s: false
+      # nocheck: onion-flag  server-to-server dials clearnet peers that resolve this domain in DNS, which an onion address does not answer
+      s2s: false
     internal:
       http: 5280
       c2s: 5222
diff --git a/scripts/docker/cache/package-frontend/certs.sh b/scripts/docker/cache/package-frontend/certs.sh
index 22af789401..2e8f338f00 100755
--- a/scripts/docker/cache/package-frontend/certs.sh
+++ b/scripts/docker/cache/package-frontend/certs.sh
@@ -19,6 +19,11 @@ fi
 : "${INFINITO_CACHE_PACKAGE_FRONTEND_INIT_IMAGE:?Source scripts/meta/env/load.sh first}"
 ALPINE_IMAGE="${INFINITO_CACHE_PACKAGE_FRONTEND_INIT_IMAGE}"
 
+if ! MAX_ATTEMPTS=3 RETRY_DELAY_SECONDS=10 \
+	"${REPO_ROOT}/scripts/github/runner/pull_with_retry.sh" "${ALPINE_IMAGE}"; then
+	echo "[package-frontend-certs] could not pull ${ALPINE_IMAGE}; falling back to a cached copy" >&2
+fi
+
 exec docker run --rm \
 	-v "${INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR}:/ca" \
 	-v "${INFINITO_CACHE_PACKAGE_FRONTEND_CERTS_DIR}:/certs" \
diff --git a/scripts/github/guide/compose_deploy.sh b/scripts/github/guide/compose_deploy.sh
index b7fdcc16d8..ff6a82fd9f 100755
--- a/scripts/github/guide/compose_deploy.sh
+++ b/scripts/github/guide/compose_deploy.sh
@@ -16,4 +16,5 @@ test -s /tmp/run.sh
 source scripts/meta/env/load.sh
 sed -i "s#<your-ssh-public-key>#ssh-ed25519 AAAA_TEST_DUMMY_KEY github-ci-dummy@infinito#" /tmp/run.sh
 sed -i "s#<your-domain>#${INFINITO_DOMAIN}#" /tmp/run.sh
+sed -i "s#<your-clearnet-resolver>#${INFINITO_DNS_IP}#" /tmp/run.sh
 docker exec -i "${INFINITO_CONTAINER}" bash -s </tmp/run.sh
diff --git a/scripts/github/resolve/pr_affected_roles.sh b/scripts/github/resolve/pr_affected_roles.sh
index d485039691..9434ae1480 100755
--- a/scripts/github/resolve/pr_affected_roles.sh
+++ b/scripts/github/resolve/pr_affected_roles.sh
@@ -15,7 +15,9 @@
 #   PR_BODY         PR body markdown (only read on the subset path).
 #
 # Outputs (GITHUB_OUTPUT):
-#   whitelist=<role-id ...|__ALL__>
+#   whitelist=<selection token ...|__ALL__>
+#             a token is a role id, variant-narrowed to `<role>#0,2` where
+#             only some of the role's variants reach the change.
 
 set -euo pipefail
 
diff --git a/scripts/github/runner/cleanup_docker.sh b/scripts/github/runner/cleanup_docker.sh
index 0a210d463b..85a45dc965 100755
--- a/scripts/github/runner/cleanup_docker.sh
+++ b/scripts/github/runner/cleanup_docker.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 #
 # Cleanup pass for the Docker / buildx state on a GitHub-hosted runner.
-# Used by images-build-ci.yml as the always-on tail of the build job to
+# Used by call-images-build-ci.yml as the always-on tail of the build job to
 # free disk before the runner is reused (or recycled).
 set -euo pipefail
 
diff --git a/scripts/github/runner/disk_pressure_report.sh b/scripts/github/runner/disk_pressure_report.sh
index 0c7e0ae233..a4b1aef1cb 100755
--- a/scripts/github/runner/disk_pressure_report.sh
+++ b/scripts/github/runner/disk_pressure_report.sh
@@ -14,6 +14,8 @@ echo "Runner: $(uname -a)"
 echo
 df -h
 echo
+free -h
+echo
 docker version || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
 echo
 docker system df || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
diff --git a/scripts/github/update/collection_source.sh b/scripts/github/update/collection_source.sh
new file mode 100755
index 0000000000..d414094979
--- /dev/null
+++ b/scripts/github/update/collection_source.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "${SCRIPT_DIR}/../../.." && pwd)"
+
+cd "${REPO_ROOT}"
+make dotenv >/dev/null
+set -a
+# shellcheck disable=SC1091
+. .env
+set +a
+python3 -m cli.contributing.update.collection_source "$@"
diff --git a/scripts/github/update/galaxy_pins.sh b/scripts/github/update/galaxy_pins.sh
new file mode 100755
index 0000000000..46201fd1d2
--- /dev/null
+++ b/scripts/github/update/galaxy_pins.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "${SCRIPT_DIR}/../../.." && pwd)"
+
+cd "${REPO_ROOT}"
+make dotenv >/dev/null
+set -a
+# shellcheck disable=SC1091
+. .env
+set +a
+python3 -m cli.contributing.update.galaxy "$@"
diff --git a/scripts/github/update/restore_collection_history.sh b/scripts/github/update/restore_collection_history.sh
new file mode 100755
index 0000000000..fb49bb4cc6
--- /dev/null
+++ b/scripts/github/update/restore_collection_history.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${GH_TOKEN:?Missing GH_TOKEN}"
+: "${GITHUB_REPOSITORY:?Missing GITHUB_REPOSITORY}"
+: "${HISTORY_PATH:?Missing HISTORY_PATH}"
+: "${HISTORY_WORKFLOW:?Missing HISTORY_WORKFLOW}"
+
+ARTIFACT_NAME="${ARTIFACT_NAME:-collection-source-history}"
+
+mkdir -p "$(dirname "${HISTORY_PATH}")"
+
+run_id="$(
+	gh run list \
+		--repo "${GITHUB_REPOSITORY}" \
+		--workflow "${HISTORY_WORKFLOW}" \
+		--status success \
+		--limit 1 \
+		--json databaseId \
+		--jq '.[0].databaseId // empty'
+)"
+
+if [[ -z "${run_id}" ]]; then
+	echo "No previous successful run; starting a fresh history."
+	exit 0
+fi
+
+tmp_dir="$(mktemp -d)"
+if ! gh run download "${run_id}" \
+	--repo "${GITHUB_REPOSITORY}" \
+	--name "${ARTIFACT_NAME}" \
+	--dir "${tmp_dir}"; then
+	echo "Run ${run_id} carries no ${ARTIFACT_NAME}; starting a fresh history."
+	exit 0
+fi
+
+cp "${tmp_dir}/$(basename "${HISTORY_PATH}")" "${HISTORY_PATH}"
+echo "Restored history from run ${run_id}."
diff --git a/scripts/image/push.sh b/scripts/image/push.sh
index 4cb3ec606c..b1a35b0c5a 100755
--- a/scripts/image/push.sh
+++ b/scripts/image/push.sh
@@ -19,6 +19,8 @@ source "${script_dir}/../meta/env/load.sh"
 ghcr_owner="$(scripts/meta/resolve/repository/owner.sh)"
 repo_name="$("${script_dir}/../meta/resolve/repository/name.sh")"
 
+cache_ref="ghcr.io/${ghcr_owner}/${repo_name}/${MATRIX_DISTRO}:buildcache"
+
 max_attempts="${MAX_ATTEMPTS:-7}"
 retry_delay_seconds="${RETRY_DELAY_SECONDS:-20}"
 attempt=1
@@ -46,8 +48,8 @@ while true; do
 		--build-arg "INFINITO_PYTHON_INSTALL_SCRIPT=${INFINITO_PYTHON_INSTALL_SCRIPT:?source scripts/meta/env/load.sh}" \
 		--build-arg "INFINITO_DOCKER_CLI_INSTALL_SCRIPT=${INFINITO_DOCKER_CLI_INSTALL_SCRIPT:?source scripts/meta/env/load.sh}" \
 		"${nix_arg[@]}" \
-		--cache-from "type=gha,scope=${repo_name}-${MATRIX_DISTRO}" \
-		--cache-to "type=gha,mode=max,scope=${repo_name}-${MATRIX_DISTRO}" \
+		--cache-from "type=registry,ref=${cache_ref}" \
+		--cache-to "type=registry,mode=max,ref=${cache_ref}" \
 		"${BUILD_CONTEXT_DIR}"; then
 		echo "Build & push succeeded on attempt ${attempt}/${max_attempts}."
 		break
diff --git a/scripts/image/push_all.sh b/scripts/image/push_all.sh
new file mode 100755
index 0000000000..11ca4b67b8
--- /dev/null
+++ b/scripts/image/push_all.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Argv: <distro> [<distro> ...]  (falls back to INFINITO_DISTROS)
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "${script_dir}/../.." && pwd)"
+
+distros=("$@")
+if ((${#distros[@]} == 0)); then
+	: "${INFINITO_DISTROS:?Missing INFINITO_DISTROS and no distro arguments}"
+	read -r -a distros <<<"${INFINITO_DISTROS}"
+fi
+
+log_dir="${BUILD_LOG_DIR:-${repo_root}/build/image-logs}"
+mkdir -p "${log_dir}"
+
+stamp() {
+	local distro="$1"
+	local line
+	while IFS= read -r line; do
+		printf '[%s][%(%H:%M:%S)T] %s\n' "${distro}" -1 "${line}"
+	done
+}
+
+# shellcheck source=scripts/meta/env/load.sh
+source "${repo_root}/scripts/meta/env/load.sh"
+
+echo "🏗️  Building ${#distros[@]} image(s) concurrently: ${distros[*]}"
+echo "    Logs: ${log_dir}"
+
+gap_prev=1
+gap=2
+
+pids=()
+started=0
+for distro in "${distros[@]}"; do
+	if ((started > 0)); then
+		sleep "${gap}"
+		gap_next=$((gap_prev + gap))
+		gap_prev="${gap}"
+		gap="${gap_next}"
+	fi
+
+	(
+		set -o pipefail
+		MATRIX_DISTRO="${distro}" bash "${script_dir}/push.sh" 2>&1 |
+			stamp "${distro}" |
+			tee "${log_dir}/${distro}.log"
+	) &
+	pids+=("$!")
+	started=$((started + 1))
+done
+
+failed=()
+index=0
+for pid in "${pids[@]}"; do
+	distro="${distros[${index}]}"
+	if wait "${pid}"; then
+		echo "✅ ${distro}"
+	else
+		echo "❌ ${distro}"
+		failed+=("${distro}")
+	fi
+	index=$((index + 1))
+done
+
+if ((${#failed[@]} > 0)); then
+	echo "❌ Failed distros: ${failed[*]}"
+	exit 1
+fi
+
+echo "🎉 All ${#distros[@]} image(s) built and pushed"
diff --git a/scripts/install/ansible.sh b/scripts/install/ansible.sh
index 4b347d570b..8aa2d5b0e1 100755
--- a/scripts/install/ansible.sh
+++ b/scripts/install/ansible.sh
@@ -16,30 +16,63 @@ INSTALL_TIMEOUT=15m
 GALAXY_REQ="requirements/requirements.galaxy.yml"
 GIT_REQ="requirements/requirements.git.yml"
 
-while true; do
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+cd "${REPO_ROOT}"
+
+if [[ -z "${INFINITO_ANSIBLE_COLLECTIONS_SOURCE:-}" ]]; then
+	# shellcheck source=/dev/null
+	source <(grep -E '^INFINITO_ANSIBLE_COLLECTIONS_SOURCE=' default.env)
+fi
+
+: "${INFINITO_ANSIBLE_COLLECTIONS_SOURCE:?not declared in default.env}"
+
+case "${INFINITO_ANSIBLE_COLLECTIONS_SOURCE}" in
+galaxy) SOURCE_ORDER=("Galaxy:${GALAXY_REQ}" "Git:${GIT_REQ}") ;;
+git) SOURCE_ORDER=("Git:${GIT_REQ}" "Galaxy:${GALAXY_REQ}") ;;
+*)
+	echo "❌ INFINITO_ANSIBLE_COLLECTIONS_SOURCE must be 'galaxy' or 'git'," \
+		"got '${INFINITO_ANSIBLE_COLLECTIONS_SOURCE}'" >&2
+	exit 2
+	;;
+esac
+
+if MISSING="$("${PYTHON}" -m utils.install.collections "${GALAXY_REQ}" "${ANSIBLE_COLLECTIONS_DIR}")"; then
+	echo "✅ Every pinned collection is already installed"
+	echo "🎉 All collections are ready"
+	exit 0
+fi
+if [ -z "${MISSING}" ]; then
+	echo "❌ The collection check exited non-zero without naming a collection," \
+		"so it crashed rather than finding work; see its traceback above" >&2
+	exit 3
+fi
+echo "→ Not satisfied yet: ${MISSING}"
+
+installed=0
+while ((installed == 0)); do
 	echo "▶️  Attempt ${ATTEMPT}/${MAX_ATTEMPTS}"
 
-	echo "🌐 Trying Galaxy source (${GALAXY_REQ})…"
-	if timeout --foreground "${INSTALL_TIMEOUT}" \
-		"${PYTHON}" -m ansible.cli.galaxy collection install \
-		-r "${GALAXY_REQ}" \
-		-p "${ANSIBLE_COLLECTIONS_DIR}" \
-		--force-with-deps; then
+	for entry in "${SOURCE_ORDER[@]}"; do
+		label="${entry%%:*}"
+		req="${entry#*:}"
 
-		echo "✅ Collections installed successfully via Galaxy on attempt ${ATTEMPT}"
-		break
-	fi
+		echo "🌐 Trying ${label} source (${req})…"
+		if timeout --foreground "${INSTALL_TIMEOUT}" \
+			"${PYTHON}" -m ansible.cli.galaxy collection install \
+			-r "${req}" \
+			-p "${ANSIBLE_COLLECTIONS_DIR}" \
+			--force-with-deps; then
 
-	echo "⚠️  Galaxy install failed on attempt ${ATTEMPT}"
+			echo "✅ Collections installed successfully via ${label} on attempt ${ATTEMPT}"
+			installed=1
+			break
+		fi
 
-	echo "🔁 Falling back to Git source (${GIT_REQ})…"
-	if timeout --foreground "${INSTALL_TIMEOUT}" \
-		"${PYTHON}" -m ansible.cli.galaxy collection install \
-		-r "${GIT_REQ}" \
-		-p "${ANSIBLE_COLLECTIONS_DIR}" \
-		--force-with-deps; then
+		echo "⚠️  ${label} install failed on attempt ${ATTEMPT}"
+	done
 
-		echo "✅ Collections installed successfully via Git fallback on attempt ${ATTEMPT}"
+	if ((installed == 1)); then
 		break
 	fi
 
diff --git a/scripts/install/venv.sh b/scripts/install/venv.sh
index 8dcebdf096..3cc78f52bb 100755
--- a/scripts/install/venv.sh
+++ b/scripts/install/venv.sh
@@ -43,6 +43,11 @@ install_venv() {
 	echo "🎯 Venv python target : ${venv_python}"
 	echo
 
+	if [[ -x "${venv_python}" ]]; then
+		echo "→ Virtualenv already exists"
+		return 0
+	fi
+
 	local venv_parent
 	venv_parent="$(dirname "${VENV}")"
 	if [[ -n "${VIRTUAL_ENV:-}" && "${VIRTUAL_ENV}" == "${VENV}" ]]; then
@@ -56,13 +61,9 @@ install_venv() {
 		sudo chown "${USER:-$(whoami)}" "${venv_parent}"
 	fi
 
-	if [[ ! -x "${venv_python}" ]]; then
-		echo "→ Creating virtualenv ${VENV}"
-		"${bootstrap_python}" -m venv "${VENV}"
-		echo "✅ Virtualenv created"
-	else
-		echo "→ Virtualenv already exists"
-	fi
+	echo "→ Creating virtualenv ${VENV}"
+	"${bootstrap_python}" -m venv "${VENV}"
+	echo "✅ Virtualenv created"
 }
 
 install_venv
diff --git a/scripts/make/parallel.sh b/scripts/make/parallel.sh
index 0140e2db07..83a5678f41 100755
--- a/scripts/make/parallel.sh
+++ b/scripts/make/parallel.sh
@@ -14,6 +14,12 @@ if [[ $# -eq 0 ]]; then
 	exit 2
 fi
 
+duplicates="$(printf '%s\n' "$@" | sort | uniq -d)"
+if [[ -n "${duplicates}" ]]; then
+	echo "scripts/make/parallel.sh: duplicate target(s): ${duplicates//$'\n'/ }; each table here is keyed by target name, so a repeat overwrites the first run's exit code and log" >&2 # nocheck: self-path-reference
+	exit 2
+fi
+
 # shellcheck source=scripts/meta/env/load.sh
 source scripts/meta/env/load.sh
 
diff --git a/scripts/meta/resolve/diff/affected_roles.sh b/scripts/meta/resolve/diff/affected_roles.sh
index ef32acb46b..696fb528f2 100755
--- a/scripts/meta/resolve/diff/affected_roles.sh
+++ b/scripts/meta/resolve/diff/affected_roles.sh
@@ -21,7 +21,11 @@
 #                                        (resolver exit 2), OR
 #                                      * the resolver itself errors out
 #                                        (any other non-zero exit).
-#   <role-id> [<role-id> ...]        restricted deploy set (whitelist).
+#   <token> [<token> ...]            restricted deploy set (whitelist).
+#                                    A token is a role id, narrowed to the
+#                                    variants that reach a seed where not all
+#                                    of them do (`web-app-x#0,2`, see
+#                                    utils.github.variant.selection).
 #
 # Pre-conditions:
 #   - The host Python interpreter referenced by ${PYTHON:-python3} has the
diff --git a/scripts/meta/wait/ci_images.sh b/scripts/meta/wait/ci_images.sh
new file mode 100755
index 0000000000..194c4b081d
--- /dev/null
+++ b/scripts/meta/wait/ci_images.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Env:
+#   REGISTRY, OWNER, REPO_PREFIX, CI_TAG, INFINITO_DISTROS
+#     image coordinates, as scripts/meta/resolve/missing/ci_images.sh reads them
+#   WAIT_ATTEMPTS        polls before giving up (default 60)
+#   WAIT_SLEEP_SECONDS   seconds between polls (default 10)
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+resolver="${script_dir}/../resolve/missing/ci_images.sh"
+
+wait_attempts="${WAIT_ATTEMPTS:-60}"
+wait_sleep_seconds="${WAIT_SLEEP_SECONDS:-10}"
+
+echo "⏳ Waiting for the CI images tagged ${CI_TAG:?}"
+
+for attempt in $(seq 1 "${wait_attempts}"); do
+	if ! still_missing="$(bash "${resolver}")"; then
+		echo "❌ Could not check the CI images; see the resolver's output above." >&2
+		exit 2
+	fi
+
+	if [[ "${still_missing}" == "false" ]]; then
+		echo "✅ Every CI image is available."
+		exit 0
+	fi
+
+	echo "   attempt ${attempt}/${wait_attempts}: still incomplete"
+	sleep "${wait_sleep_seconds}"
+done
+
+echo "❌ Gave up after ${wait_attempts} attempts." >&2
+exit 1
diff --git a/scripts/tests/code/run.sh b/scripts/tests/code/run.sh
index bcec6268d4..b4c74106c9 100755
--- a/scripts/tests/code/run.sh
+++ b/scripts/tests/code/run.sh
@@ -35,7 +35,7 @@ if "${PYTHON}" -c 'import pytest, xdist' >/dev/null 2>&1; then
 	# the exact set `unittest discover` runs. PYTHONDONTWRITEBYTECODE keeps
 	# namespace probing from dropping __pycache__ into roles/.
 	mkdir -p build/test-reports
-	PYTHONDONTWRITEBYTECODE=1 "${PYTHON}" -m pytest "${_suite_dir}" -q -n auto -rP -p no:cacheprovider \
+	PYTHONDONTWRITEBYTECODE=1 "${PYTHON}" -m pytest "${_suite_dir}" -q -n auto --dist loadscope -rP -p no:cacheprovider \
 		--import-mode=importlib \
 		--junitxml="${_junit_report}" \
 		-o consider_namespace_packages=true \
diff --git a/scripts/tests/deploy/swarm/utils/collect/diagnostics.sh b/scripts/tests/deploy/swarm/utils/collect/diagnostics.sh
index 3684745315..6fa5376a3e 100755
--- a/scripts/tests/deploy/swarm/utils/collect/diagnostics.sh
+++ b/scripts/tests/deploy/swarm/utils/collect/diagnostics.sh
@@ -144,6 +144,20 @@ for node in "${MGR}" "${WRK1}" "${WRK2}" "${NFS_SERVER}"; do
 	dexec "${node}" sh -c "ss -lunp 2>/dev/null; ss -lntp 2>/dev/null" || echo "(ss unavailable)"
 	echo "--- dnsmasq journal ---"
 	dexec "${node}" sh -c "journalctl -u dnsmasq --no-pager 2>&1" || echo "(journalctl unavailable)"
+	echo "--- dnsmasq command line ---"
+	# shellcheck disable=SC2016
+	dexec "${node}" sh -c 'pid=$(systemctl show -p MainPID --value dnsmasq 2>/dev/null)
+if [ -n "${pid}" ] && [ "${pid}" != "0" ] && [ -r "/proc/${pid}/cmdline" ]; then
+  tr "\000" "\n" < "/proc/${pid}/cmdline"
+else
+  echo "(dnsmasq has no readable MainPID)"
+fi' || echo "(dnsmasq cmdline unavailable)"
+	echo "--- dnsmasq startup wiring ---"
+	dexec "${node}" sh -c 'cat /etc/default/dnsmasq 2>&1 || echo "(no /etc/default/dnsmasq)"'
+	dexec "${node}" sh -c "systemctl cat dnsmasq 2>&1" || echo "(systemctl cat unavailable)"
+	echo "--- dnsmasq config on disk ---"
+	dexec "${node}" sh -c 'cat /etc/dnsmasq.conf 2>&1 || echo "(no /etc/dnsmasq.conf)"'
+	dexec "${node}" sh -c 'ls -l /etc/dnsmasq.d 2>&1 || echo "(no /etc/dnsmasq.d)"'
 	echo "--- addresses ---"
 	dexec "${node}" ip -4 addr show
 	echo "--- nat rules ---"
diff --git a/scripts/tests/dns/parallel.sh b/scripts/tests/dns/parallel.sh
index 8e6d2162fb..49390a6fc5 100755
--- a/scripts/tests/dns/parallel.sh
+++ b/scripts/tests/dns/parallel.sh
@@ -43,9 +43,22 @@ run_one() {
 	docker exec "${name}" bash -lc 'exec "${INFINITO_SRC_DIR}/scripts/tests/dns/inside.sh"'
 }
 
+stamp() {
+	local distro="$1"
+	local line
+	while IFS= read -r line; do
+		printf '[%s][%(%H:%M:%S)T] %s\n' "${distro}" -1 "${line}"
+	done
+}
+
+echo "🌐 Testing DNS on ${#distros[@]} distro(s) concurrently: ${distros[*]}"
+
 declare -A pid
 for d in "${distros[@]}"; do
-	run_one "${d}" >"/tmp/dns-${d}.log" 2>&1 &
+	(
+		set -o pipefail
+		run_one "${d}" 2>&1 | stamp "${d}" | tee "/tmp/dns-${d}.log"
+	) &
 	pid["${d}"]=$!
 done
 
@@ -53,12 +66,12 @@ rc_total=0
 for d in "${distros[@]}"; do
 	rc=0
 	wait "${pid[${d}]}" || rc=$?
-	echo "::group::DNS ${d} (exit ${rc})"
-	cat "/tmp/dns-${d}.log"
-	echo "::endgroup::"
 	if [[ "${rc}" -ne 0 ]]; then
+		echo "❌ ${d} (exit ${rc})"
 		echo "::error::DNS test failed for ${d}"
 		rc_total=1
+	else
+		echo "✅ ${d}"
 	fi
 	docker rm -f "dns-dind-${d}" >/dev/null 2>&1 || true # nocheck: shell-or-true -- cleanup of a possibly already-removed container
 done
diff --git a/scripts/tests/workspace/utils/cache.sh b/scripts/tests/workspace/utils/cache.sh
index 80ac36e79e..f111c74d30 100755
--- a/scripts/tests/workspace/utils/cache.sh
+++ b/scripts/tests/workspace/utils/cache.sh
@@ -219,7 +219,7 @@ probe_did_inner_build() {
 
 	tmpdir="$(mktemp -d)"
 	cat >"${tmpdir}/Dockerfile" <<-'EOF'
-		FROM debian:bookworm-slim
+		FROM debian:13-slim
 		RUN apt-get update -o Acquire::http::No-Cache=true
 	EOF
 	tag="cache-did-probe-$$"
diff --git a/tasks/stages/01_constructor.yml b/tasks/stages/01_constructor.yml
index e7951f0602..4a18f0b9b9 100644
--- a/tasks/stages/01_constructor.yml
+++ b/tasks/stages/01_constructor.yml
@@ -28,6 +28,9 @@
       ansible.builtin.set_fact:
         networks: "{{ defaults_networks | combine(networks | default({}, true), recursive=True) }}"
 
+    - name: 🧊 Render the applications SPOT once for the merge block
+      applications_carrier: {}
+
     - name: "✅ Sanity check: all group_names must exist in applications"
       ansible.builtin.assert:
         that:
@@ -96,6 +99,10 @@
       ansible.builtin.set_fact:
         service_provider: "{{ defaults_service_provider | combine(service_provider | default({}, true), recursive=True) }}"
 
+    - name: 🧊 Drop the merge-block carrier so later stages re-render
+      applications_carrier:
+        clear: true
+
 - name: "💾 Persist {{ SOFTWARE_NAME }} version"
   ansible.builtin.include_role:
     name: sys-version
diff --git a/templates/roles/README.md.j2.tmpl b/templates/roles/README.md.j2.tmpl
index a1ef0fc411..ad3e55c6b8 100644
--- a/templates/roles/README.md.j2.tmpl
+++ b/templates/roles/README.md.j2.tmpl
@@ -84,6 +84,9 @@ source scripts/meta/env/load.sh
 
 APP={{ application_id }}
 DOMAIN=<your-domain>
+{% if application_needs_clearnet_resolver -%}
+DNS=<your-clearnet-resolver>
+{% endif -%}
 TLS_MODE=self_signed
 SSH_PUBLIC_KEY="<your-ssh-public-key>"
 INVENTORY=inventories/production
@@ -91,7 +94,7 @@ infinito administration inventory provision "$INVENTORY" \
   --inventory-file "$INVENTORY/devices.yml" \
   --host localhost \
   --include "$APP" \
-  --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", \"users\": {\"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}"
+  --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", {% if application_needs_clearnet_resolver %}\"networks\": {\"internet\": {\"dns\": \"$DNS\"}}, {% endif %}\"users\": {\"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}"
 infinito administration deploy dedicated "$INVENTORY/devices.yml" \
   --password-file "$INVENTORY/.password" \
   --diff -vv
@@ -103,19 +106,22 @@ Run the published image to provision the inventory and deploy {{ application_nam
 APP={{ application_id }}
 HOST=<your-server>
 DOMAIN=<your-domain>
+{% if application_needs_clearnet_resolver -%}
+DNS=<your-clearnet-resolver>
+{% endif -%}
 TLS_MODE=self_signed
 SSH_PUBLIC_KEY="<your-ssh-public-key>"
 
 docker run --rm -it \
   -v "$PWD/inventories:/etc/infinito.nexus/inventories" \
-  -e APP="$APP" -e HOST="$HOST" -e DOMAIN="$DOMAIN" -e TLS_MODE="$TLS_MODE" -e SSH_PUBLIC_KEY="$SSH_PUBLIC_KEY" \
+  -e APP="$APP" -e HOST="$HOST" -e DOMAIN="$DOMAIN" {% if application_needs_clearnet_resolver %}-e DNS="$DNS" {% endif %}-e TLS_MODE="$TLS_MODE" -e SSH_PUBLIC_KEY="$SSH_PUBLIC_KEY" \
   ghcr.io/infinito-nexus/core/debian bash -c '
     INVENTORY=/etc/infinito.nexus/inventories/production
     infinito administration inventory provision "$INVENTORY" \
       --inventory-file "$INVENTORY/devices.yml" \
       --host "$HOST" \
       --include "$APP" \
-      --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", \"users\": {\"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}" &&
+      --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", {% if application_needs_clearnet_resolver %}\"networks\": {\"internet\": {\"dns\": \"$DNS\"}}, {% endif %}\"users\": {\"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}" &&
     infinito administration deploy dedicated "$INVENTORY/devices.yml" \
       --password-file "$INVENTORY/.password" \
       --diff -vv'
diff --git a/tests/external/roles/test_ai_local_models_downloadable.py b/tests/external/roles/test_ai_local_models_downloadable.py
new file mode 100644
index 0000000000..4f013d6788
--- /dev/null
+++ b/tests/external/roles/test_ai_local_models_downloadable.py
@@ -0,0 +1,260 @@
+"""Every declared local AI model still resolves to a file upstream serves.
+
+``group_vars/all/16_ai.yml`` pins each model by repository, file name and
+sha256 so a deploy fetches it with a checksum instead of trusting whatever a
+search term resolves to. A pin that upstream no longer matches becomes a deploy
+that transfers half a gigabyte on every host and then fails on the digest, with
+nothing in the failure naming the declaration as the cause.
+
+The declaration's own shape is a repository fact and is asserted. Whether the
+file is still served is a network fact, so a timeout or a refused connection is
+reported as unverified rather than failing, the way the sibling external checks
+do: a firewalled runner must not turn a good pin red. An answer that contradicts
+the pin is a defect in the repository and does fail.
+"""
+
+from __future__ import annotations
+
+import concurrent.futures
+import re
+import unittest
+from urllib.parse import urlsplit
+
+import requests
+
+from utils.annotations.message import warning
+from utils.cache.yaml import load_yaml_any
+
+from . import PROJECT_ROOT
+
+_AI_VARS_FILE = "group_vars/all/16_ai.yml"
+_HUGGINGFACE_PREFIX = "https://huggingface.co/"
+_USER_AGENT = "infinito-nexus-model-pin-check"
+_TIMEOUT_SECONDS = 20
+_MAX_WORKERS = 4
+_SHA256 = re.compile(r"^[0-9a-f]{64}$")
+
+
+def _models() -> list[dict]:
+    data = load_yaml_any(str(PROJECT_ROOT / _AI_VARS_FILE)) or {}
+    entries = data.get("AI_LOCAL_MODELS") if isinstance(data, dict) else None
+    return [entry for entry in (entries or []) if isinstance(entry, dict)]
+
+
+def _repo_path(entry: dict) -> str:
+    """Return the HuggingFace ``user/repo`` this entry pins, else empty.
+
+    Args:
+        entry: one AI_LOCAL_MODELS declaration.
+    """
+    url = str(entry.get("url") or "")
+    if not url.startswith(_HUGGINGFACE_PREFIX):
+        return ""
+    return str(entry.get("repo") or "").strip("/")
+
+
+def _download_url(entry: dict) -> str:
+    return str(entry["url"])
+
+
+def _mirror_urls(entry: dict) -> list[str]:
+    """Every extra URL a deploy falls back to, in declaration order."""
+    mirrors = entry.get("mirrors") or []
+    return [str(url) for url in mirrors if isinstance(url, str)]
+
+
+def _upstream_digests(repo_path: str) -> tuple[str, object]:
+    """Return (kind, payload) with kind one of ok, warn, unverified.
+
+    On ``ok`` the payload maps each published file name to its sha256 and byte
+    count, which is what the pin is compared against without transferring the
+    file itself.
+    """
+    url = f"{_HUGGINGFACE_PREFIX}api/models/{repo_path}"
+    try:
+        response = requests.get(
+            url,
+            params={"blobs": "true"},
+            headers={"User-Agent": _USER_AGENT},
+            timeout=_TIMEOUT_SECONDS,
+        )
+    except requests.Timeout as exc:
+        return "unverified", f"Timeout: {exc}"
+    except requests.RequestException as exc:
+        return "unverified", f"{type(exc).__name__}: {exc}"
+
+    if response.status_code != 200:
+        return "warn", f"HTTP {response.status_code}"
+    try:
+        payload = response.json()
+    except ValueError as exc:
+        return "unverified", f"unparsable answer: {exc}"
+
+    digests = {}
+    for sibling in payload.get("siblings") or []:
+        if not isinstance(sibling, dict):
+            continue
+        name = sibling.get("rfilename")
+        digest = (sibling.get("lfs") or {}).get("sha256")
+        size = (sibling.get("lfs") or {}).get("size") or sibling.get("size")
+        if isinstance(name, str) and isinstance(digest, str):
+            digests[name] = {"sha256": digest, "size": size}
+    return "ok", digests
+
+
+def _reachable(url: str) -> tuple[str, str]:
+    """Return (kind, detail); a redirect to the CDN counts as reachable."""
+    try:
+        response = requests.get(
+            url,
+            allow_redirects=True,
+            headers={"User-Agent": _USER_AGENT, "Range": "bytes=0-0"},
+            stream=True,
+            timeout=_TIMEOUT_SECONDS,
+        )
+        try:
+            status = response.status_code
+        finally:
+            response.close()
+    except requests.Timeout as exc:
+        return "unverified", f"Timeout: {exc}"
+    except requests.RequestException as exc:
+        return "unverified", f"{type(exc).__name__}: {exc}"
+
+    if status < 400:
+        return "ok", f"HTTP {status}"
+    return "warn", f"HTTP {status}"
+
+
+class TestAiLocalModelsDownloadable(unittest.TestCase):
+    def test_every_declared_model_is_pinned(self) -> None:
+        models = _models()
+        self.assertTrue(models, f"{_AI_VARS_FILE} declares no AI_LOCAL_MODELS")
+
+        unpinned = []
+        for entry in models:
+            alias = str(entry.get("alias") or "<no alias>")
+            url = entry.get("url")
+            repo = entry.get("repo")
+            file_name = entry.get("file")
+            digest = entry.get("sha256")
+            if not isinstance(url, str) or not urlsplit(url).scheme:
+                unpinned.append(f"{alias}: 'url' is not an absolute URL")
+            if not isinstance(repo, str) or len(repo.strip("/").split("/")) != 2:
+                unpinned.append(f"{alias}: 'repo' is not '<publisher>/<repo>'")
+            if not isinstance(file_name, str) or not file_name:
+                unpinned.append(f"{alias}: 'file' is missing")
+            if not isinstance(digest, str) or not _SHA256.match(digest):
+                unpinned.append(f"{alias}: 'sha256' is not 64 hex characters")
+            size = entry.get("bytes")
+            if not isinstance(size, int) or size <= 0:
+                unpinned.append(f"{alias}: 'bytes' is not a positive integer")
+
+        self.assertFalse(
+            unpinned,
+            f"{len(unpinned)} model declaration(s) in {_AI_VARS_FILE} cannot be "
+            f"fetched with a checksum. Each entry needs 'url', 'repo', 'file' "
+            f"and 'sha256':\n" + "\n".join(f"  {line}" for line in unpinned),
+        )
+
+    def test_every_pin_matches_what_upstream_serves(self) -> None:
+        models = [
+            entry
+            for entry in _models()
+            if isinstance(entry.get("url"), str)
+            and isinstance(entry.get("file"), str)
+            and isinstance(entry.get("sha256"), str)
+        ]
+        self.assertTrue(models, f"{_AI_VARS_FILE} declares no pinned model")
+
+        repo_paths = [_repo_path(entry) for entry in models]
+        with concurrent.futures.ThreadPoolExecutor(max_workers=_MAX_WORKERS) as pool:
+            api = list(pool.map(_upstream_digests, repo_paths))
+            reach = list(pool.map(_reachable, [_download_url(e) for e in models]))
+
+        mismatched = []
+        for entry, repo_path, (kind, payload), (rkind, rdetail) in zip(
+            models, repo_paths, api, reach, strict=True
+        ):
+            alias = entry["alias"]
+            url = _download_url(entry)
+            if rkind != "ok":
+                warning(
+                    f"{alias}: {url} answered {rdetail}"
+                    if rkind == "warn"
+                    else f"{alias}: {url} was not checked ({rdetail})",
+                    title="Model unreachable"
+                    if rkind == "warn"
+                    else "Model unverified",
+                    file=_AI_VARS_FILE,
+                )
+            if not repo_path:
+                continue
+            if kind != "ok":
+                warning(
+                    f"{alias}: {repo_path} was not checked ({payload})",
+                    title="Model pin unverified",
+                    file=_AI_VARS_FILE,
+                )
+                continue
+            published = payload.get(entry["file"])
+            if published is None:
+                mismatched.append(
+                    f"{alias}: {repo_path} no longer publishes {entry['file']}"
+                )
+                continue
+            if published["sha256"] != entry["sha256"]:
+                mismatched.append(
+                    f"{alias}: {entry['file']} is {published['sha256']} upstream, "
+                    f"pinned as {entry['sha256']}"
+                )
+            pinned_size = entry.get("bytes")
+            if published["size"] is not None and published["size"] != pinned_size:
+                mismatched.append(
+                    f"{alias}: {entry['file']} is {published['size']} bytes "
+                    f"upstream, pinned as {pinned_size}"
+                )
+
+        self.assertFalse(
+            mismatched,
+            f"{len(mismatched)} model pin(s) in {_AI_VARS_FILE} no longer match "
+            f"what upstream publishes. Update 'file' and 'sha256' to the value "
+            f"the repository serves today:\n"
+            + "\n".join(f"  {line}" for line in mismatched),
+        )
+
+    def test_every_declared_mirror_still_serves_the_file(self) -> None:
+        targets = [
+            (str(entry.get("alias") or "<no alias>"), url)
+            for entry in _models()
+            for url in _mirror_urls(entry)
+        ]
+        if not targets:
+            self.skipTest(f"{_AI_VARS_FILE} declares no model mirror")
+
+        with concurrent.futures.ThreadPoolExecutor(max_workers=_MAX_WORKERS) as pool:
+            answers = list(pool.map(_reachable, [url for _, url in targets]))
+
+        broken = []
+        for (alias, url), (kind, detail) in zip(targets, answers, strict=True):
+            if kind == "ok":
+                continue
+            if kind == "unverified":
+                warning(
+                    f"{alias}: mirror {url} was not checked ({detail})",
+                    title="Model mirror unverified",
+                    file=_AI_VARS_FILE,
+                )
+                continue
+            broken.append(f"{alias}: mirror {url} answered {detail}")
+
+        self.assertFalse(
+            broken,
+            f"{len(broken)} declared mirror(s) no longer serve the pinned file, so "
+            "they add no redundancy. Drop the entry or point it at a copy that "
+            "answers:\n" + "\n".join(f"  {line}" for line in broken),
+        )
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()
diff --git a/tests/external/roles/test_pinned_addon_archives_available.py b/tests/external/roles/test_pinned_addon_archives_available.py
new file mode 100644
index 0000000000..93d5b8e0d3
--- /dev/null
+++ b/tests/external/roles/test_pinned_addon_archives_available.py
@@ -0,0 +1,123 @@
+"""Every addon pinned to a release archive still resolves upstream.
+
+An addon may carry ``config.archive``: the deploy fetches that archive and
+unpacks it instead of letting the app store pick the newest release. The pin
+exists because a store can advertise a release whose artifact was never
+published, and a deploy has no way to fall back from that.
+
+The pin is worth exactly as long as the artifact outlives it. When upstream
+retires the release, every deploy of that role fails at install time with a 404
+and nothing in the failure names the declaration as the cause. The same shape
+already cost this repository a red CI job on two runs, in the opposite
+direction: the store offered a version whose archive answered 404.
+
+The declaration's shape is a repository fact and is asserted. Whether the
+archive is still served is a network fact, so a timeout or a refused connection
+is reported as unverified rather than failing, the way the sibling external
+checks do: a firewalled runner must not turn a good pin red. An answer that
+contradicts the pin is a defect in the repository and does fail.
+"""
+
+from __future__ import annotations
+
+import concurrent.futures
+import unittest
+from pathlib import Path
+from urllib.parse import urlsplit
+
+import requests
+
+from utils.annotations.message import warning
+from utils.cache.yaml import load_yaml_any
+
+from . import PROJECT_ROOT
+
+_ADDON_GLOB = "*/meta/addons/*.yml"
+_USER_AGENT = "infinito-nexus-addon-pin-check"
+_TIMEOUT_SECONDS = 20
+_MAX_WORKERS = 4
+
+
+def _pinned_archives() -> list[tuple[str, str, str]]:
+    """Every ``(role, addon, archive)`` an addon pins, in path order."""
+    found: list[tuple[str, str, str]] = []
+    for addon_file in sorted((PROJECT_ROOT / "roles").glob(_ADDON_GLOB)):
+        spec = load_yaml_any(str(addon_file), default_if_missing={}) or {}
+        archive = (spec.get("config") or {}).get("archive")
+        if not archive:
+            continue
+        role = addon_file.parent.parent.parent.name
+        found.append((role, addon_file.stem, str(archive)))
+    return found
+
+
+def _relative(role: str, addon: str) -> str:
+    return str(Path("roles") / role / "meta" / "addons" / f"{addon}.yml")
+
+
+def _reachable(url: str) -> tuple[str, str]:
+    """Return (kind, detail); a redirect to a release CDN counts as reachable."""
+    try:
+        response = requests.get(
+            url,
+            allow_redirects=True,
+            headers={"User-Agent": _USER_AGENT, "Range": "bytes=0-0"},
+            stream=True,
+            timeout=_TIMEOUT_SECONDS,
+        )
+        try:
+            status = response.status_code
+        finally:
+            response.close()
+    except requests.Timeout as exc:
+        return "unverified", f"Timeout: {exc}"
+    except requests.RequestException as exc:
+        return "unverified", f"{type(exc).__name__}: {exc}"
+
+    if status < 400:
+        return "ok", f"HTTP {status}"
+    return "gone", f"HTTP {status}"
+
+
+class TestPinnedAddonArchivesAvailable(unittest.TestCase):
+    def test_every_pinned_archive_is_an_absolute_url(self) -> None:
+        malformed = [
+            f"{role}.{addon}: {archive!r} is not an absolute URL"
+            for role, addon, archive in _pinned_archives()
+            if not urlsplit(archive).scheme or not urlsplit(archive).netloc
+        ]
+        self.assertFalse(
+            malformed,
+            f"{len(malformed)} addon pin(s) cannot be fetched. 'config.archive' "
+            "must be an absolute URL to a release artifact:\n"
+            + "\n".join(f"  {line}" for line in malformed),
+        )
+
+    def test_every_pinned_archive_is_still_served(self) -> None:
+        pins = _pinned_archives()
+        if not pins:
+            self.skipTest("no addon pins a release archive")
+
+        with concurrent.futures.ThreadPoolExecutor(max_workers=_MAX_WORKERS) as pool:
+            answers = list(pool.map(_reachable, [archive for _, _, archive in pins]))
+
+        retired = []
+        for (role, addon, archive), (kind, detail) in zip(pins, answers, strict=True):
+            if kind == "ok":
+                continue
+            if kind == "unverified":
+                warning(
+                    f"{role}.{addon}: {archive} was not checked ({detail})",
+                    title="Addon pin unverified",
+                    file=_relative(role, addon),
+                )
+                continue
+            retired.append(f"{role}.{addon}: {archive} answered {detail}")
+
+        self.assertFalse(
+            retired,
+            f"{len(retired)} pinned addon archive(s) are gone upstream. Every "
+            "deploy of the role fails at install time until the pin moves to a "
+            "release that is still published:\n"
+            + "\n".join(f"  {line}" for line in retired),
+        )
diff --git a/tests/external/update/docker/test_image_pin_policy.py b/tests/external/update/docker/test_image_pin_policy.py
new file mode 100644
index 0000000000..be4e27c3fa
--- /dev/null
+++ b/tests/external/update/docker/test_image_pin_policy.py
@@ -0,0 +1,122 @@
+"""Enforce the pin ranking: a semver tag, else a digest, and nothing else.
+
+Two states fail here, and neither is a matter of taste:
+
+* A pin that is neither a semver tag nor a digest names something the registry
+  can move under us. Nothing in this repository can tell whether it still points
+  where it did when it was written.
+* A digest where the registry does publish semver tags. The digest is the
+  fallback for upstreams that offer no orderable tag; taking it anyway opts the
+  entry out of the freshness pipeline for no gain.
+
+Both are declarable when the choice is deliberate, with ``# nocheck:
+docker-version`` respectively ``# nocheck: docker-digest`` on the ``version:``
+line or the one above it. The mirror case is the reason the second one exists:
+a tag whose bytes moved is worth pinning past, even though the tag exists.
+
+Opt-in external test: it reads live third-party registries and runs only under
+the external suite. The offline sibling at
+[test_semver_pinning.py](../../../lint/ansible/services/test_semver_pinning.py)
+warns about the same pins without failing.
+"""
+
+from __future__ import annotations
+
+import concurrent.futures
+import unittest
+
+from utils.annotations.suppress import is_suppressed_at
+from utils.cache.files import read_text
+from utils.docker.image.discovery import iter_role_images
+from utils.docker.image.pin import DIGEST, REF, RULE_BY_CLASS, pin_class
+from utils.docker.registry import fetch_registry_tags
+from utils.roles.mapping import ROLE_FILE_META_SERVICES
+from utils.update.base import is_semver, resolve_max_fetch_workers
+from utils.update.docker import is_supported_registry
+
+from . import PROJECT_ROOT
+
+
+def _pull_image(ref) -> str:
+    return ref.name if ref.registry == "docker.io" else f"{ref.registry}/{ref.name}"
+
+
+def _declared(ref, rule: str) -> bool:
+    """Whether the ``version:`` line carrying this pin opts out of *rule*."""
+    path = PROJECT_ROOT / "roles" / ref.role / ROLE_FILE_META_SERVICES
+    lines = read_text(path).splitlines()
+    needle = ref.version.strip()
+    numbers = [
+        number
+        for number, line in enumerate(lines, start=1)
+        if line.split("#", 1)[0].strip().startswith("version:")
+        and needle in line.split("#", 1)[0]
+    ]
+    return bool(numbers) and all(
+        is_suppressed_at(lines, number, rule) for number in numbers
+    )
+
+
+def _offers_semver(image: str) -> bool:
+    return any(is_semver(tag) for tag in fetch_registry_tags(image))
+
+
+class TestImagePinPolicy(unittest.TestCase):
+    """A pin is a semver tag, a justified digest, or a declared exception."""
+
+    def test_unpinned_and_unversioned_entries_are_rejected(self) -> None:
+        refs = list(iter_role_images(PROJECT_ROOT))
+        self.assertTrue(refs, "No role images discovered")
+
+        offenders = [
+            f"  roles/{ref.role}/{ROLE_FILE_META_SERVICES}: {ref.service} pins "
+            f"{ref.version!r}, which is neither a version nor a digest"
+            for ref in refs
+            if pin_class(ref.version) == REF and not _declared(ref, RULE_BY_CLASS[REF])
+        ]
+
+        if offenders:
+            listing = "\n".join(sorted(offenders))
+            self.fail(
+                "These entries pin a name the registry can move under them. "
+                "Pin a semver tag, or a digest when upstream publishes none, or "
+                f"declare the choice with `# nocheck: {RULE_BY_CLASS[REF]}`:\n"
+                f"{listing}"
+            )
+
+    def test_a_digest_is_rejected_where_semver_is_published(self) -> None:
+        refs = [
+            ref
+            for ref in iter_role_images(PROJECT_ROOT)
+            if pin_class(ref.version) == DIGEST
+            and is_supported_registry(ref.name)
+            and not _declared(ref, RULE_BY_CLASS[DIGEST])
+        ]
+        if not refs:
+            self.skipTest("no undeclared digest pins to check")
+
+        images = {_pull_image(ref) for ref in refs}
+        with concurrent.futures.ThreadPoolExecutor(
+            max_workers=resolve_max_fetch_workers()
+        ) as pool:
+            offers = dict(zip(images, pool.map(_offers_semver, images), strict=True))
+
+        offenders = [
+            f"  roles/{ref.role}/{ROLE_FILE_META_SERVICES}: {ref.service} pins a "
+            f"digest while {_pull_image(ref)} publishes semver tags"
+            for ref in refs
+            if offers.get(_pull_image(ref))
+        ]
+
+        if offenders:
+            listing = "\n".join(sorted(offenders))
+            self.fail(
+                "A digest is the fallback for an upstream that publishes no "
+                "orderable tag. These have one, so the digest only hides them "
+                f"from the update job. Use the tag, or declare why not with "
+                f"`# nocheck: {RULE_BY_CLASS[DIGEST]}`:\n{listing}"
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/external/update/docker/test_image_reachable.py b/tests/external/update/docker/test_image_reachable.py
index 9065c44535..362d1e5ec9 100644
--- a/tests/external/update/docker/test_image_reachable.py
+++ b/tests/external/update/docker/test_image_reachable.py
@@ -17,6 +17,7 @@ import unittest
 
 from utils.annotations.message import warning
 from utils.docker.image.discovery import iter_role_images, load_yaml
+from utils.docker.image.pin import pull_reference
 from utils.docker.registry import manifest_exists
 from utils.roles.mapping import ROLE_FILE_META_SERVICES
 from utils.update.base import resolve_max_fetch_workers
@@ -28,6 +29,10 @@ def _pull_image(ref) -> str:
     return ref.name if ref.registry == "docker.io" else f"{ref.registry}/{ref.name}"
 
 
+def _display(ref) -> str:
+    return pull_reference(_pull_image(ref), ref.version)
+
+
 class TestDockerImageReachable(unittest.TestCase):
     """Fail on any pinned Docker image:version tag the registry reports absent."""
 
