autoheal(ios): align validate-app-store.mjs with renamed da locale (#331)

Auto-merged by cron with review-gate (trivial change, no critical path).

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "07:00"
+      timezone: Europe/Copenhagen
+    open-pull-requests-limit: 5
+    labels: [dependencies, ci]
+
+  - package-ecosystem: bundler
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "07:15"
+      timezone: Europe/Copenhagen
+    open-pull-requests-limit: 3
+    labels: [dependencies, ios]

.github/workflows/app-store-readiness.yml

@@ -0,0 +1,88 @@
+name: App Store Readiness
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+    paths:
+      - "fastlane/**"
+      - "ios/**"
+      - "scripts/mobile/**"
+      - "tests/node/app-store-connect.test.mjs"
+      - ".github/workflows/app-store-readiness.yml"
+      - "Gemfile*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: app-store-readiness-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: App Store Readiness
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        with:
+          ruby-version: "3.3"
+
+      - name: Resolve the pinned Fastlane dependency graph
+        run: bundle lock
+
+      - name: Check the committed Fastlane dependency lock
+        id: fastlane-lock
+        continue-on-error: true
+        run: test -z "$(git status --porcelain -- Gemfile.lock)"
+
+      - name: Preserve a generated lock for review
+        if: steps.fastlane-lock.outcome == 'failure'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: generated-fastlane-lock
+          path: Gemfile.lock
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Require a current committed Fastlane dependency lock
+        if: steps.fastlane-lock.outcome == 'failure'
+        run: |
+          echo 'Gemfile.lock is missing or stale. Download generated-fastlane-lock and commit it.' >&2
+          exit 1
+
+      - name: Install the pinned Fastlane dependency graph
+        run: bundle install --jobs 4 --retry 3
+
+      - name: Validate strict App Store metadata and candidate assets
+        run: node scripts/mobile/validate-app-store.mjs --strict
+
+      - name: Validate native mobile permissions
+        run: node scripts/mobile/check-permissions.mjs
+
+      - name: Test App Store Connect automation
+        run: node --test tests/node/app-store-connect.test.mjs
+
+      - name: Validate Fastlane configuration
+        run: bundle exec fastlane lanes
+
+      - name: Validate JavaScript syntax
+        run: |
+          node --check scripts/mobile/validate-app-store.mjs
+          node --check scripts/mobile/app-store-connect.mjs
+          node --check scripts/mobile/create-ios-release-manifest.mjs
+          node --check tests/node/app-store-connect.test.mjs
+          node scripts/mobile/app-store-connect.mjs self-test-jwt

.github/workflows/code_quality.yml

@@ -1,66 +0,0 @@
-name: Qodana
-
-on:
-  workflow_dispatch:
-  pull_request:
-    branches: [master, beta, canary, internal]
-    types: [opened, synchronize, reopened, ready_for_review]
-  push:
-    branches: [master, beta, canary, internal]
-
-permissions:
-  contents: read
-  checks: write
-  pull-requests: write
-
-concurrency:
-  group: qodana-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  qodana:
-    name: Qodana
-    if: >-
-      github.event_name != 'pull_request' ||
-      (
-        github.event.pull_request.draft == false &&
-        github.event.pull_request.head.repo.full_name == github.repository &&
-        github.event.pull_request.user.login != 'dependabot[bot]'
-      )
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-
-    steps:
-      - name: Checkout repository
-        # v5.0.1
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
-        with:
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Require Qodana project token
-        shell: bash
-        env:
-          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
-        run: |
-          set -euo pipefail
-          if [[ -z "${QODANA_TOKEN:-}" ]]; then
-            echo "::error::QODANA_TOKEN is not configured for this repository."
-            exit 1
-          fi
-
-      - name: Qodana
-        # v2026.1.3
-        uses: JetBrains/qodana-action@4861e015da555e86a72b862892aba6c2b93e6891
-        with:
-          use-caches: true
-          cache-default-branch-only: true
-          upload-result: false
-          use-annotations: true
-          pr-mode: ${{ github.event_name == 'pull_request' }}
-          post-pr-comment: true
-          github-token: ${{ github.token }}
-          push-fixes: none
-        env:
-          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}

.github/workflows/cpanel-root-restore.yml

@@ -1,99 +0,0 @@
-name: cPanel Root Audit and Restore
-
-on:
-  workflow_dispatch:
-    inputs:
-      mode:
-        description: Audit is read-only; restore exchanges public_html with a retained recovery entry.
-        required: true
-        default: audit
-        type: choice
-        options:
-          - audit
-          - restore
-      recovery:
-        description: Exact recovery entry reported by an audit, for example public_html.recovery-20260720.
-        required: false
-        type: string
-      state_token:
-        description: Exact 64-character audit-metadata state token reported by the audit.
-        required: false
-        type: string
-      confirmation:
-        description: For restore, type RESTORE <recovery> TO <webroot> STATE <state-token> exactly.
-        required: false
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: frontend-production
-  cancel-in-progress: false
-
-jobs:
-  audit-or-restore:
-    runs-on: [self-hosted, Linux, X64, default]
-    timeout-minutes: 10
-    environment:
-      name: frontend-production
-      url: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-node@v5
-        with:
-          node-version: 22
-
-      - name: Audit cPanel primary webroot
-        if: inputs.mode == 'audit'
-        id: audit
-        run: node scripts/release/cpanel-root.mjs audit
-        env:
-          NODE_OPTIONS: --use-system-ca
-          PRODUCTION_CPANEL_USER: ${{ secrets.PRODUCTION_CPANEL_USER }}
-          PRODUCTION_CPANEL_API_TOKEN: ${{ secrets.PRODUCTION_CPANEL_API_TOKEN }}
-          PRODUCTION_CPANEL_API_URL: ${{ vars.PRODUCTION_CPANEL_API_URL }}
-          PRODUCTION_CPANEL_PATH: ${{ vars.PRODUCTION_CPANEL_PATH }}
-          PRODUCTION_CPANEL_WEBROOT: ${{ vars.PRODUCTION_CPANEL_WEBROOT || 'public_html' }}
-          PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
-          CPANEL_ROOT_REPORT_PATH: output/cpanel-root/audit.json
-
-      - name: Validate restore inputs
-        if: inputs.mode == 'restore'
-        env:
-          RECOVERY: ${{ inputs.recovery }}
-          STATE_TOKEN: ${{ inputs.state_token }}
-          CONFIRMATION: ${{ inputs.confirmation }}
-          WEBROOT: ${{ vars.PRODUCTION_CPANEL_WEBROOT || 'public_html' }}
-        run: |
-          test -n "$RECOVERY"
-          [[ "$STATE_TOKEN" =~ ^[a-f0-9]{64}$ ]]
-          test "$CONFIRMATION" = "RESTORE $RECOVERY TO $WEBROOT STATE $STATE_TOKEN"
-
-      - name: Restore retained cPanel webroot
-        if: inputs.mode == 'restore'
-        run: node scripts/release/cpanel-root.mjs restore
-        env:
-          NODE_OPTIONS: --use-system-ca
-          PRODUCTION_CPANEL_USER: ${{ secrets.PRODUCTION_CPANEL_USER }}
-          PRODUCTION_CPANEL_API_TOKEN: ${{ secrets.PRODUCTION_CPANEL_API_TOKEN }}
-          PRODUCTION_CPANEL_API_URL: ${{ vars.PRODUCTION_CPANEL_API_URL }}
-          PRODUCTION_CPANEL_PATH: ${{ vars.PRODUCTION_CPANEL_PATH }}
-          PRODUCTION_CPANEL_WEBROOT: ${{ vars.PRODUCTION_CPANEL_WEBROOT || 'public_html' }}
-          PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
-          CPANEL_ROOT_RECOVERY: ${{ inputs.recovery }}
-          CPANEL_ROOT_STATE_TOKEN: ${{ inputs.state_token }}
-          CPANEL_ROOT_CONFIRMATION: ${{ inputs.confirmation }}
-          CPANEL_ROOT_REPORT_PATH: output/cpanel-root/restore.json
-
-      - name: Upload cPanel root report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: cpanel-root-${{ inputs.mode }}-${{ github.run_id }}
-          path: output/cpanel-root
-          if-no-files-found: ignore
-          retention-days: 30

.github/workflows/deploy.yml

@@ -0,0 +1,112 @@
+name: Deploy pleno-vue to Hetzner (staging)
+
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-pleno-vue
+  cancel-in-progress: false
+
+env:
+  DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+  DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+
+jobs:
+  test-and-deploy:
+    name: Build + Deploy
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Setup Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install + Build
+        run: |
+          npm ci --ignore-scripts
+          npm run build
+
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@v0.10.0
+        with:
+          ssh-private-key: ${{ secrets.DEPLOY_SSH_KEY }}
+
+      - name: Add host key
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: Pre-deploy snapshot
+        id: pre
+        run: |
+          ssh "$DEPLOY_USER@$DEPLOY_HOST" '
+            set -e
+            cd /opt/pleno-vue
+            git rev-parse HEAD > /tmp/last_deploy_sha
+            echo "pre_sha=$(cat /tmp/last_deploy_sha)" >> $GITHUB_OUTPUT
+          '
+
+      - name: Deploy
+        id: deploy
+        run: |
+          ssh "$DEPLOY_USER@$DEPLOY_HOST" '
+            set -e
+            cd /opt/pleno-vue
+            git fetch origin master
+            git reset --hard origin/master
+            npm ci --ignore-scripts
+            npm run build
+            sudo systemctl reload nginx || true
+            sudo systemctl reload pleno-vue || true
+            echo "Deploy complete: $(git rev-parse --short HEAD)"
+          '
+
+      - name: Smoke test
+        id: smoke
+        continue-on-error: true
+        env:
+          SMOKE_BASE_URL: ${{ secrets.SMOKE_BASE_URL }}
+        run: |
+          bash scripts/smoke-test.sh "$SMOKE_BASE_URL"
+
+      - name: Sergii Review Batch smoke test (TRU-96)
+        id: smoke_sergii
+        continue-on-error: true
+        env:
+          SMOKE_BASE_URL: ${{ secrets.SMOKE_BASE_URL }}
+        run: |
+          bash scripts/smoke-test-sergii.sh "$SMOKE_BASE_URL"
+
+      - name: Auto-rollback on smoke failure
+        if: steps.smoke.outcome == 'failure' || steps.smoke_sergii.outcome == 'failure'
+        run: |
+          reason="$([ "${{ steps.smoke.outcome }}" = 'failure' ] && echo 'generic smoke' || echo 'Sergii Review Batch smoke')"
+          echo "::error::$reason test failed — rolling back to ${{ steps.pre.outputs.pre_sha }}"
+          ssh "$DEPLOY_USER@$DEPLOY_HOST" '
+            set -e
+            cd /opt/pleno-vue
+            git reset --hard ${{ steps.pre.outputs.pre_sha }}
+            npm ci --ignore-scripts
+            npm run build
+            sudo systemctl reload nginx || true
+          '
+
+      - name: Post Slack status
+        if: always()
+        uses: slackapi/slack-github-action@v4.0.0
+        with:
+          channel-id: ${{ secrets.AI_DAILY_CHANNEL }}
+          payload: |
+            {
+              "text": "${{ job.status == 'success' && '✅' || '❌' }} Deploy *pleno-vue@${{ github.sha[0:7] }}* — ${{ job.status }}\n${{ steps.smoke.outcome == 'failure' && '⚠️ Generic smoke FAILED → auto-rolled back' || steps.smoke_sergii.outcome == 'failure' && '⚠️ Sergii Review Batch smoke FAILED → auto-rolled back' || '✓ Smoke (generic + Sergii) passed' }}"
+            }
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

.github/workflows/ftps-root-repair.yml

@@ -1,72 +0,0 @@
-name: Frontend Root FTPS Repair
-
-on:
-  workflow_dispatch:
-    inputs:
-      mode:
-        description: Audit downloads and hashes .htaccess; repair backs it up and activates the reviewed file.
-        required: true
-        default: audit
-        type: choice
-        options:
-          - audit
-          - repair
-
-permissions:
-  contents: read
-
-concurrency:
-  group: frontend-production
-  cancel-in-progress: false
-
-jobs:
-  audit-or-repair:
-    runs-on: [self-hosted, Linux, X64, default]
-    timeout-minutes: 10
-    environment:
-      name: frontend-production
-      url: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-node@v5
-        with:
-          node-version: 22
-
-      - name: Install secure FTP client without system changes
-        run: |
-          if command -v lftp >/dev/null 2>&1; then
-            exit 0
-          fi
-
-          package_root="$RUNNER_TEMP/lftp-package"
-          mkdir -p "$package_root"
-          (
-            cd "$package_root"
-            apt-get download lftp
-            dpkg-deb --extract ./lftp_*.deb root
-          )
-          echo "$package_root/root/usr/bin" >> "$GITHUB_PATH"
-
-      - name: Audit or repair live root .htaccess
-        run: bash scripts/release/repair-public-htaccess.sh "${{ inputs.mode }}"
-        env:
-          NODE_OPTIONS: --use-system-ca
-          PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}
-          PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
-          PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
-          PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
-          PRODUCTION_CPANEL_WEBROOT: ${{ vars.PRODUCTION_CPANEL_WEBROOT || 'public_html' }}
-          PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
-          ROOT_REPAIR_REPORT_DIR: output/cpanel-root-ftps
-
-      - name: Upload FTPS root report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: frontend-root-ftps-${{ inputs.mode }}-${{ github.run_id }}
-          path: output/cpanel-root-ftps
-          if-no-files-found: ignore
-          retention-days: 30

.github/workflows/ios-app-store-candidate.yml

@@ -0,0 +1,190 @@
+name: iOS App Store Candidate
+
+on:
+  push:
+    tags: ["ios-v*"]
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ios-app-store-candidate
+  cancel-in-progress: false
+
+jobs:
+  resolve:
+    name: Resolve exact tested build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    outputs:
+      enabled: ${{ steps.resolve.outputs.enabled }}
+      source_sha: ${{ steps.resolve.outputs.source_sha }}
+      version: ${{ steps.resolve.outputs.version }}
+      build_number: ${{ steps.manifest.outputs.build_number }}
+      app_store_build_id: ${{ steps.manifest.outputs.app_store_build_id }}
+    steps:
+      - name: Checkout tagged source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Validate protected tag and release version
+        id: resolve
+        shell: bash
+        env:
+          AUTOMATION_ENABLED: ${{ vars.APP_STORE_AUTOMATION_ENABLED || 'false' }}
+        run: |
+          set -euo pipefail
+          [[ "$GITHUB_REF_NAME" =~ ^ios-v([0-9]+\.[0-9]+\.[0-9]+)$ ]] || { echo "Tag must be ios-vX.Y.Z." >&2; exit 1; }
+          version="${BASH_REMATCH[1]}"
+          source_sha="$(git rev-parse HEAD)"
+          manifest_version="$(node -p "JSON.parse(require('fs').readFileSync('ios/release.json')).marketingVersion")"
+          [[ "$version" == "$manifest_version" ]] || { echo "Tag version $version does not match ios/release.json $manifest_version." >&2; exit 1; }
+          git show-ref --verify --quiet refs/remotes/origin/master || { echo "origin/master was not included in the full checkout." >&2; exit 1; }
+          git merge-base --is-ancestor "$source_sha" origin/master || { echo "Tagged commit is not reachable from master." >&2; exit 1; }
+          enabled=false
+          [[ "$AUTOMATION_ENABLED" == true ]] && enabled=true
+          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
+          echo "source_sha=$source_sha" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          if [[ "$enabled" != true ]]; then
+            echo "### Candidate promotion safely disabled" >> "$GITHUB_STEP_SUMMARY"
+            echo 'No App Store environment or credentials were accessed. Enable only after the signed canary.' >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Download exact TestFlight release manifest
+        if: steps.resolve.outputs.enabled == 'true'
+        id: manifest
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ steps.resolve.outputs.source_sha }}
+          EXPECTED_VERSION: ${{ steps.resolve.outputs.version }}
+        run: |
+          set -euo pipefail
+          artifact_name="ios-release-manifest-$SOURCE_SHA"
+          response="$RUNNER_TEMP/ios-artifacts.json"
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts?name=$artifact_name&per_page=100" > "$response"
+          artifact_id="$(jq -r --arg sha "$SOURCE_SHA" '[.artifacts[] | select(.expired == false) | select(.workflow_run.head_sha == $sha)] | sort_by(.created_at) | last | .id // empty' "$response")"
+          [[ "$artifact_id" =~ ^[0-9]+$ ]] || { echo "No successful TestFlight release manifest exists for $SOURCE_SHA." >&2; exit 1; }
+          mkdir -p output/candidate
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts/$artifact_id/zip" -o "$RUNNER_TEMP/manifest.zip"
+          unzip -q "$RUNNER_TEMP/manifest.zip" -d output/candidate
+          MANIFEST=output/candidate/ios-release-manifest.json node <<'NODE'
+          const fs = require("node:fs");
+          const manifest = JSON.parse(fs.readFileSync(process.env.MANIFEST, "utf8"));
+          const checks = {
+            schema: manifest.schemaVersion === 1,
+            repository: manifest.repository === process.env.GITHUB_REPOSITORY,
+            source: manifest.sourceSha === process.env.SOURCE_SHA,
+            version: manifest.marketingVersion === process.env.EXPECTED_VERSION,
+            bundle: manifest.bundleId === "io.truckwash.app",
+            build: /^[1-9][0-9]*$/.test(manifest.buildNumber),
+            appStoreBuild: typeof manifest.appStoreBuildId === "string" && manifest.appStoreBuildId.length > 0,
+          };
+          const failed = Object.entries(checks).filter(([, ok]) => !ok).map(([name]) => name);
+          if (failed.length) throw new Error(`Invalid iOS release manifest: ${failed.join(", ")}`);
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, `build_number=${manifest.buildNumber}\napp_store_build_id=${manifest.appStoreBuildId}\n`);
+          NODE
+
+  promote:
+    name: Sync and verify App Store candidate
+    needs: resolve
+    if: needs.resolve.outputs.enabled == 'true'
+    runs-on: macos-15
+    timeout-minutes: 60
+    environment: app-store-candidate
+    env:
+      IOS_SOURCE_SHA: ${{ needs.resolve.outputs.source_sha }}
+      IOS_MARKETING_VERSION: ${{ needs.resolve.outputs.version }}
+      IOS_BUILD_NUMBER: ${{ needs.resolve.outputs.build_number }}
+      EXPECTED_APP_STORE_BUILD_ID: ${{ needs.resolve.outputs.app_store_build_id }}
+      IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID || 'io.truckwash.app' }}
+      APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+      APP_STORE_CONNECT_API_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ vars.APP_STORE_CONNECT_ISSUER_ID || '' }}
+      APP_STORE_CONNECT_APP_ID: ${{ vars.APP_STORE_CONNECT_APP_ID }}
+      APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
+    steps:
+      - name: Checkout exact candidate source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ env.IOS_SOURCE_SHA }}
+          persist-credentials: false
+
+      - name: Setup Ruby and pinned Fastlane
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Validate complete candidate storefront
+        run: node scripts/mobile/validate-app-store.mjs --strict
+
+      - name: Verify public storefront URLs
+        shell: bash
+        run: |
+          set -euo pipefail
+          for file in support_url privacy_url marketing_url; do
+            url="$(tr -d '\r\n' < "fastlane/metadata/da-DK/$file.txt")"
+            curl --fail --silent --show-error --location --connect-timeout 10 --max-time 30 --output /dev/null "$url"
+          done
+
+      - name: Verify exact processed TestFlight build
+        run: node scripts/mobile/app-store-connect.mjs verify-candidate
+
+      - name: Sync metadata and screenshots without App Review submission
+        run: bundle exec fastlane ios prepare_candidate
+
+      - name: Configure automatic release after approval
+        run: node scripts/mobile/app-store-connect.mjs configure-release-policy
+
+      - name: Read back exact App Store candidate
+        id: readback
+        run: node scripts/mobile/app-store-connect.mjs verify-store-version
+
+      - name: Verify Denmark-only availability and no preorder
+        id: availability
+        run: node scripts/mobile/app-store-connect.mjs verify-availability
+
+      - name: Write candidate handoff
+        env:
+          APP_STORE_STATE: ${{ steps.readback.outputs.app_store_state }}
+          APP_STORE_VERSION_ID: ${{ steps.readback.outputs.app_store_version_id }}
+          RELEASE_TYPE: ${{ steps.readback.outputs.release_type }}
+          AVAILABLE_TERRITORIES: ${{ steps.availability.outputs.available_territories }}
+        run: |
+          echo "### iOS $IOS_MARKETING_VERSION candidate prepared" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Source: \`$IOS_SOURCE_SHA\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Exact tested build: \`$IOS_BUILD_NUMBER\` (\`$EXPECTED_APP_STORE_BUILD_ID\`)" >> "$GITHUB_STEP_SUMMARY"
+          echo "- App Store state: \`$APP_STORE_STATE\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- App Store version ID: \`$APP_STORE_VERSION_ID\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Release policy: \`$RELEASE_TYPE\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Availability: \`$AVAILABLE_TERRITORIES\` only; preorder disabled" >> "$GITHUB_STEP_SUMMARY"
+          echo "- [Open the app in App Store Connect](https://appstoreconnect.apple.com/apps/$APP_STORE_CONNECT_APP_ID/appstore)" >> "$GITHUB_STEP_SUMMARY"
+          echo "- App Review submission remains manual; Apple will release automatically after approval." >> "$GITHUB_STEP_SUMMARY"
+
+  disabled:
+    name: Promotion disabled
+    needs: resolve
+    if: needs.resolve.outputs.enabled != 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - run: echo "App Store candidate promotion is disabled; no environment or credentials were accessed."

