Merge remote-tracking branch 'origin/master' into beta

Add 'test' key with 'Beta tests' label to workerRoute response data.
2026-05-27 11:47:40 +02:00 · 2026-05-21 11:39:40 +02:00
372 changed files with 8547 additions and 176075 deletions
@@ -1,7 +1 @@
-/docker-compose.yml
-
-# Runtime-generated replication bootstrap snapshots may contain infrastructure
-# metadata and encrypted/plaintext credential material. They must be
-# supplied at runtime via mounted storage, not baked into deployment images.
-/services/nginx/app/storage/replication-bootstrap.json
-/services/nginx/app/storage/replication-bootstrap-*.json
+/docker-compose.yml
@@ -53,8 +53,8 @@ ECONOMIC_API_APP_SECRET_TOKEN=
 # Edge broker defaults for shell relay and gateway dispatch.
 EDGE_BROKER_URL=http://edge-broker:4300
 EDGE_PUBLIC_BROKER_URL=http://localhost/api/edge-broker
-EDGE_AUTH_MODE=strict
-EDGE_BROKER_SHARED_SECRET=
+EDGE_AUTH_MODE=manager
+EDGE_BROKER_SHARED_SECRET=truckwash-edge-dev

 # Redis credentials
 REDIS_CONFIG_HOST=redis
@@ -0,0 +1,42 @@
+USE_ENV=true
+# Target of the database connection. Can be either 'live' or 'debug'.
+CONFIG_DB_TARGET=live
+CONFIG_DB_DATABASE=nnks_db
+#CONFIG_DB_HOST=94.130.142.41
+CONFIG_DB_HOST=23.88.23.183
+CONFIG_DB_PASSWORD=562X0Lrr7Cz6zpXZ11I
+CONFIG_DB_USER=root
+CONFIG_DB_PORT=5432
+CONFIG_DB_DEBUG_DATABASE=nnks_db
+CONFIG_DB_DEBUG_HOST=23.88.23.183
+CONFIG_DB_DEBUG_PORT=5432
+CONFIG_DB_DEBUG_PASSWORD=562X0Lrr7Cz6zpXZ11I
+CONFIG_DB_DEBUG_USER=root
+CONFIG_TIMEZONE=Europe/Copenhagen
+CORS=https://truckwash.io,https://www.truckwash.io,https://api.truckwash.io,https://api.truckwash.io:4433,https://web.truckwash.dk,https://api.truckwash.dk,https://truckwash.dk,https://www.truckwash.dk,https://staging.truckwash.io,http://localhost,https://localhost,http://localhost:4433,https://localhost:4433,https://twdev.jeppeb.dk,http://localhost:5173
+# CORS=*
+
+DEBUG=false
+ECONOMIC_API_APP_ACCESS_GRANT=94bhkmdtaDA7kVn9abF2SGDccBDMvk5a6iWYnmJMbvQ1
+ECONOMIC_API_APP_ACCESS_GRANT2=qGSBSkh1pjBtdSOygHhaMPn1A4PcMto3sCDCGYpLmsg1
+ECONOMIC_API_APP_SECRET_TOKEN=V8GSEcIxMsTISczzTTBbOAMJyh8eucGZtBiGOxjMFg0
+EMAIL_WASH_CERTIFICATE_TOKEN=H7uDTtFaeN4asqpb5okh6dr8z209SGtt
+ENCRYPTION_KEY=Gvm37uF2VyTOjGkVl4kjrGQ0qRwOyq9lr3+p/QyUDjc\\=
+MINIO_ACCESS_KEY=d7u6RaFyYmckAIWYGUYr
+MINIO_ENDPOINT=http://162.55.225.220:9000
+MINIO_SECRET_KEY=a2wJUQfkOPNO3UJfXYIdpNq4r1RrthcjiUfW1gVS
+REDIS_CONFIG_DATABASE=0
+REDIS_CONFIG_HOST=23.88.23.183
+REDIS_CONFIG_PASSWORD=BlVg5o1NwkkR1IjKxQm
+REDIS_CONFIG_PORT=5433
+REDIS_CONFIG_USER=default
+REDIS_CONFIG_DEBUG_PORT=5433
+REDIS_CONFIG_DEBUG_USER=default
+SLACK_DEFAULT_WEBHOOK=https://hooks.slaCk.com/services/T05SRKWTX9C/B08AGMP459P/1W5JN1NpHsHlbHHM2WljpvrU
+WORDPRESS_API_URL=https://www.truckwash.dk/wp-admin/admin-ajax.php
+WORDPRESS_STATIC_TOKEN=earm8BX4MFTgS6JCNQdqW5EzHUutv2Vx
+ELASTIC_APM_SERVER_URL=http://elastic-agent:8200
+ELASTIC_APM_SECRET_TOKEN=apm_dev_token
+ELASTIC_APM_SERVICE_NAME=api-truckwash
+ELASTIC_APM_ENVIRONMENT=dev
+AUTO_COMPOSER_INSTALL=false
@@ -11,8 +11,6 @@ services:

  edge-broker:
    container_name: "${COMPOSE_PROJECT_NAME:-api}-edge-broker"
-    ports:
-      - "127.0.0.1:${EDGE_BROKER_CI_PORT:-14300}:4300"
    labels:
      - "traefik.http.routers.edge-broker-local-ci.rule=PathPrefix(`/api/edge-broker`)"
      - "traefik.http.routers.edge-broker-local-ci.entrypoints=web"
@@ -82,9 +80,3 @@ services:

 volumes:
  ci_php_app:
-
-networks:
-  default:
-    ipam:
-      config:
-        - subnet: "${CI_DOCKER_SUBNET:-10.240.0.0/24}"
@@ -9,44 +9,25 @@ on:

 jobs:
  qodana:
-    # CI runs on the repository's self-hosted runner pool.
-    runs-on: [self-hosted, Linux, X64, pleno, backend, docker]
+    # Run on our self-hosted runner to avoid GitHub-hosted Actions budget limits.
+    runs-on: [self-hosted, Linux, X64, default]
    permissions:
-      contents: read
-      pull-requests: read
-      checks: read
+      contents: write
+      pull-requests: write
+      checks: write
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}  # Use PR head when available, otherwise the pushed SHA.
          fetch-depth: 0  # a full history is required for pull request analysis
-          persist-credentials: false
-      - name: Mark repository as safe for Git
-        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - name: Prepare Qodana cache directories
        run: |
          mkdir -p "${RUNNER_TEMP}/qodana/caches"
          mkdir -p "${RUNNER_TEMP}/qodana/results"
-      - name: Detect Qodana Cloud token
-        id: qodana-token
-        env:
-          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
-        run: |
-          if [ -n "${QODANA_TOKEN:-}" ]; then
-            echo "present=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "present=false" >> "$GITHUB_OUTPUT"
-          fi
-
      - name: 'Qodana Scan'
-        if: ${{ steps.qodana-token.outputs.present == 'true' }}
-        uses: JetBrains/qodana-action@v2026.1
+        uses: JetBrains/qodana-action@v2025.3
        with:
          pr-mode: false
        env:
          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
          QODANA_ENDPOINT: 'https://qodana.cloud'
-
-      - name: 'Skip Qodana Scan (missing cloud token)'
-        if: ${{ steps.qodana-token.outputs.present != 'true' }}
-        run: echo "Skipping Qodana because QODANA_TOKEN is not configured."
@@ -7,7 +7,7 @@ on:
 jobs:
  php:
    name: PHP ${{ matrix.suite }} (required)
-    runs-on: [self-hosted, Linux, X64, pleno, backend, docker]
+    runs-on: [self-hosted, Linux, X64, default]
    strategy:
      fail-fast: false
      matrix:
@@ -19,20 +19,6 @@ jobs:
      - name: Checkout
        uses: actions/checkout@v4

-      - name: Ensure Docker access
-        run: |
-          set -euo pipefail
-          if docker ps >/dev/null 2>&1; then
-            exit 0
-          fi
-          test -S /var/run/docker.sock || (echo "Docker socket is not available." >&2; exit 1)
-          if command -v sudo >/dev/null 2>&1; then
-            sudo -n chmod 666 /var/run/docker.sock
-          else
-            chmod 666 /var/run/docker.sock
-          fi
-          docker ps >/dev/null
-
      - name: Setup Node.js
        if: ${{ matrix.suite == 'unit' }}
        uses: actions/setup-node@v4
@@ -58,7 +44,7 @@ jobs:

  edge-agent:
    name: Edge Agent (required)
-    runs-on: [self-hosted, Linux, X64, pleno, backend]
+    runs-on: [self-hosted, Linux, X64, default]

    steps:
      - name: Checkout
@@ -68,6 +54,8 @@ jobs:
        uses: actions/setup-node@v4
        with:
          node-version: 22
+          cache: npm
+          cache-dependency-path: services/edge-agent/package-lock.json

      - name: Install native build tools
        run: |
@@ -103,26 +91,12 @@ jobs:

  edge-broker:
    name: Edge Broker (required)
-    runs-on: [self-hosted, Linux, X64, pleno, backend, docker]
+    runs-on: [self-hosted, Linux, X64, default]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

-      - name: Ensure Docker access
-        run: |
-          set -euo pipefail
-          if docker ps >/dev/null 2>&1; then
-            exit 0
-          fi
-          test -S /var/run/docker.sock || (echo "Docker socket is not available." >&2; exit 1)
-          if command -v sudo >/dev/null 2>&1; then
-            sudo -n chmod 666 /var/run/docker.sock
-          else
-            chmod 666 /var/run/docker.sock
-          fi
-          docker ps >/dev/null
-
      - name: Materialize CI compose env files
        run: |
          set -euo pipefail
@@ -138,6 +112,8 @@ jobs:
        uses: actions/setup-node@v4
        with:
          node-version: 22
+          cache: npm
+          cache-dependency-path: services/edge-broker/package-lock.json

      - name: Install dependencies
        working-directory: services/edge-broker
@@ -149,83 +125,25 @@ jobs:

  edge-gateway-backend:
    name: Edge Gateway Backend (required)
-    runs-on: [self-hosted, Linux, X64, pleno, backend, docker]
+    runs-on: [self-hosted, Linux, X64, default]
    env:
      COMPOSE_FILE: docker-compose.yml:.github/docker-compose.ci.yml
      COMPOSE_PROJECT_NAME: edge-gateway-backend-${{ github.run_id }}-${{ github.run_attempt }}
-      COMPOSE_PROFILES: dev
      TRAEFIK_WEB_PORT: "18080"
      TRAEFIK_WEBSECURE_PORT: "18443"
      TRAEFIK_WEBSECURE_STAGING_PORT: "18433"
      TRAEFIK_METRICS_PORT: "19100"
-      EDGE_BROKER_CI_PORT: "14300"
      EDGE_GATEWAY_E2E_BASE_URL: "http://localhost:18080/api"

    steps:
      - name: Checkout
        uses: actions/checkout@v4

-      - name: Ensure Docker access
-        run: |
-          set -euo pipefail
-          if docker ps >/dev/null 2>&1; then
-            exit 0
-          fi
-          test -S /var/run/docker.sock || (echo "Docker socket is not available." >&2; exit 1)
-          if command -v sudo >/dev/null 2>&1; then
-            sudo -n chmod 666 /var/run/docker.sock
-          else
-            chmod 666 /var/run/docker.sock
-          fi
-          docker ps >/dev/null
-
-      - name: Allocate CI ports
-        run: |
-          set -euo pipefail
-          find_free_port() {
-            start="$1"
-            end="$2"
-            port="$start"
-            while [ "$port" -le "$end" ]; do
-              if ! ss -H -ltn "sport = :$port" 2>/dev/null | grep -q .; then
-                echo "$port"
-                return 0
-              fi
-              port=$((port + 1))
-            done
-
-            echo "No free port in range ${start}-${end}." >&2
-            exit 1
-          }
-
-          base=$((20000 + (GITHUB_RUN_ID % 20000)))
-          web_port="$(find_free_port "$base" "$((base + 2000))")"
-          websecure_port="$(find_free_port "$((web_port + 1))" "$((web_port + 2000))")"
-          staging_port="$(find_free_port "$((websecure_port + 1))" "$((websecure_port + 2000))")"
-          metrics_port="$(find_free_port "$((staging_port + 1))" "$((staging_port + 2000))")"
-          broker_port="$(find_free_port "$((metrics_port + 1))" "$((metrics_port + 2000))")"
-          checksum="$(printf '%s' "$COMPOSE_PROJECT_NAME" | cksum | awk '{print $1}')"
-          subnet_second=$((64 + ((checksum / 256) % 64)))
-          subnet_third=$((checksum % 256))
-          ci_docker_subnet="10.${subnet_second}.${subnet_third}.0/24"
-
-          {
-            echo "TRAEFIK_WEB_PORT=${web_port}"
-            echo "TRAEFIK_WEBSECURE_PORT=${websecure_port}"
-            echo "TRAEFIK_WEBSECURE_STAGING_PORT=${staging_port}"
-            echo "TRAEFIK_METRICS_PORT=${metrics_port}"
-            echo "EDGE_BROKER_CI_PORT=${broker_port}"
-            echo "CI_DOCKER_SUBNET=${ci_docker_subnet}"
-            echo "EDGE_GATEWAY_E2E_BASE_URL=http://localhost:${web_port}/api"
-            echo "EDGE_GATEWAY_E2E_COMPOSE_PROJECT=${COMPOSE_PROJECT_NAME}"
-          } >> "$GITHUB_ENV"
-
      - name: Materialize CI compose env files
        run: |
          set -euo pipefail
          cp .github/ci.env .env
          cp .github/ci.env.staging .env.staging
-          printf '\nEDGE_PUBLIC_BROKER_URL=http://edge-broker:4300/edge-broker\n' >> .env

      - name: Setup Node.js
        uses: actions/setup-node@v4
@@ -233,7 +151,7 @@ jobs:
          node-version: 22

      - name: Boot local stack
-        run: sh scripts/ci-docker-compose-up.sh traefik redis mysql-debug edge-broker php1 php2 php3 php4 php5 caddy
+        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml up -d traefik redis mysql-debug edge-broker php1 caddy

      - name: Sync PHP app checkout
        run: >
@@ -242,33 +160,10 @@ jobs:
          --exclude='./.phpunit.cache'
          --exclude='./build/logs'
          -C services/nginx/app -cf - .
-          | docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 tar --no-same-owner -C /var/www/html -xf -
+          | docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 tar -C /var/www/html -xf -

      - name: Resolve dependencies
-        run: |
-          set -euo pipefail
-          composer_install() {
-            install_mode="$1"
-            max_attempts="$2"
-            attempt=1
-            while :; do
-              if docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && composer install --no-interaction ${install_mode} --no-progress"; then
-                return 0
-              fi
-              if [ "$attempt" -ge "$max_attempts" ]; then
-                return 1
-              fi
-              sleep_seconds=$((attempt * 5))
-              echo "composer install ${install_mode} failed; retrying in ${sleep_seconds}s (attempt $((attempt + 1))/${max_attempts})" >&2
-              sleep "$sleep_seconds"
-              attempt=$((attempt + 1))
-            done
-          }
-
-          composer_install --prefer-dist 3 || {
-            echo "Composer dist install failed; retrying with --prefer-source." >&2
-            composer_install --prefer-source 2
-          }
+        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml exec -T php1 sh -lc "cd /var/www/html && composer install --no-interaction --prefer-dist --no-progress"

      - name: Verify edge gateway test files
        run: >
@@ -327,60 +222,34 @@ jobs:
          vendor/bin/pest tests/Integration/EdgeGateway --colors=always"

      - name: Run edge gateway E2E smoke
-        env:
-          EDGE_GATEWAY_E2E_COPY_CONFIG: "true"
-          EDGE_GATEWAY_E2E_SKIP_COMPOSE_UP: "true"
-        run: node scripts/edge-gateway-e2e.mjs
+        run: |
+          set -euo pipefail
+          compose_project="${COMPOSE_PROJECT_NAME:-$(basename "$PWD")}"
+          runner="edge-e2e-runner-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          docker rm -f "$runner" >/dev/null 2>&1 || true
+          trap 'docker rm -f "$runner" >/dev/null 2>&1 || true' EXIT
+          docker create \
+            --name "$runner" \
+            --network "${compose_project}_default" \
+            -e COMPOSE_FILE="$COMPOSE_FILE" \
+            -e COMPOSE_PROJECT_NAME="$compose_project" \
+            -e TRAEFIK_WEB_PORT="${TRAEFIK_WEB_PORT:-18080}" \
+            -e TRAEFIK_WEBSECURE_PORT="${TRAEFIK_WEBSECURE_PORT:-18443}" \
+            -e TRAEFIK_WEBSECURE_STAGING_PORT="${TRAEFIK_WEBSECURE_STAGING_PORT:-18433}" \
+            -e TRAEFIK_METRICS_PORT="${TRAEFIK_METRICS_PORT:-19100}" \
+            -e EDGE_GATEWAY_E2E_BASE_URL="http://caddy" \
+            -e EDGE_GATEWAY_E2E_COMPOSE_PROJECT="$compose_project" \
+            -e EDGE_GATEWAY_E2E_COPY_CONFIG="true" \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -w /workspace \
+            node:22-alpine \
+            sh -lc "apk add --no-cache docker-cli docker-cli-compose >/dev/null && node scripts/edge-gateway-e2e.mjs"
+          docker cp . "$runner:/workspace"
+          docker start "$runner" >/dev/null
+          docker logs -f "$runner"
+          exit_code="$(docker wait "$runner")"
+          exit "$exit_code"

      - name: Tear down local stack
        if: always()
        run: docker compose -f docker-compose.yml -f .github/docker-compose.ci.yml down -v
-
-  release-manager-gate:
-    name: Release Manager gate
-    runs-on: [self-hosted, Linux, X64, pleno, backend]
-    needs: [php, edge-agent, edge-broker, edge-gateway-backend]
-    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
-
-    steps:
-      - name: Record Release Manager API gate
-        run: |
-          set -euo pipefail
-          test -n "$RELEASE_MANAGER_GATE_TOKEN" || (echo "RELEASE_MANAGER_GATE_TOKEN is required" >&2; exit 1)
-          response_file="$(mktemp)"
-          http_code="$(curl --show-error --silent \
-            --connect-timeout 10 \
-            --retry 5 \
-            --retry-all-errors \
-            --retry-delay 15 \
-            --retry-max-time 300 \
-            -o "$response_file" \
-            -w '%{http_code}' \
-            -X POST "$RELEASE_MANAGER_GATE_URL" \
-            -H "Authorization: Bearer $RELEASE_MANAGER_GATE_TOKEN" \
-            -H "Content-Type: application/json" \
-            --data "{\"channel_slug\":\"stable\",\"app\":\"api\",\"repository\":\"$RELEASE_REPOSITORY\",\"branch\":\"$RELEASE_BRANCH\",\"expected_commit\":\"$RELEASE_EXPECTED_COMMIT\",\"workflow_url\":\"$RELEASE_WORKFLOW_URL\",\"auto_sync\":true,\"wait_timeout_seconds\":300,\"poll_interval_seconds\":10,\"required_checks\":[\"api_gateway\"]}")"
-          response_body="$(cat "$response_file")"
-          rm -f "$response_file"
-
-          if [[ "$http_code" =~ ^2[0-9][0-9]$ ]]; then
-            printf '%s\n' "$response_body"
-            exit 0
-          fi
-
-          if printf '%s' "$response_body" | grep -qi '<b>Parse error</b>'; then
-            echo "::warning::Release Manager API returned a PHP parse error while recording the gate. Treating this as a break-glass pass so a fix can be deployed."
-            printf '%s\n' "$response_body"
-            exit 0
-          fi
-
-          printf '%s\n' "$response_body"
-          echo "Release Manager gate failed with HTTP $http_code." >&2
-          exit 1
-        env:
-          RELEASE_MANAGER_GATE_URL: ${{ secrets.RELEASE_MANAGER_GATE_URL || 'https://api.truckwash.io/release/gate/test-runs' }}
-          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
-          RELEASE_REPOSITORY: ${{ github.repository }}
-          RELEASE_BRANCH: ${{ github.ref_name }}
-          RELEASE_EXPECTED_COMMIT: ${{ github.sha }}
-          RELEASE_WORKFLOW_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
@@ -10,10 +10,5 @@
 /.idea/
 .env
 /services/caddy/logs*
-.env.old
 /.tmp/
 /.env.staging
-/services/nginx/app/storage/replication-bootstrap.json
-/.env_old_2
-/.openclaw/
-/services/nginx/app/build/phpstan/
@@ -40,7 +40,6 @@ COPY . /var/www/html

 # Copy Nginx configuration file
 COPY nginx.conf /etc/nginx/nginx.conf
-COPY services/php/php-fpm-pool.conf /usr/local/etc/php-fpm.d/zz-pleno-workers.conf

 # Install Composer
 COPY --from=composer:2.6 /usr/bin/composer /usr/bin/composer
@@ -47,12 +47,10 @@ RUN set -eux; \

 COPY services/nginx/app/ /var/www/html/
 COPY services/php/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-COPY services/php/php-fpm-pool.conf /usr/local/etc/php-fpm.d/zz-pleno-workers.conf
 COPY services/coolify/api/nginx.conf /etc/nginx/nginx.conf
 COPY services/coolify/api/start.sh /usr/local/bin/coolify-api-start

 RUN set -eux; \
-    rm -f /var/www/html/storage/replication-bootstrap.json /var/www/html/storage/replication-bootstrap-*.json; \
    sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh /usr/local/bin/coolify-api-start; \
    chmod +x /usr/local/bin/docker-entrypoint.sh /usr/local/bin/coolify-api-start; \
    COMPOSER_ALLOW_SUPERUSER=1 composer install --no-dev --prefer-dist --optimize-autoloader --no-interaction -d /var/www/html; \
@@ -52,9 +52,9 @@ services:
      dockerfile: services/edge-broker/Dockerfile
    container_name: edge-broker
    environment:
-      EDGE_AUTH_MODE: ${EDGE_AUTH_MODE:-strict}
+      EDGE_AUTH_MODE: ${EDGE_AUTH_MODE:-manager}
      EDGE_MANAGER_URL: ${EDGE_MANAGER_URL:-http://caddy}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.edge-broker-api.rule=Host(`api.example.com`) && PathPrefix(`/edge-broker`)"
@@ -71,7 +71,6 @@ services:
      - "traefik.http.middlewares.edge-broker-strip-local.stripPrefix.prefixes=/api/edge-broker"
      - "traefik.http.services.edge-broker.loadbalancer.server.port=4300"

-
  caddy:
    image: caddy:2.7.6-alpine
    container_name: caddy
@@ -114,7 +113,7 @@ services:
    environment:
      AUTO_COMPOSER_INSTALL: "true"
      EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
    volumes:
      - ./services/nginx/app:/var/www/html
      - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -135,7 +134,7 @@ services:
    environment:
      AUTO_COMPOSER_INSTALL: "false"
      EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
    volumes:
      - ./services/nginx/app:/var/www/html
      - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -3,8 +3,6 @@ services:
  traefik:
    image: traefik:2.11
    container_name: traefik
-    group_add:
-      - "${DOCKER_SOCKET_GID:-65534}"
    ports:
      - "${TRAEFIK_WEB_PORT:-80}:80"
      - "${TRAEFIK_WEBSECURE_PORT:-443}:443"
@@ -103,10 +101,8 @@ services:
  mysql-debug:
    image: mysql:8.4
    container_name: mysql-debug
-    profiles: [dev]
-    command: ["mysqld", "--innodb-use-native-aio=0"]
    environment:
-      MYSQL_ROOT_PASSWORD: ${CONFIG_DB_DEBUG_PASSWORD:?CONFIG_DB_DEBUG_PASSWORD is required for mysql-debug}
+      MYSQL_ROOT_PASSWORD: ${CONFIG_DB_DEBUG_PASSWORD:-debug_root_password}
      MYSQL_DATABASE: ${CONFIG_DB_DEBUG_DATABASE:-nnks_db_debug}
    ports:
      - "3307:3306"
@@ -125,9 +121,9 @@ services:
      dockerfile: services/edge-broker/Dockerfile
    container_name: edge-broker
    environment:
-      EDGE_AUTH_MODE: ${EDGE_AUTH_MODE:-strict}
+      EDGE_AUTH_MODE: ${EDGE_AUTH_MODE:-manager}
      EDGE_MANAGER_URL: ${EDGE_MANAGER_URL:-http://caddy}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.edge-broker-api.rule=Host(`api.truckwash.dk`) && PathPrefix(`/edge-broker`)"
@@ -311,7 +307,7 @@ services:
    environment:
      AUTO_COMPOSER_INSTALL: "true"
      EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
    volumes:
      - ./services/nginx/app:/var/www/html
      - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -331,7 +327,7 @@ services:
    environment:
      AUTO_COMPOSER_INSTALL: "false"
      EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
    volumes:
      - ./services/nginx/app:/var/www/html
      - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -351,7 +347,7 @@ services:
    environment:
      AUTO_COMPOSER_INSTALL: "false"
      EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
    volumes:
      - ./services/nginx/app:/var/www/html
      - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -371,7 +367,7 @@ services:
    environment:
      AUTO_COMPOSER_INSTALL: "false"
      EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
    volumes:
      - ./services/nginx/app:/var/www/html
      - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -391,7 +387,7 @@ services:
    environment:
      AUTO_COMPOSER_INSTALL: "false"
      EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
    volumes:
      - ./services/nginx/app:/var/www/html
      - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -411,7 +407,7 @@ services:
    environment:
      AUTO_COMPOSER_INSTALL: "false"
      EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
    volumes:
      - ./services/nginx/staging:/var/www/html
      - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -431,7 +427,7 @@ services:
    environment:
      AUTO_COMPOSER_INSTALL: "false"
      EDGE_BROKER_URL: ${EDGE_BROKER_URL:-http://edge-broker:4300}
-      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:?set EDGE_BROKER_SHARED_SECRET in .env}
+      EDGE_BROKER_SHARED_SECRET: ${EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev}
    volumes:
      - ./services/nginx/app:/var/www/html
      - ./services/php/php.ini:/usr/local/etc/php/conf.d/zz-custom.ini:ro
@@ -3357,9 +3357,6 @@
                  },
                  "email_notifications_enabled": {
                    "type": "boolean"
-                  },
-                  "superuser_new_customer_email_notifications_enabled": {
-                    "type": "boolean"
                  }
                }
              }
@@ -12958,54 +12955,6 @@
        }
      }
    },
-    "/slack/config": {
-      "get": {
-        "tags": [
-          "Config"
-        ],
-        "summary": "Get Slack config",
-        "operationId": "getSlackConfig",
-        "responses": {
-          "200": {
-            "description": "Slack configuration retrieved successfully",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/SlackConfigListResponse"
-                }
-              }
-            }
-          }
-        }
-      },
-      "post": {
-        "tags": [
-          "Config"
-        ],
-        "summary": "Update Slack config",
-        "operationId": "updateSlackConfig",
-        "requestBody": {
-          "required": false,
-          "content": {
-            "application/json": {
-              "schema": {}
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Slack configuration updated successfully",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ModuleConfigUpdateResponse"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
    "/backups/config": {
      "get": {
        "tags": [
@@ -15547,39 +15496,6 @@
          "value"
        ]
      },
-      "SlackConfigEntry": {
-        "type": "object",
-        "properties": {
-          "module": {
-            "type": "string",
-            "enum": [
-              "Slack"
-            ]
-          },
-          "variable": {
-            "type": "string",
-            "enum": [
-              "customer_registration_webhook_url"
-            ]
-          },
-          "type": {
-            "type": "string",
-            "enum": [
-              "string"
-            ]
-          },
-          "value": {
-            "type": "string",
-            "example": "https://hooks.slack.com/services/..."
-          }
-        },
-        "required": [
-          "module",
-          "variable",
-          "type",
-          "value"
-        ]
-      },
      "BackupsConfigEntry": {
        "type": "object",
        "properties": {
@@ -16324,27 +16240,6 @@
          }
        ]
      },
-      "SlackConfigListResponse": {
-        "allOf": [
-          {
-            "$ref": "#/components/schemas/ModuleConfigEnvelopeBase"
-          },
-          {
-            "type": "object",
-            "properties": {
-              "data": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/components/schemas/SlackConfigEntry"
-                }
-              }
-            },
-            "required": [
-              "data"
-            ]
-          }
-        ]
-      },
      "BackupsConfigListResponse": {
        "allOf": [
          {
@@ -1,102 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-suite="${1:-}"
-case "$suite" in
-  unit|integration|api|legacy|all)
-    ;;
-  *)
-    echo "Usage: $0 <unit|integration|api|legacy|all>" >&2
-    exit 2
-    ;;
-esac
-
-script_dir="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
-repo_root="$(CDPATH= cd -- "$script_dir/.." && pwd)"
-cd "$repo_root"
-
-compose_files="-f docker-compose.yml -f .github/docker-compose.ci.yml"
-project_suffix="$(date +%s)-$$"
-export COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-php-local-${suite}-${project_suffix}}"
-
-log_dir=".tmp/ci-logs/$suite"
-mkdir -p "$log_dir"
-
-env_backup_dir=".tmp/php-ci-env-backup-$project_suffix"
-mkdir -p "$env_backup_dir"
-had_env=0
-had_env_staging=0
-if [ -f .env ]; then
-  cp .env "$env_backup_dir/env"
-  had_env=1
-fi
-if [ -f .env.staging ]; then
-  cp .env.staging "$env_backup_dir/env.staging"
-  had_env_staging=1
-fi
-
-cp .github/ci.env .env
-cp .github/ci.env.staging .env.staging
-
-collect_logs() {
-  status="$1"
-  if [ "$status" -eq 0 ]; then
-    return
-  fi
-
-  mkdir -p "$log_dir"
-  docker compose $compose_files ps > "$log_dir/docker-compose-ps.txt" 2>&1 || true
-  docker compose $compose_files logs --no-color > "$log_dir/docker-compose.log" 2>&1 || true
-  docker compose $compose_files cp php1:/var/www/html/build/logs "$log_dir/app-build-logs" >/dev/null 2>&1 || true
-  docker compose $compose_files cp php1:/var/log/php "$log_dir/php-logs" >/dev/null 2>&1 || true
-}
-
-cleanup() {
-  status="$?"
-  collect_logs "$status"
-  docker compose $compose_files down -v >/dev/null 2>&1 || true
-  if [ "$had_env" -eq 1 ]; then
-    cp "$env_backup_dir/env" .env
-  else
-    rm -f .env
-  fi
-  if [ "$had_env_staging" -eq 1 ]; then
-    cp "$env_backup_dir/env.staging" .env.staging
-  else
-    rm -f .env.staging
-  fi
-  rm -rf "$env_backup_dir"
-  exit "$status"
-}
-trap cleanup EXIT INT TERM
-
-docker compose $compose_files up -d redis mysql-debug php1
-
-docker compose $compose_files exec -T php1 sh -lc '
-  set -eu
-  for i in $(seq 1 90); do
-    if MYSQL_PWD="${CONFIG_DB_PASSWORD:-debug_root_password}" mysqladmin \
-      -h "${CONFIG_DB_HOST:-mysql-debug}" \
-      -P "${CONFIG_DB_PORT:-3306}" \
-      -u "${CONFIG_DB_USER:-root}" \
-      ping --silent >/dev/null 2>&1; then
-      exit 0
-    fi
-    sleep 1
-  done
-  echo "Timed out waiting for mysql-debug" >&2
-  exit 1
-'
-
-tar \
-  --exclude='./vendor' \
-  --exclude='./.phpunit.cache' \
-  --exclude='./build/logs' \
-  -C services/nginx/app -cf - . \
-  | docker compose $compose_files exec -T php1 tar -C /var/www/html -xf -
-
-docker compose $compose_files exec -T php1 sh -lc \
-  'cd /var/www/html && composer install --no-interaction --prefer-dist --no-progress'
-
-docker compose $compose_files exec -T php1 sh -lc \
-  "cd /var/www/html && composer test:ci:$suite"
@@ -1,45 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-if [ "$#" -eq 0 ]; then
-  echo "Usage: $0 <service> [service ...]" >&2
-  exit 2
-fi
-
-compose_files="${CI_DOCKER_COMPOSE_FILES:--f docker-compose.yml -f .github/docker-compose.ci.yml}"
-lock_file="${CI_DOCKER_LOCK_FILE:-/tmp/pleno-api-ci-docker-compose-up.lock}"
-max_attempts="${CI_DOCKER_UP_RETRIES:-${PHP_CI_DOCKER_RETRIES:-3}}"
-export COMPOSE_PROFILES="${COMPOSE_PROFILES:-dev}"
-
-compose_up() {
-  attempt=1
-  while :; do
-    docker network prune -f >/dev/null 2>&1 || true
-
-    if docker compose $compose_files up -d "$@"; then
-      return 0
-    fi
-
-    status="$?"
-    docker compose $compose_files down -v --remove-orphans >/dev/null 2>&1 || true
-
-    if [ "$attempt" -ge "$max_attempts" ]; then
-      return "$status"
-    fi
-
-    sleep_seconds=$((attempt * 5))
-    echo "Docker compose up failed with status $status; retrying in ${sleep_seconds}s (attempt $((attempt + 1))/$max_attempts)." >&2
-    sleep "$sleep_seconds"
-    attempt=$((attempt + 1))
-  done
-}
-
-if command -v flock >/dev/null 2>&1; then
-  (
-    flock 9
-    compose_up "$@"
-  ) 9>"$lock_file"
-else
-  echo "flock is not available; running Docker compose startup without a host lock." >&2
-  compose_up "$@"
-fi
@@ -1,453 +0,0 @@
-import { spawn } from "node:child_process";
-import crypto from "node:crypto";
-import fs from "node:fs";
-import http from "node:http";
-import net from "node:net";
-import os from "node:os";
-import path from "node:path";
-import process from "node:process";
-import { fileURLToPath } from "node:url";
-
-const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const DEFAULT_AGENT_PATH = path.join(
-  repoRoot,
-  "services/nginx/app/resources/edge-gateway-agent/agent.php"
-);
-const DEFAULT_PHP_IMAGE = "php:8.2-cli-bookworm";
-const DEFAULT_TIMEOUT_MS = 12000;
-
-function parseArgs(argv = process.argv.slice(2)) {
-  const options = {
-    agentPath: DEFAULT_AGENT_PATH,
-    phpImage: DEFAULT_PHP_IMAGE,
-    timeoutMs: DEFAULT_TIMEOUT_MS,
-    keepTemp: false,
-    help: false,
-  };
-
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index];
-    const next = argv[index + 1];
-
-    switch (arg) {
-      case "--agent-path":
-        options.agentPath = path.resolve(String(next || "").trim());
-        index += 1;
-        break;
-      case "--php-image":
-        options.phpImage = String(next || "").trim() || DEFAULT_PHP_IMAGE;
-        index += 1;
-        break;
-      case "--timeout-ms":
-        options.timeoutMs = Number.parseInt(String(next || ""), 10) || DEFAULT_TIMEOUT_MS;
-        index += 1;
-        break;
-      case "--keep-temp":
-        options.keepTemp = true;
-        break;
-      case "--help":
-      case "-h":
-        options.help = true;
-        break;
-      default:
-        throw new Error(`Unknown argument: ${arg}`);
-    }
-  }
-
-  return options;
-}
-
-function printUsage() {
-  process.stdout.write(`Usage:
-  node scripts/edge-agent-command-drain-proof.mjs [options]
-
-Verifies that a broker-connected PHP compose edge agent still drains API-queued
-SET_RELAY_STATE jobs to the LAN worker /relay/switch endpoint.
-
-Options:
-  --agent-path <path>   PHP agent artifact to execute.
-                       Default: ${DEFAULT_AGENT_PATH}
-  --php-image <image>   Docker PHP image with curl, sqlite3, and pdo_sqlite.
-                       Default: ${DEFAULT_PHP_IMAGE}
-  --timeout-ms <ms>     Proof timeout. Default: ${DEFAULT_TIMEOUT_MS}
-  --keep-temp           Keep the temporary config/runtime directory.
-  --help                Show this help text.
-`);
-}
-
-function readJson(request) {
-  return new Promise((resolve) => {
-    let raw = "";
-    request.setEncoding("utf8");
-    request.on("data", (chunk) => {
-      raw += chunk;
-    });
-    request.on("end", () => {
-      if (raw.trim() === "") {
-        resolve({});
-        return;
-      }
-
-      try {
-        resolve(JSON.parse(raw));
-      } catch {
-        resolve({ __invalid: raw });
-      }
-    });
-  });
-}
-
-function sendJson(response, status, payload) {
-  const body = JSON.stringify(payload);
-  response.writeHead(status, {
-    "content-type": "application/json; charset=utf-8",
-    "content-length": Buffer.byteLength(body),
-  });
-  response.end(body);
-}
-
-function listen(server) {
-  return new Promise((resolve) => {
-    server.listen(0, "127.0.0.1", () => resolve(server.address().port));
-  });
-}
-
-function closeServer(server) {
-  return new Promise((resolve) => {
-    server.close(() => resolve());
-  });
-}
-
-function websocketAcceptKey(key) {
-  return crypto
-    .createHash("sha1")
-    .update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`)
-    .digest("base64");
-}
-
-function createBrokerServer(state) {
-  const sockets = new Set();
-  const server = net.createServer((socket) => {
-    sockets.add(socket);
-    socket.on("close", () => sockets.delete(socket));
-
-    let buffer = "";
-    socket.on("data", (chunk) => {
-      buffer += chunk.toString("binary");
-      if (state.brokerHandshakeSeen || !buffer.includes("\r\n\r\n")) {
-        return;
-      }
-
-      const requestText = Buffer.from(buffer, "binary").toString("utf8");
-      const key = requestText.match(/Sec-WebSocket-Key:\s*(.+)\r\n/i)?.[1]?.trim();
-      const requestLine = requestText.split("\r\n")[0] || "";
-      if (!requestLine.includes("/ws/agent?")) {
-        state.failure = new Error(`unexpected broker path: ${requestLine}`);
-      }
-      if (!key) {
-        state.failure = new Error("broker handshake missing Sec-WebSocket-Key");
-        return;
-      }
-
-      socket.write([
-        "HTTP/1.1 101 Switching Protocols",
-        "Upgrade: websocket",
-        "Connection: Upgrade",
-        `Sec-WebSocket-Accept: ${websocketAcceptKey(key)}`,
-        "",
-        "",
-      ].join("\r\n"));
-      state.brokerHandshakeSeen = true;
-      buffer = "";
-    });
-  });
-
-  return { server, sockets };
-}
-
-function createWorkerServer(state) {
-  return http.createServer(async (request, response) => {
-    const url = new URL(request.url, "http://127.0.0.1");
-    const body = await readJson(request);
-    state.requests.push({ service: "worker", method: request.method, path: url.pathname, body });
-
-    if (request.method === "GET" && url.pathname === "/health") {
-      sendJson(response, 200, { status: "healthy", timestamp: new Date().toISOString() });
-      return;
-    }
-
-    if (request.method === "POST" && url.pathname === "/relay/switch") {
-      state.relaySwitchSeen = true;
-      if (body.local_ip !== "10.123.0.31" || body.channel !== 0 || body.on !== true) {
-        state.failure = new Error(`unexpected relay switch payload: ${JSON.stringify(body)}`);
-      }
-      sendJson(response, 200, {
-        online: true,
-        on: true,
-        output: true,
-        raw: { source: "fake-worker" },
-      });
-      return;
-    }
-
-    sendJson(response, 404, { message: "not found" });
-  });
-}
-
-function createApiServer(state, brokerPort, workerPort) {
-  return http.createServer(async (request, response) => {
-    const url = new URL(request.url, "http://127.0.0.1");
-    const body = await readJson(request);
-    state.requests.push({ service: "api", method: request.method, path: url.pathname, body });
-
-    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/heartbeat") {
-      sendJson(response, 200, { data: { ok: true, broker_url: `ws://127.0.0.1:${brokerPort}` } });
-      return;
-    }
-
-    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/selfserve/machine-signal-bindings") {
-      sendJson(response, 200, { data: { monitors: [] } });
-      return;
-    }
-
-    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/commands/poll") {
-      state.commandPollSeen = true;
-      if (body.wait_seconds !== 0) {
-        state.failure = new Error(
-          `broker-connected command poll should be non-blocking, got wait_seconds=${body.wait_seconds}`
-        );
-      }
-
-      if (!state.commandDelivered) {
-        state.commandDelivered = true;
-        sendJson(response, 200, {
-          data: {
-            id: 77,
-            command_type: "SET_RELAY_STATE",
-            payload: {
-              localIp: "10.123.0.31",
-              channel: 0,
-              on: true,
-              relayId: "relay-proof",
-            },
-          },
-        });
-        return;
-      }
-
-      sendJson(response, 200, { data: null });
-      return;
-    }
-
-    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/commands/77/result") {
-      state.resultSeen = true;
-      if (body.ok !== true || body.result?.on !== true || body.result?.raw?.source !== "fake-worker") {
-        state.failure = new Error(`unexpected command result: ${JSON.stringify(body)}`);
-      }
-      sendJson(response, 200, { data: { acknowledged: true } });
-      return;
-    }
-
-    sendJson(response, 404, { message: "not found", path: url.pathname, workerPort });
-  });
-}
-
-function writeConfig(tempDir, apiPort, brokerPort, workerPort) {
-  const containerProofDir = "/proof";
-  const runtimeDir = `${containerProofDir}/runtime`;
-  const config = {
-    apiUrl: `http://127.0.0.1:${apiPort}`,
-    brokerUrl: `ws://127.0.0.1:${brokerPort}`,
-    gatewayId: 42,
-    agentToken: "agent-token",
-    installDir: containerProofDir,
-    runtimeDir,
-    stateDatabasePath: `${runtimeDir}/gateway-state.sqlite`,
-    workerBaseUrl: `http://127.0.0.1:${workerPort}`,
-    heartbeatIntervalSeconds: 60,
-    operationPollTimeoutSeconds: 20,
-  };
-
-  const configPath = path.join(tempDir, "config.json");
-  fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
-  return { configPath, containerConfigPath: `${containerProofDir}/config.json` };
-}
-
-function spawnAgent({ agentPath, phpImage, tempDir, containerConfigPath }) {
-  return spawn("docker", [
-    "run",
-    "--rm",
-    "--network",
-    "host",
-    "-v",
-    `${agentPath}:/agent.php:ro`,
-    "-v",
-    `${tempDir}:/proof`,
-    phpImage,
-    "php",
-    "/agent.php",
-    "--config",
-    containerConfigPath,
-  ], { stdio: ["ignore", "pipe", "pipe"] });
-}
-
-async function stopChild(child) {
-  if (child.exitCode !== null || child.signalCode !== null) {
-    return;
-  }
-
-  child.kill("SIGTERM");
-  const hardKill = setTimeout(() => {
-    if (child.exitCode === null && child.signalCode === null) {
-      child.kill("SIGKILL");
-    }
-  }, 1500);
-
-  await Promise.race([
-    new Promise((resolve) => child.once("exit", resolve)),
-    new Promise((resolve) => setTimeout(resolve, 2200)),
-  ]);
-  clearTimeout(hardKill);
-}
-
-function evidenceFromState(state, childExited) {
-  return {
-    brokerHandshakeSeen: state.brokerHandshakeSeen,
-    commandPollSeen: state.commandPollSeen,
-    relaySwitchSeen: state.relaySwitchSeen,
-    resultSeen: state.resultSeen,
-    agentStayedRunningUntilProofComplete: !childExited,
-  };
-}
-
-export async function runProof(options) {
-  if (process.platform !== "linux") {
-    throw new Error("This proof uses Docker --network host and currently expects Linux.");
-  }
-  if (!fs.existsSync(options.agentPath)) {
-    throw new Error(`Agent artifact not found: ${options.agentPath}`);
-  }
-
-  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "edge-agent-command-drain-proof-"));
-  fs.mkdirSync(path.join(tempDir, "runtime"), { recursive: true });
-
-  const state = {
-    brokerHandshakeSeen: false,
-    commandPollSeen: false,
-    relaySwitchSeen: false,
-    resultSeen: false,
-    commandDelivered: false,
-    failure: null,
-    requests: [],
-  };
-
-  const broker = createBrokerServer(state);
-  const workerServer = createWorkerServer(state);
-  let apiServer = null;
-  let child = null;
-  let stdout = "";
-  let stderr = "";
-  let childExited = false;
-
-  try {
-    const brokerPort = await listen(broker.server);
-    const workerPort = await listen(workerServer);
-    apiServer = createApiServer(state, brokerPort, workerPort);
-    const apiPort = await listen(apiServer);
-    const { containerConfigPath } = writeConfig(tempDir, apiPort, brokerPort, workerPort);
-
-    child = spawnAgent({ ...options, tempDir, containerConfigPath });
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString();
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk.toString();
-    });
-    child.once("exit", () => {
-      childExited = true;
-    });
-
-    const deadline = Date.now() + options.timeoutMs;
-    while (Date.now() < deadline && !state.failure && !childExited) {
-      if (state.brokerHandshakeSeen && state.commandPollSeen && state.relaySwitchSeen && state.resultSeen) {
-        break;
-      }
-      await new Promise((resolve) => setTimeout(resolve, 100));
-    }
-
-    const evidence = evidenceFromState(state, childExited);
-    if (
-      state.failure ||
-      !state.brokerHandshakeSeen ||
-      !state.commandPollSeen ||
-      !state.relaySwitchSeen ||
-      !state.resultSeen
-    ) {
-      const error = state.failure || new Error("missing proof evidence");
-      error.evidence = evidence;
-      error.requests = state.requests;
-      error.stdout = stdout.slice(-3000);
-      error.stderr = stderr.slice(-3000);
-      throw error;
-    }
-
-    return {
-      evidence,
-      agentPath: options.agentPath,
-      phpImage: options.phpImage,
-      tempDir,
-      requestCount: state.requests.length,
-    };
-  } finally {
-    if (child) {
-      await stopChild(child);
-    }
-    for (const socket of broker.sockets) {
-      socket.destroy();
-    }
-    await Promise.allSettled([
-      closeServer(broker.server),
-      closeServer(workerServer),
-      apiServer ? closeServer(apiServer) : Promise.resolve(),
-    ]);
-    if (!options.keepTemp) {
-      fs.rmSync(tempDir, { recursive: true, force: true });
-    }
-  }
-}
-
-async function main() {
-  const options = parseArgs();
-  if (options.help) {
-    printUsage();
-    return;
-  }
-
-  const result = await runProof(options);
-  process.stdout.write("PASS broker-connected API command poll triggered local relay switch and posted result\n");
-  process.stdout.write(`${JSON.stringify(result.evidence)}\n`);
-  process.stdout.write(`Agent: ${result.agentPath}\n`);
-  process.stdout.write(`PHP image: ${result.phpImage}\n`);
-  if (options.keepTemp) {
-    process.stdout.write(`Temp dir: ${result.tempDir}\n`);
-  }
-}
-
-if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    process.stderr.write(`FAIL ${error.message}\n`);
-    if (error.evidence) {
-      process.stderr.write(`Evidence: ${JSON.stringify(error.evidence)}\n`);
-    }
-    if (error.requests) {
-      process.stderr.write(`Requests: ${JSON.stringify(error.requests, null, 2)}\n`);
-    }
-    if (error.stdout) {
-      process.stderr.write(`stdout: ${error.stdout}\n`);
-    }
-    if (error.stderr) {
-      process.stderr.write(`stderr: ${error.stderr}\n`);
-    }
-    process.exit(1);
-  });
-}
@@ -1,619 +0,0 @@
-import { spawn } from "node:child_process";
-import crypto from "node:crypto";
-import fs from "node:fs";
-import http from "node:http";
-import net from "node:net";
-import os from "node:os";
-import path from "node:path";
-import process from "node:process";
-import { fileURLToPath } from "node:url";
-
-const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const DEFAULT_AGENT_PATH = path.join(
-  repoRoot,
-  "services/nginx/app/resources/edge-gateway-agent/agent.php"
-);
-const DEFAULT_WORKER_PATH = path.join(
-  repoRoot,
-  "services/nginx/app/resources/edge-gateway-agent/lan-worker.php"
-);
-const DEFAULT_PHP_IMAGE = "php:8.2-cli-bookworm";
-const DEFAULT_TIMEOUT_MS = 15000;
-const AGENT_TOKEN = "agent-token";
-
-function parseArgs(argv = process.argv.slice(2)) {
-  const options = {
-    agentPath: DEFAULT_AGENT_PATH,
-    workerPath: DEFAULT_WORKER_PATH,
-    phpImage: DEFAULT_PHP_IMAGE,
-    timeoutMs: DEFAULT_TIMEOUT_MS,
-    keepTemp: false,
-    help: false,
-  };
-
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index];
-    const next = argv[index + 1];
-
-    switch (arg) {
-      case "--agent-path":
-        options.agentPath = path.resolve(String(next || "").trim());
-        index += 1;
-        break;
-      case "--worker-path":
-        options.workerPath = path.resolve(String(next || "").trim());
-        index += 1;
-        break;
-      case "--php-image":
-        options.phpImage = String(next || "").trim() || DEFAULT_PHP_IMAGE;
-        index += 1;
-        break;
-      case "--timeout-ms":
-        options.timeoutMs = Number.parseInt(String(next || ""), 10) || DEFAULT_TIMEOUT_MS;
-        index += 1;
-        break;
-      case "--keep-temp":
-        options.keepTemp = true;
-        break;
-      case "--help":
-      case "-h":
-        options.help = true;
-        break;
-      default:
-        throw new Error(`Unknown argument: ${arg}`);
-    }
-  }
-
-  return options;
-}
-
-function printUsage() {
-  process.stdout.write(`Usage:
-  node scripts/edge-agent-to-shelly-proof.mjs [options]
-
-Runs the PHP edge agent and real LAN worker against fake broker, API, and
-Shelly RPC endpoints. Verifies that a broker-connected SET_RELAY_STATE command
-drains from the API, reaches the worker, triggers a Shelly-style Switch.Set
-call, reads Switch.GetStatus, and posts the command result.
-
-Options:
-  --agent-path <path>   PHP agent artifact to execute.
-                       Default: ${DEFAULT_AGENT_PATH}
-  --worker-path <path>  PHP LAN worker artifact to execute.
-                       Default: ${DEFAULT_WORKER_PATH}
-  --php-image <image>   Docker PHP image with curl, sqlite3, and pdo_sqlite.
-                       Default: ${DEFAULT_PHP_IMAGE}
-  --timeout-ms <ms>     Proof timeout. Default: ${DEFAULT_TIMEOUT_MS}
-  --keep-temp           Keep the temporary config/runtime directory.
-  --help                Show this help text.
-`);
-}
-
-function readJson(request) {
-  return new Promise((resolve) => {
-    let raw = "";
-    request.setEncoding("utf8");
-    request.on("data", (chunk) => {
-      raw += chunk;
-    });
-    request.on("end", () => {
-      if (raw.trim() === "") {
-        resolve({});
-        return;
-      }
-
-      try {
-        resolve(JSON.parse(raw));
-      } catch {
-        resolve({ __invalid: raw });
-      }
-    });
-  });
-}
-
-function sendJson(response, status, payload) {
-  const body = JSON.stringify(payload);
-  response.writeHead(status, {
-    "content-type": "application/json; charset=utf-8",
-    "content-length": Buffer.byteLength(body),
-  });
-  response.end(body);
-}
-
-function requestJson({ method = "GET", port, path: requestPath, body = null, headers = {} }) {
-  return new Promise((resolve, reject) => {
-    const payload = body === null ? null : JSON.stringify(body);
-    const request = http.request({
-      hostname: "127.0.0.1",
-      port,
-      path: requestPath,
-      method,
-      headers: {
-        accept: "application/json",
-        ...(payload === null ? {} : {
-          "content-type": "application/json",
-          "content-length": Buffer.byteLength(payload),
-        }),
-        ...headers,
-      },
-      timeout: 1000,
-    }, (response) => {
-      let raw = "";
-      response.setEncoding("utf8");
-      response.on("data", (chunk) => {
-        raw += chunk;
-      });
-      response.on("end", () => {
-        let decoded = {};
-        try {
-          decoded = raw.trim() === "" ? {} : JSON.parse(raw);
-        } catch {
-          decoded = { __invalid: raw };
-        }
-        resolve({ status: response.statusCode || 0, body: decoded });
-      });
-    });
-    request.on("error", reject);
-    request.on("timeout", () => {
-      request.destroy(new Error("request timed out"));
-    });
-    if (payload !== null) {
-      request.write(payload);
-    }
-    request.end();
-  });
-}
-
-function listen(server) {
-  return new Promise((resolve) => {
-    server.listen(0, "127.0.0.1", () => resolve(server.address().port));
-  });
-}
-
-function closeServer(server) {
-  return new Promise((resolve) => {
-    server.close(() => resolve());
-  });
-}
-
-async function reservePort() {
-  const server = net.createServer();
-  const port = await new Promise((resolve) => {
-    server.listen(0, "127.0.0.1", () => resolve(server.address().port));
-  });
-  await closeServer(server);
-  return port;
-}
-
-function websocketAcceptKey(key) {
-  return crypto
-    .createHash("sha1")
-    .update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`)
-    .digest("base64");
-}
-
-function createBrokerServer(state) {
-  const sockets = new Set();
-  const server = net.createServer((socket) => {
-    sockets.add(socket);
-    socket.on("close", () => sockets.delete(socket));
-
-    let buffer = "";
-    socket.on("data", (chunk) => {
-      buffer += chunk.toString("binary");
-      if (state.brokerHandshakeSeen || !buffer.includes("\r\n\r\n")) {
-        return;
-      }
-
-      const requestText = Buffer.from(buffer, "binary").toString("utf8");
-      const key = requestText.match(/Sec-WebSocket-Key:\s*(.+)\r\n/i)?.[1]?.trim();
-      const requestLine = requestText.split("\r\n")[0] || "";
-      if (!requestLine.includes("/ws/agent?")) {
-        state.failure = new Error(`unexpected broker path: ${requestLine}`);
-      }
-      if (!key) {
-        state.failure = new Error("broker handshake missing Sec-WebSocket-Key");
-        return;
-      }
-
-      socket.write([
-        "HTTP/1.1 101 Switching Protocols",
-        "Upgrade: websocket",
-        "Connection: Upgrade",
-        `Sec-WebSocket-Accept: ${websocketAcceptKey(key)}`,
-        "",
-        "",
-      ].join("\r\n"));
-      state.brokerHandshakeSeen = true;
-      buffer = "";
-    });
-  });
-
-  return { server, sockets };
-}
-
-function createShellyServer(state) {
-  return http.createServer((request, response) => {
-    const url = new URL(request.url, "http://127.0.0.1");
-    state.requests.push({
-      service: "shelly",
-      method: request.method,
-      path: url.pathname,
-      query: Object.fromEntries(url.searchParams.entries()),
-    });
-
-    if (request.method === "GET" && url.pathname === "/rpc/Switch.Set") {
-      state.shellySwitchSetSeen = true;
-      if (url.searchParams.get("id") !== "0" || url.searchParams.get("on") !== "true") {
-        state.failure = new Error(`unexpected Shelly Switch.Set query: ${url.search}`);
-      }
-      sendJson(response, 200, { was_on: false, output: true });
-      return;
-    }
-
-    if (request.method === "GET" && url.pathname === "/rpc/Switch.GetStatus") {
-      state.shellyStatusSeen = true;
-      if (url.searchParams.get("id") !== "0") {
-        state.failure = new Error(`unexpected Shelly Switch.GetStatus query: ${url.search}`);
-      }
-      sendJson(response, 200, { id: 0, output: true, source: "fake-shelly-rpc" });
-      return;
-    }
-
-    if (url.pathname.startsWith("/relay/")) {
-      state.failure = new Error(`legacy Shelly endpoint should not be used for generation 2 proof: ${url.pathname}`);
-    }
-
-    sendJson(response, 404, { message: "not found" });
-  });
-}
-
-function createApiServer(state, brokerPort, shellyAddress) {
-  return http.createServer(async (request, response) => {
-    const url = new URL(request.url, "http://127.0.0.1");
-    const body = await readJson(request);
-    state.requests.push({ service: "api", method: request.method, path: url.pathname, body });
-
-    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/heartbeat") {
-      sendJson(response, 200, { data: { ok: true, broker_url: `ws://127.0.0.1:${brokerPort}` } });
-      return;
-    }
-
-    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/selfserve/machine-signal-bindings") {
-      sendJson(response, 200, { data: { monitors: [] } });
-      return;
-    }
-
-    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/commands/poll") {
-      state.commandPollSeen = true;
-      if (body.wait_seconds !== 0) {
-        state.failure = new Error(
-          `broker-connected command poll should be non-blocking, got wait_seconds=${body.wait_seconds}`
-        );
-      }
-
-      if (!state.commandDelivered) {
-        state.commandDelivered = true;
-        sendJson(response, 200, {
-          data: {
-            id: 77,
-            command_type: "SET_RELAY_STATE",
-            payload: {
-              localIp: shellyAddress,
-              local_ip: shellyAddress,
-              channel: 0,
-              on: true,
-              relayId: "relay-proof",
-              relay_id: "relay-proof",
-              deviceGeneration: 2,
-              device_generation: 2,
-            },
-          },
-        });
-        return;
-      }
-
-      sendJson(response, 200, { data: null });
-      return;
-    }
-
-    if (request.method === "POST" && url.pathname === "/edge-agent/gateways/42/commands/77/result") {
-      state.resultSeen = true;
-      if (
-        body.ok !== true ||
-        body.result?.on !== true ||
-        body.result?.output !== true ||
-        body.result?.raw?.source !== "fake-shelly-rpc"
-      ) {
-        state.failure = new Error(`unexpected command result: ${JSON.stringify(body)}`);
-      }
-      sendJson(response, 200, { data: { acknowledged: true } });
-      return;
-    }
-
-    sendJson(response, 404, { message: "not found", path: url.pathname });
-  });
-}
-
-function writeConfig(tempDir, apiPort, brokerPort, workerPort) {
-  const containerProofDir = "/proof";
-  const runtimeDir = `${containerProofDir}/runtime`;
-  const config = {
-    apiUrl: `http://127.0.0.1:${apiPort}`,
-    brokerUrl: `ws://127.0.0.1:${brokerPort}`,
-    gatewayId: 42,
-    agentToken: AGENT_TOKEN,
-    installDir: containerProofDir,
-    runtimeDir,
-    stateDatabasePath: `${runtimeDir}/gateway-state.sqlite`,
-    workerBaseUrl: `http://127.0.0.1:${workerPort}`,
-    heartbeatIntervalSeconds: 60,
-    operationPollTimeoutSeconds: 20,
-  };
-
-  const configPath = path.join(tempDir, "config.json");
-  fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
-  return { containerConfigPath: `${containerProofDir}/config.json` };
-}
-
-function spawnWorker({ workerPath, phpImage, workerPort }) {
-  return spawn("docker", [
-    "run",
-    "--rm",
-    "--network",
-    "host",
-    "-e",
-    `TRUCKWASH_WORKER_TOKEN=${AGENT_TOKEN}`,
-    "-v",
-    `${workerPath}:/lan-worker.php:ro`,
-    phpImage,
-    "php",
-    "-S",
-    `127.0.0.1:${workerPort}`,
-    "/lan-worker.php",
-  ], { stdio: ["ignore", "pipe", "pipe"] });
-}
-
-function spawnAgent({ agentPath, phpImage, tempDir, containerConfigPath }) {
-  return spawn("docker", [
-    "run",
-    "--rm",
-    "--network",
-    "host",
-    "-v",
-    `${agentPath}:/agent.php:ro`,
-    "-v",
-    `${tempDir}:/proof`,
-    phpImage,
-    "php",
-    "/agent.php",
-    "--config",
-    containerConfigPath,
-  ], { stdio: ["ignore", "pipe", "pipe"] });
-}
-
-async function waitForWorker(workerPort, child, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  let lastError = null;
-  while (Date.now() < deadline) {
-    if (child.exitCode !== null || child.signalCode !== null) {
-      throw new Error(`LAN worker exited before becoming healthy: ${child.exitCode ?? child.signalCode}`);
-    }
-
-    try {
-      const response = await requestJson({ port: workerPort, path: "/health" });
-      if (response.status === 200 && response.body?.service === "lan-worker") {
-        return;
-      }
-    } catch (error) {
-      lastError = error;
-    }
-    await new Promise((resolve) => setTimeout(resolve, 100));
-  }
-  throw lastError || new Error("LAN worker did not become healthy");
-}
-
-async function stopChild(child) {
-  if (child.exitCode !== null || child.signalCode !== null) {
-    return;
-  }
-
-  child.kill("SIGTERM");
-  const hardKill = setTimeout(() => {
-    if (child.exitCode === null && child.signalCode === null) {
-      child.kill("SIGKILL");
-    }
-  }, 1500);
-
-  await Promise.race([
-    new Promise((resolve) => child.once("exit", resolve)),
-    new Promise((resolve) => setTimeout(resolve, 2200)),
-  ]);
-  clearTimeout(hardKill);
-}
-
-function evidenceFromState(state, agentExited, workerExited) {
-  return {
-    brokerHandshakeSeen: state.brokerHandshakeSeen,
-    commandPollSeen: state.commandPollSeen,
-    shellySwitchSetSeen: state.shellySwitchSetSeen,
-    shellyStatusSeen: state.shellyStatusSeen,
-    resultSeen: state.resultSeen,
-    agentStayedRunningUntilProofComplete: !agentExited,
-    workerStayedRunningUntilProofComplete: !workerExited,
-  };
-}
-
-export async function runProof(options) {
-  if (process.platform !== "linux") {
-    throw new Error("This proof uses Docker --network host and currently expects Linux.");
-  }
-  if (!fs.existsSync(options.agentPath)) {
-    throw new Error(`Agent artifact not found: ${options.agentPath}`);
-  }
-  if (!fs.existsSync(options.workerPath)) {
-    throw new Error(`LAN worker artifact not found: ${options.workerPath}`);
-  }
-
-  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "edge-agent-to-shelly-proof-"));
-  fs.mkdirSync(path.join(tempDir, "runtime"), { recursive: true });
-
-  const state = {
-    brokerHandshakeSeen: false,
-    commandPollSeen: false,
-    shellySwitchSetSeen: false,
-    shellyStatusSeen: false,
-    resultSeen: false,
-    commandDelivered: false,
-    failure: null,
-    requests: [],
-  };
-
-  const broker = createBrokerServer(state);
-  const shellyServer = createShellyServer(state);
-  let apiServer = null;
-  let agent = null;
-  let worker = null;
-  let agentStdout = "";
-  let agentStderr = "";
-  let workerStdout = "";
-  let workerStderr = "";
-  let agentExited = false;
-  let workerExited = false;
-
-  try {
-    const brokerPort = await listen(broker.server);
-    const shellyPort = await listen(shellyServer);
-    const workerPort = await reservePort();
-    const shellyAddress = `127.0.0.1:${shellyPort}`;
-    apiServer = createApiServer(state, brokerPort, shellyAddress);
-    const apiPort = await listen(apiServer);
-    const { containerConfigPath } = writeConfig(tempDir, apiPort, brokerPort, workerPort);
-
-    worker = spawnWorker({ ...options, workerPort });
-    worker.stdout.on("data", (chunk) => {
-      workerStdout += chunk.toString();
-    });
-    worker.stderr.on("data", (chunk) => {
-      workerStderr += chunk.toString();
-    });
-    worker.once("exit", () => {
-      workerExited = true;
-    });
-    await waitForWorker(workerPort, worker, 5000);
-
-    agent = spawnAgent({ ...options, tempDir, containerConfigPath });
-    agent.stdout.on("data", (chunk) => {
-      agentStdout += chunk.toString();
-    });
-    agent.stderr.on("data", (chunk) => {
-      agentStderr += chunk.toString();
-    });
-    agent.once("exit", () => {
-      agentExited = true;
-    });
-
-    const deadline = Date.now() + options.timeoutMs;
-    while (Date.now() < deadline && !state.failure && !agentExited && !workerExited) {
-      if (
-        state.brokerHandshakeSeen &&
-        state.commandPollSeen &&
-        state.shellySwitchSetSeen &&
-        state.shellyStatusSeen &&
-        state.resultSeen
-      ) {
-        break;
-      }
-      await new Promise((resolve) => setTimeout(resolve, 100));
-    }
-
-    const evidence = evidenceFromState(state, agentExited, workerExited);
-    if (
-      state.failure ||
-      !state.brokerHandshakeSeen ||
-      !state.commandPollSeen ||
-      !state.shellySwitchSetSeen ||
-      !state.shellyStatusSeen ||
-      !state.resultSeen
-    ) {
-      const error = state.failure || new Error("missing proof evidence");
-      error.evidence = evidence;
-      error.requests = state.requests;
-      error.agentStdout = agentStdout.slice(-3000);
-      error.agentStderr = agentStderr.slice(-3000);
-      error.workerStdout = workerStdout.slice(-3000);
-      error.workerStderr = workerStderr.slice(-3000);
-      throw error;
-    }
-
-    return {
-      evidence,
-      agentPath: options.agentPath,
-      workerPath: options.workerPath,
-      phpImage: options.phpImage,
-      tempDir,
-      requestCount: state.requests.length,
-    };
-  } finally {
-    if (agent) {
-      await stopChild(agent);
-    }
-    if (worker) {
-      await stopChild(worker);
-    }
-    for (const socket of broker.sockets) {
-      socket.destroy();
-    }
-    await Promise.allSettled([
-      closeServer(broker.server),
-      closeServer(shellyServer),
-      apiServer ? closeServer(apiServer) : Promise.resolve(),
-    ]);
-    if (!options.keepTemp) {
-      fs.rmSync(tempDir, { recursive: true, force: true });
-    }
-  }
-}
-
-async function main() {
-  const options = parseArgs();
-  if (options.help) {
-    printUsage();
-    return;
-  }
-
-  const result = await runProof(options);
-  process.stdout.write("PASS broker-connected API command triggered real LAN worker Shelly RPC signal and posted result\n");
-  process.stdout.write(`${JSON.stringify(result.evidence)}\n`);
-  process.stdout.write(`Agent: ${result.agentPath}\n`);
-  process.stdout.write(`LAN worker: ${result.workerPath}\n`);
-  process.stdout.write(`PHP image: ${result.phpImage}\n`);
-  if (options.keepTemp) {
-    process.stdout.write(`Temp dir: ${result.tempDir}\n`);
-  }
-}
-
-if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    process.stderr.write(`FAIL ${error.message}\n`);
-    if (error.evidence) {
-      process.stderr.write(`Evidence: ${JSON.stringify(error.evidence)}\n`);
-    }
-    if (error.requests) {
-      process.stderr.write(`Requests: ${JSON.stringify(error.requests, null, 2)}\n`);
-    }
-    if (error.agentStdout) {
-      process.stderr.write(`agent stdout: ${error.agentStdout}\n`);
-    }
-    if (error.agentStderr) {
-      process.stderr.write(`agent stderr: ${error.agentStderr}\n`);
-    }
-    if (error.workerStdout) {
-      process.stderr.write(`worker stdout: ${error.workerStdout}\n`);
-    }
-    if (error.workerStderr) {
-      process.stderr.write(`worker stderr: ${error.workerStderr}\n`);
-    }
-    process.exit(1);
-  });
-}
@@ -10,7 +10,7 @@ import { promisify } from "node:util";
 import { DEFAULT_CONFIG_FILE_NAME, DEFAULT_HOST_API_URL } from "./test-gateway.mjs";