@@ -57,7 +62,7 @@ class TestDockerImageReachable(unittest.TestCase):
 
         for ref in indeterminate:
             warning(
-                f"{ref.role}/{ref.service}: {_pull_image(ref)}:{ref.version} "
+                f"{ref.role}/{ref.service}: {_display(ref)} "
                 f"could not be verified (network / auth / rate-limit)",
                 title="🔍 Unverified Docker image",
                 file=f"roles/{ref.role}/{ROLE_FILE_META_SERVICES}",
@@ -65,12 +70,12 @@ class TestDockerImageReachable(unittest.TestCase):
 
         if missing:
             lines = "\n".join(
-                f"  {ref.role}/{ref.service}: {_pull_image(ref)}:{ref.version}"
+                f"  {ref.role}/{ref.service}: {_display(ref)}"
                 for ref in sorted(missing, key=lambda r: (r.role, r.service))
             )
             self.fail(
-                "These pinned Docker image:version tags do not exist in their "
-                f"registry (HTTP 404):\n{lines}"
+                "These pinned Docker images do not exist in their registry "
+                f"(HTTP 404):\n{lines}"
             )
 
     def test_incomplete_image_version_pairs_warn(self) -> None:
diff --git a/tests/integration/ansible/filters/test_defined.py b/tests/integration/ansible/filters/test_defined.py
index 3b531346e4..cf8cd59d76 100644
--- a/tests/integration/ansible/filters/test_defined.py
+++ b/tests/integration/ansible/filters/test_defined.py
@@ -51,6 +51,7 @@ BUILTIN_FILTERS: set[str] = {
     "sort",
     "string",
     "striptags",
+    "subelements",
     "sum",
     "title",
     "trim",
diff --git a/tests/integration/ansible/jinja/test_variable_definitions.py b/tests/integration/ansible/jinja/test_variable_definitions.py
index ee269ed5b1..0092ae1603 100644
--- a/tests/integration/ansible/jinja/test_variable_definitions.py
+++ b/tests/integration/ansible/jinja/test_variable_definitions.py
@@ -17,8 +17,12 @@ logger = logging.getLogger(__name__)
 class TestVariableDefinitions(unittest.TestCase):
     """
     Ensures that every Jinja2 variable used in templates/playbooks is defined
-    somewhere in the repository (direct var files, set_fact/vars blocks,
-    loop_var/register names, Jinja set/for definitions, and Jinja macro parameters).
+    somewhere in the repository (direct var files, the shipped inventories,
+    set_fact/vars blocks, loop_var/register names, Jinja set/for definitions,
+    and Jinja macro parameters).
+
+    The inventories count because the deploy CLI bakes them into host_vars, so
+    a `meta/variants.yml` entry resolves against them exactly like a group_var.
 
     If a variable is not defined, the test passes only if a corresponding
     fallback key exists (either "default_<var>" or "defaults_<var>").
@@ -32,6 +36,7 @@ class TestVariableDefinitions(unittest.TestCase):
         self.var_files: list[str] = []
         roles_prefix = str(Path(self.project_root) / "roles") + "/"
         group_vars_prefix = str(Path(self.project_root) / "group_vars" / "all") + "/"
+        inventory_prefix = str(Path(self.project_root) / "inventories") + "/"
 
         def _is_role_var_file(p: str) -> bool:
             if not p.startswith(roles_prefix):
@@ -40,9 +45,13 @@ class TestVariableDefinitions(unittest.TestCase):
             return len(parts) >= 3 and parts[1] in ("vars", "defaults")
 
         for p in iter_project_files(extensions=(".yml",)):
-            if _is_role_var_file(p) or (
-                p.startswith(group_vars_prefix)
-                and "/" not in p[len(group_vars_prefix) :]
+            if (
+                _is_role_var_file(p)
+                or (
+                    p.startswith(group_vars_prefix)
+                    and "/" not in p[len(group_vars_prefix) :]
+                )
+                or p.startswith(inventory_prefix)
             ):
                 self.var_files.append(p)
 
@@ -237,6 +246,7 @@ class TestVariableDefinitions(unittest.TestCase):
                             "ansible_memtotal_mb",
                             "omit",
                             "group_names",
+                            "ansible_parent_role_names",
                             "ansible_processor_vcpus",
                             "ansible_service_mgr",
                             "ansible_distribution_release",
@@ -284,6 +294,7 @@ class TestVariableDefinitions(unittest.TestCase):
                                 "ansible_memtotal_mb",
                                 "omit",
                                 "group_names",
+                                "ansible_parent_role_names",
                                 "ansible_processor_vcpus",
                                 "ansible_distribution_release",
                                 "ansible_distribution",
diff --git a/tests/integration/meta/workflows/test_ci_inputs_documented.py b/tests/integration/meta/workflows/test_ci_inputs_documented.py
new file mode 100644
index 0000000000..3676d7d1aa
--- /dev/null
+++ b/tests/integration/meta/workflows/test_ci_inputs_documented.py
@@ -0,0 +1,96 @@
+"""Integration guard: every repository secret and variable a workflow reads is documented.
+
+Background
+==========
+A `${{ secrets.X }}` or `${{ vars.X }}` reference is a contract with whoever
+administers the repository, and an unset one resolves to the empty string
+rather than to an error. An undocumented name is therefore invisible twice: the
+administrator cannot know to set it, and the run that needed it degrades
+silently.
+
+The guard also catches the inverse drift, a doc naming a variable the workflows
+no longer read under that name, because it compares the reference against the
+page rather than the page against itself.
+
+Scope
+=====
+Every `${{ secrets.<NAME> }}` and `${{ vars.<NAME> }}` on a non-comment line of
+`.github/workflows/*.yml`. Secrets MUST appear in `secrets.md`, variables in
+`configuration.md`, both under `docs/contributing/tools/github/actions/`.
+
+Exemptions
+==========
+`GITHUB_TOKEN` is minted by GitHub for every run; it is not administered and
+cannot be set. Any other exemption belongs in `_PROVIDED_SECRETS` with the
+reason it is not administrator-supplied.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+
+from utils.cache.files import read_text
+
+from . import PROJECT_ROOT
+
+WORKFLOWS = PROJECT_ROOT / ".github" / "workflows"
+DOCS = PROJECT_ROOT / "docs" / "contributing" / "tools" / "github" / "actions"
+
+_REFERENCE = re.compile(r"\$\{\{\s*(secrets|vars)\.([A-Za-z_][A-Za-z0-9_]*)")
+
+_PROVIDED_SECRETS = frozenset({"GITHUB_TOKEN"})
+
+_PAGES = {"secrets": "secrets.md", "vars": "configuration.md"}
+
+
+def _referenced() -> dict[str, set[str]]:
+    """Names the workflows actually read, keyed by `secrets` / `vars`.
+
+    A commented-out line is skipped: it documents an option nobody has taken,
+    and demanding a doc row for it would describe an input the run never asks
+    for.
+    """
+    found: dict[str, set[str]] = {"secrets": set(), "vars": set()}
+    for workflow in sorted(WORKFLOWS.glob("*.yml")):
+        for line in read_text(str(workflow)).splitlines():
+            if line.lstrip().startswith("#"):
+                continue
+            for kind, name in _REFERENCE.findall(line):
+                if kind == "secrets" and name in _PROVIDED_SECRETS:
+                    continue
+                found[kind].add(name)
+    return found
+
+
+class TestCiInputsDocumented(unittest.TestCase):
+    def test_every_referenced_secret_and_variable_is_documented(self) -> None:
+        offenders: list[str] = []
+        for kind, names in _referenced().items():
+            documented = read_text(str(DOCS / _PAGES[kind]))
+            offenders.extend(
+                f"{kind}.{name} is read by a workflow but absent from "
+                f"docs/contributing/tools/github/actions/{_PAGES[kind]}"
+                for name in sorted(names)
+                if name not in documented
+            )
+
+        if offenders:
+            self.fail(
+                f"{len(offenders)} CI input(s) undocumented:\n"
+                + "\n".join(f"- {o}" for o in offenders)
+                + "\n\nAn unset secret or variable resolves to the empty string, "
+                "so an undocumented one degrades a run instead of failing it. "
+                "Add a row naming the workflow, what it enables, and what "
+                "happens while it is unset."
+            )
+
+    def test_the_guard_reads_workflows_that_exist(self) -> None:
+        self.assertTrue(
+            any(WORKFLOWS.glob("*.yml")),
+            f"no workflow files under {WORKFLOWS}; the guard would pass vacuously",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/meta/workflows/test_ci_retrigger_inputs.py b/tests/integration/meta/workflows/test_ci_retrigger_inputs.py
index 20c937aac2..f5588594c2 100644
--- a/tests/integration/meta/workflows/test_ci_retrigger_inputs.py
+++ b/tests/integration/meta/workflows/test_ci_retrigger_inputs.py
@@ -43,6 +43,7 @@ _VALUES = {
     "filesystem": "btrfs",
     "tor": "enforced",
     "offset": "40",
+    "chunk_size": "25",
     "chunk_gate": "false",
     "sweep": "7",
     "workspace": "true",
diff --git a/tests/integration/meta/workflows/test_variant_payload_scope.py b/tests/integration/meta/workflows/test_variant_payload_scope.py
new file mode 100644
index 0000000000..00a9d18967
--- /dev/null
+++ b/tests/integration/meta/workflows/test_variant_payload_scope.py
@@ -0,0 +1,96 @@
+"""The swarm matrix bakes a variant payload for every app it deploys."""
+
+from __future__ import annotations
+
+import unittest
+from typing import ClassVar
+
+from cli.administration.deploy.development.inventory.payload import (
+    _resolve_variant_payloads,
+    get_variant_overrides_only,
+)
+from cli.administration.deploy.development.inventory.planner import (
+    plan_dev_inventory_matrix,
+)
+from utils.cache.files import PROJECT_ROOT
+from utils.tests.swarm.derive_includes import (
+    _EXPLICIT_INCLUDES,
+    derive_includes,
+    variant_scope,
+)
+
+_ROLES_DIR = str(PROJECT_ROOT / "roles")
+
+
+def _rounds(primary: str) -> list[tuple]:
+    return plan_dev_inventory_matrix(
+        roles_dir=_ROLES_DIR,
+        primary_apps=[primary],
+        base_inventory_dir="/tmp/variant-payload-scope",
+    )
+
+
+class TestVariantPayloadScope(unittest.TestCase):
+    PRIMARIES: ClassVar[tuple[str, ...]] = (
+        "svc-ai-litellm",
+        "web-app-bigbluebutton",
+        "web-app-peertube",
+        "web-app-nextcloud",
+    )
+
+    def test_every_deployed_app_receives_its_declared_override(self) -> None:
+        overrides = get_variant_overrides_only(roles_dir=_ROLES_DIR)
+        for primary in self.PRIMARIES:
+            for round_index, _inv, round_variants, _include, *_ in _rounds(primary):
+                scope = variant_scope(primary, variants=round_variants)
+                payloads = _resolve_variant_payloads(
+                    roles_dir=_ROLES_DIR,
+                    include=scope,
+                    active_variants=round_variants,
+                )
+                for app in derive_includes(primary, variants=round_variants):
+                    declared = overrides.get(app) or []
+                    if not declared:
+                        continue
+                    index = round_variants.get(app, 0)
+                    if not 0 <= index < len(declared):
+                        index = 0
+                    if not declared[index] or app in _EXPLICIT_INCLUDES:
+                        continue
+                    self.assertIn(
+                        app,
+                        payloads,
+                        f"{primary}#{round_index} deploys {app}, whose variants.yml "
+                        f"declares an override, but the inventory bakes none, so it "
+                        f"silently runs on its base config",
+                    )
+
+    def test_a_dependency_keeps_its_override_when_the_include_collapses(self) -> None:
+        primary = "svc-ai-litellm"
+        for round_index, _inv, round_variants, round_include, *_ in _rounds(primary):
+            if "web-app-keycloak" not in variant_scope(
+                primary, variants=round_variants
+            ):
+                continue
+            payloads = _resolve_variant_payloads(
+                roles_dir=_ROLES_DIR,
+                include=variant_scope(primary, variants=round_variants),
+                active_variants=round_variants,
+            )
+            realm = (
+                payloads.get("web-app-keycloak", {})
+                .get("services", {})
+                .get("keycloak", {})
+                .get("realm", {})
+            )
+            self.assertIs(
+                realm.get("totp_enabled"),
+                False,
+                f"{primary}#{round_index} deploys keycloak with "
+                f"{len(round_include)} planned app(s); without its variant override "
+                f"the realm demands CONFIGURE_TOTP and every SSO persona times out",
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/integration/roles/meta/services/repositories/test_declared_in_services.py b/tests/integration/roles/meta/services/repositories/test_declared_in_services.py
index f79749ee30..d3336c8d5d 100644
--- a/tests/integration/roles/meta/services/repositories/test_declared_in_services.py
+++ b/tests/integration/roles/meta/services/repositories/test_declared_in_services.py
@@ -1,6 +1,7 @@
 """Integration guard: every git-clone URL referenced inside a role
 (Dockerfile, tasks, templates, files) MUST be declared as a
-`repository:` value in that role's ``meta/services.yml``.
+`repository:` value in that role's ``meta/services.yml`` or in one of
+its ``meta/addons/<id>.yml`` files, which is where an addon pins itself.
 
 The same applies symmetrically to git refs: any `compose_repository_ref`
 or `--branch <ref>` (clone) value that ties to a declared
@@ -39,7 +40,7 @@ import unittest
 
 from utils.cache.files import iter_project_files, read_text
 from utils.cache.yaml import load_yaml_any
-from utils.roles.mapping import ROLE_FILE_META_SERVICES
+from utils.roles.mapping import ROLE_DIR_META_ADDONS, ROLE_FILE_META_SERVICES
 
 from . import PROJECT_ROOT
 
@@ -106,18 +107,20 @@ class TestDeclaredInServices(unittest.TestCase):
         for role_dir in sorted(p for p in ROLES_DIR.iterdir() if p.is_dir()):
             role_name = role_dir.name
             services_path = role_dir / ROLE_FILE_META_SERVICES
-            declared = (
-                _collect_declared_repositories(services_path)
-                if services_path.is_file()
-                else set()
-            )
+            declaration_paths = [services_path]
+            declaration_paths += sorted((role_dir / ROLE_DIR_META_ADDONS).glob("*.yml"))
+            declared: set[str] = set()
+            for declaration_path in declaration_paths:
+                if declaration_path.is_file():
+                    declared |= _collect_declared_repositories(declaration_path)
+            declaration_names = {str(p) for p in declaration_paths}
 
             seen_paths: set[str] = set()
             for fpath in _iter_role_files(role_dir):
                 if fpath in seen_paths:
                     continue
                 seen_paths.add(fpath)
-                if fpath.endswith("/" + ROLE_FILE_META_SERVICES):
+                if fpath in declaration_names:
                     continue
                 try:
                     text = read_text(fpath)
@@ -140,7 +143,8 @@ class TestDeclaredInServices(unittest.TestCase):
                             f"{role_name}: {rel}:{line_no} "
                             f"references `{url}` but it is not declared "
                             f"as `repository:` in "
-                            f"{role_name}/{ROLE_FILE_META_SERVICES}"
+                            f"{role_name}/{ROLE_FILE_META_SERVICES} "
+                            f"or {role_name}/{ROLE_DIR_META_ADDONS}/"
                         )
 
         if offenders:
diff --git a/tests/integration/roles/svc-net-tor/test_container_dns_wiring.py b/tests/integration/roles/svc-net-tor/test_container_dns_wiring.py
index 7f0dc0d3c7..4ed72e9dd0 100644
--- a/tests/integration/roles/svc-net-tor/test_container_dns_wiring.py
+++ b/tests/integration/roles/svc-net-tor/test_container_dns_wiring.py
@@ -1,5 +1,6 @@
 import unittest
 
+from ansible.module_utils.parsing.convert_bool import boolean as ansible_boolean
 from jinja2 import Environment, FileSystemLoader
 
 from tests.integration.roles import PROJECT_ROOT
@@ -143,9 +144,24 @@ class TestStaticBindSurvivesBoot(unittest.TestCase):
         names = [t.get("name") for t in tasks]
         start = next(t for t in tasks if t.get("name") == START_TASK)
         self.assertLess(names.index(DROPIN_BLOCK), names.index(START_TASK))
+
+        reload_expression = start["ansible.builtin.systemd"]["daemon_reload"]
+        env = Environment(autoescape=False)  # noqa: S701 - renders a boolean, not markup
+        env.filters["bool"] = ansible_boolean
+        env.tests["changed"] = lambda result: bool(result.get("changed", False))
+
         self.assertEqual(
-            start["ansible.builtin.systemd"]["daemon_reload"],
-            "{{ _tor_dnsmasq_dropin is changed }}",
+            env.from_string(reload_expression).render(
+                TOR_DNSMASQ_OWNS_LISTENER=True, _tor_dnsmasq_dropin={"changed": True}
+            ),
+            "True",
+            "a rewritten drop-in has to reach systemd before the unit restarts",
+        )
+        self.assertEqual(
+            env.from_string(reload_expression).render(TOR_DNSMASQ_OWNS_LISTENER=False),
+            "False",
+            "the drop-in task is gated on owning the listener, so the reload "
+            "expression must not reach for its register when it was skipped",
         )
 
     def test_the_bridge_fact_is_live_before_anything_binds_it(self):
diff --git a/tests/lint/ansible/jinja/test_compose_ports_use_container_ports_lookup.py b/tests/lint/ansible/jinja/test_compose_ports_use_container_ports_lookup.py
index 8e1758182f..d66c3464c9 100644
--- a/tests/lint/ansible/jinja/test_compose_ports_use_container_ports_lookup.py
+++ b/tests/lint/ansible/jinja/test_compose_ports_use_container_ports_lookup.py
@@ -7,8 +7,8 @@ declared ``ports.local`` / ``ports.public`` (host) and ``ports.internal``
 (container) values, so the published and container ports stay one source
 of truth:
 
-    {{ lookup('container_ports', ['gitea', 'http'], ['gitea', 'ssh'],
-              ip=DOCKER_BIND_HOST) | indent(4) }}
+    {{ lookup('container_ports', ['gitea', 'http', DOCKER_BIND_HOST],
+              ['gitea', 'ssh']) | indent(4) }}
 
 Hand-writing the mapping
 ``- "{{ ... }}:{{ lookup('config', ..., 'services.<e>.ports.local.<k>') }}:..."``
@@ -37,31 +37,94 @@ from . import PROJECT_ROOT
 
 _RULE = "compose-ports-must-use-container-ports"
 
-_PORT_SEGMENT = re.compile(r"\A(?:\{\{.*\}\}|[\d.]+|\d+/(?:tcp|udp))\Z")
+_PORT_SEGMENT = re.compile(
+    r"\A(?:\{\{.*\}\}|\$\{[^}]*\}|[\d.]+|[\d-]+)(?:/(?:tcp|udp))?\Z",
+)
 
-_LIST_ITEM = re.compile(r'-\s*"([^"]*)"')
+_LIST_ITEM = re.compile(r"""-\s*["']?(.*?)["']?\s*(?:\#.*)?\Z""")
+
+_LONG_SYNTAX_KEY = re.compile(r"\A-?\s*(?:target|published|mode|protocol):")
+
+_BLOCK_KEY = re.compile(r"\A(ports|expose):\s*(.*)\Z")
 
 _PAIR = re.compile(r"\[\s*'([\w-]+)'\s*,\s*'([\w-]+)'\s*\]")
 
 
 def _is_scan_target(rel_path: str) -> bool:
-    if not rel_path.startswith("roles/") or "/templates/" not in rel_path:
-        return False
-    name = Path(rel_path).name
-    return name.endswith(".yml.j2") and "compose" in name
+    """Every role template that can carry a compose ``ports:`` block.
+
+    ``compose.yml.j2`` and its ``compose.<flavor>.yml.j2`` siblings, plus the
+    ``*.yml.j2`` fragments they include: a mapping hand-written in an included
+    file publishes exactly the same port as one written inline.
+    """
+    return (
+        rel_path.startswith("roles/")
+        and "/templates/" in rel_path
+        and rel_path.endswith(".yml.j2")
+    )
 
 
-def _is_raw_port_mapping(line: str) -> bool:
+def _is_raw_port_mapping(line: str, *, mapping_only: bool = False) -> bool:
+    """Whether *line* publishes a port by hand, quoted or not.
+
+    ``mapping_only`` drops the single-segment form. Under ``expose:`` that form
+    names a container port for documentation and publishes nothing, so only a
+    ``host:container`` mapping there is a publication.
+    """
     match = _LIST_ITEM.match(line.strip())
     if match is None:
         return False
-    inner = match.group(1)
-    if "=" in inner:
+    inner = match.group(1).strip()
+    if not inner or "=" in inner:
         return False
-    segments = inner.split(":")
-    return len(segments) >= 2 and all(
-        _PORT_SEGMENT.match(segment.strip()) for segment in segments
-    )
+    segments = [segment.strip() for segment in inner.split(":")]
+    if not all(_PORT_SEGMENT.match(segment) for segment in segments):
+        return False
+    if len(segments) >= 2:
+        return True
+    return not mapping_only and bool(_PORT_SEGMENT.match(inner))
+
+
+def _raw_port_lines(lines: list[str]) -> list[int]:
+    """1-based line numbers that publish a port by hand.
+
+    The block is tracked by the indentation of its ``ports:`` / ``expose:`` key
+    rather than by the next key seen. Keying on the next line closed the block
+    on anything shaped like a key, which the long-syntax members ``target:``,
+    ``published:``, ``protocol:`` and ``mode:`` are, so the block could never
+    end while it was being read; blank, comment and ``{% %}`` lines equally have
+    no say in where a YAML block ends.
+    """
+    found: list[int] = []
+    block_indent: int | None = None
+    mapping_only = False
+    for number, line in enumerate(lines, start=1):
+        stripped = line.strip()
+        if not stripped or stripped.startswith(("#", "{%")):
+            continue
+        indent = len(line) - len(line.rstrip("\n").lstrip())
+        if (
+            block_indent is not None
+            and indent <= block_indent
+            and not stripped.startswith("- ")
+        ):
+            block_indent = None
+        if block_indent is None:
+            opener = _BLOCK_KEY.match(stripped)
+            if opener:
+                block_indent = indent
+                mapping_only = opener.group(1) == "expose"
+                inline = opener.group(2).strip().strip("[]")
+                if inline and _is_raw_port_mapping(
+                    "- " + inline, mapping_only=mapping_only
+                ):
+                    found.append(number)
+            continue
+        if _LONG_SYNTAX_KEY.match(stripped) or _is_raw_port_mapping(
+            line, mapping_only=mapping_only
+        ):
+            found.append(number)
+    return found
 
 
 class TestComposePortsUseContainerPortsLookup(unittest.TestCase):
@@ -75,27 +138,11 @@ class TestComposePortsUseContainerPortsLookup(unittest.TestCase):
             if not _is_scan_target(rel):
                 continue
             lines = content.splitlines()
-            in_ports_block = False
-            for idx, line in enumerate(lines):
-                stripped = line.strip()
-                if not stripped:
-                    continue
-                if stripped.startswith("- "):
-                    if (
-                        in_ports_block
-                        and _is_raw_port_mapping(line)
-                        and not is_suppressed_at(
-                            lines, idx + 1, _RULE, mode="same-or-above"
-                        )
-                    ):
-                        findings.append((rel, idx + 1, stripped))
-                    continue
-                if stripped.startswith("{{"):
-                    in_ports_block = "container_ports" in stripped
-                    continue
-                key = re.match(r"[\w-]+:", stripped)
-                if key:
-                    in_ports_block = key.group(0) == "ports:"
+            findings.extend(
+                (rel, number, lines[number - 1].strip())
+                for number in _raw_port_lines(lines)
+                if not is_suppressed_at(lines, number, _RULE, mode="same-or-above")
+            )
 
         if findings:
             formatted = "\n".join(
@@ -107,8 +154,8 @@ class TestComposePortsUseContainerPortsLookup(unittest.TestCase):
                 "Build the `ports:` block with the container_ports lookup instead, "
                 "so the published (local/public) and container (internal) ports stay "
                 "a single declared source of truth:\n\n"
-                "    {{ lookup('container_ports', ['<svc>', '<proto>'],\n"
-                "              ip=DOCKER_BIND_HOST) | indent(4) }}\n\n"
+                "    {{ lookup('container_ports',\n"
+                "              ['<svc>', '<proto>', DOCKER_BIND_HOST]) | indent(4) }}\n\n"
                 "One ['<svc>', '<proto>'] pair per published port; the lookup reads "
                 "ports.local/public for the host side and ports.internal for the "
                 "container side. Mark with "
diff --git a/tests/lint/ansible/jinja/test_firewall_fragment_verdicts.py b/tests/lint/ansible/jinja/test_firewall_fragment_verdicts.py
new file mode 100644
index 0000000000..7c0fefc9a8
--- /dev/null
+++ b/tests/lint/ansible/jinja/test_firewall_fragment_verdicts.py
@@ -0,0 +1,79 @@
+"""Lint: a firewall fragment may tighten, never overrule.
+
+A fragment declares its own nftables table. In nftables an ``accept`` verdict
+terminates that table's base chain and nothing else: the packet still traverses
+every other base chain registered at the same hook, and a ``drop`` in any of
+them wins. Docker sets the filter FORWARD policy to ``drop`` by default, so a
+fragment that accepts is not permitting anything, it is only declining to
+decide.
+
+Measured, not assumed: converting a role's ``iptables -A FORWARD -i wg0 -j
+ACCEPT`` into a fragment rule at priority -10 dropped every forwarded packet
+under that policy, 0 of 3 against 3 of 3 for the rule it replaced, with the
+fragment's own counter showing the accept had matched all three. The deploy was
+green either way.
+
+A rule that has to overrule a policy another component set belongs in the chain
+that carries that policy, not in a fragment.
+
+Suppression (see ``docs/contributing/actions/testing/suppression.md``):
+
+* ``nocheck: firewall-fragment-accept`` on the rule's line or the one above it,
+  for an accept whose only job is to skip the fragment's own later rules.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+from utils.annotations.suppress import is_suppressed_at
+from utils.cache.files import iter_project_files, read_text
+
+from . import PROJECT_ROOT
+
+_RULE = "firewall-fragment-accept"
+_FRAGMENT = "templates/nftables.conf.j2"
+_POLICY = re.compile(r"\bpolicy\s+accept\b")
+_VERDICT = re.compile(r"\baccept\s*$")
+
+
+def _fragments() -> list[str]:
+    suffix = "/" + _FRAGMENT
+    return sorted(
+        path
+        for path in iter_project_files(extensions=(".j2",), exclude_tests=True)
+        if path.endswith(suffix)
+    )
+
+
+class TestFirewallFragmentVerdicts(unittest.TestCase):
+    def test_no_fragment_rule_accepts(self) -> None:
+        findings: list[str] = []
+        for path in _fragments():
+            rel = Path(path).relative_to(PROJECT_ROOT).as_posix()
+            lines = read_text(path).splitlines()
+            for index, line in enumerate(lines):
+                body = line.split("#")[0].rstrip().rstrip(";")
+                if _POLICY.search(body) or not _VERDICT.search(body):
+                    continue
+                if is_suppressed_at(lines, index + 1, _RULE, mode="same-or-above"):
+                    continue
+                findings.append(f"- {rel}:{index + 1}: {line.strip()}")
+
+        if findings:
+            self.fail(
+                "These fragment rules end in an accept verdict, which terminates "
+                "only this table's base chain. Another chain at the same hook can "
+                "still drop the packet, so the rule permits nothing:\n"
+                + "\n".join(findings)
+                + "\n\nFix: express the intent as a drop of what must not pass, or "
+                "put the rule in the chain that carries the policy it has to "
+                f"overrule. Mark it `nocheck: {_RULE}` when the accept only skips "
+                "the fragment's own later rules."
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/jinja/test_shell_templates_are_valid.py b/tests/lint/ansible/jinja/test_shell_templates_are_valid.py
new file mode 100644
index 0000000000..921e159c9e
--- /dev/null
+++ b/tests/lint/ansible/jinja/test_shell_templates_are_valid.py
@@ -0,0 +1,145 @@
+"""Lint: a shell script shipped as a Jinja template still gets checked.
+
+``make lint-shellcheck`` walks files on disk, so a ``*.sh.j2`` is invisible to
+it: the thing that actually runs on the host is the render, and nothing looks at
+the render until it fails on a node. That is an unpleasant place to discover a
+quoting mistake in a script which runs as root and rewrites the host packet
+filter.
+
+Every ``roles/*/templates/*.sh.j2`` is rendered here and handed to ``bash -n``,
+plus ``shellcheck`` where it is installed. A value the lint does not know
+renders as a placeholder token and an unknown collection renders as empty, so
+the check judges the shape of the script rather than what a particular
+deployment puts in it. Where a template's structure only becomes real with
+concrete values, those live in ``_SAMPLE``.
+
+``SC2034`` is excluded: emptying a conditional branch orphans the variables that
+branch used, so a partial render cannot tell a genuinely unused variable from
+one whose only reader was not rendered.
+"""
+
+from __future__ import annotations
+
+import shlex
+import shutil
+import subprocess
+import unittest
+from pathlib import Path
+
+import jinja2
+
+from utils.cache.files import iter_project_files, read_text
+
+from . import PROJECT_ROOT
+
+_PARTIAL_RENDER_NOISE = "SC2034"
+
+
+class _PassthroughFilters(dict):
+    """Any filter this environment does not know leaves the value untouched.
+
+    The repo's own filter plugins live in ansible, not in bare jinja2, and the
+    check is about the shape of the resulting shell rather than about what a
+    filter computes.
+    """
+
+    def __missing__(self, name: str):
+        def _identity(value: object, *_args: object, **_kwargs: object) -> object:
+            return value
+
+        return _identity
+
+    def __contains__(self, name: object) -> bool:
+        """Claim every filter, because jinja resolves them at compile time."""
+        return True
+
+    def get(self, name: object, default: object = None) -> object:
+        """Jinja looks filters up with ``get``, which skips ``__missing__``."""
+        return self[name] if name in dict.keys(self) else self.__missing__(str(name))
+
+
+class _Placeholder(jinja2.Undefined):
+    """An unknown value that keeps the rendered script syntactically whole."""
+
+    def __str__(self) -> str:
+        return "placeholder"
+
+    def __iter__(self):
+        return iter(())
+
+    def __bool__(self) -> bool:
+        return False
+
+    def __getattr__(self, name: str) -> _Placeholder:
+        return self
+
+    def __getitem__(self, key: object) -> _Placeholder:
+        return self
+
+
+_SAMPLE: dict[str, object] = {}
+
+
+def _shell_templates() -> list[Path]:
+    found = []
+    for path_str in iter_project_files(extensions=(".j2",)):
+        rel = Path(path_str).relative_to(PROJECT_ROOT).as_posix()
+        if rel.startswith("roles/") and rel.endswith(".sh.j2"):
+            found.append(Path(path_str))
+    return sorted(found)
+
+
+class TestShellTemplatesAreValid(unittest.TestCase):
+    def test_every_shell_template_renders_to_valid_bash(self) -> None:
+        templates = _shell_templates()
+        self.assertTrue(templates, "no roles/*/templates/*.sh.j2 found to check")
+        shellcheck = shutil.which("shellcheck")
+        for path in templates:
+            rel = path.relative_to(PROJECT_ROOT).as_posix()
+            with self.subTest(template=rel):
+                environment = jinja2.Environment(
+                    undefined=_Placeholder,
+                    keep_trailing_newline=True,
+                    autoescape=False,  # noqa: S701  shell, not markup
+                )
+                environment.filters = _PassthroughFilters(environment.filters)
+                environment.filters["quote"] = shlex.quote
+                environment.globals["lookup"] = lambda *_args, **_kwargs: "placeholder"
+                rendered = environment.from_string(read_text(str(path))).render(
+                    **_SAMPLE
+                )
+                syntax = subprocess.run(
+                    ["bash", "-n"],
+                    input=rendered,
+                    capture_output=True,
+                    text=True,
+                    check=False,
+                )
+                self.assertEqual(
+                    syntax.returncode,
+                    0,
+                    f"{rel} does not render to valid bash:\n{syntax.stderr}",
+                )
+                if shellcheck is None:
+                    continue
+                report = subprocess.run(
+                    [
+                        shellcheck,
+                        "--shell=bash",
+                        f"--exclude={_PARTIAL_RENDER_NOISE}",
+                        "-",
+                    ],
+                    input=rendered,
+                    capture_output=True,
+                    text=True,
+                    check=False,
+                )
+                self.assertEqual(
+                    report.returncode,
+                    0,
+                    f"{rel} fails shellcheck once rendered:\n{report.stdout}",
+                )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/jinja/test_software_identity_variables.py b/tests/lint/ansible/jinja/test_software_identity_variables.py
new file mode 100644
index 0000000000..dde53d1aef
--- /dev/null
+++ b/tests/lint/ansible/jinja/test_software_identity_variables.py
@@ -0,0 +1,91 @@
+"""Lint: a template spells the software's identity through its variables.
+
+``SOFTWARE_NAME``, ``SOFTWARE_DOMAIN``, ``SOFTWARE_URL`` and ``ORGANIZATION``
+are declared once in ``group_vars/all/00_general.yml`` and derive from each
+other. A template that writes the value instead of the variable forks that
+single point: a rename reaches the four declarations and every consumer that
+reads them, and silently misses the literal.
+
+The check needs one literal only. ``SOFTWARE_DOMAIN`` is ``SOFTWARE_NAME |
+lower``, ``SOFTWARE_URL`` is ``https://`` plus the domain and ``ORGANIZATION``
+is the name again, so a case-insensitive search for the name's value finds the
+value of all four. The value is read from the declaration rather than written
+here, so renaming the software does not leave this lint hunting the old string.
+
+Suppression (see ``docs/contributing/actions/testing/suppression.md``):
+
+* ``nocheck: software-identity`` on the offending line or the one above it,
+  for a literal that must survive a rename, such as an identifier a third
+  party already issued under the old name.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+from utils.annotations.suppress import is_suppressed_at
+from utils.cache.files import iter_project_files, read_text
+from utils.cache.yaml import load_yaml_any
+
+from . import PROJECT_ROOT
+
+_RULE = "software-identity"
+_SPOT = "group_vars/all/00_general.yml"
+_NAME_KEY = "SOFTWARE_NAME"
+
+
+def _software_name() -> str:
+    """The literal value of ``SOFTWARE_NAME``, read from its declaration."""
+    declared = load_yaml_any(str(PROJECT_ROOT / _SPOT))
+    if not isinstance(declared, dict) or _NAME_KEY not in declared:
+        raise AssertionError(f"{_SPOT} declares no {_NAME_KEY}")
+    name = declared[_NAME_KEY]
+    if not isinstance(name, str) or "{{" in name:
+        raise AssertionError(
+            f"{_SPOT}: {_NAME_KEY} is no longer a plain literal ({name!r}), so "
+            "this lint can no longer derive what to search for"
+        )
+    return name
+
+
+def _variable_for(line: str, start: int, matched: str) -> str:
+    if line[:start].endswith(("https://", "http://")):
+        return "SOFTWARE_URL"
+    if matched.islower():
+        return "SOFTWARE_DOMAIN"
+    return f"{_NAME_KEY} (or ORGANIZATION)"
+
+
+class TestSoftwareIdentityVariables(unittest.TestCase):
+    def test_no_template_spells_out_the_software_identity(self) -> None:
+        pattern = re.compile(re.escape(_software_name()), re.IGNORECASE)
+
+        findings: list[str] = []
+        for path in iter_project_files(extensions=(".j2",), exclude_tests=True):
+            rel = Path(path).relative_to(PROJECT_ROOT).as_posix()
+            lines = read_text(path).splitlines()
+            for index, line in enumerate(lines):
+                match = pattern.search(line)
+                if match is None:
+                    continue
+                if is_suppressed_at(lines, index + 1, _RULE, mode="same-or-above"):
+                    continue
+                variable = _variable_for(line, match.start(), match.group(0))
+                findings.append(
+                    f"- {rel}:{index + 1}: {match.group(0)!r} -> {{{{ {variable} }}}}"
+                )
+
+        if findings:
+            self.fail(
+                "These templates write the software's identity as a literal, so a "
+                f"rename in {_SPOT} would leave them behind:\n"
+                + "\n".join(findings)
+                + f"\n\nFix: render the declared variable instead. Mark it "
+                f"`nocheck: {_RULE}` when the literal must survive a rename."
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/modules/test_systemd_units_via_sys_service.py b/tests/lint/ansible/modules/test_systemd_units_via_sys_service.py
new file mode 100644
index 0000000000..4edb292bfa
--- /dev/null
+++ b/tests/lint/ansible/modules/test_systemd_units_via_sys_service.py
@@ -0,0 +1,80 @@
+"""Lint: a systemd unit is installed through sys-service, not by hand.
+
+``sys-service`` owns what it takes to make a unit real: resolving the template,
+writing it into the system unit directory, reloading the daemon, enabling and
+starting it, the timer variant, and the async and flush behaviour the deploy
+relies on. A role that renders its own ``*.service.j2`` with a bare ``template:``
+gets the file and none of the rest, and every one of those omissions is silent —
+a unit that exists but was never enabled looks installed until the host reboots.
+
+It is also how the same decisions end up answered differently per role. That is
+not hypothetical: the role this lint was written alongside rendered its own unit
+and its own reload handler before anyone noticed sys-service already did both.
+
+Suppression (see ``docs/contributing/actions/testing/suppression.md``):
+
+* ``# nocheck: systemd-via-sys-service`` on the ``src:`` line or anywhere in the
+  task body, for a unit sys-service genuinely cannot carry.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+from utils.annotations.suppress import is_suppressed_at
+from utils.cache.files import iter_project_files_with_content
+
+from . import PROJECT_ROOT
+
+_RULE = "systemd-via-sys-service"
+_OWNER = "sys-service"
+_UNIT_SRC = re.compile(r"^\s*src:\s*[\"']?(?P<src>[^\"'\s]+\.service\.j2)[\"']?")
+
+
+def _is_task_file(rel_path: str) -> bool:
+    return (
+        rel_path.startswith("roles/")
+        and "/tasks/" in rel_path
+        and rel_path.endswith((".yml", ".yaml"))
+    )
+
+
+def _role_of(rel_path: str) -> str:
+    return Path(rel_path).parts[1]
+
+
+class TestSystemdUnitsViaSysService(unittest.TestCase):
+    def test_no_role_installs_its_own_unit(self) -> None:
+        findings: list[str] = []
+        for path_str, content in iter_project_files_with_content(
+            extensions=(".yml", ".yaml"),
+            exclude_tests=True,
+        ):
+            rel = Path(path_str).relative_to(PROJECT_ROOT).as_posix()
+            if not _is_task_file(rel) or _role_of(rel) == _OWNER:
+                continue
+            lines = content.splitlines()
+            for index, line in enumerate(lines):
+                match = _UNIT_SRC.match(line)
+                if match is None:
+                    continue
+                if is_suppressed_at(lines, index + 1, _RULE, mode="same-or-above"):
+                    continue
+                findings.append(f"- {rel}:{index + 1}: {match.group('src')}")
+
+        if findings:
+            self.fail(
+                "These roles render a systemd unit themselves instead of handing "
+                "it to sys-service, which also reloads the daemon, enables the "
+                "unit, and carries the timer, async and flush behaviour:\n"
+                + "\n".join(sorted(set(findings)))
+                + "\n\nFix: name the template templates/systemctl.service.j2 and "
+                "include the sys-service role with system_service_id, or mark the "
+                f"task `# nocheck: {_RULE}` when sys-service cannot carry it."
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/roles/meta/test_healthcheck_binary_on_slim_base.py b/tests/lint/ansible/roles/meta/test_healthcheck_binary_on_slim_base.py
new file mode 100644
index 0000000000..a883650bcc
--- /dev/null
+++ b/tests/lint/ansible/roles/meta/test_healthcheck_binary_on_slim_base.py
@@ -0,0 +1,239 @@
+"""A healthcheck must find every program it runs in the image it runs in.
+
+A stripped base carries the runtime and little else, and which "little else"
+differs per family. The declaration does not know that: ``flavor: curl`` renders
+``CMD curl -f <url>`` and ``flavor: tcp`` renders ``CMD bash -c`` over
+``/dev/tcp`` whatever the image underneath is. Where the program is absent the
+probe fails from its first beat and the container never reports healthy.
+
+The two deploy modes answer differently, and neither answer names the program.
+``sys-svc-compose`` waits on the database container alone in compose and on
+every stack task in swarm, so a permanently unhealthy service passes unnoticed
+under compose and stops the deploy under swarm: the task dies with ``non-zero
+exit (137): dockerexec: unhealthy container``, is rescheduled, dies again, and
+the wait fails. Every deployment holding the service in its closure fails with
+it, reported against the service that was waited for.
+
+What is checked
+===============
+Every ``meta/services.yml`` healthcheck whose service sits on a base this file
+has measured. The programs come from the probe the declaration renders
+(:func:`utils.docker.healthcheck.compose.compose`), both its ``CMD`` and its
+``CMD-SHELL`` form, so a flavor that changes its command moves this check with
+it rather than drifting from a table restated here. ``||`` in a shell probe is
+read as alternatives, ``&&`` and ``;`` as a sequence that needs all of its
+parts, and shell builtins are dropped so a trailing ``|| exit 1`` cannot make
+every requirement look satisfiable.
+
+A requirement is met when the measured base provides the program or the role's
+``files/Dockerfile`` installs it. A base that is neither family is skipped: a
+vendor image's contents are not knowable from the tree, and for most of them
+there is no Dockerfile of ours to add anything to.
+
+Per-service opt-out
+===================
+``# nocheck: healthcheck-binary`` on the ``flavor`` line or the one above it,
+with a reason naming where the program comes from instead.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+
+from utils.annotations.suppress import is_suppressed_at
+from utils.cache.files import read_text
+from utils.cache.yaml import load_yaml_any
+from utils.docker.healthcheck.compose import compose
+from utils.roles.mapping import ROLE_FILE_META_SERVICES
+
+from . import PROJECT_ROOT
+
+RULE = "healthcheck-binary"
+
+PROVIDED: dict[str, frozenset[str]] = {
+    "slim": frozenset({"bash", "sh"}),
+    "alpine": frozenset({"sh", "wget", "nc"}),
+}
+"""What each stripped family ships, read out of the images themselves.
+
+Measured with ``docker create`` plus ``docker cp``, which reports a path that is
+absent instead of reporting a shell's opinion of it. Every lookup covered
+``/usr/bin``, ``/bin``, ``/usr/local/bin`` and ``/sbin``:
+
+* ``debian:13-slim``, ``node:26-slim`` and ``python:3.13.15-slim`` carry
+  ``/bin/bash`` at 1298416 bytes and none of ``curl``, ``wget`` or ``nc``. bash
+  is Essential in Debian and the other three are not, which is the whole
+  difference between the stripped tag and the full one: the full ``node:26``
+  variant carries ``/usr/bin/curl`` at 280800 bytes.
+* ``redis:8-alpine`` and ``node:26-alpine`` carry ``/usr/bin/wget`` and
+  ``/usr/bin/nc`` as busybox applets, no ``curl``, and no ``/bin/bash`` at all.
+  Their ``/bin/sh`` is busybox, which does not implement ``/dev/tcp``, so the
+  flavors built on that redirection need the real shell rather than any shell.
+
+The family is read from the tag, which holds for every image in the tree today:
+every ``slim`` tag here is Debian based and every ``alpine`` tag is Alpine
+based. Adding a family means measuring it the same way, not inferring it.
+"""
+
+IMAGE_PROVIDES: dict[str, frozenset[str]] = {
+    "nginx": frozenset({"curl"}),
+}
+"""Programs an individual image adds on top of what its family ships.
+
+nginx installs curl in both of its variants: ``/usr/bin/curl`` at 272432 bytes
+in ``nginx:1.31.6-alpine`` and at 321880 bytes in the Debian ``nginx:1.31``.
+Base Alpine does not have it at all, measured the same way on ``redis:8-alpine``
+and ``node:26-alpine``. Reading nginx's curl as a property of Alpine would pass
+a ``curl`` flavor on any alpine image, so it is recorded against the image that
+installs it.
+"""
+
+SHELL_BUILTINS = frozenset({"exit", "true", "false", "test", "[", ":", "echo"})
+"""Words a probe may invoke that no package provides."""
+
+
+def _families(version: object) -> list[str]:
+    """The measured families a version tag names, in declaration order."""
+    text = str(version)
+    return [family for family in PROVIDED if family in text]
+
+
+def _image_extras(image: object) -> frozenset[str]:
+    """What this particular image adds beyond its family.
+
+    Args:
+        image: the ``image`` value, with or without a registry prefix.
+    """
+    name = str(image).rsplit("/", 1)[-1]
+    return IMAGE_PROVIDES.get(name, frozenset())
+
+
+def _requirements(flavor: object) -> list[list[str]]:
+    """The programs a declared flavor runs, as alternatives of sequences.
+
+    ``[["wget"], ["curl"]]`` means either one satisfies the probe;
+    ``[["msmtp", "curl"]]`` would mean it needs both.
+
+    Args:
+        flavor: the ``healthcheck.flavor`` value, one name or a list.
+    """
+    try:
+        test = [
+            str(part)
+            for part in compose(flavor, port=80, path="/", hostname="h").test()
+        ]
+    except Exception:
+        return []
+    if not test:
+        return []
+    if test[0] == "CMD":
+        return [[test[1]]] if len(test) > 1 else []
+    if len(test) < 2:
+        return []
+    groups: list[list[str]] = []
+    for alternative in re.split(r"\|\|", test[1]):
+        words = [
+            segment.strip().split()[0]
+            for segment in re.split(r"&&|;", alternative)
+            if segment.strip()
+        ]
+        needed = [word for word in words if word not in SHELL_BUILTINS]
+        if needed:
+            groups.append(needed)
+    return groups
+
+
+def _installs(dockerfile_body: str, program: str) -> bool:
+    """Whether the Dockerfile names the program as something it installs."""
+    pattern = rf"(?<![\w-]){re.escape(program)}(?![\w-])"
+    return re.search(pattern, dockerfile_body) is not None
+
+
+def _flavor_lines(lines: list[str]) -> dict[str, int]:
+    """The 1-based ``flavor:`` line of each top-level service key.
+
+    ``meta/services.yml`` maps one service per top-level key, so the flavor a
+    key owns is the first one under it. Taking the file's first flavor line
+    instead would let one service's marker silence another's.
+
+    Args:
+        lines: the file's lines, as :func:`read_text` splits them.
+    """
+    found: dict[str, int] = {}
+    current: str | None = None
+    for number, line in enumerate(lines, start=1):
+        key = re.match(r"([A-Za-z0-9_.-]+):\s*(?:#.*)?$", line)
+        if key:
+            current = key.group(1)
+            continue
+        if current and current not in found and re.match(r"\s+flavor:", line):
+            found[current] = number
+    return found
+
+
+class TestHealthcheckBinaryOnSlimBase(unittest.TestCase):
+    def test_a_stripped_base_provides_every_program_its_healthcheck_runs(self):
+        offenders = []
+        for services in sorted(
+            (PROJECT_ROOT / "roles").glob(f"*/{ROLE_FILE_META_SERVICES}")
+        ):
+            role_dir = services.parent.parent
+            data = load_yaml_any(str(services), default_if_missing={}) or {}
+            lines = read_text(str(services)).splitlines()
+            flavor_lines = _flavor_lines(lines)
+            for key, entry in data.items():
+                if not isinstance(entry, dict):
+                    continue
+                health = entry.get("healthcheck")
+                if not isinstance(health, dict) or "flavor" not in health:
+                    continue
+                families = _families(entry.get("version", ""))
+                if not families:
+                    continue
+                groups = _requirements(health["flavor"])
+                if not groups:
+                    continue
+                if is_suppressed_at(lines, flavor_lines.get(key, 0), RULE):
+                    continue
+                dockerfile = role_dir / "files" / "Dockerfile"
+                body = read_text(str(dockerfile)) if dockerfile.is_file() else ""
+                available = set().union(*(PROVIDED[family] for family in families))
+                available |= _image_extras(entry.get("image", ""))
+                satisfied = any(
+                    all(
+                        program in available or _installs(body, program)
+                        for program in group
+                    )
+                    for group in groups
+                )
+                if satisfied:
+                    continue
+                wanted = " or ".join(" and ".join(group) for group in groups)
+                offenders.append(
+                    f"{role_dir.name}: service '{key}' declares healthcheck "
+                    f"flavor {health['flavor']!r}, which runs {wanted}, on the "
+                    f"{'/'.join(families)} image {entry.get('image')}:"
+                    f"{entry.get('version')} that provides "
+                    f"{', '.join(sorted(available))}; "
+                    + (
+                        "files/Dockerfile installs none of them"
+                        if body
+                        else "the role has no files/Dockerfile"
+                    )
+                )
+
+        self.assertEqual(
+            [],
+            offenders,
+            "A stripped base carries the runtime and little else, so a program a "
+            "healthcheck runs has to come from the base or from the role that "
+            "depends on it. Install it in the role's files/Dockerfile, pick a "
+            "flavor the image can already run, or mark the line "
+            f"`# nocheck: {RULE}` with a reason naming where the program comes "
+            "from:\n  " + "\n  ".join(offenders),
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/roles/meta/test_role_subnet_pool.py b/tests/lint/ansible/roles/meta/test_role_subnet_pool.py
new file mode 100644
index 0000000000..b18f584947
--- /dev/null
+++ b/tests/lint/ansible/roles/meta/test_role_subnet_pool.py
@@ -0,0 +1,97 @@
+"""Lint: a role's local subnet comes out of the declared pool.
+
+``NETWORK_ROLE_SUBNET_POOL`` in ``group_vars/all/08_networks.yml`` names the
+block role networks are carved from. Until it existed the block was an emergent
+property: the allocator in ``cli contributing network address suggest`` derives
+its umbrella from the subnets already in use, so the tree defined the rule
+instead of the rule defining the tree. Anything that consumes "our own address
+space" then has to guess, and a guess that is one role out of date silently
+excludes that role. That is not hypothetical: a firewall range derived from the
+pool by eye would have cut BigBlueButton off, because its subnet is the one
+that sits outside.
+
+A role that genuinely cannot choose its block is named in
+``NETWORK_ROLE_SUBNET_EXCEPTION_ROLES``. The list carries role ids rather than
+CIDRs on purpose: the block is already declared in that role's
+``meta/networks.yml``, and repeating it here would be the same duplication one
+layer up. Consumers resolve the ids through ``lookup('role_subnets', ...)``.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import unittest
+
+import jinja2
+
+from utils.cache.yaml import load_yaml_any
+from utils.meta.scan import iter_subnets
+
+from . import PROJECT_ROOT
+
+NETWORKS_FILE = PROJECT_ROOT / "group_vars" / "all" / "08_networks.yml"
+
+
+def _declared_space() -> tuple[list[ipaddress.IPv4Network], list[str]]:
+    """The pool plus the blocks of the excepted roles, with their raw strings."""
+    data = load_yaml_any(str(NETWORKS_FILE), default_if_missing={}) or {}
+    pool = data.get("NETWORK_ROLE_SUBNET_POOL")
+    if isinstance(pool, str) and "{{" in pool:
+        pool = jinja2.Template(pool).render(**data)
+    roles = data.get("NETWORK_ROLE_SUBNET_EXCEPTION_ROLES") or []
+    if not isinstance(pool, str) or not isinstance(roles, list):
+        raise TypeError(
+            f"{NETWORKS_FILE} must declare NETWORK_ROLE_SUBNET_POOL as a string "
+            "and NETWORK_ROLE_SUBNET_EXCEPTION_ROLES as a list of role ids"
+        )
+    declared = dict(iter_subnets())
+    raw = [pool]
+    for role in roles:
+        subnet = declared.get(str(role))
+        if subnet is None:
+            raise AssertionError(
+                f"{NETWORKS_FILE}: NETWORK_ROLE_SUBNET_EXCEPTION_ROLES names "
+                f"'{role}', which declares no networks.local.subnet"
+            )
+        raw.append(str(subnet))
+    return [ipaddress.ip_network(entry, strict=True) for entry in raw], raw
+
+
+class TestRoleSubnetPool(unittest.TestCase):
+    def test_every_role_subnet_sits_in_the_declared_space(self) -> None:
+        allowed, raw = _declared_space()
+        findings = [
+            f"- {role}: {subnet}"
+            for role, subnet in sorted(iter_subnets(), key=lambda item: item[0])
+            if not any(subnet.subnet_of(block) for block in allowed)
+        ]
+        if findings:
+            self.fail(
+                "These roles declare networks.local.subnet outside the address "
+                "space this deployment declares for itself:\n"
+                + "\n".join(findings)
+                + "\n\nDeclared space: "
+                + ", ".join(raw)
+                + "\n\nFix: pick a subnet inside the pool via "
+                "`infinito contributing network address suggest`, or, when the "
+                "block is pinned by something outside this repository, name the "
+                "role in NETWORK_ROLE_SUBNET_EXCEPTION_ROLES in "
+                "group_vars/all/08_networks.yml."
+            )
+
+    def test_the_exceptions_are_not_already_covered(self) -> None:
+        """An exception inside the pool is dead weight that outlives its reason."""
+        allowed, raw = _declared_space()
+        pool = allowed[0]
+        redundant = [entry for entry in allowed[1:] if entry.subnet_of(pool)]
+        if redundant:
+            self.fail(
+                "NETWORK_ROLE_SUBNET_EXCEPTION_ROLES names role(s) whose subnet "
+                f"already sits inside {raw[0]}: "
+                f"{', '.join(str(entry) for entry in redundant)}. "
+                "Remove them; the pool already admits those addresses."
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/roles/meta/test_variants_distinct.py b/tests/lint/ansible/roles/meta/test_variants_distinct.py
new file mode 100644
index 0000000000..3dc998b5aa
--- /dev/null
+++ b/tests/lint/ansible/roles/meta/test_variants_distinct.py
@@ -0,0 +1,83 @@
+"""No two entries of a ``meta/variants.yml`` may declare the same override.
+
+A variant exists to deploy a shape the other entries do not. Two entries with
+the same content produce the same rendered payload, so the matrix plans them as
+separate rows, assigns each its own axes and spends a deploy job on each. The
+measured cost of one such job in this repository's CI is around one hundred
+minutes, and the second one proves nothing the first did not.
+
+The duplicate is also invisible in the plan table, which lists rows by
+``role#variant``: the two read as different rows and only their identical
+``embeds`` and ``weight`` betray them.
+
+Comparison is on the parsed payload, not the file text, so two entries that
+differ in key order, indentation or comments still count as the same. ``null``
+normalises to ``{}`` the way the loader treats it, because a bare ``- `` list
+item and an explicit ``- {}`` declare the same no-override entry.
+
+Per-file opt-out
+================
+``# nocheck: variants-duplicate`` anywhere in the file, with a reason naming
+what the repetition buys. Reserve it for a role whose variants are told apart
+by something outside the entry, and say what that is; the default path is to
+delete the entry, because the axes a duplicate would have covered are assigned
+per row rather than declared per variant.
+"""
+
+from __future__ import annotations
+
+import json
+import unittest
+from collections import defaultdict
+
+from utils.annotations.suppress import is_suppressed_anywhere
+from utils.cache.files import read_text
+from utils.cache.yaml import load_yaml_any
+from utils.roles.mapping import ROLE_FILE_META_VARIANTS
+
+from . import PROJECT_ROOT
+
+RULE = "variants-duplicate"
+
+
+def _fingerprint(entry: object) -> str:
+    """The entry's content, independent of key order and of ``null`` vs ``{}``."""
+    return json.dumps(entry if entry is not None else {}, sort_keys=True, default=str)
+
+
+class TestVariantsDistinct(unittest.TestCase):
+    def test_no_two_variants_declare_the_same_override(self) -> None:
+        offenders = []
+        for variants_file in sorted(
+            (PROJECT_ROOT / "roles").glob(f"*/{ROLE_FILE_META_VARIANTS}")
+        ):
+            entries = load_yaml_any(str(variants_file), default_if_missing=[])
+            if not isinstance(entries, list):
+                continue
+            if is_suppressed_anywhere(read_text(str(variants_file)).splitlines(), RULE):
+                continue
+
+            seen: dict[str, list[int]] = defaultdict(list)
+            for index, entry in enumerate(entries):
+                seen[_fingerprint(entry)].append(index)
+
+            role = variants_file.parent.parent.name
+            for indices in seen.values():
+                if len(indices) > 1:
+                    joined = ", ".join(f"#{index}" for index in indices)
+                    offenders.append(
+                        f"{role}: variants {joined} declare the same override"
+                    )
+
+        self.assertEqual(
+            [],
+            offenders,
+            "A duplicated variant entry costs a deploy job and proves nothing the "
+            "entry it repeats did not. Delete the repetition, give it the override "
+            f"that makes it a distinct shape, or mark the file `# nocheck: {RULE}` "
+            "with a reason:\n  " + "\n  ".join(offenders),
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/roles/test_addon_enabled_renders_to_bool.py b/tests/lint/ansible/roles/test_addon_enabled_renders_to_bool.py
new file mode 100644
index 0000000000..b69de637d4
--- /dev/null
+++ b/tests/lint/ansible/roles/test_addon_enabled_renders_to_bool.py
@@ -0,0 +1,137 @@
+"""Every addon ``enabled`` must render to a boolean, even on a bare scope.
+
+Rationale
+=========
+``meta/addons/*.yml`` is rendered inside the applications SPOT and consumed as
+``plugin_value.enabled | bool``. An expression that cannot resolve does not
+fail: ``utils.templating.ansible._templar_render_best_effort`` returns the
+string untouched, and for a value carrying a non-env ``lookup(`` it refuses the
+fallback as well. The template text reaches the filter, which coerces it to
+False and emits::
+
+    [DEPRECATION WARNING]: The `bool` filter coerced invalid value
+    "{{ ... }}" (str) to False.
+
+The deploy gate fails on that warning, and the addon is off in every run that
+did not warn loudly enough to be noticed. Run 34893363518, job 104153194109
+lost web-app-nextcloud this way.
+
+The check renders the whole applications map against a scope carrying only what
+every run has -- group_vars plus the deployed role names -- and blanks ``API``
+to the most hostile override an inventory may legally write. Anything that
+survives as template text resolves only against something the render scope does
+not carry.
+"""
+
+from __future__ import annotations
+
+import unittest
+from typing import Any
+
+from ansible.parsing.dataloader import DataLoader
+from ansible.template import Templar
+
+from utils.cache.applications import (
+    _MERGED_APPLICATIONS_CACHE,
+    get_merged_applications,
+)
+from utils.cache.yaml import load_yaml_any
+
+from . import PROJECT_ROOT
+
+_ADDONS_GLOB = "*/meta/addons/*.yml"
+_BOOL_LITERALS = frozenset(
+    {"true", "false", "yes", "no", "on", "off", "1", "0", "y", "n"}
+)
+
+
+def _role_names() -> list[str]:
+    return sorted(
+        path.name for path in (PROJECT_ROOT / "roles").iterdir() if path.is_dir()
+    )
+
+
+def _hostile_scope() -> dict[str, Any]:
+    variables: dict[str, Any] = {}
+    for path in sorted((PROJECT_ROOT / "group_vars" / "all").glob("*.yml")):
+        data = load_yaml_any(path) or {}
+        if isinstance(data, dict):
+            variables.update(data)
+    variables["group_names"] = _role_names()
+    variables["API"] = {}
+    return variables
+
+
+def _rendered_addons() -> dict[str, dict[str, Any]]:
+    variables = _hostile_scope()
+    templar = Templar(loader=DataLoader(), variables=dict(variables))
+    templar.available_variables = dict(variables)
+
+    _MERGED_APPLICATIONS_CACHE.clear()
+    try:
+        applications = get_merged_applications(
+            variables=dict(variables), templar=templar
+        )
+    finally:
+        _MERGED_APPLICATIONS_CACHE.clear()
+
+    return {
+        app_id: config["addons"]
+        for app_id, config in applications.items()
+        if isinstance(config, dict) and isinstance(config.get("addons"), dict)
+    }
+
+
+def _verdict(value: Any) -> str:
+    if isinstance(value, bool):
+        return ""
+    if not isinstance(value, str):
+        return f"is {type(value).__name__}, not a boolean"
+    if "{{" in value or "{%" in value:
+        return f"stayed template text: {value}"
+    if value.strip().lower() not in _BOOL_LITERALS:
+        return f"is not a boolean literal: {value!r}"
+    return ""
+
+
+class TestAddonEnabledRendersToBool(unittest.TestCase):
+    def test_every_addon_enabled_resolves(self) -> None:
+        findings = [
+            f"  - roles/{app_id}/meta/addons/{addon_id}.yml: 'enabled' {verdict}"
+            for app_id, addons in _rendered_addons().items()
+            for addon_id, spec in sorted(addons.items())
+            if isinstance(spec, dict)
+            for verdict in [_verdict(spec.get("enabled"))]
+            if verdict
+        ]
+
+        if findings:
+            self.fail(
+                f"{len(findings)} addon gate(s) do not render to a boolean on a "
+                "scope without inventory extras, so '| bool' coerces the leftover "
+                "text to False and the deploy fails on the deprecation warning:\n"
+                + "\n".join(findings)
+                + "\n\nResolve the value through a lookup that carries its own "
+                "source instead of a variable the render scope may not hold: "
+                "lookup('api_enabled', '<provider>') gates on credentials, "
+                "lookup('config', ...) on another application's settings."
+            )
+
+    def test_the_scan_reaches_templated_gates(self) -> None:
+        """A scope that resolved nothing, or addons without gates, passes for free."""
+        templated = [
+            path
+            for path in sorted((PROJECT_ROOT / "roles").glob(_ADDONS_GLOB))
+            if "{{" in str((load_yaml_any(path) or {}).get("enabled", ""))
+        ]
+        self.assertTrue(
+            templated,
+            "no addon declares a templated 'enabled', so the rule above is vacuous",
+        )
+
+        rendered = _rendered_addons()
+        self.assertTrue(rendered, "no application carries addons; nothing was checked")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/roles/test_no_no_log_in_test_roles.py b/tests/lint/ansible/roles/test_no_no_log_in_test_roles.py
new file mode 100644
index 0000000000..a4528978cf
--- /dev/null
+++ b/tests/lint/ansible/roles/test_no_no_log_in_test_roles.py
@@ -0,0 +1,100 @@
+"""Lint: a test role must never carry ``no_log``.
+
+``roles/test-*`` run only in CI, against a throwaway cluster whose credentials
+are generated per deploy and thrown away with it. ``no_log`` there protects
+nothing and costs the one thing a red test job is for: the output that says
+what failed. A masked task reports ``the output has been hidden`` and the
+operator has to re-run the whole matrix round to learn what a single assertion
+saw.
+
+The rule is absolute, so it carries no ``nocheck`` escape hatch. When a test
+task's output looks too sensitive to print, extract the field the assertion
+needs instead of blinding the task.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+from utils.annotations.message import in_github_actions, warning
+from utils.cache.files import read_text
+
+from . import PROJECT_ROOT
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+_NO_LOG_RE = re.compile(r"^\s*no_log\s*:")
+
+
+@dataclass(frozen=True)
+class Finding:
+    path: str
+    line: int
+    text: str
+
+
+def _collect_findings(root: Path) -> list[Finding]:
+    findings: list[Finding] = []
+    for yaml_file in sorted(root.glob("roles/test-*/**/*.yml")):
+        try:
+            lines = read_text(str(yaml_file)).splitlines()
+        except OSError:
+            continue
+        rel = yaml_file.relative_to(root).as_posix()
+        findings.extend(
+            Finding(rel, number, line.strip())
+            for number, line in enumerate(lines, start=1)
+            if _NO_LOG_RE.match(line)
+        )
+    return findings
+
+
+def _fix_hint(rel: str) -> str:
+    return (
+        f"{rel} uses no_log in a test role. Test roles run in CI against "
+        "throwaway credentials, so no_log hides the failure output without "
+        "protecting anything. Drop it; if a value is genuinely too large or "
+        "noisy to print, extract the field the assertion reads."
+    )
+
+
+class TestNoNoLogInTestRoles(unittest.TestCase):
+    def test_test_roles_carry_no_no_log(self) -> None:
+        findings = _collect_findings(PROJECT_ROOT)
+
+        for finding in findings:
+            warning(
+                _fix_hint(finding.path),
+                title="no_log in a test role",
+                file=finding.path,
+                line=finding.line,
+            )
+
+        if findings and not in_github_actions():
+            print()
+            print(f"[WARNING] no_log in test roles ({len(findings)}):")
+            for finding in findings:
+                print(f"- {finding.path}:{finding.line}: {finding.text}")
+
+        if findings:
+            self.fail(
+                f"{len(findings)} no_log entr(ies) in roles/test-*:\n"
+                + "\n".join(f"{f.path}:{f.line}: {_fix_hint(f.path)}" for f in findings)
+            )
+
+    def test_the_scan_reaches_the_test_roles(self) -> None:
+        """A glob that matches nothing would pass vacuously forever."""
+        scanned = sorted(PROJECT_ROOT.glob("roles/test-*/**/*.yml"))
+        self.assertTrue(
+            scanned,
+            "no YAML found under roles/test-*; the glob no longer reaches the "
+            "test roles, so the rule above cannot fire",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/services/test_onion_port_flag.py b/tests/lint/ansible/services/test_onion_port_flag.py
new file mode 100644
index 0000000000..04b839edc6
--- /dev/null
+++ b/tests/lint/ansible/services/test_onion_port_flag.py
@@ -0,0 +1,235 @@
+"""Lint: every host-bound port states whether it answers on the node onion.
+
+A port under ``ports.local`` or ``ports.public`` binds an address on the stack
+host, which is what a ``HiddenServicePort`` can forward to. Whether it should be
+forwarded is a decision with a cost in both directions: silently off leaves a
+service unreachable that the operator believes is on the onion, and silently on
+publishes a database, an admin interface or a SOCKS proxy to everyone holding
+the onion address. Neither belongs to a default, so the flag is mandatory and
+every ``false`` carries the reason it is false.
+
+The flag lives next to the numbers it decides about::
+
+    ports:
+      public:
+        smtp: 25
+        smtps: 465
+      onion:
+        smtp: true
+        smtps: false # nocheck: onion-flag  no implicit-TLS listener when TLS is off
+
+Five groups are out of scope, because for them the answer is architectural
+rather than per-role, and a hundred-odd copies of one sentence state it worse
+than this paragraph does:
+
+* ``ports.internal`` lives in the container's network namespace, where no
+  host-side forward reaches it.
+* the categories a hidden service cannot carry, listed and reasoned once in
+  ``plugins.lookup.tor_ports.UDP_ONLY_CATEGORIES``.
+* ``http``, ``sso`` and ``websocket``, because the node onion already forwards
+  port 80 to the reverse proxy, which routes every vhost, every oauth2 hop and
+  every socket upgrade behind it. A direct forward there would bypass the proxy,
+  its auth and its CSP.
+* the implicit-TLS variants, because Tor is already the transport encryption and
+  ``container_ports`` drops those listeners entirely when TLS is off, which an
+  onion deployment always is.
+* an entity declaring ``exposed:``, which is the older opt-in for the same
+  decision and is tested per variant. Two flags for one decision is the trap.
+
+A flag naming a category the entity never declares is reported too: it reads as
+a live forward and forwards nothing.
+
+Suppression (see ``docs/contributing/actions/testing/suppression.md``):
+
+* ``# nocheck: onion-flag`` plus a reason, on or directly above a ``false`` flag.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+from collections.abc import Mapping
+
+from plugins.lookup.tor_ports import UDP_ONLY_CATEGORIES
+from utils.annotations.suppress import line_has_rule
+from utils.cache.files import read_text
+from utils.cache.yaml import load_yaml_any
+from utils.meta.scan import iter_role_dirs
+from utils.roles.mapping import ROLE_FILE_META_SERVICES
+
+_RULE = "onion-flag"
+_HOST_BOUND_SCOPES = ("local", "public")
+_PROXY_FRONTED_CATEGORIES = frozenset({"http", "sso", "websocket"})
+_IMPLICIT_TLS_CATEGORIES = frozenset({"smtps", "imaps", "pop3s", "ldaps"})
+_OUT_OF_SCOPE = (
+    UDP_ONLY_CATEGORIES | _PROXY_FRONTED_CATEGORIES | _IMPLICIT_TLS_CATEGORIES
+)
+_MIN_REASON_CHARS = 10
+
+_MARKER_RE = re.compile(
+    r"(?:noqa|nocheck)\s*:\s*"
+    r"(?:[a-z0-9][a-z0-9\-]*)(?:\s*,\s*[a-z0-9][a-z0-9\-]*)*(.*)$",
+    re.IGNORECASE,
+)
+
+
+def _host_bound_categories(ports: Mapping) -> set[str]:
+    """Category names of *ports* that bind a host address as a single TCP port.
+
+    The proxy-fronted categories are skipped under ``local`` and kept under
+    ``public``, which is the difference between riding behind the edge proxy and
+    being it: 128 roles declare ``http``/``sso``/``websocket`` on the loopback,
+    and exactly one publishes ``http`` on the host.
+    """
+    found: set[str] = set()
+    for scope in _HOST_BOUND_SCOPES:
+        declared = ports.get(scope)
+        if not isinstance(declared, Mapping):
+            continue
+        skipped = UDP_ONLY_CATEGORIES | _IMPLICIT_TLS_CATEGORIES
+        if scope == "local":
+            skipped = skipped | _PROXY_FRONTED_CATEGORIES
+        found.update(
+            category
+            for category, value in declared.items()
+            if isinstance(value, int)
+            and not isinstance(value, bool)
+            and category not in skipped
+        )
+    return found
+
+
+def _flag_line(lines: list[str], entity: str, category: str) -> int | None:
+    """1-based line of ``<category>:`` inside *entity*'s ``onion:`` block."""
+    in_entity = False
+    onion_indent = -1
+    for number, raw in enumerate(lines, start=1):
+        stripped = raw.strip()
+        if not stripped or stripped.startswith("#"):
+            continue
+        indent = len(raw) - len(raw.lstrip())
+        if indent == 0:
+            in_entity = stripped.startswith(f"{entity}:")
+            onion_indent = -1
+            continue
+        if not in_entity:
+            continue
+        if onion_indent >= 0 and indent <= onion_indent:
+            onion_indent = -1
+        if stripped.startswith("onion:"):
+            onion_indent = indent
+            continue
+        if onion_indent >= 0 and stripped.startswith(f"{category}:"):
+            return number
+    return None
+
+
+def _reason_for(lines: list[str], line_no: int) -> str | None:
+    """The suppression reason governing *line_no*, or None when unsuppressed."""
+    candidates = [line_no - 1]
+    previous = line_no - 2
+    while previous >= 0 and not lines[previous].strip():
+        previous -= 1
+    candidates.append(previous)
+    for index in candidates:
+        if index < 0 or not line_has_rule(lines[index], _RULE):
+            continue
+        match = _MARKER_RE.search(lines[index])
+        return match.group(1).strip().lstrip("-:").strip() if match else ""
+    return None
+
+
+class TestOnionPortFlag(unittest.TestCase):
+    def test_every_host_bound_port_declares_an_onion_flag(self) -> None:
+        findings: list[str] = []
+        for role_dir in iter_role_dirs():
+            path = role_dir / ROLE_FILE_META_SERVICES
+            if not path.is_file():
+                continue
+            services = load_yaml_any(str(path), default_if_missing={})
+            if not isinstance(services, Mapping):
+                continue
+            lines = read_text(str(path)).splitlines()
+            for entity, config in services.items():
+                if not isinstance(config, Mapping):
+                    continue
+                ports = config.get("ports")
+                if not isinstance(ports, Mapping) or "exposed" in config:
+                    continue
+                findings.extend(
+                    self._entity_findings(role_dir.name, entity, ports, lines)
+                )
+        if findings:
+            self.fail(
+                "Every host-bound port must state whether it answers on the node "
+                "onion, via a boolean of the same category name under "
+                "`ports.onion`. A `false` flag needs `# nocheck: onion-flag` and "
+                "a reason on or above it.\n" + "\n".join(findings)
+            )
+
+    def _entity_findings(
+        self,
+        role: str,
+        entity: str,
+        ports: Mapping,
+        lines: list[str],
+    ) -> list[str]:
+        declared = _host_bound_categories(ports)
+        flags = ports.get("onion")
+        flags = flags if isinstance(flags, Mapping) else {}
+        where = f"roles/{role}/{ROLE_FILE_META_SERVICES}: {entity}"
+        findings = [
+            f"{where}.ports.onion.{category}: missing, declare true or false"
+            for category in sorted(declared - set(flags))
+        ]
+        findings.extend(
+            f"{where}.ports.onion.{category}: "
+            + (
+                "out of scope, remove the flag"
+                if category in _OUT_OF_SCOPE
+                else "no such port is declared under " + " or ".join(_HOST_BOUND_SCOPES)
+            )
+            for category in sorted(set(flags) - declared)
+        )
+        for category in sorted(set(flags) & declared):
+            findings.extend(
+                self._flag_findings(where, entity, category, flags[category], lines)
+            )
+        return findings
+
+    def _flag_findings(
+        self,
+        where: str,
+        entity: str,
+        category: str,
+        flag: object,
+        lines: list[str],
+    ) -> list[str]:
+        at = f"{where}.ports.onion.{category}"
+        if not isinstance(flag, bool):
+            return [f"{at}: must be a literal true or false, not {flag!r}"]
+        if flag:
+            return []
+        line_no = _flag_line(lines, entity, category)
+        if line_no is None:
+            return [f"{at}: is false but its line could not be located"]
+        reason = _reason_for(lines, line_no)
+        if reason is None:
+            return [
+                (
+                    f"{at} (line {line_no}): false needs `# nocheck: {_RULE}` and "
+                    f"a reason on or above it"
+                )
+            ]
+        if len(reason) < _MIN_REASON_CHARS:
+            return [
+                (
+                    f"{at} (line {line_no}): `# nocheck: {_RULE}` states no reason "
+                    f"why the port stays off the onion"
+                )
+            ]
+        return []
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/services/test_semver_pinning.py b/tests/lint/ansible/services/test_semver_pinning.py
index 07e1df230e..c09544eda9 100644
--- a/tests/lint/ansible/services/test_semver_pinning.py
+++ b/tests/lint/ansible/services/test_semver_pinning.py
@@ -59,6 +59,7 @@ from utils.annotations.message import warning as gha_warning
 from utils.annotations.suppress import is_suppressed_at
 from utils.cache.files import read_text
 from utils.cache.yaml import load_yaml_any
+from utils.docker.image.pin import is_digest
 from utils.roles.mapping import ROLE_FILE_META_SERVICES
 from utils.update.base import is_semver
 