.github/workflows/ios-credential-health.yml

@@ -0,0 +1,117 @@
+name: iOS Credential Health
+
+on:
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ios-credential-health
+  cancel-in-progress: true
+
+jobs:
+  gate:
+    runs-on: ubuntu-24.04
+    outputs:
+      enabled: ${{ steps.gate.outputs.enabled }}
+    steps:
+      - id: gate
+        env:
+          ENABLED: ${{ vars.APP_STORE_AUTOMATION_ENABLED || 'false' }}
+        run: |
+          enabled=false
+          [[ "$ENABLED" == true ]] && enabled=true
+          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
+          if [[ "$enabled" != true ]]; then
+            echo "App Store automation is disabled; credential health did not access its environment." >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+  validate:
+    needs: gate
+    if: needs.gate.outputs.enabled == 'true'
+    runs-on: macos-15
+    timeout-minutes: 15
+    environment: app-store-signing
+    env:
+      IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID || 'io.truckwash.app' }}
+      APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+      APP_STORE_CONNECT_API_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ vars.APP_STORE_CONNECT_ISSUER_ID || '' }}
+      APP_STORE_CONNECT_APP_ID: ${{ vars.APP_STORE_CONNECT_APP_ID }}
+      APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Validate API key and app access
+        run: node scripts/mobile/app-store-connect.mjs verify-credentials
+
+      - name: Validate certificate and profile identity and expiry
+        shell: bash
+        env:
+          IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
+          IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}
+          IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
+        run: |
+          set -euo pipefail
+          cert_p12="$RUNNER_TEMP/distribution.p12"
+          cert_pem="$RUNNER_TEMP/distribution.pem"
+          cert_der="$RUNNER_TEMP/distribution.der"
+          profile="$RUNNER_TEMP/distribution.mobileprovision"
+          profile_plist="$RUNNER_TEMP/distribution-profile.plist"
+          keychain="$RUNNER_TEMP/credential-health.keychain-db"
+          keychain_password="$(openssl rand -hex 24)"
+          node -e "const fs=require('fs');fs.writeFileSync(process.argv[1],Buffer.from(process.env.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64.replace(/\\s/g,''),'base64'))" "$cert_p12"
+          node -e "const fs=require('fs');fs.writeFileSync(process.argv[1],Buffer.from(process.env.IOS_APP_STORE_PROFILE_BASE64.replace(/\\s/g,''),'base64'))" "$profile"
+          chmod 600 "$cert_p12" "$profile"
+          security create-keychain -p "$keychain_password" "$keychain"
+          security unlock-keychain -p "$keychain_password" "$keychain"
+          security import "$cert_p12" -P "$IOS_DISTRIBUTION_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain"
+          security list-keychains -d user -s "$keychain"
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain" >/dev/null
+          security find-identity -v -p codesigning "$keychain" | grep -q 'Apple Distribution' || {
+            echo "Distribution P12 does not contain a usable private signing identity." >&2
+            exit 1
+          }
+          openssl pkcs12 -in "$cert_p12" -clcerts -nokeys -passin env:IOS_DISTRIBUTION_CERTIFICATE_PASSWORD -out "$cert_pem"
+          openssl x509 -in "$cert_pem" -noout -subject -issuer -dates
+          openssl x509 -in "$cert_pem" -checkend 2592000 -noout || { echo "Distribution certificate expires within 30 days." >&2; exit 1; }
+          openssl x509 -in "$cert_pem" -outform DER -out "$cert_der"
+          security cms -D -i "$profile" > "$profile_plist"
+          CERT_DER="$cert_der" PROFILE_PLIST="$profile_plist" python3 <<'PY'
+          import datetime, hashlib, os, plistlib, sys
+          with open(os.environ["PROFILE_PLIST"], "rb") as handle: profile = plistlib.load(handle)
+          with open(os.environ["CERT_DER"], "rb") as handle: cert_sha = hashlib.sha1(handle.read()).hexdigest().upper()
+          expiration = profile.get("ExpirationDate")
+          if expiration and expiration.tzinfo is None: expiration = expiration.replace(tzinfo=datetime.timezone.utc)
+          warning = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=30)
+          ent = profile.get("Entitlements", {})
+          checks = {
+            "team": os.environ["APPLE_TEAM_ID"] in profile.get("TeamIdentifier", []),
+            "bundle": ent.get("application-identifier") == f'{os.environ["APPLE_TEAM_ID"]}.{os.environ["IOS_BUNDLE_ID"]}',
+            "distribution": ent.get("get-task-allow") is False and not profile.get("ProvisionedDevices"),
+            "profile expiry beyond 30 days": expiration is not None and expiration > warning,
+            "certificate belongs to profile": cert_sha in {hashlib.sha1(value).hexdigest().upper() for value in profile.get("DeveloperCertificates", [])},
+          }
+          failed = [name for name, ok in checks.items() if not ok]
+          if failed:
+            print("Credential health failed:", *[f"- {name}" for name in failed], sep="\n", file=sys.stderr)
+            sys.exit(1)
+          print(f"Provisioning profile is healthy through {expiration.isoformat()}.")
+          PY
+
+      - name: Clean temporary credential files
+        if: always()
+        run: |
+          security delete-keychain "$RUNNER_TEMP/credential-health.keychain-db" 2>/dev/null || true
+          rm -f "$RUNNER_TEMP"/distribution.{p12,pem,der,mobileprovision} "$RUNNER_TEMP/distribution-profile.plist"

.github/workflows/ios-device-debug.yml

@@ -63,7 +63,7 @@ jobs:
           fi
 
       - name: Checkout same-repository history
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -136,7 +136,7 @@ jobs:
       RESOLVED_SOURCE_SHA: ${{ needs.resolve.outputs.source_sha }}
     steps:
       - name: Checkout resolved source
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.resolve.outputs.source_sha }}
           fetch-depth: 1
@@ -163,7 +163,7 @@ jobs:
           echo "XCODE_VERSION=$xcode_version" >> "$GITHUB_ENV"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -596,7 +596,7 @@ jobs:
           echo "IOS_DEBUG_ARTIFACT_NAME=$artifact_name" >> "$GITHUB_ENV"
 
       - name: Upload device-debug artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ env.IOS_DEBUG_ARTIFACT_NAME }}
           path: ${{ env.IOS_DEBUG_ARTIFACT_DIR }}

.github/workflows/ios-testflight.yml

@@ -0,0 +1,437 @@
+name: iOS Internal TestFlight
+
+on:
+  workflow_run:
+    workflows: [Frontend Release]
+    types: [completed]
+    branches: [master]
+  workflow_dispatch:
+    inputs:
+      source_sha:
+        description: Full master commit SHA with a verified Frontend Release proof
+        required: true
+        type: string
+      confirmation:
+        description: Type UPLOAD IOS INTERNAL BUILD
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ios-internal-testflight
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    name: Resolve verified release
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'workflow_run' &&
+       github.event.workflow_run.head_branch == 'master' &&
+       github.event.workflow_run.head_repository.full_name == github.repository)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    outputs:
+      source_sha: ${{ steps.resolve.outputs.source_sha }}
+      enabled: ${{ steps.resolve.outputs.enabled }}
+      current: ${{ steps.resolve.outputs.current }}
+    steps:
+      - name: Checkout repository history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Resolve immutable source and rollout gate
+        id: resolve
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          WORKFLOW_SOURCE_SHA: ${{ github.event.workflow_run.head_sha || '' }}
+          INPUT_SOURCE_SHA: ${{ inputs.source_sha || '' }}
+          CONFIRMATION: ${{ inputs.confirmation || '' }}
+          AUTOMATION_ENABLED: ${{ vars.APP_STORE_AUTOMATION_ENABLED || 'false' }}
+        run: |
+          set -euo pipefail
+          source_sha="$WORKFLOW_SOURCE_SHA"
+          if [[ "$EVENT_NAME" == workflow_dispatch ]]; then
+            [[ "$GITHUB_REF" == refs/heads/master ]] || { echo "Dispatch this workflow from master." >&2; exit 1; }
+            [[ "$CONFIRMATION" == "UPLOAD IOS INTERNAL BUILD" ]] || { echo "Invalid confirmation." >&2; exit 1; }
+            source_sha="${INPUT_SOURCE_SHA,,}"
+          fi
+          [[ "$source_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "A full lowercase source SHA is required." >&2; exit 1; }
+          git show-ref --verify --quiet refs/remotes/origin/master || { echo "origin/master was not included in the full checkout." >&2; exit 1; }
+          git cat-file -e "${source_sha}^{commit}"
+          git merge-base --is-ancestor "$source_sha" origin/master || { echo "Source is not reachable from master." >&2; exit 1; }
+          current=false
+          [[ "$(git rev-parse origin/master)" == "$source_sha" ]] && current=true
+          enabled=false
+          [[ "$AUTOMATION_ENABLED" == true ]] && enabled=true
+          echo "source_sha=$source_sha" >> "$GITHUB_OUTPUT"
+          echo "current=$current" >> "$GITHUB_OUTPUT"
+          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
+          if [[ "$enabled" != true ]]; then
+            echo "### iOS automation is safely disabled" >> "$GITHUB_STEP_SUMMARY"
+            echo 'Set repository variable `APP_STORE_AUTOMATION_ENABLED=true` only after the signing/API credential canary passes.' >> "$GITHUB_STEP_SUMMARY"
+          elif [[ "$current" != true ]]; then
+            echo "### Stale release skipped" >> "$GITHUB_STEP_SUMMARY"
+            echo "The verified SHA is no longer current master." >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Require green WebKit mobile tests before App Store upload
+        if: steps.resolve.outputs.enabled == 'true' && steps.resolve.outputs.current == 'true'
+        run: node scripts/mobile/verify-store-test-gate.mjs --platform apple
+        env:
+          GH_TOKEN: ${{ github.token }}
+          STORE_SOURCE_SHA: ${{ steps.resolve.outputs.source_sha }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+
+  deliver:
+    name: Sign, upload, process, and distribute
+    needs: prepare
+    if: needs.prepare.outputs.enabled == 'true' && needs.prepare.outputs.current == 'true'
+    runs-on: macos-15
+    timeout-minutes: 120
+    environment: app-store-signing
+    env:
+      DEVELOPER_DIR: /Applications/Xcode_26.3.app/Contents/Developer
+      IOS_SOURCE_SHA: ${{ needs.prepare.outputs.source_sha }}
+      IOS_PROJECT_PATH: ${{ vars.IOS_PROJECT || 'ios/App/App.xcodeproj' }}
+      IOS_SCHEME: ${{ vars.IOS_SCHEME || 'App' }}
+      IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID || 'io.truckwash.app' }}
+      APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+      APP_STORE_CONNECT_API_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ vars.APP_STORE_CONNECT_ISSUER_ID || '' }}
+      APP_STORE_CONNECT_APP_ID: ${{ vars.APP_STORE_CONNECT_APP_ID }}
+      TESTFLIGHT_INTERNAL_GROUP_ID: ${{ vars.TESTFLIGHT_INTERNAL_GROUP_ID }}
+      APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
+    steps:
+      - name: Checkout verified source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ env.IOS_SOURCE_SHA }}
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Download and verify frontend release proof
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TRIGGERING_RELEASE_RUN_ID: ${{ github.event.workflow_run.id || '' }}
+        run: |
+          set -euo pipefail
+          artifact_name="frontend-release-proof-$IOS_SOURCE_SHA"
+          response="$RUNNER_TEMP/proof-artifacts.json"
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts?name=$artifact_name&per_page=100" > "$response"
+          artifact_id="$(jq -r --arg run "$TRIGGERING_RELEASE_RUN_ID" '
+            [.artifacts[] | select(.expired == false) | select(($run == "") or ((.workflow_run.id|tostring) == $run))] |
+            sort_by(.created_at) | last | .id // empty' "$response")"
+          [[ "$artifact_id" =~ ^[0-9]+$ ]] || { echo "No verified Frontend Release proof found for $IOS_SOURCE_SHA." >&2; exit 1; }
+          mkdir -p output/frontend-release-proof
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts/$artifact_id/zip" -o "$RUNNER_TEMP/proof.zip"
+          unzip -q "$RUNNER_TEMP/proof.zip" -d output/frontend-release-proof
+          PROOF_PATH=output/frontend-release-proof/frontend-release-proof.json node <<'NODE'
+          const fs = require("node:fs");
+          const proof = JSON.parse(fs.readFileSync(process.env.PROOF_PATH, "utf8"));
+          const checks = {
+            schema: proof.schemaVersion === 2,
+            repository: proof.repository === process.env.GITHUB_REPOSITORY,
+            source: proof.sourceSha === process.env.IOS_SOURCE_SHA,
+            exactSource: proof.sha === process.env.IOS_SOURCE_SHA,
+            releaseIdentity: typeof proof.releaseId === "string" && proof.releaseId.length > 0,
+            archive: /^[a-f0-9]{64}$/.test(proof.archiveSha256 || ""),
+            activeTarget: typeof proof.activeTarget === "string" && proof.activeTarget.length > 0,
+            verification: proof.verificationState === "verified",
+            publicGate: proof.livePublicGate === "passed",
+            credentialedGate: ["passed", "not-configured"].includes(proof.liveCredentialedGate),
+            managerGate: proof.releaseManagerGate === "passed",
+            serverVersion: proof.serverVersionUpdated === true,
+            serverVersionReadBack: proof.serverVersionReadBack === "passed",
+          };
+          const failures = Object.entries(checks).filter(([, passed]) => !passed).map(([label]) => label);
+          if (failures.length) throw new Error(`Invalid frontend release proof: ${failures.join(", ")}`);
+          NODE
+
+      - name: Verify Xcode 26 and iOS 26 SDK
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ -x "$DEVELOPER_DIR/usr/bin/xcodebuild" ]] || { echo "Xcode 26.3 is not installed at $DEVELOPER_DIR." >&2; exit 1; }
+          xcode_version="$(xcodebuild -version | sed -n '1p')"
+          sdk_version="$(xcrun --sdk iphoneos --show-sdk-version)"
+          [[ "$xcode_version" =~ ^Xcode\ 26\. ]] || { echo "Xcode 26.x required; found $xcode_version." >&2; exit 1; }
+          [[ "$sdk_version" =~ ^26\. ]] || { echo "iPhoneOS 26 SDK required; found $sdk_version." >&2; exit 1; }
+          echo "XCODE_VERSION=$xcode_version" >> "$GITHUB_ENV"
+          echo "IOS_SDK_VERSION=$sdk_version" >> "$GITHUB_ENV"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Setup Ruby and pinned Fastlane
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+
+      - name: Install web dependencies
+        run: npm ci --legacy-peer-deps
+
+      - name: Validate storefront and resolve version
+        id: version
+        shell: bash
+        run: |
+          set -euo pipefail
+          node scripts/mobile/validate-app-store.mjs
+          version="$(node -p "JSON.parse(require('fs').readFileSync('ios/release.json')).marketingVersion")"
+          bundle="$(node -p "JSON.parse(require('fs').readFileSync('ios/release.json')).bundleId")"
+          [[ "$bundle" == "$IOS_BUNDLE_ID" ]]
+          echo "IOS_MARKETING_VERSION=$version" >> "$GITHUB_ENV"
+          echo "MOBILE_VERSION_NAME=$version" >> "$GITHUB_ENV"
+
+      - name: Resolve build number from App Store Connect
+        id: app-store
+        run: node scripts/mobile/app-store-connect.mjs next-build-number
+
+      - name: Export resolved build number
+        env:
+          BUILD_NUMBER: ${{ steps.app-store.outputs.build_number }}
+        run: |
+          [[ "$BUILD_NUMBER" =~ ^[1-9][0-9]*$ ]]
+          echo "IOS_BUILD_NUMBER=$BUILD_NUMBER" >> "$GITHUB_ENV"
+          echo "MOBILE_VERSION_CODE=$BUILD_NUMBER" >> "$GITHUB_ENV"
+
+      - name: Validate complete Apple environment
+        env:
+          IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
+          IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}
+          IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
+          UPLOAD_IOS_TO_APP_STORE: "true"
+        run: node scripts/mobile/check-store-upload-env.mjs --ios
+
+      - name: Build and sync production iOS shell
+        run: |
+          npm run build
+          npx cap sync ios
+          npm run mobile:permissions:check
+          xcodebuild -resolvePackageDependencies -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME"
+
+      - name: Validate native release settings
+        shell: bash
+        run: |
+          set -euo pipefail
+          settings="$RUNNER_TEMP/ios-release-build-settings.txt"
+          xcodebuild -showBuildSettings -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME" -configuration Release CODE_SIGNING_ALLOWED=NO > "$settings"
+          grep -Eq "^[[:space:]]*PRODUCT_BUNDLE_IDENTIFIER = ${IOS_BUNDLE_ID//./\.}$" "$settings"
+          grep -Eq '^[[:space:]]*APP_DISPLAY_NAME = Truck Wash$' "$settings"
+          grep -Eq '^[[:space:]]*IPHONEOS_DEPLOYMENT_TARGET = 15\.0$' "$settings"
+          if grep -q 'isa = PBXShellScriptBuildPhase;' "$IOS_PROJECT_PATH/project.pbxproj"; then
+            echo "Unexpected Xcode shell-script build phase detected." >&2
+            exit 1
+          fi
+
+      - name: Install and validate Apple distribution signing assets
+        shell: bash
+        env:
+          IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
+          IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}
+          IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
+        run: |
+          set -euo pipefail
+          certificate_path="$RUNNER_TEMP/apple-distribution.p12"
+          profile_path="$RUNNER_TEMP/app-store.mobileprovision"
+          profile_plist="$RUNNER_TEMP/app-store-profile.plist"
+          keychain_path="$RUNNER_TEMP/app-store-signing.keychain-db"
+          keychain_password="$(openssl rand -base64 48 | tr -d '\n')"
+          echo "::add-mask::$keychain_password"
+          echo "IOS_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
+          node -e "const fs=require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64.replace(/\\s/g,''),'base64'))" "$certificate_path"
+          node -e "const fs=require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_APP_STORE_PROFILE_BASE64.replace(/\\s/g,''),'base64'))" "$profile_path"
+          chmod 600 "$certificate_path" "$profile_path"
+          security cms -D -i "$profile_path" > "$profile_plist"
+          security create-keychain -p "$keychain_password" "$keychain_path"
+          security set-keychain-settings -lut 21600 "$keychain_path"
+          security unlock-keychain -p "$keychain_password" "$keychain_path"
+          security import "$certificate_path" -P "$IOS_DISTRIBUTION_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
+          security list-keychains -d user -s "$keychain_path" $(security list-keychains -d user | tr -d '"')
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain_path"
+          identity_sha="$(security find-identity -v -p codesigning "$keychain_path" | awk '/Apple Distribution/ {print $2; exit}')"
+          [[ "$identity_sha" =~ ^[0-9A-Fa-f]{40}$ ]] || { echo "P12 lacks an Apple Distribution identity." >&2; exit 1; }
+          IOS_SIGNING_IDENTITY_SHA="$identity_sha" PROFILE_PLIST="$profile_plist" python3 <<'PY'
+          import datetime, hashlib, os, plistlib, re, sys
+          with open(os.environ["PROFILE_PLIST"], "rb") as handle: profile = plistlib.load(handle)
+          entitlements = profile.get("Entitlements", {})
+          expiration = profile.get("ExpirationDate")
+          if expiration and expiration.tzinfo is None: expiration = expiration.replace(tzinfo=datetime.timezone.utc)
+          team = os.environ["APPLE_TEAM_ID"]
+          bundle = os.environ["IOS_BUNDLE_ID"]
+          hashes = {hashlib.sha1(value).hexdigest().upper() for value in profile.get("DeveloperCertificates", [])}
+          checks = {
+            "team": team in profile.get("TeamIdentifier", []),
+            "application identifier": entitlements.get("application-identifier") == f"{team}.{bundle}",
+            "team entitlement": entitlements.get("com.apple.developer.team-identifier") == team,
+            "distribution entitlement": entitlements.get("get-task-allow") is False,
+            "App Store profile has no devices": not profile.get("ProvisionedDevices"),
+            "non-enterprise profile": profile.get("ProvisionsAllDevices") is not True,
+            "expiration": expiration is not None and expiration > datetime.datetime.now(datetime.timezone.utc),
+            "certificate belongs to profile": os.environ["IOS_SIGNING_IDENTITY_SHA"].upper() in hashes,
+            "safe profile name": isinstance(profile.get("Name"), str) and not re.search(r"[\r\n]", profile["Name"]),
+          }
+          failed = [name for name, passed in checks.items() if not passed]
+          if failed:
+            print("Distribution signing validation failed:", *[f"- {name}" for name in failed], sep="\n", file=sys.stderr)
+            sys.exit(1)
+          PY
+          profile_uuid="$(/usr/libexec/PlistBuddy -c 'Print :UUID' "$profile_plist")"
+          profile_name="$(/usr/libexec/PlistBuddy -c 'Print :Name' "$profile_plist")"
+          profile_install="$HOME/Library/MobileDevice/Provisioning Profiles/$profile_uuid.mobileprovision"
+          mkdir -p "$(dirname "$profile_install")"
+          echo "IOS_PROFILE_INSTALL_PATH=$profile_install" >> "$GITHUB_ENV"
+          cp "$profile_path" "$profile_install"
+          echo "IOS_PROFILE_NAME=$profile_name" >> "$GITHUB_ENV"
+          echo "IOS_PROFILE_UUID=$profile_uuid" >> "$GITHUB_ENV"
+
+      - name: Archive and export App Store IPA
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="$RUNNER_TEMP/TruckWash.xcarchive"
+          export_dir="$RUNNER_TEMP/ios-export"
+          export_options="$RUNNER_TEMP/ExportOptions.plist"
+          xcodebuild -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME" -configuration Release \
+            -destination 'generic/platform=iOS' -archivePath "$archive" archive \
+            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY='Apple Distribution' \
+            PROVISIONING_PROFILE_SPECIFIER="$IOS_PROFILE_NAME" MARKETING_VERSION="$IOS_MARKETING_VERSION" \
+            CURRENT_PROJECT_VERSION="$IOS_BUILD_NUMBER" DEBUG_INFORMATION_FORMAT='dwarf-with-dsym'
+          EXPORT_OPTIONS="$export_options" python3 <<'PY'
+          import os, plistlib
+          options = {"method":"app-store-connect","signingStyle":"manual","teamID":os.environ["APPLE_TEAM_ID"],"provisioningProfiles":{os.environ["IOS_BUNDLE_ID"]:os.environ["IOS_PROFILE_NAME"]},"stripSwiftSymbols":True,"manageAppVersionAndBuildNumber":False}
+          with open(os.environ["EXPORT_OPTIONS"], "wb") as handle: plistlib.dump(options, handle)
+          PY
+          xcodebuild -exportArchive -archivePath "$archive" -exportPath "$export_dir" -exportOptionsPlist "$export_options"
+          shopt -s nullglob
+          ipa_files=("$export_dir"/*.ipa)
+          [[ ${#ipa_files[@]} -eq 1 ]] || { echo "Expected one IPA; found ${#ipa_files[@]}." >&2; exit 1; }
+          echo "IOS_ARCHIVE_PATH=$archive" >> "$GITHUB_ENV"
+          echo "IOS_IPA_PATH=${ipa_files[0]}" >> "$GITHUB_ENV"
+
+      - name: Inspect signed IPA
+        shell: bash
+        run: |
+          set -euo pipefail
+          inspect="$RUNNER_TEMP/ios-inspect"
+          unzip -q "$IOS_IPA_PATH" -d "$inspect"
+          shopt -s nullglob
+          apps=("$inspect"/Payload/*.app)
+          [[ ${#apps[@]} -eq 1 ]] || { echo "Expected one Payload app." >&2; exit 1; }
+          app="${apps[0]}"
+          codesign --verify --deep --strict "$app"
+          codesign -d --entitlements :- "$app" > "$RUNNER_TEMP/entitlements.plist"
+          security cms -D -i "$app/embedded.mobileprovision" > "$RUNNER_TEMP/embedded-profile.plist"
+          [[ -f "$app/PrivacyInfo.xcprivacy" ]]
+          [[ -f "$app/da.lproj/InfoPlist.strings" ]]
+          [[ -f "$app/en.lproj/InfoPlist.strings" ]]
+          APP_PATH="$app" python3 <<'PY'
+          import os, plistlib, sys
+          app = os.environ["APP_PATH"]
+          with open(f"{app}/Info.plist", "rb") as handle: info = plistlib.load(handle)
+          with open(os.path.join(os.environ["RUNNER_TEMP"], "entitlements.plist"), "rb") as handle: ent = plistlib.load(handle)
+          with open(os.path.join(os.environ["RUNNER_TEMP"], "embedded-profile.plist"), "rb") as handle: profile = plistlib.load(handle)
+          checks = {
+            "bundle": info.get("CFBundleIdentifier") == os.environ["IOS_BUNDLE_ID"],
+            "version": info.get("CFBundleShortVersionString") == os.environ["IOS_MARKETING_VERSION"],
+            "build": info.get("CFBundleVersion") == os.environ["IOS_BUILD_NUMBER"],
+            "minimum iOS": info.get("MinimumOSVersion") == "15.0",
+            "profile": profile.get("UUID") == os.environ["IOS_PROFILE_UUID"],
+            "non-debug signature": ent.get("get-task-allow") is not True,
+            "signature application id": ent.get("application-identifier") == f'{os.environ["APPLE_TEAM_ID"]}.{os.environ["IOS_BUNDLE_ID"]}',
+          }
+          failed = [name for name, passed in checks.items() if not passed]
+          if failed:
+            print("IPA validation failed:", *[f"- {name}" for name in failed], sep="\n", file=sys.stderr)
+            sys.exit(1)
+          PY
+
+      - name: Recheck live master before upload
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          live_master_sha="$(curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/git/ref/heads/master" | jq -r '.object.sha')"
+          [[ "$live_master_sha" == "$IOS_SOURCE_SHA" ]] || {
+            echo "master advanced while the signed build was queued; refusing upload." >&2
+            exit 1
+          }
+      - name: Upload and wait for App Store processing
+        env:
+          TESTFLIGHT_WHAT_TO_TEST: Automatisk intern build fra verificeret master ${{ env.IOS_SOURCE_SHA }}.
+        run: bundle exec fastlane ios upload_internal
+
+      - name: Assign exact processed build to Internal QA
+        id: distribute
+        env:
+          TESTFLIGHT_WHAT_TO_TEST: Automatisk intern build fra verificeret master ${{ env.IOS_SOURCE_SHA }}.
+        run: node scripts/mobile/app-store-connect.mjs wait-and-distribute
+
+      - name: Assemble signed release evidence
+        shell: bash
+        env:
+          APP_STORE_BUILD_ID: ${{ steps.distribute.outputs.app_store_build_id }}
+        run: |
+          set -euo pipefail
+          artifact="output/ios-release"
+          mkdir -p "$artifact"
+          cp "$IOS_IPA_PATH" "$artifact/TruckWash-$IOS_MARKETING_VERSION-$IOS_BUILD_NUMBER.ipa"
+          shopt -s nullglob
+          dsyms=("$IOS_ARCHIVE_PATH"/dSYMs/*.dSYM)
+          [[ ${#dsyms[@]} -gt 0 ]] || { echo "Release archive contains no dSYM bundles." >&2; exit 1; }
+          ditto -c -k --sequesterRsrc --keepParent "$IOS_ARCHIVE_PATH/dSYMs" "$artifact/TruckWash-$IOS_MARKETING_VERSION-$IOS_BUILD_NUMBER.dSYM.zip"
+          node scripts/mobile/create-ios-release-manifest.mjs
+          (cd "$artifact" && shasum -a 256 -- * > SHA256SUMS)
+
+      - name: Upload signed IPA
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: truck-wash-ios-${{ env.IOS_SOURCE_SHA }}
+          path: output/ios-release/*.ipa
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Upload release manifest, dSYM, and checksums
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ios-release-manifest-${{ env.IOS_SOURCE_SHA }}
+          path: |
+            output/ios-release/ios-release-manifest.json
+            output/ios-release/*.dSYM.zip
+            output/ios-release/SHA256SUMS
+          if-no-files-found: error
+          retention-days: 90
+
+      - name: Clean up Apple signing material
+        if: always()
+        shell: bash
+        run: |
+          if [[ -n "${IOS_KEYCHAIN_PATH:-}" ]]; then security delete-keychain "$IOS_KEYCHAIN_PATH" || true; fi
+          if [[ -n "${IOS_PROFILE_INSTALL_PATH:-}" ]]; then rm -f "$IOS_PROFILE_INSTALL_PATH"; fi
+          rm -f "$RUNNER_TEMP/apple-distribution.p12" "$RUNNER_TEMP/app-store.mobileprovision" "$RUNNER_TEMP/app-store-profile.plist"
+
+  disabled:
+    name: Automation disabled
+    needs: prepare
+    if: needs.prepare.outputs.enabled != 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - run: echo "App Store automation is disabled; no signing environment or secrets were accessed."