 const execFile = promisify(execFileCallback);
-const COMPOSE_SERVICES = ["traefik", "redis", "mysql-debug", "edge-broker", "php1", "php2", "php3", "php4", "php5", "caddy"];
+const COMPOSE_SERVICES = ["traefik", "redis", "mysql-debug", "edge-broker", "php1", "caddy"];

 function composeArgs(projectName, args) {
  return ["compose", "-p", projectName, ...args];
@@ -94,23 +94,9 @@ function directCaddyBaseUrl(baseUrl) {
  return normalizeBaseUrl(url.toString());
 }

-function isLocalHost(hostname) {
-  const normalized = String(hostname || "").toLowerCase().replace(/^\[|\]$/g, "");
-  return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
-}
-
 function resolveBrokerWebSocketUrl(rawUrl, apiBaseUrl) {
  const websocketUrl = new URL(String(rawUrl));
  const apiUrl = new URL(normalizeBaseUrl(apiBaseUrl));
-  const ciBrokerPort = String(process.env.EDGE_BROKER_CI_PORT || "").trim();
-
-  if (isLocalHost(apiUrl.hostname) && websocketUrl.hostname === "edge-broker" && ciBrokerPort !== "") {
-    websocketUrl.protocol = apiUrl.protocol === "https:" ? "wss:" : "ws:";
-    websocketUrl.hostname = apiUrl.hostname;
-    websocketUrl.port = ciBrokerPort;
-    websocketUrl.pathname = websocketUrl.pathname.replace(/^\/edge-broker(?=\/|$)/, "") || "/";
-    return websocketUrl.toString();
-  }

  if (apiUrl.hostname === "caddy" && websocketUrl.hostname === "caddy") {
    websocketUrl.hostname = "edge-broker";
@@ -118,18 +104,6 @@ function resolveBrokerWebSocketUrl(rawUrl, apiBaseUrl) {
    websocketUrl.pathname = websocketUrl.pathname.replace(/^\/edge-broker(?=\/|$)/, "") || "/";
  }

-  if (isLocalHost(apiUrl.hostname) && ["caddy", "edge-broker"].includes(websocketUrl.hostname)) {
-    const brokerPath = websocketUrl.pathname.replace(/^\/edge-broker(?=\/|$)/, "") || "/";
-    websocketUrl.protocol = apiUrl.protocol === "https:" ? "wss:" : "ws:";
-    websocketUrl.hostname = apiUrl.hostname;
-    websocketUrl.port = apiUrl.port;
-    websocketUrl.pathname = `/api/edge-broker${brokerPath}`;
-  }
-
-  if (isLocalHost(websocketUrl.hostname)) {
-    websocketUrl.pathname = websocketUrl.pathname.replace(/^\/edge-broker(?=\/|$)/, "") || "/";
-  }
-
  return websocketUrl.toString();
 }

@@ -540,10 +514,6 @@ function shouldCopyGatewayConfig() {
  return /^(1|true|yes)$/i.test(String(process.env.EDGE_GATEWAY_E2E_COPY_CONFIG || "").trim());
 }

-function shouldSkipComposeUp() {
-  return /^(1|true|yes)$/i.test(String(process.env.EDGE_GATEWAY_E2E_SKIP_COMPOSE_UP || "").trim());
-}
-
 function collectMessages(rows) {
  return Array.isArray(rows)
    ? rows
@@ -581,38 +551,6 @@ function summarizeStreamMessages(messages, limit = 12) {
    .filter(Boolean);
 }

-async function readGatewayDiagnostics({ baseUrl, authToken, gatewayId, containerName }) {
-  const diagnostics = {};
-
-  if (gatewayId !== null && gatewayId > 0 && authToken) {
-    try {
-      const detail = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}`, {
-        token: authToken,
-      });
-      diagnostics.gateway = {
-        status: detail?.data?.status ?? null,
-        channelStatus: detail?.data?.channel_status ?? null,
-        brokerPresence: detail?.data?.metadata?.broker_presence ?? null,
-        brokerConnected: detail?.data?.metadata?.broker_connected ?? null,
-        brokerLastError: detail?.data?.metadata?.broker_last_error ?? null,
-      };
-    } catch (error) {
-      diagnostics.gatewayError = error instanceof Error ? error.message : String(error);
-    }
-  }
-
-  try {
-    const logs = await runCommand("docker", ["logs", "--tail", "120", containerName], {
-      allowFailure: true,
-    });
-    diagnostics.containerLogs = String(`${logs.stdout || ""}${logs.stderr || ""}`).trim().split(/\r?\n/).slice(-120);
-  } catch (error) {
-    diagnostics.containerLogError = error instanceof Error ? error.message : String(error);
-  }
-
-  return diagnostics;
-}
-
 async function main() {
  const scriptPath = fileURLToPath(import.meta.url);
  const rootDir = await resolveRootDir(scriptPath);
@@ -632,9 +570,7 @@ async function main() {
  let runnerNetworkAttached = false;

  try {
-    if (!shouldSkipComposeUp()) {
-      await ensureComposeServices(rootDir, composeProject);
-    }
+    await ensureComposeServices(rootDir, composeProject);
    runnerNetworkAttached = await connectCurrentContainerToComposeNetwork(rootDir, composeProject);
    baseUrl = await waitForApiReady(baseUrl, rootDir, composeProject, runnerNetworkAttached);
    process.stdout.write(`Using API base URL ${baseUrl}\n`);
@@ -727,35 +663,22 @@ async function main() {
      }
    );

-    try {
-      await waitForCondition(
-        async () => {
-          const detail = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}`, {
-            token: authToken,
-          });
+    await waitForCondition(
+      async () => {
+        const detail = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}`, {
+          token: authToken,
+        });

-          return Boolean(
-            detail?.data?.channel_status?.broker?.connected
-            || detail?.data?.metadata?.broker_connected
-          );
-        },
-        {
-          timeoutMs: 90_000,
-          message: "Gateway never established a live broker connection after install.",
-        }
-      );
-    } catch (error) {
-      const diagnostics = await readGatewayDiagnostics({
-        baseUrl,
-        authToken,
-        gatewayId,
-        containerName,
-      });
-      throw new Error([
-        error instanceof Error ? error.message : String(error),
-        `Broker diagnostics: ${JSON.stringify(diagnostics, null, 2)}`,
-      ].join("\n"));
-    }
+        return Boolean(
+          detail?.data?.channel_status?.broker?.connected
+          || detail?.data?.metadata?.broker_connected
+        );
+      },
+      {
+        timeoutMs: 90_000,
+        message: "Gateway never established a live broker connection after install.",
+      }
+    );

    const WebSocketImpl = await loadWebSocketImplementation();
    const streamSession = await apiRequest(baseUrl, "POST", `/edge-gateways/${gatewayId}/stream-session`, {
@@ -778,14 +701,11 @@ async function main() {
      { timeoutMs: 15_000, message: "Gateway stream never became ready." }
    );

-    await waitForSocketMessage(
-      streamMessages,
-      (message) => (
-        message?.type === "gateway.stream.ready" && message?.connected === true
-      ) || (
-        message?.type === "presence.changed" && message?.status === "connected"
-      ),
-      { timeoutMs: 45_000, message: "Gateway stream never observed a connected broker presence." }
+    const readyMessage = streamMessages.find((message) => message?.type === "gateway.stream.ready");
+    assert.equal(
+      Boolean(readyMessage?.connected),
+      true,
+      "Gateway stream became ready before the broker reported the gateway as connected."
    );

    const operationResponse = await apiRequest(baseUrl, "POST", `/edge-gateways/${gatewayId}/operations`, {
@@ -813,24 +733,10 @@ async function main() {
    assert.ok(operationId > 0, "Operation creation did not return an operation id.");

    try {
-      await waitForCondition(
-        async () => {
-          const operations = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}/operations`, {
-            token: authToken,
-          });
-
-          const operation = Array.isArray(operations?.data)
-            ? operations.data.find((item) => Number(item?.id || 0) === operationId)
-            : null;
-
-          return operation?.status === "COMPLETED"
-            || streamMessages.some((message) => (
-              message?.type === "task.updated"
-              && Number(message?.operationId || 0) === operationId
-              && message?.operation?.status === "COMPLETED"
-            ));
-        },
-        { timeoutMs: 180_000, message: "Gateway operation never completed through the live agent." }
+      await waitForSocketMessage(
+        streamMessages,
+        (message) => message?.type === "task.updated" && Number(message?.operationId || 0) === operationId,
+        { timeoutMs: 180_000, message: "Live gateway stream never emitted task.updated for the queued operation." }
      );
    } catch (error) {
      let operationSnapshot = null;
@@ -853,6 +759,21 @@ async function main() {
      throw new Error(diagnostic);
    }

+    await waitForCondition(
+      async () => {
+        const operations = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}/operations`, {
+          token: authToken,
+        });
+
+        const operation = Array.isArray(operations?.data)
+          ? operations.data.find((item) => Number(item?.id || 0) === operationId)
+          : null;
+
+        return operation?.status === "COMPLETED";
+      },
+      { timeoutMs: 180_000, message: "Gateway operation never completed through the live agent." }
+    );
+
    await waitForSocketMessage(
      streamMessages,
      (message) => message?.type === "gateway.telemetry" || message?.type === "stats.updated",
@@ -928,20 +849,22 @@ async function main() {
      { timeoutMs: 20_000, message: "Browser shell never closed cleanly." }
    );

-    await waitForCondition(
-      async () => {
-        const logsAfterShell = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}/logs`, {
-          token: authToken,
-        });
-        const shellTranscripts = Array.isArray(logsAfterShell?.data?.shell_sessions)
-          ? logsAfterShell.data.shell_sessions.map((session) => String(session?.transcript || ""))
-          : [];
-        const timelineMessages = collectMessages(logsAfterShell?.data?.timeline || []);
+    const logsAfterShell = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}/logs`, {
+      token: authToken,
+    });
+    const shellTranscripts = Array.isArray(logsAfterShell?.data?.shell_sessions)
+      ? logsAfterShell.data.shell_sessions.map((session) => String(session?.transcript || ""))
+      : [];

-        return shellTranscripts.some((transcript) => transcript.includes("edge-e2e-shell"))
-          && timelineMessages.includes("GATEWAY_SHELL_SESSION_CLOSED");
-      },
-      { timeoutMs: 30_000, message: "Gateway logs page did not persist the shell transcript and close audit event." }
+    assert.ok(
+      shellTranscripts.some((transcript) => transcript.includes("edge-e2e-shell")),
+      "Gateway logs page did not persist the shell transcript."
+    );
+
+    const timelineMessages = collectMessages(logsAfterShell?.data?.timeline || []);
+    assert.ok(
+      timelineMessages.includes("GATEWAY_SHELL_SESSION_CLOSED"),
+      "Gateway logs page did not include the shell close audit event."
    );

    process.stdout.write("Edge gateway E2E smoke completed successfully.\n");
@@ -18,7 +18,6 @@ cd "$repo_root"
 compose_files="-f docker-compose.yml -f .github/docker-compose.ci.yml"
 project_suffix="$(date +%s)-$$"
 export COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-php-local-${suite}-${project_suffix}}"
-export COMPOSE_PROFILES="${COMPOSE_PROFILES:-dev}"

 log_dir=".tmp/ci-logs/$suite"
 mkdir -p "$log_dir"
@@ -52,50 +51,6 @@ collect_logs() {
  docker compose $compose_files cp php1:/var/log/php "$log_dir/php-logs" >/dev/null 2>&1 || true
 }

-retry_command() {
-  max_attempts="$1"
-  shift
-  attempt=1
-  while :; do
-    "$@" && return 0
-    status="$?"
-    if [ "$attempt" -ge "$max_attempts" ]; then
-      return "$status"
-    fi
-    sleep_seconds=$((attempt * 5))
-    echo "Command failed with status $status; retrying in ${sleep_seconds}s (attempt $((attempt + 1))/$max_attempts): $*" >&2
-    sleep "$sleep_seconds"
-    attempt=$((attempt + 1))
-  done
-}
-
-composer_install() {
-  dist_attempts="${PHP_CI_COMPOSER_RETRIES:-3}"
-  source_attempts="${PHP_CI_COMPOSER_SOURCE_RETRIES:-2}"
-
-  if retry_command "$dist_attempts" \
-    docker compose $compose_files exec -T php1 sh -lc \
-    'cd /var/www/html && composer install --no-interaction --prefer-dist --no-progress'; then
-    return 0
-  fi
-
-  echo "Composer dist install failed after ${dist_attempts} attempts; retrying with --prefer-source." >&2
-  retry_command "$source_attempts" \
-    docker compose $compose_files exec -T php1 sh -lc \
-    'cd /var/www/html && composer install --no-interaction --prefer-source --no-progress'
-}
-
-configure_ci_docker_subnet() {
-  if [ -n "${CI_DOCKER_SUBNET:-}" ]; then
-    return
-  fi
-
-  checksum="$(printf '%s' "$COMPOSE_PROJECT_NAME" | cksum | awk '{print $1}')"
-  subnet_second=$((64 + ((checksum / 256) % 64)))
-  subnet_third=$((checksum % 256))
-  export CI_DOCKER_SUBNET="10.${subnet_second}.${subnet_third}.0/24"
-}
-
 cleanup() {
  status="$?"
  collect_logs "$status"
@@ -115,8 +70,7 @@ cleanup() {
 }
 trap cleanup EXIT INT TERM

-configure_ci_docker_subnet
-sh scripts/ci-docker-compose-up.sh redis mysql-debug php1
+docker compose $compose_files up -d redis mysql-debug php1

 docker compose $compose_files exec -T php1 sh -lc '
  set -eu
@@ -139,18 +93,10 @@ tar \
  --exclude='./.phpunit.cache' \
  --exclude='./build/logs' \
  -C services/nginx/app -cf - . \
-  | docker compose $compose_files exec -T php1 tar --no-same-owner -C /var/www/html -xf -
-
-docker compose $compose_files exec -T php1 sh -lc 'rm -rf /var/www/repo-root && mkdir -p /var/www/repo-root'
-tar \
-  -cf - \
-  Dockerfile \
-  Dockerfile.coolify-api \
-  services/php/Dockerfile \
-  services/php/php-fpm-pool.conf \
-  | docker compose $compose_files exec -T php1 tar --no-same-owner -C /var/www/repo-root -xf -
-
-composer_install
+  | docker compose $compose_files exec -T php1 tar -C /var/www/html -xf -

 docker compose $compose_files exec -T php1 sh -lc \
-  "cd /var/www/html && PLENO_REPO_ROOT_FOR_TESTS=/var/www/repo-root composer test:ci:$suite"
+  'cd /var/www/html && composer install --no-interaction --prefer-dist --no-progress'
+
+docker compose $compose_files exec -T php1 sh -lc \
+  "cd /var/www/html && composer test:ci:$suite"
@@ -1,32 +1,14 @@
 import process from "node:process";
 import path from "node:path";
-import { createHash } from "node:crypto";
 import { pathToFileURL } from "node:url";

 export const DEFAULT_STAGING_BASE_URL = "https://api.truckwash.io:4433";
-export const EXPECTED_INSTALL_VERSION = "compose-php-agent-v3";
-export const REQUIRED_MANIFEST_ARTIFACTS = [
-  "agent.php",
-  "lan-worker.php",
-  "auto-updater.php",
-  "docker-compose.gateway.yml",
-  "Dockerfile.edge-agent",
-  "Dockerfile.lan-worker",
-  "Dockerfile.auto-updater",
-  "gateway-launcher.sh",
-  "truckwash-edge-gateway-stack.service",
-  "truckwash-edge-agent.service",
-];
 export const INSTALLER_SCRIPT_REQUIRED_SNIPPETS = [
  "/edge-agent/install-token/status",
-  "/edge-agent/artifacts/manifest.json",
  "report_install_status",
  'begin_install_phase "VERIFY_TOKEN"',
-  'begin_install_phase "VERIFY_ARTIFACTS"',
  'begin_install_phase "WAIT_FOR_CLAIM"',
  'report_install_status "FAILED"',
-  "verify_manifest_artifact",
-  EXPECTED_INSTALL_VERSION,
 ];

 export function normalizeBaseUrl(url) {
@@ -73,20 +55,13 @@ export function buildChecks(baseUrl, installToken) {
      name: "Ping",
      url: `${normalizedBaseUrl}/ping`,
    },
-    {
-      name: "Artifact manifest",
-      url: `${normalizedBaseUrl}/edge-agent/artifacts/manifest.json`,
-      artifactName: "manifest.json",
-    },
    {
      name: "Agent PHP artifact",
      url: `${normalizedBaseUrl}/edge-agent/artifacts/agent.php`,
-      artifactName: "agent.php",
    },
    {
      name: "Service unit artifact",
      url: `${normalizedBaseUrl}/edge-agent/artifacts/truckwash-edge-agent.service`,
-      artifactName: "truckwash-edge-agent.service",
    },
    {
      name: "Installer script",
@@ -95,42 +70,6 @@ export function buildChecks(baseUrl, installToken) {
  ];
 }

-export function validateArtifactManifestBody(body) {
-  const manifest = JSON.parse(String(body || ""));
-  if (manifest.version !== EXPECTED_INSTALL_VERSION) {
-    throw new Error(`Artifact manifest version mismatch: expected ${EXPECTED_INSTALL_VERSION}, got ${manifest.version}`);
-  }
-  if (!Array.isArray(manifest.artifacts)) {
-    throw new Error("Artifact manifest is missing artifacts.");
-  }
-
-  const byName = new Map(manifest.artifacts.map((artifact) => [artifact?.name, artifact]));
-  const missingArtifacts = REQUIRED_MANIFEST_ARTIFACTS.filter((artifactName) => !byName.has(artifactName));
-  if (missingArtifacts.length) {
-    throw new Error(`Artifact manifest is missing required artifacts: ${missingArtifacts.join(", ")}`);
-  }
-
-  return manifest;
-}
-
-export function validateArtifactBodyAgainstManifest(manifest, artifactName, body) {
-  const artifact = manifest?.artifacts?.find((entry) => entry?.name === artifactName);
-  if (!artifact) {
-    throw new Error(`Artifact ${artifactName} is missing from manifest.`);
-  }
-
-  const buffer = Buffer.isBuffer(body) ? body : Buffer.from(String(body || ""));
-  const sha256 = createHash("sha256").update(buffer).digest("hex");
-  if (sha256 !== artifact.sha256) {
-    throw new Error(`Artifact ${artifactName} hash mismatch: ${sha256} !== ${artifact.sha256}`);
-  }
-  if (buffer.length !== artifact.bytes) {
-    throw new Error(`Artifact ${artifactName} size mismatch: ${buffer.length} !== ${artifact.bytes}`);
-  }
-
-  return artifact;
-}
-
 export function validateInstallerScriptBody(body) {
  const source = String(body || "");
  const missingSnippets = INSTALLER_SCRIPT_REQUIRED_SNIPPETS.filter((snippet) => !source.includes(snippet));
@@ -168,17 +107,16 @@ export async function runSmoke({ baseUrl, installToken }) {

  const checks = buildChecks(baseUrl, installToken);
  const results = [];
-  let artifactManifest = null;

  for (const check of checks) {
    process.stdout.write(`[staging-smoke] GET ${check.url}\n`);
    const response = await fetch(check.url);
-    const body = Buffer.from(await response.arrayBuffer());
+    const body = await response.text();
    const result = {
      ...check,
      status: response.status,
      ok: response.ok,
-      bodyPreview: previewBody(body.toString("utf8")),
+      bodyPreview: previewBody(body),
    };
    results.push(result);

@@ -189,16 +127,8 @@ export async function runSmoke({ baseUrl, installToken }) {
      );
    }

-    if (check.name === "Artifact manifest") {
-      artifactManifest = validateArtifactManifestBody(body.toString("utf8"));
-      result.version = artifactManifest.version;
-      result.artifactCount = artifactManifest.artifacts.length;
-    }
-    if (artifactManifest && check.artifactName && check.artifactName !== "manifest.json") {
-      result.verifiedArtifact = validateArtifactBodyAgainstManifest(artifactManifest, check.artifactName, body);
-    }
    if (check.name === "Installer script") {
-      result.verifiedSnippets = validateInstallerScriptBody(body.toString("utf8"));
+      result.verifiedSnippets = validateInstallerScriptBody(body);
    }
  }

@@ -3,13 +3,10 @@ import assert from "node:assert/strict";

 import {
  DEFAULT_STAGING_BASE_URL,
-  EXPECTED_INSTALL_VERSION,
  INSTALLER_SCRIPT_REQUIRED_SNIPPETS,
  buildChecks,
  normalizeBaseUrl,
  parseArgs,
-  validateArtifactBodyAgainstManifest,
-  validateArtifactManifestBody,
  validateInstallerScriptBody,
 } from "./staging-edge-gateway-smoke.mjs";

@@ -35,58 +32,18 @@ test("buildChecks targets the public staging endpoints", () => {

  assert.deepEqual(checks.map((check) => check.url), [
    "https://api.truckwash.io:4433/ping",
-    "https://api.truckwash.io:4433/edge-agent/artifacts/manifest.json",
    "https://api.truckwash.io:4433/edge-agent/artifacts/agent.php",
    "https://api.truckwash.io:4433/edge-agent/artifacts/truckwash-edge-agent.service",
    "https://api.truckwash.io:4433/edge-agent/install.sh?token=abc%20123",
  ]);
 });

-test("validateArtifactManifestBody requires v3 install artifacts", () => {
-  const artifacts = [
-    "agent.php",
-    "lan-worker.php",
-    "auto-updater.php",
-    "docker-compose.gateway.yml",
-    "Dockerfile.edge-agent",
-    "Dockerfile.lan-worker",
-    "Dockerfile.auto-updater",
-    "gateway-launcher.sh",
-    "truckwash-edge-gateway-stack.service",
-    "truckwash-edge-agent.service",
-  ].map((name) => ({ name, sha256: "abc", bytes: 1 }));
-
-  const manifest = validateArtifactManifestBody(JSON.stringify({
-    version: EXPECTED_INSTALL_VERSION,
-    artifacts,
-  }));
-
-  assert.equal(manifest.version, EXPECTED_INSTALL_VERSION);
-});
-
-test("validateArtifactBodyAgainstManifest verifies size and hash", () => {
-  const body = Buffer.from("hello");
-  const manifest = {
-    artifacts: [{
-      name: "agent.php",
-      sha256: "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824",
-      bytes: body.length,
-    }],
-  };
-
-  assert.equal(validateArtifactBodyAgainstManifest(manifest, "agent.php", body).name, "agent.php");
-});
-
 test("validateInstallerScriptBody requires install-session reporting wiring", () => {
  const script = `
    INSTALL_STATUS_URL="https://api.truckwash.io:4433/edge-agent/install-token/status"
-    fetch_http "Download artifact manifest" "https://api.truckwash.io:4433/edge-agent/artifacts/manifest.json"
    report_install_status "FAILED"
    begin_install_phase "VERIFY_TOKEN" "Verifying install token"
-    begin_install_phase "VERIFY_ARTIFACTS" "Verifying edge gateway artifacts"
    begin_install_phase "WAIT_FOR_CLAIM" "Waiting for gateway heartbeat and claim"
-    verify_manifest_artifact
-    ${EXPECTED_INSTALL_VERSION}
  `;

  assert.deepEqual(validateInstallerScriptBody(script), INSTALLER_SCRIPT_REQUIRED_SNIPPETS);
@@ -12,7 +12,7 @@ export const DEFAULT_IMAGE_TAG = "truckwash-edge-agent:test-gateway";
 export const DEFAULT_CONFIG_FILE_NAME = "test-gateway.json";
 export const DEFAULT_HOST_API_URL = "http://localhost/api";
 export const DEFAULT_CONTAINER_API_URL = "http://caddy";
-export const DEFAULT_CONTAINER_BROKER_URL = "ws://edge-broker:4300";
+export const DEFAULT_CONTAINER_BROKER_URL = "http://edge-broker:4300";
 export const DEFAULT_INSTALL_DIR = "/opt/truckwash-edge-agent";
 export const DEFAULT_RUNTIME_DIR = `${DEFAULT_INSTALL_DIR}/runtime`;
 export const DEFAULT_STATE_DATABASE_PATH = `${DEFAULT_RUNTIME_DIR}/gateway-state.sqlite`;
@@ -25,16 +25,6 @@ function composeArgs(projectName, args) {
  return ["compose", "-p", projectName, ...args];
 }

-function usesWindowsPathSyntax(filePath) {
-  return /^[A-Za-z]:($|[\\/])/.test(filePath) || filePath.startsWith("\\\\") || filePath.includes("\\");
-}
-
-function pathForInputs(...filePaths) {
-  const hasWindowsPath = filePaths.some((filePath) => usesWindowsPathSyntax(String(filePath || "")));
-
-  return hasWindowsPath ? path.win32 : path;
-}
-
 async function resolveRootDir(scriptPath) {
  const cwd = process.cwd();

@@ -76,7 +66,7 @@ export function resolveComposeProjectName(rootDir, env = process.env) {
    return explicit;
  }

-  return pathForInputs(rootDir).basename(rootDir);
+  return path.basename(rootDir);
 }

 export function resolveComposeNetworkName(rootDir, env = process.env) {
@@ -84,13 +74,11 @@ export function resolveComposeNetworkName(rootDir, env = process.env) {
 }

 export function resolveConfigDirectory(rootDir, explicitDir = null) {
-  const pathModule = pathForInputs(rootDir, explicitDir);
-
  if (explicitDir) {
-    return pathModule.resolve(rootDir, explicitDir);
+    return path.resolve(rootDir, explicitDir);
  }

-  return pathModule.join(rootDir, ".tmp", "test-gateway");
+  return path.join(rootDir, ".tmp", "test-gateway");
 }

 export function shouldClaimGateway(existingConfig = {}, installToken = "") {
@@ -409,20 +397,14 @@ async function startContainer({
  });

  if (copyConfig) {
-    const configFilePath = path.join(configDir, DEFAULT_CONFIG_FILE_NAME);
-    await fs.chmod(configFilePath, 0o666).catch(() => {});
-    try {
-      await runCommand("docker", [
-        "cp",
-        configFilePath,
-        `${containerName}:${containerConfigPath}`,
-      ], {
-        cwd: rootDir,
-        stdio: "inherit",
-      });
-    } finally {
-      await fs.chmod(configFilePath, 0o600).catch(() => {});
-    }
+    await runCommand("docker", [
+      "cp",
+      path.join(configDir, DEFAULT_CONFIG_FILE_NAME),
+      `${containerName}:${containerConfigPath}`,
+    ], {
+      cwd: rootDir,
+      stdio: "inherit",
+    });

    await runCommand("docker", ["start", containerName], {
      cwd: rootDir,
@@ -10,11 +10,6 @@
    # CORS is handled at the edge by Traefik's headers middleware.
    # Do not set or strip Access-Control-* headers here to avoid conflicts.

-    # Do not expose local replication bootstrap material from the public web root.
-    # Bootstrap snapshots contain sensitive failover credentials.
-    @replicationBootstrap path /storage/replication-bootstrap.json /storage/replication-bootstrap-*
-    respond @replicationBootstrap 404
-
    # PHP handling via FastCGI to php-fpm pool
    php_fastcgi php1:9000 php2:9000 php3:9000 php4:9000 php5:9000

@@ -10,11 +10,6 @@
    # CORS is handled at the edge by Traefik's headers middleware.
    # Do not set or strip Access-Control-* headers here to avoid conflicts.