@@ -69,6 +70,7 @@ if TYPE_CHECKING:
 
 
 _DOCKER_RULE = "docker-version"
+_DIGEST_RULE = "docker-digest"
 _REPO_RULE = "repository-version"
 
 _DOCKER_TITLE = "Non-semver Docker image version"
@@ -176,7 +178,7 @@ class TestSemverPinning(unittest.TestCase):
                     line_no = _locate_value_line(
                         lines, "version", value, used_version_lines
                     )
-                    rule = _DOCKER_RULE
+                    rule = _DIGEST_RULE if is_digest(value) else _DOCKER_RULE
                     title = _DOCKER_TITLE
                     category: type[Warning] = NonSemverImageVersionWarning
                     key_label = "version"
@@ -208,10 +210,10 @@ class TestSemverPinning(unittest.TestCase):
 
         if findings_emitted:
             print(
-                "\n💡 Non-semver pins: suppress with "
-                "'# nocheck: docker-version' (above or on the `version:` line) "
-                "or '# nocheck: repository-version' (above or on the `ref:` "
-                "line) when the non-semver pin is intentional.",
+                "\n💡 Non-semver pins: a digest is the preferred fallback and "
+                "declares itself with '# nocheck: docker-digest'; a general "
+                "tag uses '# nocheck: docker-version' and a general git ref "
+                "'# nocheck: repository-version', above or on the pinned line.",
                 flush=True,
             )
 
diff --git a/tests/lint/ansible/tasks/test_loop_var_shadowing.py b/tests/lint/ansible/tasks/test_loop_var_shadowing.py
new file mode 100644
index 0000000000..414434dad4
--- /dev/null
+++ b/tests/lint/ansible/tasks/test_loop_var_shadowing.py
@@ -0,0 +1,103 @@
+"""Lint: a ``loop_var`` may not take the name of a declared variable.
+
+Ansible warns and carries on:
+
+    [WARNING]: The variable 'application_id' is already in use.
+    You should set the `loop_var` value in the `loop_control` option for the
+    task to something else to avoid variable collisions and unexpected
+    behavior.
+
+Carrying on is the problem. Inside the loop the original value is gone, so
+every lookup, template and nested include that reads the name sees the loop
+item instead. The task still succeeds, which is why this shows up as a warning
+in a log nobody greps rather than as a failure.
+
+``application_id`` is the sharp case here: almost every role declares it and
+``include_role`` carries it into whatever the loop body reaches, so a loop over
+applications that names its item ``application_id`` silently repoints every
+config lookup in the nested role.
+
+Declared means: a key in ``group_vars/**`` or in any role's ``vars/main.yml``
+or ``defaults/main.yml``. Cross-role includes are routine in this repository,
+so a name another role declares is a name that can be in scope here.
+
+Suppression (see ``docs/contributing/actions/testing/suppression.md``):
+
+* ``nocheck: loop-var-shadow`` on the ``loop_var`` line or the one above it,
+  when the shadowing is deliberate and the loop body provably reads no other
+  meaning of the name.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+from utils.annotations.suppress import is_suppressed_at
+from utils.cache.files import iter_project_files, read_text
+from utils.cache.yaml import load_yaml_any
+
+from . import PROJECT_ROOT
+
+_RULE = "loop-var-shadow"
+_LOOP_VAR = re.compile(r"^\s*loop_var:\s*[\"']?(?P<name>[A-Za-z_][A-Za-z0-9_]*)")
+
+
+def _declared_names() -> set[str]:
+    """Every variable name the project declares in a file Ansible loads."""
+    names: set[str] = set()
+    for path in iter_project_files(extensions=(".yml", ".yaml"), exclude_tests=True):
+        rel = Path(path).relative_to(PROJECT_ROOT).as_posix()
+        is_group_var = rel.startswith("group_vars/")
+        is_role_var = re.fullmatch(r"roles/[^/]+/(vars|defaults)/main\.ya?ml", rel)
+        if not (is_group_var or is_role_var):
+            continue
+        loaded = load_yaml_any(path)
+        if isinstance(loaded, dict):
+            names.update(key for key in loaded if isinstance(key, str))
+    return names
+
+
+def _task_files() -> list[str]:
+    return sorted(
+        path
+        for path in iter_project_files(extensions=(".yml", ".yaml"), exclude_tests=True)
+        if "/tasks/" in Path(path).relative_to(PROJECT_ROOT).as_posix()
+    )
+
+
+class TestLoopVarShadowing(unittest.TestCase):
+    def test_no_loop_var_shadows_a_declared_variable(self) -> None:
+        declared = _declared_names()
+        self.assertTrue(
+            declared, "no variable declarations were found to compare against"
+        )
+
+        findings: list[str] = []
+        for path in _task_files():
+            rel = Path(path).relative_to(PROJECT_ROOT).as_posix()
+            lines = read_text(path).splitlines()
+            for index, line in enumerate(lines):
+                match = _LOOP_VAR.match(line)
+                if match is None or match.group("name") not in declared:
+                    continue
+                if is_suppressed_at(lines, index + 1, _RULE, mode="same-or-above"):
+                    continue
+                findings.append(f"- {rel}:{index + 1}: loop_var: {match.group('name')}")
+
+        if findings:
+            self.fail(
+                "These loops name their item after a variable the project "
+                "declares, so inside the loop that variable carries the item "
+                "instead of its own value and every nested lookup reads the "
+                "wrong thing:\n"
+                + "\n".join(findings)
+                + "\n\nFix: give the loop item a name of its own, for example "
+                f"`loop_var: <role>_item`, or mark it `nocheck: {_RULE}` when the "
+                "loop body provably reads no other meaning of the name."
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/variables/test_api_accessed_via_lookup.py b/tests/lint/ansible/variables/test_api_accessed_via_lookup.py
new file mode 100644
index 0000000000..803ab4177d
--- /dev/null
+++ b/tests/lint/ansible/variables/test_api_accessed_via_lookup.py
@@ -0,0 +1,105 @@
+"""``API`` is reachable through its lookups only, never as a bare variable.
+
+Rationale
+=========
+A bare ``API.github.client_id`` resolves against whatever the scope happens to
+hold, and an inventory override replaces the declaration rather than merging
+into it -- ``utils/api.py`` carries the mechanism and the consequences.
+``lookup('api', '<provider>.<key>')`` and ``lookup('api_enabled', '<provider>')``
+merge the override over ``group_vars/all/18_api.yml``, so an override narrows
+values and never the provider set. Routing every access through them also keeps
+one place to change how credentials are sourced.
+
+Scope
+=====
+Jinja in ``roles/``, ``group_vars/`` and ``inventories/``. An ``API:`` key
+being *declared* is not an access; only a dereference inside ``{{ }}`` or
+``{% %}`` is. Test fixtures legitimately build the bare form to exercise the
+renderer, so ``tests/`` is out of scope.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+from dataclasses import dataclass
+from pathlib import Path
+
+from utils.cache.files import iter_project_files_with_content
+
+from . import PROJECT_ROOT
+
+_SCOPES = ("roles", "group_vars", "inventories")
+_SUFFIXES = (".yml", ".yaml", ".j2")
+_JINJA_BLOCK = re.compile(r"\{\{(.*?)\}\}|\{%(.*?)%\}", re.DOTALL)
+_BARE_API = re.compile(r"(?<![\w.'\"])API\s*[.\[]")
+
+
+@dataclass(frozen=True)
+class Finding:
+    path: str
+    line: int
+    expression: str
+
+
+def _scoped_files() -> list[tuple[str, str]]:
+    prefixes = tuple(f"{scope}/" for scope in _SCOPES)
+    scoped: list[tuple[str, str]] = []
+    for path, text in iter_project_files_with_content(
+        extensions=_SUFFIXES, exclude_tests=True
+    ):
+        rel = Path(path).relative_to(PROJECT_ROOT).as_posix()
+        if rel.startswith(prefixes):
+            scoped.append((rel, text))
+    return sorted(scoped)
+
+
+def _findings() -> list[Finding]:
+    findings: list[Finding] = []
+    for rel, text in _scoped_files():
+        for match in _JINJA_BLOCK.finditer(text):
+            expression = match.group(1) or match.group(2) or ""
+            if not _BARE_API.search(expression):
+                continue
+            line = text.count("\n", 0, match.start()) + 1
+            findings.append(Finding(rel, line, " ".join(expression.split())))
+    return findings
+
+
+class TestApiAccessedViaLookup(unittest.TestCase):
+    def test_no_jinja_dereferences_api_directly(self) -> None:
+        findings = _findings()
+
+        if findings:
+            self.fail(
+                f"{len(findings)} expression(s) read 'API' as a bare variable, which "
+                "breaks against an inventory that overrides only some providers:\n"
+                + "\n".join(
+                    f"  - {f.path}:{f.line}: {{{{ {f.expression} }}}}" for f in findings
+                )
+                + "\n\nRead the value with lookup('api', '<provider>.<key>') and gate "
+                "on lookup('api_enabled', '<provider>')."
+            )
+
+    def test_the_scan_reaches_jinja_in_every_scope(self) -> None:
+        """A suffix or scope typo would make the rule above pass forever."""
+        scanned = _scoped_files()
+        for scope in _SCOPES:
+            with self.subTest(scope=scope):
+                blocks = sum(
+                    len(_JINJA_BLOCK.findall(text))
+                    for rel, text in scanned
+                    if rel.startswith(f"{scope}/")
+                )
+                self.assertTrue(blocks, f"no Jinja found under {scope}/")
+
+    def test_the_pattern_separates_a_dereference_from_a_declaration(self) -> None:
+        self.assertTrue(_BARE_API.search("API.github.client_id | length"))
+        self.assertTrue(_BARE_API.search("API['github']"))
+        self.assertFalse(_BARE_API.search("lookup('api', 'github.client_id')"))
+        self.assertFalse(_BARE_API.search("LITELLM_API.url"))
+        self.assertFalse(_BARE_API.search("item.API.key"))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/ansible/variables/test_role_and_group_vars_used.py b/tests/lint/ansible/variables/test_role_and_group_vars_used.py
index d663e8e1e1..89fa90a7f9 100644
--- a/tests/lint/ansible/variables/test_role_and_group_vars_used.py
+++ b/tests/lint/ansible/variables/test_role_and_group_vars_used.py
@@ -194,8 +194,7 @@ def _build_usage_indices(repo_root: Path) -> tuple[set[str], set[str], set[str]]
 
     Routes every read through the project's cached helpers:
     * ``iter_project_files_with_content`` walks the path list once
-      per process (``lru_cache(maxsize=1)`` on `_all_project_files`)
-      and reads each file via the cached ``read_text``;
+      per process and reads each file via the cached ``read_text``;
     * ``load_yaml_any`` parses each YAML file once per
       ``(path, mtime, size)`` signature and reuses the parsed
       structure on every later call in the same process — no
diff --git a/tests/lint/filesystem/shell/test_no_shell_templates.py b/tests/lint/filesystem/shell/test_no_shell_templates.py
new file mode 100644
index 0000000000..512c1656c5
--- /dev/null
+++ b/tests/lint/filesystem/shell/test_no_shell_templates.py
@@ -0,0 +1,64 @@
+"""Lint: a shell script ships as ``.sh``, not as ``.sh.j2``.
+
+A templated script is opaque to every tool that reads shell. ``shellcheck``
+parses Jinja as syntax errors, the repo's own ``.sh`` guards (``|| true``,
+``sh -c pipefail``, inline PHP) skip the file because it is not a ``.sh``, and
+nothing can execute it to test it: what runs on the host never exists in the
+repository. A defect in the rendered half is found by deploying it.
+
+The variability belongs in the invocation, not in the text. ``sys-service``
+resolves ``files/shell/script.sh`` alongside ``templates/script.sh.j2``, and a
+static script takes its values the way this repo's Python scripts already do:
+as arguments on ``ExecStart``, or through ``Environment=``.
+
+Suppression (see ``docs/contributing/actions/testing/suppression.md``):
+
+* ``nocheck: shell-template`` anywhere in the first 30 lines, for a script whose
+  shape itself is generated rather than its values. Put the marker BELOW the
+  shebang, never above it, and prefer the Jinja comment form ``{# ... #}`` so it
+  does not land in the rendered script. State what is generated.
+
+None of the templates present when this guard landed meets that bar: each
+interpolates values into a fixed script, and each is grandfathered with a marker
+saying so, because converting a deployed script to argv changes what runs on the
+host. The guard exists to stop the next one.
+"""
+
+from __future__ import annotations
+
+import unittest
+from pathlib import Path
+
+from utils.annotations.suppress import is_suppressed_in_head
+from utils.cache.files import iter_project_files, read_text
+
+from . import PROJECT_ROOT
+
+_RULE = "shell-template"
+_SUFFIX = ".sh.j2"
+
+
+class TestNoShellTemplates(unittest.TestCase):
+    def test_no_shell_script_is_a_template(self) -> None:
+        findings: list[str] = []
+        for path in iter_project_files(extensions=(_SUFFIX,), exclude_tests=True):
+            lines = read_text(path).splitlines()
+            if is_suppressed_in_head(lines, _RULE):
+                continue
+            findings.append(f"- {Path(path).relative_to(PROJECT_ROOT).as_posix()}")
+
+        if findings:
+            self.fail(
+                "These shell scripts are Jinja templates, so shellcheck, the "
+                "repository's .sh guards and every test read something other "
+                "than what runs on the host:\n"
+                + "\n".join(sorted(findings))
+                + "\n\nFix: move the script to files/shell/ as a plain .sh and "
+                "pass its values as ExecStart arguments or Environment= entries, "
+                f"or mark it `nocheck: {_RULE}` in the file head when the script's "
+                "shape, not just its values, is generated."
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/lint/repository/test_distros_spot.py b/tests/lint/repository/test_distros_spot.py
index fe380047fc..5f58618776 100644
--- a/tests/lint/repository/test_distros_spot.py
+++ b/tests/lint/repository/test_distros_spot.py
@@ -113,7 +113,7 @@ class TestDistrosSpot(unittest.TestCase):
         ref = _MATRIX_REF_RE.match(str(axis))
         self.assertIsNotNone(
             ref,
-            f"test-workspace.yml must derive its matrix from {FILE_META_DISTROS} "
+            f"call-test-workspace.yml must derive its matrix from {FILE_META_DISTROS} "
             f"via fromJson(needs.<job>.outputs.<name>), got {axis!r}.",
         )
         resolver_id, output_name = ref.groups()
diff --git a/tests/lint/repository/test_no_debian_codename_tags.py b/tests/lint/repository/test_no_debian_codename_tags.py
new file mode 100644
index 0000000000..5445e3ab86
--- /dev/null
+++ b/tests/lint/repository/test_no_debian_codename_tags.py
@@ -0,0 +1,222 @@
+"""Lint: a container image tag MUST NOT name a Debian release by codename.
+
+Why
+---
+
+A codename carries no ordering. ``bookworm`` and ``trixie`` are two
+opaque strings, so neither the image updater at
+[test_image_versions.py](../../external/update/docker/test_image_versions.py)
+nor the semver pin lint at
+[test_semver_pinning.py](../../lint/ansible/services/test_semver_pinning.py)
+can tell that one supersedes the other. A python image pinned to the Debian
+12 codename is therefore frozen on that release for as long as it stands: no
+job will ever raise it, and the freeze is invisible because the tag keeps
+resolving.
+
+The numeric equivalent (``debian:13``, ``debian:13.6``) is comparable, so
+the same pin stays inside the freshness pipeline and crosses a Debian major
+the way every other version pin does.
+
+Scope
+-----
+
+Every tracked file. Two shapes are recognised:
+
+* a ``name:tag`` image reference with no space after the colon, which
+  covers ``image:`` values, Dockerfile ``FROM`` lines and heredocs,
+* a ``version:`` / ``*_version:`` / ``*_tag:`` YAML value, whose tag
+  carries no registry prefix to anchor it.
+
+A tag is split on ``-``, ``.`` and ``_``; a finding needs one whole
+component to be a codename, so ``cache buster`` and ``.stretched-link``
+do not match.
+
+Out of scope: an apt suite name (``deb ... bookworm main``, a Nexus proxy
+``"distribution"``). A sources.list has no numeric form, so the rule would
+have no fix to offer there.
+
+Suppression
+-----------
+
+``# nocheck: debian-codename`` on or above the line, for an upstream that
+publishes no numeric tag. The marker names which upstream, because the pin
+it buys can never be raised.
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import unittest
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+from utils.annotations.suppress import is_suppressed_at
+from utils.cache.files import read_text
+
+from . import PROJECT_ROOT
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+_RULE = "debian-codename"
+
+_CODENAMES = frozenset(
+    {
+        "squeeze",
+        "wheezy",
+        "jessie",
+        "stretch",
+        "buster",
+        "bullseye",
+        "bookworm",
+        "trixie",
+        "forky",
+        "duke",
+        "sid",
+    }
+)
+
+_MENTION_RE = re.compile(
+    rf"(?<![a-z])(?:{'|'.join(sorted(_CODENAMES))})(?![a-z])",
+    re.IGNORECASE,
+)
+
+_IMAGE_REF_RE = re.compile(
+    r"(?<![\w./:-])([a-z0-9][a-z0-9._/-]{0,127}):([A-Za-z0-9][A-Za-z0-9._-]{0,127})"
+)
+
+_VERSION_KEY_RE = re.compile(
+    r"^\s*(?:-\s*)?(?P<key>[A-Za-z0-9_]*(?:version|tag))\s*:\s*(?P<value>\S+)",
+    re.IGNORECASE,
+)
+
+_TAG_SPLIT_RE = re.compile(r"[-._]")
+
+
+@dataclass(frozen=True)
+class Violation:
+    """One codename-tagged reference.
+
+    Args:
+        file: repo-relative path.
+        line_no: 1-based line the reference sits on.
+        reference: the offending text as written.
+        codename: the release component that triggered the finding.
+    """
+
+    file: str
+    line_no: int
+    reference: str
+    codename: str
+
+
+def _codename_of(tag: str) -> str | None:
+    """Return the codename component of *tag*, or None when it carries none.
+
+    Args:
+        tag: an image tag, without the ``name:`` prefix.
+    """
+    for component in _TAG_SPLIT_RE.split(tag.strip("'\"")):
+        if component.lower() in _CODENAMES:
+            return component.lower()
+    return None
+
+
+def _references_on(line: str) -> list[tuple[str, str]]:
+    """Yield ``(reference, codename)`` for every codename-tagged reference.
+
+    Args:
+        line: one source line already known to mention a codename.
+    """
+    found: list[tuple[str, str]] = []
+    for match in _IMAGE_REF_RE.finditer(line):
+        codename = _codename_of(match.group(2))
+        if codename:
+            found.append((match.group(0), codename))
+    if found:
+        return found
+    key_match = _VERSION_KEY_RE.match(line)
+    if key_match:
+        value = key_match.group("value").split("#", 1)[0]
+        codename = _codename_of(value)
+        if codename:
+            found.append((f"{key_match.group('key')}: {value}", codename))
+    return found
+
+
+def _git_lines(*args: str) -> list[str]:
+    out = subprocess.check_output(
+        ["git", "-c", "safe.directory=*", "-C", str(PROJECT_ROOT), *args],
+        text=True,
+    )
+    return [line for line in out.splitlines() if line]
+
+
+def _targets() -> set[str]:
+    """Every tracked file plus every untracked new one.
+
+    A role added but not yet staged carries its pins like any other, so the
+    lint MUST see it before the commit rather than after.
+    """
+    return set(_git_lines("ls-files")) | set(
+        _git_lines("ls-files", "--others", "--exclude-standard")
+    )
+
+
+def _scan_file(path: Path) -> list[Violation]:
+    """Return every unsuppressed codename reference in *path*.
+
+    Args:
+        path: absolute path to a tracked file.
+    """
+    try:
+        text = read_text(str(path))
+    except (OSError, UnicodeDecodeError, ValueError):
+        return []
+
+    if not _MENTION_RE.search(text):
+        return []
+
+    rel = path.relative_to(PROJECT_ROOT).as_posix()
+    lines = text.splitlines()
+    violations: list[Violation] = []
+    for line_no, raw in enumerate(lines, start=1):
+        if not _MENTION_RE.search(raw):
+            continue
+        for reference, codename in _references_on(raw):
+            if is_suppressed_at(lines, line_no, _RULE):
+                continue
+            violations.append(Violation(rel, line_no, reference, codename))
+    return violations
+
+
+class TestNoDebianCodenameTags(unittest.TestCase):
+    """Fails on any image tag that names a Debian release by codename."""
+
+    def test_no_image_tag_names_a_debian_codename(self) -> None:
+        violations: list[Violation] = []
+        for rel in sorted(_targets()):
+            path = PROJECT_ROOT / rel
+            if path.is_file():
+                violations.extend(_scan_file(path))
+
+        if not violations:
+            return
+
+        shown = "\n".join(
+            f"{v.file}:{v.line_no}: {v.reference} (Debian {v.codename})"
+            for v in sorted(violations, key=lambda v: (v.file, v.line_no))
+        )
+        self.fail(
+            f"{len(violations)} image reference(s) pinned to a Debian codename. "
+            "A codename is not ordered, so no updater can raise it across a "
+            "Debian major and the pin stays frozen on that release forever. "
+            "Use the numeric tag instead (debian:13, python:3.11-slim), or "
+            f"declare the exception with '# nocheck: {_RULE}' naming the "
+            f"upstream that publishes no numeric tag:\n{shown}"
+        )
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()
diff --git a/tests/lint/repository/test_workflow_references.py b/tests/lint/repository/test_workflow_references.py
index fcb8156f37..10340731fb 100644
--- a/tests/lint/repository/test_workflow_references.py
+++ b/tests/lint/repository/test_workflow_references.py
@@ -2,9 +2,17 @@
 
 Scope
 =====
-Any occurrence of ``.github/workflows/<file>.yml`` or ``actions/workflows/
-<file>.yml`` in a tracked text file: `uses:` lines, Python constants, Makefile
-variables, shell API URLs and Markdown links alike.
+Three patterns:
+
+* ``.github/workflows/<file>.yml`` or ``actions/workflows/<file>.yml`` anywhere
+  in a tracked text file: `uses:` lines, Python constants, Makefile variables,
+  shell API URLs and Markdown links alike.
+* a **bare** ``<file>.yml`` inside ``.github/workflows/`` itself, where every
+  such token names a sibling workflow. Elsewhere in the tree a bare name is
+  ambiguous with role and compose files, so the prefix stays mandatory there.
+* the target of a manual dispatch anywhere, which must exist **and** declare
+  ``workflow_dispatch``. Both forms count: ``gh workflow run <file>.yml`` and a
+  REST POST to ``actions/workflows/<file>.yml/dispatches``.
 
 Why
 ===
@@ -13,6 +21,11 @@ the run, a Python constant raises at test time, but a Markdown link or an API
 URL in a shell script fails only in production, months later. Matching the
 string against the directory listing catches all of them at once.
 
+A stale `gh workflow run` target is the quietest of the three. GitHub resolves
+the name against the deleted workflow's tombstone instead of erroring, answers
+HTTP 422, and keeps the tombstone out of `GET /actions/workflows`, so listing a
+repository's workflows shows a clean set while every dispatch fails.
+
 A file opts out with a ``nocheck: workflow-references`` marker in its first 30
 lines, for documents that name a workflow that does not exist yet.
 """
@@ -32,16 +45,30 @@ _NOCHECK_RULE = "workflow-references"
 _WORKFLOW_DIR = PROJECT_ROOT / ".github" / "workflows"
 _SUFFIXES = {".md", ".yml", ".yaml", ".py", ".sh", ".j2", ".rst", ".txt"}
 _REFERENCE_RE = re.compile(r"(?:\.github|actions)/workflows/([A-Za-z0-9._-]+\.ya?ml)")
+_BARE_RE = re.compile(r"(?<![\w/.-])([A-Za-z0-9][A-Za-z0-9._-]*\.ya?ml)")
+_DISPATCH_RE = re.compile(
+    r"gh workflow run\s+(?P<cli>[A-Za-z0-9._-]+\.ya?ml)"
+    r"|actions/workflows/(?P<api>[A-Za-z0-9._-]+\.ya?ml)/dispatches"
+)
 
 
 def _scanned(path: Path) -> bool:
     return path.suffix in _SUFFIXES or path.name == "Makefile"
 
 
-def missing_references() -> list[str]:
-    """Every `<file>:<line>: <workflow>` whose workflow is not on disk."""
-    known = {entry.name for entry in _WORKFLOW_DIR.iterdir() if entry.is_file()}
-    offenders: list[str] = []
+def _known() -> set[str]:
+    return {entry.name for entry in _WORKFLOW_DIR.iterdir() if entry.is_file()}
+
+
+def _patterns(path: Path) -> tuple[re.Pattern[str], ...]:
+    if path.is_relative_to(_WORKFLOW_DIR):
+        return (_REFERENCE_RE, _BARE_RE)
+    return (_REFERENCE_RE,)
+
+
+def _candidates() -> list[tuple[str, list[str]]]:
+    """Every scanned file that did not opt out, as `(relative path, lines)`."""
+    found: list[tuple[str, list[str]]] = []
     for path_str in iter_non_ignored_files():
         path = Path(path_str)
         if not _scanned(path):
@@ -52,16 +79,41 @@ def missing_references() -> list[str]:
             continue
         if is_suppressed_in_head(lines, _NOCHECK_RULE):
             continue
-        rel = path.relative_to(PROJECT_ROOT).as_posix()
+        found.append((path.relative_to(PROJECT_ROOT).as_posix(), lines))
+    return found
+
+
+def missing_references() -> list[str]:
+    """Every `<file>:<line>: <workflow>` whose workflow is not on disk."""
+    known = _known()
+    offenders: list[str] = []
+    for rel, lines in _candidates():
+        patterns = _patterns(PROJECT_ROOT / rel)
         for number, line in enumerate(lines, 1):
+            names = {name for pattern in patterns for name in pattern.findall(line)}
             offenders.extend(
-                f"{rel}:{number}: {name}"
-                for name in _REFERENCE_RE.findall(line)
-                if name not in known
+                f"{rel}:{number}: {name}" for name in sorted(names) if name not in known
             )
     return offenders
 
 
+def undispatchable_targets() -> list[str]:
+    """Every `gh workflow run` target that is absent or not manually dispatchable."""
+    known = _known()
+    offenders: list[str] = []
+    for rel, lines in _candidates():
+        for number, line in enumerate(lines, 1):
+            for match in _DISPATCH_RE.finditer(line):
+                name = match.group("cli") or match.group("api")
+                if name not in known:
+                    offenders.append(f"{rel}:{number}: {name} does not exist")
+                elif "workflow_dispatch" not in read_text(str(_WORKFLOW_DIR / name)):
+                    offenders.append(
+                        f"{rel}:{number}: {name} declares no workflow_dispatch trigger"
+                    )
+    return offenders
+
+
 class TestWorkflowReferences(unittest.TestCase):
     def test_referenced_workflows_exist(self) -> None:
         offenders = missing_references()
@@ -73,6 +125,17 @@ class TestWorkflowReferences(unittest.TestCase):
                 "that is still to be created:\n" + "\n".join(sorted(offenders))
             )
 
+    def test_dispatch_targets_are_dispatchable(self) -> None:
+        offenders = undispatchable_targets()
+        if offenders:
+            self.fail(
+                f"{len(offenders)} manual dispatch(es) name a workflow GitHub cannot "
+                "run. Both failures answer HTTP 422 rather than something the caller "
+                "can read: a stale filename resolves to the deleted workflow's "
+                "tombstone, and a reusable-only workflow refuses the event:\n"
+                + "\n".join(sorted(offenders))
+            )
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/performance/test_runtime_performance.py b/tests/performance/test_runtime_performance.py
index bad5f4ac0d..5f11fcfac7 100644
--- a/tests/performance/test_runtime_performance.py
+++ b/tests/performance/test_runtime_performance.py
@@ -97,7 +97,7 @@ class TestRuntimeLookupPerformance(unittest.TestCase):
         hit the cache and stay under theirs.
 
