From 5f0c4079793618c4031bcc6c401fc7426ed6ce03 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sat, 10 Oct 2026 15:21:37 -0300
Subject: [PATCH 01/17] refactor(frontend): remove the SaaS layer from the
 dashboard

Thinker is self-hosted only, so the inherited Manifest Cloud UI goes.
The frontend leaves first so no screen breaks when #14/#15 drop the
matching backend endpoints.

- Billing/plans: delete PlanPicker, UpgradeSuccessModal,
  UsageLimitBanner, the /upgrade page, the Register ?step=plan picker,
  the plan stores, the plan-based range locks on the analytics pages,
  the plan-limit upgrade CTAs in the request views, the Account billing
  and usage-email sections, and the @better-auth/stripe client plugin
  and dependency.
- API Bot: delete the banner, the sidebar card, the dithered ground,
  their stylesheet and the SVG asset.
- GitHub stars: drop the header star button and its /api/v1/github call.
- Free Models: delete the page, its route, its API client and the assets
  only it used.
- Managed Gemini Free: drop the provider entry, icon alias, background
  /ensure provisioning call and the Calendly key URL.
- Cloud branches: checkIsSelfHosted() is gone and every screen behaves
  as self-hosted (Local providers always listed, local logs copy, CLI
  login pinned to this host, discovery after signup and setup). Drop the
  Manifest Cloud origin mapping, the cloud email card, the
  VITE_MANIFEST_SELFHOSTED read and the Dockerfile ENV that set it.
- Help: drop the Manifest Calendly booking link.
- Remove the dead CSS for all of the above, update the tests and the
  inherited dev guide.

Closes #12

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 design-system/registry/components.json        | 429 ++----------
 design-system/registry/llms.txt               | 130 ++--
 docker/Dockerfile                             |   3 -
 docs/dev/manifest-guide.md                    |   6 +-
 package-lock.json                             |  17 -
 packages/frontend/package.json                |   1 -
 .../public/api-bot-works-with-any-api.svg     | 612 ------------------
 packages/frontend/public/icons/caret-down.svg |   1 -
 .../public/icons/cerebras-dark-mode.svg       |   1 -
 .../public/icons/github-dark-mode.svg         |   1 -
 .../public/icons/ollama-dark-mode.svg         |   1 -
 .../frontend/public/icons/zai-dark-mode.svg   |   1 -
 packages/frontend/src/App.tsx                 |   4 -
 .../frontend/src/components/AddAgentModal.tsx |  20 +-
 .../src/components/ApiBotAnnouncement.tsx     |  60 --
 .../frontend/src/components/ApiBotBanner.tsx  |  55 --
 .../frontend/src/components/AuthGuard.tsx     |  49 +-
 .../src/components/CloudEmailInfo.tsx         |  24 -
 .../src/components/CustomProviderForm.tsx     |  20 +-
 .../frontend/src/components/DitherGround.tsx  |  11 -
 .../src/components/EmailProviderSection.tsx   |   2 +-
 .../frontend/src/components/GuestGuard.tsx    |   6 -
 packages/frontend/src/components/Header.tsx   | 126 +---
 .../src/components/MessageDetails.tsx         |  22 +-
 .../src/components/ModelPickerModal.tsx       |   2 +-
 .../src/components/NoConnectionsPrompt.tsx    |  42 +-
 .../frontend/src/components/PlanPicker.tsx    | 187 ------
 .../frontend/src/components/ProviderIcon.tsx  |   1 -
 .../src/components/ProviderSelectContent.tsx  |   9 +-
 packages/frontend/src/components/Sidebar.tsx  | 106 +--
 .../src/components/UpgradeSuccessModal.tsx    |  81 ---
 .../src/components/UsageLimitBanner.tsx       | 103 ---
 .../src/components/VersionIndicator.tsx       |   7 +-
 .../src/components/message-table-cells.tsx    |  30 +-
 packages/frontend/src/index.tsx               |  12 +-
 packages/frontend/src/pages/Account.tsx       | 226 +------
 packages/frontend/src/pages/Discovery.tsx     |  20 +-
 packages/frontend/src/pages/FreeModels.tsx    | 379 -----------
 .../frontend/src/pages/GlobalOverview.tsx     |  82 +--
 packages/frontend/src/pages/Help.tsx          |  40 +-
 packages/frontend/src/pages/Limits.tsx        |  46 +-
 packages/frontend/src/pages/MessageLog.tsx    |  39 +-
 packages/frontend/src/pages/Overview.tsx      |  55 +-
 packages/frontend/src/pages/Register.tsx      | 325 ++++------
 .../src/pages/SettingsRecordingSection.tsx    |  11 +-
 packages/frontend/src/pages/Setup.tsx         |  14 +-
 packages/frontend/src/pages/Upgrade.tsx       | 374 -----------
 packages/frontend/src/pages/Welcome.tsx       |  77 +--
 .../frontend/src/pages/integrations/Cli.tsx   |  27 +-
 .../src/pages/providers/ConnectionDetail.tsx  |  29 +-
 .../frontend/src/pages/providers/Local.tsx    |  22 +-
 packages/frontend/src/services/api.ts         |   1 -
 .../frontend/src/services/api/analytics.ts    |  71 +-
 packages/frontend/src/services/api/billing.ts |  33 -
 packages/frontend/src/services/api/core.ts    |   5 +-
 .../frontend/src/services/api/free-models.ts  |  32 -
 .../frontend/src/services/api/providers.ts    |  64 +-
 packages/frontend/src/services/auth-client.ts |  17 +-
 .../frontend/src/services/auth-redirects.ts   |   6 +-
 .../frontend/src/services/billing-display.ts  |  31 -
 packages/frontend/src/services/discovery.ts   |  29 -
 .../frontend/src/services/dither-ground.ts    | 169 -----
 packages/frontend/src/services/formatters.ts  |   1 -
 .../src/services/install-endpoints.ts         |  13 +-
 .../src/services/message-error-taxonomy.ts    |  15 -
 .../frontend/src/services/plan-range-lock.ts  |  30 -
 .../frontend/src/services/plan-selection.ts   |  25 -
 packages/frontend/src/services/plan-store.ts  |  66 --
 .../src/services/provider-api-key-urls.ts     |  13 +-
 packages/frontend/src/services/providers.ts   |   6 -
 .../frontend/src/services/setup-status.ts     |   9 -
 packages/frontend/src/styles/agents.css       | 375 -----------
 packages/frontend/src/styles/api-bot.css      | 195 ------
 packages/frontend/src/styles/auth.css         | 176 -----
 packages/frontend/src/styles/controls.css     | 133 ----
 .../frontend/src/styles/custom-select.css     |  17 -
 packages/frontend/src/styles/data.css         |  96 ---
 packages/frontend/src/styles/modals.css       | 186 ------
 .../frontend/src/styles/notifications.css     |  30 -
 packages/frontend/src/styles/theme.css        |  13 +-
 .../tests/components/AddAgentModal.test.tsx   |  22 +-
 .../components/ApiBotAnnouncement.test.tsx    |  42 --
 .../tests/components/ApiBotBanner.test.tsx    |  44 --
 .../frontend/tests/components/App.test.tsx    |   4 -
 .../tests/components/AuthGuard.test.tsx       |  96 +--
 .../tests/components/CloudEmailInfo.test.tsx  |  26 -
 .../components/CustomProviderForm.test.tsx    |  14 +-
 .../tests/components/GuestGuard.test.tsx      |  26 +-
 .../frontend/tests/components/Header.test.tsx | 179 +----
 .../frontend/tests/components/Help.test.tsx   |  42 +-
 .../tests/components/MessageDetails.test.tsx  |   9 +-
 .../components/MessageTableStatus.test.tsx    |   6 +-
 .../components/NoConnectionsPrompt.test.tsx   |  46 +-
 .../tests/components/PlanPicker.test.tsx      |  71 --
 .../components/PlaygroundEmptyState.test.tsx  |   4 -
 .../tests/components/ProviderIcon.test.tsx    |   1 -
 ...derSelectContent-copilot-accounts.test.tsx |   4 -
 .../ProviderSelectContent-deeplink.test.tsx   |   1 -
 .../components/ProviderSelectContent.test.tsx |   1 -
 .../components/ProviderSelectModal.test.tsx   |   1 -
 .../tests/components/Sidebar.test.tsx         | 120 +---
 .../tests/components/SocialButtons.test.tsx   |  17 +-
 .../components/UpgradeSuccessModal.test.tsx   |  36 --
 .../components/UsageLimitBanner.test.tsx      | 125 ----
 .../components/VersionIndicator.test.tsx      |  30 +-
 .../frontend/tests/pages/Account.test.tsx     | 311 +--------
 .../tests/pages/AgentProviders.test.tsx       |   8 -
 packages/frontend/tests/pages/Cli.test.tsx    |  63 +-
 .../frontend/tests/pages/Discovery.test.tsx   |  31 +-
 .../frontend/tests/pages/FreeModels.test.tsx  | 359 ----------
 .../tests/pages/GlobalOverviewFilter.test.tsx |  43 --
 .../tests/pages/Limits-interactions.test.tsx  |   6 -
 packages/frontend/tests/pages/Limits.test.tsx |  50 +-
 packages/frontend/tests/pages/Login.test.tsx  |  45 +-
 .../frontend/tests/pages/McpServer.test.tsx   |   8 +-
 .../frontend/tests/pages/MessageLog.test.tsx  |  21 +-
 .../frontend/tests/pages/Overview.test.tsx    |  24 +-
 .../pages/ProviderOverviewPages.test.tsx      |  40 +-
 .../tests/pages/ProviderPages.test.tsx        |  22 -
 .../frontend/tests/pages/Register.test.tsx    | 211 +-----
 .../pages/SettingsRecordingSection.test.tsx   |  24 +-
 packages/frontend/tests/pages/Setup.test.tsx  |  17 +-
 .../frontend/tests/pages/Upgrade.test.tsx     | 234 -------
 .../frontend/tests/services/api-extra.test.ts |  11 -
 .../tests/services/api/billing.test.ts        | 109 ----
 .../tests/services/api/providers.test.ts      |  82 +--
 .../tests/services/auth-client.test.ts        |  27 +-
 .../tests/services/auth-redirects.test.ts     |  44 +-
 .../tests/services/billing-display.test.ts    |  49 --
 .../frontend/tests/services/discovery.test.ts |  37 --
 .../tests/services/dither-ground.test.ts      | 207 ------
 .../tests/services/formatters.test.ts         |   1 -
 .../services/message-error-taxonomy.test.ts   |  45 --
 .../tests/services/plan-range-lock.test.ts    |  80 ---
 .../tests/services/plan-selection.test.ts     |  42 --
 .../tests/services/plan-store.test.ts         |  76 ---
 .../frontend/tests/services/providers.test.ts |  11 +-
 .../tests/services/setup-status.test.ts       |  46 +-
 .../tests/services/use-overview-range.test.ts |   6 -
 139 files changed, 596 insertions(+), 8566 deletions(-)
 delete mode 100644 packages/frontend/public/api-bot-works-with-any-api.svg
 delete mode 100644 packages/frontend/public/icons/caret-down.svg
 delete mode 100644 packages/frontend/public/icons/cerebras-dark-mode.svg
 delete mode 100644 packages/frontend/public/icons/github-dark-mode.svg
 delete mode 100644 packages/frontend/public/icons/ollama-dark-mode.svg
 delete mode 100644 packages/frontend/public/icons/zai-dark-mode.svg
 delete mode 100644 packages/frontend/src/components/ApiBotAnnouncement.tsx
 delete mode 100644 packages/frontend/src/components/ApiBotBanner.tsx
 delete mode 100644 packages/frontend/src/components/CloudEmailInfo.tsx
 delete mode 100644 packages/frontend/src/components/DitherGround.tsx
 delete mode 100644 packages/frontend/src/components/PlanPicker.tsx
 delete mode 100644 packages/frontend/src/components/UpgradeSuccessModal.tsx
 delete mode 100644 packages/frontend/src/components/UsageLimitBanner.tsx
 delete mode 100644 packages/frontend/src/pages/FreeModels.tsx
 delete mode 100644 packages/frontend/src/pages/Upgrade.tsx
 delete mode 100644 packages/frontend/src/services/api/billing.ts
 delete mode 100644 packages/frontend/src/services/api/free-models.ts
 delete mode 100644 packages/frontend/src/services/billing-display.ts
 delete mode 100644 packages/frontend/src/services/dither-ground.ts
 delete mode 100644 packages/frontend/src/services/message-error-taxonomy.ts
 delete mode 100644 packages/frontend/src/services/plan-range-lock.ts
 delete mode 100644 packages/frontend/src/services/plan-selection.ts
 delete mode 100644 packages/frontend/src/services/plan-store.ts
 delete mode 100644 packages/frontend/src/styles/api-bot.css
 delete mode 100644 packages/frontend/tests/components/ApiBotAnnouncement.test.tsx
 delete mode 100644 packages/frontend/tests/components/ApiBotBanner.test.tsx
 delete mode 100644 packages/frontend/tests/components/CloudEmailInfo.test.tsx
 delete mode 100644 packages/frontend/tests/components/PlanPicker.test.tsx
 delete mode 100644 packages/frontend/tests/components/UpgradeSuccessModal.test.tsx
 delete mode 100644 packages/frontend/tests/components/UsageLimitBanner.test.tsx
 delete mode 100644 packages/frontend/tests/pages/FreeModels.test.tsx
 delete mode 100644 packages/frontend/tests/pages/Upgrade.test.tsx
 delete mode 100644 packages/frontend/tests/services/api/billing.test.ts
 delete mode 100644 packages/frontend/tests/services/billing-display.test.ts
 delete mode 100644 packages/frontend/tests/services/dither-ground.test.ts
 delete mode 100644 packages/frontend/tests/services/message-error-taxonomy.test.ts
 delete mode 100644 packages/frontend/tests/services/plan-range-lock.test.ts
 delete mode 100644 packages/frontend/tests/services/plan-selection.test.ts
 delete mode 100644 packages/frontend/tests/services/plan-store.test.ts

diff --git a/design-system/registry/components.json b/design-system/registry/components.json
index 7b063afc..24652e0b 100644
--- a/design-system/registry/components.json
+++ b/design-system/registry/components.json
@@ -307,28 +307,11 @@
         "agents.css"
       ]
     },
-    "account-email-footer": {
-      "classes": [
-        "account-email-footer"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
-    "account-email-toggle": {
-      "classes": [
-        "account-email-toggle--disabled"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
     "account-modal": {
       "classes": [
         "account-modal",
         "account-modal--standalone",
-        "account-modal__inner",
-        "account-modal__inner--upgrade"
+        "account-modal__inner"
       ],
       "files": [
         "agents.css"
@@ -513,31 +496,6 @@
         "routing-providers.css"
       ]
     },
-    "api-bot-banner": {
-      "classes": [
-        "api-bot-banner",
-        "api-bot-banner__text"
-      ],
-      "files": [
-        "api-bot.css"
-      ]
-    },
-    "api-bot-btn": {
-      "classes": [
-        "api-bot-btn"
-      ],
-      "files": [
-        "api-bot.css"
-      ]
-    },
-    "api-bot-close": {
-      "classes": [
-        "api-bot-close"
-      ],
-      "files": [
-        "api-bot.css"
-      ]
-    },
     "api-key-display": {
       "classes": [
         "api-key-display__code",
@@ -760,37 +718,6 @@
         "data.css"
       ]
     },
-    "billing-footer": {
-      "classes": [
-        "billing-footer",
-        "billing-footer__actions",
-        "billing-footer__link",
-        "billing-footer__note"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
-    "billing-stat": {
-      "classes": [
-        "billing-stat",
-        "billing-stat__cancel",
-        "billing-stat__label",
-        "billing-stat__meta",
-        "billing-stat__value"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
-    "billing-stats": {
-      "classes": [
-        "billing-stats"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
     "breadcrumb": {
       "classes": [
         "breadcrumb"
@@ -810,9 +737,7 @@
         "btn--sm"
       ],
       "files": [
-        "agents.css",
         "controls.css",
-        "data.css",
         "layout.css",
         "limits.css",
         "modals.css",
@@ -872,17 +797,6 @@
         "syntax-highlight.css"
       ]
     },
-    "cloud-email-info": {
-      "classes": [
-        "cloud-email-info",
-        "cloud-email-info__desc",
-        "cloud-email-info__icon",
-        "cloud-email-info__title"
-      ],
-      "files": [
-        "notifications.css"
-      ]
-    },
     "complexity-empty": {
       "classes": [
         "complexity-empty",
@@ -1201,14 +1115,6 @@
         "discovery.css"
       ]
     },
-    "dither-ground": {
-      "classes": [
-        "dither-ground"
-      ],
-      "files": [
-        "api-bot.css"
-      ]
-    },
     "drawer": {
       "classes": [
         "drawer",
@@ -1319,8 +1225,7 @@
         "error-autofix-row__meta-label",
         "error-autofix-row__meta-table",
         "error-autofix-row__meta-value",
-        "error-autofix-row__title",
-        "error-autofix-row__upgrade"
+        "error-autofix-row__title"
       ],
       "files": [
         "data.css"
@@ -1455,55 +1360,6 @@
         "wizard.css"
       ]
     },
-    "free-models-accordion": {
-      "classes": [
-        "free-models-accordion",
-        "free-models-accordion--open"
-      ],
-      "files": [
-        "data.css"
-      ]
-    },
-    "free-models-base-url-row": {
-      "classes": [
-        "free-models-base-url-row"
-      ],
-      "files": [
-        "data.css"
-      ]
-    },
-    "free-models-caret": {
-      "classes": [
-        "free-models-caret"
-      ],
-      "files": [
-        "data.css"
-      ]
-    },
-    "free-models-disabled-btn": {
-      "classes": [
-        "free-models-disabled-btn"
-      ],
-      "files": [
-        "data.css"
-      ]
-    },
-    "free-models-logo-dark": {
-      "classes": [
-        "free-models-logo-dark"
-      ],
-      "files": [
-        "data.css"
-      ]
-    },
-    "free-models-logo-light": {
-      "classes": [
-        "free-models-logo-light"
-      ],
-      "files": [
-        "data.css"
-      ]
-    },
     "free-tag": {
       "classes": [
         "free-tag"
@@ -1540,24 +1396,13 @@
         "header__dropdown-name",
         "header__gear",
         "header__gear-btn",
-        "header__github-icon",
-        "header__github-star",
-        "header__github-star-action",
-        "header__github-star-btn",
-        "header__github-star-close",
-        "header__github-star-count",
-        "header__github-star-label",
         "header__left",
         "header__logo",
         "header__logo-img",
         "header__logo-img--dark",
         "header__logo-img--light",
-        "header__mode-badge",
-        "header__mode-badge--dev",
-        "header__pro-badge",
         "header__right",
-        "header__separator",
-        "header__star-separator"
+        "header__separator"
       ],
       "files": [
         "controls.css",
@@ -2514,32 +2359,6 @@
         "wizard.css"
       ]
     },
-    "plan-picker": {
-      "classes": [
-        "plan-picker",
-        "plan-picker__amount",
-        "plan-picker__badge",
-        "plan-picker__card",
-        "plan-picker__card--expanded",
-        "plan-picker__card--pro",
-        "plan-picker__cta",
-        "plan-picker__details",
-        "plan-picker__features",
-        "plan-picker__name",
-        "plan-picker__period",
-        "plan-picker__price-inline",
-        "plan-picker__radio",
-        "plan-picker__radio-dot",
-        "plan-picker__row",
-        "plan-picker__section-header",
-        "plan-picker__section-subtitle",
-        "plan-picker__section-title",
-        "plan-picker__usage"
-      ],
-      "files": [
-        "auth.css"
-      ]
-    },
     "platform-icon": {
       "classes": [
         "platform-icon"
@@ -2713,14 +2532,6 @@
         "playground.css"
       ]
     },
-    "pro-range-badge": {
-      "classes": [
-        "pro-range-badge"
-      ],
-      "files": [
-        "custom-select.css"
-      ]
-    },
     "provider-auth-badge": {
       "classes": [
         "provider-auth-badge",
@@ -3641,52 +3452,13 @@
         "sidebar__logo",
         "sidebar__logo-dot",
         "sidebar__section-add",
-        "sidebar__section-label",
-        "sidebar__spacer"
+        "sidebar__section-label"
       ],
       "files": [
         "controls.css",
         "theme.css"
       ]
     },
-    "sidebar-api-bot": {
-      "classes": [
-        "sidebar-api-bot",
-        "sidebar-api-bot__close",
-        "sidebar-api-bot__image",
-        "sidebar-api-bot__text",
-        "sidebar-api-bot__title"
-      ],
-      "files": [
-        "api-bot.css"
-      ]
-    },
-    "sidebar-upgrade": {
-      "classes": [
-        "sidebar-upgrade"
-      ],
-      "files": [
-        "modals.css"
-      ]
-    },
-    "sidebar-usage": {
-      "classes": [
-        "sidebar-usage",
-        "sidebar-usage__alert",
-        "sidebar-usage__bar",
-        "sidebar-usage__count",
-        "sidebar-usage__count--danger",
-        "sidebar-usage__fill",
-        "sidebar-usage__fill--danger",
-        "sidebar-usage__fill--warning",
-        "sidebar-usage__header",
-        "sidebar-usage__month",
-        "sidebar-usage__title"
-      ],
-      "files": [
-        "modals.css"
-      ]
-    },
     "skeleton": {
       "classes": [
         "skeleton",
@@ -4061,107 +3833,6 @@
         "theme.css"
       ]
     },
-    "upgrade-back": {
-      "classes": [
-        "upgrade-back"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
-    "upgrade-limit-notice": {
-      "classes": [
-        "upgrade-limit-notice"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
-    "upgrade-page-header": {
-      "classes": [
-        "upgrade-page-header",
-        "upgrade-page-header--centered",
-        "upgrade-page-header__copy"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
-    "upgrade-plan-card": {
-      "classes": [
-        "upgrade-plan-card",
-        "upgrade-plan-card--pro",
-        "upgrade-plan-card__amount",
-        "upgrade-plan-card__amount--custom",
-        "upgrade-plan-card__badge",
-        "upgrade-plan-card__body",
-        "upgrade-plan-card__cta",
-        "upgrade-plan-card__desc",
-        "upgrade-plan-card__divider",
-        "upgrade-plan-card__features",
-        "upgrade-plan-card__features-intro",
-        "upgrade-plan-card__footer",
-        "upgrade-plan-card__header",
-        "upgrade-plan-card__no-commitment",
-        "upgrade-plan-card__period",
-        "upgrade-plan-card__price",
-        "upgrade-plan-card__usage"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
-    "upgrade-plan-grid": {
-      "classes": [
-        "upgrade-plan-grid"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
-    "upgrade-pro-current": {
-      "classes": [
-        "upgrade-pro-current",
-        "upgrade-pro-current__card",
-        "upgrade-pro-current__status"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
-    "upgrade-success-modal": {
-      "classes": [
-        "upgrade-success-modal",
-        "upgrade-success-modal__body",
-        "upgrade-success-modal__done",
-        "upgrade-success-modal__features",
-        "upgrade-success-modal__icon",
-        "upgrade-success-modal__subtitle",
-        "upgrade-success-modal__title"
-      ],
-      "files": [
-        "modals.css"
-      ]
-    },
-    "upgrade-terms": {
-      "classes": [
-        "upgrade-terms"
-      ],
-      "files": [
-        "agents.css"
-      ]
-    },
-    "usage-limit-banner": {
-      "classes": [
-        "usage-limit-banner",
-        "usage-limit-banner__actions",
-        "usage-limit-banner__btn",
-        "usage-limit-banner__text"
-      ],
-      "files": [
-        "modals.css"
-      ]
-    },
     "version-indicator": {
       "classes": [
         "version-indicator",
@@ -4447,154 +4118,154 @@
       "prop": "box-shadow",
       "value": "rgba(0, 0, 0, 0.08) 0px 0px 0px 1px",
       "file": "theme.css",
-      "line": 197
+      "line": 196
     },
     {
       "selector": ".trend--up",
       "prop": "color",
       "value": "hsl(var(--success))",
       "file": "theme.css",
-      "line": 238
+      "line": 237
     },
     {
       "selector": ".trend--up",
       "prop": "background",
       "value": "hsl(var(--success) / 0.1)",
       "file": "theme.css",
-      "line": 239
+      "line": 238
     },
     {
       "selector": ".trend--down",
       "prop": "color",
       "value": "hsl(var(--destructive))",
       "file": "theme.css",
-      "line": 243
+      "line": 242
     },
     {
       "selector": ".trend--down",
       "prop": "background",
       "value": "hsl(var(--destructive) / 0.1)",
       "file": "theme.css",
-      "line": 244
+      "line": 243
     },
     {
       "selector": ".panel",
       "prop": "box-shadow",
       "value": "rgba(0, 0, 0, 0.08) 0px 0px 0px 1px",
       "file": "theme.css",
-      "line": 269
+      "line": 268
     },
     {
       "selector": ".chart-card",
       "prop": "box-shadow",
       "value": "rgba(0, 0, 0, 0.08) 0px 0px 0px 1px",
       "file": "theme.css",
-      "line": 285
+      "line": 284
     },
     {
       "selector": ".chart-card__header",
       "prop": "align-items",
       "value": "flex-end",
       "file": "theme.css",
-      "line": 291
+      "line": 290
     },
     {
       "selector": ".chart-card__value-row",
       "prop": "align-items",
       "value": "baseline",
       "file": "theme.css",
-      "line": 323
+      "line": 322
     },
     {
       "selector": ".feed-item",
       "prop": "align-items",
       "value": "center",
       "file": "theme.css",
-      "line": 587
+      "line": 586
     },
     {
       "selector": ".feed-item",
       "prop": "gap",
       "value": "var(--gap-md)",
       "file": "theme.css",
-      "line": 588
+      "line": 587
     },
     {
       "selector": ".feed-item",
       "prop": "padding",
       "value": "10px 0",
       "file": "theme.css",
-      "line": 589
+      "line": 588
     },
     {
       "selector": ".sidebar",
       "prop": "padding",
       "value": "var(--gap-lg) 0 0 0",
       "file": "theme.css",
-      "line": 785
+      "line": 784
     },
     {
       "selector": ".theme-toggle",
       "prop": "padding",
       "value": "6px 12px",
       "file": "theme.css",
-      "line": 943
+      "line": 938
     },
     {
       "selector": ".theme-toggle",
       "prop": "width",
       "value": "100%",
       "file": "theme.css",
-      "line": 952
+      "line": 947
     },
     {
       "selector": ".chart-tooltip",
       "prop": "font-size",
       "value": "var(--font-size-xs)",
       "file": "theme.css",
-      "line": 1029
+      "line": 1024
     },
     {
       "selector": ".expandable-card__fade",
       "prop": "height",
       "value": "64px",
       "file": "theme.css",
-      "line": 1060
+      "line": 1055
     },
     {
       "selector": ".expandable-card__fade",
       "prop": "background",
       "value": "linear-gradient(transparent, hsl(var(--card)) 70%)",
       "file": "theme.css",
-      "line": 1061
+      "line": 1056
     },
     {
       "selector": ".expandable-card__fade",
       "prop": "padding-bottom",
       "value": "12px",
       "file": "theme.css",
-      "line": 1066
+      "line": 1061
     },
     {
       "selector": ".modal",
       "prop": "box-shadow",
       "value": "rgba(0, 0, 0, 0.08) 0px 0px 0px 1px,\n    0 25px 50px -12px rgb(0 0 0 / 0.25)",
       "file": "theme.css",
-      "line": 1117
+      "line": 1112
     },
     {
       "selector": ".modal__close",
       "prop": "width",
       "value": "2rem",
       "file": "theme.css",
-      "line": 1142
+      "line": 1137
     },
     {
       "selector": ".modal__close",
       "prop": "height",
       "value": "2rem",
       "file": "theme.css",
-      "line": 1143
+      "line": 1138
     },
     {
       "selector": ".toast",
@@ -4674,7 +4345,7 @@
       "value": "var(--card-shadow)",
       "file": "cards.css",
       "line": 7,
-      "losesTo": "theme.css:197"
+      "losesTo": "theme.css:196"
     },
     {
       "selector": ".trend--up",
@@ -4682,7 +4353,7 @@
       "value": "hsl(var(--muted-foreground))",
       "file": "cards.css",
       "line": 48,
-      "losesTo": "theme.css:238"
+      "losesTo": "theme.css:237"
     },
     {
       "selector": ".trend--down",
@@ -4690,7 +4361,7 @@
       "value": "hsl(var(--muted-foreground))",
       "file": "cards.css",
       "line": 48,
-      "losesTo": "theme.css:243"
+      "losesTo": "theme.css:242"
     },
     {
       "selector": ".trend--up",
@@ -4698,7 +4369,7 @@
       "value": "hsl(var(--muted))",
       "file": "cards.css",
       "line": 49,
-      "losesTo": "theme.css:239"
+      "losesTo": "theme.css:238"
     },
     {
       "selector": ".trend--down",
@@ -4706,7 +4377,7 @@
       "value": "hsl(var(--muted))",
       "file": "cards.css",
       "line": 49,
-      "losesTo": "theme.css:244"
+      "losesTo": "theme.css:243"
     },
     {
       "selector": ".panel",
@@ -4714,7 +4385,7 @@
       "value": "var(--card-shadow)",
       "file": "cards.css",
       "line": 59,
-      "losesTo": "theme.css:269"
+      "losesTo": "theme.css:268"
     },
     {
       "selector": ".view-more-link",
@@ -4730,7 +4401,7 @@
       "value": "var(--card-shadow)",
       "file": "cards.css",
       "line": 86,
-      "losesTo": "theme.css:285"
+      "losesTo": "theme.css:284"
     },
     {
       "selector": ".chart-card__header",
@@ -4738,7 +4409,7 @@
       "value": "stretch",
       "file": "cards.css",
       "line": 92,
-      "losesTo": "theme.css:291"
+      "losesTo": "theme.css:290"
     },
     {
       "selector": ".chart-card__value-row",
@@ -4746,7 +4417,7 @@
       "value": "center",
       "file": "cards.css",
       "line": 160,
-      "losesTo": "theme.css:323"
+      "losesTo": "theme.css:322"
     },
     {
       "selector": ".chart-tooltip",
@@ -4754,7 +4425,7 @@
       "value": "var(--tooltip-font-size)",
       "file": "charts.css",
       "line": 78,
-      "losesTo": "theme.css:1029"
+      "losesTo": "theme.css:1024"
     },
     {
       "selector": ".expandable-card__fade",
@@ -4762,7 +4433,7 @@
       "value": "80px",
       "file": "charts.css",
       "line": 110,
-      "losesTo": "theme.css:1060"
+      "losesTo": "theme.css:1055"
     },
     {
       "selector": ".expandable-card__fade",
@@ -4770,7 +4441,7 @@
       "value": "linear-gradient(transparent, hsl(var(--card)) 60%)",
       "file": "charts.css",
       "line": 111,
-      "losesTo": "theme.css:1061"
+      "losesTo": "theme.css:1056"
     },
     {
       "selector": ".expandable-card__fade",
@@ -4778,7 +4449,7 @@
       "value": "16px",
       "file": "charts.css",
       "line": 116,
-      "losesTo": "theme.css:1066"
+      "losesTo": "theme.css:1061"
     },
     {
       "selector": ".toast",
@@ -4826,7 +4497,7 @@
       "value": "var(--gap-md) 0",
       "file": "controls.css",
       "line": 213,
-      "losesTo": "theme.css:785"
+      "losesTo": "theme.css:784"
     },
     {
       "selector": ".custom-select__option--top > svg",
@@ -4866,7 +4537,7 @@
       "value": "flex-start",
       "file": "data.css",
       "line": 507,
-      "losesTo": "theme.css:587"
+      "losesTo": "theme.css:586"
     },
     {
       "selector": ".feed-item",
@@ -4874,7 +4545,7 @@
       "value": "12px",
       "file": "data.css",
       "line": 508,
-      "losesTo": "theme.css:588"
+      "losesTo": "theme.css:587"
     },
     {
       "selector": ".feed-item",
@@ -4882,7 +4553,7 @@
       "value": "12px 0",
       "file": "data.css",
       "line": 509,
-      "losesTo": "theme.css:589"
+      "losesTo": "theme.css:588"
     },
     {
       "selector": ".theme-toggle",
@@ -4890,7 +4561,7 @@
       "value": "2rem",
       "file": "layout.css",
       "line": 141,
-      "losesTo": "theme.css:952"
+      "losesTo": "theme.css:947"
     },
     {
       "selector": ".theme-toggle",
@@ -4898,7 +4569,7 @@
       "value": "0",
       "file": "layout.css",
       "line": 149,
-      "losesTo": "theme.css:943"
+      "losesTo": "theme.css:938"
     },
     {
       "selector": ".modal",
@@ -4906,7 +4577,7 @@
       "value": "var(--card-shadow),\n    0 25px 50px -12px rgb(0 0 0 / 0.25)",
       "file": "modals.css",
       "line": 22,
-      "losesTo": "theme.css:1117"
+      "losesTo": "theme.css:1112"
     },
     {
       "selector": ".modal__close",
@@ -4914,7 +4585,7 @@
       "value": "32px",
       "file": "modals.css",
       "line": 47,
-      "losesTo": "theme.css:1142"
+      "losesTo": "theme.css:1137"
     },
     {
       "selector": ".modal__close",
@@ -4922,7 +4593,7 @@
       "value": "32px",
       "file": "modals.css",
       "line": 48,
-      "losesTo": "theme.css:1143"
+      "losesTo": "theme.css:1138"
     },
     {
       "selector": ".setup-modal__header",
@@ -5118,8 +4789,8 @@
   "stats": {
     "tokens": 79,
     "darkOverrides": 38,
-    "blocks": 318,
-    "classes": 1700,
+    "blocks": 288,
+    "classes": 1583,
     "canonicalRules": 46,
     "ghostRules": 46
   }
diff --git a/design-system/registry/llms.txt b/design-system/registry/llms.txt
index 2a5d421a..c2b2e4c0 100644
--- a/design-system/registry/llms.txt
+++ b/design-system/registry/llms.txt
@@ -96,11 +96,9 @@
 --z-toast: 8000
 --z-tooltip: 9999
 
-## Blocks (318 BEM blocks, 1700 classes)
+## Blocks (288 BEM blocks, 1583 classes)
 account-back-btn (agents.css): account-back-btn
-account-email-footer (agents.css): account-email-footer
-account-email-toggle (agents.css): account-email-toggle--disabled
-account-modal (agents.css): account-modal account-modal--standalone account-modal__inner account-modal__inner--upgrade
+account-modal (agents.css): account-modal account-modal--standalone account-modal__inner
 account-security-error (agents.css): account-security-error
 account-security-footer (agents.css): account-security-footer
 action-menu (action-menu.css): action-menu action-menu--open action-menu__dropdown action-menu__item action-menu__item--danger action-menu__trigger
@@ -116,9 +114,6 @@ agent-type-select (agent-type-select.css): agent-type-select agent-type-select__
 agent-type-select-row (agent-type-select.css): agent-type-select-row
 agents-grid (agents.css): agents-grid
 anthropic-detail (routing-providers.css): anthropic-detail__alt anthropic-detail__alt-divider anthropic-detail__alt-hint anthropic-detail__btn anthropic-detail__primary
-api-bot-banner (api-bot.css): api-bot-banner api-bot-banner__text
-api-bot-btn (api-bot.css): api-bot-btn
-api-bot-close (api-bot.css): api-bot-close
 api-key-display (wizard.css): api-key-display__code api-key-display__prefix api-key-display__value api-key-display__warning
 app-body (layout.css): app-body
 app-layout (theme.css): app-layout
@@ -140,16 +135,12 @@ autofix-card (data.css): autofix-card autofix-card--autofix autofix-card--fallba
 autofix-card-row (data.css): autofix-card-row
 autofix-consent (modals.css): autofix-consent__agent-icon autofix-consent__agent-name autofix-consent__agent-row autofix-consent__agents autofix-consent__agents-label autofix-consent__legal
 autofix-icon (data.css): autofix-icon
-billing-footer (agents.css): billing-footer billing-footer__actions billing-footer__link billing-footer__note
-billing-stat (agents.css): billing-stat billing-stat__cancel billing-stat__label billing-stat__meta billing-stat__value
-billing-stats (agents.css): billing-stats
 breadcrumb (layout.css, theme.css): breadcrumb
-btn (agents.css, controls.css, data.css, layout.css, limits.css, modals.css, routing-providers.css, routing.css, skeleton.css, theme.css): btn btn--danger btn--ghost btn--outline btn--primary btn--sm
+btn (controls.css, layout.css, limits.css, modals.css, routing-providers.css, routing.css, skeleton.css, theme.css): btn btn--danger btn--ghost btn--outline btn--primary btn--sm
 cards-grid (layout.css, theme.css, wizard.css): cards-grid
 chart-card (cards.css, theme.css): chart-card chart-card__body chart-card__controls chart-card__filter-btn chart-card__filter-btn--active chart-card__filters chart-card__header chart-card__label chart-card__stat chart-card__stat--active chart-card__stat--clickable chart-card__subtitle chart-card__subtitle-title chart-card__value chart-card__value-row
 chart-tooltip (charts.css, theme.css): chart-tooltip
 class_ (syntax-highlight.css): class_
-cloud-email-info (notifications.css): cloud-email-info cloud-email-info__desc cloud-email-info__icon cloud-email-info__title
 complexity-empty (routing.css): complexity-empty complexity-empty__desc complexity-empty__title
 confirm-modal (limits.css): confirm-modal__confirm-row confirm-modal__footer confirm-modal__warning
 connection-delete-confirmation (routing-providers.css): connection-delete-confirmation connection-delete-confirmation__copy connection-delete-confirmation__footer connection-delete-confirmation__label connection-delete-confirmation__title connection-delete-confirmation__warning
@@ -176,7 +167,6 @@ discovery-actions (discovery.css): discovery-actions
 discovery-card (discovery.css): discovery-card discovery-card__desc discovery-card__form discovery-card__intro discovery-card__logo discovery-card__title
 discovery-form (discovery.css): discovery-form
 discovery-select (discovery.css): discovery-select--empty
-dither-ground (api-bot.css): dither-ground
 drawer (request-drawer.css): drawer drawer--open drawer__badge drawer__badge--autofix drawer__badge--fallback drawer__body drawer__close drawer__content drawer__content-empty drawer__header drawer__messages-pane drawer__meta-row drawer__meta-sep drawer__meta-text drawer__sidebar drawer__sidebar-title drawer__split drawer__tabs-full drawer__title drawer__title-row
 drawer-context-card (request-drawer.css): drawer-context-card drawer-context-card--autofix drawer-context-card--error drawer-context-card--fallback
 drawer-kv (request-drawer.css): drawer-kv drawer-kv__key
@@ -184,7 +174,7 @@ drawer-metadata (request-drawer.css): drawer-metadata
 drawer-status (request-drawer.css): drawer-status drawer-status--error drawer-status--neutral drawer-status--success
 duplicate-agent (agents.css): duplicate-agent__badge duplicate-agent__list duplicate-agent__section duplicate-agent__section-header
 empty-state (data.css, theme.css): empty-state empty-state__img empty-state__img-wrapper empty-state__title
-error-autofix-row (data.css): error-autofix-row error-autofix-row--solo error-autofix-row--triple error-autofix-row__arrow error-autofix-row__arrow-down error-autofix-row__arrow-right error-autofix-row__autofix error-autofix-row__autofix--autofix error-autofix-row__autofix--fallback error-autofix-row__autofix-btn error-autofix-row__autofix-btn--secondary error-autofix-row__autofix-text error-autofix-row__autofix-title error-autofix-row__error error-autofix-row__error--full error-autofix-row__meta-hint error-autofix-row__meta-label error-autofix-row__meta-table error-autofix-row__meta-value error-autofix-row__title error-autofix-row__upgrade
+error-autofix-row (data.css): error-autofix-row error-autofix-row--solo error-autofix-row--triple error-autofix-row__arrow error-autofix-row__arrow-down error-autofix-row__arrow-right error-autofix-row__autofix error-autofix-row__autofix--autofix error-autofix-row__autofix--fallback error-autofix-row__autofix-btn error-autofix-row__autofix-btn--secondary error-autofix-row__autofix-text error-autofix-row__autofix-title error-autofix-row__error error-autofix-row__error--full error-autofix-row__meta-hint error-autofix-row__meta-label error-autofix-row__meta-table error-autofix-row__meta-value error-autofix-row__title
 error-class-card (analytics-overview.css): error-class-card error-class-card__bar error-class-card__bar-wrap error-class-card__count error-class-card__empty error-class-card__label error-class-card__list error-class-card__row error-class-card__title
 expandable-card (charts.css, theme.css): expandable-card expandable-card__btn expandable-card__content expandable-card__fade
 fallback-icon (data.css): fallback-icon
@@ -195,15 +185,9 @@ feedback-cell (feedback.css): feedback-cell
 feedback-modal (feedback.css): feedback-modal feedback-modal__footer feedback-modal__tags feedback-modal__textarea
 feedback-tag (feedback.css): feedback-tag feedback-tag--selected
 framework-snippets (wizard.css): framework-snippets__block framework-snippets__connection framework-snippets__field framework-snippets__label framework-snippets__toggle-row framework-snippets__value
-free-models-accordion (data.css): free-models-accordion free-models-accordion--open
-free-models-base-url-row (data.css): free-models-base-url-row
-free-models-caret (data.css): free-models-caret
-free-models-disabled-btn (data.css): free-models-disabled-btn
-free-models-logo-dark (data.css): free-models-logo-dark
-free-models-logo-light (data.css): free-models-logo-light
 free-tag (theme.css): free-tag
 function_ (syntax-highlight.css): function_
-header (controls.css, theme.css): header header__avatar header__avatar-btn header__breadcrumb-current header__breadcrumb-icon header__breadcrumb-label header__breadcrumb-link header__breadcrumb-provider-icon header__docs-link header__dropdown header__dropdown-divider header__dropdown-email header__dropdown-header header__dropdown-item header__dropdown-item--danger header__dropdown-name header__gear header__gear-btn header__github-icon header__github-star header__github-star-action header__github-star-btn header__github-star-close header__github-star-count header__github-star-label header__left header__logo header__logo-img header__logo-img--dark header__logo-img--light header__mode-badge header__mode-badge--dev header__pro-badge header__right header__separator header__star-separator
+header (controls.css, theme.css): header header__avatar header__avatar-btn header__breadcrumb-current header__breadcrumb-icon header__breadcrumb-label header__breadcrumb-link header__breadcrumb-provider-icon header__docs-link header__dropdown header__dropdown-divider header__dropdown-email header__dropdown-header header__dropdown-item header__dropdown-item--danger header__dropdown-name header__gear header__gear-btn header__left header__logo header__logo-img header__logo-img--dark header__logo-img--light header__right header__separator
 header-combo (routing-header-tiers.css): header-combo header-combo--invalid header-combo__error header-combo__input header-combo__menu header-combo__option header-combo__option--free header-combo__option--hover header-combo__option-group header-combo__option-label header-combo__option-row header-combo__option-sublabel
 header-controls (layout.css, theme.css): header-controls
 header-tier-card (routing-header-tiers.css): header-tier-card__actions header-tier-card__icon-btn header-tier-card__kebab header-tier-card__kebab-btn header-tier-card__menu header-tier-card__menu-item header-tier-card__menu-item--danger header-tier-card__name header-tier-card__ordinal header-tier-card__rule header-tier-card__title
@@ -285,7 +269,6 @@ overview-stats (analytics-overview.css): overview-stats overview-stats--3 overvi
 page-header (analytics-overview.css, connection-detail.css, layout.css, theme.css): page-header page-header--wrap page-header__intro page-header__subtitle page-header__title
 pagination (data.css): pagination pagination__btn pagination__controls pagination__summary
 panel (analytics-overview.css, cards.css, charts.css, limits.css, request-drawer.css, routing-providers.css, routing-tabs.css, theme.css, welcome.css, wizard.css): panel panel--disabled panel__header panel__tab panel__tab--active panel__tab-icon panel__tabs panel__title
-plan-picker (auth.css): plan-picker plan-picker__amount plan-picker__badge plan-picker__card plan-picker__card--expanded plan-picker__card--pro plan-picker__cta plan-picker__details plan-picker__features plan-picker__name plan-picker__period plan-picker__price-inline plan-picker__radio plan-picker__radio-dot plan-picker__row plan-picker__section-header plan-picker__section-subtitle plan-picker__section-title plan-picker__usage
 platform-icon (platform-icons.css): platform-icon
 playground (playground.css): playground playground--embedded playground__add playground__add-plus playground__add-shortcut playground__add-shortcut-plus playground__columns
 playground-column (playground.css): playground-column playground-column__best playground-column__best--on playground-column__best--static playground-column__body playground-column__chip playground-column__edit-icon playground-column__error playground-column__error-text playground-column__header playground-column__headers playground-column__headers-caret playground-column__headers-caret--open playground-column__headers-list playground-column__headers-toggle playground-column__icon playground-column__metric playground-column__metric-label playground-column__metric-value playground-column__metric-value-row playground-column__metrics playground-column__name playground-column__placeholder playground-column__remove playground-column__response playground-column__skeleton playground-column__title playground-column__title--readonly playground-column__title-left playground-column__win-badge
@@ -295,7 +278,6 @@ playground-prompt (playground.css): playground-prompt playground-prompt--info pl
 playground-prompt-wrapper (playground.css): playground-prompt-wrapper playground-prompt-wrapper--history-open
 playground-recent (playground.css): playground-recent playground-recent--collapsed playground-recent__body playground-recent__collapse playground-recent__empty playground-recent__fade playground-recent__group-label playground-recent__header playground-recent__item playground-recent__item--active playground-recent__item-wrapper playground-recent__list playground-recent__menu playground-recent__menu-anchor playground-recent__menu-backdrop playground-recent__menu-item playground-recent__more playground-recent__new playground-recent__new-icon playground-recent__new-label playground-recent__new-left playground-recent__new-shortcut playground-recent__prompt playground-recent__title playground-recent__toggle
 playground-summary (playground.css): playground-summary playground-summary__best-cell playground-summary__best-star playground-summary__best-star--on playground-summary__delta playground-summary__provider playground-summary__provider-icon playground-summary__provider-name playground-summary__row--best playground-summary__row--clickable playground-summary__table playground-summary__title playground-summary__value playground-summary__winner-icon
-pro-range-badge (custom-select.css): pro-range-badge
 provider-auth-badge (routing.css): provider-auth-badge provider-auth-badge--key provider-auth-badge--local provider-auth-badge--overlay provider-auth-badge--sub
 provider-card (notifications.css, routing-providers.css): provider-card provider-card__actions provider-card__body provider-card__dropdown provider-card__dropdown-item provider-card__dropdown-item--danger provider-card__email provider-card__header provider-card__key provider-card__label provider-card__logo provider-card__logo-letter provider-card__menu provider-card__menu-btn provider-card__meta provider-card__name
 provider-detail (routing-providers.css): provider-detail provider-detail__action provider-detail__beta-badge provider-detail__disconnect provider-detail__disconnect-icon provider-detail__error provider-detail__field provider-detail__footer provider-detail__format provider-detail__format-help provider-detail__format-legend provider-detail__format-option provider-detail__format-option--active provider-detail__format-option--disabled provider-detail__format-option-path provider-detail__format-option-title provider-detail__format-options provider-detail__header provider-detail__header-actions provider-detail__hint provider-detail__icon provider-detail__input provider-detail__input--disabled provider-detail__input--error provider-detail__input--masked provider-detail__key-help provider-detail__key-help-link provider-detail__key-row provider-detail__label provider-detail__label-muted provider-detail__models-bar provider-detail__name provider-detail__no-key provider-detail__refresh-btn provider-detail__refresh-icon--spinning provider-detail__signin-btn provider-detail__subtitle provider-detail__title-group
@@ -361,10 +343,7 @@ setup-segment (wizard.css): setup-segment setup-segment--full setup-segment__btn
 setup-step (wizard.css): setup-step__desc setup-step__heading
 setup-step-providers (overview.css): setup-step-providers
 setup-steps (controls.css): setup-steps setup-steps__content setup-steps__divider setup-steps__number setup-steps__step
-sidebar (controls.css, theme.css): sidebar sidebar--mobile-open sidebar__badge sidebar__feedback sidebar__feedback-hint sidebar__feedback-title sidebar__footer sidebar__link sidebar__link--disabled sidebar__link-row sidebar__logo sidebar__logo-dot sidebar__section-add sidebar__section-label sidebar__spacer
-sidebar-api-bot (api-bot.css): sidebar-api-bot sidebar-api-bot__close sidebar-api-bot__image sidebar-api-bot__text sidebar-api-bot__title
-sidebar-upgrade (modals.css): sidebar-upgrade
-sidebar-usage (modals.css): sidebar-usage sidebar-usage__alert sidebar-usage__bar sidebar-usage__count sidebar-usage__count--danger sidebar-usage__fill sidebar-usage__fill--danger sidebar-usage__fill--warning sidebar-usage__header sidebar-usage__month sidebar-usage__title
+sidebar (controls.css, theme.css): sidebar sidebar--mobile-open sidebar__badge sidebar__feedback sidebar__feedback-hint sidebar__feedback-title sidebar__footer sidebar__link sidebar__link--disabled sidebar__link-row sidebar__logo sidebar__logo-dot sidebar__section-add sidebar__section-label
 skeleton (skeleton.css): skeleton skeleton--rect skeleton--text
 skill-dot (data.css): skill-dot skill-dot--active
 skip-link (layout.css): skip-link
@@ -399,15 +378,6 @@ u-marker (charts.css, theme.css): u-marker
 u-series (charts.css, theme.css): u-series
 u-value (charts.css, theme.css): u-value
 u-wrap (cards.css, charts.css, theme.css): u-wrap
-upgrade-back (agents.css): upgrade-back
-upgrade-limit-notice (agents.css): upgrade-limit-notice
-upgrade-page-header (agents.css): upgrade-page-header upgrade-page-header--centered upgrade-page-header__copy
-upgrade-plan-card (agents.css): upgrade-plan-card upgrade-plan-card--pro upgrade-plan-card__amount upgrade-plan-card__amount--custom upgrade-plan-card__badge upgrade-plan-card__body upgrade-plan-card__cta upgrade-plan-card__desc upgrade-plan-card__divider upgrade-plan-card__features upgrade-plan-card__features-intro upgrade-plan-card__footer upgrade-plan-card__header upgrade-plan-card__no-commitment upgrade-plan-card__period upgrade-plan-card__price upgrade-plan-card__usage
-upgrade-plan-grid (agents.css): upgrade-plan-grid
-upgrade-pro-current (agents.css): upgrade-pro-current upgrade-pro-current__card upgrade-pro-current__status
-upgrade-success-modal (modals.css): upgrade-success-modal upgrade-success-modal__body upgrade-success-modal__done upgrade-success-modal__features upgrade-success-modal__icon upgrade-success-modal__subtitle upgrade-success-modal__title
-upgrade-terms (agents.css): upgrade-terms
-usage-limit-banner (modals.css): usage-limit-banner usage-limit-banner__actions usage-limit-banner__btn usage-limit-banner__text
 version-indicator (version-indicator.css): version-indicator version-indicator--update version-indicator__dismiss version-indicator__update
 view-more-link (analytics-overview.css, cards.css): view-more-link
 waiting-banner (overview.css): waiting-banner waiting-banner--success
@@ -437,29 +407,29 @@ workspace-table (agents.css): workspace-table__actions workspace-table__icon wor
 .request-tool { border-radius: var(--radius-sm) }  ← request-drawer.css:919
 .request-tool { background: hsl(36 80% 50% / 0.04) }  ← request-drawer.css:920
 .hljs-attr { color: hsl(var(--chart-4)) }  ← syntax-highlight.css:41
-.summary-card { box-shadow: rgba(0, 0, 0, 0.08) 0px 0px 0px 1px }  ← theme.css:197
-.trend--up { color: hsl(var(--success)) }  ← theme.css:238
-.trend--up { background: hsl(var(--success) / 0.1) }  ← theme.css:239
-.trend--down { color: hsl(var(--destructive)) }  ← theme.css:243
-.trend--down { background: hsl(var(--destructive) / 0.1) }  ← theme.css:244
-.panel { box-shadow: rgba(0, 0, 0, 0.08) 0px 0px 0px 1px }  ← theme.css:269
-.chart-card { box-shadow: rgba(0, 0, 0, 0.08) 0px 0px 0px 1px }  ← theme.css:285
-.chart-card__header { align-items: flex-end }  ← theme.css:291
-.chart-card__value-row { align-items: baseline }  ← theme.css:323
-.feed-item { align-items: center }  ← theme.css:587
-.feed-item { gap: var(--gap-md) }  ← theme.css:588
-.feed-item { padding: 10px 0 }  ← theme.css:589
-.sidebar { padding: var(--gap-lg) 0 0 0 }  ← theme.css:785
-.theme-toggle { padding: 6px 12px }  ← theme.css:943
-.theme-toggle { width: 100% }  ← theme.css:952
-.chart-tooltip { font-size: var(--font-size-xs) }  ← theme.css:1029
-.expandable-card__fade { height: 64px }  ← theme.css:1060
-.expandable-card__fade { background: linear-gradient(transparent, hsl(var(--card)) 70%) }  ← theme.css:1061
-.expandable-card__fade { padding-bottom: 12px }  ← theme.css:1066
+.summary-card { box-shadow: rgba(0, 0, 0, 0.08) 0px 0px 0px 1px }  ← theme.css:196
+.trend--up { color: hsl(var(--success)) }  ← theme.css:237
+.trend--up { background: hsl(var(--success) / 0.1) }  ← theme.css:238
+.trend--down { color: hsl(var(--destructive)) }  ← theme.css:242
+.trend--down { background: hsl(var(--destructive) / 0.1) }  ← theme.css:243
+.panel { box-shadow: rgba(0, 0, 0, 0.08) 0px 0px 0px 1px }  ← theme.css:268
+.chart-card { box-shadow: rgba(0, 0, 0, 0.08) 0px 0px 0px 1px }  ← theme.css:284
+.chart-card__header { align-items: flex-end }  ← theme.css:290
+.chart-card__value-row { align-items: baseline }  ← theme.css:322
+.feed-item { align-items: center }  ← theme.css:586
+.feed-item { gap: var(--gap-md) }  ← theme.css:587
+.feed-item { padding: 10px 0 }  ← theme.css:588
+.sidebar { padding: var(--gap-lg) 0 0 0 }  ← theme.css:784
+.theme-toggle { padding: 6px 12px }  ← theme.css:938
+.theme-toggle { width: 100% }  ← theme.css:947
+.chart-tooltip { font-size: var(--font-size-xs) }  ← theme.css:1024
+.expandable-card__fade { height: 64px }  ← theme.css:1055
+.expandable-card__fade { background: linear-gradient(transparent, hsl(var(--card)) 70%) }  ← theme.css:1056
+.expandable-card__fade { padding-bottom: 12px }  ← theme.css:1061
 .modal { box-shadow: rgba(0, 0, 0, 0.08) 0px 0px 0px 1px,
-    0 25px 50px -12px rgb(0 0 0 / 0.25) }  ← theme.css:1117
-.modal__close { width: 2rem }  ← theme.css:1142
-.modal__close { height: 2rem }  ← theme.css:1143
+    0 25px 50px -12px rgb(0 0 0 / 0.25) }  ← theme.css:1112
+.modal__close { width: 2rem }  ← theme.css:1137
+.modal__close { height: 2rem }  ← theme.css:1138
 .toast { align-items: flex-start }  ← toast.css:16
 .toast { gap: var(--gap-sm) }  ← toast.css:17
 .toast { padding: 12px var(--gap-md) }  ← toast.css:18
@@ -473,39 +443,39 @@ workspace-table (agents.css): workspace-table__actions workspace-table__icon wor
 .welcome__route-test-heading { gap: 10px }  ← welcome.css:904
 
 ## Ghost rules — declared but always losing; edit the canonical rule instead, delete these in the refactor project (46)
-.summary-card { box-shadow: var(--card-shadow) }  at cards.css:7 loses to theme.css:197
-.trend--up { color: hsl(var(--muted-foreground)) }  at cards.css:48 loses to theme.css:238
-.trend--down { color: hsl(var(--muted-foreground)) }  at cards.css:48 loses to theme.css:243
-.trend--up { background: hsl(var(--muted)) }  at cards.css:49 loses to theme.css:239
-.trend--down { background: hsl(var(--muted)) }  at cards.css:49 loses to theme.css:244
-.panel { box-shadow: var(--card-shadow) }  at cards.css:59 loses to theme.css:269
+.summary-card { box-shadow: var(--card-shadow) }  at cards.css:7 loses to theme.css:196
+.trend--up { color: hsl(var(--muted-foreground)) }  at cards.css:48 loses to theme.css:237
+.trend--down { color: hsl(var(--muted-foreground)) }  at cards.css:48 loses to theme.css:242
+.trend--up { background: hsl(var(--muted)) }  at cards.css:49 loses to theme.css:238
+.trend--down { background: hsl(var(--muted)) }  at cards.css:49 loses to theme.css:243
+.panel { box-shadow: var(--card-shadow) }  at cards.css:59 loses to theme.css:268
 .view-more-link { color: hsl(var(--muted-foreground)) }  at cards.css:72 loses to analytics-overview.css:213
-.chart-card { box-shadow: var(--card-shadow) }  at cards.css:86 loses to theme.css:285
-.chart-card__header { align-items: stretch }  at cards.css:92 loses to theme.css:291
-.chart-card__value-row { align-items: center }  at cards.css:160 loses to theme.css:323
-.chart-tooltip { font-size: var(--tooltip-font-size) }  at charts.css:78 loses to theme.css:1029
-.expandable-card__fade { height: 80px }  at charts.css:110 loses to theme.css:1060
-.expandable-card__fade { background: linear-gradient(transparent, hsl(var(--card)) 60%) }  at charts.css:111 loses to theme.css:1061
-.expandable-card__fade { padding-bottom: 16px }  at charts.css:116 loses to theme.css:1066
+.chart-card { box-shadow: var(--card-shadow) }  at cards.css:86 loses to theme.css:284
+.chart-card__header { align-items: stretch }  at cards.css:92 loses to theme.css:290
+.chart-card__value-row { align-items: center }  at cards.css:160 loses to theme.css:322
+.chart-tooltip { font-size: var(--tooltip-font-size) }  at charts.css:78 loses to theme.css:1024
+.expandable-card__fade { height: 80px }  at charts.css:110 loses to theme.css:1055
+.expandable-card__fade { background: linear-gradient(transparent, hsl(var(--card)) 60%) }  at charts.css:111 loses to theme.css:1056
+.expandable-card__fade { padding-bottom: 16px }  at charts.css:116 loses to theme.css:1061
 .toast { align-items: center }  at controls.css:124 loses to toast.css:16
 .toast { gap: 10px }  at controls.css:125 loses to toast.css:17
 .toast { padding: 12px 16px }  at controls.css:126 loses to toast.css:18
 .toast { box-shadow: 0 4px 16px rgb(0 0 0 / 0.15) }  at controls.css:129 loses to toast.css:22
 .toast { animation: toast-in 200ms ease-out }  at controls.css:132 loses to toast.css:26
-.sidebar { padding: var(--gap-md) 0 }  at controls.css:213 loses to theme.css:785
+.sidebar { padding: var(--gap-md) 0 }  at controls.css:213 loses to theme.css:784
 .custom-select__option--top > svg { margin-top: calc((18px - 13px) / 2) }  at custom-select.css:137 loses to custom-select.css:142
 .custom-select__option--top > img { margin-top: calc((18px - 13px) / 2) }  at custom-select.css:137 loses to custom-select.css:142
 .tier-badge--fallback { background: hsl(var(--muted-foreground) / 0.1) }  at data.css:299 loses to overview.css:105
 .tier-badge--fallback { color: hsl(var(--muted-foreground)) }  at data.css:300 loses to overview.css:106
-.feed-item { align-items: flex-start }  at data.css:507 loses to theme.css:587
-.feed-item { gap: 12px }  at data.css:508 loses to theme.css:588
-.feed-item { padding: 12px 0 }  at data.css:509 loses to theme.css:589
-.theme-toggle { width: 2rem }  at layout.css:141 loses to theme.css:952
-.theme-toggle { padding: 0 }  at layout.css:149 loses to theme.css:943
+.feed-item { align-items: flex-start }  at data.css:507 loses to theme.css:586
+.feed-item { gap: 12px }  at data.css:508 loses to theme.css:587
+.feed-item { padding: 12px 0 }  at data.css:509 loses to theme.css:588
+.theme-toggle { width: 2rem }  at layout.css:141 loses to theme.css:947
+.theme-toggle { padding: 0 }  at layout.css:149 loses to theme.css:938
 .modal { box-shadow: var(--card-shadow),
-    0 25px 50px -12px rgb(0 0 0 / 0.25) }  at modals.css:22 loses to theme.css:1117
-.modal__close { width: 32px }  at modals.css:47 loses to theme.css:1142
-.modal__close { height: 32px }  at modals.css:48 loses to theme.css:1143
+    0 25px 50px -12px rgb(0 0 0 / 0.25) }  at modals.css:22 loses to theme.css:1112
+.modal__close { width: 32px }  at modals.css:47 loses to theme.css:1137
+.modal__close { height: 32px }  at modals.css:48 loses to theme.css:1138
 .setup-modal__header { align-items: flex-start }  at modals.css:64 loses to overview.css:15
 .setup-modal__next { padding: 8px 20px }  at modals.css:97 loses to overview.css:42
 .setup-modal__next { color: hsl(var(--primary-foreground)) }  at modals.css:101 loses to overview.css:46
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 079b0a9e..dd6f5952 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -22,9 +22,6 @@ COPY packages/shared packages/shared
 COPY packages/frontend packages/frontend
 COPY packages/backend packages/backend
 COPY packages/manifest packages/manifest
-# Marks this bundle as a self-hosted build so the frontend reveals the
-# version badge baked in at build time. Cloud CI builds never set this.
-ENV VITE_MANIFEST_SELFHOSTED=true
 RUN npx turbo build --filter=manifest-backend --filter=manifest-frontend --filter=manifest-shared
 
 # Stage 3: Production dependencies only. npm ci runs with --ignore-scripts
diff --git a/docs/dev/manifest-guide.md b/docs/dev/manifest-guide.md
index 8f515f12..4f2258df 100644
--- a/docs/dev/manifest-guide.md
+++ b/docs/dev/manifest-guide.md
@@ -16,7 +16,7 @@ Manifest is a smart model router for **AI agents**. It sits between an agent and
 
 **"Harness" is the dashboard word for an agent.** The UI now labels agents **Harnesses** (nav item "Harnesses", routes under `/harnesses`, categories `AI agent` / `Automation` / `App AI SDK` / `Coding Assistant` from `CATEGORY_LABELS` in `packages/shared/src/agent-type.ts`). This is a **copy-level rename only**: backend code, database tables (`agents`, `agent_messages`, …), API routes (`/api/v1/agents/*`), and entity/service names all still say *agent*. Legacy `/agents/*` dashboard URLs redirect to `/harnesses/*`. When writing UI copy say "harness"; when writing code or API docs keep "agent".
 
-**Product note:** this repo is **Manifest LLM Gateway**, the open-source LLM gateway of Manifest, available and maintained. The dashboard and the READMEs carry no promotion of the other Manifest product (the self-healing layer at `dashboard.manifest.build`), which is on hold. The dashboard announces **API Bot** instead: a banner above the page content (`ApiBotBanner.tsx`) and a sidebar card (`ApiBotAnnouncement.tsx`), both linking to `https://manifest.build/api-bot/`, shown in every deployment mode with a per-session dismiss, on API Bot's own dithered ground (`services/dither-ground.ts`). `POST /api/v1/waitlist/pivot/claim` stays only for self-hosted versions that still ship the old sidebar card.
+**Product note:** this repo is **Manifest LLM Gateway**, the open-source LLM gateway of Manifest, available and maintained. The dashboard and the READMEs carry no promotion of the other Manifest product (the self-healing layer at `dashboard.manifest.build`), which is on hold. Thinker removed the dashboard's SaaS layer (#12): no API Bot banner or sidebar card, no plans/upgrade/Stripe UI, no GitHub stars, no Free Models page, no managed Gemini Free, and no cloud-mode branches (the dashboard always behaves as self-hosted). The matching backend endpoints (`/api/v1/billing*`, `/api/v1/waitlist*`, `/api/v1/github*`, `/api/v1/free-models*`) still exist until #14/#15 remove them; the dashboard no longer calls them.
 
 **Supported agents**: see `AGENT_PLATFORMS` in `packages/shared/src/agent-type.ts` for the current list (OpenClaw, Hermes, Claude Code, OpenCode, generic OpenAI/Anthropic SDK slots, and others — don't duplicate the list here, it grows independently of this doc). OpenClaw remains the deepest integration, but no new code or copy should frame Manifest as OpenClaw-only. When adding examples, prefer "AI agent" as the noun and pick OpenClaw as the worked example rather than the sole target. Manifest is consumed as a generic OpenAI-compatible HTTP endpoint — there are no first-party OpenClaw plugins in this repo anymore.
 
@@ -183,9 +183,7 @@ packages/
 │   │   │   ├── providers/                   # Subscriptions.tsx, Byok.tsx, Local.tsx, ConnectionDetail.tsx, ProviderConnectionsPage.tsx (/providers/* pages)
 │   │   │   ├── Discovery.tsx                # Self-hosted discovery form (one-time, post-signup)
 │   │   │   ├── Welcome.tsx                  # Post-signup welcome flow (+ welcome-helpers.ts)
-│   │   │   ├── FreeModels.tsx               # Free model catalog
 │   │   │   ├── Setup.tsx                    # First-run setup wizard
-│   │   │   ├── Upgrade.tsx                  # Billing/plan upgrade page
 │   │   │   ├── Help.tsx                     # Help page
 │   │   │   ├── AgentLimitsRedirect.tsx, AgentMessagesRedirect.tsx # Legacy per-harness URL redirects
 │   │   │   ├── CliAuth.tsx                  # /cli/auth — approve a `mnfst login` browser request
@@ -778,7 +776,7 @@ The id is minted lazily by `InstallIdService.getOrCreate()` (exported from `Tele
 
 **Self-hosted consent is once, and rides on the per-agent enable.** On self-hosted, consent is remembered via `install_metadata.autofix_consented_at` — a single nullable column on the existing telemetry singleton. Consent is recorded by **any** enable path: the per-agent `PATCH …/autofix` with `enabled: true` (a disable never mints it), the enable-all endpoint, and the Autofix switch on first agent creation. The singleton row is upserted, minting an `install_id` if telemetry never did — so consent alone never starts telemetry.
 
-**The sidebar carries no Autofix card.** The Autofix enablement card duplicated what notifications already cover, and the cards promoting the self-healing product are gone. The only sidebar card is the API Bot announcement. The per-harness **Settings** toggle (`SettingsAutofixSection.tsx`) is the enablement path in the dashboard.
+**The sidebar carries no Autofix card.** The Autofix enablement card duplicated what notifications already cover, and the cards promoting the self-healing product are gone. The sidebar carries no cards. The per-harness **Settings** toggle (`SettingsAutofixSection.tsx`) is the enablement path in the dashboard.
 
 `POST /api/v1/autofix/enable-all` remains as an API-level fleet backfill (no dashboard caller): it runs `UPDATE agents SET autofix_enabled = true` for every live, non-playground agent in the tenant (**including any previously turned off**), invalidates the per-tenant config cache, records consent, and returns the refreshed workspace status. Soft-deleted agents are left alone so resurrecting one doesn't silently arrive with Autofix on.
 
diff --git a/package-lock.json b/package-lock.json
index 1abc8d48..7835682f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18671,7 +18671,6 @@
       "name": "manifest-frontend",
       "version": "0.1.0",
       "dependencies": {
-        "@better-auth/stripe": "1.7.4",
         "@solidjs/meta": "^0.29.4",
         "@solidjs/router": "^0.16.2",
         "better-auth": "1.7.4",
@@ -18803,22 +18802,6 @@
         }
       }
     },
-    "packages/frontend/node_modules/@better-auth/stripe": {
-      "version": "1.7.4",
-      "resolved": "https://registry.npmjs.org/@better-auth/stripe/-/stripe-1.7.4.tgz",
-      "integrity": "sha512-mjKfpxfYSeyma2B3jheDVJ8/SlINf9VDWTa+7Ty1Q/TboAHUGVOLaNdBlqoFY9V2Fvg80DvPhxsFVk8+ZXXNtw==",
-      "license": "MIT",
-      "dependencies": {
-        "defu": "^6.1.5",
-        "zod": "^4.5.4"
-      },
-      "peerDependencies": {
-        "@better-auth/core": "^1.7.4",
-        "better-auth": "^1.7.4",
-        "better-call": "1.4.0",
-        "stripe": "^18 || ^19 || ^20 || ^21 || ^22"
-      }
-    },
     "packages/frontend/node_modules/@better-auth/telemetry": {
       "version": "1.7.4",
       "resolved": "https://registry.npmjs.org/@better-auth/telemetry/-/telemetry-1.7.4.tgz",
diff --git a/packages/frontend/package.json b/packages/frontend/package.json
index 06b6566d..7ac06fec 100644
--- a/packages/frontend/package.json
+++ b/packages/frontend/package.json
@@ -12,7 +12,6 @@
     "lint": "eslint src/"
   },
   "dependencies": {
-    "@better-auth/stripe": "1.7.4",
     "@solidjs/meta": "^0.29.4",
     "@solidjs/router": "^0.16.2",
     "better-auth": "1.7.4",
diff --git a/packages/frontend/public/api-bot-works-with-any-api.svg b/packages/frontend/public/api-bot-works-with-any-api.svg
deleted file mode 100644
index 32351ab0..00000000
--- a/packages/frontend/public/api-bot-works-with-any-api.svg
+++ /dev/null
@@ -1,612 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="1600" height="720" viewBox="0 0 1600 720">
-<defs>
-<clipPath id="clip-0">
-<path clip-rule="nonzero" d="M 0 0 L 140 0 L 140 84 L 0 84 Z M 0 0 "/>
-</clipPath>
-<clipPath id="clip-1">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-2">
-<path clip-rule="nonzero" d="M 0 0 L 80 0 L 80 17 L 0 17 Z M 0 0 "/>
-</clipPath>
-<clipPath id="clip-3">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-4">
-<path clip-rule="nonzero" d="M 180 0 L 396 0 L 396 84 L 180 84 Z M 180 0 "/>
-</clipPath>
-<clipPath id="clip-5">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-6">
-<path clip-rule="nonzero" d="M 243 0 L 333 0 L 333 24 L 243 24 Z M 243 0 "/>
-</clipPath>
-<clipPath id="clip-7">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-8">
-<path clip-rule="nonzero" d="M 436 0 L 652 0 L 652 84 L 436 84 Z M 436 0 "/>
-</clipPath>
-<clipPath id="clip-9">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-10">
-<path clip-rule="nonzero" d="M 496 0 L 592 0 L 592 21 L 496 21 Z M 496 0 "/>
-</clipPath>
-<clipPath id="clip-11">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-12">
-<path clip-rule="nonzero" d="M 692 0 L 908 0 L 908 84 L 692 84 Z M 692 0 "/>
-</clipPath>
-<clipPath id="clip-13">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-14">
-<path clip-rule="nonzero" d="M 752 0 L 848 0 L 848 24 L 752 24 Z M 752 0 "/>
-</clipPath>
-<clipPath id="clip-15">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-16">
-<path clip-rule="nonzero" d="M 948 0 L 1164 0 L 1164 84 L 948 84 Z M 948 0 "/>
-</clipPath>
-<clipPath id="clip-17">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-18">
-<path clip-rule="nonzero" d="M 1008 0 L 1104 0 L 1104 19 L 1008 19 Z M 1008 0 "/>
-</clipPath>
-<clipPath id="clip-19">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-20">
-<path clip-rule="nonzero" d="M 1204 0 L 1420 0 L 1420 84 L 1204 84 Z M 1204 0 "/>
-</clipPath>
-<clipPath id="clip-21">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-22">
-<path clip-rule="nonzero" d="M 1264 0 L 1360 0 L 1360 24 L 1264 24 Z M 1264 0 "/>
-</clipPath>
-<clipPath id="clip-23">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-24">
-<path clip-rule="nonzero" d="M 1460 0 L 1600 0 L 1600 84 L 1460 84 Z M 1460 0 "/>
-</clipPath>
-<clipPath id="clip-25">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-26">
-<path clip-rule="nonzero" d="M 0 124 L 140 124 L 140 340 L 0 340 Z M 0 124 "/>
-</clipPath>
-<clipPath id="clip-27">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-28">
-<path clip-rule="nonzero" d="M 0 184 L 80 184 L 80 280 L 0 280 Z M 0 184 "/>
-</clipPath>
-<clipPath id="clip-29">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-30">
-<path clip-rule="nonzero" d="M 180 124 L 396 124 L 396 340 L 180 340 Z M 180 124 "/>
-</clipPath>
-<clipPath id="clip-31">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-32">
-<path clip-rule="nonzero" d="M 241 184 L 335 184 L 335 280 L 241 280 Z M 241 184 "/>
-</clipPath>
-<clipPath id="clip-33">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-34">
-<path clip-rule="nonzero" d="M 436 124 L 652 124 L 652 340 L 436 340 Z M 436 124 "/>
-</clipPath>
-<clipPath id="clip-35">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-36">
-<path clip-rule="nonzero" d="M 497 184 L 591 184 L 591 280 L 497 280 Z M 497 184 "/>
-</clipPath>
-<clipPath id="clip-37">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-38">
-<path clip-rule="nonzero" d="M 692 124 L 908 124 L 908 340 L 692 340 Z M 692 124 "/>
-</clipPath>
-<clipPath id="clip-39">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-40">
-<path clip-rule="nonzero" d="M 752 184 L 848 184 L 848 280 L 752 280 Z M 752 184 "/>
-</clipPath>
-<clipPath id="clip-41">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-42">
-<path clip-rule="nonzero" d="M 948 124 L 1164 124 L 1164 340 L 948 340 Z M 948 124 "/>
-</clipPath>
-<clipPath id="clip-43">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-44">
-<path clip-rule="nonzero" d="M 1010 184 L 1102 184 L 1102 280 L 1010 280 Z M 1010 184 "/>
-</clipPath>
-<clipPath id="clip-45">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-46">
-<path clip-rule="nonzero" d="M 1204 124 L 1420 124 L 1420 340 L 1204 340 Z M 1204 124 "/>
-</clipPath>
-<clipPath id="clip-47">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-48">
-<path clip-rule="nonzero" d="M 1278 184 L 1346 184 L 1346 280 L 1278 280 Z M 1278 184 "/>
-</clipPath>
-<clipPath id="clip-49">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-50">
-<path clip-rule="nonzero" d="M 1460 124 L 1600 124 L 1600 340 L 1460 340 Z M 1460 124 "/>
-</clipPath>
-<clipPath id="clip-51">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-52">
-<path clip-rule="nonzero" d="M 1527 184 L 1600 184 L 1600 280 L 1527 280 Z M 1527 184 "/>
-</clipPath>
-<clipPath id="clip-53">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-54">
-<path clip-rule="nonzero" d="M 0 380 L 140 380 L 140 596 L 0 596 Z M 0 380 "/>
-</clipPath>
-<clipPath id="clip-55">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-56">
-<path clip-rule="nonzero" d="M 0 440 L 78 440 L 78 536 L 0 536 Z M 0 440 "/>
-</clipPath>
-<clipPath id="clip-57">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-58">
-<path clip-rule="nonzero" d="M 180 380 L 396 380 L 396 596 L 180 596 Z M 180 380 "/>
-</clipPath>
-<clipPath id="clip-59">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-60">
-<path clip-rule="nonzero" d="M 240 451 L 336 451 L 336 525 L 240 525 Z M 240 451 "/>
-</clipPath>
-<clipPath id="clip-61">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-62">
-<path clip-rule="nonzero" d="M 436 380 L 652 380 L 652 596 L 436 596 Z M 436 380 "/>
-</clipPath>
-<clipPath id="clip-63">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-64">
-<path clip-rule="nonzero" d="M 496 441 L 592 441 L 592 535 L 496 535 Z M 496 441 "/>
-</clipPath>
-<clipPath id="clip-65">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-66">
-<path clip-rule="nonzero" d="M 696 384 L 904 384 L 904 592 L 696 592 Z M 696 384 "/>
-</clipPath>
-<clipPath id="clip-67">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-68">
-<path clip-rule="nonzero" d="M 650 338 L 950 338 L 950 638 L 650 638 Z M 650 338 "/>
-</clipPath>
-<clipPath id="clip-69">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-70">
-<path clip-rule="nonzero" d="M 737 456 L 863 456 L 863 527 L 737 527 Z M 737 456 "/>
-</clipPath>
-<clipPath id="clip-71">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-72">
-<path clip-rule="nonzero" d="M 948 380 L 1164 380 L 1164 596 L 948 596 Z M 948 380 "/>
-</clipPath>
-<clipPath id="clip-73">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-74">
-<path clip-rule="nonzero" d="M 1022 440 L 1090 440 L 1090 536 L 1022 536 Z M 1022 440 "/>
-</clipPath>
-<clipPath id="clip-75">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-76">
-<path clip-rule="nonzero" d="M 1204 380 L 1420 380 L 1420 596 L 1204 596 Z M 1204 380 "/>
-</clipPath>
-<clipPath id="clip-77">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-78">
-<path clip-rule="nonzero" d="M 1264 440 L 1360 440 L 1360 536 L 1264 536 Z M 1264 440 "/>
-</clipPath>
-<clipPath id="clip-79">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-80">
-<path clip-rule="nonzero" d="M 1460 380 L 1600 380 L 1600 596 L 1460 596 Z M 1460 380 "/>
-</clipPath>
-<clipPath id="clip-81">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-82">
-<path clip-rule="nonzero" d="M 1520 446 L 1600 446 L 1600 530 L 1520 530 Z M 1520 446 "/>
-</clipPath>
-<clipPath id="clip-83">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-84">
-<path clip-rule="nonzero" d="M 0 636 L 140 636 L 140 720 L 0 720 Z M 0 636 "/>
-</clipPath>
-<clipPath id="clip-85">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-86">
-<path clip-rule="nonzero" d="M 0 696 L 79 696 L 79 720 L 0 720 Z M 0 696 "/>
-</clipPath>
-<clipPath id="clip-87">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-88">
-<path clip-rule="nonzero" d="M 180 636 L 396 636 L 396 720 L 180 720 Z M 180 636 "/>
-</clipPath>
-<clipPath id="clip-89">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-90">
-<path clip-rule="nonzero" d="M 240 703 L 336 703 L 336 720 L 240 720 Z M 240 703 "/>
-</clipPath>
-<clipPath id="clip-91">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-92">
-<path clip-rule="nonzero" d="M 436 636 L 652 636 L 652 720 L 436 720 Z M 436 636 "/>
-</clipPath>
-<clipPath id="clip-93">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-94">
-<path clip-rule="nonzero" d="M 496 707 L 592 707 L 592 720 L 496 720 Z M 496 707 "/>
-</clipPath>
-<clipPath id="clip-95">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-96">
-<path clip-rule="nonzero" d="M 692 636 L 908 636 L 908 720 L 692 720 Z M 692 636 "/>
-</clipPath>
-<clipPath id="clip-97">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-98">
-<path clip-rule="nonzero" d="M 948 636 L 1164 636 L 1164 720 L 948 720 Z M 948 636 "/>
-</clipPath>
-<clipPath id="clip-99">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-100">
-<path clip-rule="nonzero" d="M 1034 696 L 1078 696 L 1078 720 L 1034 720 Z M 1034 696 "/>
-</clipPath>
-<clipPath id="clip-101">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-102">
-<path clip-rule="nonzero" d="M 1204 636 L 1420 636 L 1420 720 L 1204 720 Z M 1204 636 "/>
-</clipPath>
-<clipPath id="clip-103">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-104">
-<path clip-rule="nonzero" d="M 1270 696 L 1354 696 L 1354 720 L 1270 720 Z M 1270 696 "/>
-</clipPath>
-<clipPath id="clip-105">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-106">
-<path clip-rule="nonzero" d="M 1460 636 L 1600 636 L 1600 720 L 1460 720 Z M 1460 636 "/>
-</clipPath>
-<clipPath id="clip-107">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-<clipPath id="clip-108">
-<path clip-rule="nonzero" d="M 1520 696 L 1600 696 L 1600 720 L 1520 720 Z M 1520 696 "/>
-</clipPath>
-<clipPath id="clip-109">
-<path clip-rule="nonzero" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-</clipPath>
-</defs>
-<path fill-rule="nonzero" fill="rgb(4.705882%, 7.058824%, 5.882353%)" fill-opacity="1" d="M 56 0 L 1544 0 C 1574.929688 0 1600 25.070312 1600 56 L 1600 664 C 1600 694.929688 1574.929688 720 1544 720 L 56 720 C 25.070312 720 0 694.929688 0 664 L 0 56 C 0 25.070312 25.070312 0 56 0 Z M 56 0 "/>
-<g clip-path="url(#clip-0)">
-<g clip-path="url(#clip-1)">
-<path fill-rule="nonzero" fill="rgb(0%, 38.039216%, 100%)" fill-opacity="1" d="M -22 -132 L 86 -132 C 115.824219 -132 140 -107.824219 140 -78 L 140 30 C 140 59.824219 115.824219 84 86 84 L -22 84 C -51.824219 84 -76 59.824219 -76 30 L -76 -78 C -76 -107.824219 -51.824219 -132 -22 -132 Z M -22 -132 "/>
-</g>
-</g>
-<g clip-path="url(#clip-2)">
-<g clip-path="url(#clip-3)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 8 -64.773438 L -16 -49.484375 L 8 -34.195312 L 32.003906 -49.484375 Z M 56 -64.773438 L 32 -49.484375 L 56 -34.195312 L 80 -49.484375 Z M -16 -18.902344 L 8 -3.617188 L 32.003906 -18.902344 L 8 -34.191406 Z M 56 -34.191406 L 32 -18.902344 L 56 -3.617188 L 80 -18.902344 Z M 8 1.484375 L 32.003906 16.773438 L 56.003906 1.484375 L 32.003906 -13.804688 Z M 8 1.484375 "/>
-</g>
-</g>
-<g clip-path="url(#clip-4)">
-<g clip-path="url(#clip-5)">
-<path fill-rule="nonzero" fill="rgb(38.823529%, 17.254902%, 65.098039%)" fill-opacity="1" d="M 234 -132 L 342 -132 C 371.824219 -132 396 -107.824219 396 -78 L 396 30 C 396 59.824219 371.824219 84 342 84 L 234 84 C 204.175781 84 180 59.824219 180 30 L 180 -78 C 180 -107.824219 204.175781 -132 234 -132 Z M 234 -132 "/>
-</g>
-</g>
-<g clip-path="url(#clip-6)">
-<g clip-path="url(#clip-7)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 318.28125 -3.839844 L 310.292969 -9.105469 L 303.632812 2.023438 L 295.882812 -0.242188 L 289.058594 10.171875 L 289.40625 13.453125 L 326.503906 6.613281 L 324.351562 -16.5625 Z M 283.683594 -13.832031 L 289.636719 -14.648438 C 290.601562 -14.214844 291.273438 -14.046875 292.425781 -13.757812 C 294.222656 -13.289062 296.304688 -12.835938 299.386719 -14.394531 C 300.109375 -14.746094 301.601562 -16.117188 302.203125 -16.894531 L 326.589844 -21.320312 L 329.074219 8.789062 L 287.300781 16.316406 Z M 328.984375 -24.679688 L 326.574219 -24.21875 L 321.953125 -72 L 243.15625 -62.859375 L 252.863281 15.910156 L 262.089844 14.574219 C 261.351562 13.523438 260.203125 12.253906 258.246094 10.621094 C 255.527344 8.363281 256.488281 4.53125 258.09375 2.113281 C 260.210938 -1.976562 271.132812 -7.175781 270.515625 -13.710938 C 270.292969 -16.089844 269.914062 -19.183594 267.707031 -21.304688 C 267.628906 -20.425781 267.777344 -19.574219 267.777344 -19.574219 C 267.777344 -19.574219 266.867188 -20.730469 266.414062 -22.308594 C 265.96875 -22.90625 265.617188 -23.105469 265.140625 -23.90625 C 264.800781 -22.976562 264.847656 -21.894531 264.847656 -21.894531 C 264.847656 -21.894531 264.105469 -23.644531 263.984375 -25.125 C 263.542969 -24.460938 263.4375 -23.203125 263.4375 -23.203125 C 263.4375 -23.203125 262.472656 -25.964844 262.691406 -27.453125 C 262.253906 -28.742188 260.949219 -31.3125 261.320312 -37.148438 C 263.71875 -35.464844 269.015625 -35.863281 271.078125 -38.902344 C 271.765625 -39.90625 272.230469 -42.660156 270.734375 -48.074219 C 269.777344 -51.546875 267.394531 -56.714844 266.472656 -58.679688 L 266.359375 -58.601562 C 266.847656 -57.019531 267.855469 -53.707031 268.238281 -52.101562 C 269.410156 -47.226562 269.726562 -45.53125 269.175781 -43.285156 C 268.710938 -41.332031 267.589844 -40.050781 264.746094 -38.625 C 261.90625 -37.191406 258.136719 -40.679688 257.894531 -40.871094 C 255.136719 -43.070312 253 -46.660156 252.761719 -48.402344 C 252.511719 -50.3125 253.859375 -51.457031 254.539062 -53.015625 C 253.566406 -52.734375 252.484375 -52.246094 252.484375 -52.246094 C 252.484375 -52.246094 253.777344 -53.585938 255.371094 -54.742188 C 256.03125 -55.179688 256.421875 -55.457031 257.117188 -56.035156 C 256.507812 -56.046875 255.898438 -56.042969 255.292969 -56.023438 C 255.292969 -56.023438 256.972656 -56.933594 258.710938 -57.59375 C 257.441406 -57.648438 256.21875 -57.605469 256.21875 -57.605469 C 256.21875 -57.605469 259.96875 -59.28125 262.933594 -60.511719 C 264.96875 -61.34375 266.957031 -61.101562 268.074219 -59.484375 C 269.542969 -57.363281 271.085938 -56.214844 274.351562 -55.5 C 276.355469 -56.390625 276.964844 -56.847656 279.488281 -57.535156 C 281.703125 -59.976562 283.449219 -60.289062 283.449219 -60.289062 C 283.449219 -60.289062 282.585938 -59.496094 282.351562 -58.246094 C 283.609375 -59.242188 284.992188 -60.066406 284.992188 -60.066406 C 284.992188 -60.066406 284.457031 -59.410156 283.957031 -58.363281 L 284.074219 -58.191406 C 285.539062 -59.070312 287.265625 -59.769531 287.265625 -59.769531 C 287.265625 -59.769531 286.773438 -59.144531 286.191406 -58.335938 C 287.300781 -58.34375 289.542969 -58.289062 290.414062 -58.1875 C 295.554688 -58.074219 296.625 -63.683594 298.597656 -64.386719 C 301.066406 -65.269531 302.171875 -65.800781 306.382812 -61.667969 C 309.996094 -58.117188 312.820312 -51.761719 311.421875 -50.335938 C 310.242188 -49.15625 307.925781 -50.796875 305.355469 -54 C 303.890625 -55.808594 302.90625 -57.957031 302.492188 -60.246094 C 302.222656 -61.570312 301.523438 -62.765625 300.503906 -63.648438 C 300.503906 -63.648438 301.425781 -61.609375 301.425781 -59.808594 C 301.425781 -58.824219 301.542969 -55.148438 303.121094 -53.089844 C 302.964844 -52.785156 302.890625 -51.59375 302.71875 -51.367188 C 300.886719 -53.585938 296.949219 -55.167969 296.304688 -55.636719 C 298.480469 -53.855469 303.476562 -49.765625 305.394531 -45.839844 C 307.207031 -42.132812 306.140625 -38.730469 307.058594 -37.851562 C 307.320312 -37.601562 310.964844 -33.0625 311.660156 -30.785156 C 312.882812 -26.808594 311.734375 -22.632812 310.136719 -20.042969 L 305.667969 -19.347656 C 305.015625 -19.527344 304.574219 -19.621094 303.988281 -19.960938 C 304.308594 -20.53125 304.953125 -21.960938 304.960938 -22.246094 L 304.707031 -22.691406 C 303.316406 -20.722656 300.988281 -18.8125 299.050781 -17.710938 C 296.519531 -16.277344 293.601562 -16.496094 291.699219 -17.089844 C 286.308594 -18.746094 281.207031 -22.394531 279.980469 -23.351562 C 279.980469 -23.351562 279.941406 -22.589844 280.171875 -22.414062 C 281.53125 -20.882812 284.648438 -18.109375 287.660156 -16.175781 L 281.238281 -15.46875 L 284.277344 8.164062 C 282.929688 8.355469 282.714844 8.449219 281.246094 8.660156 C 279.949219 4.070312 277.464844 1.078125 274.753906 -0.667969 C 272.355469 -2.203125 269.054688 -2.546875 265.894531 -1.925781 L 265.695312 -1.6875 C 268.308594 -1.972656 270.941406 -1.34375 273.148438 0.0898438 C 275.765625 1.738281 277.871094 6.011719 278.648438 8.585938 C 279.640625 11.871094 280.328125 15.382812 277.65625 19.113281 C 275.753906 21.761719 270.199219 23.222656 265.710938 20.058594 C 266.910156 21.984375 268.53125 23.5625 270.710938 23.859375 C 273.949219 24.300781 277.019531 23.738281 279.136719 21.5625 C 280.945312 19.707031 281.894531 15.828125 281.648438 11.738281 L 284.503906 11.324219 L 285.535156 18.660156 L 332.84375 12.964844 Z M 300.199219 -44.609375 C 300.0625 -44.308594 299.859375 -44.109375 300.171875 -43.128906 L 300.1875 -43.070312 L 300.238281 -42.945312 L 300.367188 -42.652344 C 300.929688 -41.503906 301.546875 -40.421875 302.574219 -39.867188 C 302.84375 -39.910156 303.121094 -39.945312 303.402344 -39.960938 C 304.371094 -40 304.984375 -39.847656 305.371094 -39.640625 C 305.40625 -39.832031 305.410156 -40.117188 305.390625 -40.527344 C 305.320312 -41.984375 305.679688 -44.457031 302.886719 -45.761719 C 301.832031 -46.246094 300.351562 -46.097656 299.859375 -45.488281 C 299.9375 -45.476562 300.015625 -45.460938 300.09375 -45.4375 C 300.835938 -45.171875 300.332031 -44.914062 300.199219 -44.609375 M 308.03125 -31.039062 C 307.664062 -31.238281 305.953125 -31.160156 304.746094 -31.019531 C 302.453125 -30.746094 299.976562 -29.953125 299.4375 -29.53125 C 298.449219 -28.769531 298.894531 -27.441406 299.625 -26.890625 C 301.667969 -25.363281 303.464844 -24.339844 305.351562 -24.59375 C 306.511719 -24.742188 307.535156 -26.578125 308.265625 -28.246094 C 308.761719 -29.398438 308.761719 -30.640625 308.03125 -31.039062 M 287.722656 -42.808594 C 288.371094 -43.425781 284.503906 -44.226562 281.5 -42.183594 C 279.285156 -40.671875 279.214844 -37.4375 281.335938 -35.601562 C 281.546875 -35.414062 281.71875 -35.289062 281.882812 -35.183594 C 283.648438 -36.015625 285.535156 -36.570312 287.46875 -36.832031 C 287.921875 -37.332031 288.441406 -38.210938 288.308594 -39.8125 C 288.132812 -41.980469 286.488281 -41.636719 287.722656 -42.808594 "/>
-</g>
-</g>
-<g clip-path="url(#clip-8)">
-<g clip-path="url(#clip-9)">
-<path fill-rule="nonzero" fill="rgb(94.117647%, 41.568627%, 41.568627%)" fill-opacity="1" d="M 490 -132 L 598 -132 C 627.824219 -132 652 -107.824219 652 -78 L 652 30 C 652 59.824219 627.824219 84 598 84 L 490 84 C 460.175781 84 436 59.824219 436 30 L 436 -78 C 436 -107.824219 460.175781 -132 490 -132 Z M 490 -132 "/>
-</g>
-</g>
-<g clip-path="url(#clip-10)">
-<g clip-path="url(#clip-11)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 571.121094 -21.386719 C 559.59375 -21.386719 550.238281 -12.042969 550.238281 -0.507812 C 550.238281 11.027344 559.59375 20.371094 571.121094 20.371094 C 582.648438 20.371094 592 11.011719 592 -0.507812 C 592 -12.027344 582.65625 -21.386719 571.121094 -21.386719 Z M 516.878906 -21.386719 C 505.359375 -21.386719 496 -12.039062 496 -0.507812 C 496 11.023438 505.351562 20.371094 516.878906 20.371094 C 528.40625 20.371094 537.761719 11.019531 537.761719 -0.507812 C 537.761719 -12.035156 528.414062 -21.386719 516.878906 -21.386719 Z M 564.878906 -47.488281 C 564.878906 -35.957031 555.53125 -26.609375 544 -26.609375 C 532.472656 -26.609375 523.121094 -35.957031 523.121094 -47.488281 C 523.121094 -59.007812 532.472656 -68.367188 544 -68.367188 C 555.53125 -68.367188 564.878906 -59.007812 564.878906 -47.488281 Z M 564.878906 -47.488281 "/>
-</g>
-</g>
-<g clip-path="url(#clip-12)">
-<g clip-path="url(#clip-13)">
-<path fill-rule="nonzero" fill="rgb(0%, 32.156863%, 80%)" fill-opacity="1" d="M 746 -132 L 854 -132 C 883.824219 -132 908 -107.824219 908 -78 L 908 30 C 908 59.824219 883.824219 84 854 84 L 746 84 C 716.175781 84 692 59.824219 692 30 L 692 -78 C 692 -107.824219 716.175781 -132 746 -132 Z M 746 -132 "/>
-</g>
-</g>
-<g clip-path="url(#clip-14)">
-<g clip-path="url(#clip-15)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 836.589844 -72 L 763.410156 -72 C 757.117188 -71.984375 752.015625 -66.882812 752 -60.589844 L 752 12.589844 C 752.015625 18.882812 757.117188 23.984375 763.410156 24 L 836.589844 24 C 842.882812 23.984375 847.984375 18.882812 848 12.589844 L 848 -60.589844 C 847.984375 -66.882812 842.882812 -71.984375 836.589844 -72 Z M 793.359375 -2.851562 C 793.359375 -0.746094 791.652344 0.960938 789.546875 0.960938 L 773.546875 0.960938 C 771.441406 0.960938 769.734375 -0.746094 769.730469 -2.851562 L 769.730469 -50.480469 C 769.730469 -51.492188 770.132812 -52.460938 770.851562 -53.175781 C 771.566406 -53.890625 772.535156 -54.292969 773.546875 -54.292969 L 789.546875 -54.292969 C 791.652344 -54.289062 793.359375 -52.585938 793.359375 -50.480469 Z M 830.292969 -24.71875 C 830.296875 -23.710938 829.894531 -22.742188 829.175781 -22.03125 C 828.460938 -21.316406 827.488281 -20.921875 826.480469 -20.933594 L 810.480469 -20.933594 C 809.472656 -20.925781 808.5 -21.320312 807.785156 -22.03125 C 807.070312 -22.742188 806.667969 -23.710938 806.667969 -24.71875 L 806.667969 -50.480469 C 806.667969 -52.585938 808.375 -54.292969 810.480469 -54.292969 L 826.480469 -54.292969 C 828.585938 -54.289062 830.289062 -52.585938 830.292969 -50.480469 Z M 830.292969 -24.71875 "/>
-</g>
-</g>
-<g clip-path="url(#clip-16)">
-<g clip-path="url(#clip-17)">
-<path fill-rule="nonzero" fill="rgb(21.176471%, 17.647059%, 34.901961%)" fill-opacity="1" d="M 1002 -132 L 1110 -132 C 1139.824219 -132 1164 -107.824219 1164 -78 L 1164 30 C 1164 59.824219 1139.824219 84 1110 84 L 1002 84 C 972.175781 84 948 59.824219 948 30 L 948 -78 C 948 -107.824219 972.175781 -132 1002 -132 Z M 1002 -132 "/>
-</g>
-</g>
-<g clip-path="url(#clip-18)">
-<g clip-path="url(#clip-19)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 1063.640625 -61.980469 C 1060.148438 -67.773438 1051.753906 -67.773438 1048.265625 -61.980469 L 1035.617188 -40.320312 C 1055.277344 -30.503906 1068.261719 -11.003906 1069.734375 10.925781 L 1060.851562 10.925781 C 1059.382812 -7.867188 1048.078125 -24.480469 1031.136719 -32.742188 L 1019.433594 -12.503906 C 1028.945312 -8.238281 1035.628906 0.578125 1037.171875 10.886719 L 1016.777344 10.886719 C 1016.285156 10.855469 1015.84375 10.574219 1015.601562 10.144531 C 1015.359375 9.710938 1015.355469 9.1875 1015.585938 8.753906 L 1021.234375 -0.855469 C 1019.320312 -2.453125 1017.136719 -3.691406 1014.78125 -4.507812 L 1009.183594 5.101562 C 1008.007812 7.117188 1007.6875 9.523438 1008.300781 11.777344 C 1008.910156 14.03125 1010.398438 15.949219 1012.433594 17.097656 C 1013.757812 17.84375 1015.253906 18.238281 1016.777344 18.246094 L 1044.707031 18.246094 C 1045.761719 5.230469 1039.929688 -7.390625 1029.328125 -15.023438 L 1033.769531 -22.710938 C 1047.148438 -13.523438 1054.679688 2.054688 1053.566406 18.246094 L 1077.226562 18.246094 C 1078.347656 -6.289062 1066.335938 -29.566406 1045.6875 -42.871094 L 1054.664062 -58.253906 C 1055.078125 -58.949219 1055.980469 -59.179688 1056.679688 -58.773438 C 1057.699219 -58.210938 1095.679688 8.058594 1096.390625 8.828125 C 1096.648438 9.285156 1096.636719 9.84375 1096.367188 10.292969 C 1096.097656 10.742188 1095.609375 11.011719 1095.085938 11 L 1085.9375 11 C 1086.050781 13.449219 1086.050781 15.890625 1085.9375 18.324219 L 1095.125 18.324219 C 1098.285156 18.339844 1101.214844 16.664062 1102.804688 13.929688 C 1104.390625 11.195312 1104.394531 7.820312 1102.8125 5.085938 Z M 1063.640625 -61.980469 "/>
-</g>
-</g>
-<g clip-path="url(#clip-20)">
-<g clip-path="url(#clip-21)">
-<path fill-rule="nonzero" fill="rgb(0%, 23.921569%, 100%)" fill-opacity="1" d="M 1258 -132 L 1366 -132 C 1395.824219 -132 1420 -107.824219 1420 -78 L 1420 30 C 1420 59.824219 1395.824219 84 1366 84 L 1258 84 C 1228.175781 84 1204 59.824219 1204 30 L 1204 -78 C 1204 -107.824219 1228.175781 -132 1258 -132 Z M 1258 -132 "/>
-</g>
-</g>
-<g clip-path="url(#clip-22)">
-<g clip-path="url(#clip-23)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 1312 -72 C 1285.78125 -72 1264.410156 -50.859375 1264.039062 -24.730469 C 1263.652344 1.804688 1285.179688 23.792969 1311.71875 23.949219 C 1319.785156 24.011719 1327.734375 22.023438 1334.820312 18.175781 C 1335.140625 18 1335.359375 17.679688 1335.398438 17.316406 C 1335.441406 16.953125 1335.300781 16.589844 1335.027344 16.347656 L 1330.539062 12.371094 C 1329.628906 11.558594 1328.332031 11.339844 1327.207031 11.8125 C 1322.25 13.917969 1316.902344 14.96875 1311.515625 14.890625 C 1290.074219 14.625 1272.746094 -3.214844 1273.089844 -24.660156 C 1273.425781 -45.832031 1290.757812 -62.953125 1312.007812 -62.953125 L 1350.929688 -62.953125 L 1350.929688 6.230469 L 1328.839844 -13.394531 C 1328.5 -13.695312 1328.046875 -13.839844 1327.59375 -13.792969 C 1327.140625 -13.746094 1326.726562 -13.511719 1326.457031 -13.144531 C 1322.769531 -8.238281 1316.84375 -5.535156 1310.71875 -5.972656 C 1301.78125 -6.628906 1294.660156 -13.710938 1293.953125 -22.644531 C 1293.570312 -27.667969 1295.300781 -32.625 1298.726562 -36.324219 C 1302.148438 -40.023438 1306.960938 -42.125 1312 -42.132812 C 1321.375 -42.121094 1329.195312 -34.964844 1330.035156 -25.628906 C 1330.109375 -24.808594 1330.476562 -24.039062 1331.097656 -23.496094 L 1336.847656 -18.394531 C 1337.148438 -18.125 1337.574219 -18.039062 1337.957031 -18.171875 C 1338.339844 -18.300781 1338.621094 -18.628906 1338.695312 -19.027344 C 1339.121094 -21.300781 1339.253906 -23.621094 1339.09375 -25.929688 C 1338.164062 -39.433594 1327.226562 -50.296875 1313.710938 -51.128906 C 1298.21875 -52.089844 1285.273438 -39.96875 1284.855469 -24.777344 C 1284.457031 -9.976562 1296.589844 2.792969 1311.390625 3.121094 C 1317.324219 3.261719 1323.140625 1.441406 1327.9375 -2.054688 L 1356.785156 23.519531 C 1357.351562 24.019531 1358.15625 24.136719 1358.84375 23.828125 C 1359.53125 23.519531 1359.972656 22.832031 1359.972656 22.078125 L 1359.972656 -70.175781 C 1359.972656 -71.179688 1359.164062 -71.992188 1358.160156 -72 Z M 1312 -72 "/>
-</g>
-</g>
-<g clip-path="url(#clip-24)">
-<g clip-path="url(#clip-25)">
-<path fill-rule="nonzero" fill="rgb(4.313725%, 36.078431%, 100%)" fill-opacity="1" d="M 1514 -132 L 1622 -132 C 1651.824219 -132 1676 -107.824219 1676 -78 L 1676 30 C 1676 59.824219 1651.824219 84 1622 84 L 1514 84 C 1484.175781 84 1460 59.824219 1460 30 L 1460 -78 C 1460 -107.824219 1484.175781 -132 1514 -132 Z M 1514 -132 "/>
-</g>
-</g>
-<g clip-path="url(#clip-26)">
-<g clip-path="url(#clip-27)">
-<path fill-rule="nonzero" fill="rgb(12.156863%, 55.294118%, 92.941176%)" fill-opacity="1" d="M -22 124 L 86 124 C 115.824219 124 140 148.175781 140 178 L 140 286 C 140 315.824219 115.824219 340 86 340 L -22 340 C -51.824219 340 -76 315.824219 -76 286 L -76 178 C -76 148.175781 -51.824219 124 -22 124 Z M -22 124 "/>
-</g>
-</g>
-<g clip-path="url(#clip-28)">
-<g clip-path="url(#clip-29)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 68 184 L -4 184 C -10.628906 184 -16 189.371094 -16 196 L -16 268 C -16 274.632812 -10.628906 280 -4 280 L 68 280 C 74.632812 280 80 274.632812 80 268 L 80 196 C 80 189.371094 74.632812 184 68 184 Z M 44.796875 201.597656 C 44.796875 199.835938 46.234375 198.394531 48.003906 198.394531 C 49.765625 198.394531 51.203125 199.835938 51.203125 201.597656 L 51.203125 244.347656 C 51.203125 246.117188 49.765625 247.550781 48.003906 247.550781 C 46.230469 247.550781 44.796875 246.117188 44.796875 244.347656 Z M 28.800781 199.976562 C 28.800781 198.214844 30.226562 196.78125 32 196.78125 C 33.773438 196.78125 35.199219 198.214844 35.199219 199.976562 L 35.199219 246.382812 C 35.199219 248.144531 33.773438 249.585938 32 249.585938 C 30.226562 249.585938 28.800781 248.144531 28.800781 246.382812 Z M 12.800781 201.597656 C 12.800781 199.835938 14.234375 198.394531 15.996094 198.394531 C 17.769531 198.394531 19.203125 199.835938 19.203125 201.597656 L 19.203125 244.347656 C 19.203125 246.117188 17.765625 247.550781 15.996094 247.550781 C 14.234375 247.550781 12.800781 246.117188 12.800781 244.347656 Z M -3.203125 208 C -3.203125 206.230469 -1.765625 204.800781 0.00390625 204.800781 C 1.765625 204.800781 3.199219 206.230469 3.199219 208 L 3.199219 236.78125 C 3.199219 238.542969 1.765625 239.980469 0.00390625 239.980469 C -1.769531 239.980469 -3.203125 238.539062 -3.203125 236.78125 Z M 66.078125 256.808594 C 65.589844 257.226562 53.734375 267.179688 32 267.179688 C 10.269531 267.179688 -1.589844 257.234375 -2.085938 256.808594 C -3.425781 255.65625 -3.585938 253.640625 -2.429688 252.296875 C -1.289062 250.960938 0.730469 250.796875 2.070312 251.9375 C 2.261719 252.101562 12.84375 260.78125 31.996094 260.78125 C 51.386719 260.78125 61.820312 252.035156 61.910156 251.953125 C 63.246094 250.796875 65.269531 250.953125 66.425781 252.296875 C 67.578125 253.640625 67.425781 255.65625 66.078125 256.808594 Z M 67.203125 236.78125 C 67.203125 238.542969 65.765625 239.980469 64 239.980469 C 62.234375 239.980469 60.796875 238.539062 60.796875 236.78125 L 60.796875 208 C 60.796875 206.230469 62.238281 204.800781 64 204.800781 C 65.765625 204.800781 67.203125 206.226562 67.203125 208 Z M 67.203125 236.78125 "/>
-</g>
-</g>
-<g clip-path="url(#clip-30)">
-<g clip-path="url(#clip-31)">
-<path fill-rule="nonzero" fill="rgb(9.803922%, 9.803922%, 9.803922%)" fill-opacity="1" d="M 234 124 L 342 124 C 371.824219 124 396 148.175781 396 178 L 396 286 C 396 315.824219 371.824219 340 342 340 L 234 340 C 204.175781 340 180 315.824219 180 286 L 180 178 C 180 148.175781 204.175781 124 234 124 Z M 234 124 "/>
-</g>
-</g>
-<g clip-path="url(#clip-32)">
-<g clip-path="url(#clip-33)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 257.835938 200.832031 C 260.820312 203.257812 261.941406 203.070312 267.546875 202.695312 L 320.40625 199.523438 C 321.527344 199.523438 320.597656 198.402344 320.222656 198.21875 L 311.441406 191.871094 C 309.761719 190.566406 307.515625 189.070312 303.21875 189.445312 L 252.039062 193.179688 C 250.175781 193.363281 249.800781 194.300781 250.542969 195.042969 Z M 261.007812 213.152344 L 261.007812 268.769531 C 261.007812 271.757812 262.5 272.875 265.863281 272.6875 L 323.957031 269.328125 C 327.320312 269.144531 327.695312 267.089844 327.695312 264.660156 L 327.695312 209.414062 C 327.695312 206.992188 326.765625 205.683594 324.703125 205.867188 L 263.996094 209.414062 C 261.757812 209.605469 261.007812 210.722656 261.007812 213.148438 Z M 318.355469 216.132812 C 318.726562 217.8125 318.355469 219.492188 316.675781 219.683594 L 313.875 220.242188 L 313.875 261.300781 C 311.445312 262.609375 309.203125 263.355469 307.335938 263.355469 C 304.34375 263.355469 303.597656 262.421875 301.355469 259.625 L 283.046875 230.878906 L 283.046875 258.6875 L 288.839844 260 C 288.839844 260 288.839844 263.359375 284.167969 263.359375 L 271.28125 264.105469 C 270.90625 263.359375 271.28125 261.492188 272.589844 261.121094 L 275.949219 260.1875 L 275.949219 223.414062 L 271.289062 223.039062 C 270.910156 221.359375 271.847656 218.9375 274.460938 218.746094 L 288.285156 217.816406 L 307.339844 246.933594 L 307.339844 221.171875 L 302.480469 220.617188 C 302.109375 218.558594 303.601562 217.066406 305.46875 216.882812 Z M 247.742188 188.140625 L 300.984375 184.21875 C 307.519531 183.660156 309.203125 184.03125 313.3125 187.019531 L 330.308594 198.964844 C 333.109375 201.015625 334.042969 201.574219 334.042969 203.816406 L 334.042969 269.328125 C 334.042969 273.433594 332.550781 275.863281 327.324219 276.230469 L 265.492188 279.96875 C 261.570312 280.15625 259.699219 279.597656 257.644531 276.980469 L 245.128906 260.738281 C 242.886719 257.753906 241.957031 255.515625 241.957031 252.898438 L 241.957031 194.667969 C 241.957031 191.3125 243.453125 188.507812 247.742188 188.140625 Z M 247.742188 188.140625 "/>
-</g>
-</g>
-<g clip-path="url(#clip-34)">
-<g clip-path="url(#clip-35)">
-<path fill-rule="nonzero" fill="rgb(10.980392%, 10.980392%, 10.980392%)" fill-opacity="1" d="M 490 124 L 598 124 C 627.824219 124 652 148.175781 652 178 L 652 286 C 652 315.824219 627.824219 340 598 340 L 490 340 C 460.175781 340 436 315.824219 436 286 L 436 178 C 436 148.175781 460.175781 124 490 124 Z M 490 124 "/>
-</g>
-</g>
-<g clip-path="url(#clip-36)">
-<g clip-path="url(#clip-37)">
-<path fill-rule="nonzero" fill="rgb(24.705882%, 81.176471%, 55.686275%)" fill-opacity="1" d="M 543.601562 188.144531 C 543.539062 184.199219 538.558594 182.503906 536.105469 185.597656 L 499.054688 232.199219 C 494.679688 237.707031 498.601562 245.820312 505.636719 245.820312 L 543.953125 245.820312 L 544.402344 275.859375 C 544.460938 279.800781 549.441406 281.492188 551.894531 278.402344 L 588.945312 231.792969 C 593.316406 226.292969 589.394531 218.179688 582.363281 218.179688 L 543.796875 218.179688 Z M 543.601562 188.144531 "/>
-</g>
-</g>
-<g clip-path="url(#clip-38)">
-<g clip-path="url(#clip-39)">
-<path fill-rule="nonzero" fill="rgb(94.117647%, 39.607843%, 18.431373%)" fill-opacity="1" d="M 746 124 L 854 124 C 883.824219 124 908 148.175781 908 178 L 908 286 C 908 315.824219 883.824219 340 854 340 L 746 340 C 716.175781 340 692 315.824219 692 286 L 692 178 C 692 148.175781 716.175781 124 746 124 Z M 746 124 "/>
-</g>
-</g>
-<g clip-path="url(#clip-40)">
-<g clip-path="url(#clip-41)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 752 280 L 752 184 L 848 184 L 848 280 Z M 779.804688 207.585938 L 796.253906 238.414062 L 796.253906 258.671875 L 802.585938 258.671875 L 802.585938 238.785156 L 819.175781 207.589844 L 812.179688 207.589844 L 802.351562 227.089844 C 800.863281 230.066406 799.601562 232.824219 799.601562 232.824219 C 799.601562 232.824219 798.410156 229.992188 796.996094 227.089844 L 787.324219 207.585938 Z M 779.804688 207.585938 "/>
-</g>
-</g>
-<g clip-path="url(#clip-42)">
-<g clip-path="url(#clip-43)">
-<path fill-rule="nonzero" fill="rgb(100%, 47.843137%, 34.901961%)" fill-opacity="1" d="M 1002 124 L 1110 124 C 1139.824219 124 1164 148.175781 1164 178 L 1164 286 C 1164 315.824219 1139.824219 340 1110 340 L 1002 340 C 972.175781 340 948 315.824219 948 286 L 948 178 C 948 148.175781 972.175781 124 1002 124 Z M 1002 124 "/>
-</g>
-</g>
-<g clip-path="url(#clip-44)">
-<g clip-path="url(#clip-45)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 1080.65625 215.71875 L 1080.65625 204.335938 C 1083.730469 202.898438 1085.703125 199.820312 1085.722656 196.425781 L 1085.722656 196.15625 C 1085.710938 191.316406 1081.792969 187.394531 1076.953125 187.378906 L 1076.683594 187.378906 C 1071.847656 187.394531 1067.925781 191.3125 1067.910156 196.152344 L 1067.910156 196.421875 C 1067.925781 199.792969 1069.875 202.863281 1072.921875 204.3125 L 1072.972656 204.335938 L 1072.972656 215.742188 C 1068.621094 216.410156 1064.519531 218.21875 1061.097656 220.984375 L 1061.144531 220.945312 L 1029.832031 196.5625 C 1031.0625 191.957031 1028.863281 187.125 1024.585938 185.023438 C 1020.308594 182.921875 1015.140625 184.136719 1012.246094 187.921875 C 1009.351562 191.710938 1009.535156 197.015625 1012.6875 200.589844 C 1015.839844 204.167969 1021.078125 205.019531 1025.199219 202.625 L 1025.152344 202.648438 L 1055.941406 226.613281 C 1053.21875 230.691406 1051.773438 235.492188 1051.789062 240.394531 C 1051.789062 245.769531 1053.488281 250.746094 1056.375 254.824219 L 1056.324219 254.742188 L 1046.957031 264.117188 C 1046.207031 263.875 1045.425781 263.746094 1044.636719 263.734375 L 1044.628906 263.734375 C 1040.136719 263.734375 1036.496094 267.375 1036.496094 271.867188 C 1036.496094 276.359375 1040.136719 280 1044.628906 280 C 1049.121094 280 1052.761719 276.359375 1052.761719 271.867188 C 1052.75 271.058594 1052.613281 270.257812 1052.359375 269.488281 L 1052.378906 269.542969 L 1061.648438 260.277344 C 1069.921875 266.589844 1081.246094 267.113281 1090.070312 261.589844 C 1098.890625 256.0625 1103.363281 245.648438 1101.296875 235.445312 C 1099.226562 225.246094 1091.054688 217.394531 1080.777344 215.738281 L 1080.632812 215.71875 Z M 1076.800781 253.230469 C 1069.722656 253.210938 1064 247.460938 1064.011719 240.386719 C 1064.023438 233.308594 1069.769531 227.578125 1076.84375 227.585938 C 1083.921875 227.589844 1089.65625 233.328125 1089.660156 240.402344 L 1089.660156 240.410156 C 1089.664062 247.496094 1083.917969 253.242188 1076.832031 253.238281 Z M 1076.800781 253.230469 "/>
-</g>
-</g>
-<g clip-path="url(#clip-46)">
-<g clip-path="url(#clip-47)">
-<path fill-rule="nonzero" fill="rgb(11.764706%, 11.764706%, 11.764706%)" fill-opacity="1" d="M 1258 124 L 1366 124 C 1395.824219 124 1420 148.175781 1420 178 L 1420 286 C 1420 315.824219 1395.824219 340 1366 340 L 1258 340 C 1228.175781 340 1204 315.824219 1204 286 L 1204 178 C 1204 148.175781 1228.175781 124 1258 124 Z M 1258 124 "/>
-</g>
-</g>
-<g clip-path="url(#clip-48)">
-<g clip-path="url(#clip-49)">
-<path fill-rule="nonzero" fill="rgb(94.901961%, 30.588235%, 11.764706%)" fill-opacity="1" d="M 1327.40625 219.925781 L 1309.054688 219.925781 L 1309.054688 184 L 1327.40625 184 C 1337.3125 184 1345.367188 192.054688 1345.367188 201.960938 C 1345.367188 211.863281 1337.3125 219.925781 1327.40625 219.925781 Z M 1314.941406 214.039062 L 1327.40625 214.039062 C 1334.066406 214.039062 1339.484375 208.621094 1339.484375 201.964844 C 1339.484375 195.308594 1334.0625 189.886719 1327.40625 189.886719 L 1314.941406 189.886719 Z M 1314.941406 219.925781 L 1296.59375 219.925781 C 1286.6875 219.925781 1278.632812 211.867188 1278.632812 201.964844 C 1278.632812 192.058594 1286.6875 184 1296.59375 184 L 1314.945312 184 L 1314.945312 219.925781 Z M 1296.59375 189.882812 C 1289.933594 189.882812 1284.515625 195.304688 1284.515625 201.960938 C 1284.515625 208.617188 1289.933594 214.039062 1296.59375 214.039062 L 1309.058594 214.039062 L 1309.058594 189.882812 Z M 1314.941406 249.960938 L 1296.59375 249.960938 C 1286.6875 249.960938 1278.632812 241.902344 1278.632812 232 C 1278.632812 222.097656 1286.6875 214.039062 1296.59375 214.039062 L 1314.945312 214.039062 L 1314.945312 249.960938 Z M 1296.59375 219.925781 C 1289.933594 219.925781 1284.515625 225.34375 1284.515625 232 C 1284.515625 238.65625 1289.9375 244.074219 1296.59375 244.074219 L 1309.058594 244.074219 L 1309.058594 219.925781 Z M 1296.6875 280 C 1286.730469 280 1278.628906 271.945312 1278.628906 262.039062 C 1278.628906 252.136719 1286.683594 244.078125 1296.589844 244.078125 L 1314.941406 244.078125 L 1314.941406 261.84375 C 1314.941406 271.855469 1306.753906 280 1296.6875 280 Z M 1296.59375 249.960938 C 1289.925781 249.96875 1284.523438 255.371094 1284.515625 262.035156 C 1284.515625 268.695312 1289.976562 274.113281 1296.691406 274.113281 C 1303.511719 274.113281 1309.0625 268.609375 1309.0625 261.839844 L 1309.0625 249.960938 Z M 1327.40625 249.960938 L 1327.015625 249.960938 C 1317.113281 249.960938 1309.054688 241.902344 1309.054688 232 C 1309.054688 222.097656 1317.113281 214.039062 1327.015625 214.039062 L 1327.40625 214.039062 C 1337.3125 214.039062 1345.367188 222.097656 1345.367188 232 C 1345.367188 241.902344 1337.3125 249.960938 1327.40625 249.960938 Z M 1327.019531 219.925781 C 1320.359375 219.925781 1314.945312 225.34375 1314.945312 232 C 1314.945312 238.65625 1320.363281 244.074219 1327.019531 244.074219 L 1327.410156 244.074219 C 1334.070312 244.074219 1339.488281 238.65625 1339.488281 232 C 1339.488281 225.34375 1334.066406 219.925781 1327.410156 219.925781 Z M 1327.019531 219.925781 "/>
-</g>
-</g>
-<g clip-path="url(#clip-50)">
-<g clip-path="url(#clip-51)">
-<path fill-rule="nonzero" fill="rgb(0%, 18.823529%, 52.941176%)" fill-opacity="1" d="M 1514 124 L 1622 124 C 1651.824219 124 1676 148.175781 1676 178 L 1676 286 C 1676 315.824219 1651.824219 340 1622 340 L 1514 340 C 1484.175781 340 1460 315.824219 1460 286 L 1460 178 C 1460 148.175781 1484.175781 124 1514 124 Z M 1514 124 "/>
-</g>
-</g>
-<g clip-path="url(#clip-52)">
-<g clip-path="url(#clip-53)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 1582.429688 202.613281 L 1555.765625 202.613281 L 1546.578125 261.003906 L 1527.28125 261.003906 L 1539.449219 184 L 1571.429688 184 C 1586.445312 184 1596.929688 193.175781 1597.320312 206.050781 C 1594.726562 204.140625 1588.898438 202.613281 1582.433594 202.613281 M 1608.710938 224.796875 C 1608.710938 238.4375 1596.671875 252.207031 1580.878906 252.207031 L 1570.90625 252.207031 L 1566.378906 280 L 1546.960938 280 L 1554.339844 233.847656 L 1568.707031 233.847656 C 1585.539062 233.847656 1598.09375 219.3125 1597.320312 206.050781 C 1604.34375 209.65625 1608.746094 216.902344 1608.710938 224.796875 M 1558.613281 206.183594 L 1584.242188 206.183594 C 1587.871094 206.183594 1592.011719 207.070312 1593.695312 208.347656 C 1592.914062 219.3125 1583.074219 230.28125 1567.933594 230.28125 L 1554.855469 230.28125 Z M 1558.613281 206.183594 "/>
-</g>
-</g>
-<g clip-path="url(#clip-54)">
-<g clip-path="url(#clip-55)">
-<path fill-rule="nonzero" fill="rgb(100%, 87.843137%, 10.588235%)" fill-opacity="1" d="M -22 380 L 86 380 C 115.824219 380 140 404.175781 140 434 L 140 542 C 140 571.824219 115.824219 596 86 596 L -22 596 C -51.824219 596 -76 571.824219 -76 542 L -76 434 C -76 404.175781 -51.824219 380 -22 380 Z M -22 380 "/>
-</g>
-</g>
-<g clip-path="url(#clip-56)">
-<g clip-path="url(#clip-57)">
-<path fill-rule="nonzero" fill="rgb(14.117647%, 10.980392%, 8.235294%)" fill-opacity="1" d="M 29.066406 440 C 11.164062 439.941406 -23.28125 480.984375 -10.410156 491.855469 L -7.253906 494.53125 C -8.105469 496.820312 -8.40625 499.273438 -8.132812 501.699219 C -7.796875 505.058594 -6.058594 508.277344 -3.253906 510.765625 C -0.589844 513.125 2.914062 514.621094 6.316406 514.621094 C 11.941406 527.578125 24.796875 535.53125 39.859375 535.980469 C 56.019531 536.460938 69.59375 528.875 75.277344 515.253906 C 75.648438 514.292969 77.226562 509.988281 77.226562 506.183594 C 77.226562 502.359375 75.066406 500.777344 73.6875 500.777344 C 73.648438 500.628906 73.375 499.632812 73 498.433594 C 72.628906 497.230469 72.238281 496.390625 72.238281 496.390625 C 73.738281 494.140625 73.769531 492.132812 73.566406 490.992188 C 73.355469 489.578125 72.769531 488.378906 71.585938 487.136719 C 70.398438 485.890625 67.976562 484.617188 64.570312 483.664062 L 62.789062 483.167969 C 62.78125 483.09375 62.691406 478.957031 62.617188 477.179688 C 62.558594 475.898438 62.449219 473.890625 61.828125 471.921875 C 61.085938 469.246094 59.796875 466.90625 58.183594 465.410156 C 62.632812 460.804688 65.40625 455.722656 65.398438 451.367188 C 65.386719 442.988281 55.097656 440.453125 42.414062 445.703125 L 39.726562 446.84375 C 38.085938 445.234375 36.445312 443.625 34.800781 442.015625 C 33.214844 440.636719 31.269531 440.007812 29.066406 440 Z M 29.359375 443.492188 C 30.023438 443.492188 30.648438 443.566406 31.21875 443.722656 C 32.40625 444.058594 36.339844 448.621094 36.339844 448.621094 C 36.339844 448.621094 29.035156 452.671875 22.261719 458.324219 C 13.140625 465.351562 6.238281 475.566406 2.113281 486.652344 C -1.132812 487.285156 -3.992188 489.125 -5.738281 491.664062 C -6.785156 490.792969 -8.730469 489.105469 -9.074219 488.449219 C -11.867188 483.144531 -6.03125 472.839844 -1.953125 467.019531 C 7.335938 453.761719 21.480469 443.46875 29.359375 443.492188 Z M 42.503906 456.585938 C 42.664062 456.574219 42.742188 456.785156 42.617188 456.878906 C 42.042969 457.320312 41.421875 457.921875 40.964844 458.535156 C 40.929688 458.582031 40.921875 458.648438 40.949219 458.703125 C 40.972656 458.753906 41.027344 458.789062 41.089844 458.792969 C 43.722656 458.808594 47.4375 459.730469 49.855469 461.089844 C 50.019531 461.179688 49.902344 461.5 49.71875 461.457031 C 46.058594 460.617188 40.0625 459.980469 33.839844 461.496094 C 28.28125 462.855469 24.039062 464.949219 20.945312 467.199219 C 20.785156 467.3125 20.601562 467.109375 20.722656 466.960938 C 24.308594 462.820312 28.71875 459.21875 32.671875 457.199219 C 32.808594 457.128906 32.953125 457.277344 32.878906 457.40625 C 32.5625 457.980469 31.960938 459.195312 31.769531 460.121094 C 31.738281 460.261719 31.894531 460.371094 32.015625 460.289062 C 34.476562 458.609375 38.753906 456.816406 42.503906 456.585938 Z M 54.597656 469.402344 L 54.820312 469.40625 C 55.46875 469.433594 56.101562 469.636719 56.644531 469.992188 C 58.78125 471.410156 59.085938 474.855469 59.195312 477.371094 C 59.257812 478.8125 59.433594 482.289062 59.492188 483.285156 C 59.628906 485.566406 60.226562 485.886719 61.441406 486.289062 C 62.121094 486.515625 62.761719 486.679688 63.691406 486.945312 C 66.515625 487.734375 68.191406 488.542969 69.253906 489.574219 C 69.878906 490.222656 70.171875 490.90625 70.265625 491.5625 C 70.597656 493.996094 68.375 497.003906 62.496094 499.726562 C 56.066406 502.710938 48.269531 503.46875 42.878906 502.867188 L 40.996094 502.65625 C 36.683594 502.074219 34.222656 507.644531 36.8125 511.460938 C 38.480469 513.921875 43.019531 515.519531 47.5625 515.519531 C 57.980469 515.519531 65.984375 511.074219 68.964844 507.230469 C 69.050781 507.121094 69.128906 507.007812 69.203125 506.890625 C 69.347656 506.671875 69.226562 506.550781 69.042969 506.675781 C 66.613281 508.339844 55.804688 514.953125 44.242188 512.960938 C 44.242188 512.960938 42.839844 512.730469 41.554688 512.230469 C 40.535156 511.832031 38.402344 510.855469 38.144531 508.667969 C 47.476562 511.546875 53.347656 508.824219 53.347656 508.824219 C 53.460938 508.773438 53.527344 508.65625 53.515625 508.535156 C 53.507812 508.464844 53.472656 508.398438 53.417969 508.355469 C 53.363281 508.308594 53.292969 508.289062 53.21875 508.296875 C 53.21875 508.296875 45.574219 509.429688 38.347656 506.785156 C 39.136719 504.222656 41.226562 505.152344 44.386719 505.402344 C 49.304688 505.695312 54.234375 505.164062 58.976562 503.828125 C 62.246094 502.890625 66.542969 501.039062 69.882812 498.402344 C 71.007812 500.875 71.402344 503.601562 71.402344 503.601562 C 71.402344 503.601562 72.28125 503.441406 73.003906 503.890625 C 73.695312 504.316406 74.199219 505.195312 73.855469 507.472656 C 73.152344 511.722656 71.34375 515.175781 68.308594 518.351562 C 66.410156 520.402344 64.152344 522.089844 61.644531 523.328125 C 60.285156 524.046875 58.828125 524.664062 57.296875 525.167969 C 45.84375 528.90625 34.121094 524.796875 30.339844 515.96875 C 30.035156 515.292969 29.78125 514.59375 29.585938 513.878906 C 27.972656 508.058594 29.34375 501.078125 33.617188 496.683594 C 33.875 496.402344 34.144531 496.070312 34.144531 495.660156 C 34.144531 495.3125 33.925781 494.945312 33.734375 494.6875 C 32.238281 492.515625 27.058594 488.824219 28.101562 481.671875 C 28.847656 476.535156 33.339844 472.914062 37.527344 473.132812 C 37.882812 473.148438 38.234375 473.171875 38.59375 473.191406 C 40.402344 473.300781 41.992188 473.53125 43.484375 473.59375 C 45.984375 473.703125 48.230469 473.339844 50.894531 471.121094 C 51.796875 470.371094 52.515625 469.71875 53.734375 469.515625 C 53.847656 469.496094 54.105469 469.402344 54.597656 469.402344 Z M 54.683594 478.125 C 54.605469 478.125 54.523438 478.132812 54.445312 478.144531 C 53.105469 478.359375 53.054688 480.015625 53.53125 482.304688 C 53.804688 483.585938 54.28125 484.683594 54.8125 485.363281 C 55.511719 485.285156 56.183594 485.277344 56.804688 485.363281 C 57.160156 484.542969 57.21875 483.136719 56.898438 481.597656 C 56.453125 479.457031 55.855469 478.109375 54.683594 478.125 Z M 40.042969 484.308594 C 38.585938 484.300781 37.164062 484.757812 35.980469 485.613281 C 35.339844 486.078125 34.734375 486.730469 34.820312 487.125 C 34.851562 487.253906 34.945312 487.347656 35.171875 487.375 C 35.695312 487.4375 37.539062 486.507812 39.660156 486.375 C 41.15625 486.285156 42.394531 486.753906 43.351562 487.175781 C 44.308594 487.59375 44.894531 487.867188 45.125 487.628906 C 45.273438 487.476562 45.226562 487.1875 45 486.8125 C 44.527344 486.042969 43.558594 485.265625 42.527344 484.824219 C 41.742188 484.488281 40.898438 484.3125 40.042969 484.308594 Z M 56.371094 487.546875 C 55.6875 487.535156 55.121094 488.292969 55.105469 489.226562 C 55.089844 490.171875 55.628906 490.949219 56.316406 490.957031 C 57.003906 490.96875 57.570312 490.214844 57.589844 489.277344 C 57.605469 488.332031 57.058594 487.558594 56.371094 487.546875 Z M 42.050781 488.234375 C 41.851562 488.234375 41.644531 488.242188 41.433594 488.269531 C 40.1875 488.46875 39.5 488.875 39.058594 489.257812 C 38.683594 489.585938 38.453125 489.949219 38.453125 490.203125 C 38.449219 490.285156 38.480469 490.363281 38.539062 490.417969 C 38.59375 490.476562 38.671875 490.507812 38.753906 490.507812 C 39.03125 490.507812 39.664062 490.257812 39.664062 490.257812 C 40.941406 489.773438 42.320312 489.632812 43.667969 489.839844 C 44.296875 489.910156 44.589844 489.949219 44.726562 489.734375 C 44.769531 489.671875 44.816406 489.539062 44.6875 489.335938 C 44.4375 488.925781 43.445312 488.261719 42.046875 488.234375 Z M 51.09375 489.835938 C 50.585938 489.835938 50.152344 490.039062 49.960938 490.429688 C 49.660156 491.042969 50.101562 491.878906 50.945312 492.292969 C 51.785156 492.707031 52.714844 492.542969 53.023438 491.933594 C 53.324219 491.3125 52.882812 490.476562 52.039062 490.0625 C 51.746094 489.914062 51.421875 489.835938 51.09375 489.832031 Z M 4.550781 489.933594 C 4.742188 489.933594 4.945312 489.933594 5.148438 489.945312 C 8.066406 490.105469 12.371094 492.34375 13.355469 498.703125 C 14.222656 504.34375 12.84375 510.074219 7.558594 510.980469 C 7.066406 511.058594 6.566406 511.097656 6.0625 511.085938 C 1.183594 510.953125 -4.09375 506.554688 -4.617188 501.34375 C -5.195312 495.585938 -2.253906 491.152344 2.960938 490.101562 C 3.429688 490.003906 3.96875 489.941406 4.550781 489.933594 Z M 4.273438 493.640625 C 2.988281 493.628906 1.757812 494.15625 0.882812 495.097656 C -0.636719 496.769531 -0.871094 499.046875 -0.578125 499.855469 C -0.472656 500.148438 -0.300781 500.230469 -0.179688 500.246094 C 0.0742188 500.28125 0.460938 500.09375 0.699219 499.449219 C 0.722656 499.378906 0.746094 499.308594 0.769531 499.238281 C 0.914062 498.722656 1.125 498.222656 1.394531 497.761719 C 1.796875 497.148438 2.425781 496.71875 3.140625 496.570312 C 3.859375 496.421875 4.605469 496.5625 5.214844 496.964844 C 6.28125 497.660156 6.691406 498.964844 6.234375 500.203125 C 6.003906 500.847656 5.621094 502.078125 5.703125 503.089844 C 5.875 505.132812 7.132812 505.957031 8.265625 506.039062 C 9.359375 506.078125 10.128906 505.46875 10.324219 505.015625 C 10.441406 504.746094 10.34375 504.589844 10.28125 504.515625 C 10.109375 504.304688 9.828125 504.367188 9.558594 504.433594 C 9.351562 504.488281 9.136719 504.519531 8.921875 504.519531 C 8.453125 504.53125 8.011719 504.308594 7.742188 503.929688 C 7.433594 503.449219 7.453125 502.726562 7.796875 501.910156 C 7.839844 501.800781 7.894531 501.679688 7.957031 501.542969 C 8.507812 500.3125 9.429688 498.242188 8.394531 496.277344 C 7.617188 494.796875 6.34375 493.867188 4.820312 493.675781 C 4.636719 493.652344 4.453125 493.636719 4.269531 493.636719 Z M 4.273438 493.640625 "/>
-</g>
-</g>
-<g clip-path="url(#clip-58)">
-<g clip-path="url(#clip-59)">
-<path fill-rule="nonzero" fill="rgb(34.509804%, 39.607843%, 94.901961%)" fill-opacity="1" d="M 234 380 L 342 380 C 371.824219 380 396 404.175781 396 434 L 396 542 C 396 571.824219 371.824219 596 342 596 L 234 596 C 204.175781 596 180 571.824219 180 542 L 180 434 C 180 404.175781 204.175781 380 234 380 Z M 234 380 "/>
-</g>
-</g>
-<g clip-path="url(#clip-60)">
-<g clip-path="url(#clip-61)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 321.269531 457.480469 C 315.042969 454.621094 308.476562 452.585938 301.726562 451.417969 C 301.601562 451.394531 301.476562 451.453125 301.414062 451.566406 C 300.570312 453.066406 299.636719 455.027344 298.980469 456.566406 C 291.601562 455.460938 284.261719 455.460938 277.03125 456.566406 C 276.378906 454.992188 275.410156 453.066406 274.5625 451.566406 C 274.5 451.457031 274.375 451.398438 274.25 451.417969 C 267.5 452.582031 260.929688 454.621094 254.707031 457.480469 C 254.65625 457.5 254.609375 457.539062 254.578125 457.589844 C 242.132812 476.183594 238.722656 494.320312 240.398438 512.230469 C 240.40625 512.320312 240.453125 512.402344 240.523438 512.457031 C 248.734375 518.484375 256.6875 522.148438 264.492188 524.574219 C 264.617188 524.609375 264.75 524.566406 264.828125 524.460938 C 266.675781 521.941406 268.324219 519.28125 269.734375 516.484375 C 269.773438 516.410156 269.777344 516.316406 269.746094 516.238281 C 269.714844 516.15625 269.648438 516.09375 269.566406 516.0625 C 266.957031 515.074219 264.46875 513.863281 262.078125 512.492188 C 261.988281 512.441406 261.933594 512.347656 261.925781 512.246094 C 261.921875 512.144531 261.964844 512.046875 262.046875 511.984375 C 262.550781 511.605469 263.054688 511.214844 263.535156 510.816406 C 263.621094 510.746094 263.742188 510.730469 263.847656 510.777344 C 279.558594 517.949219 296.566406 517.949219 312.089844 510.777344 C 312.195312 510.726562 312.316406 510.742188 312.40625 510.8125 C 312.886719 511.210938 313.390625 511.605469 313.898438 511.984375 C 313.980469 512.042969 314.023438 512.144531 314.019531 512.246094 C 314.015625 512.347656 313.957031 512.441406 313.871094 512.492188 C 311.476562 513.890625 308.972656 515.082031 306.378906 516.058594 C 306.296875 516.089844 306.234375 516.15625 306.203125 516.234375 C 306.171875 516.316406 306.175781 516.410156 306.214844 516.484375 C 307.65625 519.277344 309.304688 521.9375 311.117188 524.457031 C 311.191406 524.566406 311.328125 524.613281 311.453125 524.574219 C 319.296875 522.144531 327.25 518.484375 335.460938 512.457031 C 335.53125 512.402344 335.578125 512.324219 335.585938 512.234375 C 337.589844 491.527344 332.234375 473.539062 321.394531 457.59375 C 321.367188 457.542969 321.320312 457.5 321.269531 457.480469 Z M 272.078125 501.324219 C 267.351562 501.324219 263.453125 496.980469 263.453125 491.648438 C 263.453125 486.316406 267.273438 481.972656 272.082031 481.972656 C 276.921875 481.972656 280.78125 486.355469 280.707031 491.648438 C 280.707031 496.980469 276.886719 501.324219 272.078125 501.324219 Z M 303.980469 501.324219 C 299.25 501.324219 295.351562 496.980469 295.351562 491.648438 C 295.351562 486.316406 299.171875 481.972656 303.980469 481.972656 C 308.824219 481.972656 312.683594 486.355469 312.605469 491.648438 C 312.605469 496.980469 308.824219 501.324219 303.980469 501.324219 Z M 303.980469 501.324219 "/>
-</g>
-</g>
-<g clip-path="url(#clip-62)">
-<g clip-path="url(#clip-63)">
-<path fill-rule="nonzero" fill="rgb(14.117647%, 16.078431%, 18.431373%)" fill-opacity="1" d="M 490 380 L 598 380 C 627.824219 380 652 404.175781 652 434 L 652 542 C 652 571.824219 627.824219 596 598 596 L 490 596 C 460.175781 596 436 571.824219 436 542 L 436 434 C 436 404.175781 460.175781 380 490 380 Z M 490 380 "/>
-</g>
-</g>
-<g clip-path="url(#clip-64)">
-<g clip-path="url(#clip-65)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 544 441.1875 C 517.480469 441.1875 496 462.679688 496 489.1875 C 496 510.398438 509.753906 528.386719 528.820312 534.726562 C 531.21875 535.179688 532.101562 533.695312 532.101562 532.421875 C 532.101562 531.28125 532.058594 528.261719 532.039062 524.261719 C 518.6875 527.15625 515.871094 517.820312 515.871094 517.820312 C 513.6875 512.28125 510.53125 510.800781 510.53125 510.800781 C 506.183594 507.824219 510.867188 507.882812 510.867188 507.882812 C 515.6875 508.21875 518.21875 512.828125 518.21875 512.828125 C 522.5 520.167969 529.457031 518.046875 532.199219 516.820312 C 532.632812 513.714844 533.867188 511.601562 535.238281 510.398438 C 524.578125 509.199219 513.375 505.070312 513.375 486.679688 C 513.375 481.441406 515.234375 477.160156 518.316406 473.800781 C 517.777344 472.589844 516.15625 467.707031 518.734375 461.097656 C 518.734375 461.097656 522.757812 459.808594 531.9375 466.015625 C 535.777344 464.949219 539.855469 464.421875 543.9375 464.394531 C 548.015625 464.421875 552.097656 464.949219 555.9375 466.015625 C 565.054688 459.808594 569.074219 461.097656 569.074219 461.097656 C 571.65625 467.707031 570.035156 472.589844 569.554688 473.800781 C 572.617188 477.160156 574.476562 481.441406 574.476562 486.679688 C 574.476562 505.121094 563.257812 509.179688 552.574219 510.359375 C 554.257812 511.800781 555.816406 514.742188 555.816406 519.238281 C 555.816406 525.664062 555.757812 530.824219 555.757812 532.382812 C 555.757812 533.644531 556.597656 535.144531 559.054688 534.664062 C 578.261719 528.367188 592 510.367188 592 489.1875 C 592 462.679688 570.507812 441.1875 544 441.1875 "/>
-</g>
-</g>
-<g clip-path="url(#clip-66)">
-<g clip-path="url(#clip-67)">
-<path fill-rule="nonzero" fill="rgb(4.313725%, 23.921569%, 20.784314%)" fill-opacity="1" d="M 746 384 L 854 384 C 881.613281 384 904 406.386719 904 434 L 904 542 C 904 569.613281 881.613281 592 854 592 L 746 592 C 718.386719 592 696 569.613281 696 542 L 696 434 C 696 406.386719 718.386719 384 746 384 Z M 746 384 "/>
-</g>
-</g>
-<g clip-path="url(#clip-68)">
-<g clip-path="url(#clip-69)">
-<path fill="none" stroke-width="4" stroke-linecap="butt" stroke-linejoin="miter" stroke="rgb(13.333333%, 77.254902%, 45.490196%)" stroke-opacity="1" stroke-dasharray="11 10" stroke-miterlimit="4" d="M 373 192 L 427 192 C 440.806641 192 452 203.193359 452 217 L 452 271 C 452 284.806641 440.806641 296 427 296 L 373 296 C 359.193359 296 348 284.806641 348 271 L 348 217 C 348 203.193359 359.193359 192 373 192 Z M 373 192 " transform="matrix(2, 0, 0, 2, 0, 0)"/>
-</g>
-</g>
-<g clip-path="url(#clip-70)">
-<g clip-path="url(#clip-71)">
-<path fill-rule="nonzero" fill="rgb(13.333333%, 77.254902%, 45.490196%)" fill-opacity="1" d="M 770.445312 519.304688 L 770.445312 526.390625 L 764.875 526.390625 C 758.71875 526.390625 754.59375 525.476562 752.5 523.648438 C 750.414062 521.820312 749.367188 518.171875 749.367188 512.703125 L 749.367188 504.71875 C 749.367188 500.984375 748.703125 498.40625 747.382812 496.984375 C 746.054688 495.5625 743.664062 494.851562 740.195312 494.851562 L 737.898438 494.851562 L 737.898438 487.765625 L 740.195312 487.765625 C 743.664062 487.765625 746.054688 487.0625 747.382812 485.648438 C 748.703125 484.234375 749.367188 481.65625 749.367188 477.890625 L 749.367188 469.914062 C 749.367188 464.445312 750.414062 460.804688 752.5 458.984375 C 754.59375 457.164062 758.71875 456.257812 764.875 456.257812 L 770.445312 456.257812 L 770.445312 463.3125 L 765.882812 463.3125 C 763.304688 463.3125 761.585938 463.828125 760.71875 464.867188 C 759.851562 465.90625 759.421875 468.195312 759.421875 471.734375 L 759.421875 479.484375 C 759.421875 483.570312 758.8125 486.4375 757.601562 488.09375 C 756.390625 489.75 754.226562 490.820312 751.109375 491.289062 C 754.226562 491.8125 756.390625 492.90625 757.601562 494.59375 C 758.8125 496.273438 759.421875 499.140625 759.421875 503.203125 L 759.421875 510.8125 C 759.421875 514.375 759.851562 516.679688 760.71875 517.726562 C 761.585938 518.78125 763.304688 519.304688 765.882812 519.304688 Z M 829.554688 519.304688 L 834.046875 519.304688 C 836.617188 519.304688 838.351562 518.773438 839.242188 517.710938 C 840.132812 516.648438 840.578125 514.34375 840.578125 510.8125 L 840.578125 503.203125 C 840.578125 499.140625 841.179688 496.273438 842.390625 494.59375 C 843.609375 492.90625 845.757812 491.8125 848.851562 491.289062 C 845.734375 490.820312 843.578125 489.757812 842.375 488.09375 C 841.171875 486.4375 840.578125 483.570312 840.578125 479.484375 L 840.578125 471.734375 C 840.578125 468.242188 840.140625 465.96875 839.257812 464.90625 C 838.382812 463.84375 836.640625 463.3125 834.046875 463.3125 L 829.554688 463.3125 L 829.554688 456.257812 L 835.125 456.257812 C 841.257812 456.257812 845.359375 457.164062 847.421875 458.984375 C 849.484375 460.804688 850.523438 464.445312 850.523438 469.914062 L 850.523438 477.890625 C 850.523438 481.625 851.195312 484.210938 852.546875 485.632812 C 853.890625 487.054688 856.3125 487.765625 859.796875 487.765625 L 862.101562 487.765625 L 862.101562 494.851562 L 859.796875 494.851562 C 856.3125 494.851562 853.890625 495.570312 852.546875 497 C 851.195312 498.4375 850.523438 501.015625 850.523438 504.71875 L 850.523438 512.703125 C 850.523438 518.171875 849.492188 521.820312 847.421875 523.648438 C 845.359375 525.476562 841.257812 526.390625 835.125 526.390625 L 829.554688 526.390625 Z M 731.367188 443.453125 "/>
-</g>
-</g>
-<g clip-path="url(#clip-72)">
-<g clip-path="url(#clip-73)">
-<path fill-rule="nonzero" fill="rgb(25.882353%, 52.156863%, 95.686275%)" fill-opacity="1" d="M 1002 380 L 1110 380 C 1139.824219 380 1164 404.175781 1164 434 L 1164 542 C 1164 571.824219 1139.824219 596 1110 596 L 1002 596 C 972.175781 596 948 571.824219 948 542 L 948 434 C 948 404.175781 972.175781 380 1002 380 Z M 1002 380 "/>
-</g>
-</g>
-<g clip-path="url(#clip-74)">
-<g clip-path="url(#clip-75)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 1086.109375 459.195312 C 1090.957031 469.628906 1089.855469 481.90625 1084.488281 491.886719 C 1080.085938 500.074219 1073.511719 506.847656 1068.097656 514.34375 C 1065.621094 517.777344 1063.121094 521.34375 1061.421875 525.253906 C 1060.855469 526.550781 1060.367188 527.882812 1059.886719 529.21875 C 1059.402344 530.550781 1058.992188 531.910156 1058.527344 533.253906 C 1058.09375 534.507812 1057.585938 535.988281 1056.019531 536 L 1055.992188 536 C 1054.128906 535.996094 1053.675781 533.878906 1053.210938 532.453125 C 1052.074219 528.957031 1050.886719 525.601562 1049.136719 522.351562 C 1047.097656 518.574219 1044.554688 515.085938 1041.976562 511.667969 Z M 1042.179688 470.820312 L 1026.34375 489.648438 C 1029.238281 495.808594 1033.628906 501.101562 1037.828125 506.367188 C 1038.816406 507.609375 1039.804688 508.855469 1040.777344 510.113281 L 1060.710938 486.410156 L 1060.597656 486.453125 C 1053.632812 488.855469 1045.832031 485.289062 1043.027344 478.503906 C 1042.644531 477.582031 1042.363281 476.621094 1042.191406 475.640625 C 1041.941406 473.890625 1041.882812 472.597656 1042.175781 470.847656 Z M 1029.96875 452.597656 L 1029.957031 452.613281 C 1022.167969 462.476562 1020.832031 476.132812 1025.488281 487.691406 L 1044.628906 464.9375 L 1044.394531 464.734375 Z M 1066.644531 441.742188 L 1051.292969 459.996094 C 1051.328125 459.980469 1051.363281 459.96875 1051.398438 459.957031 C 1057.800781 457.753906 1065.011719 460.554688 1068.28125 466.460938 C 1068.984375 467.734375 1069.570312 469.191406 1069.789062 470.640625 C 1070.058594 472.425781 1070.128906 473.730469 1069.835938 475.519531 L 1069.824219 475.585938 L 1085.167969 457.339844 C 1081.160156 450.027344 1074.566406 444.46875 1066.679688 441.757812 Z M 1045.863281 463.472656 L 1064.648438 441.140625 L 1064.460938 441.09375 C 1061.679688 440.363281 1058.816406 439.996094 1055.945312 440 C 1046.535156 440.089844 1037.59375 444.097656 1031.269531 451.0625 L 1031.203125 451.136719 Z M 1045.863281 463.472656 "/>
-</g>
-</g>
-<g clip-path="url(#clip-76)">
-<g clip-path="url(#clip-77)">
-<path fill-rule="nonzero" fill="rgb(36.862745%, 41.568627%, 82.352941%)" fill-opacity="1" d="M 1258 380 L 1366 380 C 1395.824219 380 1420 404.175781 1420 434 L 1420 542 C 1420 571.824219 1395.824219 596 1366 596 L 1258 596 C 1228.175781 596 1204 571.824219 1204 542 L 1204 434 C 1204 404.175781 1228.175781 380 1258 380 Z M 1258 380 "/>
-</g>
-</g>
-<g clip-path="url(#clip-78)">
-<g clip-path="url(#clip-79)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 1275.542969 456.71875 C 1284.660156 446.097656 1297.960938 439.988281 1311.960938 440 C 1338.496094 440 1360 461.503906 1360 488.035156 C 1360 502.597656 1353.519531 515.648438 1343.28125 524.457031 L 1275.546875 456.71875 Z M 1271.269531 462.503906 L 1337.492188 528.726562 C 1335.394531 530.046875 1333.191406 531.207031 1330.890625 532.191406 L 1267.804688 469.109375 C 1268.792969 466.808594 1269.953125 464.605469 1271.269531 462.507812 Z M 1265.289062 476.652344 L 1323.347656 534.710938 C 1320.507812 535.398438 1317.574219 535.839844 1314.566406 536 L 1264 485.433594 C 1264.15625 482.472656 1264.589844 479.53125 1265.289062 476.652344 Z M 1264.609375 496.101562 L 1303.898438 535.394531 C 1283.792969 531.960938 1268.039062 516.207031 1264.605469 496.101562 Z M 1264.609375 496.101562 "/>
-</g>
-</g>
-<g clip-path="url(#clip-80)">
-<g clip-path="url(#clip-81)">
-<path fill-rule="nonzero" fill="rgb(0%, 0%, 0%)" fill-opacity="1" d="M 1514 380 L 1622 380 C 1651.824219 380 1676 404.175781 1676 434 L 1676 542 C 1676 571.824219 1651.824219 596 1622 596 L 1514 596 C 1484.175781 596 1460 571.824219 1460 542 L 1460 434 C 1460 404.175781 1484.175781 380 1514 380 Z M 1514 380 "/>
-</g>
-</g>
-<g clip-path="url(#clip-82)">
-<g clip-path="url(#clip-83)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 1568 446.433594 L 1616 529.566406 L 1520 529.566406 Z M 1568 446.433594 "/>
-</g>
-</g>
-<g clip-path="url(#clip-84)">
-<g clip-path="url(#clip-85)">
-<path fill-rule="nonzero" fill="rgb(0%, 0%, 0%)" fill-opacity="1" d="M -22 636 L 86 636 C 115.824219 636 140 660.175781 140 690 L 140 798 C 140 827.824219 115.824219 852 86 852 L -22 852 C -51.824219 852 -76 827.824219 -76 798 L -76 690 C -76 660.175781 -51.824219 636 -22 636 Z M -22 636 "/>
-</g>
-</g>
-<g clip-path="url(#clip-86)">
-<g clip-path="url(#clip-87)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 40.9375 736.648438 L 75.90625 696 L 67.621094 696 L 37.257812 731.296875 L 13.003906 696 L -14.96875 696 L 21.703125 749.371094 L -14.96875 792 L -6.679688 792 L 25.382812 754.726562 L 50.996094 792 L 78.96875 792 Z M 29.589844 749.84375 L 25.871094 744.527344 L -3.695312 702.238281 L 9.03125 702.238281 L 32.890625 736.367188 L 36.609375 741.683594 L 67.625 786.042969 L 54.894531 786.042969 Z M 29.589844 749.84375 "/>
-</g>
-</g>
-<g clip-path="url(#clip-88)">
-<g clip-path="url(#clip-89)">
-<path fill-rule="nonzero" fill="rgb(9.411765%, 74.901961%, 100%)" fill-opacity="1" d="M 234 636 L 342 636 C 371.824219 636 396 660.175781 396 690 L 396 798 C 396 827.824219 371.824219 852 342 852 L 234 852 C 204.175781 852 180 827.824219 180 798 L 180 690 C 180 660.175781 204.175781 636 234 636 Z M 234 636 "/>
-</g>
-</g>
-<g clip-path="url(#clip-90)">
-<g clip-path="url(#clip-91)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 287.96875 703.863281 C 286.230469 703.863281 284.488281 704.207031 282.847656 704.890625 L 247.117188 719.667969 C 245.105469 720.5 245.15625 723.300781 247.164062 724.132812 L 283.09375 738.363281 C 286.238281 739.640625 289.761719 739.640625 292.90625 738.363281 L 328.835938 724.132812 C 330.847656 723.347656 330.847656 720.5 328.882812 719.667969 L 293.054688 704.890625 C 291.445312 704.210938 289.714844 703.863281 287.96875 703.863281 Z M 333.601562 728.222656 C 333.296875 728.226562 332.992188 728.289062 332.710938 728.402344 L 292.664062 743.910156 C 291.746094 744.289062 291.148438 745.179688 291.144531 746.167969 L 291.144531 781.753906 C 291.152344 782.542969 291.546875 783.277344 292.203125 783.71875 C 292.859375 784.160156 293.691406 784.25 294.429688 783.960938 L 334.480469 768.398438 C 335.398438 768.058594 336.007812 767.175781 336 766.195312 L 336 730.613281 C 335.992188 729.292969 334.917969 728.226562 333.601562 728.226562 Z M 242.703125 728.378906 C 241.984375 728.355469 241.289062 728.628906 240.785156 729.140625 C 240.34375 729.585938 240 730.121094 240 730.761719 L 240 764.179688 C 240 765.949219 242.058594 767.128906 243.632812 766.339844 L 268.710938 754.316406 L 269.941406 753.726562 L 281.816406 747.984375 C 283.679688 747.105469 283.535156 744.351562 281.570312 743.617188 L 243.53125 728.550781 C 243.269531 728.441406 242.988281 728.382812 242.703125 728.375 Z M 242.703125 728.378906 "/>
-</g>
-</g>
-<g clip-path="url(#clip-92)">
-<g clip-path="url(#clip-93)">
-<path fill-rule="nonzero" fill="rgb(1.176471%, 21.176471%, 23.921569%)" fill-opacity="1" d="M 490 636 L 598 636 C 627.824219 636 652 660.175781 652 690 L 652 798 C 652 827.824219 627.824219 852 598 852 L 490 852 C 460.175781 852 436 827.824219 436 798 L 436 690 C 436 660.175781 460.175781 636 490 636 Z M 490 636 "/>
-</g>
-</g>
-<g clip-path="url(#clip-94)">
-<g clip-path="url(#clip-95)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 547.65625 707.617188 L 547.65625 761.160156 L 592 707.621094 L 547.65625 707.621094 Z M 496 707.625 C 496 719.863281 505.933594 729.800781 518.171875 729.800781 C 530.410156 729.800781 540.339844 719.863281 540.34375 707.625 Z M 540.34375 726.851562 L 496 780.382812 L 540.34375 780.382812 Z M 569.824219 758.210938 C 557.570312 758.210938 547.65625 768.132812 547.65625 780.382812 L 592 780.382812 C 592 768.144531 582.078125 758.210938 569.828125 758.210938 Z M 569.824219 758.210938 "/>
-</g>
-</g>
-<g clip-path="url(#clip-96)">
-<g clip-path="url(#clip-97)">
-<path fill-rule="nonzero" fill="rgb(95.294118%, 50.196078%, 12.54902%)" fill-opacity="1" d="M 746 636 L 854 636 C 883.824219 636 908 660.175781 908 690 L 908 798 C 908 827.824219 883.824219 852 854 852 L 746 852 C 716.175781 852 692 827.824219 692 798 L 692 690 C 692 660.175781 716.175781 636 746 636 Z M 746 636 "/>
-</g>
-</g>
-<g clip-path="url(#clip-98)">
-<g clip-path="url(#clip-99)">
-<path fill-rule="nonzero" fill="rgb(7.45098%, 66.666667%, 32.156863%)" fill-opacity="1" d="M 1002 636 L 1110 636 C 1139.824219 636 1164 660.175781 1164 690 L 1164 798 C 1164 827.824219 1139.824219 852 1110 852 L 1002 852 C 972.175781 852 948 827.824219 948 798 L 948 690 C 948 660.175781 972.175781 636 1002 636 Z M 1002 636 "/>
-</g>
-</g>
-<g clip-path="url(#clip-100)">
-<g clip-path="url(#clip-101)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 1076.773438 734.21875 C 1071.714844 711.898438 1059.765625 704.5625 1058.480469 701.761719 C 1057.359375 700.183594 1056.359375 697.945312 1055.539062 696 C 1055.394531 697.980469 1055.320312 698.738281 1053.449219 700.734375 C 1050.554688 703 1035.695312 715.464844 1034.488281 740.816406 C 1033.359375 764.464844 1051.566406 778.554688 1054.039062 780.351562 L 1054.320312 780.550781 C 1054.835938 784.359375 1055.273438 788.175781 1055.640625 792 L 1057.5625 792 C 1058.019531 787.871094 1058.699219 783.777344 1059.605469 779.71875 C 1061.273438 778.535156 1062.019531 777.867188 1063.003906 776.949219 C 1072.425781 768.230469 1077.714844 755.929688 1077.558594 743.09375 C 1077.601562 739.835938 1077.148438 736.445312 1076.773438 734.21875 Z M 1055.429688 767 C 1055.429688 767 1055.429688 733.835938 1056.527344 733.839844 C 1057.378906 733.839844 1058.488281 776.621094 1058.488281 776.621094 C 1056.964844 776.441406 1055.429688 769.578125 1055.429688 767 Z M 1055.429688 767 "/>
-</g>
-</g>
-<g clip-path="url(#clip-102)">
-<g clip-path="url(#clip-103)">
-<path fill-rule="nonzero" fill="rgb(56.862745%, 27.45098%, 100%)" fill-opacity="1" d="M 1258 636 L 1366 636 C 1395.824219 636 1420 660.175781 1420 690 L 1420 798 C 1420 827.824219 1395.824219 852 1366 852 L 1258 852 C 1228.175781 852 1204 827.824219 1204 798 L 1204 690 C 1204 660.175781 1228.175781 636 1258 636 Z M 1258 636 "/>
-</g>
-</g>
-<g clip-path="url(#clip-104)">
-<g clip-path="url(#clip-105)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 1310.285156 714.855469 L 1317.144531 714.855469 L 1317.144531 735.429688 L 1310.28125 735.429688 Z M 1329.144531 714.855469 L 1336 714.855469 L 1336 735.429688 L 1329.144531 735.429688 Z M 1288 696 L 1270.855469 713.144531 L 1270.855469 774.855469 L 1291.429688 774.855469 L 1291.429688 792 L 1308.570312 774.855469 L 1322.285156 774.855469 L 1353.144531 744 L 1353.144531 696 Z M 1346.285156 740.570312 L 1332.570312 754.285156 L 1318.855469 754.285156 L 1306.855469 766.285156 L 1306.855469 754.285156 L 1291.429688 754.285156 L 1291.429688 702.855469 L 1346.285156 702.855469 Z M 1346.285156 740.570312 "/>
-</g>
-</g>
-<g clip-path="url(#clip-106)">
-<g clip-path="url(#clip-107)">
-<path fill-rule="nonzero" fill="rgb(0%, 32.156863%, 80%)" fill-opacity="1" d="M 1514 636 L 1622 636 C 1651.824219 636 1676 660.175781 1676 690 L 1676 798 C 1676 827.824219 1651.824219 852 1622 852 L 1514 852 C 1484.175781 852 1460 827.824219 1460 798 L 1460 690 C 1460 660.175781 1484.175781 636 1514 636 Z M 1514 636 "/>
-</g>
-</g>
-<g clip-path="url(#clip-108)">
-<g clip-path="url(#clip-109)">
-<path fill-rule="nonzero" fill="rgb(100%, 100%, 100%)" fill-opacity="1" d="M 1566.285156 742.050781 L 1520 742.050781 C 1520.003906 747.59375 1522.210938 752.910156 1526.136719 756.824219 C 1530.0625 760.734375 1535.386719 762.925781 1540.929688 762.910156 L 1549.449219 762.910156 L 1549.449219 771.140625 C 1549.449219 782.65625 1558.78125 791.996094 1570.300781 792 L 1570.300781 746.070312 C 1570.300781 743.851562 1568.5 742.050781 1566.28125 742.050781 Z M 1589.175781 719.027344 L 1542.945312 719.027344 C 1542.945312 730.546875 1552.285156 739.882812 1563.804688 739.882812 L 1572.320312 739.882812 L 1572.320312 748.117188 C 1572.328125 759.632812 1581.664062 768.964844 1593.179688 768.972656 L 1593.179688 723.03125 C 1593.179688 720.820312 1591.386719 719.027344 1589.175781 719.027344 Z M 1612.050781 696 L 1565.820312 696 C 1565.820312 707.519531 1575.160156 716.859375 1586.679688 716.859375 L 1595.195312 716.859375 L 1595.195312 725.089844 C 1595.203125 736.582031 1604.507812 745.902344 1616 745.933594 L 1616 700.019531 C 1616.007812 697.824219 1614.246094 696.03125 1612.050781 696 Z M 1612.050781 696 "/>
-</g>
-</g>
-<path fill="none" stroke-width="2" stroke-linecap="butt" stroke-linejoin="miter" stroke="rgb(13.72549%, 19.215686%, 16.470588%)" stroke-opacity="1" stroke-miterlimit="4" d="M 28 1 L 772 1 C 786.912109 1 799 13.087891 799 28 L 799 332 C 799 346.912109 786.912109 359 772 359 L 28 359 C 13.087891 359 1 346.912109 1 332 L 1 28 C 1 13.087891 13.087891 1 28 1 Z M 28 1 " transform="matrix(2, 0, 0, 2, 0, 0)"/>
-</svg>
diff --git a/packages/frontend/public/icons/caret-down.svg b/packages/frontend/public/icons/caret-down.svg
deleted file mode 100644
index 8197786b..00000000
--- a/packages/frontend/public/icons/caret-down.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="24" height="24" fill="" viewBox="0 0 24 24" transform="" id="injected-svg" xmlns="http://www.w3.org/2000/svg"><g fill="currentColor" opacity="1"><path d="m12.76 15.11 3.83-4.46c.56-.65.1-1.65-.76-1.65H8.18c-.85 0-1.32 1-.76 1.65l3.83 4.46c.4.47 1.12.47 1.52 0Z"></path></g></svg>
\ No newline at end of file
diff --git a/packages/frontend/public/icons/cerebras-dark-mode.svg b/packages/frontend/public/icons/cerebras-dark-mode.svg
deleted file mode 100644
index 7d2bc123..00000000
--- a/packages/frontend/public/icons/cerebras-dark-mode.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg fill="#ffffff" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Cerebras</title><path clip-rule="evenodd" d="M14.121 2.701a9.299 9.299 0 000 18.598V22.7c-5.91 0-10.7-4.791-10.7-10.701S8.21 1.299 14.12 1.299V2.7zm4.752 3.677A7.353 7.353 0 109.42 17.643l-.901 1.074a8.754 8.754 0 01-1.08-12.334 8.755 8.755 0 0112.335-1.08l-.901 1.075zm-2.255.844a5.407 5.407 0 00-5.048 9.563l-.656 1.24a6.81 6.81 0 016.358-12.043l-.654 1.24zM14.12 8.539a3.46 3.46 0 100 6.922v1.402a4.863 4.863 0 010-9.726v1.402z" fill="#F15A29" fill-rule="evenodd"></path><path d="M15.407 10.836a2.24 2.24 0 00-.51-.409 1.084 1.084 0 00-.544-.152c-.255 0-.483.047-.684.14a1.58 1.58 0 00-.84.912c-.074.203-.11.416-.11.631 0 .218.036.43.11.631a1.594 1.594 0 00.84.913c.2.093.43.14.684.14.216 0 .417-.046.602-.135.188-.09.35-.225.475-.392l.928 1.006c-.14.14-.3.261-.482.363a3.367 3.367 0 01-1.083.38c-.17.026-.317.04-.44.04a3.315 3.315 0 01-1.182-.21 2.825 2.825 0 01-.961-.597 2.816 2.816 0 01-.644-.929 2.987 2.987 0 01-.238-1.21c0-.444.08-.847.238-1.21.15-.35.368-.666.643-.929.278-.261.605-.464.962-.596a3.315 3.315 0 011.182-.21c.355 0 .712.068 1.072.204.361.138.685.36.944.649l-.962.97z"></path></svg>
diff --git a/packages/frontend/public/icons/github-dark-mode.svg b/packages/frontend/public/icons/github-dark-mode.svg
deleted file mode 100644
index a1ac1a12..00000000
--- a/packages/frontend/public/icons/github-dark-mode.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>GitHub</title><path fill="#ffffff" fill-rule="evenodd" clip-rule="evenodd" d="M12.026 2c-5.509 0-9.974 4.465-9.974 9.974 0 4.406 2.857 8.145 6.821 9.465.499.09.679-.217.679-.481 0-.237-.008-.865-.011-1.696-2.775.602-3.361-1.338-3.361-1.338-.452-1.152-1.107-1.459-1.107-1.459-.905-.619.069-.605.069-.605 1.002.07 1.527 1.028 1.527 1.028.89 1.524 2.336 1.084 2.902.829.091-.645.351-1.085.635-1.334-2.214-.251-4.542-1.107-4.542-4.93 0-1.087.389-1.979 1.024-2.675-.101-.253-.446-1.268.099-2.64 0 0 .837-.269 2.742 1.021a9.582 9.582 0 0 1 2.496-.336 9.554 9.554 0 0 1 2.496.336c1.906-1.291 2.742-1.021 2.742-1.021.545 1.372.203 2.387.099 2.64.64.696 1.024 1.587 1.024 2.675 0 3.833-2.33 4.675-4.552 4.922.355.308.675.916.675 1.846 0 1.334-.012 2.41-.012 2.737 0 .267.178.577.687.479C19.146 20.115 22 16.379 22 11.974 22 6.465 17.535 2 12.026 2z"/></svg>
diff --git a/packages/frontend/public/icons/ollama-dark-mode.svg b/packages/frontend/public/icons/ollama-dark-mode.svg
deleted file mode 100644
index c76e1d22..00000000
--- a/packages/frontend/public/icons/ollama-dark-mode.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg fill="#ffffff" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Ollama</title><path d="M7.905 1.09c.216.085.411.225.588.41.295.306.544.744.734 1.263.191.522.315 1.1.362 1.68a5.054 5.054 0 012.049-.636l.051-.004c.87-.07 1.73.087 2.48.474.101.053.2.11.297.17.05-.569.172-1.134.36-1.644.19-.52.439-.957.733-1.264a1.67 1.67 0 01.589-.41c.257-.1.53-.118.796-.042.401.114.745.368 1.016.737.248.337.434.769.561 1.287.23.934.27 2.163.115 3.645l.053.04.026.019c.757.576 1.284 1.397 1.563 2.35.435 1.487.216 3.155-.534 4.088l-.018.021.002.003c.417.762.67 1.567.724 2.4l.002.03c.064 1.065-.2 2.137-.814 3.19l-.007.01.01.024c.472 1.157.62 2.322.438 3.486l-.006.039a.651.651 0 01-.747.536.648.648 0 01-.54-.742c.167-1.033.01-2.069-.48-3.123a.643.643 0 01.04-.617l.004-.006c.604-.924.854-1.83.8-2.72-.046-.779-.325-1.544-.8-2.273a.644.644 0 01.18-.886l.009-.006c.243-.159.467-.565.58-1.12a4.229 4.229 0 00-.095-1.974c-.205-.7-.58-1.284-1.105-1.683-.595-.454-1.383-.673-2.38-.61a.653.653 0 01-.632-.371c-.314-.665-.772-1.141-1.343-1.436a3.288 3.288 0 00-1.772-.332c-1.245.099-2.343.801-2.67 1.686a.652.652 0 01-.61.425c-1.067.002-1.893.252-2.497.703-.522.39-.878.935-1.066 1.588a4.07 4.07 0 00-.068 1.886c.112.558.331 1.02.582 1.269l.008.007c.212.207.257.53.109.785-.36.622-.629 1.549-.673 2.44-.05 1.018.186 1.902.719 2.536l.016.019a.643.643 0 01.095.69c-.576 1.236-.753 2.252-.562 3.052a.652.652 0 01-1.269.298c-.243-1.018-.078-2.184.473-3.498l.014-.035-.008-.012a4.339 4.339 0 01-.598-1.309l-.005-.019a5.764 5.764 0 01-.177-1.785c.044-.91.278-1.842.622-2.59l.012-.026-.002-.002c-.293-.418-.51-.953-.63-1.545l-.005-.024a5.352 5.352 0 01.093-2.49c.262-.915.777-1.701 1.536-2.269.06-.045.123-.09.186-.132-.159-1.493-.119-2.73.112-3.67.127-.518.314-.95.562-1.287.27-.368.614-.622 1.015-.737.266-.076.54-.059.797.042zm4.116 9.09c.936 0 1.8.313 2.446.855.63.527 1.005 1.235 1.005 1.94 0 .888-.406 1.58-1.133 2.022-.62.375-1.451.557-2.403.557-1.009 0-1.871-.259-2.493-.734-.617-.47-.963-1.13-.963-1.845 0-.707.398-1.417 1.056-1.946.668-.537 1.55-.849 2.485-.849zm0 .896a3.07 3.07 0 00-1.916.65c-.461.37-.722.835-.722 1.25 0 .428.21.829.61 1.134.455.347 1.124.548 1.943.548.799 0 1.473-.147 1.932-.426.463-.28.7-.686.7-1.257 0-.423-.246-.89-.683-1.256-.484-.405-1.14-.643-1.864-.643zm.662 1.21l.004.004c.12.151.095.37-.056.49l-.292.23v.446a.375.375 0 01-.376.373.375.375 0 01-.376-.373v-.46l-.271-.218a.347.347 0 01-.052-.49.353.353 0 01.494-.051l.215.172.22-.174a.353.353 0 01.49.051zm-5.04-1.919c.478 0 .867.39.867.871a.87.87 0 01-.868.871.87.87 0 01-.867-.87.87.87 0 01.867-.872zm8.706 0c.48 0 .868.39.868.871a.87.87 0 01-.868.871.87.87 0 01-.867-.87.87.87 0 01.867-.872zM7.44 2.3l-.003.002a.659.659 0 00-.285.238l-.005.006c-.138.189-.258.467-.348.832-.17.692-.216 1.631-.124 2.782.43-.128.899-.208 1.404-.237l.01-.001.019-.034c.046-.082.095-.161.148-.239.123-.771.022-1.692-.253-2.444-.134-.364-.297-.65-.453-.813a.628.628 0 00-.107-.09L7.44 2.3zm9.174.04l-.002.001a.628.628 0 00-.107.09c-.156.163-.32.45-.453.814-.29.794-.387 1.776-.23 2.572l.058.097.008.014h.03a5.184 5.184 0 011.466.212c.086-1.124.038-2.043-.128-2.722-.09-.365-.21-.643-.349-.832l-.004-.006a.659.659 0 00-.285-.239h-.004z"></path></svg>
diff --git a/packages/frontend/public/icons/zai-dark-mode.svg b/packages/frontend/public/icons/zai-dark-mode.svg
deleted file mode 100644
index 57a1b70b..00000000
--- a/packages/frontend/public/icons/zai-dark-mode.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg fill="#ffffff" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Z.ai</title><path d="M12.105 2L9.927 4.953H.653L2.83 2h9.276zM23.254 19.048L21.078 22h-9.242l2.174-2.952h9.244zM24 2L9.264 22H0L14.736 2H24z"></path></svg>
diff --git a/packages/frontend/src/App.tsx b/packages/frontend/src/App.tsx
index 1b804bb0..93d705f5 100644
--- a/packages/frontend/src/App.tsx
+++ b/packages/frontend/src/App.tsx
@@ -13,8 +13,6 @@ import Header from './components/Header.jsx';
 import Sidebar from './components/Sidebar.jsx';
 import AuthGuard from './components/AuthGuard.jsx';
 import VersionIndicator from './components/VersionIndicator.jsx';
-import UsageLimitBanner from './components/UsageLimitBanner.jsx';
-import ApiBotBanner from './components/ApiBotBanner.jsx';
 import { connectSse } from './services/sse.js';
 import { RightSidebarProvider, useRightSidebar } from './services/right-sidebar.jsx';
 
@@ -81,8 +79,6 @@ const AppInner: ParentComponent = (props) => {
           classList={{ 'main-content--full': !showSidebar() }}
           aria-label="Dashboard content"
         >
-          <UsageLimitBanner />
-          <ApiBotBanner />
           {props.children}
         </main>
         {rightSidebar()}
diff --git a/packages/frontend/src/components/AddAgentModal.tsx b/packages/frontend/src/components/AddAgentModal.tsx
index f1e1eaa2..42540142 100644
--- a/packages/frontend/src/components/AddAgentModal.tsx
+++ b/packages/frontend/src/components/AddAgentModal.tsx
@@ -1,17 +1,9 @@
-import {
-  createEffect,
-  createResource,
-  createSignal,
-  onCleanup,
-  Show,
-  type Component,
-} from 'solid-js';
+import { createEffect, createSignal, onCleanup, Show, type Component } from 'solid-js';
 import { useNavigate } from '@solidjs/router';
 import AgentTypeSelect from './AgentTypeSelect.jsx';
 import { createAgent, getGlobalProviders } from '../services/api.js';
 import { toast } from '../services/toast-store.js';
 import { markAgentCreated, markSetupPending } from '../services/recent-agents.js';
-import { checkIsSelfHosted } from '../services/setup-status.js';
 import { refreshAgents } from '../services/sse.js';
 import { type AgentCategory, type AgentPlatform, PLATFORMS_BY_CATEGORY } from 'manifest-shared';
 
@@ -38,9 +30,6 @@ const AddAgentModal: Component<{ open: boolean; onClose: () => void }> = (props)
   // self-hosted).
   const [autofixEnabled, setAutofixEnabled] = createSignal(true);
   const [recordingEnabled, setRecordingEnabled] = createSignal(true);
-  // Where the logs live depends on the deployment: self-hosted keeps them in
-  // the operator's own database, cloud in the Manifest workspace.
-  const [selfHosted] = createResource(checkIsSelfHosted);
 
   // Tracks whether the user dismissed the modal (overlay click / Escape) while a
   // create request was still in flight. A dismissed create must NOT run its
@@ -252,11 +241,8 @@ const AddAgentModal: Component<{ open: boolean; onClose: () => void }> = (props)
                       <span>Enable logs</span>
                     </div>
                     <div class="model-params__label-hint">
-                      See exactly what your agent sends on every attempt, and debug it faster.{' '}
-                      {selfHosted.state === 'ready' &&
-                        (selfHosted()
-                          ? 'Logs stay in your own database.'
-                          : 'Logs are stored in your Manifest workspace.')}
+                      See exactly what your agent sends on every attempt, and debug it faster. Logs
+                      stay in your own database.
                     </div>
                   </div>
                   <div class="model-params__row-control">
diff --git a/packages/frontend/src/components/ApiBotAnnouncement.tsx b/packages/frontend/src/components/ApiBotAnnouncement.tsx
deleted file mode 100644
index 817d1946..00000000
--- a/packages/frontend/src/components/ApiBotAnnouncement.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-import { Show, createSignal, type Component } from 'solid-js';
-import DitherGround from './DitherGround.jsx';
-import { API_BOT_URL } from './ApiBotBanner.jsx';
-
-const API_BOT_CARD_DISMISSED_KEY = 'api-bot-card-dismissed';
-
-/**
- * Sidebar card announcing API Bot, on API Bot's dithered ground. Shows for
- * everyone in every deployment mode with a per-session dismiss.
- */
-const ApiBotAnnouncement: Component = () => {
-  const [dismissed, setDismissed] = createSignal(
-    sessionStorage.getItem(API_BOT_CARD_DISMISSED_KEY) === '1',
-  );
-
-  const dismiss = () => {
-    sessionStorage.setItem(API_BOT_CARD_DISMISSED_KEY, '1');
-    setDismissed(true);
-  };
-
-  return (
-    <Show when={!dismissed()}>
-      <div class="sidebar-api-bot">
-        <DitherGround />
-        <button
-          type="button"
-          class="api-bot-close sidebar-api-bot__close"
-          title="Hide for this session"
-          aria-label="Hide the announcement for this session"
-          onClick={dismiss}
-        >
-          <svg
-            xmlns="http://www.w3.org/2000/svg"
-            width="14"
-            height="14"
-            fill="currentColor"
-            viewBox="0 0 24 24"
-            aria-hidden="true"
-          >
-            <path d="m16.192 6.344-4.243 4.242-4.242-4.242-1.414 1.414L10.535 12l-4.242 4.242 1.414 1.414 4.242-4.242 4.243 4.242 1.414-1.414L13.364 12l4.242-4.242z" />
-          </svg>
-        </button>
-        <img
-          class="sidebar-api-bot__image"
-          src="/api-bot-works-with-any-api.svg"
-          alt="API Bot works with any API"
-          width="1600"
-          height="720"
-        />
-        <span class="sidebar-api-bot__title">Meet API Bot</span>
-        <p class="sidebar-api-bot__text">API changes won't take your app down anymore.</p>
-        <a href={API_BOT_URL} target="_blank" rel="noopener noreferrer" class="api-bot-btn">
-          Get started
-        </a>
-      </div>
-    </Show>
-  );
-};
-
-export default ApiBotAnnouncement;
diff --git a/packages/frontend/src/components/ApiBotBanner.tsx b/packages/frontend/src/components/ApiBotBanner.tsx
deleted file mode 100644
index 5f3ed620..00000000
--- a/packages/frontend/src/components/ApiBotBanner.tsx
+++ /dev/null
@@ -1,55 +0,0 @@
-import { Show, createSignal, type Component } from 'solid-js';
-import DitherGround from './DitherGround.jsx';
-
-export const API_BOT_URL = 'https://manifest.build/api-bot/';
-const API_BOT_BANNER_DISMISSED_KEY = 'api-bot-banner-dismissed';
-
-/**
- * Top-of-page banner announcing API Bot, on API Bot's dithered ground. Shows
- * for everyone with a per-session dismiss.
- */
-const ApiBotBanner: Component = () => {
-  const [dismissed, setDismissed] = createSignal(
-    sessionStorage.getItem(API_BOT_BANNER_DISMISSED_KEY) === '1',
-  );
-
-  const dismiss = () => {
-    sessionStorage.setItem(API_BOT_BANNER_DISMISSED_KEY, '1');
-    setDismissed(true);
-  };
-
-  return (
-    <Show when={!dismissed()}>
-      <div class="api-bot-banner">
-        <DitherGround />
-        <span class="api-bot-banner__text">
-          <strong>Introducing API Bot:</strong> keep your app running through upstream API breaking
-          changes.
-        </span>
-        <a href={API_BOT_URL} target="_blank" rel="noopener noreferrer" class="api-bot-btn">
-          Get started
-        </a>
-        <button
-          type="button"
-          class="api-bot-close"
-          title="Hide for this session"
-          aria-label="Hide this banner for this session"
-          onClick={dismiss}
-        >
-          <svg
-            xmlns="http://www.w3.org/2000/svg"
-            width="14"
-            height="14"
-            fill="currentColor"
-            viewBox="0 0 24 24"
-            aria-hidden="true"
-          >
-            <path d="m16.192 6.344-4.243 4.242-4.242-4.242-1.414 1.414L10.535 12l-4.242 4.242 1.414 1.414 4.242-4.242 4.243 4.242 1.414-1.414L13.364 12l4.242-4.242z" />
-          </svg>
-        </button>
-      </div>
-    </Show>
-  );
-};
-
-export default ApiBotBanner;
diff --git a/packages/frontend/src/components/AuthGuard.tsx b/packages/frontend/src/components/AuthGuard.tsx
index 9d11dc6e..ad5d74c4 100644
--- a/packages/frontend/src/components/AuthGuard.tsx
+++ b/packages/frontend/src/components/AuthGuard.tsx
@@ -2,22 +2,13 @@ import { useLocation, useNavigate } from '@solidjs/router';
 import { Show, createEffect, createSignal, type ParentComponent } from 'solid-js';
 import { authClient } from '../services/auth-client.js';
 import { buildLoginRedirect } from '../services/auth-redirects.js';
-import { hasPlanBeenChosen, markPlanChosen } from '../services/plan-selection.js';
-import { hasOnboardingBeenDone } from '../services/onboarding.js';
 import { getDiscoveryPendingNext } from '../services/discovery.js';
-import { loadPlan } from '../services/plan-store.js';
 
 const AuthGuard: ParentComponent = (props) => {
   const session = authClient.useSession();
   const navigate = useNavigate();
   const location = useLocation();
-  const [planChecked, setPlanChecked] = createSignal(false);
-
-  // Start the plan lookup now, in parallel with the session probe: it only
-  // needs the cookie jar. The effect below awaits the same in-flight promise,
-  // so the two serial round trips before first paint become one. Signed-out
-  // visitors get a 401 that loadPlan neither caches nor surfaces.
-  void loadPlan();
+  const [routeChecked, setRouteChecked] = createSignal(false);
 
   createEffect(() => {
     const s = session();
@@ -28,51 +19,25 @@ const AuthGuard: ParentComponent = (props) => {
     }
     // The CLI consent page and the MCP OAuth consent page are not part of
     // onboarding. Gate them on an authenticated session only, so a user who is
-    // mid-discovery/plan selection can still authorize a client (otherwise the
-    // login flow never gets its code).
+    // mid-discovery can still authorize a client (otherwise the login flow
+    // never gets its code).
     if (location.pathname === '/cli/auth' || location.pathname === '/consent') {
-      setPlanChecked(true);
+      setRouteChecked(true);
       return;
     }
-    const userId = s.data.user?.id;
     // A freshly signed-up user with the discovery step still pending is sent
     // back to it from anywhere in the app except the form itself.
-    const pendingNext = getDiscoveryPendingNext(userId ?? '');
+    const pendingNext = getDiscoveryPendingNext(s.data.user?.id ?? '');
     if (pendingNext !== null && location.pathname !== '/discovery') {
       navigate(`/discovery?next=${encodeURIComponent(pendingNext)}`, { replace: true });
       return;
     }
-    if (planChecked()) return;
-    // Resolve the plan store before rendering any page — downstream consumers
-    // (range locks) read it synchronously. loadPlan never rejects (fail-open)
-    // and costs one indexed query.
-    loadPlan().then((status) => {
-      // /register?step=plan is the plan selection destination — never intercept it.
-      if (location.pathname === '/register') {
-        setPlanChecked(true);
-        return;
-      }
-      if (userId && hasPlanBeenChosen(userId)) {
-        setPlanChecked(true);
-        return;
-      }
-      // Don't gate on plan selection before the user has completed onboarding.
-      if (userId && !hasOnboardingBeenDone(userId)) {
-        setPlanChecked(true);
-        return;
-      }
-      if (status.enabled && status.plan !== 'pro') {
-        navigate('/register?step=plan', { replace: true });
-        return;
-      }
-      if (userId) markPlanChosen(userId);
-      setPlanChecked(true);
-    });
+    setRouteChecked(true);
   });
 
   return (
     <Show
-      when={!session().isPending && session().data && planChecked()}
+      when={!session().isPending && session().data && routeChecked()}
       fallback={
         <div class="auth-layout">
           <div class="auth-card" style="text-align: center;">
diff --git a/packages/frontend/src/components/CloudEmailInfo.tsx b/packages/frontend/src/components/CloudEmailInfo.tsx
deleted file mode 100644
index b520feea..00000000
--- a/packages/frontend/src/components/CloudEmailInfo.tsx
+++ /dev/null
@@ -1,24 +0,0 @@
-import type { Component } from "solid-js";
-
-interface Props {
-  email: string;
-}
-
-const CloudEmailInfo: Component<Props> = (props) => {
-  return (
-    <div class="cloud-email-info">
-      <svg class="cloud-email-info__icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
-        <path d="M4 4h16c1.1 0 2 .9 2 2v12c0 1.1-.9 2-2 2H4c-1.1 0-2-.9-2-2V6c0-1.1.9-2 2-2z" />
-        <polyline points="22,6 12,13 2,6" />
-      </svg>
-      <div>
-        <div class="cloud-email-info__title">Email alerts</div>
-        <div class="cloud-email-info__desc">
-          Alerts will be sent to <strong>{props.email}</strong>
-        </div>
-      </div>
-    </div>
-  );
-};
-
-export default CloudEmailInfo;
diff --git a/packages/frontend/src/components/CustomProviderForm.tsx b/packages/frontend/src/components/CustomProviderForm.tsx
index e3d37cd4..889f0a32 100644
--- a/packages/frontend/src/components/CustomProviderForm.tsx
+++ b/packages/frontend/src/components/CustomProviderForm.tsx
@@ -12,7 +12,6 @@ import {
   type RoutingProvider,
 } from '../services/api.js';
 import { toast } from '../services/toast-store.js';
-import { checkIsSelfHosted } from '../services/setup-status.js';
 import { customProviderColor } from '../services/formatters.js';
 import type { ProviderDef } from '../services/providers.js';
 import type { CustomProviderPrefill } from '../services/routing-params.js';
@@ -99,7 +98,6 @@ const CustomProviderForm: Component<Props> = (props) => {
   const [showDeleteConfirm, setShowDeleteConfirm] = createSignal(false);
   const [probeBusy, setProbeBusy] = createSignal(false);
   const [probeError, setProbeError] = createSignal<string | null>(null);
-  const [isSelfHosted] = createResource(() => checkIsSelfHosted());
 
   // In edit mode an API-key provider manages its keys the way native providers
   // do: each key is a connection, added, renamed, replaced and removed on the
@@ -447,16 +445,14 @@ const CustomProviderForm: Component<Props> = (props) => {
               {probeBusy() ? <span class="spinner" /> : 'Fetch models'}
             </button>
           </div>
-          <Show when={isSelfHosted()}>
-            <div
-              class="provider-detail__hint"
-              style="font-size: var(--font-size-xs); color: hsl(var(--muted-foreground)); margin-top: 4px;"
-            >
-              For local servers use <code>http://host.docker.internal:&lt;port&gt;</code> (Docker),{' '}
-              <code>http://host.containers.internal:&lt;port&gt;</code> (Podman), or{' '}
-              <code>http://localhost:&lt;port&gt;</code> (native). HTTPS required for public URLs.
-            </div>
-          </Show>
+          <div
+            class="provider-detail__hint"
+            style="font-size: var(--font-size-xs); color: hsl(var(--muted-foreground)); margin-top: 4px;"
+          >
+            For local servers use <code>http://host.docker.internal:&lt;port&gt;</code> (Docker),{' '}
+            <code>http://host.containers.internal:&lt;port&gt;</code> (Podman), or{' '}
+            <code>http://localhost:&lt;port&gt;</code> (native). HTTPS required for public URLs.
+          </div>
           <Show when={probeError()}>
             <div class="provider-detail__error" role="alert" style="margin-top: 4px;">
               {probeError()}
diff --git a/packages/frontend/src/components/DitherGround.tsx b/packages/frontend/src/components/DitherGround.tsx
deleted file mode 100644
index 51b5a220..00000000
--- a/packages/frontend/src/components/DitherGround.tsx
+++ /dev/null
@@ -1,11 +0,0 @@
-import { onCleanup, onMount, type Component } from 'solid-js';
-import { mountDither } from '../services/dither-ground.js';
-
-/** API Bot's dithered ground, filling its positioned parent. */
-const DitherGround: Component = () => {
-  let canvas!: HTMLCanvasElement;
-  onMount(() => onCleanup(mountDither(canvas)));
-  return <canvas ref={canvas} class="dither-ground" aria-hidden="true" />;
-};
-
-export default DitherGround;
diff --git a/packages/frontend/src/components/EmailProviderSection.tsx b/packages/frontend/src/components/EmailProviderSection.tsx
index 91185ec5..0c27e05b 100644
--- a/packages/frontend/src/components/EmailProviderSection.tsx
+++ b/packages/frontend/src/components/EmailProviderSection.tsx
@@ -12,7 +12,7 @@ interface EmailProviderSectionProps {
 }
 
 // No margin on the wrapper: .provider-card carries its own bottom gap, and the
-// unboxed setup/skeleton branches bring theirs, so spacing matches cloud's card.
+// unboxed setup/skeleton branches bring theirs.
 const EmailProviderSection: Component<EmailProviderSectionProps> = (props) => (
   <div>
     <Show
diff --git a/packages/frontend/src/components/GuestGuard.tsx b/packages/frontend/src/components/GuestGuard.tsx
index 00070510..fbdabd7a 100644
--- a/packages/frontend/src/components/GuestGuard.tsx
+++ b/packages/frontend/src/components/GuestGuard.tsx
@@ -3,7 +3,6 @@ import { Show, createEffect, createSignal, onMount, type ParentComponent } from
 import { authClient } from '../services/auth-client.js';
 import { getAuthDestination, signedOAuthDestination } from '../services/auth-redirects.js';
 import { checkNeedsSetup } from '../services/setup-status.js';
-import { hasPlanBeenChosen } from '../services/plan-selection.js';
 import { getDiscoveryPendingNext } from '../services/discovery.js';
 
 const GuestGuard: ParentComponent = (props) => {
@@ -25,7 +24,6 @@ const GuestGuard: ParentComponent = (props) => {
 
   createEffect(() => {
     const s = session();
-    const step = Array.isArray(searchParams.step) ? searchParams.step[0] : searchParams.step;
     if (!s.isPending && s.data) {
       const destination = getAuthDestination(searchParams, location.search);
       if (signedOAuthDestination(location.search) === destination) {
@@ -40,10 +38,6 @@ const GuestGuard: ParentComponent = (props) => {
         navigate(`/discovery?next=${encodeURIComponent(pendingNext)}`, { replace: true });
         return;
       }
-      if (step === 'plan' && !hasPlanBeenChosen(s.data.user?.id ?? '')) {
-        if (setupChecked()) setReady(true);
-        return;
-      }
       navigate(destination, { replace: true });
     }
     if (setupChecked() && !s.isPending && !s.data) {
diff --git a/packages/frontend/src/components/Header.tsx b/packages/frontend/src/components/Header.tsx
index 44c20a45..f681bf81 100644
--- a/packages/frontend/src/components/Header.tsx
+++ b/packages/frontend/src/components/Header.tsx
@@ -1,20 +1,10 @@
 import { A, useLocation, useNavigate } from '@solidjs/router';
-import {
-  Show,
-  createSignal,
-  createEffect,
-  createResource,
-  onCleanup,
-  onMount,
-  type Component,
-} from 'solid-js';
+import { Show, createSignal, createEffect, onCleanup, type Component } from 'solid-js';
 import { useAgentName } from '../services/routing.js';
 import { authClient } from '../services/auth-client.js';
 import { agentDisplayName } from '../services/agent-display-name.js';
 import { agentPlatformIcon } from '../services/agent-platform-store.js';
-import { checkIsSelfHosted } from '../services/setup-status.js';
 import NotificationBell from './NotificationBell.jsx';
-import { getBillingStatus } from '../services/api/billing.js';
 import {
   connectionBreadcrumbName,
   connectionBreadcrumbProviderId,
@@ -25,11 +15,6 @@ import {
 import { providerIcon } from './ProviderIcon.jsx';
 import DuplicateAgentModal from './DuplicateAgentModal.jsx';
 
-const GITHUB_REPO = 'mnfst/llm-gateway';
-const STAR_DISMISSED_KEY = 'github-star-dismissed';
-const STAR_CACHE_KEY = 'github-star-count';
-const STAR_CACHE_TS_KEY = 'github-star-ts';
-const STAR_CACHE_TTL = 3600000; // 1 hour
 const DOCS_BASE_URL = 'https://manifest.build/llm-gateway/docs';
 
 interface HeaderProps {
@@ -44,60 +29,15 @@ const Header: Component<HeaderProps> = (props) => {
   const [menuOpen, setMenuOpen] = createSignal(false);
   const [gearOpen, setGearOpen] = createSignal(false);
   const [duplicateOpen, setDuplicateOpen] = createSignal(false);
-  const [starCount, setStarCount] = createSignal<number | null>(null);
-  const [starDismissed, setStarDismissed] = createSignal(
-    sessionStorage.getItem(STAR_DISMISSED_KEY) === 'true',
-  );
-  const [isSelfHosted, setIsSelfHosted] = createSignal(false);
   const session = authClient.useSession();
   const navigate = useNavigate();
-  const [billing] = createResource(async () => {
-    try {
-      return await getBillingStatus();
-    } catch {
-      return null;
-    }
-  });
-  const isPro = () => billing()?.enabled && billing()?.plan === 'pro';
-
-  onMount(() => {
-    checkIsSelfHosted().then(setIsSelfHosted);
-    if (!starDismissed()) {
-      const cachedCount = sessionStorage.getItem(STAR_CACHE_KEY);
-      const cachedTs = sessionStorage.getItem(STAR_CACHE_TS_KEY);
-      if (cachedCount && cachedTs && Date.now() - Number(cachedTs) < STAR_CACHE_TTL) {
-        setStarCount(Number(cachedCount));
-        return;
-      }
-      fetch('/api/v1/github/stars')
-        .then((r) => r.json())
-        .then((data) => {
-          if (typeof data.stars === 'number') {
-            setStarCount(data.stars);
-            sessionStorage.setItem(STAR_CACHE_KEY, String(data.stars));
-            sessionStorage.setItem(STAR_CACHE_TS_KEY, String(Date.now()));
-          }
-        })
-        .catch(() => {});
-    }
-  });
-
-  const dismissStar = (e: MouseEvent) => {
-    e.preventDefault();
-    e.stopPropagation();
-    sessionStorage.setItem(STAR_DISMISSED_KEY, 'true');
-    setStarDismissed(true);
-  };
-
-  const formatCount = (n: number): string => {
-    return n.toLocaleString('en-US');
-  };
 
   const user = () => session()?.data?.user;
   const effectiveName = () => user()?.name ?? 'User';
   const docsUrl = () => {
     const p = location.pathname;
-    if (p.includes('/guardrails') || p.includes('/limits')) return `${DOCS_BASE_URL}/observability/`;
+    if (p.includes('/guardrails') || p.includes('/limits'))
+      return `${DOCS_BASE_URL}/observability/`;
     if (p.includes('/routing')) return `${DOCS_BASE_URL}/llm-gateway/`;
     if (p.startsWith('/providers/subscriptions')) {
       return `${DOCS_BASE_URL}/providers/subscription-based-providers/`;
@@ -147,11 +87,6 @@ const Header: Component<HeaderProps> = (props) => {
           />
           <img src="/logotype-dark.svg" alt="" class="header__logo-img header__logo-img--dark" />
         </A>
-        <Show when={isSelfHosted()}>
-          <span class="header__mode-badge" title="Running on the self-hosted version of Manifest">
-            Self-hosted
-          </span>
-        </Show>
         <Show when={getAgentName()}>
           <span class="header__separator">/</span>
           <A href="/harnesses" class="header__breadcrumb-link" style="font-weight: 500;">
@@ -298,54 +233,6 @@ const Header: Component<HeaderProps> = (props) => {
           Docs
         </a>
         <NotificationBell />
-        <Show when={!starDismissed()}>
-          <div class="header__star-separator" />
-          <div class="header__github-star">
-            <a
-              href={`https://github.com/${GITHUB_REPO}`}
-              target="_blank"
-              rel="noopener noreferrer"
-              class="header__github-star-btn"
-            >
-              <span class="header__github-star-action">
-                <svg
-                  class="header__github-icon"
-                  width="16"
-                  height="16"
-                  viewBox="0 0 16 16"
-                  fill="currentColor"
-                  aria-hidden="true"
-                >
-                  <path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z" />
-                </svg>
-                <span class="header__github-star-label">Star</span>
-              </span>
-              <Show when={starCount() !== null}>
-                <span class="header__github-star-count">{formatCount(starCount()!)}</span>
-              </Show>
-            </a>
-            <button
-              class="header__github-star-close"
-              onClick={dismissStar}
-              aria-label="Dismiss GitHub star button"
-            >
-              <svg
-                width="10"
-                height="10"
-                viewBox="0 0 10 10"
-                fill="none"
-                stroke="currentColor"
-                stroke-width="1.5"
-                stroke-linecap="round"
-                aria-hidden="true"
-              >
-                <line x1="2" y1="2" x2="8" y2="8" />
-                <line x1="8" y1="2" x2="2" y2="8" />
-              </svg>
-            </button>
-          </div>
-          <div class="header__star-separator" />
-        </Show>
         <div class="header__user" style="position: relative;">
           <button
             class="header__avatar-btn"
@@ -359,12 +246,7 @@ const Header: Component<HeaderProps> = (props) => {
           <Show when={menuOpen()}>
             <div class="header__dropdown" role="menu">
               <div class="header__dropdown-header">
-                <span class="header__dropdown-name">
-                  {effectiveName()}
-                  <Show when={isPro()}>
-                    <span class="header__pro-badge">PRO</span>
-                  </Show>
-                </span>
+                <span class="header__dropdown-name">{effectiveName()}</span>
                 <span class="header__dropdown-email">{user()?.email ?? ''}</span>
               </div>
               <div class="header__dropdown-divider" />
diff --git a/packages/frontend/src/components/MessageDetails.tsx b/packages/frontend/src/components/MessageDetails.tsx
index da639d09..438f4e4b 100644
--- a/packages/frontend/src/components/MessageDetails.tsx
+++ b/packages/frontend/src/components/MessageDetails.tsx
@@ -1,5 +1,4 @@
 import { createResource, createSignal, For, Show, type JSX } from 'solid-js';
-import { A } from '@solidjs/router';
 import {
   getMessageDetails,
   flagMessageMiscategorized,
@@ -10,7 +9,6 @@ import { inferProviderName } from '../services/routing-utils.js';
 import { getModelDisplayName } from '../services/model-display.js';
 import { AUTOFIX_STATUS_LABELS, manifestErrorDocsUrl, isSuccessStatus } from 'manifest-shared';
 import { formatErrorClass, formatErrorOrigin } from '../services/formatters.js';
-import { isPlanRequestLimitMessage } from '../services/message-error-taxonomy.js';
 import { ModelParamsSection, RequestHeadersSection } from './MessageDetailsSections.jsx';
 import { routingTierLabel } from './message-table-types.js';
 
@@ -284,7 +282,6 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
           const hasTrigger = isAutofixRetry || isFallbackTrigger;
           const hasNextAction = isAutofixOriginal || isFallbackError;
           const isTripleLayout = hasTrigger && hasNextAction && !!m.error_message;
-          const isPlanLimitBlock = () => isPlanRequestLimitMessage(m);
           return (
             <>
               {/* ── Message section — always first ─────────────────── */}
@@ -364,22 +361,7 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                           <line x1="15" y1="9" x2="9" y2="15" />
                           <line x1="9" y1="9" x2="15" y2="15" />
                         </svg>
-                        <span>
-                          {m.error_message}
-                          <Show when={isPlanLimitBlock()}>
-                            {' '}
-                            Upgrade to Pro for unlimited requests.
-                          </Show>
-                        </span>
-                        <Show when={isPlanLimitBlock()}>
-                          <A
-                            href="/upgrade?reason=requests"
-                            class="btn btn--primary btn--sm"
-                            style="text-decoration: none; flex-shrink: 0; margin-left: 8px;"
-                          >
-                            Upgrade plan
-                          </A>
-                        </Show>
+                        <span>{m.error_message}</span>
                       </div>
                       <table class="error-autofix-row__meta-table">
                         <tbody>
@@ -441,8 +423,6 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                                     'The provider experienced an internal error.'}
                                   {m.error_class === 'no_provider_key' &&
                                     'No API key is configured for this provider.'}
-                                  {m.error_class === 'plan_request_limit_exceeded' &&
-                                    'The Manifest Free plan monthly request quota was reached.'}
                                 </span>
                               </td>
                             </tr>
diff --git a/packages/frontend/src/components/ModelPickerModal.tsx b/packages/frontend/src/components/ModelPickerModal.tsx
index 594c6d6b..2a35f915 100644
--- a/packages/frontend/src/components/ModelPickerModal.tsx
+++ b/packages/frontend/src/components/ModelPickerModal.tsx
@@ -125,7 +125,7 @@ const ModelPickerModal: Component<Props> = (props) => {
   // Default to the first connected category (subscription > api_key > local)
   // so the picker opens on something the user actually has. When nothing is
   // connected the default is 'api_key' — matches the pre-local behavior so
-  // existing snapshots / tests that assume the free-models pill is visible
+  // existing snapshots / tests that assume the free-only pill is visible
   // (only shown for api_key) don't start failing.
   const resolveInitialTab = (): AuthType => {
     if (hasSubscription()) return 'subscription';
diff --git a/packages/frontend/src/components/NoConnectionsPrompt.tsx b/packages/frontend/src/components/NoConnectionsPrompt.tsx
index 42e3f4aa..2ae9696d 100644
--- a/packages/frontend/src/components/NoConnectionsPrompt.tsx
+++ b/packages/frontend/src/components/NoConnectionsPrompt.tsx
@@ -1,6 +1,5 @@
 import { A } from '@solidjs/router';
-import { createResource, Show, type Component } from 'solid-js';
-import { checkIsSelfHosted } from '../services/setup-status.js';
+import type { Component } from 'solid-js';
 
 const SubscriptionIcon = () => (
   <svg
@@ -51,8 +50,6 @@ const LocalIcon = () => (
 );
 
 const NoConnectionsPrompt: Component = () => {
-  const [selfHosted] = createResource(checkIsSelfHosted);
-
   return (
     <div class="no-connections-prompt">
       <div class="no-connections-prompt__header">
@@ -94,27 +91,22 @@ const NoConnectionsPrompt: Component = () => {
             Connect provider
           </button>
         </A>
-        <Show when={selfHosted()}>
-          <A
-            href="/providers/local"
-            class="no-connections-prompt__card"
-            style="text-decoration: none;"
-          >
-            <span class="no-connections-prompt__card-icon">
-              <LocalIcon />
-            </span>
-            <span class="no-connections-prompt__card-title">Local</span>
-            <span class="no-connections-prompt__card-desc">
-              Connect to LLM servers running on your machine.
-            </span>
-            <button
-              class="btn btn--primary btn--sm"
-              style="margin-top: auto; pointer-events: none;"
-            >
-              Connect provider
-            </button>
-          </A>
-        </Show>
+        <A
+          href="/providers/local"
+          class="no-connections-prompt__card"
+          style="text-decoration: none;"
+        >
+          <span class="no-connections-prompt__card-icon">
+            <LocalIcon />
+          </span>
+          <span class="no-connections-prompt__card-title">Local</span>
+          <span class="no-connections-prompt__card-desc">
+            Connect to LLM servers running on your machine.
+          </span>
+          <button class="btn btn--primary btn--sm" style="margin-top: auto; pointer-events: none;">
+            Connect provider
+          </button>
+        </A>
       </div>
     </div>
   );
diff --git a/packages/frontend/src/components/PlanPicker.tsx b/packages/frontend/src/components/PlanPicker.tsx
deleted file mode 100644
index d538c160..00000000
--- a/packages/frontend/src/components/PlanPicker.tsx
+++ /dev/null
@@ -1,187 +0,0 @@
-import { For, Show, createSignal, type Component } from 'solid-js';
-import { FREE_REQUEST_LIMIT_LABEL } from '../services/billing-display.js';
-
-/* ── Plan data ───────────────────────────────────────── */
-
-const freeFeatures = [
-  'Unlimited agents',
-  `${FREE_REQUEST_LIMIT_LABEL} routed requests / month`,
-  'All providers, no restrictions',
-  'Subscription providers (Claude, ChatGPT, Gemini...)',
-  '7-day dashboard retention',
-  'Autofix',
-  'Budget alerts and notifications',
-  'Community support via Discord',
-];
-
-const proFeatures = [
-  'Unlimited routed requests',
-  '365 days dashboard retention',
-  'Basic support (platform issues, billing, licence activation)',
-];
-
-const enterpriseFeatures = [
-  'Multiple seats and team management',
-  'SSO / SAML',
-  'Audit logs',
-  'Custom retention',
-  'Uptime SLA',
-  'SOC 2 Type II and ISO 27001',
-  'HIPAA and custom BAAs',
-  'Custom guardrails',
-  'Dedicated support (Slack and email)',
-];
-
-export type PlanId = 'free' | 'pro' | 'enterprise';
-
-interface PlanDef {
-  id: PlanId;
-  name: string;
-  price: string;
-  period?: string;
-  desc: string;
-  features: string[];
-  popular?: boolean;
-}
-
-export interface PlanPickerProps {
-  /** Price label for Pro plan (e.g. "$19"). Falls back to "Pro" if null. */
-  proPrice?: string | null;
-  /** Called when the user clicks "Choose this plan". */
-  onSelect: (plan: PlanId) => void;
-  /** Show a loading spinner on the selected plan's button. */
-  busy?: boolean;
-  /** Current usage (free plan only). */
-  usedRequests?: number | null;
-}
-
-const fmt = (n: number) => n.toLocaleString('en-US');
-
-const PlanPicker: Component<PlanPickerProps> = (props) => {
-  const [expanded, setExpanded] = createSignal<PlanId | null>('pro');
-
-  const plans = (): PlanDef[] => [
-    {
-      id: 'free',
-      name: 'Free',
-      price: '$0',
-      period: '/month',
-      desc: 'For prototypes and small projects.',
-      features: freeFeatures,
-    },
-    {
-      id: 'pro',
-      name: 'Pro',
-      price: props.proPrice ?? 'Pro',
-      period: props.proPrice ? '/month' : undefined,
-      desc: 'For production projects. Longer data access and unlimited agents. Not suited for teams.',
-      features: proFeatures,
-      popular: true,
-    },
-    {
-      id: 'enterprise',
-      name: 'Enterprise',
-      price: 'Custom',
-      desc: 'For scaling projects, large scale teams. Enterprise-grade support and security.',
-      features: enterpriseFeatures,
-    },
-  ];
-
-  const toggle = (id: PlanId) => {
-    setExpanded((prev) => (prev === id ? null : id));
-  };
-
-  return (
-    <div class="plan-picker">
-      <For each={plans()}>
-        {(plan) => {
-          const isExpanded = () => expanded() === plan.id;
-
-          return (
-            <button
-              type="button"
-              class={`plan-picker__card${plan.popular ? ' plan-picker__card--pro' : ''}${isExpanded() ? ' plan-picker__card--expanded' : ''}`}
-              onClick={() => toggle(plan.id)}
-            >
-              <div class="plan-picker__row">
-                <div class="plan-picker__name">
-                  <span class="plan-picker__radio">
-                    <Show when={isExpanded()}>
-                      <span class="plan-picker__radio-dot" />
-                    </Show>
-                  </span>
-                  <span>{plan.name}</span>
-                  <Show when={plan.popular}>
-                    <span class="plan-picker__badge">Popular</span>
-                  </Show>
-                </div>
-                <div class="plan-picker__price-inline">
-                  <span class="plan-picker__amount">{plan.price}</span>
-                  <Show when={plan.period}>
-                    <span class="plan-picker__period">{plan.period}</span>
-                  </Show>
-                </div>
-              </div>
-
-              <Show when={isExpanded()}>
-                <div class="plan-picker__details">
-                  <Show when={plan.id === 'free' && props.usedRequests != null}>
-                    <p class="plan-picker__usage">{fmt(props.usedRequests!)} used this month</p>
-                  </Show>
-                  <ul class="plan-picker__features">
-                    <For each={plan.features}>
-                      {(feature) => (
-                        <li>
-                          <svg
-                            xmlns="http://www.w3.org/2000/svg"
-                            width="14"
-                            height="14"
-                            fill="#2632EF"
-                            viewBox="0 0 24 24"
-                            aria-hidden="true"
-                          >
-                            <path d="M9 15.59 4.71 11.3 3.3 12.71l5 5c.2.2.45.29.71.29s.51-.1.71-.29l11-11-1.41-1.41L9.02 15.59Z" />
-                          </svg>
-                          <span>{feature}</span>
-                        </li>
-                      )}
-                    </For>
-                  </ul>
-                </div>
-              </Show>
-            </button>
-          );
-        }}
-      </For>
-
-      <Show when={expanded()}>
-        <Show
-          when={expanded() !== 'enterprise'}
-          fallback={
-            <a
-              class="auth-form__submit plan-picker__cta"
-              href="https://manifest.build/pricing"
-              target="_blank"
-              rel="noopener noreferrer"
-            >
-              Talk to sales
-            </a>
-          }
-        >
-          <button
-            type="button"
-            class="auth-form__submit plan-picker__cta"
-            disabled={props.busy}
-            onClick={() => props.onSelect(expanded()!)}
-          >
-            {props.busy ? <span class="spinner" /> : 'Choose this plan'}
-          </button>
-        </Show>
-      </Show>
-    </div>
-  );
-};
-
-export default PlanPicker;
-
-export { freeFeatures, proFeatures, enterpriseFeatures };
diff --git a/packages/frontend/src/components/ProviderIcon.tsx b/packages/frontend/src/components/ProviderIcon.tsx
index 8ebe7ac0..849198e2 100644
--- a/packages/frontend/src/components/ProviderIcon.tsx
+++ b/packages/frontend/src/components/ProviderIcon.tsx
@@ -131,7 +131,6 @@ export function providerIcon(id: string, size: number = 20): JSX.Element | null
       );
 
     /* ── Gemini ───────────────────────────────────── */
-    case 'gemini-free':
     case 'gemini':
       return (
         <svg
diff --git a/packages/frontend/src/components/ProviderSelectContent.tsx b/packages/frontend/src/components/ProviderSelectContent.tsx
index ed6ed394..98605856 100644
--- a/packages/frontend/src/components/ProviderSelectContent.tsx
+++ b/packages/frontend/src/components/ProviderSelectContent.tsx
@@ -1,4 +1,4 @@
-import { createEffect, createSignal, onMount, Show, type Component } from 'solid-js';
+import { createEffect, createSignal, Show, type Component } from 'solid-js';
 import { normalizeProviderName } from 'manifest-shared';
 import { PROVIDERS, type ProviderDef } from '../services/providers.js';
 import {
@@ -10,7 +10,6 @@ import {
 } from '../services/api.js';
 import { toast } from '../services/toast-store.js';
 import type { CustomProviderPrefill, ProviderDeepLink } from '../services/routing-params.js';
-import { checkIsSelfHosted } from '../services/setup-status.js';
 import CustomProviderForm from './CustomProviderForm.js';
 import CopilotDeviceLogin from './CopilotDeviceLogin.js';
 import LocalServerDetailView from './LocalServerDetailView.js';
@@ -40,7 +39,7 @@ const ProviderSelectContent: Component<ProviderSelectContentProps> = (props) =>
   const deepLink = props.providerDeepLink;
   const deepLinkProv = deepLink ? PROVIDERS.find((p) => p.id === deepLink.providerId) : null;
   // A `custom:<id>` deep link can't resolve to a standard PROVIDERS entry; it
-  // targets a custom provider whose editor we open directly (see onMount below).
+  // targets a custom provider whose editor we open directly (see the effect below).
   const deepLinkCustomId = deepLink?.providerId.startsWith('custom:')
     ? deepLink.providerId.slice('custom:'.length)
     : null;
@@ -48,10 +47,6 @@ const ProviderSelectContent: Component<ProviderSelectContentProps> = (props) =>
   const [activeTab, setActiveTab] = createSignal<'subscription' | 'api_key' | 'local'>(
     deepLink?.authType ?? props.initialTab ?? 'subscription',
   );
-  const [isSelfHosted, setIsSelfHosted] = createSignal(false);
-  onMount(async () => {
-    setIsSelfHosted(await checkIsSelfHosted());
-  });
   // Custom-provider deep link: open the custom editor for the matching id
   // instead of leaving the modal on the provider list (which can't resolve a
   // `custom:` id). An effect (not onMount) covers custom providers that load
diff --git a/packages/frontend/src/components/Sidebar.tsx b/packages/frontend/src/components/Sidebar.tsx
index 2e337f26..1fbe77cd 100644
--- a/packages/frontend/src/components/Sidebar.tsx
+++ b/packages/frontend/src/components/Sidebar.tsx
@@ -1,10 +1,7 @@
 import { A, useLocation } from '@solidjs/router';
 import { Show, createSignal, createResource, type Component } from 'solid-js';
-import { getBillingStatus } from '../services/api/billing.js';
-import { FREE_REQUEST_LIMIT_LABEL } from '../services/billing-display.js';
-import { checkIsSelfHosted, checkMcpEnabled } from '../services/setup-status.js';
+import { checkMcpEnabled } from '../services/setup-status.js';
 import AddAgentModal from './AddAgentModal.jsx';
-import ApiBotAnnouncement from './ApiBotAnnouncement.jsx';
 
 interface SidebarProps {
   mobileOpen?: boolean;
@@ -26,24 +23,11 @@ const Sidebar: Component<SidebarProps> = (props) => {
   const location = useLocation();
   const isGlobalActive = makeIsGlobalActive(() => location.pathname);
   const [addModalOpen, setAddModalOpen] = createSignal(false);
-  // Local providers only exist on self-hosted installs — a cloud backend
-  // can't reach the user's localhost, so the Local entry is hidden there.
-  const [selfHosted] = createResource(checkIsSelfHosted);
   // An install served over plain HTTP cannot host the MCP OAuth resource, so
   // the backend runs without the endpoint entirely. The entry waits for the
-  // status like the Local one does, rather than appearing and then vanishing
-  // on the installs that don't have it.
+  // status rather than appearing and then vanishing on the installs that don't
+  // have it.
   const [mcpEnabled] = createResource(checkMcpEnabled);
-  const [billing] = createResource(async () => {
-    try {
-      return await getBillingStatus();
-    } catch {
-      return null;
-    }
-  });
-  const showUpgrade = () => billing()?.enabled && billing()?.plan === 'free';
-  const requestLimitLabel = () =>
-    billing()?.requests.limit?.toLocaleString('en-US') ?? FREE_REQUEST_LIMIT_LABEL;
 
   const handleNav = () => {
     props.onNavigate?.();
@@ -109,16 +93,14 @@ const Sidebar: Component<SidebarProps> = (props) => {
         </button>
       </div>
       <div class="sidebar__section-label">PROVIDERS</div>
-      <Show when={selfHosted()}>
-        <A
-          href="/providers/local"
-          class="sidebar__link"
-          classList={{ active: isGlobalActive('/providers/local') }}
-          aria-current={isGlobalActive('/providers/local') ? 'page' : undefined}
-        >
-          Local
-        </A>
-      </Show>
+      <A
+        href="/providers/local"
+        class="sidebar__link"
+        classList={{ active: isGlobalActive('/providers/local') }}
+        aria-current={isGlobalActive('/providers/local') ? 'page' : undefined}
+      >
+        Local
+      </A>
       <A
         href="/providers/usage-based"
         class="sidebar__link"
@@ -171,72 +153,6 @@ const Sidebar: Component<SidebarProps> = (props) => {
         Playground
       </A>
 
-      <div class="sidebar__spacer" />
-
-      {/* API Bot announcement: shows for everyone in every deployment mode,
-          with a per-session dismiss. Links to manifest.build/api-bot/. */}
-      <ApiBotAnnouncement />
-
-      <Show when={!selfHosted() && showUpgrade()}>
-        <div class="sidebar-usage">
-          <span class="sidebar-usage__title">
-            {new Date().toLocaleDateString('en-US', { month: 'long' })} usage
-          </span>
-          <span
-            class="sidebar-usage__count"
-            classList={{
-              'sidebar-usage__count--danger':
-                (billing()!.requests.used ?? 0) / (billing()!.requests.limit ?? 1) >= 0.8,
-            }}
-          >
-            {billing()!.requests.used != null
-              ? billing()!.requests.used!.toLocaleString('en-US')
-              : '0'}
-            {' / '}
-            {billing()!.requests.limit != null
-              ? billing()!.requests.limit!.toLocaleString('en-US')
-              : '0'}
-            {' requests'}
-          </span>
-          <div class="sidebar-usage__bar">
-            <div
-              class="sidebar-usage__fill"
-              classList={{
-                'sidebar-usage__fill--warning':
-                  (billing()!.requests.used ?? 0) / (billing()!.requests.limit ?? 1) >= 0.5 &&
-                  (billing()!.requests.used ?? 0) / (billing()!.requests.limit ?? 1) < 0.8,
-                'sidebar-usage__fill--danger':
-                  (billing()!.requests.used ?? 0) / (billing()!.requests.limit ?? 1) >= 0.8,
-              }}
-              style={{
-                width: `${Math.min(100, ((billing()!.requests.used ?? 0) / (billing()!.requests.limit ?? 1)) * 100)}%`,
-              }}
-            />
-          </div>
-          <Show when={(billing()!.requests.used ?? 0) / (billing()!.requests.limit ?? 1) >= 0.8}>
-            <p class="sidebar-usage__alert">
-              {(billing()!.requests.used ?? 0) >= (billing()!.requests.limit ?? 1)
-                ? "You've reached your monthly limit. Requests are being blocked."
-                : `You're limited to ${requestLimitLabel()} requests this month. Upgrade for unlimited.`}
-            </p>
-          </Show>
-        </div>
-        <A href="/upgrade" class="sidebar-upgrade" onClick={handleNav}>
-          <svg
-            xmlns="http://www.w3.org/2000/svg"
-            width="16"
-            height="16"
-            fill="currentColor"
-            viewBox="0 0 24 24"
-            aria-hidden="true"
-          >
-            <path d="M12 2C6.486 2 2 6.486 2 12s4.486 10 10 10 10-4.486 10-10S17.514 2 12 2m0 18c-4.411 0-8-3.589-8-8s3.589-8 8-8 8 3.589 8 8-3.589 8-8 8" />
-            <path d="m8 12 1.41 1.41L11 11.83V17h2v-5.17l1.59 1.59L16 12l-4-4z" />
-          </svg>
-          Upgrade plan
-        </A>
-      </Show>
-
       {/* Create-harness modal, opened by the + button next to the Harnesses nav link */}
       <AddAgentModal open={addModalOpen()} onClose={() => setAddModalOpen(false)} />
     </nav>
diff --git a/packages/frontend/src/components/UpgradeSuccessModal.tsx b/packages/frontend/src/components/UpgradeSuccessModal.tsx
deleted file mode 100644
index 55d1fc69..00000000
--- a/packages/frontend/src/components/UpgradeSuccessModal.tsx
+++ /dev/null
@@ -1,81 +0,0 @@
-import { Show, type Component } from 'solid-js';
-import { Portal } from 'solid-js/web';
-
-interface UpgradeSuccessModalProps {
-  open: boolean;
-  onClose: () => void;
-}
-
-const features = [
-  'Unlimited routed requests',
-  '365 days dashboard retention',
-  'Basic support (platform issues, billing, licence activation)',
-];
-
-const UpgradeSuccessModal: Component<UpgradeSuccessModalProps> = (props) => {
-  return (
-    <Show when={props.open}>
-      <Portal>
-        <div
-          class="modal-backdrop"
-          onClick={() => props.onClose()}
-          onKeyDown={(e) => {
-            if (e.key === 'Escape') props.onClose();
-          }}
-        >
-          <div
-            class="modal upgrade-success-modal"
-            role="dialog"
-            aria-modal="true"
-            aria-label="Upgrade successful"
-            onClick={(e) => e.stopPropagation()}
-          >
-            <div class="upgrade-success-modal__body">
-              <div class="upgrade-success-modal__icon">
-                <svg
-                  xmlns="http://www.w3.org/2000/svg"
-                  width="20"
-                  height="20"
-                  fill="#2632EF"
-                  viewBox="0 0 24 24"
-                  aria-hidden="true"
-                >
-                  <path d="M9 15.59 4.71 11.3 3.3 12.71l5 5c.2.2.45.29.71.29s.51-.1.71-.29l11-11-1.41-1.41L9.02 15.59Z" />
-                </svg>
-              </div>
-              <h2 class="upgrade-success-modal__title">You're now on the Pro plan</h2>
-              <p class="upgrade-success-modal__subtitle">
-                Your workspace has been upgraded. Here's what you now have access to:
-              </p>
-              <ul class="upgrade-success-modal__features">
-                {features.map((f) => (
-                  <li>
-                    <svg
-                      xmlns="http://www.w3.org/2000/svg"
-                      width="16"
-                      height="16"
-                      fill="#2632EF"
-                      viewBox="0 0 24 24"
-                      aria-hidden="true"
-                    >
-                      <path d="M9 15.59 4.71 11.3 3.3 12.71l5 5c.2.2.45.29.71.29s.51-.1.71-.29l11-11-1.41-1.41L9.02 15.59Z" />
-                    </svg>
-                    <span>{f}</span>
-                  </li>
-                ))}
-              </ul>
-              <button
-                class="btn btn--primary upgrade-success-modal__done"
-                onClick={() => props.onClose()}
-              >
-                Done
-              </button>
-            </div>
-          </div>
-        </div>
-      </Portal>
-    </Show>
-  );
-};
-
-export default UpgradeSuccessModal;
diff --git a/packages/frontend/src/components/UsageLimitBanner.tsx b/packages/frontend/src/components/UsageLimitBanner.tsx
deleted file mode 100644
index 9675a2fb..00000000
--- a/packages/frontend/src/components/UsageLimitBanner.tsx
+++ /dev/null
@@ -1,103 +0,0 @@
-import { A } from '@solidjs/router';
-import { Show, createEffect, createResource, createSignal, type Component } from 'solid-js';
-import { getBillingStatus } from '../services/api/billing.js';
-import { authClient } from '../services/auth-client.js';
-
-const DISMISS_KEY = 'manifest_usage_banner_dismissed';
-
-function isDismissedToday(key: string | null): boolean {
-  if (!key) return false;
-  try {
-    const stored = localStorage.getItem(key);
-    if (!stored) return false;
-    const today = new Date().toISOString().slice(0, 10);
-    return stored === today;
-  } catch {
-    return false;
-  }
-}
-
-function dismissForToday(key: string | null): void {
-  if (!key) return;
-  try {
-    const today = new Date().toISOString().slice(0, 10);
-    localStorage.setItem(key, today);
-  } catch {
-    /* noop */
-  }
-}
-
-const UsageLimitBanner: Component = () => {
-  const session = authClient.useSession();
-  const dismissKey = () => {
-    const userId = session()?.data?.user?.id;
-    return userId ? `${DISMISS_KEY}:${userId}` : null;
-  };
-  const [dismissed, setDismissed] = createSignal(false);
-  const [billing] = createResource(async () => {
-    try {
-      return await getBillingStatus();
-    } catch {
-      return null;
-    }
-  });
-
-  createEffect(() => setDismissed(isDismissedToday(dismissKey())));
-
-  const ratio = () => {
-    const b = billing();
-    if (!b?.enabled || b.plan !== 'free' || b.requests.limit == null) return 0;
-    return (b.requests.used ?? 0) / b.requests.limit;
-  };
-
-  const atLimit = () => ratio() >= 1;
-  const nearLimit = () => ratio() >= 0.8 && ratio() < 1;
-  const canDismiss = () => nearLimit() && !atLimit();
-
-  const handleDismiss = () => {
-    dismissForToday(dismissKey());
-    setDismissed(true);
-  };
-
-  return (
-    <Show when={(nearLimit() && !dismissed()) || atLimit()}>
-      <div class="usage-limit-banner" classList={{ 'usage-limit-banner--danger': atLimit() }}>
-        <span class="usage-limit-banner__text">
-          {atLimit()
-            ? "You've reached your monthly limit. Requests are being blocked."
-            : `You're limited to ${billing()!.requests.limit!.toLocaleString('en-US')} requests this month. Upgrade for unlimited.`}
-        </span>
-        <div class="usage-limit-banner__actions">
-          <A
-            href="/upgrade?reason=requests"
-            class="btn btn--outline btn--sm usage-limit-banner__btn"
-          >
-            <svg
-              xmlns="http://www.w3.org/2000/svg"
-              width="14"
-              height="14"
-              fill="currentColor"
-              viewBox="0 0 24 24"
-              aria-hidden="true"
-            >
-              <path d="M12 2C6.486 2 2 6.486 2 12s4.486 10 10 10 10-4.486 10-10S17.514 2 12 2m0 18c-4.411 0-8-3.589-8-8s3.589-8 8-8 8 3.589 8 8-3.589 8-8 8" />
-              <path d="m8 12 1.41 1.41L11 11.83V17h2v-5.17l1.59 1.59L16 12l-4-4z" />
-            </svg>
-            Upgrade plan
-          </A>
-          <Show when={canDismiss()}>
-            <button
-              type="button"
-              class="btn btn--outline btn--sm usage-limit-banner__btn"
-              onClick={handleDismiss}
-            >
-              Got it
-            </button>
-          </Show>
-        </div>
-      </div>
-    </Show>
-  );
-};
-
-export default UsageLimitBanner;
diff --git a/packages/frontend/src/components/VersionIndicator.tsx b/packages/frontend/src/components/VersionIndicator.tsx
index 028b09a3..e13840c0 100644
--- a/packages/frontend/src/components/VersionIndicator.tsx
+++ b/packages/frontend/src/components/VersionIndicator.tsx
@@ -26,16 +26,15 @@ function writeDismissed(version: string): void {
 }
 
 /**
- * Bottom-corner `vX.Y.Z` badge for self-hosted installs. When the backend
+ * Bottom-corner `vX.Y.Z` badge. When the backend
  * reports a newer release, the badge grows a link to the changelog for that
  * release, with a dismiss button. A failed check degrades to the plain badge.
  */
 const VersionIndicator = () => {
-  const isSelfHosted = import.meta.env.VITE_MANIFEST_SELFHOSTED === 'true';
   const version = __MANIFEST_VERSION__;
 
   const [info] = createResource<VersionInfo | null, boolean>(
-    () => isSelfHosted && Boolean(version),
+    () => Boolean(version),
     () => getVersionInfo().catch(() => null),
   );
   const [dismissed, setDismissed] = createSignal<string | null>(readDismissed());
@@ -51,7 +50,7 @@ const VersionIndicator = () => {
   };
 
   return (
-    <Show when={isSelfHosted && version}>
+    <Show when={version}>
       <div
         class="version-indicator"
         classList={{ 'version-indicator--update': update() !== null }}
diff --git a/packages/frontend/src/components/message-table-cells.tsx b/packages/frontend/src/components/message-table-cells.tsx
index a01c5daf..f8ef4b70 100644
--- a/packages/frontend/src/components/message-table-cells.tsx
+++ b/packages/frontend/src/components/message-table-cells.tsx
@@ -20,7 +20,6 @@ import { getModelDisplayName } from '../services/model-display.js';
 import { providerIcon, customProviderLogo } from './ProviderIcon.jsx';
 import { authBadgeFor, authLabel } from './AuthBadge.js';
 import { platformIcon, isSuccessStatus } from 'manifest-shared';
-import { isPlanRequestLimitMessage } from '../services/message-error-taxonomy.js';
 
 const MONO = 'font-family: var(--font-mono);';
 const MONO_XS =
@@ -388,12 +387,7 @@ const ERROR_DESCRIPTORS: Record<string, string> = {
   request: 'Bad request',
 };
 
-function isPlanLimitBlock(item: MessageRow): boolean {
-  return isPlanRequestLimitMessage(item);
-}
-
 function statusErrorDescriptor(item: MessageRow): string | null {
-  if (isPlanLimitBlock(item)) return 'Plan limit';
   return item.error_origin ? (ERROR_DESCRIPTORS[item.error_origin] ?? null) : null;
 }
 
@@ -434,33 +428,15 @@ export function StatusCell(item: MessageRow, _agentName: string | undefined): JS
 