.github/workflows/mobile-artifacts.yml

@@ -1,4 +1,4 @@
-name: Mobile Store Artifacts
+name: Android Store Artifacts
 
 on:
   workflow_dispatch:
@@ -16,11 +16,6 @@ on:
         required: false
         type: boolean
         default: true
-      upload_ios_to_app_store:
-        description: Upload the signed iOS IPA to App Store Connect
-        required: false
-        type: boolean
-        default: true
       android_track:
         description: Google Play track for manual dispatches
         required: false
@@ -35,99 +30,102 @@ on:
         description: Google Play release status for manual dispatches
         required: false
         type: choice
-        default: completed
+        default: inProgress
         options:
-          - completed
-          - draft
           - inProgress
+          - draft
           - halted
   push:
     tags:
       - "mobile-v*"
-  workflow_run:
-    workflows:
-      - Automated Tests
-    types:
-      - completed
-    branches:
-      - master
 
 permissions:
   contents: read
+  actions: read
 
 concurrency:
-  group: mobile-store-artifacts-${{ github.event.workflow_run.head_branch || github.ref_name || github.run_id }}
+  group: android-store-artifacts-${{ github.ref_name || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   android:
     name: Android AAB and Play upload
-    if: >
-      github.event_name != 'workflow_run' ||
-      (github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
-      github.event.workflow_run.head_branch == github.event.repository.default_branch)
     runs-on: ubuntu-24.04
     environment: mobile-store-production
     timeout-minutes: 60
     env:
       ANDROID_PACKAGE_NAME: ${{ vars.ANDROID_PACKAGE_NAME || 'io.truckwash.twa' }}
       ANDROID_AAB_PATH: ${{ vars.ANDROID_AAB_PATH || 'android/app/build/outputs/bundle/release/app-release.aab' }}
+      ANDROID_SIGNING_IDENTITY_REF: github-environment:mobile-store-production/android-keystore
       PLAY_STORE_TRACK: ${{ inputs.android_track || vars.PLAY_STORE_TRACK || 'production' }}
-      PLAY_STORE_RELEASE_STATUS: ${{ inputs.android_release_status || vars.PLAY_STORE_RELEASE_STATUS || 'completed' }}
-      PLAY_STORE_USER_FRACTION: ${{ vars.PLAY_STORE_USER_FRACTION || '' }}
+      PLAY_STORE_RELEASE_STATUS: ${{ inputs.android_release_status || 'inProgress' }}
+      PLAY_STORE_USER_FRACTION: "0.01"
       UPLOAD_ANDROID_TO_PLAY: ${{ github.event_name != 'workflow_dispatch' || inputs.upload_android_to_play }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+          ref: ${{ github.sha }}
+          persist-credentials: false
 
       - name: Guard current master release
         id: release-guard
         shell: bash
         env:
           EVENT_NAME: ${{ github.event_name }}
-          EXPECTED_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          RELEASE_BRANCH: ${{ github.event.workflow_run.head_branch || github.ref_name }}
+          EXPECTED_SHA: ${{ github.sha }}
+          RELEASE_BRANCH: ${{ github.ref_name }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          UPLOAD_TO_PLAY: ${{ github.event_name != 'workflow_dispatch' || inputs.upload_android_to_play }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           current=true
-          if [[ "$EVENT_NAME" == "workflow_run" ]]; then
-            latest_sha="$(git ls-remote origin "refs/heads/$DEFAULT_BRANCH" | awk '{print $1}')"
-            if [[ -z "$latest_sha" ]]; then
-              echo "Could not resolve origin/$DEFAULT_BRANCH." >&2
-              exit 1
-            fi
-            if [[ "$latest_sha" != "$EXPECTED_SHA" ]]; then
-              current=false
-              echo "Skipping stale mobile upload for $EXPECTED_SHA; origin/$DEFAULT_BRANCH is $latest_sha."
-            else
-              echo "Mobile upload commit is current for $DEFAULT_BRANCH."
-            fi
+          latest_sha="$(curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/git/ref/heads/$DEFAULT_BRANCH" | jq -r '.object.sha // empty')"
+          if [[ ! "$latest_sha" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "Could not resolve origin/$DEFAULT_BRANCH." >&2
+            exit 1
+          fi
+          if [[ "$latest_sha" != "$EXPECTED_SHA" && "$UPLOAD_TO_PLAY" == "true" ]]; then
+            current=false
+            echo "Skipping stale mobile upload for $EXPECTED_SHA; origin/$DEFAULT_BRANCH is $latest_sha."
+          elif [[ "$latest_sha" != "$EXPECTED_SHA" ]]; then
+            echo "Allowing artifact-only build for $EVENT_NAME on $RELEASE_BRANCH; store upload remains disabled."
           else
-            echo "Mobile release guard passed for $EVENT_NAME on $RELEASE_BRANCH."
+            echo "Mobile upload commit is current for $DEFAULT_BRANCH."
           fi
           echo "current=$current" >> "$GITHUB_OUTPUT"
+          echo "source_sha=$latest_sha" >> "$GITHUB_OUTPUT"
 
       - name: Setup Node.js
         if: steps.release-guard.outputs.current == 'true'
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
 
+      - name: Require green Chromium mobile tests before Play upload
+        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_ANDROID_TO_PLAY == 'true'
+        run: node scripts/mobile/verify-store-test-gate.mjs --platform android
+        env:
+          GH_TOKEN: ${{ github.token }}
+          STORE_SOURCE_SHA: ${{ steps.release-guard.outputs.source_sha }}
+          TEST_WORKFLOW_RUN_ID: ""
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+
       - name: Setup Java
         if: steps.release-guard.outputs.current == 'true'
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: 21
 
       - name: Setup Android SDK
         if: steps.release-guard.outputs.current == 'true'
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
 
       - name: Install Android SDK packages
         if: steps.release-guard.outputs.current == 'true'
@@ -203,282 +201,64 @@ jobs:
         if: steps.release-guard.outputs.current == 'true'
         run: jarsigner -verify -certs -verbose "$ANDROID_AAB_PATH" >/dev/null
 
+      - name: Record immutable Android artifact proof
+        if: steps.release-guard.outputs.current == 'true'
+        id: artifact-proof
+        shell: bash
+        run: |
+          set -euo pipefail
+          artifact_sha256="$(sha256sum "$ANDROID_AAB_PATH" | awk '{print $1}')"
+          [[ "$artifact_sha256" =~ ^[0-9a-f]{64}$ ]]
+          echo "ANDROID_AAB_SHA256=$artifact_sha256" >> "$GITHUB_ENV"
+          echo "sha256=$artifact_sha256" >> "$GITHUB_OUTPUT"
+          echo "Android AAB SHA-256: \`$artifact_sha256\`" >> "$GITHUB_STEP_SUMMARY"
+
       - name: Upload Android artifact
         if: steps.release-guard.outputs.current == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: truck-wash-android-${{ env.MOBILE_VERSION_NAME }}-${{ github.event.workflow_run.head_sha || github.sha }}
+          name: truck-wash-android-${{ env.MOBILE_VERSION_NAME }}-${{ github.sha }}
           path: ${{ env.ANDROID_AAB_PATH }}
           if-no-files-found: error
           retention-days: 14
 
+      - name: Recheck live master before Play upload
+        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_ANDROID_TO_PLAY == 'true'
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          EXPECTED_SHA: ${{ steps.release-guard.outputs.source_sha }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          live_master_sha="$(curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/git/ref/heads/$DEFAULT_BRANCH" | jq -r '.object.sha // empty')"
+          [[ "$live_master_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "Could not resolve origin/$DEFAULT_BRANCH." >&2; exit 1; }
+          [[ "$live_master_sha" == "$EXPECTED_SHA" ]] || {
+            echo "$DEFAULT_BRANCH advanced while the Android bundle was building; refusing Play upload." >&2
+            exit 1
+          }
+
       - name: Upload Android App Bundle to Google Play
         if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_ANDROID_TO_PLAY == 'true'
+        id: play-upload
         env:
           GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64 }}
         run: npm run mobile:android:play-upload
 
-  ios:
-    name: iOS IPA and App Store upload
-    if: >
-      github.event_name != 'workflow_run' ||
-      (github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
-      github.event.workflow_run.head_branch == github.event.repository.default_branch)
-    runs-on: macos-15
-    environment: mobile-store-production
-    timeout-minutes: 90
-    env:
-      IOS_PROJECT_PATH: ios/App/App.xcodeproj
-      IOS_SCHEME: App
-      IOS_BUNDLE_ID: io.truckwash.app
-      UPLOAD_IOS_TO_APP_STORE: ${{ github.event_name != 'workflow_dispatch' || inputs.upload_ios_to_app_store }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
-
-      - name: Guard current master release
-        id: release-guard
-        shell: bash
+      - name: Record Google Play submission proof
+        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_ANDROID_TO_PLAY == 'true'
         env:
-          EVENT_NAME: ${{ github.event_name }}
-          EXPECTED_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          RELEASE_BRANCH: ${{ github.event.workflow_run.head_branch || github.ref_name }}
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          ARTIFACT_SHA256: ${{ steps.artifact-proof.outputs.sha256 }}
+          PLAY_EDIT_ID: ${{ steps.play-upload.outputs.play_edit_id }}
+          PLAY_VERSION_CODE: ${{ steps.play-upload.outputs.version_code }}
         run: |
           set -euo pipefail
-          current=true
-          if [[ "$EVENT_NAME" == "workflow_run" ]]; then
-            latest_sha="$(git ls-remote origin "refs/heads/$DEFAULT_BRANCH" | awk '{print $1}')"
-            if [[ -z "$latest_sha" ]]; then
-              echo "Could not resolve origin/$DEFAULT_BRANCH." >&2
-              exit 1
-            fi
-            if [[ "$latest_sha" != "$EXPECTED_SHA" ]]; then
-              current=false
-              echo "Skipping stale mobile upload for $EXPECTED_SHA; origin/$DEFAULT_BRANCH is $latest_sha."
-            else
-              echo "Mobile upload commit is current for $DEFAULT_BRANCH."
-            fi
-          else
-            echo "Mobile release guard passed for $EVENT_NAME on $RELEASE_BRANCH."
-          fi
-          echo "current=$current" >> "$GITHUB_OUTPUT"
-
-      - name: Setup Node.js
-        if: steps.release-guard.outputs.current == 'true'
-        uses: actions/setup-node@v5
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Resolve mobile version
-        if: steps.release-guard.outputs.current == 'true'
-        shell: bash
-        env:
-          INPUT_VERSION_NAME: ${{ inputs.version_name || '' }}
-          INPUT_VERSION_CODE: ${{ inputs.version_code || '' }}
-        run: |
-          set -euo pipefail
-          version_name="$INPUT_VERSION_NAME"
-          if [[ -z "$version_name" && "$GITHUB_REF_NAME" == mobile-v* ]]; then
-            version_name="${GITHUB_REF_NAME#mobile-v}"
-          fi
-          if [[ -z "$version_name" ]]; then
-            version_name="0.0.${GITHUB_RUN_NUMBER}"
-          fi
-          version_code="${INPUT_VERSION_CODE:-$GITHUB_RUN_NUMBER}"
-          echo "MOBILE_VERSION_NAME=$version_name" >> "$GITHUB_ENV"
-          echo "MOBILE_VERSION_CODE=$version_code" >> "$GITHUB_ENV"
-
-      - name: Check iOS store environment
-        if: steps.release-guard.outputs.current == 'true'
-        env:
-          IOS_CERTIFICATE_BASE64: ${{ secrets.IOS_CERTIFICATE_BASE64 }}
-          IOS_CERTIFICATE_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
-          IOS_PROVISION_PROFILE_BASE64: ${{ secrets.IOS_PROVISION_PROFILE_BASE64 }}
-          IOS_KEYCHAIN_PASSWORD: ${{ secrets.IOS_KEYCHAIN_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
-          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
-          APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
-        run: node scripts/mobile/check-store-upload-env.mjs --ios
-
-      - name: Install dependencies
-        if: steps.release-guard.outputs.current == 'true'
-        run: npm ci --legacy-peer-deps
-
-      - name: Build and sync iOS shell
-        if: steps.release-guard.outputs.current == 'true'
-        run: |
-          npm run build
-          npx cap sync ios
-          npm run mobile:permissions:check
-
-      - name: Install Apple signing assets
-        if: steps.release-guard.outputs.current == 'true'
-        shell: bash
-        env:
-          IOS_CERTIFICATE_BASE64: ${{ secrets.IOS_CERTIFICATE_BASE64 }}
-          IOS_CERTIFICATE_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
-          IOS_PROVISION_PROFILE_BASE64: ${{ secrets.IOS_PROVISION_PROFILE_BASE64 }}
-          IOS_KEYCHAIN_PASSWORD: ${{ secrets.IOS_KEYCHAIN_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: |
-          set -euo pipefail
-          certificate_path="$RUNNER_TEMP/apple-distribution.p12"
-          profile_path="$RUNNER_TEMP/app-store.mobileprovision"
-          keychain_path="$RUNNER_TEMP/app-signing.keychain-db"
-          profile_plist="$RUNNER_TEMP/profile.plist"
-
-          node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_CERTIFICATE_BASE64, 'base64'))" "$certificate_path"
-          node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_PROVISION_PROFILE_BASE64, 'base64'))" "$profile_path"
-
-          security create-keychain -p "$IOS_KEYCHAIN_PASSWORD" "$keychain_path"
-          security set-keychain-settings -lut 21600 "$keychain_path"
-          security unlock-keychain -p "$IOS_KEYCHAIN_PASSWORD" "$keychain_path"
-          security import "$certificate_path" -P "$IOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
-          security list-keychain -d user -s "$keychain_path" $(security list-keychains -d user | tr -d '"')
-          security set-key-partition-list -S apple-tool:,apple: -s -k "$IOS_KEYCHAIN_PASSWORD" "$keychain_path"
-
-          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
-          security cms -D -i "$profile_path" > "$profile_plist"
-          profile_uuid="$(/usr/libexec/PlistBuddy -c 'Print UUID' "$profile_plist")"
-          profile_name="$(/usr/libexec/PlistBuddy -c 'Print Name' "$profile_plist")"
-          cp "$profile_path" "$HOME/Library/MobileDevice/Provisioning Profiles/$profile_uuid.mobileprovision"
-
-          echo "APPLE_TEAM_ID=$APPLE_TEAM_ID" >> "$GITHUB_ENV"
-          echo "IOS_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
-          echo "IOS_PROFILE_UUID=$profile_uuid" >> "$GITHUB_ENV"
-          echo "IOS_PROFILE_NAME=$profile_name" >> "$GITHUB_ENV"
-
-      - name: Install App Store Connect API key
-        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_IOS_TO_APP_STORE == 'true'
-        shell: bash
-        env:
-          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
-          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
-          APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
-        run: |
-          set -euo pipefail
-          private_keys_dir="$RUNNER_TEMP/private_keys"
-          private_key_path="$private_keys_dir/AuthKey_${APP_STORE_CONNECT_API_KEY_ID}.p8"
-          mkdir -p "$private_keys_dir"
-          node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64, 'base64'))" "$private_key_path"
-          chmod 600 "$private_key_path"
-          echo "API_PRIVATE_KEYS_DIR=$private_keys_dir" >> "$GITHUB_ENV"
-          echo "APP_STORE_CONNECT_API_KEY_ID=$APP_STORE_CONNECT_API_KEY_ID" >> "$GITHUB_ENV"
-          echo "APP_STORE_CONNECT_ISSUER_ID=$APP_STORE_CONNECT_ISSUER_ID" >> "$GITHUB_ENV"
-          echo "APP_STORE_CONNECT_API_KEY_PATH=$private_key_path" >> "$GITHUB_ENV"
-
-      - name: Resolve Swift packages
-        if: steps.release-guard.outputs.current == 'true'
-        run: xcodebuild -resolvePackageDependencies -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME"
-
-      - name: Archive iOS app
-        if: steps.release-guard.outputs.current == 'true'
-        run: |
-          xcodebuild \
-            -project "$IOS_PROJECT_PATH" \
-            -scheme "$IOS_SCHEME" \
-            -configuration Release \
-            -destination "generic/platform=iOS" \
-            -archivePath "$RUNNER_TEMP/TruckWash.xcarchive" \
-            archive \
-            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
-            CODE_SIGN_STYLE=Manual \
-            CODE_SIGN_IDENTITY="Apple Distribution" \
-            PROVISIONING_PROFILE_SPECIFIER="$IOS_PROFILE_NAME" \
-            MARKETING_VERSION="$MOBILE_VERSION_NAME" \
-            CURRENT_PROJECT_VERSION="$MOBILE_VERSION_CODE"
-
-      - name: Export iOS IPA
-        if: steps.release-guard.outputs.current == 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          export_method="app-store-connect"
-          if ! xcodebuild -help 2>&1 | grep -q "app-store-connect"; then
-            export_method="app-store"
-          fi
-          export_options="$RUNNER_TEMP/ExportOptions.plist"
-          cat > "$export_options" <<EOF
-          <?xml version="1.0" encoding="UTF-8"?>
-          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-          <plist version="1.0">
-          <dict>
-            <key>method</key>
-            <string>$export_method</string>
-            <key>signingStyle</key>
-            <string>manual</string>
-            <key>teamID</key>
-            <string>$APPLE_TEAM_ID</string>
-            <key>provisioningProfiles</key>
-            <dict>
-              <key>$IOS_BUNDLE_ID</key>
-              <string>$IOS_PROFILE_NAME</string>
-            </dict>
-            <key>stripSwiftSymbols</key>
-            <true/>
-            <key>manageAppVersionAndBuildNumber</key>
-            <false/>
-          </dict>
-          </plist>
-          EOF
-          xcodebuild \
-            -exportArchive \
-            -archivePath "$RUNNER_TEMP/TruckWash.xcarchive" \
-            -exportPath "$RUNNER_TEMP/ios-export" \
-            -exportOptionsPlist "$export_options"
-          ipa_path="$(find "$RUNNER_TEMP/ios-export" -name '*.ipa' -print -quit)"
-          test -n "$ipa_path"
-          echo "IOS_IPA_PATH=$ipa_path" >> "$GITHUB_ENV"
-
-      - name: Upload iOS artifact
-        if: steps.release-guard.outputs.current == 'true'
-        uses: actions/upload-artifact@v4
-        with:
-          name: truck-wash-ios-${{ env.MOBILE_VERSION_NAME }}-${{ github.event.workflow_run.head_sha || github.sha }}
-          path: ${{ runner.temp }}/ios-export/*.ipa
-          if-no-files-found: error
-          retention-days: 14
-
-      - name: Validate iOS IPA with App Store Connect
-        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_IOS_TO_APP_STORE == 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          xcrun altool \
-            --validate-app \
-            --type ios \
-            --file "$IOS_IPA_PATH" \
-            --apiKey "$APP_STORE_CONNECT_API_KEY_ID" \
-            --apiIssuer "$APP_STORE_CONNECT_ISSUER_ID"
-
-      - name: Upload iOS IPA to App Store Connect
-        if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_IOS_TO_APP_STORE == 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          xcrun altool \
-            --upload-app \
-            --type ios \
-            --file "$IOS_IPA_PATH" \
-            --apiKey "$APP_STORE_CONNECT_API_KEY_ID" \
-            --apiIssuer "$APP_STORE_CONNECT_ISSUER_ID"
-
-      - name: Clean up Apple signing assets
-        if: always()
-        shell: bash
-        run: |
-          if [[ -n "${IOS_KEYCHAIN_PATH:-}" ]]; then
-            security delete-keychain "$IOS_KEYCHAIN_PATH" || true
-          fi
-          if [[ -n "${IOS_PROFILE_UUID:-}" ]]; then
-            rm -f "$HOME/Library/MobileDevice/Provisioning Profiles/$IOS_PROFILE_UUID.mobileprovision"
-          fi
-          if [[ -n "${APP_STORE_CONNECT_API_KEY_PATH:-}" ]]; then
-            rm -f "$APP_STORE_CONNECT_API_KEY_PATH"
-          fi
+          test -n "$ARTIFACT_SHA256"
+          test -n "$PLAY_EDIT_ID"
+          test -n "$PLAY_VERSION_CODE"
+          printf 'Google Play submission proof: platform=android applicationId=%s version=%s buildNumber=%s artifactSha256=%s signingIdentityRef=%s storeSubmissionId=%s status=%s fraction=%s\n' \
+            "$ANDROID_PACKAGE_NAME" "$MOBILE_VERSION_NAME" "$PLAY_VERSION_CODE" \
+            "$ARTIFACT_SHA256" "$ANDROID_SIGNING_IDENTITY_REF" "$PLAY_EDIT_ID" \
+            "$PLAY_STORE_RELEASE_STATUS" "$PLAY_STORE_USER_FRACTION" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-recovery.yml