         Using a single for-loop here is test-code-only and not production code
-        generating files/tasks; the CLAUDE.md shell-loop ban does not apply.
+        generating files/tasks; the AGENTS.md shell-loop ban does not apply.
         """
         warm = _simulate_ansible_variables(self.shared_applications, self.shared_users)
         t0 = time.process_time()
diff --git a/tests/unit/python/cli/administration/inventory/provision/test_reset.py b/tests/unit/python/cli/administration/inventory/provision/test_reset.py
index 91d038ee8f..4995e6059f 100644
--- a/tests/unit/python/cli/administration/inventory/provision/test_reset.py
+++ b/tests/unit/python/cli/administration/inventory/provision/test_reset.py
@@ -53,6 +53,10 @@ users:
       6e6577730a
   biber:
     password: VeryUnsecurePassword!1
+  keycloak-bot:
+    password: !vault |
+      $ANSIBLE_VAULT;1.1;AES256
+      626f740a
 """
 
 DECLARED_USERS = """\
@@ -63,6 +67,14 @@ newsletter:
   uid: 1002
 """
 
+KEYCLOAK_USERS = (
+    DECLARED_USERS
+    + """\
+keycloak-bot:
+  uid: 1003
+"""
+)
+
 
 class TestResetCredentials(unittest.TestCase):
     def setUp(self):
@@ -70,10 +82,14 @@ class TestResetCredentials(unittest.TestCase):
         self.addCleanup(shutil.rmtree, self.workdir, ignore_errors=True)
 
         self.roles_dir = self.workdir / "roles"
-        for application_id in ("web-app-a", "web-app-keycloak"):
+        declarations = {
+            "web-app-a": DECLARED_USERS,
+            "web-app-keycloak": KEYCLOAK_USERS,
+        }
+        for application_id, declared in declarations.items():
             users_file = self.roles_dir / application_id / ROLE_FILE_META_USERS
             users_file.parent.mkdir(parents=True, exist_ok=True)
-            users_file.write_text(DECLARED_USERS, encoding="utf-8")
+            users_file.write_text(declared, encoding="utf-8")
 
         self.host_vars_file = self.workdir / "host_vars" / "localhost.yml"
         self.host_vars_file.parent.mkdir(parents=True, exist_ok=True)
@@ -125,6 +141,32 @@ class TestResetCredentials(unittest.TestCase):
         self._reset(exclude={"administrator", "web-app-keycloak"})
         self.assertIn("database_password", self._credentials("web-app-keycloak"))
 
+    def test_an_application_outside_the_rotation_keeps_its_credentials(self):
+        """Dropping must not outrun regeneration.
+
+        The drop side walks the document while the generate side walks
+        `credential_ids`. A matrix host_vars file carries a block per mirror
+        artefact too, so a document-wide drop would delete credentials the
+        caller never writes back.
+        """
+        _, credentials, _ = self._reset(credential_ids=["web-app-a"])
+        self.assertIn("database_password", self._credentials("web-app-keycloak"))
+        self.assertNotIn("api_key", self._credentials("web-app-a"))
+        self.assertEqual(credentials.call_args.kwargs["application_ids"], ["web-app-a"])
+
+    def test_narrowing_the_credentials_still_rotates_every_user(self):
+        """A narrowed credential scope must not narrow the user passwords.
+
+        Both halves used to share one id list, so scoping the credentials to
+        the round silently stopped rotating the users of every other role.
+        """
+        _, _, users = self._reset(credential_ids=["web-app-a"])
+        self.assertNotIn("password", self._document()["users"]["keycloak-bot"])
+        self.assertEqual(
+            users.call_args.kwargs["application_ids"],
+            ["web-app-a", "web-app-keycloak"],
+        )
+
     def test_an_excluded_user_keeps_its_password(self):
         self._reset()
         users = self._document()["users"]
@@ -164,7 +206,7 @@ class TestResetCredentials(unittest.TestCase):
 
     def test_the_rotated_count_covers_both_sections(self):
         rotated, _, _ = self._reset()
-        self.assertEqual(rotated, 4)
+        self.assertEqual(rotated, 5)
 
     def test_rotating_nothing_aborts(self):
         with self.assertRaises(SystemExit):
diff --git a/tests/unit/python/cli/administration/inventory/provision/test_services_disabler.py b/tests/unit/python/cli/administration/inventory/provision/test_services_disabler.py
index 3b6d865ff2..59155d1424 100644
--- a/tests/unit/python/cli/administration/inventory/provision/test_services_disabler.py
+++ b/tests/unit/python/cli/administration/inventory/provision/test_services_disabler.py
@@ -188,6 +188,36 @@ class TestApplyServicesDisabled(unittest.TestCase):
         dump_yaml(role_dir / ROLE_FILE_META_SERVICES, services)
         dump_yaml(role_dir / ROLE_FILE_VARS_MAIN, {"application_id": role_name})
 
+    def test_a_role_without_shared_in_its_contract_does_not_get_one(self):
+        self._write_host_vars(
+            {"applications": {"web-svc-cdn": {"services": {"dashboard": {}}}}}
+        )
+        self._make_role("web-svc-cdn", {"dashboard": {"enabled": False}})
+
+        apply_services_disabled(self.host_vars, ["dashboard"], self.roles_dir)
+
+        service = self._read_host_vars()["applications"]["web-svc-cdn"]["services"][
+            "dashboard"
+        ]
+        self.assertEqual(False, service["enabled"])
+        self.assertNotIn("shared", service)
+
+    def test_a_role_declaring_both_toggles_still_gets_both(self):
+        self._write_host_vars(
+            {"applications": {"web-app-nextcloud": {"services": {"dashboard": {}}}}}
+        )
+        self._make_role(
+            "web-app-nextcloud", {"dashboard": {"enabled": True, "shared": True}}
+        )
+
+        apply_services_disabled(self.host_vars, ["dashboard"], self.roles_dir)
+
+        service = self._read_host_vars()["applications"]["web-app-nextcloud"][
+            "services"
+        ]["dashboard"]
+        self.assertEqual(False, service["enabled"])
+        self.assertEqual(False, service["shared"])
+
     def test_disables_service_in_host_vars_and_removes_from_inventory(self):
         self._write_host_vars(
             {
diff --git a/tests/unit/python/cli/meta/ci/test_dev_runtime_matrix.py b/tests/unit/python/cli/meta/ci/test_dev_runtime_matrix.py
index 4a10c8d458..bb4fd28e5e 100644
--- a/tests/unit/python/cli/meta/ci/test_dev_runtime_matrix.py
+++ b/tests/unit/python/cli/meta/ci/test_dev_runtime_matrix.py
@@ -7,7 +7,7 @@ import unittest
 from cli.meta.ci.dev_runtime import image_label, workspace_matrix
 from utils.symbol_glossary import to_emoji
 
-IMAGES = ["debian:bookworm", "fedora:latest", "ubuntu:latest", "quay.io/centos:latest"]
+IMAGES = ["debian:13", "fedora:latest", "ubuntu:latest", "quay.io/centos:latest"]
 
 
 class TestWorkspaceMatrix(unittest.TestCase):
@@ -55,7 +55,7 @@ class TestWorkspaceMatrix(unittest.TestCase):
     def test_a_label_keeps_only_the_last_two_segments(self) -> None:
         self.assertEqual(image_label("quay.io/centos/centos:latest"), "centos:latest")
         self.assertEqual(image_label("manjarolinux/base"), "manjarolinux/base")
-        self.assertEqual(image_label("debian:bookworm"), "debian:bookworm")
+        self.assertEqual(image_label("debian:13"), "debian:13")
         self.assertEqual(image_label("ghcr.io/foo/bar/baz:1.2"), "baz:1.2")
         self.assertEqual(image_label("plainname"), "plainname")
 
diff --git a/tests/unit/python/cli/meta/ci/test_validate.py b/tests/unit/python/cli/meta/ci/test_validate.py
index e849f331c7..d418efec03 100644
--- a/tests/unit/python/cli/meta/ci/test_validate.py
+++ b/tests/unit/python/cli/meta/ci/test_validate.py
@@ -54,6 +54,11 @@ class TestProblems(unittest.TestCase):
         self.assertEqual(errors, [])
         self.assertIn("web-app-gone", warnings[0])
 
+    def test_a_pinned_role_the_run_never_discovers_only_warns(self) -> None:
+        errors, warnings = _problems("web-app-gone#0,2")
+        self.assertEqual(errors, [])
+        self.assertIn("web-app-gone", warnings[0])
+
     def test_a_bare_role_the_run_discovers_is_silent(self) -> None:
         self.assertEqual(_problems("web-app-a"), ([], []))
 
diff --git a/tests/unit/python/cli/meta/roles/applications/resolution/affected/test_main.py b/tests/unit/python/cli/meta/roles/applications/resolution/affected/test_main.py
index 6d354161d6..40314d62bc 100644
--- a/tests/unit/python/cli/meta/roles/applications/resolution/affected/test_main.py
+++ b/tests/unit/python/cli/meta/roles/applications/resolution/affected/test_main.py
@@ -13,6 +13,7 @@ from utils.cache.yaml import dump_yaml
 from utils.roles.mapping import (
     ROLE_FILE_META_MAIN,
     ROLE_FILE_META_SERVICES,
+    ROLE_FILE_META_VARIANTS,
     ROLE_FILE_VARS_MAIN,
 )
 
@@ -38,6 +39,22 @@ def _write_run_after(root: Path, role: str, run_after: list[str]) -> None:
     )
 
 
+def _write_sso_consumer(root: Path, role: str, variants: list[bool]) -> None:
+    """A role consuming shared `sso`, with one variant per `variants` entry
+    that either keeps the consumption or switches it off."""
+    dump_yaml(
+        root / "roles" / role / ROLE_FILE_META_SERVICES,
+        {role: {}, "sso": {"enabled": True, "shared": True, "flavor": "oidc"}},
+    )
+    dump_yaml(
+        root / "roles" / role / ROLE_FILE_META_VARIANTS,
+        [
+            {"services": {"sso": {"enabled": consumes, "shared": consumes}}}
+            for consumes in variants
+        ],
+    )
+
+
 def _write_dependencies(root: Path, role: str, deps: list[str]) -> None:
     dump_yaml(
         root / "roles" / role / ROLE_FILE_META_MAIN,
@@ -104,6 +121,59 @@ class TestAffected(unittest.TestCase):
                 self.assertIn("web-app-keycloak", got)
                 self.assertIn("web-app-consumer", got)
 
+    def test_only_the_variants_reaching_the_seed_are_kept(self) -> None:
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            _mk_app_role(root, "web-app-keycloak", "keycloak")
+            _mk_app_role(root, "web-app-consumer", "consumer")
+            _write_sso_consumer(root, "web-app-consumer", [True, False, True])
+
+            with patch.object(repo_paths, "PROJECT_ROOT", root):
+                got = affected_main.affected_selection(["web-app-keycloak"])
+            self.assertIn("web-app-consumer#0,2", got)
+
+    def test_a_role_whose_variants_all_reach_the_seed_stays_bare(self) -> None:
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            _mk_app_role(root, "web-app-keycloak", "keycloak")
+            _mk_app_role(root, "web-app-consumer", "consumer")
+            _write_sso_consumer(root, "web-app-consumer", [True, True])
+
+            with patch.object(repo_paths, "PROJECT_ROOT", root):
+                got = affected_main.affected_selection(["web-app-keycloak"])
+            self.assertIn("web-app-consumer", got)
+
+    def test_the_narrowing_follows_a_parents_variant_one_generation_up(self) -> None:
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            _mk_app_role(root, "web-app-keycloak", "keycloak")
+            _mk_app_role(root, "web-app-matomo", "matomo")
+            _mk_app_role(root, "web-app-consumer", "consumer")
+            _write_sso_consumer(root, "web-app-matomo", [True, False])
+            dump_yaml(
+                root / "roles" / "web-app-consumer" / ROLE_FILE_META_SERVICES,
+                {"consumer": {}, "matomo": {"enabled": True, "shared": True}},
+            )
+            dump_yaml(
+                root / "roles" / "web-app-consumer" / ROLE_FILE_META_VARIANTS,
+                [{"services": {"matomo": {"enabled": True, "shared": True}}}] * 2,
+            )
+
+            with patch.object(repo_paths, "PROJECT_ROOT", root):
+                got = affected_main.affected_selection(["web-app-keycloak"])
+            self.assertIn("web-app-consumer#0", got)
+
+    def test_a_seed_keeps_every_variant_of_its_own_role(self) -> None:
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            _mk_app_role(root, "web-app-keycloak", "keycloak")
+            _mk_app_role(root, "web-app-consumer", "consumer")
+            _write_sso_consumer(root, "web-app-consumer", [True, False])
+
+            with patch.object(repo_paths, "PROJECT_ROOT", root):
+                got = affected_main.affected_selection(["web-app-consumer"])
+            self.assertEqual(got, ["web-app-consumer"])
+
     def test_unknown_role_raises(self) -> None:
         with tempfile.TemporaryDirectory() as td:
             root = Path(td)
diff --git a/tests/unit/python/group_vars/test_litellm_chat_model.py b/tests/unit/python/group_vars/test_litellm_chat_model.py
index 4705bbd14b..67a8c4c902 100644
--- a/tests/unit/python/group_vars/test_litellm_chat_model.py
+++ b/tests/unit/python/group_vars/test_litellm_chat_model.py
@@ -11,10 +11,18 @@ from utils.cache.yaml import load_yaml
 _AI_VARS = Path(PROJECT_ROOT) / "group_vars" / "all" / "16_ai.yml"
 
 
-def _stub_lookup(preload_models):
+def _ansible_bool(value):
+    if isinstance(value, str):
+        return value.strip().lower() in ("true", "yes", "on", "1")
+    return bool(value)
+
+
+def _stub_lookup(preload_models, lmstudio_models):
     def lookup(kind, role, path, *args):
         if (kind, path) == ("config", "services.ollama.preload_models"):
             return preload_models
+        if (kind, path) == ("config", "services.lmstudio.preload_models"):
+            return lmstudio_models
         raise AssertionError(f"unexpected lookup({kind!r}, {role!r}, {path!r})")
 
     return lookup
@@ -36,15 +44,24 @@ class TestLitellmChatModel(unittest.TestCase):
         cls.env.tests["search"] = lambda value, pattern: bool(
             re.search(pattern, str(value))
         )
+        cls.env.filters["bool"] = _ansible_bool
         cls.source = load_yaml(_AI_VARS)
 
-    def _render(self, name, *, roles, api_key, preload_models=()):
+    def _render(self, name, *, roles, api_key, preload_models=(), lmstudio_models=()):
         return (
             self.env.from_string(self.source[name])
             .render(
                 LITELLM_BACKEND_ROLES=list(roles),
-                OPENROUTER_API_KEY=api_key,
-                lookup=_stub_lookup(list(preload_models)),
+                LITELLM_OLLAMA_BACKEND=str("svc-ai-ollama" in roles),
+                LITELLM_LMSTUDIO_BACKEND=str("svc-ai-lmstudio" in roles),
+                AI_REMOTE_ALIASES=(["openrouter/auto"] if api_key else []),
+                lookup=_stub_lookup(
+                    [{"alias": alias, "name": alias} for alias in preload_models],
+                    [
+                        {"alias": alias, "name": f"{alias}-gguf"}
+                        for alias in lmstudio_models
+                    ],
+                ),
             )
             .strip()
         )
@@ -66,10 +83,35 @@ class TestLitellmChatModel(unittest.TestCase):
         self.assertEqual(served, "True")
 
     def test_lmstudio_wins_over_the_openrouter_fallback(self):
-        model, served = self._both(roles=["svc-ai-lmstudio"], api_key="")
-        self.assertEqual(model, "lmstudio/default")
+        model, served = self._both(
+            roles=["svc-ai-lmstudio"], api_key="", lmstudio_models=["qwen2.5:0.5b"]
+        )
+        self.assertEqual(model, "qwen2.5:0.5b")
         self.assertEqual(served, "True")
 
+    def test_lmstudio_without_a_preloaded_model_serves_nothing(self):
+        served = self._render(
+            "LITELLM_CHAT_MODEL_SERVED", roles=["svc-ai-lmstudio"], api_key=""
+        )
+        self.assertEqual(served, "False")
+
+    def test_both_backends_name_the_same_model(self):
+        alias = "qwen2.5:0.5b"
+        with_ollama = self._render(
+            "LITELLM_CHAT_MODEL",
+            roles=["svc-ai-ollama"],
+            api_key="",
+            preload_models=[alias],
+        )
+        with_lmstudio = self._render(
+            "LITELLM_CHAT_MODEL",
+            roles=["svc-ai-lmstudio"],
+            api_key="",
+            lmstudio_models=[alias],
+        )
+        self.assertEqual(with_ollama, with_lmstudio)
+        self.assertEqual(with_ollama, alias)
+
     def test_ollama_serves_its_first_non_embedding_model(self):
         model, served = self._both(
             roles=["svc-ai-ollama"],
@@ -90,15 +132,19 @@ class TestLitellmChatModel(unittest.TestCase):
 
     def test_the_model_is_named_exactly_when_one_is_served(self):
         cases = (
-            (["web-app-mattermost"], "", ()),
-            (["web-app-mattermost"], "sk-test", ()),
-            (["svc-ai-lmstudio"], "", ()),
-            (["svc-ai-ollama"], "", ("llama3.2",)),
+            (["web-app-mattermost"], "", (), ()),
+            (["web-app-mattermost"], "sk-test", (), ()),
+            (["svc-ai-lmstudio"], "", (), ()),
+            (["svc-ai-lmstudio"], "", (), ("qwen2.5:0.5b",)),
+            (["svc-ai-ollama"], "", ("llama3.2",), ()),
         )
-        for roles, api_key, preload in cases:
-            with self.subTest(roles=roles, api_key=bool(api_key)):
+        for roles, api_key, preload, lmstudio in cases:
+            with self.subTest(roles=roles, api_key=bool(api_key), lmstudio=lmstudio):
                 model, served = self._both(
-                    roles=roles, api_key=api_key, preload_models=preload
+                    roles=roles,
+                    api_key=api_key,
+                    preload_models=preload,
+                    lmstudio_models=lmstudio,
                 )
                 self.assertEqual(bool(model), served == "True")
 
diff --git a/tests/unit/python/plugins/action/test_applications_carrier.py b/tests/unit/python/plugins/action/test_applications_carrier.py
index 5e80413bbb..841b2eea44 100644
--- a/tests/unit/python/plugins/action/test_applications_carrier.py
+++ b/tests/unit/python/plugins/action/test_applications_carrier.py
@@ -68,6 +68,46 @@ class TestApplicationsCarrierActionPlugin(unittest.TestCase):
         ):
             action.run(task_vars={})
 
+    def test_clear_drops_the_fact_without_rendering(self):
+        lookup = _FakeLookup({"key": ["roles", []], "applications": {}})
+        action = _make_action(_FakeTask(args={"clear": True}))
+        with (
+            patch(
+                "plugins.action.applications_carrier.ActionBase.run",
+                autospec=True,
+                return_value={},
+            ),
+            patch(
+                "plugins.action.applications_carrier.lookup_loader.get",
+                return_value=lookup,
+            ),
+        ):
+            result = action.run(task_vars={"applications": {}})
+
+        self.assertIsNone(result["ansible_facts"][APPLICATIONS_RENDERED_FACT])
+        self.assertFalse(result["changed"])
+        self.assertEqual(lookup.calls, [])
+
+    def test_clear_false_still_renders(self):
+        carrier = {"key": ["roles", ["a", "b", "c", "d"]], "applications": {"x": {}}}
+        lookup = _FakeLookup(carrier)
+        action = _make_action(_FakeTask(args={"clear": "no"}))
+        with (
+            patch(
+                "plugins.action.applications_carrier.ActionBase.run",
+                autospec=True,
+                return_value={},
+            ),
+            patch(
+                "plugins.action.applications_carrier.lookup_loader.get",
+                return_value=lookup,
+            ),
+        ):
+            result = action.run(task_vars={"applications": {}})
+
+        self.assertIs(result["ansible_facts"][APPLICATIONS_RENDERED_FACT], carrier)
+        self.assertEqual(len(lookup.calls), 1)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/unit/python/plugins/filter/test_redirect_sources.py b/tests/unit/python/plugins/filter/test_redirect_sources.py
new file mode 100644
index 0000000000..d0aaa7d712
--- /dev/null
+++ b/tests/unit/python/plugins/filter/test_redirect_sources.py
@@ -0,0 +1,74 @@
+import sys
+import unittest
+
+from . import PROJECT_ROOT
+
+if str(PROJECT_ROOT) not in sys.path:
+    sys.path.insert(0, str(PROJECT_ROOT))
+
+from ansible.errors import AnsibleFilterError
+
+from plugins.filter.redirect_sources import FilterModule, redirect_sources
+
+
+class TestRedirectSources(unittest.TestCase):
+    def test_every_reference_form_is_covered(self):
+        self.assertEqual(
+            redirect_sources("unpkg.com"),
+            [
+                "https://unpkg.com/",
+                "http://unpkg.com/",
+                "/",
+            ],
+        )
+
+    def test_the_catch_all_comes_last(self):
+        sources = redirect_sources("unpkg.com")
+
+        self.assertEqual(
+            sources[-1],
+            "/",
+            "the bare slash is the widest form and reads as the fallback only "
+            "while it stays at the end",
+        )
+
+    def test_no_form_is_a_prefix_of_another(self):
+        sources = redirect_sources("unpkg.com")
+
+        for index, source in enumerate(sources):
+            for other in sources[:index]:
+                self.assertFalse(
+                    source.startswith(other),
+                    f"{source!r} starts with {other!r}, so the two forms "
+                    f"cannot be told apart by a prefix comparison",
+                )
+
+    def test_surrounding_whitespace_is_dropped(self):
+        self.assertEqual(redirect_sources("  unpkg.com  ")[0], "https://unpkg.com/")
+
+    def test_the_host_is_not_otherwise_rewritten(self):
+        self.assertEqual(
+            redirect_sources("CDN.Example.COM")[1], "http://CDN.Example.COM/"
+        )
+
+    def test_a_subdomain_host_keeps_every_label(self):
+        self.assertEqual(
+            redirect_sources("cdn.jsdelivr.net")[0], "https://cdn.jsdelivr.net/"
+        )
+
+    def test_an_empty_host_is_rejected(self):
+        for value in ("", "   "):
+            with self.assertRaises(AnsibleFilterError):
+                redirect_sources(value)
+
+    def test_a_non_string_host_is_rejected(self):
+        for value in (None, 42, ["unpkg.com"]):
+            with self.assertRaises(AnsibleFilterError):
+                redirect_sources(value)
+
+    def test_the_filter_is_exported(self):
+        self.assertIs(FilterModule().filters()["redirect_sources"], redirect_sources)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/plugins/lookup/test_alert_rule_roles.py b/tests/unit/python/plugins/lookup/test_alert_rule_roles.py
index 7de5d73d55..09953d117e 100644
--- a/tests/unit/python/plugins/lookup/test_alert_rule_roles.py
+++ b/tests/unit/python/plugins/lookup/test_alert_rule_roles.py
@@ -1,13 +1,20 @@
 """Unit tests for plugins/lookup/alert_rule_roles.py.
 
 Mocks the Ansible-side machinery and asserts the plugin returns exactly the
-deployed roles that ship a ``templates/prometheus/alert_rules.yml.j2``.
+scraped roles that ship a ``templates/prometheus/alert_rules.yml.j2``.
+
+Activation is delegated to ``native_metrics_apps`` rather than re-derived here,
+so these tests stub that lookup and assert the intersection. A role that is
+deployed but not scraped must not contribute rules: its alert would fire on
+``absent()`` forever.
 """
 
 from __future__ import annotations
 
+import tempfile
 import unittest
 import unittest.mock as mock
+from pathlib import Path
 
 import plugins.lookup.alert_rule_roles as module
 from plugins.lookup.alert_rule_roles import LookupModule
@@ -39,19 +46,26 @@ def _seed_roles(tmp_path, roles_with_template, roles_without_template=()):
 
 class TestAlertRuleRolesLookup(unittest.TestCase):
     def setUp(self):
-        self._tmp = mock.patch.object(module, "ROLES_DIR")
-        self.roles_dir = self._tmp.start()
-        self.addCleanup(self._tmp.stop)
+        self._roles_dir = mock.patch.object(module, "ROLES_DIR")
+        self.roles_dir = self._roles_dir.start()
+        self.addCleanup(self._roles_dir.stop)
+
+    def _patch_scraped(self, scraped):
+        """Stand in for the native_metrics_apps lookup."""
+        inner = mock.MagicMock()
+        inner.run.return_value = [list(scraped)]
+        loader = mock.patch.object(module, "lookup_loader")
+        started = loader.start()
+        started.get.return_value = inner
+        self.addCleanup(loader.stop)
 
     def test_raises_when_positional_terms_supplied(self):
+        self._patch_scraped([])
         lm = _make_lookup({"group_names": []})
         with self.assertRaises(ValueError):
             lm.run(["unexpected"], variables=lm._templar.available_variables)
 
-    def test_returns_only_deployed_roles_that_ship_a_template(self):
-        import tempfile
-        from pathlib import Path
-
+    def test_returns_only_scraped_roles_that_ship_a_template(self):
         with tempfile.TemporaryDirectory() as td:
             tmp_path = Path(td)
             _seed_roles(
@@ -60,35 +74,40 @@ class TestAlertRuleRolesLookup(unittest.TestCase):
                 roles_without_template=["web-app-matomo"],
             )
             module.ROLES_DIR = tmp_path
+            self._patch_scraped(["web-app-matomo", "web-app-openbao"])
 
-            vars_ = {
-                "group_names": [
-                    "web-app-matomo",
-                    "web-app-openbao",
-                    "web-app-never-deployed",
-                ]
-            }
-            lm = _make_lookup(vars_)
-            self.assertEqual(lm.run([], variables=vars_), [["web-app-openbao"]])
+            lm = _make_lookup({})
+            self.assertEqual(lm.run([], variables={}), [["web-app-openbao"]])
+
+    def test_a_deployed_role_that_is_not_scraped_contributes_no_rules(self):
+        """The whole point of moving the filter out of the fragments.
+
+        svc-db-postgres ships a template here but native_metrics_apps does not
+        list it, so its rules must not reach the file.
+        """
+        with tempfile.TemporaryDirectory() as td:
+            tmp_path = Path(td)
+            _seed_roles(tmp_path, roles_with_template=["svc-db-postgres"])
+            module.ROLES_DIR = tmp_path
+            self._patch_scraped([])
+
+            lm = _make_lookup({})
+            self.assertEqual(lm.run([], variables={}), [[]])
 
     def test_result_is_sorted_and_deduplicated(self):
-        import tempfile
-        from pathlib import Path
-
         with tempfile.TemporaryDirectory() as td:
             tmp_path = Path(td)
             _seed_roles(tmp_path, roles_with_template=["b-role", "a-role"])
             module.ROLES_DIR = tmp_path
+            self._patch_scraped(["b-role", "a-role", "b-role"])
 
-            vars_ = {"group_names": ["b-role", "a-role", "b-role"]}
-            lm = _make_lookup(vars_)
-            self.assertEqual(lm.run([], variables=vars_), [["a-role", "b-role"]])
-
-    def test_returns_empty_list_without_group_names(self):
-        import tempfile
-        from pathlib import Path
+            lm = _make_lookup({})
+            self.assertEqual(lm.run([], variables={}), [["a-role", "b-role"]])
 
+    def test_returns_empty_list_when_nothing_is_scraped(self):
         with tempfile.TemporaryDirectory() as td:
             module.ROLES_DIR = Path(td)
+            self._patch_scraped([])
+
             lm = _make_lookup({})
             self.assertEqual(lm.run([], variables={}), [[]])
diff --git a/tests/unit/python/plugins/lookup/test_api.py b/tests/unit/python/plugins/lookup/test_api.py
index eaa1ecedbb..f9dc81bb27 100644
--- a/tests/unit/python/plugins/lookup/test_api.py
+++ b/tests/unit/python/plugins/lookup/test_api.py
@@ -90,9 +90,19 @@ class TestApiLookup(unittest.TestCase):
             self.lookup.run(["cloudflare.api_token"], variables={"API": "nope"})
         self.assertIn("mapping", str(ctx.exception))
 
-    def test_missing_api_global_raises_unknown_key(self):
+    def test_missing_api_global_falls_back_to_the_declaration(self):
+        self.assertEqual(self.lookup.run(["cloudflare.api_token"], variables={})[0], "")
+
+    def test_a_provider_the_scope_omits_still_resolves(self):
+        out = self.lookup.run(
+            ["github.client_id"],
+            variables={"API": {"cloudflare": {"api_token": "cf"}}},
+        )
+        self.assertEqual(out, [""])
+
+    def test_an_undeclared_provider_still_raises(self):
         with self.assertRaises(AnsibleError):
-            self.lookup.run(["cloudflare.api_token"], variables={})
+            self.lookup.run(["nope.api_key"], variables=self.vars)
 
     def test_templar_resolves_jinja_values(self):
         self.lookup._templar = _FakeTemplar(mapping={"{{ vault_cf }}": "secret-cf"})
diff --git a/tests/unit/python/plugins/lookup/test_container_ports.py b/tests/unit/python/plugins/lookup/test_container_ports.py
index cf854230f9..385946855a 100644
--- a/tests/unit/python/plugins/lookup/test_container_ports.py
+++ b/tests/unit/python/plugins/lookup/test_container_ports.py
@@ -119,5 +119,133 @@ class TestContainerPortsLookup(unittest.TestCase):
         self.assertEqual(out, ['ports:\n  - "10.0.0.1:8002:3000"'])
 
 
+def _edge_apps():
+    return {
+        "web-svc-coturn": {
+            "services": {
+                "coturn": {
+                    "ports": {
+                        "public": {
+                            "stun_turn": 3481,
+                            "relay": {"start": 20000, "end": 39999},
+                        }
+                    }
+                },
+                "openresty": {
+                    "ports": {
+                        "internal": {"http": 80},
+                        "public": {"http": 80},
+                    }
+                },
+                "api": {"ports": {"internal": {"http": 5000}}},
+            }
+        }
+    }
+
+
+def _run_edge(terms):
+    lookup = LookupModule()
+    lookup._loader = mock.MagicMock()
+    apps = _edge_apps()
+    with patch("plugins.lookup.container_ports.lookup_loader") as loader_mock:
+        loader_mock.get.return_value = mock.MagicMock(run=lambda *_a, **_k: [apps])
+        return lookup.run(terms, variables={"application_id": "web-svc-coturn"})[0]
+
+
+class TestContainerPortsDictTerms(unittest.TestCase):
+    def test_one_list_item_per_transport(self):
+        out = _run_edge(
+            [
+                {
+                    "service": "coturn",
+                    "protocol": "stun_turn",
+                    "transport": ["udp", "tcp"],
+                    "container": "same",
+                }
+            ]
+        )
+        self.assertEqual(out, 'ports:\n  - "3481:3481/udp"\n  - "3481:3481/tcp"')
+
+    def test_a_range_renders_on_both_sides(self):
+        out = _run_edge(
+            [
+                {
+                    "service": "coturn",
+                    "protocol": "relay",
+                    "transport": "udp",
+                    "container": "same",
+                }
+            ]
+        )
+        self.assertEqual(out, 'ports:\n  - "20000-39999:20000-39999/udp"')
+
+    def test_host_mode_emits_the_long_block(self):
+        out = _run_edge([{"service": "openresty", "protocol": "http", "mode": "host"}])
+        self.assertEqual(
+            out,
+            "ports:\n  - target: 80\n    published: 80\n"
+            "    protocol: tcp\n    mode: host",
+        )
+
+    def test_ephemeral_publishes_only_the_container_port(self):
+        out = _run_edge(
+            [{"service": "api", "protocol": "http", "publish": "ephemeral"}]
+        )
+        self.assertEqual(out, 'ports:\n  - "5000"')
+
+    def test_host_mode_rejects_an_ip(self):
+        with self.assertRaises(AnsibleError):
+            _run_edge(
+                [
+                    {
+                        "service": "openresty",
+                        "protocol": "http",
+                        "mode": "host",
+                        "ip": "10.0.0.1",
+                    }
+                ]
+            )
+
+    def test_an_unknown_term_key_is_rejected(self):
+        with self.assertRaises(AnsibleError):
+            _run_edge([{"service": "openresty", "protocol": "http", "protokol": "tcp"}])
+
+    def test_key_names_the_block(self):
+        lookup = LookupModule()
+        lookup._loader = mock.MagicMock()
+        with patch("plugins.lookup.container_ports.lookup_loader") as loader_mock:
+            loader_mock.get.return_value = mock.MagicMock(
+                run=lambda *_a, **_k: [_edge_apps()]
+            )
+            out = lookup.run(
+                [["openresty", "http"]],
+                variables={"application_id": "web-svc-coturn"},
+                key="expose",
+            )
+        self.assertEqual(out, ['expose:\n  - "80:80"'])
+
+    def test_an_unknown_block_key_is_rejected(self):
+        lookup = LookupModule()
+        lookup._loader = mock.MagicMock()
+        with (
+            patch("plugins.lookup.container_ports.lookup_loader") as loader_mock,
+            self.assertRaises(AnsibleError),
+        ):
+            loader_mock.get.return_value = mock.MagicMock(
+                run=lambda *_a, **_k: [_edge_apps()]
+            )
+            lookup.run(
+                [["openresty", "http"]],
+                variables={"application_id": "web-svc-coturn"},
+                key="publish",
+            )
+
+    def test_an_unknown_transport_is_rejected(self):
+        with self.assertRaises(AnsibleError):
+            _run_edge(
+                [{"service": "openresty", "protocol": "http", "transport": "sctp"}]
+            )
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/unit/python/plugins/lookup/test_sso_oidc_plugin.py b/tests/unit/python/plugins/lookup/test_sso_oidc_plugin.py
index 8f6dc8c580..af94622a39 100644
--- a/tests/unit/python/plugins/lookup/test_sso_oidc_plugin.py
+++ b/tests/unit/python/plugins/lookup/test_sso_oidc_plugin.py
@@ -66,9 +66,28 @@ class OidcFlavorLookupTests(unittest.TestCase):
         self._patcher = mock.patch.object(self.mod, "lookup_loader")
         self._loader_mock = self._patcher.start()
         self._stub_payload = None
-        self._loader_mock.get.return_value = mock.MagicMock(
-            run=lambda *_a, **_k: [self._stub_payload]
-        )
+        self._loader_mock.get.side_effect = self._stub_lookup
+
+    def _stub_lookup(self, name, *_args, **_kwargs):
+        """Stand in for the lookups the plugin consumes.
+
+        ``config`` resolves a dotted path against the payload the way
+        ``lookup('config', app, path, default)`` does with a default supplied;
+        anything else answers with the payload itself.
+        """
+        if name == "config":
+            return mock.MagicMock(
+                run=lambda terms, **_kw: [self._stub_config(*terms)],
+            )
+        return mock.MagicMock(run=lambda *_a, **_kw: [self._stub_payload])
+
+    def _stub_config(self, application_id, config_path, default=None):
+        node = (self._stub_payload or {}).get(application_id)
+        for part in str(config_path).split("."):
+            if not isinstance(node, dict) or part not in node:
+                return default
+            node = node[part]
+        return node
 
     def tearDown(self):
         self._patcher.stop()
diff --git a/tests/unit/python/plugins/lookup/test_tor_ports.py b/tests/unit/python/plugins/lookup/test_tor_ports.py
index 5be68ffe0a..67b7a5ad72 100644
--- a/tests/unit/python/plugins/lookup/test_tor_ports.py
+++ b/tests/unit/python/plugins/lookup/test_tor_ports.py
@@ -9,7 +9,7 @@ from ansible.errors import AnsibleError
 from plugins.lookup.tor_ports import (
     LookupModule,
     collect_exposed_ports,
-    collect_public_ports,
+    collect_onion_ports,
 )
 from utils.cache import _reset_cache_for_tests
 from utils.cache.yaml import dump_yaml_str
@@ -33,7 +33,15 @@ class TestTorPortsLookup(unittest.TestCase):
         _write_services(
             self.roles_dir,
             "web-app-gitea",
-            {"gitea": {"ports": {"public": {"ssh": 2201}, "local": {"http": 8002}}}},
+            {
+                "gitea": {
+                    "ports": {
+                        "public": {"ssh": 2201},
+                        "local": {"http": 8002},
+                        "onion": {"ssh": True},
+                    }
+                }
+            },
         )
         _write_services(
             self.roles_dir,
@@ -68,40 +76,159 @@ class TestTorPortsLookup(unittest.TestCase):
         _reset_cache_for_tests()
         self._tmpdir.cleanup()
 
-    def test_collects_public_single_ints_sorted(self) -> None:
-        ports = collect_public_ports(
-            ["web-app-gitea", "svc-db-openldap"], self.roles_dir
+    @staticmethod
+    def _apps(**roles: dict) -> dict:
+        """The variant-merged applications view for the given roles.
+
+        Every entity keeps its own ``ports``; the top-level ``tor:`` block of
+        ``meta/services.yml`` merges in as one more entity alongside them.
+        """
+        return {role: {"services": dict(entities)} for role, entities in roles.items()}
+
+    def test_only_named_categories_are_forwarded_sorted(self) -> None:
+        apps = self._apps(
+            **{
+                "web-app-gitea": {
+                    "gitea": {
+                        "ports": {"public": {"ssh": 2201}, "onion": {"ssh": True}}
+                    }
+                },
+                "web-app-mailu": {
+                    "mailu": {
+                        "ports": {
+                            "public": {"smtp": 25, "smtps": 465, "imap": 143},
+                            "onion": {"smtp": True},
+                        }
+                    }
+                },
+            }
         )
-        self.assertEqual(ports, [636, 2201])
 
-    def test_relay_ranges_excluded(self) -> None:
-        ports = collect_public_ports(["web-svc-coturn"], self.roles_dir)
-        self.assertEqual(ports, [3481, 5351])
+        ports = collect_onion_ports(apps, ["web-app-gitea", "web-app-mailu"])
 
-    def test_media_category_excluded(self) -> None:
-        _write_services(
-            self.roles_dir,
-            "web-app-jitsi",
-            {"jitsi": {"ports": {"public": {"media": 10000}, "local": {"http": 8084}}}},
+        self.assertEqual(ports, [25, 2201])
+
+    def test_local_wins_over_public_for_the_same_category(self) -> None:
+        """``container_ports`` publishes the local port when the category has
+        one, so the forward must target that and not the public alias."""
+        apps = self._apps(
+            **{
+                "web-app-x": {
+                    "x": {
+                        "ports": {
+                            "local": {"http": 8080},
+                            "public": {"http": 80},
+                            "onion": {"http": True},
+                        }
+                    }
+                }
+            }
         )
-        self.assertEqual(collect_public_ports(["web-app-jitsi"], self.roles_dir), [])
 
-    def test_roles_without_public_ports_yield_nothing(self) -> None:
-        self.assertEqual(collect_public_ports(["web-app-hugo"], self.roles_dir), [])
+        self.assertEqual(collect_onion_ports(apps, ["web-app-x"]), [8080])
 
-    def test_tor_disabled_role_excluded(self) -> None:
-        _write_services(
-            self.roles_dir,
-            "web-app-optout",
-            {
-                "optout": {"ports": {"public": {"ssh": 2299}}},
-                "tor": {"enabled": False},
-            },
+    def test_a_falsy_or_unrendered_flag_forwards_nothing(self) -> None:
+        """The input must be the rendered view: template text left in the flag
+        is not quietly read as enabled."""
+        apps = self._apps(
+            **{
+                "web-app-a": {
+                    "a": {"ports": {"public": {"ssh": 22}, "onion": {"ssh": False}}}
+                },
+                "web-app-b": {
+                    "b": {
+                        "ports": {
+                            "public": {"ssh": 23},
+                            "onion": {"ssh": "{{ 'svc-net-tor' in group_names }}"},
+                        }
+                    }
+                },
+            }
         )
-        self.assertEqual(collect_public_ports(["web-app-optout"], self.roles_dir), [])
 
-    def test_unknown_role_ignored(self) -> None:
-        self.assertEqual(collect_public_ports(["web-app-nope"], self.roles_dir), [])
+        self.assertEqual(collect_onion_ports(apps, ["web-app-a", "web-app-b"]), [])
+
+    def test_udp_only_categories_are_never_forwarded(self) -> None:
+        apps = self._apps(
+            **{
+                "web-svc-coturn": {
+                    "coturn": {
+                        "ports": {
+                            "public": {
+                                "media": 10000,
+                                "stun_turn": 3481,
+                                "stun_turn_tls": 5351,
+                                "ssh": 2299,
+                                "relay": {"start": 20000, "end": 39999},
+                            },
+                            "onion": {
+                                "media": True,
+                                "relay": True,
+                                "stun_turn": True,
+                                "stun_turn_tls": True,
+                                "ssh": True,
+                            },
+                        }
+                    }
+                }
+            }
+        )
+
+        self.assertEqual(collect_onion_ports(apps, ["web-svc-coturn"]), [2299])
+
+    def test_a_category_with_no_declared_port_is_skipped(self) -> None:
+        apps = self._apps(
+            **{
+                "web-app-x": {
+                    "x": {"ports": {"public": {"ssh": 2201}, "onion": {"typo": True}}}
+                }
+            }
+        )
+
+        self.assertEqual(collect_onion_ports(apps, ["web-app-x"]), [])
+
+    def test_a_role_without_an_onion_block_forwards_nothing(self) -> None:
+        apps = self._apps(
+            **{"web-app-hugo": {"hugo": {"ports": {"local": {"http": 8008}}}}}
+        )
+
+        self.assertEqual(collect_onion_ports(apps, ["web-app-hugo"]), [])
+
+    def test_the_port_flag_is_the_gate_not_the_tor_flag(self) -> None:
+        """``services.tor.enabled`` is the dependency edge onto svc-net-tor, not
+        the port forward; ``ports.onion`` alone decides what gets a
+        HiddenServicePort."""
+        apps = self._apps(
+            **{
+                "web-app-gitea": {
+                    "tor": {"enabled": False},
+                    "gitea": {
+                        "ports": {"public": {"ssh": 2201}, "onion": {"ssh": True}}
+                    },
+                }
+            }
+        )
+
+        self.assertEqual(collect_onion_ports(apps, ["web-app-gitea"]), [2201])
+
+    def test_role_outside_the_deploy_is_ignored(self) -> None:
+        apps = self._apps(
+            **{
+                "web-app-gitea": {
+                    "gitea": {
+                        "ports": {"public": {"ssh": 2201}, "onion": {"ssh": True}}
+                    }
+                }
+            }
+        )
+
+        self.assertEqual(collect_onion_ports(apps, ["web-app-nope"]), [])
+
+    def test_collect_onion_ports_ignores_non_mappings(self) -> None:
+        self.assertEqual(collect_onion_ports({}, ["a"]), [])
+        self.assertEqual(collect_onion_ports(None, ["a"]), [])
+        apps = {"a": {"services": {"s": {"ports": {"onion": True}}}}}
+        self.assertEqual(collect_onion_ports(apps, ["a"]), [])
 
     def test_collect_exposed_ports_gated_and_deployed(self) -> None:
         apps = {
@@ -151,6 +278,14 @@ class TestTorPortsLookup(unittest.TestCase):
         )[0]
         self.assertEqual(result, [{"onion_port": 2201, "target": "127.0.0.1:2201"}])
 