   // A Manifest software limit is one red pill linking to its agent's limits page.
   if (pill.limitAgent) {
-    const planLimit = isPlanLimitBlock(item);
     return (
-      <td style={planLimit ? 'padding: 8.1px var(--gap-md)' : undefined}>
+      <td>
         <A
           class={pill.cls}
-          href={
-            planLimit
-              ? '/upgrade?reason=requests'
-              : `/harnesses/${encodeURIComponent(pill.limitAgent)}/limits`
-          }
-          title={
-            planLimit
-              ? 'Free plan request limit reached - upgrade to Pro'
-              : 'Manifest usage limit reached - open your limits'
-          }
+          href={`/harnesses/${encodeURIComponent(pill.limitAgent)}/limits`}
+          title="Manifest usage limit reached - open your limits"
         >
           {pill.label}
         </A>
-        {planLimit && (
-          <A
-            href="/upgrade?reason=requests"
-            class="btn btn--primary btn--sm"
-            style="margin-left: 6px; font-size: 11px; padding: 2px 8px; text-decoration: none;"
-          >
-            Upgrade plan
-          </A>
-        )}
       </td>
     );
   }
diff --git a/packages/frontend/src/index.tsx b/packages/frontend/src/index.tsx
index 385b9454..585b6e67 100644
--- a/packages/frontend/src/index.tsx
+++ b/packages/frontend/src/index.tsx
@@ -30,7 +30,6 @@ const Routing = lazyReload(() => import('./pages/Routing.jsx'));
 const Playground = lazyReload(() => import('./pages/Playground.jsx'));
 const Limits = lazyReload(() => import('./pages/Limits.jsx'));
 const Account = lazyReload(() => import('./pages/Account.jsx'));
-const Upgrade = lazyReload(() => import('./pages/Upgrade.jsx'));
 const CliAuth = lazyReload(() => import('./pages/CliAuth.jsx'));
 const Consent = lazyReload(() => import('./pages/Consent.jsx'));
 const OauthError = lazyReload(() => import('./pages/OauthError.jsx'));
@@ -42,7 +41,6 @@ const Discovery = lazyReload(() => import('./pages/Discovery.jsx'));
 const Welcome = lazyReload(() => import('./pages/Welcome.jsx'));
 const ModelPrices = lazyReload(() => import('./pages/ModelPrices.jsx'));
 const Help = lazyReload(() => import('./pages/Help.jsx'));
-const FreeModels = lazyReload(() => import('./pages/FreeModels.jsx'));
 const ConnectProvider = lazyReload(() => import('./pages/ConnectProvider.jsx'));
 const Subscriptions = lazyReload(() => import('./pages/providers/Subscriptions.jsx'));
 const Byok = lazyReload(() => import('./pages/providers/Byok.jsx'));
@@ -57,9 +55,9 @@ const GuestLayout: ParentComponent = (props) => (
   </GuestGuard>
 );
 
-// Post-signup discovery step (self-hosted only): authenticated, rendered as
-// its own centered two-column card outside the App shell. The page itself
-// redirects anyone who should not see it (cloud, already completed or skipped).
+// Post-signup discovery step: authenticated, rendered as its own centered
+// two-column card outside the App shell. The page itself redirects anyone who
+// should not see it (already completed or skipped).
 const DiscoveryLayout: ParentComponent = (props) => <AuthGuard>{props.children}</AuthGuard>;
 
 // Full-page onboarding: authenticated but outside the App dashboard shell.
@@ -119,7 +117,6 @@ render(
 
             {/* Non-tab agent routes: kept reachable but not primary tabs */}
             <Route path="/model-prices" component={ModelPrices} />
-            <Route path="/free-models" component={FreeModels} />
             <Route path="/help" component={Help} />
           </Route>
 
@@ -145,9 +142,6 @@ render(
           <Route path="/connect-provider" component={ConnectProvider} />
           <Route path="/account" component={Account} />
         </Route>
-        <Route path="/upgrade" component={AuthGuard}>
-          <Route path="/" component={Upgrade} />
-        </Route>
         <Route path="/cli/auth" component={AuthGuard}>
           <Route path="/" component={CliAuth} />
         </Route>
diff --git a/packages/frontend/src/pages/Account.tsx b/packages/frontend/src/pages/Account.tsx
index 7bec9a52..1786af67 100644
--- a/packages/frontend/src/pages/Account.tsx
+++ b/packages/frontend/src/pages/Account.tsx
@@ -1,20 +1,8 @@
-import {
-  createEffect,
-  createResource,
-  createSignal,
-  onMount,
-  Show,
-  type Component,
-} from 'solid-js';
-import { useNavigate, useSearchParams } from '@solidjs/router';
+import { createResource, createSignal, onMount, Show, type Component } from 'solid-js';
+import { useNavigate } from '@solidjs/router';
 import { Title, Meta } from '@solidjs/meta';
 import { authClient } from '../services/auth-client.js';
-import { getBillingStatus, updateBillingEmailPreferences } from '../services/api/billing.js';
 import { toast } from '../services/toast-store.js';
-import {
-  FREE_REQUEST_LIMIT_LABEL,
-  formatBillingPriceWithInterval,
-} from '../services/billing-display.js';
 
 const Account: Component = () => {
   const navigate = useNavigate();
@@ -70,24 +58,13 @@ const Account: Component = () => {
       setPwBusy(false);
     }
   };
-  const [billing, { refetch: refetchBilling }] = createResource(() => getBillingStatus());
   const [accounts] = createResource(() => authClient.listAccounts());
   const hasCredentialAccount = () =>
     (accounts()?.data ?? []).some((a) => a.providerId === 'credential');
-  const [searchParams, setSearchParams] = useSearchParams();
-  const [billingBusy, setBillingBusy] = createSignal(false);
-  const [emailPrefsBusy, setEmailPrefsBusy] = createSignal(false);
-  const [usageAlertsEnabled, setUsageAlertsEnabled] = createSignal(true);
 
   const userName = () => session()?.data?.user?.name ?? '';
   const userEmail = () => session()?.data?.user?.email ?? '';
   const userId = () => session()?.data?.user?.id ?? '';
-  const proPriceWithInterval = () => formatBillingPriceWithInterval(billing()?.priceMonthly);
-
-  createEffect(() => {
-    const prefs = billing()?.emailPreferences;
-    if (prefs) setUsageAlertsEnabled(prefs.usageAlerts);
-  });
 
   onMount(() => {
     const stored = localStorage.getItem('theme');
@@ -96,64 +73,8 @@ const Account: Component = () => {
     } else {
       setTheme('system');
     }
-
-    if (searchParams['upgraded'] === '1') {
-      toast.success('Welcome to Pro!');
-      setSearchParams({ upgraded: undefined }, { replace: true });
-    }
   });
 
-  const handleUpgrade = async () => {
-    setBillingBusy(true);
-    try {
-      const origin = window.location.origin;
-      const res = await authClient.subscription.upgrade({
-        plan: 'pro',
-        successUrl: `${origin}/account?upgraded=1`,
-        cancelUrl: `${origin}/account`,
-      });
-      const error = (res as { error?: unknown } | undefined)?.error;
-      if (error) throw error;
-    } catch {
-      toast.error('Could not start the upgrade. Please try again.');
-    } finally {
-      setBillingBusy(false);
-    }
-  };
-
-  const handleManageBilling = async () => {
-    setBillingBusy(true);
-    // Open the tab synchronously inside the click handler so it keeps the user
-    // activation — a popup blocker would kill a window.open() that ran after the
-    // awaited portal call. We navigate this placeholder once the URL resolves.
-    // Drop `opener` for the same isolation `noopener` would give us.
-    const tab = window.open('about:blank', '_blank');
-    if (tab) tab.opener = null;
-    try {
-      // disableRedirect returns the portal URL instead of navigating the current
-      // tab, so we can send the new tab there and keep the dashboard open.
-      const res = await authClient.subscription.billingPortal({
-        returnUrl: `${window.location.origin}/account`,
-        disableRedirect: true,
-      });
-      const url = res?.data?.url;
-      if (url) {
-        if (tab) tab.location.href = url;
-        else window.open(url, '_blank', 'noopener,noreferrer');
-      } else {
-        tab?.close();
-        toast.error('Could not open the billing portal. Please try again.');
-      }
-    } catch {
-      tab?.close();
-      toast.error('Could not open the billing portal. Please try again.');
-    } finally {
-      setBillingBusy(false);
-    }
-  };
-
-  const fmt = (n: number) => n.toLocaleString('en-US');
-
   const applyTheme = (value: 'light' | 'dark' | 'system') => {
     setTheme(value);
     if (value === 'system') {
@@ -172,22 +93,6 @@ const Account: Component = () => {
     setTimeout(() => setCopied(false), 2000);
   };
 
-  const handleUsageAlertsChange = async (enabled: boolean) => {
-    const previous = usageAlertsEnabled();
-    setUsageAlertsEnabled(enabled);
-    setEmailPrefsBusy(true);
-    try {
-      const saved = await updateBillingEmailPreferences({ usageAlerts: enabled });
-      setUsageAlertsEnabled(saved.usageAlerts);
-      await refetchBilling();
-      toast.success('Email preferences saved');
-    } catch {
-      setUsageAlertsEnabled(previous);
-    } finally {
-      setEmailPrefsBusy(false);
-    }
-  };
-
   return (
     <div class="account-modal">
       <Title>Account Preferences - Manifest</Title>
@@ -375,133 +280,6 @@ const Account: Component = () => {
           </div>
         </div>
 
-        {/* Billing */}
-        <Show when={billing()?.enabled}>
-          <h2 class="settings-section__title" id="billing">
-            Billing
-          </h2>
-
-          <div class="settings-card">
-            <div class="billing-stats">
-              <div class="billing-stat">
-                <span class="billing-stat__label">Current plan</span>
-                <span class="billing-stat__value">
-                  {billing()!.plan === 'pro' ? 'Pro' : 'Free'}
-                  {billing()!.plan === 'pro' && proPriceWithInterval()
-                    ? ` · ${proPriceWithInterval()}`
-                    : ''}
-                </span>
-                <Show when={billing()!.cancelAtPeriodEnd && billing()!.subscriptionPeriodEnd}>
-                  <span class="billing-stat__cancel">
-                    You'll keep Pro access until{' '}
-                    {new Date(billing()!.subscriptionPeriodEnd!).toLocaleDateString(undefined, {
-                      month: 'long',
-                      day: 'numeric',
-                      year: 'numeric',
-                    })}
-                  </span>
-                </Show>
-              </div>
-
-              <div class="billing-stat">
-                <span class="billing-stat__label">Requests</span>
-                <span class="billing-stat__value">
-                  {billing()!.requests.limit != null
-                    ? billing()!.requests.used != null
-                      ? `${fmt(billing()!.requests.used!)} / ${fmt(billing()!.requests.limit!)}`
-                      : fmt(billing()!.requests.limit!)
-                    : 'Unlimited'}
-                </span>
-                <Show when={billing()!.requests.limit != null && billing()!.requests.periodEnd}>
-                  <span class="billing-stat__meta">
-                    Resets{' '}
-                    {new Date(billing()!.requests.periodEnd!).toLocaleDateString(undefined, {
-                      month: 'short',
-                      day: 'numeric',
-                    })}
-                  </span>
-                </Show>
-              </div>
-            </div>
-
-            <div class="settings-card__footer billing-footer">
-              <span class="billing-footer__note">
-                {billing()!.plan === 'free'
-                  ? `Free: ${FREE_REQUEST_LIMIT_LABEL} requests/mo · Pro: unlimited requests`
-                  : 'Update your payment method and view invoices.'}
-              </span>
-              <Show
-                when={billing()!.plan === 'free'}
-                fallback={
-                  <div class="billing-footer__actions">
-                    <button
-                      class="btn btn--outline btn--sm"
-                      disabled={billingBusy()}
-                      onClick={handleManageBilling}
-                    >
-                      {billingBusy() ? <span class="spinner" /> : 'Manage subscription'}
-                    </button>
-                    <button
-                      class="btn btn--outline btn--sm"
-                      disabled={billingBusy()}
-                      onClick={handleManageBilling}
-                    >
-                      {billingBusy() ? <span class="spinner" /> : 'View invoices'}
-                    </button>
-                  </div>
-                }
-              >
-                <button
-                  class="btn btn--primary btn--sm"
-                  disabled={billingBusy()}
-                  onClick={handleUpgrade}
-                >
-                  Upgrade to Pro
-                  {proPriceWithInterval() ? ` · ${proPriceWithInterval()}` : ''}
-                </button>
-              </Show>
-            </div>
-          </div>
-        </Show>
-
-        {/* Email Preferences */}
-        <Show when={billing()?.enabled}>
-          <h2 class="settings-section__title" id="email-preferences">
-            Email preferences
-          </h2>
-
-          <div class="settings-card">
-            <div class="settings-card__row">
-              <div class="settings-card__label">
-                <span class="settings-card__label-title">Usage alert emails</span>
-                <span class="settings-card__label-desc">
-                  Receive emails at 80% usage and when the monthly request limit is reached.
-                </span>
-              </div>
-              <div class="settings-card__control settings-card__control--end">
-                <label
-                  class="notification-toggle account-email-toggle"
-                  classList={{ 'account-email-toggle--disabled': emailPrefsBusy() }}
-                  title="Usage alert emails"
-                >
-                  <input
-                    type="checkbox"
-                    checked={usageAlertsEnabled()}
-                    disabled={emailPrefsBusy()}
-                    onChange={(e) => void handleUsageAlertsChange(e.currentTarget.checked)}
-                  />
-                  <span class="notification-toggle__slider" aria-hidden="true" />
-                  <span class="sr-only">Receive usage alert emails</span>
-                </label>
-              </div>
-            </div>
-            <div class="settings-card__footer account-email-footer">
-              Plan confirmations, plan changes, and cancellation confirmations remain on as billing
-              lifecycle emails.
-            </div>
-          </div>
-        </Show>
-
         {/* Appearance */}
         <h2 class="settings-section__title">Appearance</h2>
 
diff --git a/packages/frontend/src/pages/Discovery.tsx b/packages/frontend/src/pages/Discovery.tsx
index c09e5b01..43fca20a 100644
--- a/packages/frontend/src/pages/Discovery.tsx
+++ b/packages/frontend/src/pages/Discovery.tsx
@@ -5,22 +5,19 @@ import '../styles/discovery.css';
 import Select from '../components/Select.jsx';
 import { authClient } from '../services/auth-client.js';
 import { isSafeInternalRedirect } from '../services/auth-redirects.js';
-import { checkIsSelfHosted } from '../services/setup-status.js';
 import {
   COMPANY_SIZE_OPTIONS,
   PROJECT_TYPE_OPTIONS,
-  clearDiscoveryPending,
   completeDiscovery,
-  isConfirmedNotSelfHosted,
   isDiscoveryRequired,
   markDiscoveryPending,
   type DiscoverySubmission,
 } from '../services/discovery.js';
 
 /**
- * One-time post-signup step for self-hosted installs. Self-guards like
- * Setup.tsx: anyone who should not see it (cloud, already completed, already
- * skipped, direct navigation later) is redirected to the `next` destination.
+ * One-time post-signup step. Self-guards like Setup.tsx: anyone who should not
+ * see it (already completed, already skipped, direct navigation later) is
+ * redirected to the `next` destination.
  */
 const Discovery: Component = () => {
   const navigate = useNavigate();
@@ -50,17 +47,6 @@ const Discovery: Component = () => {
   };
 
   onMount(async () => {
-    if (!(await checkIsSelfHosted())) {
-      // Only a confirmed non-self-hosted answer drops the marker and leaves.
-      // On an unconfirmed answer (transient status failure) we fall through
-      // and behave as self-hosted: leaving while the marker stands would let
-      // the guards bounce the user back here in an endless loop.
-      if (await isConfirmedNotSelfHosted()) {
-        clearDiscoveryPending(userId());
-        leave();
-        return;
-      }
-    }
     if (isSignupRedirect()) markDiscoveryPending(userId(), next());
     if (!(await isDiscoveryRequired(userId()))) {
       leave();
diff --git a/packages/frontend/src/pages/FreeModels.tsx b/packages/frontend/src/pages/FreeModels.tsx
deleted file mode 100644
index 354b3381..00000000
--- a/packages/frontend/src/pages/FreeModels.tsx
+++ /dev/null
@@ -1,379 +0,0 @@
-import { Meta, Title } from '@solidjs/meta';
-import { useParams } from '@solidjs/router';
-import { createResource, createSignal, For, Show, type Component } from 'solid-js';
-import ErrorState from '../components/ErrorState.jsx';
-import { agentDisplayName } from '../services/agent-display-name.js';
-import { getFreeModels, type FreeProviderDto } from '../services/api.js';
-import { PROVIDERS } from '../services/providers.js';
-import { checkIsSelfHosted } from '../services/setup-status.js';
-import { toast } from '../services/toast-store.js';
-
-/** Logos that have a `-dark-mode` variant in /icons/ */
-const DARK_MODE_LOGOS = new Set([
-  '/icons/github.svg',
-  '/icons/ollama.svg',
-  '/icons/zai.svg',
-  '/icons/cerebras.svg',
-]);
-
-const ExternalLinkIcon = () => (
-  <svg
-    width="12"
-    height="12"
-    viewBox="0 0 24 24"
-    fill="none"
-    stroke="currentColor"
-    stroke-width="2"
-    stroke-linecap="round"
-    stroke-linejoin="round"
-    style="margin-left: 4px;"
-    aria-hidden="true"
-  >
-    <path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6" />
-    <polyline points="15 3 21 3 21 9" />
-    <line x1="10" y1="14" x2="21" y2="3" />
-  </svg>
-);
-
-const CopyButton: Component<{ text: string }> = (props) => {
-  const [copied, setCopied] = createSignal(false);
-
-  const handleCopy = async () => {
-    try {
-      await navigator.clipboard.writeText(props.text);
-      setCopied(true);
-      toast.success('Copied to clipboard');
-      setTimeout(() => setCopied(false), 2000);
-    } catch {
-      toast.error('Failed to copy');
-    }
-  };
-
-  return (
-    <button
-      class="btn btn--outline btn--sm"
-      style="padding: 2px 8px; font-size: var(--font-size-xs);"
-      onClick={handleCopy}
-      aria-label="Copy to clipboard"
-    >
-      {copied() ? 'Copied' : 'Copy'}
-    </button>
-  );
-};
-
-/**
- * Map free-model provider names to built-in provider IDs.
- * When a match exists, the Connect button links directly to the
- * provider modal instead of the custom-provider form.
- */
-const FREE_TO_BUILTIN: Record<string, string> = {
-  Cohere: 'custom',
-  'Google Gemini': 'gemini',
-  'Mistral AI': 'mistral',
-  'Z AI': 'zai',
-  Groq: 'groq',
-  'Hugging Face': 'custom',
-  'Kilo Code': 'custom',
-  'NVIDIA NIM': 'nvidia',
-  'Ollama Cloud': 'ollama',
-  OpenRouter: 'openrouter',
-  SiliconFlow: 'custom',
-  Cerebras: 'custom',
-  'Cloudflare Workers AI': 'custom',
-  'GitHub Models': 'custom',
-  'LLM7.io': 'custom',
-};
-
-const ConnectButton: Component<{ provider: FreeProviderDto }> = (props) => {
-  const params = useParams<{ agentName: string }>();
-  const agentName = () => decodeURIComponent(params.agentName);
-  const [isSelfHosted] = createResource(() => checkIsSelfHosted());
-
-  const builtinId = () => FREE_TO_BUILTIN[props.provider.name];
-  const builtin = () => {
-    const id = builtinId();
-    return id && id !== 'custom' ? PROVIDERS.find((p) => p.id === id) : undefined;
-  };
-
-  const models = () => {
-    const withId = props.provider.models.filter((m) => m.id);
-    if (withId.length === 0) return '';
-    return withId.map((m) => `${m.id}:0:0`).join(',');
-  };
-
-  const href = () => {
-    const b = builtin();
-    if (b) {
-      return `/harnesses/${encodeURIComponent(agentName())}/routing?provider=${b.id}`;
-    }
-    const base = `/harnesses/${encodeURIComponent(agentName())}/routing?provider=custom&name=${encodeURIComponent(props.provider.name)}&baseUrl=${encodeURIComponent(props.provider.base_url!)}`;
-    const m = models();
-    return m ? `${base}&models=${encodeURIComponent(m)}` : base;
-  };
-
-  // Ollama (self-hosted only) is disabled in cloud mode
-  const isOllamaLocal = () => {
-    const b = builtin();
-    return b?.localOnly === true;
-  };
-
-  return (
-    <Show
-      when={!isOllamaLocal() || isSelfHosted()}
-      fallback={
-        <span
-          class="free-models-disabled-btn"
-          data-tooltip="Available on the self-hosted version only"
-        >
-          Connect {props.provider.name}
-        </span>
-      }
-    >
-      <a href={href()} class="btn btn--primary btn--sm" style="text-decoration: none;">
-        Connect {props.provider.name}
-      </a>
-    </Show>
-  );
-};
-
-const FreeModels: Component = () => {
-  const [data] = createResource(() => getFreeModels());
-
-  return (
-    <div class="container--lg">
-      <Title>Free Models - Manifest</Title>
-      <Meta
-        name="description"
-        content="Free LLM models you can use with Manifest. No credit card required."
-      />
-      <div class="page-header">
-        <div>
-          <h1>Free Models</h1>
-          <span class="breadcrumb">
-            Cloud providers offering free API access for {agentDisplayName() ?? 'your harness'}
-          </span>
-        </div>
-      </div>
-
-      <div style="display: flex; flex-direction: column; gap: 10px; margin-bottom: 24px;">
-        <div style="display: flex; align-items: center; gap: 10px;">
-          <span style="display: inline-flex; align-items: center; justify-content: center; width: 22px; height: 22px; border-radius: 50%; background: hsl(var(--primary)); color: hsl(var(--primary-foreground)); font-size: var(--font-size-xs); font-weight: 600; flex-shrink: 0;">
-            1
-          </span>
-          <span style="font-size: var(--font-size-sm); color: hsl(var(--muted-foreground));">
-            Get your free API key from the provider website
-          </span>
-        </div>
-        <div style="display: flex; align-items: center; gap: 10px;">
-          <span style="display: inline-flex; align-items: center; justify-content: center; width: 22px; height: 22px; border-radius: 50%; background: hsl(var(--primary)); color: hsl(var(--primary-foreground)); font-size: var(--font-size-xs); font-weight: 600; flex-shrink: 0;">
-            2
-          </span>
-          <span style="font-size: var(--font-size-sm); color: hsl(var(--muted-foreground));">
-            Hit the provider Connect button, paste your key, and validate the connection
-          </span>
-        </div>
-        <div style="display: flex; align-items: center; gap: 10px;">
-          <span style="display: inline-flex; align-items: center; justify-content: center; width: 22px; height: 22px; border-radius: 50%; background: hsl(var(--primary)); color: hsl(var(--primary-foreground)); font-size: var(--font-size-xs); font-weight: 600; flex-shrink: 0;">
-            3
-          </span>
-          <span style="font-size: var(--font-size-sm); color: hsl(var(--muted-foreground));">
-            Done! The provider models are now included in your routing. Customize tiers and
-            preferences from the routing page.
-          </span>
-        </div>
-      </div>
-
-      <Show when={!data.loading} fallback={<div class="loading-spinner" />}>
-        <Show when={!data.error} fallback={<ErrorState message="Failed to load free models" />}>
-          <For each={data()?.providers ?? []}>
-            {(provider) => (
-              <div class="panel" style="margin-bottom: 24px;">
-                <div style="display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-bottom: 8px;">
-                  <h2 style="margin: 0; font-size: var(--font-size-lg); display: flex; align-items: center; gap: 8px;">
-                    {provider.logo &&
-                      (() => {
-                        const dark = provider.logo.replace(/\.([^.]+)$/, '-dark-mode.$1');
-                        const hasDark = DARK_MODE_LOGOS.has(provider.logo);
-                        return hasDark ? (
-                          <>
-                            <img
-                              src={provider.logo}
-                              alt=""
-                              class="free-models-logo-light"
-                              style="height: 20px;"
-                            />
-                            <img
-                              src={dark}
-                              alt=""
-                              class="free-models-logo-dark"
-                              style="height: 20px;"
-                            />
-                          </>
-                        ) : (
-                          <img src={provider.logo} alt="" style="height: 20px;" />
-                        );
-                      })()}
-                    {provider.name}
-                  </h2>
-                  <div style="display: flex; gap: 8px; flex-shrink: 0;">
-                    <a
-                      href={provider.api_key_url}
-                      target="_blank"
-                      rel="noopener noreferrer"
-                      class="btn btn--outline btn--sm"
-                      style="text-decoration: none;"
-                    >
-                      Get API key
-                      <ExternalLinkIcon />
-                    </a>
-                    <Show when={provider.base_url}>
-                      <ConnectButton provider={provider} />
-                    </Show>
-                  </div>
-                </div>
-                <Show when={provider.tags.length > 0}>
-                  <div style="display: flex; align-items: center; gap: 20px; margin-bottom: 16px; flex-wrap: wrap;">
-                    <For each={provider.tags}>
-                      {(tag) => (
-                        <span style="display: inline-flex; align-items: center; gap: 6px; font-size: var(--font-size-sm); color: hsl(var(--foreground)); white-space: nowrap;">
-                          <span style="width: 5px; height: 5px; border-radius: 50%; background: hsl(var(--foreground)); flex-shrink: 0;" />
-                          {tag}
-                        </span>
-                      )}
-                    </For>
-                  </div>
-                </Show>
-                <Show when={!provider.tags.length}>
-                  <div style="margin-bottom: 16px; font-size: var(--font-size-sm); color: hsl(var(--muted-foreground));">
-                    {provider.description}
-                  </div>
-                </Show>
-
-                {(() => {
-                  const [showModels, setShowModels] = createSignal(false);
-                  const displayModels = () => provider.models.filter((m) => m.id);
-                  return (
-                    <>
-                      <Show when={provider.base_url}>
-                        <div class="free-models-base-url-row">
-                          <div style="display: flex; align-items: center; gap: 8px; min-width: 0;">
-                            <span style="font-size: var(--font-size-sm); color: hsl(var(--muted-foreground)); flex-shrink: 0;">
-                              Base URL:
-                            </span>
-                            <code style="font-family: var(--font-mono); font-size: var(--font-size-xs); background: hsl(var(--muted) / 0.5); padding: 4px 8px; border-radius: var(--radius); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; min-width: 0;">
-                              {provider.base_url}
-                            </code>
-                            <CopyButton text={provider.base_url!} />
-                          </div>
-                          <button
-                            style="display: inline-flex; align-items: center; gap: 6px; font-size: var(--font-size-sm); color: hsl(var(--foreground)); padding: 0; background: none; border: none; cursor: pointer; white-space: nowrap; margin-left: auto; font-weight: 500;"
-                            onClick={() => setShowModels((v) => !v)}
-                          >
-                            {showModels()
-                              ? 'Hide models'
-                              : `Show models (${displayModels().length})`}
-                            <img
-                              src="/icons/caret-down.svg"
-                              alt=""
-                              class="free-models-caret"
-                              style={`width: 20px; height: 20px; transition: transform 250ms ease; transform: rotate(${showModels() ? '180deg' : '0deg'});`}
-                            />
-                          </button>
-                        </div>
-                      </Show>
-                      <Show when={!provider.base_url}>
-                        <button
-                          style="display: inline-flex; align-items: center; gap: 6px; font-size: var(--font-size-sm); color: hsl(var(--foreground)); padding: 0; background: none; border: none; cursor: pointer; white-space: nowrap; font-weight: 500;"
-                          onClick={() => setShowModels((v) => !v)}
-                        >
-                          {showModels() ? 'Hide models' : `Show models (${displayModels().length})`}
-                          <img
-                            src="/icons/caret-down.svg"
-                            alt=""
-                            class="free-models-caret"
-                            style={`width: 20px; height: 20px; transition: transform 250ms ease; transform: rotate(${showModels() ? '180deg' : '0deg'});`}
-                          />
-                        </button>
-                      </Show>
-
-                      <div
-                        class="free-models-accordion"
-                        classList={{ 'free-models-accordion--open': showModels() }}
-                      >
-                        <div>
-                          <Show when={provider.warning}>
-                            <div style="display: flex; align-items: flex-start; gap: 8px; padding: 10px 14px; border-radius: var(--radius); background: #f7f5ed; margin-top: 16px; margin-bottom: 16px; font-size: var(--font-size-sm);">
-                              <svg
-                                xmlns="http://www.w3.org/2000/svg"
-                                width="16"
-                                height="16"
-                                fill="currentColor"
-                                viewBox="0 0 24 24"
-                                style="flex-shrink: 0; color: hsl(var(--primary)); margin-top: 1px;"
-                              >
-                                <path d="M12 17c.55 0 1-.45 1-1v-4c0-.55-.45-1-1-1s-1 .45-1 1v4c0 .55.45 1 1 1M12 7a1 1 0 1 0 0 2 1 1 0 1 0 0-2" />
-                                <path d="M12 22c5.51 0 10-4.49 10-10S17.51 2 12 2 2 6.49 2 12s4.49 10 10 10m0-18c4.41 0 8 3.59 8 8s-3.59 8-8 8-8-3.59-8-8 3.59-8 8-8" />
-                              </svg>
-                              <span style="color: hsl(var(--foreground) / 0.8);">
-                                {provider.warning}
-                              </span>
-                            </div>
-                          </Show>
-
-                          <table
-                            class="data-table"
-                            style={`table-layout: fixed; width: 100%;${provider.warning ? '' : ' margin-top: 16px;'}`}
-                          >
-                            <colgroup>
-                              <col style="width: 36%" />
-                              <col style="width: 12%" />
-                              <col style="width: 14%" />
-                              <col style="width: 16%" />
-                              <col style="width: 22%" />
-                            </colgroup>
-                            <thead>
-                              <tr>
-                                <th>Model Name</th>
-                                <th>Context</th>
-                                <th>Max Output</th>
-                                <th>Modality</th>
-                                <th>Rate Limit</th>
-                              </tr>
-                            </thead>
-                            <tbody>
-                              <For each={displayModels()}>
-                                {(model) => (
-                                  <tr>
-                                    <td style="font-family: var(--font-mono); font-size: var(--font-size-xs);">
-                                      {model.id}
-                                    </td>
-                                    <td style="font-size: var(--font-size-sm);">{model.context}</td>
-                                    <td style="font-size: var(--font-size-sm);">
-                                      {model.max_output}
-                                    </td>
-                                    <td style="font-size: var(--font-size-sm);">
-                                      {model.modality}
-                                    </td>
-                                    <td style="font-size: var(--font-size-sm);">
-                                      {model.rate_limit || '\u2014'}
-                                    </td>
-                                  </tr>
-                                )}
-                              </For>
-                            </tbody>
-                          </table>
-                        </div>
-                      </div>
-                    </>
-                  );
-                })()}
-              </div>
-            )}
-          </For>
-        </Show>
-      </Show>
-    </div>
-  );
-};
-
-export default FreeModels;
diff --git a/packages/frontend/src/pages/GlobalOverview.tsx b/packages/frontend/src/pages/GlobalOverview.tsx
index c22278d3..ea94e476 100644
--- a/packages/frontend/src/pages/GlobalOverview.tsx
+++ b/packages/frontend/src/pages/GlobalOverview.tsx
@@ -1,6 +1,6 @@
 import { Title } from '@solidjs/meta';
 import { toggleScrollFade } from '../services/scroll-fade.js';
-import { A, useNavigate, useSearchParams } from '@solidjs/router';
+import { A, useNavigate } from '@solidjs/router';
 import {
   createResource,
   createSignal,
@@ -12,9 +12,6 @@ import {
   type Component,
 } from 'solid-js';
 import AddAgentModal from '../components/AddAgentModal.jsx';
-import UpgradeSuccessModal from '../components/UpgradeSuccessModal.jsx';
-import { markPlanChosen } from '../services/plan-selection.js';
-import { authClient } from '../services/auth-client.js';
 import {
   getAgents,
   getGlobalProviders,
@@ -30,7 +27,6 @@ import {
   getOverviewAgentUsage,
   getOverviewProviderUsage,
 } from '../services/api/analytics.js';
-import { usePlanRangeLock } from '../services/plan-range-lock.js';
 import { formatNumber, formatCost } from '../services/formatters.js';
 import { providerIcon } from '../components/ProviderIcon.jsx';
 import { preloadModelDisplayNames } from '../services/model-display.js';
@@ -140,7 +136,6 @@ const RANGE_OPTIONS = [
   { label: 'Last 90 days', value: '90d' },
   { label: 'Last 365 days', value: '365d' },
 ];
-const PRO_DASHBOARD_RANGES = new Set(['30d', '90d', '365d']);
 
 const RANGE_STORAGE_KEY = 'manifest_global_range';
 const GROUP_STORAGE_KEY = 'manifest_global_group';
@@ -157,34 +152,11 @@ function loadRange(): string {
 
 const GlobalOverview: Component = () => {
   const navigate = useNavigate();
-  const [searchParams] = useSearchParams();
-  const session = authClient.useSession();
-  const isUpgraded = searchParams.upgraded === '1';
-  if (isUpgraded) {
-    const uid = session()?.data?.user?.id;
-    if (uid) markPlanChosen(uid);
-  }
-  const [upgradeModalOpen, setUpgradeModalOpen] = createSignal(isUpgraded);
-
-  const closeUpgradeModal = () => {
-    setUpgradeModalOpen(false);
-    window.history.replaceState(null, '', '/overview');
-    if (hasNoAgents() && !sessionStorage.getItem(ONBOARDING_DISMISSED_KEY)) {
-      setAddAgentOpen(true);
-    }
-  };
-
   preloadModelDisplayNames();
 
   // ── Range state (persisted in localStorage) ──────────────────────────
   const [chartRange, setChartRangeRaw] = createSignal(loadRange());
-  const {
-    isFreePlan,
-    isProRangeLocked,
-    effectiveRange: effectiveChartRange,
-  } = usePlanRangeLock(chartRange, PRO_DASHBOARD_RANGES, '7d');
   const setChartRange = (v: string) => {
-    if (isFreePlan() && PRO_DASHBOARD_RANGES.has(v)) return;
     setChartRangeRaw(v);
     try {
       localStorage.setItem(RANGE_STORAGE_KEY, v);
@@ -218,24 +190,9 @@ const GlobalOverview: Component = () => {
     'requests',
   );
 
-  const proBadge = () => (
-    <span class="pro-range-badge" aria-label="Pro plan required">
-      PRO
-    </span>
-  );
-  const rangeOptions = () =>
-    RANGE_OPTIONS.map((option) =>
-      isProRangeLocked(option.value) ? { ...option, disabled: true, badge: proBadge() } : option,
-    );
-  createEffect(() => {
-    if (isFreePlan() && PRO_DASHBOARD_RANGES.has(chartRange())) {
-      setChartRange('7d');
-    }
-  });
-
   // ── Data resources (5 parallel) ──────────────────────────────────────
   const [overviewResult] = createResource(
-    () => ({ range: effectiveChartRange(), _ping: analyticsPing() }),
+    () => ({ range: chartRange(), _ping: analyticsPing() }),
     async (p) => ({
       range: p.range,
       data: (await getOverview(p.range, undefined, true)) as OverviewResponse,
@@ -257,9 +214,9 @@ const GlobalOverview: Component = () => {
   }));
   const overviewDetails = () => {
     const result = overviewDetailsResult();
-    return result?.range === effectiveChartRange() ? result.data : undefined;
+    return result?.range === chartRange() ? result.data : undefined;
   };
-  const rangeChanging = () => overviewResult.loading && loadedRange() !== effectiveChartRange();
+  const rangeChanging = () => overviewResult.loading && loadedRange() !== chartRange();
 
   const [agents] = createResource(
     () => ({ _agentPing: agentPing(), _analyticsPing: analyticsPing() }),
@@ -304,7 +261,7 @@ const GlobalOverview: Component = () => {
   );
 
   // ── Autofix resources ─────────────────────────────────
-  const autofixScope = createMemo(() => ({ range: effectiveChartRange() }));
+  const autofixScope = createMemo(() => ({ range: chartRange() }));
   const [autofixStatsResult] = createResource(
     () => ({ scope: autofixScope(), _ping: analyticsPing() }),
     async (p) => ({ scope: p.scope, data: await getAutofixStats(p.scope.range) }),
@@ -317,7 +274,7 @@ const GlobalOverview: Component = () => {
   // Disposition timeseries: feeds the "By request status" chart view AND the
   // Self-healed requests tab (recovered subset: healed + fallback series).
   const [requestStatusTs] = createResource(
-    () => ({ range: effectiveChartRange(), _ping: analyticsPing() }),
+    () => ({ range: chartRange(), _ping: analyticsPing() }),
     (p) => getAutofixTimeseries(p.range, 'disposition'),
   );
   const selfHealedTs = () => {
@@ -339,7 +296,7 @@ const GlobalOverview: Component = () => {
   // Harness table usage, driven by the page range selector (the workspace
   // agents endpoint is a fixed window; this table must follow the filter).
   const [harnessUsage] = createResource(
-    () => ({ range: effectiveChartRange(), _ping: analyticsPing() }),
+    () => ({ range: chartRange(), _ping: analyticsPing() }),
     (p) => getOverviewAgentUsage(p.range) as Promise<UsageTSResult>,
   );
   const harnessUsageFor = (agentName: string) => {
@@ -356,17 +313,17 @@ const GlobalOverview: Component = () => {
   };
 
   const [agentReliability] = createResource(
-    () => ({ range: effectiveChartRange(), _ping: analyticsPing() }),
+    () => ({ range: chartRange(), _ping: analyticsPing() }),
     (p) => getPerAgentReliability(p.range),
   );
 
   const [providerReliability] = createResource(
-    () => ({ range: effectiveChartRange(), _ping: analyticsPing() }),
+    () => ({ range: chartRange(), _ping: analyticsPing() }),
     (p) => getPerProviderReliability(p.range),
   );
 
   const [modelReliability] = createResource(
-    () => ({ range: effectiveChartRange(), _ping: analyticsPing() }),
+    () => ({ range: chartRange(), _ping: analyticsPing() }),
     (p) => getPerModelReliability(p.range),
   );
 
@@ -390,7 +347,7 @@ const GlobalOverview: Component = () => {
   };
 
   const [usageTimeseries] = createResource(
-    () => ({ range: effectiveChartRange(), group: groupBy(), _ping: analyticsPing() }),
+    () => ({ range: chartRange(), group: groupBy(), _ping: analyticsPing() }),
     (p) => usageFetcher(p.range, p.group),
   );
 
@@ -577,7 +534,7 @@ const GlobalOverview: Component = () => {
     on(
       () => hasNoAgents(),
       (empty) => {
-        if (empty && !sessionStorage.getItem(ONBOARDING_DISMISSED_KEY) && !upgradeModalOpen()) {
+        if (empty && !sessionStorage.getItem(ONBOARDING_DISMISSED_KEY)) {
           setAddAgentOpen(true);
         }
       },
@@ -591,7 +548,6 @@ const GlobalOverview: Component = () => {
 
       {/* Add Harness Modal */}
       <AddAgentModal open={addAgentOpen()} onClose={dismissAddAgent} />
-      <UpgradeSuccessModal open={upgradeModalOpen()} onClose={closeUpgradeModal} />
 
       {/* ── 1. Page Header ──────────────────────────────────────────── */}
       <div class="page-header" style="border-bottom: none; padding-bottom: 0;">
@@ -601,7 +557,7 @@ const GlobalOverview: Component = () => {
         </div>
         <Show when={!hasNoAgents() || !hasNoProviders()}>
           <div style="display: flex; align-items: center; gap: 8px;">
-            <Select value={chartRange()} onChange={setChartRange} options={rangeOptions()} />
+            <Select value={chartRange()} onChange={setChartRange} options={RANGE_OPTIONS} />
           </div>
         </Show>
       </div>
@@ -681,7 +637,7 @@ const GlobalOverview: Component = () => {
         }
       >
         {/* ── Autofix KPI cards ── */}
-        <AutofixKpiCards stats={autofixStats()} range={effectiveChartRange()} />
+        <AutofixKpiCards stats={autofixStats()} range={chartRange()} />
 
         {/* ── 2. Unified Chart Card ─────────────────────────────────── */}
         {(() => {
@@ -715,7 +671,7 @@ const GlobalOverview: Component = () => {
               costInfoTooltip="Actual API key costs only. Subscription usage is not included."
               tokensValue={o().summary.tokens_today.value}
               tokensTrendPct={o().summary.tokens_today.trend_pct}
-              range={effectiveChartRange()}
+              range={chartRange()}
               requestStatusTimeseries={requestsGroup() === 'status' ? requestStatusTs() : undefined}
               agentRequestTimeseries={
                 requestsGroup() === 'agent'
@@ -1100,7 +1056,7 @@ const GlobalOverview: Component = () => {
                                   return (
                                     <a
                                       class="count-link"
-                                      href={`/messages?connections=${encodeURIComponent(connection.id)}&range=${effectiveChartRange()}&attempts=has_failed`}
+                                      href={`/messages?connections=${encodeURIComponent(connection.id)}&range=${chartRange()}&attempts=has_failed`}
                                       title="View the requests holding these failed attempts"
                                       onClick={(e) => {
                                         // The row navigates to the connection; this cell
@@ -1108,7 +1064,7 @@ const GlobalOverview: Component = () => {
                                         e.preventDefault();
                                         e.stopPropagation();
                                         navigate(
-                                          `/messages?connections=${encodeURIComponent(connection.id)}&range=${effectiveChartRange()}&attempts=has_failed`,
+                                          `/messages?connections=${encodeURIComponent(connection.id)}&range=${chartRange()}&attempts=has_failed`,
                                         );
                                       }}
                                     >
@@ -1215,7 +1171,7 @@ const GlobalOverview: Component = () => {
                             const rel = agentReliability()?.find(
                               (r) => r.agent_name === agent.agent_name,
                             );
-                            const link = `/messages?agent=${encodeURIComponent(agent.agent_name)}&range=${effectiveChartRange()}`;
+                            const link = `/messages?agent=${encodeURIComponent(agent.agent_name)}&range=${chartRange()}`;
                             return (
                               <a
                                 class="count-link"
@@ -1242,7 +1198,7 @@ const GlobalOverview: Component = () => {
                                   {(() => {
                                     // Recovered = successful requests holding a
                                     // recovery attempt (autofix or fallback).
-                                    const link = `/messages?agent=${encodeURIComponent(agent.agent_name)}&range=${effectiveChartRange()}&status=ok&trigger=autofix,fallback`;
+                                    const link = `/messages?agent=${encodeURIComponent(agent.agent_name)}&range=${chartRange()}&status=ok&trigger=autofix,fallback`;
                                     return (
                                       <a
                                         class="count-link"
diff --git a/packages/frontend/src/pages/Help.tsx b/packages/frontend/src/pages/Help.tsx
index b4fbb236..9abd3f6d 100644
--- a/packages/frontend/src/pages/Help.tsx
+++ b/packages/frontend/src/pages/Help.tsx
@@ -5,10 +5,7 @@ const Help: Component = () => {
   return (
     <div class="container--sm">
       <Title>Help & Support - Manifest</Title>
-      <Meta
-        name="description"
-        content="Get help with Manifest. Schedule a call or contact support."
-      />
+      <Meta name="description" content="Get help with Manifest. Contact support." />
       <div class="page-header">
         <div>
           <h1>Help & Support</h1>
@@ -19,41 +16,6 @@ const Help: Component = () => {
       </div>
 
       <div class="settings-card">
-        <div class="settings-card__row">
-          <div class="settings-card__label">
-            <span class="settings-card__label-title">Schedule a Call</span>
-            <span class="settings-card__label-desc">
-              Book a 15-min call with us to get help setting things up.
-            </span>
-          </div>
-          <div class="settings-card__control">
-            <a
-              href="https://calendly.com/sebastien-manifest/15min"
-              target="_blank"
-              rel="noopener noreferrer"
-              class="btn btn--outline btn--sm"
-              style="text-decoration: none;"
-            >
-              Book
-              <svg
-                width="12"
-                height="12"
-                viewBox="0 0 24 24"
-                fill="none"
-                stroke="currentColor"
-                stroke-width="2"
-                stroke-linecap="round"
-                stroke-linejoin="round"
-                style="margin-left: 4px;"
-                aria-hidden="true"
-              >
-                <path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6" />
-                <polyline points="15 3 21 3 21 9" />
-                <line x1="10" y1="14" x2="21" y2="3" />
-              </svg>
-            </a>
-          </div>
-        </div>
         <div class="settings-card__row">
           <div class="settings-card__label">
             <span class="settings-card__label-title">Email Support</span>
diff --git a/packages/frontend/src/pages/Limits.tsx b/packages/frontend/src/pages/Limits.tsx
index 1a57a215..4fca279f 100644
--- a/packages/frontend/src/pages/Limits.tsx
+++ b/packages/frontend/src/pages/Limits.tsx
@@ -1,8 +1,6 @@
 import { createSignal, createResource, Show, onCleanup, type Component } from 'solid-js';
 import { useParams } from '@solidjs/router';
 import { Title, Meta } from '@solidjs/meta';
-import { authClient } from '../services/auth-client.js';
-import CloudEmailInfo from '../components/CloudEmailInfo.js';
 import EmailProviderModal from '../components/EmailProviderModal.js';
 import EmailProviderSection from '../components/EmailProviderSection.js';
 import LimitRuleModal from '../components/LimitRuleModal.js';
@@ -12,7 +10,7 @@ import LimitHistoryTable from '../components/LimitHistoryTable.js';
 import { KebabMenu, DeleteRuleModal, RemoveProviderModal } from '../components/LimitModals.js';
 import { toast } from '../services/toast-store.js';
 import { agentDisplayName } from '../services/agent-display-name.js';
-import { checkIsSelfHosted, checkEmailConfigured } from '../services/setup-status.js';
+import { checkEmailConfigured } from '../services/setup-status.js';
 import {
   getNotificationRules,
   getNotificationLogs,
@@ -38,18 +36,12 @@ const Limits: Component = () => {
     (name) => getNotificationLogs(name),
   );
   const [routingStatus] = createResource(() => agentName(), getRoutingStatus);
-  const [isSelfHosted] = createResource(checkIsSelfHosted);
   const [emailConfigured] = createResource(checkEmailConfigured);
-  // Only fetch the provider config on self-hosted: cloud never renders it.
-  const [emailProvider, { refetch: refetchProvider }] = createResource(
-    () => (isSelfHosted() === true ? true : undefined),
-    getEmailProvider,
-  );
+  const [emailProvider, { refetch: refetchProvider }] = createResource(getEmailProvider);
   // Solid re-throws when you read an errored resource, so every read below goes
   // through this accessor. A failed initial fetch or a failed refresh after a
   // successful delete reads as "no provider saved" instead of taking the page down.
   const savedProvider = () => (emailProvider.error ? undefined : emailProvider());
-  const session = authClient.useSession();
   const [showModal, setShowModal] = createSignal(false);
   const [showEditProvider, setShowEditProvider] = createSignal(false);
   const [showRemoveProvider, setShowRemoveProvider] = createSignal(false);
@@ -62,10 +54,9 @@ const Limits: Component = () => {
   const [deleting, setDeleting] = createSignal(false);
 
   const routingEnabled = () => routingStatus()?.enabled ?? false;
-  // Cloud always has a sender. Self-hosted has one when the operator saved a
-  // provider in the dashboard or set the EMAIL_* environment variables.
-  const hasProvider = () =>
-    isSelfHosted() !== true || !!savedProvider() || emailConfigured() === true;
+  // There is a sender when the operator saved a provider in the dashboard or
+  // set the EMAIL_* environment variables. Assume one while the status loads.
+  const hasProvider = () => !!savedProvider() || emailConfigured() !== false;
 
   const hasEmailRules = () => {
     const r = rules();
@@ -258,26 +249,13 @@ const Limits: Component = () => {
         </div>
       </Show>
 
-      {/* Render nothing until the deployment mode is known: the cloud card makes
-          a factual claim about who sends emails that is false on self-hosted. */}
-      <Show when={isSelfHosted() !== undefined}>
-        <Show
-          when={isSelfHosted() === true}
-          fallback={
-            <div style="margin-bottom: var(--gap-lg);">
-              <CloudEmailInfo email={session().data?.user?.email ?? ''} />
-            </div>
-          }
-        >
-          <EmailProviderSection
-            emailProvider={savedProvider()}
-            loading={emailProvider.loading || emailProvider.state === 'unresolved'}
-            onConfigured={refetchProvider}
-            onEdit={() => setShowEditProvider(true)}
-            onRemove={() => setShowRemoveProvider(true)}
-          />
-        </Show>
-      </Show>
+      <EmailProviderSection
+        emailProvider={savedProvider()}
+        loading={emailProvider.loading || emailProvider.state === 'unresolved'}
+        onConfigured={refetchProvider}
+        onEdit={() => setShowEditProvider(true)}
+        onRemove={() => setShowRemoveProvider(true)}
+      />
 
       <LimitRuleTable
         rules={rules()}
diff --git a/packages/frontend/src/pages/MessageLog.tsx b/packages/frontend/src/pages/MessageLog.tsx
index a7ef6d8e..99e3483f 100644
--- a/packages/frontend/src/pages/MessageLog.tsx
+++ b/packages/frontend/src/pages/MessageLog.tsx
@@ -32,7 +32,6 @@ import {
   getRoutingStatus,
 } from '../services/api.js';
 import { createCursorPagination } from '../services/cursor-pagination.js';
-import { usePlanRangeLock } from '../services/plan-range-lock.js';
 import { getModelDisplayName, preloadModelDisplayNames } from '../services/model-display.js';
 import { PROVIDERS, SPECIFICITY_STAGES } from '../services/providers.js';
 import { providerIcon } from '../components/ProviderIcon.jsx';
@@ -91,8 +90,6 @@ const normalizeStatusFilter = (value: unknown): MessageStatusFilterValue =>
 const MESSAGE_RANGE_FILTERS = ['24h', '7d', '30d', '90d', '365d'] as const;
 type MessageRangeFilter = (typeof MESSAGE_RANGE_FILTERS)[number];
 type MessageRangeFilterValue = '' | MessageRangeFilter;
-// Same Pro gating as the Overview range selector: long windows are paid.
-const PRO_RANGES = new Set(['30d', '90d', '365d']);
 
 const isMessageRangeFilter = (value: unknown): value is MessageRangeFilter =>
   typeof value === 'string' && (MESSAGE_RANGE_FILTERS as readonly string[]).includes(value);
@@ -299,8 +296,6 @@ const MessageLog: Component = () => {
   const [rangeFilter, setRangeFilterValue] = createSignal<MessageRangeFilterValue>(
     normalizeRangeFilter(searchParams.range),
   );
-  const { isFreePlan, isProRangeLocked, effectiveRange } =
-    usePlanRangeLock<MessageRangeFilterValue>(rangeFilter, PRO_RANGES, '7d');
   const [tierFilter, setTierFilter] = createSignal('');
   const [originFilter, setOriginFilter] = createSignal('');
   const [statusFilterValue, setStatusFilterValue] = createSignal<MessageStatusFilterValue>(
@@ -340,16 +335,11 @@ const MessageLog: Component = () => {
     setSearchParams({ trigger: triggerChoiceToParam(next) }, { replace: true });
   };
   const setRangeFilter = (value: string) => {
-    if (isProRangeLocked(value)) return;
     const next = normalizeRangeFilter(value);
     setRangeFilterValue(next);
     setSearchParams({ range: next || undefined }, { replace: true });
   };
 
-  createEffect(() => {
-    if (isFreePlan() && PRO_RANGES.has(rangeFilter())) setRangeFilter('7d');
-  });
-
   createEffect(
     on(
       () => searchParams.range,
@@ -408,7 +398,7 @@ const MessageLog: Component = () => {
     }
     const status = statusFilterValue();
     if (status) q.status = status;
-    const range = effectiveRange();
+    const range = rangeFilter();
     if (range) q.range = range;
     const origin = originFilter();
     if (origin) q.origin = origin;
@@ -464,7 +454,7 @@ const MessageLog: Component = () => {
   const [messageFilterOptions] = createResource(
     () => ({
       agentName: agentFilter() || params.agentName,
-      range: effectiveRange(),
+      range: rangeFilter(),
       _ping: analyticsPing(),
     }),
     (p) => {
@@ -598,23 +588,14 @@ const MessageLog: Component = () => {
     );
   });
 
-  const proBadge = () => (
-    <span class="pro-range-badge" aria-label="Pro plan required">
-      PRO
-    </span>
-  );
-  const rangeOptions = createMemo(() => [
+  const rangeOptions = [
     { label: 'All time', value: '' },
-    ...[
-      { label: 'Last 24 hours', value: '24h' },
-      { label: 'Last 7 days', value: '7d' },
-      { label: 'Last 30 days', value: '30d' },
-      { label: 'Last 90 days', value: '90d' },
-      { label: 'Last 365 days', value: '365d' },
-    ].map((opt) =>
-      isProRangeLocked(opt.value) ? { ...opt, disabled: true, badge: proBadge() } : opt,
-    ),
-  ]);
+    { label: 'Last 24 hours', value: '24h' },
+    { label: 'Last 7 days', value: '7d' },
+    { label: 'Last 30 days', value: '30d' },
+    { label: 'Last 90 days', value: '90d' },
+    { label: 'Last 365 days', value: '365d' },
+  ];
 
   const attemptStatusOptions = [
     { label: 'All attempt statuses', value: '' },
@@ -800,7 +781,7 @@ const MessageLog: Component = () => {
             <Select
               value={rangeFilter()}
               onChange={setRangeFilter}
-              options={rangeOptions()}
+              options={rangeOptions}
               label="Period filter"
             />
           </Show>
diff --git a/packages/frontend/src/pages/Overview.tsx b/packages/frontend/src/pages/Overview.tsx
index 9cbf72c7..4d791b16 100644
--- a/packages/frontend/src/pages/Overview.tsx
+++ b/packages/frontend/src/pages/Overview.tsx
@@ -41,13 +41,11 @@ import {
   useOverviewColumns,
   useOverviewRange,
 } from '../services/use-overview-range.js';
-import { usePlanRangeLock } from '../services/plan-range-lock.js';
 import '../styles/overview.css';
 import '../styles/charts.css';
 import '../styles/routing.css';
 import { getAutofixStats } from '../services/api/analytics.js';
 
-const PRO_RANGES = new Set(['30d', '90d', '365d']);
 const AGENT_RANGE_OPTIONS = [
   { label: 'Last 24 hours', value: '24h' },
   { label: 'Last 7 days', value: '7d' },
@@ -109,7 +107,7 @@ type OverviewDetails = Pick<
   'cost_by_model' | 'recent_activity' | 'request_reliability' | 'active_skills'
 >;
 
-type PivotedTimeseries = {
+type KeyedTimeseries = {
   agents: string[];
   timeseries: Array<Record<string, number | string>>;
 };
@@ -131,20 +129,6 @@ const Overview: Component = () => {
   const { range, setRange, handleRangeChange } = useOverviewRange({
     markUserSelected: () => setUserSelectedRange(true),
   });
-  const { isFreePlan, isProRangeLocked, effectiveRange } = usePlanRangeLock(
-    range,
-    PRO_RANGES,
-    '7d',
-  );
-  const proBadge = () => (
-    <span class="pro-range-badge" aria-label="Pro plan required">
-      PRO
-    </span>
-  );
-  const agentRangeOptions = () =>
-    AGENT_RANGE_OPTIONS.map((opt) =>
-      isProRangeLocked(opt.value) ? { ...opt, disabled: true, badge: proBadge() } : opt,
-    );
   const [activeView, setActiveViewRaw] = createSignal<ProviderView>('requests');
   const [tokenChartRequested, setTokenChartRequested] = createSignal(false);
   const [costChartRequested, setCostChartRequested] = createSignal(false);
@@ -167,12 +151,10 @@ const Overview: Component = () => {
     !!localStorage.getItem(`setup_completed_${params.agentName}`),
   );
 
-  // Never waits on billing/status: the plan-hint lock resolves the range
-  // synchronously, so this fetches exactly once at the right range.
   // The memo's identity changes on every range/agent transition (including
   // A → B → A) but stays stable across same-scope SSE refreshes.
   const overviewScope = createMemo(() => ({
-    range: effectiveRange(),
+    range: range(),
     agentName: params.agentName,
   }));
   const [overviewResult, { refetch }] = createResource(
@@ -217,10 +199,6 @@ const Overview: Component = () => {
   };
 
   createEffect(() => {
-    if (isFreePlan() && PRO_RANGES.has(range())) {
-      handleRangeChange('7d');
-      return;
-    }
     if (
       showEmptyState() &&
       !setupCompleted() &&
@@ -269,26 +247,26 @@ const Overview: Component = () => {
   const [selectedProviders, setSelectedProviders] = createSignal<Set<string>>(loadSavedProviders());
 
   const tsKey = (): TimeseriesKey => ({
-    range: effectiveRange(),
+    range: range(),
     agent: params.agentName,
     _ping: analyticsPing(),
   });
   const [providerTokenTs] = createResource(
     () => (tokenChartRequested() ? tsKey() : false),
-    (p) => getPerProviderTimeseries(p.agent, p.range) as Promise<PivotedTimeseries>,
+    (p) => getPerProviderTimeseries(p.agent, p.range) as Promise<KeyedTimeseries>,
   );
   const [providerMessageTs] = createResource(
     () => tsKey(),
-    (p) => getPerProviderMessageTimeseries(p.agent, p.range) as Promise<PivotedTimeseries>,
+    (p) => getPerProviderMessageTimeseries(p.agent, p.range) as Promise<KeyedTimeseries>,
   );
   const [providerCostTs] = createResource(
     () => (costChartRequested() ? tsKey() : false),
-    (p) => getPerProviderCostTimeseries(p.agent, p.range) as Promise<PivotedTimeseries>,
+    (p) => getPerProviderCostTimeseries(p.agent, p.range) as Promise<KeyedTimeseries>,
   );
 
   // ── Autofix resources ─────────────────────────────────
   const autofixScope = createMemo(() => ({
-    range: effectiveRange(),
+    range: range(),
     agent: decodeURIComponent(params.agentName),
   }));
   const [autofixStatsResult] = createResource(
@@ -304,7 +282,7 @@ const Overview: Component = () => {
   // other grouping is meaningful) + the Healed requests tab subset.
   const [statusTimeseries] = createResource(
     () => ({
-      range: effectiveRange(),
+      range: range(),
       agent: decodeURIComponent(params.agentName),
       _ping: analyticsPing(),
     }),
@@ -312,7 +290,7 @@ const Overview: Component = () => {
   );
   const [modelReliability] = createResource(
     () => ({
-      range: effectiveRange(),
+      range: range(),
       agent: decodeURIComponent(params.agentName),
       _ping: analyticsPing(),
     }),
@@ -385,7 +363,7 @@ const Overview: Component = () => {
   const setAllProviders = (on: boolean) =>
     persistProviders(on ? new Set(allProviders()) : new Set<string>());
 
-  const filterTs = (raw: PivotedTimeseries | undefined): PivotedTimeseries | undefined => {
+  const filterTs = (raw: KeyedTimeseries | undefined): KeyedTimeseries | undefined => {
     if (!raw) return undefined;
     const sel = effectiveSelected();
     if (sel.size === 0) return raw;
@@ -422,14 +400,7 @@ const Overview: Component = () => {
       >
         <div class="header-controls">
           <Show when={showDashboard()}>
-            <Select
-              value={range()}
-              onChange={(v) => {
-                if (isProRangeLocked(v)) return;
-                handleRangeChange(v);
-              }}
-              options={agentRangeOptions()}
-            />
+            <Select value={range()} onChange={handleRangeChange} options={AGENT_RANGE_OPTIONS} />
           </Show>
           <Show when={showEmptyState() && !setupCompleted()}>
             <button class="btn btn--primary btn--sm" onClick={() => setSetupOpen(true)}>
@@ -513,7 +484,7 @@ const Overview: Component = () => {
                   <AutofixKpiCards
                     stats={currentAutofixStats()}
                     agentName={decodeURIComponent(params.agentName)}
-                    range={effectiveRange()}
+                    range={range()}
                   />
                   {(() => {
                     return (
@@ -543,7 +514,7 @@ const Overview: Component = () => {
                         costInfoTooltip="Actual API key costs only. Subscription usage is not included."
                         tokensValue={d().summary?.tokens_today?.value ?? 0}
                         tokensTrendPct={d().summary?.tokens_today?.trend_pct ?? 0}
-                        range={effectiveRange()}
+                        range={range()}
                         requestStatusTimeseries={statusTimeseries()}
                         agentTimeseries={filteredTokenTs() ?? undefined}
                         agentCostTimeseries={filteredCostTs() ?? undefined}
diff --git a/packages/frontend/src/pages/Register.tsx b/packages/frontend/src/pages/Register.tsx
index c84008c1..77fba00b 100644
--- a/packages/frontend/src/pages/Register.tsx
+++ b/packages/frontend/src/pages/Register.tsx
@@ -1,27 +1,16 @@
-import { A, useLocation, useNavigate, useSearchParams } from '@solidjs/router';
+import { A, useLocation } from '@solidjs/router';
 import { Title, Meta } from '@solidjs/meta';
-import {
-  type Component,
-  createEffect,
-  createSignal,
-  createUniqueId,
-  onCleanup,
-  onMount,
-  Show,
-} from 'solid-js';
+import { type Component, createSignal, createUniqueId, onCleanup, onMount, Show } from 'solid-js';
 import SocialButtons from '../components/SocialButtons.jsx';
-import PlanPicker, { type PlanId } from '../components/PlanPicker.jsx';
 import { authClient } from '../services/auth-client.js';
 import { appendSearch } from '../services/auth-redirects.js';
 import { getLastAuthMethod, setLastAuthMethod } from '../services/last-auth-method.js';
-import { checkIsSelfHosted, checkSocialProviders } from '../services/setup-status.js';
-import { getBillingStatus } from '../services/api/billing.js';
-import { markPlanChosen } from '../services/plan-selection.js';
-import { formatBillingPrice } from '../services/billing-display.js';
-import { toast } from '../services/toast-store.js';
+import { checkSocialProviders } from '../services/setup-status.js';
 import { markDiscoveryPending } from '../services/discovery.js';
 
 const RESEND_COOLDOWN_SECONDS = 60;
+// Signups pass through the one-time discovery step before the welcome flow.
+const POST_SIGNUP_URL = '/discovery?next=%2Fwelcome';
 
 const Register: Component = () => {
   const [name, setName] = createSignal('');
@@ -33,43 +22,16 @@ const Register: Component = () => {
   const [alreadyExists, setAlreadyExists] = createSignal(false);
   const [resendCooldown, setResendCooldown] = createSignal(0);
   const [socialProviders, setSocialProviders] = createSignal<string[]>([]);
-  // Self-hosted signups pass through the one-time discovery step first.
-  const [postSignupUrl, setPostSignupUrl] = createSignal('/welcome');
   const [lastAuthMethod] = createSignal(getLastAuthMethod());
-  const [searchParams] = useSearchParams();
-  const navigate = useNavigate();
-  const [proPrice, setProPrice] = createSignal<string | null>(null);
-  const [planBusy, setPlanBusy] = createSignal(false);
   const location = useLocation();
-  const session = authClient.useSession();
-  const userId = () => session()?.data?.user?.id ?? '';
-  const showPlan = () => searchParams.step === 'plan';
   const nameId = createUniqueId();
   const emailId = createUniqueId();
   const passwordId = createUniqueId();
   const errorId = createUniqueId();
-  const socialSignupUrl = () =>
-    postSignupUrl().startsWith('/discovery') ? `${postSignupUrl()}&signup=1` : undefined;
+  const socialSignupUrl = `${POST_SIGNUP_URL}&signup=1`;
 
   onMount(async () => {
     setSocialProviders(await checkSocialProviders());
-    if (await checkIsSelfHosted()) {
-      setPostSignupUrl('/discovery?next=%2Fwelcome');
-    }
-  });
-
-  createEffect(() => {
-    if (!showPlan()) return;
-    getBillingStatus({ cache: false })
-      .then((status) => {
-        if (status?.plan === 'pro') {
-          markPlanChosen(userId());
-          navigate('/', { replace: true });
-        } else {
-          setProPrice(formatBillingPrice(status?.priceMonthly));
-        }
-      })
-      .catch(() => {});
   });
 
   let cooldownInterval: ReturnType<typeof setInterval> | undefined;
@@ -102,7 +64,7 @@ const Register: Component = () => {
       name: name(),
       email: email(),
       password: password(),
-      callbackURL: postSignupUrl(),
+      callbackURL: POST_SIGNUP_URL,
     });
 
     setLoading(false);
@@ -117,14 +79,12 @@ const Register: Component = () => {
     setAlreadyExists(false);
     setLastAuthMethod('email');
 
-    // Self-hosted: remember the discovery step is pending so the guards keep
-    // routing this user back to it until it is completed or skipped.
-    if (postSignupUrl().startsWith('/discovery')) {
-      markDiscoveryPending(data?.user?.id ?? '', '/welcome');
-    }
+    // Remember the discovery step is pending so the guards keep routing this
+    // user back to it until it is completed or skipped.
+    markDiscoveryPending(data?.user?.id ?? '', '/welcome');
 
     if (data?.token) {
-      window.location.href = postSignupUrl();
+      window.location.href = POST_SIGNUP_URL;
       return;
     }
 
@@ -132,38 +92,12 @@ const Register: Component = () => {
     startCooldown();
   };
 
-  const handlePlanSelect = async (plan: PlanId) => {
-    if (plan === 'free') {
-      markPlanChosen(userId());
-      window.location.replace('/');
-      return;
-    }
-    if (plan === 'enterprise') {
-      return;
-    }
-    setPlanBusy(true);
-    try {
-      const origin = window.location.origin;
-      const res = await authClient.subscription.upgrade({
-        plan: 'pro',
-        successUrl: `${origin}/overview?upgraded=1`,
-        cancelUrl: `${origin}/register?step=plan`,
-      });
-      const error = (res as { error?: unknown } | undefined)?.error;
-      if (error) throw error;
-      markPlanChosen(userId());
-    } catch {
-      toast.error('Could not start the upgrade. Please try again.');
-      setPlanBusy(false);
-    }
-  };
-
   const handleResend = async () => {
     if (resendCooldown() > 0) return;
 
     const { error: resendError } = await authClient.sendVerificationEmail({
       email: email(),
-      callbackURL: postSignupUrl(),
+      callbackURL: POST_SIGNUP_URL,
     });
 
     if (resendError) {
@@ -220,143 +154,116 @@ const Register: Component = () => {
           </>
         }
       >
-        <Show
-          when={showPlan()}
-          fallback={
-            <>
-              <div class="auth-header">
-                <h1 class="auth-header__title">Create an account</h1>
-                <p class="auth-header__subtitle">Monitor your AI harnesses' costs and usage</p>
-              </div>
-
-              <SocialButtons
-                enabledProviders={socialProviders()}
-                lastUsed={lastAuthMethod()}
-                callbackURL={socialSignupUrl()}
-              />
+        <div class="auth-header">
+          <h1 class="auth-header__title">Create an account</h1>
+          <p class="auth-header__subtitle">Monitor your AI harnesses' costs and usage</p>
+        </div>
 
-              <Show when={socialProviders().length > 0}>
-                <div class="auth-divider">
-                  <span class="auth-divider__text">or</span>
-                </div>
-              </Show>
+        <SocialButtons
+          enabledProviders={socialProviders()}
+          lastUsed={lastAuthMethod()}
+          callbackURL={socialSignupUrl}
+        />
 
-              <form class="auth-form" onSubmit={handleSubmit}>
-                <Show when={alreadyExists()}>
-                  <div id={errorId} class="auth-form__error" role="alert">
-                    An account with this email already exists.{' '}
-                    <A href={appendSearch('/login', location.search)} class="auth-form__error-link">
-                      Sign in
-                    </A>{' '}
-                    or{' '}
-                    <A href="/reset-password" class="auth-form__error-link">
-                      reset your password
-                    </A>
-                    .
-                  </div>
-                </Show>
-                <Show when={error() && !alreadyExists()}>
-                  <div id={errorId} class="auth-form__error" role="alert">
-                    {error()}
-                  </div>
-                </Show>
-                <label class="auth-form__label" for={nameId}>
-                  Name
-                  <input
-                    ref={(el) => requestAnimationFrame(() => el.focus())}
-                    id={nameId}
-                    class="auth-form__input"
-                    type="text"
-                    autocomplete="name"
-                    placeholder="Your name"
-                    value={name()}
-                    onInput={(e) => setName(e.currentTarget.value)}
-                    required
-                    aria-describedby={error() ? errorId : undefined}
-                  />
-                </label>
-                <label class="auth-form__label" for={emailId}>
-                  Email
-                  <input
-                    id={emailId}
-                    class="auth-form__input"
-                    type="email"
-                    autocomplete="email"
-                    placeholder="you@example.com"
-                    value={email()}
-                    onInput={(e) => setEmail(e.currentTarget.value)}
-                    required
-                    aria-describedby={error() ? errorId : undefined}
-                  />
-                </label>
-                <label class="auth-form__label" for={passwordId}>
-                  Password
-                  <input
-                    id={passwordId}
-                    class="auth-form__input"
-                    type="password"
-                    autocomplete="new-password"
-                    placeholder="Create a password"
-                    value={password()}
-                    onInput={(e) => setPassword(e.currentTarget.value)}
-                    required
-                    minLength={8}
-                    aria-describedby={error() ? errorId : undefined}
-                  />
-                </label>
-                <button class="auth-form__submit" type="submit" disabled={loading()}>
-                  {loading() ? <span class="spinner" /> : 'Create account'}
-                </button>
-              </form>
-              <p class="auth-terms">
-                By signing up, you agree to our{' '}
-                <a
-                  href="https://manifest.build/terms"
-                  class="auth-terms__link"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                >
-                  Terms
-                </a>{' '}
-                and{' '}
-                <a
-                  href="https://manifest.build/privacy"
-                  class="auth-terms__link"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                >
-                  Privacy Policy
-                </a>
-              </p>
-              <div class="auth-footer">
-                <span>Already have an account? </span>
-                <A href={appendSearch('/login', location.search)} class="auth-footer__link">
-                  Sign in
-                </A>
-              </div>
-            </>
-          }
-        >
-          <div class="auth-header">
-            <h1 class="auth-header__title">
-              {searchParams.context === 'login' ? 'Choose your plan' : 'Create an account'}
-            </h1>
-            <p class="auth-header__subtitle">
-              {searchParams.context === 'login'
-                ? 'Manifest now offers Free and Pro plans. Select the one that fits your needs.'
-                : "Monitor your AI harnesses' costs and usage"}
-            </p>
+        <Show when={socialProviders().length > 0}>
+          <div class="auth-divider">
+            <span class="auth-divider__text">or</span>
           </div>
+        </Show>
 
-          <Show when={searchParams.context !== 'login'}>
-            <div class="plan-picker__section-header">
-              <h2 class="plan-picker__section-title">Choose your plan</h2>
-              <p class="plan-picker__section-subtitle">You can change your plan anytime</p>
+        <form class="auth-form" onSubmit={handleSubmit}>
+          <Show when={alreadyExists()}>
+            <div id={errorId} class="auth-form__error" role="alert">
+              An account with this email already exists.{' '}
+              <A href={appendSearch('/login', location.search)} class="auth-form__error-link">
+                Sign in
+              </A>{' '}
+              or{' '}
+              <A href="/reset-password" class="auth-form__error-link">
+                reset your password
+              </A>
+              .
             </div>
           </Show>
-
-          <PlanPicker proPrice={proPrice()} onSelect={handlePlanSelect} busy={planBusy()} />
-        </Show>
+          <Show when={error() && !alreadyExists()}>
+            <div id={errorId} class="auth-form__error" role="alert">
+              {error()}
+            </div>
+          </Show>
+          <label class="auth-form__label" for={nameId}>
+            Name
+            <input
+              ref={(el) => requestAnimationFrame(() => el.focus())}
+              id={nameId}
+              class="auth-form__input"
+              type="text"
+              autocomplete="name"
+              placeholder="Your name"
+              value={name()}
+              onInput={(e) => setName(e.currentTarget.value)}
+              required
+              aria-describedby={error() ? errorId : undefined}
+            />
+          </label>
+          <label class="auth-form__label" for={emailId}>
+            Email
+            <input
+              id={emailId}
+              class="auth-form__input"
+              type="email"
+              autocomplete="email"
+              placeholder="you@example.com"
+              value={email()}
+              onInput={(e) => setEmail(e.currentTarget.value)}
+              required
+              aria-describedby={error() ? errorId : undefined}
+            />
+          </label>
+          <label class="auth-form__label" for={passwordId}>
+            Password
+            <input
+              id={passwordId}
+              class="auth-form__input"
+              type="password"
+              autocomplete="new-password"
+              placeholder="Create a password"
+              value={password()}
+              onInput={(e) => setPassword(e.currentTarget.value)}
+              required
+              minLength={8}
+              aria-describedby={error() ? errorId : undefined}
+            />
+          </label>
+          <button class="auth-form__submit" type="submit" disabled={loading()}>
+            {loading() ? <span class="spinner" /> : 'Create account'}
+          </button>
+        </form>
+        <p class="auth-terms">
+          By signing up, you agree to our{' '}
+          <a
+            href="https://manifest.build/terms"
+            class="auth-terms__link"
+            target="_blank"
+            rel="noopener noreferrer"
+          >
+            Terms
+          </a>{' '}
+          and{' '}
+          <a
+            href="https://manifest.build/privacy"
+            class="auth-terms__link"
+            target="_blank"
+            rel="noopener noreferrer"
+          >
+            Privacy Policy
+          </a>
+        </p>
+        <div class="auth-footer">
+          <span>Already have an account? </span>
+          <A href={appendSearch('/login', location.search)} class="auth-footer__link">
+            Sign in
+          </A>
+        </div>
       </Show>
     </>
   );
diff --git a/packages/frontend/src/pages/SettingsRecordingSection.tsx b/packages/frontend/src/pages/SettingsRecordingSection.tsx
index 6408d17a..4cbaacaf 100644
--- a/packages/frontend/src/pages/SettingsRecordingSection.tsx
+++ b/packages/frontend/src/pages/SettingsRecordingSection.tsx
@@ -1,14 +1,10 @@
 import { createResource, createSignal, type Component } from 'solid-js';
 import { getRecording, updateRecording } from '../services/api.js';
-import { checkIsSelfHosted } from '../services/setup-status.js';
 import { toast } from '../services/toast-store.js';
 
 const SettingsRecordingSection: Component<{ agentName: () => string }> = (props) => {
   const [config, { mutate }] = createResource(() => props.agentName(), getRecording);
   const [saving, setSaving] = createSignal(false);
-  // Where the logs live depends on the deployment: self-hosted keeps them in
-  // the operator's own database, cloud in the Manifest workspace.
-  const [selfHosted] = createResource(checkIsSelfHosted);
 
   const enabled = () => (!config.loading && !config.error ? (config()?.enabled ?? false) : false);
   const busy = () => saving() || config.loading || Boolean(config.error);
@@ -39,11 +35,8 @@ const SettingsRecordingSection: Component<{ agentName: () => string }> = (props)
             <span class="settings-card__label-title">Enable logs</span>
             <span class="settings-card__label-desc">
               Log the full content of every request and every attempt, so you can see what your
-              agent sends. You will find these logs on the Requests page, inside each request.{' '}
-              {selfHosted.state === 'ready' &&
-                (selfHosted()
-                  ? "On this self-hosted install, logs stay in your own database and never reach Manifest's cloud."
-                  : 'Logs are stored in your Manifest workspace.')}
+              agent sends. You will find these logs on the Requests page, inside each request. Logs
+              stay in your own database.
             </span>
           </div>
           <div class="settings-card__control settings-card__control--end">
diff --git a/packages/frontend/src/pages/Setup.tsx b/packages/frontend/src/pages/Setup.tsx
index e4a52d20..7e5c105b 100644
--- a/packages/frontend/src/pages/Setup.tsx
+++ b/packages/frontend/src/pages/Setup.tsx
@@ -3,7 +3,7 @@ import { Title, Meta } from '@solidjs/meta';
 import { type Component, createSignal, onMount, Show } from 'solid-js';
 import { authClient } from '../services/auth-client.js';
 import { buildLoginRedirect } from '../services/auth-redirects.js';
-import { checkIsSelfHosted, checkNeedsSetup, createFirstAdmin } from '../services/setup-status.js';
+import { checkNeedsSetup, createFirstAdmin } from '../services/setup-status.js';
 import { markDiscoveryPending } from '../services/discovery.js';
 
 const Setup: Component = () => {
@@ -53,14 +53,10 @@ const Setup: Component = () => {
         navigate(buildLoginRedirect('/discovery', '?next=%2F&signup=1'), { replace: true });
         return;
       }
-      // New self-hosted admins get the one-time discovery step first; the
-      // pending marker lets the guards route them back until it is done.
-      if (await checkIsSelfHosted()) {
-        markDiscoveryPending(signInData?.user?.id ?? '', '/');
-        window.location.href = '/discovery';
-      } else {
-        window.location.href = '/';
-      }
+      // New admins get the one-time discovery step first; the pending marker
+      // lets the guards route them back until it is done.
+      markDiscoveryPending(signInData?.user?.id ?? '', '/');
+      window.location.href = '/discovery';
     } catch (err) {
       setError(err instanceof Error ? err.message : 'Setup failed');
     } finally {
diff --git a/packages/frontend/src/pages/Upgrade.tsx b/packages/frontend/src/pages/Upgrade.tsx
deleted file mode 100644
index 3b19355c..00000000
--- a/packages/frontend/src/pages/Upgrade.tsx
+++ /dev/null
@@ -1,374 +0,0 @@
-import { Meta, Title } from '@solidjs/meta';
-import { useNavigate, useSearchParams } from '@solidjs/router';
-import { For, Show, createEffect, createResource, createSignal, type Component } from 'solid-js';
-import {
-  type PlanId,
-  freeFeatures,
-  proFeatures,
-  enterpriseFeatures,
-} from '../components/PlanPicker.jsx';
-import { authClient } from '../services/auth-client.js';
-import { getBillingStatus } from '../services/api/billing.js';
-import { toast } from '../services/toast-store.js';
-import { FREE_REQUEST_LIMIT_LABEL, formatBillingPrice } from '../services/billing-display.js';
-import { markPlanChosen } from '../services/plan-selection.js';
-
-const Upgrade: Component = () => {
-  const navigate = useNavigate();
-  const [searchParams] = useSearchParams();
-  const session = authClient.useSession();
-  const userId = () => session()?.data?.user?.id ?? '';
-  const [billingError, setBillingError] = createSignal(false);
-  const [billing] = createResource(async () => {
-    setBillingError(false);
-    try {
-      return await getBillingStatus({ cache: false });
-    } catch {
-      setBillingError(true);
-      return undefined;
-    }
-  });
-  const [billingBusy, setBillingBusy] = createSignal(false);
-
-  const status = () => billing();
-  // `?reason=requests` comes from links on old blocked requests and emails, so
-  // it can outlive the Free plan. Only a Free tenant has a limit to report.
-  const isRequestLimitEntry = () => searchParams.reason === 'requests' && status()?.plan === 'free';
-  const proPrice = () => formatBillingPrice(status()?.priceMonthly);
-
-  createEffect(() => {
-    const current = status();
-    if (current && !current.enabled) {
-      navigate('/', { replace: true });
-    }
-  });
-
-  const handlePlanSelect = async (plan: PlanId) => {
-    if (plan === 'enterprise') {
-      return;
-    }
-    setBillingBusy(true);
-    try {
-      const origin = window.location.origin;
-      const cancelPath = `${window.location.pathname}${window.location.search}` || '/upgrade';
-      const res = await authClient.subscription.upgrade({
-        plan: 'pro',
-        successUrl: `${origin}/overview?upgraded=1`,
-        cancelUrl: `${origin}${cancelPath}`,
-      });
-      const error = (res as { error?: unknown } | undefined)?.error;
-      if (error) throw error;
-      const uid = userId();
-      if (uid) markPlanChosen(uid);
-    } catch {
-      toast.error('Could not start the upgrade. Please try again.');
-    } finally {
-      setBillingBusy(false);
-    }
-  };
-
-  return (
-    <div class="account-modal account-modal--standalone">
-      <Title>Upgrade to Pro - Manifest</Title>
-      <Meta name="description" content="Upgrade Manifest to Pro for unlimited routed requests." />
-      <div class="account-modal__inner account-modal__inner--upgrade">
-        <Show when={window.history.length > 1}>
-          <button
-            class="upgrade-back"
-            onClick={() => {
-              const referrer = document.referrer;
-              if (referrer && new URL(referrer).origin === window.location.origin) {
-                window.history.back();
-              } else {
-                navigate('/');
-              }
-            }}
-          >
-            <svg
-              xmlns="http://www.w3.org/2000/svg"
-              width="16"
-              height="16"
-              fill="currentColor"
-              viewBox="0 0 24 24"
-              aria-hidden="true"
-            >
-              <path d="M15.41 7.41 14 6l-6 6 6 6 1.41-1.41L10.83 12l4.58-4.59Z" />
-            </svg>
-            Back
-          </button>
-        </Show>
-        <div class="page-header upgrade-page-header upgrade-page-header--centered">
-          <div class="upgrade-page-header__copy">
-            <h1>Full control over your AI routing</h1>
-            <p>Free to start. Pick the plan that fits how your team ships AI.</p>
-          </div>
-        </div>
-
-        <Show when={isRequestLimitEntry()}>
-          <p class="upgrade-limit-notice">
-            You've used all{' '}
-            {status()?.requests.limit?.toLocaleString('en-US') ?? FREE_REQUEST_LIMIT_LABEL} requests
-            this month. Upgrade for unlimited routed requests.
-          </p>
-        </Show>
-
-        <Show when={billing.loading}>
-          <div class="settings-card">
-            <div class="settings-card__body">
-              <p class="settings-card__desc">Loading billing status...</p>
-            </div>
-          </div>
-        </Show>
-
-        <Show when={billingError()}>
-          <div class="settings-card">
-            <div class="settings-card__body">
-              <p class="settings-card__desc">Could not load billing status. Please try again.</p>
-            </div>
-            <div class="settings-card__footer billing-footer">
-              <span class="billing-footer__note">You can continue to the dashboard.</span>
-              <button class="btn btn--outline btn--sm" onClick={() => navigate('/')}>
-                Dashboard
-              </button>
-            </div>
-          </div>
-        </Show>
-
-        <Show when={status()?.enabled && !billingError()}>
-          <Show
-            when={status()!.plan === 'pro'}
-            fallback={
-              <>
-                <div class="upgrade-plan-grid">
-                  <section class="settings-card upgrade-plan-card">
-                    <div class="upgrade-plan-card__header">
-                      <h2>Free</h2>
-                    </div>
-                    <div class="upgrade-plan-card__price">
-                      <span class="upgrade-plan-card__amount">$0</span>
-                      <span class="upgrade-plan-card__period">/month</span>
-                    </div>
-                    <p class="upgrade-plan-card__desc">For prototypes and small projects.</p>
-                    <div class="upgrade-plan-card__cta">
-                      <button
-                        class="btn btn--outline"
-                        onClick={() => {
-                          const uid = userId();
-                          if (uid) markPlanChosen(uid);
-                          navigate('/');
-                        }}
-                      >
-                        Use Manifest for free
-                      </button>
-                    </div>
-                    <div class="upgrade-plan-card__bottom">
-                      <div class="upgrade-plan-card__divider" />
-                      <ul class="upgrade-plan-card__features">
-                        <For each={freeFeatures}>
-                          {(feature) => (
-                            <li>
-                              <svg
-                                xmlns="http://www.w3.org/2000/svg"
-                                width="16"
-                                height="16"
-                                fill="#2632EF"
-                                viewBox="0 0 24 24"
-                                aria-hidden="true"
-                              >
-                                <path d="M9 15.59 4.71 11.3 3.3 12.71l5 5c.2.2.45.29.71.29s.51-.1.71-.29l11-11-1.41-1.41L9.02 15.59Z" />
-                              </svg>
-                              <span>{feature}</span>
-                            </li>
-                          )}
-                        </For>
-                      </ul>
-                    </div>
-                  </section>
-
-                  <section class="settings-card upgrade-plan-card upgrade-plan-card--pro">
-                    <span class="upgrade-plan-card__badge">Popular</span>
-                    <div class="upgrade-plan-card__header">
-                      <h2>Pro</h2>
-                    </div>
-                    <div class="upgrade-plan-card__price">
-                      <span class="upgrade-plan-card__amount">{proPrice() ?? 'Pro'}</span>
-                      <Show when={proPrice()}>
-                        <span class="upgrade-plan-card__period">/month</span>
-                      </Show>
-                    </div>
-                    <p class="upgrade-plan-card__desc">
-                      For production projects. Longer data access and unlimited agents. Not suited
-                      for teams.
-                    </p>
-                    <div class="upgrade-plan-card__cta">
-                      <button
-                        class="btn btn--primary"
-                        disabled={billingBusy()}
-                        onClick={() => handlePlanSelect('pro')}
-                      >
-                        {billingBusy() ? <span class="spinner" /> : 'Upgrade to Pro'}
-                      </button>
-                      <span class="upgrade-plan-card__no-commitment">
-                        No commitment, cancel anytime
-                      </span>
-                    </div>
-                    <div class="upgrade-plan-card__bottom">
-                      <div class="upgrade-plan-card__divider" />
-                      <p class="upgrade-plan-card__features-intro">
-                        Everything in the Free plan, plus:
-                      </p>
-                      <ul class="upgrade-plan-card__features">
-                        <For each={proFeatures}>
-                          {(feature) => (
-                            <li>
-                              <svg
-                                xmlns="http://www.w3.org/2000/svg"
-                                width="16"
-                                height="16"
-                                fill="#2632EF"
-                                viewBox="0 0 24 24"
-                                aria-hidden="true"
-                              >
-                                <path d="M9 15.59 4.71 11.3 3.3 12.71l5 5c.2.2.45.29.71.29s.51-.1.71-.29l11-11-1.41-1.41L9.02 15.59Z" />
-                              </svg>
-                              <span>{feature}</span>
-                            </li>
-                          )}
-                        </For>
-                      </ul>
-                    </div>
-                  </section>
-
-                  <section class="settings-card upgrade-plan-card">
-                    <div class="upgrade-plan-card__header">
-                      <h2>Enterprise</h2>
-                    </div>
-                    <div class="upgrade-plan-card__price">
-                      <span class="upgrade-plan-card__amount upgrade-plan-card__amount--custom">
-                        Let's Talk
-                      </span>
-                    </div>
-                    <p class="upgrade-plan-card__desc">
-                      For scaling projects, large scale teams. Enterprise-grade support and
-                      security.
-                    </p>
-                    <div class="upgrade-plan-card__cta">
-                      <a
-                        class="btn btn--primary"
-                        href="https://manifest.build/pricing"
-                        target="_blank"
-                        rel="noopener noreferrer"
-                      >
-                        Talk to sales
-                      </a>
-                    </div>
-                    <div class="upgrade-plan-card__bottom">
-                      <div class="upgrade-plan-card__divider" />
-                      <ul class="upgrade-plan-card__features">
-                        <For each={enterpriseFeatures}>
-                          {(feature) => (
-                            <li>
-                              <svg
-                                xmlns="http://www.w3.org/2000/svg"
-                                width="16"
-                                height="16"
-                                fill="#2632EF"
-                                viewBox="0 0 24 24"
-                                aria-hidden="true"
-                              >
-                                <path d="M9 15.59 4.71 11.3 3.3 12.71l5 5c.2.2.45.29.71.29s.51-.1.71-.29l11-11-1.41-1.41L9.02 15.59Z" />
-                              </svg>
-                              <span>{feature}</span>
-                            </li>
-                          )}
-                        </For>
-                      </ul>
-                    </div>
-                  </section>
-                </div>
-                <p class="upgrade-terms">
-                  Subject to our{' '}
-                  <a href="https://manifest.build/terms" target="_blank" rel="noopener noreferrer">
-                    terms and conditions
-                  </a>
-                </p>
-              </>
-            }
-          >
-            <div class="upgrade-pro-current">
-              <p class="upgrade-pro-current__status">
-                You're currently on the <strong>Pro plan</strong>. Manage billing from{' '}
-                <a href="/account" class="billing-footer__link">
-                  Account
-                </a>
-                .
-              </p>
-              <p class="upgrade-pro-current__status">
-                If you need more (team management, compliance, SLAs...), explore our Enterprise
-                plan.
-              </p>
-
-              <div class="upgrade-pro-current__card">
-                <section class="settings-card upgrade-plan-card">
-                  <div class="upgrade-plan-card__header">
-                    <h2>Enterprise</h2>
-                  </div>
-                  <div class="upgrade-plan-card__price">
-                    <span class="upgrade-plan-card__amount upgrade-plan-card__amount--custom">
-                      Let's Talk
-                    </span>
-                  </div>
-                  <p class="upgrade-plan-card__desc">
-                    Everything is negotiable. We build the plan around your team's needs.
-                  </p>
-                  <div class="upgrade-plan-card__cta">
-                    <a
-                      class="btn btn--primary"
-                      href="https://manifest.build/pricing"
-                      target="_blank"
-                      rel="noopener noreferrer"
-                    >
-                      Talk to sales
-                    </a>
-                  </div>
-                  <div class="upgrade-plan-card__bottom">
-                    <div class="upgrade-plan-card__divider" />
-                    <ul class="upgrade-plan-card__features">
-                      {[
-                        'Multiple seats and team management',
-                        'SSO / SAML',
-                        'Audit logs',
-                        'Custom retention',
-                        'Uptime SLA',
-                        'SOC 2 Type II and ISO 27001',
-                        'HIPAA and custom BAAs',
-                        'Custom guardrails',
-                        'Dedicated support (Slack and email)',
-                      ].map((feature) => (
-                        <li>
-                          <svg
-                            xmlns="http://www.w3.org/2000/svg"
-                            width="16"
-                            height="16"
-                            fill="#2632EF"
-                            viewBox="0 0 24 24"
-                            aria-hidden="true"
-                          >
-                            <path d="M9 15.59 4.71 11.3 3.3 12.71l5 5c.2.2.45.29.71.29s.51-.1.71-.29l11-11-1.41-1.41L9.02 15.59Z" />
-                          </svg>
-                          <span>{feature}</span>
-                        </li>
-                      ))}
-                    </ul>
-                  </div>
-                </section>
-              </div>
-            </div>
-          </Show>
-        </Show>
-      </div>
-    </div>
-  );
-};
-
-export default Upgrade;
diff --git a/packages/frontend/src/pages/Welcome.tsx b/packages/frontend/src/pages/Welcome.tsx
index e8425f57..60e37b85 100644
--- a/packages/frontend/src/pages/Welcome.tsx
+++ b/packages/frontend/src/pages/Welcome.tsx
@@ -57,7 +57,6 @@ import { customProviderColor } from '../services/formatters.js';
 import { markAgentCreated } from '../services/recent-agents.js';
 import { useRightSidebar } from '../services/right-sidebar.jsx';
 import { hasOnboardingBeenDone, markOnboardingDone } from '../services/onboarding.js';
-import { checkIsSelfHosted } from '../services/setup-status.js';
 import {
   type AgentCategory,
   type AgentPlatform,
@@ -165,8 +164,6 @@ const Welcome: Component = () => {
     }
   };
   // ── Shared resources ─────────────────────────────────────────────────
-  const [selfHosted] = createResource(checkIsSelfHosted);
-
   // The Playground agent gives provider connections an agent context before
   // the user's own harness exists (providers are tenant-global anyway).
   const [agent] = createResource(() => getPlaygroundAgent());
@@ -220,9 +217,7 @@ const Welcome: Component = () => {
   const handleProviderTabKeyDown = (event: KeyboardEvent) => {
     if (event.key !== 'ArrowLeft' && event.key !== 'ArrowRight') return;
     event.preventDefault();
-    const order: Array<'api_key' | 'subscription' | 'local'> = selfHosted()
-      ? ['api_key', 'subscription', 'local']
-      : ['api_key', 'subscription'];
+    const order: Array<'api_key' | 'subscription' | 'local'> = ['api_key', 'subscription', 'local'];
     const idx = order.indexOf(tab() as 'api_key' | 'subscription' | 'local');
     const next =
       event.key === 'ArrowRight'
@@ -719,16 +714,10 @@ const Welcome: Component = () => {
 
   // Never trap users: setup resumes from server state on the next visit, so
   // skipping only skips the guidance, not the work.
-  const skipOnboarding = () => {
-    const uid = userId();
-    if (uid) markOnboardingDone(uid);
-    navigate('/register?step=plan');
-  };
-
-  const openOnboardingPaywall = () => {
+  const leaveOnboarding = () => {
     const uid = userId();
     if (uid) markOnboardingDone(uid);
-    navigate('/register?step=plan');
+    navigate('/');
   };
 
   // Which steps are completed, for the sidebar checkmarks. Steps without
@@ -828,7 +817,7 @@ const Welcome: Component = () => {
         </section>
 
         <div class="welcome__sidebar-footer">
-          <button type="button" class="btn btn--ghost btn--sm" onClick={skipOnboarding}>
+          <button type="button" class="btn btn--ghost btn--sm" onClick={leaveOnboarding}>
             Skip setup for now
           </button>
         </div>
@@ -959,11 +948,7 @@ const Welcome: Component = () => {
                             </div>
                             <div class="model-params__label-hint">
                               See exactly what your agent sends on every attempt, and debug it
-                              faster.{' '}
-                              {selfHosted.state === 'ready' &&
-                                (selfHosted()
-                                  ? 'Logs stay in your own database.'
-                                  : 'Logs are stored in your Manifest workspace.')}
+                              faster. Logs stay in your own database.
                             </div>
                           </div>
                           <div class="model-params__row-control">
@@ -1102,32 +1087,30 @@ const Welcome: Component = () => {
                   </svg>
                   Subscriptions
                 </button>
-                <Show when={selfHosted()}>
-                  <button
-                    id="welcome-provider-tab-local"
-                    class="panel__tab"
-                    classList={{ 'panel__tab--active': tab() === 'local' }}
-                    type="button"
-                    role="tab"
-                    aria-selected={tab() === 'local'}
-                    aria-controls="welcome-provider-panel-local"
-                    tabindex={tab() === 'local' ? 0 : -1}
-                    onClick={() => selectProviderTab('local')}
-                    onKeyDown={handleProviderTabKeyDown}
+                <button
+                  id="welcome-provider-tab-local"
+                  class="panel__tab"
+                  classList={{ 'panel__tab--active': tab() === 'local' }}
+                  type="button"
+                  role="tab"
+                  aria-selected={tab() === 'local'}
+                  aria-controls="welcome-provider-panel-local"
+                  tabindex={tab() === 'local' ? 0 : -1}
+                  onClick={() => selectProviderTab('local')}
+                  onKeyDown={handleProviderTabKeyDown}
+                >
+                  <svg
+                    width="14"
+                    height="14"
+                    viewBox="0 0 24 24"
+                    fill="currentColor"
+                    aria-hidden="true"
+                    style="color: #F72585"
                   >
-                    <svg
-                      width="14"
-                      height="14"
-                      viewBox="0 0 24 24"
-                      fill="currentColor"
-                      aria-hidden="true"
-                      style="color: #F72585"
-                    >
-                      <path d="m13.18 6.75 2.66-4.22-1.69-1.07L12 4.87 9.85 1.46 8.16 2.53l2.66 4.22-8.67 13.72A1.006 1.006 0 0 0 3 22.01h18c.36 0 .7-.2.88-.52s.16-.71-.03-1.02zM10.24 20 12 16.98 13.76 20zm5.83 0-3.21-5.5c-.36-.62-1.37-.62-1.73 0L7.92 20H4.81L12 8.62 19.19 20h-3.11Z" />
-                    </svg>
-                    Local
-                  </button>
-                </Show>
+                    <path d="m13.18 6.75 2.66-4.22-1.69-1.07L12 4.87 9.85 1.46 8.16 2.53l2.66 4.22-8.67 13.72A1.006 1.006 0 0 0 3 22.01h18c.36 0 .7-.2.88-.52s.16-.71-.03-1.02zM10.24 20 12 16.98 13.76 20zm5.83 0-3.21-5.5c-.36-.62-1.37-.62-1.73 0L7.92 20H4.81L12 8.62 19.19 20h-3.11Z" />
+                  </svg>
+                  Local
+                </button>
               </div>
 
               <Show
@@ -1426,7 +1409,7 @@ const Welcome: Component = () => {
                   Back to routing
                 </button>
                 <Show when={agentRequestSeen()}>
-                  <button class="btn btn--primary" onClick={openOnboardingPaywall}>
+                  <button class="btn btn--primary" onClick={leaveOnboarding}>
                     Go to dashboard
                     <svg
                       width="14"
@@ -1611,7 +1594,7 @@ const Welcome: Component = () => {
             <button
               ref={(element) => (liftoffAction = element)}
               class="welcome__liftoff-action btn btn--primary"
-              onClick={openOnboardingPaywall}
+              onClick={leaveOnboarding}
             >
               Go to dashboard
               <svg
diff --git a/packages/frontend/src/pages/integrations/Cli.tsx b/packages/frontend/src/pages/integrations/Cli.tsx
index c100b645..5f36728d 100644
--- a/packages/frontend/src/pages/integrations/Cli.tsx
+++ b/packages/frontend/src/pages/integrations/Cli.tsx
@@ -1,25 +1,17 @@
-import { createMemo, createResource, type Component } from 'solid-js';
+import type { Component } from 'solid-js';
 import { Title, Meta } from '@solidjs/meta';
 import CodeBlock from '../../components/CodeBlock.jsx';
 import { installOrigin } from '../../services/install-endpoints.js';
-import { checkIsSelfHosted } from '../../services/setup-status.js';
 
 const DOCS_URL = 'https://manifest.build/llm-gateway/docs/cli/';
 const PACKAGE = 'mnfst-gateway-cli';
 
 /**
- * On a self-hosted install the CLI has to be told which host to talk to, and
- * this dashboard is the only place that knows it. On Cloud the CLI already
- * defaults there, so the flag would be noise.
- *
- * `pinHost` is deliberately "not known to be Cloud" rather than "known to be
- * self-hosted". While the deployment check is in flight, or if it fails, the
- * honest fallback is the explicit form: `--url` is merely redundant on Cloud,
- * whereas a bare `mnfst login` is plain wrong on a self-hosted install and the
- * user would copy it before the check resolved.
+ * The CLI has to be told which host to talk to, and this dashboard is the only
+ * place that knows it.
  */
-export function loginCommand(pinHost: boolean, origin: string): string {
-  return pinHost ? `mnfst login --url ${origin}` : 'mnfst login';
+export function loginCommand(origin: string): string {
+  return `mnfst login --url ${origin}`;
 }
 
 const EXAMPLE = `mnfst agent create --name coding-assistant --platform openclaw
@@ -28,14 +20,7 @@ mnfst agent configure coding-assistant --models grok-4.5,grok-4 --provider xai
 mnfst routing test coding-assistant`;
 
 const Cli: Component = () => {
-  // A failed deployment check must not throw into the render tree: this page
-  // has a correct answer for "unknown" and nothing to escalate. Swallowing it
-  // here keeps the failure indistinguishable from still-loading, which is what
-  // the memo below already handles.
-  const [selfHosted] = createResource(() => checkIsSelfHosted().catch(() => undefined));
-  // Only a confirmed Cloud install drops the flag; unresolved and errored both
-  // keep it, so a self-hosted user never sees a command that targets Cloud.
-  const login = createMemo(() => loginCommand(selfHosted() !== false, installOrigin()));
+  const login = () => loginCommand(installOrigin());
 
   return (
     <div class="container--lg">
diff --git a/packages/frontend/src/pages/providers/ConnectionDetail.tsx b/packages/frontend/src/pages/providers/ConnectionDetail.tsx
index e2321d9a..351a08c0 100644
--- a/packages/frontend/src/pages/providers/ConnectionDetail.tsx
+++ b/packages/frontend/src/pages/providers/ConnectionDetail.tsx
@@ -1,7 +1,6 @@
 import { Title } from '@solidjs/meta';
 import { toggleScrollFade } from '../../services/scroll-fade.js';
 import { A, useNavigate, useParams } from '@solidjs/router';
-import { getBillingStatus } from '../../services/api/billing.js';
 import {
   createEffect,
   createMemo,
@@ -117,7 +116,6 @@ interface AnalyticsResponse {
   attempts: { total: number; successful: number; success_rate: number };
 }
 
-const PRO_RANGES_CD = new Set(['30d', '90d', '365d']);
 const CD_RANGE_OPTIONS = [
   { label: 'Last 24 hours', value: '24h' },
   { label: 'Last 7 days', value: '7d' },
@@ -129,26 +127,6 @@ const CD_RANGE_OPTIONS = [
 const ConnectionDetail: Component = () => {
   const params = useParams<{ connectionId: string }>();
   const navigate = useNavigate();
-  const [billing] = createResource(async () => {
-    try {
-      return await getBillingStatus();
-    } catch {
-      return null;
-    }
-  });
-  const isFreePlan = () => billing()?.enabled && billing()?.plan === 'free';
-  const proBadge = () => (
-    <span class="pro-range-badge" aria-label="Pro plan required">
-      PRO
-    </span>
-  );
-  const cdRangeOptions = () =>
-    CD_RANGE_OPTIONS.map((opt) =>
-      isFreePlan() && PRO_RANGES_CD.has(opt.value)
-        ? { ...opt, disabled: true, badge: proBadge() }
-        : opt,
-    );
-
   const [detail, { refetch: refetchDetail }] = createResource(
     () => params.connectionId,
     (id) => getConnectionDetail(id) as Promise<DetailResponse>,
@@ -800,11 +778,8 @@ const ConnectionDetail: Component = () => {
                   </Show>
                   <Select
                     value={chartRange()}
-                    onChange={(v) => {
-                      if (isFreePlan() && PRO_RANGES_CD.has(v)) return;
-                      setChartRange(v);
-                    }}
-                    options={cdRangeOptions()}
+                    onChange={setChartRange}
+                    options={CD_RANGE_OPTIONS}
                   />
                   <button class="btn btn--outline btn--sm" onClick={openManageModal}>
                     Manage
diff --git a/packages/frontend/src/pages/providers/Local.tsx b/packages/frontend/src/pages/providers/Local.tsx
index 6683d610..fc33913f 100644
--- a/packages/frontend/src/pages/providers/Local.tsx
+++ b/packages/frontend/src/pages/providers/Local.tsx
@@ -1,23 +1,7 @@
-import { Navigate } from '@solidjs/router';
-import { createResource, Show, type Component } from 'solid-js';
+import type { Component } from 'solid-js';
 import ProviderConnectionsPage from './ProviderConnectionsPage.jsx';
-import { checkIsSelfHosted } from '../../services/setup-status.js';
 
-/**
- * Local providers (Ollama, LM Studio) only exist on self-hosted installs — a
- * cloud backend can't reach the user's localhost. In cloud the route redirects
- * to BYOK instead of showing an unusable page. Nothing renders until the
- * self-hosted check resolves so the page never flashes before a redirect.
- */
-const LocalProviders: Component = () => {
-  const [selfHosted] = createResource(checkIsSelfHosted);
-  return (
-    <Show when={selfHosted() !== undefined}>
-      <Show when={selfHosted()} fallback={<Navigate href="/providers/usage-based" />}>
-        <ProviderConnectionsPage kind="local" />
-      </Show>
-    </Show>
-  );
-};
+/** Local providers (Ollama, LM Studio, llama.cpp) running next to this install. */
+const LocalProviders: Component = () => <ProviderConnectionsPage kind="local" />;
 
 export default LocalProviders;
diff --git a/packages/frontend/src/services/api.ts b/packages/frontend/src/services/api.ts
index 5edb545e..ae9f2e98 100644
--- a/packages/frontend/src/services/api.ts
+++ b/packages/frontend/src/services/api.ts
@@ -7,7 +7,6 @@ export * from './api/specificity.js';
 export * from './api/header-tiers.js';
 export * from './api/notifications.js';
 export * from './api/oauth.js';
-export * from './api/free-models.js';
 export * from './api/model-params.js';
 export * from './api/playground.js';
 export * from './api/version.js';
diff --git a/packages/frontend/src/services/api/analytics.ts b/packages/frontend/src/services/api/analytics.ts
index c7be1425..d2d727e7 100644
--- a/packages/frontend/src/services/api/analytics.ts
+++ b/packages/frontend/src/services/api/analytics.ts
@@ -1,14 +1,14 @@
 import { fetchJson } from './core.js';
 
-export type PivotedTimeseries = Promise<{
+export type KeyedTimeseries = Promise<{
   agents: string[];
   timeseries: Array<Record<string, number | string>>;
 }>;
 
 export type UsageTimeseries = Promise<{
-  tokenUsage: Awaited<PivotedTimeseries>;
-  messageUsage: Awaited<PivotedTimeseries>;
-  costUsage: Awaited<PivotedTimeseries>;
+  tokenUsage: Awaited<KeyedTimeseries>;
+  messageUsage: Awaited<KeyedTimeseries>;
+  costUsage: Awaited<KeyedTimeseries>;
 }>;
 
 export function getProviderAnalytics(
@@ -43,14 +43,14 @@ export function getPerAgentTimeseries(
   range = '24h',
   label?: string,
   connectionId?: string,
-): PivotedTimeseries {
+): KeyedTimeseries {
   return fetchJson('/provider-analytics/per-agent-timeseries', {
     auth_type: authType,
     provider,
     range,
     ...(label !== undefined ? { label } : {}),
     ...(connectionId ? { connection_id: connectionId } : {}),
-  }) as PivotedTimeseries;
+  }) as KeyedTimeseries;
 }
 
 /**
@@ -141,14 +141,14 @@ export function getPerAgentMessageTimeseries(
   range = '24h',
   label?: string,
   connectionId?: string,
-): PivotedTimeseries {
+): KeyedTimeseries {
   return fetchJson('/provider-analytics/per-agent-message-timeseries', {
     auth_type: authType,
     provider,
     range,
     ...(label !== undefined ? { label } : {}),
     ...(connectionId ? { connection_id: connectionId } : {}),
-  }) as PivotedTimeseries;
+  }) as KeyedTimeseries;
 }
 
 export function getPerAgentCostTimeseries(
@@ -157,86 +157,83 @@ export function getPerAgentCostTimeseries(
   range = '24h',
   label?: string,
   connectionId?: string,
-): PivotedTimeseries {
+): KeyedTimeseries {
   return fetchJson('/provider-analytics/per-agent-cost-timeseries', {
     auth_type: authType,
     provider,
     range,
     ...(label !== undefined ? { label } : {}),
     ...(connectionId ? { connection_id: connectionId } : {}),
-  }) as PivotedTimeseries;
+  }) as KeyedTimeseries;
 }
 
 export function getConnectionDetail(connectionId: string) {
   return fetchJson('/provider-analytics/connection-detail', { connection_id: connectionId });
 }
 
-export function getGlobalPerAgentTimeseries(range = '24h'): PivotedTimeseries {
-  return fetchJson('/overview/per-agent-timeseries', { range }) as PivotedTimeseries;
+export function getGlobalPerAgentTimeseries(range = '24h'): KeyedTimeseries {
+  return fetchJson('/overview/per-agent-timeseries', { range }) as KeyedTimeseries;
 }
 
-export function getGlobalPerAgentMessageTimeseries(range = '24h'): PivotedTimeseries {
-  return fetchJson('/overview/per-agent-message-timeseries', { range }) as PivotedTimeseries;
+export function getGlobalPerAgentMessageTimeseries(range = '24h'): KeyedTimeseries {
+  return fetchJson('/overview/per-agent-message-timeseries', { range }) as KeyedTimeseries;
 }
 
-export function getGlobalPerAgentCostTimeseries(range = '24h'): PivotedTimeseries {
-  return fetchJson('/overview/per-agent-cost-timeseries', { range }) as PivotedTimeseries;
+export function getGlobalPerAgentCostTimeseries(range = '24h'): KeyedTimeseries {
+  return fetchJson('/overview/per-agent-cost-timeseries', { range }) as KeyedTimeseries;
 }
 
 export function getOverviewAgentUsage(range = '24h'): UsageTimeseries {
   return fetchJson('/overview/agents/usage', { range }) as UsageTimeseries;
 }
 
-export function getGlobalPerProviderTimeseries(range = '24h'): PivotedTimeseries {
-  return fetchJson('/overview/per-provider-timeseries', { range }) as PivotedTimeseries;
+export function getGlobalPerProviderTimeseries(range = '24h'): KeyedTimeseries {
+  return fetchJson('/overview/per-provider-timeseries', { range }) as KeyedTimeseries;
 }
 
-export function getGlobalPerProviderMessageTimeseries(range = '24h'): PivotedTimeseries {
-  return fetchJson('/overview/per-provider-message-timeseries', { range }) as PivotedTimeseries;
+export function getGlobalPerProviderMessageTimeseries(range = '24h'): KeyedTimeseries {
+  return fetchJson('/overview/per-provider-message-timeseries', { range }) as KeyedTimeseries;
 }
 
-export function getGlobalPerProviderCostTimeseries(range = '24h'): PivotedTimeseries {
-  return fetchJson('/overview/per-provider-cost-timeseries', { range }) as PivotedTimeseries;
+export function getGlobalPerProviderCostTimeseries(range = '24h'): KeyedTimeseries {
+  return fetchJson('/overview/per-provider-cost-timeseries', { range }) as KeyedTimeseries;
 }
 
 export function getOverviewProviderUsage(range = '24h'): UsageTimeseries {
   return fetchJson('/overview/providers/usage', { range }) as UsageTimeseries;
 }
 
-export function getGlobalPerModelTimeseries(range = '24h'): PivotedTimeseries {
-  return fetchJson('/overview/per-model-timeseries', { range }) as PivotedTimeseries;
+export function getGlobalPerModelTimeseries(range = '24h'): KeyedTimeseries {
+  return fetchJson('/overview/per-model-timeseries', { range }) as KeyedTimeseries;
 }
 
-export function getGlobalPerModelMessageTimeseries(range = '24h'): PivotedTimeseries {
-  return fetchJson('/overview/per-model-message-timeseries', { range }) as PivotedTimeseries;
+export function getGlobalPerModelMessageTimeseries(range = '24h'): KeyedTimeseries {
+  return fetchJson('/overview/per-model-message-timeseries', { range }) as KeyedTimeseries;
 }
 
-export function getGlobalPerModelCostTimeseries(range = '24h'): PivotedTimeseries {
-  return fetchJson('/overview/per-model-cost-timeseries', { range }) as PivotedTimeseries;
+export function getGlobalPerModelCostTimeseries(range = '24h'): KeyedTimeseries {
+  return fetchJson('/overview/per-model-cost-timeseries', { range }) as KeyedTimeseries;
 }
 
-export function getPerProviderTimeseries(agentName: string, range = '24h'): PivotedTimeseries {
+export function getPerProviderTimeseries(agentName: string, range = '24h'): KeyedTimeseries {
   return fetchJson('/overview/per-provider-timeseries', {
     agent_name: agentName,
     range,
-  }) as PivotedTimeseries;
+  }) as KeyedTimeseries;
 }
 
-export function getPerProviderMessageTimeseries(
-  agentName: string,
-  range = '24h',
-): PivotedTimeseries {
+export function getPerProviderMessageTimeseries(agentName: string, range = '24h'): KeyedTimeseries {
   return fetchJson('/overview/per-provider-message-timeseries', {
     agent_name: agentName,
     range,
-  }) as PivotedTimeseries;
+  }) as KeyedTimeseries;
 }
 
-export function getPerProviderCostTimeseries(agentName: string, range = '24h'): PivotedTimeseries {
+export function getPerProviderCostTimeseries(agentName: string, range = '24h'): KeyedTimeseries {
   return fetchJson('/overview/per-provider-cost-timeseries', {
     agent_name: agentName,
     range,
-  }) as PivotedTimeseries;
+  }) as KeyedTimeseries;
 }
 
 export function getOverview(range = '24h', agentName?: string, fast = false) {
diff --git a/packages/frontend/src/services/api/billing.ts b/packages/frontend/src/services/api/billing.ts
deleted file mode 100644
index 296fb39a..00000000
--- a/packages/frontend/src/services/api/billing.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import { fetchJson, fetchMutate, type FetchJsonOptions } from './core';
-import type { BillingEmailPreferences, BillingPlanStatus, BillingStatus } from 'manifest-shared';
-
-// Re-export so UI components can import the type from the API module they
-// already use, instead of reaching across package boundaries for it.
-export type { BillingEmailPreferences, BillingPlanStatus, BillingStatus };
-
-export function getBillingStatus(options?: FetchJsonOptions): Promise<BillingStatus> {
-  if (options) {
-    return fetchJson<BillingStatus>('/billing/status', undefined, options);
-  }
-  return fetchJson<BillingStatus>('/billing/status');
-}
-
-/**
- * Light plan lookup — no usage counter, no Stripe price. See plan-store.ts.
- * AuthGuard fires it before the session is known, so a signed-out 401 must
- * reject quietly rather than hard-navigate to /login and lose the requested
- * path the guard is about to preserve.
- */
-export function getBillingPlan(): Promise<BillingPlanStatus> {
-  return fetchJson<BillingPlanStatus>('/billing/plan', undefined, { loginRedirect: false });
-}
-
-export function updateBillingEmailPreferences(
-  preferences: BillingEmailPreferences,
-): Promise<BillingEmailPreferences> {
-  return fetchMutate<BillingEmailPreferences>('/billing/email-preferences', {
-    method: 'PATCH',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(preferences),
-  });
-}
diff --git a/packages/frontend/src/services/api/core.ts b/packages/frontend/src/services/api/core.ts
index f8537878..b76b252e 100644
--- a/packages/frontend/src/services/api/core.ts
+++ b/packages/frontend/src/services/api/core.ts
@@ -15,9 +15,8 @@ export interface FetchJsonOptions {
   /**
    * Whether a 401 that looks like a session expiry hard-navigates the browser
    * to `/login`. Defaults to `true`. Pass `false` for a probe that may run
-   * before the session is known (the plan prefetch in AuthGuard): it then
-   * rejects with the same error and leaves the redirect, and the preserved
-   * requested path, to the auth guard.
+   * before the session is known: it then rejects with the same error and
+   * leaves the redirect, and the preserved requested path, to the auth guard.
    */
   loginRedirect?: boolean;
 }
diff --git a/packages/frontend/src/services/api/free-models.ts b/packages/frontend/src/services/api/free-models.ts
deleted file mode 100644
index 4a2da863..00000000
--- a/packages/frontend/src/services/api/free-models.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-import { fetchJson } from './core.js';
-
-export interface FreeModelDto {
-  id: string | null;
-  name: string;
-  context: string;
-  max_output: string;
-  modality: string;
-  rate_limit: string;
-}
-
-export interface FreeProviderDto {
-  name: string;
-  logo: string | null;
-  description: string;
-  tags: string[];
-  api_key_url: string;
-  base_url: string | null;
-  warning: string | null;
-  country: string;
-  flag: string;
-  models: FreeModelDto[];
-}
-
-export interface FreeModelsResponse {
-  providers: FreeProviderDto[];
-  last_synced_at: string | null;
-}
-
-export function getFreeModels(): Promise<FreeModelsResponse> {
-  return fetchJson<FreeModelsResponse>('/free-models');
-}
diff --git a/packages/frontend/src/services/api/providers.ts b/packages/frontend/src/services/api/providers.ts
index 9d288b56..8f0913f1 100644
--- a/packages/frontend/src/services/api/providers.ts
+++ b/packages/frontend/src/services/api/providers.ts
@@ -1,6 +1,5 @@
-import { SHARED_PROVIDERS, type AuthType } from 'manifest-shared';
-import { invalidateAll } from './cache.js';
-import { BASE_URL, fetchJson, parseErrorMessage } from './core.js';
+import type { AuthType } from 'manifest-shared';
+import { fetchJson } from './core.js';
 
 export interface TenantProviderConnection {
   id: string;
@@ -66,64 +65,9 @@ export interface ProviderUsageResponse {
   providers: TenantProviderUsage[];
 }
 
-export interface ManagedFreeEnsureResponse {
-  connected: boolean;
-  connection_id: string | null;
-  source: 'existing' | 'auto' | 'manual' | 'none';
-  auto_available: boolean;
-}
-
-const managedFreeEnsureInflight = new Map<string, Promise<ManagedFreeEnsureResponse>>();
-
-export async function ensureManagedFreeProvider(
-  providerId: string,
-  apiKey?: string,
-): Promise<ManagedFreeEnsureResponse> {
-  const existing = managedFreeEnsureInflight.get(providerId);
-  if (!apiKey && existing) return existing;
-
-  const run = (async () => {
-    const response = await fetch(`${BASE_URL}/providers/${encodeURIComponent(providerId)}/ensure`, {
-      method: 'POST',
-      credentials: 'include',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(apiKey ? { apiKey } : {}),
-    });
-    if (!response.ok) {
-      throw new Error(await parseErrorMessage(response));
-    }
-    const data = (await response.json()) as ManagedFreeEnsureResponse;
-    if (data.source === 'auto' || data.source === 'manual') {
-      invalidateAll();
-    }
-    return data;
-  })();
-
-  if (!apiKey) {
-    const tracked = run.finally(() => {
-      if (managedFreeEnsureInflight.get(providerId) === tracked) {
-        managedFreeEnsureInflight.delete(providerId);
-      }
-    });
-    managedFreeEnsureInflight.set(providerId, tracked);
-    return tracked;
-  }
-  return run;
-}
-
-/**
- * Fetch provider CONFIG only (cheap; paints immediately).
- * Managed free-provider provisioning stays in the background so an unavailable
- * LiteLLM gateway never blocks provider configuration or routing screens.
- */
+/** Fetch provider CONFIG only (cheap; paints immediately). */
 export function getProviders() {
-  const providers = fetchJson<ProvidersResponse>('/providers');
-  for (const provider of SHARED_PROVIDERS) {
-    if (provider.managedFree) {
-      void ensureManagedFreeProvider(provider.id).catch(() => undefined);
-    }
-  }
-  return providers;
+  return fetchJson<ProvidersResponse>('/providers');
 }
 
 /** Fetch provider USAGE stats (the expensive 30d aggregation). */
diff --git a/packages/frontend/src/services/auth-client.ts b/packages/frontend/src/services/auth-client.ts
index f90be81f..189b3546 100644
--- a/packages/frontend/src/services/auth-client.ts
+++ b/packages/frontend/src/services/auth-client.ts
@@ -1,21 +1,6 @@
 import { createAuthClient } from 'better-auth/solid';
-import { stripeClient } from '@better-auth/stripe/client';
 
-// The stripe client plugin widens the client with a `subscription` namespace
-// (upgrade/cancel/billingPortal/list) that the billing UI calls.
-//
-// The explicit annotation is required because `declaration: true` demands a
-// portable type: the *inferred* type reaches into private dist chunks of
-// `@better-auth/stripe` and `better-auth` that TS cannot name (TS2742).
-// Spelling the same type via instantiation expressions on the two imported
-// factories keeps it portable while `authClient.subscription` stays fully
-// typed. Keep the annotation's plugin options in sync with the call below.
-export const authClient: ReturnType<
-  typeof createAuthClient<{
-    plugins: [ReturnType<typeof stripeClient<{ subscription: true }>>];
-  }>
-> = createAuthClient({
+export const authClient = createAuthClient({
   baseURL: window.location.origin,
   basePath: '/api/auth',
-  plugins: [stripeClient({ subscription: true })],
 });
diff --git a/packages/frontend/src/services/auth-redirects.ts b/packages/frontend/src/services/auth-redirects.ts
index 7a1d221b..9de269d0 100644
--- a/packages/frontend/src/services/auth-redirects.ts
+++ b/packages/frontend/src/services/auth-redirects.ts
@@ -1,6 +1,5 @@
 type SearchParams = Record<string, string | string[] | undefined>;
 
-const UPGRADE_PATH = '/upgrade';
 const HOME_PATH = '/';
 
 function firstParam(value: string | string[] | undefined): string | undefined {
@@ -40,7 +39,7 @@ export function getAuthDestination(searchParams: SearchParams, rawSearch = ''):
   if (oauthDestination) return oauthDestination;
   const redirect = firstParam(searchParams.redirect);
   if (isSafeInternalRedirect(redirect)) return redirect;
-  return firstParam(searchParams.plan) === 'pro' ? UPGRADE_PATH : HOME_PATH;
+  return HOME_PATH;
 }
 
 export function buildLoginRedirect(pathname: string, search = ''): string {
@@ -73,9 +72,6 @@ export function buildSocialAuthUrls(
   if (isSafeInternalRedirect(redirect)) {
     errorParams.set('redirect', redirect);
   }
-  if (firstParam(searchParams.plan) === 'pro') {
-    errorParams.set('plan', 'pro');
-  }
   // Better Auth appends the actual `error` code to this URL. Keep our fallback
   // marker separate so the callback does not contain two `error` parameters.
   errorParams.set('oauth', 'failed');
diff --git a/packages/frontend/src/services/billing-display.ts b/packages/frontend/src/services/billing-display.ts
deleted file mode 100644
index f2ed335b..00000000
--- a/packages/frontend/src/services/billing-display.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-import { PLAN_LIMITS, type BillingPrice } from 'manifest-shared';
-
-export const FREE_REQUEST_LIMIT = PLAN_LIMITS.free.requestsPerMonth ?? 0;
-export const FREE_REQUEST_LIMIT_LABEL = FREE_REQUEST_LIMIT.toLocaleString('en-US');
-
-export function formatBillingPrice(price: BillingPrice | null | undefined): string | null {
-  if (price?.amount == null || !price.currency) return null;
-  const wholeAmount = Number.isInteger(price.amount);
-  try {
-    return new Intl.NumberFormat(undefined, {
-      style: 'currency',
-      currency: price.currency,
-      minimumFractionDigits: wholeAmount ? 0 : undefined,
-      maximumFractionDigits: wholeAmount ? 0 : undefined,
-    }).format(price.amount);
-  } catch {
-    return `${price.amount.toLocaleString(undefined)} ${price.currency}`;
-  }
-}
-
-export function billingIntervalSuffix(price: BillingPrice | null | undefined): string {
-  if (!price?.interval) return '';
-  return price.interval === 'month' ? '/mo' : `/${price.interval}`;
-}
-
-export function formatBillingPriceWithInterval(
-  price: BillingPrice | null | undefined,
-): string | null {
-  const formatted = formatBillingPrice(price);
-  return formatted ? `${formatted}${billingIntervalSuffix(price)}` : null;
-}
diff --git a/packages/frontend/src/services/discovery.ts b/packages/frontend/src/services/discovery.ts
index 1dbd6425..43f33401 100644
--- a/packages/frontend/src/services/discovery.ts
+++ b/packages/frontend/src/services/discovery.ts
@@ -83,35 +83,6 @@ export function getDiscoveryPendingNext(userId: string): string | null {
   }
 }
 
-/**
- * Cache-free probe used before dropping the pending marker: only a positive
- * "this deployment is not self-hosted" answer counts. A transient failure
- * returns false so a real self-hosted signup never loses the one-time form.
- */
-export async function isConfirmedNotSelfHosted(): Promise<boolean> {
-  try {
-    const res = await fetch('/api/v1/setup/status', {
-      credentials: 'include',
-      cache: 'no-store',
-    });
-    if (!res.ok) return false;
-    const data = (await res.json()) as { isSelfHosted?: boolean };
-    return data.isSelfHosted === false;
-  } catch {
-    return false;
-  }
-}
-
-/** Drop the pending marker without recording completion. */
-export function clearDiscoveryPending(userId: string): void {
-  if (!userId) return;
-  try {
-    localStorage.removeItem(`${PENDING_PREFIX}${userId}`);
-  } catch {
-    /* storage unavailable */
-  }
-}
-
 export function hasDiscoveryBeenDoneLocally(userId: string): boolean {
   try {
     return localStorage.getItem(`${PREFIX}${userId}`) === '1';
diff --git a/packages/frontend/src/services/dither-ground.ts b/packages/frontend/src/services/dither-ground.ts
deleted file mode 100644
index 83f7f143..00000000
--- a/packages/frontend/src/services/dither-ground.ts
+++ /dev/null
@@ -1,169 +0,0 @@
-/**
- * The dithered ground of the API Bot promotions, ported from the API Bot
- * website (scout-website/src/dither.js): the near-black ground, clean at the
- * top centre, then square pixels that grow denser toward the sides and the
- * floor, in the ordered dithering of the Bayer 8x8 matrix. Two colours only,
- * drawn on a canvas of one pixel per cell and stretched with
- * image-rendering: pixelated, so every pixel stays crisp.
- *
- * The ground is API Bot's own, so it is the same in both dashboard themes.
- * Two slow waves bend it like grass in a breeze while it is on screen; it
- * stays still for readers who ask for reduced motion.
- */
-
-export const BAYER = [
-  [0, 32, 8, 40, 2, 34, 10, 42],
-  [48, 16, 56, 24, 50, 18, 58, 26],
-  [12, 44, 4, 36, 14, 46, 6, 38],
-  [60, 28, 52, 20, 62, 30, 54, 22],
-  [3, 35, 11, 43, 1, 33, 9, 41],
-  [51, 19, 59, 27, 49, 17, 57, 25],
-  [15, 47, 7, 39, 13, 45, 5, 37],
-  [63, 31, 55, 23, 61, 29, 53, 21],
-];
-
-export const DITHER = {
-  pixel: 3,
-  reach: 0.55,
-  fall: 1.12,
-  max: 0.75,
-  curve: 1.4,
-  light: 0.5,
-  floor: 1.05,
-  lift: 0.78,
-};
-
-export const WIND = { across: 0.035, rise: 0.025, speed: 0.55, fps: 20 };
-
-/** API Bot's ground (#0b0f0d) and its green (#22c574) laid over it at 35%. */
-export const GROUND_PAPER: [number, number, number] = [11, 15, 13];
-export const GROUND_INK: [number, number, number] = [34, 197, 116];
-export const GROUND_SHARE = 0.35;
-
-export function threshold(x: number, y: number): number {
-  return (BAYER[y % 8]![x % 8]! + 0.5) / 64;
-}
-
-export function smoothstep(a: number, b: number, t: number): number {
-  const k = Math.max(0, Math.min(1, (t - a) / (b - a)));
-  return k * k * (3 - 2 * k);
-}
-
-/** Density at u (0 to 1 across) and t (0 at the top, 1 at the floor). */
-export function density(u: number, t: number): number {
-  const across =
-    (Math.abs(u - DITHER.light) / DITHER.light) * (DITHER.lift + (1 - DITHER.lift) * t);
-  const d = Math.hypot(across, t * DITHER.floor);
-  return DITHER.max * Math.pow(smoothstep(DITHER.reach, DITHER.fall, d), DITHER.curve);
-}
-
-/** The density bent by the wind; `time` is in seconds, 0 is the still ground. */
-export function windy(u: number, t: number, time: number): number {
-  const w = time * WIND.speed;
-  const du =
-    WIND.across * Math.sin(t * 9 + w * 2.1) + WIND.across * 0.5 * Math.sin(t * 17 - w * 1.3);
-  const dt = WIND.rise * Math.sin(u * 7 - w * 1.7) * (0.4 + t);
-  return density(u + du, t + dt);
-}
-
-export function mix(
-  ink: [number, number, number],
-  paper: [number, number, number],
-  share: number,
-): [number, number, number] {
-  return ink.map((c, i) => Math.round(c * share + paper[i]! * (1 - share))) as [
-    number,
-    number,
-    number,
-  ];
-}
-
-/**
- * Draws the ground on `canvas`, sized to its parent, and keeps it in step with
- * resizes, visibility and the reduced-motion setting. Returns the cleanup.
- */
-export function mountDither(canvas: HTMLCanvasElement): () => void {
-  const ctx = canvas.getContext('2d');
-  const ground = canvas.parentElement;
-  if (!ctx || !ground) return () => {};
-
-  const still =
-    typeof window.matchMedia === 'function'
-      ? window.matchMedia('(prefers-reduced-motion: reduce)')
-      : null;
-  const dot = mix(GROUND_INK, GROUND_PAPER, GROUND_SHARE);
-  const P = DITHER.pixel;
-  let cols = 0;
-  let rows = 0;
-  let image: ImageData | null = null;
-
-  const measure = (): boolean => {
-    cols = Math.ceil(ground.clientWidth / P);
-    rows = Math.ceil(ground.clientHeight / P);
-    if (!cols || !rows) return false;
-    canvas.width = cols;
-    canvas.height = rows;
-    canvas.style.width = `${cols * P}px`;
-    canvas.style.height = `${rows * P}px`;
-    image = ctx.createImageData(cols, rows);
-    return true;
-  };
-
-  const draw = (time: number) => {
-    if (!image) return;
-    const data = image.data;
-    data.fill(0);
-    for (let y = 0; y < rows; y++) {
-      const t = rows > 1 ? y / (rows - 1) : 0;
-      for (let x = 0; x < cols; x++) {
-        const u = cols > 1 ? x / (cols - 1) : 0.5;
-        if (windy(u, t, time) <= threshold(x, y)) continue;
-        const i = (y * cols + x) * 4;
-        data[i] = dot[0];
-        data[i + 1] = dot[1];
-        data[i + 2] = dot[2];
-        data[i + 3] = 255;
-      }
-    }
-    ctx.putImageData(image, 0, 0);
-  };
-
-  // the wind blows only while the ground is on screen and motion is welcome
-  let visible = true;
-  let frame = 0;
-  let last = 0;
-  const tick = (now: number) => {
-    frame = requestAnimationFrame(tick);
-    if (now - last < 1000 / WIND.fps) return;
-    last = now;
-    draw(now / 1000);
-  };
-  const play = () => {
-    cancelAnimationFrame(frame);
-    if (visible && !still?.matches) frame = requestAnimationFrame(tick);
-    else draw(0);
-  };
-  const refresh = () => {
-    if (measure()) play();
-  };
-
-  refresh();
-  const resize = typeof ResizeObserver === 'function' ? new ResizeObserver(refresh) : null;
-  resize?.observe(ground);
-  const view =
-    typeof IntersectionObserver === 'function'
-      ? new IntersectionObserver((entries) => {
-          visible = entries[0]!.isIntersecting;
-          play();
-        })
-      : null;
-  view?.observe(ground);
-  still?.addEventListener?.('change', play);
-
-  return () => {
-    cancelAnimationFrame(frame);
-    resize?.disconnect();
-    view?.disconnect();
-    still?.removeEventListener?.('change', play);
-  };
-}
diff --git a/packages/frontend/src/services/formatters.ts b/packages/frontend/src/services/formatters.ts
index c16efcf1..65fe0b21 100644
--- a/packages/frontend/src/services/formatters.ts
+++ b/packages/frontend/src/services/formatters.ts
@@ -125,7 +125,6 @@ const ERROR_CLASS_LABELS: Record<string, string> = {
   no_provider_key: 'Missing API key',
   subscription_credentials_unusable: 'Subscription credentials',
   limit_exceeded: 'Limit exceeded',
-  plan_request_limit_exceeded: 'Plan request limit',
   internal: 'Internal error',
 };
 
diff --git a/packages/frontend/src/services/install-endpoints.ts b/packages/frontend/src/services/install-endpoints.ts
index 9004546b..1853e28a 100644
--- a/packages/frontend/src/services/install-endpoints.ts
+++ b/packages/frontend/src/services/install-endpoints.ts
@@ -1,22 +1,15 @@
 /**
  * Endpoints derived from the origin this dashboard is served from.
  *
- * The dashboard and API ship as one service. Cloud has two working domains,
- * but new setup instructions use app.manifest.build. Self-hosted installs use
- * the browser origin.
+ * The dashboard and API ship as one service, so the browser origin is the
+ * install's own address.
  *
  * Under the Vite dev server the dashboard runs on its own port, so these read as
  * the dev server's origin rather than the backend's. That is a dev-only artifact
  * and matches the behaviour of the snippets mentioned above.
  */
-export function setupOrigin(origin: string): string {
-  return origin === 'https://app.manifest.build' || origin === 'https://gateway.manifest.build'
-    ? 'https://app.manifest.build'
-    : origin;
-}
-
 export function installOrigin(): string {
-  return setupOrigin(window.location.origin);
+  return window.location.origin;
 }
 
 /** Where an MCP client should be pointed. */
diff --git a/packages/frontend/src/services/message-error-taxonomy.ts b/packages/frontend/src/services/message-error-taxonomy.ts
deleted file mode 100644
index e3987612..00000000
--- a/packages/frontend/src/services/message-error-taxonomy.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-export interface MessageErrorTaxonomySignals {
-  error_origin?: string | null;
-  error_class?: string | null;
-  error_http_status?: number | null;
-  routing_reason?: string | null;
-}
-
-export function isPlanRequestLimitMessage(message: MessageErrorTaxonomySignals): boolean {
-  if (message.error_origin !== 'policy' || message.error_http_status !== 402) return false;
-  return (
-    message.error_class === 'plan_request_limit_exceeded' ||
-    message.routing_reason === 'plan_request_limit_exceeded' ||
-    message.error_class === 'limit_exceeded'
-  );
-}
diff --git a/packages/frontend/src/services/plan-range-lock.ts b/packages/frontend/src/services/plan-range-lock.ts
deleted file mode 100644
index 9e1262d6..00000000
--- a/packages/frontend/src/services/plan-range-lock.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-import { createMemo, type Accessor } from 'solid-js';
-import { isFreePlan } from './plan-store.js';
-
-export interface PlanRangeLock<T extends string> {
-  /** True for a Free cloud tenant (synchronous read of the plan store). */
-  isFreePlan: Accessor<boolean>;
-  /** Whether a picker option must be disabled. */
-  isProRangeLocked: (value: string) => boolean;
-  /** The range to fetch with: the selection, clamped while PRO ranges are locked. */
-  effectiveRange: Accessor<T>;
-}
-
-/**
- * Shared plan-based range lock for the Overview / Global Overview / Requests
- * dashboards: PRO ranges are Free-tenant-locked and clamp to the fallback.
- *
- * The plan comes from the plan store, which AuthGuard resolves before any
- * page renders — so the lock is synchronous, `effectiveRange` is stable from
- * first paint, and every range-keyed resource fetches exactly once at the
- * right range. No billing fetch, no loading state, nothing to flicker.
- */
-export function usePlanRangeLock<T extends string>(
-  range: Accessor<T>,
-  proRanges: ReadonlySet<string>,
-  fallback: T,
-): PlanRangeLock<T> {
-  const isProRangeLocked = (value: string) => isFreePlan() && proRanges.has(value);
-  const effectiveRange = createMemo(() => (isProRangeLocked(range()) ? fallback : range()));
-  return { isFreePlan, isProRangeLocked, effectiveRange };
-}
diff --git a/packages/frontend/src/services/plan-selection.ts b/packages/frontend/src/services/plan-selection.ts
deleted file mode 100644
index 9cef1a26..00000000
--- a/packages/frontend/src/services/plan-selection.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-const PREFIX = 'manifest_plan_chosen_';
-
-export function markPlanChosen(userId: string): void {
-  try {
-    localStorage.setItem(`${PREFIX}${userId}`, '1');
-  } catch {
-    /* storage full or unavailable */
-  }
-}
-
-export function hasPlanBeenChosen(userId: string): boolean {
-  try {
-    return localStorage.getItem(`${PREFIX}${userId}`) === '1';
-  } catch {
-    return false;
-  }
-}
-
-export function clearPlanChosen(userId: string): void {
-  try {
-    localStorage.removeItem(`${PREFIX}${userId}`);
-  } catch {
-    /* noop */
-  }
-}
diff --git a/packages/frontend/src/services/plan-store.ts b/packages/frontend/src/services/plan-store.ts
deleted file mode 100644
index 28e2b26c..00000000
--- a/packages/frontend/src/services/plan-store.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-import { createSignal } from 'solid-js';
-import { getBillingPlan, type BillingPlanStatus } from './api/billing.js';
-
-/**
- * The tenant's billing plan, resolved once per app boot behind AuthGuard and
- * read synchronously everywhere after. Plan is session-scoped data (it only
- * changes on upgrade/downgrade, which round-trips through Stripe checkout and
- * reboots the app), so it rides the bootstrap instead of the live
- * /billing/status endpoint — pages never wait on billing to decide range
- * locks, and nothing can flicker or double-fetch.
- */
-
-/** Fail-open default: on a fetch error the UI behaves as if billing is off. */
-const FAIL_OPEN: BillingPlanStatus = { enabled: false, plan: 'free' };
-
-const [planStatus, setPlanStatus] = createSignal<BillingPlanStatus | null>(null);
-
-let inflight: Promise<BillingPlanStatus> | null = null;
-/** Bumped by every reset so a lookup started before it cannot write back. */
-let generation = 0;
-
-/**
- * Resolve the plan once per boot (deduped). Never rejects — a failed lookup
- * falls open so a billing hiccup can't block the dashboard.
- */
-export function loadPlan(): Promise<BillingPlanStatus> {
-  const current = planStatus();
-  if (current) return Promise.resolve(current);
-  if (inflight) return inflight;
-  // Only a real answer is remembered, and only by the lookup that still owns
-  // the store: a failed lookup (a 401 from a probe that fired before sign-in,
-  // a billing hiccup) falls open for this caller but is retried by the next
-  // one, and a lookup that was outlived by a reset neither writes its stale
-  // answer nor clears the slot the replacement lookup now holds.
-  const owner = generation;
-  const request: Promise<BillingPlanStatus> = getBillingPlan()
-    .then((status) => {
-      if (generation === owner) setPlanStatus(status);
-      return status;
-    })
-    .catch(() => FAIL_OPEN)
-    .finally(() => {
-      if (inflight === request) inflight = null;
-    });
-  inflight = request;
-  return request;
-}
-
-/**
- * True for a Free cloud tenant. Synchronous: AuthGuard awaits {@link loadPlan}
- * before rendering any page, so by the time a consumer runs this is settled.
- * (Reactive anyway, so a late resolution still propagates.)
- */
-export const isFreePlan = (): boolean => {
-  const status = planStatus();
-  return !!status && status.enabled && status.plan === 'free';
-};
-
-export { planStatus };
-
-/** Reset the store (tests, or forcing a re-resolve after a plan change). */
-export function resetPlanStore(next: BillingPlanStatus | null = null): void {
-  setPlanStatus(next);
-  inflight = null;
-  generation += 1;
-}
diff --git a/packages/frontend/src/services/provider-api-key-urls.ts b/packages/frontend/src/services/provider-api-key-urls.ts
index 57eba738..40cb5ce9 100644
--- a/packages/frontend/src/services/provider-api-key-urls.ts
+++ b/packages/frontend/src/services/provider-api-key-urls.ts
@@ -1,7 +1,3 @@
-import { SHARED_PROVIDER_BY_ID } from 'manifest-shared';
-
-const MANAGED_FREE_PROVIDER_API_KEY_URL = 'https://calendly.com/sebastien-manifest/30min';
-
 export const ROUTING_PROVIDER_API_KEY_URLS: Record<string, string> = {
   anthropic: 'https://console.anthropic.com/settings/keys',
   bedrock: 'https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-generate.html',
@@ -32,13 +28,8 @@ export const ROUTING_PROVIDER_API_KEY_URLS: Record<string, string> = {
   zai: 'https://z.ai/manage-apikey/apikey-list',
 };
 
-export const getRoutingProviderApiKeyUrl = (providerId: string): string | undefined => {
-  const configuredUrl = ROUTING_PROVIDER_API_KEY_URLS[providerId];
-  if (configuredUrl) return configuredUrl;
-  return SHARED_PROVIDER_BY_ID.get(providerId)?.managedFree
-    ? MANAGED_FREE_PROVIDER_API_KEY_URL
-    : undefined;
-};
+export const getRoutingProviderApiKeyUrl = (providerId: string): string | undefined =>
+  ROUTING_PROVIDER_API_KEY_URLS[providerId];
 
 /**
  * Where to obtain a subscription token for each subscription-tab provider.
diff --git a/packages/frontend/src/services/providers.ts b/packages/frontend/src/services/providers.ts
index 363655d8..19a1d398 100644
--- a/packages/frontend/src/services/providers.ts
+++ b/packages/frontend/src/services/providers.ts
@@ -285,11 +285,6 @@ const PROVIDER_UI: Record<string, ProviderUIOverlay> = {
       'Google no longer allows new Gemini sign-ins from apps outside Google. Existing connections keep working. To add Gemini, connect a Gemini API key under Usage-based providers.',
     models: [],
   },
-  'gemini-free': {
-    initial: 'GF',
-    subtitle: 'Free Gemini models via Manifest',
-    models: [],
-  },
   kiro: {
     initial: 'K',
     subtitle: 'Claude, DeepSeek, MiniMax, GLM, Qwen via Kiro',
@@ -527,7 +522,6 @@ const PROVIDER_ORDER = [
   'commandcode',
   'deepseek',
   'fireworks',
-  'gemini-free',
   'copilot',
   'gemini',
   'vertex',
diff --git a/packages/frontend/src/services/setup-status.ts b/packages/frontend/src/services/setup-status.ts
index 96db0dc6..a8ce8ee8 100644
--- a/packages/frontend/src/services/setup-status.ts
+++ b/packages/frontend/src/services/setup-status.ts
@@ -6,7 +6,6 @@
 interface SetupStatusResponse {
   needsSetup: boolean;
   socialProviders?: string[];
-  isSelfHosted?: boolean;
   ollamaAvailable?: boolean;
   localLlmHost?: string;
   emailConfigured?: boolean;
@@ -16,7 +15,6 @@ interface SetupStatusResponse {
 interface SetupStatusResult {
   needsSetup: boolean;
   socialProviders: string[];
-  isSelfHosted: boolean;
   ollamaAvailable: boolean;
   localLlmHost: string;
   emailConfigured: boolean;
@@ -35,7 +33,6 @@ async function fetchSetupStatus(): Promise<SetupStatusResult> {
       return {
         needsSetup: false,
         socialProviders: [],
-        isSelfHosted: false,
         ollamaAvailable: false,
         localLlmHost: 'localhost',
         emailConfigured: true,
@@ -45,7 +42,6 @@ async function fetchSetupStatus(): Promise<SetupStatusResult> {
     return {
       needsSetup: data.needsSetup === true,
       socialProviders: data.socialProviders ?? [],
-      isSelfHosted: data.isSelfHosted === true,
       ollamaAvailable: data.ollamaAvailable === true,
       localLlmHost: data.localLlmHost || 'localhost',
       // Assume available unless the backend explicitly says otherwise, so a
@@ -58,7 +54,6 @@ async function fetchSetupStatus(): Promise<SetupStatusResult> {
     return {
       needsSetup: false,
       socialProviders: [],
-      isSelfHosted: false,
       ollamaAvailable: false,
       localLlmHost: 'localhost',
       emailConfigured: true,
@@ -82,10 +77,6 @@ export async function checkSocialProviders(): Promise<string[]> {
   return (await getSetupStatus()).socialProviders;
 }
 
-export async function checkIsSelfHosted(): Promise<boolean> {
-  return (await getSetupStatus()).isSelfHosted;
-}
-
 export async function checkIsOllamaAvailable(): Promise<boolean> {
   return (await getSetupStatus()).ollamaAvailable;
 }
diff --git a/packages/frontend/src/styles/agents.css b/packages/frontend/src/styles/agents.css
index 102d2913..5f46b22c 100644
--- a/packages/frontend/src/styles/agents.css
+++ b/packages/frontend/src/styles/agents.css
@@ -160,10 +160,6 @@
   padding: var(--gap-xl) var(--gap-lg);
 }
 
-.account-modal__inner--upgrade {
-  max-width: 1080px;
-}
-
 .account-back-btn {
   display: inline-flex;
   align-items: center;
@@ -313,75 +309,6 @@
   }
 }
 
-/* Billing: three stats on one line, divided, with the action in the footer. */
-.billing-stats {
-  display: flex;
-  align-items: stretch;
-}
-
-.billing-stat {
-  flex: 1;
-  min-width: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 4px;
-  padding: var(--gap-lg);
-  border-right: 1px solid hsl(var(--border));
-}
-
-.billing-stat:last-child {
-  border-right: none;
-}
-
-.billing-stat__label {
-  font-size: var(--font-size-xs);
-  color: hsl(var(--muted-foreground));
-}
-
-.billing-stat__value {
-  font-size: var(--font-size-md, 1rem);
-  font-weight: 600;
-  color: hsl(var(--foreground));
-}
-
-.billing-stat__meta {
-  font-size: var(--font-size-xs);
-  color: hsl(var(--muted-foreground));
-}
-
-.billing-footer {
-  justify-content: space-between;
-  align-items: center;
-  gap: var(--gap-md);
-  padding: var(--gap-md) var(--gap-lg);
-  border-top: 1px solid hsl(var(--border));
-}
-
-.billing-footer__note {
-  flex: 1;
-  min-width: 0;
-  font-size: var(--font-size-xs);
-  color: hsl(var(--muted-foreground));
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.billing-footer .btn {
-  flex-shrink: 0;
-}
-
-.account-email-toggle--disabled {
-  cursor: wait;
-  opacity: 0.65;
-}
-
-.account-email-footer {
-  justify-content: flex-start;
-  font-size: var(--font-size-xs);
-  color: hsl(var(--muted-foreground));
-}
-
 .account-security-footer {
   justify-content: space-between;
   align-items: center;
@@ -393,308 +320,6 @@
   color: hsl(var(--destructive));
 }
 
-@media (max-width: 640px) {
-  .billing-stats {
-    flex-direction: column;
-  }
-  .billing-stat {
-    border-right: none;
-    border-bottom: 1px solid hsl(var(--border));
-  }
-  .billing-stat:last-child {
-    border-bottom: none;
-  }
-}
-
-.upgrade-page-header {
-  border-bottom: none;
-  padding-bottom: var(--gap-xl);
-}
-
-.upgrade-page-header__copy {
-  max-width: 680px;
-}
-
-.upgrade-limit-notice {
-  text-align: center;
-  font-size: var(--font-size-sm);
-  color: hsl(var(--muted-foreground));
-  margin-bottom: var(--gap-lg);
-}
-
-.upgrade-page-header--centered {
-  display: block;
-  text-align: center;
-  margin-top: var(--gap-2xl);
-}
-
-.upgrade-page-header--centered .upgrade-page-header__copy {
-  max-width: 100%;
-  margin: 0 auto;
-}
-
-.upgrade-page-header__copy p {
-  margin: var(--gap-sm) 0 0;
-  color: hsl(var(--muted-foreground));
-  font-size: var(--font-size-sm);
-  line-height: 1.6;
-}
-
-.upgrade-plan-grid {
-  display: grid;
-  grid-template-columns: repeat(3, minmax(0, 1fr));
-  column-gap: var(--gap-lg);
-  row-gap: 0;
-}
-
-.upgrade-plan-card {
-  position: relative;
-  display: grid;
-  grid-template-rows: subgrid;
-  grid-row: span 5;
-  padding: var(--gap-lg);
-  margin-bottom: 0;
-}
-
-.upgrade-plan-card--pro {
-  border-color: hsl(var(--border));
-  overflow: hidden;
-}
-
-.upgrade-plan-card--pro::before {
-  content: '';
-  position: absolute;
-  top: -40px;
-  left: -10%;
-  right: -10%;
-  height: 120px;
-  background:
-    radial-gradient(ellipse at 20% 0%, rgba(44, 224, 183, 0.25) 0%, transparent 50%),
-    radial-gradient(ellipse at 50% 0%, rgba(38, 50, 239, 0.2) 0%, transparent 50%),
-    radial-gradient(ellipse at 80% 0%, rgba(254, 7, 110, 0.2) 0%, transparent 50%);
-  filter: blur(30px);
-  pointer-events: none;
-  z-index: 0;
-}
-
-.upgrade-plan-card--pro > * {
-  position: relative;
-  z-index: 1;
-}
-
-.upgrade-plan-card__badge {
-  position: absolute;
-  top: var(--gap-md);
-  right: var(--gap-md);
-  padding: 3px 5px;
-  border-radius: 2px;
-  background: #2632ef;
-  color: #ffffff;
-  font-size: 9px;
-  font-weight: 600;
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-}
-
-.upgrade-plan-card__body {
-  display: contents;
-}
-
-.upgrade-plan-card__header h2 {
-  margin: 0;
-  color: hsl(var(--foreground));
-  font-size: var(--font-size-base);
-  font-weight: 600;
-}
-
-.upgrade-plan-card__price {
-  display: flex;
-  align-items: baseline;
-  gap: 4px;
-  min-height: 42px;
-  margin-top: var(--gap-md);
-}
-
-.upgrade-plan-card__amount {
-  color: hsl(var(--foreground));
-  font-size: 2rem;
-  font-family: 'Bricolage Grotesque', var(--font-family);
-  font-weight: 650;
-  letter-spacing: 0;
-  line-height: 1;
-}
-
-.upgrade-plan-card__amount--custom {
-  font-size: 2rem;
-}
-
-.upgrade-plan-card__period {
-  color: hsl(var(--muted-foreground));
-  font-size: var(--font-size-sm);
-}
-
-.upgrade-plan-card__desc {
-  margin: var(--gap-md) 0 0;
-  color: hsl(var(--muted-foreground));
-  font-size: var(--font-size-sm);
-  line-height: 1.5;
-}
-
-.upgrade-plan-card__usage {
-  margin: var(--gap-sm) 0 0;
-  color: hsl(var(--foreground));
-  font-size: var(--font-size-xs);
-  font-weight: 500;
-}
-
-.upgrade-plan-card__cta {
-  margin-top: var(--gap-lg);
-}
-
-.upgrade-plan-card__cta .btn {
-  width: 100%;
-  text-decoration: none;
-}
-
-.upgrade-plan-card__no-commitment {
-  display: block;
-  text-align: center;
-  margin-top: var(--gap-sm);
-  font-size: var(--font-size-xs);
-  color: hsl(var(--muted-foreground));
-}
-
-.upgrade-plan-card__divider {
-  height: 1px;
-  background: hsl(var(--border));
-  margin: var(--gap-sm) 0 var(--gap-lg) 0;
-}
-
-.upgrade-plan-card__features-intro {
-  margin: 0;
-  color: hsl(var(--muted-foreground));
-  font-size: var(--font-size-sm);
-  line-height: 1.5;
-}
-
-.upgrade-plan-card__features {
-  display: flex;
-  flex-direction: column;
-  gap: 10px;
-  margin: var(--gap-sm) 0 0;
-  padding: 0;
-  list-style: none;
-}
-
-.upgrade-plan-card__features li {
-  display: flex;
-  align-items: flex-start;
-  gap: 8px;
-  min-width: 0;
-  color: hsl(var(--foreground));
-  font-size: var(--font-size-sm);
-  line-height: 1.45;
-}
-
-.upgrade-plan-card__features i,
-.upgrade-plan-card__features svg {
-  flex: 0 0 auto;
-  margin-top: 1px;
-}
-
-.upgrade-plan-card__footer {
-  justify-content: stretch;
-  padding: var(--gap-md) var(--gap-lg);
-  border-top: 1px solid hsl(var(--border));
-}
-
-.upgrade-plan-card__footer .btn {
-  width: 100%;
-}
-
-.upgrade-pro-current {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-}
-
-.upgrade-pro-current__status {
-  text-align: center;
-  margin-bottom: var(--gap-lg);
-  color: hsl(var(--muted-foreground));
-  font-size: var(--font-size-sm);
-  line-height: 1.5;
-}
-
-.upgrade-pro-current__status:first-of-type {
-  margin-bottom: var(--gap-sm);
-}
-
-.upgrade-pro-current__card {
-  width: 100%;
-  max-width: 400px;
-}
-
-.billing-stat__cancel {
-  color: hsl(var(--destructive));
-  font-size: var(--font-size-xs);
-  margin-top: 2px;
-}
-
-.billing-footer__actions {
-  display: flex;
-  gap: var(--gap-sm);
-}
-
-.billing-footer__link {
-  color: hsl(var(--foreground));
-  font-weight: 500;
-  text-decoration: underline;
-  text-underline-offset: 2px;
-}
-
-.upgrade-back {
-  display: inline-flex;
-  align-items: center;
-  gap: 4px;
-  padding: 0;
-  background: none;
-  border: none;
-  color: hsl(var(--muted-foreground));
-  font-size: var(--font-size-sm);
-  font-family: var(--font-family);
-  font-weight: 500;
-  cursor: pointer;
-  transition: color var(--transition-fast);
-}
-
-.upgrade-back:hover {
-  color: hsl(var(--foreground));
-}
-
-.upgrade-terms {
-  text-align: center;
-  margin-top: var(--gap-lg);
-  font-size: var(--font-size-xs);
-  color: hsl(var(--muted-foreground));
-}
-
-.upgrade-terms a {
-  color: hsl(var(--muted-foreground));
-  text-decoration: underline;
-  text-underline-offset: 2px;
-}
-
-.upgrade-terms a:hover {
-  color: hsl(var(--foreground));
-}
-
-@media (max-width: 920px) {
-  .upgrade-plan-grid {
-    grid-template-columns: 1fr;
-  }
-}
-
 .settings-card__body {
   padding: var(--gap-md) var(--gap-lg);
 }
diff --git a/packages/frontend/src/styles/api-bot.css b/packages/frontend/src/styles/api-bot.css
deleted file mode 100644
index 57417c54..00000000
--- a/packages/frontend/src/styles/api-bot.css
+++ /dev/null
@@ -1,195 +0,0 @@
-/* ── API Bot promotions (ApiBotBanner.tsx, ApiBotAnnouncement.tsx) ─────
-   API Bot's own look, the same in both dashboard themes: the near-black
-   ground of the API Bot website with its dithered green pixels
-   (services/dither-ground.ts), light text, and the green button with hard
-   bands and stepped corners. */
-
-.api-bot-banner,
-.sidebar-api-bot {
-  --api-bot-ground: #0b0f0d;
-  --api-bot-text: #ffffff;
-  --api-bot-muted: #ffffff;
-  /* a halo of the ground around the letters lifts them off the pixels */
-  --api-bot-halo: 0 0 4px #0b0f0d, 0 0 8px #0b0f0d;
-  --api-bot-pixel: 3px;
-  position: relative;
-  isolation: isolate;
-  overflow: hidden;
-  background: var(--api-bot-ground);
-  color: var(--api-bot-text);
-}
-
-.dither-ground {
-  position: absolute;
-  inset: 0;
-  z-index: -1;
-  image-rendering: pixelated;
-  pointer-events: none;
-}
-
-/* the button of the API Bot website: the left of a strip twice its width, a
-   hover glides it to the lighter right */
-.api-bot-btn {
-  flex-shrink: 0;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  padding: 5px 12px;
-  background-image: linear-gradient(
-    115deg,
-    #16a35d 0 14%,
-    #1cb467 14% 28%,
-    #22c574 28% 42%,
-    #22c574 42% 56%,
-    #3fd187 56% 70%,
-    #5edc9b 70% 85%,
-    #86efba 85% 100%
-  );
-  background-size: 200% 100%;
-  background-position: 0% 0;
-  color: var(--api-bot-ground);
-  font-family: var(--font-family);
-  font-size: var(--font-size-sm);
-  font-weight: 600;
-  text-decoration: none;
-  clip-path: polygon(
-    0 var(--api-bot-pixel),
-    var(--api-bot-pixel) var(--api-bot-pixel),
-    var(--api-bot-pixel) 0,
-    calc(100% - var(--api-bot-pixel)) 0,
-    calc(100% - var(--api-bot-pixel)) var(--api-bot-pixel),
-    100% var(--api-bot-pixel),
-    100% calc(100% - var(--api-bot-pixel)),
-    calc(100% - var(--api-bot-pixel)) calc(100% - var(--api-bot-pixel)),
-    calc(100% - var(--api-bot-pixel)) 100%,
-    var(--api-bot-pixel) 100%,
-    var(--api-bot-pixel) calc(100% - var(--api-bot-pixel)),
-    0 calc(100% - var(--api-bot-pixel))
-  );
-  transition: background-position 0.5s cubic-bezier(0.22, 1, 0.36, 1);
-}
-
-.api-bot-btn:hover {
-  background-position: 100% 0;
-}
-
-.api-bot-btn:focus-visible {
-  outline: 2px solid var(--api-bot-text);
-  outline-offset: 2px;
-}
-
-.api-bot-close {
-  flex-shrink: 0;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  width: 24px;
-  height: 24px;
-  color: var(--api-bot-muted);
-  background: none;
-  border: none;
-  border-radius: var(--radius-sm, 4px);
-  cursor: pointer;
-  transition:
-    color var(--transition-fast),
-    background var(--transition-fast);
-}
-
-.api-bot-close:hover,
-.api-bot-close:focus-visible {
-  color: var(--api-bot-text);
-  background: rgba(244, 246, 243, 0.12);
-}
-
-/* ── Banner, above the page content ── */
-.api-bot-banner {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  gap: 12px;
-  width: fit-content;
-  max-width: 100%;
-  margin: 0 auto var(--gap-lg);
-  padding: 8px 8px 8px 16px;
-  border-radius: var(--radius);
-}
-
-.api-bot-banner__text {
-  font-size: var(--font-size-sm);
-  font-weight: 500;
-  line-height: 1.4;
-  text-shadow: var(--api-bot-halo);
-}
-
-.api-bot-banner__text strong {
-  font-weight: 700;
-}
-
-/* ── Sidebar card ── */
-.sidebar-api-bot {
-  display: flex;
-  flex-direction: column;
-  gap: 8px;
-  margin: var(--gap-sm);
-  padding: 12px;
-  border-radius: var(--radius);
-  cursor: default;
-}
-
-.sidebar-api-bot__close {
-  position: absolute;
-  top: 6px;
-  right: 6px;
-  z-index: 1;
-  width: 22px;
-  height: 22px;
-  color: var(--api-bot-ground);
-  background: #ffffff;
-  border-radius: 999px;
-  box-shadow: 0 1px 4px rgba(0, 0, 0, 0.35);
-}
-
-.sidebar-api-bot__close:hover,
-.sidebar-api-bot__close:focus-visible {
-  color: var(--api-bot-ground);
-  background: #e6ebe7;
-}
-
-.sidebar-api-bot__close:focus-visible {
-  outline: 2px solid #ffffff;
-  outline-offset: 2px;
-}
-
-.sidebar-api-bot__close svg {
-  width: 12px;
-  height: 12px;
-}
-
-.sidebar-api-bot__image {
-  display: block;
-  width: 100%;
-  height: auto;
-  border-radius: calc(var(--radius) - 2px);
-}
-
-.sidebar-api-bot__title {
-  margin-top: 4px;
-  font-size: var(--font-size-md);
-  font-weight: 700;
-  line-height: 1.35;
-  text-shadow: var(--api-bot-halo);
-}
-
-.sidebar-api-bot__text {
-  margin: 0;
-  font-size: var(--font-size-sm);
-  font-weight: 500;
-  line-height: 1.45;
-  color: var(--api-bot-muted);
-  text-shadow: var(--api-bot-halo);
-}
-
-.sidebar-api-bot .api-bot-btn {
-  margin-top: 4px;
-  padding: 8px 12px;
-}
diff --git a/packages/frontend/src/styles/auth.css b/packages/frontend/src/styles/auth.css
index fb0e11fd..13ceb336 100644
--- a/packages/frontend/src/styles/auth.css
+++ b/packages/frontend/src/styles/auth.css
@@ -353,182 +353,6 @@
   text-decoration: underline;
 }
 
-/* ── Plan Picker (accordion in auth card) ────────── */
-.plan-picker {
-  display: flex;
-  flex-direction: column;
-  gap: var(--gap-sm);
-  margin-bottom: var(--gap-lg);
-}
-
-.plan-picker__card {
-  display: flex;
-  flex-direction: column;
-  width: 100%;
-  padding: var(--gap-md);
-  background: hsl(var(--background));
-  border: 1px solid hsl(var(--input));
-  border-radius: var(--radius);
-  cursor: pointer;
-  text-align: left;
-  font-family: var(--font-family);
-  transition:
-    border-color var(--transition-fast),
-    box-shadow var(--transition-fast);
-}
-
-.plan-picker__card:hover {
-  border-color: hsl(var(--foreground) / 0.25);
-}
-
-.plan-picker__card--expanded {
-  border-color: hsl(var(--foreground));
-}
-
-.plan-picker__card--pro.plan-picker__card--expanded {
-  border-color: hsl(var(--foreground));
-}
-
-.plan-picker__row {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: var(--gap-sm);
-}
-
-.plan-picker__name {
-  display: flex;
-  align-items: center;
-  gap: var(--gap-sm);
-  font-size: var(--font-size-sm);
-  font-weight: 600;
-  color: hsl(var(--foreground));
-}
-
-.plan-picker__radio {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  width: 16px;
-  height: 16px;
-  border-radius: 50%;
-  border: 2px solid hsl(var(--input));
-  flex-shrink: 0;
-  transition: border-color var(--transition-fast);
-}
-
-.plan-picker__card--expanded .plan-picker__radio {
-  border-color: hsl(var(--primary));
-}
-
-.plan-picker__radio-dot {
-  width: 8px;
-  height: 8px;
-  border-radius: 50%;
-  background: hsl(var(--primary));
-}
-
-.plan-picker__badge {
-  padding: 3px 5px;
-  border-radius: 2px;
-  background: #2632ef;
-  color: #ffffff;
-  font-size: 9px;
-  font-weight: 600;
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-}
-
-.plan-picker__price-inline {
-  display: flex;
-  align-items: baseline;
-  gap: 2px;
-}
-
-.plan-picker__amount {
-  font-size: var(--font-size-sm);
-  font-weight: 600;
-  color: hsl(var(--foreground));
-}
-
-.plan-picker__period {
-  font-size: var(--font-size-xs);
-  color: hsl(var(--muted-foreground));
-}
-
-.plan-picker__details {
-  margin-top: var(--gap-md);
-  padding-top: var(--gap-md);
-  border-top: 1px solid hsl(var(--border));
-  animation: planDetailsIn 200ms ease-out both;
-}
-
-@keyframes planDetailsIn {
-  from {
-    opacity: 0;
-    transform: translateY(-4px);
-  }
-  to {
-    opacity: 1;
-    transform: translateY(0);
-  }
-}
-
-.plan-picker__usage {
-  margin: 0 0 var(--gap-sm);
-  font-size: var(--font-size-xs);
-  font-weight: 500;
-  color: hsl(var(--foreground));
-}
-
-.plan-picker__features {
-  display: flex;
-  flex-direction: column;
-  gap: 6px;
-  margin: 0;
-  padding: 0;
-  list-style: none;
-}
-
-.plan-picker__features li {
-  display: flex;
-  align-items: flex-start;
-  gap: 6px;
-  color: hsl(var(--foreground));
-  font-size: var(--font-size-xs);
-  line-height: 1.45;
-}
-
-.plan-picker__features i,
-.plan-picker__features svg {
-  flex: 0 0 auto;
-  margin-top: 1px;
-}
-
-.plan-picker__section-header {
-  margin-bottom: var(--gap-md);
-}
-
-.plan-picker__section-title {
-  margin: 0;
-  font-size: var(--font-size-sm);
-  font-weight: 600;
-  color: hsl(var(--foreground));
-}
-
-.plan-picker__section-subtitle {
-  margin: 2px 0 0;
-  font-size: var(--font-size-xs);
-  color: hsl(var(--muted-foreground));
-}
-
-.plan-picker__cta {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  text-decoration: none;
-}
-
 /* ── Auth responsive ─────────────────────────────── */
 @media (max-width: 480px) {
   .auth-card {
diff --git a/packages/frontend/src/styles/controls.css b/packages/frontend/src/styles/controls.css
index 23982ad6..23e1e345 100644
--- a/packages/frontend/src/styles/controls.css
+++ b/packages/frontend/src/styles/controls.css
@@ -306,30 +306,6 @@
   display: block;
 }
 
-.header__mode-badge {
-  display: inline-flex;
-  align-items: center;
-  font-size: 10px;
-  font-weight: 600;
-  text-transform: uppercase;
-  letter-spacing: 0.05em;
-  padding: 4px 7px 3px;
-  border-radius: var(--radius);
-  background: hsl(var(--success) / 0.15);
-  color: hsl(var(--success));
-  /* The header's left group shrinks around the breadcrumb on small screens;
-     the badge must stay one line rather than break "SELF-" / "HOSTED". */
-  white-space: nowrap;
-  flex-shrink: 0;
-  line-height: 1;
-  user-select: none;
-}
-
-.header__mode-badge--dev {
-  background: hsl(25 95% 53% / 0.15);
-  color: hsl(25 95% 53%);
-}
-
 .header__separator {
   color: hsl(var(--muted-foreground));
   font-size: var(--font-size-sm);
@@ -444,16 +420,6 @@
   color: hsl(var(--foreground));
 }
 
-.header__pro-badge {
-  padding: 1px 6px;
-  border-radius: 2px;
-  background: hsl(var(--primary));
-  color: hsl(var(--primary-foreground));
-  font-size: 9px;
-  font-weight: 700;
-  letter-spacing: 0.04em;
-}
-
 .header__dropdown-email {
   display: block;
   font-size: var(--font-size-xs);
@@ -730,102 +696,3 @@
   border: none;
   background: hsl(var(--background));
 }
-
-/* ── GitHub Star Button ──────────────────────────── */
-.header__github-star {
-  position: relative;
-  display: flex;
-  align-items: center;
-}
-
-.header__github-star-btn {
-  display: inline-flex;
-  align-items: stretch;
-  height: 28px;
-  border-radius: 6px;
-  border: 1px solid hsl(var(--border));
-  background: hsl(var(--card));
-  color: hsl(var(--foreground));
-  font-size: var(--font-size-xs);
-  font-weight: 600;
-  font-family: var(--font-family);
-  text-decoration: none;
-  cursor: pointer;
-  transition: all var(--transition-fast);
-  white-space: nowrap;
-  line-height: 1;
-  overflow: hidden;
-}
-
-.header__github-star-btn:hover {
-  border-color: hsl(var(--ring) / 0.3);
-}
-
-.header__github-star-action {
-  display: flex;
-  align-items: center;
-  gap: 6px;
-  padding: 0 10px;
-  background: hsl(var(--muted));
-  transition: background var(--transition-fast);
-}
-
-.header__github-star-btn:hover .header__github-star-action {
-  background: hsl(var(--muted-foreground) / 0.15);
-}
-
-.header__github-icon {
-  flex-shrink: 0;
-}
-
-.header__github-star-label {
-  font-size: var(--font-size-xs);
-  font-weight: 600;
-}
-
-.header__github-star-count {
-  display: flex;
-  align-items: center;
-  padding: 0 10px;
-  font-size: var(--font-size-xs);
-  font-weight: 600;
-  font-variant-numeric: tabular-nums;
-  border-left: 1px solid hsl(var(--border));
-}
-
-.header__github-star-close {
-  position: absolute;
-  top: -6px;
-  right: -6px;
-  width: 16px;
-  height: 16px;
-  border-radius: 50%;
-  border: 1px solid hsl(var(--border));
-  background: hsl(var(--card));
-  color: hsl(var(--muted-foreground));
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  cursor: pointer;
-  opacity: 0;
-  transition: all var(--transition-fast);
-  padding: 0;
-  line-height: 1;
-}
-
-.header__github-star:hover .header__github-star-close {
-  opacity: 1;
-}
-
-.header__github-star-close:hover {
-  background: hsl(var(--destructive));
-  border-color: hsl(var(--destructive));
-  color: white;
-}
-
-.header__star-separator {
-  width: 1px;
-  align-self: stretch;
-  background: hsl(var(--border));
-  margin: 0 8px;
-}
diff --git a/packages/frontend/src/styles/custom-select.css b/packages/frontend/src/styles/custom-select.css
index ffd42973..3a9281c6 100644
--- a/packages/frontend/src/styles/custom-select.css
+++ b/packages/frontend/src/styles/custom-select.css
@@ -149,23 +149,6 @@
   flex-wrap: wrap;
 }
 
-.pro-range-badge {
-  margin-left: auto;
-  padding: 1px 5px;
-  border-radius: 2px;
-  background: hsl(var(--foreground));
-  color: hsl(var(--background));
-  font-size: 9px;
-  font-weight: 700;
-  letter-spacing: 0.04em;
-  text-decoration: none;
-  opacity: 1;
-}
-
-.pro-range-badge:hover {
-  opacity: 0.85;
-}
-
 .custom-select__option--selected {
   background: hsl(var(--accent));
   font-weight: 500;
diff --git a/packages/frontend/src/styles/data.css b/packages/frontend/src/styles/data.css
index 56af31bd..8cfac780 100644
--- a/packages/frontend/src/styles/data.css
+++ b/packages/frontend/src/styles/data.css
@@ -1416,20 +1416,6 @@ table.msg-detail__table td {
   line-height: 1.4;
 }
 
-.error-autofix-row__upgrade {
-  display: flex;
-  align-items: center;
-  gap: var(--gap-sm);
-  margin-top: var(--gap-md);
-  font-size: var(--font-size-xs);
-  color: hsl(var(--foreground));
-}
-
-.error-autofix-row__upgrade .btn {
-  text-decoration: none;
-  flex-shrink: 0;
-}
-
 .msg-detail__fallback-banner {
   font-size: var(--font-size-xs);
   padding: 6px 12px;
@@ -1453,85 +1439,3 @@ table.msg-detail__table td {
   align-items: center;
   gap: 6px;
 }
-
-/* ── Free Models accordion ────────────────────────── */
-.free-models-accordion {
-  display: grid;
-  grid-template-rows: 0fr;
-  opacity: 0;
-  transition:
-    grid-template-rows 300ms ease,
-    opacity 250ms ease;
-}
-
-.free-models-accordion > * {
-  overflow: hidden;
-}
-
-.free-models-accordion--open {
-  grid-template-rows: 1fr;
-  opacity: 1;
-}
-
-.free-models-base-url-row {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-}
-
-.dark .free-models-caret {
-  filter: invert(1);
-}
-
-.free-models-logo-dark {
-  display: none;
-}
-
-.dark .free-models-logo-light {
-  display: none;
-}
-
-.dark .free-models-logo-dark {
-  display: block;
-}
-
-.free-models-disabled-btn {
-  display: inline-flex;
-  align-items: center;
-  position: relative;
-  padding: 6px 16px;
-  font-size: var(--font-size-sm);
-  font-weight: 500;
-  border-radius: var(--radius);
-  border: 1px solid hsl(var(--border));
-  color: hsl(var(--muted-foreground));
-  opacity: 0.5;
-  cursor: not-allowed;
-}
-
-.free-models-disabled-btn::after {
-  content: attr(data-tooltip);
-  position: absolute;
-  bottom: calc(100% + 6px);
-  right: 0;
-  padding: 4px 10px;
-  border-radius: var(--radius);
-  background: hsl(var(--foreground));
-  color: hsl(var(--background));
-  font-size: var(--tooltip-font-size);
-  font-weight: 400;
-  white-space: nowrap;
-  opacity: 0;
-  pointer-events: none;
-  transition: opacity 150ms ease;
-}
-
-.free-models-disabled-btn:hover::after {
-  opacity: 1;
-}
-
-@media (max-width: 640px) {
-  .free-models-base-url-row {
-    flex-wrap: wrap;
-  }
-}
diff --git a/packages/frontend/src/styles/modals.css b/packages/frontend/src/styles/modals.css
index 5e54b3ae..5a050635 100644
--- a/packages/frontend/src/styles/modals.css
+++ b/packages/frontend/src/styles/modals.css
@@ -582,192 +582,6 @@
   min-width: 24px;
 }
 
-/* ── Upgrade Success Modal ────────────────────────── */
-.modal.upgrade-success-modal {
-  max-width: 420px;
-}
-
-.upgrade-success-modal__body {
-  padding: var(--gap-xl);
-}
-
-.upgrade-success-modal__icon {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  width: 40px;
-  height: 40px;
-  margin-bottom: var(--gap-md);
-  background: hsl(230 90% 55% / 0.08);
-  border-radius: 50%;
-}
-
-.upgrade-success-modal__title {
-  margin: 0;
-  font-size: var(--font-size-lg);
-  font-weight: 600;
-  color: hsl(var(--foreground));
-  letter-spacing: -0.025em;
-}
-
-.upgrade-success-modal__subtitle {
-  margin: var(--gap-sm) 0 0;
-  font-size: var(--font-size-sm);
-  color: hsl(var(--muted-foreground));
-  line-height: 1.5;
-}
-
-.upgrade-success-modal__features {
-  display: flex;
-  flex-direction: column;
-  gap: var(--gap-sm);
-  margin: var(--gap-lg) 0;
-  padding: 0;
-  list-style: none;
-  text-align: left;
-}
-
-.upgrade-success-modal__features li {
-  display: flex;
-  align-items: flex-start;
-  gap: 8px;
-  font-size: var(--font-size-sm);
-  color: hsl(var(--foreground));
-  line-height: 1.45;
-}
-
-.upgrade-success-modal__features svg {
-  flex: 0 0 auto;
-  margin-top: 2px;
-}
-
-.upgrade-success-modal__done {
-  width: fit-content;
-  float: right;
-}
-
-.sidebar-usage {
-  margin: 0 var(--gap-md) 10px;
-}
-
-.sidebar-usage__header {
-  display: flex;
-  justify-content: space-between;
-  align-items: baseline;
-  margin-bottom: 2px;
-}
-
-.sidebar-usage__title {
-  font-size: 12px;
-  font-weight: 700;
-  color: hsl(var(--foreground));
-}
-
-.sidebar-usage__month {
-  font-size: 12px;
-  font-weight: 700;
-  color: hsl(var(--foreground));
-}
-
-.sidebar-usage__count {
-  display: block;
-  font-size: 12px;
-  font-weight: 700;
-  color: hsl(var(--foreground));
-  margin-bottom: 6px;
-}
-
-/* ── Global Usage Limit Banner ────────────────────── */
-.usage-limit-banner {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  gap: var(--gap-md);
-  padding: var(--gap-sm) var(--gap-lg);
-  margin: calc(-1 * var(--gap-xl)) calc(-1 * var(--gap-xl)) var(--gap-lg);
-  background: hsl(var(--destructive) / 0.06);
-  border-bottom: 1px solid hsl(var(--destructive) / 0.2);
-  font-size: var(--font-size-xs);
-  color: hsl(var(--destructive));
-}
-
-.usage-limit-banner__text {
-  font-weight: 500;
-}
-
-.usage-limit-banner__actions {
-  display: flex;
-  align-items: center;
-  gap: var(--gap-sm);
-  flex-shrink: 0;
-}
-
-.usage-limit-banner__btn {
-  display: inline-flex;
-  align-items: center;
-  gap: 4px;
-  text-decoration: none;
-  white-space: nowrap;
-}
-
-.sidebar-usage__alert {
-  margin: 6px 0 0;
-  font-size: 11px;
-  font-weight: 500;
-  color: hsl(var(--destructive));
-  line-height: 1.4;
-}
-
-.sidebar-usage__count--danger {
-  color: hsl(var(--destructive));
-}
-
-.sidebar-usage__bar {
-  height: 4px;
-  background: hsl(var(--background));
-  border-radius: 2px;
-  overflow: hidden;
-}
-
-.sidebar-usage__fill {
-  height: 100%;
-  background: hsl(var(--primary));
-  border-radius: 2px;
-  transition: width 300ms ease;
-}
-
-.sidebar-usage__fill--warning {
-  background: hsl(var(--warning));
-}
-
-.sidebar-usage__fill--danger {
-  background: hsl(var(--destructive));
-}
-
-.sidebar-upgrade {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  gap: 6px;
-  margin: 0 var(--gap-md) var(--gap-md);
-  width: calc(100% - var(--gap-md) * 2);
-  padding: 8px 0;
-  font-size: var(--font-size-sm);
-  font-weight: 500;
-  font-family: var(--font-family);
-  color: hsl(var(--foreground));
-  background: hsl(var(--background));
-  border: 1px solid hsl(var(--border));
-  border-radius: var(--radius);
-  cursor: pointer;
-  transition: border-color var(--transition-fast);
-  text-decoration: none;
-}
-
-.sidebar-upgrade:hover {
-  border-color: hsl(var(--foreground) / 0.3);
-}
-
 /* Create-harness toggles (Connect Harness modal + Welcome first-harness form):
    they reuse the Model-parameters group-card design (.model-params__* from
    routing.css); this wrapper only spaces the group from the fields above. */
diff --git a/packages/frontend/src/styles/notifications.css b/packages/frontend/src/styles/notifications.css
index 7cc23a5c..4fe78228 100644
--- a/packages/frontend/src/styles/notifications.css
+++ b/packages/frontend/src/styles/notifications.css
@@ -455,33 +455,3 @@
   align-items: center;
   gap: 8px;
 }
-
-/* ── Cloud Email Info Card ──────────────────────── */
-.cloud-email-info {
-  display: flex;
-  align-items: flex-start;
-  gap: 12px;
-  padding: 16px 20px;
-  background: hsl(var(--card));
-  border: 1px solid hsl(var(--border));
-  border-radius: var(--radius);
-}
-
-.cloud-email-info__icon {
-  flex-shrink: 0;
-  margin-top: 2px;
-  color: hsl(var(--success));
-}
-
-.cloud-email-info__title {
-  font-size: var(--font-size-sm);
-  font-weight: 600;
-  color: hsl(var(--foreground));
-  margin-bottom: 2px;
-}
-
-.cloud-email-info__desc {
-  font-size: var(--font-size-xs);
-  color: hsl(var(--muted-foreground));
-  line-height: 1.5;
-}
diff --git a/packages/frontend/src/styles/theme.css b/packages/frontend/src/styles/theme.css
index b6a8b031..246ef002 100644
--- a/packages/frontend/src/styles/theme.css
+++ b/packages/frontend/src/styles/theme.css
@@ -21,7 +21,6 @@
 @import './action-menu.css';
 @import './feedback.css';
 @import './params-card.css';
-@import './api-bot.css';
 
 /*
  * Route-scoped stylesheets are intentionally NOT imported here. They are
@@ -891,10 +890,6 @@ h6 {
   background: hsl(var(--border));
 }
 
-.sidebar__spacer {
-  flex: 1;
-}
-
 .sidebar__feedback {
   display: block;
   padding: var(--gap-md) var(--gap-lg);
@@ -1288,9 +1283,7 @@ h6 {
   }
   .header__separator,
   .header__breadcrumb-link,
-  .header__docs-link,
-  .header__github-star,
-  .header__star-separator {
+  .header__docs-link {
     display: none;
   }
   .header__breadcrumb-current {
@@ -1414,7 +1407,6 @@ h6 {
     transform: translateX(0);
   }
   .sidebar__section-label,
-  .sidebar__spacer,
   .sidebar__feedback {
     display: block;
   }
@@ -1543,9 +1535,6 @@ h6 {
 }
 
 @media (max-width: 480px) {
-  .header__mode-badge {
-    display: none;
-  }
   .header__breadcrumb-current {
     max-width: 34vw;
   }
diff --git a/packages/frontend/tests/components/AddAgentModal.test.tsx b/packages/frontend/tests/components/AddAgentModal.test.tsx
index 0e5a314a..cbced1c2 100644
--- a/packages/frontend/tests/components/AddAgentModal.test.tsx
+++ b/packages/frontend/tests/components/AddAgentModal.test.tsx
@@ -30,12 +30,6 @@ vi.mock('../../src/services/sse.js', () => ({
   refreshAgents: (...args: unknown[]) => mockRefreshAgents(...args),
 }));
 
-// Deployment mode drives the logs storage note in the toggle description.
-let mockIsSelfHosted = false;
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => Promise.resolve(mockIsSelfHosted),
-}));
-
 vi.mock('../../src/components/AgentTypeSelect.jsx', () => ({
   default: (props: any) => (
     <div
@@ -75,7 +69,6 @@ const renderOpen = () => {
 describe('AddAgentModal', () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    mockIsSelfHosted = false;
     mockCreateAgent.mockResolvedValue({ agent: { name: 'new-agent' }, apiKey: 'key-1' });
     mockGetGlobalProviders.mockResolvedValue({ providers: [{ provider: 'openai' }] });
   });
@@ -295,20 +288,11 @@ describe('AddAgentModal', () => {
     });
   });
 
-  it('labels the logs toggle and shows the cloud storage note', async () => {
+  it('labels the logs toggle and shows the local storage note', () => {
     renderOpen();
     expect(screen.getByText('Enable logs')).toBeTruthy();
-    await vi.waitFor(() =>
-      expect(document.body.textContent).toContain('Logs are stored in your Manifest workspace.'),
-    );
-  });
-
-  it('shows the machine-local storage note on self-hosted', async () => {
-    mockIsSelfHosted = true;
-    renderOpen();
-    await vi.waitFor(() =>
-      expect(document.body.textContent).toContain('Logs stay in your own database.'),
-    );
+    expect(document.body.textContent).toContain('Logs stay in your own database.');
+    expect(document.body.textContent).not.toContain('Manifest workspace');
   });
 
   it('resets the category/platform to defaults when a category changes', () => {
diff --git a/packages/frontend/tests/components/ApiBotAnnouncement.test.tsx b/packages/frontend/tests/components/ApiBotAnnouncement.test.tsx
deleted file mode 100644
index b4740fe6..00000000
--- a/packages/frontend/tests/components/ApiBotAnnouncement.test.tsx
+++ /dev/null
@@ -1,42 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { fireEvent, render, screen } from '@solidjs/testing-library';
-
-const cleanup = vi.fn();
-vi.mock('../../src/services/dither-ground.js', () => ({
-  mountDither: () => cleanup,
-}));
-
-import ApiBotAnnouncement from '../../src/components/ApiBotAnnouncement';
-
-describe('ApiBotAnnouncement', () => {
-  beforeEach(() => {
-    sessionStorage.clear();
-    cleanup.mockClear();
-  });
-
-  it('shows the image, title, text and a link to API Bot', () => {
-    const { container } = render(() => <ApiBotAnnouncement />);
-    const image = screen.getByAltText('API Bot works with any API');
-    expect(image.getAttribute('src')).toBe('/api-bot-works-with-any-api.svg');
-    expect(screen.getByText('Meet API Bot')).toBeTruthy();
-    expect(screen.getByText("API changes won't take your app down anymore.")).toBeTruthy();
-    const link = screen.getByRole('link', { name: 'Get started' });
-    expect(link.getAttribute('href')).toBe('https://manifest.build/api-bot/');
-    expect(link.getAttribute('target')).toBe('_blank');
-    expect(container.querySelector('canvas.dither-ground')).not.toBeNull();
-  });
-
-  it('hides for the session when closed and stops the ground', () => {
-    const { container } = render(() => <ApiBotAnnouncement />);
-    fireEvent.click(screen.getByRole('button', { name: 'Hide the announcement for this session' }));
-    expect(container.querySelector('.sidebar-api-bot')).toBeNull();
-    expect(sessionStorage.getItem('api-bot-card-dismissed')).toBe('1');
-    expect(cleanup).toHaveBeenCalled();
-  });
-
-  it('stays hidden once dismissed in this session', () => {
-    sessionStorage.setItem('api-bot-card-dismissed', '1');
-    const { container } = render(() => <ApiBotAnnouncement />);
-    expect(container.querySelector('.sidebar-api-bot')).toBeNull();
-  });
-});
diff --git a/packages/frontend/tests/components/ApiBotBanner.test.tsx b/packages/frontend/tests/components/ApiBotBanner.test.tsx
deleted file mode 100644
index 10d8df77..00000000
--- a/packages/frontend/tests/components/ApiBotBanner.test.tsx
+++ /dev/null
@@ -1,44 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { fireEvent, render, screen } from '@solidjs/testing-library';
-
-const mockMountDither = vi.fn(() => () => {});
-vi.mock('../../src/services/dither-ground.js', () => ({
-  mountDither: (canvas: HTMLCanvasElement) => mockMountDither(canvas),
-}));
-
-import ApiBotBanner, { API_BOT_URL } from '../../src/components/ApiBotBanner';
-
-describe('ApiBotBanner', () => {
-  beforeEach(() => {
-    sessionStorage.clear();
-    mockMountDither.mockClear();
-  });
-
-  it('announces API Bot and links to its page in a new tab', () => {
-    const { container } = render(() => <ApiBotBanner />);
-    expect(screen.getByText('Introducing API Bot:')).toBeTruthy();
-    expect(
-      screen.getByText(/keep your app running through upstream API breaking changes/),
-    ).toBeTruthy();
-    const link = screen.getByRole('link', { name: 'Get started' });
-    expect(link.getAttribute('href')).toBe(API_BOT_URL);
-    expect(API_BOT_URL).toBe('https://manifest.build/api-bot/');
-    expect(link.getAttribute('target')).toBe('_blank');
-    expect(link.getAttribute('rel')).toBe('noopener noreferrer');
-    expect(container.querySelector('canvas.dither-ground')).not.toBeNull();
-    expect(mockMountDither).toHaveBeenCalledTimes(1);
-  });
-
-  it('hides for the session when closed', () => {
-    const { container } = render(() => <ApiBotBanner />);
-    fireEvent.click(screen.getByRole('button', { name: 'Hide this banner for this session' }));
-    expect(container.querySelector('.api-bot-banner')).toBeNull();
-    expect(sessionStorage.getItem('api-bot-banner-dismissed')).toBe('1');
-  });
-
-  it('stays hidden once dismissed in this session', () => {
-    sessionStorage.setItem('api-bot-banner-dismissed', '1');
-    const { container } = render(() => <ApiBotBanner />);
-    expect(container.querySelector('.api-bot-banner')).toBeNull();
-  });
-});
diff --git a/packages/frontend/tests/components/App.test.tsx b/packages/frontend/tests/components/App.test.tsx
index 809fe562..c0e35d2b 100644
--- a/packages/frontend/tests/components/App.test.tsx
+++ b/packages/frontend/tests/components/App.test.tsx
@@ -38,10 +38,6 @@ vi.mock("../../src/components/AuthGuard.jsx", () => ({
   default: (props: any) => <div data-testid="auth-guard">{props.children}</div>,
 }));
 
-vi.mock("../../src/services/dither-ground.js", () => ({
-  mountDither: () => () => {},
-}));
-
 vi.mock("../../src/services/sse.js", () => ({
   connectSse: () => () => {},
   analyticsPing: () => 0,
diff --git a/packages/frontend/tests/components/AuthGuard.test.tsx b/packages/frontend/tests/components/AuthGuard.test.tsx
index 039a41fe..cc26162b 100644
--- a/packages/frontend/tests/components/AuthGuard.test.tsx
+++ b/packages/frontend/tests/components/AuthGuard.test.tsx
@@ -2,7 +2,6 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { render, screen } from '@solidjs/testing-library';
 
 const mockNavigate = vi.fn();
-const mockGetBillingPlan = vi.fn().mockResolvedValue({ enabled: false, plan: 'free' });
 let mockLocation = { pathname: '/', search: '' };
 let mockSessionData: any = {
   data: { user: { id: 'u1', name: 'Test' } },
@@ -20,19 +19,12 @@ vi.mock('../../src/services/auth-client.js', () => ({
   },
 }));
 
-vi.mock('../../src/services/api/billing.js', () => ({
-  getBillingPlan: (...args: unknown[]) => mockGetBillingPlan(...args),
-}));
-
 import AuthGuard from '../../src/components/AuthGuard';
-import { resetPlanStore } from '../../src/services/plan-store';
 
 describe('AuthGuard', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     localStorage.clear();
-    resetPlanStore();
-    mockGetBillingPlan.mockResolvedValue({ enabled: false, plan: 'free' });
     mockSessionData = {
       data: { user: { id: 'u1', name: 'Test' } },
       isPending: false,
@@ -85,69 +77,19 @@ describe('AuthGuard', () => {
     expect(await screen.findByText('Protected content')).toBeDefined();
   });
 
-  it('skips the upgrade redirect when the user already chose a plan', async () => {
-    localStorage.setItem('manifest_plan_chosen_u1', '1');
-    localStorage.setItem('manifest_onboarding_done_u1', '1');
-    mockGetBillingPlan.mockResolvedValue({ enabled: true, plan: 'free' });
-    render(() => (
-      <AuthGuard>
-        <span>Protected content</span>
-      </AuthGuard>
-    ));
-
-    expect(await screen.findByText('Protected content')).toBeDefined();
-    // The plan store still resolves at bootstrap (range locks read it), but a
-    // chosen plan never redirects to /register?step=plan again.
-    expect(mockGetBillingPlan).toHaveBeenCalledTimes(1);
-    expect(mockNavigate).not.toHaveBeenCalled();
-  });
-
-  it('redirects authenticated free users to /register?step=plan after onboarding', async () => {
-    localStorage.setItem('manifest_onboarding_done_u1', '1');
-    mockGetBillingPlan.mockResolvedValue({ enabled: true, plan: 'free' });
-    render(() => (
-      <AuthGuard>
-        <span>Protected content</span>
-      </AuthGuard>
-    ));
-
-    await vi.waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/register?step=plan', { replace: true });
-    });
-  });
-
-  it('marks the plan chosen and renders children for a pro user after onboarding', async () => {
-    localStorage.setItem('manifest_onboarding_done_u1', '1');
-    mockGetBillingPlan.mockResolvedValue({ enabled: true, plan: 'pro' });
-    render(() => (
-      <AuthGuard>
-        <span>Protected content</span>
-      </AuthGuard>
-    ));
-
-    expect(await screen.findByText('Protected content')).toBeDefined();
-    expect(localStorage.getItem('manifest_plan_chosen_u1')).toBe('1');
-    expect(mockNavigate).not.toHaveBeenCalled();
-  });
-
-  it('skips the upgrade redirect and renders children when onboarding is not done', async () => {
-    mockGetBillingPlan.mockResolvedValue({ enabled: true, plan: 'free' });
+  it('does not render children while redirecting to the pending discovery step', async () => {
+    localStorage.setItem('manifest_discovery_pending_u1', '/welcome');
     render(() => (
       <AuthGuard>
         <span>Protected content</span>
       </AuthGuard>
     ));
-
-    expect(await screen.findByText('Protected content')).toBeDefined();
-    // The plan store still resolves (bootstrap), but no redirect fires before
-    // onboarding completes.
-    expect(mockNavigate).not.toHaveBeenCalled();
+    await vi.waitFor(() => expect(mockNavigate).toHaveBeenCalled());
+    expect(screen.queryByText('Protected content')).toBeNull();
   });
 
-  it('skips the redirect and renders children when on /register', async () => {
+  it('renders children after onboarding without any plan redirect', async () => {
     localStorage.setItem('manifest_onboarding_done_u1', '1');
-    mockLocation = { pathname: '/register', search: '?step=plan' };
-    mockGetBillingPlan.mockResolvedValue({ enabled: true, plan: 'free' });
     render(() => (
       <AuthGuard>
         <span>Protected content</span>
@@ -158,30 +100,6 @@ describe('AuthGuard', () => {
     expect(mockNavigate).not.toHaveBeenCalled();
   });
 
-  it('fails open when the plan cannot be loaded', async () => {
-    mockGetBillingPlan.mockRejectedValue(new Error('network'));
-    render(() => (
-      <AuthGuard>
-        <span>Protected content</span>
-      </AuthGuard>
-    ));
-
-    expect(await screen.findByText('Protected content')).toBeDefined();
-  });
-
-  it('starts resolving the plan while the session is still pending', async () => {
-    // The plan lookup only needs the cookie jar, not the resolved session, so
-    // it must not wait behind the session probe: in production that probe is
-    // ~0.5 s and the plan another 0.3–0.9 s, paid serially before any page.
-    mockSessionData = { data: null, isPending: true };
-    render(() => (
-      <AuthGuard>
-        <span>Protected content</span>
-      </AuthGuard>
-    ));
-    await vi.waitFor(() => expect(mockGetBillingPlan).toHaveBeenCalledTimes(1));
-  });
-
   it('shows loading state when session is pending', () => {
     mockSessionData = { data: null, isPending: true };
     const { container } = render(() => (
@@ -216,14 +134,14 @@ describe('AuthGuard', () => {
 
   it('preserves the protected path and query when redirecting to login', async () => {
     mockSessionData = { data: null, isPending: false };
-    mockLocation = { pathname: '/upgrade', search: '?reason=requests' };
+    mockLocation = { pathname: '/messages', search: '?range=30d' };
     render(() => (
       <AuthGuard>
         <span>Protected content</span>
       </AuthGuard>
     ));
     await vi.waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/login?redirect=%2Fupgrade%3Freason%3Drequests', {
+      expect(mockNavigate).toHaveBeenCalledWith('/login?redirect=%2Fmessages%3Frange%3D30d', {
         replace: true,
       });
     });
diff --git a/packages/frontend/tests/components/CloudEmailInfo.test.tsx b/packages/frontend/tests/components/CloudEmailInfo.test.tsx
deleted file mode 100644
index 02f19af7..00000000
--- a/packages/frontend/tests/components/CloudEmailInfo.test.tsx
+++ /dev/null
@@ -1,26 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { render, screen } from "@solidjs/testing-library";
-import CloudEmailInfo from "../../src/components/CloudEmailInfo";
-
-describe("CloudEmailInfo", () => {
-  it("renders the title", () => {
-    render(() => <CloudEmailInfo email="test@example.com" />);
-    expect(screen.getByText("Email alerts")).toBeDefined();
-  });
-
-  it("displays the user email", () => {
-    const { container } = render(() => <CloudEmailInfo email="user@manifest.build" />);
-    expect(container.textContent).toContain("user@manifest.build");
-  });
-
-  it("renders the mail icon", () => {
-    const { container } = render(() => <CloudEmailInfo email="test@example.com" />);
-    const icon = container.querySelector(".cloud-email-info__icon");
-    expect(icon).not.toBeNull();
-  });
-
-  it("renders the description text", () => {
-    const { container } = render(() => <CloudEmailInfo email="test@example.com" />);
-    expect(container.textContent).toContain("Alerts will be sent to");
-  });
-});
diff --git a/packages/frontend/tests/components/CustomProviderForm.test.tsx b/packages/frontend/tests/components/CustomProviderForm.test.tsx
index 1e74e1bc..af59622b 100644
--- a/packages/frontend/tests/components/CustomProviderForm.test.tsx
+++ b/packages/frontend/tests/components/CustomProviderForm.test.tsx
@@ -9,7 +9,6 @@ const mockGetProviders = vi.fn().mockResolvedValue([]);
 const mockConnectProvider = vi.fn().mockResolvedValue({});
 const mockDisconnectProvider = vi.fn().mockResolvedValue({ ok: true, notifications: [] });
 const mockRenameProviderKey = vi.fn().mockResolvedValue({});
-const mockCheckIsSelfHosted = vi.fn().mockResolvedValue(false);
 
 vi.mock("../../src/services/api.js", () => ({
   createCustomProvider: (...args: unknown[]) => mockCreateCustomProvider(...args),
@@ -23,10 +22,6 @@ vi.mock("../../src/services/api.js", () => ({
   revokeOpenaiOAuth: vi.fn(),
 }));
 
-vi.mock("../../src/services/setup-status.js", () => ({
-  checkIsSelfHosted: () => mockCheckIsSelfHosted(),
-}));
-
 vi.mock("../../src/services/toast-store.js", () => ({
   toast: { error: vi.fn(), success: vi.fn(), warning: vi.fn() },
 }));
@@ -481,7 +476,13 @@ describe("CustomProviderForm — Fetch models probe", () => {
 
   beforeEach(() => {
     vi.clearAllMocks();
-    mockCheckIsSelfHosted.mockResolvedValue(true);
+  });
+
+  it("always shows the local-server base URL hint", () => {
+    render(() => (
+      <CustomProviderForm agentName="test-agent" onCreated={onCreated} onBack={onBack} />
+    ));
+    expect(screen.getByText("http://host.docker.internal:<port>")).toBeDefined();
   });
 
   it("fetches models via probe and populates the model rows", async () => {
@@ -1274,7 +1275,6 @@ describe("CustomProviderForm — probe edge cases and model-row interactions", (
 
   beforeEach(() => {
     vi.clearAllMocks();
-    mockCheckIsSelfHosted.mockResolvedValue(true);
   });
 
   it("shows an error when Fetch models runs with an empty base URL", async () => {
diff --git a/packages/frontend/tests/components/GuestGuard.test.tsx b/packages/frontend/tests/components/GuestGuard.test.tsx
index 8cc22174..f6852e7d 100644
--- a/packages/frontend/tests/components/GuestGuard.test.tsx
+++ b/packages/frontend/tests/components/GuestGuard.test.tsx
@@ -97,35 +97,19 @@ describe('GuestGuard', () => {
     });
   });
 
-  it('redirects authenticated pro-intent guests to upgrade', async () => {
-    mockSessionData = {
-      data: { user: { id: 'u1', name: 'Test' } },
-      isPending: false,
-    };
-    mockSearchParams = { plan: 'pro' };
-    render(() => (
-      <GuestGuard>
-        <span>Guest content</span>
-      </GuestGuard>
-    ));
-    await vi.waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/upgrade', { replace: true });
-    });
-  });
-
   it('redirects authenticated guests to a safe return path first', async () => {
     mockSessionData = {
       data: { user: { id: 'u1', name: 'Test' } },
       isPending: false,
     };
-    mockSearchParams = { redirect: '/upgrade?reason=requests', plan: 'pro' };
+    mockSearchParams = { redirect: '/messages?range=30d' };
     render(() => (
       <GuestGuard>
         <span>Guest content</span>
       </GuestGuard>
     ));
     await vi.waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/upgrade?reason=requests', {
+      expect(mockNavigate).toHaveBeenCalledWith('/messages?range=30d', {
         replace: true,
       });
     });
@@ -162,7 +146,7 @@ describe('GuestGuard', () => {
     vi.unstubAllGlobals();
   });
 
-  it('lets authenticated users finish the plan step before redirecting', async () => {
+  it('redirects authenticated users home even with the legacy plan step', async () => {
     mockSessionData = {
       data: { user: { id: 'u1', name: 'Test' } },
       isPending: false,
@@ -175,9 +159,9 @@ describe('GuestGuard', () => {
     ));
 
     await vi.waitFor(() => {
-      expect(screen.getByText('Guest content')).not.toBeNull();
+      expect(mockNavigate).toHaveBeenCalledWith('/', { replace: true });
     });
-    expect(mockNavigate).not.toHaveBeenCalled();
+    expect(screen.queryByText('Guest content')).toBeNull();
   });
 
   it('redirects to /setup when setup is incomplete', async () => {
diff --git a/packages/frontend/tests/components/Header.test.tsx b/packages/frontend/tests/components/Header.test.tsx
index 932aedec..51822672 100644
--- a/packages/frontend/tests/components/Header.test.tsx
+++ b/packages/frontend/tests/components/Header.test.tsx
@@ -3,7 +3,6 @@ import { render, screen, fireEvent } from '@solidjs/testing-library';
 
 const mockSignOut = vi.fn().mockResolvedValue(undefined);
 const mockNavigate = vi.fn();
-const mockGetBillingStatus = vi.fn().mockResolvedValue({ enabled: false, plan: 'free' });
 const mockLocationReplace = vi.fn();
 let mockPathname = '/';
 
@@ -50,15 +49,6 @@ vi.mock('../../src/services/agent-display-name.js', () => ({
   agentDisplayName: () => mockAgentDisplayName,
 }));
 
-const mockCheckIsSelfHosted = vi.fn().mockResolvedValue(false);
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => mockCheckIsSelfHosted(),
-}));
-
-vi.mock('../../src/services/api/billing.js', () => ({
-  getBillingStatus: (...args: unknown[]) => mockGetBillingStatus(...args),
-}));
-
 vi.mock('../../src/components/NotificationBell.jsx', () => ({
   default: () => null,
 }));
@@ -76,11 +66,7 @@ beforeEach(() => {
   mockPathname = '/';
   mockAgentName = null;
   mockAgentDisplayName = null;
-  mockGetBillingStatus.mockReset();
-  mockGetBillingStatus.mockResolvedValue({ enabled: false, plan: 'free' });
   mockLocationReplace.mockReset();
-  mockCheckIsSelfHosted.mockReset();
-  mockCheckIsSelfHosted.mockResolvedValue(false);
   // The breadcrumb store is a real module-level signal; reset it so a value
   // set in one test never leaks into another.
   setConnectionBreadcrumb(null);
@@ -170,149 +156,24 @@ describe('Header', () => {
   });
 });
 
-describe('Header - GitHub star button', () => {
-  it('renders the star button with link to GitHub repo', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ stars: 1234 })),
-    );
-    const { container } = render(() => <Header />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Star')).toBeDefined();
-    });
-    const link = container.querySelector('.header__github-star-btn') as HTMLAnchorElement;
-    expect(link).toBeDefined();
-    expect(link.href).toContain('github.com/mnfst/llm-gateway');
-    expect(link.target).toBe('_blank');
-    expect(link.rel).toBe('noopener noreferrer');
-  });
-
-  it('fetches and displays the star count', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ stars: 5678 })),
-    );
-    render(() => <Header />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('5,678')).toBeDefined();
-    });
-  });
-
-  it('formats large star counts with locale separators', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ stars: 12345 })),
-    );
-    render(() => <Header />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('12,345')).toBeDefined();
-    });
-  });
-
-  it('renders star button without count when API returns non-numeric value', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ stars: 'not a number' })),
-    );
-    const { container } = render(() => <Header />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Star')).toBeDefined();
-    });
-    expect(container.querySelector('.header__github-star-count')).toBeNull();
-  });
-
-  it('renders star button without count when fetch fails', async () => {
-    vi.spyOn(globalThis, 'fetch').mockRejectedValueOnce(new Error('Network error'));
-    const { container } = render(() => <Header />);
-    // Star label should still appear
-    await vi.waitFor(() => {
-      expect(screen.getByText('Star')).toBeDefined();
-    });
-    expect(container.querySelector('.header__github-star-count')).toBeNull();
-  });
-
-  it('shows dismiss button', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ stars: 100 })),
-    );
-    render(() => <Header />);
-    await vi.waitFor(() => {
-      expect(screen.getByLabelText('Dismiss GitHub star button')).toBeDefined();
-    });
-  });
-
-  it('hides star button when dismiss is clicked', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ stars: 100 })),
-    );
-    const { container } = render(() => <Header />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Star')).toBeDefined();
-    });
-    await fireEvent.click(screen.getByLabelText('Dismiss GitHub star button'));
-    expect(container.querySelector('.header__github-star')).toBeNull();
-  });
-
-  it('persists dismiss state in sessionStorage', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ stars: 100 })),
-    );
-    render(() => <Header />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Star')).toBeDefined();
-    });
-    await fireEvent.click(screen.getByLabelText('Dismiss GitHub star button'));
-    expect(sessionStorage.getItem('github-star-dismissed')).toBe('true');
-  });
-
-  it('does not render star button if previously dismissed', async () => {
-    sessionStorage.setItem('github-star-dismissed', 'true');
-    const fetchSpy = vi
-      .spyOn(globalThis, 'fetch')
-      .mockResolvedValueOnce(new Response(JSON.stringify({ stars: 100 })));
-    const { container } = render(() => <Header />);
-    expect(container.querySelector('.header__github-star')).toBeNull();
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it('does not fetch star count if dismissed', () => {
-    sessionStorage.setItem('github-star-dismissed', 'true');
-    const fetchSpy = vi
-      .spyOn(globalThis, 'fetch')
-      .mockResolvedValueOnce(new Response(JSON.stringify({ stars: 100 })));
-    render(() => <Header />);
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it('uses cached star count from sessionStorage', async () => {
-    sessionStorage.setItem('github-star-count', '9999');
-    sessionStorage.setItem('github-star-ts', String(Date.now()));
+describe('Header - no hosted extras', () => {
+  it('makes no network call on mount (no GitHub stars, no billing)', async () => {
     const fetchSpy = vi.spyOn(globalThis, 'fetch');
-    render(() => <Header />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('9,999')).toBeDefined();
-    });
+    const { container } = render(() => <Header />);
+    await new Promise((r) => setTimeout(r, 0));
     expect(fetchSpy).not.toHaveBeenCalled();
+    expect(container.querySelector('a[href*="github.com"]')).toBeNull();
   });
 
-  it('fetches fresh count when cache is expired', async () => {
-    sessionStorage.setItem('github-star-count', '9999');
-    sessionStorage.setItem('github-star-ts', String(Date.now() - 4000000));
-    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ stars: 5555 })),
-    );
+  it('shows no plan badge in the user menu', async () => {
     render(() => <Header />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('5,555')).toBeDefined();
-    });
+    await fireEvent.click(screen.getByLabelText('User menu'));
+    expect(screen.queryByText('PRO')).toBeNull();
   });
 
-  it('caches star count in sessionStorage after fetch', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(JSON.stringify({ stars: 4321 })),
-    );
-    render(() => <Header />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('4,321')).toBeDefined();
-    });
-    expect(sessionStorage.getItem('github-star-count')).toBe('4321');
-    expect(sessionStorage.getItem('github-star-ts')).toBeDefined();
+  it('shows no deployment-mode badge', () => {
+    const { container } = render(() => <Header />);
+    expect(container.textContent).not.toContain('Self-hosted');
   });
 });
 
@@ -420,24 +281,6 @@ describe('Header - gear dropdown', () => {
   });
 });
 
-describe('Header - self-hosted badge', () => {
-  it('renders the Self-hosted badge when isSelfHosted is true', async () => {
-    mockCheckIsSelfHosted.mockResolvedValue(true);
-    const { container } = render(() => <Header />);
-    await new Promise((r) => setTimeout(r, 0));
-    const badge = container.querySelector('.header__mode-badge:not(.header__mode-badge--dev)');
-    expect(badge).not.toBeNull();
-    expect(badge?.textContent?.trim()).toBe('Self-hosted');
-  });
-
-  it('does not render the Self-hosted badge in cloud mode', async () => {
-    mockCheckIsSelfHosted.mockResolvedValue(false);
-    const { container } = render(() => <Header />);
-    await new Promise((r) => setTimeout(r, 0));
-    expect(container.querySelector('.header__mode-badge:not(.header__mode-badge--dev)')).toBeNull();
-  });
-});
-
 describe('Header - connection breadcrumb', () => {
   it('renders the connection breadcrumb (back link, provider icon, name, label) when no agent is active', () => {
     // No :agentName route param → getAgentName() is falsy, so the agent
diff --git a/packages/frontend/tests/components/Help.test.tsx b/packages/frontend/tests/components/Help.test.tsx
index ab8ef716..9496ce1a 100644
--- a/packages/frontend/tests/components/Help.test.tsx
+++ b/packages/frontend/tests/components/Help.test.tsx
@@ -21,23 +21,11 @@ describe("Help", () => {
     expect(screen.getByText("Help & Support")).toBeDefined();
   });
 
-  it("shows Schedule a Call section", () => {
-    render(() => <Help />);
-    expect(screen.getByText("Schedule a Call")).toBeDefined();
-  });
-
   it("shows Email Support section", () => {
     render(() => <Help />);
     expect(screen.getByText("Email Support")).toBeDefined();
   });
 
-  it("has Book link", () => {
-    render(() => <Help />);
-    const links = screen.getAllByRole("link");
-    const bookLink = links.find((l) => l.textContent?.includes("Book"));
-    expect(bookLink).toBeDefined();
-  });
-
   it("has Contact link", () => {
     render(() => <Help />);
     const links = screen.getAllByRole("link");
@@ -45,23 +33,6 @@ describe("Help", () => {
     expect(contactLink).toBeDefined();
   });
 
-  it("Calendly link has correct href", () => {
-    render(() => <Help />);
-    const links = screen.getAllByRole("link");
-    const bookLink = links.find((l) => l.textContent?.includes("Book"));
-    expect(bookLink?.getAttribute("href")).toBe(
-      "https://calendly.com/sebastien-manifest/15min",
-    );
-  });
-
-  it("Calendly link opens in new tab with noopener noreferrer", () => {
-    render(() => <Help />);
-    const links = screen.getAllByRole("link");
-    const bookLink = links.find((l) => l.textContent?.includes("Book"));
-    expect(bookLink?.getAttribute("target")).toBe("_blank");
-    expect(bookLink?.getAttribute("rel")).toBe("noopener noreferrer");
-  });
-
   it("Email link is mailto", () => {
     render(() => <Help />);
     const links = screen.getAllByRole("link");
@@ -86,13 +57,6 @@ describe("Help", () => {
     ).toBeDefined();
   });
 
-  it("describes the call duration in the Schedule a Call section", () => {
-    render(() => <Help />);
-    expect(
-      screen.getByText(/Book a 15-min call with us to get help setting things up\./),
-    ).toBeDefined();
-  });
-
   it("shows the support email address with the response window", () => {
     render(() => <Help />);
     expect(
@@ -103,9 +67,11 @@ describe("Help", () => {
     ).toBeDefined();
   });
 
-  it("renders exactly two action links (Book and Contact)", () => {
+  it("renders a single action link (Contact) and no call booking", () => {
     render(() => <Help />);
     const links = screen.getAllByRole("link");
-    expect(links.length).toBe(2);
+    expect(links.length).toBe(1);
+    expect(screen.queryByText("Schedule a Call")).toBeNull();
+    expect(links.some((l) => l.getAttribute("href")?.includes("calendly"))).toBe(false);
   });
 });
diff --git a/packages/frontend/tests/components/MessageDetails.test.tsx b/packages/frontend/tests/components/MessageDetails.test.tsx
index b90637d0..7fe89925 100644
--- a/packages/frontend/tests/components/MessageDetails.test.tsx
+++ b/packages/frontend/tests/components/MessageDetails.test.tsx
@@ -114,7 +114,7 @@ describe('MessageDetails', () => {
     });
   });
 
-  it('links request-limit 402 errors to the upgrade page', async () => {
+  it('shows legacy plan request-limit errors without an upgrade call to action', async () => {
     mockGetMessageDetails.mockResolvedValue({
       message: {
         ...detailsResponse.message,
@@ -131,11 +131,10 @@ describe('MessageDetails', () => {
     const { container } = render(() => <MessageDetails messageId="msg-1" />);
 
     await vi.waitFor(() => {
-      expect(container.textContent).toContain('Upgrade to Pro for unlimited requests.');
-      expect(container.textContent).toContain('Plan request limit');
-      const link = screen.getByText('Upgrade plan').closest('a');
-      expect(link?.getAttribute('href')).toBe('/upgrade?reason=requests');
+      expect(container.textContent).toContain('Request limit reached');
     });
+    expect(container.textContent).not.toContain('Upgrade');
+    expect(container.querySelector('a[href^="/upgrade"]')).toBeNull();
   });
 
   it('surfaces a Manifest config error as origin/type, not a provider fault', async () => {
diff --git a/packages/frontend/tests/components/MessageTableStatus.test.tsx b/packages/frontend/tests/components/MessageTableStatus.test.tsx
index 88cc9871..149be634 100644
--- a/packages/frontend/tests/components/MessageTableStatus.test.tsx
+++ b/packages/frontend/tests/components/MessageTableStatus.test.tsx
@@ -34,7 +34,7 @@ function renderStatus(row: Partial<MessageRow>) {
 }
 
 describe('MessageTable status labels', () => {
-  it('labels billing plan request-limit blocks as plan limits', () => {
+  it('never links legacy plan request-limit rows to an upgrade page', () => {
     renderStatus({
       error_origin: 'policy',
       error_class: 'plan_request_limit_exceeded',
@@ -43,8 +43,8 @@ describe('MessageTable status labels', () => {
     });
 
     const link = screen.getByText('Failed') as HTMLAnchorElement;
-    expect(link.getAttribute('href')).toBe('/upgrade?reason=requests');
-    expect(link.getAttribute('title')).toBe('Free plan request limit reached - upgrade to Pro');
+    expect(link.getAttribute('href')).toBe('/harnesses/demo-agent/limits');
+    expect(screen.queryByText('Upgrade plan')).toBeNull();
   });
 
   it('keeps other Manifest policy failures labelled as custom limits', () => {
diff --git a/packages/frontend/tests/components/NoConnectionsPrompt.test.tsx b/packages/frontend/tests/components/NoConnectionsPrompt.test.tsx
index 93806730..4b8278c0 100644
--- a/packages/frontend/tests/components/NoConnectionsPrompt.test.tsx
+++ b/packages/frontend/tests/components/NoConnectionsPrompt.test.tsx
@@ -1,5 +1,5 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { render, waitFor } from '@solidjs/testing-library';
+import { describe, it, expect, vi } from 'vitest';
+import { render } from '@solidjs/testing-library';
 
 // `A` from the router is rendered as a plain anchor so hrefs are assertable.
 vi.mock('@solidjs/router', () => ({
@@ -10,52 +10,22 @@ vi.mock('@solidjs/router', () => ({
   ),
 }));
 
-// `selfHosted` derives from the setup-status resource (checkIsSelfHosted).
-const mockCheckIsSelfHosted = vi.fn();
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => mockCheckIsSelfHosted(),
-}));
-
 import NoConnectionsPrompt from '../../src/components/NoConnectionsPrompt';
 
 describe('NoConnectionsPrompt', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it('always renders the Subscriptions and Usage-based provider cards', async () => {
-    mockCheckIsSelfHosted.mockResolvedValue(false);
+  it('renders the Subscriptions and Usage-based provider cards', () => {
     const { container } = render(() => <NoConnectionsPrompt />);
-    await waitFor(() => {
-      expect(container.querySelector('a[href="/providers/subscriptions"]')).not.toBeNull();
-    });
+    expect(container.querySelector('a[href="/providers/subscriptions"]')).not.toBeNull();
     expect(container.querySelector('a[href="/providers/usage-based"]')).not.toBeNull();
     expect(container.textContent).toContain('Subscriptions');
     expect(container.textContent).toContain('Usage-based');
   });
 
-  it('renders the Local provider card when self-hosted', async () => {
-    mockCheckIsSelfHosted.mockResolvedValue(true);
+  it('always renders the Local provider card', () => {
     const { container } = render(() => <NoConnectionsPrompt />);
-    // The Local card only appears once the self-hosted resource resolves true.
-    const localCard = await waitFor(() => {
-      const card = container.querySelector('a[href="/providers/local"]');
-      if (!card) throw new Error('Local card not rendered yet');
-      return card;
-    });
+    const localCard = container.querySelector('a[href="/providers/local"]');
     expect(localCard).not.toBeNull();
-    expect(localCard.textContent).toContain('Local');
-    expect(localCard.textContent).toContain('Connect to LLM servers running on your machine.');
-  });
-
-  it('does NOT render the Local provider card in cloud mode', async () => {
-    mockCheckIsSelfHosted.mockResolvedValue(false);
-    const { container } = render(() => <NoConnectionsPrompt />);
-    // Wait for the always-present cards so the resource has had a chance to
-    // resolve; the Local card must still be absent in cloud mode.
-    await waitFor(() => {
-      expect(container.querySelector('a[href="/providers/subscriptions"]')).not.toBeNull();
-    });
-    expect(container.querySelector('a[href="/providers/local"]')).toBeNull();
+    expect(localCard!.textContent).toContain('Local');
+    expect(localCard!.textContent).toContain('Connect to LLM servers running on your machine.');
   });
 });
diff --git a/packages/frontend/tests/components/PlanPicker.test.tsx b/packages/frontend/tests/components/PlanPicker.test.tsx
deleted file mode 100644
index 63bb79c4..00000000
--- a/packages/frontend/tests/components/PlanPicker.test.tsx
+++ /dev/null
@@ -1,71 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { fireEvent, render, screen } from '@solidjs/testing-library';
-import PlanPicker from '../../src/components/PlanPicker';
-import { FREE_REQUEST_LIMIT_LABEL } from '../../src/services/billing-display';
-
-describe('PlanPicker', () => {
-  it('renders the Pro plan expanded by default and submits it', () => {
-    const onSelect = vi.fn();
-    const { container } = render(() => <PlanPicker proPrice="$20" onSelect={onSelect} />);
-
-    expect(screen.getByText('Popular')).toBeDefined();
-    expect(screen.getByText('$20')).toBeDefined();
-    expect(screen.getAllByText('/month').length).toBeGreaterThan(0);
-    expect(screen.getByText('Unlimited routed requests')).toBeDefined();
-
-    fireEvent.click(container.querySelector('.plan-picker__cta')!);
-
-    expect(onSelect).toHaveBeenCalledWith('pro');
-  });
-
-  it('expands the Free plan with usage and submits it', () => {
-    const onSelect = vi.fn();
-    const { container } = render(() => (
-      <PlanPicker proPrice="$20" usedRequests={1234} onSelect={onSelect} />
-    ));
-
-    const cards = container.querySelectorAll<HTMLButtonElement>('.plan-picker__card');
-    fireEvent.click(cards[0]);
-
-    expect(screen.getByText('1,234 used this month')).toBeDefined();
-    expect(screen.getByText(`${FREE_REQUEST_LIMIT_LABEL} routed requests / month`)).toBeDefined();
-    expect(screen.getByText('Community support via Discord')).toBeDefined();
-
-    fireEvent.click(container.querySelector('.plan-picker__cta')!);
-
-    expect(onSelect).toHaveBeenCalledWith('free');
-  });
-
-  it('collapses the selected plan when it is clicked again', () => {
-    const { container } = render(() => <PlanPicker proPrice="$20" onSelect={vi.fn()} />);
-    const proCard = container.querySelectorAll<HTMLButtonElement>('.plan-picker__card')[1];
-
-    fireEvent.click(proCard);
-
-    expect(container.querySelector('.plan-picker__cta')).toBeNull();
-  });
-
-  it('renders enterprise details and the sales link', () => {
-    const { container } = render(() => <PlanPicker proPrice={null} onSelect={vi.fn()} />);
-    const enterpriseCard = container.querySelectorAll<HTMLButtonElement>('.plan-picker__card')[2];
-
-    fireEvent.click(enterpriseCard);
-
-    expect(screen.getByText('Custom')).toBeDefined();
-    expect(screen.getByText('SSO / SAML')).toBeDefined();
-    const link = container.querySelector('.plan-picker__cta') as HTMLAnchorElement;
-    expect(link.textContent).toBe('Talk to sales');
-    expect(link.getAttribute('href')).toBe('https://manifest.build/pricing');
-    expect(link.getAttribute('target')).toBe('_blank');
-    expect(link.getAttribute('rel')).toBe('noopener noreferrer');
-  });
-
-  it('falls back to a Pro label and disables the CTA while busy', () => {
-    const { container } = render(() => <PlanPicker proPrice={null} busy onSelect={vi.fn()} />);
-    const cta = container.querySelector('.plan-picker__cta') as HTMLButtonElement;
-
-    expect(screen.getAllByText('Pro').length).toBeGreaterThan(0);
-    expect(cta.disabled).toBe(true);
-    expect(cta.querySelector('.spinner')).not.toBeNull();
-  });
-});
diff --git a/packages/frontend/tests/components/PlaygroundEmptyState.test.tsx b/packages/frontend/tests/components/PlaygroundEmptyState.test.tsx
index de271f09..814a4dff 100644
--- a/packages/frontend/tests/components/PlaygroundEmptyState.test.tsx
+++ b/packages/frontend/tests/components/PlaygroundEmptyState.test.tsx
@@ -7,10 +7,6 @@ import { render } from '@solidjs/testing-library';
 vi.mock('@solidjs/router', () => ({
   A: (props: { children?: unknown }) => props.children,
 }));
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: vi.fn().mockResolvedValue(false),
-}));
-
 import PlaygroundEmptyState from '../../src/components/playground/PlaygroundEmptyState';
 
 describe('PlaygroundEmptyState', () => {
diff --git a/packages/frontend/tests/components/ProviderIcon.test.tsx b/packages/frontend/tests/components/ProviderIcon.test.tsx
index 10282439..713276dd 100644
--- a/packages/frontend/tests/components/ProviderIcon.test.tsx
+++ b/packages/frontend/tests/components/ProviderIcon.test.tsx
@@ -11,7 +11,6 @@ const KNOWN_PROVIDERS = [
   'copilot',
   'commandcode',
   'gemini',
-  'gemini-free',
   'groq',
   'kiro',
   'deepseek',
diff --git a/packages/frontend/tests/components/ProviderSelectContent-copilot-accounts.test.tsx b/packages/frontend/tests/components/ProviderSelectContent-copilot-accounts.test.tsx
index e365531f..6cb5cbd9 100644
--- a/packages/frontend/tests/components/ProviderSelectContent-copilot-accounts.test.tsx
+++ b/packages/frontend/tests/components/ProviderSelectContent-copilot-accounts.test.tsx
@@ -12,10 +12,6 @@ vi.mock('../../src/services/api.js', async (importOriginal) => {
   };
 });
 
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: vi.fn().mockResolvedValue(false),
-}));
-
 vi.mock('../../src/services/toast-store.js', () => ({
   toast: { error: vi.fn(), success: vi.fn(), warning: vi.fn() },
 }));
diff --git a/packages/frontend/tests/components/ProviderSelectContent-deeplink.test.tsx b/packages/frontend/tests/components/ProviderSelectContent-deeplink.test.tsx
index ab48526d..a7e85ab7 100644
--- a/packages/frontend/tests/components/ProviderSelectContent-deeplink.test.tsx
+++ b/packages/frontend/tests/components/ProviderSelectContent-deeplink.test.tsx
@@ -11,7 +11,6 @@ vi.mock('../../src/services/api.js', () => ({
 }));
 
 vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: vi.fn().mockResolvedValue(true),
   checkIsOllamaAvailable: vi.fn().mockResolvedValue(false),
   checkLocalLlmHost: vi.fn().mockResolvedValue('localhost'),
 }));
diff --git a/packages/frontend/tests/components/ProviderSelectContent.test.tsx b/packages/frontend/tests/components/ProviderSelectContent.test.tsx
index c1936945..ad170b2e 100644
--- a/packages/frontend/tests/components/ProviderSelectContent.test.tsx
+++ b/packages/frontend/tests/components/ProviderSelectContent.test.tsx
@@ -13,7 +13,6 @@ vi.mock("../../src/services/api.js", () => ({
 }));
 
 vi.mock("../../src/services/setup-status.js", () => ({
-  checkIsSelfHosted: vi.fn().mockResolvedValue(true),
   checkIsOllamaAvailable: vi.fn().mockResolvedValue(false),
   checkLocalLlmHost: vi.fn().mockResolvedValue('localhost'),
 }));
diff --git a/packages/frontend/tests/components/ProviderSelectModal.test.tsx b/packages/frontend/tests/components/ProviderSelectModal.test.tsx
index 0f3be0a8..d6825e5e 100644
--- a/packages/frontend/tests/components/ProviderSelectModal.test.tsx
+++ b/packages/frontend/tests/components/ProviderSelectModal.test.tsx
@@ -139,7 +139,6 @@ vi.mock('../../src/components/ProviderIcon.js', () => ({
 }));
 
 vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: vi.fn().mockResolvedValue(false),
   checkIsOllamaAvailable: vi.fn().mockResolvedValue(false),
   checkLocalLlmHost: vi.fn().mockResolvedValue('localhost'),
 }));
diff --git a/packages/frontend/tests/components/Sidebar.test.tsx b/packages/frontend/tests/components/Sidebar.test.tsx
index 1345e236..cade5e4c 100644
--- a/packages/frontend/tests/components/Sidebar.test.tsx
+++ b/packages/frontend/tests/components/Sidebar.test.tsx
@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, vi, beforeEach } from "vitest";
 import { fireEvent, render, screen, waitFor } from "@solidjs/testing-library";
 
 let mockPathname = "/overview";
@@ -27,24 +27,10 @@ vi.mock("@solidjs/router", () => ({
   useLocation: () => ({ get pathname() { return mockPathname; } }),
 }));
 
-vi.mock("../../src/services/dither-ground.js", () => ({
-  mountDither: () => () => {},
-}));
-
-const mockGetBillingStatus = vi.fn();
-vi.mock("../../src/services/api/billing.js", () => ({
-  getBillingStatus: (...args: unknown[]) => mockGetBillingStatus(...args),
-}));
-
-// Local providers only exist on self-hosted installs; the Sidebar hides the
-// Local nav entry in cloud. Default to self-hosted so the legacy link
-// assertions keep applying; cloud tests flip the flag.
-let mockIsSelfHosted = true;
 // MCP is on by default; an install served over plain HTTP runs without it and
 // the nav entry goes with it.
 let mockMcpEnabled = true;
 vi.mock("../../src/services/setup-status.js", () => ({
-  checkIsSelfHosted: () => Promise.resolve(mockIsSelfHosted),
   checkMcpEnabled: () => Promise.resolve(mockMcpEnabled),
 }));
 
@@ -75,12 +61,6 @@ beforeEach(() => {
   sessionStorage.clear();
   vi.clearAllMocks();
   mockPathname = "/overview";
-  mockIsSelfHosted = true;
-  mockGetBillingStatus.mockResolvedValue({
-    enabled: false,
-    plan: "free",
-    requests: { used: null, limit: null, periodEnd: null },
-  });
 });
 
 describe("Sidebar — global nav links", () => {
@@ -94,22 +74,12 @@ describe("Sidebar — global nav links", () => {
     expect(screen.getByText("Requests")).toBeDefined();
   });
 
-  it("renders provider section links (Local resolves async, self-hosted)", async () => {
+  it("renders provider section links, Local included", () => {
     render(() => <Sidebar />);
     expect(screen.getByText("PROVIDERS")).toBeDefined();
     expect(screen.getByText("Subscriptions")).toBeDefined();
     expect(screen.getByText("Usage-based")).toBeDefined();
-    await waitFor(() => expect(screen.getByText("Local")).toBeDefined());
-  });
-
-  it("hides the Local link in cloud", async () => {
-    mockIsSelfHosted = false;
-    const { container } = render(() => <Sidebar />);
-    // Wait for the self-hosted resource to settle (Usage-based is always present).
-    await waitFor(() => expect(screen.getByText("Usage-based")).toBeDefined());
-    await Promise.resolve();
-    expect(container.querySelector('a[href="/providers/local"]')).toBeNull();
-    expect(container.textContent).not.toContain("Local");
+    expect(screen.getByText("Local")).toBeDefined();
   });
 
   it("renders the Harnesses nav link under Requests", () => {
@@ -350,84 +320,14 @@ describe("Sidebar — structure and interaction", () => {
   });
 });
 
-describe("Sidebar — usage card", () => {
-  beforeEach(() => {
-    // The usage meter only occupies the bottom-left slot in cloud; self-hosted
-    // always shows the Autofix card there.
-    mockIsSelfHosted = false;
-  });
-  afterEach(() => {
-    mockIsSelfHosted = true;
-  });
-
-  it("renders free-plan usage and the near-limit warning state", async () => {
-    mockGetBillingStatus.mockResolvedValue({
-      enabled: true,
-      plan: "free",
-      requests: { used: 8_500, limit: 10_000, periodEnd: null },
-    });
-
-    const { container } = render(() => <Sidebar />);
-
-    await screen.findByText(/8,500/);
-    expect(container.querySelector(".sidebar-usage__count--danger")).not.toBeNull();
-    expect(container.querySelector(".sidebar-usage__fill--danger")).not.toBeNull();
-    expect(container.textContent).toContain(
-      "You're limited to 10,000 requests this month. Upgrade for unlimited.",
-    );
-    expect(container.querySelector('a[href="/upgrade"]')).not.toBeNull();
-  });
-
-  it("renders the reached-limit warning state", async () => {
-    mockGetBillingStatus.mockResolvedValue({
-      enabled: true,
-      plan: "free",
-      requests: { used: 10_001, limit: 10_000, periodEnd: null },
-    });
-
+describe("Sidebar — no hosted extras", () => {
+  it("renders no usage meter, upgrade link or announcement card", async () => {
     const { container } = render(() => <Sidebar />);
-
-    await screen.findByText(/10,001/);
-    expect(container.textContent).toContain(
-      "You've reached your monthly limit. Requests are being blocked.",
+    await waitFor(() =>
+      expect(container.querySelector('a[href="/integrations/mcp"]')).not.toBeNull(),
     );
-    expect(container.querySelector(".sidebar-usage__fill--danger")).not.toBeNull();
-  });
-
-  it("hides the usage card when the billing fetch fails (fail-soft fallback)", async () => {
-    mockGetBillingStatus.mockRejectedValue(new Error("boom"));
-    const { container } = render(() => <Sidebar />);
-    await waitFor(() => expect(mockGetBillingStatus).toHaveBeenCalled());
-    await new Promise((resolve) => setTimeout(resolve, 0));
-    expect(container.querySelector(".sidebar-usage")).toBeNull();
-  });
-
-  it("renders the warning fill before the danger threshold", async () => {
-    mockGetBillingStatus.mockResolvedValue({
-      enabled: true,
-      plan: "free",
-      requests: { used: 5_500, limit: 10_000, periodEnd: null },
-    });
-
-    const { container } = render(() => <Sidebar />);
-
-    await screen.findByText(/5,500/);
-    expect(container.querySelector(".sidebar-usage__fill--warning")).not.toBeNull();
-    expect(container.querySelector(".sidebar-usage__fill--danger")).toBeNull();
-  });
-});
-
-describe("Sidebar — API Bot announcement card", () => {
-  it("renders the API Bot card in self-hosted", async () => {
-    const { container } = render(() => <Sidebar />);
-    await screen.findByText("Meet API Bot");
-    expect(container.querySelector(".sidebar-api-bot")).not.toBeNull();
-  });
-
-  it("renders the API Bot card in cloud too", async () => {
-    mockIsSelfHosted = false;
-    const { container } = render(() => <Sidebar />);
-    await screen.findByText("Meet API Bot");
-    expect(container.querySelector(".sidebar-api-bot")).not.toBeNull();
+    expect(container.querySelector('a[href="/upgrade"]')).toBeNull();
+    expect(container.textContent).not.toContain("Upgrade plan");
+    expect(container.textContent).not.toContain("API Bot");
   });
 });
diff --git a/packages/frontend/tests/components/SocialButtons.test.tsx b/packages/frontend/tests/components/SocialButtons.test.tsx
index 295059a8..c2af18b9 100644
--- a/packages/frontend/tests/components/SocialButtons.test.tsx
+++ b/packages/frontend/tests/components/SocialButtons.test.tsx
@@ -83,25 +83,14 @@ describe('SocialButtons', () => {
     expect(getLastAuthMethod()).toBe('google');
   });
 