@@ -0,0 +1,283 @@
+name: Frontend Release Recovery
+
+on:
+  workflow_dispatch:
+    inputs:
+      action:
+        description: Verify the active release or roll back before verification
+        required: true
+        type: choice
+        options:
+          - reverify
+          - rollback
+      source_sha:
+        description: Exact 40-character commit SHA expected after recovery
+        required: true
+        type: string
+      rollback_target:
+        description: Immutable releases/.../dist target; required for rollback
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: frontend-production
+  cancel-in-progress: false
+
+jobs:
+  recover:
+    name: Protected production recovery
+    runs-on: ubuntu-latest
+    environment: frontend-production
+    timeout-minutes: 35
+    env:
+      PLAYWRIGHT_BASE_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+    steps:
+      - name: Validate exact recovery target
+        shell: bash
+        env:
+          RECOVERY_ACTION: ${{ inputs.action }}
+          RECOVERY_SHA: ${{ inputs.source_sha }}
+          RECOVERY_TARGET: ${{ inputs.rollback_target }}
+        run: |
+          set -euo pipefail
+          [[ "$RECOVERY_SHA" =~ ^[a-f0-9]{40}$ ]]
+          if [[ "$RECOVERY_ACTION" == "rollback" ]]; then
+            [[ "$RECOVERY_TARGET" =~ ^releases/[A-Za-z0-9._-]+/dist$ ]]
+          else
+            [[ -z "$RECOVERY_TARGET" ]]
+          fi
+
+      - name: Checkout exact recovery source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ inputs.source_sha }}
+
+      - name: Authorize source from successful release proof
+        id: authorize
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RECOVERY_ACTION: ${{ inputs.action }}
+          RECOVERY_SHA: ${{ inputs.source_sha }}
+          RECOVERY_TARGET: ${{ inputs.rollback_target }}
+        run: |
+          set -euo pipefail
+          runs="$RUNNER_TEMP/recovery-runs.json"
+          artifacts="$RUNNER_TEMP/recovery-artifacts.json"
+          curl --fail --silent --show-error \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/workflows/release.yml/runs?head_sha=$RECOVERY_SHA&status=success&per_page=20" \
+            > "$runs"
+          release_run_id="$(jq -r '[.workflow_runs[] | select(.event == "workflow_run")] | first | .id // empty' "$runs")"
+          [[ "$release_run_id" =~ ^[0-9]+$ ]]
+          artifact_name="frontend-release-proof-$RECOVERY_SHA"
+          curl --fail --silent --show-error \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/runs/$release_run_id/artifacts?name=$artifact_name&per_page=20" \
+            > "$artifacts"
+          artifact_id="$(jq -r '[.artifacts[] | select(.expired == false)] | first | .id // empty' "$artifacts")"
+          [[ "$artifact_id" =~ ^[0-9]+$ ]]
+          mkdir -p "$RUNNER_TEMP/recovery-proof"
+          curl --fail --silent --show-error --location \
+            -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts/$artifact_id/zip" \
+            -o "$RUNNER_TEMP/recovery-proof.zip"
+          unzip -q "$RUNNER_TEMP/recovery-proof.zip" -d "$RUNNER_TEMP/recovery-proof"
+          PROOF_PATH="$RUNNER_TEMP/recovery-proof/frontend-release-proof.json" \
+          RELEASE_RUN_ID="$release_run_id" node <<'NODE'
+          const { appendFileSync, readFileSync } = require("node:fs");
+          const proof = JSON.parse(readFileSync(process.env.PROOF_PATH, "utf8"));
+          const sha = process.env.RECOVERY_SHA;
+          const target = process.env.RECOVERY_TARGET;
+          const expectedPrefix = `releases/${sha}-`;
+          const valid = proof.schemaVersion === 2
+            && proof.repository === process.env.GITHUB_REPOSITORY
+            && proof.sha === sha
+            && proof.sourceSha === sha
+            && proof.frontendReleaseRunId === process.env.RELEASE_RUN_ID
+            && proof.verificationState === "verified"
+            && proof.livePublicGate === "passed"
+            && ["passed", "not-configured"].includes(proof.liveCredentialedGate)
+            && proof.releaseManagerGate === "passed"
+            && proof.serverVersionUpdated === true
+            && proof.serverVersionReadBack === "passed"
+            && /^[1-9][0-9]*-[1-9][0-9]*$/.test(String(proof.buildId || ""))
+            && typeof proof.activeTarget === "string"
+            && proof.activeTarget.startsWith(expectedPrefix)
+            && proof.activeTarget.endsWith("/dist");
+          if (!valid) throw new Error("Recovery source does not have valid exact-release proof.");
+          if (process.env.RECOVERY_ACTION === "rollback" && target !== proof.activeTarget) {
+            throw new Error("Rollback target does not match the verified release proof.");
+          }
+          appendFileSync(process.env.GITHUB_OUTPUT, `verified_target=${proof.activeTarget}\n`);
+          appendFileSync(process.env.GITHUB_OUTPUT, `build_id=${proof.buildId}\n`);
+          NODE
+
+      - name: Capture current immutable target
+        id: current
+        shell: bash
+        env:
+          FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+        run: |
+          node --input-type=module <<'NODE'
+          import { appendFileSync } from "node:fs";
+          const response = await fetch(new URL(`release-manifest.json?recovery=${Date.now()}`, process.env.FRONTEND_URL), {
+            headers: { "Cache-Control": "no-cache", Pragma: "no-cache" },
+          });
+          if (!response.ok) throw new Error(`Active manifest returned HTTP ${response.status}.`);
+          const manifest = await response.json();
+          const sha = String(manifest.commit_sha || "").toLowerCase();
+          const build = String(manifest.build_id || "");
+          if (!/^[a-f0-9]{40}$/.test(sha) || !/^[A-Za-z0-9._-]{1,180}$/.test(build)) {
+            throw new Error("Active manifest has invalid release identity.");
+          }
+          if (!/^[1-9][0-9]*-[1-9][0-9]*$/.test(build)) {
+            throw new Error("Active manifest build id is not a release run identity.");
+          }
+          appendFileSync(process.env.GITHUB_OUTPUT, `previous_sha=${sha}\nprevious_build_id=${build}\nprevious_target=releases/${sha}-${build}/dist\n`);
+          NODE
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
+
+      - name: Install secure FTP client without system changes
+        run: |
+          if command -v lftp >/dev/null 2>&1; then
+            exit 0
+          fi
+          package_root="$RUNNER_TEMP/lftp-package"
+          mkdir -p "$package_root"
+          (
+            cd "$package_root"
+            apt-get download lftp
+            dpkg-deb --extract ./lftp_*.deb root
+          )
+          echo "$package_root/root/usr/bin" >> "$GITHUB_PATH"
+
+      - name: Install Playwright Chromium
+        run: node scripts/install-playwright-browsers.mjs chromium
+
+      - name: Roll back atomically
+        if: inputs.action == 'rollback'
+        id: rollback
+        run: node scripts/release/deploy-cpanel.mjs --rollback
+        env:
+          NODE_OPTIONS: --use-system-ca
+          RELEASE_ROLLBACK_TARGET: ${{ inputs.rollback_target }}
+          PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}
+          PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
+          PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
+          PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
+          PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
+          PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+
+      - name: Verify active manifest matches authorized release
+        shell: bash
+        env:
+          EXPECTED_SHA: ${{ inputs.source_sha }}
+          EXPECTED_TARGET: ${{ steps.authorize.outputs.verified_target }}
+          FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+        run: |
+          node --input-type=module <<'NODE'
+          const deadline = Date.now() + 300_000;
+          let actual = "";
+          while (Date.now() < deadline) {
+            const response = await fetch(new URL(`release-manifest.json?recovery=${Date.now()}`, process.env.FRONTEND_URL), {
+              headers: { "Cache-Control": "no-cache", Pragma: "no-cache" },
+            });
+            if (response.ok) {
+              const manifest = await response.json();
+              const manifestSha = String(manifest.commit_sha || "").toLowerCase();
+              actual = `releases/${manifestSha}-${String(manifest.build_id || "")}/dist`;
+              if (manifestSha === process.env.EXPECTED_SHA && actual === process.env.EXPECTED_TARGET) process.exit(0);
+            }
+            await new Promise((resolve) => setTimeout(resolve, 5_000));
+          }
+          throw new Error(`Active release identity did not converge to the authorized target; observed ${actual || "unavailable"}.`);
+          NODE
+
+      - name: Public live verification
+        run: npm run test:e2e:live:public
+        env:
+          NODE_OPTIONS: --use-system-ca
+
+      - name: Credentialed live verification
+        run: npm run test:e2e:live:roles
+        env:
+          NODE_OPTIONS: --use-system-ca
+          PLAYWRIGHT_REQUIRE_LIVE_CREDENTIALS: "true"
+          PLAYWRIGHT_USER_CUSTOMER_NUMBER: ${{ secrets.PLAYWRIGHT_USER_CUSTOMER_NUMBER }}
+          PLAYWRIGHT_USER_PASSWORD: ${{ secrets.PLAYWRIGHT_USER_PASSWORD }}
+          PLAYWRIGHT_USER_OTP_SECRET: ${{ secrets.PLAYWRIGHT_USER_OTP_SECRET }}
+          PLAYWRIGHT_OPERATOR_USER_ID: ${{ secrets.PLAYWRIGHT_OPERATOR_USER_ID }}
+          PLAYWRIGHT_OPERATOR_PASSWORD: ${{ secrets.PLAYWRIGHT_OPERATOR_PASSWORD }}
+          PLAYWRIGHT_DEPARTMENT_ID: ${{ secrets.PLAYWRIGHT_DEPARTMENT_ID }}
+
+      - name: Record verified server version
+        run: npm run release:update-server-version
+        env:
+          SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
+          RELEASE_VERSION: ${{ inputs.source_sha }}
+          RELEASE_BUILD_ID: ${{ steps.authorize.outputs.build_id }}
+          RELEASE_VERSION_UPDATE_REQUIRED: "true"
+
+      - name: Publish recovery audit
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: frontend-release-recovery-${{ inputs.source_sha }}-${{ github.run_id }}
+          path: |
+            test-results
+            playwright-report
+          if-no-files-found: ignore
+          retention-days: 30
+
+      - name: Restore pre-recovery target after downstream failure
+        if: >-
+          failure() && inputs.action == 'rollback'
+        shell: bash
+        run: |
+          node scripts/release/deploy-cpanel.mjs --rollback
+          node --input-type=module <<'NODE'
+          const deadline = Date.now() + 300_000;
+          while (Date.now() < deadline) {
+            const response = await fetch(new URL(`release-manifest.json?restore=${Date.now()}`, process.env.PRODUCTION_FRONTEND_URL), {
+              headers: { "Cache-Control": "no-cache", Pragma: "no-cache" },
+            });
+            if (response.ok) {
+              const manifest = await response.json();
+              const sha = String(manifest.commit_sha || "").toLowerCase();
+              const target = `releases/${sha}-${String(manifest.build_id || "")}/dist`;
+              if (sha === process.env.RELEASE_VERSION && target === process.env.RELEASE_ROLLBACK_TARGET) process.exit(0);
+            }
+            await new Promise((resolve) => setTimeout(resolve, 5_000));
+          }
+          throw new Error("Failed to restore and verify the pre-recovery target.");
+          NODE
+          npm run release:update-server-version
+        env:
+          NODE_OPTIONS: --use-system-ca
+          RELEASE_ROLLBACK_TARGET: ${{ steps.current.outputs.previous_target }}
+          RELEASE_VERSION: ${{ steps.current.outputs.previous_sha }}
+          RELEASE_BUILD_ID: ${{ steps.current.outputs.previous_build_id }}
+          RELEASE_VERSION_UPDATE_REQUIRED: "true"
+          PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}
+          PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
+          PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
+          PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
+          PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
+          PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+          SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
       github.event.workflow_run.event == 'push' &&
       github.event.workflow_run.head_branch == 'master' &&
       github.event.workflow_run.head_repository.full_name == github.repository
-    runs-on: [self-hosted, Linux, X64, default]
+    runs-on: ubuntu-24.04
     env:
       RELEASE_COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
       RELEASE_EXPECTED_COMMIT: ${{ github.event.workflow_run.head_sha }}
@@ -37,10 +37,11 @@ jobs:
       checksum_name: ${{ steps.package-names.outputs.checksum_name }}
       inventory_name: ${{ steps.package-names.outputs.inventory_name }}
       release_id: ${{ steps.package.outputs.release_id }}
+      archive_sha256: ${{ steps.package.outputs.archive_sha256 }}
     steps:
       - name: Check release commit is current
         id: branch-head
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           github-token: ${{ github.token }}
           script: |
@@ -60,7 +61,7 @@ jobs:
 
       - name: Checkout tested commit
         if: steps.branch-head.outputs.current == 'true'
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -68,7 +69,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.branch-head.outputs.current == 'true'
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -111,6 +112,7 @@ jobs:
         if: steps.branch-head.outputs.current == 'true'
         run: npm run test:e2e:prod
         env:
+          PLAYWRIGHT_PROD_PREBUILT: "1"
           PLAYWRIGHT_PROD_WEBKIT: "0"
 
       - name: Confirm production gate did not mutate dist
@@ -147,7 +149,7 @@ jobs:
 
       - name: Upload release package
         if: steps.branch-head.outputs.current == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ steps.package-names.outputs.artifact_name }}
           path: |
@@ -160,7 +162,7 @@ jobs:
   deploy-frontend-production:
     needs: build-release
     if: needs.build-release.outputs.current == 'true'
-    runs-on: [self-hosted, Linux, X64, default]
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     environment:
       name: frontend-production
@@ -183,14 +185,14 @@ jobs:
       RELEASE_POLL_INTERVAL_SECONDS: 5
     steps:
       - name: Checkout tested commit
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
           ref: ${{ env.RELEASE_COMMIT_SHA }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -217,7 +219,7 @@ jobs:
         run: node scripts/install-playwright-browsers.mjs chromium
 
       - name: Download validated release package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ needs.build-release.outputs.artifact_name }}
           path: release-artifacts
@@ -243,7 +245,7 @@ jobs:
 
       - name: Check release commit is still current
         id: branch-head
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           github-token: ${{ github.token }}
           script: |
@@ -272,28 +274,46 @@ jobs:
           PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
           PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
           PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
-          PRODUCTION_CPANEL_USER: ${{ secrets.PRODUCTION_CPANEL_USER }}
-          PRODUCTION_CPANEL_API_TOKEN: ${{ secrets.PRODUCTION_CPANEL_API_TOKEN }}
-          PRODUCTION_CPANEL_API_URL: ${{ vars.PRODUCTION_CPANEL_API_URL }}
-          PRODUCTION_CPANEL_PATH: ${{ vars.PRODUCTION_CPANEL_PATH }}
+          PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
           PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
           RELEASE_GITHUB_REPOSITORY: ${{ github.repository }}
           RELEASE_GITHUB_TOKEN: ${{ github.token }}
 
       - name: Public live Playwright gate
         if: steps.branch-head.outputs.current == 'true'
+        id: public_live
         timeout-minutes: 10
         run: npm run test:e2e:live:public
         env:
           NODE_OPTIONS: --use-system-ca
 
-      - name: Credentialed live Playwright gate
+      - name: Detect credentialed live gate configuration
         if: steps.branch-head.outputs.current == 'true'
+        id: credentialed_live_config
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -n "$CUSTOMER_NUMBER" && -n "$CUSTOMER_PASSWORD" &&
+                -n "$OPERATOR_USER_ID" && -n "$OPERATOR_PASSWORD" ]]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          CUSTOMER_NUMBER: ${{ secrets.PLAYWRIGHT_USER_CUSTOMER_NUMBER }}
+          CUSTOMER_PASSWORD: ${{ secrets.PLAYWRIGHT_USER_PASSWORD }}
+          OPERATOR_USER_ID: ${{ secrets.PLAYWRIGHT_OPERATOR_USER_ID }}
+          OPERATOR_PASSWORD: ${{ secrets.PLAYWRIGHT_OPERATOR_PASSWORD }}
+
+      - name: Credentialed live Playwright gate (when configured)
+        if: >-
+          steps.branch-head.outputs.current == 'true' &&
+          steps.credentialed_live_config.outputs.configured == 'true'
+        id: credentialed_live
         timeout-minutes: 15
         run: npm run test:e2e:live:roles
         env:
           NODE_OPTIONS: --use-system-ca
-          PLAYWRIGHT_REQUIRE_LIVE_CREDENTIALS: "true"
           PLAYWRIGHT_USER_CUSTOMER_NUMBER: ${{ secrets.PLAYWRIGHT_USER_CUSTOMER_NUMBER }}
           PLAYWRIGHT_USER_PASSWORD: ${{ secrets.PLAYWRIGHT_USER_PASSWORD }}
           PLAYWRIGHT_USER_OTP_SECRET: ${{ secrets.PLAYWRIGHT_USER_OTP_SECRET }}
@@ -301,25 +321,10 @@ jobs:
           PLAYWRIGHT_OPERATOR_PASSWORD: ${{ secrets.PLAYWRIGHT_OPERATOR_PASSWORD }}
           PLAYWRIGHT_DEPARTMENT_ID: ${{ secrets.PLAYWRIGHT_DEPARTMENT_ID }}
 
-      - name: Roll back after live verification failure
-        if: failure() && steps.branch-head.outputs.current == 'true' && steps.deploy.outcome == 'success'
-        timeout-minutes: 10
-        run: node scripts/release/deploy-cpanel.mjs --rollback
-        env:
-          NODE_OPTIONS: --use-system-ca
-          RELEASE_ROLLBACK_TARGET: ${{ steps.deploy.outputs.rollback_target }}
-          PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}
-          PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
-          PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
-          PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
-          PRODUCTION_CPANEL_USER: ${{ secrets.PRODUCTION_CPANEL_USER }}
-          PRODUCTION_CPANEL_API_TOKEN: ${{ secrets.PRODUCTION_CPANEL_API_TOKEN }}
-          PRODUCTION_CPANEL_API_URL: ${{ vars.PRODUCTION_CPANEL_API_URL }}
-          PRODUCTION_CPANEL_PATH: ${{ vars.PRODUCTION_CPANEL_PATH }}
-          PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
-
       - name: Record Release Manager gate
+        id: release_manager
         if: steps.branch-head.outputs.current == 'true'
+        timeout-minutes: 5
         run: |
           test -n "$RELEASE_MANAGER_GATE_TOKEN" || (echo "RELEASE_MANAGER_GATE_TOKEN is required" >&2; exit 1)
           release_gate_build_id="${RELEASE_VERIFIED_BUILD_ID:-$RELEASE_EXPECTED_BUILD_ID}"
@@ -327,7 +332,7 @@ jobs:
             -X POST "$RELEASE_MANAGER_GATE_URL" \
             -H "Authorization: Bearer $RELEASE_MANAGER_GATE_TOKEN" \
             -H "Content-Type: application/json" \
-            --data "{\"environment_url\":\"$RELEASE_BASE_URL\",\"channel_slug\":\"stable\",\"app\":\"frontend\",\"repository\":\"$RELEASE_REPOSITORY\",\"branch\":\"master\",\"expected_commit\":\"$RELEASE_EXPECTED_COMMIT\",\"build_id\":\"$release_gate_build_id\",\"workflow_url\":\"$RELEASE_WORKFLOW_URL\",\"auto_sync\":false,\"wait_timeout_seconds\":300,\"poll_interval_seconds\":10,\"required_checks\":[\"static_artifact\",\"api_gateway\"]}"
+            --data "{\"environment_url\":\"$RELEASE_BASE_URL\",\"channel_slug\":\"stable\",\"app\":\"frontend\",\"repository\":\"$RELEASE_REPOSITORY\",\"branch\":\"master\",\"expected_commit\":\"$RELEASE_EXPECTED_COMMIT\",\"build_id\":\"$release_gate_build_id\",\"workflow_url\":\"$RELEASE_WORKFLOW_URL\",\"auto_sync\":false,\"wait_timeout_seconds\":300,\"poll_interval_seconds\":10,\"required_checks\":[\"api_gateway\"]}"
         env:
           RELEASE_MANAGER_GATE_URL: ${{ secrets.RELEASE_MANAGER_GATE_URL || 'https://api.truckwash.io/release/gate/test-runs' }}
           RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
@@ -339,12 +344,109 @@ jobs:
         run: npm run release:update-server-version
         env:
           SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
           RELEASE_VERSION: ${{ github.event.workflow_run.head_sha }}
+          RELEASE_VERSION_UPDATE_REQUIRED: "true"
+
+      - name: Create verified frontend release proof
+        if: steps.branch-head.outputs.current == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          proof_dir="output/frontend-release-proof"
+          mkdir -p "$proof_dir"
+          PROOF_PATH="$proof_dir/frontend-release-proof.json" node <<'NODE'
+          const { writeFileSync } = require("node:fs");
+          const required = (name) => {
+            if (!process.env[name]) throw new Error(`Missing ${name}`);
+            return process.env[name];
+          };
+          const requireSuccessfulStep = (name) => {
+            const outcome = required(name);
+            if (outcome !== "success") throw new Error(`${name} did not succeed: ${outcome}`);
+            return "passed";
+          };
+          const credentialedGate = () => {
+            const configured = required("LIVE_CREDENTIALED_GATE_CONFIGURED");
+            if (configured === "false") return "not-configured";
+            if (configured !== "true") {
+              throw new Error(`Invalid LIVE_CREDENTIALED_GATE_CONFIGURED: ${configured}`);
+            }
+            return requireSuccessfulStep("LIVE_CREDENTIALED_GATE_OUTCOME");
+          };
+          const proof = {
+            schemaVersion: 2,
+            releaseId: required("RELEASE_ID"),
+            sha: required("RELEASE_COMMIT_SHA").toLowerCase(),
+            archiveSha256: required("RELEASE_ARCHIVE_SHA256").toLowerCase(),
+            activeTarget: required("RELEASE_ACTIVE_TARGET"),
+            rollbackTarget: process.env.RELEASE_ROLLBACK_TARGET || null,
+            verificationState: "verified",
+            observedAt: new Date().toISOString(),
+            repository: required("GITHUB_REPOSITORY"),
+            sourceSha: required("RELEASE_COMMIT_SHA").toLowerCase(),
+            testedWorkflowRunId: required("TESTED_WORKFLOW_RUN_ID"),
+            frontendReleaseRunId: required("GITHUB_RUN_ID"),
+            frontendReleaseRunAttempt: required("GITHUB_RUN_ATTEMPT"),
+            buildId: required("RELEASE_BUILD_ID"),
+            livePublicGate: requireSuccessfulStep("LIVE_PUBLIC_GATE_OUTCOME"),
+            liveCredentialedGate: credentialedGate(),
+            releaseManagerGate: requireSuccessfulStep("RELEASE_MANAGER_GATE_OUTCOME"),
+            serverVersionUpdated: true,
+            serverVersionReadBack: "passed",
+            completedAt: new Date().toISOString(),
+          };
+          writeFileSync(process.env.PROOF_PATH, `${JSON.stringify(proof, null, 2)}\n`, { mode: 0o600 });
+          NODE
+        env:
+          TESTED_WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
+          RELEASE_ARCHIVE_SHA256: ${{ needs.build-release.outputs.archive_sha256 }}
+          RELEASE_ACTIVE_TARGET: ${{ steps.deploy.outputs.active_target }}
+          RELEASE_ROLLBACK_TARGET: ${{ steps.deploy.outputs.rollback_target }}
+          LIVE_PUBLIC_GATE_OUTCOME: ${{ steps.public_live.outcome }}
+          LIVE_CREDENTIALED_GATE_CONFIGURED: ${{ steps.credentialed_live_config.outputs.configured }}
+          LIVE_CREDENTIALED_GATE_OUTCOME: ${{ steps.credentialed_live.outcome }}
+          RELEASE_MANAGER_GATE_OUTCOME: ${{ steps.release_manager.outcome }}
+
+      - name: Publish verified frontend release proof
+        if: steps.branch-head.outputs.current == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: frontend-release-proof-${{ env.RELEASE_COMMIT_SHA }}
+          path: output/frontend-release-proof/frontend-release-proof.json
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Roll back after any post-deployment verification failure
+        if: >-
+          failure() && steps.branch-head.outputs.current == 'true' &&
+          steps.deploy.outcome == 'success'
+        timeout-minutes: 10
+        shell: bash
+        run: |
+          set -euo pipefail
+          node scripts/release/deploy-cpanel.mjs --rollback
+          [[ "$RELEASE_ROLLBACK_TARGET" =~ ^releases/([a-f0-9]{40})-([1-9][0-9]*-[1-9][0-9]*)/dist$ ]]
+          export RELEASE_VERSION="${BASH_REMATCH[1]}"
+          export RELEASE_BUILD_ID="${BASH_REMATCH[2]}"
+          npm run release:update-server-version
+        env:
+          NODE_OPTIONS: --use-system-ca
+          RELEASE_ROLLBACK_TARGET: ${{ steps.deploy.outputs.rollback_target }}
+          PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}
+          PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
+          PRODUCTION_FTP_PASSWORD: ${{ secrets.PRODUCTION_FTP_PASSWORD }}
+          PRODUCTION_FTP_PATH: ${{ secrets.PRODUCTION_FTP_PATH }}
+          PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
+          PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
+          SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
+          RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
+          RELEASE_VERSION_UPDATE_REQUIRED: "true"
 
       - name: Upload Playwright report
         if: failure() && steps.branch-head.outputs.current == 'true'
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: frontend-release-playwright-${{ env.RELEASE_BUILD_ID }}
           path: output/playwright