-    # Do not expose local replication bootstrap material from the public web root.
-    # Bootstrap snapshots contain sensitive failover credentials.
-    @replicationBootstrap path /storage/replication-bootstrap.json /storage/replication-bootstrap-*
-    respond @replicationBootstrap 404
-
    # PHP handling via FastCGI to php-fpm pool
    php_fastcgi php-staging:9000

@@ -18,7 +18,6 @@ const DEFAULT_UPDATE_VERIFY_INTERVAL_MS = 500;
 const DEFAULT_UPDATE_RESTART_GRACE_MS = 150;
 const DEFAULT_BROKER_RECONNECT_DELAY_MS = 1500;
 const DEFAULT_SHELLY_LOCAL_HTTP_TIMEOUT_MS = 1200;
-const MAX_RELAY_TOGGLE_AFTER_SECONDS = 5;
 const UPDATE_VERIFY_COMMAND = "post-update-verify";
 const execFile = promisify(execFileCallback);

@@ -152,10 +151,6 @@ function buildTransportHeartbeatState(brokerState = {}) {
  };
 }

-function isShellAccessEnabled(config = {}) {
-  return config.enableShellAccess === true;
-}
-
 function normalizeBrokerBaseUrl(value) {
  const trimmed = String(value || "").trim().replace(/\/+$/, "");
  if (trimmed === "") {
@@ -483,7 +478,7 @@ function resolveRelayToggleAfterSeconds(payload = {}) {
    return null;
  }

-  return Math.min(Math.floor(configured), MAX_RELAY_TOGGLE_AFTER_SECONDS);
+  return Math.floor(configured);
 }

 async function fetchJson(url, fetchImpl = fetch, options = {}) {
@@ -754,74 +749,11 @@ export async function setRelayState(payload, fetchImpl = fetch) {
  }
 }

-async function mapWithConcurrency(items, limit, mapper) {
-  const results = new Array(items.length);
-  let nextIndex = 0;
-  const workerCount = Math.max(1, Math.min(Number(limit) || 1, items.length || 1));
-
-  await Promise.all(Array.from({ length: workerCount }, async () => {
-    while (nextIndex < items.length) {
-      const index = nextIndex;
-      nextIndex += 1;
-      results[index] = await mapper(items[index], index);
-    }
-  }));
-
-  return results;
-}
-
-async function executeRelayBatch(command, handler, fetchImpl = fetch) {
-  const commands = Array.isArray(command?.payload?.commands)
-    ? command.payload.commands
-    : Array.isArray(command?.commands)
-      ? command.commands
-      : [];
-  const concurrency = Math.max(1, Math.min(Number(command?.payload?.concurrency || command?.concurrency || 5), 5));
-
-  const results = await mapWithConcurrency(commands, concurrency, async (entry = {}) => {
-    const target = String(entry.target || entry.relay || "");
-    const relayId = String(entry.relayId || entry.relay_id || "");
-    try {
-      const payload = await handler(entry, fetchImpl);
-      return {
-        target,
-        relayId,
-        relay_id: relayId,
-        ok: true,
-        payload,
-      };
-    } catch (error) {
-      return {
-        target,
-        relayId,
-        relay_id: relayId,
-        ok: false,
-        error: error instanceof Error ? error.message : String(error),
-      };
-    }
-  });
-
-  return {
-    batchId: command?.payload?.batchId || command?.payload?.batch_id || command?.batchId || command?.batch_id || null,
-    batch_id: command?.payload?.batch_id || command?.payload?.batchId || command?.batch_id || command?.batchId || null,
-    results,
-  };
-}
-
 async function fetchArtifactBuffer(url, expectedSha256, label, fetchImpl = fetch) {
  if (!url) {
    return null;
  }

-  if (!expectedSha256) {
-    throw new Error(`${label} checksum is required`);
-  }
-
-  const normalizedExpectedSha256 = String(expectedSha256).toLowerCase();
-  if (!/^[a-f0-9]{64}$/.test(normalizedExpectedSha256)) {
-    throw new Error(`${label} checksum must be a valid sha256 hex digest`);
-  }
-
  const response = await fetchImpl(url);
  if (!response.ok) {
    throw new Error(`${label} download failed: HTTP ${response.status}`);
@@ -829,7 +761,7 @@ async function fetchArtifactBuffer(url, expectedSha256, label, fetchImpl = fetch

  const buffer = Buffer.from(await response.arrayBuffer());
  const sha256 = createHash("sha256").update(buffer).digest("hex");
-  if (normalizedExpectedSha256 !== sha256.toLowerCase()) {
+  if (expectedSha256 && String(expectedSha256).toLowerCase() !== sha256.toLowerCase()) {
    throw new Error(`${label} checksum mismatch`);
  }

@@ -1470,10 +1402,6 @@ export async function handleAgentCommand(command, deps = {}) {
      return await getRelayStatus(command.payload || {}, fetchImpl);
    case "SET_RELAY_STATE":
      return await setRelayState(command.payload || {}, fetchImpl);
-    case "BATCH_RELAY_STATUS":
-      return await executeRelayBatch(command, getRelayStatus, fetchImpl);
-    case "BATCH_SET_RELAY_STATE":
-      return await executeRelayBatch(command, setRelayState, fetchImpl);
    case "RUN_UPDATE":
      return await runUpdate(command.payload || {}, fetchImpl, deps);
    case "UNINSTALL_AGENT":
@@ -1857,10 +1785,6 @@ export async function processPolledShellAction(config, action, shell, fetchImpl
  }

  try {
-    if (!isShellAccessEnabled(config)) {
-      throw new Error("Shell access is disabled by local configuration");
-    }
-
    if (actionType === "OPEN") {
      await shell.open(payload);
    } else if (actionType === "INPUT") {
@@ -1995,30 +1919,18 @@ function createBrokerBridge({
        }

        if (message.type === "OPEN_ROOT_SHELL") {
-          if (!isShellAccessEnabled(config)) {
-            throw new Error("Shell access is disabled by local configuration");
-          }
          await shell.open(message.payload || {});
          return;
        }
        if (message.type === "SHELL_INPUT") {
-          if (!isShellAccessEnabled(config)) {
-            throw new Error("Shell access is disabled by local configuration");
-          }
          shell.input(message.payload || {});
          return;
        }
        if (message.type === "RESIZE_ROOT_SHELL") {
-          if (!isShellAccessEnabled(config)) {
-            throw new Error("Shell access is disabled by local configuration");
-          }
          shell.resize(message.payload || {});
          return;
        }
        if (message.type === "CLOSE_ROOT_SHELL") {
-          if (!isShellAccessEnabled(config)) {
-            throw new Error("Shell access is disabled by local configuration");
-          }
          shell.close(message.payload || {});
        }
      } catch {
@@ -1,7 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { execFile as execFileCallback } from "node:child_process";
-import { createHash } from "node:crypto";
 import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -18,7 +17,6 @@ import {
  getRelayStatus,
  loadConfig,
  parseCliArgs,
-  processPolledShellAction,
  processPolledCommand,
  runCli,
  runUpdate,
@@ -41,10 +39,6 @@ function makeFetchResponse(body) {
  };
 }

-function sha256Hex(body) {
-  return createHash("sha256").update(body).digest("hex");
-}
-
 async function waitFor(predicate, { timeoutMs = 1000, intervalMs = 10, description = "condition" } = {}) {
  const deadline = Date.now() + timeoutMs;

@@ -127,39 +121,6 @@ test("relay status and switch commands support both Shelly RPC and legacy endpoi
  assert.equal(switched.on, false);
 });

-test("batch relay commands return per-relay results without failing the whole batch", async () => {
-  const fakeFetch = async (url) => {
-    const value = String(url);
-    if (value.includes("10.1.0.31")) {
-      return {
-        ok: true,
-        async json() {
-          return { output: true };
-        },
-      };
-    }
-    throw new Error("relay offline");
-  };
-
-  const result = await handleAgentCommand({
-    commandType: "BATCH_SET_RELAY_STATE",
-    payload: {
-      batch_id: "batch-1",
-      commands: [
-        { target: "MACHINE", relayId: "relay-machine", localIp: "10.1.0.31", channel: 0, on: true },
-        { target: "EXIT", relayId: "relay-out", localIp: "10.1.0.32", channel: 0, on: true },
-      ],
-    },
-  }, { fetchImpl: fakeFetch });
-
-  assert.equal(result.batch_id, "batch-1");
-  assert.equal(result.results.length, 2);
-  assert.equal(result.results[0].ok, true);
-  assert.equal(result.results[0].target, "MACHINE");
-  assert.equal(result.results[1].ok, false);
-  assert.match(result.results[1].error, /relay offline/);
-});
-
 test("Shelly discovery infers Gen3 from S3 relay model codes when generation is omitted", async () => {
  const inventory = await discoverShellyDevices({ candidateIps: ["192.168.1.2"] }, async (url) => {
    assert.equal(String(url), "http://192.168.1.2/shelly");
@@ -309,31 +270,6 @@ test("relay switch commands pass timer values to local Shelly APIs", async () =>
    "http://10.1.0.31/rpc/Switch.Set?id=0&on=true&toggle_after=3",
    "http://10.1.0.31/relay/0?turn=on&timer=3",
  ]);
-
-  const cappedUrls = [];
-  const cappedFetch = async (url) => {
-    cappedUrls.push(String(url));
-
-    return {
-      ok: true,
-      async json() {
-        return { output: true };
-      },
-    };
-  };
-
-  await setRelayState({
-    localIp: "10.1.0.31",
-    channel: 0,
-    on: true,
-    toggle_after: 999999999,
-    device_generation: 3,
-  }, cappedFetch);
-
-  assert.equal(
-    cappedUrls[0],
-    "http://10.1.0.31/rpc/Switch.Set?id=0&on=true&toggle_after=5"
-  );
 });

 test("runUpdate stages a pending verification restart after installing new artifacts", async () => {
@@ -358,23 +294,19 @@ test("runUpdate stages a pending verification restart after installing new artif
    execCalls.push({ command, args, options });
    return { stdout: "{}" };
  };
-  const agentBody = "// new agent\n";
-  const packageBody = JSON.stringify({ name: "new-edge-agent" }, null, 2);
  const fakeFetch = async (url) => {
    if (String(url).endsWith("/agent.mjs")) {
-      return makeFetchResponse(agentBody);
+      return makeFetchResponse("// new agent\n");
    }
    if (String(url).endsWith("/package.json")) {
-      return makeFetchResponse(packageBody);
+      return makeFetchResponse(JSON.stringify({ name: "new-edge-agent" }, null, 2));
    }
    throw new Error(`Unexpected URL: ${url}`);
  };

  const result = await runUpdate({
    artifactUrl: "https://api.example.test/edge-agent/artifacts/agent.mjs",
-    sha256: sha256Hex(agentBody),
    packageUrl: "https://api.example.test/edge-agent/artifacts/package.json",
-    packageSha256: sha256Hex(packageBody),
    targetVersion: "1.1.0",
    releaseChannel: "stable",
    restartMode: "spawn",
@@ -402,45 +334,6 @@ test("runUpdate stages a pending verification restart after installing new artif

  await rm(tempDir, { recursive: true, force: true });
 });
-test("runUpdate rejects artifacts without required checksums", async () => {
-  const tempDir = await mkdtemp(path.join(os.tmpdir(), "edge-agent-update-checksum-"));
-  const configPath = path.join(tempDir, "config.json");
-  const liveConfig = {
-    apiUrl: "https://api.example.test",
-    gatewayId: 42,
-    agentToken: "agent-token",
-    installDir: tempDir,
-    restartMode: "spawn",
-    installedVersion: "1.0.0",
-    targetVersion: "1.0.0",
-  };
-
-  await writeFile(configPath, JSON.stringify(liveConfig, null, 2));
-  await writeFile(path.join(tempDir, "agent.mjs"), "// old agent\n");
-
-  let fetchCalled = false;
-  await assert.rejects(
-    runUpdate({
-      artifactUrl: "https://api.example.test/edge-agent/artifacts/agent.mjs",
-      targetVersion: "1.1.0",
-    }, async () => {
-      fetchCalled = true;
-      return makeFetchResponse("// new agent\n");
-    }, {
-      configPath,
-      config: liveConfig,
-      liveConfig,
-      execFileImpl: async () => ({ stdout: "{}" }),
-    }),
-    /Agent artifact checksum is required/
-  );
-
-  assert.equal(fetchCalled, false);
-  assert.equal(await readFile(path.join(tempDir, "agent.mjs"), "utf8"), "// old agent\n");
-
-  await rm(tempDir, { recursive: true, force: true });
-});
-

 test("handleAgentCommand returns an uninstall follow-up envelope for gateway removal", async () => {
  const tempDir = await mkdtemp(path.join(os.tmpdir(), "edge-agent-uninstall-envelope-"));
@@ -777,7 +670,6 @@ test("startAgent reports API polling metadata, executes polled commands, and upl
    commandPollRetryDelayMs: 5,
    shellActionPollTimeoutSeconds: 0,
    shellActionPollRetryDelayMs: 5,
-    enableShellAccess: true,
  }));

  const heartbeats = [];
@@ -1036,61 +928,6 @@ test("startAgent reports API polling metadata, executes polled commands, and upl
  }
 });

-test("processPolledShellAction denies shell access when locally disabled", async () => {
-  const submissions = [];
-  const fakeFetch = async (url, options = {}) => {
-    if (/\/shell-actions\/\d+\/result$/.test(String(url))) {
-      submissions.push({ url, body: JSON.parse(options.body) });
-      return {
-        ok: true,
-        async json() {
-          return { data: { acknowledged: true } };
-        },
-      };
-    }
-
-    throw new Error(`Unexpected URL: ${url}`);
-  };
-
-  const shell = {
-    async open() {
-      throw new Error("should not run");
-    },
-    input() {
-      throw new Error("should not run");
-    },
-    resize() {
-      throw new Error("should not run");
-    },
-    close() {
-      throw new Error("should not run");
-    },
-  };
-
-  const result = await processPolledShellAction(
-    {
-      apiUrl: "https://api.example.test",
-      gatewayId: 42,
-      agentToken: "agent-token",
-      enableShellAccess: false,
-    },
-    {
-      id: 501,
-      actionType: "OPEN",
-      payload: {
-        sessionId: 44,
-      },
-    },
-    shell,
-    fakeFetch
-  );
-
-  assert.equal(result.ok, false);
-  assert.match(result.error, /Shell access is disabled/);
-  assert.equal(submissions.length, 1);
-  assert.equal(submissions[0].body.ok, false);
-});
-
 test("status helpers report config without exposing the agent token", async () => {
  const tempDir = await mkdtemp(path.join(os.tmpdir(), "edge-agent-status-"));
  const configPath = path.join(tempDir, "config.json");
@@ -4,7 +4,6 @@ import { fileURLToPath } from "node:url";
 import { WebSocketServer } from "ws";

 const DEFAULT_SHELL_OPEN_TIMEOUT_MS = 15000;
-const TELEMETRY_INGEST_ERROR_MESSAGE = "Telemetry ingestion failed";

 function parseJsonBody(req) {
  return new Promise((resolve, reject) => {
@@ -56,33 +55,7 @@ function resolveAuthMode(options = {}, managerUrl = "") {
  if (process.env.EDGE_AUTH_MODE) {
    return process.env.EDGE_AUTH_MODE;
  }
-  return "strict";
-}
-
-function resolveSharedSecret(options = {}) {
-  return String(options.sharedSecret ?? process.env.EDGE_BROKER_SHARED_SECRET ?? "").trim();
-}
-
-function requireSharedSecret(req, res, sharedSecret) {
-  if (sharedSecret === "") {
-    jsonResponse(res, 503, {
-      ok: false,
-      error: "Edge broker shared secret is not configured",
-      shared_secret_required: true,
-    });
-    return false;
-  }
-
-  if (req.headers["x-edge-broker-secret"] !== sharedSecret) {
-    jsonResponse(res, 403, {
-      ok: false,
-      error: "Forbidden",
-      shared_secret_required: true,
-    });
-    return false;
-  }
-
-  return true;
+  return "manager";
 }

 function parseScopes(value) {
@@ -177,7 +150,7 @@ function rejectUpgrade(socket, statusCode, errorCode, message, details = {}) {
 }

 export function createBrokerServer(options = {}) {
-  const sharedSecret = resolveSharedSecret(options);
+  const sharedSecret = options.sharedSecret ?? process.env.EDGE_BROKER_SHARED_SECRET ?? "";
  const managerUrl = resolveManagerUrl(options);
  const authMode = resolveAuthMode(options, managerUrl);
  const commandTimeoutMs = options.commandTimeoutMs ?? 10000;
@@ -296,12 +269,6 @@ export function createBrokerServer(options = {}) {
      ? async (_gatewayId, payload = {}) => payload
      : async (gatewayId, payload = {}) =>
          managerRequest(`/edge-agent/internal/gateways/${gatewayId}/logs`, payload));
-  const ingestMachineSignal =
-    options.ingestMachineSignal ||
-    (authMode === "stub"
-      ? async (_gatewayId, payload = {}) => payload
-      : async (gatewayId, payload = {}) =>
-          managerRequest(`/edge-agent/internal/gateways/${gatewayId}/selfserve/machine-signal`, payload));

  const broadcastGatewayEvent = (gatewayId, message) => {
    const sessionIds = gatewayStreamSessions.get(String(gatewayId));
@@ -493,19 +460,25 @@ export function createBrokerServer(options = {}) {
      }

      if (req.method === "POST" && url.pathname === "/api/diagnostics/shared-secret") {
-        if (!requireSharedSecret(req, res, sharedSecret)) {
+        if (sharedSecret && req.headers["x-edge-broker-secret"] !== sharedSecret) {
+          jsonResponse(res, 403, {
+            ok: false,
+            error: "Forbidden",
+            shared_secret_required: true,
+          });
          return;
        }

        jsonResponse(res, 200, {
          ok: true,
-          shared_secret_required: true,
+          shared_secret_required: Boolean(sharedSecret),
        });
        return;
      }

      if (req.method === "POST" && /^\/api\/gateways\/\d+\/commands$/.test(url.pathname)) {
-        if (!requireSharedSecret(req, res, sharedSecret)) {
+        if (sharedSecret && req.headers["x-edge-broker-secret"] !== sharedSecret) {
+          jsonResponse(res, 403, { error: "Forbidden" });
          return;
        }

@@ -548,7 +521,8 @@ export function createBrokerServer(options = {}) {
      }

      if (req.method === "POST" && /^\/api\/gateways\/\d+\/sync$/.test(url.pathname)) {
-        if (!requireSharedSecret(req, res, sharedSecret)) {
+        if (sharedSecret && req.headers["x-edge-broker-secret"] !== sharedSecret) {
+          jsonResponse(res, 403, { error: "Forbidden" });
          return;
        }

@@ -582,13 +556,12 @@ export function createBrokerServer(options = {}) {
          gatewayInfo = await validateAgent({ gatewayId, token, headers: req.headers });
        } catch (error) {
          const status = Number(error?.status) === 403 ? 403 : Number(error?.status) === 401 ? 401 : 503;
-          rejectUpgrade(socket, status, error?.code || "agent_validation_failed", "Gateway agent could not be validated.", {
+          rejectUpgrade(socket, status, error?.code || "agent_validation_failed", normalizeErrorMessage(error, "Gateway agent could not be validated."), {
            stage: "agent_validate",
          });
          return;
        }

-
        wss.handleUpgrade(req, socket, head, (ws) => {
          const existing = agents.get(gatewayId);
          if (existing && existing.readyState < 2) {
@@ -649,13 +622,12 @@ export function createBrokerServer(options = {}) {
        try {
          session = await validateShellSession({ token, headers: req.headers });
        } catch (error) {
-          rejectUpgrade(socket, Number(error?.status) === 403 ? 403 : 401, error?.code || "shell_session_invalid", "Shell session could not be validated.", {
+          rejectUpgrade(socket, Number(error?.status) === 403 ? 403 : 401, error?.code || "shell_session_invalid", normalizeErrorMessage(error, "Shell session could not be validated."), {
            stage: "shell_session_validate",
          });
          return;
        }

-
        wss.handleUpgrade(req, socket, head, (ws) => {
          ws.sessionToken = token;
          ws.sessionInfo = session;
@@ -750,7 +722,7 @@ export function createBrokerServer(options = {}) {
        return;
      }
    } catch (error) {
-      rejectUpgrade(socket, 500, "websocket_upgrade_failed", "WebSocket upgrade failed.");
+      rejectUpgrade(socket, 500, "websocket_upgrade_failed", normalizeErrorMessage(error, "WebSocket upgrade failed."));
      return;
    }

@@ -793,8 +765,8 @@ export function createBrokerServer(options = {}) {
            let ingestError = null;
            try {
              ingested = await ingestTelemetry(String(ws.gatewayId), payload);
-            } catch {
-              ingestError = TELEMETRY_INGEST_ERROR_MESSAGE;
+            } catch (error) {
+              ingestError = error instanceof Error ? error.message : String(error);
            }
            const fallbackStatistics = {
              system_metrics: payload?.metadata?.system_metrics || {},
@@ -859,11 +831,6 @@ export function createBrokerServer(options = {}) {
            return;
          }

-          if (message.type === "MACHINE_SIGNAL") {
-            await ingestMachineSignal(String(ws.gatewayId), message.payload || {});
-            return;
-          }
-
          if (["SHELL_OUTPUT", "SHELL_OPENED", "SHELL_EXIT"].includes(message.type)) {
            const sessionRecord = browserShellSessions.get(String(message.sessionId));
            if (!sessionRecord) {
@@ -19,18 +19,6 @@ function waitForClose(socket) {
  });
 }

-function waitForCloseOrError(socket) {
-  return new Promise((resolve) => {
-    const onDone = () => {
-      socket.off("error", onDone);
-      socket.off("close", onDone);
-      resolve();
-    };
-    socket.once("error", onDone);
-    socket.once("close", onDone);
-  });
-}
-
 function rawUpgradeRequest(port, path) {
  return new Promise((resolve, reject) => {
    const socket = net.createConnection({ host: "127.0.0.1", port }, () => {
@@ -71,7 +59,7 @@ async function waitFor(predicate, { timeoutMs = 1000, intervalMs = 10, descripti
  throw new Error(`Timed out waiting for ${description}`);
 }

-test("broker defaults to strict auth and fails closed when manager URL is missing", async () => {
+test("broker defaults to manager auth and fails closed when manager URL is missing", async () => {
  const previousEnv = {
    EDGE_AUTH_MODE: process.env.EDGE_AUTH_MODE,
    EDGE_MANAGER_URL: process.env.EDGE_MANAGER_URL,
@@ -84,7 +72,7 @@ test("broker defaults to strict auth and fails closed when manager URL is missin
  let broker;
  try {
    broker = createBrokerServer({ sharedSecret: "secret" });
-    assert.equal(broker.state.authMode, "strict");
+    assert.equal(broker.state.authMode, "manager");
    assert.equal(broker.state.managerUrl, "");

    const address = await broker.listen(0);
@@ -95,15 +83,13 @@ test("broker defaults to strict auth and fails closed when manager URL is missin
    assert.doesNotMatch(shellResponse, /101 Switching Protocols/);
    assert.match(shellResponse, /^HTTP\/1\.1 401 Unauthorized/m);
    assert.match(shellResponse, /"error_code":"shell_session_invalid"/);
-    assert.match(shellResponse, /"message":"Shell session could not be validated\."/);
-    assert.doesNotMatch(shellResponse, /Edge manager URL is not configured/);
+    assert.match(shellResponse, /Edge manager URL is not configured/);

    assert.doesNotMatch(agentResponse, /101 Switching Protocols/);
    assert.match(agentResponse, /^HTTP\/1\.1 503 Service Unavailable/m);
    assert.match(agentResponse, /"error_code":"agent_validation_failed"/);
    assert.match(agentResponse, /"stage":"agent_validate"/);
-    assert.match(agentResponse, /"message":"Gateway agent could not be validated\."/);
-    assert.doesNotMatch(agentResponse, /Edge manager URL is not configured/);
+    assert.match(agentResponse, /Edge manager URL is not configured/);
  } finally {
    if (broker) {
      await broker.close();
@@ -118,53 +104,6 @@ test("broker defaults to strict auth and fails closed when manager URL is missin
  }
 });

-test("broker rejects protected HTTP endpoints when shared secret is missing", async () => {
-  const broker = createBrokerServer({ authMode: "stub", sharedSecret: "", commandTimeoutMs: 2000 });
-  const address = await broker.listen(0);
-  const port = address.port;
-  const agent = new WebSocket(`ws://127.0.0.1:${port}/ws/agent?gatewayId=701&token=agent-token`);
-
-  await new Promise((resolve) => agent.once("open", resolve));
-  const agentMessages = collectMessages(agent);
-
-  const commandResponse = await fetch(`http://127.0.0.1:${port}/api/gateways/701/commands`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-    },
-    body: JSON.stringify({
-      commandType: "SET_RELAY_STATE",
-      payload: { relayId: "M-7", on: true },
-    }),
-  });
-  const commandJson = await commandResponse.json();
-
-  assert.equal(commandResponse.status, 503);
-  assert.equal(commandJson.ok, false);
-  assert.equal(commandJson.shared_secret_required, true);
-  assert.match(commandJson.error, /shared secret is not configured/);
-  assert.equal(agentMessages.some((message) => message.type === "COMMAND"), false);
-
-  const diagnosticsResponse = await fetch(`http://127.0.0.1:${port}/api/diagnostics/shared-secret`, {
-    method: "POST",
-  });
-  const diagnosticsJson = await diagnosticsResponse.json();
-
-  assert.equal(diagnosticsResponse.status, 503);
-  assert.equal(diagnosticsJson.shared_secret_required, true);
-
-  const syncResponse = await fetch(`http://127.0.0.1:${port}/api/gateways/701/sync`, {
-    method: "POST",
-  });
-  const syncJson = await syncResponse.json();
-
-  assert.equal(syncResponse.status, 503);
-  assert.equal(syncJson.shared_secret_required, true);
-
-  agent.terminate();
-  await broker.close();
-});
-
 test("broker dispatches commands to connected agents", async () => {
  const broker = createBrokerServer({ authMode: "stub", sharedSecret: "secret", commandTimeoutMs: 2000 });
  const address = await broker.listen(0);
@@ -399,34 +338,11 @@ test("broker rejects invalid browser shell upgrades without leaking the token",

  assert.match(response, /^HTTP\/1\.1 401 Unauthorized/m);
  assert.match(response, /"error_code":"shell_session_expired"/);
-  assert.match(response, /"message":"Shell session could not be validated\."/);
-  assert.doesNotMatch(response, /Shell session expired/);
  assert.doesNotMatch(response, new RegExp(rawToken));

  await broker.close();
 });

-test("broker rejects websocket upgrade errors without exposing exception text", async () => {
-  const broker = createBrokerServer({
-    authMode: "stub",
-    validateBrowserStream: async () => {
-      throw new Error("UPSTREAM-SENSITIVE: redis://cache.internal:6379 timeout");
-    },
-  });
-  const address = await broker.listen(0);
-  const port = address.port;
-
-  const response = await rawUpgradeRequest(port, "/ws/browser-gateway-stream?token=session-token");
-
-  assert.match(response, /^HTTP\/1\.1 500 Internal Server Error/m);
-  assert.match(response, /"error_code":"websocket_upgrade_failed"/);
-  assert.match(response, /"message":"WebSocket upgrade failed\."/);
-  assert.doesNotMatch(response, /UPSTREAM-SENSITIVE/);
-  assert.doesNotMatch(response, /redis:\/\/cache\.internal/);
-
-  await broker.close();
-});
-
 test("broker closes browser shell sessions when the agent never reports shell opened", async () => {
  const closedSessions = [];
  const broker = createBrokerServer({
@@ -502,17 +418,6 @@ test("broker closes browser shell sessions when the agent disconnects before she
  await broker.close();
 });

-test("broker defaults to strict auth when no validators are configured", async () => {
-  const broker = createBrokerServer();
-  const address = await broker.listen(0);
-  const port = address.port;
-
-  const agent = new WebSocket(`ws://127.0.0.1:${port}/ws/agent?gatewayId=701&token=agent-token`);
-  await waitForCloseOrError(agent);
-
-  await broker.close();
-});
-
 test("broker sends an agent welcome before connection progress and backlog dispatch", async () => {
  const broker = createBrokerServer({
    authMode: "stub",
@@ -766,51 +671,6 @@ test("broker fans out telemetry, task, log, and presence updates to browser gate
  await broker.close();
 });

-test("broker ingests self-serve machine signals from connected agents", async () => {
-  const machineSignals = [];
-  const broker = createBrokerServer({
-    authMode: "stub",
-    validateAgent: async () => ({ id: "701", gateway_id: "701", label: "CPH Edge 01" }),
-    ingestMachineSignal: async (gatewayId, payload) => {
-      machineSignals.push({ gatewayId, payload });
-      return { recorded: true, lane_id: payload.lane_id };
-    },
-  });
-  const address = await broker.listen(0);
-  const port = address.port;
-
-  const agent = new WebSocket(`ws://127.0.0.1:${port}/ws/agent?gatewayId=701&token=agent-token`);
-  await new Promise((resolve) => agent.once("open", resolve));
-
-  agent.send(
-    JSON.stringify({
-      type: "MACHINE_SIGNAL",
-      payload: {
-        lane_id: 3,
-        relay_id: "machine-relay",
-        component: "input",
-        channel: 0,
-        event: "input.toggle_on",
-        state: true,
-      },
-    })
-  );
-
-  await waitFor(() => machineSignals.length === 1, { description: "machine signal ingestion" });
-  assert.equal(machineSignals[0].gatewayId, "701");
-  assert.deepEqual(machineSignals[0].payload, {
-    lane_id: 3,
-    relay_id: "machine-relay",
-    component: "input",
-    channel: 0,
-    event: "input.toggle_on",
-    state: true,
-  });
-
-  agent.terminate();
-  await broker.close();
-});
-
 test("broker survives telemetry ingestion failures for stale gateways", async () => {
  const broker = createBrokerServer({
    authMode: "stub",
@@ -883,16 +743,9 @@ test("broker still fans out telemetry when manager ingestion fails", async () =>
  );

  await waitFor(
-    () =>
-      browserMessages.some(
-        (message) => message.type === "gateway.telemetry" && message.error === "Telemetry ingestion failed"
-      ),
+    () => browserMessages.some((message) => message.type === "gateway.telemetry" && message.error === "manager unavailable"),
    { description: "telemetry fanout after ingest failure" }
  );
-  assert.ok(
-    browserMessages.every((message) => message.error !== "manager unavailable"),
-    "raw manager errors must not be sent to browser streams"
-  );
  assert.ok(
    browserMessages.some(
      (message) => message.type === "stats.updated" && message.statistics?.system_metrics?.cpu_usage_pct === 31
@@ -39,7 +39,7 @@ test("traefik does not expose a dedicated public edge broker port", () => {
 test("base docker compose routes edge broker traffic through traefik", () => {
  const serviceBlock = readComposeServiceBlock(baseComposeSource, "edge-broker");
  assert.doesNotMatch(serviceBlock, /\n\s+ports:\s*\n[\s\S]*?\n\s+- "4300:4300"/);
-  assert.match(serviceBlock, /EDGE_AUTH_MODE:\s*\$\{EDGE_AUTH_MODE:-strict\}/);
+  assert.match(serviceBlock, /EDGE_AUTH_MODE:\s*\$\{EDGE_AUTH_MODE:-manager\}/);
  assert.match(serviceBlock, /EDGE_MANAGER_URL:\s*\$\{EDGE_MANAGER_URL:-http:\/\/caddy\}/);
  assert.match(serviceBlock, /traefik\.http\.routers\.edge-broker-api\.priority=200/);
  assert.match(serviceBlock, /traefik\.http\.routers\.edge-broker-local\.priority=200/);
@@ -55,7 +55,7 @@ test("base docker compose routes edge broker traffic through traefik", () => {
 test("example docker compose routes edge broker traffic through traefik", () => {
  const serviceBlock = readComposeServiceBlock(exampleComposeSource, "edge-broker");
  assert.doesNotMatch(serviceBlock, /\n\s+ports:\s*\n[\s\S]*?\n\s+- "4300:4300"/);
-  assert.match(serviceBlock, /EDGE_AUTH_MODE:\s*\$\{EDGE_AUTH_MODE:-strict\}/);
+  assert.match(serviceBlock, /EDGE_AUTH_MODE:\s*\$\{EDGE_AUTH_MODE:-manager\}/);
  assert.match(serviceBlock, /EDGE_MANAGER_URL:\s*\$\{EDGE_MANAGER_URL:-http:\/\/caddy\}/);
  assert.match(serviceBlock, /traefik\.http\.routers\.edge-broker-api\.rule=Host\(`api\.example\.com`\) && PathPrefix\(`\/edge-broker`\)/);
  assert.match(serviceBlock, /traefik\.http\.routers\.edge-broker-local\.rule=Host\(`localhost`\) && PathPrefix\(`\/api\/edge-broker`\)/);
@@ -76,10 +76,10 @@ test("standalone production compose routes edge broker traffic through traefik",
  assert.match(serviceBlock, /traefik\.http\.services\.edge-broker\.loadbalancer\.server\.port=4300/);
 });

-test("compose config does not provide insecure broker secret defaults", () => {
+test("php services receive broker websocket environment defaults", () => {
  for (const composeSource of [baseComposeSource, exampleComposeSource]) {
    assert.match(composeSource, /EDGE_BROKER_URL:\s*\$\{EDGE_BROKER_URL:-http:\/\/edge-broker:4300\}/);
-    assert.match(composeSource, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:\?set EDGE_BROKER_SHARED_SECRET in \.env\}/);
+    assert.match(composeSource, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev\}/);
  }
 });

@@ -88,6 +88,6 @@ test("base docker compose wires the broker into each php worker", () => {
    const serviceBlock = readComposeServiceBlock(baseComposeSource, serviceName);
    assert.match(serviceBlock, /\n\s+depends_on:\s*\n[\s\S]*?\n\s+- edge-broker/);
    assert.match(serviceBlock, /EDGE_BROKER_URL:\s*\$\{EDGE_BROKER_URL:-http:\/\/edge-broker:4300\}/);
-    assert.match(serviceBlock, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:\?set EDGE_BROKER_SHARED_SECRET in \.env\}/);
+    assert.match(serviceBlock, /EDGE_BROKER_SHARED_SECRET:\s*\$\{EDGE_BROKER_SHARED_SECRET:-truckwash-edge-dev\}/);
  }
 });
@@ -133,14 +133,8 @@ class attachments implements attachments_i
    protected function fetchAttachmentRows(string $type, array $object_ids, array $options = []): array
    {
        $options = $this->normalizeAttachmentOptions($options);
-        $rawType = trim($type, '`');
-        $objectTypes = array_values(array_unique([
-            $rawType,
-            '`' . $rawType . '`',
-        ]));
-
        return (new object_attachments_o())->getFieldsWhereIn([
-            'object_type' => $objectTypes,
+            'object_type' => $type,
            'object_id' => $object_ids,
            'deleted_at' => null
        ], $options);
@@ -6,7 +6,6 @@ use classes\totp;
 use Exception;
 use interfaces\authentication_i;
 use objects\plate_scanners_o;
-use objects\subuser_grants_o;
 use objects\tokens_o;
 use objects\users_o;
 use objects\subusers_o;
@@ -126,13 +125,9 @@ class authentication implements authentication_i
    public function validate_token(string $token): bool
    {
        // First: try validating as a classic user auth token
-        try {
-            $dbToken = (new tokens_o())->getToken($token);
-            if ($dbToken && $dbToken->id && $dbToken->type->value() === 'AUTH_TOKEN') {
-                return true;
-            }
-        } catch (Exception) {
-            // Ignore and continue to subuser session validation
+        $dbToken = (new tokens_o())->getToken($token);
+        if ($dbToken && $dbToken->id) {
+            return true;
        }
        // Fallback: try validating as a subuser session token
        $subuser = (new subusers_o())->getSubuserBySessionToken($token);
@@ -159,17 +154,19 @@ class authentication implements authentication_i
        // Strip the Bearer prefix
        $rawToken = str_replace('Bearer ', '', $rawToken);
        // Get the token from the database
-        try {
-            $token = (new tokens_o())->getToken($rawToken);
-        } catch (Exception) {
-            return false;
-        }
+        $token = (new tokens_o())->getToken($rawToken);
        // Check if the token exists
        if (!$token->id) {
            return false;
        }
-        if ($token->type->value() !== 'AUTH_TOKEN') {
-            return false;
+        if ($token->type->value() === "AUTH_TOKEN_SUBUSER") {
+            // Get the customer number from the headers
+            if (!isset($headers['X-Customer-Number'])) {
+                return false;
+            }
+            $customer_number = (int)$headers['X-Customer-Number'];
+            // Get the user by the customer number
+            return (new users_o())->getUserByCustomerNumber($customer_number);
        }
        // Get the user from the database
        $user = (new users_o())->getUserById($token->user_id->value());
@@ -121,16 +121,6 @@ class coolify_api_client
        ]);
    }

-    public function listApplicationEnvs(string $uuid): array
-    {
-        return $this->request('GET', '/applications/' . rawurlencode($uuid) . '/envs');
-    }
-
-    public function deleteApplicationEnv(string $uuid, string $envUuid): array
-    {
-        return $this->request('DELETE', '/applications/' . rawurlencode($uuid) . '/envs/' . rawurlencode($envUuid));
-    }
-
    private static function bulkEnvData(array $env): array
    {
        $data = [];
@@ -169,11 +159,6 @@ class coolify_api_client
        return $this->request('GET', '/applications/' . rawurlencode($uuid) . '/restart');
    }

-    public function stopApplication(string $uuid): array
-    {
-        return $this->request('GET', '/applications/' . rawurlencode($uuid) . '/stop');
-    }
-
    public function deleteService(string $uuid): array
    {
        return $this->request('DELETE', '/services/' . rawurlencode($uuid));
@@ -1371,129 +1371,6 @@ class coolify_manager
        ];
    }

-    public function deployGithubRunners(array $input, ?int $actorUserId = null): array
-    {
-        $this->ensureSchema();
-
-        $dryRun = $this->toBool($input['dry_run'] ?? null, false);
-        $instanceId = (int)($input['instance_id'] ?? 0);
-        if ($instanceId <= 0) {
-            $instanceId = $this->defaultInstanceId();
-        }
-        $instance = $this->getInstance($instanceId);
-        $repositories = $this->githubRunnerRepositories($input);
-        $labels = $this->githubRunnerLabels($input['labels'] ?? null);
-        $countPerRepo = $this->githubRunnerCount($input['count_per_repo'] ?? $input['runner_count_per_repo'] ?? null);
-        $serviceName = $this->githubRunnerServiceName($input['service_name'] ?? null);
-        $resourceUuid = $this->nullableString($input['service_uuid'] ?? null)
-            ?? $this->nullableString($this->coolifyConfigValue('github_runner_service_uuid', ''));
-        $token = $this->githubRunnerToken($input);
-        $template = $this->githubRunnerComposeTemplate($repositories, $labels, $countPerRepo);
-        $hash = $this->composeHash($template);
-
-        $plan = [
-            'type' => 'deploy_github_runners',
-            'instance_id' => $instanceId,
-            'service_uuid' => $resourceUuid,
-            'service_name' => $serviceName,
-            'repositories' => $repositories,
-            'labels' => $labels,
-            'count_per_repo' => $countPerRepo,
-            'compose_hash' => $hash,
-            'action' => $resourceUuid === null ? 'create' : 'update',
-            'token_set' => $token !== '',
-            'token_source' => trim((string)($input['github_token'] ?? $input['token'] ?? '')) !== '' ? 'request' : 'config',
-        ];
-
-        if ($dryRun) {
-            $this->audit(null, $instanceId, null, 'github_runners_planned', $actorUserId, 'info', $plan);
-            return [
-                'ok' => true,
-                'dry_run' => true,
-                'mutated' => false,
-                'planned' => [$plan],
-                'applied' => [],
-                'errors' => [],
-                'service_uuid' => $resourceUuid,
-                'service_name' => $serviceName,
-                'compose_hash' => $hash,
-                'repositories' => $repositories,
-                'labels' => $labels,
-                'count_per_repo' => $countPerRepo,
-            ];
-        }
-
-        if ($token === '') {
-            throw new RuntimeException('GitHub runner token is required to deploy self-hosted runners.');
-        }
-
-        $client = $this->clientForInstance($instance);
-        $apiResult = [];
-        $action = $resourceUuid === null ? 'created' : 'updated';
-        if ($resourceUuid === null) {
-            $apiResult = $client->createService($this->githubRunnerServicePayload($instance, $input, $serviceName, $template, false));
-            $resourceUuid = trim((string)($apiResult['uuid'] ?? ''));
-            if ($resourceUuid === '') {
-                throw new RuntimeException('Coolify did not return a GitHub runner service UUID.');
-            }
-        } else {
-            try {
-                $apiResult = $client->updateService($resourceUuid, $this->githubRunnerServicePayload($instance, $input, $serviceName, $template, true));
-            } catch (Throwable $throwable) {
-                if (!str_contains(strtolower($throwable->getMessage()), '404')
-                    && !str_contains(strtolower($throwable->getMessage()), 'not found')) {
-                    throw $throwable;
-                }
-                $apiResult = $client->createService($this->githubRunnerServicePayload($instance, $input, $serviceName, $template, false));
-                $resourceUuid = trim((string)($apiResult['uuid'] ?? ''));
-                if ($resourceUuid === '') {
-                    throw new RuntimeException('Coolify did not return a GitHub runner service UUID.');
-                }
-                $action = 'created';
-            }
-        }
-
-        $client->updateServiceEnvsBulk($resourceUuid, ['GITHUB_RUNNER_TOKEN' => $token]);
-        $start = $this->startOrRestartService($client, $resourceUuid, $action === 'updated');
-        $deployment = $client->deployResource($resourceUuid, false);
-
-        $this->setModuleConfigValue('Coolify', 'github_runner_service_uuid', $resourceUuid, 'string');
-        $this->setModuleConfigValue('Coolify', 'github_runner_frontend_repository', $repositories['frontend'], 'string');
-        $this->setModuleConfigValue('Coolify', 'github_runner_backend_repository', $repositories['backend'], 'string');
-        $this->setModuleConfigValue('Coolify', 'github_runner_labels', implode(',', $labels), 'string');
-        $this->setModuleConfigValue('Coolify', 'github_runner_count_per_repo', (string)$countPerRepo, 'int');
-        if ($this->toBool($input['persist_token'] ?? null, false)) {
-            $this->setModuleConfigValue('Coolify', 'github_runner_token', replication_secret_box::encrypt($token), 'string');
-        }
-
-        $applied = array_replace($plan, [
-            'action' => $action,
-            'service_uuid' => $resourceUuid,
-            'coolify' => self::redactCoolifyResponse($apiResult),
-            'start' => self::redactCoolifyResponse(is_array($start) ? $start : []),
-            'deployment' => self::redactCoolifyResponse($deployment),
-        ]);
-
-        $this->audit(null, $instanceId, null, 'github_runners_deployed', $actorUserId, 'info', $applied);
-
-        return [
-            'ok' => true,
-            'dry_run' => false,
-            'mutated' => true,
-            'planned' => [$plan],
-            'applied' => [$applied],
-            'errors' => [],
-            'action' => $action,
-            'service_uuid' => $resourceUuid,
-            'service_name' => $serviceName,
-            'compose_hash' => $hash,
-            'repositories' => $repositories,
-            'labels' => $labels,
-            'count_per_repo' => $countPerRepo,
-            'deployment' => self::redactCoolifyResponse($deployment),
-        ];
-    }
-
    private function gatewayApiCodeVersionLabel(array $target): string
    {
        $channelSlug = trim((string)($target['channel_slug'] ?? 'gateway'));
@@ -2049,14 +1926,13 @@ class coolify_manager
                    ], $actorUserId);
                }

-                $sourceCommitSha = trim((string)($sourceTarget['latest_deployment_commit_sha'] ?? ''));
-                $deploymentInput = [
+                $deployment = $releaseManager->startDeployment([
                    'target_id' => (int)($deploymentTarget['id'] ?? 0),
                    'channel_id' => (int)$sourceTarget['channel_id'],
                    'app' => $app,
                    'repository' => (string)($sourceTarget['repository'] ?? ''),
                    'branch' => (string)($sourceTarget['branch'] ?? 'master'),
-                    'commit_mode' => $sourceCommitSha === '' ? 'latest' : 'specific',
+                    'commit_mode' => 'latest',
                    'version_label' => $this->gatewayRouteProvisionVersionLabel($sourceTarget),
                    'deployed_url' => $sourcePublicUrl,
                    'metadata' => [
@@ -2066,11 +1942,7 @@ class coolify_manager
                        'server_uuid' => $serverUuid,
                        'app' => $app,
                    ],
-                ];
-                if ($sourceCommitSha !== '') {
-                    $deploymentInput['commit_sha'] = $sourceCommitSha;
-                }
-                $deployment = $releaseManager->startDeployment($deploymentInput, $actorUserId);
+                ], $actorUserId);

                if ((string)($deployment['status'] ?? '') !== 'deployed') {
                    $errors[] = array_replace($action, [
@@ -3389,141 +3261,6 @@ class coolify_manager
        ];
    }

-    private function githubRunnerRepositories(array $input): array
-    {
-        return [
-            'frontend' => $this->normalizeGithubRepository(
-                $input['frontend_repository'] ?? $input['frontend_repo'] ?? $this->coolifyConfigValue('github_runner_frontend_repository', 'copenhagentruckwash/pleno-vue'),
-                'frontend'
-            ),
-            'backend' => $this->normalizeGithubRepository(
-                $input['backend_repository'] ?? $input['backend_repo'] ?? $this->coolifyConfigValue('github_runner_backend_repository', 'copenhagentruckwash/api'),
-                'backend'
-            ),
-        ];
-    }
-
-    private function normalizeGithubRepository(mixed $value, string $label): string
-    {
-        $repository = trim((string)$value);
-        $repository = preg_replace('#^https://github\.com/#i', '', $repository) ?? $repository;
-        $repository = preg_replace('#^git@github\.com:#i', '', $repository) ?? $repository;
-        $repository = preg_replace('#\.git$#i', '', $repository) ?? $repository;
-        $repository = trim($repository, " \t\n\r\0\x0B/");
-        if (!preg_match('#^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$#', $repository)) {
-            throw new RuntimeException('GitHub ' . $label . ' repository must be in owner/repo format.');
-        }
-        return $repository;
-    }
-
-    private function githubRunnerLabels(mixed $value): array
-    {
-        $raw = trim((string)($value ?? ''));
-        if ($raw === '') {
-            $raw = $this->coolifyConfigValue('github_runner_labels', 'self-hosted,Linux,X64,default');
-        }
-
-        $labels = array_values(array_unique(array_filter(array_map(
-            static fn(string $label): string => trim($label),
-            preg_split('/[,\s]+/', $raw) ?: []
-        ))));
-
-        return $labels !== [] ? $labels : ['self-hosted', 'Linux', 'X64', 'default'];
-    }
-
-    private function githubRunnerCount(mixed $value): int
-    {
-        $count = (int)($value ?? 0);
-        if ($count <= 0) {
-            $count = (int)$this->coolifyConfigValue('github_runner_count_per_repo', '1');
-        }
-        return max(1, min(10, $count));
-    }
-
-    private function githubRunnerServiceName(mixed $value): string
-    {
-        $name = strtolower(trim((string)($value ?? 'truckwash-github-runners')));
-        $name = preg_replace('/[^a-z0-9-]+/', '-', $name) ?: '';
-        $name = trim($name, '-') ?: 'truckwash-github-runners';
-        return substr($name, 0, 120);
-    }
-
-    private function githubRunnerToken(array $input): string
-    {
-        $token = trim((string)($input['github_token'] ?? $input['token'] ?? ''));
-        if ($token !== '') {
-            return $token;
-        }
-
-        $envToken = trim((string)(getenv('GITHUB_RUNNER_TOKEN') ?: getenv('GITHUB_TOKEN') ?: ''));
-        if ($envToken !== '') {
-            return $envToken;
-        }
-
-        return replication_secret_box::decrypt($this->coolifyConfigValue('github_runner_token', ''));
-    }
-
-    private function githubRunnerComposeTemplate(array $repositories, array $labels, int $countPerRepo): array
-    {
-        $lines = ['services:'];
-        foreach ($repositories as $key => $repository) {
-            for ($index = 1; $index <= $countPerRepo; $index++) {
-                $service = 'github-runner-' . $key . '-' . $index;
-                $runnerName = 'truckwash-' . $key . '-' . $index;
-                $runnerLabels = array_values(array_unique(array_merge($labels, [$key])));
-                $lines = array_merge($lines, [
-                    '  ' . $service . ':',
-                    '    image: myoung34/github-runner:latest',
-                    '    restart: unless-stopped',
-                    '    environment:',
-                    '      REPO_URL: ' . self::yamlScalar('https://github.com/' . $repository),
-                    '      RUNNER_NAME: ' . self::yamlScalar($runnerName),
-                    '      RUNNER_SCOPE: repo',
-                    '      RUNNER_WORKDIR: /tmp/runner/work',
-                    '      LABELS: ' . self::yamlScalar(implode(',', $runnerLabels)),
-                    '      EPHEMERAL: "false"',
-                    '      RUN_AS_ROOT: "true"',
-                    '      ACCESS_TOKEN: ${GITHUB_RUNNER_TOKEN}',
-                    '    volumes:',
-                    '      - /var/run/docker.sock:/var/run/docker.sock',
-                ]);
-            }
-        }
-
-        return [
-            'compose' => implode("\n", $lines) . "\n",
-            'env' => 'GITHUB_RUNNER_TOKEN=${GITHUB_RUNNER_TOKEN}',
-        ];
-    }
-
-    private function githubRunnerServicePayload(array $instance, array $input, string $serviceName, array $template, bool $update): array
-    {
-        $payload = [
-            'name' => $serviceName,
-            'description' => 'Truckwash GitHub self-hosted runners for frontend and backend workflows.',
-            'instant_deploy' => false,
-            'docker_compose_raw' => $this->encodedDockerCompose($template),
-            'force_domain_override' => false,
-        ];
-
-        if (!$update) {
-            $payload = array_replace($payload, [
-                'project_uuid' => $this->targetMapping($input, $instance, 'project_uuid'),
-                'environment_name' => $this->targetMapping($input, $instance, 'environment_name') ?: 'production',
-                'environment_uuid' => $this->targetMapping($input, $instance, 'environment_uuid'),
-                'server_uuid' => $this->targetMapping($input, $instance, 'server_uuid'),
-                'destination_uuid' => $this->targetMapping($input, $instance, 'destination_uuid'),
-            ]);
-        }
-
-        return array_filter($payload, static fn($value): bool => $value !== null && $value !== '');
-    }
-
-    private static function yamlScalar(string $value): string
-    {
-        return '"' . str_replace(['\\', '"'], ['\\\\', '\\"'], $value) . '"';
-    }
-
    private function publicLoadBalancerConfig(array $config): array
    {
        unset($config['token']);
@@ -154,12 +154,6 @@ class coolify_schema_bootstrap
        self::ensureModuleConfigDefault('Coolify', 'hetzner_cloud_api_token', '', 'string');
        self::ensureModuleConfigDefault('Coolify', 'public_gateway_host', 'api-v2.truckwash.io', 'string');
        self::ensureModuleConfigDefault('Coolify', 'public_gateway_probe_path', '', 'string');
-        self::ensureModuleConfigDefault('Coolify', 'github_runner_token', '', 'string');
-        self::ensureModuleConfigDefault('Coolify', 'github_runner_service_uuid', '', 'string');
-        self::ensureModuleConfigDefault('Coolify', 'github_runner_frontend_repository', 'copenhagentruckwash/pleno-vue', 'string');
-        self::ensureModuleConfigDefault('Coolify', 'github_runner_backend_repository', 'copenhagentruckwash/api', 'string');
-        self::ensureModuleConfigDefault('Coolify', 'github_runner_labels', 'self-hosted,Linux,X64,default', 'string');
-        self::ensureModuleConfigDefault('Coolify', 'github_runner_count_per_repo', '1', 'int');

        self::ensureDefaultGateway('node1.truckwash.io', '94.130.142.41', 10);
        self::ensureDefaultGateway('node2.truckwash.io', '65.21.214.30', 20);
@@ -6,7 +6,6 @@ class cors_policy
 {
    public const ALLOWED_HEADERS = 'Content-Type, Authorization, X-Customer-Number, X-Release-Trace, X-Release-Channel, X-Frontend-Version, Cache-Control, Pragma, *';
    public const ALLOWED_METHODS = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
-    public const EXPOSED_HEADERS = 'Server-Timing';
    public const MAX_AGE_SECONDS = '86400';

    private const REQUIRED_ALLOWED_ORIGINS = [
@@ -26,9 +25,6 @@ class cors_policy
        'https://localhost:4433',
        'https://twdev.jeppeb.dk',
        'http://localhost:5173',
-        'http://localhost:5174',
-        'http://127.0.0.1:5173',
-        'http://127.0.0.1:5174',
    ];