+    def test_run_forwards_nothing_without_an_onion_opt_in(self) -> None:
+        result = self.lookup.run(
+            [],
+            variables={"group_names": ["svc-db-openldap", "web-svc-coturn"]},
+            roles_dir=str(self.roles_dir),
+        )[0]
+        self.assertEqual(result, [])
+
     def test_empty_group_names(self) -> None:
         result = self.lookup.run([], variables={}, roles_dir=str(self.roles_dir))[0]
         self.assertEqual(result, [])
diff --git a/tests/unit/python/roles/svc-ai-litellm/files/test_probe_routing.py b/tests/unit/python/roles/svc-ai-litellm/files/test_probe_routing.py
new file mode 100644
index 0000000000..b2073361b1
--- /dev/null
+++ b/tests/unit/python/roles/svc-ai-litellm/files/test_probe_routing.py
@@ -0,0 +1,216 @@
+"""Unit tests for the svc-ai-litellm routing probe's verdict logic."""
+
+from __future__ import annotations
+
+import importlib.util
+import unittest
+
+from . import PROJECT_ROOT
+
+MODULE_PATH = PROJECT_ROOT / "roles/svc-ai-litellm/files/test/probe.py"
+
+spec = importlib.util.spec_from_file_location("litellm_probe", MODULE_PATH)
+probe = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(probe)
+
+ALIAS = "qwen2.5:0.5b"
+LMSTUDIO_ONLY = "mistral:latest"
+
+
+def verdict(**overrides) -> list[str]:
+    kwargs = {
+        "served": set(),
+        "expected": [],
+        "chat_model": "",
+        "chat_model_served": False,
+        "ollama_enabled": False,
+        "lmstudio_enabled": False,
+        "lmstudio_aliases": [LMSTUDIO_ONLY],
+        "remote_aliases": [],
+    }
+    kwargs.update(overrides)
+    return probe.evaluate(**kwargs)
+
+
+class TestOllamaOnlyDeployment(unittest.TestCase):
+    """svc-ai-ollama deployed, svc-ai-lmstudio not — variant 0."""
+
+    def test_a_consistent_gateway_passes(self) -> None:
+        self.assertEqual(
+            verdict(
+                served={ALIAS},
+                expected=[ALIAS],
+                chat_model=ALIAS,
+                chat_model_served=True,
+                ollama_enabled=True,
+            ),
+            [],
+        )
+
+    def test_an_lmstudio_alias_without_its_backend_fails(self) -> None:
+        failures = verdict(
+            served={ALIAS, LMSTUDIO_ONLY},
+            expected=[ALIAS],
+            chat_model=ALIAS,
+            chat_model_served=True,
+            ollama_enabled=True,
+        )
+        self.assertEqual(len(failures), 1)
+        self.assertIn("svc-ai-lmstudio is not deployed", failures[0])
+
+    def test_a_declared_model_the_gateway_dropped_fails(self) -> None:
+        failures = verdict(
+            served=set(),
+            expected=[ALIAS],
+            chat_model=ALIAS,
+            chat_model_served=True,
+            ollama_enabled=True,
+        )
+        self.assertTrue(
+            any("does not serve" in failure for failure in failures), failures
+        )
+
+    def test_the_model_consumers_ask_for_must_be_routable(self) -> None:
+        failures = verdict(
+            served={ALIAS},
+            expected=[ALIAS],
+            chat_model="llama3:latest",
+            chat_model_served=True,
+            ollama_enabled=True,
+        )
+        self.assertEqual(len(failures), 1)
+        self.assertIn("llama3:latest", failures[0])
+
+
+class TestLmstudioOnlyDeployment(unittest.TestCase):
+    """svc-ai-lmstudio deployed, svc-ai-ollama not — variant 2."""
+
+    def test_the_same_alias_ollama_would_serve_passes(self) -> None:
+        self.assertEqual(
+            verdict(
+                served={ALIAS},
+                expected=[ALIAS],
+                chat_model=ALIAS,
+                chat_model_served=True,
+                lmstudio_enabled=True,
+                lmstudio_aliases=[ALIAS],
+            ),
+            [],
+        )
+
+    def test_a_declared_alias_the_gateway_never_routed_fails(self) -> None:
+        failures = verdict(
+            served=set(),
+            expected=[ALIAS],
+            chat_model=ALIAS,
+            chat_model_served=True,
+            lmstudio_enabled=True,
+            lmstudio_aliases=[ALIAS],
+        )
+        self.assertTrue(
+            any("declared and not routed" in failure for failure in failures), failures
+        )
+
+    def test_an_ollama_model_without_its_backend_fails(self) -> None:
+        failures = verdict(
+            served={ALIAS, "llama3:latest"},
+            expected=[ALIAS],
+            chat_model=ALIAS,
+            chat_model_served=True,
+            lmstudio_enabled=True,
+            lmstudio_aliases=[ALIAS],
+        )
+        self.assertTrue(
+            any("svc-ai-ollama is not deployed" in failure for failure in failures),
+            failures,
+        )
+
+
+class TestBothBackendsDeployment(unittest.TestCase):
+    """Variant 0 plus lmstudio: a shared alias proves nothing about lmstudio."""
+
+    def test_only_the_exclusive_alias_is_demanded(self) -> None:
+        self.assertEqual(
+            verdict(
+                served={ALIAS, LMSTUDIO_ONLY},
+                expected=[ALIAS, LMSTUDIO_ONLY],
+                chat_model=ALIAS,
+                chat_model_served=True,
+                ollama_enabled=True,
+                lmstudio_enabled=True,
+            ),
+            [],
+        )
+
+    def test_a_missing_exclusive_alias_still_fails(self) -> None:
+        failures = verdict(
+            served={ALIAS},
+            expected=[ALIAS],
+            chat_model=ALIAS,
+            chat_model_served=True,
+            ollama_enabled=True,
+            lmstudio_enabled=True,
+        )
+        self.assertTrue(
+            any("declared and not routed" in failure for failure in failures), failures
+        )
+
+
+class TestRemoteProviders(unittest.TestCase):
+    """A configured provider key publishes its alias and serves the gateway."""
+
+    def test_a_keyed_provider_is_the_only_backend_needed(self) -> None:
+        self.assertEqual(
+            verdict(
+                served={"openai/gpt-4o-mini"},
+                expected=["openai/gpt-4o-mini"],
+                chat_model="openai/gpt-4o-mini",
+                chat_model_served=True,
+                remote_aliases=["openai/gpt-4o-mini"],
+            ),
+            [],
+        )
+
+    def test_a_remote_alias_is_not_mistaken_for_an_ollama_model(self) -> None:
+        self.assertEqual(
+            verdict(
+                served={"anthropic/claude-sonnet-4-5", ALIAS},
+                expected=["anthropic/claude-sonnet-4-5", ALIAS],
+                chat_model=ALIAS,
+                chat_model_served=True,
+                lmstudio_enabled=True,
+                lmstudio_aliases=[ALIAS],
+                remote_aliases=["anthropic/claude-sonnet-4-5"],
+            ),
+            [],
+        )
+
+    def test_a_declared_provider_the_gateway_dropped_fails(self) -> None:
+        failures = verdict(
+            served=set(),
+            expected=["openrouter/auto"],
+            chat_model="openrouter/auto",
+            chat_model_served=True,
+            remote_aliases=["openrouter/auto"],
+        )
+        self.assertTrue(
+            any("does not serve" in failure for failure in failures), failures
+        )
+
+
+class TestNoBackendDeployment(unittest.TestCase):
+    def test_an_empty_gateway_passes(self) -> None:
+        self.assertEqual(verdict(), [])
+
+    def test_any_published_model_fails(self) -> None:
+        failures = verdict(served={"openrouter/auto"})
+        self.assertTrue(
+            any("no backend is deployed" in failure for failure in failures), failures
+        )
+
+    def test_the_chat_model_is_not_demanded_when_nothing_serves_it(self) -> None:
+        self.assertEqual(verdict(chat_model=ALIAS), [])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/svc-ai-litellm/templates/__init__.py b/tests/unit/python/roles/svc-ai-litellm/templates/__init__.py
new file mode 100644
index 0000000000..9f69c70b47
--- /dev/null
+++ b/tests/unit/python/roles/svc-ai-litellm/templates/__init__.py
@@ -0,0 +1,3 @@
+from pathlib import Path
+
+PROJECT_ROOT: Path = Path(__file__).resolve().parents[6]
diff --git a/tests/unit/python/roles/svc-ai-litellm/templates/test_config_model_list.py b/tests/unit/python/roles/svc-ai-litellm/templates/test_config_model_list.py
new file mode 100644
index 0000000000..e1728d0e72
--- /dev/null
+++ b/tests/unit/python/roles/svc-ai-litellm/templates/test_config_model_list.py
@@ -0,0 +1,169 @@
+"""The gateway config publishes one alias per model, whichever backend serves it.
+
+``config.yaml.j2`` is where the two local backends meet: Ollama pulls a model
+under the alias and LM Studio under its own hub name, and both must surface to
+consumers as the same ``model_name``. A wrong accessor or a missing de-duplicate
+condition does not fail the render, it publishes a route nothing answers, so the
+template is rendered here rather than read.
+"""
+
+from __future__ import annotations
+
+import unittest
+
+import yaml
+from jinja2 import Environment, StrictUndefined
+
+from utils.cache.files import read_text
+
+from . import PROJECT_ROOT
+
+TEMPLATE = PROJECT_ROOT / "roles/svc-ai-litellm/templates/config.yaml.j2"
+
+SHARED = {"alias": "qwen2.5:0.5b", "name": "qwen2.5-0.5b-instruct"}
+OLLAMA_ONLY = {"alias": "llama3:latest", "name": "llama-3.2-3b-instruct"}
+LMSTUDIO_ONLY = {"alias": "mistral:latest", "name": "mistral-7b-instruct-v0.3"}
+
+OLLAMA_URL = "http://ollama:11434"
+LMSTUDIO_URL = "http://lmstudio:1234"
+
+
+def _ansible_bool(value):
+    if isinstance(value, str):
+        return value.strip().lower() in ("true", "yes", "on", "1")
+    return bool(value)
+
+
+def _stub_lookup(ollama_models, lmstudio_models):
+    def lookup(kind, role, path, *args):
+        if (kind, path) == ("config", "services.ollama.preload_models"):
+            return ollama_models
+        if (kind, path) == ("config", "services.lmstudio.preload_models"):
+            return lmstudio_models
+        raise AssertionError(f"unexpected lookup({kind!r}, {role!r}, {path!r})")
+
+    return lookup
+
+
+REMOTE_BACKENDS = (
+    ("openai/gpt-4o-mini", "openai/gpt-4o-mini", "OPENAI_API_KEY"),
+    ("anthropic/claude-sonnet-4-5", "anthropic/claude-sonnet-4-5", "ANTHROPIC_API_KEY"),
+    ("openrouter/auto", "openrouter/openrouter/auto", "OPENROUTER_API_KEY"),
+)
+
+
+def _remote(keys):
+    """The LITELLM_REMOTE_BACKENDS list vars/main.yml builds, with these keys.
+
+    Args:
+        keys: env-name -> key value; a provider absent from it stays unkeyed.
+    """
+    return [
+        {"alias": alias, "model": model, "env": env, "key": keys.get(env, "")}
+        for alias, model, env in REMOTE_BACKENDS
+    ]
+
+
+def render(*, ollama=(), lmstudio=(), keys=None):
+    """The rendered config as a parsed mapping.
+
+    Args:
+        ollama: preload entries svc-ai-ollama declares; empty means not deployed.
+        lmstudio: preload entries svc-ai-lmstudio declares; empty means not deployed.
+        keys: env-name -> provider key for the remote backends.
+    """
+    env = Environment(undefined=StrictUndefined, autoescape=False)  # noqa: S701 - YAML, not markup
+    env.filters["bool"] = _ansible_bool
+    rendered = env.from_string(read_text(str(TEMPLATE))).render(
+        LITELLM_OLLAMA_BACKEND=str(bool(ollama)),
+        LITELLM_LMSTUDIO_BACKEND=str(bool(lmstudio)),
+        lookup=_stub_lookup(list(ollama), list(lmstudio)),
+        OLLAMA_BASE_LOCAL_URL=OLLAMA_URL,
+        LMSTUDIO_BASE_LOCAL_URL=LMSTUDIO_URL,
+        LITELLM_MAX_OUTPUT_TOKENS=512,
+        LITELLM_UPSTREAM_TIMEOUT=60,
+        LITELLM_REMOTE_BACKENDS=_remote(keys or {}),
+    )
+    return yaml.safe_load(
+        rendered
+    )  # nocheck: direct-yaml - parses this test's own render
+
+
+def routes(config) -> dict:
+    return {
+        entry["model_name"]: entry["litellm_params"]
+        for entry in (config.get("model_list") or [])
+    }
+
+
+class TestOllamaOnly(unittest.TestCase):
+    def test_every_alias_is_published_against_the_ollama_backend(self) -> None:
+        published = routes(render(ollama=[SHARED, OLLAMA_ONLY]))
+        self.assertEqual(set(published), {SHARED["alias"], OLLAMA_ONLY["alias"]})
+        self.assertEqual(
+            published[SHARED["alias"]]["model"], f"ollama/{SHARED['alias']}"
+        )
+        self.assertEqual(published[SHARED["alias"]]["api_base"], OLLAMA_URL)
+
+
+class TestLmstudioOnly(unittest.TestCase):
+    def test_the_alias_is_published_against_the_lmstudio_name(self) -> None:
+        published = routes(render(lmstudio=[SHARED, LMSTUDIO_ONLY]))
+        self.assertEqual(set(published), {SHARED["alias"], LMSTUDIO_ONLY["alias"]})
+        self.assertEqual(
+            published[SHARED["alias"]]["model"], f"openai/{SHARED['name']}"
+        )
+        self.assertEqual(published[SHARED["alias"]]["api_base"], f"{LMSTUDIO_URL}/v1")
+
+    def test_an_alias_reaches_the_same_name_ollama_would_publish(self) -> None:
+        self.assertEqual(
+            set(routes(render(lmstudio=[SHARED]))),
+            set(routes(render(ollama=[SHARED]))),
+        )
+
+
+class TestBothBackends(unittest.TestCase):
+    def test_a_shared_alias_is_published_once_and_routed_to_ollama(self) -> None:
+        published = routes(
+            render(ollama=[SHARED, OLLAMA_ONLY], lmstudio=[SHARED, LMSTUDIO_ONLY])
+        )
+        self.assertEqual(
+            set(published),
+            {SHARED["alias"], OLLAMA_ONLY["alias"], LMSTUDIO_ONLY["alias"]},
+        )
+        self.assertEqual(published[SHARED["alias"]]["api_base"], OLLAMA_URL)
+        self.assertEqual(
+            published[LMSTUDIO_ONLY["alias"]]["api_base"], f"{LMSTUDIO_URL}/v1"
+        )
+
+
+class TestNoBackend(unittest.TestCase):
+    def test_the_model_list_is_empty(self) -> None:
+        self.assertEqual(render()["model_list"], [])
+
+    def test_one_provider_key_alone_publishes_its_route(self) -> None:
+        published = routes(render(keys={"OPENROUTER_API_KEY": "sk-or-test"}))
+        self.assertEqual(set(published), {"openrouter/auto"})
+        self.assertEqual(
+            published["openrouter/auto"]["api_key"], "os.environ/OPENROUTER_API_KEY"
+        )
+
+    def test_each_keyed_provider_gets_its_own_route(self) -> None:
+        published = routes(
+            render(
+                keys={
+                    "OPENAI_API_KEY": "sk-test",
+                    "ANTHROPIC_API_KEY": "sk-ant-test",
+                }
+            )
+        )
+        self.assertEqual(
+            set(published), {"openai/gpt-4o-mini", "anthropic/claude-sonnet-4-5"}
+        )
+
+    def test_an_unkeyed_provider_publishes_nothing(self) -> None:
+        self.assertEqual(render(keys={"OPENAI_API_KEY": ""})["model_list"], [])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/svc-net-firewall/__init__.py b/tests/unit/python/roles/svc-net-firewall/__init__.py
new file mode 100644
index 0000000000..8ee16d7567
--- /dev/null
+++ b/tests/unit/python/roles/svc-net-firewall/__init__.py
@@ -0,0 +1,3 @@
+from pathlib import Path
+
+PROJECT_ROOT: Path = Path(__file__).resolve().parents[5]
diff --git a/tests/unit/python/roles/svc-net-firewall/test_fragments.py b/tests/unit/python/roles/svc-net-firewall/test_fragments.py
new file mode 100644
index 0000000000..99152196b5
--- /dev/null
+++ b/tests/unit/python/roles/svc-net-firewall/test_fragments.py
@@ -0,0 +1,236 @@
+"""Every role's nftables fragment parses, and replaces its table instead of merging.
+
+``nft -f`` on ``table inet x { ... }`` MERGES into an existing table: a rule
+dropped from the declaration stays in the kernel, and the ruleset can only ever
+grow. The three-line idiom below is what makes a fragment a replacement:
+
+    table inet x          <- creates it when absent, so the delete cannot fail
+    delete table inet x   <- removes whatever the last deploy left
+    table inet x { ... }  <- the declaration, applied in the same transaction
+
+``nft -f`` is atomic, so the table is never observed empty. Without the first
+line the delete fails on a fresh host; without the second the fragment merges.
+
+The checks run the real ``nft`` over the rendered text, so a fragment that is
+valid Jinja but invalid nftables fails here rather than on the host. They render
+every deploy mode, because a fragment may branch on one, and feed plausible
+rather than real values: nft needs shapes, not this host's addresses.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import subprocess
+import tempfile
+import unittest
+from contextlib import contextmanager
+from functools import lru_cache
+from pathlib import Path
+
+import jinja2
+
+from utils.cache.files import iter_project_files, read_text
+from utils.cache.yaml import load_yaml_any
+from utils.roles.mapping import ROLE_FILE_VARS_MAIN
+
+from . import PROJECT_ROOT
+
+FRAGMENT = "templates/nftables.conf.j2"
+TABLE = "infinito_probe"
+
+PROBE_PORTS = {
+    "TOR_TRANS_PORT": "9040",
+    "TOR_DNS_PORT": "9053",
+    "TOR_SOCKS_PORT": "9050",
+    "TOR_DNSMASQ_PORT": "53",
+}
+
+_PORT_VARIABLE = re.compile(r"\{\{\s*([A-Z][A-Z0-9_]*)\s*\}\}")
+
+
+def _guarded_ports() -> list[dict]:
+    """The role's own guard list, with its port variables filled from stand-ins.
+
+    The shape has to come from the declaration: an entry that gains a key, a
+    protocol or a whole port must reach the rendered table here, or this check
+    keeps passing on a fixture the role stopped shipping.
+    """
+    declared = load_yaml_any(
+        str(PROJECT_ROOT / "roles" / "svc-net-tor" / ROLE_FILE_VARS_MAIN)
+    )["TOR_EGRESS_GUARDED_PORTS"]
+    return [
+        {**entry, "port": PROBE_PORTS[_PORT_VARIABLE.search(entry["port"]).group(1)]}
+        for entry in declared
+    ]
+
+
+COMMON = {
+    "FIREWALL_TABLE": TABLE,
+    "TOR_EGRESS_CLIENT_CIDRS": ["127.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"],
+    "TOR_EGRESS_GUARDED_PORTS": _guarded_ports(),
+    "TOR_EGRESS_VIRTUAL_NET_IPV4": "10.192.0.0/10",
+    **PROBE_PORTS,
+    "TOR_CONTAINER_DNS_HOST": "172.17.0.1",
+    "NETWORK_INTERNAL_CIDRS": [
+        "127.0.0.0/8",
+        "10.0.0.0/8",
+        "172.16.0.0/12",
+        "192.168.0.0/16",
+    ],
+}
+
+MODES = ("compose", "swarm")
+
+
+def _run(argv: list[str]) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(argv, capture_output=True, text=True, check=False)
+
+
+@lru_cache(maxsize=1)
+def _nft_can_check() -> bool:
+    """Whether `nft -c` works here.
+
+    It is not a parser: it opens netlink and builds a cache against the live
+    kernel first, so on a runner without CAP_NET_ADMIN it fails on a valid
+    ruleset. Probing the binary's presence would make this suite red there.
+    """
+    if shutil.which("nft") is None:
+        return False
+    with tempfile.NamedTemporaryFile("w", suffix=".conf") as handle:
+        handle.write("table inet infinito_capability_probe\n")
+        handle.flush()
+        return _run(["nft", "-c", "-f", handle.name]).returncode == 0
+
+
+@contextmanager
+def _network_namespace(name: str):
+    """An empty namespace, so a loaded ruleset cannot reach the live one."""
+    created = _run(["ip", "netns", "add", name])
+    if created.returncode != 0:
+        raise unittest.SkipTest(f"cannot create a network namespace: {created.stderr}")
+    try:
+        yield ["ip", "netns", "exec", name]
+    finally:
+        _run(["ip", "netns", "del", name])
+
+
+def _fragments() -> list[str]:
+    suffix = "/" + FRAGMENT
+    return sorted(
+        path
+        for path in iter_project_files(extensions=(".j2",), exclude_tests=True)
+        if path.endswith(suffix)
+    )
+
+
+def _render(path: str, mode: str = "swarm") -> str:
+    environment = jinja2.Environment(
+        keep_trailing_newline=True,
+        trim_blocks=True,
+        autoescape=False,  # noqa: S701  nftables, not markup
+    )
+    return environment.from_string(read_text(path)).render(
+        DEPLOYMENT_MODE=mode, **COMMON
+    )
+
+
+class TestFirewallFragments(unittest.TestCase):
+    def test_at_least_one_fragment_exists(self) -> None:
+        """Otherwise every assertion below passes over an empty list."""
+        self.assertTrue(_fragments(), "no role declares templates/nftables.conf.j2")
+
+    def test_each_fragment_replaces_its_table(self) -> None:
+        for path in _fragments():
+            rel = Path(path).relative_to(PROJECT_ROOT).as_posix()
+            with self.subTest(fragment=rel):
+                lines = [
+                    line.strip() for line in _render(path).splitlines() if line.strip()
+                ]
+                declarations = [
+                    line for line in lines if re.match(r"^(delete )?table inet ", line)
+                ]
+                self.assertEqual(
+                    declarations[:3],
+                    [
+                        f"table inet {TABLE}",
+                        f"delete table inet {TABLE}",
+                        f"table inet {TABLE} {{",
+                    ],
+                    f"{rel} must open with the create, delete and declare idiom, "
+                    "or nft merges the new rules into the old table",
+                )
+
+    def test_each_fragment_parses(self) -> None:
+        if not _nft_can_check():
+            self.skipTest("nft -c needs CAP_NET_ADMIN, which this runner lacks")
+        nft = shutil.which("nft")
+        for path in _fragments():
+            rel = Path(path).relative_to(PROJECT_ROOT).as_posix()
+            for mode in MODES:
+                with self.subTest(fragment=rel, mode=mode):
+                    with tempfile.NamedTemporaryFile("w", suffix=".conf") as handle:
+                        handle.write(_render(path, mode))
+                        handle.flush()
+                        result = subprocess.run(
+                            [nft, "-c", "-f", handle.name],
+                            capture_output=True,
+                            text=True,
+                            check=False,
+                        )
+                    self.assertEqual(
+                        result.returncode,
+                        0,
+                        f"{rel} is not valid nftables in {mode}:\n{result.stderr}",
+                    )
+
+    def test_each_fragment_loads_and_reloads(self) -> None:
+        """A dry run cannot show what happens on the second deploy.
+
+        Loading the same fragment twice is what proves the idiom: the second
+        pass meets the table the first one left and must replace it, which is
+        exactly the case ``nft -c`` never sees.
+        """
+        if not _nft_can_check() or shutil.which("ip") is None:
+            self.skipTest("loading a ruleset needs nft with CAP_NET_ADMIN and ip")
+        for index, path in enumerate(_fragments()):
+            rel = Path(path).relative_to(PROJECT_ROOT).as_posix()
+            for mode in MODES:
+                with self.subTest(fragment=rel, mode=mode):
+                    with (
+                        tempfile.NamedTemporaryFile("w", suffix=".conf") as handle,
+                        _network_namespace(f"nftprobe{os.getpid()}x{index}") as netns,
+                    ):
+                        handle.write(_render(path, mode))
+                        handle.flush()
+                        listings = []
+                        for attempt in ("first", "second"):
+                            loaded = _run([*netns, "nft", "-f", handle.name])
+                            self.assertEqual(
+                                loaded.returncode,
+                                0,
+                                f"{rel} failed to load on the {attempt} pass "
+                                f"in {mode}:\n{loaded.stderr}",
+                            )
+                            listed = _run(
+                                [*netns, "nft", "list", "table", "inet", TABLE]
+                            )
+                            self.assertEqual(
+                                listed.returncode,
+                                0,
+                                f"{rel} loaded but left no table on the {attempt} "
+                                f"pass in {mode}:\n{listed.stderr}",
+                            )
+                            listings.append(listed.stdout)
+                    self.assertIn(f"table inet {TABLE}", listings[0])
+                    self.assertEqual(
+                        listings[0],
+                        listings[1],
+                        f"{rel} grew on the second pass in {mode}, so it merges "
+                        "into the table it found instead of replacing it",
+                    )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/svc-net-tor/test_egress_clients.py b/tests/unit/python/roles/svc-net-tor/test_egress_clients.py
new file mode 100644
index 0000000000..52a558a9a9
--- /dev/null
+++ b/tests/unit/python/roles/svc-net-tor/test_egress_clients.py
@@ -0,0 +1,101 @@
+"""The egress guard admits every address a container can come from.
+
+The guard drops any source outside ``tor_egress_clients``, and containers reach
+the TransPort and the DNSPort through exactly those rules. So the list is not a
+convenience: if it ever stops covering docker's own address pools, every
+container loses the resolver and the transparent proxy at once, and it fails in
+production rather than here.
+
+This runs the real lookup over the repository's real network declarations. A
+narrowed pool, a renamed key or a dropped entry in the lookup all surface as a
+failure of the property the rules depend on.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+import unittest
+from unittest import mock
+
+import jinja2
+
+from utils.cache.yaml import load_yaml_any
+
+from . import PROJECT_ROOT
+
+NETWORKS = PROJECT_ROOT / "group_vars/all/08_networks.yml"
+LOOKUP = "roles/svc-net-tor/lookup_plugins/tor_egress_clients.py"
+
+
+def _load_lookup():
+    path = PROJECT_ROOT / LOOKUP
+    spec = importlib.util.spec_from_file_location("tor_egress_clients_lookup", path)
+    module = importlib.util.module_from_spec(spec)
+    assert spec and spec.loader
+    sys.modules["tor_egress_clients_lookup"] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+class _Templar:
+    """Resolves the group_vars cross-references the lookup renders."""
+
+    def __init__(self, variables: dict):
+        self.available_variables = variables
+
+    def template(self, value):
+        return (
+            jinja2.Environment(autoescape=False)  # noqa: S701 - renders CIDRs, not markup
+            .from_string(str(value))
+            .render(**self.available_variables)
+        )
+
+
+class TestEgressClients(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.module = _load_lookup()
+        cls.variables = load_yaml_any(str(NETWORKS))
+
+    def _admitted(self) -> list[str]:
+        lookup = self.module.LookupModule()
+        lookup._templar = _Templar(self.variables)
+        lookup._loader = mock.MagicMock()
+        with mock.patch.object(self.module, "lookup_loader") as loader:
+            loader.get.return_value = mock.MagicMock(
+                run=mock.MagicMock(return_value=[[]])
+            )
+            return lookup.run([], variables=self.variables)[0]
+
+    def test_every_docker_address_pool_is_admitted(self) -> None:
+        admitted = self._admitted()
+        pools = self.variables["NETWORK_DOCKER_ADDRESS_POOLS"]
+        self.assertTrue(pools, "no docker address pool is declared")
+        for pool in pools:
+            with self.subTest(pool=pool["base"]):
+                self.assertIn(
+                    pool["base"],
+                    admitted,
+                    "containers draw their address from this pool and reach the "
+                    "guarded ports through the guard, so dropping it from the "
+                    "admitted list takes the resolver away from every container",
+                )
+
+    def test_loopback_is_admitted(self) -> None:
+        """The host resolves .onion through its own loopback."""
+        self.assertIn(self.variables["NETWORK_LOOPBACK_CIDR"], self._admitted())
+
+    def test_the_lan_is_not_admitted_wholesale(self) -> None:
+        """The guarded ports carry no access policy, so the LAN is not a client.
+
+        Admitting 10.0.0.0/8 would hand a transparent proxy and a resolver to
+        every host the operator's network happens to contain.
+        """
+        self.assertNotIn(
+            self.variables["NETWORK_PRIVATE_CIDRS"]["class_a"], self._admitted()
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/svc-net-tor/test_extra_ports.py b/tests/unit/python/roles/svc-net-tor/test_extra_ports.py
new file mode 100644
index 0000000000..4deb747de1
--- /dev/null
+++ b/tests/unit/python/roles/svc-net-tor/test_extra_ports.py
@@ -0,0 +1,135 @@
+"""The node onion forwards HTTP whether or not the proxy is in the inventory.
+
+``lookup('tor_ports')`` collects what the roles in ``group_names`` declare under
+``ports.onion``. Port 80 belongs to ``svc-prx-openresty``, which a node acquires
+through ``sys-stk-front-proxy`` and which therefore appears in no dependency
+list an inventory holds. A node provisioned with ``--include svc-net-tor`` alone
+published an onion forwarding SSH and nothing else.
+
+These run the real lookup over a stubbed ``tor_ports``, so a flag that stops
+reaching the forward list, or a derived port that starts duplicating a flagged
+one, fails here rather than on the node.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+import unittest
+from typing import Any
+from unittest import mock
+
+from ansible.errors import AnsibleError
+
+from . import PROJECT_ROOT
+
+LOOKUP = "roles/svc-net-tor/lookup_plugins/tor_extra_ports.py"
+SSH_ENTRY = {"onion_port": 22, "target": "127.0.0.1:22"}
+HTTP_ENTRY = {"onion_port": 80, "target": "127.0.0.1:80"}
+ENABLED = {"TOR_ONION_SSH_ENABLED": True, "TOR_ONION_HTTP_ENABLED": True}
+
+
+def _load_lookup():
+    path = PROJECT_ROOT / LOOKUP
+    spec = importlib.util.spec_from_file_location("tor_extra_ports_lookup", path)
+    module = importlib.util.module_from_spec(spec)
+    assert spec and spec.loader
+    sys.modules["tor_extra_ports_lookup"] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+class _DerivedPorts:
+    """Stands in for the tor_ports lookup the plugin composes with."""
+
+    def __init__(self, entries: list[dict[str, Any]]):
+        self.entries = entries
+
+    def run(self, _terms, **_kwargs):
+        return [self.entries]
+
+
+class _Templar:
+    """Resolves a group_var reference the way the play's templar does."""
+
+    def __init__(self, rendered: Any):
+        self.rendered = rendered
+
+    def template(self, _value):
+        return self.rendered
+
+
+class TestExtraPorts(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.module = _load_lookup()
+
+    def _ports(self, derived: list[dict], **variables) -> list[dict]:
+        lookup = self.module.LookupModule()
+        lookup._templar = None
+        lookup._loader = None
+        with mock.patch.object(
+            self.module.lookup_loader, "get", return_value=_DerivedPorts(derived)
+        ):
+            return lookup.run([], variables={**ENABLED, **variables})[0]
+
+    def test_a_flag_that_arrives_as_template_text_is_still_read(self) -> None:
+        lookup = self.module.LookupModule()
+        lookup._templar = _Templar(True)
+        lookup._loader = None
+        variables = dict.fromkeys(
+            ENABLED,
+            "{{ lookup('config', application_id, 'services.tor.forwards.x') | bool }}",
+        )
+        with mock.patch.object(
+            self.module.lookup_loader, "get", return_value=_DerivedPorts([])
+        ):
+            ports = lookup.run([], variables=variables)[0]
+        self.assertIn(
+            HTTP_ENTRY,
+            ports,
+            "group vars reach a lookup unrendered, so the flag arrives as its own "
+            "template text; reading it without templating aborts the torrc render "
+            "on every tor row",
+        )
+
+    def test_http_is_forwarded_without_the_proxy_in_the_inventory(self) -> None:
+        self.assertIn(
+            HTTP_ENTRY,
+            self._ports([]),
+            "a node whose inventory lists only svc-net-tor still serves its apps "
+            "over the onion, so the forward cannot depend on the proxy being listed",
+        )
+
+    def test_a_derived_port_does_not_duplicate_a_flagged_one(self) -> None:
+        ports = self._ports([HTTP_ENTRY])
+        self.assertEqual(
+            [entry for entry in ports if entry["onion_port"] == 80],
+            [HTTP_ENTRY],
+            "torrc writes one HiddenServicePort line per entry, so a duplicate "
+            "publishes the same forward twice",
+        )
+
+    def test_derived_ports_still_reach_the_forward_list(self) -> None:
+        onion_dns = {"onion_port": 9053, "target": "127.0.0.1:9053"}
+        self.assertIn(
+            onion_dns,
+            self._ports([onion_dns]),
+            "the flags add to what the services declare, they do not replace it",
+        )
+
+    def test_a_flag_turns_its_forward_off(self) -> None:
+        ports = self._ports([], TOR_ONION_HTTP_ENABLED=False)
+        self.assertNotIn(HTTP_ENTRY, ports)
+        self.assertIn(SSH_ENTRY, ports, "the other flag is untouched")
+
+    def test_an_undeclared_flag_is_refused(self) -> None:
+        lookup = self.module.LookupModule()
+        lookup._templar = None
+        with self.assertRaises(AnsibleError) as raised:
+            lookup.run([], variables={"TOR_ONION_SSH_ENABLED": True})
+        self.assertIn("TOR_ONION_HTTP_ENABLED", str(raised.exception))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/svc-net-tor/test_guarded_ports.py b/tests/unit/python/roles/svc-net-tor/test_guarded_ports.py
new file mode 100644
index 0000000000..f3c2c0ba88
--- /dev/null
+++ b/tests/unit/python/roles/svc-net-tor/test_guarded_ports.py
@@ -0,0 +1,130 @@
+"""Every port the egress router binds locally is dropped for foreign sources.
+
+The guard chain is the only thing between these listeners and anyone who can
+route a packet to the node. A port that is bound but not named in a drop rule
+answers the whole reachable network: the transparent proxy relays, the DNSPort
+resolves, and the split-DNS forwarder both resolves recursively and hands out
+the node's own ``.onion`` records.
+
+This walks the real declaration chain rather than a fixture: ``meta/services.yml``
+names the ports tor itself binds, ``vars/main.yml`` turns each into a
+``TOR_*_PORT`` variable, and the guard list plus the fragment template spend
+those variables on drop rules. A port added to the service declaration without a
+rule fails the first test.
+
+The forwarder sits outside that chain because it is not tor's own port: it takes
+the well-known resolver port from ``NETWORK_DNS_PORT``, and the host already
+assigns that number to whichever resolver owns it. The second test covers it by
+name instead.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+
+from utils.cache.files import read_text
+from utils.cache.yaml import load_yaml_any
+from utils.roles.mapping import ROLE_FILE_META_SERVICES, ROLE_FILE_VARS_MAIN
+
+from . import PROJECT_ROOT
+
+ROLE = PROJECT_ROOT / "roles/svc-net-tor"
+SERVICES = ROLE / ROLE_FILE_META_SERVICES
+VARS = ROLE / ROLE_FILE_VARS_MAIN
+FRAGMENT = ROLE / "templates/nftables.conf.j2"
+
+_VARIABLE = re.compile(r"\{\{\s*([A-Z][A-Z0-9_]*)\s*\}\}")
+_PORT_KEY = re.compile(r"services\.tor\.ports\.local\.([a-z0-9_]+)")
+_DROP_RULE = re.compile(r"^\s*(?!#).*\b(?P<protocol>tcp|udp)\s+dport\b.*\bdrop\b")
+
+
+def _declared_ports() -> dict[str, int]:
+    return load_yaml_any(str(SERVICES))["tor"]["ports"]["local"]
+
+
+def _port_variables() -> dict[str, str]:
+    """Maps each ``TOR_*_PORT`` variable to the port key it reads."""
+    declared = load_yaml_any(str(VARS))
+    names = {}
+    for name, value in declared.items():
+        if not isinstance(value, str):
+            continue
+        key = _PORT_KEY.search(value)
+        if key is not None:
+            names[name] = key.group(1)
+    return names
+
+
+def _entries_for(variable: str) -> list[dict]:
+    """Guard entries whose port comes from *variable*."""
+    return [
+        entry
+        for entry in load_yaml_any(str(VARS))["TOR_EGRESS_GUARDED_PORTS"]
+        if _VARIABLE.search(str(entry["port"])).group(1) == variable
+    ]
+
+
+def _guarded_keys() -> set[str]:
+    """Port keys that reach a drop rule, through the vars list or the template."""
+    variables = _port_variables()
+    guarded: set[str] = set()
+
+    for entry in load_yaml_any(str(VARS))["TOR_EGRESS_GUARDED_PORTS"]:
+        name = _VARIABLE.search(str(entry["port"]))
+        if name is not None and name.group(1) in variables:
+            guarded.add(variables[name.group(1)])
+
+    for line in read_text(str(FRAGMENT)).splitlines():
+        if _DROP_RULE.match(line) is None:
+            continue
+        for name in _VARIABLE.findall(line):
+            if name in variables:
+                guarded.add(variables[name])
+
+    return guarded
+
+
+class TestGuardedPorts(unittest.TestCase):
+    def test_every_locally_bound_port_reaches_a_drop_rule(self) -> None:
+        declared = _declared_ports()
+        self.assertTrue(declared, f"{SERVICES} declares no local ports")
+
+        unguarded = sorted(set(declared) - _guarded_keys())
+        self.assertEqual(
+            unguarded,
+            [],
+            "these ports are bound on the node but no guard rule drops a "
+            "foreign source for them, so they answer everything that can route "
+            f"to the node: {', '.join(f'{key} ({declared[key]})' for key in unguarded)}",
+        )
+
+    def test_the_forwarder_is_guarded_on_both_transports(self) -> None:
+        entries = _entries_for("TOR_DNSMASQ_PORT")
+        self.assertEqual(
+            {entry["protocol"] for entry in entries},
+            {"tcp", "udp"},
+            "dnsmasq answers on both transports, and a TCP query returns the "
+            "same records a UDP one does",
+        )
+
+    def test_the_forwarder_admits_every_source_the_node_calls_internal(self) -> None:
+        """The resolver may not be stricter than the proxy it sits next to.
+
+        ``internal`` is ``NETWORK_INTERNAL_CIDRS``, the same list ``torrc.j2``
+        spends on ``SocksPolicy accept``. ``containers`` is narrower: out of
+        ``10.0.0.0/8`` it carries only the docker pool and the exception role,
+        which leaves out swarm's ingress network and every overlay docker
+        allocates without an ipam block. Guarding the resolver with the narrow
+        set hands a source a full SOCKS proxy and refuses it a name lookup.
+        """
+        self.assertEqual(
+            {entry["admitted"] for entry in _entries_for("TOR_DNSMASQ_PORT")},
+            {"internal"},
+            "the resolver carries ordinary name resolution for everything the "
+            "node routes, so it takes the internal set, not the container pools",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/svc-net-tor/test_onion_ports_probe.py b/tests/unit/python/roles/svc-net-tor/test_onion_ports_probe.py
new file mode 100644
index 0000000000..1c825cb070
--- /dev/null
+++ b/tests/unit/python/roles/svc-net-tor/test_onion_ports_probe.py
@@ -0,0 +1,203 @@
+"""The onion port probe speaks SOCKS5 and reports only real successes.
+
+The handshake used to live in a heredoc inside a shell script, where no linter
+and no test could reach it: forty lines assembling protocol bytes, checked by
+nothing. These tests run it against a fake proxy that answers by script, so the
+bytes on the wire and the verdict drawn from the reply are both pinned.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import socket
+import threading
+import unittest
+
+from . import PROJECT_ROOT
+
+
+def _load_probe():
+    path = PROJECT_ROOT / "roles" / "svc-net-tor" / "files" / "test" / "onion_ports.py"
+    spec = importlib.util.spec_from_file_location("onion_ports_probe", str(path))
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+PROBE = _load_probe()
+
+
+class _FakeSocks(threading.Thread):
+    """A one-shot SOCKS5 proxy that replies with a scripted CONNECT code."""
+
+    def __init__(
+        self,
+        reply_code: int | None,
+        greeting: bytes = b"\x05\x02",
+        auth_reply: bytes = b"\x01\x00",
+    ) -> None:
+        super().__init__(daemon=True)
+        self._reply_code = reply_code
+        self._greeting = greeting
+        self._auth_reply = auth_reply
+        self._server = socket.socket()
+        self._server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        self._server.bind(("127.0.0.1", 0))
+        self._server.listen(1)
+        self.offered = b""
+        self.auth = b""
+        self.request = b""
+
+    @property
+    def endpoint(self) -> str:
+        host, port = self._server.getsockname()
+        return f"{host}:{port}"
+
+    def run(self) -> None:
+        conn, _ = self._server.accept()
+        with self._server, conn:
+            self.offered = conn.recv(3)
+            conn.sendall(self._greeting)
+            if self._greeting != b"\x05\x02":
+                return
+            self.auth = conn.recv(512)
+            conn.sendall(self._auth_reply)
+            if self._auth_reply != b"\x01\x00":
+                return
+            self.request = conn.recv(512)
+            if self._reply_code is None:
+                return
+            conn.sendall(bytes([0x05, self._reply_code, 0x00, 0x01]))
+
+
+class TestConnectThroughSocks(unittest.TestCase):
+    def test_a_success_reply_passes_and_carries_the_target(self) -> None:
+        proxy = _FakeSocks(reply_code=0x00)
+        proxy.start()
+        PROBE.connect_through_socks(proxy.endpoint, "example.onion", 25, 5)
+        proxy.join(timeout=5)
+        self.assertTrue(
+            proxy.request.startswith(b"\x05\x01\x00\x03"),
+            f"the CONNECT request is malformed: {proxy.request!r}",
+        )
+        self.assertIn(b"example.onion", proxy.request)
+        self.assertTrue(
+            proxy.request.endswith((25).to_bytes(2, "big")),
+            "the port must travel big-endian in the last two bytes",
+        )
+
+    def test_every_attempt_isolates_itself_with_fresh_credentials(self) -> None:
+        seen: list[bytes] = []
+        for _ in range(2):
+            proxy = _FakeSocks(reply_code=0x00)
+            proxy.start()
+            PROBE.connect_through_socks(proxy.endpoint, "example.onion", 80, 5)
+            proxy.join(timeout=5)
+            self.assertEqual(
+                proxy.offered,
+                b"\x05\x01\x02",
+                "only username/password may be offered, or Tor may pick no-auth "
+                "and put the attempt on the shared circuit",
+            )
+            self.assertEqual(
+                proxy.auth[0], 0x01, f"bad RFC 1929 version: {proxy.auth!r}"
+            )
+            seen.append(proxy.auth)
+        self.assertNotEqual(
+            seen[0],
+            seen[1],
+            "a retry that reuses the credentials reuses the dead rendezvous circuit",
+        )
+
+    def test_rejected_credentials_fail(self) -> None:
+        proxy = _FakeSocks(reply_code=None, auth_reply=b"\x01\x01")
+        proxy.start()
+        with self.assertRaises(PROBE.ProbeError) as raised:
+            PROBE.connect_through_socks(proxy.endpoint, "example.onion", 25, 5)
+        self.assertIn("credentials", str(raised.exception))
+
+    def test_a_refusal_reply_fails(self) -> None:
+        proxy = _FakeSocks(reply_code=0x05)
+        proxy.start()
+        with self.assertRaises(PROBE.ProbeError) as raised:
+            PROBE.connect_through_socks(proxy.endpoint, "example.onion", 25, 5)
+        self.assertIn("0x05", str(raised.exception))
+
+    def test_a_refused_auth_method_fails(self) -> None:
+        proxy = _FakeSocks(reply_code=None, greeting=b"\x05\xff")
+        proxy.start()
+        with self.assertRaises(PROBE.ProbeError):
+            PROBE.connect_through_socks(proxy.endpoint, "example.onion", 25, 5)
+
+    def test_a_closed_connection_fails(self) -> None:
+        proxy = _FakeSocks(reply_code=None)
+        proxy.start()
+        with self.assertRaises(PROBE.ProbeError):
+            PROBE.connect_through_socks(proxy.endpoint, "example.onion", 25, 5)
+
+    def test_an_unreachable_proxy_fails(self) -> None:
+        with self.assertRaises(PROBE.ProbeError) as raised:
+            PROBE.connect_through_socks("127.0.0.1:1", "example.onion", 25, 1)
+        self.assertIn("unreachable", str(raised.exception))
+
+
+class TestProbe(unittest.TestCase):
+    def test_only_the_failures_are_retried(self) -> None:
+        attempts: list[int] = []
+
+        def _connect(_proxy, _host, port, _timeout):
+            attempts.append(port)
+            if port == 25:
+                raise PROBE.ProbeError("still down")
+
+        original = PROBE.connect_through_socks
+        PROBE.connect_through_socks = _connect
+        try:
+            failures = PROBE.probe(
+                proxy="p:9050",
+                host="example.onion",
+                ports=[25, 143],
+                timeout=1,
+                retries=3,
+                sleep_seconds=0,
+                sleeper=lambda _seconds: None,
+            )
+        finally:
+            PROBE.connect_through_socks = original
+
+        self.assertEqual(failures, {25: "still down"})
+        self.assertEqual(
+            attempts.count(143),
+            1,
+            "a healthy port must not be probed again on a retry pass",
+        )
+        self.assertEqual(attempts.count(25), 3)
+
+    def test_a_port_that_recovers_is_not_reported(self) -> None:
+        seen: list[int] = []
+
+        def _connect(_proxy, _host, port, _timeout):
+            seen.append(port)
+            if len(seen) == 1:
+                raise PROBE.ProbeError("first pass fails")
+
+        original = PROBE.connect_through_socks
+        PROBE.connect_through_socks = _connect
+        try:
+            failures = PROBE.probe(
+                proxy="p:9050",
+                host="example.onion",
+                ports=[25],
+                timeout=1,
+                retries=2,
+                sleep_seconds=0,
+                sleeper=lambda _seconds: None,
+            )
+        finally:
+            PROBE.connect_through_socks = original
+
+        self.assertEqual(failures, {})
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/svc-net-tor/test_test_env_sourcing.py b/tests/unit/python/roles/svc-net-tor/test_test_env_sourcing.py
new file mode 100644
index 0000000000..e0a3f8ed8c
--- /dev/null
+++ b/tests/unit/python/roles/svc-net-tor/test_test_env_sourcing.py
@@ -0,0 +1,75 @@
+"""The rendered test.env survives the shell that sources it.
+
+test-e2e-cli loads test.env with ``set -a && . test.env && set +a``. An unquoted
+space-separated value there is not an assignment but a command with a one-word
+environment prefix: ``ONION_PORTS=25 80`` runs ``80``, bash reports
+``command not found`` and carries on, and the probe reads an empty port list as
+nothing to check.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import unittest
+
+from jinja2 import Environment, StrictUndefined, select_autoescape
+
+from plugins.filter.dotenv import FilterModule
+from utils.cache.files import read_text
+
+from . import PROJECT_ROOT
+
+TEMPLATE = PROJECT_ROOT / "roles" / "svc-net-tor" / "templates" / "test.env.j2"
+PORTS = [25, 80, 587]
+
+
+def _lookup(name: str, *_args: str) -> object:
+    return {
+        "config": "example.onion",
+        "nginx": "/etc/nginx/conf.d/servers",
+        "tor_ports": [
+            {"onion_port": port, "target": f"127.0.0.1:{port}"} for port in PORTS
+        ],
+        "tor_socks": "127.0.0.1:9050",
+    }[name]
+
+
+def _render(mode: str) -> str:
+    env = Environment(
+        undefined=StrictUndefined,
+        autoescape=select_autoescape(default_for_string=False),
+    )
+    env.filters.update(FilterModule().filters())
+    return env.from_string(read_text(str(TEMPLATE))).render(
+        lookup=_lookup,
+        DEPLOYMENT_MODE=mode,
+        TOR_DNSMASQ_CONF="/etc/dnsmasq.d/tor-onion.conf",
+    )
+
+
+class TestTestEnvSourcing(unittest.TestCase):
+    def test_every_onion_port_reaches_the_probe(self) -> None:
+        for mode in ("compose", "swarm"):
+            with self.subTest(mode=mode):
+                result = subprocess.run(
+                    [
+                        "bash",
+                        "-c",
+                        (
+                            "set -a && . /dev/stdin && set +a && "
+                            'printf %s "${ONION_PORTS-unset}"'
+                        ),
+                    ],
+                    input=_render(mode),
+                    capture_output=True,
+                    text=True,
+                    check=False,
+                )
+                self.assertEqual(
+                    result.stderr, "", "sourcing test.env must not run anything"
+                )
+                self.assertEqual(result.stdout, " ".join(str(port) for port in PORTS))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/sys-ctl-hlth-csp/lookup_plugins/test_csp_accept_status.py b/tests/unit/python/roles/sys-ctl-hlth-csp/lookup_plugins/test_csp_accept_status.py
new file mode 100644
index 0000000000..3378cc06e2
--- /dev/null
+++ b/tests/unit/python/roles/sys-ctl-hlth-csp/lookup_plugins/test_csp_accept_status.py
@@ -0,0 +1,124 @@
+from __future__ import annotations
+
+import importlib.util
+import sys
+import unittest
+import unittest.mock as mock
+from unittest.mock import patch
+
+from . import PROJECT_ROOT
+
+
+def _load_module(rel_path: str, name: str):
+    path = PROJECT_ROOT / rel_path
+    spec = importlib.util.spec_from_file_location(name, str(path))
+    mod = importlib.util.module_from_spec(spec)
+    assert spec and spec.loader
+    sys.modules[name] = mod
+    spec.loader.exec_module(mod)
+    return mod
+
+
+class _DummyTemplar:
+    def __init__(self, available_variables: dict | None = None):
+        self.available_variables = available_variables or {}
+
+
+class CspAcceptStatusLookupTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.module = _load_module(
+            "roles/sys-ctl-hlth-csp/lookup_plugins/csp_accept_status.py",
+            "csp_accept_status_lookup",
+        )
+
+    def _run(self, applications, **kwargs):
+        lm = self.module.LookupModule()
+        lm._templar = _DummyTemplar()
+        lm._loader = mock.MagicMock()
+        with patch.object(self.module, "lookup_loader") as loader_mock:
+            loader_mock.get.return_value = mock.MagicMock(
+                run=lambda *_a, **_k: [applications]
+            )
+            return lm.run(terms=[], variables={}, **kwargs)[0]
+
+    def test_empty_applications_returns_empty_list(self):
+        self.assertEqual(self._run({}), [])
+
+    def test_non_mapping_applications_returns_empty(self):
+        self.assertEqual(self._run([]), [])
+
+    def test_a_declared_4xx_is_named_with_its_domain(self):
+        apps = {
+            "web-svc-mirror": {
+                "domains": {"canonical": ["mirror.example.com"]},
+                "server": {"status_codes": {"default": [404]}},
+            }
+        }
+        self.assertEqual(self._run(apps), ["mirror.example.com=404"])
+
+    def test_aliases_are_named_too(self):
+        apps = {
+            "web-app-bridgy": {
+                "domains": {
+                    "canonical": ["bridgy.example.com"],
+                    "aliases": ["fed.example.com"],
+                },
+                "server": {"status_codes": {"default": [200, 404]}},
+            }
+        }
+        self.assertEqual(
+            self._run(apps),
+            ["bridgy.example.com=404", "fed.example.com=404"],
+        )
+
+    def test_a_2xx_only_declaration_names_nothing(self):
+        apps = {
+            "web-app-foo": {
+                "domains": {"canonical": ["foo.example.com"]},
+                "server": {"status_codes": {"default": [200]}},
+            }
+        }
+        self.assertEqual(self._run(apps), [])
+
+    def test_a_redirect_is_named_because_the_checker_rejects_it(self):
+        apps = {
+            "web-app-foo": {
+                "domains": {"canonical": ["foo.example.com"]},
+                "server": {"status_codes": {"default": [200, 301]}},
+            }
+        }
+        self.assertEqual(self._run(apps), ["foo.example.com=301"])
+
+    def test_two_vhosts_of_one_role_keep_their_own_codes(self):
+        apps = {
+            "web-app-split": {
+                "domains": {
+                    "canonical": {
+                        "api": "api.example.com",
+                        "web": "web.example.com",
+                    }
+                },
+                "server": {
+                    "status_codes": {
+                        "api": [405],
+                        "web": [200],
+                        "default": [200],
+                    }
+                },
+            }
+        }
+        self.assertEqual(self._run(apps), ["api.example.com=405"])
+
+    def test_several_codes_of_one_domain_are_joined(self):
+        apps = {
+            "web-app-foo": {
+                "domains": {"canonical": ["foo.example.com"]},
+                "server": {"status_codes": {"default": [200, 403, 404]}},
+            }
+        }
+        self.assertEqual(self._run(apps), ["foo.example.com=403,404"])
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)
diff --git a/tests/unit/python/roles/sys-ctl-hlth-csp/lookup_plugins/test_csp_skip_domains.py b/tests/unit/python/roles/sys-ctl-hlth-csp/lookup_plugins/test_csp_skip_domains.py
index 2ab1e503f5..8fcc53d0c1 100644
--- a/tests/unit/python/roles/sys-ctl-hlth-csp/lookup_plugins/test_csp_skip_domains.py
+++ b/tests/unit/python/roles/sys-ctl-hlth-csp/lookup_plugins/test_csp_skip_domains.py
@@ -24,6 +24,13 @@ class _DummyTemplar:
         self.available_variables = available_variables or {}
 
 
+def _app(service_enabled, domain="filer.example.com"):
+    return {
+        "server": {"domains": {"canonical": {"filer": domain}}},
+        "services": {"filer": {"enabled": service_enabled, "domains": ["filer"]}},
+    }
+
+
 class CspSkipDomainsLookupTests(unittest.TestCase):
     @classmethod
     def setUpClass(cls):
@@ -45,89 +52,47 @@ class CspSkipDomainsLookupTests(unittest.TestCase):
     def test_empty_applications_returns_empty_list(self):
         self.assertEqual(self._run({}), [])
 
-    def test_app_with_status_code_ge_400_skips_canonical_and_aliases(self):
-        apps = {
-            "web-app-bridgy": {
-                "domains": {
-                    "canonical": ["bridgy.example.com"],
-                    "aliases": ["fed.example.com"],
-                },
-                "server": {
-                    "status_codes": {"default": [200, 404]},
-                },
-            }
-        }
-        self.assertEqual(self._run(apps), ["bridgy.example.com", "fed.example.com"])
+    def test_non_mapping_applications_returns_empty(self):
+        self.assertEqual(self._run([]), [])
 
-    def test_app_without_status_code_ge_400_is_not_skipped(self):
+    def test_a_disabled_service_hides_its_canonical_domain(self):
+        self.assertEqual(
+            self._run({"web-app-seaweedfs": _app(False)}),
+            ["filer.example.com"],
+        )
+
+    def test_an_enabled_service_keeps_its_domain_under_probe(self):
+        self.assertEqual(self._run({"web-app-seaweedfs": _app(True)}), [])
+
+    def test_a_service_without_domains_is_ignored(self):
         apps = {
             "web-app-foo": {
-                "domains": {"canonical": ["foo.example.com"]},
-                "server": {
-                    "status_codes": {"default": [200]},
-                },
+                "server": {"domains": {"canonical": {"web": "foo.example.com"}}},
+                "services": {"worker": {"enabled": False}},
             }
         }
         self.assertEqual(self._run(apps), [])
 