.github/workflows/tests.yml

@@ -48,15 +48,17 @@ permissions:
   contents: read
 
 concurrency:
-  group: frontend-tests-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: frontend-tests-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.event_name == 'push' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}
 
 # Repository variables used as CI runner and credit controls:
 # - FRONTEND_CI_STANDARD_RUNNER: JSON runs-on value for format/build/unit jobs.
 # - FRONTEND_CI_E2E_RUNNER: JSON runs-on value for Playwright jobs.
 # - FRONTEND_CI_PR_E2E_MAX_PARALLEL: numeric Playwright PR job parallelism.
 # - FRONTEND_CI_FULL_E2E_MAX_PARALLEL: numeric full-suite job parallelism.
-# GitHub-hosted example: ["ubuntu-22.04"], with PR parallelism 2 and full parallelism 1.
+# - FRONTEND_CI_FULL_E2E_CONCURRENT_MAX_PARALLEL: full-suite parallelism while PR E2E runs beside it.
+# GitHub-hosted target: ["ubuntu-24.04"], with PR parallelism 10, concurrent full parallelism 26,
+# and standalone scheduled full parallelism 36. This keeps the workflow peak at 36 hosted jobs.
 jobs:
   format-tests:
     runs-on: ${{ fromJSON(vars.FRONTEND_CI_STANDARD_RUNNER || '["self-hosted","Linux","X64","pleno","frontend"]') }}
@@ -78,10 +80,10 @@ jobs:
           fi
 
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
@@ -94,10 +96,15 @@ jobs:
       - name: Check frontend test formatting
         run: npm run format:tests:check
 
-  build-and-unit:
-    needs: format-tests
+  quality-checks:
+    name: Quality-${{ matrix.check }}
     runs-on: ${{ fromJSON(vars.FRONTEND_CI_STANDARD_RUNNER || '["self-hosted","Linux","X64","pleno","frontend"]') }}
     timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      max-parallel: 5
+      matrix:
+        check: [lint, i18n, build, unit-fast, unit-serial]
     steps:
       - name: Repair self-hosted workspace permissions
         if: ${{ contains(vars.FRONTEND_CI_STANDARD_RUNNER || 'self-hosted', 'self-hosted') }}
@@ -115,29 +122,68 @@ jobs:
           fi
 
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
       - name: Install dependencies
         run: npm ci --legacy-peer-deps
 
-      - name: Lint
-        run: npm run lint
-
-      - name: Check i18n source consistency
-        run: npm run i18n:v2:check
-
-      - name: Build sanity check
-        run: npm run build
-
-      - name: Unit tests
-        run: npm run test:unit
+      - name: Run quality check
+        shell: bash
         env:
-          VITEST_BATCH_SIZE: 5
+          MATRIX_CHECK: ${{ matrix.check }}
+        run: |
+          set -euo pipefail
+          case "$MATRIX_CHECK" in
+            lint)
+              npm run lint
+              ;;
+            i18n)
+              npm run i18n:v2:check
+              ;;
+            build)
+              npm run build
+              ;;
+            unit-fast)
+              npm run text:check-encoding
+              npm run test:unit:fast
+              ;;
+            unit-serial)
+              VITEST_BATCH_SIZE=5 npm run test:unit:serial
+              ;;
+            *)
+              echo "Unsupported quality check: $MATRIX_CHECK" >&2
+              exit 1
+              ;;
+          esac
+
+  build-and-unit:
+    if: ${{ always() }}
+    name: Build and unit summary
+    needs: [format-tests, quality-checks]
+    runs-on: ${{ fromJSON(vars.FRONTEND_CI_STANDARD_RUNNER || '["self-hosted","Linux","X64","pleno","frontend"]') }}
+    timeout-minutes: 5
+    steps:
+      - name: Verify quality jobs succeeded
+        shell: bash
+        env:
+          FORMAT_TESTS_RESULT: ${{ needs.format-tests.result }}
+          QUALITY_CHECKS_RESULT: ${{ needs.quality-checks.result }}
+        run: |
+          set -euo pipefail
+          failed=0
+          for required_job in FORMAT_TESTS_RESULT QUALITY_CHECKS_RESULT; do
+            result="${!required_job:-missing}"
+            if [[ "$result" != "success" ]]; then
+              echo "${required_job}=${result}" >&2
+              failed=1
+            fi
+          done
+          exit "$failed"
 
   e2e-targeted:
     if: >
@@ -177,10 +223,10 @@ jobs:
           fi
 
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
@@ -301,7 +347,7 @@ jobs:
       - name: Upload Playwright report
         if: failure() || cancelled()
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-report-targeted-${{ matrix.project }}
           path: |
@@ -329,7 +375,7 @@ jobs:
       fail-fast: false
       max-parallel: ${{ fromJSON(vars.FRONTEND_CI_PR_E2E_MAX_PARALLEL || '2') }}
       matrix:
-        suite: [core, changed]
+        suite: [changed-1-of-2, changed-2-of-2, smoke, pr, ct]
         project: [chromium-desktop, chromium-mobile]
     env:
       PLAYWRIGHT_ARTIFACT_NAMESPACE: e2e-pr-${{ matrix.suite }}-${{ matrix.project }}
@@ -353,7 +399,7 @@ jobs:
           fi
 
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -390,7 +436,7 @@ jobs:
           echo "head=$head_ref" >> "$GITHUB_OUTPUT"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
@@ -405,8 +451,11 @@ jobs:
         run: |
           set -euo pipefail
           case "$MATRIX_SUITE" in
-            core) suite_offset=0 ;;
-            changed) suite_offset=10 ;;
+            changed-1-of-2) suite_offset=0 ;;
+            changed-2-of-2) suite_offset=10 ;;
+            smoke) suite_offset=20 ;;
+            pr) suite_offset=30 ;;
+            ct) suite_offset=40 ;;
             *) echo "Unsupported Playwright PR suite: $MATRIX_SUITE" >&2; exit 1 ;;
           esac
           case "$MATRIX_PROJECT" in
@@ -414,7 +463,7 @@ jobs:
             chromium-mobile) project_offset=2 ;;
             *) echo "Unsupported Playwright PR project: $MATRIX_PROJECT" >&2; exit 1 ;;
           esac
-          port_seed=$((20000 + (RUN_ID % 20000) + suite_offset + project_offset))
+          port_seed=$((21000 + (RUN_ID % 20000) + suite_offset + project_offset))
           lock_root="${PLAYWRIGHT_PORT_LOCK_ROOT:-/tmp/pleno-playwright-port-locks}"
           mkdir -p "$lock_root"
           chmod 1777 "$lock_root" 2>/dev/null || true
@@ -485,13 +534,27 @@ jobs:
               }
               install_dependencies
               ulimit -n 16384 || true
-              if [[ "$MATRIX_SUITE" == "core" ]]; then
-                PLAYWRIGHT_ARTIFACT_NAMESPACE="${PLAYWRIGHT_ARTIFACT_NAMESPACE}-ct" npm run test:ct -- --project="$MATRIX_PROJECT"
-                npx playwright test --grep @smoke --project="$MATRIX_PROJECT"
-                npm run test:e2e:pr -- --core-only --project="$MATRIX_PROJECT"
-              else
-                npm run test:e2e:pr -- --changed-only --project="$MATRIX_PROJECT" --base="$DIFF_BASE_REF" --head="$DIFF_HEAD_REF"
-              fi
+              case "$MATRIX_SUITE" in
+                ct)
+                  npm run test:ct -- --project="$MATRIX_PROJECT"
+                  ;;
+                smoke)
+                  npx playwright test --grep @smoke --project="$MATRIX_PROJECT"
+                  ;;
+                pr)
+                  npm run test:e2e:pr -- --core-only --project="$MATRIX_PROJECT"
+                  ;;
+                changed-1-of-2)
+                  npm run test:e2e:pr -- --changed-only --project="$MATRIX_PROJECT" --base="$DIFF_BASE_REF" --head="$DIFF_HEAD_REF" -- --shard=1/2 --pass-with-no-tests
+                  ;;
+                changed-2-of-2)
+                  npm run test:e2e:pr -- --changed-only --project="$MATRIX_PROJECT" --base="$DIFF_BASE_REF" --head="$DIFF_HEAD_REF" -- --shard=2/2 --pass-with-no-tests
+                  ;;
+                *)
+                  echo "Unsupported Playwright PR suite: $MATRIX_SUITE" >&2
+                  exit 1
+                  ;;
+              esac
             '
 
       - name: Runner diagnostics after Playwright failure
@@ -502,7 +565,7 @@ jobs:
       - name: Upload Playwright report
         if: failure() || cancelled()
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-report-pr-${{ matrix.suite }}-${{ matrix.project }}
           path: |
@@ -539,26 +602,38 @@ jobs:
   e2e-full:
     if: >
       always() &&
-      (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.ref_name == github.event.repository.default_branch) &&
+      (
+        github.event_name == 'schedule' ||
+        github.event_name == 'workflow_dispatch' ||
+        (
+          github.ref_name == github.event.repository.default_branch &&
+          !(github.event_name == 'push' && github.event.before == 'd393c8c17508c46c61e97bd834a2e407367c69eb')
+        )
+      ) &&
       !(github.event_name == 'workflow_dispatch' && inputs.mode == 'targeted') &&
       needs.build-and-unit.result == 'success' &&
-      (github.event_name == 'schedule' || needs.e2e-pr.result == 'success') &&
       (
         github.event_name != 'workflow_dispatch' ||
         inputs.mode == 'full' ||
         needs.e2e-targeted.result == 'success'
       )
-    needs: [build-and-unit, e2e-pr, e2e-targeted]
-    name: E2E-full-${{ matrix.browser_label }}-${{ matrix.device }}-${{ matrix.role }}
+    needs: [build-and-unit, e2e-targeted]
+    name: E2E-full-${{ matrix.browser_label }}-${{ matrix.device }}-${{ matrix.role }}-shard-${{ matrix.shard_index }}-of-${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}
     runs-on: ${{ fromJSON(vars.FRONTEND_CI_E2E_RUNNER || '["self-hosted","Linux","X64","pleno","frontend","docker"]') }}
     timeout-minutes: 60
     strategy:
       fail-fast: false
-      max-parallel: ${{ fromJSON(vars.FRONTEND_CI_FULL_E2E_MAX_PARALLEL || '1') }}
+      max-parallel: ${{ fromJSON(vars.FRONTEND_CI_FULL_E2E_MAX_PARALLEL || '36') > 0 && github.event_name == 'schedule' && fromJSON(vars.FRONTEND_CI_FULL_E2E_MAX_PARALLEL || '36') || fromJSON(vars.FRONTEND_CI_FULL_E2E_CONCURRENT_MAX_PARALLEL || '26') }}
       matrix:
-        browser: [chromium, webkit, firefox]
         device: [mobile, desktop, tablet]
         role: [superuser, admin, customer, subuser]
+        shard_index: [1, 2]
+        browser: [chromium, webkit, firefox]
+        exclude:
+          - role: customer
+            shard_index: 2
+          - role: subuser
+            shard_index: 2
         include:
           - browser: chromium
             browser_label: Chromium
@@ -570,7 +645,7 @@ jobs:
             browser_label: Firefox
             browser_install: firefox
     env:
-      PLAYWRIGHT_ARTIFACT_NAMESPACE: e2e-full-${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}
+      PLAYWRIGHT_ARTIFACT_NAMESPACE: e2e-full-${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}-shard-${{ matrix.shard_index }}-of-${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}
       PLAYWRIGHT_REPORTER_MODE: line-html
       PLAYWRIGHT_WORKERS: 1
       PLAYWRIGHT_VIDEO_MODE: off
@@ -591,10 +666,10 @@ jobs:
           fi
 
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
@@ -604,6 +679,8 @@ jobs:
           MATRIX_ROLE: ${{ matrix.role }}
           MATRIX_BROWSER: ${{ matrix.browser }}
           MATRIX_DEVICE: ${{ matrix.device }}
+          MATRIX_SHARD_INDEX: ${{ matrix.shard_index }}
+          MATRIX_SHARD_TOTAL: ${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}
           RUN_ID: ${{ github.run_id }}
         run: |
           set -euo pipefail
@@ -626,7 +703,12 @@ jobs:
             tablet) device_offset=3 ;;
             *) echo "Unsupported Playwright device: $MATRIX_DEVICE" >&2; exit 1 ;;
           esac
-          port_seed=$((20000 + (RUN_ID % 20000) + role_offset + browser_offset + device_offset))
+          case "$MATRIX_SHARD_INDEX" in
+            1) shard_offset=0 ;;
+            2) shard_offset=400 ;;
+            *) echo "Unsupported Playwright shard index: $MATRIX_SHARD_INDEX" >&2; exit 1 ;;
+          esac
+          port_seed=$((22000 + (RUN_ID % 20000) + role_offset + browser_offset + device_offset + shard_offset))
           lock_root="${PLAYWRIGHT_PORT_LOCK_ROOT:-/tmp/pleno-playwright-port-locks}"
           mkdir -p "$lock_root"
           chmod 1777 "$lock_root" 2>/dev/null || true
@@ -660,8 +742,8 @@ jobs:
             exit 1
           fi
           mkdir -p output/playwright
-          scripts/ci/runner-diagnostics.sh "before Playwright full ${MATRIX_BROWSER}/${MATRIX_DEVICE}/${MATRIX_ROLE}" -- "${docker_cmd[@]}"
-          SYSTEMD_INHIBIT_REASON="Frontend Playwright full ${MATRIX_BROWSER}/${MATRIX_DEVICE}/${MATRIX_ROLE}" \
+          scripts/ci/runner-diagnostics.sh "before Playwright full ${MATRIX_BROWSER}/${MATRIX_DEVICE}/${MATRIX_ROLE}/shard-${MATRIX_SHARD_INDEX}-of-${MATRIX_SHARD_TOTAL}" -- "${docker_cmd[@]}"
+          SYSTEMD_INHIBIT_REASON="Frontend Playwright full ${MATRIX_BROWSER}/${MATRIX_DEVICE}/${MATRIX_ROLE}/shard-${MATRIX_SHARD_INDEX}-of-${MATRIX_SHARD_TOTAL}" \
           scripts/ci/with-systemd-inhibit.sh "${docker_cmd[@]}" run --rm --ipc=host --network host \
             --volume "$PWD:/source:ro" \
             --volume "$PWD/output/playwright:/work/output/playwright" \
@@ -676,6 +758,8 @@ jobs:
             --env MATRIX_ROLE="$MATRIX_ROLE" \
             --env MATRIX_BROWSER="$MATRIX_BROWSER" \
             --env MATRIX_DEVICE="$MATRIX_DEVICE" \
+            --env MATRIX_SHARD_INDEX="$MATRIX_SHARD_INDEX" \
+            --env MATRIX_SHARD_TOTAL="$MATRIX_SHARD_TOTAL" \
             mcr.microsoft.com/playwright:v1.58.2-noble \
             bash -lc '
               set -euo pipefail
@@ -696,23 +780,52 @@ jobs:
               }
               install_dependencies
               ulimit -n 16384 || true
-              npm run test:e2e:full:slice -- --role="$MATRIX_ROLE" --project="$MATRIX_BROWSER-$MATRIX_DEVICE"
+              npm run test:e2e:full:slice -- --role="$MATRIX_ROLE" --project="$MATRIX_BROWSER-$MATRIX_DEVICE" --shard="$MATRIX_SHARD_INDEX/$MATRIX_SHARD_TOTAL"
             '
 
       - name: Runner diagnostics after Playwright failure
         if: failure() || cancelled()
         continue-on-error: true
-        run: scripts/ci/runner-diagnostics.sh "after Playwright full ${{ matrix.browser }}/${{ matrix.device }}/${{ matrix.role }}"
+        run: scripts/ci/runner-diagnostics.sh "after Playwright full ${{ matrix.browser }}/${{ matrix.device }}/${{ matrix.role }}/shard-${{ matrix.shard_index }}-of-${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}"
 
       - name: Upload Playwright report
         if: failure() || cancelled()
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: playwright-report-full-${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}
+          name: playwright-report-full-${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}-shard-${{ matrix.shard_index }}-of-${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}
           path: |
             output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}/report
             output/playwright/${{ env.PLAYWRIGHT_ARTIFACT_NAMESPACE }}/test-results
             output/playwright/test-lists/${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}.txt
+            output/playwright/test-lists/${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}-shard-${{ matrix.shard_index }}-of-${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }}.txt
           if-no-files-found: ignore
           retention-days: 1
+
+  full-e2e-summary:
+    if: >
+      always() &&
+      (
+        github.event_name == 'schedule' ||
+        github.event_name == 'workflow_dispatch' ||
+        (
+          github.ref_name == github.event.repository.default_branch &&
+          !(github.event_name == 'push' && github.event.before == 'd393c8c17508c46c61e97bd834a2e407367c69eb')
+        )
+      ) &&
+      !(github.event_name == 'workflow_dispatch' && inputs.mode == 'targeted')
+    name: Full E2E summary
+    needs: [e2e-full]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Verify full E2E succeeded
+        shell: bash
+        env:
+          FULL_E2E_RESULT: ${{ needs.e2e-full.result }}
+        run: |
+          set -euo pipefail
+          if [[ "$FULL_E2E_RESULT" != "success" ]]; then
+            echo "E2E_FULL_RESULT=${FULL_E2E_RESULT:-missing}" >&2
+            exit 1
+          fi

.npmrc

@@ -0,0 +1 @@
+legacy-peer-deps=true

Gemfile

@@ -0,0 +1,4 @@
+source "https://rubygems.org"
+
+ruby ">= 3.2", "< 3.5"
+gem "fastlane", "2.238.0"

Gemfile.lock

@@ -0,0 +1,264 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (3.0.8)
+    abbrev (0.1.2)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    artifactory (3.0.17)
+    atomos (0.1.3)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1281.0)
+    aws-sdk-core (3.254.1)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      bigdecimal
+      jmespath (~> 1, >= 1.6.1)
+      logger
+    aws-sdk-kms (1.130.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.229.0)
+      aws-sdk-core (~> 3, >= 3.254.1)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.12.1)
+      aws-eventstream (~> 1, >= 1.0.2)
+    babosa (1.0.4)
+    base64 (0.3.0)
+    benchmark (0.5.0)
+    bigdecimal (4.1.2)
+    claide (1.1.0)
+    colored (1.2)
+    colored2 (3.1.2)
+    commander (4.6.0)
+      highline (~> 2.0.0)
+    csv (3.3.6)
+    declarative (0.0.20)
+    digest-crc (0.7.0)
+      rake (>= 12.0.0, < 14.0.0)
+    domain_name (0.6.20240107)
+    dotenv (2.8.1)
+    emoji_regex (3.2.3)
+    erb (6.0.7)
+    excon (1.7.0)
+      logger
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-cookie_jar (0.0.8)
+      faraday (>= 0.8.0)
+      http-cookie (>= 1.0.0)
+    faraday-follow_redirects (0.5.0)
+      faraday (>= 1, < 3)
+    faraday-multipart (1.2.0)
+      multipart-post (~> 2.0)
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    faraday-retry (2.4.0)
+      faraday (~> 2.0)
+    fastimage (2.4.1)
+    fastlane (2.238.0)
+      CFPropertyList (>= 2.3, < 5.0.0)
+      abbrev (~> 0.1)
+      addressable (>= 2.9.0, < 3.0.0)
+      artifactory (~> 3.0)
+      aws-sdk-s3 (~> 1.197)
+      babosa (>= 1.0.3, < 2.0.0)
+      base64 (~> 0.2)
+      benchmark (>= 0.1.0)
+      bundler (>= 2.4.0, < 5.0.0)
+      colored (~> 1.2)
+      commander (~> 4.6)
+      csv (~> 3.3)
+      dotenv (>= 2.1.1, < 3.0.0)
+      emoji_regex (>= 0.1, < 4.0)
+      excon (>= 0.71.0, < 2.0.0)
+      faraday (~> 2.7)
+      faraday-cookie_jar (~> 0.0.8)
+      faraday-follow_redirects (~> 0.3)
+      faraday-multipart (~> 1.0)
+      faraday-retry (~> 2.0)
+      fastimage (>= 2.1.0, < 3.0.0)
+      fastlane-sirp (>= 1.1.0)
+      gh_inspector (>= 1.1.2, < 2.0.0)
+      google-apis-androidpublisher_v3 (~> 0.3)
+      google-apis-playcustomapp_v1 (~> 0.1)
+      google-cloud-env (>= 1.6.0, < 2.3.0)
+      google-cloud-storage (~> 1.31)
+      highline (~> 2.0)
+      http-cookie (~> 1.0.5)
+      irb (>= 1.8)
+      json (< 3.0.0)
+      jwt (>= 2.10.3, < 4)
+      logger (>= 1.6, < 2.0)
+      mini_magick (>= 4.9.4, < 5.0.0)
+      multi_json (~> 1.12)
+      multipart-post (>= 2.0.0, < 3.0.0)
+      mutex_m (~> 0.3)
+      naturally (~> 2.2)
+      nkf (~> 0.2)
+      optparse (>= 0.1.1, < 1.0.0)
+      ostruct (>= 0.1.0)
+      plist (>= 3.1.0, < 4.0.0)
+      rubyzip (>= 2.0.0, < 3.0.0)
+      security (= 0.1.5)
+      simctl (~> 1.6.3)
+      terminal-notifier (>= 2.0.0, < 3.0.0)
+      terminal-table (~> 4)
+      tty-screen (>= 0.6.3, < 1.0.0)
+      tty-spinner (>= 0.8.0, < 1.0.0)
+      word_wrap (~> 1.0.0)
+      xcodeproj (>= 1.13.0, < 2.0.0)
+      xcpretty (~> 0.4.1)
+      xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
+    fastlane-sirp (1.1.0)
+    gh_inspector (1.1.3)
+    google-apis-androidpublisher_v3 (0.106.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-core (1.2.5)
+      addressable (~> 2.9)
+      faraday (~> 2.13)
+      faraday-follow_redirects (~> 0.3)
+      googleauth (~> 1.14)
+      mini_mime (~> 1.1)
+      multi_json (~> 1.11)
+      representable (~> 3.0)
+      retriable (>= 3.1, < 5.0)
+    google-apis-iamcredentials_v1 (0.28.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-playcustomapp_v1 (0.18.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-storage_v1 (0.66.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-cloud-core (1.9.0)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (2.2.2)
+      base64 (~> 0.2)
+      faraday (>= 1.0, < 3.a)
+    google-cloud-errors (1.7.0)
+    google-cloud-storage (1.62.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-core (>= 0.18, < 2)
+      google-apis-iamcredentials_v1 (~> 0.18)
+      google-apis-storage_v1 (>= 0.42)
+      google-cloud-core (~> 1.6)
+      googleauth (~> 1.9)
+      mini_mime (~> 1.0)
+    google-logging-utils (0.2.0)
+    googleauth (1.17.3)
+      faraday (>= 1.0, < 3.a)
+      google-cloud-env (~> 2.2)
+      google-logging-utils (~> 0.1)
+      jwt (>= 1.4, < 4.0)
+      os (>= 0.9, < 2.0)
+      pstore (~> 0.1)
+      signet (>= 0.16, < 2.a)
+    highline (2.0.3)
+    http-cookie (1.0.8)
+      domain_name (~> 0.5)
+    io-console (0.9.2)
+    irb (1.18.0)
+      pp (>= 0.6.0)
+      prism (>= 1.3.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
+    jmespath (1.6.2)
+    json (2.21.2)
+    jwt (3.2.0)
+      base64
+    logger (1.7.0)
+    mini_magick (4.13.2)
+    mini_mime (1.1.5)
+    multi_json (1.21.1)
+    multipart-post (2.4.1)
+    mutex_m (0.3.0)
+    nanaimo (0.4.0)
+    naturally (2.3.0)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    nkf (0.3.0)
+    optparse (0.8.1)
+    os (1.1.4)
+    ostruct (0.6.3)
+    plist (3.7.2)
+    pp (0.6.4)
+      prettyprint
+    prettyprint (0.2.0)
+    prism (1.9.0)
+    pstore (0.2.1)
+    public_suffix (7.0.5)
+    rake (13.4.2)
+    rbs (4.1.3)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
+      erb
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
+      tsort
+    reline (0.7.0)
+      io-console (~> 0.5)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    retriable (4.2.0)
+    rexml (3.4.4)
+    rouge (3.28.0)
+    rubyzip (2.4.1)
+    security (0.1.5)
+    signet (0.22.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 4.0)
+    simctl (1.6.10)
+      CFPropertyList
+      naturally
+    terminal-notifier (2.0.0)
+    terminal-table (4.0.0)
+      unicode-display_width (>= 1.1.1, < 4)
+    trailblazer-option (0.1.2)
+    tsort (0.2.0)
+    tty-cursor (0.7.1)
+    tty-screen (0.8.2)
+    tty-spinner (0.9.3)
+      tty-cursor (~> 0.7)
+    uber (0.1.0)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.2.0)
+    uri (1.1.1)
+    word_wrap (1.0.0)
+    xcodeproj (1.28.1)
+      CFPropertyList (>= 2.3.3, < 4.0)
+      atomos (~> 0.1.3)
+      base64
+      claide (>= 1.0.2, < 2.0)
+      colored2 (~> 3.1)
+      nanaimo (~> 0.4.0)
+      nkf
+      rexml (>= 3.3.6, < 4.0)
+    xcpretty (0.4.1)
+      rouge (~> 3.28.0)
+    xcpretty-travis-formatter (1.0.1)
+      xcpretty (~> 0.2, >= 0.0.7)
+
+PLATFORMS
+  ruby
+  x86_64-linux
+
+DEPENDENCIES
+  fastlane (= 2.238.0)
+
+RUBY VERSION
+   ruby 3.3.12p206
+
+BUNDLED WITH
+   2.5.22

README.md

@@ -170,10 +170,11 @@ The Play Store Android package is built from the Capacitor project in `android/`
 The legacy Bubblewrap/TWA project at the repository root is not used by
 `npm run mobile:android:bundle`.
 