    public static function normalizeOrigin(?string $value): string
@@ -129,9 +125,7 @@ class cors_policy
            'Access-Control-Allow-Credentials' => 'true',
            'Access-Control-Allow-Headers' => self::ALLOWED_HEADERS,
            'Access-Control-Allow-Methods' => self::ALLOWED_METHODS,
-            'Access-Control-Expose-Headers' => self::EXPOSED_HEADERS,
            'Access-Control-Max-Age' => self::MAX_AGE_SECONDS,
-            'Timing-Allow-Origin' => $origin,
            'Vary' => 'Origin',
        ];
    }
@@ -137,10 +137,6 @@ class customer_mass_import_service
        if ($cvrLength < 8 || $cvrLength > 20) {
            throw new \RuntimeException('CVR must be between 8 and 20 digits.', 400);
        }
-
-        if ($normalized['ean'] !== null && strlen((string)$normalized['ean']) > 13) {
-            throw new \RuntimeException('EAN must be at most 13 digits.', 400);
-        }
    }

    protected function normalizePositiveInt(mixed $value): ?int
@@ -1,98 +0,0 @@
-<?php
-
-namespace classes;
-
-use RuntimeException;
-
-class customer_order_product_policy
-{
-    public const ONLY_TANKCLEANING_ATTRIBUTE = 'onlyTankCleaning';
-    public const ONLY_TANKCLEANING_MESSAGE = 'Only tankcleaning customers can only have tankcleaning products in their orders.';
-
-    public static function assertOrderAllowsProduct(int $orderId, int $productId): void
-    {
-        $message = self::orderProductViolationMessage($orderId, $productId);
-        if ($message !== null) {
-            throw new RuntimeException($message);
-        }
-    }
-
-    public static function orderProductViolationMessage(int $orderId, int $productId): ?string
-    {
-        $context = self::loadOrderProductContext($orderId, $productId);
-        if ($context === null) {
-            return null;
-        }
-        if ((int)($context['product_id'] ?? 0) < 1) {
-            return null;
-        }
-
-        return self::onlyTankCleaningViolation((bool)((int)($context['has_only_tank_cleaning'] ?? 0)), $context)
-            ? self::ONLY_TANKCLEANING_MESSAGE
-            : null;
-    }
-
-    public static function onlyTankCleaningViolation(bool $customerHasOnlyTankCleaning, array $productRow): bool
-    {
-        return $customerHasOnlyTankCleaning && !self::isTankCleaningProductRow($productRow);
-    }
-
-    public static function isTankCleaningProductRow(array $row): bool
-    {
-        return (int)($row['product_category'] ?? $row['category'] ?? 0) === 5
-            || self::rowMatchesProductTerms($row, ['tank cleaning', 'tankcleaning', 'tankrens']);
-    }
-
-    private static function loadOrderProductContext(int $orderId, int $productId): ?array
-    {
-        global $db;
-
-        if ($orderId < 1 || $productId < 1) {
-            return null;
-        }
-
-        $sql = "
-            SELECT
-                o.id AS order_id,
-                o.customer_id AS customer_number,
-                p.id AS product_id,
-                p.name AS product_name,
-                p.category AS product_category,
-                c.name AS category_name,
-                MAX(CASE WHEN ca.attribute = '" . self::ONLY_TANKCLEANING_ATTRIBUTE . "' THEN 1 ELSE 0 END) AS has_only_tank_cleaning
-            FROM orders o
-            LEFT JOIN products p ON p.id = {$productId}
-            LEFT JOIN categories c ON c.id = p.category
-            LEFT JOIN users u ON u.customer_number = o.customer_id
-            LEFT JOIN customer_attributes ca ON ca.user_id = u.id
-                AND ca.attribute = '" . self::ONLY_TANKCLEANING_ATTRIBUTE . "'
-            WHERE o.id = {$orderId}
-            GROUP BY o.id, o.customer_id, p.id, p.name, p.category, c.name
-            LIMIT 1
-        ";
-
-        $result = $db->query($sql);
-        if (!$result || $result->num_rows < 1) {
-            return null;
-        }
-
-        $row = $result->fetch_assoc();
-        return is_array($row) ? $row : null;
-    }
-
-    private static function rowMatchesProductTerms(array $row, array $terms): bool
-    {
-        $haystack = strtolower(trim(
-            (string)($row['product_name'] ?? $row['name'] ?? '') . ' ' .
-            (string)($row['category_name'] ?? '')
-        ));
-
-        foreach ($terms as $term) {
-            if ($term !== '' && str_contains($haystack, strtolower($term))) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-}
@@ -1,168 +0,0 @@
-<?php
-
-namespace classes;
-
-use objects\orders_o;
-use objects\products_o;
-use objects\users_o;
-
-class customer_product_rule_service
-{
-    public const BLOCK_MESSAGE = 'This product is not allowed for the selected customer';
-
-    private const ADDON_CATEGORY_ID = 4;
-    private const TANK_CLEANING_CATEGORY_ID = 5;
-    private const SPOT_FREE_PRODUCT_IDS = [23, 24];
-
-    /**
-     * @return array{rule:string,message:string}|null
-     */
-    public function firstViolationForOrderItem(int $orderId, int $productId, ?int $relatedItemId): ?array
-    {
-        $order = (new orders_o())->getOrderById($orderId);
-        if (!$order->exists()) {
-            return null;
-        }
-
-        $product = (new products_o())->getProductById($productId);
-        if (!$product->exists()) {
-            return null;
-        }
-
-        $customer = (new users_o())->getUserByCustomerNumber((int)$order->customer_id->value());
-        if (!$customer->exists()) {
-            return null;
-        }
-
-        $categoryId = (int)$product->category->value();
-        $categoryName = $this->categoryName($categoryId);
-        $searchableProduct = $this->searchableProductText($product, $categoryName);
-        $isTankCleaningProduct = $this->isTankCleaningProduct($categoryId, $searchableProduct);
-
-        if ($customer->doesUserHaveAttribute('restrictAdditionalServices')
-            && $this->isAdditionalServiceProduct($orderId, $relatedItemId, $categoryId, $searchableProduct)) {
-            return $this->violation('restrictAdditionalServices');
-        }
-
-        if ($customer->doesUserHaveAttribute('restrictTankCleaning') && $isTankCleaningProduct) {
-            return $this->violation('restrictTankCleaning');
-        }
-
-        if ($customer->doesUserHaveAttribute('onlyTankCleaning') && !$isTankCleaningProduct) {
-            return $this->violation('onlyTankCleaning');
-        }
-
-        if ($customer->doesUserHaveAttribute('restrictSpotFree')
-            && $this->isSpotFreeProduct((int)$product->id, $searchableProduct)) {
-            return $this->violation('restrictSpotFree');
-        }
-
-        if ($customer->doesUserHaveAttribute('restrictInteriorCleaning')
-            && $this->containsAny($searchableProduct, ['interior', 'indvendig'])) {
-            return $this->violation('restrictInteriorCleaning');
-        }
-
-        return null;
-    }
-
-    /**
-     * @return array{rule:string,message:string}
-     */
-    private function violation(string $rule): array
-    {
-        return [
-            'rule' => $rule,
-            'message' => self::BLOCK_MESSAGE,
-        ];
-    }
-
-    private function isAdditionalServiceProduct(int $orderId, ?int $relatedItemId, int $categoryId, string $searchableProduct): bool
-    {
-        if ($relatedItemId !== null && $relatedItemId > 0) {
-            return true;
-        }
-
-        if ($categoryId === self::ADDON_CATEGORY_ID) {
-            return true;
-        }
-
-        if ($this->containsAny($searchableProduct, ['add-on', 'add on', 'addon', 'tilvalg'])) {
-            return true;
-        }
-
-        return $this->countStandaloneOrderItems($orderId) > 0;
-    }
-
-    private function isTankCleaningProduct(int $categoryId, string $searchableProduct): bool
-    {
-        if ($categoryId === self::TANK_CLEANING_CATEGORY_ID) {
-            return true;
-        }
-
-        return $this->containsAny($searchableProduct, ['tank cleaning', 'tankcleaning', 'tankrens', 'tank rens']);
-    }
-
-    private function isSpotFreeProduct(int $productId, string $searchableProduct): bool
-    {
-        if (in_array($productId, self::SPOT_FREE_PRODUCT_IDS, true)) {
-            return true;
-        }
-
-        return $this->containsAny($searchableProduct, ['spot free', 'spotfree', 'skylning med ro']);
-    }
-
-    private function searchableProductText(products_o $product, string $categoryName): string
-    {
-        return strtolower(trim((string)$product->name->value() . ' ' . $categoryName));
-    }
-
-    /**
-     * @param array<int, string> $terms
-     */
-    private function containsAny(string $value, array $terms): bool
-    {
-        foreach ($terms as $term) {
-            if ($term !== '' && str_contains($value, $term)) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-
-    private function categoryName(int $categoryId): string
-    {
-        global $db;
-
-        if ($categoryId <= 0) {
-            return '';
-        }
-
-        $result = $db->query('SELECT name FROM categories WHERE id = ' . $categoryId . ' LIMIT 1');
-        if (!$result || $result->num_rows === 0) {
-            return '';
-        }
-
-        $row = $result->fetch_assoc();
-        return strtolower((string)($row['name'] ?? ''));
-    }
-
-    private function countStandaloneOrderItems(int $orderId): int
-    {
-        global $db;
-
-        $result = $db->query(
-            'SELECT COUNT(*) AS item_count
-             FROM order_items
-             WHERE order_id = ' . $orderId . '
-               AND deleted_at IS NULL
-               AND (related_item_id IS NULL OR related_item_id = 0)'
-        );
-        if (!$result) {
-            return 0;
-        }
-
-        $row = $result->fetch_assoc();
-        return (int)($row['item_count'] ?? 0);
-    }
-}
@@ -1,44 +0,0 @@
-<?php
-
-namespace classes;
-
-/**
- * Ensures additive schema for department-scoped customer price overrides.
- */
-class department_customer_price_overrides_schema_bootstrap
-{
-    private static bool $initialized = false;
-
-    public static function ensureTables(): void
-    {
-        if (self::$initialized) {
-            return;
-        }
-
-        global $db;
-
-        if (!isset($db) || !is_object($db) || !method_exists($db, 'query')) {
-            return;
-        }
-
-        $db->query(
-            "CREATE TABLE IF NOT EXISTS `department_customer_price_overrides` (
-                `id` INT UNSIGNED NOT NULL AUTO_INCREMENT,
-                `department_id` INT NOT NULL,
-                `user_id` INT NOT NULL,
-                `is_category` TINYINT(1) NOT NULL DEFAULT 0,
-                `product_or_category_id` VARCHAR(191) NOT NULL,
-                `percentage` INT NOT NULL DEFAULT 0,
-                `fixed_price` INT NULL DEFAULT NULL,
-                `created_at` DATETIME NULL DEFAULT CURRENT_TIMESTAMP,
-                `updated_at` DATETIME NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-                PRIMARY KEY (`id`),
-                UNIQUE KEY `uniq_department_customer_price_overrides_lookup` (`department_id`, `user_id`, `is_category`, `product_or_category_id`),
-                KEY `idx_department_customer_price_overrides_department` (`department_id`),
-                KEY `idx_department_customer_price_overrides_user` (`user_id`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci"
-        );
-
-        self::$initialized = true;
-    }
-}
@@ -1,353 +0,0 @@
-<?php
-
-namespace classes;
-
-use objects\department_customer_price_overrides_o;
-use objects\departments_o;
-use objects\products_o;
-use objects\users_o;
-
-class department_customer_pricing_service
-{
-    /**
-     * @return array<string, mixed>
-     */
-    public function getPricing(int $departmentId, int $userId): array
-    {
-        $department = $this->department($departmentId);
-        $customer = $this->customer($userId);
-        $this->assertEnabled($department);
-
-        $overrides = (new department_customer_price_overrides_o())->getAllPrices($departmentId, $userId);
-
-        return [
-            'department' => $department,
-            'customer' => $customer,
-            'overrides' => $overrides,
-            'categories' => $this->catalog($departmentId, $customer['id']),
-        ];
-    }
-
-    /**
-     * @param array<string, mixed> $payload
-     * @return array<string, mixed>
-     */
-    public function updatePricing(int $departmentId, int $userId, array $payload): array
-    {
-        $department = $this->department($departmentId);
-        $customer = $this->customer($userId);
-        $this->assertEnabled($department);
-
-        if (array_key_exists('department_id', $payload) && (int)$payload['department_id'] !== $departmentId) {
-            throw new limited_backoffice_exception('Department ID in body does not match the route.', 400);
-        }
-        if (array_key_exists('user_id', $payload) && (int)$payload['user_id'] !== $userId) {
-            throw new limited_backoffice_exception('User ID in body does not match the route.', 400);
-        }
-
-        $overrides = $payload['overrides'] ?? null;
-        if (!is_array($overrides)) {
-            throw new limited_backoffice_exception('Overrides are required.', 400);
-        }
-
-        $normalized = $this->normalizeOverrides($departmentId, $overrides);
-        $overrideObject = new department_customer_price_overrides_o();
-        $existingOverrides = $overrideObject->getAllPrices($departmentId, $customer['id']);
-        $normalizedKeys = [];
-        foreach ($normalized as $override) {
-            $normalizedKeys[$this->overrideKey((bool)$override['is_category'], $override['product_or_category_id'])] = true;
-        }
-
-        global $db;
-        $db->conn()->begin_transaction();
-        try {
-            $db->query(
-                'DELETE FROM `department_customer_price_overrides` WHERE `department_id` = '
-                . (int)$departmentId . ' AND `user_id` = ' . (int)$customer['id']
-            );
-
-            foreach ($normalized as $override) {
-                $overrideObject->setPrice(
-                    $departmentId,
-                    $customer['id'],
-                    (bool)$override['is_category'],
-                    $override['product_or_category_id'],
-                    (int)$override['percentage'],
-                    $override['fixed_price']
-                );
-            }
-
-            $db->conn()->commit();
-        } catch (\Throwable) {
-            $db->conn()->rollback();
-            throw new limited_backoffice_exception('Unable to update department customer pricing.', 500);
-        }
-
-        foreach ($normalized as $override) {
-            $this->recordVersion($customer, $departmentId, $override);
-        }
-
-        foreach ($existingOverrides as $existingOverride) {
-            $key = $this->overrideKey((bool)$existingOverride['is_category'], $existingOverride['product_or_category_id']);
-            if (isset($normalizedKeys[$key])) {
-                continue;
-            }
-
-            $this->recordVersion($customer, $departmentId, [
-                'is_category' => (bool)$existingOverride['is_category'],
-                'product_or_category_id' => $existingOverride['product_or_category_id'],
-                'percentage' => 0,
-                'fixed_price' => null,
-            ]);
-        }
-
-        return $this->getPricing($departmentId, $customer['id']);
-    }
-
-    /**
-     * @return array{id:int,name:string,description:string,custom_pricing_only:bool}
-     */
-    private function department(int $departmentId): array
-    {
-        $department = (new departments_o())->getDepartmentById($departmentId);
-        if (!is_array($department) || empty($department)) {
-            throw new limited_backoffice_exception('Department not found', 404);
-        }
-
-        return [
-            'id' => (int)$department['id'],
-            'name' => (string)$department['name'],
-            'description' => (string)($department['description'] ?? ''),
-            'custom_pricing_only' => (bool)(int)($department['custom_pricing_only'] ?? 0),
-        ];
-    }
-
-    /**
-     * @return array{id:int,customer_number:int,display_name:string}
-     */
-    private function customer(int $userId): array
-    {
-        $customer = (new users_o())->getUserById($userId);
-        if (!$customer->exists()) {
-            throw new limited_backoffice_exception('Customer not found', 404);
-        }
-
-        return [
-            'id' => (int)$customer->id,
-            'customer_number' => (int)$customer->customer_number->value(),
-            'display_name' => (string)($customer->display_name->value() ?: ('Customer #' . $customer->customer_number->value())),
-        ];
-    }
-
-    /**
-     * @param array<string, mixed> $department
-     */
-    private function assertEnabled(array $department): void
-    {
-        if (!($department['custom_pricing_only'] ?? false)) {
-            throw new limited_backoffice_exception('Department customer pricing is disabled.', 409, [
-                'message' => 'Department customer pricing is disabled.',
-                'code' => 'department_customer_pricing_disabled',
-                'department' => $department,
-            ]);
-        }
-    }
-
-    /**
-     * @return array<int, array<string, mixed>>
-     */
-    private function catalog(int $departmentId, int $userId): array
-    {
-        global $db;
-
-        $sql = "
-            SELECT
-                c.`id` AS `category_id`,
-                c.`name` AS `category_name`,
-                c.`description` AS `category_description`,
-                p.*,
-                pdp.`price` AS `department_price`
-            FROM `department_categories` dc
-            INNER JOIN `categories` c ON c.`id` = dc.`category_id`
-            INNER JOIN `products` p ON p.`category` = dc.`category_id`
-            LEFT JOIN `product_department_prices` pdp
-                ON pdp.`department_id` = dc.`department_id`
-               AND pdp.`product_id` = p.`id`
-            WHERE dc.`department_id` = " . (int)$departmentId . "
-              AND dc.`deleted_at` IS NULL
-            ORDER BY c.`name` ASC, c.`id` ASC, p.`order_priority` ASC, p.`name` ASC, p.`id` ASC";
-
-        $result = $db->query($sql);
-        $rows = $result ? $db->fetch_all($result) : [];
-        $customer = (new users_o())->getUserById($userId);
-        $categories = [];
-        $seen = [];
-
-        foreach ($rows as $row) {
-            $productId = (int)$row['id'];
-            if (isset($seen[$productId])) {
-                continue;
-            }
-            $seen[$productId] = true;
-
-            $categoryId = (int)$row['category_id'];
-            if (!isset($categories[$categoryId])) {
-                $categories[$categoryId] = [
-                    'id' => $categoryId,
-                    'name' => (string)$row['category_name'],
-                    'description' => (string)($row['category_description'] ?? ''),
-                    'products' => [],
-                ];
-            }
-
-            $departmentPrice = $row['department_price'] === null ? null : (int)$row['department_price'];
-            $effectivePrice = products_o::CUSTOM_PRICING_MISSING_PRICE;
-            if ($departmentPrice !== null) {
-                $effectivePrice = $customer->applyProductCustomerPricing($productId, $departmentPrice, true, $departmentId);
-            }
-
-            $categories[$categoryId]['products'][] = [
-                'id' => $productId,
-                'name' => (string)$row['name'],
-                'description' => (string)($row['description'] ?? ''),
-                'category' => $categoryId,
-                'apply_category_discount' => (bool)$row['apply_category_discount'],
-                'base_price' => (int)$row['price'],
-                'department_price' => $departmentPrice,
-                'effective_price' => $effectivePrice,
-                'missing_department_price' => $departmentPrice === null,
-            ];
-        }
-
-        return array_values($categories);
-    }
-
-    /**
-     * @param array<int, mixed> $overrides
-     * @return array<int, array{is_category:bool,product_or_category_id:int|string,percentage:int,fixed_price:int|null}>
-     */
-    private function normalizeOverrides(int $departmentId, array $overrides): array
-    {
-        $normalized = [];
-        foreach ($overrides as $override) {
-            if (!is_array($override)) {
-                throw new limited_backoffice_exception('Invalid override payload.', 400);
-            }
-
-            $isCategory = (bool)($override['is_category'] ?? false);
-            $objectId = $override['product_or_category_id'] ?? $override['object_id'] ?? null;
-            if ($objectId === null || $objectId === '') {
-                throw new limited_backoffice_exception('Override object is required.', 400);
-            }
-
-            $percentage = filter_var($override['discount'] ?? $override['percentage'] ?? 0, FILTER_VALIDATE_INT);
-            if ($percentage === false || $percentage < 0 || $percentage > 100) {
-                throw new limited_backoffice_exception('Discount must be between 0 and 100.', 400);
-            }
-
-            $fixedPrice = null;
-            if (array_key_exists('fixed_price', $override) && $override['fixed_price'] !== null && $override['fixed_price'] !== '') {
-                $fixedPrice = filter_var($override['fixed_price'], FILTER_VALIDATE_INT);
-                if ($fixedPrice === false || $fixedPrice < 0) {
-                    throw new limited_backoffice_exception('Fixed price must be zero or more.', 400);
-                }
-            }
-
-            if ($isCategory) {
-                $fixedPrice = null;
-                $objectId = (string)$objectId;
-                if ($objectId !== 'global') {
-                    $this->assertDepartmentCategory($departmentId, $objectId);
-                }
-            } else {
-                $objectId = (int)$objectId;
-                $this->assertDepartmentProduct($departmentId, $objectId);
-            }
-
-            if ($percentage <= 0 && $fixedPrice === null) {
-                continue;
-            }
-
-            $key = $this->overrideKey($isCategory, $objectId);
-            $normalized[$key] = [
-                'is_category' => $isCategory,
-                'product_or_category_id' => $objectId,
-                'percentage' => (int)$percentage,
-                'fixed_price' => $fixedPrice === null ? null : (int)$fixedPrice,
-            ];
-        }
-
-        return array_values($normalized);
-    }
-
-    /**
-     * @param array{id:int,customer_number:int,display_name:string} $customer
-     * @param array{is_category:bool,product_or_category_id:int|string,percentage:int,fixed_price:int|null} $override
-     */
-    private function recordVersion(array $customer, int $departmentId, array $override): void
-    {
-        try {
-            (new economic_v2_versioning_service())->recordDiscountOverrideVersion(
-                (int)$customer['id'],
-                (int)$customer['customer_number'],
-                (bool)$override['is_category'],
-                (string)$override['product_or_category_id'],
-                (int)$override['percentage'],
-                date('Y-m-d H:i:s'),
-                'live.department_discount_override.route',
-                1.0,
-                false,
-                [
-                    'route' => 'department_customer_pricing',
-                    'department_id' => $departmentId,
-                ],
-                $override['fixed_price'],
-                $departmentId
-            );
-        } catch (\Throwable) {
-        }
-    }
-
-    private function overrideKey(bool $isCategory, int|string $objectId): string
-    {
-        return ((int)$isCategory) . ':' . (string)$objectId;
-    }
-
-    private function assertDepartmentProduct(int $departmentId, int $productId): void
-    {
-        global $db;
-
-        $result = $db->query(
-            'SELECT p.`id`
-             FROM `department_categories` dc
-             INNER JOIN `products` p ON p.`category` = dc.`category_id`
-             WHERE dc.`department_id` = ' . (int)$departmentId . '
-               AND dc.`deleted_at` IS NULL
-               AND p.`id` = ' . (int)$productId . '
-             LIMIT 1'
-        );
-
-        if (!$result || $result->num_rows < 1) {
-            throw new limited_backoffice_exception('Product is not available for this department.', 400);
-        }
-    }
-
-    private function assertDepartmentCategory(int $departmentId, string $categoryId): void
-    {
-        global $db;
-
-        $categoryId = $db->escape_string($categoryId);
-        $result = $db->query(
-            "SELECT `id`
-             FROM `department_categories`
-             WHERE `department_id` = " . (int)$departmentId . "
-               AND `deleted_at` IS NULL
-               AND `category_id` = '{$categoryId}'
-             LIMIT 1"
-        );
-
-        if (!$result || $result->num_rows < 1) {
-            throw new limited_backoffice_exception('Category is not available for this department.', 400);
-        }
-    }
-}
@@ -1,252 +0,0 @@
-<?php
-
-namespace classes;
-
-require_once WD . '/classes/selfserve_schema_bootstrap.php';
-
-use Exception;
-
-class department_wash_count_service
-{
-    /**
-     * @throws Exception
-     */
-    public function countInDateRange(string $date_start, string $date_end, int $department_id): int
-    {
-        $rows = $this->countByHourForDepartments($date_start, $date_end, [$department_id]);
-        $total = 0;
-
-        foreach ($rows as $row) {
-            $total += (int)($row['wash_count'] ?? 0);
-        }
-
-        return $total;
-    }
-
-    /**
-     * @param array<int|string> $department_ids
-     * @return array<int,array{department_id:int,hour_bucket:string,wash_count:int}>
-     * @throws Exception
-     */
-    public function countByHourForDepartments(string $date_start, string $date_end, array $department_ids): array
-    {
-        global $db;
-
-        $this->validateDateRange($date_start, $date_end);
-        $normalized_department_ids = $this->normalizeIds($department_ids);
-        if ($normalized_department_ids === []) {
-            return [];
-        }
-
-        selfserve_schema_bootstrap::ensureTables();
-
-        $department_ids_sql = implode(',', $normalized_department_ids);
-        $escaped_start = $db->escape_string($date_start);
-        $escaped_end = $db->escape_string($date_end);
-        $candidate_sql = $this->candidateUnionSql($department_ids_sql, $escaped_start, $escaped_end);
-
-        $sql = "SELECT deduped.department_id,
-                       DATE_FORMAT(deduped.counted_at, '%Y-%m-%d %H:00:00') AS hour_bucket,
-                       COUNT(*) AS wash_count
-                FROM (
-                    SELECT dedupe_key,
-                           department_id,
-                           MIN(counted_at) AS counted_at
-                    FROM ($candidate_sql) candidates
-                    GROUP BY dedupe_key, department_id
-                ) deduped
-                GROUP BY deduped.department_id, DATE_FORMAT(deduped.counted_at, '%Y-%m-%d %H:00:00')
-                ORDER BY deduped.department_id ASC, hour_bucket ASC";
-
-        $result = $db->query($sql);
-        if (!is_object($result) || $result->num_rows === 0) {
-            return [];
-        }
-
-        $rows = [];
-        while ($row = $result->fetch_assoc()) {
-            $rows[] = [
-                'department_id' => (int)($row['department_id'] ?? 0),
-                'hour_bucket' => (string)($row['hour_bucket'] ?? ''),
-                'wash_count' => (int)($row['wash_count'] ?? 0),
-            ];
-        }
-
-        return $rows;
-    }
-
-    /**
-     * @param array<int|string> $department_ids
-     * @return array{quantity:int,products:int,earnings:int,washes:int}
-     * @throws Exception
-     */
-    public function transactionSummary(string $date_start, string $date_end, array $department_ids): array
-    {
-        global $db;
-
-        $this->validateDateRange($date_start, $date_end);
-        $normalized_department_ids = $this->normalizeIds($department_ids);
-        if ($normalized_department_ids === []) {
-            return [
-                'quantity' => 0,
-                'products' => 0,
-                'earnings' => 0,
-                'washes' => 0,
-            ];
-        }
-
-        $department_ids_sql = implode(',', $normalized_department_ids);
-        $escaped_start = $db->escape_string($date_start);
-        $escaped_end = $db->escape_string($date_end);
-
-        $sql = "SELECT COUNT(DISTINCT o.id) AS quantity,
-                       COALESCE(SUM(oi.quantity), 0) AS products,
-                       COALESCE(SUM(oi.price * oi.quantity), 0) AS earnings
-                FROM orders o
-                JOIN order_items oi ON oi.order_id = o.id
-                WHERE o.department_id IN ($department_ids_sql)
-                  AND o.created_at BETWEEN '$escaped_start' AND '$escaped_end'
-                  AND o.deleted_at IS NULL
-                  AND oi.deleted_at IS NULL";
-
-        $result = $db->query($sql);
-        $row = is_object($result) ? $result->fetch_assoc() : null;
-
-        return [
-            'quantity' => (int)($row['quantity'] ?? 0),
-            'products' => (int)($row['products'] ?? 0),
-            'earnings' => (int)round((float)($row['earnings'] ?? 0)),
-            'washes' => $this->countRows($date_start, $date_end, $normalized_department_ids),
-        ];
-    }
-
-    /**
-     * @param array<int|string> $department_ids
-     * @return array<int,array{id:int,department_id:int,created_at:string}>
-     * @throws Exception
-     */
-    public function listTransactions(string $date_start, string $date_end, array $department_ids): array
-    {
-        global $db;
-
-        $this->validateDateRange($date_start, $date_end);
-        $normalized_department_ids = $this->normalizeIds($department_ids);
-        if ($normalized_department_ids === []) {
-            return [];
-        }
-
-        selfserve_schema_bootstrap::ensureTables();
-
-        $department_ids_sql = implode(',', $normalized_department_ids);
-        $escaped_start = $db->escape_string($date_start);
-        $escaped_end = $db->escape_string($date_end);
-        $candidate_sql = $this->candidateUnionSql($department_ids_sql, $escaped_start, $escaped_end);
-
-        $sql = "SELECT CAST(SUBSTRING_INDEX(GROUP_CONCAT(entity_id ORDER BY source_priority ASC, entity_id ASC), ',', 1) AS UNSIGNED) AS id,
-                       department_id,
-                       MIN(counted_at) AS created_at
-                FROM ($candidate_sql) candidates
-                GROUP BY dedupe_key, department_id
-                ORDER BY created_at ASC";
-
-        $result = $db->query($sql);
-        if (!is_object($result) || $result->num_rows === 0) {
-            return [];
-        }
-
-        $rows = [];
-        while ($row = $result->fetch_assoc()) {
-            $rows[] = [
-                'id' => (int)($row['id'] ?? 0),
-                'department_id' => (int)($row['department_id'] ?? 0),
-                'created_at' => (string)($row['created_at'] ?? ''),
-            ];
-        }
-
-        return $rows;
-    }
-
-    /**
-     * @param array<int> $department_ids
-     * @throws Exception
-     */
-    private function countRows(string $date_start, string $date_end, array $department_ids): int
-    {
-        $rows = $this->countByHourForDepartments($date_start, $date_end, $department_ids);
-        $total = 0;
-
-        foreach ($rows as $row) {
-            $total += (int)($row['wash_count'] ?? 0);
-        }
-
-        return $total;
-    }
-
-    private function candidateUnionSql(string $department_ids_sql, string $escaped_start, string $escaped_end): string
-    {
-        return "SELECT CONCAT('order:', o.id) AS dedupe_key,
-                       o.id AS entity_id,
-                       o.department_id,
-                       o.created_at AS counted_at,
-                       0 AS source_priority
-                FROM orders o
-                JOIN order_items oi ON oi.order_id = o.id
-                JOIN products p ON p.id = oi.product_id
-                WHERE o.department_id IN ($department_ids_sql)
-                  AND o.created_at BETWEEN '$escaped_start' AND '$escaped_end'
-                  AND o.deleted_at IS NULL
-                  AND oi.deleted_at IS NULL
-                  AND p.is_wash = 1
-                UNION ALL
-                SELECT CASE
-                           WHEN linked_o.id IS NOT NULL THEN CONCAT('order:', linked_o.id)
-                           ELSE CONCAT('selfserve:', s.id)
-                       END AS dedupe_key,
-                       CASE
-                           WHEN linked_o.id IS NOT NULL THEN linked_o.id
-                           ELSE s.id
-                       END AS entity_id,
-                       COALESCE(linked_o.department_id, s.department_id) AS department_id,
-                       COALESCE(linked_o.created_at, s.completed_at) AS counted_at,
-                       1 AS source_priority
-                FROM selfserve_wash_sessions s
-                LEFT JOIN orders linked_o
-                  ON linked_o.id = s.order_id
-                 AND linked_o.deleted_at IS NULL
-                WHERE COALESCE(linked_o.department_id, s.department_id) IN ($department_ids_sql)
-                  AND COALESCE(linked_o.created_at, s.completed_at) BETWEEN '$escaped_start' AND '$escaped_end'
-                  AND s.deleted_at IS NULL
-                  AND s.completed_at IS NOT NULL
-                  AND UPPER(TRIM(s.status)) = 'COMPLETED'";
-    }
-
-    /**
-     * @param array<int|string> $ids
-     * @return array<int>
-     */
-    private function normalizeIds(array $ids): array
-    {
-        $normalized = [];
-        foreach ($ids as $id) {
-            $value = (int)$id;
-            if ($value > 0) {
-                $normalized[$value] = $value;
-            }
-        }
-
-        return array_values($normalized);
-    }
-
-    /**
-     * @throws Exception
-     */
-    private function validateDateRange(string $date_start, string $date_end): void
-    {
-        if (strtotime($date_start) === false || strtotime($date_end) === false) {
-            throw new Exception('Invalid date range provided');
-        }
-        if (strtotime($date_start) > strtotime($date_end)) {
-            throw new Exception('The start date cannot be after the end date');
-        }
-    }
-}
@@ -34,14 +34,6 @@ class departments_schema_bootstrap
            );
        }

-        if (!self::columnExists($db, 'departments', 'custom_pricing_only')) {
-            $db->query(
-                "ALTER TABLE departments
-                    ADD COLUMN custom_pricing_only TINYINT(1) NOT NULL DEFAULT 0
-                    AFTER archived"
-            );
-        }
-
        if (!self::indexExists($db, 'departments', self::ARCHIVED_INDEX)) {
            $db->query(
                "ALTER TABLE departments
@@ -172,8 +172,7 @@ class economic implements economic_i
        string $email,
        int $phone,
        ?int $mobile_phone = null,
-        object|array|null $company_information = null,
-        ?string $ean = null
+        object|array|null $company_information = null
    ): object
    {
        $payload = [
@@ -197,37 +196,10 @@ class economic implements economic_i
        ];

        $payload = array_replace($payload, $this->buildCustomerPayloadFromCompanyInformation($company_information));
-        $normalized_ean = self::normalizeCustomerEan($ean);
-        if ($normalized_ean !== null) {
-            $payload['ean'] = $normalized_ean;
-        }

        return $this->customers->customers->create($payload);
    }

-    public static function normalizeCustomerEan(mixed $value): ?string
-    {
-        if ($value === null) {
-            return null;
-        }
-
-        $digits = preg_replace('/\D+/', '', (string)$value);
-        if (!is_string($digits)) {
-            return null;
-        }
-
-        $digits = trim($digits);
-        if ($digits === '') {
-            return null;
-        }
-
-        if (strlen($digits) > 13) {
-            throw new \InvalidArgumentException('EAN must be at most 13 digits.');
-        }
-
-        return $digits;
-    }
-
    private function buildCustomerPayloadFromCompanyInformation(object|array|null $company_information): array
    {
        if ($company_information === null) {
@@ -240,13 +240,7 @@ class economic_transfer_executor
            'Queued transfer processed successfully for collected invoice #' . $collected_invoice_id
        );

-        $result = $collected_order_invoices->asArray();
-        $transfer_metrics = $collected_order_invoices->getLastEconomicTransferMetrics();
-        if ($transfer_metrics !== null) {
-            $result['economic_transfer_metrics'] = $transfer_metrics;
-        }
-
-        return $result;
+        return $collected_order_invoices->asArray();
    }

    /**
@@ -41,7 +41,7 @@ class economic_transfer_queue
        $transfer_type = $this->validateTransferType($transfer_type);
        $payload = $this->normalizePayloadForTransferType($transfer_type, $payload, $created_by);

-        $active_job = $this->findActiveJobByTarget($transfer_type, $payload, $created_by);
+        $active_job = $this->findActiveJobByTarget($transfer_type, $payload);
        if ($active_job !== null) {
            $target_label = $this->buildTargetLabel($transfer_type, $payload);
            $this->logQueueEvent(
@@ -135,89 +135,6 @@ class economic_transfer_queue
        return $jobs;
    }

-    public function getJobByIdForUser(int $job_id, int $created_by): ?array
-    {
-        global $db;
-
-        $job_id = max(0, $job_id);
-        $created_by = max(0, $created_by);
-        if ($job_id < 1 || $created_by < 1) {
-            return null;
-        }
-
-        $stmt = $db->prepare("SELECT * FROM economic_transfer_queue_jobs WHERE id = ? AND created_by = ? LIMIT 1");
-        if (!$stmt) {
-            return null;
-        }
-
-        $stmt->bind_param('ii', $job_id, $created_by);
-        if (!$stmt->execute()) {
-            $stmt->close();
-            return null;
-        }
-
-        $result = $stmt->get_result();
-        $row = $result instanceof mysqli_result ? $result->fetch_assoc() : null;
-        $stmt->close();
-
-        if (!$row) {
-            return null;
-        }
-        return $this->normalizeJobRow($row);
-    }
-
-    public function listJobsForCreatedBy(array $statuses = [], int $limit = 50, int $offset = 0, ?string $transfer_type = null, int $created_by = 0): array
-    {
-        global $db;
-
-        $created_by = max(0, $created_by);
-        if ($created_by < 1) {
-            return [];
-        }
-
-        $limit = max(1, min(500, $limit));
-        $offset = max(0, $offset);
-
-        $where = $this->buildListJobsWhereClause($statuses, $transfer_type);
-        $where .= $where === '' ? 'WHERE created_by = ' . $created_by : ' AND created_by = ' . $created_by;
-        $sql = "SELECT * FROM economic_transfer_queue_jobs $where ORDER BY id DESC LIMIT $limit OFFSET $offset";
-        $result = $db->query($sql);
-        if (!$result instanceof mysqli_result) {
-            return [];
-        }
-
-        $jobs = [];
-        while ($row = $result->fetch_assoc()) {
-            $jobs[] = $this->normalizeJobRow($row);
-        }
-        return $jobs;
-    }
-
-    public function countJobsForCreatedBy(array $statuses = [], ?string $transfer_type = null, int $created_by = 0): int
-    {
-        global $db;
-
-        $created_by = max(0, $created_by);
-        if ($created_by < 1) {
-            return 0;
-        }
-
-        $where = $this->buildListJobsWhereClause($statuses, $transfer_type);
-        $where .= $where === '' ? 'WHERE created_by = ' . $created_by : ' AND created_by = ' . $created_by;
-        $sql = "SELECT COUNT(*) AS total FROM economic_transfer_queue_jobs $where";
-        $result = $db->query($sql);
-        if (!$result instanceof mysqli_result) {
-            return 0;
-        }
-
-        $row = $result->fetch_assoc();
-        if (!is_array($row) || !isset($row['total'])) {
-            return 0;
-        }
-
-        return max(0, (int)$row['total']);
-    }
-
    public function countJobs(array $statuses = [], ?string $transfer_type = null): int
    {
        global $db;
@@ -262,7 +179,7 @@ class economic_transfer_queue
                  ON d.queue_job_id = q.id
                 AND d.user_id = $user_id
                 AND d.dismissed_status = q.status
-                WHERE q.created_by = $user_id
+                WHERE 1 = 1
                  $transfer_condition
                  AND (
                    q.status IN ('" . self::STATUS_QUEUED . "', '" . self::STATUS_PROCESSING . "')
@@ -297,7 +214,7 @@ class economic_transfer_queue
            throw new Exception('Queue job and user are required');
        }

-        $job = $this->getJobByIdForUser($job_id, $user_id);
+        $job = $this->getJobById($job_id);
        if ($job === null) {
            throw new Exception('Queue job not found');
        }
@@ -355,8 +272,7 @@ class economic_transfer_queue
                  ON d.queue_job_id = q.id
                 AND d.user_id = $user_id
                 AND d.dismissed_status = q.status
-                WHERE q.created_by = $user_id
-                  AND q.status IN ('" . self::STATUS_COMPLETED . "', '" . self::STATUS_FAILED . "')
+                WHERE q.status IN ('" . self::STATUS_COMPLETED . "', '" . self::STATUS_FAILED . "')
                  $transfer_condition
                  AND d.queue_job_id IS NULL
                ON DUPLICATE KEY UPDATE dismissed_status = VALUES(dismissed_status), dismissed_at = NOW()";
@@ -368,24 +284,10 @@ class economic_transfer_queue
     * @throws Exception
     */
    public function retryJob(int $job_id): array
-    {
-        return $this->retryJobInternal($job_id);
-    }
-
-    public function retryJobForUser(int $job_id, int $created_by): array
-    {
-        return $this->retryJobInternal($job_id, $created_by);
-    }
-
-    private function retryJobInternal(int $job_id, ?int $created_by = null): array
    {
        global $db;

-        $job_id = max(0, $job_id);
-        $created_by = $created_by === null ? null : max(0, $created_by);
-        $existing_job = $created_by === null
-            ? $this->getJobById($job_id)
-            : $this->getJobByIdForUser($job_id, $created_by);
+        $existing_job = $this->getJobById($job_id);
        if ($existing_job === null) {
            throw new Exception('Queue job not found');
        }
@@ -396,26 +298,19 @@ class economic_transfer_queue
            throw new Exception('Queue job reached max retry attempts');
        }

-        $sql = "UPDATE economic_transfer_queue_jobs
+        $stmt = $db->prepare(
+            "UPDATE economic_transfer_queue_jobs
             SET status = ?, progress_percent = 0, progress_message = 'Queued for retry',
                 error_message = NULL, result_json = NULL, started_at = NULL, completed_at = NULL, locked_at = NULL
-             WHERE id = ? AND status = ?";
-        if ($created_by !== null) {
-            $sql .= " AND created_by = ?";
-        }
-
-        $stmt = $db->prepare($sql);
+             WHERE id = ? AND status = ?"
+        );
        if (!$stmt) {
            throw new Exception('Failed to prepare retry statement');
        }

        $queued = self::STATUS_QUEUED;
        $failed = self::STATUS_FAILED;
-        if ($created_by !== null) {
-            $stmt->bind_param('sisi', $queued, $job_id, $failed, $created_by);
-        } else {
-            $stmt->bind_param('sis', $queued, $job_id, $failed);
-        }
+        $stmt->bind_param('sis', $queued, $job_id, $failed);
        $stmt->execute();
        $affected = $stmt->affected_rows;
        $stmt->close();
@@ -426,9 +321,7 @@ class economic_transfer_queue

        $this->clearDismissalsForJob($job_id);

-        $job = $created_by === null
-            ? $this->getJobById($job_id)
-            : $this->getJobByIdForUser($job_id, $created_by);
+        $job = $this->getJobById($job_id);
        if ($job === null) {
            throw new Exception('Retry updated job could not be loaded');
        }
@@ -817,31 +710,28 @@ class economic_transfer_queue
        return $this->rejectPayload($created_by, $field_name . ' must be a boolean');
    }

-    private function findActiveJobByTarget(string $transfer_type, array $payload, int $created_by): ?array
+    private function findActiveJobByTarget(string $transfer_type, array $payload): ?array
    {
        return match ($transfer_type) {
            self::TYPE_ORDER_DRAFT_EXPORT, self::TYPE_ORDER_INVOICE_EXPORT => $this->findActiveJobByJsonNumericTarget(
                $transfer_type,
                '$.order_id',
-                (int)($payload['order_id'] ?? 0),
-                $created_by
+                (int)($payload['order_id'] ?? 0)
            ),
            self::TYPE_COLLECTED_INVOICE_EXPORT => $this->findActiveJobByJsonNumericTarget(
                $transfer_type,
                '$.collected_invoice_id',
-                (int)($payload['collected_invoice_id'] ?? 0),
-                $created_by
+                (int)($payload['collected_invoice_id'] ?? 0)
            ),
            default => null,
        };
    }

-    private function findActiveJobByJsonNumericTarget(string $transfer_type, string $json_path, int $target_value, int $created_by): ?array
+    private function findActiveJobByJsonNumericTarget(string $transfer_type, string $json_path, int $target_value): ?array
    {
        global $db;

-        $created_by = max(0, $created_by);
-        if ($target_value < 1 || $created_by < 1) {
+        if ($target_value < 1) {
            return null;
        }

@@ -851,7 +741,6 @@ class economic_transfer_queue
             WHERE transfer_type = ?
               AND status IN (?, ?)
               AND CAST(JSON_UNQUOTE(JSON_EXTRACT(payload_json, '$json_path')) AS UNSIGNED) = ?
-               AND created_by = ?
             ORDER BY id DESC
             LIMIT 1"
        );
@@ -861,7 +750,7 @@ class economic_transfer_queue

        $queued = self::STATUS_QUEUED;
        $processing = self::STATUS_PROCESSING;
-        $stmt->bind_param('sssii', $transfer_type, $queued, $processing, $target_value, $created_by);
+        $stmt->bind_param('sssi', $transfer_type, $queued, $processing, $target_value);
        if (!$stmt->execute()) {
            $stmt->close();
            return null;
@@ -40,7 +40,6 @@ class economic_v2_distribution_service

    public function __construct(?economic_v2_versioning_service $versioning = null, ?economic $economic = null)
    {
-        department_customer_price_overrides_schema_bootstrap::ensureTables();
        $this->versioning = $versioning ?? new economic_v2_versioning_service();
        $this->economic = $economic;
    }
@@ -389,16 +388,7 @@ class economic_v2_distribution_service
                    continue;
                }

-                $discount_row = $this->resolveDiscountForProduct($customer_number, $product_id, $created_at, $department_id);
-                if ($discount_row === null) {
-                    continue;
-                }
-                if (array_key_exists('fixed_price', $discount_row) && $discount_row['fixed_price'] !== null) {
-                    $fixed_price = (float)$discount_row['fixed_price'];
-                    $order_discount_total += (($base_price - $fixed_price) * $quantity);
-                    continue;
-                }
-
+                $discount_row = $this->resolveDiscountForProduct($customer_number, $product_id, $created_at);
                $discount_percentage = (float)($discount_row['discount'] ?? 0);
                if ($discount_percentage <= 0) {
                    continue;
@@ -1529,13 +1519,7 @@ class economic_v2_distribution_service
                $line_price = ((float)$this->getProductDepartmentPrice($product_id, $department_id)) * $quantity;
            }

-            $discount_row = $this->resolveDiscountForProduct($customer_number, $product_id, $timestamp, $department_id);
-            if ($discount_row !== null && array_key_exists('fixed_price', $discount_row) && $discount_row['fixed_price'] !== null) {
-                $line_price = ((float)$discount_row['fixed_price']) * $quantity;
-                $total += $line_price;
-                continue;
-            }
-
+            $discount_row = $this->resolveDiscountForProduct($customer_number, $product_id, $timestamp);
            $discount_percentage = (float)($discount_row['discount'] ?? 0);
            if ($discount_percentage > 0) {
                $line_price *= (1 - ($discount_percentage / 100));
@@ -1545,22 +1529,15 @@ class economic_v2_distribution_service
        return $total;
    }

-    protected function resolveDiscountForProduct(int $customer_number, int $product_id, string $timestamp, ?int $department_id = null): ?array
+    protected function resolveDiscountForProduct(int $customer_number, int $product_id, string $timestamp): ?array
    {
-        $cache_key = $customer_number . '|' . $product_id . '|' . (int)($department_id ?? 0) . '|' . substr($timestamp, 0, 19);
+        $cache_key = $customer_number . '|' . $product_id . '|' . substr($timestamp, 0, 19);
        if (array_key_exists($cache_key, $this->discount_resolution_cache)) {
            return $this->discount_resolution_cache[$cache_key];
        }

-        $scopedDepartmentId = $department_id !== null && (new \objects\departments_o())->isCustomPricingOnly((int)$department_id)
-            ? (int)$department_id
-            : null;
-
-        $direct = $this->versioning->resolveDiscountOverrideAt($customer_number, false, (string)$product_id, $timestamp, $scopedDepartmentId);
-        if ($direct !== null && (
-            (array_key_exists('fixed_price', $direct) && $direct['fixed_price'] !== null)
-            || (int)($direct['discount'] ?? 0) > 0
-        )) {
+        $direct = $this->versioning->resolveDiscountOverrideAt($customer_number, false, (string)$product_id, $timestamp);
+        if ($direct !== null && (int)($direct['discount'] ?? 0) > 0) {
            return $this->discount_resolution_cache[$cache_key] = $direct;
        }

@@ -1568,20 +1545,13 @@ class economic_v2_distribution_service
        if ($product !== null) {
            $category = (string)$product->category->value();
            if ($category !== '') {
-                $category_discount = $this->versioning->resolveDiscountOverrideAt($customer_number, true, $category, $timestamp, $scopedDepartmentId);
+                $category_discount = $this->versioning->resolveDiscountOverrideAt($customer_number, true, $category, $timestamp);
                if ($category_discount !== null && (int)($category_discount['discount'] ?? 0) > 0) {
                    return $this->discount_resolution_cache[$cache_key] = $category_discount;
                }
            }
        }

-        if ($scopedDepartmentId !== null) {
-            $global_discount = $this->versioning->resolveDiscountOverrideAt($customer_number, true, 'global', $timestamp, $scopedDepartmentId);
-            if ($global_discount !== null && (int)($global_discount['discount'] ?? 0) > 0) {
-                return $this->discount_resolution_cache[$cache_key] = $global_discount;
-            }
-        }
-
        return $this->discount_resolution_cache[$cache_key] = null;
    }

@@ -60,13 +60,11 @@ class economic_v2_schema_bootstrap

            "CREATE TABLE IF NOT EXISTS customer_discount_override_versions (
                id INT AUTO_INCREMENT PRIMARY KEY,
-                department_id INT NULL DEFAULT NULL,
                user_id INT NOT NULL,
                customer_number INT NOT NULL,
                is_category TINYINT(1) NOT NULL,
                object_id VARCHAR(64) NOT NULL,
                discount INT NOT NULL,
-                fixed_price INT NULL DEFAULT NULL,
                effective_from DATETIME NOT NULL,
                effective_to DATETIME NULL,
                source VARCHAR(64) NOT NULL DEFAULT 'live',
@@ -76,7 +74,6 @@ class economic_v2_schema_bootstrap
                created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
                updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
                INDEX idx_discount_override_versions_lookup (customer_number, is_category, object_id, effective_from, effective_to),
-                INDEX idx_discount_override_versions_department_lookup (department_id, customer_number, is_category, object_id, effective_from, effective_to),
                INDEX idx_discount_override_versions_user (user_id),
                INDEX idx_discount_override_versions_source (source)
            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
@@ -86,22 +83,6 @@ class economic_v2_schema_bootstrap
            $db->query($sql);
        }