-    def test_app_without_status_codes_field_is_not_skipped(self):
-        apps = {"web-app-foo": {"domains": {"canonical": ["foo.example.com"]}}}
-        self.assertEqual(self._run(apps), [])
-
-    def test_group_names_selection_filters_apps(self):
+    def test_the_selection_filters_which_apps_are_inspected(self):
         apps = {
-            "web-app-bridgy": {
-                "domains": {"canonical": ["bridgy.example.com"]},
-                "server": {
-                    "status_codes": {"default": [404]},
-                },
-            },
-            "web-app-other": {
-                "domains": {"canonical": ["other.example.com"]},
-                "server": {
-                    "status_codes": {"default": [404]},
-                },
-            },
+            "web-app-a": _app(False, "a.example.com"),
+            "web-app-b": _app(False, "b.example.com"),
         }
         self.assertEqual(
-            self._run(apps, group_names=["web-app-bridgy"]),
-            ["bridgy.example.com"],
+            self._run(apps, group_names=["web-app-a"]),
+            ["a.example.com"],
         )
 
     def test_group_names_csv_string_is_accepted(self):
         apps = {
-            "a": {
-                "domains": {"canonical": ["a.example.com"]},
-                "server": {
-                    "status_codes": {"default": [404]},
-                },
-            },
-            "b": {
-                "domains": {"canonical": ["b.example.com"]},
-                "server": {
-                    "status_codes": {"default": [404]},
-                },
-            },
+            "web-app-a": _app(False, "a.example.com"),
+            "web-app-b": _app(False, "b.example.com"),
         }
         self.assertEqual(
-            self._run(apps, group_names="a,b"),
+            self._run(apps, group_names="web-app-a,web-app-b"),
             ["a.example.com", "b.example.com"],
         )
 
-    def test_non_4xx_codes_dont_count(self):
-        apps = {
-            "web-app-foo": {
-                "domains": {"canonical": ["foo.example.com"]},
-                "server": {
-                    "status_codes": {"default": [200, 301, 302]},
-                },
-            }
-        }
-        self.assertEqual(self._run(apps), [])
-
-    def test_non_mapping_applications_returns_empty(self):
-        self.assertEqual(self._run([]), [])
-
 
 if __name__ == "__main__":
     unittest.main(verbosity=2)
diff --git a/tests/unit/python/roles/sys-ctl-hlth-csp/test_accept_status_reaches_onions.py b/tests/unit/python/roles/sys-ctl-hlth-csp/test_accept_status_reaches_onions.py
new file mode 100644
index 0000000000..770713510c
--- /dev/null
+++ b/tests/unit/python/roles/sys-ctl-hlth-csp/test_accept_status_reaches_onions.py
@@ -0,0 +1,57 @@
+import importlib.util
+import unittest
+
+from . import PROJECT_ROOT
+
+SCRIPT = PROJECT_ROOT / "roles" / "sys-ctl-hlth-csp" / "files" / "python" / "script.py"
+ONION = "mirror.b5abfs7uwr23x6vbjxqjatyscpmkm6qkmkla7eyapdi4zpwtrz6o4nqd.onion"
+DOMAINS = ["mirror.infinito.test", ONION, "html.infinito.test"]
+
+
+def _expand(accept_status, domains=None):
+    spec = importlib.util.spec_from_file_location("csp_wrapper", SCRIPT)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module.expand_accept_status(
+        accept_status, DOMAINS if domains is None else domains
+    )
+
+
+class TestAcceptStatusReachesOnions(unittest.TestCase):
+    def test_the_onion_sibling_inherits_the_declaration(self):
+        expanded = _expand(["mirror.infinito.test=404"])
+
+        self.assertIn(
+            f"{ONION}=404",
+            expanded,
+            "the checker matches accepted codes by hostname, so a code declared "
+            "for the clearnet vhost never reaches its onion twin on its own",
+        )
+
+    def test_a_vhost_without_an_onion_twin_gains_nothing(self):
+        self.assertEqual(
+            _expand(["html.infinito.test=403"]), ["html.infinito.test=403"]
+        )
+
+    def test_several_codes_carry_over_unchanged(self):
+        expanded = _expand(["mirror.infinito.test=301,302,404"])
+
+        self.assertIn(f"{ONION}=301,302,404", expanded)
+
+    def test_an_onion_entry_is_not_expanded_again(self):
+        self.assertEqual(_expand([f"{ONION}=404"]), [f"{ONION}=404"])
+
+    def test_an_entry_without_codes_is_left_alone(self):
+        self.assertEqual(_expand(["mirror.infinito.test"]), ["mirror.infinito.test"])
+
+    def test_only_the_matching_label_is_extended(self):
+        expanded = _expand(["html.infinito.test=403", "mirror.infinito.test=404"])
+
+        self.assertEqual(
+            [e for e in expanded if e.endswith(".onion=404")], [f"{ONION}=404"]
+        )
+        self.assertEqual([e for e in expanded if e.endswith(".onion=403")], [])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/sys-ctl-hlth-csp/test_list_flags_are_separated.py b/tests/unit/python/roles/sys-ctl-hlth-csp/test_list_flags_are_separated.py
new file mode 100644
index 0000000000..59fb813bef
--- /dev/null
+++ b/tests/unit/python/roles/sys-ctl-hlth-csp/test_list_flags_are_separated.py
@@ -0,0 +1,55 @@
+import importlib.util
+import unittest
+
+from . import PROJECT_ROOT
+
+SCRIPT = PROJECT_ROOT / "roles" / "sys-ctl-hlth-csp" / "files" / "python" / "script.py"
+URLS = ["https://a.test/", "https://b.test/"]
+
+
+def _load():
+    spec = importlib.util.spec_from_file_location("csp_wrapper", SCRIPT)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _cmd(**kwargs):
+    return _load().build_docker_cmd(
+        image="img",
+        urls=URLS,
+        short_mode=False,
+        ignore_network_blocks_from=kwargs.get("ignore", []),
+        accept_status=kwargs.get("accept", []),
+    )
+
+
+class TestListFlagsAreSeparatedFromUrls(unittest.TestCase):
+    def test_accept_status_is_separated_from_the_urls(self):
+        cmd = _cmd(accept=["a.test=403"])
+
+        self.assertEqual(
+            cmd[cmd.index("--accept-status") + 2],
+            "--",
+            "the checker consumes every token after a list flag that does not "
+            "start with '--', and a URL does not, so the URLs would be read as "
+            "more status declarations",
+        )
+
+    def test_two_list_flags_share_a_single_separator(self):
+        cmd = _cmd(ignore=["x.test"], accept=["y.test=403"])
+
+        self.assertEqual(cmd.count("--"), 1)
+        self.assertLess(cmd.index("--"), cmd.index(URLS[0]))
+
+    def test_without_a_list_flag_no_separator_is_emitted(self):
+        self.assertNotIn("--", _cmd())
+
+    def test_every_url_survives_the_separator(self):
+        cmd = _cmd(accept=["y.test=403"])
+
+        self.assertEqual(cmd[cmd.index("--") + 1 :], URLS)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/sys-ctl-hlth-csp/test_unit_flags_are_parsable.py b/tests/unit/python/roles/sys-ctl-hlth-csp/test_unit_flags_are_parsable.py
new file mode 100644
index 0000000000..759832c95a
--- /dev/null
+++ b/tests/unit/python/roles/sys-ctl-hlth-csp/test_unit_flags_are_parsable.py
@@ -0,0 +1,75 @@
+import re
+import subprocess
+import sys
+import unittest
+
+from utils.cache.files import read_text
+
+from . import PROJECT_ROOT
+
+ROLE = PROJECT_ROOT / "roles" / "sys-ctl-hlth-csp"
+TASKS = ROLE / "tasks" / "00_core.yml"
+SCRIPT = ROLE / "files" / "python" / "script.py"
+
+_FLAG = re.compile(r"'\s*(--[a-z][a-z0-9-]*)")
+_VALUE = {
+    "--nginx-config-dir": "/nonexistent",
+    "--image": "img",
+    "--tor-proxy": "socks5://127.0.0.1:9050",
+    "--onion-timeout": "1000",
+}
+_LIST_VALUE = {
+    "--ignore-network-blocks-from": "a.test",
+    "--skip-domain": "a.test",
+    "--accept-status": "a.test=403",
+}
+
+
+def _flags_the_unit_passes() -> set[str]:
+    return set(_FLAG.findall(read_text(str(TASKS))))
+
+
+def _invoke(flag: str) -> subprocess.CompletedProcess:
+    argv = [
+        sys.executable,
+        str(SCRIPT),
+        "--nginx-config-dir",
+        "/nonexistent",
+        "--image",
+        "img",
+    ]
+    if flag in _LIST_VALUE:
+        argv.extend([flag, _LIST_VALUE[flag]])
+    elif flag in _VALUE and flag not in ("--nginx-config-dir", "--image"):
+        argv.extend([flag, _VALUE[flag]])
+    elif flag not in _VALUE:
+        argv.append(flag)
+    return subprocess.run(argv, capture_output=True, text=True, timeout=60, check=False)
+
+
+class TestUnitFlagsAreParsable(unittest.TestCase):
+    def test_the_unit_passes_at_least_the_known_flags(self):
+        found = _flags_the_unit_passes()
+
+        self.assertIn("--accept-status", found)
+        self.assertIn("--onion-timeout", found)
+
+    def test_every_flag_the_unit_passes_is_accepted_by_the_script(self):
+        for flag in sorted(_flags_the_unit_passes()):
+            with self.subTest(flag=flag):
+                completed = _invoke(flag)
+                self.assertNotIn(
+                    "unrecognized arguments",
+                    completed.stderr,
+                    f"the systemd unit passes {flag} but script.py rejects it, "
+                    f"which fails the service with status=2/INVALIDARGUMENT",
+                )
+
+    def test_an_undeclared_flag_is_still_rejected(self):
+        completed = _invoke("--definitely-not-a-flag")
+
+        self.assertIn("unrecognized arguments", completed.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/web-app-discourse/test_oidc_setting_order.py b/tests/unit/python/roles/web-app-discourse/test_oidc_setting_order.py
index d5eb180e00..87ef01cba5 100644
--- a/tests/unit/python/roles/web-app-discourse/test_oidc_setting_order.py
+++ b/tests/unit/python/roles/web-app-discourse/test_oidc_setting_order.py
@@ -4,7 +4,7 @@ import unittest
 
 from utils.cache.files import PROJECT_ROOT, read_text
 
-CONFIG = PROJECT_ROOT / "roles/web-app-discourse/templates/config.yml.j2"
+SETTINGS = PROJECT_ROOT / "roles/web-app-discourse/files/ruby/apply_settings.rb"
 PREREQUISITES = (
     "openid_connect_discovery_document",
     "openid_connect_client_id",
@@ -14,15 +14,13 @@ PREREQUISITES = (
 
 def _line_of(lines: list[str], setting: str) -> int:
     return next(
-        index
-        for index, line in enumerate(lines)
-        if f'rails r "SiteSetting.{setting} = ' in line
+        index for index, line in enumerate(lines) if f"SiteSetting.{setting} = " in line
     )
 
 
 class TestDiscourseOidcSettingOrder(unittest.TestCase):
     def test_oidc_is_enabled_only_after_its_prerequisites_are_set(self) -> None:
-        lines = read_text(str(CONFIG)).splitlines()
+        lines = read_text(str(SETTINGS)).splitlines()
         enable = _line_of(lines, "openid_connect_enabled")
         for setting in PREREQUISITES:
             with self.subTest(setting=setting):
diff --git a/tests/unit/python/roles/web-app-nextcloud/filter_plugins/test_nextcloud_install.py b/tests/unit/python/roles/web-app-nextcloud/filter_plugins/test_nextcloud_install.py
index b633104387..3b902b60f8 100644
--- a/tests/unit/python/roles/web-app-nextcloud/filter_plugins/test_nextcloud_install.py
+++ b/tests/unit/python/roles/web-app-nextcloud/filter_plugins/test_nextcloud_install.py
@@ -12,6 +12,11 @@ SOCKS_ERROR = (
     "for https://garm3.nextcloud.com/api/v1/apps.json"
 )
 TIMEOUT_ERROR = "cURL error 28: Connection timed out after 120002 milliseconds"
+ARTIFACT_404 = (
+    "Error: Client error: `GET https://github.com/ONLYOFFICE/onlyoffice-nextcloud"
+    "/releases/download/v10.2.0/onlyoffice.tar.gz` resulted in a "
+    "`404 Not Found` response:\nNot Found"
+)
 
 
 def _load_module(rel_path: str, name: str):
@@ -56,6 +61,11 @@ class TestNextcloudInstallStatus(unittest.TestCase):
         self.assertFalse(status["unavailable"])
         self.assertFalse(_tolerated(status))
 
+    def test_an_advertised_release_whose_artifact_is_gone_stays_fatal(self):
+        status = _status(stdout=ARTIFACT_404)
+        self.assertFalse(status["unavailable"])
+        self.assertFalse(_tolerated(status))
+
     def test_an_incompatible_plugin_stays_terminal_and_not_runnable(self):
         status = _status(
             stdout="deck is not compatible with this version of the server"
diff --git a/tests/unit/python/roles/web-app-nextcloud/test_oidc_addon_follows_sso.py b/tests/unit/python/roles/web-app-nextcloud/test_oidc_addon_follows_sso.py
new file mode 100644
index 0000000000..3fa9e82bee
--- /dev/null
+++ b/tests/unit/python/roles/web-app-nextcloud/test_oidc_addon_follows_sso.py
@@ -0,0 +1,68 @@
+"""The OIDC addon must not be on when Nextcloud has no SSO provider.
+
+``meta/addons/oidc_login.yml`` gates on ``lookup('sso_oidc_plugin')``, which the
+applications render evaluates while it is still in flight. Under that re-entry
+guard the merged view hands out service flags as their own Jinja text, and
+``bool("{{ ... }}")`` is True: the lookup read ``services.ldap.enabled`` as
+enabled on a deployment that has neither Keycloak nor OpenLDAP and announced
+``oidc_login``. Nextcloud then advertised a login hand-off to a provider that is
+not deployed, while ``templates/config/oidc.config.php.j2`` re-read the same
+setting at task time and correctly wrote nothing.
+
+The stubbed lookup tests next to the plugin cannot see this: a stub resolves the
+path but does not render it. This renders for real.
+"""
+
+from __future__ import annotations
+
+import unittest
+
+from utils.cache import _reset_cache_for_tests
+from utils.cache.applications import get_merged_applications
+
+
+def _templar(variables: dict):
+    from ansible.parsing.dataloader import DataLoader
+    from ansible.template import Templar
+
+    templar = Templar(loader=DataLoader(), variables=dict(variables))
+    templar.available_variables = dict(variables)
+    return templar
+
+
+def _addon_flags(*deployed: str) -> dict:
+    variables = {"group_names": list(deployed), "applications": {}}
+    _reset_cache_for_tests()
+    try:
+        applications = get_merged_applications(
+            variables=variables, templar=_templar(variables)
+        )
+    finally:
+        _reset_cache_for_tests()
+    nextcloud = applications["web-app-nextcloud"]
+    addons = nextcloud.get("addons") or {}
+    services = nextcloud.get("services") or {}
+    return {
+        "sso": (services.get("sso") or {}).get("enabled"),
+        "ldap": (services.get("ldap") or {}).get("enabled"),
+        **{
+            name: (addons.get(name) or {}).get("enabled")
+            for name in ("oidc_login", "user_oidc", "sociallogin")
+        },
+    }
+
+
+class TestOidcAddonFollowsSso(unittest.TestCase):
+    def test_no_provider_means_no_oidc_addon(self) -> None:
+        flags = _addon_flags("web-app-nextcloud")
+
+        self.assertEqual(flags["sso"], False)
+        self.assertEqual(
+            (flags["oidc_login"], flags["user_oidc"], flags["sociallogin"]),
+            (False, False, False),
+            "no OIDC plugin may be announced without an SSO provider",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/roles/web-app-openbao/test_credential_rotation.py b/tests/unit/python/roles/web-app-openbao/test_credential_rotation.py
index 3af7af87f4..4beccfb7b3 100644
--- a/tests/unit/python/roles/web-app-openbao/test_credential_rotation.py
+++ b/tests/unit/python/roles/web-app-openbao/test_credential_rotation.py
@@ -1,8 +1,9 @@
 """Guards for the per-deploy credential rotation path of web-app-openbao.
 
 The platform regenerates generated-algorithm credentials on every deploy, so the
-seal key and AppRole a run is handed differ from the ones the running instance
-was configured with. Three things carry that transition, and each fails silently
+AppRole a run is handed differs from the one the running instance was configured
+with. The seal key is pinned out of that and moves only when an operator changes
+it, but the same transition then has to carry it. Each part fails silently
 rather than loudly when broken -- a sealed node and an unusable AppRole look
 identical to ordinary drift. These tests pin them.
 """
@@ -15,6 +16,7 @@ from jinja2 import Environment, FileSystemLoader, StrictUndefined
 
 from utils.cache.files import read_text
 from utils.cache.yaml import load_yaml_any
+from utils.roles.mapping import ROLE_FILE_META_SECRETS
 
 from . import PROJECT_ROOT
 
@@ -53,6 +55,30 @@ def tasks_of(name: str) -> list[dict]:
     return load_yaml_any(str(TASKS_DIR / name))
 
 
+class TestWhichCredentialsRotate(unittest.TestCase):
+    """The seal key survives a deploy; the AppRole does not.
+
+    The static seal carries one generation of slack, and rotating every deploy
+    spends it continuously: a run that skips a generation leaves the raft store
+    readable only from a volume backup plus the key that wrapped it. The
+    AppRole is the opposite case -- the live authentication path, whose
+    rotation the fallback login in 01_init.yml exists to absorb.
+    """
+
+    def setUp(self):
+        self.credentials = load_yaml_any(str(ROLE_DIR / ROLE_FILE_META_SECRETS))[
+            "credentials"
+        ]
+
+    def test_the_seal_key_is_pinned(self):
+        self.assertIs(self.credentials["seal_key"].get("rotatable"), False)
+
+    def test_both_approle_credentials_still_rotate(self):
+        for name in ("approle_role_id", "approle_secret_id"):
+            with self.subTest(credential=name):
+                self.assertIsNot(self.credentials[name].get("rotatable"), False)
+
+
 class TestSealStanzaRotation(unittest.TestCase):
     def _render(self, rotating: bool) -> str:
         env = jinja_env(ROLE_DIR / "templates")
@@ -223,6 +249,97 @@ class TestTheSecretIdSwapIsGuarded(unittest.TestCase):
         self.assertNotIn("when", task)
 
 
+class TestTheRecoveryKeyIsKeptAndUsable(unittest.TestCase):
+    """The one authority that does not rotate, and the way back it buys.
+
+    `bao operator init` issues a recovery key once and nothing reissues it.
+    Dropping it leaves the AppRole as the only administrative path, so a reset,
+    a replaced manager, or a run that dies between the two pins in
+    06_rotate.yml locks the instance out for good while its data stays
+    readable. sys-token-store holds it rather than the inventory, which no role
+    writes.
+    """
+
+    def setUp(self):
+        self.tasks = tasks_of("01_init.yml")
+
+    def _init_block(self) -> list[dict]:
+        return next(
+            task["block"]
+            for task in self.tasks
+            if "block" in task and "openbao_initialized" in str(task.get("when", ""))
+        )
+
+    def test_the_key_is_persisted_on_the_deploy_that_creates_it(self):
+        store = next(
+            task
+            for task in self._init_block()
+            if task.get("ansible.builtin.include_role", {}).get("name")
+            == "sys-token-store"
+        )
+        self.assertEqual(
+            store["ansible.builtin.include_role"]["tasks_from"], "write.yml"
+        )
+        self.assertIn("recovery_keys_b64", store["vars"]["sys_token_store_token"])
+
+    def test_the_key_is_loaded_before_the_logins_that_may_need_it(self):
+        load = next(
+            i
+            for i, task in enumerate(self.tasks)
+            if task.get("ansible.builtin.include_role", {}).get("tasks_from")
+            == "01_load.yml"
+        )
+        login = next(
+            i
+            for i, task in enumerate(self.tasks)
+            if task.get("register") == "openbao_approle_login"
+        )
+        self.assertLess(load, login)
+
+    def test_recovery_runs_only_when_both_logins_failed_and_a_key_exists(self):
+        block = next(
+            task
+            for task in self.tasks
+            if "openbao_approle_login_recovered" in str(task)
+        )
+        conditions = " ".join(block["when"])
+        self.assertIn("openbao_approle_login.rc != 0", conditions)
+        self.assertIn("openbao_approle_login_previous.rc", conditions)
+        self.assertIn("OPENBAO_RECOVERY_KEY", conditions)
+
+    def test_the_rebuilt_approle_is_the_one_the_inventory_holds(self):
+        """Recovering to the recorded pair would strand the deploy again.
+
+        02_auth.yml re-pins both halves to the inventory values, so the login
+        that proves recovery worked has to use those, not the applied ones.
+        """
+        block = next(
+            task
+            for task in self.tasks
+            if "openbao_approle_login_recovered" in str(task)
+        )
+        login = next(
+            task
+            for task in block["block"]
+            if task.get("register") == "openbao_approle_login_recovered"
+        )
+        self.assertIn("OPENBAO_APPROLE_ROLE_ID", login["ansible.builtin.shell"])
+        self.assertIn("OPENBAO_APPROLE_SECRET_ID", login["args"]["stdin"])
+
+    def test_the_recovery_path_ends_by_rebuilding_the_approle(self):
+        tasks = tasks_of("utils/recover.yml")
+        self.assertEqual(
+            tasks[-1]["ansible.builtin.include_tasks"],
+            "../02_auth.yml",
+            "minting a root token without re-pinning leaves the deploy no better off",
+        )
+
+    def test_a_rejected_recovery_key_fails_loudly(self):
+        tasks = tasks_of("utils/recover.yml")
+        guard = next(task for task in tasks if "ansible.builtin.fail" in task)
+        self.assertIn("complete", guard["when"])
+
+
 class TestTheRegisteredSecretIdComesFromTheLogin(unittest.TestCase):
     def test_it_is_the_credential_that_was_just_accepted(self):
         """Deriving it from the state file instead would be wrong.
diff --git a/tests/unit/python/utils/cache/test_base.py b/tests/unit/python/utils/cache/test_base.py
index a25a5cbac9..044cd168e9 100644
--- a/tests/unit/python/utils/cache/test_base.py
+++ b/tests/unit/python/utils/cache/test_base.py
@@ -111,13 +111,35 @@ class TestStableVariablesSignature(unittest.TestCase):
     def test_empty_variables_collapses_to_canonical_tuple(self):
         self.assertEqual(
             base._stable_variables_signature(None),
-            ("0", "0", "", ""),
+            ("0", "0", "", "", ""),
         )
         self.assertEqual(
             base._stable_variables_signature({}),
-            ("0", "0", "", ""),
+            ("0", "0", "", "", ""),
         )
 
+    def test_two_hosts_of_one_play_do_not_share_a_key(self):
+        shared = {"applications": {"web-app-pretix": {}}, "DOMAIN_PRIMARY": "x.test"}
+        member = base._stable_variables_signature(
+            {**shared, "group_names": ["web-app-pretix", "svc-db-postgres"]}
+        )
+        outsider = base._stable_variables_signature(
+            {**shared, "group_names": ["web-app-pretix"]}
+        )
+
+        self.assertNotEqual(
+            member,
+            outsider,
+            "a service flag may read group_names, so one host's payload must "
+            "never answer for a host whose groups differ",
+        )
+
+    def test_group_order_does_not_split_the_key(self):
+        first = base._stable_variables_signature({"group_names": ["a", "b"]})
+        second = base._stable_variables_signature({"group_names": ["b", "a"]})
+
+        self.assertEqual(first, second)
+
     def test_includes_domain_primary_and_email_domain_strings(self):
         sig = base._stable_variables_signature(
             {
diff --git a/tests/unit/python/utils/cache/test_data.py b/tests/unit/python/utils/cache/test_data.py
index 9744417d79..c8ce41ad14 100644
--- a/tests/unit/python/utils/cache/test_data.py
+++ b/tests/unit/python/utils/cache/test_data.py
@@ -129,8 +129,8 @@ class TestStableVariablesSignature(unittest.TestCase):
         _reset_cache_for_tests()
 
     def test_empty_variables_returns_sentinel(self):
-        self.assertEqual(_stable_variables_signature(None), ("0", "0", "", ""))
-        self.assertEqual(_stable_variables_signature({}), ("0", "0", "", ""))
+        self.assertEqual(_stable_variables_signature(None), ("0", "0", "", "", ""))
+        self.assertEqual(_stable_variables_signature({}), ("0", "0", "", "", ""))
 
     def test_captures_key_subset(self):
         sig = _stable_variables_signature(
diff --git a/tests/unit/python/utils/cache/test_domains.py b/tests/unit/python/utils/cache/test_domains.py
index ae7b2b7c35..c884e16db2 100644
--- a/tests/unit/python/utils/cache/test_domains.py
+++ b/tests/unit/python/utils/cache/test_domains.py
@@ -337,5 +337,71 @@ class TestOnionDomainInjection(unittest.TestCase):
         self.assertEqual(out["web-app-x"], ["infinito.test", self.ONION])
 
 
+class TestOnionFlagsAreRendered(unittest.TestCase):
+    """`services.tor.*` reaches this map as Jinja in 99 of the 105 roles that
+    declare it, and as its own source text whenever the applications render is
+    still in flight. Reading that text as a boolean answers False and drops the
+    onion domains for every app, which is what froze a clearnet asset URL into
+    the applications payload of run 34922994823.
+    """
+
+    ONION = TestOnionDomainInjection.ONION
+    JINJA_ON = "{{ 'svc-net-tor' in group_names }}"
+
+    _apps = TestOnionDomainInjection._apps
+
+    def _templar(self, **variables):
+        from ansible.parsing.dataloader import DataLoader
+        from ansible.template import Templar
+
+        templar = Templar(loader=DataLoader(), variables=dict(variables))
+        templar.available_variables = dict(variables)
+        return templar
+
+    def _inject(self, apps, **variables):
+        return cache_domains._inject_onion_domains(
+            {"web-app-x": ["x.infinito.test"]},
+            apps,
+            "infinito.test",
+            self.ONION,
+            templar=self._templar(**variables),
+            variables=dict(variables),
+        )
+
+    def test_a_templated_enabled_flag_still_injects_the_onion(self):
+        out = self._inject(
+            self._apps(enabled=self.JINJA_ON),
+            group_names=["svc-net-tor", "web-app-x"],
+        )
+
+        self.assertEqual(out["web-app-x"], ["x.infinito.test", f"x.{self.ONION}"])
+
+    def test_a_templated_flag_resolving_false_leaves_the_clearnet_domain(self):
+        out = self._inject(self._apps(enabled=self.JINJA_ON), group_names=["web-app-x"])
+
+        self.assertEqual(out["web-app-x"], ["x.infinito.test"])
+
+    def test_templated_exclusive_replaces_the_clearnet_domain(self):
+        out = self._inject(
+            self._apps(enabled=self.JINJA_ON, exclusive=self.JINJA_ON),
+            group_names=["svc-net-tor", "web-app-x"],
+        )
+
+        self.assertEqual(out["web-app-x"], [f"x.{self.ONION}"])
+
+    def test_a_flag_that_cannot_be_rendered_is_an_error(self):
+        """Without a templar the text cannot resolve, and answering False
+        would drop the onion domains without saying so."""
+        with self.assertRaisesRegex(ValueError, "services.tor.enabled"):
+            cache_domains._inject_onion_domains(
+                {"web-app-x": ["x.infinito.test"]},
+                self._apps(enabled=self.JINJA_ON),
+                "infinito.test",
+                self.ONION,
+                templar=None,
+                variables={"group_names": ["svc-net-tor"]},
+            )
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/unit/python/utils/cache/test_files.py b/tests/unit/python/utils/cache/test_files.py
index b614ed41db..14b554017e 100644
--- a/tests/unit/python/utils/cache/test_files.py
+++ b/tests/unit/python/utils/cache/test_files.py
@@ -164,5 +164,33 @@ class TestReset(_ProjectRootFixture, unittest.TestCase):
         self.assertEqual(read_text(str(self.root / "x.txt")), "v1-changed")
 
 
+class TestWalkIsKeyedOnTheRoot(_ProjectRootFixture, unittest.TestCase):
+    def test_a_second_root_is_walked_rather_than_answered_from_the_first(
+        self,
+    ) -> None:
+        _touch(self.root / "first.txt", "a")
+        self.assertEqual(
+            {str(self.root / "first.txt")},
+            set(iter_project_files()),
+        )
+
+        with TemporaryDirectory() as other:
+            other_root = Path(other)
+            _touch(other_root / "second.txt", "b")
+            with patch.object(files_module, "PROJECT_ROOT", other_root):
+                self.assertEqual(
+                    {str(other_root / "second.txt")},
+                    set(iter_project_files()),
+                    "the walk answered for the previous root, so a test that "
+                    "points PROJECT_ROOT at a fixture silently sweeps the real "
+                    "repository instead",
+                )
+
+        self.assertEqual(
+            {str(self.root / "first.txt")},
+            set(iter_project_files()),
+        )
+
+
 if __name__ == "__main__":  # pragma: no cover
     unittest.main()
diff --git a/tests/unit/python/utils/docker/test_image_pin.py b/tests/unit/python/utils/docker/test_image_pin.py
new file mode 100644
index 0000000000..bf95b2650d
--- /dev/null
+++ b/tests/unit/python/utils/docker/test_image_pin.py
@@ -0,0 +1,99 @@
+from __future__ import annotations
+
+import unittest
+
+from utils.docker.image.discovery import docker_hub_source, image_source
+from utils.docker.image.pin import (
+    DIGEST,
+    REF,
+    RULE_BY_CLASS,
+    SEMVER,
+    is_digest,
+    pin_class,
+    pull_reference,
+    reference_separator,
+)
+
+DIGEST_VALUE = "sha256:d5591131b1d898cd02fc7a17adb8ea026352d67809bc9289707778e9e03a76a4"
+
+
+class TestPinClass(unittest.TestCase):
+    def test_a_semver_tag_is_a_semver_pin(self):
+        for value in ("3.0.1", "16", "17-3.5", "5.4.5-php8.3-apache", "v1.12.27"):
+            self.assertEqual(pin_class(value), SEMVER, value)
+
+    def test_a_content_address_is_a_digest_pin(self):
+        self.assertEqual(pin_class(DIGEST_VALUE), DIGEST)
+
+    def test_a_moving_name_is_neither(self):
+        for value in ("latest", "main", "stable", "buildx-stable-1"):
+            self.assertEqual(pin_class(value), REF, value)
+
+    def test_surrounding_whitespace_does_not_change_the_class(self):
+        self.assertEqual(pin_class(f"  {DIGEST_VALUE}  "), DIGEST)
+        self.assertEqual(pin_class("  3.0.1  "), SEMVER)
+
+    def test_a_digest_declares_itself_apart_from_a_tag(self):
+        self.assertNotEqual(
+            RULE_BY_CLASS[DIGEST],
+            RULE_BY_CLASS[REF],
+            "a digest is chosen for a reason a non-semver tag never carries, so "
+            "the two cannot share one marker",
+        )
+        self.assertEqual(RULE_BY_CLASS[DIGEST], "docker-digest")
+        self.assertEqual(RULE_BY_CLASS[REF], "docker-version")
+
+    def test_a_semver_pin_needs_no_declaration(self):
+        self.assertNotIn(SEMVER, RULE_BY_CLASS)
+
+
+class TestPullReference(unittest.TestCase):
+    def test_a_digest_is_joined_with_an_at_sign(self):
+        self.assertEqual(reference_separator(DIGEST_VALUE), "@")
+        self.assertEqual(
+            pull_reference("ghcr.io/owner/app", DIGEST_VALUE),
+            f"ghcr.io/owner/app@{DIGEST_VALUE}",
+        )
+
+    def test_a_tag_is_joined_with_a_colon(self):
+        self.assertEqual(reference_separator("3.0.1"), ":")
+        self.assertEqual(
+            pull_reference("ghcr.io/owner/app", "3.0.1"), "ghcr.io/owner/app:3.0.1"
+        )
+
+    def test_is_digest_rejects_a_tag_that_merely_mentions_sha256(self):
+        self.assertFalse(is_digest("v2-sha256:abc"))
+
+
+class TestSourceKeepsTheDigest(unittest.TestCase):
+    """A pull ref that silently drops the digest pins nothing at all."""
+
+    def test_image_source_keeps_a_digest(self):
+        self.assertEqual(
+            image_source("ghcr.io/owner/app", DIGEST_VALUE),
+            f"ghcr.io/owner/app@{DIGEST_VALUE}",
+        )
+
+    def test_image_source_still_tags_a_semver(self):
+        self.assertEqual(
+            image_source("ghcr.io/owner/app", "3.0.1"), "ghcr.io/owner/app:3.0.1"
+        )
+
+    def test_docker_hub_source_keeps_a_digest(self):
+        self.assertEqual(
+            docker_hub_source("postgres", DIGEST_VALUE),
+            f"docker.io/library/postgres@{DIGEST_VALUE}",
+        )
+
+    def test_a_digest_never_yields_a_tag_separator(self):
+        source = image_source("quay.io/owner/app", DIGEST_VALUE)
+
+        self.assertNotIn(
+            f":{DIGEST_VALUE}",
+            source,
+            "a colon here would make the registry read the digest as a tag name",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/utils/github/variant/test_selection.py b/tests/unit/python/utils/github/variant/test_selection.py
index 9c990f9110..f150d7378e 100644
--- a/tests/unit/python/utils/github/variant/test_selection.py
+++ b/tests/unit/python/utils/github/variant/test_selection.py
@@ -199,6 +199,11 @@ class TestApply(unittest.TestCase):
     def test_a_bare_role_that_matches_nothing_is_tolerated(self) -> None:
         self.assertEqual(selection.apply(_ROWS, selection.parse_list("web-app-c")), [])
 
+    def test_a_pin_on_an_undiscovered_role_is_tolerated_like_a_bare_one(self) -> None:
+        self.assertEqual(
+            selection.apply(_ROWS, selection.parse_list("web-app-c#0,2")), []
+        )
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/unit/python/utils/install/test_collections.py b/tests/unit/python/utils/install/test_collections.py
new file mode 100644
index 0000000000..8ff53e96cb
--- /dev/null
+++ b/tests/unit/python/utils/install/test_collections.py
@@ -0,0 +1,260 @@
+import json
+import re
+import shutil
+import subprocess
+import sys
+import unittest
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from utils import PROJECT_ROOT
+from utils.cache.files import read_text
+from utils.cache.yaml import load_yaml_any
+from utils.install.collections import declared_pins, unsatisfied
+
+_DOCKERFILE = PROJECT_ROOT / "Dockerfile"
+_COPY = re.compile(r"^COPY\s+(?P<source>\S+)\s+\$\{INFINITO_SRC_DIR\}/(?P<target>\S+)$")
+
+
+def _materialise_image_slice(destination: Path) -> None:
+    """Reproduce what the image holds when it first runs the collection check.
+
+    The Dockerfile copies a handful of paths, runs ``scripts/install/ansible.sh``
+    against them, and only afterwards copies the rest of the tree. Anything
+    ``utils.install.collections`` imports beyond that slice is absent in the
+    layer that executes it, which no import inside a full checkout can show.
+    The list is read from the Dockerfile rather than restated here, so a COPY
+    added or dropped moves this probe with it.
+
+    The caller must run the slice under ``python -S``. This repository installs
+    ``utils`` into site-packages, so without it the interpreter resolves every
+    submodule from the checkout however the slice is built, and the probe
+    passes on a module that cannot import inside the image.
+
+    Args:
+        destination: an empty directory to build the slice in.
+    """
+    for line in read_text(str(_DOCKERFILE)).splitlines():
+        if line.startswith("COPY . "):
+            return
+        match = _COPY.match(line.strip())
+        if not match:
+            continue
+        source = PROJECT_ROOT / match.group("source")
+        target = destination / match.group("target")
+        target.parent.mkdir(parents=True, exist_ok=True)
+        if source.is_dir():
+            shutil.copytree(source, target, dirs_exist_ok=True)
+        else:
+            shutil.copy2(source, target)
+
+
+_REQUIREMENTS = (
+    PROJECT_ROOT / "requirements" / "requirements.galaxy.yml",
+    PROJECT_ROOT / "requirements" / "requirements.git.yml",
+)
+
+_BOOTSTRAP_PROBE = """
+import sys
+
+
+class _NoPyYAML:
+    def find_spec(self, fullname, path=None, target=None):
+        if fullname == "yaml" or fullname.startswith("yaml."):
+            raise ImportError("PyYAML is absent during the lint bootstrap")
+        return None
+
+
+sys.meta_path.insert(0, _NoPyYAML())
+
+from pathlib import Path
+
+from utils.install.lint.ansible import collections as lint_collections
+from utils.install.collections import declared_pins
+
+for fqcn, version in declared_pins(Path("requirements/requirements.galaxy.yml")):
+    print(fqcn, version)
+"""
+
+REQUIREMENTS = """---
+collections:
+  - name: community.general
+    version: 13.4.0
+  - name: hetzner.hcloud
+    version: 7.0.1
+"""
+
+
+def _write_requirements(root: Path, body: str = REQUIREMENTS) -> Path:
+    path = root / "requirements.galaxy.yml"
+    path.write_text(body, encoding="utf-8")
+    return path
+
+
+def _install(collections_dir: Path, fqcn: str, version: str) -> None:
+    namespace, _, name = fqcn.partition(".")
+    target = collections_dir / "ansible_collections" / namespace / name
+    target.mkdir(parents=True)
+    (target / "MANIFEST.json").write_text(
+        json.dumps({"collection_info": {"version": version}}), encoding="utf-8"
+    )
+
+
+class TestAgainstPyYAML(unittest.TestCase):
+    def test_the_hand_parser_agrees_with_pyyaml(self):
+        for path in _REQUIREMENTS:
+            with self.subTest(requirements=path.name):
+                declared = load_yaml_any(str(path), default_if_missing={}) or {}
+                expected = [
+                    (str(entry.get("name")), entry.get("version"))
+                    for entry in declared.get("collections") or []
+                    if isinstance(entry, dict) and entry.get("name")
+                ]
+                expected = [
+                    (name, None if version is None else str(version))
+                    for name, version in expected
+                ]
+
+                self.assertEqual(declared_pins(path), expected)
+
+    def test_the_parser_runs_with_pyyaml_unimportable(self):
+        result = subprocess.run(
+            [sys.executable, "-c", _BOOTSTRAP_PROBE],
+            cwd=str(PROJECT_ROOT),
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("community.general", result.stdout)
+
+    def test_the_checker_runs_on_the_slice_the_dockerfile_copies(self):
+        tmp = TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        slice_root = Path(tmp.name)
+        _materialise_image_slice(slice_root)
+        requirements = slice_root / "requirements" / "requirements.galaxy.yml"
+        self.assertTrue(
+            requirements.is_file(),
+            "the Dockerfile stopped copying requirements/ before the ansible "
+            "install layer; this probe needs it to have something to check",
+        )
+
+        result = subprocess.run(
+            [
+                sys.executable,
+                "-S",
+                "-m",
+                "utils.install.collections",
+                str(requirements),
+                str(slice_root / "collections"),
+            ],
+            cwd=str(slice_root),
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+
+        self.assertNotIn(
+            "ModuleNotFoundError",
+            result.stderr,
+            "utils.install.collections reached for a module the image layer "
+            "that runs it does not hold; keep it on the standard library",
+        )
+        self.assertEqual(
+            result.returncode,
+            1,
+            f"an empty collections dir satisfies nothing, so the checker owes "
+            f"exit 1 and a list; stderr: {result.stderr}",
+        )
+        self.assertIn("community.general", result.stdout)
+
+
+class TestDeclaredPins(unittest.TestCase):
+    def test_a_quoted_version_is_read_without_its_quotes(self):
+        body = (
+            "---\ncollections:\n"
+            '  - name: double.quoted\n    version: "13.4.0"\n'
+            "  - name: single.quoted\n    version: '1.0.0'\n"
+            "  - name: commented\n    version: 2.2.2 # pinned\n"
+        )
+        with TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            requirements = _write_requirements(root, body)
+
+            self.assertEqual(
+                declared_pins(requirements),
+                [
+                    ("double.quoted", "13.4.0"),
+                    ("single.quoted", "1.0.0"),
+                    ("commented", "2.2.2"),
+                ],
+            )
+
+    def test_an_entry_without_a_version_stays_unpinned(self):
+        body = "---\ncollections:\n  - name: bare.entry\n"
+        with TemporaryDirectory() as tmp:
+            root = Path(tmp)
+
+            self.assertEqual(
+                declared_pins(_write_requirements(root, body)), [("bare.entry", None)]
+            )
+
+    def test_a_missing_file_declares_nothing(self):
+        with TemporaryDirectory() as tmp:
+            self.assertEqual(declared_pins(Path(tmp) / "absent.yml"), [])
+
+
+class TestUnsatisfied(unittest.TestCase):
+    def test_every_pin_installed_at_its_version_is_satisfied(self):
+        with TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            requirements = _write_requirements(root)
+            _install(root, "community.general", "13.4.0")
+            _install(root, "hetzner.hcloud", "7.0.1")
+
+            self.assertEqual(unsatisfied(requirements, root), [])
+
+    def test_absent_collection_is_reported(self):
+        with TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            requirements = _write_requirements(root)
+            _install(root, "community.general", "13.4.0")
+
+            self.assertEqual(unsatisfied(requirements, root), ["hetzner.hcloud:7.0.1"])
+
+    def test_wrong_version_is_reported_although_the_directory_exists(self):
+        with TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            requirements = _write_requirements(root)
+            _install(root, "community.general", "13.4.0")
+            _install(root, "hetzner.hcloud", "6.9.0")
+
+            self.assertEqual(unsatisfied(requirements, root), ["hetzner.hcloud:7.0.1"])
+
+    def test_unpinned_entry_can_never_be_confirmed(self):
+        body = "---\ncollections:\n  - name: community.general\n"
+        with TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            requirements = _write_requirements(root, body)
+            _install(root, "community.general", "13.4.0")
+
+            self.assertEqual(unsatisfied(requirements, root), ["community.general"])
+
+    def test_unreadable_manifest_is_reported(self):
+        with TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            requirements = _write_requirements(root)
+            _install(root, "community.general", "13.4.0")
+            _install(root, "hetzner.hcloud", "7.0.1")
+            manifest = (
+                root / "ansible_collections" / "hetzner" / "hcloud" / "MANIFEST.json"
+            )
+            manifest.write_text("{not json", encoding="utf-8")
+
+            self.assertEqual(unsatisfied(requirements, root), ["hetzner.hcloud:7.0.1"])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/utils/manager/test_inventory_manager.py b/tests/unit/python/utils/manager/test_inventory_manager.py
index 5740a345a5..96a98c2b60 100644
--- a/tests/unit/python/utils/manager/test_inventory_manager.py
+++ b/tests/unit/python/utils/manager/test_inventory_manager.py
@@ -1,13 +1,16 @@
 import base64
 import tempfile
 from pathlib import Path
+from typing import ClassVar
 from unittest import TestCase, main, mock
 
 from cryptography.hazmat.primitives.asymmetric import ec
 from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
 
+from utils.cache.files import PROJECT_ROOT
+from utils.cache.yaml import load_yaml_any
 from utils.handler.vault import VaultScalar
-from utils.manager.inventory import InventoryManager
+from utils.manager.inventory import InventoryManager, validate_supplied_value
 from utils.manager.value_generator import ValueGenerator
 from utils.roles.mapping import (
     ROLE_FILE_META_SECRETS,
@@ -760,5 +763,104 @@ class TestInventoryManagerVariant(TestCase):
             self.assertEqual(cfg, {})
 
 
+class TestSuppliedValueValidation(TestCase):
+    """A schema that declares a shape must reject a value contradicting it.
+
+    Without this the declaration is decoration: the 192 `validation:` blocks
+    already in the role schemas are enforced nowhere, and a `regex` would have
+    joined them.
+    """
+
+    SCHEMA: ClassVar[dict[str, str]] = {
+        "type": "string",
+        "regex": "sk-[A-Za-z0-9]{4,}",
+    }
+
+    def test_a_matching_value_passes(self):
+        validate_supplied_value("credentials.api_key", "sk-abcd1234", self.SCHEMA)
+
+    def test_an_empty_value_is_not_configured_and_passes(self):
+        validate_supplied_value("credentials.api_key", "", self.SCHEMA)
+        validate_supplied_value("credentials.api_key", None, self.SCHEMA)
+
+    def test_a_value_failing_the_pattern_aborts(self):
+        with self.assertRaises(SystemExit):
+            validate_supplied_value("credentials.api_key", "nope", self.SCHEMA)
+
+    def test_a_partial_match_is_not_enough(self):
+        with self.assertRaises(SystemExit):
+            validate_supplied_value("credentials.api_key", "sk-ab!!", self.SCHEMA)
+
+    def test_a_value_of_the_wrong_type_aborts(self):
+        with self.assertRaises(SystemExit):
+            validate_supplied_value("credentials.port", 8080, {"type": "string"})
+
+    def test_an_unknown_declared_type_aborts(self):
+        with self.assertRaises(SystemExit):
+            validate_supplied_value("credentials.x", "v", {"type": "uuid"})
+
+    def test_a_schema_declaring_neither_accepts_anything(self):
+        validate_supplied_value("credentials.x", "anything", {"description": "free"})
+
+    def test_an_unrendered_template_is_not_a_value(self):
+        for value in ("{{ API.openai.api_key }}", "{% if x %}a{% endif %}"):
+            with self.subTest(value=value):
+                validate_supplied_value("credentials.api_key", value, self.SCHEMA)
+
+
+class TestProviderKeyPattern(TestCase):
+    """The shipped provider-key pattern must outlive a vendor's format change.
+
+    OpenAI moved from `sk-` to `sk-proj-` without notice. A schema that pinned
+    the prefix would reject a valid key and abort inventory creation, so the
+    pattern checks what a paste can get wrong instead.
+    """
+
+    ACCEPTED: ClassVar[tuple[str, ...]] = (
+        "sk-proj-AbCdEfGh1234567890xyz",
+        "sk-ant-api03-AbCdEfGh1234567890",
+        "sk-or-v1-AbCdEfGh1234567890abc",
+        "sk-AbCdEfGh1234567890legacyKey",
+        "some-future-format-2099-abcdef",
+    )
+    REJECTED: ClassVar[tuple[str, ...]] = (
+        "sk-proj-AbCdEfGh1234567890xyz\n",
+        "sk-short",
+        "<your-key-here>",
+        "sk-proj-Ab Cd 1234567890 xyz",
+    )
+
+    def _credentials(self) -> dict:
+        path = PROJECT_ROOT / "roles/svc-ai-litellm" / ROLE_FILE_META_SECRETS
+        return load_yaml_any(str(path))["credentials"]
+
+    def _schema(self) -> dict:
+        return self._credentials()["openai_api_key"]
+
+    def test_every_declared_default_survives_its_own_schema(self):
+        """A default is written verbatim and read back as a supplied value.
+
+        Run 34883491022 died in every job because the provider keys' own
+        `{{ API.<vendor>.api_key }}` reached the pattern on the second read.
+        """
+        for key, schema in self._credentials().items():
+            if "default" not in schema:
+                continue
+            with self.subTest(key=key):
+                validate_supplied_value(f"credentials.{key}", schema["default"], schema)
+
+    def test_every_known_provider_form_is_accepted(self):
+        schema = self._schema()
+        for value in self.ACCEPTED:
+            with self.subTest(value=value):
+                validate_supplied_value("credentials.openai_api_key", value, schema)
+
+    def test_a_broken_paste_is_rejected(self):
+        schema = self._schema()
+        for value in self.REJECTED:
+            with self.subTest(value=value), self.assertRaises(SystemExit):
+                validate_supplied_value("credentials.openai_api_key", value, schema)
+
+
 if __name__ == "__main__":
     main()
diff --git a/tests/unit/python/utils/roles/applications/services/test_registry.py b/tests/unit/python/utils/roles/applications/services/test_registry.py
index ab7de60a13..f27085ea7c 100644
--- a/tests/unit/python/utils/roles/applications/services/test_registry.py
+++ b/tests/unit/python/utils/roles/applications/services/test_registry.py
@@ -4,12 +4,15 @@ import tempfile
 import unittest
 from pathlib import Path
 
+from utils.cache.files import PROJECT_ROOT, read_text
 from utils.cache.yaml import dump_yaml_str
 from utils.roles.applications.services.registry import (
+    GROUP_GATED_CONSTANTS,
     ServiceRegistryError,
     build_service_registry_from_applications,
     detect_service_bucket,
     detect_service_channel,
+    is_explicit_truth,
     ordered_primary_service_entries,
     resolve_service_dependency_roles_from_config,
 )
@@ -335,5 +338,40 @@ class TestServiceRegistryOrdering(unittest.TestCase):
                 ordered_primary_service_entries(registry, roles_dir)
 
 
+class TestExplicitTruth(unittest.TestCase):
+    """A flag may resolve a dependency through a group-gated constant.
+
+    The substring rule reads the role id out of the flag itself, so a SPOT
+    constant hides it. Roles referencing one keep their provider only while
+    the constant is registered.
+    """
+
+    def test_a_literal_true_resolves(self):
+        self.assertTrue(is_explicit_truth(True))
+
+    def test_the_in_group_names_form_resolves(self):
+        self.assertTrue(is_explicit_truth("{{ 'web-app-keycloak' in group_names }}"))
+
+    def test_every_registered_constant_resolves(self):
+        for constant in GROUP_GATED_CONSTANTS:
+            with self.subTest(constant=constant):
+                self.assertTrue(is_explicit_truth("{{ " + constant + " }}"))
+
+    def test_an_unregistered_jinja_expression_does_not_resolve(self):
+        self.assertFalse(
+            is_explicit_truth("{{ lookup('config', 'web-app-gitea', 'mcp.enabled') }}")
+        )
+
+    def test_a_literal_false_does_not_resolve(self):
+        self.assertFalse(is_explicit_truth(False))
+
+    def test_every_registered_constant_is_defined_in_group_vars(self):
+        group_vars = PROJECT_ROOT / "group_vars" / "all"
+        defined = "".join(read_text(str(path)) for path in group_vars.glob("*.yml"))
+        for constant in GROUP_GATED_CONSTANTS:
+            with self.subTest(constant=constant):
+                self.assertIn(f"{constant}:", defined)
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/unit/python/cli/administration/deploy/development/inventory/test_nested_overrides.py b/tests/unit/python/utils/roles/applications/test_variants_overrides.py
similarity index 91%
rename from tests/unit/python/cli/administration/deploy/development/inventory/test_nested_overrides.py
rename to tests/unit/python/utils/roles/applications/test_variants_overrides.py
index a473f1031d..a59edde7ba 100644
--- a/tests/unit/python/cli/administration/deploy/development/inventory/test_nested_overrides.py
+++ b/tests/unit/python/utils/roles/applications/test_variants_overrides.py
@@ -1,4 +1,4 @@
-"""Unit tests for `cli.administration.deploy.development.inventory.nested_overrides`.
+"""Unit tests for `utils.roles.applications.variants`' provider overrides.
 