-  it('routes pro-intent social auth to upgrade', async () => {
-    mockSearchParams = { plan: 'pro' };
-    render(() => <SocialButtons />);
-    await fireEvent.click(screen.getByText('Continue with Google'));
-    expect(mockSignInSocial).toHaveBeenCalledWith({
-      provider: 'google',
-      callbackURL: '/upgrade',
-      errorCallbackURL: '/login?plan=pro&oauth=failed',
-    });
-  });
-
   it('preserves safe redirect intent for social auth', async () => {
-    mockSearchParams = { redirect: '/upgrade?reason=requests' };
+    mockSearchParams = { redirect: '/messages?range=30d' };
     render(() => <SocialButtons />);
     await fireEvent.click(screen.getByText('Continue with GitHub'));
     expect(mockSignInSocial).toHaveBeenCalledWith({
       provider: 'github',
-      callbackURL: '/upgrade?reason=requests',
-      errorCallbackURL: '/login?redirect=%2Fupgrade%3Freason%3Drequests&oauth=failed',
+      callbackURL: '/messages?range=30d',
+      errorCallbackURL: '/login?redirect=%2Fmessages%3Frange%3D30d&oauth=failed',
     });
   });
 
diff --git a/packages/frontend/tests/components/UpgradeSuccessModal.test.tsx b/packages/frontend/tests/components/UpgradeSuccessModal.test.tsx
deleted file mode 100644
index 53a71b05..00000000
--- a/packages/frontend/tests/components/UpgradeSuccessModal.test.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { fireEvent, render, screen } from '@solidjs/testing-library';
-import UpgradeSuccessModal from '../../src/components/UpgradeSuccessModal';
-
-describe('UpgradeSuccessModal', () => {
-  it('renders nothing when closed', () => {
-    const { container } = render(() => <UpgradeSuccessModal open={false} onClose={vi.fn()} />);
-
-    expect(container.textContent).toBe('');
-    expect(document.body.querySelector('.upgrade-success-modal')).toBeNull();
-  });
-
-  it('renders Pro benefits and closes from the backdrop, Escape, or done button', () => {
-    const onClose = vi.fn();
-    render(() => <UpgradeSuccessModal open onClose={onClose} />);
-
-    expect(screen.getByText("You're now on the Pro plan")).toBeDefined();
-    expect(screen.getByText('Unlimited routed requests')).toBeDefined();
-    expect(screen.getByText('365 days dashboard retention')).toBeDefined();
-
-    const dialog = screen.getByRole('dialog', { name: 'Upgrade successful' });
-    const backdrop = document.body.querySelector('.modal-backdrop') as HTMLElement;
-
-    fireEvent.click(dialog);
-    expect(onClose).not.toHaveBeenCalled();
-
-    fireEvent.click(screen.getByText('Done'));
-    expect(onClose).toHaveBeenCalledTimes(1);
-
-    fireEvent.keyDown(backdrop, { key: 'Escape' });
-    expect(onClose).toHaveBeenCalledTimes(2);
-
-    fireEvent.click(backdrop);
-    expect(onClose).toHaveBeenCalledTimes(3);
-  });
-});
diff --git a/packages/frontend/tests/components/UsageLimitBanner.test.tsx b/packages/frontend/tests/components/UsageLimitBanner.test.tsx
deleted file mode 100644
index 5a1781ab..00000000
--- a/packages/frontend/tests/components/UsageLimitBanner.test.tsx
+++ /dev/null
@@ -1,125 +0,0 @@
-import { describe, expect, it, vi, beforeEach } from 'vitest';
-import { fireEvent, render, screen, waitFor } from '@solidjs/testing-library';
-import UsageLimitBanner from '../../src/components/UsageLimitBanner';
-
-const mockGetBillingStatus = vi.fn();
-
-vi.mock('@solidjs/router', () => ({
-  A: (props: any) => (
-    <a href={props.href} class={props.class}>
-      {props.children}
-    </a>
-  ),
-}));
-
-vi.mock('../../src/services/auth-client.js', () => ({
-  authClient: {
-    useSession: () => () => ({
-      data: { user: { id: 'u1' } },
-      isPending: false,
-    }),
-  },
-}));
-
-vi.mock('../../src/services/api/billing.js', () => ({
-  getBillingStatus: (...args: unknown[]) => mockGetBillingStatus(...args),
-}));
-
-const freeStatus = (used: number, limit = 10_000) => ({
-  enabled: true,
-  plan: 'free' as const,
-  requests: { used, limit, periodEnd: null },
-});
-
-describe('UsageLimitBanner', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    localStorage.clear();
-    mockGetBillingStatus.mockResolvedValue(freeStatus(8_000));
-  });
-
-  it('shows and dismisses the near-limit warning for free users', async () => {
-    const { container } = render(() => <UsageLimitBanner />);
-
-    await screen.findByText("You're limited to 10,000 requests this month. Upgrade for unlimited.");
-    expect(container.querySelector('.usage-limit-banner--danger')).toBeNull();
-    expect(container.querySelector('a[href="/upgrade?reason=requests"]')).not.toBeNull();
-
-    fireEvent.click(screen.getByText('Got it'));
-
-    await waitFor(() => {
-      expect(container.querySelector('.usage-limit-banner')).toBeNull();
-    });
-  });
-
-  it('keeps the reached-limit warning visible and non-dismissible', async () => {
-    mockGetBillingStatus.mockResolvedValue(freeStatus(10_000));
-    const { container } = render(() => <UsageLimitBanner />);
-
-    await screen.findByText("You've reached your monthly limit. Requests are being blocked.");
-    expect(container.querySelector('.usage-limit-banner--danger')).not.toBeNull();
-    expect(screen.queryByText('Got it')).toBeNull();
-  });
-
-  it('stays hidden when the warning was already dismissed today', async () => {
-    localStorage.setItem(
-      'manifest_usage_banner_dismissed:u1',
-      new Date().toISOString().slice(0, 10),
-    );
-    const { container } = render(() => <UsageLimitBanner />);
-
-    await waitFor(() => expect(mockGetBillingStatus).toHaveBeenCalled());
-
-    expect(container.querySelector('.usage-limit-banner')).toBeNull();
-  });
-
-  it('does not reuse another user dismissal', async () => {
-    localStorage.setItem(
-      'manifest_usage_banner_dismissed:u2',
-      new Date().toISOString().slice(0, 10),
-    );
-    const { container } = render(() => <UsageLimitBanner />);
-
-    await screen.findByText("You're limited to 10,000 requests this month. Upgrade for unlimited.");
-
-    expect(container.querySelector('.usage-limit-banner')).not.toBeNull();
-  });
-
-  it('keeps working when dismissal storage is unavailable', async () => {
-    const getItem = vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
-      throw new Error('blocked');
-    });
-    const setItem = vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
-      throw new Error('blocked');
-    });
-
-    try {
-      render(() => <UsageLimitBanner />);
-
-      await screen.findByText(
-        "You're limited to 10,000 requests this month. Upgrade for unlimited.",
-      );
-      expect(() => fireEvent.click(screen.getByText('Got it'))).not.toThrow();
-    } finally {
-      getItem.mockRestore();
-      setItem.mockRestore();
-    }
-  });
-
-  it('stays hidden for pro users and billing fetch failures', async () => {
-    mockGetBillingStatus.mockResolvedValueOnce({
-      enabled: true,
-      plan: 'pro',
-      requests: { used: null, limit: null, periodEnd: null },
-    });
-    const pro = render(() => <UsageLimitBanner />);
-    await waitFor(() => expect(mockGetBillingStatus).toHaveBeenCalledTimes(1));
-    expect(pro.container.querySelector('.usage-limit-banner')).toBeNull();
-    pro.unmount();
-
-    mockGetBillingStatus.mockRejectedValueOnce(new Error('network'));
-    const failed = render(() => <UsageLimitBanner />);
-    await waitFor(() => expect(mockGetBillingStatus).toHaveBeenCalledTimes(2));
-    expect(failed.container.querySelector('.usage-limit-banner')).toBeNull();
-  });
-});
diff --git a/packages/frontend/tests/components/VersionIndicator.test.tsx b/packages/frontend/tests/components/VersionIndicator.test.tsx
index 78f153e7..0fd8471c 100644
--- a/packages/frontend/tests/components/VersionIndicator.test.tsx
+++ b/packages/frontend/tests/components/VersionIndicator.test.tsx
@@ -43,30 +43,10 @@ describe('VersionIndicator', () => {
   });
 
   afterEach(() => {
-    vi.unstubAllEnvs();
     vi.restoreAllMocks();
   });
 
-  it('renders nothing when not self-hosted', () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', '');
-    const { container } = render(() => <VersionIndicator />);
-    expect(container.querySelector('.version-indicator')).toBeNull();
-  });
-
-  it("renders nothing when the flag is anything other than 'true'", () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', 'false');
-    const { container } = render(() => <VersionIndicator />);
-    expect(container.querySelector('.version-indicator')).toBeNull();
-  });
-
-  it('does not ask the backend for version info when not self-hosted', () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', '');
-    render(() => <VersionIndicator />);
-    expect(mockGetVersionInfo).not.toHaveBeenCalled();
-  });
-
-  it('renders v{version} when self-hosted', () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', 'true');
+  it('renders v{version}', () => {
     const { container } = render(() => <VersionIndicator />);
     const badge = container.querySelector('.version-indicator');
     expect(badge).not.toBeNull();
@@ -75,7 +55,6 @@ describe('VersionIndicator', () => {
   });
 
   it('keeps the plain badge when already on the latest release', async () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', 'true');
     const { container } = render(() => <VersionIndicator />);
     await waitFor(() => expect(mockGetVersionInfo).toHaveBeenCalledTimes(1));
     expect(container.querySelector('.version-indicator__update')).toBeNull();
@@ -85,7 +64,6 @@ describe('VersionIndicator', () => {
   });
 
   it('links to the changelog when a newer release exists', async () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', 'true');
     mockGetVersionInfo.mockResolvedValue(newer());
     const { container, findByText } = render(() => <VersionIndicator />);
 
@@ -103,7 +81,6 @@ describe('VersionIndicator', () => {
   });
 
   it('shows neither an upgrade link nor a releases-behind count', async () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', 'true');
     mockGetVersionInfo.mockResolvedValue(newer());
     const { container, findByText } = render(() => <VersionIndicator />);
 
@@ -114,7 +91,6 @@ describe('VersionIndicator', () => {
   });
 
   it('hides the update notice when dismissed and remembers the dismissed version', async () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', 'true');
     mockGetVersionInfo.mockResolvedValue(newer());
     const { container, findByLabelText } = render(() => <VersionIndicator />);
 
@@ -131,7 +107,6 @@ describe('VersionIndicator', () => {
   });
 
   it('stays dismissed on later loads while the latest version is unchanged', async () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', 'true');
     localStorage.setItem(UPDATE_DISMISSED_STORAGE_KEY, '9.9.9');
     mockGetVersionInfo.mockResolvedValue(newer());
     const { container } = render(() => <VersionIndicator />);
@@ -142,7 +117,6 @@ describe('VersionIndicator', () => {
   });
 
   it('shows the notice again once an even newer version is released', async () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', 'true');
     localStorage.setItem(UPDATE_DISMISSED_STORAGE_KEY, '9.9.8');
     mockGetVersionInfo.mockResolvedValue(newer());
     const { findByText } = render(() => <VersionIndicator />);
@@ -151,7 +125,6 @@ describe('VersionIndicator', () => {
   });
 
   it('still works when localStorage is unavailable', async () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', 'true');
     vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
       throw new Error('blocked');
     });
@@ -167,7 +140,6 @@ describe('VersionIndicator', () => {
   });
 
   it('keeps the plain badge when the version check fails', async () => {
-    vi.stubEnv('VITE_MANIFEST_SELFHOSTED', 'true');
     mockGetVersionInfo.mockRejectedValue(new Error('network down'));
     const { container } = render(() => <VersionIndicator />);
     await waitFor(() => expect(mockGetVersionInfo).toHaveBeenCalledTimes(1));
diff --git a/packages/frontend/tests/pages/Account.test.tsx b/packages/frontend/tests/pages/Account.test.tsx
index e17b0815..597b1079 100644
--- a/packages/frontend/tests/pages/Account.test.tsx
+++ b/packages/frontend/tests/pages/Account.test.tsx
@@ -1,19 +1,8 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { render, screen, fireEvent, waitFor } from '@solidjs/testing-library';
-import { FREE_REQUEST_LIMIT_LABEL } from '../../src/services/billing-display';
-import { FREE_PLAN_REQUESTS_PER_MONTH } from 'manifest-shared';
-
-const searchParamsState: Record<string, string | undefined> = {};
-const setSearchParamsFn = vi.fn((p: Record<string, string | undefined>) => {
-  for (const [k, v] of Object.entries(p)) {
-    if (v === undefined) delete searchParamsState[k];
-    else searchParamsState[k] = v;
-  }
-});
 
 vi.mock('@solidjs/router', () => ({
   useNavigate: () => vi.fn(),
-  useSearchParams: () => [searchParamsState, setSearchParamsFn],
 }));
 
 vi.mock('@solidjs/meta', () => ({
@@ -21,8 +10,6 @@ vi.mock('@solidjs/meta', () => ({
   Meta: () => null,
 }));
 
-const mockUpgrade = vi.fn();
-const mockBillingPortal = vi.fn();
 const mockListAccounts = vi.fn();
 const mockChangePassword = vi.fn();
 
@@ -32,22 +19,11 @@ vi.mock('../../src/services/auth-client.js', () => ({
       data: { user: { id: 'u1', name: 'Test User', email: 'test@test.com' } },
       isPending: false,
     }),
-    subscription: {
-      upgrade: (...a: unknown[]) => mockUpgrade(...a),
-      billingPortal: (...a: unknown[]) => mockBillingPortal(...a),
-    },
     listAccounts: (...a: unknown[]) => mockListAccounts(...a),
     changePassword: (...a: unknown[]) => mockChangePassword(...a),
   },
 }));
 
-const mockGetBillingStatus = vi.fn();
-const mockUpdateBillingEmailPreferences = vi.fn();
-vi.mock('../../src/services/api/billing.js', () => ({
-  getBillingStatus: (...a: unknown[]) => mockGetBillingStatus(...a),
-  updateBillingEmailPreferences: (...a: unknown[]) => mockUpdateBillingEmailPreferences(...a),
-}));
-
 const mockToastSuccess = vi.fn();
 const mockToastError = vi.fn();
 vi.mock('../../src/services/toast-store.js', () => ({
@@ -79,55 +55,12 @@ Object.defineProperty(window, 'matchMedia', {
 
 import Account from '../../src/pages/Account';
 
-const disabledStatus = {
-  enabled: false,
-  plan: 'free' as const,
-  priceMonthly: { amount: null, currency: null, interval: null },
-  emailPreferences: { usageAlerts: true },
-  requests: { used: 0, limit: FREE_PLAN_REQUESTS_PER_MONTH, periodEnd: null },
-  cancelAtPeriodEnd: false,
-  subscriptionPeriodEnd: null,
-};
-
-const freeStatus = {
-  enabled: true,
-  plan: 'free' as const,
-  priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-  emailPreferences: { usageAlerts: true },
-  requests: {
-    used: 120,
-    limit: FREE_PLAN_REQUESTS_PER_MONTH,
-    periodEnd: '2026-08-01T00:00:00.000Z',
-  },
-  cancelAtPeriodEnd: false,
-  subscriptionPeriodEnd: null,
-};
-
-const proStatus = {
-  enabled: true,
-  plan: 'pro' as const,
-  priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-  emailPreferences: { usageAlerts: true },
-  requests: { used: null, limit: null, periodEnd: null },
-  cancelAtPeriodEnd: false,
-  subscriptionPeriodEnd: null,
-};
-
 describe('Account', () => {
-  let fakeTab: { location: { href: string }; opener: unknown; close: ReturnType<typeof vi.fn> };
-
   beforeEach(() => {
     vi.clearAllMocks();
     localStorage.clear();
-    for (const key of Object.keys(searchParamsState)) delete searchParamsState[key];
-    mockGetBillingStatus.mockResolvedValue(disabledStatus);
-    mockUpdateBillingEmailPreferences.mockResolvedValue({ usageAlerts: true });
-    mockUpgrade.mockResolvedValue(undefined);
-    mockBillingPortal.mockResolvedValue({ data: { url: 'https://billing.stripe.com/session' } });
     mockListAccounts.mockResolvedValue({ data: [{ providerId: 'credential' }], error: null });
     mockChangePassword.mockResolvedValue({ data: {}, error: null });
-    fakeTab = { location: { href: '' }, opener: {}, close: vi.fn() };
-    vi.spyOn(window, 'open').mockImplementation(() => fakeTab as unknown as Window);
   });
 
   it('renders Account Preferences heading', () => {
@@ -324,242 +257,12 @@ describe('Account', () => {
     expect(localStorage.getItem('theme')).toBe('dark');
   });
 
-  describe('Billing', () => {
-    it('hides the Billing section when billing is not enabled', async () => {
-      const { container } = render(() => <Account />);
-      await waitFor(() => expect(mockGetBillingStatus).toHaveBeenCalled());
-      expect(screen.queryByText('Billing')).toBeNull();
-      expect(screen.queryByText('Email preferences')).toBeNull();
-      expect(container.querySelector('#billing')).toBeNull();
-    });
-
-    it('shows plan, usage, and comparison footer on the free plan', async () => {
-      mockGetBillingStatus.mockResolvedValue(freeStatus);
-      const { container } = render(() => <Account />);
-      await screen.findByText('Billing');
-      expect(container.querySelector('#billing')).not.toBeNull();
-      expect(screen.getByText('Current plan')).toBeDefined();
-      expect(screen.getByText('Free')).toBeDefined();
-      expect(screen.getByText(`120 / ${FREE_REQUEST_LIMIT_LABEL}`)).toBeDefined();
-      expect(screen.getByText(/Resets/)).toBeDefined();
-      expect(
-        screen.getByText(`Free: ${FREE_REQUEST_LIMIT_LABEL} requests/mo · Pro: unlimited requests`),
-      ).toBeDefined();
-      expect(screen.getByText('Email preferences')).toBeDefined();
-      expect(
-        (screen.getByLabelText('Receive usage alert emails') as HTMLInputElement).checked,
-      ).toBe(true);
-    });
-
-    it('saves usage alert email preferences', async () => {
-      mockGetBillingStatus
-        .mockResolvedValueOnce(freeStatus)
-        .mockResolvedValue({ ...freeStatus, emailPreferences: { usageAlerts: false } });
-      mockUpdateBillingEmailPreferences.mockResolvedValue({ usageAlerts: false });
-      render(() => <Account />);
-      const checkbox = (await screen.findByLabelText(
-        'Receive usage alert emails',
-      )) as HTMLInputElement;
-
-      fireEvent.click(checkbox);
-
-      await waitFor(() =>
-        expect(mockUpdateBillingEmailPreferences).toHaveBeenCalledWith({ usageAlerts: false }),
-      );
-      await waitFor(() => expect(mockToastSuccess).toHaveBeenCalledWith('Email preferences saved'));
-      await waitFor(() => expect(checkbox.checked).toBe(false));
-    });
-
-    it('restores the usage alert toggle when saving fails', async () => {
-      mockGetBillingStatus.mockResolvedValue(freeStatus);
-      mockUpdateBillingEmailPreferences.mockRejectedValue(new Error('network'));
-      render(() => <Account />);
-      const checkbox = (await screen.findByLabelText(
-        'Receive usage alert emails',
-      )) as HTMLInputElement;
-
-      fireEvent.click(checkbox);
-
-      await waitFor(() =>
-        expect(mockUpdateBillingEmailPreferences).toHaveBeenCalledWith({ usageAlerts: false }),
-      );
-      await waitFor(() => expect(checkbox.checked).toBe(true));
-    });
-    it('falls back to the included label when a limited plan has no usage count yet', async () => {
-      mockGetBillingStatus.mockResolvedValue({
-        ...freeStatus,
-        requests: { used: null, limit: FREE_PLAN_REQUESTS_PER_MONTH, periodEnd: null },
-      });
-      render(() => <Account />);
-      await screen.findByText('Billing');
-      expect(screen.getByText(FREE_REQUEST_LIMIT_LABEL)).toBeDefined();
-    });
-
-    it('calls subscription.upgrade with checkout URLs when Upgrade to Pro is clicked', async () => {
-      mockGetBillingStatus.mockResolvedValue(freeStatus);
-      render(() => <Account />);
-      const button = await screen.findByText(/Upgrade to Pro/);
-      expect(button.textContent).toContain('$20/mo');
-      fireEvent.click(button);
-      expect(mockUpgrade).toHaveBeenCalledWith({
-        plan: 'pro',
-        successUrl: `${window.location.origin}/account?upgraded=1`,
-        cancelUrl: `${window.location.origin}/account`,
-      });
-      await waitFor(() => expect((button as HTMLButtonElement).disabled).toBe(false));
-    });
-
-    it('disables the upgrade button while the checkout call is in flight', async () => {
-      mockGetBillingStatus.mockResolvedValue(freeStatus);
-      let resolveUpgrade!: () => void;
-      mockUpgrade.mockImplementation(
-        () => new Promise<void>((resolve) => (resolveUpgrade = resolve)),
-      );
-      render(() => <Account />);
-      const button = (await screen.findByText(/Upgrade to Pro/)) as HTMLButtonElement;
-      fireEvent.click(button);
-      await waitFor(() => expect(button.disabled).toBe(true));
-      resolveUpgrade();
-      await waitFor(() => expect(button.disabled).toBe(false));
-    });
-
-    it('shows an error toast and re-enables the button when the upgrade call rejects', async () => {
-      mockGetBillingStatus.mockResolvedValue(freeStatus);
-      mockUpgrade.mockRejectedValue(new Error('network'));
-      render(() => <Account />);
-      const button = (await screen.findByText(/Upgrade to Pro/)) as HTMLButtonElement;
-      fireEvent.click(button);
-      await waitFor(() =>
-        expect(mockToastError).toHaveBeenCalledWith(
-          'Could not start the upgrade. Please try again.',
-        ),
-      );
-      await waitFor(() => expect(button.disabled).toBe(false));
-    });
-
-    it('shows an error toast and re-enables the button when the upgrade call returns an error payload', async () => {
-      mockGetBillingStatus.mockResolvedValue(freeStatus);
-      mockUpgrade.mockResolvedValue({ error: { message: 'network' } });
-      render(() => <Account />);
-      const button = (await screen.findByText(/Upgrade to Pro/)) as HTMLButtonElement;
-      fireEvent.click(button);
-      await waitFor(() =>
-        expect(mockToastError).toHaveBeenCalledWith(
-          'Could not start the upgrade. Please try again.',
-        ),
-      );
-      await waitFor(() => expect(button.disabled).toBe(false));
-    });
-
-    it('shows an error toast when the billing portal call rejects', async () => {
-      mockGetBillingStatus.mockResolvedValue(proStatus);
-      mockBillingPortal.mockRejectedValue(new Error('network'));
-      render(() => <Account />);
-      const button = (await screen.findByText('Manage subscription')) as HTMLButtonElement;
-      fireEvent.click(button);
-      await waitFor(() =>
-        expect(mockToastError).toHaveBeenCalledWith(
-          'Could not open the billing portal. Please try again.',
-        ),
-      );
-      await waitFor(() => expect(button.disabled).toBe(false));
-    });
-
-    it('shows an error toast when the portal returns no url', async () => {
-      mockGetBillingStatus.mockResolvedValue(proStatus);
-      mockBillingPortal.mockResolvedValue({ data: null });
-      render(() => <Account />);
-      const button = (await screen.findByText('Manage subscription')) as HTMLButtonElement;
-      fireEvent.click(button);
-      await waitFor(() =>
-        expect(mockToastError).toHaveBeenCalledWith(
-          'Could not open the billing portal. Please try again.',
-        ),
-      );
-      // Placeholder tab was opened synchronously, then closed when no url came back.
-      expect(fakeTab.close).toHaveBeenCalled();
-      await waitFor(() => expect(button.disabled).toBe(false));
-    });
-
-    it('falls back to a direct window.open when the placeholder tab is blocked', async () => {
-      mockGetBillingStatus.mockResolvedValue(proStatus);
-      // Popup blocker: the synchronous placeholder open returns null.
-      (window.open as unknown as ReturnType<typeof vi.fn>).mockReturnValue(null);
-      render(() => <Account />);
-      const button = await screen.findByText('Manage subscription');
-      fireEvent.click(button);
-      await waitFor(() =>
-        expect(window.open).toHaveBeenCalledWith(
-          'https://billing.stripe.com/session',
-          '_blank',
-          'noopener,noreferrer',
-        ),
-      );
-    });
-
-    it('hides the upgrade price when Stripe price is unavailable', async () => {
-      mockGetBillingStatus.mockResolvedValue({
-        ...freeStatus,
-        priceMonthly: { amount: null, currency: null, interval: null },
-      });
-      render(() => <Account />);
-      const button = await screen.findByText(/Upgrade to Pro/);
-      expect(button.textContent).not.toContain('$');
-    });
-
-    it('shows Manage subscription on the pro plan and opens the billing portal', async () => {
-      mockGetBillingStatus.mockResolvedValue(proStatus);
-      render(() => <Account />);
-      const button = await screen.findByText('Manage subscription');
-      expect(screen.getByText('Pro · $20/mo')).toBeDefined();
-      expect(screen.getByText('Unlimited')).toBeDefined();
-      expect(
-        screen.queryByText(new RegExp(`Free: ${FREE_REQUEST_LIMIT_LABEL} requests`)),
-      ).toBeNull();
-      fireEvent.click(button);
-      expect(mockBillingPortal).toHaveBeenCalledWith({
-        returnUrl: `${window.location.origin}/account`,
-        disableRedirect: true,
-      });
-      // A placeholder tab opens synchronously (keeps user activation), then gets
-      // pointed at the portal URL once it resolves. opener is cleared for isolation.
-      expect(window.open).toHaveBeenCalledWith('about:blank', '_blank');
-      expect(fakeTab.opener).toBeNull();
-      await waitFor(() => expect(fakeTab.location.href).toBe('https://billing.stripe.com/session'));
-      await waitFor(() => expect((button as HTMLButtonElement).disabled).toBe(false));
-    });
-
-    it('shows the scheduled cancellation access date for Pro users', async () => {
-      mockGetBillingStatus.mockResolvedValue({
-        ...proStatus,
-        cancelAtPeriodEnd: true,
-        subscriptionPeriodEnd: '2026-08-15T00:00:00.000Z',
-      });
-
-      render(() => <Account />);
-
-      await screen.findByText(/You'll keep Pro access until/);
-      expect(screen.getByText(/August 15, 2026/)).toBeDefined();
-    });
-
-    it('shows unlimited labels when pro limits are null', async () => {
-      mockGetBillingStatus.mockResolvedValue({
-        ...proStatus,
-        priceMonthly: { amount: null, currency: null, interval: null },
-        requests: { used: 5000, limit: null, periodEnd: null },
-      });
-      render(() => <Account />);
-      await screen.findByText('Manage subscription');
-      expect(screen.getByText('Pro')).toBeDefined();
-      expect(screen.getByText('Unlimited')).toBeDefined();
-    });
-
-    it('shows a success toast and clears the param when ?upgraded=1 is present', async () => {
-      searchParamsState['upgraded'] = '1';
-      render(() => <Account />);
-      await waitFor(() => expect(mockToastSuccess).toHaveBeenCalledWith('Welcome to Pro!'));
-      expect(setSearchParamsFn).toHaveBeenCalledWith({ upgraded: undefined }, { replace: true });
-      expect(searchParamsState['upgraded']).toBeUndefined();
-    });
+  it('shows no billing, plan or usage-email sections', async () => {
+    const { container } = render(() => <Account />);
+    await waitFor(() => expect(mockListAccounts).toHaveBeenCalled());
+    expect(screen.queryByText('Billing')).toBeNull();
+    expect(screen.queryByText('Email preferences')).toBeNull();
+    expect(container.querySelector('#billing')).toBeNull();
+    expect(container.textContent).not.toContain('Upgrade to Pro');
   });
 });
diff --git a/packages/frontend/tests/pages/AgentProviders.test.tsx b/packages/frontend/tests/pages/AgentProviders.test.tsx
index d64e064d..acab0e01 100644
--- a/packages/frontend/tests/pages/AgentProviders.test.tsx
+++ b/packages/frontend/tests/pages/AgentProviders.test.tsx
@@ -15,14 +15,6 @@ vi.mock('@solidjs/router', () => ({
   A: (props: any) => props.children,
 }));
 
-// NoConnectionsPrompt (the empty-state fallback) gates a "Local" card on the
-// self-hosted check. Stub it so the prompt renders without a real fetch; the
-// value doesn't affect the assertions (they only look for "No providers
-// connected").
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => Promise.resolve(false),
-}));
-
 vi.mock('../../src/services/api/providers.js', () => ({
   getProviders: (...args: unknown[]) => mockGetGlobalProviders(...args),
 }));
diff --git a/packages/frontend/tests/pages/Cli.test.tsx b/packages/frontend/tests/pages/Cli.test.tsx
index 318989fb..0c37bd08 100644
--- a/packages/frontend/tests/pages/Cli.test.tsx
+++ b/packages/frontend/tests/pages/Cli.test.tsx
@@ -1,83 +1,30 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { render, waitFor } from '@solidjs/testing-library';
+import { describe, it, expect, vi } from 'vitest';
+import { render } from '@solidjs/testing-library';
 
 vi.mock('@solidjs/meta', () => ({
   Title: (props: { children?: unknown }) => <title>{String(props.children ?? '')}</title>,
   Meta: () => null,
 }));
 
-let mockIsSelfHosted = false;
-let mockPending: Promise<boolean> | null = null;
-let mockRejects = false;
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => {
-    if (mockRejects) return Promise.reject(new Error('status unavailable'));
-    if (mockPending) return mockPending;
-    return Promise.resolve(mockIsSelfHosted);
-  },
-}));
-
 import Cli, { loginCommand } from '../../src/pages/integrations/Cli';
 
 describe('loginCommand', () => {
-  it('pins the host when asked, where only the dashboard knows it', () => {
-    expect(loginCommand(true, 'https://llm.acme.internal')).toBe(
+  it('pins the host, which only the dashboard knows', () => {
+    expect(loginCommand('https://llm.acme.internal')).toBe(
       'mnfst login --url https://llm.acme.internal',
     );
   });
-
-  it('omits the flag on cloud, where the CLI already defaults there', () => {
-    expect(loginCommand(false, 'https://app.manifest.build')).toBe('mnfst login');
-  });
 });
 
 describe('CLI page', () => {
-  beforeEach(() => {
-    mockIsSelfHosted = false;
-    mockPending = null;
-    mockRejects = false;
-  });
-
   it('shows the npm install for the published package', () => {
     const { container } = render(() => <Cli />);
     expect(container.textContent).toContain('npm install -g mnfst-gateway-cli');
   });
 
-  it('shows a bare login on cloud', async () => {
-    const { container } = render(() => <Cli />);
-    // Wait for the flag to disappear, not for 'mnfst login' to appear: the
-    // pinned form contains that substring too, so it would match immediately
-    // and assert before the deployment check resolved.
-    await waitFor(() => expect(container.textContent).not.toContain('--url'));
-    expect(container.textContent).toContain('mnfst login');
-  });
-
-  it('adds the host flag on self-hosted', async () => {
-    mockIsSelfHosted = true;
+  it('shows the login command pinned to this install', () => {
     const { container } = render(() => <Cli />);
-    await waitFor(() =>
-      expect(container.textContent).toContain(`mnfst login --url ${window.location.origin}`),
-    );
-  });
-
-  it('keeps the host flag while the deployment check is still in flight', async () => {
-    let release: (v: boolean) => void = () => {};
-    mockPending = new Promise<boolean>((r) => {
-      release = r;
-    });
-    const { container } = render(() => <Cli />);
-    // Nothing has resolved yet: the explicit form is the one that works either way.
     expect(container.textContent).toContain(`mnfst login --url ${window.location.origin}`);
-    release(false);
-    await waitFor(() => expect(container.textContent).not.toContain('--url'));
-  });
-
-  it('keeps the host flag when the deployment check fails', async () => {
-    mockRejects = true;
-    const { container } = render(() => <Cli />);
-    await waitFor(() =>
-      expect(container.textContent).toContain(`mnfst login --url ${window.location.origin}`),
-    );
   });
 
   it('links to the command reference', () => {
diff --git a/packages/frontend/tests/pages/Discovery.test.tsx b/packages/frontend/tests/pages/Discovery.test.tsx
index 826bc845..363fb82e 100644
--- a/packages/frontend/tests/pages/Discovery.test.tsx
+++ b/packages/frontend/tests/pages/Discovery.test.tsx
@@ -2,12 +2,9 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { render, screen, fireEvent, waitFor } from '@solidjs/testing-library';
 
 const mockNavigate = vi.fn();
-const mockCheckIsSelfHosted = vi.fn();
 const mockIsDiscoveryRequired = vi.fn();
 const mockCompleteDiscovery = vi.fn();
 const mockMarkDiscoveryPending = vi.fn();
-const mockClearDiscoveryPending = vi.fn();
-const mockIsConfirmedNotSelfHosted = vi.fn();
 let mockSearchParams: Record<string, string | string[] | undefined> = {};
 
 vi.mock('@solidjs/router', () => ({
@@ -29,10 +26,6 @@ vi.mock('../../src/services/auth-client.js', () => ({
   },
 }));
 
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: (...args: unknown[]) => mockCheckIsSelfHosted(...args),
-}));
-
 vi.mock('../../src/services/discovery.js', async (importOriginal) => {
   const actual = await importOriginal<typeof import('../../src/services/discovery.js')>();
   return {
@@ -40,8 +33,6 @@ vi.mock('../../src/services/discovery.js', async (importOriginal) => {
     isDiscoveryRequired: (...args: unknown[]) => mockIsDiscoveryRequired(...args),
     completeDiscovery: (...args: unknown[]) => mockCompleteDiscovery(...args),
     markDiscoveryPending: (...args: unknown[]) => mockMarkDiscoveryPending(...args),
-    clearDiscoveryPending: (...args: unknown[]) => mockClearDiscoveryPending(...args),
-    isConfirmedNotSelfHosted: (...args: unknown[]) => mockIsConfirmedNotSelfHosted(...args),
   };
 });
 
@@ -51,10 +42,8 @@ describe('Discovery page', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mockSearchParams = {};
-    mockCheckIsSelfHosted.mockResolvedValue(true);
     mockIsDiscoveryRequired.mockResolvedValue(true);
     mockCompleteDiscovery.mockResolvedValue(undefined);
-    mockIsConfirmedNotSelfHosted.mockResolvedValue(true);
   });
 
   async function renderForm() {
@@ -65,26 +54,10 @@ describe('Discovery page', () => {
     return result;
   }
 
-  it('redirects to the dashboard on non-self-hosted deployments', async () => {
-    mockCheckIsSelfHosted.mockResolvedValue(false);
-    render(() => <Discovery />);
-    await waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/', { replace: true });
-    });
-    expect(mockIsDiscoveryRequired).not.toHaveBeenCalled();
-    expect(screen.queryByText('Help us understand who uses Manifest')).toBeNull();
-    // The pending marker is dropped so the guards cannot loop back here.
-    expect(mockClearDiscoveryPending).toHaveBeenCalledWith('u1');
-  });
-
-  it('behaves as self-hosted when the non-self-hosted answer is unconfirmed', async () => {
-    mockCheckIsSelfHosted.mockResolvedValue(false);
-    mockIsConfirmedNotSelfHosted.mockResolvedValue(false);
+  it('shows the form without any deployment-mode check', async () => {
     await renderForm();
-    // No redirect and no marker loss: leaving while the marker stands would
-    // let the guards loop the user back here forever.
     expect(mockNavigate).not.toHaveBeenCalled();
-    expect(mockClearDiscoveryPending).not.toHaveBeenCalled();
+    expect(mockIsDiscoveryRequired).toHaveBeenCalledWith('u1');
   });
 
   it('redirects to next when the step was already completed', async () => {
diff --git a/packages/frontend/tests/pages/FreeModels.test.tsx b/packages/frontend/tests/pages/FreeModels.test.tsx
deleted file mode 100644
index 6ab3b9e8..00000000
--- a/packages/frontend/tests/pages/FreeModels.test.tsx
+++ /dev/null
@@ -1,359 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { render, screen, fireEvent } from '@solidjs/testing-library';
-
-vi.mock('@solidjs/router', () => ({
-  useParams: () => ({ agentName: 'test-agent' }),
-}));
-
-vi.mock('@solidjs/meta', () => ({
-  Title: (props: any) => <title>{props.children}</title>,
-  Meta: (props: any) => <meta name={props.name ?? ''} content={props.content ?? ''} />,
-}));
-
-vi.mock('../../src/services/toast-store.js', () => ({
-  toast: { success: vi.fn(), error: vi.fn() },
-}));
-
-vi.mock('../../src/services/agent-display-name.js', () => ({
-  agentDisplayName: () => 'test-agent',
-}));
-
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: vi.fn().mockResolvedValue(false),
-}));
-
-vi.mock('../../src/services/providers.js', () => ({
-  PROVIDERS: [
-    { id: 'ollama', name: 'Ollama', localOnly: true, color: '#1a1a1a', initial: 'Ol', subtitle: '', keyPrefix: '', minKeyLength: 0, keyPlaceholder: '', noKeyRequired: true, models: [] },
-    { id: 'gemini', name: 'Google', color: '#4285f4', initial: 'G', subtitle: '', keyPrefix: '', minKeyLength: 30, keyPlaceholder: '', models: [] },
-    { id: 'nvidia', name: 'NVIDIA NIM', color: '#76B900', initial: 'Nv', subtitle: '', keyPrefix: '', minKeyLength: 20, keyPlaceholder: 'nvapi-...', models: [] },
-  ],
-}));
-
-vi.mock('../../src/services/api/free-models.js', () => ({
-  getFreeModels: vi.fn().mockResolvedValue({
-    providers: [
-      {
-        name: 'Cohere',
-        logo: '/icons/cohere.svg',
-        description: 'Free trial API key.',
-        tags: ['Up to 1,000 calls/month', 'No credit card required'],
-        api_key_url: 'https://dashboard.cohere.com/api-keys',
-        base_url: 'https://api.cohere.ai/compatibility/v1',
-        warning: 'Trial keys cannot be used for production or commercial workloads.',
-        country: 'CA',
-        flag: '\u{1F1E8}\u{1F1E6}',
-        models: [
-          { id: 'command-a-03-2025', name: 'Command A (111B)', context: '256K', max_output: '8K', modality: 'Text', rate_limit: '20 RPM' },
-          { id: 'command-a-reasoning-08-2025', name: 'Command A Reasoning', context: '256K', max_output: '32K', modality: 'Text', rate_limit: '20 RPM' },
-          { id: null, name: '+ 4 more models', context: 'Varies', max_output: 'Varies', modality: 'Text', rate_limit: '' },
-        ],
-      },
-      {
-        name: 'Google Gemini',
-        logo: '/icons/gemini.svg',
-        description: 'Free tier from Google.',
-        tags: ['250K TPM (Tokens / Minute) shared across models', 'No credit card required'],
-        api_key_url: 'https://aistudio.google.com/apikey',
-        base_url: 'https://generativelanguage.googleapis.com/v1beta/openai/',
-        warning: 'Rate limits apply per Google Cloud project.',
-        country: 'US',
-        flag: '\u{1F1FA}\u{1F1F8}',
-        models: [
-          { id: 'gemini-2.5-flash', name: 'Gemini 2.5 Flash', context: '1M', max_output: '65K', modality: 'Text + Image', rate_limit: '10 RPM' },
-          { id: 'gemini-2.5-flash-lite', name: 'Gemini 2.5 Flash-Lite', context: '1M', max_output: '65K', modality: 'Text + Image', rate_limit: '' },
-        ],
-      },
-      {
-        name: 'GitHub Models',
-        logo: '/icons/github.svg',
-        description: 'Free tier from GitHub.',
-        tags: [],
-        api_key_url: 'https://github.com/settings/tokens',
-        base_url: null,
-        warning: null,
-        country: 'US',
-        flag: '\u{1F1FA}\u{1F1F8}',
-        models: [
-          { id: 'gpt-4o', name: 'GPT-4o', context: '128K', max_output: '16K', modality: 'Text', rate_limit: '10 RPM' },
-        ],
-      },
-      {
-        name: 'NVIDIA NIM',
-        logo: '/icons/nvidia.svg',
-        description: 'Free tier on NVIDIA-hosted NIM endpoints.',
-        tags: ['Hosted API key access'],
-        api_key_url: 'https://build.nvidia.com/settings/api-keys',
-        base_url: 'https://integrate.api.nvidia.com/v1',
-        warning: null,
-        country: 'US',
-        flag: '\u{1F1FA}\u{1F1F8}',
-        models: [
-          { id: 'nvidia/nemotron-3-super-120b-a12b', name: 'Nemotron 3 Super', context: '128K', max_output: '8K', modality: 'Text', rate_limit: '' },
-        ],
-      },
-      {
-        name: 'Ollama Cloud',
-        logo: '/icons/ollama.svg',
-        description: 'Free tier with qualitative usage limits.',
-        tags: [],
-        api_key_url: 'https://ollama.com/settings/keys',
-        base_url: 'https://api.ollama.com',
-        warning: null,
-        country: 'US',
-        flag: '\u{1F1FA}\u{1F1F8}',
-        models: [
-          { id: 'llama3.1:cloud', name: 'llama3.1', context: '128K', max_output: '8K', modality: 'Text', rate_limit: '30 RPM' },
-        ],
-      },
-    ],
-    last_synced_at: '2026-04-17T00:00:00.000Z',
-  }),
-}));
-
-import FreeModels from '../../src/pages/FreeModels';
-import { toast } from '../../src/services/toast-store.js';
-
-describe('FreeModels', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it('renders the page title and header', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Free Models')).toBeDefined();
-    });
-  });
-
-  it('renders step instructions', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Get your free API key from the provider website')).toBeDefined();
-      expect(screen.getByText('Hit the provider Connect button, paste your key, and validate the connection')).toBeDefined();
-      expect(screen.getByText(/Done! The provider models are now included in your routing/)).toBeDefined();
-    });
-  });
-
-  it('renders Cohere provider card with name and logo', async () => {
-    const { container } = render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Cohere')).toBeDefined();
-      const img = container.querySelector('img[src="/icons/cohere.svg"]');
-      expect(img).not.toBeNull();
-    });
-  });
-
-  it('renders provider tags', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Up to 1,000 calls/month')).toBeDefined();
-      expect(screen.getAllByText('No credit card required').length).toBe(2);
-    });
-  });
-
-  it('renders Get API key link', async () => {
-    const { container } = render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      const link = container.querySelector('a[href="https://dashboard.cohere.com/api-keys"]');
-      expect(link).not.toBeNull();
-      expect(link!.getAttribute('target')).toBe('_blank');
-      expect(link!.textContent).toContain('Get API key');
-    });
-  });
-
-  it('renders Connect button with link to routing page', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      const connectBtn = screen.getByText('Connect Cohere');
-      expect(connectBtn.tagName).toBe('A');
-      const href = connectBtn.getAttribute('href')!;
-      expect(href).toContain('/harnesses/test-agent/routing?');
-      expect(href).toContain('provider=custom');
-      expect(href).toContain('name=Cohere');
-      expect(href).toContain('command-a-03-2025');
-    });
-  });
-
-  it('renders base URL with copy button for providers that have one', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getAllByText('Base URL:').length).toBe(4);
-      expect(screen.getByText('https://api.cohere.ai/compatibility/v1')).toBeDefined();
-    });
-  });
-
-  it('does not render base URL or Connect for providers without baseUrl', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('GitHub Models')).toBeDefined();
-      expect(screen.queryByText('Connect GitHub Models')).toBeNull();
-    });
-  });
-
-  it('shows description for providers without tags', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Free tier from GitHub.')).toBeDefined();
-    });
-  });
-
-  it('renders model table with model IDs', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('command-a-03-2025')).toBeDefined();
-      expect(screen.getByText('command-a-reasoning-08-2025')).toBeDefined();
-    });
-  });
-
-  it('renders warning message', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText(/Trial keys cannot be used/)).toBeDefined();
-    });
-  });
-
-  it('renders Gemini provider card', async () => {
-    const { container } = render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Google Gemini')).toBeDefined();
-      const img = container.querySelector('img[src="/icons/gemini.svg"]');
-      expect(img).not.toBeNull();
-    });
-  });
-
-  it('renders Gemini Connect button linking to built-in provider', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      const connectBtn = screen.getByText('Connect Google Gemini');
-      expect(connectBtn.tagName).toBe('A');
-      const href = connectBtn.getAttribute('href')!;
-      expect(href).toContain('provider=gemini');
-    });
-  });
-
-  it('renders NVIDIA NIM Connect button linking to built-in provider', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      const connectBtn = screen.getByText('Connect NVIDIA NIM');
-      expect(connectBtn.tagName).toBe('A');
-      const href = connectBtn.getAttribute('href')!;
-      expect(href).toContain('provider=nvidia');
-      expect(href).not.toContain('provider=custom');
-    });
-  });
-
-  it('toggles model visibility when clicking toggle button', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getAllByText(/Show models/).length).toBeGreaterThan(0);
-    });
-    fireEvent.click(screen.getAllByText(/Show models/)[0]);
-    await vi.waitFor(() => {
-      expect(screen.getAllByText('Hide models').length).toBeGreaterThan(0);
-    });
-  });
-
-  it('copies base URL to clipboard on Copy click', async () => {
-    const mockWriteText = vi.fn().mockResolvedValue(undefined);
-    Object.assign(navigator, { clipboard: { writeText: mockWriteText } });
-
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getAllByText('Copy').length).toBeGreaterThan(0);
-    });
-    fireEvent.click(screen.getAllByText('Copy')[0]);
-
-    await vi.waitFor(() => {
-      expect(mockWriteText).toHaveBeenCalledWith('https://api.cohere.ai/compatibility/v1');
-      expect(toast.success).toHaveBeenCalledWith('Copied to clipboard');
-    });
-  });
-
-  it('filters out models without an id', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('command-a-03-2025')).toBeDefined();
-      expect(screen.queryByText('+ 4 more models')).toBeNull();
-    });
-  });
-
-  it('shows model count excluding models without id', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      const buttons = screen.getAllByText(/Show models/);
-      expect(buttons[0].textContent).toContain('Show models (2)');
-    });
-  });
-
-  it('shows dash for missing rate_limit', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('gemini-2.5-flash-lite')).toBeDefined();
-      const row = screen.getByText('gemini-2.5-flash-lite').closest('tr')!;
-      const cells = row.querySelectorAll('td');
-      expect(cells[4].textContent).toBe('\u2014');
-    });
-  });
-
-  it('shows error toast when clipboard fails', async () => {
-    const mockWriteText = vi.fn().mockRejectedValue(new Error('fail'));
-    Object.assign(navigator, { clipboard: { writeText: mockWriteText } });
-
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getAllByText('Copy').length).toBeGreaterThan(0);
-    });
-    fireEvent.click(screen.getAllByText('Copy')[0]);
-
-    await vi.waitFor(() => {
-      expect(toast.error).toHaveBeenCalledWith('Failed to copy');
-    });
-  });
-
-  it('renders built-in provider connect link for known providers', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      const connectBtn = screen.getByText('Connect Google Gemini');
-      const href = connectBtn.getAttribute('href')!;
-      expect(href).toContain('provider=gemini');
-      expect(href).not.toContain('provider=custom');
-    });
-  });
-
-  it('renders dark mode logo variant for providers with dark logos', async () => {
-    const { container } = render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      const darkLogo = container.querySelector('img.free-models-logo-dark');
-      expect(darkLogo).not.toBeNull();
-      expect(darkLogo!.getAttribute('src')).toContain('-dark-mode');
-    });
-  });
-
-  it('renders disabled connect button for Ollama Cloud in cloud mode', async () => {
-    const { container } = render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      const disabled = container.querySelector('.free-models-disabled-btn');
-      expect(disabled).not.toBeNull();
-      expect(disabled!.textContent).toContain('Connect Ollama Cloud');
-      expect(disabled!.getAttribute('data-tooltip')).toBe(
-        'Available on the self-hosted version only',
-      );
-    });
-  });
-
-  it('renders show models toggle for providers without base_url', async () => {
-    render(() => <FreeModels />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('GitHub Models')).toBeDefined();
-    });
-    // GitHub Models has no base_url, so the toggle is rendered outside the base-url row
-    const buttons = screen.getAllByText(/Show models/);
-    const ghButton = buttons.find((b) => b.textContent?.includes('(1)'));
-    expect(ghButton).toBeDefined();
-    fireEvent.click(ghButton!);
-    await vi.waitFor(() => {
-      expect(screen.getByText('gpt-4o')).toBeDefined();
-    });
-  });
-});
diff --git a/packages/frontend/tests/pages/GlobalOverviewFilter.test.tsx b/packages/frontend/tests/pages/GlobalOverviewFilter.test.tsx
index 8cfa27ce..8bd466eb 100644
--- a/packages/frontend/tests/pages/GlobalOverviewFilter.test.tsx
+++ b/packages/frontend/tests/pages/GlobalOverviewFilter.test.tsx
@@ -17,7 +17,6 @@ const apiMocks = vi.hoisted(() => ({
   getOverviewDetails: vi.fn(),
   getOverviewAgentUsage: vi.fn(),
   getOverviewProviderUsage: vi.fn(),
-  getBillingStatus: vi.fn(),
   navigate: vi.fn(),
 }));
 
@@ -34,7 +33,6 @@ let filterSelectProps: {
   items: string[];
 } | null = null;
 let providerChartProps: Record<string, unknown> | null = null;
-let mockSearchParams: Record<string, string | undefined> = {};
 
 vi.mock('@solidjs/meta', () => ({
   Title: (props: { children: unknown }) => <title>{props.children}</title>,
@@ -47,7 +45,6 @@ vi.mock('@solidjs/router', () => ({
     </a>
   ),
   useNavigate: () => apiMocks.navigate,
-  useSearchParams: () => [mockSearchParams],
 }));
 
 vi.mock('../../src/services/api.js', async () => {
@@ -127,10 +124,6 @@ vi.mock('../../src/services/api/analytics.js', () => ({
   getErrorBreakdown: () => Promise.resolve({ by_class: {}, by_origin: {}, auto_fixed: 0 }),
 }));
 
-vi.mock('../../src/services/api/billing.js', () => ({
-  getBillingStatus: (...args: unknown[]) => apiMocks.getBillingStatus(...args),
-}));
-
 vi.mock('../../src/services/auth-client.js', () => ({
   authClient: {
     useSession: () => () => ({
@@ -261,11 +254,6 @@ vi.mock('manifest-shared', () => ({
   platformIcon: () => 'robot',
 }));
 
-let mockIsSelfHosted = false;
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => Promise.resolve(mockIsSelfHosted),
-}));
-
 import GlobalOverview from '../../src/pages/GlobalOverview';
 
 const overviewResponse = {
@@ -338,10 +326,8 @@ beforeEach(() => {
   localStorage.clear();
   sessionStorage.clear();
   localStorage.setItem('manifest_global_group', 'provider');
-  mockIsSelfHosted = false;
   filterSelectProps = null;
   providerChartProps = null;
-  mockSearchParams = {};
   sseMocks.reset?.();
 
   apiMocks.getAgents.mockResolvedValue(agentsResponse);
@@ -351,14 +337,6 @@ beforeEach(() => {
   apiMocks.getOverviewDetails.mockResolvedValue({});
   apiMocks.getOverviewAgentUsage.mockResolvedValue(providerUsageTimeseries);
   apiMocks.getOverviewProviderUsage.mockResolvedValue(providerUsageTimeseries);
-  apiMocks.getBillingStatus.mockResolvedValue({
-    enabled: false,
-    plan: 'free',
-    priceMonthly: { amount: null, currency: null, interval: null },
-    requests: { used: null, limit: null, periodEnd: null },
-    cancelAtPeriodEnd: false,
-    subscriptionPeriodEnd: null,
-  });
 });
 
 afterEach(() => {
@@ -449,25 +427,4 @@ describe('GlobalOverview filter onUnselectAll', () => {
       );
     });
   });
-
-  it('opens the Pro success modal when upgraded=1 is present', async () => {
-    const replaceState = vi.spyOn(window.history, 'replaceState').mockImplementation(() => {});
-    mockSearchParams = { upgraded: '1' };
-
-    try {
-      render(() => <GlobalOverview />);
-
-      await waitFor(() => expect(localStorage.getItem('manifest_plan_chosen_u1')).toBe('1'));
-      await waitFor(() =>
-        expect(document.body.textContent).toContain("You're now on the Pro plan"),
-      );
-
-      await waitFor(() => expect(document.querySelector('.modal-backdrop')).not.toBeNull());
-      fireEvent.click(document.querySelector('.modal-backdrop')!);
-
-      expect(replaceState).toHaveBeenCalledWith(null, '', '/overview');
-    } finally {
-      replaceState.mockRestore();
-    }
-  });
 });
diff --git a/packages/frontend/tests/pages/Limits-interactions.test.tsx b/packages/frontend/tests/pages/Limits-interactions.test.tsx
index aa8a9fd2..460bcf71 100644
--- a/packages/frontend/tests/pages/Limits-interactions.test.tsx
+++ b/packages/frontend/tests/pages/Limits-interactions.test.tsx
@@ -26,7 +26,6 @@ vi.mock("../../src/services/api.js", () => ({
 }));
 
 vi.mock("../../src/services/setup-status.js", () => ({
-  checkIsSelfHosted: vi.fn(() => Promise.resolve(false)),
   checkEmailConfigured: vi.fn(() => Promise.resolve(true)),
 }));
 
@@ -44,11 +43,6 @@ vi.mock("../../src/components/LimitRuleModal.js", () => ({
   ),
 }));
 
-vi.mock("../../src/components/CloudEmailInfo.js", () => ({
-  default: (props: any) => (
-    <div data-testid="cloud-email-info">CloudEmailInfo: {props.email}</div>
-  ),
-}));
 
 vi.mock("../../src/services/auth-client.js", () => ({
   authClient: {
diff --git a/packages/frontend/tests/pages/Limits.test.tsx b/packages/frontend/tests/pages/Limits.test.tsx
index 517f8007..6b265d39 100644
--- a/packages/frontend/tests/pages/Limits.test.tsx
+++ b/packages/frontend/tests/pages/Limits.test.tsx
@@ -13,7 +13,6 @@ vi.mock("@solidjs/meta", () => ({
 
 let mockRules: any[] = [];
 let mockRoutingStatus = { enabled: false };
-let mockIsSelfHosted = false;
 let mockEmailProvider: any = null;
 let mockRemoveFails = false;
 let mockProviderFetchFails = false;
@@ -32,7 +31,6 @@ vi.mock("../../src/services/api.js", () => ({
 }));
 
 vi.mock("../../src/services/setup-status.js", () => ({
-  checkIsSelfHosted: vi.fn(() => Promise.resolve(mockIsSelfHosted)),
   checkEmailConfigured: vi.fn(() => Promise.resolve(true)),
 }));
 
@@ -81,25 +79,12 @@ vi.mock("../../src/components/LimitRuleModal.js", () => ({
   ),
 }));
 
-vi.mock("../../src/components/CloudEmailInfo.js", () => ({
-  default: (props: any) => (
-    <div data-testid="cloud-email-info">CloudEmailInfo: {props.email}</div>
-  ),
-}));
-
-vi.mock("../../src/services/auth-client.js", () => ({
-  authClient: {
-    useSession: () => () => ({ data: { user: { email: "user@example.com" } } }),
-  },
-}));
-
 import Limits from "../../src/pages/Limits";
 
 describe("Limits page", () => {
   beforeEach(() => {
     mockRules = [];
     mockRoutingStatus = { enabled: false };
-    mockIsSelfHosted = false;
     mockEmailProvider = null;
     mockRemoveFails = false;
     mockProviderFetchFails = false;
@@ -172,22 +157,6 @@ describe("Limits page", () => {
     });
   });
 
-  it("shows cloud email info", async () => {
-    render(() => <Limits />);
-    // The email block waits for the deployment mode, so the cloud card only
-    // appears once checkIsSelfHosted() has resolved.
-    await waitFor(() => {
-      expect(screen.getByTestId("cloud-email-info")).toBeDefined();
-    });
-  });
-
-  it("passes session email to cloud email info", async () => {
-    const { container } = render(() => <Limits />);
-    await waitFor(() => {
-      expect(container.textContent).toContain("user@example.com");
-    });
-  });
-
   it("renders modal component", async () => {
     render(() => <Limits />);
 
@@ -580,9 +549,7 @@ describe("Limits page", () => {
     });
   });
 
-
-  it("shows the email provider section instead of the cloud card on self-hosted", async () => {
-    mockIsSelfHosted = true;
+  it("always shows the email provider section, never a cloud email card", async () => {
     render(() => <Limits />);
     await waitFor(() => {
       expect(screen.getByTestId("email-provider-section")).toBeDefined();
@@ -590,17 +557,7 @@ describe("Limits page", () => {
     expect(screen.queryByTestId("cloud-email-info")).toBeNull();
   });
 
-  it("keeps the cloud email card on cloud", async () => {
-    mockIsSelfHosted = false;
-    render(() => <Limits />);
-    await waitFor(() => {
-      expect(screen.getByTestId("cloud-email-info")).toBeDefined();
-    });
-    expect(screen.queryByTestId("email-provider-section")).toBeNull();
-  });
-
   it("opens the edit modal with the saved provider's details and closes it", async () => {
-    mockIsSelfHosted = true;
     mockEmailProvider = { provider: "mailgun", keyPrefix: "key-", domain: "mg.example.com", notificationEmail: "ops@example.com" };
     render(() => <Limits />);
     await waitFor(() => {
@@ -619,7 +576,6 @@ describe("Limits page", () => {
   });
 
   it("refetches the provider after the modal saves or the setup completes", async () => {
-    mockIsSelfHosted = true;
     render(() => <Limits />);
     await waitFor(() => {
       expect(screen.getByTestId("email-provider-section")).toBeDefined();
@@ -638,7 +594,6 @@ describe("Limits page", () => {
   });
 
   it("removes the provider, warns about email rules, and closes the confirm dialog", async () => {
-    mockIsSelfHosted = true;
     mockEmailProvider = { provider: "resend" };
     mockRules = [{ id: "r1", metric_type: "tokens", threshold: 100, period: "day", action: "notify", is_active: true, trigger_count: 0 }];
     render(() => <Limits />);
@@ -665,7 +620,6 @@ describe("Limits page", () => {
   });
 
   it("keeps the confirm dialog open and recovers when the removal fails", async () => {
-    mockIsSelfHosted = true;
     mockEmailProvider = { provider: "resend" };
     mockRemoveFails = true;
     render(() => <Limits />);
@@ -693,7 +647,6 @@ describe("Limits page", () => {
   it("keeps the page up when the provider config fails to load", async () => {
     // Reading an errored Solid resource re-throws. Every read goes through the
     // guarded accessor, so a failed fetch reads as "no provider saved".
-    mockIsSelfHosted = true;
     mockProviderFetchFails = true;
     render(() => <Limits />);
     // data-has-provider is also "false" while the fetch is still in flight, so
@@ -707,7 +660,6 @@ describe("Limits page", () => {
   });
 
   it("stays up when the refresh after a successful removal fails", async () => {
-    mockIsSelfHosted = true;
     mockEmailProvider = { provider: "resend", keyPrefix: "re_abc" };
     render(() => <Limits />);
     await waitFor(() => {
diff --git a/packages/frontend/tests/pages/Login.test.tsx b/packages/frontend/tests/pages/Login.test.tsx
index b1f7f7c5..ef0320a3 100644
--- a/packages/frontend/tests/pages/Login.test.tsx
+++ b/packages/frontend/tests/pages/Login.test.tsx
@@ -96,9 +96,9 @@ describe('Login', () => {
   });
 
   it('preserves the query string on the register link', () => {
-    mockLocationSearch = '?plan=pro';
+    mockLocationSearch = '?redirect=%2Fmessages';
     const { container } = render(() => <Login />);
-    expect(container.querySelector('a[href="/register?plan=pro"]')).not.toBeNull();
+    expect(container.querySelector('a[href="/register?redirect=%2Fmessages"]')).not.toBeNull();
   });
 
   it('has forgot password link', () => {
@@ -230,7 +230,7 @@ describe('Login', () => {
     });
   });
 
-  it('redirects to upgrade after successful pro-intent login', async () => {
+  it('uses a safe redirect after successful login', async () => {
     const locationSpy = vi.spyOn(window, 'location', 'get').mockReturnValue({
       ...window.location,
       href: '',
@@ -238,7 +238,7 @@ describe('Login', () => {
     const hrefSetter = vi.fn();
     Object.defineProperty(window.location, 'href', { set: hrefSetter, configurable: true });
 
-    mockSearchParams = { plan: 'pro' };
+    mockSearchParams = { redirect: '/messages?range=30d' };
     mockSignInEmail.mockResolvedValue({ error: null });
     const { container } = render(() => <Login />);
     fireEvent.input(container.querySelector('input[type="email"]')!, {
@@ -249,32 +249,7 @@ describe('Login', () => {
     });
     fireEvent.submit(container.querySelector('form')!);
     await vi.waitFor(() => {
-      expect(hrefSetter).toHaveBeenCalledWith('/upgrade');
-    });
-
-    locationSpy.mockRestore();
-  });
-
-  it('uses a safe redirect before pro intent after successful login', async () => {
-    const locationSpy = vi.spyOn(window, 'location', 'get').mockReturnValue({
-      ...window.location,
-      href: '',
-    });
-    const hrefSetter = vi.fn();
-    Object.defineProperty(window.location, 'href', { set: hrefSetter, configurable: true });
-
-    mockSearchParams = { redirect: '/upgrade?reason=requests', plan: 'pro' };
-    mockSignInEmail.mockResolvedValue({ error: null });
-    const { container } = render(() => <Login />);
-    fireEvent.input(container.querySelector('input[type="email"]')!, {
-      target: { value: 't@t.com' },
-    });
-    fireEvent.input(container.querySelector('input[type="password"]')!, {
-      target: { value: 'password123' },
-    });
-    fireEvent.submit(container.querySelector('form')!);
-    await vi.waitFor(() => {
-      expect(hrefSetter).toHaveBeenCalledWith('/upgrade?reason=requests');
+      expect(hrefSetter).toHaveBeenCalledWith('/messages?range=30d');
     });
 
     locationSpy.mockRestore();
@@ -304,8 +279,8 @@ describe('Login', () => {
     locationSpy.mockRestore();
   });
 
-  it('resends unverified pro logins with an upgrade callback', async () => {
-    mockSearchParams = { plan: 'pro' };
+  it('resends unverified logins with the redirect as callback', async () => {
+    mockSearchParams = { redirect: '/messages' };
     mockSignInEmail.mockResolvedValue({
       error: { message: 'Email is not verified', code: 'EMAIL_NOT_VERIFIED' },
     });
@@ -328,7 +303,7 @@ describe('Login', () => {
     await vi.waitFor(() => {
       expect(mockSendVerificationEmail).toHaveBeenCalledWith({
         email: 'user@test.com',
-        callbackURL: '/upgrade',
+        callbackURL: '/messages',
       });
     });
   });
@@ -357,7 +332,7 @@ describe('Login', () => {
   });
 
   it('offers email verification after an unlinked social login', async () => {
-    mockSearchParams = { oauth: 'failed', error: 'account_not_linked', redirect: '/upgrade' };
+    mockSearchParams = { oauth: 'failed', error: 'account_not_linked', redirect: '/messages' };
     mockSendVerificationEmail.mockResolvedValue({ error: null });
     const { container } = render(() => <Login />);
     await vi.waitFor(() => {
@@ -374,7 +349,7 @@ describe('Login', () => {
     await vi.waitFor(() => {
       expect(mockSendVerificationEmail).toHaveBeenCalledWith({
         email: 'user@test.com',
-        callbackURL: '/upgrade',
+        callbackURL: '/messages',
       });
       expect(container.textContent).toContain('Verification email sent');
     });
diff --git a/packages/frontend/tests/pages/McpServer.test.tsx b/packages/frontend/tests/pages/McpServer.test.tsx
index 62491af3..91b95a4d 100644
--- a/packages/frontend/tests/pages/McpServer.test.tsx
+++ b/packages/frontend/tests/pages/McpServer.test.tsx
@@ -15,15 +15,9 @@ vi.mock('../../src/services/setup-status.js', () => ({
 }));
 
 import McpServer, { clientSetups } from '../../src/pages/integrations/McpServer';
-import { mcpEndpoint, installOrigin, setupOrigin } from '../../src/services/install-endpoints';
+import { mcpEndpoint, installOrigin } from '../../src/services/install-endpoints';
 
 describe('install-endpoints', () => {
-  it('uses app for new Cloud setup on either Cloud host', () => {
-    expect(setupOrigin('https://app.manifest.build')).toBe('https://app.manifest.build');
-    expect(setupOrigin('https://gateway.manifest.build')).toBe('https://app.manifest.build');
-    expect(setupOrigin('https://manifest.example.com')).toBe('https://manifest.example.com');
-  });
-
   it('derives the origin from the browser', () => {
     expect(installOrigin()).toBe(window.location.origin);
   });
diff --git a/packages/frontend/tests/pages/MessageLog.test.tsx b/packages/frontend/tests/pages/MessageLog.test.tsx
index 8a84b33d..8d50518e 100644
--- a/packages/frontend/tests/pages/MessageLog.test.tsx
+++ b/packages/frontend/tests/pages/MessageLog.test.tsx
@@ -152,8 +152,6 @@ vi.mock('../../src/components/MultiSelect.jsx', () => ({
   ),
 }));
 
-import { resetPlanStore } from '../../src/services/plan-store';
-
 vi.mock('../../src/services/sse.js', () => ({
   pingCount: () => 0,
   messagePing: () => pingBox.read(),
@@ -181,11 +179,6 @@ vi.mock('../../src/services/formatters.js', () => ({
     Object.entries(h ?? {}).sort(([a], [b]) => a.localeCompare(b)),
 }));
 
-const mockCheckIsSelfHosted = vi.fn(() => Promise.resolve(false));
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => mockCheckIsSelfHosted(),
-}));
-
 vi.mock('../../src/components/SetupModal.jsx', () => ({
   default: (props: any) => (
     <div
@@ -337,7 +330,6 @@ describe('MessageLog', () => {
     const [ping, setPing] = createSignal(0);
     pingBox.read = ping;
     pingBox.set = setPing;
-    resetPlanStore({ enabled: false, plan: 'free' });
   });
 
   it('renders Requests heading', () => {
@@ -754,22 +746,17 @@ describe('MessageLog', () => {
     expect(mockSetSearchParams).toHaveBeenCalledWith({ range: '7d' }, { replace: true });
   });
 
-  it('clamps a Pro-range deep link before loading data for a free plan', async () => {
+  it('honours a long-range deep link as is, with no plan clamp', async () => {
     mockSearchParams = { range: '365d' };
-    // The plan store is resolved by AuthGuard before any page mounts, so the
-    // clamp is synchronous — no fetch ever goes out at the PRO range.
-    resetPlanStore({ enabled: true, plan: 'free' });
     mockGetMessages.mockResolvedValue(messagesData);
 
     render(() => <MessageLog />);
 
     await vi.waitFor(() => {
-      expect(mockGetMessages).toHaveBeenCalledWith(expect.objectContaining({ range: '7d' }));
-    });
-    expect(mockGetMessages).not.toHaveBeenCalledWith(expect.objectContaining({ range: '365d' }));
-    await vi.waitFor(() => {
-      expect(mockSetSearchParams).toHaveBeenCalledWith({ range: '7d' }, { replace: true });
+      expect(mockGetMessages).toHaveBeenCalledWith(expect.objectContaining({ range: '365d' }));
     });
+    expect(mockGetMessages).not.toHaveBeenCalledWith(expect.objectContaining({ range: '7d' }));
+    expect(mockSetSearchParams).not.toHaveBeenCalledWith({ range: '7d' }, { replace: true });
   });
 
   it('filters messages by attempt status (plain select, URL-synced)', async () => {
diff --git a/packages/frontend/tests/pages/Overview.test.tsx b/packages/frontend/tests/pages/Overview.test.tsx
index d9d19b2e..5f486943 100644
--- a/packages/frontend/tests/pages/Overview.test.tsx
+++ b/packages/frontend/tests/pages/Overview.test.tsx
@@ -77,11 +77,6 @@ vi.mock('../../src/services/formatters.js', () => ({
   customProviderColor: vi.fn(() => '#6366f1'),
 }));
 
-const mockCheckIsSelfHosted = vi.fn(() => Promise.resolve(false));
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => mockCheckIsSelfHosted(),
-}));
-
 // The per-agent Overview renders ProviderChartCard → MultiAgentTokenChart.
 // Stub the chart to a marker exposing its series, and the per-view provider
 // timeseries endpoints to a controllable resolver.
@@ -134,7 +129,6 @@ vi.mock('../../src/services/api/routing.js', () => ({
   getAutofix: () => Promise.resolve({ enabled: false }),
 }));
 
-import { resetPlanStore } from '../../src/services/plan-store';
 
 vi.mock('../../src/components/MultiAgentTokenChart.jsx', () => ({
   AGENT_COLORS: ['#111111', '#222222', '#333333'],
@@ -198,7 +192,6 @@ vi.mock('../../src/components/Select.jsx', () => ({
       {props.options?.map((o: any) => (
         <option value={o.value} disabled={o.disabled}>
           {o.label}
-          {o.badge ? ' - PRO' : ''}
         </option>
       ))}
     </select>
@@ -294,7 +287,6 @@ describe('Overview', () => {
     });
     mockGetCustomProviders.mockResolvedValue([]);
     mockPerProvider.mockResolvedValue({ agents: [], timeseries: [] });
-    resetPlanStore({ enabled: false, plan: 'free' });
   });
 
   it('renders Overview heading with agent name', () => {
@@ -1104,29 +1096,25 @@ describe('Overview', () => {
       });
     });
 
-    it('limits Free users to 7-day dashboard ranges and labels longer ranges as Pro-only', async () => {
+    it('offers every range, long windows included, with no plan lock', async () => {
       localStorage.setItem('manifest_chart_range', '365d');
-      resetPlanStore({ enabled: true, plan: 'free' });
       mockGetOverview.mockResolvedValue(overviewData);
 
       const { container } = render(() => <Overview />);
 
       await vi.waitFor(() => {
-        expect(mockGetOverview).toHaveBeenCalledWith('7d', 'test-agent', true);
-      });
-      await vi.waitFor(() => {
-        expect(localStorage.getItem('manifest_chart_range')).toBe('7d');
+        expect(mockGetOverview).toHaveBeenCalledWith('365d', 'test-agent', true);
+        expect(container.querySelector('[data-testid="select"]')).not.toBeNull();
       });
 
       const select = container.querySelector('[data-testid="select"]') as HTMLSelectElement;
-      const lockedOptions = Array.from(select.options).filter((option) =>
+      const longOptions = Array.from(select.options).filter((option) =>
         ['30d', '90d', '365d'].includes(option.value),
       );
-      expect(lockedOptions.map((option) => option.disabled)).toEqual([true, true, true]);
-      expect(select.textContent).toContain('Last 30 days - PRO');
+      expect(longOptions.map((option) => option.disabled)).toEqual([false, false, false]);
 
       fireEvent.change(select, { target: { value: '90d' } });
-      expect(localStorage.getItem('manifest_chart_range')).toBe('7d');
+      expect(localStorage.getItem('manifest_chart_range')).toBe('90d');
     });
   });
 
diff --git a/packages/frontend/tests/pages/ProviderOverviewPages.test.tsx b/packages/frontend/tests/pages/ProviderOverviewPages.test.tsx
index 90ee1153..c812da73 100644
--- a/packages/frontend/tests/pages/ProviderOverviewPages.test.tsx
+++ b/packages/frontend/tests/pages/ProviderOverviewPages.test.tsx
@@ -21,7 +21,6 @@ const apiMocks = vi.hoisted(() => ({
   getOverviewDetails: vi.fn(),
   getOverviewAgentUsage: vi.fn(),
   getOverviewProviderUsage: vi.fn(),
-  getBillingStatus: vi.fn(),
   getConnectionDetail: vi.fn(),
   getProviderAnalytics: vi.fn(),
   getPerAgentTimeseries: vi.fn(),
@@ -124,9 +123,6 @@ vi.mock('../../src/services/api/analytics.js', () => ({
   getErrorBreakdown: () => Promise.resolve({ by_class: {}, by_origin: {}, auto_fixed: 0 }),
 }));
 
-vi.mock('../../src/services/api/billing.js', () => ({
-  getBillingStatus: (...args: unknown[]) => apiMocks.getBillingStatus(...args),
-}));
 
 vi.mock('../../src/services/providers.js', () => ({
   PROVIDERS: [
@@ -271,11 +267,7 @@ vi.mock('../../src/components/Select.jsx', () => ({
     <select value={props.value} onChange={(e) => props.onChange(e.currentTarget.value)}>
       {props.options.map((option) => (
         <option value={option.value} disabled={option.disabled}>
-          {option.description
-            ? `${option.label} · ${option.description}`
-            : option.badge
-              ? `${option.label} · PRO`
-              : option.label}
+          {option.description ? `${option.label} · ${option.description}` : option.label}
         </option>
       ))}
     </select>
@@ -379,15 +371,8 @@ vi.mock('manifest-shared', () => ({
   isSuccessStatus: (s: string | null | undefined) => s == null || s === 'ok' || s === 'success',
 }));
 
-// Local providers only exist on self-hosted installs.
-let mockIsSelfHosted = true;
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => Promise.resolve(mockIsSelfHosted),
-}));
-
 import GlobalOverview from '../../src/pages/GlobalOverview';
 import ConnectionDetail from '../../src/pages/providers/ConnectionDetail';
-import { resetPlanStore } from '../../src/services/plan-store';
 
 const overviewResponse = {
   summary: {
@@ -725,13 +710,11 @@ function ensureStorageLike(kind: 'localStorage' | 'sessionStorage') {
 
 beforeEach(() => {
   vi.clearAllMocks();
-  resetPlanStore();
   ensureStorageLike('localStorage').clear();
   ensureStorageLike('sessionStorage').clear();
   localStorage.setItem('manifest_global_group', 'provider');
   routerState.navigate.mockReset();
   routerState.params = { connectionId: 'conn-openai' };
-  mockIsSelfHosted = true;
 
   apiMocks.getAgents.mockResolvedValue(agentsResponse);
   apiMocks.getCustomProviders.mockResolvedValue([
@@ -749,14 +732,6 @@ beforeEach(() => {
   apiMocks.getOverviewDetails.mockResolvedValue({});
   apiMocks.getOverviewAgentUsage.mockResolvedValue(agentUsageTimeseries);
   apiMocks.getOverviewProviderUsage.mockResolvedValue(providerUsageTimeseries);
-  apiMocks.getBillingStatus.mockResolvedValue({
-    enabled: false,
-    plan: 'free',
-    priceMonthly: { amount: null, currency: null, interval: null },
-    requests: { used: null, limit: null, periodEnd: null },
-    cancelAtPeriodEnd: false,
-    subscriptionPeriodEnd: null,
-  });
   apiMocks.getConnectionDetail.mockResolvedValue(connectionDetail);
   apiMocks.getProviderAnalytics.mockResolvedValue(connectionAnalytics);
   apiMocks.getPerAgentTimeseries.mockResolvedValue(agentTimeseries);
@@ -854,25 +829,22 @@ describe('GlobalOverview (analytics)', () => {
     expect(routerState.navigate).toHaveBeenCalledWith('/harnesses/worker-agent');
   });
 
-  it('limits Free users to 7-day dashboard ranges and labels longer ranges as Pro-only', async () => {
+  it('offers every dashboard range, long windows included, with no plan lock', async () => {
     localStorage.setItem('manifest_global_range', '365d');
-    resetPlanStore({ enabled: true, plan: 'free' });
 
     render(() => <GlobalOverview />);
 
     await waitFor(() => expect(screen.getByTestId('provider-chart-card')).toBeDefined());
-    await waitFor(() => expect(localStorage.getItem('manifest_global_range')).toBe('7d'));
-    expect(apiMocks.getOverview).toHaveBeenCalledWith('7d', undefined, true);
+    expect(apiMocks.getOverview).toHaveBeenCalledWith('365d', undefined, true);
 
     const rangeSelect = screen.getByRole('combobox') as HTMLSelectElement;
-    const lockedOptions = Array.from(rangeSelect.options).filter((option) =>
+    const longOptions = Array.from(rangeSelect.options).filter((option) =>
       ['30d', '90d', '365d'].includes(option.value),
     );
-    expect(lockedOptions.map((option) => option.disabled)).toEqual([true, true, true]);
-    expect(screen.getByText('Last 30 days · PRO')).toBeDefined();
+    expect(longOptions.map((option) => option.disabled)).toEqual([false, false, false]);
 
     fireEvent.change(rangeSelect, { target: { value: '90d' } });
-    expect(localStorage.getItem('manifest_global_range')).toBe('7d');
+    expect(localStorage.getItem('manifest_global_range')).toBe('90d');
   });
 
   it('shows custom provider names instead of custom:<uuid> in provider series', async () => {
diff --git a/packages/frontend/tests/pages/ProviderPages.test.tsx b/packages/frontend/tests/pages/ProviderPages.test.tsx
index 5cb14969..7cb3c44e 100644
--- a/packages/frontend/tests/pages/ProviderPages.test.tsx
+++ b/packages/frontend/tests/pages/ProviderPages.test.tsx
@@ -16,13 +16,6 @@ vi.mock('@solidjs/router', () => ({
   Navigate: (props: { href: string }) => <div data-testid="navigate" data-href={props.href} />,
 }));
 
-// The Local providers page only exists on self-hosted installs; cloud
-// redirects to BYOK. Default to self-hosted so the page tests apply.
-let mockIsSelfHosted = true;
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => Promise.resolve(mockIsSelfHosted),
-}));
-
 vi.mock('@solidjs/meta', () => ({
   Title: (props: { children: unknown }) => <title>{props.children as string}</title>,
 }));
@@ -216,7 +209,6 @@ describe('provider pages', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mockSearchParams = {};
-    mockIsSelfHosted = true;
     mockRenameProviderKey.mockResolvedValue(undefined);
     mockGetGlobalProviders.mockResolvedValue(globalProvidersResponse);
     // The usage endpoint returns the per-(provider, auth_type) stats that the
@@ -456,20 +448,6 @@ describe('provider pages', () => {
     });
   });
 
-  it('redirects the local providers page to the usage-based page in cloud', async () => {
-    mockIsSelfHosted = false;
-    const { container } = render(() => <LocalProviders />);
-
-    await waitFor(() => {
-      const navigate = container.querySelector('[data-testid="navigate"]');
-      expect(navigate).not.toBeNull();
-      expect(navigate?.getAttribute('data-href')).toBe('/providers/usage-based');
-    });
-    // The page content (its connected-connections heading) must not render —
-    // cloud short-circuits straight to the redirect.
-    expect(container.textContent).not.toContain('My local connections');
-  });
-
   it('auto-opens the modal from add=true and clears the query param', async () => {
     mockSearchParams = { add: 'true' };
     render(() => <LocalProviders />);
diff --git a/packages/frontend/tests/pages/Register.test.tsx b/packages/frontend/tests/pages/Register.test.tsx
index c12438d9..9f8cfe62 100644
--- a/packages/frontend/tests/pages/Register.test.tsx
+++ b/packages/frontend/tests/pages/Register.test.tsx
@@ -4,14 +4,8 @@ import { render, screen, fireEvent } from '@solidjs/testing-library';
 const mockSignUpEmail = vi.fn().mockResolvedValue({});
 const mockSignInSocial = vi.fn().mockResolvedValue({});
 const mockSendVerificationEmail = vi.fn().mockResolvedValue({});
-const mockSubscriptionUpgrade = vi.fn().mockResolvedValue({});
-const mockGetBillingStatus = vi.fn().mockResolvedValue({ enabled: false, plan: 'free' });
-const mockCheckIsSelfHosted = vi.fn().mockResolvedValue(false);
 const mockCheckSocialProviders = vi.fn().mockResolvedValue([]);
-const mockNavigate = vi.fn();
-const mockToastError = vi.fn();
 let mockLocationSearch = '';
-let mockSearchParams: Record<string, string | undefined> = {};
 
 vi.mock('@solidjs/router', () => ({
   A: (props: any) => (
@@ -20,8 +14,8 @@ vi.mock('@solidjs/router', () => ({
     </a>
   ),
   useLocation: () => ({ search: mockLocationSearch }),
-  useNavigate: () => mockNavigate,
-  useSearchParams: () => [mockSearchParams],
+  // SocialButtons reads the query to build its callbacks.
+  useSearchParams: () => [{}],
 }));
 
 vi.mock('@solidjs/meta', () => ({
@@ -31,32 +25,14 @@ vi.mock('@solidjs/meta', () => ({
 
 vi.mock('../../src/services/auth-client.js', () => ({
   authClient: {
-    useSession: () => () => ({
-      data: { user: { id: 'u1', name: 'Test User', email: 'test@test.com' } },
-      isPending: false,
-    }),
     signUp: { email: (...args: unknown[]) => mockSignUpEmail(...args) },
     signIn: { social: (...args: unknown[]) => mockSignInSocial(...args) },
     sendVerificationEmail: (...args: unknown[]) => mockSendVerificationEmail(...args),
-    subscription: { upgrade: (...args: unknown[]) => mockSubscriptionUpgrade(...args) },
-  },
-}));
-
-vi.mock('../../src/services/api/billing.js', () => ({
-  getBillingStatus: (...args: unknown[]) => mockGetBillingStatus(...args),
-}));
-
-vi.mock('../../src/services/toast-store.js', () => ({
-  toast: {
-    error: (...args: unknown[]) => mockToastError(...args),
-    success: vi.fn(),
-    warning: vi.fn(),
   },
 }));
 
 vi.mock('../../src/services/setup-status.js', () => ({
   checkSocialProviders: (...args: unknown[]) => mockCheckSocialProviders(...args),
-  checkIsSelfHosted: (...args: unknown[]) => mockCheckIsSelfHosted(...args),
 }));
 
 import Register from '../../src/pages/Register';
@@ -67,12 +43,8 @@ describe('Register', () => {
     vi.clearAllMocks();
     mockSignUpEmail.mockResolvedValue({});
     mockSignInSocial.mockResolvedValue({});
-    mockSubscriptionUpgrade.mockResolvedValue({});
-    mockGetBillingStatus.mockResolvedValue({ enabled: false, plan: 'free' });
-    mockCheckIsSelfHosted.mockResolvedValue(false);
     mockCheckSocialProviders.mockResolvedValue([]);
     mockLocationSearch = '';
-    mockSearchParams = {};
     localStorage.clear();
   });
 
@@ -99,9 +71,9 @@ describe('Register', () => {
   });
 
   it('preserves the query string on sign-in links', () => {
-    mockLocationSearch = '?plan=pro';
+    mockLocationSearch = '?redirect=%2Fmessages';
     const { container } = render(() => <Register />);
-    expect(container.querySelector('a[href="/login?plan=pro"]')).not.toBeNull();
+    expect(container.querySelector('a[href="/login?redirect=%2Fmessages"]')).not.toBeNull();
   });
 
   it('shows terms and privacy links', () => {
@@ -126,27 +98,6 @@ describe('Register', () => {
     });
   });
 
-  it('passes the upgrade callback to signup', async () => {
-    mockSignUpEmail.mockResolvedValue({ error: null });
-    const { container } = render(() => <Register />);
-    fireEvent.input(container.querySelector('input[type="text"]')!, { target: { value: 'Test' } });
-    fireEvent.input(container.querySelector('input[type="email"]')!, {
-      target: { value: 'test@test.com' },
-    });
-    fireEvent.input(container.querySelector('input[type="password"]')!, {
-      target: { value: 'pass123' },
-    });
-    fireEvent.submit(container.querySelector('form')!);
-    await vi.waitFor(() => {
-      expect(mockSignUpEmail).toHaveBeenCalledWith({
-        name: 'Test',
-        email: 'test@test.com',
-        password: 'pass123',
-        callbackURL: '/welcome',
-      });
-    });
-  });
-
   it('shows email verification after successful signup', async () => {
     mockSignUpEmail.mockResolvedValue({ error: null });
     const { container } = render(() => <Register />);
@@ -201,40 +152,9 @@ describe('Register', () => {
     expect(container.querySelector('a[href="/reset-password"]')).not.toBeNull();
   });
 
-  it('redirects directly to /welcome when signup returns a token', async () => {
-    const locationSpy = vi.spyOn(window, 'location', 'get').mockReturnValue({
-      ...window.location,
-      href: '',
-    });
-    const hrefSetter = vi.fn();
-    Object.defineProperty(window.location, 'href', { set: hrefSetter, configurable: true });
-
-    mockSignUpEmail.mockResolvedValue({
-      data: { token: 'tok', user: { id: 'u1' } },
-      error: null,
-    });
-    const { container } = render(() => <Register />);
-    fireEvent.input(container.querySelector('input[type="text"]')!, { target: { value: 'Test' } });
-    fireEvent.input(container.querySelector('input[type="email"]')!, {
-      target: { value: 'new@test.com' },
-    });
-    fireEvent.input(container.querySelector('input[type="password"]')!, {
-      target: { value: 'pass12345' },
-    });
-    fireEvent.submit(container.querySelector('form')!);
-    await vi.waitFor(() => {
-      expect(hrefSetter).toHaveBeenCalledWith('/welcome');
-    });
-
-    locationSpy.mockRestore();
-  });
-
-  it('routes self-hosted email signups through the discovery step', async () => {
-    mockCheckIsSelfHosted.mockResolvedValue(true);
+  it('routes email signups through the discovery step', async () => {
     mockSignUpEmail.mockResolvedValue({ error: null });
     const { container } = render(() => <Register />);
-    // Let onMount resolve checkIsSelfHosted before submitting.
-    await new Promise((resolve) => setTimeout(resolve, 0));
     fireEvent.input(container.querySelector('input[type="text"]')!, { target: { value: 'Test' } });
     fireEvent.input(container.querySelector('input[type="email"]')!, {
       target: { value: 'test@test.com' },
@@ -253,8 +173,7 @@ describe('Register', () => {
     });
   });
 
-  it('routes self-hosted social signups through the discovery step', async () => {
-    mockCheckIsSelfHosted.mockResolvedValue(true);
+  it('routes social signups through the discovery step', async () => {
     mockCheckSocialProviders.mockResolvedValue(['github']);
     render(() => <Register />);
 
@@ -267,7 +186,7 @@ describe('Register', () => {
     });
   });
 
-  it('redirects self-hosted token signups to the discovery step', async () => {
+  it('redirects token signups to the discovery step', async () => {
     const locationSpy = vi.spyOn(window, 'location', 'get').mockReturnValue({
       ...window.location,
       href: '',
@@ -275,13 +194,11 @@ describe('Register', () => {
     const hrefSetter = vi.fn();
     Object.defineProperty(window.location, 'href', { set: hrefSetter, configurable: true });
 
-    mockCheckIsSelfHosted.mockResolvedValue(true);
     mockSignUpEmail.mockResolvedValue({
       data: { token: 'tok', user: { id: 'u1' } },
       error: null,
     });
     const { container } = render(() => <Register />);
-    await new Promise((resolve) => setTimeout(resolve, 0));
     fireEvent.input(container.querySelector('input[type="text"]')!, { target: { value: 'Test' } });
     fireEvent.input(container.querySelector('input[type="email"]')!, {
       target: { value: 'new@test.com' },
@@ -299,87 +216,6 @@ describe('Register', () => {
     locationSpy.mockRestore();
   });
 
-  it('redirects already-Pro users away from the plan step', async () => {
-    mockSearchParams = { step: 'plan' };
-    mockGetBillingStatus.mockResolvedValue({
-      enabled: true,
-      plan: 'pro',
-      priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-    });
-
-    render(() => <Register />);
-
-    await vi.waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/', { replace: true });
-    });
-  });
-
-  it('lets users choose the free plan from the plan step', async () => {
-    const replace = vi.fn();
-    const locationSpy = vi.spyOn(window, 'location', 'get').mockReturnValue({
-      ...window.location,
-      replace,
-    });
-    mockSearchParams = { step: 'plan' };
-    mockGetBillingStatus.mockResolvedValue({
-      enabled: true,
-      plan: 'free',
-      priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-    });
-
-    const { container } = render(() => <Register />);
-    await screen.findByText('Choose your plan');
-
-    const freeCard = Array.from(
-      container.querySelectorAll<HTMLButtonElement>('.plan-picker__card'),
-    ).find((card) => card.textContent?.includes('Free'));
-    if (!freeCard) throw new Error('Free plan card not found');
-    fireEvent.click(freeCard);
-    fireEvent.click(container.querySelector('.plan-picker__cta')!);
-
-    expect(replace).toHaveBeenCalledWith('/');
-    locationSpy.mockRestore();
-  });
-
-  it('starts Pro checkout from the plan step', async () => {
-    mockSearchParams = { step: 'plan' };
-    mockGetBillingStatus.mockResolvedValue({
-      enabled: true,
-      plan: 'free',
-      priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-    });
-
-    const { container } = render(() => <Register />);
-    await screen.findByText('Choose your plan');
-    fireEvent.click(container.querySelector('.plan-picker__cta')!);
-
-    await vi.waitFor(() => {
-      expect(mockSubscriptionUpgrade).toHaveBeenCalledWith({
-        plan: 'pro',
-        successUrl: `${window.location.origin}/overview?upgraded=1`,
-        cancelUrl: `${window.location.origin}/register?step=plan`,
-      });
-    });
-  });
-
-  it('shows an error toast when Pro checkout returns an error payload from the plan step', async () => {
-    mockSearchParams = { step: 'plan' };
-    mockSubscriptionUpgrade.mockResolvedValue({ error: { message: 'stripe down' } });
-    mockGetBillingStatus.mockResolvedValue({
-      enabled: true,
-      plan: 'free',
-      priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-    });
-
-    const { container } = render(() => <Register />);
-    await screen.findByText('Choose your plan');
-    fireEvent.click(container.querySelector('.plan-picker__cta')!);
-
-    await vi.waitFor(() =>
-      expect(mockToastError).toHaveBeenCalledWith('Could not start the upgrade. Please try again.'),
-    );
-  });
-
   it('shows loading state during submission', async () => {
     mockSignUpEmail.mockReturnValue(new Promise(() => {}));
     const { container } = render(() => <Register />);
@@ -444,7 +280,7 @@ describe('Register', () => {
       await vi.waitFor(() => {
         expect(mockSendVerificationEmail).toHaveBeenCalledWith({
           email: 'test@test.com',
-          callbackURL: '/welcome',
+          callbackURL: '/discovery?next=%2Fwelcome',
         });
       });
     }
@@ -530,33 +366,12 @@ describe('Register', () => {
     });
   });
 
-  it('shows "Choose your plan" title when context=login (existing/OAuth user)', async () => {
-    mockSearchParams = { step: 'plan', context: 'login' };
-    mockGetBillingStatus.mockResolvedValue({
-      enabled: true,
-      plan: 'free',
-      priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-    });
-
-    render(() => <Register />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Choose your plan')).toBeDefined();
-    });
-    expect(screen.getByText(/Manifest now offers Free and Pro plans/)).toBeDefined();
-  });
-
-  it('shows "Create an account" title without context=login (email signup)', async () => {
-    mockSearchParams = { step: 'plan' };
-    mockGetBillingStatus.mockResolvedValue({
-      enabled: true,
-      plan: 'free',
-      priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-    });
-
+  it('never renders a plan picker, even with the legacy plan step', () => {
+    mockLocationSearch = '?step=plan';
     render(() => <Register />);
-    await vi.waitFor(() => {
-      expect(screen.getByText('Create an account')).toBeDefined();
-    });
+    expect(screen.getByText('Create an account')).toBeDefined();
+    expect(screen.queryByText('Choose your plan')).toBeNull();
+    expect(screen.queryByText(/Pro/)).toBeNull();
   });
 
   it('clears the cooldown interval on unmount', async () => {
diff --git a/packages/frontend/tests/pages/SettingsRecordingSection.test.tsx b/packages/frontend/tests/pages/SettingsRecordingSection.test.tsx
index 60156d69..9b309f93 100644
--- a/packages/frontend/tests/pages/SettingsRecordingSection.test.tsx
+++ b/packages/frontend/tests/pages/SettingsRecordingSection.test.tsx
@@ -4,7 +4,6 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 const getRecording = vi.fn();
 const updateRecording = vi.fn();
 const toastSuccess = vi.fn();
-let mockIsSelfHosted = true;
 vi.mock('../../src/services/api.js', () => ({
   getRecording: (...args: unknown[]) => getRecording(...args),
   updateRecording: (...args: unknown[]) => updateRecording(...args),
@@ -12,20 +11,16 @@ vi.mock('../../src/services/api.js', () => ({
 vi.mock('../../src/services/toast-store.js', () => ({
   toast: { success: (...args: unknown[]) => toastSuccess(...args) },
 }));
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => Promise.resolve(mockIsSelfHosted),
-}));
 
 import SettingsRecordingSection from '../../src/pages/SettingsRecordingSection';
 
 describe('SettingsRecordingSection', () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    mockIsSelfHosted = true;
   });
   afterEach(cleanup);
 
-  it('renders the disabled state with the self-hosted storage note', async () => {
+  it('renders the disabled state with the local storage note', async () => {
     getRecording.mockResolvedValue({ enabled: false });
     const { getByRole, getByText, container } = render(() => (
       <SettingsRecordingSection agentName={() => 'demo'} />
@@ -36,24 +31,11 @@ describe('SettingsRecordingSection', () => {
     expect(toggle.getAttribute('aria-checked')).toBe('false');
     expect(getByText('Logs')).toBeTruthy();
     expect(container.textContent).toContain('see what your agent sends');
-    await waitFor(() =>
-      expect(container.textContent).toContain(
-        'logs stay in your own database and never reach',
-      ),
-    );
+    expect(container.textContent).toContain('Logs stay in your own database.');
+    expect(container.textContent).not.toContain('workspace');
     expect(getRecording).toHaveBeenCalledWith('demo', expect.anything());
   });
 
-  it('shows the workspace storage note on cloud', async () => {
-    mockIsSelfHosted = false;
-    getRecording.mockResolvedValue({ enabled: false });
-    const { container } = render(() => <SettingsRecordingSection agentName={() => 'demo'} />);
-    await waitFor(() =>
-      expect(container.textContent).toContain('Logs are stored in your Manifest workspace.'),
-    );
-    expect(container.textContent).not.toContain('your own database');
-  });
-
   it('enables logs for the current agent', async () => {
     getRecording.mockResolvedValue({ enabled: false });
     updateRecording.mockResolvedValue({ enabled: true });
diff --git a/packages/frontend/tests/pages/Setup.test.tsx b/packages/frontend/tests/pages/Setup.test.tsx
index c871dee0..1dace7c8 100644
--- a/packages/frontend/tests/pages/Setup.test.tsx
+++ b/packages/frontend/tests/pages/Setup.test.tsx
@@ -4,7 +4,6 @@ import { render, screen, fireEvent, waitFor } from '@solidjs/testing-library';
 const mockNavigate = vi.fn();
 const mockSignInEmail = vi.fn().mockResolvedValue({});
 const mockCheckNeedsSetup = vi.fn();
-const mockCheckIsSelfHosted = vi.fn();
 const mockCreateFirstAdmin = vi.fn();
 
 vi.mock('@solidjs/router', () => ({
@@ -26,7 +25,6 @@ vi.mock('../../src/services/auth-client.js', () => ({
 
 vi.mock('../../src/services/setup-status.js', () => ({
   checkNeedsSetup: (...args: unknown[]) => mockCheckNeedsSetup(...args),
-  checkIsSelfHosted: (...args: unknown[]) => mockCheckIsSelfHosted(...args),
   createFirstAdmin: (...args: unknown[]) => mockCreateFirstAdmin(...args),
 }));
 
@@ -36,7 +34,6 @@ describe('Setup page', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mockCheckNeedsSetup.mockResolvedValue(true);
-    mockCheckIsSelfHosted.mockResolvedValue(false);
     mockCreateFirstAdmin.mockResolvedValue(undefined);
     mockSignInEmail.mockResolvedValue({});
 
@@ -123,8 +120,7 @@ describe('Setup page', () => {
     });
   });
 
-  it('redirects self-hosted admins to the discovery step after setup', async () => {
-    mockCheckIsSelfHosted.mockResolvedValue(true);
+  it('redirects new admins to the discovery step after setup', async () => {
     mockSignInEmail.mockResolvedValue({ data: { user: { id: 'admin1' } } });
     localStorage.removeItem('manifest_discovery_pending_admin1');
     const { container } = await renderSetup();
@@ -138,17 +134,6 @@ describe('Setup page', () => {
     localStorage.removeItem('manifest_discovery_pending_admin1');
   });
 
-  it('redirects non-self-hosted admins straight to the dashboard after setup', async () => {
-    mockCheckIsSelfHosted.mockResolvedValue(false);
-    const { container } = await renderSetup();
-    fillValidForm();
-    fireEvent.submit(container.querySelector('form')!);
-
-    await waitFor(() => {
-      expect(window.location.href).toBe('/');
-    });
-  });
-
   it('surfaces server errors from createFirstAdmin', async () => {
     mockCreateFirstAdmin.mockRejectedValue(new Error('already exists'));
     const { container } = await renderSetup();
diff --git a/packages/frontend/tests/pages/Upgrade.test.tsx b/packages/frontend/tests/pages/Upgrade.test.tsx
deleted file mode 100644
index c278a60b..00000000
--- a/packages/frontend/tests/pages/Upgrade.test.tsx
+++ /dev/null
@@ -1,234 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { fireEvent, render, screen, waitFor } from '@solidjs/testing-library';
-import { FREE_REQUEST_LIMIT_LABEL } from '../../src/services/billing-display';
-import { FREE_PLAN_REQUESTS_PER_MONTH } from 'manifest-shared';
-
-const mockNavigate = vi.fn();
-let mockSearchParams: Record<string, string> = {};
-
-vi.mock('@solidjs/router', () => ({
-  useNavigate: () => mockNavigate,
-  useSearchParams: () => [mockSearchParams],
-}));
-
-vi.mock('@solidjs/meta', () => ({
-  Title: (props: any) => <title>{props.children}</title>,
-  Meta: () => null,
-}));
-
-const mockUpgrade = vi.fn();
-vi.mock('../../src/services/auth-client.js', () => ({
-  authClient: {
-    useSession: () => () => ({ data: { user: { id: 'u1' } }, isPending: false }),
-    subscription: {
-      upgrade: (...args: unknown[]) => mockUpgrade(...args),
-    },
-  },
-}));
-
-const mockGetBillingStatus = vi.fn();
-vi.mock('../../src/services/api/billing.js', () => ({
-  getBillingStatus: (...args: unknown[]) => mockGetBillingStatus(...args),
-}));
-
-const mockToastError = vi.fn();
-vi.mock('../../src/services/toast-store.js', () => ({
-  toast: {
-    error: (...args: unknown[]) => mockToastError(...args),
-  },
-}));
-
-import Upgrade from '../../src/pages/Upgrade';
-
-const disabledStatus = {
-  enabled: false,
-  plan: 'free' as const,
-  priceMonthly: { amount: null, currency: null, interval: null },
-  emailPreferences: { usageAlerts: true },
-  requests: { used: null, limit: FREE_PLAN_REQUESTS_PER_MONTH, periodEnd: null },
-  cancelAtPeriodEnd: false,
-  subscriptionPeriodEnd: null,
-};
-
-const freeStatus = {
-  enabled: true,
-  plan: 'free' as const,
-  priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-  emailPreferences: { usageAlerts: true },
-  requests: {
-    used: 1250,
-    limit: FREE_PLAN_REQUESTS_PER_MONTH,
-    periodEnd: '2026-08-01T00:00:00.000Z',
-  },
-  cancelAtPeriodEnd: false,
-  subscriptionPeriodEnd: null,
-};
-
-const proStatus = {
-  enabled: true,
-  plan: 'pro' as const,
-  priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-  emailPreferences: { usageAlerts: true },
-  requests: { used: null, limit: null, periodEnd: null },
-  cancelAtPeriodEnd: false,
-  subscriptionPeriodEnd: null,
-};
-
-describe('Upgrade', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockSearchParams = {};
-    mockGetBillingStatus.mockResolvedValue(freeStatus);
-    mockUpgrade.mockResolvedValue(undefined);
-    window.history.pushState({}, '', '/upgrade');
-  });
-
-  it('fetches billing status without cache and renders plan choices', async () => {
-    render(() => <Upgrade />);
-
-    await screen.findByText('Free');
-
-    expect(mockGetBillingStatus).toHaveBeenCalledWith({ cache: false });
-    expect(screen.getByText('Full control over your AI routing')).toBeDefined();
-    expect(screen.getByText('$0')).toBeDefined();
-    expect(screen.getByText('$20')).toBeDefined();
-    expect(screen.getByText('Unlimited agents')).toBeDefined();
-    expect(screen.getByText(`${FREE_REQUEST_LIMIT_LABEL} routed requests / month`)).toBeDefined();
-    expect(screen.getByText('All providers, no restrictions')).toBeDefined();
-    expect(screen.getByText('Subscription providers (Claude, ChatGPT, Gemini...)')).toBeDefined();
-    expect(screen.getByText('Unlimited routed requests')).toBeDefined();
-    expect(screen.getByText('365 days dashboard retention')).toBeDefined();
-    expect(screen.getByText('Budget alerts and notifications')).toBeDefined();
-    expect(screen.getByText('Enterprise')).toBeDefined();
-    expect(screen.getByText("Let's Talk")).toBeDefined();
-    expect(screen.getByText('Talk to sales')).toBeDefined();
-    expect(screen.getByText('Upgrade to Pro')).toBeDefined();
-  });
-
-  it('shows the request-limit entry message', async () => {
-    mockSearchParams = { reason: 'requests' };
-    render(() => <Upgrade />);
-
-    await screen.findByText(
-      new RegExp(`You've used all ${FREE_REQUEST_LIMIT_LABEL} requests this month`),
-    );
-  });
-
-  it('hides the request-limit entry message on the Pro plan', async () => {
-    mockSearchParams = { reason: 'requests' };
-    mockGetBillingStatus.mockResolvedValue(proStatus);
-    render(() => <Upgrade />);
-
-    await screen.findByText(/You're currently on the/);
-    expect(screen.queryByText(/You've used all/)).toBeNull();
-  });
-
-  it('goes back when the referrer is from the same origin', async () => {
-    const back = vi.spyOn(window.history, 'back').mockImplementation(() => undefined);
-    Object.defineProperty(document, 'referrer', {
-      value: `${window.location.origin}/account`,
-      configurable: true,
-    });
-    try {
-      render(() => <Upgrade />);
-
-      fireEvent.click(await screen.findByText('Back'));
-
-      expect(back).toHaveBeenCalled();
-    } finally {
-      back.mockRestore();
-    }
-  });
-
-  it('falls back to the dashboard when Back has no same-origin referrer', async () => {
-    Object.defineProperty(document, 'referrer', {
-      value: 'https://example.com/account',
-      configurable: true,
-    });
-    render(() => <Upgrade />);
-
-    fireEvent.click(await screen.findByText('Back'));
-
-    expect(mockNavigate).toHaveBeenCalledWith('/');
-  });
-
-  it('continues on Free by navigating to the dashboard', async () => {
-    render(() => <Upgrade />);
-
-    const button = await screen.findByText('Use Manifest for free');
-    fireEvent.click(button);
-
-    expect(mockNavigate).toHaveBeenCalledWith('/');
-  });
-
-  it('starts checkout with the current upgrade URL as cancel URL', async () => {
-    mockSearchParams = { reason: 'requests' };
-    window.history.pushState({}, '', '/upgrade?reason=requests');
-    render(() => <Upgrade />);
-
-    const button = await screen.findByText('Upgrade to Pro');
-    fireEvent.click(button);
-
-    expect(mockUpgrade).toHaveBeenCalledWith({
-      plan: 'pro',
-      successUrl: `${window.location.origin}/overview?upgraded=1`,
-      cancelUrl: `${window.location.origin}/upgrade?reason=requests`,
-    });
-    await waitFor(() => expect((button as HTMLButtonElement).disabled).toBe(false));
-  });
-
-  it('shows an error toast when checkout fails', async () => {
-    mockUpgrade.mockRejectedValue(new Error('stripe down'));
-    render(() => <Upgrade />);
-
-    fireEvent.click(await screen.findByText('Upgrade to Pro'));
-
-    await waitFor(() =>
-      expect(mockToastError).toHaveBeenCalledWith('Could not start the upgrade. Please try again.'),
-    );
-  });
-
-  it('shows an error toast when checkout returns an error payload', async () => {
-    mockUpgrade.mockResolvedValue({ error: { message: 'stripe down' } });
-    render(() => <Upgrade />);
-
-    fireEvent.click(await screen.findByText('Upgrade to Pro'));
-
-    await waitFor(() =>
-      expect(mockToastError).toHaveBeenCalledWith('Could not start the upgrade. Please try again.'),
-    );
-  });
-
-  it('redirects away when billing is disabled', async () => {
-    mockGetBillingStatus.mockResolvedValue(disabledStatus);
-    render(() => <Upgrade />);
-
-    await waitFor(() => expect(mockNavigate).toHaveBeenCalledWith('/', { replace: true }));
-    expect(screen.queryByText('$20')).toBeNull();
-  });
-
-  it('shows an already-upgraded state for Pro users', async () => {
-    mockGetBillingStatus.mockResolvedValue(proStatus);
-    render(() => <Upgrade />);
-
-    await screen.findByText(/You're currently on the/);
-    expect(screen.getByText('Account')).toBeDefined();
-    expect(screen.queryByText('$20')).toBeNull();
-  });
-
-  it('shows a loading state while billing status is pending', () => {
-    mockGetBillingStatus.mockReturnValue(new Promise(() => undefined));
-    render(() => <Upgrade />);
-
-    expect(screen.getByText('Loading billing status...')).toBeDefined();
-  });
-
-  it('shows a recoverable state when billing status fails', async () => {
-    mockGetBillingStatus.mockRejectedValue(new Error('network'));
-    render(() => <Upgrade />);
-
-    await screen.findByText('Could not load billing status. Please try again.');
-    fireEvent.click(screen.getByText('Dashboard'));
-    expect(mockNavigate).toHaveBeenCalledWith('/');
-  });
-});
diff --git a/packages/frontend/tests/services/api-extra.test.ts b/packages/frontend/tests/services/api-extra.test.ts
index 0ff1d550..a5e4635b 100644
--- a/packages/frontend/tests/services/api-extra.test.ts
+++ b/packages/frontend/tests/services/api-extra.test.ts
@@ -1,5 +1,4 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { getFreeModels } from '../../src/services/api/free-models.js';
 import { submitOpenaiOAuthCallback } from '../../src/services/api/oauth.js';
 import {
   probeCustomProvider,
@@ -40,16 +39,6 @@ function mockOk(body: unknown) {
   });
 }
 
-describe('api/free-models', () => {
-  it('fetches /free-models and returns the payload', async () => {
-    mockOk({ providers: [], last_synced_at: null });
-    const out = await getFreeModels();
-    expect(out).toEqual({ providers: [], last_synced_at: null });
-    const url = mockFetch.mock.calls[0][0] as string;
-    expect(url).toContain('/api/v1/free-models');
-  });
-});
-
 describe('api/oauth', () => {
   it('submitOpenaiOAuthCallback POSTs code + state as JSON', async () => {
     mockOk({ ok: true });
diff --git a/packages/frontend/tests/services/api/billing.test.ts b/packages/frontend/tests/services/api/billing.test.ts
deleted file mode 100644
index f7d2e47f..00000000
--- a/packages/frontend/tests/services/api/billing.test.ts
+++ /dev/null
@@ -1,109 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-
-// Mock `fetchJson` at the module boundary so the test pins exactly the path
-// `billing.ts` asks for, without re-exercising the SWR cache + fetch plumbing
-// already covered by core.test.ts. The factory is hoisted, so the spy has to
-// be created via `vi.hoisted` to be referenceable inside it.
-const { fetchJsonMock, fetchMutateMock } = vi.hoisted(() => ({
-  fetchJsonMock: vi.fn(),
-  fetchMutateMock: vi.fn(),
-}));
-
-vi.mock('../../../src/services/api/core.js', () => ({
-  fetchJson: fetchJsonMock,
-  fetchMutate: fetchMutateMock,
-}));
-
-import {
-  getBillingPlan,
-  getBillingStatus,
-  updateBillingEmailPreferences,
-} from '../../../src/services/api/billing';
-import { fetchJson, fetchMutate } from '../../../src/services/api/core';
-import { FREE_PLAN_REQUESTS_PER_MONTH, type BillingStatus } from 'manifest-shared';
-
-describe('billing API client', () => {
-  beforeEach(() => {
-    fetchJsonMock.mockReset();
-    fetchMutateMock.mockReset();
-  });
-
-  it('getBillingPlan GETs /billing/plan without the global login redirect', async () => {
-    // AuthGuard fires this before the session is known, so a signed-out 401
-    // must reject quietly instead of hard-navigating the browser to /login.
-    fetchJsonMock.mockResolvedValue({ enabled: true, plan: 'free' });
-
-    const result = await getBillingPlan();
-
-    expect(fetchJson).toHaveBeenCalledWith('/billing/plan', undefined, { loginRedirect: false });
-    expect(result).toEqual({ enabled: true, plan: 'free' });
-  });
-
-  it('getBillingStatus GETs /billing/status and returns the parsed status', async () => {
-    const status: BillingStatus = {
-      enabled: true,
-      plan: 'pro',
-      priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-      emailPreferences: { usageAlerts: true },
-      requests: { used: 1_000, limit: 500_000, periodEnd: '2026-08-01T00:00:00.000Z' },
-      cancelAtPeriodEnd: false,
-      subscriptionPeriodEnd: null,
-    };
-    fetchJsonMock.mockResolvedValue(status);
-
-    const result = await getBillingStatus();
-
-    expect(fetchJson).toHaveBeenCalledWith('/billing/status');
-    expect(result).toEqual(status);
-  });
-
-  it('getBillingStatus returns a disabled free-plan status unchanged', async () => {
-    const status: BillingStatus = {
-      enabled: false,
-      plan: 'free',
-      priceMonthly: { amount: null, currency: null, interval: null },
-      emailPreferences: { usageAlerts: true },
-      requests: { used: null, limit: FREE_PLAN_REQUESTS_PER_MONTH, periodEnd: null },
-      cancelAtPeriodEnd: false,
-      subscriptionPeriodEnd: null,
-    };
-    fetchJsonMock.mockResolvedValue(status);
-
-    const result = await getBillingStatus();
-
-    expect(fetchJson).toHaveBeenCalledWith('/billing/status');
-    expect(result).toBe(status);
-  });
-
-  it('passes through fetch options for fresh billing reads', async () => {
-    const status: BillingStatus = {
-      enabled: true,
-      plan: 'free',
-      priceMonthly: { amount: 20, currency: 'USD', interval: 'month' },
-      emailPreferences: { usageAlerts: true },
-      requests: { used: 500, limit: FREE_PLAN_REQUESTS_PER_MONTH, periodEnd: null },
-      cancelAtPeriodEnd: false,
-      subscriptionPeriodEnd: null,
-    };
-    fetchJsonMock.mockResolvedValue(status);
-
-    const result = await getBillingStatus({ cache: false });
-
-    expect(fetchJson).toHaveBeenCalledWith('/billing/status', undefined, { cache: false });
-    expect(result).toBe(status);
-  });
-
-  it('updateBillingEmailPreferences PATCHes the preference payload', async () => {
-    const saved = { usageAlerts: false };
-    fetchMutateMock.mockResolvedValue(saved);
-
-    const result = await updateBillingEmailPreferences({ usageAlerts: false });
-
-    expect(fetchMutate).toHaveBeenCalledWith('/billing/email-preferences', {
-      method: 'PATCH',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ usageAlerts: false }),
-    });
-    expect(result).toBe(saved);
-  });
-});
diff --git a/packages/frontend/tests/services/api/providers.test.ts b/packages/frontend/tests/services/api/providers.test.ts
index 75cdff6a..60608324 100644
--- a/packages/frontend/tests/services/api/providers.test.ts
+++ b/packages/frontend/tests/services/api/providers.test.ts
@@ -2,7 +2,6 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import * as api from '../../../src/services/api';
 import {
   connectionUsage,
-  ensureManagedFreeProvider,
   getProviders,
   getProviderUsage,
   mergeUsage,
@@ -47,88 +46,13 @@ describe('providers API client', () => {
     const fetchMock = setupFetch(response);
 
     await expect(getProviders()).resolves.toEqual(response);
-    expect(fetchMock).toHaveBeenCalledTimes(2);
+    // Only the config read: no background provisioning of a hosted provider.
+    expect(fetchMock).toHaveBeenCalledTimes(1);
     const [url, init] = fetchMock.mock.calls[0];
     expect(url).toContain('/api/v1/providers');
     expect(url).not.toContain('/api/v1/providers/usage');
+    expect(url).not.toContain('/ensure');
     expect((init as RequestInit).credentials).toBe('include');
-    expect(fetchMock.mock.calls[1][0]).toContain('/api/v1/providers/gemini-free/ensure');
-    expect(fetchMock.mock.calls[1][1]).toMatchObject({
-      method: 'POST',
-      credentials: 'include',
-    });
-  });
-
-  it('does not wait for background managed free-provider provisioning', async () => {
-    const response = { providers: [], model_counts: {} };
-    let resolveEnsure!: (response: unknown) => void;
-    const fetchMock = vi.fn().mockImplementation((_url: string, init?: RequestInit) => {
-      if (init?.method === 'POST') {
-        return new Promise((resolve) => {
-          resolveEnsure = resolve;
-        });
-      }
-      return Promise.resolve({
-        ok: true,
-        status: 200,
-        json: async () => response,
-        text: async () => JSON.stringify(response),
-      });
-    });
-    vi.stubGlobal('fetch', fetchMock);
-
-    await expect(getProviders()).resolves.toEqual(response);
-    expect(fetchMock).toHaveBeenCalledWith(
-      expect.stringContaining('/api/v1/providers/gemini-free/ensure'),
-      expect.objectContaining({ method: 'POST' }),
-    );
-
-    resolveEnsure({
-      ok: true,
-      status: 200,
-      json: async () => ({
-        connected: false,
-        connection_id: null,
-        source: 'none',
-        auto_available: false,
-      }),
-    });
-    await ensureManagedFreeProvider('gemini-free');
-  });
-
-  it('pastes a manually provisioned Gemini Free virtual key', async () => {
-    const response = {
-      connected: true,
-      connection_id: 'conn-1',
-      source: 'manual',
-      auto_available: false,
-    };
-    const fetchMock = setupFetch(response);
-
-    await expect(ensureManagedFreeProvider('gemini-free', 'sk-virtual')).resolves.toEqual(response);
-    expect(fetchMock).toHaveBeenCalledWith(
-      '/api/v1/providers/gemini-free/ensure',
-      expect.objectContaining({
-        method: 'POST',
-        credentials: 'include',
-        body: JSON.stringify({ apiKey: 'sk-virtual' }),
-      }),
-    );
-  });
-
-  it('surfaces managed free-provider provisioning errors', async () => {
-    vi.stubGlobal(
-      'fetch',
-      vi.fn().mockResolvedValue({
-        ok: false,
-        status: 400,
-        json: async () => ({ message: 'Invalid gifted key' }),
-      }),
-    );
-
-    await expect(ensureManagedFreeProvider('gemini-free', 'bad-key')).rejects.toThrow(
-      'Invalid gifted key',
-    );
   });
 
   it('GETs provider USAGE from the dedicated endpoint', async () => {
diff --git a/packages/frontend/tests/services/auth-client.test.ts b/packages/frontend/tests/services/auth-client.test.ts
index 55fff779..c11c18c5 100644
--- a/packages/frontend/tests/services/auth-client.test.ts
+++ b/packages/frontend/tests/services/auth-client.test.ts
@@ -4,31 +4,23 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 // module under test (`auth-client.ts`) imports this symbol and invokes it
 // once at module-load time, so we mock it before any dynamic import below.
 // Use `vi.hoisted` so the spy is available to the hoisted `vi.mock` factory.
-const { createAuthClientMock, stripeClientMock } = vi.hoisted(() => ({
+const { createAuthClientMock } = vi.hoisted(() => ({
   createAuthClientMock: vi.fn((config: unknown) => ({
     __mockClient: true,
     config,
   })),
-  // `stripeClient` is a factory the module passes into `plugins`. We tag the
-  // return value so the test can assert the plugin was actually wired in.
-  stripeClientMock: vi.fn((opts: unknown) => ({ __stripePlugin: true, opts })),
 }));
 
 vi.mock("better-auth/solid", () => ({
   createAuthClient: createAuthClientMock,
 }));
 
-vi.mock("@better-auth/stripe/client", () => ({
-  stripeClient: stripeClientMock,
-}));
-
 describe("authClient", () => {
   beforeEach(() => {
     // Each test re-imports the module to re-trigger the top-level
     // `createAuthClient({...})` call against a fresh mock state.
     vi.resetModules();
     createAuthClientMock.mockClear();
-    stripeClientMock.mockClear();
 
     // Pin `window.location.origin` to a deterministic value. jsdom would
     // otherwise return "http://localhost:3000", which is fine but we want
@@ -68,21 +60,11 @@ describe("authClient", () => {
     expect(config.basePath).toBe("/api/auth");
   });
 
-  it("registers the stripe subscription client plugin", async () => {
+  it("registers no client plugins (no billing layer)", async () => {
     await import("../../src/services/auth-client.js");
 
-    // `stripeClient` must be called once with subscription mode enabled...
-    expect(stripeClientMock).toHaveBeenCalledTimes(1);
-    expect(stripeClientMock.mock.calls[0][0]).toEqual({ subscription: true });
-
-    // ...and the returned plugin must be passed into `createAuthClient`'s
-    // `plugins` array, which is what widens the client type with the
-    // `subscription` namespace in production.
-    const config = createAuthClientMock.mock.calls[0][0] as {
-      plugins: unknown[];
-    };
-    expect(config.plugins).toHaveLength(1);
-    expect(config.plugins[0]).toBe(stripeClientMock.mock.results[0].value);
+    const config = createAuthClientMock.mock.calls[0][0] as { plugins?: unknown[] };
+    expect(config.plugins ?? []).toHaveLength(0);
   });
 
   it("exports authClient as createAuthClient return type", async () => {
@@ -115,7 +97,6 @@ describe("authClient", () => {
     // a stale value baked at first import.
     vi.resetModules();
     createAuthClientMock.mockClear();
-    stripeClientMock.mockClear();
     vi.stubGlobal("window", {
       ...window,
       location: {
diff --git a/packages/frontend/tests/services/auth-redirects.test.ts b/packages/frontend/tests/services/auth-redirects.test.ts
index 00a607c2..f6a1fd0b 100644
--- a/packages/frontend/tests/services/auth-redirects.test.ts
+++ b/packages/frontend/tests/services/auth-redirects.test.ts
@@ -10,8 +10,8 @@ import {
 
 describe('auth redirect helpers', () => {
   it('accepts safe internal redirects', () => {
-    expect(isSafeInternalRedirect('/upgrade')).toBe(true);
-    expect(isSafeInternalRedirect('/upgrade?reason=requests')).toBe(true);
+    expect(isSafeInternalRedirect('/messages')).toBe(true);
+    expect(isSafeInternalRedirect('/messages?range=30d')).toBe(true);
   });
 
   it('rejects external or malformed redirects', () => {
@@ -23,16 +23,21 @@ describe('auth redirect helpers', () => {
     expect(isSafeInternalRedirect('%')).toBe(false);
   });
 
-  it('chooses redirect before plan intent', () => {
-    expect(getAuthDestination({ redirect: '/messages', plan: 'pro' })).toBe('/messages');
+  it('uses a safe redirect as the destination', () => {
+    expect(getAuthDestination({ redirect: '/messages' })).toBe('/messages');
   });
 
-  it('falls back to upgrade for pro intent', () => {
-    expect(getAuthDestination({ plan: 'pro' })).toBe('/upgrade');
+  it('falls back to home without a safe redirect', () => {
+    expect(getAuthDestination({ redirect: 'https://evil.test' })).toBe('/');
+    expect(getAuthDestination({})).toBe('/');
   });
 
-  it('falls back to home without safe redirect or pro intent', () => {
-    expect(getAuthDestination({ redirect: 'https://evil.test' })).toBe('/');
+  it('ignores the legacy plan intent parameter', () => {
+    expect(getAuthDestination({ plan: 'pro' })).toBe('/');
+    expect(buildSocialAuthUrls({ plan: 'pro' })).toEqual({
+      callbackURL: '/',
+      errorCallbackURL: '/login?oauth=failed',
+    });
   });
 
   it('resumes a signed MCP authorization query after sign-in', () => {
@@ -42,7 +47,7 @@ describe('auth redirect helpers', () => {
     expect(destination).toBe(
       '/api/auth/oauth2/authorize?client_id=https%3A%2F%2Fclient.test%2Fmetadata&redirect_uri=http%3A%2F%2F127.0.0.1%2Fcallback&ba_param=client_id&ba_param=redirect_uri&sig=abc',
     );
-    expect(getAuthDestination({ plan: 'pro' }, query)).toBe(destination);
+    expect(getAuthDestination({}, query)).toBe(destination);
     expect(buildSocialAuthUrls({}, query)).toEqual({
       callbackURL: destination,
       errorCallbackURL: `/login?${new URLSearchParams(query.slice(1)).toString()}`,
@@ -56,28 +61,21 @@ describe('auth redirect helpers', () => {
   });
 
   it('builds encoded login redirects from path and search', () => {
-    expect(buildLoginRedirect('/upgrade', '?reason=requests')).toBe(
-      '/login?redirect=%2Fupgrade%3Freason%3Drequests',
+    expect(buildLoginRedirect('/messages', '?range=30d')).toBe(
+      '/login?redirect=%2Fmessages%3Frange%3D30d',
     );
   });
 
   it('appends search strings to cross-links', () => {
-    expect(appendSearch('/login', '?plan=pro')).toBe('/login?plan=pro');
-    expect(appendSearch('/login', 'plan=pro')).toBe('/login?plan=pro');
+    expect(appendSearch('/login', '?redirect=%2Fmessages')).toBe('/login?redirect=%2Fmessages');
+    expect(appendSearch('/login', 'redirect=%2Fmessages')).toBe('/login?redirect=%2Fmessages');
     expect(appendSearch('/login')).toBe('/login');
   });
 
-  it('builds social callback URLs for pro intent', () => {
-    expect(buildSocialAuthUrls({ plan: 'pro' })).toEqual({
-      callbackURL: '/upgrade',
-      errorCallbackURL: '/login?plan=pro&oauth=failed',
-    });
-  });
-
   it('preserves safe redirects in social error callbacks', () => {
-    expect(buildSocialAuthUrls({ redirect: '/upgrade?reason=requests' })).toEqual({
-      callbackURL: '/upgrade?reason=requests',
-      errorCallbackURL: '/login?redirect=%2Fupgrade%3Freason%3Drequests&oauth=failed',
+    expect(buildSocialAuthUrls({ redirect: '/messages?range=30d' })).toEqual({
+      callbackURL: '/messages?range=30d',
+      errorCallbackURL: '/login?redirect=%2Fmessages%3Frange%3D30d&oauth=failed',
     });
   });
 });
diff --git a/packages/frontend/tests/services/billing-display.test.ts b/packages/frontend/tests/services/billing-display.test.ts
deleted file mode 100644
index 31e70f2b..00000000
--- a/packages/frontend/tests/services/billing-display.test.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import {
-  FREE_REQUEST_LIMIT,
-  FREE_REQUEST_LIMIT_LABEL,
-  billingIntervalSuffix,
-  formatBillingPrice,
-  formatBillingPriceWithInterval,
-} from '../../src/services/billing-display';
-
-describe('billing-display', () => {
-  it('exports the shared free request limit label', () => {
-    expect(FREE_REQUEST_LIMIT).toBe(10_000);
-    expect(FREE_REQUEST_LIMIT_LABEL).toBe('10,000');
-  });
-
-  it('formats whole and fractional Stripe prices with currency', () => {
-    expect(formatBillingPrice({ amount: 20, currency: 'USD', interval: 'month' })).toBe('$20');
-    expect(formatBillingPrice({ amount: 19.99, currency: 'USD', interval: 'month' })).toBe(
-      '$19.99',
-    );
-  });
-
-  it('falls back when Intl cannot format the currency code', () => {
-    expect(formatBillingPrice({ amount: 20, currency: 'NOT_A_CURRENCY', interval: 'month' })).toBe(
-      '20 NOT_A_CURRENCY',
-    );
-  });
-
-  it('returns null for missing price pieces', () => {
-    expect(formatBillingPrice(null)).toBeNull();
-    expect(formatBillingPrice({ amount: null, currency: 'USD', interval: 'month' })).toBeNull();
-    expect(formatBillingPrice({ amount: 20, currency: null, interval: 'month' })).toBeNull();
-  });
-
-  it('formats interval suffixes', () => {
-    expect(billingIntervalSuffix({ amount: 20, currency: 'USD', interval: 'month' })).toBe('/mo');
-    expect(billingIntervalSuffix({ amount: 200, currency: 'USD', interval: 'year' })).toBe('/year');
-    expect(billingIntervalSuffix({ amount: 20, currency: 'USD', interval: null })).toBe('');
-  });
-
-  it('combines price and interval when both are available', () => {
-    expect(formatBillingPriceWithInterval({ amount: 20, currency: 'USD', interval: 'month' })).toBe(
-      '$20/mo',
-    );
-    expect(
-      formatBillingPriceWithInterval({ amount: null, currency: 'USD', interval: 'month' }),
-    ).toBeNull();
-  });
-});
diff --git a/packages/frontend/tests/services/discovery.test.ts b/packages/frontend/tests/services/discovery.test.ts
index 7d5d2bb1..d1c2d5c7 100644
--- a/packages/frontend/tests/services/discovery.test.ts
+++ b/packages/frontend/tests/services/discovery.test.ts
@@ -2,9 +2,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import {
   COMPANY_SIZE_OPTIONS,
   PROJECT_TYPE_OPTIONS,
-  clearDiscoveryPending,
   completeDiscovery,
-  isConfirmedNotSelfHosted,
   getDiscoveryPendingNext,
   hasDiscoveryBeenDoneLocally,
   isDiscoveryRequired,
@@ -84,14 +82,6 @@ describe('discovery service', () => {
     it('ignores an empty user id', () => {
       markDiscoveryPending('', '/welcome');
       expect(getDiscoveryPendingNext('')).toBeNull();
-      expect(() => clearDiscoveryPending('')).not.toThrow();
-    });
-
-    it('clearDiscoveryPending drops the marker without recording completion', () => {
-      markDiscoveryPending('u1', '/welcome');
-      clearDiscoveryPending('u1');
-      expect(getDiscoveryPendingNext('u1')).toBeNull();
-      expect(hasDiscoveryBeenDoneLocally('u1')).toBe(false);
     });
 
     it('swallows storage errors', () => {
@@ -161,33 +151,6 @@ describe('discovery service', () => {
     });
   });
 
-  describe('isConfirmedNotSelfHosted', () => {
-    it('confirms only on an explicit non-self-hosted answer', async () => {
-      mockFetch.mockResolvedValue({ ok: true, json: async () => ({ isSelfHosted: false }) });
-      expect(await isConfirmedNotSelfHosted()).toBe(true);
-    });
-
-    it('denies on a self-hosted answer', async () => {
-      mockFetch.mockResolvedValue({ ok: true, json: async () => ({ isSelfHosted: true }) });
-      expect(await isConfirmedNotSelfHosted()).toBe(false);
-    });
-
-    it('denies on a success body without the isSelfHosted field', async () => {
-      mockFetch.mockResolvedValue({ ok: true, json: async () => ({}) });
-      expect(await isConfirmedNotSelfHosted()).toBe(false);
-    });
-
-    it('denies on a non-2xx response', async () => {
-      mockFetch.mockResolvedValue({ ok: false, status: 503 });
-      expect(await isConfirmedNotSelfHosted()).toBe(false);
-    });
-
-    it('denies when the request throws', async () => {
-      mockFetch.mockRejectedValue(new Error('network down'));
-      expect(await isConfirmedNotSelfHosted()).toBe(false);
-    });
-  });
-
   describe('completeDiscovery', () => {
     it('marks the local flag and posts the submission', async () => {
       mockFetch.mockResolvedValue({ ok: true });
diff --git a/packages/frontend/tests/services/dither-ground.test.ts b/packages/frontend/tests/services/dither-ground.test.ts
deleted file mode 100644
index 80ea08e5..00000000
--- a/packages/frontend/tests/services/dither-ground.test.ts
+++ /dev/null
@@ -1,207 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import {
-  DITHER,
-  GROUND_INK,
-  GROUND_PAPER,
-  GROUND_SHARE,
-  density,
-  mix,
-  mountDither,
-  smoothstep,
-  threshold,
-  windy,
-} from '../../src/services/dither-ground';
-
-function makeCtx() {
-  return {
-    createImageData: vi.fn((w: number, h: number) => ({ data: new Uint8ClampedArray(w * h * 4) })),
-    putImageData: vi.fn(),
-  };
-}
-
-describe('dither ground helpers', () => {
-  it('reads the Bayer threshold in (0, 1)', () => {
-    expect(threshold(0, 0)).toBeCloseTo(0.5 / 64);
-    expect(threshold(9, 8)).toBeCloseTo(32.5 / 64);
-  });
-
-  it('eases between two edges', () => {
-    expect(smoothstep(0, 1, -1)).toBe(0);
-    expect(smoothstep(0, 1, 2)).toBe(1);
-    expect(smoothstep(0, 1, 0.5)).toBe(0.5);
-  });
-
-  it('keeps the top centre clean and fills the lower corners', () => {
-    expect(density(0.5, 0)).toBe(0);
-    expect(density(0, 1)).toBeCloseTo(DITHER.max);
-  });
-
-  it('matches the still ground at time 0 only near the base shape', () => {
-    expect(windy(0.5, 0, 0)).toBeGreaterThanOrEqual(0);
-    expect(windy(0, 1, 3)).toBeGreaterThan(0);
-  });
-
-  it('mixes the green into the ground', () => {
-    expect(mix(GROUND_INK, GROUND_PAPER, GROUND_SHARE)).toEqual([19, 79, 49]);
-    expect(mix([255, 255, 255], [0, 0, 0], 0)).toEqual([0, 0, 0]);
-  });
-});
-
-describe('mountDither', () => {
-  let frames: FrameRequestCallback[];
-  let ctx: ReturnType<typeof makeCtx> | null;
-  let size = { w: 30, h: 12 };
-  let reduced = false;
-  let mediaListeners: Array<() => void>;
-  let resizeCb: (() => void) | null;
-  let viewCb: ((entries: Array<{ isIntersecting: boolean }>) => void) | null;
-  const disconnects = { resize: vi.fn(), view: vi.fn() };
-  const removeListener = vi.fn();
-
-  function makeCanvas(withParent = true) {
-    const canvas = document.createElement('canvas');
-    if (withParent) {
-      const parent = document.createElement('div');
-      Object.defineProperty(parent, 'clientWidth', { get: () => size.w });
-      Object.defineProperty(parent, 'clientHeight', { get: () => size.h });
-      parent.appendChild(canvas);
-    }
-    return canvas;
-  }
-
-  beforeEach(() => {
-    frames = [];
-    ctx = makeCtx();
-    size = { w: 30, h: 12 };
-    reduced = false;
-    mediaListeners = [];
-    resizeCb = null;
-    viewCb = null;
-    let id = 0;
-    vi.spyOn(HTMLCanvasElement.prototype, 'getContext').mockImplementation((() => ctx) as never);
-    vi.stubGlobal('requestAnimationFrame', (cb: FrameRequestCallback) => {
-      frames.push(cb);
-      return ++id;
-    });
-    vi.stubGlobal('cancelAnimationFrame', vi.fn());
-    vi.stubGlobal('matchMedia', () => ({
-      get matches() {
-        return reduced;
-      },
-      addEventListener: (_: string, fn: () => void) => mediaListeners.push(fn),
-      removeEventListener: removeListener,
-    }));
-    vi.stubGlobal(
-      'ResizeObserver',
-      class {
-        constructor(cb: () => void) {
-          resizeCb = cb;
-        }
-        observe() {}
-        disconnect() {
-          disconnects.resize();
-        }
-      },
-    );
-    vi.stubGlobal(
-      'IntersectionObserver',
-      class {
-        constructor(cb: (entries: Array<{ isIntersecting: boolean }>) => void) {
-          viewCb = cb;
-        }
-        observe() {}
-        disconnect() {
-          disconnects.view();
-        }
-      },
-    );
-  });
-
-  afterEach(() => {
-    vi.unstubAllGlobals();
-    vi.restoreAllMocks();
-  });
-
-  it('returns a no-op cleanup without a 2d context', () => {
-    ctx = null;
-    expect(() => mountDither(makeCanvas())()).not.toThrow();
-  });
-
-  it('returns a no-op cleanup without a parent', () => {
-    expect(() => mountDither(makeCanvas(false))()).not.toThrow();
-  });
-
-  it('sizes the canvas to its parent and animates at the wind rate', () => {
-    const canvas = makeCanvas();
-    const cleanup = mountDither(canvas);
-    expect(canvas.width).toBe(10);
-    expect(canvas.height).toBe(4);
-    expect(canvas.style.width).toBe('30px');
-    expect(frames).toHaveLength(1);
-
-    frames.shift()!(1000);
-    expect(ctx!.putImageData).toHaveBeenCalledTimes(1);
-    const data = (ctx!.putImageData.mock.calls[0]![0] as { data: Uint8ClampedArray }).data;
-    expect(data.some((v) => v === 255)).toBe(true);
-
-    // a frame within 1/20 s of the last one is skipped
-    frames.shift()!(1010);
-    expect(ctx!.putImageData).toHaveBeenCalledTimes(1);
-
-    cleanup();
-    expect(disconnects.resize).toHaveBeenCalled();
-    expect(disconnects.view).toHaveBeenCalled();
-    expect(removeListener).toHaveBeenCalled();
-  });
-
-  it('draws the still ground once when motion is reduced', () => {
-    reduced = true;
-    mountDither(makeCanvas());
-    expect(frames).toHaveLength(0);
-    expect(ctx!.putImageData).toHaveBeenCalledTimes(1);
-  });
-
-  it('stops the wind off screen and restarts it on screen', () => {
-    mountDither(makeCanvas());
-    viewCb!([{ isIntersecting: false }]);
-    expect(ctx!.putImageData).toHaveBeenCalledTimes(1);
-    frames.length = 0;
-    viewCb!([{ isIntersecting: true }]);
-    expect(frames).toHaveLength(1);
-  });
-
-  it('replays when the reduced-motion setting changes', () => {
-    mountDither(makeCanvas());
-    reduced = true;
-    mediaListeners[0]!();
-    expect(ctx!.putImageData).toHaveBeenCalledTimes(1);
-  });
-
-  it('skips drawing while the parent has no size, and measures again on resize', () => {
-    size = { w: 0, h: 0 };
-    mountDither(makeCanvas());
-    expect(ctx!.createImageData).not.toHaveBeenCalled();
-    size = { w: 3, h: 3 };
-    resizeCb!();
-    expect(ctx!.createImageData).toHaveBeenCalledWith(1, 1);
-    frames.shift()!(1000);
-    expect(ctx!.putImageData).toHaveBeenCalled();
-  });
-
-  it('draws a still ground when no frame has been measured yet', () => {
-    size = { w: 0, h: 0 };
-    reduced = true;
-    mountDither(makeCanvas());
-    viewCb!([{ isIntersecting: false }]);
-    expect(ctx!.putImageData).not.toHaveBeenCalled();
-  });
-
-  it('works without matchMedia or observers', () => {
-    vi.stubGlobal('matchMedia', undefined);
-    vi.stubGlobal('ResizeObserver', undefined);
-    vi.stubGlobal('IntersectionObserver', undefined);
-    const cleanup = mountDither(makeCanvas());
-    expect(frames).toHaveLength(1);
-    expect(() => cleanup()).not.toThrow();
-  });
-});
diff --git a/packages/frontend/tests/services/formatters.test.ts b/packages/frontend/tests/services/formatters.test.ts
index 887dcea3..c3da2cfe 100644
--- a/packages/frontend/tests/services/formatters.test.ts
+++ b/packages/frontend/tests/services/formatters.test.ts
@@ -131,7 +131,6 @@ describe('formatErrorClass', () => {
     expect(formatErrorClass('no_provider_key')).toBe('Missing API key');
     expect(formatErrorClass('subscription_credentials_unusable')).toBe('Subscription credentials');
     expect(formatErrorClass('limit_exceeded')).toBe('Limit exceeded');
-    expect(formatErrorClass('plan_request_limit_exceeded')).toBe('Plan request limit');
     expect(formatErrorClass('server_error')).toBe('Server error');
   });
   it('returns null for a missing class', () => {
diff --git a/packages/frontend/tests/services/message-error-taxonomy.test.ts b/packages/frontend/tests/services/message-error-taxonomy.test.ts
deleted file mode 100644
index f6c2d02e..00000000
--- a/packages/frontend/tests/services/message-error-taxonomy.test.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { isPlanRequestLimitMessage } from '../../src/services/message-error-taxonomy';
-
-describe('isPlanRequestLimitMessage', () => {
-  it('detects new plan request-limit rows', () => {
-    expect(
-      isPlanRequestLimitMessage({
-        error_origin: 'policy',
-        error_class: 'plan_request_limit_exceeded',
-        error_http_status: 402,
-      }),
-    ).toBe(true);
-  });
-
-  it('keeps legacy plan request-limit rows upgrade-compatible', () => {
-    expect(
-      isPlanRequestLimitMessage({
-        error_origin: 'policy',
-        error_class: 'limit_exceeded',
-        routing_reason: 'limit_exceeded',
-        error_http_status: 402,
-      }),
-    ).toBe(true);
-  });
-
-  it('does not treat user-configured Limits as plan quota', () => {
-    expect(
-      isPlanRequestLimitMessage({
-        error_origin: 'policy',
-        error_class: 'limit_exceeded',
-        error_http_status: 429,
-      }),
-    ).toBe(false);
-  });
-
-  it('does not treat provider billing errors as Manifest plan quota', () => {
-    expect(
-      isPlanRequestLimitMessage({
-        error_origin: 'provider',
-        error_class: 'billing',
-        error_http_status: 402,
-      }),
-    ).toBe(false);
-  });
-});
diff --git a/packages/frontend/tests/services/plan-range-lock.test.ts b/packages/frontend/tests/services/plan-range-lock.test.ts
deleted file mode 100644
index da63c387..00000000
--- a/packages/frontend/tests/services/plan-range-lock.test.ts
+++ /dev/null
@@ -1,80 +0,0 @@
-import { describe, it, expect, beforeEach } from 'vitest';
-import { createRoot, createSignal } from 'solid-js';
-import { usePlanRangeLock } from '../../src/services/plan-range-lock.js';
-import { resetPlanStore } from '../../src/services/plan-store.js';
-
-const PRO_RANGES = new Set(['30d', '90d', '365d']);
-
-const withLock = (
-  initialRange: string,
-  body: (
-    lock: ReturnType<typeof usePlanRangeLock<string>>,
-    setRange: (v: string) => void,
-  ) => void,
-) => {
-  createRoot((dispose) => {
-    const [range, setRange] = createSignal(initialRange);
-    const lock = usePlanRangeLock(range, PRO_RANGES, '7d');
-    try {
-      body(lock, setRange);
-    } finally {
-      dispose();
-    }
-  });
-};
-
-describe('usePlanRangeLock', () => {
-  beforeEach(() => {
-    resetPlanStore();
-  });
-
-  it('locks PRO ranges and clamps to the fallback for a free plan', () => {
-    resetPlanStore({ enabled: true, plan: 'free' });
-    withLock('90d', (lock) => {
-      expect(lock.isFreePlan()).toBe(true);
-      expect(lock.isProRangeLocked('90d')).toBe(true);
-      expect(lock.isProRangeLocked('7d')).toBe(false);
-      expect(lock.effectiveRange()).toBe('7d');
-    });
-  });
-
-  it('leaves PRO ranges unlocked for a paid plan', () => {
-    resetPlanStore({ enabled: true, plan: 'pro' });
-    withLock('30d', (lock) => {
-      expect(lock.isFreePlan()).toBe(false);
-      expect(lock.isProRangeLocked('30d')).toBe(false);
-      expect(lock.effectiveRange()).toBe('30d');
-    });
-  });
-
-  it('leaves PRO ranges unlocked when billing is disabled or unresolved', () => {
-    resetPlanStore({ enabled: false, plan: 'free' });
-    withLock('365d', (lock) => {
-      expect(lock.effectiveRange()).toBe('365d');
-    });
-    resetPlanStore();
-    withLock('365d', (lock) => {
-      expect(lock.isFreePlan()).toBe(false);
-      expect(lock.effectiveRange()).toBe('365d');
-    });
-  });
-
-  it('reacts to range changes and never clamps non-PRO ranges', () => {
-    resetPlanStore({ enabled: true, plan: 'free' });
-    withLock('24h', (lock, setRange) => {
-      expect(lock.effectiveRange()).toBe('24h');
-      setRange('30d');
-      expect(lock.effectiveRange()).toBe('7d');
-      setRange('7d');
-      expect(lock.effectiveRange()).toBe('7d');
-    });
-  });
-
-  it('re-clamps reactively when the plan store updates mid-session', () => {
-    withLock('30d', (lock) => {
-      expect(lock.effectiveRange()).toBe('30d');
-      resetPlanStore({ enabled: true, plan: 'free' });
-      expect(lock.effectiveRange()).toBe('7d');
-    });
-  });
-});
diff --git a/packages/frontend/tests/services/plan-selection.test.ts b/packages/frontend/tests/services/plan-selection.test.ts
deleted file mode 100644
index f36c80b4..00000000
--- a/packages/frontend/tests/services/plan-selection.test.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import {
-  clearPlanChosen,
-  hasPlanBeenChosen,
-  markPlanChosen,
-} from '../../src/services/plan-selection';
-
-describe('plan-selection', () => {
-  beforeEach(() => {
-    vi.restoreAllMocks();
-    localStorage.clear();
-  });
-
-  it('stores, reads, and clears the chosen plan flag per user', () => {
-    expect(hasPlanBeenChosen('u1')).toBe(false);
-
-    markPlanChosen('u1');
-
-    expect(hasPlanBeenChosen('u1')).toBe(true);
-    expect(hasPlanBeenChosen('u2')).toBe(false);
-
-    clearPlanChosen('u1');
-
-    expect(hasPlanBeenChosen('u1')).toBe(false);
-  });
-
-  it('fails closed when storage reads are unavailable and does not throw on writes', () => {
-    vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
-      throw new Error('full');
-    });
-    vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
-      throw new Error('blocked');
-    });
-    vi.spyOn(Storage.prototype, 'removeItem').mockImplementation(() => {
-      throw new Error('blocked');
-    });
-
-    expect(() => markPlanChosen('u1')).not.toThrow();
-    expect(hasPlanBeenChosen('u1')).toBe(false);
-    expect(() => clearPlanChosen('u1')).not.toThrow();
-  });
-});
diff --git a/packages/frontend/tests/services/plan-store.test.ts b/packages/frontend/tests/services/plan-store.test.ts
deleted file mode 100644
index 71762099..00000000
--- a/packages/frontend/tests/services/plan-store.test.ts
+++ /dev/null
@@ -1,76 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { loadPlan, isFreePlan, planStatus, resetPlanStore } from '../../src/services/plan-store.js';
-
-const mockGetBillingPlan = vi.fn();
-vi.mock('../../src/services/api/billing.js', () => ({
-  getBillingPlan: (...args: unknown[]) => mockGetBillingPlan(...args),
-}));
-
-describe('plan store', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    resetPlanStore();
-  });
-
-  it('resolves and caches the plan on first load', async () => {
-    mockGetBillingPlan.mockResolvedValue({ enabled: true, plan: 'pro' });
-    await expect(loadPlan()).resolves.toEqual({ enabled: true, plan: 'pro' });
-    await expect(loadPlan()).resolves.toEqual({ enabled: true, plan: 'pro' });
-    expect(mockGetBillingPlan).toHaveBeenCalledTimes(1);
-    expect(planStatus()).toEqual({ enabled: true, plan: 'pro' });
-  });
-
-  it('dedupes concurrent loads onto one request', async () => {
-    let resolve!: (v: { enabled: boolean; plan: string }) => void;
-    mockGetBillingPlan.mockReturnValue(new Promise((r) => (resolve = r)));
-    const [a, b] = [loadPlan(), loadPlan()];
-    resolve({ enabled: true, plan: 'free' });
-    await expect(a).resolves.toEqual({ enabled: true, plan: 'free' });
-    await expect(b).resolves.toEqual({ enabled: true, plan: 'free' });
-    expect(mockGetBillingPlan).toHaveBeenCalledTimes(1);
-  });
-
-  it('keeps deduping a newer load when an older one settles after a reset', async () => {
-    // AuthGuard prefetches at mount; a reset (tests, plan change) can land
-    // while that lookup is still pending. The old promise must not clear the
-    // slot the replacement lookup now owns, or the next caller fires a third
-    // request instead of joining the second.
-    let resolveOld!: (v: { enabled: boolean; plan: string }) => void;
-    let resolveNew!: (v: { enabled: boolean; plan: string }) => void;
-    mockGetBillingPlan
-      .mockReturnValueOnce(new Promise((r) => (resolveOld = r)))
-      .mockReturnValueOnce(new Promise((r) => (resolveNew = r)));
-    const old = loadPlan();
-    resetPlanStore();
-    const fresh = loadPlan();
-    resolveOld({ enabled: false, plan: 'free' });
-    await old;
-    const joined = loadPlan();
-    resolveNew({ enabled: true, plan: 'pro' });
-    await expect(fresh).resolves.toEqual({ enabled: true, plan: 'pro' });
-    await expect(joined).resolves.toEqual({ enabled: true, plan: 'pro' });
-    expect(mockGetBillingPlan).toHaveBeenCalledTimes(2);
-  });
-
-  it('fails open (billing disabled) when the lookup errors, without caching failure', async () => {
-    mockGetBillingPlan.mockRejectedValueOnce(new Error('boom'));
-    await expect(loadPlan()).resolves.toEqual({ enabled: false, plan: 'free' });
-    expect(isFreePlan()).toBe(false);
-    // The failed value is never stored: a lookup fired before sign-in (401)
-    // must not decide the plan for the session that signs in right after.
-    expect(planStatus()).toBeNull();
-    // The next load retries instead of serving the failed value.
-    mockGetBillingPlan.mockResolvedValue({ enabled: true, plan: 'free' });
-    await expect(loadPlan()).resolves.toEqual({ enabled: true, plan: 'free' });
-  });
-
-  it('derives isFreePlan only for an enabled free plan', () => {
-    expect(isFreePlan()).toBe(false); // unresolved
-    resetPlanStore({ enabled: false, plan: 'free' });
-    expect(isFreePlan()).toBe(false); // billing off (self-hosted)
-    resetPlanStore({ enabled: true, plan: 'pro' });
-    expect(isFreePlan()).toBe(false);
-    resetPlanStore({ enabled: true, plan: 'free' });
-    expect(isFreePlan()).toBe(true);
-  });
-});
diff --git a/packages/frontend/tests/services/providers.test.ts b/packages/frontend/tests/services/providers.test.ts
index 7ff0283b..095aa240 100644
--- a/packages/frontend/tests/services/providers.test.ts
+++ b/packages/frontend/tests/services/providers.test.ts
@@ -487,14 +487,9 @@ describe('PROVIDERS', () => {
     expect(ollama.minKeyLength).toBe(0);
   });
 
-  it('exposes Gemini Free as a managed free provider', () => {
-    const provider = PROVIDERS.find((entry) => entry.id === 'gemini-free')!;
-    expect(provider.name).toBe('Gemini Free');
-    expect(provider.subtitle).toBe('Free Gemini models via Manifest');
-    expect(provider.keyPlaceholder).toBe('sk-...');
-    expect(getRoutingProviderApiKeyUrl('gemini-free')).toBe(
-      'https://calendly.com/sebastien-manifest/30min',
-    );
+  it('does not list the hosted Gemini Free provider', () => {
+    expect(PROVIDERS.find((entry) => entry.id === 'gemini-free')).toBeUndefined();
+    expect(getRoutingProviderApiKeyUrl('gemini-free')).toBeUndefined();
   });
 
   it('exposes the current Meta Muse Spark catalog and Contributor warning', () => {
diff --git a/packages/frontend/tests/services/setup-status.test.ts b/packages/frontend/tests/services/setup-status.test.ts
index 8b6f69cf..5fe55126 100644
--- a/packages/frontend/tests/services/setup-status.test.ts
+++ b/packages/frontend/tests/services/setup-status.test.ts
@@ -2,7 +2,6 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import {
   checkNeedsSetup,
   checkSocialProviders,
-  checkIsSelfHosted,
   checkIsOllamaAvailable,
   checkLocalLlmHost,
   checkEmailConfigured,
@@ -117,66 +116,25 @@ describe('setup-status service', () => {
     });
   });
 
-  describe('checkIsSelfHosted', () => {
-    it('returns true when backend reports isSelfHosted=true', async () => {
-      vi.stubGlobal(
-        'fetch',
-        vi.fn().mockResolvedValue({
-          ok: true,
-          json: async () => ({ needsSetup: false, isSelfHosted: true }),
-        }),
-      );
-      expect(await checkIsSelfHosted()).toBe(true);
-    });
-
-    it('returns false when backend reports isSelfHosted=false', async () => {
-      vi.stubGlobal(
-        'fetch',
-        vi.fn().mockResolvedValue({
-          ok: true,
-          json: async () => ({ needsSetup: false, isSelfHosted: false }),
-        }),
-      );
-      expect(await checkIsSelfHosted()).toBe(false);
-    });
-
-    it('returns false when backend omits isSelfHosted', async () => {
-      vi.stubGlobal(
-        'fetch',
-        vi.fn().mockResolvedValue({
-          ok: true,
-          json: async () => ({ needsSetup: false }),
-        }),
-      );
-      expect(await checkIsSelfHosted()).toBe(false);
-    });
-
-    it('returns false on fetch failure', async () => {
-      vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('offline')));
-      expect(await checkIsSelfHosted()).toBe(false);
-    });
-
+  describe('shared status cache', () => {
     it('shares cache with checkNeedsSetup (single fetch)', async () => {
       const fetchMock = vi.fn().mockResolvedValue({
         ok: true,
         json: async () => ({
           needsSetup: true,
-          isSelfHosted: true,
           socialProviders: ['google'],
           ollamaAvailable: true,
         }),
       });
       vi.stubGlobal('fetch', fetchMock);
 
-      const [needs, selfHosted, social, ollama] = await Promise.all([
+      const [needs, social, ollama] = await Promise.all([
         checkNeedsSetup(),
-        checkIsSelfHosted(),
         checkSocialProviders(),
         checkIsOllamaAvailable(),
       ]);
 
       expect(needs).toBe(true);
-      expect(selfHosted).toBe(true);
       expect(social).toEqual(['google']);
       expect(ollama).toBe(true);
       expect(fetchMock).toHaveBeenCalledTimes(1);
diff --git a/packages/frontend/tests/services/use-overview-range.test.ts b/packages/frontend/tests/services/use-overview-range.test.ts
index cdd8ec8e..4759bd92 100644
--- a/packages/frontend/tests/services/use-overview-range.test.ts
+++ b/packages/frontend/tests/services/use-overview-range.test.ts
@@ -7,11 +7,6 @@ import {
   useOverviewColumns,
 } from '../../src/services/use-overview-range';
 
-const mockCheckIsSelfHosted = vi.fn(() => Promise.resolve(false));
-vi.mock('../../src/services/setup-status.js', () => ({
-  checkIsSelfHosted: () => mockCheckIsSelfHosted(),
-}));
-
 vi.mock('../../src/components/message-table-types.js', () => ({
   COMPACT_COLUMNS: ['status', 'trigger', 'date', 'model'],
 }));
@@ -19,7 +14,6 @@ vi.mock('../../src/components/message-table-types.js', () => ({
 describe('use-overview-range', () => {
   beforeEach(() => {
     localStorage.clear();
-    mockCheckIsSelfHosted.mockResolvedValue(false);
   });
 
   afterEach(() => {

From d4abfb2cce04c7603a95698b3ec736a066dbd731 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sat, 10 Oct 2026 15:43:12 -0300
Subject: [PATCH 02/17] refactor(backend): remove billing, Stripe and plan
 limits

Billing, Stripe and the Free/Pro plans belong to the SaaS layer that
Thinker drops (docs/decisoes-iniciais.md section 3).

- Delete packages/backend/src/billing (PlanService, billing controller,
  billing emails, request quota window, subscription status) and drop
  BillingModule from the app, proxy and analytics modules.
- Proxy: remove the per-request plan gate (assertWithinRequestLimit) and
  the PLAN_LIMIT_REQUESTS / M204 handling in the controller and the
  exception filter. The proxy no longer answers 402 on its own; a 402
  follows the generic error path.
- Auth: remove the @better-auth/stripe plugin; drop the stripe and
  @better-auth/stripe dependencies from the backend.
- Recording retention: keep only the global path (365-day default or
  REQUEST_RECORDING_RETENTION_DAYS); per-plan retention is gone.
- Tenant entity: drop limit_overrides and billing_email_preferences;
  delete the TenantRequestUsage entity.
- Shared: delete plan-limits and its exports.
- Remove the STRIPE_* / PLAN_LIMIT_* / PLAN_REQUEST_QUOTA_RESET_AT
  variables from .env.example.
- New migration DropBillingSchema1803200000000 drops the quota trigger
  and function, requests.quota_counted, tenant_request_usage,
  billing_email_logs and the two tenant columns. The old
  AddTenantRequestUsage migration keeps only its self-hosted path
  (a no-op up) so it no longer imports deleted billing code.

/api/v1/billing/* no longer exists, and the STRIPE_* and PLAN_LIMIT_*
variables are ignored if set.

Closes #14

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/dev/manifest-guide.md                    |   7 +-
 package-lock.json                             |  19 +-
 packages/backend/.env.example                 |  18 +-
 packages/backend/package.json                 |   2 -
 .../backend/src/analytics/analytics.module.ts |   2 -
 packages/backend/src/app.module.ts            |   2 -
 .../backend/src/auth/auth.instance.spec.ts    | 138 +---
 packages/backend/src/auth/auth.instance.ts    |  40 +-
 .../billing/billing-email-log.service.spec.ts |  65 --
 .../src/billing/billing-email-log.service.ts  |  85 ---
 .../src/billing/billing-email-preferences.ts  |  15 -
 .../src/billing/billing-email-sender.spec.ts  | 222 ------
 .../src/billing/billing-email-sender.ts       |  76 --
 .../src/billing/billing-email.service.ts      |  58 --
 .../billing-usage-email.service.spec.ts       | 239 -------
 .../billing/billing-usage-email.service.ts    | 118 ---
 .../src/billing/billing.config.spec.ts        |  69 --
 .../backend/src/billing/billing.config.ts     |  24 -
 .../src/billing/billing.controller.spec.ts    |  53 --
 .../backend/src/billing/billing.controller.ts |  27 -
 .../backend/src/billing/billing.module.ts     |  16 -
 .../update-billing-email-preferences.dto.ts   |   6 -
 .../billing/emails/billing-plan-email.spec.ts |  87 ---
 .../src/billing/emails/billing-plan-email.tsx | 436 -----------
 .../backend/src/billing/emails/preview.tsx    |  49 --
 .../backend/src/billing/plan.service.spec.ts  | 676 ------------------
 packages/backend/src/billing/plan.service.ts  | 558 ---------------
 .../src/billing/request-quota-window.spec.ts  |  42 --
 .../src/billing/request-quota-window.ts       |  13 -
 .../src/billing/subscription-status.spec.ts   |  14 -
 .../src/billing/subscription-status.ts        |  19 -
 .../subscription-webhook-emails.spec.ts       | 322 ---------
 .../billing/subscription-webhook-emails.ts    | 156 ----
 .../backend/src/common/errors/error-codes.ts  |   6 -
 .../src/common/errors/manifest-error.ts       |   2 -
 packages/backend/src/config/app.config.ts     |   5 +-
 .../src/database/data-source-definitions.ts   |   4 +-
 ...801300000000-AddTenantRequestUsage.spec.ts |  76 +-
 .../1801300000000-AddTenantRequestUsage.ts    | 212 +-----
 .../1803200000000-DropBillingSchema.spec.ts   |  43 ++
 .../1803200000000-DropBillingSchema.ts        |  68 ++
 ...equest-recording-retention.service.spec.ts |  48 +-
 .../request-recording-retention.service.ts    |  67 +-
 .../src/entities/agent-message.entity.ts      |   5 +-
 .../tenant-request-usage.entity.spec.ts       |  24 -
 .../entities/tenant-request-usage.entity.ts   |  19 -
 .../src/entities/tenant.entity.spec.ts        |  22 +-
 .../backend/src/entities/tenant.entity.ts     |  12 -
 .../notifications/emails/email-assets.spec.ts |  16 -
 .../__tests__/proxy-exception.filter.spec.ts  |  82 +--
 .../__tests__/proxy-message-recorder.spec.ts  |  30 -
 .../proxy/__tests__/proxy.controller.spec.ts  |  99 +--
 .../proxy.controller.streaming-abort.spec.ts  |   1 -
 .../routing/proxy/proxy-exception.filter.ts   |  27 -
 .../routing/proxy/proxy-message-recorder.ts   |   2 +-
 .../src/routing/proxy/proxy.controller.ts     |  45 --
 .../backend/src/routing/proxy/proxy.module.ts |   2 -
 .../test/billing-request-limit.e2e-spec.ts    | 249 -------
 .../drop-billing-schema-migration.e2e-spec.ts | 206 ++++++
 packages/backend/test/helpers.ts              |   2 -
 .../test/proxy-no-plan-gate.e2e-spec.ts       | 201 ++++++
 ...tenant-request-usage-migration.e2e-spec.ts | 420 -----------
 packages/shared/__tests__/plan-limits.spec.ts |  21 -
 packages/shared/src/index.ts                  |  14 -
 packages/shared/src/plan-limits.ts            |  48 --
 scripts/db-footprint-bench.mjs                |   7 -
 66 files changed, 632 insertions(+), 5126 deletions(-)
 delete mode 100644 packages/backend/src/billing/billing-email-log.service.spec.ts
 delete mode 100644 packages/backend/src/billing/billing-email-log.service.ts
 delete mode 100644 packages/backend/src/billing/billing-email-preferences.ts
 delete mode 100644 packages/backend/src/billing/billing-email-sender.spec.ts
 delete mode 100644 packages/backend/src/billing/billing-email-sender.ts
 delete mode 100644 packages/backend/src/billing/billing-email.service.ts
 delete mode 100644 packages/backend/src/billing/billing-usage-email.service.spec.ts
 delete mode 100644 packages/backend/src/billing/billing-usage-email.service.ts
 delete mode 100644 packages/backend/src/billing/billing.config.spec.ts
 delete mode 100644 packages/backend/src/billing/billing.config.ts
 delete mode 100644 packages/backend/src/billing/billing.controller.spec.ts
 delete mode 100644 packages/backend/src/billing/billing.controller.ts
 delete mode 100644 packages/backend/src/billing/billing.module.ts
 delete mode 100644 packages/backend/src/billing/dto/update-billing-email-preferences.dto.ts
 delete mode 100644 packages/backend/src/billing/emails/billing-plan-email.spec.ts
 delete mode 100644 packages/backend/src/billing/emails/billing-plan-email.tsx
 delete mode 100644 packages/backend/src/billing/emails/preview.tsx
 delete mode 100644 packages/backend/src/billing/plan.service.spec.ts
 delete mode 100644 packages/backend/src/billing/plan.service.ts
 delete mode 100644 packages/backend/src/billing/request-quota-window.spec.ts
 delete mode 100644 packages/backend/src/billing/request-quota-window.ts
 delete mode 100644 packages/backend/src/billing/subscription-status.spec.ts
 delete mode 100644 packages/backend/src/billing/subscription-status.ts
 delete mode 100644 packages/backend/src/billing/subscription-webhook-emails.spec.ts
 delete mode 100644 packages/backend/src/billing/subscription-webhook-emails.ts
 create mode 100644 packages/backend/src/database/migrations/1803200000000-DropBillingSchema.spec.ts
 create mode 100644 packages/backend/src/database/migrations/1803200000000-DropBillingSchema.ts
 delete mode 100644 packages/backend/src/entities/tenant-request-usage.entity.spec.ts
 delete mode 100644 packages/backend/src/entities/tenant-request-usage.entity.ts
 delete mode 100644 packages/backend/test/billing-request-limit.e2e-spec.ts
 create mode 100644 packages/backend/test/drop-billing-schema-migration.e2e-spec.ts
 create mode 100644 packages/backend/test/proxy-no-plan-gate.e2e-spec.ts
 delete mode 100644 packages/backend/test/tenant-request-usage-migration.e2e-spec.ts
 delete mode 100644 packages/shared/__tests__/plan-limits.spec.ts
 delete mode 100644 packages/shared/src/plan-limits.ts

diff --git a/docs/dev/manifest-guide.md b/docs/dev/manifest-guide.md
index 97ac55de..18797e81 100644
--- a/docs/dev/manifest-guide.md
+++ b/docs/dev/manifest-guide.md
@@ -144,7 +144,6 @@ packages/
 │   │   ├── setup/                           # First-run admin setup wizard
 │   │   ├── free-models/                     # Free LLM model catalog
 │   │   ├── model-discovery/                 # Per-provider model fetching + fallback
-│   │   ├── billing/                         # Stripe billing status + plan limits
 │   │   ├── error-pages/                     # Custom error-page config (internal + public)
 │   │   ├── waitlist/                        # Pivot waiting-list claims + legacy Autofix claim compatibility route
 │   │   ├── discovery/                       # Self-hosted discovery onboarding (forwarded to Peacock)
@@ -430,7 +429,6 @@ Every resource belongs to a tenant; users only authenticate and (optionally) app
 | GET                       | `/api/v1/providers` / `/api/v1/providers/usage` | Session/API Key                     | Connected provider list + usage                                                                             |
 | GET                       | `/api/v1/provider-analytics/*`                  | Session/API Key                     | Per-provider analytics                                                                                      |
 | GET                       | `/api/v1/errors/breakdown`                      | Session/API Key                     | Error breakdown analytics                                                                                   |
-| GET/PATCH                 | `/api/v1/billing/*`                             | Session/API Key                     | Billing status, light `plan` endpoint, email preferences (Stripe)                                           |
 | POST                      | `/api/v1/waitlist/autofix/claim`                | Public                              | Deprecated no-op compatibility route for older self-hosted versions                                         |
 | POST                      | `/api/v1/waitlist/pivot/claim`                  | Public                              | Closed pivot waiting-list claim, kept for older self-hosted versions; records origin (cloud/self-hosted)   |
 | GET/POST                  | `/api/v1/autofix/status` / `.../enable-all`     | Session/API Key                     | Workspace Autofix coverage + API-only fleet enable (no dashboard caller)                                    |
@@ -528,8 +526,7 @@ See `packages/backend/.env.example` for all variables. Key ones:
 - `AUTOFIX_REPORT_ALL_4XX` — Set `true` to stream an agent's request-side 4xx (4xx except 401/402/403/429) to Phoenix's `POST /api/heal/observe` as evidence, carrying the full request body. Serves no fix and creates no heal attempt; it only lets Phoenix see the body that failed. Wider than the heal path in scope (not limited to `AUTOFIX_REPAIRABLE_STATUSES`) but **gated to agents with Autofix on** — `AutofixService.isActiveFor()`, the same per-agent flag that healing checks. Turning Autofix on is what consents to sending failing requests to the healing service; the check fails closed. Off by default: a second, deployment-level switch on top. Manifest persists nothing; the body is secret-scrubbed, capped at 256 KB, batched, and dropped under backpressure. Skipped when Autofix already reported the same failure via `/api/heal`. See `routing/autofix/observation-reporter.ts`.
 - `REQUEST_RECORDING_STORAGE` / `REQUEST_RECORDING_FILESYSTEM_PATH` / `REQUEST_RECORDING_S3_*` / `REQUEST_RECORDING_RETENTION_DAYS` — Provider Attempt body recording storage + retention. See [Request Recording](#request-recording-provider-attempt-bodies).
 - `CREDITS_BASE_URL` / `CREDITS_MASTER_KEY` / `CREDITS_AUTO_PROVISION_ALLOWLIST` / `CREDITS_GEMINI_FREE_MAX_BUDGET` — Managed free providers (e.g. Gemini Free) via the credits gateway (default base URL `https://credits.manifest.build`; free-provider budget default `10`).
-- `STRIPE_SECRET_KEY` / `STRIPE_WEBHOOK_SECRET` / `STRIPE_PRO_PRICE_ID` — Billing (cloud only). See `packages/backend/src/billing/`.
-- `PLAN_LIMIT_FREE_REQUESTS` / `PLAN_LIMIT_PRO_REQUESTS` / `PLAN_REQUEST_QUOTA_RESET_AT` — Per-plan request quotas enforced by `plan.service.ts`.
+- Thinker has no billing, plans or request quotas (#14): the `STRIPE_*`, `PLAN_LIMIT_*` and `PLAN_REQUEST_QUOTA_RESET_AT` variables are gone and ignored if set. The proxy no longer checks a plan limit per request and never answers 402 on its own; `DropBillingSchema1803200000000` drops the leftover billing tables and columns.
 
 ## Domain Terminology
 
@@ -584,7 +581,7 @@ Opt-in, **per-harness** recording of Provider Attempt request/response bodies, b
 - **Toggle**: `GET/PATCH /api/v1/routing/:agentName/recording` (in `tier.controller.ts`); UI in `pages/SettingsRecordingSection.tsx`. **Default ON for newly created harnesses only** — enabling the feature never changed existing harnesses' settings. Setting changes apply immediately across replicas.
 - **Storage selection** (`REQUEST_RECORDING_STORAGE=auto|s3|filesystem|disabled`, default `auto`): complete S3 credentials win; otherwise self-hosted falls back to the filesystem path (`REQUEST_RECORDING_FILESYSTEM_PATH`, default `/data/request-recordings`). Managed Cloud never silently falls back to ephemeral local disk. S3 config: `REQUEST_RECORDING_S3_BUCKET/ENDPOINT/REGION/ACCESS_KEY_ID/SECRET_ACCESS_KEY/FORCE_PATH_STYLE`.
 - **Encryption at rest**: recordings are encrypted under the **current** `MANIFEST_ENCRYPTION_KEY` only. The `MANIFEST_ENCRYPTION_KEY_PREVIOUS` re-encryption pass does **not** rewrite recordings — after a key change, older recordings are unreadable until retention removes them. Pre-encryption gzip-only recordings stay readable.
-- **Retention** (`REQUEST_RECORDING_RETENTION_DAYS`): defaults Cloud Free 7d, Cloud Pro 365d, self-hosted 365d. Cleanup cron in `database/request-recording-retention.service.ts`.
+- **Retention** (`REQUEST_RECORDING_RETENTION_DAYS`): one instance-wide value, default 365d (no per-plan retention). Cleanup cron in `database/request-recording-retention.service.ts`.
 - **Privacy**: inline base64 images are stripped from recordings (and from Phoenix observation payloads).
 - **Code**: `common/services/request-recording-storage.service.ts` (storage backends), `common/utils/request-recording-codec.ts` (gzip + encryption codec), `routing/proxy/attempt-recording.service.ts` + `attempt-recording-capture.ts` (capture in the proxy path).
 - **Deploy templates** provision durable recording storage (see README deploy table). Volume-backed templates are single-instance; use S3-compatible storage before scaling horizontally.
diff --git a/package-lock.json b/package-lock.json
index 1abc8d48..b4e30b95 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15146,6 +15146,7 @@
       "resolved": "https://registry.npmjs.org/stripe/-/stripe-18.5.0.tgz",
       "integrity": "sha512-Hp+wFiEQtCB0LlNgcFh5uVyKznpDjzyUZ+CNVEf+I3fhlYvh7rZruIg+jOwzJRCpy0ZTPMjlzm7J2/M2N6d+DA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "qs": "^6.11.0"
       },
@@ -17033,7 +17034,6 @@
         "@better-auth/cimd": "1.7.4",
         "@better-auth/mcp": "1.7.4",
         "@better-auth/oauth-provider": "1.7.4",
-        "@better-auth/stripe": "1.7.4",
         "@modelcontextprotocol/server": "2.0.0",
         "@nestjs/cache-manager": "^3.1.3",
         "@nestjs/common": "^11.2.1",
@@ -17063,7 +17063,6 @@
         "react-dom": "^19.2.8",
         "reflect-metadata": "^0.2.0",
         "rxjs": "^7.8.0",
-        "stripe": "^18.0.0",
         "typeorm": "^0.3.0",
         "uuid": "^11.0.0",
         "zod": "^4.4.3"
@@ -17243,22 +17242,6 @@
         }
       }
     },
-    "packages/backend/node_modules/@better-auth/stripe": {
-      "version": "1.7.4",
-      "resolved": "https://registry.npmjs.org/@better-auth/stripe/-/stripe-1.7.4.tgz",
-      "integrity": "sha512-mjKfpxfYSeyma2B3jheDVJ8/SlINf9VDWTa+7Ty1Q/TboAHUGVOLaNdBlqoFY9V2Fvg80DvPhxsFVk8+ZXXNtw==",
-      "license": "MIT",
-      "dependencies": {
-        "defu": "^6.1.5",
-        "zod": "^4.5.4"
-      },
-      "peerDependencies": {
-        "@better-auth/core": "^1.7.4",
-        "better-auth": "^1.7.4",
-        "better-call": "1.4.0",
-        "stripe": "^18 || ^19 || ^20 || ^21 || ^22"
-      }
-    },
     "packages/backend/node_modules/@better-auth/telemetry": {
       "version": "1.7.4",
       "resolved": "https://registry.npmjs.org/@better-auth/telemetry/-/telemetry-1.7.4.tgz",
diff --git a/packages/backend/.env.example b/packages/backend/.env.example
index b60185a6..33679bf5 100644
--- a/packages/backend/.env.example
+++ b/packages/backend/.env.example
@@ -34,8 +34,7 @@ BETTER_AUTH_URL=http://localhost:3001
 # AGENT_USAGE_DAILY_READ_TENANTS=        # Optional comma-separated tenant rollout before global cutover
 # AGENT_USAGE_DAILY_BATCH_SIZE=250       # Requests and provider attempts selected per transaction
 # AGENT_USAGE_DAILY_RUN_BUDGET_MS=5000   # Maximum work budget for each one-minute run
-# Optional global recording retention override.
-# Defaults: Cloud Free 7 days, Cloud Pro 365 days, self-hosted 365 days.
+# Optional recording retention override, in days (default 365).
 # REQUEST_RECORDING_RETENTION_DAYS=365
 # Storage selection defaults to auto: complete S3 credentials win; otherwise
 # self-hosted installs use the mounted filesystem path. Managed Cloud never
@@ -148,21 +147,6 @@ BETTER_AUTH_URL=http://localhost:3001
 # ERROR_PAGE_PUSH_SECRET=     # Shared secret for /api/v1/internal/error-pages (CMS push API)
 # CRM_METRICS_SECRET=         # Cloud only. Secret for /api/v1/internal/crm-metrics; min 32 chars, exports user emails
 
-# ── Stripe Billing (cloud only) ─────────────────────
-# Enables the Free/Pro plan paywall. Cloud-only: billing no-ops when these are
-# unset or when running self-hosted (MANIFEST_MODE=selfhosted). Set all three
-# STRIPE_* vars to turn billing on.
-# STRIPE_SECRET_KEY=          # sk_test_... / sk_live_...
-# STRIPE_WEBHOOK_SECRET=      # whsec_... (from `stripe listen` or the dashboard webhook)
-# STRIPE_PRO_PRICE_ID=        # price_... for the Manifest Pro recurring price
-#
-# Optional request-limit tuning (defaults: free 10000 req, pro unlimited)
-# PLAN_LIMIT_FREE_REQUESTS=10000
-# PLAN_LIMIT_PRO_REQUESTS=
-# Requests before this ISO timestamp are ignored by monthly plan quota counters.
-# Use only for hosted billing rollouts or emergency usage resets; message history remains intact.
-# PLAN_REQUEST_QUOTA_RESET_AT=2026-07-09T09:06:52Z
-
 # ── Release announcement email (Auto-fix / Doctor version) ──
 # The sending tool lives OUTSIDE this repo (sebconejo/autofix-email-to-subscribers);
 # only the React Email template stays here. These two knobs feed the template.
diff --git a/packages/backend/package.json b/packages/backend/package.json
index 9ff2c52b..38985a87 100644
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -28,7 +28,6 @@
     "@better-auth/cimd": "1.7.4",
     "@better-auth/mcp": "1.7.4",
     "@better-auth/oauth-provider": "1.7.4",
-    "@better-auth/stripe": "1.7.4",
     "@modelcontextprotocol/server": "2.0.0",
     "@nestjs/cache-manager": "^3.1.3",
     "@nestjs/common": "^11.2.1",
@@ -58,7 +57,6 @@
     "react-dom": "^19.2.8",
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.8.0",
-    "stripe": "^18.0.0",
     "typeorm": "^0.3.0",
     "uuid": "^11.0.0",
     "zod": "^4.4.3"
diff --git a/packages/backend/src/analytics/analytics.module.ts b/packages/backend/src/analytics/analytics.module.ts
index 63ce3231..21a0d99c 100644
--- a/packages/backend/src/analytics/analytics.module.ts
+++ b/packages/backend/src/analytics/analytics.module.ts
@@ -40,7 +40,6 @@ import { AttemptStatsService } from './services/attempt-stats.service';
 import { AutofixAnalyticsController } from './controllers/autofix-analytics.controller';
 import { AutofixStatsService } from './services/autofix-stats.service';
 import { RequestVolumeService } from './services/request-volume.service';
-import { BillingModule } from '../billing/billing.module';
 import { AutofixModule } from '../routing/autofix/autofix.module';
 import { AgentUsageDailyService } from './services/agent-usage-daily.service';
 
@@ -63,7 +62,6 @@ import { AgentUsageDailyService } from './services/agent-usage-daily.service';
     OtlpModule,
     RoutingCoreModule,
     ModelPricesModule,
-    BillingModule,
     AutofixModule,
   ],
   controllers: [
diff --git a/packages/backend/src/app.module.ts b/packages/backend/src/app.module.ts
index fb8ca3ba..d4149533 100644
--- a/packages/backend/src/app.module.ts
+++ b/packages/backend/src/app.module.ts
@@ -32,7 +32,6 @@ import { SetupModule } from './setup/setup.module';
 import { FreeModelsModule } from './free-models/free-models.module';
 import { TelemetryModule } from './telemetry/telemetry.module';
 import { WaitlistModule } from './waitlist/waitlist.module';
-import { BillingModule } from './billing/billing.module';
 import { DiscoveryModule } from './discovery/discovery.module';
 import { CrmMetricsModule } from './crm-metrics/crm-metrics.module';
 import { McpModule } from './mcp/mcp.module';
@@ -119,7 +118,6 @@ const mcpImports = mcpAvailability().enabled ? [McpModule] : [];
     TelemetryModule,
     BackfillModule,
     WaitlistModule,
-    BillingModule,
     DiscoveryModule,
     ...mcpImports,
     ...crmMetricsImports,
diff --git a/packages/backend/src/auth/auth.instance.spec.ts b/packages/backend/src/auth/auth.instance.spec.ts
index 92948d20..ccb72091 100644
--- a/packages/backend/src/auth/auth.instance.spec.ts
+++ b/packages/backend/src/auth/auth.instance.spec.ts
@@ -7,8 +7,6 @@ const mockBetterAuth = jest.fn().mockReturnValue({
 
 jest.mock('better-auth', () => ({ betterAuth: mockBetterAuth }));
 jest.mock('pg', () => ({ Pool: jest.fn() }));
-const mockStripePlugin = jest.fn().mockReturnValue({ id: 'stripe' });
-jest.mock('@better-auth/stripe', () => ({ stripe: mockStripePlugin }));
 // The MCP/OAuth plugins are ESM-only. Jest (Node 22) cannot require them, so
 // this spec mocks them exactly as it already mocks `better-auth` itself.
 jest.mock('better-auth/plugins', () => ({
@@ -39,12 +37,6 @@ jest.mock('../notifications/emails/reset-password', () => ({
 jest.mock('../notifications/services/email-providers/send-email', () => ({
   sendEmail: jest.fn(),
 }));
-jest.mock('../billing/subscription-webhook-emails', () => ({
-  previousPlanFromEvent: jest.fn().mockReturnValue(null),
-  sendPlanChangedEmail: jest.fn().mockResolvedValue(true),
-  sendSubscriptionCanceledEmail: jest.fn().mockResolvedValue(true),
-  sendSubscriptionConfirmedEmail: jest.fn().mockResolvedValue(true),
-}));
 
 describe('auth.instance', () => {
   const originalEnv = process.env;
@@ -615,20 +607,12 @@ describe('auth.instance', () => {
 
   describe('plugins', () => {
     beforeEach(() => {
-      mockStripePlugin.mockClear();
       (jest.requireMock('@better-auth/mcp') as { mcp: jest.Mock }).mcp.mockClear();
       (jest.requireMock('@better-auth/cimd') as { cimd: jest.Mock }).cimd.mockClear();
       // These tests assert the exact plugin list, so the developer's shell must
       // not be able to flip a branch (MCP_ENABLED=false while testing the
-      // switch, or Stripe keys turning billing on).
-      for (const key of [
-        'MCP_ENABLED',
-        'STRIPE_SECRET_KEY',
-        'STRIPE_WEBHOOK_SECRET',
-        'STRIPE_PRO_PRICE_ID',
-      ]) {
-        delete process.env[key];
-      }
+      // switch).
+      delete process.env['MCP_ENABLED'];
     });
 
     // `mcp()` validates its resource URL as it is constructed and throws for a
@@ -723,127 +707,11 @@ describe('auth.instance', () => {
       ]);
     });
 
-    it('registers the MCP/OAuth plugins but not stripe when billing is disabled', () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
-      delete process.env['STRIPE_SECRET_KEY'];
-      delete process.env['STRIPE_WEBHOOK_SECRET'];
-      delete process.env['STRIPE_PRO_PRICE_ID'];
+    it('registers only the JWT and MCP/OAuth plugins (no billing plugin)', () => {
       loadModule();
 
       const config = mockBetterAuth.mock.calls[0][0];
       expect(config.plugins).toEqual([{ id: 'jwt' }, { id: 'mcp' }, { id: 'cimd' }]);
-      expect(mockStripePlugin).not.toHaveBeenCalled();
-    });
-
-    it('registers the stripe plugin after the MCP/OAuth plugins when billing is enabled', () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
-      process.env['STRIPE_SECRET_KEY'] = 'sk_test_x';
-      process.env['STRIPE_WEBHOOK_SECRET'] = 'whsec_x';
-      process.env['STRIPE_PRO_PRICE_ID'] = 'price_x';
-      loadModule();
-
-      const config = mockBetterAuth.mock.calls[0][0];
-      expect(config.plugins).toEqual([
-        { id: 'jwt' },
-        { id: 'mcp' },
-        { id: 'cimd' },
-        { id: 'stripe' },
-      ]);
-      expect(mockStripePlugin).toHaveBeenCalledTimes(1);
-      const pluginConfig = mockStripePlugin.mock.calls[0][0];
-      expect(pluginConfig.stripeClient).toBeDefined();
-      expect(pluginConfig.stripeWebhookSecret).toBe('whsec_x');
-      expect(pluginConfig.subscription).toMatchObject({
-        enabled: true,
-        plans: [{ name: 'pro', priceId: 'price_x' }],
-      });
-      expect(pluginConfig.subscription.onSubscriptionComplete).toEqual(expect.any(Function));
-      expect(pluginConfig.subscription.onSubscriptionCreated).toEqual(expect.any(Function));
-      expect(pluginConfig.subscription.onSubscriptionUpdate).toEqual(expect.any(Function));
-      expect(pluginConfig.subscription.onSubscriptionCancel).toEqual(expect.any(Function));
-      expect(pluginConfig.subscription.onSubscriptionDeleted).toEqual(expect.any(Function));
-      expect(pluginConfig).not.toHaveProperty('createCustomerOnSignUp');
-    });
-
-    it('onSubscriptionComplete calls sendSubscriptionConfirmedEmail', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
-      process.env['STRIPE_SECRET_KEY'] = 'sk_test_x';
-      process.env['STRIPE_WEBHOOK_SECRET'] = 'whsec_x';
-      process.env['STRIPE_PRO_PRICE_ID'] = 'price_x';
-
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      const webhookEmails = require('../billing/subscription-webhook-emails') as {
-        sendSubscriptionConfirmedEmail: jest.Mock;
-        sendPlanChangedEmail: jest.Mock;
-        sendSubscriptionCanceledEmail: jest.Mock;
-        previousPlanFromEvent: jest.Mock;
-      };
-      jest.spyOn(webhookEmails, 'sendSubscriptionConfirmedEmail').mockResolvedValue(true);
-      jest.spyOn(webhookEmails, 'sendPlanChangedEmail').mockResolvedValue(true);
-      jest.spyOn(webhookEmails, 'sendSubscriptionCanceledEmail').mockResolvedValue(true);
-      jest.spyOn(webhookEmails, 'previousPlanFromEvent').mockReturnValue('free');
-
-      loadModule();
-      const pluginConfig = mockStripePlugin.mock.calls[0][0];
-      const sub = { subscription: { plan: 'pro' } };
-      const evt = { event: { id: 'evt_1' } };
-
-      await pluginConfig.subscription.onSubscriptionComplete({ ...evt, ...sub });
-      expect(webhookEmails.sendSubscriptionConfirmedEmail).toHaveBeenCalled();
-
-      await pluginConfig.subscription.onSubscriptionCreated({ ...evt, ...sub });
-      expect(webhookEmails.sendSubscriptionConfirmedEmail).toHaveBeenCalledTimes(2);
-
-      await pluginConfig.subscription.onSubscriptionUpdate({ ...evt, ...sub });
-      expect(webhookEmails.previousPlanFromEvent).toHaveBeenCalled();
-      expect(webhookEmails.sendPlanChangedEmail).toHaveBeenCalled();
-
-      await pluginConfig.subscription.onSubscriptionDeleted({ ...evt, ...sub });
-      expect(webhookEmails.sendSubscriptionCanceledEmail).toHaveBeenCalled();
-    });
-
-    it('onSubscriptionCancel skips when event is undefined', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
-      process.env['STRIPE_SECRET_KEY'] = 'sk_test_x';
-      process.env['STRIPE_WEBHOOK_SECRET'] = 'whsec_x';
-      process.env['STRIPE_PRO_PRICE_ID'] = 'price_x';
-
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      const webhookEmails = require('../billing/subscription-webhook-emails') as {
-        sendSubscriptionCanceledEmail: jest.Mock;
-      };
-      jest.spyOn(webhookEmails, 'sendSubscriptionCanceledEmail').mockResolvedValue(true);
-
-      loadModule();
-      const pluginConfig = mockStripePlugin.mock.calls[0][0];
-
-      await pluginConfig.subscription.onSubscriptionCancel({
-        event: undefined,
-        subscription: { plan: 'pro' },
-      });
-      expect(webhookEmails.sendSubscriptionCanceledEmail).not.toHaveBeenCalled();
-    });
-
-    it('onSubscriptionCancel sends when event is present', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
-      process.env['STRIPE_SECRET_KEY'] = 'sk_test_x';
-      process.env['STRIPE_WEBHOOK_SECRET'] = 'whsec_x';
-      process.env['STRIPE_PRO_PRICE_ID'] = 'price_x';
-
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      const webhookEmails = require('../billing/subscription-webhook-emails') as {
-        sendSubscriptionCanceledEmail: jest.Mock;
-      };
-      jest.spyOn(webhookEmails, 'sendSubscriptionCanceledEmail').mockResolvedValue(true);
-
-      loadModule();
-      const pluginConfig = mockStripePlugin.mock.calls[0][0];
-
-      await pluginConfig.subscription.onSubscriptionCancel({
-        event: { id: 'evt_cancel' },
-        subscription: { plan: 'pro' },
-      });
-      expect(webhookEmails.sendSubscriptionCanceledEmail).toHaveBeenCalled();
     });
   });
 
diff --git a/packages/backend/src/auth/auth.instance.ts b/packages/backend/src/auth/auth.instance.ts
index 1b88dc06..f6cc53b4 100644
--- a/packages/backend/src/auth/auth.instance.ts
+++ b/packages/backend/src/auth/auth.instance.ts
@@ -3,19 +3,11 @@ import type { Auth } from 'better-auth';
 import { jwt } from 'better-auth/plugins';
 import { cimd } from '@better-auth/cimd';
 import { mcp } from '@better-auth/mcp';
-import { stripe as stripePlugin } from '@better-auth/stripe';
 import { render } from '@react-email/render';
 import { VerifyEmailEmail } from '../notifications/emails/verify-email';
 import { ResetPasswordEmail } from '../notifications/emails/reset-password';
 import { sendEmail } from '../notifications/services/email-providers/send-email';
-import { isBillingEnabled, getStripeClient } from '../billing/billing.config';
 import { optionalPositiveInteger } from '../config/env.util';
-import {
-  previousPlanFromEvent,
-  sendPlanChangedEmail,
-  sendSubscriptionCanceledEmail,
-  sendSubscriptionConfirmedEmail,
-} from '../billing/subscription-webhook-emails';
 import { fetchClientMetadataResource } from './cimd-client-metadata-fetch';
 import { authOriginFromEnv, mcpAvailability } from './mcp-availability';
 import { MCP_READ_SCOPE, MCP_WRITE_SCOPE, MCP_SCOPES } from './mcp-scopes';
@@ -183,37 +175,7 @@ function buildPlugins() {
   // unavailable: `mcp()` validates its resource URL as it is constructed, so
   // building it on an HTTP-only install throws here and takes down the whole
   // process, and CIMD exists only to serve MCP clients.
-  const base = [jwt(), ...(mcpEnabled ? buildMcpPlugins() : [])];
-  if (!isBillingEnabled()) return base;
-  const plans = [{ name: 'pro', priceId: process.env['STRIPE_PRO_PRICE_ID']! }];
-  const priceToPlan = new Map(plans.map((plan) => [plan.priceId, plan.name]));
-  return [
-    ...base,
-    stripePlugin({
-      stripeClient: getStripeClient(),
-      stripeWebhookSecret: process.env['STRIPE_WEBHOOK_SECRET']!,
-      subscription: {
-        enabled: true,
-        plans,
-        onSubscriptionComplete: async ({ event, subscription }) => {
-          await sendSubscriptionConfirmedEmail(database, event, subscription);
-        },
-        onSubscriptionCreated: async ({ event, subscription }) => {
-          await sendSubscriptionConfirmedEmail(database, event, subscription);
-        },
-        onSubscriptionUpdate: async ({ event, subscription }) => {
-          const previousPlan = previousPlanFromEvent(event, priceToPlan);
-          await sendPlanChangedEmail(database, event, subscription, previousPlan);
-        },
-        onSubscriptionCancel: async ({ event, subscription }) => {
-          if (event) await sendSubscriptionCanceledEmail(database, event, subscription);
-        },
-        onSubscriptionDeleted: async ({ event, subscription }) => {
-          await sendSubscriptionCanceledEmail(database, event, subscription);
-        },
-      },
-    }),
-  ];
+  return [jwt(), ...(mcpEnabled ? buildMcpPlugins() : [])];
 }
 