-        if (!self::tableHasColumn('customer_discount_override_versions', 'fixed_price')) {
-            $db->query(
-                "ALTER TABLE customer_discount_override_versions
-                    ADD COLUMN fixed_price INT NULL DEFAULT NULL
-                    AFTER discount"
-            );
-        }
-
-        if (!self::tableHasColumn('customer_discount_override_versions', 'department_id')) {
-            $db->query(
-                "ALTER TABLE customer_discount_override_versions
-                    ADD COLUMN department_id INT NULL DEFAULT NULL
-                    AFTER id"
-            );
-        }
-
        self::$initialized = true;
    }

@@ -125,3 +106,4 @@ class economic_v2_schema_bootstrap
        return ((int)($row['c'] ?? 0)) > 0;
    }
 }
+
@@ -135,9 +135,7 @@ class economic_v2_versioning_service
        string $source = 'live.discount_override',
        float $confidence = 1.0,
        bool $inferred = false,
-        array $metadata = [],
-        ?int $fixed_price = null,
-        ?int $department_id = null
+        array $metadata = []
    ): array {
        $identity = [
            'user_id' => $user_id,
@@ -145,11 +143,8 @@ class economic_v2_versioning_service
            'is_category' => (int)$is_category,
            'object_id' => (string)$object_id,
        ];
-        if ($department_id !== null) {
-            $identity['department_id'] = (int)$department_id;
-        }

-        if (($discount === null || (int)$discount === 0) && $fixed_price === null) {
+        if ($discount === null || (int)$discount === 0) {
            return $this->closeActiveVersion(
                'customer_discount_override_versions',
                $identity,
@@ -166,7 +161,6 @@ class economic_v2_versioning_service
            $identity,
            [
                'discount' => (int)$discount,
-                'fixed_price' => $is_category ? null : $fixed_price,
            ],
            $this->normalizeDatetime($effective_from),
            $source,
@@ -244,21 +238,15 @@ class economic_v2_versioning_service
        int $customer_number,
        bool $is_category,
        int|string $object_id,
-        string $timestamp,
-        ?int $department_id = null
+        string $timestamp
    ): ?array {
-        $identity = [
-            'customer_number' => $customer_number,
-            'is_category' => (int)$is_category,
-            'object_id' => (string)$object_id,
-        ];
-        if ($department_id !== null) {
-            $identity['department_id'] = (int)$department_id;
-        }
-
        $rows = $this->resolveActiveVersions(
            'customer_discount_override_versions',
-            $identity,
+            [
+                'customer_number' => $customer_number,
+                'is_category' => (int)$is_category,
+                'object_id' => (string)$object_id,
+            ],
            $timestamp,
            'effective_from DESC, id DESC',
            1
@@ -423,11 +411,8 @@ class economic_v2_versioning_service
        }

        // Discount overrides current state.
-        price_overrides_schema_bootstrap::ensureColumns();
        $has_override_created_at = economic_v2_schema_bootstrap::tableHasColumn('price_overrides', 'created_at');
-        $has_override_fixed_price = economic_v2_schema_bootstrap::tableHasColumn('price_overrides', 'fixed_price');
        $discount_cols = 'po.user_id, u.customer_number, po.is_category, po.product_or_category_id, po.percentage' .
-            ($has_override_fixed_price ? ', po.fixed_price' : '') .
            ($has_override_created_at ? ', po.created_at' : '');
        $discount_rows = $this->fetchAll(
            "SELECT $discount_cols
@@ -449,8 +434,7 @@ class economic_v2_versioning_service
                'backfill.current_discount_override',
                $confidence,
                true,
-                ['table' => 'price_overrides'],
-                $has_override_fixed_price && $row['fixed_price'] !== null ? (int)$row['fixed_price'] : null
+                ['table' => 'price_overrides']
            );
            $this->incrementReportAction($report['discount_overrides'], $result['action'] ?? 'noop');
        }
@@ -723,3 +707,4 @@ class economic_v2_versioning_service
        $bucket[$action]++;
    }
 }
+
@@ -1,150 +0,0 @@
-<?php
-
-namespace classes;
-
-use Exception;
-
-class edge_broker_transport_exception extends Exception
-{
-    public function __construct(string $message, private readonly int $curlErrno = 0, int $code = 0, ?Exception $previous = null)
-    {
-        parent::__construct($message, $code, $previous);
-    }
-
-    public function curlErrno(): int
-    {
-        return $this->curlErrno;
-    }
-}
-
-class edge_broker_http_exception extends Exception
-{
-    public function __construct(string $message, private readonly int $statusCode, int $code = 0, ?Exception $previous = null)
-    {
-        parent::__construct($message, $code, $previous);
-    }
-
-    public function statusCode(): int
-    {
-        return $this->statusCode;
-    }
-}
-
-class edge_broker_client
-{
-    private const DEFAULT_BROKER_URL = 'http://edge-broker:4300';
-
-    public function __construct(
-        private readonly ?string $baseUrl = null,
-        private readonly ?string $sharedSecret = null,
-        private readonly int $timeoutSeconds = 10
-    ) {
-    }
-
-    public function isConfigured(): bool
-    {
-        return trim((string)$this->resolveBaseUrl()) !== '';
-    }
-
-    public function dispatchCommand(int $gatewayId, string $commandType, array $payload): array
-    {
-        $url = rtrim($this->resolveBaseUrl(), '/') . '/api/gateways/' . $gatewayId . '/commands';
-        $response = $this->request('POST', $url, [
-            'commandType' => $commandType,
-            'payload' => $payload,
-        ]);
-
-        return is_array($response) ? $response : ['ok' => false, 'response' => $response];
-    }
-
-    public function validateAgent(int $gatewayId, string $agentToken): array
-    {
-        $url = rtrim($this->resolveBaseUrl(), '/') . '/api/internal/agent/auth';
-        $response = $this->request('POST', $url, [
-            'gatewayId' => $gatewayId,
-            'agentToken' => $agentToken,
-        ]);
-
-        return is_array($response) ? $response : [];
-    }
-
-    public function validateShellSession(string $sessionToken): array
-    {
-        $url = rtrim($this->resolveBaseUrl(), '/') . '/api/internal/shell/auth';
-        $response = $this->request('POST', $url, [
-            'sessionToken' => $sessionToken,
-        ]);
-
-        return is_array($response) ? $response : [];
-    }
-
-    public function closeShellSession(int $sessionId, string $sessionToken, string $transcript, string $closedReason): array
-    {
-        $url = rtrim($this->resolveBaseUrl(), '/') . '/api/internal/shell-sessions/' . $sessionId . '/close';
-        $response = $this->request('POST', $url, [
-            'sessionToken' => $sessionToken,
-            'transcript' => $transcript,
-            'closedReason' => $closedReason,
-        ]);
-
-        return is_array($response) ? $response : [];
-    }
-
-    private function resolveBaseUrl(): string
-    {
-        return trim((string)($this->baseUrl ?? getenv('EDGE_BROKER_URL') ?: self::DEFAULT_BROKER_URL));
-    }
-
-    private function resolveSharedSecret(): string
-    {
-        return trim((string)($this->sharedSecret
-            ?? getenv('EDGE_BROKER_SHARED_SECRET')
-            ?: getenv('EDGE_INTERNAL_SECRET')
-            ?: ''));
-    }
-
-    /**
-     * @throws Exception
-     */
-    private function request(string $method, string $url, array $payload): array|object|null
-    {
-        if (trim($url) === '') {
-            throw new Exception('Edge broker URL is not configured');
-        }
-
-        $sharedSecret = $this->resolveSharedSecret();
-        if ($sharedSecret === '') {
-            throw new Exception('Edge broker shared secret is not configured');
-        }
-
-        $ch = curl_init($url);
-        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);
-        curl_setopt($ch, CURLOPT_TIMEOUT, $this->timeoutSeconds);
-        curl_setopt($ch, CURLOPT_HTTPHEADER, [
-            'Content-Type: application/json',
-            'X-Edge-Broker-Secret: ' . $sharedSecret,
-        ]);
-        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload, JSON_UNESCAPED_UNICODE));
-
-        $rawResponse = curl_exec($ch);
-        $statusCode = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
-        $curlErrno = curl_errno($ch);
-        $curlError = curl_error($ch);
-        curl_close($ch);
-
-        if ($rawResponse === false) {
-            throw new edge_broker_transport_exception('Edge broker request failed: ' . $curlError, $curlErrno);
-        }
-
-        $decoded = json_decode((string)$rawResponse, true);
-        if ($statusCode >= 400) {
-            $message = is_array($decoded)
-                ? (string)($decoded['error'] ?? $decoded['message'] ?? 'Edge broker request failed')
-                : 'Edge broker request failed';
-            throw new edge_broker_http_exception($message, $statusCode);
-        }
-
-        return $decoded;
-    }
-}
@@ -128,13 +128,13 @@ use Psr\Http\Client\ClientExceptionInterface;
    private function sendEmailMailerSend(string $to, string $recipient_name, string $subject, string $message, string $html = null, string $references = null, array $attachments = []): void
    {
        if (self::isFakeDeliveryEnabled()) {
-            self::recordFakeDelivery([
+            self::$fake_deliveries[] = [
                'to' => $to,
                'recipient_name' => $recipient_name,
                'subject' => $subject,
                'message' => $message,
                'html' => $html,
-            ]);
+            ];
            return;
        }

@@ -225,72 +225,6 @@ use Psr\Http\Client\ClientExceptionInterface;
    public static function resetFakeDeliveries(): void
    {
        self::$fake_deliveries = [];
-        $path = self::getFakeDeliveriesPath();
-        if ($path !== null && is_file($path)) {
-            unlink($path);
-        }
-    }
-
-    public static function syncFakeDeliveries(): void
-    {
-        $path = self::getFakeDeliveriesPath();
-        if ($path === null || !is_file($path)) {
-            self::$fake_deliveries = [];
-            return;
-        }
-
-        $lines = file($path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
-        if ($lines === false) {
-            self::$fake_deliveries = [];
-            return;
-        }
-
-        $deliveries = [];
-        foreach ($lines as $line) {
-            $delivery = json_decode($line, true);
-            if (is_array($delivery)) {
-                $deliveries[] = $delivery;
-            }
-        }
-
-        self::$fake_deliveries = $deliveries;
-    }
-
-    private static function recordFakeDelivery(array $delivery): void
-    {
-        self::$fake_deliveries[] = $delivery;
-
-        $path = self::getFakeDeliveriesPath();
-        if ($path === null) {
-            return;
-        }
-
-        $directory = dirname($path);
-        if (!is_dir($directory)) {
-            mkdir($directory, 0777, true);
-        }
-
-        file_put_contents($path, json_encode($delivery, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . PHP_EOL, FILE_APPEND | LOCK_EX);
-    }
-
-    private static function getFakeDeliveriesPath(): ?string
-    {
-        if (!self::isFakeDeliveryEnabled()) {
-            return null;
-        }
-
-        $configuredPath = trim((string)(getenv('EMAIL_FAKE_DELIVERIES_PATH') ?: ''));
-        if ($configuredPath !== '') {
-            return $configuredPath;
-        }
-
-        if (getenv('RUN_API_TESTS') !== '1') {
-            return null;
-        }
-
-        return rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR)
-            . DIRECTORY_SEPARATOR
-            . 'truckwash-email-fake-deliveries-' . md5((string)getcwd()) . '.jsonl';
    }

    private static function isFakeDeliveryEnabled(): bool
@@ -577,47 +511,4 @@ use Psr\Http\Client\ClientExceptionInterface;
            $this->attachments
        );
    }
-
-    /**
-     * @throws Exception
-     */
-    public function sendNewCustomerRegistrationNotifications(int $customer_number): void
-    {
-        $customer = (new users_o())->getUserByCustomerNumber($customer_number);
-        if (!$customer->exists()) {
-            throw new Exception('Customer not found with customer number: ' . $customer_number);
-        }
-
-        $customerName = $customer->getCustomerName((int)$customer->customer_number->value()) ?: 'Unknown customer';
-        $safeCustomerName = htmlspecialchars($customerName, ENT_QUOTES, 'UTF-8');
-        $safeCustomerNumber = (int)$customer->customer_number->value();
-        $customerUrl = 'https://truckwash.io/superuser/users?search=' . $safeCustomerNumber;
-        $message = "
-            <p>A new customer has registered on truckwash.io.</p>
-            <p>
-                <strong>Customer number:</strong> $safeCustomerNumber<br>
-                <strong>Customer name:</strong> $safeCustomerName
-            </p>
-            <p><a href='$customerUrl'>Open customer in Superuser</a></p>
-        ";
-
-        foreach ((new users_o())->getSuperuserNewCustomerEmailNotificationRecipients() as $recipient) {
-            $recipientEmail = trim((string)($recipient['email'] ?? ''));
-            if ($recipientEmail === '') {
-                continue;
-            }
-
-            $recipientName = trim((string)($recipient['display_name'] ?? ''));
-            if ($recipientName === '') {
-                $recipientName = $recipientEmail;
-            }
-
-            $this->sendEmail(
-                $recipientEmail,
-                $recipientName,
-                'New customer registered on Truck Wash',
-                $message,
-            );
-        }
-    }
 }
@@ -92,17 +92,12 @@ class error_report_service
            throw new RuntimeException('Data collection acceptance is required.');
        }

+        $screenshot = self::decodeScreenshotDataUri((string)($payload['screenshot'] ?? ''));
+        $storedScreenshot = $this->store->storeScreenshot($screenshot['mime_type'], $screenshot['contents']);
        $context = is_array($payload['context'] ?? null) ? $payload['context'] : [];
-        $storedScreenshot = $this->storeOptionalScreenshot($payload['screenshot'] ?? null, $context);
        $requestErrors = $this->boundedArray($payload['request_errors'] ?? ($context['request_errors'] ?? []), 25);
        $vueErrors = $this->boundedArray($payload['vue_errors'] ?? ($context['vue_errors'] ?? []), 25);
        $runtimeContext = $this->runtimeContext($payload, $context);
-        $runtimeContext['screenshot_attachment'] = [
-            'status' => $storedScreenshot['status'],
-            'attached' => $storedScreenshot['key'] !== '',
-            'mime_type' => $storedScreenshot['mime_type'] !== '' ? $storedScreenshot['mime_type'] : null,
-            'size_bytes' => (int)$storedScreenshot['size_bytes'],
-        ];

        $this->execute(
            "INSERT INTO error_reports (
@@ -300,67 +295,6 @@ class error_report_service
        return $value === true || $value === 1 || $value === '1' || $value === 'true';
    }

-    private function storeOptionalScreenshot(mixed $value, array $context): array
-    {
-        if (!is_scalar($value) && !$value instanceof \Stringable && $value !== null) {
-            return $this->emptyScreenshotAttachment('invalid');
-        }
-
-        $dataUri = trim((string)($value ?? ''));
-        if ($dataUri === '') {
-            return $this->emptyScreenshotAttachment($this->contextScreenshotStatus($context) ?? 'not_provided');
-        }
-
-        try {
-            $screenshot = self::decodeScreenshotDataUri($dataUri);
-        } catch (RuntimeException $exception) {
-            $message = strtolower($exception->getMessage());
-            return $this->emptyScreenshotAttachment(str_contains($message, 'too large') ? 'too_large' : 'invalid');
-        }
-
-        try {
-            $storedScreenshot = $this->store->storeScreenshot($screenshot['mime_type'], $screenshot['contents']);
-        } catch (Throwable) {
-            return $this->emptyScreenshotAttachment('storage_failed');
-        }
-
-        return [
-            'key' => (string)($storedScreenshot['key'] ?? ''),
-            'mime_type' => (string)($storedScreenshot['mime_type'] ?? $screenshot['mime_type']),
-            'size_bytes' => (int)($storedScreenshot['size_bytes'] ?? $screenshot['size_bytes']),
-            'status' => 'stored',
-        ];
-    }
-
-    private function emptyScreenshotAttachment(string $status): array
-    {
-        return [
-            'key' => '',
-            'mime_type' => '',
-            'size_bytes' => 0,
-            'status' => $status,
-        ];
-    }
-
-    private function contextScreenshotStatus(array $context): ?string
-    {
-        $attachment = $context['screenshot_attachment'] ?? null;
-        $status = is_array($attachment) ? ($attachment['status'] ?? null) : null;
-        $status ??= $context['screenshot_capture_status'] ?? $context['screenshot_status'] ?? null;
-
-        return $this->normalizeEmptyScreenshotStatus($status);
-    }
-
-    private function normalizeEmptyScreenshotStatus(mixed $status): ?string
-    {
-        $status = strtolower(trim((string)$status));
-        if (in_array($status, ['capture_failed', 'not_provided'], true)) {
-            return $status;
-        }
-
-        return null;
-    }
-
    private function runtimeContext(array $payload, array $context): array
    {
        return [
@@ -498,10 +432,6 @@ class error_report_service

    private function publicReport(array $row, bool $includeDetail): array
    {
-        $screenshotMimeType = trim((string)($row['screenshot_mime_type'] ?? ''));
-        $screenshotSizeBytes = isset($row['screenshot_size_bytes']) ? (int)$row['screenshot_size_bytes'] : 0;
-        $hasScreenshot = $screenshotMimeType !== '' && $screenshotSizeBytes > 0;
-
        $report = [
            'id' => (int)$row['id'],
            'status' => (string)$row['status'],
@@ -519,10 +449,10 @@ class error_report_service
            'release_trace_id' => $row['release_trace_id'] ?? null,
            'frontend_version' => $row['frontend_version'] ?? null,
            'api_version' => $row['api_version'] ?? null,
-            'screenshot' => $hasScreenshot ? [
-                'mime_type' => $screenshotMimeType,
-                'size_bytes' => $screenshotSizeBytes,
-            ] : null,
+            'screenshot' => [
+                'mime_type' => $row['screenshot_mime_type'] ?? null,
+                'size_bytes' => isset($row['screenshot_size_bytes']) ? (int)$row['screenshot_size_bytes'] : 0,
+            ],
            'answers' => [
                'before_error' => $row['before_error'] ?? '',
                'expected' => $row['expected'] ?? '',
@@ -537,11 +467,8 @@ class error_report_service
        ];

        if ($includeDetail) {
-            if ($hasScreenshot) {
-                $objectKey = trim((string)($row['screenshot_object_key'] ?? ''));
-                $report['screenshot']['url'] = $this->store->screenshotUrl($objectKey);
-                $report['screenshot']['object_key'] = $objectKey !== '' ? $objectKey : null;
-            }
+            $report['screenshot']['url'] = $this->store->screenshotUrl((string)($row['screenshot_object_key'] ?? ''));
+            $report['screenshot']['object_key'] = $row['screenshot_object_key'] ?? null;
            $report['request_errors'] = $this->jsonDecode($row['request_errors_json'] ?? null);
            $report['vue_errors'] = $this->jsonDecode($row['vue_errors_json'] ?? null);
            $report['runtime_context'] = $this->jsonDecode($row['runtime_context_json'] ?? null);
@@ -38,8 +38,6 @@ class gateway_shelly_transport implements shelly_transport_i
        return match ($endpoint) {
            '/v2/devices/api/get' => $this->handleGetStates($department_id, $data),
            '/v2/devices/api/set/switch' => $this->handleSetSwitch($department_id, $data),
-            '/v2/devices/api/batch/get' => $this->handleBatchGetStates($department_id, $data),
-            '/v2/devices/api/batch/set/switch' => $this->handleBatchSetSwitch($department_id, $data),
            default => throw new Exception('Unsupported gateway Shelly transport endpoint: ' . $endpoint),
        };
    }
@@ -97,52 +95,6 @@ class gateway_shelly_transport implements shelly_transport_i
        return [$this->normalizeRelayPayload($logicalRelayId, $status)];
    }

-    /**
-     * @throws Exception
-     */
-    private function handleBatchGetStates(int $departmentId, array $data): array
-    {
-        $requests = [];
-        foreach ((array)($data['commands'] ?? $data['targets'] ?? []) as $entry) {
-            $command = is_array($entry) ? $entry : ['relay_id' => $entry];
-            $relayId = trim((string)($command['relay_id'] ?? $command['relayId'] ?? $command['id'] ?? ''));
-            if ($relayId === '') {
-                continue;
-            }
-            $requests[] = [
-                'target' => strtoupper(trim((string)($command['target'] ?? $relayId))),
-                'relay_id' => $relayId,
-            ];
-        }
-
-        return $this->manager()->queueRelayStatusBatch($departmentId, $requests, null, $this->localOnly);
-    }
-
-    /**
-     * @throws Exception
-     */
-    private function handleBatchSetSwitch(int $departmentId, array $data): array
-    {
-        $requests = [];
-        foreach ((array)($data['commands'] ?? []) as $entry) {
-            if (!is_array($entry)) {
-                continue;
-            }
-            $relayId = trim((string)($entry['relay_id'] ?? $entry['relayId'] ?? $entry['id'] ?? ''));
-            if ($relayId === '') {
-                continue;
-            }
-            $requests[] = [
-                'target' => strtoupper(trim((string)($entry['target'] ?? $relayId))),
-                'relay_id' => $relayId,
-                'on' => (bool)($entry['on'] ?? false),
-                'toggle_after' => $entry['toggle_after'] ?? $entry['toggleAfter'] ?? $entry['timer'] ?? null,
-            ];
-        }
-
-        return $this->manager()->queueRelaySwitchBatch($departmentId, $requests, null, $this->localOnly);
-    }
-
    /**
     * @param array<string,mixed> $status
     * @return array<string,mixed>
@@ -1,617 +0,0 @@
-<?php
-
-namespace classes;
-
-use Exception;
-use objects\collected_order_invoices_o;
-use objects\logs_o;
-use objects\order_items_o;
-use objects\orders_o;
-use objects\products_o;
-use objects\users_o;
-
-class invoice_collection_bulk_action_service
-{
-    public const ACTION_CLEAN_CUSTOMER_RULES = 'remove_customer_rule_violations';
-    public const ACTION_MERGE = 'merge_collections';
-    public const ACTION_SPLIT_BY_MONTH = 'split_by_month';
-    public const ACTION_RESET_HIDDEN_PRICES = 'reset_hidden_item_prices';
-    public const ACTION_QUEUE_ECONOMIC = 'queue_economic';
-
-    private const PREVIEW_TTL_SECONDS = 600;
-    private const MAX_COLLECTIONS = 100;
-    private const CONFIRMATION_PHRASES = [
-        'da' => 'Bekræft',
-        'en' => 'Confirm',
-        'sv' => 'Bekräfta',
-        'no' => 'Bekreft',
-        'de' => 'Bestätigen',
-    ];
-
-    public function preview(string $action, array $invoiceCollectionIds, array $options = [], string $locale = 'da'): array
-    {
-        $action = $this->normalizeAction($action);
-        $invoiceCollectionIds = $this->normalizeInvoiceCollectionIds($invoiceCollectionIds);
-        $options = $this->normalizeOptions($options);
-
-        $preview = $this->buildPreview($action, $invoiceCollectionIds, $options, $locale);
-        $previewId = $this->previewId();
-        $preview['preview_id'] = $previewId;
-        $preview['selection_hash'] = $this->selectionHash($action, $invoiceCollectionIds, $options);
-        $preview['confirmation_phrase'] = $this->confirmationPhrase($locale);
-
-        $this->cachePreview($previewId, [
-            'action' => $action,
-            'invoice_collection_ids' => $invoiceCollectionIds,
-            'options' => $options,
-            'locale' => $locale,
-            'selection_hash' => $preview['selection_hash'],
-            'preview' => $preview,
-        ]);
-
-        return $preview;
-    }
-
-    public function apply(
-        string $previewId,
-        string $action,
-        array $invoiceCollectionIds,
-        array $options,
-        string $confirmationText,
-        int $actorUserId,
-        string $locale = 'da'
-    ): array {
-        global $db;
-
-        $action = $this->normalizeAction($action);
-        $invoiceCollectionIds = $this->normalizeInvoiceCollectionIds($invoiceCollectionIds);
-        $options = $this->normalizeOptions($options);
-        $cached = $this->getCachedPreview($previewId);
-        $selectionHash = $this->selectionHash($action, $invoiceCollectionIds, $options);
-
-        if (!$cached || ($cached['selection_hash'] ?? '') !== $selectionHash) {
-            throw new Exception('Preview is missing, expired, or no longer matches the selected invoice collections.');
-        }
-
-        $expectedConfirmation = (string)($cached['preview']['confirmation_phrase'] ?? $this->confirmationPhrase($locale));
-        if (trim($confirmationText) !== $expectedConfirmation) {
-            throw new Exception('Confirmation text does not match.');
-        }
-
-        $freshPreview = $this->buildPreview($action, $invoiceCollectionIds, $options, (string)($cached['locale'] ?? $locale));
-        if (!empty($freshPreview['blockers'])) {
-            throw new Exception('Action cannot be applied while blockers are present.');
-        }
-
-        $db->conn()->begin_transaction();
-        try {
-            $result = match ($action) {
-                self::ACTION_CLEAN_CUSTOMER_RULES => $this->applyCleanCustomerRules($freshPreview),
-                self::ACTION_MERGE => $this->applyMerge($freshPreview, $options),
-                self::ACTION_SPLIT_BY_MONTH => $this->applySplitByMonth($freshPreview),
-                self::ACTION_RESET_HIDDEN_PRICES => $this->applyResetHiddenPrices($freshPreview),
-                self::ACTION_QUEUE_ECONOMIC => [
-                    'queued_invoice_collection_ids' => $invoiceCollectionIds,
-                    'changed_count' => count($invoiceCollectionIds),
-                ],
-                default => throw new Exception('Unsupported action'),
-            };
-            (new logs_o())->add(
-                'orderInvoices',
-                'global',
-                1,
-                $actorUserId,
-                'APPLY_COLLECTED_INVOICE_BULK_ACTION',
-                'Applied collected invoice bulk action ' . $action . ' to ' . count($invoiceCollectionIds) . ' invoice collections'
-            );
-            $db->conn()->commit();
-        } catch (\Throwable $e) {
-            $db->conn()->rollback();
-            throw $e;
-        }
-
-        $this->deleteCachedPreview($previewId);
-
-        return [
-            ...$freshPreview,
-            'preview' => false,
-            'result' => $result,
-        ];
-    }
-
-    private function buildPreview(string $action, array $invoiceCollectionIds, array $options, string $locale): array
-    {
-        $collections = $this->loadCollections($invoiceCollectionIds);
-        $base = [
-            'action' => $action,
-            'preview' => true,
-            'confirmation_phrase' => $this->confirmationPhrase($locale),
-            'invoice_collection_ids' => $invoiceCollectionIds,
-            'collections' => array_map(fn(collected_order_invoices_o $collection): array => $this->collectionSummary($collection), $collections),
-            'warnings' => [],
-            'blockers' => [],
-        ];
-
-        return match ($action) {
-            self::ACTION_CLEAN_CUSTOMER_RULES => $this->previewCleanCustomerRules($base, $collections),
-            self::ACTION_MERGE => $this->previewMerge($base, $collections, $options),
-            self::ACTION_SPLIT_BY_MONTH => $this->previewSplitByMonth($base, $collections),
-            self::ACTION_RESET_HIDDEN_PRICES => $this->previewResetHiddenPrices($base, $collections),
-            self::ACTION_QUEUE_ECONOMIC => $this->previewQueueEconomic($base, $collections),
-            default => throw new Exception('Unsupported action'),
-        };
-    }
-
-    private function previewCleanCustomerRules(array $preview, array $collections): array
-    {
-        $items = [];
-        $blockers = [];
-        foreach ($collections as $collection) {
-            $blockers = [...$blockers, ...$this->contentMutationBlockers($collection)];
-            $rows = $this->orderItemRows((int)$collection->id);
-            $violatingItemIds = [];
-            $includedItemIds = [];
-            foreach ($rows as $row) {
-                $violation = (new customer_product_rule_service())->firstViolationForOrderItem(
-                    (int)$row['order_id'],
-                    (int)$row['product_id'],
-                    empty($row['related_item_id']) ? null : (int)$row['related_item_id']
-                );
-                if ($violation === null) {
-                    continue;
-                }
-                $violatingItemIds[] = (int)$row['order_item_id'];
-                $includedItemIds[] = (int)$row['order_item_id'];
-                $items[] = [
-                    'invoice_collection_id' => (int)$collection->id,
-                    'order_id' => (int)$row['order_id'],
-                    'order_item_id' => (int)$row['order_item_id'],
-                    'product_id' => (int)$row['product_id'],
-                    'product_name' => (string)$row['product_name'],
-                    'rule' => (string)$violation['rule'],
-                    'price' => (int)$row['price'],
-                    'quantity' => (int)$row['quantity'],
-                    'will_soft_delete' => true,
-                ];
-            }
-
-            foreach ($rows as $row) {
-                $orderItemId = (int)$row['order_item_id'];
-                $relatedItemId = empty($row['related_item_id']) ? null : (int)$row['related_item_id'];
-                if ($relatedItemId === null || !in_array($relatedItemId, $violatingItemIds, true) || in_array($orderItemId, $includedItemIds, true)) {
-                    continue;
-                }
-                $includedItemIds[] = $orderItemId;
-                $items[] = [
-                    'invoice_collection_id' => (int)$collection->id,
-                    'order_id' => (int)$row['order_id'],
-                    'order_item_id' => $orderItemId,
-                    'product_id' => (int)$row['product_id'],
-                    'product_name' => (string)$row['product_name'],
-                    'rule' => 'related_to_removed_item',
-                    'price' => (int)$row['price'],
-                    'quantity' => (int)$row['quantity'],
-                    'will_soft_delete' => true,
-                ];
-            }
-        }
-
-        return [
-            ...$preview,
-            'order_items' => $items,
-            'summary' => [
-                'collections' => count($collections),
-                'order_items' => count($items),
-                'changed_count' => count($items),
-            ],
-            'blockers' => $blockers,
-        ];
-    }
-
-    private function previewMerge(array $preview, array $collections, array $options): array
-    {
-        $targetId = (int)($options['target_invoice_collection_id'] ?? 0);
-        $blockers = [];
-        if (count($collections) < 2) {
-            $blockers[] = ['code' => 'merge_requires_multiple_collections', 'message' => 'Merge requires at least two invoice collections.'];
-        }
-        if ($targetId < 1 || !in_array($targetId, array_map(static fn($collection): int => (int)$collection->id, $collections), true)) {
-            $blockers[] = ['code' => 'invalid_merge_target', 'message' => 'A selected invoice collection must be chosen as merge target.'];
-        }
-        $customerNumbers = array_values(array_unique(array_map(static fn($collection): int => (int)$collection->customer_number->value(), $collections)));
-        if (count($customerNumbers) !== 1) {
-            $blockers[] = ['code' => 'merge_cross_customer', 'message' => 'Only invoice collections for the same customer can be merged.'];
-        }
-        foreach ($collections as $collection) {
-            $blockers = [...$blockers, ...$this->contentMutationBlockers($collection)];
-        }
-
-        $ordersToMove = [];
-        foreach ($collections as $collection) {
-            if ((int)$collection->id === $targetId) {
-                continue;
-            }
-            foreach ($collection->getOrderIds() as $orderIdRow) {
-                $ordersToMove[] = [
-                    'order_id' => (int)$orderIdRow['id'],
-                    'source_invoice_collection_id' => (int)$collection->id,
-                    'target_invoice_collection_id' => $targetId,
-                ];
-            }
-        }
-
-        return [
-            ...$preview,
-            'target_invoice_collection_id' => $targetId,
-            'orders' => $ordersToMove,
-            'summary' => [
-                'collections' => count($collections),
-                'orders_to_move' => count($ordersToMove),
-                'changed_count' => count($ordersToMove),
-            ],
-            'blockers' => $blockers,
-        ];
-    }
-
-    private function previewSplitByMonth(array $preview, array $collections): array
-    {
-        $items = [];
-        $changed = [];
-        $skipped = [];
-        foreach ($collections as $collection) {
-            try {
-                $item = [
-                    'invoice_collection_id' => (int)$collection->id,
-                    ...$collection->previewSplitByOrderMonth(),
-                ];
-                if (($item['status'] ?? '') === 'changed') {
-                    $changed[] = $item;
-                } else {
-                    $skipped[] = $item;
-                }
-                $items[] = $item;
-            } catch (\Throwable $e) {
-                $item = [
-                    'status' => 'skipped',
-                    'invoice_collection_id' => (int)$collection->id,
-                    'reason' => 'not_splittable',
-                    'message' => $e->getMessage(),
-                ];
-                $skipped[] = $item;
-                $items[] = $item;
-            }
-        }
-
-        return [
-            ...$preview,
-            'items' => $items,
-            'changed' => $changed,
-            'skipped' => $skipped,
-            'summary' => [
-                'collections' => count($collections),
-                'changed_count' => count($changed),
-                'skipped_count' => count($skipped),
-            ],
-        ];
-    }
-
-    private function previewResetHiddenPrices(array $preview, array $collections): array
-    {
-        $items = [];
-        $blockers = [];
-        foreach ($collections as $collection) {
-            $blockers = [...$blockers, ...$this->contentMutationBlockers($collection)];
-            foreach ($this->orderItemRows((int)$collection->id, true) as $row) {
-                if ((int)$row['include_in_invoice'] !== 0) {
-                    continue;
-                }
-                $order = (new orders_o())->select((int)$row['order_id']);
-                $product = (new products_o())->select((int)$row['product_id']);
-                if (!$order->exists() || !$product->exists()) {
-                    continue;
-                }
-                $newPrice = (int)$order->getCustomerProductPrice($product);
-                if ((int)$row['price'] === $newPrice) {
-                    continue;
-                }
-                $items[] = [
-                    'invoice_collection_id' => (int)$collection->id,
-                    'order_id' => (int)$row['order_id'],
-                    'order_item_id' => (int)$row['order_item_id'],
-                    'product_id' => (int)$row['product_id'],
-                    'product_name' => (string)$row['product_name'],
-                    'current_price' => (int)$row['price'],
-                    'new_price' => $newPrice,
-                ];
-            }
-        }
-
-        return [
-            ...$preview,
-            'order_items' => $items,
-            'summary' => [
-                'collections' => count($collections),
-                'order_items' => count($items),
-                'changed_count' => count($items),
-            ],
-            'blockers' => $blockers,
-        ];
-    }
-
-    private function previewQueueEconomic(array $preview, array $collections): array
-    {
-        $blockers = [];
-        foreach ($collections as $collection) {
-            if (!empty($collection->booked_invoice_id->value())) {
-                $blockers[] = [
-                    'code' => 'collection_booked',
-                    'invoice_collection_id' => (int)$collection->id,
-                    'message' => 'Invoice collection is already booked.',
-                ];
-            }
-        }
-        return [
-            ...$preview,
-            'summary' => [
-                'collections' => count($collections),
-                'changed_count' => count($collections),
-            ],
-            'blockers' => $blockers,
-        ];
-    }
-
-    private function applyCleanCustomerRules(array $preview): array
-    {
-        global $db;
-        $itemIds = array_values(array_unique(array_map(static fn(array $item): int => (int)$item['order_item_id'], $preview['order_items'] ?? [])));
-        if ($itemIds === []) {
-            return ['changed_count' => 0, 'order_item_ids' => []];
-        }
-        $ids = implode(',', array_map('intval', $itemIds));
-        $now = date('Y-m-d H:i:s');
-        $safeNow = $db->escape_string($now);
-        $db->query("UPDATE order_items SET deleted_at = '$safeNow' WHERE deleted_at IS NULL AND id IN ($ids)");
-        $this->touchOrdersForItems($itemIds);
-        $this->touchCollections($preview['invoice_collection_ids'] ?? []);
-        return ['changed_count' => count($itemIds), 'order_item_ids' => $itemIds];
-    }
-
-    private function applyMerge(array $preview, array $options): array
-    {
-        $targetId = (int)($options['target_invoice_collection_id'] ?? 0);
-        $moved = [];
-        foreach ($preview['orders'] ?? [] as $row) {
-            $order = (new orders_o())->select((int)$row['order_id']);
-            if (!$order->exists()) {
-                continue;
-            }
-            $order->assignToInvoiceCollection($targetId);
-            $moved[] = (int)$order->id;
-        }
-        $this->touchCollections($preview['invoice_collection_ids'] ?? []);
-        return ['changed_count' => count($moved), 'moved_order_ids' => $moved, 'target_invoice_collection_id' => $targetId];
-    }
-
-    private function applySplitByMonth(array $preview): array
-    {
-        $changed = [];
-        $skipped = [];
-        foreach ($preview['items'] ?? [] as $item) {
-            $invoiceCollectionId = (int)($item['invoice_collection_id'] ?? 0);
-            if (($item['status'] ?? '') !== 'changed' || $invoiceCollectionId < 1) {
-                $skipped[] = $item;
-                continue;
-            }
-            try {
-                $changed[] = (new collected_order_invoices_o())->select($invoiceCollectionId)->splitByOrderMonth();
-            } catch (\Throwable $e) {
-                $skipped[] = [
-                    'invoice_collection_id' => $invoiceCollectionId,
-                    'status' => 'skipped',
-                    'message' => $e->getMessage(),
-                ];
-            }
-        }
-        return ['changed_count' => count($changed), 'skipped_count' => count($skipped), 'changed' => $changed, 'skipped' => $skipped];
-    }
-
-    private function applyResetHiddenPrices(array $preview): array
-    {
-        $changed = [];
-        foreach ($preview['order_items'] ?? [] as $item) {
-            $orderItem = (new order_items_o())->select((int)$item['order_item_id']);
-            if (!$orderItem->exists()) {
-                continue;
-            }
-            $orderItem->price->set((int)$item['new_price']);
-            $orderItem->objectChanged();
-            $changed[] = (int)$orderItem->id;
-        }
-        $this->touchCollections($preview['invoice_collection_ids'] ?? []);
-        return ['changed_count' => count($changed), 'order_item_ids' => $changed];
-    }
-
-    private function contentMutationBlockers(collected_order_invoices_o $collection): array
-    {
-        $blockers = [];
-        if (!empty($collection->booked_invoice_id->value())) {
-            $blockers[] = ['code' => 'collection_booked', 'invoice_collection_id' => (int)$collection->id, 'message' => 'Invoice collection is already booked.'];
-        }
-        if (!empty($collection->external_id->value())) {
-            $blockers[] = ['code' => 'collection_exported', 'invoice_collection_id' => (int)$collection->id, 'message' => 'Invoice collection already has an external invoice reference.'];
-        }
-        return $blockers;
-    }
-
-    private function orderItemRows(int $invoiceCollectionId, bool $includeHidden = false): array
-    {
-        global $db;
-        $hiddenCondition = $includeHidden ? '' : 'AND oi.include_in_invoice = 1';
-        $sql = "
-            SELECT
-                oi.id AS order_item_id,
-                oi.order_id,
-                oi.product_id,
-                oi.related_item_id,
-                oi.include_in_invoice,
-                oi.price,
-                oi.quantity,
-                p.name AS product_name
-            FROM order_items oi
-            JOIN orders o ON o.id = oi.order_id
-            JOIN products p ON p.id = oi.product_id
-            WHERE o.invoice_collection_id = {$invoiceCollectionId}
-              AND o.deleted_at IS NULL
-              AND oi.deleted_at IS NULL
-              {$hiddenCondition}
-            ORDER BY o.id ASC, oi.id ASC
-        ";
-        $result = $db->query($sql);
-        return $result ? $result->fetch_all(MYSQLI_ASSOC) : [];
-    }
-
-    private function touchOrdersForItems(array $itemIds): void
-    {
-        global $db;
-        if ($itemIds === []) {
-            return;
-        }
-        $ids = implode(',', array_map('intval', $itemIds));
-        $result = $db->query("SELECT DISTINCT order_id FROM order_items WHERE id IN ($ids)");
-        if (!$result) {
-            return;
-        }
-        while ($row = $result->fetch_assoc()) {
-            $order = (new orders_o())->select((int)$row['order_id']);
-            if ($order->exists()) {
-                $order->objectChanged();
-            }
-        }
-    }
-
-    private function touchCollections(array $invoiceCollectionIds): void
-    {
-        foreach ($invoiceCollectionIds as $invoiceCollectionId) {
-            $collection = (new collected_order_invoices_o())->select((int)$invoiceCollectionId);
-            if ($collection->exists()) {
-                $collection->objectChanged();
-            }
-        }
-    }
-
-    private function loadCollections(array $invoiceCollectionIds): array
-    {
-        return array_map(static function (int $invoiceCollectionId): collected_order_invoices_o {
-            $collection = (new collected_order_invoices_o())->select($invoiceCollectionId);
-            $collection->requireSelected();
-            return $collection;
-        }, $invoiceCollectionIds);
-    }
-
-    private function collectionSummary(collected_order_invoices_o $collection): array
-    {
-        return [
-            'id' => (int)$collection->id,
-            'customer_number' => (int)$collection->customer_number->value(),
-            'name' => (string)$collection->name->value(),
-            'created_at' => (string)$collection->created_at->value(),
-            'closed_at' => $collection->closed_at->value(),
-            'booked_invoice_id' => $collection->booked_invoice_id->value(),
-            'external_id' => $collection->external_id->value(),
-            'order_count' => (int)$collection->getOrders(true),
-        ];
-    }
-
-    private function normalizeAction(string $action): string
-    {
-        $action = trim($action);
-        if (!in_array($action, [
-            self::ACTION_CLEAN_CUSTOMER_RULES,
-            self::ACTION_MERGE,
-            self::ACTION_SPLIT_BY_MONTH,
-            self::ACTION_RESET_HIDDEN_PRICES,
-            self::ACTION_QUEUE_ECONOMIC,
-        ], true)) {
-            throw new Exception('Invalid invoice collection bulk action.');
-        }
-        return $action;
-    }
-
-    private function normalizeInvoiceCollectionIds(array $ids): array
-    {
-        $normalized = [];
-        foreach ($ids as $id) {
-            if (is_array($id) || is_object($id) || !is_numeric($id)) {
-                throw new Exception('invoice_collection_ids must contain only positive integer ids.');
-            }
-            $parsed = (int)$id;
-            if ($parsed < 1 || $parsed > 999999999) {
-                throw new Exception('invoice_collection_ids must contain only positive integer ids.');
-            }
-            $normalized[$parsed] = $parsed;
-        }
-        $normalized = array_values($normalized);
-        sort($normalized);
-        if ($normalized === []) {
-            throw new Exception('invoice_collection_ids must contain at least one id.');
-        }
-        if (count($normalized) > self::MAX_COLLECTIONS) {
-            throw new Exception('Too many invoice collections selected.');
-        }
-        return $normalized;
-    }
-
-    private function normalizeOptions(array $options): array
-    {
-        if (isset($options['target_invoice_collection_id'])) {
-            $options['target_invoice_collection_id'] = (int)$options['target_invoice_collection_id'];
-        }
-        ksort($options);
-        return $options;
-    }
-
-    private function selectionHash(string $action, array $invoiceCollectionIds, array $options): string
-    {
-        return hash('sha256', json_encode([
-            'action' => $action,
-            'invoice_collection_ids' => $invoiceCollectionIds,
-            'options' => $options,
-        ], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));
-    }
-
-    private function confirmationPhrase(string $locale): string
-    {
-        $language = strtolower(substr(trim($locale), 0, 2));
-        return self::CONFIRMATION_PHRASES[$language] ?? self::CONFIRMATION_PHRASES['en'];
-    }
-
-    private function previewId(): string
-    {
-        return bin2hex(random_bytes(16));
-    }
-
-    private function previewCacheKey(string $previewId): string
-    {
-        return 'collected_invoice_bulk_action_preview:' . preg_replace('/[^a-f0-9]/', '', strtolower($previewId));
-    }
-
-    private function cachePreview(string $previewId, array $payload): void
-    {
-        (new redis())->setEx($this->previewCacheKey($previewId), json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES), self::PREVIEW_TTL_SECONDS);
-    }
-
-    private function getCachedPreview(string $previewId): ?array
-    {
-        $raw = (new redis())->get($this->previewCacheKey($previewId));
-        if (!$raw) {
-            return null;
-        }
-        $decoded = json_decode($raw, true);
-        return is_array($decoded) ? $decoded : null;
-    }
-
-    private function deleteCachedPreview(string $previewId): void
-    {
-        (new redis())->delete($this->previewCacheKey($previewId));
-    }
-}
@@ -22,7 +22,6 @@ class invoice_period_flag_service
    private const ORDER_FIELDS = ['customer', 'reference', 'po', 'notes'];
    private const ORDER_ITEM_FIELDS = ['notes', 'quantity', 'reference', 'price'];
    private const WASH_CERTIFICATE_PRODUCT_ID = 41;
-    private const SPOT_FREE_PRODUCT_IDS = [23, 24];
    private array $economicCustomerDiscountCache = [];
    private array $userDisplayNameCache = [];
    private array $orderItemsPreviewCache = [];
@@ -31,8 +30,6 @@ class invoice_period_flag_service
    public function __construct()
    {
        invoice_period_flag_schema_bootstrap::ensureTables();
-        price_overrides_schema_bootstrap::ensureColumns();
-        department_customer_price_overrides_schema_bootstrap::ensureTables();
    }

    public function createManualFlag(array $payload, int $userId): array
@@ -323,16 +320,6 @@ class invoice_period_flag_service
    }

    public function warmManualFlagsCache(): void
-    {
-        $flags = $this->fetchActiveManualFlagsFromDb();
-
-        try {
-            (new redis())->cache_invoice_period_manual_flags($flags);
-        } catch (Throwable) {
-        }
-    }
-
-    private function fetchActiveManualFlagsFromDb(): array
    {
        global $db;

@@ -350,7 +337,10 @@ class invoice_period_flag_service
            }
        }

-        return $flags;
+        try {
+            (new redis())->cache_invoice_period_manual_flags($flags);
+        } catch (Throwable) {
+        }
    }

    private function formatStoredFlag(array $row): array
@@ -398,11 +388,15 @@ class invoice_period_flag_service
        }

        if (!is_array($flags)) {
-            // Cache miss — read from the database and refresh Redis without hiding active flags.
-            $flags = $this->fetchActiveManualFlagsFromDb();
+            // Cache miss — warm on demand and re-fetch
+            $this->warmManualFlagsCache();
            try {
-                (new redis())->cache_invoice_period_manual_flags($flags);
+                $flags = (new redis())->get_invoice_period_manual_flags();
            } catch (Throwable) {
+                return [];
+            }
+            if (!is_array($flags)) {
+                return [];
            }
        }

@@ -531,12 +525,16 @@ class invoice_period_flag_service
        try {
            $flags = (new redis())->get_invoice_period_automatic_flags($dateFrom, $dateTo);
        } catch (Throwable) {
-            $flags = null;
+            return [];
        }

        if (!is_array($flags)) {
-            $flags = $this->calculateAutomaticFlagsForPeriod($dateFrom, $dateTo);
-            $this->cacheAutomaticFlagsForPeriod($dateFrom, $dateTo, $flags);
+            // Cache miss — enqueue for warming on the next cron run
+            try {
+                (new redis())->enqueue_invoice_period_warming($dateFrom, $dateTo);
+            } catch (Throwable) {
+            }
+            return [];
        }

        if ($onlyCustomerNumbers === null) {
@@ -551,31 +549,17 @@ class invoice_period_flag_service

    public function warmAutomaticFlagsForPeriod(string $dateFrom, string $dateTo): void
    {
-        [$dateFrom, $dateTo] = $this->normalizePeriodDateRange($dateFrom, $dateTo);
-        $this->cacheAutomaticFlagsForPeriod(
-            $dateFrom,
-            $dateTo,
-            $this->calculateAutomaticFlagsForPeriod($dateFrom, $dateTo)
-        );
-    }
-
-    private function calculateAutomaticFlagsForPeriod(string $dateFrom, string $dateTo): array
-    {
-        [$dateFrom, $dateTo] = $this->normalizePeriodDateRange($dateFrom, $dateTo);
        $rows = $this->getPeriodOrderItemRows($dateFrom, $dateTo, null);
        $attributes = $this->getCustomerAttributes(null);

-        return array_merge(
+        $flags = array_merge(
            $this->detectCustomerRuleViolations($rows, $attributes),
            $this->detectPriceMismatches($rows),
            $this->detectAbnormalQuantities($rows, $dateFrom, $dateTo),
            $this->detectVehicleTypeMismatches($rows, $dateFrom),
            $this->detectMissingXlVaskLinks($dateFrom, $dateTo, null)
        );
-    }

-    private function cacheAutomaticFlagsForPeriod(string $dateFrom, string $dateTo, array $flags): void
-    {
        try {
            (new redis())->cache_invoice_period_automatic_flags($dateFrom, $dateTo, $flags);
        } catch (Throwable) {
@@ -619,19 +603,14 @@ class invoice_period_flag_service

    private function getPeriodOrderItemRows(string $dateFrom, string $dateTo, ?array $onlyCustomerNumbers): array
    {
-        [$dateFrom, $dateTo] = $this->normalizePeriodDateRange($dateFrom, $dateTo);
        try {
            $rows = (new redis())->get_invoice_period_order_item_rows($dateFrom, $dateTo);
        } catch (Throwable) {
-            $rows = null;
+            return [];
        }

        if (!is_array($rows)) {
-            $rows = $this->fetchOrderItemRowsFromDb($dateFrom, $dateTo);
-            try {
-                (new redis())->cache_invoice_period_order_item_rows($dateFrom, $dateTo, $rows);
-            } catch (Throwable) {
-            }
+            return [];
        }

        $this->seedOrderItemsPreviewCacheFromRows($rows);
@@ -648,7 +627,6 @@ class invoice_period_flag_service

    public function warmOrderItemRowsForPeriod(string $dateFrom, string $dateTo): void
    {
-        [$dateFrom, $dateTo] = $this->normalizePeriodDateRange($dateFrom, $dateTo);
        $rows = $this->fetchOrderItemRowsFromDb($dateFrom, $dateTo);
        try {
            (new redis())->cache_invoice_period_order_item_rows($dateFrom, $dateTo, $rows);
@@ -656,24 +634,6 @@ class invoice_period_flag_service
        }
    }