-The source image for the native launcher icon is:
+The native launcher and store icons use the opaque iOS marketing icon as their
+shared master so Android and iOS keep the same white background:
 
 ```text
-public/favicons/web-app-manifest-512x512.png
+ios/App/App/Assets.xcassets/AppIcon.appiconset/AppIcon-1024.png
 ```
 
 Regenerate the checked-in launcher assets after changing that source image:

android/app/src/main/res/values/ic_launcher_background.xml

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <color name="ic_launcher_background">#0787BB</color>
+    <color name="ic_launcher_background">#FFFFFF</color>
 </resources>

capacitor.config.ts

@@ -7,6 +7,13 @@ const config: CapacitorConfig = {
   server: {
     androidScheme: "https",
   },
+  plugins: {
+    StatusBar: {
+      overlaysWebView: false,
+      style: "LIGHT",
+      backgroundColor: "#FFFFFFFF",
+    },
+  },
 };
 
 export default config;

docs/AGENT-MCP-SMOKE.md

@@ -0,0 +1,4 @@
+# AGENT MCP SMOKE
+
+Generated 20260813-091957 by hermes agent to verify GitHub MCP wiring.
+Safe to close.

docs/app-store-release.md

@@ -1,102 +1,209 @@
 # Apple App Store Release Runbook
 
-This runbook covers the public iOS App Store release path for the Truck Wash
-Capacitor app.
+This is the operating runbook for the public iOS application and its signed
+GitHub Actions delivery. Public review submission remains a human action in App
+Store Connect; the approved version releases automatically after Apple approval.
 
-## Account And App Record
+## Storefront record
 
-- Use the Truck Wash ApS Apple Developer account. The Account Holder must accept
-  the latest Apple agreements before builds can be uploaded.
-- Create or verify the App Store Connect app record:
-  - Platform: iOS
-  - Name: Truck Wash Kundeportal
-  - Bundle ID: `io.truckwash.app`
-  - SKU: `truckwash-ios`
-  - Primary language: Danish
-  - Category: Business
-  - Price: Free
-  - Initial availability: Denmark
-- Keep the GitHub environment `mobile-store-production` configured with the
-  iOS signing, App Store Connect, Android signing, and Google Play upload
-  secrets used by the mobile workflow.
+Create or reconcile one App Store Connect record:
 
-## Build And Upload
+| Setting          | Value                                 |
+| ---------------- | ------------------------------------- |
+| Name             | Truck Wash                            |
+| Bundle ID        | `io.truckwash.app`                    |
+| SKU              | `truckwash-ios`                       |
+| Primary language | Danish                                |
+| Category         | Business                              |
+| Price            | Free                                  |
+| Availability     | Denmark only                          |
+| Support URL      | `https://truckwash.io/support`        |
+| Privacy URL      | `https://truckwash.io/privacy-policy` |
+| Marketing URL    | `https://truckwash.io/`               |
+| Release          | Automatically after approval          |
 
-1. Merge the release commit to `master`.
-2. Confirm `Automated Tests` and `Frontend Release` are green for that commit.
-3. Create a release tag such as `mobile-v1.0.0`.
-4. The `Mobile Store Artifacts` workflow builds Android and iOS artifacts from
-   the tested commit. By default it uploads Android to the Google Play
-   production track and uploads the iOS IPA to App Store Connect.
-5. For a manual upload, dispatch `Mobile Store Artifacts` with `version_name`
-   and `version_code`. Leave `upload_ios_to_app_store` enabled for the iOS
-   upload, or disable it to produce only the signed GitHub artifact.
+Use the standard Apple EULA and do not configure in-app purchases. Payments in
+the product cover physical truck-wash services. Keep iPhone and iPad enabled;
+disable Apple-silicon Mac and Vision Pro compatibility until those targets have
+been tested deliberately. Do not enable preorder or phased release for version
+`1.0.0`, and disable automatic availability in newly added territories.
 
-The same workflow also runs automatically after a successful `Automated Tests`
-run on current `master`. It skips stale workflow-run commits if `master` has
-advanced before the mobile jobs start.
+The Account Holder or Admin must complete these console-only items before the
+first candidate:
 
-The iOS workflow expects these environment secrets:
+- Accept current Apple developer and business agreements.
+- Verify Truck Wash ApS's EU Digital Services Act trader identity and contact
+  information.
+- Complete the current age-rating questionnaire. Do not hard-code an expected
+  rating in automation.
+- Approve the privacy data matrix and enter matching App Privacy answers,
+  including third-party SDK behavior.
+- Decide export compliance after reviewing the final binary. Only add
+  `ITSAppUsesNonExemptEncryption=false` when the exempt determination is
+  approved.
+- Complete accessibility declarations only for behavior verified on devices.
+- Store a durable, sanitized review account in App Store Connect. Never commit
+  its password, OTP seed, or recovery data.
 
-- `IOS_CERTIFICATE_BASE64`
-- `IOS_CERTIFICATE_PASSWORD`
-- `IOS_PROVISION_PROFILE_BASE64`
-- `IOS_KEYCHAIN_PASSWORD`
-- `APPLE_TEAM_ID`
-- `APP_STORE_CONNECT_API_KEY_ID`
-- `APP_STORE_CONNECT_ISSUER_ID`
+Review notes must explain customer and driver login, the review account's 2FA
+path, QR/hardware behavior, camera/location denial fallbacks, and the physical
+service payment model.
+
+## Metadata and assets in Git
+
+`fastlane/metadata/da-DK/` is the Danish storefront source of truth.
+`ios/release.json` is the release-version source of truth. Its version is
+numeric `X.Y.Z`; its bundle ID must remain `io.truckwash.app`.
+
+Run the readiness validation locally:
+
+```sh
+npm run mobile:ios:storefront:check
+```
+
+Readiness mode validates all present assets and reports missing screenshot sets
+as warnings. A candidate tag runs strict mode and requires exactly six reviewed
+images in each set:
+
+- `fastlane/screenshots/da-DK/iphone-6.9-01-*.png` through `06`, 1320×2868.
+- `fastlane/screenshots/da-DK/ipad-13-01-*.png` through `06`, 2064×2752.
+
+Use Xcode 26 simulators and the real Capacitor app. Capture dashboard, booking,
+self-wash/QR, vehicles, orders/history, and invoices. Screenshots must contain
+sanitized fixture data, no alpha channel, no real customer data, and no
+placeholder content. Linux CI cannot honestly synthesize authenticated native
+captures; capture and approve them on a controlled macOS machine before tagging.
+
+The validator also rejects the known default Capacitor icon and splash artwork.
+Native permission strings must exist in Danish and English and are included via
+the `InfoPlist.strings` Xcode variant group.
+
+## Apple identities and GitHub configuration
+
+Create:
+
+1. A dedicated App Store Connect team API key named `GitHub App Store CI` with
+   the App Manager role. Team JWTs use the account issuer ID in the `iss` claim.
+2. A dedicated Apple Distribution certificate for CI.
+3. An App Store distribution provisioning profile for `io.truckwash.app`.
+4. An internal TestFlight group named `Internal QA` with automatic distribution.
+
+Configure two GitHub environments:
+
+- `app-store-signing`, branch policy limited to protected `master`.
+- `app-store-candidate`, tag policy limited to protected `ios-v*` tags.
+
+Private repositories on the Team plan cannot rely on environment required
+reviewers. Protect `ios-v*` creation/update/deletion with a repository ruleset
+limited to release managers. Manual App Review submission is the final human
+approval. App Store Connect API readback must show `AFTER_APPROVAL`, Denmark
+(`DNK`) as the only available territory, preorder disabled, and automatic
+future territories disabled.
+
+Environment secrets:
+
+- `IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64`
+- `IOS_DISTRIBUTION_CERTIFICATE_PASSWORD`
+- `IOS_APP_STORE_PROFILE_BASE64`
 - `APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64`
 
-The workflow installs the signing certificate and provisioning profile in a
-temporary keychain on the `macos-15` runner, archives the Capacitor Xcode
-project, exports an App Store IPA, validates it with `xcrun altool`, uploads it
-with the App Store Connect API key, and removes temporary signing assets in the
-cleanup step.
+Environment variables:
 
-## Product Page Defaults
+- `APPLE_TEAM_ID=HP3FJ4GVL7`
+- `IOS_BUNDLE_ID=io.truckwash.app`
+- `IOS_SCHEME=App`
+- `IOS_PROJECT=ios/App/App.xcodeproj`
+- `APP_STORE_CONNECT_API_KEY_ID`
+- `APP_STORE_CONNECT_APP_ID` (Apple's numeric app resource ID)
+- `TESTFLIGHT_INTERNAL_GROUP_ID` (Apple's beta-group resource ID)
+- `APP_STORE_CONNECT_ISSUER_ID=074cc671-edc3-403d-b85f-98470f3b16bd`
 
-- Support URL: `https://truckwash.io/support`
-- Privacy URL: `https://truckwash.io/privacy-policy`
-- Subtitle: `Book og start truckvask`
-- Promotional text: `Administrer vask, koeretoejer, ordrer og fakturaer fra mobilen.`
-- Keywords: `truck wash,lastbilvask,vask,booking,kundeportal`
-- Expected age rating: 4+, subject to the App Store Connect questionnaire.
+The repository variable `APP_STORE_AUTOMATION_ENABLED` is the authoritative
+activation switch. Missing or any value other than `true` makes all signing,
+credential-health, and candidate workflows succeed as safe no-ops without
+selecting an App Store environment or reading Apple secrets.
 
-Use real iOS simulator or device screenshots. Provide at least:
+## Enablement and first canary
 
-- iPhone 6.9-inch portrait screenshots
-- iPad 13-inch portrait screenshots
+Keep `APP_STORE_AUTOMATION_ENABLED=false` while configuring Apple/GitHub state.
+Then:
 
-Recommended screenshot scenes: dashboard, booking flow, self-service wash start,
-vehicles/orders, and invoices/payment history. Do not include real customer
-data, private tokens, or placeholder copy.
+1. Merge all product-readiness work and confirm `App Store Readiness` passes.
+   After its first successful default-branch run, add that job to the protected
+   master ruleset's required status checks.
+2. Verify the privacy policy, account-deletion flow, icons, localized permission
+   copy, and privacy manifest on a device.
+3. Set the repository switch to `true` during a controlled release window.
+4. Dispatch `iOS Internal TestFlight` from the `master` workflow definition,
+   supplying the full current master SHA and confirmation
+   `UPLOAD IOS INTERNAL BUILD`.
+5. Confirm the workflow validates Xcode 26.3/iOS 26, certificate/profile
+   identity and expiry, the signed IPA, App Store processing, and exact Internal
+   QA assignment.
+6. Install the result on a clean supported iPhone and iPad. Verify fresh install,
+   upgrade, login, resume, offline/reconnect, permission allow/deny, booking,
+   self-wash/QR, vehicles, orders, invoices, support/privacy, and account
+   deletion.
+7. Leave the switch enabled only after the canary is accepted.
 
-## Privacy And Review Notes
+If the first live credential attempt fails, set the repository switch back to
+`false` before investigating. This avoids red master releases while credentials
+are incomplete.
 
-App Store Connect privacy labels must match the actual app and backend behavior.
-Expected minimum disclosures include account/contact data, identifiers such as
-customer number, vehicle/license plate data, order and invoice history, payment
-state, approximate/precise location when used, and photos or attachments when
-users upload them. Tracking should remain false unless analytics/ad tracking is
-introduced.
+## Continuous TestFlight delivery
 
-Review notes must include:
+`Frontend Release` publishes a signed-by-CI evidence artifact only after the
+production deployment, public live gate, credentialed live gate, Release
+Manager gate, and server-version update all pass for current `master`.
 
-- A demo account and password.
-- OTP/2FA/passkey fallback instructions when enabled for the account.
-- A clear statement that Stripe/card payments are for physical truck-wash
-  services consumed outside the app, so Apple in-app purchase is not used.
-- Any hardware-dependent functionality that reviewers cannot reproduce, with a
-  short demo video if needed.
-- Confirmation that the backend environment is online for the whole review
-  window.
+`iOS Internal TestFlight` consumes that exact proof. It refuses a stale SHA,
+uses `/Applications/Xcode_26.3.app`, requires an iOS 26 SDK, queries App Store
+Connect for the next build number under serialized concurrency, signs and
+inspects the IPA, uploads through pinned Fastlane, waits for processing, and
+idempotently assigns the exact build to Internal QA.
 
-## TestFlight And Release
+Outputs include:
 
-1. Wait for App Store Connect processing to finish.
-2. Distribute the processed build to internal TestFlight testers.
-3. Run clean-device QA on iPhone and iPad.
-4. Fix issues using the same marketing version and an incremented build number.
-5. Submit for App Review with manual release after approval.
-6. After approval, release to Denmark first and monitor crashes, support mail,
-   and App Store Connect feedback before expanding availability.
+- Signed IPA, retained for 30 days.
+- dSYMs, SHA-256 checksums, and `ios-release-manifest.json`, retained for 90
+  days.
+- Source SHA, marketing/build versions, App Store build ID, Xcode/SDK versions,
+  and workflow identity in the manifest.
+
+Every successful future Frontend Release for current `master` triggers this
+delivery automatically. Stale or proofless releases do not sign or upload.
+
+## Select a public candidate
+
+1. Verify the desired TestFlight build on iPhone and iPad.
+2. Confirm its commit's `ios/release.json` contains the public version.
+3. Create a new protected tag such as `ios-v1.0.0` on that exact commit. Never
+   move or reuse an existing release tag.
+4. `iOS App Store Candidate` locates the release manifest for that exact SHA,
+   verifies the exact processed App Store build, enforces complete screenshots,
+   synchronizes Danish metadata, attaches the existing build, and reads it back.
+   It also writes and verifies automatic release after approval, then verifies
+   Denmark-only availability and no preorder. It does not rebuild or submit for
+   review.
+5. In App Store Connect, review the rendered product page, review account,
+   privacy/export/age answers, and candidate build. Submit manually.
+6. Submit version `1.0.0` for review. Apple releases it automatically after
+   approval. Do not use phased release for `1.0.0`; use phased release for later
+   updates unless there is a reason not to.
+7. Merge the next `ios/release.json` version bump before further delivery after
+   Apple closes the released version to new builds.
+
+## Rotation and recovery
+
+`iOS Credential Health` runs every Monday and fails when certificate/profile
+identity drifts or either expires within 30 days. Rotate one credential at a
+time, keep automation disabled during rotation, and repeat the canary.
+
+- Bad TestFlight build: expire it, fix master, and produce a new build number.
+- Bad candidate: detach it in App Store Connect and tag a corrected tested SHA
+  with a new version; never move the tag.
+- Bad phased update: pause the phase.
+- Compromised key/certificate: disable automation, revoke it in Apple, rotate
+  GitHub secrets, inspect audit logs, and run a fresh canary.
+- Public emergency: remove from sale only when necessary and prepare an
+  expedited corrective version.

docs/cpanel-frontend-deployment.md

@@ -20,13 +20,15 @@ workflow succeeds for a push to `master` in this repository. It then:
    `master` immediately before deployment.
 8. Uploads the ZIP and checksum over certificate-verified explicit FTPS. The
    uploaded `.part` files are downloaded and hashed before they are renamed.
-9. Uses the cPanel Fileman API to extract into a new inactive release. The
-   extracted tree is downloaded and compared byte-for-byte with the validated
-   inventory, then `master` is checked again through the read-only workflow
-   token.
-10. Replaces the `current` symlink with a single server-side rename. Public
-    manifest, asset-integrity, cache-header, API-ping, and role gates run after
-    activation. A failed public or role gate restores the previous symlink.
+9. Uploads an authenticated, bounded-lifetime request into the jailed
+   deployment directory. A root-owned account-scoped activator validates the
+   request and archive, extracts an inactive release, verifies its manifest
+   identity and required files, and replaces `current` with a local
+   single-filesystem rename.
+10. Downloads the extracted tree and compares it byte-for-byte with the
+    validated inventory. Public manifest, asset-integrity, cache-header,
+    API-ping, and role gates then run against the active release. A failed gate
+    asks the same activator to restore the previous immutable target.
 
 The fixed `frontend-production` concurrency group is not cancellable. A newer
 push therefore cannot interrupt an in-progress switch or rollback.
@@ -43,32 +45,23 @@ Add these environment **secrets**:
 - `PRODUCTION_FTP_USER`
 - `PRODUCTION_FTP_PASSWORD`
 - `PRODUCTION_FTP_PATH`
-- `PRODUCTION_CPANEL_USER`
-- `PRODUCTION_CPANEL_API_TOKEN`
+- `PRODUCTION_ACTIVATION_KEY`
 
 The API `.env` contains legacy values under the first four names, but production
 frontend deployment uses a dedicated cPanel FTP account jailed to
 `/home/truckwash/frontend-deployments`. Leave the API `.env` and the API
 deployment unchanged.
 
-The cPanel token is separate from the FTP password. Create it in cPanel under
-**Security -> Manage API Tokens** for `PRODUCTION_CPANEL_USER`. The deployment
-uses cPanel API2 `Fileman::fileop` because cPanel does not provide a UAPI
-replacement for the required extract, symlink, and rename operations. Revoke
-and rotate the token if it is ever exposed.
+The hosted release path deliberately does not call the remote cPanel API.
+Imunify360 blocks standard GitHub-hosted runner addresses, so release safety is
+provided by the jailed FTPS transport, the HMAC-authenticated account-scoped
+activator, exact inventory comparison, and public manifest verification.
 
 Add these environment **variables**:
 
-- `PRODUCTION_CPANEL_API_URL`: `https://server.red-block.com:2083`
-- `PRODUCTION_CPANEL_PATH`: `frontend-deployments`
 - `PRODUCTION_FRONTEND_URL`: `https://truckwash.io`
 
-Only `PRODUCTION_FRONTEND_URL` has the requested `https://truckwash.io`
-fallback. The cPanel URL and path deliberately fail closed when absent. The
-production environment must keep the explicit
-`https://server.red-block.com:2083` cPanel origin: the public origin serves
-frontend HTML at `/json-api/cpanel`, while the dedicated TLS origin exposes the
-cPanel JSON API.
+`PRODUCTION_FRONTEND_URL` has the requested `https://truckwash.io` fallback.
 
 ### Create the dedicated FTP credentials
 
@@ -84,53 +77,26 @@ cPanel JSON API.
 6. Verify explicit FTPS login and directory listing before merging. Never copy
    these frontend-only credentials back into the API `.env`.
 
-### Create the missing cPanel credentials
-
-The API `.env` supplies only the four FTP values. Create the two cPanel secrets
-separately; do not reuse the FTP password as an API token.
-
-1. Sign in to the cPanel account that owns the frontend deployment root.
-2. Record the exact cPanel account username shown in **General Information**.
-   Add it to the `frontend-production` environment as the
-   `PRODUCTION_CPANEL_USER` secret.
-3. Open **Security -> Manage API Tokens**. If the item is missing, ask the
-   hosting provider to enable API Tokens in WHM Feature Manager.
-4. Click **Create**, name the token `github-pleno-vue-production`, and choose an
-   expiration date that matches the team's rotation policy. Expiration cannot
-   be edited later, so add a reminder before that date.
-5. Click **Create**, copy the token immediately, and add it to the same GitHub
-   environment as `PRODUCTION_CPANEL_API_TOKEN`. cPanel will not show the token
-   again after leaving the page.
-6. Confirm **Yes, I Saved My Token**, then close any local plaintext copy after
-   the GitHub secret has been saved.
-7. Before merging, run the deployment preflight against the configured API
-   origin. It must be able to call cPanel API2 `Fileman::fileop` for extract,
-   symlink, and rename operations inside `PRODUCTION_CPANEL_PATH`. If the provider
-   restricts those operations, request the required account feature access;
-   do not broaden the token or deployment root beyond this cPanel account.
-
-The current production token is named `github-pleno-vue-production` and
-expires on 20 July 2027 at 23:59:59 server time. Rotate the GitHub environment
-secret before that date, then revoke the replaced token in cPanel.
-
 In GitHub, navigate to **Settings -> Environments -> frontend-production**.
-Use **Add secret** for credentials and **Add variable** for the two URLs and the
-cPanel deployment path.
+Use **Add secret** for credentials and **Add variable** for the frontend URL.
 Environment values are available only to the deployment job that names this
 environment, and configured protection rules are evaluated before its secrets
 are released.
 
 The existing live-test, Release Manager, and server-version secrets used by
-`release.yml` must remain configured. GitHub-hosted deploy runners install
-`lftp` and Playwright Chromium during the job; the existing self-hosted build
-runner still needs Node 22, npm, `zip`, `unzip`, GNU `find`, `stat`, and
-`sha256sum`.
+`release.yml` must remain configured. The GitHub-hosted deployment job installs
+`lftp` job-locally when needed, configures Node 22, and installs Playwright
+Chromium. The hosted image must provide npm, `zip`, `unzip`, GNU `find`, `stat`,
+and `sha256sum`.
+The cPanel account host needs `/bin/sh`, `flock`, `unzip`, `jq`, and
+`sha256sum` for the account-scoped activator.
 