 function buildMcpPlugins() {
diff --git a/packages/backend/src/billing/billing-email-log.service.spec.ts b/packages/backend/src/billing/billing-email-log.service.spec.ts
deleted file mode 100644
index ce62cf87..00000000
--- a/packages/backend/src/billing/billing-email-log.service.spec.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-import { DataSource } from 'typeorm';
-import { FREE_PLAN_REQUESTS_PER_MONTH } from 'manifest-shared';
-import { BillingEmailLogService, hasBillingEmailLog } from './billing-email-log.service';
-
-describe('BillingEmailLogService', () => {
-  it('returns true when a dedupe key is inserted', async () => {
-    const query = jest.fn().mockResolvedValue([{ id: 'log-1' }]);
-    const service = new BillingEmailLogService({ query } as unknown as DataSource);
-
-    await expect(
-      service.tryInsert({
-        dedupeKey: 'billing-usage:t1:2026-07:requests_warning',
-        kind: 'requests_warning',
-        tenantId: 't1',
-        userId: 'u1',
-        periodStart: '2026-07-01T00:00:00.000Z',
-        periodEnd: '2026-08-01T00:00:00.000Z',
-        metadata: { used: 8000, limit: FREE_PLAN_REQUESTS_PER_MONTH },
-      }),
-    ).resolves.toBe(true);
-
-    expect(query).toHaveBeenCalledWith(expect.stringContaining('ON CONFLICT (dedupe_key)'), [
-      expect.any(String),
-      'billing-usage:t1:2026-07:requests_warning',
-      'requests_warning',
-      't1',
-      'u1',
-      null,
-      '2026-07-01T00:00:00.000Z',
-      '2026-08-01T00:00:00.000Z',
-      { used: 8000, limit: FREE_PLAN_REQUESTS_PER_MONTH },
-    ]);
-  });
-
-  it('returns false when the dedupe key already exists', async () => {
-    const service = new BillingEmailLogService({
-      query: jest.fn().mockResolvedValue([]),
-    } as unknown as DataSource);
-
-    await expect(
-      service.tryInsert({
-        dedupeKey: 'billing:subscription_confirmed:sub_1',
-        kind: 'subscription_confirmed',
-      }),
-    ).resolves.toBe(false);
-  });
-
-  it('checks whether a dedupe key exists', async () => {
-    const query = jest.fn().mockResolvedValue({ rows: [{ id: 'log-1' }] });
-    const service = new BillingEmailLogService({ query } as unknown as DataSource);
-
-    await expect(service.hasDedupeKey('billing:subscription_confirmed:sub_1')).resolves.toBe(true);
-
-    expect(query).toHaveBeenCalledWith(
-      expect.stringContaining('SELECT id FROM billing_email_logs'),
-      ['billing:subscription_confirmed:sub_1'],
-    );
-  });
-
-  it('treats unexpected query results as empty rows', async () => {
-    const query = jest.fn().mockResolvedValue({});
-
-    await expect(hasBillingEmailLog({ query }, 'missing')).resolves.toBe(false);
-  });
-});
diff --git a/packages/backend/src/billing/billing-email-log.service.ts b/packages/backend/src/billing/billing-email-log.service.ts
deleted file mode 100644
index fb6cf472..00000000
--- a/packages/backend/src/billing/billing-email-log.service.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-import { Injectable } from '@nestjs/common';
-import { DataSource } from 'typeorm';
-import { v4 as uuid } from 'uuid';
-
-export type BillingEmailLogQueryable = {
-  query(sql: string, params?: unknown[]): Promise<unknown>;
-};
-
-export interface BillingEmailLogParams {
-  dedupeKey: string;
-  kind: string;
-  tenantId?: string | null;
-  userId?: string | null;
-  stripeSubscriptionId?: string | null;
-  periodStart?: string | null;
-  periodEnd?: string | null;
-  metadata?: Record<string, unknown> | null;
-}
-
-function rowsFrom<T>(result: unknown): T[] {
-  if (Array.isArray(result)) return result as T[];
-  if (result && typeof result === 'object' && Array.isArray((result as { rows?: unknown }).rows)) {
-    return (result as { rows: T[] }).rows;
-  }
-  return [];
-}
-
-async function queryRows<T>(
-  db: BillingEmailLogQueryable,
-  sql: string,
-  params: unknown[] = [],
-): Promise<T[]> {
-  return rowsFrom<T>(await db.query(sql, params));
-}
-
-export async function hasBillingEmailLog(
-  db: BillingEmailLogQueryable,
-  dedupeKey: string,
-): Promise<boolean> {
-  const rows = await queryRows<{ id: string }>(
-    db,
-    `SELECT id FROM billing_email_logs WHERE dedupe_key = $1 LIMIT 1`,
-    [dedupeKey],
-  );
-  return rows.length > 0;
-}
-
-export async function tryInsertBillingEmailLog(
-  db: BillingEmailLogQueryable,
-  params: BillingEmailLogParams,
-): Promise<boolean> {
-  const rows = await queryRows<{ id: string }>(
-    db,
-    `INSERT INTO billing_email_logs
-       (id, dedupe_key, kind, tenant_id, user_id, stripe_subscription_id, period_start, period_end, metadata)
-     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
-     ON CONFLICT (dedupe_key) DO NOTHING
-     RETURNING id`,
-    [
-      uuid(),
-      params.dedupeKey,
-      params.kind,
-      params.tenantId ?? null,
-      params.userId ?? null,
-      params.stripeSubscriptionId ?? null,
-      params.periodStart ?? null,
-      params.periodEnd ?? null,
-      params.metadata ?? null,
-    ],
-  );
-  return rows.length > 0;
-}
-
-@Injectable()
-export class BillingEmailLogService {
-  constructor(private readonly dataSource: DataSource) {}
-
-  async hasDedupeKey(dedupeKey: string): Promise<boolean> {
-    return hasBillingEmailLog(this.dataSource, dedupeKey);
-  }
-
-  async tryInsert(params: BillingEmailLogParams): Promise<boolean> {
-    return tryInsertBillingEmailLog(this.dataSource, params);
-  }
-}
diff --git a/packages/backend/src/billing/billing-email-preferences.ts b/packages/backend/src/billing/billing-email-preferences.ts
deleted file mode 100644
index fa9113d1..00000000
--- a/packages/backend/src/billing/billing-email-preferences.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import type { BillingEmailPreferences } from 'manifest-shared';
-
-export const DEFAULT_BILLING_EMAIL_PREFERENCES: BillingEmailPreferences = {
-  usageAlerts: true,
-};
-
-export function normalizeBillingEmailPreferences(raw: unknown): BillingEmailPreferences {
-  const value = raw as Partial<BillingEmailPreferences> | null | undefined;
-  return {
-    usageAlerts:
-      typeof value?.usageAlerts === 'boolean'
-        ? value.usageAlerts
-        : DEFAULT_BILLING_EMAIL_PREFERENCES.usageAlerts,
-  };
-}
diff --git a/packages/backend/src/billing/billing-email-sender.spec.ts b/packages/backend/src/billing/billing-email-sender.spec.ts
deleted file mode 100644
index ee488c57..00000000
--- a/packages/backend/src/billing/billing-email-sender.spec.ts
+++ /dev/null
@@ -1,222 +0,0 @@
-jest.mock('@react-email/render', () => ({
-  render: jest
-    .fn()
-    .mockImplementation((_el: unknown, opts?: { plainText?: boolean }) =>
-      Promise.resolve(opts?.plainText ? 'plain text' : '<html>rendered</html>'),
-    ),
-}));
-jest.mock('./emails/billing-plan-email', () => ({
-  SubscriptionPlanEmail: jest.fn().mockReturnValue('sub-element'),
-  PlanUsageEmail: jest.fn().mockReturnValue('usage-element'),
-}));
-jest.mock('../notifications/services/email-providers/send-email', () => ({
-  sendEmail: jest.fn().mockResolvedValue(true),
-}));
-
-import {
-  formatPlanName,
-  getBillingEmailFrom,
-  getBillingAppUrl,
-  subscriptionEmailSubject,
-  usageEmailSubject,
-  sendSubscriptionPlanEmail,
-  sendPlanUsageEmail,
-} from './billing-email-sender';
-import { sendEmail } from '../notifications/services/email-providers/send-email';
-import { SubscriptionPlanEmail, PlanUsageEmail } from './emails/billing-plan-email';
-
-describe('billing-email-sender', () => {
-  const saved = { ...process.env };
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    process.env = { ...saved };
-    delete process.env['EMAIL_FROM'];
-    delete process.env['NOTIFICATION_FROM_EMAIL'];
-    delete process.env['BETTER_AUTH_URL'];
-  });
-
-  afterAll(() => {
-    process.env = { ...saved };
-  });
-
-  describe('formatPlanName', () => {
-    it('capitalizes "pro"', () => expect(formatPlanName('pro')).toBe('Pro'));
-    it('capitalizes "Pro"', () => expect(formatPlanName('Pro')).toBe('Pro'));
-    it('capitalizes "free"', () => expect(formatPlanName('free')).toBe('Free'));
-    it('returns Manifest for null', () => expect(formatPlanName(null)).toBe('Manifest'));
-    it('returns Manifest for undefined', () => expect(formatPlanName(undefined)).toBe('Manifest'));
-    it('returns Manifest for empty string', () => expect(formatPlanName('')).toBe('Manifest'));
-    it('returns Manifest for whitespace', () => expect(formatPlanName('  ')).toBe('Manifest'));
-    it('capitalizes first letter of unknown plans', () =>
-      expect(formatPlanName('starter')).toBe('Starter'));
-  });
-
-  describe('getBillingEmailFrom', () => {
-    it('returns the explicit value when given', () => {
-      expect(getBillingEmailFrom('custom@example.com')).toBe('custom@example.com');
-    });
-
-    it('falls back to EMAIL_FROM', () => {
-      process.env['EMAIL_FROM'] = 'from@env.com';
-      expect(getBillingEmailFrom()).toBe('from@env.com');
-    });
-
-    it('falls back to NOTIFICATION_FROM_EMAIL', () => {
-      process.env['NOTIFICATION_FROM_EMAIL'] = 'notify@env.com';
-      expect(getBillingEmailFrom()).toBe('notify@env.com');
-    });
-
-    it('falls back to the default address', () => {
-      expect(getBillingEmailFrom()).toBe('noreply@manifest.build');
-    });
-
-    it('falls back when explicit is null', () => {
-      expect(getBillingEmailFrom(null)).toBe('noreply@manifest.build');
-    });
-  });
-
-  describe('getBillingAppUrl', () => {
-    it('returns the explicit value, stripping trailing slashes', () => {
-      expect(getBillingAppUrl('https://my.app/')).toBe('https://my.app');
-    });
-
-    it('falls back to BETTER_AUTH_URL', () => {
-      process.env['BETTER_AUTH_URL'] = 'https://auth.example.com';
-      expect(getBillingAppUrl()).toBe('https://auth.example.com');
-    });
-
-    it('falls back to the default app URL', () => {
-      expect(getBillingAppUrl()).toBe('https://app.manifest.build');
-    });
-
-    it('falls back when explicit is null', () => {
-      expect(getBillingAppUrl(null)).toBe('https://app.manifest.build');
-    });
-
-    it('returns the default when stripping slashes yields empty', () => {
-      expect(getBillingAppUrl('///')).toBe('https://app.manifest.build');
-    });
-  });
-
-  describe('subscriptionEmailSubject', () => {
-    it('returns a plan_changed subject', () => {
-      expect(subscriptionEmailSubject('plan_changed', 'Pro')).toBe(
-        'Your Manifest plan changed to Pro',
-      );
-    });
-
-    it('returns a cancellation_confirmed subject', () => {
-      expect(subscriptionEmailSubject('cancellation_confirmed', 'Pro')).toBe(
-        'Your Manifest Pro cancellation is scheduled',
-      );
-    });
-
-    it('returns a subscription_confirmed subject', () => {
-      expect(subscriptionEmailSubject('subscription_confirmed', 'Pro')).toBe(
-        'Your Manifest Pro plan is active',
-      );
-    });
-  });
-
-  describe('usageEmailSubject', () => {
-    it('returns the limit-reached subject', () => {
-      expect(usageEmailSubject('requests_limit_reached')).toBe(
-        'Your Manifest monthly request limit has been reached',
-      );
-    });
-
-    it('returns the warning subject', () => {
-      expect(usageEmailSubject('requests_warning')).toBe(
-        'Your Manifest workspace has used 80% of monthly requests',
-      );
-    });
-  });
-
-  describe('sendSubscriptionPlanEmail', () => {
-    it('renders, sends, and returns the result', async () => {
-      const props = {
-        kind: 'subscription_confirmed' as const,
-        userName: 'Ada',
-        planName: 'Pro',
-        previousPlanName: null,
-        periodEnd: null,
-        appUrl: 'https://app.manifest.build',
-        manageBillingUrl: 'https://app.manifest.build/account',
-      };
-      const result = await sendSubscriptionPlanEmail('ada@example.com', props);
-
-      expect(result).toBe(true);
-      expect(SubscriptionPlanEmail).toHaveBeenCalledWith(props);
-      expect(sendEmail).toHaveBeenCalledWith({
-        to: 'ada@example.com',
-        subject: 'Your Manifest Pro plan is active',
-        html: '<html>rendered</html>',
-        text: 'plain text',
-        from: 'Manifest <noreply@manifest.build>',
-      });
-    });
-
-    it('uses a custom from email when provided', async () => {
-      const props = {
-        kind: 'plan_changed' as const,
-        userName: null,
-        planName: 'Free',
-        previousPlanName: 'Pro',
-        periodEnd: null,
-        appUrl: 'https://app.manifest.build',
-        manageBillingUrl: 'https://app.manifest.build/account',
-      };
-      await sendSubscriptionPlanEmail('ada@example.com', props, 'custom@manifest.build');
-
-      expect(sendEmail).toHaveBeenCalledWith(
-        expect.objectContaining({
-          from: 'Manifest <custom@manifest.build>',
-        }),
-      );
-    });
-  });
-
-  describe('sendPlanUsageEmail', () => {
-    it('renders, sends, and returns the result', async () => {
-      const props = {
-        kind: 'requests_limit_reached' as const,
-        userName: 'Ada',
-        used: 10000,
-        limit: 10000,
-        periodEnd: '2026-08-01T00:00:00.000Z',
-        appUrl: 'https://app.manifest.build',
-      };
-      const result = await sendPlanUsageEmail('ada@example.com', props);
-
-      expect(result).toBe(true);
-      expect(PlanUsageEmail).toHaveBeenCalledWith(props);
-      expect(sendEmail).toHaveBeenCalledWith({
-        to: 'ada@example.com',
-        subject: 'Your Manifest monthly request limit has been reached',
-        html: '<html>rendered</html>',
-        text: 'plain text',
-        from: 'Manifest <noreply@manifest.build>',
-      });
-    });
-
-    it('uses a custom from email when provided', async () => {
-      const props = {
-        kind: 'requests_warning' as const,
-        userName: null,
-        used: 8000,
-        limit: 10000,
-        periodEnd: '2026-08-01T00:00:00.000Z',
-        appUrl: 'https://app.manifest.build',
-      };
-      await sendPlanUsageEmail('ada@example.com', props, 'custom@manifest.build');
-
-      expect(sendEmail).toHaveBeenCalledWith(
-        expect.objectContaining({
-          from: 'Manifest <custom@manifest.build>',
-          subject: 'Your Manifest workspace has used 80% of monthly requests',
-        }),
-      );
-    });
-  });
-});
diff --git a/packages/backend/src/billing/billing-email-sender.ts b/packages/backend/src/billing/billing-email-sender.ts
deleted file mode 100644
index 118325af..00000000
--- a/packages/backend/src/billing/billing-email-sender.ts
+++ /dev/null
@@ -1,76 +0,0 @@
-import { getDashboardBaseUrl } from '../common/utils/dashboard-url';
-import { render } from '@react-email/render';
-import {
-  PlanUsageEmail,
-  PlanUsageEmailProps,
-  SubscriptionPlanEmail,
-  SubscriptionPlanEmailProps,
-} from './emails/billing-plan-email';
-import { sendEmail } from '../notifications/services/email-providers/send-email';
-
-export function formatPlanName(plan: string | null | undefined): string {
-  const normalized = (plan ?? '').trim().toLowerCase();
-  if (normalized === 'pro') return 'Pro';
-  if (normalized === 'free') return 'Free';
-  if (!normalized) return 'Manifest';
-  return normalized.charAt(0).toUpperCase() + normalized.slice(1);
-}
-
-export function getBillingEmailFrom(explicit?: string | null): string {
-  return (
-    explicit ||
-    process.env['EMAIL_FROM'] ||
-    process.env['NOTIFICATION_FROM_EMAIL'] ||
-    'noreply@manifest.build'
-  );
-}
-
-export function getBillingAppUrl(explicit?: string | null): string {
-  return getDashboardBaseUrl(explicit);
-}
-
-export function subscriptionEmailSubject(kind: SubscriptionPlanEmailProps['kind'], plan: string) {
-  if (kind === 'plan_changed') return `Your Manifest plan changed to ${plan}`;
-  if (kind === 'cancellation_confirmed') return `Your Manifest ${plan} cancellation is scheduled`;
-  return `Your Manifest ${plan} plan is active`;
-}
-
-export function usageEmailSubject(kind: PlanUsageEmailProps['kind']) {
-  return kind === 'requests_limit_reached'
-    ? 'Your Manifest monthly request limit has been reached'
-    : 'Your Manifest workspace has used 80% of monthly requests';
-}
-
-export async function sendSubscriptionPlanEmail(
-  to: string,
-  props: SubscriptionPlanEmailProps,
-  fromEmail?: string | null,
-): Promise<boolean> {
-  const element = SubscriptionPlanEmail(props);
-  const html = await render(element);
-  const text = await render(element, { plainText: true });
-  return sendEmail({
-    to,
-    subject: subscriptionEmailSubject(props.kind, props.planName),
-    html,
-    text,
-    from: `Manifest <${getBillingEmailFrom(fromEmail)}>`,
-  });
-}
-
-export async function sendPlanUsageEmail(
-  to: string,
-  props: PlanUsageEmailProps,
-  fromEmail?: string | null,
-): Promise<boolean> {
-  const element = PlanUsageEmail(props);
-  const html = await render(element);
-  const text = await render(element, { plainText: true });
-  return sendEmail({
-    to,
-    subject: usageEmailSubject(props.kind),
-    html,
-    text,
-    from: `Manifest <${getBillingEmailFrom(fromEmail)}>`,
-  });
-}
diff --git a/packages/backend/src/billing/billing-email.service.ts b/packages/backend/src/billing/billing-email.service.ts
deleted file mode 100644
index 17376924..00000000
--- a/packages/backend/src/billing/billing-email.service.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import type { PlanUsageEmailProps, SubscriptionPlanEmailProps } from './emails/billing-plan-email';
-import {
-  getBillingAppUrl,
-  sendPlanUsageEmail,
-  sendSubscriptionPlanEmail,
-} from './billing-email-sender';
-
-@Injectable()
-export class BillingEmailService {
-  private readonly logger = new Logger(BillingEmailService.name);
-  private readonly fromEmail: string;
-
-  constructor(private readonly configService: ConfigService) {
-    this.fromEmail =
-      this.configService.get<string>('app.emailFrom') ||
-      this.configService.get<string>('app.notificationFromEmail', 'noreply@manifest.build');
-  }
-
-  getAppUrl(): string {
-    return getBillingAppUrl(this.configService.get<string>('app.betterAuthUrl', ''));
-  }
-
-  async sendSubscriptionPlanEmail(
-    to: string,
-    props: Omit<SubscriptionPlanEmailProps, 'appUrl' | 'manageBillingUrl'>,
-  ): Promise<boolean> {
-    const appUrl = this.getAppUrl();
-    const sent = await sendSubscriptionPlanEmail(
-      to,
-      {
-        ...props,
-        appUrl,
-        manageBillingUrl: `${appUrl}/account`,
-      },
-      this.fromEmail,
-    );
-    if (!sent) this.logger.warn(`Failed to send billing lifecycle email to ${to}`);
-    return sent;
-  }
-
-  async sendPlanUsageEmail(
-    to: string,
-    props: Omit<PlanUsageEmailProps, 'appUrl'>,
-  ): Promise<boolean> {
-    const sent = await sendPlanUsageEmail(
-      to,
-      {
-        ...props,
-        appUrl: this.getAppUrl(),
-      },
-      this.fromEmail,
-    );
-    if (!sent) this.logger.warn(`Failed to send billing usage email to ${to}`);
-    return sent;
-  }
-}
diff --git a/packages/backend/src/billing/billing-usage-email.service.spec.ts b/packages/backend/src/billing/billing-usage-email.service.spec.ts
deleted file mode 100644
index ec751547..00000000
--- a/packages/backend/src/billing/billing-usage-email.service.spec.ts
+++ /dev/null
@@ -1,239 +0,0 @@
-jest.mock('./billing.config', () => ({
-  isBillingEnabled: jest.fn(),
-}));
-
-import { DataSource } from 'typeorm';
-import { FREE_PLAN_REQUESTS_PER_MONTH } from 'manifest-shared';
-import { BillingUsageEmailService } from './billing-usage-email.service';
-import { isBillingEnabled } from './billing.config';
-import { PlanService } from './plan.service';
-import { BillingEmailLogService } from './billing-email-log.service';
-import { BillingEmailService } from './billing-email.service';
-import { IngestEventBusService } from '../common/services/ingest-event-bus.service';
-
-describe('BillingUsageEmailService', () => {
-  let service: BillingUsageEmailService;
-  let dataSourceQuery: jest.Mock;
-  let getLimits: jest.Mock;
-  let countRequestsSince: jest.Mock;
-  let hasDedupeKey: jest.Mock;
-  let tryInsert: jest.Mock;
-  let sendPlanUsageEmail: jest.Mock;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    (isBillingEnabled as jest.Mock).mockReturnValue(true);
-    getLimits = jest.fn().mockResolvedValue({
-      agents: 1,
-      requestsPerMonth: FREE_PLAN_REQUESTS_PER_MONTH,
-    });
-    countRequestsSince = jest.fn().mockResolvedValue(8_000);
-    hasDedupeKey = jest.fn().mockResolvedValue(false);
-    tryInsert = jest.fn().mockResolvedValue(true);
-    sendPlanUsageEmail = jest.fn().mockResolvedValue(true);
-    dataSourceQuery = jest.fn(() => {
-      return Promise.resolve([
-        {
-          email: 'owner@example.com',
-          name: 'Ada',
-          user_id: 'u1',
-          billing_email_preferences: null,
-        },
-      ]);
-    });
-    service = new BillingUsageEmailService(
-      { all: jest.fn() } as unknown as IngestEventBusService,
-      { getLimits, countRequestsSince } as unknown as PlanService,
-      { query: dataSourceQuery } as unknown as DataSource,
-      { hasDedupeKey, tryInsert } as unknown as BillingEmailLogService,
-      { sendPlanUsageEmail } as unknown as BillingEmailService,
-    );
-  });
-
-  it('does nothing when billing is disabled', async () => {
-    (isBillingEnabled as jest.Mock).mockReturnValue(false);
-
-    await expect(service.checkTenantUsage('t1')).resolves.toBe(false);
-
-    expect(getLimits).not.toHaveBeenCalled();
-    expect(sendPlanUsageEmail).not.toHaveBeenCalled();
-  });
-
-  it('sends the 80 percent warning once per tenant and month', async () => {
-    jest.useFakeTimers().setSystemTime(new Date('2026-07-06T12:00:00.000Z'));
-    try {
-      await expect(service.checkTenantUsage('t1')).resolves.toBe(true);
-
-      expect(countRequestsSince).toHaveBeenCalledWith('t1', Date.UTC(2026, 6, 1));
-      expect(hasDedupeKey).toHaveBeenCalledWith(
-        'billing-usage:t1:2026-07-01T00:00:00.000Z:requests_warning',
-      );
-      expect(sendPlanUsageEmail).toHaveBeenCalledWith(
-        'owner@example.com',
-        expect.objectContaining({
-          kind: 'requests_warning',
-          userName: 'Ada',
-          used: 8000,
-          limit: FREE_PLAN_REQUESTS_PER_MONTH,
-          periodEnd: '2026-08-01T00:00:00.000Z',
-        }),
-      );
-      expect(tryInsert).toHaveBeenCalledWith(
-        expect.objectContaining({
-          dedupeKey: 'billing-usage:t1:2026-07-01T00:00:00.000Z:requests_warning',
-          kind: 'requests_warning',
-          tenantId: 't1',
-          userId: 'u1',
-          periodStart: '2026-07-01T00:00:00.000Z',
-          periodEnd: '2026-08-01T00:00:00.000Z',
-          metadata: { used: 8000, limit: FREE_PLAN_REQUESTS_PER_MONTH },
-        }),
-      );
-    } finally {
-      jest.useRealTimers();
-    }
-  });
-
-  it('subscribes to message events and unsubscribes on destroy', async () => {
-    const unsubscribe = jest.fn();
-    const handlers: Array<(event: { kind: string; tenantId: string }) => void> = [];
-    const bus = {
-      all: jest.fn(() => ({
-        subscribe: (handler: (event: { kind: string; tenantId: string }) => void) => {
-          handlers.push(handler);
-          return { unsubscribe };
-        },
-      })),
-    } as unknown as IngestEventBusService;
-    const localService = new BillingUsageEmailService(
-      bus,
-      { getLimits, countRequestsSince } as unknown as PlanService,
-      { query: dataSourceQuery } as unknown as DataSource,
-      { hasDedupeKey, tryInsert } as unknown as BillingEmailLogService,
-      { sendPlanUsageEmail } as unknown as BillingEmailService,
-    );
-    const check = jest.spyOn(localService, 'checkTenantUsage').mockRejectedValue(new Error('boom'));
-    const loggerWarn = jest.spyOn(localService['logger'], 'warn').mockImplementation();
-
-    localService.onModuleInit();
-    handlers[0]({ kind: 'other', tenantId: 't1' });
-    handlers[0]({ kind: 'message', tenantId: 't1' });
-    await Promise.resolve();
-
-    expect(check).toHaveBeenCalledTimes(1);
-    expect(check).toHaveBeenCalledWith('t1');
-    expect(loggerWarn).toHaveBeenCalledWith(
-      'Billing usage email check failed for tenant t1: Error: boom',
-    );
-
-    localService.onModuleDestroy();
-    expect(unsubscribe).toHaveBeenCalledTimes(1);
-    loggerWarn.mockRestore();
-  });
-
-  it('sends the limit-reached email instead of the warning when usage is at the cap', async () => {
-    countRequestsSince.mockResolvedValue(FREE_PLAN_REQUESTS_PER_MONTH);
-
-    await service.checkTenantUsage('t1');
-
-    expect(sendPlanUsageEmail).toHaveBeenCalledWith(
-      'owner@example.com',
-      expect.objectContaining({
-        kind: 'requests_limit_reached',
-        used: FREE_PLAN_REQUESTS_PER_MONTH,
-      }),
-    );
-  });
-
-  it('does not send when the dedupe log already exists', async () => {
-    hasDedupeKey.mockResolvedValue(true);
-
-    await expect(service.checkTenantUsage('t1')).resolves.toBe(false);
-
-    expect(sendPlanUsageEmail).not.toHaveBeenCalled();
-    expect(tryInsert).not.toHaveBeenCalled();
-  });
-
-  it('does not write the dedupe log when no billing recipient exists', async () => {
-    const warn = jest.spyOn(service['logger'], 'warn').mockImplementation();
-    dataSourceQuery.mockResolvedValueOnce([]);
-
-    await expect(service.checkTenantUsage('t1')).resolves.toBe(false);
-
-    expect(warn).toHaveBeenCalledWith('No billing email recipient found for tenant t1');
-    expect(sendPlanUsageEmail).not.toHaveBeenCalled();
-    expect(tryInsert).not.toHaveBeenCalled();
-    warn.mockRestore();
-  });
-
-  it('does not send or write the dedupe log when usage alerts are disabled', async () => {
-    dataSourceQuery.mockResolvedValueOnce([
-      {
-        email: 'owner@example.com',
-        name: 'Ada',
-        user_id: 'u1',
-        billing_email_preferences: { usageAlerts: false },
-      },
-    ]);
-
-    await expect(service.checkTenantUsage('t1')).resolves.toBe(false);
-
-    expect(sendPlanUsageEmail).not.toHaveBeenCalled();
-    expect(tryInsert).not.toHaveBeenCalled();
-  });
-
-  it('does not write the dedupe log when sending fails', async () => {
-    sendPlanUsageEmail.mockResolvedValue(false);
-
-    await expect(service.checkTenantUsage('t1')).resolves.toBe(false);
-
-    expect(sendPlanUsageEmail).toHaveBeenCalledTimes(1);
-    expect(tryInsert).not.toHaveBeenCalled();
-  });
-
-  it('does not send below the usage threshold', async () => {
-    countRequestsSince.mockResolvedValue(7_999);
-
-    await expect(service.checkTenantUsage('t1')).resolves.toBe(false);
-
-    expect(hasDedupeKey).not.toHaveBeenCalled();
-    expect(tryInsert).not.toHaveBeenCalled();
-    expect(sendPlanUsageEmail).not.toHaveBeenCalled();
-  });
-
-  it('does not send when the plan limit is null (unlimited)', async () => {
-    getLimits.mockResolvedValue({ requestsPerMonth: null });
-
-    await expect(service.checkTenantUsage('t1')).resolves.toBe(false);
-
-    expect(countRequestsSince).not.toHaveBeenCalled();
-    expect(sendPlanUsageEmail).not.toHaveBeenCalled();
-  });
-
-  it('does not send when the plan limit is zero', async () => {
-    getLimits.mockResolvedValue({ requestsPerMonth: 0 });
-
-    await expect(service.checkTenantUsage('t1')).resolves.toBe(false);
-
-    expect(countRequestsSince).not.toHaveBeenCalled();
-    expect(sendPlanUsageEmail).not.toHaveBeenCalled();
-  });
-
-  it('does not send when recipient email is null', async () => {
-    const warn = jest.spyOn(service['logger'], 'warn').mockImplementation();
-    dataSourceQuery.mockResolvedValueOnce([
-      { email: null, name: 'Ada', user_id: 'u1', billing_email_preferences: null },
-    ]);
-
-    await expect(service.checkTenantUsage('t1')).resolves.toBe(false);
-
-    expect(warn).toHaveBeenCalledWith('No billing email recipient found for tenant t1');
-    expect(sendPlanUsageEmail).not.toHaveBeenCalled();
-    warn.mockRestore();
-  });
-
-  it('calls onModuleDestroy safely when there is no subscription', () => {
-    // Service not yet initialized — ingestSub is undefined
-    expect(() => service.onModuleDestroy()).not.toThrow();
-  });
-});
diff --git a/packages/backend/src/billing/billing-usage-email.service.ts b/packages/backend/src/billing/billing-usage-email.service.ts
deleted file mode 100644
index d9e7a3e8..00000000
--- a/packages/backend/src/billing/billing-usage-email.service.ts
+++ /dev/null
@@ -1,118 +0,0 @@
-import { Injectable, Logger, OnModuleDestroy, OnModuleInit } from '@nestjs/common';
-import { DataSource } from 'typeorm';
-import { Subscription } from 'rxjs';
-import { IngestEventBusService } from '../common/services/ingest-event-bus.service';
-import { isBillingEnabled } from './billing.config';
-import { PlanService } from './plan.service';
-import { BillingEmailLogService } from './billing-email-log.service';
-import { BillingEmailService } from './billing-email.service';
-import { normalizeBillingEmailPreferences } from './billing-email-preferences';
-
-const REQUEST_WARNING_RATIO = 0.8;
-
-interface BillingRecipient {
-  email: string | null;
-  name: string | null;
-  user_id: string | null;
-  billing_email_preferences: unknown;
-}
-
-@Injectable()
-export class BillingUsageEmailService implements OnModuleInit, OnModuleDestroy {
-  private readonly logger = new Logger(BillingUsageEmailService.name);
-  private ingestSub?: Subscription;
-
-  constructor(
-    private readonly ingestBus: IngestEventBusService,
-    private readonly planService: PlanService,
-    private readonly dataSource: DataSource,
-    private readonly logs: BillingEmailLogService,
-    private readonly emails: BillingEmailService,
-  ) {}
-
-  onModuleInit(): void {
-    this.ingestSub = this.ingestBus.all().subscribe((event) => {
-      if (event.kind !== 'message') return;
-      void this.checkTenantUsage(event.tenantId).catch((err) => {
-        this.logger.warn(`Billing usage email check failed for tenant ${event.tenantId}: ${err}`);
-      });
-    });
-  }
-
-  onModuleDestroy(): void {
-    this.ingestSub?.unsubscribe();
-  }
-
-  async checkTenantUsage(tenantId: string): Promise<boolean> {
-    if (!isBillingEnabled()) return false;
-
-    const limits = await this.planService.getLimits({ tenantId, userId: null });
-    const limit = limits.requestsPerMonth;
-    if (limit === null || limit <= 0) return false;
-
-    const now = new Date();
-    const monthStartMs = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1);
-    const periodStart = new Date(monthStartMs).toISOString();
-    const periodEnd = new Date(
-      Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1),
-    ).toISOString();
-    const used = await this.planService.countRequestsSince(tenantId, monthStartMs);
-    const kind = this.resolveMilestoneKind(used, limit);
-    if (!kind) return false;
-
-    const dedupeKey = `billing-usage:${tenantId}:${periodStart}:${kind}`;
-    if (await this.logs.hasDedupeKey(dedupeKey)) return false;
-
-    const recipient = await this.resolveRecipient(tenantId);
-    if (!recipient?.email) {
-      this.logger.warn(`No billing email recipient found for tenant ${tenantId}`);
-      return false;
-    }
-    if (!normalizeBillingEmailPreferences(recipient.billing_email_preferences).usageAlerts) {
-      return false;
-    }
-
-    const sent = await this.emails.sendPlanUsageEmail(recipient.email, {
-      kind,
-      userName: recipient.name,
-      used,
-      limit,
-      periodEnd,
-    });
-    if (!sent) return false;
-
-    await this.logs.tryInsert({
-      dedupeKey,
-      kind,
-      tenantId,
-      userId: recipient.user_id,
-      periodStart,
-      periodEnd,
-      metadata: { used, limit },
-    });
-    return true;
-  }
-
-  private resolveMilestoneKind(
-    used: number,
-    limit: number,
-  ): 'requests_warning' | 'requests_limit_reached' | null {
-    if (used >= limit) return 'requests_limit_reached';
-    if (used >= Math.ceil(limit * REQUEST_WARNING_RATIO)) return 'requests_warning';
-    return null;
-  }
-
-  private async resolveRecipient(tenantId: string): Promise<BillingRecipient | null> {
-    const rows: BillingRecipient[] = await this.dataSource.query(
-      `SELECT COALESCE(u.email, t.email) AS email,
-              COALESCE(NULLIF(u.name, ''), NULLIF(t.organization_name, '')) AS name,
-              t.owner_user_id AS user_id,
-              t.billing_email_preferences AS billing_email_preferences
-         FROM tenants t
-         LEFT JOIN "user" u ON u.id = t.owner_user_id
-        WHERE t.id = $1`,
-      [tenantId],
-    );
-    return rows[0] ?? null;
-  }
-}
diff --git a/packages/backend/src/billing/billing.config.spec.ts b/packages/backend/src/billing/billing.config.spec.ts
deleted file mode 100644
index 6bef7021..00000000
--- a/packages/backend/src/billing/billing.config.spec.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-import { isBillingEnabled } from './billing.config';
-
-describe('isBillingEnabled', () => {
-  const saved = { ...process.env };
-
-  afterEach(() => {
-    process.env = { ...saved };
-  });
-
-  function setCloudWithKeys() {
-    process.env['MANIFEST_MODE'] = 'cloud';
-    process.env['STRIPE_SECRET_KEY'] = 'sk_test_x';
-    process.env['STRIPE_WEBHOOK_SECRET'] = 'whsec_x';
-    process.env['STRIPE_PRO_PRICE_ID'] = 'price_x';
-  }
-
-  it('is enabled in cloud mode with all Stripe env vars set', () => {
-    setCloudWithKeys();
-    expect(isBillingEnabled()).toBe(true);
-  });
-
-  it('is disabled when self-hosted even with keys', () => {
-    setCloudWithKeys();
-    process.env['MANIFEST_MODE'] = 'selfhosted';
-    expect(isBillingEnabled()).toBe(false);
-  });
-
-  it.each(['STRIPE_SECRET_KEY', 'STRIPE_WEBHOOK_SECRET', 'STRIPE_PRO_PRICE_ID'])(
-    'is disabled when %s is missing',
-    (key) => {
-      setCloudWithKeys();
-      delete process.env[key];
-      expect(isBillingEnabled()).toBe(false);
-    },
-  );
-});
-
-describe('getStripeClient', () => {
-  const saved = { ...process.env };
-
-  afterEach(() => {
-    process.env = { ...saved };
-    jest.resetModules();
-    jest.unmock('stripe');
-  });
-
-  it('lazily creates a singleton Stripe client', () => {
-    const constructorCalls: string[] = [];
-    jest.resetModules();
-    jest.mock('stripe', () => ({
-      __esModule: true,
-      default: class MockStripe {
-        constructor(key: string) {
-          constructorCalls.push(key);
-        }
-      },
-    }));
-    process.env['STRIPE_SECRET_KEY'] = 'sk_test_singleton';
-
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { getStripeClient } = require('./billing.config');
-
-    const first = getStripeClient();
-    const second = getStripeClient();
-
-    expect(first).toBe(second);
-    expect(constructorCalls).toEqual(['sk_test_singleton']);
-  });
-});
diff --git a/packages/backend/src/billing/billing.config.ts b/packages/backend/src/billing/billing.config.ts
deleted file mode 100644
index 038b6431..00000000
--- a/packages/backend/src/billing/billing.config.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-import Stripe from 'stripe';
-import { isSelfHosted } from '../common/utils/detect-self-hosted';
-
-/**
- * Billing (Stripe plans + request limits) is active only in cloud mode with
- * full Stripe configuration. Self-hosted installs are always unlimited.
- */
-export function isBillingEnabled(): boolean {
-  return (
-    !isSelfHosted() &&
-    !!process.env['STRIPE_SECRET_KEY'] &&
-    !!process.env['STRIPE_WEBHOOK_SECRET'] &&
-    !!process.env['STRIPE_PRO_PRICE_ID']
-  );
-}
-
-let stripeClient: Stripe | null = null;
-
-export function getStripeClient(): Stripe {
-  if (!stripeClient) {
-    stripeClient = new Stripe(process.env['STRIPE_SECRET_KEY']!);
-  }
-  return stripeClient;
-}
diff --git a/packages/backend/src/billing/billing.controller.spec.ts b/packages/backend/src/billing/billing.controller.spec.ts
deleted file mode 100644
index e30c4f8e..00000000
--- a/packages/backend/src/billing/billing.controller.spec.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-import { Test, TestingModule } from '@nestjs/testing';
-import { BillingController } from './billing.controller';
-import { PlanService } from './plan.service';
-
-describe('BillingController', () => {
-  let controller: BillingController;
-  const getBillingStatus = jest.fn();
-  const getPlanStatus = jest.fn();
-  const updateBillingEmailPreferences = jest.fn();
-
-  beforeEach(async () => {
-    const module: TestingModule = await Test.createTestingModule({
-      controllers: [BillingController],
-      providers: [
-        {
-          provide: PlanService,
-          useValue: { getBillingStatus, getPlanStatus, updateBillingEmailPreferences },
-        },
-      ],
-    }).compile();
-    controller = module.get(BillingController);
-    jest.clearAllMocks();
-  });
-
-  it('returns the billing status for the request tenant context', async () => {
-    const status = { enabled: false };
-    getBillingStatus.mockResolvedValue(status);
-    const ctx = { tenantId: 't1', userId: 'u1' };
-    const result = await controller.status(ctx as never);
-    expect(getBillingStatus).toHaveBeenCalledWith(ctx);
-    expect(result).toBe(status);
-  });
-
-  it('returns the light plan status for the request tenant context', async () => {
-    const planStatus = { enabled: true, plan: 'pro' };
-    getPlanStatus.mockResolvedValue(planStatus);
-    const ctx = { tenantId: 't1', userId: 'u1' };
-    const result = await controller.plan(ctx as never);
-    expect(getPlanStatus).toHaveBeenCalledWith(ctx);
-    expect(result).toBe(planStatus);
-  });
-
-  it('updates billing email preferences for the request tenant context', async () => {
-    const preferences = { usageAlerts: false };
-    updateBillingEmailPreferences.mockResolvedValue(preferences);
-    const ctx = { tenantId: 't1', userId: 'u1' };
-
-    const result = await controller.updateEmailPreferences(ctx as never, preferences);
-
-    expect(updateBillingEmailPreferences).toHaveBeenCalledWith(ctx, preferences);
-    expect(result).toBe(preferences);
-  });
-});
diff --git a/packages/backend/src/billing/billing.controller.ts b/packages/backend/src/billing/billing.controller.ts
deleted file mode 100644
index 296368fb..00000000
--- a/packages/backend/src/billing/billing.controller.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import { Body, Controller, Get, Patch } from '@nestjs/common';
-import { TenantCtx, TenantContext } from '../common/decorators/tenant-context.decorator';
-import { PlanService } from './plan.service';
-import { UpdateBillingEmailPreferencesDto } from './dto/update-billing-email-preferences.dto';
-
-@Controller('api/v1')
-export class BillingController {
-  constructor(private readonly planService: PlanService) {}
-
-  @Get('billing/status')
-  async status(@TenantCtx() ctx: TenantContext) {
-    return this.planService.getBillingStatus(ctx);
-  }
-
-  @Get('billing/plan')
-  async plan(@TenantCtx() ctx: TenantContext) {
-    return this.planService.getPlanStatus(ctx);
-  }
-
-  @Patch('billing/email-preferences')
-  async updateEmailPreferences(
-    @TenantCtx() ctx: TenantContext,
-    @Body() body: UpdateBillingEmailPreferencesDto,
-  ) {
-    return this.planService.updateBillingEmailPreferences(ctx, body);
-  }
-}
diff --git a/packages/backend/src/billing/billing.module.ts b/packages/backend/src/billing/billing.module.ts
deleted file mode 100644
index 453c4ebc..00000000
--- a/packages/backend/src/billing/billing.module.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { Module } from '@nestjs/common';
-import { TypeOrmModule } from '@nestjs/typeorm';
-import { Tenant } from '../entities/tenant.entity';
-import { BillingController } from './billing.controller';
-import { PlanService } from './plan.service';
-import { BillingEmailLogService } from './billing-email-log.service';
-import { BillingEmailService } from './billing-email.service';
-import { BillingUsageEmailService } from './billing-usage-email.service';
-
-@Module({
-  imports: [TypeOrmModule.forFeature([Tenant])],
-  controllers: [BillingController],
-  providers: [PlanService, BillingEmailLogService, BillingEmailService, BillingUsageEmailService],
-  exports: [PlanService],
-})
-export class BillingModule {}
diff --git a/packages/backend/src/billing/dto/update-billing-email-preferences.dto.ts b/packages/backend/src/billing/dto/update-billing-email-preferences.dto.ts
deleted file mode 100644
index 68597a27..00000000
--- a/packages/backend/src/billing/dto/update-billing-email-preferences.dto.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import { IsBoolean } from 'class-validator';
-
-export class UpdateBillingEmailPreferencesDto {
-  @IsBoolean()
-  usageAlerts!: boolean;
-}
diff --git a/packages/backend/src/billing/emails/billing-plan-email.spec.ts b/packages/backend/src/billing/emails/billing-plan-email.spec.ts
deleted file mode 100644
index bcdeda01..00000000
--- a/packages/backend/src/billing/emails/billing-plan-email.spec.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-import { renderToStaticMarkup } from 'react-dom/server';
-import { FREE_PLAN_REQUESTS_PER_MONTH } from 'manifest-shared';
-import { PlanUsageEmail, SubscriptionPlanEmail } from './billing-plan-email';
-
-describe('billing plan emails', () => {
-  it('escapes user-controlled names in subscription emails', () => {
-    const html = renderToStaticMarkup(
-      SubscriptionPlanEmail({
-        kind: 'subscription_confirmed',
-        userName: '<img src=x onerror="alert(1)">',
-        planName: 'Pro',
-        appUrl: 'https://app.manifest.build',
-        manageBillingUrl: 'https://app.manifest.build/account',
-      }),
-    );
-
-    expect(html).not.toMatch(/<img src=x/);
-    expect(html).toContain('&lt;img src=x');
-    expect(html).toContain('href="https://app.manifest.build/account#email-preferences"');
-  });
-
-  it('renders plan-change subscription copy', () => {
-    const html = renderToStaticMarkup(
-      SubscriptionPlanEmail({
-        kind: 'plan_changed',
-        userName: 'Ada',
-        planName: 'Pro',
-        previousPlanName: 'Free',
-        appUrl: 'https://app.manifest.build',
-        manageBillingUrl: 'https://app.manifest.build/account',
-      }),
-    );
-
-    expect(html).toContain('Your plan is now Manifest Pro');
-    expect(html).toContain('from <strong>Free</strong>');
-  });
-
-  it('renders cancellation subscription copy without a period end', () => {
-    const html = renderToStaticMarkup(
-      SubscriptionPlanEmail({
-        kind: 'cancellation_confirmed',
-        userName: 'Ada',
-        planName: 'Pro',
-        appUrl: 'https://app.manifest.build',
-        manageBillingUrl: 'https://app.manifest.build/account',
-      }),
-    );
-
-    expect(html).toContain('Pro cancellation confirmed');
-    expect(html).toContain('scheduled to end');
-  });
-
-  it('renders usage counts and reset date', () => {
-    const html = renderToStaticMarkup(
-      PlanUsageEmail({
-        kind: 'requests_warning',
-        userName: 'Ada',
-        used: 8000,
-        limit: FREE_PLAN_REQUESTS_PER_MONTH,
-        periodEnd: '2026-08-01T00:00:00.000Z',
-        appUrl: 'https://app.manifest.build',
-      }),
-    );
-
-    expect(html).toContain('80% of monthly requests used');
-    expect(html).toContain('8,000');
-    expect(html).toContain('10,000');
-    expect(html).toContain('Aug 1, 2026');
-  });
-
-  it('normalizes usage CTA URLs with trailing slashes', () => {
-    const html = renderToStaticMarkup(
-      PlanUsageEmail({
-        kind: 'requests_limit_reached',
-        used: FREE_PLAN_REQUESTS_PER_MONTH,
-        limit: FREE_PLAN_REQUESTS_PER_MONTH,
-        periodEnd: '2026-08-01T00:00:00.000Z',
-        appUrl: 'https://app.manifest.build/',
-      }),
-    );
-
-    expect(html).toContain('href="https://app.manifest.build/upgrade"');
-    expect(html).toContain('href="https://app.manifest.build/account#email-preferences"');
-    expect(html).not.toContain('https://app.manifest.build//upgrade');
-    expect(html).not.toContain('https://app.manifest.build//account');
-  });
-});
diff --git a/packages/backend/src/billing/emails/billing-plan-email.tsx b/packages/backend/src/billing/emails/billing-plan-email.tsx
deleted file mode 100644
index 1f919044..00000000
--- a/packages/backend/src/billing/emails/billing-plan-email.tsx
+++ /dev/null
@@ -1,436 +0,0 @@
-import { getEmailAssetUrl } from '../../common/utils/dashboard-url';
-import * as React from 'react';
-import {
-  Html,
-  Head,
-  Body,
-  Container,
-  Section,
-  Text,
-  Button,
-  Preview,
-  Hr,
-  Link,
-  Img,
-} from '@react-email/components';
-
-type SubscriptionEmailKind = 'subscription_confirmed' | 'plan_changed' | 'cancellation_confirmed';
-type UsageEmailKind = 'requests_warning' | 'requests_limit_reached';
-
-export interface SubscriptionPlanEmailProps {
-  kind: SubscriptionEmailKind;
-  userName?: string | null;
-  planName: string;
-  previousPlanName?: string | null;
-  periodEnd?: string | null;
-  appUrl: string;
-  manageBillingUrl: string;
-  logoUrl?: string;
-}
-
-export interface PlanUsageEmailProps {
-  kind: UsageEmailKind;
-  userName?: string | null;
-  used: number;
-  limit: number;
-  periodEnd: string;
-  appUrl: string;
-  logoUrl?: string;
-}
-
-function greeting(name?: string | null): string {
-  const trimmed = name?.trim();
-  return trimmed ? `Hi ${trimmed},` : 'Hi,';
-}
-
-function formatCount(value: number): string {
-  return Math.round(value).toLocaleString('en-US', { maximumFractionDigits: 0 });
-}
-
-function formatDate(raw?: string | null): string | null {
-  if (!raw) return null;
-  const date = new Date(raw);
-  if (Number.isNaN(date.getTime())) return raw;
-  return date.toLocaleDateString('en-US', {
-    month: 'short',
-    day: 'numeric',
-    year: 'numeric',
-    timeZone: 'UTC',
-  });
-}
-
-function accountUrl(appUrl: string): string {
-  return `${appUrl.replace(/\/+$/, '')}/account`;
-}
-
-function emailPreferencesUrl(appUrl: string): string {
-  return `${accountUrl(appUrl)}#email-preferences`;
-}
-
-function subscriptionCopy(props: SubscriptionPlanEmailProps): {
-  preview: string;
-  badge: string;
-  heading: string;
-  body: React.ReactNode | 'multi';
-  paragraphs?: React.ReactNode[];
-  features?: string[];
-  cta: string;
-  ctaSecondary?: string;
-} {
-  if (props.kind === 'plan_changed') {
-    return {
-      preview: `Your Manifest plan changed to ${props.planName}`,
-      badge: '',
-      heading: `Your plan is now Manifest ${props.planName}`,
-      body: (
-        <>
-          {greeting(props.userName)} your plan has been updated
-          {props.previousPlanName ? (
-            <>
-              {' '}
-              from <strong>{props.previousPlanName}</strong>
-            </>
-          ) : null}{' '}
-          to <strong>{props.planName}</strong>. Here's what you now have access to:
-        </>
-      ),
-      features: [
-        'Unlimited routed requests',
-        '365 days dashboard retention',
-        'Basic support (platform issues, billing, licence activation)',
-      ],
-      cta: 'Open Manifest',
-    };
-  }
-
-  if (props.kind === 'cancellation_confirmed') {
-    const end = formatDate(props.periodEnd);
-    return {
-      preview: end
-        ? `Your Manifest ${props.planName} plan is scheduled to end on ${end}`
-        : `Your Manifest ${props.planName} plan is scheduled to end`,
-      badge: '',
-      heading: `${props.planName} cancellation confirmed`,
-      body: 'multi',
-      paragraphs: [
-        <>
-          {greeting(props.userName)} we're sorry to see you go. Your{' '}
-          <strong>{props.planName}</strong> cancellation has been confirmed. You'll keep full access
-          to {props.planName} features{end ? ` until ${end}` : ''}.
-        </>,
-        <>
-          After that date, your workspace will switch back to the Free plan with 10,000 routed
-          requests per month and 7-day dashboard retention.
-        </>,
-        <>
-          If there's anything we can do, or if you'd like to discuss your needs, we're here to help.
-        </>,
-      ],
-      cta: 'Manage billing',
-      ctaSecondary: 'Talk to sales',
-    };
-  }
-
-  return {
-    preview: `Your Manifest ${props.planName} plan is active`,
-    badge: '',
-    heading: `Welcome to Manifest ${props.planName}`,
-    body: (
-      <>
-        {greeting(props.userName)} your <strong>{props.planName}</strong> plan is active. The whole
-        team warmly thanks you for your trust. Here's what you now have access to:
-      </>
-    ),
-    features: [
-      'Unlimited routed requests',
-      '365 days dashboard retention',
-      'Basic support (platform issues, billing, licence activation)',
-    ],
-    cta: 'Open Manifest',
-  };
-}
-
-export function SubscriptionPlanEmail(props: SubscriptionPlanEmailProps) {
-  const logoUrl = props.logoUrl ?? getEmailAssetUrl('manifest-logo.png', props.appUrl);
-  const copy = subscriptionCopy(props);
-  const accent = props.kind === 'cancellation_confirmed' ? '#ea580c' : '#0f766e';
-  const accentBg = props.kind === 'cancellation_confirmed' ? '#fff7ed' : '#ecfdf5';
-
-  return (
-    <Html>
-      <Head />
-      <Preview>{copy.preview}</Preview>
-      <Body style={body}>
-        <Container style={container}>
-          <Section style={logoSection}>
-            <Img src={logoUrl} alt="Manifest LLM Gateway" width="174" height="32" style={logoImg} />
-          </Section>
-
-          <Section style={card}>
-            <Text style={heading}>{copy.heading}</Text>
-            {copy.paragraphs ? (
-              copy.paragraphs.map((p, i) => (
-                <Text key={i} style={paragraph}>
-                  {p}
-                </Text>
-              ))
-            ) : (
-              <Text style={paragraph}>{copy.body}</Text>
-            )}
-
-            {copy.features && copy.features.length > 0 && (
-              <Section style={{ margin: '0 0 24px' }}>
-                {copy.features.map((feature) => (
-                  <Text key={feature} style={featureItem}>
-                    <span style={{ color: '#2632EF' }}>✓</span> {feature}
-                  </Text>
-                ))}
-              </Section>
-            )}
-
-            <Section style={buttonContainer}>
-              <Button
-                style={button}
-                href={
-                  props.kind === 'subscription_confirmed' ? props.appUrl : props.manageBillingUrl
-                }
-              >
-                {copy.cta}
-              </Button>
-              {copy.ctaSecondary && (
-                <Button style={buttonSecondary} href="https://manifest.build/pricing">
-                  {copy.ctaSecondary}
-                </Button>
-              )}
-            </Section>
-
-            <Text style={hint}>
-              This email confirms a Manifest plan change only. Stripe may send payment receipts
-              separately.
-            </Text>
-          </Section>
-
-          <Footer preferencesUrl={emailPreferencesUrl(props.appUrl)} />
-        </Container>
-      </Body>
-    </Html>
-  );
-}
-
-export function PlanUsageEmail(props: PlanUsageEmailProps) {
-  const logoUrl = props.logoUrl ?? getEmailAssetUrl('manifest-logo.png', props.appUrl);
-  const isLimit = props.kind === 'requests_limit_reached';
-  const percentage = Math.min(100, Math.round((props.used / props.limit) * 100));
-  const accent = isLimit ? '#dc2626' : '#ea580c';
-  const accentBg = isLimit ? '#fef2f2' : '#fff7ed';
-  const reset = formatDate(props.periodEnd);
-  const title = isLimit ? 'Monthly request limit reached' : '80% of monthly requests used';
-
-  return (
-    <Html>
-      <Head />
-      <Preview>
-        {isLimit
-          ? `Your Manifest workspace reached ${formatCount(props.limit)} monthly requests`
-          : `Your Manifest workspace used ${percentage}% of monthly requests`}
-      </Preview>
-      <Body style={body}>
-        <Container style={container}>
-          <Section style={logoSection}>
-            <Img src={logoUrl} alt="Manifest LLM Gateway" width="174" height="32" style={logoImg} />
-          </Section>
-
-          <Section style={card}>
-            <Text style={heading}>{title}</Text>
-            <Text style={paragraph}>
-              {greeting(props.userName)} your workspace has used{' '}
-              <strong>{formatCount(props.used)}</strong> of{' '}
-              <strong>{formatCount(props.limit)}</strong> included requests this month.
-            </Text>
-
-            <Text style={paragraph}>
-              {isLimit
-                ? `New routed requests are blocked until the limit resets${reset ? ` on ${reset}` : ''}.`
-                : `Requests are still running. The limit resets${reset ? ` on ${reset}` : ' at the start of next month'}.`}
-            </Text>
-
-            <Text style={paragraph}>
-              {isLimit
-                ? 'Upgrade to Pro for unlimited requests.'
-                : `If you reach ${formatCount(props.limit)}, new requests will stop being routed until the next period. To avoid interruptions, stay within your limit or upgrade to Pro for unlimited requests.`}
-            </Text>
-
-            <Section style={buttonContainer}>
-              <Button style={button} href={`${props.appUrl.replace(/\/+$/, '')}/upgrade`}>
-                Review plan
-              </Button>
-            </Section>
-          </Section>
-
-          <Footer preferencesUrl={emailPreferencesUrl(props.appUrl)} />
-        </Container>
-      </Body>
-    </Html>
-  );
-}
-
-function Footer(props: { preferencesUrl: string }) {
-  return (
-    <>
-      <Hr style={divider} />
-      <Section style={footer}>
-        <Text style={footerMuted}>
-          <Link href={props.preferencesUrl} style={footerLink}>
-            Manage email preferences
-          </Link>
-          {' · '}
-          (c) 2026 MNFST Inc.{' '}
-          <Link href="https://manifest.build" style={footerLink}>
-            manifest.build
-          </Link>
-        </Text>
-      </Section>
-    </>
-  );
-}
-
-const brandBg = '#f8f6f1';
-const brandCardBg = '#ffffff';
-const brandFg = '#020817';
-const brandMuted = '#64748b';
-const brandBorder = '#e5dfd6';
-const brandPrimary = '#0f172a';
-const brandPrimaryFg = '#f9f8f5';
-const brandFont =
-  'Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif';
-
-const body: React.CSSProperties = {
-  backgroundColor: brandBg,
-  fontFamily: brandFont,
-  margin: 0,
-  padding: 0,
-};
-
-const container: React.CSSProperties = {
-  maxWidth: '520px',
-  margin: '0 auto',
-  padding: '40px 20px',
-};
-
-const logoSection: React.CSSProperties = {
-  textAlign: 'left' as const,
-  paddingBottom: '32px',
-};
-
-const logoImg: React.CSSProperties = {};
-
-const card: React.CSSProperties = {
-  backgroundColor: brandCardBg,
-  borderRadius: '12px',
-  padding: '40px 36px',
-  border: `1px solid ${brandBorder}`,
-};
-
-const badge: React.CSSProperties = {
-  display: 'inline-block',
-  borderRadius: '999px',
-  fontSize: '12px',
-  fontWeight: 700,
-  padding: '5px 10px',
-  margin: '0 0 16px',
-};
-
-const heading: React.CSSProperties = {
-  fontSize: '22px',
-  fontWeight: 700,
-  color: brandFg,
-  margin: '0 0 12px',
-  lineHeight: '1.3',
-};
-
-const paragraph: React.CSSProperties = {
-  fontSize: '15px',
-  lineHeight: '1.6',
-  color: '#374151',
-  margin: '0 0 24px',
-};
-
-const buttonContainer: React.CSSProperties = {
-  textAlign: 'left' as const,
-  margin: '28px 0 0',
-};
-
-const button: React.CSSProperties = {
-  backgroundColor: brandPrimary,
-  color: brandPrimaryFg,
-  fontSize: '13px',
-  fontWeight: 600,
-  padding: '8px 16px',
-  borderRadius: '6px',
-  textDecoration: 'none',
-  display: 'inline-block',
-  lineHeight: '1',
-};
-
-const buttonSecondary: React.CSSProperties = {
-  backgroundColor: 'transparent',
-  color: brandFg,
-  fontSize: '13px',
-  fontWeight: 600,
-  padding: '8px 16px',
-  borderRadius: '6px',
-  border: `1px solid ${brandBorder}`,
-  textDecoration: 'none',
-  display: 'inline-block',
-  lineHeight: '1',
-  marginLeft: '8px',
-};
-
-const featureItem: React.CSSProperties = {
-  fontSize: '14px',
-  lineHeight: '1.5',
-  color: brandFg,
-  margin: '0 0 6px',
-  padding: '0',
-};
-
-const hint: React.CSSProperties = {
-  fontSize: '13px',
-  lineHeight: '1.5',
-  color: brandMuted,
-  margin: '24px 0 0',
-};
-
-const notice: React.CSSProperties = {
-  border: '1px solid',
-  borderRadius: '8px',
-  padding: '14px 16px',
-  margin: '0 0 8px',
-};
-
-const noticeText: React.CSSProperties = {
-  fontSize: '14px',
-  lineHeight: '1.5',
-  margin: 0,
-};
-
-const divider: React.CSSProperties = {
-  borderColor: brandBorder,
-  borderTop: 'none',
-  margin: '32px 0 24px',
-};
-
-const footer: React.CSSProperties = {
-  textAlign: 'center' as const,
-};
-
-const footerMuted: React.CSSProperties = {
-  fontSize: '12px',
-  color: '#94a3b8',
-  margin: 0,
-};
-
-const footerLink: React.CSSProperties = {
-  color: '#94a3b8',
-  textDecoration: 'underline',
-};
diff --git a/packages/backend/src/billing/emails/preview.tsx b/packages/backend/src/billing/emails/preview.tsx
deleted file mode 100644
index f331628a..00000000
--- a/packages/backend/src/billing/emails/preview.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-/**
- * Quick email preview script.
- * Usage: npx tsx src/billing/emails/preview.tsx [kind]
- * Kinds: requests_warning, requests_limit_reached, subscription_confirmed, plan_changed, cancellation_confirmed
- * Opens the rendered email in the default browser.
- */
-import { render } from '@react-email/render';
-import * as React from 'react';
-import { writeFileSync } from 'fs';
-import { execSync } from 'child_process';
-import { PlanUsageEmail, SubscriptionPlanEmail } from './billing-plan-email';
-
-const kind = (process.argv[2] ?? 'requests_warning') as string;
-const outPath = '/tmp/manifest-email-preview.html';
-
-async function main() {
-  let html: string;
-
-  if (kind === 'requests_warning' || kind === 'requests_limit_reached') {
-    html = await render(
-      React.createElement(PlanUsageEmail, {
-        kind: kind as 'requests_warning' | 'requests_limit_reached',
-        userName: 'Sébastien',
-        used: kind === 'requests_limit_reached' ? 10000 : 8200,
-        limit: 10000,
-        periodEnd: '2026-08-01T00:00:00.000Z',
-        appUrl: 'http://localhost:37475',
-      }),
-    );
-  } else {
-    html = await render(
-      React.createElement(SubscriptionPlanEmail, {
-        kind: kind as 'subscription_confirmed' | 'plan_changed' | 'cancellation_confirmed',
-        userName: 'Sébastien',
-        planName: 'Pro',
-        previousPlanName: kind === 'plan_changed' ? 'Free' : undefined,
-        periodEnd: kind === 'cancellation_confirmed' ? '2026-08-06T00:00:00.000Z' : undefined,
-        appUrl: 'http://localhost:37475',
-        manageBillingUrl: 'http://localhost:37475/account',
-      }),
-    );
-  }
-
-  writeFileSync(outPath, html);
-  console.log(`Preview written to ${outPath}`);
-  execSync(`open ${outPath}`);
-}
-
-main();
diff --git a/packages/backend/src/billing/plan.service.spec.ts b/packages/backend/src/billing/plan.service.spec.ts
deleted file mode 100644
index a2ca6fc1..00000000
--- a/packages/backend/src/billing/plan.service.spec.ts
+++ /dev/null
@@ -1,676 +0,0 @@
-import { Test, TestingModule } from '@nestjs/testing';
-import { getRepositoryToken } from '@nestjs/typeorm';
-import { DataSource } from 'typeorm';
-import { HttpException } from '@nestjs/common';
-import { FREE_PLAN_REQUESTS_PER_MONTH } from 'manifest-shared';
-import { PlanService } from './plan.service';
-import { Tenant } from '../entities/tenant.entity';
-import { toLocalSqlTimestamp, toSqlTimestamp } from '../common/utils/postgres-sql';
-import * as billingConfig from './billing.config';
-
-describe('PlanService', () => {
-  let service: PlanService;
-  let mockTenantFindOne: jest.Mock;
-  let mockTenantUpdate: jest.Mock;
-  let mockQuery: jest.Mock;
-  const saved = { ...process.env };
-  const CTX = { tenantId: 't1', userId: 'u1' };
-  const FRESH_CTX = { tenantId: null, userId: 'u1' };
-  const TENANT = { id: 't1', owner_user_id: 'u1', limit_overrides: null };
-
-  function quotaTriggerDefinition(timeZone: string): string {
-    return `IF (NEW."timestamp" AT TIME ZONE '${timeZone}') AT TIME ZONE 'UTC' < counter_cutover_at`;
-  }
-
-  function processTimeZone(): string {
-    return Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC';
-  }
-
-  function enableBilling() {
-    process.env['MANIFEST_MODE'] = 'cloud';
-    process.env['STRIPE_SECRET_KEY'] = 'sk_test_x';
-    process.env['STRIPE_WEBHOOK_SECRET'] = 'whsec_x';
-    process.env['STRIPE_PRO_PRICE_ID'] = 'price_x';
-  }
-
-  beforeEach(async () => {
-    process.env = { ...saved };
-    jest.restoreAllMocks();
-    mockTenantFindOne = jest.fn().mockResolvedValue(null);
-    mockTenantUpdate = jest.fn().mockResolvedValue({ affected: 1 });
-    mockQuery = jest.fn().mockResolvedValue([]);
-    const module: TestingModule = await Test.createTestingModule({
-      providers: [
-        PlanService,
-        {
-          provide: getRepositoryToken(Tenant),
-          useValue: { findOne: mockTenantFindOne, update: mockTenantUpdate },
-        },
-        { provide: DataSource, useValue: { query: mockQuery } },
-      ],
-    }).compile();
-    service = module.get(PlanService);
-  });
-
-  afterAll(() => {
-    process.env = { ...saved };
-  });
-
-  describe('onModuleInit', () => {
-    it('skips the timezone check for self-hosted mode', async () => {
-      process.env['MANIFEST_MODE'] = 'selfhosted';
-
-      await expect(service.onModuleInit()).resolves.toBeUndefined();
-      expect(mockQuery).not.toHaveBeenCalled();
-    });
-
-    it('accepts the request storage timezone used by the process', async () => {
-      enableBilling();
-      mockQuery.mockResolvedValue([{ definition: quotaTriggerDefinition(processTimeZone()) }]);
-
-      await expect(service.onModuleInit()).resolves.toBeUndefined();
-      expect(mockQuery.mock.calls[0][0]).toContain('pg_get_functiondef');
-    });
-
-    it('rejects a request storage timezone mismatch', async () => {
-      enableBilling();
-      const mismatch = processTimeZone() === 'UTC' ? 'Europe/Paris' : 'UTC';
-      mockQuery.mockResolvedValue([{ definition: quotaTriggerDefinition(mismatch) }]);
-
-      await expect(service.onModuleInit()).rejects.toThrow(
-        'Request quota storage timezone mismatch',
-      );
-    });
-
-    it('rejects a missing request quota trigger', async () => {
-      enableBilling();
-      mockQuery.mockResolvedValue([{ definition: null }]);
-
-      await expect(service.onModuleInit()).rejects.toThrow(
-        'Could not read request quota timezone from installed trigger',
-      );
-    });
-  });
-
-  describe('getPlan', () => {
-    it('returns free when billing is disabled', async () => {
-      expect(await service.getPlan(CTX)).toBe('free');
-      expect(mockQuery).not.toHaveBeenCalled();
-    });
-
-    it('resolves the active subscription in the tenant snapshot query', async () => {
-      enableBilling();
-      mockQuery.mockResolvedValueOnce([{ subscriptionPlan: 'pro' }]);
-      expect(await service.getPlan(CTX)).toBe('pro');
-      expect(mockQuery.mock.calls[0][1]).toEqual(['t1', 'u1']);
-      expect(String(mockQuery.mock.calls[0][0])).toContain('LEFT JOIN LATERAL');
-      expect(String(mockQuery.mock.calls[0][0])).toContain('t."limit_overrides"');
-      expect(String(mockQuery.mock.calls[0][0])).toContain(
-        `"status" IN ('active', 'trialing', 'past_due')`,
-      );
-    });
-
-    it('falls back to ctx.userId when there is no tenant yet', async () => {
-      enableBilling();
-      mockQuery.mockResolvedValueOnce([{ subscriptionPlan: 'pro' }]);
-      expect(await service.getPlan(FRESH_CTX)).toBe('pro');
-      expect(mockQuery.mock.calls[0][1]).toEqual([null, 'u1']);
-    });
-
-    it('returns free when neither tenant owner nor userId exists', async () => {
-      enableBilling();
-      expect(await service.getPlan({ tenantId: null, userId: null })).toBe('free');
-      expect(mockQuery).not.toHaveBeenCalled();
-    });
-
-    it('returns free when no active subscription row exists', async () => {
-      enableBilling();
-      expect(await service.getPlan(CTX)).toBe('free');
-    });
-  });
-
-  describe('getPlanStatus', () => {
-    it('reports billing disabled without querying', async () => {
-      expect(await service.getPlanStatus(CTX)).toEqual({ enabled: false, plan: 'free' });
-      expect(mockQuery).not.toHaveBeenCalled();
-    });
-
-    it('returns the resolved plan with a single snapshot query when enabled', async () => {
-      enableBilling();
-      mockQuery.mockResolvedValueOnce([{ subscriptionPlan: 'pro' }]);
-      expect(await service.getPlanStatus(CTX)).toEqual({ enabled: true, plan: 'pro' });
-      expect(mockQuery).toHaveBeenCalledTimes(1);
-    });
-  });
-
-  describe('getLimits', () => {
-    it('returns unlimited when billing is disabled', async () => {
-      expect(await service.getLimits(CTX)).toEqual({ requestsPerMonth: null });
-    });
-
-    it('returns free plan defaults', async () => {
-      enableBilling();
-      expect(await service.getLimits(CTX)).toEqual({
-        requestsPerMonth: FREE_PLAN_REQUESTS_PER_MONTH,
-      });
-    });
-
-    it('env var overrides plan default', async () => {
-      enableBilling();
-      process.env['PLAN_LIMIT_FREE_REQUESTS'] = '3000';
-      expect((await service.getLimits(CTX)).requestsPerMonth).toBe(3000);
-    });
-
-    it('ignores a non-numeric env override', async () => {
-      enableBilling();
-      process.env['PLAN_LIMIT_FREE_REQUESTS'] = 'abc';
-      expect((await service.getLimits(CTX)).requestsPerMonth).toBe(FREE_PLAN_REQUESTS_PER_MONTH);
-    });
-
-    it('tenant limit_overrides beats env and defaults', async () => {
-      enableBilling();
-      process.env['PLAN_LIMIT_FREE_REQUESTS'] = '3000';
-      mockQuery.mockResolvedValue([{ limitOverrides: { requestsPerMonth: 50_000 } }]);
-      expect((await service.getLimits(CTX)).requestsPerMonth).toBe(50_000);
-    });
-
-    it('returns pro defaults (unlimited) for pro tenants', async () => {
-      enableBilling();
-      mockQuery.mockResolvedValue([{ subscriptionPlan: 'pro' }]);
-      expect(await service.getLimits(CTX)).toEqual({ requestsPerMonth: null });
-    });
-
-    it('can fail open when requested by the proxy hot path', async () => {
-      enableBilling();
-      mockQuery.mockRejectedValue(new Error('snapshot down'));
-      await expect(service.getLimits(CTX, { failOpen: true })).resolves.toEqual({
-        requestsPerMonth: null,
-      });
-    });
-
-    it('throttles the limit failure warning and reports the suppressed count', async () => {
-      enableBilling();
-      mockQuery.mockRejectedValue(new Error('snapshot down'));
-      const warn = jest
-        .spyOn((service as unknown as { logger: { warn: jest.Mock } }).logger, 'warn')
-        .mockImplementation(() => undefined);
-      const nowSpy = jest.spyOn(Date, 'now');
-      try {
-        nowSpy.mockReturnValue(2_000_000);
-        await service.getLimits(CTX, { failOpen: true }); // first → warns once
-        await service.getLimits(CTX, { failOpen: true }); // within window → suppressed
-        expect(warn).toHaveBeenCalledTimes(1);
-        expect(String(warn.mock.calls[0][0])).not.toContain('suppressed');
-
-        nowSpy.mockReturnValue(2_000_000 + 61_000);
-        await service.getLimits(CTX, { failOpen: true }); // window elapsed → warns with tail
-        expect(warn).toHaveBeenCalledTimes(2);
-        expect(String(warn.mock.calls[1][0])).toContain('1 more suppressed');
-      } finally {
-        nowSpy.mockRestore();
-      }
-    });
-  });
-
-  describe('getBillingStatus', () => {
-    it('reports disabled with no Stripe call', async () => {
-      const status = await service.getBillingStatus(CTX);
-      expect(status.enabled).toBe(false);
-      expect(status.requests.limit).toBeNull();
-    });
-
-    it('reports plan, usage and limits when enabled', async () => {
-      enableBilling();
-      mockQuery.mockImplementation((sql: string) =>
-        sql.includes('FROM "tenant_request_usage"')
-          ? Promise.resolve([{ n: 42, baseline_counted: true }])
-          : Promise.resolve([{ subscriptionPlan: 'free' }]),
-      );
-      const status = await service.getBillingStatus(CTX);
-      expect(status).toMatchObject({
-        enabled: true,
-        plan: 'free',
-        emailPreferences: { usageAlerts: true },
-        requests: { used: 42, limit: FREE_PLAN_REQUESTS_PER_MONTH },
-      });
-      // periodEnd is the 1st of next month at midnight UTC.
-      expect(status.requests.periodEnd).toMatch(/^\d{4}-\d{2}-01T00:00:00\.000Z$/);
-    });
-
-    it('returns live usage without waiting for the historical baseline scan', async () => {
-      enableBilling();
-      let resolveBaseline!: (v: Array<{ n: string }>) => void;
-      const baselineHang = new Promise<Array<{ n: string }>>((r) => {
-        resolveBaseline = r;
-      });
-      mockQuery.mockImplementation((sql: string) => {
-        if (sql.includes('FROM "tenant_request_usage"') && sql.includes('SELECT "request_count"')) {
-          return Promise.resolve([{ n: '8', baseline_counted: false }]);
-        }
-        if (sql.includes('EXTRACT(EPOCH')) {
-          return Promise.resolve([{ cutover_ms: String(Date.parse('2026-07-28T09:00:00Z')) }]);
-        }
-        if (sql.includes('SELECT COUNT(*)')) return baselineHang;
-        if (sql.includes('FROM (SELECT 1) seed') || sql.includes('subscriptionPlan')) {
-          return Promise.resolve([{ subscriptionPlan: 'free' }]);
-        }
-        return Promise.resolve([]);
-      });
-
-      const status = await service.getBillingStatus(CTX);
-      expect(status.requests.used).toBe(8);
-
-      // Unblock the background init so the suite does not leak a hanging promise.
-      resolveBaseline([{ n: '1' }]);
-      await new Promise((resolve) => setImmediate(resolve));
-      await new Promise((resolve) => setImmediate(resolve));
-    });
-  });
-
-  describe('billing email preferences', () => {
-    it('defaults usage alerts on when no tenant preference is stored', async () => {
-      mockTenantFindOne.mockResolvedValue(TENANT);
-
-      await expect(service.getBillingEmailPreferences(CTX)).resolves.toEqual({
-        usageAlerts: true,
-      });
-    });
-
-    it('reads stored usage alert opt-outs', async () => {
-      mockTenantFindOne.mockResolvedValue({
-        ...TENANT,
-        billing_email_preferences: { usageAlerts: false },
-      });
-
-      await expect(service.getBillingEmailPreferences(CTX)).resolves.toEqual({
-        usageAlerts: false,
-      });
-    });
-
-    it('updates tenant billing email preferences', async () => {
-      await expect(
-        service.updateBillingEmailPreferences(CTX, { usageAlerts: false }),
-      ).resolves.toEqual({
-        usageAlerts: false,
-      });
-
-      expect(mockTenantUpdate).toHaveBeenCalledWith(
-        { id: 't1' },
-        { billing_email_preferences: { usageAlerts: false } },
-      );
-    });
-
-    it('rejects updates before a workspace exists', async () => {
-      await expect(
-        service.updateBillingEmailPreferences(FRESH_CTX, { usageAlerts: false }),
-      ).rejects.toThrow('A workspace is required');
-      expect(mockTenantUpdate).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('price lookup', () => {
-    beforeEach(() => {
-      mockQuery.mockImplementation((sql: string) =>
-        sql.includes('FROM "tenant_request_usage"')
-          ? Promise.resolve([{ n: 0, baseline_counted: true }])
-          : Promise.resolve([{ subscriptionPlan: 'free' }]),
-      );
-    });
-
-    it('fetches, converts cents to dollars, and caches', async () => {
-      enableBilling();
-      const retrieve = jest.fn().mockResolvedValue({
-        currency: 'usd',
-        recurring: { interval: 'month' },
-        unit_amount: 2000,
-      });
-      jest
-        .spyOn(billingConfig, 'getStripeClient')
-        .mockReturnValue({ prices: { retrieve } } as never);
-
-      const first = await service.getBillingStatus(CTX);
-      const second = await service.getBillingStatus(CTX);
-      expect(first.priceMonthly).toEqual({ amount: 20, currency: 'USD', interval: 'month' });
-      expect(second.priceMonthly).toEqual({ amount: 20, currency: 'USD', interval: 'month' });
-      expect(retrieve).toHaveBeenCalledTimes(1); // second call served from cache
-    });
-
-    it('returns an empty price when Stripe errors, without failing the endpoint', async () => {
-      enableBilling();
-      jest.spyOn(billingConfig, 'getStripeClient').mockReturnValue({
-        prices: { retrieve: jest.fn().mockRejectedValue(new Error('down')) },
-      } as never);
-
-      const status = await service.getBillingStatus(CTX);
-      expect(status.enabled).toBe(true);
-      expect(status.priceMonthly).toEqual({ amount: null, currency: null, interval: null });
-    });
-
-    it('falls back to 100 divisor for an invalid currency code', async () => {
-      enableBilling();
-      jest.spyOn(billingConfig, 'getStripeClient').mockReturnValue({
-        prices: {
-          retrieve: jest.fn().mockResolvedValue({
-            currency: 'INVALID_NOT_A_CURRENCY',
-            recurring: { interval: 'month' },
-            unit_amount: 5000,
-          }),
-        },
-      } as never);
-
-      const status = await service.getBillingStatus(CTX);
-      // 5000 / 100 (fallback divisor) = 50
-      expect(status.priceMonthly.amount).toBe(50);
-    });
-
-    it('handles a price with no unit_amount', async () => {
-      enableBilling();
-      jest.spyOn(billingConfig, 'getStripeClient').mockReturnValue({
-        prices: {
-          retrieve: jest.fn().mockResolvedValue({
-            currency: 'eur',
-            recurring: { interval: 'month' },
-            unit_amount: null,
-          }),
-        },
-      } as never);
-
-      expect((await service.getBillingStatus(CTX)).priceMonthly).toEqual({
-        amount: null,
-        currency: 'EUR',
-        interval: 'month',
-      });
-    });
-  });
-
-  describe('countRequestsSince', () => {
-    const START = Date.UTC(2026, 6, 1); // 2026-07-01 UTC
-    const ROLLOUT_RESET = Date.parse('2026-07-09T09:06:52Z');
-
-    it('returns 0 for a null tenantId without querying', async () => {
-      expect(await service.countRequestsSince(null, START)).toBe(0);
-      expect(mockQuery).not.toHaveBeenCalled();
-    });
-
-    it('reads the exact tenant and rollout-window counter row', async () => {
-      mockQuery.mockResolvedValue([{ n: 7, baseline_counted: true }]);
-      expect(await service.countRequestsSince('t1', START)).toBe(7);
-      const [sql, params] = mockQuery.mock.calls[0];
-      expect(sql).toContain('FROM "tenant_request_usage"');
-      expect(sql).not.toContain('COUNT(');
-      expect(params).toEqual(['t1', toSqlTimestamp(new Date(ROLLOUT_RESET))]);
-    });
-
-    it('casts PostgreSQL bigint counters to numbers', async () => {
-      mockQuery.mockResolvedValue([{ n: '7', baseline_counted: true }]);
-
-      const count = await service.countRequestsSince('t1', START);
-
-      expect(count).toBe(7);
-      expect(typeof count).toBe('number');
-    });
-
-    it('allows the quota reset window to be moved by env override', async () => {
-      process.env['PLAN_REQUEST_QUOTA_RESET_AT'] = '2026-07-10T12:34:56Z';
-      mockQuery.mockResolvedValue([{ n: 4, baseline_counted: true }]);
-
-      expect(await service.countRequestsSince('t1', START)).toBe(4);
-
-      expect(mockQuery.mock.calls[0][1][1]).toBe(toSqlTimestamp(new Date('2026-07-10T12:34:56Z')));
-    });
-
-    it('reads the shared counter on every call instead of serving replica-local state', async () => {
-      mockQuery.mockResolvedValue([{ n: 3, baseline_counted: true }]);
-      await service.countRequestsSince('t1', START);
-      await service.countRequestsSince('t1', START);
-      expect(mockQuery).toHaveBeenCalledTimes(2);
-    });
-
-    it('changes the counter key when the month rolls over', async () => {
-      mockQuery.mockResolvedValue([{ n: 1, baseline_counted: true }]);
-      await service.countRequestsSince('t1', START);
-      await service.countRequestsSince('t1', Date.UTC(2026, 7, 1)); // August
-      expect(mockQuery).toHaveBeenCalledTimes(2);
-      expect(mockQuery.mock.calls[1][1][1]).toBe(toSqlTimestamp(new Date(Date.UTC(2026, 7, 1))));
-    });
-
-    it('returns the live counter immediately and baselines history in the background', async () => {
-      const cutover = Date.parse('2026-07-28T09:00:00Z');
-      mockQuery
-        .mockResolvedValueOnce([{ n: '3', baseline_counted: false }])
-        .mockResolvedValueOnce([{ cutover_ms: String(cutover) }])
-        .mockResolvedValueOnce([{ n: '2' }])
-        .mockResolvedValueOnce([{ n: '5' }]);
-
-      // Hot path must not wait on the historical COUNT — only live increments.
-      expect(await service.countRequestsSince('t1', START)).toBe(3);
-
-      // Flush the scheduled baseline init.
-      await new Promise((resolve) => setImmediate(resolve));
-      await new Promise((resolve) => setImmediate(resolve));
-
-      const [baselineSql, baselineParams] = mockQuery.mock.calls[2];
-      expect(baselineSql).toContain('FROM "requests" r');
-      expect(baselineSql).toContain('m."request_id" IS NULL');
-      expect(baselineSql).toContain('pa."timestamp" < c.local_timestamp');
-      expect(baselineSql).toContain('m."timestamp" < c.local_timestamp');
-      expect(baselineParams).toEqual([
-        't1',
-        toLocalSqlTimestamp(new Date(ROLLOUT_RESET)),
-        Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC',
-        'tenant_request_usage_cutover_v1',
-      ]);
-      expect(mockQuery.mock.calls[3][0]).toContain(
-        'WHEN "tenant_request_usage"."baseline_counted" THEN 0',
-      );
-    });
-
-    it('schedules a post-cutover zero-row without blocking or scanning history', async () => {
-      const augustStart = Date.UTC(2026, 7, 1);
-      const cutover = Date.parse('2026-07-28T09:00:00Z');
-      mockQuery
-        .mockResolvedValueOnce([])
-        .mockResolvedValueOnce([{ cutover_ms: cutover }])
-        .mockResolvedValueOnce([{ n: '0' }]);
-
-      expect(await service.countRequestsSince('t1', augustStart)).toBe(0);
-
-      await new Promise((resolve) => setImmediate(resolve));
-      await new Promise((resolve) => setImmediate(resolve));
-
-      expect(mockQuery).toHaveBeenCalledTimes(3);
-      expect(
-        mockQuery.mock.calls.every(([sql]) => !String(sql).includes('FROM "requests" r')),
-      ).toBe(true);
-      expect(mockQuery.mock.calls[2][1]).toEqual(['t1', toSqlTimestamp(new Date(augustStart)), 0]);
-    });
-
-    it('coalesces concurrent baseline initialization within one process', async () => {
-      const cutover = Date.parse('2026-07-28T09:00:00Z');
-      mockQuery.mockImplementation((sql: string) => {
-        if (sql.includes('SELECT "request_count"'))
-          return Promise.resolve([{ n: 0, baseline_counted: false }]);
-        if (sql.includes('EXTRACT(EPOCH')) return Promise.resolve([{ cutover_ms: cutover }]);
-        if (sql.includes('SELECT COUNT(*)')) return Promise.resolve([{ n: '4' }]);
-        if (sql.includes('INSERT INTO "tenant_request_usage"'))
-          return Promise.resolve([{ n: '4' }]);
-        return Promise.resolve([]);
-      });
-
-      // Both callers return the live counter immediately (0), without awaiting baseline.
-      await expect(
-        Promise.all([
-          service.countRequestsSince('t1', START),
-          service.countRequestsSince('t1', START),
-        ]),
-      ).resolves.toEqual([0, 0]);
-
-      await new Promise((resolve) => setImmediate(resolve));
-      await new Promise((resolve) => setImmediate(resolve));
-
-      expect(
-        mockQuery.mock.calls.filter(([sql]) => String(sql).includes('EXTRACT(EPOCH')),
-      ).toHaveLength(1);
-      expect(
-        mockQuery.mock.calls.filter(([sql]) => String(sql).includes('SELECT COUNT(*)')),
-      ).toHaveLength(1);
-      expect(
-        mockQuery.mock.calls.filter(([sql]) =>
-          String(sql).includes('INSERT INTO "tenant_request_usage"'),
-        ),
-      ).toHaveLength(1);
-    });
-
-    it('does not fail the hot path when the migration cutover marker is missing', async () => {
-      mockQuery.mockResolvedValueOnce([]).mockResolvedValueOnce([]);
-
-      // Live counter is 0; baseline init fails in the background.
-      await expect(service.countRequestsSince('t1', START)).resolves.toBe(0);
-
-      await new Promise((resolve) => setImmediate(resolve));
-      await new Promise((resolve) => setImmediate(resolve));
-    });
-
-    it('rethrows a DB error so the next call can retry', async () => {
-      mockQuery.mockRejectedValueOnce(new Error('boom'));
-      await expect(service.countRequestsSince('t1', START)).rejects.toThrow('boom');
-      mockQuery.mockResolvedValueOnce([{ n: 9, baseline_counted: true }]);
-      expect(await service.countRequestsSince('t1', START)).toBe(9);
-    });
-
-    it('countRequestsThisMonth derives the current UTC month window', async () => {
-      jest.useFakeTimers().setSystemTime(new Date('2026-08-15T10:00:00Z'));
-      try {
-        mockQuery.mockResolvedValue([{ n: 2, baseline_counted: true }]);
-        expect(await service.countRequestsThisMonth('t1')).toBe(2);
-        expect(mockQuery.mock.calls[0][1][1]).toBe(toSqlTimestamp(new Date(Date.UTC(2026, 7, 1))));
-      } finally {
-        jest.useRealTimers();
-      }
-    });
-
-    it('countRequestsThisMonth starts at the rollout reset during the rollout month', async () => {
-      jest.useFakeTimers().setSystemTime(new Date('2026-07-10T10:00:00Z'));
-      try {
-        mockQuery.mockResolvedValue([{ n: 2, baseline_counted: true }]);
-        expect(await service.countRequestsThisMonth('t1')).toBe(2);
-        expect(mockQuery.mock.calls[0][1][1]).toBe(toSqlTimestamp(new Date(ROLLOUT_RESET)));
-      } finally {
-        jest.useRealTimers();
-      }
-    });
-  });
-
-  describe('assertWithinRequestLimit', () => {
-    // Route subscription lookups vs the request counter lookup to the right result.
-    function routeQuery(plan: string, count: number) {
-      mockQuery.mockImplementation((sql: string) =>
-        sql.includes('FROM "tenant_request_usage"')
-          ? Promise.resolve([{ n: count, baseline_counted: true }])
-          : Promise.resolve([{ subscriptionPlan: plan }]),
-      );
-    }
-
-    it('allows when billing is disabled without counting', async () => {
-      await expect(service.assertWithinRequestLimit(CTX)).resolves.toBeUndefined();
-      expect(mockQuery).not.toHaveBeenCalled();
-    });
-
-    it('allows an unlimited (pro) tenant without counting requests', async () => {
-      enableBilling();
-      mockQuery.mockResolvedValue([{ subscriptionPlan: 'pro' }]); // plan null limit
-      await expect(service.assertWithinRequestLimit(CTX)).resolves.toBeUndefined();
-      // Only the subscription lookup ran; no usage lookup.
-      expect(
-        mockQuery.mock.calls.every(([sql]) => !String(sql).includes('FROM "tenant_request_usage"')),
-      ).toBe(true);
-    });
-
-    it('allows a free tenant below the request limit', async () => {
-      enableBilling();
-      routeQuery('free', FREE_PLAN_REQUESTS_PER_MONTH - 1);
-      await expect(service.assertWithinRequestLimit(CTX)).resolves.toBeUndefined();
-    });
-
-    it('throws 402 PLAN_LIMIT_REQUESTS for a free tenant at the limit', async () => {
-      enableBilling();
-      routeQuery('free', FREE_PLAN_REQUESTS_PER_MONTH);
-      try {
-        await service.assertWithinRequestLimit(CTX);
-        fail('expected HttpException');
-      } catch (e) {
-        const err = e as HttpException;
-        expect(err.getStatus()).toBe(402);
-        expect(err.getResponse()).toMatchObject({
-          code: 'PLAN_LIMIT_REQUESTS',
-          limit: FREE_PLAN_REQUESTS_PER_MONTH,
-          used: FREE_PLAN_REQUESTS_PER_MONTH,
-        });
-      }
-    });
-
-    it('fails open (allows the request) when the count query errors', async () => {
-      enableBilling();
-      mockQuery.mockImplementation((sql: string) =>
-        sql.includes('FROM "tenant_request_usage"')
-          ? Promise.reject(new Error('db down'))
-          : Promise.resolve([{ subscriptionPlan: 'free' }]),
-      );
-      // A usage lookup failure must never block: the soft Free-tier gate fails open.
-      await expect(service.assertWithinRequestLimit(CTX)).resolves.toBeUndefined();
-    });
-
-    it('fails open (allows the request) when the billing snapshot query errors', async () => {
-      enableBilling();
-      mockQuery.mockRejectedValue(new Error('snapshot down'));
-      await expect(service.assertWithinRequestLimit(CTX)).resolves.toBeUndefined();
-      expect(mockQuery).toHaveBeenCalledTimes(1);
-      expect(String(mockQuery.mock.calls[0][0])).not.toContain('FROM "tenant_request_usage"');
-    });
-
-    it('throttles the fail-open warning and reports the suppressed count', async () => {
-      enableBilling();
-      mockQuery.mockImplementation((sql: string) =>
-        sql.includes('FROM "tenant_request_usage"')
-          ? Promise.reject(new Error('db down'))
-          : Promise.resolve([{ subscriptionPlan: 'free' }]),
-      );
-      const warn = jest
-        .spyOn((service as unknown as { logger: { warn: jest.Mock } }).logger, 'warn')
-        .mockImplementation(() => undefined);
-      const nowSpy = jest.spyOn(Date, 'now');
-      try {
-        nowSpy.mockReturnValue(1_000_000);
-        await service.assertWithinRequestLimit(CTX); // first failure → warns once
-        await service.assertWithinRequestLimit(CTX); // within window → suppressed
-        expect(warn).toHaveBeenCalledTimes(1);
-        expect(String(warn.mock.calls[0][0])).not.toContain('suppressed');
-
-        nowSpy.mockReturnValue(1_000_000 + 61_000);
-        await service.assertWithinRequestLimit(CTX); // window elapsed → warns with tail
-        expect(warn).toHaveBeenCalledTimes(2);
-        expect(String(warn.mock.calls[1][0])).toContain('1 more suppressed');
-      } finally {
-        nowSpy.mockRestore();
-      }
-    });
-  });
-
-  describe('envLimit hardening', () => {
-    it('rejects hex and scientific notation, falling back to the plan default', async () => {
-      enableBilling();
-      process.env['PLAN_LIMIT_FREE_REQUESTS'] = '0x10';
-      expect((await service.getLimits(CTX)).requestsPerMonth).toBe(FREE_PLAN_REQUESTS_PER_MONTH);
-      process.env['PLAN_LIMIT_FREE_REQUESTS'] = '1e3';
-      expect((await service.getLimits(CTX)).requestsPerMonth).toBe(FREE_PLAN_REQUESTS_PER_MONTH);
-      process.env['PLAN_LIMIT_FREE_REQUESTS'] = ' 5 ';
-      expect((await service.getLimits(CTX)).requestsPerMonth).toBe(FREE_PLAN_REQUESTS_PER_MONTH);
-    });
-
-    it('accepts a plain digits-only override', async () => {
-      enableBilling();
-      process.env['PLAN_LIMIT_FREE_REQUESTS'] = '7000';
-      expect((await service.getLimits(CTX)).requestsPerMonth).toBe(7000);
-    });
-  });
-});
diff --git a/packages/backend/src/billing/plan.service.ts b/packages/backend/src/billing/plan.service.ts
deleted file mode 100644
index bf6871ac..00000000
--- a/packages/backend/src/billing/plan.service.ts
+++ /dev/null
@@ -1,558 +0,0 @@
-import {
-  BadRequestException,
-  HttpException,
-  HttpStatus,
-  Injectable,
-  Logger,
-  OnModuleInit,
-} from '@nestjs/common';
-import { InjectRepository } from '@nestjs/typeorm';
-import { DataSource, Repository } from 'typeorm';
-import { MANIFEST_ERROR_ORIGINS, PLAN_LIMITS, UNLIMITED_PLAN_LIMITS } from 'manifest-shared';
-import type {
-  BillingEmailPreferences,
-  BillingPlanStatus,
-  BillingPrice,
-  BillingStatus,
-  Plan,
-  PlanLimits,
-} from 'manifest-shared';
-import type Stripe from 'stripe';
-import { Tenant } from '../entities/tenant.entity';
-import type { TenantContext } from '../common/decorators/tenant-context.decorator';
-import { toLocalSqlTimestamp, toSqlTimestamp } from '../common/utils/postgres-sql';
-import { getStripeClient, isBillingEnabled } from './billing.config';
-import {
-  DEFAULT_BILLING_EMAIL_PREFERENCES,
-  normalizeBillingEmailPreferences,
-} from './billing-email-preferences';
-import { REQUEST_USAGE_CUTOVER_STATE, requestQuotaWindowStartMs } from './request-quota-window';
-import { PAID_SUBSCRIPTION_STATUS_SQL_LIST } from './subscription-status';
-
-const PRICE_CACHE_TTL_MS = 60 * 60 * 1000;
-const BILLING_PRICE_UNAVAILABLE: BillingPrice = Object.freeze({
-  amount: null,
-  currency: null,
-  interval: null,
-});
-// Throttle the "count failed → failing open" warning: a sustained DB outage
-// hits this on every proxied request, which would flood logs and add avoidable
-// pressure to the hot path. One line per window, with a suppressed-count tail so
-// the true rate stays visible.
-const COUNT_FAILURE_WARN_WINDOW_MS = 60 * 1000;
-const LIMIT_FAILURE_WARN_WINDOW_MS = 60 * 1000;
-const MANIFEST_ERROR_ORIGIN_SQL_LIST = MANIFEST_ERROR_ORIGINS.map((origin) => `'${origin}'`).join(
-  ', ',
-);
-
-function envLimit(name: string): number | undefined {
-  const raw = process.env[name];
-  if (raw === undefined || raw === '') return undefined;
-  // Digits only: plan limits are non-negative integers. `Number()` would also
-  // accept hex (0x10), scientific (1e3), and whitespace-padded values, silently
-  // producing an unexpected limit instead of falling back to the plan default.
-  if (!/^\d+$/.test(raw)) return undefined;
-  const n = Number(raw);
-  return Number.isFinite(n) ? n : undefined;
-}
-
-interface BillingSnapshot {
-  plan: Plan;
-  limitOverrides: { requestsPerMonth?: number } | null;
-  billingEmailPreferences: Partial<BillingEmailPreferences> | null;
-  cancelAtPeriodEnd: boolean;
-  periodEnd: string | null;
-}
-
-interface BillingSnapshotRow {
-  subscriptionPlan: string | null;
-  cancelAtPeriodEnd: boolean | null;
-  periodEnd: string | null;
-  limitOverrides: { requestsPerMonth?: number } | null;
-  billingEmailPreferences: Partial<BillingEmailPreferences> | null;
-}
-
-function canonicalTimeZone(timeZone: string): string {
-  return new Intl.DateTimeFormat('en-US', { timeZone }).resolvedOptions().timeZone;
-}
-
-function currentProcessTimeZone(): string {
-  return Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC';
-}
-
-@Injectable()
-export class PlanService implements OnModuleInit {
-  private readonly logger = new Logger(PlanService.name);
-  private priceCache: { value: BillingPrice; fetchedAt: number } | null = null;
-  private lastCountFailureWarnAtMs = 0;
-  private suppressedCountFailureWarns = 0;
-  private lastLimitFailureWarnAtMs = 0;
-  private suppressedLimitFailureWarns = 0;
-  /** In-flight baseline initializations keyed by tenant+window. Never awaited on
-   * the admission/billing hot path — only used for single-flight coalescing. */
-  private readonly requestUsageInitializations = new Map<string, Promise<void>>();
-
-  constructor(
-    @InjectRepository(Tenant) private readonly tenantRepo: Repository<Tenant>,
-    private readonly dataSource: DataSource,
-  ) {}
-
-  async onModuleInit(): Promise<void> {
-    if (!isBillingEnabled()) return;
-
-    const storageTimeZone = await this.readRequestStorageTimeZone();
-    const processTimeZone = currentProcessTimeZone();
-    if (canonicalTimeZone(storageTimeZone) !== canonicalTimeZone(processTimeZone)) {
-      throw new Error(
-        `Request quota storage timezone mismatch: trigger=${storageTimeZone}, process=${processTimeZone}`,
-      );
-    }
-  }
-
-  /**
-   * Billing attaches to the tenant. The Stripe subscription row is keyed by
-   * referenceId = the tenant OWNER's user id (better-auth's plugin keys
-   * checkout to the session user); fall back to ctx.userId for fresh
-   * accounts that have no tenant yet.
-   */
-  private async getBillingSnapshot(ctx: TenantContext): Promise<BillingSnapshot> {
-    if (!isBillingEnabled() || (!ctx.tenantId && !ctx.userId)) {
-      return {
-        plan: 'free',
-        limitOverrides: null,
-        billingEmailPreferences: null,
-        cancelAtPeriodEnd: false,
-        periodEnd: null,
-      };
-    }
-    const rows: BillingSnapshotRow[] = await this.dataSource.query(
-      `SELECT
-          t."limit_overrides" AS "limitOverrides",
-          t."billing_email_preferences" AS "billingEmailPreferences",
-          s."plan" AS "subscriptionPlan",
-          s."cancelAtPeriodEnd" AS "cancelAtPeriodEnd",
-          s."periodEnd" AS "periodEnd"
-         FROM (SELECT 1) seed
-    LEFT JOIN "tenants" t
-           ON t."id" = $1
-    LEFT JOIN LATERAL (
-          SELECT "plan", "cancelAtPeriodEnd", "periodEnd"
-            FROM "subscription"
-           WHERE "referenceId" = COALESCE(t."owner_user_id", $2)
-             AND "status" IN (${PAID_SUBSCRIPTION_STATUS_SQL_LIST})
-        ORDER BY "periodEnd" DESC NULLS LAST
-           LIMIT 1
-         ) s
-           ON COALESCE(t."owner_user_id", $2) IS NOT NULL`,
-      [ctx.tenantId, ctx.userId],
-    );
-    const row = rows[0];
-    return {
-      plan: row?.subscriptionPlan === 'pro' ? 'pro' : 'free',
-      limitOverrides: row?.limitOverrides ?? null,
-      billingEmailPreferences: row?.billingEmailPreferences ?? null,
-      cancelAtPeriodEnd: row?.cancelAtPeriodEnd ?? false,
-      periodEnd: row?.periodEnd ?? null,
-    };
-  }
-
-  private async findTenant(ctx: TenantContext): Promise<Tenant | null> {
-    if (!ctx.tenantId) return null;
-    return this.tenantRepo.findOne({ where: { id: ctx.tenantId } });
-  }
-
-  /** Resolve the tenant's plan from better-auth's webhook-synced subscription table. */
-  async getPlan(ctx: TenantContext): Promise<Plan> {
-    return (await this.getBillingSnapshot(ctx)).plan;
-  }
-
-  /**
-   * Light plan lookup for UI gating (range locks, AuthGuard bootstrap). One
-   * snapshot query — never touches the usage counter or Stripe.
-   */
-  async getPlanStatus(ctx: TenantContext): Promise<BillingPlanStatus> {
-    if (!isBillingEnabled()) return { enabled: false, plan: 'free' };
-    return { enabled: true, plan: await this.getPlan(ctx) };
-  }
-
-  private limitsForSnapshot(snapshot: BillingSnapshot): PlanLimits {
-    const defaults = PLAN_LIMITS[snapshot.plan];
-    const prefix = `PLAN_LIMIT_${snapshot.plan.toUpperCase()}`;
-    const overrides = snapshot.limitOverrides;
-    return {
-      requestsPerMonth:
-        overrides?.requestsPerMonth ?? envLimit(`${prefix}_REQUESTS`) ?? defaults.requestsPerMonth,
-    };
-  }
-
-  /** Resolution order: per-tenant override > instance env > plan defaults. */
-  async getLimits(ctx: TenantContext, opts: { failOpen?: boolean } = {}): Promise<PlanLimits> {
-    if (!isBillingEnabled()) return UNLIMITED_PLAN_LIMITS;
-    try {
-      return this.limitsForSnapshot(await this.getBillingSnapshot(ctx));
-    } catch (err) {
-      if (!opts.failOpen) throw err;
-      this.warnLimitFailureThrottled(ctx.tenantId, err as Error);
-      return UNLIMITED_PLAN_LIMITS;
-    }
-  }
-
-  /** Start of the current calendar month in UTC (epoch ms). */
-  private monthStartMsUtc(now: Date): number {
-    return Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1);
-  }
-
-  /** Start of next calendar month in UTC — the moment the request quota resets. */
-  private nextMonthStartUtc(now: Date): Date {
-    return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1));
-  }
-
-  /**
-   * Routed requests recorded for the tenant in the effective monthly quota
-   * window. Hot path is one PK read of `tenant_request_usage`.
-   *
-   * When the pre-cutover baseline has not been applied yet (`baseline_counted =
-   * false`, or the row is missing), this returns the live post-cutover counter
-   * immediately and schedules the historical baseline scan in the background.
-   * Waiting on that scan used to block `/billing/status` and free-tier
-   * admission for tens of seconds on high-volume tenants. Undercounting until
-   * the baseline lands is fail-open — the same posture as a COUNT failure.
-   */
-  async countRequestsSince(tenantId: string | null, monthStartMs: number): Promise<number> {
-    if (!tenantId) return 0;
-    const windowStartMs = requestQuotaWindowStartMs(monthStartMs);
-    const windowStart = toSqlTimestamp(new Date(windowStartMs));
-    const rows: Array<{ n: number | string; baseline_counted: boolean }> =
-      await this.dataSource.query(
-        `SELECT "request_count" AS n, "baseline_counted"
-         FROM "tenant_request_usage"
-        WHERE "tenant_id" = $1
-          AND "window_start" = $2`,
-        [tenantId, windowStart],
-      );
-    if (rows[0]?.baseline_counted) return Number(rows[0].n);
-
-    // Live trigger increments only (or 0 if the row does not exist yet). Kick
-    // the one-shot historical baseline off the hot path so dashboard/admission
-    // stay O(1) even for large pre-cutover histories.
-    this.scheduleRequestUsageInitialization(tenantId, windowStartMs, windowStart);
-    return Number(rows[0]?.n ?? 0);
-  }
-
-  /** Single-flight background baseline init. Errors are logged, not thrown. */
-  private scheduleRequestUsageInitialization(
-    tenantId: string,
-    windowStartMs: number,
-    windowStart: string,
-  ): void {
-    const initializationKey = `${tenantId}:${windowStart}`;
-    if (this.requestUsageInitializations.has(initializationKey)) return;
-
-    const pending = this.initializeRequestUsage(tenantId, windowStartMs, windowStart)
-      .then(() => undefined)
-      .catch((err: Error) => {
-        this.logger.warn(
-          `Request usage baseline init failed for tenant ${tenantId}: ${err.message}`,
-        );
-      })
-      .finally(() => {
-        if (this.requestUsageInitializations.get(initializationKey) === pending) {
-          this.requestUsageInitializations.delete(initializationKey);
-        }
-      });
-    this.requestUsageInitializations.set(initializationKey, pending);
-  }
-
-  private async initializeRequestUsage(
-    tenantId: string,
-    windowStartMs: number,
-    windowStart: string,
-  ): Promise<number> {
-    const cutoverRows: Array<{ cutover_ms: number | string }> = await this.dataSource.query(
-      `SELECT EXTRACT(EPOCH FROM ("completed_at" AT TIME ZONE 'UTC')) * 1000 AS cutover_ms
-         FROM "backfill_state"
-        WHERE "name" = $1`,
-      [REQUEST_USAGE_CUTOVER_STATE],
-    );
-    const cutoverMs = Number(cutoverRows[0]?.cutover_ms);
-    if (!Number.isFinite(cutoverMs)) {
-      throw new Error(`Missing request usage cutover state: ${REQUEST_USAGE_CUTOVER_STATE}`);
-    }
-
-    let baseline = 0;
-    if (windowStartMs < cutoverMs) {
-      const storageTimeZone = Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC';
-      const baselineRows: Array<{ n: number | string }> = await this.dataSource.query(
-        `WITH cutover AS (
-           SELECT ("completed_at" AT TIME ZONE 'UTC') AT TIME ZONE $3::text AS local_timestamp
-             FROM "backfill_state"
-            WHERE "name" = $4
-         )
-         SELECT COUNT(*)::bigint AS n
-           FROM (
-             SELECT r."id"
-               FROM "requests" r
-              CROSS JOIN cutover c
-              WHERE r."tenant_id" = $1
-                AND r."timestamp" >= $2
-                AND EXISTS (
-                  SELECT 1
-                    FROM "agent_messages" pa
-                   WHERE pa."request_id" = r."id"
-                     AND pa."timestamp" < c.local_timestamp
-                     AND (
-                       pa."error_origin" IS NULL
-                       OR pa."error_origin" NOT IN (${MANIFEST_ERROR_ORIGIN_SQL_LIST})
-                     )
-                )
-                AND NOT EXISTS (
-                  SELECT 1
-                    FROM "agents" a
-                   WHERE a."id" = r."agent_id"
-                     AND a."is_playground" = true
-                )
-             UNION ALL
-             SELECT m."id"
-               FROM "agent_messages" m
-              CROSS JOIN cutover c
-              WHERE m."tenant_id" = $1
-                AND m."request_id" IS NULL
-                AND m."timestamp" >= $2
-                AND m."timestamp" < c.local_timestamp
-                AND COALESCE(m."superseded", false) = false
-                AND (
-                  m."error_origin" IS NULL
-                  OR m."error_origin" NOT IN (${MANIFEST_ERROR_ORIGIN_SQL_LIST})
-                )
-                AND NOT EXISTS (
-                  SELECT 1
-                    FROM "agents" a
-                   WHERE a."id" = m."agent_id"
-                     AND a."is_playground" = true
-                )
-           ) historical`,
-        [
-          tenantId,
-          toLocalSqlTimestamp(new Date(windowStartMs)),
-          storageTimeZone,
-          REQUEST_USAGE_CUTOVER_STATE,
-        ],
-      );
-      baseline = Number(baselineRows[0]?.n ?? 0);
-    }
-
-    const initializedRows: Array<{ n: number | string }> = await this.dataSource.query(
-      `INSERT INTO "tenant_request_usage" (
-         "tenant_id",
-         "window_start",
-         "request_count",
-         "baseline_counted"
-       )
-       VALUES ($1, $2, $3, true)
-       ON CONFLICT ("tenant_id", "window_start")
-       DO UPDATE SET
-         "request_count" = "tenant_request_usage"."request_count" +
-           CASE
-             WHEN "tenant_request_usage"."baseline_counted" THEN 0
-             ELSE EXCLUDED."request_count"
-           END,
-         "baseline_counted" = true
-       RETURNING "request_count" AS n`,
-      [tenantId, windowStart, baseline],
-    );
-    return Number(initializedRows[0]?.n ?? baseline);
-  }
-
-  private async readRequestStorageTimeZone(): Promise<string> {
-    const rows: Array<{ definition: string | null }> = await this.dataSource.query(`
-      SELECT pg_get_functiondef(
-               to_regprocedure('"count_tenant_request_usage"()')
-             ) AS "definition"
-    `);
-    const storageTimeZone = rows[0]?.definition?.match(
-      /(?:OLD|NEW|prior|r)\."timestamp"\s+AT TIME ZONE '([^']+)'/,
-    )?.[1];
-    if (!storageTimeZone) {
-      throw new Error('Could not read request quota timezone from installed trigger');
-    }
-    return storageTimeZone;
-  }
-
-  /** Routed requests for the tenant so far this calendar month (UTC). */
-  async countRequestsThisMonth(tenantId: string | null): Promise<number> {
-    return this.countRequestsSince(tenantId, this.monthStartMsUtc(new Date()));
-  }
-
-  /**
-   * Log the fail-open warning at most once per {@link COUNT_FAILURE_WARN_WINDOW_MS},
-   * carrying a count of how many were suppressed since the last emit. Keeps a
-   * DB outage from turning every proxied request into a log line while still
-   * surfacing the true failure rate.
-   */
-  private warnCountFailureThrottled(tenantId: string | null, err: Error): void {
-    const now = Date.now();
-    if (now - this.lastCountFailureWarnAtMs < COUNT_FAILURE_WARN_WINDOW_MS) {
-      this.suppressedCountFailureWarns++;
-      return;
-    }
-    const suppressed = this.suppressedCountFailureWarns;
-    this.suppressedCountFailureWarns = 0;
-    this.lastCountFailureWarnAtMs = now;
-    const tail =
-      suppressed > 0
-        ? ` (${suppressed} more suppressed in the last ${COUNT_FAILURE_WARN_WINDOW_MS / 1000}s)`
-        : '';
-    this.logger.warn(
-      `Request-limit usage lookup failed for tenant ${tenantId}; allowing request: ${err.message}${tail}`,
-    );
-  }
-
-  private warnLimitFailureThrottled(tenantId: string | null, err: Error): void {
-    const now = Date.now();
-    if (now - this.lastLimitFailureWarnAtMs < LIMIT_FAILURE_WARN_WINDOW_MS) {
-      this.suppressedLimitFailureWarns++;
-      return;
-    }
-    const suppressed = this.suppressedLimitFailureWarns;
-    this.suppressedLimitFailureWarns = 0;
-    this.lastLimitFailureWarnAtMs = now;
-    const tail =
-      suppressed > 0
-        ? ` (${suppressed} more suppressed in the last ${LIMIT_FAILURE_WARN_WINDOW_MS / 1000}s)`
-        : '';
-    this.logger.warn(
-      `Request-limit lookup failed for tenant ${tenantId}; allowing request: ${err.message}${tail}`,
-    );
-  }
-
-  /**
-   * Block a routed request when the tenant is at/over its monthly request cap.
-   * Called on the /v1/* proxy admission path BEFORE the request is recorded, so
-   * a blocked request never becomes an `agent_messages` row (which would count
-   * toward the very limit it hit). Only structured data is thrown; the friendly
-   * copy + upgrade link is built in ProxyExceptionFilter.
-   */
-  async assertWithinRequestLimit(ctx: TenantContext): Promise<void> {
-    if (!isBillingEnabled()) return;
-    const limits = await this.getLimits(ctx, { failOpen: true });
-    if (limits.requestsPerMonth === null) return; // Pro / unlimited
-    let used: number;
-    try {
-      used = await this.countRequestsThisMonth(ctx.tenantId);
-    } catch (err) {
-      // Fail open: a transient usage lookup failure must never block a request. The
-      // limit is a soft Free-tier gate, not a hard financial guard, so erring
-      // toward "allow" is correct. The next request retries the count. Warn is
-      // throttled so a sustained outage can't flood the log / hot path.
-      this.warnCountFailureThrottled(ctx.tenantId, err as Error);
-      return;
-    }
-    if (used < limits.requestsPerMonth) return;
-    throw new HttpException(
-      {
-        statusCode: HttpStatus.PAYMENT_REQUIRED,
-        code: 'PLAN_LIMIT_REQUESTS',
-        limit: limits.requestsPerMonth,
-        used,
-      },
-      HttpStatus.PAYMENT_REQUIRED,
-    );
-  }
-
-  async getBillingStatus(ctx: TenantContext): Promise<BillingStatus> {
-    const billingEnabled = isBillingEnabled();
-    if (!billingEnabled) {
-      return {
-        enabled: false,
-        plan: 'free',
-        priceMonthly: BILLING_PRICE_UNAVAILABLE,
-        emailPreferences: DEFAULT_BILLING_EMAIL_PREFERENCES,
-        requests: { used: null, limit: null, periodEnd: null },
-        cancelAtPeriodEnd: false,
-        subscriptionPeriodEnd: null,
-      };
-    }
-    const snapshot = await this.getBillingSnapshot(ctx);
-    const limits = this.limitsForSnapshot(snapshot);
-    const emailPreferences = normalizeBillingEmailPreferences(snapshot.billingEmailPreferences);
-    const now = new Date();
-    const [requestsUsed, priceMonthly] = await Promise.all([
-      this.countRequestsSince(ctx.tenantId, this.monthStartMsUtc(now)),
-      this.getProPrice(),
-    ]);
-    return {
-      enabled: true,
-      plan: snapshot.plan,
-      priceMonthly,
-      emailPreferences,
-      requests: {
-        used: requestsUsed,
-        limit: limits.requestsPerMonth,
-        periodEnd: this.nextMonthStartUtc(now).toISOString(),
-      },
-      cancelAtPeriodEnd: snapshot.cancelAtPeriodEnd,
-      subscriptionPeriodEnd: snapshot.periodEnd,
-    };
-  }
-
-  async getBillingEmailPreferences(ctx: TenantContext): Promise<BillingEmailPreferences> {
-    if (!ctx.tenantId) return DEFAULT_BILLING_EMAIL_PREFERENCES;
-    const tenant = await this.findTenant(ctx);
-    return normalizeBillingEmailPreferences(tenant?.billing_email_preferences);
-  }
-
-  async updateBillingEmailPreferences(
-    ctx: TenantContext,
-    preferences: BillingEmailPreferences,
-  ): Promise<BillingEmailPreferences> {
-    if (!ctx.tenantId) {
-      throw new BadRequestException('A workspace is required to update billing email preferences.');
-    }
-    const normalized = normalizeBillingEmailPreferences(preferences);
-    await this.tenantRepo.update({ id: ctx.tenantId }, { billing_email_preferences: normalized });
-    return normalized;
-  }
-
-  /** Display price for the Pro plan, cached; never lets a Stripe outage break the endpoint. */
-  private async getProPrice(): Promise<BillingPrice> {
-    if (this.priceCache && Date.now() - this.priceCache.fetchedAt < PRICE_CACHE_TTL_MS) {
-      return this.priceCache.value;
-    }
-    try {
-      const price = await getStripeClient().prices.retrieve(process.env['STRIPE_PRO_PRICE_ID']!);
-      const value = this.stripePriceToBillingPrice(price);
-      this.priceCache = { value, fetchedAt: Date.now() };
-      return value;
-    } catch {
-      this.priceCache = { value: BILLING_PRICE_UNAVAILABLE, fetchedAt: Date.now() };
-      return BILLING_PRICE_UNAVAILABLE;
-    }
-  }
-
-  private stripePriceToBillingPrice(price: Stripe.Price): BillingPrice {
-    const rawAmount =
-      price.unit_amount_decimal ?? (price.unit_amount != null ? String(price.unit_amount) : null);
-    const minorAmount = rawAmount != null ? Number(rawAmount) : null;
-    return {
-      amount:
-        minorAmount != null && Number.isFinite(minorAmount)
-          ? minorAmount / this.currencyMinorUnitDivisor(price.currency)
-          : null,
-      currency: price.currency ? price.currency.toUpperCase() : null,
-      interval: price.recurring?.interval ?? null,
-    };
-  }
-
-  private currencyMinorUnitDivisor(currency: string): number {
-    try {
-      const digits =
-        new Intl.NumberFormat('en-US', {
-          style: 'currency',
-          currency,
-        }).resolvedOptions().maximumFractionDigits ?? 2;
-      return 10 ** digits;
-    } catch {
-      return 100;
-    }
-  }
-}
diff --git a/packages/backend/src/billing/request-quota-window.spec.ts b/packages/backend/src/billing/request-quota-window.spec.ts
deleted file mode 100644
index 8e24f8dd..00000000
--- a/packages/backend/src/billing/request-quota-window.spec.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-import {
-  DEFAULT_REQUEST_QUOTA_RESET_AT,
-  REQUEST_QUOTA_RESET_AT_ENV,
-  requestQuotaResetAtMs,
-  requestQuotaWindowStartMs,
-} from './request-quota-window';
-
-describe('request quota window', () => {
-  const original = process.env[REQUEST_QUOTA_RESET_AT_ENV];
-
-  afterEach(() => {
-    if (original === undefined) delete process.env[REQUEST_QUOTA_RESET_AT_ENV];
-    else process.env[REQUEST_QUOTA_RESET_AT_ENV] = original;
-  });
-
-  it('uses the rollout reset during its calendar month', () => {
-    delete process.env[REQUEST_QUOTA_RESET_AT_ENV];
-
-    expect(requestQuotaWindowStartMs(Date.UTC(2026, 6, 1))).toBe(
-      Date.parse(DEFAULT_REQUEST_QUOTA_RESET_AT),
-    );
-  });
-
-  it('uses the calendar month after the rollout reset', () => {
-    delete process.env[REQUEST_QUOTA_RESET_AT_ENV];
-    const august = Date.UTC(2026, 7, 1);
-
-    expect(requestQuotaWindowStartMs(august)).toBe(august);
-  });
-
-  it('accepts a deployment-specific reset override', () => {
-    process.env[REQUEST_QUOTA_RESET_AT_ENV] = '2026-07-10T12:34:56Z';
-
-    expect(requestQuotaResetAtMs()).toBe(Date.parse('2026-07-10T12:34:56Z'));
-  });
-
-  it('falls back when the reset override is invalid', () => {
-    process.env[REQUEST_QUOTA_RESET_AT_ENV] = 'not-a-date';
-
-    expect(requestQuotaResetAtMs()).toBe(Date.parse(DEFAULT_REQUEST_QUOTA_RESET_AT));
-  });
-});
diff --git a/packages/backend/src/billing/request-quota-window.ts b/packages/backend/src/billing/request-quota-window.ts
deleted file mode 100644
index d613f601..00000000
--- a/packages/backend/src/billing/request-quota-window.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-export const DEFAULT_REQUEST_QUOTA_RESET_AT = '2026-07-09T09:06:52Z';
-export const REQUEST_QUOTA_RESET_AT_ENV = 'PLAN_REQUEST_QUOTA_RESET_AT';
-export const REQUEST_USAGE_CUTOVER_STATE = 'tenant_request_usage_cutover_v1';
-
-export function requestQuotaResetAtMs(): number {
-  const raw = process.env[REQUEST_QUOTA_RESET_AT_ENV]?.trim() || DEFAULT_REQUEST_QUOTA_RESET_AT;
-  const parsed = Date.parse(raw);
-  return Number.isFinite(parsed) ? parsed : Date.parse(DEFAULT_REQUEST_QUOTA_RESET_AT);
-}
-
-export function requestQuotaWindowStartMs(monthStartMs: number): number {
-  return Math.max(monthStartMs, requestQuotaResetAtMs());
-}
diff --git a/packages/backend/src/billing/subscription-status.spec.ts b/packages/backend/src/billing/subscription-status.spec.ts
deleted file mode 100644
index 4475e6af..00000000
--- a/packages/backend/src/billing/subscription-status.spec.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import {
-  PAID_SUBSCRIPTION_STATUSES,
-  PAID_SUBSCRIPTION_STATUS_SQL_LIST,
-} from './subscription-status';
-
-describe('subscription-status', () => {
-  it('keeps past_due subscriptions on the paid plan', () => {
-    expect(PAID_SUBSCRIPTION_STATUSES).toEqual(['active', 'trialing', 'past_due']);
-  });
-
-  it('renders the statuses as a SQL IN list', () => {
-    expect(PAID_SUBSCRIPTION_STATUS_SQL_LIST).toBe("'active', 'trialing', 'past_due'");
-  });
-});
diff --git a/packages/backend/src/billing/subscription-status.ts b/packages/backend/src/billing/subscription-status.ts
deleted file mode 100644
index 379bcd01..00000000
--- a/packages/backend/src/billing/subscription-status.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/**
- * Stripe subscription statuses that keep a tenant on its paid plan.
- *
- * `past_due` is included on purpose: while Stripe retries a failed renewal the
- * subscription is still live. Showing the tenant as Free in that window made
- * the dashboard offer "Upgrade", and better-auth's `subscription.upgrade` only
- * reuses active/trialing/incomplete rows, so checkout started a second
- * subscription next to the one still being retried. Staying Pro sends the user
- * to "Manage billing" instead, where they fix the card on the existing
- * subscription. When the retries run out, Stripe moves it to `canceled` or
- * `unpaid` (per the account's dunning setting), and both drop the tenant to
- * Free.
- */
-export const PAID_SUBSCRIPTION_STATUSES = ['active', 'trialing', 'past_due'] as const;
-
-/** `PAID_SUBSCRIPTION_STATUSES` as a SQL `IN (...)` list of literals. */
-export const PAID_SUBSCRIPTION_STATUS_SQL_LIST = PAID_SUBSCRIPTION_STATUSES.map(
-  (status) => `'${status}'`,
-).join(', ');
diff --git a/packages/backend/src/billing/subscription-webhook-emails.spec.ts b/packages/backend/src/billing/subscription-webhook-emails.spec.ts
deleted file mode 100644
index a9833db5..00000000
--- a/packages/backend/src/billing/subscription-webhook-emails.spec.ts
+++ /dev/null
@@ -1,322 +0,0 @@
-jest.mock('./billing-email-sender', () => ({
-  formatPlanName: (plan: string | null | undefined) =>
-    plan === 'pro' ? 'Pro' : plan === 'free' ? 'Free' : plan,
-  getBillingAppUrl: () => 'https://app.manifest.build',
-  getBillingEmailFrom: () => 'noreply@manifest.build',
-  sendSubscriptionPlanEmail: jest.fn().mockResolvedValue(true),
-}));
-
-import type Stripe from 'stripe';
-import type { Subscription } from '@better-auth/stripe';
-import {
-  planFromPriceId,
-  previousPlanFromEvent,
-  sendPlanChangedEmail,
-  sendSubscriptionCanceledEmail,
-  sendSubscriptionConfirmedEmail,
-} from './subscription-webhook-emails';
-import { sendSubscriptionPlanEmail } from './billing-email-sender';
-
-function subscription(overrides: Partial<Subscription> = {}): Subscription {
-  return {
-    id: 'sub-row-1',
-    plan: 'pro',
-    referenceId: 'u1',
-    status: 'active',
-    stripeSubscriptionId: 'sub_123',
-    periodEnd: new Date('2026-08-01T00:00:00.000Z'),
-    ...overrides,
-  } as Subscription;
-}
-
-function event(overrides: Partial<Stripe.Event> = {}): Stripe.Event {
-  return {
-    id: 'evt_123',
-    data: { object: {}, previous_attributes: {} },
-    ...overrides,
-  } as Stripe.Event;
-}
-
-describe('subscription webhook billing emails', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  it('maps previous Stripe item prices back to plan names', () => {
-    const priceToPlan = new Map([['price_basic', 'free']]);
-    const previous = event({
-      data: {
-        object: {},
-        previous_attributes: { items: { data: [{ price: { id: 'price_basic' } }] } },
-      },
-    } as Stripe.Event);
-
-    expect(previousPlanFromEvent(previous, priceToPlan)).toBe('free');
-  });
-
-  it('sends a deduped subscription confirmation email', async () => {
-    const query = jest
-      .fn()
-      .mockResolvedValueOnce({ rows: [] })
-      .mockResolvedValueOnce({ rows: [{ email: 'owner@example.com', name: 'Ada' }] })
-      .mockResolvedValueOnce({ rows: [{ id: 'log-1' }] });
-
-    await expect(sendSubscriptionConfirmedEmail({ query }, event(), subscription())).resolves.toBe(
-      true,
-    );
-
-    expect(query.mock.calls[0][0]).toContain('SELECT id FROM billing_email_logs');
-    expect(query.mock.calls[0][1][0]).toBe('billing:subscription_confirmed:sub_123:confirm');
-    expect(query.mock.calls[2][0]).toContain('ON CONFLICT (dedupe_key) DO NOTHING');
-    expect(query.mock.calls[2][1][1]).toBe('billing:subscription_confirmed:sub_123:confirm');
-    expect(sendSubscriptionPlanEmail).toHaveBeenCalledWith(
-      'owner@example.com',
-      expect.objectContaining({ kind: 'subscription_confirmed', planName: 'Pro' }),
-      'noreply@manifest.build',
-    );
-  });
-
-  it('does not send when the lifecycle dedupe key already exists', async () => {
-    const query = jest.fn().mockResolvedValueOnce({ rows: [{ id: 'log-1' }] });
-
-    await expect(sendSubscriptionConfirmedEmail({ query }, event(), subscription())).resolves.toBe(
-      false,
-    );
-
-    expect(query).toHaveBeenCalledTimes(1);
-    expect(sendSubscriptionPlanEmail).not.toHaveBeenCalled();
-  });
-
-  it('does not write the lifecycle dedupe log when sending fails', async () => {
-    (sendSubscriptionPlanEmail as jest.Mock).mockResolvedValueOnce(false);
-    const query = jest
-      .fn()
-      .mockResolvedValueOnce({ rows: [] })
-      .mockResolvedValueOnce({ rows: [{ email: 'owner@example.com', name: 'Ada' }] });
-
-    await expect(sendSubscriptionConfirmedEmail({ query }, event(), subscription())).resolves.toBe(
-      false,
-    );
-
-    expect(sendSubscriptionPlanEmail).toHaveBeenCalledTimes(1);
-    expect(query).toHaveBeenCalledTimes(2);
-  });
-
-  it('returns false when lifecycle email handling throws', async () => {
-    const warn = jest.spyOn(console, 'warn').mockImplementation();
-    const query = jest.fn().mockRejectedValue(new Error('db down'));
-
-    await expect(sendSubscriptionConfirmedEmail({ query }, event(), subscription())).resolves.toBe(
-      false,
-    );
-
-    expect(warn).toHaveBeenCalledWith(
-      '[BillingEmail] Failed to send subscription_confirmed:',
-      expect.any(Error),
-    );
-    warn.mockRestore();
-  });
-
-  it('sends a plan-changed email only when the plan changed', async () => {
-    const query = jest
-      .fn()
-      .mockResolvedValueOnce({ rows: [] })
-      .mockResolvedValueOnce({ rows: [{ email: 'owner@example.com', name: 'Ada' }] })
-      .mockResolvedValueOnce({ rows: [{ id: 'log-1' }] });
-
-    await expect(sendPlanChangedEmail({ query }, event(), subscription(), 'free')).resolves.toBe(
-      true,
-    );
-    await expect(
-      sendPlanChangedEmail({ query }, event({ id: 'evt_same' }), subscription(), 'pro'),
-    ).resolves.toBe(false);
-
-    expect(sendSubscriptionPlanEmail).toHaveBeenCalledTimes(1);
-    expect(sendSubscriptionPlanEmail).toHaveBeenCalledWith(
-      'owner@example.com',
-      expect.objectContaining({
-        kind: 'plan_changed',
-        previousPlanName: 'Free',
-      }),
-      'noreply@manifest.build',
-    );
-  });
-
-  it('dedupes cancel and delete events by subscription id', async () => {
-    const query = jest
-      .fn()
-      .mockResolvedValueOnce({ rows: [] })
-      .mockResolvedValueOnce({ rows: [{ email: 'owner@example.com', name: 'Ada' }] })
-      .mockResolvedValueOnce({ rows: [{ id: 'log-1' }] });
-
-    await expect(sendSubscriptionCanceledEmail({ query }, event(), subscription())).resolves.toBe(
-      true,
-    );
-
-    expect(query.mock.calls[2][1][1]).toBe('billing:cancellation_confirmed:sub_123:cancel');
-    expect(sendSubscriptionPlanEmail).toHaveBeenCalledWith(
-      'owner@example.com',
-      expect.objectContaining({ kind: 'cancellation_confirmed' }),
-      'noreply@manifest.build',
-    );
-  });
-
-  it('returns false when no billing recipient email is found', async () => {
-    const query = jest
-      .fn()
-      .mockResolvedValueOnce({ rows: [] }) // dedupe check
-      .mockResolvedValueOnce({ rows: [{ email: null, name: null }] }); // user lookup
-
-    await expect(sendSubscriptionConfirmedEmail({ query }, event(), subscription())).resolves.toBe(
-      false,
-    );
-
-    expect(sendSubscriptionPlanEmail).not.toHaveBeenCalled();
-  });
-
-  it('returns false when no billing user row exists', async () => {
-    const query = jest
-      .fn()
-      .mockResolvedValueOnce({ rows: [] }) // dedupe check
-      .mockResolvedValueOnce({ rows: [] }); // no user found
-
-    await expect(sendSubscriptionConfirmedEmail({ query }, event(), subscription())).resolves.toBe(
-      false,
-    );
-
-    expect(sendSubscriptionPlanEmail).not.toHaveBeenCalled();
-  });
-
-  it('returns false for plan_changed when previousPlan is null', async () => {
-    await expect(
-      sendPlanChangedEmail({ query: jest.fn() }, event(), subscription(), null),
-    ).resolves.toBe(false);
-  });
-
-  it('uses the stripeSubscriptionId fallback to subscription.id when stripeSubscriptionId is null', async () => {
-    const query = jest
-      .fn()
-      .mockResolvedValueOnce({ rows: [] })
-      .mockResolvedValueOnce({ rows: [{ email: 'owner@example.com', name: 'Ada' }] })
-      .mockResolvedValueOnce({ rows: [{ id: 'log-1' }] });
-
-    const sub = subscription({ stripeSubscriptionId: null as unknown as string, id: 'ba-row-id' });
-    await sendSubscriptionConfirmedEmail({ query }, event(), sub);
-
-    expect(query.mock.calls[0][1][0]).toBe('billing:subscription_confirmed:ba-row-id:confirm');
-  });
-
-  it('uses cancelAt for the period end in cancel emails when cancelAt is present', async () => {
-    const cancelDate = new Date('2026-09-01T00:00:00.000Z');
-    const query = jest
-      .fn()
-      .mockResolvedValueOnce({ rows: [] })
-      .mockResolvedValueOnce({ rows: [{ email: 'owner@example.com', name: 'Ada' }] })
-      .mockResolvedValueOnce({ rows: [{ id: 'log-1' }] });
-
-    await sendSubscriptionCanceledEmail({ query }, event(), subscription({ cancelAt: cancelDate }));
-
-    expect(sendSubscriptionPlanEmail).toHaveBeenCalledWith(
-      'owner@example.com',
-      expect.objectContaining({
-        periodEnd: cancelDate.toISOString(),
-      }),
-      'noreply@manifest.build',
-    );
-  });
-
-  it('uses endedAt for the period end when both cancelAt and periodEnd are null', async () => {
-    const endedDate = new Date('2026-10-15T00:00:00.000Z');
-    const query = jest
-      .fn()
-      .mockResolvedValueOnce({ rows: [] })
-      .mockResolvedValueOnce({ rows: [{ email: 'owner@example.com', name: 'Ada' }] })
-      .mockResolvedValueOnce({ rows: [{ id: 'log-1' }] });
-
-    await sendSubscriptionCanceledEmail(
-      { query },
-      event(),
-      subscription({
-        cancelAt: null as unknown as Date,
-        periodEnd: null as unknown as Date,
-        endedAt: endedDate,
-      }),
-    );
-
-    expect(sendSubscriptionPlanEmail).toHaveBeenCalledWith(
-      'owner@example.com',
-      expect.objectContaining({
-        periodEnd: endedDate.toISOString(),
-      }),
-      'noreply@manifest.build',
-    );
-  });
-
-  it('resolves user from an array result (not { rows } wrapper)', async () => {
-    const query = jest
-      .fn()
-      .mockResolvedValueOnce([]) // dedupe check — array form
-      .mockResolvedValueOnce([{ email: 'owner@example.com', name: 'Ada' }]) // user — array form
-      .mockResolvedValueOnce([{ id: 'log-1' }]); // insert
-
-    await expect(sendSubscriptionConfirmedEmail({ query }, event(), subscription())).resolves.toBe(
-      true,
-    );
-
-    expect(sendSubscriptionPlanEmail).toHaveBeenCalled();
-  });
-
-  describe('planFromPriceId', () => {
-    const priceToPlan = new Map([['price_pro', 'pro']]);
-
-    it('returns the plan name for a known price', () => {
-      expect(planFromPriceId('price_pro', priceToPlan)).toBe('pro');
-    });
-
-    it('returns null for an unknown price', () => {
-      expect(planFromPriceId('price_unknown', priceToPlan)).toBeNull();
-    });
-
-    it('returns null for null priceId', () => {
-      expect(planFromPriceId(null, priceToPlan)).toBeNull();
-    });
-
-    it('returns null for undefined priceId', () => {
-      expect(planFromPriceId(undefined, priceToPlan)).toBeNull();
-    });
-  });
-
-  describe('previousPlanFromEvent edge cases', () => {
-    it('returns null when previous_attributes is undefined', () => {
-      const priceToPlan = new Map([['price_pro', 'pro']]);
-      const e = event({ data: { object: {} } } as Stripe.Event);
-      expect(previousPlanFromEvent(e, priceToPlan)).toBeNull();
-    });
-
-    it('returns null when previous_attributes has no items', () => {
-      const priceToPlan = new Map([['price_pro', 'pro']]);
-      const e = event({
-        data: { object: {}, previous_attributes: {} },
-      } as Stripe.Event);
-      expect(previousPlanFromEvent(e, priceToPlan)).toBeNull();
-    });
-  });
-
-  it('uses eventId for the dedupe action on plan_changed kind', async () => {
-    const query = jest
-      .fn()
-      .mockResolvedValueOnce({ rows: [] })
-      .mockResolvedValueOnce({ rows: [{ email: 'owner@example.com', name: 'Ada' }] })
-      .mockResolvedValueOnce({ rows: [{ id: 'log-1' }] });
-
-    await sendPlanChangedEmail(
-      { query },
-      event({ id: 'evt_plan_change_42' }),
-      subscription(),
-      'free',
-    );
-
-    // plan_changed uses the eventId as the dedupe action (not 'confirm' or 'cancel')
-    expect(query.mock.calls[0][1][0]).toBe('billing:plan_changed:sub_123:evt_plan_change_42');
-  });
-});
diff --git a/packages/backend/src/billing/subscription-webhook-emails.ts b/packages/backend/src/billing/subscription-webhook-emails.ts
deleted file mode 100644
index 3b9165b6..00000000
--- a/packages/backend/src/billing/subscription-webhook-emails.ts
+++ /dev/null
@@ -1,156 +0,0 @@
-import type Stripe from 'stripe';
-import type { Subscription } from '@better-auth/stripe';
-import {
-  formatPlanName,
-  getBillingAppUrl,
-  getBillingEmailFrom,
-  sendSubscriptionPlanEmail,
-} from './billing-email-sender';
-import {
-  BillingEmailLogQueryable,
-  hasBillingEmailLog,
-  tryInsertBillingEmailLog,
-} from './billing-email-log.service';
-
-interface BillingUserRecipient {
-  email: string | null;
-  name: string | null;
-}
-
-async function resolveBillingUser(
-  db: BillingEmailLogQueryable,
-  userId: string,
-): Promise<BillingUserRecipient | null> {
-  const result = await db.query(
-    `SELECT email, NULLIF(name, '') AS name FROM "user" WHERE id = $1`,
-    [userId],
-  );
-  const rows = Array.isArray(result)
-    ? (result as BillingUserRecipient[])
-    : ((result as { rows?: BillingUserRecipient[] }).rows ?? []);
-  return rows[0] ?? null;
-}
-
-async function sendLifecycleEmail(
-  db: BillingEmailLogQueryable,
-  params: {
-    kind: 'subscription_confirmed' | 'plan_changed' | 'cancellation_confirmed';
-    eventId: string;
-    subscription: Subscription;
-    previousPlanName?: string | null;
-    periodEnd?: string | null;
-  },
-): Promise<boolean> {
-  try {
-    const userId = params.subscription.referenceId;
-    const subscriptionId = params.subscription.stripeSubscriptionId ?? params.subscription.id;
-    const dedupeAction =
-      params.kind === 'subscription_confirmed'
-        ? 'confirm'
-        : params.kind === 'cancellation_confirmed'
-          ? 'cancel'
-          : params.eventId;
-    const dedupeKey = `billing:${params.kind}:${subscriptionId}:${dedupeAction}`;
-    if (await hasBillingEmailLog(db, dedupeKey)) return false;
-
-    const recipient = await resolveBillingUser(db, userId);
-    if (!recipient?.email) return false;
-
-    const appUrl = getBillingAppUrl();
-    const sent = await sendSubscriptionPlanEmail(
-      recipient.email,
-      {
-        kind: params.kind,
-        userName: recipient.name,
-        planName: formatPlanName(params.subscription.plan),
-        previousPlanName: params.previousPlanName,
-        periodEnd: params.periodEnd ?? null,
-        appUrl,
-        manageBillingUrl: `${appUrl}/account`,
-      },
-      getBillingEmailFrom(),
-    );
-    if (!sent) return false;
-
-    await tryInsertBillingEmailLog(db, {
-      dedupeKey,
-      kind: params.kind,
-      userId,
-      stripeSubscriptionId: subscriptionId,
-      periodEnd: params.periodEnd ?? null,
-      metadata: {
-        eventId: params.eventId,
-        plan: params.subscription.plan,
-        previousPlan: params.previousPlanName ?? null,
-      },
-    });
-    return true;
-  } catch (err) {
-    console.warn(`[BillingEmail] Failed to send ${params.kind}:`, err);
-    return false;
-  }
-}
-
-export function planFromPriceId(
-  priceId: string | null | undefined,
-  priceToPlan: ReadonlyMap<string, string>,
-): string | null {
-  if (!priceId) return null;
-  return priceToPlan.get(priceId) ?? null;
-}
-
-export function previousPlanFromEvent(
-  event: Stripe.Event,
-  priceToPlan: ReadonlyMap<string, string>,
-): string | null {
-  const previous = event.data.previous_attributes as
-    | { items?: { data?: Array<{ price?: { id?: string } }> } }
-    | undefined;
-  const previousPrice = previous?.items?.data?.find((item) => item.price?.id)?.price?.id;
-  return planFromPriceId(previousPrice, priceToPlan);
-}
-
-export async function sendSubscriptionConfirmedEmail(
-  db: BillingEmailLogQueryable,
-  event: Stripe.Event,
-  subscription: Subscription,
-): Promise<boolean> {
-  return sendLifecycleEmail(db, {
-    kind: 'subscription_confirmed',
-    eventId: event.id,
-    subscription,
-    periodEnd: subscription.periodEnd?.toISOString(),
-  });
-}
-
-export async function sendPlanChangedEmail(
-  db: BillingEmailLogQueryable,
-  event: Stripe.Event,
-  subscription: Subscription,
-  previousPlan: string | null,
-): Promise<boolean> {
-  if (!previousPlan || previousPlan === subscription.plan) return false;
-  return sendLifecycleEmail(db, {
-    kind: 'plan_changed',
-    eventId: event.id,
-    subscription,
-    previousPlanName: formatPlanName(previousPlan),
-    periodEnd: subscription.periodEnd?.toISOString(),
-  });
-}
-
-export async function sendSubscriptionCanceledEmail(
-  db: BillingEmailLogQueryable,
-  event: Stripe.Event,
-  subscription: Subscription,
-): Promise<boolean> {
-  return sendLifecycleEmail(db, {
-    kind: 'cancellation_confirmed',
-    eventId: event.id,
-    subscription,
-    periodEnd:
-      subscription.cancelAt?.toISOString() ??
-      subscription.periodEnd?.toISOString() ??
-      subscription.endedAt?.toISOString(),
-  });
-}
diff --git a/packages/backend/src/common/errors/error-codes.ts b/packages/backend/src/common/errors/error-codes.ts
index 5a66366a..2f1a6434 100644
--- a/packages/backend/src/common/errors/error-codes.ts
+++ b/packages/backend/src/common/errors/error-codes.ts
@@ -58,12 +58,6 @@ export const MANIFEST_ERRORS = {
     title: 'Concurrency limit exceeded',
     template: 'Too many concurrent requests. Give it a moment.',
   },
-  M204: {
-    title: 'Monthly request limit reached',
-    template:
-      "You've used all {threshold} requests included this month on the Free plan. " +
-      'Upgrade to Pro for unlimited requests: {upgradeUrl}',
-  },
   M300: {
     title: 'Missing messages array',
     template: '`messages` array is required.',
diff --git a/packages/backend/src/common/errors/manifest-error.ts b/packages/backend/src/common/errors/manifest-error.ts
index b0f5698f..accb0b9c 100644
--- a/packages/backend/src/common/errors/manifest-error.ts
+++ b/packages/backend/src/common/errors/manifest-error.ts
@@ -13,7 +13,6 @@ export const MANIFEST_BLOCKED_REQUEST_REASONS = [
   'subscription_credentials_unusable',
   'key_expired',
   'limit_exceeded',
-  'plan_request_limit_exceeded',
   'manifest_rate_limited',
   'manifest_ip_rate_limited',
   'manifest_concurrency_limited',
@@ -54,7 +53,6 @@ export const MANIFEST_CODE_TO_REASON: Record<RecordableManifestCode, ManifestBlo
     M201: 'manifest_rate_limited',
     M202: 'manifest_ip_rate_limited',
     M203: 'manifest_concurrency_limited',
-    M204: 'plan_request_limit_exceeded',
     M300: 'manifest_invalid_request',
     M302: 'model_not_available',
     M303: 'local_provider_unavailable',
diff --git a/packages/backend/src/config/app.config.ts b/packages/backend/src/config/app.config.ts
index 29dc4e64..679ddd33 100644
--- a/packages/backend/src/config/app.config.ts
+++ b/packages/backend/src/config/app.config.ts
@@ -56,9 +56,8 @@ export const appConfig = registerAs('app', () => ({
   // without auth. Off by default; only Manifest Cloud's marketing site uses it.
   // The variable keeps its historical name so existing deployments stay on.
   publicErrorPagesEnabled: process.env['MANIFEST_PUBLIC_STATS'] === 'true',
-  // Optional instance-wide override. When unset, request recordings follow the
-  // Cloud plan policy (Free 7 days, Pro 365 days); non-billing deployments use
-  // the 365-day default.
+  // Optional instance-wide override. When unset, request recordings are kept
+  // for the 365-day default.
   requestRecordingRetentionDays: optionalPositiveInteger(
     process.env['REQUEST_RECORDING_RETENTION_DAYS'],
   ),
diff --git a/packages/backend/src/database/data-source-definitions.ts b/packages/backend/src/database/data-source-definitions.ts
index dabf7114..c8c2c0db 100644
--- a/packages/backend/src/database/data-source-definitions.ts
+++ b/packages/backend/src/database/data-source-definitions.ts
@@ -26,7 +26,6 @@ import { ReasoningContentCacheEntry } from '../entities/reasoning-content-cache-
 import { AgentEnabledProvider } from '../entities/agent-enabled-provider.entity';
 import { PublicErrorPage } from '../entities/public-error-page.entity';
 import { WaitlistClaim } from '../entities/waitlist-claim.entity';
-import { TenantRequestUsage } from '../entities/tenant-request-usage.entity';
 import { CliAuthCode } from '../entities/cli-auth-code.entity';
 import { AgentUsageDaily } from '../entities/agent-usage-daily.entity';
 import { RenameWaitlistClaimsTable1800000000000 } from './migrations/1800000000000-RenameWaitlistClaimsTable';
@@ -57,6 +56,7 @@ import { AddAgentUsageDaily1802800000000 } from './migrations/1802800000000-AddA
 import { AddAgentMessagesDirectUsageIndex1802900000000 } from './migrations/1802900000000-AddAgentMessagesDirectUsageIndex';
 import { CoverRequestsLogFilters1803000000000 } from './migrations/1803000000000-CoverRequestsLogFilters';
 import { CoverHarnessRequestsIndex1803100000000 } from './migrations/1803100000000-CoverHarnessRequestsIndex';
+import { DropBillingSchema1803200000000 } from './migrations/1803200000000-DropBillingSchema';
 import { InitialSchema1771464895790 } from './migrations/1771464895790-InitialSchema';
 import { HashApiKeys1771500000000 } from './migrations/1771500000000-HashApiKeys';
 import { ModelPricingImprovements1771600000000 } from './migrations/1771600000000-ModelPricingImprovements';
@@ -200,7 +200,6 @@ export const entities = [
   BackfillState,
   PublicErrorPage,
   WaitlistClaim,
-  TenantRequestUsage,
   CliAuthCode,
   AgentUsageDaily,
 ];
@@ -352,4 +351,5 @@ export const migrations = [
   AddAgentMessagesDirectUsageIndex1802900000000,
   CoverRequestsLogFilters1803000000000,
   CoverHarnessRequestsIndex1803100000000,
+  DropBillingSchema1803200000000,
 ];
diff --git a/packages/backend/src/database/migrations/1801300000000-AddTenantRequestUsage.spec.ts b/packages/backend/src/database/migrations/1801300000000-AddTenantRequestUsage.spec.ts
index 2a80e2ae..db2126d7 100644
--- a/packages/backend/src/database/migrations/1801300000000-AddTenantRequestUsage.spec.ts
+++ b/packages/backend/src/database/migrations/1801300000000-AddTenantRequestUsage.spec.ts
@@ -2,7 +2,6 @@ import { AddTenantRequestUsage1801300000000 } from './1801300000000-AddTenantReq
 
 describe('AddTenantRequestUsage1801300000000', () => {
   let statements: Array<{ sql: string; params?: unknown[] }>;
-  const originalManifestMode = process.env['MANIFEST_MODE'];
   const queryRunner = {
     query: jest.fn(async (sql: string, params?: unknown[]) => {
       statements.push({ sql, params });
@@ -13,84 +12,17 @@ describe('AddTenantRequestUsage1801300000000', () => {
   };
 
   beforeEach(() => {
-    process.env['MANIFEST_MODE'] = 'cloud';
     statements = [];
     jest.clearAllMocks();
-    queryRunner.query.mockImplementation(async (sql: string, params?: unknown[]) => {
-      statements.push({ sql, params });
-    });
-  });
-
-  afterAll(() => {
-    if (originalManifestMode === undefined) {
-      delete process.env['MANIFEST_MODE'];
-    } else {
-      process.env['MANIFEST_MODE'] = originalManifestMode;
-    }
   });
 
-  it('does not add quota counter artifacts to self-hosted installations', async () => {
-    process.env['MANIFEST_MODE'] = 'selfhosted';
-
-    await new AddTenantRequestUsage1801300000000().up(queryRunner as never);
-
-    expect(queryRunner.query).not.toHaveBeenCalled();
-    expect(queryRunner.startTransaction).not.toHaveBeenCalled();
-  });
-
-  it('adds the exact counter and atomically publishes a trigger cutover without scanning data', async () => {
+  it('keeps only the self-hosted path: no quota counter schema is created', async () => {
     const migration = new AddTenantRequestUsage1801300000000();
-    await migration.up(queryRunner as never);
+    await migration.up();
 
-    const sql = statements.map((statement) => statement.sql).join('\n');
     expect(migration.transaction).toBe(false);
-    expect(statements[0].sql).toContain("SET lock_timeout = '1s'");
-    expect(statements.at(-1)?.sql).toContain('RESET lock_timeout');
-    expect(sql).toContain('CREATE TABLE IF NOT EXISTS "tenant_request_usage"');
-    expect(sql).toContain('PRIMARY KEY ("tenant_id", "window_start")');
-    expect(sql).toContain('ADD COLUMN IF NOT EXISTS "baseline_counted" boolean');
-    expect(sql).toContain('ADD COLUMN IF NOT EXISTS "quota_counted" boolean');
-    expect(sql).not.toContain('quota_window_start');
-    expect(sql).not.toContain('legacy_quota_counted');
-    expect(sql).toContain('CREATE OR REPLACE FUNCTION "count_tenant_request_usage"()');
-    expect(sql).toContain('AFTER INSERT OR UPDATE OF "request_id" ON "agent_messages"');
-    expect(sql).toContain('AND r."quota_counted" = false');
-    expect(sql).toContain('LOCK TABLE "agent_messages" IN SHARE ROW EXCLUSIVE MODE');
-    expect(sql).toContain("'tenant_request_usage_cutover_v1'");
-    expect(sql).not.toContain('WITH counted AS');
-    expect(statements.every((statement) => statement.params === undefined)).toBe(true);
-    expect(queryRunner.startTransaction).toHaveBeenCalledTimes(1);
-    expect(queryRunner.commitTransaction).toHaveBeenCalledTimes(1);
-    expect(queryRunner.rollbackTransaction).not.toHaveBeenCalled();
-  });
-
-  it('resets the lock timeout after a failed migration statement', async () => {
-    const failure = new Error('lock timeout');
-    queryRunner.query.mockImplementation(async (sql: string, params?: unknown[]) => {
-      statements.push({ sql, params });
-      if (sql.includes('CREATE TABLE')) throw failure;
-    });
-
-    await expect(new AddTenantRequestUsage1801300000000().up(queryRunner as never)).rejects.toBe(
-      failure,
-    );
-    expect(statements.at(-1)?.sql).toContain('RESET lock_timeout');
-  });
-
-  it('rolls back cutover publication when trigger installation fails', async () => {
-    const failure = new Error('trigger failed');
-    queryRunner.query.mockImplementation(async (sql: string, params?: unknown[]) => {
-      statements.push({ sql, params });
-      if (sql.includes('CREATE TRIGGER')) throw failure;
-    });
-
-    await expect(new AddTenantRequestUsage1801300000000().up(queryRunner as never)).rejects.toBe(
-      failure,
-    );
-    expect(queryRunner.startTransaction).toHaveBeenCalledTimes(1);
-    expect(queryRunner.commitTransaction).not.toHaveBeenCalled();
-    expect(queryRunner.rollbackTransaction).toHaveBeenCalledTimes(1);
-    expect(statements.at(-1)?.sql).toContain('RESET lock_timeout');
+    expect(queryRunner.query).not.toHaveBeenCalled();
+    expect(queryRunner.startTransaction).not.toHaveBeenCalled();
   });
 
   it('removes the trigger before its supporting columns and table', async () => {
diff --git a/packages/backend/src/database/migrations/1801300000000-AddTenantRequestUsage.ts b/packages/backend/src/database/migrations/1801300000000-AddTenantRequestUsage.ts
index 377e7a3f..4474e6d6 100644
--- a/packages/backend/src/database/migrations/1801300000000-AddTenantRequestUsage.ts
+++ b/packages/backend/src/database/migrations/1801300000000-AddTenantRequestUsage.ts
@@ -1,214 +1,24 @@
 import { MigrationInterface, QueryRunner } from 'typeorm';
-import {
-  REQUEST_USAGE_CUTOVER_STATE,
-  requestQuotaResetAtMs,
-} from '../../billing/request-quota-window';
-import { isSelfHosted } from '../../common/utils/detect-self-hosted';
-import { toLocalSqlTimestamp, toSqlTimestamp } from '../../common/utils/postgres-sql';
 
-// Keep the migration self-contained: these are the request-level origins at
-// this schema version, matching the legacy quota query it replaces.
-const MANIFEST_ERROR_ORIGINS = ['config', 'policy', 'internal', 'request'] as const;
-const MANIFEST_ERROR_ORIGIN_SQL_LIST = MANIFEST_ERROR_ORIGINS.map((origin) => `'${origin}'`).join(
-  ', ',
-);
+// Inlined when the billing module that owned it was removed.
+const REQUEST_USAGE_CUTOVER_STATE = 'tenant_request_usage_cutover_v1';
 
 /**
- * Replaces admission-path COUNT scans with one exact monthly counter lookup.
+ * Historically added Manifest Cloud's monthly request-quota counter
+ * (`tenant_request_usage`, `requests.quota_counted` and an `agent_messages`
+ * trigger). The counter only ever existed in cloud mode; self-hosted installs
+ * skipped it entirely.
  *
- * The deploy migration never scans historical telemetry. It atomically records
- * a cutover while installing the trigger, then active tenants initialize their
- * pre-cutover baseline once through PlanService. Post-cutover attempts update
- * the counter transactionally and merge safely with that lazy baseline.
+ * Thinker has no plan quotas, so only the self-hosted path remains and `up()`
+ * is a no-op. Databases that did get the counter have it removed by
+ * DropBillingSchema1803200000000. `down()` keeps its idempotent cleanup.
  */
 export class AddTenantRequestUsage1801300000000 implements MigrationInterface {
   name = 'AddTenantRequestUsage1801300000000';
   transaction = false;
 
-  public async up(queryRunner: QueryRunner): Promise<void> {
-    // Request quotas are a Cloud billing concern. Keep self-hosted schemas and
-    // their write path free of the counter table, request flag, and trigger.
-    if (isSelfHosted()) return;
-
-    const resetDate = new Date(requestQuotaResetAtMs());
-    const resetCutoff = toLocalSqlTimestamp(resetDate);
-    const resetWindow = toSqlTimestamp(resetDate);
-    const storageTimeZone = Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC';
-    const storageTimeZoneSql = storageTimeZone.replaceAll("'", "''");
-
-    await queryRunner.query(`SET lock_timeout = '1s'`);
-    try {
-      await queryRunner.query(`
-        CREATE TABLE IF NOT EXISTS "tenant_request_usage" (
-          "tenant_id" varchar NOT NULL,
-          "window_start" timestamp NOT NULL,
-          "request_count" bigint NOT NULL DEFAULT 0,
-          "baseline_counted" boolean NOT NULL DEFAULT false,
-          CONSTRAINT "PK_tenant_request_usage" PRIMARY KEY ("tenant_id", "window_start"),
-          CONSTRAINT "CHK_tenant_request_usage_non_negative" CHECK ("request_count" >= 0)
-        )
-      `);
-      await queryRunner.query(
-        `ALTER TABLE "tenant_request_usage" ADD COLUMN IF NOT EXISTS "baseline_counted" boolean NOT NULL DEFAULT false`,
-      );
-      await queryRunner.query(`
-        ALTER TABLE "requests"
-          ADD COLUMN IF NOT EXISTS "quota_counted" boolean NOT NULL DEFAULT false
-      `);
-
-      await queryRunner.query(`
-        CREATE OR REPLACE FUNCTION "count_tenant_request_usage"()
-        RETURNS trigger
-        LANGUAGE plpgsql
-        AS $$
-        DECLARE
-          counter_cutover_at timestamp;
-          counted_tenant_id varchar;
-          counted_window_start timestamp;
-        BEGIN
-          IF NEW.request_id IS NULL THEN
-            RETURN NEW;
-          END IF;
-
-          SELECT "completed_at"
-            INTO counter_cutover_at
-            FROM "backfill_state"
-           WHERE "name" = '${REQUEST_USAGE_CUTOVER_STATE}';
-
-          IF counter_cutover_at IS NULL THEN
-            RETURN NEW;
-          END IF;
-
-          IF TG_OP = 'UPDATE' THEN
-            IF OLD.request_id IS NOT NULL THEN
-              RETURN NEW;
-            END IF;
-
-            IF (OLD."timestamp" AT TIME ZONE '${storageTimeZoneSql}') AT TIME ZONE 'UTC'
-                 < counter_cutover_at
-               OR COALESCE(OLD.superseded, false)
-               OR OLD.error_origin IN (${MANIFEST_ERROR_ORIGIN_SQL_LIST}) THEN
-              RETURN NEW;
-            END IF;
-          ELSIF COALESCE(NEW.superseded, false)
-             OR NEW.error_origin IN (${MANIFEST_ERROR_ORIGIN_SQL_LIST}) THEN
-            RETURN NEW;
-          END IF;
-
-          IF (NEW."timestamp" AT TIME ZONE '${storageTimeZoneSql}') AT TIME ZONE 'UTC'
-               < counter_cutover_at THEN
-            RETURN NEW;
-          END IF;
-
-          -- A Request with any pre-cutover attempt belongs entirely to the lazy
-          -- historical baseline. Mark it handled so a later fallback cannot
-          -- also increment the live counter.
-          IF EXISTS (
-            SELECT 1
-              FROM "agent_messages" prior
-             WHERE prior."request_id" = NEW.request_id
-               AND prior."id" <> NEW.id
-               AND (
-                 (prior."timestamp" AT TIME ZONE '${storageTimeZoneSql}') AT TIME ZONE 'UTC'
-               ) < counter_cutover_at
-               AND (
-                 prior."error_origin" IS NULL
-                 OR prior."error_origin" NOT IN (${MANIFEST_ERROR_ORIGIN_SQL_LIST})
-               )
-          ) THEN
-            UPDATE "requests"
-               SET "quota_counted" = true
-             WHERE "id" = NEW.request_id
-               AND "quota_counted" = false;
-            RETURN NEW;
-          END IF;
-
-          UPDATE "requests" r
-             SET "quota_counted" = true
-           WHERE r."id" = NEW.request_id
-             AND r."quota_counted" = false
-             AND r."tenant_id" IS NOT NULL
-             AND r."timestamp" >= '${resetCutoff}'::timestamp
-             AND NOT EXISTS (
-               SELECT 1
-                 FROM "agents" a
-                WHERE a."id" = r."agent_id"
-                  AND a."is_playground" = true
-             )
-          RETURNING
-            r."tenant_id",
-            GREATEST(
-              date_trunc(
-                'month',
-                (r."timestamp" AT TIME ZONE '${storageTimeZoneSql}') AT TIME ZONE 'UTC'
-              ),
-              '${resetWindow}'::timestamp
-            )
-               INTO counted_tenant_id, counted_window_start;
-
-          IF counted_tenant_id IS NULL THEN
-            RETURN NEW;
-          END IF;
-
-          INSERT INTO "tenant_request_usage" (
-            "tenant_id",
-            "window_start",
-            "request_count",
-            "baseline_counted"
-          )
-          VALUES (
-            counted_tenant_id,
-            counted_window_start,
-            1,
-            counted_window_start >= counter_cutover_at
-          )
-          ON CONFLICT ("tenant_id", "window_start")
-          DO UPDATE SET "request_count" = "tenant_request_usage"."request_count" + 1;
-
-          RETURN NEW;
-        END;
-        $$
-      `);
-
-      // The lock makes cutover publication and trigger installation atomic:
-      // rows committed before the lock are historical; rows after commit see
-      // the trigger. A one-second lock timeout makes a busy deploy retry instead
-      // of pausing writes indefinitely.
-      await queryRunner.startTransaction();
-      try {
-        await queryRunner.query(`LOCK TABLE "agent_messages" IN SHARE ROW EXCLUSIVE MODE`);
-        await queryRunner.query(`
-          INSERT INTO "backfill_state" ("name", "completed_at")
-          VALUES (
-            '${REQUEST_USAGE_CUTOVER_STATE}',
-            clock_timestamp() AT TIME ZONE 'UTC'
-          )
-          ON CONFLICT ("name") DO NOTHING
-        `);
-        await queryRunner.query(`
-          DO $$
-          BEGIN
-            IF NOT EXISTS (
-              SELECT 1
-                FROM pg_trigger
-               WHERE tgname = 'TRG_agent_messages_count_tenant_request_usage'
-                 AND tgrelid = 'agent_messages'::regclass
-            ) THEN
-              CREATE TRIGGER "TRG_agent_messages_count_tenant_request_usage"
-              AFTER INSERT OR UPDATE OF "request_id" ON "agent_messages"
-              FOR EACH ROW EXECUTE FUNCTION "count_tenant_request_usage"();
-            END IF;
-          END
-          $$
-        `);
-        await queryRunner.commitTransaction();
-      } catch (error) {
-        await queryRunner.rollbackTransaction();
-        throw error;
-      }
-    } finally {
-      await queryRunner.query(`RESET lock_timeout`);
-    }
+  public async up(): Promise<void> {
+    // Self-hosted path: no quota counter schema.
   }
 
   public async down(queryRunner: QueryRunner): Promise<void> {
diff --git a/packages/backend/src/database/migrations/1803200000000-DropBillingSchema.spec.ts b/packages/backend/src/database/migrations/1803200000000-DropBillingSchema.spec.ts
new file mode 100644
index 00000000..aa24d5b1
--- /dev/null
+++ b/packages/backend/src/database/migrations/1803200000000-DropBillingSchema.spec.ts
@@ -0,0 +1,43 @@
+import { DropBillingSchema1803200000000 } from './1803200000000-DropBillingSchema';
+
+async function run(direction: 'up' | 'down'): Promise<string[]> {
+  const query = jest.fn(async () => []);
+  await new DropBillingSchema1803200000000()[direction]({ query } as never);
+  return query.mock.calls.map((call) => String((call as unknown[])[0]));
+}
+
+describe('DropBillingSchema1803200000000', () => {
+  it('drops the quota trigger and function before the table they write to', async () => {
+    const sql = await run('up');
+    const at = (fragment: string) => sql.findIndex((statement) => statement.includes(fragment));
+
+    expect(at('DROP TRIGGER IF EXISTS "TRG_agent_messages_count_tenant_request_usage"')).toBe(0);
+    expect(at('DROP FUNCTION IF EXISTS "count_tenant_request_usage"()')).toBe(1);
+    expect(at('DROP TABLE IF EXISTS "tenant_request_usage"')).toBeGreaterThan(1);
+  });
+
+  it('drops every billing table and column idempotently', async () => {
+    const sql = (await run('up')).join('\n');
+
+    expect(sql).toContain(
+      `DELETE FROM "backfill_state" WHERE "name" = 'tenant_request_usage_cutover_v1'`,
+    );
+    expect(sql).toContain('ALTER TABLE "requests" DROP COLUMN IF EXISTS "quota_counted"');
+    expect(sql).toContain('DROP TABLE IF EXISTS "tenant_request_usage"');
+    expect(sql).toContain('DROP TABLE IF EXISTS "billing_email_logs"');
+    expect(sql).toContain('DROP COLUMN IF EXISTS "limit_overrides"');
+    expect(sql).toContain('DROP COLUMN IF EXISTS "billing_email_preferences"');
+    expect(sql).not.toMatch(/DROP (TABLE|COLUMN|TRIGGER|FUNCTION) (?!IF EXISTS)/);
+  });
+
+  it('restores the self-hosted billing schema on revert, without the quota counter', async () => {
+    const sql = (await run('down')).join('\n');
+
+    expect(sql).toContain('ADD COLUMN IF NOT EXISTS "limit_overrides" jsonb');
+    expect(sql).toContain('ADD COLUMN IF NOT EXISTS "billing_email_preferences" jsonb');
+    expect(sql).toContain('CREATE TABLE IF NOT EXISTS "billing_email_logs"');
+    expect(sql).toContain('CREATE UNIQUE INDEX IF NOT EXISTS "IDX_billing_email_logs_dedupe_key"');
+    expect(sql).toContain('CREATE INDEX IF NOT EXISTS "IDX_billing_email_logs_tenant_period"');
+    expect(sql).not.toContain('tenant_request_usage');
+  });
+});
diff --git a/packages/backend/src/database/migrations/1803200000000-DropBillingSchema.ts b/packages/backend/src/database/migrations/1803200000000-DropBillingSchema.ts
new file mode 100644
index 00000000..44c24528
--- /dev/null
+++ b/packages/backend/src/database/migrations/1803200000000-DropBillingSchema.ts
@@ -0,0 +1,68 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+/**
+ * Drops the schema left behind by the removed billing layer (Stripe plans,
+ * request quotas and billing emails):
+ *
+ * - `tenant_request_usage`, plus the `agent_messages` trigger, its function,
+ *   the `requests.quota_counted` flag and the cutover row that fed it. These
+ *   only exist on databases that ran the old cloud-mode quota migration
+ *   (1801300000000), and the trigger must go before the table it writes to,
+ *   or every attempt insert would fail.
+ * - `billing_email_logs` (its indexes go with the table).
+ * - `tenants.limit_overrides` and `tenants.billing_email_preferences`.
+ *
+ * Better Auth's Stripe plugin tables (`subscription`, `user.stripeCustomerId`)
+ * were only created when `STRIPE_*` was configured; they are not managed by
+ * TypeORM and are left alone.
+ *
+ * Every statement is idempotent, so the migration is safe on any schema.
+ * `down()` restores what the earlier migrations create on the self-hosted path
+ * (the quota counter was never part of it), not the rows.
+ */
+export class DropBillingSchema1803200000000 implements MigrationInterface {
+  name = 'DropBillingSchema1803200000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP TRIGGER IF EXISTS "TRG_agent_messages_count_tenant_request_usage" ON "agent_messages"`,
+    );
+    await queryRunner.query(`DROP FUNCTION IF EXISTS "count_tenant_request_usage"()`);
+    await queryRunner.query(
+      `DELETE FROM "backfill_state" WHERE "name" = 'tenant_request_usage_cutover_v1'`,
+    );
+    await queryRunner.query(`ALTER TABLE "requests" DROP COLUMN IF EXISTS "quota_counted"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "tenant_request_usage"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "billing_email_logs"`);
+    await queryRunner.query(
+      `ALTER TABLE "tenants" DROP COLUMN IF EXISTS "limit_overrides", DROP COLUMN IF EXISTS "billing_email_preferences"`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "tenants" ADD COLUMN IF NOT EXISTS "limit_overrides" jsonb, ADD COLUMN IF NOT EXISTS "billing_email_preferences" jsonb`,
+    );
+    await queryRunner.query(`
+      CREATE TABLE IF NOT EXISTS "billing_email_logs" (
+        "id" varchar NOT NULL,
+        "dedupe_key" varchar NOT NULL,
+        "kind" varchar NOT NULL,
+        "tenant_id" varchar,
+        "user_id" varchar,
+        "stripe_subscription_id" varchar,
+        "period_start" TIMESTAMP,
+        "period_end" TIMESTAMP,
+        "metadata" jsonb,
+        "sent_at" TIMESTAMP NOT NULL DEFAULT NOW(),
+        CONSTRAINT "PK_billing_email_logs" PRIMARY KEY ("id")
+      )
+    `);
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX IF NOT EXISTS "IDX_billing_email_logs_dedupe_key" ON "billing_email_logs" ("dedupe_key")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX IF NOT EXISTS "IDX_billing_email_logs_tenant_period" ON "billing_email_logs" ("tenant_id", "period_start") WHERE "tenant_id" IS NOT NULL`,
+    );
+  }
+}
diff --git a/packages/backend/src/database/request-recording-retention.service.spec.ts b/packages/backend/src/database/request-recording-retention.service.spec.ts
index af6e58f7..e6d466e6 100644
--- a/packages/backend/src/database/request-recording-retention.service.spec.ts
+++ b/packages/backend/src/database/request-recording-retention.service.spec.ts
@@ -1,13 +1,6 @@
 import { Logger } from '@nestjs/common';
-import { isBillingEnabled } from '../billing/billing.config';
 import { RequestRecordingRetentionService } from './request-recording-retention.service';
 
-jest.mock('../billing/billing.config', () => ({
-  isBillingEnabled: jest.fn(),
-}));
-
-const mockedIsBillingEnabled = jest.mocked(isBillingEnabled);
-
 describe('RequestRecordingRetentionService', () => {
   const query = jest.fn();
   const connect = jest.fn();
@@ -25,7 +18,6 @@ describe('RequestRecordingRetentionService', () => {
     connect.mockResolvedValue(undefined);
     release.mockResolvedValue(undefined);
     storage.delete.mockResolvedValue(undefined);
-    mockedIsBillingEnabled.mockReturnValue(true);
     query.mockImplementation(async (sql: string) => {
       if (sql.includes('pg_try_advisory_lock')) return [{ acquired: true }];
       if (sql.includes('pg_advisory_unlock')) return [{ unlocked: true }];
@@ -43,14 +35,14 @@ describe('RequestRecordingRetentionService', () => {
 
   afterEach(() => jest.restoreAllMocks());
 
-  it('deletes Free recordings after 7 days and Pro recordings after 365 days', async () => {
+  it('deletes recordings older than the 365-day default, storage object first', async () => {
     const expired = {
       attempt_id: 'attempt-1',
       storage_key: 'request-recordings/v1/attempt-1.json.gz',
     };
     query.mockImplementation(async (sql: string) => {
       if (sql.includes('pg_try_advisory_lock')) return [{ acquired: true }];
-      if (sql.includes('FROM agent_messages attempt')) return [expired];
+      if (sql.includes('FROM agent_messages')) return [expired];
       if (sql.includes('UPDATE agent_messages')) {
         return [[{ id: 'attempt-1' }], 1];
       }
@@ -59,17 +51,10 @@ describe('RequestRecordingRetentionService', () => {
 
     await expect(service.deleteExpiredRecordings()).resolves.toBe(1);
 
-    const planQuery = query.mock.calls.find(([sql]) =>
-      String(sql).includes('FROM agent_messages attempt'),
-    );
-    expect(planQuery).toBeDefined();
-    expect(planQuery![0]).toContain('AND NOT EXISTS');
-    expect(planQuery![0]).toContain('AND EXISTS');
-    expect(planQuery![0]).toContain("subscription.status IN ('active', 'trialing', 'past_due')");
-    expect(planQuery![0]).toContain(
-      "AND attempt.timestamp < CURRENT_TIMESTAMP - (LEAST($1::int, $2::int) * INTERVAL '1 day')",
-    );
-    expect(planQuery![1]).toEqual([7, 365]);
+    const select = query.mock.calls.find(([sql]) => String(sql).includes('FROM agent_messages'));
+    expect(select).toBeDefined();
+    expect(select![0]).not.toMatch(/subscription|tenants|plan/i);
+    expect(select![1]).toEqual([365]);
     expect(storage.delete).toHaveBeenCalledWith(expired.storage_key);
     const deleteCall = query.mock.calls.findIndex(([sql]) =>
       String(sql).includes('UPDATE agent_messages'),
@@ -79,7 +64,7 @@ describe('RequestRecordingRetentionService', () => {
     );
   });
 
-  it('uses one global retention override for every plan', async () => {
+  it('uses the global retention override when configured', async () => {
     get.mockReturnValue(30);
     service = new RequestRecordingRetentionService(
       { createQueryRunner } as never,
@@ -89,22 +74,7 @@ describe('RequestRecordingRetentionService', () => {
 
     await expect(service.deleteExpiredRecordings()).resolves.toBe(0);
 
-    const select = query.mock.calls.find(
-      ([sql]) =>
-        String(sql).includes('FROM agent_messages') &&
-        !String(sql).includes('FROM agent_messages attempt'),
-    );
-    expect(select).toBeDefined();
-    expect(select![0]).not.toContain('subscription');
-    expect(select![1]).toEqual([30]);
-  });
-
-  it('uses the 365-day default outside billing deployments', async () => {
-    mockedIsBillingEnabled.mockReturnValue(false);
-
-    await expect(service.deleteExpiredRecordings()).resolves.toBe(0);
-
-    expect(query).toHaveBeenCalledWith(expect.stringContaining('FROM agent_messages'), [365]);
+    expect(query).toHaveBeenCalledWith(expect.stringContaining('FROM agent_messages'), [30]);
   });
 
   it('does no work when another replica owns the advisory lock', async () => {
@@ -119,7 +89,7 @@ describe('RequestRecordingRetentionService', () => {
   it('keeps metadata when object deletion fails so cleanup can retry', async () => {
     query.mockImplementation(async (sql: string) => {
       if (sql.includes('pg_try_advisory_lock')) return [{ acquired: true }];
-      if (sql.includes('FROM agent_messages attempt')) {
+      if (sql.includes('FROM agent_messages')) {
         return [
           {
             attempt_id: 'attempt-1',
diff --git a/packages/backend/src/database/request-recording-retention.service.ts b/packages/backend/src/database/request-recording-retention.service.ts
index 842ab316..d724bdba 100644
--- a/packages/backend/src/database/request-recording-retention.service.ts
+++ b/packages/backend/src/database/request-recording-retention.service.ts
@@ -2,13 +2,9 @@ import { Injectable, Logger } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { Cron, CronExpression } from '@nestjs/schedule';
 import { DataSource, QueryRunner } from 'typeorm';
-import { isBillingEnabled } from '../billing/billing.config';
-import { PAID_SUBSCRIPTION_STATUS_SQL_LIST } from '../billing/subscription-status';
 import { RequestRecordingStorageService } from '../common/services/request-recording-storage.service';
 
-const FREE_RETENTION_DAYS = 7;
-const PRO_RETENTION_DAYS = 365;
-const NON_BILLING_RETENTION_DAYS = 365;
+const DEFAULT_RETENTION_DAYS = 365;
 const RETENTION_LOCK_KEY = 4011986;
 
 const TRY_LOCK_SQL = `
@@ -25,49 +21,6 @@ const SELECT_ALL_EXPIRED_SQL = `
   ORDER BY timestamp ASC
 `;
 
-// The top-level timestamp bound is implied by the OR below (LEAST($1, $2) is
-// the shorter retention, so the later cutoff), but the planner cannot hoist it
-// out of the OR on its own. Stated explicitly it becomes a range scan on the
-// partial index IDX_agent_messages_recording (migration 1802600000000), and the
-// `::int` casts pin $1/$2 to integers, so the retention constants above must
-// stay whole days — a fractional value fails loudly at parse time.
-// Every arm's cutoff must be an argument to `LEAST`, or that arm silently stops
-// matching.
-const SELECT_PLAN_EXPIRED_SQL = `
-  SELECT attempt.id AS attempt_id, attempt.recording_key AS storage_key
-  FROM agent_messages attempt
-  JOIN requests request ON request.id = attempt.request_id
-  WHERE attempt.recording_key IS NOT NULL
-    AND attempt.timestamp < CURRENT_TIMESTAMP - (LEAST($1::int, $2::int) * INTERVAL '1 day')
-    AND (
-    (
-      attempt.timestamp < CURRENT_TIMESTAMP - ($1 * INTERVAL '1 day')
-      AND NOT EXISTS (
-        SELECT 1
-        FROM tenants tenant
-        JOIN "subscription" subscription
-          ON subscription."referenceId" = tenant.owner_user_id
-        WHERE tenant.id = request.tenant_id
-          AND subscription.plan = 'pro'
-          AND subscription.status IN (${PAID_SUBSCRIPTION_STATUS_SQL_LIST})
-      )
-    )
-    OR (
-      attempt.timestamp < CURRENT_TIMESTAMP - ($2 * INTERVAL '1 day')
-      AND EXISTS (
-        SELECT 1
-        FROM tenants tenant
-        JOIN "subscription" subscription
-          ON subscription."referenceId" = tenant.owner_user_id
-        WHERE tenant.id = request.tenant_id
-          AND subscription.plan = 'pro'
-          AND subscription.status IN (${PAID_SUBSCRIPTION_STATUS_SQL_LIST})
-      )
-    )
-  )
-  ORDER BY attempt.timestamp ASC
-`;
-
 const DELETE_METADATA_SQL = `
   UPDATE agent_messages
   SET recording_key = NULL
@@ -107,13 +60,10 @@ export class RequestRecordingRetentionService {
       acquired = lockRows[0]?.acquired === true;
       if (!acquired) return 0;
 
-      const recordings =
-        this.globalRetentionDays !== null || !isBillingEnabled()
-          ? await this.findAllExpired(
-              queryRunner,
-              this.globalRetentionDays ?? NON_BILLING_RETENTION_DAYS,
-            )
-          : await this.findExpiredByPlan(queryRunner);
+      const recordings = await this.findAllExpired(
+        queryRunner,
+        this.globalRetentionDays ?? DEFAULT_RETENTION_DAYS,
+      );
       const deleted = await this.deleteRecordings(queryRunner, recordings);
 
       if (deleted > 0) {
@@ -142,13 +92,6 @@ export class RequestRecordingRetentionService {
     >;
   }
 
-  private async findExpiredByPlan(queryRunner: QueryRunner): Promise<ExpiredRecording[]> {
-    return queryRunner.query(SELECT_PLAN_EXPIRED_SQL, [
-      FREE_RETENTION_DAYS,
-      PRO_RETENTION_DAYS,
-    ]) as Promise<ExpiredRecording[]>;
-  }
-
   private async deleteRecordings(
     queryRunner: QueryRunner,
     recordings: ExpiredRecording[],
diff --git a/packages/backend/src/entities/agent-message.entity.ts b/packages/backend/src/entities/agent-message.entity.ts
index 0f3d5d6a..6848adff 100644
--- a/packages/backend/src/entities/agent-message.entity.ts
+++ b/packages/backend/src/entities/agent-message.entity.ts
@@ -117,9 +117,8 @@ export class AgentMessage {
    * WHAT kind of failure it was (normalized): 'rate_limit' | 'auth' |
    * 'invalid_request' | 'billing' | 'server_error' | 'timeout' | 'network' |
    * 'no_provider' | 'no_provider_key' | 'local_provider_unavailable' |
-   * 'limit_exceeded' | 'plan_request_limit_exceeded' | 'internal' | … A rate
-   * limit is a *class*
-   * of error here, not a top-level status. NULL on success.
+   * 'limit_exceeded' | 'internal' | … A rate limit is a *class* of error
+   * here, not a top-level status. NULL on success.
    */
   @Column('varchar', { nullable: true })
   error_class!: string | null;
diff --git a/packages/backend/src/entities/tenant-request-usage.entity.spec.ts b/packages/backend/src/entities/tenant-request-usage.entity.spec.ts
deleted file mode 100644
index d387cb76..00000000
--- a/packages/backend/src/entities/tenant-request-usage.entity.spec.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-import { getMetadataArgsStorage } from 'typeorm';
-import { TenantRequestUsage } from './tenant-request-usage.entity';
-
-describe('TenantRequestUsage', () => {
-  it('maps the tenant and quota window as the composite primary key', () => {
-    const primaryColumns = getMetadataArgsStorage()
-      .columns.filter(
-        (column) => column.target === TenantRequestUsage && column.options.primary === true,
-      )
-      .map((column) => column.propertyName)
-      .sort();
-
-    expect(primaryColumns).toEqual(['tenant_id', 'window_start']);
-  });
-
-  it('tracks whether the historical baseline was initialized', () => {
-    const baselineColumn = getMetadataArgsStorage().columns.find(
-      (column) =>
-        column.target === TenantRequestUsage && column.propertyName === 'baseline_counted',
-    );
-
-    expect(baselineColumn?.options).toMatchObject({ default: false });
-  });
-});
diff --git a/packages/backend/src/entities/tenant-request-usage.entity.ts b/packages/backend/src/entities/tenant-request-usage.entity.ts
deleted file mode 100644
index e0cdcedc..00000000
--- a/packages/backend/src/entities/tenant-request-usage.entity.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { Column, Entity, PrimaryColumn } from 'typeorm';
-import { timestampType } from '../common/utils/postgres-sql';
-
-@Entity('tenant_request_usage')
-export class TenantRequestUsage {
-  @PrimaryColumn('varchar')
-  tenant_id!: string;
-
-  @PrimaryColumn(timestampType())
-  window_start!: string;
-
-  /** PostgreSQL bigint values are returned as strings by the pg driver. */
-  @Column('bigint', { default: 0 })
-  request_count!: string;
-
-  /** True after pre-cutover usage has been added once for this tenant/window. */
-  @Column('boolean', { default: false })
-  baseline_counted!: boolean;
-}
diff --git a/packages/backend/src/entities/tenant.entity.spec.ts b/packages/backend/src/entities/tenant.entity.spec.ts
index 342650ee..2aad22ac 100644
--- a/packages/backend/src/entities/tenant.entity.spec.ts
+++ b/packages/backend/src/entities/tenant.entity.spec.ts
@@ -31,22 +31,12 @@ describe('Tenant entity', () => {
     expect(t.email).toBeNull();
   });
 
-  it('allows limit_overrides to be set or null', () => {
-    const t = new Tenant();
-    t.limit_overrides = null;
-    expect(t.limit_overrides).toBeNull();
-
-    t.limit_overrides = { requestsPerMonth: 50000 };
-    expect(t.limit_overrides).toEqual({ requestsPerMonth: 50000 });
-  });
-
-  it('allows billing_email_preferences to be set or null', () => {
-    const t = new Tenant();
-    t.billing_email_preferences = null;
-    expect(t.billing_email_preferences).toBeNull();
-
-    t.billing_email_preferences = { usageAlerts: false };
-    expect(t.billing_email_preferences).toEqual({ usageAlerts: false });
+  it('no longer maps the retired billing columns', () => {
+    const columns = getMetadataArgsStorage()
+      .columns.filter((c) => c.target === Tenant)
+      .map((c) => c.propertyName);
+    expect(columns).not.toContain('limit_overrides');
+    expect(columns).not.toContain('billing_email_preferences');
   });
 
   describe('TypeORM relation callbacks', () => {
diff --git a/packages/backend/src/entities/tenant.entity.ts b/packages/backend/src/entities/tenant.entity.ts
index 3511e44b..33d50df9 100644
--- a/packages/backend/src/entities/tenant.entity.ts
+++ b/packages/backend/src/entities/tenant.entity.ts
@@ -1,7 +1,6 @@
 import { Entity, Column, PrimaryColumn, OneToMany } from 'typeorm';
 import { Agent } from './agent.entity';
 import { timestampType, timestampDefault } from '../common/utils/postgres-sql';
-import type { BillingEmailPreferences } from 'manifest-shared';
 
 @Entity('tenants')
 export class Tenant {
@@ -31,17 +30,6 @@ export class Tenant {
   @Column('boolean', { default: true })
   is_active!: boolean;
 
-  /**
-   * Per-tenant plan-limit overrides (support / enterprise escape hatch).
-   * Null = plan defaults apply. When set, the matching fields override the
-   * resolved plan limits. Read by PlanService.getLimits().
-   */
-  @Column('jsonb', { nullable: true })
-  limit_overrides!: { requestsPerMonth?: number } | null;
-
-  @Column('jsonb', { nullable: true })
-  billing_email_preferences!: Partial<BillingEmailPreferences> | null;
-
   @OneToMany(() => Agent, (a) => a.tenant, { cascade: true })
   agents!: Agent[];
 
diff --git a/packages/backend/src/notifications/emails/email-assets.spec.ts b/packages/backend/src/notifications/emails/email-assets.spec.ts
index 4c7c35ff..b5ecd216 100644
--- a/packages/backend/src/notifications/emails/email-assets.spec.ts
+++ b/packages/backend/src/notifications/emails/email-assets.spec.ts
@@ -4,7 +4,6 @@ import { ResetPasswordEmail } from './reset-password';
 import { TestEmail } from './test-email';
 import { ThresholdAlertEmail } from './threshold-alert';
 import { DoctorReleaseEmail } from './doctor-release';
-import { PlanUsageEmail, SubscriptionPlanEmail } from '../../billing/emails/billing-plan-email';
 
 const dashboard = 'https://dashboard.example';
 const renderers = {
@@ -22,21 +21,6 @@ const renderers = {
       agentUrl: `${dashboard}/harnesses/demo`,
     }),
   announcement: () => DoctorReleaseEmail({ appUrl: dashboard }),
-  subscription: () =>
-    SubscriptionPlanEmail({
-      kind: 'subscription_confirmed',
-      planName: 'Pro',
-      appUrl: dashboard,
-      manageBillingUrl: `${dashboard}/account`,
-    }),
-  usage: () =>
-    PlanUsageEmail({
-      kind: 'requests_warning',
-      used: 8000,
-      limit: 10000,
-      periodEnd: '2026-10-01',
-      appUrl: dashboard,
-    }),
 };
 
 describe('email image deployment URLs', () => {
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy-exception.filter.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy-exception.filter.spec.ts
index b45bbd50..aab70e49 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy-exception.filter.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy-exception.filter.spec.ts
@@ -1,7 +1,6 @@
 import { UnauthorizedException, BadRequestException, HttpException } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { ArgumentsHost } from '@nestjs/common';
-import { FREE_PLAN_REQUESTS_PER_MONTH } from 'manifest-shared';
 import { ProxyExceptionFilter } from '../proxy-exception.filter';
 import type { ProxyMessageRecorder } from '../proxy-message-recorder';
 
@@ -363,79 +362,50 @@ describe('ProxyExceptionFilter', () => {
     });
   });
 
-  describe('plan request-limit block (402 PLAN_LIMIT_REQUESTS)', () => {
-    const blockExc = () =>
-      new HttpException(
-        {
-          statusCode: 402,
-          code: 'PLAN_LIMIT_REQUESTS',
-          limit: FREE_PLAN_REQUESTS_PER_MONTH,
-          used: FREE_PLAN_REQUESTS_PER_MONTH,
-        },
-        402,
-      );
-
-    it('renders the friendly M204 upgrade message for a non-streaming chat client (HTTP 200)', () => {
-      const { host, res } = chatHost();
-      filter.catch(blockExc(), host);
-
-      expect(res.status).toHaveBeenCalledWith(200);
-      const payload = res.json.mock.calls[0][0];
-      const content = payload.choices[0].message.content as string;
-      expect(content).toContain('M204');
-      expect(content).toContain(`${FREE_PLAN_REQUESTS_PER_MONTH} requests`);
-      expect(content).toContain('http://localhost:3001/upgrade?reason=requests');
-    });
+  // The gateway no longer has a plan paywall, so a 402 (even one carrying a
+  // quota-style body) gets no special treatment: it follows the same generic
+  // path as any other 4xx, and no upgrade link is ever rendered.
+  describe('402 responses (no plan paywall)', () => {
+    const legacyPlanBlock = () =>
+      new HttpException({ statusCode: 402, code: 'QUOTA_EXCEEDED', limit: 0, used: 0 }, 402);
 
-    it('returns a real 402 with insufficient_quota + code for an SDK/tool client', () => {
+    it('returns the generic 4xx envelope to an SDK/tool client', () => {
       const { host, res } = createMockHost({}, { accept: 'application/json' });
-      filter.catch(blockExc(), host);
+      filter.catch(legacyPlanBlock(), host);
 
       expect(res.status).toHaveBeenCalledWith(402);
-      expect(res.json).toHaveBeenCalledWith(
-        expect.objectContaining({
-          error: expect.objectContaining({
-            type: 'insufficient_quota',
-            code: 'PLAN_LIMIT_REQUESTS',
-            message: expect.stringContaining('Upgrade to Pro'),
-          }),
-          limit: FREE_PLAN_REQUESTS_PER_MONTH,
-          used: FREE_PLAN_REQUESTS_PER_MONTH,
-        }),
-      );
+      expect(res.json).toHaveBeenCalledWith({
+        error: { message: expect.any(String), type: 'invalid_request_error' },
+      });
       const payload = res.json.mock.calls[0][0];
-      expect(payload.error.message).toContain('http://localhost:3001/upgrade?reason=requests');
+      expect(JSON.stringify(payload)).not.toMatch(/insufficient_quota|upgrade|M204/i);
     });
 
-    it('ignores a 402 without the PLAN_LIMIT_REQUESTS code (falls through)', () => {
-      const { host, res } = createMockHost({}, { accept: 'application/json' });
-      filter.catch(new HttpException({ statusCode: 402, code: 'SOMETHING_ELSE' }, 402), host);
+    it('renders the plain exception message for a chat client, without an upgrade link', () => {
+      const { host, res } = chatHost();
+      filter.catch(new HttpException('Payment required by upstream', 402), host);
 
-      // Falls through to the generic tool envelope, not the billing branch.
-      expect(res.status).toHaveBeenCalledWith(402);
-      const payload = res.json.mock.calls[0][0];
-      expect(payload.error.type).not.toBe('insufficient_quota');
+      expect(res.status).toHaveBeenCalledWith(200);
+      const content = res.json.mock.calls[0][0].choices[0].message.content as string;
+      expect(content).toBe('Payment required by upstream');
+      expect(content).not.toMatch(/upgrade|M204/i);
     });
 
-    it('renders the friendly M204 upgrade message as SSE for a streaming chat client', () => {
+    it('streams the plain exception message to a streaming chat client', () => {
       const { host, res } = createMockHost({ stream: true });
-      filter.catch(blockExc(), host);
+      filter.catch(legacyPlanBlock(), host);
 
-      expect(res.setHeader).toHaveBeenCalledWith('Content-Type', 'text/event-stream');
       expect(res.status).toHaveBeenCalledWith(200);
       const payload = res.send.mock.calls[0][0] as string;
       expect(payload).toContain('data: [DONE]');
-      expect(payload).toContain('M204');
+      expect(payload).not.toMatch(/upgrade|M204/i);
     });
 
-    it('returns the 402 to an Accept: text/event-stream non-streaming client with a friendly response', () => {
-      const { host, res } = chatHost();
-      filter.catch(blockExc(), host);
+    it('never records a blocked-request row for a 402', () => {
+      const { host } = createMockHost({}, { accept: 'application/json' });
+      filter.catch(legacyPlanBlock(), host);
 
-      expect(res.status).toHaveBeenCalledWith(200);
-      const payload = res.json.mock.calls[0][0];
-      const content = payload.choices[0].message.content as string;
-      expect(content).toContain('M204');
+      expect(recordManifestBlockedRequest).not.toHaveBeenCalled();
     });
   });
 });
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.spec.ts
index a431e006..f5f1ae8f 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.spec.ts
@@ -1077,36 +1077,6 @@ describe('ProxyMessageRecorder', () => {
       ]);
     });
 
-    it('records plan-limit blocks as Manifest policy rows', async () => {
-      await recorder.recordManifestBlockedRequest(ctx, {
-        httpStatus: 402,
-        errorMessage: 'Free plan request limit reached',
-        reason: 'plan_request_limit_exceeded',
-        model: 'auto',
-        traceId: 'trace-1',
-        sessionKey: 'session-1',
-      });
-
-      expect(insertMock).toHaveBeenCalledTimes(1);
-      expect(insertMock.mock.calls[0][0]).toMatchObject({
-        tenant_id: 'tenant-1',
-        agent_id: 'agent-1',
-        agent_name: 'test-agent',
-        trace_id: 'trace-1',
-        session_key: 'session-1',
-        status: 'failed',
-        error_message: 'Free plan request limit reached',
-        error_http_status: 402,
-        routing_reason: 'plan_request_limit_exceeded',
-        error_origin: 'policy',
-        error_class: 'plan_request_limit_exceeded',
-        superseded: false,
-        model: 'auto',
-        provider: null,
-      });
-      expect(emitMock).toHaveBeenCalledWith('tenant-1', 'message', 'user-1');
-    });
-
     it('records local proxy rate limits as Manifest policy rate-limit rows', async () => {
       await recorder.recordManifestBlockedRequest(ctx, {
         httpStatus: 429,
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy.controller.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy.controller.spec.ts
index 38c8e659..b7d7852f 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy.controller.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy.controller.spec.ts
@@ -1,5 +1,4 @@
 import { HttpException, Logger } from '@nestjs/common';
-import { FREE_PLAN_REQUESTS_PER_MONTH } from 'manifest-shared';
 import { ManifestError } from '../../../common/errors/manifest-error';
 import { ProxyController } from '../proxy.controller';
 import { ProxyMessageRecorder } from '../proxy-message-recorder';
@@ -150,7 +149,6 @@ describe('ProxyController', () => {
   let providerParamSpecs: { getCapabilities: jest.Mock };
   let modelsDevSync: { lookupModelCapabilities: jest.Mock };
   let recorder: ProxyMessageRecorder;
-  let planService: { assertWithinRequestLimit: jest.Mock };
   let observationReporter: { report: jest.Mock };
   let recordingConfig: { isRecording: jest.Mock };
   let attemptRecording: { available: boolean; save: jest.Mock };
@@ -158,7 +156,6 @@ describe('ProxyController', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     proxyService = { proxyRequest: jest.fn() };
-    planService = { assertWithinRequestLimit: jest.fn().mockResolvedValue(undefined) };
     rateLimiter = {
       checkLimit: jest.fn(),
       checkIpLimit: jest.fn(),
@@ -228,7 +225,6 @@ describe('ProxyController', () => {
       new ThinkingBlockCache(),
       new ReasoningContentCache(),
       modelDiscovery as never,
-      planService as never,
       observationReporter as never,
       providerParamSpecs as never,
       modelsDevSync as never,
@@ -1057,77 +1053,58 @@ describe('ProxyController', () => {
     expect(res.status).toHaveBeenCalledWith(200);
   });
 
-  it('enforces the plan request limit before routing and records a Manifest policy row', async () => {
-    const block = new HttpException(
-      {
-        statusCode: 402,
-        code: 'PLAN_LIMIT_REQUESTS',
-        limit: FREE_PLAN_REQUESTS_PER_MONTH,
-        used: FREE_PLAN_REQUESTS_PER_MONTH,
+  // There is no plan paywall on the hot path: admission goes straight to the
+  // local rate limiter and routing, with no per-request plan lookup.
+  it('admits a normal request straight to rate limiting and routing', async () => {
+    const responseBody = { choices: [{ message: { content: 'hello' } }] };
+    proxyService.proxyRequest.mockResolvedValue({
+      forward: {
+        response: new Response(JSON.stringify(responseBody), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        }),
+        isGoogle: false,
+        isAnthropic: false,
+        isChatGpt: false,
       },
-      402,
-    );
-    planService.assertWithinRequestLimit.mockRejectedValueOnce(block);
-    const recordSpy = jest.spyOn(recorder, 'recordManifestBlockedRequest');
+      meta: { tier: 'simple', model: 'gpt-4o', provider: 'OpenAI', confidence: 0.9 },
+    });
+    const blockedSpy = jest.spyOn(recorder, 'recordManifestBlockedRequest');
 
     const req = mockRequest({ model: 'auto', messages: [{ role: 'user', content: 'hi' }] });
     const { res } = mockResponse();
 
-    // The gate runs BEFORE the try/catch, so the 402 propagates to
-    // ProxyExceptionFilter instead of the local handleProxyError.
-    await expect(controller.chatCompletions(req as never, res as never)).rejects.toBe(block);
-    await flushRecorderMicrotasks();
+    await controller.chatCompletions(req as never, res as never);
 
-    // Gate ran before rate limiting / routing. The recorded row is classified as
-    // Manifest policy, which PlanService excludes from billable request counts.
-    expect(planService.assertWithinRequestLimit).toHaveBeenCalledWith(req.ingestionContext);
-    expect(rateLimiter.checkLimit).not.toHaveBeenCalled();
-    expect(proxyService.proxyRequest).not.toHaveBeenCalled();
-    expect(recordSpy).toHaveBeenCalledWith(
-      req.ingestionContext,
-      expect.objectContaining({
-        httpStatus: 402,
-        errorMessage: 'Free plan monthly request limit reached',
-        reason: 'plan_request_limit_exceeded',
-        model: 'auto',
-      }),
-    );
-    expect(mockMessageRepo.insert).toHaveBeenCalledWith(
-      expect.objectContaining({
-        status: 'failed',
-        error_http_status: 402,
-        routing_reason: 'plan_request_limit_exceeded',
-        error_origin: 'policy',
-        error_class: 'plan_request_limit_exceeded',
-      }),
+    expect(rateLimiter.checkLimit).toHaveBeenCalledWith('tenant-1');
+    expect(rateLimiter.checkLimit.mock.invocationCallOrder[0]).toBeLessThan(
+      proxyService.proxyRequest.mock.invocationCallOrder[0]!,
     );
+    expect(res.status).toHaveBeenCalledWith(200);
+    expect(res.json).toHaveBeenCalledWith(responseBody);
+    expect(blockedSpy).not.toHaveBeenCalled();
   });
 
-  it('routes a non-402 plan-lookup error through the normal proxy error handler', async () => {
-    // A subscription/tenant lookup failure is Manifest's own bug (M500), not a
-    // provider failure — it must be recorded + normalized, never thrown raw
-    // (which would 500 the caller) and never blamed on the provider.
-    planService.assertWithinRequestLimit.mockRejectedValueOnce(new Error('subscription db down'));
-    const manifestSpy = jest.spyOn(recorder, 'recordManifestBlockedRequest');
-    const providerSpy = jest.spyOn(recorder, 'recordProviderError');
+  it('handles a 402 raised while routing like any other 4xx, never as a plan block', async () => {
+    proxyService.proxyRequest.mockRejectedValue(new HttpException('Payment required', 402));
+    const blockedSpy = jest.spyOn(recorder, 'recordManifestBlockedRequest');
 
     const req = mockRequest({ messages: [{ role: 'user', content: 'hi' }] });
     const { res } = mockResponse();
 
-    await controller.chatCompletions(req as never, res as never);
+    // Handled locally (the response is written), not rethrown to the filter.
+    await expect(controller.chatCompletions(req as never, res as never)).resolves.toBeUndefined();
+    await flushRecorderMicrotasks();
 
-    expect(providerSpy).not.toHaveBeenCalled();
-    expect(manifestSpy).toHaveBeenCalledWith(
-      expect.anything(),
-      expect.objectContaining({
-        errorCode: 'M500',
-        reason: 'manifest_internal_error',
-        httpStatus: 500,
-        // The real internal message, not the friendly text the caller sees.
-        errorMessage: expect.stringContaining('subscription db down'),
-      }),
-    );
-    expect(proxyService.proxyRequest).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(402);
+    expect(res.json).toHaveBeenCalledWith({
+      error: { message: 'Payment required', type: 'invalid_request_error' },
+    });
+    for (const [, payload] of blockedSpy.mock.calls) {
+      expect(payload).not.toMatchObject({ reason: 'plan_request_limit_exceeded' });
+      expect(payload).not.toMatchObject({ errorCode: 'M204' });
+    }
+    expect(rateLimiter.releaseSlot).toHaveBeenCalledWith('tenant-1');
   });
 
   it('should expose /v1/responses and convert chat completions output to Responses format', async () => {
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy.controller.streaming-abort.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy.controller.streaming-abort.spec.ts
index 80d85b19..69c7bd2e 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy.controller.streaming-abort.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy.controller.streaming-abort.spec.ts
@@ -129,7 +129,6 @@ describe('ProxyController streaming abort', () => {
       new ThinkingBlockCache(),
       new ReasoningContentCache(),
       modelDiscovery as never,
-      { assertWithinRequestLimit: jest.fn().mockResolvedValue(undefined) } as never,
       { report: jest.fn() } as never,
       { getCapabilities: jest.fn().mockResolvedValue(null) } as never,
       {
diff --git a/packages/backend/src/routing/proxy/proxy-exception.filter.ts b/packages/backend/src/routing/proxy/proxy-exception.filter.ts
index 12658b5b..d484fb29 100644
--- a/packages/backend/src/routing/proxy/proxy-exception.filter.ts
+++ b/packages/backend/src/routing/proxy/proxy-exception.filter.ts
@@ -98,33 +98,6 @@ export class ProxyExceptionFilter implements ExceptionFilter {
       return;
     }
 
-    // Plan request-limit block (402). Chat clients get the friendly M204
-    // upgrade message with a link to the billing UI; SDKs/tools get a real 402
-    // with `insufficient_quota` (the type OpenAI SDKs map to billing) plus the
-    // machine code and limit/used for programmatic handling.
-    const billingResponse = exception.getResponse();
-    if (
-      status === 402 &&
-      typeof billingResponse === 'object' &&
-      billingResponse !== null &&
-      (billingResponse as { code?: string }).code === 'PLAN_LIMIT_REQUESTS'
-    ) {
-      const { limit, used } = billingResponse as { limit?: number; used?: number };
-      const upgradeUrl = `${getDashboardUrl(this.config)}/upgrade?reason=requests`;
-      const content = formatManifestError('M204', { threshold: limit ?? 0, upgradeUrl });
-      const isStream = (req.body as Record<string, unknown>)?.stream === true;
-      if (isChatRenderingClient(req)) {
-        sendFriendlyResponse(res, content, isStream);
-      } else {
-        res.status(402).json({
-          error: { message: content, type: 'insufficient_quota', code: 'PLAN_LIMIT_REQUESTS' },
-          limit,
-          used,
-        });
-      }
-      return;
-    }
-
     const isStream = (req.body as Record<string, unknown>)?.stream === true;
     const isChatClient = isChatRenderingClient(req);
 
diff --git a/packages/backend/src/routing/proxy/proxy-message-recorder.ts b/packages/backend/src/routing/proxy/proxy-message-recorder.ts
index 95d858c5..71731402 100644
--- a/packages/backend/src/routing/proxy/proxy-message-recorder.ts
+++ b/packages/backend/src/routing/proxy/proxy-message-recorder.ts
@@ -880,7 +880,7 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
 
   /**
    * The single writer for every Manifest-authored failure row: setup errors
-   * (M100/M101), limits (M200/M204), rate limits (M201–M203), malformed requests
+   * (M100/M101), limits (M200), rate limits (M201–M203), malformed requests
    * (M300), internal errors (M500), and expired keys (M004).
    *
    * `provider` and `routing_tier` are deliberately left NULL — no provider was
diff --git a/packages/backend/src/routing/proxy/proxy.controller.ts b/packages/backend/src/routing/proxy/proxy.controller.ts
index ff5436d0..0075074e 100644
--- a/packages/backend/src/routing/proxy/proxy.controller.ts
+++ b/packages/backend/src/routing/proxy/proxy.controller.ts
@@ -9,7 +9,6 @@ import {
   UseFilters,
   Logger,
   HttpException,
-  HttpStatus,
   Optional,
 } from '@nestjs/common';
 import { Request, Response as ExpressResponse } from 'express';
@@ -64,7 +63,6 @@ import { redactInlineImageDataUrls } from './inline-image-redaction';
 import { scrubSecrets } from '../../common/utils/secret-scrub';
 import { openAiModelId, subscriptionOpenAiModelId } from './openai-model-id';
 import { openAiModelCapabilities, type OpenAiModelCapabilities } from './openai-model-capabilities';
-import { PlanService } from '../../billing/plan.service';
 import { StreamFailure } from './stream-writer';
 import { AgentRecordingConfigService } from '../../common/services/agent-recording-config.service';
 import { AttemptRecordingService } from './attempt-recording.service';
@@ -137,7 +135,6 @@ export class ProxyController {
     private readonly thinkingCache: ThinkingBlockCache,
     private readonly reasoningCache: ReasoningContentCache,
     private readonly modelDiscovery: ModelDiscoveryService,
-    private readonly planService: PlanService,
     private readonly observationReporter: ObservationReporter,
     private readonly providerParamSpecs: ProviderParamSpecService,
     private readonly modelsDevSync: ModelsDevSyncService,
@@ -345,47 +342,6 @@ export class ProxyController {
       return attempt;
     };
 
-    // Plan request-limit gate. A 402 must reach ProxyExceptionFilter (friendly
-    // upgrade message / real 402), but still gets a Manifest-policy row in
-    // agent_messages so the Messages tab explains why the request never routed.
-    // Billing counters exclude Manifest-origin rows, so this does not consume
-    // quota or push the tenant further over the limit.
-    try {
-      await this.planService.assertWithinRequestLimit(req.ingestionContext);
-    } catch (err: unknown) {
-      if (err instanceof HttpException && err.getStatus() === HttpStatus.PAYMENT_REQUIRED) {
-        this.recordManifestBlockedRequest(
-          err,
-          req,
-          requestId,
-          traceId,
-          callerAttribution,
-          requestHeaders,
-          'plan_request_limit_exceeded',
-          apiMode,
-          HttpStatus.PAYMENT_REQUIRED,
-          'M204',
-          Date.now() - startTime,
-        );
-        throw err;
-      }
-      await this.handleProxyError(
-        err,
-        req,
-        res,
-        clientAbort,
-        headersSent,
-        requestId,
-        traceId,
-        callerAttribution,
-        requestHeaders,
-        apiMode,
-        undefined,
-        undefined,
-      );
-      return;
-    }
-
     try {
       // Each of these throws its own ManifestError (M201 per-user, M202 per-IP,
       // M203 concurrency), so handleProxyError records which limit actually
@@ -922,7 +878,6 @@ export class ProxyController {
           if (typeof nested === 'string') return nested;
         }
         const code = record.code;
-        if (code === 'PLAN_LIMIT_REQUESTS') return 'Free plan monthly request limit reached';
         if (typeof code === 'string') return code;
       }
     }
diff --git a/packages/backend/src/routing/proxy/proxy.module.ts b/packages/backend/src/routing/proxy/proxy.module.ts
index c801ba4e..73dcab79 100644
--- a/packages/backend/src/routing/proxy/proxy.module.ts
+++ b/packages/backend/src/routing/proxy/proxy.module.ts
@@ -12,7 +12,6 @@ import { OAuthModule } from '../oauth/oauth.module';
 import { ResolveModule } from '../resolve/resolve.module';
 import { CustomProviderModule } from '../custom-provider/custom-provider.module';
 import { HeaderTiersModule } from '../header-tiers/header-tiers.module';
-import { BillingModule } from '../../billing/billing.module';
 import { AutofixModule } from '../autofix/autofix.module';
 import { ProxyController } from './proxy.controller';
 import { ProxyService } from './proxy.service';
@@ -42,7 +41,6 @@ import { AttemptRecordingService } from './attempt-recording.service';
     ResolveModule,
     CustomProviderModule,
     HeaderTiersModule,
-    BillingModule,
     AutofixModule,
   ],
   controllers: [ProxyController],
diff --git a/packages/backend/test/billing-request-limit.e2e-spec.ts b/packages/backend/test/billing-request-limit.e2e-spec.ts
deleted file mode 100644
index 299e77cc..00000000
--- a/packages/backend/test/billing-request-limit.e2e-spec.ts
+++ /dev/null
@@ -1,249 +0,0 @@
-import { INestApplication } from '@nestjs/common';
-import { DataSource } from 'typeorm';
-import request from 'supertest';
-import { createTestApp, TEST_OTLP_KEY, TEST_USER_ID } from './helpers';
-import { PlanService } from '../src/billing/plan.service';
-import { REQUEST_USAGE_CUTOVER_STATE } from '../src/billing/request-quota-window';
-
-// Enforces the monthly routed-request cap on the /v1/* proxy. The schema-only
-// harness enables billing after app init because it does not install the Cloud
-// quota trigger. We drive the block with PLAN_LIMIT_FREE_REQUESTS=0 so the gate
-// trips before any upstream call. Env is restored in afterAll.
-let app: INestApplication;
-let ds: DataSource;
-
-const envSnapshots: Record<string, string | undefined> = {};
-const BILLING_ENV_VARS = [
-  'MANIFEST_MODE',
-  'STRIPE_SECRET_KEY',
-  'STRIPE_WEBHOOK_SECRET',
-  'STRIPE_PRO_PRICE_ID',
-  'PLAN_LIMIT_FREE_REQUESTS',
-];
-
-/** Poll a COUNT query until it reaches `minimum` (the blocked-request rows are
- *  written asynchronously, after the 402 has already been sent). Returns the
- *  last observed count either way so assertions still fail loudly on timeout. */
-async function waitForCount(sql: string, params: unknown[], minimum: number): Promise<number> {
-  const deadline = Date.now() + 1000;
-  let count = 0;
-  do {
-    const rows = await ds.query(sql, params);
-    count = rows[0].n;
-    if (count >= minimum) return count;
-    await new Promise((resolve) => setTimeout(resolve, 25));
-  } while (Date.now() < deadline);
-  return count;
-}
-
-const MANIFEST_BLOCK_COUNT_SQL = `SELECT COUNT(*)::int AS n
-     FROM requests
-    WHERE tenant_id = $1
-      AND error_origin = 'policy'
-      AND error_class = 'plan_request_limit_exceeded'
-      AND error_http_status = 402`;
-
-async function waitForManifestBlockCount(tenantId: string, minimum: number): Promise<number> {
-  return waitForCount(MANIFEST_BLOCK_COUNT_SQL, [tenantId], minimum);
-}
-
-beforeAll(async () => {
-  for (const key of BILLING_ENV_VARS) envSnapshots[key] = process.env[key];
-  process.env['MANIFEST_MODE'] = 'cloud';
-  process.env['PLAN_LIMIT_FREE_REQUESTS'] = '0';
-  delete process.env['STRIPE_SECRET_KEY'];
-  delete process.env['STRIPE_WEBHOOK_SECRET'];
-  delete process.env['STRIPE_PRO_PRICE_ID'];
-
-  app = await createTestApp();
-  ds = app.get(DataSource);
-  process.env['STRIPE_SECRET_KEY'] = 'sk_test_dummy';
-  process.env['STRIPE_WEBHOOK_SECRET'] = 'whsec_dummy';
-  process.env['STRIPE_PRO_PRICE_ID'] = 'price_dummy';
-  // better-auth's runMigrations doesn't run in the e2e harness, so create the
-  // Stripe plugin's subscription table shape ourselves (PlanService.getPlan
-  // queries it). camelCase quoted columns match the real schema.
-  await ds.query(`CREATE TABLE IF NOT EXISTS "subscription" (
-    "id" text PRIMARY KEY,
-    "plan" text NOT NULL,
-    "referenceId" text NOT NULL,
-    "stripeCustomerId" text,
-    "stripeSubscriptionId" text,
-    "status" text NOT NULL,
-    "periodStart" timestamptz,
-    "periodEnd" timestamptz,
-    "cancelAtPeriodEnd" boolean DEFAULT false
-  )`);
-  await ds.query(
-    `INSERT INTO "backfill_state" ("name", "completed_at")
-     VALUES ($1, clock_timestamp() AT TIME ZONE 'UTC')
-     ON CONFLICT ("name") DO NOTHING`,
-    [REQUEST_USAGE_CUTOVER_STATE],
-  );
-});
-
-afterAll(async () => {
-  if (ds) {
-    await ds.query(`DELETE FROM "subscription" WHERE "referenceId" = $1`, [TEST_USER_ID]);
-  }
-  for (const key of BILLING_ENV_VARS) {
-    if (envSnapshots[key] === undefined) delete process.env[key];
-    else process.env[key] = envSnapshots[key];
-  }
-  if (app) await app.close();
-});
-
-describe('request limit gate (/v1 proxy)', () => {
-  // Every case sets its own plan. A subscription row left by a killed run would
-  // otherwise turn the Free cases into Pro or fail a fixed-id INSERT.
-  beforeEach(async () => {
-    await ds.query(`DELETE FROM "subscription" WHERE "referenceId" = $1`, [TEST_USER_ID]);
-  });
-
-  it('blocks a free tenant over the monthly request cap with a real 402 for tool callers', async () => {
-    const tenantRows = await ds.query(`SELECT id FROM tenants WHERE owner_user_id = $1 LIMIT 1`, [
-      TEST_USER_ID,
-    ]);
-    const tenantId = tenantRows[0].id;
-    const blocksBefore = await ds.query(
-      `SELECT COUNT(*)::int AS n
-         FROM requests
-        WHERE tenant_id = $1
-          AND error_origin = 'policy'
-          AND error_class = 'plan_request_limit_exceeded'
-          AND error_http_status = 402`,
-      [tenantId],
-    );
-    const res = await request(app.getHttpServer())
-      .post('/v1/chat/completions')
-      .set('Authorization', `Bearer ${TEST_OTLP_KEY}`)
-      .set('Accept', 'application/json')
-      .send({ model: 'auto', messages: [{ role: 'user', content: 'hi' }] })
-      .expect(402);
-    expect(res.body.error.code).toBe('PLAN_LIMIT_REQUESTS');
-    expect(res.body.error.type).toBe('insufficient_quota');
-    expect(res.body.error.message).toContain('Upgrade to Pro');
-    expect(res.body.limit).toBe(0);
-    expect(await waitForManifestBlockCount(tenantId, blocksBefore[0].n + 1)).toBe(
-      blocksBefore[0].n + 1,
-    );
-  });
-
-  it('records the blocked request as a visible Manifest failure without counting it toward quota', async () => {
-    const tenantRows = await ds.query(`SELECT id FROM tenants WHERE owner_user_id = $1 LIMIT 1`, [
-      TEST_USER_ID,
-    ]);
-    const tenantId = tenantRows[0].id;
-    const monthStartMs = Date.UTC(new Date().getUTCFullYear(), new Date().getUTCMonth(), 1);
-    const planService = app.get(PlanService);
-    const billableBefore = await planService.countRequestsSince(tenantId, monthStartMs);
-    const before = await ds.query(`SELECT COUNT(*)::int AS n FROM requests WHERE tenant_id = $1`, [
-      tenantId,
-    ]);
-    const attemptsBefore = await ds.query(
-      `SELECT COUNT(*)::int AS n FROM agent_messages WHERE tenant_id = $1`,
-      [tenantId],
-    );
-    const manifestBlocksBefore = await ds.query(
-      `SELECT COUNT(*)::int AS n
-         FROM requests
-        WHERE tenant_id = $1
-          AND error_origin = 'policy'
-          AND error_class = 'plan_request_limit_exceeded'
-          AND error_http_status = 402`,
-      [tenantId],
-    );
-    await request(app.getHttpServer())
-      .post('/v1/chat/completions')
-      .set('Authorization', `Bearer ${TEST_OTLP_KEY}`)
-      .set('Accept', 'application/json')
-      .send({ model: 'auto', messages: [{ role: 'user', content: 'again' }] })
-      .expect(402);
-    const manifestBlocksAfter = await waitForManifestBlockCount(
-      tenantId,
-      manifestBlocksBefore[0].n + 1,
-    );
-    const after = await ds.query(`SELECT COUNT(*)::int AS n FROM requests WHERE tenant_id = $1`, [
-      tenantId,
-    ]);
-    // The attempt row is a separate asynchronous insert from the requests row
-    // the block-count wait already covered — poll it too, or a slow runner
-    // reads 1 attempt where 2 have been ordered (the CI flake this fixes).
-    const attemptsAfterN = await waitForCount(
-      `SELECT COUNT(*)::int AS n FROM agent_messages WHERE tenant_id = $1`,
-      [tenantId],
-      attemptsBefore[0].n + 1,
-    );
-    const latestBlock = await ds.query(
-      `SELECT status, error_origin, error_class, error_http_status, error_code
-         FROM requests
-        WHERE tenant_id = $1
-          AND error_origin = 'policy'
-          AND error_class = 'plan_request_limit_exceeded'
-          AND error_http_status = 402
-        ORDER BY timestamp DESC
-        LIMIT 1`,
-      [tenantId],
-    );
-    const billableAfter = await planService.countRequestsSince(tenantId, monthStartMs);
-
-    expect(after[0].n).toBe(before[0].n + 1);
-    expect(attemptsAfterN).toBe(attemptsBefore[0].n + 1);
-    expect(manifestBlocksAfter).toBe(manifestBlocksBefore[0].n + 1);
-    expect(latestBlock[0]).toEqual(
-      expect.objectContaining({
-        status: 'failed',
-        error_origin: 'policy',
-        error_class: 'plan_request_limit_exceeded',
-        error_http_status: 402,
-        error_code: 'M204',
-      }),
-    );
-    expect(billableAfter).toBe(billableBefore);
-  });
-
-  // A failed renewal leaves the subscription past_due while Stripe retries it.
-  // Showing that tenant as Free offered "Upgrade", and checkout then started a
-  // second subscription next to the one still being retried.
-  it.each([
-    ['active', 'pro'],
-    ['trialing', 'pro'],
-    ['past_due', 'pro'],
-    ['unpaid', 'free'],
-    ['canceled', 'free'],
-    ['incomplete', 'free'],
-    ['incomplete_expired', 'free'],
-  ])('resolves a %s pro subscription to the %s plan', async (status, expected) => {
-    const tenantRows = await ds.query(`SELECT id FROM tenants WHERE owner_user_id = $1 LIMIT 1`, [
-      TEST_USER_ID,
-    ]);
-    try {
-      await ds.query(
-        `INSERT INTO "subscription" ("id", "plan", "referenceId", "status") VALUES ('sub-status-e2e', 'pro', $1, $2)`,
-        [TEST_USER_ID, status],
-      );
-      const plan = await app
-        .get(PlanService)
-        .getPlan({ tenantId: tenantRows[0].id, userId: TEST_USER_ID });
-      expect(plan).toBe(expected);
-    } finally {
-      await ds.query(`DELETE FROM "subscription" WHERE "id" = 'sub-status-e2e'`);
-    }
-  });
-
-  it('allows requests once the tenant is on an active pro subscription (unlimited)', async () => {
-    await ds.query(
-      `INSERT INTO "subscription" ("id", "plan", "referenceId", "status") VALUES ('sub-req-e2e-1', 'pro', $1, 'active')`,
-      [TEST_USER_ID],
-    );
-    // Pro is unlimited, so the request-limit gate must NOT return 402. The
-    // request proceeds past the gate (it may fail downstream for lack of a real
-    // provider, but never with our PLAN_LIMIT_REQUESTS block).
-    const res = await request(app.getHttpServer())
-      .post('/v1/chat/completions')
-      .set('Authorization', `Bearer ${TEST_OTLP_KEY}`)
-      .set('Accept', 'application/json')
-      .send({ model: 'auto', messages: [{ role: 'user', content: 'pro' }] });
-    expect(res.status).not.toBe(402);
-  });
-});
diff --git a/packages/backend/test/drop-billing-schema-migration.e2e-spec.ts b/packages/backend/test/drop-billing-schema-migration.e2e-spec.ts
new file mode 100644
index 00000000..e62d9b99
--- /dev/null
+++ b/packages/backend/test/drop-billing-schema-migration.e2e-spec.ts
@@ -0,0 +1,206 @@
+import { DataSource } from 'typeorm';
+import { entities, migrations } from '../src/database/data-source-definitions';
+import { DropBillingSchema1803200000000 } from '../src/database/migrations/1803200000000-DropBillingSchema';
+import { toLocalSqlTimestamp } from '../src/common/utils/postgres-sql';
+
+const TENANT = 'billing-drop-tenant';
+const AGENT = 'billing-drop-agent';
+const TIMESTAMP = toLocalSqlTimestamp(new Date(Date.now() - 60 * 1000));
+
+interface BillingArtifacts {
+  usageTable: string | null;
+  emailLogsTable: string | null;
+  quotaFlag: boolean;
+  limitOverrides: boolean;
+  emailPreferences: boolean;
+  usageTrigger: boolean;
+  usageFunction: boolean;
+  cutoverRow: boolean;
+}
+
+async function billingArtifacts(ds: DataSource): Promise<BillingArtifacts> {
+  const rows: BillingArtifacts[] = await ds.query(`
+    SELECT
+      to_regclass('tenant_request_usage')::text AS "usageTable",
+      to_regclass('billing_email_logs')::text AS "emailLogsTable",
+      EXISTS (
+        SELECT 1 FROM information_schema.columns
+         WHERE table_name = 'requests' AND column_name = 'quota_counted'
+      ) AS "quotaFlag",
+      EXISTS (
+        SELECT 1 FROM information_schema.columns
+         WHERE table_name = 'tenants' AND column_name = 'limit_overrides'
+      ) AS "limitOverrides",
+      EXISTS (
+        SELECT 1 FROM information_schema.columns
+         WHERE table_name = 'tenants' AND column_name = 'billing_email_preferences'
+      ) AS "emailPreferences",
+      EXISTS (
+        SELECT 1 FROM pg_trigger
+         WHERE tgname = 'TRG_agent_messages_count_tenant_request_usage'
+      ) AS "usageTrigger",
+      EXISTS (
+        SELECT 1 FROM pg_proc WHERE proname = 'count_tenant_request_usage'
+      ) AS "usageFunction",
+      EXISTS (
+        SELECT 1 FROM "backfill_state" WHERE "name" = 'tenant_request_usage_cutover_v1'
+      ) AS "cutoverRow"
+  `);
+  return rows[0]!;
+}
+
+const NONE: BillingArtifacts = {
+  usageTable: null,
+  emailLogsTable: null,
+  quotaFlag: false,
+  limitOverrides: false,
+  emailPreferences: false,
+  usageTrigger: false,
+  usageFunction: false,
+  cutoverRow: false,
+};
+
+async function runDropMigration(ds: DataSource, direction: 'up' | 'down'): Promise<void> {
+  const queryRunner = ds.createQueryRunner();
+  try {
+    await new DropBillingSchema1803200000000()[direction](queryRunner);
+  } finally {
+    await queryRunner.release();
+  }
+}
+
+async function insertAttempt(ds: DataSource, id: string): Promise<void> {
+  await ds.query(
+    `INSERT INTO "requests" ("id", "tenant_id", "agent_id", "timestamp", "status")
+     VALUES ($1, $2, $3, $4, 'success')`,
+    [`${id}-request`, TENANT, AGENT, TIMESTAMP],
+  );
+  await ds.query(
+    `INSERT INTO "agent_messages" (
+       "id", "request_id", "tenant_id", "agent_id", "agent_name", "timestamp",
+       "status", "input_tokens", "output_tokens", "cache_read_tokens",
+       "cache_creation_tokens"
+     )
+     VALUES ($1, $2, $3, $4, $4, $5, 'success', 0, 0, 0, 0)`,
+    [id, `${id}-request`, TENANT, AGENT, TIMESTAMP],
+  );
+}
+
+/**
+ * Recreates the shape the old cloud-mode quota migration left behind: the
+ * counter table, the request flag, the cutover row and a trigger on
+ * agent_messages that writes into the counter table.
+ */
+async function installLegacyQuotaCounter(ds: DataSource): Promise<void> {
+  await ds.query(`
+    CREATE TABLE "tenant_request_usage" (
+      "tenant_id" varchar NOT NULL,
+      "window_start" timestamp NOT NULL,
+      "request_count" bigint NOT NULL DEFAULT 0,
+      "baseline_counted" boolean NOT NULL DEFAULT false,
+      CONSTRAINT "PK_tenant_request_usage" PRIMARY KEY ("tenant_id", "window_start")
+    )
+  `);
+  await ds.query(
+    `ALTER TABLE "requests" ADD COLUMN "quota_counted" boolean NOT NULL DEFAULT false`,
+  );
+  await ds.query(
+    `INSERT INTO "backfill_state" ("name", "completed_at")
+     VALUES ('tenant_request_usage_cutover_v1', NOW())`,
+  );
+  await ds.query(`
+    CREATE FUNCTION "count_tenant_request_usage"() RETURNS trigger
+    LANGUAGE plpgsql AS $$
+    BEGIN
+      INSERT INTO "tenant_request_usage" ("tenant_id", "window_start", "request_count")
+      VALUES (NEW.tenant_id, date_trunc('month', NEW."timestamp"), 1)
+      ON CONFLICT ("tenant_id", "window_start")
+      DO UPDATE SET "request_count" = "tenant_request_usage"."request_count" + 1;
+      RETURN NEW;
+    END;
+    $$
+  `);
+  await ds.query(`
+    CREATE TRIGGER "TRG_agent_messages_count_tenant_request_usage"
+    AFTER INSERT OR UPDATE OF "request_id" ON "agent_messages"
+    FOR EACH ROW EXECUTE FUNCTION "count_tenant_request_usage"()
+  `);
+}
+
+describe('DropBillingSchema migration (e2e)', () => {
+  let ds: DataSource;
+
+  beforeAll(async () => {
+    ds = new DataSource({
+      type: 'postgres',
+      url:
+        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase',
+      // The exact registries the deploy runner uses, not a glob.
+      entities,
+      migrations,
+      synchronize: false,
+      dropSchema: true,
+      logging: false,
+    });
+    await ds.initialize();
+    await ds.runMigrations({ transaction: 'each' });
+
+    await ds.query(`INSERT INTO "tenants" ("id", "name", "is_active") VALUES ($1, $1, true)`, [
+      TENANT,
+    ]);
+    await ds.query(
+      `INSERT INTO "agents" ("id", "tenant_id", "name", "display_name", "is_playground")
+       VALUES ($1, $2, $1, $1, false)`,
+      [AGENT, TENANT],
+    );
+  }, 120_000);
+
+  afterAll(async () => {
+    if (ds?.isInitialized) await ds.destroy();
+  });
+
+  it('leaves no billing schema on a database migrated from empty', async () => {
+    expect(await billingArtifacts(ds)).toEqual(NONE);
+    const applied: Array<{ name: string }> = await ds.query(
+      `SELECT "name" FROM "migrations" WHERE "name" = 'DropBillingSchema1803200000000'`,
+    );
+    expect(applied).toHaveLength(1);
+  });
+
+  it('reverts to the self-hosted billing schema and applies again', async () => {
+    await runDropMigration(ds, 'down');
+    expect(await billingArtifacts(ds)).toEqual({
+      ...NONE,
+      emailLogsTable: 'billing_email_logs',
+      limitOverrides: true,
+      emailPreferences: true,
+    });
+
+    await runDropMigration(ds, 'up');
+    expect(await billingArtifacts(ds)).toEqual(NONE);
+
+    // Idempotent: a second run on the cleaned schema is a no-op.
+    await runDropMigration(ds, 'up');
+    expect(await billingArtifacts(ds)).toEqual(NONE);
+  });
+
+  it('removes a legacy cloud quota counter, so attempt writes keep working', async () => {
+    await installLegacyQuotaCounter(ds);
+    await insertAttempt(ds, 'attempt-before-drop');
+    const counted: Array<{ n: string }> = await ds.query(
+      `SELECT "request_count" AS n FROM "tenant_request_usage" WHERE "tenant_id" = $1`,
+      [TENANT],
+    );
+    expect(Number(counted[0]?.n)).toBe(1);
+
+    await runDropMigration(ds, 'up');
+
+    expect(await billingArtifacts(ds)).toEqual(NONE);
+    await expect(insertAttempt(ds, 'attempt-after-drop')).resolves.toBeUndefined();
+    const attempts: Array<{ n: string }> = await ds.query(
+      `SELECT COUNT(*) AS n FROM "agent_messages" WHERE "tenant_id" = $1`,
+      [TENANT],
+    );
+    expect(Number(attempts[0]?.n)).toBe(2);
+  });
+});
diff --git a/packages/backend/test/helpers.ts b/packages/backend/test/helpers.ts
index 6f97c0a4..c79b7693 100644
--- a/packages/backend/test/helpers.ts
+++ b/packages/backend/test/helpers.ts
@@ -40,7 +40,6 @@ import { AgentEnabledProvider } from '../src/entities/agent-enabled-provider.ent
 import { BackfillState } from '../src/entities/backfill-state.entity';
 import { PublicErrorPage } from '../src/entities/public-error-page.entity';
 import { WaitlistClaim } from '../src/entities/waitlist-claim.entity';
-import { TenantRequestUsage } from '../src/entities/tenant-request-usage.entity';
 import { CliAuthCode } from '../src/entities/cli-auth-code.entity';
 import { AuthModule } from '../src/auth/auth.module';
 import { HealthModule } from '../src/health/health.module';
@@ -87,7 +86,6 @@ const entities = [
   BackfillState,
   PublicErrorPage,
   WaitlistClaim,
-  TenantRequestUsage,
   CliAuthCode,
 ];
 const OPENROUTER_MODELS_URL = 'https://openrouter.ai/api/v1/models';
diff --git a/packages/backend/test/proxy-no-plan-gate.e2e-spec.ts b/packages/backend/test/proxy-no-plan-gate.e2e-spec.ts
new file mode 100644
index 00000000..4f43f8fa
--- /dev/null
+++ b/packages/backend/test/proxy-no-plan-gate.e2e-spec.ts
@@ -0,0 +1,201 @@
+/**
+ * The proxy hot path has no plan paywall (#14). Even with the variables that
+ * used to switch the Free-plan request limit on (Stripe keys plus a zero
+ * request allowance), every request is routed to the provider, and a 402 from
+ * the provider is forwarded as a provider error, never turned into a plan
+ * block.
+ */
+import { INestApplication } from '@nestjs/common';
+import { DataSource } from 'typeorm';
+import request from 'supertest';
+import {
+  createTestApp,
+  TEST_AGENT_ID,
+  TEST_OTLP_KEY,
+  TEST_TENANT_ID,
+  TEST_USER_ID,
+} from './helpers';
+import { encrypt, getEncryptionSecret } from '../src/common/utils/crypto.util';
+import { RoutingCacheService } from '../src/routing/routing-core/routing-cache.service';
+
+const MODEL = 'gpt-4o-mini';
+const LEGACY_BILLING_ENV: Record<string, string> = {
+  STRIPE_SECRET_KEY: 'sk_test_legacy',
+  STRIPE_WEBHOOK_SECRET: 'whsec_legacy',
+  STRIPE_PRO_PRICE_ID: 'price_legacy',
+  PLAN_LIMIT_FREE_REQUESTS: '0',
+};
+
+let app: INestApplication;
+let ds: DataSource;
+let originalFetch: typeof global.fetch;
+const previousEnv: Record<string, string | undefined> = {};
+const providerCalls: string[] = [];
+let providerStatus = 200;
+
+function completion(): Record<string, unknown> {
+  return {
+    id: 'chatcmpl-mock',
+    object: 'chat.completion',
+    created: 0,
+    model: MODEL,
+    choices: [{ index: 0, message: { role: 'assistant', content: 'pong' }, finish_reason: 'stop' }],
+    usage: { prompt_tokens: 5, completion_tokens: 2, total_tokens: 7 },
+  };
+}
+
+beforeAll(async () => {
+  for (const [key, value] of Object.entries(LEGACY_BILLING_ENV)) {
+    previousEnv[key] = process.env[key];
+    process.env[key] = value;
+  }
+
+  app = await createTestApp();
+  ds = app.get(DataSource);
+
+  const now = new Date().toISOString().replace('T', ' ').replace('Z', '').slice(0, 19);
+  await ds.query(
+    `INSERT INTO tenant_providers
+       (id, tenant_id, created_by_user_id, agent_id, provider, auth_type, api_key_encrypted,
+        is_active, connected_at, updated_at, key_prefix, cached_models)
+     VALUES ($1,$2,$3,$4,'openai','api_key',$5,true,$6,$6,'sk-test',$7)`,
+    [
+      'no-gate-openai',
+      TEST_TENANT_ID,
+      TEST_USER_ID,
+      TEST_AGENT_ID,
+      encrypt('sk-test-fake-key', getEncryptionSecret()),
+      now,
+      JSON.stringify([
+        {
+          id: MODEL,
+          displayName: MODEL,
+          provider: 'openai',
+          authType: 'api_key',
+          contextWindow: 128000,
+          inputPricePerToken: 0.00000015,
+          outputPricePerToken: 0.0000006,
+          qualityScore: 3,
+        },
+      ]),
+    ],
+  );
+  await ds.query(
+    `INSERT INTO agent_enabled_providers (agent_id, tenant_provider_id) VALUES ($1, $2)`,
+    [TEST_AGENT_ID, 'no-gate-openai'],
+  );
+  await ds.query(
+    `INSERT INTO tier_assignments (id, agent_id, tier, override_route, updated_at)
+     VALUES ($1, $2, 'default', $3::jsonb, $4)
+     ON CONFLICT (agent_id, tier) DO UPDATE SET override_route = EXCLUDED.override_route`,
+    [
+      'no-gate-default',
+      TEST_AGENT_ID,
+      JSON.stringify({ provider: 'openai', authType: 'api_key', model: MODEL }),
+      now,
+    ],
+  );
+  await ds.query(`UPDATE agents SET complexity_routing_enabled = false WHERE id = $1`, [
+    TEST_AGENT_ID,
+  ]);
+
+  originalFetch = global.fetch;
+  global.fetch = (async (input, init) => {
+    const url =
+      typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
+    let hostname = '';
+    try {
+      hostname = new URL(url).hostname;
+    } catch {
+      // Non-absolute URL: fall through to the real fetch.
+    }
+    if (hostname === 'api.openai.com') {
+      providerCalls.push(url);
+      const body =
+        providerStatus === 200
+          ? completion()
+          : { error: { message: 'insufficient credit', type: 'insufficient_quota' } };
+      return new Response(JSON.stringify(body), {
+        status: providerStatus,
+        headers: { 'content-type': 'application/json' },
+      });
+    }
+    return originalFetch(input, init);
+  }) as typeof fetch;
+}, 60_000);
+
+afterAll(async () => {
+  if (originalFetch) global.fetch = originalFetch;
+  if (app) await app.close();
+  for (const [key, value] of Object.entries(previousEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+beforeEach(async () => {
+  providerStatus = 200;
+  providerCalls.length = 0;
+  await ds.query(`DELETE FROM agent_messages WHERE agent_id = $1`, [TEST_AGENT_ID]);
+  app.get(RoutingCacheService).invalidateAgent(TEST_AGENT_ID);
+});
+
+async function waitForAttempts(min: number): Promise<Array<Record<string, unknown>>> {
+  const deadline = Date.now() + 10_000;
+  let rows: Array<Record<string, unknown>> = [];
+  do {
+    rows = await ds.query(
+      `SELECT status, error_http_status, routing_reason, error_class, error_code
+         FROM agent_messages
+        WHERE agent_id = $1 AND status <> 'pending'`,
+      [TEST_AGENT_ID],
+    );
+    if (rows.length >= min) return rows;
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  } while (Date.now() < deadline);
+  return rows;
+}
+
+describe('Proxy without a plan paywall (e2e)', () => {
+  it('routes every request to the provider despite the legacy billing variables', async () => {
+    for (let i = 0; i < 3; i++) {
+      const res = await request(app.getHttpServer())
+        .post('/v1/chat/completions')
+        .set('Authorization', `Bearer ${TEST_OTLP_KEY}`)
+        .send({ messages: [{ role: 'user', content: `hello ${i}` }] })
+        .expect(200);
+
+      expect(res.body.choices[0].message.content).toBe('pong');
+      expect(res.headers['x-manifest-model']).toBe(MODEL);
+    }
+
+    expect(providerCalls).toHaveLength(3);
+    const rows = await waitForAttempts(3);
+    expect(rows.filter((row) => row.status === 'success')).toHaveLength(3);
+    for (const row of rows) {
+      expect(row.routing_reason).not.toBe('plan_request_limit_exceeded');
+      expect(row.error_code).toBeNull();
+    }
+  });
+
+  it('forwards a provider 402 as a provider error, not as a plan block', async () => {
+    providerStatus = 402;
+
+    const res = await request(app.getHttpServer())
+      .post('/v1/chat/completions')
+      .set('Authorization', `Bearer ${TEST_OTLP_KEY}`)
+      .send({ messages: [{ role: 'user', content: 'hello' }] })
+      .expect(402);
+
+    expect(providerCalls).toHaveLength(1);
+    expect(res.body.error.source).toBe('provider');
+    expect(res.body.error.code).not.toBe('PLAN_LIMIT_REQUESTS');
+    expect(JSON.stringify(res.body)).not.toMatch(/upgrade|M204/i);
+
+    const rows = await waitForAttempts(1);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]).toMatchObject({ error_http_status: 402 });
+    expect(rows[0]!.routing_reason).not.toBe('plan_request_limit_exceeded');
+    expect(rows[0]!.error_code).not.toBe('M204');
+  });
+});
diff --git a/packages/backend/test/tenant-request-usage-migration.e2e-spec.ts b/packages/backend/test/tenant-request-usage-migration.e2e-spec.ts
deleted file mode 100644
index 1cd38017..00000000
--- a/packages/backend/test/tenant-request-usage-migration.e2e-spec.ts
+++ /dev/null
@@ -1,420 +0,0 @@
-import { DataSource } from 'typeorm';
-import { AddTenantRequestUsage1801300000000 } from '../src/database/migrations/1801300000000-AddTenantRequestUsage';
-import { PlanService } from '../src/billing/plan.service';
-import { REQUEST_QUOTA_RESET_AT_ENV } from '../src/billing/request-quota-window';
-import { toLocalSqlTimestamp, toSqlTimestamp } from '../src/common/utils/postgres-sql';
-
-const TENANT = 'usage-tenant';
-const AGENT = 'usage-agent';
-const PLAYGROUND = 'usage-playground';
-
-// A tenant's quota window is `GREATEST(date_trunc('month', row_timestamp),
-// PLAN_REQUEST_QUOTA_RESET_AT)` — see the trigger in the migration and
-// `requestQuotaWindowStartMs()`. The shipped reset default (2026-07-09) only
-// *is* that window while the clock sits inside July 2026: from 2026-08-01 on,
-// the trigger buckets live rows into the calendar-month window while a fixture
-// pinned to the reset instant keeps reading the July row, so every "live"
-// assertion silently saw only the historical baseline. Anchor the whole fixture
-// to a reset instant inside the current window instead, so these tests pin the
-// counter's behaviour rather than the month they were written in.
-const NOW_MS = Date.now();
-const NOW = new Date(NOW_MS);
-const MONTH_START_MS = Date.UTC(NOW.getUTCFullYear(), NOW.getUTCMonth(), 1);
-// Clamped to the month start so the reset never precedes the calendar window it
-// is meant to dominate (otherwise `GREATEST` would pick the month start back).
-const RESET_AT_MS = Math.max(NOW_MS - 2 * 60 * 60 * 1000, MONTH_START_MS);
-const WINDOW_START = toSqlTimestamp(new Date(RESET_AT_MS));
-// Historical fixture rows: inside the quota window, before the cutover the
-// migration stamps with `clock_timestamp()` when it runs.
-const REQUEST_TIMESTAMP = toLocalSqlTimestamp(new Date((RESET_AT_MS + NOW_MS) / 2));
-let afterCutoverTimestamp: string;
-let futureTimestamp: string;
-let futureWindow: string;
-
-async function runMigration(
-  ds: DataSource,
-  direction: 'up' | 'down',
-  migration = new AddTenantRequestUsage1801300000000(),
-): Promise<void> {
-  const queryRunner = ds.createQueryRunner();
-  try {
-    await migration[direction](queryRunner);
-  } finally {
-    await queryRunner.release();
-  }
-}
-
-async function insertRequest(
-  ds: DataSource,
-  id: string,
-  agentId = AGENT,
-  timestamp = REQUEST_TIMESTAMP,
-): Promise<void> {
-  await ds.query(
-    `INSERT INTO "requests" ("id", "tenant_id", "agent_id", "timestamp", "status")
-     VALUES ($1, $2, $3, $4, 'success')`,
-    [id, TENANT, agentId, timestamp],
-  );
-}
-
-async function insertAttempt(
-  ds: DataSource,
-  id: string,
-  opts: {
-    requestId?: string | null;
-    agentId?: string;
-    timestamp?: string;
-    superseded?: boolean;
-    errorOrigin?: string | null;
-  } = {},
-): Promise<void> {
-  await ds.query(
-    `INSERT INTO "agent_messages" (
-       "id", "request_id", "tenant_id", "agent_id", "agent_name", "timestamp",
-       "status", "input_tokens", "output_tokens", "cache_read_tokens",
-       "cache_creation_tokens", "superseded", "error_origin"
-     )
-     VALUES ($1, $2, $3, $4, $4, $5, 'success', 0, 0, 0, 0, $6, $7)`,
-    [
-      id,
-      opts.requestId ?? null,
-      TENANT,
-      opts.agentId ?? AGENT,
-      opts.timestamp ?? REQUEST_TIMESTAMP,
-      opts.superseded ?? false,
-      opts.errorOrigin ?? null,
-    ],
-  );
-}
-
-async function usageRow(
-  ds: DataSource,
-  windowStart = WINDOW_START,
-): Promise<{ count: number; initialized: boolean } | null> {
-  const rows: Array<{ request_count: string; baseline_counted: boolean }> = await ds.query(
-    `SELECT "request_count", "baseline_counted"
-       FROM "tenant_request_usage"
-      WHERE "tenant_id" = $1
-        AND "window_start" = $2`,
-    [TENANT, windowStart],
-  );
-  if (!rows[0]) return null;
-  return {
-    count: Number(rows[0].request_count),
-    initialized: rows[0].baseline_counted,
-  };
-}
-
-describe('AddTenantRequestUsage migration (e2e)', () => {
-  let ds: DataSource;
-  let originalManifestMode: string | undefined;
-  let originalQuotaResetAt: string | undefined;
-
-  beforeAll(async () => {
-    originalManifestMode = process.env['MANIFEST_MODE'];
-    process.env['MANIFEST_MODE'] = 'cloud';
-    // Must be set before the migration runs: `up()` reads it to build the
-    // trigger's window expression.
-    originalQuotaResetAt = process.env[REQUEST_QUOTA_RESET_AT_ENV];
-    process.env[REQUEST_QUOTA_RESET_AT_ENV] = new Date(RESET_AT_MS).toISOString();
-    ds = new DataSource({
-      type: 'postgres',
-      url:
-        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase',
-      entities: ['src/entities/!(*.spec).ts'],
-      migrations: ['src/database/migrations/!(*.spec).ts'],
-      synchronize: false,
-      dropSchema: true,
-      logging: false,
-    });
-    await ds.initialize();
-    await ds.runMigrations({ transaction: 'each' });
-    await runMigration(ds, 'down');
-
-    await ds.query(`INSERT INTO "tenants" ("id", "name", "is_active") VALUES ($1, $1, true)`, [
-      TENANT,
-    ]);
-    await ds.query(
-      `INSERT INTO "agents" ("id", "tenant_id", "name", "display_name", "is_playground")
-       VALUES ($1, $3, $1, $1, false), ($2, $3, $2, $2, true)`,
-      [AGENT, PLAYGROUND, TENANT],
-    );
-
-    await insertRequest(ds, 'seed-linked');
-    await insertAttempt(ds, 'seed-linked-attempt', { requestId: 'seed-linked' });
-
-    await insertRequest(ds, 'seed-playground', PLAYGROUND);
-    await insertAttempt(ds, 'seed-playground-attempt', {
-      requestId: 'seed-playground',
-      agentId: PLAYGROUND,
-    });
-
-    await insertRequest(ds, 'seed-zero-attempt');
-    await insertAttempt(ds, 'seed-legacy');
-    await insertAttempt(ds, 'seed-legacy-superseded', { superseded: true });
-    await insertAttempt(ds, 'seed-manifest-rejection', { errorOrigin: 'policy' });
-
-    await runMigration(ds, 'up');
-    const cutoverTimes = await ds.query(
-      `SELECT
-         to_char(
-           (
-             ("completed_at" + interval '1 minute') AT TIME ZONE 'UTC'
-           ) AT TIME ZONE $1::text,
-           'YYYY-MM-DD HH24:MI:SS'
-         ) AS "afterCutover",
-         to_char(
-           (
-             (
-               date_trunc('month', "completed_at") + interval '1 month 12 hours'
-             ) AT TIME ZONE 'UTC'
-           ) AT TIME ZONE $1::text,
-           'YYYY-MM-DD HH24:MI:SS'
-         ) AS "futureTimestamp",
-         to_char(
-           date_trunc('month', "completed_at") + interval '1 month',
-           'YYYY-MM-DD HH24:MI:SS'
-         ) AS "futureWindow"
-       FROM "backfill_state"
-      WHERE "name" = 'tenant_request_usage_cutover_v1'`,
-      [Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC'],
-    );
-    afterCutoverTimestamp = cutoverTimes[0].afterCutover;
-    futureTimestamp = cutoverTimes[0].futureTimestamp;
-    futureWindow = cutoverTimes[0].futureWindow;
-  }, 60_000);
-
-  afterAll(async () => {
-    if (ds?.isInitialized) await ds.destroy();
-    if (originalManifestMode === undefined) {
-      delete process.env['MANIFEST_MODE'];
-    } else {
-      process.env['MANIFEST_MODE'] = originalManifestMode;
-    }
-    if (originalQuotaResetAt === undefined) {
-      delete process.env[REQUEST_QUOTA_RESET_AT_ENV];
-    } else {
-      process.env[REQUEST_QUOTA_RESET_AT_ENV] = originalQuotaResetAt;
-    }
-  });
-
-  it('publishes only schema and cutover metadata during migration', async () => {
-    expect(await usageRow(ds)).toBeNull();
-
-    const requests = await ds.query(
-      `SELECT "id", "quota_counted"
-         FROM "requests"
-        WHERE "id" LIKE 'seed-%'
-     ORDER BY "id"`,
-    );
-    expect(requests).toEqual([
-      { id: 'seed-linked', quota_counted: false },
-      { id: 'seed-playground', quota_counted: false },
-      { id: 'seed-zero-attempt', quota_counted: false },
-    ]);
-
-    const legacyColumn = await ds.query(
-      `SELECT 1
-         FROM information_schema.columns
-        WHERE table_name = 'agent_messages'
-          AND column_name = 'legacy_quota_counted'`,
-    );
-    expect(legacyColumn).toEqual([]);
-  });
-
-  it('accepts the installed trigger timezone at Cloud boot', async () => {
-    const previousStripeEnv = {
-      secret: process.env['STRIPE_SECRET_KEY'],
-      webhook: process.env['STRIPE_WEBHOOK_SECRET'],
-      price: process.env['STRIPE_PRO_PRICE_ID'],
-    };
-    process.env['STRIPE_SECRET_KEY'] = 'sk_test_x';
-    process.env['STRIPE_WEBHOOK_SECRET'] = 'whsec_x';
-    process.env['STRIPE_PRO_PRICE_ID'] = 'price_x';
-    try {
-      await expect(new PlanService({} as never, ds).onModuleInit()).resolves.toBeUndefined();
-    } finally {
-      if (previousStripeEnv.secret === undefined) delete process.env['STRIPE_SECRET_KEY'];
-      else process.env['STRIPE_SECRET_KEY'] = previousStripeEnv.secret;
-      if (previousStripeEnv.webhook === undefined) delete process.env['STRIPE_WEBHOOK_SECRET'];
-      else process.env['STRIPE_WEBHOOK_SECRET'] = previousStripeEnv.webhook;
-      if (previousStripeEnv.price === undefined) delete process.env['STRIPE_PRO_PRICE_ID'];
-      else process.env['STRIPE_PRO_PRICE_ID'] = previousStripeEnv.price;
-    }
-  });
-
-  it('initializes the exact historical baseline once in the background', async () => {
-    const planService = new PlanService({} as never, ds);
-
-    // The hot path returns the live counter immediately (no row yet → 0) and
-    // schedules the one-shot historical baseline off the request path.
-    expect(await planService.countRequestsSince(TENANT, MONTH_START_MS)).toBe(0);
-
-    // The background init lands the exact baseline and flips the flag.
-    const deadline = Date.now() + 10_000;
-    let row = await usageRow(ds);
-    while (!row?.initialized && Date.now() < deadline) {
-      await new Promise((resolve) => setTimeout(resolve, 50));
-      row = await usageRow(ds);
-    }
-    expect(row).toEqual({ count: 2, initialized: true });
-
-    // Steady state: subsequent reads serve the initialized counter directly.
-    expect(await planService.countRequestsSince(TENANT, MONTH_START_MS)).toBe(2);
-    expect(await usageRow(ds)).toEqual({ count: 2, initialized: true });
-  });
-
-  it('counts each live Request once and keeps exclusions out', async () => {
-    await insertRequest(ds, 'live-request', AGENT, afterCutoverTimestamp);
-    await insertAttempt(ds, 'live-attempt-1', {
-      requestId: 'live-request',
-      timestamp: afterCutoverTimestamp,
-    });
-    await insertAttempt(ds, 'live-attempt-2', {
-      requestId: 'live-request',
-      timestamp: afterCutoverTimestamp,
-    });
-    expect(await usageRow(ds)).toEqual({ count: 3, initialized: true });
-
-    await insertRequest(ds, 'live-playground', PLAYGROUND, afterCutoverTimestamp);
-    await insertAttempt(ds, 'live-playground-attempt', {
-      requestId: 'live-playground',
-      agentId: PLAYGROUND,
-      timestamp: afterCutoverTimestamp,
-    });
-    await insertRequest(ds, 'live-manifest-rejection', AGENT, afterCutoverTimestamp);
-    await insertAttempt(ds, 'live-manifest-rejection-attempt', {
-      requestId: 'live-manifest-rejection',
-      timestamp: afterCutoverTimestamp,
-      errorOrigin: 'policy',
-    });
-
-    expect(await usageRow(ds)).toEqual({ count: 3, initialized: true });
-  });
-
-  it('does not double-count historical attempts that are linked or retried after cutover', async () => {
-    await insertRequest(ds, 'legacy-parent');
-    await ds.query(
-      `UPDATE "agent_messages"
-          SET "request_id" = $1, "attempt_number" = 1
-        WHERE "id" = 'seed-legacy'`,
-      ['legacy-parent'],
-    );
-
-    await insertAttempt(ds, 'seed-linked-post-cutover-fallback', {
-      requestId: 'seed-linked',
-      timestamp: afterCutoverTimestamp,
-    });
-    expect(await usageRow(ds)).toEqual({ count: 3, initialized: true });
-
-    const historicalRequests = await ds.query(
-      `SELECT "id", "quota_counted"
-         FROM "requests"
-        WHERE "id" IN ('legacy-parent', 'seed-linked')
-     ORDER BY "id"`,
-    );
-    expect(historicalRequests).toEqual([
-      { id: 'legacy-parent', quota_counted: false },
-      { id: 'seed-linked', quota_counted: true },
-    ]);
-  });
-
-  it('counts a post-cutover unlinked attempt when the request backfill links it', async () => {
-    await insertRequest(ds, 'live-link-parent', AGENT, afterCutoverTimestamp);
-    await insertAttempt(ds, 'live-link-attempt', { timestamp: afterCutoverTimestamp });
-    await ds.query(
-      `UPDATE "agent_messages"
-          SET "request_id" = $1, "attempt_number" = 1
-        WHERE "id" = 'live-link-attempt'`,
-      ['live-link-parent'],
-    );
-
-    expect(await usageRow(ds)).toEqual({ count: 4, initialized: true });
-  });
-
-  it('creates future quota windows fully initialized without a historical scan', async () => {
-    await insertRequest(ds, 'future-request', AGENT, futureTimestamp);
-    await insertAttempt(ds, 'future-attempt', {
-      requestId: 'future-request',
-      timestamp: futureTimestamp,
-    });
-
-    expect(await usageRow(ds, futureWindow)).toEqual({ count: 1, initialized: true });
-  });
-
-  it('fails within the lock timeout instead of queueing a busy deployment', async () => {
-    const blocker = ds.createQueryRunner();
-    await blocker.connect();
-    await blocker.startTransaction();
-    try {
-      await blocker.query(`LOCK TABLE "requests" IN ACCESS SHARE MODE`);
-      const startedAt = Date.now();
-
-      await expect(runMigration(ds, 'up')).rejects.toMatchObject({ code: '55P03' });
-
-      const elapsedMs = Date.now() - startedAt;
-      expect(elapsedMs).toBeGreaterThanOrEqual(900);
-      expect(elapsedMs).toBeLessThan(3_000);
-    } finally {
-      await blocker.rollbackTransaction();
-      await blocker.release();
-    }
-  });
-});
-
-describe('AddTenantRequestUsage self-hosted migration (e2e)', () => {
-  let ds: DataSource;
-  let originalManifestMode: string | undefined;
-
-  beforeAll(async () => {
-    originalManifestMode = process.env['MANIFEST_MODE'];
-    process.env['MANIFEST_MODE'] = 'selfhosted';
-    ds = new DataSource({
-      type: 'postgres',
-      url:
-        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase',
-      entities: ['src/entities/!(*.spec).ts'],
-      migrations: ['src/database/migrations/!(*.spec).ts'],
-      synchronize: false,
-      dropSchema: true,
-      logging: false,
-    });
-    await ds.initialize();
-    await ds.runMigrations({ transaction: 'each' });
-  }, 60_000);
-
-  afterAll(async () => {
-    if (ds?.isInitialized) await ds.destroy();
-    if (originalManifestMode === undefined) {
-      delete process.env['MANIFEST_MODE'];
-    } else {
-      process.env['MANIFEST_MODE'] = originalManifestMode;
-    }
-  });
-
-  it('does not create the Cloud quota counter schema or trigger', async () => {
-    const artifacts = await ds.query(`
-      SELECT
-        to_regclass('tenant_request_usage') AS "usageTable",
-        EXISTS (
-          SELECT 1
-            FROM information_schema.columns
-           WHERE table_name = 'requests'
-             AND column_name = 'quota_counted'
-        ) AS "requestFlag",
-        EXISTS (
-          SELECT 1
-            FROM pg_trigger
-           WHERE tgname = 'TRG_agent_messages_count_tenant_request_usage'
-        ) AS "usageTrigger"
-    `);
-
-    expect(artifacts).toEqual([
-      {
-        usageTable: null,
-        requestFlag: false,
-        usageTrigger: false,
-      },
-    ]);
-  });
-});
diff --git a/packages/shared/__tests__/plan-limits.spec.ts b/packages/shared/__tests__/plan-limits.spec.ts
deleted file mode 100644
index 3db34770..00000000
--- a/packages/shared/__tests__/plan-limits.spec.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import {
-  FREE_PLAN_REQUESTS_PER_MONTH,
-  PLANS,
-  PLAN_LIMITS,
-  UNLIMITED_PLAN_LIMITS,
-} from '../src/plan-limits';
-
-describe('plan-limits', () => {
-  it('defines limits for every plan', () => {
-    for (const plan of PLANS) {
-      expect(PLAN_LIMITS[plan]).toBeDefined();
-    }
-  });
-
-  it('pins the launch values', () => {
-    expect(FREE_PLAN_REQUESTS_PER_MONTH).toBe(10_000);
-    expect(PLAN_LIMITS.free).toEqual({ requestsPerMonth: FREE_PLAN_REQUESTS_PER_MONTH });
-    expect(PLAN_LIMITS.pro).toEqual({ requestsPerMonth: null });
-    expect(UNLIMITED_PLAN_LIMITS).toEqual({ requestsPerMonth: null });
-  });
-});
diff --git a/packages/shared/src/index.ts b/packages/shared/src/index.ts
index 229f523b..e2da002f 100644
--- a/packages/shared/src/index.ts
+++ b/packages/shared/src/index.ts
@@ -172,20 +172,6 @@ export type {
   PlaygroundHistoryRunSummary,
   PlaygroundHistoryRunDetail,
 } from './playground';
-export {
-  PLANS,
-  FREE_PLAN_REQUESTS_PER_MONTH,
-  PLAN_LIMITS,
-  UNLIMITED_PLAN_LIMITS,
-} from './plan-limits';
-export type {
-  BillingEmailPreferences,
-  BillingPlanStatus,
-  BillingPrice,
-  BillingStatus,
-  Plan,
-  PlanLimits,
-} from './plan-limits';
 export { AUTOFIX_STATUSES, AUTOFIX_STATUS_LABELS, deriveAutofixStatus } from './autofix-status';
 export type { AutofixStatus, AutofixStatusChainEntry, AutofixStatusRecord } from './autofix-status';
 export {
diff --git a/packages/shared/src/plan-limits.ts b/packages/shared/src/plan-limits.ts
deleted file mode 100644
index 005c3476..00000000
--- a/packages/shared/src/plan-limits.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-export const PLANS = ['free', 'pro'] as const;
-export type Plan = (typeof PLANS)[number];
-
-export interface PlanLimits {
-  /** Max routed requests per calendar month (UTC); null = unlimited. Enforced on the /v1/* proxy. */
-  requestsPerMonth: number | null;
-}
-
-export const FREE_PLAN_REQUESTS_PER_MONTH = 10_000;
-
-export const PLAN_LIMITS: Readonly<Record<Plan, PlanLimits>> = {
-  free: { requestsPerMonth: FREE_PLAN_REQUESTS_PER_MONTH },
-  // Pro is unlimited. null = unlimited, enforced the same way as the self-hosted
-  // UNLIMITED_PLAN_LIMITS.
-  pro: { requestsPerMonth: null },
-};
-
-export const UNLIMITED_PLAN_LIMITS: PlanLimits = { requestsPerMonth: null };
-
-export interface BillingPrice {
-  amount: number | null;
-  currency: string | null;
-  interval: string | null;
-}
-
-export interface BillingEmailPreferences {
-  usageAlerts: boolean;
-}
-
-/**
- * Light plan lookup for surfaces that only gate UI on the tenant's plan
- * (range locks, AuthGuard bootstrap). Deliberately excludes usage and price —
- * consumers that render those use the full {@link BillingStatus}.
- */
-export interface BillingPlanStatus {
-  enabled: boolean;
-  plan: Plan;
-}
-
-export interface BillingStatus {
-  enabled: boolean;
-  plan: Plan;
-  priceMonthly: BillingPrice;
-  emailPreferences: BillingEmailPreferences;
-  requests: { used: number | null; limit: number | null; periodEnd: string | null };
-  cancelAtPeriodEnd: boolean;
-  subscriptionPeriodEnd: string | null;
-}
diff --git a/scripts/db-footprint-bench.mjs b/scripts/db-footprint-bench.mjs
index c4fd370a..94655ae3 100644
--- a/scripts/db-footprint-bench.mjs
+++ b/scripts/db-footprint-bench.mjs
@@ -63,13 +63,6 @@ const QUERIES = [
             AND at.timestamp < date_trunc('month', now()) + interval '1 month'`,
     params: (t) => [t.tenant_id, t.agent_name],
   },
-  {
-    tag: 'HOT',
-    name: 'plan quota counter lookup',
-    sql: `SELECT request_count AS n, baseline_counted FROM tenant_request_usage
-          WHERE tenant_id = $1 AND window_start = date_trunc('month', now())`,
-    params: (t) => [t.tenant_id],
-  },
   {
     tag: 'HOT',
     name: 'attempts by request id',

From 071ae495dc9662f6bf4d40c2fc0f9b0d322d7c54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 00:00:34 -0300
Subject: [PATCH 03/17] refactor(frontend): remove phone-home and Autofix from
 the dashboard

Thinker makes no outbound calls of its own, and Autofix depended on
Manifest's hosted Phoenix service. The dashboard drops both before the
backend modules go in #16 and #17.

- Update check: VersionIndicator now only shows the build-time
  __MANIFEST_VERSION__ badge. It makes no request, shows no "new version"
  link to the manifest.build changelog and has no dismiss state.
  services/api/version.ts and its test are gone.
- Discovery: delete the post-signup questionnaire (page, service, styles,
  route, tests) and the pending-discovery redirects in AuthGuard and
  GuestGuard. First-admin setup now lands on / (Overview), signup on
  /welcome, and social signup also goes to /welcome. A leftover
  manifest_discovery_pending_* key from an older build no longer
  redirects anyone.
- Wingman: delete the dev drawer, wingman-dev-proxy.ts, the
  VITE_WINGMAN_* / __WINGMAN_URL__ / __DEV_MODE__ build constants, the
  App and Welcome mounts, the drawer CSS and the CONTRIBUTING section.
- Autofix: delete AutofixKpiCards, SettingsAutofixSection,
  NotificationBell (it only nagged about inactive Autofix), the Autofix
  switch and Manifest Terms/Privacy line on harness creation (modal and
  Welcome), the autofix badges, trigger filter, Phoenix panels, sibling
  links and status labels in the Requests views, the "Autofixed attempts"
  connection card, the Doctor tooltip variant, the healed chart series,
  the autofix fields in services/api/*, the two public PNGs, and the
  dead CSS.
- The generic reliability metrics that the backend still serves under
  the legacy /overview/autofix-* paths (success rate, fallback
  recoveries, request status over time, per harness/provider/model
  reliability) stay. They are now read through neutral clients
  (getReliabilityStats, getRequestStatusTimeseries, RELIABILITY_PATHS)
  and shown by ReliabilityKpiCards. "Self-healed" becomes "Recovered" and
  counts fallback recoveries only.
- Update the tests, the design-system registry and the inherited dev
  guide.