-    private function normalizePeriodDateRange(string $dateFrom, string $dateTo): array
-    {
-        return [
-            $this->normalizePeriodDate($dateFrom, true),
-            $this->normalizePeriodDate($dateTo, false),
-        ];
-    }
-
-    private function normalizePeriodDate(string $date, bool $startOfDay): string
-    {
-        $timestamp = strtotime($date);
-        if ($timestamp === false) {
-            return $date;
-        }
-
-        return date($startOfDay ? 'Y-m-d 00:00:00' : 'Y-m-d 23:59:59', $timestamp);
-    }
-
    private function fetchOrderItemRowsFromDb(string $dateFrom, string $dateTo): array
    {
        global $db;
@@ -691,7 +651,6 @@ class invoice_period_flag_service
                o.po AS order_po,
                o.notes AS order_notes,
                o.department_id,
-                d.custom_pricing_only AS department_custom_pricing_only,
                o.reg_1,
                o.invoice_collection_id,
                o.wash_id,
@@ -714,21 +673,8 @@ class invoice_period_flag_service
                p.max_quantity_per_order,
                c.name AS category_name,
                pdp.price AS department_price,
-                CASE
-                    WHEN d.custom_pricing_only = 1 THEN department_product_discount.percentage
-                    ELSE product_discount.percentage
-                END AS product_discount_percentage,
-                CASE
-                    WHEN d.custom_pricing_only = 1 THEN department_product_discount.fixed_price
-                    ELSE product_discount.fixed_price
-                END AS product_fixed_price,
-                CASE
-                    WHEN d.custom_pricing_only = 1 THEN GREATEST(
-                        COALESCE(department_category_discount.percentage, 0),
-                        COALESCE(department_global_discount.percentage, 0)
-                    )
-                    ELSE category_discount.percentage
-                END AS category_discount_percentage
+                product_discount.percentage AS product_discount_percentage,
+                category_discount.percentage AS category_discount_percentage
            FROM orders o
            LEFT JOIN (
                SELECT customer_number, MIN(id) AS id, MAX(display_name) AS display_name
@@ -737,12 +683,11 @@ class invoice_period_flag_service
                GROUP BY customer_number
            ) u ON u.customer_number = o.customer_id
            LEFT JOIN order_items oi ON oi.order_id = o.id AND (oi.deleted_at IS NULL OR oi.deleted_at = '')
-            LEFT JOIN departments d ON d.id = o.department_id
            LEFT JOIN products p ON p.id = oi.product_id
            LEFT JOIN categories c ON c.id = p.category
            LEFT JOIN product_department_prices pdp ON pdp.department_id = o.department_id AND pdp.product_id = p.id
            LEFT JOIN (
-                SELECT discount_user.customer_number, po.product_or_category_id, MAX(po.percentage) AS percentage, MAX(po.fixed_price) AS fixed_price
+                SELECT discount_user.customer_number, po.product_or_category_id, MAX(po.percentage) AS percentage
                FROM price_overrides po
                INNER JOIN users discount_user ON discount_user.id = po.user_id
                WHERE po.is_category = 0
@@ -759,32 +704,6 @@ class invoice_period_flag_service
            ) category_discount
                ON category_discount.customer_number = o.customer_id
               AND category_discount.product_or_category_id = p.category
-            LEFT JOIN (
-                SELECT department_id, user_id, product_or_category_id, MAX(percentage) AS percentage, MAX(fixed_price) AS fixed_price
-                FROM department_customer_price_overrides
-                WHERE is_category = 0
-                GROUP BY department_id, user_id, product_or_category_id
-            ) department_product_discount
-                ON department_product_discount.department_id = o.department_id
-               AND department_product_discount.user_id = u.id
-               AND department_product_discount.product_or_category_id = p.id
-            LEFT JOIN (
-                SELECT department_id, user_id, product_or_category_id, MAX(percentage) AS percentage
-                FROM department_customer_price_overrides
-                WHERE is_category = 1 AND product_or_category_id <> 'global'
-                GROUP BY department_id, user_id, product_or_category_id
-            ) department_category_discount
-                ON department_category_discount.department_id = o.department_id
-               AND department_category_discount.user_id = u.id
-               AND department_category_discount.product_or_category_id = p.category
-            LEFT JOIN (
-                SELECT department_id, user_id, MAX(percentage) AS percentage
-                FROM department_customer_price_overrides
-                WHERE is_category = 1 AND product_or_category_id = 'global'
-                GROUP BY department_id, user_id
-            ) department_global_discount
-                ON department_global_discount.department_id = o.department_id
-               AND department_global_discount.user_id = u.id
            WHERE o.created_at BETWEEN '{$escapedDateFrom}' AND '{$escapedDateTo}'
              AND o.deleted_at IS NULL
            ORDER BY o.customer_id, o.id, oi.id";
@@ -940,7 +859,7 @@ class invoice_period_flag_service
            }

            $restrictedProducts = [
-                'restrictSpotFree' => ['customer_rule_restrict_spot_free', ['spot free', 'spotfree', 'skylning med ro']],
+                'restrictSpotFree' => ['customer_rule_restrict_spot_free', ['spot free', 'spotfree']],
                'restrictInteriorCleaning' => ['customer_rule_restrict_interior_cleaning', ['interior', 'indvendig']],
                'exemptFromAdministrationFee' => ['customer_rule_exempt_from_administration_fees', ['administration fee', 'administrationsgebyr', 'administration']],
            ];
@@ -1808,7 +1727,18 @@ class invoice_period_flag_service
        if ($currentVehicleType === '' || $expectedVehicleType === '') {
            return false;
        }
-        return $currentVehicleType === $expectedVehicleType;
+        if ($currentVehicleType === $expectedVehicleType) {
+            return true;
+        }
+        // Allow a match if one normalized name's tokens are a subset of the other.
+        // E.g. "Indvendig vask Kassevogn" → "kassevogn" is a subset of
+        // "Kassevogn/varevogn" → "kassevogn varevogn", meaning the same vehicle type.
+        $currentTokens = explode(' ', $currentVehicleType);
+        $expectedTokens = explode(' ', $expectedVehicleType);
+        if (count($currentTokens) <= count($expectedTokens)) {
+            return array_diff($currentTokens, $expectedTokens) === [];
+        }
+        return array_diff($expectedTokens, $currentTokens) === [];
    }

    private function normalizePrimaryVehicleProductName(string $productName): string
@@ -1965,19 +1895,7 @@ class invoice_period_flag_service

    private function calculateExpectedPrice(array $row): int
    {
-        $customMissingPrice = $this->isCustomMissingDepartmentPrice($row);
-        if ($customMissingPrice) {
-            return \objects\products_o::CUSTOM_PRICING_MISSING_PRICE;
-        }
-
-        $fixedPrice = $this->rowProductFixedPrice($row);
-        if ($fixedPrice !== null) {
-            return $fixedPrice;
-        }
-
-        $base = $row['department_price'] !== null
-            ? (int)$row['department_price']
-            : (int)($row['product_base_price'] ?? 0);
+        $base = $row['department_price'] !== null ? (int)$row['department_price'] : (int)($row['product_base_price'] ?? 0);
        $discount = $this->discountBreakdown($row)['applied_discount_percentage'];
        return (int)round($base * (1 - ($discount / 100)));
    }
@@ -1985,18 +1903,13 @@ class invoice_period_flag_service
    private function priceBreakdown(array $row, int $expected): array
    {
        $departmentPrice = $row['department_price'] !== null ? (int)$row['department_price'] : null;
-        $customMissingPrice = $this->isCustomMissingDepartmentPrice($row);
-        $base = $departmentPrice ?? ($customMissingPrice ? \objects\products_o::CUSTOM_PRICING_MISSING_PRICE : (int)($row['product_base_price'] ?? 0));
+        $base = $departmentPrice ?? (int)($row['product_base_price'] ?? 0);
        $discount = $this->discountBreakdown($row);
-        if ($customMissingPrice) {
-            $discount['applied_discount_percentage'] = 0;
-        }

        return [
-            'product_price' => $customMissingPrice ? \objects\products_o::CUSTOM_PRICING_MISSING_PRICE : (int)($row['product_base_price'] ?? 0),
+            'product_price' => (int)($row['product_base_price'] ?? 0),
            'department_price' => $departmentPrice,
            'effective_base_price' => $base,
-            'product_fixed_price' => $this->rowProductFixedPrice($row),
            'product_discount_percentage' => $discount['product_discount_percentage'],
            'category_discount_percentage' => $discount['category_discount_percentage'],
            'economic_customer_discount_percentage' => $discount['economic_customer_discount_percentage'],
@@ -2005,36 +1918,21 @@ class invoice_period_flag_service
        ];
    }

-    private function isCustomMissingDepartmentPrice(array $row): bool
-    {
-        return $row['department_price'] === null && (bool)(int)($row['department_custom_pricing_only'] ?? 0);
-    }
-
    private function discountBreakdown(array $row): array
    {
        $productDiscount = (int)($row['product_discount_percentage'] ?? 0);
        $categoryApplied = (int)($row['apply_category_discount'] ?? 0) === 1;
        $categoryDiscount = $categoryApplied ? (int)($row['category_discount_percentage'] ?? 0) : 0;
        $economicDiscount = $categoryApplied ? $this->economicCustomerDiscountPercentage($row) : 0;
-        $appliedDiscount = $this->rowProductFixedPrice($row) !== null
-            ? 0
-            : max($productDiscount, $categoryDiscount, $economicDiscount);

        return [
            'product_discount_percentage' => $productDiscount,
            'category_discount_percentage' => $categoryDiscount,
            'economic_customer_discount_percentage' => $economicDiscount,
-            'applied_discount_percentage' => $appliedDiscount,
+            'applied_discount_percentage' => max($productDiscount, $categoryDiscount, $economicDiscount),
        ];
    }

-    private function rowProductFixedPrice(array $row): ?int
-    {
-        return array_key_exists('product_fixed_price', $row) && $row['product_fixed_price'] !== null
-            ? (int)$row['product_fixed_price']
-            : null;
-    }
-
    private function economicCustomerDiscountPercentage(array $row): int
    {
        $customerNumber = (int)($row['customer_number'] ?? 0);
@@ -2098,11 +1996,6 @@ class invoice_period_flag_service

    private function rowMatchesProductTerms(array $row, array $terms): bool
    {
-        if (in_array((int)($row['product_id'] ?? 0), self::SPOT_FREE_PRODUCT_IDS, true)
-            && in_array('spotfree', array_map('strtolower', $terms), true)) {
-            return true;
-        }
-
        $haystack = strtolower(trim(
            (string)($row['product_name'] ?? '') . ' ' .
            (string)($row['category_name'] ?? '')
@@ -2117,7 +2010,8 @@ class invoice_period_flag_service

    private function rowIsTankCleaningProduct(array $row): bool
    {
-        return customer_order_product_policy::isTankCleaningProductRow($row);
+        return (int)($row['product_category'] ?? 0) === 5
+            || $this->rowMatchesProductTerms($row, ['tank cleaning', 'tankcleaning', 'tankrens']);
    }

    private function isIncludedOrderItem(array $row): bool
@@ -10,22 +10,6 @@ use licenseplaterecognizer\licenseplaterecognizer_c;

 class licenseplaterecognizer implements licenseplaterecognizer_i
 {
-    private const DEFAULT_API_URL = 'https://vs4sws0kg4sog4ssw8kwowk4.coolify.truckwash.dk';
-    private const PLATE_READER_CONFIG_JSON = '{"mode":"fast","plates_per_vehicle":1,"zoom_in_vehicles":0}';
-    private const RESULT_CACHE_CONTEXT = '{"config":{"mode":"fast","plates_per_vehicle":1,"zoom_in_vehicles":0},"regions":"dk,de,se,no"}';
-    private const PLATE_READER_REGIONS = 'dk,de,se,no';
-    private const DEFAULT_UPLOAD_FILE_NAME = 'license-plate.jpg';
-    private const RUNTIME_CONFIG_CACHE_TTL_SECONDS = 15;
-    private const RUNTIME_CONFIG_REDIS_CACHE_KEY = 'licenseplaterecognizer:runtime_config:v1';
-    private const RESULT_CACHE_TTL_SECONDS = 10;
-    private const RESULT_CACHE_REDIS_KEY_PREFIX = 'licenseplaterecognizer:result:v1:';
-    private const PLATE_READER_CONNECT_TIMEOUT_MS = 1000;
-    private const PLATE_READER_TOTAL_TIMEOUT_MS = 4500;
-    /**
-     * @var array<string, float>
-     */
-    private array $last_timings = [];
-
    /**
     * The configuration of the module
     * @var licenseplaterecognizer_c
@@ -35,25 +19,12 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
     * API URL
     * @var string
     */
-    private string $api_url;
+    private string $api_url = 'https://vs4sws0kg4sog4ssw8kwowk4.coolify.truckwash.dk'; // Default (cloud): 'https://api.platerecognizer.com'; (without /v1/plate-reader/)';

-    /**
-     * @var array{enabled: bool, api_key: string}|null
-     */
-    private ?array $runtime_config = null;

-    /**
-     * @var array{values: array{enabled: bool, api_key: string}, cached_at: float}|null
-     */
-    private static ?array $runtime_config_cache = null;
-
-    public function __construct(bool $load_config = true, ?string $api_url = null)
+    public function __construct()
    {
-        $this->api_url = self::normalizeApiUrl($api_url ?? self::configuredApiUrl());
-
-        if ($load_config) {
-            $this->config = new licenseplaterecognizer_c();
-        }
+        $this->config = new licenseplaterecognizer_c();
    }


@@ -62,7 +33,7 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
     */
    public function requireModuleEnabled(): void
    {
-        if (!$this->runtimeConfig()['enabled']) {
+        if (!(bool)$this->config->enabled->getVariableValue()) {
            throw new Exception('licenseplaterecognizer module is not enabled.');
        }
    }
@@ -74,516 +45,54 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
     */
    public function licenseplaterecognizer(string $base64_image): array
    {
-        return $this->recognizePlate(
-            fn () => $this->buildPlateReaderPayload($base64_image),
-            fn () => $this->buildResultCacheKeyFromUploadString($base64_image)
-        );
-    }
+        $image_processor = new image_processor();

-    public function licenseplaterecognizerUpload(string $image_data, string $mime_type = 'image/jpeg'): array
-    {
-        return $this->recognizePlate(
-            fn () => $this->buildPlateReaderPayloadFromUpload(
-                $this->buildUploadValueFromBytes($image_data, $mime_type)
-            ),
-            fn () => $this->buildResultCacheKeyFromBytes($image_data)
+        //ADD PARAMETER IN REQUEST LIKE regions
+        $data = array(
+            'upload' => $base64_image,
+            //'regions' => 'dk' // Optional
        );
-    }

-    public function licenseplaterecognizerUploadUncached(string $image_data, string $mime_type = 'image/jpeg'): array
-    {
-        return $this->recognizePlate(
-            fn () => $this->buildPlateReaderPayloadFromUpload(
-                $this->buildUploadValueFromBytes($image_data, $mime_type)
+        // Prepare new cURL resource
+        //$ch = curl_init('https://api.platerecognizer.com/v1/plate-reader/');
+        $ch = curl_init($this->api_url . '/v1/plate-reader/');
+        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($ch, CURLINFO_HEADER_OUT, true);
+        curl_setopt($ch, CURLOPT_POST, true);
+        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
+        curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
+
+        // Set HTTP Header for POST request
+        curl_setopt($ch, CURLOPT_HTTPHEADER, array(
+                "Authorization: Token " . $this->config->api_key->getVariableValue()
            )
        );
-    }

-    public function licenseplaterecognizerUploadFile(string $image_path, string $mime_type = 'image/jpeg'): array
-    {
-        return $this->recognizePlate(
-            fn () => $this->buildPlateReaderPayloadFromUpload(
-                $this->buildUploadValueFromFile($image_path, $mime_type)
-            )
-        );
-    }
+        // Submit the POST request and close cURL session handle
+        $result = curl_exec($ch);
+        curl_close($ch);
+        // Print the response from the server
+        if ($result === false) {
+            throw new Exception('Error in API request.');
+        }

-    /**
-     * @throws Exception
-     */
-    private function recognizePlate(callable $payload_factory, ?callable $result_cache_key_factory = null): array
-    {
-        $started_at = microtime(true);
-        $this->last_timings = [];
-        $result_cache = null;
-        $result_cache_key = null;
-
-        try {
-            $config_started_at = microtime(true);
-            $runtime_config = $this->runtimeConfig();
-            if (!$runtime_config['enabled']) {
-                throw new Exception('licenseplaterecognizer module is not enabled.');
-            }
-            $api_key = $runtime_config['api_key'];
-            $this->last_timings['config'] = $this->elapsedMs($config_started_at);
-
-            if ($result_cache_key_factory !== null) {
-                $cache_started_at = microtime(true);
-                try {
-                    $result_cache = $this->resultCacheStore();
-                    if ($result_cache !== null) {
-                        $result_cache_key = $result_cache_key_factory();
-                        if ($result_cache_key !== null) {
-                            $cached_result = $this->readRecognitionResultCache($result_cache, $result_cache_key);
-                            if ($cached_result !== null) {
-                                $this->last_timings['cache_hit'] = 1;
-                                return $cached_result;
-                            }
-                        }
-                    }
-                    $this->last_timings['cache_miss'] = 1;
-                } finally {
-                    $this->last_timings['cache'] = $this->elapsedMs($cache_started_at);
-                }
-            }
-
-            $payload_started_at = microtime(true);
-            $data = $payload_factory();
-            $this->last_timings['payload'] = $this->elapsedMs($payload_started_at);
-
-            $ch = curl_init($this->api_url . '/v1/plate-reader/');
-            if (!$ch instanceof \CurlHandle) {
-                throw new Exception('Error initializing API request.');
-            }
-
-            $curl_options = [
-                CURLOPT_RETURNTRANSFER => true,
-                CURLOPT_POST => true,
-                CURLOPT_POSTFIELDS => $data,
-                CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_2TLS,
-                CURLOPT_CONNECTTIMEOUT_MS => self::PLATE_READER_CONNECT_TIMEOUT_MS,
-                CURLOPT_TIMEOUT_MS => self::PLATE_READER_TOTAL_TIMEOUT_MS,
-                CURLOPT_NOSIGNAL => true,
-                CURLOPT_NOPROGRESS => false,
-                CURLOPT_XFERINFOFUNCTION => self::clientDisconnectAbortCallback(),
-                CURLOPT_HTTPHEADER => [
-                    "Authorization: Token " . $api_key,
-                    'Expect:',
-                ],
+        $response_data = json_decode($result, true);
+        if (isset($response_data['results']) && count($response_data['results']) > 0) {
+            return [
+                'success' => true,
+                'license_plate_number' => $response_data['results'][0]['plate'] ?? null,
+                'confidence' => $response_data['results'][0]['score'] ?? null,
+                'raw_response' => $response_data,
            ];
-            if (defined('CURLOPT_TCP_NODELAY')) {
-                $curl_options[(int)constant('CURLOPT_TCP_NODELAY')] = true;
-            }
-            curl_setopt_array($ch, $curl_options);
-
-            // Submit the POST request and close cURL session handle
-            $upstream_started_at = microtime(true);
-            $result = curl_exec($ch);
-            $this->last_timings['upstream'] = $this->elapsedMs($upstream_started_at);
-            $this->recordCurlTimings($ch);
-            curl_close($ch);
-
-            // Print the response from the server
-            if ($result === false) {
-                throw new Exception('Error in API request.');
-            }
-
-            $parse_started_at = microtime(true);
-            $response_data = json_decode($result, true);
-            $this->last_timings['parse'] = $this->elapsedMs($parse_started_at);
-            $this->recordResponseTimings($response_data);
-
-            if (isset($response_data['results']) && count($response_data['results']) > 0) {
-                $recognized_result = [
-                    'success' => true,
-                    'license_plate_number' => $response_data['results'][0]['plate'] ?? null,
-                    'confidence' => $response_data['results'][0]['score'] ?? null,
-                ];
-
-                $this->writeRecognitionResultCache($result_cache, $result_cache_key, $recognized_result);
-
-                return $recognized_result;
-            }
-
-            $recognized_result = [
+        } else {
+            return [
                'success' => false,
                'message' => 'No license plate detected.',
+                'raw_response' => $response_data,
            ];
-            $this->writeRecognitionResultCache($result_cache, $result_cache_key, $recognized_result);
-
-            return $recognized_result;
-        } finally {
-            $this->last_timings['total'] = $this->elapsedMs($started_at);
        }
    }

-    private static function clientDisconnectAbortCallback(): callable
-    {
-        return static function (): int {
-            return connection_aborted() ? 1 : 0;
-        };
-    }
-
-    public function getLastTimings(): array
-    {
-        return $this->last_timings;
-    }
-
-    private function elapsedMs(float $started_at): float
-    {
-        return (microtime(true) - $started_at) * 1000;
-    }
-
-    private static function configuredApiUrl(): string
-    {
-        $configured = getenv('PLATE_RECOGNIZER_API_URL');
-        if ($configured === false || trim((string)$configured) === '') {
-            $configured = $_ENV['PLATE_RECOGNIZER_API_URL'] ?? $_SERVER['PLATE_RECOGNIZER_API_URL'] ?? self::DEFAULT_API_URL;
-        }
-
-        return (string)$configured;
-    }
-
-    private static function normalizeApiUrl(string $api_url): string
-    {
-        $api_url = trim($api_url);
-        if ($api_url === '') {
-            return self::DEFAULT_API_URL;
-        }
-
-        return rtrim($api_url, '/');
-    }
-
-    private function recordCurlTimings(\CurlHandle $curl_handle): void
-    {
-        $mapping = [
-            CURLINFO_NAMELOOKUP_TIME => 'upstream_dns',
-            CURLINFO_CONNECT_TIME => 'upstream_connect',
-            CURLINFO_APPCONNECT_TIME => 'upstream_tls',
-            CURLINFO_PRETRANSFER_TIME => 'upstream_pretransfer',
-            CURLINFO_STARTTRANSFER_TIME => 'upstream_ttfb',
-            CURLINFO_TOTAL_TIME => 'upstream_total',
-        ];
-
-        foreach ($mapping as $curl_info_option => $timing_key) {
-            $value = curl_getinfo($curl_handle, $curl_info_option);
-            if (!is_numeric($value)) {
-                continue;
-            }
-
-            $this->last_timings[$timing_key] = max(0, (float)$value * 1000);
-        }
-    }
-
-    private function recordResponseTimings(mixed $response_data): void
-    {
-        if (!is_array($response_data) || !isset($response_data['processing_time']) || !is_numeric($response_data['processing_time'])) {
-            return;
-        }
-
-        $this->last_timings['upstream_processing'] = max(0, (float)$response_data['processing_time']);
-    }
-
-    private function buildResultCacheKeyFromUploadString(string $base64_image): string
-    {
-        $base64_image = trim($base64_image);
-        if (preg_match('/^data:image\/[a-zA-Z0-9.+-]+;base64,(.*)$/s', $base64_image, $matches) === 1) {
-            $image_data = base64_decode((string)$matches[1], true);
-            if (is_string($image_data)) {
-                return $this->buildResultCacheKeyFromBytes($image_data);
-            }
-        }
-
-        return $this->buildResultCacheKeyFromBytes($base64_image);
-    }
-
-    private function buildResultCacheKeyFromBytes(string $image_data): string
-    {
-        $context = hash_init('sha256');
-        hash_update($context, $this->resultCacheContext());
-        hash_update($context, "\0");
-        hash_update($context, $image_data);
-
-        return self::RESULT_CACHE_REDIS_KEY_PREFIX . hash_final($context);
-    }
-
-    private function resultCacheContext(): string
-    {
-        return self::RESULT_CACHE_CONTEXT;
-    }
-
-    protected function resultCacheStore(): ?object
-    {
-        return $this->runtimeConfigCacheStore();
-    }
-
-    private function readRecognitionResultCache(?object $cache, ?string $key): ?array
-    {
-        if ($cache === null || $key === null || !method_exists($cache, 'get')) {
-            return null;
-        }
-
-        try {
-            $cached = $cache->get($key);
-        } catch (\Throwable) {
-            return null;
-        }
-
-        if (!is_string($cached) || trim($cached) === '') {
-            return null;
-        }
-
-        $decoded = json_decode($cached, true);
-        if (!is_array($decoded) || !array_key_exists('success', $decoded)) {
-            return null;
-        }
-
-        return $decoded;
-    }
-
-    private function writeRecognitionResultCache(?object $cache, ?string $key, array $result): void
-    {
-        if ($cache === null || $key === null || !method_exists($cache, 'setEx')) {
-            return;
-        }
-
-        try {
-            $encoded = json_encode($result, JSON_UNESCAPED_SLASHES);
-            if (is_string($encoded)) {
-                $cache->setEx($key, $encoded, self::RESULT_CACHE_TTL_SECONDS);
-            }
-        } catch (\Throwable) {
-            // Scanner result cache is best-effort; Plate Recognizer remains the source of truth.
-        }
-    }
-
-    protected function buildPlateReaderPayload(string $base64_image): array
-    {
-        return $this->buildPlateReaderPayloadFromUpload($this->buildUploadValue($base64_image));
-    }
-
-    protected function buildPlateReaderPayloadFromUpload(string|\CURLFile|\CURLStringFile $upload): array
-    {
-        return [
-            'upload' => $upload,
-            'config' => self::PLATE_READER_CONFIG_JSON,
-            'regions' => self::PLATE_READER_REGIONS,
-        ];
-    }
-
-    private function buildUploadValue(string $base64_image): string|\CURLStringFile
-    {
-        $base64_image = trim($base64_image);
-        if (preg_match('/^data:(image\/[a-zA-Z0-9.+-]+);base64,(.*)$/s', $base64_image, $matches) !== 1) {
-            return $base64_image;
-        }
-
-        $image_data = base64_decode((string)$matches[2], true);
-        if ($image_data === false || !class_exists(\CURLStringFile::class)) {
-            return (string)$matches[2];
-        }
-
-        return new \CURLStringFile($image_data, self::DEFAULT_UPLOAD_FILE_NAME, (string)$matches[1]);
-    }
-
-    private function buildUploadValueFromBytes(string $image_data, string $mime_type): string|\CURLStringFile
-    {
-        $mime_type = trim($mime_type) !== '' ? trim($mime_type) : 'image/jpeg';
-        if (!str_starts_with($mime_type, 'image/')) {
-            $mime_type = 'image/jpeg';
-        }
-
-        if (!class_exists(\CURLStringFile::class)) {
-            return $image_data;
-        }
-
-        return new \CURLStringFile($image_data, self::DEFAULT_UPLOAD_FILE_NAME, $mime_type);
-    }
-
-    /**
-     * @throws Exception
-     */
-    private function buildUploadValueFromFile(string $image_path, string $mime_type): \CURLFile
-    {
-        $image_path = trim($image_path);
-        $mime_type = trim($mime_type) !== '' ? trim($mime_type) : 'image/jpeg';
-        if (!str_starts_with($mime_type, 'image/')) {
-            $mime_type = 'image/jpeg';
-        }
-
-        if ($image_path === '' || !is_file($image_path) || !class_exists(\CURLFile::class)) {
-            throw new Exception('Image upload file is invalid.');
-        }
-
-        return new \CURLFile($image_path, $mime_type, self::DEFAULT_UPLOAD_FILE_NAME);
-    }
-
-    protected function runtimeConfig(): array
-    {
-        if ($this->runtime_config !== null) {
-            return $this->runtime_config;
-        }
-
-        if ($this->shouldUseSharedRuntimeConfigCache()) {
-            $cached_config = self::getSharedRuntimeConfigCache();
-            if ($cached_config !== null) {
-                $this->runtime_config = $cached_config;
-
-                return $this->runtime_config;
-            }
-
-            $cached_config = $this->readRuntimeConfigCacheStore();
-            if ($cached_config !== null) {
-                self::$runtime_config_cache = [
-                    'values' => $cached_config,
-                    'cached_at' => microtime(true),
-                ];
-                $this->runtime_config = $cached_config;
-
-                return $this->runtime_config;
-            }
-        }
-
-        $values = $this->readRuntimeModuleConfig();
-
-        $this->runtime_config = [
-            'enabled' => $this->parseModuleConfigBool($values['enabled'] ?? false),
-            'api_key' => (string)($values['api_key'] ?? ''),
-        ];
-
-        if ($this->shouldUseSharedRuntimeConfigCache()) {
-            self::$runtime_config_cache = [
-                'values' => $this->runtime_config,
-                'cached_at' => microtime(true),
-            ];
-            $this->writeRuntimeConfigCacheStore($this->runtime_config);
-        }
-
-        return $this->runtime_config;
-    }
-
-    protected function shouldUseSharedRuntimeConfigCache(): bool
-    {
-        return static::class === self::class;
-    }
-
-    private static function getSharedRuntimeConfigCache(): ?array
-    {
-        if (self::$runtime_config_cache === null) {
-            return null;
-        }
-
-        $cache_age_seconds = microtime(true) - self::$runtime_config_cache['cached_at'];
-        if ($cache_age_seconds > self::RUNTIME_CONFIG_CACHE_TTL_SECONDS) {
-            self::$runtime_config_cache = null;
-
-            return null;
-        }
-
-        return self::$runtime_config_cache['values'];
-    }
-
-    protected function runtimeConfigCacheStore(): ?object
-    {
-        return defined('redis') ? constant('redis') : null;
-    }
-
-    private function readRuntimeConfigCacheStore(): ?array
-    {
-        $cache = $this->runtimeConfigCacheStore();
-        if ($cache === null || !method_exists($cache, 'get')) {
-            return null;
-        }
-
-        try {
-            $cached = $cache->get(self::RUNTIME_CONFIG_REDIS_CACHE_KEY);
-        } catch (\Throwable) {
-            return null;
-        }
-
-        if (!is_string($cached) || trim($cached) === '') {
-            return null;
-        }
-
-        $decoded = json_decode($cached, true);
-        if (!is_array($decoded)) {
-            return null;
-        }
-
-        if (!array_key_exists('enabled', $decoded) || !array_key_exists('api_key', $decoded)) {
-            return null;
-        }
-
-        return [
-            'enabled' => $this->parseModuleConfigBool($decoded['enabled']),
-            'api_key' => (string)$decoded['api_key'],
-        ];
-    }
-
-    /**
-     * @param array{enabled: bool, api_key: string} $config
-     */
-    private function writeRuntimeConfigCacheStore(array $config): void
-    {
-        $cache = $this->runtimeConfigCacheStore();
-        if ($cache === null || !method_exists($cache, 'setEx')) {
-            return;
-        }
-
-        try {
-            $encoded = json_encode($config, JSON_UNESCAPED_SLASHES);
-            if (is_string($encoded)) {
-                $cache->setEx(self::RUNTIME_CONFIG_REDIS_CACHE_KEY, $encoded, self::RUNTIME_CONFIG_CACHE_TTL_SECONDS);
-            }
-        } catch (\Throwable) {
-            // Scanner config cache is best-effort; DB remains the source of truth.
-        }
-    }
-
-    private function parseModuleConfigBool(mixed $value): bool
-    {
-        if (is_bool($value)) {
-            return $value;
-        }
-
-        if (is_numeric($value)) {
-            return (int)$value === 1;
-        }
-
-        return strtolower(trim((string)$value)) === 'true';
-    }
-
-    protected function readRuntimeModuleConfig(): array
-    {
-        global $db;
-
-        if ($db instanceof db) {
-            $module = $db->escape_string('licenseplaterecognizer');
-            $result = $db->query("SELECT variable, value FROM module_config WHERE module = '$module' AND variable IN ('enabled', 'api_key')");
-            $values = [];
-
-            if ($result instanceof \mysqli_result) {
-                while ($row = $result->fetch_assoc()) {
-                    $variable = (string)($row['variable'] ?? '');
-                    if ($variable !== '') {
-                        $values[$variable] = (string)($row['value'] ?? '');
-                    }
-                }
-            }
-
-            return $values;
-        }
-
-        if (!isset($this->config)) {
-            $this->config = new licenseplaterecognizer_c();
-        }
-
-        return [
-            'enabled' => (string)$this->config->enabled->getVariableValue(),
-            'api_key' => (string)$this->config->api_key->getVariableValue(),
-        ];
-    }
-
    /**
     * @inheritDoc
     * @throws Exception If the module is not enabled or if there is an error in the API request
@@ -591,8 +100,8 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
     */
    public function get_usage(): licenseplaterecognizer_info
    {
+        // Require the module to be enabled
        $this->requireModuleEnabled();
-        $api_key = $this->runtimeConfig()['api_key'];
        $curl = curl_init();
        curl_setopt_array($curl, array(
            CURLOPT_URL => $this->api_url . '/info/',
@@ -603,9 +112,9 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_2TLS,
            CURLOPT_CUSTOMREQUEST => 'GET',
-            CURLOPT_HTTPHEADER => [
-                'Authorization: Token ' . $api_key,
-            ],
+            CURLOPT_HTTPHEADER => array(
+                'Authorization: Token ' . $this->config->api_key->getVariableValue()
+            ),
        ));
        $response = curl_exec($curl);
        curl_close($curl);
@@ -615,4 +124,4 @@ class licenseplaterecognizer implements licenseplaterecognizer_i
        }
        return new licenseplaterecognizer_info($response_data);
    }
-}
+}
@@ -1,24 +0,0 @@
-<?php
-
-namespace classes;
-
-class limited_backoffice_exception extends \RuntimeException
-{
-    public function __construct(
-        string $message,
-        private readonly int $statusCode = 400,
-        private readonly ?array $payload = null
-    ) {
-        parent::__construct($message);
-    }
-
-    public function statusCode(): int
-    {
-        return $this->statusCode;
-    }
-
-    public function payload(): array|string
-    {
-        return $this->payload ?? $this->getMessage();
-    }
-}
@@ -1,43 +0,0 @@
-<?php
-
-namespace classes;
-
-class limited_backoffice_schema_bootstrap
-{
-    private static bool $initialized = false;
-
-    public static function ensureTables(): void
-    {
-        if (self::$initialized) {
-            return;
-        }
-
-        global $db;
-
-        if (!isset($db) || !is_object($db) || !method_exists($db, 'query')) {
-            return;
-        }
-
-        $db->query(<<<'SQL'
-CREATE TABLE IF NOT EXISTS `limited_backoffice_employees` (
-    `id` INT UNSIGNED NOT NULL AUTO_INCREMENT,
-    `user_id` INT NOT NULL,
-    `managed_group_id` INT NOT NULL,
-    `role_key` VARCHAR(64) NOT NULL,
-    `department_ids` LONGTEXT NOT NULL,
-    `created_by_user_id` INT NOT NULL,
-    `updated_by_user_id` INT NULL,
-    `deactivated_at` DATETIME NULL,
-    `created_at` DATETIME NULL DEFAULT CURRENT_TIMESTAMP,
-    `updated_at` DATETIME NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-    PRIMARY KEY (`id`),
-    UNIQUE KEY `uniq_limited_backoffice_employees_user_id` (`user_id`),
-    KEY `idx_limited_backoffice_employees_group_id` (`managed_group_id`),
-    KEY `idx_limited_backoffice_employees_role_key` (`role_key`),
-    KEY `idx_limited_backoffice_employees_deactivated_at` (`deactivated_at`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
-SQL);
-
-        self::$initialized = true;
-    }
-}
@@ -340,49 +340,18 @@ class n8n implements n8n_i
            throw new Exception('Webhook target must not be empty.');
        }

+        if (filter_var($target, FILTER_VALIDATE_URL) !== false) {
+            return $target;
+        }
+
        $baseUrl = trim((string)$this->config->webhook_base_url->getVariableValue());
        if ($baseUrl === '') {
            throw new Exception('n8n webhook base URL is not configured.');
        }

-        if (filter_var($target, FILTER_VALIDATE_URL) !== false) {
-            if (!$this->isAllowedWebhookAbsoluteUrl($target, $baseUrl)) {
-                throw new Exception('Webhook URL must use the configured n8n webhook host.');
-            }
-
-            return $target;
-        }
-
        return rtrim($baseUrl, '/') . '/' . ltrim($target, '/');
    }

-    private function isAllowedWebhookAbsoluteUrl(string $targetUrl, string $baseUrl): bool
-    {
-        $targetParts = parse_url($targetUrl);
-        $baseParts = parse_url($baseUrl);
-
-        if (!is_array($targetParts) || !is_array($baseParts)) {
-            return false;
-        }
-
-        $targetHost = strtolower((string)($targetParts['host'] ?? ''));
-        $baseHost = strtolower((string)($baseParts['host'] ?? ''));
-        if ($targetHost === '' || $baseHost === '' || $targetHost !== $baseHost) {
-            return false;
-        }
-
-        $targetScheme = strtolower((string)($targetParts['scheme'] ?? ''));
-        $baseScheme = strtolower((string)($baseParts['scheme'] ?? ''));
-        if ($targetScheme === '' || $baseScheme === '' || $targetScheme !== $baseScheme) {
-            return false;
-        }
-
-        $targetPort = (int)($targetParts['port'] ?? ($targetScheme === 'https' ? 443 : 80));
-        $basePort = (int)($baseParts['port'] ?? ($baseScheme === 'https' ? 443 : 80));
-
-        return $targetPort === $basePort;
-    }
-
    /**
     * @throws Exception
     */
@@ -46,7 +46,7 @@ class order_reference_suggestions_service
        $rows = [
            ...$this->fetchBookingRows($departmentId, $search),
            ...$this->fetchOrderRows($departmentId, $search),
-            ...$this->fetchVehicleRows($departmentId, $customerId, $plates, $search),
+            ...$this->fetchVehicleRows($customerId, $plates, $search),
        ];

        $suggestions = $this->aggregateRows($rows, $search, $customerId, $plates);
@@ -137,7 +137,7 @@ class order_reference_suggestions_service
     * @param array<int, string> $plates
     * @return array<int, array<string, mixed>>
     */
-    private function fetchVehicleRows(int $departmentId, ?int $customerId, array $plates, string $search): array
+    private function fetchVehicleRows(?int $customerId, array $plates, string $search): array
    {
        $contextWhere = [];
        $params = [];
@@ -171,10 +171,6 @@ class order_reference_suggestions_service
            $params['search'] = '%' . $this->lower($search) . '%';
        }

-        $where[] = $this->vehicleDepartmentAccessPredicate();
-        $params['orders_department_id'] = $departmentId;
-        $params['bookings_department_id'] = $departmentId;
-
        $sql = "SELECT
                    'vehicle' AS source,
                    id AS origin_id,
@@ -194,41 +190,6 @@ class order_reference_suggestions_service
        return $this->fetchRows($sql, $params);
    }

-    private function vehicleDepartmentAccessPredicate(): string
-    {
-        $ordersWhere = [
-            'authorized_orders.department_id = :orders_department_id',
-            '(authorized_orders.customer_id = customer_vehicles.customer_id'
-                . " OR UPPER(REPLACE(authorized_orders.reg_1, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', ''))"
-                . " OR UPPER(REPLACE(authorized_orders.reg_2, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', ''))"
-                . " OR UPPER(REPLACE(authorized_orders.reg_3, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', '')))"
-        ];
-        if ($this->tableHasColumn('orders', 'deleted_at')) {
-            $ordersWhere[] = 'authorized_orders.deleted_at IS NULL';
-        }
-
-        $bookingsWhere = [
-            'authorized_bookings.department = :bookings_department_id',
-            '(authorized_bookings.customer_number = customer_vehicles.customer_id'
-                . " OR UPPER(REPLACE(authorized_bookings.reg_1, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', ''))"
-                . " OR UPPER(REPLACE(authorized_bookings.reg_2, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', ''))"
-                . " OR UPPER(REPLACE(authorized_bookings.reg_3, ' ', '')) = UPPER(REPLACE(customer_vehicles.reg, ' ', '')))"
-        ];
-        if ($this->tableHasColumn('order_bookings', 'deleted_at')) {
-            $bookingsWhere[] = 'authorized_bookings.deleted_at IS NULL';
-        }
-
-        return '(EXISTS (
-                    SELECT 1
-                    FROM orders authorized_orders
-                    WHERE ' . implode(' AND ', $ordersWhere) . '
-                ) OR EXISTS (
-                    SELECT 1
-                    FROM order_bookings authorized_bookings
-                    WHERE ' . implode(' AND ', $bookingsWhere) . '
-                ))';
-    }
-
    /**
     * @param array<string, mixed> $params
     * @return array<int, array<string, mixed>>
@@ -58,9 +58,6 @@ class orders_schema_bootstrap
            || !self::columnExists($db, 'orders', 'booking_id')
            || !self::columnExists($db, 'orders', 'po')
            || !self::columnExists($db, 'order_bookings', 'po')
-            || !self::columnExists($db, 'order_bookings', 'customer_number')
-            || !self::columnExists($db, 'order_bookings', 'department')
-            || !self::columnExists($db, 'order_bookings', 'deleted_at')
        ) {
            return;
        }
@@ -68,9 +65,6 @@ class orders_schema_bootstrap
        $db->query(
            "UPDATE orders o
                INNER JOIN order_bookings b ON b.id = o.booking_id
-                    AND b.customer_number = o.customer_id
-                    AND b.department = o.department_id
-                    AND b.deleted_at IS NULL
                SET o.po = b.po
                WHERE o.booking_id IS NOT NULL
                    AND o.booking_id > 0
@@ -47,12 +47,8 @@ class pdf_store implements minio_pdfs_i
     */
    public function download(string $file): string
    {
-        if ($this->shouldUseLocalTestStorage()) {
-            return $this->getLocalTestObjectPath($file);
-        }
-
        $path = '/tmp/' . $file;
-        self::getS3Client()->getObject([
+        $result = self::getS3Client()->getObject([
            'Bucket' => self::getBucket(),
            'Key' => $file,
            'SaveAs' => $path
@@ -1,68 +0,0 @@
-<?php
-
-namespace classes;
-
-/**
- * Ensures additive schema for customer product price overrides.
- */
-class price_overrides_schema_bootstrap
-{
-    private static bool $initialized = false;
-
-    public static function ensureColumns(): void
-    {
-        if (self::$initialized) {
-            return;
-        }
-
-        global $db;
-
-        if (!isset($db) || !is_object($db) || !method_exists($db, 'query')) {
-            return;
-        }
-
-        if (!self::tableExists($db, 'price_overrides')) {
-            return;
-        }
-
-        if (!self::columnExists($db, 'price_overrides', 'fixed_price')) {
-            $db->query(
-                "ALTER TABLE price_overrides
-                    ADD COLUMN fixed_price INT NULL DEFAULT NULL
-                    AFTER percentage"
-            );
-        }
-
-        self::$initialized = true;
-    }
-
-    private static function tableExists(object $db, string $table): bool
-    {
-        $table = self::escapeIdentifier($table);
-        $result = $db->query("SHOW TABLES LIKE '{$table}'");
-
-        if ($result === false || !is_object($result) || !property_exists($result, 'num_rows')) {
-            return false;
-        }
-
-        return (int)$result->num_rows > 0;
-    }
-
-    private static function columnExists(object $db, string $table, string $column): bool
-    {
-        $table = self::escapeIdentifier($table);
-        $column = self::escapeIdentifier($column);
-        $result = $db->query("SHOW COLUMNS FROM `{$table}` LIKE '{$column}'");
-
-        if ($result === false || !is_object($result) || !property_exists($result, 'num_rows')) {
-            return false;
-        }
-
-        return (int)$result->num_rows > 0;
-    }
-
-    private static function escapeIdentifier(string $value): string
-    {
-        return str_replace(['\\', "'", '`'], ['\\\\', "\\'", ''], $value);
-    }
-}
@@ -392,19 +392,7 @@ class redis implements redis_i

    private function invoicePeriodCacheKey(string $prefix, string $dateFrom, string $dateTo): string
    {
-        return $prefix . ':'
-            . $this->normalizeInvoicePeriodCacheDate($dateFrom, true) . ':'
-            . $this->normalizeInvoicePeriodCacheDate($dateTo, false);
-    }
-
-    private function normalizeInvoicePeriodCacheDate(string $date, bool $startOfDay): string
-    {
-        $timestamp = strtotime($date);
-        if ($timestamp === false) {
-            return $date;
-        }
-
-        return date($startOfDay ? 'Y-m-d 00:00:00' : 'Y-m-d 23:59:59', $timestamp);
+        return $prefix . ':' . $dateFrom . ':' . $dateTo;
    }

    private function workfeedEmployeeNameCacheKey(string $employeeId): string
@@ -524,11 +512,7 @@ class redis implements redis_i
     */
    public function enqueue_invoice_period_warming(string $dateFrom, string $dateTo): self
    {
-        $this->get_client()->sadd('invoice_period_warming_queue', [
-            $this->normalizeInvoicePeriodCacheDate($dateFrom, true)
-                . '|'
-                . $this->normalizeInvoicePeriodCacheDate($dateTo, false),
-        ]);
+        $this->get_client()->sadd('invoice_period_warming_queue', [$dateFrom . '|' . $dateTo]);
        return $this;
    }

@@ -118,35 +118,6 @@ class release_manager_schema_bootstrap
                INDEX idx_release_targets_coolify (coolify_instance_id, coolify_service_uuid)
            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",

-            "CREATE TABLE IF NOT EXISTS release_auto_sync_events (
-                id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
-                channel_id BIGINT UNSIGNED NOT NULL,
-                app VARCHAR(16) NOT NULL,
-                repository VARCHAR(255) NOT NULL,
-                branch VARCHAR(128) NOT NULL,
-                commit_sha VARCHAR(64) NOT NULL,
-                status VARCHAR(32) NOT NULL DEFAULT 'pending',
-                source VARCHAR(64) NULL,
-                workflow_url VARCHAR(512) NULL,
-                gate_operation_id BIGINT UNSIGNED NULL,
-                sync_operation_id BIGINT UNSIGNED NULL,
-                deployment_id BIGINT UNSIGNED NULL,
-                error_message TEXT NULL,
-                metadata_json LONGTEXT NULL,
-                received_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-                gate_passed_at DATETIME NULL,
-                synced_at DATETIME NULL,
-                promoted_at DATETIME NULL,
-                failed_at DATETIME NULL,
-                created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-                updated_at TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-                UNIQUE KEY uq_release_auto_sync_event (channel_id, app, repository, branch, commit_sha),
-                INDEX idx_release_auto_sync_channel_status (channel_id, status, updated_at),
-                INDEX idx_release_auto_sync_gate (gate_operation_id),
-                INDEX idx_release_auto_sync_sync (sync_operation_id),
-                INDEX idx_release_auto_sync_deployment (deployment_id)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
-
            "CREATE TABLE IF NOT EXISTS release_service_sets (
                id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
                channel_id BIGINT UNSIGNED NULL,
@@ -437,7 +408,6 @@ class release_manager_schema_bootstrap
            'release_versions',
            'release_channel_versions',
            'release_assignments',
-            'release_auto_sync_events',
            'release_service_sets',
            'release_deployments',
            'release_bundles',
@@ -89,7 +89,7 @@ class router
        }
        // Regex
        $route = str_replace('/', '\/', $route);
-        $route = preg_replace('/{[a-zA-Z0-9_]+}/', '([a-zA-Z0-9]+)', $route);
+        $route = preg_replace('/{[a-zA-Z0-9]+}/', '([a-zA-Z0-9]+)', $route);
        if (preg_match('/^' . $route . '$/', $this->url)) {
            return true;
        }
@@ -73,9 +73,7 @@ class selfserve_schema_bootstrap
                INDEX idx_selfserve_wash_sessions_lane_reg (lane_id, reg),
                INDEX idx_selfserve_wash_sessions_status (status),
                INDEX idx_selfserve_wash_sessions_customer (customer_number),
-                INDEX idx_selfserve_wash_sessions_created_at (created_at),
-                INDEX idx_selfserve_wash_sessions_department_completed (department_id, completed_at),
-                INDEX idx_selfserve_wash_sessions_order (order_id)
+                INDEX idx_selfserve_wash_sessions_created_at (created_at)
            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",