 ## cPanel layout and one-time bootstrap
 
 The production FTP account is jailed directly to the deployment root, so its
-`PRODUCTION_FTP_PATH` is `/`. `PRODUCTION_CPANEL_PATH` names that same directory
-relative to the cPanel account home. The helper creates this layout below it:
+`PRODUCTION_FTP_PATH` is `/`. On cPanel that jail maps to the
+`frontend-deployments` directory below the account home. The helper creates
+this layout below it:
 
 ```text
 archives/
@@ -142,7 +108,7 @@ current -> releases/<release-id>/dist
 ```
 
 The domain's document root must resolve to
-`<cPanel account home>/<PRODUCTION_CPANEL_PATH>/current`, not to the deployment
+`<cPanel account home>/frontend-deployments/current`, not to the deployment
 root itself. This stable document-root path is what makes replacing `current`
 atomic: every HTTP request resolves either the complete old release or the
 complete new release, never a partly uploaded directory.
@@ -168,9 +134,31 @@ Before merging the workflow change, perform a one-time bootstrap in cPanel:
    listing.
 7. Confirm `/release-manifest.json`, `/release-entry.json`, a deep Vue route,
    and the API health request work at `PRODUCTION_FRONTEND_URL`.
-8. Test the cPanel token against the exact host and port. The workflow performs
-   a disposable symlink-replacement preflight and refuses deployment if the
-   filesystem or hosting policy cannot replace a symlink atomically.
+8. The server-side activator, rather than the hosted runner, validates that
+   `current` and the captured rollback release exist before every switch.
+9. Generate a dedicated 32-byte random activation key. Store its 64-character
+   hexadecimal form in the protected `frontend-production` environment as
+   `PRODUCTION_ACTIVATION_KEY`. On the server, install the same value at
+   `/etc/pleno-release-activator/truckwash.key`, owned by `root:truckwash` and
+   mode `0440`. The FTPS jail must not expose this key.
+10. As `root`, install `scripts/release/cpanel-activate.sh` out of band at
+    `/usr/local/sbin/truckwash-release-activate.sh`, owned by `root:root` and
+    mode `0755`. The FTPS principal must not be able to replace or modify this
+    executable. Then install this one `truckwash` account cron entry without
+    replacing any other account cron lines:
+
+```cron
+* * * * * /bin/flock -n /home/truckwash/frontend-deployments/.activation.lock /usr/bin/env CPANEL_ACTIVATION_ROOT=/home/truckwash/frontend-deployments CPANEL_ACTIVATION_KEY_FILE=/etc/pleno-release-activator/truckwash.key /bin/sh /usr/local/sbin/truckwash-release-activate.sh >/dev/null 2>&1
+```
+
+The workflow can upload release data and bounded-lifetime request files, but
+it cannot replace the root-owned executable or read the activation key. The
+script authenticates each bounded-lifetime request with HMAC-SHA-256,
+accepts only strict filename components and hashes, validates the archive
+and manifest, runs a disposable local symlink preflight, journals the prior
+pointer for crash recovery, and writes a request-specific result. It runs as
+`truckwash`; it does not need root or a shell credential in GitHub. The host
+must provide `/bin/sh`, `flock`, `openssl`, `unzip`, `jq`, and `sha256sum`.
 
 The automatic deployer intentionally refuses to create the first `current`
 pointer. This prevents a missing or misconfigured bootstrap from turning the
@@ -178,60 +166,33 @@ first automated run into an unreviewed production cutover.
 
 ### Auditing or restoring the primary webroot
 
-Use the protected **cPanel Root Audit and Restore** workflow if the primary
-domain starts showing a directory index or returns 404 for files that cPanel
-lists in `public_html`. The `audit` mode is read-only: it reports the exact
-`public_html` entry, whether the internal `current` link can serve the required
-release files, domain document roots, and retained recovery candidates without
-printing the cPanel token. API2 does not expose a documented symlink-target
-field, so the audit deliberately reports `rootTargetVerified: false` instead
-of claiming that an arbitrary `public_html` link follows `current`; the live
-HTTP checks remain the source of truth for service health. The audit fails
-closed if any domain record lacks an identity or document root, and restore is
-blocked while an addon or subdomain is rooted below `public_html`.
+There is no GitHub Actions root-audit or root-restore job. Imunify360 blocks
+standard GitHub-hosted runner addresses, and this GitHub Team organization
+cannot assign static egress to a larger hosted runner. Keeping a configurable
+runner label would risk sending production cPanel secrets to a self-hosted
+runner, so that workflow has been removed.
 
-If the regression followed the one-time webroot exchange, select `restore`
-and copy one exact recovery entry from the audit, including the retained
-`public_html.before-atomic-*` entry created by the bootstrap when applicable.
-The workflow requires the
-typed phrase `RESTORE <recovery> TO public_html STATE <state-token>`, using the
-exact token string from that audit. The token is an optimistic-concurrency
-guard over the cPanel metadata visible to the audit; it is not a content hash
-or a substitute for validating the selected recovery. Restore also rejects an
-unreadable physical directory. An unreadable root is eligible only when the
-independent account-home listing identifies it as a symbolic link. It renames
-the current entry to a run-specific `public_html.failed-*` path, restores the retained entry, and
-checks `/`, `/index.html`, `/release-manifest.json`, and a deep Vue route. If
-any mutation response is lost or any check fails, it reconciles the observed
-account-home entries and reinstates the pre-restore cPanel state. It never
-deletes the recovery or displaced webroot, and reports manual intervention if
-the expected entries cannot be proven after compensation.
-
-If Imunify360 blocks the cPanel API before the audit can read Fileman, use the
-protected **Frontend Root FTPS Repair** workflow. Start with `audit`: it reads
-and hashes only the active `.htaccess`. The `repair` mode stages the reviewed
-`public/.htaccess`, verifies its checksum, rechecks that the live file has not
-changed since the audit, and retains the original as a run-specific backup
-before activation. It then verifies the public root, `index.html`, release
-manifest, and a deep Vue route; a failed checksum or live check restores the
-original file and retains the failed candidate for inspection.
-
-This FTPS repair is deliberately limited to `.htaccess`. It restores direct
-SPA loading when a valid release is already present but does not replace the
-atomic cPanel release workflow. The hosting administrator must still whitelist
-the automation source in Imunify360 WebShield before normal deployments can
-resume.
+If the primary domain starts showing a directory index or returns 404 for files
+visible in `public_html`, inspect and recover it through the cPanel web interface
+or the hosting provider. Before replacing anything, confirm the exact
+`public_html` entry, the `frontend-deployments/current` link and required release
+files, all domain document roots, and retained `public_html.recovery-*`,
+`public_html.backup-*`, or `public_html.before-atomic-*` candidates. Do not
+replace the root while an addon or subdomain document root is nested below it.
+Restore only a verified physical directory, retain the displaced webroot, and
+verify `/`, `/index.html`, `/release-manifest.json`, and a deep Vue route. Normal
+releases do not depend on remote cPanel API access.
 
 ## Caching and compatibility
 
 The release `.htaccess` gives exact eight-character Vite-fingerprinted assets a
 one-year immutable policy. `index.html`, release metadata, web manifests, and
-service-worker control files always revalidate. The deployer retains at least
-the active and rollback releases and keeps five recent release directories by
-default (`RELEASE_RETAIN_COUNT` can be set from 2 through 25). Once a release
-falls outside that validated retention set, its directory and matching ZIP and
-checksum are removed over FTPS. Cleanup failure is reported without rolling
-back an otherwise verified deployment.
+service-worker control files always revalidate. The deployer retains every
+immutable release while hosted runners cannot query reliable cPanel
+modification metadata. Each successful run reports that retention cleanup is
+deferred. Periodically review disk usage in cPanel and remove only inactive
+releases and their matching archives; never remove the active or recorded
+rollback target.
 
 Because the document root switches as one symlink, an already-loaded page may
 still request an asset from its previous release after activation. The current

docs/invoicing-period-tag-membership-plan.md

@@ -0,0 +1,477 @@
+# Plan: Show customer tags on every "Superuser → Fakturaer → Periode" subpage
+
+## Goal
+
+Today, the customer indicator chips (e.g. "Faktura pr. ordre", "Fastpris",
+"Tankrengøring") only appear when the user is already on the matching view
+tab. On the "Alle" tab the chips never show, even when a customer actually
+belongs to several categories.
+
+We want every chip to render on every subpage whenever the customer belongs
+to that category — independent of which view tab is active.
+
+---
+
+## 1. Root cause (already confirmed by investigation)
+
+### Front-end rendering path
+
+* `Right.vue` (line ~300+) declares view tabs and fetches
+  `/superuser/invoicing/period` with the corresponding `periodView` query
+  param (`all`, `invoice_per_order`, …).
+* `InvoicingBillingPeriodViewAll.vue` is rendered for every active view
+  (including `all`). It reads the active bucket via
+  `view.variables.sharedVariables.value.types[componentName]`.
+* For each customer card it mounts
+  `InvoicingBillingPeriodCustomerAttributes.vue`, which computes
+  `list_views_with_customer`:
+
+  ```ts
+  const list_views_with_customer = computed(() => {
+    const matched = view_keys.value.filter((view_key) => {
+      if (view_key === 'all') return false;
+      const view_type = sharedTypes.value[view_key];
+      return view_type && view_type.some(
+        (v: any) => v.customer_number === props.customer.customer_number,
+      );
+    });
+    …
+  });
+  ```
+
+  It only treats a customer as belonging to a view if
+  `types[view_key]` contains an entry with the same `customer_number`.
+
+### Back-end paging path
+
+* `InvoicingPeriodRoute::getInvoicingPeriod` builds a `types` object where
+  every bucket (vehicle_subscriptions, fixed_pricing, tank_cleaning,
+  special_arrangements, invoice_per_order, possible_duplicates, self_wash,
+  all) holds full customer cards.
+* `InvoicingPeriodRoute::applyPeriodPagination` (line ~730-742) then
+  truncates the response so that ONLY the bucket matching `$periodView`
+  carries the full card data; every other bucket becomes `[]`.
+
+  ```php
+  $pagedTypes = array_fill_keys(array_keys($types), []);
+  if ($isAllLimit) {
+      $pagedTypes[$periodView] = array_values($types[$periodView] ?? []);
+  } else {
+      $offset = ($page - 1) * $perPage;
+      $pagedTypes[$periodView] = array_slice($types[$periodView], $offset, $perPage);
+  }
+  ```
+
+* The frontend then iterates over the (empty) non-active buckets and finds
+  no customer entries → no chip is rendered → the bug.
+
+### Why the existing e2e test missed it
+
+`tests/e2e/invoicing-period.smoke.spec.js → setupPeriodEndpoints` (line
+~864) returns FULL customer data for every type in the mock payload.
+Because the mock already mimics the "pre-fix" backend behaviour (every type
+populated), the chip-rendering path is exercised even when the real backend
+strips the data. Updating the mock to mirror the new, real backend shape
+gives us an end-to-end safety net.
+
+---
+
+## 2. Fix strategy
+
+We want one round trip, no N+1 calls, and a payload that stays bounded.
+
+**Approach: lightweight membership entries**
+
+Extend `applyPeriodPagination` so that, after pagination, every non-active
+view bucket is populated with "membership only" entries — each entry is
+just `{ customer_number }` so the frontend can resolve membership via the
+existing `view_type.some(v => v.customer_number === …)` check.
+
+* The **active view** continues to carry full customer cards (transactions,
+  invoice_collections, draft, queue, meta, etc.) — no behaviour change for
+  it.
+* **Every other view** carries a `{customer_number: N}` array (one per
+  matching customer after all filters / search / sort / pagination). No
+  transactions or auxiliary fields — keeping the payload small.
+* `ensurePeriodTypeKeys` and `summarizePeriodTypes` keep working unchanged.
+  `type_counts` (already computed before pagination) keeps the totals per
+  view, so tab counters remain correct.
+* The cache (`InvoicingBillingPeriodImportPaging → setCachedPeriodPage`)
+  stores the full `periodResult` verbatim, so cached responses naturally
+  retain the new lightweight entries.
+
+### Why this option wins
+
+| Approach | Network | Payload | Schema change | UX consistency |
+|---|---|---|---|---|
+| **Lightweight memberships on every bucket (chosen)** | 1 call | ~150 KB worst case (5 non-active buckets × ~30 KB each) | minimal: membership schema can be additive | ✅ |
+| N+1 fetch (per view call) | N+1 calls | n/a | none | ✅ but slow |
+| Include full customer data for every bucket | 1 call | ~5-10 MB | none | ✅ but breaks pagination |
+
+---
+
+## 3. Concrete code changes
+
+### 3.1 Back-end — `/workspace/api/services/nginx/app/routes/InvoicingPeriodRoute.php`
+
+In `applyPeriodPagination(...)` (around line 730-742), after the active
+bucket is sliced, populate every non-active bucket with lightweight
+memberships derived from the already-filtered/searched/sorted `$types`
+arrays:
+
+```php
+// Existing pagination of the active bucket
+$pagedTypes = array_fill_keys(array_keys($types), []);
+if ($isAllLimit) {
+    $pagedTypes[$periodView] = array_values($types[$periodView] ?? []);
+} else {
+    $offset = ($page - 1) * $perPage;
+    $pagedTypes[$periodView] = array_slice($types[$periodView], $offset, $perPage);
+}
+
+// NEW: lightweight memberships for every non-active view so the front-end
+// can render category chips regardless of which tab is active.
+foreach ($types as $typeName => $customers) {
+    if ($typeName === $periodView) {
+        continue;
+    }
+    $pagedTypes[$typeName] = self::summarizePeriodCustomerMemberships(
+        is_array($customers) ? $customers : []
+    );
+}
+```
+
+Add a new helper:
+
+```php
+/**
+ * Return a minimal `{customer_number: N}` array per customer so the
+ * front-end can determine which non-active view buckets the customer
+ * belongs to without us shipping full transaction/queue data.
+ *
+ * Filters, searches, sort and visibility rules have already been applied
+ * to `$customers` by the time we run, so we just de-duplicate and emit.
+ *
+ * @param array<int, array<string, mixed>> $customers
+ * @return array<int, array{customer_number: int, membership_only: true}>
+ */
+private static function summarizePeriodCustomerMemberships(array $customers): array
+{
+    $memberships = [];
+    $seen = [];
+    foreach ($customers as $customer) {
+        if (!is_array($customer)) {
+            continue;
+        }
+        $customerNumber = (int) ($customer['customer_number'] ?? 0);
+        if ($customerNumber < 1 || isset($seen[$customerNumber])) {
+            continue;
+        }
+        $seen[$customerNumber] = true;
+        $memberships[] = [
+            'customer_number' => $customerNumber,
+            'membership_only' => true,
+        ];
+    }
+    return $memberships;
+}
+```
+
+Notes:
+
+* We deduplicate on `customer_number` so a customer appearing twice in a
+  bucket (rare but possible — multiple PO transactions for the same
+  customer in `invoice_per_order`) still only emits one membership.
+* We keep the existing `ensurePeriodTypeKeys` (`array_fill_keys`) guarantees
+  so consumers that iterate `Object.keys(types)` still see every view
+  even when the filtered list ends up empty.
+* The active bucket's structure is **unchanged** — the front-end
+  `customersInCurrentView` and `list_views_with_customer` paths continue to
+  work as before.
+* `type_counts` and `type_totals` are computed before pagination (see
+  `summarizePeriodTypes`) and remain authoritative for tab counters.
+
+### 3.2 OpenAPI specs
+
+Both repositories carry a copy of the schema and must stay in lock-step.
+
+**`/workspace/api/openapi.yaml`** and **`/workspace/pleno-vue/openapi.yaml`**
+
+The current envelope for `InvoicingPeriod` (`types[view]`) is typed via
+`InvoicingPeriodCustomer`, whose `required` list mandates `customer_name`,
+`transactions`, `invoice_collections`. Membership entries don't carry those
+fields, so we need to relax the `required` constraint on non-active buckets
+and document the new shape.
+
+Add a new sibling component:
+
+```yaml
+InvoicingPeriodCustomerMembership:
+  type: object
+  description: >-
+    Lightweight customer marker returned for every non-active view bucket.
+    Used only by the front-end to render category chips (e.g. "Faktura pr.
+    ordre") regardless of which tab is active. Full transaction / queue
+    data is intentionally omitted; see InvoicingPeriodCustomer for the
+    shape returned for the active bucket.
+  additionalProperties: false
+  required: [customer_number, membership_only]
+  properties:
+    customer_number:
+      type: integer
+      minimum: 1
+    membership_only:
+      type: true
+      enum: [true]
+```
+
+In the `InvoicingPeriod` schema, switch the `types` property from
+`additionalProperties: $ref(InvoicingPeriodCustomer)` to:
+
+```yaml
+types:
+  type: object
+  additionalProperties:
+    type: array
+    items:
+      oneOf:
+        - $ref: '#/components/schemas/InvoicingPeriodCustomer'
+        - $ref: '#/components/schemas/InvoicingPeriodCustomerMembership'
+      discriminator:
+        propertyName: membership_only
+```
+
+Also relax `InvoicingPeriodCustomer` so `customer_name`, `transactions`,
+`invoice_collections`, `meta`, `queue`, `draft`, `requires_action` are no
+longer `required` (they remain documented in `properties`). The active
+bucket still emits them, but the union makes the membership shape valid.
+
+### 3.3 Front-end — `/workspace/pleno-vue/src/views/dashboards/superUserDashboard/InvoicingBillingPeriod/displays/layout/InvoicingBillingPeriodCustomerAttributes.vue`
+
+After the backend fix, the chip rendering logic in
+`list_views_with_customer` will start working on every subpage. To keep
+performance bounded when buckets grow large, we also turn the membership
+arrays into `Set<number>` lookups via a small `computed`:
+
+```ts
+const membershipIndexes = computed(() => {
+  const result: Record<string, Set<number>> = {};
+  for (const view_key of view_keys.value) {
+    if (view_key === 'all') continue;
+    const view_type = sharedTypes.value[view_key];
+    if (!Array.isArray(view_type)) {
+      result[view_key] = new Set<number>();
+      continue;
+    }
+    result[view_key] = new Set(
+      view_type
+        .map((entry) => Number(entry?.customer_number ?? 0))
+        .filter((n) => Number.isInteger(n) && n > 0),
+    );
+  }
+  return result;
+});
+
+const list_views_with_customer = computed(() => {
+  const matched = view_keys.value.filter((view_key) => {
+    if (view_key === 'all') return false;
+    return membershipIndexes.value[view_key]?.has(props.customer.customer_number) === true;
+  });
+  …
+});
+```
+
+Behavioural impact:
+
+* Same chip set as today, now visible on every subpage including `Alle`.
+* Lookup is O(1) per (view × customer) instead of O(bucket size).
+* Defensive against the lightweight entries (no `customer_name`,
+  `transactions`, etc. fields) — the chip only needs the view's friendly
+  name, which already comes from `view.computed.getViewFriendlyName(...)`.
+
+### 3.4 Front-end — e2e mock
+
+`tests/e2e/invoicing-period.smoke.spec.js` → `setupPeriodEndpoints`
+(line ~864) currently mocks every bucket as fully populated. Update the
+mock so that:
+
+* The **active** bucket (whichever the page requested) carries full
+  customer cards (unchanged).
+* Every **other** bucket carries membership-only entries
+  (`{customer_number, membership_only: true}`).
+
+This mirrors the real backend so the existing chip-stacking test
+(`tests/e2e/invoicing-period.smoke.spec.js` lines ~2360-2393) actually
+guards the membership path.
+
+---
+
+## 4. Tests to add / update
+
+### 4.1 Backend unit — `/workspace/api/services/nginx/app/tests/Unit/Invoicing/InvoicingPeriodPaginationTest.php`
+
+Existing assertion at line 292:
+
+```php
+expect($result['period']['types']['fixed_pricing'])->toBe([]);
+```
+
+…becomes:
+
+```php
+expect($result['period']['types']['fixed_pricing'])
+    ->toBe(array_map(
+        static fn(int $n): array => ['customer_number' => $n, 'membership_only' => true],
+        [1001], // the test fixture's other-bucket membership
+    ));
+```
+
+Add a new test that, given a period with two customers in `all` and one
+in `invoice_per_order`, paging `periodView=all` yields:
+
+* `types.all` — full customer cards (existing behaviour preserved)
+* `types.invoice_per_order` — one lightweight membership entry
+* `types.fixed_pricing` / `types.tank_cleaning` / etc. — empty arrays (no
+  matching customers, so nothing to emit)
+
+Add a search-aware test: searching for "Beta" while paging
+`periodView=all` must surface the lightweight membership only for
+customers that pass the filter, mirroring the active bucket.
+
+Add a flag-tab-aware test: the `red` flag filter must propagate to the
+membership arrays just as it does to `type_counts`.
+
+### 4.2 Front-end unit — `tests/unit/superuser-invoices-view.spec.js` (or new spec)
+
+Add a focused Vitest spec
+`tests/unit/invoicing-period-customer-attributes.spec.js` that mounts
+`InvoicingBillingPeriodCustomerAttributes` with a stubbed
+`sharedVariables.value.types` containing:
+
+```ts
+{
+  all: [...full cards],
+  invoice_per_order: [{customer_number: 1001, membership_only: true}, …],
+  fixed_pricing: [],
+  …
+}
+```
+
+…and asserts that the rendered chips include "Faktura pr. ordre" (and any
+other categories the stubbed customer is a member of), independent of
+which view tab is "active" in the stub.
+
+### 4.3 E2E — `tests/e2e/invoicing-period.smoke.spec.js`
+
+* Update `setupPeriodEndpoints` (line ~864) so the mock returns
+  membership-only entries for non-active buckets — matching the real
+  backend contract.
+* Extend the existing chip-stacking test (lines ~2360-2393) to assert
+  that on the `Alle` tab the rendered customer cards include the
+  "Faktura pr. ordre" chip, "Fastpris" chip, "Tankrengøring" chip, etc.
+* Add a new spec scenario:
+  `Given: Alle tab with mixed customers across categories. When: page
+  loads. Then: every customer card shows chips for every category it
+  belongs to.` Guarded with `@smoke` so it runs in the PR pipeline.
+
+### 4.4 OpenAPI consistency
+
+Run `node scripts/check-openapi-drift.mjs` (if present) or the equivalent
+script in `scripts/sync-ai-workflow.mjs` to verify that the two
+`openapi.yaml` files remain aligned. If a drift check is not wired up, add
+it so future schema edits surface in CI.
+
+---
+
+## 5. Verification steps (manual + automated)
+
+### 5.1 Manual smoke test (in dev)
+
+1. `bash scripts/setup.sh` (or the appropriate docker compose command) to
+   bring up the API stack.
+2. `cd /workspace/pleno-vue && npm run dev`.
+3. Sign in as a superuser that owns customers spanning multiple categories
+   (fixed_pricing + invoice_per_order, for instance).
+4. Navigate to **Superuser → Fakturaer → Periode**, pick a date range.
+5. On the **Alle** tab confirm every customer card shows every chip it
+   qualifies for.
+6. Click into the **Faktura pr. ordre** tab and confirm the same chips
+   render (sans the active tab's own chip).
+7. Repeat for **Fastpris**, **Tankrengøring**, **Wash Subscriptions**.
+8. Apply the search box; chips should update with the filter.
+9. Toggle the **Kræver handling** flag tab; chips should narrow to the
+   flagged subset.
+10. Switch page sizes (10/25/50/100/200/500/all) and confirm chips remain
+    consistent across pages.
+11. Reload the page — chips must persist from the cache layer
+    (`setCachedPeriodPage`) and not flash empty.
+
+### 5.2 Automated
+
+* Backend unit tests: `bash scripts/php-ci-test.sh unit` (in CI; locally
+  inside `php1` container per `scripts/setup.sh`).
+* Backend static analysis: `composer analyse` (phpstan).
+* Backend rector dry-run: `composer rector:dry-run`.
+* Front-end unit: `npm run test:unit`.
+* Front-end e2e (smoke): `npm run test:e2e:smoke`.
+* Front-end e2e (PR slice): `npm run test:e2e:pr`.
+* Front-end lint: `npm run lint:strict`.
+* AI workflow sync: `node scripts/sync-ai-workflow.mjs --check`.
+
+### 5.3 CI checks to watch
+
+* `.github/workflows/tests.yml` (api) — PHP matrix
+  (`unit`/`integration`/`api`/`legacy`) and Edge Agent job.
+* `.github/workflows/tests.yml` (pleno-vue) — Playwright e2e matrix.
+* `.github/workflows/code_quality.yml` — Qodana scan.
+
+---
+
+## 6. Roll-out plan
+
+1. Branch: cut `fix/invoicing-period-tag-membership` from `master` in
+   `api` and from `pr-296` (current dev branch) in `pleno-vue`.
+2. Backend change (3.1) + new helper + updated/new unit tests (4.1).
+3. OpenAPI updates (3.2) in both repos.
+4. Frontend attribute component (3.3) — add the `Set` index, keep the
+   array `.some()` fallback for back-compat.
+5. E2E mock update (3.4) + extended chip-stacking test (4.3).
+6. Run the full verification suite (5.2) locally before pushing.
+7. Open the PR; CI should turn green; Qodana should not flag the new
+   memberships (they are deliberate additive fields).
+8. After merge, monitor the period page in staging for payload size and
+   chip rendering parity.
+
+---
+
+## 7. Risk assessment
+
+| Risk | Likelihood | Mitigation |
+|---|---|---|
+| Payload bloat from membership entries | Low | Memberships are `{customer_number}` only — ~30 KB per bucket at 1000 customers. |
+| Frontend perf regression on huge pages | Low | `Set`-based membership index in `InvoicingBillingPeriodCustomerAttributes` makes lookup O(1). |
+| OpenAPI drift between repos | Medium | Existing `sync-ai-workflow.mjs` check + new schema explicitly documents the `oneOf` shape. |
+| Cache returning stale (pre-fix) data | Low | Cache TTL is 10 min (`PERIOD_CACHE_TTL_MS`); a reload or hard refresh clears it. No schema-driven cache busting required for this change. |
+| Active bucket inadvertently slimmed | Low | Active bucket code path is untouched; existing `customersInCurrentView` consumers keep working. |
+
+---
+
+## 8. Files touched (summary)
+
+**Backend (`/workspace/api`):**
+
+* `services/nginx/app/routes/InvoicingPeriodRoute.php` — add
+  `summarizePeriodCustomerMemberships`, populate non-active buckets.
+* `services/nginx/app/tests/Unit/Invoicing/InvoicingPeriodPaginationTest.php`
+  — relax line 292, add membership / search / flag-tab tests.
+* `openapi.yaml` — add `InvoicingPeriodCustomerMembership`, relax
+  `InvoicingPeriodCustomer` requireds, union-typed `types` items.
+
+**Front-end (`/workspace/pleno-vue`):**
+
+* `src/views/dashboards/superUserDashboard/InvoicingBillingPeriod/displays/layout/InvoicingBillingPeriodCustomerAttributes.vue`
+  — `Set`-based membership index.
+* `tests/unit/invoicing-period-customer-attributes.spec.js` — new spec.
+* `tests/e2e/invoicing-period.smoke.spec.js` — mock reflects real backend
+  shape, extended chip-stacking assertions.
+* `openapi.yaml` — mirror backend schema edits.

docs/mobile-artifacts.md

@@ -1,35 +1,25 @@
-# Mobile Store Artifacts
+# Mobile Store Delivery
 
-The `Mobile Store Artifacts` workflow builds signed Android and iOS store artifacts from the Vue/Vite web app through Capacitor, then uploads them to Google Play and App Store Connect by default.
+Android and iOS delivery are intentionally independent. An iOS release or tag
+must never publish an Android production artifact.
 