Closes #13

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CONTRIBUTING.md                               |  16 -
 design-system/registry/components.json        | 337 +++--------
 design-system/registry/llms.txt               |  98 ++--
 docs/dev/manifest-guide.md                    |  13 +-
 .../frontend/public/autofix-icon-email.png    | Bin 5673 -> 0 bytes
 .../public/banner-autofix-gradient.png        | Bin 74389 -> 0 bytes
 packages/frontend/src/App.tsx                 |  15 -
 .../frontend/src/components/AddAgentModal.tsx |  56 +-
 .../frontend/src/components/AuthGuard.tsx     |  23 +-
 .../src/components/ChartHoverTooltip.tsx      |   2 +-
 .../src/components/CostByModelTable.tsx       |   6 +-
 .../frontend/src/components/GuestGuard.tsx    |   9 -
 packages/frontend/src/components/Header.tsx   |   2 -
 .../src/components/MessageDetails.tsx         | 400 ++-----------
 .../frontend/src/components/MessageTable.tsx  |   7 +-
 .../src/components/NotificationBell.tsx       | 192 ------
 .../src/components/ProviderChartCard.tsx      |   2 +-
 .../src/components/ReliabilityChart.tsx       |  31 +-
 ...ixKpiCards.tsx => ReliabilityKpiCards.tsx} |  64 +-
 .../frontend/src/components/RequestDrawer.tsx | 175 +-----
 .../src/components/UnifiedChartCard.tsx       |  36 +-
 .../src/components/VersionIndicator.tsx       |  76 +--
 .../src/components/WingmanDevTools.tsx        | 214 -------
 .../src/components/message-table-cells.tsx    |  58 +-
 .../src/components/message-table-types.ts     |   8 +-
 packages/frontend/src/index.tsx               |   9 -
 packages/frontend/src/pages/Discovery.tsx     | 188 ------
 .../frontend/src/pages/GlobalOverview.tsx     |  69 +--
 packages/frontend/src/pages/MessageLog.tsx    |  57 +-
 packages/frontend/src/pages/Overview.tsx      |  59 +-
 packages/frontend/src/pages/Register.tsx      |  12 +-
 packages/frontend/src/pages/Settings.tsx      |   4 -
 .../src/pages/SettingsAutofixSection.tsx      | 104 ----
 packages/frontend/src/pages/Setup.tsx         |  16 +-
 packages/frontend/src/pages/Welcome.tsx       |  78 +--
 .../src/pages/providers/ConnectionDetail.tsx  |  30 +-
 .../providers/ProviderConnectionsPage.tsx     |   6 +-
 packages/frontend/src/services/api.ts         |   1 -
 packages/frontend/src/services/api/agents.ts  |   1 -
 .../frontend/src/services/api/analytics.ts    | 123 ++--
 .../frontend/src/services/api/messages.ts     |  33 --
 packages/frontend/src/services/api/routing.ts |  20 -
 packages/frontend/src/services/api/version.ts |  22 -
 packages/frontend/src/services/discovery.ts   | 139 -----
 packages/frontend/src/services/formatters.ts  |   1 -
 packages/frontend/src/styles/agents.css       |  21 +-
 .../src/styles/analytics-overview.css         |  38 +-
 packages/frontend/src/styles/cards.css        |  23 -
 packages/frontend/src/styles/controls.css     | 187 ------
 packages/frontend/src/styles/data.css         | 232 ++------
 packages/frontend/src/styles/discovery.css    | 108 ----
 packages/frontend/src/styles/modals.css       |  83 ---
 .../src/styles/notifications-bell.css         |  92 ---
 packages/frontend/src/styles/params-card.css  |   2 +-
 .../frontend/src/styles/request-drawer.css    |  10 +-
 packages/frontend/src/styles/theme.css        |   4 +-
 .../frontend/src/styles/version-indicator.css |  57 --
 packages/frontend/src/styles/welcome.css      |  70 +--
 packages/frontend/src/vite-env.d.ts           |   2 -
 .../tests/components/AddAgentModal.test.tsx   |  37 +-
 .../AnalyticsChartSurfaces.test.tsx           | 102 ++--
 .../tests/components/AuthGuard.test.tsx       |  24 +-
 .../components/CostByModelTable.test.tsx      |  27 +-
 .../ErrorClassCard.preserved.test.tsx         |  11 +-
 .../tests/components/GuestGuard.test.tsx      |  23 +-
 .../frontend/tests/components/Header.test.tsx |   4 -
 .../MessageDetails.autofix.test.tsx           | 546 ------------------
 .../tests/components/MessageDetails.test.tsx  |  64 +-
 .../MessageTable.onOpenMessage.test.tsx       | 169 ------
 .../tests/components/MessageTable.test.tsx    |  64 +-
 .../components/NotificationBell.test.tsx      | 182 ------
 .../tests/components/RequestDrawer.test.tsx   |  40 +-
 .../tests/components/SocialButtons.test.tsx   |   4 +-
 .../components/VersionIndicator.test.tsx      | 145 +----
 .../tests/components/WingmanDevTools.test.tsx | 194 -------
 .../components/message-table-cells.test.tsx   |  50 +-
 .../frontend/tests/pages/Discovery.test.tsx   | 220 -------
 .../tests/pages/GlobalOverviewFilter.test.tsx |  22 +-
 .../frontend/tests/pages/MessageLog.test.tsx  |  25 +-
 .../tests/pages/Overview-limits.test.tsx      |  19 +-
 .../frontend/tests/pages/Overview.test.tsx    |  53 +-
 .../pages/ProviderOverviewPages.test.tsx      |  77 +--
 .../tests/pages/ProviderPages.test.tsx        |   8 +-
 .../frontend/tests/pages/Register.test.tsx    |  18 +-
 .../frontend/tests/pages/Routing.test.tsx     |   4 -
 .../frontend/tests/pages/Settings.test.tsx    |  10 +-
 .../pages/SettingsAutofixSection.test.tsx     | 265 ---------
 packages/frontend/tests/pages/Setup.test.tsx  |  16 +-
 .../tests/pages/Workspace-validation.test.tsx |  15 -
 .../frontend/tests/pages/Workspace.test.tsx   |   9 -
 .../tests/services/api/analytics.test.ts      |  40 +-
 .../tests/services/api/routing-extra.test.ts  |  22 -
 .../frontend/tests/services/discovery.test.ts | 183 ------
 .../tests/services/version-api.test.ts        |  52 --
 .../frontend/tests/wingman-dev-proxy.test.ts  |  42 --
 packages/frontend/vite.config.ts              |  50 +-
 packages/frontend/wingman-dev-proxy.ts        | 104 ----
 97 files changed, 762 insertions(+), 5919 deletions(-)
 delete mode 100644 packages/frontend/public/autofix-icon-email.png
 delete mode 100644 packages/frontend/public/banner-autofix-gradient.png
 delete mode 100644 packages/frontend/src/components/NotificationBell.tsx
 rename packages/frontend/src/components/{AutofixKpiCards.tsx => ReliabilityKpiCards.tsx} (72%)
 delete mode 100644 packages/frontend/src/components/WingmanDevTools.tsx
 delete mode 100644 packages/frontend/src/pages/Discovery.tsx
 delete mode 100644 packages/frontend/src/pages/SettingsAutofixSection.tsx
 delete mode 100644 packages/frontend/src/services/api/version.ts
 delete mode 100644 packages/frontend/src/services/discovery.ts
 delete mode 100644 packages/frontend/src/styles/discovery.css
 delete mode 100644 packages/frontend/src/styles/notifications-bell.css
 delete mode 100644 packages/frontend/tests/components/MessageDetails.autofix.test.tsx
 delete mode 100644 packages/frontend/tests/components/MessageTable.onOpenMessage.test.tsx
 delete mode 100644 packages/frontend/tests/components/NotificationBell.test.tsx
 delete mode 100644 packages/frontend/tests/components/WingmanDevTools.test.tsx
 delete mode 100644 packages/frontend/tests/pages/Discovery.test.tsx
 delete mode 100644 packages/frontend/tests/pages/SettingsAutofixSection.test.tsx
 delete mode 100644 packages/frontend/tests/services/discovery.test.ts
 delete mode 100644 packages/frontend/tests/services/version-api.test.ts
 delete mode 100644 packages/frontend/tests/wingman-dev-proxy.test.ts
 delete mode 100644 packages/frontend/wingman-dev-proxy.ts