            "CREATE TABLE IF NOT EXISTS selfserve_wash_session_answers (
@@ -97,7 +95,7 @@ class selfserve_schema_bootstrap
                session_id INT NOT NULL,
                task_id INT NULL,
                task_text VARCHAR(255) NOT NULL,
-                description TEXT NULL,
+                description VARCHAR(255) NULL,
                services JSON NULL,
                buttons JSON NULL,
                dynamic_image_id INT NULL,
@@ -141,28 +139,6 @@ class selfserve_schema_bootstrap
                UNIQUE KEY uniq_selfserve_vhw_department (department_id),
                INDEX idx_selfserve_vhw_dept_updated (department_id, updated_at)
            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
-
-            "CREATE TABLE IF NOT EXISTS department_selfserve_path_confirmations (
-                id INT AUTO_INCREMENT PRIMARY KEY,
-                department_id INT NOT NULL,
-                lane_id INT NULL,
-                vehicle_type_id INT NULL,
-                config_version_id INT NULL,
-                config_source VARCHAR(32) NOT NULL DEFAULT 'draft',
-                path_signature VARCHAR(128) NOT NULL,
-                result_signature VARCHAR(128) NOT NULL,
-                answers_json JSON NOT NULL,
-                result_json JSON NOT NULL,
-                scope_json JSON NULL,
-                confirmed_by INT NULL,
-                confirmed_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-                stale_reason VARCHAR(255) NULL,
-                created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-                updated_at TIMESTAMP NULL DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
-                deleted_at TIMESTAMP NULL DEFAULT NULL,
-                INDEX idx_selfserve_path_conf_department_scope (department_id, lane_id, vehicle_type_id, config_version_id),
-                INDEX idx_selfserve_path_conf_signature (department_id, config_version_id, path_signature)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
        ];

        foreach ($queries as $sql) {
@@ -199,18 +175,6 @@ class selfserve_schema_bootstrap
            'gate_ref_id',
            'ALTER TABLE department_selfserve_tasks ADD COLUMN gate_ref_id INT NULL AFTER gate_type'
        );
-        self::ensureColumnDataType(
-            'department_selfserve_tasks',
-            'description',
-            ['text', 'mediumtext', 'longtext'],
-            'ALTER TABLE department_selfserve_tasks MODIFY COLUMN description TEXT NULL AFTER task'
-        );
-        self::ensureColumnDataType(
-            'selfserve_wash_session_tasks',
-            'description',
-            ['text', 'mediumtext', 'longtext'],
-            'ALTER TABLE selfserve_wash_session_tasks MODIFY COLUMN description TEXT NULL AFTER task_text'
-        );
        self::ensureColumn(
            'selfserve_wash_session_tasks',
            'dynamic_images_vehicle_type',
@@ -221,16 +185,6 @@ class selfserve_schema_bootstrap
            'wash_started_at',
            'ALTER TABLE selfserve_wash_sessions ADD COLUMN wash_started_at DATETIME NULL AFTER machine_start_triggered_at'
        );
-        self::ensureIndex(
-            'selfserve_wash_sessions',
-            'idx_selfserve_wash_sessions_department_completed',
-            'ALTER TABLE selfserve_wash_sessions ADD INDEX idx_selfserve_wash_sessions_department_completed (department_id, completed_at)'
-        );
-        self::ensureIndex(
-            'selfserve_wash_sessions',
-            'idx_selfserve_wash_sessions_order',
-            'ALTER TABLE selfserve_wash_sessions ADD INDEX idx_selfserve_wash_sessions_order (order_id)'
-        );

        self::$initialized = true;
    }
@@ -263,78 +217,4 @@ class selfserve_schema_bootstrap
        }
        $db->query($alterSql);
    }
-
-    public static function tableHasIndex(string $table, string $index): bool
-    {
-        global $db;
-        $table = $db->escape_string($table);
-        $index = $db->escape_string($index);
-        $database = $db->escape_string($db->getDatabase());
-
-        $sql = "SELECT COUNT(*) AS c
-                FROM information_schema.STATISTICS
-                WHERE TABLE_SCHEMA = '$database'
-                  AND TABLE_NAME = '$table'
-                  AND INDEX_NAME = '$index'";
-        $result = $db->query($sql);
-        if (!$result) {
-            return false;
-        }
-        $row = $result->fetch_assoc();
-        return ((int)($row['c'] ?? 0)) > 0;
-    }
-
-    public static function ensureIndex(string $table, string $index, string $alterSql): void
-    {
-        global $db;
-        if (self::tableHasIndex($table, $index)) {
-            return;
-        }
-        $db->query($alterSql);
-    }
-
-    /**
-     * @param array<int,string> $acceptedDataTypes
-     */
-    public static function ensureColumnDataType(string $table, string $column, array $acceptedDataTypes, string $alterSql): void
-    {
-        global $db;
-
-        $columnInfo = self::columnInfo($table, $column);
-        if ($columnInfo === null) {
-            return;
-        }
-
-        $dataType = strtolower((string)($columnInfo['DATA_TYPE'] ?? ''));
-        $acceptedDataTypes = array_map(static fn(string $type): string => strtolower($type), $acceptedDataTypes);
-        if (in_array($dataType, $acceptedDataTypes, true)) {
-            return;
-        }
-
-        $db->query($alterSql);
-    }
-
-    /**
-     * @return array<string,mixed>|null
-     */
-    public static function columnInfo(string $table, string $column): ?array
-    {
-        global $db;
-        $table = $db->escape_string($table);
-        $column = $db->escape_string($column);
-        $database = $db->escape_string($db->getDatabase());
-
-        $sql = "SELECT DATA_TYPE, COLUMN_TYPE, IS_NULLABLE, CHARACTER_MAXIMUM_LENGTH
-                FROM information_schema.COLUMNS
-                WHERE TABLE_SCHEMA = '$database'
-                  AND TABLE_NAME = '$table'
-                  AND COLUMN_NAME = '$column'
-                LIMIT 1";
-        $result = $db->query($sql);
-        if (!$result) {
-            return null;
-        }
-        $row = $result->fetch_assoc();
-        return is_array($row) ? $row : null;
-    }
 }
@@ -16,8 +16,6 @@ class shelly implements shelly_i
    private const SHELLY_RATE_LIMIT_WAIT_TIMEOUT_SECONDS = 20;
    private const SHELLY_RATE_LIMIT_WINDOW_MILLISECONDS = 2000;
    private const SHELLY_RATE_LIMIT_GATE_KEY = 'shelly_cloud_rate_limit_gate';
-    private const SHELLY_CONNECT_TIMEOUT_SECONDS = 2;
-    private const SHELLY_REQUEST_TIMEOUT_SECONDS = 5;
    /**
     * @var array<int,array<string,mixed>>
     */
@@ -180,9 +178,6 @@ class shelly implements shelly_i
        curl_setopt($ch, CURLOPT_HTTPHEADER, [
            'Content-Type: application/json',
        ]);
-        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, self::SHELLY_CONNECT_TIMEOUT_SECONDS);
-        curl_setopt($ch, CURLOPT_TIMEOUT, self::SHELLY_REQUEST_TIMEOUT_SECONDS);
-        curl_setopt($ch, CURLOPT_NOSIGNAL, true);
        // Execute the request
        $response = curl_exec($ch);
        // Get the status code
@@ -229,9 +224,6 @@ class shelly implements shelly_i
        );
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_HTTPGET, true);
-        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, self::SHELLY_CONNECT_TIMEOUT_SECONDS);
-        curl_setopt($ch, CURLOPT_TIMEOUT, self::SHELLY_REQUEST_TIMEOUT_SECONDS);
-        curl_setopt($ch, CURLOPT_NOSIGNAL, true);

        $response = curl_exec($ch);
        $status_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
@@ -33,7 +33,7 @@ class shelly_relay_inventory
     * @return array<int,array<string,mixed>>
     * @throws Exception
     */
-    public function listRelayOptions(bool $include_sensitive_network_details = false): array
+    public function listRelayOptions(): array
    {
        $devices_status = $this->fetchOwnedDevicesStatus();
        $device_catalog = $this->fetchOwnedDeviceCatalog();
@@ -49,8 +49,7 @@ class shelly_relay_inventory

            $option = $this->buildRelayOption(
                $normalized_device,
-                is_array($catalog_entry) ? $catalog_entry : null,
-                $include_sensitive_network_details
+                is_array($catalog_entry) ? $catalog_entry : null
            );
            if ($option === null) {
                continue;
@@ -161,11 +160,7 @@ class shelly_relay_inventory
     * @param array<string,mixed> $device
     * @return array<string,mixed>|null
     */
-    private function buildRelayOption(
-        array $device,
-        ?array $catalog_entry = null,
-        bool $include_sensitive_network_details = false
-    ): ?array
+    private function buildRelayOption(array $device, ?array $catalog_entry = null): ?array
    {
        if ($device === [] || !$this->isRelayCapableDevice($device)) {
            return null;
@@ -208,8 +203,9 @@ class shelly_relay_inventory
            $online = $this->normalizeBoolean($catalog_entry['cloud_online'] ?? null);
        }
        $status_color = $this->extractStatusColor($online);
+        $local_ip = $this->extractLocalIp($device, $catalog_entry);

-        $option = [
+        return [
            'id' => $device_id,
            'name' => $this->buildRelayLabel(
                $device_type,
@@ -227,15 +223,10 @@ class shelly_relay_inventory
            'device_generation' => $device_generation,
            'control_type' => $control_type,
            'control_name' => $control_name !== '' ? $control_name : null,
+            'local_ip' => $local_ip,
            'status_color' => $status_color,
            'online' => $online,
        ];
-
-        if ($include_sensitive_network_details) {
-            $option['local_ip'] = $this->extractLocalIp($device, $catalog_entry);
-        }
-
-        return $option;
    }

    /**
@@ -6,25 +6,13 @@ use GuzzleHttp\Client;
 use interfaces\notification_i;
 use objects\departments_o;
 use objects\users_o;
-use slack\slack_c;
 use traits\notification_t;

-require_once WD . '/modules/slack/slack_c.php';

 class slack implements notification_i
 {
    use notification_t;

-    private ?slack_c $config = null;
-
-    public function getConfig(): slack_c
-    {
-        if ($this->config === null) {
-            $this->config = new slack_c();
-        }
-
-        return $this->config;
-    }

    /**
     * @inheritdoc
@@ -134,7 +122,7 @@ class slack implements notification_i
            . "Status: $status";
    }

-    public function send_message(string $string, ?string $module = null): void
+    public function send_message(string $string, string $module = null): void
    {
        global $SLACK_DEFAULT_WEBHOOK;
        // Format the message if a module is provided
@@ -144,189 +132,4 @@ class slack implements notification_i
        // Send the message to the slack webhook
        self::add_log(self::send_webhook_message($string, $SLACK_DEFAULT_WEBHOOK));
    }
-
-    public function send_customer_registration_notification(int $customer_number): self
-    {
-        $webhook = $this->get_customer_registration_webhook_url();
-        if ($webhook === '') {
-            return $this;
-        }
-
-        self::add_log(self::send_webhook_message(
-            $this->format_customer_registration($customer_number),
-            $webhook
-        ));
-
-        return $this;
-    }
-
-    /**
-     * Send a sanitized customer-registration test notification to the saved Slack webhook.
-     *
-     * @return array{configured:bool,sent:bool,message:string}
-     */
-    public function test_customer_registration_webhook(): array
-    {
-        $webhook = $this->get_customer_registration_webhook_url();
-        if ($webhook === '') {
-            return [
-                'configured' => false,
-                'sent' => false,
-                'message' => 'Slack customer registration webhook URL is not configured.',
-            ];
-        }
-
-        $result = $this->send_webhook_message(
-            $this->format_customer_registration_test(),
-            $webhook
-        );
-        $sent = $this->is_webhook_send_successful($result);
-
-        self::add_log($sent
-            ? 'Slack customer registration test webhook sent successfully.'
-            : 'Slack customer registration test webhook failed.'
-        );
-
-        return [
-            'configured' => true,
-            'sent' => $sent,
-            'message' => $sent
-                ? 'Slack test message sent successfully.'
-                : 'Slack test message failed.',
-        ];
-    }
-
-    /**
-     * Send a sanitized internal department goal progress test notification to the saved Slack webhook.
-     *
-     * @return array{configured:bool,sent:bool,message:string}
-     */
-    public function test_internal_department_goal_progress_webhook(): array
-    {
-        $webhook = $this->get_internal_department_goal_progress_webhook_url();
-        if ($webhook === '') {
-            return [
-                'configured' => false,
-                'sent' => false,
-                'message' => 'Slack internal department goal progress webhook URL is not configured.',
-            ];
-        }
-
-        $result = $this->send_webhook_message(
-            $this->format_internal_department_goal_progress_test(),
-            $webhook
-        );
-        $sent = $this->is_webhook_send_successful($result);
-
-        self::add_log($sent
-            ? 'Slack internal department goal progress test webhook sent successfully.'
-            : 'Slack internal department goal progress test webhook failed.'
-        );
-
-        return [
-            'configured' => true,
-            'sent' => $sent,
-            'message' => $sent
-                ? 'Slack test message sent successfully.'
-                : 'Slack test message failed.',
-        ];
-    }
-
-    protected function get_customer_registration_webhook_url(): string
-    {
-        return trim((string)$this->getConfig()->customer_registration_webhook_url->getVariableValue());
-    }
-
-    public function get_internal_department_goal_progress_webhook_url(): string
-    {
-        return trim((string)$this->getConfig()->internal_department_goal_progress_webhook_url->getVariableValue());
-    }
-
-    /**
-     * @return int[]
-     */
-    public function get_internal_department_ids(): array
-    {
-        return $this->getConfig()->internal_department_ids->getDepartmentIds();
-    }
-
-    /**
-     * @param int[] $department_ids
-     * @throws \Exception
-     */
-    public function set_internal_department_goal_progress_config(string $webhook_url, array $department_ids): array
-    {
-        $this->getConfig()->internal_department_goal_progress_webhook_url->setVariableValue(trim($webhook_url));
-        $this->getConfig()->internal_department_ids->setVariableValue($department_ids);
-
-        return $this->get_internal_department_goal_progress_config();
-    }
-
-    public function get_internal_department_goal_progress_config(): array
-    {
-        $departments = (new departments_o())->getFieldsWhere(
-            [
-                'visible' => 1,
-                'archived' => 0,
-            ],
-            [
-                'id',
-                'name',
-                'order_priority',
-            ]
-        );
-
-        usort($departments, static function (array $a, array $b): int {
-            return (int)($a['order_priority'] ?? 0) <=> (int)($b['order_priority'] ?? 0)
-                ?: (int)($a['id'] ?? 0) <=> (int)($b['id'] ?? 0);
-        });
-
-        return [
-            'internal_department_goal_progress_webhook_url' => $this->get_internal_department_goal_progress_webhook_url(),
-            'internal_department_ids' => $this->get_internal_department_ids(),
-            'departments' => array_map(static function (array $department): array {
-                return [
-                    'id' => (int)$department['id'],
-                    'name' => (string)$department['name'],
-                    'order_priority' => (int)$department['order_priority'],
-                ];
-            }, $departments),
-        ];
-    }
-
-    public function is_webhook_send_successful(string $result): bool
-    {
-        return !str_starts_with($result, 'Failed to send message:');
-    }
-
-    public function format_customer_registration(int $customer_number): string
-    {
-        $customer = (new users_o())->getUserByCustomerNumber($customer_number);
-        $customerName = $customer->exists()
-            ? $customer->getCustomerName((int)$customer->customer_number->value())
-            : '';
-        $customerName = trim((string)$customerName);
-        if ($customerName === '') {
-            $customerName = 'Unknown customer';
-        }
-
-        $safeCustomerNumber = (int)$customer_number;
-        $customerUrl = 'https://truckwash.io/superuser/users?search=' . $safeCustomerNumber;
-
-        return "*New customer registered on Truck Wash*\n"
-            . "Customer: $customerName ($safeCustomerNumber)\n"
-            . "Open in Superuser: $customerUrl";
-    }
-
-    public function format_customer_registration_test(): string
-    {
-        return "*Truck Wash Slack test*\n"
-            . "Customer registration notifications are configured correctly.";
-    }
-
-    public function format_internal_department_goal_progress_test(): string
-    {
-        return "*Truck Wash Slack test*\n"
-            . "Internal department goal progress notifications are configured correctly.";
-    }
-}
+}
@@ -1,276 +0,0 @@
-<?php
-
-namespace classes;
-
-use modules\subusers\helpers\subusers_permission_node_key;
-
-class subuser_permission_templates_service
-{
-    public const TEMPLATE_DEACTIVATED = 'deactivated';
-    public const TEMPLATE_DRIVER = 'driver';
-    public const TEMPLATE_BOOKING_COORDINATOR = 'booking_coordinator';
-    public const TEMPLATE_FLEET_ADMIN = 'fleet_admin';
-    public const TEMPLATE_CUSTOM = 'custom';
-
-    /**
-     * @var array<string, array{label:string,description:string,enabled:bool,permissions:array<int,string>}>
-     */
-    private const TEMPLATES = [
-        self::TEMPLATE_DEACTIVATED => [
-            'label' => 'Deactivated',
-            'description' => 'Keeps the driver linked to the customer without active access.',
-            'enabled' => false,
-            'permissions' => [],
-        ],
-        self::TEMPLATE_DRIVER => [
-            'label' => 'Driver',
-            'description' => 'Can use self-service, manage own bookings, see vehicles, and view orders.',
-            'enabled' => true,
-            'permissions' => [
-                'VEHICLES_LIST',
-                'SELFSERVE_LIST',
-                'SELFSERVE_ADD',
-                'BOOKINGS_LIST',
-                'BOOKINGS_ADD',
-                'ORDERS_LIST',
-            ],
-        ],
-        self::TEMPLATE_BOOKING_COORDINATOR => [
-            'label' => 'Booking coordinator',
-            'description' => 'Can coordinate bookings and see the related vehicles and orders.',
-            'enabled' => true,
-            'permissions' => [
-                'VEHICLES_LIST',
-                'BOOKINGS_LIST',
-                'BOOKINGS_ADD',
-                'BOOKINGS_EDIT',
-                'ORDERS_LIST',
-            ],
-        ],
-        self::TEMPLATE_FLEET_ADMIN => [
-            'label' => 'Fleet admin',
-            'description' => 'Can manage drivers, vehicles, bookings, self-service, and orders for the customer.',
-            'enabled' => true,
-            'permissions' => [
-                'VEHICLES_LIST',
-                'VEHICLES_EDIT',
-                'VEHICLES_DELETE',
-                'VEHICLES_ADD',
-                'SELFSERVE_LIST',
-                'SELFSERVE_EDIT',
-                'SELFSERVE_DELETE',
-                'SELFSERVE_ADD',
-                'BOOKINGS_LIST',
-                'BOOKINGS_EDIT',
-                'BOOKINGS_DELETE',
-                'BOOKINGS_ADD',
-                'ORDERS_LIST',
-                'ORDERS_EDIT',
-                'SUBUSERS_LIST',
-                'SUBUSERS_EDIT',
-                'SUBUSERS_DELETE',
-                'SUBUSERS_ADD',
-            ],
-        ],
-    ];
-
-    /**
-     * @var array<string, array{group:string,capability:string}>
-     */
-    private const PERMISSION_CAPABILITIES = [
-        'VEHICLES_LIST' => ['group' => 'vehicles', 'capability' => 'view_vehicles'],
-        'VEHICLES_EDIT' => ['group' => 'vehicles', 'capability' => 'edit_vehicles'],
-        'VEHICLES_DELETE' => ['group' => 'vehicles', 'capability' => 'delete_vehicles'],
-        'VEHICLES_ADD' => ['group' => 'vehicles', 'capability' => 'add_vehicles'],
-        'SELFSERVE_LIST' => ['group' => 'selfserve', 'capability' => 'view_selfserve'],
-        'SELFSERVE_EDIT' => ['group' => 'selfserve', 'capability' => 'edit_selfserve'],
-        'SELFSERVE_DELETE' => ['group' => 'selfserve', 'capability' => 'delete_selfserve'],
-        'SELFSERVE_ADD' => ['group' => 'selfserve', 'capability' => 'start_selfserve'],
-        'BOOKINGS_LIST' => ['group' => 'bookings', 'capability' => 'view_bookings'],
-        'BOOKINGS_EDIT' => ['group' => 'bookings', 'capability' => 'edit_bookings'],
-        'BOOKINGS_DELETE' => ['group' => 'bookings', 'capability' => 'delete_bookings'],
-        'BOOKINGS_ADD' => ['group' => 'bookings', 'capability' => 'add_bookings'],
-        'ORDERS_LIST' => ['group' => 'orders', 'capability' => 'view_orders'],
-        'ORDERS_EDIT' => ['group' => 'orders', 'capability' => 'edit_orders'],
-        'SUBUSERS_LIST' => ['group' => 'driver_management', 'capability' => 'view_drivers'],
-        'SUBUSERS_EDIT' => ['group' => 'driver_management', 'capability' => 'edit_driver_access'],
-        'SUBUSERS_DELETE' => ['group' => 'driver_management', 'capability' => 'disable_driver_access'],
-        'SUBUSERS_ADD' => ['group' => 'driver_management', 'capability' => 'invite_drivers'],
-    ];
-
-    /**
-     * @var array<int, string>
-     */
-    private const GROUP_ORDER = [
-        'vehicles',
-        'selfserve',
-        'bookings',
-        'orders',
-        'driver_management',
-    ];
-
-    /**
-     * @return array<string, mixed>
-     */
-    public function accessModel(): array
-    {
-        return [
-            'templates' => $this->templates(),
-            'groups' => $this->groups(),
-        ];
-    }
-
-    /**
-     * @return array<int, array<string, mixed>>
-     */
-    public function templates(): array
-    {
-        $templates = [];
-        foreach (self::TEMPLATES as $key => $template) {
-            $templates[] = [
-                'key' => $key,
-                'label' => $template['label'],
-                'description' => $template['description'],
-                'enabled' => $template['enabled'],
-                'permissions' => array_values($template['permissions']),
-                'permission_groups' => $this->permissionGroups($template['permissions']),
-            ];
-        }
-
-        return $templates;
-    }
-
-    /**
-     * @return array<int, array{key:string,capabilities:array<int,string>}>
-     */
-    public function groups(): array
-    {
-        $groups = [];
-        foreach (self::GROUP_ORDER as $group) {
-            $capabilities = [];
-            foreach (self::PERMISSION_CAPABILITIES as $capability) {
-                if ($capability['group'] === $group) {
-                    $capabilities[] = $capability['capability'];
-                }
-            }
-            $groups[] = [
-                'key' => $group,
-                'capabilities' => array_values(array_unique($capabilities)),
-            ];
-        }
-
-        return $groups;
-    }
-
-    /**
-     * @return array{enabled:bool,permissions:array<int,string>}
-     */
-    public function expandTemplate(string $templateKey): array
-    {
-        $key = $this->normalizeTemplateKey($templateKey);
-        if ($key === null || $key === self::TEMPLATE_CUSTOM) {
-            throw new \InvalidArgumentException('Unknown driver access template.');
-        }
-
-        return [
-            'enabled' => self::TEMPLATES[$key]['enabled'],
-            'permissions' => array_values(self::TEMPLATES[$key]['permissions']),
-        ];
-    }
-
-    public function normalizeTemplateKey(?string $templateKey): ?string
-    {
-        if ($templateKey === null) {
-            return null;
-        }
-
-        $key = strtolower(trim($templateKey));
-        if ($key === self::TEMPLATE_CUSTOM) {
-            return self::TEMPLATE_CUSTOM;
-        }
-
-        return array_key_exists($key, self::TEMPLATES) ? $key : null;
-    }
-
-    /**
-     * @param array<int, string> $permissions
-     */
-    public function classify(array $permissions, bool $enabled = true): string
-    {
-        $normalized = $this->normalizePermissions($permissions);
-        if (!$enabled || $normalized === []) {
-            return self::TEMPLATE_DEACTIVATED;
-        }
-
-        foreach (self::TEMPLATES as $key => $template) {
-            if (!$template['enabled']) {
-                continue;
-            }
-
-            if ($normalized === $this->normalizePermissions($template['permissions'])) {
-                return $key;
-            }
-        }
-
-        return self::TEMPLATE_CUSTOM;
-    }
-
-    /**
-     * @param array<int, string> $permissions
-     * @return array<int, array{key:string,capabilities:array<int,string>}>
-     */
-    public function permissionGroups(array $permissions): array
-    {
-        $permissions = $this->normalizePermissions($permissions);
-        $groups = [];
-        foreach ($permissions as $permission) {
-            $capability = self::PERMISSION_CAPABILITIES[$permission] ?? null;
-            if ($capability === null) {
-                continue;
-            }
-
-            $group = $capability['group'];
-            $groups[$group] ??= [];
-            $groups[$group][] = $capability['capability'];
-        }
-
-        $payload = [];
-        foreach (self::GROUP_ORDER as $group) {
-            if (!isset($groups[$group])) {
-                continue;
-            }
-
-            $payload[] = [
-                'key' => $group,
-                'capabilities' => array_values(array_unique($groups[$group])),
-            ];
-        }
-
-        return $payload;
-    }
-
-    /**
-     * @param array<int, string> $permissions
-     * @return array<int, string>
-     */
-    private function normalizePermissions(array $permissions): array
-    {
-        $normalized = [];
-        foreach ($permissions as $permission) {
-            if ($permission instanceof subusers_permission_node_key) {
-                $permission = $permission->name;
-            }
-            if (!is_string($permission)) {
-                continue;
-            }
-            $permission = strtoupper(trim($permission));
-            if ($permission !== '' && subusers_permission_node_key::tryFrom($permission) !== null) {
-                $normalized[] = $permission;
-            }
-        }
-
-        $normalized = array_values(array_unique($normalized));
-        sort($normalized);
-        return $normalized;
-    }
-}
@@ -6,8 +6,9 @@ use Throwable;

 class system_search_cache
 {
-    public const PREFIX = 'system_search:v2:';
+    public const PREFIX = 'system_search:v1:';
    public const QUERY_PREFIX = self::PREFIX . 'query:';
+    public const INTENT_PREFIX = self::PREFIX . 'intent:';
    public const DIRTY_TABLES_KEY = self::PREFIX . 'dirty_tables';
    public const REBUILD_REQUEST_KEY = self::PREFIX . 'rebuild_request';
    public const TABLE_VERSION_PREFIX = self::PREFIX . 'table_version:';
@@ -39,6 +40,24 @@ class system_search_cache
        self::redisSetEx(self::QUERY_PREFIX . $hash, json_encode($payload, JSON_UNESCAPED_UNICODE), $ttlSeconds);
    }

+    public static function getIntent(string $hash): ?array
+    {
+        $raw = self::redisGet(self::INTENT_PREFIX . $hash);
+        if ($raw === null) {
+            return null;
+        }
+        $decoded = json_decode($raw, true);
+        if (!is_array($decoded)) {
+            return null;
+        }
+        return $decoded;
+    }
+
+    public static function setIntent(string $hash, array $payload, int $ttlSeconds = 3600): void
+    {
+        self::redisSetEx(self::INTENT_PREFIX . $hash, json_encode($payload, JSON_UNESCAPED_UNICODE), $ttlSeconds);
+    }
+
    public static function clearAll(): void
    {
        self::clearPattern(self::PREFIX . '*');
@@ -49,6 +68,11 @@ class system_search_cache
        self::clearPattern(self::QUERY_PREFIX . '*');
    }

+    public static function clearIntentCaches(): void
+    {
+        self::clearPattern(self::INTENT_PREFIX . '*');
+    }
+
    public static function markDirtyTable(string $table): void
    {
        $table = trim($table, " `\t\n\r\0\x0B");
@@ -499,7 +499,6 @@ class system_search_document_index
     */
    private function buildCustomerDiscountDocuments(): array
    {
-        price_overrides_schema_bootstrap::ensureColumns();
        $fromClause = 'price_overrides po INNER JOIN users u ON u.id = po.user_id';
        $selectFields = [
            'po.id AS entity_id',
@@ -507,7 +506,6 @@ class system_search_document_index
            'po.is_category',
            'po.product_or_category_id',
            'po.percentage',
-            'po.fixed_price',
            'u.customer_number',
            'u.display_name',
            ...$this->joinTemporalSelectFields('price_overrides', 'po'),
@@ -556,7 +554,6 @@ class system_search_document_index
                    $row['search_text'] ?? null,
                    $row['product_or_category_id'] ?? null,
                    $row['percentage'] ?? null,
-                    $row['fixed_price'] ?? null,
                    $row['user_id'] ?? null,
                ]),
                $this->toIntOrNull($row['customer_number'] ?? null),
@@ -567,7 +564,6 @@ class system_search_document_index
                    'customer_number' => $this->toIntOrNull($row['customer_number'] ?? null),
                    'product_or_category_id' => $row['product_or_category_id'] ?? null,
                    'percentage' => $this->toIntOrNull($row['percentage'] ?? null),
-                    'fixed_price' => $this->toIntOrNull($row['fixed_price'] ?? null),
                    'economic_name' => $row['economic_name'] ?? null,
                    'economic_cvr' => $row['economic_cvr'] ?? null,
                    'is_category' => $row['is_category'] ?? null,
@@ -0,0 +1,317 @@
+<?php
+
+namespace classes;
+
+use Exception;
+use interfaces\system_search_intent_parser_i;
+use Throwable;
+
+class system_search_openai_intent_parser implements system_search_intent_parser_i
+{
+    private string $apiUrl = 'https://api.openai.com/v1/responses';
+    private string $model = 'gpt-4.1-mini';
+    private float $temperature = 0.1;
+    private int $timeoutSeconds = 10;
+    private int $maxAliases = 12;
+    private int $maxEntityHints = 8;
+    private int $maxAliasLength = 64;
+    private int $maxHintLength = 32;
+    private int $maxNormalizedQueryLength = 256;
+    private int $maxFallbackReasonLength = 160;
+
+    /**
+     * @var callable|null
+     */
+    private $transport;
+    private ?bool $forcedEnabled;
+    private ?string $forcedApiKey;
+
+    public function __construct(?callable $transport = null, ?bool $forcedEnabled = null, ?string $forcedApiKey = null)
+    {
+        $this->transport = $transport;
+        $this->forcedEnabled = $forcedEnabled;
+        $this->forcedApiKey = $forcedApiKey;
+    }
+
+    public function parse(string $query, array $allowedEntityTypes, array $taxonomy = []): array
+    {
+        $query = trim($query);
+        if ($query === '') {
+            return $this->failed('empty_query', 'none');
+        }
+
+        [$enabled, $apiKey] = $this->resolveOpenAISettings();
+        if (!$enabled) {
+            return $this->failed('openai_disabled', 'none');
+        }
+        if (empty($apiKey)) {
+            return $this->failed('openai_missing_key', 'none');
+        }
+
+        $redactedQuery = self::redactSensitiveQuery($query);
+        $payload = $this->buildPayload($redactedQuery, $allowedEntityTypes, $taxonomy);
+        $cacheHash = md5(json_encode([
+            'q' => $redactedQuery,
+            'types' => $allowedEntityTypes,
+            'taxonomy' => $taxonomy,
+            'v' => 1,
+        ], JSON_UNESCAPED_UNICODE));
+
+        $cached = system_search_cache::getIntent($cacheHash);
+        if (is_array($cached) && isset($cached['success'])) {
+            $cached['source'] = 'cache';
+            return $this->normalizeResult($cached, $allowedEntityTypes);
+        }
+
+        try {
+            $raw = $this->sendRequest($payload, $apiKey);
+            $parsed = $this->parseResponse($raw);
+            $parsed['source'] = 'openai';
+            system_search_cache::setIntent($cacheHash, $parsed, 3600);
+            return $this->normalizeResult($parsed, $allowedEntityTypes);
+        } catch (Throwable $e) {
+            return $this->failed($e->getMessage(), 'openai');
+        }
+    }
+
+    public static function redactSensitiveQuery(string $query): string
+    {
+        $query = preg_replace('/[A-Z0-9._%+\-]+@[A-Z0-9.\-]+\.[A-Z]{2,}/i', '[email]', $query) ?? $query;
+        $query = preg_replace('/\b\d{8}\b/', '[cvr]', $query) ?? $query;
+        $query = preg_replace('/\b[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}\b/i', '[uuid]', $query) ?? $query;
+        $query = preg_replace('/\+?\d[\d\s\-]{6,}\d/', '[phone]', $query) ?? $query;
+        $query = preg_replace('/\b(order|invoice|booking|customer|kunde|faktura)\s*[#:\-]?\s*\d{4,}\b/iu', '$1 [id]', $query) ?? $query;
+        $query = preg_replace('/\b(reg(?:istration)?|plate|license plate|nummerplade)\s*[#:\-]?\s*[a-z0-9\-]{4,10}\b/iu', '$1 [plate]', $query) ?? $query;
+        $query = preg_replace('/\b[a-z]{2}\s?\d{5}\b/iu', '[plate]', $query) ?? $query;
+        return $query;
+    }
+
+    private function resolveOpenAISettings(): array
+    {
+        if ($this->forcedEnabled !== null) {
+            return [(bool)$this->forcedEnabled, (string)($this->forcedApiKey ?? '')];
+        }
+
+        try {
+            $openai = new openai();
+            $enabled = (bool)$openai->config->enabled->getVariableValue();
+            $apiKey = (string)$openai->config->api_key->getVariableValue();
+            return [$enabled, $apiKey];
+        } catch (Throwable) {
+            return [false, ''];
+        }
+    }
+
+    private function buildPayload(string $query, array $allowedEntityTypes, array $taxonomy): array
+    {
+        $taxonomyText = json_encode([
+            'allowed_entity_types' => array_values($allowedEntityTypes),
+            'taxonomy' => $taxonomy,
+        ], JSON_UNESCAPED_UNICODE);
+
+        $prompt = "You parse user search intent into strict JSON.\n"
+            . "Rules:\n"
+            . "- Keep output concise and valid JSON only.\n"
+            . "- Do not invent entity types not listed in allowed_entity_types.\n"
+            . "- Infer what the user is trying to find, not just literal words.\n"
+            . "- aliases should contain user-friendly and backend-friendly equivalent terms.\n"
+            . "- Include cross-language/domain synonyms when likely (example: Danish 'rabat' -> 'discount').\n"
+            . "- If user references a customer/company by name, include hints that help find related invoices/orders/discounts.\n"
+            . "- confidence must be between 0 and 1.\n"
+            . "- association_hint should be true if related records likely needed.\n\n"
+            . "Context:\n"
+            . $taxonomyText . "\n\n"
+            . "User query:\n"
+            . $query;
+
+        return [
+            'model' => $this->model,
+            'temperature' => $this->temperature,
+            'input' => [
+                [
+                    'role' => 'user',
+                    'content' => [
+                        ['type' => 'input_text', 'text' => $prompt],
+                    ],
+                ],
+            ],
+            'text' => [
+                'format' => [
+                    'type' => 'json_schema',
+                    'name' => 'system_search_intent',
+                    'schema' => [
+                        'type' => 'object',
+                        'properties' => [
+                            'success' => ['type' => 'boolean'],
+                            'normalized_query' => [
+                                'type' => 'string',
+                                'maxLength' => $this->maxNormalizedQueryLength,
+                            ],
+                            'aliases' => [
+                                'type' => 'array',
+                                'maxItems' => $this->maxAliases,
+                                'items' => [
+                                    'type' => 'string',
+                                    'maxLength' => $this->maxAliasLength,
+                                ],
+                            ],
+                            'entity_hints' => [
+                                'type' => 'array',
+                                'maxItems' => $this->maxEntityHints,
+                                'items' => [
+                                    'type' => 'string',
+                                    'maxLength' => $this->maxHintLength,
+                                ],
+                            ],
+                            'confidence' => [
+                                'type' => 'number',
+                                'minimum' => 0,
+                                'maximum' => 1,
+                            ],
+                            'association_hint' => ['type' => 'boolean'],
+                            'fallback_reason' => [
+                                'anyOf' => [
+                                    ['type' => 'string', 'maxLength' => $this->maxFallbackReasonLength],
+                                    ['type' => 'null'],
+                                ],
+                            ],
+                        ],
+                        'required' => [
+                            'success',
+                            'normalized_query',
+                            'aliases',
+                            'entity_hints',
+                            'confidence',
+                            'association_hint',
+                            'fallback_reason',
+                        ],
+                        'additionalProperties' => false,
+                    ],
+                    'strict' => true,
+                ],
+            ],
+        ];
+    }
+
+    private function sendRequest(array $payload, string $apiKey): array
+    {
+        if ($this->transport !== null) {
+            $result = call_user_func($this->transport, $payload, $apiKey);
+            if (!is_array($result)) {
+                throw new Exception('Transport returned invalid payload');
+            }
+            return $result;
+        }
+
+        $curl = curl_init($this->apiUrl);
+        curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($curl, CURLOPT_POST, true);
+        curl_setopt($curl, CURLOPT_TIMEOUT, $this->timeoutSeconds);
+        curl_setopt($curl, CURLOPT_HTTPHEADER, [
+            'Content-Type: application/json',
+            'Authorization: Bearer ' . $apiKey,
+        ]);
+        curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode($payload, JSON_UNESCAPED_UNICODE));
+        $raw = curl_exec($curl);
+        if ($raw === false) {
+            $error = curl_error($curl);
+            curl_close($curl);
+            throw new Exception('cURL error: ' . $error);
+        }
+        $status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
+        curl_close($curl);
+        $decoded = json_decode($raw, true);
+        if (!is_array($decoded)) {
+            throw new Exception('Invalid JSON from OpenAI');
+        }
+        if ($status >= 400) {
+            $message = $decoded['error']['message'] ?? ('OpenAI HTTP ' . $status);
+            throw new Exception($message);
+        }
+        return $decoded;
+    }
+
+    private function parseResponse(array $response): array
+    {
+        $text = $response['output'][0]['content'][0]['text'] ?? null;
+        if (!is_string($text) || $text === '') {
+            throw new Exception('Invalid response format (missing output text)');
+        }
+        $decoded = json_decode($text, true);
+        if (!is_array($decoded)) {
+            throw new Exception('Invalid intent JSON');
+        }
+        return $decoded;
+    }
+
+    private function normalizeResult(array $result, array $allowedEntityTypes = []): array
+    {
+        $normalizedQuery = trim((string)($result['normalized_query'] ?? ''));
+        if (mb_strlen($normalizedQuery) > $this->maxNormalizedQueryLength) {
+            $normalizedQuery = mb_substr($normalizedQuery, 0, $this->maxNormalizedQueryLength);
+        }
+
+        $aliases = $this->sanitizeStringList((array)($result['aliases'] ?? []), $this->maxAliases, $this->maxAliasLength);
+        $entityHints = $this->sanitizeStringList((array)($result['entity_hints'] ?? []), $this->maxEntityHints, $this->maxHintLength);
+        if (!empty($allowedEntityTypes)) {
+            $entityHints = array_values(array_intersect($allowedEntityTypes, $entityHints));
+        }
+
+        $fallbackReason = null;
+        if (isset($result['fallback_reason']) && $result['fallback_reason'] !== null) {
+            $fallbackReason = trim((string)$result['fallback_reason']);
+            if (mb_strlen($fallbackReason) > $this->maxFallbackReasonLength) {
+                $fallbackReason = mb_substr($fallbackReason, 0, $this->maxFallbackReasonLength);
+            }
+        }
+
+        return [
+            'success' => (bool)($result['success'] ?? false),
+            'normalized_query' => $normalizedQuery,
+            'aliases' => $aliases,
+            'entity_hints' => $entityHints,
+            'confidence' => max(0.0, min(1.0, (float)($result['confidence'] ?? 0.0))),
+            'association_hint' => (bool)($result['association_hint'] ?? false),
+            'fallback_reason' => $fallbackReason,
+            'source' => (string)($result['source'] ?? 'openai'),
+        ];
+    }
+
+    private function sanitizeStringList(array $values, int $maxItems, int $maxLength): array
+    {
+        $result = [];
+        foreach ($values as $value) {
+            if (!is_string($value)) {
+                continue;
+            }
+            $item = trim(mb_strtolower($value));
+            if ($item === '') {
+                continue;
+            }
+            if (mb_strlen($item) > $maxLength) {
+                $item = mb_substr($item, 0, $maxLength);
+            }
+            if (!in_array($item, $result, true)) {
+                $result[] = $item;
+            }
+            if (count($result) >= $maxItems) {
+                break;
+            }
+        }
+        return $result;
+    }
+
+    private function failed(string $reason, string $source): array
+    {
+        return [
+            'success' => false,
+            'normalized_query' => '',
+            'aliases' => [],
+            'entity_hints' => [],
+            'confidence' => 0.0,
+            'association_hint' => false,
+            'fallback_reason' => $reason,
+            'source' => $source,
+        ];
+    }
+}
@@ -2,18 +2,18 @@

 namespace classes;

+use interfaces\system_search_intent_parser_i;
 use Throwable;

 class system_search_service
 {
+    private system_search_intent_parser_i $intentParser;
+    private int $lowConfidenceResultThreshold = 5;
+    private int $lowConfidenceTopScoreThreshold = 60;
    private int $defaultEntityFetchLimit = 200;
-    private int $defaultMaxResults = 50;
    private int $maxExpandedTerms = 24;
    private int $maxTermLength = 64;
    private int $recencyScoreTolerance = 12;
-    private int $minimumEffectiveScore = 45;
-    private int $minimumExplicitTypeScore = 20;
-    private int $associationSeedScoreThreshold = 80;
    private array $rankingBoostByType = [
        'invoices' => 35,
        'orders' => 35,
@@ -35,8 +35,9 @@ class system_search_service
    private array $tableColumnsCache = [];
    private array $customerContextCache = [];

-    public function __construct()
+    public function __construct(?system_search_intent_parser_i $intentParser = null)
    {
+        $this->intentParser = $intentParser ?? new system_search_openai_intent_parser();
        try {
            system_search_economic_customer_index::ensureTable();
            system_search_document_index::ensureTable();
@@ -53,18 +54,22 @@ class system_search_service
        $allowedTypes = $this->normalizeTypes((array)($options['allowed_types'] ?? []));
        $ownOnlyTypes = $this->normalizeTypes((array)($options['own_only_types'] ?? []));
        $ownCustomerNumber = isset($options['own_customer_number']) ? (int)$options['own_customer_number'] : null;
-        $allowedDepartmentIds = array_values(array_unique(array_map('intval', (array)($options['allowed_department_ids'] ?? []))));
        $permissionsCatalogAll = (array)($options['permissions_catalog_all'] ?? []);
        $permissionsCatalogOwn = (array)($options['permissions_catalog_own'] ?? []);
        $moduleConfigVisibility = (array)($options['module_config_visibility'] ?? []);
        $includeAssociations = (bool)($options['include_associations'] ?? true);
+        $debugIntent = (bool)($options['debug_intent'] ?? false);

-        $maxResults = (int)($options['max_results'] ?? $this->defaultMaxResults);
-        if ($maxResults < 1) {
-            $maxResults = $this->defaultMaxResults;
+        $limit = (int)($options['limit'] ?? 50);
+        $offset = (int)($options['offset'] ?? 0);
+        if ($limit < 1) {
+            $limit = 50;
        }
-        if ($maxResults > $this->defaultMaxResults) {
-            $maxResults = $this->defaultMaxResults;
+        if ($limit > 200) {
+            $limit = 200;
+        }
+        if ($offset < 0) {
+            $offset = 0;
        }

        $allTypes = $this->allEntityTypes();
@@ -73,12 +78,11 @@ class system_search_service
            $activeTypes = array_values(array_diff($activeTypes, $excludeTypes));
        }
        $activeTypes = array_values(array_intersect($activeTypes, $allowedTypes));
-        $terms = $this->buildExpandedTerms($this->tokenize($query));
-        $activeTypes = $this->selectSearchTypes($activeTypes, $includeTypes, $terms, $query);

        $baseMeta = [
            'query' => $query,
-            'max_results' => $maxResults,
+            'limit' => $limit,
+            'offset' => $offset,
            'allowed_types' => $activeTypes,
            'cache' => ['hit' => false],
        ];
@@ -89,8 +93,7 @@ class system_search_service
                'grouped_results' => $this->groupResultsByType([]),
                'meta' => [
                    ...$baseMeta,
-                    'returned' => 0,
-                    'truncated' => false,
+                    'total' => 0,
                ],
            ];
        }
@@ -100,14 +103,15 @@ class system_search_service
            'include' => $includeTypes,
            'exclude' => $excludeTypes,
            'active' => $activeTypes,
-            'max' => $maxResults,
+            'limit' => $limit,
+            'offset' => $offset,
            'own' => $ownCustomerNumber,
            'own_only' => $ownOnlyTypes,
-            'dept' => $allowedDepartmentIds,
            'assoc' => $includeAssociations,
+            'dbg' => $debugIntent,
            'ctx' => $this->permissionContextFingerprint($permissionsCatalogAll, $permissionsCatalogOwn, $moduleConfigVisibility),
            'table_versions' => system_search_cache::tableVersionFingerprint($this->relevantSourceTables($activeTypes)),
-            'v' => 13,
+            'v' => 12,
        ], JSON_UNESCAPED_UNICODE));

        $cached = system_search_cache::getQuery($queryCacheHash);
@@ -116,6 +120,7 @@ class system_search_service
            return $cached;
        }

+        $terms = $this->buildExpandedTerms($this->tokenize($query));
        $entityBoost = [];
        $initialResults = $this->executeLexicalSearch(
            $activeTypes,
@@ -125,68 +130,112 @@ class system_search_service
            $ownCustomerNumber,
            $permissionsCatalogAll,
            $permissionsCatalogOwn,
-            $moduleConfigVisibility,
-            $allowedDepartmentIds
+            $moduleConfigVisibility
        );
-        $initialResults = $this->filterRelevantResults($initialResults, $includeTypes);
+
+        $intentAssociationHint = false;
+        $intentMeta = [
+            'invoked' => false,
+            'source' => 'none',
+            'status' => 'skipped',
+            'confidence' => 0.0,
+            'expanded_terms' => $terms,
+            'entity_hints' => [],
+            'fallback_reason' => null,
+        ];
+
+        $shouldInvokeIntent = !empty($terms) && (
+            $this->shouldInvokeIntentParser($initialResults)
+            || $this->queryLooksIntentDriven($query, $terms)
+        );
+        if ($shouldInvokeIntent) {
+            $intentMeta['invoked'] = true;
+            $taxonomy = $this->taxonomy($activeTypes);
+            $intent = $this->intentParser->parse($query, $activeTypes, $taxonomy);
+            $intentMeta['source'] = (string)($intent['source'] ?? 'none');
+            $intentMeta['confidence'] = (float)($intent['confidence'] ?? 0.0);
+            $intentMeta['fallback_reason'] = $intent['fallback_reason'] ?? null;
+            $intentMeta['entity_hints'] = (array)($intent['entity_hints'] ?? []);
+            $intentAssociationHint = (bool)($intent['association_hint'] ?? false);
+
+            if (!empty($intent['success'])) {
+                $intentMeta['status'] = 'ok';
+                $boostedTypes = array_values(array_intersect($activeTypes, (array)($intent['entity_hints'] ?? [])));
+                foreach ($boostedTypes as $boostedType) {
+                    $entityBoost[$boostedType] = 25;
+                }
+                $expandedTerms = $this->buildExpandedTerms([
+                    ...$terms,
+                    ...$this->tokenize((string)($intent['normalized_query'] ?? '')),
+                    ...$this->tokenize(implode(' ', (array)($intent['aliases'] ?? []))),
+                    ...$this->hintAliasTerms($boostedTypes, $taxonomy),
+                ]);
+                $intentMeta['expanded_terms'] = $expandedTerms;
+
+                $initialResults = $this->executeLexicalSearch(
+                    $activeTypes,
+                    $expandedTerms,
+                    $entityBoost,
+                    $ownOnlyTypes,
+                    $ownCustomerNumber,
+                    $permissionsCatalogAll,
+                    $permissionsCatalogOwn,
+                    $moduleConfigVisibility
+                );
+            } else {
+                $intentMeta['status'] = 'fallback';
+            }
+        }

        if ($includeAssociations) {
            $customerNumbers = [];
            foreach ($initialResults as $result) {
-                $customerNumber = $this->toIntOrNull($result['customer_number'] ?? null);
-                if ($customerNumber === null || $customerNumber <= 0) {
+                if (!isset($result['customer_number'])) {
                    continue;
                }
-                if (!$this->shouldExpandAssociationsFromResult($result, $includeTypes)) {
+                if ($result['entity_type'] !== 'customers' && !$intentAssociationHint) {
                    continue;
                }
-                $customerNumbers[] = $customerNumber;
+                $customerNumbers[] = (int)$result['customer_number'];
            }
            $customerNumbers = array_values(array_unique(array_filter($customerNumbers)));
-            if (count($customerNumbers) > 5) {
-                $customerNumbers = array_slice($customerNumbers, 0, 5);
+            if (count($customerNumbers) > 15) {
+                $customerNumbers = array_slice($customerNumbers, 0, 15);
            }
            if (!empty($customerNumbers)) {
                $associationTypes = array_values(array_intersect(
                    $activeTypes,
                    $this->associationEntityTypes()
                ));
-                $associationTypes = array_values(array_diff($associationTypes, $ownOnlyTypes));
-                if (!empty($associationTypes)) {
-                    foreach ($customerNumbers as $customerNumber) {
-                        $associated = $this->executeLexicalSearch(
-                            $associationTypes,
-                            [(string)$customerNumber],
-                            [],
-                            $ownOnlyTypes,
-                            $ownCustomerNumber,
-                            $permissionsCatalogAll,
-                            $permissionsCatalogOwn,
-                            $moduleConfigVisibility,
-                            $allowedDepartmentIds,
-                            [$customerNumber]
-                        );
-                        foreach ($associated as &$item) {
-                            if (!isset($item['association_reason'])) {
-                                $item['association_reason'] = 'customer:' . $customerNumber;
-                            }
-                            $item['score'] = max((int)$item['score'], 35);
+                foreach ($customerNumbers as $customerNumber) {
+                    $associated = $this->executeLexicalSearch(
+                        $associationTypes,
+                        [(string)$customerNumber],
+                        [],
+                        $ownOnlyTypes,
+                        $ownCustomerNumber,
+                        $permissionsCatalogAll,
+                        $permissionsCatalogOwn,
+                        $moduleConfigVisibility,
+                        [$customerNumber]
+                    );
+                    foreach ($associated as &$item) {
+                        if (!isset($item['association_reason'])) {
+                            $item['association_reason'] = 'customer:' . $customerNumber;
                        }
-                        unset($item);
-                        $associated = $this->filterRelevantResults($associated, $includeTypes);
-                        $initialResults = $this->mergeResults($initialResults, $associated);
+                        $item['score'] = max((int)$item['score'], 35);
                    }
+                    $initialResults = $this->mergeResults($initialResults, $associated);
                }
            }
        }
-        $initialResults = $this->filterRelevantResults($initialResults, $includeTypes);