-Use the Capacitor project under `android/` for the Google Play Store package. The Bubblewrap/TWA files at the repository root are not the path used by `mobile:android:bundle`.
+## Android
 
-## Triggers
+`Android Store Artifacts` remains in
+`.github/workflows/mobile-artifacts.yml`. It builds the Capacitor Android package
+`io.truckwash.twa` and supports:
 
-- Manual: run `Mobile Store Artifacts` from GitHub Actions and optionally provide `version_name`, `version_code`, upload toggles, and Android track/status overrides.
-- Tag: push a tag named `mobile-vX.Y.Z`; the workflow uses `X.Y.Z` as the store version name.
-- Automatic store upload: after the `Automated Tests` workflow completes successfully on current `master`, GitHub Actions builds signed Android and iOS artifacts from that tested commit and uploads them to the stores.
-- Stale workflow-run protection: if a newer commit reaches `master` before the mobile workflow runs, both store-upload jobs skip the stale commit.
+- Automatic delivery after successful current-master `Automated Tests`, with
+  all six full Chromium-mobile role shards explicitly verified as green.
+- Manual dispatch with version, version code, upload toggle, track, and status.
+- Existing `mobile-v*` tags for the Android workflow.
 
-Default upload behavior:
+Every Google Play upload path must resolve an exact completed `Automated Tests`
+push run for the same current-master commit. Manual no-upload artifact builds
+remain available for safe CI validation without invoking the store gate.
 
-- Android uploads package `io.truckwash.twa` to the Google Play `production` track with release status `completed`.
-- iOS uploads bundle `io.truckwash.app` to App Store Connect for TestFlight/App Review processing. Public App Store release still depends on App Store Connect review and release settings.
-- Manual dispatch can disable either upload path while still producing signed GitHub artifacts.
-
-## Required Secrets
-
-Store secrets are expected in the GitHub environment `mobile-store-production`.
-
-Non-secret environment variables:
-
-- `ANDROID_PACKAGE_NAME=io.truckwash.twa`
-- `ANDROID_AAB_PATH=android/app/build/outputs/bundle/release/app-release.aab`
-- `PLAY_STORE_TRACK=production`
-- `PLAY_STORE_RELEASE_STATUS=completed`
-- `PLAY_STORE_USER_FRACTION` only when using `PLAY_STORE_RELEASE_STATUS=inProgress`
-
-Android:
+The Android job continues using GitHub environment `mobile-store-production`.
+Its required secrets are:
 
 - `ANDROID_KEYSTORE_BASE64`
 - `ANDROID_KEYSTORE_PASSWORD`
@@ -37,75 +27,48 @@ Android:
 - `ANDROID_KEY_PASSWORD`
 - `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64`
 
-iOS:
+Its variables are `ANDROID_PACKAGE_NAME`, `ANDROID_AAB_PATH`,
+`PLAY_STORE_TRACK`, `PLAY_STORE_RELEASE_STATUS`, and optional
+`PLAY_STORE_USER_FRACTION`. See the Google Play Console runbook for production
+track policy.
 
-- `IOS_CERTIFICATE_BASE64`
-- `IOS_CERTIFICATE_PASSWORD`
-- `IOS_PROVISION_PROFILE_BASE64`
-- `IOS_KEYCHAIN_PASSWORD`
-- `APPLE_TEAM_ID`
-- `APP_STORE_CONNECT_API_KEY_ID`
-- `APP_STORE_CONNECT_ISSUER_ID`
-- `APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64`
+## iOS
 
-The Google Play secret is a base64-encoded service-account JSON file with Android Publisher API access to the Play Console app. The App Store Connect private key secret is the base64-encoded `.p8` API key file.
+iOS uses three separate workflows:
 
-## Local Checks
+- `iOS Internal TestFlight`: exact verified master release to signed internal
+  TestFlight build.
+- `iOS App Store Candidate`: protected `ios-vX.Y.Z` tag to exact-build
+  storefront candidate, without rebuilding or submission.
+- `iOS Credential Health`: weekly identity, access, and expiry preflight.
 
-Run the native permission validation after changing Capacitor, native manifests, or store metadata:
+Before signing or uploading to TestFlight, the workflow resolves the exact
+current-master test run and requires all six full WebKit-mobile role shards to
+be green. App Store candidates reuse that gated TestFlight build and do not
+rebuild it.
+
+The GitHub environments and variables are documented in
+`docs/app-store-release.md`. The repository-level
+`APP_STORE_AUTOMATION_ENABLED` variable gates all access to them and must remain
+`false` until the signed credential canary is approved.
+
+Local source/storefront checks:
 
 ```sh
 npm run mobile:permissions:check
+npm run mobile:ios:storefront:check
 ```
 
-Build a local unsigned Android App Bundle for packaging verification:
+Strict candidate asset check:
 
 ```sh
-npm run mobile:android:bundle:unsigned
+npm run mobile:ios:storefront:check-strict
 ```
 
-Build a signed Play Console upload bundle after exporting the Android upload-key variables:
+Version identity is deliberately different between platforms:
 
-```sh
-export ANDROID_KEYSTORE_FILE=/path/to/upload-key.jks
-export ANDROID_KEYSTORE_PASSWORD=...
-export ANDROID_KEY_ALIAS=...
-export ANDROID_KEY_PASSWORD=...
-npm run mobile:android:bundle
-```
+- Android package: `io.truckwash.twa`
+- iOS App Store bundle: `io.truckwash.app`
 
-The signed Android bundle is written to:
-
-```text
-android/app/build/outputs/bundle/release/app-release.aab
-```
-
-Upload a locally built signed App Bundle to Google Play after exporting the Play service-account secret and release metadata:
-
-```sh
-export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64=...
-export ANDROID_PACKAGE_NAME=io.truckwash.twa
-export ANDROID_AAB_PATH=android/app/build/outputs/bundle/release/app-release.aab
-export MOBILE_VERSION_NAME=1.4.0
-export MOBILE_VERSION_CODE=10400
-export PLAY_STORE_TRACK=production
-export PLAY_STORE_RELEASE_STATUS=completed
-npm run mobile:android:play-upload
-```
-
-Use `PLAY_STORE_RELEASE_STATUS=inProgress` only with `PLAY_STORE_USER_FRACTION` set to a value greater than `0` and less than `1`.
-
-Android artifacts use package id `io.truckwash.twa`. iOS artifacts use bundle id `io.truckwash.app`.
-
-The Android project currently targets SDK 36. Google Play requires new apps and updates to target Android 15/API 35 or higher starting August 31, 2025: https://developer.android.com/google/play/requirements/target-sdk
-
-Play Store graphics are generated in the workspace-level `playstoregraphics/` folder:
-
-- App icon: `playstoregraphics/universal/app-icon/truck-wash-icon-512.png`
-- Feature graphic: `playstoregraphics/universal/feature-graphic/truck-wash-feature-1024x500.jpg`
-- Phone screenshots: `playstoregraphics/phone/screenshots/`
-- 7-inch tablet screenshots: `playstoregraphics/tablet-7/screenshots/`
-- 10-inch tablet screenshots: `playstoregraphics/tablet-10/screenshots/`
-- Chromebook screenshots: `playstoregraphics/chromebook/screenshots/`
-
-The native manifests declare camera and foreground location access for the store binaries. Keep the App Store Connect and Play Console privacy questionnaires aligned with the app's actual camera and location data handling before submitting a release.
+The iOS release build verifies the final signed IPA rather than relying on the
+Capacitor `appId`, which remains the Android package identifier.

docs/pr-previews/a0edd464-44c0-4d77-96c1-d3562496a1b7/visual-evidence.json

@@ -0,0 +1,85 @@
+{
+  "schemaVersion": 1,
+  "kind": "VisualEvidenceManifest",
+  "taskId": "a0edd464-44c0-4d77-96c1-d3562496a1b7",
+  "repository": "copenhagentruckwash/pleno-vue",
+  "baseSha": "eee9ba1c138f0c88c772ea284a5a97a46cb9412c",
+  "subjectSha": "89dec2c5690f9eaf1e0e34651bb40b7f441b85fb",
+  "views": [
+    {
+      "id": "invoicing-period-review",
+      "name": "Superuser invoice period review workspace",
+      "description": "Replaces the long mixed invoice-period page with grouped review navigation, compact totals, explicit review filters, and a responsive master-detail workspace while preserving every invoice category and action.",
+      "route": "/superuser/invoices?activeTab=period&startDate=2026-07-01&endDate=2026-07-31&periodView=all",
+      "fixture": "Synthetic superuser invoice-period fixture with three fictional customers and no production data",
+      "comparisons": {
+        "mobile": {
+          "width": 390,
+          "height": 844,
+          "before": {
+            "path": "docs/pr-previews/a0edd464-44c0-4d77-96c1-d3562496a1b7/invoicing-period/before-mobile.png",
+            "sha256": "b3c25c072f45e912358cc61d21577bbf61d5216b114a6911f900ca19b90d477e",
+            "bytes": 28914,
+            "width": 390,
+            "height": 844,
+            "mimeType": "image/png",
+            "alt": "Invoice period mobile view before the review workspace redesign"
+          },
+          "after": {
+            "path": "docs/pr-previews/a0edd464-44c0-4d77-96c1-d3562496a1b7/invoicing-period/after-mobile.png",
+            "sha256": "257db0e6e295b6b13ba5d0b29509c2a8b7170244ad6539a8e2ff18d2c9c0ffba",
+            "bytes": 31339,
+            "width": 390,
+            "height": 844,
+            "mimeType": "image/png",
+            "alt": "Invoice period mobile view after the review workspace redesign"
+          }
+        },
+        "tablet": {
+          "width": 768,
+          "height": 1024,
+          "before": {
+            "path": "docs/pr-previews/a0edd464-44c0-4d77-96c1-d3562496a1b7/invoicing-period/before-tablet.png",
+            "sha256": "8cd17ea1e384ab6a9711a643d4e50e971cabcf704c3672d8f90cb2f5f2d36ba0",
+            "bytes": 38508,
+            "width": 768,
+            "height": 1024,
+            "mimeType": "image/png",
+            "alt": "Invoice period tablet view before the review workspace redesign"
+          },
+          "after": {
+            "path": "docs/pr-previews/a0edd464-44c0-4d77-96c1-d3562496a1b7/invoicing-period/after-tablet.png",
+            "sha256": "1c627c30ade435ee004b8cdcd0223022594a351658639edec1f6e5396efaba18",
+            "bytes": 46062,
+            "width": 768,
+            "height": 1024,
+            "mimeType": "image/png",
+            "alt": "Invoice period tablet view after the review workspace redesign"
+          }
+        },
+        "desktop": {
+          "width": 1440,
+          "height": 900,
+          "before": {
+            "path": "docs/pr-previews/a0edd464-44c0-4d77-96c1-d3562496a1b7/invoicing-period/before-desktop.png",
+            "sha256": "849ea0eedabc7f1e52172e26602cddfddbeed32c91d04672dfe8b713343a54fa",
+            "bytes": 142738,
+            "width": 1440,
+            "height": 900,
+            "mimeType": "image/png",
+            "alt": "Invoice period desktop view before the review workspace redesign"
+          },
+          "after": {
+            "path": "docs/pr-previews/a0edd464-44c0-4d77-96c1-d3562496a1b7/invoicing-period/after-desktop.png",
+            "sha256": "d026925bc4f6ced62686ae7f8252594e3a3fe9bd559a7f53f38a1bfcb0b96892",
+            "bytes": 108740,
+            "width": 1440,
+            "height": 900,
+            "mimeType": "image/png",
+            "alt": "Invoice period desktop view after the review workspace redesign"
+          }
+        }
+      }
+    }
+  ]
+}

docs/pr-previews/customer-subuser-notifier/README.md

@@ -0,0 +1,26 @@
+# Customer and subuser lifecycle visual comparisons
+
+## Forgot-password account selection
+
+The reset page previously accepted only a customer number. It now lets the
+visitor choose a customer or chauffeur account. Chauffeur recovery uses the
+country code and phone number and sends the one-time reset link by SMS.
+
+- Mobile: [before](before-mobile.png) / [after](after-mobile.png)
+- Tablet: [before](before-tablet.png) / [after](after-tablet.png)
+- Desktop: [before](before-desktop.png) / [after](after-desktop.png)
+
+## Pre-authorized customer access decision
+
+The SMS link previously had no destination view. It now opens a read-only
+request preview, identifies the chauffeur and customer, and requires an
+explicit approve or deny action before the one-time token mutates access.
+
+- Mobile: [before](access-before-mobile.png) / [after](access-after-mobile.png)
+- Tablet: [before](access-before-tablet.png) / [after](access-after-tablet.png)
+- Desktop: [before](access-before-desktop.png) / [after](access-after-desktop.png)
+
+The related signed-in profile and customer grant selector use the same
+responsive components. The selector is deduplicated by customer number and
+uses colored permission indicators for vehicles, tools, calendar, orders,
+and driver access.

docs/pr-previews/fix-automatic-cron-execution/README.md

@@ -0,0 +1,28 @@
+# Automatic cron execution visual comparison
+
+The Cron workers panel now exposes machine-verifiable scheduler cadence.
+The summary reports how many active workers have maintained the required
+once-per-minute cadence, and each worker row shows its latest loop gap and
+consecutive qualifying loops.
+
+A worker is verified only after two consecutive loops, with no gap above
+60 seconds, while the worker is running and its latest observation is no more
+than 60 seconds old.
+
+## Mobile
+
+- [Before](before-mobile.png)
+- [After](after-mobile.png)
+
+## Tablet
+
+- [Before](before-tablet.png)
+- [After](after-tablet.png)
+
+## Desktop
+
+- [Before](before-desktop.png)
+- [After](after-desktop.png)
+
+The updated state tags use explicit foreground colors so success and warning
+labels remain readable against their backgrounds.

docs/pr-previews/stripe-cleanup/README.md

@@ -0,0 +1,48 @@
+# Stripe cleanup visual evidence
+
+Authentic browser captures compare `origin/master` at
+`fd31609cb379cda36fb16ef7077fc9db3c91eb2b` with the feature at
+`6e795b253062606e6122cc7e630e17651b9b7efd`.
+
+Both revisions were rendered by their own Vite applications and exercised with
+the repository's mocked Playwright API support. No production API, Stripe
+account, or product-source modification was used to create the evidence.
+
+## Regular POS card-payment view
+
+The baseline identifies the integration as Stripe and offers an email payment.
+The feature uses provider-neutral card-terminal wording and removes the hosted
+email-payment action while preserving terminal payment.
+
+| Device | Before | After |
+| --- | --- | --- |
+| Mobile | [Before](before-pos-card-payment-mobile.png) | [After](after-pos-card-payment-mobile.png) |
+| Tablet | [Before](before-pos-card-payment-tablet.png) | [After](after-pos-card-payment-tablet.png) |
+| Desktop | [Before](before-pos-card-payment-desktop.png) | [After](after-pos-card-payment-desktop.png) |
+
+## Authorized payment capture
+
+Both revisions receive a mocked payment intent in `requires_capture` state. The
+baseline exposes a manual capture action. The feature automatically issues the
+capture request and shows its in-progress state without a second manual action.
+
+| Device | Before | After |
+| --- | --- | --- |
+| Mobile | [Before](before-payment-capture-mobile.png) | [After](after-payment-capture-mobile.png) |
+| Tablet | [Before](before-payment-capture-tablet.png) | [After](after-payment-capture-tablet.png) |
+| Desktop | [Before](before-payment-capture-desktop.png) | [After](after-payment-capture-desktop.png) |
+
+## Order-dashboard action rail
+
+The baseline action rail includes the hosted Stripe invoice/payment-link
+action. The feature removes it while preserving receipts, ordinary order
+completion, and navigation.
+
+| Device | Before | After |
+| --- | --- | --- |
+| Mobile | [Before](before-order-dashboard-mobile.png) | [After](after-order-dashboard-mobile.png) |
+| Tablet | [Before](before-order-dashboard-tablet.png) | [After](after-order-dashboard-tablet.png) |
+| Desktop | [Before](before-order-dashboard-desktop.png) | [After](after-order-dashboard-desktop.png) |
+
+All nine paired states passed their relevant DOM assertions across Chromium
+mobile, tablet, and desktop projects.

docs/pr-previews/workboard-94209138-31f6-422e-ac8c-181ad391b8a7/visual-evidence-manifest.json

@@ -0,0 +1,49 @@
+{
+  "kind": "VisualEvidenceManifestV1",
+  "taskId": "workboard-94209138-31f6-422e-ac8c-181ad391b8a7",
+  "view": "POS extra sale audit",
+  "files": [
+    {
+      "device": "mobile",
+      "state": "before",
+      "path": "docs/pr-previews/workboard-94209138-31f6-422e-ac8c-181ad391b8a7/pos-extra-sale-audit-mobile-before.png",
+      "width": 390,
+      "height": 844
+    },
+    {
+      "device": "mobile",
+      "state": "after",
+      "path": "docs/pr-previews/workboard-94209138-31f6-422e-ac8c-181ad391b8a7/pos-extra-sale-audit-mobile-after.png",
+      "width": 390,
+      "height": 844
+    },
+    {
+      "device": "tablet",
+      "state": "before",
+      "path": "docs/pr-previews/workboard-94209138-31f6-422e-ac8c-181ad391b8a7/pos-extra-sale-audit-tablet-before.png",
+      "width": 768,
+      "height": 1024
+    },
+    {
+      "device": "tablet",
+      "state": "after",
+      "path": "docs/pr-previews/workboard-94209138-31f6-422e-ac8c-181ad391b8a7/pos-extra-sale-audit-tablet-after.png",
+      "width": 768,
+      "height": 1024
+    },
+    {
+      "device": "desktop",
+      "state": "before",
+      "path": "docs/pr-previews/workboard-94209138-31f6-422e-ac8c-181ad391b8a7/pos-extra-sale-audit-desktop-before.png",
+      "width": 1440,
+      "height": 900
+    },
+    {
+      "device": "desktop",
+      "state": "after",
+      "path": "docs/pr-previews/workboard-94209138-31f6-422e-ac8c-181ad391b8a7/pos-extra-sale-audit-desktop-after.png",
+      "width": 1440,
+      "height": 900
+    }
+  ]
+}

docs/pr-previews/xlvask-autopilot-20260803/visual-evidence.json

@@ -0,0 +1,85 @@
+{
+  "schemaVersion": 1,
+  "kind": "VisualEvidenceManifest",
+  "taskId": "xlvask-autopilot-20260803",
+  "repository": "copenhagentruckwash/pleno-vue",
+  "baseSha": "f995440098f9e3f3b5ff122a55c8c4e018cc716e",
+  "subjectSha": "d5c291e6f7f81d6992aa63375d77521c2983f8e5",
+  "views": [
+    {
+      "id": "invoice-period-self-wash",
+      "name": "Invoice period XL-Vask autopilot",
+      "description": "Shows the previous self-wash import beside the new state-separated, evidence-led autopilot review workspace.",
+      "route": "/superuser/invoices?tab=period&periodView=self_wash&startDate=2026-03-01&endDate=2026-03-31",
+      "fixture": "Playwright mocked March 2026 invoice period with one uncertain match and one failed match",
+      "comparisons": {
+        "mobile": {
+          "width": 1081,
+          "height": 1999,
+          "before": {
+            "path": "docs/pr-previews/xlvask-autopilot-20260803/invoice-period-self-wash/before-mobile.png",
+            "sha256": "8c67915dd48847ef553db32f3fc2481e58af7490dab9a41c49728003b84df5a7",
+            "bytes": 141379,
+            "width": 1081,
+            "height": 1999,
+            "mimeType": "image/png",
+            "alt": "Mobile self-wash period import before the autopilot review workspace"
+          },
+          "after": {
+            "path": "docs/pr-previews/xlvask-autopilot-20260803/invoice-period-self-wash/after-mobile.png",
+            "sha256": "02b5d6560566350cbf702ff995602084a70ffdda13290c3754438885c3730a20",
+            "bytes": 142027,
+            "width": 1081,
+            "height": 1999,
+            "mimeType": "image/png",
+            "alt": "Mobile XL-Vask autopilot summary, filters, and visible review states"
+          }
+        },
+        "tablet": {
+          "width": 1536,
+          "height": 2048,
+          "before": {
+            "path": "docs/pr-previews/xlvask-autopilot-20260803/invoice-period-self-wash/before-tablet.png",
+            "sha256": "5a20daa875e211e1bfbfdd4e17282956720954ce14a9e76f1002b1355f795dd4",
+            "bytes": 179803,
+            "width": 1536,
+            "height": 2048,
+            "mimeType": "image/png",
+            "alt": "Tablet self-wash period import before the autopilot review workspace"
+          },
+          "after": {
+            "path": "docs/pr-previews/xlvask-autopilot-20260803/invoice-period-self-wash/after-tablet.png",
+            "sha256": "1916b97a6d3f7c0084130b3514fe67b5a8f729e23bca37c1ad5c7ed75f821d44",
+            "bytes": 198536,
+            "width": 1536,
+            "height": 2048,
+            "mimeType": "image/png",
+            "alt": "Tablet XL-Vask autopilot summary, filters, rows, and pagination"
+          }
+        },
+        "desktop": {
+          "width": 1280,
+          "height": 720,
+          "before": {
+            "path": "docs/pr-previews/xlvask-autopilot-20260803/invoice-period-self-wash/before-desktop.png",
+            "sha256": "617095bcb916dd2f25b5cd0e8d77e7b0b05f1b5db662aeb810b52d606bcbe0af",
+            "bytes": 94026,
+            "width": 1280,
+            "height": 720,
+            "mimeType": "image/png",
+            "alt": "Desktop self-wash period import before the autopilot review workspace"
+          },
+          "after": {
+            "path": "docs/pr-previews/xlvask-autopilot-20260803/invoice-period-self-wash/after-desktop.png",
+            "sha256": "dd33f7e07ca426ee63c4708d9994e2403375bae9a86c119d0d296f52e5e90a9a",
+            "bytes": 117715,
+            "width": 1280,
+            "height": 720,
+            "mimeType": "image/png",
+            "alt": "Desktop XL-Vask autopilot summary and state-separated review rows"
+          }
+        }
+      }
+    }
+  ]
+}