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d5762ad9..b4bb3c0b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -32,14 +32,6 @@ packages/
 └── frontend/             # SolidJS single-page app (Vite, uPlot)
 ```
 
-> The Wingman gateway tester now lives in its own repository at
-> [`mnfst/wingman`](https://github.com/mnfst/wingman) and is hosted at
-> [`wingman.manifest.build`](https://wingman.manifest.build). The dashboard
-> embeds it as an iframe drawer **in dev mode only** — it is dead-code-
-> eliminated from production / self-hosted bundles. To run Wingman
-> locally instead of the hosted SPA, clone that repo and set
-> `VITE_WINGMAN_URL=http://localhost:3002` when building the frontend.
-
 Self-hosting is supported via the [Docker image](https://hub.docker.com/r/manifestdotbuild/manifest).
 
 ## Getting Started
@@ -148,14 +140,6 @@ The backend runs standalone and OpenClaw talks to it as a regular OpenAI-compati
 - Debugging the proxy or message ingestion
 - Working on the dashboard UI with live data
 
-## Wingman — gateway tester (dev only)
-
-**Wingman** is an in-browser playground for sending one-shot requests at the gateway while impersonating any of the agents/SDKs Manifest tracks (OpenClaw, Hermes, OpenAI SDK, Vercel AI SDK, LangChain, cURL, Raw). It lives in its own repo at [`mnfst/wingman`](https://github.com/mnfst/wingman) and is hosted at [`wingman.manifest.build`](https://wingman.manifest.build). The dashboard embeds it as an iframe drawer (FAB at bottom-right, or `⌘/Ctrl + Shift + W`) **only in dev mode** — it is dead-code-eliminated from production / self-hosted bundles via the `__DEV_MODE__` build constant in `packages/frontend/vite.config.ts`.
-
-Pick a profile, type a message, see the request and response side by side with the assistant's text, status pill, latency, tokens, and full headers/body dumps. Each send is saved to a localStorage history sidebar so you can compare runs and replay any of them.
-
-The hosted SPA is a static bundle with no first-party backend. Your API key is sent directly from the browser to whatever Manifest backend you configure as the base URL (the same endpoint the key is already used against); nothing is proxied through wingman.manifest.build. To point the drawer at a locally-running Wingman build instead, set `VITE_WINGMAN_URL=http://localhost:3002` when building the frontend, and run Wingman from the `mnfst/wingman` repo.
-
 ## Available Scripts
 
 | Command                                         | Description                                                |
diff --git a/design-system/registry/components.json b/design-system/registry/components.json
index 24652e0b..061af1bc 100644
--- a/design-system/registry/components.json
+++ b/design-system/registry/components.json
@@ -355,14 +355,6 @@
         "theme.css"
       ]
     },
-    "add-agent-legal": {
-      "classes": [
-        "add-agent-legal"
-      ],
-      "files": [
-        "modals.css"
-      ]
-    },
     "add-agent-toggles": {
       "classes": [
         "add-agent-toggles",
@@ -598,8 +590,7 @@
         "auth-form__success"
       ],
       "files": [
-        "auth.css",
-        "discovery.css"
+        "auth.css"
       ]
     },
     "auth-header": {
@@ -669,55 +660,6 @@
         "auth.css"
       ]
     },
-    "autofix-card": {
-      "classes": [
-        "autofix-card",
-        "autofix-card--autofix",
-        "autofix-card--fallback",
-        "autofix-card__branding",
-        "autofix-card__header",
-        "autofix-card__ids",
-        "autofix-card__op",
-        "autofix-card__op-desc",
-        "autofix-card__op-type",
-        "autofix-card__ops",
-        "autofix-card__phrase",
-        "autofix-card__sibling-btn",
-        "autofix-card__title"
-      ],
-      "files": [
-        "data.css"
-      ]
-    },
-    "autofix-card-row": {
-      "classes": [
-        "autofix-card-row"
-      ],
-      "files": [
-        "data.css"
-      ]
-    },
-    "autofix-consent": {
-      "classes": [
-        "autofix-consent__agent-icon",
-        "autofix-consent__agent-name",
-        "autofix-consent__agent-row",
-        "autofix-consent__agents",
-        "autofix-consent__agents-label",
-        "autofix-consent__legal"
-      ],
-      "files": [
-        "modals.css"
-      ]
-    },
-    "autofix-icon": {
-      "classes": [
-        "autofix-icon"
-      ],
-      "files": [
-        "data.css"
-      ]
-    },
     "breadcrumb": {
       "classes": [
         "breadcrumb"
@@ -1022,7 +964,6 @@
       "files": [
         "connection-detail.css",
         "custom-select.css",
-        "discovery.css",
         "routing-providers.css"
       ]
     },
@@ -1078,49 +1019,11 @@
         "overview.css"
       ]
     },
-    "discovery-actions": {
-      "classes": [
-        "discovery-actions"
-      ],
-      "files": [
-        "discovery.css"
-      ]
-    },
-    "discovery-card": {
-      "classes": [
-        "discovery-card",
-        "discovery-card__desc",
-        "discovery-card__form",
-        "discovery-card__intro",
-        "discovery-card__logo",
-        "discovery-card__title"
-      ],
-      "files": [
-        "discovery.css"
-      ]
-    },
-    "discovery-form": {
-      "classes": [
-        "discovery-form"
-      ],
-      "files": [
-        "discovery.css"
-      ]
-    },
-    "discovery-select": {
-      "classes": [
-        "discovery-select--empty"
-      ],
-      "files": [
-        "discovery.css"
-      ]
-    },
     "drawer": {
       "classes": [
         "drawer",
         "drawer--open",
         "drawer__badge",
-        "drawer__badge--autofix",
         "drawer__badge--fallback",
         "drawer__body",
         "drawer__close",
@@ -1145,7 +1048,6 @@
     "drawer-context-card": {
       "classes": [
         "drawer-context-card",
-        "drawer-context-card--autofix",
         "drawer-context-card--error",
         "drawer-context-card--fallback"
       ],
@@ -1204,33 +1106,6 @@
         "theme.css"
       ]
     },
-    "error-autofix-row": {
-      "classes": [
-        "error-autofix-row",
-        "error-autofix-row--solo",
-        "error-autofix-row--triple",
-        "error-autofix-row__arrow",
-        "error-autofix-row__arrow-down",
-        "error-autofix-row__arrow-right",
-        "error-autofix-row__autofix",
-        "error-autofix-row__autofix--autofix",
-        "error-autofix-row__autofix--fallback",
-        "error-autofix-row__autofix-btn",
-        "error-autofix-row__autofix-btn--secondary",
-        "error-autofix-row__autofix-text",
-        "error-autofix-row__autofix-title",
-        "error-autofix-row__error",
-        "error-autofix-row__error--full",
-        "error-autofix-row__meta-hint",
-        "error-autofix-row__meta-label",
-        "error-autofix-row__meta-table",
-        "error-autofix-row__meta-value",
-        "error-autofix-row__title"
-      ],
-      "files": [
-        "data.css"
-      ]
-    },
     "error-class-card": {
       "classes": [
         "error-class-card",
@@ -1247,6 +1122,29 @@
         "analytics-overview.css"
       ]
     },
+    "error-recovery-row": {
+      "classes": [
+        "error-recovery-row",
+        "error-recovery-row--solo",
+        "error-recovery-row__arrow",
+        "error-recovery-row__arrow-down",
+        "error-recovery-row__arrow-right",
+        "error-recovery-row__card",
+        "error-recovery-row__card--fallback",
+        "error-recovery-row__card-text",
+        "error-recovery-row__card-title",
+        "error-recovery-row__error",
+        "error-recovery-row__error--full",
+        "error-recovery-row__meta-hint",
+        "error-recovery-row__meta-label",
+        "error-recovery-row__meta-table",
+        "error-recovery-row__meta-value",
+        "error-recovery-row__title"
+      ],
+      "files": [
+        "data.css"
+      ]
+    },
     "expandable-card": {
       "classes": [
         "expandable-card",
@@ -1693,15 +1591,6 @@
         "syntax-highlight.css"
       ]
     },
-    "info-card": {
-      "classes": [
-        "info-card__content",
-        "info-card__text"
-      ],
-      "files": [
-        "cards.css"
-      ]
-    },
     "info-tooltip": {
       "classes": [
         "info-tooltip",
@@ -2146,14 +2035,6 @@
         "data.css"
       ]
     },
-    "msg-highlight": {
-      "classes": [
-        "msg-highlight"
-      ],
-      "files": [
-        "data.css"
-      ]
-    },
     "msg-row": {
       "classes": [
         "msg-row--clickable",
@@ -2192,22 +2073,6 @@
         "layout.css"
       ]
     },
-    "notif-dropdown": {
-      "classes": [
-        "notif-dropdown",
-        "notif-dropdown__desc",
-        "notif-dropdown__dot",
-        "notif-dropdown__dot-col",
-        "notif-dropdown__header",
-        "notif-dropdown__item",
-        "notif-dropdown__item--read",
-        "notif-dropdown__list",
-        "notif-dropdown__title"
-      ],
-      "files": [
-        "notifications-bell.css"
-      ]
-    },
     "notif-hint": {
       "classes": [
         "notif-hint"
@@ -2288,7 +2153,6 @@
     "overview-stat-card": {
       "classes": [
         "overview-stat-card",
-        "overview-stat-card--autofix",
         "overview-stat-card--destructive",
         "overview-stat-card--fallback",
         "overview-stat-card__label",
@@ -2722,11 +2586,30 @@
         "welcome.css"
       ]
     },
+    "recovery-card": {
+      "classes": [
+        "recovery-card",
+        "recovery-card--fallback",
+        "recovery-card__branding",
+        "recovery-card__phrase",
+        "recovery-card__title"
+      ],
+      "files": [
+        "data.css"
+      ]
+    },
+    "recovery-card-row": {
+      "classes": [
+        "recovery-card-row"
+      ],
+      "files": [
+        "data.css"
+      ]
+    },
     "recovery-opt-icon": {
       "classes": [
         "recovery-opt-icon",
-        "recovery-opt-icon__none",
-        "recovery-opt-icon__plus"
+        "recovery-opt-icon__none"
       ],
       "files": [
         "data.css"
@@ -3228,9 +3111,6 @@
         "settings-card",
         "settings-card--danger",
         "settings-card--disabled",
-        "settings-card--flush",
-        "settings-card--highlight",
-        "settings-card--info",
         "settings-card__body",
         "settings-card__control",
         "settings-card__control--end",
@@ -3247,14 +3127,11 @@
         "settings-card__label-desc",
         "settings-card__label-desc--meta",
         "settings-card__label-title",
-        "settings-card__legal",
         "settings-card__row"
       ],
       "files": [
         "agents.css",
-        "cards.css",
         "controls.css",
-        "modals.css",
         "notifications.css"
       ]
     },
@@ -3277,7 +3154,6 @@
       ],
       "files": [
         "agents.css",
-        "modals.css",
         "welcome.css"
       ]
     },
@@ -3561,7 +3437,6 @@
     "status-badge": {
       "classes": [
         "status-badge",
-        "status-badge--auto_fixed",
         "status-badge--error",
         "status-badge--fallback_error",
         "status-badge--neutral",
@@ -3835,10 +3710,7 @@
     },
     "version-indicator": {
       "classes": [
-        "version-indicator",
-        "version-indicator--update",
-        "version-indicator__dismiss",
-        "version-indicator__update"
+        "version-indicator"
       ],
       "files": [
         "version-indicator.css"
@@ -3872,11 +3744,6 @@
         "welcome__agent-wait",
         "welcome__agent-wait--success",
         "welcome__agent-wait-heading",
-        "welcome__autofix-details",
-        "welcome__autofix-examples",
-        "welcome__autofix-heading",
-        "welcome__autofix-how",
-        "welcome__autofix-section",
         "welcome__availability-note",
         "welcome__error",
         "welcome__eyebrow",
@@ -3895,7 +3762,6 @@
         "welcome__launch-stack--complete",
         "welcome__launch-stack-header",
         "welcome__launch-track",
-        "welcome__legal",
         "welcome__liftoff",
         "welcome__liftoff-action",
         "welcome__liftoff-beacon",
@@ -3975,32 +3841,6 @@
         "welcome.css"
       ]
     },
-    "wingman-drawer": {
-      "classes": [
-        "wingman-drawer",
-        "wingman-drawer--resizing",
-        "wingman-drawer__actions",
-        "wingman-drawer__frame",
-        "wingman-drawer__head",
-        "wingman-drawer__icon-btn",
-        "wingman-drawer__resizer",
-        "wingman-drawer__sub",
-        "wingman-drawer__title"
-      ],
-      "files": [
-        "controls.css"
-      ]
-    },
-    "wingman-fab": {
-      "classes": [
-        "wingman-fab",
-        "wingman-fab__label"
-      ],
-      "files": [
-        "controls.css",
-        "version-indicator.css"
-      ]
-    },
     "workspace-table": {
       "classes": [
         "workspace-table__actions",
@@ -4020,7 +3860,7 @@
       "prop": "color",
       "value": "hsl(var(--foreground))",
       "file": "analytics-overview.css",
-      "line": 213
+      "line": 183
     },
     {
       "selector": ".custom-select__option--top > svg",
@@ -4090,21 +3930,21 @@
       "prop": "border",
       "value": "1px solid hsl(36 80% 50% / 0.24)",
       "file": "request-drawer.css",
-      "line": 918
+      "line": 910
     },
     {
       "selector": ".request-tool",
       "prop": "border-radius",
       "value": "var(--radius-sm)",
       "file": "request-drawer.css",
-      "line": 919
+      "line": 911
     },
     {
       "selector": ".request-tool",
       "prop": "background",
       "value": "hsl(36 80% 50% / 0.04)",
       "file": "request-drawer.css",
-      "line": 920
+      "line": 912
     },
     {
       "selector": ".hljs-attr",
@@ -4314,28 +4154,35 @@
       "prop": "outline",
       "value": "2px solid hsl(var(--ring))",
       "file": "welcome.css",
-      "line": 865
+      "line": 860
     },
     {
       "selector": ".welcome__text-link:focus-visible",
       "prop": "outline-offset",
       "value": "3px",
       "file": "welcome.css",
-      "line": 866
+      "line": 861
     },
     {
       "selector": ".welcome__route-test-heading",
       "prop": "align-items",
       "value": "center",
       "file": "welcome.css",
-      "line": 903
+      "line": 896
     },
     {
       "selector": ".welcome__route-test-heading",
       "prop": "gap",
       "value": "10px",
       "file": "welcome.css",
-      "line": 904
+      "line": 897
+    },
+    {
+      "selector": ".welcome__text-link",
+      "prop": "padding",
+      "value": "6px 0",
+      "file": "welcome.css",
+      "line": 1090
     }
   ],
   "ghostRules": [
@@ -4393,7 +4240,7 @@
       "value": "hsl(var(--muted-foreground))",
       "file": "cards.css",
       "line": 72,
-      "losesTo": "analytics-overview.css:213"
+      "losesTo": "analytics-overview.css:183"
     },
     {
       "selector": ".chart-card",
@@ -4520,7 +4367,7 @@
       "prop": "background",
       "value": "hsl(var(--muted-foreground) / 0.1)",
       "file": "data.css",
-      "line": 299,
+      "line": 252,
       "losesTo": "overview.css:105"
     },
     {
@@ -4528,7 +4375,7 @@
       "prop": "color",
       "value": "hsl(var(--muted-foreground))",
       "file": "data.css",
-      "line": 300,
+      "line": 253,
       "losesTo": "overview.css:106"
     },
     {
@@ -4536,7 +4383,7 @@
       "prop": "align-items",
       "value": "flex-start",
       "file": "data.css",
-      "line": 507,
+      "line": 460,
       "losesTo": "theme.css:586"
     },
     {
@@ -4544,7 +4391,7 @@
       "prop": "gap",
       "value": "12px",
       "file": "data.css",
-      "line": 508,
+      "line": 461,
       "losesTo": "theme.css:587"
     },
     {
@@ -4552,7 +4399,7 @@
       "prop": "padding",
       "value": "12px 0",
       "file": "data.css",
-      "line": 509,
+      "line": 462,
       "losesTo": "theme.css:588"
     },
     {
@@ -4640,31 +4487,31 @@
       "prop": "border",
       "value": "1px solid hsl(var(--border))",
       "file": "request-drawer.css",
-      "line": 670,
-      "losesTo": "request-drawer.css:918"
+      "line": 662,
+      "losesTo": "request-drawer.css:910"
     },
     {
       "selector": ".request-tool",
       "prop": "border-radius",
       "value": "var(--radius)",
       "file": "request-drawer.css",
-      "line": 671,
-      "losesTo": "request-drawer.css:919"
+      "line": 663,
+      "losesTo": "request-drawer.css:911"
     },
     {
       "selector": ".request-tool",
       "prop": "background",
       "value": "hsl(var(--card))",
       "file": "request-drawer.css",
-      "line": 672,
-      "losesTo": "request-drawer.css:920"
+      "line": 664,
+      "losesTo": "request-drawer.css:912"
     },
     {
       "selector": ".hljs-attr",
       "prop": "color",
       "value": "hsl(187 60% 38%)",
       "file": "request-drawer.css",
-      "line": 1098,
+      "line": 1090,
       "losesTo": "syntax-highlight.css:41"
     },
     {
@@ -4681,7 +4528,7 @@
       "value": "3px solid hsl(var(--ring))",
       "file": "welcome.css",
       "line": 726,
-      "losesTo": "welcome.css:865"
+      "losesTo": "welcome.css:860"
     },
     {
       "selector": ".welcome__text-link:focus-visible",
@@ -4689,23 +4536,31 @@
       "value": "2px",
       "file": "welcome.css",
       "line": 727,
-      "losesTo": "welcome.css:866"
+      "losesTo": "welcome.css:861"
     },
     {
       "selector": ".welcome__route-test-heading",
       "prop": "align-items",
       "value": "flex-start",
       "file": "welcome.css",
-      "line": 873,
-      "losesTo": "welcome.css:903"
+      "line": 868,
+      "losesTo": "welcome.css:896"
     },
     {
       "selector": ".welcome__route-test-heading",
       "prop": "gap",
       "value": "14px",
       "file": "welcome.css",
-      "line": 875,
-      "losesTo": "welcome.css:904"
+      "line": 870,
+      "losesTo": "welcome.css:897"
+    },
+    {
+      "selector": ".welcome__text-link",
+      "prop": "padding",
+      "value": "0",
+      "file": "welcome.css",
+      "line": 1079,
+      "losesTo": "welcome.css:1090"
     }
   ],
   "componentSheets": {
@@ -4713,7 +4568,7 @@
       "components/ChartHoverTooltip.tsx"
     ],
     "analytics-overview.css": [
-      "components/AutofixKpiCards.tsx",
+      "components/ReliabilityKpiCards.tsx",
       "pages/GlobalOverview.tsx",
       "pages/providers/ConnectionDetail.tsx",
       "pages/providers/ProviderConnectionsPage.tsx"
@@ -4721,9 +4576,6 @@
     "connection-detail.css": [
       "pages/providers/ConnectionDetail.tsx"
     ],
-    "discovery.css": [
-      "pages/Discovery.tsx"
-    ],
     "filter-select.css": [
       "components/FilterSelect.tsx"
     ],
@@ -4731,9 +4583,6 @@
       "components/ModelPricesFilterBar.tsx",
       "pages/MessageLog.tsx"
     ],
-    "notifications-bell.css": [
-      "components/NotificationBell.tsx"
-    ],
     "overview.css": [
       "pages/GlobalOverview.tsx",
       "pages/MessageLog.tsx",
@@ -4789,9 +4638,9 @@
   "stats": {
     "tokens": 79,
     "darkOverrides": 38,
-    "blocks": 288,
-    "classes": 1583,
-    "canonicalRules": 46,
-    "ghostRules": 46
+    "blocks": 276,
+    "classes": 1513,
+    "canonicalRules": 47,
+    "ghostRules": 47
   }
 }
diff --git a/design-system/registry/llms.txt b/design-system/registry/llms.txt
index c2b2e4c0..8f516749 100644
--- a/design-system/registry/llms.txt
+++ b/design-system/registry/llms.txt
@@ -96,14 +96,13 @@
 --z-toast: 8000
 --z-tooltip: 9999
 
-## Blocks (288 BEM blocks, 1583 classes)
+## Blocks (276 BEM blocks, 1513 classes)
 account-back-btn (agents.css): account-back-btn
 account-modal (agents.css): account-modal account-modal--standalone account-modal__inner
 account-security-error (agents.css): account-security-error
 account-security-footer (agents.css): account-security-footer
 action-menu (action-menu.css): action-menu action-menu--open action-menu__dropdown action-menu__item action-menu__item--danger action-menu__trigger
 active (controls.css, theme.css): active
-add-agent-legal (modals.css): add-agent-legal
 add-agent-toggles (modals.css): add-agent-toggles add-agent-toggles__header
 afx-kpi-line (analytics-overview.css): afx-kpi-line afx-kpi-line__primary afx-kpi-line__sep afx-kpi-line__stat
 agent-card (action-menu.css, agents.css): agent-card agent-card--skeleton agent-card__chart agent-card__menu agent-card__name agent-card__platform-icon agent-card__stat agent-card__stat-label agent-card__stat-value agent-card__stats agent-card__top
@@ -123,7 +122,7 @@ attempt-item (request-drawer.css): attempt-item attempt-item--active attempt-ite
 auth-card (auth.css): auth-card
 auth-divider (auth.css): auth-divider auth-divider__text
 auth-footer (auth.css): auth-footer auth-footer__link
-auth-form (auth.css, discovery.css): auth-form auth-form__actions auth-form__error auth-form__error-link auth-form__forgot auth-form__input auth-form__label auth-form__link-btn auth-form__notice auth-form__notice-link auth-form__submit auth-form__submit--secondary auth-form__success
+auth-form (auth.css): auth-form auth-form__actions auth-form__error auth-form__error-link auth-form__forgot auth-form__input auth-form__label auth-form__link-btn auth-form__notice auth-form__notice-link auth-form__submit auth-form__submit--secondary auth-form__success
 auth-header (auth.css): auth-header auth-header__subtitle auth-header__title
 auth-last-used (auth.css): auth-last-used
 auth-layout (auth.css): auth-layout
@@ -131,10 +130,6 @@ auth-logo (auth.css): auth-logo auth-logo__img auth-logo__img--dark auth-logo__i
 auth-social-btn (auth.css): auth-social-btn auth-social-btn--discord auth-social-btn--github auth-social-btn--google auth-social-btn__icon
 auth-social-group (auth.css): auth-social-group
 auth-terms (auth.css): auth-terms auth-terms__link
-autofix-card (data.css): autofix-card autofix-card--autofix autofix-card--fallback autofix-card__branding autofix-card__header autofix-card__ids autofix-card__op autofix-card__op-desc autofix-card__op-type autofix-card__ops autofix-card__phrase autofix-card__sibling-btn autofix-card__title
-autofix-card-row (data.css): autofix-card-row
-autofix-consent (modals.css): autofix-consent__agent-icon autofix-consent__agent-name autofix-consent__agent-row autofix-consent__agents autofix-consent__agents-label autofix-consent__legal
-autofix-icon (data.css): autofix-icon
 breadcrumb (layout.css, theme.css): breadcrumb
 btn (controls.css, layout.css, limits.css, modals.css, routing-providers.css, routing.css, skeleton.css, theme.css): btn btn--danger btn--ghost btn--outline btn--primary btn--sm
 cards-grid (layout.css, theme.css, wizard.css): cards-grid
@@ -158,24 +153,20 @@ count-link (theme.css): count-link
 custom-provider-item (routing-providers.css): custom-provider-item custom-provider-item__delete custom-provider-item__icon custom-provider-item__info custom-provider-item__meta custom-provider-item__name
 custom-provider-model-row (routing-providers.css): custom-provider-model-row custom-provider-model-row__name custom-provider-model-row__price custom-provider-model-row__remove
 custom-provider-models (routing-providers.css): custom-provider-models custom-provider-models__column custom-provider-models__column--name custom-provider-models__column--price custom-provider-models__column-spacer custom-provider-models__columns custom-provider-models__label
-custom-select (connection-detail.css, custom-select.css, discovery.css, routing-providers.css): custom-select custom-select__chevron custom-select__dropdown custom-select__dropdown--portal custom-select__dropdown--wide custom-select__option custom-select__option--disabled custom-select__option--selected custom-select__option--top custom-select__option-desc custom-select__option-text custom-select__option-text--inline custom-select__trigger custom-select__trigger--open custom-select__value
+custom-select (connection-detail.css, custom-select.css, routing-providers.css): custom-select custom-select__chevron custom-select__dropdown custom-select__dropdown--portal custom-select__dropdown--wide custom-select__option custom-select__option--disabled custom-select__option--selected custom-select__option--top custom-select__option-desc custom-select__option-text custom-select__option-text--inline custom-select__trigger custom-select__trigger--open custom-select__value
 dark (agent-type-select.css, agents.css, analytics-overview.css, auth.css, controls.css, data.css, modals.css, model-filter.css, overview.css, platform-icons.css, request-drawer.css, routing-deprecation.css, routing-providers.css, routing.css, syntax-highlight.css, tokens.css, welcome.css, wizard.css): dark
 data-table (data.css, feedback.css, theme.css): data-table data-table__sortable
 data-table-scroll (data.css): data-table-scroll
 demo-dashboard (overview.css): demo-dashboard
-discovery-actions (discovery.css): discovery-actions
-discovery-card (discovery.css): discovery-card discovery-card__desc discovery-card__form discovery-card__intro discovery-card__logo discovery-card__title
-discovery-form (discovery.css): discovery-form
-discovery-select (discovery.css): discovery-select--empty
-drawer (request-drawer.css): drawer drawer--open drawer__badge drawer__badge--autofix drawer__badge--fallback drawer__body drawer__close drawer__content drawer__content-empty drawer__header drawer__messages-pane drawer__meta-row drawer__meta-sep drawer__meta-text drawer__sidebar drawer__sidebar-title drawer__split drawer__tabs-full drawer__title drawer__title-row
-drawer-context-card (request-drawer.css): drawer-context-card drawer-context-card--autofix drawer-context-card--error drawer-context-card--fallback
+drawer (request-drawer.css): drawer drawer--open drawer__badge drawer__badge--fallback drawer__body drawer__close drawer__content drawer__content-empty drawer__header drawer__messages-pane drawer__meta-row drawer__meta-sep drawer__meta-text drawer__sidebar drawer__sidebar-title drawer__split drawer__tabs-full drawer__title drawer__title-row
+drawer-context-card (request-drawer.css): drawer-context-card drawer-context-card--error drawer-context-card--fallback
 drawer-kv (request-drawer.css): drawer-kv drawer-kv__key
 drawer-metadata (request-drawer.css): drawer-metadata
 drawer-status (request-drawer.css): drawer-status drawer-status--error drawer-status--neutral drawer-status--success
 duplicate-agent (agents.css): duplicate-agent__badge duplicate-agent__list duplicate-agent__section duplicate-agent__section-header
 empty-state (data.css, theme.css): empty-state empty-state__img empty-state__img-wrapper empty-state__title
-error-autofix-row (data.css): error-autofix-row error-autofix-row--solo error-autofix-row--triple error-autofix-row__arrow error-autofix-row__arrow-down error-autofix-row__arrow-right error-autofix-row__autofix error-autofix-row__autofix--autofix error-autofix-row__autofix--fallback error-autofix-row__autofix-btn error-autofix-row__autofix-btn--secondary error-autofix-row__autofix-text error-autofix-row__autofix-title error-autofix-row__error error-autofix-row__error--full error-autofix-row__meta-hint error-autofix-row__meta-label error-autofix-row__meta-table error-autofix-row__meta-value error-autofix-row__title
 error-class-card (analytics-overview.css): error-class-card error-class-card__bar error-class-card__bar-wrap error-class-card__count error-class-card__empty error-class-card__label error-class-card__list error-class-card__row error-class-card__title
+error-recovery-row (data.css): error-recovery-row error-recovery-row--solo error-recovery-row__arrow error-recovery-row__arrow-down error-recovery-row__arrow-right error-recovery-row__card error-recovery-row__card--fallback error-recovery-row__card-text error-recovery-row__card-title error-recovery-row__error error-recovery-row__error--full error-recovery-row__meta-hint error-recovery-row__meta-label error-recovery-row__meta-table error-recovery-row__meta-value error-recovery-row__title
 expandable-card (charts.css, theme.css): expandable-card expandable-card__btn expandable-card__content expandable-card__fade
 fallback-icon (data.css): fallback-icon
 fallback-list (routing.css): fallback-list fallback-list__add fallback-list__card fallback-list__card--dragging fallback-list__card--skipped fallback-list__card--swapping fallback-list__drag-handle fallback-list__drop-indicator fallback-list__drop-indicator--active fallback-list__empty fallback-list__empty-desc fallback-list__empty-icon fallback-list__empty-title fallback-list__icon fallback-list__items fallback-list__model fallback-list__params fallback-list__rank fallback-list__remove
@@ -216,7 +207,6 @@ hljs-template-tag (syntax-highlight.css): hljs-template-tag
 hljs-title (syntax-highlight.css): hljs-title
 hljs-type (syntax-highlight.css): hljs-type
 hljs-variable (syntax-highlight.css): hljs-variable
-info-card (cards.css): info-card__content info-card__text
 info-tooltip (tooltip.css): info-tooltip info-tooltip__bubble info-tooltip__icon
 integration-grid (wizard.css): integration-grid
 integration-panel (wizard.css): integration-panel__desc integration-panel__header integration-panel__tabs
@@ -251,11 +241,9 @@ model-modality-badges (routing-modal.css): model-modality-badges
 model-params (params-card.css, routing.css): model-params__body model-params__default-hint model-params__dialog model-params__empty model-params__empty-link model-params__field model-params__footer model-params__footer-actions model-params__group model-params__group-card model-params__group-header model-params__help model-params__help-tooltip model-params__label-hint model-params__label-title model-params__number model-params__number--slider model-params__param-key model-params__request-link model-params__reset model-params__row model-params__row--disabled model-params__row-control model-params__row-text model-params__separator model-params__slider model-params__slider-bound model-params__slider-bounds model-params__slider-control model-params__slider-field model-params__slider-field--disabled model-params__slider-tick model-params__slider-track-bg model-params__slider-track-wrapper model-params__status model-params__toggle
 model-params-modal (routing.css): model-params-modal model-params-modal--empty
 msg-detail (data.css): msg-detail msg-detail__cell msg-detail__chevron msg-detail__chevron--open msg-detail__chevron-btn msg-detail__chevron-btn--open msg-detail__chevron-cell msg-detail__chevron-th msg-detail__count msg-detail__count-badge msg-detail__error msg-detail__error-box msg-detail__error-code msg-detail__error-inline msg-detail__eye-btn msg-detail__fallback-banner msg-detail__loader msg-detail__log-body msg-detail__meta msg-detail__meta-item msg-detail__meta-label msg-detail__miscat-btn msg-detail__mono msg-detail__mono-xs msg-detail__param-value msg-detail__row msg-detail__section msg-detail__section-row msg-detail__section-title msg-detail__section-title--inline msg-detail__section-title--toggle msg-detail__severity-dot msg-detail__spinner msg-detail__summary msg-detail__summary-item msg-detail__table
-msg-highlight (data.css): msg-highlight
 msg-row (data.css): msg-row--clickable msg-row--expanded msg-row--selected
 no-connections-prompt (routing.css): no-connections-prompt no-connections-prompt__card no-connections-prompt__card-desc no-connections-prompt__card-icon no-connections-prompt__card-title no-connections-prompt__cards no-connections-prompt__desc no-connections-prompt__header no-connections-prompt__title
 not-found (layout.css): not-found not-found__code not-found__link not-found__text not-found__title
-notif-dropdown (notifications-bell.css): notif-dropdown notif-dropdown__desc notif-dropdown__dot notif-dropdown__dot-col notif-dropdown__header notif-dropdown__item notif-dropdown__item--read notif-dropdown__list notif-dropdown__title
 notif-hint (notifications.css): notif-hint
 notif-table (notifications.css): notif-table notif-table--flush notif-table__actions notif-table__mono notif-table__period notif-table__row--disabled
 notification-modal (notifications.css): notification-modal__select
@@ -264,7 +252,7 @@ notification-toggle (notifications.css): notification-toggle notification-toggle
 output-controls (routing.css): output-controls output-controls--compact output-controls__field output-controls__label output-controls__segment output-controls__segment--active output-controls__segments
 overview (agents.css): overview__platform-icon
 overview-split (analytics-overview.css): overview-split
-overview-stat-card (analytics-overview.css): overview-stat-card overview-stat-card--autofix overview-stat-card--destructive overview-stat-card--fallback overview-stat-card__label overview-stat-card__value overview-stat-card__value-row
+overview-stat-card (analytics-overview.css): overview-stat-card overview-stat-card--destructive overview-stat-card--fallback overview-stat-card__label overview-stat-card__value overview-stat-card__value-row
 overview-stats (analytics-overview.css): overview-stats overview-stats--3 overview-stats--5
 page-header (analytics-overview.css, connection-detail.css, layout.css, theme.css): page-header page-header--wrap page-header__intro page-header__subtitle page-header__title
 pagination (data.css): pagination pagination__btn pagination__controls pagination__summary
@@ -289,7 +277,9 @@ provider-setup (notifications.css): provider-setup__subtitle provider-setup__tit
 provider-setup-card (notifications.css): provider-setup-card provider-setup-card__desc provider-setup-card__logo provider-setup-card__name
 provider-setup-grid (notifications.css): provider-setup-grid
 provider-toggle (routing-providers.css, routing.css, welcome.css): provider-toggle provider-toggle--action provider-toggle__actions provider-toggle__add-btn provider-toggle__add-tooltip provider-toggle__badge provider-toggle__badge--connected provider-toggle__disconnect-btn provider-toggle__expand provider-toggle__icon provider-toggle__info provider-toggle__key-input provider-toggle__key-row provider-toggle__local-only provider-toggle__name provider-toggle__name--action provider-toggle__subtitle provider-toggle__switch provider-toggle__switch--on provider-toggle__switch-thumb provider-toggle__tag
-recovery-opt-icon (data.css): recovery-opt-icon recovery-opt-icon__none recovery-opt-icon__plus
+recovery-card (data.css): recovery-card recovery-card--fallback recovery-card__branding recovery-card__phrase recovery-card__title
+recovery-card-row (data.css): recovery-card-row
+recovery-opt-icon (data.css): recovery-opt-icon recovery-opt-icon__none
 rel-chart (reliability-card.css): rel-chart__legend rel-chart__legend-dot rel-chart__legend-item
 rel-col (theme.css): rel-col
 request-message (request-drawer.css): request-message request-message--active request-message__body request-message__body--capped request-message__chevron request-message__chevron--open request-message__content request-message__footer request-message__header request-message__index request-message__meta-code request-message__preview request-message__role request-message__role--assistant request-message__role--system request-message__role--tool request-message__role--unknown request-message__role--user request-message__uncap
@@ -325,9 +315,9 @@ rule-menu (limits.css): rule-menu__btn rule-menu__dropdown rule-menu__item rule-
 scroll-panel (analytics-overview.css, routing-providers.css): scroll-panel scroll-panel--at-bottom scroll-panel__body
 security-event (data.css, theme.css): security-event security-event__badge security-event__desc security-event__dot security-event__dot--critical security-event__dot--info security-event__dot--warning security-event__time
 select (controls.css, theme.css): select
-settings-card (agents.css, cards.css, controls.css, modals.css, notifications.css): settings-card settings-card--danger settings-card--disabled settings-card--flush settings-card--highlight settings-card--info settings-card__body settings-card__control settings-card__control--end settings-card__copy-btn settings-card__desc settings-card__footer settings-card__id-row settings-card__id-value settings-card__input settings-card__key-actions settings-card__key-row settings-card__key-value settings-card__label settings-card__label-desc settings-card__label-desc--meta settings-card__label-title settings-card__legal settings-card__row
+settings-card (agents.css, controls.css, notifications.css): settings-card settings-card--danger settings-card--disabled settings-card__body settings-card__control settings-card__control--end settings-card__copy-btn settings-card__desc settings-card__footer settings-card__id-row settings-card__id-value settings-card__input settings-card__key-actions settings-card__key-row settings-card__key-value settings-card__label settings-card__label-desc settings-card__label-desc--meta settings-card__label-title settings-card__row
 settings-section (agents.css, controls.css): settings-section__title settings-section__title--danger
-settings-switch (agents.css, modals.css, welcome.css): settings-switch settings-switch--on settings-switch__thumb settings-switch__track
+settings-switch (agents.css, welcome.css): settings-switch settings-switch--on settings-switch__thumb settings-switch__track
 setup-agents-card (wizard.css): setup-agents-card setup-agents-card__title
 setup-agents-coming-soon (wizard.css): setup-agents-coming-soon setup-agents-coming-soon__text
 setup-change-type-link (wizard.css): setup-change-type-link
@@ -354,7 +344,7 @@ specificity-modal (routing-specificity.css): specificity-modal specificity-modal
 specificity-output-controls (routing-specificity.css): specificity-output-controls
 spinner (skeleton.css): spinner
 sr-only (playground.css, skeleton.css): sr-only
-status-badge (data.css, theme.css): status-badge status-badge--auto_fixed status-badge--error status-badge--fallback_error status-badge--neutral status-badge--ok status-badge--rate_limited status-badge--retry
+status-badge (data.css, theme.css): status-badge status-badge--error status-badge--fallback_error status-badge--neutral status-badge--ok status-badge--rate_limited status-badge--retry
 status-badge-tooltip (data.css): status-badge-tooltip status-badge-tooltip__bubble
 subscription-detail (routing-providers.css): subscription-detail__alt subscription-detail__alt-divider subscription-detail__alt-hint subscription-detail__btn subscription-detail__primary
 summary-card (cards.css, theme.css): summary-card summary-card__label summary-card__subtitle summary-card__value
@@ -378,12 +368,10 @@ u-marker (charts.css, theme.css): u-marker
 u-series (charts.css, theme.css): u-series
 u-value (charts.css, theme.css): u-value
 u-wrap (cards.css, charts.css, theme.css): u-wrap
-version-indicator (version-indicator.css): version-indicator version-indicator--update version-indicator__dismiss version-indicator__update
+version-indicator (version-indicator.css): version-indicator
 view-more-link (analytics-overview.css, cards.css): view-more-link
 waiting-banner (overview.css): waiting-banner waiting-banner--success
-welcome (welcome.css): welcome welcome__actions welcome__actions--split welcome__actions--sticky welcome__actions-note welcome__agent-wait welcome__agent-wait--success welcome__agent-wait-heading welcome__autofix-details welcome__autofix-examples welcome__autofix-heading welcome__autofix-how welcome__autofix-section welcome__availability-note welcome__error welcome__eyebrow welcome__first-request welcome__form-panel welcome__harness-summary welcome__harness-summary-icon welcome__harness-summary-name welcome__harness-summary-type welcome__inline-code welcome__input-hint welcome__launch-orbit welcome__launch-rocket welcome__launch-rocket--complete welcome__launch-stack welcome__launch-stack--complete welcome__launch-stack-header welcome__launch-track welcome__legal welcome__liftoff welcome__liftoff-action welcome__liftoff-beacon welcome__liftoff-copy welcome__liftoff-description welcome__liftoff-earth welcome__liftoff-exit welcome__liftoff-flash welcome__liftoff-kicker welcome__liftoff-orbit welcome__liftoff-plume welcome__liftoff-plume-inner welcome__liftoff-rocket welcome__liftoff-smoke welcome__liftoff-stars welcome__liftoff-stars--far welcome__liftoff-stars--near welcome__liftoff-status welcome__liftoff-title welcome__liftoff-title--launch welcome__liftoff-title--orbit welcome__liftoff-titles welcome__logo-dark welcome__logo-light welcome__logo-mark welcome__main welcome__model-badge welcome__nav welcome__nav-btn welcome__nav-check welcome__nav-dot welcome__nav-hint welcome__nav-item welcome__nav-item--active welcome__nav-item--done welcome__nav-label welcome__nav-mobile-rocket welcome__nav-mobile-rocket--complete welcome__output welcome__panel welcome__panel--playground welcome__panel--setup welcome__panel-desc welcome__panel-header welcome__panel-title welcome__pending welcome__plan-heading welcome__plan-section welcome__playground welcome__playground-actions welcome__playground-link welcome__progress welcome__progress-header welcome__prompt-label welcome__provider-connected welcome__provider-list welcome__request-failure welcome__response welcome__rocket-flame welcome__route-test-heading welcome__route-test-section welcome__route-test-title welcome__section-desc welcome__section-heading welcome__setup-snippets welcome__sidebar welcome__sidebar-footer welcome__sidebar-top welcome__skip-row welcome__spinner welcome__stats welcome__success-icon welcome__text-link welcome__textarea
-wingman-drawer (controls.css): wingman-drawer wingman-drawer--resizing wingman-drawer__actions wingman-drawer__frame wingman-drawer__head wingman-drawer__icon-btn wingman-drawer__resizer wingman-drawer__sub wingman-drawer__title
-wingman-fab (controls.css, version-indicator.css): wingman-fab wingman-fab__label
+welcome (welcome.css): welcome welcome__actions welcome__actions--split welcome__actions--sticky welcome__actions-note welcome__agent-wait welcome__agent-wait--success welcome__agent-wait-heading welcome__availability-note welcome__error welcome__eyebrow welcome__first-request welcome__form-panel welcome__harness-summary welcome__harness-summary-icon welcome__harness-summary-name welcome__harness-summary-type welcome__inline-code welcome__input-hint welcome__launch-orbit welcome__launch-rocket welcome__launch-rocket--complete welcome__launch-stack welcome__launch-stack--complete welcome__launch-stack-header welcome__launch-track welcome__liftoff welcome__liftoff-action welcome__liftoff-beacon welcome__liftoff-copy welcome__liftoff-description welcome__liftoff-earth welcome__liftoff-exit welcome__liftoff-flash welcome__liftoff-kicker welcome__liftoff-orbit welcome__liftoff-plume welcome__liftoff-plume-inner welcome__liftoff-rocket welcome__liftoff-smoke welcome__liftoff-stars welcome__liftoff-stars--far welcome__liftoff-stars--near welcome__liftoff-status welcome__liftoff-title welcome__liftoff-title--launch welcome__liftoff-title--orbit welcome__liftoff-titles welcome__logo-dark welcome__logo-light welcome__logo-mark welcome__main welcome__model-badge welcome__nav welcome__nav-btn welcome__nav-check welcome__nav-dot welcome__nav-hint welcome__nav-item welcome__nav-item--active welcome__nav-item--done welcome__nav-label welcome__nav-mobile-rocket welcome__nav-mobile-rocket--complete welcome__output welcome__panel welcome__panel--playground welcome__panel--setup welcome__panel-desc welcome__panel-header welcome__panel-title welcome__pending welcome__plan-heading welcome__plan-section welcome__playground welcome__playground-actions welcome__playground-link welcome__progress welcome__progress-header welcome__prompt-label welcome__provider-connected welcome__provider-list welcome__request-failure welcome__response welcome__rocket-flame welcome__route-test-heading welcome__route-test-section welcome__route-test-title welcome__section-desc welcome__section-heading welcome__setup-snippets welcome__sidebar welcome__sidebar-footer welcome__sidebar-top welcome__skip-row welcome__spinner welcome__stats welcome__success-icon welcome__text-link welcome__textarea
 workspace-table (agents.css): workspace-table__actions workspace-table__icon workspace-table__name
 
 ## Primitives (0)
@@ -392,8 +380,8 @@ workspace-table (agents.css): workspace-table__actions workspace-table__icon wor
 ## Migration map — legacy component → primitive to use instead (0)
 (empty until primitives exist)
 
-## Canonical rules — same selector+property declared twice with different values; the winner renders (46)
-.view-more-link { color: hsl(var(--foreground)) }  ← analytics-overview.css:213
+## Canonical rules — same selector+property declared twice with different values; the winner renders (47)
+.view-more-link { color: hsl(var(--foreground)) }  ← analytics-overview.css:183
 .custom-select__option--top > svg { margin-top: calc((18px - 14px) / 2) }  ← custom-select.css:142
 .custom-select__option--top > img { margin-top: calc((18px - 14px) / 2) }  ← custom-select.css:142
 .setup-modal__header { align-items: center }  ← overview.css:15
@@ -403,9 +391,9 @@ workspace-table (agents.css): workspace-table__actions workspace-table__icon wor
 .setup-modal__next:hover { opacity: 0.85 }  ← overview.css:55
 .tier-badge--fallback { background: hsl(38 92% 50% / 0.15) }  ← overview.css:105
 .tier-badge--fallback { color: hsl(38 92% 40%) }  ← overview.css:106
-.request-tool { border: 1px solid hsl(36 80% 50% / 0.24) }  ← request-drawer.css:918
-.request-tool { border-radius: var(--radius-sm) }  ← request-drawer.css:919
-.request-tool { background: hsl(36 80% 50% / 0.04) }  ← request-drawer.css:920
+.request-tool { border: 1px solid hsl(36 80% 50% / 0.24) }  ← request-drawer.css:910
+.request-tool { border-radius: var(--radius-sm) }  ← request-drawer.css:911
+.request-tool { background: hsl(36 80% 50% / 0.04) }  ← request-drawer.css:912
 .hljs-attr { color: hsl(var(--chart-4)) }  ← syntax-highlight.css:41
 .summary-card { box-shadow: rgba(0, 0, 0, 0.08) 0px 0px 0px 1px }  ← theme.css:196
 .trend--up { color: hsl(var(--success)) }  ← theme.css:237
@@ -437,19 +425,20 @@ workspace-table (agents.css): workspace-table__actions workspace-table__icon wor
     0 2px 4px -2px rgb(0 0 0 / 0.1) }  ← toast.css:22
 .toast { animation: toastSlideIn 200ms ease-out }  ← toast.css:26
 .welcome__progress-header span { letter-spacing: 0.02em }  ← welcome.css:554
-.welcome__text-link:focus-visible { outline: 2px solid hsl(var(--ring)) }  ← welcome.css:865
-.welcome__text-link:focus-visible { outline-offset: 3px }  ← welcome.css:866
-.welcome__route-test-heading { align-items: center }  ← welcome.css:903
-.welcome__route-test-heading { gap: 10px }  ← welcome.css:904
+.welcome__text-link:focus-visible { outline: 2px solid hsl(var(--ring)) }  ← welcome.css:860
+.welcome__text-link:focus-visible { outline-offset: 3px }  ← welcome.css:861
+.welcome__route-test-heading { align-items: center }  ← welcome.css:896
+.welcome__route-test-heading { gap: 10px }  ← welcome.css:897
+.welcome__text-link { padding: 6px 0 }  ← welcome.css:1090
 
-## Ghost rules — declared but always losing; edit the canonical rule instead, delete these in the refactor project (46)
+## Ghost rules — declared but always losing; edit the canonical rule instead, delete these in the refactor project (47)
 .summary-card { box-shadow: var(--card-shadow) }  at cards.css:7 loses to theme.css:196
 .trend--up { color: hsl(var(--muted-foreground)) }  at cards.css:48 loses to theme.css:237
 .trend--down { color: hsl(var(--muted-foreground)) }  at cards.css:48 loses to theme.css:242
 .trend--up { background: hsl(var(--muted)) }  at cards.css:49 loses to theme.css:238
 .trend--down { background: hsl(var(--muted)) }  at cards.css:49 loses to theme.css:243
 .panel { box-shadow: var(--card-shadow) }  at cards.css:59 loses to theme.css:268
-.view-more-link { color: hsl(var(--muted-foreground)) }  at cards.css:72 loses to analytics-overview.css:213
+.view-more-link { color: hsl(var(--muted-foreground)) }  at cards.css:72 loses to analytics-overview.css:183
 .chart-card { box-shadow: var(--card-shadow) }  at cards.css:86 loses to theme.css:284
 .chart-card__header { align-items: stretch }  at cards.css:92 loses to theme.css:290
 .chart-card__value-row { align-items: center }  at cards.css:160 loses to theme.css:322
@@ -465,11 +454,11 @@ workspace-table (agents.css): workspace-table__actions workspace-table__icon wor
 .sidebar { padding: var(--gap-md) 0 }  at controls.css:213 loses to theme.css:784
 .custom-select__option--top > svg { margin-top: calc((18px - 13px) / 2) }  at custom-select.css:137 loses to custom-select.css:142
 .custom-select__option--top > img { margin-top: calc((18px - 13px) / 2) }  at custom-select.css:137 loses to custom-select.css:142
-.tier-badge--fallback { background: hsl(var(--muted-foreground) / 0.1) }  at data.css:299 loses to overview.css:105
-.tier-badge--fallback { color: hsl(var(--muted-foreground)) }  at data.css:300 loses to overview.css:106
-.feed-item { align-items: flex-start }  at data.css:507 loses to theme.css:586
-.feed-item { gap: 12px }  at data.css:508 loses to theme.css:587
-.feed-item { padding: 12px 0 }  at data.css:509 loses to theme.css:588
+.tier-badge--fallback { background: hsl(var(--muted-foreground) / 0.1) }  at data.css:252 loses to overview.css:105
+.tier-badge--fallback { color: hsl(var(--muted-foreground)) }  at data.css:253 loses to overview.css:106
+.feed-item { align-items: flex-start }  at data.css:460 loses to theme.css:586
+.feed-item { gap: 12px }  at data.css:461 loses to theme.css:587
+.feed-item { padding: 12px 0 }  at data.css:462 loses to theme.css:588
 .theme-toggle { width: 2rem }  at layout.css:141 loses to theme.css:947
 .theme-toggle { padding: 0 }  at layout.css:149 loses to theme.css:938
 .modal { box-shadow: var(--card-shadow),
@@ -481,24 +470,23 @@ workspace-table (agents.css): workspace-table__actions workspace-table__icon wor
 .setup-modal__next { color: hsl(var(--primary-foreground)) }  at modals.css:101 loses to overview.css:46
 .setup-modal__next { background: hsl(var(--primary)) }  at modals.css:102 loses to overview.css:45
 .setup-modal__next:hover { opacity: 0.9 }  at modals.css:110 loses to overview.css:55
-.request-tool { border: 1px solid hsl(var(--border)) }  at request-drawer.css:670 loses to request-drawer.css:918
-.request-tool { border-radius: var(--radius) }  at request-drawer.css:671 loses to request-drawer.css:919
-.request-tool { background: hsl(var(--card)) }  at request-drawer.css:672 loses to request-drawer.css:920
-.hljs-attr { color: hsl(187 60% 38%) }  at request-drawer.css:1098 loses to syntax-highlight.css:41
+.request-tool { border: 1px solid hsl(var(--border)) }  at request-drawer.css:662 loses to request-drawer.css:910
+.request-tool { border-radius: var(--radius) }  at request-drawer.css:663 loses to request-drawer.css:911
+.request-tool { background: hsl(var(--card)) }  at request-drawer.css:664 loses to request-drawer.css:912
+.hljs-attr { color: hsl(187 60% 38%) }  at request-drawer.css:1090 loses to syntax-highlight.css:41
 .welcome__progress-header span { letter-spacing: 0.09em }  at welcome.css:548 loses to welcome.css:554
-.welcome__text-link:focus-visible { outline: 3px solid hsl(var(--ring)) }  at welcome.css:726 loses to welcome.css:865
-.welcome__text-link:focus-visible { outline-offset: 2px }  at welcome.css:727 loses to welcome.css:866
-.welcome__route-test-heading { align-items: flex-start }  at welcome.css:873 loses to welcome.css:903
-.welcome__route-test-heading { gap: 14px }  at welcome.css:875 loses to welcome.css:904
+.welcome__text-link:focus-visible { outline: 3px solid hsl(var(--ring)) }  at welcome.css:726 loses to welcome.css:860
+.welcome__text-link:focus-visible { outline-offset: 2px }  at welcome.css:727 loses to welcome.css:861
+.welcome__route-test-heading { align-items: flex-start }  at welcome.css:868 loses to welcome.css:896
+.welcome__route-test-heading { gap: 14px }  at welcome.css:870 loses to welcome.css:897
+.welcome__text-link { padding: 0 }  at welcome.css:1079 loses to welcome.css:1090
 
-## Component-loaded sheets — imported by components, not theme.css; they load after the global styles (20)
+## Component-loaded sheets — imported by components, not theme.css; they load after the global styles (18)
 agent-chart-tooltip.css ← components/ChartHoverTooltip.tsx
-analytics-overview.css ← components/AutofixKpiCards.tsx, pages/GlobalOverview.tsx, pages/providers/ConnectionDetail.tsx, pages/providers/ProviderConnectionsPage.tsx
+analytics-overview.css ← components/ReliabilityKpiCards.tsx, pages/GlobalOverview.tsx, pages/providers/ConnectionDetail.tsx, pages/providers/ProviderConnectionsPage.tsx
 connection-detail.css ← pages/providers/ConnectionDetail.tsx
-discovery.css ← pages/Discovery.tsx
 filter-select.css ← components/FilterSelect.tsx
 model-filter.css ← components/ModelPricesFilterBar.tsx, pages/MessageLog.tsx
-notifications-bell.css ← components/NotificationBell.tsx
 overview.css ← pages/GlobalOverview.tsx, pages/MessageLog.tsx, pages/Overview.tsx
 playground.css ← pages/Playground.tsx
 reliability-card.css ← components/ReliabilityChart.tsx
diff --git a/docs/dev/manifest-guide.md b/docs/dev/manifest-guide.md
index 4f2258df..1dc2c1cf 100644
--- a/docs/dev/manifest-guide.md
+++ b/docs/dev/manifest-guide.md
@@ -2,7 +2,7 @@
 > Thinker is a self-hosted-only fork. While this file is being rewritten, apply these overrides to everything below:
 >
 > - **Ignore every "Cloud Mode Always" / `MANIFEST_MODE=cloud` directive.** Thinker has no cloud mode; use the self-hosted mode.
-> - **Ignore the Wingman drawer requirement** (the dev-mode iframe check against `wingman.manifest.build`).
+> - **The dashboard has no Wingman drawer, update check, Discovery step or Autofix UI** (#13). Backend leftovers go in #16/#17.
 > - **Never call `app.manifest.build` or any other Manifest-hosted endpoint.**
 > - **Do not use the `mnfst` CLI against Manifest's cloud.** The CLI becomes `thinker` and only talks to a Thinker instance.
 
@@ -20,9 +20,7 @@ Manifest is a smart model router for **AI agents**. It sits between an agent and
 
 **Supported agents**: see `AGENT_PLATFORMS` in `packages/shared/src/agent-type.ts` for the current list (OpenClaw, Hermes, Claude Code, OpenCode, generic OpenAI/Anthropic SDK slots, and others — don't duplicate the list here, it grows independently of this doc). OpenClaw remains the deepest integration, but no new code or copy should frame Manifest as OpenClaw-only. When adding examples, prefer "AI agent" as the noun and pick OpenClaw as the worked example rather than the sole target. Manifest is consumed as a generic OpenAI-compatible HTTP endpoint — there are no first-party OpenClaw plugins in this repo anymore.
 
-Wingman — the gateway tester for sending requests against a Manifest backend while impersonating any of the supported agents (useful for routing/header-classifier reproductions) — lives in its own repo at [`mnfst/wingman`](https://github.com/mnfst/wingman) and is hosted at [`wingman.manifest.build`](https://wingman.manifest.build). The dashboard embeds it as an iframe drawer **in dev mode only** — it is dead-code-eliminated from production / self-hosted bundles via `__DEV_MODE__`. The backend allows the hosted Wingman origin through CORS in both dev and production (production also honors `WINGMAN_CORS_ORIGINS`), while the CSP `frame-src` that permits the drawer iframe stays dev-only; both are wired in `packages/backend/src/cors-csp-config.ts`.
-
-**Whenever working in dev mode (`/serve`, `npm run dev`, etc.), the Wingman drawer is expected to be available** — open the FAB at the bottom-right of the dashboard (or hit ⌘/Ctrl+Shift+W) and confirm the iframe loads `https://wingman.manifest.build` cleanly. The drawer is part of the dev surface area, so a broken iframe means the dev environment is broken. `/serve` is **dev-only** — never use it to validate production behavior.
+The dashboard makes no outbound call of its own (#13): no Wingman drawer, no "new version" check (the version badge reads the build-time `__MANIFEST_VERSION__` constant from `vite.config.ts`), no post-signup Discovery questionnaire, and no Autofix UI. Setup and signup go straight to the dashboard (`/` and `/welcome`). The backend `wingman`/CORS, `version/`, `discovery/` and Autofix modules still exist until #16/#17 remove them; the dashboard no longer calls them, except the generic reliability analytics still served under the legacy `/api/v1/overview/autofix-*` paths (see `RELIABILITY_PATHS` in `packages/frontend/src/services/api/analytics.ts`).
 
 **Three management surfaces share one REST API.** The dashboard, the `mnfst` CLI (`packages/cli/`), and the remote MCP server (`packages/backend/src/mcp/`) all drive the same `/api/v1/*` services with the same tenant scoping. Add a capability to the service layer once, then expose it on whichever surfaces need it; never fork logic per surface. See [CLI login](#cli-login-mnfst-login) and [Remote MCP server](#remote-mcp-server) below.
 
@@ -174,14 +172,13 @@ packages/
 │   │   │   ├── AgentDetail.tsx, AgentProviders.tsx   # Per-harness detail shell (tabs) + provider connections
 │   │   │   ├── MessageLog.tsx               # Paginated Requests log (legacy filename)
 │   │   │   ├── Account.tsx                  # User profile (session data)
-│   │   │   ├── Settings.tsx, SettingsAutofixSection.tsx, SettingsRecordingSection.tsx # Harness settings + Autofix + request-recording toggles
+│   │   │   ├── Settings.tsx, SettingsRecordingSection.tsx # Harness settings + request-recording toggle
 │   │   │   ├── Routing.tsx, RoutingPanels.tsx, RoutingActions.tsx, RoutingDefaultTierSection.tsx, RoutingHeaderTiersSection.tsx, RoutingSpecificitySection.tsx, RoutingTierCard.tsx # LLM routing config (split by concern)
 │   │   │   ├── Limits.tsx                   # Alert rule management — mounted at /harnesses/:agentName/guardrails ("Guardrails" tab)
 │   │   │   ├── ModelPrices.tsx              # Model pricing table
 │   │   │   ├── Playground.tsx               # Prompt playground
 │   │   │   ├── ConnectProvider.tsx          # Provider connection flow
 │   │   │   ├── providers/                   # Subscriptions.tsx, Byok.tsx, Local.tsx, ConnectionDetail.tsx, ProviderConnectionsPage.tsx (/providers/* pages)
-│   │   │   ├── Discovery.tsx                # Self-hosted discovery form (one-time, post-signup)
 │   │   │   ├── Welcome.tsx                  # Post-signup welcome flow (+ welcome-helpers.ts)
 │   │   │   ├── Setup.tsx                    # First-run setup wizard
 │   │   │   ├── Help.tsx                     # Help page
@@ -772,11 +769,11 @@ The id is minted lazily by `InstallIdService.getOrCreate()` (exported from `Tele
 
 **Recording separates the request verdict from attempt audit.** `requests.autofix_status` is the one outcome for the logical request; only `retry_succeeded` means the request was recovered by Autofix. Actual provider calls remain `agent_messages` rows with their own `status`. When Manifest sends a patched retry, the related attempt rows use `autofix_applied`, `autofix_group_id`, `autofix_role`, and `autofix_operations`; Phoenix's decision metadata is exposed by the entity as `autofix_decision` (`{status,issueId,patchId,healAttemptId,explanation}`) and mapped to the retained physical column `autofix_phoenix`. A Phoenix consultation that produces no patched retry must not create a fake provider attempt.
 
-**Frontend:** `pages/SettingsAutofixSection.tsx` — a single on/off toggle in the per-agent **Settings** page (shown for every agent; `services/api/routing.ts` `getAutofix`/`updateAutofix`; `.settings-switch` styling). `components/MessageDetails.tsx` renders the Autofix panel + sibling link.
+**Frontend:** none. The dashboard's Autofix UI (Settings toggle, create-time switch, KPI card, badges, filters, Phoenix panels and the notification bell) was removed in #13; agents are created without `autofix_enabled`, so the self-hosted default (off) applies.
 
 **Self-hosted consent is once, and rides on the per-agent enable.** On self-hosted, consent is remembered via `install_metadata.autofix_consented_at` — a single nullable column on the existing telemetry singleton. Consent is recorded by **any** enable path: the per-agent `PATCH …/autofix` with `enabled: true` (a disable never mints it), the enable-all endpoint, and the Autofix switch on first agent creation. The singleton row is upserted, minting an `install_id` if telemetry never did — so consent alone never starts telemetry.
 
-**The sidebar carries no Autofix card.** The Autofix enablement card duplicated what notifications already cover, and the cards promoting the self-healing product are gone. The sidebar carries no cards. The per-harness **Settings** toggle (`SettingsAutofixSection.tsx`) is the enablement path in the dashboard.
+**The dashboard has no Autofix enablement path** (#13).
 
 `POST /api/v1/autofix/enable-all` remains as an API-level fleet backfill (no dashboard caller): it runs `UPDATE agents SET autofix_enabled = true` for every live, non-playground agent in the tenant (**including any previously turned off**), invalidates the per-tenant config cache, records consent, and returns the refreshed workspace status. Soft-deleted agents are left alone so resurrecting one doesn't silently arrive with Autofix on.
 
diff --git a/packages/frontend/public/autofix-icon-email.png b/packages/frontend/public/autofix-icon-email.png
deleted file mode 100644
index b1d328eb4a85f158e2ee82d32c68f65bad999a3d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5673
zcmV+^7S`#BP)<h;3K|Lk000e1NJLTq002k;002k`0ssI2+K(g<000mGNkl<Zc$~aj
zX{?^dRX#KC``znY+wpq6hcr!Sfj|XWoo2C|4V)%+OKAcHsY0c#kPvDm;2#L7@DF|<
zfyDNM3ZY7E706C#Nz^1{aZ>7*lC;g{C61jq-hJ2aote&g&N=hWcfGZ0+E3PKJm1{+
zoiool&sk=^Hl;-8{5<`w=_mg8)ZT-`W2c5EXVdJk^NmXsou}luB}&vJN|72z7~yYa
zPDA<m+`8mFMT-2lIw$cQXRWvXY2$?cSnDoaG`MiQxp?`+jT=^MUbo`h%XViI?8H?3
z;=?B%dg|oNTwX_#mGPTg!uwMGQ~3u8?Y|!X9I1rP`dQ{Im**E!gO<l-^&~TSP9D@b
zrB9e|eXsu}2F<pMC-1p*{nD}ahZSsonC^dk>fatZK0TY)5`053CEw;YqR(w2^eOo!
zVI;35@G28f60G=JMJYdrF{ws?42@uQTHhqhn`M0(nVF^f&CAx`b@AGP_vaC8YC8V;
z-yPlcy?I7S^^Gy<b<8InF$6HP!caQ0@#wJbx$>OR33<g{R!MFYlQZ`hbQpHpymt8?
z{n90i2P4pp2)g&p?hpRr$gY=$junm^7VA9=pGP7u!$)3*eai~PeI4PI60cPDis!ft
zsPE?_SN|=GoA89hSl|(|(RE9uO?W16Df$ubi|M(yj(zr-m-e2TIWuC%PQ=gt<+1&5
zchKpmHo*8`zq9`2z4x#&Xdpk^C+G%V*dr;J7~1)7JwJgwo@p9rcsiJ+AmFScx_2gf
zGnD!c{^jRym>B=7>wbRu_+SLFVVC~wZ%*!iD-bWAca*>LveUe~-sg3Z>~|iIN&60c
za)wDvii7+W`kn+CJlSIok8ocQqk<l9k&Gm40{SrtGSZUFsYcjdV|sIH?(;9aJdANf
zu&+Ea`_ii&O9k<vGCt3NE}0Cr?x-4=ux`S-N&8r<%Hy!6dW1&4&1%t)$07-xCZXsm
z+T<V`uc~iD7LVH(k4)YB>cL*HqbK4QADE@AQVF242x1Q&jWc^-+>)##>lZsFyj!r1
zy1SLM=m!}W8;c&eslD0!6r(=B$Bhgtkr~fV{a-D_Q2HT#>H7zc&JI<uFMN4sX3jLw
z^olh-!9r?VkFx7A>nE?c-*47f9k<;rGEo1wUY}qs#tG=<5t7v_Zc!Npj<87LMq9RJ
z?gO!m-t=7j*BAHm>Q7CjN1yD#NG4mP+D=@hSERPrRJJ5KNtok{{WRPMXPE9e{6}#U
zIlXCMRD49MUC~TP+haltq~dW!(h$q-*LEK|HQ)JNFAh7~doo5g^rA1?#gZr*F-EWQ
zcsQgyLN+2AMcU^*@-7;x$t#j#U11bG?N>73uM`<_vhEQ*45fA2#?%G+_S+}?^WPeh
z*eI)5RNLjvjo>lh*1y$sEEaqO6H2k?h9r6=dT7`-YGa15jVqT{Sk-c>3`9M)f>oxC
zK)pQHf<@9d4xaF@?TKgIEkTd*A+tBJ92xJKn)!_uSW$L|%vuGLWZyP|UWG~SyV1Av
z2-Yn!yHMc+i&F30OI0K3UOPPH4<8M@eKEjLBl=OSR&WqT620<@kB+!v<;BKQbp4#@
z6@SIB!iUK4?B|3EtAMaU_9%eRA}!#<G^&%r{*W^sof-NQ$MRw#?_yAkYQRps-=SX(
zDMOHIU8Q5S9jZ@TFcQqhN<Zl8eT{0F4;fr6Gid}dvn5|x#Bk#n0{x?>hJJ27f@h=p
z6UE9Yr^)W(iK((57fnmmt~^!TP0G=vxb?hR^{aifRhoo_1I-8a%n{VaSQ|$<!}l0c
zKm?_%3d<&n+A7;R4MPN(RQ5?%=|^pytr4qXw(RA^b5<^H*Df2c(4*d`rBQj}h)#}-
zkFuhxtS-q+8v&=YX+-%O*0d0d4`JMrA;WE=RK*Ih$FOGz<`R4xSWeNXtshwNPoKN|
z@Bi@f+pbs*tZ0F3#YZ`ygjM#MteRGA%w!<N&@eAN8G)F}TCJN@-=L*+q-U#XQqO4(
zWNVx=#uH9U8l8||JaC`fwoyX3Pu#X~$s$fy8)YMjKUIFSE0fvY;uc6)`Dj04dsGni
z$`B-2B{m-B5-Prn`x!&Uv*cGSgG!#~7h4j{p~(&-xxMR#H5ZIGBG?6E&5q6MGVkkq
z%T5zXYc{O>*6SYkRd16rKIcOtjIT%{-%`86-#5B*U_~y*=(|y{kUfj=PO<4NA@@fk
zz>s7_{LjRAbLVxd>lE;gYu8K+IO!AZa<WH?5_!dh3Q9%CQjZ3W*jtZbg_}!a@d2z7
zWxrV`gT@E!k5xAHOO5Njx$v9WYvIXQ=G=At<RXJhK8rGFA6##LTjF=><#8Iz_ugVe
z&fdl{uw^g6lO+}rRt%y=(7<5p1HUz7meb2g`mIPClsOxT&|Qt2yI{=SdBX@?^7*xE
z)+`=xT@b8f-4=hTgm_x2STV`W)7Y;t<fy;Sx*iJ4!&=CxrbSM~U_TDyrjt>a!#sGA
zB+9<(F5sDW-Lz%_TngHFv;F#YuJX&`g=>7o#x&+K98%$}RE<Yr{DL9N?;G7+g8k%C
zl~ZC7kpwZD$RnjuW51q1B@T?jZ1U~0iFVtKtLQABZJXCE9dAl3A}sGJTXpiZV9%G`
zG_U3QI0N6t%Jzg;fJsIs^bApP9d+Q9WEdv3vBbV8IYU_1!PvqFI?Ug`buydN*#sLK
z_>XMas6MU878y6*!7f(bDJ|%ih}nyej>T&m_vB6sHaC6~O|v!#2gH`&Ds~lx<x$AW
zEAZG+?{s}sc6!+b&8^p;6)ySQa?RxO#e-tWnkm<w&^(pv?aIch$k3gJp&%AowJYXE
z(=^k@X!<EOw!oHvt>Km$GW!hiqubVIOwKJ>+xTDKx(T)#g)N-y;3yx~(V%f-R2w6)
zE9c_K9In}2e%a@;EDaJ5hfu1~x)Rei0u#+38yP`p+<;iv*X8wD{?DGnyNNNk?Uu>g
zwybVgxzF>tWaHw{#WxPlbi;rpAl{{<r83Ns(vnLu&T~+fp}sz+2Lx2AKrGuwZ-2dM
z9oOGm&sEVD8E%vNfm^N1Yulh+-*B=YnkFNUHU+8OuU^^Se#@$xZdkc!+|!TpnVpYM
zyzutJPwhW8m8&mI{CPb&c1R?B)WDID%eM(5kqZ*us>@o}Ajt{y*Z2JDYYA0YC+8g^
zvX?R(PDZ%y%P2WLAK?+H!aGTxU0O3a*uH)B2RARLAMf+@u0s!e{fz^MX8{9B7F2*k
zrBonO83<9ZlbJY}swy`hyY-c}WnN*dvV~*>TyC=|hPG`IkQ7W<8~Mxya`HIm+Uquq
zefYzZS6_XhJHOujP@lZ8=f89K-pBU5b$AZA<+X9-7h=Q-8`ofDTu_RJ7%&vXu;U-U
z_0=qihe<ib$4fyh|MQ>)DSz_m5p+LK%Hxx3nveX(<W<+aYa*Q{-aG&P*xm#0%s9Lf
z#ZpP&DM<~+%aD{pogIXbz~_Ez>-U<B3G|IuFZKrO;&C8DusXJ@Y=>xfd~Ed{+gH&~
z{`2q?`@j6?>lv|FY!8@N-)t|61!^6hOV+JKiMcPnsAIm)edfCC2{_ULr}Kz-Fn7_W
zv7e4q`E$oj8#hfZ);KFzR3WQU|K_Zv-Z$`?yN+x2@Mi4CIGzYBd>7gT*$_|gID5Io
zvBmk0t>4{`OUa@Wi3;-Wn<P}_7JZf(5i2^wC$~I1x8%CW$AdZ|xMi915f@8%;PvUR
z-hYUGDxZfR+jsEbv_>8sqAm5>8XMJdiL{N>7k>A~?|7UJi~abviNc4GZ7i@w@s6<X
zGOxw97sJ|(i|)94&97Xy;wMBN-`I8NzDIT+IyxtQOgtNW7c-$ZKh|5_s5f(;+VX#T
z@}T}oycs{mNnsu*+3M<XcR)NCflF7d9c;U2{V%_J;;~5IJoMlrd)|I$MhmgxuYA4k
z;=wQ?{UoJ&@n+<H?}l9(LophRQhpZuF(4+~7;>8ha)?DDFwAT@@G*25!|c;mZ(4No
zj&)aUSxrCQXXkToKk}cu-#Ib|-^G5({Fs9uW30%=ISO$jh((ngQP^j0{3bi9hNKdh
z!1zQYr^bA`$0%it0#}_#Vi6vff<3B0a-d90R<v8TZ@6abnz2PcT1YiF8=m=}gO5M9
z|M>B_gwqh=ag-(GcuW0NAAi6N11t4i>c^5CMUwmd>tEn=%9s$>CPpJBM33BNtXlZA
z9GwJ?6*+%HJelo{^&Sypgq21I3tY5haP`*7+wZ=p9h_ghZWtfAf6voTzBxY^6(!hG
zkeI__LVj}o9&bmX$l?!fYwIHQY0fp*Ui@k1P!#yM&8*T$X2~Nh4wo9FbuH&90oO-T
ziz7F<bkx`=T0HK;FzkEz<kID1n=V~)UcsLE`hiF9+a2ZL(U?66zbC3s4)g?1E{9nD
zR!8@m8CXBlN{8?e8Fc74Y|I`EUaMsV41+wYg9q!nfqApOcEEX5z?%XKW_jx4_wF0c
z$8$?H9LC2U*o~|)`<3LXd{-+1%I3({y1;p{`m5Oc>r%tQcsaGe1*yE&eApNvNeqKb
zcO5+Pu*-q23*A_Tr3*++<gKAm@6PFW<@>E(kka&#xt;%Y;M{^e{na;Sj(1L~DX6>f
z6C&ynB$1HoC6tOtsc@(~ypLMv;>g44OwRXFyU%OQ%8c4A(8&ED7{)%Ew%7`48)Prx
zB^4|A)+NoypSX9={A@UzRP%G;i3j$wZbv+a%KEGlk#t<&Yt;(A2NOxpXkx)CnZ9If
z`EL={Cp!g4@mi_?TrZI7RVSx=Dv4z8`R{!to2<Y~KL+S$oIlw;`_TTg3HH=O`{t*H
zh!SE`X<g$)!+SY(t<XBr6#2F>shmX{K3TPbagJJ760AU>xL2h0;HXtmUbj@~q&^q0
zi$N^7!A#Rbtt;oJKYRb)`I+tvaAkgfc()g<oJ!@TQq&1bN%qU>uDKGa3WhFOIwke}
z5Y;-OR$#q4cS)UbD1fVIQtgn+6k^3LB2_mVBhzw;k6~9@MJtsom*!6mpL_6)(*=9x
zp}k=`DB4{bK@6*GE#7q|p<wHKBzfF-Nim0xKwqNO$w_Z%;NqR0J3{v&!Y1JvoTqfL
zuZMR*<zZco8hx_-f>n?eXH1^^k39=Oo1g7=KDd|X>zP3!t#w=F5B!0m8e(~=B?>oc
zjZEctX7k*K?dkaoN0fw{53X*V^|`j8RtJ<^VMTsc(A8jfTgi7QmHH`PmW#2Q?sne4
zuNG|Q1AFIB%|mj_{Zc`Ub0x(*j3P$8Y!!M{TXBiB#m3}r2ZN=)((Fwz^r83=Ck&DO
zUfyrEy_9;J#`@HL@YWaZ>p{z%o%ijr9dVl7ij9S2zL6wXqN3-u=Ignc^L3V~@<f%5
zqZg~=+08Ss3MFL`L>Pu7zr%7fCv|K=Mr*^c4RAnSr6HUhTKkl?000HjNkl<Z{>kCv
z|NMOs>}&t{-EMkVkk{PN7_~^HmJ<t$RJf_{GT)Q52F!jef)yjqivMKu<5Dd}#Vtv7
z((Xnvb;!84=m}l{v9i~CquvQlWH*LU*^}rI$J>bU!m<q$xhgt!Y{;>>+%uL+Mq{}a
z;--*LlS)DA98#akbEK*vcOxTW!Wc^~gXi$=J&E_323x&v<9ZF$7_5&23zBjYUCzhs
z49zK{B<njF$?rzRpHHeBojfot7tZX=nh<&B1}9R8JaeSWv3S<Q?1qB$*&pO5a|RLm
zTPE_Z802;gVg^(`^|lk|mMxj@(mQmhb-P{zMH@*y0d7t3u~K6vAi@?>_eX6Vag4Hy
z`Ud0ZfT~euh~x{Gip55$7csA@A2Yt~?biI5>+M-<{pD0%PBsRu_ZO}j7(<8#LU*;r
zc|K5bsoX2-tNCEC0K3O(5G#9)`U1G2XU--_EevvYYBMaM>`3p^nCn}Ot&%JLS5Drl
zNTq>K_m#b=k4bLnk}<z@#h7>1jW@46QCdj@bOcz*6$&qzOCPPq);sY_SvFo%Cma9<
zXa4MGf^Sd->);ijS6EpxJ`9S9u#w0d&rrRQb5Pff#FoplQ0w2nWW<BXjju>nZZJLs
z`zvmCE39}w)wfPLQ=+vNk(ZrLIg2M*>%97+EQ3SzkUW^33cISmvY1e`AVNn10V}J+
zQHkjL6XOj(v&6se+ErwC_as&Xr>WJIn3&8C>v(d+0@>b@#;J%uNU>6OE;xAj4AoMV
zJTrSnI7#KNctwnp#_SqlrxN39)ZeL3lXFn9x67|x>)(6jil)`O*3K`u>sHH<N-Uy%
zDqexpL%0CTFR*UOK3aHQL9!M8faOT-xh=j}uoBtw{FF?RsQlDN7|L6Xo_$lXL-A>Y
z#=rLiEBysa2UmV*1MyXKN~V+L?xOkVqJg4~Y-z@m7O#keNh2viOm|)LZq2pGR$TF$
zR%Ux`)ZIy%aa!(Nd~u0Iz2!3ABH$}--q6Z#UABJm(!sbdo=OhJTz|${EXoe6bdL7@
znOgA&8jD!;Bqsrb!uy@De^QN&1yw{39kLJ6G^twS&O(X$J?XgAv?aF64)EsR`B{?d
z=}T9SU%6u=3@V~xf<w;{50=UioFZBAr0Ha=Tc_u`sYJJ4d;nkPRSAUy#iClt$IO;|
zEO)iay@)7x9!Btql7k7hJZJNc_bgd4PUV*pH-GxFHJ45}J$!Oh{{jQ$z1olUSe4te
zg;&i2UC*V89{e(KWhIIgF<(n;DYYX(wf0nbCRbmg;Kq`)g)<`9zq(V9=WlxdiY<Vv
z7c3V8KmONOE?qrlxanFEr{MQF#wDrZL!1axpW_reBxO|KS$TZmppi$ee>rj`wor|=
znnxEcj&Y@$0!d_#lE%le&&O7-pSb(;R}L2G&61JdkG=Ksi7$NS*>0wjj8mdSXYsLO
zWj?^!%>tQ&7C#mvsz&<OB2xLF&@SOA)H>ovJoup#JC}rbH+kJu{Dg(<S^&Y^IO>)*
zPg%5V?6?2+hLxKZmlrJjVchhw`7izP^9TR`xZK}$Nq*0OTB@AwqK5A5{)5Rm(y#IW
z>hA%2O6u8BK-XW35!tCEB#|0$6Id5AgeZI>md7>iKCZ`JK*E?Vx_a`?KfPjN`FJge
zJN>7OIb{C!gZrNRhwsiDnX7S=9~FxI$ha>oU-f-$jS5$?+Z#mI*Rv9>+v+Ka+|vj+
zQw}6Qe&e5<1jQ}khlK@0mx0>+sh|7B4_)j}yHn!M_T$sJso^vK^2)BSydGw`Y={H*
z1gr!Bsc%<0nJRx>^+!B@VJ2rM308AYX1*okl77;>tH%(srNNT1U)b@Ut3L6*@x_BP
zuHT*a=fbZ%dGO``e)GudC+CjO%^jN$bDcM{@oIsRaVu7%wztsgNHD6g0s^V(M`=}B
z9r0t$*z)o5<zp)@S$4_I8!x$O{kfO@0{{R3|NpC;umu1B00v1!K~w_(=<8H{@O`K$
P00000NkvXXu0mjfVD4dx

diff --git a/packages/frontend/public/banner-autofix-gradient.png b/packages/frontend/public/banner-autofix-gradient.png
deleted file mode 100644
index b57995470ab9c2dcbcbe5f072fbd9fc241300f51..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 74389
zcmV)BK*PU@P)<h;3K|Lk000e1NJLTq00Pbc004Lh0{{R3)jot@00093P)t-s0001h
zf}V+rpLThjTVbARZk{zeo<~lfAS9iXl%nzP?DO*O@bB*O@b2&J?(OUB>geh7@$l>E
z?(gmE=jQA5^YHKP@Y>q!?d<U3;qK|^@agF7_4M!T>g?+1>(|%p=;rD3^78TT^5^FA
z?Cb92<nh$h>h0|F=H~A2?dkRO^5x{{?d$2**YNZ4>-F>U+uZNv<nHR}^5o;}^6~Q7
z+VI`o?B3nz-rnxg)9%R1?f3QY<KgS!;OEcK?)CHS_Vo13&Fs+8>)zh-<Kyn<=kMFv
z>G$^Xm!I*_((=>Q@~5or-{0%u;qt7o?MP7Z)Yb0j=H|)D=*i6SoTKjU?e6mL>Cn*U
z;NS1CwCv&F>yer9@bC1ZsO{I+>CDaO@bB=hv+=>i?#0LIl9}z*)a8bc@Vmb5!o=#m
z!1BPv^0m6~jFaxn&hNj$>QGqn?CbEjyzr>5^O&COf{N|5xa?G1@;^rL+S%rxrt!qb
z@#W&>O;qsP-1EG?>GJUK#mDZryX#<R@r;!7XK(UYVDd~<^+QVWcYy8h?()9D?xd>n
ze~9w<_w#Rf^6u;IV{Gi#+4S@B^vuumV{7vG_x8oc<$Q$hdV=#bJM%R>?mI#6o}%bF
zLG!J!=k4p}b$#+&WAa>O?XtG;<Ky*fbMjwk_d`qd>FM@SS?u57^vB8Yx4GwScI?2x
z<Z^rNsI2E`aqU-M?SqW;XmR&IM(nb+=O`}khmPq*OzmTA_l}k5-`(TO%i^4*_AoW>
zxV`np%J!9-=1NiQhmrQ9sOL~v_p7q@=H~ZqclTOj_g7%|*w^Fs^!6<?^U=`Zw7K^3
z@%M9l_sh=qy1eADw)K#i_dZ4TR9yE+Q1^a^_i}pZeT3(Df%nkU_b@f++uZo1tM}E{
z_rb>Zq^IG$!S}7N-|g)8#>L;8pW!+{=$D`Ov$f$OC+Yh6_g7!%gNfo_XXh9l?rL)7
zy}jMw;rSsZ@kUJNPgmxQk>YoL;Xg*=5fta4q}gF=;Ej>m2w57>0000AbW%=J0FsiD
zl9G~=l9J8wIxqkM002ouK~#9!ME!YOlXu!Z0Q)!l9ukDGhOiTs1R@{_5Vo)dFa!vZ
zB@ni-BT$U2ihxY4Y(>f{R%Az^Afgte)|L*{Ql}$0OlKGh6pKFk{9HP1-*fxC@8=ao
zb|YN(b)WA!=Q`IB#rCK?Wly1~mLKeJ*s|31_EE0jV4d5Z+CEMjm+ZDnNP_lVnq+Zz
z_q97MX_v-ZTof)c@oJfLjj<>#<FR&mt84LVQoOnvzsp*cdaad7d5f#8vc-IQ8L!N%
ztZXgbdv%q?Dr2$Myl$@=@re(>>#VXeFBW5U)eCQCmBp`?dAWMWvskNid<wmc<y}UP
zXW?~gd?bs(XGzz*;$2zs^i>vrjl#k|%;!<~d@n{onO8hNfcSD0*8nMn#m_IJu;_e#
zfNR<Ld^&|r32^l`((%?aGNS0|>FHSNB^ui4*%=vH>R4JD$HtnQ#2Um##cF687#q8p
z$Es_pX_~3&>iX)csM*`9sH>}}`l{d=eyP|TJ*uy(t*@z}7UgDQtfgbDmxwQDbe<nT
zk9UcW=kr|10a6B&WJM#>JZMx8CfCZ!*~2-GM58%-2x(NRyJsZVnd<qKGl$deNsaW3
zjEtmGojH-tk?ro(NOuXx&o9!Q<}L}NdU{^L#|tg+IaKB~yvX!$CQ*gtI4hDrok#XB
zqr}I%y1Fu~>2#xfbG=v{6Sr8+SbJM-CwnIqT_-I!do@jCgIH5DH%kLN>Cy8I_2@<v
z3d7Z(5)g0g!sPRqR%9lg@Fl6ve$Eni_ecjHfx90klH*eq!cLL@v#}~=_F_gxMs{OJ
z_~1%rNqBhCLUMR^QTTTYK~0;<X>&OVIq45_iW3qZOyt}c3u@RHn@+f&ewaR`tX*!N
z=^QAXP*&D9w@f_jQw|T;JX;<vZS9Y!KX<i${#ncAv-=VC5uXiL{yp!@fm44k&AVHA
z_HzH_uCH&MtBg2%>YH<yKY3jF+5Fvyr~Y2~N#4V*nNLdd&UJnA*U!%8eezlTCzsFu
zzr0hQesb!wQ~i~H%{zOw>$7v8e0l1~UeBdJw=Zt*DRvGNoSpIU-&4nBvftOo1rh<L
zox8&oyl!6<N`&K**HYoGFo`A<E+*{?7Z;f%=3>&KbWOU;C$F(yudS`}%huLdYf>_0
zmnB_gt;Vl0P~&B+vNh{9dfD2ltLrMutBkeE!{?B9%gV|ai~KdOReT0xZH=<J$SPaq
zqlU{C`7C}JzJNE&JKl@F=*llEV=>}g%gUr)t~`E#Kg(6hKqap-0_eCDP|mAf)-2c6
zviNux*D`(p--}|+%V&Afz4BQU7jJL6E5+-PcRt<D4n?eEh<dg}EysRjVqzR?s%htD
zYG7yL_K|6uR+NUOv8I{5nnskGuDY6*u7<iBYFV{cUtL#4T~+m{sw#@vQB_}GMcv*_
zQzO>+<Vgd~SUZ%nw~n=5Kp7vU#o+S-$b1Xyq-#7T*~0==hcYCQX+P7*?n0_X9F-JC
zrFl9_xI*W4S|rU`;4FyaIt!>C?UHNUb}E%d_2ZJL?ank0l7vf*W8zY<5|Wuo9v);e
zndu?*w_=hR3|zVaL@879^Nny}8X1}zxM`?s*{i7s>g(F;tElMP+B@lLXvBVOY;LY&
z5^H3r_pP3xk)CU!p)19j;U7<r=kqPf_#R}dBrBQ))t^fZ6G(pMwnut$Jl#`0b7zC)
z!MU>;DOJ&pDJdf>71br#8JX23;i5EAc1-x7s60F;c_An*r#!SNrm3T&IAJQNJUwAx
zYNF#o`qW`<pR)Fsx4+a(wJ3k7>1?hXZmFMG{%QVk>wLtMzKEL6uiwmkvvsPgrt9*#
z%3E7se_nUF_4Ch4pMU=B)4Qj>?3(|2>)hGrU+(vRcK2M@mw9I+D!+L?{P+F5vncz^
zXFrdqKlRy{dFMX+^z0{>PeoLI{p0f2ckh0B?(@8FPUU_6N!O8{+3mgDZT7Zoc6|Ln
zkh^~6_gM*N{UEa4VSL>0!1?#_#e??OJA!tL*RM&`-Pa_VP?AJTVtTyZO?sWQCQafm
zu9dk+S>#>HVi{j5by;KWmbvc6uaQxgtGn^5Yir&pwpDM&8h<Um%$r~4#Y5*^^<toB
zm#s-rr>xaAe;)d?l<vRA@aH|+U8OTvYdY}(UaQt?E^BM9QeOOG87qHvm5xu0ca7&W
zTp0l_JZZet%gZa?1x-28i%wa!=Am-q6IlT)Z?tDGx}6u@l|?af_0BgsPuDZD^ft1y
z)HAo#Gte`1Gu1J0GuAXU(b9A?H~EWJl$(~DmVwq8HC?kaYHd;W+Gx+V>bB}CZT5k^
zHtII2s=cZzZH_9(0v%OU^;Pgu>TYIQS_U7*8k!gyprSvf>sYfASqv9fG9Cbr=^}MO
z+e@+{39XnUnpK<?(<9EG>p}CNT7{9~s2&!yq%aGrvxG*YT3ONXO+`P)yUB4$R&k_9
z5*itwW))}QL9!OQ2$RT3W&UgN%tSt)?!u3!xahg&=jR)qx3e?!wzQ1ZFw-<X^R2p*
ztxcPawi6z+uC}J8ZIoH80ot?WM;eAkcIPe6>*(YgdIh*rT&*b#+(WGS<Ny~uLQ;~m
zg$0$wm4r$BI8@GQPyF`zN+IVsq{uI_Lq;<GIT_MD*|-v3@NRJBU*ed1jYZ<{0`Wp}
za`IsIW^vQ2G*orr=0wcB+Mqixe;DWpYMyv7l|E2&XTMh2*)rW(zxA|r_*`e*jp>%U
ziE~pCt@F(_rG0s=oqroHy)pk~*Z$>*n-6CyFK^xK>OU26x$eu$x4vF}`uW{2OXp8r
z&8zGG^zrk@&%6G9_mjN;UjF3a)~9(_yO#e}AMw}WTR-OA>iVSee@f4t>i_bSyJsIq
zT+KUmL{Tz1su=CrR{YNHIgpJW9B{_hM`i2-L2A2XhdWMfZ*PCyE}=1ZxVx_fG^v2P
zOWLI+y$1Z?ElO!T=IbQV;-Zup4|oCe!CPEg<Gb#zNztmMzyqsNsgzQ-Yq17s;4fvZ
z0$rer%NAXLMfj^MUVPaagC*soGfU$aUDsCQ%UCGsGU9JO%PU^$T1IEZ<CS=N{u&xI
z&x^vd;PY9o{;R9;JcbvG6##(a!eXISG2*=#EH77<m$yq|nKz3<xoxN8Wf$P(?e)mW
z`$H2m)U!0QG&L|ZwKUN)|0oteYfFQZCR*m2#<6Z1#+qtcW?Gu+y0P~9>gx9DDjMqQ
z>e{$*I{{~?tLg`~*&J1MJbvt$im!^cuKF2!O-*ArO=BJNSUVj9J3Sp8Lsui$0Do6t
zfOvW$kHxd_=P?;157cFnHCbwr#EbK{B6-9ysa9mF2bE?aB$49qdK`&s#iXJ8Qj_9@
zsPZ^`ycOAlM<#iY`Bwf(7EBkuzdzrL9*|f@ca5i03|$TBmU@<kdZxxECu3tZ&G2At
zZ5;Jg1JzYkv{h8pHE>b-YH4bnF#w7(Ha0ggGX2=n%fOCqbUxoTKL91|63>X|yYR>!
z3^ZsfTyD-(s$ZCd>(G8Bl^w$2$U=N_6}c($s*#l3$*PRpl9ZCcl8nrMEewVhg=c3L
zWyU0@h5oRaR`jAUC@noaW+LZ@v4({72OYHyHzvl4CzM0!4~D0wYa1%38fpff^-s^=
z8Jf8<GkmqPB~STHYs65^{x>t{`nP_pJX<<&t2E;It+UH#ONTz)uYBHlYNoXG@~P6+
zAMaj0l^0R@S<UBXPhI_V_|wl${h0Uc^K+kWMMQja`R3pHKRs9a*RC!AkWXi>Ms)q{
z*37BAzuo%uNYCDA)$Hib=uYmA&&9p#3hwU*sR!Jh$Z_C}*BrrXRP<|Fd%FZkLn3q*
z3Q6e8iyn&}LZL)Tm6D`1;o@uN+Tt!5;8}`Nm9DL>5{+{g1-{0RO8wE5`MZlesnr?-
zom^TbWv!K2z2=ee;YnVrWlYv0FMgFFWl7`9TwT`k$@Dd#Zps=1U7WwlWU%7P7`P&c
zA1R*E{k<42JRXa}qTt5v6(2xn(7niO0RY?9uDp1Lt2e_tp6*5QvIcGju*mnK=j-Kr
z=ik1qr+41lz|z}952awD<90jN&C*0u^Q5L`Y^;`no90P-6o$R6ZB(0@lf6B9vpssV
z3V?;ay1t|B313xJeOuL|$BzacJ!<Q#tE*<K>!hv$$Z^sQ7lq|*13f#hL?bUf6iWag
z5`*DoO$NGU!~>(c@EJUOBbZE!Bo}`gkHq6yC3#ryS`megYG?A9Nn{I>70-ibL2|K9
zvi5h8GRZ7!p0z(Y-Xh)~=K<IJ`17uGiV;OePsh;E(!fp6#L`XE%pg`%P0dMPUse5R
zuPuQ61$A6z!20&OYHDh+X0fIxEn_Xsar-bbKp*!u(lhi*%xAgcQ3b^NC$2Fl{!FHa
zl?Ta#%5}D)Idda9euA(oiYuP(av59Zkl|33Qhlj0Bf7DwBsx4=G+2-+Do7S(4JQ95
zt0+i(FXo;&CM_nY@IhftLeODT@hfF=?No7kM{(!NslLu;Wzf`ov9fcjd0^_sbVFXt
zOxN&q-`l6HGxL?_@><{YKlyKeP3vcG>Tk__Ruchm98o%d?vuW*p~s&O)m;7jT*UIN
zt%u*tocg-*v---?bGK%0UjF;p%F_CXFY6-uzrJ~H|Fc`?Zbp3iX~f@auA<ya|EK=c
zC(mylna!P*%Vpb&omquk<}>?y>UwIbWOQ7x!%Y>8?{Ib^+uLb7g5TR|<LwgeLHqdY
z*AkCwyCmW3MUNz5l7vKC6uw@wTI20XUt6pR*B1GtU4LK@GG&px=89Y7Dk_=GV4-a@
zccsilei>_b*WyE6GuPI3<JS1Rcz%4m*BTQLxr|J~p^_ILA0Q<MEYewg|20=!1S|?p
znmqa{kB`$Lt_B{(nneMmrg*Ue_yK6iQm;fWmsLiYp%>qqPjO}Cd%1d9Kl0Xb#qq~b
z4`)E42tI&ZOK$@mH@lDAH0-pDV-2E=qhht(G_^I<%+$5ii6T(<)#%k$Gt+jmQFpSj
zMJ?OdqEb|k*{Jp&4|H@qdhCSi2~`^v+cp(jz-zOUnmA^~S{mOr`q(nx+tT|H-IX4n
zAK-0G_wsjn6i<n#Q2brUJk*a119ugMlx!ijK<!Fhtdf{4fBz(=6z}y9ATuZyWemPQ
z!`~H`K|nkuz=h>%&B~_-1n?=Wd?R|kx87|)U_IOjOzezJwcMOyZ8hw5o%B`oRgc*o
z1s1xXYHP1;@2jGwOB`g~)HF5CzBO?(F?X{x*CD<E28Q{13>{Vg9uvcwRpt`F;}gxF
zNsFU}IbR_;f8{Lk6F4|TMqcO0J=qt7LsHlwB_SgtjiTt4OO4gvFO@80f3Xr8UXUhU
z5HA#Ed=ZmXzL_={n$wiiRGwD*Hs^<gro)_p?>ZV<lnKqRYCDuIIS*=X)D)+;-XEJ*
zwzj0VbWT^^+?sy4|G0nR)bpX6`=t@3HFxVTm+sf()#a7;^?zFTNnYMJ(=B;hSC?C^
zwtiN5YrpR7z~A=!@7Cv?>;HWIc|^_KQ+Q$K)6&mR-Fi6x_|zv6!{5y3eYRY4HsXIG
zZl1mQ{K(|2T+y?gx>F$=_1T`ixU+X9b#zA}80Q=a+IKkZ?E>e69nt}bbKoqX34}u7
zuCvwa#dhIquH<#x;v(-r$mP*UyG-Gll$7+EEL`06_g@1j-d$TwDl1D`U6t-id3^eA
z*&1)nDv2-MT@y-Od23Ac@-ilcyeQ>Md1PLh6qvz_?=LN*Fn1r(%gX${%KWANUb}QY
zE8a!A79h3eNv&CQX1u>Ei;)OQBfc!2Rb~yQV=W#(9|nsO@9jl#T|MvZU1n|R&2Tlk
zecK55!Y)6+$Qvg>b8jPWOCximSksRzKQeLCj8!v6Up6o^Gc{Jz(!dYj*i2K+OvBe6
zgof6y+A8SNDo!>|s;Fgs{R=igrESM;E*uX$e)O2F>akzJbg0>=scAXIYMlAV(%2jf
z0`BQJZh3?0@J_ULb)^RoKq!FXh5JWYJcE*0#=w8d+Mmu(is$hu41a$zlMzq1cHza-
zS>PJ@d>1bQ*z)7gGgcqDczfkryBfyl>)bXpvb1#b_IC6BR>#gw(_Ayw+%49vO;=4r
z&0byICQwx$mzrvzt-iV~kcPgRy|0?Cy{}oUZme3AshXvMxrqU=GmZ-8t~xjnpAXOh
zm&EeQXHdv|raz#@wInJ!vz13A*Dun+&+|$u=L%=^D^Io}__X|Db#C<brIeJ4i<8|U
z-4{hg(b<jR;n`W@f`1i-#w_KO7Zn$z#fV?!<P<gq6&E(-bjCCsK4?}B6bAJ*D2tbe
zo5z}O)TB?{{B5AF;mNS_uVeL32U?b&*PL4JyEQc2KXWUu?&gikv#sa)hpt}EYptno
zoqu{c;#vRm8@HA}z1sKb&8}OO|L^8}Ug^`zpZ9(KEbs2ai2lDXU#+=(we#}XuD@?x
z{;ccfr=@xSFYoeI92#$4K6_+zdvAMoyK1j-mc28{2ILq`T^}D^ALnuv>+1rC)b;iC
z*W(V7*J#c=q}T52?c?L5@ub~$ppIQ25T=m$1@u7^Qt`J?C|zXkTD;~-7>jE>9&<6y
zMatOa`-9o=M+09>DwC1{uSrC+_TVkD7A=4>q-!jY94skAh~kcy5)_h@$qS&A@xWx1
zF_}1Tx}xOE;-z$;5b`Q7K<WY}10}-u=egiC=w;zeVG;LuS9EMw2F3f)D#hE{+snuZ
zfc9fOH#<u=OK(d<6FU<VkaKRPCZ@3(T3Q<BYW8YTzQ*RpxH|(kpV83Q)z#M3*HzP2
z2b-Z{>#MG!e)NK)s;Z--Y9N>m$73fh9KUcvRYfIG*H%SW*QpKkfw5C;tTCFjxrvDm
zs6RVHBOSeby+oFd_jzwGz*TR`Bl>y1i#4c2Yu8oW=^3b5FFr5{KY$Y89Z+`OE5O@}
zAAtXXj;nP%u1P~zR~?*SfsPW5?2L3iHZsw{<2E<2#6J^dreUU~p=;wyU?J7OUmaDC
zp11(kMO|MN42+ug8TDRm4Zwb5-zYUraEY<8Zh8j3mUw2K@1<j)=S>G8#5f=C&-b_B
zGYQ~qC3K<2QMoifNtnRd(~ra9a@^T$pIo0*8QbCFNVUA;Vs&Flc2CKrjFQ3df~A!3
ztfg*o+7}C%F+ofJ{vs`=sQBK(PYcB{Xww~Y32EtvF%365ipQF!iwA<H$66-tEEoSY
z_DkinUnXXz?howORkpUieVjKuUs-c@xc=r;#MS5b&($oSnjiS2<?_w>XXj>q>}rXa
z`DPjjWBKO8np5-Vo}L?ysO<Wz?#FY>pOtpCR(^f?@~N(8pWnLt>1QpEKUw~=tLE>e
zm4B=M@|%dyj#SO=Rqyr8j<VNhdt_Cqvz&uJ<*4C<9l^o)fqW<Rcka69`VNOH7+<7~
zb0w1Y@kK#9Ev|i6uuB4J7E%|-lU|cv6VzSOE+}d0BKSMNkVS&Q!};)aToMX6sf@%#
z>63-zU7-}zlaMd;cuh`P^Out8Bq2VW=Rx)d&}LdtEqJ?0R!L<^Lf}m)51;JHw2(?c
zgO&M%ROZL?%i{UoC<)Na4F6RZMtnSv4z7ez#<HffP$v`yDueE-N7uWZcwW!i`}TRe
z^L9ph`8tMn1}5ep<xC8;eBDg7Q5$Yx1vIp6QPo<yYG=%}Q4iW?pfsY?RRNrB(C>6r
zRgT)&ItHqqIC|{paS$7U$8aFj2a>*^qM~AtZs?>2@NE{Qf%B!Qo1vX0_-rE}RU^73
z#fX)7-bg3@_IXsOksig>g_ZAW?PXo&6%e0j?Va!HQkGArThsH;2Y4B=a8fhOx1;A<
zp4T%pylrG@WTa<j4w!EOCehr)$yf_VQ(chC`ey0`)1vBo!SVQU$74rN;6hWk@wLJ6
zR2T5bULAa$hNhdAMy!TG>_=v1mM87(+)Ui;bnqpuz0d0<0>s1zuoA6V79ckKaTbiT
zvWOFcWQlZ-bC!5IIQXTWcIe6F<jQ0jA=M+JDLqw_(X%15lbIEb;f*Qctm?tgnB<kF
z%!;&b(9ki(_ryhM8~0uXH57L=BnQ0=s@qKO97}jPG0~jfycKk(vv~fu^jkU0ox@KD
z8cy|1KUu!9^>%3f$&Hzo0rcmZ>Bp^o_XoOe&E%bHeb~BOI#BoQa$oEJ417I(?(Ej%
zuF6kK?|!*;_0+@puDt%z>C#*CSFbLgou5ZDe!L&i)%9@x?#-IB=k5;uPwCd*K-7(<
z?B(XpZjVl~Q?}WE%4WepNAD<7#}5RN<KwA<)B~S&cY$R5clq@L$#~=rRWR-;5D3O;
zuOYE`qKZA@P{R1z3iLE+j)UEHrqF-U0)$69O^QkdPc2-u+D#$}cWJNDy_vgYq0mD}
zUZgH2h2bnOB#{>_tdgXF*!aX<auTi!vJ^*sDc_pMjAsILl+pbe;89#~pQf+jF7D+@
zX7MRy4A%dlO>2LOH*TPbEPDK!wb80K%g_ryHbWh6Z@qk10yCpB+`J8SEbUA_Lc?-1
zH3vTzYo-;erFO>NS3~!VzLqU&`iw3}0^2Bkm0opSU}sw=75xiGRh{%vF{&3(%{Gp|
zIvz!L4m|336a}r~q^quCgW6H^H8U`S24nKANvz3j^H^_FJ#!;-y^jqI?d<dj@DBaP
z$Q#@@p3`r;y6Po*pLazUKkuz)r;~4IZlq^v;GLKVY-E&ZX?Om%8*q_{xt--nb5o6v
zV>QocoG~`jz=>3)*FI2JTiv$zn3LnNW5;oIsUK5yJbF}Bzb#PJ7ROfIHr+F7QMej)
zfr89poz&d4w2Tdm-AqgjEiLVEk20co)4jc1>DExD;w}8GllVzwE2@h#Db7k_WdR|D
z>*wC?H|m_L;IL1xvmHDYxfi1=qN}1O|51IZqA|03<sT~|QN=<*L3j3`xUl<&B5`?9
zOlVHbzq5mq=bDN){@oE&{99AP@Yq1p#7_-PwK)R=%KOSYt;)W-mgS(CmKNoknyu;K
z;ro|w%)fay)Ex2h&CpPPXWnqj)BVn8HJ9s$pY?zG@V}2Ew!WNs`g#4sy1O-x`y;N_
z+?uKT@@D-v)1TiRx*T!t@&Dv~-BnkKBjwlUN+TlvKKyC@<6D(C|5ktY)RC3h6@_AQ
zdv<iPaW8c{c=pf8(b=8R(bS#w_3__j>nPv@w%~X6jzI9c1e~2@XMDYVht@7@m#n99
zg^LGqC~GPgxMN57nz<-!r|k-b)LoBVVH|C7aW@I-AqtwbNT%)5m>x9JYZ{?-0iEok
z(4|zN6&cmej1wl|7YQ|PA>E}Uk)%8xPs&7Z$KMu<Qo!+e6#E*J%!lT($^<Uqm+|~@
zCS=5~5}Kh4p(=nJbn&Ld>#>aJMy`o0*L)p2FLX<sq4c~B^gdLLoAJpgf~k##{ugC#
zZ>*uA;p?QUX0LrlR}FAj8#i$$l_-D=6>xJl>IB{FsNZID!uF^Qo{r%+8sZ5@M@O4u
zXwItk_D*M1w0!L~G|$9pYMlJYBnnW~MAObdC)UKwPUj?~3p-S^oeuFAQLhGQy<SE-
zmOALYhISt`9ZPd_TyL=kAS-lqV)e}J+$?YVS{fV2YG`PwX{tr3=&Jc@^=fPP>h}^4
z=cwulJOK1%983W;@W}LS+D-r&fuU2^f`|gRq^9Mjdq&gAIM&=iQ_IxARL4%o#LmFT
zT*uDn{CV&^u9ScPf2ciD3nq{0!MtWcWzxdpxDHfmBvo)d)!lQ)FC;ZJm+dpkCWyM~
zl#7#-?27K_?&_?i?954V)<VomcUnozQc?24W<ht;#uuA&3CTG*X?NakOvN+@ZQMBg
zr6FgcTnX}SXka+~t#W=sx!gQ(e{8s}`2O(I<>_aA%IW^fzRL~EdBX$sH)<;nzZn`j
zJKR4#eQUXIzNPiQPX|ur4cFtKIA8bqaztM9C;Rm^&maDEz6OFz#ODwHx_|D|{i|E^
zpXNo}t;wtZe@{PO{_G*d#L6R+E22NE_qHc<w`WU$Id-<$ik;M1#pHo36(zhQWAAX=
zJvp+`>s<K(x-#gFaU2w1gSwOKE{@Y^?X-3X;W!yOgU=Ik1&e+(5})?E{q^qdA{UxC
zjS9IJL<kLH*K3*wco3n0mb8ejPGzFbNgh&KQacYdPp2i(q$J*&(4WcU^H9+&f1y>t
zBFle~!uPV`NfZ5<(s(kNA5Si0Kn(<c$6ztaaOA>K%F7k{I3NaI^`_?sB<34=d)s*f
zJfF8i>FAj27@FFdSn9>v#TsZ?eq<1Zlc2HY88vMvC+hlYnxHl8aex9|CNyn(TUB*!
zb!`<#C;bzFfhW+N(VNkde+>kBMq5Nl<2AHr+~w76v_BM(h8r#oZ7l;+H3Q37w^(yC
z0|0bWQ@hxcCWeMOh98@pG_fPlj(03Lv)i~$7@Fwm8CssSv@?h`w=}_H!bh7~g3E@)
z4uA}qPfb%-`;0x{g|@oAFK9x272*NlksLpE6qv_R^*B1S{_zt>Z2{#WU*cYY`^ASV
z(@f3D$=ul3*hEV!*3HBKRN}`v<^&G61G!`9O<4_qrpjV68DtAcJ#khZ)Hs0$O(L-p
zx_e3-JbhB#Ii8WZY`H8rcQiPp<dRGjA`7lc5naC|TFJ~v2^WROq=>r3q2<Zpg)wQ#
z;c3}(K?_aAX>*|sLCTn*hMcDKrox1mEiVuI-rh)fS)1O_a%U)L;IOXlaA;=e#+$ya
zx~`U~{^9Amspi%<&uUt3Ee|~(nx2{OsGlDGak{2*=Gk=3<I?GwnU-7oHIL8LRd)4#
zQ+Km||IX0-<>jllDoZ0S->g}#JU7!{U;pE|n!1^Xe*=&G`8RKlte})dla0U_+ltxh
z?LGOQquW3o+qsH^(H@`F_3icb>%aTRB<nltY(Q$-DB$yJpH!|px4qq2Ac&MW3tvaJ
zOPm+m$J<fd<5Vt5xbBB4Zf62UJHK9}?Fs;`2~uQH(hicED%fp*O%u|XNz`33Xlo%}
zrX~3UaML`bkYxOKrBaVI@}d<lDM@NY=B*|1tQY-x7HHQjW|`DQO1FsTdGQ!70W7cq
z@j#zMMN=rQ;5>Bbu4UE%=jkj%BbYRB>xLGnhZbpY8=cAWFD5urnb@5)H8%bz7DN^S
zHO_$U0_s%JZ~|$of-|5!+92pT;z?iKQ6*4cRYleDSDQev8YmyM#kLRl`Iw_^AUa|o
zP&8nPuC~3plZLLnrjxp{mYIRAMwIqR0|QgDlTa}}GLF?Ub^9pR)Fd|6M8}k9l%~c;
z;6sev3}Ur>4Pqg;YZ%9Bx*4DwtAj29636|*9xON>m#(c7daq*}9>4|SYC3-W#IM8y
zIDQP5S|E<7$8GiXLBr_V=;Nkhui~VwqNRPtS3Sy1&ESld*+~;%XRyz9C%tumy7Kk(
za2o^n=L(Aq$P@;dM**s%COK0{)G!j4>gnzf*)DTf=g8a@o^sFJDtStXk3u2OI6Zku
z5j;Ctogtcx369As$qp?jug<K95od~%L&KB5oBLt2>0Vk+!(8}J#bf1Z_j2Ce$+>^$
zusmmKtoAo$=h$%2R_E|Q-&pJP+kxpf&)yEqFHa9B`#Oh)?<-p>-%d}=-<<BewOltn
zG1R&hQPWj9)3^U{rln^1?9Ah<Z@-zIf3o$k^l`+w`qI40t@~a5bs+s_hHf^0I`go;
z=EwT0H@hBQ{;~sLV=r9MJy|W<o?S_Kx3k^Tvn}r#on>#!cNA5!^;!9-=lZ%#E?6ID
z@4%NNALZ<DJ$*Pk>jyHZh2xRJgVzG;_&80_E*anDNFrZL#$U(1ejWB&xI50>^^=T;
z!N?>Pcr02-(96MIlXjg2LJ4rlYbu&Ejey-W@*<5%qb3RCUXz5<BpNSCN+L_+)_6>?
z8gUR9q#m%!@c2>^gHKMPm-$;jIOMI82^W$J{2Orpz{KF?8XxZ+K!Ksb`}}P?LoXdK
zJ@5>m%>X!X6F2%69oitu!1Rn3PJqUL(Ts{h+jCP>1J+Q{hb==Ja6>yv+eSsz1|^KU
zx2>Z-Bnn4JCva>y1|C0t%<=ezW5@6k3h9{2i4$nhaC7LZfQQDX!s(%_OUQ+4#!<dn
z5Y54O#DWuyGBZA@b<)_)xJ?7T5TG41=+7p`n#NHdoirdGixxf(CJ<CI_+o$yU3D9M
zZCw=t4Qs370jL7EL%|6=`u~3b#{zMG`0xM-c?UNYJYpw2nE!hK>h@Z`QJQYXYO$KQ
zq%5O8HjM=aBEAE9w<%uvI4N5*T=`ycIC}e&tUTh9NHhrV?jFuGYNYeJgTRL?aObi)
z?y_JRn~f%26`kAIST!15T{5yKx>Q}UlrdOPkx|gSP$Z54bnea$nu|#;N(fEMNlPy-
zj)~bw7<)OWe0686qjPLdnbtg9Uehsf|K*dZrsnB4W5YMzHovJInwqXT{Pay-%W&tA
za(G}~*?HLCGB#YV9C|)5J>L>Bc5{08*>Y=TUTbS>M15;bP2SMCy3%tspUe+^J@I*7
z&DW3d_RnV`B2Jy{$MNv*%eQ`<ug|N51!-@xq<XTXr(||AcW*^Dx;@*2r|s(0+3iW$
z<e!RzozZQDY-fGkM=oIhE*Kw8{e67LVMnsVNtH?34;&&vP;(Es0xq>(fEG=A{aV-#
zC!QztM3RGZ`)dG_aS6A5ohBS7aZ%8ME91_u$-ouDq$`Ug2^AEd!~^y-A?lgDxEMxS
z#Ctr}XgoehKo8m?dNeBBV=amAk8&1T@ksnN@|w#k@H9D|;V-2G@IX7SQV8wLI{+FA
zY)4*jY#7}}f7USo?Q94cP)FyZ*uR)UQ!tJ-{y6GPl&^+5!8F_BnXVd47-qm1_@!?H
zvKg&T8-g(oS}G@ws`MTQN=0KnK}dpu;Ofw#PvCgyc+`eqI8<$%d~MWK^dXI(v4sgw
z!(Lk#l8hGa`BCaxwrWnA_F4ufq1k9g8JscJ)-*GQVNc5~%1P}E<Qpf@gP@SXs}TRX
z8kl2ydzhR);C7<-JDxb|*n9N2Bkl~xhzsjD@c{7ZiK8}w#B)3VFfV~N#3yQN131Aw
zWp9QDV2^+1WYkGhUtB4sCI+!aIyy$Tjq-6u&i5j86iQh>nc?EWaDlIc#6)){d$>FM
zQQcvS5>Or3o-!W^e!iz=GKD~~Eo&UjC}~WY%&5LpU6ryFJ-8CS6uwl^o&0Vvv^zO@
zE<3ZhFfDl_IY#^gsJh|?aq(1Ihcc%l=P>8+L3&KX)Npa_fbxcNzo8>9VIbk~eoexg
z+WjX}EjN@CweuZy{R8z%<^74i*1oG_HBaB18ybq}U!Lxt?vJ>!JpKIU^7F5UBTBbw
zuFmvN*Oj)^J%2iUDq`!$&mW$h`82OTVz~cu>q8hmhGtr8j;t(|Os-UiFQu%k^z@|Q
zb}~{89=b85YHyN#u+5fNud@}3_1pu+=p+t*zYEZn$K~U{j~=kMC9-v)J3us-`+MY$
zEcIX=F9Jm4`R`OX@gx$#P9%^wsyPzpjMtuAp*wJQyM!vBQSrhq<QHcN&W<E^A&Iv8
z)goYam{drL^N=Jh#xdg-g=Eqq+A$NqN&Y-gcUB%`SexQlWSID%zO2El0T&za24gK?
z)yuz(<pmXu?ixVPUp2BuLF>S*frFrdouy$c?){dU25u&rmYP~_#%|iivAXu^W@yiv
z;55`w%)Pd#Yi)?d+P1iJ+t}jd2NDBkE!Cs8$B&|tjye*3(GgD{?)8q2$9usn9J>G!
zT-yl{1;kyiin<vvi<-Jq6ewUEFLkxFqcn8&wbb0y%$zi1HPmfk+0)eklpw4X_7Kz|
z;elI2IjZ+w00f39PW`CUQ57(QM=zWpKzbn2jE^2WcH#f`0FHv5!-KLp;i%dRxN#H|
zjFXf0|2+VEfPdU2Aaj1Cc1FY4K*Lzezz*IH92zWf4%MRsB)T%Z7~a-UQ^9#A`MV@p
zkRS~@L+U08EVvF_cR#96q`UjLgWS^xVs}XHsAsM`6{w>zxVo`tvZ5p<v;<z!f}RpI
z=am-)VsS}k^3uKV&{v@wX$u{%ii(PggWw!3d~*kdU7SAgvi9xR#9V!PadS}4R7*!g
z;q=th)O5nz+KIZBmz8}vdBp?uQ+ZQEH7zw;PnPTYmG|og9=3FxYM5zheR^*Cam{{9
zUEXwEP5r>wH~p6*rt)qr|NTwPmvwpdTbCo|w{FdUSu@lh(b8J~{F~29k96-Xi7MVL
zO)m8WXY7T9rgry?ZdXH9Ng16T-ImYFeYPiY$o*5MIN07{b2ta%<2#ZAxlfPt_|5^h
zU9fY&5wt4=;}XeE80YtPXYd|efxvkjpt>DQh`_=9^*AJ%amj(R=eU3-LCLRkN#l_c
zVVnThfrLZ?7EkhPho72iL29?aafC`*^za}Ki9DV#F3E!-gug6)k?BENOd`Y5=s~8r
zNO=^g3t0*e1YOFb!!$}~1<+R?1+2Q}dwJ;@(E|)!VG7ct7(o?IGyz=(md@K((*#^>
zlyPj7Hem)<`&dIm*GyL*KtmT*hFi3{FHC7FfhyWZZM1DcBA{kKF&}L^aRN8@UI1s5
z6RHYF!3)Ph*!_C!1nM39o&HhuQxzxu-Zqrf1>EnoRn%?q9Pk0Z^=)<Sb=6U|TD~|l
z0-Wor0BGabsqTw^SX~7dkBW_|Edg>=E(D&y13()-fm%KWkb#5ev17kFIvxwWaDt#!
zhz9_+&<5g8piLV}I#3&*sjW|_Kl=JwZGhdjaFl3kXyCd5u|Y^YC(U$B@f|SIx&5&Y
z!GH7P19<d&KArFH;^Dz3Gp#IWBzXLULU#%6N|?k#62{@Wr%GVo@$pFwk%54|UNW0|
zDR@%eSUowJTM;eF>{%HJ4Xt|jkL;p%nS-K*C2_VmEqoy~ydg7OIR~C2s5~bjydj||
zVKW^bj-c{}8s%of#Ke5z{kn;cj<-W&hs_BC9Rn>1LsMf7HTTn|TZW${EKg6(*QDQ>
zzf)7Y+&U4Vtlb~#9IF``xH-}P%hqQTEl;-|*7VQJbk_9^f8F2p80W?P^jrHg4+m~_
z&F4+koT}?;Z9TH`B7CXwU3bsB$v?Xrmoi?6GWV)RXL}TTxg}L4v(>Yc>>i(4na>V;
zR?&msA&T~cb;XY2AXP4jlncOufbmH6No`MEKNyGi|8?YeyQg3s6v$2(H&U`bE|HB3
zxjR0D0K*9zclV@uLSdA=rnU=F`>(&E2|ULm7d-^+*MY2e;{>F3DhWjlI%L-ZY84EO
z!fQe+7}%4@JZ4f7PkN2)pM;lqWn?C-8y0Yz2Eg_}arJkF9!}>o;`14x=)CnPdR~uo
z&V#2TSTf7oI1XtVY51C$$DV=BJ?f;EnK1|hd#yHT#r7&{PBv(v>h|`w_Q!hFols(c
z%QhEOkAXT+b-aM5V{IQgBRb>-H0lq(jvc=M*&A>GA`ARU00-di&>DedeO2uVilhzA
z-iCnG`r1*bZWUeaHeC?N0J^=Z_O>>vHf_2#ZK?#cfK5*YSI~(QptXCCA5#T32D<na
zwTzO+)q{)Z*W<*C$BAnRHwDKNK=qD+@Q$3Y0eZGkCnQW=8}xlBJGe~UwA9p$anN+a
z!50QX1005->$p-LF)+~J0*uDsxsVu1KTDGmdDJ-6vlWdS*G`oPuC#}(d%B|y2|Rt)
zuXFILiamN!9wM*0UVTYXArfUwMi(?@hfj8guZUJs{vpm-S_sXId6%3W+O)8clk;G6
zu6QtK?m^5%T3W-#cXyf+re6K>>hMm^o93L3iH+ua$~(>JIn86s9lzZfZXPHfp8jFz
zWyA2{K&^5(eZOw_&Hb4hTP+j)oy}LLT9<1dx7M|yi0@B#*46w{IdxUJTsl1e?CrzS
z>B{BGyokKM8_SR9yILRTovV3RKb&_2AZTgweb3}V#>(W2$#>B!+tDlUwzsz@fjf2@
z|CG!3M)o*8vwNdGp1+42_^^Mk^7%bCx<}3dzS!AGT^~&ymH#d~7>|^%=Z^2lPb&`C
z<Djh%JY|BN_MJ%X`l4bz3|iuPyFkcU=gP(-+kMsr?E=ouqQC)ch(zMqE}#*}I*IH4
zS~zYY5r#=P5*YTJg|M+p06OA?R!I<7Xbho+hYR3_1uY)-4-1zhav2j7AW&1J{;U89
z#B@5#`;nIye05$%-uZe)-g@5W4fSHZ?LIcNG&KRmYYdzLFsY^mqlVf?8Xz~cU`o?Q
z$!Tfh0H&hd3n7J=K0&WkaU?wZ`ZmV`!Sr5G1yDVXx;}aVZS#U-AZqFYR28_A@D4}9
z4t?~3s=AZDjpGHNZWVhQ422L(L$5YmLiR+_5?$Mg=%U0S&jye{wO8HIN#z7_ngnpM
zIj)bdb<Bpq#<&HbArlu2PzD$bN1~$tzYpLzI`~mMq+`&yFW9J_07H%kt{z3)VpNEO
zpnaP?&I4M;>VW03rpBhRgrN?ij*gw35#12>C{UU4be=1p9}oW*%&8<eRWU8o?u>6Z
z*LfU5iiCSzAd`8frgBn4QhjE9{x!><^+{1oHdY7sT*|lv0y?@otD<|b;*xl!sHi9T
zohW9dp*u&MC0+<E-%QBLDP9PA^{VMrQ%>>N#;f$0jWnh5yM*G2v4-ZL^nsj~=A4#}
z!{(O_V_Q?ogn?=0Ku5<w&Dh(Csn)Tn$NSIb)AN)!rk4+gDu;)r8*2LY`#P3~-rSfT
z{&cGH>D$KxH=bUu>AT$WuyWw({h2RkE?*t!YF)11sytQGccf_L#k-}FmG1EOSt}Lq
zd)}42Sb8_Pw=yf=3*WBlnH7!xnVVXjE6dpKnauqYHd48Kdo~vXS+bPW-+k6Yww-0E
z3c-QTI2&DC#%YINI(VJUiS&{0oMy{72iuXq%i1}qY?+{OoV#-%IFNe^G3Fv0$2YEh
zoJ(Z`rpVgc-2ptt<0MyJe{iD$od{9MaIu3w0;IDdSy(ZJH0jT~OsYSm^CY;3!9V-2
zxj;CyCWENMlnODNLd*>joLvAVF`oe)5blZF2DeejnwBPD$_zd-(KIzaWA+yVIFQbm
zY3drQ=@WKJdwVoZ&>FVtzJQ?my*4&PEeC=iJEn>@Y||Ea^a6^?(GjJL!x+#2?)XIK
zBs?6BzaAw3HJlSbyeh|zLL7&lXdCFHiuSJJYtw5RrL9UFE%m{m^b(N5DUjeK9Q82^
z00T8Fdg#i)!+;osB?MpW#PJhE_eTj6^^8;KuNRKt0ieb&^d5Dz)rYSy&<2M<Tx@|V
za7O`f=)<t8jw7Y6wwi`9z?9n=C(wXqnwBSZyv=XJ9t|srj+d+9DjebQj6`?_AW%_w
ze0Zx#NhBs$NW}ygsXdHlweBu+A0L+q+S!8BYz5nslgmz>J?+E3m>ZqZGaIs3(G#6f
z71}e>J)2ojkp1q9(C-&6eV0)rTKIQ&sCct*VK8W6v#@Eisqnj^xsC6NHy>=geehcc
zrm*J55|m>>`(qu4uZrRD@0e2N{G?RYbkt5Awu~JPzijRtnAm?ZaA$vFd2FWgxBBUU
z*5-lwfxbFr%hb#-Ep_)hTlyoGYq#poj<xp9<aKV<4b`<Ox1J5x-o4R!BcdjvrS#U3
z?v=^Vr9Z;E#hEMJe-yk657`sFD5>7ASQ1V4>;=DX?8)6L8SR<unH=5gxwu!|(-Td&
zN#)x+lRJ$&vTgaEY@5xN{qDIVlgV)$ObwAMuI$Kv-(j=2+o6!B?#S74#k#_0G&ObI
zT_H=ArLx=C#~s+~9DxIH_RjToU=o}eB@$<@<baw=yC$KHe>h=7j}ekzGieq8*h%1~
zQP9>x=qvtKQa<d`;GwO`;3Qq6^B4i~N#HiTh?1t{(_Qh?!t{y`E8kGZOUI57xgo-t
zSQ;9ef%^rTjMdUKgI5@5Fb(x6ec)Mj6=>T8-4>;4quPe5)5k0dh>N2{{iwE`An-Cy
zeU8U}MT<O6v`YebI1=sC@mTLM^vdHW&@@rewkPyqqG$t<u+hht(MPeKP|?Q>i@Gnt
z|FuDt0en$K`Km$(u{{CrDPhw)cDxrv+y&yxI1;b|XdU+eLb4&QpkE2xd>ne9BN%X1
zLQBCNfq>k&IN;Xk)weNof`P<d8(<wg-I+6*zQ)E;Q3h&|aSTCM!sCr0FzAs1jKuf=
zR}0MZ@W?K4Jec~VBoCoK$%7e2dyTm-t0XRT0j>ona-8en;|HyqBR{>(uJXe`M@6-w
zM<%NF>sAzqQleKfCbO1SVkS#sDwYP{XTK9=iC-k=Bo}qZ3~q`CV;26snf~gJpNb9>
zVuChuUUlRYH*_?V!+JON?^koRa~%`K0}U~quNo#2-lDt#tDAGCo~KW=1T`yv>l|+R
z>E*MTjlQW`bmyU(^vg=+Pj72FmEY9O^es>Sv^CIQ-_ki#GYx`zzx2m9_q&EZAL|-w
z{&Gfn4yxeFN_ZAJ^oxasmCcpO1yROc#bj3X=*p6)<j;&flsoJk+q2axv!n9u3^{Oh
zRdscbBI96o_MmEX$44Qr9vzJay_dS~uq{tLnB3lx9fU;hq$)fVnAlRBK1hXPy3HQv
zq^9CMa`|}fc)Ma<mI`2<IxbJ8Nd%sr*Vj`8GNA4Qt|xKR^N{$tJ4---NWkQAX&%7O
z__lj6Juqw+$0NaZj#D8>X+Ag(3Yig4<_9FP$QJR5JO&+(YRp%`)<e<z*cB>@-p6{d
z(ShC2F))UJp#|aXq$Y+>G}X>%>T1|SdsEj?*Y-t6w!xoX6>UP0@Kv=1B0T{BZA(xX
zM^({|Z9hnIMCk$09{s;(K)A=zosWSVK0)AvHi&eNHYdRE1s*?PtNyE_J`8xo*$#Y~
zs;U!YX;ikVW1tGb{$cbGP}tG&!&kgO;1;xGTsj1l0YWDr2f;Es5<@U}0BFj`!Lz73
z5q}8EnYbIMV*bQe-3(-kHgS*9@YPZ~sTrk391b*1PnxuSu#A}78R{72-`1g1Af1vi
z-UGvnKZZS-R!JmcA~!CKM)I?eNFoIi6tcj9P4)9}_jKT%PF?446v2vAg)CPdG8&yL
zYLs6B`>e>wkY|*Dw-bejio!+R--izlE{Xs1Vj*U*ykax7JMI1EAL93!G4GplzTZSS
z7mGX6f)dh{ImN&oV+~Uc>8}cvo1L#Fn&&WIs63o{k}%br{?jyc#OdjY{loOP&9$$d
zbToJ7+*+P`y!>>ybzq<a6I)ZAZ|eFc>gqdMl&#MO`uqECP4^Gfl(trO*58_{oUS{!
zb!6fFi}#yz@8;&hGZ&VY-VMHcFIo^S^%PC6EX}?XEp3;GmS!g>OGLA?fA;KM{BwJ<
zdV59D6FphAH(S-Sy%W+Cysg+9k;@M_u$l&A{#U`?DdFtl<Om<rD0_4r3L|HICuGOx
zJ$uw02T4!C!H&Wmcd+qw?r5ZdhTeTJy3QV7kGwuE5U?Xt*M*=(sO=6Cf%~|-fa^@d
zC@9St5Kll`{2BA19++oNvcOCz)1Q>Yb4jv>W63|jpHGQrNnKpvF{a0RW9-$H?oBab
zSldx<Lsi!CcC#~BwKOp!^aOJ)Q!OWm7Mk{FKn#PWwbzP*$PGFJd;=)lUU)B0=o4iJ
zMFoVJKEdxEB`Ow@+zCQX!Lg7y1rj~;cpKqNIzg!4sNfS9aE1f;Pzkhw41MAQ3<2o}
zMi1TlLex=J7?km`Cmc_-9VM#y|KJJ^cDQC7iN5^dh<W1Z2SSi=%z@$l@CHW$TH|G#
zHo$Z!H%=<Pj!rhjaJh=FJ&5mK^kg;tSbHsPGYvJ&<Qkis8km^aSsLiUPUuZoomudz
zE(Sny0t*z7#3Q+o{mCRAS$GX|=RzTOQ9^6y(!#hBE(f@e!|{>9w~?C49?d<7=A_OF
zQe>%(a_Gh@*Y`3+6_b-GlhHj{;*x^NrSOrZ@0XGnAbocab}wvZ7nF-b#S3%EugcRl
zJBq}`;hSl%g8qof8GG=m>Az{k;^MSdKc&4KdzoB3S3A~F`?l#ux$^D6+u`A{%9jm4
zy=<A9>U%XaG}ds~JW%&iIW;^nGuDj0JfM8092z*hx_<}lx%oGEJDLajW^NADUp~BF
zc|W4GvVUx-|H%7yMSDxt@5GZY!W-XZyzkBkUwM}un*E|XbT)KlvSelH9k{!a?%9&b
zKTGzOqI-H)sz)Y!@Sc##Sy}X+e0wjWXHTZsW6R{Dx$hMRGWl#z^<>CwPl{qBct??Y
zkdmrUIHZiT*X944n!7HqYM0C9o~dB_1i9_9^@D>Q6fp{y>$%RolIk}ua0bQaE^!{0
z2;I3Db_VTdC7}9AoJm416(ge5BpTD7O2YK*HH;=PXwbs>q$GcaG{Az+x5o51rcu0I
z;|T{noq~~9$lb8AeT@FBqvH!b1O9gy_X$N=O9P{>T3S)P_G)UV32kkAZD0JYVymhR
zEyWf}26`aDA`rBg69H~f)<hXPejv*TY<n~ir^4gJagdNV(7P}65@HKcn-_>T!!3QB
z=-j{&L?1u?>oGv=4{kVoJaIX|;OR&>iU2AI9|qBu|G&x~m^uPE;}5hHTreMOe5hX=
zU&74i3+Jk?HewT03FaDXhSnLkD1Emxu}-%&HOvX!+|<p)DAp2oQ(}f2per#T0N;~D
zhBco78zPzK&k(}57#Bto(iSBEH$ce0R2mJK&Y2`|4&(aCxXzxQ?G7Q-Q8wqIfXxo6
zQuJKUKw-11QnnS1+ZU@xMJbmiN5dzpqkF<LAQFm~!n<Gmr)0Atydb9Fk0tTFqPe1X
zutCqo1jS^}Ej(CAD=f;%PKyam$jJ=)VKZSNEj?(XDCjWg<z`S$@xaUF!?Dhdh93@}
zq`!Sq-ViiA5!BqEtR4GhzoGMf-<0yn)bRdK(=84C4J~8y17lr50|U#??hn^34}$^e
zAA5SaGh)ByuxsMxR{9a~A4>~a?-#-cmtMT+30*4qL-eiywfyc<%*wkL@54)0qF1^V
z@0YqKGkP*s8YdMZQOM+W_vm)TpCO9vKT~_Eda6=_dwQz&s;ie^TImL9J$ZU|baba`
z(x-ZIr03$OB6x3aM^Pf*+Z(BNXdjJMu*YZNtDXhD#~J5veGb~&uN<@sJyYc}Pj0Fo
z+PC|-C%65YBodOMr?W6FQsObbC~*MOPm7}xb9UhJ$Vp`3&t%e?70%{X{?<$;J&DXO
zqXbZ-OfL#QF~F7Kt>bl`j+xg)I$SrHNI@XMZ37)Mb1ejF7+`w)q_G<2I@Ao@)FE_W
z3`JiXM?!7zY~af<rv&bd=zYDaxX<HQ*o(s<K?6e=BsjC<A85N@(Kpehj~xrdTLM3r
zkHHUvc);-xlwKf+5H#5~0ss?W83wpx1U@FP1tEqI7X&`}0=oY3UmXF-k9`0hAI_Wj
zquPeAal%FwZz0CJKu*Jlq>c+sMZHZ$1r&*@eVaPw4{-WBW9F-=VP>L+_>VJ4Suj3n
z`Y|qJ*z;gK%6EN43CL%`EzYO&qyc1#1rsi33rK-v63|ANGw>VkdDplSKR+5IL3e@Q
zIG5wF?kQl0aoF<F1G$6jV%2)cq@qVY63tFY&4?aNIh`>pl1)~02WR%Y`$u<HPf6AY
z^pvI0$<30%toJXv2VZ;<KG*ajbFLs}F0{CyJf^VWkGZ1F@>efoiU(uT%U=XR3jZS~
zy|`(kJO{@A;f;oSucpd#Y7Y-<i~EA!Hc#YW&~U7<Z)0Hjjk35et?y;=x#|6f6F3hx
zD~s#KeySN5?p$tOe$oN)C8BR?sNu=saLfFW1+Xg%;d4tXqVCYNcjA)n(C&9jb6HC-
zDqeJlFT7ale!o)C{SSCg_LdqaOO}>Gdb(4hC%a+wNWqmlDcb%Mvsp_r(d-Jq#^m<o
zUi3TmHdIA<_0FUWN8y!_(b?2dT;PgHnL@!XX&hDbTnX8`xV^35Y%6@CW#gy8mUt>;
zo{?;>Jk`g+hwB5|-t~5Z|BMuj3%KKvB+0c%KXh#mYLY~94Fzt292OzT-ybvmOqfr}
zJSj3Qc>ZK5F}p%Z$}eNlDHOyKU~G@UO4QLiualpTayBs3F)-1wG&cR#Jj%>83R1I{
znVN=yEfGkdsfIKHZ4H9%LQNBV9VV*O^*<c9aH9JaBYCPS7mn(qRf5JqQQ{;Rcp>lu
zHbD1vBt$zx=QvIr3Zdr_WvWW3dH^U#KS1H*AM`|mw1zwH!ifuxCs4Vl=c7m4@J8Y{
zS~Ah}(aiy0fI-?$sM<P$iX(iXZK}4%pt%qhkw7zDC&H)!Hqgn;UV}&mQL~RS)6~Ev
zYKk!e823K5vqNXr(epxIh9L{1z;sLrGFYw*GHgd49!ZH-u$nK@tbi|^sl;p*%@3lj
zbEGp)=vO$Ak?o%A&g}Ioqp6YdgB00hDksHH<`XQR4UtEeY=?|Y{v$UdyJvE;DmrBn
zE$>~4sCywZG<4~^?zx4%q8Fm~=#XOZptz`5)IC?UQ4o`MZ=q29;?Db~n5Cw)&78T7
z@0<Skq2cXD)60gUwBot%$~T(R8amU`ipwX!drYLyO%*TSc{TmR+m@Vx;g_BJQ_U?8
z#?ov1mJ=E}r{`;%OFN#l9M&u^H#gq^Xdd{yrfzua=|KOHrH!KZG4I6-X)*5?@GmdC
zUlP3#y;xe96HhKJ6okJB4NnojTUzNB2Zz4+SNG`b`{1S7rJm|+#k<CC(WRcrjLDTh
zv%*(aW+xTz*n8QNdnKtofA*AsVlSE9-VW~>{j)lwdQv`l39JaaBzJUAHd+l5yJVET
zGaJ$~%T`49q|R22217_4P30)qRf=&3g@ZznI?i!uPjyF)M}~0)5*Qb+(b|9J`Z<qZ
zllTd#Va{PfGR@h=gJi`_TEw}A1P*o08gsNvvUNPXHJFH_(7pLyu0~}66eBM~FGE)y
zL~LNn3VumDODz*)nA^>awbbA%K0`Q*H9**@5gs;sjB$fDKsVIJZ5;qr{{nzC&U9_6
zHiVn4w~fFF1R4PMaDia%P{AKCFX|Ww!|`a_@e}_iMjs=}n;<?uv}%+)amGXAJxY)i
zgh%fJ0mF$FevIImQTw(8hIYK5LU4H~W>rV9eyDeKbw?cg+Ejagh1)3V0yqp@bY>tk
z)NG-upE1@tsreVUQBHnjriF5bA@w%gpcHQ%9dB1V7(y}c&WBF}7d(Y&4d$N7r14>6
zv`P|M2x(zdlEhC!l^~RfCXhIABpiY4y4*drJr}dk9GR!*Iy>0CN}-6Jt-6j@G#XsB
zeQ{D&QeD+J(jC1r`;Y3L%+b)L645rGbH<CTrBLyU(CDJ~OQC5ibD`lmb47D28!_E6
zFTUF>*(^#62kICrN=ti{(D4dJ(y_sfjnMR*v7j-$WwSQ@RY&^7jaLoILS+p6cFL*Z
zj;Vy&!;X%hCSDFT3`~@_y#21VxOoPEWI);6*AbCWS(o#yrmu5({^nSHrSix^_WQx2
z(2eexv=;~jDSB75x%5ShNW9co)Lrzd`c*-Z=*7Et1@F<j!?SzD3nk$4LUB%<Tv(cI
zEa>hQy%0|pEdfWouilGZ67Myl%i~5gnXz*EPsm2IqtzFewtGsdMSGK?;Ju9Pl90^3
zo{W*y>Z<C|9z{w@k4)}4>rmyh<HH_Lk#R!U^4wAOb&#BFKQ<?I^z?x<$3Z4wJIJXR
zGj?|8NSwnYR4NxqR}!IL7?VnigVhwB8o3o@p0$)ovVaW_gQbX(cmz{41BqUbSO^Tr
zr{Gy4AcxV%n0&G{bhCtc)7UcB!1Ux_%#4Y_4G<hq)670N?Ap}zwLus_y+c5O3S?v(
zCt}J}AH;&nu?s4;$5n}g+=pUz3`8d;&T1EM_`5(Tbwp(on86XpMqu7Rh|~lF0vLRh
z7-s>1K0)9Nf+Zn@KJ<2|BZOE3e4z?^28vy^?E~EhnY}l#_ZV&%DmMBUEFcs`0y67r
zt7w3e12%&71NRtX4NXjU5hhe${0||RU_!vs^}P4DENDs$7kVNKBf}Wz;qxgV=fKnp
zJxFmDOe-pJt|l#F8ii}+?APuGYmLMmr<F(<CoI^(hwT^4k<UhsI)K%X%h|KJ3bqV~
z{aJQM&q!kr!oEb?DbbAuds*Gxv)xOgqVL~{iY_foE@Vy?iMziGU&?&(PxM7`On7qi
zi?pJc!tV66qI>U)iWa^Q|4|M)uSlFTx0#lfHkOw5;C*sX%#;`$-bQ&$`bL7XBe}S#
zxZ#K5`(wZT@;0WWXkbX${1)s+XU>hO0Zh3}Ow^4H^}Vg^=y=w${OrxCmf@M2`5QAw
z<`&X6i|01qZ^nd%F1(*hd%qO3kSt!<C>Mpl@7@$`WOpYoErl+<$0O`sDiU=s6>Q`#
z6ub!U&Rm)-nau9aC|GI~ZHB+d=oWQ{FO_to(#0v_p1tbO$?oc&@OOK&B`GVSy{w*|
z;1?N_Jz%gasxdME7_vtU!BkggDMm_0Q>tf6V0V#2o>9ozRSq~SvK>O!IqMDw?wk;g
z50|6h_`sOzbDitsw~qcSpho%$o&89D+$&_7g$E==e_+8l5}AptDjt$n;7MS>$N>U6
z05hj_KF0DAZ^Ooc5hg%qn2&XgKO&?;Vxn8k1o3WK@CgAve{k5TIGMTiqIPtNU;<y{
z6R2RQ8*vukI-m~*_Wnvx4g`5eK<Nu8V}b|{BtY?T;`vcRls^8U?Gh{o>Xl&MjvoE>
z#IX<ZIQlukSrf)QqSA3NbR=3cKsOpT=xAVzKqn`-M4VLAi3>@E2<lSTB62^7QEfGC
z0A?6b!OEREqhV(3cGBeISlD0_F`-}y<p{nE@N-74I!H-CC|wycNho}OCY?{V7FtP}
zNg(LRB&60*N$n(wkcbkag-K{!u8#l>!$E*Ei;t(oInrU&$Hz03t?-$>nCc@_5Q4BG
zw_<ek^k@ou?_x>xWX9~jCR0+XtCD3YqN<Fg?e2n=f<2K~gr9tPXhHYjQnt7|Z7@6e
z{aki8=4I!y#YGjblIObTVu}WviZ<uOX$xaT?>Ao{9}HvQ3k?e!8w=%yIUU7w&Bf`p
z<q1u1p5&x;PE6%2myackP2?2MY$%_M^$j$&Ow`WYQQmmlGJR(`y%Y5Gjpmp4TV`5k
z`i{gDzT8|0-DrCCz9<Iwf|8s+-iN-=nF|MVSM=_E_xq)Vh0vuJF(dCn=U$Y&?=D(G
zZ$@2rZzhXFK{UP(hZgig6q>yRT=HV2WGOtfyJBf+Bz$T1MR&$hPmBnk4SD}XC>s0T
z<VwZ6j2D=4U+S6tSIK1cWKYKANbZWLk=+yBGg~#1k(%Nl@2Tcg%hxX|<QH?R*3qkT
zWu9!gPgt&}jP1PcBjC7m+#@9fKTUNOaA^W}njaP2#tK6(&Jreyn#pt_A^VVLfnmck
z3&aEPk&nlKa!AQ{)pIo@Om=qPdYf1#A`=N3Frp}kh%Xb69$=!~)NE1M`Y38!4G3*2
zIByYlVoaU1scWB5C-@GSLY<&%W7-NGS_L)vVdRQXJ%D(LlOj>gsBrY{4<a97O(t|0
z;)7I)VZ&p+9|*srZAU*q6L{uM5E3Dwm>&hc0H(pzt-8$xLfBE)g^c)rZfYP7dktV^
zT{Sl%N+DJw$~@Kpv1Czj8eulw(43gNWnp+-2Ujk*9ZI})S-dq5Q6!k-iHk?l9WM^2
zza*E%FacF)EpR5`2;vT7u4kB4JE9ihbQCyH1ymm^pK(atoN;G1+rcMQ5ps~q1{bAB
zJv~x|bNy_!LXlcg)mYt=vLa7OnGK)a%P7g%St+R=+57iW_5u!wqU@E5(4`8|Qr28|
z){E?=0x<w>^3sc@h0x@8;)RU&p<`+9|M6-8aY}PBfXnZ*@4YIHNzQ=<uc&;psW>wS
zN5+lxmk%~J3g;Roa#}Y!P|QOO51JdM#&QOf6QDhigf}&@+_}-LeEV>}Z>X<+xn<)1
z@{#hGR~=28L32SHb90+>uhQPX*hrg8+nfvE5Qi84YjfenyUq7=ucFJ}cV~qczUwY}
z|L^YPxus0tqtK$vl~<XtZ;LZul>gBkTC~}XOLAdp5_o$FHy}|poUx&z?so;iQ`rky
zFIGau(c+ZwcPlBggYUXCwkx{-l?y*Or1X)Js>Z6G#_G}PmFU^(9$8~mwLG{wH(35v
zBi!SoimIL~xeA}_4v}mhAK4WL_jb=P2adZtH_UxJEYjWCJq(gL$(bY}S;0y}iWA1g
zF|BcWcVSvHtmtUg5W?YEXVLL<#*>#GvM0RJz%ZYRlmevGVaf@mf%!a5WMSb*MUc{j
zdDB++S4@)vPOJB}X``Z@2sRo{wm=nC;At3?0^vK>M?DiYit0Y`p$~sR%LIi1-tAXV
z7sm+#?kI6UL?dn^(6j0VTfz;8g8vmH;04SF98<@qV_XaKfVM>W0=5&nq^$}bzz5?e
z;+eG0_`2z98X(?7!%0ic3{Y7^!|kM<Ibnar5aMl^x>-8s>4@h;CS!oVwW}B6yQ~q(
z1e)Fg^V(7ing^5Q!n{TjQms7vc43YQTfBCK8yV-vb?}3773o9ccyh+60!$lu!h94d
z<2s~Xll!n`icwk5b;t<+8_a3MX(t2$Lsh{kJ<)P`w5&V2y0N<P(q7}c+3b=RnJM8J
z;-2iKo`T7g?8%bo?(eI6vO^a#Gr9+}<{IZ#!n;#&_kQv2Kd_X($et^i%gRoe%T8V>
z3Y`lrFPaOQTS$0SUi_jtEhv36p?o8usp0#nqK<|!Wyf#-K@a{R;m)hh+QXkVeo;0D
zH4G&5HP<%(cB6Bw<wost!}Go)8%kUgX~i4RYhqqDy@?qsYRFkAdOJ7wzTxHjSDQG5
zZWg`DnG4;_{3CnwkL031@Z#LU`_Q?Z;?2#b4e|TArG`ORPc|2d(qhVs1_#rUle^!A
zXNNDn-AwLY3Ef0(i^Jb<POju+6?KOui^Adk&JHaq80-$8Tqzn6t#mhvda^{}C})}Y
z(o!_0;8RknLaXJ~J!s#GMp=qHw<mQZM1H;J`sl2KPj#w;jO`<f<ZuLRfrIR{K)_AC
zPUZSZ9H=yBcaoJAH4MXVVHQ>%yEH3*%v&(%WHOxxe?JReUphS>3AtX@aN}4a9LUJ-
zV@TizI*1Cw#Pi9Mc4kp-#%DAQG~BfQf;=HDO^jZFl{V{DSNGLz>%9O6hEp#g#}V*D
z9sVI?C4s^N?Myf=V4?t$xIp;fRAI6>-g|<uToAQ=TpuLe(GzV1twD&1C%}5>+oHv*
z;1sE913w-N9DypffHu8O#25-@T~XCImLgybr&N73WnWESV$8){ElLB?bDAd5N{orv
z0z&um#{UNQ9wPkLE72Nd>=GYfZNXTRS}?3I3Xjk`GHua6PI!$9UvroT38@<HR6kNA
z5_;ROP`MoENKYKNojLB#>tXBesSfR)J`Rd;AAxLC4oxt1ob7p#Dsz{g?s1sy$z@Nb
zM9(U!OD@d<JrBxP<dE66s~W>oCVNUm)wAIv->+nRQN5j6m682oK_My-EzB15gqOVA
z%$`h3=@zeqijbx>H&_&t9J&PkWiwM;w3%G=?%#6@_vVtn`{UkAadFf8gtYRpjfI?z
zmm4oT`Zm$FYdRVpO#N_JI6aV_{-&d0XiTY0ANt_+n4g%Q9?L79XuUCTq@lQBu3@A2
zxAIrNZETdkdKELc5wsDspiJA?fUq;SvCt8-v9a{_hd*BZ`(@Fqg%{$SjXB~X3dM(R
z#4NloEDzsI2D$jhLQ|0#97(u%ZUOJ;ZU}99pS=+pv+$p^&BFIZ?~CS^(l&A3zMq>D
z7cLbMM0Qb8Nho@Lc(`bArQlsk=(|bL$Vzxch^R_5BA-kViBf_~QhG+Jb2COSO<wGo
zy*}&H$WBE-4?8&3C)Yut@RT`l*beSt?S5#~<B>og$cqSr*TY#7=Yb({nuQceaMm6?
zD;@)!2RXhBG6Hf9kooLN*V8%gN=OU_mPUrLMkeRI&9y!<w!{>_o3HUnV|eWljihEv
znEQ!DPBSfEE&DdOBaqOdPI#I1A+&%1fv{qGED$4wjvq`xuu`CURgV*5BHn?94D09x
zMCm$eW8{!fWK;uBfO^A`QXK$8Mdhfrqb-r>h<O$pTV0ee9CuD_2>7riZ1^B9bkzxS
z2{Cz&$kJ~Sb84VrpkV@)9)q(cn3x4klW&-4cOEP|GDeJ$*@fUPggCF#1Blc|Oq*DF
z{LG}mUQ0z<C`p1eJRxM0ICmk9OS*y*CejGF?wEOXM{8K;a8C=`PhaOaz{@-CBa{2M
zj|*fz>=3wab}sIWUODh7Nexa-g^Y`lyGyfs@K$E6L|<ZyqBBJ7?(ETwjP0zw>XZ^u
z$x?N7cXbAOaZgtGC3Nf1p6(C86t%weLj3MtQH=P-4<$<rlZ8d1<OOkZOj_vs@VQqn
zVhZQxLbHQnHj|fbq!mvrJSd)PfI2?*Drlhma4H$YEVVf|YG00}k2Pb)<+s|y=8oa}
zISJDVPhZx~A9<C~(D16MHX-M*Az^A`uJ-K)Vr<@S{#2ZX!LPYDO)rbyh88Q6UvB0c
zmcRO=35|TA9FV<uEUkDGztcD7HpFwA3&jbU?;AE^io|Ji9h=#qe{5!MZl*OA&6UTz
zEJ_<pP7}`+mS@Mj5HB==$rgW?)syxjGp0H;D>S(%gMi!F$Zo)0DjX-v!M*5`rGk;h
zij<0sioNK`ODn;0QAm$mCJL@D32w}-$_-JZZ~#6op{Us$nNKPx=}2zmHTX)M-96kR
zxl{`rZGNUvndCTUvcHf_rdX3LJa8nWBifk4fXZu#Fim8r7-CvKU(W!EDi}jGfY;x|
zn3!78GSi6CFf%v_%wZmd$q}&Ax=vv6ke!U*+A7*`-vds=QbZW>h|v{r4yvkc2sE(O
zhou5wBGBeU8(euXPNU<3-Ux)LDG-dGBc6^z-Lt*m1nZr;t*S4a{<h#y0`>7#)nV{=
zg8$my7L!?S+S(w(-4ND`=|T--GejC8?NrO$65bPYQ=M2#<S*ip!(v3SGo&!`UFnYy
z7L0g1U}ZAW!g!CE9v%#Trj-?#c?$~<_!1GZOZABK@NkwOS|f}q2#XA(S~;KvaFOZd
zM|1b#y5npTDf5ws`5gFoI(TwDQysuHdscgLFbbP0Q(&gwN5O7HXu)U|6f_wWg;B*y
zN>6G=PfAbq#gg#tk?NE$dbTsz|Jd8RzMWlNoe`dq@?tilBD!Q`J0(Mr*<BLaQ-HCo
zl8Wq=cNyXg@%P=??+Rj87P7KKlNZWE)6!rvE!xOTdlgdz_|Y^Ms*Kqvd|4i}(KJ?k
zV=STJWkN&FSnVCSJ<@9sx3uw8IX2u-Q#&!$34>_*Z!f1d(%%lChJ%XVzO0@5El4?0
zoVGDl{PNX};+(^!Lwv?YLdQmNQBF`pOwr4rvER~i?xdl<b7ErNroC(m+T3g?I7~xC
z*<A6<^zylw--0%hfkl#wHvaLd_*HrOLb13ZCv9wQ<5l*9v{x{rEM(`1%f)F$#YJhM
zOZPU5ip1GVOBKm4z7Q>l3o;f`LPgnGqR@g+QAt)~Xzog5NlA4|RzXT`6}vImXEr!v
z8|m=Dqllim7&#iEIDHXQ6IbL8*L@r!J=-JWB0bifxmRe;C~Ddx!kCV^SqoT}h%7v7
zN&o^4{290(8&T+VFXTRh&>|8r><CKQE!NIR!|fw86H7?p#&D4$DHm~H8W@BkGKlog
z=&RWxh)4y10M=%t0odBw11g}u!l&s3$bbVPWJKFueU&x<3Cw!`3Y!q|c9@RP*-zM@
zu5E~bU3i`e*C-~jJ~&5-uB>Z&rq@=Rm|W39_6Mx1nrEPqxM|oUV@U&3teBO;c(|pT
z8>~g%DC$^Tjh5%nL;W-aZR7fgMS+SP5Kx93D69bBC4$VLSn$4u{nLUJ$Gb*j#vwr(
z2|aOOI%%XU$eO0QbHQkw2FT!YVcF+gp{|F47L9Ztz2468In9Zd$bjbra(7fQ+`c{v
zA8<?S7efv_NB2SisiBX_aygUo9@$96X!Sq$zGqiwRyTHINVe)-%J#)s*fCQkzk>LX
za&JfUeRpOFoXATfBh^a)oZ*?FA^^|irS7K5rGgjYBJtq6w2I_cDao54j5jjpVitY~
zdeOA`A}BenA^cTPad9!~FD)pjsG~4#sC;a{>1j-kGG{C&Az^r8syLxxYN~L)_{dvj
z-OJwwraGqfzZ)AH`)#b@W%1NRL;BRl+o>tkVnS_9dIOBsZ(@EMJKWgVIBb}U8Ov$N
zdD$?R^Y+by27)BSyi7yFTu{*4I}LB~u8G2;^jAT1bLp?jU&Z8fr2jUC0mz252b*7%
z=cFrRk~aqn|JW$nz|~Mxn4JFI1~_#9??Lfqu(&CCE;PA2TRfSa3Dtcixgh)>6<L=W
zOTx1Yx`UTQJq6VYm=i-3mr`;wQZ5D0_FRv~+1n?T9SkAsbfnDLCl%9f+^_r`Bw^0Z
z&fG8>aH2;$Ry%-Yb@50HK#o-ajz{?{416;XpMnZ7^hW*{jCV*)`qsz@3Ja`vC})FM
zg!5|}X!^RH@jYo^tgE4A8-+n>BIyub32ili0yBO4-V3no6GPN^hS~;@CIYwAFW3Tu
z5JCOKU<=}E!L}V!*AG;0L*c`Giuk);8-g-HoCm-+UI0i|f%l?KLrop$Pz?-6p^nwG
zVgZ|d-A+24QPVQkFg5$g7|9Bj$dfiR%EwSICZ@b^C+eLyL{u0Z0e1{*7X;|=UH$1S
zYcM->e}E0->-+PNAZUd_OAjk&YchIr9KIch+jl3NUZ)Yf@5~|G<{Td?cl??UH&PDP
z2>T>FBU8DGT!D}5y1S2iFh?d!9rfE*$mJucv#IQh>{NM3bq1%sdfOp|9jxHY9*m6U
z%5z7yqZQkYFj?lZE4FhRW#41`G$o}(@oo?Edezncn7!Coo&8RpGFf%$-BR{a=w3;Q
zC}k;gDYP4MqPU=Y?qA)>-J9a3qVR?Ca#30n4s;7Iz6fo~ENTK6_~SosH`2#2QJbDq
zn4S&*G8U9@_}dQ~cM_)V98T08{?c(|qIRp{$^OLKhM*dy@-Th+?N7tScV3}G*KT(H
z2J_z7;md^Ia+D2k(v%I#R}-64wPVvcZ{fMld6O_PHunmi?Ba%o;-Z+T&h(s#pyGs$
zj)prArj)M|ly3?TpS+2A8Pw3Rarphj%k-c(ImJ00zcmDH=ETe;h>LR)zIYXrT%NsA
zIM~oMC;oR)Q(93$+FbNf_7|biq2XBtC4_J)>K0`cjf7`*U&_uXDapthMMf*Trz%(x
z+!H(^^Qn?u#O4D|$Z5zfA?`j74yU=Eo_=3(5hBQKx8Qn6thh)CCkY>slH#n8JHtSj
zQb0T-fI+wRV$jjj40X<X=i|4XPNI>e9#ZV=J~p-d*w`%A5^y65=_>|Wng}yMalwVB
zOC-esa%jVf4_mYuQO8JYL4J&OpsyOh1#C;U+89f@ppIBDmEH^X2-L;+2?Uv6iHSgh
zyjF?A_y~-h+Qfumo4q!II$(_MMaUe2(1DgUF;9Ynr;~<;*-1bRV`B|ObD6pklHXtc
zq6O)P2wpcd#Y%zmNJRxfgD`8H00XS88D0q9MI1SUf&U$u1Xr`vh35}7+k!-L7ABH}
z&Q@?|gi+fi9yE6nUZT;sUkRL@sbMld=XM7{WSEabs*kg5{0hhC3g<c&rTBO%9AvU+
zc`9erlkJ0v47Pkc8nkI@342r~SiiU<K(-9LXQObSr8>atF5^_N;Z~}WRfQ;esu6$~
zGC8s$6Zv2+ulq_*kEjZ>sEs}E_ENSBz<8ug4z674uFjlINy})2ku!W`CHqBa=E95b
z7YaufzUW^1Pxph3<eWJm+@K9{PSYRZ3Fw!_K^+T0FLOE@%Ew|3ft3>)ltIe$=BbXR
z+9NIdPm~RZ!_x!P9aHczr4QWbIJ|+no@#iL-f-CP;7!NNjyoO8haJkPu?=O;+v%Ky
zH)BJ83=9*~GT7_#W~_OvZvxXZ4Zj7oG^D?L`SiD(saJ>T>0=G)%{dJS`fZ*#?5o{K
z!xD|0pa(BwVuI$%=QeU)9{yBxFD9)#t-N9IPUu3;Tuxf3_=oWFf}n!In88q@kYh5l
z#XT2`3PLlZv&1VYqLS>!l8T=2;7dJO8P(OZ{~H`U5(4m1l{=Elz9?t=%%0{1J8)7x
z<$iGPx+68h**T2LC6+hPNaQ$w7ruv;g*A`j5&)r$98iXg<3}z5Isp{#^Dx~ZU<)^I
z2;j(<GteOtZY}W#;YQz@V#MDULrdCd&Sx~VHNoH6tEs>y0p3pC333NUT~)!Vp}YZt
zog8)5dkOi2SfYa3b|icjs=(UX=+5fe`UEJ^MhSz^?$uUr(<Y*7hyg+@7sB`z0*nx4
zV5Y9Atwz{MwA>KD(FW7hNid4WM6i*DPOPb3qB#;2k&E-OwIL<n(3<4}odijW*mGp<
z<wYT4{VY7lQU;z`FcI8k!6fsLJ`fk@;!MSxxJ)dmh$9L8ko!aZ3eH>4(;S?l9RwU$
za^a@q`f(g0(HGVoIJv1{>NsC1aP+>yU9a*)(T1=&>x#(J3Yi?Lw_ivI+eaekN#)4d
zvd9DEggeM(oRry-Z5fOn!KsQAADkCQeMUz{N2?X`#*2!Kl+=scRl%cK@(huzd#QT%
zUn!!-@Pd_$>PC^cdrvG1|MyC0R(EDk%wWNb638&(f}EJ|VZMmT{9$ABhlROKaZb?2
zhWNn-0v>B$-fJrQrRdI`-|h$DX!z4~#}Vb*H!t&=hx*2p6Z_M@^($|@tWg4sbk=n?
zAl#$j`J2v(w=bKOH(EP>oBmGuW=vVP+)+E$H}!Vl&D)l#x6R7*H&Y2yZ~D?})0OEj
zZ*<lccQh+&#&T*K4uMiSH>U80;=}Zg(!-9ihL-e%F=b~04Bfy&K@ABL={Z3$4PZ}_
zW6BHD3OCZQpy1z-MUx9NlSA)i&wUX-xVe-iDhjU%{X$d`6aK#?_<v_kR$Qt^hDqb3
z2=VZ_RUxyvA<(WI92_{OQ-L{PJon*v`uVwg`nh9w4$SFsVM+dRGzcsnObZ5+iST&_
z(Vj7c<qa2UzAM&1AkRGCC>HBeOpM%2ER8fQ%``O45%HoC3#XC>rdM>`5JjtrNm&&&
z6?-#%H8T}mWFVpx%?NWThCy)bb0Wq7we_9QcflGv5wTyeaH{Lu;tfvfHa5f*A<mCB
zIPsYgzI!Cq*bq5lMBKj{k&*#A<pU#!=nZwKe{N?$F&lh@1E48lXTXiynIPpECs#Ye
zM5upyMz^8dBNZB}U?@m9v&LAN3!fM*`;c}EvW{d$xaLTxYUrgNGz?#oq;by3fxr}|
zvokt0Lh0Nism|>Jcw*e${XA*oKI1+<ew+|VB<HITu7iX8ijU8z{34><PO~E~MIKaz
z32<oP90YsHg4e53b`;~$irgxPSxzv*lpQ=FkIO(<`&0#wk19euQ%7@Cp&^d?a7GAQ
z4koIr<vY0<=-Vkh73<I$vPNeoXGK}nNX1B=t<Gp1ELmDv5F-vRxlk1P5AmQ#G?!H<
z-oQC5=LIO>n9z;6FJfNZnF|_QYRV~U-t3qjD^4G)Eq?GeAt8OZA>qhxEiKJ0Ff472
zP1U1A?+<SsPA{kDO-v}KhqfkAy>FT)p0`dXylkjdPNg^8IXpy6Li5DHjn1jD=AmKb
z)SLZ@&Z)}cp`b10bb6f<e(NA*5MdXYQ2wOsoB%)Av5_|hRwaF^TshT})=+%dksdVG
zaHpYg^HqA#cP|TL9*C7i_r_uXqJy$G=8A(BiV7C8!(*BX=LVBQlb15H=LSRn5!wi}
zQBe_+T~LydF;Y<yjU4UhstkOydZJ<V@XWn3%9fwzpptX1aKj=UJi)161JQwdDcKpr
zEC@4Zy6~8M3x6w~Kb?Xt4gTl#uxsQI%h1yB{B0c~V^qh)==?`S47859iTO#aPO&?Q
zfPG^(w~y2`eKpTGsi~W}VPsm3K)v8M5S>J<wX*3YWN>x$wqB4GI2CH^Ucfkusv0V`
zP1T7Q6SP(DB@&JF)rp~6Cy*f^mf_;lC0<qcMdFMT=E!Y<n!(CBApjJTAC?axY8PAv
zC>JfalOM&JAm|PU!1J+gIz$GHCB$q)te3z-mVo#&fDHUfEQ?2kJA)k0vL;*mBXj^Z
zmN=_8WI9-R2+^KV+}8-72A0B6NeEu^z`{2;kFE)>yZc>lr(S8t1Pa&FIaPv5L9DQf
zbQkzwTKOUecf8X*xv74#NO#=-E;?gjAG_T%mz~Q^MNHB-#^z?neSk4iokvFwJlokL
zkYZ9V`pCwiDV~-Q??Fn~tU?ye&XxPfM@KoM(V|fZiY2nyOQWLd(SPklXQjxO8rg8x
z7fkki@s99SglET;VCP%+i%^j`6ocY_h!_5|5PokdrjYPc=LF3a1uY~L=HxudLBDKy
z(~+>**-?9Bcw*vyUc>(Wz~!l_ne@uB8s${$@QuFbebdVWEq$1>1^+R1<L%7Uz<ghS
zz4E`EQ#JEJ^Z2O!ndaw*EmO_4LCe$4H{PZ{f3n}aHF0BVxV*G^U~Fng*{6K@%fKC+
zBaw=lkUsWgs(8A1c_L@3<A*VT_?U?|8$;zU3(=(uzuPR_0NdRZQ=A1pFRd`9JhR{x
zj3eT~K_sAM7laRHhISWZFGVL0X1yDM_2ptuN>;_>Y%o-(luH+{SIa^!$}a9)A3eQ}
z8z<+A;IvN&*7T7gX;xHFQ+^2f!R#!2zDfQ(vIU>~h>sJKwSSo_qI0pAPv?9h@;vPj
z0cL6Uu}Lf<5{)g*VCad(6!b})3C|$<%MGI|1{hdUBZdoAG}}PisrTyY6EIjETYyyb
zoz!fjF7(>=Y7_geboD>vY+=Y6z?p!^NHoIy2;ns)K(`9=1hBYJ4I&9FPHGzJzP`F2
zqKmZEwR|<zwPW3MHJr?%3=Fh13{cInClR9$@26p`of{I^ZyN$Je+;+*yPOUSnMRcJ
zkFa7W-^+T<x(o|^DE|CJq$zq}Yar4qUCLan!0C99u2~@=2D`JM2vTX+s7N9v(<C%O
zn8XU>YhS^(FA-3&+)xnaLyhz~?Gx#IeO=<Pe$fHT+0em#5al*5@j3WknSj$1B4Ep|
zS8>=r2wa(!2eW<r!m2RtJnp{ZesFp{)qPy%H|{wOg#h^!ihs)7J=b$n*X5^u<PPhX
z4%i2yxmB1;3RcYej82ZO1aJRybhOduQl`9TFJn@n=)M$Q4F-2bG}5?`Ji8DcdT%9M
zEXwW<4=<k!joJ85PEpJsMGw+8zt}7fS{mC7!YM6%?z_y1;`H*3pd-uu%X!6HH}1cg
zX_%jGop>`p)H>6!U%Nb}tWTeMvs^novGsW1?r%f;>5mWVmg`#fZwxn-9u9X-JiasB
z*Ei8zJ3W87_RZTT^Fa+Y%YAh@oz44o>BG(VfIf`hzO98fMA@8vXMarDGB#28_Wp1~
z`r&;XFPnyfVuFI2)BfF%UY!0wiCn0L<c^$}>=(tD2Tq>L!rBdS<_|?h-;1;1Q!R?g
zSc=XHg@9TS8ZC-0$tXZp>%~U)rAxV|<<->}Q;>-8zn(sbB);z8EQ`F3Q8z!_L%;H%
zSzs@dN1WBq5+)in*&2F^e*h1wG%40zE{6H}NS*+(VU*~d_^}@1lJqRi^h^Pqar82A
zL+bZQO)WE|$YE*)gIGvqG(#kdCZ?t}2p@;OubMv8=r(B3M0FxoLmO-d7-oA!8|b4Y
zgTp&Ygx#sCYC8pDC<-&S7j!}JVI~&29<~U2(Z}E|;l)?OiP2ZX-U&GgNSSd{Ge%q@
z@H41yVjSDR)WA3j`rpSy)*gaL&Ea%K9=cBcdAbfohw`y2-#b4ZdlVmGTc<zRbqbcu
z#4+Nm{4Jy|4CXbS1=))1??SACj3c=q{T2?oxJ7KsiX?>*qSLiV2QJlW{Htq1pX&mw
zWb<ivM+LW&1lNHc9DK(8xLn!Ab|e*4A-c{zm&27gupPz)sXiPBtW)unc!sfM>yfFc
z?gwGq5co^4`%u@p4jj*Rp^vAG%7w-lDZoW>dM8z$%O3yV^<c$%@Q%;yL2j^Ogp-S$
zu!{=V;e+@76#{WF6wb?@LPZINp&GlhAjf2^q-BMRmqegAP!@#?1!+Y;ya>+`rKjZ-
zrHPXh%7bFk{!=_QmNwQ=K6RwEbhxyCzIp56o8g+5^>st_`^vtSnVErSPn7%9dCxjJ
zYwGsv?hoABZytWrIp4hBKQr(qVfn^%&DioXMi2+OI^PWUy}??<x|W*5C(FY_TVrE@
z*Yg+_7;XUeeljpn+c5UFrKM%6<4x!NX62KnsU{o{6FQ3fItmlU(t{Awm)7tDl+A>g
z^0d$g<(m%%zgtKXXMaCf6kha2W|pWxJUB9#T@;NG-SF?1vR5(&L&E=o*s+q)OP6FR
zv%!t<cU%X^bI4_fjr%x^M|!$T@FR%ygQvr<9k*8q-c)RwL^>FmPRABYIHC#JA;62C
zh>=1|3LTRhiO7J)Ns!oyV`^Y-K&)@@g^Ae2*UZd7TT{&!%m$JS+#oj-5p-}wtE;Kn
zgNjCzCU#ID0p?e{0{R(ldm@LCh;kv=JMCVStF04aa|tp7Z*$T$vsEF6qwvunGl&%s
z#KBV6Hp<B!)*>}PXnQvt0W}TI_!5?UGdDNH>LR!tj|=lsSdC!>qWqEFc^n3@b|Rmc
zUU&6!VOht2%Lwp~f5eN278)PGq+llp=t(kp(b|LLkDF8+6F^!>3c~^ka2-^SBrN#B
zOcep4-D#23#jtTdPlN)x15x|9`?(83Jl(IjV?HR%{ko@v0N+cWaR&}O9g(Tg3ea~l
zswakIflqvV)*aeW-|n(&A(5Q+u+(;kb%`ezbDr%SZacOI?R+Ij#o-dr0}UM}GB`r~
z<frkfL{?QHbC;zkf@O-7b%Y-Lqo)K0kjARnm5Qp0mC1s}OBIvZOP8{;M48>8Bcj5E
z@S>t*q)I1rEX`%U_@OARd^0^JCM{?RQR(FqO=JH#GLMYhy#Cg%ftumk%DU;H=9c+^
zx|^LdrBn0MrTx=gL;cIjuI1s@hW>%+fxfNEshVX(A51-+e)@K3zw)n#6En@tGt>Kb
zF4tjE?Xq&e^QXrHQ>|}mYo?c5XKE6jY(0fRbzr%+V`zAyHoavkX!x*vW?-zaq4O{(
zAqRR)$3`vWnV1e-WMAYo6(wi?kkb?@zL!&&oYo|UPJ~0@U|M)+_DHrU9F7)IR->o{
z3zhzr5}Yw2g6%eBG$ce(rMTY60jnX0?tRU{$DJz(0}gZ-xLa8XtUy!24;|)#sCkM9
zk~#R+QodIr!e#PxD3p9lx*m~{k3A5E*h3N<YhZ3}j6DoU06l3;B%7PMX%KgPO@efQ
zW``^TZ3LT}frhh%+YP!jRsuoxKtg~zQelv(1WOz-#X>A{gR9gREF1te;-ggwAqGKS
z;6QwPb=5E!We;EtmO}*@b-ILfj`JVn8k{7-I;$ag3@OyHu_sMqE&md0iY#-ij>7^r
zJwgnGW1EtQ6@&T2B1N!_`QFHb!NObYcJ}AHCeneXcrHx;GJX=@+GPy}BxaJ-A}$WY
zf!9b<3oM}B<x*YzghGr~#d#1(xE_QL2`+N1OZJO%_QPNbrmV0{8P-MjR4TIT1YBs}
zT%ka61qO~tA3-FQdj$(?9oP~@s&lTpb1H{(9W$S(VF8<qNehxB)mb8JcX%y{i<48S
zDDT(qJ{M&YK=aho>oSLfgY~aC>+9TH)HsK5>Wy;Pid1Z3fzFtln_HbxRgr=jsPIWF
zfGf(L6p3RHEs#+dy40POMi}#pl0`-L#P{Z!Hq&0d|6!x)hmGdV!j2=$1O5AXL(|JG
zLoIc~52qg^LwdTVOWD7_e0jL8zO?`C!`7R9m<*q3c~f6My#IK=?r>^<7+8CG=x!%K
zMeA}z-^~5x*1D~+p@I9CgYF+H>$>i24RsDwmd`Z5d8$Nv|E2Y?r8A*<ptHZD<z+|n
zR6=oQ?bzF#2asQqA2g%~{gGatP#oUWRG1bTG?>;Dp7vla84nXee&_=jtFh27G`l1;
zBQ#rt9vzw$UJ;%l5@9#dWJt#8Mz%ukqqv?D%u$5+c>2l1t{`e#c8%@eN0nTIdK>0}
z)xp=mQ&|B%lSxFz1S1}sd|mumxK{`0J;M5ud@n?YBlzk(atU=n&_P8uL7JVGmZm{0
zV#85d82Lc>GO?;n3r0IMV@x&?@%y&G$*NfTgXXNQO^mN#2hRnt8NI|{mimbc&`7Y3
zP(|eeaa0V{Czh?K5>hs59hML63q)6TQiCptRdASAJcAfgtZPA9q8ifFql~p6P9nY6
zO!FjC$1P28R)yQhfC%mf(gzJgOlUvyqF_}FE72Ph>;VjHaCX6I(5oyFpemke%?!Zi
zH-Kjs55#I%kmEeC#ej<Cve(eDX<QEiO<%)Q4@u~b?X(_oU^dalsif-;G*8^w1nmy)
zR8OI2n9$F|2i-W5FxrhfxBHD#IbiT4g45&pE_0~k2xI#SYc>VK$jB=k<lRY5zrNBA
zN4g*mX>HCzByf5-K&v4|a=58n!ml@eIv69N>poXxf)u|<Oumc)gUfy3T98FI=4QyN
zGUPptBYTtGv;VFZi6*}fPpRn61b`NYb{E0AT=3%FoHz$r8sQz{;_o*fyx%N*^`C}>
zoFk_OYHq!$kElDlKYyx!cwnowzJ8|k#`C8LwA-&+9=lmr`CR$12E6p+R%HYdN%LA-
zYC31?22S<Q*KIWq=XJIy=MRTxT88r`TBlDP4);xcJ$!#(Iiu`U_SYl$QQ308@6ANr
z4^vYK!_CEgg>TY3`lcK1759xnkeNsrYiP(RFYgHID9mXn&bgBix)B-_vmpNdkAJ6S
z&7}>-Bxm0f&kbf3glCH~@O-iWnI)GR{{f0ll#+qLT1868rAyT#h`Jof^@(K5IX><V
z&;WqdU`5Ar1mtjgT#KV&GjJTqngnZEVi}kKKI0K=I-s~*^9e6f{&}K5>)0VT7i0#U
zY9_J1ADJ0{Y^rq<eext`@c^4aIhzropXwTB5I$@$_)T!faB~7b6A3Oj6Ka1LEp*Z*
zatToE*k6gafzk-n#}-+vcMH^o*QgCjHa_fERU!mI*9Kn(#2pdguMO%CLndxSMlR6J
zM^2jX&lzAa`y|rUL9>8p!QcV0PQbu`*kFqYYXln^dIuQlVEHBX&>>2df?c6>mjHe|
zwtBJRfA%7lZ?ml6;7DTf63I+tIKYx6gw0UO{5g&!O~Nn=pfoKGNgG!9CedhwxFSHt
z7mfP!>#)eL7P(Nu{hVnsh%Z>3;_inf^cW;`c6N6bMEa%D1XK>}F<4NKU_y*^awD$@
z$35W%lStwu5}^brhD)PzlO)($=&<-RmxdarajzXvsfgpe=E)Hdn;b5Vrz+5b6c=Ht
zURR`6$vKnk#>SnB(|?BaT<Qr|RL_oNRlg{yz)o;+CSs+Fepo5W7TwEU2p!xET@V-F
zn=1-!`tDUuM@Ql2k*|@XyM^7y)1~!w)8`^0YD%{-sM1_tIrMP3ZYHl`X5fC;@L0|A
ze4lb?X!^$1FA?)yZ(8by8unYBA?ZN*u&=dlAY!QH{>;<mhOy3bTb=VaN@toUYHqaD
zzpdN4vD`V;(mGXJhq$Ji{;8m`C(4@p%Hpx<8;DV8x{))LmVjSVwdFx+33m#Sq?*=L
zzWD<v4sp;u?8==BEm%taM@%6s9O8<stcv8|?thAsS0*oIj6{oagEK;^;NHj$jz(v`
zE(h=Ia9swn?s_EWI@Q6?58F%yRy2R-I2dkVTSra`-x@&^WD25ySXhF_PekG|reZCz
zuN%a(j^W8zEOs!&Nf5hD3{2e2J}e!ySMw!y4r1?!x<0ryEni(5EJZ<~+Ne6|VjdQQ
zu?X;jKtgOhhR_WWg=oI8`4bsPy@57?;PY@e#G)R^DS-s4CP<H7`0^33k7W^N+S+G8
z<N?g6J0X}$19bBl4J}{fKtn{)(mbh!s7OmULt|4|HVlm1>~LuH#sWi2Lpy67yF_A|
z$_2AyM){BUIN4IH`K$O(y0Tngbf$RmTrm}lNDZD9g_%TwcLNRCB?(i4SQqY*6t@OO
zn#v4|BU$W{;^I6=B&+KfPI11%y^<uscH^)sh!qw3!OsO;f(<y=ov()p!rHIVgzW-I
ziqsHz7n#n&Fhuubj+TTeAsQ)+%xxz*TtR3i!mHvCX0_`fAQSs=!f3lz0<Nck1QJCO
zDRB^vqf?LjVWX5!q$JpLlr8b`X=i&vc$6zp$SFO+@{HW*lE$8rl<mwA(WLx8qNR$G
ztS>OxQX!6c@$QT6@WFS5gLC)9X;_~1T~T^b(+@}H^Xgms^SW*>Z{^Kb-u>m-bKs5T
ztMxT4^Ybn9UBA>1mktj^+!$`{s(iXNJXHE{dSJQp;mmJ&SCy4-22S0d?wT&0Xx*O}
zsu>vQs~@iKRNn2IuK8uY9?vJ9Y~7eCjhHwbo@gCQKO7sHn4bAhtMX-S$JB#_+NUjJ
z#T`#NZZy=QDd%)FVWmb#!q`9VDaH4i=6+~O{`W%ppg87V;SUBe5&V5<Moj4U-QkTT
zSp^xBm!d;UGOD7ht4B&MVjy!Q<dQrjBsVzsG>#glku~G#c}>E-5=r&@N??H$B`bVe
z!{VSOAUR3;Eq2VpA9^06&4fQVpRPmf(?%qt0qh!>_Wt(ck77~E=6^AVYGSSd;RJmd
zXFvGqKDg>WXdn7uCeVHH$Ho>x`RYy|iuyyWo%%6kJ;PmRa{|1aep_##J+aXZEt&`v
zQ2iiws}Pasz9@NoCX$^A(5wwr(2TIsscE%gC7{_EObuugQ`)h{Z3fsiVPIlrse$b&
zSg>MAtl)wr6lVQ=Z#vc&>JaORDZtOJE_CSJP*chnbpJ<ukk9@UEJa@RN<zpgnT%ut
z9+@8}O=R+T0iZa3#`<q!xdF+;8Ow|@cNxYMh6zcF*DSbLm?Hd2iW8$Vi5mHHm=Gt(
z$T)<ZNUV0<vA!G8j7*PRG~qDRu*Ace>yF+ojPr2E5rrzGS%vMAq(I?d0{xOKcFCTo
zV<BRHlEU0+Qbc>>J>yp*1y{monB+nz5F(U)LTIRC2kyE+p1b4cyd(3Bu7=5pQ&Kge
z*f~u&KeBqFt4Bk-zwe$LEC>%@iMf~YE=C-hJr@(YnGM%c&|u7F_=ANb{R8Jd?Z3J_
zbQAkh_Ge~Fr?)CQZ<bC!-Fh;d*YX+iIA$VlE?-8e-<XLg1$ds1cyewa@BV+E3`Cr(
z!`ZL3ucq$Vxz4UP(|I@|PFJ?pqWq`(=I<}p)Ga4`Gd$ez=EeZHy8b6P`n8PRSpKPV
zqPDhn>`8HPdSPGj1ad=)iQO=TP36T+9mVNs4>r>7eODfnIrn{`I6Fq1mMkvHOztiT
z55F|HGFT$Q+2DUCvobC&U92j}7{StLc1ZN4)796Zr?T1ZA@Cqw!MDW+tOgh1G8Xvm
z$APLNerhfrL=vn8D>1;|B>>CTDFH_3VW=}istj_kj1m!1j|DwoG_Z)lEjHH4^jiZA
z;>BVn4@sjy76efY4#LJ>_g5QrwYI1>^jcLypmx$%^~FihhR{nuDkIbG!#Zy`HQ@Us
zUbJxnkjBd@flya4`=^Z+CSdzO^7($4+=3XRrmtaZMkp{y8H0uI3|ciT)*9w#G&M~P
zG)>K7bu^5PKaM3fW*XV)wPBCj$G1N=GQx5-*!T1E;X5((!rBv8YYLqOa~<6aybTs1
z<Cx&Z=V3nqKY)zqWD3QK$c=&znh=w)^%cSrGmgw8#U(M|B*h$Ik~`MGBJ_bwa<*D@
zNg`n@tPl}_9+8qbs?Y+uq12u0Npk@R`S~^8N5dux>=wr)E!Kq~znI3qf-yuF0<<vw
zJg|+7b}ea*7AJ|5Ch^GFhl9nONgl$lNRlg5XV`hE?qP`F^rLaxB|cQaX)q`fgtf3e
zN2`1g!FzG^`g)2_Mn(^Y0WR%KR`iH2WrT*q{J#|X&!zCDf4%x5M*OZY{Ka=-aiRFT
z;(MFLM~2UR(u&P0SD&Bi+j?BtKV14_X@4Go@xZB}yLH2tJBKQjH|y%^woXM{?o+<`
zyrr(8CZaTN`R4P^POx?L^%GMyodY;Y-kcw(dHBn6tMcJYYv=UMsm>YYFIakbzolh3
zeY*2<!$8CI<;vEH8yy=BwSD(H5`Id!b9m$JFX<f##fL#bV>vO?7=L_F-ZTfb`$180
zVa|hvdubTD`68<*yC5^GAV$0rGm;hF9UVQA0{>`FNO$nXi;XGKDHkuvu8-tad4{la
zecZo--M~TMa6Qu9;ktx+4ZByY!kEsWrf61BxUo(EUO=J08C(`2a3d1PIzJIRZwx8W
z*1Qc3F)rw>bJEleOCMr2{(=Q&YR1Gq6E`(`Eb>vustFKux>~mSy1n{X>P~D2@{Mvr
zyfP$`3lRITg#t!7I5*l<h+I$GV+1XILj8j33H3l?84#9jsuF|YHUyIahY}IN7^v@S
zLk!fa0eBGbTRRF4Bv2ii$n7`N0MCt`#r9`Tnj)*&+yLC67PbVr0Xze7oY%vh#O=0W
z;v*afu|iP~=UJQq^q|-$(lKch?_v!XM}E9(q8A9~0B?Vncx>Nb5PM4zf`l@5A;<Gw
z0xT#<th8eC$sTJkks^9H$pTYXaU@<G6B&#=8UVF0EKG>AVjSrT(?dc_+P#J?lEei7
zlr6lr>tS^bXGelHvLc1iJgn9{m{va%>nYX{g#ucXmh`j78ZlhYW01%~qzm$P7o}lX
zvIl&E-flq(6VTePFCt;HT}b7GI2?es^Tg&Xpbj7QXz*-qbuPg4Y%qa6E{&vw_w*E1
zH70kbWQ|scF=+k8i|~r?Lzj|aE-v~{kvLr}KGJpS)^c9u{&Z<65On3`{`#8Mnaj)d
zl~_%PGH(6vP+nL6R^4z!-AwEJsXXPm);cWetb6<h3xgu&``@<oU#{7|iBE5SwmdNZ
z+tuf9=KGbEcL#=tu12)<JzfS~(%e6^-=S<BsD08h^kljD&Hbr?!{)r8&gtSi|9RU{
zKG9izKLOJKK?xn{$uSKG%=w`>EePh(@U+42GBaNlBp3a#kQEx5nT#tFKIrN%GDoti
zf<?h87{45Wo4+J?)<<5&zJ8h=B4;}sa5xU`NDk!s;gsTmb<-ZSFnp{1<D5NQto@;*
z1e8(yvBaK*g;)9KKlau`?3K9@5l&$V9?XqU0?k3v8AFXb19jWXDT-*#a3G_^h%(kE
z&VG2ZMU&Mg67BR=?T<nhLEJKu3{D_)9Q_tYLhMW-R20N86E;!Iqo@+81K8GT6WIH~
zztM|Kb8TM;<AInzL53-20&xehMJDtaZ8I%hV(T{OjWb9!a*H)N`O(M5;9Lx}OieVf
z7*P{vK{vbe2LG3hiY#ky*j#lI6EXVgn!n1xa1{#+30z#^vO-!P_>Oo+8Te^`MED_k
z-*wfZjD-x=01K(Vi#1~Ym}S?9=pBEu2Q$e6C2!?_O)5oIdSEH<HNO9D9HuW9EvVAC
zq$^bH=Ov+?TX|qA;2LH!*W!}m;ugt5E1WJZEU=eCYO$C^vWjz-A{vv2#R&*6F2fkI
z#~PBvFp7&jZmcEqPohytyH?ai48yh4!f<HhI=8n+axb>0UYD>1o{^_z>~&8_jiZ<j
z_1U}BI6ATyQeBcVi$T2X3{gqNY{p>b7fTrhp`mHwqQRBT<oDmr!H;=ltF`ab%9&42
z)kk#JMby;&y{7b8EA{~`FF()A8~(AT^^>Ws`j)fj29`_bhnDM~wVoR&t!#PLGE^C{
zpI+J8^4avAfuZHMty{yDL)eK`In;mu>E+g`nyqKk`<MHcTc@7&r9V?vKAftZzA-S7
zpzQo5p(A1VM$lo)%r9f<=@S#hZ-ah7UMf5s>GvLhY%Yo^|92s(IjCqew7k49^xj-%
zPIzXrxFB>eJTpAwi;D1y6j4R+CCn1{{Idjyz>%+_L#nGdqq(T&(>|Qjo?%zm&JK|>
zKX*jQgJ2?uT_bL$u;Ex?eFEPKjSC4XSfg2H7(mJYFlXncW2j?lN;u=OJq673$0rd~
zfGJqG=HYSEGP5UkK@b~9KtMQQ`UIfB7fE(1ClI*-g5p<gTg*$@z&mF{<h-b2^$v=+
zH;|af#!#TXe&8`8?-Tg~sAd&aTVH)Aq?FpIM`41N*ecPh3L6J3&)RCfPC(ITFo&oQ
z!?R{=6!v*yJuT)@j6c?dbrlP!z;2v0HUEpLp_?1<KGIQ<c&qm<auxORZ-bGBW7O3;
z-vCTBonD3|uPh@zg<^zVby!@EIarDpyc`S)Fm{<M`1iE{GJ?LyOsq)30$nVOwsNsx
z##_L@M2WvbtT>?Z0YBmpVM0ZVm3mOgQZnifyN}VqEv_-Gq}ar3!N=T-Re%tc%p+Mz
zua)77U{Iv~ag0STEc3NmgCa?$1Joc;+Jhg*v|{q;@!<0KR#NA2GF6J5I5fd^Oe`Z&
zERuE|`WF=q`Z||`P);=F=+Wqr5CjfoT*RCmW=iFvMi6+>B`b|7DT4*w<&8!E36EL&
zS8~?eLepl^5$q(a$*Y;!s)_h|x-##Z;epouPloe8AO3OR)NsUST{TbdKKs0NpsT)a
zzrX*~r{|uw*4*vCTp97@@ba_io5X4Ho4Wbs`ny;tR9ZXV_pG$E4pGv5PpA4yXS&9)
z?Qm#ne*b>+M8w0fC&SA5+T!~IoywrYv7cJ*3@3CJ*B&O^fwOP!&R9cv2iT3AprG>P
zx#FCdjiw?nc1<x0*_YC=H8;Dc;NLNzpT*(P8CjFjD~$z>85zM9!5P6g4~8_RUK-5}
zhV_VjnkZ;Lf#kXs3}YCC3llnrfp&uJ2s>3=APZX4U6=u6YcN?@{GN|`_Rc3LXV@W(
z&;w&NOb8vtM9cUuC?z#b4Gm2#ScIJ5oP*5>#yMU44`BhYW}pC3%f2XK*qBcMFQ`M%
zh8H7{$eF{OEAqdvs||V2aN41)j~%o5a8g9UV~Ye<K%BUsj_E>T<CH2`KwIS50yq=v
zR3N070YR%psp%RZPERAs%oo#DZdgO5VS4hUDJIV?ac(s=G%++nb)N*&L3oj{*;WT3
zULV^f8tA#gzU^&&9@>g4%ZMmk3coB7o(>jru>CQRW6k$Qst#mC>oNv1v6%sMJ`cO?
zq*ks>f8I4d4;dxk@OaXAe7`)%V5)zXdP&J-64rQ->19%$ixqb8(y%8e2^JApP?MNt
z7G>DJ6lY<DTpAZNdka*rm$knI_CR|1OIiLFyfwtv@R@u@*(x?tUz3s{@Fc;wiqUc@
zi3{yr7)PS+;=l=F&j*6;X#sm&Fv^MMAc_}OJ-^YA9$EBuG`lBdq^DaHos}^uUnmGg
z0$ssi1>z8j#G)dxcr$JA$nxE1&%fT!TONv-zF9vrJ$(06SIxPt`mXu9uKJtPHGjWb
zd3osaXUhJrzE9`xm(HJSJ+(Fe1bg6G>!(k(E`QlFG@LixQr}lUeRCL#W}giV*I*Z1
z|4>~^OKsis^ZR`@H4Vel5BocQSw1(^^5jkDSm)c0{^5=ZWdbo#-lPobP=2SpvyqVg
zAP5{?Ez+%vF+GD2oV2X8!tX*6xzyC1h3ta@%#?}$St1&&#x&tSvqaI+jTO~ZB`F~g
z{$;tr4!OAwu$X(gdm>_n<L=<@=ND!{bszr<APra!n9e#016KF}GAs~1!6GPU9iuV|
z*1sEheQal-2VM@9tbv&&Q{$*J*luMS>xAG9JYi4-TA((x4_*6T;po&>?M2|d%2B5e
zsx`btMBbJvF^ml)jK7H!ATr7Ij|H|7JsMdvNX$UjZbRX#UO;arBFu>vudk1BZ8$fy
zv82U`$j{d&2oCHbwufSagi}phLQrwjFx9|DVlA*N=BB1?7~wWH_crl0fgDe;iXRyn
zz(7S*wvN$x$lp4K#9mOeXkx2uBA`biltavtK?5}e0&yiamjj2e%3SaYog$65UZv2b
ziK`X_3bU}F`12U?yfP_+EVYo9{mkQA@v#|pm3NI<<`o}@z>Y^&z$ttw8GRhbYCe=l
ztdeFj%B=id7^@V%)Pe=2Dt?trIQ$r{*75$kiC$RF%V+sB{jGV(-gc3C@mW%T(i*Wq
znao>cS|LYb(FGF)R~E_eUAtp2msr3cNsWY?i4A86J4B(7g~&&vG2~Lc_f<)OsH9+_
z=hEm(N#l3hD}xK6)dk`oibBH&#X(2D{(P(M^ZEYa&rAC|x4tg@G4J_}`iQRi)~nO!
z&MkM<&7Z6J>&@wzy#B7`&YJ($-HaHzb#tb4tFnH%|3~bu=<KhrYrR|7IuFV4>Dhsn
zN-UPGt&A9$9==h3uBEf3vSoPrabN53tA};VcWN)+NSNxlapT6s#Bkp)&{OK}baXrj
zdaJyHof!#-LFEq`%7e;d8or1rp9^}BTrP$jf3FB+46w!^Qfj`>dXZHjx|Ed?-WZzE
z2-8Mz%1FpabTBxb+^Q;0F2FM)lTz8x1#u#b<8qy?{6L6OJ;Jco4P#X<NSd%FW1<R_
zET3-3(xH37_>c%Q9V{9Kh942iHhQvwsV^q~W07I6hTsiiBv1={g$n%jwoXx?+c0ec
zJy2EK5huS7Wo&yK;DU%DNA!y=u^FNbF>^@yQX!J~RgQhwv4TJPCoUj41KZ$<fmn4L
zVjlz?cj~&>cZKO$SWbztEqiSZVrj8DoTAzYfYeYSL=`mz>1zUbfQY`W;il<k{uh&2
zI}>BWzgU`^Af8O;Jk}#4VBgXNg5h~ROK-bxu?QS&jjNZ@BZMI#xZOoBAONG0hWXgC
z$k1`YLN*2q!6N|(<ZwkG2eZrt{0BoyhhG}mtMNR@raYDf0+g&+N%U0|Gy|KWS*$W^
z>s_y(v759EeHN{qYyp=D1`-4O%YKe8V>0;IH|@f3m6o}XSu7a)%2q9`1Nh!7FNF5c
z5resk0}I2>3rj!vUhz_o_%$rOA;;0IvF!H>Hcci8NbX_6)1J=M@vmU;^Koz==djrd
zhjli)C%8(%PFWwlba6=@U2v(QT2w6_#4d<}if~cIU}5$o?%-()g-7}yfBJBy^3=J!
zzUk*P^{t=Rf1Ni!aI<px^P1AqQ_7hqt(Wtr&(`$!EB`iMdUL<NwX5rD#QacS-NXLA
z`Jv0D^UwM_&u-;C`|r)V`RV?<HAAH}{mVo9rO#?QOZy)_d^7!UCa<RDY0Zs}XY)Tj
zD_$O(9~-_u+)<M-@e}3~bB1e`3CRsVDH9sf?|fH2mfqCVAubHcDIY`{PQio1puvTI
zCdVWXCTC_AWQJoZr8~1RG`vDoa4Gr{__=Drui}77l#*PB$&kostUiDv7fYov26x@>
z3eDXw3_KkdqL;sig_VEOBbfKeW&ZIlEDGO{fq)fPU=2ND{zT8x2uVmMO_618deR)2
znefq>LDSGj=qyY^2>1dJKoYGzcne(sUMJgQwoXUYL0G6<z{rV>Dz;A8IuZ%x#JX<8
zA*tFDqp(E4%u)1glzAYMVlEs5_`oTV*jjagST?1K>q3{9gSEj~Qy+&zP})E?5LA#z
zpyh;8Hq&a;FoqBMjM+&zR5hGX+33_Jrsn2Y{EbbCCMKre!kzt*;Yk=rG2HE~Lu?x$
z0+9?2i5>Q6*3b;~@{N!SoPRsf8k_3kQNd+;2x-9n7%!JqS1+$eSeYA8=7oq37N7p1
z%Kcd`e7=VZ-Jj*kf8>R?S|RO@;=*%HlrjR!SU+Qdw5y8?U<y$8s<j1$CG|>NW4N&V
z8AwF%`fw7Z>roOB^+;ji-#{1@<+dKg9o#44Z?B?9^IX>`9@cy!@|C$3=7Ovr5|zda
zi^D2lW;-SfxSnC{v~_1JWpP;l*+(YJjplIJRaK*n7rRGf+ae;iq9QB0qGu4}|4Uzl
zW|hAXH*SO;`DCl6{#@PFu5(|P*4K31`sSSSRR5`S%V%d!)jWTEuIBUBuE)!rm3J>c
z8=kK#z4||=mg|QjE}#4Q`F!5<+W!8!XP>vUzIi${bnE&2xuN-%{?cb}zNu`vI(+N%
zn?L@y{~2;h@2B5*I-TC9e0*nlx^kdCp=G#sVB(kg=JcS#&UED2Ob`6DkX~Ni*%1WX
zyir)5GZ<8!76cX=b)Fe>Z!Sw*QTTmwTFgHNL$k6A76xGs&7Q1oT!EbO&lFU(C^%St
zJ>;V2s7!V`)jh-$qd`8`Be8GxI_zA2;DanI;HV>$;}}1ac-VAhjc8FmJ)cL>F$BG3
z=$+_ocis@Tcx(bPIEi(`YEV&7&v0khYhyR7nLROM;tLVQm)O~@Pefr542CMU_Vl)?
z>IeD~E>I+lW5FPzaBYdMj3BRLs>gcu9easXXGd)5LF%o(%27lW;1g{zgoRz4Kpvp=
z(2s3<?XmeAYzR)AL>223^H!jp&qV2Bsj{vU9)z}r(;2NOUpzW<1FRE|HU5jSrezc=
z+04@1;Ny>g_RT=w*_nDHX~ELS07-S{O)SsfHnc-BlAfXWBSX9u435#q(8BTG4JgCj
zn8eipsQa#{-o&!9d~1dgrnBh8@-JdQi|)-r@vdT<F7o|WT^QDo&R1F1u4H_~q7{5k
z-uPg|4zC)5>V70O42XXefLtEeRXRbWxZHNZ4rxYyoF1!;xCgMT^Ye`YEHL|HNT#z^
z85ByH*J=QR2LcfxC>B(gMJXAZ?g68jOz?grKbWnFRqe?5K;R?C;UE%sUQf^2>WiF`
z+>w#J9^9m>LuX6&!o!#T)svkWypR&!{e7lrFzv{>n~#5tI6L#~?#y4OOTU?~%mZ0h
z`VHih%Fn*6KYO{e>;8Pixth{SpoxgT4gXkKx;*pcjmn6jnVG8*T@TORg&g?F@YPdw
zSNDe^me1Yj%xi6Kf!G43`cD6?x>I!z`|95;KgnxJn5r9k^W<`KT}#8`=Dz8T=N+}R
z7~1+L25o=11M>O1vEs3q!Zhr4PRJ>25(lLZ24T<}F1xhvW5Sp24TgpeW{Z-u8?!UB
zOA0P#RtJkjBN?;7&{1-$s&g-;1cQ3UMn}Kv5~$nQ!0YUnYV8b`&e<x=gO+rSM0P<<
zBV&{}b~E4$MqEF1G`iQXEF%Lq10zEdH$4Qsox}jQhJCD>`bkY=ZCzqdHgIhl#;Mc+
zno(p($o;Th_*Yf+Kovj?8)9Ue2-f(&xVhtw02FA+h`Y5xHt4S(7Ev4}Vi&PA1vRUB
z;zBPGu8ZQeAqWi+bT+?YS6dsBj|iuoJrUvou@I8EiW>aRy3inT5Vgg_0MmiI7)?zW
zRSo_U3%@A#7JX!nh1*&t2Ij_gmVePP&@wSJ!R!?bRLCzd0h#XIW=L!cH6$h>&Gi7S
z_2^#Tvh-X7bcltxlvO)xBX1Yhw=6qr>_>vRkmYroju;YuBxAc!=w1-Zy*~tGml?Ub
zlm)ng81cfI=tPEh02;b0<2-8GJ3jw55u<(E+m5c|<>gB8jyKG=Myn{p)sfFibV0nd
zUOwFms=PP-JcZ(2_Gs1Go0vI3%U|=yKf)+`gdI25*rA27^CSdzLuIF8bJ=MJhjyxu
zz%yjL>a_fHsvrf9JJ}`Kx?=QS8KYRs;$AHZ9$YC2-}@d}c=xbmD72}d`^cADr=EWP
z<^Jbahri65KO0e67qOhze|Mnt?ybw``tP=WR{7VPGiQfO?|xm`d3EUV^RBC(*0)}M
zc)8|k|JAPMt=3k&_;kL19@O;LU3dHUKO1Q6O8=y^u70Y&2CEI>-Cv%sf7;djto7+w
zO>O<N^wy^XwRbA(JEt13%cbVQ%c-1}iT@}u6prYc^bR=sA0Wk}sriSZxgT=U2Gj3}
zF$EhFo}G<~zLc5qkA-e{U$aD)LcbV^j-LEyPw=IX(csgH;E_?tDDrhM&z|nGE2*B>
zJ>im}S~*)>aYojc6%7sAg6!eKw8CZ}G9{5u>^g?e-767CLOnfSNNXnMF!^Z3BK8gK
z59VeKV|`4yY7wFQPM{oA?e(>N^|b?g5wihh56u+-!Uie0ATN#*%p8_v12&^as}gB+
zszkaXy0j{y>WFH$!I6+i@jszY^mbdqqC}XLRP8Si+_g$uuQp%|8Z(hqpiiVXV=W<}
zMCya~#%v-;!ZX-R-)8m~Gp(pIFp_8@d;{pn&KG|HA7MGOsohD?)25mj4Kp`2^R`Pg
zB|LcMI&PLmL?9ormhQZf;d#j9M&LfoU2p5T>LtScah_Pe=-qakejB~rh*E~I4j1%i
zJy0MlJ+JsgmK~0fNIXFE_44}GNay@2%ZTM=>6L$*Zgid!Z|H4JPsBT1@u~TGlrnF+
z_wC#Gs;;*w0Prq)iPn}nE?z8e9hNmBL0t9DBk<DI=(cO(ZNAqkB2F#Vu)f!-Ea_2_
z{~C=CTNEaUJP-v*^8n;%r?$(kE8IC8`9+zGb8#nF;dd$ZpW)m8m@Nt3j-ISeNy!k8
zbeCjib%#e6Wp^(O9*MYl>iP6m|IMzv%jeEj4(D~<`fMiR;oTqS|JHvlqV8sY>Dl3%
zHP8F!KdZkS@x1lP)^O?NymQM>?w-Bb-?jCy{%@VjKW;sonLc}KxU%o^!>!KxuB-4)
z*Ia&jYis80)Q!rzr?p#8J0Ev+4Ls@ZOMg?ld}DuX`ToG0sh0aUf__roNl+FRV-hi_
z=|)0vLPvReQSlE6L222=;uvvLQ(6I%ahj5|?#+p?Kc;Cgt>R*L0VcZ(O0I}XqN7DU
zAr;jZtD<KwB179VIQ6>hbd{f{JTetg(5YWJ!w?V#t;zyxW38<GX-pV^t&?1s(8qW#
zt~^)V^Uk05GB9+7>%kIBt91-?up!47;t5WG*a8nXD8i56slXU3VV^_O#L?|nc<BgQ
z;#VjpPA6=THHR>08=wp#{__HnynnQpSU-h8x}zt0iG?RbBocyi0kiQjfw%&2DfHSB
zu;VD!586244alJZ3rM8M5Vn3y(-JfaaTdhQ0bDnxyU%E8>Z&0#FUr>!bU3ze8MonZ
zhz9KzYwR0q@X<+AIF-yzJ~q`bHi!8HqL9Hy9~+u@n;IDC#GZHi2sDT#ortr0<ehl?
zk(beJY+MBTFnVMF50>jAJCrouX-zjmdae=1+r3>AR{?&J6_uDz$2{VBBbK)jkcd&4
z&bPN+tzGr>ZnwF5=@@z4M&TwJ>6GbsQ*aG<eR~^4YrU%DWn`^`3=pr|-quD$9^h?)
zOI$TFv?DI8RYO)j%gDRT)eEzl)&$u>v04LB=r4tS=*$$xQLk{Rkz~(EngcOD;NauQ
zkz98GnygA0&Fu;P-<}bLs4=7Gx~QbOqPzQx63k;|A}2jFMs(!MuF9^@{#tYQ^XYH4
zmLop@v~ug=R%yil%-_8`l=t}ZH|J(9-@02reC}#q<^1Km&mV5}SN?z6`xke%^Spl?
z@9fO%+}ly7s^cI8(b23!X|Y&@P7)<Fx}~9Y8XBimkc>#`5E7@ML5E1wp-7bJm=>co
z)?urTWgXUWmpXiW-1oZM`(B^B?)(1y=67Ac$GdxfzyHJUx;C?`5~0c~&-e5Bcs>rp
zEsv-E+An<6Uo3yF8j}|fw1}q`u|R3x6xSDTzSt-o>u=WdzL<H`SpC<5V(HH-?SlHp
zFZQMN^^Gmv%}<A_rB#oT+c&HJv#P4QL7L3z&UrlckW=<woT2WVoQAtYIca5iNq6&-
z8%Frtr1-qZq`joHu#nW&c=&&1FJ-4@g`{@Xy}X~B01UdQNK#S9_U>XTyfeI*odI56
zl8iQL$DhDpyaG-g6mTvb|KS$p66J|G(CjkV6I2BXG|u>?!DbU)b>@&L5u6RU#rWDG
z@Yj+Q0ZAbI=^}LXF^c&kNarNz%sA9o?ZGr0_TjMea(4dWESl)w!ETYr$NbG_#KMm-
z68)6$YX17SFta0oW@PyQvithmuMvCo+mmncG$MWq@bee%%lnyci6AwCM~aycE(OG@
z8$Hdpm;=v2lA`mi{+R-Q!cYvNE1gsB1v-Rh4O|!FFdN#~L`3KtM*tVM1jQo`dwF-g
znmCv?#o4)&+>K{_O>03wal*pI*lKpr-4I?gPP4X_pe_N`L&l;lO0nT>qzyW~2dx3_
z`JOkr=ycoH*KP2k`5>&Y9bet{{i+;f5Ud`3OmX&a!{^-zXVG@B+;Gq+ruNmKlObWc
z<77+Fp}_0ISAy~j3@JF-xDNs|@`amrIq^Z?7-D^CR7*5DPQHdt<xatd7flDxpT9`H
z=o9369;(Jm$fiaHyV)OaT(kZLT)rzVzyF?k<r^2T&_wDLZ&a!)-hRx&0QPrX5B&bu
z7W_H8w*Tc{e#njOdKnVJ4jX}<w1OKFc0wSW)(rp55|$oq4$mA<$%O-NdIfK0c*UwW
zYMgX+yXJ1MtaSVlPc9bpExxIr`)kX%Sp24`Sk|K2Z12_f6}PZT7waKu`Onwd=PgYe
zZ{&}Vk0svhdp=j)Us62XSX%nDr}}AMPrKmBlbxrHcdHwF#)@0+wpW2I+THw+UbVw{
z{Jf!Y=k7dwZTOf6pNvG7#Y4tjMt=s+-_-e$RDRlgYjkW_d`R6hTvxccX}R~qx>7{Z
z5(Xn7h0QMXW-<cUV1D27rrw$S6Z(ySaIeWLfgq2A<pMt>EL}ZeCu(xREXKqhqzzZ>
zxnUa%Y{StAfk4KlMuS#X<wiEROuOS?VEBq~Hz<IjTF)IiKpXhWeF{%cf<SjK!r*tv
zd4PH1@0@>&5%BZByD}pJ2#CgSk*9`GlW&oDa`Lw*)$nyDAiOV#6gQAXk&Jor%v;z(
z6Z`I86Xc_>2?Hf!v*Jtybe=iuPxzyQkrZ(ck}YsY-)mzD7AZbZfCl>X>2vq;fo!~g
zy`9soDbSyd)6uO#xz??9ud%Y!!<MBc|K4Ce=yx?Fe<ZP460S}pq;_4kG$p!eBSV<t
z;6&p@5l7jWVrpnUSPKKvd><TI;*6uFS{S~vC8&CaM#PbIx{VG4Y;Yu;TR6cQ`=Zex
z;B9<5o{gRcC)kMC;?!b`<Ag7XH!*`gP!>2@xcgcR8oeUn^*{o*B*tm5*2u@nXm${%
z`ZlVx&v_qTQ@9jg0@NLR@zU>MHUA}6E58T-BlMr`O#)3|;C<x^go(ExoFn4F{Q@#k
zpF0sC^??1ODEEG}=)0_!yX=aPXv|dr3esXv2!{uT$4do*{&7~HU{kJ?_xG}f1*%2X
z2CGR}KlRsk)znO1(<W;`UMg5uZoFxJREoxfHU0dd=6Q?yDGS;4kH*#Yb1xQ)2ii*p
zT4oxn$AyB@`ug6U`hjWz>;JRZu33Cu+Su4v+Wc_r(cS8Y(!W;ih?~2cM;^A9_0aED
z{oBx!p1ecO-#E!toPGLZdKnC9CX)8)Tkx_DON~s+9u47V*TwFIwT7kfce5GMS=_V=
zZbE7bI~OQ)5u-xURhS904Qd8cLS-<Su!{(Q>4t~Pq>Bs9I{YR$NQnP{Q7+;&gF%!u
zBj0elebF(<d;wu?x66IZoyy@RN~o*QYx>uaAU3rF`^f+5Jt(S-{o$xVa5?Xt{^I=*
z2v=PEN!(y9P8iVr8a>8m1T=>Rg9!Bbj7XmU9pQV6%^=Kg;g(Av(!YN1!+-KOXNd>C
zJ%f?()EUAU>9+)E2RQG{8N&STQ<##2FZ~5X-6ucSxu<g$eTL2%{2yHh!QIm_*8M!f
zUx!$)5L2On-c^z_$yU$3pa$7R$a;<Q$6R>T-4_266l*Jg-8f^Cla;ZdCAfH|HBP4P
z*c(EmVEPI?Si?c%TAV*qblbkflH9`dRXKKxvqTKxg0ItUrx+)E+|Z~79|H5qX%_T7
zpe9bWzR1IZ&;jmZ1mOjOVPjug?4&GwF^U?+m1B`(3db>cCm5o2U$8SWdQ}UfR(PGl
zgABMKVq1I-Um2DYDw-Idi`TIMIR6!(!QkuH!N&%LB=p*QqN#QGB$Wcup%<om$mPDd
zGnuLQ-WzFf)Lcb{=uS}rVIou)U37m50;Sa4u=}b1{qjWVx<LK3uV1_-C|=d@RAQ9|
zC;Rm{OVh7h6e?LNB~M<$+k7+dx=GOcx<u8YR`Gbe<L3kNf#XJjdZYAVNt2-dZYe(W
zXhXH~x~X2?R4tZ^o9gSI_SQeI|J!D%pajIF#l~({@$2HAdNHj3pNbpmpU-b}H&;KY
zej-gC>yef{l%g!>Owb$XIe9~W&U;*$*IJg&<)p`E!>3?0Z!~B0S>#A+SXO*iNPI3_
zzH-^QTiJ@PXa$>%Trfr*<ALH9TatN@ndo(eaN7t+FalH(FnhK4u=WIn#@@`H;4;Fy
z4Ms>X=)eBe0z4NTVNys0558yBU9~kN43J21gpxZBE-`Qk06i3rxc;ZV`1ann0Ehw7
z84%=8Q14Mwzx^6rGg=6oQ)hI{#H9C@$P_$Fc<m!2^HajW9Nh>0#N_y!&(Hq)TP#s9
zC}K1I8^C-(I6ft){GSmP9O%gnzJUJ*I%uHL2)jS^#kXe>5T~OHUk`r}`0gR@g4n6(
zpshcrlTV1S^8KMNw<)k8;UU|6cRfr0{CoN&TO#yT&k6v#u`YUQJ7W@#wv&@B^4Xm7
zu`e3LlxQ&+W9U>%fO<|A7L@l!q=UDuEMkm6+q3h<vBZFgro^|Fgbo8AduwQmB5q*?
z(SV(k6CANggUI8s@O1|&XlHEUM6xio9W-{bigUW>i*oF17egu^L{u0FSqEU2<l_QJ
zvV`9a(La;&O$QeS(a>CsvGDZ?1`6%t22}gf4dktZrh3@~B)%`fsixjAx%tf`T)YFk
z0~6c4C;zuc5xAqb7$WwMDeM%CfEnL){dY!JEF<+hZsZRTs66AIm}ZH4SuH~J7q6$@
zw5+pKEn+nb=URwGpg_AWRF(8LwF~Qewa-~CELKzXYaRmX7Z>~M-%P1C@5<L%%D&P?
z0Z&}qq#4(|5EpB!-w4NwtGnlfJ;J}$mzHRf`%2qO9`>*ni;JszUXKm+OuaZ<d9+hq
zRV<bM7pE*|sH%tGxbt}EVS4w--wx@?RdhOszMPbvjzC3zWGwxs`MspkY_!gmVQKMU
ze^|=SUE;<vn6at<vKzL`PDv=rO<^m*5cT_!>CHr_V}|5U0h8ep+Bbfa$gRQBbTSbA
z2ABne=OFopYYaKa1m1)(j^>x$+z^>!NU<;nfy2lcvk(vtzyZd(SFgI)oC6){9AU$c
zY&M){q7nl{I|bW0u$s?){WZ}WoV`aV0e?p%roe+7jm7(@sxQ9%H9YoFjNwF%>iiiI
zHTW5kqx~r&kiY%xEfKc)_1Uk1Gy{G9{4;|uP9awf4fWYmaHj(Yl~82q_!A*o;HJVX
z9eQv5dw{($nHHSZJLeyv=Zs?QtbZzkz@$OP*4K|ar5mR=8xg06C|lzicr(^o#<_!4
zrEjN4(lxCm<=g4$)jHXlni77$Z?ScWBY+Rvd}G5wY|fER=k8?cTZ^5GyAQw*Qn`gC
z`T@Iq3->`|D<fZ$Y3-m5sTRf8$~NC(&;~7XoKvkWdUMbNNQQR#Moy$!!w6GdUw32~
z=EFf@(2n@qNLc7tnbwf(W}Qe_{NU;U1+U#8>7J>@V4UqB2!M{aEiQu10X;p$^<M_x
zxO~G6jMXo#p|`k(bl>o6p;tT*lyj3h34LNGG_vTPZ~cEIKSKNcK*4x$=jGDN-IVAo
z{>%IGqw%l?J25<`d_G<;lgox1l`H)!m9j-8=+n&fs)hXnDiyDHjrY8Xw<#B3Dy$Z>
zUiX#`vv`Z*7cBz8)SHLuHB||3O7&)JMm)aQ&11Fqs(O@y_UHZe+Ua_%XG$M#qLx1`
z*0h(1yIV>hKdh1!m#F?)QoYjtqMhGf%xRaFl)#vVPM21#+}(e?d$$`#OK|*}r;pGh
z8{+AC{QYHwhK7vtK|%_F=SKEYR%{qdMWYi^Q<<@aMO{U8g^ZNwPBxoCm1Go36!7X{
zQvGh>@`PI;T8?n41Hr9@>AZ_4q^~!?dIX<_5_HjL!4Vo*L)Y^@ur0rhpcJE7r+ZE$
zJH(~LS=n5*K|-55#I81whMd;%*CE7wu+R7w=Hn;Nzy#)u!EfJ#$e_@D0l4{7A_Dd|
zL?A4}0>1|AeDZT5dk}^B<oi(X_c_SFB@X?kCx3@M;nx@h@16Sf=f5V#zu%!d1{>+@
zy_0XxLO=*g-MOz}kp!p?SROXsP^qBlL8g}T$$|(lmh{em-VZ|q*x2a9E=kuQLLV*)
zx&;Qh$o<iCb^^v>i7I^+evMW(pe^aae-uew(6iK#Y)MYK`GYXXsmZsqHMNQ{vV_~D
z(cpryp_S3#ELw_uQ(_+jki-~_5NsW5VZM})&oiwtwX`xN)%ez0;irTm4TP{3A+y9m
zt<5LZ+L@B<Y-~w(wwAS4BuhgQ$S*azHTZxjiR47Gh48@C&dQL4GmZ9o(8|fs{G#uI
zkFOhax;_`bx)kh4zHWBo_Jx>hUwXQP{yr)Y-U$xYR~!O8;GIH6E?*}Chy1+5Z`I{0
zZl(NK2a9yn=#2Y!qElWHJ7a*)t<fju<bvY?ZSSyLrW$xNzNzYCJ!eg^N_qX&$In%B
zrA@_Hm$0-fmQ2kWpH^+C`bx(Ie^t#)iB&uRBAcassz(D&nzg<ub#bq%_vh)&K9xYM
zDOGKPIV~8FmJUnn1tq{Vs)bL-R!UwR{#VnGw7s}gx-$0ou2}k{tn6;H6r#b2$72nR
z;3AFmG(;vR@6(t0kLUkSQu<#i)0ZRTmqW5qr$a(UvLbgQ(e{Jonp(&Gp`s|HjwwpX
z?P3&R;jPHb07LW#Mq8qHfEWJ#q112>FP8(4D;+M@G_cbNk|Wv7gyMNE#tkYfa|&2U
zU>~60FgNruHe4{Wv$DWURBL4!2jwePgAwo{(g!Mr<3%X=P%ME76NYpr38FLftVoYP
z`}x<OV*L9JaAssz0k}Z!Ho@3H>-;+c^7!<#w_qS4eeLrvh<JIZQ4lbQUH51BOl-Ze
zi2?HiY^L9x0p9Vc4*Cmc=l2FmUl=$$M|}S6DHtCR+&zO+XNgQ&9UBAGY1r}_oJMFB
z=t}1z-2L65HGnOnj=q7uu0f6eppL)3o@I?*fmMMXT>5opYx4aq^#DEUS(2=5YAwN>
z&X1e5(>K(&Ew{5AgyWOxpp`Kx27Q9DrBR$kO)Uvn1@?%wy1u%v%1MKkBtxqjJCdcH
z73z2#Ug=h*PI|yEEOq0YYAgq_mn1n^>LTwPbpTOd#`$_ci1g8`JIz`;k!tj8NKhSE
z<{R5s)ebtj6OjRygSFWAoJXZLya>gNtK%hCpX<mC_{#CZjq`sbyFm<Rjns9|wr|Xk
zIRp(M6Xvj2Ze?WLL5v9FyY251D{fUFMyKx118z}v$`+RkzlxABZuZEDX{CJNP5-J8
zEylnRZ}sO@mWK6uU96TjjkDy7&o^1T*JA>K?76C#HOv#2_5z?D7#FNy!P5VHYU8LF
zY$aJqaf@oIRM^tH`nq|zsfD#TrUr<&IM=xN^K&tZdi#bz^It>N&F#{s%}s}m?JFDA
zRn5)K)lZXm=+#4i8{^!4RMu0~kPJl%=XJ7ldFU~{G8rvLWL|3Jer#pVQhW#>;awq!
zUCCM+4S}#b_1()QTwCfCKZtS@G7{K~x(Y>IN`NHuj^sO-Ty_H82?%gWY(sLa*ENYp
zls!am9iH}4gtI0kD9D@)Jqn_!ubY=s2)fyAFe$-zumerh_?4j{LE?|IG=^I_>|$^^
z*GFj7DV?)es9?|iIr6LwKKm4Tl?LA;1qC7WkO^Y*cM=IzpAj9#?}#vMq(~qQ_Uv!a
zcpzZyw?w4&Ng`DqETwPneRhUedK2P8BnZOWfKamh4z9XjHvztjKyh{kXh&=a(Pv-|
zG=RYp;qGW~G6ER1jWd`WFi*mjBSOc(KY}ow)+sQ6l^(`JcdLlm2t-ZX^Cu{IwfQzS
zIF1BDgIcLS3u;xZaYVkmt}TL`YtVP#(82$%mSk#78q_n)hexSXzWX4_Dh?dfxO`Jf
zxc$#sqA4-FXJ==bZ)vHYZv|vqSHH%Vq&JHfJ{kxAeBJyS6mMI!>F8{1od$I=eOkuZ
z)L7+{FrOL^l1TVW)NNA!EKa>U$?lb9IW7w%Fbs@*VckpdHNE5({OS_8*IxzMU%L?W
zA12m8FdvJ$>2S@O8cy?iXMN@SHiZ{E@fIWTUo#RIOh#rAJE5>MmtFBMX>3MpQ6x7y
z?Ewz;=n3VNuxV4Q>g^rwee*)SE?6y5Kc6b?pX!&5Kc7}@&OPrfRSvV%tE|obK3V;n
zdesc;`SW&}Kq(Vw`ZSuR0U4`FQ$HYkv(}{iS=_SNJ|h&D@}8<nH`iV?i63niKiX6`
zcfTpEFD-u5EH1uFR}DQ9|657vi$>0)_OU0ASL%0~AMZD`Pb@#4c*04}k>)H*bN1*@
z_8W%yNonb$>GZ5L4mkZu{H3JWuu&N0wjy_;E*BYgqKYgwu#J?|TriT@Kfr1v7fewJ
zGchA0!0VP*Xt<xZm!As_AvU3*S4;rc-7tf{7v)Qe3E~G~=S{g31WO7xAa&<w&0S+^
zoyr}7YGI~9rEv$oOYGh({q=BVKX+PJ_ngi>1V|B7&Qk{OgWd_e?i7^Uzd41}lQW2!
z$5Idx-k%f6R4C8jI{%j7B;k~QarQS~BOr(%DE%7D4aCNNN`Tn-+*4;h16GHaAIP-6
zzDMi_VZwo)<}7G-ZwY?&J%U~L`KhzGGQgDa9I^67;DnBWJ^@Uh)-5>a4+<Vy4uH}I
z7yu*k<8+MCS?dx<x(5C?=reR|ZIRigXQ^MKS5u>>k8_ys9zn8nvdXveClRf4Z9aOF
zS|`%1Kc+_5S?A*)t{-Ow%+gBF%H7GGq-#^-WQ9sha@Ql(*bJg6N8fCtXN5YfPr8cd
z+7X*bocG!M{CulgJv<H1(L>*X<FA{qr|UFJ($me?2WklR6#iOYTVLQOMz0KGzJkd%
zD5WqXi@E+Pc;T|oS0*rfjk+A_;OhC$2fv4L&7@x_{5(8hP3rfjOxkz13Kb6+6%`0i
zR=~3{x={2(9XEs<jVQp>=(K-7p%s=Y->~E=&2#P4o9TWQYi92Cz)`8Dw@IyJwUo}N
z(E)F)HK{d1fxNF?B~)ojWX~c07Obj!d2@?AVbex`Z_@^A0~4QMqhH*j(y)XA9;ng0
zwUXf>6>H|v6X8JP=A-GxmDkl9&o?%oR<-y2wXC_Jw5Pkd1d6NX<cAL%x~qngn@1k)
zJW1#5JT9C6w+a3{?9A!Q@gbaedRi(dNU6y2tmOUyUb&$0x2B1>Y4K>9nXobI3}d87
z65gd`C^Fja6nbS+8Eh}FHb@%0Xo&|m{X7r?=|bRi<c>glR|jI(?fE5EP_EbAz)o<Z
zoQK0VQY9QgX_y6K1*;7sTo&Wt?W|{M>~8B00~dF!1$93^O&qp!@7?JL%^xD!&_{pq
z>FM9y!-D%Q_Jjx(B=Q2kCF(TT&+oG(-k$v(P-&oeSbTr+`L7ZGa|VSRLY2=xH2~uL
z*;(h`5aDiwm=IEL|8Ku0?9I;s-$uIuI}Ug`o&p^0?5u;Me-@521*hR$1I}u}Ny4(x
z8BGL|<L>4ApF^;fB`g%ManU6*ne}S?fi~*d=D*dCsDY(!jUG;?u5ErCdII#kPWglG
zwYcu<8k1~|;ax^@!W(F}W(VW)Az%l!aPTUGzgR2z$Jtt;X>qRsmZD#S)0%Io5AzQM
z+1uDyMqs|H#i{qtkISFcuf<olv&qN2sB5WLgToIEx?cW0jDgUg$64Z)V`B+u1sw^9
ztgl|(hE0guc{CZI;01s63N&e-%cwT?zegOA!!`0hhk}db6>yEJ@bH!-c2WZi6BS+G
z7Z!R&dlz{p>^>+0Mw=4Wl@(H$5^{e#J0-R*Wa~u#bpM!ewR&!mwc4cIkYhPApjL``
z>NWJf<I{5k&znm7Wr7*CYKGS@e7^c(yj|8ZT|X!8V~LNacyiS$PqwJiHi_jWO5xF?
z0b$?pi|312m^W>fmara;Z#=DE{Ok0?VokBUYG{QuRowHWdF4NQnxBqI#nn%H`nsD1
zoV$C?Rs53qhKBCPqZ>m*$(8Bd9JCtHb`xO}vFZG0{Q1~QP8$EGSU%Q+Y1}MPT1ZxI
zZq^@mb5nju5mhKsir{U=Ou3Vr$t?6vNc5Iu+zRlffhX$aWlyDoV`mNPatHg44vd6k
z7?+!nJw3^k3qBA}1R+ood>Zih7YN?_tdViKg*(O^DDuD*wY7yAtv)I<svq3<&%qoK
zbbDtkq|qBdf<h4V2^#`}f$?iFF3$d%$dpIW_NVXP5Cs|GYri4HR=-8&+P$yehsB~#
zCfG|LJQKX5PXY1WgVgXOSpKI`rUBnM6TJm&{UH)JIPGshL}LQ!Aie<rckoBBG5Gw9
zK0#3e1`SVWSVCK#j=+!zC=W*&4ZnVEjs7`OL4?1h4cY*G0}|p@^ngvzx}&fXLM`;Q
zq#Ab;+JQl1qD0@*CxpIe6LjyvG)KR{5<mvL{&fLdqtILF=hxWcK--cmt?~;{@3CXY
ziO1z&&?cfF->L?Xrmj9>J5jOqYe_iYdbU<Im<03nh~d*x-+#~&u%~{$jjcb@w){=8
zqb#@bF}e*CS2WJ97kw@-TtDx60fMhDO%`B9ZEfax^M*qw5>Ufwu%1UUd*&4{KgPd?
z7iQk7Nc@h`#TNOc+$l;)6a54(+WnE%R@gG$kIz2Qt6FantO|L<8rJms+;9nMa$n1v
zX<@xqDbu`BspYb9dGDOEMLWDc&0;-Y(>@nZ4+ynS$64YT-iB;S@Op7|KqZh1*JP~4
zrs+jiDN8)vD?oK_Ea{zU?qd}fH#LekoBKwdZai-mHYf8AU$2N8pFXUHTfvj$>PCKd
z6@)2`V-F`9q?{*Z@!dHqRq;<NITQ4pq4+XR5<NaXiJP7j%g^EO#kbxciA{@79gUA3
z4NK!zq-}F|Q*s$ajI6Gr!oscu<{gEi&<oIp!mrKCo95xtNrN>p^$LyJ78<?)Dt{>G
z8zz+BcfiN{a*(STB+m$x0K*J|I?#~_6GOt%(9jA1m8mVkmnQ+?Lj5DGJrO45Of;~k
zZFEpL4dAPfKklIlW8DYF=kL%tLpb#XqK$E0k*JO2SELJmPHYW9<p5<A(Z@*pIdkUM
zSj9j|NT^mmB@7He`hbr=k_6wvYUbOMU!R3}^yd*UtJ66PZ^zSwb3Z(nU>z0#V>{T3
z>7oC?5l46ItV47o@V|R+)el%&$3McrSuZX^$KAcgy#NMEI{4Nju3}JhLT~%l$|j;V
zzW@bu5Wz2~##VOd0*LjCEeT8}{d|9P3RZ}#C&4(?im1VHDA&5!Fxu+dkn&NI(WTpv
z5V3(!FF2^z)L7c+&gvP*;qdC#=#bFJSfWBBpfSQS?%q`!z5H3cL~M2Sb<sAX*Rgtw
zLJc`OX2Vx8*r@oH6Nq!nMHmJms0N`fuiU;u;>Qidd0JoV_&yXKR>%VQo*5Y65t!kT
znVG5h5mIkPk#|br9ftRv3PyBMN^0~rmmQ5skQ??O@8t=ZT*&GlpAomHr^Q0q^fZpO
zP+OuDjL!@-m98tNWX0oXmZ#>{&~V85*6WqSs+p2u)|$F$ZBZ$Eqh1v9N(Wf1Ma}SZ
zy<oAgSJPgq?jNq_m2MO_$sUbApMoZQxUr;JF4$-~Y-#MP25SAN<+*h8-^SX9nx)N+
zRXt_h#ZpeyME4FH{OPdwf<^9ra(W~rv6Yp{^Odd3^t{TfbY#sX&1c6iWk*J4joxp~
zYW*RV(F)W~kycR$_eBM)y%Y>Z0)xtA7XFy&m*LlmpaZYKfKJ#sTnY8`^g;?fj<G|K
z$u+YZCN~Jf=O79cL10EgfB{18f=`U0odpcOVvMX{zKEnVcX)~FgEkKhp^lBEZh_uu
zgL4J&zSW24EgI;Pp8<^i_UzY$lj5gm-r}r&eg;I)ufa3=7USQq5xe%=lka!iM7kB6
z>c05)i&MWL7AS-}60neapML%s1XaX#5w!hJvGNAV4yGIafHUra#&-txGB&8<&hNcO
z;a7^w!#TL(>FX16Lc+2UtWh{J>FI%(bb1!Ko;EtpHK&mbWSJiUJi7LMx14{^(o$z|
zR##Uy;%&aWK5z?M@lj<hb)9VVY>ne=fqRf_QNB@e@%8ks8j}iYNRZ^z)YP~;;awX@
z1+0Li=tp2(>O4s7mj-QZFag3$-Ik<psb4_SxAC{aw1+)T%{|PW`fn`<@p3@d5@Ct0
zyRMavjT1=Z`A%^pf6~=_J2cL~>KqMUl@rP!Sc3##zv$_D(Y^x~)JTjY|B-C%5@>II
z4Oa7h5M+2+OTxV~5+!UT9j0vm*hT%Z=!Zf^d{M=n|FzVW8+|{!F64)l(UACz_!Fq5
zP1C)@tE?$i(*W;HiR_Jlr4kNkwW@yQluFqo)V>zT2Cy3(SIYjX(HyOawSr?=>6D;k
zK+M{lu2;!e*pAn$wQAnf(V7e($gsHg;Q*_>NnR>0X)ftgO*L)EpAQJ?<vYdCtLuB8
zJ}G(J*N*bM(j$G6-27ytD!G}SSJK=t(Ot}!-sMZ5><s0k^EvdK=A2P@jHV}5<>f6S
z*=jy}IXjh`w4K$OmedNMZb`(=Qi#~mq7-flbSWtnBE?Gv@MrHkYy}erU*L)cNL*-F
zuF&AgeX}#LGw{HL$kapHUepbETU~G?yP26gnt^-kcpGfo;PPPb6ks$9%CH4o08G*H
z&DveH(!Yuo;i(#T%wNbDbOy{}pz|#@AAr(Oot+7L4MegT5UzAEasG^8XZ#vm4hUj@
zN36DyFo@{P-~G-RwfQa4kq|vK5&Hvr#&5uDg54-0+5F)(^Xb>8VX6eK(>ai-b)bJa
zd-hv@!lwTmk(32l3|OP*{B0uMo;szAv+YlKn(F$)EXg0Db3JE0^d!y^*ncDZLf^l@
z_MCGBI#(M6jpu`<gf~|HgZ{cm6|kz&#c8hbCq>j^)~(TxsD&IL?jHV?#=3*<S0g}g
z(gpDpoiEWq;EP#d%~)Uw<B@y$y83a>`Ll5aw&<{D(TnNo-_xtH)v2k8&?_KWMd;b&
z>yrv>Z6ip|`cOdtw#Mw|Kd6szJCf7Ye1G3r63OB{_-ynFmOZY9=C@sMU%pPndbm>H
zV1s<+jvEf4QB**6)-E8_CHjR@Z-R}J;N`8jbp@Jz#=k0<KXfK`75<RoT_@VANQr)z
z#f}w)g+xcD#NIzKEatK1`q!FdbAr|WCM~OJV0u-ycr^XGzf^g|TJ4kf3N<XXyhZk6
ziq)eLijU<onYtHMTiq__z3El*cr5XN`1zPn*!xBxF43$uE%x%Jg~gis`T<^v1|9f|
znU*Qdm|&&4y0L!oQGMfded(hW5dGWR=bv^ri%S|g%_Waks(T&|Ro!iFkT&!AoaCju
zJ5^8Oa~^XL1UHgBpO+N5oX1~^-Q5pa{wW?ZtAyC4EVN6}vFvEBC`;6pko7Jhml-W$
z*D>H+&h$e#hlHsJ_ws_@HWivPng<y`T~sI`gC#sg5wnNjNV5e1o|mq>#+>)L2)k$B
z+wl1UNueC%n^~w~jod9sU>exf+SyzMfP2;W-qm}~NO{0DUiWiA3W!eo6kKR%VGZD-
z`1Ta4@29}%PNFQI0SxW@8B$;ge#d9;k-E=MA<G+p@~__$KJZ-djsW)&_5IA(ghuwH
z0YRz577)e$)ake9&YZ?Lc<$sWv=3OH5T{z_t?pa&()n>9jeZVQfv)>$JzY$Lr}aQk
z(kCb;P|y?*x#I7GYi%rTuNvS%J>42ukm}l4>AFKVhKj9g8Q~6=KSn*>TAWv`T%5rq
z1TY<;2PPp7FW?eO=lr)3NSf7+(6`j{N5@@*QVSEvSshFFd=&i}8!IFN5O{_2Ip7<*
z{x$h;Yw$@V9ZQ>te499(xcmapqlmAnZ&?swh<%PNq>Z?%3kxR;4Bs(dIl2)67(T8T
z0x1`x{%B_6NejB*aKk$4n%N}nTE`Ux&%%ipMs^C1jLvVoy}c5=JG<Ud?=W79m_HVE
z{lL7#O)X0MLt$8MZhY8Y%1^stC*<SD!!qq_t$YAcK(4=dZG4#bM%FSnCvWPXdDA=G
zq!q|ZUr!5XO4S21M+3v^Cb>YS752?&j?r!id0N)A7BZ9pp%}a+?M(lho|&cr6|3Y(
zBjc?P42WN>i+eX&!&3sZ8}%jief1C?!j7?8+#p7;+}u}6Fg65#>*@K=k}Bz=vZ{w1
z`oBr<((@kQm3DXUJl#k3VO~;Y*?eU@pFT3uz@@`|V<euB#$)tZDnYD6v_#q{f~<<T
zh##mBML*~)tYD(^D9Y&ax}~7{c?Wp6xdh&F3CAc%^^gR*gm-v^+lRMVn-L2Ydk4g4
z+CzL#CclCi1(;peZ{NOb?o*CrGjPLVe6g7YYbK6Vdo>QMOC+yeMG%iWJf8JVeI5bx
zMV*3APZNe*{)EjwNYS62J?sCT&+*w=LU;0BgmMz`@n|$~gnxSm0ms1KKyJpu@bnkx
zD?rO2k|khfKr|QMqAPdy|MpV|x*=3S)?36qL}mixK6ysx9u_DV0ntXo%hW(0HXk_S
z`np7t3XuwcIm}W|#|l1;_jDo*prOI^W)K0;SofU1zdK-I1aP6)!ls&ZPtVe35W7Q!
z7s0(OAK;B?1PSvQ33LxDz5KUvq#B^Zq<rkpZS&DYyq_83EOq^L3JUTKaBL%H3-GpP
z7VU;5h<p*Y26~q6wmPH;9sRg-`55;wK)UN-?H*SH$VJ~WBJN&XevKs>4s`2IdcLq+
zuLXnO+{e_>Jm%GPpNnM2ui!}i<yY6qE(k!hCqpynIqC3w1OT-CY0~>9^`@7Xcc-71
z7fh0JnS`tPR$=OQxf#s=X0t=GQnEluOO0iZMk9u@k{^FU-qa-5t|^5=%}l9EKF~Cy
ztX2=m`<m9Z!>YMA1O4Kr{(g;6y{1%Zg;VQjH>T%?OVz{U!lr5MdOuGrQ>n&>Wm9iT
zOIK%<ERCjLSTa2~GyZ5srRjatzbNkgPi4Efq^h~UNAO0x+4HdR(T1SDzIda$apgs6
zPxH#-#-~pj8^<1xb#qp#8l@9==~WX|%RO*?<|LOjbi)w|CU*PToaH1W*e^v!j&k=R
zlTzVl9-l3WAAw;(T3CF=4<cq*T}5g_MGCtvx66-N#P&*L+@VSWzN2}=#N5S?8ru0y
zTln{Zp>5Xi_d?2^2@$Vw!-NcbE7wbAL9T8=fQ;ONgDqlwz#oHU9XL5)%@|>BF*GD$
zLb4>5#CkTyr~RD`^z@yHG-E)}SbKm|aT;u87z~_xpJ)sq8fsT?Fi>#6I7t|Yg5(cP
zH>Si-za@MMzJ8z4b{aufU&EIGcm`}daFXF$2Z9qkN#SUR{|G-uXi`po`#w%6f)L>9
z5>p^XK!4}6kbIqkvkclFBJ3hU_Y`mrpbKbTPu3LV>-wV=h9wx5C@}K{A=*mM&eGOq
z&_+KWQg!$n#1ZR`tG2ptNtRdj;?UIMXx3m|h*%?CqF=DFwLzO4fq4(DcdfpDK|Y`l
zof@3(IOhnGjk8V-;FNrQs|cGKy}ws*f`yH*Qe&wTVe32?hwqF~8ARYa0)z)>&W3mw
zycm)%L49(BS%NF%02l)=I(|jDOoqG)IYdGDeVBxrbX+qrp?S1<-Sndd27L2Pp+{yw
zV#1#~3!&UkNT_&+*`K+a`!BoEttmgoilS5gfLM1T<2!y7Y83IBe4N#?sus=(l`?rh
zOWid0;*GjjJ;0LT7&rAQj~0)_tFnHrQmGl14X>*DTlzJ;8D6hUT`FK{dh6H5XSCI-
zqqXU3P&}G8SDQ+ekQGi($%LBWVxDSofG6ld8{H^oEefljZ}94Sx)-a(52dW?ma(TL
zW2HGg&C>3}?(U7d$=DU%l{R*7l-<o4sp8W)WfSQ+`{~`IkNHWF>3NZnd+BLOv3bw9
zNn9ufN4c?kS%@20s^GHIc8l(d>UN8MtSge-DMEr~2Eu=^L`m@S3!qV9mg^OcXo<j3
zA~40n+CD0ZK%ohLANa$<$DC-N&Ca_5g@)-foZcYeH>$NLw<9>|hVB+l{*aqur>k#g
zLnIpO;S8NA09Z!|pb(JaOfZxoC^-pEKfDI~Au~Y-4dxNJ`aqT;S~*477l8i^FAbp4
zSc?$ytlv1FCDI7t7(;N8AR7eNnTVx;@A<bU&*>Y0A7Y>bf(CM7aXlySZg?Yne%3}G
zN4FLyZMMLmK>u?~n*sxW8z5)?I{7;25wI^Y0CJ4{0Fn&>E=GV2t%LAdw8L;xLUDCR
zZvkrqOGMh@1fvZ=FHr-chn{X6Dk<6ngo0w@0<U%(J$GOeP{7RU4;G-sw$y)5*_%Zj
zjzDXzs}pAfj6(-oY<Hk3x;A>}NO9P+>l5pAy@)u%OBg_PL<D-D8a+F_(y-n3H3e?u
z=IdKdadm^g2gHSx>zB;G^ufgv0qU@JM4`C>>(`sqfN!X6S7_GMM2`S(7X)<v=*P}P
z@>>P-f!_ns|9)8)!mePaZYA6op*p7~q>QA6h+?0`o+#$MR;!N$O`C7jti}Fm)ajO^
zjef1Te`Z)Syt;-4;|OS-a7xC*0aum?WU?bwuTZHjDP5Jx$K}G_Ik{XY92ZWHKc9Oj
z!$?@F6i@fpm#SoA;ugU`?{Is4NvZsada7mS=|+p7WNfjts^vv#bxHl$!{R3|9zCC^
zs=xb$RRzJ|6Y2g_&S7)a&VMc4<#4(uy7!YgI}IE-<tAl=BsxC=Gts?}`S`!^MIm@C
zW`(4srDdgUg+UCPn~=s%NQg$baYX_G+L*aaW@bib1{35BG#j1xp?pL02#4!%xTihM
zA=HJ)%><9b1cq!kD9FzYf;Z2?_3Li4M6k7E`QR*cLvYH1G|rfG71i1FsvYb+YmFf|
zEdUaG+Fv)K!1)y5V6ZtpKmA^SMJT<&j7H=(dSd@?kt`1k4_yaHb7$VWL7zGGn^Rxo
zEQ62t1>vjlsR7}idk&S?nQ#t0bN21Ilg>nt3dAlEZ}klj2t?563{Ds5;XvyYfCWXQ
zRru@L6bu@Gx~fM+rx+N->4EjETL6lY4M8#S$1$oYK&Rk7i|rnWR66=KHrNkF0E;Ui
z)xd36$96W~7Mm4)JNQO}O-j-S9*3b(PiNLLU+*5;3!K$___fFB+h7T!TccmA2kA>e
zjXTaK21ECn+L}RKg8~eHHU;`Mx-im<An4a9?|`cz@q&>sq?UuW&@}2;86Z6X_QL3=
zEsZR!EN)XkcBUAfM^u2%c}L%v>ld$odC4J$4F5a8O$*izp_IU=(3>8i-yi%3{6syF
zb?@z$2}^>1_3rYP+{)O7Y3yzSTl6ov?5x=Dx>6C#@IzWySI7^sm9b&}y$|}nc%3&l
zJfr57%Eo)Ae^#&kRe3Zc6Rx74kSUwA!kKaP>e{-z<mYu>lV(oSt9m0>YFIp;S|wA-
zv>MewpLU>0I5j04X9))uHO0e=y(LquRn>DAi`Uy!I#4?OyjLt_J>7h?DG>Iww`@Ld
zZY(KTY?PPQ@BHV+R8{>$s8b&P+u_}0dez|$|3x>ay9}qfF*%u@Lr+iUaQKz<^ofb|
z{m1<I$o-`K{m8!{4>mpw#OKzqtmx6!uK1L?uxQ0@3S2iB+YDwAQ^8bZBxELd!^%9-
z55dM);K7JJVL&MMgf1R5ht3NwAd5mY9P?$U8Cnmt&zCQ`U50wujk56SJfS`|G&~Rf
zIpJ7gVFBL)Cxrh1nz98DZDT`>OTeOu?Cg^|7{!Q~%yXwdhX>us(`UZ^-2dDc_ki4;
z{VjoY5a=Bdo=Mp9qun@7L>Hr$Lr?{N20Zu)(FwRssKwvfoHc;w-I;s(cyXL01cK;5
z5OJ&rlO%%Y3{(Y&wE#pv^vIY@QAml?T%!vZ92r~iH+RNjUeDIwA6gZgS+p7Np)yOo
zIHFOi&4*gdpM({Mjg@7D720b38vpzVR9;Y*Y9e6I4rX4yyMK+1?b|_|Or3LhP2g`K
zb|@(MaRxPUx_SnK7%OMb5s;mw9{&A$Bzzc3FMa2H%!xJkuy(=%#^2cnU<VMDe0^fU
zV(WyzS0B_qq+fvI<>QDnPgh^J^R5@&3@?54$AwE5C$C?)Wbb*=#39JzhW&-f(6;Yk
zntAgZi8X*$1zeE8)bI*`H9ez(5q~F9RF_-VmGXz&qTJN5(f9|*>3f+P&#i1lqSeyg
z36@a2dMt;CTM4L*ceKVDUSAvT@0(VO=TMY!4Cl1R!zIUSbG<6%s_c02cy3z2Yg%oR
zi8V7qs9?1!HA}vxWHrt7D(i<=tCa#}|F}@xzt}4u*9ccwZ+c7WS73YI^SWfXx?WXU
z(!%RuHHep=uRMmpu(|AM&)urVN6pD)Rqa)cbWYz+&toYpppz$Z#u}1`=p0UE12XOB
z8%C1%ld_ZM8@7_tQ|DtNTO-q2MHmLNveIJHvcL~a4NG9B)J3N#qS-JOE$X@>VHRfi
z-J10KP7+R?ymb&Tndt$k6~av&!l4zmjzK1fr-?PJ*9bFA_!b~CB?wmEuVR9)gOcRv
z7z3rJ(R*bDbU={2xm(#_Jhvsy;xY_;3dh+Uh#gU%_24I?10aI%l{u;NIbkgTtI==$
z34`a;P{MwF2JYo=k?(`lACRI?65yP{>9^k^Ug9jFLOeq({;(;*yExYo5WAxDIHv=$
zGkOo47eLYA8l7`L?Qg4NiNdWH;T%UyXwJH}HW3EK0LgTrPeFROjg5YszE!P$0Scs*
zB|%Bjg<4E+5P)!P&0CWHE1Y6Ws|f5oY+=pepYLA_ew(h%IW*4hz#wd`P)`eN2XSx<
zY_Jl!N9-5zMPQLf2q)1bL&z0jJ4g^PpzA^rhd5XNoG!M0dU(;~7ZBJrS_{2=&{6UE
z5w&P+ERAcgz5;pF)OXgf_K$|hryUG-g%vg0yV*Zdka_q=i0thhJcF#^#p?-E0?*0s
zC#m1iTmlnsc6xayUQs}zkD%`dnHgL~79*u1n*DM&?Ik!H(R=q((zv59!$#8L|2rf;
zto5g8`UzHlud-xDu3c4Wv@E6S^|}^|m7~p7o>nDZlL?RK*42Fjb7CQHP77wVOwCi5
z&P~fSuUFTO<fWymQr@^$b|hf6tdIXJpK4<Dw>Pbo_Rh3SD>WM}Q?iy`S+A^kc&)m+
z{zZMUu)SsD`PyAU_0b{hz!vK{E!Bue7Vn66q}^4`-9yQZ%~g+bs#Y2rAMPdd)00;?
zm7K>_2%CVo`x(gm$w{z&=4Zzzjkc!#6vlmq6ngZ}B80ScRlu_D4=IY2t}td%LLHM)
zmvM*L3F;NY%TM7=%?yxWH;AxD7x1&fJ;FP$kUgSqgqk4f2CB;&6cY;UH-fHH$k#!L
zfq$%{&-Ge}mmMw4A=@Xkn-~p2c#Lzxg3J=j15zzc&S`h}n&VWT!Ua77i@Q_sc|qHN
zDGl-4=$Fs^ecg8kiSyX?8GLO(gl8h4`z*mQ1r`S14h)Q^Yz&;C<MuzJQ*ct}p6*Fq
zydvQ742kPWXJiWLqVS)C9>qY<hN#ZCrUPQp(?NywC&lUH$H7X*+1&<<k%AiH+dwk`
zmNpi4?r?&Rn5_jIhus}6CNM68I=u!|AzfWCk1h28LDvFX2D{TruckmJpBQj!^lAad
zVYQ9v09z4#^b$Cogvb_d*Vu><G50ml2%w>W855XwdYBq<t<tM4(9OriN>_If*Djqw
zTqN`g-0jZg*VGyV<$f=Wh27L`H(&VGA@BlQlk=2+Hoxu@brBgv2n_f9GRT1l7;|u#
zguRBt6^P@mFu!l}3-`*n5}@#|`0>`Q%w05-era7{DL*X1NVF(yD`n~aNa|1b_x2-O
z!}jANbD~4`V^7TSw7sl#xf}=eNZvAYBxDUAPY)ccmBYj0xw+{XVbl6COE@#Pw)lLY
zR3;Ozsf9C5ETyt#RXcDr0|ZalGQP2@UR{;Xs8oyn>*MW!@MNs|0r7_T>0<qiyhT{w
z+#(oL2^XJhx;0gsrMyOQWAUaCij^1D@b2eHt9QnlyL)olrF}j0!#?Rs*~1<F-G-hg
zJwuNh_!FG6^c-n+eDd;W<mh~5Y&^fRvNaL}=#h|-(PyGj(NFQBtnFwb*;tg;stD_1
zZ>6vkDnwq)u1@a^34;kaj-Q0;)#jZD?got-3R;UN%%4L8(QqIKDAdHnE$RUAdt_IL
z2yrF+(wy*~D)$8rZD{Co-W1^@Ksk_yZ8~c=3!TbU5EG2`a04QMiuJicgx(p0dqkDi
zHPD5e1hd;|f}u?8SWfADVSr8po4hjyfH7dgZ{Q4M<lDb9m~G%ur%S9!&N$ygOyTF~
zll8xb1p!31`e1>g>xG%uX#-r_fnvZ%wBVkOGlnf^|8th$>PMg|`eQR;;}3XD*B>WS
z_o_ie%`B<r>MWQ+Xk@_xH6@^COYnts-Q(`%li;jtYiZ*To?Jc(H8v{7`c632mUeox
z7}jcRL9&R8vv~yuos}_I9|id^<+Ze&1rQQ}F;O4cxAzE*;w;KL&OXo+o!R`W{_cZ1
zR&lctU}RuiMANO~Zme$$k0#^U2zNWuEUZq;9T9ioSbNde5gQX9ig~b^>vcHQ-9YT2
z=a-&jYp^uj5Y`e3lllJ$4{iICwMRf^r-ye21NP3DnM{UXN@hh$=I)Ofip+O)sktd4
zZfi<>SXg|@%d9Pcw%lit+)8F;Y<A=cpmRc{YHqc^MLWH!83y*O<SFOYR|U$c85taL
zn`C{%{qj}0K-pVAE?171P7TY})xeioGsmoT^-=G0wXjJwBb(}f3R9#hyc(v(8u`>}
z-&)ga&_~yWV_@km_Erm_!0M^5VvVtqn|M?8?b6c5lE)=OZ-zJ}jnz+|6jwhS>dtGV
zH>Y>gpA2<3OOZ4&l1E1XP(!7(EGHRJ$4Ptp{K%w<`K6?Ie&k+Qd~4cI(P?4NmZDn$
z)QGYeA)?$}8002IGk`wBm_H-sJ7y*|v9L2UBf|sv^HAx~!bAPqZcbkDLY%sNIFT`N
zaI*vMNZ1lyxO@TenPwo_`IwuzL7{?J*aftC<`(c}guv72wy{NREhHPp#<Ni2f#YMW
z13UohWUzovLxDwbDA3#b12J<3rPF`_DZceT3rO$Yd;T5KLV(cx^|>#InGeMrrUyv&
zxtD(r2;E7@1N0%T#kdD(!&#p=)WDRT4Q#;D*Eb*lWcbrzB?z#grU0xAUCUYQqd}I4
z)6XZewQzvY4(sUqTe+J8Xg002gCxX?U~<l4F^BCOn1Q+lrXY>F<G|g^*R#{B1(1gm
zU5h23o}Q%>y5Ia-Y*yR}uhIx`OZ9QkQEQO{2Z9_%MH2Sh&U(&7KLONEHv+F940tv8
zH1`@EeXL<>;!xV%jotOZM<iXviwF?`gOoul3fwnbgAFNezHY%j6rUI~^H&QuJTFGs
zJGum!c$zHyb4QzJ+qIjXFx8-WO@<?Ch2h~H9)M^R>%vZEKtLhm$1T`8NB?-Iu41<?
zf%{-Ip$=Nt5K-7jQCd>SNaSC#V&{{xbJ8lgCzQManQ~36UDRreRpUG%Z(7_tF2sIB
zsqQ=OpAq!;uFk2CRpZC9rq$Io!Shw6a;{G^Fs|%7lF8Op(>T4n@wL)5Icsh}Jy*Ie
z9xqX<d3`FeQmqm6jt^J2G;0JKsyEY%VsJWm5LIb5`l_B!37$R_w9hmagIh;$Zk9@$
zmwT!>-JG$iu_4X`r-xIST$YR^tcjuSG<r^QReF3wWqM@Z@^WNsI$~?Nqk!!Gy>+=Y
zWHdXA%T4P_1*JcXk(HKOkt(W7$*oJMNT|3&hzE-lev%BY&P1Tl46ksSpX6q^N9Pq<
zpoa(gG$byW(5&szMR(YnEd&9wgA+6=w40kFK^%oJ)|YbIH^$u80`@&V#uo6MEw{7-
z>z!m%i<MYDcsE3F8deFw%TP^0c|%Yej2X|Nb2trP8mAMYKrlb=oyJ}qfF2qNLZo#T
zJWc~0%!&xA&^c%0kMr(qaL+joGFC_e@uDDD`UW*RP)!jjDcJO3iycvbQ~dt#f!f5z
z7`+4GsIF_{q+?r98)sZ=8wUoRsjd~M`G|P2G&IzAnguy%(010?5?mvv8hD-SxkuO%
zTxhKJK>H+FL4t+cIbA5oOaViqFNpx>0+}#y?a&3fT%)gViDV7Tl>q8yF(U%V&?$%;
z1k{Y>jeZ0gjW}I`vV@lbs=aQ$d%mt7tlwvi2scxB7Z}ErTU<8<AI34p_wsc|u$#@z
z94`c2gh>qTLR6G>6k=6qkZ!||n?`f!kWj6W1HufHC|nd*FwoZ}cKukf>z&IiEc!7w
zi}8~CV6RBD^n>Vr?#ug2qX~Jj&%(eV9)YeSx^gcBYZQSJbdCP;wN<b*w3`0K{$3d|
z%gN<$#@B&E&&;3zt9h%XGpzM>u@KY@wOFI>-xRK?w0#<0Z@;Vwq&wm8@HkH+XUXSE
z>*rQ`dtVHctSzE{mdT#V)_&gXZRd%r<t1b7eZ}I%VxFLWqrI_oY*XA^^01|OrM_6Y
z^Dud(x~jdodFbi<-5pN#--eQ_q)+m4&{J3PbM7uDS4K{Nh?JBE-@2r1J~uCYsWPpy
zG7sqUAJPyFn;P93%dM!(t;ot1F@8v3C{kd+0TT`c0bxV<01+}7bspXUZLsePpn1S4
zmj=rM`>1drcGjL9CN5+*@LtU9FT*Ph{6sf5&kGbJs9c8Cpt;X&3YcF`cICIrVGm(v
zXsBmrVd@SAon0JElMHl;{jc7+I2~da=5MKcTJLk5ROioiY|iL_e{q^%6cNsi7!&<<
zPGia=+-`MF!ClD)3?tA$p{_+{tj#_Aq3e7~4<CE0_c^c&8y%nypa>yQf-p11dA6;^
zrcD<JizNyx`1a@`tgu9x1sN`aga!yy6L(uHCm4C*yQ?MDLh_39WoK7YV`XG(XX9iU
z=L9hVd<f#KjM4wwxyQM?qjtl%@t!4UMwYg=PI1OSAV_aX1~zEFvBe|Jl3;G;e^no>
zXY|96G7t?jP(6^T34H?*rlspYh^--b9av08;F4hod=OG^TO*iD-Hy5KixYgE@<$5A
z@w`uP(B<;rOC1P?LjVQFZ+l`jOLO?6HCVg|f0J}x^YHUxQg3y1QLRCrV<&oNLJ3+}
z(Uo!M<!%LHU=e4W8@(6CZH0CtESo*SjgR~(D}FR7GCMCRKC&{s@`PH``&zC283(wf
zzvbsCrBF4nDl7#Gr|D;D)xAyAnmJ|r+>CN=plMpR+CMd{nR@eLx=FqMW?Cj>J)a)v
zALvsLtgopCRC7w4^l2IEczi}66Rd9Z34ZQfYZ(*Fyq@k?O|@f}G9c&?FA5%(RM*Q7
zOX^G7TP7av6d&%0s~h_p+8Yn+IpT@Np2s^mV}}i8oS{YzCwZhSZ@H>rKc`aKFhZZ7
z;50ziJ(`}!%?k;G?Q>RMd{$~~D$#4Crm@3fvl1A&OQMvpggSPi=+3(e_Wxoq7?KRX
zBF3M*F$j9W(!4E@1`daZN5G^9_=heB)(0kJibE94N|1^Qy*CA?n&JvJL6D<cP_X&=
z1s_;(xGosoHUc?`$k?g10`DF96ObGsjkQKkrxu6poUM+nF2o?j<rt<H`UPNjg1dbB
zOumgj2E2lA38f!a+Msw4TB!mw(fXf*iLa;g_B4(!f(tRh5%@%b9@=m{1GMG1=dJ@3
z4z_guIL`zw=MEEGOVTWaOK4klp$>@y1Q!SQMR&sNIi`k?t=hU<07q~_KV)c|?{BI%
z2$Qc_Q=BnFLkMC~mYwcFfkm=~mp_<7aS=|lK%Z^zIROB%wS7M=+5$G7tpUr<7^_22
zM{V+fieP`_4vk?A40^2)t>_*B&M3(?9}Tv?-ql({AqzCcqTFiG%Cr`<vxQHvBak8U
z7+=aOH~}sMU;pa*rSs=~VAdb>CD{{nbI&OIYvdc&lh>>d!aKrg_I@7W|LPE+aPjuL
z)dnX5k8QRW8#eTrY_@3kJ8wm9u6I@inEG7N*8Cr~!s_bohb#f9{maq>9Khp8BID`w
zuslTl2>REjhfAlGLRr6Ty10KvxLPWonHzx1e#`K9i(I3gQ3-gf<1AT|R=z63-Jj)z
z{{~LETF|dq?{Cr^|E$LJr@=vATa!-<mD(v;(~NMS_XV$gkypPcEEN_HG;a*oi>G+6
zn-_(PCE~G-H;sqQQxEH_pRcq_d5tTNr1Xc4RZmw|4(}fJG!9jBs)tr~lKD^Qm7Mv8
z<*G`MMFDc4I_K?kmj4!+O0*kk^vbj(L>7gl#v<()b$UCuE?1Ps&dn`iKtNbg$Ap==
zB7v#sVrGIhiWJR4iT523k3>m$fPLsKPngO;=N)M8GU*VC$aS(cve#Y7IMG4&ZpfWL
zeuyLGvN<J~5>)PZ8+LYZXoNQkGO^2FSwXpJ1>HTo;cV=z^r7lN_>K--UH~rW`PWz?
zQw{3{1NVZfXolhXVxU{#?CuO#fzQzrgM1I;4z$ORA!5!$3+k+U+D6ad9zIm#4(Q7U
zxw07GY_2-%xYt|-(rj6vH>+cemysO^7Y1>bSMv@1bq(zZg|s_PG^reB08Y^C*34SX
zB6ko0iBOmrS{mUP+u7L~8rPC+Ez0BUusnfDk`oMcYwTi-aaw1M(UBmoxyA;Kvr{cZ
zRN!@h@;M7dHlZyswkyDuCvFxrB})iY@TSHJ1P_c3gQVFATptMicD}n|K0X8bLSqZN
zStDdwIK?;y2OC+Ck*e$#jM>B0Jmx$&`oV6lp5#j%H?EOg;d5k74*loQgHRV3p(KLW
z%<!OjBmUS=lBl5heZyq3!wbC&8Ej@Dvj}#YOm4=5T@jZN&EC(7j?P+YP54X5XzTrK
zXh<W|(o<ufCGDmEIsK=JyonPkrD|<Wy{@g-3j5!TuQd&`Sm=8DhqbJ^Io6!IUnAGf
z3@g{=AZg63DaCJ&SsK}}OgN(wYQ_OPgWNAvi^rAyeNC&pKGuM0dU|S3wx(tEYMQ3|
zre!l4-p2C*lyJeK{P8dr-lcs58&A|vT3Q-61k)?+&r4cL>Z^Jdo2!P(+Kd0nS$R?|
zP432tzT235_c8rRa$`J<pp!W{d3p4lcs?gD`On!SBhUDi@$vlD5ya2OXT^tvq#*V)
zEF@kOR>2Nqv$w-UY$T_k)yVAXs$+CXG8v5TyfQiynYY4`aGXKyq(Y_wL-T8}7`=uf
z4SXZY6FKZACf8ia7d-8eSO$BUp!1jE;qB-{adf1d4-N{xZH|ZrN082qVi37%XpDms
z6L%FuzAh@79X1O3z_-v!yE_Af&?(Tj0cNL5xHjrQV2F>vSpaVh2nrJpG#qZ-ak=(C
zWko1g@x&T<51iHk`m0A+&RN-j9}nUXNPVEl>p~a<VJTQc_$Y=llwRDgfw!|Q+yZK9
z?8?z#z+K3~6kY>PR^_n2u)?LJ1|GOER(7?dS>IY?ix?*xa8V#cf%gLJHZ1f>u(7MT
zT8_IU;{`n84xE@|=x(cr*M=py{UpL846;HLUR(uWIAE(s0)-mpGmz*QVNZ@&3%hcB
zu^JNWWNdw*|FbZ1rBKdW7=if$lOx!fz}g7uvp#NLkuO`@n~;$ogshrSWW!#PSUY$i
z`x}d`4Ca-<o8b~_KzJuJ^U9Cm+w5BmuY^oSLNq%wH=5mA6rIQ&O~_4oIhq<BmIAx|
zkZ19G36aZT@%WwZWrfiv_?1aX@s;U+PCC)6l=ZLo5A;KcA`|wn9j(ih15L#mutJ+~
zBEh$t{&{>3O|pD=S}yBlX@_UDN_FuO3h>ctix9e$IpM%MJnhuILfLxLQU98J4ocYR
zUgfZ+R4@fmc<~hPMF~9Yjy7gW1U<q{5H>cNS~kksOAtgMleX`)Y>E+{`3P~FjnxC`
zj~c5Q`OQ0dJv+%|BRdWB$|wAX{4##!2v&o1{yd+PJ`$N!xt!A)+1kL*icduheTXOo
zRHQJ_pDRMLqrvB{V>1{E*#8!GDH4hb3E{6F!!P4I4@ARyWJo-qPD!MO!hnN%(<QKt
z))5|c4a|OrQ0og(E+%9Lv#2P_buz`CVt+XXP>1=&+n11vLy0lR!A1jZ?uhsa3u7>L
zkwj<=zgZMQTT81rJu7FJ4n^o&#i2E@b$17A3Ali>j-{@Svq6M=0q|QJjCF*eKDfXU
zgi#kkmbWyByQf=o&L)E3_~24bydFRoii6RI4V;+V?J(dWtBPdoJ`0tH;Z=7O<$K14
zHTsAqvdy<OhPBaxmElza7l+?|xs{U-tTK#h?Pl$2Q70{s5qlo$N8{Uu2nTYqwa_y(
zv_fJV6n|DY;a24&Xcfw935%nAv?_4wf<ZJWLnPwzV22sO7Ow>$C4^^84gN(}Np?_R
z8G;aQ1*3OEEBplD@eeL7{JOBdMvziD;ZRP#c-xH<1HWiD<b(&Ii@SdCCE5Nfr~vIv
zX!h1o7ii(ME7ri}kj+gCa0zeogTgbj<JOg1SGI1k{ZNMr6`5O%!i+91b1N%h3$C}K
zw7t~b{b(3rEg>}(zj1yvJvw&e|Hj7WjV6WB^U|KB@9fY|^lM)nv$S#<Pp162cX)kV
zE|9BdghvCbO#(S<{b*XITAx{$i)W6f@uWFfsb;*lxCzU^nf3KywNN`SJ)@GVHRI!@
ztnr!Wa?R0{dR)d@n;KS4t7Yv?)2x<ZjZh|F)o%<4+6A)y-q$^<hpNVEp}4zAzQ_|-
zO{m%%S=AfO8x7Lx*Zil+D~-~s=ADK|mC4N<B&OW0ghGYzVXOoXDUY69**X%xw+}<}
z$dM2{upB#@ni@MFHp<N!4dX7gaz)v72({vh7-7+Mxkb#}gs!e1GZG5f;6KB|4)kxY
zTQqOx_o&YS9*I|Iet|9rH$6PVF<wW33;lb71`Yo&V0I>MJ_xxXlfQCvBvKP_*@Q$h
z*zr8hwP`IJU}5xDgINdZs~EjZ?Z6){KybF5v8@wMV-0rABumiRfaDq%5CltOw8ca=
z1VK9k)&>j&fEzeJ&~N#Z2#u+8oNa+Ibfjp0b)bQ%jYI#6vtnxs^ehhgr8vT*1ujPU
z3j~DWZfa~vim^3BB{r<JMP#j&Z455;@aT$xYRQ6PL^7;_$($h^Ghm>28_sa1<>hdW
zGloHooevU_eQON|u^77T1bcvczDQO?&`JzyJdU+3?2$|j35B;63<^w*2`3Hw8;$MC
z4M{Ob2Cu2X_d(Quu!&*@oq)U{oAZ2(p}Cu>xf_C5uqAPQzxYE2)+<lPP|pk4Sa~8D
z77=bV&rsTbc;0La4^Ny754aMZ0RxF|XdSR(>k7!o@T!w^MSE5FDcFTDnkan0V54KM
zOa0+iZc6HCT2@8s{VZ5_-RE*g_eG<z6U%waVH3&lxaaQ2Kik1%l^uUVIjwC{t;)v7
zhf9US+J52jnpXB^efahI>uF`*%<%ZQ5+wcO)&A)tbRnv>RpsI|MBGBT5<+ekYi(Q$
zu3bB@4z+9sxhm^|^||Q*dCAe#6nOotjYrc1Q|mBv6tD!(g)Bkw6l-8Z(9$PfY?R7c
z#19{C_Pm%H+e89*!%9`j(BqcI(&k5p&74O$B?3<KL_^h1H$87Gxoo*x`gr7SWL`SG
zlFr#5flF>BA9T@p<Ys2YCbecSL5&cSwRC@UG*<*U<W@yj2$R9CNI@iQ7qnLFj9VZl
z72fhjyj3Ej)6XvvTf(+0)WAS54AdTNp<W&?G<%v0*~A)w>);J^+%Pk_=5`sO)^3-{
zpch=feKGhl1q<5X;Pb)f%VP`)4@@6J{918L5JW<%g`W^01x#0_KnK9l!Ezau)y~e}
zHV%jHY5`$`4x0+_mi6P%Pk<JL8m(7jLoB9k2p+wSUah+xlzI?1k&G>E4Qt?f0k=<M
zlxM3NQ*@`Mq*@=#a-47r3)@;-Lud>vjBFt^xLt1U3-`nYxPue=FjFU(93mE_+_yXi
z#^i{EEibo%1!z9j_2s^BPn<=13T$cNzpwzaIs8LvjSOw^1uX0!C|e*Rf~??=Snd>K
z^=cNLbw+W9H4y07UCoDKT|Q)IrZ5vVowYDW@`<_QtU1OCbF>p*86ju|OA?R;d|b))
zNH{p}dESj|h9)lPat9VxW-cZUw7_r&2am}sick+CUaWKS8|D>1Z>HpXrbLl>h3&`O
zN>pT~bp4nDAv60y0{0JvMO)EDSOSW&UPh0;Z2dzjCoL>&c^;gdtyXM@<CF60u!D#X
zOUj9@8c9o%a!&N~`lq$WtK!vh`J9RefbRL6a9j;r+*LSp{S4(4Yh9&Pi`R!sWh^B^
z2H$A=mFjvePu3)#8y5^r^=p(5=aj2WtkNcynpG-XFA)}N)l;P!^?FNbzjj<D*NDZX
zE7fw%Sh28oYV$d(TA&&mD3!~q8cW4JRn2{k;^anQdrxy!b8)*AZZc(eyE)Z46YV_@
zmy;hIB146qoL-eTRL1ASKqh&qA+I4l63Xtp?8?a2`H`h0ke(w$5MCsT%?gWVXXP%X
zuq)COsdZQo7Utr37iAPCFgh89j7}zq9EcNT`W3dpgChgH0KZO}3qa^l&zmlxE<~`d
zz2^l~k_(7ErkG&+4S3Wn2>U`fwgR^UY_||J>+9z08jPvX&=J6$X-w^TLR|=tSwmDT
zcwy-q!%WN2&;|tzahrzF&XQ`d#h3*)hM~&8pq6yCMi<;lEZ}TFY(rmyHAGyE6H2=~
z#Lo~qA>9?GpTq=bRqH;8>%T3&0NfzqtA$4(ltGUgV~1cDLx^=3>}Jnf!T;Xe$sC5t
zMuu*tzUJtmDd!i;?R-q(=S=jlko3mP!bvg4^t`d5Esm_6&#WnNq)i=-%5BTx78g_Q
zYk?vRPy&(27FdMB5Vsb%@of1k(7sKPP~b*5-!4#`YJJ{1x?LZ{CCkw#2-v*2`2y^0
z-GWe#%@&ZObZOzzb$c^}U3GYN{2r0W9u71IU`W^6I_$$uCf{A@v<|%zs0d7?c?5jV
zpoVAsNg-k0@%m0t_gw{(%}5Y^w<Q89#VzW3khz_ea-YGy&y5b_azmnDj&Li}Qb%Ih
zk-JIDKc!=O3dw^3OC)v=9DZ_Z4(F$I`U$lRj=0KUrF>4PT2~8|b87W#t&(>%pk7<+
z*FqsUqZKaBO)H1By;^xc7#-RHWq<#)YHEC~q<3z-U(6d=TVqW(P2masQ|f6|%bZ#z
znC_LUOL(ggch4=VT39Xpz4c8!V(p_+mY_un_TA!}(y?~9JU5oEJZvmIEGc=^UR_`P
zq;a#k`ED~dFHgoE?({?sJ(WsvjFZzx8YiSVoDmKuhfiz=lXE!B*<0~2e$I~13*n~1
za$_`dD=fDzlHIx#(iIY&Tamhzn#E2issM7QsL1$^`JIAsN5U>l#3_cKIn`T|89)PZ
z6a>;x4_e?P(m1eJfjkWwS!*P!M45zIcfgVnQ7U9lO0ZeXWj9A6;o2U7O~K?CUvLi0
z7tG5I0ppqD0Kop3koud>`nsdi85>zz62OC9oE_R$8z;E2;KQ}XgbyN|C+y;8iK9t?
zeZUrgE4Z5)&ccw{t_GVt6!dbOWuiB?vMmP`jAIPc80BylJp(Qam_=i5&$<non;M~b
z#?-<QoDvgbXJHOoeRIkJQXFD@O)<X`1=-x#5aNH+^LCDS+y{EdaxgRDNOyh#)}1kf
zj&`?W49kry@W#p3(8xUBf-t-_M5|&&lx-v<+m#!CRc^H4YDaO6F-Jg3aLjpgSBj6L
zYYe;u;IxCvym0aSbxam+mxCy;+%8{SxN&fS>|$o^d7~|q9OXbpI1R1ME6SnmO4~QI
za3<}V*G($pCN==nL<E0G5Yo#4FFnJ%OH#P>V;4LJQ!+)Fsky1SFZaSm!(iSGi%nd1
z>vDhCjveK{oL>rw&EAiVuM|c8C6AxIi!wIKseDGCkDte7yKMi&xa#N9)m7mz8eZ|R
zTBBNT(#{+sA3}~6SPt}Awzl5CDo|_3`-B6l<HbVR%$%@Pdjy;r5<}Th{ha1Vrd12H
zO)YAcV7x^plR-*5BZh4OB!ij~jTq*m<0X&!rZ!tPc`5+X_4S+b!=tLklILTkrNuoj
zdg@<G+uIvoR5kWg72iE<uX>WRa`*5_Ww$i>5RT9Mp~~cT&U||EPEPVXCvT*Zo|cm|
zAOGj&?9s?)ocO=&!JNOfwK5AeIwUJC3-ch>gUINLt{Ck~g*g%<p^hLxXWUUp*wn&1
z85!PQOiAM8zjjLCTmWa8P8@4MMIJ5zp&p^ABlgxb5JqowSi{v0HRiHCQpU_~kSR!1
zfl;F?8CO^e!ph9Q!f*5Zb)Vb5l=C<#Rw#6^;D)0yPByarFd$hGkQw?=e?#b?4Qm0J
z)xvQXWzf_XIPq*gI$)9w0AM&@7(2zm^X)cr<S|#p5D99waH_90iYZ48wu_0G#Ucle
zvI~xG3)oDQQ;dDgF=tWE&j$PYI9{e)M4mjw2WSEX0fOeYDM;|S?&h@M8gtu%ayy1%
z=vI!<65=q&m@gOs2BuIf%6(>EE!+mf$_VAz2{17tAB@hM;xz(yekZr{=)fsH<!(;F
z6w_cQ3T43+FCRz5vbh1~afJT;!bOVP9}&_+{_>*ZAA>#3zeHbb?*mB$q!AeRLd~qB
zqD+8a(7p_vyb%@d`7SW9lggmc;1Y2wAe<3S^+;^{kru$Hkg)Ht0i<R|XNbDGqBBz2
zcd{NJ)HQl^DZcLIRvMDG_tJ7jsa<F(L?a<sH|)jp_geX2Y0Qr_@Smkd=H!IkU2a%T
zrYA`wD|1eO(76iA{qb6pYHpxc*;K5ZY3fyvugZ?rS;wq_xw&y6K#I9OCANjCVd0u`
zhNV^lzFUWirG9QrtsWQ1*XIOty`@v)UbXhQMhh3a>Er2Dxu!*_LN=jBxWQ|mo*M2~
zZ)#WI<tQi>w+uA))z=Hg?lubgHl9|sR5wdY<kFJnNBoKE$DHQFs)^>q=Da?sw3xH}
z=VmD<=Lx^;uxt-(QEARZdRlxEJ!d};NL~DBdRk;2x0TPo&y5`2uS;DD<3^80*Tq+`
zL%Ld1>JpGeF2W0byAarA%8!^X+7dFlAR+XoN^bcvyxW)(D6hOEejYAu;a32E26l8n
z8f!w1>Tt35bh~L!gvEjmZGZU^<$~*_m>@VO5zG#dNiQzAy1ALhpd`X%jfkDR?Nold
z)->j}p&`+G7%n)K+gZgR-OtuG-xN)@F(imizO|;cIP}JLBs8jMa4lv{V_+(a>WeiV
zIs||dw)bF&kNR5+YHF>oo!xoUStoOJ0KN;3G3GIbj&5$}QE3;>I|fnQ3=JuO!_Nof
z8}T*A3$EO4fwFL(;zkKJ^q~NZ@d=Iz{t9TBPcZ7Jq3dljf=Ya6eXt@rIPYjgaYg=A
zIe_(xh8X7@4a+GPZ=(w?2Wq@<{<h<S<84>-OB4jF#SocQW|!O$MZW+NZBUf?r5JNF
z@*fv2lY_654{nezMRi;by#&>oTWANl10ETK{{t2zNObJ*ymG}u;uro+n@4!KwRfg>
zr}tzA<5or?qb`7XC!p{avrEB+Nf#rvg3YKvI*2HGTam(LXR)&str&!oxVe$JTQB4J
zX*=2bkq@%BV)^{Y^wghHN9dLRcO-8)J}+;ysxm!&c_*DC&1)Drfq)<0suB%!|K=Ms
zze?dcPjED&;{7}=8)o$%{VXTyHfvhRI-Z#sU!P;KG}<+uQnucEBpg@v9%<yONVbw`
zS#tT&nsB&jT&)%GG)jOYb1hm~`v7l~rBP|%W?ruu>)&ibt6fsfD-l$euKaab&J&cB
zw3n7NH?|jVJUV<aFYc~xEG`-2NS`J*CcmL`dXkGD_O0BNrVkBGH1nVEk<s1Fsl-5A
z`Hausdqz*oOHJoi@|VKmqnBIb=l`9X7WpzQo{KgkJ~t}`$X!YuTZHhztgeI~*?#QF
z2h{Hv-}y11aZmK}qTM>U<%iG-s$V$l9K2{=Z8r~Y(p;>m4#ZV5)FtX0`!*z!-nd3=
zW9{uJ7tAjN+q=153PO-6#nCr7IOcND?Vy;;lwijNP&`odj4o0T$agy!a0ihHf_|C^
z8U`E4)Cl?5rnk%QIW0h41kqMGO0Wg&ca7f1G?0)yi$M*3yt4oZ(72*|u|S_Yc-x{J
zx!S;1%njX8FJpX>atSE+Ho6Kouvj6V!8bsrz{K91Lgc)-{gD#v3R@?{Q{Ki}4m3=+
z;M<hog<!aWV<qI~8siy*_)9k&WbBB{%Y*K{GKc&IObTE(L4>M$;Z-oyIG4yVpcnd>
zf9dE(4!#5fw9EGA$!?S=nB-qRxPB=p=-?G>N{|J1<AS3J8GBWi4o?~;k5HE@X4gCr
z0$~#BVSh6a8v4L+FPg-oQ=))}QRZ$qWAeLqcLKi4*n;6);Z}yCXfmrPrBEcQ$ldBH
zOsUA-4SRP#0TQE^d+gMZ+>xw*-%Cpy`6>G^u_1W~cv|A@<&5x0=Kn8!J~ewemR=dT
z*B~8{rj;$zQPwz-oOI3!o^VF^MmsF)7bxLBFb6K^j8fJ#eO#*5_O5Eg>+-duah_5=
z4d;UK;Wggey5Ly3zAhME)jVGnuJ^K7f`0XsMyLgKL#!FtTq9O5+JQCgw76Kd1_8iy
zbH8jwxd8)G9wG~;HpER+AZ|2OKk5;32C7>Qi>pd{s@Lv5ZGO7)q;ats#&s*n-O}!%
zheOH9%VQJCQt8A)IxNjcswx}!-F&_@Z{lt?KaZb-S8H}iC75+1*?C)|@vZb&aJiRu
zv!H>D%uOB58cj(+nqq2hAtO3>GFOsSmr_^3E>cJeK}tepV0zQ;OoAcM77mHGBq01|
zI6N8&OK5OMLtSVl_SU$5cA(ubGdpmwx4+~`ff&o}hFh>1+3kj_BiZe;Ym6iQB=}0#
zgBD_f;o{?FQC?n4u^=oC+;EgBz&(r%&)e0Wcf=mU2^A6!HMXX1PUT3^#@4+2{4BIa
zfVplX4j%a;<_p1qOw5VmY<Sze9EUe%A$Y;uoMK9*z~*!T+3+y{3eN|dM`7V+e*I#M
zdGLV`YBMG1`YgpU`0{m}IX67*tIHRHgDJiT2&_a(@%3P%>t=7wh%jzMR$`zHdKE*)
z^0~tYT7`~a*8^Ac>lCa(J%cX0*^{r^U&gC8i0lZ3HFzu(yx(ydO~k=hCT^bOFFU?G
zKs7c)kZvdflsYcaJfl#HLmj-xlOCRd*O1`RMy6T&`Q1`TFm`)M!o$72*i`EGf9fa<
zz2jBrcPsI`cb&I#8CwYum4IKfEfR^C2??p}gtXk~{Reefsr%88Vk{M<?YEA`5>ox>
z)Yj#+)Mq1E*^zs6oaevnFURKb%OWS}m1F7qbRcv9xj<MOjZddPhQD*a9E3Tg483wc
zOS5_m?}0h_@apgY>aA9LG&3xm8|YWd*Ve{Y*XPtt<65X&dFl-o&aGDXMmDEaw;usp
z?&B#n%Hbo(uT-mOIyB0;HI0BbP}(9Z?wu+@#sqJ(Sg8>Ym&nJ)P?iO%l2YM@u)So3
zg=+o01U<)CRnLDmPn5O5wBX@JcYQm*r|L!e*h6|*RrCDahN_`FfOIfs%;PL2<?uOM
zd}PDsC8dXD=S41I%UKzc7MqF?!o3i7EAS04IDS}4NloYyq48qx*8S*RQOL|lfk|IR
zLZ_rFk%2gsM5He&!aKbc-d^5boqiIU2klCD2N6Kw5r_>qu9Pm<qG%5Go|im3tS>+!
zYj5xAf~sT|gLSxB4B7Sab<jNA%+8aM{p&_XCNd?+aqu>H|K|;Z&C7`hYzrgGZ3<f0
z7{g$T^BCFS&y8wmTkhy)fs$+PW9MjoyB6DrU>}_J@^Un|ZVMLXh9J6IxDmaA+eM4>
zW(Tgmu88g<Foa;T4-OkbhwaHe3wRyjJ3uZ*kPp(YDM9uzUr~I_F1QA{k?n(B$&{c=
z9X@VknA?-x$jBddHM{QShA52-9Z?iOXk@dmI_ymjU_nbUA=^h?LN|rabG>1Y&x<-R
z0|mM5OShm<noraXGmyf~T}&?Ec|lNGdYI7&&ukAeEi~NP!2yb5hwy_dS3JW5U6?Lj
zUYYN_;R+G%<tJg>@(NJ+QK5|TQb=HAn@|`43h#GZb}CZ=dU{H<D7TfJ%Prjf0qeeb
z_@;=sBGldOtd|eCM0Ryj9zqwM?N|OZ58X4DklCfp^M}$yAnn*fQgHfSUZgbnSx)y(
zRZh-c`;&>DoD;(J;bTxPW{!u~USn4+o6!QJ5Kk#_B<E!60U>P4kH+VwRKmIS@fIw&
zkLAMt#dV>wU)d{G5A^o-AGK)5*TDK8e=eNHK4w!R>z9|x*Q#Zh1QANOx;U+Qv&L&5
z5Kjq*TI%bMHj0m=Eyc|%;xU>0u)X?e$tIR8jm^odhsnh&51+4qD%xJvFkih>HTGns
zieGhDw(@WE<Pm9d@=)b+<V0ixC$eEF3H=hC3;&J1(Pz*2@$sOGE~mwZa7W_9c15jW
z(cG}KrL+`ws;HtUdY4`ILt!c-1H{qELT1-XNyZNnc=fm4ddE(L;2{G9Qe<6)cOqLe
zunq1G7pNUn8i+CE&I{NbcDSGlIka6k0Dfn0-(gP<x&e7%3>hYO*nXK|OuBI4yd$p3
z=UvH;M9)EvLC_?T<a-;m4|D~ni9~J1^4HZI*ZmlCv?O1ZySY(jucNvyV6eK4cEKDd
z;B`leD}{KvYYajuG0I_i<3^#7Z(l#Sg!>(2AAChOH)zl8FD+c|z?|yV5#)9d;~DA`
zOb!Y~vPef%aFE%BS+}SlvmgwyK|yZU-9STev!`G;bU?Ou`)a|{t>gCx<li5>3L?i`
zaErPSgS>M44$m7=_GI$43xFj|et%$p;Q(uYoN`cwE??*f#XsG})1)IR)WaooGAfkj
zW!)Km5N;hF?qv^D=)z<`233OaXg_8k*tpc2-W?u{D+FK>u;nN5V<a;E1a2+@#xfXn
zTSb#8ii-Og8QF>~k@t4ABI}3kEYS~Hqgk=JS$h?KNCQ7EBx#hpyfi-_zYV=cJU=>?
z%a70FCskH*^D2}0A@TG4$})On<JMthda@MY?fk^v|7lE)T#0N?Pd<VAD_ez@by&$#
zj`LP|YBe_1&*!F&l%?_)>&IFx%rj8F`;~x|=hkK8Gaw_aE8&^6sXSg}9V<&$<u9;F
znUM+R>er4I2k@m>O3lpC`iye=p}GZ8ZBy#r%`xG$QoO+vYIyC#f_7eU)y&fp-r;m{
z<LjQ1rsT%EB`b}^$b%j0Y3ylyT+&y(`E;bTaV0r<<!)6@RoQ$G;^?K)WC&q*Dgo8y
zR3`JQmPhFgOUubgBayHcP0NE|Fp`_~(-x{THzZah$_B?SRTL(wV^{1(vzgl|g;@!T
zLLz#iC;=)$V)0bi$?%i>N#d0$3HMXbz)ke<q7e}k9$w%0Q3DPFfppM9z2FONf&tOw
znv17P)TK~+f~9l;0fjf*7R+uexLv@Wz%2+h+RfbUviSj~BwV?JF!+BJj1Cno?ro%^
zo;P2BNhvtLK+y0soO-Z7e9VIl-N-TUPQOgSss^tDaxfXk6;(dy(q%W#g$oxC$c~f?
zLEw;3z(R{6<oot!lnyf4+~nYrJq--)8w-x1mx7`ocI-e?M7~5OyBu_Q9t4>=bih@X
zu*We$w_ty8BdCMYhUJ`_y*1`s2NUvzP;w~9-W{Ho4g$%czsIvf$&)7UU$Wq@Trj!j
zaf7<xKqEkkK#7Y4Nm7B-KnDaGI8Z%ZCgJkn;zhgS(jiIga0&2J1W>&)Bv%yS61EpL
zv-4eMCnMuKukG&`%v+3r0dpaY-a8B?lG9UfG2SJJ(o%NW(Fu2!ka1cBUxDb{c}7Z>
zD0_*U&D{&j5~aqEgoSalM&?^9`N@BXOxmVb&QHYdKSMilNB{xp^vGxQJPv<inKO|y
zk(}3^y+3q!G_t#go}8E5IMgE@I`L+$zhBD|!Zt<);p>rFD_2fw)pNrvWV6l4)>KDo
z!5oe+Toy6#37V9{GySXqb^YqGT79gZn}SLCz_CVfJlv~g$=23Zn}%gPz;-Ozy0U&%
zHiPnBdfeErIo{+|&-KERaR7{?_NLPI9<i`mFji6}tL|%N@v1j56Vgi>npXN?%3nM&
z*4^IHK<7L>lnymMYNS_js#ZqI=m71O8**~!&xZEX_p)>7dC8H<+~vyb{bze4&+@Y3
z)55Uu1}mjCgxi`6I~h@K*67Q+XwiK|bYUz*#C)&?#{xK;GwN~+w<Lurj4oP$;+EnT
z0)nXFetuq)e$-5`IjG@*lSF_UTt@>#!7w0>HIh|2TtcJBp&iyHpqhgteGq!d)7}L6
zv1F{oVQz5aau68@8)%-rs}D9WWc)uE4Tu@`iZ=kxUUEaQ5SAOS+#Ja<!I#htLt*3w
z?Cm1O(-n{)1v_;Lx#I@qD_8Qxr~}X*qU;YSuMPkdera}KhO5Cs6uu@-ri;mBsON#n
z!X>D~X!c)rM72eM=Gx)mX%-Yppk!cD;m}Tkf(eKr6qA~D(6s}X(3??h9S&yr2ZUO;
zk)wptdvO2&A1+BmK~$(FZ5<}oH$o3+c#zt5&4Jd2TqFcI+_cB**5g_S!k=$qZ+FGh
zqr>4Fs)@uU++&hSbD&WV`~v-uJkxozBhWiB9GH<r!SH_foy6nLR-hj<ahut7tBajc
zl#u~{d_<UbWkf4d>i%UrD<PzCY3ql&+}#JG6%||D`)PQC#aA5{>#vZskl5BNKA%4t
zKmV81pF+SWTgsi_|AjxYpB&HMA1b4VMWRC<eKtQ7kNz3F2Pu6yc`v!DC%rqpeIk+r
zL*>f6k}CQM<$$VKeZ&IVtcIj@4rAZ&I{a~!1KK0uv2gLIlsBiD28Bbdl_{}5nR+v$
z#$J0>Nsy5sSy@-Fs$_HOb=KU^f*F}yjs8O^RIkcbH`e>dSW``lJeH8984$xBTHL!R
zUt@{k^Tp~JU@f-1;5Ah>_V&#jg4f@Kjo?^)$x8C0m7bE8s>SNY_91EC<40BVkLXEd
zc{>kB8UVypp^YBxp2)$)hMu06mlHpdmmZ%~85x_z4~x(K_kFBWVnal!VXd)gVOhJW
z*}G|Vt#zr~=oArTlL-l;3`UA5wL*~qy*DFan_XD=qk_q-$mnEB{O(XQyd(i$5}J3Y
z#OtPqSGdHhjrI+!g**J(&})zbJ6tZf*dyNCVFCMEGY6Wdi&-e4W4S=SWPbqxoG98R
zsN6wOW*rnWp9?_%K*%OB_TVs494|Y%66{F(j$k*`*Pw&T7tAQ+s9==ZSHuanU$Ce6
z+#s8ExLvk)qkMVL5fl}40o?WuSD2`TQmhZip=7ehfv4vr+0(@uK*FSThcylEzCmD^
zAl4RppEif6&^Fq&&<^`aYZtOTzGa$6=z;x}4jS3oJ`~Qtq3CmO&}fsBH(<>`hR<vV
zJ|D}vZzfGT{T#@&sL*db!(HsD*0hc*lP(G`7pB8@cxUJLih%Hr?>m7Pw`ERx1>Qv2
z4ahw3_Q;^#Vg@8KnIfu$4WeR3qIaq{!@D9kfXPf)O7K!7uv2dpb#*d-P>8m;Y-|Bi
zD@27MsjyyS!xg1<EBby2uA`#X_|~6N)As%l-xa+#k^?is)X1>-t(?8IY<er5pItc;
z-;ka@G+H*or%&uZ-W#H)$0s*%o-F0;G~{(BA2vuU@8*FDF@zmO)m<QBPfpBf`_(PI
zb3CE8e_V;YV)e{1a0=lxG4!pgn?Rpi?;q~v)uSO%uBqf&G}3e9O)|~#Dkw-zQ)`eH
z&dG$$N|-~ps1}=e$~Q9uD%tAdF>9lj5MM27r=Pb}mrl3OHNTk}DA6veHcEx^;+FcA
z0p7;zfyQ=WHLHH?@M%v;HLIs&s6M&-P(Fm@6i!t;XKbacTUxfkx!brrG$C!6@1AJL
zOMg<C+>j@YY%NQgNKen(o8M20PoJ;kR*uXkrN(ZB#D^roA}Km#_ow(>b{YzHU0Q0Z
zXqU^b3t@(!Fc-mx19qcbg<YL>3Csr!1y1rEzwOQpNdWa0LXwys;j~+mF5%&w06Azb
z)NuSSG!XP$G7U8IHj^k9FMAV*HdO0tScSV>H~?qKlQ@fny#e{cf>|i|2_5KQDJD@d
zZkNcHTq#jzQN*z(TT{MtbL)t5yU-Ejc?okRrQ=e^m-cS<Xk3Ci7NR<$f=tYUI<O2T
zTQ4A{mfYsqVP+p?GU*aZ_Mnj`Q84YTC#^#vqCu7PXgi>Kw0Ssmc7z_dM1`Bta3tHj
zLaAhjHkSaGwl-@ISQZ}GBQvzk-lH?TjqDNX$wX{>Tidm^YoVPt13_x*unuqgKGf5L
z2`Uz?1ECu<#GaW@U8s}aw@JJLJQRMNR1ZdggmFcZ=!ZURJ2AA7x`jr<uP(tm(Qg|Y
zkXs4f5>STfa)In)XO+cF?fi}nleOIhQ5N%u+;>~iqSgvUbVY8(b~HORaw|KvD>Xj#
z{?bT%<d6K3y8Zim&-S@t2;PfLTdLf<AJ18ihbiF%w_$X7C~rP8eV!kZ1gbkHzHDU~
z%DQCiPSS_ycj?KEE0B*?SJA7UNas0xX-|7(BOjcNRqazPM1J6TDra~{@S}SpTOC$w
zS!+r`lU9p;p-eb_+<!cy<c)&?ttH&NW`=vmmEbwA9nA<|&&}Y-1F&1g0hbHcl}N%m
z()7!Zn&Gj_n_~6yGzg$j3I<puGmGMu>88!+8ea2jmO#Ft($tIV`$|em#!3$BVZ~ok
zFCA-oUb-TdcGq`rRB;v$tE<YY8_PHiJMB-NRyK3!m1R}Zi9C3THtcce6X|)C4V96}
z&p?8v$B$0LjwBIg3wg0=tv`)c#y{H%i$(LC#s=P#mK#=)zy%@%)7)rgQC-SzbVXss
zZV@{}1Z3Zvp<uW9q2&n3=#<>aOzcdQASsDTg@rCAL<cVqnsu93IG7#iq{AHmu}+4D
zdZ6_P^@s{}Xp6FT@Fa@pK~$){b!ZzFic$7axN1i^P%e1_)bl)mZ`g&<D572Hpm?I6
z?YLxr>41o5Ay(*~U^RqB9Yl55dq6zr*@3iE2QuK3PLsAtGZ&O$6R@MAP=P!B?7ciE
zC#}6aCPOEQ`b;xvLtl?l8jkNW9Q>(H7kryAXb%rJp<S8uqI#19aZ205qd@w(86Nn~
z1^9XgptCEJezcoy0fAnK9ich^wcHM*x_C_jjrUVrX_I8$@^<l-Ff%f?nGjhr6y6{S
zG3z9E3R9Q~48}G)Gw~e^(*i`DppvK7)#ct2RXkv)p!!NG5_WU5L|9g5rHVozPW|t9
zSwG~C7G|+?yFx;u?;{c<i(40#7M494J9<AglF$FcQquf#NGznxA^Vj}%l{rflt&-s
z_cWx>r!VIvabo$)LzPL(=}FS;A<leq@?HGC>HL-Ezf4q4(DNGR$I^$oIYSSVd&-_l
zyURAJ<{PR`V6Uev)@rpVsoLprxZP^z#;1iq>j<{~v`RQVw<;XhDpys<faLnM>&MDB
zz2n+r;i_;B&IDj6!FqA7ZxynXX(3(_!0E;XTA5&NZJ?JW1D9?_$P?fguQl~TWhEEN
zr<5;RX4;R(1ge$#z9C2lt6J)x9+ot39@h6%OB)~e^z1y6avt}rG`G`N?hZAU4Ly-I
zBujf5a^TgU{#cs+q~Xtd{2_GKNt`5ZStY1-`;kfX%8+#aes)+Af!1Z==hn*Qa_d6U
zQV2zC8aEf%P*~k|N*AOmyXZZ->VA+U{P?c!yUtq*wgPQlXC2e)9YezK@B)jYEs-Yi
zqhdY;O9t+CG&n<3J*+*f@i9U&dy|SQH7(qQ$l&bweW)k$DPVl(>FE%PrrN<C;}aRR
z+|z6_=)eReJ1Xizls#dDXWh{O|6-^EJctu)?dD>AKpa;Ld7)7z6q*_OSRCt6&&eok
z*gIT2Cq1nvX%3U<8az5XF`!!GulA5oX^<fKb$E9A(IgHMkI4Wu5`bc0{44n$)jB-G
zh1%vtL-7s=?id;#?$QPY`%PHqcqjroCj&kF{QPK%0n~8nowjY%;KX+Uz=s)L8Et;=
zyfDo%T@V8;>CD`wA~lIwxXsMm?qYA>sq12UBVV_$;to5tuq(GH>m7sr;}Yb>DcfP}
zR7NU;oAu);&S+PbD3(1^*DCUcENC<(Wh*Q!l?y021nqIfeC*zC2={&^pPO`_KN6O+
zln29<q&-l5N8ofdnm01BAGsX4pLc&^c{C?}A~KRclrvJ96Ay$AJhXJqVGd^nQ4Nm|
ztDZF9-QQVxLT^lNXxJ&1mhF^HAnUzH$~)0NEYm2*wN3J4rCP~DWnQ0IUG48X8kes(
zt&eN5I_Y0MQVox5h1ykF?;JcrwK5^d`u!zXWY1tuEQQW{UHE2Awa!|b18w>k8gBI(
zZ(Jr&Pxr1)@urmWbx2TnLKfodTcm$|-99|F_@b}0US6^xo_e&=CvHq`*{H66EH0g@
zuNtc^?MdDQPxP<So}P9oB;9}8`LC*{$=yRkf6GgjjwI8UE2VkTN)B4BKhGluC^l(=
zo(wbd1};!ZtWZYg>6j}*QnR>Od-17TtsriM#is$%6v2xldNe^1{R88NT}DL~D7D@S
z7}_Z+Dj14Hj5CZ|x4htB;KfEBAv448jsy;*9xli>4^0gB_V9Co{u`HfDs2+~r+Ru!
zhIia-^T6`J!_y_)!Hjn00L=6@j|-tF*)A?F<j~NlNf-MLmk#?569>-=P};h{*W*Iy
zK{#Rn4#?IH7usm=2eS?=gzZ7+Yjbh%0Id(Yg2_;HIg-S-HkyPMC7BGI{D#VOVba>Z
zX`_X=!P6;9(H7X|K=W(!!=Ko_NxYbTG|=A_fwXr43K~#`K-jg@6jT?cq|M7iLSy&^
zC<;B$F>ECQ!|A$1D{6a}aVrrXBoa2WOLB`1GqiAqw;yQXY{fQmbeMGvQQ-q7(4V^P
zLS~90H#54cB7+g8SSnPc7BY5Iz2O$W_2cdj%q+}uxhc8vtxND%&dn;U2;&x}#HP+i
z$M2=W(g!5;w5(M8ZYraH+H1|`(<}L{qe(e?|95Y{k{%f{#2?9SP2WrZsd7GVK6WS;
zsnr}Haet|dAF9mZ6!VAjz;@>>caPkaK9P>)O+4gF$Ch(A6FbR6-G|c3?wyA_-Famz
zQ&nXT+YfX8ns;KLe^rH;h*f2u44v}us(O4*pqlFiR|xFRpH*u0s-|Dd>qjQ$j1ar<
z)m62uU%0;ZdVO_HSUtB6Q|L9VhV^FrXj<Mst?3^ah7&aCpK8R!&aJZKGh#r~r2+^}
zh6U3bs#3A6S+Ic!`mv_z4LJBW4J;mt+pCM8HZB&IR6VS3FMd+IQgYb*aOiMF`mp-2
zsrgA&_e6URk_NFUls4?#ZICACJ>l%+<>2*7#I()Fr^n~*hvbZu?em|dap`+M{bi&Q
z?xG>1#8w5XQSNA6YzlWPYdb83yB(dv&4mp|8hlk>cI`3>*$>!^NmxR&aUEqBDsEw(
z@$;r)IP}I*l6>Rcd4~yiyHG!>3xkHx&2XwqKsb`_u7uOTlLl->rh0_71;PcL7T9*P
z!z4U3lsXyyeH66=5G~odEfDTuZBbDjR8P+X+Jdzw%?$@V{J;|@xbq;e%?zvbE7p?-
z;j}1P_++PtBs83AEy0nMgmwl_PPR=3UTOPY!3_6mV+MjMB_T|zJH7p=3W;|hmTpv>
z;ts!nPD#MKz&43@+nr7@1tIPY$fUB{Is-D=>LloJx2Smj5`zJ@1ly0%hIoQZNnK|`
zMrKDYb9=Xr@uN3mQpE6LXYTrSrBFqgB2iZ=qiYxMD-?{>B3OeLC8RJbQtNWrUBK~E
zmcr8RjCA49LLZWqHnQEC)ioN@#YM6-J6n`iS&<SV%99p_EbWD$r5MeNT)sb&2I}K{
z{8Hpr<Z|p%WFG&gQ7rf(leWqx(k3eTjoFo3>HG=0bb?P$Zj};vT=GPE{7%)#e8@yj
z_wvJZ{LcA3V>=B=he%h=8F~WtJEy&yE-jOmb$8EiHs*1#L*D6mI`je*B)JgBxJjcO
z0990oaFiMC8k*-}7{|zY(=3<^sHcw>m21cC%DI_=;Wg#J`s+2B8jR989Q<{>5QOsT
zMdj-FxO%#!X-3OiRH>)6GL?1!WN1jWcuh0IJZ+z>SKc^W%o5bMh^NKKNf~S3Y%iU9
z)Yv50XfG+Q7L=|uANI5iJy{ugv{Kbm+}P04oLpVjv(wPXNv_&?n%9trsKJJz`Nq7S
zd0-p-F=<kAcX}mcDtYwEyuGa?{&HC5GOYJn<CkzhB<m+cYS!Hk%Zg14;fCy`K%D}g
z22mQf4sBja0%mT&`U!P~%m<*`p$HWwNc^@HU2Wcy&O#XXdovY@3<U;t8sS0;4<!#T
ziFb#WmrDm?DcXq3xfj(VJduhnz{LZN$0XFqF2r;N38KdVyh>r`+Ue49a7|(o-g(W1
zN~484OuCS<ZA3?4jnA6AGTDjzp-zuBKZiEVoHQzRk~T@Bb~v=5x9yY!zLQ*`T5pFd
zIu+YA4=Rm;(wor%pnNi;6DQd3od?5@%DCgFU~E(U7)-y=N$=h5@BlBGACt=H+`2_&
zD~ga$KABJmh_ZrtXP0=nE=j)2C}b<x-gOCEk_Vj`yNs^7!tGWOvumqjsUqbadz(?Q
zox+3{TwPZ#o1L3lnAHV5le;upRF}q0Eo|M+;wEf|Ev415!$eCjM@B*-L$b19tA>tv
zYb$nSBx|B|G-MxlCL)o+`YeqvBGMp}mZkAOEl*@8?MJ4L#pcn$C(5JejsAHwZ+RY@
z-TAWgWquxbp2^Gn{YvS6I>>UB6FY#f$~bvFoUwU&&kkp0sH}%Wub!{!k?yw-HS+0Y
zL-gLNs!hR@v9hY6=IZ7}BvV$MP_Kj1jBFH4fhyRK_p4X6tfQIZ@d3EuuJ(@~Yx@a2
zc@8$ApmQ9{j_1UJpQp#MD-mjb9zI@E&hcd6^S5YVL)s@>pE>RuU+-Nj9Z;{YVzD^I
zTddbKiKh?^G^~Lu(u}5fLtaw6sjQ!BVKtRVt7TK|EzQk>s-dUVeZ2pyZ+<@ZqPo3(
z<F7-!s-4HpD~<KZ533$ZbLfYU8xJdonk!#aRyWcs|7(IiB1HuKqn!V<pTn8wLl?^(
zsZ2|c<;SKaC8gmf%1sTK4+$B)zm&DK#I4NT%Epn#b|p1MG|I>o6*0i%NPxO<JEMYK
zCqe+l?z>EQ+ofQ~f-K|=Z)Q<vCi9&)x<`;o{n%6{8tDKJnuO8$r_RI-54;5k3wBMW
zU*co{lLkOQ(iVzKJJo}V84GwAtuquINq8u=t#h)i%}>&C1q>(JO+T7Tn+X~O>rkdg
zsN`mV1TPGiHe_7{wjFqNUSaw%JHMGs^kCkcENt_pPBL*|GZfx|FsqhG7#Z6hof+>^
zJqp>_P)Pg^nD~}{WEZt%X1w#lOY+@zz;;5$uD3#TYdhdw-7aW^33a=7wwa1;zm&Sp
ztQ2o9<HsM_OS_Ei3Wi8gacj4W8=ZjjJ6eZ{uBZ++4iBPRzhj3m!n%+@8oT|nVwcNh
zb6Z6dDbO=@iCQ0wE_H=1JzI)>$rb%~YS!*@)^gWhLeiJACsOy5qWPn#%PEmze129E
zeZF;xKQanJ@<cp+zjbeKK0SNuFX{aB<>Z{o?D&a!#FFjf_m?OAb7bo>AmsGQo%G5*
z&Q5n(_sY=U=AR6$G*mvEuTCCGPR^5-4YhObN;!u^jgN<hb{Zr9x^uTAdFX{y8ec7K
z&U^D%IPvt!;n<_9_QS)f69Y3WfN^Um%W5<R#{#u-T8WyB6gJj44lnqkGL%}m_LzlM
zLkm%ra$PH6%?a1~p@G%lQQ7KKCA|4nXsVUd1KK&2ynj{A)AnN$RLj=;)k4<#A`bY9
zQpRgvM+}g7cv16wv6qF$LNM0@Gnt<1#nMuYfjuQ-jrcARJdYHhyY0zCW76i*CqvD2
z>0xq%R9Yf!pm%ey03tkc^X}3os^G0KlEY8N^(s9rnVz>lf{n^vNM2s#v)D>Fe!=)T
zHZA%m!Z&vdrq<i7X}L?lquE)l*hewD(v~W^5`Ne&5@Bx7xC0rM0z!C3TPBm;r9ixj
zH=Fs6NoC)uqh$cC!odpnW_o!fQW*-ouW*6S0g5Cwd@_I*K<lIixWFZ_tquJ2HV-c<
z6T28|TH++Njp0GP<wvD5Cp#6^2VVHRK(sDisIEY@neV7HX5u8ni#93gWZdkO&?JyE
zcX)f?yU1{nWbC3azsq35XOF7b_S&K{yMVVKWPLY-5s>jt@_;Gn+Gb<drntl0WsFkq
zK*Ek)r=s(gsH>2hDOzGgOGKbZbUmo(65UZS>*_j-MpJjW-=#9(!U-5{D|aciE+uw1
zE2R$A8AjQnrMe2y(mNziwr;i7arZ|mwkkv;v8_uOIYivBJ#I)^>t0@32pl`Z;!{)8
zqet^Z6L_;vPiw^pmxL_{HzaRlGz=~-Ibd0gl#NEFtxV+onM22Ks&$9Ig;>31n5WFs
z%O;YN_xZ^?>GR2V=W`DE^YopuhKZrddHinop?dC_D66C=j~#;H-c#RD*?5S!$*L9U
zCJOOGX?M@qVo&$bp}Z%reyDwnUcB;%)6-CY_^`YAgiwaAS3bNxtUXrFspg>F9#;Xu
z(8yE(HkyP-)9cWxsOO*=MBh-aBm^p$^qStxfwT|C+??uIeY_?gSfB2P5A<rU222f>
z^0{_XrWC_KmsPLP2p}$;8t<!?4XlYbge8lrMfFCLyyp$T?2VS@_WH*Dv67O~#nLCL
zVnMy2w7P1n{_)dI1koekc(LsH(8|N^hwbo2>fto+@T(qI(dklTc|XQM=2Q-)=g@Pq
zbK)cS^7eB^@~}9XU(Onh&5IA&Y7LwJDQp>w!U_bage;A`6lIO3rS0aX))A|zkX%Mc
zLW+oyvIJh&14UO?0wV?c*TRI9u0*EdR^6RCi2{|mvySndL~$!4)4Nb2f$dCZC&N1f
z1e*ZjLEu<uRT<2H@I;!TP0^N!q**U}i3Ii5PeGlef~p?wCF#Uz$2PrF!9Xt}VNUuf
z+R!dcdizb@0zIem$~GQD*Q*Hd$Y2&SGT4OyOa(Q7*~O4-vlRfxk!Y(JW&f%0&O61H
zBH^8+PE@hIOITN@h^Q4?TNxD<g`*HWv)>hNr|oVfpx$mV6{1vjS7$<39RSKMHluJ9
zbv7empDoHr<!*B;c5`>r7$FZBA$QV7(L{*2b@!2B&?*Ycssyhs7LmGpKkSF3Ev3$n
z#%?XAaUduLVezNEJ^1u2?JeI=;?B?GddP{~OA4ExPl~)xuS{>{r}DXf*{{qS;?7UR
zk7jf7_@mi7{6>1xPTu@P(g;Vo%t;3cpOe1Ffv@rM*m8HnJU|L;_vky)<-2_PO3zMJ
z`rV$MD%fof0kkL^s~oBt+MKA8iVq{}#{`QH5AzyV9!?B3Ha|-5k(L}b2#SZER>2&+
zy}Gnp&{MXvv2tR4Zf$Nx4U<L9`fBew#<z8x-PN_@>Gk8@x#MwoAgyX(#<;FrKOSFS
zogQDE!FFZ*cxDv~!SVHVrDmOAXRNOuPpQ|Hi$~+yReXuX@ncw=Z?0+9@F^PY`1+=L
zdO(c^ymuUSjRU>MhnmH;G1=ny=5+7k+J<aHGcYr?vY{E;7@O(c?491&7?Z8^jL);C
zS0*&Qn>#%dW4N^+!oY55Y-jB7aHn_TaBS#s=Ws{5KeV&IvNy3@y)`tyvemP{Gtb$X
zSQ_CBEl=!@?C*h~GCHxhzcoKPIx#xGzqPkNGP*a)pB!D<dzZDfx657H+Iz>{UBd0%
z?&#$1_UP8`l4y5(J9T@Pd$2e9ZgQ!PF}d5Zy}P?zx4pIf?%g(VdncOQ-hH==JG+zH
z+mnpRcke0|6z_HqmL{2#8N1t)lUrNcii3B=)89=p-)$f4zQfaZ6_f9_xA5rF0zPt3
z_l_~St$4RJx%H0t`uIu*+mr0=Z6-eX-RL{UXvf~@cE{4v*7nxq?(Xi^==M_GHu2Q0
z-R=Etyv2Xp_`a9$<gMM2$<eL-$@$&Ut-Vp)AK6>ln_Svm8r|F4US8VU-doxlS=t-f
z#ZO?1yT#vL8r|QXA59~kx4g^W+Hc+8-x^)sTH31IADN$+-`^Wrnx}8mhxWF1mM2D+
zmqzC2CwBJv6C-$MerJ9^d1QWQWCFLHQ9OP)Ix$hbwKE|d9a}zJ9y{FG-@){@GP*Od
z0}G(Ns)?0->BJCzXFba+hZ{R9LyP-6L&^IaD`Pu7hdUd~Q#&g?V?FajJrhIo?JGS!
z8)GYn13P0g`<mXBiK(g0p^b@+v5hGRr8ifI!!R{AHa#|`Sy}8^+*};$nK~ReT-g+!
z_@{sR<uCu~m!JI8|GfF+pNKy{`Q`gZ-{1cw?%*EY5I5p|JopLm@&9@6{YT$_^8Y;H
ze;)Yd`!DhLClYsv$3A)g-Y1{Df5wNzosV(vqhEgVG5*evKKkWHzx)_~e*8}#fAq;m
zAK}>_{qlo<`s4$=_tD?)e)Q4DpM3J+FF*L?SHJx5W8C}bgO5JIqaT0#(Z?TrOuYT*
zqYppEM?U=U!w){ddwA!g4?e)hfAJyiet-vwhd=nm2Os19hrc48M7;UMhrjq0KIIqq
z^TS`@?yo-l)h|9E?%^Z&_^*CJ+#~J~Z$9|oSHypK3h@~6-usXK;_vr~kG{Y2E8O0H
z9=;s$C4WJD$q(K?M%?@G{U_r?zxdVPzc%rG{QW7v_<z3ve0%r?J|@0_58r?7_un19
zp^xzd;wc}#{{}w(;Qj6WKZp2d;J^R*o<1c0q4@WHL_GQd-Xs3)_(^?0y!r4$d>MSk
zFFt<%!}-<6#N!_lKc<gA{KZG_e@4Vl@S|URgdZRAqkR7p#^>S3{>d*s`qf8xB7Wk3
z{}te!4?lSSoA?Bu^6~ro_#5zR!>{aP{HlouKKkUtPu~BQ@W{vSf2qG9eu*D`Li}Do
z`o$-oy#MGY#Mk)XpYROg(f{WR;2j(R93Xrip7&25;vC?Kxc~9{(?cAOk5ByL_K({?
zZvVLb<Mxl+KW_iH{p0qJ+dppqxc%eykJ~?P|G54C?d|^uf^5{Zng51!00000NkvXX
Hu0mjf+iT$>

diff --git a/packages/frontend/src/App.tsx b/packages/frontend/src/App.tsx
index 93d705f5..60635902 100644
--- a/packages/frontend/src/App.tsx
+++ b/packages/frontend/src/App.tsx
@@ -2,11 +2,9 @@ import { useLocation } from '@solidjs/router';
 import {
   createEffect,
   createSignal,
-  lazy,
   onCleanup,
   onMount,
   Show,
-  Suspense,
   type ParentComponent,
 } from 'solid-js';
 import Header from './components/Header.jsx';
@@ -16,14 +14,6 @@ import VersionIndicator from './components/VersionIndicator.jsx';
 import { connectSse } from './services/sse.js';
 import { RightSidebarProvider, useRightSidebar } from './services/right-sidebar.jsx';
 
-// Dev-only gateway tester. Gating the dynamic import behind the compile-time
-// `__DEV_MODE__` flag lets rollup drop both the component and its transitive
-// deps from production/self-hosted bundles — a static import can leak in when
-// transitive deps have side effects, since `define` runs after graph build.
-const WingmanDevTools = __DEV_MODE__
-  ? lazy(() => import('./components/WingmanDevTools.jsx'))
-  : null;
-
 const SseConnector: ParentComponent = (props) => {
   onMount(() => {
     const cleanup = connectSse();
@@ -84,11 +74,6 @@ const AppInner: ParentComponent = (props) => {
         {rightSidebar()}
       </div>
       <VersionIndicator />
-      {__DEV_MODE__ && WingmanDevTools && (
-        <Suspense fallback={null}>
-          <WingmanDevTools />
-        </Suspense>
-      )}
     </div>
   );
 };
diff --git a/packages/frontend/src/components/AddAgentModal.tsx b/packages/frontend/src/components/AddAgentModal.tsx
index 42540142..76e989f6 100644
--- a/packages/frontend/src/components/AddAgentModal.tsx
+++ b/packages/frontend/src/components/AddAgentModal.tsx
@@ -25,10 +25,8 @@ const AddAgentModal: Component<{ open: boolean; onClose: () => void }> = (props)
     PLATFORMS_BY_CATEGORY['personal'][0] ?? null,
   );
   const [creating, setCreating] = createSignal(false);
-  // Both default ON — explicit so create always sends a choice rather than
-  // relying on the server-side inherit path (which is OFF for Autofix on
-  // self-hosted).
-  const [autofixEnabled, setAutofixEnabled] = createSignal(true);
+  // Defaults ON — explicit so create always sends a choice rather than
+  // relying on the server-side default.
   const [recordingEnabled, setRecordingEnabled] = createSignal(true);
 
   // Tracks whether the user dismissed the modal (overlay click / Escape) while a
@@ -73,9 +71,8 @@ const AddAgentModal: Component<{ open: boolean; onClose: () => void }> = (props)
 
   /**
    * @param token attempt id from {@link beginAttempt}, re-checked after every await.
-   * @param autofixChoice the Autofix setting pinned when the submit started.
    */
-  const createAgentNow = async (token: number, autofixChoice: boolean) => {
+  const createAgentNow = async (token: number) => {
     const agentName = name().trim();
     if (!agentName) return;
     setCreating(true);
@@ -84,7 +81,6 @@ const AddAgentModal: Component<{ open: boolean; onClose: () => void }> = (props)
         name: agentName,
         ...(category() ? { agent_category: category()! } : {}),
         ...(platform() ? { agent_platform: platform()! } : {}),
-        autofix_enabled: autofixChoice,
         record_messages: recordingEnabled(),
       });
       // Local creates do not wait for the asynchronous server-sent event. This
@@ -137,16 +133,13 @@ const AddAgentModal: Component<{ open: boolean; onClose: () => void }> = (props)
     // A second submit while the create is already running would issue a
     // duplicate agent-creation request.
     if (creating()) return;
-    // The legal line under the toggles is the consent act: the backend records
-    // the install-level consent when the create carries autofix_enabled: true.
-    await createAgentNow(beginAttempt(), autofixEnabled());
+    await createAgentNow(beginAttempt());
   };
 
   const resetForm = () => {
     setName('');
     setCategory('personal');
     setPlatform(PLATFORMS_BY_CATEGORY['personal'][0] ?? null);
-    setAutofixEnabled(true);
     setRecordingEnabled(true);
   };
 
@@ -208,33 +201,6 @@ const AddAgentModal: Component<{ open: boolean; onClose: () => void }> = (props)
                   not the larger Model-params group header. */}
               <div class="modal-card__field-label add-agent-toggles__header">Settings</div>
               <div class="model-params__group-card">
-                <div class="model-params__row">
-                  <div class="model-params__row-text">
-                    <div class="model-params__label-title">
-                      <span>Autofix</span>
-                    </div>
-                    <div class="model-params__label-hint">
-                      Repair eligible failing requests before falling back.
-                    </div>
-                  </div>
-                  <div class="model-params__row-control">
-                    <button
-                      type="button"
-                      role="switch"
-                      aria-checked={autofixEnabled()}
-                      aria-label="Autofix"
-                      class="settings-switch"
-                      classList={{ 'settings-switch--on': autofixEnabled() }}
-                      disabled={creating()}
-                      onClick={() => setAutofixEnabled(!autofixEnabled())}
-                    >
-                      <span class="settings-switch__track">
-                        <span class="settings-switch__thumb" />
-                      </span>
-                    </button>
-                  </div>
-                </div>
-                <div class="model-params__separator" />
                 <div class="model-params__row">
                   <div class="model-params__row-text">
                     <div class="model-params__label-title">
@@ -266,20 +232,6 @@ const AddAgentModal: Component<{ open: boolean; onClose: () => void }> = (props)
             </div>
           </div>
 
-          <Show when={autofixEnabled()}>
-            <p class="autofix-consent__legal add-agent-legal">
-              By enabling Autofix, you agree to Manifest&apos;s{' '}
-              <a href="https://manifest.build/terms" target="_blank" rel="noopener noreferrer">
-                Terms
-              </a>{' '}
-              and{' '}
-              <a href="https://manifest.build/privacy" target="_blank" rel="noopener noreferrer">
-                Privacy Policy
-              </a>
-              .
-            </p>
-          </Show>
-
           <div class="modal-card__footer">
             <button
               class="btn btn--primary btn--sm"
diff --git a/packages/frontend/src/components/AuthGuard.tsx b/packages/frontend/src/components/AuthGuard.tsx
index ad5d74c4..0f10f1f8 100644
--- a/packages/frontend/src/components/AuthGuard.tsx
+++ b/packages/frontend/src/components/AuthGuard.tsx
@@ -1,43 +1,24 @@
 import { useLocation, useNavigate } from '@solidjs/router';
-import { Show, createEffect, createSignal, type ParentComponent } from 'solid-js';
+import { Show, createEffect, type ParentComponent } from 'solid-js';
 import { authClient } from '../services/auth-client.js';
 import { buildLoginRedirect } from '../services/auth-redirects.js';
-import { getDiscoveryPendingNext } from '../services/discovery.js';
 
 const AuthGuard: ParentComponent = (props) => {
   const session = authClient.useSession();
   const navigate = useNavigate();
   const location = useLocation();
-  const [routeChecked, setRouteChecked] = createSignal(false);
 
   createEffect(() => {
     const s = session();
     if (s.isPending) return;
     if (!s.data) {
       navigate(buildLoginRedirect(location.pathname, location.search), { replace: true });
-      return;
     }
-    // The CLI consent page and the MCP OAuth consent page are not part of
-    // onboarding. Gate them on an authenticated session only, so a user who is
-    // mid-discovery can still authorize a client (otherwise the login flow
-    // never gets its code).
-    if (location.pathname === '/cli/auth' || location.pathname === '/consent') {
-      setRouteChecked(true);
-      return;
-    }
-    // A freshly signed-up user with the discovery step still pending is sent
-    // back to it from anywhere in the app except the form itself.
-    const pendingNext = getDiscoveryPendingNext(s.data.user?.id ?? '');
-    if (pendingNext !== null && location.pathname !== '/discovery') {
-      navigate(`/discovery?next=${encodeURIComponent(pendingNext)}`, { replace: true });
-      return;
-    }
-    setRouteChecked(true);
   });
 
   return (
     <Show
-      when={!session().isPending && session().data && routeChecked()}
+      when={!session().isPending && session().data}
       fallback={
         <div class="auth-layout">
           <div class="auth-card" style="text-align: center;">
diff --git a/packages/frontend/src/components/ChartHoverTooltip.tsx b/packages/frontend/src/components/ChartHoverTooltip.tsx
index aca4ba70..47831a42 100644
--- a/packages/frontend/src/components/ChartHoverTooltip.tsx
+++ b/packages/frontend/src/components/ChartHoverTooltip.tsx
@@ -5,7 +5,7 @@ import '../styles/agent-chart-tooltip.css';
 /**
  * Shared column-hover tooltip for the stacked bar charts (Cost / Tokens /
  * Requests by provider-harness via MultiAgentTokenChart, and Requests by
- * status / Healed requests via ReliabilityChart). One implementation so the
+ * status / Recovered requests via ReliabilityChart). One implementation so the
  * hover reads the same everywhere: snapped cursor, date header, one row per
  * series (swatch, name, value), underlined Total.
  */
diff --git a/packages/frontend/src/components/CostByModelTable.tsx b/packages/frontend/src/components/CostByModelTable.tsx
index 3231489d..c79387bd 100644
--- a/packages/frontend/src/components/CostByModelTable.tsx
+++ b/packages/frontend/src/components/CostByModelTable.tsx
@@ -13,7 +13,7 @@ import { PROVIDERS } from '../services/providers.js';
 import InfoTooltip from './InfoTooltip.jsx';
 import {
   attemptSuccessRate,
-  totalAttemptsTooltip,
+  TOTAL_ATTEMPTS_TOOLTIP,
   MODEL_SUCCESS_RATE_TOOLTIP,
   type ModelReliabilityRow,
 } from '../services/api/analytics.js';
@@ -31,8 +31,6 @@ interface CostByModelRow {
 
 interface CostByModelTableProps {
   rows: CostByModelRow[];
-  /** Doctor availability drives the Total attempts tooltip wording. */
-  doctorAvailable?: boolean;
   /** Per-model reliability (Total attempts · Success rate). The three columns
       render only when reliability data is provided. */
   reliability?: ModelReliabilityRow[];
@@ -79,7 +77,7 @@ const CostByModelTable: Component<CostByModelTableProps> = (props) => {
               <>
                 <th class="rel-col">
                   Total attempts
-                  <InfoTooltip text={totalAttemptsTooltip(props.doctorAvailable ?? false)} />
+                  <InfoTooltip text={TOTAL_ATTEMPTS_TOOLTIP} />
                 </th>
                 <th class="rel-col">
                   Success rate
diff --git a/packages/frontend/src/components/GuestGuard.tsx b/packages/frontend/src/components/GuestGuard.tsx
index fbdabd7a..c75c219e 100644
--- a/packages/frontend/src/components/GuestGuard.tsx
+++ b/packages/frontend/src/components/GuestGuard.tsx
@@ -3,7 +3,6 @@ import { Show, createEffect, createSignal, onMount, type ParentComponent } from
 import { authClient } from '../services/auth-client.js';
 import { getAuthDestination, signedOAuthDestination } from '../services/auth-redirects.js';
 import { checkNeedsSetup } from '../services/setup-status.js';
-import { getDiscoveryPendingNext } from '../services/discovery.js';
 
 const GuestGuard: ParentComponent = (props) => {
   const session = authClient.useSession();
@@ -30,14 +29,6 @@ const GuestGuard: ParentComponent = (props) => {
         globalThis.location.assign(destination);
         return;
       }
-      // An unfinished discovery step outranks the usual destinations:
-      // browser Back into the auth pages must land on the form, not fall
-      // through to the dashboard.
-      const pendingNext = getDiscoveryPendingNext(s.data.user?.id ?? '');
-      if (pendingNext !== null) {
-        navigate(`/discovery?next=${encodeURIComponent(pendingNext)}`, { replace: true });
-        return;
-      }
       navigate(destination, { replace: true });
     }
     if (setupChecked() && !s.isPending && !s.data) {
diff --git a/packages/frontend/src/components/Header.tsx b/packages/frontend/src/components/Header.tsx
index f681bf81..8c68976c 100644
--- a/packages/frontend/src/components/Header.tsx
+++ b/packages/frontend/src/components/Header.tsx
@@ -4,7 +4,6 @@ import { useAgentName } from '../services/routing.js';
 import { authClient } from '../services/auth-client.js';
 import { agentDisplayName } from '../services/agent-display-name.js';
 import { agentPlatformIcon } from '../services/agent-platform-store.js';
-import NotificationBell from './NotificationBell.jsx';
 import {
   connectionBreadcrumbName,
   connectionBreadcrumbProviderId,
@@ -232,7 +231,6 @@ const Header: Component<HeaderProps> = (props) => {
           </svg>
           Docs
         </a>
-        <NotificationBell />
         <div class="header__user" style="position: relative;">
           <button
             class="header__avatar-btn"
diff --git a/packages/frontend/src/components/MessageDetails.tsx b/packages/frontend/src/components/MessageDetails.tsx
index 438f4e4b..2c45370c 100644
--- a/packages/frontend/src/components/MessageDetails.tsx
+++ b/packages/frontend/src/components/MessageDetails.tsx
@@ -3,19 +3,16 @@ import {
   getMessageDetails,
   flagMessageMiscategorized,
   clearMessageMiscategorized,
-  type AutofixOperation,
 } from '../services/api.js';
 import { inferProviderName } from '../services/routing-utils.js';
 import { getModelDisplayName } from '../services/model-display.js';
-import { AUTOFIX_STATUS_LABELS, manifestErrorDocsUrl, isSuccessStatus } from 'manifest-shared';
+import { manifestErrorDocsUrl, isSuccessStatus } from 'manifest-shared';
 import { formatErrorClass, formatErrorOrigin } from '../services/formatters.js';
 import { ModelParamsSection, RequestHeadersSection } from './MessageDetailsSections.jsx';
 import { routingTierLabel } from './message-table-types.js';
 
 export interface MessageDetailsProps {
   messageId: string;
-  /** Open a linked message (the Autofix sibling) in the same list. */
-  onOpenMessage?: (id: string) => void;
 }
 
 function MetaField(props: { label: string; value: string | null | undefined }): JSX.Element {
@@ -71,173 +68,6 @@ function MiscategorizeControl(props: {
   );
 }
 
-/**
- * Human-readable description of a Phoenix operation.
- */
-function describeOperation(op: AutofixOperation): string {
-  switch (op.type) {
-    case 'drop_param':
-      return op.from
-        ? `Removed unsupported parameter "${op.from}"`
-        : 'Removed an unsupported parameter';
-    case 'rename_param':
-      return op.from && op.to ? `Renamed "${op.from}" to "${op.to}"` : 'Renamed a parameter';
-    case 'clamp_param':
-      return op.from && op.to
-        ? `Adjusted ${op.from} from ${op.from} to ${op.to}`
-        : 'Adjusted a value to fit the allowed range';
-    case 'set_param':
-      return op.from && op.to ? `Set "${op.from}" to ${op.to}` : 'Set a required parameter value';
-    case 'remap_model':
-      return op.from && op.to
-        ? `Switched from "${op.from}" to "${op.to}"`
-        : 'Replaced the model with a supported one';
-    case 'remove_unsupported_schema_keywords':
-      return 'Cleaned unsupported JSON Schema keywords from tool definitions';
-    case 'remove_unsupported_message_fields':
-      return op.from
-        ? `Removed unsupported field "${op.from}" from messages`
-        : 'Removed unsupported fields from messages';
-    default:
-      return op.from && op.to ? `${op.type}: ${op.from} → ${op.to}` : op.type;
-  }
-}
-
-/**
- * Autofix card. Shows the branding, a human phrase, the operation details,
- * Phoenix IDs, and a link to the paired row.
- */
-export function AutofixSection(props: {
-  role: string | null;
-  operations: AutofixOperation[] | null;
-  phoenix: {
-    status: string | null;
-    issueId: string | null;
-    patchId: string | null;
-    healAttemptId: string | null;
-    explanation?: {
-      summary: string;
-      operations: Array<{ type: string; detail: string }>;
-      source: string;
-    } | null;
-  } | null;
-  sibling: { id: string; role: string | null; status: string } | null;
-  onOpenMessage?: (id: string) => void;
-}): JSX.Element {
-  const isOriginal = () => props.role === 'original';
-  // Prefer Phoenix's own explanation (authoritative, built from the real edit) over
-  // our generic phrase and locally re-derived operation prose.
-  const explanation = () => props.phoenix?.explanation ?? null;
-  const phrase = () => {
-    const summary = explanation()?.summary;
-    if (summary) return summary;
-    if (!isOriginal())
-      return 'Manifest caught an error, repaired the request, and retried it successfully.';
-    return props.sibling
-      ? 'This request failed. Manifest repaired it automatically and retried.'
-      : 'This request failed. Autofix tried but could not find a repair.';
-  };
-  // One row per edit: Phoenix's per-op detail when present, else our local fallback.
-  const fixRows = (): Array<{ type: string; detail: string }> => {
-    const ex = explanation();
-    if (ex && ex.operations.length > 0) return ex.operations;
-    return (props.operations ?? []).map((op) => ({ type: op.type, detail: describeOperation(op) }));
-  };
-
-  return (
-    <div class="autofix-card-row">
-      <div class="autofix-card autofix-card--autofix">
-        <div class="autofix-card__branding">
-          <span class="autofix-icon">
-            <svg
-              xmlns="http://www.w3.org/2000/svg"
-              width="12"
-              height="12"
-              fill="currentColor"
-              viewBox="0 0 24 24"
-              aria-hidden="true"
-            >
-              <path d="m21.45 11.11-3-1.5-2.68-1.34-.03-.03-1.34-2.68-1.5-3c-.34-.68-1.45-.68-1.79 0l-1.5 3-1.34 2.68-.03.03-2.68 1.34-3 1.5c-.34.17-.55.52-.55.89s.21.72.55.89l3 1.5 2.68 1.34.03.03 1.34 2.68 1.5 3c.17.34.52.55.89.55s.72-.21.89-.55l1.5-3 1.34-2.68.03-.03 2.68-1.34 3-1.5c.34-.17.55-.52.55-.89s-.21-.72-.55-.89Z" />
-            </svg>
-          </span>
-          <span class="autofix-card__title">autofix</span>
-        </div>
-
-        <p class="autofix-card__phrase">{phrase()}</p>
-
-        <Show when={fixRows().length > 0}>
-          <table class="error-autofix-row__meta-table">
-            <tbody>
-              <For each={fixRows()}>
-                {(op) => (
-                  <tr>
-                    <td class="error-autofix-row__meta-label">Fix</td>
-                    <td class="error-autofix-row__meta-value">
-                      <strong>{op.type}</strong>
-                      <span class="error-autofix-row__meta-hint">{op.detail}</span>
-                    </td>
-                  </tr>
-                )}
-              </For>
-            </tbody>
-          </table>
-        </Show>
-
-        <Show
-          when={
-            props.phoenix &&
-            (props.phoenix.issueId || props.phoenix.patchId || props.phoenix.healAttemptId)
-          }
-        >
-          <div class="autofix-card__ids">
-            <Show when={props.phoenix!.issueId}>
-              <span>Issue {props.phoenix!.issueId!.slice(0, 8)}</span>
-            </Show>
-            <Show when={props.phoenix!.patchId}>
-              <span>Patch {props.phoenix!.patchId!.slice(0, 8)}</span>
-            </Show>
-            <Show when={props.phoenix!.healAttemptId}>
-              <span>Heal-attempt {props.phoenix!.healAttemptId!.slice(0, 8)}</span>
-            </Show>
-          </div>
-        </Show>
-
-        <Show when={props.sibling && props.onOpenMessage}>
-          <button
-            type="button"
-            class={
-              isOriginal()
-                ? 'error-autofix-row__autofix-btn'
-                : 'error-autofix-row__autofix-btn error-autofix-row__autofix-btn--secondary'
-            }
-            style="margin-top: 10px;"
-            onClick={() => props.onOpenMessage!(props.sibling!.id)}
-          >
-            {isOriginal() ? (
-              <>
-                <svg
-                  xmlns="http://www.w3.org/2000/svg"
-                  width="14"
-                  height="14"
-                  fill="currentColor"
-                  viewBox="0 0 24 24"
-                  aria-hidden="true"
-                  style="flex-shrink: 0;"
-                >
-                  <path d="m21.45 11.11-3-1.5-2.68-1.34-.03-.03-1.34-2.68-1.5-3c-.34-.68-1.45-.68-1.79 0l-1.5 3-1.34 2.68-.03.03-2.68 1.34-3 1.5c-.34.17-.55.52-.55.89s.21.72.55.89l3 1.5 2.68 1.34.03.03 1.34 2.68 1.5 3c.17.34.52.55.89.55s.72-.21.89-.55l1.5-3 1.34-2.68.03-.03 2.68-1.34 3-1.5c.34-.17.55-.52.55-.89s-.21-.72-.55-.89Z" />
-                </svg>
-                View Autofix retry
-              </>
-            ) : (
-              <>← View original request</>
-            )}
-          </button>
-        </Show>
-      </div>
-    </div>
-  );
-}
-
 export default function MessageDetails(props: MessageDetailsProps): JSX.Element {
   const [data] = createResource(() => props.messageId, getMessageDetails);
 
@@ -257,8 +87,8 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
           const d = data()!;
           const m = d.message;
           const provider = m.model ? inferProviderName(m.model) : null;
-          // Normalize status for display: a superseded failure (fallback / autofix
-          // original) still renders its real two-state outcome. isSuccessStatus
+          // Normalize status for display: a superseded failure (the fallback
+          // primary) still renders its real two-state outcome. isSuccessStatus
           // accepts both the legacy `ok` and the canonical `success`.
           const displayStatus = () => {
             if (m.status === 'pending' || m.status === 'cancelled') {
@@ -271,17 +101,14 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
               return { label: 'Success', cls: 'status-badge status-badge--ok' };
             return { label: 'Failed', cls: 'status-badge status-badge--error' };
           };
-          const isAutofixOriginal = m.autofix_applied && m.autofix_role === 'original';
-          const isAutofixRetry = m.autofix_applied && m.autofix_role === 'retry';
           // The superseded primary of a fallback flow (legacy status `fallback_error`,
-          // now the canonical `failed` + `superseded`), excluding the Autofix original
-          // which has its own next-action panel.
-          const isFallbackError =
-            m.status === 'fallback_error' || (m.superseded === true && !isAutofixOriginal);
+          // now the canonical `failed` + `superseded`).
+          const isFallbackError = m.status === 'fallback_error' || m.superseded === true;
           const isFallbackTrigger = !!m.fallback_from_model && !isFallbackError;
-          const hasTrigger = isAutofixRetry || isFallbackTrigger;
-          const hasNextAction = isAutofixOriginal || isFallbackError;
-          const isTripleLayout = hasTrigger && hasNextAction && !!m.error_message;
+          // The two are exclusive: a superseded attempt shows what came next,
+          // the final fallback attempt shows what triggered it.
+          const hasTrigger = isFallbackTrigger;
+          const hasNextAction = isFallbackError;
           return (
             <>
               {/* ── Message section — always first ─────────────────── */}
@@ -292,10 +119,6 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                     <span class="msg-detail__meta-label">Status</span>
                     <span class={displayStatus().cls}>{displayStatus().label}</span>
                   </span>
-                  <MetaField
-                    label="Autofix"
-                    value={m.autofix_status ? AUTOFIX_STATUS_LABELS[m.autofix_status] : null}
-                  />
                   <MetaField label="ID" value={m.id} />
                   <MetaField label="Provider" value={provider} />
                   <MetaField label="Auth" value={m.auth_type} />
@@ -339,11 +162,11 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                     <div
                       class={
                         hasNextAction || hasTrigger
-                          ? 'error-autofix-row__error'
-                          : 'error-autofix-row__error error-autofix-row__error--full'
+                          ? 'error-recovery-row__error'
+                          : 'error-recovery-row__error error-recovery-row__error--full'
                       }
                     >
-                      <div class="error-autofix-row__title">Error</div>
+                      <div class="error-recovery-row__title">Error</div>
                       <div class="msg-detail__error-inline">
                         <svg
                           xmlns="http://www.w3.org/2000/svg"
@@ -363,12 +186,12 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                         </svg>
                         <span>{m.error_message}</span>
                       </div>
-                      <table class="error-autofix-row__meta-table">
+                      <table class="error-recovery-row__meta-table">
                         <tbody>
                           <Show when={m.error_code}>
                             <tr>
-                              <td class="error-autofix-row__meta-label">Code</td>
-                              <td class="error-autofix-row__meta-value">
+                              <td class="error-recovery-row__meta-label">Code</td>
+                              <td class="error-recovery-row__meta-value">
                                 <a
                                   class="msg-detail__error-code"
                                   href={manifestErrorDocsUrl(m.error_code!)}
@@ -377,7 +200,7 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                                 >
                                   {m.error_code}
                                 </a>
-                                <span class="error-autofix-row__meta-hint">
+                                <span class="error-recovery-row__meta-hint">
                                   Read the docs for this error.
                                 </span>
                               </td>
@@ -385,10 +208,10 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                           </Show>
                           <Show when={formatErrorOrigin(m.error_origin)}>
                             <tr>
-                              <td class="error-autofix-row__meta-label">Origin</td>
-                              <td class="error-autofix-row__meta-value">
+                              <td class="error-recovery-row__meta-label">Origin</td>
+                              <td class="error-recovery-row__meta-value">
                                 <strong>{formatErrorOrigin(m.error_origin)}</strong>
-                                <span class="error-autofix-row__meta-hint">
+                                <span class="error-recovery-row__meta-hint">
                                   {m.error_origin === 'provider' &&
                                     'The LLM provider rejected the request.'}
                                   {m.error_origin === 'transport' &&
@@ -405,10 +228,10 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                           </Show>
                           <Show when={formatErrorClass(m.error_class)}>
                             <tr>
-                              <td class="error-autofix-row__meta-label">Type</td>
-                              <td class="error-autofix-row__meta-value">
+                              <td class="error-recovery-row__meta-label">Type</td>
+                              <td class="error-recovery-row__meta-value">
                                 <strong>{formatErrorClass(m.error_class)}</strong>
-                                <span class="error-autofix-row__meta-hint">
+                                <span class="error-recovery-row__meta-hint">
                                   {m.error_class === 'invalid_request' &&
                                     'The request is malformed. Wrong parameter, unsupported value, or missing field.'}
                                   {m.error_class === 'rate_limit' &&
@@ -433,9 +256,9 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                   );
 
                   const arrowBlock = (
-                    <div class="error-autofix-row__arrow">
+                    <div class="error-recovery-row__arrow">
                       <svg
-                        class="error-autofix-row__arrow-right"
+                        class="error-recovery-row__arrow-right"
                         xmlns="http://www.w3.org/2000/svg"
                         width="20"
                         height="20"
@@ -446,7 +269,7 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                         <path d="M6 13h6v4l6-5-6-5v4H6z" />
                       </svg>
                       <svg
-                        class="error-autofix-row__arrow-down"
+                        class="error-recovery-row__arrow-down"
                         xmlns="http://www.w3.org/2000/svg"
                         width="20"
                         height="20"
@@ -459,32 +282,9 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                     </div>
                   );
 
-                  const autofixTriggerCard = (
-                    <div class="error-autofix-row__autofix error-autofix-row__autofix--autofix">
-                      <div class="error-autofix-row__autofix-title">
-                        <span class="autofix-icon">
-                          <svg
-                            xmlns="http://www.w3.org/2000/svg"
-                            width="12"
-                            height="12"
-                            fill="currentColor"
-                            viewBox="0 0 24 24"
-                            aria-hidden="true"
-                          >
-                            <path d="m21.45 11.11-3-1.5-2.68-1.34-.03-.03-1.34-2.68-1.5-3c-.34-.68-1.45-.68-1.79 0l-1.5 3-1.34 2.68-.03.03-2.68 1.34-3 1.5c-.34.17-.55.52-.55.89s.21.72.55.89l3 1.5 2.68 1.34.03.03 1.34 2.68 1.5 3c.17.34.52.55.89.55s.72-.21.89-.55l1.5-3 1.34-2.68.03-.03 2.68-1.34 3-1.5c.34-.17.55-.52.55-.89s-.21-.72-.55-.89Z" />
-                          </svg>
-                        </span>
-                        <span class="autofix-card__title">autofix</span>
-                      </div>
-                      <p class="error-autofix-row__autofix-text" style="font-size: 12px;">
-                        This request was triggered by an autofix.
-                      </p>
-                    </div>
-                  );
-
                   const fallbackTriggerCard = (
-                    <div class="error-autofix-row__autofix error-autofix-row__autofix--fallback">
-                      <div class="error-autofix-row__autofix-title">
+                    <div class="error-recovery-row__card error-recovery-row__card--fallback">
+                      <div class="error-recovery-row__card-title">
                         <span class="fallback-icon">
                           <svg
                             xmlns="http://www.w3.org/2000/svg"
@@ -497,9 +297,9 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                             <path d="m7.84 13.75 1.33-1.49-2.53-2.25h8.37c2.21 0 4 1.79 4 4s-1.79 4-4 4h-3v2h3c3.31 0 6-2.69 6-6s-2.69-6-6-6H6.63l2.53-2.25-1.33-1.49-5.34 4.75 5.34 4.75Z" />
                           </svg>
                         </span>
-                        <span class="autofix-card__title">fallback</span>
+                        <span class="recovery-card__title">fallback</span>
                       </div>
-                      <p class="error-autofix-row__autofix-text" style="font-size: 12px;">
+                      <p class="error-recovery-row__card-text" style="font-size: 12px;">
                         <strong>Attempt #{((m.fallback_index as number) ?? 0) + 1}:</strong> this
                         request was triggered by a fallback from{' '}
                         <strong>
@@ -512,52 +312,9 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                     </div>
                   );
 
-                  const autofixNextCard = (
-                    <div class="error-autofix-row__autofix error-autofix-row__autofix--autofix">
-                      <div class="error-autofix-row__autofix-title">
-                        <span class="autofix-icon">
-                          <svg
-                            xmlns="http://www.w3.org/2000/svg"
-                            width="12"
-                            height="12"
-                            fill="currentColor"
-                            viewBox="0 0 24 24"
-                            aria-hidden="true"
-                          >
-                            <path d="m21.45 11.11-3-1.5-2.68-1.34-.03-.03-1.34-2.68-1.5-3c-.34-.68-1.45-.68-1.79 0l-1.5 3-1.34 2.68-.03.03-2.68 1.34-3 1.5c-.34.17-.55.52-.55.89s.21.72.55.89l3 1.5 2.68 1.34.03.03 1.34 2.68 1.5 3c.17.34.52.55.89.55s.72-.21.89-.55l1.5-3 1.34-2.68.03-.03 2.68-1.34 3-1.5c.34-.17.55-.52.55-.89s-.21-.72-.55-.89Z" />
-                          </svg>
-                        </span>
-                        <span class="autofix-card__title">autofix</span>
-                      </div>
-                      <p class="error-autofix-row__autofix-text">
-                        Autofix was attempted after this error.
-                      </p>
-                      <Show when={m.autofix_sibling && props.onOpenMessage}>
-                        <button
-                          type="button"
-                          class="error-autofix-row__autofix-btn"
-                          onClick={() => props.onOpenMessage!(m.autofix_sibling!.id)}
-                        >
-                          <svg
-                            xmlns="http://www.w3.org/2000/svg"
-                            width="14"
-                            height="14"
-                            fill="currentColor"
-                            viewBox="0 0 24 24"
-                            aria-hidden="true"
-                            style="flex-shrink: 0;"
-                          >
-                            <path d="m21.45 11.11-3-1.5-2.68-1.34-.03-.03-1.34-2.68-1.5-3c-.34-.68-1.45-.68-1.79 0l-1.5 3-1.34 2.68-.03.03-2.68 1.34-3 1.5c-.34.17-.55.52-.55.89s.21.72.55.89l3 1.5 2.68 1.34.03.03 1.34 2.68 1.5 3c.17.34.52.55.89.55s.72-.21.89-.55l1.5-3 1.34-2.68.03-.03 2.68-1.34 3-1.5c.34-.17.55-.52.55-.89s-.21-.72-.55-.89Z" />
-                          </svg>
-                          View Autofix retry
-                        </button>
-                      </Show>
-                    </div>
-                  );
-
                   const fallbackNextCard = (
-                    <div class="error-autofix-row__autofix error-autofix-row__autofix--fallback">
-                      <div class="error-autofix-row__autofix-title">
+                    <div class="error-recovery-row__card error-recovery-row__card--fallback">
+                      <div class="error-recovery-row__card-title">
                         <span class="fallback-icon">
                           <svg
                             xmlns="http://www.w3.org/2000/svg"
@@ -570,70 +327,18 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                             <path d="m7.84 13.75 1.33-1.49-2.53-2.25h8.37c2.21 0 4 1.79 4 4s-1.79 4-4 4h-3v2h3c3.31 0 6-2.69 6-6s-2.69-6-6-6H6.63l2.53-2.25-1.33-1.49-5.34 4.75 5.34 4.75Z" />
                           </svg>
                         </span>
-                        <span class="autofix-card__title">fallback</span>
+                        <span class="recovery-card__title">fallback</span>
                       </div>
-                      <p class="error-autofix-row__autofix-text">
+                      <p class="error-recovery-row__card-text">
                         A fallback was triggered after this error.
                       </p>
                     </div>
                   );
 
-                  /* Cases 4-7: Triple layout — trigger | error | next action */
-                  if (isTripleLayout) {
-                    const triggerCard = isAutofixRetry ? autofixTriggerCard : fallbackTriggerCard;
-                    const nextCard = isAutofixOriginal ? autofixNextCard : fallbackNextCard;
-                    const arrowBlock2 = (
-                      <div class="error-autofix-row__arrow">
-                        <svg
-                          class="error-autofix-row__arrow-right"
-                          xmlns="http://www.w3.org/2000/svg"
-                          width="20"
-                          height="20"
-                          fill="currentColor"
-                          viewBox="0 0 24 24"
-                          aria-hidden="true"
-                        >
-                          <path d="M6 13h6v4l6-5-6-5v4H6z" />
-                        </svg>
-                        <svg
-                          class="error-autofix-row__arrow-down"
-                          xmlns="http://www.w3.org/2000/svg"
-                          width="20"
-                          height="20"
-                          fill="currentColor"
-                          viewBox="0 0 24 24"
-                          aria-hidden="true"
-                        >
-                          <path d="M13 12V6h-2v6H7l5 6 5-6z" />
-                        </svg>
-                      </div>
-                    );
-                    return (
-                      <div class="error-autofix-row error-autofix-row--triple">
-                        {triggerCard}
-                        {arrowBlock}
-                        {errorBlock}
-                        {arrowBlock2}
-                        {nextCard}
-                      </div>
-                    );
-                  }
-
-                  /* Case 2: Error + autofix (no trigger) */
-                  if (m.error_message && isAutofixOriginal) {
-                    return (
-                      <div class="error-autofix-row">
-                        {errorBlock}
-                        {arrowBlock}
-                        {autofixNextCard}
-                      </div>
-                    );
-                  }
-
-                  /* Case 3: Error + fallback (no trigger) */
+                  /* Error + fallback (no trigger) */
                   if (m.error_message && isFallbackError) {
                     return (
-                      <div class="error-autofix-row">
+                      <div class="error-recovery-row">
                         {errorBlock}
                         {arrowBlock}
                         {fallbackNextCard}
@@ -641,12 +346,11 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                     );
                   }
 
-                  /* Cases 8-9: Trigger + error, nothing after → 50/50 */
-                  if (m.error_message && hasTrigger && !hasNextAction) {
-                    const triggerCard = isAutofixRetry ? autofixTriggerCard : fallbackTriggerCard;
+                  /* Trigger + error, nothing after → 50/50 */
+                  if (m.error_message && hasTrigger) {
                     return (
-                      <div class="error-autofix-row">
-                        {triggerCard}
+                      <div class="error-recovery-row">
+                        {fallbackTriggerCard}
                         {arrowBlock}
                         {errorBlock}
                       </div>
@@ -656,28 +360,16 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                   /* Error only → full width */
                   if (m.error_message) {
                     return (
-                      <div class="error-autofix-row error-autofix-row--solo">{errorBlock}</div>
-                    );
-                  }
-
-                  /* ── No error: trigger-only cards (autofix retry success, fallback success) */
-                  if (isAutofixRetry && !m.error_message) {
-                    return (
-                      <AutofixSection
-                        role={m.autofix_role}
-                        operations={m.autofix_operations}
-                        phoenix={m.autofix_decision}
-                        sibling={m.autofix_sibling}
-                        onOpenMessage={props.onOpenMessage}
-                      />
+                      <div class="error-recovery-row error-recovery-row--solo">{errorBlock}</div>
                     );
                   }
 
+                  /* ── No error: the successful fallback attempt */
                   if (isFallbackTrigger && !m.error_message) {
                     return (
-                      <div class="autofix-card-row">
-                        <div class="autofix-card autofix-card--fallback">
-                          <div class="autofix-card__branding">
+                      <div class="recovery-card-row">
+                        <div class="recovery-card recovery-card--fallback">
+                          <div class="recovery-card__branding">
                             <span class="fallback-icon">
                               <svg
                                 xmlns="http://www.w3.org/2000/svg"
@@ -690,9 +382,9 @@ export default function MessageDetails(props: MessageDetailsProps): JSX.Element
                                 <path d="m7.84 13.75 1.33-1.49-2.53-2.25h8.37c2.21 0 4 1.79 4 4s-1.79 4-4 4h-3v2h3c3.31 0 6-2.69 6-6s-2.69-6-6-6H6.63l2.53-2.25-1.33-1.49-5.34 4.75 5.34 4.75Z" />
                               </svg>
                             </span>
-                            <span class="autofix-card__title">fallback</span>
+                            <span class="recovery-card__title">fallback</span>
                           </div>
-                          <p class="autofix-card__phrase" style="font-size: 12px;">
+                          <p class="recovery-card__phrase" style="font-size: 12px;">
                             <strong>Attempt #{((m.fallback_index as number) ?? 0) + 1}:</strong>{' '}
                             this request was triggered by a fallback from{' '}
                             <strong>
diff --git a/packages/frontend/src/components/MessageTable.tsx b/packages/frontend/src/components/MessageTable.tsx
index a1e29f75..918cdf86 100644
--- a/packages/frontend/src/components/MessageTable.tsx
+++ b/packages/frontend/src/components/MessageTable.tsx
@@ -13,8 +13,6 @@ export interface MessageTableProps {
   ) => { platform: string | null; category: string | null } | undefined;
   onFallbackErrorClick?: (model: string) => void;
   onTriggerClick?: (id: string) => void;
-  /** Open a linked message (Autofix sibling) from an expanded row's detail. */
-  onOpenMessage?: (id: string) => void;
   rowIdPrefix?: string;
   showHeaderTooltips?: boolean;
   expandable?: boolean;
@@ -99,10 +97,7 @@ function ExpandableRow(props: {
       <Show when={expanded() && !useDrawer()}>
         <tr class="msg-detail__row">
           <td colspan={colSpan()} class="msg-detail__cell">
-            <MessageDetails
-              messageId={props.item.id}
-              onOpenMessage={props.tableProps.onOpenMessage}
-            />
+            <MessageDetails messageId={props.item.id} />
           </td>
         </tr>
       </Show>
diff --git a/packages/frontend/src/components/NotificationBell.tsx b/packages/frontend/src/components/NotificationBell.tsx
deleted file mode 100644
index cc24bc19..00000000
--- a/packages/frontend/src/components/NotificationBell.tsx
+++ /dev/null
@@ -1,192 +0,0 @@
-import {
-  createResource,
-  createSignal,
-  createMemo,
-  createEffect,
-  For,
-  Show,
-  onCleanup,
-  type Component,
-} from 'solid-js';
-import '../styles/notifications-bell.css';
-import { A } from '@solidjs/router';
-import { getWorkspaceAutofixStatus } from '../services/api/analytics.js';
-import { getAgents } from '../services/api.js';
-import { agentPing, routingPing } from '../services/sse.js';
-
-const READ_KEY = 'manifest_notif_read';
-
-function getReadSet(): Set<string> {
-  try {
-    const raw = localStorage.getItem(READ_KEY);
-    if (raw) return new Set(JSON.parse(raw));
-  } catch {
-    /* ignore */
-  }
-  return new Set();
-}
-
-function markRead(agentName: string) {
-  const s = getReadSet();
-  s.add(agentName);
-  try {
-    localStorage.setItem(READ_KEY, JSON.stringify([...s]));
-  } catch {
-    /* ignore */
-  }
-}
-
-interface AgentRow {
-  agent_name: string;
-  display_name: string;
-}
-
-const NotificationBell: Component = () => {
-  const [open, setOpen] = createSignal(false);
-  const [readSet, setReadSet] = createSignal(getReadSet());
-  let rootRef: HTMLDivElement | undefined;
-
-  // Close on outside click
-  if (typeof document !== 'undefined') {
-    const handler = (e: MouseEvent) => {
-      if (rootRef && !rootRef.contains(e.target as Node)) setOpen(false);
-    };
-    document.addEventListener('mousedown', handler);
-    onCleanup(() => document.removeEventListener('mousedown', handler));
-  }
-
-  // Poll once a minute to catch autofix toggle changes (no SSE for this
-  // mutation). The status only changes on a toggle, never on traffic, so it
-  // must not key on messagePing: every gateway request fires that ping, and
-  // refetching on each one made this bell the busiest dashboard endpoint in
-  // production, competing with the Overview for the same database pool.
-  const [tick, setTick] = createSignal(0);
-  const interval = setInterval(() => setTick((n) => n + 1), 60_000);
-  onCleanup(() => clearInterval(interval));
-
-  const [status] = createResource(
-    () => ({ _a: agentPing(), _r: routingPing(), _t: tick() }),
-    async () => {
-      try {
-        return await getWorkspaceAutofixStatus();
-      } catch {
-        return null;
-      }
-    },
-  );
-
-  const [agentList] = createResource(
-    () => ({ _a: agentPing() }),
-    async () => {
-      try {
-        const data = (await getAgents()) as { agents?: AgentRow[] } | AgentRow[];
-        return Array.isArray(data) ? data : (data?.agents ?? []);
-      } catch {
-        return [] as AgentRow[];
-      }
-    },
-  );
-
-  const disabledAgents = createMemo(() => {
-    const s = status();
-    const list = agentList() ?? [];
-    if (!s) return [];
-    const enabledSet = new Set(s.enabled_agents);
-    return list
-      .filter((a) => !enabledSet.has(a.agent_name))
-      .map((a) => ({ name: a.agent_name, display: a.display_name || a.agent_name }));
-  });
-
-  // When an agent gets enabled, remove it from the read set so the
-  // notification reappears fresh if it's later disabled again.
-  createEffect(() => {
-    const s = status();
-    if (!s) return;
-    const enabled = new Set(s.enabled_agents);
-    const read = getReadSet();
-    let changed = false;
-    for (const name of read) {
-      if (enabled.has(name)) {
-        read.delete(name);
-        changed = true;
-      }
-    }
-    if (changed) {
-      try {
-        localStorage.setItem(READ_KEY, JSON.stringify([...read]));
-      } catch {
-        /* ignore */
-      }
-      setReadSet(new Set(read));
-    }
-  });
-
-  const unreadCount = createMemo(
-    () => disabledAgents().filter((a) => !readSet().has(a.name)).length,
-  );
-
-  const handleClick = (agentName: string) => {
-    markRead(agentName);
-    setReadSet(getReadSet());
-    setOpen(false);
-  };
-
-  return (
-    <Show when={disabledAgents().length > 0}>
-      <div ref={rootRef} style="position: relative;">
-        <button
-          class="btn btn--outline btn--sm"
-          style="position: relative; padding: 6px; display: flex; align-items: center;"
-          onClick={() => setOpen(!open())}
-          aria-label="Notifications"
-        >
-          <svg
-            xmlns="http://www.w3.org/2000/svg"
-            width="18"
-            height="18"
-            fill="currentColor"
-            viewBox="0 0 24 24"
-          >
-            <path d="M19 12.59V10c0-3.22-2.18-5.93-5.14-6.74C13.57 2.52 12.85 2 12 2s-1.56.52-1.86 1.26C7.18 4.08 5 6.79 5 10v2.59L3.29 14.3a1 1 0 0 0-.29.71v2c0 .55.45 1 1 1h16c.55 0 1-.45 1-1v-2c0-.27-.11-.52-.29-.71zM19 16H5v-.59l1.71-1.71a1 1 0 0 0 .29-.71v-3c0-2.76 2.24-5 5-5s5 2.24 5 5v3c0 .27.11.52.29.71L19 15.41zm-4.18 4H9.18c.41 1.17 1.51 2 2.82 2s2.41-.83 2.82-2" />
-          </svg>
-          <Show when={unreadCount() > 0}>
-            <span style="position: absolute; top: 2px; right: 2px; width: 8px; height: 8px; border-radius: 50%; background: hsl(var(--destructive));" />
-          </Show>
-        </button>
-
-        <Show when={open()}>
-          <div class="notif-dropdown">
-            <div class="notif-dropdown__header">Autofix notifications</div>
-            <div class="notif-dropdown__list">
-              <For each={disabledAgents()}>
-                {(agent) => {
-                  const isRead = () => readSet().has(agent.name);
-                  return (
-                    <A
-                      href={`/harnesses/${encodeURIComponent(agent.name)}/settings?highlight=autofix`}
-                      class="notif-dropdown__item"
-                      classList={{ 'notif-dropdown__item--read': isRead() }}
-                      onClick={() => handleClick(agent.name)}
-                    >
-                      <div class="notif-dropdown__dot-col">
-                        <Show when={!isRead()}>
-                          <span class="notif-dropdown__dot" />
-                        </Show>
-                      </div>
-                      <span style="font-size: 14px;">
-                        Autofix is inactive on <strong>{agent.display}</strong>. Enable it to get
-                        the full dashboard experience.
-                      </span>
-                    </A>
-                  );
-                }}
-              </For>
-            </div>
-          </div>
-        </Show>
-      </div>
-    </Show>
-  );
-};
-
-export default NotificationBell;
diff --git a/packages/frontend/src/components/ProviderChartCard.tsx b/packages/frontend/src/components/ProviderChartCard.tsx
index 93ea19d4..26d3b299 100644
--- a/packages/frontend/src/components/ProviderChartCard.tsx
+++ b/packages/frontend/src/components/ProviderChartCard.tsx
@@ -89,7 +89,7 @@ const ProviderChartCard: Component<ProviderChartCardProps> = (props) => {
                 text={
                   props.requestSuccessRate == null
                     ? `Provider-attempt success: ${props.attemptSuccessRate!.toFixed(1)}%.`
-                    : `Caller success: ${props.requestSuccessRate.toFixed(1)}%. Provider-attempt success: ${props.attemptSuccessRate!.toFixed(1)}%. The gap is recovery from fallbacks and Autofix.`
+                    : `Caller success: ${props.requestSuccessRate.toFixed(1)}%. Provider-attempt success: ${props.attemptSuccessRate!.toFixed(1)}%. The gap is recovery from fallbacks.`
                 }
               />
             </Show>
diff --git a/packages/frontend/src/components/ReliabilityChart.tsx b/packages/frontend/src/components/ReliabilityChart.tsx
index 36970e29..9351da4b 100644
--- a/packages/frontend/src/components/ReliabilityChart.tsx
+++ b/packages/frontend/src/components/ReliabilityChart.tsx
@@ -19,28 +19,19 @@ import {
   isMultiDayRange,
   fillDailyGaps,
 } from '../services/chart-utils.js';
-import type { AutofixTimeseries } from '../services/api/analytics.js';
+import type { StatusTimeseries } from '../services/api/analytics.js';
 
 // ---------------------------------------------------------------------------
 // Colors per series mode
 // ---------------------------------------------------------------------------
 const OUTCOME_COLORS: Record<string, string> = {
   success: '#1cc4bf', // --success teal — direct success
-  healed: '#2632ef', // blue — recovered by Autofix (must not read as success)
-  autofix: '#2632ef', // blue — recovered by autofix
   fallback: '#f2c79c', // warm yellow — recovered by fallback
   error: '#EF4444', // --destructive red
-  no_fix_found: '#F59E0B', // amber
-  resolving: '#D1D5DB',
-  ineffective: '#DC2626',
 };
 
 function colorFor(key: string, mode: string, idx: number): string {
   if (mode === 'disposition') return OUTCOME_COLORS[key] ?? '#888';
-  if (mode === 'autofix') {
-    if (key === 'auto-fixed') return '#1cc4bf';
-    return '#EF4444';
-  }
   if (mode === 'http_status') {
     if (key.startsWith('2')) return '#1cc4bf'; // success teal, like every chart
     if (key.startsWith('4')) return '#F59E0B';
@@ -65,11 +56,7 @@ function colorFor(key: string, mode: string, idx: number): string {
 function keyLabel(key: string): string {
   if (key === 'none') return 'No error';
   if (key === 'success') return 'Success';
-  if (key === 'healed') return 'Success - recovered by Autofix';
   if (key === 'error') return 'Error';
-  if (key === 'no_fix_found') return 'No fix found';
-  if (key === 'autofix') return 'Success - recovered by Autofix';
-  if (key === 'auto-fixed') return 'Autofixed';
   if (key === 'fallback') return 'Success - recovered by Fallback';
   return key.replace(/_/g, ' ').replace(/^\w/, (c) => c.toUpperCase());
 }
@@ -78,25 +65,23 @@ function keyLabel(key: string): string {
 // Component
 // ---------------------------------------------------------------------------
 export interface ReliabilityChartProps {
-  timeseries: AutofixTimeseries;
+  timeseries: StatusTimeseries;
   range: string;
   seriesMode: string;
 }
 
 /**
  * Fixed reading order for the disposition series — legend AND bar stacking
- * (bottom to top): Success, then healed via Autofix, then healed via
- * Fallback, then Error. Unknown keys keep their incoming order, after these.
+ * (bottom to top): Success, then recovered via Fallback, then Error.
+ * Unknown keys keep their incoming order, after these.
  */
 const SERIES_ORDER: Record<string, number> = {
   success: 0,
-  healed: 1,
-  autofix: 1,
-  fallback: 2,
-  error: 3,
+  fallback: 1,
+  error: 2,
 };
 
-function orderTimeseries(d: AutofixTimeseries | undefined): AutofixTimeseries | undefined {
+function orderTimeseries(d: StatusTimeseries | undefined): StatusTimeseries | undefined {
   if (!d) return d;
   const picked = d.keys
     .map((k, i) => ({ k, i }))
@@ -205,7 +190,7 @@ const ReliabilityChart: Component<ReliabilityChartProps> = (props) => {
                   return;
                 }
                 // One row per series, in the fixed legend/stacking order
-                // (Success, healed via Autofix, via Fallback, Error) — NOT
+                // (Success, recovered via Fallback, Error) — NOT
                 // value-sorted like the per-agent charts.
                 const entries: HoverTooltipState['entries'] = [];
                 let total = 0;
diff --git a/packages/frontend/src/components/AutofixKpiCards.tsx b/packages/frontend/src/components/ReliabilityKpiCards.tsx
similarity index 72%
rename from packages/frontend/src/components/AutofixKpiCards.tsx
rename to packages/frontend/src/components/ReliabilityKpiCards.tsx
index b5de3619..70c2531b 100644
--- a/packages/frontend/src/components/AutofixKpiCards.tsx
+++ b/packages/frontend/src/components/ReliabilityKpiCards.tsx
@@ -8,7 +8,7 @@ import '../styles/analytics-overview.css';
 import {
   RECOVERED_REQUESTS_TOOLTIP,
   REQUEST_SUCCESS_RATE_TOOLTIP,
-  type AutofixStats,
+  type ReliabilityStats,
 } from '../services/api/analytics.js';
 
 function fmtPct(v: number): string {
@@ -31,8 +31,8 @@ function trendBadge(current: number, previous: number) {
   );
 }
 
-export interface AutofixKpiCardsProps {
-  stats: AutofixStats | undefined;
+export interface ReliabilityKpiCardsProps {
+  stats: ReliabilityStats | undefined;
   /** Scopes the deep links to one harness; omitted, they cover every harness. */
   agentName?: string;
   /** The page's current window, carried on the deep links. */
@@ -44,11 +44,11 @@ export interface AutofixKpiCardsProps {
 const viewMore = (): JSX.Element => <span class="view-more-link">View more</span>;
 
 /**
- * The reliability story, request-first: Success rate · Self-healed requests %
- * · Self-healed via Autofix · Self-healed via Fallback. Self-healed =
- * autofix_saves + fallback_saves over the window total.
+ * The reliability story, request-first: Success rate · Recovered requests %
+ * · Recovered by fallback · Failed requests. Recovered = fallback_saves over
+ * the window total.
  */
-const AutofixKpiCards: Component<AutofixKpiCardsProps> = (props) => {
+const ReliabilityKpiCards: Component<ReliabilityKpiCardsProps> = (props) => {
   const navigate = useNavigate();
   const requestsLink = (extra: string) => {
     if (props.noLinks) return null;
@@ -81,31 +81,23 @@ const AutofixKpiCards: Component<AutofixKpiCardsProps> = (props) => {
       : {};
   const scopeTitle = (subject: string) =>
     props.agentName ? `View this harness's ${subject}` : `View ${subject} across all harnesses`;
-  const selfHealed = () => {
-    const s = props.stats;
-    if (!s) return 0;
-    return s.autofix_saves.value + (s.fallback_saves?.value ?? 0);
-  };
-  const selfHealedPrev = () => {
-    const s = props.stats;
-    if (!s) return 0;
-    return s.autofix_saves.previous + (s.fallback_saves?.previous ?? 0);
-  };
-  const selfHealedPct = () => {
+  const recovered = () => props.stats?.fallback_saves?.value ?? 0;
+  const recoveredPrev = () => props.stats?.fallback_saves?.previous ?? 0;
+  const recoveredPct = () => {
     const s = props.stats;
     if (!s || !s.total_requests || s.total_requests.value === 0) return 0;
-    return selfHealed() / s.total_requests.value;
+    return recovered() / s.total_requests.value;
   };
-  const selfHealedPctPrev = () => {
+  const recoveredPctPrev = () => {
     const s = props.stats;
     if (!s || !s.total_requests || s.total_requests.previous === 0) return 0;
-    return selfHealedPrev() / s.total_requests.previous;
+    return recoveredPrev() / s.total_requests.previous;
   };
 
   return (
     <Show when={props.stats}>
       {(s) => (
-        <div class="overview-stats overview-stats--5">
+        <div class="overview-stats">
           <div class="overview-stat-card">
             <span class="overview-stat-card__label">
               Success rate
@@ -119,7 +111,7 @@ const AutofixKpiCards: Component<AutofixKpiCardsProps> = (props) => {
           <div
             class="overview-stat-card"
             {...linkProps(
-              requestsLink('&status=ok&trigger=autofix,fallback'),
+              requestsLink('&status=ok&trigger=fallback'),
               scopeTitle('recovered requests'),
             )}
           >
@@ -128,22 +120,8 @@ const AutofixKpiCards: Component<AutofixKpiCardsProps> = (props) => {
               <InfoTooltip text={RECOVERED_REQUESTS_TOOLTIP} />
             </span>
             <div class="overview-stat-card__value-row">
-              <span class="overview-stat-card__value">{fmtPct(selfHealedPct())}</span>
-              {trendBadge(selfHealedPct(), selfHealedPctPrev())}
-              <Show when={requestsLink('')}>{viewMore()}</Show>
-            </div>
-          </div>
-          <div
-            class="overview-stat-card overview-stat-card--autofix"
-            {...linkProps(
-              requestsLink('&status=ok&trigger=autofix'),
-              scopeTitle('requests recovered by Autofix'),
-            )}
-          >
-            <span class="overview-stat-card__label">Recovered by Autofix</span>
-            <div class="overview-stat-card__value-row">
-              <span class="overview-stat-card__value">{formatNumber(s().autofix_saves.value)}</span>
-              {trendBadge(s().autofix_saves.value, s().autofix_saves.previous)}
+              <span class="overview-stat-card__value">{fmtPct(recoveredPct())}</span>
+              {trendBadge(recoveredPct(), recoveredPctPrev())}
               <Show when={requestsLink('')}>{viewMore()}</Show>
             </div>
           </div>
@@ -156,10 +134,8 @@ const AutofixKpiCards: Component<AutofixKpiCardsProps> = (props) => {
           >
             <span class="overview-stat-card__label">Recovered by Fallback</span>
             <div class="overview-stat-card__value-row">
-              <span class="overview-stat-card__value">
-                {formatNumber(s().fallback_saves?.value ?? 0)}
-              </span>
-              {trendBadge(s().fallback_saves?.value ?? 0, s().fallback_saves?.previous ?? 0)}
+              <span class="overview-stat-card__value">{formatNumber(recovered())}</span>
+              {trendBadge(recovered(), recoveredPrev())}
               <Show when={requestsLink('')}>{viewMore()}</Show>
             </div>
           </div>
@@ -182,4 +158,4 @@ const AutofixKpiCards: Component<AutofixKpiCardsProps> = (props) => {
   );
 };
 
-export default AutofixKpiCards;
+export default ReliabilityKpiCards;
diff --git a/packages/frontend/src/components/RequestDrawer.tsx b/packages/frontend/src/components/RequestDrawer.tsx
index 4e8d6722..fe75e8d8 100644
--- a/packages/frontend/src/components/RequestDrawer.tsx
+++ b/packages/frontend/src/components/RequestDrawer.tsx
@@ -8,20 +8,11 @@ import {
   onCleanup,
   type Component,
 } from 'solid-js';
-import {
-  getMessageDetails,
-  type AttemptRecording,
-  type AutofixDecision,
-} from '../services/api/messages.js';
-import {
-  AUTOFIX_STATUS_LABELS,
-  isFailedStatus,
-  isSuccessStatus,
-  type AutofixStatus,
-} from 'manifest-shared';
+import { getMessageDetails, type AttemptRecording } from '../services/api/messages.js';
+import { isFailedStatus, isSuccessStatus } from 'manifest-shared';
 import { formatParamValue } from './MessageDetailsSections.jsx';
 import { providerIcon } from './ProviderIcon.jsx';
-import { AutofixIcon, FallbackIcon } from './message-table-cells.jsx';
+import { FallbackIcon } from './message-table-cells.jsx';
 import { authBadgeFor } from './AuthBadge.js';
 import RequestMessages, { type RecordingView } from './RequestMessages.jsx';
 import '../styles/request-drawer.css';
@@ -29,7 +20,6 @@ import '../styles/request-drawer.css';
 export interface RequestDrawerProps {
   messageId: string | null;
   onClose: () => void;
-  onOpenMessage?: (id: string) => void;
 }
 
 type AttemptTab = 'details' | 'messages' | 'tools' | 'raw' | 'headers' | 'params';
@@ -37,7 +27,7 @@ type AttemptTab = 'details' | 'messages' | 'tools' | 'raw' | 'headers' | 'params
 interface Attempt {
   id: string;
   index: number;
-  type: 'initial' | 'fallback' | 'autofix';
+  type: 'initial' | 'fallback';
   status: string;
   provider: string;
   model: string;
@@ -61,11 +51,6 @@ interface Attempt {
   fallback_index?: number;
   request_headers?: Record<string, string>;
   request_params?: Record<string, unknown>;
-  autofix_applied?: boolean;
-  autofix_operations?: any;
-  autofix_decision?: AutofixDecision;
-  autofix_role?: string;
-  autofix_sibling?: any;
   recording?: AttemptRecording | null;
 }
 
@@ -83,7 +68,6 @@ function statusLabel(status: string): string {
   if (status === 'pending') return 'Pending';
   if (status === 'cancelled') return 'Cancelled';
   if (isSuccessStatus(status)) return 'Success';
-  if (status === 'auto_fixed') return 'Autofixed';
   if (status === 'rate_limited') return 'Rate limited';
   return 'Failed';
 }
@@ -121,12 +105,10 @@ function attemptErrorMessage(
   return 'Request failed without an error message.';
 }
 
-function inferType(att: any, index: number, msg: any): Attempt['type'] {
-  if (att.autofix_role === 'retry') return 'autofix';
+function inferType(att: any, index: number): Attempt['type'] {
   if (att.fallback_from_model || att.fallback_index) return 'fallback';
-  // For backend summary attempts (no autofix_role/fallback fields),
-  // use position: first = initial, rest = fallback (unless autofix on the request)
-  if (index > 0 && msg.autofix_applied) return 'autofix';
+  // For backend summary attempts (no fallback fields), use position:
+  // first = initial, rest = fallback.
   if (index > 0) return 'fallback';
   return 'initial';
 }
@@ -137,7 +119,7 @@ function buildAttempts(msg: any): Attempt[] {
     return msg.attempts.map((att: any, i: number) => ({
       id: att.id,
       index: i + 1,
-      type: inferType(att, i, msg),
+      type: inferType(att, i),
       status: att.status,
       provider: att.provider ?? msg.provider,
       model: att.model ?? msg.model ?? msg.model_id,
@@ -161,19 +143,12 @@ function buildAttempts(msg: any): Attempt[] {
       output_tokens: att.output_tokens ?? undefined,
       request_headers: att.request_headers ?? undefined,
       request_params: att.request_params ?? undefined,
-      autofix_applied: att.autofix_applied ?? false,
-      autofix_operations: att.autofix_operations ?? undefined,
-      autofix_decision: att.autofix_decision ?? msg.autofix_decision,
-      autofix_role: att.autofix_role ?? undefined,
-      autofix_sibling: att.autofix_sibling ?? msg.autofix_sibling,
       recording: att.recording ?? null,
     }));
   }
 
   // Fallback: single attempt from the message row itself
-  let type: Attempt['type'] = 'initial';
-  if (msg.fallback_from_model) type = 'fallback';
-  if (msg.autofix_role === 'retry') type = 'autofix';
+  const type: Attempt['type'] = msg.fallback_from_model ? 'fallback' : 'initial';
 
   return [
     {
@@ -203,11 +178,6 @@ function buildAttempts(msg: any): Attempt[] {
       output_tokens: msg.output_tokens,
       request_headers: msg.request_headers,
       request_params: msg.request_params,
-      autofix_applied: msg.autofix_applied,
-      autofix_operations: msg.autofix_operations,
-      autofix_decision: msg.autofix_decision,
-      autofix_role: msg.autofix_role,
-      autofix_sibling: msg.autofix_sibling,
       recording: null,
     },
   ];
@@ -288,12 +258,7 @@ const RequestDrawer: Component<RequestDrawerProps> = (props) => {
     onCleanup(() => document.removeEventListener('keydown', handler));
   }
 
-  const requestStatus = () => {
-    const msg = m();
-    if (!msg) return 'error';
-    if (msg.autofix_role === 'retry' && isSuccessStatus(msg.status)) return 'success';
-    return msg.status;
-  };
+  const requestStatus = () => m()?.status ?? 'error';
 
   const headerProvider = () => currentAttempt()?.provider ?? m()?.provider;
   const headerAuthType = () => currentAttempt()?.auth_type ?? m()?.auth_type;
@@ -329,16 +294,6 @@ const RequestDrawer: Component<RequestDrawerProps> = (props) => {
                   <span class={`drawer-status ${requestStatusClass(requestStatus())}`}>
                     {statusLabel(requestStatus())}
                   </span>
-                  <Show when={msg().autofix_status as AutofixStatus | null}>
-                    {(autofixStatus) => (
-                      <>
-                        <span class="drawer__meta-sep">&middot;</span>
-                        <span class="drawer__meta-text">
-                          Autofix: {AUTOFIX_STATUS_LABELS[autofixStatus()]}
-                        </span>
-                      </>
-                    )}
-                  </Show>
                   <Show when={headerProvider()}>
                     <span class="drawer__meta-sep">&middot;</span>
                     <span
@@ -378,8 +333,6 @@ const RequestDrawer: Component<RequestDrawerProps> = (props) => {
                           <span class="attempt-item__icon">
                             {att.type === 'fallback' ? (
                               <FallbackIcon />
-                            ) : att.type === 'autofix' ? (
-                              <AutofixIcon />
                             ) : (
                               <svg
                                 xmlns="http://www.w3.org/2000/svg"
@@ -568,53 +521,6 @@ const RequestDrawer: Component<RequestDrawerProps> = (props) => {
                                   Cumulative by design: the error card is never
                                   replaced by a context card. ── */}
 
-                                {/* Origin: this attempt IS the healed Autofix retry */}
-                                <Show when={att().autofix_role === 'retry'}>
-                                  <div class="drawer-context-card drawer-context-card--autofix">
-                                    <div style="margin-bottom: 8px;">
-                                      <span class="trigger-badge trigger-badge--autofix">
-                                        <AutofixIcon />
-                                        autofix
-                                      </span>
-                                    </div>
-                                    <div style="font-size: var(--font-size-sm); color: hsl(var(--foreground)); margin-bottom: 8px;">
-                                      {isSuccessStatus(att().status)
-                                        ? 'This Autofix retry recovered the request.'
-                                        : 'Manifest applied a fix and retried, but this attempt failed.'}
-                                    </div>
-                                    <Show when={att().autofix_decision?.explanation?.summary}>
-                                      <div style="font-size: var(--font-size-xs); color: hsl(var(--muted-foreground)); margin-bottom: 8px;">
-                                        {att().autofix_decision!.explanation!.summary}
-                                      </div>
-                                    </Show>
-                                    <Show when={att().autofix_operations}>
-                                      <table
-                                        class="error-autofix-row__meta-table"
-                                        style="--meta-table-border: hsl(222 47% 50% / 0.3); margin-top: 0;"
-                                      >
-                                        <tbody>
-                                          <For each={att().autofix_operations as any[]}>
-                                            {(op: any) => (
-                                              <tr>
-                                                <td class="error-autofix-row__meta-label">Fix</td>
-                                                <td>
-                                                  {op.type}
-                                                  {(op.args?.from ?? op.from)
-                                                    ? `: ${op.args?.from ?? op.from}`
-                                                    : ''}
-                                                  {(op.args?.to ?? op.to)
-                                                    ? ` → ${op.args?.to ?? op.to}`
-                                                    : ''}
-                                                </td>
-                                              </tr>
-                                            )}
-                                          </For>
-                                        </tbody>
-                                      </table>
-                                    </Show>
-                                  </div>
-                                </Show>
-
                                 {/* Origin: this attempt IS the fallback recovery */}
                                 <Show when={att().fallback_from_model}>
                                   <div class="drawer-context-card drawer-context-card--fallback">
@@ -651,25 +557,25 @@ const RequestDrawer: Component<RequestDrawerProps> = (props) => {
                                       }
                                     >
                                       <table
-                                        class="error-autofix-row__meta-table"
+                                        class="error-recovery-row__meta-table"
                                         style="--meta-table-border: hsl(var(--destructive) / 0.25);"
                                       >
                                         <tbody>
                                           <Show when={att().error_origin}>
                                             <tr>
-                                              <td class="error-autofix-row__meta-label">Origin</td>
+                                              <td class="error-recovery-row__meta-label">Origin</td>
                                               <td>{att().error_origin}</td>
                                             </tr>
                                           </Show>
                                           <Show when={att().error_class}>
                                             <tr>
-                                              <td class="error-autofix-row__meta-label">Type</td>
+                                              <td class="error-recovery-row__meta-label">Type</td>
                                               <td>{att().error_class}</td>
                                             </tr>
                                           </Show>
                                           <Show when={att().error_http_status}>
                                             <tr>
-                                              <td class="error-autofix-row__meta-label">
+                                              <td class="error-recovery-row__meta-label">
                                                 HTTP status
                                               </td>
                                               <td>{att().error_http_status}</td>
@@ -681,64 +587,11 @@ const RequestDrawer: Component<RequestDrawerProps> = (props) => {
                                   </div>
                                 </Show>
 
-                                {/* Consequence: this failed attempt was autofixed
-                                  and retried right after */}
-                                <Show
-                                  when={att().autofix_applied && att().autofix_role !== 'retry'}
-                                >
-                                  <div class="drawer-context-card drawer-context-card--autofix">
-                                    <div style="margin-bottom: 8px;">
-                                      <span class="trigger-badge trigger-badge--autofix">
-                                        <AutofixIcon />
-                                        autofix
-                                      </span>
-                                    </div>
-                                    <div style="font-size: var(--font-size-sm); color: hsl(var(--foreground)); margin-bottom: 8px;">
-                                      {`This attempt failed and was autofixed.${
-                                        attempts().length > att().index
-                                          ? ` Retried as attempt ${att().index + 1}.`
-                                          : ''
-                                      }`}
-                                    </div>
-                                    <Show when={att().autofix_decision?.explanation?.summary}>
-                                      <div style="font-size: var(--font-size-xs); color: hsl(var(--muted-foreground)); margin-bottom: 8px;">
-                                        {att().autofix_decision!.explanation!.summary}
-                                      </div>
-                                    </Show>
-                                    <Show when={att().autofix_operations}>
-                                      <table
-                                        class="error-autofix-row__meta-table"
-                                        style="--meta-table-border: hsl(222 47% 50% / 0.3); margin-top: 0;"
-                                      >
-                                        <tbody>
-                                          <For each={att().autofix_operations as any[]}>
-                                            {(op: any) => (
-                                              <tr>
-                                                <td class="error-autofix-row__meta-label">Fix</td>
-                                                <td>
-                                                  {op.type}
-                                                  {(op.args?.from ?? op.from)
-                                                    ? `: ${op.args?.from ?? op.from}`
-                                                    : ''}
-                                                  {(op.args?.to ?? op.to)
-                                                    ? ` → ${op.args?.to ?? op.to}`
-                                                    : ''}
-                                                </td>
-                                              </tr>
-                                            )}
-                                          </For>
-                                        </tbody>
-                                      </table>
-                                    </Show>
-                                  </div>
-                                </Show>
-
                                 {/* Consequence: this failed attempt was recovered by
                                   a LATER fallback attempt */}
                                 <Show
                                   when={
                                     isFailedStatus(att().status) &&
-                                    !(att().autofix_applied && att().autofix_role !== 'retry') &&
                                     attempts().length > att().index &&
                                     attempts()[att().index]?.fallback_from_model
                                   }
diff --git a/packages/frontend/src/components/UnifiedChartCard.tsx b/packages/frontend/src/components/UnifiedChartCard.tsx
index df64d229..38863ff5 100644
--- a/packages/frontend/src/components/UnifiedChartCard.tsx
+++ b/packages/frontend/src/components/UnifiedChartCard.tsx
@@ -1,12 +1,12 @@
 import { Show, Suspense, lazy, type Component, type JSX } from 'solid-js';
 import InfoTooltip from './InfoTooltip.jsx';
 import { formatNumber, formatCost } from '../services/formatters.js';
-import { RECOVERED_REQUESTS_TOOLTIP, type AutofixTimeseries } from '../services/api/analytics.js';
+import { RECOVERED_REQUESTS_TOOLTIP, type StatusTimeseries } from '../services/api/analytics.js';
 
 const MultiAgentTokenChart = lazy(() => import('./MultiAgentTokenChart.jsx'));
 const ReliabilityChart = lazy(() => import('./ReliabilityChart.jsx'));
 
-export type ChartTab = 'requests' | 'selfheal' | 'cost' | 'tokens';
+export type ChartTab = 'requests' | 'recovered' | 'cost' | 'tokens';
 
 interface AgentTimeseries {
   agents: string[];
@@ -25,14 +25,14 @@ export interface UnifiedChartCardProps {
   requestsTrendPct: number;
   agentRequestTimeseries?: AgentTimeseries;
   /** When set, the Requests tab shows this (disposition) instead of agentRequestTimeseries */
-  requestStatusTimeseries?: AutofixTimeseries;
+  requestStatusTimeseries?: StatusTimeseries;
   /** Series mode for the status chart (colors/labels): disposition by default. */
   requestStatusSeriesMode?: string;
-  // Self-healed requests tab (the recovered subset — autofix + fallback).
+  // Recovered requests tab (the subset recovered by fallback).
   // The tab renders only when the timeseries is provided.
-  selfHealedValue?: number;
-  selfHealedTrendPct?: number;
-  selfHealedTimeseries?: AutofixTimeseries;
+  recoveredValue?: number;
+  recoveredTrendPct?: number;
+  recoveredTimeseries?: StatusTimeseries;
   // Cost tab
   costValue?: number;
   costTrendPct?: number;
@@ -75,7 +75,7 @@ const UnifiedChartCard: Component<UnifiedChartCardProps> = (props) => {
     switch (props.activeTab) {
       case 'requests':
         return props.requestsLabel ?? 'Requests';
-      case 'selfheal':
+      case 'recovered':
         return 'Recovered requests';
       case 'cost':
         return 'Cost';
@@ -105,20 +105,20 @@ const UnifiedChartCard: Component<UnifiedChartCardProps> = (props) => {
             {trendBadge(props.requestsTrendPct)}
           </div>
         </button>
-        <Show when={props.selfHealedTimeseries}>
+        <Show when={props.recoveredTimeseries}>
           <button
             type="button"
             class="chart-card__stat chart-card__stat--clickable"
-            classList={{ 'chart-card__stat--active': props.activeTab === 'selfheal' }}
-            onClick={() => props.onTabChange('selfheal')}
+            classList={{ 'chart-card__stat--active': props.activeTab === 'recovered' }}
+            onClick={() => props.onTabChange('recovered')}
           >
             <span class="chart-card__label">
               Recovered requests
               <InfoTooltip text={RECOVERED_REQUESTS_TOOLTIP} />
             </span>
             <div class="chart-card__value-row">
-              <span class="chart-card__value">{formatNumber(props.selfHealedValue ?? 0)}</span>
-              {trendBadge(props.selfHealedTrendPct ?? 0)}
+              <span class="chart-card__value">{formatNumber(props.recoveredValue ?? 0)}</span>
+              {trendBadge(props.recoveredTrendPct ?? 0)}
             </div>
           </button>
         </Show>
@@ -159,8 +159,8 @@ const UnifiedChartCard: Component<UnifiedChartCardProps> = (props) => {
       <div class="chart-card__subtitle">
         <span class="chart-card__subtitle-title">{tabTitle()}</span>
         {/* The grouping filters (by status/provider/harness) only apply to the
-            other tabs — self-healed is already a fixed autofix/fallback split. */}
-        <Show when={props.seriesFilters && props.activeTab !== 'selfheal'}>
+            other tabs — recovered is already a fixed fallback subset. */}
+        <Show when={props.seriesFilters && props.activeTab !== 'recovered'}>
           <div class="chart-card__filters">{props.seriesFilters}</div>
         </Show>
       </div>
@@ -198,13 +198,13 @@ const UnifiedChartCard: Component<UnifiedChartCardProps> = (props) => {
               </Show>
             </Show>
           </Show>
-          <Show when={props.activeTab === 'selfheal'}>
+          <Show when={props.activeTab === 'recovered'}>
             <Show
-              when={props.selfHealedTimeseries && props.selfHealedTimeseries.buckets.length > 0}
+              when={props.recoveredTimeseries && props.recoveredTimeseries.buckets.length > 0}
               fallback={EMPTY('No recovered requests in this time range')}
             >
               <ReliabilityChart
-                timeseries={props.selfHealedTimeseries!}
+                timeseries={props.recoveredTimeseries!}
                 range={props.range}
                 seriesMode="disposition"
               />
diff --git a/packages/frontend/src/components/VersionIndicator.tsx b/packages/frontend/src/components/VersionIndicator.tsx
index e13840c0..8ad7390d 100644
--- a/packages/frontend/src/components/VersionIndicator.tsx
+++ b/packages/frontend/src/components/VersionIndicator.tsx
@@ -1,83 +1,17 @@
-import { createResource, createSignal, Show } from 'solid-js';
-import { getVersionInfo, type VersionInfo } from '../services/api/version.js';
+import { Show } from 'solid-js';
 
 /**
- * localStorage key holding the `latest` version the user dismissed. The
- * notice stays hidden while the latest release is that version and comes
- * back on its own once an even newer one is published.
- */
-export const UPDATE_DISMISSED_STORAGE_KEY = 'manifest.update-dismissed';
-
-function readDismissed(): string | null {
-  try {
-    return localStorage.getItem(UPDATE_DISMISSED_STORAGE_KEY);
-  } catch {
-    return null;
-  }
-}
-
-function writeDismissed(version: string): void {
-  try {
-    localStorage.setItem(UPDATE_DISMISSED_STORAGE_KEY, version);
-  } catch {
-    // Private mode or blocked storage: the in-memory signal still hides it
-    // for this page load.
-  }
-}
-
-/**
- * Bottom-corner `vX.Y.Z` badge. When the backend
- * reports a newer release, the badge grows a link to the changelog for that
- * release, with a dismiss button. A failed check degrades to the plain badge.
+ * Bottom-corner `vX.Y.Z` badge. The version is a build-time constant injected
+ * by `vite.config.ts` from the canonical package.json, so the badge makes no
+ * request at all: Thinker never checks for updates on its own.
  */
 const VersionIndicator = () => {
   const version = __MANIFEST_VERSION__;
 
-  const [info] = createResource<VersionInfo | null, boolean>(
-    () => Boolean(version),
-    () => getVersionInfo().catch(() => null),
-  );
-  const [dismissed, setDismissed] = createSignal<string | null>(readDismissed());
-
-  const update = (): (VersionInfo & { latest: string }) | null => {
-    const v = info();
-    if (!v?.update_available || !v.latest) return null;
-    return dismissed() === v.latest ? null : { ...v, latest: v.latest };
-  };
-  const dismiss = (latest: string) => {
-    setDismissed(latest);
-    writeDismissed(latest);
-  };
-
   return (
     <Show when={version}>
-      <div
-        class="version-indicator"
-        classList={{ 'version-indicator--update': update() !== null }}
-        aria-label={
-          update()
-            ? `Version ${version}, update to ${update()?.latest} available`
-            : `Version ${version}`
-        }
-      >
+      <div class="version-indicator" aria-label={`Version ${version}`}>
         <span>v{version}</span>
-        <Show when={update()}>
-          {(u) => (
-            <span class="version-indicator__update">
-              <a href={u().release_url ?? undefined} target="_blank" rel="noopener noreferrer">
-                v{u().latest} available
-              </a>
-              <button
-                type="button"
-                class="version-indicator__dismiss"
-                aria-label="Dismiss update notice"
-                onClick={() => dismiss(u().latest)}
-              >
-                ×
-              </button>
-            </span>
-          )}
-        </Show>
       </div>
     </Show>
   );
diff --git a/packages/frontend/src/components/WingmanDevTools.tsx b/packages/frontend/src/components/WingmanDevTools.tsx
deleted file mode 100644
index 5c1902d8..00000000
--- a/packages/frontend/src/components/WingmanDevTools.tsx
+++ /dev/null
@@ -1,214 +0,0 @@
-import { createEffect, createSignal, onCleanup, Show, type Component } from 'solid-js';
-
-const STORAGE_OPEN = 'manifest:wingman:open';
-const STORAGE_HEIGHT = 'manifest:wingman:height';
-const MIN_HEIGHT_VH = 20;
-const MAX_HEIGHT_VH = 90;
-const DEFAULT_HEIGHT_VH = 50;
-
-function readStoredOpen(): boolean {
-  try {
-    return localStorage.getItem(STORAGE_OPEN) === '1';
-  } catch {
-    return false;
-  }
-}
-
-function readStoredHeight(): number {
-  try {
-    const raw = localStorage.getItem(STORAGE_HEIGHT);
-    if (!raw) return DEFAULT_HEIGHT_VH;
-    const n = Number(raw);
-    if (!Number.isFinite(n)) return DEFAULT_HEIGHT_VH;
-    return Math.min(MAX_HEIGHT_VH, Math.max(MIN_HEIGHT_VH, n));
-  } catch {
-    return DEFAULT_HEIGHT_VH;
-  }
-}
-
-function writeStored(key: string, value: string): void {
-  try {
-    localStorage.setItem(key, value);
-  } catch {
-    /* ignore */
-  }
-}
-
-const WingmanDevTools: Component = () => {
-  const [open, setOpen] = createSignal(readStoredOpen());
-  const [heightVh, setHeightVh] = createSignal(readStoredHeight());
-  const [resizing, setResizing] = createSignal(false);
-
-  // `__WINGMAN_URL__` is set by vite.config.ts to a loopback origin in dev: the
-  // Wingman dev proxy republishes the hosted SPA there so the iframe sits in
-  // the same address space as the gateway it calls. Framing the hosted HTTPS
-  // origin directly makes every request a local-network request, which Chrome
-  // blocks (see wingman-dev-proxy.ts). The literal is only a fallback for a
-  // build that didn't define it.
-  const HOSTED_WINGMAN_URL = 'https://wingman.manifest.build';
-  const deriveWingmanBase = (): string => __WINGMAN_URL__ || HOSTED_WINGMAN_URL;
-
-  const iframeSrc = () =>
-    `${deriveWingmanBase()}?baseUrl=${encodeURIComponent(window.location.origin)}`;
-
-  const setOpenPersist = (next: boolean) => {
-    setOpen(next);
-    writeStored(STORAGE_OPEN, next ? '1' : '0');
-  };
-
-  const setHeightPersist = (next: number) => {