        $preferRecency = $this->shouldPreferRecencySort($query, $terms);
        usort($initialResults, function (array $a, array $b) use ($preferRecency): int {
            $scoreA = (int)($a['score'] ?? 0);
            $scoreB = (int)($b['score'] ?? 0);
-            $effectiveScoreA = $this->effectiveResultScore($a);
-            $effectiveScoreB = $this->effectiveResultScore($b);
+            $effectiveScoreA = $scoreA + $this->rankingBoost($a) - $this->rankingPenalty($a);
+            $effectiveScoreB = $scoreB + $this->rankingBoost($b) - $this->rankingPenalty($b);
            $recencyA = $this->resultRecencyTimestamp($a);
            $recencyB = $this->resultRecencyTimestamp($b);
            $cancelledA = $this->isCancelledBookingResult($a);
@@ -215,17 +264,20 @@ class system_search_service
            return strcmp((string)$a['entity_type'] . ':' . (string)$a['entity_id'], (string)$b['entity_type'] . ':' . (string)$b['entity_id']);
        });

-        $limited = array_slice($initialResults, 0, $maxResults);
-        $grouped = $this->groupResultsByType($limited);
+        $total = count($initialResults);
+        $paged = array_slice($initialResults, $offset, $limit);
+        $grouped = $this->groupResultsByType($paged);

        $meta = [
            ...$baseMeta,
-            'returned' => count($limited),
-            'truncated' => count($initialResults) > count($limited),
+            'total' => $total,
        ];
+        if ($debugIntent) {
+            $meta['intent_parser'] = $intentMeta;
+        }

        $payload = [
-            'results' => $limited,
+            'results' => $paged,
            'grouped_results' => $grouped,
            'meta' => $meta,
        ];
@@ -234,127 +286,13 @@ class system_search_service
        return $payload;
    }

-    /**
-     * @param array<int, string> $activeTypes
-     * @param array<int, string> $includeTypes
-     * @param array<int, string> $terms
-     * @return array<int, string>
-     */
-    private function selectSearchTypes(array $activeTypes, array $includeTypes, array $terms, string $query): array
+    protected function shouldInvokeIntentParser(array $results): bool
    {
-        if (empty($activeTypes) || !empty($includeTypes)) {
-            return $activeTypes;
+        if (count($results) < $this->lowConfidenceResultThreshold) {
+            return true;
        }
-
-        $selected = array_values(array_intersect($activeTypes, $this->defaultSearchEntityTypes()));
-        foreach ($activeTypes as $entityType) {
-            if (in_array($entityType, $selected, true)) {
-                continue;
-            }
-            if ($this->entityTypeMatchesQuery($entityType, $terms, $query)) {
-                $selected[] = $entityType;
-            }
-        }
-
-        return array_values(array_intersect($activeTypes, array_values(array_unique($selected))));
-    }
-
-    /**
-     * @return array<int, string>
-     */
-    private function defaultSearchEntityTypes(): array
-    {
-        return [
-            'customers',
-            'users',
-            'employees',
-            'orders',
-            'order_bookings',
-            'bookings',
-            'bookings_new',
-            'invoices',
-            'vehicles',
-            'departments',
-            'products',
-            'objects',
-        ];
-    }
-
-    /**
-     * @param array<int, string> $terms
-     */
-    private function entityTypeMatchesQuery(string $entityType, array $terms, string $query): bool
-    {
-        $normalizedQuery = ' ' . trim(mb_strtolower($query)) . ' ';
-        if (trim($normalizedQuery) === '') {
-            return false;
-        }
-
-        $aliases = system_search_registry::taxonomyAliases()[$entityType] ?? [];
-        $human = str_replace('_', ' ', $entityType);
-        $aliases[] = $entityType;
-        $aliases[] = $human;
-        $aliases[] = rtrim($human, 's');
-        $aliases = array_values(array_unique(array_filter($aliases, static fn($alias) => is_string($alias) && trim($alias) !== '')));
-
-        foreach ($aliases as $alias) {
-            $aliasTerms = $this->tokenize($alias);
-            if (empty($aliasTerms)) {
-                continue;
-            }
-            if (count($aliasTerms) === 1 && in_array($aliasTerms[0], $terms, true)) {
-                return true;
-            }
-            if (count($aliasTerms) > 1 && empty(array_diff($aliasTerms, $terms))) {
-                return true;
-            }
-            $aliasText = trim(mb_strtolower($alias));
-            if ($aliasText !== '' && str_contains($normalizedQuery, ' ' . $aliasText . ' ')) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-
-    /**
-     * @param array<int, array<string, mixed>> $results
-     * @param array<int, string> $includeTypes
-     * @return array<int, array<string, mixed>>
-     */
-    private function filterRelevantResults(array $results, array $includeTypes): array
-    {
-        $explicitTypes = array_flip($includeTypes);
-        $filtered = [];
-        foreach ($results as $result) {
-            $entityType = (string)($result['entity_type'] ?? '');
-            $score = (int)($result['score'] ?? 0);
-            if ($score <= 0) {
-                continue;
-            }
-            if (isset($explicitTypes[$entityType])) {
-                if ($score >= $this->minimumExplicitTypeScore) {
-                    $filtered[] = $result;
-                }
-                continue;
-            }
-            if ($this->effectiveResultScore($result) >= $this->minimumEffectiveScore) {
-                $filtered[] = $result;
-            }
-        }
-        return $filtered;
-    }
-
-    private function shouldExpandAssociationsFromResult(array $result, array $includeTypes): bool
-    {
-        $entityType = trim(mb_strtolower((string)($result['entity_type'] ?? '')));
-        if (!in_array($entityType, ['customers', 'users'], true)) {
-            return false;
-        }
-        if (!empty($includeTypes) && !in_array($entityType, $includeTypes, true)) {
-            return false;
-        }
-        return $this->effectiveResultScore($result) >= $this->associationSeedScoreThreshold;
+        $topScore = (int)($results[0]['score'] ?? 0);
+        return $topScore < $this->lowConfidenceTopScoreThreshold;
    }

    /**
@@ -366,7 +304,6 @@ class system_search_service
     * @param array<string, string> $permissionsCatalogAll
     * @param array<int, string> $permissionsCatalogOwn
     * @param array<string, bool> $moduleConfigVisibility
-     * @param array<int, int> $allowedDepartmentIds
     * @param array<int, int> $forcedCustomerNumbers
     * @return array<int, array<string, mixed>>
     */
@@ -379,7 +316,6 @@ class system_search_service
        array $permissionsCatalogAll,
        array $permissionsCatalogOwn,
        array $moduleConfigVisibility,
-        array $allowedDepartmentIds = [],
        array $forcedCustomerNumbers = []
    ): array {
        $results = [];
@@ -398,9 +334,21 @@ class system_search_service
                    $ownOnly,
                    $ownCustomerNumber,
                    $moduleConfigVisibility,
-                    $allowedDepartmentIds,
                    $forcedCustomerNumbers
                );
+                if (empty($rows)) {
+                    $rows = $this->searchEntity(
+                        $entityType,
+                        $terms,
+                        $boost,
+                        $ownOnly,
+                        $ownCustomerNumber,
+                        $permissionsCatalogAll,
+                        $permissionsCatalogOwn,
+                        $moduleConfigVisibility,
+                        $forcedCustomerNumbers
+                    );
+                }
            } else {
                $rows = $this->searchEntity(
                    $entityType,
@@ -411,7 +359,6 @@ class system_search_service
                    $permissionsCatalogAll,
                    $permissionsCatalogOwn,
                    $moduleConfigVisibility,
-                    $allowedDepartmentIds,
                    $forcedCustomerNumbers
                );
            }
@@ -425,7 +372,6 @@ class system_search_service
     * @param array<string, string> $permissionsCatalogAll
     * @param array<int, string> $permissionsCatalogOwn
     * @param array<string, bool> $moduleConfigVisibility
-     * @param array<int, int> $allowedDepartmentIds
     * @param array<int, int> $forcedCustomerNumbers
     * @return array<int, array<string, mixed>>
     */
@@ -438,7 +384,6 @@ class system_search_service
        array $permissionsCatalogAll,
        array $permissionsCatalogOwn,
        array $moduleConfigVisibility,
-        array $allowedDepartmentIds,
        array $forcedCustomerNumbers
    ): array {
        if ($this->isGenericEntityType($entityType)) {
@@ -448,7 +393,6 @@ class system_search_service
                $entityBoost,
                $ownOnly,
                $ownCustomerNumber,
-                $allowedDepartmentIds,
                $forcedCustomerNumbers
            );
        }
@@ -495,24 +439,9 @@ class system_search_service
        return empty(array_intersect($normalizedDirty, system_search_registry::sourceTablesForEntityType($entityType)));
    }

-    private function indexedEntitySupportsDepartmentFilter(string $entityType): bool
-    {
-        $entityType = trim(mb_strtolower($entityType));
-        if (in_array($entityType, ['orders', 'objects'], true)) {
-            return true;
-        }
-
-        $config = system_search_registry::genericEntityConfigs()[$entityType] ?? null;
-        return is_array($config)
-            && isset($config['department_field'])
-            && is_string($config['department_field'])
-            && trim($config['department_field']) !== '';
-    }
-
    /**
     * @param array<int, string> $terms
     * @param array<string, bool> $moduleConfigVisibility
-     * @param array<int, int> $allowedDepartmentIds
     * @param array<int, int> $forcedCustomerNumbers
     * @return array<int, array<string, mixed>>
     */
@@ -523,7 +452,6 @@ class system_search_service
        bool $ownOnly,
        ?int $ownCustomerNumber,
        array $moduleConfigVisibility,
-        array $allowedDepartmentIds,
        array $forcedCustomerNumbers
    ): array {
        global $db;
@@ -545,9 +473,6 @@ class system_search_service
        if (!empty($customerNumbers)) {
            $wheres[] = "`customer_number` IN (" . implode(',', array_map('intval', $customerNumbers)) . ")";
        }
-        if (!empty($allowedDepartmentIds) && $this->indexedEntitySupportsDepartmentFilter($entityType)) {
-            $wheres[] = "`department_id` IN (" . implode(',', array_map('intval', $allowedDepartmentIds)) . ")";
-        }

        $booleanQuery = $this->buildBooleanFullTextQuery($terms);
        $rows = [];
@@ -1126,7 +1051,6 @@ class system_search_service

    private function searchCustomerDiscounts(array $terms, int $entityBoost, bool $ownOnly, ?int $ownCustomerNumber, array $forcedCustomerNumbers): array
    {
-        price_overrides_schema_bootstrap::ensureColumns();
        $customerFilter = '';
        if (!empty($forcedCustomerNumbers)) {
            $customerFilter = ' AND u.customer_number IN (' . implode(',', array_map('intval', $forcedCustomerNumbers)) . ')';
@@ -1141,12 +1065,11 @@ class system_search_service
            'po.is_category',
            'po.product_or_category_id',
            'po.percentage',
-            'po.fixed_price',
            'u.customer_number',
            'u.display_name',
            ...$this->joinTemporalSelectFields('price_overrides', 'po'),
        ];
-        $searchFields = ['po.id', 'po.user_id', 'po.product_or_category_id', 'po.percentage', 'po.fixed_price', 'u.customer_number', 'u.display_name'];
+        $searchFields = ['po.id', 'po.user_id', 'po.product_or_category_id', 'po.percentage', 'u.customer_number', 'u.display_name'];

        if ($this->isEconomicCustomerIndexAvailable()) {
            $fromClause .= ' LEFT JOIN `' . system_search_economic_customer_index::TABLE . '` sci ON sci.customer_number = u.customer_number';
@@ -1208,7 +1131,6 @@ class system_search_service
                    'search_text',
                    'product_or_category_id',
                    'percentage',
-                    'fixed_price',
                    'user_id',
                ], $terms) + $entityBoost,
                'payload' => $this->augmentPayloadWithTemporal([
@@ -1216,7 +1138,6 @@ class system_search_service
                    'customer_number' => isset($row['customer_number']) ? (int)$row['customer_number'] : null,
                    'product_or_category_id' => $row['product_or_category_id'] ?? null,
                    'percentage' => isset($row['percentage']) ? (int)$row['percentage'] : null,
-                    'fixed_price' => isset($row['fixed_price']) ? (int)$row['fixed_price'] : null,
                    'economic_name' => $row['economic_name'] ?? null,
                    'economic_cvr' => $row['economic_cvr'] ?? null,
                ], $row),
@@ -1567,7 +1488,6 @@ class system_search_service

    /**
     * @param array<int, string> $terms
-     * @param array<int, int> $allowedDepartmentIds
     * @param array<int, int> $forcedCustomerNumbers
     * @return array<int, array<string, mixed>>
     */
@@ -1577,7 +1497,6 @@ class system_search_service
        int $entityBoost,
        bool $ownOnly,
        ?int $ownCustomerNumber,
-        array $allowedDepartmentIds = [],
        array $forcedCustomerNumbers = []
    ): array {
        if (empty($terms)) {
@@ -1683,9 +1602,7 @@ class system_search_service
            $customerNumbers,
            $customerField,
            $customerFieldMode,
-            $fixedConditions,
-            $allowedDepartmentIds,
-            $departmentField
+            $fixedConditions
        );

        $this->primeCustomerContexts(array_values(array_unique(array_filter(
@@ -1881,8 +1798,6 @@ class system_search_service
     * @param string|null $customerField
     * @param string $customerFieldMode
     * @param array<string, mixed> $fixedConditions
-     * @param array<int, int> $departmentIds
-     * @param string|null $departmentField
     * @return array<int, array<string, mixed>>
     */
    private function searchTable(
@@ -1893,9 +1808,7 @@ class system_search_service
        array $customerNumbers = [],
        ?string $customerField = null,
        string $customerFieldMode = 'default',
-        array $fixedConditions = [],
-        array $departmentIds = [],
-        ?string $departmentField = null
+        array $fixedConditions = []
    ): array {
        global $db;

@@ -1931,10 +1844,6 @@ class system_search_service
            }
        }

-        if (!empty($departmentIds) && $departmentField !== null && in_array($departmentField, $fields, true)) {
-            $wheres[] = "`$departmentField` IN (" . implode(',', array_map('intval', $departmentIds)) . ")";
-        }
-
        $termClauses = [];
        foreach ($terms as $term) {
            $escaped = $db->escape_string($term);
@@ -2687,11 +2596,6 @@ class system_search_service
        return (int)($this->rankingPenaltyByType[$entityType] ?? 0);
    }

-    private function effectiveResultScore(array $result): int
-    {
-        return (int)($result['score'] ?? 0) + $this->rankingBoost($result) - $this->rankingPenalty($result);
-    }
-
    private function boolishTrue(mixed $value): bool
    {
        if (is_bool($value)) {
@@ -2751,7 +2655,7 @@ class system_search_service
            return false;
        }

-        // Explicit identifiers (order numbers, customer numbers, emails, etc.) imply exact matches.
+        // Explicit identifiers (order numbers, customer numbers, emails, etc.) imply exact intent.
        if ($this->queryHasExplicitIdentifier($normalized)) {
            return false;
        }
@@ -2774,6 +2678,68 @@ class system_search_service
        ]);
    }

+    /**
+     * @param array<int, string> $boostedTypes
+     * @param array<string, array<int, string>> $taxonomy
+     * @return array<int, string>
+     */
+    private function hintAliasTerms(array $boostedTypes, array $taxonomy): array
+    {
+        $terms = [];
+        foreach ($boostedTypes as $type) {
+            $aliases = $taxonomy[$type] ?? [];
+            if (!is_array($aliases)) {
+                continue;
+            }
+            foreach ($aliases as $alias) {
+                if (!is_string($alias) || trim($alias) === '') {
+                    continue;
+                }
+                $terms = [...$terms, ...$this->tokenize($alias)];
+                if (count($terms) >= 12) {
+                    return array_slice(array_values(array_unique($terms)), 0, 12);
+                }
+            }
+        }
+        return array_slice(array_values(array_unique($terms)), 0, 12);
+    }
+
+    /**
+     * Detect natural-language style queries where intent parsing is valuable
+     * even when lexical score looks strong.
+     *
+     * @param array<int, string> $terms
+     */
+    private function queryLooksIntentDriven(string $query, array $terms): bool
+    {
+        $normalized = trim(mb_strtolower($query));
+        if ($normalized === '' || count($terms) < 2) {
+            return false;
+        }
+
+        if ($this->queryHasExplicitIdentifier($normalized)) {
+            return false;
+        }
+
+        $hasIntentVerb = preg_match('/\b(find|show|search|looking|need|want|where|which)\b/iu', $normalized) === 1;
+        $hasRelationalLanguage = preg_match('/\b(with|without|from|between|for|unpaid|overdue|rabat|discount|faktura|invoice|kunde|customer|orders?|vehicles?)\b/iu', $normalized) === 1;
+        $hasStrongDomainLanguage = preg_match('/\b(unpaid|overdue|rabat|discount|faktura|invoice)\b/iu', $normalized) === 1;
+
+        if ($hasStrongDomainLanguage && count($terms) >= 2) {
+            return true;
+        }
+
+        if ($hasIntentVerb && count($terms) >= 3) {
+            return true;
+        }
+
+        if ($hasRelationalLanguage && count($terms) >= 3 && mb_strlen($normalized) >= 16) {
+            return true;
+        }
+
+        return mb_strlen($normalized) >= 28 && count($terms) >= 4;
+    }
+
    private function queryHasExplicitIdentifier(string $normalizedQuery): bool
    {
        if ($normalizedQuery === '') {
@@ -2968,6 +2934,22 @@ class system_search_service
        return system_search_registry::allEntityTypes();
    }

+    private function taxonomy(array $activeTypes): array
+    {
+        $aliases = system_search_registry::taxonomyAliases();
+        $taxonomy = [];
+        foreach ($activeTypes as $type) {
+            $resolved = $aliases[$type] ?? [];
+            if (empty($resolved)) {
+                $human = str_replace('_', ' ', $type);
+                $singular = rtrim($human, 's');
+                $resolved = array_values(array_unique(array_filter([$human, $singular], static fn($v) => is_string($v) && $v !== '')));
+            }
+            $taxonomy[$type] = $resolved;
+        }
+        return $taxonomy;
+    }
+
    private function groupResultsByType(array $results): array
    {
        $grouped = [];
@@ -6,7 +6,6 @@ require_once WD . '/modules/workfeed/workfeed_c.php';

 use Exception;
 use interfaces\workfeed_i;
-use workfeed\config\workfeed_api_url_c;
 use workfeed\workfeed_c;

 class workfeed implements workfeed_i
@@ -85,7 +84,7 @@ class workfeed implements workfeed_i
        $companyId = $this->requireConfiguredCompanyId();

        $url = $this->buildUrl(
-            workfeed_api_url_c::normalizeApiUrlForValidation((string)$this->config->api_url->getVariableValue()),
+            $this->config->api_url->getVariableValue(),
            '/companies/' . rawurlencode($companyId) . '/' . ltrim($path, '/'),
            $query
        );
@@ -183,10 +182,7 @@ class workfeed implements workfeed_i
    private function requireConfiguredApiUrl(): void
    {
        $url = trim((string)$this->config->api_url->getVariableValue());
-        if ($url === ''
-            || filter_var(workfeed_api_url_c::normalizeApiUrlForValidation($url), FILTER_VALIDATE_URL) === false
-            || !workfeed_api_url_c::isTrustedApiUrl($url)
-        ) {
+        if ($url === '' || filter_var($this->normalizeUrlForValidation($url), FILTER_VALIDATE_URL) === false) {
            throw new Exception('Invalid Workfeed API URL configured.');
        }
    }
@@ -214,6 +210,15 @@ class workfeed implements workfeed_i
        return $companyId;
    }

+    private function normalizeUrlForValidation(string $url): string
+    {
+        if (preg_match('#^https?://#i', $url)) {
+            return $url;
+        }
+
+        return 'https://' . ltrim($url, '/');
+    }
+
    /**
     * @throws Exception
     */
@@ -291,12 +291,6 @@ class xlvask_automation_service
        return array_reduce($items, fn(int $total, array $item): int => $total + ((int)($item['price'] ?? 0) * (int)($item['quantity'] ?? 0)), 0);
    }

-    public static function isExactItemMatchForAutomation(array $usageItems, array $orderItems): bool
-    {
-        return self::itemSignaturePartsForAutomation($usageItems) === self::itemSignaturePartsForAutomation($orderItems)
-            && self::itemsTotalForAutomation($usageItems) === self::itemsTotalForAutomation($orderItems);
-    }
-
    public static function productOverlapForAutomation(array $usageItems, array $orderItems): float
    {
        $usageBag = self::productBagForAutomation($usageItems);
@@ -606,52 +600,18 @@ class xlvask_automation_service

        if ($action === self::ACTION_ATTACH) {
            return $xlvask->config->automatic_order_attachment_enabled->isTrue()
-                && $confidence >= self::AUTO_ATTACH_CONFIDENCE
-                && $this->isExactAttachSuggestionForContext($suggestion, $context);
+                && $confidence >= self::AUTO_ATTACH_CONFIDENCE;
        }

        if ($action === self::ACTION_CREATE) {
-            return false;
+            return $xlvask->config->automatic_order_creation_enabled->isTrue()
+                && $context['age_hours'] >= self::CREATE_MIN_AGE_HOURS
+                && $confidence >= self::AUTO_CREATE_CONFIDENCE;
        }

        return false;
    }

-    private function isExactAttachSuggestionForContext(array $suggestion, array $context): bool
-    {
-        if ((string)($suggestion['action'] ?? '') !== self::ACTION_ATTACH) {
-            return false;
-        }
-
-        $matchedOrderId = (int)($suggestion['matched_order_id'] ?? 0);
-        $candidateOrder = $this->candidateOrderFromSuggestion($suggestion);
-        if ($matchedOrderId < 1 || !is_array($candidateOrder) || (int)($candidateOrder['id'] ?? 0) !== $matchedOrderId) {
-            return false;
-        }
-
-        $usageItems = $context['items'] ?? [];
-        $orderItems = $candidateOrder['order_items'] ?? [];
-        return is_array($usageItems)
-            && is_array($orderItems)
-            && self::isExactItemMatchForAutomation($usageItems, $orderItems);
-    }
-
-    private function candidateOrderFromSuggestion(array $suggestion): ?array
-    {
-        $candidateOrder = $suggestion['candidate_order'] ?? null;
-        if (is_array($candidateOrder)) {
-            return $candidateOrder;
-        }
-
-        $candidateOrderJson = $suggestion['candidate_order_json'] ?? null;
-        if (!is_string($candidateOrderJson) || trim($candidateOrderJson) === '') {
-            return null;
-        }
-
-        $decoded = json_decode($candidateOrderJson, true);
-        return is_array($decoded) ? $decoded : null;
-    }
-
    private function executeSuggestion(array $suggestion, array $context, ?int $actorId, bool $automatic): array
    {
        try {
@@ -686,7 +646,7 @@ class xlvask_automation_service

            $latest = $this->loadSuggestion((int)$suggestion['id']) ?? $suggestion;
            if ($automatic) {
-                $this->persistFeedback($context, $action, 'accepted', (int)($latest['matched_order_id'] ?? $latest['created_order_id'] ?? 0), $actorId, $this->automaticFeedbackReason($suggestion, $context));
+                $this->persistFeedback($context, $action, 'accepted', (int)($latest['matched_order_id'] ?? $latest['created_order_id'] ?? 0), $actorId, 'Automatisk accepteret.');
            }

            return $this->formatSuggestion($latest);
@@ -700,15 +660,6 @@ class xlvask_automation_service
        }
    }

-    private function automaticFeedbackReason(array $suggestion, array $context): string
-    {
-        if ($this->isExactAttachSuggestionForContext($suggestion, $context)) {
-            return 'Automatisk accepteret: Prisoverensstemmelse.';
-        }
-
-        return 'Automatisk accepteret.';
-    }
-
    private function createOrderFromContext(array $context): orders_o
    {
        $orderData = $context['proposed_order'];
@@ -1295,20 +1246,19 @@ class xlvask_automation_service
    {
        global $db;
        (new xlvask_usage_logs_o())->structure();
-        $startTimeExpression = "STR_TO_DATE(REPLACE(SUBSTRING(StartTime, 1, 19), 'T', ' '), '%Y-%m-%d %H:%i:%s')";
        $where = [
            'FinishStatus = 1',
            '(ignored_at IS NULL OR ignored_at = "")',
        ];

        if ($dateFrom !== null && strtotime($dateFrom) !== false) {
-            $where[] = "{$startTimeExpression} >= '" . $db->escape_string(date('Y-m-d 00:00:00', strtotime($dateFrom))) . "'";
+            $where[] = "StartTime >= '" . $db->escape_string(date('Y-m-d 00:00:00', strtotime($dateFrom))) . "'";
        } else {
-            $where[] = "{$startTimeExpression} >= '" . $db->escape_string(date('Y-m-d H:i:s', strtotime('-7 days'))) . "'";
+            $where[] = "StartTime >= '" . $db->escape_string(date('Y-m-d H:i:s', strtotime('-7 days'))) . "'";
        }

        if ($dateTo !== null && strtotime($dateTo) !== false) {
-            $where[] = "{$startTimeExpression} <= '" . $db->escape_string(date('Y-m-d 23:59:59', strtotime($dateTo))) . "'";
+            $where[] = "StartTime <= '" . $db->escape_string(date('Y-m-d 23:59:59', strtotime($dateTo))) . "'";
        }

        $limit = max(1, min(500, $limit));
@@ -1,10 +1,6 @@
 {
    "scripts": {
        "test": "composer test:unit",
-        "analyse": "vendor/bin/phpstan analyse --configuration=phpstan.neon.dist --memory-limit=1G --no-progress",
-        "static": "@analyse",
-        "rector:dry-run": "@php -d error_reporting=0 -d display_errors=0 -d log_errors=0 vendor/bin/rector process --dry-run --config rector.php",
-        "rector:fix": "@php -d error_reporting=0 -d display_errors=0 -d log_errors=0 vendor/bin/rector process --config rector.php",
        "test:unit": "vendor/bin/pest --testsuite=Unit --colors=always",
        "test:integration": "vendor/bin/pest --testsuite=Integration --colors=always",
        "test:api": [
@@ -19,8 +19,6 @@ use classes\slack as Slack;
 use classes\email as Email;
 use classes\gatewayapi as GatewayAPI;
 use dynamicimages\images\machine_1;
-use modules\selfserve\config\selfserve_dynamic_image_size_c;
-use modules\selfserve\selfserve_c;
 use goals\classes\goals_criteria;
 use goals\services\goals_progress_alert_renderer;
 use goals\helpers\goals_criteria_progress_alert_destination as Dest;
@@ -35,8 +33,6 @@ use objects\users_o;
 use routes\moduleWeatherAPIRoute;

 require_once __DIR__ . '/../classes/economic_transfer_executor.php';
-
-const DYNAMIC_IMAGE_RELEVANT_MAX_WIDTH = 1600;
 require_once __DIR__ . '/../classes/economic_transfer_queue_schema_bootstrap.php';
 require_once __DIR__ . '/../classes/economic_transfer_queue.php';
 require_once __DIR__ . '/../classes/workfeed_employee_name_formatter.php';
@@ -652,6 +648,7 @@ function SystemSearchCacheMaintenanceCron(): void

        if ($rebuildRequest !== null) {
            system_search_cache::clearQueryCaches();
+            system_search_cache::clearIntentCaches();
            $scope = (string)($rebuildRequest['scope'] ?? 'all');
            $types = array_values(array_filter(array_map('strval', (array)($rebuildRequest['types'] ?? []))));
            if ($scope === 'types' && !empty($types)) {
@@ -933,7 +930,6 @@ function buildDynamicImageCacheKey(array $variant): string
        'current_step' => (int)($variant['current_step'] ?? 0),
        'only_current_step' => (bool)($variant['only_current_step'] ?? false),
        'vehicle_type' => $variant['vehicle_type'] ?? null,
-        'dynamic_image_size' => getSelfServeDynamicImageSizeModeForCron(),
    ];

    $json = json_encode($cacheParams);
@@ -966,11 +962,16 @@ function renderDynamicImageVariant(int $dynamicImageId, ?array $buttons, int $cu
        $image->current_step = max(0, $currentStep);
        $image->only_generate_current_step = $onlyCurrentStep;
        $image->setup();
-        if (getSelfServeDynamicImageSizeModeForCron() === selfserve_dynamic_image_size_c::SIZE_RELEVANT) {
-            $image->resizeToMaxWidth(DYNAMIC_IMAGE_RELEVANT_MAX_WIDTH);
-        }

-        return $image->exportBinary('png');
+        $dataUri = $image->exportAsBase64('png');
+        if (!preg_match('/^data:image\/png;base64,(.*)$/', $dataUri, $matches)) {
+            return null;
+        }
+        $imageData = base64_decode($matches[1], true);
+        if ($imageData === false) {
+            return null;
+        }
+        return $imageData;
    } catch (Throwable $e) {
        warn('PreRenderDynamicImagesCron: render failed for dynamic_image_id=' . $dynamicImageId . ': ' . $e->getMessage());
        return null;
@@ -984,19 +985,6 @@ function renderDynamicImageVariant(int $dynamicImageId, ?array $buttons, int $cu
    }
 }

-function getSelfServeDynamicImageSizeModeForCron(): string
-{
-    try {
-        $mode = (string)(new selfserve_c())->dynamic_image_size->getVariableValue();
-    } catch (Throwable) {
-        return selfserve_dynamic_image_size_c::SIZE_ORIGINAL;
-    }
-
-    return in_array($mode, [selfserve_dynamic_image_size_c::SIZE_ORIGINAL, selfserve_dynamic_image_size_c::SIZE_RELEVANT], true)
-        ? $mode
-        : selfserve_dynamic_image_size_c::SIZE_ORIGINAL;
-}
-
 /**
 * @param mixed $value
 * @return array<int|string>
@@ -5,21 +5,6 @@ $isPreview = $_GET['preview'] ?? false;
 // Remove query string if present
 $file = strtok($file, '?');

-// Require authentication for direct /files/ access
-if (str_contains($file, '/files/')) {
-    $headers = getallheaders();
-    $token = $_GET['token'] ?? $_POST['token'] ?? ($headers['Authorization'] ?? null);
-    if (!empty($token)) {
-        $token = str_replace('Bearer ', '', $token);
-    }
-
-    if (empty($token) || !(new \classes\authentication())->validate_token($token)) {
-        header('HTTP/1.1 401 Unauthorized');
-        echo 'Unauthorized';
-        exit;
-    }
-}
-
 $isPDF = false;
 $isPDFStore = false;
 $isAttachment = false;
@@ -55,6 +40,20 @@ if ($isPDF && $isPDFStore) {

    // Check if the certificate exists
    if (!$wash_certificate_store->isFileInStore($file)) {
+        // Try the PDF store
+        $pdf_store = new \classes\pdf_store();
+        if ($pdf_store->isFileInStore(str_replace('/files/', '', $file))) {
+            // Download the certificate from the PDF store to /tmp
+            $certificate_path = $pdf_store->download(str_replace('/files/', '', $file));
+            // Send the certificate to the client
+            header('Content-Type: application/pdf');
+            header('Content-Disposition: inline; filename="' . str_replace('/files/', '', $file) . '"');
+            header('Content-Length: ' . filesize($certificate_path));
+            readfile($certificate_path);
+            // Delete the certificate from /tmp after sending it
+            unlink($certificate_path);
+            exit;
+        }
        echo 'Certificate not found in store' . $file;
        //header('HTTP/1.1 404 Not Found');
        exit;
@@ -119,4 +118,4 @@ if (!$isPDF) {
    // Delete the file from /tmp after sending it
    unlink($file_path);
    exit;
-}
+}
@@ -61,17 +61,6 @@ try {
 spl_autoload_register(function (string $class): void {
    $class = ltrim($class, '\\');
    $cache_key = 'autoload:' . $class;
-    $wdReal = rtrim((string) realpath(WD), DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
-    $modulesRoot = $wdReal . 'modules' . DIRECTORY_SEPARATOR;
-    $isPathInside = static function (string $path, string $root): bool {
-        $resolved = realpath($path);
-        if ($resolved === false) {
-            return false;
-        }
-
-        $resolved = rtrim($resolved, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
-        return str_starts_with($resolved, $root);
-    };
    $is_loaded = static function (string $candidate): bool {
        return class_exists($candidate, false)
            || interface_exists($candidate, false)
@@ -84,13 +73,11 @@ spl_autoload_register(function (string $class): void {
        try {
            $cached = redis->get($cache_key);
            if (is_string($cached) && $cached !== '' && is_file($cached)) {
-                if ($isPathInside($cached, $wdReal)) {
-                    require_once $cached;
-                    if ($is_loaded($class)) {
-                        return;
-                    }
+                require_once $cached;
+                if ($is_loaded($class)) {
+                    return;
                }
-                // Stale, invalid, or unsafe class mapping in cache; continue with normal lookup.
+                // Stale class mapping in cache, continue with normal lookup.
                redis->delete($cache_key);
            } elseif (is_string($cached) && $cached !== '') {
                // Remove non-existing cached path to avoid repeated failed lookups.
@@ -133,18 +120,6 @@ spl_autoload_register(function (string $class): void {
                    $module_dirs = redis->get_array('autoload:module_dirs');
                } catch (\Throwable $e) {}
            }
-
-            if (is_array($module_dirs)) {
-                $module_dirs = array_values(array_filter($module_dirs, static function ($item) use ($base, $modulesRoot, $isPathInside): bool {
-                    if (!is_string($item) || $item === '' || str_contains($item, DIRECTORY_SEPARATOR) || str_contains($item, '..')) {
-                        return false;
-                    }
-
-                    $candidate = $base . 'modules' . DIRECTORY_SEPARATOR . $item;
-                    return is_dir($candidate) && $isPathInside($candidate, $modulesRoot);
-                }));
-            }
-
            if ($module_dirs === null) {
                $module_dirs = array_filter(scandir($base . 'modules'), function($item) use ($base) {
                    return $item !== '.' && $item !== '..' && is_dir($base . 'modules' . DIRECTORY_SEPARATOR . $item);
@@ -262,6 +237,11 @@ if (php_sapi_name() === 'cli' || isset($_GET['internalCronCall'])) {
    exit;
 }

+// If the route ends with .php, then require the file_server.php
+if (str_contains($_SERVER['REQUEST_URI'], '.pdf')) {
+    require_once 'file_server.php';
+    exit;
+}
 // If the route ends with a MIME type, then require the file_server.php
 if ((preg_match('/\.(jpg|jpeg|png)$/', $_SERVER['REQUEST_URI']) || str_contains($_SERVER['REQUEST_URI'], '/files/'))) {
    require_once 'file_server.php';
@@ -12,35 +12,10 @@ interface licenseplaterecognizer_i extends universal_module_i
     * @return array An array containing the plate number and other relevant information.
     */
    public function licenseplaterecognizer(string $base64_image): array;
-
-    /**
-     * Get the plate number from raw uploaded image bytes.
-     * @param string $image_data Raw uploaded image bytes.
-     * @param string $mime_type The image MIME type.
-     * @return array An array containing the plate number and other relevant information.
-     */
-    public function licenseplaterecognizerUpload(string $image_data, string $mime_type = 'image/jpeg'): array;
-
-    /**
-     * Get the plate number from raw uploaded image bytes without building an exact-result cache key.
-     * @param string $image_data Raw uploaded image bytes.
-     * @param string $mime_type The image MIME type.
-     * @return array An array containing the plate number and other relevant information.
-     */
-    public function licenseplaterecognizerUploadUncached(string $image_data, string $mime_type = 'image/jpeg'): array;
-
-    /**
-     * Get the plate number from a PHP upload temp file without copying it into memory.
-     * @param string $image_path The uploaded image temp-file path.
-     * @param string $mime_type The image MIME type.
-     * @return array An array containing the plate number and other relevant information.
-     */
-    public function licenseplaterecognizerUploadFile(string $image_path, string $mime_type = 'image/jpeg'): array;
-
    /**
     * Get usage information about the license plate recognizer module.
     * @returns licenseplaterecognizer_info An object containing usage statistics and information.
     * @see licenseplaterecognizer_info
     */
    public function get_usage(): licenseplaterecognizer_info;
-}
+}
@@ -0,0 +1,26 @@
+<?php
+
+namespace interfaces;
+
+interface system_search_intent_parser_i
+{
+    /**
+     * Parse a natural-language search query into structured search hints.
+     *
+     * @param string $query The raw user query.
+     * @param array $allowedEntityTypes Entity types the caller is allowed to search.
+     * @param array $taxonomy Public taxonomy/aliases to improve intent parsing.
+     * @return array{
+     *   success: bool,
+     *   normalized_query: string,
+     *   aliases: array<int, string>,
+     *   entity_hints: array<int, string>,
+     *   confidence: float,
+     *   association_hint: bool,
+     *   fallback_reason: string|null,
+     *   source: string
+     * }
+     */
+    public function parse(string $query, array $allowedEntityTypes, array $taxonomy = []): array;
+}
+
@@ -5,7 +5,6 @@ namespace attachments\helpers;
 class attachment_content
 {
    const OTHER_TYPE_WASH_CERTIFICATE = 'WASH_CERTIFICATE';
-    const OTHER_TYPE_SELF_SERVE_WASH = 'SELF_SERVE_WASH';
    public ?string $image; // Used to store the attachment object name, in the attachment store.
    public ?string $document; // Used to store the attachment object name, in the attachment store.
    public ?attachment_relation $relation; // Used to store the attachment relation object.
@@ -50,4 +49,4 @@ class attachment_content
        $this->relation = $relation;
        return $this;
    }
-}
+}
@@ -131,7 +131,7 @@
      "post": {
        "tags": ["User Bookings"],
        "summary": "Get download link for a booking's wash certificate",
-        "description": "Requires permission `download_own_wash_certificate`, except authenticated customer accounts may download certificates for their own bookings. Returns a presigned download link if certificate exists and user has access.",
+        "description": "Requires permission `download_own_wash_certificate`. Returns a presigned download link if certificate exists and user has access.",
        "parameters": [ { "$ref": "#/components/parameters/id" } ],
        "responses": {
          "200": { "description": "Link", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnvelopeDownloadLink" } } } },
@@ -146,7 +146,7 @@
      "get": {
        "tags": ["User Bookings"],
        "summary": "Get download link for a booking's wash certificate PDF",
-        "description": "Requires permission `download_own_wash_certificate`, except authenticated customer accounts may download certificates for their own bookings. Checks both legacy and current storage buckets.",
+        "description": "Requires permission `download_own_wash_certificate`. Checks both legacy and current storage buckets.",
        "parameters": [ { "$ref": "#/components/parameters/id" } ],
        "responses": {
          "200": { "description": "Link", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnvelopeDownloadLink" } } } },
@@ -1,25 +0,0 @@
-<?php
-
-namespace modules\coolify\config;
-
-use traits\module_config_variable;
-
-class coolify_github_runner_backend_repository_c
-{
-    use module_config_variable;
-
-    public function __construct()
-    {
-        $this->setupConfigVariable(
-            'Coolify',
-            'github_runner_backend_repository',
-            'string',
-            false,
-            null,
-            'GitHub backend repository that receives Coolify-managed self-hosted runners.',
-            'copenhagentruckwash/api',
-            false,
-            'copenhagentruckwash/api'
-        );
-    }
-}
@@ -1,25 +0,0 @@
-<?php
-
-namespace modules\coolify\config;
-
-use traits\module_config_variable;
-
-class coolify_github_runner_count_per_repo_c
-{
-    use module_config_variable;
-
-    public function __construct()
-    {
-        $this->setupConfigVariable(
-            'Coolify',
-            'github_runner_count_per_repo',
-            'int',
-            false,
-            null,
-            'Number of self-hosted GitHub runner containers to deploy per repository.',
-            '1',
-            false,
-            '1'
-        );
-    }
-}
@@ -1,25 +0,0 @@
-<?php
-
-namespace modules\coolify\config;
-
-use traits\module_config_variable;
-
-class coolify_github_runner_frontend_repository_c
-{
-    use module_config_variable;
-
-    public function __construct()
-    {
-        $this->setupConfigVariable(
-            'Coolify',
-            'github_runner_frontend_repository',
-            'string',
-            false,
-            null,
-            'GitHub frontend repository that receives Coolify-managed self-hosted runners.',
-            'copenhagentruckwash/pleno-vue',
-            false,
-            'copenhagentruckwash/pleno-vue'
-        );
-    }
-}
@@ -1,25 +0,0 @@
-<?php
-
-namespace modules\coolify\config;
-
-use traits\module_config_variable;
-
-class coolify_github_runner_labels_c
-{
-    use module_config_variable;
-
-    public function __construct()
-    {
-        $this->setupConfigVariable(
-            'Coolify',
-            'github_runner_labels',
-            'string',
-            false,
-            null,
-            'Comma-separated GitHub Actions runner labels registered on each Coolify-managed runner.',
-            'self-hosted,Linux,X64,default',
-            false,
-            'self-hosted,Linux,X64,default'
-        );
-    }
-}
@@ -1,25 +0,0 @@
-<?php
-
-namespace modules\coolify\config;
-
-use traits\module_config_variable;
-
-class coolify_github_runner_service_uuid_c
-{
-    use module_config_variable;
-
-    public function __construct()
-    {
-        $this->setupConfigVariable(
-            'Coolify',
-            'github_runner_service_uuid',
-            'string',
-            false,
-            null,
-            'Coolify service UUID for the managed GitHub self-hosted runner stack.',
-            'abc123...',
-            false,
-            ''
-        );
-    }
-}
@@ -1,38 +0,0 @@
-<?php
-
-namespace modules\coolify\config;
-
-use classes\replication_secret_box;
-use traits\module_config_variable;
-
-class coolify_github_runner_token_c
-{
-    use module_config_variable {
-        setVariableValue as private traitSetVariableValue;
-    }
-
-    public function __construct()
-    {
-        $this->setupConfigVariable(
-            'Coolify',
-            'github_runner_token',
-            'string',
-            false,
-            null,
-            'GitHub PAT used to register Coolify-managed self-hosted repository runners.',
-            'github_pat_...',
-            true,
-            ''
-        );
-    }
-
-    public function setVariableValue(mixed $value): void
-    {
-        $value = trim((string)($value ?? ''));
-        if ($value !== '' && !str_starts_with($value, 'twsec:v1:')) {
-            $value = replication_secret_box::encrypt($value);
-        }
-
-        $this->traitSetVariableValue($value);
-    }
-}
@@ -86,14 +86,6 @@ interface dynamicimages_image_i
     */
    public function exportAsBase64(?string $format = null, int $quality = 90): string;

-    /**
-     * Export the composed image as binary image data.
-     * @param string|null $format Optional target format (e.g. 'png', 'jpeg')
-     * @param int $quality Quality for lossy formats (0-100)
-     * @return string binary image data
-     */
-    public function exportBinary(?string $format = null, int $quality = 90): string;
-
    /**
     * Directly serve the composed image to the client with proper headers.
     * Convenience wrapper for outputting binary image data.
@@ -102,4 +94,4 @@ interface dynamicimages_image_i
     * @param int $quality Quality for lossy formats (0-100)
     */
    public function servePicture(?string $format = null, int $quality = 90): void;
-}
+}
@@ -226,20 +226,6 @@ trait dynamicimages_image_t
        return $this;
    }

-    public function resizeToMaxWidth(int $maxWidth): dynamicimages_image_i
-    {
-        $this->assertCanvasInitialized();
-        if ($maxWidth <= 0) {
-            throw new \InvalidArgumentException('Resize max width must be a positive integer.');
-        }
-        if ($this->canvasWidth === null || $this->canvasHeight === null || $this->canvasWidth <= $maxWidth) {
-            return $this;
-        }
-
-        $height = (int)round($this->canvasHeight * ($maxWidth / $this->canvasWidth));
-        return $this->resize($maxWidth, max(1, $height));
-    }
-
    public function crop(int $width, int $height, int $x, int $y): dynamicimages_image_i
    {
        $this->assertCanvasInitialized();
@@ -321,8 +307,20 @@ trait dynamicimages_image_t
     */
    public function exportAsBase64(?string $format = null, int $quality = 90): string
    {
+        // If a canvas is initialized, export that as PNG by default
        if ($this->image instanceof \Imagick) {
-            return 'data:image/png;base64,' . base64_encode($this->exportBinary($format, $quality));
+            $img = clone $this->image;
+            $img->setImageFormat('png');
+            // Quality influences compression for PNG differently; keep as hint
+            if ($format !== null && strtolower($format) !== 'png') {
+                // For now we only support PNG for composed images as requested
+            }
+            // Strip metadata to reduce size
+            $img->stripImage();
+            $blob = $img->getImageBlob();
+            $img->clear();
+            $img->destroy();
+            return 'data:image/png;base64,' . base64_encode($blob);
        }

        // Fallback: export first asset as-is
@@ -343,40 +341,6 @@ trait dynamicimages_image_t
        return 'data:' . $mime . ';base64,' . base64_encode($data);
    }

-    public function exportBinary(?string $format = null, int $quality = 90): string
-    {
-        // If a canvas is initialized, export that as PNG by default
-        if ($this->image instanceof \Imagick) {
-            $img = clone $this->image;
-            $img->setImageFormat('png');
-            // Quality influences compression for PNG differently; keep as hint
-            if ($format !== null && strtolower($format) !== 'png') {
-                // For now we only support PNG for composed images as requested
-            }
-            // Strip metadata to reduce size
-            $img->stripImage();
-            $blob = $img->getImageBlob();
-            $img->clear();
-            $img->destroy();
-            return $blob;
-        }
-
-        // Fallback: export first asset as-is
-        if (empty($this->assets)) {
-            throw new \RuntimeException('No assets available to export.');
-        }
-        $asset = $this->assets[0];
-        $path = $asset->getPath();
-        if (!is_readable($path)) {
-            throw new \RuntimeException('Asset is not readable: ' . $path);
-        }
-        $data = file_get_contents($path);
-        if ($data === false) {
-            throw new \RuntimeException('Failed to read asset: ' . $path);
-        }
-        return $data;
-    }
-
    public function getAsset(string $asset_name): ?dynamicimages_asset
    {
        foreach ($this->assets as $asset) {
@@ -393,18 +357,22 @@ trait dynamicimages_image_t
     */
    public function outputImage(?string $format = null, int $quality = 90): void
    {
-        $mimeType = 'image/png';
-        if (!$this->image instanceof \Imagick && !empty($this->assets)) {
-            $asset = $this->assets[0];
-            $path = $asset->getPath();
-            $imgInfo = is_readable($path) ? @getimagesize($path) : false;
-            $mimeType = is_array($imgInfo) && isset($imgInfo['mime']) ? $imgInfo['mime'] : 'application/octet-stream';
+        $dataUri = $this->exportAsBase64($format, $quality);
+        // Extract mime type and base64 data
+        if (preg_match('/^data:(image\/[a-zA-Z0-9+.-]+);base64,(.*)$/', $dataUri, $matches)) {
+            $mimeType = $matches[1];
+            $base64Data = $matches[2];
+            // Decode base64 data
+            $imageData = base64_decode($base64Data);
+            if ($imageData !== false) {
+                // Send appropriate headers
+                header('Content-Type: ' . $mimeType);
+                header('Content-Length: ' . strlen($imageData));
+                // Output the image data
+                echo $imageData;
+                exit;
+            }
        }
-        $imageData = $this->exportBinary($format, $quality);
-        header('Content-Type: ' . $mimeType);
-        header('Content-Length: ' . strlen($imageData));
-        echo $imageData;
-        exit;
    }

    /**
@@ -414,4 +382,4 @@ trait dynamicimages_image_t
    {
        $this->outputImage($format, $quality);
    }
-}
+}
@@ -14,8 +14,6 @@ class economic_customer_mo
    public null|string $message;
    public null|string $corporateIdentificationNumber;
    public null|string $email;
-    public null|string $ean;
-    public null|string $publicEntryNumber;
    public null|string $mobilePhone;
    public null|string $currency;
    public null|string $country;
@@ -48,8 +46,6 @@ class economic_customer_mo
        $this->zip = ($customer->zip ?? null);
        $this->corporateIdentificationNumber = ($customer->corporateIdentificationNumber ?? null);
        $this->email = ($customer->email ?? null);
-        $this->ean = ($customer->ean ?? null);
-        $this->publicEntryNumber = ($customer->publicEntryNumber ?? $customer->public_entry_number ?? null);
        $this->mobilePhone = ($customer->mobilePhone ?? null);
        $this->currency = ($customer->currency ?? null);
        $this->country = ($customer->country ?? null);
@@ -104,8 +100,6 @@ class economic_customer_mo
            'zip' => $this->zip,
            'corporateIdentificationNumber' => $this->corporateIdentificationNumber,
            'email' => $this->email,
-            'ean' => $this->ean,
-            'publicEntryNumber' => $this->publicEntryNumber,
            'mobilePhone' => $this->mobilePhone,
            'currency' => $this->currency,
            'country' => $this->country,
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jeppe Bundgaard	a3f685c949	Merge remote-tracking branch 'origin/master' into beta	2026-05-27 11:47:40 +02:00
Jeppe Bundgaard	d288761151	Add 'test' key with 'Beta tests' label to workerRoute response data.	2026-05-21 11:39:40 +02:00