 The service registry is stubbed: what matters is which role a claim is
 attributed to, not how a service key resolves to its provider.
@@ -9,7 +9,7 @@ from __future__ import annotations
 import unittest
 from unittest.mock import patch
 
-from cli.administration.deploy.development.inventory.nested_overrides import (
+from utils.roles.applications.variants import (
     NestedOverrideConflictError,
     collect_provider_overrides,
 )
@@ -19,10 +19,7 @@ _REGISTRY = {
     "gitea": {"role": "web-app-gitea"},
 }
 
-_PATCH = (
-    "cli.administration.deploy.development.inventory.nested_overrides"
-    ".build_service_registry_from_roles_dir"
-)
+_PATCH = "utils.roles.applications.variants.build_service_registry_from_roles_dir"
 
 
 class TestCollectProviderOverrides(unittest.TestCase):
diff --git a/tests/unit/python/utils/test_api.py b/tests/unit/python/utils/test_api.py
new file mode 100644
index 0000000000..1a48d495b9
--- /dev/null
+++ b/tests/unit/python/utils/test_api.py
@@ -0,0 +1,51 @@
+import unittest
+
+from utils.api import declared_api, provider_enabled, resolve_api
+
+
+class TestResolveApi(unittest.TestCase):
+    def test_a_partial_override_keeps_the_declared_providers(self) -> None:
+        declared = declared_api()
+        self.assertIn("github", declared)
+
+        resolved = resolve_api({"API": {"openai": {"api_key": "sk-test"}}})
+
+        self.assertEqual(set(resolved), set(declared))
+        self.assertEqual(resolved["openai"]["api_key"], "sk-test")
+        self.assertEqual(resolved["github"]["client_id"], "")
+
+    def test_an_override_wins_per_key(self) -> None:
+        resolved = resolve_api({"API": {"github": {"client_id": "ID42"}}})
+
+        self.assertEqual(resolved["github"]["client_id"], "ID42")
+        self.assertEqual(resolved["github"]["client_secret"], "")
+
+    def test_a_missing_api_falls_back_to_the_declaration(self) -> None:
+        self.assertEqual(resolve_api({}), declared_api())
+
+    def test_a_non_mapping_api_is_an_error(self) -> None:
+        with self.assertRaises(TypeError):
+            resolve_api({"API": "nope"})
+
+
+class TestProviderEnabled(unittest.TestCase):
+    def test_every_credential_must_carry_a_value(self) -> None:
+        api = {"github": {"client_id": "ID42", "client_secret": "SEC42"}}
+
+        self.assertTrue(provider_enabled(api, "github"))
+
+    def test_one_empty_credential_disables_the_provider(self) -> None:
+        api = {"github": {"client_id": "ID42", "client_secret": "   "}}
+
+        self.assertFalse(provider_enabled(api, "github"))
+
+    def test_a_provider_without_credentials_is_disabled(self) -> None:
+        self.assertFalse(provider_enabled({"github": {}}, "github"))
+
+    def test_an_undeclared_provider_is_an_error(self) -> None:
+        with self.assertRaises(KeyError):
+            provider_enabled({}, "github")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/utils/tests/swarm/test_matrix_run_reporting.py b/tests/unit/python/utils/tests/swarm/test_run_reporting.py
similarity index 86%
rename from tests/unit/python/utils/tests/swarm/test_matrix_run_reporting.py
rename to tests/unit/python/utils/tests/swarm/test_run_reporting.py
index 4f27992dcb..ea14038c7a 100644
--- a/tests/unit/python/utils/tests/swarm/test_matrix_run_reporting.py
+++ b/tests/unit/python/utils/tests/swarm/test_run_reporting.py
@@ -3,7 +3,7 @@ import io
 import unittest
 from unittest import mock
 
-from utils.tests.swarm import matrix
+from utils.tests.swarm import run
 
 
 class TestRunReporting(unittest.TestCase):
@@ -18,10 +18,10 @@ class TestRunReporting(unittest.TestCase):
     def _run_capturing(self, rc: int) -> tuple[int, str]:
         buffer = io.StringIO()
         with (
-            mock.patch.object(matrix, "_run_watched", return_value=rc) as watched,
+            mock.patch.object(run, "run_watched", return_value=rc) as watched,
             contextlib.redirect_stdout(buffer),
         ):
-            returned = matrix._run(["true"], env={"A": "b"}, label="demo phase")
+            returned = run.run_step(["true"], env={"A": "b"}, label="demo phase")
         watched.assert_called_once_with(["true"], env={"A": "b"})
         return returned, buffer.getvalue()
 
diff --git a/tests/unit/python/utils/update/test_base_pin_families.py b/tests/unit/python/utils/update/test_base_pin_families.py
new file mode 100644
index 0000000000..564fcab71a
--- /dev/null
+++ b/tests/unit/python/utils/update/test_base_pin_families.py
@@ -0,0 +1,143 @@
+"""Immutable tags the updater could not order before.
+
+Two shapes reach the repository that name a fixed release yet failed the semver
+gate, so the bump job skipped them and nothing could tell whether a newer one
+existed: a vendor patch counter such as ``2.4.0p32`` and a five-component
+version such as ``26.04.2.1.1``.
+"""
+
+from __future__ import annotations
+
+import unittest
+
+from utils.update.base import (
+    is_semver,
+    latest_semver,
+    version_depth,
+    version_flavor,
+    version_key,
+)
+
+
+def _latest(current: str, tags: list[str]) -> str | None:
+    return latest_semver(tags, version_depth(current), version_flavor(current))
+
+
+class TestPatchCounterTags(unittest.TestCase):
+    def test_a_patch_counter_is_orderable(self):
+        self.assertTrue(is_semver("2.4.0p32"))
+
+    def test_it_bumps_within_its_own_counter(self):
+        self.assertEqual(_latest("2.4.0p32", ["2.4.0p32", "2.4.0p33"]), "2.4.0p33")
+
+    def test_the_counter_orders_numerically_not_lexically(self):
+        self.assertEqual(_latest("2.4.0p9", ["2.4.0p9", "2.4.0p10"]), "2.4.0p10")
+
+    def test_a_later_release_wins_over_a_later_counter(self):
+        self.assertEqual(_latest("2.4.0p32", ["2.4.0p99", "2.4.1p1"]), "2.4.1p1")
+
+    def test_it_never_crosses_into_a_four_component_version(self):
+        self.assertEqual(
+            _latest("2.4.0p32", ["2.4.0p32", "2.4.0.99"]),
+            "2.4.0p32",
+            "2.4.0.99 is a different tag family and bumping into it would "
+            "silently change what the role deploys",
+        )
+
+    def test_the_counter_letter_keeps_families_apart(self):
+        self.assertEqual(version_flavor("2.4.0p32"), "p")
+        self.assertEqual(version_flavor("2.4.0.32"), "")
+        self.assertNotEqual(version_depth("2.4.0p32"), version_depth("2.4.0.32"))
+
+    def test_a_plain_release_does_not_bump_into_a_counter(self):
+        self.assertEqual(_latest("2.4.0", ["2.4.0", "2.4.0p1"]), "2.4.0")
+
+
+class TestFiveComponentTags(unittest.TestCase):
+    def test_five_components_are_orderable(self):
+        self.assertTrue(is_semver("26.04.2.1.1"))
+        self.assertEqual(version_depth("26.04.2.1.1"), 5)
+
+    def test_it_bumps_within_its_own_depth(self):
+        self.assertEqual(
+            _latest("26.04.2.1.1", ["26.04.2.1.1", "26.04.2.1.2"]), "26.04.2.1.2"
+        )
+
+    def test_it_never_crosses_into_a_shorter_version(self):
+        self.assertEqual(
+            _latest("26.04.2.1.1", ["26.04.2.1.1", "27.0.0.0"]), "26.04.2.1.1"
+        )
+
+
+class TestNothingElseChanged(unittest.TestCase):
+    """The shapes the updater already handled must keep their family key."""
+
+    def test_known_shapes_keep_their_classification(self):
+        cases = {
+            "1.2.3": (True, 3, "", (1, 2, 3, 0)),
+            "v1.12.27": (True, 3, "", (1, 12, 27, 0)),
+            "16": (True, 1, "", (16, 0, 0, 0)),
+            "5.4.5-php8.3-apache": (True, 3, "-php8.3-apache", (5, 4, 5, 0)),
+        }
+
+        for tag, (semver, depth, flavor, key) in cases.items():
+            self.assertEqual(is_semver(tag), semver, tag)
+            self.assertEqual(version_depth(tag), depth, tag)
+            self.assertEqual(version_flavor(tag), flavor, tag)
+            self.assertEqual(version_key(tag), key, tag)
+
+    def test_moving_names_are_still_refused(self):
+        for tag in ("latest", "stable", "lts", "alpine", "main"):
+            self.assertFalse(is_semver(tag), tag)
+
+    def test_a_flavored_tag_still_refuses_a_different_runtime(self):
+        self.assertEqual(
+            _latest("5.4.5-php8.3-apache", ["5.4.6-php8.4-apache", "5.4.6"]),
+            None,
+        )
+
+
+class TestChannelPrefixedTags(unittest.TestCase):
+    """A release line written before the number is a family, not a version."""
+
+    def test_a_channel_prefixed_tag_is_orderable(self):
+        self.assertTrue(is_semver("main-v1.77.7-stable"))
+        self.assertEqual(version_depth("main-v1.77.7-stable"), 3)
+        self.assertEqual(version_key("main-v1.77.7-stable"), (1, 77, 7, 0))
+
+    def test_it_bumps_inside_its_own_channel(self):
+        tags = ["main-v1.77.7-stable", "main-v1.83.14-stable"]
+        self.assertEqual(_latest("main-v1.77.7-stable", tags), "main-v1.83.14-stable")
+
+    def test_it_never_crosses_into_a_sibling_channel(self):
+        tags = ["main-v1.83.14-nightly", "main-v1.83.14-stable"]
+        self.assertEqual(_latest("main-v1.77.7-stable", tags), "main-v1.83.14-stable")
+        self.assertEqual(_latest("main-v1.77.7-nightly", tags), "main-v1.83.14-nightly")
+
+    def test_a_bare_number_is_a_different_family_than_a_channelled_one(self):
+        self.assertNotEqual(version_flavor("stable-9646"), version_flavor("9646"))
+        self.assertEqual(
+            _latest("stable-9646", ["stable-9646", "9999"]),
+            "stable-9646",
+            "a bare build number leaves the stable channel and would change "
+            "what the role deploys",
+        )
+
+    def test_it_bumps_inside_the_stable_channel(self):
+        self.assertEqual(
+            _latest("stable-9646", ["stable-9646", "stable-9999"]), "stable-9999"
+        )
+
+    def test_a_channel_without_a_number_stays_refused(self):
+        for tag in ("act-latest", "bookworm-slim", "main-latest", "buildx-stable-1"):
+            self.assertFalse(is_semver(tag), tag)
+
+    def test_a_date_stamped_tag_orders_as_one_number(self):
+        self.assertEqual(version_depth("20260917"), 1)
+        self.assertEqual(
+            _latest("20260702", ["20260702", "20260706", "20260917"]), "20260917"
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/utils/update/test_collection_source.py b/tests/unit/python/utils/update/test_collection_source.py
new file mode 100644
index 0000000000..fa0075d497
--- /dev/null
+++ b/tests/unit/python/utils/update/test_collection_source.py
@@ -0,0 +1,114 @@
+import json
+import unittest
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from utils.update.collection_source import (
+    RATIO,
+    WINDOW,
+    append_sample,
+    decide,
+    load_history,
+)
+
+
+def _samples(galaxy, git, count=WINDOW):
+    return [{"galaxy": galaxy, "git": git} for _ in range(count)]
+
+
+class TestAppendSample(unittest.TestCase):
+    def test_the_window_never_grows_past_its_size(self):
+        history = _samples(10.0, 10.0, WINDOW)
+
+        grown = append_sample(history, {"galaxy": 99.0, "git": 1.0})
+
+        self.assertEqual(len(grown), WINDOW)
+        self.assertEqual(grown[-1], {"galaxy": 99.0, "git": 1.0})
+
+    def test_the_oldest_sample_is_the_one_dropped(self):
+        history = [{"galaxy": float(i), "git": 1.0} for i in range(WINDOW)]
+
+        grown = append_sample(history, {"galaxy": 99.0, "git": 1.0})
+
+        self.assertEqual(grown[0]["galaxy"], 1.0)
+
+
+class TestDecide(unittest.TestCase):
+    def test_below_a_full_window_the_default_is_left_alone(self):
+        history = _samples(300.0, 10.0, WINDOW - 1)
+
+        verdict = decide(history, "galaxy")
+
+        self.assertFalse(verdict.changed)
+        self.assertEqual(verdict.samples, WINDOW - 1)
+
+    def test_exactly_the_ratio_swaps_the_preferred_source(self):
+        history = _samples(30.0, 10.0)
+
+        verdict = decide(history, "galaxy")
+
+        self.assertTrue(verdict.changed)
+        self.assertEqual(verdict.proposed, "git")
+
+    def test_just_under_the_ratio_keeps_the_preferred_source(self):
+        history = _samples(10.0 * RATIO - 0.1, 10.0)
+
+        self.assertFalse(decide(history, "galaxy").changed)
+
+    def test_a_failed_install_ranks_worse_than_any_duration(self):
+        history = _samples(None, 10.0)
+
+        verdict = decide(history, "galaxy")
+
+        self.assertTrue(verdict.changed)
+        self.assertEqual(verdict.proposed, "git")
+        self.assertEqual(verdict.medians["galaxy"], float("inf"))
+
+    def test_the_faster_source_is_never_swapped_away_from(self):
+        history = _samples(10.0, 300.0)
+
+        self.assertFalse(decide(history, "galaxy").changed)
+
+    def test_both_sources_failing_changes_nothing(self):
+        history = _samples(None, None)
+
+        self.assertFalse(decide(history, "galaxy").changed)
+
+    def test_a_single_outlier_does_not_move_the_median(self):
+        history = _samples(10.0, 10.0, WINDOW - 1)
+        history = append_sample(history, {"galaxy": 9000.0, "git": 10.0})
+
+        self.assertFalse(decide(history, "galaxy").changed)
+
+    def test_the_verdict_is_taken_from_the_preferred_side(self):
+        history = _samples(10.0, 30.0)
+
+        verdict = decide(history, "git")
+
+        self.assertTrue(verdict.changed)
+        self.assertEqual(verdict.proposed, "galaxy")
+
+
+class TestLoadHistory(unittest.TestCase):
+    def test_a_missing_file_reads_as_an_empty_history(self):
+        with TemporaryDirectory() as tmp:
+            self.assertEqual(load_history(Path(tmp) / "absent.json"), [])
+
+    def test_a_corrupt_file_reads_as_an_empty_history(self):
+        with TemporaryDirectory() as tmp:
+            path = Path(tmp) / "history.json"
+            path.write_text("{not json", encoding="utf-8")
+
+            self.assertEqual(load_history(path), [])
+
+    def test_a_written_history_round_trips(self):
+        with TemporaryDirectory() as tmp:
+            path = Path(tmp) / "history.json"
+            history = _samples(1.0, 2.0, 3)
+            path.write_text(json.dumps(history), encoding="utf-8")
+
+            self.assertEqual(load_history(path), history)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/utils/update/test_docker_release_groups.py b/tests/unit/python/utils/update/test_docker_release_groups.py
new file mode 100644
index 0000000000..72b6c22256
--- /dev/null
+++ b/tests/unit/python/utils/update/test_docker_release_groups.py
@@ -0,0 +1,112 @@
+"""Several images of one role at one version move together or not at all.
+
+Upstream does not push a release group atomically. Measured on Docker Hub:
+``jitsi/prosody``, ``jitsi/jicofo`` and ``jitsi/jvb`` all publish
+``stable-9457`` while ``jitsi/web`` does not, so a bump run landing in that
+window would raise three components and leave the fourth behind.
+"""
+
+from __future__ import annotations
+
+import unittest
+from pathlib import Path
+
+from utils.roles.mapping import ROLE_FILE_META_SERVICES
+from utils.update.docker import (
+    DockerImageVersionEntry,
+    DockerImageVersionUpdate,
+    _held_to_release_groups,
+)
+
+JITSI = ("web", "prosody", "jicofo", "jvb")
+
+
+def _entry(role: str, service: str, image: str, version: str):
+    return DockerImageVersionEntry(
+        role=role,
+        service=service,
+        image=image,
+        version=version,
+        config_path=Path(ROLE_FILE_META_SERVICES),
+    )
+
+
+def _jitsi_updates(version: str, latest: str):
+    return [
+        DockerImageVersionUpdate(
+            entry=_entry("web-app-jitsi", name, f"jitsi/{name}", version),
+            latest=latest,
+        )
+        for name in JITSI
+    ]
+
+
+class TestReleaseGroupsMoveTogether(unittest.TestCase):
+    def test_a_partial_publish_holds_the_whole_group_back(self):
+        tags = {
+            "jitsi/web": ["stable-9400", "stable-9646"],
+            "jitsi/prosody": ["stable-9400", "stable-9646", "stable-9700"],
+            "jitsi/jicofo": ["stable-9400", "stable-9646", "stable-9700"],
+            "jitsi/jvb": ["stable-9400", "stable-9646", "stable-9700"],
+        }
+        updates = _jitsi_updates("stable-9400", "stable-9700")
+
+        held = _held_to_release_groups(updates, tags)
+
+        self.assertEqual({update.latest for update in held}, {"stable-9646"})
+        self.assertEqual(len(held), 4)
+
+    def test_a_group_all_publish_moves_to_the_head(self):
+        tags = {f"jitsi/{name}": ["stable-9400", "stable-9700"] for name in JITSI}
+        updates = _jitsi_updates("stable-9400", "stable-9700")
+
+        held = _held_to_release_groups(updates, tags)
+
+        self.assertEqual({update.latest for update in held}, {"stable-9700"})
+
+    def test_a_group_with_nothing_in_common_is_dropped(self):
+        tags = {
+            "jitsi/web": ["stable-9400", "stable-9701"],
+            "jitsi/prosody": ["stable-9400", "stable-9702"],
+            "jitsi/jicofo": ["stable-9400", "stable-9703"],
+            "jitsi/jvb": ["stable-9400", "stable-9704"],
+        }
+        updates = _jitsi_updates("stable-9400", "stable-9704")
+
+        self.assertEqual(_held_to_release_groups(updates, tags), [])
+
+    def test_a_lone_entry_is_untouched(self):
+        update = DockerImageVersionUpdate(
+            entry=_entry("web-app-fider", "fider", "getfider/fider", "v0.35.0"),
+            latest="v0.36.0",
+        )
+
+        held = _held_to_release_groups([update], {"getfider/fider": ["v0.36.0"]})
+
+        self.assertEqual(held, [update])
+
+    def test_two_roles_on_one_version_are_not_one_group(self):
+        tags = {
+            "jitsi/web": ["stable-9400", "stable-9700"],
+            "other/thing": ["stable-9400"],
+        }
+        updates = [
+            DockerImageVersionUpdate(
+                entry=_entry("web-app-jitsi", "web", "jitsi/web", "stable-9400"),
+                latest="stable-9700",
+            ),
+            DockerImageVersionUpdate(
+                entry=_entry("web-app-other", "thing", "other/thing", "stable-9400"),
+                latest="stable-9400",
+            ),
+        ]
+
+        held = _held_to_release_groups(updates, tags)
+
+        self.assertEqual(
+            [update.latest for update in held], ["stable-9700", "stable-9400"]
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/utils/update/test_galaxy.py b/tests/unit/python/utils/update/test_galaxy.py
new file mode 100644
index 0000000000..c05a02d292
--- /dev/null
+++ b/tests/unit/python/utils/update/test_galaxy.py
@@ -0,0 +1,127 @@
+import unittest
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from unittest.mock import patch
+
+from utils.update.galaxy import apply_updates, collect_pins, find_outdated_updates
+
+GALAXY = """---
+collections:
+  - name: community.general
+    version: 13.2.0
+  - name: kewlfft.aur
+    version: 0.13.0
+"""
+
+GIT = """---
+collections:
+  - name: community.general
+    source: https://github.com/ansible-collections/community.general.git
+    type: git
+    version: 13.2.0
+
+  - name: kewlfft.aur
+    source: https://github.com/kewlfft/ansible-aur.git
+    type: git
+    version: master
+"""
+
+
+def _read(root: Path, name: str) -> str:
+    path = root / "requirements" / name
+    return path.read_text()  # nocheck: cache-read -- rewritten by this test
+
+
+def _repo(root: Path) -> Path:
+    (root / "requirements").mkdir()
+    (root / "requirements" / "requirements.galaxy.yml").write_text(
+        GALAXY, encoding="utf-8"
+    )
+    (root / "requirements" / "requirements.git.yml").write_text(GIT, encoding="utf-8")
+    return root
+
+
+class TestCollectPins(unittest.TestCase):
+    def test_only_collections_pinned_to_a_semver_in_both_files_are_collected(self):
+        with TemporaryDirectory() as tmp:
+            root = _repo(Path(tmp))
+
+            pins = collect_pins(root)
+
+            self.assertEqual([pin.fqcn for pin in pins], ["community.general"])
+
+    def test_a_version_the_two_files_disagree_on_is_not_collected(self):
+        with TemporaryDirectory() as tmp:
+            root = _repo(Path(tmp))
+            (root / "requirements" / "requirements.galaxy.yml").write_text(
+                GALAXY.replace("13.2.0", "13.4.0"), encoding="utf-8"
+            )
+
+            self.assertEqual(collect_pins(root), [])
+
+
+class TestFindOutdatedUpdates(unittest.TestCase):
+    def test_a_higher_tag_of_the_same_depth_is_an_update(self):
+        with TemporaryDirectory() as tmp:
+            root = _repo(Path(tmp))
+            with patch(
+                "utils.update.galaxy.git_ls_remote_tags",
+                return_value=["13.1.0", "13.2.0", "13.4.0"],
+            ):
+                updates = find_outdated_updates(root)
+
+            self.assertEqual([u.latest for u in updates], ["13.4.0"])
+
+    def test_the_newest_tag_already_pinned_is_no_update(self):
+        with TemporaryDirectory() as tmp:
+            root = _repo(Path(tmp))
+            with patch(
+                "utils.update.galaxy.git_ls_remote_tags",
+                return_value=["13.1.0", "13.2.0"],
+            ):
+                self.assertEqual(find_outdated_updates(root), [])
+
+    def test_a_tag_of_a_different_depth_is_not_a_candidate(self):
+        with TemporaryDirectory() as tmp:
+            root = _repo(Path(tmp))
+            with patch(
+                "utils.update.galaxy.git_ls_remote_tags",
+                return_value=["13.2.0", "14"],
+            ):
+                self.assertEqual(find_outdated_updates(root), [])
+
+
+class TestApplyUpdates(unittest.TestCase):
+    def test_both_requirement_files_are_bumped_together(self):
+        with TemporaryDirectory() as tmp:
+            root = _repo(Path(tmp))
+            with patch(
+                "utils.update.galaxy.git_ls_remote_tags",
+                return_value=["13.4.0"],
+            ):
+                updates = find_outdated_updates(root)
+                changed = apply_updates(root, updates)
+
+            self.assertEqual(len(changed), 2)
+            galaxy_text = _read(root, "requirements.galaxy.yml")
+            git_text = _read(root, "requirements.git.yml")
+            self.assertIn("version: 13.4.0", galaxy_text)
+            self.assertIn("version: 13.4.0", git_text)
+            self.assertNotIn("13.2.0", galaxy_text)
+            self.assertNotIn("13.2.0", git_text)
+
+    def test_an_entry_outside_the_update_keeps_its_version(self):
+        with TemporaryDirectory() as tmp:
+            root = _repo(Path(tmp))
+            with patch(
+                "utils.update.galaxy.git_ls_remote_tags",
+                return_value=["13.4.0"],
+            ):
+                apply_updates(root, find_outdated_updates(root))
+
+            self.assertIn("version: master", _read(root, "requirements.git.yml"))
+            self.assertIn("version: 0.13.0", _read(root, "requirements.galaxy.yml"))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/python/utils/update/test_repository.py b/tests/unit/python/utils/update/test_repository.py
index 28dfa766c2..a956b4354e 100644
--- a/tests/unit/python/utils/update/test_repository.py
+++ b/tests/unit/python/utils/update/test_repository.py
@@ -5,10 +5,12 @@ import unittest
 from pathlib import Path
 
 from utils.cache.files import read_text
+from utils.roles.mapping import ROLE_DIR_META_ADDONS, ROLE_FILE_META_SERVICES
 from utils.update.repository import (
     RepositoryRefEntry,
     RepositoryRefUpdate,
     apply_updates,
+    collect_entries,
     suppressed_ref_lines,
     update_config_refs,
     walk_repo_ref_pairs,
@@ -216,5 +218,46 @@ class TestApplyUpdates(unittest.TestCase):
             self.assertEqual(read_text(str(config_b)), "  ref: v2.1.0\n")
 