-    const clamped = Math.min(MAX_HEIGHT_VH, Math.max(MIN_HEIGHT_VH, next));
-    setHeightVh(clamped);
-    writeStored(STORAGE_HEIGHT, String(clamped));
-  };
-
-  const onResizePointerDown = (e: PointerEvent) => {
-    e.preventDefault();
-    setResizing(true);
-    const move = (ev: PointerEvent) => {
-      const fromBottom = window.innerHeight - ev.clientY;
-      const vh = (fromBottom / window.innerHeight) * 100;
-      setHeightPersist(vh);
-    };
-    const up = () => {
-      setResizing(false);
-      document.removeEventListener('pointermove', move);
-      document.removeEventListener('pointerup', up);
-    };
-    document.addEventListener('pointermove', move);
-    document.addEventListener('pointerup', up);
-  };
-
-  // Global Escape closes the drawer; Cmd/Ctrl+Shift+W toggles it.
-  createEffect(() => {
-    const handler = (e: KeyboardEvent) => {
-      if (e.key === 'Escape' && open()) {
-        setOpenPersist(false);
-        return;
-      }
-      if ((e.metaKey || e.ctrlKey) && e.shiftKey && (e.key === 'W' || e.key === 'w')) {
-        e.preventDefault();
-        setOpenPersist(!open());
-      }
-    };
-    document.addEventListener('keydown', handler);
-    onCleanup(() => document.removeEventListener('keydown', handler));
-  });
-
-  return (
-    <>
-      <Show when={!open()}>
-        <button
-          type="button"
-          class="wingman-fab"
-          onClick={() => setOpenPersist(true)}
-          title="Open Wingman, gateway tester (⌘/Ctrl + Shift + W)"
-          aria-label="Open Wingman gateway tester"
-        >
-          <svg
-            width="20"
-            height="20"
-            viewBox="0 0 24 24"
-            fill="none"
-            stroke="currentColor"
-            stroke-width="1.8"
-            stroke-linecap="round"
-            stroke-linejoin="round"
-            aria-hidden="true"
-          >
-            <path d="M20.24 12.24a6 6 0 0 0-8.49-8.49L5 10.5V19h8.5z" />
-            <line x1="16" y1="8" x2="2" y2="22" />
-            <line x1="17.5" y1="15" x2="9" y2="15" />
-          </svg>
-          <span class="wingman-fab__label">Wingman</span>
-        </button>
-      </Show>
-
-      <Show when={open()}>
-        <aside
-          class="wingman-drawer"
-          classList={{ 'wingman-drawer--resizing': resizing() }}
-          style={{ height: `${heightVh()}vh` }}
-          aria-label="Wingman gateway tester"
-        >
-          <div
-            class="wingman-drawer__resizer"
-            onPointerDown={onResizePointerDown}
-            role="separator"
-            aria-orientation="horizontal"
-            aria-label="Resize Wingman drawer"
-            title="Drag to resize"
-          />
-          <header class="wingman-drawer__head">
-            <div class="wingman-drawer__title">
-              <strong>Wingman</strong>
-            </div>
-            <div class="wingman-drawer__actions">
-              <a
-                href={iframeSrc()}
-                target="_blank"
-                rel="noopener noreferrer"
-                class="wingman-drawer__icon-btn"
-                title="Open Wingman in a new tab"
-                aria-label="Open Wingman in a new tab"
-              >
-                <svg
-                  width="14"
-                  height="14"
-                  viewBox="0 0 24 24"
-                  fill="none"
-                  stroke="currentColor"
-                  stroke-width="2"
-                  stroke-linecap="round"
-                  stroke-linejoin="round"
-                  aria-hidden="true"
-                >
-                  <path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6" />
-                  <polyline points="15 3 21 3 21 9" />
-                  <line x1="10" y1="14" x2="21" y2="3" />
-                </svg>
-              </a>
-              <button
-                type="button"
-                class="wingman-drawer__icon-btn"
-                onClick={() => setOpenPersist(false)}
-                title="Close (Esc)"
-                aria-label="Close Wingman drawer"
-              >
-                <svg
-                  width="14"
-                  height="14"
-                  viewBox="0 0 24 24"
-                  fill="none"
-                  stroke="currentColor"
-                  stroke-width="2"
-                  stroke-linecap="round"
-                  stroke-linejoin="round"
-                  aria-hidden="true"
-                >
-                  <line x1="18" y1="6" x2="6" y2="18" />
-                  <line x1="6" y1="6" x2="18" y2="18" />
-                </svg>
-              </button>
-            </div>
-          </header>
-          {/* `local-network-access` is delegated as a fallback. It is not
-              needed when the drawer points at the loopback proxy (same
-              address space, no permission involved), but if someone points
-              VITE_WINGMAN_URL back at an https origin it's the difference
-              between Chrome offering the permission prompt and denying it
-              outright by permissions policy, with no prompt possible. */}
-          <iframe
-            src={iframeSrc()}
-            class="wingman-drawer__frame"
-            title="Wingman gateway tester"
-            sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox allow-clipboard-write"
-            allow="clipboard-read; clipboard-write; local-network-access"
-          />
-        </aside>
-      </Show>
-    </>
-  );
-};
-
-export default WingmanDevTools;
diff --git a/packages/frontend/src/components/message-table-cells.tsx b/packages/frontend/src/components/message-table-cells.tsx
index f8ef4b70..5dd66e13 100644
--- a/packages/frontend/src/components/message-table-cells.tsx
+++ b/packages/frontend/src/components/message-table-cells.tsx
@@ -44,23 +44,6 @@ export function HeartbeatIcon(): JSX.Element {
   );
 }
 
-export function AutofixIcon(): JSX.Element {
-  return (
-    <span class="autofix-icon">
-      <svg
-        xmlns="http://www.w3.org/2000/svg"
-        width="12"
-        height="12"
-        fill="currentColor"
-        viewBox="0 0 24 24"
-        aria-hidden="true"
-      >
-        <path d="m21.45 11.11-3-1.5-2.68-1.34-.03-.03-1.34-2.68-1.5-3c-.34-.68-1.45-.68-1.79 0l-1.5 3-1.34 2.68-.03.03-2.68 1.34-3 1.5c-.34.17-.55.52-.55.89s.21.72.55.89l3 1.5 2.68 1.34.03.03 1.34 2.68 1.5 3c.17.34.52.55.89.55s.72-.21.89-.55l1.5-3 1.34-2.68.03-.03 2.68-1.34 3-1.5c.34-.17.55-.52.55-.89s-.21-.72-.55-.89Z" />
-      </svg>
-    </span>
-  );
-}
-
 export function FallbackIcon(): JSX.Element {
   return (
     <span class="fallback-icon">
@@ -90,7 +73,7 @@ const HEADER_LABELS: Record<MessageColumnKey, string> = {
   duration: 'Latency',
   status: 'Status',
   attempts: 'Attempts',
-  selfheal: 'Recovery attempts',
+  recovery: 'Recovery attempts',
   agent: 'Harness',
 };
 
@@ -341,35 +324,20 @@ export function AttemptsCell(item: MessageRow): JSX.Element {
   return <td style={MONO_XS}>{item.attempt_count ?? 1}</td>;
 }
 
-export function SelfHealCell(item: MessageRow): JSX.Element {
-  const hasAutofix = !!item.autofix_applied;
-  const hasFallback = !!item.fallback_from_model;
-
-  if (!hasAutofix && !hasFallback) return <td style={MONO_XS}>{'\u2014'}</td>;
+export function RecoveryCell(item: MessageRow): JSX.Element {
+  if (!item.fallback_from_model) return <td style={MONO_XS}>{'\u2014'}</td>;
 
   return (
     <td>
       <span style="display: inline-flex; align-items: center; gap: 4px;">
-        {hasAutofix && (
-          <span
-            class="trigger-badge trigger-badge--autofix"
-            title="Autofix"
-            style="padding: 1px 3px;"
-          >
-            <AutofixIcon />
-            autofix
-          </span>
-        )}
-        {hasFallback && (
-          <span
-            class="trigger-badge trigger-badge--fallback"
-            title="Fallback"
-            style="padding: 1px 3px;"
-          >
-            <FallbackIcon />
-            fallback
-          </span>
-        )}
+        <span
+          class="trigger-badge trigger-badge--fallback"
+          title="Fallback"
+          style="padding: 1px 3px;"
+        >
+          <FallbackIcon />
+          fallback
+        </span>
       </span>
     </td>
   );
@@ -488,8 +456,8 @@ export function renderCell(
       return StatusCell(item, ctx.agentName);
     case 'attempts':
       return AttemptsCell(item);
-    case 'selfheal':
-      return SelfHealCell(item);
+    case 'recovery':
+      return RecoveryCell(item);
     case 'agent':
       return AgentCell(item, ctx.agentPlatformLookup);
   }
diff --git a/packages/frontend/src/components/message-table-types.ts b/packages/frontend/src/components/message-table-types.ts
index 83243987..a8155d50 100644
--- a/packages/frontend/src/components/message-table-types.ts
+++ b/packages/frontend/src/components/message-table-types.ts
@@ -32,8 +32,6 @@ export interface MessageRow {
   cache_creation_tokens?: number | null;
   duration_ms?: number | null;
   feedback_rating?: string | null;
-  autofix_applied?: boolean;
-  autofix_role?: string | null;
   attempt_count?: number;
 }
 
@@ -54,7 +52,7 @@ export type MessageColumnKey =
   | 'duration'
   | 'status'
   | 'attempts'
-  | 'selfheal'
+  | 'recovery'
   | 'agent';
 
 // Reading order: identity first (status, when, who, what), THEN the
@@ -65,7 +63,7 @@ export const COMPACT_COLUMNS: MessageColumnKey[] = [
   'date',
   'model',
   'attempts',
-  'selfheal',
+  'recovery',
   'message',
   'cost',
   'totalTokens',
@@ -78,7 +76,7 @@ export const DETAILED_COLUMNS: MessageColumnKey[] = [
   'date',
   'model',
   'attempts',
-  'selfheal',
+  'recovery',
   'message',
   'cost',
   'totalTokens',
diff --git a/packages/frontend/src/index.tsx b/packages/frontend/src/index.tsx
index 585b6e67..2a7e9aca 100644
--- a/packages/frontend/src/index.tsx
+++ b/packages/frontend/src/index.tsx
@@ -37,7 +37,6 @@ const Login = lazyReload(() => import('./pages/Login.jsx'));
 const Register = lazyReload(() => import('./pages/Register.jsx'));
 const ResetPassword = lazyReload(() => import('./pages/ResetPassword.jsx'));
 const Setup = lazyReload(() => import('./pages/Setup.jsx'));
-const Discovery = lazyReload(() => import('./pages/Discovery.jsx'));
 const Welcome = lazyReload(() => import('./pages/Welcome.jsx'));
 const ModelPrices = lazyReload(() => import('./pages/ModelPrices.jsx'));
 const Help = lazyReload(() => import('./pages/Help.jsx'));
@@ -55,11 +54,6 @@ const GuestLayout: ParentComponent = (props) => (
   </GuestGuard>
 );
 
-// Post-signup discovery step: authenticated, rendered as its own centered
-// two-column card outside the App shell. The page itself redirects anyone who
-// should not see it (already completed or skipped).
-const DiscoveryLayout: ParentComponent = (props) => <AuthGuard>{props.children}</AuthGuard>;
-
 // Full-page onboarding: authenticated but outside the App dashboard shell.
 // The embedded Playground step calls useRightSidebar, so the provider App
 // normally supplies must be recreated here.
@@ -159,9 +153,6 @@ render(
         <Route path="/setup" component={AuthLayout}>
           <Route path="/" component={Setup} />
         </Route>
-        <Route path="/discovery" component={DiscoveryLayout}>
-          <Route path="/" component={Discovery} />
-        </Route>
         <Route path="/welcome" component={WelcomeLayout}>
           <Route path="/" component={Welcome} />
         </Route>
diff --git a/packages/frontend/src/pages/Discovery.tsx b/packages/frontend/src/pages/Discovery.tsx
deleted file mode 100644
index 43fca20a..00000000
--- a/packages/frontend/src/pages/Discovery.tsx
+++ /dev/null
@@ -1,188 +0,0 @@
-import { useNavigate, useSearchParams } from '@solidjs/router';
-import { Title, Meta } from '@solidjs/meta';
-import { type Component, createSignal, createUniqueId, onMount, Show } from 'solid-js';
-import '../styles/discovery.css';
-import Select from '../components/Select.jsx';
-import { authClient } from '../services/auth-client.js';
-import { isSafeInternalRedirect } from '../services/auth-redirects.js';
-import {
-  COMPANY_SIZE_OPTIONS,
-  PROJECT_TYPE_OPTIONS,
-  completeDiscovery,
-  isDiscoveryRequired,
-  markDiscoveryPending,
-  type DiscoverySubmission,
-} from '../services/discovery.js';
-
-/**
- * One-time post-signup step. Self-guards like Setup.tsx: anyone who should not
- * see it (already completed, already skipped, direct navigation later) is
- * redirected to the `next` destination.
- */
-const Discovery: Component = () => {
-  const navigate = useNavigate();
-  const [searchParams] = useSearchParams();
-  const session = authClient.useSession();
-  const userId = () => session()?.data?.user?.id ?? '';
-
-  const [checking, setChecking] = createSignal(true);
-  const [busy, setBusy] = createSignal(false);
-  const [name, setName] = createSignal('');
-  const [email, setEmail] = createSignal('');
-  const [projectType, setProjectType] = createSignal('');
-  const [companySize, setCompanySize] = createSignal('');
-  const nameId = createUniqueId();
-  const emailId = createUniqueId();
-
-  const next = () => {
-    const raw = searchParams.next;
-    const value = Array.isArray(raw) ? raw[0] : raw;
-    return isSafeInternalRedirect(value) ? value : '/';
-  };
-
-  const leave = () => navigate(next(), { replace: true });
-  const isSignupRedirect = () => {
-    const raw = searchParams.signup;
-    return (Array.isArray(raw) ? raw[0] : raw) === '1';
-  };
-
-  onMount(async () => {
-    if (isSignupRedirect()) markDiscoveryPending(userId(), next());
-    if (!(await isDiscoveryRequired(userId()))) {
-      leave();
-      return;
-    }
-    // Anyone who sees the form gets the pending marker, so browser Back
-    // returns here via the guards until the step is completed or skipped.
-    // Covers users whose signup predates the marker (or another browser).
-    markDiscoveryPending(userId(), next());
-    setChecking(false);
-  });
-
-  const finish = async (submission: DiscoverySubmission) => {
-    if (busy()) return;
-    setBusy(true);
-    try {
-      await completeDiscovery(userId(), submission);
-    } finally {
-      setBusy(false);
-    }
-    leave();
-  };
-
-  const handleSubmit = async (e: Event) => {
-    e.preventDefault();
-    await finish({
-      ...(name().trim() && { name: name().trim() }),
-      ...(email().trim() && { email: email().trim() }),
-      ...(projectType() && { projectType: projectType() }),
-      ...(companySize() && { companySize: companySize() }),
-    });
-  };
-
-  return (
-    <div class="auth-layout">
-      <Title>Welcome - Manifest</Title>
-      <Meta name="description" content="Tell us a little about how you use Manifest." />
-      <Show when={!checking()} fallback={<div class="auth-header__subtitle">Loading...</div>}>
-        <div class="discovery-card">
-          <aside class="discovery-card__intro">
-            <div class="auth-logo discovery-card__logo">
-              <a href="https://manifest.build" class="auth-logo__link">
-                <img
-                  src="/logotype-white.svg"
-                  alt="Manifest LLM Gateway"
-                  class="auth-logo__img auth-logo__img--light"
-                />
-                <img src="/logotype-dark.svg" alt="" class="auth-logo__img auth-logo__img--dark" />
-              </a>
-            </div>
-            <h1 class="discovery-card__title">Help us understand who uses Manifest</h1>
-            <div class="discovery-card__desc">
-              <p>
-                Manifest is <strong>open source</strong> and self-hosted, so we don't usually know
-                who's using it or what they're building.
-              </p>
-              <p>
-                If you're open to it, tell us a little about yourself. We may reach out personally
-                to learn about your experience and get your feedback. No newsletters or marketing
-                emails.
-              </p>
-            </div>
-          </aside>
-          <div class="discovery-card__form">
-            <form class="auth-form discovery-form" onSubmit={handleSubmit}>
-              <label class="auth-form__label" for={nameId}>
-                Name
-                <input
-                  id={nameId}
-                  class="auth-form__input"
-                  type="text"
-                  autocomplete="name"
-                  placeholder="Your name"
-                  value={name()}
-                  onInput={(e) => setName(e.currentTarget.value)}
-                />
-              </label>
-              <label class="auth-form__label" for={emailId}>
-                Email
-                <input
-                  id={emailId}
-                  class="auth-form__input"
-                  type="email"
-                  autocomplete="email"
-                  placeholder="you@example.com"
-                  value={email()}
-                  onInput={(e) => setEmail(e.currentTarget.value)}
-                />
-              </label>
-              <div class="auth-form__label">
-                What type of project are you working on?
-                <div classList={{ 'discovery-select--empty': !projectType() }}>
-                  <Select
-                    options={PROJECT_TYPE_OPTIONS}
-                    value={projectType()}
-                    onChange={setProjectType}
-                    placeholder="Select an option"
-                    label="What type of project are you working on?"
-                    portal
-                    maxDropdownHeight={280}
-                  />
-                </div>
-              </div>
-              <div class="auth-form__label">
-                How big is your company?
-                <div classList={{ 'discovery-select--empty': !companySize() }}>
-                  <Select
-                    options={COMPANY_SIZE_OPTIONS}
-                    value={companySize()}
-                    onChange={setCompanySize}
-                    placeholder="Select an option"
-                    label="How big is your company?"
-                    portal
-                    maxDropdownHeight={280}
-                  />
-                </div>
-              </div>
-              <div class="discovery-actions">
-                <button
-                  type="button"
-                  class="btn btn--ghost"
-                  onClick={() => finish({})}
-                  disabled={busy()}
-                >
-                  Skip
-                </button>
-                <button class="btn btn--primary" type="submit" disabled={busy()}>
-                  {busy() ? <span class="spinner" /> : 'Continue'}
-                </button>
-              </div>
-            </form>
-          </div>
-        </div>
-      </Show>
-    </div>
-  );
-};
-
-export default Discovery;
diff --git a/packages/frontend/src/pages/GlobalOverview.tsx b/packages/frontend/src/pages/GlobalOverview.tsx
index ea94e476..7230c455 100644
--- a/packages/frontend/src/pages/GlobalOverview.tsx
+++ b/packages/frontend/src/pages/GlobalOverview.tsx
@@ -34,7 +34,7 @@ import { PROVIDERS } from '../services/providers.js';
 import { AGENT_COLORS } from '../components/MultiAgentTokenChart.jsx';
 import InfoTooltip from '../components/InfoTooltip.jsx';
 import UnifiedChartCard from '../components/UnifiedChartCard.jsx';
-import AutofixKpiCards from '../components/AutofixKpiCards.jsx';
+import ReliabilityKpiCards from '../components/ReliabilityKpiCards.jsx';
 import Sparkline from '../components/Sparkline.jsx';
 import FilterSelect from '../components/FilterSelect.jsx';
 import Select from '../components/Select.jsx';
@@ -53,15 +53,15 @@ import '../styles/charts.css';
 import '../styles/analytics-overview.css';
 import '../styles/routing.css';
 import {
-  getAutofixStats,
-  getAutofixTimeseries,
+  getReliabilityStats,
+  getRequestStatusTimeseries,
   getPerProviderReliability,
   getPerAgentReliability,
   getPerModelReliability,
-  selfHealedCount,
+  recoveredCount,
   successRate,
   attemptSuccessRate,
-  totalAttemptsTooltip,
+  TOTAL_ATTEMPTS_TOOLTIP,
   MODEL_SUCCESS_RATE_TOOLTIP,
   PROVIDER_SUCCESS_RATE_TOOLTIP,
   CONNECTION_SUCCESS_RATE_TOOLTIP,
@@ -186,7 +186,7 @@ const GlobalOverview: Component = () => {
   };
 
   // ── Chart view state ─────────────────────────────────────────────────
-  const [chartView, setChartView] = createSignal<'requests' | 'selfheal' | 'tokens' | 'cost'>(
+  const [chartView, setChartView] = createSignal<'requests' | 'recovered' | 'tokens' | 'cost'>(
     'requests',
   );
 
@@ -260,29 +260,27 @@ const GlobalOverview: Component = () => {
     },
   );
 
-  // ── Autofix resources ─────────────────────────────────
-  const autofixScope = createMemo(() => ({ range: chartRange() }));
-  const [autofixStatsResult] = createResource(
-    () => ({ scope: autofixScope(), _ping: analyticsPing() }),
-    async (p) => ({ scope: p.scope, data: await getAutofixStats(p.scope.range) }),
+  // ── Reliability resources ─────────────────────────────
+  const reliabilityScope = createMemo(() => ({ range: chartRange() }));
+  const [reliabilityStatsResult] = createResource(
+    () => ({ scope: reliabilityScope(), _ping: analyticsPing() }),
+    async (p) => ({ scope: p.scope, data: await getReliabilityStats(p.scope.range) }),
   );
-  const autofixStats = () => {
-    const result = autofixStatsResult();
-    return result?.scope === autofixScope() ? result.data : undefined;
+  const reliabilityStats = () => {
+    const result = reliabilityStatsResult();
+    return result?.scope === reliabilityScope() ? result.data : undefined;
   };
 
-  // Disposition timeseries: feeds the "By request status" chart view AND the
-  // Self-healed requests tab (recovered subset: healed + fallback series).
+  // Request-status timeseries: feeds the "By request status" chart view AND
+  // the Recovered requests tab (the fallback series alone).
   const [requestStatusTs] = createResource(
     () => ({ range: chartRange(), _ping: analyticsPing() }),
-    (p) => getAutofixTimeseries(p.range, 'disposition'),
+    (p) => getRequestStatusTimeseries(p.range),
   );
-  const selfHealedTs = () => {
+  const recoveredTs = () => {
     const ts = requestStatusTs();
     if (!ts) return undefined;
-    const picked = ts.keys
-      .map((k, i) => ({ k, i }))
-      .filter(({ k }) => k === 'healed' || k === 'fallback');
+    const picked = ts.keys.map((k, i) => ({ k, i })).filter(({ k }) => k === 'fallback');
     return {
       ...ts,
       keys: picked.map(({ k }) => k),
@@ -636,8 +634,8 @@ const GlobalOverview: Component = () => {
           </Show>
         }
       >
-        {/* ── Autofix KPI cards ── */}
-        <AutofixKpiCards stats={autofixStats()} range={chartRange()} />
+        {/* ── Reliability KPI cards ── */}
+        <ReliabilityKpiCards stats={reliabilityStats()} range={chartRange()} />
 
         {/* ── 2. Unified Chart Card ─────────────────────────────────── */}
         {(() => {
@@ -653,19 +651,16 @@ const GlobalOverview: Component = () => {
               onTabChange={setChartView}
               requestsValue={o().summary.messages.value}
               requestsTrendPct={o().summary.messages.trend_pct}
-              selfHealedValue={
-                (autofixStats()?.autofix_saves.value ?? 0) +
-                (autofixStats()?.fallback_saves?.value ?? 0)
-              }
-              selfHealedTrendPct={(() => {
-                const s = autofixStats();
+              recoveredValue={reliabilityStats()?.fallback_saves?.value ?? 0}
+              recoveredTrendPct={(() => {
+                const s = reliabilityStats();
                 if (!s) return 0;
-                const cur = s.autofix_saves.value + (s.fallback_saves?.value ?? 0);
-                const prev = s.autofix_saves.previous + (s.fallback_saves?.previous ?? 0);
+                const cur = s.fallback_saves?.value ?? 0;
+                const prev = s.fallback_saves?.previous ?? 0;
                 if (prev === 0) return 0;
                 return Math.max(-999, Math.min(999, Math.round(((cur - prev) / prev) * 100)));
               })()}
-              selfHealedTimeseries={selfHealedTs()}
+              recoveredTimeseries={recoveredTs()}
               costValue={o().summary.cost_today.value}
               costTrendPct={o().summary.cost_today.trend_pct}
               costInfoTooltip="Actual API key costs only. Subscription usage is not included."
@@ -790,7 +785,7 @@ const GlobalOverview: Component = () => {
                   <th style="text-align: right;">Est. cost</th>
                   <th class="rel-col">
                     Total attempts
-                    <InfoTooltip text={totalAttemptsTooltip(true)} />
+                    <InfoTooltip text={TOTAL_ATTEMPTS_TOOLTIP} />
                   </th>
                   <th class="rel-col">
                     Success rate
@@ -923,7 +918,7 @@ const GlobalOverview: Component = () => {
                   <th>Status</th>
                   <th class="rel-col">
                     Total attempts
-                    <InfoTooltip text={totalAttemptsTooltip(true)} />
+                    <InfoTooltip text={TOTAL_ATTEMPTS_TOOLTIP} />
                   </th>
                   <th class="rel-col">
                     Failed attempts
@@ -1197,8 +1192,8 @@ const GlobalOverview: Component = () => {
                                 <Show when={rel()} fallback="—">
                                   {(() => {
                                     // Recovered = successful requests holding a
-                                    // recovery attempt (autofix or fallback).
-                                    const link = `/messages?agent=${encodeURIComponent(agent.agent_name)}&range=${chartRange()}&status=ok&trigger=autofix,fallback`;
+                                    // fallback attempt.
+                                    const link = `/messages?agent=${encodeURIComponent(agent.agent_name)}&range=${chartRange()}&status=ok&trigger=fallback`;
                                     return (
                                       <a
                                         class="count-link"
@@ -1210,7 +1205,7 @@ const GlobalOverview: Component = () => {
                                           navigate(link);
                                         }}
                                       >
-                                        {formatNumber(selfHealedCount(rel()!))}
+                                        {formatNumber(recoveredCount(rel()!))}
                                       </a>
                                     );
                                   })()}
diff --git a/packages/frontend/src/pages/MessageLog.tsx b/packages/frontend/src/pages/MessageLog.tsx
index 99e3483f..064e025a 100644
--- a/packages/frontend/src/pages/MessageLog.tsx
+++ b/packages/frontend/src/pages/MessageLog.tsx
@@ -20,7 +20,7 @@ import MultiSelect, { type MultiSelectOption } from '../components/MultiSelect.j
 import { getProviders as getProviderConnections } from '../services/api/providers.js';
 import SetupModal from '../components/SetupModal.jsx';
 import { DETAILED_COLUMNS, type MessageRow } from '../components/message-table-types.js';
-import { AutofixIcon, FallbackIcon } from '../components/message-table-cells.jsx';
+import { FallbackIcon } from '../components/message-table-cells.jsx';
 import { agentDisplayName } from '../services/agent-display-name.js';
 import { agentPlatform, agentCategory } from '../services/agent-platform-store.js';
 import {
@@ -78,7 +78,7 @@ const HEADER_TIER_FILTER_PREFIX = 'header:';
 const MESSAGE_STATUS_FILTERS = ['ok', 'failed', 'cancelled'] as const;
 type MessageStatusFilter = (typeof MESSAGE_STATUS_FILTERS)[number];
 type MessageStatusFilterValue = '' | MessageStatusFilter;
-const MESSAGE_TRIGGER_FILTERS = ['none', 'fallback', 'autofix'] as const;
+const MESSAGE_TRIGGER_FILTERS = ['none', 'fallback'] as const;
 type MessageTriggerFilter = (typeof MESSAGE_TRIGGER_FILTERS)[number];
 
 const isMessageStatusFilter = (value: unknown): value is MessageStatusFilter =>
@@ -104,7 +104,7 @@ const normalizeTriggerFilters = (value: unknown): MessageTriggerFilter[] =>
   typeof value === 'string' ? value.split(',').filter(isMessageTriggerFilter) : [];
 
 /** The recovery select's states: default, any kind, one kind, or none at all. */
-const TRIGGER_CHOICES = ['any', 'autofix', 'fallback', 'none'] as const;
+const TRIGGER_CHOICES = ['fallback', 'none'] as const;
 type TriggerChoice = '' | (typeof TRIGGER_CHOICES)[number];
 
 const isTriggerChoice = (value: unknown): value is TriggerChoice =>
@@ -243,19 +243,13 @@ const MessageLog: Component = () => {
     );
   });
   // A plain select over the useful recovery readings. The wire stays a comma
-  // list (?trigger=autofix,fallback), so 'any' folds both kinds and existing
-  // deep links keep working.
+  // list (?trigger=fallback); unknown kinds in an old deep link are ignored.
   const triggerListToChoice = (list: MessageTriggerFilter[]): TriggerChoice => {
-    if (list.includes('autofix') && list.includes('fallback')) return 'any';
-    if (list.includes('autofix')) return 'autofix';
     if (list.includes('fallback')) return 'fallback';
     if (list.includes('none')) return 'none';
     return '';
   };
-  const triggerChoiceToParam = (choice: TriggerChoice): string | undefined => {
-    if (choice === 'any') return 'autofix,fallback';
-    return choice || undefined;
-  };
+  const triggerChoiceToParam = (choice: TriggerChoice): string | undefined => choice || undefined;
   const [triggerFilter, setTriggerFilter] = createSignal<TriggerChoice>(
     triggerListToChoice(normalizeTriggerFilters(searchParams.trigger)),
   );
@@ -631,26 +625,6 @@ const MessageLog: Component = () => {
   );
   const triggerOptions = [
     { label: 'All attempts', value: '' },
-    {
-      label: 'With any recovery attempt',
-      value: 'any',
-      icon: (
-        <span class="recovery-opt-icon" aria-hidden="true">
-          <AutofixIcon />
-          <span class="recovery-opt-icon__plus">+</span>
-          <FallbackIcon />
-        </span>
-      ),
-    },
-    {
-      label: 'With an autofix attempt',
-      value: 'autofix',
-      icon: (
-        <span class="recovery-opt-icon" aria-hidden="true">
-          <AutofixIcon />
-        </span>
-      ),
-    },
     {
       label: 'With a fallback attempt',
       value: 'fallback',
@@ -673,15 +647,6 @@ const MessageLog: Component = () => {
     { label: 'Transport', value: 'transport' },
   ];
 
-  // Jump to a linked message (the Autofix sibling of an expanded row).
-  const scrollToMessage = (id: string) => {
-    const el = document.getElementById(`msg-${id}`);
-    if (!el) return;
-    el.scrollIntoView({ behavior: 'smooth', block: 'center' });
-    el.classList.add('msg-highlight');
-    setTimeout(() => el.classList.remove('msg-highlight'), 2000);
-  };
-
   // Drawer state. `?request=<id>` deep-links a request into the side panel
   // (the Recent Requests lists navigate here instead of expanding inline).
   const [selectedMessageId, setSelectedMessageId] = createSignal<string | null>(
@@ -692,11 +657,6 @@ const MessageLog: Component = () => {
     setSelectedMessageId(null);
     if (searchParams.request) setSearchParams({ request: undefined });
   };
-  const handleOpenMessageInDrawer = (id: string) => {
-    closeDrawer();
-    setTimeout(() => openDrawer(id), 100);
-  };
-
   // Close drawer when clicking outside the table (not on a message row)
   const handlePageClick = (e: MouseEvent) => {
     if (!selectedMessageId()) return;
@@ -975,7 +935,6 @@ const MessageLog: Component = () => {
                   agentName={params.agentName}
                   customProviderName={() => undefined}
                   agentPlatformLookup={(name) => agentPlatformMap().get(name)}
-                  onOpenMessage={scrollToMessage}
                   onRowSelect={openDrawer}
                   selectedRowId={selectedMessageId()}
                   rowIdPrefix="msg-"
@@ -1006,11 +965,7 @@ const MessageLog: Component = () => {
           onClose={() => setSetupOpen(false)}
         />
       </Show>
-      <RequestDrawer
-        messageId={selectedMessageId()}
-        onClose={closeDrawer}
-        onOpenMessage={handleOpenMessageInDrawer}
-      />
+      <RequestDrawer messageId={selectedMessageId()} onClose={closeDrawer} />
     </div>
   );
 };
diff --git a/packages/frontend/src/pages/Overview.tsx b/packages/frontend/src/pages/Overview.tsx
index 4d791b16..1ddc18ed 100644
--- a/packages/frontend/src/pages/Overview.tsx
+++ b/packages/frontend/src/pages/Overview.tsx
@@ -10,7 +10,7 @@ import {
   type Component,
 } from 'solid-js';
 import UnifiedChartCard from '../components/UnifiedChartCard.jsx';
-import AutofixKpiCards from '../components/AutofixKpiCards.jsx';
+import ReliabilityKpiCards from '../components/ReliabilityKpiCards.jsx';
 
 import FilterSelect from '../components/FilterSelect.jsx';
 import { AGENT_COLORS } from '../components/MultiAgentTokenChart.jsx';
@@ -26,7 +26,8 @@ import { agentPlatform, agentCategory } from '../services/agent-platform-store.j
 import { PROVIDERS } from '../services/providers.js';
 import { getOverview, getOverviewDetails } from '../services/api.js';
 import {
-  getAutofixTimeseries,
+  getReliabilityStats,
+  getRequestStatusTimeseries,
   getPerModelReliability,
   getPerProviderTimeseries,
   getPerProviderMessageTimeseries,
@@ -44,7 +45,6 @@ import {
 import '../styles/overview.css';
 import '../styles/charts.css';
 import '../styles/routing.css';
-import { getAutofixStats } from '../services/api/analytics.js';
 
 const AGENT_RANGE_OPTIONS = [
   { label: 'Last 24 hours', value: '24h' },
@@ -112,7 +112,7 @@ type KeyedTimeseries = {
   timeseries: Array<Record<string, number | string>>;
 };
 
-type ProviderView = 'requests' | 'selfheal' | 'cost' | 'tokens';
+type ProviderView = 'requests' | 'recovered' | 'cost' | 'tokens';
 type TimeseriesKey = { range: string; agent: string; _ping: number };
 
 const Overview: Component = () => {
@@ -264,29 +264,32 @@ const Overview: Component = () => {
     (p) => getPerProviderCostTimeseries(p.agent, p.range) as Promise<KeyedTimeseries>,
   );
 
-  // ── Autofix resources ─────────────────────────────────
-  const autofixScope = createMemo(() => ({
+  // ── Reliability resources ─────────────────────────────
+  const reliabilityScope = createMemo(() => ({
     range: range(),
     agent: decodeURIComponent(params.agentName),
   }));
-  const [autofixStatsResult] = createResource(
-    () => ({ scope: autofixScope(), _ping: analyticsPing() }),
-    async (p) => ({ scope: p.scope, data: await getAutofixStats(p.scope.range, p.scope.agent) }),
+  const [reliabilityStatsResult] = createResource(
+    () => ({ scope: reliabilityScope(), _ping: analyticsPing() }),
+    async (p) => ({
+      scope: p.scope,
+      data: await getReliabilityStats(p.scope.range, p.scope.agent),
+    }),
   );
-  const currentAutofixStats = () => {
-    const result = autofixStatsResult();
-    return result?.scope === autofixScope() ? result.data : undefined;
+  const currentReliabilityStats = () => {
+    const result = reliabilityStatsResult();
+    return result?.scope === reliabilityScope() ? result.data : undefined;
   };
-  // Disposition timeseries: the Requests chart's ONLY view on this page (an
+  // Request-status timeseries: the Requests chart's ONLY view on this page (an
   // agent is the harness, and a request may touch several providers, so no
-  // other grouping is meaningful) + the Healed requests tab subset.
+  // other grouping is meaningful) + the Recovered requests tab subset.
   const [statusTimeseries] = createResource(
     () => ({
       range: range(),
       agent: decodeURIComponent(params.agentName),
       _ping: analyticsPing(),
     }),
-    (p) => getAutofixTimeseries(p.range, 'disposition', p.agent),
+    (p) => getRequestStatusTimeseries(p.range, p.agent),
   );
   const [modelReliability] = createResource(
     () => ({
@@ -309,12 +312,10 @@ const Overview: Component = () => {
   });
   const scopeChanging = () => loadedScope() !== overviewScope();
 
-  const selfHealedTs = () => {
+  const recoveredTs = () => {
     const ts = statusTimeseries();
     if (!ts) return undefined;
-    const picked = ts.keys
-      .map((k, i) => ({ k, i }))
-      .filter(({ k }) => k === 'healed' || k === 'fallback');
+    const picked = ts.keys.map((k, i) => ({ k, i })).filter(({ k }) => k === 'fallback');
     return {
       ...ts,
       keys: picked.map(({ k }) => k),
@@ -481,8 +482,8 @@ const Overview: Component = () => {
                       </p>
                     </div>
                   </Show>
-                  <AutofixKpiCards
-                    stats={currentAutofixStats()}
+                  <ReliabilityKpiCards
+                    stats={currentReliabilityStats()}
                     agentName={decodeURIComponent(params.agentName)}
                     range={range()}
                   />
@@ -493,22 +494,19 @@ const Overview: Component = () => {
                         onTabChange={setActiveView}
                         requestsValue={d().summary?.messages?.value ?? 0}
                         requestsTrendPct={d().summary?.messages?.trend_pct ?? 0}
-                        selfHealedValue={
-                          (currentAutofixStats()?.autofix_saves.value ?? 0) +
-                          (currentAutofixStats()?.fallback_saves?.value ?? 0)
-                        }
-                        selfHealedTrendPct={(() => {
-                          const s = currentAutofixStats();
+                        recoveredValue={currentReliabilityStats()?.fallback_saves?.value ?? 0}
+                        recoveredTrendPct={(() => {
+                          const s = currentReliabilityStats();
                           if (!s) return 0;
-                          const cur = s.autofix_saves.value + (s.fallback_saves?.value ?? 0);
-                          const prev = s.autofix_saves.previous + (s.fallback_saves?.previous ?? 0);
+                          const cur = s.fallback_saves?.value ?? 0;
+                          const prev = s.fallback_saves?.previous ?? 0;
                           if (prev === 0) return 0;
                           return Math.max(
                             -999,
                             Math.min(999, Math.round(((cur - prev) / prev) * 100)),
                           );
                         })()}
-                        selfHealedTimeseries={selfHealedTs()}
+                        recoveredTimeseries={recoveredTs()}
                         costValue={d().summary?.cost_today?.value ?? 0}
                         costTrendPct={d().summary?.cost_today?.trend_pct ?? 0}
                         costInfoTooltip="Actual API key costs only. Subscription usage is not included."
@@ -575,7 +573,6 @@ const Overview: Component = () => {
                   <CostByModelTable
                     rows={overviewDetails()?.cost_by_model ?? d().cost_by_model ?? []}
                     reliability={modelReliability()}
-                    doctorAvailable
                   />
                 </>
               );
diff --git a/packages/frontend/src/pages/Register.tsx b/packages/frontend/src/pages/Register.tsx
index 77fba00b..0d27aac4 100644
--- a/packages/frontend/src/pages/Register.tsx
+++ b/packages/frontend/src/pages/Register.tsx
@@ -6,11 +6,10 @@ import { authClient } from '../services/auth-client.js';
 import { appendSearch } from '../services/auth-redirects.js';
 import { getLastAuthMethod, setLastAuthMethod } from '../services/last-auth-method.js';
 import { checkSocialProviders } from '../services/setup-status.js';
-import { markDiscoveryPending } from '../services/discovery.js';
 
 const RESEND_COOLDOWN_SECONDS = 60;
-// Signups pass through the one-time discovery step before the welcome flow.
-const POST_SIGNUP_URL = '/discovery?next=%2Fwelcome';
+// New accounts land on the onboarding flow, which hands off to the dashboard.
+const POST_SIGNUP_URL = '/welcome';
 
 const Register: Component = () => {
   const [name, setName] = createSignal('');
@@ -28,7 +27,6 @@ const Register: Component = () => {
   const emailId = createUniqueId();
   const passwordId = createUniqueId();
   const errorId = createUniqueId();
-  const socialSignupUrl = `${POST_SIGNUP_URL}&signup=1`;
 
   onMount(async () => {
     setSocialProviders(await checkSocialProviders());
@@ -79,10 +77,6 @@ const Register: Component = () => {
     setAlreadyExists(false);
     setLastAuthMethod('email');
 
-    // Remember the discovery step is pending so the guards keep routing this
-    // user back to it until it is completed or skipped.
-    markDiscoveryPending(data?.user?.id ?? '', '/welcome');
-
     if (data?.token) {
       window.location.href = POST_SIGNUP_URL;
       return;
@@ -162,7 +156,7 @@ const Register: Component = () => {
         <SocialButtons
           enabledProviders={socialProviders()}
           lastUsed={lastAuthMethod()}
-          callbackURL={socialSignupUrl}
+          callbackURL={POST_SIGNUP_URL}
         />
 
         <Show when={socialProviders().length > 0}>
diff --git a/packages/frontend/src/pages/Settings.tsx b/packages/frontend/src/pages/Settings.tsx
index 8c6ea352..2af7133d 100644
--- a/packages/frontend/src/pages/Settings.tsx
+++ b/packages/frontend/src/pages/Settings.tsx
@@ -6,7 +6,6 @@ import ErrorState from '../components/ErrorState.jsx';
 import AgentTypeGrid from '../components/AgentTypeGrid.jsx';
 import SetupStepAddProvider from '../components/SetupStepAddProvider.jsx';
 import SetupModal from '../components/SetupModal.jsx';
-import SettingsAutofixSection from './SettingsAutofixSection.jsx';
 import SettingsRecordingSection from './SettingsRecordingSection.jsx';
 import { agentDisplayName } from '../services/agent-display-name.js';
 import { installOrigin } from '../services/install-endpoints.js';
@@ -226,9 +225,6 @@ const Settings: Component = () => {
         </div>
       </div>
 
-      {/* -- Autofix ---------------------------------- */}
-      <SettingsAutofixSection agentName={agentName} />
-
       {/* -- Message recording ------------------------- */}
       <SettingsRecordingSection agentName={agentName} />
 
diff --git a/packages/frontend/src/pages/SettingsAutofixSection.tsx b/packages/frontend/src/pages/SettingsAutofixSection.tsx
deleted file mode 100644
index 745b74be..00000000
--- a/packages/frontend/src/pages/SettingsAutofixSection.tsx
+++ /dev/null
@@ -1,104 +0,0 @@
-import { createResource, createSignal, createEffect, onCleanup, type Component } from 'solid-js';
-import { useSearchParams } from '@solidjs/router';
-import { getAutofix, updateAutofix } from '../services/api.js';
-
-/**
- * Per-agent Autofix toggle on the Settings page. Fetches its own status and
- * persists the on/off choice. The effective value shown here already reflects
- * the deployment-mode default resolved by the backend (ON in cloud, OFF in
- * self-hosted) when the agent has made no explicit choice. The legal line under
- * the card is the consent act: the backend records the install-level consent on
- * the first enable, no confirmation dialog involved.
- */
-const SettingsAutofixSection: Component<{ agentName: () => string }> = (props) => {
-  const [config, { mutate }] = createResource(() => props.agentName(), getAutofix);
-  const [saving, setSaving] = createSignal(false);
-
-  // Guard the errored read: accessing an errored SolidJS resource re-throws, so
-  // short-circuit to off (the switch stays disabled via busy() below). Also gate
-  // on `config.loading`: Solid keeps the previous agent's value during a refetch,
-  // so without this the switch would briefly show the prior agent's state when
-  // you switch harnesses.
-  const enabled = () => (!config.loading && !config.error ? (config()?.enabled ?? false) : false);
-  // Also disabled after a failed read: without a known current state a click
-  // would blindly write a value the user never saw.
-  const busy = () => saving() || config.loading || Boolean(config.error);
-
-  // No busy() guard needed: the switch is the only caller and it is disabled
-  // while busy, so a re-entrant click cannot dispatch.
-  const saveEnabled = async (nextEnabled: boolean) => {
-    // Pin the agent this click targets. If the user switches harnesses before
-    // the save resolves, don't mutate the (now different) agent's resource.
-    const agentName = props.agentName();
-    setSaving(true);
-    try {
-      const next = await updateAutofix(agentName, { enabled: nextEnabled });
-      if (props.agentName() === agentName) mutate(next);
-    } catch {
-      // `updateAutofix` (via `fetchMutate`) already surfaces the backend error as a
-      // toast, so don't raise a second generic one here — just stop the spinner.
-    } finally {
-      setSaving(false);
-    }
-  };
-
-  const [searchParams] = useSearchParams();
-  const [highlighted, setHighlighted] = createSignal(searchParams.highlight === 'autofix');
-  createEffect(() => {
-    if (highlighted()) {
-      // onCleanup, not a return value: Solid feeds an effect's return into the
-      // next run instead of calling it, so a returned closure never fires.
-      const timer = setTimeout(() => setHighlighted(false), 1500);
-      onCleanup(() => clearTimeout(timer));
-    }
-  });
-
-  return (
-    <>
-      <h2 class="settings-section__title">Autofix</h2>
-      <div
-        class="settings-card settings-card--flush"
-        classList={{ 'settings-card--highlight': highlighted() }}
-      >
-        <div class="settings-card__row">
-          <div class="settings-card__label">
-            <span class="settings-card__label-title">Autofix failing requests</span>
-            <span class="settings-card__label-desc">
-              When a request fails with a fixable error, Manifest repairs it and retries once before
-              falling back, so a bad request gets fixed instead of just failing over.
-            </span>
-          </div>
-          <div class="settings-card__control settings-card__control--end">
-            <button
-              type="button"
-              role="switch"
-              aria-checked={enabled()}
-              aria-label="Autofix"
-              class="settings-switch"
-              classList={{ 'settings-switch--on': enabled() }}
-              disabled={busy()}
-              onClick={() => void saveEnabled(!enabled())}
-            >
-              <span class="settings-switch__track">
-                <span class="settings-switch__thumb" />
-              </span>
-            </button>
-          </div>
-        </div>
-      </div>
-      <p class="autofix-consent__legal settings-card__legal">
-        By enabling Autofix, you agree to Manifest&apos;s{' '}
-        <a href="https://manifest.build/terms" target="_blank" rel="noopener noreferrer">
-          Terms
-        </a>{' '}
-        and{' '}
-        <a href="https://manifest.build/privacy" target="_blank" rel="noopener noreferrer">
-          Privacy Policy
-        </a>
-        .
-      </p>
-    </>
-  );
-};
-
-export default SettingsAutofixSection;
diff --git a/packages/frontend/src/pages/Setup.tsx b/packages/frontend/src/pages/Setup.tsx
index 7e5c105b..6fc74f77 100644
--- a/packages/frontend/src/pages/Setup.tsx
+++ b/packages/frontend/src/pages/Setup.tsx
@@ -2,9 +2,7 @@ import { useNavigate } from '@solidjs/router';
 import { Title, Meta } from '@solidjs/meta';
 import { type Component, createSignal, onMount, Show } from 'solid-js';
 import { authClient } from '../services/auth-client.js';
-import { buildLoginRedirect } from '../services/auth-redirects.js';
 import { checkNeedsSetup, createFirstAdmin } from '../services/setup-status.js';
-import { markDiscoveryPending } from '../services/discovery.js';
 
 const Setup: Component = () => {
   const navigate = useNavigate();
@@ -43,20 +41,18 @@ const Setup: Component = () => {
       await createFirstAdmin({ email: email(), name: name(), password: password() });
 
       // Auto sign-in with the credentials just created.
-      const { data: signInData, error: authError } = await authClient.signIn.email({
+      const { error: authError } = await authClient.signIn.email({
         email: email(),
         password: password(),
       });
       if (authError) {
-        // Creation succeeded but sign-in failed. Preserve the new-account
-        // destination so a later manual login still reaches discovery.
-        navigate(buildLoginRedirect('/discovery', '?next=%2F&signup=1'), { replace: true });
+        // Creation succeeded but sign-in failed: a manual login lands on the
+        // dashboard home like any other sign-in.
+        navigate('/login', { replace: true });
         return;
       }
-      // New admins get the one-time discovery step first; the pending marker
-      // lets the guards route them back until it is done.
-      markDiscoveryPending(signInData?.user?.id ?? '', '/');
-      window.location.href = '/discovery';
+      // Full reload so the new session cookie is picked up by every guard.
+      window.location.href = '/';
     } catch (err) {
       setError(err instanceof Error ? err.message : 'Setup failed');
     } finally {
diff --git a/packages/frontend/src/pages/Welcome.tsx b/packages/frontend/src/pages/Welcome.tsx
index 60e37b85..00317465 100644
--- a/packages/frontend/src/pages/Welcome.tsx
+++ b/packages/frontend/src/pages/Welcome.tsx
@@ -5,12 +5,10 @@ import type { AnimationPlaybackControls, AnimationSequence } from 'motion';
 import {
   For,
   Show,
-  Suspense,
   createEffect,
   createMemo,
   createResource,
   createSignal,
-  lazy,
   onCleanup,
   untrack,
   type Component,
@@ -70,13 +68,6 @@ import '../styles/routing-providers.css';
 import '../styles/routing-modal.css';
 import '../styles/welcome.css';
 
-// Dev-only gateway tester, same compile-time gating as App.tsx: rollup drops
-// the component and its deps from production/self-hosted bundles. Mounted on
-// the activate step so the first request can be fired without leaving the UI.
-const WingmanDevTools = __DEV_MODE__
-  ? lazy(() => import('../components/WingmanDevTools.jsx'))
-  : null;
-
 type StepId = 'harness' | 'providers' | 'playground' | 'route' | 'activate';
 const STEP_ORDER: StepId[] = ['harness', 'providers', 'playground', 'route', 'activate'];
 
@@ -274,12 +265,8 @@ const Welcome: Component = () => {
   );
   const [creating, setCreating] = createSignal(false);
   const [harnessError, setHarnessError] = createSignal('');
-  // Both default ON, mirroring the Connect Harness modal — explicit so create
-  // always sends a choice rather than relying on the server-side inherit path
-  // (which is OFF for Autofix on self-hosted). Creating with Autofix on is
-  // itself the consent act (the backend records it), so the form shows the
-  // legal line inline instead of a consent dialog mid-onboarding.
-  const [autofixEnabled, setAutofixEnabled] = createSignal(true);
+  // Defaults ON, mirroring the Connect Harness modal — explicit so create
+  // always sends a choice rather than relying on the server-side default.
   const [logsEnabled, setLogsEnabled] = createSignal(true);
   const harnessCreated = () => !!harnessSlug();
 
@@ -302,7 +289,6 @@ const Welcome: Component = () => {
         name,
         ...(category() ? { agent_category: category()! } : {}),
         ...(platform() ? { agent_platform: platform()! } : {}),
-        autofix_enabled: autofixEnabled(),
         record_messages: logsEnabled(),
       });
       const slug = result?.agent?.name ?? name;
@@ -912,35 +898,6 @@ const Welcome: Component = () => {
                           labels, not the larger Model-params group header. */}
                       <div class="modal-card__field-label add-agent-toggles__header">Settings</div>
                       <div class="model-params__group-card">
-                        <div class="model-params__row">
-                          <div class="model-params__row-text">
-                            <div class="model-params__label-title">
-                              <span>Autofix</span>
-                            </div>
-                            <div class="model-params__label-hint">
-                              Repair eligible failing requests before falling back. Failed requests
-                              are sent to Manifest Autofix for diagnosis; provider authorization
-                              credentials are never sent.
-                            </div>
-                          </div>
-                          <div class="model-params__row-control">
-                            <button
-                              type="button"
-                              role="switch"
-                              aria-checked={autofixEnabled()}
-                              aria-label="Autofix"
-                              class="settings-switch"
-                              classList={{ 'settings-switch--on': autofixEnabled() }}
-                              disabled={creating()}
-                              onClick={() => setAutofixEnabled(!autofixEnabled())}
-                            >
-                              <span class="settings-switch__track">
-                                <span class="settings-switch__thumb" />
-                              </span>
-                            </button>
-                          </div>
-                        </div>
-                        <div class="model-params__separator" />
                         <div class="model-params__row">
                           <div class="model-params__row-text">
                             <div class="model-params__label-title">
@@ -971,27 +928,6 @@ const Welcome: Component = () => {
                       </div>
                     </div>
                   </div>
-                  <Show when={autofixEnabled()}>
-                    <p class="autofix-consent__legal welcome__legal">
-                      By enabling Autofix, you agree to Manifest&apos;s{' '}
-                      <a
-                        href="https://manifest.build/terms"
-                        target="_blank"
-                        rel="noopener noreferrer"
-                      >
-                        Terms
-                      </a>{' '}
-                      and{' '}
-                      <a
-                        href="https://manifest.build/privacy"
-                        target="_blank"
-                        rel="noopener noreferrer"
-                      >
-                        Privacy Policy
-                      </a>
-                      .
-                    </p>
-                  </Show>
                   <Show when={harnessError()}>
                     <p
                       id="welcome-harness-error"
@@ -1663,16 +1599,6 @@ const Welcome: Component = () => {
           onOpenProviderModal={() => setStep('providers')}
         />
       </Show>
-
-      {/* Dev-only: fire the first request from the UI instead of a terminal.
-          Hidden once liftoff takes over — the drawer would sit under it anyway. */}
-      {__DEV_MODE__ && WingmanDevTools && (
-        <Show when={step() === 'activate' && !agentRequestSeen()}>
-          <Suspense fallback={null}>
-            <WingmanDevTools />
-          </Suspense>
-        </Show>
-      )}
     </div>
   );
 };
diff --git a/packages/frontend/src/pages/providers/ConnectionDetail.tsx b/packages/frontend/src/pages/providers/ConnectionDetail.tsx
index 351a08c0..eec83972 100644
--- a/packages/frontend/src/pages/providers/ConnectionDetail.tsx
+++ b/packages/frontend/src/pages/providers/ConnectionDetail.tsx
@@ -22,7 +22,7 @@ import {
   getConnectionAttemptHttpStatusTimeseries,
   getConnectionAttemptBreakdown,
   attemptSuccessRate,
-  totalAttemptsTooltip,
+  TOTAL_ATTEMPTS_TOOLTIP,
   CONNECTION_SUCCESS_RATE_TOOLTIP,
   CONNECTION_HARNESS_SUCCESS_RATE_TOOLTIP,
 } from '../../services/api/analytics.js';
@@ -788,9 +788,8 @@ const ConnectionDetail: Component = () => {
               </div>
 
               {/* Attempt world cards: the connection's own numbers on the
-                  filtered period. Fallback retries exist for everyone;
-                  autofixed attempts only exist with the Doctor version. */}
-              <div class="overview-stats overview-stats--5" style="margin-bottom: 16px;">
+                  filtered period. */}
+              <div class="overview-stats" style="margin-bottom: 16px;">
                 <div class="overview-stat-card">
                   <span class="overview-stat-card__label">
                     Success rate
@@ -855,25 +854,6 @@ const ConnectionDetail: Component = () => {
                     {viewMore()}
                   </div>
                 </div>
-                <div
-                  class="overview-stat-card"
-                  style="cursor: pointer;"
-                  title="View the requests where this connection ran an autofixed attempt"
-                  onClick={() => navigate(requestsLink('&trigger=autofix'))}
-                >
-                  <span class="overview-stat-card__label">Autofixed attempts</span>
-                  <div class="overview-stat-card__value-row">
-                    <span class="overview-stat-card__value">
-                      {formatNumber(breakdown()?.autofix_attempts ?? 0)}
-                    </span>
-                    <Show when={(breakdown()?.autofix_attempts ?? 0) > 0}>
-                      <span style="color: hsl(var(--muted-foreground)); font-size: var(--font-size-xs);">
-                        {formatNumber(breakdown()?.autofix_attempts_succeeded ?? 0)} succeeded
-                      </span>
-                    </Show>
-                    {viewMore()}
-                  </div>
-                </div>
               </div>
 
               {/* Chart */}
@@ -893,7 +873,7 @@ const ConnectionDetail: Component = () => {
                       activeTab={chartView()}
                       onTabChange={setChartView}
                       requestsLabel="Attempts"
-                      requestsInfoTooltip={totalAttemptsTooltip(true)}
+                      requestsInfoTooltip={TOTAL_ATTEMPTS_TOOLTIP}
                       requestsValue={attemptTotals().attempts}
                       requestsTrendPct={0}
                       tokensValue={analytics()!.summary.tokens.value}
@@ -1119,7 +1099,7 @@ const ConnectionDetail: Component = () => {
                           </Show>
                           <th class="rel-col">
                             Total attempts
-                            <InfoTooltip text={totalAttemptsTooltip(true)} />
+                            <InfoTooltip text={TOTAL_ATTEMPTS_TOOLTIP} />
                           </th>
                           <th class="rel-col">
                             Success rate
diff --git a/packages/frontend/src/pages/providers/ProviderConnectionsPage.tsx b/packages/frontend/src/pages/providers/ProviderConnectionsPage.tsx
index ad2f1605..39131e87 100644
--- a/packages/frontend/src/pages/providers/ProviderConnectionsPage.tsx
+++ b/packages/frontend/src/pages/providers/ProviderConnectionsPage.tsx
@@ -41,7 +41,7 @@ import CustomProviderForm from '../../components/CustomProviderForm.jsx';
 import Sparkline from '../../components/Sparkline.jsx';
 import {
   attemptSuccessRate,
-  totalAttemptsTooltip,
+  TOTAL_ATTEMPTS_TOOLTIP,
   CONNECTION_SUCCESS_RATE_TOOLTIP_30D,
 } from '../../services/api/analytics.js';
 import '../../styles/routing.css';
@@ -583,7 +583,7 @@ const ProviderConnectionsPage: Component<ProviderConnectionsPageProps> = (props)
           <div class="overview-stat-card">
             <span class="overview-stat-card__label">
               Total attempts (30d)
-              <InfoTooltip text={totalAttemptsTooltip(true)} />
+              <InfoTooltip text={TOTAL_ATTEMPTS_TOOLTIP} />
             </span>
             <div class="overview-stat-card__value-row">
               <span class="overview-stat-card__value">{formatNumber(totalAttempts())}</span>
@@ -637,7 +637,7 @@ const ProviderConnectionsPage: Component<ProviderConnectionsPageProps> = (props)
                     </Show>
                     <th class="rel-col">
                       Total attempts (30d)
-                      <InfoTooltip text={totalAttemptsTooltip(true)} />
+                      <InfoTooltip text={TOTAL_ATTEMPTS_TOOLTIP} />
                     </th>
                     <th class="rel-col">
                       Success rate (30d)
diff --git a/packages/frontend/src/services/api.ts b/packages/frontend/src/services/api.ts
index ae9f2e98..3d12d426 100644
--- a/packages/frontend/src/services/api.ts
+++ b/packages/frontend/src/services/api.ts
@@ -9,7 +9,6 @@ export * from './api/notifications.js';
 export * from './api/oauth.js';
 export * from './api/model-params.js';
 export * from './api/playground.js';
-export * from './api/version.js';
 export {
   getProviders as getGlobalProviders,
   getProviderUsage as getGlobalProviderUsage,
diff --git a/packages/frontend/src/services/api/agents.ts b/packages/frontend/src/services/api/agents.ts
index bebe028e..b70e84c3 100644
--- a/packages/frontend/src/services/api/agents.ts
+++ b/packages/frontend/src/services/api/agents.ts
@@ -61,7 +61,6 @@ export interface CreateAgentParams {
   name: string;
   agent_category?: string;
   agent_platform?: string;
-  autofix_enabled?: boolean;
   record_messages?: boolean;
 }
 
diff --git a/packages/frontend/src/services/api/analytics.ts b/packages/frontend/src/services/api/analytics.ts
index d2d727e7..11f4c585 100644
--- a/packages/frontend/src/services/api/analytics.ts
+++ b/packages/frontend/src/services/api/analytics.ts
@@ -64,14 +64,14 @@ export function getConnectionAttemptStatusTimeseries(
   range = '24h',
   label?: string,
   connectionId?: string,
-): Promise<AutofixTimeseries> {
+): Promise<StatusTimeseries> {
   return fetchJson('/provider-analytics/attempt-status-timeseries', {
     auth_type: authType,
     provider,
     range,
     ...(label !== undefined ? { label } : {}),
     ...(connectionId ? { connection_id: connectionId } : {}),
-  }) as Promise<AutofixTimeseries>;
+  }) as Promise<StatusTimeseries>;
 }
 
 /** Attempts by HTTP status over time for ONE connection. */
@@ -81,14 +81,14 @@ export function getConnectionAttemptHttpStatusTimeseries(
   range = '24h',
   label?: string,
   connectionId?: string,
-): Promise<AutofixTimeseries> {
+): Promise<StatusTimeseries> {
   return fetchJson('/provider-analytics/attempt-http-status-timeseries', {
     auth_type: authType,
     provider,
     range,
     ...(label !== undefined ? { label } : {}),
     ...(connectionId ? { connection_id: connectionId } : {}),
-  }) as Promise<AutofixTimeseries>;
+  }) as Promise<StatusTimeseries>;
 }
 
 export interface ConnectionAttemptBreakdown {
@@ -97,8 +97,6 @@ export interface ConnectionAttemptBreakdown {
   failed: number;
   fallback_retries: number;
   fallback_retries_succeeded: number;
-  autofix_attempts: number;
-  autofix_attempts_succeeded: number;
 }
 
 /** Header-card breakdown for ONE connection (totals + retry families). */
@@ -271,45 +269,35 @@ export interface AttemptTimeseries {
 }
 
 // ---------------------------------------------------------------------------
-// Autofix analytics
+// Request reliability
 // ---------------------------------------------------------------------------
 
-export interface AutofixStatus {
-  any_enabled: boolean;
-  enabled_agents: string[];
-  /** Agents effectively running without Autofix after deployment-mode defaults. */
-  disabled_agents: string[];
-  /** True only when legacy/unconfigured agents need the fleet enable action. */
-  needs_enable_all: boolean;
-  /** Self-hosted consent-once; cloud always true. */
-  consented: boolean;
-}
-
-export interface AutofixStats {
+/**
+ * Request-reliability endpoints. The backend still serves these generic
+ * metrics (success rate, fallback recoveries, per-harness/provider/model
+ * reliability, request status over time) under the legacy Autofix paths
+ * inherited from upstream. #16 moves them to neutral paths when it removes
+ * Autofix from the backend; keeping them here makes that a one-place change.
+ */
+const RELIABILITY_PATHS = {
+  stats: '/overview/autofix-stats',
+  requestStatusTimeseries: '/overview/autofix-timeseries',
+  perAgent: '/overview/autofix-per-agent',
+  perProvider: '/overview/autofix-per-provider',
+  perModel: '/overview/autofix-per-model',
+} as const;
+
+export interface ReliabilityStats {
   success_rate: { value: number; previous: number };
-  autofix_saves: { value: number; previous: number };
-  /** Requests recovered by a successful fallback attempt (additive field). */
+  /** Requests recovered by a successful fallback attempt. */
   fallback_saves: { value: number; previous: number };
-  /** Window total — denominator for the self-healed share (additive field). */
+  /** Window total — denominator for the recovered-requests share. */
   total_requests: { value: number; previous: number };
   errors_remaining: { value: number; previous: number };
-  coverage: { rate: number; previous_rate: number };
-  dispositions: {
-    healed: number;
-    no_fix_found: number;
-    resolving: number;
-    ineffective: number;
-  };
-  needs_attention: Array<{
-    error_message: string;
-    provider: string;
-    model: string;
-    count: number;
-    phoenix_issue_id: string | null;
-  }>;
 }
 
-export interface AutofixTimeseries {
+/** A keyed bucket series: `counts[i]` is the value of `keys[i]` in that bucket. */
+export interface StatusTimeseries {
   range: string;
   by: string;
   keys: string[];
@@ -330,29 +318,26 @@ export function getAttemptTimeseries(range = '7d', agentName?: string): Promise<
   }) as Promise<AttemptTimeseries>;
 }
 
-export function getWorkspaceAutofixStatus(): Promise<AutofixStatus> {
-  return fetchJson('/autofix/status') as Promise<AutofixStatus>;
-}
-
-export function getAutofixStats(range = '7d', agentName?: string): Promise<AutofixStats> {
-  return fetchJson('/overview/autofix-stats', {
+export function getReliabilityStats(range = '7d', agentName?: string): Promise<ReliabilityStats> {
+  return fetchJson(RELIABILITY_PATHS.stats, {
     range,
     ...(agentName ? { agent_name: agentName } : {}),
-  }) as Promise<AutofixStats>;
+  }) as Promise<ReliabilityStats>;
 }
 
-export function getAutofixTimeseries(
+/**
+ * Logical requests over time by final status (`success`, `fallback`,
+ * `error`): the "By request status" chart and its recovered subset.
+ */
+export function getRequestStatusTimeseries(
   range = '7d',
-  by = 'disposition',
   agentName?: string,
-  failedOnly?: boolean,
-): Promise<AutofixTimeseries> {
-  return fetchJson('/overview/autofix-timeseries', {
+): Promise<StatusTimeseries> {
+  return fetchJson(RELIABILITY_PATHS.requestStatusTimeseries, {
     range,
-    by,
+    by: 'disposition',
     ...(agentName ? { agent_name: agentName } : {}),
-    ...(failedOnly ? { failed_only: 'true' } : {}),
-  }) as Promise<AutofixTimeseries>;
+  }) as Promise<StatusTimeseries>;
 }
 
 /**
@@ -371,12 +356,11 @@ export interface ProviderReliabilityRow {
 }
 
 /** One-line definition surfaced by the ⓘ tooltips next to "Recovered requests". */
-export const RECOVERED_REQUESTS_TOOLTIP =
-  'Successful requests that were recovered by Autofix or fallback.';
+export const RECOVERED_REQUESTS_TOOLTIP = 'Successful requests that were recovered by fallback.';
 
-/** Self-healed = recovered by Autofix + recovered by fallback. */
-export function selfHealedCount(row: { autofixed: number; fallback_saves?: number }): number {
-  return row.autofixed + (row.fallback_saves ?? 0);
+/** Recovered = requests that succeeded on a fallback attempt. */
+export function recoveredCount(row: { fallback_saves?: number }): number {
+  return row.fallback_saves ?? 0;
 }
 
 /** Request success rate over the row's window; null when there is no traffic. */
@@ -391,16 +375,9 @@ export function attemptSuccessRate(row: { attempts: number; succeeded?: number }
   return row.succeeded / row.attempts;
 }
 
-/**
- * Total attempts ⓘ: the Doctor version (Autofix) owns the autofixed
- * vocabulary, so tenants without it get the same sentence minus Autofix.
- * House vocabulary: a FALLBACK is a retry; an AUTOFIX produces an attempt.
- */
-export function totalAttemptsTooltip(doctorAvailable: boolean): string {
-  return doctorAvailable
-    ? 'Every provider call counts here, including fallback retries and autofixed attempts. One request can produce several attempts.'
-    : 'Every provider call counts here, including fallback retries. One request can produce several attempts.';
-}
+/** Total attempts ⓘ. House vocabulary: a FALLBACK is a retry. */
+export const TOTAL_ATTEMPTS_TOOLTIP =
+  'Every provider call counts here, including fallback retries. One request can produce several attempts.';
 
 /** Success rate ⓘ texts, one per surface grain. */
 export const MODEL_SUCCESS_RATE_TOOLTIP = 'Successful attempts over all attempts for this model.';
@@ -423,7 +400,7 @@ export function getPerProviderReliability(
   range = '7d',
   agentName?: string,
 ): Promise<ProviderReliabilityRow[]> {
-  return fetchJson('/overview/autofix-per-provider', {
+  return fetchJson(RELIABILITY_PATHS.perProvider, {
     range,
     ...(agentName ? { agent_name: agentName } : {}),
   }) as Promise<ProviderReliabilityRow[]>;
@@ -433,18 +410,17 @@ export interface AgentReliabilityRow {
   agent_name: string;
   requests: number;
   failed: number;
-  autofixed: number;
-  /** Requests recovered by a successful fallback attempt (additive field). */
+  /** Requests recovered by a successful fallback attempt. */
   fallback_saves: number;
   /** Same success definition as the global Success rate KPI (additive field). */
   succeeded: number;
 }
 
 export function getPerAgentReliability(range = '7d'): Promise<AgentReliabilityRow[]> {
-  return fetchJson('/overview/autofix-per-agent', { range }) as Promise<AgentReliabilityRow[]>;
+  return fetchJson(RELIABILITY_PATHS.perAgent, { range }) as Promise<AgentReliabilityRow[]>;
 }
 
-/** Attempt-world reliability for a model: a model is not healed, it acts. */
+/** Attempt-world reliability for a model: every call it served, by outcome. */
 export interface ModelReliabilityRow {
   model: string;
   attempts: number;
@@ -456,7 +432,7 @@ export function getPerModelReliability(
   range = '7d',
   agentName?: string,
 ): Promise<ModelReliabilityRow[]> {
-  return fetchJson('/overview/autofix-per-model', {
+  return fetchJson(RELIABILITY_PATHS.perModel, {
     range,
     ...(agentName ? { agent_name: agentName } : {}),
   }) as Promise<ModelReliabilityRow[]>;
@@ -469,7 +445,6 @@ export interface ErrorBreakdownResponse {
   provider_errors: number;
   transport_errors: number;
   manifest_errors: number;
-  auto_fixed: number;
   by_origin: Record<string, number>;
   by_class: Record<string, number>;
   provider_error_rate: number;
diff --git a/packages/frontend/src/services/api/messages.ts b/packages/frontend/src/services/api/messages.ts
index a1d4a84a..e7601977 100644
--- a/packages/frontend/src/services/api/messages.ts
+++ b/packages/frontend/src/services/api/messages.ts
@@ -1,25 +1,4 @@
 import { fetchJson, fetchMutate, type FetchJsonOptions } from './core.js';
-import type { AutofixStatus } from 'manifest-shared';
-
-/** A deterministic edit Phoenix applied to heal a request. */
-export interface AutofixOperation {
-  type: string;
-  from?: string;
-  to?: string;
-}
-
-export interface AutofixDecision {
-  status: string | null;
-  issueId: string | null;
-  patchId: string | null;
-  healAttemptId: string | null;
-  /** Phoenix's human-readable "why" for the fix (null for pre-explanation rows). */
-  explanation?: {
-    summary: string;
-    operations: Array<{ type: string; detail: string }>;
-    source: string;
-  } | null;
-}
 
 export interface AttemptRecording {
   request_body: Record<string, unknown>;
@@ -38,7 +17,6 @@ export interface MessageDetailResponse {
     agent_name: string | null;
     model: string | null;
     status: string;
-    autofix_status: AutofixStatus | null;
     error_message: string | null;
     /** Documented Manifest error code ('M100', 'M300', …). Null for provider failures. */
     error_code: string | null;
@@ -92,13 +70,6 @@ export interface MessageDetailResponse {
       appUrl?: string;
       categories?: string[];
     } | null;
-    autofix_applied: boolean;
-    autofix_role: string | null;
-    autofix_operations: AutofixOperation[] | null;
-    /** Phoenix's decision behind this provider attempt. */
-    autofix_decision: AutofixDecision | null;
-    /** The paired row (failed original ↔ successful retry), for the visual link. */
-    autofix_sibling: { id: string; role: string | null; status: string } | null;
     attempts?: Array<{
       id: string;
       model: string | null;
@@ -117,10 +88,6 @@ export interface MessageDetailResponse {
       fallback_index: number | null;
       request_headers: Record<string, string> | null;
       request_params: Record<string, unknown> | null;
-      autofix_applied: boolean;
-      autofix_role: string | null;
-      autofix_operations: AutofixOperation[] | null;
-      autofix_decision: AutofixDecision | null;
       /** Exact provider-facing payload for this Provider Attempt. */
       recording: AttemptRecording | null;
     }>;
diff --git a/packages/frontend/src/services/api/routing.ts b/packages/frontend/src/services/api/routing.ts
index 2c4ac483..a565ecad 100644
--- a/packages/frontend/src/services/api/routing.ts
+++ b/packages/frontend/src/services/api/routing.ts
@@ -206,26 +206,6 @@ export function toggleComplexity(agentName: string) {
   });
 }
 
-/* -- Routing: Autofix -- */
-
-export interface AutofixConfig {
-  enabled: boolean;
-  /** True once the self-hosted install consented (modal hidden thereafter). */
-  consented?: boolean;
-}
-
-export function getAutofix(agentName: string) {
-  return fetchJson<AutofixConfig>(routingPath(agentName, 'autofix'));
-}
-
-export function updateAutofix(agentName: string, body: { enabled?: boolean }) {
-  return fetchMutate<AutofixConfig>(routingPath(agentName, 'autofix'), {
-    method: 'PATCH',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(body),
-  });
-}
-
 /* -- Routing: Message recording -- */
 
 export interface RecordingConfig {
diff --git a/packages/frontend/src/services/api/version.ts b/packages/frontend/src/services/api/version.ts
deleted file mode 100644
index e43858c6..00000000
--- a/packages/frontend/src/services/api/version.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { fetchJson } from './core.js';
-
-/** Mirrors `VersionInfo` in `packages/backend/src/version/version-check.service.ts`. */
-export interface VersionInfo {
-  current: string;
-  latest: string | null;
-  update_available: boolean;
-  /** Releases published after `current` (capped at 100); null when unknown. */
-  releases_behind: number | null;
-  /** Website changelog anchored at `latest`. */
-  release_url: string | null;
-  github_release_url: string | null;
-  upgrade_docs_url: string;
-  upgrade_command: string;
-  /** False on cloud or when the install opted out of update checks. */
-  check_enabled: boolean;
-  checked_at: string | null;
-}
-
-export function getVersionInfo(): Promise<VersionInfo> {
-  return fetchJson<VersionInfo>('/version');
-}
diff --git a/packages/frontend/src/services/discovery.ts b/packages/frontend/src/services/discovery.ts
deleted file mode 100644
index 43f33401..00000000
--- a/packages/frontend/src/services/discovery.ts
+++ /dev/null
@@ -1,139 +0,0 @@
-/**
- * Self-hosted user discovery onboarding step.
- *
- * Shown once to new self-hosted users right after signup. This module is the
- * frontend contract for the backend endpoints:
- *
- *   GET  /api/v1/discovery/status   -> { required: boolean } (optional)
- *   POST /api/v1/discovery/complete -> { ok: true }
- *        body: { name?, email?, projectType?, companySize? }
- *        (an empty body means the user skipped the form)
- *
- * Completion is persisted per user in localStorage so the step appears
- * exactly once per user on this browser. The complete endpoint forwards
- * non-empty submissions to Peacock; the optional status endpoint can replace
- * the local fallback later if completion needs to follow a user across browsers.
- */
-
-export interface DiscoverySubmission {
-  name?: string;
-  email?: string;
-  projectType?: string;
-  companySize?: string;
-}
-
-export interface DiscoveryOption {
-  label: string;
-  value: string;
-}
-
-export const PROJECT_TYPE_OPTIONS: DiscoveryOption[] = [
-  { label: 'AI product or application', value: 'ai_product' },
-  { label: 'AI agent', value: 'ai_agent' },
-  { label: 'Internal AI tool or automation', value: 'internal_tool' },
-  { label: 'AI workflow / automation platform', value: 'workflow_platform' },
-  { label: 'Personal project / experimentation', value: 'personal_project' },
-  { label: 'Other', value: 'other' },
-];
-
-export const COMPANY_SIZE_OPTIONS: DiscoveryOption[] = [
-  { label: "I'm not using Manifest for work", value: 'not_for_work' },
-  { label: '1–20', value: '1-20' },
-  { label: '21–100', value: '21-100' },
-  { label: '101–500', value: '101-500' },
-  { label: '501–1,000', value: '501-1000' },
-  { label: '1,000+', value: '1000+' },
-];
-
-const PREFIX = 'manifest_discovery_done_';
-const PENDING_PREFIX = 'manifest_discovery_pending_';
-
-export function markDiscoveryDoneLocally(userId: string): void {
-  try {
-    localStorage.setItem(`${PREFIX}${userId}`, '1');
-    localStorage.removeItem(`${PENDING_PREFIX}${userId}`);
-  } catch {
-    /* storage full or unavailable */
-  }
-}
-
-/**
- * Record at signup that this user still has the discovery step ahead, along
- * with where the flow continues afterwards. The guards use this to send the
- * user back to the form (browser Back, manual navigation) until it is
- * completed or skipped.
- */
-export function markDiscoveryPending(userId: string, next: string): void {
-  if (!userId) return;
-  try {
-    localStorage.setItem(`${PENDING_PREFIX}${userId}`, next);
-  } catch {
-    /* storage full or unavailable */
-  }
-}
-
-/** The pending `next` destination, or null when nothing is pending. */
-export function getDiscoveryPendingNext(userId: string): string | null {
-  if (!userId) return null;
-  try {
-    if (localStorage.getItem(`${PREFIX}${userId}`) === '1') return null;
-    return localStorage.getItem(`${PENDING_PREFIX}${userId}`);
-  } catch {
-    return null;
-  }
-}
-
-export function hasDiscoveryBeenDoneLocally(userId: string): boolean {
-  try {
-    return localStorage.getItem(`${PREFIX}${userId}`) === '1';
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Whether the discovery step should be shown to this user. The local done
- * flag wins when present; otherwise the backend is asked. A `required: false`
- * answer is cached as local completion so the guards stop redirecting here.
- * When the endpoint is unreachable or not deployed yet, only users holding a
- * signup pending marker see the step, so existing users who open /discovery
- * by hand are never trapped.
- */
-export async function isDiscoveryRequired(userId: string): Promise<boolean> {
-  if (hasDiscoveryBeenDoneLocally(userId)) return false;
-  try {
-    const res = await fetch('/api/v1/discovery/status', {
-      credentials: 'include',
-      cache: 'no-store',
-    });
-    if (!res.ok) return getDiscoveryPendingNext(userId) !== null;
-    const data = (await res.json()) as { required?: boolean };
-    if (data.required === true) return true;
-    markDiscoveryDoneLocally(userId);
-    return false;
-  } catch {
-    return getDiscoveryPendingNext(userId) !== null;
-  }
-}
-
-/**
- * Record the step as done (submit and skip both land here — skip sends an
- * empty submission). The local flag is written first so the user is never
- * shown the form again even if the backend call fails or does not exist yet.
- */
-export async function completeDiscovery(
-  userId: string,
-  submission: DiscoverySubmission,
-): Promise<void> {
-  markDiscoveryDoneLocally(userId);
-  try {
-    await fetch('/api/v1/discovery/complete', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      credentials: 'include',
-      body: JSON.stringify(submission),
-    });
-  } catch {
-    /* endpoint unavailable — the local flag already recorded completion */
-  }
-}
diff --git a/packages/frontend/src/services/formatters.ts b/packages/frontend/src/services/formatters.ts
index 65fe0b21..b19c41af 100644
--- a/packages/frontend/src/services/formatters.ts
+++ b/packages/frontend/src/services/formatters.ts
@@ -79,7 +79,6 @@ const STATUS_LABELS: Record<string, string> = {
   // column stays the simple Success/Failed it was before.
   rate_limited: 'Failed',
   fallback_error: 'Handled',
-  auto_fixed: 'Autofixed',
 };
 
 export function formatStatus(status: string): string {
diff --git a/packages/frontend/src/styles/agents.css b/packages/frontend/src/styles/agents.css
index 5f46b22c..361bc104 100644
--- a/packages/frontend/src/styles/agents.css
+++ b/packages/frontend/src/styles/agents.css
@@ -188,25 +188,6 @@
   overflow: hidden;
 }
 
-.settings-card--highlight {
-  animation: settings-highlight-blink 1.5s ease;
-}
-
-@keyframes settings-highlight-blink {
-  0% {
-    background: hsl(var(--card));
-  }
-  15% {
-    background: hsl(38, 92%, 50%, 0.15);
-  }
-  70% {
-    background: hsl(38, 92%, 50%, 0.15);
-  }
-  100% {
-    background: hsl(var(--card));
-  }
-}
-
 .settings-card__row {
   display: flex;
   align-items: center;
@@ -324,7 +305,7 @@
   padding: var(--gap-md) var(--gap-lg);
 }
 
-/* ── Settings toggle switch (e.g. Autofix) ─────────── */
+/* ── Settings toggle switch (e.g. message recording) ── */
 .settings-switch {
   display: inline-flex;
   align-items: center;
diff --git a/packages/frontend/src/styles/analytics-overview.css b/packages/frontend/src/styles/analytics-overview.css
index 46d2fb6c..566209e4 100644
--- a/packages/frontend/src/styles/analytics-overview.css
+++ b/packages/frontend/src/styles/analytics-overview.css
@@ -109,34 +109,17 @@
   top: -5px;
 }
 
-/* Accent variants: each recovery KPI wears its chart series colour (blue =
-   recovered by Autofix, teal green = recovered by fallback) and the failed
-   card reads destructive, label included.
+/* Accent variants: the recovery KPI wears its chart series colour (teal
+   green = recovered by fallback) and the failed card reads destructive,
+   label included.
 
    The backgrounds are three layers in one `background-image` (the house recipe —
-   the autofix/fallback icon squares are built the same way, card-sized):
+   the fallback icon square is built the same way, card-sized):
    1. a diagonal fade of the card's colour toward transparent,
    2. a denser, darker glow anchored in the top-right corner (the "blurred
       shape" — a radial does it without an extra node or a GPU blur),
    3. a faint echo in the opposite corner for mesh-like depth.
    The glow sits opposite the text, so values keep their contrast. */
-.overview-stat-card--autofix {
-  background-color: hsl(var(--card));
-  background-image:
-    radial-gradient(ellipse 90% 95% at 100% 0%, rgba(21, 30, 180, 0.2), transparent 55%),
-    radial-gradient(ellipse 70% 80% at 0% 100%, rgba(38, 50, 239, 0.07), transparent 50%),
-    linear-gradient(135deg, rgba(38, 50, 239, 0.13), rgba(38, 50, 239, 0));
-  border-color: rgba(38, 50, 239, 0.25);
-}
-
-.overview-stat-card--autofix:hover {
-  border-color: rgba(38, 50, 239, 0.45);
-}
-
-.overview-stat-card--autofix .overview-stat-card__value {
-  color: #2632ef;
-}
-
 .overview-stat-card--fallback {
   background-color: hsl(var(--card));
   background-image:
@@ -173,19 +156,6 @@
 
 /* Dark mode: quieter fades (the dark card does the work), brighter glows
    (on a dark ground it is the glow that carries the colour). */
-.dark .overview-stat-card--autofix {
-  background-color: hsl(var(--card));
-  background-image:
-    radial-gradient(ellipse 90% 95% at 100% 0%, rgba(80, 95, 255, 0.28), transparent 55%),
-    radial-gradient(ellipse 70% 80% at 0% 100%, rgba(38, 50, 239, 0.1), transparent 50%),
-    linear-gradient(135deg, rgba(38, 50, 239, 0.16), rgba(38, 50, 239, 0));
-  border-color: rgba(99, 112, 255, 0.35);
-}
-
-.dark .overview-stat-card--autofix .overview-stat-card__value {
-  color: #8f9bff;
-}
-
 .dark .overview-stat-card--fallback {
   background-color: hsl(var(--card));
   background-image:
diff --git a/packages/frontend/src/styles/cards.css b/packages/frontend/src/styles/cards.css
index 664fb71a..1ad4ad2b 100644
--- a/packages/frontend/src/styles/cards.css
+++ b/packages/frontend/src/styles/cards.css
@@ -224,26 +224,3 @@
   box-shadow: 0 1px 2px 0 rgb(0 0 0 / 0.06);
   font-weight: 600;
 }
-
-/* ── Info Card (Autofix Extension Prompt) ──────────── */
-.settings-card--info {
-  background: hsl(var(--muted));
-  border: 1px solid hsl(var(--primary) / 0.3);
-}
-
-.info-card__content {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: var(--gap-md);
-  padding: var(--gap-md);
-  flex-wrap: wrap;
-}
-
-.info-card__text {
-  margin: 0;
-  font-size: var(--font-size-sm);
-  font-weight: 500;
-  color: hsl(var(--foreground));
-  flex: 1 1 auto;
-}
diff --git a/packages/frontend/src/styles/controls.css b/packages/frontend/src/styles/controls.css
index 23e1e345..4b123f0a 100644
--- a/packages/frontend/src/styles/controls.css
+++ b/packages/frontend/src/styles/controls.css
@@ -509,190 +509,3 @@
   border-color: hsl(var(--ring) / 0.3);
   background: hsl(var(--muted));
 }
-
-/* ── Wingman dev tools (dev-only) ─────────────────── */
-/* Floating action button — bottom-right when drawer is closed.        */
-/* Pink gradient so contributors notice it but never confuse it with   */
-/* the rest of the dashboard chrome.                                   */
-.wingman-fab {
-  position: fixed;
-  bottom: 22px;
-  right: 22px;
-  z-index: 8000;
-  display: inline-flex;
-  align-items: center;
-  gap: 8px;
-  height: 44px;
-  padding: 0 18px 0 14px;
-  border: none;
-  border-radius: 999px;
-  background: linear-gradient(135deg, #ec4899, #db2777);
-  color: white;
-  font-family: var(--font-family);
-  font-size: 13px;
-  font-weight: 600;
-  letter-spacing: 0.2px;
-  cursor: pointer;
-  box-shadow:
-    0 6px 20px rgba(236, 72, 153, 0.32),
-    0 1px 3px rgba(0, 0, 0, 0.12);
-  transition:
-    transform 0.12s ease,
-    box-shadow 0.18s ease,
-    background 0.15s ease;
-}
-
-.wingman-fab:hover {
-  background: linear-gradient(135deg, #db2777, #be185d);
-  box-shadow:
-    0 10px 28px rgba(236, 72, 153, 0.42),
-    0 2px 6px rgba(0, 0, 0, 0.15);
-  transform: translateY(-1px);
-}
-
-.wingman-fab:active {
-  transform: translateY(0);
-}
-
-.wingman-fab__label {
-  line-height: 1;
-}
-
-@media (max-width: 540px) {
-  .wingman-fab__label {
-    display: none;
-  }
-  .wingman-fab {
-    width: 44px;
-    padding: 0;
-    justify-content: center;
-  }
-}
-
-/* Slide-up drawer — DevTools-style.                                   */
-.wingman-drawer {
-  position: fixed;
-  left: 0;
-  right: 0;
-  bottom: 0;
-  z-index: 8000;
-  display: flex;
-  flex-direction: column;
-  background: hsl(var(--background));
-  border-top: 1px solid hsl(var(--border));
-  box-shadow: 0 -10px 40px rgba(0, 0, 0, 0.18);
-  animation: wingman-drawer-in 0.22s cubic-bezier(0.16, 1, 0.3, 1);
-  min-height: 200px;
-}
-
-.wingman-drawer--resizing {
-  user-select: none;
-}
-
-.wingman-drawer--resizing iframe {
-  pointer-events: none;
-}
-
-@keyframes wingman-drawer-in {
-  from {
-    transform: translateY(100%);
-    opacity: 0.6;
-  }
-  to {
-    transform: translateY(0);
-    opacity: 1;
-  }
-}
-
-.wingman-drawer__resizer {
-  height: 6px;
-  margin-top: -3px;
-  cursor: ns-resize;
-  position: relative;
-  flex-shrink: 0;
-}
-
-.wingman-drawer__resizer::before {
-  content: '';
-  position: absolute;
-  left: 50%;
-  top: 50%;
-  transform: translate(-50%, -50%);
-  width: 36px;
-  height: 4px;
-  border-radius: 2px;
-  background: hsl(var(--border));
-  transition: background 0.15s;
-}
-
-.wingman-drawer__resizer:hover::before,
-.wingman-drawer--resizing .wingman-drawer__resizer::before {
-  background: #ec4899;
-}
-
-.wingman-drawer__head {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  padding: 6px 12px 6px 16px;
-  border-bottom: 1px solid hsl(var(--border));
-  background: hsl(var(--card));
-  flex-shrink: 0;
-}
-
-.wingman-drawer__title {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  min-width: 0;
-}
-
-.wingman-drawer__title strong {
-  font-size: 13px;
-  color: hsl(var(--foreground));
-}
-
-.wingman-drawer__sub {
-  font-size: 11px;
-  color: hsl(var(--muted-foreground));
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-.wingman-drawer__actions {
-  display: flex;
-  align-items: center;
-  gap: 4px;
-  flex-shrink: 0;
-}
-
-.wingman-drawer__icon-btn {
-  width: 28px;
-  height: 28px;
-  display: grid;
-  place-items: center;
-  border: 1px solid transparent;
-  background: transparent;
-  border-radius: 6px;
-  color: hsl(var(--muted-foreground));
-  cursor: pointer;
-  text-decoration: none;
-  transition:
-    background 0.12s,
-    color 0.12s,
-    border-color 0.12s;
-}
-
-.wingman-drawer__icon-btn:hover {
-  background: hsl(var(--muted));
-  color: hsl(var(--foreground));
-  border-color: hsl(var(--border));
-}
-
-.wingman-drawer__frame {
-  flex: 1;
-  width: 100%;
-  border: none;
-  background: hsl(var(--background));
-}
diff --git a/packages/frontend/src/styles/data.css b/packages/frontend/src/styles/data.css
index 8cfac780..1d155217 100644
--- a/packages/frontend/src/styles/data.css
+++ b/packages/frontend/src/styles/data.css
@@ -102,13 +102,6 @@
   cursor: pointer;
 }
 
-/* Autofix: the failed original of a healed pair. Orange (not red) — it failed
-   but was recovered. */
-.status-badge--auto_fixed {
-  background: hsl(25 95% 53% / 0.15);
-  color: hsl(25 95% 44%);
-}
-
 /* ── Trigger badges (Trigger column) ─────────────────────────────────── */
 
 .trigger-badge {
@@ -128,24 +121,6 @@
   cursor: pointer;
 }
 
-/* Autofix icon: white sparkle inside a multi-shape gradient square */
-.autofix-icon {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 18px;
-  height: 18px;
-  flex-shrink: 0;
-  border-radius: 4px;
-  background:
-    radial-gradient(ellipse 220% 200% at 95% 0%, rgba(73, 207, 202, 0.9) 0%, transparent 50%),
-    radial-gradient(ellipse 120% 110% at 5% 15%, rgba(66, 80, 255, 0.85) 0%, transparent 45%),
-    radial-gradient(ellipse 200% 180% at 55% 105%, rgba(255, 60, 140, 0.6) 0%, transparent 55%),
-    radial-gradient(ellipse 130% 110% at 30% 50%, rgba(90, 70, 255, 0.55) 0%, transparent 45%);
-  background-color: #4535c9;
-  color: #fff;
-}
-
 /* Fallback icon: gradient square with warm/yellow tones */
 .fallback-icon {
   display: inline-flex;
@@ -175,26 +150,17 @@
   flex-shrink: 0;
 }
 
-.recovery-opt-icon .autofix-icon,
 .recovery-opt-icon .fallback-icon {
   width: 14px;
   height: 14px;
   border-radius: 3px;
 }
 
-.recovery-opt-icon .autofix-icon svg,
 .recovery-opt-icon .fallback-icon svg {
   width: 9px;
   height: 9px;
 }
 
-.recovery-opt-icon__plus {
-  font-size: 10px;
-  font-weight: 600;
-  color: hsl(var(--muted-foreground));
-  line-height: 1;
-}
-
 .recovery-opt-icon__none {
   color: hsl(var(--destructive));
   display: inline-flex;
@@ -211,19 +177,6 @@ a.status-badge:hover {
   text-decoration: underline;
 }
 
-@keyframes msg-highlight-flash {
-  0% {
-    background: hsl(38 92% 50% / 0.15);
-  }
-  100% {
-    background: transparent;
-  }
-}
-
-.data-table tr.msg-highlight {
-  animation: msg-highlight-flash 2s ease-out;
-}
-
 /* ── Status Badge Error Tooltip ──────────────────── */
 .status-badge-tooltip {
   position: relative;
@@ -1076,132 +1029,60 @@ table.msg-detail__table td {
   vertical-align: middle;
 }
 
-/* ── Autofix card (accordion detail) ─────────────────────────────────── */
+/* ── Recovery card (accordion detail) ─────────────────────────────────── */
 
-.autofix-card-row {
+.recovery-card-row {
   display: block;
   margin-bottom: 12px;
 }
 
-.autofix-card {
+.recovery-card {
   max-width: 50%;
   padding: 12px 16px;
 }
 
-.autofix-card--autofix {
-  background: hsl(222 47% 50% / 0.06);
-  border: 1px solid hsl(222 47% 50% / 0.3);
-}
-
-.autofix-card--fallback {
+.recovery-card--fallback {
   background: hsl(36 80% 60% / 0.08);
   border: 1px solid hsl(36 80% 50% / 0.3);
 }
 
-.autofix-card__header {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 12px;
-}
-
-.autofix-card__branding {
+.recovery-card__branding {
   display: inline-flex;
   align-items: center;
   gap: 6px;
 }
 
-.autofix-card__title {
+.recovery-card__title {
   font-family: var(--font-heading);
   font-weight: 700;
   font-size: var(--font-size-sm);
   color: hsl(var(--foreground));
 }
 
-.autofix-card__sibling-btn {
-  background: none;
-  border: 1px solid hsl(var(--border));
-  border-radius: 4px;
-  padding: 4px 12px;
-  font-family: var(--font-body);
-  font-size: var(--font-size-xs);
-  font-weight: 500;
-  color: hsl(var(--foreground));
-  cursor: pointer;
-  white-space: nowrap;
-  transition: all 0.15s ease;
-}
-
-.autofix-card__sibling-btn:hover {
-  background: hsl(var(--accent));
-  border-color: hsl(var(--accent));
-}
-
-.autofix-card__phrase {
+.recovery-card__phrase {
   margin: 8px 0 0;
   font-size: var(--font-size-sm);
   color: hsl(var(--muted-foreground));
   line-height: 1.5;
 }
 
-.autofix-card__ops {
-  display: flex;
-  flex-direction: column;
-  gap: 6px;
-  margin-top: 10px;
-}
+/* ── Error + recovery side-by-side row ────────────────────────────────── */
 
-.autofix-card__op {
-  display: flex;
-  align-items: baseline;
-  gap: 8px;
-  font-size: var(--font-size-xs);
-}
-
-.autofix-card__op-type {
-  font-family: var(--font-mono);
-  font-weight: 600;
-  color: hsl(var(--foreground));
-  white-space: nowrap;
-}
-
-.autofix-card__op-desc {
-  color: hsl(var(--muted-foreground));
-}
-
-.autofix-card__ids {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 12px;
-  margin-top: 10px;
-  padding-top: 8px;
-  border-top: 1px solid hsl(var(--border));
-  font-family: var(--font-mono);
-  font-size: var(--font-size-xs);
-  color: hsl(var(--muted-foreground) / 0.6);
-}
-
-/* ── Error + Autofix side-by-side row ────────────────────────────────── */
-
-.error-autofix-row {
+.error-recovery-row {
   display: grid;
   grid-template-columns: 1fr 36px 1fr;
   margin-bottom: 12px;
 }
 
-.error-autofix-row--solo {
+.error-recovery-row--solo {
   grid-template-columns: 1fr;
 }
 
-.error-autofix-row--triple {
-  grid-template-columns: 1fr 36px 1fr 36px 1fr;
-}
-
-.error-autofix-row__error--full {
+.error-recovery-row__error--full {
   border-right: 1px solid hsl(var(--destructive) / 0.25);
 }
 
-.error-autofix-row__error {
+.error-recovery-row__error {
   min-width: 0;
   max-width: 100%;
   overflow: hidden;
@@ -1210,7 +1091,7 @@ table.msg-detail__table td {
   border: 1px solid hsl(var(--destructive) / 0.25);
 }
 
-.error-autofix-row__title {
+.error-recovery-row__title {
   font-size: var(--font-size-xs);
   font-weight: 600;
   color: hsl(var(--foreground));
@@ -1219,21 +1100,21 @@ table.msg-detail__table td {
   margin-bottom: 8px;
 }
 
-.error-autofix-row__arrow {
+.error-recovery-row__arrow {
   display: flex;
   align-items: center;
   justify-content: center;
   color: hsl(var(--muted-foreground));
 }
 
-.error-autofix-row__arrow-right {
+.error-recovery-row__arrow-right {
   display: block;
 }
-.error-autofix-row__arrow-down {
+.error-recovery-row__arrow-down {
   display: none;
 }
 
-.error-autofix-row__autofix {
+.error-recovery-row__card {
   min-width: 0;
   max-width: 100%;
   overflow: hidden;
@@ -1242,75 +1123,38 @@ table.msg-detail__table td {
   border: 1px solid hsl(var(--border));
 }
 
-.error-autofix-row__autofix--autofix {
-  background: hsl(222 47% 50% / 0.06);
-  border-color: hsl(222 47% 50% / 0.3);
-}
-
-.error-autofix-row__autofix--fallback {
+.error-recovery-row__card--fallback {
   background: hsl(36 80% 60% / 0.08);
   border-color: hsl(36 80% 50% / 0.3);
 }
 
 @media (max-width: 900px) {
-  .error-autofix-row,
-  .error-autofix-row--triple {
+  .error-recovery-row {
     grid-template-columns: 1fr;
     grid-template-rows: auto;
   }
-  .error-autofix-row__arrow-right {
+  .error-recovery-row__arrow-right {
     display: none;
   }
-  .error-autofix-row__arrow-down {
+  .error-recovery-row__arrow-down {
     display: block;
   }
 }
 
-.error-autofix-row__autofix-title {
+.error-recovery-row__card-title {
   display: inline-flex;
   align-items: center;
   gap: 6px;
   margin-bottom: 8px;
 }
 
-.error-autofix-row__autofix-text {
+.error-recovery-row__card-text {
   font-size: var(--font-size-xs);
   color: hsl(var(--muted-foreground));
   margin: 0 0 10px;
   line-height: 1.4;
 }
 
-.error-autofix-row__autofix-btn {
-  display: inline-flex;
-  align-items: center;
-  gap: 6px;
-  padding: 6px 14px;
-  border: none;
-  border-radius: 3px;
-  background: hsl(var(--primary));
-  color: hsl(var(--primary-foreground));
-  font-family: var(--font-body);
-  font-size: var(--font-size-xs);
-  font-weight: 500;
-  cursor: pointer;
-  transition: opacity 0.15s ease;
-}
-
-.error-autofix-row__autofix-btn:hover {
-  opacity: 0.85;
-}
-
-.error-autofix-row__autofix-btn--secondary {
-  background: hsl(var(--card));
-  color: hsl(var(--foreground));
-  border: 1px solid hsl(var(--border));
-}
-
-.error-autofix-row__autofix-btn--secondary:hover {
-  opacity: 1;
-  border-color: hsl(var(--ring));
-}
-
 /* ── Error inline + meta table (shared) ──────────────────────────────── */
 
 .msg-detail__error-inline {
@@ -1344,7 +1188,7 @@ table.msg-detail__table td {
   text-decoration: none;
 }
 
-.error-autofix-row__meta-table {
+.error-recovery-row__meta-table {
   /* Single source for EVERY border of the table (outer frame, row dividers,
      label column divider). Contextual cards override the variable so the
      table always matches its card's border color. */
@@ -1359,19 +1203,15 @@ table.msg-detail__table td {
 }
 
 /* Contextual table borders — inherit from parent card color */
-.error-autofix-row__error .error-autofix-row__meta-table {
+.error-recovery-row__error .error-recovery-row__meta-table {
   --meta-table-border: hsl(var(--destructive) / 0.25);
 }
-.error-autofix-row__autofix--autofix .error-autofix-row__meta-table,
-.autofix-card--autofix .error-autofix-row__meta-table {
-  --meta-table-border: hsl(222 47% 50% / 0.3);
-}
-.error-autofix-row__autofix--fallback .error-autofix-row__meta-table,
-.autofix-card--fallback .error-autofix-row__meta-table {
+.error-recovery-row__card--fallback .error-recovery-row__meta-table,
+.recovery-card--fallback .error-recovery-row__meta-table {
   --meta-table-border: hsl(36 80% 50% / 0.3);
 }
 
-.error-autofix-row__meta-table td {
+.error-recovery-row__meta-table td {
   padding: 4px 10px;
   font-size: var(--font-size-xs);
   vertical-align: top;
@@ -1379,11 +1219,11 @@ table.msg-detail__table td {
   white-space: break-spaces;
 }
 
-.error-autofix-row__meta-table tr:last-child td {
+.error-recovery-row__meta-table tr:last-child td {
   border-bottom: none;
 }
 
-.error-autofix-row__meta-label {
+.error-recovery-row__meta-label {
   font-weight: 600;
   color: hsl(var(--foreground));
   width: 60px;
@@ -1391,24 +1231,24 @@ table.msg-detail__table td {
   border-right: 1px solid var(--meta-table-border);
 }
 
-.error-autofix-row__meta-value {
+.error-recovery-row__meta-value {
   color: hsl(var(--foreground));
 }
 
-.error-autofix-row__meta-hint,
-.error-autofix-row__autofix-text,
+.error-recovery-row__meta-hint,
+.error-recovery-row__card-text,
 .msg-detail__error-inline span,
-.error-autofix-row__meta-value strong {
+.error-recovery-row__meta-value strong {
   overflow-wrap: anywhere;
   word-break: break-word;
   white-space: pre-wrap;
 }
 
-.error-autofix-row__meta-value strong {
+.error-recovery-row__meta-value strong {
   font-weight: 600;
 }
 
-.error-autofix-row__meta-hint {
+.error-recovery-row__meta-hint {
   display: block;
   color: hsl(var(--muted-foreground));
   font-weight: 400;
diff --git a/packages/frontend/src/styles/discovery.css b/packages/frontend/src/styles/discovery.css
deleted file mode 100644
index 2f9d2d2d..00000000
--- a/packages/frontend/src/styles/discovery.css
+++ /dev/null
@@ -1,108 +0,0 @@
-/* ── Self-hosted user discovery step (Discovery.tsx) ── */
-
-/* Two-column modal card: intro 40% left, form 60% right */
-.discovery-card {
-  width: 100%;
-  max-width: 860px;
-  display: flex;
-  align-items: stretch;
-  background: hsl(var(--card));
-  border: 1px solid hsl(var(--border));
-  border-radius: 12px;
-  box-shadow: var(--card-shadow);
-  overflow: hidden;
-  animation: fadeInUp 300ms ease-out both;
-}
-
-.discovery-card__intro {
-  flex: 0 0 40%;
-  display: flex;
-  flex-direction: column;
-  gap: var(--gap-md);
-  padding: var(--gap-xl);
-  text-align: left;
-  border-right: 1px solid hsl(var(--border));
-}
-
-.discovery-card__logo {
-  text-align: left;
-  margin-bottom: var(--gap-xs);
-}
-
-.discovery-card__title {
-  font-size: var(--font-size-xl);
-  font-weight: 700;
-  color: hsl(var(--foreground));
-  letter-spacing: -0.025em;
-  line-height: 1.2;
-}
-
-/* Muted intro copy */
-.discovery-card__desc {
-  display: flex;
-  flex-direction: column;
-  gap: var(--gap-sm);
-  font-size: var(--font-size-md);
-  color: hsl(var(--muted-foreground));
-  line-height: 1.55;
-}
-
-.discovery-card__desc strong {
-  font-weight: 600;
-  color: hsl(var(--foreground));
-}
-
-.discovery-card__form {
-  flex: 1;
-  min-width: 0;
-  padding: var(--gap-xl);
-}
-
-.discovery-card__form .auth-form {
-  margin-bottom: 0;
-}
-
-/* Selects sized to match .auth-form__input (2.75rem, full width) */
-.discovery-form .custom-select {
-  display: block;
-  width: 100%;
-}
-
-.discovery-form .custom-select__trigger {
-  width: 100%;
-  height: 2.75rem;
-  padding: 0 var(--gap-md);
-  background: hsl(var(--background));
-  border-color: hsl(var(--input));
-}
-
-.discovery-form .custom-select__trigger--open {
-  border-color: hsl(var(--primary));
-  box-shadow: 0 0 0 2px hsl(var(--primary) / 0.15);
-}
-
-/* Unselected selects read as placeholders, like input placeholder text */
-.discovery-select--empty .custom-select__value {
-  color: hsl(var(--muted-foreground) / 0.6);
-}
-
-/* Footer: Skip bottom-left, Continue (fit-content) bottom-right */
-.discovery-actions {
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-  gap: var(--gap-sm);
-  margin-top: var(--gap-sm);
-}
-
-@media (max-width: 720px) {
-  .discovery-card {
-    flex-direction: column;
-  }
-
-  .discovery-card__intro {
-    flex: none;
-    border-right: none;
-    border-bottom: 1px solid hsl(var(--border));
-  }
-}
diff --git a/packages/frontend/src/styles/modals.css b/packages/frontend/src/styles/modals.css
index 5a050635..de65a99f 100644
--- a/packages/frontend/src/styles/modals.css
+++ b/packages/frontend/src/styles/modals.css
@@ -185,74 +185,6 @@
   font-weight: 600;
 }
 
-.autofix-consent__legal {
-  color: hsl(var(--muted-foreground));
-  font-size: var(--font-size-xs);
-  line-height: 1.5;
-}
-
-.autofix-consent__agents-label {
-  font-size: var(--font-size-sm);
-  font-weight: 600;
-  color: hsl(var(--foreground));
-  margin-bottom: 6px;
-}
-
-.autofix-consent__agents {
-  display: flex;
-  flex-direction: column;
-  margin-bottom: var(--gap-lg);
-  max-height: min(280px, 40vh);
-  overflow-y: auto;
-}
-
-/* Flat list rows split by hairlines (the model-picker idiom), not one card
-   per agent — the list must stay compact with 10-20 agents. */
-.autofix-consent__agent-row {
-  display: flex;
-  align-items: center;
-  gap: var(--gap-sm);
-  padding: var(--gap-sm) 4px;
-  border-top: 1px solid hsl(var(--border) / 0.5);
-}
-
-.autofix-consent__agent-row:first-child {
-  border-top: none;
-}
-
-/* aria-disabled replaces disabled on the saving switch (focus-trap safety);
-   mirror the .settings-switch:disabled look. */
-.autofix-consent__agent-row .settings-switch[aria-disabled='true'] {
-  opacity: 0.6;
-  cursor: not-allowed;
-}
-
-.autofix-consent__agent-icon {
-  width: 20px;
-  height: 20px;
-  flex-shrink: 0;
-}
-
-.dark .autofix-consent__agent-icon[src*='openai'],
-.dark .autofix-consent__agent-icon[src*='anthropic'],
-.dark .autofix-consent__agent-icon[src*='vercel'],
-.dark .autofix-consent__agent-icon[src*='opencode'],
-.dark .autofix-consent__agent-icon[src*='codex'],
-.dark .autofix-consent__agent-icon[src*='other'] {
-  filter: invert(1);
-}
-
-.autofix-consent__agent-name {
-  flex: 1;
-  min-width: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  font-size: var(--font-size-sm);
-  color: hsl(var(--foreground));
-}
-
-.autofix-consent__legal a,
 .modal-card__desc a {
   color: hsl(var(--foreground));
   font-weight: 600;
@@ -594,18 +526,3 @@
 .add-agent-toggles__header {
   margin-top: 0;
 }
-
-.add-agent-legal {
-  margin-top: var(--gap-sm);
-}
-
-/* Legal line under a Settings card (Autofix section). The card drops its
-   own bottom margin so the mention reads as attached to it. */
-.settings-card--flush {
-  margin-bottom: 0;
-}
-
-.settings-card__legal {
-  margin-top: var(--gap-sm);
-  margin-bottom: var(--gap-lg);
-}
diff --git a/packages/frontend/src/styles/notifications-bell.css b/packages/frontend/src/styles/notifications-bell.css
deleted file mode 100644
index ae6597b8..00000000
--- a/packages/frontend/src/styles/notifications-bell.css
+++ /dev/null
@@ -1,92 +0,0 @@
-.notif-dropdown {
-  position: absolute;
-  top: calc(100% + 8px);
-  right: 0;
-  min-width: 400px;
-  max-width: 50vh;
-  max-height: 50vh;
-  background: hsl(var(--card));
-  border: 1px solid hsl(var(--border));
-  border-radius: var(--radius);
-  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.12);
-  z-index: 200;
-  overflow: hidden;
-  display: flex;
-  flex-direction: column;
-}
-
-@media (max-width: 768px) {
-  .notif-dropdown {
-    min-width: unset;
-    max-width: 100vw;
-    left: 0;
-    right: 0;
-    position: fixed;
-    top: 68px;
-    border-radius: 0;
-  }
-}
-
-.notif-dropdown__header {
-  padding: 12px 16px;
-  font-size: var(--font-size-sm);
-  font-weight: 700;
-  color: hsl(var(--foreground));
-  border-bottom: 1px solid hsl(var(--border));
-  flex-shrink: 0;
-}
-
-.notif-dropdown__list {
-  overflow-y: auto;
-  flex: 1;
-}
-
-.notif-dropdown__item {
-  display: flex;
-  align-items: flex-start;
-  gap: 10px;
-  padding: 12px 16px;
-  border-bottom: 1px solid hsl(var(--border));
-  text-decoration: none;
-  color: hsl(var(--foreground));
-  transition: background 0.15s ease;
-  cursor: pointer;
-}
-
-.notif-dropdown__item:last-child {
-  border-bottom: none;
-}
-
-.notif-dropdown__item:hover {
-  background: hsl(var(--muted) / 0.5);
-}
-
-.notif-dropdown__item--read {
-  opacity: 0.6;
-}
-
-.notif-dropdown__dot-col {
-  width: 8px;
-  padding-top: 6px;
-  flex-shrink: 0;
-}
-
-.notif-dropdown__dot {
-  display: block;
-  width: 8px;
-  height: 8px;
-  border-radius: 50%;
-  background: hsl(var(--destructive));
-}
-
-.notif-dropdown__title {
-  font-size: var(--font-size-sm);
-  font-weight: 600;
-  margin-bottom: 2px;
-}
-
-.notif-dropdown__desc {
-  font-size: var(--font-size-xs);
-  color: hsl(var(--muted-foreground));
-  line-height: 1.4;
-}
diff --git a/packages/frontend/src/styles/params-card.css b/packages/frontend/src/styles/params-card.css
index 4c2de55c..fbc14c44 100644
--- a/packages/frontend/src/styles/params-card.css
+++ b/packages/frontend/src/styles/params-card.css
@@ -2,7 +2,7 @@
    each row a title + hint on the left and a control on the right, split by
    hairline separators. Canonical consumer is the Model parameters dialog
    (routing.css keeps its dialog-specific rules); the Connect Harness modal and
-   the Welcome first-harness form reuse it for their Autofix / logs toggles,
+   the Welcome first-harness form reuse it for their logs toggle,
    which is why these rules are global rather than in the Routing chunk. */
 
 .model-params__row {
diff --git a/packages/frontend/src/styles/request-drawer.css b/packages/frontend/src/styles/request-drawer.css
index 301967a2..4c663fe6 100644
--- a/packages/frontend/src/styles/request-drawer.css
+++ b/packages/frontend/src/styles/request-drawer.css
@@ -120,10 +120,6 @@
   background: hsl(36 80% 60% / 0.12);
   color: hsl(36 80% 40%);
 }
-.drawer__badge--autofix {
-  background: hsl(222 47% 50% / 0.1);
-  color: hsl(222 47% 50%);
-}
 
 /* ── Split layout: sidebar + content ── */
 .drawer__split {
@@ -312,7 +308,7 @@
   padding-right: 12px;
 }
 
-/* ── Context cards (error, autofix, fallback) inside the Details tab ── */
+/* ── Context cards (error, fallback) inside the Details tab ── */
 /* grid-column: 1 / -1 spans both KV columns so the card is full width */
 .drawer-context-card {
   grid-column: 1 / -1;
@@ -324,10 +320,6 @@
   background: hsl(var(--destructive) / 0.06);
   border: 1px solid hsl(var(--destructive) / 0.25);
 }
-.drawer-context-card--autofix {
-  background: hsl(222 47% 50% / 0.06);
-  border: 1px solid hsl(222 47% 50% / 0.3);
-}
 .drawer-context-card--fallback {
   background: hsl(36 80% 60% / 0.08);
   border: 1px solid hsl(36 80% 50% / 0.3);
diff --git a/packages/frontend/src/styles/theme.css b/packages/frontend/src/styles/theme.css
index 246ef002..4a306bb0 100644
--- a/packages/frontend/src/styles/theme.css
+++ b/packages/frontend/src/styles/theme.css
@@ -440,7 +440,7 @@ h6 {
   font-size: var(--font-size-sm);
 }
 
-/* Trailing reliability columns (Total requests · Healed · Success rate):
+/* Trailing reliability columns (Total requests · Recovered · Success rate):
    fixed width + right alignment so consecutive tables line up and the trio
    reads as one continuous block down the page. */
 .data-table th.rel-col,
@@ -1570,7 +1570,7 @@ h6 {
 .data-table th[data-col='attempts'] {
   width: 72px;
 }
-.data-table th[data-col='selfheal'] {
+.data-table th[data-col='recovery'] {
   width: 138px;
 }
 .data-table th[data-col] {
diff --git a/packages/frontend/src/styles/version-indicator.css b/packages/frontend/src/styles/version-indicator.css
index 306b84d4..27ca75db 100644
--- a/packages/frontend/src/styles/version-indicator.css
+++ b/packages/frontend/src/styles/version-indicator.css
@@ -15,60 +15,3 @@
   cursor: default;
   user-select: none;
 }
-
-/* The dev-only Wingman FAB (44px tall, 22px from the corner) shares this
-   corner. Lift the badge above it while it is on the page; production
-   builds never render the FAB, so this rule never fires there. */
-body:has(.wingman-fab) .version-indicator {
-  bottom: calc(22px + 44px + var(--gap-sm));
-}
-
-/* A newer release exists: make the badge readable and clickable. */
-.version-indicator--update {
-  opacity: 1;
-  user-select: text;
-  padding: 4px 6px 4px 10px;
-  border-radius: var(--radius-sm);
-  background: hsl(var(--card));
-  border: 1px solid hsl(var(--border));
-  box-shadow: var(--shadow-sm);
-}
-
-.version-indicator__update {
-  display: inline-flex;
-  align-items: center;
-  gap: var(--gap-sm);
-}
-
-.version-indicator__update a {
-  color: hsl(var(--primary));
-  text-decoration: none;
-  font-weight: 600;
-}
-
-.version-indicator__update a:hover,
-.version-indicator__update a:focus-visible {
-  text-decoration: underline;
-}
-
-.version-indicator__dismiss {
-  appearance: none;
-  border: 0;
-  background: transparent;
-  /* 24px minimum hit area so the × is tappable on touch screens. */
-  padding: 0 6px;
-  min-width: 24px;
-  min-height: 24px;
-  font: inherit;
-  font-size: var(--font-size-sm);
-  line-height: 1;
-  color: hsl(var(--muted-foreground));
-  cursor: pointer;
-  border-radius: var(--radius-sm);
-}
-
-.version-indicator__dismiss:hover,
-.version-indicator__dismiss:focus-visible {
-  color: hsl(var(--foreground));
-  background: hsl(var(--muted));
-}
diff --git a/packages/frontend/src/styles/welcome.css b/packages/frontend/src/styles/welcome.css
index a212b5e2..7f88e1fb 100644
--- a/packages/frontend/src/styles/welcome.css
+++ b/packages/frontend/src/styles/welcome.css
@@ -818,10 +818,6 @@
   }
 }
 
-.welcome__legal {
-  margin-top: var(--gap-sm);
-}
-
 .welcome__error {
   margin: 0;
   color: hsl(var(--destructive));
@@ -837,7 +833,6 @@
   line-height: 1.5;
 }
 
-.welcome__autofix-section,
 .welcome__first-request,
 .welcome__plan-section {
   border-top: 1px solid hsl(var(--border));
@@ -889,8 +884,6 @@
   background: hsl(var(--muted) / 0.28);
 }
 
-/* ── Autofix step ──────────────────────────────── */
-
 /* ── Route & test step ──────────────────────────── */
 
 .welcome__route-test-section {
@@ -1082,64 +1075,7 @@
   border-radius: 4px;
 }
 
-/* ── Autofix step: concrete repair examples ────── */
-
-.welcome__autofix-details {
-  margin-top: 18px;
-}
-
-.welcome__autofix-heading {
-  margin: 0 0 10px;
-  color: hsl(var(--muted-foreground));
-  font-family: var(--font-mono);
-  font-size: 10px;
-  font-weight: 700;
-  letter-spacing: 0.14em;
-  text-transform: uppercase;
-}
-
-.welcome__autofix-examples {
-  display: grid;
-  grid-template-columns: repeat(2, minmax(0, 1fr));
-  gap: 8px;
-  margin: 0;
-  padding: 0;
-  list-style: none;
-}
-
-.welcome__autofix-examples li {
-  display: grid;
-  gap: 5px;
-  padding: 11px 13px;
-  border: 1px solid hsl(var(--border));
-  border-radius: var(--radius);
-  background: hsl(var(--card));
-}
-
-.welcome__autofix-examples code {
-  overflow: hidden;
-  color: hsl(var(--destructive) / 0.85);
-  font-family: var(--font-mono);
-  font-size: var(--font-size-xs);
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.welcome__autofix-examples span {
-  color: hsl(var(--muted-foreground));
-  font-size: var(--font-size-xs);
-  line-height: 1.45;
-}
-
-.welcome__autofix-how {
-  max-width: 640px;
-  margin: 12px 0 0;
-  color: hsl(var(--muted-foreground));
-  font-size: var(--font-size-sm);
-  line-height: 1.55;
-}
-
-.welcome__autofix-how .welcome__text-link {
+.welcome__text-link {
   padding: 0;
   text-decoration: underline;
   text-underline-offset: 3px;
@@ -1565,10 +1501,6 @@
     white-space: nowrap;
   }
 
-  .welcome__autofix-examples {
-    grid-template-columns: 1fr;
-  }
-
   .welcome__panel .routing-cards--centered {
     max-width: 100%;
     min-width: 340px;
diff --git a/packages/frontend/src/vite-env.d.ts b/packages/frontend/src/vite-env.d.ts
index fd6b94d6..9da11a00 100644
--- a/packages/frontend/src/vite-env.d.ts
+++ b/packages/frontend/src/vite-env.d.ts
@@ -1,5 +1,3 @@
 /// <reference types="vite/client" />
 
 declare const __MANIFEST_VERSION__: string;
-declare const __DEV_MODE__: boolean;
-declare const __WINGMAN_URL__: string;
diff --git a/packages/frontend/tests/components/AddAgentModal.test.tsx b/packages/frontend/tests/components/AddAgentModal.test.tsx
index cbced1c2..f84a74f7 100644
--- a/packages/frontend/tests/components/AddAgentModal.test.tsx
+++ b/packages/frontend/tests/components/AddAgentModal.test.tsx
@@ -84,30 +84,18 @@ describe('AddAgentModal', () => {
     expect(container.textContent).toContain('Name your harness to start tracking');
   });
 
-  it('creates directly with the legal line as the consent act (no dialog)', async () => {
+  it('offers only the logs toggle, with no Autofix switch or third-party legal line', async () => {
     const { input, createBtn } = renderOpen();
-    // Autofix defaults on, so the Terms/Privacy legal line is visible.
-    expect(document.body.textContent).toContain('you agree to Manifest');
-    expect(document.querySelector('a[href="https://manifest.build/terms"]')).not.toBeNull();
-    expect(document.querySelector('a[href="https://manifest.build/privacy"]')).not.toBeNull();
+    const switches = document.querySelectorAll('.settings-switch');
+    expect(switches.length).toBe(1);
+    expect(switches[0]!.getAttribute('aria-label')).toBe('Enable logs');
+    expect(document.body.textContent).not.toContain('Autofix');
+    expect(document.querySelector('a[href^="https://manifest.build"]')).toBeNull();
 
     fireEvent.input(input, { target: { value: 'first-agent' } });
     fireEvent.click(createBtn);
     await vi.waitFor(() => expect(mockCreateAgent).toHaveBeenCalled());
-    expect(screen.queryByText('Enable hosted Autofix?')).toBeNull();
-  });
-
-  it('hides the legal line when Autofix is toggled off and still creates', async () => {
-    const { container, input, createBtn } = renderOpen();
-    fireEvent.click(container.querySelector('.settings-switch')!);
-    expect(document.body.textContent).not.toContain('you agree to Manifest');
-
-    fireEvent.input(input, { target: { value: 'disabled-agent' } });
-    fireEvent.click(createBtn);
-    await vi.waitFor(() => expect(mockCreateAgent).toHaveBeenCalled());
-    expect(mockCreateAgent).toHaveBeenCalledWith(
-      expect.objectContaining({ autofix_enabled: false }),
-    );
+    expect(mockCreateAgent.mock.calls[0]![0]).not.toHaveProperty('autofix_enabled');
   });
 
   describe('create races', () => {
@@ -152,7 +140,6 @@ describe('AddAgentModal', () => {
 
       expect(mockNavigate).not.toHaveBeenCalled();
     });
-
   });
 
   it('keeps Create disabled until a non-blank name is entered', () => {
@@ -259,22 +246,19 @@ describe('AddAgentModal', () => {
         name: 'typed',
         agent_category: 'app',
         agent_platform: 'langchain',
-        autofix_enabled: true,
         record_messages: true,
       });
     });
   });
 
-  it('sends toggled-off Autofix and recording when the user flips them', async () => {
+  it('sends toggled-off recording when the user flips it', async () => {
     const { input, createBtn } = renderOpen();
-    // Both switches default on; flip each off before creating.
+    // The logs switch defaults on; flip it off before creating.
     const switches = Array.from(
       document.querySelectorAll('.settings-switch'),
     ) as HTMLButtonElement[];
-    // Order in the modal: Autofix, then Enable logs.
-    expect(switches.length).toBeGreaterThanOrEqual(2);
+    expect(switches.length).toBe(1);
     fireEvent.click(switches[0]!);
-    fireEvent.click(switches[1]!);
     fireEvent.input(input, { target: { value: 'typed' } });
     fireEvent.click(createBtn);
     await vi.waitFor(() => {
@@ -282,7 +266,6 @@ describe('AddAgentModal', () => {
         name: 'typed',
         agent_category: 'personal',
         agent_platform: expect.any(String),
-        autofix_enabled: false,
         record_messages: false,
       });
     });
diff --git a/packages/frontend/tests/components/AnalyticsChartSurfaces.test.tsx b/packages/frontend/tests/components/AnalyticsChartSurfaces.test.tsx
index ea0caf42..936bb9e9 100644
--- a/packages/frontend/tests/components/AnalyticsChartSurfaces.test.tsx
+++ b/packages/frontend/tests/components/AnalyticsChartSurfaces.test.tsx
@@ -79,7 +79,7 @@ vi.mock('../../src/services/sse.js', () => ({
 }));
 
 vi.mock('../../src/services/api/analytics.js', () => ({
-  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by Autofix or fallback.',
+  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by fallback.',
   REQUEST_SUCCESS_RATE_TOOLTIP:
     'Successful requests over all requests. Recovered requests count as successful.',
   getErrorBreakdown: (...args: unknown[]) => mockGetErrorBreakdown(...args),
@@ -89,7 +89,7 @@ import GlobalOverviewSkeleton from '../../src/components/GlobalOverviewSkeleton'
 import MultiAgentTokenChart, { AGENT_COLORS } from '../../src/components/MultiAgentTokenChart';
 import ProviderChartCard from '../../src/components/ProviderChartCard';
 import UnifiedChartCard from '../../src/components/UnifiedChartCard';
-import AutofixKpiCards from '../../src/components/AutofixKpiCards';
+import ReliabilityKpiCards from '../../src/components/ReliabilityKpiCards';
 import ErrorClassCard from '../../src/components/ErrorClassCard';
 import ReliabilityChart from '../../src/components/ReliabilityChart';
 
@@ -115,23 +115,23 @@ const buildLazyChart = async () => {
 };
 
 describe('analytics chart surface components', () => {
-  it('renders the self-healed requests tab from the disposition timeseries', async () => {
+  it('renders the recovered requests tab from the request-status timeseries', async () => {
     const onTabChange = vi.fn();
-    const selfHealedTimeseries = {
+    const recoveredTimeseries = {
       range: '7d',
       by: 'disposition',
-      keys: ['healed', 'fallback'],
-      buckets: [{ bucket: '2026-06-04', counts: [12, 3] }],
+      keys: ['fallback'],
+      buckets: [{ bucket: '2026-06-04', counts: [3] }],
     };
     const { unmount } = render(() => (
       <UnifiedChartCard
-        activeTab="selfheal"
+        activeTab="recovered"
         onTabChange={onTabChange}
         requestsValue={10}
         requestsTrendPct={0}
-        selfHealedValue={15}
-        selfHealedTrendPct={20}
-        selfHealedTimeseries={selfHealedTimeseries}
+        recoveredValue={15}
+        recoveredTrendPct={20}
+        recoveredTimeseries={recoveredTimeseries}
         tokensValue={100}
         tokensTrendPct={0}
         range="7d"
@@ -151,8 +151,7 @@ describe('analytics chart surface components', () => {
     await buildLazyChart();
     // Stacked series are reversed (top-of-stack first).
     const labels = capturedChartOpts.series.slice(1).map((s: { label: string }) => s.label);
-    expect(labels).toContain('Success - recovered by Autofix');
-    expect(labels).toContain('Success - recovered by Fallback');
+    expect(labels).toEqual(['Success - recovered by Fallback']);
     unmount();
   });
 
@@ -187,16 +186,16 @@ describe('analytics chart surface components', () => {
     unmount();
   });
 
-  it('renders the self-healed empty state and hides the tab without a timeseries', () => {
+  it('renders the recovered empty state and hides the tab without a timeseries', () => {
     const { unmount } = render(() => (
       <UnifiedChartCard
-        activeTab="selfheal"
+        activeTab="recovered"
         onTabChange={vi.fn()}
         requestsValue={0}
         requestsTrendPct={0}
-        selfHealedValue={0}
-        selfHealedTrendPct={0}
-        selfHealedTimeseries={{ range: '24h', by: 'disposition', keys: [], buckets: [] }}
+        recoveredValue={0}
+        recoveredTrendPct={0}
+        recoveredTimeseries={{ range: '24h', by: 'disposition', keys: [], buckets: [] }}
         tokensValue={0}
         tokensTrendPct={0}
         range="24h"
@@ -221,15 +220,15 @@ describe('analytics chart surface components', () => {
     noTab.unmount();
   });
 
-  it('orders disposition series success → healed → fallback → error (legend and stack)', async () => {
+  it('orders disposition series success → fallback → error (legend and stack)', async () => {
     // Backend delivers keys in an arbitrary order; the chart must normalize.
     const { container, unmount } = render(() => (
       <ReliabilityChart
         timeseries={{
           range: '7d',
           by: 'disposition',
-          keys: ['error', 'fallback', 'success', 'healed'],
-          buckets: [{ bucket: '2026-06-04', counts: [4, 3, 1, 2] }],
+          keys: ['error', 'fallback', 'success'],
+          buckets: [{ bucket: '2026-06-04', counts: [4, 3, 1] }],
         }}
         range="7d"
         seriesMode="disposition"
@@ -240,19 +239,14 @@ describe('analytics chart surface components', () => {
     const legend = [...container.querySelectorAll('.rel-chart__legend-item')].map((e) =>
       e.textContent?.trim(),
     );
-    expect(legend).toEqual([
-      'Success',
-      'Success - recovered by Autofix',
-      'Success - recovered by Fallback',
-      'Error',
-    ]);
+    expect(legend).toEqual(['Success', 'Success - recovered by Fallback', 'Error']);
 
     // Stack order (bottom → top) follows the same order: the cumulative data
     // rows are reversed (top first), so the LAST row is the bottom (success=1)
-    // and the first is the full stack (…+error=10).
+    // and the first is the full stack (…+error=8).
     const data = capturedLifecycleOpts.buildData();
     const stacks = data.slice(1).map((s: number[]) => s[0]);
-    expect(stacks).toEqual([10, 6, 3, 1]); // error top, then fallback, healed, success bottom
+    expect(stacks).toEqual([8, 4, 1]); // error top, then fallback, success bottom
     unmount();
   });
 
@@ -262,8 +256,8 @@ describe('analytics chart surface components', () => {
         timeseries={{
           range: '7d',
           by: 'disposition',
-          keys: ['error', 'fallback', 'success', 'healed'],
-          buckets: [{ bucket: '2026-06-04', counts: [4, 3, 1, 2] }],
+          keys: ['error', 'fallback', 'success'],
+          buckets: [{ bucket: '2026-06-04', counts: [4, 3, 1] }],
         }}
         range="7d"
         seriesMode="disposition"
@@ -295,11 +289,10 @@ describe('analytics chart surface components', () => {
     }));
     expect(rows).toEqual([
       { label: 'Success', value: '1' },
-      { label: 'Success - recovered by Autofix', value: '2' },
       { label: 'Success - recovered by Fallback', value: '3' },
       { label: 'Error', value: '4' },
     ]);
-    expect(container.querySelector('.agent-chart-tooltip__total-value')?.textContent).toBe('10');
+    expect(container.querySelector('.agent-chart-tooltip__total-value')?.textContent).toBe('8');
 
     // Cursor off the data hides it.
     capturedChartOpts.hooks.setCursor[0]({ cursor: { idx: -1 } });
@@ -319,19 +312,15 @@ describe('analytics chart surface components', () => {
     expect(capturedLifecycleOpts.buildChart()).toBeNull();
   });
 
-  it('renders the self-healed KPI cards (rate, share, via Autofix, via Fallback)', () => {
+  it('renders the reliability KPI cards (rate, recovered share, via Fallback, failed)', () => {
     const base = {
       success_rate: { value: 0.8, previous: 0.7 },
       errors_remaining: { value: 0, previous: 0 },
-      coverage: { rate: 0.555, previous_rate: 0.5 },
-      dispositions: { healed: 5, no_fix_found: 2, resolving: 1, ineffective: 0 },
-      needs_attention: [],
     };
     const { unmount } = render(() => (
-      <AutofixKpiCards
+      <ReliabilityKpiCards
         stats={{
           ...base,
-          autofix_saves: { value: 5, previous: 0 },
           fallback_saves: { value: 3, previous: 0 },
           total_requests: { value: 100, previous: 0 },
         }}
@@ -339,27 +328,25 @@ describe('analytics chart surface components', () => {
     ));
     expect(screen.getByText('Success rate')).toBeDefined();
     expect(screen.getByText('80.0%')).toBeDefined();
-    // Self-healed share = (5 + 3) / 100.
+    // Recovered share = 3 / 100.
     expect(screen.getByText('Recovered requests')).toBeDefined();
-    expect(screen.getByText('8.0%')).toBeDefined();
+    expect(screen.getByText('3.0%')).toBeDefined();
     expect(screen.getByText('Failed requests')).toBeDefined();
-    expect(screen.getByText('Recovered by Autofix')).toBeDefined();
-    expect(screen.getByText('5')).toBeDefined();
     expect(screen.getByText('Recovered by Fallback')).toBeDefined();
     expect(screen.getByText('3')).toBeDefined();
-    // The five-card row relies on the responsive `overview-stats--5` modifier;
-    // an inline grid-template-columns would override the phone breakpoints.
+    expect(document.body.textContent).not.toContain('Autofix');
+    // Four cards use the base responsive grid; an inline grid-template-columns
+    // would override the phone breakpoints.
     const grid = screen.getByText('Success rate').closest('.overview-stats') as HTMLElement;
-    expect(grid.classList.contains('overview-stats--5')).toBe(true);
+    expect(grid.querySelectorAll('.overview-stat-card')).toHaveLength(4);
     expect(grid.style.gridTemplateColumns).toBe('');
     unmount();
 
     // Trends: previous window present → percentage badges.
     render(() => (
-      <AutofixKpiCards
+      <ReliabilityKpiCards
         stats={{
           ...base,
-          autofix_saves: { value: 1, previous: 2 },
           fallback_saves: { value: 1, previous: 2 },
           total_requests: { value: 10, previous: 10 },
         }}
@@ -372,15 +359,11 @@ describe('analytics chart surface components', () => {
     const base = {
       success_rate: { value: 0.8, previous: 0.7 },
       errors_remaining: { value: 0, previous: 0 },
-      coverage: { rate: 0.555, previous_rate: 0.5 },
-      dispositions: { healed: 5, no_fix_found: 2, resolving: 1, ineffective: 0 },
-      needs_attention: [],
     };
     render(() => (
-      <AutofixKpiCards
+      <ReliabilityKpiCards
         stats={{
           ...base,
-          autofix_saves: { value: 5, previous: 0 },
           fallback_saves: { value: 3, previous: 0 },
           total_requests: { value: 100, previous: 0 },
         }}
@@ -392,17 +375,14 @@ describe('analytics chart surface components', () => {
     expect(routerNavigate).toHaveBeenCalledWith(
       '/messages?agent=demo-agent&range=7d&status=failed',
     );
-    fireEvent.click(screen.getByText('Recovered by Autofix').closest('.overview-stat-card')!);
-    expect(routerNavigate).toHaveBeenCalledWith(
-      '/messages?agent=demo-agent&range=7d&status=ok&trigger=autofix',
-    );
     fireEvent.click(screen.getByText('Recovered by Fallback').closest('.overview-stat-card')!);
     expect(routerNavigate).toHaveBeenCalledWith(
       '/messages?agent=demo-agent&range=7d&status=ok&trigger=fallback',
     );
+    routerNavigate.mockClear();
     fireEvent.click(screen.getByText('Recovered requests').closest('.overview-stat-card')!);
     expect(routerNavigate).toHaveBeenCalledWith(
-      '/messages?agent=demo-agent&range=7d&status=ok&trigger=autofix,fallback',
+      '/messages?agent=demo-agent&range=7d&status=ok&trigger=fallback',
     );
 
     const failedCard = screen.getByText('Failed requests').closest('.overview-stat-card')!;
@@ -423,16 +403,12 @@ describe('analytics chart surface components', () => {
 
   it('describes global KPI links as covering all harnesses', () => {
     render(() => (
-      <AutofixKpiCards
+      <ReliabilityKpiCards
         stats={{
           success_rate: { value: 0.8, previous: 0.7 },
           errors_remaining: { value: 2, previous: 1 },
-          autofix_saves: { value: 5, previous: 0 },
           fallback_saves: { value: 3, previous: 0 },
           total_requests: { value: 100, previous: 0 },
-          coverage: { rate: 0.5, previous_rate: 0.4 },
-          dispositions: { healed: 5, no_fix_found: 2, resolving: 1, ineffective: 0 },
-          needs_attention: [],
         }}
       />
     ));
@@ -532,7 +508,7 @@ describe('analytics chart surface components', () => {
     ));
 
     expect(screen.getByTestId('info-tooltip').textContent).toBe(
-      'Caller success: 95.0%. Provider-attempt success: 80.0%. The gap is recovery from fallbacks and Autofix.',
+      'Caller success: 95.0%. Provider-attempt success: 80.0%. The gap is recovery from fallbacks.',
     );
     unmount();
 
diff --git a/packages/frontend/tests/components/AuthGuard.test.tsx b/packages/frontend/tests/components/AuthGuard.test.tsx
index cc26162b..2f8771e8 100644
--- a/packages/frontend/tests/components/AuthGuard.test.tsx
+++ b/packages/frontend/tests/components/AuthGuard.test.tsx
@@ -32,32 +32,20 @@ describe('AuthGuard', () => {
     mockLocation = { pathname: '/', search: '' };
   });
 
-  it('redirects to the discovery step when it is still pending for the user', async () => {
+  it('ignores a leftover discovery marker and renders the app (no post-signup detour)', async () => {
+    // Builds before #13 stored this marker after signup/setup to force a
+    // questionnaire. It must no longer route anyone anywhere.
     localStorage.setItem('manifest_discovery_pending_u1', '/welcome');
     render(() => (
       <AuthGuard>
         <span>Protected content</span>
       </AuthGuard>
     ));
-    await vi.waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/discovery?next=%2Fwelcome', { replace: true });
-    });
-  });
-
-  it('does not redirect away from the discovery page itself while pending', async () => {
-    localStorage.setItem('manifest_discovery_pending_u1', '/welcome');
-    mockLocation = { pathname: '/discovery', search: '?next=%2Fwelcome' };
-    render(() => (
-      <AuthGuard>
-        <span>Protected content</span>
-      </AuthGuard>
-    ));
     expect(await screen.findByText('Protected content')).toBeDefined();
     expect(mockNavigate).not.toHaveBeenCalled();
   });
 
-  it('lets the MCP consent page through even while onboarding is pending', async () => {
-    localStorage.setItem('manifest_discovery_pending_u1', '/welcome');
+  it('lets the MCP consent page through with an authenticated session', async () => {
     mockLocation = { pathname: '/consent', search: '?client_id=c' };
     render(() => (
       <AuthGuard>
@@ -77,8 +65,8 @@ describe('AuthGuard', () => {
     expect(await screen.findByText('Protected content')).toBeDefined();
   });
 
-  it('does not render children while redirecting to the pending discovery step', async () => {
-    localStorage.setItem('manifest_discovery_pending_u1', '/welcome');
+  it('does not render children while redirecting to login', async () => {
+    mockSessionData = { data: null, isPending: false };
     render(() => (
       <AuthGuard>
         <span>Protected content</span>
diff --git a/packages/frontend/tests/components/CostByModelTable.test.tsx b/packages/frontend/tests/components/CostByModelTable.test.tsx
index e7cdb028..fa8ee79e 100644
--- a/packages/frontend/tests/components/CostByModelTable.test.tsx
+++ b/packages/frontend/tests/components/CostByModelTable.test.tsx
@@ -31,7 +31,7 @@ describe('CostByModelTable', () => {
     ));
     expect(container.textContent).toContain('Model usage');
     const headers = Array.from(container.querySelectorAll('th')).map((h) => h.textContent?.trim());
-    // Attempt world: a model is not healed, it acts. Total attempts counts
+    // Attempt world: Total attempts counts
     // every provider call on the model; Success rate is attempt-level.
     expect(headers).toEqual(['Model', 'Tokens', '% of total', 'Cost', 'Total attempts', 'Success rate']);
     const cells = Array.from(container.querySelectorAll('tbody td')).map((c) =>
@@ -280,32 +280,19 @@ describe('CostByModelTable', () => {
     });
   });
 
-  it('words the Total attempts tooltip by Doctor availability', () => {
-    const { container, unmount } = render(() => (
-      <CostByModelTable
-        rows={[row({ model: 'gpt-4o' })]}
-        reliability={[{ model: 'gpt-4o', attempts: 10, failed: 1, succeeded: 9 }]}
-        doctorAvailable
-      />
-    ));
-    const labels = () =>
-      [...container.querySelectorAll('.info-tooltip')].map((e) => e.getAttribute('aria-label'));
-    expect(labels().join(' ')).toContain('including fallback retries and autofixed attempts');
-    unmount();
-
-    const { container: c2 } = render(() => (
+  it('words the Total attempts tooltip around fallback retries only', () => {
+    const { container } = render(() => (
       <CostByModelTable
         rows={[row({ model: 'gpt-4o' })]}
         reliability={[{ model: 'gpt-4o', attempts: 10, failed: 1, succeeded: 9 }]}
       />
     ));
-    // Without the Doctor version the sentence never mentions Autofix.
-    const labels2 = [...c2.querySelectorAll('.info-tooltip')]
+    const labels = [...container.querySelectorAll('.info-tooltip')]
       .map((e) => e.getAttribute('aria-label'))
       .join(' ');
-    expect(labels2).toContain('including fallback retries.');
-    expect(labels2).not.toContain('autofixed');
+    expect(labels).toContain('including fallback retries.');
+    expect(labels).not.toContain('autofixed');
     // Success rate carries the model-grain definition.
-    expect(labels2).toContain('Successful attempts over all attempts for this model.');
+    expect(labels).toContain('Successful attempts over all attempts for this model.');
   });
 });
diff --git a/packages/frontend/tests/components/ErrorClassCard.preserved.test.tsx b/packages/frontend/tests/components/ErrorClassCard.preserved.test.tsx
index 2072ff6c..858778fa 100644
--- a/packages/frontend/tests/components/ErrorClassCard.preserved.test.tsx
+++ b/packages/frontend/tests/components/ErrorClassCard.preserved.test.tsx
@@ -21,12 +21,11 @@ import { render, screen, waitFor } from '@solidjs/testing-library';
 
 const breakdown = vi.fn();
 vi.mock('../../src/services/api/analytics.js', () => ({
-  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by Autofix or fallback.',
-  REQUEST_SUCCESS_RATE_TOOLTIP: 'Successful requests over all requests. Recovered requests count as successful.',
-  totalAttemptsTooltip: (doctor: boolean) =>
-    doctor
-      ? 'Every provider call counts here, including fallback retries and autofixed attempts. One request can produce several attempts.'
-      : 'Every provider call counts here, including fallback retries. One request can produce several attempts.',
+  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by fallback.',
+  REQUEST_SUCCESS_RATE_TOOLTIP:
+    'Successful requests over all requests. Recovered requests count as successful.',
+  TOTAL_ATTEMPTS_TOOLTIP:
+    'Every provider call counts here, including fallback retries. One request can produce several attempts.',
   MODEL_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this model.',
   PROVIDER_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this provider.',
   CONNECTION_SUCCESS_RATE_TOOLTIP_30D:
diff --git a/packages/frontend/tests/components/GuestGuard.test.tsx b/packages/frontend/tests/components/GuestGuard.test.tsx
index f6852e7d..ea789fac 100644
--- a/packages/frontend/tests/components/GuestGuard.test.tsx
+++ b/packages/frontend/tests/components/GuestGuard.test.tsx
@@ -49,7 +49,7 @@ describe('GuestGuard', () => {
     });
   });
 
-  it('redirects to the discovery step when it is still pending for the user', async () => {
+  it('ignores a leftover discovery marker and sends the user home', async () => {
     localStorage.setItem('manifest_discovery_pending_u1', '/welcome');
     mockSessionData = {
       data: { user: { id: 'u1', name: 'Test' } },
@@ -60,26 +60,12 @@ describe('GuestGuard', () => {
         <span>Guest content</span>
       </GuestGuard>
     ));
-    await vi.waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/discovery?next=%2Fwelcome', { replace: true });
-    });
-  });
-
-  it('ignores a pending discovery step already marked done', async () => {
-    localStorage.setItem('manifest_discovery_pending_u1', '/welcome');
-    localStorage.setItem('manifest_discovery_done_u1', '1');
-    mockSessionData = {
-      data: { user: { id: 'u1', name: 'Test' } },
-      isPending: false,
-    };
-    render(() => (
-      <GuestGuard>
-        <span>Guest content</span>
-      </GuestGuard>
-    ));
     await vi.waitFor(() => {
       expect(mockNavigate).toHaveBeenCalledWith('/', { replace: true });
     });
+    for (const [path] of mockNavigate.mock.calls) {
+      expect(path).not.toContain('/discovery');
+    }
   });
 
   it('redirects to home when session exists', async () => {
@@ -117,7 +103,6 @@ describe('GuestGuard', () => {
 
   it('preserves signed MCP authorization during the authenticated redirect', async () => {
     vi.stubGlobal('location', { assign: mockLocationAssign });
-    localStorage.setItem('manifest_discovery_pending_u1', '/welcome');
     mockSessionData = {
       data: { user: { id: 'u1', name: 'Test' } },
       isPending: false,
diff --git a/packages/frontend/tests/components/Header.test.tsx b/packages/frontend/tests/components/Header.test.tsx
index 51822672..96a449ce 100644
--- a/packages/frontend/tests/components/Header.test.tsx
+++ b/packages/frontend/tests/components/Header.test.tsx
@@ -49,10 +49,6 @@ vi.mock('../../src/services/agent-display-name.js', () => ({
   agentDisplayName: () => mockAgentDisplayName,
 }));
 
-vi.mock('../../src/components/NotificationBell.jsx', () => ({
-  default: () => null,
-}));
-
 import Header from '../../src/components/Header';
 import { setConnectionBreadcrumb } from '../../src/services/connection-breadcrumb-store';
 
diff --git a/packages/frontend/tests/components/MessageDetails.autofix.test.tsx b/packages/frontend/tests/components/MessageDetails.autofix.test.tsx
deleted file mode 100644
index bfa228eb..00000000
--- a/packages/frontend/tests/components/MessageDetails.autofix.test.tsx
+++ /dev/null
@@ -1,546 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { render, cleanup, fireEvent } from '@solidjs/testing-library';
-
-const mockGetMessageDetails = vi.fn();
-const mockFlagMiscategorized = vi.fn();
-const mockClearMiscategorized = vi.fn();
-vi.mock('../../src/services/api.js', () => ({
-  getMessageDetails: (...args: unknown[]) => mockGetMessageDetails(...args),
-  flagMessageMiscategorized: (...args: unknown[]) => mockFlagMiscategorized(...args),
-  clearMessageMiscategorized: (...args: unknown[]) => mockClearMiscategorized(...args),
-}));
-
-vi.mock('../../src/services/routing-utils.js', () => ({
-  inferProviderName: (m: string) => {
-    if (m.startsWith('gpt')) return 'OpenAI';
-    return m;
-  },
-}));
-
-vi.mock('../../src/services/model-display.js', () => ({
-  getModelDisplayName: (slug: string) => slug,
-}));
-
-import MessageDetails from '../../src/components/MessageDetails';
-
-// The Autofix model is two linked rows: a failed `original` and its
-// successful `retry`. Each row carries `autofix_role`, the Phoenix
-// `autofix_operations`, and an `autofix_sibling` pointer to the paired row.
-//
-// The redesigned MessageDetails renders these as an "error + autofix" row of
-// colored cards rather than a titled section:
-//   • the failed ORIGINAL (has an error_message) → an error card paired with a
-//     "autofix" next-card ("Autofix was attempted after this error." + a
-//     "View autofix retry" link).
-//   • the successful RETRY (no error_message) → the rich `AutofixSection` card:
-//     a success phrase, the Phoenix operation table, the Phoenix ids, and a
-//     "← View original request" back-link.
-const baseMessage = {
-  id: 'msg-1',
-  timestamp: '2026-02-16 10:00:00',
-  agent_name: 'test-agent',
-  model: 'gpt-4o',
-  status: 'error',
-  autofix_status: null,
-  error_message: null,
-  description: null,
-  service_type: 'agent',
-  input_tokens: 100,
-  output_tokens: 50,
-  cache_read_tokens: 0,
-  cache_creation_tokens: 0,
-  cost_usd: 0.05,
-  duration_ms: 1200,
-  trace_id: 'trace-abc123',
-  routing_tier: 'standard',
-  routing_reason: null,
-  specificity_category: null,
-  specificity_miscategorized: false,
-  auth_type: 'api_key',
-  provider_key_label: null,
-  skill_name: null,
-  fallback_from_model: null,
-  fallback_index: null,
-  session_key: null,
-  feedback_rating: null,
-  feedback_tags: null,
-  feedback_details: null,
-  request_headers: null,
-  request_params: null,
-  header_tier_id: null,
-  header_tier_name: null,
-  header_tier_color: null,
-  caller_attribution: null,
-  autofix_applied: false,
-  autofix_role: null,
-  autofix_operations: null,
-  autofix_decision: null,
-  autofix_sibling: null,
-};
-
-// The failed original: 400'd on an unknown parameter, Phoenix renamed it, and
-// it links forward to the successful retry row.
-const originalResponse = {
-  message: {
-    ...baseMessage,
-    id: 'orig-1',
-    status: 'error',
-    autofix_status: 'retry_succeeded' as const,
-    error_message: 'Unknown parameter: max_tokens',
-    autofix_applied: true,
-    autofix_role: 'original',
-    autofix_operations: [{ type: 'rename_param', from: 'max_tokens', to: 'max_output_tokens' }],
-    autofix_sibling: { id: 'retry-1', role: 'retry', status: 'ok' },
-  },
-};
-
-// The successful retry: 200 after the patch, linking back to the original.
-const retryResponse = {
-  message: {
-    ...baseMessage,
-    id: 'retry-1',
-    status: 'ok',
-    autofix_status: 'retry_succeeded' as const,
-    error_message: null,
-    autofix_applied: true,
-    autofix_role: 'retry',
-    autofix_operations: null,
-    autofix_sibling: { id: 'orig-1', role: 'original', status: 'error' },
-  },
-};
-
-describe('MessageDetails Autofix section', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-  afterEach(() => {
-    cleanup();
-  });
-
-  it.each([
-    ['no_patch', 'No patch'],
-    ['resolving', 'Resolving'],
-    ['retry_succeeded', 'Retry succeeded'],
-    ['retry_failed', 'Retry failed'],
-    ['service_error', 'Service error'],
-  ] as const)('renders the %s request status as %s', async (autofix_status, label) => {
-    mockGetMessageDetails.mockResolvedValue({
-      message: { ...baseMessage, autofix_status },
-    });
-    const { container } = render(() => <MessageDetails messageId="msg-1" />);
-
-    await vi.waitFor(() => expect(container.textContent).toContain(label));
-  });
-
-  it('renders the original-side panel: error, the "autofix attempted" card, and the retry link', async () => {
-    mockGetMessageDetails.mockResolvedValue(originalResponse);
-    const onOpenMessage = vi.fn();
-    const { container } = render(() => (
-      <MessageDetails messageId="orig-1" onOpenMessage={onOpenMessage} />
-    ));
-
-    await vi.waitFor(() => {
-      expect(container.textContent).toContain('Autofix was attempted after this error.');
-    });
-
-    // The failed original shows its error inline alongside the autofix card.
-    expect(container.querySelector('.msg-detail__error-inline')!.textContent).toBe(
-      'Unknown parameter: max_tokens',
-    );
-
-    // The forward link to the successful retry.
-    const link = container.querySelector('.error-autofix-row__autofix-btn');
-    expect(link).not.toBeNull();
-    expect(link!.textContent).toContain('View Autofix retry');
-
-    // Clicking it opens the sibling (retry) row.
-    fireEvent.click(link!);
-    expect(onOpenMessage).toHaveBeenCalledWith('retry-1');
-  });
-
-  it('renders the retry-side panel: success phrase and the back-link to the original', async () => {
-    mockGetMessageDetails.mockResolvedValue(retryResponse);
-    const onOpenMessage = vi.fn();
-    const { container } = render(() => (
-      <MessageDetails messageId="retry-1" onOpenMessage={onOpenMessage} />
-    ));
-
-    await vi.waitFor(() => {
-      expect(container.textContent).toContain(
-        'Manifest caught an error, repaired the request, and retried it successfully.',
-      );
-    });
-
-    // The back-link to the original failed request uses the secondary variant.
-    const link = container.querySelector('.error-autofix-row__autofix-btn--secondary');
-    expect(link).not.toBeNull();
-    expect(link!.textContent).toContain('View original request');
-
-    fireEvent.click(link!);
-    expect(onOpenMessage).toHaveBeenCalledWith('orig-1');
-  });
-
-  it('does not render the Autofix section when autofix_applied is false', async () => {
-    mockGetMessageDetails.mockResolvedValue({ message: { ...baseMessage } });
-    const onOpenMessage = vi.fn();
-    const { container } = render(() => (
-      <MessageDetails messageId="msg-1" onOpenMessage={onOpenMessage} />
-    ));
-
-    await vi.waitFor(() => {
-      // Wait for the panel to render at all.
-      expect(container.textContent).toContain('Request');
-    });
-
-    // No error/autofix row and no autofix cards render.
-    expect(container.querySelector('.error-autofix-row')).toBeNull();
-    expect(container.querySelector('.autofix-card')).toBeNull();
-    expect(container.querySelector('.error-autofix-row__autofix-btn')).toBeNull();
-  });
-
-  it('omits the sibling link when onOpenMessage is not provided', async () => {
-    // A sibling exists, but with no handler the link can go nowhere — so it is
-    // not rendered. The "autofix attempted" card still appears.
-    mockGetMessageDetails.mockResolvedValue(originalResponse);
-    const { container } = render(() => <MessageDetails messageId="orig-1" />);
-
-    await vi.waitFor(() => {
-      expect(container.textContent).toContain('Autofix was attempted after this error.');
-    });
-
-    expect(container.querySelector('.error-autofix-row__autofix-btn')).toBeNull();
-  });
-
-  it('shows the "autofix attempted" card with no link when autofix_sibling is null', async () => {
-    // An `original` row with no retry sibling means Autofix ran but never
-    // produced a working request — the card still explains an attempt was made,
-    // but there is no sibling to link to.
-    const noSibling = {
-      message: {
-        ...originalResponse.message,
-        autofix_sibling: null,
-      },
-    };
-    mockGetMessageDetails.mockResolvedValue(noSibling);
-    const onOpenMessage = vi.fn();
-    const { container } = render(() => (
-      <MessageDetails messageId="orig-1" onOpenMessage={onOpenMessage} />
-    ));
-
-    await vi.waitFor(() => {
-      expect(container.textContent).toContain('Autofix was attempted after this error.');
-    });
-
-    // The error is still surfaced, but with no sibling there is no link.
-    expect(container.querySelector('.msg-detail__error-inline')!.textContent).toBe(
-      'Unknown parameter: max_tokens',
-    );
-    expect(container.querySelector('.error-autofix-row__autofix-btn')).toBeNull();
-  });
-
-  it('renders the retry panel with no operation rows when the operations list is empty', async () => {
-    // Defensive: autofix_applied is true but no operations serialized. The
-    // `operations && operations.length > 0` guard keeps the operations table
-    // absent while the success phrase and the sibling link still render.
-    const noOps = {
-      message: {
-        ...retryResponse.message,
-        autofix_operations: [],
-      },
-    };
-    mockGetMessageDetails.mockResolvedValue(noOps);
-    const onOpenMessage = vi.fn();
-    const { container } = render(() => (
-      <MessageDetails messageId="retry-1" onOpenMessage={onOpenMessage} />
-    ));
-
-    await vi.waitFor(() => {
-      expect(container.textContent).toContain(
-        'Manifest caught an error, repaired the request, and retried it successfully.',
-      );
-    });
-    // Phrase present, no operations table, but the sibling link still renders.
-    expect(container.querySelector('.error-autofix-row__meta-table')).toBeNull();
-    expect(container.querySelector('.error-autofix-row__autofix-btn--secondary')).not.toBeNull();
-  });
-
-  it('describes every Phoenix operation type in the retry panel', async () => {
-    // The retry panel renders one row per operation: the raw `op.type` in bold
-    // plus a human-readable description. This fixture exercises each branch of
-    // describeOperation (with and without from/to).
-    const allOps = {
-      message: {
-        ...retryResponse.message,
-        autofix_operations: [
-          { type: 'drop_param', from: 'top_k' },
-          { type: 'drop_param' },
-          { type: 'rename_param', from: 'max_tokens', to: 'max_output_tokens' },
-          { type: 'rename_param', from: 'x' },
-          { type: 'clamp_param', from: 'temperature', to: '2' },
-          { type: 'clamp_param' },
-          { type: 'set_param', from: 'stream', to: 'false' },
-          { type: 'set_param' },
-          { type: 'remap_model', from: 'gpt-5', to: 'gpt-4o' },
-          { type: 'remap_model' },
-          { type: 'remove_unsupported_schema_keywords' },
-          { type: 'remove_unsupported_message_fields', from: 'name' },
-          { type: 'remove_unsupported_message_fields' },
-          { type: 'weird_unknown_op', from: 'a', to: 'b' },
-          { type: 'lonely_unknown_op' },
-        ],
-      },
-    };
-    mockGetMessageDetails.mockResolvedValue(allOps);
-    const { container } = render(() => <MessageDetails messageId="retry-1" />);
-
-    await vi.waitFor(() => {
-      expect(container.querySelector('.error-autofix-row__meta-table')).not.toBeNull();
-    });
-
-    const text = container.textContent!;
-    expect(text).toContain('Removed unsupported parameter "top_k"');
-    expect(text).toContain('Removed an unsupported parameter');
-    expect(text).toContain('Renamed "max_tokens" to "max_output_tokens"');
-    expect(text).toContain('Renamed a parameter');
-    expect(text).toContain('Adjusted temperature from temperature to 2');
-    expect(text).toContain('Adjusted a value to fit the allowed range');
-    expect(text).toContain('Set "stream" to false');
-    expect(text).toContain('Set a required parameter value');
-    expect(text).toContain('Switched from "gpt-5" to "gpt-4o"');
-    expect(text).toContain('Replaced the model with a supported one');
-    expect(text).toContain('Cleaned unsupported JSON Schema keywords from tool definitions');
-    expect(text).toContain('Removed unsupported field "name" from messages');
-    expect(text).toContain('Removed unsupported fields from messages');
-    // Unknown op types fall back to `type: from → to` (or bare `type`).
-    expect(text).toContain('weird_unknown_op: a → b');
-    expect(text).toContain('lonely_unknown_op');
-    // The raw op.type is shown in bold too.
-    expect(text).toContain('rename_param');
-  });
-
-  it('renders an operation description without an arrow when from/to are missing', async () => {
-    // An operation type that is not a known param op carries no from/to, so the
-    // `: from → to` suffix is suppressed — the only place a `→` could appear.
-    const bareOp = {
-      message: {
-        ...retryResponse.message,
-        autofix_operations: [{ type: 'strip_unsupported_field' }],
-        autofix_sibling: null,
-      },
-    };
-    mockGetMessageDetails.mockResolvedValue(bareOp);
-    const { container } = render(() => <MessageDetails messageId="retry-1" />);
-
-    await vi.waitFor(() => {
-      expect(container.textContent).toContain('strip_unsupported_field');
-    });
-    expect(container.textContent).not.toContain('→');
-  });
-
-  it('renders Phoenix issue/patch/heal ids (first 8 chars) when autofix_decision is present', async () => {
-    // Phoenix's own identifiers for the heal decision. Each id renders as a
-    // labelled 8-char slice: "Issue <8>", "Patch <8>", "Heal-attempt <8>".
-    const withPhoenix = {
-      message: {
-        ...retryResponse.message,
-        autofix_decision: {
-          issueId: 'issue-1234abcd',
-          patchId: 'patch-5678efgh',
-          healAttemptId: 'heal-9012ijkl',
-        },
-      },
-    };
-    mockGetMessageDetails.mockResolvedValue(withPhoenix);
-    const { container } = render(() => <MessageDetails messageId="retry-1" />);
-
-    await vi.waitFor(() => {
-      expect(container.querySelector('.autofix-card__ids')).not.toBeNull();
-    });
-
-    // 8-char slices of each id, with their labels.
-    expect(container.textContent).toContain('Issue issue-12');
-    expect(container.textContent).toContain('Patch patch-56');
-    expect(container.textContent).toContain('Heal-attempt heal-901');
-  });
-
-  it('renders only the Heal-attempt id when issueId and patchId are absent', async () => {
-    // Exercises the `issueId || patchId || healAttemptId` OR short-circuit past
-    // the first two operands: only healAttemptId is present, so the Issue/Patch
-    // chips are suppressed while the section still shows the heal id.
-    const healOnly = {
-      message: {
-        ...retryResponse.message,
-        autofix_decision: {
-          issueId: null,
-          patchId: null,
-          healAttemptId: 'heal-9012ijkl',
-        },
-      },
-    };
-    mockGetMessageDetails.mockResolvedValue(healOnly);
-    const { container } = render(() => <MessageDetails messageId="retry-1" />);
-
-    await vi.waitFor(() => {
-      expect(container.textContent).toContain('Heal-attempt heal-901');
-    });
-
-    expect(container.textContent).not.toContain('Issue ');
-    expect(container.textContent).not.toContain('Patch ');
-  });
-
-  it('renders no Phoenix ids when autofix_decision is null', async () => {
-    // The retry panel with autofix_decision null (the default) must not render
-    // any Issue/Patch/Heal-attempt labels — covers the absent branch.
-    mockGetMessageDetails.mockResolvedValue(retryResponse);
-    const { container } = render(() => <MessageDetails messageId="retry-1" />);
-
-    await vi.waitFor(() => {
-      expect(container.textContent).toContain(
-        'Manifest caught an error, repaired the request, and retried it successfully.',
-      );
-    });
-
-    expect(container.querySelector('.autofix-card__ids')).toBeNull();
-    expect(container.textContent).not.toContain('Issue ');
-    expect(container.textContent).not.toContain('Patch ');
-    expect(container.textContent).not.toContain('Heal-attempt');
-  });
-
-  it("renders Phoenix's explanation summary and per-op detail when present", async () => {
-    // Phoenix now sends a human-readable "why". The card shows its summary in place
-    // of the generic phrase, and its authoritative per-op detail — which the local
-    // describeOperation could not produce for clamp_param (no from/to).
-    const withExplanation = {
-      message: {
-        ...retryResponse.message,
-        autofix_operations: [{ type: 'clamp_param' }],
-        autofix_decision: {
-          issueId: 'issue-1',
-          patchId: 'patch-1',
-          healAttemptId: 'heal-1',
-          explanation: {
-            summary:
-              "Your request set max_tokens above this model's limit, so it was capped at 8192.",
-            operations: [
-              { type: 'clamp_param', detail: 'Capped "max_tokens" at the maximum of 8192.' },
-            ],
-            source: 'deterministic',
-          },
-        },
-      },
-    };
-    mockGetMessageDetails.mockResolvedValue(withExplanation);
-    const { container } = render(() => <MessageDetails messageId="retry-1" />);
-
-    await vi.waitFor(() => {
-      expect(container.querySelector('.error-autofix-row__meta-table')).not.toBeNull();
-    });
-
-    const text = container.textContent!;
-    // Phoenix's summary replaces the generic success phrase.
-    expect(text).toContain('so it was capped at 8192');
-    expect(text).not.toContain(
-      'Manifest caught an error, repaired the request, and retried it successfully.',
-    );
-    // Phoenix's authoritative per-op detail (the local fallback couldn't describe clamp_param).
-    expect(text).toContain('Capped "max_tokens" at the maximum of 8192.');
-    expect(text).toContain('clamp_param');
-  });
-
-  it('renders a triple layout: autofix retry trigger → error → fallback next', async () => {
-    // A retry that itself failed and was recovered by a fallback: the request
-    // was triggered by an autofix (left), it errored (middle), and a fallback
-    // fired after (right) — the 3-column `--triple` layout.
-    mockGetMessageDetails.mockResolvedValue({
-      message: {
-        ...baseMessage,
-        id: 'triple-1',
-        status: 'fallback_error',
-        error_message: 'Overloaded',
-        autofix_applied: true,
-        autofix_role: 'retry',
-      },
-    });
-    const { container } = render(() => <MessageDetails messageId="triple-1" />);
-
-    await vi.waitFor(() => {
-      expect(container.querySelector('.error-autofix-row--triple')).not.toBeNull();
-    });
-
-    const text = container.textContent!;
-    // Trigger card (left): this request came from an autofix.
-    expect(text).toContain('This request was triggered by an autofix.');
-    // Error card (middle).
-    expect(container.querySelector('.msg-detail__error-inline')!.textContent).toBe('Overloaded');
-    // Next card (right): a fallback fired after the error.
-    expect(text).toContain('A fallback was triggered after this error.');
-  });
-
-  it('renders a triple layout: fallback trigger → error → autofix next, with the retry link', async () => {
-    // A request reached via fallback that also failed and then triggered an
-    // autofix: fallback trigger (left), error (middle), autofix next (right)
-    // carrying the forward link to the retry sibling.
-    const onOpenMessage = vi.fn();
-    mockGetMessageDetails.mockResolvedValue({
-      message: {
-        ...baseMessage,
-        id: 'triple-2',
-        status: 'error',
-        error_message: 'Bad param',
-        fallback_from_model: 'gemini-flash',
-        fallback_index: 2,
-        autofix_applied: true,
-        autofix_role: 'original',
-        autofix_sibling: { id: 'retry-2', role: 'retry', status: 'ok' },
-      },
-    });
-    const { container } = render(() => (
-      <MessageDetails messageId="triple-2" onOpenMessage={onOpenMessage} />
-    ));
-
-    await vi.waitFor(() => {
-      expect(container.querySelector('.error-autofix-row--triple')).not.toBeNull();
-    });
-
-    const text = container.textContent!;
-    // Fallback trigger card (left) with the 1-based attempt number + source.
-    expect(text).toContain('Attempt #3:');
-    expect(text).toContain('gemini-flash');
-    // Error card (middle).
-    expect(container.querySelector('.msg-detail__error-inline')!.textContent).toBe('Bad param');
-    // Autofix next card (right) with the forward link.
-    expect(text).toContain('Autofix was attempted after this error.');
-    const link = container.querySelector('.error-autofix-row__autofix-btn');
-    expect(link).not.toBeNull();
-    fireEvent.click(link!);
-    expect(onOpenMessage).toHaveBeenCalledWith('retry-2');
-  });
-
-  it('renders a 50/50 trigger+error layout when an autofix retry itself errors with nothing after', async () => {
-    // A retry that failed and was NOT recovered: trigger card (this came from an
-    // autofix) + the error, but no next-action card and no triple layout.
-    mockGetMessageDetails.mockResolvedValue({
-      message: {
-        ...baseMessage,
-        id: 'retry-fail-1',
-        status: 'error',
-        error_message: 'Retry also failed',
-        autofix_applied: true,
-        autofix_role: 'retry',
-      },
-    });
-    const { container } = render(() => <MessageDetails messageId="retry-fail-1" />);
-
-    await vi.waitFor(() => {
-      expect(container.textContent).toContain('This request was triggered by an autofix.');
-    });
-
-    // Error present, but no triple layout and no next-action cards.
-    expect(container.querySelector('.msg-detail__error-inline')!.textContent).toBe(
-      'Retry also failed',
-    );
-    expect(container.querySelector('.error-autofix-row--triple')).toBeNull();
-    expect(container.textContent).not.toContain('A fallback was triggered after this error.');
-    expect(container.textContent).not.toContain('Autofix was attempted after this error.');
-  });
-});
diff --git a/packages/frontend/tests/components/MessageDetails.test.tsx b/packages/frontend/tests/components/MessageDetails.test.tsx
index 7fe89925..e786de21 100644
--- a/packages/frontend/tests/components/MessageDetails.test.tsx
+++ b/packages/frontend/tests/components/MessageDetails.test.tsx
@@ -107,7 +107,7 @@ describe('MessageDetails', () => {
     const { container } = render(() => <MessageDetails messageId="msg-1" />);
     await vi.waitFor(() => {
       // The redesign renders the error message inside `.msg-detail__error-inline`
-      // (an icon + the message span) within the error/autofix row.
+      // (an icon + the message span) within the error/recovery row.
       const errorBox = container.querySelector('.msg-detail__error-inline');
       expect(errorBox).not.toBeNull();
       expect(errorBox!.textContent).toBe('401 Unauthorized: invalid API key');
@@ -252,8 +252,6 @@ describe('MessageDetails', () => {
         error_origin: 'provider',
         error_class: 'server_error',
         superseded: true,
-        autofix_applied: false,
-        autofix_role: null,
       },
     });
     const { container } = render(() => <MessageDetails messageId="msg-1" />);
@@ -263,16 +261,55 @@ describe('MessageDetails', () => {
     });
   });
 
-  it('does not treat a normalized superseded Autofix original as a fallback error', async () => {
-    // A superseded row that is the Autofix original must route to its own
-    // next-action panel, never the fallback one — the `!isAutofixOriginal`
-    // guard on the new superseded branch.
+  it('shows only the next-action card for a superseded fallback attempt', async () => {
+    // A fallback hop that failed and handed off again is superseded: it shows
+    // what came next, not what triggered it.
     mockGetMessageDetails.mockResolvedValue({
       message: {
         ...detailsResponse.message,
         status: 'failed',
-        error_message: 'Bad request',
+        error_message: 'Overloaded again',
         superseded: true,
+        fallback_from_model: 'gpt-4o',
+        fallback_index: 1,
+      },
+    });
+    const { container } = render(() => <MessageDetails messageId="msg-1" />);
+    await vi.waitFor(() => {
+      expect(container.textContent).toContain('A fallback was triggered after this error.');
+    });
+    expect(container.textContent).not.toContain('this request was triggered by a fallback from');
+  });
+
+  it('pairs a failed fallback attempt with its trigger when nothing came after', async () => {
+    mockGetMessageDetails.mockResolvedValue({
+      message: {
+        ...detailsResponse.message,
+        status: 'failed',
+        error_message: 'Still failing',
+        superseded: false,
+        fallback_from_model: 'gpt-4o',
+        fallback_index: 0,
+      },
+    });
+    const { container } = render(() => <MessageDetails messageId="msg-1" />);
+    await vi.waitFor(() => {
+      expect(container.textContent).toContain('Still failing');
+    });
+    const row = container.querySelector('.error-recovery-row');
+    expect(row).not.toBeNull();
+    expect(row!.classList.contains('error-recovery-row--solo')).toBe(false);
+    expect(container.textContent).toContain('this request was triggered by a fallback from');
+  });
+
+  it('never renders Autofix metadata or cards', async () => {
+    mockGetMessageDetails.mockResolvedValue({
+      message: {
+        ...detailsResponse.message,
+        status: 'failed',
+        error_message: 'Bad request',
+        // Legacy fields a pre-#16 backend may still send are ignored.
+        autofix_status: 'retry_succeeded',
         autofix_applied: true,
         autofix_role: 'original',
       },
@@ -281,7 +318,8 @@ describe('MessageDetails', () => {
     await vi.waitFor(() => {
       expect(container.textContent).toContain('Bad request');
     });
-    expect(container.textContent).not.toContain('A fallback was triggered after this error.');
+    expect(container.textContent).not.toMatch(/autofix/i);
+    expect(container.querySelector('.error-recovery-row--solo')).not.toBeNull();
   });
 
   it('shows message summary', async () => {
@@ -383,8 +421,8 @@ describe('MessageDetails', () => {
     const { container } = render(() => <MessageDetails messageId="msg-1" />);
     await vi.waitFor(() => {
       // A successful request reached via fallback renders the fallback
-      // trigger card (`.autofix-card--fallback`) with the attempt number.
-      const banner = container.querySelector('.autofix-card--fallback');
+      // trigger card (`.recovery-card--fallback`) with the attempt number.
+      const banner = container.querySelector('.recovery-card--fallback');
       expect(banner).not.toBeNull();
       expect(banner!.textContent).toContain('gemini-2.5-flash-lite');
       expect(banner!.textContent).toContain('#1');
@@ -395,7 +433,7 @@ describe('MessageDetails', () => {
     mockGetMessageDetails.mockResolvedValue(detailsResponse);
     const { container } = render(() => <MessageDetails messageId="msg-1" />);
     await vi.waitFor(() => {
-      expect(container.querySelector('.autofix-card--fallback')).toBeNull();
+      expect(container.querySelector('.recovery-card--fallback')).toBeNull();
     });
   });
 
@@ -663,7 +701,7 @@ describe('MessageDetails', () => {
     mockGetMessageDetails.mockResolvedValue(fallbackNoIndexResponse);
     const { container } = render(() => <MessageDetails messageId="msg-1" />);
     await vi.waitFor(() => {
-      const banner = container.querySelector('.autofix-card--fallback');
+      const banner = container.querySelector('.recovery-card--fallback');
       expect(banner).not.toBeNull();
       expect(banner!.textContent).toContain('gemini-2.5-flash-lite');
       // With no explicit index the attempt number falls back to #1 rather than
diff --git a/packages/frontend/tests/components/MessageTable.onOpenMessage.test.tsx b/packages/frontend/tests/components/MessageTable.onOpenMessage.test.tsx
deleted file mode 100644
index 043df682..00000000
--- a/packages/frontend/tests/components/MessageTable.onOpenMessage.test.tsx
+++ /dev/null
@@ -1,169 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { render, cleanup, fireEvent } from '@solidjs/testing-library';
-import type { MessageRow } from '../../src/components/message-table-types';
-
-// This suite renders the REAL MessageDetails inside an expanded MessageTable
-// row (unlike MessageTable.test.tsx, which stubs MessageDetails). It proves the
-// `onOpenMessage` prop is threaded end-to-end: table → ExpandableRow →
-// MessageDetails → Autofix link → handler. The api layer is mocked so the
-// resource resolves to an Autofixed original with a sibling.
-
-const mockGetMessageDetails = vi.fn();
-const mockFlagMiscategorized = vi.fn();
-const mockClearMiscategorized = vi.fn();
-vi.mock('../../src/services/api.js', () => ({
-  getMessageDetails: (...args: unknown[]) => mockGetMessageDetails(...args),
-  flagMessageMiscategorized: (...args: unknown[]) => mockFlagMiscategorized(...args),
-  clearMessageMiscategorized: (...args: unknown[]) => mockClearMiscategorized(...args),
-}));
-
-vi.mock('@solidjs/router', () => ({
-  A: (props: any) => (
-    <a href={props.href} class={props.class}>
-      {props.children}
-    </a>
-  ),
-}));
-
-vi.mock('../../src/services/formatters.js', () => ({
-  formatCost: (v: number) => (v < 0 ? null : `$${v.toFixed(2)}`),
-  formatNumber: (v: number) => String(v),
-  formatStatus: (s: string) => s,
-  formatTime: (t: string) => t,
-  formatDuration: (ms: number) => `${ms}ms`,
-  formatErrorMessage: (s: string) => s,
-  formatErrorOrigin: (o: string | null | undefined) => o ?? null,
-  formatErrorClass: (c: string | null | undefined) => c ?? null,
-  customProviderColor: () => '#6366f1',
-}));
-
-vi.mock('../../src/services/routing-utils.js', () => ({
-  inferProviderFromModel: (m: string) => (m.startsWith('gpt') ? 'openai' : null),
-  inferProviderName: (m: string) => (m.startsWith('gpt') ? 'OpenAI' : m),
-  resolveProviderId: (dbProvider: string) => (dbProvider ? dbProvider.toLowerCase() : undefined),
-  stripCustomPrefix: (m: string) => m.replace(/^custom:[^/]+\//, ''),
-}));
-
-vi.mock('../../src/services/providers.js', () => ({
-  PROVIDERS: [{ id: 'openai', name: 'OpenAI' }],
-}));
-
-vi.mock('../../src/services/model-display.js', () => ({
-  getModelDisplayName: (slug: string) => slug,
-}));
-
-vi.mock('../../src/components/ProviderIcon.jsx', () => ({
-  providerIcon: (id: string) => <span data-testid={`icon-${id}`} />,
-  customProviderLogo: () => null,
-}));
-
-vi.mock('../../src/components/AuthBadge.js', () => ({
-  authBadgeFor: () => null,
-  authLabel: () => 'API Key',
-}));
-
-vi.mock('../../src/components/InfoTooltip.jsx', () => ({
-  default: (props: any) => <span data-testid="info-tooltip" title={props.text} />,
-}));
-
-import MessageTable from '../../src/components/MessageTable';
-
-function makeRow(overrides: Partial<MessageRow> = {}): MessageRow {
-  return {
-    id: 'orig-1',
-    timestamp: '2026-02-16 10:00:00',
-    agent_name: 'test-agent',
-    model: 'gpt-4o',
-    input_tokens: 100,
-    output_tokens: 50,
-    total_tokens: 150,
-    cost: 0.05,
-    status: 'error',
-    ...overrides,
-  };
-}
-
-const originalDetail = {
-  message: {
-    id: 'orig-1',
-    timestamp: '2026-02-16 10:00:00',
-    agent_name: 'test-agent',
-    model: 'gpt-4o',
-    status: 'error',
-    error_message: 'Unknown parameter: max_tokens',
-    description: null,
-    service_type: 'agent',
-    input_tokens: 100,
-    output_tokens: 50,
-    cache_read_tokens: 0,
-    cache_creation_tokens: 0,
-    cost_usd: 0.05,
-    duration_ms: 1200,
-    trace_id: 'trace-abc123',
-    routing_tier: 'standard',
-    routing_reason: null,
-    specificity_category: null,
-    specificity_miscategorized: false,
-    auth_type: 'api_key',
-    provider_key_label: null,
-    skill_name: null,
-    fallback_from_model: null,
-    fallback_index: null,
-    session_key: null,
-    feedback_rating: null,
-    feedback_tags: null,
-    feedback_details: null,
-    request_headers: null,
-    request_params: null,
-    header_tier_id: null,
-    header_tier_name: null,
-    header_tier_color: null,
-    caller_attribution: null,
-    autofix_applied: true,
-    autofix_role: 'original',
-    autofix_operations: [{ type: 'rename_param', from: 'max_tokens', to: 'max_output_tokens' }],
-    autofix_sibling: { id: 'retry-1', role: 'retry', status: 'ok' },
-  },
-};
-
-describe('MessageTable onOpenMessage passthrough', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-  afterEach(() => {
-    cleanup();
-  });
-
-  it('threads onOpenMessage into an expanded row so the Autofix link opens the sibling', async () => {
-    mockGetMessageDetails.mockResolvedValue(originalDetail);
-    const onOpenMessage = vi.fn();
-    const { container } = render(() => (
-      <MessageTable
-        items={[makeRow()]}
-        columns={['date']}
-        agentName="agent-1"
-        customProviderName={() => undefined}
-        onOpenMessage={onOpenMessage}
-        rowIdPrefix="msg-"
-        expandable
-      />
-    ));
-
-    // Expand the row via the chevron.
-    const chevron = container.querySelector('.msg-detail__chevron-btn') as HTMLButtonElement;
-    expect(chevron).not.toBeNull();
-    fireEvent.click(chevron);
-
-    // The real MessageDetails resource resolves and renders the Autofix link.
-    const link = await vi.waitFor(() => {
-      const el = container.querySelector('.error-autofix-row__autofix-btn');
-      expect(el).not.toBeNull();
-      return el as HTMLButtonElement;
-    });
-    expect(link.textContent).toContain('View Autofix retry');
-
-    // Clicking the sibling link calls the table's onOpenMessage with the id.
-    fireEvent.click(link);
-    expect(onOpenMessage).toHaveBeenCalledWith('retry-1');
-  });
-});
diff --git a/packages/frontend/tests/components/MessageTable.test.tsx b/packages/frontend/tests/components/MessageTable.test.tsx
index 01483a8c..a4c51fa0 100644
--- a/packages/frontend/tests/components/MessageTable.test.tsx
+++ b/packages/frontend/tests/components/MessageTable.test.tsx
@@ -83,15 +83,7 @@ vi.mock('../../src/components/InfoTooltip.jsx', () => ({
 }));
 
 vi.mock('../../src/components/MessageDetails.jsx', () => ({
-  // Reads `onOpenMessage` so the lazy prop getter that threads it through
-  // MessageTable is exercised.
-  default: (props: any) => (
-    <div
-      data-testid="message-details"
-      data-id={props.messageId}
-      data-has-open={props.onOpenMessage ? 'yes' : 'no'}
-    />
-  ),
+  default: (props: any) => <div data-testid="message-details" data-id={props.messageId} />,
 }));
 
 import MessageTable from '../../src/components/MessageTable';
@@ -170,7 +162,7 @@ describe('MessageTable', () => {
           agentName="agent-1"
         />
       ));
-      const tokensHeader = container.querySelectorAll('th')[7]!; // 'totalTokens' is at index 7 in COMPACT_COLUMNS (after selfheal)
+      const tokensHeader = container.querySelectorAll('th')[7]!; // 'totalTokens' is at index 7 in COMPACT_COLUMNS (after recovery)
       expect(tokensHeader.textContent).toBe('Tokens');
       expect(tokensHeader.querySelector('[data-testid="info-tooltip"]')).toBeNull();
     });
@@ -499,19 +491,6 @@ describe('MessageTable', () => {
   });
 
   describe('attempts column', () => {
-    it('renders just the attempt count (no icons) for a row with autofix_applied', () => {
-      const { container } = render(() => (
-        <MessageTable
-          items={[makeRow({ attempt_count: 2, autofix_applied: true })]}
-          columns={['attempts']}
-          agentName="agent-1"
-        />
-      ));
-      expect(container.querySelector('td')!.textContent).toContain('2');
-      // Icons moved to selfheal column
-      expect(container.querySelector('[title="Autofix"]')).toBeNull();
-    });
-
     it('renders just the attempt count (no icons) when fallback_from_model is set', () => {
       const { container } = render(() => (
         <MessageTable
@@ -521,30 +500,17 @@ describe('MessageTable', () => {
         />
       ));
       expect(container.querySelector('td')!.textContent).toContain('2');
-      // Icons moved to selfheal column
+      // Icons live in the recovery column
       expect(container.querySelector('[title="Fallback"]')).toBeNull();
     });
   });
 
-  describe('selfheal column', () => {
-    it('renders autofix icon with text label when autofix_applied', () => {
-      const { container } = render(() => (
-        <MessageTable
-          items={[makeRow({ autofix_applied: true })]}
-          columns={['selfheal']}
-          agentName="agent-1"
-        />
-      ));
-      const badge = container.querySelector('[title="Autofix"]') as HTMLElement;
-      expect(badge).not.toBeNull();
-      expect(badge.textContent).toContain('autofix');
-    });
-
+  describe('recovery column', () => {
     it('renders fallback icon with text label when fallback_from_model is set', () => {
       const { container } = render(() => (
         <MessageTable
           items={[makeRow({ fallback_from_model: 'gpt-4o' })]}
-          columns={['selfheal']}
+          columns={['recovery']}
           agentName="agent-1"
         />
       ));
@@ -553,11 +519,11 @@ describe('MessageTable', () => {
       expect(badge.textContent).toContain('fallback');
     });
 
-    it('renders dash when neither autofix nor fallback applies', () => {
+    it('renders dash when no fallback applies', () => {
       const { container } = render(() => (
         <MessageTable
           items={[makeRow()]}
-          columns={['selfheal']}
+          columns={['recovery']}
           agentName="agent-1"
         />
       ));
@@ -740,22 +706,6 @@ describe('MessageTable', () => {
       expect(details!.getAttribute('data-id')).toBe('specific-msg-id');
     });
 
-    it('threads onOpenMessage through to the expanded MessageDetails', () => {
-      const { container } = render(() => (
-        <MessageTable
-          items={[makeRow()]}
-          columns={['date']}
-          agentName="agent-1"
-          expandable
-          onOpenMessage={vi.fn()}
-        />
-      ));
-      const btn = container.querySelector('.msg-detail__chevron-btn') as HTMLButtonElement;
-      fireEvent.click(btn);
-      const details = container.querySelector('[data-testid="message-details"]');
-      expect(details!.getAttribute('data-has-open')).toBe('yes');
-    });
-
     it('sets aria-label on chevron button', () => {
       const { container } = render(() => (
         <MessageTable
diff --git a/packages/frontend/tests/components/NotificationBell.test.tsx b/packages/frontend/tests/components/NotificationBell.test.tsx
deleted file mode 100644
index ab65b9a8..00000000
--- a/packages/frontend/tests/components/NotificationBell.test.tsx
+++ /dev/null
@@ -1,182 +0,0 @@
-import { fireEvent, render, screen, waitFor } from '@solidjs/testing-library';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-const mockGetStatus = vi.fn();
-const mockGetAgents = vi.fn();
-
-vi.mock('@solidjs/router', () => ({
-  A: (props: any) => (
-    <a href={props.href} class={props.class} classList={props.classList} onClick={props.onClick}>
-      {props.children}
-    </a>
-  ),
-}));
-
-vi.mock('../../src/services/api/analytics.js', () => ({
-  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by Autofix or fallback.',
-  REQUEST_SUCCESS_RATE_TOOLTIP:
-    'Successful requests over all requests. Recovered requests count as successful.',
-  totalAttemptsTooltip: (doctor: boolean) =>
-    doctor
-      ? 'Every provider call counts here, including fallback retries and autofixed attempts. One request can produce several attempts.'
-      : 'Every provider call counts here, including fallback retries. One request can produce several attempts.',
-  MODEL_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this model.',
-  PROVIDER_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this provider.',
-  CONNECTION_SUCCESS_RATE_TOOLTIP_30D:
-    'Successful attempts over all attempts for this connection, over the last 30 days.',
-  CONNECTION_SUCCESS_RATE_TOOLTIP:
-    'Successful attempts over all attempts for this connection, on the filtered period.',
-  CONNECTION_HARNESS_SUCCESS_RATE_TOOLTIP:
-    'Successful attempts over all attempts for this harness on this connection.',
-  HARNESS_SUCCESS_RATE_TOOLTIP: 'Successful requests over all requests for this harness.',
-  HARNESS_TOTAL_REQUESTS_TOOLTIP:
-    'Logical requests from this harness, one per call, whatever the number of attempts.',
-  attemptSuccessRate: (row: { attempts: number; succeeded?: number }) =>
-    !row.attempts || row.succeeded == null ? null : row.succeeded / row.attempts,
-  getWorkspaceAutofixStatus: (...args: unknown[]) => mockGetStatus(...args),
-}));
-
-vi.mock('../../src/services/api.js', () => ({
-  getAgents: (...args: unknown[]) => mockGetAgents(...args),
-}));
-
-vi.mock('../../src/services/sse.js', async () => {
-  const { createSignal } = await import('solid-js');
-  const [messagePing, setMessagePing] = createSignal(0);
-  return {
-    messagePing,
-    agentPing: () => 0,
-    routingPing: () => 0,
-    __setMessagePing: setMessagePing,
-  };
-});
-
-import NotificationBell from '../../src/components/NotificationBell';
-import * as sse from '../../src/services/sse.js';
-
-const setMessagePing = (sse as unknown as { __setMessagePing: (n: number) => void })
-  .__setMessagePing;
-
-describe('NotificationBell', () => {
-  beforeEach(() => {
-    vi.useFakeTimers({ shouldAdvanceTime: true });
-    localStorage.clear();
-    mockGetStatus.mockResolvedValue({
-      any_enabled: false,
-      enabled_agents: [],
-    });
-    mockGetAgents.mockResolvedValue({
-      agents: [{ agent_name: 'demo', display_name: 'Demo agent' }],
-    });
-  });
-
-  afterEach(() => {
-    vi.useRealTimers();
-  });
-
-  it('shows disabled agents, marks them read, and closes outside', async () => {
-    render(() => <NotificationBell />);
-
-    await waitFor(() => expect(screen.getByLabelText('Notifications')).toBeDefined());
-    fireEvent.click(screen.getByLabelText('Notifications'));
-    const link = screen.getByText(/Autofix is inactive on/).closest('a')!;
-    expect(link.getAttribute('href')).toBe('/harnesses/demo/settings?highlight=autofix');
-    fireEvent.click(link);
-    expect(localStorage.getItem('manifest_notif_read')).toContain('demo');
-    expect(screen.queryByText(/Autofix is inactive on/)).toBeNull();
-
-    fireEvent.click(screen.getByLabelText('Notifications'));
-    expect(screen.getByText(/Autofix is inactive on/)).toBeDefined();
-    fireEvent.mouseDown(document.body);
-    expect(screen.queryByText(/Autofix is inactive on/)).toBeNull();
-  });
-
-  it('clears read state after an agent is enabled and accepts array agent responses', async () => {
-    localStorage.setItem('manifest_notif_read', JSON.stringify(['demo']));
-    mockGetAgents.mockResolvedValue([{ agent_name: 'demo', display_name: '' }]);
-    mockGetStatus
-      .mockResolvedValueOnce({ any_enabled: false, enabled_agents: [], consented: true })
-      .mockResolvedValue({ any_enabled: true, enabled_agents: ['demo'], consented: true });
-    render(() => <NotificationBell />);
-
-    await waitFor(() => expect(screen.getByLabelText('Notifications')).toBeDefined());
-    await vi.advanceTimersByTimeAsync(60_000);
-    await waitFor(() => expect(screen.queryByLabelText('Notifications')).toBeNull());
-    expect(localStorage.getItem('manifest_notif_read')).toBe('[]');
-  });
-
-  it('does not refetch the workspace Autofix status when a new message arrives', async () => {
-    // Every gateway request emits a message ping. Refetching the status on each
-    // one made this bell the busiest dashboard endpoint in production, and the
-    // status only changes on an Autofix toggle, never on traffic.
-    render(() => <NotificationBell />);
-    await waitFor(() => expect(mockGetStatus).toHaveBeenCalledTimes(1));
-
-    setMessagePing(1);
-    await vi.advanceTimersByTimeAsync(1_000);
-
-    expect(mockGetStatus).toHaveBeenCalledTimes(1);
-  });
-
-  it('polls the workspace Autofix status once a minute, not every 15 seconds', async () => {
-    render(() => <NotificationBell />);
-    await waitFor(() => expect(mockGetStatus).toHaveBeenCalledTimes(1));
-
-    await vi.advanceTimersByTimeAsync(15_000);
-    expect(mockGetStatus).toHaveBeenCalledTimes(1);
-
-    await vi.advanceTimersByTimeAsync(45_000);
-    await waitFor(() => expect(mockGetStatus).toHaveBeenCalledTimes(2));
-  });
-
-  it('hides itself when loading agents fails', async () => {
-    mockGetAgents.mockRejectedValue(new Error('offline'));
-    render(() => <NotificationBell />);
-    await waitFor(() => expect(mockGetAgents).toHaveBeenCalled());
-    expect(screen.queryByLabelText('Notifications')).toBeNull();
-  });
-
-  it('hides itself when loading workspace Autofix status fails', async () => {
-    mockGetStatus.mockRejectedValue(new Error('offline'));
-    render(() => <NotificationBell />);
-    await waitFor(() => expect(mockGetStatus).toHaveBeenCalled());
-    expect(screen.queryByLabelText('Notifications')).toBeNull();
-  });
-
-  it('recovers from unread-state storage failures', async () => {
-    const getItem = vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
-      throw new Error('blocked');
-    });
-    render(() => <NotificationBell />);
-    await waitFor(() => expect(mockGetAgents).toHaveBeenCalled());
-    expect(screen.queryByLabelText('Notifications')).toBeNull();
-    getItem.mockRestore();
-  });
-
-  it('keeps working when marking a notification read cannot persist', async () => {
-    render(() => <NotificationBell />);
-    await waitFor(() => expect(screen.getByLabelText('Notifications')).toBeDefined());
-    fireEvent.click(screen.getByLabelText('Notifications'));
-    const setItem = vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
-      throw new Error('blocked');
-    });
-    fireEvent.click(screen.getByText(/Autofix is inactive on/).closest('a')!);
-    expect(screen.queryByText(/Autofix is inactive on/)).toBeNull();
-    setItem.mockRestore();
-  });
-
-  it('keeps working when clearing enabled-agent read state cannot persist', async () => {
-    localStorage.setItem('manifest_notif_read', JSON.stringify(['demo']));
-    mockGetStatus
-      .mockResolvedValueOnce({ any_enabled: false, enabled_agents: [], consented: true })
-      .mockResolvedValue({ any_enabled: true, enabled_agents: ['demo'], consented: true });
-    render(() => <NotificationBell />);
-    await waitFor(() => expect(screen.getByLabelText('Notifications')).toBeDefined());
-    const setItem = vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
-      throw new Error('blocked');
-    });
-    await vi.advanceTimersByTimeAsync(60_000);
-    await waitFor(() => expect(screen.queryByLabelText('Notifications')).toBeNull());
-    setItem.mockRestore();
-  });
-});
diff --git a/packages/frontend/tests/components/RequestDrawer.test.tsx b/packages/frontend/tests/components/RequestDrawer.test.tsx
index 630f322c..c182d47b 100644
--- a/packages/frontend/tests/components/RequestDrawer.test.tsx
+++ b/packages/frontend/tests/components/RequestDrawer.test.tsx
@@ -21,9 +21,11 @@ vi.mock('../../src/components/MessageDetailsSections.jsx', () => ({
 
 import RequestDrawer from '../../src/components/RequestDrawer';
 
+// The `autofix_*` fields mimic what a backend that predates #16 may still send:
+// the drawer must ignore them.
 const fullMessage = {
   id: 'request-1234567890',
-  status: 'auto_fixed',
+  status: 'failed',
   provider: 'openai',
   model: 'requested-model',
   model_id: 'requested-model-id',
@@ -47,7 +49,7 @@ const fullMessage = {
   attempts: [
     {
       id: 'attempt-1',
-      status: 'auto_fixed',
+      status: 'error',
       provider: 'openai',
       model: 'gpt-4o',
       model_id: 'gpt-4o-id',
@@ -114,21 +116,18 @@ describe('RequestDrawer', () => {
 
     await waitFor(() => expect(screen.getByText('Request request-1234')).toBeDefined());
     expect(mockGetMessageDetails).toHaveBeenCalledWith('request-1234567890');
-    expect(screen.getAllByText('Autofixed').length).toBeGreaterThan(0);
-    expect(screen.getByText('Autofix: Retry succeeded')).toBeDefined();
-    // The header meta row carries NO fallback/autofix badge: that story belongs
-    // to the attempts (sidebar icons + context cards), not the request title.
+    expect(screen.getAllByText('Failed').length).toBeGreaterThan(0);
+    // The header meta row carries NO fallback badge: that story belongs to the
+    // attempts (sidebar icons + context cards), not the request title.
     expect(container.querySelector('.drawer__meta-row .trigger-badge')).toBeNull();
-    // The branded badges still exist further down, on the attempt content.
-    expect(screen.getAllByText('autofix').length).toBeGreaterThan(0);
-    // Sidebar attempt icons use the same branded squares.
+    // Sidebar attempt icons use the branded fallback square.
     expect(container.querySelector('.attempt-item__icon .fallback-icon')).not.toBeNull();
-    expect(container.querySelector('.attempt-item__icon .autofix-icon')).not.toBeNull();
     expect(screen.getByText('bad parameter')).toBeDefined();
     expect(screen.getByText('invalid_request')).toBeDefined();
     expect(screen.getByText('$0.0123')).toBeDefined();
-    // Autofix context card: role-aware copy + operations table.
-    expect(container.textContent).toContain('rename: old → new');
+    // Legacy autofix fields are ignored: no status line, badge or operations.
+    expect(container.textContent).not.toMatch(/autofix/i);
+    expect(container.textContent).not.toContain('rename: old → new');
 
     fireEvent.click(screen.getByText('Request headers'));
     expect(screen.getByText('alpha')).toBeDefined();
@@ -151,24 +150,8 @@ describe('RequestDrawer', () => {
     expect(onClose).toHaveBeenCalledTimes(2);
   });
 
-  it.each([
-    ['no_patch', 'No patch'],
-    ['resolving', 'Resolving'],
-    ['retry_succeeded', 'Retry succeeded'],
-    ['retry_failed', 'Retry failed'],
-    ['service_error', 'Service error'],
-  ] as const)('labels the %s request outcome as %s', async (autofix_status, label) => {
-    mockGetMessageDetails.mockResolvedValue({
-      message: { ...fullMessage, autofix_status },
-    });
-    render(() => <RequestDrawer messageId={`status-${autofix_status}`} onClose={vi.fn()} />);
-
-    await waitFor(() => expect(screen.getByText(`Autofix: ${label}`)).toBeDefined());
-  });
-
   it.each([
     [{ fallback_from_model: 'old' }, 'fallback'],
-    [{ autofix_role: 'retry' }, 'autofix'],
     [{}, 'initial'],
   ])('builds a single %s attempt when no attempt array is present', async (extra, type) => {
     mockGetMessageDetails.mockResolvedValue({
@@ -179,7 +162,6 @@ describe('RequestDrawer', () => {
       autofix_applied: false,
       fallback_index: undefined,
       fallback_from_model: (extra as { fallback_from_model?: string }).fallback_from_model,
-      autofix_role: (extra as { autofix_role?: string }).autofix_role,
       request_headers: { header: 'value' },
       request_params: { max_tokens: 10 },
       cost: 0,
diff --git a/packages/frontend/tests/components/SocialButtons.test.tsx b/packages/frontend/tests/components/SocialButtons.test.tsx
index c2af18b9..51e41dbf 100644
--- a/packages/frontend/tests/components/SocialButtons.test.tsx
+++ b/packages/frontend/tests/components/SocialButtons.test.tsx
@@ -107,11 +107,11 @@ describe('SocialButtons', () => {
   });
 
   it('accepts a signup-specific callback override', async () => {
-    render(() => <SocialButtons callbackURL="/discovery?next=%2Fwelcome&signup=1" />);
+    render(() => <SocialButtons callbackURL="/welcome" />);
     await fireEvent.click(screen.getByText('Continue with GitHub'));
     expect(mockSignInSocial).toHaveBeenCalledWith({
       provider: 'github',
-      callbackURL: '/discovery?next=%2Fwelcome&signup=1',
+      callbackURL: '/welcome',
       errorCallbackURL: '/login?oauth=failed',
     });
   });
diff --git a/packages/frontend/tests/components/VersionIndicator.test.tsx b/packages/frontend/tests/components/VersionIndicator.test.tsx
index 0fd8471c..1749b210 100644
--- a/packages/frontend/tests/components/VersionIndicator.test.tsx
+++ b/packages/frontend/tests/components/VersionIndicator.test.tsx
@@ -1,52 +1,13 @@
-import { describe, it, expect, afterEach, beforeEach, vi } from 'vitest';
-import { fireEvent, render, waitFor } from '@solidjs/testing-library';
-import VersionIndicator, {
-  UPDATE_DISMISSED_STORAGE_KEY,
-} from '../../src/components/VersionIndicator';
-import { getVersionInfo, type VersionInfo } from '../../src/services/api/version.js';
-
-vi.mock('../../src/services/api/version.js', () => ({
-  getVersionInfo: vi.fn(),
-}));
-
-const mockGetVersionInfo = vi.mocked(getVersionInfo);
-
-function info(overrides: Partial<VersionInfo> = {}): VersionInfo {
-  return {
-    current: __MANIFEST_VERSION__,
-    latest: __MANIFEST_VERSION__,
-    update_available: false,
-    releases_behind: 0,
-    release_url: `https://manifest.build/changelog/#v${__MANIFEST_VERSION__.replace(/\./g, '-')}`,
-    github_release_url: null,
-    upgrade_docs_url: 'https://manifest.build/llm-gateway/docs/self-hosted/#upgrading',
-    upgrade_command: 'docker compose pull && docker compose up -d',
-    check_enabled: true,
-    checked_at: '2026-09-04T09:00:00.000Z',
-    ...overrides,
-  };
-}
-
-const newer = () =>
-  info({
-    latest: '9.9.9',
-    update_available: true,
-    releases_behind: 9,
-    release_url: 'https://manifest.build/changelog/#v9-9-9',
-  });
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { render } from '@solidjs/testing-library';
+import VersionIndicator from '../../src/components/VersionIndicator';
 
 describe('VersionIndicator', () => {
-  beforeEach(() => {
-    mockGetVersionInfo.mockReset();
-    mockGetVersionInfo.mockResolvedValue(info());
-    localStorage.clear();
-  });
-
   afterEach(() => {
     vi.restoreAllMocks();
   });
 
-  it('renders v{version}', () => {
+  it('renders the build-time version', () => {
     const { container } = render(() => <VersionIndicator />);
     const badge = container.querySelector('.version-indicator');
     expect(badge).not.toBeNull();
@@ -54,99 +15,11 @@ describe('VersionIndicator', () => {
     expect(badge?.getAttribute('aria-label')).toBe(`Version ${__MANIFEST_VERSION__}`);
   });
 
-  it('keeps the plain badge when already on the latest release', async () => {
-    const { container } = render(() => <VersionIndicator />);
-    await waitFor(() => expect(mockGetVersionInfo).toHaveBeenCalledTimes(1));
-    expect(container.querySelector('.version-indicator__update')).toBeNull();
-    expect(container.querySelector('.version-indicator')?.textContent).toBe(
-      `v${__MANIFEST_VERSION__}`,
-    );
-  });
-
-  it('links to the changelog when a newer release exists', async () => {
-    mockGetVersionInfo.mockResolvedValue(newer());
-    const { container, findByText } = render(() => <VersionIndicator />);
-
-    const changelog = (await findByText('v9.9.9 available')) as HTMLAnchorElement;
-    expect(changelog.tagName).toBe('A');
-    expect(changelog.href).toBe('https://manifest.build/changelog/#v9-9-9');
-    expect(changelog.target).toBe('_blank');
-    expect(changelog.rel).toContain('noopener');
-
-    const badge = container.querySelector('.version-indicator');
-    expect(badge?.classList.contains('version-indicator--update')).toBe(true);
-    expect(badge?.getAttribute('aria-label')).toBe(
-      `Version ${__MANIFEST_VERSION__}, update to 9.9.9 available`,
-    );
-  });
-
-  it('shows neither an upgrade link nor a releases-behind count', async () => {
-    mockGetVersionInfo.mockResolvedValue(newer());
-    const { container, findByText } = render(() => <VersionIndicator />);
-
-    await findByText('v9.9.9 available');
-    expect(container.querySelector('.version-indicator__upgrade')).toBeNull();
-    expect(container.textContent).not.toContain('behind');
-    expect(container.textContent).not.toContain('How to upgrade');
-  });
-
-  it('hides the update notice when dismissed and remembers the dismissed version', async () => {
-    mockGetVersionInfo.mockResolvedValue(newer());
-    const { container, findByLabelText } = render(() => <VersionIndicator />);
-
-    const close = await findByLabelText('Dismiss update notice');
-    expect(close.tagName).toBe('BUTTON');
-    fireEvent.click(close);
-
-    expect(container.querySelector('.version-indicator__update')).toBeNull();
-    expect(container.querySelector('.version-indicator')?.textContent).toBe(
-      `v${__MANIFEST_VERSION__}`,
-    );
-    expect(container.querySelector('.version-indicator--update')).toBeNull();
-    expect(localStorage.getItem(UPDATE_DISMISSED_STORAGE_KEY)).toBe('9.9.9');
-  });
-
-  it('stays dismissed on later loads while the latest version is unchanged', async () => {
-    localStorage.setItem(UPDATE_DISMISSED_STORAGE_KEY, '9.9.9');
-    mockGetVersionInfo.mockResolvedValue(newer());
-    const { container } = render(() => <VersionIndicator />);
-
-    await waitFor(() => expect(mockGetVersionInfo).toHaveBeenCalledTimes(1));
-    await Promise.resolve();
-    expect(container.querySelector('.version-indicator__update')).toBeNull();
-  });
-
-  it('shows the notice again once an even newer version is released', async () => {
-    localStorage.setItem(UPDATE_DISMISSED_STORAGE_KEY, '9.9.8');
-    mockGetVersionInfo.mockResolvedValue(newer());
-    const { findByText } = render(() => <VersionIndicator />);
-
-    await expect(findByText('v9.9.9 available')).resolves.toBeTruthy();
-  });
-
-  it('still works when localStorage is unavailable', async () => {
-    vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
-      throw new Error('blocked');
-    });
-    vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
-      throw new Error('blocked');
-    });
-    mockGetVersionInfo.mockResolvedValue(newer());
-    const { container, findByLabelText, findByText } = render(() => <VersionIndicator />);
-
-    await findByText('v9.9.9 available');
-    fireEvent.click(await findByLabelText('Dismiss update notice'));
-    expect(container.querySelector('.version-indicator__update')).toBeNull();
-  });
-
-  it('keeps the plain badge when the version check fails', async () => {
-    mockGetVersionInfo.mockRejectedValue(new Error('network down'));
+  it('makes no network request and offers no update link', () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch');
     const { container } = render(() => <VersionIndicator />);
-    await waitFor(() => expect(mockGetVersionInfo).toHaveBeenCalledTimes(1));
-    await Promise.resolve();
-    expect(container.querySelector('.version-indicator__update')).toBeNull();
-    expect(container.querySelector('.version-indicator')?.textContent).toBe(
-      `v${__MANIFEST_VERSION__}`,
-    );
+    expect(fetchSpy).not.toHaveBeenCalled();
+    expect(container.querySelector('a')).toBeNull();
+    expect(container.querySelector('button')).toBeNull();
   });
 });
diff --git a/packages/frontend/tests/components/WingmanDevTools.test.tsx b/packages/frontend/tests/components/WingmanDevTools.test.tsx
deleted file mode 100644
index 425e8dc9..00000000
--- a/packages/frontend/tests/components/WingmanDevTools.test.tsx
+++ /dev/null
@@ -1,194 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { render, fireEvent } from "@solidjs/testing-library";
-import WingmanDevTools from "../../src/components/WingmanDevTools.jsx";
-
-// Vite would inject these at build time. Vitest needs them defined manually
-// before the module under test reads them.
-declare global {
-  // eslint-disable-next-line no-var
-  var __WINGMAN_URL__: string;
-  // eslint-disable-next-line no-var
-  var __DEV_MODE__: boolean;
-}
-
-const STORAGE_OPEN = "manifest:wingman:open";
-const STORAGE_HEIGHT = "manifest:wingman:height";
-
-describe("WingmanDevTools", () => {
-  let originalOpen: typeof window.open;
-
-  beforeEach(() => {
-    globalThis.__WINGMAN_URL__ = "";
-    globalThis.__DEV_MODE__ = true;
-    localStorage.clear();
-    originalOpen = window.open;
-    window.open = (() => null) as typeof window.open;
-    Object.defineProperty(window, "location", {
-      value: {
-        ...window.location,
-        protocol: "http:",
-        hostname: "localhost",
-        port: "11096",
-        origin: "http://localhost:11096",
-      },
-      writable: true,
-    });
-  });
-
-  afterEach(() => {
-    window.open = originalOpen;
-  });
-
-  it("renders the FAB by default and not the drawer", () => {
-    const { container } = render(() => <WingmanDevTools />);
-    expect(container.querySelector(".wingman-fab")).not.toBeNull();
-    expect(container.querySelector(".wingman-drawer")).toBeNull();
-  });
-
-  it("opens the drawer when the FAB is clicked and persists state", async () => {
-    const { container } = render(() => <WingmanDevTools />);
-    const fab = container.querySelector(".wingman-fab") as HTMLButtonElement;
-    await fireEvent.click(fab);
-    expect(container.querySelector(".wingman-drawer")).not.toBeNull();
-    expect(container.querySelector(".wingman-fab")).toBeNull();
-    expect(localStorage.getItem(STORAGE_OPEN)).toBe("1");
-  });
-
-  it("closes the drawer when the close button is clicked", async () => {
-    localStorage.setItem(STORAGE_OPEN, "1");
-    const { container } = render(() => <WingmanDevTools />);
-    const closeBtn = container.querySelector(
-      '.wingman-drawer__icon-btn[aria-label="Close Wingman drawer"]',
-    ) as HTMLButtonElement;
-    await fireEvent.click(closeBtn);
-    expect(container.querySelector(".wingman-drawer")).toBeNull();
-    expect(container.querySelector(".wingman-fab")).not.toBeNull();
-    expect(localStorage.getItem(STORAGE_OPEN)).toBe("0");
-  });
-
-  it("points the iframe at the hosted Wingman with a pre-filled baseUrl", () => {
-    localStorage.setItem(STORAGE_OPEN, "1");
-    const { container } = render(() => <WingmanDevTools />);
-    const iframe = container.querySelector(
-      ".wingman-drawer__frame",
-    ) as HTMLIFrameElement;
-    expect(iframe).not.toBeNull();
-    expect(iframe.src.startsWith("https://wingman.manifest.build/")).toBe(true);
-    expect(iframe.src).toContain(
-      "baseUrl=" + encodeURIComponent("http://localhost:11096"),
-    );
-  });
-
-  // Without this delegation Chrome denies `local-network-access` by
-  // permissions policy inside a cross-origin iframe, so the permission can
-  // never even be prompted for. It is only a fallback — the drawer normally
-  // points at a loopback origin where no permission is involved — but if it
-  // ever frames an https origin again, this is what keeps it recoverable.
-  it("delegates local-network-access to the iframe", () => {
-    localStorage.setItem(STORAGE_OPEN, "1");
-    const { container } = render(() => <WingmanDevTools />);
-    const iframe = container.querySelector(
-      ".wingman-drawer__frame",
-    ) as HTMLIFrameElement;
-    expect(iframe.getAttribute("allow")).toContain("local-network-access");
-  });
-
-  it("respects a build-time __WINGMAN_URL__ override", () => {
-    globalThis.__WINGMAN_URL__ = "http://wingman.test:5555";
-    localStorage.setItem(STORAGE_OPEN, "1");
-    const { container } = render(() => <WingmanDevTools />);
-    const iframe = container.querySelector(
-      ".wingman-drawer__frame",
-    ) as HTMLIFrameElement;
-    expect(iframe.src.startsWith("http://wingman.test:5555/")).toBe(true);
-  });
-
-  it("clamps the stored height to the allowed range", () => {
-    localStorage.setItem(STORAGE_OPEN, "1");
-    localStorage.setItem(STORAGE_HEIGHT, "999");
-    const { container } = render(() => <WingmanDevTools />);
-    const drawer = container.querySelector(".wingman-drawer") as HTMLElement;
-    expect(drawer.style.height).toBe("90vh");
-  });
-
-  it("falls back to default height when the stored value is non-numeric", () => {
-    localStorage.setItem(STORAGE_OPEN, "1");
-    localStorage.setItem(STORAGE_HEIGHT, "not-a-number");
-    const { container } = render(() => <WingmanDevTools />);
-    const drawer = container.querySelector(".wingman-drawer") as HTMLElement;
-    expect(drawer.style.height).toBe("50vh");
-  });
-
-  it("toggles via Cmd/Ctrl+Shift+W", async () => {
-    const { container } = render(() => <WingmanDevTools />);
-    expect(container.querySelector(".wingman-drawer")).toBeNull();
-    const event = new KeyboardEvent("keydown", {
-      key: "W",
-      shiftKey: true,
-      ctrlKey: true,
-      bubbles: true,
-    });
-    document.dispatchEvent(event);
-    expect(container.querySelector(".wingman-drawer")).not.toBeNull();
-  });
-
-  it("closes via Escape when open", async () => {
-    localStorage.setItem(STORAGE_OPEN, "1");
-    const { container } = render(() => <WingmanDevTools />);
-    expect(container.querySelector(".wingman-drawer")).not.toBeNull();
-    const event = new KeyboardEvent("keydown", { key: "Escape", bubbles: true });
-    document.dispatchEvent(event);
-    expect(container.querySelector(".wingman-drawer")).toBeNull();
-  });
-
-  it("Escape is a no-op when the drawer is closed", () => {
-    const { container } = render(() => <WingmanDevTools />);
-    const event = new KeyboardEvent("keydown", { key: "Escape", bubbles: true });
-    document.dispatchEvent(event);
-    expect(container.querySelector(".wingman-fab")).not.toBeNull();
-  });
-
-  it("opens a new tab when the external link is clicked", async () => {
-    let opened: string | undefined;
-    window.open = ((url?: string | URL) => {
-      opened = typeof url === "string" ? url : url?.toString();
-      return null;
-    }) as typeof window.open;
-    localStorage.setItem(STORAGE_OPEN, "1");
-    const { container } = render(() => <WingmanDevTools />);
-    const link = container.querySelector(
-      '.wingman-drawer__icon-btn[aria-label="Open Wingman in a new tab"]',
-    ) as HTMLAnchorElement;
-    expect(link).not.toBeNull();
-    expect(link.href).toContain("baseUrl=");
-  });
-
-  it("resizes the drawer via the top handle pointer drag", async () => {
-    Object.defineProperty(window, "innerHeight", { value: 1000, writable: true });
-    localStorage.setItem(STORAGE_OPEN, "1");
-    const { container } = render(() => <WingmanDevTools />);
-    const drawer = container.querySelector(".wingman-drawer") as HTMLElement;
-    const resizer = container.querySelector(
-      ".wingman-drawer__resizer",
-    ) as HTMLElement;
-    expect(drawer.style.height).toBe("50vh");
-
-    // jsdom doesn't implement PointerEvent; fake one with the minimum surface
-    // the component relies on (`clientY` and `preventDefault`).
-    const makePointer = (type: string, clientY: number) => {
-      const e = new MouseEvent(type, { bubbles: true, cancelable: true });
-      Object.defineProperty(e, "clientY", { value: clientY });
-      return e;
-    };
-
-    resizer.dispatchEvent(makePointer("pointerdown", 500));
-    document.dispatchEvent(makePointer("pointermove", 300));
-    // 1000 - 300 = 700px from bottom -> 70vh
-    expect(drawer.style.height).toBe("70vh");
-    document.dispatchEvent(makePointer("pointerup", 300));
-    // Subsequent moves after pointerup should be ignored.
-    document.dispatchEvent(makePointer("pointermove", 100));
-    expect(drawer.style.height).toBe("70vh");
-    expect(localStorage.getItem(STORAGE_HEIGHT)).toBe("70");
-  });
-});
diff --git a/packages/frontend/tests/components/message-table-cells.test.tsx b/packages/frontend/tests/components/message-table-cells.test.tsx
index 3ec315bb..7432c9ee 100644
--- a/packages/frontend/tests/components/message-table-cells.test.tsx
+++ b/packages/frontend/tests/components/message-table-cells.test.tsx
@@ -1,14 +1,13 @@
 import { describe, it, expect, vi } from 'vitest';
 import { render } from '@solidjs/testing-library';
 import {
-  AutofixIcon,
   FallbackIcon,
   HeartbeatIcon,
   ModelCell,
   AgentCell,
   StatusCell,
   AttemptsCell,
-  SelfHealCell,
+  RecoveryCell,
 } from '../../src/components/message-table-cells';
 import { fireEvent } from '@solidjs/testing-library';
 import type { MessageRow } from '../../src/components/message-table-types';
@@ -92,15 +91,6 @@ describe('HeartbeatIcon', () => {
   });
 });
 
-describe('AutofixIcon', () => {
-  it('renders with aria-hidden', () => {
-    const { container } = render(() => <AutofixIcon />);
-    const svg = container.querySelector('svg');
-    expect(svg).not.toBeNull();
-    expect(svg!.getAttribute('aria-hidden')).toBe('true');
-  });
-});
-
 describe('AttemptsCell', () => {
   function renderCell(row: MessageRow) {
     return render(() => (
@@ -112,52 +102,37 @@ describe('AttemptsCell', () => {
     ));
   }
 
-  it('renders just the attempt count (no icons) for a row with autofix_applied', () => {
-    const { container } = renderCell(baseRow({ attempt_count: 2, autofix_applied: true }));
-    expect(container.querySelector('td')!.textContent).toContain('2');
-    // Icons moved to SelfHealCell
-    expect(container.querySelector('[title="Autofix"]')).toBeNull();
-  });
-
   it('renders just the attempt count (no icons) when fallback_from_model is set', () => {
     const { container } = renderCell(baseRow({ fallback_from_model: 'gpt-4o', attempt_count: 2 }));
     expect(container.querySelector('td')!.textContent).toContain('2');
-    // Icons moved to SelfHealCell
+    // Icons live in RecoveryCell
     expect(container.querySelector('[title="Fallback"]')).toBeNull();
   });
 
-  it('renders only the count with no badges when neither autofix nor fallback applies', () => {
+  it('renders only the count with no badges when no fallback applies', () => {
     const { container } = renderCell(baseRow({ attempt_count: 1 }));
     expect(container.querySelector('[title]')).toBeNull();
     expect(container.querySelector('td')!.textContent).toContain('1');
   });
 });
 
-describe('SelfHealCell', () => {
+describe('RecoveryCell', () => {
   function renderCell(row: MessageRow) {
     return render(() => (
       <table>
         <tbody>
-          <tr>{SelfHealCell(row)}</tr>
+          <tr>{RecoveryCell(row)}</tr>
         </tbody>
       </table>
     ));
   }
 
-  it('renders a dash when neither autofix nor fallback applies', () => {
+  it('renders a dash when no fallback applies', () => {
     const { container } = renderCell(baseRow());
     expect(container.querySelector('td')!.textContent).toContain('\u2014');
     expect(container.querySelector('[title]')).toBeNull();
   });
 
-  it('renders autofix badge with icon and text when autofix_applied', () => {
-    const { container } = renderCell(baseRow({ autofix_applied: true }));
-    const badge = container.querySelector('[title="Autofix"]') as HTMLElement;
-    expect(badge).not.toBeNull();
-    expect(badge.className).toContain('trigger-badge--autofix');
-    expect(badge.textContent).toContain('autofix');
-  });
-
   it('renders fallback badge with icon and text when fallback_from_model is set', () => {
     const { container } = renderCell(baseRow({ fallback_from_model: 'gpt-4o' }));
     const badge = container.querySelector('[title="Fallback"]') as HTMLElement;
@@ -166,12 +141,13 @@ describe('SelfHealCell', () => {
     expect(badge.textContent).toContain('fallback');
   });
 
-  it('renders both badges when both autofix and fallback apply', () => {
-    const { container } = renderCell(
-      baseRow({ autofix_applied: true, fallback_from_model: 'gpt-4o' }),
-    );
-    expect(container.querySelector('[title="Autofix"]')).not.toBeNull();
-    expect(container.querySelector('[title="Fallback"]')).not.toBeNull();
+  it('ignores legacy autofix flags on the row', () => {
+    const { container } = renderCell({
+      ...baseRow(),
+      autofix_applied: true,
+    } as MessageRow & { autofix_applied: boolean });
+    expect(container.querySelector('td')!.textContent).toContain('\u2014');
+    expect(container.textContent).not.toMatch(/autofix/i);
   });
 });
 
diff --git a/packages/frontend/tests/pages/Discovery.test.tsx b/packages/frontend/tests/pages/Discovery.test.tsx
deleted file mode 100644
index 363fb82e..00000000
--- a/packages/frontend/tests/pages/Discovery.test.tsx
+++ /dev/null
@@ -1,220 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { render, screen, fireEvent, waitFor } from '@solidjs/testing-library';
-
-const mockNavigate = vi.fn();
-const mockIsDiscoveryRequired = vi.fn();
-const mockCompleteDiscovery = vi.fn();
-const mockMarkDiscoveryPending = vi.fn();
-let mockSearchParams: Record<string, string | string[] | undefined> = {};
-
-vi.mock('@solidjs/router', () => ({
-  useNavigate: () => mockNavigate,
-  useSearchParams: () => [mockSearchParams],
-}));
-
-vi.mock('@solidjs/meta', () => ({
-  Title: (props: { children: unknown }) => <title>{props.children as string}</title>,
-  Meta: () => null,
-}));
-
-vi.mock('../../src/services/auth-client.js', () => ({
-  authClient: {
-    useSession: () => () => ({
-      data: { user: { id: 'u1', name: 'Test User', email: 'test@test.com' } },
-      isPending: false,
-    }),
-  },
-}));
-
-vi.mock('../../src/services/discovery.js', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('../../src/services/discovery.js')>();
-  return {
-    ...actual,
-    isDiscoveryRequired: (...args: unknown[]) => mockIsDiscoveryRequired(...args),
-    completeDiscovery: (...args: unknown[]) => mockCompleteDiscovery(...args),
-    markDiscoveryPending: (...args: unknown[]) => mockMarkDiscoveryPending(...args),
-  };
-});
-
-import Discovery from '../../src/pages/Discovery';
-
-describe('Discovery page', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockSearchParams = {};
-    mockIsDiscoveryRequired.mockResolvedValue(true);
-    mockCompleteDiscovery.mockResolvedValue(undefined);
-  });
-
-  async function renderForm() {
-    const result = render(() => <Discovery />);
-    await waitFor(() => {
-      expect(screen.queryByText('Help us understand who uses Manifest')).not.toBeNull();
-    });
-    return result;
-  }
-
-  it('shows the form without any deployment-mode check', async () => {
-    await renderForm();
-    expect(mockNavigate).not.toHaveBeenCalled();
-    expect(mockIsDiscoveryRequired).toHaveBeenCalledWith('u1');
-  });
-
-  it('redirects to next when the step was already completed', async () => {
-    mockSearchParams = { next: '/welcome' };
-    mockIsDiscoveryRequired.mockResolvedValue(false);
-    render(() => <Discovery />);
-    await waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/welcome', { replace: true });
-    });
-    expect(mockIsDiscoveryRequired).toHaveBeenCalledWith('u1');
-  });
-
-  it('falls back to the dashboard for unsafe next params', async () => {
-    mockSearchParams = { next: 'https://evil.example' };
-    mockIsDiscoveryRequired.mockResolvedValue(false);
-    render(() => <Discovery />);
-    await waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/', { replace: true });
-    });
-  });
-
-  it('uses the first value of an array next param', async () => {
-    mockSearchParams = { next: ['/welcome', '/other'] };
-    mockIsDiscoveryRequired.mockResolvedValue(false);
-    render(() => <Discovery />);
-    await waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/welcome', { replace: true });
-    });
-  });
-
-  it('renders the form for a new self-hosted user', async () => {
-    await renderForm();
-    expect(screen.getByPlaceholderText('Your name')).toBeDefined();
-    expect(screen.getByPlaceholderText('you@example.com')).toBeDefined();
-    expect(
-      screen.getByRole('button', { name: 'What type of project are you working on?' }),
-    ).toBeDefined();
-    expect(screen.getByRole('button', { name: 'How big is your company?' })).toBeDefined();
-    expect(screen.getByText('Continue')).toBeDefined();
-    expect(screen.getByText('Skip')).toBeDefined();
-    expect(mockNavigate).not.toHaveBeenCalled();
-  });
-
-  it('marks the step pending when the form is shown, so Back returns to it', async () => {
-    mockSearchParams = { next: '/welcome' };
-    await renderForm();
-    expect(mockMarkDiscoveryPending).toHaveBeenCalledWith('u1', '/welcome');
-  });
-
-  it('creates the per-user marker after a social signup callback', async () => {
-    mockSearchParams = { next: '/welcome', signup: '1' };
-    await renderForm();
-    expect(mockMarkDiscoveryPending).toHaveBeenCalledWith('u1', '/welcome');
-    expect(mockMarkDiscoveryPending.mock.invocationCallOrder[0]!).toBeLessThan(
-      mockIsDiscoveryRequired.mock.invocationCallOrder[0]!,
-    );
-  });
-
-  it('does not mark the step pending when redirecting away', async () => {
-    mockIsDiscoveryRequired.mockResolvedValue(false);
-    render(() => <Discovery />);
-    await waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/', { replace: true });
-    });
-    expect(mockMarkDiscoveryPending).not.toHaveBeenCalled();
-  });
-
-  it('submits only the provided fields and redirects to next', async () => {
-    mockSearchParams = { next: '/welcome' };
-    const { container } = await renderForm();
-
-    fireEvent.input(screen.getByPlaceholderText('Your name'), { target: { value: '  Seb  ' } });
-    fireEvent.click(
-      screen.getByRole('button', { name: 'What type of project are you working on?' }),
-    );
-    fireEvent.click(screen.getByText('AI agent'));
-    fireEvent.submit(container.querySelector('form')!);
-
-    await waitFor(() => {
-      expect(mockCompleteDiscovery).toHaveBeenCalledWith('u1', {
-        name: 'Seb',
-        projectType: 'ai_agent',
-      });
-    });
-    await waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/welcome', { replace: true });
-    });
-  });
-
-  it('submits every field when all are filled', async () => {
-    const { container } = await renderForm();
-
-    fireEvent.input(screen.getByPlaceholderText('Your name'), { target: { value: 'Seb' } });
-    fireEvent.input(screen.getByPlaceholderText('you@example.com'), {
-      target: { value: 'seb@example.com' },
-    });
-    fireEvent.click(
-      screen.getByRole('button', { name: 'What type of project are you working on?' }),
-    );
-    fireEvent.click(screen.getByText('Other'));
-    fireEvent.click(screen.getByRole('button', { name: 'How big is your company?' }));
-    fireEvent.click(screen.getByText('1–20'));
-    fireEvent.submit(container.querySelector('form')!);
-
-    await waitFor(() => {
-      expect(mockCompleteDiscovery).toHaveBeenCalledWith('u1', {
-        name: 'Seb',
-        email: 'seb@example.com',
-        projectType: 'other',
-        companySize: '1-20',
-      });
-    });
-  });
-
-  it('submits an empty payload when nothing was filled', async () => {
-    const { container } = await renderForm();
-    fireEvent.input(screen.getByPlaceholderText('Your name'), { target: { value: '   ' } });
-    fireEvent.submit(container.querySelector('form')!);
-
-    await waitFor(() => {
-      expect(mockCompleteDiscovery).toHaveBeenCalledWith('u1', {});
-    });
-    await waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/', { replace: true });
-    });
-  });
-
-  it('skips with an empty payload and redirects', async () => {
-    mockSearchParams = { next: '/welcome' };
-    await renderForm();
-    fireEvent.click(screen.getByText('Skip'));
-
-    await waitFor(() => {
-      expect(mockCompleteDiscovery).toHaveBeenCalledWith('u1', {});
-    });
-    await waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith('/welcome', { replace: true });
-    });
-  });
-
-  it('ignores repeated clicks while completing', async () => {
-    let resolveComplete: () => void = () => {};
-    mockCompleteDiscovery.mockImplementation(
-      () =>
-        new Promise<void>((resolve) => {
-          resolveComplete = resolve;
-        }),
-    );
-    await renderForm();
-
-    fireEvent.click(screen.getByText('Skip'));
-    fireEvent.click(screen.getByText('Skip'));
-    resolveComplete();
-
-    await waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalled();
-    });
-    expect(mockCompleteDiscovery).toHaveBeenCalledTimes(1);
-  });
-});
diff --git a/packages/frontend/tests/pages/GlobalOverviewFilter.test.tsx b/packages/frontend/tests/pages/GlobalOverviewFilter.test.tsx
index 8bd466eb..01c958c0 100644
--- a/packages/frontend/tests/pages/GlobalOverviewFilter.test.tsx
+++ b/packages/frontend/tests/pages/GlobalOverviewFilter.test.tsx
@@ -60,13 +60,11 @@ vi.mock('../../src/services/api.js', async () => {
 });
 
 vi.mock('../../src/services/api/analytics.js', () => ({
-  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by Autofix or fallback.',
+  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by fallback.',
   REQUEST_SUCCESS_RATE_TOOLTIP:
     'Successful requests over all requests. Recovered requests count as successful.',
-  totalAttemptsTooltip: (doctor: boolean) =>
-    doctor
-      ? 'Every provider call counts here, including fallback retries and autofixed attempts. One request can produce several attempts.'
-      : 'Every provider call counts here, including fallback retries. One request can produce several attempts.',
+  TOTAL_ATTEMPTS_TOOLTIP:
+    'Every provider call counts here, including fallback retries. One request can produce several attempts.',
   MODEL_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this model.',
   PROVIDER_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this provider.',
   CONNECTION_SUCCESS_RATE_TOOLTIP_30D:
@@ -80,8 +78,7 @@ vi.mock('../../src/services/api/analytics.js', () => ({
     'Logical requests from this harness, one per call, whatever the number of attempts.',
   attemptSuccessRate: (row: { attempts: number; succeeded?: number }) =>
     !row.attempts || row.succeeded == null ? null : row.succeeded / row.attempts,
-  selfHealedCount: (row: { autofixed: number; fallback_saves?: number }) =>
-    row.autofixed + (row.fallback_saves ?? 0),
+  recoveredCount: (row: { fallback_saves?: number }) => row.fallback_saves ?? 0,
   successRate: (row: { requests: number; succeeded?: number }) =>
     !row.requests || row.succeeded == null ? null : row.succeeded / row.requests,
   getPerAgentReliability: () =>
@@ -90,8 +87,7 @@ vi.mock('../../src/services/api/analytics.js', () => ({
         agent_name: 'demo-agent',
         requests: 18,
         failed: 1,
-        autofixed: 1,
-        fallback_saves: 1,
+        fallback_saves: 2,
         succeeded: 17,
       },
     ]),
@@ -105,10 +101,8 @@ vi.mock('../../src/services/api/analytics.js', () => ({
       fallbacked_attempts: { value: 2, previous: 1 },
     }),
   getAttemptTimeseries: () => Promise.resolve({ range: '7d', by: 'metric', keys: [], buckets: [] }),
-  getWorkspaceAutofixStatus: () =>
-    Promise.resolve({ any_enabled: false, enabled_agents: [], consented: true }),
-  getAutofixStats: () => Promise.resolve(null),
-  getAutofixTimeseries: () =>
+  getReliabilityStats: () => Promise.resolve(null),
+  getRequestStatusTimeseries: () =>
     Promise.resolve({ range: '7d', by: 'disposition', keys: [], buckets: [] }),
   getPerProviderReliability: () =>
     Promise.resolve([
@@ -399,7 +393,7 @@ describe('GlobalOverview filter onUnselectAll', () => {
 
   it('links the recovered-requests count to the scoped Requests log', async () => {
     const { container } = render(() => <GlobalOverview />);
-    const href = '/messages?agent=demo-agent&range=7d&status=ok&trigger=autofix,fallback';
+    const href = '/messages?agent=demo-agent&range=7d&status=ok&trigger=fallback';
     const link = await waitFor(() => {
       const found = [...container.querySelectorAll('a')].find(
         (candidate) => candidate.getAttribute('href') === href,
diff --git a/packages/frontend/tests/pages/MessageLog.test.tsx b/packages/frontend/tests/pages/MessageLog.test.tsx
index 8d50518e..030d6695 100644
--- a/packages/frontend/tests/pages/MessageLog.test.tsx
+++ b/packages/frontend/tests/pages/MessageLog.test.tsx
@@ -25,6 +25,9 @@ vi.mock('@solidjs/router', () => ({
       get range() {
         return mockSearchParams.range;
       },
+      get trigger() {
+        return mockSearchParams.trigger;
+      },
       get model() {
         return mockSearchModelAccessor ? mockSearchModelAccessor() : mockSearchParams.model;
       },
@@ -791,10 +794,10 @@ describe('MessageLog', () => {
     });
 
     const triggerSelect = selectWithOption(container, 'All attempts');
-    expect(triggerSelect.textContent).toContain('With any recovery attempt');
-    expect(triggerSelect.textContent).toContain('With an autofix attempt');
     expect(triggerSelect.textContent).toContain('With a fallback attempt');
     expect(triggerSelect.textContent).toContain('No recovery attempt');
+    expect(triggerSelect.textContent).not.toMatch(/autofix/i);
+    expect(triggerSelect.textContent).not.toContain('With any recovery attempt');
 
     mockGetMessages.mockClear();
     await fireEvent.change(triggerSelect, { target: { value: 'fallback' } });
@@ -804,16 +807,16 @@ describe('MessageLog', () => {
       );
     });
     expect(mockSetSearchParams).toHaveBeenCalledWith({ trigger: 'fallback' }, { replace: true });
+  });
+
+  it('reads an old ?trigger=autofix,fallback deep link as the fallback filter', async () => {
+    mockSearchParams = { trigger: 'autofix,fallback' };
+    mockGetMessages.mockResolvedValue(messagesData);
+    render(() => <MessageLog />);
 
-    // 'With any recovery attempt' folds both kinds on the wire, so it matches
-    // exactly what the recovered-requests deep links send.
-    mockGetMessages.mockClear();
-    await fireEvent.change(selectWithOption(container, 'All attempts'), {
-      target: { value: 'any' },
-    });
     await vi.waitFor(() => {
       expect(mockGetMessages).toHaveBeenCalledWith(
-        expect.objectContaining({ trigger: 'autofix,fallback' }),
+        expect.objectContaining({ trigger: 'fallback' }),
       );
     });
   });
@@ -1359,7 +1362,7 @@ describe('MessageLog', () => {
     mockGetMessages.mockResolvedValue(dataWithFallback);
     const { container } = render(() => <MessageLog />);
     await vi.waitFor(() => {
-      // Fallback is now shown in the Self-heal column, not a Model-cell tier badge.
+      // Fallback is now shown in the Recovery column, not a Model-cell tier badge.
       const badge = container.querySelector('[title="Fallback"]');
       expect(badge).not.toBeNull();
       expect(badge!.getAttribute('title')).toBe('Fallback');
@@ -1458,7 +1461,7 @@ describe('MessageLog', () => {
       expect(badge!.getAttribute('title')).toBe('Fallback');
     });
     // The badge lives on the recovered row, and there's exactly one (the failed
-    // original carries no fallback_from_model, so no Self-heal badge).
+    // original carries no fallback_from_model, so no Recovery badge).
     expect(container.querySelectorAll('[title="Fallback"]').length).toBe(1);
     const successRow = container.querySelector('#msg-success-1')!;
     expect(successRow.querySelector('[title="Fallback"]')).not.toBeNull();
diff --git a/packages/frontend/tests/pages/Overview-limits.test.tsx b/packages/frontend/tests/pages/Overview-limits.test.tsx
index d766f82b..a352dd6d 100644
--- a/packages/frontend/tests/pages/Overview-limits.test.tsx
+++ b/packages/frontend/tests/pages/Overview-limits.test.tsx
@@ -61,13 +61,11 @@ vi.mock('../../src/components/ProviderIcon.jsx', () => ({
 // (uPlot) and fetches per-provider timeseries; stub both so jsdom doesn't load
 // the real chart (which calls matchMedia).
 vi.mock('../../src/services/api/analytics.js', () => ({
-  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by Autofix or fallback.',
+  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by fallback.',
   REQUEST_SUCCESS_RATE_TOOLTIP:
     'Successful requests over all requests. Recovered requests count as successful.',
-  totalAttemptsTooltip: (doctor: boolean) =>
-    doctor
-      ? 'Every provider call counts here, including fallback retries and autofixed attempts. One request can produce several attempts.'
-      : 'Every provider call counts here, including fallback retries. One request can produce several attempts.',
+  TOTAL_ATTEMPTS_TOOLTIP:
+    'Every provider call counts here, including fallback retries. One request can produce several attempts.',
   MODEL_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this model.',
   PROVIDER_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this provider.',
   CONNECTION_SUCCESS_RATE_TOOLTIP_30D:
@@ -90,19 +88,14 @@ vi.mock('../../src/services/api/analytics.js', () => ({
       fallbacked_attempts: { value: 0, previous: 0 },
     }),
   getAttemptTimeseries: () => Promise.resolve({ range: '7d', by: 'metric', keys: [], buckets: [] }),
-  getWorkspaceAutofixStatus: () =>
-    Promise.resolve({ any_enabled: false, enabled_agents: [], consented: true }),
-  getAutofixStats: () => Promise.resolve(null),
-  getAutofixTimeseries: () =>
+  getReliabilityStats: () => Promise.resolve(null),
+  getRequestStatusTimeseries: () =>
     Promise.resolve({ range: '7d', by: 'disposition', keys: [], buckets: [] }),
   getPerProviderReliability: () => Promise.resolve([]),
   getPerModelReliability: () => Promise.resolve([]),
-  getErrorBreakdown: () => Promise.resolve({ by_class: {}, by_origin: {}, auto_fixed: 0 }),
+  getErrorBreakdown: () => Promise.resolve({ by_class: {}, by_origin: {} }),
 }));
 
-vi.mock('../../src/services/api/routing.js', () => ({
-  getAutofix: () => Promise.resolve({ enabled: false }),
-}));
 vi.mock('../../src/components/MultiAgentTokenChart.jsx', () => ({
   AGENT_COLORS: ['#111111', '#222222'],
   default: () => <div data-testid="multi-agent-chart" />,
diff --git a/packages/frontend/tests/pages/Overview.test.tsx b/packages/frontend/tests/pages/Overview.test.tsx
index 5f486943..124bebea 100644
--- a/packages/frontend/tests/pages/Overview.test.tsx
+++ b/packages/frontend/tests/pages/Overview.test.tsx
@@ -84,15 +84,13 @@ const mockPerProvider = vi.fn(() => Promise.resolve({ agents: [], timeseries: []
 const mockPerProviderTokens = vi.fn((...a: unknown[]) => mockPerProvider(...a));
 const mockPerProviderMessages = vi.fn((...a: unknown[]) => mockPerProvider(...a));
 const mockPerProviderCosts = vi.fn((...a: unknown[]) => mockPerProvider(...a));
-const mockGetAutofixStats = vi.fn();
+const mockGetReliabilityStats = vi.fn();
 vi.mock('../../src/services/api/analytics.js', () => ({
-  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by Autofix or fallback.',
+  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by fallback.',
   REQUEST_SUCCESS_RATE_TOOLTIP:
     'Successful requests over all requests. Recovered requests count as successful.',
-  totalAttemptsTooltip: (doctor: boolean) =>
-    doctor
-      ? 'Every provider call counts here, including fallback retries and autofixed attempts. One request can produce several attempts.'
-      : 'Every provider call counts here, including fallback retries. One request can produce several attempts.',
+  TOTAL_ATTEMPTS_TOOLTIP:
+    'Every provider call counts here, including fallback retries. One request can produce several attempts.',
   MODEL_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this model.',
   PROVIDER_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this provider.',
   CONNECTION_SUCCESS_RATE_TOOLTIP_30D:
@@ -115,21 +113,14 @@ vi.mock('../../src/services/api/analytics.js', () => ({
       fallbacked_attempts: { value: 5, previous: 4 },
     }),
   getAttemptTimeseries: () => Promise.resolve({ range: '7d', by: 'metric', keys: [], buckets: [] }),
-  getWorkspaceAutofixStatus: () =>
-    Promise.resolve({ any_enabled: false, enabled_agents: [], consented: true }),
-  getAutofixStats: (...a: unknown[]) => mockGetAutofixStats(...a),
-  getAutofixTimeseries: () =>
+  getReliabilityStats: (...a: unknown[]) => mockGetReliabilityStats(...a),
+  getRequestStatusTimeseries: () =>
     Promise.resolve({ range: '7d', by: 'disposition', keys: [], buckets: [] }),
   getPerProviderReliability: () => Promise.resolve([]),
   getPerModelReliability: () => Promise.resolve([]),
-  getErrorBreakdown: () => Promise.resolve({ by_class: {}, by_origin: {}, auto_fixed: 0 }),
+  getErrorBreakdown: () => Promise.resolve({ by_class: {}, by_origin: {} }),
 }));
 
-vi.mock('../../src/services/api/routing.js', () => ({
-  getAutofix: () => Promise.resolve({ enabled: false }),
-}));
-
-
 vi.mock('../../src/components/MultiAgentTokenChart.jsx', () => ({
   AGENT_COLORS: ['#111111', '#222222', '#333333'],
   default: (props: any) => (
@@ -277,13 +268,11 @@ describe('Overview', () => {
     const [agentName, setAgentName] = createSignal(mockAgentName);
     agentNameBox.read = agentName;
     agentNameBox.set = setAgentName;
-    mockGetAutofixStats.mockResolvedValue({
+    mockGetReliabilityStats.mockResolvedValue({
       success_rate: { value: 0.9, previous: 0.8 },
-      autofix_saves: { value: 7, previous: 5 },
       fallback_saves: { value: 2, previous: 1 },
       total_requests: { value: 100, previous: 90 },
       errors_remaining: { value: 3, previous: 4 },
-      coverage: { rate: 0.7, previous_rate: 5 / 9 },
     });
     mockGetCustomProviders.mockResolvedValue([]);
     mockPerProvider.mockResolvedValue({ agents: [], timeseries: [] });
@@ -354,15 +343,13 @@ describe('Overview', () => {
   it('renders the new agent before secondary metrics finish loading', async () => {
     const firstAgentStats = {
       success_rate: { value: 0.9, previous: 0.8 },
-      autofix_saves: { value: 777, previous: 5 },
-      fallback_saves: { value: 2, previous: 1 },
+      fallback_saves: { value: 777, previous: 5 },
       total_requests: { value: 100, previous: 90 },
       errors_remaining: { value: 3, previous: 4 },
-      coverage: { rate: 0.7, previous_rate: 5 / 9 },
     };
     const secondAgentStats = {
       ...firstAgentStats,
-      autofix_saves: { value: 888, previous: 6 },
+      fallback_saves: { value: 888, previous: 6 },
     };
     const secondAgentOverview = {
       ...overviewData,
@@ -383,7 +370,7 @@ describe('Overview', () => {
         return value;
       });
     });
-    mockGetAutofixStats.mockImplementation((_range: string, agent: string) =>
+    mockGetReliabilityStats.mockImplementation((_range: string, agent: string) =>
       agent === 'other-agent' ? secondAgentStatsPromise : Promise.resolve(firstAgentStats),
     );
 
@@ -415,19 +402,17 @@ describe('Overview', () => {
   it('renders the critical overview when switching back before secondary metrics finish', async () => {
     const firstAgentStats = {
       success_rate: { value: 0.9, previous: 0.8 },
-      autofix_saves: { value: 777, previous: 5 },
-      fallback_saves: { value: 2, previous: 1 },
+      fallback_saves: { value: 777, previous: 5 },
       total_requests: { value: 100, previous: 90 },
       errors_remaining: { value: 3, previous: 4 },
-      coverage: { rate: 0.7, previous_rate: 5 / 9 },
     };
     const secondAgentStats = {
       ...firstAgentStats,
-      autofix_saves: { value: 888, previous: 6 },
+      fallback_saves: { value: 888, previous: 6 },
     };
     const returningAgentStats = {
       ...firstAgentStats,
-      autofix_saves: { value: 999, previous: 7 },
+      fallback_saves: { value: 999, previous: 7 },
     };
     const secondAgentOverview = {
       ...overviewData,
@@ -448,7 +433,7 @@ describe('Overview', () => {
     mockGetOverview.mockImplementation((_range: string, agent: string) =>
       Promise.resolve(agent === 'other-agent' ? secondAgentOverview : overviewData),
     );
-    mockGetAutofixStats.mockImplementation((_range: string, agent: string) => {
+    mockGetReliabilityStats.mockImplementation((_range: string, agent: string) => {
       if (agent === 'other-agent') return secondAgentStatsPromise;
       firstAgentStatsCalls += 1;
       return firstAgentStatsCalls === 1
@@ -694,17 +679,17 @@ describe('Overview', () => {
     expect(screen.getAllByText('Recovered requests').length).toBeGreaterThan(0);
   });
 
-  it('loads and renders the self-healed KPIs and tab for every tenant', async () => {
+  it('loads and renders the reliability KPIs and recovered tab for every tenant', async () => {
     mockGetOverview.mockResolvedValue(overviewData);
     render(() => <Overview />);
 
     await vi.waitFor(() => {
       expect(screen.getAllByText('Success rate').length).toBeGreaterThan(0);
     });
-    expect(mockGetAutofixStats).toHaveBeenCalledWith('30d', 'test-agent');
+    expect(mockGetReliabilityStats).toHaveBeenCalledWith('30d', 'test-agent');
     // Tab + KPI cards share the label; both surfaces are present.
     expect(screen.getAllByText('Recovered requests').length).toBeGreaterThanOrEqual(2);
-    expect(screen.getByText('Recovered by Autofix')).toBeDefined();
+    expect(screen.queryByText('Recovered by Autofix')).toBeNull();
     expect(screen.getByText('Recovered by Fallback')).toBeDefined();
   });
 
@@ -1299,7 +1284,7 @@ describe('Overview', () => {
     mockGetOverview.mockResolvedValue(dataWithFallback);
     const { container } = render(() => <Overview />);
     await vi.waitFor(() => {
-      // Fallback is now surfaced in the Self-heal column, not a Model-cell badge.
+      // Fallback is now surfaced in the Recovery column, not a Model-cell badge.
       const badge = container.querySelector('[title="Fallback"]');
       expect(badge).not.toBeNull();
       expect(badge!.getAttribute('title')).toBe('Fallback');
diff --git a/packages/frontend/tests/pages/ProviderOverviewPages.test.tsx b/packages/frontend/tests/pages/ProviderOverviewPages.test.tsx
index c812da73..604ee982 100644
--- a/packages/frontend/tests/pages/ProviderOverviewPages.test.tsx
+++ b/packages/frontend/tests/pages/ProviderOverviewPages.test.tsx
@@ -74,13 +74,11 @@ vi.mock('../../src/services/api/routing.js', () => ({
 }));
 
 vi.mock('../../src/services/api/analytics.js', () => ({
-  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by Autofix or fallback.',
+  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by fallback.',
   REQUEST_SUCCESS_RATE_TOOLTIP:
     'Successful requests over all requests. Recovered requests count as successful.',
-  totalAttemptsTooltip: (doctor: boolean) =>
-    doctor
-      ? 'Every provider call counts here, including fallback retries and autofixed attempts. One request can produce several attempts.'
-      : 'Every provider call counts here, including fallback retries. One request can produce several attempts.',
+  TOTAL_ATTEMPTS_TOOLTIP:
+    'Every provider call counts here, including fallback retries. One request can produce several attempts.',
   MODEL_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this model.',
   PROVIDER_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this provider.',
   CONNECTION_SUCCESS_RATE_TOOLTIP_30D:
@@ -112,18 +110,15 @@ vi.mock('../../src/services/api/analytics.js', () => ({
   getConnectionAttemptsByAgentTimeseries: (...args: unknown[]) =>
     apiMocks.getConnectionAttemptsByAgentTimeseries(...args),
   getPerAgentCostTimeseries: (...args: unknown[]) => apiMocks.getPerAgentCostTimeseries(...args),
-  getWorkspaceAutofixStatus: () =>
-    Promise.resolve({ any_enabled: false, enabled_agents: [], consented: true }),
-  getAutofixStats: () => Promise.resolve(null),
-  getAutofixTimeseries: () =>
+  getReliabilityStats: () => Promise.resolve(null),
+  getRequestStatusTimeseries: () =>
     Promise.resolve({ range: '7d', by: 'disposition', keys: [], buckets: [] }),
   getPerProviderReliability: () => Promise.resolve([]),
   getPerModelReliability: () => Promise.resolve([]),
   getPerAgentReliability: () => Promise.resolve([]),
-  getErrorBreakdown: () => Promise.resolve({ by_class: {}, by_origin: {}, auto_fixed: 0 }),
+  getErrorBreakdown: () => Promise.resolve({ by_class: {}, by_origin: {} }),
 }));
 
-
 vi.mock('../../src/services/providers.js', () => ({
   PROVIDERS: [
     { id: 'openai', name: 'OpenAI' },
@@ -164,8 +159,8 @@ vi.mock('../../src/components/ProviderChartCard.jsx', () => ({
     agentRequestTimeseries?: { agents: string[]; timeseries: unknown[] };
     agentCostTimeseries?: { agents: string[]; timeseries: unknown[] };
     requestStatusTimeseries?: { keys: string[] };
-    selfHealedTimeseries?: { keys: string[] };
-    selfHealedValue?: number;
+    recoveredTimeseries?: { keys: string[] };
+    recoveredValue?: number;
     seriesFilters?: unknown;
     colorMap?: Record<string, string>;
   }) => (
@@ -186,8 +181,8 @@ vi.mock('../../src/components/ProviderChartCard.jsx', () => ({
       <span data-testid="cost-agents">{props.agentCostTimeseries?.agents.join(',') ?? ''}</span>
       <span data-testid="color-keys">{Object.keys(props.colorMap ?? {}).join(',')}</span>
       <span data-testid="status-keys">{props.requestStatusTimeseries?.keys.join(',') ?? ''}</span>
-      <span data-testid="healed-keys">{props.selfHealedTimeseries?.keys.join(',') ?? ''}</span>
-      <span data-testid="healed-value">{props.selfHealedValue ?? ''}</span>
+      <span data-testid="recovered-keys">{props.recoveredTimeseries?.keys.join(',') ?? ''}</span>
+      <span data-testid="recovered-value">{props.recoveredValue ?? ''}</span>
       <div data-testid="series-filters">{props.seriesFilters as any}</div>
     </div>
   ),
@@ -215,8 +210,8 @@ vi.mock('../../src/components/UnifiedChartCard.jsx', () => ({
     agentRequestTimeseries?: { agents: string[]; timeseries: unknown[] };
     agentCostTimeseries?: { agents: string[]; timeseries: unknown[] };
     requestStatusTimeseries?: { keys: string[] };
-    selfHealedTimeseries?: { keys: string[] };
-    selfHealedValue?: number;
+    recoveredTimeseries?: { keys: string[] };
+    recoveredValue?: number;
     seriesFilters?: unknown;
     colorMap?: Record<string, string>;
   }) => (
@@ -241,8 +236,8 @@ vi.mock('../../src/components/UnifiedChartCard.jsx', () => ({
       <span data-testid="cost-agents">{props.agentCostTimeseries?.agents.join(',') ?? ''}</span>
       <span data-testid="color-keys">{Object.keys(props.colorMap ?? {}).join(',')}</span>
       <span data-testid="status-keys">{props.requestStatusTimeseries?.keys.join(',') ?? ''}</span>
-      <span data-testid="healed-keys">{props.selfHealedTimeseries?.keys.join(',') ?? ''}</span>
-      <span data-testid="healed-value">{props.selfHealedValue ?? ''}</span>
+      <span data-testid="recovered-keys">{props.recoveredTimeseries?.keys.join(',') ?? ''}</span>
+      <span data-testid="recovered-value">{props.recoveredValue ?? ''}</span>
       <div data-testid="series-filters">{props.seriesFilters as any}</div>
     </div>
   ),
@@ -759,8 +754,6 @@ beforeEach(() => {
     failed: 3,
     fallback_retries: 10,
     fallback_retries_succeeded: 8,
-    autofix_attempts: 5,
-    autofix_attempts_succeeded: 4,
   });
 });
 
@@ -955,7 +948,9 @@ describe('ConnectionDetail (analytics)', () => {
     await waitFor(() => expect(screen.getAllByText('Default').length).toBeGreaterThan(0));
     expect(screen.getAllByText('Harnesses').length).toBeGreaterThan(0);
     expect(screen.getAllByText('gpt-5').length).toBeGreaterThan(0);
-    expect(screen.getByTestId('requests-info-tooltip').textContent).toContain('autofixed attempts');
+    expect(screen.getByTestId('requests-info-tooltip').textContent).toContain(
+      'including fallback retries.',
+    );
     // Recent messages table renders model and token data (description is no longer displayed).
     expect(screen.getByText('Recent Requests')).toBeDefined();
     // BYOK connection → cost columns present
@@ -989,7 +984,7 @@ describe('ConnectionDetail (analytics)', () => {
     expect(sessionStorage.getItem('chart-view:conn-openai')).toBe('requests');
   });
 
-  it('shows the Attempts tab, By HTTP status default, and no Healed tab', async () => {
+  it('shows the Attempts tab, By HTTP status default, and no Recovered tab', async () => {
     render(() => <ConnectionDetail />);
     await waitFor(() => expect(screen.getAllByText('Default').length).toBeGreaterThan(0));
     fireEvent.click(screen.getByText('Requests chart'));
@@ -1012,8 +1007,8 @@ describe('ConnectionDetail (analytics)', () => {
     await waitFor(() =>
       expect(screen.getByTestId('status-keys').textContent).toBe('success,error'),
     );
-    // The healed tab is gone: healing belongs to requests, not connections.
-    expect(screen.getByTestId('healed-keys').textContent).toBe('');
+    // No Recovered tab: recovery belongs to requests, not connections.
+    expect(screen.getByTestId('recovered-keys').textContent).toBe('');
 
     // Scoped fetch to this exact connection.
     expect(apiMocks.getConnectionAttemptStatusTimeseries).toHaveBeenCalledWith(
@@ -1064,11 +1059,12 @@ describe('ConnectionDetail (analytics)', () => {
     // badge class so the phone breakpoint can size them as a matched pair.
     expect(container.querySelector('.connection-detail__badge')?.textContent).toBe('Active');
     const stats = container.querySelector('.overview-stats');
-    expect(stats?.classList.contains('overview-stats--5')).toBe(true);
+    // Four cards use the base four-column grid, no five-card modifier.
+    expect(stats?.classList.contains('overview-stats--5')).toBe(false);
     expect((stats as HTMLElement).style.gridTemplateColumns).toBe('');
   });
 
-  it('shows the attempt cards row: rate, counts and both retry families', async () => {
+  it('shows the attempt cards row: rate, counts and fallback retries', async () => {
     const { container } = render(() => <ConnectionDetail />);
     await waitFor(() => expect(screen.getAllByText('Default').length).toBeGreaterThan(0));
     await waitFor(() => {
@@ -1084,13 +1080,10 @@ describe('ConnectionDetail (analytics)', () => {
       expect(fb).toContain('10');
       expect(fb).toContain('8 succeeded');
     });
-    await waitFor(() => {
-      const card = [...container.querySelectorAll('.overview-stat-card')].find((c) =>
-        c.textContent?.includes('Autofixed attempts'),
-      );
-      expect(card?.textContent).toContain('5');
-      expect(card?.textContent).toContain('4 succeeded');
-    });
+    // Four attempt cards; no Autofix card.
+    const cards = container.querySelectorAll('.overview-stat-card');
+    expect(cards).toHaveLength(4);
+    expect(container.textContent).not.toMatch(/autofix/i);
   });
 
   it.each([
@@ -1114,22 +1107,6 @@ describe('ConnectionDetail (analytics)', () => {
     );
   });
 
-  it('links the Autofixed attempts card', async () => {
-    const { container } = render(() => <ConnectionDetail />);
-    await waitFor(() => expect(screen.getAllByText('Default').length).toBeGreaterThan(0));
-    const card = await waitFor(() => {
-      const found = [...container.querySelectorAll('.overview-stat-card')].find((c) =>
-        c.textContent?.includes('Autofixed attempts'),
-      );
-      expect(found).toBeDefined();
-      return found!;
-    });
-    fireEvent.click(card);
-    expect(routerState.navigate).toHaveBeenCalledWith(
-      '/messages?connections=conn-openai&range=7d&trigger=autofix',
-    );
-  });
-
   it('opens the inline manage modal from the connection detail', async () => {
     render(() => <ConnectionDetail />);
     await waitFor(() => expect(screen.getAllByText('Default').length).toBeGreaterThan(0));
diff --git a/packages/frontend/tests/pages/ProviderPages.test.tsx b/packages/frontend/tests/pages/ProviderPages.test.tsx
index 7cb3c44e..c910a93b 100644
--- a/packages/frontend/tests/pages/ProviderPages.test.tsx
+++ b/packages/frontend/tests/pages/ProviderPages.test.tsx
@@ -95,13 +95,11 @@ vi.mock('../../src/services/api.js', () => ({
 }));
 
 vi.mock('../../src/services/api/analytics.js', () => ({
-  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by Autofix or fallback.',
+  RECOVERED_REQUESTS_TOOLTIP: 'Successful requests that were recovered by fallback.',
   REQUEST_SUCCESS_RATE_TOOLTIP:
     'Successful requests over all requests. Recovered requests count as successful.',
-  totalAttemptsTooltip: (doctor: boolean) =>
-    doctor
-      ? 'Every provider call counts here, including fallback retries and autofixed attempts. One request can produce several attempts.'
-      : 'Every provider call counts here, including fallback retries. One request can produce several attempts.',
+  TOTAL_ATTEMPTS_TOOLTIP:
+    'Every provider call counts here, including fallback retries. One request can produce several attempts.',
   MODEL_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this model.',
   PROVIDER_SUCCESS_RATE_TOOLTIP: 'Successful attempts over all attempts for this provider.',
   CONNECTION_SUCCESS_RATE_TOOLTIP_30D:
diff --git a/packages/frontend/tests/pages/Register.test.tsx b/packages/frontend/tests/pages/Register.test.tsx
index 9f8cfe62..67faa029 100644
--- a/packages/frontend/tests/pages/Register.test.tsx
+++ b/packages/frontend/tests/pages/Register.test.tsx
@@ -152,7 +152,7 @@ describe('Register', () => {
     expect(container.querySelector('a[href="/reset-password"]')).not.toBeNull();
   });
 
-  it('routes email signups through the discovery step', async () => {
+  it('sends email signups straight to the onboarding flow', async () => {
     mockSignUpEmail.mockResolvedValue({ error: null });
     const { container } = render(() => <Register />);
     fireEvent.input(container.querySelector('input[type="text"]')!, { target: { value: 'Test' } });
@@ -168,12 +168,12 @@ describe('Register', () => {
         name: 'Test',
         email: 'test@test.com',
         password: 'pass123',
-        callbackURL: '/discovery?next=%2Fwelcome',
+        callbackURL: '/welcome',
       });
     });
   });
 
-  it('routes social signups through the discovery step', async () => {
+  it('sends social signups straight to the onboarding flow', async () => {
     mockCheckSocialProviders.mockResolvedValue(['github']);
     render(() => <Register />);
 
@@ -181,12 +181,12 @@ describe('Register', () => {
 
     expect(mockSignInSocial).toHaveBeenCalledWith({
       provider: 'github',
-      callbackURL: '/discovery?next=%2Fwelcome&signup=1',
+      callbackURL: '/welcome',
       errorCallbackURL: '/login?oauth=failed',
     });
   });
 
-  it('redirects token signups to the discovery step', async () => {
+  it('redirects token signups to the onboarding flow', async () => {
     const locationSpy = vi.spyOn(window, 'location', 'get').mockReturnValue({
       ...window.location,
       href: '',
@@ -208,10 +208,10 @@ describe('Register', () => {
     });
     fireEvent.submit(container.querySelector('form')!);
     await vi.waitFor(() => {
-      expect(hrefSetter).toHaveBeenCalledWith('/discovery?next=%2Fwelcome');
+      expect(hrefSetter).toHaveBeenCalledWith('/welcome');
     });
-    // The pending marker lets the guards route Back presses to the form.
-    expect(localStorage.getItem('manifest_discovery_pending_u1')).toBe('/welcome');
+    // No questionnaire marker is left behind for the guards to act on.
+    expect(localStorage.getItem('manifest_discovery_pending_u1')).toBeNull();
 
     locationSpy.mockRestore();
   });
@@ -280,7 +280,7 @@ describe('Register', () => {
       await vi.waitFor(() => {
         expect(mockSendVerificationEmail).toHaveBeenCalledWith({
           email: 'test@test.com',
-          callbackURL: '/discovery?next=%2Fwelcome',
+          callbackURL: '/welcome',
         });
       });
     }
diff --git a/packages/frontend/tests/pages/Routing.test.tsx b/packages/frontend/tests/pages/Routing.test.tsx
index ceb7d317..40500234 100644
--- a/packages/frontend/tests/pages/Routing.test.tsx
+++ b/packages/frontend/tests/pages/Routing.test.tsx
@@ -21,8 +21,6 @@ const mockSetSpecificityResponseMode = vi.fn();
 const mockListModelParams = vi.fn();
 const mockSetModelParams = vi.fn();
 const mockDeleteModelParams = vi.fn();
-const mockGetAutofix = vi.fn(() => Promise.resolve({ enabled: false }));
-const mockUpdateAutofix = vi.fn(() => Promise.resolve({ enabled: false }));
 
 vi.mock('../../src/services/api.js', () => ({
   getTierAssignments: (...args: unknown[]) => mockGetTierAssignments(...args),
@@ -46,8 +44,6 @@ vi.mock('../../src/services/api.js', () => ({
   listModelParams: (...args: unknown[]) => mockListModelParams(...args),
   setModelParams: (...args: unknown[]) => mockSetModelParams(...args),
   deleteModelParams: (...args: unknown[]) => mockDeleteModelParams(...args),
-  getAutofix: (...args: unknown[]) => mockGetAutofix(...args),
-  updateAutofix: (...args: unknown[]) => mockUpdateAutofix(...args),
   modelParamsKey: (scope: string, provider: string, authType: string, model: string) =>