 
+class TestCollectEntriesCoversAddons(unittest.TestCase):
+    def _role(self, root: Path) -> Path:
+        role = root / "roles" / "web-app-example"
+        (role / ROLE_DIR_META_ADDONS).mkdir(parents=True)
+        return role
+
+    def test_addon_ref_is_collected_beside_the_service_ref(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            root = Path(tmpdir)
+            role = self._role(root)
+            (role / ROLE_FILE_META_SERVICES).write_text(
+                "app:\n  repository: https://example.test/app.git\n  ref: v1.0.0\n",
+                encoding="utf-8",
+            )
+            (role / ROLE_DIR_META_ADDONS / "plug.yml").write_text(
+                "config:\n  repository: https://example.test/plug.git\n  ref: v2.0.0\n",
+                encoding="utf-8",
+            )
+
+            by_ref = {entry.ref: entry for entry in collect_entries(root)}
+
+            self.assertEqual(set(by_ref), {"v1.0.0", "v2.0.0"})
+            addon = by_ref["v2.0.0"]
+            self.assertEqual(addon.entity_path[:2], ("addons", "plug"))
+            self.assertEqual(addon.config_path.name, "plug.yml")
+
+    def test_addon_ref_honours_its_own_suppression_marker(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            root = Path(tmpdir)
+            role = self._role(root)
+            (role / ROLE_DIR_META_ADDONS / "plug.yml").write_text(
+                "config:\n"
+                "  repository: https://example.test/plug.git\n"
+                "  # nocheck: repository-version\n"
+                "  ref: v2.0.0\n",
+                encoding="utf-8",
+            )
+
+            self.assertEqual(collect_entries(root), [])
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/utils/api.py b/utils/api.py
new file mode 100644
index 0000000000..b7c0f95891
--- /dev/null
+++ b/utils/api.py
@@ -0,0 +1,112 @@
+"""Proprietary API credential SPOT, read from group_vars/all/18_api.yml.
+
+``API`` is a plain mapping, so an inventory that configures three providers
+replaces the whole declaration instead of merging into it, and every provider it
+does not name disappears. Resolving a hidden provider then raises, and a raising
+lookup inside a value the applications renderer is templating leaves the raw
+``{{ ... }}`` text in place: the consumer stores template text, and ``| bool``
+coerces it to False with a deprecation warning that fails the deploy on the
+warning gate.
+
+Merging the scope's override over the declared defaults keeps every declared
+provider resolvable, so an override narrows values, never the provider set.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any
+
+from utils import PROJECT_ROOT
+from utils.cache.base import _deep_merge
+from utils.cache.yaml import load_yaml_any
+
+_API_SPOT_FILE = str(PROJECT_ROOT / "group_vars" / "all" / "18_api.yml")
+
+
+def declared_api() -> dict[str, Any]:
+    """The ``API`` mapping as declared in the group_vars SPOT.
+
+    Returns:
+        Provider name to credential mapping, every value a plain string.
+
+    Raises:
+        TypeError: the SPOT does not declare ``API`` as a mapping.
+    """
+    document = load_yaml_any(_API_SPOT_FILE, default_if_missing={}) or {}
+    declared = document.get("API") if isinstance(document, Mapping) else None
+    if not isinstance(declared, Mapping):
+        raise TypeError(f"{_API_SPOT_FILE} does not declare 'API' as a mapping.")
+    return dict(declared)
+
+
+def resolve_api(
+    variables: Mapping[str, Any] | None, templar: Any = None
+) -> dict[str, Any]:
+    """The effective ``API`` mapping for a render scope.
+
+    Args:
+        variables: the scope's variables; its ``API`` entry overrides the SPOT.
+        templar: optional templar; renders the override and the merged values,
+            so an inventory may source a credential from an env lookup.
+
+    Returns:
+        The SPOT declaration with the scope's override merged over it.
+
+    Raises:
+        TypeError: the scope's ``API`` is present but not a mapping.
+    """
+    declared = declared_api()
+    override: Any = (variables or {}).get("API")
+    if override is not None and not isinstance(override, Mapping) and templar:
+        override = _templated(templar, override)
+    if override is None:
+        return declared
+    if not isinstance(override, Mapping):
+        raise TypeError("'API' is defined but is not a mapping.")
+    merged = _deep_merge(declared, dict(override))
+    if templar is None:
+        return merged
+    rendered = _templated(templar, merged)
+    return dict(rendered) if isinstance(rendered, Mapping) else merged
+
+
+def _templated(templar: Any, value: Any) -> Any:
+    from ansible.errors import AnsibleError
+
+    try:
+        return templar.template(value, fail_on_undefined=False)
+    except TypeError:
+        pass
+    except (AnsibleError, ValueError):
+        return value
+
+    try:
+        return templar.template(value)
+    except (AnsibleError, TypeError, ValueError):
+        return value
+
+
+def provider_enabled(api: Mapping[str, Any], provider: str) -> bool:
+    """Whether every credential of a provider carries a value.
+
+    Args:
+        api: an effective ``API`` mapping, as returned by ``resolve_api``.
+        provider: the provider name, e.g. ``github``.
+
+    Returns:
+        True when the provider declares at least one credential and none of
+        them is empty.
+
+    Raises:
+        KeyError: the provider is not declared in the SPOT.
+    """
+    credentials = api.get(provider)
+    if not isinstance(credentials, Mapping):
+        raise KeyError(
+            f"unknown API provider {provider!r}; declare it under 'API' in "
+            f"{_API_SPOT_FILE}."
+        )
+    if not credentials:
+        return False
+    return all(str(value).strip() for value in credentials.values())
diff --git a/utils/cache/README.md b/utils/cache/README.md
index ec5607b0a6..a4d0080e34 100644
--- a/utils/cache/README.md
+++ b/utils/cache/README.md
@@ -55,3 +55,34 @@ from utils.cache.domains import get_merged_domains
 # Tests
 from utils.cache import _reset_cache_for_tests
 ```
+
+## Schema 🗺️
+
+```mermaid
+flowchart TD
+    decl["meta/services.yml<br/>a flag reading group_names<br/>114 role files"]
+    ctor["01_constructor.yml:191<br/>applications_carrier"]
+    fact["_INFINITO_APPLICATIONS_RENDERED<br/>per-host fact"]
+    lookup["lookup('database', ...)<br/>and every applications consumer"]
+    key["base.py:103<br/>_stable_variables_signature"]
+    proc["_MERGED_APPLICATIONS_CACHE<br/>process-global dict"]
+    render["base.py:198<br/>_render_with_templar"]
+    consumer["database.py:121<br/>central_enabled = shared"]
+    name["postgres_postgres<br/>vs pretix_database"]
+
+    decl -->|"read by"| render
+    ctor -->|"parks"| fact
+    lookup -->|"computes"| key
+    key -->|"1. looked up in"| proc
+    proc -->|"2. miss: falls back to"| fact
+    fact -->|"3. miss: renders"| render
+    render -->|"substitutes group_names,<br/>then stores under key"| proc
+    render --> consumer
+    consumer -->|"selects"| name
+
+    proc -.->|"TRIP-WIRE: read BEFORE the<br/>host's own fact, so an inherited<br/>entry outranks it"| fact
+    render -.->|"TRIP-WIRE: main process renders<br/>task names for one host; forked<br/>workers inherit that entry"| proc
+    key -.->|"TRIP-WIRE: carrier.py:68 stringifies<br/>only one side, so a non-scalar key<br/>part silently never matches again"| fact
+```
+
+The key covers `group_names`. `domains.py` derives from the applications view and shares that dependency; `users` reads `group_names` nowhere.
diff --git a/utils/cache/base.py b/utils/cache/base.py
index 9986e7fe63..f9c2d23276 100644
--- a/utils/cache/base.py
+++ b/utils/cache/base.py
@@ -104,15 +104,24 @@ def _stable_variables_signature(variables: Mapping[str, Any] | None) -> tuple:
     """Build a content-based cache signature from the subset of `variables`
     that influences the merged applications/users payload.
 
+    `group_names` belongs in the key because a service flag may be written as
+    `{{ '<role>' in group_names }}`, so two hosts of one play render different
+    payloads from identical host_vars. Ansible forks its workers, so a payload
+    rendered in the strategy's main process for one host is inherited by every
+    later worker; without this component that payload answers for hosts whose
+    groups say otherwise.
+
     See `_fingerprint_mapping` for why id()-only keys don't work reliably.
     """
     if not variables:
-        return ("0", "0", "", "")
+        return ("0", "0", "", "", "")
+    groups = variables.get("group_names")
     return (
         _fingerprint_mapping(variables.get("applications")),
         _fingerprint_mapping(variables.get("users")),
         str(variables.get("DOMAIN_PRIMARY") or ""),
         str(variables.get("SYSTEM_EMAIL_DOMAIN") or ""),
+        ",".join(sorted(str(group) for group in groups)) if groups else "",
     )
 
 
diff --git a/utils/cache/domains.py b/utils/cache/domains.py
index 93defc8919..ee4bd569a4 100644
--- a/utils/cache/domains.py
+++ b/utils/cache/domains.py
@@ -32,6 +32,54 @@ def _as_bool(value: Any) -> bool:
     return bool(value)
 
 
+def _resolved_flag(
+    value: Any,
+    *,
+    app: str,
+    name: str,
+    templar: Any,
+    variables: Any,
+    apps: Any,
+) -> bool:
+    """A tor service flag as a boolean, never as the text of its own template.
+
+    ``services.tor.*`` is declared as Jinja in 99 of the 105 roles that carry
+    it. When this map is built from an applications tree that is still being
+    rendered (``utils.cache.applications`` returns the raw tree while its own
+    render is in flight) the flag arrives as its source text, which every
+    boolean coercion reads as False. The onion injection would then silently
+    not happen and the clearnet domain would be frozen into whatever value the
+    render was producing.
+
+    Args:
+        value: the declared flag, rendered or not.
+        app: application id, for the error message.
+        name: flag name under ``services.tor``, for the error message.
+        templar: templar to render with; ``None`` renders nothing.
+        variables: scope the template resolves against.
+        apps: applications tree seeded into the nested render.
+
+    Returns:
+        The flag as a boolean.
+
+    Raises:
+        ValueError: the flag still carries template text after rendering.
+    """
+    if isinstance(value, str) and ("{{" in value or "{%" in value):
+        from utils.cache.base import _render_with_templar
+
+        value = _render_with_templar(
+            value, templar=templar, variables=variables, raw_applications=apps
+        )
+    if isinstance(value, str) and ("{{" in value or "{%" in value):
+        raise ValueError(
+            f"get_merged_domains: '{app}' services.tor.{name} stayed template "
+            f"text ({value!r}). Reading it as a boolean would drop the onion "
+            "domains without saying so."
+        )
+    return _as_bool(value)
+
+
 def _onion_of(domain: str, primary: str, node_onion: str) -> str | None:
     """Return ``domain`` with the clearnet ``primary`` suffix swapped for the
     node onion, or None when the domain is not under ``primary``."""
@@ -48,6 +96,9 @@ def _inject_onion_domains(
     apps: dict[str, Any],
     primary: str,
     node_onion: str,
+    *,
+    templar: Any = None,
+    variables: Any = None,
 ) -> dict[str, Any]:
     """Add ``<sub>.<node-onion>`` domains for apps opting into onion routing.
 
@@ -63,21 +114,38 @@ def _inject_onion_domains(
     )
 
     registry = build_service_registry_from_applications(apps)
+
+    def _flag(value: Any, app: str, name: str) -> bool:
+        return _resolved_flag(
+            value,
+            app=app,
+            name=name,
+            templar=templar,
+            variables=variables,
+            apps=apps,
+        )
+
     out: dict[str, Any] = {}
     for app, domains in merged.items():
         tor = ((apps.get(app) or {}).get("services") or {}).get("tor") or {}
-        if not isinstance(domains, (list, dict)) or not _as_bool(tor.get("enabled")):
+        if not isinstance(domains, (list, dict)) or not _flag(
+            tor.get("enabled"), app, "enabled"
+        ):
             out[app] = domains
             continue
-        exclusive = _as_bool(
+        exclusive = _flag(
             resolve_service_config(
                 apps, app, "tor", "exclusive", default=False, service_registry=registry
-            )
+            ),
+            app,
+            "exclusive",
         )
-        is_primary = _as_bool(
+        is_primary = _flag(
             resolve_service_config(
                 apps, app, "tor", "primary", default=False, service_registry=registry
-            )
+            ),
+            app,
+            "primary",
         )
         if isinstance(domains, dict):
             out[app] = _inject_onion_into_dict(
@@ -141,7 +209,9 @@ def get_merged_domains(
     issued while the applications render is in progress sees the unrendered
     tree, whose service flags are still Jinja strings; its map is cached under
     its own key so the render's own call sites reuse it without it ever being
-    served as the finished map.
+    served as the finished map. The tor flags are rendered before they are
+    read (``_resolved_flag``), so that mid-render map carries the same onion
+    domains the finished one does.
     """
     from plugins.filter.canonical_domains_map import (
         FilterModule as _CanonicalDomainsFilter,
@@ -200,7 +270,14 @@ def get_merged_domains(
     node_onion = str(_render_raw(node_raw or "", "services.tor.node") or "").strip()
     group_names = variables.get("group_names") or []
     if node_onion and "svc-net-tor" in group_names:
-        merged = _inject_onion_domains(merged, apps, str(primary_domain), node_onion)
+        merged = _inject_onion_domains(
+            merged,
+            apps,
+            str(primary_domain),
+            node_onion,
+            templar=templar,
+            variables=variables,
+        )
 
     _MERGED_DOMAINS_CACHE[cache_key] = merged
     return merged
diff --git a/utils/cache/files.py b/utils/cache/files.py
index 42249b8a39..6efd2d95c4 100644
--- a/utils/cache/files.py
+++ b/utils/cache/files.py
@@ -54,15 +54,14 @@ _DEFAULT_SKIP_DIRS: frozenset[str] = frozenset(
 )
 
 
-@lru_cache(maxsize=1)
-def _all_project_files() -> tuple[str, ...]:
-    """One-shot filesystem walk from PROJECT_ROOT.
+@lru_cache(maxsize=4)
+def _all_project_files(root_str: str) -> tuple[str, ...]:
+    """One-shot filesystem walk from *root_str*.
 
     Returns absolute paths as a tuple (immutable → safe to cache).
     Pruned at walk-time by `_DEFAULT_SKIP_DIRS`, since those dirs are never
     relevant for any project-tree test and descending into them is pure waste.
     """
-    root_str = str(PROJECT_ROOT)
     paths: list[str] = []
     for dirpath, dirnames, filenames in os.walk(root_str, topdown=True):
         dirnames[:] = [d for d in dirnames if d not in _DEFAULT_SKIP_DIRS]
@@ -87,7 +86,7 @@ def iter_project_files(
             ``exclude_dirs=("docs",)`` skips any file whose path contains a
             ``docs`` segment.
     """
-    all_files = _all_project_files()
+    all_files = _all_project_files(str(PROJECT_ROOT))
     tests_prefix = str(Path(str(PROJECT_ROOT)) / "tests") + os.sep
     ext_lower = tuple(e.lower() for e in extensions) if extensions else None
     exclude_dirs_set = set(exclude_dirs) if exclude_dirs else None
diff --git a/utils/docker/image/discovery.py b/utils/docker/image/discovery.py
index c569aed7c1..559003e0e7 100644
--- a/utils/docker/image/discovery.py
+++ b/utils/docker/image/discovery.py
@@ -4,6 +4,7 @@ from dataclasses import dataclass
 from typing import TYPE_CHECKING
 
 from utils.cache.yaml import load_yaml_any as _load_yaml_cached
+from utils.docker.image.pin import pull_reference
 from utils.roles.mapping import ROLE_FILE_META_SERVICES
 
 if TYPE_CHECKING:
@@ -146,7 +147,7 @@ def docker_hub_source(image: str, version: str) -> str:
     if "/" not in base:
         base = f"library/{base}"
 
-    return f"docker.io/{base}:{version}"
+    return pull_reference(f"docker.io/{base}", version)
 
 
 def image_source(image: str, version: str) -> str:
@@ -166,7 +167,7 @@ def image_source(image: str, version: str) -> str:
     if registry == "docker.io" and "/" not in base:
         base = f"library/{base}"
 
-    return f"{registry}/{base}:{version}"
+    return pull_reference(f"{registry}/{base}", version)
 
 
 def canonical_image_name(image: str) -> str:
diff --git a/utils/docker/image/pin.py b/utils/docker/image/pin.py
new file mode 100644
index 0000000000..11b4ec7e41
--- /dev/null
+++ b/utils/docker/image/pin.py
@@ -0,0 +1,58 @@
+from utils.update.base import version_depth
+
+DIGEST_PREFIX = "sha256:"
+
+SEMVER = "semver"
+DIGEST = "digest"
+REF = "ref"
+
+RULE_BY_CLASS = {
+    DIGEST: "docker-digest",
+    REF: "docker-version",
+}
+
+
+def is_digest(version: str) -> bool:
+    """Whether ``version`` pins by content rather than by name.
+
+    Args:
+        version: the ``version:`` value a role declares for an image.
+    """
+    return str(version).strip().startswith(DIGEST_PREFIX)
+
+
+def pin_class(version: str) -> str:
+    """Classify a pin as ``semver``, ``digest`` or ``ref``.
+
+    Args:
+        version: the ``version:`` value a role declares for an image.
+
+    Returns:
+        The class name. ``ref`` is the residue: a tag that names no version
+        the registry can order, so nothing can tell whether it moved.
+    """
+    stripped = str(version).strip()
+    if is_digest(stripped):
+        return DIGEST
+    if version_depth(stripped) > 0:
+        return SEMVER
+    return REF
+
+
+def reference_separator(version: str) -> str:
+    """The character that joins an image name to ``version`` in a pull ref.
+
+    Args:
+        version: the ``version:`` value a role declares for an image.
+    """
+    return "@" if is_digest(version) else ":"
+
+
+def pull_reference(name: str, version: str) -> str:
+    """Join an image name and a pin into the reference a registry accepts.
+
+    Args:
+        name: image name, with or without a registry prefix.
+        version: the ``version:`` value a role declares for an image.
+    """
+    return f"{name}{reference_separator(version)}{str(version).strip()}"
diff --git a/utils/env/handlers/passthrough.py b/utils/env/handlers/passthrough.py
index b0a30ff3d0..9509a7b7fb 100644
--- a/utils/env/handlers/passthrough.py
+++ b/utils/env/handlers/passthrough.py
@@ -12,6 +12,7 @@ if TYPE_CHECKING:
 STATIC_KEYS = (
     "INFINITO_SRC_DIR",
     "INFINITO_VENV_DIR",
+    "INFINITO_ANSIBLE_COLLECTIONS_SOURCE",
     "INFINITO_BIND_IP",
     "INFINITO_BUILD",
     "INFINITO_SUBNET",
@@ -71,6 +72,9 @@ STATIC_KEYS = (
     "INFINITO_ALIAS_REPOSITORY",
     "INFINITO_APT_UBUNTU_MIRRORS",
     "INFINITO_FORK_REPOSITORY_NAME",
+    "INFINITO_API_ANTHROPIC_KEY",
+    "INFINITO_API_OPENAI_KEY",
+    "INFINITO_API_OPENROUTER_KEY",
     "INFINITO_PLAYWRIGHT_KEEP",
     "INFINITO_PUBLISH_PORTS",
     "INFINITO_SKILLS_REPOSITORY",
@@ -91,6 +95,7 @@ STATIC_KEYS = (
     "INFINITO_BLACKLIST",
     "INFINITO_PRIORITY",
     "INFINITO_CI_CHUNK",
+    "INFINITO_CI_CHUNK_SIZE",
     "INFINITO_CI_CONCURRENCY",
     "INFINITO_CI_DISTRO_BUDGET_SECONDS",
     "INFINITO_CI_JOB_LIMIT",
diff --git a/utils/github/variant/selection.py b/utils/github/variant/selection.py
index 899ab590f1..c75e88f644 100644
--- a/utils/github/variant/selection.py
+++ b/utils/github/variant/selection.py
@@ -270,14 +270,24 @@ def apply(
         plus a rotation-picked one on top.
 
     Raises:
-        SystemExit: a token that pins something matched no row at all. Silently
-            deploying nothing is how a mistyped variant index turns into a
-            green run that tested nothing.
+        SystemExit: a token pins a variant of a role the query DID return, and
+            no row carries that variant. Silently deploying nothing is how a
+            mistyped variant index turns into a green run that tested nothing.
+
+            A token whose role the query returned nothing for is let through
+            instead: the diff-derived whitelist legitimately names roles the
+            run's mode and lifecycle envelope filters out, and since that
+            resolver now pins the variants a change actually reaches, such a
+            token would otherwise abort every chunk of the run. Role names are
+            checked against `roles/` before the run starts
+            (scripts/github/resolve/effective_whitelist.sh), so a typo is still
+            caught -- one layer earlier.
     """
     if not pins:
         return [dict(row) for row in rows]
     kept: list[dict[str, Any]] = []
     matched: set[int] = set()
+    discovered = {row["name"] for row in rows}
     for row in rows:
         hits = [
             (index, pin)
@@ -302,7 +312,7 @@ def apply(
                 }
             )
     for index, pin in enumerate(pins):
-        if index not in matched and pin.pinned:
+        if index not in matched and pin.pinned and pin.app in discovered:
             raise SystemExit(
                 f"selection {describe(pin)!r} matches no discovered row; "
                 f"check the variant index and the run's lifecycle/mode filters"
diff --git a/utils/install/collections.py b/utils/install/collections.py
new file mode 100644
index 0000000000..60c2031eb8
--- /dev/null
+++ b/utils/install/collections.py
@@ -0,0 +1,109 @@
+"""Compare the pinned Galaxy requirements against what is on disk.
+
+Imported by the lint bootstrap, which runs on a bare interpreter before any
+dependency is installed, so this module stays on the standard library. It also
+stays inside its own package: the Dockerfile copies it into the image beside
+``utils/__init__.py`` and ``utils/install/__init__.py`` and nothing else, so
+importing any other ``utils`` submodule raises ``ModuleNotFoundError`` in the
+layer that runs it. The
+requirements files it reads are this repository's own and hold one shape:
+a ``collections:`` list of ``- name:`` entries with an optional ``version:``.
+A line that does not match that shape leaves the entry unpinned, which the
+caller treats as unsatisfied and installs.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+from pathlib import Path
+
+_NAME = re.compile(r"^\s*-\s+name:\s*(?P<name>[A-Za-z0-9_.]+)\s*(?:#.*)?$")
+_VERSION = re.compile(
+    r"^\s*version:\s*(?P<quote>[\"']?)(?P<version>[^\s#\"']+)(?P=quote)\s*(?:#.*)?$"
+)
+
+
+def declared_pins(requirements_file: Path) -> list[tuple[str, str | None]]:
+    """The ``(fqcn, version)`` pairs a requirements file declares, in order.
+
+    Args:
+        requirements_file: the requirements.galaxy.yml to read.
+    """
+    pins: list[tuple[str, str | None]] = []
+    try:
+        raw = requirements_file.read_text(encoding="utf-8")  # nocheck: cache-read
+    except OSError:
+        return pins
+    lines = raw.splitlines()
+
+    for line in lines:
+        name_match = _NAME.match(line)
+        if name_match:
+            pins.append((name_match.group("name"), None))
+            continue
+        version_match = _VERSION.match(line)
+        if version_match and pins:
+            fqcn, _ = pins[-1]
+            pins[-1] = (fqcn, version_match.group("version"))
+    return pins
+
+
+def _installed_version(collections_dir: Path, namespace: str, name: str) -> str | None:
+    """The version recorded in a collection's manifest, or None when absent.
+
+    Args:
+        collections_dir: the ``-p`` target ansible-galaxy installs into.
+        namespace: collection namespace, the part before the dot.
+        name: collection name, the part after the dot.
+    """
+    manifest = (
+        collections_dir / "ansible_collections" / namespace / name / "MANIFEST.json"
+    )
+    try:
+        raw = manifest.read_text(encoding="utf-8")  # nocheck: cache-read
+        payload = json.loads(raw)
+    except (OSError, ValueError):
+        return None
+    version = payload.get("collection_info", {}).get("version")
+    return str(version) if version else None
+
+
+def unsatisfied(requirements_file: Path, collections_dir: Path) -> list[str]:
+    """Requirements that COLLECTIONS_DIR does not already hold at the pinned version.
+
+    An entry without a pinned version can never be confirmed from disk and is
+    always reported, so the caller falls through to a real install.
+
+    Args:
+        requirements_file: the requirements.galaxy.yml to read.
+        collections_dir: the ``-p`` target ansible-galaxy installs into.
+    """
+    missing: list[str] = []
+    for fqcn, pinned in declared_pins(requirements_file):
+        if "." not in fqcn or not pinned:
+            missing.append(fqcn)
+            continue
+        namespace, _, name = fqcn.partition(".")
+        if _installed_version(collections_dir, namespace, name) != pinned:
+            missing.append(f"{fqcn}:{pinned}")
+    return missing
+
+
+def main() -> int:
+    """Exit 0 when every pinned collection is present at its pinned version.
+
+    Args:
+        argv[1]: path to requirements.galaxy.yml.
+        argv[2]: path to the collections directory.
+    """
+    missing = unsatisfied(Path(sys.argv[1]), Path(sys.argv[2]))
+    if missing:
+        print(" ".join(missing))
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/utils/install/lint/ansible/collections.py b/utils/install/lint/ansible/collections.py
index 1edd2f83e2..17a2dfec9a 100644
--- a/utils/install/lint/ansible/collections.py
+++ b/utils/install/lint/ansible/collections.py
@@ -8,16 +8,13 @@ import time
 from pathlib import Path
 
 from utils.cache import PROJECT_ROOT
+from utils.install.collections import unsatisfied
 from utils.install.primitives import log, warn
 
 _MAX_ATTEMPTS = 5
 
 
-def _collection_present(base_dir: Path, namespace: str, name: str) -> bool:
-    return (base_dir / "ansible_collections" / namespace / name).is_dir()
-
-
-def _galaxy_install(requirements_file: str, base_dir: Path) -> bool:
+def _galaxy_install(requirements_file: Path, base_dir: Path) -> bool:
     try:
         subprocess.run(
             [
@@ -25,7 +22,7 @@ def _galaxy_install(requirements_file: str, base_dir: Path) -> bool:
                 "collection",
                 "install",
                 "-r",
-                requirements_file,
+                str(requirements_file),
                 "-p",
                 str(base_dir),
                 "--force-with-deps",
@@ -39,22 +36,14 @@ def _galaxy_install(requirements_file: str, base_dir: Path) -> bool:
 
 def ensure() -> None:
     collections_base_dir = Path("~/.ansible/collections").expanduser()
-    missing: list[str] = []
-
-    if not _collection_present(collections_base_dir, "community", "general"):
-        missing.append("community.general")
-    if not _collection_present(collections_base_dir, "hetzner", "hcloud"):
-        missing.append("hetzner.hcloud")
-    if not _collection_present(collections_base_dir, "kewlfft", "aur"):
-        missing.append("kewlfft.aur")
+    repo_root = Path(PROJECT_ROOT)
+    req_galaxy = repo_root / "requirements" / "requirements.galaxy.yml"
+    req_git = repo_root / "requirements" / "requirements.git.yml"
 
+    missing = unsatisfied(req_galaxy, collections_base_dir)
     if not missing:
         return
 
-    repo_root = Path(PROJECT_ROOT)
-    req_galaxy = str(repo_root / "requirements" / "requirements.galaxy.yml")
-    req_git = str(repo_root / "requirements" / "requirements.git.yml")
-
     attempt = 1
     while True:
         log(
diff --git a/utils/manager/inventory.py b/utils/manager/inventory.py
index ac3463d36d..2c7379d022 100644
--- a/utils/manager/inventory.py
+++ b/utils/manager/inventory.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 import sys
 from typing import TYPE_CHECKING, Any
 
@@ -19,7 +20,22 @@ from utils.roles.mapping import ROLE_FILE_META_SECRETS, ROLE_FILE_VARS_MAIN
 if TYPE_CHECKING:
     from pathlib import Path
 
-_CREDENTIAL_LEAF_MARKERS = ("description", "algorithm", "validation", "default")
+_CREDENTIAL_LEAF_MARKERS = (
+    "description",
+    "algorithm",
+    "validation",
+    "default",
+    "type",
+    "regex",
+)
+
+_SCHEMA_TYPES: dict[str, type | tuple[type, ...]] = {
+    "string": str,
+    "integer": int,
+    "boolean": bool,
+}
+
+_UNRENDERED_TEMPLATE = re.compile(r"\{\{|\{%")
 
 
 def _is_credential_leaf(node: Any) -> bool:
@@ -28,6 +44,59 @@ def _is_credential_leaf(node: Any) -> bool:
     )
 
 
+def validate_supplied_value(full_key: str, value: Any, meta: dict[str, Any]) -> None:
+    """Hold an operator-supplied credential to the schema it declares.
+
+    Only supplied values are checked: a generated one comes from the algorithm
+    the same schema names, and the generators take no schema argument.
+
+    Args:
+        full_key: dotted schema path, used in the failure message.
+        value: the value the operator supplied, empty meaning "not configured".
+        meta: the schema leaf, read for `type` and `regex`.
+
+    Raises:
+        SystemExit: the value contradicts the declared type or pattern.
+
+    Exception: a `default:` is written into the inventory verbatim, so on the
+    next read it arrives here as if an operator had typed it. Every default in
+    the repository is a Jinja reference, and a pattern describes the rendered
+    secret, not the template text that will produce it.
+    """
+    if value in ("", None):
+        return
+
+    if isinstance(value, str) and _UNRENDERED_TEMPLATE.search(value):
+        return
+
+    declared = meta.get("type")
+    if declared:
+        expected = _SCHEMA_TYPES.get(str(declared))
+        if expected is None:
+            print(
+                f"ERROR: '{full_key}' declares unknown type '{declared}'; "
+                f"known types are {', '.join(sorted(_SCHEMA_TYPES))}",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+        if not isinstance(value, expected):
+            print(
+                f"ERROR: '{full_key}' is declared {declared} but the supplied "
+                f"value is {type(value).__name__}",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+
+    pattern = meta.get("regex")
+    if pattern and not re.fullmatch(str(pattern), str(value)):
+        print(
+            f"ERROR: the value supplied for '{full_key}' does not match the "
+            f"pattern its schema declares: {pattern}",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
+
 def _meta_role_config(role_path: Path) -> dict[str, Any]:
     """Assemble the view of a role's config from its meta files.
 
@@ -251,6 +320,9 @@ class InventoryManager:
           * `default:` (Jinja literal) is written verbatim and
             short-circuits algorithm-based generation. `validation:` is
             ignored for default-bearing entries.
+          * `type:` and `regex:` hold an operator-supplied value to the
+            shape the schema declares; a generated one is exempt because
+            the algorithm that produced it is named by the same schema.
           * Existing inventory values are preserved (no double-encryption,
             no overwrite of operator-supplied secrets).
         """
@@ -295,6 +367,7 @@ class InventoryManager:
 
         if "default" in meta:
             if isinstance(existing_value, str) and existing_value != "":
+                validate_supplied_value(full_key, existing_value, meta)
                 return
             dest[key] = meta["default"]
             return
@@ -306,7 +379,9 @@ class InventoryManager:
         if algorithm == "plain":
             if set_key in self.overrides:
                 plain = self.overrides[set_key]
+                validate_supplied_value(full_key, plain, meta)
             elif isinstance(existing_value, str) and existing_value != "":
+                validate_supplied_value(full_key, existing_value, meta)
                 return
             elif self.allow_empty_plain:
                 plain = ""
diff --git a/utils/roles/applications/services/registry.py b/utils/roles/applications/services/registry.py
index 561ce13652..484bf2ada3 100644
--- a/utils/roles/applications/services/registry.py
+++ b/utils/roles/applications/services/registry.py
@@ -28,10 +28,21 @@ def _normalized_name(value: Any) -> str:
     return value.strip()
 
 
+GROUP_GATED_CONSTANTS: tuple[str, ...] = ("LITELLM_USABLE",)
+"""Group_vars constants whose own definition carries an ``in group_names``
+gate, so a flag referencing one is dynamic even though its own text is not.
+
+A constant hides the role id the substring rule looks for, so every SPOT of
+this kind MUST be listed here or the roles referencing it silently drop their
+provider from the static closure.
+"""
+
+
 def is_explicit_truth(value: Any) -> bool:
     """A services.<key> flag (``enabled`` / ``shared``) MAY be true if it
-    is the literal Python ``True`` OR any string containing the substring
-    ``in group_names``. Negated and compound predicates
+    is the literal Python ``True``, any string containing the substring
+    ``in group_names``, or a string referencing a `GROUP_GATED_CONSTANTS`
+    entry. Negated and compound predicates
     (``"{{ 'X' not in group_names }}"``) match on purpose: they are true
     on some node shape, and the static closure is the co-deploy superset.
     Mirrors the substring test at
@@ -47,7 +58,11 @@ def is_explicit_truth(value: Any) -> bool:
     """
     if value is True:
         return True
-    return bool(isinstance(value, str) and "in group_names" in value)
+    if not isinstance(value, str):
+        return False
+    return "in group_names" in value or any(
+        constant in value for constant in GROUP_GATED_CONSTANTS
+    )
 
 
 def detect_service_channel(role_name: str) -> str:
diff --git a/utils/roles/applications/variants.py b/utils/roles/applications/variants.py
new file mode 100644
index 0000000000..9bec87ae56
--- /dev/null
+++ b/utils/roles/applications/variants.py
@@ -0,0 +1,177 @@
+"""What one round's variants mean for the roles that round pulls in.
+
+A round picks one variant per role, and that choice decides two things no
+single role's `meta/services.yml` can state on its own: which providers the
+role still pulls in, and how lean those providers have to be
+(:mod:`utils.roles.applications.topics`). Both are resolved here, so the
+matrix planner's include set, the inventory bake and the CI selection read
+one answer instead of three.
+
+The module is deliberately free of deploy-runtime imports: the CI selection
+resolves its closure on a runner that has no inventory, no container and no
+`INFINITO_SRC_DIR`.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from utils.cache.applications import get_variants
+from utils.cache.base import _deep_merge
+from utils.cache.yaml import load_yaml_any
+from utils.roles.applications.services.registry import (
+    build_service_registry_from_roles_dir,
+)
+from utils.roles.applications.topics import CONFIG_TOPICS, apply_topic, provider_of
+from utils.roles.mapping import ROLE_FILE_META_SERVICES
+
+__all__ = [
+    "NestedOverrideConflictError",
+    "collect_provider_overrides",
+    "services_overrides_for_round",
+]
+
+
+class NestedOverrideConflictError(RuntimeError):
+    """Two roles in one round demand different config for one provider."""
+
+
+def _claims(payloads: Mapping[str, Any]) -> list[tuple[str, str, str, Any]]:
+    """Return the ``(role, service_key, topic, value)`` a round's payloads carry.
+
+    Args:
+        payloads: ``{role: variant payload}`` for one round.
+
+    Reading this before the service registry keeps a round whose variants
+    override nothing from paying for the registry at all.
+    """
+    claims: list[tuple[str, str, str, Any]] = []
+    for role_name, payload in payloads.items():
+        if not isinstance(payload, Mapping):
+            continue
+        services = payload.get("services")
+        if not isinstance(services, Mapping):
+            continue
+        for service_key, entry in services.items():
+            if not isinstance(entry, Mapping):
+                continue
+            claims.extend(
+                (role_name, service_key, topic, entry[topic])
+                for topic in sorted(CONFIG_TOPICS & set(entry))
+            )
+    return claims
+
+
+def collect_provider_overrides(
+    payloads: Mapping[str, Any], *, roles_dir: str
+) -> dict[str, dict[str, Any]]:
+    """Return ``{provider: {topic: value}}`` demanded by the round's payloads.
+
+    Args:
+        payloads: ``{role: variant payload}`` for one round.
+        roles_dir: roles directory the service registry is built from.
+
+    Raises:
+        NestedOverrideConflictError: two roles demand different values for the
+            same topic of the same provider.
+    """
+    claims = _claims(payloads)
+    if not claims:
+        return {}
+
+    registry = build_service_registry_from_roles_dir(Path(roles_dir))
+    demanded: dict[str, dict[str, Any]] = {}
+    claimed_by: dict[tuple[str, str], str] = {}
+    for role_name, service_key, topic, value in claims:
+        provider = provider_of(service_key, registry)
+        if not provider or provider == role_name:
+            continue
+        previous = claimed_by.get((provider, topic))
+        if previous and demanded[provider][topic] != value:
+            raise NestedOverrideConflictError(
+                f"{role_name} and {previous} demand different "
+                f"{topic!r} for {provider!r} in the same round; a "
+                f"round deploys it once, so the two cannot both hold"
+            )
+        demanded.setdefault(provider, {})[topic] = value
+        claimed_by[(provider, topic)] = role_name
+    return demanded
+
+
+def _apply_nested_service_maps(overrides: dict[str, dict], *, roles_dir: str) -> None:
+    """Replace a pulled-in provider's services map with what the round demands.
+
+    Only the ``services`` topic reaches this path: the closure walks service
+    edges, so the other config topics a variant may override are the inventory
+    bake's business.
+
+    Args:
+        overrides: ``{role: services map}``, mutated in place.
+        roles_dir: roles directory the service registry is built from.
+    """
+    payloads = {role: {"services": services} for role, services in overrides.items()}
+    for provider, topics in collect_provider_overrides(
+        payloads, roles_dir=roles_dir
+    ).items():
+        if "services" not in topics:
+            continue
+        overrides[provider] = apply_topic(overrides.get(provider), topics["services"])
+
+
+def services_overrides_for_round(
+    *,
+    roles_dir: str,
+    round_index: int,
+    primary_app_variants: Mapping[str, int],
+) -> dict[str, dict]:
+    """For every role with `meta/variants.yml`, return the services map
+    that results from merging the round's variant payload onto the
+    role's on-disk `meta/services.yml`.
+
+    Apps in `primary_app_variants` use the supplied (already clamped)
+    index. Other roles with their own variants clamp `round_index` to
+    their own variant count. Roles without variants are absent from the
+    result so the resolver falls through to its disk-read path.
+
+    The merged map is what the inventory ALSO bakes into host_vars, so
+    feeding the same dict into `CombinedResolver(services_overrides=...)`
+    eliminates the topology-vs-host_vars drift that variant-blind
+    resolution produced.
+    """
+    variants_per_app = get_variants(roles_dir=roles_dir)
+    overrides: dict[str, dict] = {}
+    roles_path = Path(roles_dir)
+    for role_name, variant_list in variants_per_app.items():
+        if not variant_list:
+            continue
+        variant_count = max(1, len(variant_list))
+        if role_name in primary_app_variants:
+            idx = primary_app_variants[role_name]
+        else:
+            idx = round_index if round_index < variant_count else 0
+        if not 0 <= idx < len(variant_list):
+            idx = 0
+        variant_payload = variant_list[idx] if variant_list else {}
+        if not isinstance(variant_payload, Mapping):
+            variant_payload = {}
+        variant_services = variant_payload.get("services", {})
+        if not isinstance(variant_services, Mapping):
+            continue
+        services_path = roles_path / role_name / ROLE_FILE_META_SERVICES
+        if not services_path.exists():
+            continue
+        try:
+            base_services = load_yaml_any(services_path) or {}
+        except (OSError, ValueError, yaml.YAMLError):
+            continue
+        if not isinstance(base_services, Mapping):
+            continue
+        merged = _deep_merge(dict(base_services), dict(variant_services))
+        if isinstance(merged, dict):
+            overrides[role_name] = merged
+    _apply_nested_service_maps(overrides, roles_dir=roles_dir)
+    return overrides
diff --git a/utils/tests/swarm/derive_includes.py b/utils/tests/swarm/derive_includes.py
index 70cbf04f5f..c2b7cd5e2e 100755
--- a/utils/tests/swarm/derive_includes.py
+++ b/utils/tests/swarm/derive_includes.py
@@ -193,6 +193,21 @@ def derive_includes(
     return sorted(found)
 
 
+def variant_scope(app_id: str, *, variants: dict[str, int] | None = None) -> list[str]:
+    """Deployed roles for APP_ID that must carry their own variant config.
+
+    Args:
+        app_id: role whose closure is resolved.
+        variants: active ``{app_id: variant_index}`` map, as ``derive_includes``.
+    """
+    explicit = set(_EXPLICIT_INCLUDES) - {app_id}
+    return [
+        role
+        for role in derive_includes(app_id, variants=variants)
+        if role not in explicit
+    ]
+
+
 def _disabled_provider_roles(service_registry: dict[str, Any]) -> set[str]:
     """Provider roles the ``disable`` env removes from the closure, so the
     swarm include set matches what the provision-time services_disabler
diff --git a/utils/tests/swarm/matrix.py b/utils/tests/swarm/matrix.py
index 18311d2206..efc652fbd4 100644
--- a/utils/tests/swarm/matrix.py
+++ b/utils/tests/swarm/matrix.py
@@ -21,14 +21,12 @@ from __future__ import annotations
 import argparse
 import json
 import os
-import shutil
-import subprocess
 import sys
-import time
 
 from utils import PROJECT_ROOT
-from utils.env.runtime import mem_available_mb, mem_stall_pct, mem_total_mb
 from utils.storage.constrained import host_storage_constrained
+from utils.tests.swarm.derive_includes import derive_includes, variant_scope
+from utils.tests.swarm.run import DISK_FLOOR_MB, run_step
 from utils.tests.swarm.write.extras import ensure_swarm_keypairs
 
 _SWARM_DIR = PROJECT_ROOT / "scripts" / "tests" / "deploy" / "swarm"
@@ -36,86 +34,6 @@ _SWARM_SCRIPTS = _SWARM_DIR / "routine"
 _ROLES_DIR = str(PROJECT_ROOT / "roles")
 _SWARM_EXTRAS_VARS = "inventories/development/swarm.yml"
 _DEFAULT_INVENTORY_DIR = "/tmp/inv"  # noqa: S108 - ephemeral swarm-test inventory base in CI
-DISK_FLOOR_MB = 6 * 2**10
-MEM_FLOOR_RATIO = 0.06
-
-
-def _abort(proc: subprocess.Popen[bytes], banner: str, probe: list[str]) -> int:
-    print(banner, flush=True)
-    subprocess.run(probe, check=False)
-    proc.terminate()
-    try:
-        proc.wait(timeout=30)
-    except subprocess.TimeoutExpired:
-        proc.kill()
-        proc.wait()
-    return 75
-
-
-def _run(cmd: list[str], *, env: dict[str, str], label: str) -> int:
-    """Announce a matrix step, run it, and report what it cost.
-
-    Args:
-        cmd: argv of the step.
-        env: environment the step runs with.
-        label: phase name for the banners.
-
-    Returns:
-        The step's exit code.
-    """
-    print(f"=== swarm-matrix: {label} ===", flush=True)
-    started = time.monotonic()
-    rc = _run_watched(cmd, env=env)
-    print(
-        f"=== swarm-matrix: {label} took {time.monotonic() - started:.0f}s (rc={rc}) ===",
-        flush=True,
-    )
-    return rc
-
-
-def _run_watched(cmd: list[str], *, env: dict[str, str]) -> int:
-    """Run a step, aborting visibly before the runner disk or RAM fills.
-
-    The Actions Worker dies silently on ENOSPC while writing its own logs, so
-    a full disk truncates the job without diagnostics; terminating the step at
-    DISK_FLOOR_MB keeps enough room for rescue artifacts and the log upload.
-
-    Args:
-        cmd: argv of the step.
-        env: environment the step runs with.
-
-    Returns:
-        The step's exit code, or the abort code when a floor was hit.
-    """
-    proc = subprocess.Popen(cmd, cwd=str(PROJECT_ROOT), env=env)
-    while True:
-        try:
-            return int(proc.wait(timeout=30))
-        except subprocess.TimeoutExpired:
-            free_mb = shutil.disk_usage("/").free // 2**20
-            if free_mb < DISK_FLOOR_MB:
-                return _abort(
-                    proc,
-                    "=== swarm-matrix: DISK EXHAUSTION IMMINENT "
-                    f"(<{DISK_FLOOR_MB}M free on /) - aborting step ===",
-                    ["df", "-h", "/"],
-                )
-            avail = mem_available_mb()
-            total = mem_total_mb()
-            stall = mem_stall_pct()
-            print(
-                f"=== swarm-matrix: host mem {avail}M/{total}M available, "
-                f"disk {free_mb}M free on /, stall60 {stall:.1f}% ===",
-                flush=True,
-            )
-            if total and avail < total * MEM_FLOOR_RATIO:
-                return _abort(
-                    proc,
-                    "=== swarm-matrix: MEMORY EXHAUSTION IMMINENT "
-                    f"({avail}M available, below {MEM_FLOOR_RATIO:.0%} of RAM)"
-                    " - aborting step ===",
-                    ["free", "-m"],
-                )
 
 
 def _provision(
@@ -126,7 +44,7 @@ def _provision(
     env["INFINITO_INVENTORY_DIR"] = inv_dir
     env["INFINITO_APP_VARIANTS"] = json.dumps(round_variants, sort_keys=True)
     env["INFINITO_VARS_PAYLOAD"] = json.dumps(vars_payload, sort_keys=True)
-    return _run(
+    return run_step(
         ["bash", str(_SWARM_SCRIPTS / "02_provision_inventory.sh")],
         env=env,
         label=f"provision inventory ({inv_dir})",
@@ -140,7 +58,7 @@ def _extend_inventory(
     env["APP_ID"] = app_id
     env["INV_PATH"] = f"{inv_dir}/devices.yml"
     env["INFINITO_APP_VARIANTS"] = json.dumps(round_variants, sort_keys=True)
-    return _run(
+    return run_step(
         ["python3", "-m", "utils.tests.swarm.extend_inventory"],
         env=env,
         label="extend inventory (workers + group memberships)",
@@ -157,7 +75,7 @@ def _write_mesh(*, inv_dir: str) -> int:
     args += ["--inventory", f"{inv_dir}/backup.yml"]
     args += ["--host-vars-dir", f"{inv_dir}/host_vars"]
     args += ["--vault-password-file", f"{inv_dir}/.password"]
-    return _run(
+    return run_step(
         ["python3", "-m", "cli.administration.inventory.mesh", *args],
         env=os.environ.copy(),
         label="write wireguard meshes (cross-host credentials)",
@@ -167,7 +85,7 @@ def _write_mesh(*, inv_dir: str) -> int:
 def _force_shared_db(*, inv_dir: str) -> int:
     env = os.environ.copy()
     env["INV_DIR"] = inv_dir
-    return _run(
+    return run_step(
         ["python3", "-m", "utils.tests.swarm.force_shared_db"],
         env=env,
         label="force shared DB (swarm: embedded DB is compose-only)",
@@ -177,20 +95,29 @@ def _force_shared_db(*, inv_dir: str) -> int:
 def _write_extras(*, extras_path: str) -> int:
     env = os.environ.copy()
     env["OUT_PATH"] = extras_path
-    return _run(
+    return run_step(
         ["python3", "-m", "utils.tests.swarm.write.extras"],
         env=env,
         label=f"write runtime extras ({extras_path})",
     )
 
 
-def _reset_credentials(*, inv_dir: str, round_variants: dict[str, int]) -> int:
+def _reset_credentials(
+    *, app_id: str, inv_dir: str, round_variants: dict[str, int]
+) -> int:
     """Regenerate the round's credentials so the update pass has to carry them.
 
     `administrator` stays exempt: its password is `ansible_become_password`,
     and rotating it would lock the deploy out of the nodes it manages.
+
+    The credential scope is `derive_includes`, the same source
+    `02_provision_inventory.sh` feeds provision's `--include`, so the gate
+    rotates the ids the round provisioned. A matrix host_vars file also holds
+    an application block per mirror artefact, and rotating those costs one
+    subprocess each for credentials provision never generated. Every declared
+    user password still rotates, so PASS 2 has to carry all of them.
     """
-    return _run(
+    return run_step(
         [
             "python3",
             "-m",
@@ -201,6 +128,8 @@ def _reset_credentials(*, inv_dir: str, round_variants: dict[str, int]) -> int:
             os.environ["MGR"],
             "--schema",
             "--users",
+            "--include",
+            *derive_includes(app_id, variants=round_variants),
             "--app-variants",
             json.dumps(round_variants, sort_keys=True),
             "--mirror",
@@ -252,7 +181,7 @@ def _deploy(
     else:
         label = f"deploy round {round_index + 1}/{total}"
         print(f"=== {pass_label} PASS 1 (sync) ===", flush=True)
-    return _run(env=env, cmd=cmd, label=label)
+    return run_step(env=env, cmd=cmd, label=label)
 
 
 def _deploy_backup_host(*, app_id: str, inv_dir: str, extras_path: str) -> int:
@@ -273,20 +202,20 @@ def _deploy_backup_host(*, app_id: str, inv_dir: str, extras_path: str) -> int:
         "-e",
         f"@{extras_path}",
     ]
-    return _run(env=env, cmd=cmd, label="deploy backup host (backup.yml)")
+    return run_step(env=env, cmd=cmd, label="deploy backup host (backup.yml)")
 
 
 def _converge_and_verify(*, app_id: str) -> int:
     env = os.environ.copy()
     env["APP_ID"] = app_id
-    rc = _run(
+    rc = run_step(
         ["bash", str(_SWARM_SCRIPTS / "03_wait_converge.sh")],
         env=env,
         label="wait for stack convergence",
     )
     if rc != 0:
         return rc
-    return _run(
+    return run_step(
         ["bash", str(_SWARM_SCRIPTS / "04_verify_reachable.sh")],
         env=env,
         label="verify reachability",
@@ -299,7 +228,7 @@ def _backup_restore_drill(*, app_id: str, inv_dir: str, extras_path: str) -> int
     env["INFINITO_INVENTORY_DIR"] = inv_dir
     env["DRILL_EXTRAS"] = extras_path
     env["DISK_FLOOR_MB"] = str(DISK_FLOOR_MB)
-    return _run(
+    return run_step(
         ["bash", str(_SWARM_SCRIPTS / "backup" / "base.sh")],
         env=env,
         label="backup + restore DR drill",
@@ -309,7 +238,7 @@ def _backup_restore_drill(*, app_id: str, inv_dir: str, extras_path: str) -> int
 def _verify_recovered_marker(*, app_id: str) -> int:
     env = os.environ.copy()
     env["APP_ID"] = app_id
-    return _run(
+    return run_step(
         ["bash", str(_SWARM_SCRIPTS / "backup" / "verify_recovered_marker.sh")],
         env=env,
         label="verify recovered marker (post update pass)",
@@ -321,7 +250,7 @@ def _purge(*, purge_set: tuple[str, ...]) -> int:
         return 0
     env = os.environ.copy()
     env["apps"] = ",".join(purge_set)
-    return _run(
+    return run_step(
         ["bash", str(_SWARM_DIR / "utils" / "clean" / "purge_stacks.sh")],
         env=env,
         label=f"purge prior-round stacks ({', '.join(purge_set)})",
@@ -390,7 +319,7 @@ def main(argv: list[str] | None = None) -> int:
         round_index,
         inv_dir,
         round_variants,
-        round_include,
+        _round_include,
         round_purge_set,
     ) in enumerate(plan):
         inv_root = inv_dir.rstrip("/")
@@ -402,7 +331,7 @@ def main(argv: list[str] | None = None) -> int:
 
         variant_payloads = _resolve_variant_payloads(
             roles_dir=_ROLES_DIR,
-            include=round_include,
+            include=variant_scope(app_id, variants=round_variants),
             active_variants=round_variants,
         )
         from utils.tests.swarm.backup_repos import backup_provider_ips
@@ -471,10 +400,9 @@ def main(argv: list[str] | None = None) -> int:
                 app_id=app_id, inv_dir=inv_root, extras_path=extras_path
             )
         if rc == 0:
-            rc = _reset_credentials(inv_dir=inv_root, round_variants=round_variants)
-        # Exception: the reset mirrors the manager's host_vars onto every node,
-        # which is right for per-host-identical credentials and wrong for a
-        # mesh, whose members must differ.
+            rc = _reset_credentials(
+                app_id=app_id, inv_dir=inv_root, round_variants=round_variants
+            )
         if rc == 0:
             rc = _write_mesh(inv_dir=inv_root)
         if rc == 0:
diff --git a/utils/tests/swarm/run.py b/utils/tests/swarm/run.py
new file mode 100644
index 0000000000..e400217d9d
--- /dev/null
+++ b/utils/tests/swarm/run.py
@@ -0,0 +1,92 @@
+"""Run one swarm-matrix step, aborting before the runner's disk or RAM fills.
+
+The Actions Worker dies silently on ENOSPC while writing its own logs, so a
+full disk truncates the job without diagnostics. Terminating the step at
+DISK_FLOOR_MB keeps enough room for the rescue artifacts and the log upload.
+"""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+import time
+
+from utils import PROJECT_ROOT
+from utils.env.runtime import mem_available_mb, mem_stall_pct, mem_total_mb
+
+DISK_FLOOR_MB = 6 * 2**10
+MEM_FLOOR_RATIO = 0.06
+
+
+def _abort(proc: subprocess.Popen[bytes], banner: str, probe: list[str]) -> int:
+    print(banner, flush=True)
+    subprocess.run(probe, check=False)
+    proc.terminate()
+    try:
+        proc.wait(timeout=30)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        proc.wait()
+    return 75
+
+
+def run_step(cmd: list[str], *, env: dict[str, str], label: str) -> int:
+    """Announce a matrix step, run it, and report what it cost.
+
+    Args:
+        cmd: argv of the step.
+        env: environment the step runs with.
+        label: phase name for the banners.
+
+    Returns:
+        The step's exit code.
+    """
+    print(f"=== swarm-matrix: {label} ===", flush=True)
+    started = time.monotonic()
+    rc = run_watched(cmd, env=env)
+    print(
+        f"=== swarm-matrix: {label} took {time.monotonic() - started:.0f}s (rc={rc}) ===",
+        flush=True,
+    )
+    return rc
+
+
+def run_watched(cmd: list[str], *, env: dict[str, str]) -> int:
+    """Run a step, aborting visibly before the runner disk or RAM fills.
+
+    Args:
+        cmd: argv of the step.
+        env: environment the step runs with.
+
+    Returns:
+        The step's exit code, or the abort code when a floor was hit.
+    """
+    proc = subprocess.Popen(cmd, cwd=str(PROJECT_ROOT), env=env)
+    while True:
+        try:
+            return int(proc.wait(timeout=30))
+        except subprocess.TimeoutExpired:
+            free_mb = shutil.disk_usage("/").free // 2**20
+            if free_mb < DISK_FLOOR_MB:
+                return _abort(
+                    proc,
+                    "=== swarm-matrix: DISK EXHAUSTION IMMINENT "
+                    f"(<{DISK_FLOOR_MB}M free on /) - aborting step ===",
+                    ["df", "-h", "/"],
+                )
+            avail = mem_available_mb()
+            total = mem_total_mb()
+            stall = mem_stall_pct()
+            print(
+                f"=== swarm-matrix: host mem {avail}M/{total}M available, "
+                f"disk {free_mb}M free on /, stall60 {stall:.1f}% ===",
+                flush=True,
+            )
+            if total and avail < total * MEM_FLOOR_RATIO:
+                return _abort(
+                    proc,
+                    "=== swarm-matrix: MEMORY EXHAUSTION IMMINENT "
+                    f"({avail}M available, below {MEM_FLOOR_RATIO:.0%} of RAM)"
+                    " - aborting step ===",
+                    ["free", "-m"],
+                )
diff --git a/utils/update/base.py b/utils/update/base.py
index 2900d2eaa7..161664e813 100644
--- a/utils/update/base.py
+++ b/utils/update/base.py
@@ -1,15 +1,24 @@
 """Semver primitives shared by every version-bump backend.
 
-A "version" here is a tag of the shape ``v?<numeric-semver>(-<flavor>)?``,
-where the numeric part has 1 to 4 dot-separated components and the
-optional ``-<flavor>`` suffix is an opaque discriminator (e.g. the
-Docker Official Image tag ``5.4.5-php8.3-apache`` or the npm-style
-``1.2.3-alpha``).
+A "version" here is a tag of the shape
+``(<channel>-)?v?<numeric-semver><patch>?(-<flavor>)?``, where the numeric part
+has 1 to 5 dot-separated components, the optional leading ``<channel>-`` is a
+release line written before the number (e.g. the LiteLLM tag
+``main-v1.77.7-stable`` or the Jitsi tag ``stable-9646``), the optional
+``<patch>`` is a vendor counter written as a letter and a number (e.g. the
+Checkmk tag ``2.4.0p32``), and the optional ``-<flavor>`` suffix is an opaque
+discriminator (e.g. the Docker Official Image tag ``5.4.5-php8.3-apache`` or
+the npm-style ``1.2.3-alpha``).
 
-Upgrade candidates MUST share the same depth (1, 2, 3 or 4 components)
-AND the same flavor as the current tag, so that ``5.4.5-php8.3-apache``
-never silently bumps to ``5.4.6-php8.4-apache`` (different runtime) or
-to ``5.4.6`` (different depth).
+Upgrade candidates MUST share the same depth (1 to 5 components) AND the same
+flavor as the current tag, so that ``5.4.5-php8.3-apache`` never silently bumps
+to ``5.4.6-php8.4-apache`` (different runtime) or to ``5.4.6`` (different
+depth). Everything that is not the number folds into the flavor: the leading
+channel, the trailing suffix and the patch letter. That is what keeps
+``main-v1.77.7-stable`` away from ``main-v1.77.7-nightly``, ``stable-9646``
+away from a bare ``9646``, and ``2.4.0p32`` ordering against ``2.4.0p33``
+rather than against the four-component ``2.4.0.32``. Only the patch number
+joins the ordering key, so ``p9`` sorts below ``p10``.
 """
 
 from __future__ import annotations
@@ -17,15 +26,24 @@ from __future__ import annotations
 import os
 import re
 
-_SEMVER_CORE = r"v?\d+(?:\.\d+){0,3}"
-_VERSIONED_TAG_RE = re.compile(rf"^(?P<semver>{_SEMVER_CORE})(?P<flavor>-\S+)?$")
+_SEMVER_CORE = r"v?\d+(?:\.\d+){0,4}"
+_VERSIONED_TAG_RE = re.compile(
+    rf"^(?P<channel>[A-Za-z][A-Za-z0-9]*-)?(?P<semver>{_SEMVER_CORE})"
+    rf"(?P<patch>[A-Za-z]\d+)?(?P<flavor>-\S+)?$"
+)
 
 
-def _parse_versioned_tag(tag: str) -> tuple[str, str] | None:
+def _parse_versioned_tag(tag: str) -> tuple[str, str, int | None] | None:
     match = _VERSIONED_TAG_RE.match(str(tag).strip())
     if match is None:
         return None
-    return match.group("semver"), match.group("flavor") or ""
+    patch = match.group("patch")
+    flavor = (
+        (match.group("channel") or "")
+        + (match.group("flavor") or "")
+        + (patch[0] if patch else "")
+    )
+    return match.group("semver"), flavor, int(patch[1:]) if patch else None
 
 
 def is_semver(value: str) -> bool:
@@ -36,16 +54,17 @@ def version_key(tag: str) -> tuple[int, ...]:
     parsed = _parse_versioned_tag(tag)
     if parsed is None:
         return (0,) * 4
-    semver, _flavor = parsed
+    semver, _flavor, patch = parsed
     parts = tuple(int(part) for part in semver.lstrip("v").split("."))
-    return parts + (0,) * (4 - len(parts))
+    padded = parts + (0,) * (4 - len(parts))
+    return padded if patch is None else (*padded, patch)
 
 
 def version_depth(tag: str) -> int:
     parsed = _parse_versioned_tag(tag)
     if parsed is None:
         return 0
-    semver, _flavor = parsed
+    semver, _flavor, _patch = parsed
     return len(semver.lstrip("v").split("."))
 
 
diff --git a/utils/update/collection_source.py b/utils/update/collection_source.py
new file mode 100644
index 0000000000..546ed3488e
--- /dev/null
+++ b/utils/update/collection_source.py
@@ -0,0 +1,115 @@
+"""Which requirements source ``scripts/install/ansible.sh`` should try first.
+
+Both sources carry the same pinned collections, so the only thing separating
+them is how long they take and whether they answer at all. A single slow day
+says nothing: galaxy.ansible.com degrades and recovers, and a git clone can
+stall on one runner. The default is therefore retuned only when a rolling
+window of daily samples shows one source durably behind the other.
+
+A sample whose install failed is recorded as ``None`` and ranks worse than
+any duration, so an outage counts fully rather than being dropped.
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from statistics import median
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+SOURCES = ("galaxy", "git")
+WINDOW = 12
+"""Samples the median is taken over; below this the default is left alone."""
+
+RATIO = 3.0
+"""How many times slower the preferred source must be before it is swapped."""
+
+
+@dataclass(frozen=True)
+class Verdict:
+    """The outcome of comparing the two sources.
+
+    Args:
+        preferred: the source in force when the comparison ran.
+        proposed: the source the samples favour, equal to preferred when
+            nothing should change.
+        medians: median seconds per source, infinite when every sample failed.
+        samples: how many samples the medians were taken over.
+    """
+
+    preferred: str
+    proposed: str
+    medians: dict[str, float]
+    samples: int
+
+    @property
+    def changed(self) -> bool:
+        return self.proposed != self.preferred
+
+
+def load_history(path: Path) -> list[dict[str, float | None]]:
+    """Samples recorded so far, oldest first, or an empty list.
+
+    Args:
+        path: JSON file holding the rolling window.
+    """
+    try:
+        raw = path.read_text()  # nocheck: cache-read -- rewritten every run
+        payload = json.loads(raw)
+    except (OSError, ValueError):
+        return []
+    return payload if isinstance(payload, list) else []
+
+
+def append_sample(
+    history: list[dict[str, float | None]], sample: dict[str, float | None]
+) -> list[dict[str, float | None]]:
+    """The history with SAMPLE appended, truncated to the newest WINDOW entries.
+
+    Args:
+        history: samples recorded so far, oldest first.
+        sample: seconds per source for this run, None where the install failed.
+    """
+    return [*history, sample][-WINDOW:]
+
+
+def _median_seconds(history: list[dict[str, float | None]], source: str) -> float:
+    values = [
+        float("inf") if entry.get(source) is None else float(entry[source])
+        for entry in history
+    ]
+    return median(values) if values else float("inf")
+
+
+def decide(history: list[dict[str, float | None]], preferred: str) -> Verdict:
+    """Whether the samples justify swapping the preferred source.
+
+    Args:
+        history: samples recorded so far, oldest first.
+        preferred: the source currently tried first.
+    """
+    medians = {source: _median_seconds(history, source) for source in SOURCES}
+    verdict = Verdict(
+        preferred=preferred,
+        proposed=preferred,
+        medians=medians,
+        samples=len(history),
+    )
+    if len(history) < WINDOW:
+        return verdict
+
+    other = next(source for source in SOURCES if source != preferred)
+    mine, theirs = medians[preferred], medians[other]
+    if theirs == float("inf") or theirs <= 0:
+        return verdict
+    if mine >= theirs * RATIO:
+        return Verdict(
+            preferred=preferred,
+            proposed=other,
+            medians=medians,
+            samples=len(history),
+        )
+    return verdict
diff --git a/utils/update/docker.py b/utils/update/docker.py
index 0c96b20cd4..53bf9561f8 100644
--- a/utils/update/docker.py
+++ b/utils/update/docker.py
@@ -19,6 +19,7 @@ import re
 import time
 import urllib.error
 import urllib.request
+from collections import defaultdict
 from dataclasses import dataclass
 from typing import TYPE_CHECKING
 from urllib.parse import quote, urlencode
@@ -342,7 +343,53 @@ def find_outdated_updates(repo_root: Path) -> list[DockerImageVersionUpdate]:
         if latest and version_key(entry.version) < version_key(latest):
             updates.append(DockerImageVersionUpdate(entry=entry, latest=latest))
 
-    return updates
+    return _held_to_release_groups(updates, image_tags)
+
+
+def _held_to_release_groups(
+    updates: list[DockerImageVersionUpdate], image_tags: dict[str, list[str]]
+) -> list[DockerImageVersionUpdate]:
+    """Hold every member of a release group to the newest tag all of them
+    publish.
+
+    Several images of one role that currently sit on the same version are one
+    product released together (the four Jitsi components, the six GitLab CNG
+    images). Upstream does not push them atomically, so a run that lands in the
+    window between the first and the last push would raise the ones already
+    there and leave the rest behind, deploying a mixed set.
+
+    Args:
+        updates: the per-entry candidates, before grouping.
+        image_tags: every tag fetched per image, keyed as in the caller.
+
+    Returns:
+        The updates, each group lowered to its common newest tag, and dropped
+        entirely where the group shares no newer tag at all.
+    """
+    groups: dict[tuple[str, str], list[DockerImageVersionUpdate]] = defaultdict(list)
+    for update in updates:
+        groups[(update.entry.role, update.entry.version)].append(update)
+
+    held: list[DockerImageVersionUpdate] = []
+    for group in groups.values():
+        if len(group) == 1:
+            held.extend(group)
+            continue
+        shared = set.intersection(
+            *(set(image_tags.get(update.entry.image, [])) for update in group)
+        )
+        current = group[0].entry.version
+        common = latest_semver(
+            sorted(shared), version_depth(current), version_flavor(current)
+        )
+        if not common or version_key(current) >= version_key(common):
+            continue
+        held.extend(
+            DockerImageVersionUpdate(entry=update.entry, latest=common)
+            for update in group
+        )
+
+    return held
 
 
 def update_config_versions(config_path: Path, service_versions: dict[str, str]) -> bool:
diff --git a/utils/update/galaxy.py b/utils/update/galaxy.py
new file mode 100644
index 0000000000..a29a3edf1c
--- /dev/null
+++ b/utils/update/galaxy.py
@@ -0,0 +1,136 @@
+"""Pinned Ansible collection versions in ``requirements/``.
+
+Both requirement files name the same collections at the same versions: the
+Galaxy file is the normal source, the git file the fallback used when
+galaxy.ansible.com is unreachable. A bump that touches only one of them
+would make the fallback install something the pin does not describe, so an
+update is applied to both or to neither.
+
+Upstream releases are resolved from the git file's own ``source:`` URL via
+``git ls-remote --tags``, not from the Galaxy API, because the collections
+are tagged in the repository the fallback already clones.
+
+An entry whose ``version:`` is not a semver (a branch name, say) states an
+intent this cannot second-guess and is skipped.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+from utils.cache.yaml import load_yaml_any
+from utils.update.base import is_semver, version_key
+from utils.update.repository import git_ls_remote_tags
+
+GALAXY_REQUIREMENTS = Path("requirements/requirements.galaxy.yml")
+GIT_REQUIREMENTS = Path("requirements/requirements.git.yml")
+
+
+@dataclass(frozen=True)
+class CollectionPin:
+    """One collection pinned in both requirement files.
+
+    Args:
+        fqcn: fully qualified collection name, namespace and name.
+        version: the version both files pin today.
+        source: upstream git URL taken from the git requirements file.
+    """
+
+    fqcn: str
+    version: str
+    source: str
+
+
+@dataclass(frozen=True)
+class CollectionPinUpdate:
+    pin: CollectionPin
+    latest: str
+
+
+def _entries(path: Path) -> list[dict]:
+    declared = load_yaml_any(str(path), default_if_missing={}) or {}
+    return [e for e in (declared.get("collections") or []) if isinstance(e, dict)]
+
+
+def collect_pins(repo_root: Path) -> list[CollectionPin]:
+    """Collections pinned to the same semver in both requirement files.
+
+    Args:
+        repo_root: repository root holding the ``requirements`` directory.
+    """
+    galaxy = {
+        str(e.get("name")): str(e.get("version"))
+        for e in _entries(repo_root / GALAXY_REQUIREMENTS)
+        if e.get("name") and e.get("version")
+    }
+    pins: list[CollectionPin] = []
+    for entry in _entries(repo_root / GIT_REQUIREMENTS):
+        fqcn = str(entry.get("name", ""))
+        version = str(entry.get("version", ""))
+        source = str(entry.get("source", ""))
+        if not (fqcn and source and is_semver(version)):
+            continue
+        if galaxy.get(fqcn) != version:
+            continue
+        pins.append(CollectionPin(fqcn=fqcn, version=version, source=source))
+    return pins
+
+
+def _highest_release(source: str, current: str) -> str | None:
+    candidates = [
+        tag
+        for tag in git_ls_remote_tags(source)
+        if is_semver(tag) and tag.lstrip("v").count(".") == current.count(".")
+    ]
+    if not candidates:
+        return None
+    newest = max(candidates, key=version_key)
+    if version_key(newest) <= version_key(current):
+        return None
+    return newest.lstrip("v")
+
+
+def find_outdated_updates(repo_root: Path) -> list[CollectionPinUpdate]:
+    """Pins whose upstream carries a higher release tag.
+
+    Args:
+        repo_root: repository root holding the ``requirements`` directory.
+    """
+    updates: list[CollectionPinUpdate] = []
+    for pin in collect_pins(repo_root):
+        latest = _highest_release(pin.source, pin.version)
+        if latest:
+            updates.append(CollectionPinUpdate(pin=pin, latest=latest))
+    return updates
+
+
+def _rewrite(path: Path, fqcn: str, old: str, new: str) -> bool:
+    text = path.read_text(
+        encoding="utf-8"
+    )  # nocheck: cache-read -- rewritten below, a cached copy would go stale mid-run
+    pattern = re.compile(
+        rf"(name:\s*{re.escape(fqcn)}\b(?:\n(?!\s*-\s).*)*?\n\s*version:\s*){re.escape(old)}\b"
+    )
+    replaced, count = pattern.subn(rf"\g<1>{new}", text)
+    if not count:
+        return False
+    path.write_text(replaced, encoding="utf-8")
+    return True
+
+
+def apply_updates(repo_root: Path, updates: list[CollectionPinUpdate]) -> list[Path]:
+    """Write every update into both requirement files.
+
+    Args:
+        repo_root: repository root holding the ``requirements`` directory.
+        updates: the bumps to apply, as returned by :func:`find_outdated_updates`.
+    """
+    changed: set[Path] = set()
+    for update in updates:
+        for relative in (GALAXY_REQUIREMENTS, GIT_REQUIREMENTS):
+            path = repo_root / relative
+            if _rewrite(path, update.pin.fqcn, update.pin.version, update.latest):
+                changed.add(path)
+    return sorted(changed)
diff --git a/utils/update/repository.py b/utils/update/repository.py
index ac5561fb22..c43f446461 100644
--- a/utils/update/repository.py
+++ b/utils/update/repository.py
@@ -30,7 +30,7 @@ from typing import TYPE_CHECKING
 from utils.annotations.suppress import is_suppressed_at
 from utils.cache.files import read_text
 from utils.cache.yaml import load_yaml_any
-from utils.roles.mapping import ROLE_FILE_META_SERVICES
+from utils.roles.mapping import ROLE_DIR_META_ADDONS, ROLE_FILE_META_SERVICES
 from utils.update.base import (
     is_semver,
     latest_semver,
@@ -148,43 +148,67 @@ def suppressed_ref_lines(config_path: Path) -> set[int]:
     return suppressed
 
 
+def _entries_of_file(
+    role_name: str, config_path: Path, entity_prefix: tuple[str, ...]
+) -> list[RepositoryRefEntry]:
+    """Return the unsuppressed semver ``(repository, ref)`` entries of one
+    declaration file.
+
+    Args:
+        role_name: role the file belongs to, carried into each entry.
+        config_path: YAML file to read.
+        entity_prefix: path segments prepended to the entity path, so an
+            addon's entries stay distinguishable from a service's.
+    """
+    data = load_yaml_any(str(config_path), default_if_missing=None)
+    if not isinstance(data, dict):
+        return []
+
+    ref_line_index: dict[str, list[int]] = {}
+    for line_no, ref_value in _ref_lines(read_text(str(config_path)).splitlines()):
+        ref_line_index.setdefault(ref_value, []).append(line_no)
+
+    suppressed = suppressed_ref_lines(config_path)
+    entries: list[RepositoryRefEntry] = []
+    for entity_path, repo, ref in walk_repo_ref_pairs(data, entity_prefix):
+        if not is_semver(ref):
+            continue
+        candidates = ref_line_index.get(ref) or []
+        if not candidates:
+            continue
+        line_no = candidates.pop(0)
+        if line_no in suppressed:
+            continue
+        entries.append(
+            RepositoryRefEntry(
+                role=role_name,
+                entity_path=entity_path,
+                repository=repo,
+                ref=ref,
+                config_path=config_path,
+                line=line_no,
+            )
+        )
+    return entries
+
+
 def collect_entries(repo_root: Path) -> list[RepositoryRefEntry]:
     """Return every semver-checkable ``(repository, ref)`` declaration
-    under ``roles/*/meta/services.yml`` whose ref is not suppressed."""
+    under ``roles/*/meta/services.yml`` and ``roles/*/meta/addons/*.yml``
+    whose ref is not suppressed."""
     roles_root = repo_root / "roles"
     entries: list[RepositoryRefEntry] = []
     for role_dir in sorted(p for p in roles_root.iterdir() if p.is_dir()):
         services_path = role_dir / ROLE_FILE_META_SERVICES
-        if not services_path.is_file():
-            continue
-        data = load_yaml_any(str(services_path), default_if_missing=None)
-        if not isinstance(data, dict):
-            continue
+        if services_path.is_file():
+            entries += _entries_of_file(role_dir.name, services_path, ())
 
-        raw = read_text(str(services_path))
-        ref_line_index: dict[str, list[int]] = {}
-        for line_no, ref_value in _ref_lines(raw.splitlines()):
-            ref_line_index.setdefault(ref_value, []).append(line_no)
-
-        suppressed = suppressed_ref_lines(services_path)
-        for entity_path, repo, ref in walk_repo_ref_pairs(data, ()):
-            if not is_semver(ref):
-                continue
-            candidates = ref_line_index.get(ref) or []
-            if not candidates:
-                continue
-            line_no = candidates.pop(0)
-            if line_no in suppressed:
-                continue
-            entries.append(
-                RepositoryRefEntry(
-                    role=role_dir.name,
-                    entity_path=entity_path,
-                    repository=repo,
-                    ref=ref,
-                    config_path=services_path,
-                    line=line_no,
-                )
+        addons_dir = role_dir / ROLE_DIR_META_ADDONS
+        if not addons_dir.is_dir():
+            continue
+        for addon_path in sorted(addons_dir.glob("*.yml")):
+            entries += _entries_of_file(
+                role_dir.name, addon_path, ("addons", addon_path.stem)
             )
     return entries