     `${scope}::${provider.toLowerCase()}::${model}::${authType}`,
   // Re-export types only — no runtime impact
diff --git a/packages/frontend/tests/pages/Settings.test.tsx b/packages/frontend/tests/pages/Settings.test.tsx
index f2b05665..30226f51 100644
--- a/packages/frontend/tests/pages/Settings.test.tsx
+++ b/packages/frontend/tests/pages/Settings.test.tsx
@@ -21,8 +21,6 @@ const mockDeleteAgent = vi.fn();
 const mockRenameAgent = vi.fn();
 const mockRotateAgentKey = vi.fn();
 const mockUpdateAgent = vi.fn();
-const mockGetAutofix = vi.fn(() => Promise.resolve({ enabled: false }));
-const mockUpdateAutofix = vi.fn(() => Promise.resolve({ enabled: false }));
 const mockGetRecording = vi.fn(() => Promise.resolve({ enabled: false }));
 const mockUpdateRecording = vi.fn(() => Promise.resolve({ enabled: false }));
 vi.mock("../../src/services/api.js", () => ({
@@ -32,8 +30,6 @@ vi.mock("../../src/services/api.js", () => ({
   renameAgent: (...args: unknown[]) => mockRenameAgent(...args),
   rotateAgentKey: (...args: unknown[]) => mockRotateAgentKey(...args),
   updateAgent: (...args: unknown[]) => mockUpdateAgent(...args),
-  getAutofix: (...args: unknown[]) => mockGetAutofix(...args),
-  updateAutofix: (...args: unknown[]) => mockUpdateAutofix(...args),
   getRecording: (...args: unknown[]) => mockGetRecording(...args),
   updateRecording: (...args: unknown[]) => mockUpdateRecording(...args),
 }));
@@ -192,6 +188,12 @@ describe("Settings", () => {
     expect(screen.getByText("Setup")).toBeDefined();
   });
 
+  it("has no Autofix section or third-party terms link", () => {
+    const { container } = render(() => <Settings />);
+    expect(container.textContent).not.toMatch(/autofix/i);
+    expect(container.querySelector('a[href^="https://manifest.build"]')).toBeNull();
+  });
+
   it("renders Danger zone", () => {
     render(() => <Settings />);
     expect(screen.getByText("Danger zone")).toBeDefined();
diff --git a/packages/frontend/tests/pages/SettingsAutofixSection.test.tsx b/packages/frontend/tests/pages/SettingsAutofixSection.test.tsx
deleted file mode 100644
index 85a5fce4..00000000
--- a/packages/frontend/tests/pages/SettingsAutofixSection.test.tsx
+++ /dev/null
@@ -1,265 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { render, fireEvent, waitFor, cleanup, screen } from '@solidjs/testing-library';
-import { createSignal } from 'solid-js';
-
-const mockGetAutofix = vi.fn();
-const mockUpdateAutofix = vi.fn();
-vi.mock('../../src/services/api.js', () => ({
-  getAutofix: (...args: unknown[]) => mockGetAutofix(...args),
-  updateAutofix: (...args: unknown[]) => mockUpdateAutofix(...args),
-}));
-
-const mockToastError = vi.fn();
-vi.mock('../../src/services/toast-store.js', () => ({
-  toast: { error: (...args: unknown[]) => mockToastError(...args) },
-}));
-
-let mockSearchParams: Record<string, string> = {};
-vi.mock('@solidjs/router', () => ({
-  useSearchParams: () => [mockSearchParams],
-}));
-
-import SettingsAutofixSection from '../../src/pages/SettingsAutofixSection';
-
-/** Wait for the initial `getAutofix` resource to settle so the switch's
- *  `disabled={... || config.loading}` binding flips to enabled. */
-async function waitForLoaded(container: HTMLElement): Promise<HTMLButtonElement> {
-  return await waitFor(() => {
-    const btn = container.querySelector('.settings-switch') as HTMLButtonElement | null;
-    expect(btn).not.toBeNull();
-    expect(btn!.hasAttribute('disabled')).toBe(false);
-    return btn!;
-  });
-}
-
-describe('SettingsAutofixSection', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockSearchParams = {};
-  });
-  afterEach(() => {
-    cleanup();
-  });
-
-  it('renders the Autofix title and switch', async () => {
-    mockGetAutofix.mockResolvedValue({ enabled: false });
-    const { container } = render(() => <SettingsAutofixSection agentName={() => 'demo'} />);
-
-    const btn = await waitForLoaded(container);
-    expect(container.textContent).toContain('Autofix');
-
-    // Exposed as an accessible switch, fetched against the current agent name.
-    expect(btn.getAttribute('role')).toBe('switch');
-    expect(mockGetAutofix).toHaveBeenCalledWith('demo', expect.anything());
-    // Disabled config → the switch is not in its "on" state.
-    expect(btn.classList.contains('settings-switch--on')).toBe(false);
-    expect(btn.getAttribute('aria-checked')).toBe('false');
-  });
-
-  it('shows the switch in its on state when Autofix is enabled', async () => {
-    mockGetAutofix.mockResolvedValue({ enabled: true });
-    const { container } = render(() => <SettingsAutofixSection agentName={() => 'demo'} />);
-
-    const btn = await waitForLoaded(container);
-    expect(btn.classList.contains('settings-switch--on')).toBe(true);
-    expect(btn.getAttribute('aria-checked')).toBe('true');
-  });
-
-  it('defaults the switch to off when the fetched config omits enabled', async () => {
-    mockGetAutofix.mockResolvedValue({});
-    const { container } = render(() => <SettingsAutofixSection agentName={() => 'demo'} />);
-
-    const btn = await waitForLoaded(container);
-    expect(btn.classList.contains('settings-switch--on')).toBe(false);
-    expect(btn.getAttribute('aria-checked')).toBe('false');
-  });
-
-  it('renders a disabled switch while the config is still loading', () => {
-    mockGetAutofix.mockReturnValue(new Promise(() => {}));
-    const { container } = render(() => <SettingsAutofixSection agentName={() => 'demo'} />);
-
-    const btn = container.querySelector('.settings-switch') as HTMLButtonElement;
-    expect(btn).not.toBeNull();
-    expect(btn.hasAttribute('disabled')).toBe(true);
-    expect(container.textContent).toContain('Autofix');
-  });
-
-  it('toggles Autofix on when currently disabled', async () => {
-    mockGetAutofix.mockResolvedValue({ enabled: false });
-    mockUpdateAutofix.mockResolvedValue({ enabled: true });
-    const { container } = render(() => <SettingsAutofixSection agentName={() => 'demo'} />);
-
-    const btn = await waitForLoaded(container);
-    fireEvent.click(btn);
-
-    expect(mockUpdateAutofix).toHaveBeenCalledWith('demo', { enabled: true });
-    // After the update resolves, the mutated config flips the switch on.
-    await waitFor(() => {
-      expect(btn.classList.contains('settings-switch--on')).toBe(true);
-    });
-  });
-
-  it('enables directly with the legal line as the consent act (no dialog)', async () => {
-    mockGetAutofix.mockResolvedValue({ enabled: false, consented: false });
-    mockUpdateAutofix.mockResolvedValue({ enabled: true, consented: true });
-    const { container } = render(() => <SettingsAutofixSection agentName={() => 'demo'} />);
-
-    const btn = await waitForLoaded(container);
-    // The Terms/Privacy legal line sits under the card, no dialog anywhere.
-    expect(container.textContent).toContain('you agree to Manifest');
-    const terms = screen.getByRole('link', { name: 'Terms' });
-    const privacy = screen.getByRole('link', { name: 'Privacy Policy' });
-    expect(terms.getAttribute('href')).toBe('https://manifest.build/terms');
-    expect(privacy.getAttribute('href')).toBe('https://manifest.build/privacy');
-
-    fireEvent.click(btn);
-    expect(screen.queryByRole('dialog')).toBeNull();
-    expect(mockUpdateAutofix).toHaveBeenCalledWith('demo', { enabled: true });
-    await waitFor(() => expect(btn.getAttribute('aria-checked')).toBe('true'));
-  });
-
-  it('flashes the card when arriving with ?highlight=autofix, then settles', async () => {
-    mockSearchParams = { highlight: 'autofix' };
-    vi.useFakeTimers({ shouldAdvanceTime: true });
-    try {
-      mockGetAutofix.mockResolvedValue({ enabled: false });
-      const { container } = render(() => <SettingsAutofixSection agentName={() => 'demo'} />);
-      expect(container.querySelector('.settings-card--highlight')).not.toBeNull();
-      await vi.advanceTimersByTimeAsync(1_500);
-      await waitFor(() =>
-        expect(container.querySelector('.settings-card--highlight')).toBeNull(),
-      );
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-
-  it('toggles Autofix off when currently enabled', async () => {
-    mockGetAutofix.mockResolvedValue({ enabled: true });
-    mockUpdateAutofix.mockResolvedValue({ enabled: false });
-    const { container } = render(() => <SettingsAutofixSection agentName={() => 'demo'} />);
-
-    const btn = await waitForLoaded(container);
-    fireEvent.click(btn);
-
-    expect(mockUpdateAutofix).toHaveBeenCalledWith('demo', { enabled: false });
-    expect(screen.queryByRole('dialog')).toBeNull();
-    await waitFor(() => {
-      expect(btn.classList.contains('settings-switch--on')).toBe(false);
-    });
-  });
-
-  it('ignores clicks while a save is already in flight', async () => {
-    mockGetAutofix.mockResolvedValue({ enabled: false });
-    // Keep the first update pending so `busy()` stays true for the second click.
-    mockUpdateAutofix.mockReturnValue(new Promise(() => {}));
-    const { container } = render(() => <SettingsAutofixSection agentName={() => 'demo'} />);
-
-    const btn = await waitForLoaded(container);
-    fireEvent.click(btn);
-    fireEvent.click(btn);
-
-    expect(mockUpdateAutofix).toHaveBeenCalledTimes(1);
-  });
-
-  it('keeps the switch visible but disabled when the initial read fails', async () => {
-    mockGetAutofix.mockRejectedValue(new Error('read failed'));
-    const { container } = render(() => <SettingsAutofixSection agentName={() => 'demo'} />);
-
-    await waitFor(() => expect(mockGetAutofix).toHaveBeenCalledTimes(1));
-    await new Promise((r) => setTimeout(r, 0));
-
-    const btn = container.querySelector('.settings-switch') as HTMLButtonElement;
-    expect(btn).not.toBeNull();
-    expect(btn.hasAttribute('disabled')).toBe(true);
-    expect(container.textContent).toContain('Autofix');
-    expect(mockUpdateAutofix).not.toHaveBeenCalled();
-  });
-
-  it('keeps the section disabled when a later refetch fails', async () => {
-    const [name, setName] = createSignal('a');
-    mockGetAutofix.mockResolvedValueOnce({ enabled: true });
-    mockGetAutofix.mockRejectedValueOnce(new Error('refetch failed'));
-    const { container } = render(() => <SettingsAutofixSection agentName={name} />);
-
-    // First load renders the switch in its on state.
-    const btn = await waitForLoaded(container);
-    expect(btn.classList.contains('settings-switch--on')).toBe(true);
-
-    setName('b');
-    await waitFor(() => {
-      const el = container.querySelector('.settings-switch') as HTMLButtonElement;
-      expect(el.hasAttribute('disabled')).toBe(true);
-    });
-    expect(container.textContent).toContain('Autofix');
-  });
-
-  it('shows the switch off (not the previous agent state) while a harness switch is loading', async () => {
-    const [name, setName] = createSignal('a');
-    mockGetAutofix.mockResolvedValueOnce({ enabled: true });
-    // The second agent's read never resolves → config.loading stays true, but
-    // Solid keeps the previous value while loading. Without the loading gate the
-    // switch would show 'a's ON state.
-    mockGetAutofix.mockReturnValueOnce(new Promise(() => {}));
-    const { container } = render(() => <SettingsAutofixSection agentName={name} />);
-
-    const btn = await waitForLoaded(container);
-    expect(btn.classList.contains('settings-switch--on')).toBe(true);
-
-    setName('b');
-    await waitFor(() => {
-      const el = container.querySelector('.settings-switch') as HTMLButtonElement;
-      expect(el.hasAttribute('disabled')).toBe(true);
-    });
-    expect(btn.classList.contains('settings-switch--on')).toBe(false);
-  });
-
-  it('does not apply a stale save after the harness switches mid-request', async () => {
-    const [name, setName] = createSignal('a');
-    mockGetAutofix.mockResolvedValue({ enabled: false });
-    let resolveUpdate: (v: { enabled: boolean }) => void = () => {};
-    mockUpdateAutofix.mockReturnValue(
-      new Promise<{ enabled: boolean }>((r) => {
-        resolveUpdate = r;
-      }),
-    );
-    const { container } = render(() => <SettingsAutofixSection agentName={name} />);
-
-    const btn = await waitForLoaded(container);
-    fireEvent.click(btn); // targets 'a'
-    expect(mockUpdateAutofix).toHaveBeenCalledWith('a', { enabled: true });
-
-    // Switch harness before the save resolves; the resource refetches for 'b'.
-    setName('b');
-    await waitFor(() => expect(mockGetAutofix).toHaveBeenCalledWith('b', expect.anything()));
-
-    // Resolve the stale 'a' update as ON, then let the toggle chain settle (the
-    // save's finally re-enables the switch). The guard must drop the stale
-    // response so the current 'b' harness stays OFF.
-    resolveUpdate({ enabled: true });
-    await waitFor(() => {
-      const el = container.querySelector('.settings-switch') as HTMLButtonElement;
-      expect(el.hasAttribute('disabled')).toBe(false);
-    });
-    expect(btn.classList.contains('settings-switch--on')).toBe(false);
-  });
-
-  it('raises no toast of its own on update failure and re-enables the switch', async () => {
-    mockGetAutofix.mockResolvedValue({ enabled: false });
-    mockUpdateAutofix.mockRejectedValue(new Error('boom'));
-    const { container } = render(() => <SettingsAutofixSection agentName={() => 'demo'} />);
-
-    const btn = await waitForLoaded(container);
-    fireEvent.click(btn);
-
-    // The rejected save must not crash the component and must re-enable the switch
-    // (spinner reset in `finally`). It raises no generic toast of its own — the
-    // real `updateAutofix` (via `fetchMutate`) already surfaces the backend error,
-    // so a second toast here would be a duplicate.
-    await waitFor(() => {
-      expect(btn.hasAttribute('disabled')).toBe(false);
-    });
-    expect(mockToastError).not.toHaveBeenCalled();
-    expect(btn.classList.contains('settings-switch--on')).toBe(false);
-  });
-});
diff --git a/packages/frontend/tests/pages/Setup.test.tsx b/packages/frontend/tests/pages/Setup.test.tsx
index 1dace7c8..aa3e88e9 100644
--- a/packages/frontend/tests/pages/Setup.test.tsx
+++ b/packages/frontend/tests/pages/Setup.test.tsx
@@ -120,18 +120,17 @@ describe('Setup page', () => {
     });
   });
 
-  it('redirects new admins to the discovery step after setup', async () => {
+  it('sends new admins straight to the dashboard home after setup', async () => {
     mockSignInEmail.mockResolvedValue({ data: { user: { id: 'admin1' } } });
-    localStorage.removeItem('manifest_discovery_pending_admin1');
     const { container } = await renderSetup();
     fillValidForm();
     fireEvent.submit(container.querySelector('form')!);
 
     await waitFor(() => {
-      expect(window.location.href).toBe('/discovery');
+      expect(window.location.href).toBe('/');
     });
-    expect(localStorage.getItem('manifest_discovery_pending_admin1')).toBe('/');
-    localStorage.removeItem('manifest_discovery_pending_admin1');
+    // No questionnaire marker is left behind for the guards to act on.
+    expect(localStorage.getItem('manifest_discovery_pending_admin1')).toBeNull();
   });
 
   it('surfaces server errors from createFirstAdmin', async () => {
@@ -145,17 +144,14 @@ describe('Setup page', () => {
     });
   });
 
-  it('preserves discovery through a manual login if auto-sign-in fails after setup', async () => {
+  it('falls back to the login page if auto-sign-in fails after setup', async () => {
     mockSignInEmail.mockResolvedValue({ error: { message: 'session failed' } });
     const { container } = await renderSetup();
     fillValidForm();
     fireEvent.submit(container.querySelector('form')!);
 
     await waitFor(() => {
-      expect(mockNavigate).toHaveBeenCalledWith(
-        '/login?redirect=%2Fdiscovery%3Fnext%3D%252F%26signup%3D1',
-        { replace: true },
-      );
+      expect(mockNavigate).toHaveBeenCalledWith('/login', { replace: true });
     });
   });
 
diff --git a/packages/frontend/tests/pages/Workspace-validation.test.tsx b/packages/frontend/tests/pages/Workspace-validation.test.tsx
index 33a79aa9..5d9088d5 100644
--- a/packages/frontend/tests/pages/Workspace-validation.test.tsx
+++ b/packages/frontend/tests/pages/Workspace-validation.test.tsx
@@ -36,14 +36,6 @@ vi.mock('../../src/services/api.js', () => ({
   getGlobalProviders: (...args: unknown[]) => mockGetGlobalProviders(...args),
 }));
 
-// AddAgentModal checks workspace Autofix consent before creating an agent with
-// Autofix on (the default). Unmocked it rejects, which fails closed into the
-// consent dialog and stops the create these tests assert on.
-const mockGetWorkspaceAutofixStatus = vi.fn();
-vi.mock('../../src/services/api/analytics.js', () => ({
-  getWorkspaceAutofixStatus: (...args: unknown[]) => mockGetWorkspaceAutofixStatus(...args),
-}));
-
 vi.mock('../../src/components/DuplicateAgentModal.jsx', () => ({ default: () => null }));
 
 vi.mock('../../src/services/toast-store.js', () => ({
@@ -131,7 +123,6 @@ describe('Workspace AddAgentModal - name validation', () => {
     mockGetAgents.mockResolvedValue({ agents: [] });
     mockCreateAgent.mockResolvedValue({ agent: { name: 'stub' }, apiKey: 'k' });
     mockGetGlobalProviders.mockResolvedValue({ providers: [{ provider: 'openai' }] });
-    mockGetWorkspaceAutofixStatus.mockResolvedValue({ consented: true });
   });
 
   it('keeps Create disabled while the name is the empty string', () => {
@@ -218,7 +209,6 @@ describe('Workspace AddAgentModal - name validation', () => {
         name: 'spaced-out',
         agent_category: 'personal',
         agent_platform: 'openclaw',
-        autofix_enabled: true,
         record_messages: true,
       });
     });
@@ -236,7 +226,6 @@ describe('Workspace AddAgentModal - name validation', () => {
         name: longName,
         agent_category: 'personal',
         agent_platform: 'openclaw',
-        autofix_enabled: true,
         record_messages: true,
       });
     });
@@ -250,7 +239,6 @@ describe('Workspace AddAgentModal - exact createAgent payload', () => {
     mockGetAgents.mockResolvedValue({ agents: [] });
     mockCreateAgent.mockResolvedValue({ agent: { name: 'demo' }, apiKey: 'k' });
     mockGetGlobalProviders.mockResolvedValue({ providers: [{ provider: 'openai' }] });
-    mockGetWorkspaceAutofixStatus.mockResolvedValue({ consented: true });
   });
 
   it('submits the default category and platform when the user only types a name', async () => {
@@ -262,7 +250,6 @@ describe('Workspace AddAgentModal - exact createAgent payload', () => {
         name: 'Demo Agent',
         agent_category: 'personal',
         agent_platform: 'openclaw',
-        autofix_enabled: true,
         record_messages: true,
       });
     });
@@ -271,7 +258,6 @@ describe('Workspace AddAgentModal - exact createAgent payload', () => {
     expect(Object.keys(call).sort()).toEqual([
       'agent_category',
       'agent_platform',
-      'autofix_enabled',
       'name',
       'record_messages',
     ]);
@@ -288,7 +274,6 @@ describe('Workspace AddAgentModal - exact createAgent payload', () => {
         name: 'my-langchain-agent',
         agent_category: 'app',
         agent_platform: 'langchain',
-        autofix_enabled: true,
         record_messages: true,
       });
     });
diff --git a/packages/frontend/tests/pages/Workspace.test.tsx b/packages/frontend/tests/pages/Workspace.test.tsx
index 1b593af4..7c58fd07 100644
--- a/packages/frontend/tests/pages/Workspace.test.tsx
+++ b/packages/frontend/tests/pages/Workspace.test.tsx
@@ -32,14 +32,6 @@ vi.mock('../../src/services/api.js', () => ({
   getGlobalProviders: (...args: unknown[]) => mockGetGlobalProviders(...args),
 }));
 
-// AddAgentModal checks workspace Autofix consent before creating an agent with
-// Autofix on (the default). Unmocked it rejects, which fails closed into the
-// consent dialog and stops the create these tests assert on.
-const mockGetWorkspaceAutofixStatus = vi.fn();
-vi.mock('../../src/services/api/analytics.js', () => ({
-  getWorkspaceAutofixStatus: (...args: unknown[]) => mockGetWorkspaceAutofixStatus(...args),
-}));
-
 vi.mock('../../src/components/DuplicateAgentModal.jsx', async () => {
   const { Show } = await import('solid-js');
   return {
@@ -191,7 +183,6 @@ describe('Workspace', () => {
     // Default: tenant already has a provider, so onboarding does not inject the
     // openProviders nudge and navigation carries only newApiKey.
     mockGetGlobalProviders.mockResolvedValue({ providers: [{ provider: 'openai' }] });
-    mockGetWorkspaceAutofixStatus.mockResolvedValue({ consented: true });
   });
 
   it('renders My Harnesses heading', async () => {
diff --git a/packages/frontend/tests/services/api/analytics.test.ts b/packages/frontend/tests/services/api/analytics.test.ts
index 7ae980ed..1488e6a6 100644
--- a/packages/frontend/tests/services/api/analytics.test.ts
+++ b/packages/frontend/tests/services/api/analytics.test.ts
@@ -89,20 +89,18 @@ describe('analytics API client', () => {
     expect(url).toContain('agent_name=demo');
   });
 
-  it('calls the Autofix analytics routes with their optional scopes', async () => {
+  it('calls the request-reliability routes with their optional scopes', async () => {
     let fetchMock = setupFetch({});
-    await analytics.getWorkspaceAutofixStatus();
-    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/autofix/status');
-
-    fetchMock = setupFetch({});
-    await analytics.getAutofixStats('30d', 'demo');
+    await analytics.getReliabilityStats('30d', 'demo');
     expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/autofix-stats');
+    expect(fetchMock.mock.calls[0][0]).toContain('range=30d');
     expect(fetchMock.mock.calls[0][0]).toContain('agent_name=demo');
 
     fetchMock = setupFetch({});
-    await analytics.getAutofixTimeseries('24h', 'autofix', 'demo', true);
+    await analytics.getRequestStatusTimeseries('24h', 'demo');
     expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/autofix-timeseries');
-    expect(fetchMock.mock.calls[0][0]).toContain('failed_only=true');
+    expect(fetchMock.mock.calls[0][0]).toContain('by=disposition');
+    expect(fetchMock.mock.calls[0][0]).toContain('agent_name=demo');
 
     fetchMock = setupFetch({});
     await analytics.getPerProviderReliability('7d', 'demo');
@@ -113,16 +111,20 @@ describe('analytics API client', () => {
     await analytics.getPerAgentReliability('90d');
     expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/autofix-per-agent');
 
+    fetchMock = setupFetch({});
+    await analytics.getPerModelReliability('7d', 'demo');
+    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/autofix-per-model');
+
     fetchMock = setupFetch({});
     await analytics.getErrorBreakdown('30d', 'demo');
     expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/errors/breakdown');
     expect(fetchMock.mock.calls[0][0]).toContain('agent_name=demo');
   });
 
-  it('uses Autofix analytics defaults without optional filters', async () => {
+  it('uses request-reliability defaults without optional filters', async () => {
     const calls = [
-      () => analytics.getAutofixStats(),
-      () => analytics.getAutofixTimeseries(),
+      () => analytics.getReliabilityStats(),
+      () => analytics.getRequestStatusTimeseries(),
       () => analytics.getPerProviderReliability(),
       () => analytics.getErrorBreakdown(),
     ];
@@ -135,6 +137,22 @@ describe('analytics API client', () => {
     }
   });
 
+  it('counts recovered requests from fallback saves only', () => {
+    expect(analytics.recoveredCount({ fallback_saves: 4 })).toBe(4);
+    expect(analytics.recoveredCount({})).toBe(0);
+    expect(analytics.TOTAL_ATTEMPTS_TOOLTIP).toContain('fallback retries');
+    expect(analytics.RECOVERED_REQUESTS_TOOLTIP).toBe(
+      'Successful requests that were recovered by fallback.',
+    );
+  });
+
+  it('no longer exposes the Autofix status, stats or timeseries clients', () => {
+    const exported = Object.keys(analytics);
+    expect(exported).not.toContain('getWorkspaceAutofixStatus');
+    expect(exported).not.toContain('getAutofixStats');
+    expect(exported).not.toContain('getAutofixTimeseries');
+  });
+
   it('getHealth GETs /health', async () => {
     const fetchMock = setupFetch({ ok: true });
     await analytics.getHealth();
diff --git a/packages/frontend/tests/services/api/routing-extra.test.ts b/packages/frontend/tests/services/api/routing-extra.test.ts
index 22c6616f..7fc9176c 100644
--- a/packages/frontend/tests/services/api/routing-extra.test.ts
+++ b/packages/frontend/tests/services/api/routing-extra.test.ts
@@ -115,28 +115,6 @@ describe('routing API client (additional coverage)', () => {
     await expect(routing.copilotPollToken('demo', 'dc-1')).rejects.toThrow(/Poll failed/);
   });
 
-  describe('autofix config', () => {
-    it('getAutofix GETs the autofix endpoint', async () => {
-      const fetchMock = setupFetch({ enabled: true });
-      const out = await routing.getAutofix('demo');
-      expect(out).toEqual({ enabled: true });
-      const url = fetchMock.mock.calls[0][0] as string;
-      expect(url).toContain('/api/v1/routing/demo/autofix');
-    });
-
-    it('updateAutofix PATCHes the autofix endpoint with a JSON body', async () => {
-      const fetchMock = setupFetch({ enabled: true });
-      const out = await routing.updateAutofix('demo', { enabled: true });
-      expect(out).toEqual({ enabled: true });
-      const [url, init] = fetchMock.mock.calls[0];
-      expect(url).toContain('/api/v1/routing/demo/autofix');
-      expect((init as RequestInit).method).toBe('PATCH');
-      expect(JSON.parse((init as RequestInit).body as string)).toEqual({
-        enabled: true,
-      });
-    });
-  });
-
   describe('message recording config', () => {
     it('GETs and PATCHes the per-agent recording flag', async () => {
       const fetchMock = setupFetch({ enabled: false });
diff --git a/packages/frontend/tests/services/discovery.test.ts b/packages/frontend/tests/services/discovery.test.ts
deleted file mode 100644
index d1c2d5c7..00000000
--- a/packages/frontend/tests/services/discovery.test.ts
+++ /dev/null
@@ -1,183 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import {
-  COMPANY_SIZE_OPTIONS,
-  PROJECT_TYPE_OPTIONS,
-  completeDiscovery,
-  getDiscoveryPendingNext,
-  hasDiscoveryBeenDoneLocally,
-  isDiscoveryRequired,
-  markDiscoveryDoneLocally,
-  markDiscoveryPending,
-} from '../../src/services/discovery';
-
-const mockFetch = vi.fn();
-
-describe('discovery service', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    localStorage.clear();
-    vi.stubGlobal('fetch', mockFetch);
-  });
-
-  afterEach(() => {
-    vi.unstubAllGlobals();
-    vi.restoreAllMocks();
-  });
-
-  it('exposes the form option lists', () => {
-    expect(PROJECT_TYPE_OPTIONS.map((o) => o.label)).toEqual([
-      'AI product or application',
-      'AI agent',
-      'Internal AI tool or automation',
-      'AI workflow / automation platform',
-      'Personal project / experimentation',
-      'Other',
-    ]);
-    expect(COMPANY_SIZE_OPTIONS.map((o) => o.label)).toEqual([
-      "I'm not using Manifest for work",
-      '1–20',
-      '21–100',
-      '101–500',
-      '501–1,000',
-      '1,000+',
-    ]);
-  });
-
-  it('persists and reads the per-user local flag', () => {
-    expect(hasDiscoveryBeenDoneLocally('u1')).toBe(false);
-    markDiscoveryDoneLocally('u1');
-    expect(hasDiscoveryBeenDoneLocally('u1')).toBe(true);
-    expect(hasDiscoveryBeenDoneLocally('u2')).toBe(false);
-  });
-
-  it('swallows storage write errors', () => {
-    vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
-      throw new Error('quota');
-    });
-    expect(() => markDiscoveryDoneLocally('u1')).not.toThrow();
-  });
-
-  it('treats storage read errors as not done', () => {
-    vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
-      throw new Error('unavailable');
-    });
-    expect(hasDiscoveryBeenDoneLocally('u1')).toBe(false);
-  });
-
-  describe('pending marker', () => {
-    it('stores and returns the pending next destination per user', () => {
-      expect(getDiscoveryPendingNext('u1')).toBeNull();
-      markDiscoveryPending('u1', '/welcome');
-      expect(getDiscoveryPendingNext('u1')).toBe('/welcome');
-      expect(getDiscoveryPendingNext('u2')).toBeNull();
-    });
-
-    it('returns null once the step is done, and completion clears the marker', () => {
-      markDiscoveryPending('u1', '/welcome');
-      markDiscoveryDoneLocally('u1');
-      expect(getDiscoveryPendingNext('u1')).toBeNull();
-      expect(localStorage.getItem('manifest_discovery_pending_u1')).toBeNull();
-    });
-
-    it('ignores an empty user id', () => {
-      markDiscoveryPending('', '/welcome');
-      expect(getDiscoveryPendingNext('')).toBeNull();
-    });
-
-    it('swallows storage errors', () => {
-      vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
-        throw new Error('quota');
-      });
-      vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
-        throw new Error('unavailable');
-      });
-      expect(() => markDiscoveryPending('u1', '/welcome')).not.toThrow();
-      expect(getDiscoveryPendingNext('u1')).toBeNull();
-    });
-  });
-
-  describe('isDiscoveryRequired', () => {
-    it('returns false without a network call when the local flag is set', async () => {
-      markDiscoveryDoneLocally('u1');
-      expect(await isDiscoveryRequired('u1')).toBe(false);
-      expect(mockFetch).not.toHaveBeenCalled();
-    });
-
-    it('trusts the backend when it answers required: true', async () => {
-      mockFetch.mockResolvedValue({ ok: true, json: async () => ({ required: true }) });
-      expect(await isDiscoveryRequired('u1')).toBe(true);
-      expect(mockFetch).toHaveBeenCalledWith('/api/v1/discovery/status', {
-        credentials: 'include',
-        cache: 'no-store',
-      });
-    });
-
-    it('caches a required: false answer as local completion, killing redirect loops', async () => {
-      markDiscoveryPending('u1', '/welcome');
-      mockFetch.mockResolvedValue({ ok: true, json: async () => ({ required: false }) });
-      expect(await isDiscoveryRequired('u1')).toBe(false);
-      expect(hasDiscoveryBeenDoneLocally('u1')).toBe(true);
-      expect(getDiscoveryPendingNext('u1')).toBeNull();
-    });
-
-    it('treats an unexpected response shape as not required', async () => {
-      mockFetch.mockResolvedValue({ ok: true, json: async () => ({}) });
-      expect(await isDiscoveryRequired('u1')).toBe(false);
-    });
-
-    it('falls back to the pending marker when the endpoint is not deployed (non-2xx)', async () => {
-      mockFetch.mockResolvedValue({ ok: false, status: 404 });
-      expect(await isDiscoveryRequired('u1')).toBe(false);
-      markDiscoveryPending('u1', '/welcome');
-      expect(await isDiscoveryRequired('u1')).toBe(true);
-    });
-
-    it('falls back to the pending marker when the request throws', async () => {
-      mockFetch.mockRejectedValue(new Error('network down'));
-      expect(await isDiscoveryRequired('u1')).toBe(false);
-      markDiscoveryPending('u1', '/welcome');
-      expect(await isDiscoveryRequired('u1')).toBe(true);
-    });
-
-    it('falls back to the pending marker when the response body is not JSON', async () => {
-      mockFetch.mockResolvedValue({
-        ok: true,
-        json: async () => {
-          throw new Error('bad json');
-        },
-      });
-      markDiscoveryPending('u1', '/welcome');
-      expect(await isDiscoveryRequired('u1')).toBe(true);
-    });
-  });
-
-  describe('completeDiscovery', () => {
-    it('marks the local flag and posts the submission', async () => {
-      mockFetch.mockResolvedValue({ ok: true });
-      await completeDiscovery('u1', { name: 'Seb', projectType: 'ai_agent' });
-
-      expect(hasDiscoveryBeenDoneLocally('u1')).toBe(true);
-      expect(mockFetch).toHaveBeenCalledWith('/api/v1/discovery/complete', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        credentials: 'include',
-        body: JSON.stringify({ name: 'Seb', projectType: 'ai_agent' }),
-      });
-    });
-
-    it('posts an empty body for a skip', async () => {
-      mockFetch.mockResolvedValue({ ok: true });
-      await completeDiscovery('u1', {});
-      expect(mockFetch).toHaveBeenCalledWith(
-        '/api/v1/discovery/complete',
-        expect.objectContaining({ body: '{}' }),
-      );
-    });
-
-    it('still resolves and keeps the local flag when the endpoint is unavailable', async () => {
-      mockFetch.mockRejectedValue(new Error('network down'));
-      await expect(completeDiscovery('u1', {})).resolves.toBeUndefined();
-      expect(hasDiscoveryBeenDoneLocally('u1')).toBe(true);
-    });
-  });
-});
diff --git a/packages/frontend/tests/services/version-api.test.ts b/packages/frontend/tests/services/version-api.test.ts
deleted file mode 100644
index 1f5d281c..00000000
--- a/packages/frontend/tests/services/version-api.test.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { getVersionInfo, type VersionInfo } from '../../src/services/api/version.js';
-import * as api from '../../src/services/api.js';
-
-vi.mock('../../src/services/toast-store.js', () => ({
-  toast: { error: vi.fn(), success: vi.fn(), warning: vi.fn() },
-}));
-
-const mockFetch = vi.fn();
-
-beforeEach(() => {
-  vi.stubGlobal('fetch', mockFetch);
-  vi.stubGlobal('location', { origin: 'http://localhost:3000' });
-  mockFetch.mockReset();
-});
-
-afterEach(() => {
-  vi.unstubAllGlobals();
-  vi.restoreAllMocks();
-});
-
-describe('getVersionInfo', () => {
-  it('fetches GET /api/v1/version and returns the payload', async () => {
-    const payload: VersionInfo = {
-      current: '6.21.1',
-      latest: '6.22.0',
-      update_available: true,
-      releases_behind: 1,
-      release_url: 'https://manifest.build/changelog/#v6-22-0',
-      github_release_url: 'https://github.com/mnfst/llm-gateway/releases/tag/manifest%406.22.0',
-      upgrade_docs_url: 'https://manifest.build/llm-gateway/docs/self-hosted/#upgrading',
-      upgrade_command: 'docker compose pull && docker compose up -d',
-      check_enabled: true,
-      checked_at: '2026-09-04T09:00:00.000Z',
-    };
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      json: () => Promise.resolve(payload),
-      text: () => Promise.resolve(JSON.stringify(payload)),
-    });
-
-    const result = await getVersionInfo();
-
-    expect(result).toEqual(payload);
-    expect(mockFetch).toHaveBeenCalledTimes(1);
-    expect(String(mockFetch.mock.calls[0][0])).toBe('http://localhost:3000/api/v1/version');
-  });
-
-  it('is re-exported from the api barrel', () => {
-    expect(api.getVersionInfo).toBe(getVersionInfo);
-  });
-});
diff --git a/packages/frontend/tests/wingman-dev-proxy.test.ts b/packages/frontend/tests/wingman-dev-proxy.test.ts
deleted file mode 100644
index 856db192..00000000
--- a/packages/frontend/tests/wingman-dev-proxy.test.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-import { describe, it, expect } from "vitest";
-import {
-  isRemoteWingman,
-  resolveWingmanDrawerUrl,
-} from "../wingman-dev-proxy";
-
-describe("isRemoteWingman", () => {
-  it("treats the hosted SPA as remote", () => {
-    expect(isRemoteWingman("https://wingman.manifest.build")).toBe(true);
-  });
-
-  it("treats a local Wingman checkout as not remote", () => {
-    expect(isRemoteWingman("http://localhost:3002")).toBe(false);
-    expect(isRemoteWingman("http://127.0.0.1:3002")).toBe(false);
-  });
-});
-
-describe("resolveWingmanDrawerUrl", () => {
-  // The regression this whole plugin exists for: framing the hosted HTTPS SPA
-  // makes every call from it to a localhost gateway a local-network request,
-  // which Chrome blocks and reports as a CORS failure.
-  it("never points the drawer at a public https origin", () => {
-    const url = resolveWingmanDrawerUrl("https://wingman.manifest.build", 3002);
-    expect(url).toBe("http://localhost:3002");
-    expect(url.startsWith("https://")).toBe(false);
-  });
-
-  it("uses the configured port", () => {
-    expect(resolveWingmanDrawerUrl("https://wingman.manifest.build", 41999)).toBe(
-      "http://localhost:41999",
-    );
-  });
-
-  it("leaves a loopback upstream alone", () => {
-    expect(resolveWingmanDrawerUrl("http://localhost:3002", 3002)).toBe(
-      "http://localhost:3002",
-    );
-    expect(resolveWingmanDrawerUrl("http://wingman.test:5555", 3002)).toBe(
-      "http://wingman.test:5555",
-    );
-  });
-});
diff --git a/packages/frontend/vite.config.ts b/packages/frontend/vite.config.ts
index 865f0150..92e44a13 100644
--- a/packages/frontend/vite.config.ts
+++ b/packages/frontend/vite.config.ts
@@ -3,22 +3,18 @@ import { resolve } from 'node:path';
 import { defineConfig, type ProxyOptions } from 'vite';
 import solidPlugin from 'vite-plugin-solid';
 import { codecovVitePlugin } from '@codecov/vite-plugin';
-import { resolveWingmanDrawerUrl, wingmanDevProxy } from './wingman-dev-proxy';
 
 // Dial the backend on 127.0.0.1, not `localhost`. The dev backend binds
 // 127.0.0.1 (IPv4), but on dual-stack machines `localhost` can resolve to
 // ::1 (IPv6) first, so proxied requests intermittently hit a port nothing is
-// listening on. A failed proxy hop returns no CORS headers, which the hosted
-// Wingman SPA (cross-origin, public HTTPS → loopback) then reports as a
-// spurious "CORS error".
+// listening on.
 const backendTarget = `http://127.0.0.1:${process.env.VITE_BACKEND_PORT || '3001'}`;
 
 // `nest --watch` restarts the backend on every save, and http-proxy reuses
 // keep-alive sockets that die across a restart. Without this handler Vite
-// answers the blip with a bare 502 carrying no CORS headers, so the
-// cross-origin Wingman drawer surfaces "backend momentarily unreachable" as a
-// misleading CORS failure. Echo the request Origin back on the error response
-// so the failure reads as an honest 502 the moment it happens.
+// answers the blip with a bare 502 carrying no CORS headers, which a
+// cross-origin caller reports as a misleading CORS failure. Echo the request
+// Origin back on the error response so the failure reads as an honest 502.
 const configureDevProxy: NonNullable<ProxyOptions['configure']> = (proxy) => {
   proxy.on('error', (err, req, res) => {
     // Websocket upgrades hand back a raw socket with no `writeHead`; only
@@ -48,33 +44,15 @@ const manifestVersion = (() => {
   }
 })();
 
-// The hosted Wingman SPA, and the loopback port the dev proxy republishes it
-// on. `WINGMAN_PORT` is the same knob the backend reads for its dev CORS
-// allow-list and CSP `frame-src`, so the three stay in step.
-const HOSTED_WINGMAN_URL = 'https://wingman.manifest.build';
-const wingmanUpstream = process.env.VITE_WINGMAN_URL || HOSTED_WINGMAN_URL;
-const wingmanPort = Number(process.env.WINGMAN_PORT || process.env.VITE_WINGMAN_PORT || 3002);
-const wingmanDrawerUrl = resolveWingmanDrawerUrl(wingmanUpstream, wingmanPort);
-
-export default defineConfig(({ command }) => ({
+export default defineConfig({
   define: {
+    // The version shown by the dashboard badge. Read from the canonical
+    // package.json at build time so the dashboard never asks the backend (or
+    // anyone else) for it.
     __MANIFEST_VERSION__: JSON.stringify(manifestVersion),
-    // The Wingman drawer and the orange "Dev" header badge are dev-only
-    // affordances. They ship only when Vite runs in dev mode
-    // (`vite serve`). Any production build — Docker self-hosted, Railway
-    // cloud, anything else — gets `__DEV_MODE__ = false`, so esbuild
-    // dead-code-eliminates the FAB, drawer, and badge.
-    __DEV_MODE__: JSON.stringify(command === 'serve'),
-    // Where the drawer's iframe points. In dev this is the loopback origin the
-    // Wingman dev proxy serves on, so the iframe and the gateway share an
-    // address space — a public HTTPS iframe cannot reach a localhost gateway
-    // (see wingman-dev-proxy.ts). Empty in a production build, where the
-    // drawer is dead-code-eliminated anyway.
-    __WINGMAN_URL__: JSON.stringify(command === 'serve' ? wingmanDrawerUrl : ''),
   },
   plugins: [
     solidPlugin(),
-    wingmanDevProxy({ port: wingmanPort, upstream: wingmanUpstream }),
     codecovVitePlugin({
       enableBundleAnalysis: process.env.CODECOV_TOKEN !== undefined,
       bundleName: 'manifest-frontend',
@@ -84,13 +62,9 @@ export default defineConfig(({ command }) => ({
   server: {
     port: 3000,
     // Disable Vite's built-in CORS handler. Otherwise it short-circuits
-    // OPTIONS preflights for proxied paths (e.g. `/api`, `/v1`) and
-    // strips the backend's headers — including
-    // `Access-Control-Allow-Private-Network`, which Chrome's Private
-    // Network Access enforcement now requires when the hosted Wingman
-    // SPA (https://wingman.manifest.build) calls into a loopback dev
-    // backend. The dashboard itself is same-origin, so it doesn't need
-    // Vite's CORS at all.
+    // OPTIONS preflights for proxied paths (e.g. `/api`, `/v1`) and strips
+    // the backend's own CORS headers. The dashboard itself is same-origin,
+    // so it doesn't need Vite's CORS at all.
     cors: false,
     proxy: {
       '/api': devProxyRoute,
@@ -148,4 +122,4 @@ export default defineConfig(({ command }) => ({
       ],
     },
   },
-}));
+});
diff --git a/packages/frontend/wingman-dev-proxy.ts b/packages/frontend/wingman-dev-proxy.ts
deleted file mode 100644
index f49553da..00000000
--- a/packages/frontend/wingman-dev-proxy.ts
+++ /dev/null
@@ -1,104 +0,0 @@
-import http from 'node:http';
-import https from 'node:https';
-import type { Plugin } from 'vite';
-
-/**
- * Serves the hosted Wingman SPA from a loopback origin during `vite serve`.
- *
- * The drawer used to iframe `https://wingman.manifest.build` directly and pass
- * it the dashboard's own origin as the gateway to test. That stopped working:
- * a public HTTPS page reaching `http://localhost:<port>` is a local-network
- * request, which Chrome (≥ 138) gates behind the Local Network Access
- * permission. Inside a cross-origin iframe that permission is denied by
- * permissions policy unless the embedder delegates it, so no prompt ever
- * appeared and every call failed with `Failed to fetch` — reported by the
- * browser as a CORS error, which is what sent us auditing the allow-list
- * repeatedly. Local Network Access also replaced Private Network Access, so
- * the `Access-Control-Allow-Private-Network` header the backend still sends
- * can no longer satisfy it.
- *
- * Reverse-proxying the SPA onto `127.0.0.1:<wingmanPort>` puts the iframe in
- * the same address space as the gateway, which sidesteps the permission
- * entirely — and works the same way in Safari and Firefox, neither of which
- * implements the Chrome permission. It is mounted at the port root so
- * Wingman's absolute asset paths (`/assets/…`, `/icons/…`) resolve unchanged.
- *
- * Dev only: `apply: 'serve'` keeps it out of every production build, matching
- * the drawer it exists to serve.
- */
-/** True when the upstream is a remote HTTPS SPA that has to be republished on loopback. */
-export function isRemoteWingman(upstream: string): boolean {
-  return upstream.startsWith('https://');
-}
-
-/**
- * The origin the drawer's iframe should point at.
- *
- * A remote HTTPS SPA is replaced by the loopback origin the proxy serves it
- * on — framing it directly would make every gateway call a blocked
- * local-network request. An upstream that is already on loopback (a
- * contributor's own `npm run dev` Wingman) is framed as-is.
- */
-export function resolveWingmanDrawerUrl(upstream: string, port: number): string {
-  return isRemoteWingman(upstream) ? `http://localhost:${port}` : upstream;
-}
-
-export function wingmanDevProxy(options: { port: number; upstream: string }): Plugin {
-  return {
-    name: 'manifest:wingman-dev-proxy',
-    apply: 'serve',
-    configureServer(server) {
-      // Only proxy a remote SPA. A contributor who points VITE_WINGMAN_URL at
-      // their own Wingman checkout is already on a loopback origin.
-      if (!isRemoteWingman(options.upstream)) return;
-      const upstream = new URL(options.upstream);
-
-      const proxy = http.createServer((req, res) => {
-        const upstreamReq = https.request(
-          {
-            host: upstream.hostname,
-            port: 443,
-            path: req.url,
-            method: req.method,
-            headers: {
-              ...req.headers,
-              host: upstream.hostname,
-              // Pass through undecoded so we can stream the body untouched.
-              'accept-encoding': 'identity',
-            },
-          },
-          (upstreamRes) => {
-            const headers = { ...upstreamRes.headers };
-            // The upstream CSP and framing headers are written for the hosted
-            // origin; on loopback they'd only block the drawer.
-            delete headers['content-security-policy'];
-            delete headers['x-frame-options'];
-            res.writeHead(upstreamRes.statusCode ?? 502, headers);
-            upstreamRes.pipe(res);
-          },
-        );
-        upstreamReq.on('error', (err: Error) => {
-          if (res.headersSent) return;
-          res.writeHead(502, { 'content-type': 'text/plain' });
-          res.end(`Wingman dev proxy could not reach ${options.upstream}: ${err.message}`);
-        });
-        req.pipe(upstreamReq);
-      });
-
-      proxy.on('error', (err: NodeJS.ErrnoException) => {
-        // A stale proxy from a previous run already owns the port — harmless,
-        // the drawer still resolves. Anything else is worth surfacing.
-        const detail = err.code === 'EADDRINUSE' ? 'port already in use' : err.message;
-        server.config.logger.warn(`[wingman] dev proxy not started (${detail})`);
-      });
-
-      proxy.listen(options.port, '127.0.0.1', () => {
-        server.config.logger.info(
-          `  ➜  Wingman drawer: http://localhost:${options.port} (proxying ${options.upstream})`,
-        );
-      });
-
-      server.httpServer?.on('close', () => proxy.close());
-    },
-  };
-}

From dd0ad62b2d880134728583495827f2eccba3c516 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 00:17:18 -0300
Subject: [PATCH 04/17] fix(frontend): opt new harnesses out of legacy Autofix
 until #16

Review follow-up for #57.

- A harness stored without autofix_enabled inherits the backend default.
  The backend turns Autofix ON when it detects no container (bare-metal
  npm start, dev runs), and the dashboard no longer has a switch to turn
  it off. Until #16 removes Autofix from the backend:
  - createAgent always sends autofix_enabled: false, which covers the
    Connect Harness modal, Welcome and ConnectProvider;
  - duplicateAgent follows the copy with PATCH
    /routing/:agent/autofix {enabled:false}, because the duplicate
    endpoint has no field for it.
  Both live in one commented block in services/api/agents.ts, with
  tests on the request payloads.
- The request-status timeseries client folds a legacy `healed` key into
  `success`. The backend's success rate already counts those requests
  as successes, so the bars still sum to the request total, Success +
  Recovered + Error matches the Success rate card, and Recovered stays
  fallback-only, like its KPI.
- The Requests page rewrites a stale ?trigger= value (for example
  ?trigger=autofix) on load to the filter it actually applies.
- Add AuthGuard tests for /cli/auth, with and without a session.
- Correct the dev guide: the self-hosted default is OFF only in a
  container or with MANIFEST_MODE=selfhosted. Document
  AUTOFIX_GLOBAL_ENABLED=false as the operator workaround for existing
  harnesses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/dev/manifest-guide.md                    |  8 ++-
 packages/frontend/src/pages/MessageLog.tsx    | 11 ++++
 packages/frontend/src/services/api/agents.ts  | 44 +++++++++++--
 .../frontend/src/services/api/analytics.ts    | 41 +++++++++++-
 .../tests/components/AddAgentModal.test.tsx   |  2 +
 .../tests/components/AuthGuard.test.tsx       | 31 ++++++++++
 .../frontend/tests/pages/MessageLog.test.tsx  | 31 ++++++++++
 .../tests/services/api/agents.test.ts         | 62 +++++++++++++++++--
 .../tests/services/api/analytics.test.ts      | 40 ++++++++++++
 9 files changed, 255 insertions(+), 15 deletions(-)

diff --git a/docs/dev/manifest-guide.md b/docs/dev/manifest-guide.md
index 1dc2c1cf..8a22b8cf 100644
--- a/docs/dev/manifest-guide.md
+++ b/docs/dev/manifest-guide.md
@@ -769,11 +769,15 @@ The id is minted lazily by `InstallIdService.getOrCreate()` (exported from `Tele
 
 **Recording separates the request verdict from attempt audit.** `requests.autofix_status` is the one outcome for the logical request; only `retry_succeeded` means the request was recovered by Autofix. Actual provider calls remain `agent_messages` rows with their own `status`. When Manifest sends a patched retry, the related attempt rows use `autofix_applied`, `autofix_group_id`, `autofix_role`, and `autofix_operations`; Phoenix's decision metadata is exposed by the entity as `autofix_decision` (`{status,issueId,patchId,healAttemptId,explanation}`) and mapped to the retained physical column `autofix_phoenix`. A Phoenix consultation that produces no patched retry must not create a fake provider attempt.
 
-**Frontend:** none. The dashboard's Autofix UI (Settings toggle, create-time switch, KPI card, badges, filters, Phoenix panels and the notification bell) was removed in #13; agents are created without `autofix_enabled`, so the self-hosted default (off) applies.
+**Frontend:** none. The dashboard's Autofix UI (Settings toggle, create-time switch, KPI card, badges, filters, Phoenix panels and the notification bell) was removed in #13.
+
+**Until #16 removes the backend side, the dashboard opts every new harness out.** A harness stored with `autofix_enabled = NULL` inherits `!isSelfHosted()`, which is **ON** whenever the backend detects no container (`/.dockerenv`, `/run/.containerenv`, `KUBERNETES_SERVICE_HOST`) and no `MANIFEST_MODE=selfhosted` — a bare-metal `npm start` or a dev run. Such a harness would send its repairable 4xx failures to the hosted healer. So `createAgent` in `packages/frontend/src/services/api/agents.ts` always sends `autofix_enabled: false`, and `duplicateAgent` follows the copy with `PATCH /api/v1/routing/:agent/autofix {enabled:false}` (the duplicate endpoint has no field for it).
+
+**Operator workaround for harnesses created before that** (or through the API/MCP/CLI without the flag): set `AUTOFIX_GLOBAL_ENABLED=false` (the global kill switch, checked before any per-agent flag), or run with `MANIFEST_MODE=selfhosted` so NULL resolves to off. The Docker image is already detected as self-hosted.
 
 **Self-hosted consent is once, and rides on the per-agent enable.** On self-hosted, consent is remembered via `install_metadata.autofix_consented_at` — a single nullable column on the existing telemetry singleton. Consent is recorded by **any** enable path: the per-agent `PATCH …/autofix` with `enabled: true` (a disable never mints it), the enable-all endpoint, and the Autofix switch on first agent creation. The singleton row is upserted, minting an `install_id` if telemetry never did — so consent alone never starts telemetry.
 
-**The dashboard has no Autofix enablement path** (#13).
+**The dashboard has no Autofix enablement or disablement path** (#13); use `AUTOFIX_GLOBAL_ENABLED=false` above.
 
 `POST /api/v1/autofix/enable-all` remains as an API-level fleet backfill (no dashboard caller): it runs `UPDATE agents SET autofix_enabled = true` for every live, non-playground agent in the tenant (**including any previously turned off**), invalidates the per-tenant config cache, records consent, and returns the refreshed workspace status. Soft-deleted agents are left alone so resurrecting one doesn't silently arrive with Autofix on.
 
diff --git a/packages/frontend/src/pages/MessageLog.tsx b/packages/frontend/src/pages/MessageLog.tsx
index 064e025a..63e2fca6 100644
--- a/packages/frontend/src/pages/MessageLog.tsx
+++ b/packages/frontend/src/pages/MessageLog.tsx
@@ -8,6 +8,7 @@ import {
   For,
   on,
   onCleanup,
+  onMount,
   Show,
   type Component,
 } from 'solid-js';
@@ -253,6 +254,16 @@ const MessageLog: Component = () => {
   const [triggerFilter, setTriggerFilter] = createSignal<TriggerChoice>(
     triggerListToChoice(normalizeTriggerFilters(searchParams.trigger)),
   );
+  // Rewrite a stale deep link (e.g. a recovery kind the dashboard no longer
+  // offers) to what the filter actually applies, so the URL never claims a
+  // filter that is not in effect.
+  onMount(() => {
+    const rawTrigger = searchParams.trigger;
+    const appliedTrigger = triggerChoiceToParam(triggerFilter());
+    if (typeof rawTrigger === 'string' && rawTrigger !== appliedTrigger) {
+      setSearchParams({ trigger: appliedTrigger }, { replace: true });
+    }
+  });
   // Attempt-status facet: a plain select (all / with a failed attempt / with
   // a succeeded attempt). NOT derivable from Status + Recovery — "has a failed
   // attempt" is Status=Failed UNION Recovery!=none, and those two AND together.
diff --git a/packages/frontend/src/services/api/agents.ts b/packages/frontend/src/services/api/agents.ts
index b70e84c3..26762052 100644
--- a/packages/frontend/src/services/api/agents.ts
+++ b/packages/frontend/src/services/api/agents.ts
@@ -1,4 +1,4 @@
-import { fetchJson, fetchMutate } from './core.js';
+import { fetchJson, fetchMutate, routingPath } from './core.js';
 
 export function getAgents(includePlayground = false) {
   // includePlayground surfaces the reserved Playground (is_playground) agent — the
@@ -86,14 +86,46 @@ export interface DuplicateAgentResult {
   copied: DuplicateAgentPreview['copied'];
 }
 
-export function duplicateAgent(sourceName: string, name: string) {
-  return fetchMutate<DuplicateAgentResult>(`/agents/${encodeURIComponent(sourceName)}/duplicate`, {
-    method: 'POST',
+// ---------------------------------------------------------------------------
+// Temporary legacy Autofix opt-out, removed by #16.
+//
+// The dashboard has no Autofix UI, but until #16 deletes Autofix from the
+// backend, a harness stored without an explicit `autofix_enabled` inherits the
+// backend default. That default is ON whenever the backend does not detect a
+// container (bare-metal `npm start`, dev runs), which would send failing
+// requests to Manifest's hosted healer. Every harness the dashboard creates
+// therefore opts out explicitly, here in the client so no caller can forget.
+// ---------------------------------------------------------------------------
+const LEGACY_AUTOFIX_OPT_OUT = { autofix_enabled: false } as const;
+
+/** Turn the legacy per-harness Autofix flag off (the duplicate endpoint has no field for it). */
+function optOutOfLegacyAutofix(agentName: string) {
+  return fetchMutate(routingPath(agentName, 'autofix'), {
+    method: 'PATCH',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ name }),
+    body: JSON.stringify({ enabled: false }),
   });
 }
 
+export async function duplicateAgent(sourceName: string, name: string) {
+  const result = await fetchMutate<DuplicateAgentResult>(
+    `/agents/${encodeURIComponent(sourceName)}/duplicate`,
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name }),
+    },
+  );
+  if (result?.agent?.name) {
+    try {
+      await optOutOfLegacyAutofix(result.agent.name);
+    } catch {
+      // The copy exists either way; fetchMutate already surfaced the error.
+    }
+  }
+  return result;
+}
+
 export function createAgent(params: CreateAgentParams) {
   return fetchMutate<{
     agent: {
@@ -107,6 +139,6 @@ export function createAgent(params: CreateAgentParams) {
   }>('/agents', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(params),
+    body: JSON.stringify({ ...params, ...LEGACY_AUTOFIX_OPT_OUT }),
   });
 }
diff --git a/packages/frontend/src/services/api/analytics.ts b/packages/frontend/src/services/api/analytics.ts
index 11f4c585..05408385 100644
--- a/packages/frontend/src/services/api/analytics.ts
+++ b/packages/frontend/src/services/api/analytics.ts
@@ -325,19 +325,54 @@ export function getReliabilityStats(range = '7d', agentName?: string): Promise<R
   }) as Promise<ReliabilityStats>;
 }
 
+/**
+ * Legacy request-status key for requests recovered by the removed Autofix. A
+ * backend that predates #16 can still return it for old rows (or for a harness
+ * that inherited the backend's Autofix default before the dashboard opted every
+ * create out). The backend's success rate already counts those requests as
+ * successes, so they are folded into `success`: the stacked bars keep summing
+ * to the Requests total, Success + Recovered + Error matches the Success rate
+ * card, and Recovered stays the fallback-only number the KPI shows.
+ */
+const LEGACY_RECOVERED_KEY = 'healed';
+
+/** Fold the legacy key into `success` (see LEGACY_RECOVERED_KEY). Pure. */
+export function foldLegacyRecoveredKey(ts: StatusTimeseries): StatusTimeseries {
+  const legacyIdx = ts.keys.indexOf(LEGACY_RECOVERED_KEY);
+  if (legacyIdx === -1) return ts;
+  const keys = ts.keys.filter((_, i) => i !== legacyIdx);
+  const hasSuccess = keys.includes('success');
+  const outKeys = hasSuccess ? keys : ['success', ...keys];
+  const successOut = outKeys.indexOf('success');
+  const successIn = ts.keys.indexOf('success');
+  return {
+    ...ts,
+    keys: outKeys,
+    buckets: ts.buckets.map((b) => {
+      const counts = outKeys.map((k) =>
+        k === 'success' ? 0 : (b.counts[ts.keys.indexOf(k)] ?? 0),
+      );
+      counts[successOut] =
+        (successIn === -1 ? 0 : (b.counts[successIn] ?? 0)) + (b.counts[legacyIdx] ?? 0);
+      return { bucket: b.bucket, counts };
+    }),
+  };
+}
+
 /**
  * Logical requests over time by final status (`success`, `fallback`,
  * `error`): the "By request status" chart and its recovered subset.
  */
-export function getRequestStatusTimeseries(
+export async function getRequestStatusTimeseries(
   range = '7d',
   agentName?: string,
 ): Promise<StatusTimeseries> {
-  return fetchJson(RELIABILITY_PATHS.requestStatusTimeseries, {
+  const ts = (await fetchJson(RELIABILITY_PATHS.requestStatusTimeseries, {
     range,
     by: 'disposition',
     ...(agentName ? { agent_name: agentName } : {}),
-  }) as Promise<StatusTimeseries>;
+  })) as StatusTimeseries;
+  return ts && Array.isArray(ts.keys) ? foldLegacyRecoveredKey(ts) : ts;
 }
 
 /**
diff --git a/packages/frontend/tests/components/AddAgentModal.test.tsx b/packages/frontend/tests/components/AddAgentModal.test.tsx
index f84a74f7..806af278 100644
--- a/packages/frontend/tests/components/AddAgentModal.test.tsx
+++ b/packages/frontend/tests/components/AddAgentModal.test.tsx
@@ -95,6 +95,8 @@ describe('AddAgentModal', () => {
     fireEvent.input(input, { target: { value: 'first-agent' } });
     fireEvent.click(createBtn);
     await vi.waitFor(() => expect(mockCreateAgent).toHaveBeenCalled());
+    // The modal sends no Autofix choice of its own; the API client adds the
+    // legacy opt-out to every create (tests/services/api/agents.test.ts).
     expect(mockCreateAgent.mock.calls[0]![0]).not.toHaveProperty('autofix_enabled');
   });
 
diff --git a/packages/frontend/tests/components/AuthGuard.test.tsx b/packages/frontend/tests/components/AuthGuard.test.tsx
index 2f8771e8..fdfa66b7 100644
--- a/packages/frontend/tests/components/AuthGuard.test.tsx
+++ b/packages/frontend/tests/components/AuthGuard.test.tsx
@@ -120,6 +120,37 @@ describe('AuthGuard', () => {
     });
   });
 
+  it('sends an unauthenticated CLI login to /login with its PKCE query intact', async () => {
+    // Contract with the CLI login: the approval page keeps port, state and the
+    // PKCE challenge through sign-in, or the CLI never receives its code.
+    mockSessionData = { data: null, isPending: false };
+    const search = '?port=53682&state=st4te&code_challenge=abc123&code_challenge_method=S256';
+    mockLocation = { pathname: '/cli/auth', search };
+    render(() => (
+      <AuthGuard>
+        <span>CLI consent</span>
+      </AuthGuard>
+    ));
+    await vi.waitFor(() => {
+      expect(mockNavigate).toHaveBeenCalledWith(
+        `/login?redirect=${encodeURIComponent(`/cli/auth${search}`)}`,
+        { replace: true },
+      );
+    });
+    expect(screen.queryByText('CLI consent')).toBeNull();
+  });
+
+  it('renders the CLI consent page for an authenticated session', async () => {
+    mockLocation = { pathname: '/cli/auth', search: '?port=53682&state=st4te' };
+    render(() => (
+      <AuthGuard>
+        <span>CLI consent</span>
+      </AuthGuard>
+    ));
+    expect(await screen.findByText('CLI consent')).toBeDefined();
+    expect(mockNavigate).not.toHaveBeenCalled();
+  });
+
   it('preserves the protected path and query when redirecting to login', async () => {
     mockSessionData = { data: null, isPending: false };
     mockLocation = { pathname: '/messages', search: '?range=30d' };
diff --git a/packages/frontend/tests/pages/MessageLog.test.tsx b/packages/frontend/tests/pages/MessageLog.test.tsx
index 030d6695..6aef8941 100644
--- a/packages/frontend/tests/pages/MessageLog.test.tsx
+++ b/packages/frontend/tests/pages/MessageLog.test.tsx
@@ -819,6 +819,37 @@ describe('MessageLog', () => {
         expect.objectContaining({ trigger: 'fallback' }),
       );
     });
+    // The URL is rewritten to the filter actually applied.
+    expect(mockSetSearchParams).toHaveBeenCalledWith({ trigger: 'fallback' }, { replace: true });
+  });
+
+  it('strips a stale ?trigger=autofix deep link instead of keeping it in the URL', async () => {
+    mockSearchParams = { trigger: 'autofix' };
+    mockGetMessages.mockResolvedValue(messagesData);
+    render(() => <MessageLog />);
+
+    await vi.waitFor(() => {
+      expect(mockSetSearchParams).toHaveBeenCalledWith({ trigger: undefined }, { replace: true });
+    });
+    expect(mockGetMessages).not.toHaveBeenCalledWith(
+      expect.objectContaining({ trigger: expect.anything() }),
+    );
+  });
+
+  it('leaves a current ?trigger=fallback deep link alone', async () => {
+    mockSearchParams = { trigger: 'fallback' };
+    mockGetMessages.mockResolvedValue(messagesData);
+    render(() => <MessageLog />);
+
+    await vi.waitFor(() => {
+      expect(mockGetMessages).toHaveBeenCalledWith(
+        expect.objectContaining({ trigger: 'fallback' }),
+      );
+    });
+    expect(mockSetSearchParams).not.toHaveBeenCalledWith(
+      expect.objectContaining({ trigger: expect.anything() }),
+      expect.anything(),
+    );
   });
 
   it('seeds the status filter from the status search param', async () => {
diff --git a/packages/frontend/tests/services/api/agents.test.ts b/packages/frontend/tests/services/api/agents.test.ts
index 9480591c..7363e4c0 100644
--- a/packages/frontend/tests/services/api/agents.test.ts
+++ b/packages/frontend/tests/services/api/agents.test.ts
@@ -42,9 +42,16 @@ describe('agents API client', () => {
   });
 
   it('getAgentInfo unwraps the { agent } envelope', async () => {
-    const fetchMock = setupFetch({ agent: { agent_name: 'a', display_name: 'A', agent_category: null, agent_platform: null } });
+    const fetchMock = setupFetch({
+      agent: { agent_name: 'a', display_name: 'A', agent_category: null, agent_platform: null },
+    });
     const out = await agents.getAgentInfo('a');
-    expect(out).toEqual({ agent_name: 'a', display_name: 'A', agent_category: null, agent_platform: null });
+    expect(out).toEqual({
+      agent_name: 'a',
+      display_name: 'A',
+      agent_category: null,
+      agent_platform: null,
+    });
     const url = fetchMock.mock.calls[0][0] as string;
     expect(url).toContain('/api/v1/agents/a');
   });
@@ -125,11 +132,17 @@ describe('agents API client', () => {
     expect(url).toContain('/api/v1/agents/demo/duplicate-preview');
   });
 
-  it('duplicateAgent POSTs the new name to the duplicate endpoint', async () => {
+  it('duplicateAgent POSTs the new name, then opts the copy out of legacy Autofix', async () => {
     const fetchMock = setupFetch({
       agent: { id: '1', name: 'demo-copy', display_name: 'Demo Copy' },
       apiKey: 'mnfst_new',
-      copied: { providers: 0, customProviders: 0, tierAssignments: 0, specificityAssignments: 0, modelParams: 0 },
+      copied: {
+        providers: 0,
+        customProviders: 0,
+        tierAssignments: 0,
+        specificityAssignments: 0,
+        modelParams: 0,
+      },
     });
     const out = await agents.duplicateAgent('demo', 'demo-copy');
     expect(out.agent.name).toBe('demo-copy');
@@ -137,6 +150,38 @@ describe('agents API client', () => {
     expect(url).toContain('/api/v1/agents/demo/duplicate');
     expect((init as RequestInit).method).toBe('POST');
     expect(JSON.parse((init as RequestInit).body as string)).toEqual({ name: 'demo-copy' });
+    // Until #16: the duplicate endpoint takes no Autofix field, so the copy is
+    // switched off right after it is created.
+    const [optOutUrl, optOutInit] = fetchMock.mock.calls[1];
+    expect(optOutUrl).toContain('/api/v1/routing/demo-copy/autofix');
+    expect((optOutInit as RequestInit).method).toBe('PATCH');
+    expect(JSON.parse((optOutInit as RequestInit).body as string)).toEqual({ enabled: false });
+  });
+
+  it('duplicateAgent still returns the copy when the Autofix opt-out fails', async () => {
+    const created = {
+      agent: { id: '1', name: 'demo-copy', display_name: 'Demo Copy' },
+      apiKey: 'mnfst_new',
+      copied: { providers: 0, tierAssignments: 0, specificityAssignments: 0, modelParams: 0 },
+    };
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        json: async () => created,
+        text: async () => JSON.stringify(created),
+      })
+      .mockResolvedValueOnce({
+        ok: false,
+        status: 500,
+        json: async () => ({ message: 'boom' }),
+        text: async () => JSON.stringify({ message: 'boom' }),
+      });
+    vi.stubGlobal('fetch', fetchMock);
+    const out = await agents.duplicateAgent('demo', 'demo-copy');
+    expect(out.agent.name).toBe('demo-copy');
+    expect(fetchMock).toHaveBeenCalledTimes(2);
   });
 
   it('createAgent POSTs the create payload', async () => {
@@ -159,10 +204,19 @@ describe('agents API client', () => {
     const [url, init] = fetchMock.mock.calls[0];
     expect(url).toContain('/api/v1/agents');
     expect((init as RequestInit).method).toBe('POST');
+    // Until #16: every create opts out of the legacy backend Autofix default.
     expect(JSON.parse((init as RequestInit).body as string)).toEqual({
       name: 'new-agent',
       agent_category: 'coding',
       agent_platform: 'openclaw',
+      autofix_enabled: false,
     });
   });
+
+  it('createAgent always sends autofix_enabled: false, even for a bare name', async () => {
+    const fetchMock = setupFetch({ agent: { name: 'my-agent' }, apiKey: 'k' });
+    await agents.createAgent({ name: 'my-agent' });
+    const body = JSON.parse((fetchMock.mock.calls[0][1] as RequestInit).body as string);
+    expect(body).toEqual({ name: 'my-agent', autofix_enabled: false });
+  });
 });
diff --git a/packages/frontend/tests/services/api/analytics.test.ts b/packages/frontend/tests/services/api/analytics.test.ts
index 1488e6a6..2a4531af 100644
--- a/packages/frontend/tests/services/api/analytics.test.ts
+++ b/packages/frontend/tests/services/api/analytics.test.ts
@@ -137,6 +137,46 @@ describe('analytics API client', () => {
     }
   });
 
+  it('folds a legacy healed request-status series into success', async () => {
+    setupFetch({
+      range: '7d',
+      by: 'disposition',
+      keys: ['success', 'healed', 'fallback', 'error'],
+      buckets: [
+        { bucket: '2026-06-04', counts: [5, 2, 3, 1] },
+        { bucket: '2026-06-05', counts: [1, 0, 0, 4] },
+      ],
+    });
+    const ts = await analytics.getRequestStatusTimeseries('7d');
+    expect(ts.keys).toEqual(['success', 'fallback', 'error']);
+    // Bars still sum to the request total: 11 and 5.
+    expect(ts.buckets).toEqual([
+      { bucket: '2026-06-04', counts: [7, 3, 1] },
+      { bucket: '2026-06-05', counts: [1, 0, 4] },
+    ]);
+  });
+
+  it('creates the success series when only the legacy key carries successes', () => {
+    const ts = analytics.foldLegacyRecoveredKey({
+      range: '24h',
+      by: 'disposition',
+      keys: ['healed', 'error'],
+      buckets: [{ bucket: 'b', counts: [2, 1] }],
+    });
+    expect(ts.keys).toEqual(['success', 'error']);
+    expect(ts.buckets[0]!.counts).toEqual([2, 1]);
+  });
+
+  it('leaves a timeseries without the legacy key untouched', () => {
+    const input = {
+      range: '24h',
+      by: 'disposition',
+      keys: ['success', 'fallback'],
+      buckets: [{ bucket: 'b', counts: [2, 1] }],
+    };
+    expect(analytics.foldLegacyRecoveredKey(input)).toBe(input);
+  });
+
   it('counts recovered requests from fallback saves only', () => {
     expect(analytics.recoveredCount({ fallback_saves: 4 })).toBe(4);
     expect(analytics.recoveredCount({})).toBe(0);

From 64f31b4499d7e6c848278e0fe15dfb3bfc25689f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 00:22:35 -0300
Subject: [PATCH 05/17] refactor(backend): remove waitlist, CRM, Gemini Free,
 free models, GitHub stars and error pages

Remove the Manifest Cloud and marketing surfaces from the backend:

- waitlist/ (pivot and Autofix claims) and its open-CORS pivot route
  (applyPivotClaimCors, PIVOT_CLAIM_PATH, PIVOT_CLAIM_CLOUD_ORIGIN).
- crm-metrics/ and CRM_METRICS_SECRET.
- The managed Gemini Free provider: routing/managed-free-provider/,
  common/constants/managed-free-providers.ts, the CREDITS_* variables, and
  its entries in provider-endpoints, provider-client, provider.service,
  provider-model-fetcher and routing.module. No other provider's endpoint,
  prefix handling, fallback order or tier resolution changes.
- free-models/ (sync from mnfst/awesome-free-llm-apis), github/ (stars from
  api.github.com) and error-pages/ (public and Peacock push routes, seeders,
  discovery), MANIFEST_PUBLIC_STATS and ERROR_PAGE_PUSH_SECRET.
- gemini-free and the managedFree flag from manifest-shared, and the
  regenerated CLI provider catalog.
- The plan_request_limit_exceeded error class left over from #14.

DropSaasFeatureSchema1803300000000 sets a transaction-local lock_timeout,
drops waitlist_claims, public_error_pages and the cloud-only
IDX_requests_autofix_healed index, and deletes every gemini-free connection
with its agent grants. Request history keeps its provider label, and routes
that still name gemini-free resolve as unavailable and fall through to their
fallbacks, as after a disconnect. down() restores the two tables as the
self-hosted path created them.

Closes #15

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docker/.env.example                           |   8 -
 docs/dev/manifest-guide.md                    |  18 +-
 packages/backend/.env.example                 |  11 -
 packages/backend/src/app.module.ts            |  17 -
 .../constants/managed-free-providers.spec.ts  |  84 --
 .../constants/managed-free-providers.ts       |  85 --
 .../backend/src/common/utils/dashboard-url.ts |   2 +-
 packages/backend/src/config/app.config.ts     |  16 -
 packages/backend/src/cors-csp-config.spec.ts  |  30 -
 packages/backend/src/cors-csp-config.ts       |  36 -
 .../crm-metrics/crm-metrics.filters.spec.ts   | 301 --------
 .../src/crm-metrics/crm-metrics.filters.ts    | 349 ---------
 .../src/crm-metrics/crm-metrics.module.ts     |  13 -
 .../crm-metrics/crm-metrics.service.spec.ts   | 725 ------------------
 .../src/crm-metrics/crm-metrics.service.ts    | 384 ----------
 .../src/crm-metrics/crm-metrics.types.ts      |  69 --
 .../dto/crm-metrics-query.dto.spec.ts         |  39 -
 .../crm-metrics/dto/crm-metrics-query.dto.ts  |  22 -
 .../internal-crm-metrics.controller.spec.ts   | 271 -------
 .../internal-crm-metrics.controller.ts        | 138 ----
 .../src/database/data-source-definitions.ts   |   6 +-
 .../backend/src/database/index-rebuild.ts     |   2 +-
 ...803300000000-DropSaasFeatureSchema.spec.ts |  45 ++
 .../1803300000000-DropSaasFeatureSchema.ts    |  86 +++
 .../src/entities/public-error-page.entity.ts  | 105 ---
 .../src/entities/waitlist-claim.entity.ts     |  16 -
 .../error-pages/dto/upsert-error-page.dto.ts  |  34 -
 .../error-cluster-seeder.service.spec.ts      | 122 ---
 .../error-cluster-seeder.service.ts           | 227 ------
 .../error-discovery.service.spec.ts           | 315 --------
 .../error-pages/error-discovery.service.ts    | 170 ----
 .../error-pages/error-page-seed-data.spec.ts  |  48 --
 .../src/error-pages/error-page-seed-data.ts   | 410 ----------
 .../error-page-seeder.service.spec.ts         |  53 --
 .../error-pages/error-page-seeder.service.ts  |  56 --
 .../src/error-pages/error-pages.module.ts     |  22 -
 .../error-pages/error-pages.service.spec.ts   | 244 ------
 .../src/error-pages/error-pages.service.ts    | 100 ---
 .../internal-error-pages.controller.spec.ts   | 118 ---
 .../internal-error-pages.controller.ts        |  61 --
 .../public-error-pages.controller.spec.ts     | 153 ----
 .../public-error-pages.controller.ts          |  57 --
 .../free-models-provider-metadata.ts          |  96 ---
 .../free-models-sync.service.spec.ts          | 290 -------
 .../free-models/free-models-sync.service.ts   | 135 ----
 .../free-models.controller.spec.ts            |  47 --
 .../src/free-models/free-models.controller.ts |  16 -
 .../src/free-models/free-models.module.ts     |  11 -
 .../free-models/free-models.service.spec.ts   | 172 -----
 .../src/free-models/free-models.service.ts    |  65 --
 .../src/github/github.controller.spec.ts      | 229 ------
 .../backend/src/github/github.controller.ts   |  37 -
 packages/backend/src/github/github.module.ts  |   7 -
 packages/backend/src/main.ts                  |  13 -
 .../filter-non-chat-models.spec.ts            |  25 -
 .../provider-model-fetcher.service.spec.ts    |  31 +-
 .../provider-model-fetcher.service.ts         |  45 --
 .../managed-free-provider.controller.spec.ts  |  77 --
 .../managed-free-provider.controller.ts       |  49 --
 .../managed-free-provider.service.spec.ts     | 275 -------
 .../managed-free-provider.service.ts          | 213 -----
 .../proxy/__tests__/provider-client.spec.ts   |  29 +-
 .../__tests__/provider-endpoints.spec.ts      |  17 +-
 .../__tests__/responses-stream-tools.spec.ts  |   6 +-
 .../proxy/__tests__/responses-tools.spec.ts   |  23 +-
 .../src/routing/proxy/provider-client.ts      |   5 +-
 .../src/routing/proxy/provider-endpoints.ts   |  20 -
 .../routing/routing-core/provider.service.ts  |  10 +-
 .../backend/src/routing/routing.module.ts     |   5 +-
 .../src/waitlist/dto/pivot-claim.dto.spec.ts  |  43 --
 .../src/waitlist/dto/pivot-claim.dto.ts       |  23 -
 .../src/waitlist/waitlist.controller.spec.ts  | 110 ---
 .../src/waitlist/waitlist.controller.ts       |  87 ---
 .../backend/src/waitlist/waitlist.module.ts   |  10 -
 packages/backend/test/crm-metrics.e2e-spec.ts | 366 ---------
 ...-saas-feature-schema-migration.e2e-spec.ts | 182 +++++
 packages/backend/test/helpers.ts              |   8 -
 .../test/removed-saas-routes.e2e-spec.ts      |  53 ++
 packages/backend/test/waitlist.e2e-spec.ts    | 141 ----
 packages/cli/src/provider-catalog.gen.ts      |   6 -
 .../shared/__tests__/error-taxonomy.spec.ts   |   6 +-
 packages/shared/__tests__/providers.spec.ts   |  12 +-
 packages/shared/src/error-taxonomy.ts         |  12 -
 packages/shared/src/providers.ts              |  15 -
 84 files changed, 419 insertions(+), 7671 deletions(-)
 delete mode 100644 packages/backend/src/common/constants/managed-free-providers.spec.ts
 delete mode 100644 packages/backend/src/common/constants/managed-free-providers.ts
 delete mode 100644 packages/backend/src/crm-metrics/crm-metrics.filters.spec.ts
 delete mode 100644 packages/backend/src/crm-metrics/crm-metrics.filters.ts
 delete mode 100644 packages/backend/src/crm-metrics/crm-metrics.module.ts
 delete mode 100644 packages/backend/src/crm-metrics/crm-metrics.service.spec.ts
 delete mode 100644 packages/backend/src/crm-metrics/crm-metrics.service.ts
 delete mode 100644 packages/backend/src/crm-metrics/crm-metrics.types.ts
 delete mode 100644 packages/backend/src/crm-metrics/dto/crm-metrics-query.dto.spec.ts
 delete mode 100644 packages/backend/src/crm-metrics/dto/crm-metrics-query.dto.ts
 delete mode 100644 packages/backend/src/crm-metrics/internal-crm-metrics.controller.spec.ts
 delete mode 100644 packages/backend/src/crm-metrics/internal-crm-metrics.controller.ts
 create mode 100644 packages/backend/src/database/migrations/1803300000000-DropSaasFeatureSchema.spec.ts
 create mode 100644 packages/backend/src/database/migrations/1803300000000-DropSaasFeatureSchema.ts
 delete mode 100644 packages/backend/src/entities/public-error-page.entity.ts
 delete mode 100644 packages/backend/src/entities/waitlist-claim.entity.ts
 delete mode 100644 packages/backend/src/error-pages/dto/upsert-error-page.dto.ts
 delete mode 100644 packages/backend/src/error-pages/error-cluster-seeder.service.spec.ts
 delete mode 100644 packages/backend/src/error-pages/error-cluster-seeder.service.ts
 delete mode 100644 packages/backend/src/error-pages/error-discovery.service.spec.ts
 delete mode 100644 packages/backend/src/error-pages/error-discovery.service.ts
 delete mode 100644 packages/backend/src/error-pages/error-page-seed-data.spec.ts
 delete mode 100644 packages/backend/src/error-pages/error-page-seed-data.ts
 delete mode 100644 packages/backend/src/error-pages/error-page-seeder.service.spec.ts
 delete mode 100644 packages/backend/src/error-pages/error-page-seeder.service.ts
 delete mode 100644 packages/backend/src/error-pages/error-pages.module.ts
 delete mode 100644 packages/backend/src/error-pages/error-pages.service.spec.ts
 delete mode 100644 packages/backend/src/error-pages/error-pages.service.ts
 delete mode 100644 packages/backend/src/error-pages/internal-error-pages.controller.spec.ts
 delete mode 100644 packages/backend/src/error-pages/internal-error-pages.controller.ts
 delete mode 100644 packages/backend/src/error-pages/public-error-pages.controller.spec.ts
 delete mode 100644 packages/backend/src/error-pages/public-error-pages.controller.ts
 delete mode 100644 packages/backend/src/free-models/free-models-provider-metadata.ts
 delete mode 100644 packages/backend/src/free-models/free-models-sync.service.spec.ts
 delete mode 100644 packages/backend/src/free-models/free-models-sync.service.ts
 delete mode 100644 packages/backend/src/free-models/free-models.controller.spec.ts
 delete mode 100644 packages/backend/src/free-models/free-models.controller.ts
 delete mode 100644 packages/backend/src/free-models/free-models.module.ts
 delete mode 100644 packages/backend/src/free-models/free-models.service.spec.ts
 delete mode 100644 packages/backend/src/free-models/free-models.service.ts
 delete mode 100644 packages/backend/src/github/github.controller.spec.ts
 delete mode 100644 packages/backend/src/github/github.controller.ts
 delete mode 100644 packages/backend/src/github/github.module.ts
 delete mode 100644 packages/backend/src/routing/managed-free-provider/managed-free-provider.controller.spec.ts
 delete mode 100644 packages/backend/src/routing/managed-free-provider/managed-free-provider.controller.ts
 delete mode 100644 packages/backend/src/routing/managed-free-provider/managed-free-provider.service.spec.ts
 delete mode 100644 packages/backend/src/routing/managed-free-provider/managed-free-provider.service.ts
 delete mode 100644 packages/backend/src/waitlist/dto/pivot-claim.dto.spec.ts
 delete mode 100644 packages/backend/src/waitlist/dto/pivot-claim.dto.ts
 delete mode 100644 packages/backend/src/waitlist/waitlist.controller.spec.ts
 delete mode 100644 packages/backend/src/waitlist/waitlist.controller.ts
 delete mode 100644 packages/backend/src/waitlist/waitlist.module.ts
 delete mode 100644 packages/backend/test/crm-metrics.e2e-spec.ts
 create mode 100644 packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts
 create mode 100644 packages/backend/test/removed-saas-routes.e2e-spec.ts
 delete mode 100644 packages/backend/test/waitlist.e2e-spec.ts

diff --git a/docker/.env.example b/docker/.env.example
index 484e1d2e..5066a536 100644
--- a/docker/.env.example
+++ b/docker/.env.example
@@ -89,14 +89,6 @@ BETTER_AUTH_SECRET=
 # Per-tenant concurrent in-flight request limit for each backend process.
 # MANIFEST_CONCURRENCY_MAX=10
 
-# Managed free providers (optional). A master key enables automatic
-# virtual-key provisioning; users can otherwise paste a key obtained through
-# the provider's "Get API key" link.
-# CREDITS_BASE_URL=https://credits.manifest.build
-# CREDITS_MASTER_KEY=
-# CREDITS_AUTO_PROVISION_ALLOWLIST=  # Optional comma-separated user emails
-# CREDITS_GEMINI_FREE_MAX_BUDGET=10  # Budget in USD for each generated key
-
 # ─── Email provider (optional) ─────────────────────────────────────────────
 #
 # Unified config — used for BOTH login emails (signup verification, password
diff --git a/docs/dev/manifest-guide.md b/docs/dev/manifest-guide.md
index 00840110..ab1b0a93 100644
--- a/docs/dev/manifest-guide.md
+++ b/docs/dev/manifest-guide.md
@@ -16,7 +16,7 @@ Manifest is a smart model router for **AI agents**. It sits between an agent and
 
 **"Harness" is the dashboard word for an agent.** The UI now labels agents **Harnesses** (nav item "Harnesses", routes under `/harnesses`, categories `AI agent` / `Automation` / `App AI SDK` / `Coding Assistant` from `CATEGORY_LABELS` in `packages/shared/src/agent-type.ts`). This is a **copy-level rename only**: backend code, database tables (`agents`, `agent_messages`, …), API routes (`/api/v1/agents/*`), and entity/service names all still say *agent*. Legacy `/agents/*` dashboard URLs redirect to `/harnesses/*`. When writing UI copy say "harness"; when writing code or API docs keep "agent".
 
-**Product note:** this repo is **Manifest LLM Gateway**, the open-source LLM gateway of Manifest, available and maintained. The dashboard and the READMEs carry no promotion of the other Manifest product (the self-healing layer at `dashboard.manifest.build`), which is on hold. Thinker removed the dashboard's SaaS layer (#12): no API Bot banner or sidebar card, no plans/upgrade/Stripe UI, no GitHub stars, no Free Models page, no managed Gemini Free, and no cloud-mode branches (the dashboard always behaves as self-hosted). The matching backend endpoints (`/api/v1/billing*`, `/api/v1/waitlist*`, `/api/v1/github*`, `/api/v1/free-models*`) still exist until #14/#15 remove them; the dashboard no longer calls them.
+**Product note:** this repo is **Manifest LLM Gateway**, the open-source LLM gateway of Manifest, available and maintained. The dashboard and the READMEs carry no promotion of the other Manifest product (the self-healing layer at `dashboard.manifest.build`), which is on hold. Thinker removed the dashboard's SaaS layer (#12): no API Bot banner or sidebar card, no plans/upgrade/Stripe UI, no GitHub stars, no Free Models page, no managed Gemini Free, and no cloud-mode branches (the dashboard always behaves as self-hosted). The matching backend endpoints are gone too: billing in #14, and the waitlist, CRM metrics feed, GitHub stars, free models, public and internal error pages and managed Gemini Free in #15.
 
 **Supported agents**: see `AGENT_PLATFORMS` in `packages/shared/src/agent-type.ts` for the current list (OpenClaw, Hermes, Claude Code, OpenCode, generic OpenAI/Anthropic SDK slots, and others — don't duplicate the list here, it grows independently of this doc). OpenClaw remains the deepest integration, but no new code or copy should frame Manifest as OpenClaw-only. When adding examples, prefer "AI agent" as the noun and pick OpenClaw as the worked example rather than the sole target. Manifest is consumed as a generic OpenAI-compatible HTTP endpoint — there are no first-party OpenClaw plugins in this repo anymore.
 
@@ -139,15 +139,10 @@ packages/
 │   │   ├── model-prices/                    # Model pricing management + sync
 │   │   ├── notifications/                   # Alert rules, email providers, cron
 │   │   ├── playground/                      # Prompt playground (runs, columns, starred/best)
-│   │   ├── github/                          # GitHub stars endpoint
 │   │   ├── sse/                             # Server-Sent Events for real-time updates
 │   │   ├── setup/                           # First-run admin setup wizard
-│   │   ├── free-models/                     # Free LLM model catalog
 │   │   ├── model-discovery/                 # Per-provider model fetching + fallback
-│   │   ├── error-pages/                     # Custom error-page config (internal + public)
-│   │   ├── waitlist/                        # Pivot waiting-list claims + legacy Autofix claim compatibility route
 │   │   ├── discovery/                       # Self-hosted discovery onboarding (forwarded to Peacock)
-│   │   ├── crm-metrics/                     # Cloud-only internal feed: Autofix-healed cohort + waitlist claims + corporate signups (secret-gated)
 │   │   ├── cors-csp-config.ts               # Wingman CORS/CSP origin allowlists
 │   │   ├── sentry/                          # Sentry init-options builder (SENTRY_DSN-gated)
 │   │   ├── telemetry/                       # Anonymous self-hosted telemetry
@@ -420,20 +415,15 @@ Every resource belongs to a tenant; users only authenticate and (optionally) app
 | GET/PATCH/DELETE          | `/api/v1/messages/:id/*`                        | Session/API Key                     | Request details, feedback, miscategorized flag (legacy route name)                                          |
 | GET                       | `/api/v1/security`                              | Session/API Key                     | Security score + events                                                                                     |
 | GET                       | `/api/v1/model-prices`                          | Session/API Key                     | Model pricing list                                                                                          |
-| GET                       | `/api/v1/free-models`                           | Session/API Key                     | Free LLM model catalog                                                                                      |
 | GET                       | `/api/v1/agent/usage`                           | Bearer (mnfst\_\*)                  | Token usage for the calling agent                                                                           |
 | GET                       | `/api/v1/agent/costs`                           | Bearer (mnfst\_\*)                  | Cost data for the calling agent                                                                             |
 | GET                       | `/api/v1/overview/*`                            | Session/API Key                     | Overview timeseries/breakdown sub-endpoints                                                                 |
 | GET                       | `/api/v1/providers` / `/api/v1/providers/usage` | Session/API Key                     | Connected provider list + usage                                                                             |
 | GET                       | `/api/v1/provider-analytics/*`                  | Session/API Key                     | Per-provider analytics                                                                                      |
 | GET                       | `/api/v1/errors/breakdown`                      | Session/API Key                     | Error breakdown analytics                                                                                   |
-| POST                      | `/api/v1/waitlist/autofix/claim`                | Public                              | Deprecated no-op compatibility route for older self-hosted versions                                         |
-| POST                      | `/api/v1/waitlist/pivot/claim`                  | Public                              | Closed pivot waiting-list claim, kept for older self-hosted versions; records origin (cloud/self-hosted)   |
 | GET/POST                  | `/api/v1/autofix/status` / `.../enable-all`     | Session/API Key                     | Workspace Autofix coverage + API-only fleet enable (no dashboard caller)                                    |
 | GET                       | `/api/v1/overview/autofix-*`                    | Session/API Key                     | Autofix analytics (stats, timeseries, per-agent/provider/model)                                             |
 | POST                      | `/api/v1/discovery/complete`                    | Session/API Key                     | Best-effort self-hosted discovery submission forwarded to Peacock                                           |
-| GET/POST/DELETE           | `/api/v1/internal/error-pages*`                 | Public (`x-internal-secret` header) | Custom error-page config (Peacock CMS push API)                                                             |
-| GET                       | `/api/v1/internal/crm-metrics*`                 | Public (`x-internal-secret` header) | **Cloud only.** Autofix-healed user cohort, pivot waitlist claims, and corporate signups, for the outreach CRM (`CRM_METRICS_SECRET`) |
 | GET/PUT/DELETE            | `/api/v1/agents/:agentName/enabled-providers*`  | Session/API Key                     | Per-agent provider enable/disable + impact preview                                                          |
 | GET/POST/PATCH/DELETE     | `/api/v1/notifications/*`                       | Session/API Key                     | Notification rules CRUD + email provider config                                                             |
 | GET/POST/PUT/PATCH/DELETE | `/api/v1/routing/:agentName/*`                  | Session/API Key                     | Routing config (tiers, providers, model-params, header-tiers, custom-providers, specificity, autofix, recording, etc.) |
@@ -446,7 +436,6 @@ Every resource belongs to a tenant; users only authenticate and (optionally) app
 | POST                      | `/api/v1/routing/subscription-providers`        | Bearer (mnfst\_\*)                  | Subscription provider config                                                                                |
 | GET                       | `/api/v1/setup/status`                          | Public                              | First-run setup status                                                                                      |
 | POST                      | `/api/v1/setup/admin`                           | Public                              | Create initial admin user                                                                                   |
-| GET                       | `/api/v1/public/error-pages*`                   | Public (opt-in)                     | Published error pages for the marketing site (controlled by `MANIFEST_PUBLIC_STATS`)                        |
 | GET                       | `/v1/models`                                    | Bearer (mnfst\_\*)                  | Available model list (proxy)                                                                                |
 | POST                      | `/v1/chat/completions`                          | Bearer (mnfst\_\*)                  | LLM proxy (OpenAI-compatible)                                                                               |
 | POST                      | `/v1/responses`                                 | Bearer (mnfst\_\*)                  | LLM proxy (OpenAI Responses API)                                                                            |
@@ -455,7 +444,6 @@ Every resource belongs to a tenant; users only authenticate and (optionally) app
 | ALL                       | `/otlp/v1/*`, `/v1/{traces,metrics,logs}`       | Public                              | Structured **410 Gone** — OTLP ingest is removed (`otlp-deprecated.controller.ts`)                          |
 | GET/POST/PATCH            | `/api/v1/playground/*`                          | Session/API Key                     | Playground runs (run, list, star, mark best)                                                                |
 | GET                       | `/api/v1/events`                                | Session                             | SSE real-time events                                                                                        |
-| GET                       | `/api/v1/github/stars`                          | Public                              | GitHub star count                                                                                           |
 | GET                       | `/api/v1/version`                               | Session/API Key                     | Running version + latest GitHub release for the self-hosted update badge (24h cache; off in cloud)          |
 | GET                       | `/api/v1/me`                                    | Session/API Key (tenant required)   | Identity probe for CLI/API clients: `{ tenantId, userId, authMethod, expiresAt }`; env `API_KEY` gets 401    |
 | POST                      | `/api/v1/cli/authorize`                         | Session only                        | Browser side of `mnfst login`: mints a PKCE-bound short-lived code                                          |
@@ -510,8 +498,6 @@ See `packages/backend/.env.example` for all variables. Key ones:
 - `MANIFEST_MODE` — `selfhosted` or `cloud` (default: `cloud`; auto-detected as `selfhosted` inside Docker via `/.dockerenv` or Podman via `/run/.containerenv`). Self-hosted mode allows custom-provider URLs with `http://` / private IPs. `local` is accepted as a legacy alias for `selfhosted`.
 - `MANIFEST_TELEMETRY_DISABLED` — Set `1` to opt out of anonymous telemetry (self-hosted only).
 - `MANIFEST_UPDATE_CHECK_DISABLED` — Set `1` to stop the self-hosted dashboard's daily "new version available" check against GitHub Releases (`GET /api/v1/version`, `version/` module). Separate from the telemetry opt-out: air-gapped installs want no outbound calls at all. Never runs in cloud mode.
-- `MANIFEST_PUBLIC_STATS` — Set `true` to serve the published error pages at `/api/v1/public/error-pages*` without auth (cloud-only marketing use). The name predates the removal of the aggregate usage endpoints; it is kept so existing deployments stay on.
-- `CRM_METRICS_SECRET` — Cloud only. Shared secret for `GET /api/v1/internal/crm-metrics*` (healed-user cohort; the response carries counts only, no provider breakdown — that join cost 1.1s against the route's 1.5s `statement_timeout` at a wide window), sent in the `x-internal-secret` header. Empty by default and anything under 32 chars counts as unset, because this is the only route that exports user email addresses across tenants. Separate from `ERROR_PAGE_PUSH_SECRET` on purpose: different consumer, different credential. Self-hosted installs never register the module and migration `1802200000000` skips its index there, so the feature leaves no trace on their schema or routes.
 - `TELEMETRY_ENDPOINT` — Where self-hosted installs POST the anonymous usage report. Default: `https://telemetry.manifest.build/v1/report`. See [Telemetry](#anonymous-usage-telemetry-self-hosted).
 - `DISCOVERY_ENDPOINT` — Optional override for the discovery submission endpoint. Default: `https://blue.manifest.build/v1/self-hosted/discovery`.
 - `SENTRY_DSN` / `SENTRY_ENVIRONMENT` / `SENTRY_RELEASE` — Opt-in Sentry error monitoring. Unset `SENTRY_DSN` disables Sentry entirely; `SENTRY_ENVIRONMENT` defaults to `NODE_ENV`. See [Error Monitoring](#error-monitoring-sentry-opt-in).
@@ -523,8 +509,8 @@ See `packages/backend/.env.example` for all variables. Key ones:
 - `AUTOFIX_GLOBAL_ENABLED` — Set `false` to disable Autofix for all agents (default on). Companions: `AUTOFIX_TIMEOUT_MS` (per heal call, default `10000`), `AUTOFIX_REPAIRABLE_STATUSES` (default `400,404,422`).
 - `AUTOFIX_REPORT_ALL_4XX` — Set `true` to stream an agent's request-side 4xx (4xx except 401/402/403/429) to Phoenix's `POST /api/heal/observe` as evidence, carrying the full request body. Serves no fix and creates no heal attempt; it only lets Phoenix see the body that failed. Wider than the heal path in scope (not limited to `AUTOFIX_REPAIRABLE_STATUSES`) but **gated to agents with Autofix on** — `AutofixService.isActiveFor()`, the same per-agent flag that healing checks. Turning Autofix on is what consents to sending failing requests to the healing service; the check fails closed. Off by default: a second, deployment-level switch on top. Manifest persists nothing; the body is secret-scrubbed, capped at 256 KB, batched, and dropped under backpressure. Skipped when Autofix already reported the same failure via `/api/heal`. See `routing/autofix/observation-reporter.ts`.
 - `REQUEST_RECORDING_STORAGE` / `REQUEST_RECORDING_FILESYSTEM_PATH` / `REQUEST_RECORDING_S3_*` / `REQUEST_RECORDING_RETENTION_DAYS` — Provider Attempt body recording storage + retention. See [Request Recording](#request-recording-provider-attempt-bodies).
-- `CREDITS_BASE_URL` / `CREDITS_MASTER_KEY` / `CREDITS_AUTO_PROVISION_ALLOWLIST` / `CREDITS_GEMINI_FREE_MAX_BUDGET` — Managed free providers (e.g. Gemini Free) via the credits gateway (default base URL `https://credits.manifest.build`; free-provider budget default `10`).
 - Thinker has no billing, plans or request quotas (#14): the `STRIPE_*`, `PLAN_LIMIT_*` and `PLAN_REQUEST_QUOTA_RESET_AT` variables are gone and ignored if set. The proxy no longer checks a plan limit per request and never answers 402 on its own; `DropBillingSchema1803200000000` drops the leftover billing tables and columns.
+- Thinker has no waitlist, CRM metrics feed, GitHub stars, free-models catalog, public error pages or managed Gemini Free (#15): `MANIFEST_PUBLIC_STATS`, `ERROR_PAGE_PUSH_SECRET`, `CRM_METRICS_SECRET` and `CREDITS_*` are gone and ignored if set, and so are their outbound calls (`credits.manifest.build`, `api.github.com`, the `mnfst/awesome-free-llm-apis` list on `raw.githubusercontent.com`). `DropSaasFeatureSchema1803300000000` drops `waitlist_claims`, `public_error_pages` and the cloud-only `IDX_requests_autofix_healed` index (with `lock_timeout` set), and deletes every `gemini-free` connection in `tenant_providers` together with its agent grants: the key only worked against `credits.manifest.build`. Request history keeps its `gemini-free` label, and routes that still name the provider resolve as unavailable and fall through to their fallbacks, as after a disconnect.
 
 ## Domain Terminology
 
diff --git a/packages/backend/.env.example b/packages/backend/.env.example
index 33679bf5..8071b2c8 100644
--- a/packages/backend/.env.example
+++ b/packages/backend/.env.example
@@ -74,15 +74,6 @@ BETTER_AUTH_URL=http://localhost:3001
 # MANIFEST_RATE_MAX_REQUESTS=200
 # MANIFEST_IP_RATE_MAX_REQUESTS=500
 
-# ── Managed free providers (optional) ───────────────
-# Managed gateway used by providers such as Gemini Free. A master key enables
-# automatic virtual-key provisioning; without it, users can still paste a
-# virtual key obtained through the provider's "Get API key" link.
-# CREDITS_BASE_URL=https://credits.manifest.build
-# CREDITS_MASTER_KEY=
-# CREDITS_AUTO_PROVISION_ALLOWLIST=  # Optional comma-separated user emails
-# CREDITS_GEMINI_FREE_MAX_BUDGET=10  # Budget in USD for each generated key
-
 # ── Email provider (optional, unified) ──────────────
 # Used for BOTH Better Auth transactional emails (login verification,
 # password reset) and threshold alert notifications when no per-user
@@ -144,8 +135,6 @@ BETTER_AUTH_URL=http://localhost:3001
 # ── Internal ────────────────────────────────────────
 # MANIFEST_FRONTEND_DIR=      # Custom path to frontend dist directory
 # MANIFEST_EMBEDDED=          # Set to skip auto-start (used by embedded server)
-# ERROR_PAGE_PUSH_SECRET=     # Shared secret for /api/v1/internal/error-pages (CMS push API)
-# CRM_METRICS_SECRET=         # Cloud only. Secret for /api/v1/internal/crm-metrics; min 32 chars, exports user emails
 
 # ── Release announcement email (Auto-fix / Doctor version) ──
 # The sending tool lives OUTSIDE this repo (sebconejo/autofix-email-to-subscribers);
diff --git a/packages/backend/src/app.module.ts b/packages/backend/src/app.module.ts
index d4149533..3efbffc3 100644
--- a/packages/backend/src/app.module.ts
+++ b/packages/backend/src/app.module.ts
@@ -25,18 +25,12 @@ import { RoutingModule } from './routing/routing.module';
 import { PlaygroundModule } from './playground/playground.module';
 import { CommonModule } from './common/common.module';
 import { SseModule } from './sse/sse.module';
-import { GithubModule } from './github/github.module';
 import { VersionModule } from './version/version.module';
-import { ErrorPagesModule } from './error-pages/error-pages.module';
 import { SetupModule } from './setup/setup.module';
-import { FreeModelsModule } from './free-models/free-models.module';
 import { TelemetryModule } from './telemetry/telemetry.module';
-import { WaitlistModule } from './waitlist/waitlist.module';
 import { DiscoveryModule } from './discovery/discovery.module';
-import { CrmMetricsModule } from './crm-metrics/crm-metrics.module';
 import { McpModule } from './mcp/mcp.module';
 import { mcpAvailability } from './auth/mcp-availability';
-import { isSelfHosted } from './common/utils/detect-self-hosted';
 import { DebugSentryController } from './sentry/debug-sentry.controller';
 
 const frontendPath = resolveFrontendDir();
@@ -69,12 +63,6 @@ const sentryProviders = sentryEnabled
 const sentryDebugControllers =
   sentryEnabled && process.env['NODE_ENV'] !== 'production' ? [DebugSentryController] : [];
 
-// The CRM metrics feed drives Cloud outreach. Leaving it unregistered on
-// self-hosted means the routes do not exist there at all, rather than existing
-// and answering 401 forever, and pairs with migration 1802200000000 skipping
-// its index so a self-hosted install sees no trace of this feature.
-const crmMetricsImports = isSelfHosted() ? [] : [CrmMetricsModule];
-
 // The remote MCP server is off on installs whose origin cannot carry an MCP
 // resource, and on installs that set MCP_ENABLED=false. Leaving the module
 // unregistered means `/api/v1/mcp` does not exist rather than answering an
@@ -110,17 +98,12 @@ const mcpImports = mcpAvailability().enabled ? [McpModule] : [];
     RoutingModule,
     PlaygroundModule,
     SseModule,
-    GithubModule,
     VersionModule,
-    ErrorPagesModule,
     SetupModule,
-    FreeModelsModule,
     TelemetryModule,
     BackfillModule,
-    WaitlistModule,
     DiscoveryModule,
     ...mcpImports,
-    ...crmMetricsImports,
   ],
   providers: [
     ...sentryProviders,
diff --git a/packages/backend/src/common/constants/managed-free-providers.spec.ts b/packages/backend/src/common/constants/managed-free-providers.spec.ts
deleted file mode 100644
index a0c08ec2..00000000
--- a/packages/backend/src/common/constants/managed-free-providers.spec.ts
+++ /dev/null
@@ -1,84 +0,0 @@
-import {
-  getManagedFreeLiteLlmAutoAllowlist,
-  getManagedFreeLiteLlmBaseUrl,
-  getManagedFreeLiteLlmMasterKey,
-  getManagedFreeLiteLlmMaxBudgetUsd,
-  getManagedFreeLiteLlmModelsUrl,
-  getManagedFreeProviderConfig,
-  isManagedFreeLiteLlmAutoEligible,
-} from './managed-free-providers';
-
-describe('managed free provider config', () => {
-  const env = process.env;
-
-  beforeEach(() => {
-    process.env = { ...env };
-    delete process.env['CREDITS_BASE_URL'];
-    delete process.env['CREDITS_MASTER_KEY'];
-    delete process.env['CREDITS_GEMINI_FREE_MAX_BUDGET'];
-    delete process.env['CREDITS_AUTO_PROVISION_ALLOWLIST'];
-  });
-
-  afterAll(() => {
-    process.env = env;
-  });
-
-  it('defaults to the managed gateway', () => {
-    expect(getManagedFreeLiteLlmBaseUrl()).toBe('https://credits.manifest.build');
-  });
-
-  it('strips trailing slashes from the base URL', () => {
-    process.env['CREDITS_BASE_URL'] = 'https://example.com/credits/';
-    expect(getManagedFreeLiteLlmBaseUrl()).toBe('https://example.com/credits');
-  });
-
-  it('defaults the maximum budget to 10', () => {
-    const config = getManagedFreeProviderConfig('gemini-free')!;
-    expect(getManagedFreeLiteLlmMaxBudgetUsd(config)).toBe(10);
-  });
-
-  it('parses valid budgets and rejects invalid values', () => {
-    const config = getManagedFreeProviderConfig('gemini-free')!;
-    process.env['CREDITS_GEMINI_FREE_MAX_BUDGET'] = '12.5';
-    expect(getManagedFreeLiteLlmMaxBudgetUsd(config)).toBe(12.5);
-    process.env['CREDITS_GEMINI_FREE_MAX_BUDGET'] = '-1';
-    expect(getManagedFreeLiteLlmMaxBudgetUsd(config)).toBe(10);
-    process.env['CREDITS_GEMINI_FREE_MAX_BUDGET'] = 'invalid';
-    expect(getManagedFreeLiteLlmMaxBudgetUsd(config)).toBe(10);
-  });
-
-  it('builds the model catalog URL from the configured gateway', () => {
-    process.env['CREDITS_BASE_URL'] = 'https://credits.test/';
-    expect(getManagedFreeLiteLlmModelsUrl()).toBe('https://credits.test/v1/models');
-  });
-
-  it('parses allowlisted emails', () => {
-    process.env['CREDITS_AUTO_PROVISION_ALLOWLIST'] = 'A@x.com, b@y.com ';
-    expect(getManagedFreeLiteLlmAutoAllowlist()).toEqual(['a@x.com', 'b@y.com']);
-  });
-
-  it('requires the master key for automatic provisioning', () => {
-    expect(isManagedFreeLiteLlmAutoEligible('a@x.com')).toBe(false);
-    process.env['CREDITS_MASTER_KEY'] = 'sk-test';
-    expect(isManagedFreeLiteLlmAutoEligible('a@x.com')).toBe(true);
-    expect(getManagedFreeLiteLlmMasterKey()).toBe('sk-test');
-  });
-
-  it('honors the allowlist when configured', () => {
-    process.env['CREDITS_MASTER_KEY'] = 'sk-test';
-    process.env['CREDITS_AUTO_PROVISION_ALLOWLIST'] = 'allowed@example.com';
-    expect(isManagedFreeLiteLlmAutoEligible('allowed@example.com')).toBe(true);
-    expect(isManagedFreeLiteLlmAutoEligible('other@example.com')).toBe(false);
-  });
-
-  it('keeps Gemini-specific values in one copyable config entry', () => {
-    expect(getManagedFreeProviderConfig('gemini-free')).toMatchObject({
-      id: 'gemini-free',
-      displayName: 'Gemini Free',
-      litellmModels: ['gemini/*'],
-      catalogModelIdPrefix: 'gemini-',
-      preferredModelIdPrefix: 'gemini/',
-      maxBudgetEnvVar: 'CREDITS_GEMINI_FREE_MAX_BUDGET',
-    });
-  });
-});
diff --git a/packages/backend/src/common/constants/managed-free-providers.ts b/packages/backend/src/common/constants/managed-free-providers.ts
deleted file mode 100644
index 78653450..00000000
--- a/packages/backend/src/common/constants/managed-free-providers.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-/**
- * Configuration for a Manifest-managed free provider backed by LiteLLM.
- *
- * To add another free provider, copy the Gemini Free entry below and change
- * its identity, LiteLLM model group, catalog prefix, filter, and budget env.
- * Provisioning, discovery, routing, and connection limits consume this config.
- */
-export interface ManagedFreeProviderConfig {
-  id: string;
-  displayName: string;
-  litellmModels: readonly string[];
-  catalogModelIdPrefix: string;
-  preferredModelIdPrefix: string;
-  nonChatModelPattern: RegExp;
-  maxBudgetEnvVar: string;
-}
-
-export const MANAGED_FREE_PROVIDER_CONFIGS: readonly ManagedFreeProviderConfig[] = [
-  {
-    id: 'gemini-free',
-    displayName: 'Gemini Free',
-    litellmModels: ['gemini/*'],
-    catalogModelIdPrefix: 'gemini-',
-    preferredModelIdPrefix: 'gemini/',
-    nonChatModelPattern:
-      /(?:\*|(?:^|\/)aqs-|nano-banana|deep-research|computer-use|lyria|veo-|native-audio|audio-preview|image-generation|(?:^|\/)imagen|-image(?:$|-|\/)|live-preview|(?:^|\/|-)live-|embedding|robotics|tts|gemini-1\.5|gemini-2\.0-flash-001|gemini-2\.0-flash-lite|flash-lite-preview-\d|\/gemini-exp-|-exp-\d|learnlm|gemma-|omni-flash|customtools)/i,
-    maxBudgetEnvVar: 'CREDITS_GEMINI_FREE_MAX_BUDGET',
-  },
-];
-
-export const MANAGED_FREE_PROVIDER_BY_ID: ReadonlyMap<string, ManagedFreeProviderConfig> = new Map(
-  MANAGED_FREE_PROVIDER_CONFIGS.map((config) => [config.id, config]),
-);
-
-export function getManagedFreeProviderConfig(
-  providerId: string,
-): ManagedFreeProviderConfig | undefined {
-  return MANAGED_FREE_PROVIDER_BY_ID.get(providerId.toLowerCase());
-}
-
-const DEFAULT_CREDITS_BASE_URL = 'https://credits.manifest.build';
-const DEFAULT_MAX_BUDGET_USD = 10;
-
-export function getManagedFreeLiteLlmBaseUrl(): string {
-  const raw = process.env['CREDITS_BASE_URL']?.trim() || DEFAULT_CREDITS_BASE_URL;
-  return raw.replace(/\/+$/, '');
-}
-
-export function getManagedFreeLiteLlmMasterKey(): string | null {
-  const key = process.env['CREDITS_MASTER_KEY']?.trim();
-  return key && key.length > 0 ? key : null;
-}
-
-export function getManagedFreeLiteLlmMaxBudgetUsd(config: ManagedFreeProviderConfig): number {
-  const raw = process.env[config.maxBudgetEnvVar]?.trim();
-  if (!raw) return DEFAULT_MAX_BUDGET_USD;
-  const value = Number(raw);
-  return Number.isFinite(value) && value >= 0 ? value : DEFAULT_MAX_BUDGET_USD;
-}
-
-/** Comma-separated emails. Empty means any user is eligible when a master key is configured. */
-export function getManagedFreeLiteLlmAutoAllowlist(): string[] {
-  const raw = process.env['CREDITS_AUTO_PROVISION_ALLOWLIST']?.trim() ?? '';
-  if (!raw) return [];
-  return raw
-    .split(',')
-    .map((email) => email.trim().toLowerCase())
-    .filter(Boolean);
-}
-
-export function isManagedFreeLiteLlmAutoEligible(email: string | null | undefined): boolean {
-  if (!getManagedFreeLiteLlmMasterKey()) return false;
-  const allowlist = getManagedFreeLiteLlmAutoAllowlist();
-  if (allowlist.length === 0) return true;
-  if (!email) return false;
-  return allowlist.includes(email.trim().toLowerCase());
-}
-
-export function getManagedFreeLiteLlmModelsUrl(): string {
-  return `${getManagedFreeLiteLlmBaseUrl()}/v1/models`;
-}
-
-export function getManagedFreeLiteLlmKeyGenerateUrl(): string {
-  return `${getManagedFreeLiteLlmBaseUrl()}/key/generate`;
-}
diff --git a/packages/backend/src/common/utils/dashboard-url.ts b/packages/backend/src/common/utils/dashboard-url.ts
index 3125e50e..4ea7e6f9 100644
--- a/packages/backend/src/common/utils/dashboard-url.ts
+++ b/packages/backend/src/common/utils/dashboard-url.ts
@@ -1,4 +1,4 @@
-/** Dashboard origin only; API and waitlist destinations are configured separately. */
+/** Dashboard origin only; API destinations are configured separately. */
 export const DEFAULT_DASHBOARD_URL = 'https://app.manifest.build';
 
 /** Emails need absolute URLs because they are read outside the dashboard. */
diff --git a/packages/backend/src/config/app.config.ts b/packages/backend/src/config/app.config.ts
index 679ddd33..6184db48 100644
--- a/packages/backend/src/config/app.config.ts
+++ b/packages/backend/src/config/app.config.ts
@@ -52,10 +52,6 @@ export const appConfig = registerAs('app', () => ({
   // routing during the post-SIGTERM deregistration lag (the rolling-deploy 5xx
   // spike). Must be shorter than Railway's `drainingSeconds`. 0 disables it.
   shutdownDrainMs: Number(process.env['SHUTDOWN_DRAIN_MS'] ?? 10000),
-  // When true, /api/v1/public/error-pages serves the published error pages
-  // without auth. Off by default; only Manifest Cloud's marketing site uses it.
-  // The variable keeps its historical name so existing deployments stay on.
-  publicErrorPagesEnabled: process.env['MANIFEST_PUBLIC_STATS'] === 'true',
   // Optional instance-wide override. When unset, request recordings are kept
   // for the 365-day default.
   requestRecordingRetentionDays: optionalPositiveInteger(
@@ -72,18 +68,6 @@ export const appConfig = registerAs('app', () => ({
   requestRecordingS3AccessKeyId: process.env['REQUEST_RECORDING_S3_ACCESS_KEY_ID'] ?? '',
   requestRecordingS3SecretAccessKey: process.env['REQUEST_RECORDING_S3_SECRET_ACCESS_KEY'] ?? '',
   requestRecordingS3ForcePathStyle: process.env['REQUEST_RECORDING_S3_FORCE_PATH_STYLE'] === 'true',
-  // Shared secret guarding the internal error-page push endpoint
-  // (/api/v1/internal/error-pages). The Peacock CMS sends it in the
-  // `x-internal-secret` header to publish/unpublish curated error pages.
-  // Empty by default — the endpoint rejects all writes until it is set.
-  errorPagePushSecret: process.env['ERROR_PAGE_PUSH_SECRET'] ?? '',
-  // Shared secret guarding the internal CRM metrics feed
-  // (/api/v1/internal/crm-metrics), which the outreach CRM polls daily. Sent in
-  // the `x-internal-secret` header. Deliberately separate from
-  // errorPagePushSecret: different consumer, different credential. Empty by
-  // default, and anything shorter than 32 chars counts as unset — this route
-  // exports user email addresses across tenants.
-  crmMetricsSecret: process.env['CRM_METRICS_SECRET'] ?? '',
   // Sliding lifetime (days) of a CLI-minted management PAT. Every successful
   // authentication pushes the key's `expires_at` this far into the future, so
   // an active CLI never has to re-login and an abandoned one lapses.
diff --git a/packages/backend/src/cors-csp-config.spec.ts b/packages/backend/src/cors-csp-config.spec.ts
index 1054c400..b3e28ac9 100644
--- a/packages/backend/src/cors-csp-config.spec.ts
+++ b/packages/backend/src/cors-csp-config.spec.ts
@@ -270,33 +270,3 @@ describe('applyPrivateNetworkAllow', () => {
     expect(setHeader).not.toHaveBeenCalled();
   });
 });
-
-describe('applyPivotClaimCors', () => {
-  const { applyPivotClaimCors, PIVOT_CLAIM_PATH } = jest.requireActual('./cors-csp-config');
-
-  function collect() {
-    const headers: Record<string, string> = {};
-    return { headers, set: (name: string, value: string) => (headers[name] = value) };
-  }
-
-  it('ignores other routes entirely', () => {
-    const { headers, set } = collect();
-    expect(applyPivotClaimCors({ method: 'POST', path: '/api/v1/overview' }, set)).toBe(false);
-    expect(headers).toEqual({});
-  });
-
-  it('opens CORS on the claim POST without ending the response', () => {
-    const { headers, set } = collect();
-    expect(applyPivotClaimCors({ method: 'POST', path: PIVOT_CLAIM_PATH }, set)).toBe(false);
-    expect(headers['Access-Control-Allow-Origin']).toBe('*');
-    expect(headers['Access-Control-Allow-Methods']).toBe('POST, OPTIONS');
-    expect(headers['Access-Control-Allow-Headers']).toBe('Content-Type');
-  });
-
-  it('fully answers the claim preflight', () => {
-    const { headers, set } = collect();
-    expect(applyPivotClaimCors({ method: 'OPTIONS', path: PIVOT_CLAIM_PATH }, set)).toBe(true);
-    expect(headers['Access-Control-Allow-Origin']).toBe('*');
-    expect(headers['Access-Control-Max-Age']).toBe('600');
-  });
-});
diff --git a/packages/backend/src/cors-csp-config.ts b/packages/backend/src/cors-csp-config.ts
index 6c82ec46..0673ff87 100644
--- a/packages/backend/src/cors-csp-config.ts
+++ b/packages/backend/src/cors-csp-config.ts
@@ -182,39 +182,3 @@ export function applyPrivateNetworkAllow(
   if (typeof origin !== 'string' || !allowedOrigins.includes(origin)) return;
   setHeader('Access-Control-Allow-Private-Network', 'true');
 }
-
-/** Route path of the public pivot waiting-list claim. */
-export const PIVOT_CLAIM_PATH = '/api/v1/waitlist/pivot/claim';
-
-export interface PivotCorsRequest {
-  method: string;
-  path: string;
-}
-
-/**
- * Open CORS for the pivot waiting-list claim only. Self-hosted dashboards on
- * versions that still ship the waiting-list card post the claim straight
- * from the browser, so any origin must be allowed on
- * this one route. Safe because no credentials ride along (`fetch` sends none
- * cross-origin by default and the allow-list CORS runs with
- * `credentials: false`) and the route only accepts an email. Returns true
- * when it fully answered a preflight, so the caller ends the response.
- */
-export function applyPivotClaimCors(
-  req: PivotCorsRequest,
-  setHeader: (name: string, value: string) => void,
-): boolean {
-  if (req.path !== PIVOT_CLAIM_PATH) return false;
-  setHeader('Access-Control-Allow-Origin', '*');
-  setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
-  setHeader('Access-Control-Allow-Headers', 'Content-Type');
-  setHeader('Access-Control-Max-Age', '600');
-  return req.method === 'OPTIONS';
-}
-
-/**
- * Origin of the cloud pivot claim endpoint. Production self-hosted dashboards
- * post the claim cross-origin from the browser, so the CSP `connect-src`
- * must allow it — CORS alone is not enough, the CSP blocks the fetch first.
- */
-export const PIVOT_CLAIM_CLOUD_ORIGIN = 'https://app.manifest.build';
diff --git a/packages/backend/src/crm-metrics/crm-metrics.filters.spec.ts b/packages/backend/src/crm-metrics/crm-metrics.filters.spec.ts
deleted file mode 100644
index 1540736c..00000000
--- a/packages/backend/src/crm-metrics/crm-metrics.filters.spec.ts
+++ /dev/null
@@ -1,301 +0,0 @@
-import {
-  domainOf,
-  isConsumerEmail,
-  isCorporateSignupEmail,
-  isExcludedEmail,
-  isMachineGeneratedDomain,
-  isSignupCluster,
-} from './crm-metrics.filters';
-
-describe('isExcludedEmail', () => {
-  it('keeps an ordinary user address', () => {
-    expect(isExcludedEmail('matheus@example.com')).toBe(false);
-    expect(isExcludedEmail('someone@gmail.com')).toBe(false);
-  });
-
-  it('excludes our own domains', () => {
-    expect(isExcludedEmail('bruno@buddyweb.fr')).toBe(true);
-    expect(isExcludedEmail('hello@manifest.build')).toBe(true);
-    expect(isExcludedEmail('x@mnfstinc.com')).toBe(true);
-  });
-
-  it('excludes team members signed up on a personal address', () => {
-    expect(isExcludedEmail('sebastien.conejo@gmail.com')).toBe(true);
-  });
-
-  it('excludes disposable and alias providers', () => {
-    expect(isExcludedEmail('improving_poison241@dralias.com')).toBe(true);
-    expect(isExcludedEmail('app.manifest.build@cryptidcloud.org')).toBe(true);
-    expect(isExcludedEmail('a@slmail.me')).toBe(true);
-  });
-
-  it('excludes shared role inboxes', () => {
-    expect(isExcludedEmail('info@realcompany.com')).toBe(true);
-    expect(isExcludedEmail('no-reply@realcompany.com')).toBe(true);
-    expect(isExcludedEmail('test@realcompany.com')).toBe(true);
-  });
-
-  it('matches a role inbox on the whole local part, not as a prefix', () => {
-    expect(isExcludedEmail('information@realcompany.com')).toBe(false);
-    expect(isExcludedEmail('admin.jones@realcompany.com')).toBe(false);
-    expect(isExcludedEmail('contact-us@realcompany.com')).toBe(false);
-  });
-
-  it('treats subdomains of a junk domain as junk', () => {
-    expect(isExcludedEmail('a@mail.dralias.com')).toBe(true);
-  });
-
-  it('does not match a domain that merely ends with the same letters', () => {
-    expect(isExcludedEmail('a@notdralias.com')).toBe(false);
-    expect(isExcludedEmail('a@notmanifest.build')).toBe(false);
-  });
-
-  it('normalises case and surrounding whitespace before matching', () => {
-    expect(isExcludedEmail('  Bruno@BuddyWeb.FR  ')).toBe(true);
-    expect(isExcludedEmail('INFO@Example.com')).toBe(true);
-  });
-
-  it('excludes anything that is not a routable address', () => {
-    expect(isExcludedEmail('no-at-sign')).toBe(true);
-    expect(isExcludedEmail('@nolocalpart.com')).toBe(true);
-    expect(isExcludedEmail('nodomain@')).toBe(true);
-    expect(isExcludedEmail('')).toBe(true);
-  });
-
-  it('uses the last @ so a quoted local part cannot smuggle a domain in', () => {
-    expect(isExcludedEmail('user@notjunk@dralias.com')).toBe(true);
-  });
-});
-
-describe('domainOf', () => {
-  it('returns the lowercased domain part', () => {
-    expect(domainOf('  Ada@Example.COM ')).toBe('example.com');
-  });
-
-  it('returns empty for an unroutable address', () => {
-    expect(domainOf('no-at-sign')).toBe('');
-    expect(domainOf('@leading.com')).toBe('');
-    expect(domainOf('trailing@')).toBe('');
-  });
-});
-
-describe('isConsumerEmail', () => {
-  it('flags mainstream consumer mailboxes', () => {
-    expect(isConsumerEmail('ada@gmail.com')).toBe(true);
-    expect(isConsumerEmail('ada@YAHOO.co.uk')).toBe(true);
-    expect(isConsumerEmail('ada@qq.com')).toBe(true);
-  });
-
-  it('flags privacy relays that read as custom domains', () => {
-    expect(isConsumerEmail('ada@duck.com')).toBe(true);
-    expect(isConsumerEmail('ada@pm.me')).toBe(true);
-    expect(isConsumerEmail('ada@simplelogin.io')).toBe(true);
-  });
-
-  it('treats subdomains of a consumer domain as consumer', () => {
-    expect(isConsumerEmail('ada@mail.duck.com')).toBe(true);
-  });
-
-  it('does not flag a domain that merely ends with the same letters', () => {
-    expect(isConsumerEmail('ada@notgmail.com')).toBe(false);
-  });
-
-  it('flags an unroutable address', () => {
-    expect(isConsumerEmail('nonsense')).toBe(true);
-  });
-
-  it('leaves real company domains alone', () => {
-    expect(isConsumerEmail('ada@stripe.com')).toBe(false);
-  });
-
-  describe('brand families', () => {
-    // Every one of these reached the live feed on 2026-09-14 because the
-    // exact-match list did not enumerate them.
-    it.each([
-      'yahoo.de',
-      'yahoo.com.br',
-      'yahoo.co.jp',
-      'outlook.de',
-      'hotmail.de',
-      'live.de',
-      'bk.ru',
-      'list.ru',
-      'inbox.ru',
-      'tuta.io',
-      'tutamail.com',
-      'tutanota.com',
-      'disroot.org',
-      'gmx.at',
-    ])('flags %s as a consumer country variant', (domain) => {
-      expect(isConsumerEmail(`ada@${domain}`)).toBe(true);
-    });
-
-    it('does not mistake a corporate mail subdomain for the mail.com family', () => {
-      // `mail.acme.com`: second label is a brand, not a 2-3 letter TLD.
-      expect(isConsumerEmail('ada@mail.acme.com')).toBe(false);
-    });
-
-    it('catches a consumer brand behind a subdomain', () => {
-      expect(isConsumerEmail('ada@mail.yahoo.de')).toBe(true);
-      expect(isConsumerEmail('ada@imap.gmx.net')).toBe(true);
-    });
-
-    it('keeps companies whose name is also a consumer mail brand', () => {
-      // Consumer on their mail TLD, corporate everywhere else.
-      expect(isConsumerEmail('ada@comcast.net')).toBe(true);
-      expect(isConsumerEmail('ada@comcast.com')).toBe(false);
-      expect(isConsumerEmail('ada@orange.fr')).toBe(true);
-      expect(isConsumerEmail('ada@orange.com')).toBe(false);
-      expect(isConsumerEmail('ada@web.de')).toBe(true);
-      expect(isConsumerEmail('ada@web.com')).toBe(false);
-      expect(isConsumerEmail('ada@free.fr')).toBe(true);
-      expect(isConsumerEmail('ada@free.com')).toBe(false);
-    });
-
-    it('still catches the mail.com family through the exact list', () => {
-      expect(isConsumerEmail('ada@mail.com')).toBe(true);
-      expect(isConsumerEmail('ada@engineer.com')).toBe(true);
-      expect(isConsumerEmail('ada@bk.ru')).toBe(true);
-    });
-
-    it('does not flag a company whose name merely starts with a brand word', () => {
-      expect(isConsumerEmail('ada@livestorm.co')).toBe(false);
-      expect(isConsumerEmail('ada@freshmail.io')).toBe(false);
-      expect(isConsumerEmail('ada@webflow.com')).toBe(false);
-    });
-  });
-
-  describe('relays and disposables', () => {
-    it.each([
-      'privaterelay.appleid.com',
-      'passinbox.com',
-      'passmail.net',
-      'mozmail.com',
-      'sharklasers.com',
-      'yopmail.com',
-      'harakirimail.com',
-      'agentmail.to',
-    ])('flags %s', (domain) => {
-      expect(isConsumerEmail(`ada@${domain}`)).toBe(true);
-    });
-  });
-
-  describe('universities', () => {
-    it.each([
-      'berkeley.edu',
-      'csu.fullerton.edu',
-      'iit.du.ac.bd',
-      'diu.edu.bd',
-      'alfalah.ac.id',
-      'blps.tyc.edu.tw',
-      'pace.edu.in',
-      'campus.technion.ac.il',
-    ])('flags %s as academic', (domain) => {
-      expect(isConsumerEmail(`ada@${domain}`)).toBe(true);
-    });
-
-    it('does not flag a company that happens to contain "edu"', () => {
-      expect(isConsumerEmail('ada@educative.io')).toBe(false);
-      expect(isConsumerEmail('ada@procedure.com')).toBe(false);
-    });
-
-    it('only treats a two-letter country code as academic', () => {
-      // `edu` / `ac` followed by a generic 3-letter TLD is a company, not a
-      // university. Two letters is a country code by definition, so `.ac.uk`
-      // and `.edu.bd` stay academic.
-      expect(isConsumerEmail('ada@company.edu.com')).toBe(false);
-      expect(isConsumerEmail('ada@startup.ac.dev')).toBe(false);
-      expect(isConsumerEmail('ada@startup.ac.app')).toBe(false);
-    });
-  });
-});
-
-describe('isCorporateSignupEmail', () => {
-  it('admits a company address', () => {
-    expect(isCorporateSignupEmail('ada@stripe.com')).toBe(true);
-  });
-
-  it('rejects consumer mail', () => {
-    expect(isCorporateSignupEmail('ada@gmail.com')).toBe(false);
-  });
-
-  it('rejects addresses the shared exclusion list already covers', () => {
-    expect(isCorporateSignupEmail('support@stripe.com')).toBe(false);
-    expect(isCorporateSignupEmail('ada@manifest.build')).toBe(false);
-    expect(isCorporateSignupEmail('ada@atomicmail.io')).toBe(false);
-  });
-});
-
-describe('isSignupCluster', () => {
-  const at = (iso: string, has_traffic = false) => ({ signed_up_at: iso, has_traffic });
-
-  it('flags three trafficless signups inside a month', () => {
-    expect(
-      isSignupCluster([
-        at('2026-03-01T00:00:00.000Z'),
-        at('2026-03-10T00:00:00.000Z'),
-        at('2026-03-18T00:00:00.000Z'),
-      ]),
-    ).toBe(true);
-  });
-
-  it('spares a domain below the signup threshold', () => {
-    expect(isSignupCluster([at('2026-03-01T00:00:00.000Z'), at('2026-03-02T00:00:00.000Z')])).toBe(
-      false,
-    );
-  });
-
-  it('spares a domain where anyone ever sent a request', () => {
-    expect(
-      isSignupCluster([
-        at('2026-03-01T00:00:00.000Z'),
-        at('2026-03-10T00:00:00.000Z'),
-        at('2026-03-18T00:00:00.000Z', true),
-      ]),
-    ).toBe(false);
-  });
-
-  it('spares a team that trickled in over more than a month', () => {
-    expect(
-      isSignupCluster([
-        at('2026-01-01T00:00:00.000Z'),
-        at('2026-03-10T00:00:00.000Z'),
-        at('2026-06-18T00:00:00.000Z'),
-      ]),
-    ).toBe(false);
-  });
-
-  it('judges the span regardless of row order', () => {
-    expect(
-      isSignupCluster([
-        at('2026-06-18T00:00:00.000Z'),
-        at('2026-01-01T00:00:00.000Z'),
-        at('2026-03-10T00:00:00.000Z'),
-      ]),
-    ).toBe(false);
-  });
-});
-
-describe('isMachineGeneratedDomain', () => {
-  it('flags a domain where every local part is letters then digits', () => {
-    // aratrin.com and lidugw.com on the first live dry run.
-    expect(isMachineGeneratedDomain(['vatiy14692', 'xiyese3594'])).toBe(true);
-    expect(isMachineGeneratedDomain(['lidosej357', 'safoh51835'])).toBe(true);
-    expect(isMachineGeneratedDomain(['gimade8897', 'taribe8832', 'wipejet728'])).toBe(true);
-  });
-
-  it('never judges a single address', () => {
-    expect(isMachineGeneratedDomain(['john1985'])).toBe(false);
-  });
-
-  it('spares a domain where anyone has a human-looking address', () => {
-    expect(isMachineGeneratedDomain(['john1985', 'ada.lovelace'])).toBe(false);
-    expect(isMachineGeneratedDomain(['vatiy14692', 'grace'])).toBe(false);
-  });
-
-  it('does not match shapes outside the generator pattern', () => {
-    expect(isMachineGeneratedDomain(['ab12', 'cd34'])).toBe(false); // too short
-    expect(isMachineGeneratedDomain(['a.b1234', 'c-d5678'])).toBe(false); // punctuation
-    expect(isMachineGeneratedDomain(['1234abcd', '5678efgh'])).toBe(false); // digits first
-  });
-});
diff --git a/packages/backend/src/crm-metrics/crm-metrics.filters.ts b/packages/backend/src/crm-metrics/crm-metrics.filters.ts
deleted file mode 100644
index e2bc2bc8..00000000
--- a/packages/backend/src/crm-metrics/crm-metrics.filters.ts
+++ /dev/null
@@ -1,349 +0,0 @@
-/**
- * Deliverability filtering for the CRM feed.
- *
- * These run here rather than in the CRM so every consumer inherits them: an
- * address excluded once is excluded everywhere, and the rules stay under test.
- *
- * The known bot-signup cluster (gibberish names on scraped corporate domains)
- * deliberately has no rule. It never produced a successful heal, so the cohort
- * predicate already excludes it — a domain list would be dead code that rots.
- */
-
-/** Our own addresses. Emailing ourselves about our own launch is noise. */
-const INTERNAL_DOMAINS = ['manifest.build', 'buddyweb.fr', 'mnfstinc.com', 'mnfstinc.dev'];
-
-/** Team members signed up on a personal address, so the domain rule misses them. */
-const INTERNAL_EMAILS = ['sebastien.conejo@gmail.com'];
-
-/**
- * Disposable/alias providers. Mirrors the list the CRM outreach function
- * already carries, so both sides agree on what counts as junk.
- */
-const JUNK_DOMAINS = [
-  'slmail.me',
-  'atomicmail.io',
-  'paytrust.cc',
-  'rapplo.com',
-  'joystill.com',
-  'abrdns.com',
-  'cryptidcloud.org',
-  'dralias.com',
-  'mail.cfw.262019.xyz',
-];
-
-/** Shared inboxes: nobody in particular reads these, and they skew reply rates. */
-const ROLE_LOCAL_PARTS = [
-  'info',
-  'admin',
-  'contact',
-  'support',
-  'sales',
-  'marketing',
-  'office',
-  'team',
-  'noreply',
-  'no-reply',
-  'test',
-];
-
-/**
- * True when we should not email this address.
- *
- * Subdomains of a junk domain count as junk (`x.dralias.com`), but a domain
- * that merely ends with the same letters does not (`notdralias.com`).
- */
-export function isExcludedEmail(email: string): boolean {
-  const normalized = email.trim().toLowerCase();
-  const at = normalized.lastIndexOf('@');
-  // No '@' at all, or an empty local part / domain: not a routable address.
-  if (at <= 0 || at === normalized.length - 1) return true;
-
-  const local = normalized.slice(0, at);
-  const domain = normalized.slice(at + 1);
-
-  if (INTERNAL_EMAILS.includes(normalized)) return true;
-  if (matchesDomain(domain, INTERNAL_DOMAINS)) return true;
-  if (matchesDomain(domain, JUNK_DOMAINS)) return true;
-  return ROLE_LOCAL_PARTS.includes(local);
-}
-
-function matchesDomain(domain: string, list: string[]): boolean {
-  return list.some((entry) => domain === entry || domain.endsWith(`.${entry}`));
-}
-
-/**
- * Consumer mail and privacy-relay providers.
- *
- * Separate from JUNK_DOMAINS because these addresses are perfectly real — the
- * healed-user feed emails plenty of them. They are excluded from the *signup*
- * feed only, where the whole premise is "a corporate domain implies a team
- * behind it". A gmail.com signup carries no such signal.
- *
- * The relay entries matter more than the obvious freemail ones: duck.com,
- * pm.me and simplelogin addresses read as custom domains to a naive
- * `not freemail` check, and were the largest "corporate" domains in the
- * database by signup count until they were listed here.
- */
-const CONSUMER_DOMAINS = [
-  'gmail.com',
-  'googlemail.com',
-  'outlook.com',
-  'outlook.fr',
-  'hotmail.com',
-  'hotmail.fr',
-  'hotmail.co.uk',
-  'live.com',
-  'live.fr',
-  'msn.com',
-  'yahoo.com',
-  'yahoo.co.uk',
-  'yahoo.fr',
-  'ymail.com',
-  'aol.com',
-  'icloud.com',
-  'me.com',
-  'mac.com',
-  'proton.me',
-  'protonmail.com',
-  'pm.me',
-  'duck.com',
-  'simplelogin.com',
-  'simplelogin.io',
-  'anonaddy.com',
-  'posteo.de',
-  'gmx.com',
-  'gmx.de',
-  'gmx.net',
-  'web.de',
-  't-online.de',
-  'free.fr',
-  'orange.fr',
-  'wanadoo.fr',
-  'laposte.net',
-  'sfr.fr',
-  'comcast.net',
-  'qq.com',
-  '163.com',
-  '126.com',
-  'foxmail.com',
-  'sina.com',
-  'naver.com',
-  'daum.net',
-  'yandex.ru',
-  'yandex.com',
-  'mail.com',
-  'mail.ru',
-  'rambler.ru',
-  'seznam.cz',
-  'zoho.com',
-  'fastmail.com',
-  'hey.com',
-  'engineer.com',
-  'consultant.com',
-  'usa.com',
-  'europe.com',
-  'bk.ru',
-  'list.ru',
-  'inbox.ru',
-  'inbox.lv',
-  'email.com',
-  'email.cz',
-  'example.com',
-  'test.com',
-];
-
-/**
- * Consumer providers with country variants, matched as a family.
- *
- * An exact list cannot keep up: the first live run of the signup feed let
- * through yahoo.de, yahoo.com.br, outlook.de, bk.ru, tuta.io and thirty more
- * that were simply not enumerated. The brand followed by a 2-3 letter TLD and
- * an optional two-letter country suffix covers the whole family — `yahoo.de`,
- * `yahoo.com.br`, `yahoo.co.jp` — without touching `mail.acme.com`, whose
- * second label is not a TLD.
- *
- * Matched at a label boundary, not only at the start, so `mail.yahoo.de` and
- * `imap.gmx.net` count too.
- *
- * Only brands that are consumer mail on *every* TLD belong here. Names that
- * are also a real company's domain — comcast.com, orange.com, web.com,
- * free.fr vs free.com, mail.com vs mail.acme.com — stay in the exact list
- * for their consumer TLDs, so a corporate signup at orange.com is kept.
- */
-const CONSUMER_FAMILIES = new RegExp(
-  '(?:^|\\.)(?:' +
-    [
-      'gmail',
-      'googlemail',
-      'yahoo',
-      'ymail',
-      'rocketmail',
-      'outlook',
-      'hotmail',
-      'live',
-      'msn',
-      'aol',
-      'icloud',
-      'proton',
-      'protonmail',
-      'tuta',
-      'tutanota',
-      'tutamail',
-      'gmx',
-      'yandex',
-      'rambler',
-      'disroot',
-      'posteo',
-      'mailbox',
-      'riseup',
-      'zoho',
-      'fastmail',
-      'qq',
-      'foxmail',
-      'naver',
-      'daum',
-      'seznam',
-      'laposte',
-      'wanadoo',
-    ].join('|') +
-    ')\\.[a-z]{2,3}(?:\\.[a-z]{2})?$',
-);
-
-/**
- * Privacy relays and disposable inboxes seen in production signups. Real
- * people, but the address is not an organisation's and often not even a
- * lasting one. Kept separate from CONSUMER_DOMAINS so the two lists say what
- * they are.
- */
-const RELAY_AND_DISPOSABLE_DOMAINS = [
-  'privaterelay.appleid.com',
-  'passinbox.com',
-  'passmail.net',
-  'passmail.com',
-  'passfwd.com',
-  'mozmail.com',
-  'relay.firefox.com',
-  'addy.io',
-  'anonaddy.me',
-  'simplelogin.co',
-  'simplelogin.fr',
-  'startmail.com',
-  'sharklasers.com',
-  'guerrillamail.com',
-  'guerrillamail.info',
-  'grr.la',
-  'yopmail.com',
-  'harakirimail.com',
-  'tempmail10.com',
-  'mailinator.com',
-  'agentmail.to',
-  'maildrop.cc',
-  'getnada.com',
-  'dispostable.com',
-  'trashmail.com',
-  '10minutemail.com',
-];
-
-/**
- * Universities. `.edu`, `.edu.xx` and `.ac.xx` cover every national scheme
- * seen in production (Bangladesh, India, Korea, Taiwan, the UK, Indonesia,
- * Vietnam, Brazil…). A student is a real person with a real address, but not
- * the "team behind a corporate domain" this feed exists to find.
- *
- * The country part is exactly two letters. `{2,3}` would also take
- * `company.edu.com` and `startup.ac.dev`, which are companies.
- */
-const ACADEMIC_DOMAIN = /(?:^|\.)(?:edu|ac)\.[a-z]{2}$|\.edu$/;
-
-/** Signups on one domain inside this span, with no traffic, look scripted. */
-const CLUSTER_WINDOW_MS = 30 * 86_400_000;
-
-/** Fewer than this on a domain is a small team, not a cluster. */
-const CLUSTER_MIN_SIGNUPS = 3;
-
-/** The domain part of an address, lowercased; empty when unroutable. */
-export function domainOf(email: string): string {
-  const normalized = email.trim().toLowerCase();
-  const at = normalized.lastIndexOf('@');
-  if (at <= 0 || at === normalized.length - 1) return '';
-  return normalized.slice(at + 1);
-}
-
-/**
- * True when the address does not belong to an organisation: a consumer
- * mailbox (exact list or brand family), a privacy relay or disposable inbox,
- * or a university.
- *
- * Subdomains count (`mail.duck.com`), matching `isExcludedEmail`.
- */
-export function isConsumerEmail(email: string): boolean {
-  const domain = domainOf(email);
-  if (!domain) return true;
-  return (
-    matchesDomain(domain, CONSUMER_DOMAINS) ||
-    matchesDomain(domain, RELAY_AND_DISPOSABLE_DOMAINS) ||
-    CONSUMER_FAMILIES.test(domain) ||
-    ACADEMIC_DOMAIN.test(domain)
-  );
-}
-
-/**
- * The signup feed's admission rule: a routable address, on a domain that looks
- * like an organisation, that we are not already excluding for other reasons.
- */
-export function isCorporateSignupEmail(email: string): boolean {
-  return !isExcludedEmail(email) && !isConsumerEmail(email);
-}
-
-/** One signup, reduced to what the cluster rule needs to judge a domain. */
-export interface ClusterCandidate {
-  signed_up_at: string;
-  has_traffic: boolean;
-}
-
-/**
- * True when a domain's signups look automated rather than like a real team.
- *
- * Three or more accounts, created inside a month, none of which ever sent a
- * request. A genuine team trickles in over quarters and at least one of them
- * points something at the gateway; the scraped-address clusters we have seen
- * arrive in a burst and never call the API.
- *
- * Any traffic at all clears the whole domain: a real user among them means the
- * burst was a launch, not a script.
- */
-export function isSignupCluster(signups: ClusterCandidate[]): boolean {
-  if (signups.length < CLUSTER_MIN_SIGNUPS) return false;
-  if (signups.some((signup) => signup.has_traffic)) return false;
-
-  const times = signups
-    .map((signup) => new Date(signup.signed_up_at).getTime())
-    .sort((a, b) => a - b);
-  return times[times.length - 1] - times[0] <= CLUSTER_WINDOW_MS;
-}
-
-/**
- * The local-part shape temp-mail generators produce: a run of letters and a
- * run of digits, nothing else. `lidosej357`, `xiyese3594`, `gimade8897`.
- *
- * Real people use it too (`john1985`), so it is never judged one address at
- * a time — only when every address on a domain has the shape, below.
- */
-const MACHINE_LOCAL_PART = /^[a-z]{4,8}[0-9]{3,6}$/;
-
-/**
- * True when a domain's signups all look machine-generated.
- *
- * Two or more accounts, every one of them a letters-then-digits local part.
- * A company does not sign up its whole team as `vatiy14692@` and
- * `xiyese3594@`; a disposable-mail domain does nothing else. On the first
- * dry run this was aratrin.com and lidugw.com — with Faker names attached,
- * and with traffic, so the quiet-cluster rule above did not fire.
- *
- * Across every verified signup this matched four domains: those two,
- * mypethealh.com, and one university whose student ids happen to fit and
- * which the academic rule already removes.
- */
-export function isMachineGeneratedDomain(localParts: string[]): boolean {
-  return localParts.length >= 2 && localParts.every((local) => MACHINE_LOCAL_PART.test(local));
-}
diff --git a/packages/backend/src/crm-metrics/crm-metrics.module.ts b/packages/backend/src/crm-metrics/crm-metrics.module.ts
deleted file mode 100644
index e8ea3417..00000000
--- a/packages/backend/src/crm-metrics/crm-metrics.module.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import { Module } from '@nestjs/common';
-import { CrmMetricsService } from './crm-metrics.service';
-import { InternalCrmMetricsController } from './internal-crm-metrics.controller';
-
-/**
- * Internal feed the CRM polls to drive Autofix product outreach. Queries run
- * through the injected DataSource, so no `TypeOrmModule.forFeature` is needed.
- */
-@Module({
-  controllers: [InternalCrmMetricsController],
-  providers: [CrmMetricsService],
-})
-export class CrmMetricsModule {}
diff --git a/packages/backend/src/crm-metrics/crm-metrics.service.spec.ts b/packages/backend/src/crm-metrics/crm-metrics.service.spec.ts
deleted file mode 100644
index dc1e85cc..00000000
--- a/packages/backend/src/crm-metrics/crm-metrics.service.spec.ts
+++ /dev/null
@@ -1,725 +0,0 @@
-import { ServiceUnavailableException } from '@nestjs/common';
-import type { DataSource } from 'typeorm';
-import { CrmMetricsService } from './crm-metrics.service';
-import { toLocalSqlTimestamp } from '../common/utils/postgres-sql';
-
-const NOW = new Date('2026-09-04T12:00:00.000Z');
-
-interface Scripted {
-  index?: unknown[];
-  cohort?: unknown[];
-  claims?: unknown[];
-  signups?: unknown[];
-}
-
-function cohortRow(over: Record<string, unknown> = {}) {
-  return {
-    email: 'matheus@example.com',
-    user_name: 'Matheus Vitorio',
-    tenant_id: 'tenant-a',
-    healed_recent: '260',
-    healed_all: '1241',
-    first_heal_at: '2026-07-30T15:17:31.000Z',
-    last_heal_at: '2026-09-04T09:47:30.000Z',
-    ...over,
-  };
-}
-
-function signupRow(over: Record<string, unknown> = {}) {
-  return {
-    email: 'ada@stripe.com',
-    user_name: 'Ada Lovelace',
-    signed_up_at: '2026-08-01T10:00:00.000Z',
-    last_request_at: null,
-    ...over,
-  };
-}
-
-describe('CrmMetricsService', () => {
-  let query: jest.Mock;
-  let commitTransaction: jest.Mock;
-  let rollbackTransaction: jest.Mock;
-  let release: jest.Mock;
-  let connect: jest.Mock;
-  let startTransaction: jest.Mock;
-  let service: CrmMetricsService;
-  let scripted: Scripted;
-
-  function setup(next: Scripted = {}): void {
-    scripted = { index: [{ '?column?': 1 }], ...next };
-    query = jest.fn().mockImplementation((sql: string) => {
-      if (sql.includes('SET LOCAL')) return Promise.resolve([]);
-      if (sql.includes('pg_index')) return Promise.resolve(scripted.index ?? []);
-      // Checked before the cohort branch: both queries join `tenants t`.
-      if (sql.includes('WITH signups AS MATERIALIZED'))
-        return Promise.resolve(scripted.signups ?? []);
-      if (sql.includes('JOIN tenants t')) return Promise.resolve(scripted.cohort ?? []);
-      if (sql.includes('FROM waitlist_claims')) return Promise.resolve(scripted.claims ?? []);
-      throw new Error(`unexpected SQL: ${sql}`);
-    });
-    commitTransaction = jest.fn();
-    rollbackTransaction = jest.fn();
-    release = jest.fn();
-    connect = jest.fn();
-    startTransaction = jest.fn();
-    const runner = {
-      connect,
-      startTransaction,
-      commitTransaction,
-      rollbackTransaction,
-      release,
-      query,
-    };
-    service = new CrmMetricsService({ createQueryRunner: () => runner } as unknown as DataSource);
-  }
-
-  const sqlFor = (needle: string): string =>
-    query.mock.calls.map(([sql]) => String(sql)).find((sql) => sql.includes(needle)) ?? '';
-  const paramsFor = (needle: string): unknown[] =>
-    query.mock.calls.find(([sql]) => String(sql).includes(needle))?.[1] ?? [];
-
-  beforeEach(() => setup());
-
-  afterEach(() => {
-    jest.useRealTimers();
-  });
-
-  describe('transaction handling', () => {
-    it('bounds the work with transaction-scoped timeouts', async () => {
-      await service.getHealedCohort(7, NOW);
-
-      expect(sqlFor('lock_timeout')).toBe(`SET LOCAL lock_timeout = '5000ms'`);
-      expect(sqlFor('statement_timeout')).toBe(`SET LOCAL statement_timeout = '1500ms'`);
-      expect(commitTransaction).toHaveBeenCalled();
-    });
-
-    it('rolls back and releases the runner when a query fails', async () => {
-      setup();
-      query.mockRejectedValueOnce(new Error('boom'));
-
-      await expect(service.getHealedCohort(7, NOW)).rejects.toThrow('boom');
-      expect(rollbackTransaction).toHaveBeenCalled();
-      expect(commitTransaction).not.toHaveBeenCalled();
-      expect(release).toHaveBeenCalled();
-    });
-
-    it('releases the runner on the happy path too', async () => {
-      await service.getHealedCohort(7, NOW);
-
-      expect(release).toHaveBeenCalled();
-    });
-
-    it('opens the transaction before setting the timeouts, and commits after the work', async () => {
-      setup({ cohort: [cohortRow()] });
-
-      await service.getHealedCohort(7, NOW);
-
-      // `SET LOCAL` outside a transaction is silently a no-op, so hoisting
-      // these above startTransaction would disable both bounds without
-      // changing a single line of SQL text.
-      expect(connect.mock.invocationCallOrder[0]).toBeLessThan(
-        startTransaction.mock.invocationCallOrder[0],
-      );
-      expect(startTransaction.mock.invocationCallOrder[0]).toBeLessThan(
-        query.mock.invocationCallOrder[0],
-      );
-      expect(query.mock.calls.slice(0, 2).map(([sql]) => String(sql))).toEqual([
-        `SET LOCAL lock_timeout = '5000ms'`,
-        `SET LOCAL statement_timeout = '1500ms'`,
-      ]);
-      expect(commitTransaction.mock.invocationCallOrder[0]).toBeGreaterThan(
-        query.mock.invocationCallOrder[query.mock.invocationCallOrder.length - 1],
-      );
-    });
-  });
-
-  describe('index guard', () => {
-    it('refuses to run an unindexed scan when the index is missing or invalid', async () => {
-      setup({ index: [], cohort: [cohortRow()] });
-
-      const error = await service.getHealedCohort(7, NOW).then(
-        () => null,
-        (thrown: unknown) => thrown,
-      );
-
-      expect(error).toBeInstanceOf(ServiceUnavailableException);
-      expect((error as Error).message).toContain('IDX_requests_autofix_healed');
-      // Cohort rows were scripted, so an empty result here would mean the
-      // guard let the unindexed scan run and merely found nothing.
-      expect(sqlFor('JOIN tenants t')).toBe('');
-      expect(rollbackTransaction).toHaveBeenCalled();
-      expect(release).toHaveBeenCalled();
-    });
-
-    it('reports the outage as a rejection, never as an empty cohort', async () => {
-      setup({ cohort: [] });
-      await expect(service.getHealedCohort(7, NOW)).resolves.toEqual([]);
-
-      setup({ index: [] });
-      const outcome = await service.getHealedCohort(7, NOW).then(
-        (users) => ({ resolved: users }),
-        (error: unknown) => ({ error }),
-      );
-
-      // "Nobody was healed" and "the index is gone" must not look alike to the
-      // CRM: a `catch { return [] }` here would silently empty the feed.
-      expect(outcome).toEqual({ error: expect.any(ServiceUnavailableException) });
-    });
-
-    it('probes for the index by name', async () => {
-      await service.getHealedCohort(7, NOW);
-
-      expect(paramsFor('pg_index')).toEqual(['IDX_requests_autofix_healed']);
-    });
-  });
-
-  describe('cohort window', () => {
-    it('bounds the cohort query with a local wall-clock cutoff, not UTC', async () => {
-      setup({ cohort: [cohortRow()] });
-
-      await service.getHealedCohort(7, NOW);
-
-      const expected = toLocalSqlTimestamp(new Date(NOW.getTime() - 7 * 86_400_000));
-      expect(paramsFor('JOIN tenants t')).toEqual([expected]);
-    });
-
-    it('never joins agent_messages: that breakdown cost 1.1s against a 1.5s timeout', async () => {
-      setup({ cohort: [cohortRow()] });
-
-      await service.getHealedCohort(365, NOW);
-
-      // The provider join scaled with the window and 500d the endpoint at 365
-      // days. It fed a field the outreach email no longer uses.
-      expect(sqlFor('agent_messages')).toBe('');
-    });
-
-    it('defaults to the current time when no clock is injected', async () => {
-      setup({ cohort: [cohortRow()] });
-
-      await expect(service.getHealedCohort(7)).resolves.toHaveLength(1);
-      await expect(service.getConversions(90)).resolves.toEqual([]);
-      await expect(service.getCorporateSignups(365)).resolves.toEqual([]);
-
-      const cutoff = paramsFor('JOIN tenants t')[0] as string;
-      expect(cutoff).toMatch(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/);
-    });
-
-    it('applies the canonical healed predicate, not autofix_status alone', async () => {
-      await service.getHealedCohort(7, NOW);
-
-      const sql = sqlFor('JOIN tenants t');
-      expect(sql).toContain(`r.autofix_status = 'retry_succeeded'`);
-      expect(sql).toContain('r.status IS NULL OR r.status IN');
-      expect(sql).toContain('u."emailVerified" = true');
-    });
-
-    it('counts every heal ever, but only surfaces people healed inside the window', async () => {
-      await service.getHealedCohort(7, NOW);
-
-      const sql = sqlFor('JOIN tenants t');
-      expect(sql).toContain('count(*) FILTER (WHERE r.timestamp > $1)');
-      expect(sql).toContain('HAVING count(*) FILTER (WHERE r.timestamp > $1) > 0');
-      // `healed_all` is deliberately unbounded. Narrowing the WHERE by the
-      // cutoff would collapse it onto `healed_recent` and quietly turn the
-      // "heals since Autofix shipped" number into a duplicate of the window.
-      expect(sql).not.toContain('AND r.timestamp >');
-    });
-  });
-
-  describe('cohort shaping', () => {
-    it('maps a single person', async () => {
-      setup({ cohort: [cohortRow()] });
-
-      const [user] = await service.getHealedCohort(7, NOW);
-
-      expect(user).toEqual({
-        email: 'matheus@example.com',
-        name: 'Matheus Vitorio',
-        healed_recent: 260,
-        healed_all: 1241,
-        first_heal_at: '2026-07-30T15:17:31.000Z',
-        last_heal_at: '2026-09-04T09:47:30.000Z',
-      });
-    });
-
-    it('sums a person who owns more than one tenant', async () => {
-      setup({
-        cohort: [
-          cohortRow({ tenant_id: 'tenant-a', healed_recent: '10', healed_all: '20' }),
-          cohortRow({
-            tenant_id: 'tenant-b',
-            user_name: null,
-            healed_recent: '5',
-            healed_all: '7',
-            first_heal_at: '2026-07-01T00:00:00.000Z',
-            last_heal_at: '2026-09-05T00:00:00.000Z',
-          }),
-        ],
-      });
-
-      const [user] = await service.getHealedCohort(7, NOW);
-
-      expect(user.healed_recent).toBe(15);
-      expect(user.healed_all).toBe(27);
-      expect(user.first_heal_at).toBe('2026-07-01T00:00:00.000Z');
-      expect(user.last_heal_at).toBe('2026-09-05T00:00:00.000Z');
-      expect(user.name).toBe('Matheus Vitorio');
-    });
-
-    it('keeps the first name seen when a later tenant carries a different one', async () => {
-      setup({
-        cohort: [
-          cohortRow({ tenant_id: 'tenant-a', user_name: 'First Name' }),
-          cohortRow({ tenant_id: 'tenant-b', user_name: 'Stale Name' }),
-        ],
-      });
-
-      const [user] = await service.getHealedCohort(7, NOW);
-
-      // First non-null wins; flipping the coalesce to `row.user_name ?? existing`
-      // would make the last tenant's copy of the name win instead.
-      expect(user.name).toBe('First Name');
-    });
-
-    it('leaves the name null when no row for the person ever carried one', async () => {
-      setup({
-        cohort: [
-          cohortRow({ tenant_id: 'tenant-a', user_name: null }),
-          cohortRow({ tenant_id: 'tenant-b', user_name: null }),
-        ],
-      });
-
-      const [user] = await service.getHealedCohort(7, NOW);
-
-      expect(user.name).toBeNull();
-      expect(user.email).toBe('matheus@example.com');
-    });
-
-    it('keeps a later name when the first row for a person had none', async () => {
-      setup({
-        cohort: [
-          cohortRow({ tenant_id: 'tenant-a', user_name: null }),
-          cohortRow({ tenant_id: 'tenant-b', user_name: 'Late Name' }),
-        ],
-      });
-
-      const [user] = await service.getHealedCohort(7, NOW);
-
-      expect(user.name).toBe('Late Name');
-    });
-
-    it('drops excluded addresses before they reach the payload', async () => {
-      setup({
-        cohort: [
-          cohortRow({ email: 'bruno@buddyweb.fr' }),
-          cohortRow({ email: 'improving_poison241@dralias.com' }),
-          cohortRow({ email: 'real@example.com' }),
-        ],
-      });
-
-      const users = await service.getHealedCohort(7, NOW);
-
-      expect(users.map((u) => u.email)).toEqual(['real@example.com']);
-    });
-
-    it('normalises case and whitespace on the grouping key', async () => {
-      setup({
-        cohort: [
-          cohortRow({ email: '  Matheus@Example.com ', tenant_id: 'tenant-a', healed_recent: '3' }),
-          cohortRow({ email: 'matheus@example.com', tenant_id: 'tenant-b', healed_recent: '4' }),
-        ],
-      });
-
-      const users = await service.getHealedCohort(7, NOW);
-
-      expect(users).toHaveLength(1);
-      expect(users[0].healed_recent).toBe(7);
-    });
-
-    it('orders people by heals in the window, most first', async () => {
-      setup({
-        cohort: [
-          cohortRow({ email: 'quiet@example.com', tenant_id: 't1', healed_recent: '2' }),
-          cohortRow({ email: 'loud@example.com', tenant_id: 't2', healed_recent: '99' }),
-        ],
-      });
-
-      const users = await service.getHealedCohort(7, NOW);
-
-      expect(users.map((u) => u.email)).toEqual(['loud@example.com', 'quiet@example.com']);
-    });
-  });
-
-  describe('conversions', () => {
-    it('normalises claims and bounds the window in UTC', async () => {
-      setup({
-        claims: [
-          { email: 'Someone@Example.com', source: 'cloud', claimed_at: '2026-09-01T08:00:00.000Z' },
-        ],
-      });
-
-      const claims = await service.getConversions(90, NOW);
-
-      expect(claims).toEqual([
-        { email: 'someone@example.com', source: 'cloud', claimed_at: '2026-09-01T08:00:00.000Z' },
-      ]);
-      // claimed_at is `timestamp WITH time zone`, unlike requests.timestamp.
-      expect(paramsFor('FROM waitlist_claims')).toEqual([
-        new Date(NOW.getTime() - 90 * 86_400_000).toISOString(),
-      ]);
-    });
-
-    it('runs the claims query alone: no index probe, no cross-tenant scan', async () => {
-      setup({ claims: [] });
-
-      await service.getConversions(90, NOW);
-
-      expect(query.mock.calls.map(([sql]) => String(sql).trim().split('\n')[0])).toEqual([
-        `SET LOCAL lock_timeout = '5000ms'`,
-        `SET LOCAL statement_timeout = '1500ms'`,
-        'SELECT email, source, claimed_at',
-      ]);
-      expect(commitTransaction).toHaveBeenCalled();
-    });
-
-    it('reports every claim, including addresses the cohort filters out', async () => {
-      setup({
-        claims: [
-          {
-            email: 'bruno@buddyweb.fr',
-            source: 'self-hosted',
-            claimed_at: '2026-09-02T00:00:00.000Z',
-          },
-          {
-            email: 'info@realcompany.com',
-            source: 'cloud',
-            claimed_at: '2026-09-01T00:00:00.000Z',
-          },
-        ],
-      });
-
-      const claims = await service.getConversions(90, NOW);
-
-      // Deliverability filtering is about who we may email; a conversion count
-      // that quietly drops our own signups would understate the campaign.
-      expect(claims.map((claim) => claim.email)).toEqual([
-        'bruno@buddyweb.fr',
-        'info@realcompany.com',
-      ]);
-    });
-  });
-
-  describe('caching', () => {
-    it('serves a repeated cohort request without touching the database', async () => {
-      setup({ cohort: [cohortRow()] });
-
-      const first = await service.getHealedCohort(7, NOW);
-      const callsAfterFirst = query.mock.calls.length;
-      const second = await service.getHealedCohort(7, NOW);
-
-      expect(second).toBe(first);
-      expect(query.mock.calls).toHaveLength(callsAfterFirst);
-    });
-
-    it('caches per window, so a different day count recomputes', async () => {
-      setup({ cohort: [cohortRow()] });
-
-      await service.getHealedCohort(7, NOW);
-      const callsAfterFirst = query.mock.calls.length;
-      await service.getHealedCohort(30, NOW);
-
-      expect(query.mock.calls.length).toBeGreaterThan(callsAfterFirst);
-    });
-
-    it('does not cache a failed scan, so the next call retries the database', async () => {
-      setup({ cohort: [cohortRow()] });
-      // Target the cohort scan itself, not whichever statement happens to run
-      // first: `mockRejectedValueOnce` would otherwise fail `SET LOCAL
-      // lock_timeout` and never reach the query this test is named after.
-      let failNextScan = true;
-      const scan = query.getMockImplementation()!;
-      query.mockImplementation((sql: string, ...params: unknown[]) => {
-        if (sql.includes('JOIN tenants t') && failNextScan) {
-          failNextScan = false;
-          return Promise.reject(new Error('canceling statement due to statement timeout'));
-        }
-        return scan(sql, ...params);
-      });
-
-      await expect(service.getHealedCohort(7, NOW)).rejects.toThrow('statement timeout');
-      const users = await service.getHealedCohort(7, NOW);
-
-      expect(users.map((u) => u.email)).toEqual(['matheus@example.com']);
-      // Both calls reached the scan: the failure was not memoised.
-      expect(
-        query.mock.calls.filter(([sql]) => String(sql).includes('JOIN tenants t')),
-      ).toHaveLength(2);
-    });
-
-    it('does not cache a missing index either, so the feed recovers once it is rebuilt', async () => {
-      setup({ index: [], cohort: [cohortRow()] });
-
-      await expect(service.getHealedCohort(7, NOW)).rejects.toBeInstanceOf(
-        ServiceUnavailableException,
-      );
-      scripted.index = [{ '?column?': 1 }];
-
-      await expect(service.getHealedCohort(7, NOW)).resolves.toHaveLength(1);
-    });
-
-    it('caches an empty window too, so an idle feed stops re-scanning', async () => {
-      setup({ cohort: [] });
-
-      await expect(service.getHealedCohort(7, NOW)).resolves.toEqual([]);
-      const callsAfterFirst = query.mock.calls.length;
-      await service.getHealedCohort(7, NOW);
-
-      expect(query.mock.calls).toHaveLength(callsAfterFirst);
-    });
-
-    it('keeps the cohort and the conversion caches apart at the same window', async () => {
-      setup({
-        cohort: [cohortRow()],
-        claims: [
-          { email: 'someone@example.com', source: 'cloud', claimed_at: '2026-09-01T08:00:00.000Z' },
-        ],
-      });
-
-      const users = await service.getHealedCohort(7, NOW);
-      const claims = await service.getConversions(7, NOW);
-
-      // One cache keyed on `days` alone would hand the cohort array back here.
-      expect(users.map((u) => u.email)).toEqual(['matheus@example.com']);
-      expect(claims).toEqual([
-        { email: 'someone@example.com', source: 'cloud', claimed_at: '2026-09-01T08:00:00.000Z' },
-      ]);
-    });
-
-    it('recomputes once the 60s ttl lapses', async () => {
-      jest.useFakeTimers();
-      setup({ cohort: [cohortRow()] });
-
-      await service.getHealedCohort(7, NOW);
-      const callsAfterFirst = query.mock.calls.length;
-
-      jest.advanceTimersByTime(59_000);
-      await service.getHealedCohort(7, NOW);
-      expect(query.mock.calls).toHaveLength(callsAfterFirst);
-
-      jest.advanceTimersByTime(2_000);
-      await service.getHealedCohort(7, NOW);
-      expect(query.mock.calls.length).toBeGreaterThan(callsAfterFirst);
-    });
-
-    it('caches conversions too', async () => {
-      setup({ claims: [] });
-
-      const first = await service.getConversions(90, NOW);
-      const callsAfterFirst = query.mock.calls.length;
-      const second = await service.getConversions(90, NOW);
-
-      expect(second).toBe(first);
-      expect(query.mock.calls).toHaveLength(callsAfterFirst);
-    });
-  });
-
-  describe('getCorporateSignups', () => {
-    it('refuses to run when the tenant/timestamp index is missing', async () => {
-      setup({ index: [] });
-
-      await expect(service.getCorporateSignups(365, NOW)).rejects.toBeInstanceOf(
-        ServiceUnavailableException,
-      );
-      expect(sqlFor('WITH signups AS MATERIALIZED')).toBe('');
-    });
-
-    it('excludes anyone on the pivot waiting list, in the query itself', async () => {
-      // Those people are worked by hand; the exclusion lives in SQL so no
-      // consumer can forget to apply it.
-      await service.getCorporateSignups(365, NOW);
-
-      const sql = sqlFor('WITH signups AS MATERIALIZED');
-      expect(sql).toContain('NOT EXISTS');
-      expect(sql).toContain('FROM waitlist_claims w WHERE lower(w.email) = lower(u.email)');
-    });
-
-    it('checks for the index the lateral probe depends on', async () => {
-      await service.getCorporateSignups(365, NOW);
-
-      expect(paramsFor('pg_index')).toEqual(['IDX_requests_tenant_timestamp']);
-    });
-
-    it('cuts off on a UTC boundary, matching a timestamptz column', async () => {
-      await service.getCorporateSignups(30, NOW);
-
-      expect(paramsFor('WITH signups AS MATERIALIZED')).toEqual([
-        new Date(NOW.getTime() - 30 * 86_400_000).toISOString(),
-      ]);
-    });
-
-    it('maps a signup onto the payload shape', async () => {
-      setup({ signups: [signupRow()] });
-
-      expect(await service.getCorporateSignups(365, NOW)).toEqual([
-        {
-          email: 'ada@stripe.com',
-          name: 'Ada Lovelace',
-          domain: 'stripe.com',
-          signed_up_at: '2026-08-01T10:00:00.000Z',
-          last_request_at: null,
-          has_traffic: false,
-          domain_signups: 1,
-        },
-      ]);
-    });
-
-    it('keeps a verified user who never created a tenant', async () => {
-      // Tenants are created lazily on first agent creation, so someone who
-      // signed up and never built anything has no tenant row. They are exactly
-      // who this feed is for, and an inner join would drop them: 1,274 verified
-      // users in production, 144 of them corporate.
-      setup({ signups: [signupRow({ last_request_at: null })] });
-
-      const [signup] = await service.getCorporateSignups(365, NOW);
-
-      expect(signup.has_traffic).toBe(false);
-      expect(signup.last_request_at).toBeNull();
-      expect(sqlFor('WITH signups AS MATERIALIZED')).toContain('LEFT JOIN tenants t');
-    });
-
-    it('marks a tenant that has sent a request', async () => {
-      setup({ signups: [signupRow({ last_request_at: '2026-09-01T08:00:00.000Z' })] });
-
-      const [signup] = await service.getCorporateSignups(365, NOW);
-
-      expect(signup.has_traffic).toBe(true);
-      expect(signup.last_request_at).toBe('2026-09-01T08:00:00.000Z');
-    });
-
-    it('normalises the address and derives the domain from it', async () => {
-      setup({ signups: [signupRow({ email: '  Ada@Stripe.COM ' })] });
-
-      const [signup] = await service.getCorporateSignups(365, NOW);
-
-      expect(signup.email).toBe('ada@stripe.com');
-      expect(signup.domain).toBe('stripe.com');
-    });
-
-    it('keeps a missing display name as null', async () => {
-      setup({ signups: [signupRow({ user_name: null })] });
-
-      expect((await service.getCorporateSignups(365, NOW))[0].name).toBeNull();
-    });
-
-    it('drops consumer and already-excluded addresses', async () => {
-      setup({
-        signups: [
-          signupRow({ email: 'ada@gmail.com' }),
-          signupRow({ email: 'support@stripe.com' }),
-          signupRow({ email: 'dev@manifest.build' }),
-          signupRow({ email: 'ada@stripe.com' }),
-        ],
-      });
-
-      expect((await service.getCorporateSignups(365, NOW)).map((s) => s.email)).toEqual([
-        'ada@stripe.com',
-      ]);
-    });
-
-    it('counts how many verified signups share a domain', async () => {
-      setup({
-        signups: [signupRow({ email: 'ada@stripe.com' }), signupRow({ email: 'grace@stripe.com' })],
-      });
-
-      const signups = await service.getCorporateSignups(365, NOW);
-
-      expect(signups).toHaveLength(2);
-      expect(signups.every((s) => s.domain_signups === 2)).toBe(true);
-    });
-
-    it('drops a scripted signup cluster wholesale', async () => {
-      setup({
-        signups: [
-          signupRow({ email: 'a@scraped.com', signed_up_at: '2026-03-01T00:00:00.000Z' }),
-          signupRow({ email: 'b@scraped.com', signed_up_at: '2026-03-08T00:00:00.000Z' }),
-          signupRow({ email: 'c@scraped.com', signed_up_at: '2026-03-15T00:00:00.000Z' }),
-          signupRow({ email: 'ada@stripe.com' }),
-        ],
-      });
-
-      expect((await service.getCorporateSignups(365, NOW)).map((s) => s.email)).toEqual([
-        'ada@stripe.com',
-      ]);
-    });
-
-    it('drops a domain whose signups all look machine-generated', async () => {
-      // Temp-mail domains: Faker names, traffic, and every local part is
-      // letters-then-digits. The quiet-cluster rule misses them because they
-      // have traffic; this one catches them on the address shape.
-      setup({
-        signups: [
-          signupRow({ email: 'vatiy14692@aratrin.com', user_name: 'Mrs. Beaulah Shanahan' }),
-          signupRow({
-            email: 'xiyese3594@aratrin.com',
-            user_name: 'Test01',
-            last_request_at: '2026-09-01T00:00:00.000Z',
-          }),
-          signupRow({ email: 'ada@stripe.com' }),
-        ],
-      });
-
-      expect((await service.getCorporateSignups(365, NOW)).map((s) => s.email)).toEqual([
-        'ada@stripe.com',
-      ]);
-    });
-
-    it('keeps a burst where somebody actually used the gateway', async () => {
-      setup({
-        signups: [
-          signupRow({ email: 'a@real.com', signed_up_at: '2026-03-01T00:00:00.000Z' }),
-          signupRow({ email: 'b@real.com', signed_up_at: '2026-03-08T00:00:00.000Z' }),
-          signupRow({
-            email: 'c@real.com',
-            signed_up_at: '2026-03-15T00:00:00.000Z',
-            last_request_at: '2026-04-01T00:00:00.000Z',
-          }),
-        ],
-      });
-
-      expect(await service.getCorporateSignups(365, NOW)).toHaveLength(3);
-    });
-
-    it('orders by domain size, then by newest signup', async () => {
-      setup({
-        signups: [
-          signupRow({ email: 'solo@alone.com', signed_up_at: '2026-08-20T00:00:00.000Z' }),
-          signupRow({ email: 'older@team.com', signed_up_at: '2026-01-01T00:00:00.000Z' }),
-          signupRow({ email: 'newer@team.com', signed_up_at: '2026-08-01T00:00:00.000Z' }),
-        ],
-      });
-
-      expect((await service.getCorporateSignups(365, NOW)).map((s) => s.email)).toEqual([
-        'newer@team.com',
-        'older@team.com',
-        'solo@alone.com',
-      ]);
-    });
-
-    it('returns nothing when no signup survives the filters', async () => {
-      setup({ signups: [signupRow({ email: 'ada@gmail.com' })] });
-
-      expect(await service.getCorporateSignups(365, NOW)).toEqual([]);
-    });
-
-    it('caches signups per window', async () => {
-      setup({ signups: [signupRow()] });
-
-      const first = await service.getCorporateSignups(365, NOW);
-      const callsAfterFirst = query.mock.calls.length;
-      const second = await service.getCorporateSignups(365, NOW);
-
-      expect(second).toBe(first);
-      expect(query.mock.calls).toHaveLength(callsAfterFirst);
-    });
-  });
-});
diff --git a/packages/backend/src/crm-metrics/crm-metrics.service.ts b/packages/backend/src/crm-metrics/crm-metrics.service.ts
deleted file mode 100644
index 1437a7ca..00000000
--- a/packages/backend/src/crm-metrics/crm-metrics.service.ts
+++ /dev/null
@@ -1,384 +0,0 @@
-import { Injectable, ServiceUnavailableException } from '@nestjs/common';
-import { DataSource, QueryRunner } from 'typeorm';
-import { TtlCache } from '../common/utils/ttl-cache';
-import { toLocalSqlTimestamp } from '../common/utils/postgres-sql';
-import { sqlIsSuccessStatus } from '../analytics/services/query-helpers';
-import {
-  domainOf,
-  isCorporateSignupEmail,
-  isMachineGeneratedDomain,
-  isSignupCluster,
-  isExcludedEmail,
-} from './crm-metrics.filters';
-import type {
-  CohortRow,
-  CrmCorporateSignup,
-  CrmHealedUser,
-  CrmWaitlistClaim,
-  SignupRow,
-} from './crm-metrics.types';
-
-/**
- * Answers on the cheap: the requests Autofix repaired lately, grouped by the
- * person who owns them, plus the waiting-list claims that measure whether the
- * campaign worked.
- *
- * Read once a day by the CRM, so there is no snapshot table and no cron. A
- * snapshot would need a cron running exactly the cross-tenant scan this is
- * trying to avoid, plus leader election; once indexed, the live query is
- * cheaper than that cron would be. Results sit behind a TTL cache.
- */
-
-const HEALED_INDEX = 'IDX_requests_autofix_healed';
-
-/**
- * The signup feed's whole cost model is one index probe per tenant. Without
- * this index the lateral degrades to a sequential scan of `requests` per row,
- * which measured 22s and 6.9 GB of reads against production.
- */
-const TENANT_TIMESTAMP_INDEX = 'IDX_requests_tenant_timestamp';
-
-/**
- * Short on purpose. The cache exists to stop a retrying client from replaying
- * the provider join (~80 MB of buffer reads) up to the throttler's 100/min, not
- * to serve the expected traffic — a once-a-day poll misses either way. A long
- * TTL would buy nothing and make the feed surprisingly stale after an operator
- * fixes something and re-runs.
- */
-const CACHE_TTL_MS = 60_000;
-
-/**
- * Deliberately *below* the 2.4s the unindexed cohort scan takes. If the
- * partial index is missing the query aborts instead of completing, because the
- * damage from that plan is not latency but reading 6.6 GB through a ~128 MB
- * shared_buffers and evicting everyone else's working set.
- */
-const STATEMENT_TIMEOUT_MS = 1_500;
-const LOCK_TIMEOUT_MS = 5_000;
-
-/** The index is the entire point; without it, refuse rather than thrash prod. */
-const INDEX_READY_SQL = `
-  SELECT 1 FROM pg_index i
-  JOIN pg_class c ON c.oid = i.indexrelid
-  WHERE c.relname = $1 AND i.indisvalid
-`;
-
-/**
- * The canonical "healed" predicate, matching request-volume.service.ts. The
- * status check is not redundant: a retry can return 2xx while the request still
- * concludes failed, and quoting a repair count the dashboard disagrees with is
- * worse than quoting none.
- *
- * No playground exclusion is needed here (every other cross-tenant aggregate
- * carries one): playground.service.ts writes `autofix_status: null` on all of
- * its request paths, so a playground row can never match this predicate.
- */
-const IS_HEALED = `r.autofix_status = 'retry_succeeded' AND ${sqlIsSuccessStatus('r.status')}`;
-
-const COHORT_SQL = `
-  SELECT lower(u.email)                             AS email,
-         u.name                                     AS user_name,
-         r.tenant_id                                AS tenant_id,
-         count(*) FILTER (WHERE r.timestamp > $1)   AS healed_recent,
-         count(*)                                   AS healed_all,
-         min(r.timestamp)                           AS first_heal_at,
-         max(r.timestamp)                           AS last_heal_at
-  FROM requests r
-  JOIN tenants t ON t.id = r.tenant_id
-  JOIN "user" u ON u.id = t.owner_user_id
-  WHERE ${IS_HEALED}
-    AND u."emailVerified" = true
-  GROUP BY lower(u.email), u.name, r.tenant_id
-  HAVING count(*) FILTER (WHERE r.timestamp > $1) > 0
-`;
-
-/**
- * Every verified signup in the window, with the timestamp of that tenant's most
- * recent request.
- *
- * `LIMIT 1` on a backward index scan rather than an aggregate: it answers
- * "have they ever used this, and when last" from the index alone, whereas
- * `count(*)` or a filtered aggregate must visit the heap for every row.
- *
- * Domain rules are deliberately *not* in this SQL. They live in
- * crm-metrics.filters.ts so one list governs every consumer and stays under
- * test; the cost of returning all ~8k users and filtering in TypeScript is
- * one probe each, which measured 59-93ms warm and 999ms cold against
- * production. That worst case still fits the 1.5s budget, but the margin is
- * the reason this stays one probe per row and never an aggregate.
- *
- * Anyone on the pivot waiting list is excluded. They raised their hand for
- * exactly this product and are worked by hand, one at a time — a templated
- * signup email landing on top of that conversation would be a worse
- * experience than no email. `waitlist_claims` is ~60 rows with a unique
- * index on email, so the anti-join is free.
- *
- * The join to `tenants` must stay LEFT. Tenants are created lazily on first
- * agent creation, so a user who signed up and never built anything has no
- * tenant row at all — 1,274 verified users in production, 144 of them on
- * corporate domains. An inner join drops exactly the people this feed exists
- * to find. With no tenant the lateral matches nothing, which is the correct
- * answer: `last_request_at` null, `has_traffic` false.
- */
-const SIGNUPS_SQL = `
-  WITH signups AS MATERIALIZED (
-    SELECT lower(u.email)   AS email,
-           u.name           AS user_name,
-           u."createdAt"    AS signed_up_at,
-           t.id             AS tenant_id
-    FROM "user" u
-    LEFT JOIN tenants t ON t.owner_user_id = u.id
-    WHERE u."emailVerified" = true
-      AND u."createdAt" > $1
-      AND NOT EXISTS (
-        SELECT 1 FROM waitlist_claims w WHERE lower(w.email) = lower(u.email)
-      )
-  )
-  SELECT s.email, s.user_name, s.signed_up_at, a.last_request_at
-  FROM signups s
-  LEFT JOIN LATERAL (
-    SELECT r.timestamp AS last_request_at
-    FROM requests r
-    WHERE r.tenant_id = s.tenant_id
-    ORDER BY r.timestamp DESC
-    LIMIT 1
-  ) a ON true
-`;
-
-const CLAIMS_SQL = `
-  SELECT email, source, claimed_at
-  FROM waitlist_claims
-  WHERE claimed_at > $1
-  ORDER BY claimed_at DESC
-`;
-
-@Injectable()
-export class CrmMetricsService {
-  private readonly cohortCache = new TtlCache<number, CrmHealedUser[]>({
-    maxSize: 8,
-    ttlMs: CACHE_TTL_MS,
-  });
-  private readonly claimsCache = new TtlCache<number, CrmWaitlistClaim[]>({
-    maxSize: 8,
-    ttlMs: CACHE_TTL_MS,
-  });
-  private readonly signupsCache = new TtlCache<number, CrmCorporateSignup[]>({
-    maxSize: 8,
-    ttlMs: CACHE_TTL_MS,
-  });
-
-  constructor(private readonly dataSource: DataSource) {}
-
-  /** Users whose requests Autofix repaired within `days`, one row per person. */
-  async getHealedCohort(days: number, now: Date = new Date()): Promise<CrmHealedUser[]> {
-    const cached = this.cohortCache.get(days);
-    if (cached) return cached;
-
-    const cutoff = cutoffFor(days, now);
-    const users = await this.withRunner(async (runner) => {
-      const ready = (await runner.query(INDEX_READY_SQL, [HEALED_INDEX])) as unknown[];
-      if (ready.length === 0) {
-        throw new ServiceUnavailableException(
-          `${HEALED_INDEX} is missing or invalid; refusing to run an unindexed scan`,
-        );
-      }
-      const merged = mergeByEmail((await runner.query(COHORT_SQL, [cutoff])) as CohortRow[]);
-      return buildUsers(merged);
-    });
-
-    this.cohortCache.set(days, users);
-    return users;
-  }
-
-  /**
-   * Verified signups on organisation domains within `days`, newest first.
-   *
-   * Consumer mailboxes, relays, role addresses and scripted signup clusters are
-   * removed here rather than in the CRM, so every consumer inherits the same
-   * rules.
-   */
-  async getCorporateSignups(days: number, now: Date = new Date()): Promise<CrmCorporateSignup[]> {
-    const cached = this.signupsCache.get(days);
-    if (cached) return cached;
-
-    // `user."createdAt"` is `timestamp WITH time zone`, unlike the naive
-    // `requests.timestamp` the cohort query compares against — so a UTC
-    // boundary is correct here and a local one would be off by the offset.
-    const cutoff = new Date(now.getTime() - days * 86_400_000).toISOString();
-    const signups = await this.withRunner(async (runner) => {
-      const ready = (await runner.query(INDEX_READY_SQL, [TENANT_TIMESTAMP_INDEX])) as unknown[];
-      if (ready.length === 0) {
-        throw new ServiceUnavailableException(
-          `${TENANT_TIMESTAMP_INDEX} is missing or invalid; refusing to run an unindexed scan`,
-        );
-      }
-      return buildSignups((await runner.query(SIGNUPS_SQL, [cutoff])) as SignupRow[]);
-    });
-
-    this.signupsCache.set(days, signups);
-    return signups;
-  }
-
-  /** Pivot waiting-list claims in the window: who converted, and from where. */
-  async getConversions(days: number, now: Date = new Date()): Promise<CrmWaitlistClaim[]> {
-    const cached = this.claimsCache.get(days);
-    if (cached) return cached;
-
-    // `waitlist_claims.claimed_at` is `timestamp WITH time zone`, unlike the
-    // naive `requests.timestamp` below — hence the UTC boundary here.
-    const cutoff = new Date(now.getTime() - days * 86_400_000).toISOString();
-    const claims = await this.withRunner(async (runner) => {
-      const rows = (await runner.query(CLAIMS_SQL, [cutoff])) as CrmWaitlistClaim[];
-      return rows.map((row) => ({
-        email: row.email.toLowerCase(),
-        source: row.source,
-        claimed_at: new Date(row.claimed_at).toISOString(),
-      }));
-    });
-
-    this.claimsCache.set(days, claims);
-    return claims;
-  }
-
-  /**
-   * `SET LOCAL` is transaction-scoped, which is the only form Railway's
-   * PgBouncer accepts (see the note in database.module.ts).
-   */
-  private async withRunner<T>(fn: (runner: QueryRunner) => Promise<T>): Promise<T> {
-    const runner = this.dataSource.createQueryRunner();
-    try {
-      await runner.connect();
-      await runner.startTransaction();
-      try {
-        await runner.query(`SET LOCAL lock_timeout = '${LOCK_TIMEOUT_MS}ms'`);
-        await runner.query(`SET LOCAL statement_timeout = '${STATEMENT_TIMEOUT_MS}ms'`);
-        const result = await fn(runner);
-        await runner.commitTransaction();
-        return result;
-      } catch (error) {
-        await runner.rollbackTransaction();
-        throw error;
-      }
-    } finally {
-      await runner.release();
-    }
-  }
-}
-
-/** Accumulator for the rows belonging to one person. */
-interface Merged {
-  email: string;
-  name: string | null;
-  healed_recent: number;
-  healed_all: number;
-  first_heal_at: number;
-  last_heal_at: number;
-}
-
-/**
- * Local wall clock, not UTC: `requests.timestamp` is `timestamp without time
- * zone` and the pg driver writes JS Dates in the process timezone, so a UTC
- * boundary would be offset by that amount and silently drop rows.
- */
-function cutoffFor(days: number, now: Date): string {
-  return toLocalSqlTimestamp(new Date(now.getTime() - days * 86_400_000));
-}
-
-/**
- * The SQL groups by (email, tenant) and the totals are summed here. Today a
- * user owns at most one tenant (`uq_tenants_owner_user` is unique), so this is
- * a no-op — but `owner_user_id` is nullable by design for future team
- * workspaces, so the 1:1 is a current fact rather than an invariant.
- *
- * Excluded addresses are dropped before their tenants reach the payload.
- */
-function mergeByEmail(rows: CohortRow[]): Map<string, Merged> {
-  const merged = new Map<string, Merged>();
-  for (const row of rows) {
-    const email = row.email.trim().toLowerCase();
-    if (isExcludedEmail(email)) continue;
-
-    const first = new Date(row.first_heal_at).getTime();
-    const last = new Date(row.last_heal_at).getTime();
-    const existing = merged.get(email);
-    if (!existing) {
-      merged.set(email, {
-        email,
-        name: row.user_name,
-        healed_recent: Number(row.healed_recent),
-        healed_all: Number(row.healed_all),
-        first_heal_at: first,
-        last_heal_at: last,
-      });
-      continue;
-    }
-    existing.healed_recent += Number(row.healed_recent);
-    existing.healed_all += Number(row.healed_all);
-    existing.first_heal_at = Math.min(existing.first_heal_at, first);
-    existing.last_heal_at = Math.max(existing.last_heal_at, last);
-    existing.name = existing.name ?? row.user_name;
-  }
-  return merged;
-}
-
-function buildUsers(merged: Map<string, Merged>): CrmHealedUser[] {
-  const users = [...merged.values()].map((entry) => ({
-    email: entry.email,
-    name: entry.name,
-    healed_recent: entry.healed_recent,
-    healed_all: entry.healed_all,
-    first_heal_at: new Date(entry.first_heal_at).toISOString(),
-    last_heal_at: new Date(entry.last_heal_at).toISOString(),
-  }));
-
-  return users.sort((a, b) => b.healed_recent - a.healed_recent);
-}
-
-/**
- * Turns raw signup rows into the payload: drop addresses that are not
- * organisations, drop domains whose signups look scripted, then annotate each
- * survivor with how many people share its domain.
- *
- * Ordered by domain size then recency, so if the CRM ever caps a batch it takes
- * the strongest team signals first.
- */
-function buildSignups(rows: SignupRow[]): CrmCorporateSignup[] {
-  const byDomain = new Map<string, CrmCorporateSignup[]>();
-
-  for (const row of rows) {
-    const email = row.email.trim().toLowerCase();
-    if (!isCorporateSignupEmail(email)) continue;
-
-    const lastRequest = row.last_request_at ? new Date(row.last_request_at) : null;
-    const signup: CrmCorporateSignup = {
-      email,
-      name: row.user_name,
-      domain: domainOf(email),
-      signed_up_at: new Date(row.signed_up_at).toISOString(),
-      last_request_at: lastRequest ? lastRequest.toISOString() : null,
-      has_traffic: lastRequest !== null,
-      // Filled in below, once the domain's full membership is known.
-      domain_signups: 0,
-    };
-
-    const bucket = byDomain.get(signup.domain);
-    if (bucket) bucket.push(signup);
-    else byDomain.set(signup.domain, [signup]);
-  }
-
-  const kept: CrmCorporateSignup[] = [];
-  for (const signups of byDomain.values()) {
-    if (isSignupCluster(signups)) continue;
-    if (isMachineGeneratedDomain(signups.map((s) => s.email.split('@')[0]))) continue;
-    for (const signup of signups) {
-      signup.domain_signups = signups.length;
-      kept.push(signup);
-    }
-  }
-
-  return kept.sort(
-    (a, b) =>
-      b.domain_signups - a.domain_signups ||
-      Date.parse(b.signed_up_at) - Date.parse(a.signed_up_at),
-  );
-}
diff --git a/packages/backend/src/crm-metrics/crm-metrics.types.ts b/packages/backend/src/crm-metrics/crm-metrics.types.ts
deleted file mode 100644
index 175ed194..00000000
--- a/packages/backend/src/crm-metrics/crm-metrics.types.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-/** Shapes returned by the internal CRM metrics feed. */
-
-/** One Manifest user whose failing requests Autofix repaired. */
-export interface CrmHealedUser {
-  /** Lowercased primary address. The CRM dedupes people on this. */
-  email: string;
-  /** Display name from the auth record, or null when never set. */
-  name: string | null;
-  /** Heals inside the requested window — the number worth quoting to them. */
-  healed_recent: number;
-  /** Heals since Autofix shipped, across every tenant this user owns. */
-  healed_all: number;
-  first_heal_at: string;
-  last_heal_at: string;
-}
-
-/** One pivot waiting-list claim: the conversion signal for the campaign. */
-export interface CrmWaitlistClaim {
-  email: string;
-  source: string;
-  claimed_at: string;
-}
-
-/** Raw cohort row, one per (user, tenant) pair, before merging. */
-export interface CohortRow {
-  email: string;
-  user_name: string | null;
-  tenant_id: string;
-  healed_recent: string | number;
-  healed_all: string | number;
-  first_heal_at: Date | string;
-  last_heal_at: Date | string;
-}
-
-/**
- * One corporate signup: a verified user on an organisation domain.
- *
- * Never someone on the pivot waiting list: those people are worked by hand
- * and must not also receive the templated signup email.
- *
- * Deliberately thinner than `CrmHealedUser`. Per-tenant request aggregates
- * (error counts, 30-day volume) cost a heap fetch per row and took 22s across
- * this cohort in production; a single index probe for the latest request is
- * 93ms and answers the only question the copy branches on — has this person
- * ever actually used the gateway.
- */
-export interface CrmCorporateSignup {
-  /** Lowercased primary address. The CRM dedupes people on this. */
-  email: string;
-  /** Display name from the auth record, or null when never set. */
-  name: string | null;
-  /** Lowercased domain part, so the CRM can group people onto a company. */
-  domain: string;
-  signed_up_at: string;
-  /** Null when this tenant has never sent a request. */
-  last_request_at: string | null;
-  /** `last_request_at !== null`, precomputed so template branching is trivial. */
-  has_traffic: boolean;
-  /** Verified signups sharing this domain — the "team behind it" signal. */
-  domain_signups: number;
-}
-
-/** Raw signup row, one per (user, tenant) pair, before filtering. */
-export interface SignupRow {
-  email: string;
-  user_name: string | null;
-  signed_up_at: Date | string;
-  last_request_at: Date | string | null;
-}
diff --git a/packages/backend/src/crm-metrics/dto/crm-metrics-query.dto.spec.ts b/packages/backend/src/crm-metrics/dto/crm-metrics-query.dto.spec.ts
deleted file mode 100644
index d9ff3a01..00000000
--- a/packages/backend/src/crm-metrics/dto/crm-metrics-query.dto.spec.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-import 'reflect-metadata';
-import { plainToInstance } from 'class-transformer';
-import { validateSync } from 'class-validator';
-import { CrmMetricsQueryDto } from './crm-metrics-query.dto';
-
-function parse(query: Record<string, unknown>): CrmMetricsQueryDto {
-  return plainToInstance(CrmMetricsQueryDto, query, { enableImplicitConversion: false });
-}
-
-describe('CrmMetricsQueryDto', () => {
-  it('coerces the query string into a number', () => {
-    const dto = parse({ days: '30' });
-
-    expect(dto.days).toBe(30);
-    expect(validateSync(dto)).toHaveLength(0);
-  });
-
-  it('allows the parameter to be omitted', () => {
-    const dto = parse({});
-
-    expect(dto.days).toBeUndefined();
-    expect(validateSync(dto)).toHaveLength(0);
-  });
-
-  it('accepts the window bounds', () => {
-    expect(validateSync(parse({ days: '1' }))).toHaveLength(0);
-    expect(validateSync(parse({ days: '365' }))).toHaveLength(0);
-  });
-
-  it('rejects a window outside the bounds', () => {
-    expect(validateSync(parse({ days: '0' }))).not.toHaveLength(0);
-    expect(validateSync(parse({ days: '366' }))).not.toHaveLength(0);
-  });
-
-  it('rejects a non-integer window', () => {
-    expect(validateSync(parse({ days: '7.5' }))).not.toHaveLength(0);
-    expect(validateSync(parse({ days: 'lots' }))).not.toHaveLength(0);
-  });
-});
diff --git a/packages/backend/src/crm-metrics/dto/crm-metrics-query.dto.ts b/packages/backend/src/crm-metrics/dto/crm-metrics-query.dto.ts
deleted file mode 100644
index b0414d3d..00000000
--- a/packages/backend/src/crm-metrics/dto/crm-metrics-query.dto.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { Type } from 'class-transformer';
-import { IsInt, IsOptional, Max, Min } from 'class-validator';
-
-/**
- * Window selector for both CRM metrics routes.
- *
- * The global ValidationPipe runs with `whitelist` + `forbidNonWhitelisted`, so
- * anything not declared here makes the request 400. `@Type` is what coerces the
- * query string into a number.
- *
- * A day count rather than an ISO `since`: this backend has no `@IsDateString`
- * precedent, and the payload already carries `first_heal_at` / `last_heal_at`
- * per user, so a consumer that wants a delta can compute one itself.
- */
-export class CrmMetricsQueryDto {
-  @IsOptional()
-  @IsInt()
-  @Min(1)
-  @Max(365)
-  @Type(() => Number)
-  days?: number;
-}
diff --git a/packages/backend/src/crm-metrics/internal-crm-metrics.controller.spec.ts b/packages/backend/src/crm-metrics/internal-crm-metrics.controller.spec.ts
deleted file mode 100644
index 8d6996d3..00000000
--- a/packages/backend/src/crm-metrics/internal-crm-metrics.controller.spec.ts
+++ /dev/null
@@ -1,271 +0,0 @@
-import {
-  Logger,
-  NotFoundException,
-  ServiceUnavailableException,
-  UnauthorizedException,
-} from '@nestjs/common';
-import type { ConfigService } from '@nestjs/config';
-import { InternalCrmMetricsController } from './internal-crm-metrics.controller';
-import type { CrmMetricsService } from './crm-metrics.service';
-import { isSelfHosted } from '../common/utils/detect-self-hosted';
-
-jest.mock('../common/utils/detect-self-hosted', () => ({ isSelfHosted: jest.fn() }));
-const mockedIsSelfHosted = jest.mocked(isSelfHosted);
-
-const SECRET = 'a'.repeat(32);
-const IP = '203.0.113.7';
-
-function makeConfig(secret: string | undefined): ConfigService {
-  return {
-    get: jest.fn((key: string) => (key === 'app.crmMetricsSecret' ? secret : undefined)),
-  } as unknown as ConfigService;
-}
-
-describe('InternalCrmMetricsController', () => {
-  let mockService: {
-    getHealedCohort: jest.Mock;
-    getConversions: jest.Mock;
-    getCorporateSignups: jest.Mock;
-  };
-  let warn: jest.SpyInstance;
-
-  beforeEach(() => {
-    mockService = {
-      getHealedCohort: jest.fn(),
-      getConversions: jest.fn(),
-      getCorporateSignups: jest.fn(),
-    };
-    warn = jest.spyOn(Logger.prototype, 'warn').mockImplementation();
-    mockedIsSelfHosted.mockReturnValue(false);
-  });
-
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  function makeController(secret: string | undefined): InternalCrmMetricsController {
-    return new InternalCrmMetricsController(
-      mockService as unknown as CrmMetricsService,
-      makeConfig(secret),
-    );
-  }
-
-  describe('secret rejection', () => {
-    it('rejects when the header is missing', async () => {
-      const controller = makeController(SECRET);
-
-      await expect(
-        controller.cohort(undefined as unknown as string, IP, {}),
-      ).rejects.toBeInstanceOf(UnauthorizedException);
-      expect(mockService.getHealedCohort).not.toHaveBeenCalled();
-    });
-
-    it('rejects when the header is wrong', async () => {
-      const controller = makeController(SECRET);
-
-      await expect(controller.cohort('b'.repeat(32), IP, {})).rejects.toBeInstanceOf(
-        UnauthorizedException,
-      );
-      expect(mockService.getHealedCohort).not.toHaveBeenCalled();
-    });
-
-    it('rejects when the header is the right value but the wrong length', async () => {
-      const controller = makeController(SECRET);
-
-      await expect(controller.cohort('a'.repeat(31), IP, {})).rejects.toBeInstanceOf(
-        UnauthorizedException,
-      );
-      expect(mockService.getHealedCohort).not.toHaveBeenCalled();
-    });
-
-    it('leaks neither the configured nor the provided secret when it rejects', async () => {
-      // Same length on both sides, so the constant-time compare runs rather
-      // than the length shortcut.
-      const configured = 'configured-secret'.padEnd(40, 'x');
-      const provided = 'provided-secret'.padEnd(40, 'y');
-
-      const error = await makeController(configured)
-        .cohort(provided, IP, {})
-        .then(
-          () => null,
-          (thrown: unknown) => thrown as UnauthorizedException,
-        );
-
-      expect(error).toBeInstanceOf(UnauthorizedException);
-      expect(error?.message).toBe('Invalid or missing internal secret');
-      const surfaced = `${error?.message} ${JSON.stringify(error?.getResponse())}`;
-      expect(surfaced).not.toContain(configured);
-      expect(surfaced).not.toContain(provided);
-      // The rejection log is the other place a secret could end up.
-      const logged = JSON.stringify(warn.mock.calls);
-      expect(logged).not.toContain(configured);
-      expect(logged).not.toContain(provided);
-    });
-
-    it('rejects when no secret is configured', async () => {
-      await expect(makeController(undefined).cohort('anything', IP, {})).rejects.toBeInstanceOf(
-        UnauthorizedException,
-      );
-      await expect(makeController('').cohort('', IP, {})).rejects.toBeInstanceOf(
-        UnauthorizedException,
-      );
-      expect(mockService.getHealedCohort).not.toHaveBeenCalled();
-    });
-
-    it('treats a secret shorter than 32 chars as unconfigured, even on an exact match', async () => {
-      const weak = 'short-secret';
-
-      await expect(makeController(weak).cohort(weak, IP, {})).rejects.toBeInstanceOf(
-        UnauthorizedException,
-      );
-    });
-
-    it('guards the conversions route too', async () => {
-      const controller = makeController(SECRET);
-
-      await expect(controller.conversions('nope', IP, {})).rejects.toBeInstanceOf(
-        UnauthorizedException,
-      );
-      expect(mockService.getConversions).not.toHaveBeenCalled();
-    });
-
-    it('guards the signups route too', async () => {
-      const controller = makeController(SECRET);
-
-      await expect(controller.signups('nope', IP, {})).rejects.toBeInstanceOf(
-        UnauthorizedException,
-      );
-      expect(mockService.getCorporateSignups).not.toHaveBeenCalled();
-    });
-
-    it('logs the source ip of a rejected attempt', async () => {
-      await expect(makeController(SECRET).cohort('nope', IP, {})).rejects.toThrow();
-
-      expect(warn).toHaveBeenCalledWith(`Rejected CRM metrics request from ${IP}`);
-    });
-  });
-
-  describe('cohort', () => {
-    it('defaults to a 7 day window', async () => {
-      const users = [{ email: 'a@b.com' }];
-      mockService.getHealedCohort.mockResolvedValue(users);
-
-      const result = await makeController(SECRET).cohort(SECRET, IP, {});
-
-      expect(result).toBe(users);
-      expect(mockService.getHealedCohort).toHaveBeenCalledWith(7);
-    });
-
-    it('passes an explicit window through', async () => {
-      mockService.getHealedCohort.mockResolvedValue([]);
-
-      await makeController(SECRET).cohort(SECRET, IP, { days: 30 });
-
-      expect(mockService.getHealedCohort).toHaveBeenCalledWith(30);
-    });
-
-    it('propagates an unavailable index instead of answering with an empty cohort', async () => {
-      mockService.getHealedCohort.mockRejectedValue(
-        new ServiceUnavailableException('IDX_requests_autofix_healed is missing or invalid'),
-      );
-
-      // A 503 is the signal the CRM needs to keep yesterday's list; a 200 with
-      // `[]` reads as "nobody was healed today".
-      await expect(makeController(SECRET).cohort(SECRET, IP, {})).rejects.toBeInstanceOf(
-        ServiceUnavailableException,
-      );
-    });
-  });
-
-  describe('signups', () => {
-    it('defaults to the full 365 day history', async () => {
-      const signups = [{ email: 'ada@stripe.com' }];
-      mockService.getCorporateSignups.mockResolvedValue(signups);
-
-      const result = await makeController(SECRET).signups(SECRET, IP, {});
-
-      expect(result).toBe(signups);
-      expect(mockService.getCorporateSignups).toHaveBeenCalledWith(365);
-    });
-
-    it('passes an explicit window through', async () => {
-      mockService.getCorporateSignups.mockResolvedValue([]);
-
-      await makeController(SECRET).signups(SECRET, IP, { days: 30 });
-
-      expect(mockService.getCorporateSignups).toHaveBeenCalledWith(30);
-    });
-
-    it('propagates an unavailable index instead of answering with an empty list', async () => {
-      mockService.getCorporateSignups.mockRejectedValue(
-        new ServiceUnavailableException('IDX_requests_tenant_timestamp is missing or invalid'),
-      );
-
-      await expect(makeController(SECRET).signups(SECRET, IP, {})).rejects.toBeInstanceOf(
-        ServiceUnavailableException,
-      );
-    });
-  });
-
-  describe('conversions', () => {
-    it('defaults to a 90 day window', async () => {
-      const claims = [{ email: 'a@b.com', source: 'cloud', claimed_at: 'x' }];
-      mockService.getConversions.mockResolvedValue(claims);
-
-      const result = await makeController(SECRET).conversions(SECRET, IP, {});
-
-      expect(result).toBe(claims);
-      expect(mockService.getConversions).toHaveBeenCalledWith(90);
-    });
-
-    it('passes an explicit window through', async () => {
-      mockService.getConversions.mockResolvedValue([]);
-
-      await makeController(SECRET).conversions(SECRET, IP, { days: 14 });
-
-      expect(mockService.getConversions).toHaveBeenCalledWith(14);
-    });
-  });
-
-  describe('self-hosted', () => {
-    // app.module.ts normally leaves the module unregistered, but that check
-    // runs before ConfigModule loads `.env`. This one resolves at construction,
-    // so a bare-metal install carrying MANIFEST_MODE only in `.env` is covered.
-    it('answers like an unmounted route on both endpoints', async () => {
-      mockedIsSelfHosted.mockReturnValue(true);
-      const controller = makeController(SECRET);
-
-      await expect(controller.cohort(SECRET, IP, {})).rejects.toBeInstanceOf(NotFoundException);
-      await expect(controller.conversions(SECRET, IP, {})).rejects.toBeInstanceOf(
-        NotFoundException,
-      );
-      await expect(controller.signups(SECRET, IP, {})).rejects.toBeInstanceOf(NotFoundException);
-      expect(mockService.getHealedCohort).not.toHaveBeenCalled();
-      expect(mockService.getConversions).not.toHaveBeenCalled();
-      expect(mockService.getCorporateSignups).not.toHaveBeenCalled();
-    });
-
-    it('checks the mode before the secret, so it never reveals whether one is set', async () => {
-      mockedIsSelfHosted.mockReturnValue(true);
-
-      // No secret configured at all: a Cloud install would answer 401 here.
-      await expect(makeController(undefined).cohort('anything', IP, {})).rejects.toBeInstanceOf(
-        NotFoundException,
-      );
-      expect(warn).not.toHaveBeenCalled();
-    });
-
-    it('resolves the mode once, at construction', async () => {
-      mockedIsSelfHosted.mockReturnValue(false);
-      const controller = makeController(SECRET);
-      mockService.getHealedCohort.mockResolvedValue([]);
-      const callsAfterConstruction = mockedIsSelfHosted.mock.calls.length;
-      mockedIsSelfHosted.mockReturnValue(true);
-
-      // A later flip must not change an already-built controller's behaviour,
-      // and serving a request must not re-read the mode.
-      await expect(controller.cohort(SECRET, IP, {})).resolves.toEqual([]);
-      expect(mockedIsSelfHosted.mock.calls).toHaveLength(callsAfterConstruction);
-    });
-  });
-});
diff --git a/packages/backend/src/crm-metrics/internal-crm-metrics.controller.ts b/packages/backend/src/crm-metrics/internal-crm-metrics.controller.ts
deleted file mode 100644
index 8b29f890..00000000
--- a/packages/backend/src/crm-metrics/internal-crm-metrics.controller.ts
+++ /dev/null
@@ -1,138 +0,0 @@
-import {
-  Controller,
-  Get,
-  Headers,
-  Ip,
-  Logger,
-  NotFoundException,
-  Query,
-  UnauthorizedException,
-} from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { Public } from '../common/decorators/public.decorator';
-import { timingSafeCompare } from '../common/utils/crypto.util';
-import { isSelfHosted } from '../common/utils/detect-self-hosted';
-import { CrmMetricsService } from './crm-metrics.service';
-import { CrmMetricsQueryDto } from './dto/crm-metrics-query.dto';
-import type { CrmCorporateSignup, CrmHealedUser, CrmWaitlistClaim } from './crm-metrics.types';
-
-/**
- * Internal read API for the CRM outreach pipeline.
- *
- * `@Public()` to skip the session/api-key guards, then gated by a shared secret
- * in the `x-internal-secret` header. Lives under /api/* so the SPA static
- * fallback never shadows it.
- *
- * This is the first Manifest endpoint that exports user email addresses across
- * tenants, so it is deliberately stricter than the error-pages sibling it is
- * modelled on: the comparison is constant-time, and a secret too short to be
- * worth anything counts as unconfigured rather than as a weak guard on a full
- * user list. Nothing here logs the payload.
- *
- * Cloud only. app.module.ts already leaves the module unregistered on
- * self-hosted, but that check runs at import time, before ConfigModule reads
- * `.env` — so a bare-metal install carrying `MANIFEST_MODE` only in its `.env`
- * would look like Cloud there. Containers are unaffected (`/.dockerenv` is
- * detected without any env), but this second check closes the gap: it resolves
- * at construction, after configuration is loaded.
- */
-@Controller('api/v1/internal/crm-metrics')
-export class InternalCrmMetricsController {
-  /** Below this, a configured value is treated as absent. */
-  private static readonly MIN_SECRET_LENGTH = 32;
-  private static readonly DEFAULT_COHORT_DAYS = 7;
-  private static readonly DEFAULT_CLAIM_DAYS = 90;
-  /**
-   * The widest window `CrmMetricsQueryDto` allows, which today is every signup
-   * ever (the first one is from February 2026).
-   *
-   * Wide on purpose: the signup campaign emails each person once ever and
-   * remembers who in the CRM rather than via a window, so a narrow default
-   * would strand anyone a late or failed run skipped. Once Manifest is more
-   * than a year old this stops being the full history, and someone who was
-   * never successfully contacted before ageing out would be missed. Raise the
-   * DTO cap then rather than assuming this number still means "everyone".
-   */
-  private static readonly DEFAULT_SIGNUP_DAYS = 365;
-
-  private readonly logger = new Logger(InternalCrmMetricsController.name);
-
-  /** Resolved once at construction, which is after ConfigModule loads `.env`. */
-  private readonly selfHosted = isSelfHosted();
-
-  constructor(
-    private readonly service: CrmMetricsService,
-    private readonly config: ConfigService,
-  ) {}
-
-  /**
-   * Answer exactly as an unmounted route would. Checked before the secret so a
-   * self-hosted install never reveals whether one is configured.
-   */
-  private assertCloud(): void {
-    if (this.selfHosted) throw new NotFoundException();
-  }
-
-  private assertSecret(provided: string | undefined, ip: string): void {
-    const expected = this.config.get<string>('app.crmMetricsSecret') ?? '';
-    const configured = expected.length >= InternalCrmMetricsController.MIN_SECRET_LENGTH;
-    if (!configured || !timingSafeCompare(provided ?? '', expected)) {
-      this.logger.warn(`Rejected CRM metrics request from ${ip}`);
-      throw new UnauthorizedException('Invalid or missing internal secret');
-    }
-  }
-
-  /** Users whose failing requests Autofix repaired inside the window. */
-  @Public()
-  @Get()
-  async cohort(
-    @Headers('x-internal-secret') secret: string,
-    @Ip() ip: string,
-    @Query() query: CrmMetricsQueryDto,
-  ): Promise<CrmHealedUser[]> {
-    this.assertCloud();
-    this.assertSecret(secret, ip);
-    return this.service.getHealedCohort(
-      query.days ?? InternalCrmMetricsController.DEFAULT_COHORT_DAYS,
-    );
-  }
-
-  /**
-   * Verified signups on organisation domains — the Autofix outreach cohort.
-   *
-   * A corporate address implies a team, and a team calling third-party APIs is
-   * the product's audience whether or not they ever routed an LLM request
-   * through the gateway. `has_traffic` is what the copy branches on.
-   *
-   * Excludes anyone who claimed the pivot waiting list: that cohort is worked
-   * by hand and lives on the `conversions` route.
-   */
-  @Public()
-  @Get('signups')
-  async signups(
-    @Headers('x-internal-secret') secret: string,
-    @Ip() ip: string,
-    @Query() query: CrmMetricsQueryDto,
-  ): Promise<CrmCorporateSignup[]> {
-    this.assertCloud();
-    this.assertSecret(secret, ip);
-    return this.service.getCorporateSignups(
-      query.days ?? InternalCrmMetricsController.DEFAULT_SIGNUP_DAYS,
-    );
-  }
-
-  /** Pivot waiting-list claims — the campaign's conversion signal. */
-  @Public()
-  @Get('conversions')
-  async conversions(
-    @Headers('x-internal-secret') secret: string,
-    @Ip() ip: string,
-    @Query() query: CrmMetricsQueryDto,
-  ): Promise<CrmWaitlistClaim[]> {
-    this.assertCloud();
-    this.assertSecret(secret, ip);
-    return this.service.getConversions(
-      query.days ?? InternalCrmMetricsController.DEFAULT_CLAIM_DAYS,
-    );
-  }
-}
diff --git a/packages/backend/src/database/data-source-definitions.ts b/packages/backend/src/database/data-source-definitions.ts
index c8c2c0db..ec921e84 100644
--- a/packages/backend/src/database/data-source-definitions.ts
+++ b/packages/backend/src/database/data-source-definitions.ts
@@ -24,8 +24,6 @@ import { PlaygroundRun } from '../entities/playground-run.entity';
 import { PlaygroundColumn } from '../entities/playground-column.entity';
 import { ReasoningContentCacheEntry } from '../entities/reasoning-content-cache-entry.entity';
 import { AgentEnabledProvider } from '../entities/agent-enabled-provider.entity';
-import { PublicErrorPage } from '../entities/public-error-page.entity';
-import { WaitlistClaim } from '../entities/waitlist-claim.entity';
 import { CliAuthCode } from '../entities/cli-auth-code.entity';
 import { AgentUsageDaily } from '../entities/agent-usage-daily.entity';
 import { RenameWaitlistClaimsTable1800000000000 } from './migrations/1800000000000-RenameWaitlistClaimsTable';
@@ -57,6 +55,7 @@ import { AddAgentMessagesDirectUsageIndex1802900000000 } from './migrations/1802
 import { CoverRequestsLogFilters1803000000000 } from './migrations/1803000000000-CoverRequestsLogFilters';
 import { CoverHarnessRequestsIndex1803100000000 } from './migrations/1803100000000-CoverHarnessRequestsIndex';
 import { DropBillingSchema1803200000000 } from './migrations/1803200000000-DropBillingSchema';
+import { DropSaasFeatureSchema1803300000000 } from './migrations/1803300000000-DropSaasFeatureSchema';
 import { InitialSchema1771464895790 } from './migrations/1771464895790-InitialSchema';
 import { HashApiKeys1771500000000 } from './migrations/1771500000000-HashApiKeys';
 import { ModelPricingImprovements1771600000000 } from './migrations/1771600000000-ModelPricingImprovements';
@@ -198,8 +197,6 @@ export const entities = [
   ReasoningContentCacheEntry,
   AgentEnabledProvider,
   BackfillState,
-  PublicErrorPage,
-  WaitlistClaim,
   CliAuthCode,
   AgentUsageDaily,
 ];
@@ -352,4 +349,5 @@ export const migrations = [
   CoverRequestsLogFilters1803000000000,
   CoverHarnessRequestsIndex1803100000000,
   DropBillingSchema1803200000000,
+  DropSaasFeatureSchema1803300000000,
 ];
diff --git a/packages/backend/src/database/index-rebuild.ts b/packages/backend/src/database/index-rebuild.ts
index eb8d5284..75bc79bb 100644
--- a/packages/backend/src/database/index-rebuild.ts
+++ b/packages/backend/src/database/index-rebuild.ts
@@ -3,7 +3,7 @@ import type { QueryRunner } from 'typeorm';
 /** An index rebuilt in place: same name, same key, with or without INCLUDE columns. */
 export interface InPlaceIndex {
   table: string;
-  /** Live name; callers such as the CRM metrics check look it up by name. */
+  /** Live name; kept across the rebuild so anything that looks it up by name still finds it. */
   index: string;
   /** Temporary name the replacement is built under before the swap. */
   build: string;
diff --git a/packages/backend/src/database/migrations/1803300000000-DropSaasFeatureSchema.spec.ts b/packages/backend/src/database/migrations/1803300000000-DropSaasFeatureSchema.spec.ts
new file mode 100644
index 00000000..11026996
--- /dev/null
+++ b/packages/backend/src/database/migrations/1803300000000-DropSaasFeatureSchema.spec.ts
@@ -0,0 +1,45 @@
+import { DropSaasFeatureSchema1803300000000 } from './1803300000000-DropSaasFeatureSchema';
+
+async function run(direction: 'up' | 'down'): Promise<string[]> {
+  const query = jest.fn(async () => []);
+  await new DropSaasFeatureSchema1803300000000()[direction]({ query } as never);
+  return query.mock.calls.map((call) => String((call as unknown[])[0]));
+}
+
+describe('DropSaasFeatureSchema1803300000000', () => {
+  it('sets a transaction-local lock timeout before taking any lock', async () => {
+    const sql = await run('up');
+
+    expect(sql[0]).toBe(`SET LOCAL lock_timeout = '10s'`);
+  });
+
+  it('removes Gemini Free grants before the connections they point at', async () => {
+    const sql = await run('up');
+    const at = (fragment: string) => sql.findIndex((statement) => statement.includes(fragment));
+
+    const grants = at('DELETE FROM "agent_enabled_providers"');
+    const connections = at('DELETE FROM "tenant_providers"');
+    expect(grants).toBeGreaterThan(0);
+    expect(connections).toBeGreaterThan(grants);
+    expect(sql[connections]).toContain(`LOWER("provider") = 'gemini-free'`);
+  });
+
+  it('drops the SaaS tables and the CRM index idempotently', async () => {
+    const sql = (await run('up')).join('\n');
+
+    expect(sql).toContain('DROP TABLE IF EXISTS "waitlist_claims"');
+    expect(sql).toContain('DROP TABLE IF EXISTS "public_error_pages"');
+    expect(sql).toContain('DROP INDEX IF EXISTS "IDX_requests_autofix_healed"');
+    expect(sql).not.toMatch(/DROP (TABLE|INDEX) (?!IF EXISTS)/);
+  });
+
+  it('restores the self-hosted tables on revert, without the CRM index', async () => {
+    const sql = (await run('down')).join('\n');
+
+    expect(sql).toContain('CREATE TABLE IF NOT EXISTS "waitlist_claims"');
+    expect(sql).toContain('CONSTRAINT "UQ_waitlist_claims_email" UNIQUE ("email")');
+    expect(sql).toContain('CREATE TABLE IF NOT EXISTS "public_error_pages"');
+    expect(sql).not.toContain('IDX_requests_autofix_healed');
+    expect(sql).not.toContain('SET LOCAL');
+  });
+});
diff --git a/packages/backend/src/database/migrations/1803300000000-DropSaasFeatureSchema.ts b/packages/backend/src/database/migrations/1803300000000-DropSaasFeatureSchema.ts
new file mode 100644
index 00000000..7efb4f41
--- /dev/null
+++ b/packages/backend/src/database/migrations/1803300000000-DropSaasFeatureSchema.ts
@@ -0,0 +1,86 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+/**
+ * Drops the schema left behind by the removed Manifest Cloud and marketing
+ * features (waitlist, CRM metrics feed, public error pages, managed Gemini
+ * Free):
+ *
+ * - `waitlist_claims` (the pivot/Autofix waitlist) and `public_error_pages`
+ *   (the marketing site's mirror pushed by the Peacock CMS). Their indexes and
+ *   constraints go with them.
+ * - `IDX_requests_autofix_healed`, the index that only served the CRM feed.
+ *   1802200000000 built it in cloud mode only, so on a self-hosted database
+ *   the drop is a no-op that never touches `requests`.
+ * - Every `tenant_providers` connection to the managed `gemini-free` provider.
+ *   Its endpoint (credits.manifest.build) and provider id no longer exist, so
+ *   the stored LiteLLM virtual key can never be used again; keeping the row
+ *   would leave a connection the dashboard cannot render and the proxy cannot
+ *   route. Agent grants in `agent_enabled_providers` are deleted with it, and
+ *   `agent_messages.tenant_provider_id` is nulled by its ON DELETE SET NULL
+ *   foreign key, so history keeps its `provider = 'gemini-free'` label. Routes
+ *   that still name the provider resolve as unavailable and fall through to
+ *   their fallbacks, exactly as after a manual disconnect.
+ *
+ * `lock_timeout` makes the migration fail fast instead of queueing behind a
+ * long-running query while holding up writes to the tables it locks; a failed
+ * run is retried on the next boot. Every statement is idempotent.
+ *
+ * `down()` restores the two tables as the earlier migrations created them on
+ * the self-hosted path, empty. The CRM index was never part of that path, and
+ * the deleted connections cannot be restored.
+ */
+export class DropSaasFeatureSchema1803300000000 implements MigrationInterface {
+  name = 'DropSaasFeatureSchema1803300000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`SET LOCAL lock_timeout = '10s'`);
+    await queryRunner.query(
+      `DELETE FROM "agent_enabled_providers" WHERE "tenant_provider_id" IN (
+         SELECT "id" FROM "tenant_providers" WHERE LOWER("provider") = 'gemini-free'
+       )`,
+    );
+    await queryRunner.query(
+      `DELETE FROM "tenant_providers" WHERE LOWER("provider") = 'gemini-free'`,
+    );
+    await queryRunner.query(`DROP INDEX IF EXISTS "IDX_requests_autofix_healed"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "waitlist_claims"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "public_error_pages"`);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      CREATE TABLE IF NOT EXISTS "waitlist_claims" (
+        "id" uuid DEFAULT gen_random_uuid() NOT NULL,
+        "email" varchar NOT NULL,
+        "source" varchar NOT NULL DEFAULT 'self-hosted',
+        "claimed_at" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+        CONSTRAINT "PK_waitlist_claims" PRIMARY KEY ("id"),
+        CONSTRAINT "UQ_waitlist_claims_email" UNIQUE ("email")
+      )
+    `);
+    await queryRunner.query(`
+      CREATE TABLE IF NOT EXISTS "public_error_pages" (
+        "slug" varchar PRIMARY KEY,
+        "cluster_key" varchar NOT NULL,
+        "provider" varchar NOT NULL,
+        "provider_label" varchar NOT NULL DEFAULT '',
+        "http_status" integer,
+        "category" varchar NOT NULL DEFAULT 'unknown',
+        "category_label" varchar NOT NULL DEFAULT '',
+        "title" varchar NOT NULL,
+        "meta_description" varchar NOT NULL,
+        "h1" varchar NOT NULL,
+        "body_what" text NOT NULL DEFAULT '',
+        "body_fix" text NOT NULL DEFAULT '',
+        "body_manifest" text NOT NULL DEFAULT '',
+        "sample_message" text NOT NULL DEFAULT '',
+        "faq" jsonb NOT NULL DEFAULT '[]'::jsonb,
+        "stats" jsonb NOT NULL DEFAULT '{}'::jsonb,
+        "related" jsonb NOT NULL DEFAULT '[]'::jsonb,
+        "noindex" boolean NOT NULL DEFAULT false,
+        "published_at" TIMESTAMP NOT NULL DEFAULT now(),
+        "updated_at" TIMESTAMP NOT NULL DEFAULT now()
+      )
+    `);
+  }
+}
diff --git a/packages/backend/src/entities/public-error-page.entity.ts b/packages/backend/src/entities/public-error-page.entity.ts
deleted file mode 100644
index 5683237c..00000000
--- a/packages/backend/src/entities/public-error-page.entity.ts
+++ /dev/null
@@ -1,105 +0,0 @@
-import { Entity, Column, PrimaryColumn } from 'typeorm';
-import { timestampType } from '../common/utils/postgres-sql';
-
-/** A single question/answer pair rendered into FAQPage structured data. */
-export interface ErrorPageFaqItem {
-  q: string;
-  a: string;
-}
-
-/** One day of the occurrence sparkline shown on the public page. */
-export interface ErrorPageTrendPoint {
-  date: string; // YYYY-MM-DD
-  count: number;
-}
-
-/**
- * Aggregate, non-identifying stats snapshot for the cluster. Pushed from the
- * Peacock CMS and refreshed on its hourly rollup. `tenants` is the k-anonymity
- * signal — a page is never published below MIN_TENANTS_FOR_PUBLIC distinct teams.
- */
-export interface ErrorPageStats {
-  tenants: number;
-  volume_7d: number;
-  volume_30d: number;
-  recovery_rate: number | null; // 0..1 — share auto-recovered by a Manifest fallback
-  last_seen: string | null; // ISO timestamp
-  trend: ErrorPageTrendPoint[];
-  variants?: string[]; // distinct message wordings for the same cluster ("Also seen as")
-}
-
-export interface ErrorPageRelatedLink {
-  slug: string;
-  title: string;
-}
-
-/**
- * A published, operator-approved error-cluster page served to the public
- * marketing site. This table is a READ-OPTIMISED MIRROR: it only ever holds
- * rows that an operator explicitly published from the Peacock CMS (pushed via
- * the secret-guarded internal endpoint). There is no code path from raw
- * `agent_messages` to this table — that is the trust boundary that keeps
- * un-curated error data private.
- */
-@Entity('public_error_pages')
-export class PublicErrorPage {
-  @PrimaryColumn('varchar')
-  slug!: string;
-
-  @Column('varchar')
-  cluster_key!: string;
-
-  @Column('varchar')
-  provider!: string;
-
-  @Column('varchar', { default: '' })
-  provider_label!: string;
-
-  @Column('integer', { nullable: true })
-  http_status!: number | null;
-
-  @Column('varchar', { default: 'unknown' })
-  category!: string;
-
-  @Column('varchar', { default: '' })
-  category_label!: string;
-
-  @Column('varchar')
-  title!: string;
-
-  @Column('varchar')
-  meta_description!: string;
-
-  @Column('varchar')
-  h1!: string;
-
-  @Column('text', { default: '' })
-  body_what!: string;
-
-  @Column('text', { default: '' })
-  body_fix!: string;
-
-  @Column('text', { default: '' })
-  body_manifest!: string;
-
-  @Column('text', { default: '' })
-  sample_message!: string;
-
-  @Column('jsonb')
-  faq!: ErrorPageFaqItem[];
-
-  @Column('jsonb')
-  stats!: ErrorPageStats;
-
-  @Column('jsonb')
-  related!: ErrorPageRelatedLink[];
-
-  @Column('boolean', { default: false })
-  noindex!: boolean;
-
-  @Column(timestampType())
-  published_at!: string;
-
-  @Column(timestampType())
-  updated_at!: string;
-}
diff --git a/packages/backend/src/entities/waitlist-claim.entity.ts b/packages/backend/src/entities/waitlist-claim.entity.ts
deleted file mode 100644
index 21a8d6c8..00000000
--- a/packages/backend/src/entities/waitlist-claim.entity.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { Entity, Column, PrimaryGeneratedColumn } from 'typeorm';
-
-@Entity('waitlist_claims')
-export class WaitlistClaim {
-  @PrimaryGeneratedColumn('uuid')
-  id!: string;
-
-  @Column('varchar', { unique: true })
-  email!: string;
-
-  @Column('varchar', { default: 'self-hosted' })
-  source!: string;
-
-  @Column('timestamp with time zone', { default: () => 'now()' })
-  claimed_at!: string;
-}
diff --git a/packages/backend/src/error-pages/dto/upsert-error-page.dto.ts b/packages/backend/src/error-pages/dto/upsert-error-page.dto.ts
deleted file mode 100644
index c07536d5..00000000
--- a/packages/backend/src/error-pages/dto/upsert-error-page.dto.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import { IsArray, IsBoolean, IsInt, IsObject, IsOptional, IsString } from 'class-validator';
-import type {
-  ErrorPageFaqItem,
-  ErrorPageRelatedLink,
-  ErrorPageStats,
-} from '../../entities/public-error-page.entity';
-
-/**
- * Payload the Peacock CMS pushes to publish (or re-publish/refresh) a page.
- * The global ValidationPipe runs with whitelist + forbidNonWhitelisted, so every
- * accepted field must be declared here; nested objects are validated loosely
- * (the push is a trusted, secret-guarded internal call, and the service
- * re-scrubs + re-validates the k-anonymity floor defensively).
- */
-export class UpsertErrorPageDto {
-  @IsString() slug!: string;
-  @IsString() cluster_key!: string;
-  @IsString() provider!: string;
-  @IsOptional() @IsString() provider_label?: string;
-  @IsOptional() @IsInt() http_status?: number | null;
-  @IsOptional() @IsString() category?: string;
-  @IsOptional() @IsString() category_label?: string;
-  @IsString() title!: string;
-  @IsString() meta_description!: string;
-  @IsString() h1!: string;
-  @IsOptional() @IsString() body_what?: string;
-  @IsOptional() @IsString() body_fix?: string;
-  @IsOptional() @IsString() body_manifest?: string;
-  @IsOptional() @IsString() sample_message?: string;
-  @IsOptional() @IsArray() faq?: ErrorPageFaqItem[];
-  @IsObject() stats!: ErrorPageStats;
-  @IsOptional() @IsArray() related?: ErrorPageRelatedLink[];
-  @IsOptional() @IsBoolean() noindex?: boolean;
-}
diff --git a/packages/backend/src/error-pages/error-cluster-seeder.service.spec.ts b/packages/backend/src/error-pages/error-cluster-seeder.service.spec.ts
deleted file mode 100644
index 7c8dc9fe..00000000
--- a/packages/backend/src/error-pages/error-cluster-seeder.service.spec.ts
+++ /dev/null
@@ -1,122 +0,0 @@
-import { ErrorClusterSeederService } from './error-cluster-seeder.service';
-
-/**
- * Build a fake repo whose query-builder chain resolves `getCount()` to the
- * supplied value, and whose `insert` records every batch it receives.
- */
-function makeRepo(existingCount: number) {
-  const qb = {
-    where: jest.fn().mockReturnThis(),
-    getCount: jest.fn().mockResolvedValue(existingCount),
-  };
-  const insert = jest.fn().mockResolvedValue(undefined);
-  const repo = {
-    createQueryBuilder: jest.fn().mockReturnValue(qb),
-    insert,
-  };
-  return { repo, qb, insert };
-}
-
-describe('ErrorClusterSeederService', () => {
-  const original = process.env['SEED_DATA'];
-
-  afterEach(() => {
-    if (original === undefined) delete process.env['SEED_DATA'];
-    else process.env['SEED_DATA'] = original;
-    jest.restoreAllMocks();
-  });
-
-  it('returns early without querying when SEED_DATA is unset', async () => {
-    delete process.env['SEED_DATA'];
-    const { repo, insert } = makeRepo(0);
-    const service = new ErrorClusterSeederService(repo as never);
-
-    await service.onModuleInit();
-
-    expect(repo.createQueryBuilder).not.toHaveBeenCalled();
-    expect(insert).not.toHaveBeenCalled();
-  });
-
-  it('returns early when SEED_DATA is set to a non-"true" value', async () => {
-    process.env['SEED_DATA'] = 'false';
-    const { repo, insert } = makeRepo(0);
-    const service = new ErrorClusterSeederService(repo as never);
-
-    await service.onModuleInit();
-
-    expect(repo.createQueryBuilder).not.toHaveBeenCalled();
-    expect(insert).not.toHaveBeenCalled();
-  });
-
-  it('skips inserting when seed rows already exist', async () => {
-    process.env['SEED_DATA'] = 'true';
-    const { repo, qb, insert } = makeRepo(5);
-    const service = new ErrorClusterSeederService(repo as never);
-
-    await service.onModuleInit();
-
-    expect(qb.where).toHaveBeenCalledWith('m.id LIKE :p', { p: 'seed-err-%' });
-    expect(qb.getCount).toHaveBeenCalledTimes(1);
-    expect(insert).not.toHaveBeenCalled();
-  });
-
-  describe('full seed run', () => {
-    it('inserts error rows (plus recovered siblings) in batches of 500', async () => {
-      process.env['SEED_DATA'] = 'true';
-      // Make randomness deterministic so both the recentOnly branch and the
-      // recovery-sibling branch are exercised on every spec.
-      jest.spyOn(Math, 'random').mockReturnValue(0.1);
-      const { repo, insert } = makeRepo(0);
-      const service = new ErrorClusterSeederService(repo as never);
-
-      await service.onModuleInit();
-
-      expect(insert).toHaveBeenCalled();
-
-      // Every batch must be <= 500 rows.
-      const batches = insert.mock.calls.map((c) => c[0] as unknown[]);
-      for (const batch of batches) {
-        expect(batch.length).toBeGreaterThan(0);
-        expect(batch.length).toBeLessThanOrEqual(500);
-      }
-
-      const allRows = batches.flat() as Array<Record<string, unknown>>;
-
-      // Error rows carry the seed id prefix and an http status field.
-      const errorRows = allRows.filter((r) => !String(r['id']).endsWith('-ok'));
-      expect(errorRows.length).toBeGreaterThan(0);
-      errorRows.forEach((r) => {
-        expect(String(r['id']).startsWith('seed-err-')).toBe(true);
-        expect(r['agent_id']).toBe('seed-err-agent');
-      });
-
-      // With random=0.1 (< every spec's recovery fraction at made/total≈0), at
-      // least some recovered `ok` siblings are produced sharing the trace.
-      const okRows = allRows.filter((r) => String(r['id']).endsWith('-ok'));
-      expect(okRows.length).toBeGreaterThan(0);
-      okRows.forEach((r) => {
-        expect(r['status']).toBe('success');
-        expect(r['input_tokens']).toBe(50);
-        expect(r['output_tokens']).toBe(80);
-      });
-    });
-
-    it('omits recovered siblings when randomness exceeds every recovery fraction', async () => {
-      process.env['SEED_DATA'] = 'true';
-      // random=0.99 keeps made/total < recovery false for the very first row of
-      // each spec (recovery max is 0.88), so the recovery branch is skipped.
-      jest.spyOn(Math, 'random').mockReturnValue(0.99);
-      const { repo, insert } = makeRepo(0);
-      const service = new ErrorClusterSeederService(repo as never);
-
-      await service.onModuleInit();
-
-      const allRows = insert.mock.calls.flatMap((c) => c[0] as Array<Record<string, unknown>>);
-      // Some `ok` rows may still appear once made/total climbs, but the first
-      // row of the first spec must be an error with no immediate sibling — the
-      // branch coverage we care about (the `if` evaluating false) is hit.
-      expect(allRows.length).toBeGreaterThan(0);
-      expect(allRows.some((r) => !String(r['id']).endsWith('-ok'))).toBe(true);
-    });
-  });
-});
diff --git a/packages/backend/src/error-pages/error-cluster-seeder.service.ts b/packages/backend/src/error-pages/error-cluster-seeder.service.ts
deleted file mode 100644
index 51245d35..00000000
--- a/packages/backend/src/error-pages/error-cluster-seeder.service.ts
+++ /dev/null
@@ -1,227 +0,0 @@
-import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
-import { InjectRepository } from '@nestjs/typeorm';
-import { Repository } from 'typeorm';
-import { normalizeStatus } from 'manifest-shared';
-import { AgentMessage } from '../entities/agent-message.entity';
-
-/**
- * Seeds realistic error `agent_messages` (dev/test only) so the live discovery
- * endpoint produces real GROUP BY clusters instead of a hardcoded list. Each
- * spec fans out across `tenants` distinct synthetic tenants with a recovered
- * fraction (an `ok` sibling sharing the trace) and rotates through several
- * message `samples` so discovery can surface real "Also seen as" variants.
- * Idempotent: skips if seed rows already exist (id LIKE 'seed-err-%').
- */
-interface Spec {
-  key: string;
-  provider: string;
-  http: number | null;
-  status: string;
-  model: string;
-  samples: string[];
-  tenants: number;
-  rowsPerTenant: number;
-  recovery: number;
-  recentOnly?: boolean;
-}
-
-const SPECS: Spec[] = [
-  {
-    key: 'g429',
-    provider: 'gemini',
-    http: 429,
-    status: 'rate_limited',
-    model: 'gemini-2.5-pro',
-    tenants: 120,
-    rowsPerTenant: 6,
-    recovery: 0.74,
-    samples: [
-      '{ "error": { "code": 429, "message": "You exceeded your current quota, please check your plan and billing details.", "status": "RESOURCE_EXHAUSTED" } }',
-      '{ "error": { "code": 429, "message": "Resource has been exhausted (e.g. check quota).", "status": "RESOURCE_EXHAUSTED" } }',
-      'Quota exceeded for quota metric "Generate Content API requests per minute".',
-    ],
-  },
-  {
-    key: 'or404',
-    provider: 'openrouter',
-    http: 404,
-    status: 'error',
-    model: 'anthropic/claude-3.5-sonnet',
-    tenants: 80,
-    rowsPerTenant: 5,
-    recovery: 0.81,
-    samples: [
-      '{"error":{"message":"No endpoints found for the requested model.","code":404}}',
-      '{"error":{"message":"No allowed providers are available for the selected model.","code":404}}',
-    ],
-  },
-  {
-    key: 'or402',
-    provider: 'openrouter',
-    http: 402,
-    status: 'error',
-    model: 'qwen/qwen3-coder:free',
-    tenants: 70,
-    rowsPerTenant: 6,
-    recovery: 0.88,
-    samples: [
-      '{"error":{"message":"Rate limit exceeded: free-models-per-day. Add 10 credits to unlock 1000 free model requests per day.","code":402}}',
-      '{"error":{"message":"Insufficient credits. Add more credits to continue.","code":402}}',
-    ],
-  },
-  {
-    key: 'oa401',
-    provider: 'openai',
-    http: 401,
-    status: 'error',
-    model: 'gpt-4o',
-    tenants: 55,
-    rowsPerTenant: 7,
-    recovery: 0.42,
-    samples: [
-      '{ "error": { "message": "Your authentication token has been invalidated. Please try signing in again.", "type": "invalid_request_error", "code": "invalid_authentication" } }',
-      '{ "error": { "message": "Incorrect API key provided.", "type": "invalid_request_error", "code": "invalid_api_key" } }',
-    ],
-  },
-  {
-    key: 'ds400',
-    provider: 'deepseek',
-    http: 400,
-    status: 'error',
-    model: 'deepseek-reasoner',
-    tenants: 48,
-    rowsPerTenant: 5,
-    recovery: 0.6,
-    samples: [
-      '{"error":{"message":"The reasoning_content in the thinking mode must be passed.","code":400}}',
-      '{"error":{"message":"deepseek-reasoner does not support successive user or assistant messages.","code":400}}',
-    ],
-  },
-  {
-    key: 'zai429',
-    provider: 'zai',
-    http: 429,
-    status: 'rate_limited',
-    model: 'glm-4.6',
-    tenants: 46,
-    rowsPerTenant: 4,
-    recovery: 0.5,
-    samples: [
-      '{"error":{"code":"1113","message":"Insufficient balance or no resource package. Please recharge."}}',
-    ],
-  },
-  {
-    key: 'g400',
-    provider: 'gemini',
-    http: 400,
-    status: 'error',
-    model: 'gemini-2.5-flash',
-    tenants: 42,
-    rowsPerTenant: 4,
-    recovery: 0.66,
-    samples: [
-      '{ "error": { "code": 400, "message": "Function call is missing a thought_signature in functionCall parts.", "status": "INVALID_ARGUMENT" } }',
-      '{ "error": { "code": 400, "message": "Please ensure that function call turns come immediately after a user turn or after a function response turn.", "status": "INVALID_ARGUMENT" } }',
-    ],
-  },
-  {
-    key: 'g503',
-    provider: 'gemini',
-    http: 503,
-    status: 'error',
-    model: 'gemini-2.5-pro',
-    tenants: 40,
-    rowsPerTenant: 5,
-    recovery: 0.79,
-    recentOnly: true,
-    samples: [
-      '{ "error": { "code": 503, "message": "This model is currently experiencing high demand. Spikes in demand are usually temporary.", "status": "UNAVAILABLE" } }',
-      '{ "error": { "code": 503, "message": "The service is currently unavailable.", "status": "UNAVAILABLE" } }',
-    ],
-  },
-  {
-    key: 'an400',
-    provider: 'anthropic',
-    http: 400,
-    status: 'error',
-    model: 'claude-sonnet-4',
-    tenants: 30,
-    rowsPerTenant: 5,
-    recovery: 0.7,
-    samples: [
-      '{"type":"error","error":{"type":"invalid_request_error","message":"You are out of extra usage. Add more at claude.ai to keep going."}}',
-    ],
-  },
-];
-
-const DAY_MS = 86400000;
-
-@Injectable()
-export class ErrorClusterSeederService implements OnModuleInit {
-  private readonly logger = new Logger(ErrorClusterSeederService.name);
-
-  constructor(
-    @InjectRepository(AgentMessage)
-    private readonly repo: Repository<AgentMessage>,
-  ) {}
-
-  async onModuleInit(): Promise<void> {
-    if (process.env['SEED_DATA'] !== 'true') return;
-    const existing = await this.repo
-      .createQueryBuilder('m')
-      .where('m.id LIKE :p', { p: 'seed-err-%' })
-      .getCount();
-    if (existing > 0) return;
-
-    const rows: Partial<AgentMessage>[] = [];
-    const now = Date.now();
-    for (const s of SPECS) {
-      let made = 0;
-      const total = s.tenants * s.rowsPerTenant;
-      for (let t = 0; t < s.tenants; t++) {
-        for (let r = 0; r < s.rowsPerTenant; r++) {
-          const dayOffset = s.recentOnly ? Math.random() * 2 : Math.pow(Math.random(), 1.6) * 30;
-          const tsMs = now - dayOffset * DAY_MS - Math.random() * DAY_MS;
-          const ts = new Date(tsMs).toISOString();
-          const trace = `seed-err-${s.key}-${t}-${r}`;
-          rows.push({
-            id: trace,
-            tenant_id: `seed-err-${s.key}-t${t}`,
-            agent_id: 'seed-err-agent',
-            trace_id: trace,
-            timestamp: ts,
-            status: normalizeStatus(s.status),
-            error_message: s.samples[(t + r) % s.samples.length],
-            error_http_status: s.http,
-            provider: s.provider,
-            model: s.model,
-            input_tokens: 0,
-            output_tokens: 0,
-          });
-          if (made / total < s.recovery) {
-            rows.push({
-              id: `${trace}-ok`,
-              tenant_id: `seed-err-${s.key}-t${t}`,
-              agent_id: 'seed-err-agent',
-              trace_id: trace,
-              timestamp: new Date(tsMs + 1500).toISOString(),
-              status: 'success',
-              provider: s.provider,
-              model: s.model,
-              input_tokens: 50,
-              output_tokens: 80,
-            });
-          }
-          made++;
-        }
-      }
-    }
-
-    for (let i = 0; i < rows.length; i += 500) {
-      await this.repo.insert(rows.slice(i, i + 500));
-    }
-    this.logger.log(
-      `Seeded ${rows.length} error/recovery agent_messages across ${SPECS.length} clusters (with message variants)`,
-    );
-  }
-}
diff --git a/packages/backend/src/error-pages/error-discovery.service.spec.ts b/packages/backend/src/error-pages/error-discovery.service.spec.ts
deleted file mode 100644
index dc252894..00000000
--- a/packages/backend/src/error-pages/error-discovery.service.spec.ts
+++ /dev/null
@@ -1,315 +0,0 @@
-import { ErrorDiscoveryService } from './error-discovery.service';
-
-type AggRow = {
-  provider: string;
-  http: number | null;
-  volume_30d: number;
-  volume_7d: number;
-  tenants: number;
-  first_seen: string | null;
-  last_seen: string | null;
-  recovery: number | null;
-  sample: string | null;
-};
-
-type TrendRow = { provider: string; http: number | null; day: string; cnt: number };
-
-type VariantRow = { provider: string; http: number | null; msg: string | null; cnt: number };
-
-function makeAgg(overrides: Partial<AggRow> = {}): AggRow {
-  return {
-    provider: 'gemini',
-    http: 429,
-    volume_30d: 400,
-    volume_7d: 100,
-    tenants: 42,
-    first_seen: '2026-05-01T00:00:00.000Z',
-    last_seen: '2026-06-01T00:00:00.000Z',
-    recovery: 0.74,
-    sample: 'quota exceeded',
-    ...overrides,
-  };
-}
-
-describe('ErrorDiscoveryService', () => {
-  let service: ErrorDiscoveryService;
-  let query: jest.Mock;
-
-  beforeEach(() => {
-    query = jest.fn();
-    service = new ErrorDiscoveryService({ query } as never);
-  });
-
-  /** Wire the three sequential `this.repo.query` calls: agg, trend, variants. */
-  function setup(aggRows: AggRow[], trendRows: TrendRow[] = [], variantRows: VariantRow[] = []) {
-    query
-      .mockResolvedValueOnce(aggRows)
-      .mockResolvedValueOnce(trendRows)
-      .mockResolvedValueOnce(variantRows);
-  }
-
-  it('issues exactly three queries (aggregate, trend, variants)', async () => {
-    setup([], []);
-
-    await service.discover();
-
-    expect(query).toHaveBeenCalledTimes(3);
-  });
-
-  it('excludes rows without a tenant from every public aggregate', async () => {
-    setup([], []);
-
-    await service.discover();
-
-    for (const [sql] of query.mock.calls) {
-      expect(sql).toContain('AND e.tenant_id IS NOT NULL');
-    }
-  });
-
-  it('returns an empty list when there are no clusters', async () => {
-    setup([], []);
-
-    expect(await service.discover()).toEqual([]);
-  });
-
-  describe('categoryFor mapping', () => {
-    const cases: Array<[number | null, string, string]> = [
-      [429, 'rate_limit', 'Rate limit'],
-      [401, 'auth', 'Authentication'],
-      [403, 'auth', 'Authentication'],
-      [402, 'billing', 'Billing / quota'],
-      [404, 'model_unavailable', 'Model unavailable'],
-      [500, 'server', 'Server error'],
-      [503, 'server', 'Server error'],
-      [400, 'bad_request', 'Bad request'],
-      [422, 'bad_request', 'Bad request'],
-      [null, 'unknown', 'Unknown'],
-    ];
-
-    it.each(cases)('maps http %p to category %s', async (http, id, label) => {
-      setup([makeAgg({ http })], []);
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.category).toBe(id);
-      expect(cluster.category_label).toBe(label);
-    });
-  });
-
-  describe('cluster_key and suggested_slug', () => {
-    it('builds key as provider|http and a hyphenated slug', async () => {
-      setup([makeAgg({ provider: 'gemini', http: 429 })], []);
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.cluster_key).toBe('gemini|429');
-      expect(cluster.suggested_slug).toBe('gemini-429-rate-limit');
-    });
-
-    it('uses |none and -error- in the slug when http is null', async () => {
-      setup([makeAgg({ provider: 'openrouter', http: null })], []);
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.cluster_key).toBe('openrouter|none');
-      expect(cluster.suggested_slug).toBe('openrouter-error-unknown');
-    });
-
-    it('replaces all underscores in the category id with hyphens', async () => {
-      setup([makeAgg({ provider: 'openrouter', http: 404 })], []);
-
-      const [cluster] = await service.discover();
-
-      // model_unavailable → model-unavailable
-      expect(cluster.suggested_slug).toBe('openrouter-404-model-unavailable');
-    });
-  });
-
-  describe('numeric coercion and passthrough', () => {
-    it('coerces string-y numbers and passes recovery through', async () => {
-      setup(
-        [
-          makeAgg({
-            http: '429' as unknown as number,
-            tenants: '42' as unknown as number,
-            volume_7d: '100' as unknown as number,
-            volume_30d: '400' as unknown as number,
-            recovery: 0.74,
-          }),
-        ],
-        [],
-      );
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.http_status).toBe(429);
-      expect(cluster.tenants).toBe(42);
-      expect(cluster.volume_7d).toBe(100);
-      expect(cluster.volume_30d).toBe(400);
-      expect(cluster.recovery_rate).toBe(0.74);
-      expect(cluster.first_seen).toBe('2026-05-01T00:00:00.000Z');
-      expect(cluster.last_seen).toBe('2026-06-01T00:00:00.000Z');
-    });
-
-    it('passes a null recovery rate through as null', async () => {
-      setup([makeAgg({ recovery: null })], []);
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.recovery_rate).toBeNull();
-    });
-
-    it('preserves null first_seen / last_seen', async () => {
-      setup([makeAgg({ first_seen: null, last_seen: null })], []);
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.first_seen).toBeNull();
-      expect(cluster.last_seen).toBeNull();
-    });
-  });
-
-  describe('sample scrubbing', () => {
-    it('scrubs secrets in the sample message', async () => {
-      setup([makeAgg({ sample: 'key=sk-ant-ABCDEF1234567890 boom' })], []);
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.sample_message).toContain('[REDACTED]');
-      expect(cluster.sample_message).not.toContain('sk-ant-ABCDEF1234567890');
-    });
-
-    it('treats a null sample as an empty string', async () => {
-      setup([makeAgg({ sample: null })], []);
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.sample_message).toBe('');
-    });
-  });
-
-  describe('trend assembly', () => {
-    it('attaches the trend rows matching a cluster key', async () => {
-      setup(
-        [makeAgg({ provider: 'gemini', http: 429 })],
-        [
-          { provider: 'gemini', http: 429, day: '2026-05-30', cnt: 5 },
-          { provider: 'gemini', http: 429, day: '2026-05-31', cnt: 8 },
-          // Different key — must NOT leak into the gemini|429 trend.
-          { provider: 'openai', http: 401, day: '2026-05-31', cnt: 3 },
-        ],
-      );
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.trend).toEqual([
-        { date: '2026-05-30', count: 5 },
-        { date: '2026-05-31', count: 8 },
-      ]);
-    });
-
-    it('assembles a trend keyed by provider|none for null http', async () => {
-      setup(
-        [makeAgg({ provider: 'openrouter', http: null })],
-        [{ provider: 'openrouter', http: null, day: '2026-05-31', cnt: 9 }],
-      );
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.trend).toEqual([{ date: '2026-05-31', count: 9 }]);
-    });
-
-    it('coerces string trend counts to numbers', async () => {
-      setup(
-        [makeAgg({ provider: 'gemini', http: 429 })],
-        [{ provider: 'gemini', http: 429, day: '2026-05-31', cnt: '7' as unknown as number }],
-      );
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.trend).toEqual([{ date: '2026-05-31', count: 7 }]);
-    });
-
-    it('defaults to an empty trend when no trend rows match the key', async () => {
-      setup([makeAgg({ provider: 'gemini', http: 429 })], []);
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.trend).toEqual([]);
-    });
-  });
-
-  describe('variants assembly', () => {
-    it('attaches up to 5 distinct scrubbed variants by key, isolating other keys', async () => {
-      const vrows: VariantRow[] = [
-        { provider: 'gemini', http: 429, msg: 'You exceeded your current quota', cnt: 10 },
-        { provider: 'gemini', http: 429, msg: 'Resource has been exhausted', cnt: 8 },
-        { provider: 'gemini', http: 429, msg: 'v3', cnt: 7 },
-        { provider: 'gemini', http: 429, msg: 'v4', cnt: 6 },
-        { provider: 'gemini', http: 429, msg: 'v5', cnt: 5 },
-        { provider: 'gemini', http: 429, msg: 'v6-overflow', cnt: 4 },
-        { provider: 'openai', http: 401, msg: 'other-key', cnt: 9 },
-      ];
-      setup([makeAgg({ provider: 'gemini', http: 429 })], [], vrows);
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.variants).toHaveLength(5);
-      expect(cluster.variants).toContain('You exceeded your current quota');
-      expect(cluster.variants).not.toContain('v6-overflow');
-      expect(cluster.variants).not.toContain('other-key');
-    });
-
-    it('scrubs secrets and truncates each variant to 160 chars', async () => {
-      const long = 'x'.repeat(200);
-      setup(
-        [makeAgg({ provider: 'gemini', http: 429 })],
-        [],
-        [{ provider: 'gemini', http: 429, msg: `key=sk-ant-ABCDEF1234567890 ${long}`, cnt: 1 }],
-      );
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.variants[0]).toContain('[REDACTED]');
-      expect(cluster.variants[0].length).toBeLessThanOrEqual(160);
-    });
-
-    it('treats a null variant message as empty and keys by provider|none', async () => {
-      setup(
-        [makeAgg({ provider: 'openrouter', http: null })],
-        [],
-        [{ provider: 'openrouter', http: null, msg: null, cnt: 2 }],
-      );
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.variants).toEqual(['']);
-    });
-
-    it('defaults to empty variants when none match', async () => {
-      setup([makeAgg({ provider: 'gemini', http: 429 })], [], []);
-
-      const [cluster] = await service.discover();
-
-      expect(cluster.variants).toEqual([]);
-    });
-  });
-
-  it('maps multiple clusters preserving aggregate row order', async () => {
-    setup(
-      [
-        makeAgg({ provider: 'gemini', http: 429, tenants: 120 }),
-        makeAgg({ provider: 'openai', http: 401, tenants: 55 }),
-      ],
-      [],
-    );
-
-    const result = await service.discover();
-
-    expect(result).toHaveLength(2);
-    expect(result[0].provider).toBe('gemini');
-    expect(result[0].category).toBe('rate_limit');
-    expect(result[1].provider).toBe('openai');
-    expect(result[1].category).toBe('auth');
-  });
-});
diff --git a/packages/backend/src/error-pages/error-discovery.service.ts b/packages/backend/src/error-pages/error-discovery.service.ts
deleted file mode 100644
index 528245e4..00000000
--- a/packages/backend/src/error-pages/error-discovery.service.ts
+++ /dev/null
@@ -1,170 +0,0 @@
-import { Injectable } from '@nestjs/common';
-import { InjectRepository } from '@nestjs/typeorm';
-import { Repository } from 'typeorm';
-import { AgentMessage } from '../entities/agent-message.entity';
-import { scrubSecrets } from '../common/utils/secret-scrub';
-import { MIN_TENANTS_FOR_PUBLIC } from './error-pages.service';
-
-// A message variant must appear across at least this many distinct tenants
-// before it's surfaced publicly — k-anonymity at the variant level so one
-// customer's exact (possibly identifying) error string is never exposed.
-const MIN_TENANTS_PER_VARIANT = 3;
-
-// Public-facing scrub: provider-credential redaction (shared util) PLUS email
-// redaction. Error bodies sometimes echo a user's email; strip it before any
-// sample/variant leaves the building.
-const EMAIL_RE = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
-function scrubForPublic(text: string | null | undefined): string {
-  return scrubSecrets(text ?? '').replace(EMAIL_RE, '[email]');
-}
-
-export interface DiscoveredCluster {
-  cluster_key: string;
-  provider: string;
-  http_status: number | null;
-  category: string;
-  category_label: string;
-  suggested_slug: string;
-  tenants: number;
-  volume_7d: number;
-  volume_30d: number;
-  recovery_rate: number | null;
-  first_seen: string | null;
-  last_seen: string | null;
-  sample_message: string;
-  variants: string[];
-  trend: { date: string; count: number }[];
-}
-
-function categoryFor(http: number | null): { id: string; label: string } {
-  if (http === 429) return { id: 'rate_limit', label: 'Rate limit' };
-  if (http === 401 || http === 403) return { id: 'auth', label: 'Authentication' };
-  if (http === 402) return { id: 'billing', label: 'Billing / quota' };
-  if (http === 404) return { id: 'model_unavailable', label: 'Model unavailable' };
-  if (http != null && http >= 500) return { id: 'server', label: 'Server error' };
-  if (http != null && http >= 400) return { id: 'bad_request', label: 'Bad request' };
-  return { id: 'unknown', label: 'Unknown' };
-}
-
-/**
- * Computes error-cluster aggregates live from `agent_messages` (cross-tenant).
- * This is the rollup the Peacock CMS pulls from to discover and refresh clusters.
- * Aggregates only — never returns tenant identities — and applies the same
- * k-anonymity floor as publishing, so a cluster below the floor is never
- * surfaced for curation in the first place.
- */
-@Injectable()
-export class ErrorDiscoveryService {
-  constructor(
-    @InjectRepository(AgentMessage)
-    private readonly repo: Repository<AgentMessage>,
-  ) {}
-
-  async discover(): Promise<DiscoveredCluster[]> {
-    const aggRows: Array<{
-      provider: string;
-      http: number | null;
-      volume_30d: number;
-      volume_7d: number;
-      tenants: number;
-      first_seen: string | null;
-      last_seen: string | null;
-      recovery: number | null;
-      sample: string | null;
-    }> = await this.repo.query(`
-      SELECT e.provider AS provider,
-             e.error_http_status AS http,
-             COUNT(*)::int AS volume_30d,
-             COUNT(*) FILTER (WHERE e.timestamp >= NOW() - INTERVAL '7 days')::int AS volume_7d,
-             COUNT(DISTINCT e.tenant_id)::int AS tenants,
-             MIN(e.timestamp) AS first_seen,
-             MAX(e.timestamp) AS last_seen,
-             AVG(CASE WHEN ok.trace_id IS NOT NULL THEN 1.0 ELSE 0.0 END)::float AS recovery,
-             (array_agg(e.error_message ORDER BY e.timestamp DESC))[1] AS sample
-      FROM agent_messages e
-      LEFT JOIN (
-        SELECT DISTINCT trace_id FROM agent_messages WHERE status IN ('ok', 'success') AND trace_id IS NOT NULL
-      ) ok ON ok.trace_id = e.trace_id
-      WHERE e.status IN ('error','fallback_error','rate_limited','failed')
-        AND e.tenant_id IS NOT NULL
-        AND e.provider IS NOT NULL
-        AND e.provider NOT LIKE 'custom:%'
-      GROUP BY e.provider, e.error_http_status
-      HAVING COUNT(DISTINCT e.tenant_id) >= ${MIN_TENANTS_FOR_PUBLIC}
-      ORDER BY COUNT(DISTINCT e.tenant_id) DESC
-    `);
-
-    const trendRows: Array<{ provider: string; http: number | null; day: string; cnt: number }> =
-      await this.repo.query(`
-        SELECT e.provider AS provider,
-               e.error_http_status AS http,
-               to_char(date_trunc('day', e.timestamp), 'YYYY-MM-DD') AS day,
-               COUNT(*)::int AS cnt
-        FROM agent_messages e
-        WHERE e.status IN ('error','fallback_error','rate_limited','failed')
-          AND e.timestamp >= NOW() - INTERVAL '14 days'
-          AND e.tenant_id IS NOT NULL
-          AND e.provider IS NOT NULL
-          AND e.provider NOT LIKE 'custom:%'
-        GROUP BY e.provider, e.error_http_status, day
-        ORDER BY day ASC
-      `);
-
-    const trendByKey = new Map<string, { date: string; count: number }[]>();
-    for (const r of trendRows) {
-      const key = `${r.provider}|${r.http ?? 'none'}`;
-      if (!trendByKey.has(key)) trendByKey.set(key, []);
-      trendByKey.get(key)!.push({ date: r.day, count: Number(r.cnt) });
-    }
-
-    // Top distinct message strings per cluster — powers the "Also seen as"
-    // block, widening lexical coverage to the variant wordings users search.
-    const variantRows: Array<{ provider: string; http: number | null; msg: string; cnt: number }> =
-      await this.repo.query(`
-        SELECT e.provider AS provider,
-               e.error_http_status AS http,
-               e.error_message AS msg,
-               COUNT(*)::int AS cnt
-        FROM agent_messages e
-        WHERE e.status IN ('error','fallback_error','rate_limited','failed')
-          AND e.error_message IS NOT NULL
-          AND e.tenant_id IS NOT NULL
-          AND e.provider IS NOT NULL
-          AND e.provider NOT LIKE 'custom:%'
-        GROUP BY e.provider, e.error_http_status, e.error_message
-        HAVING COUNT(DISTINCT e.tenant_id) >= ${MIN_TENANTS_PER_VARIANT}
-        ORDER BY cnt DESC
-      `);
-
-    const variantsByKey = new Map<string, string[]>();
-    for (const r of variantRows) {
-      const key = `${r.provider}|${r.http ?? 'none'}`;
-      if (!variantsByKey.has(key)) variantsByKey.set(key, []);
-      const list = variantsByKey.get(key)!;
-      if (list.length < 5) list.push(scrubForPublic(r.msg).slice(0, 160));
-    }
-
-    return aggRows.map((r) => {
-      const http = r.http != null ? Number(r.http) : null;
-      const cat = categoryFor(http);
-      const key = `${r.provider}|${http ?? 'none'}`;
-      return {
-        cluster_key: key,
-        provider: r.provider,
-        http_status: http,
-        category: cat.id,
-        category_label: cat.label,
-        suggested_slug: `${r.provider}-${http ?? 'error'}-${cat.id.replace(/_/g, '-')}`,
-        tenants: Number(r.tenants),
-        volume_7d: Number(r.volume_7d),
-        volume_30d: Number(r.volume_30d),
-        recovery_rate: r.recovery != null ? Number(r.recovery) : null,
-        first_seen: r.first_seen,
-        last_seen: r.last_seen,
-        sample_message: scrubForPublic(r.sample),
-        variants: variantsByKey.get(key) ?? [],
-        trend: trendByKey.get(key) ?? [],
-      };
-    });
-  }
-}
diff --git a/packages/backend/src/error-pages/error-page-seed-data.spec.ts b/packages/backend/src/error-pages/error-page-seed-data.spec.ts
deleted file mode 100644
index 088288a7..00000000
--- a/packages/backend/src/error-pages/error-page-seed-data.spec.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { ERROR_PAGE_SEEDS, seedTrend } from './error-page-seed-data';
-import { MIN_TENANTS_FOR_PUBLIC } from './error-pages.service';
-
-describe('seedTrend', () => {
-  const END = Date.UTC(2026, 6, 1); // 2026-07-01
-
-  it('returns 14 ascending daily points ending on the end date, never zero', () => {
-    const trend = seedTrend(720, 0, END);
-    expect(trend).toHaveLength(14);
-    expect(trend[0].date).toBe('2026-06-18');
-    expect(trend[13].date).toBe('2026-07-01');
-    for (const p of trend) expect(p.count).toBeGreaterThanOrEqual(1);
-    const dates = trend.map((p) => p.date);
-    expect([...dates].sort()).toEqual(dates); // already ascending
-  });
-
-  it('is deterministic and scales with volume + salt', () => {
-    expect(seedTrend(720, 0, END)).toEqual(seedTrend(720, 0, END));
-    const big = seedTrend(3000, 1, END).reduce((a, p) => a + p.count, 0);
-    const small = seedTrend(300, 1, END).reduce((a, p) => a + p.count, 0);
-    expect(big).toBeGreaterThan(small);
-  });
-
-  it('still emits a non-zero line for a tiny volume', () => {
-    const trend = seedTrend(1, 3, END);
-    expect(trend).toHaveLength(14);
-    for (const p of trend) expect(p.count).toBeGreaterThanOrEqual(1);
-  });
-});
-
-describe('ERROR_PAGE_SEEDS', () => {
-  it('has unique slugs, each prefixed with its provider, above the k-anon floor', () => {
-    const slugs = ERROR_PAGE_SEEDS.map((s) => s.slug);
-    expect(new Set(slugs).size).toBe(slugs.length);
-    for (const s of ERROR_PAGE_SEEDS) {
-      expect(s.slug.startsWith(`${s.provider}-`)).toBe(true);
-      expect(s.tenants).toBeGreaterThanOrEqual(MIN_TENANTS_FOR_PUBLIC);
-      expect(s.http_status).toBeGreaterThan(0);
-      expect(s.category).toBeTruthy();
-      expect(s.title).toBeTruthy();
-    }
-  });
-
-  it('covers several providers and categories for rich hubs', () => {
-    expect(new Set(ERROR_PAGE_SEEDS.map((s) => s.provider)).size).toBeGreaterThanOrEqual(4);
-    expect(new Set(ERROR_PAGE_SEEDS.map((s) => s.category)).size).toBeGreaterThanOrEqual(4);
-  });
-});
diff --git a/packages/backend/src/error-pages/error-page-seed-data.ts b/packages/backend/src/error-pages/error-page-seed-data.ts
deleted file mode 100644
index 779f7a46..00000000
--- a/packages/backend/src/error-pages/error-page-seed-data.ts
+++ /dev/null
@@ -1,410 +0,0 @@
-import type { ErrorPageTrendPoint } from '../entities/public-error-page.entity';
-
-/**
- * Curated demo error pages published on boot (dev/test only) so the public
- * `/errors/` catalog on the marketing site has a full, chart-rich set to render
- * without a live Peacock CMS. Each entry is published through the same
- * `ErrorPagesService.upsert` valve as a real CMS push, so the k-anonymity floor
- * and secret/email scrub still apply. Content is illustrative, not real tenant
- * data — `tenants`/`volume_*` are plausible aggregates and every `sample_message`
- * is a public, provider-documented error shape.
- */
-export interface ErrorPageSeed {
-  slug: string;
-  cluster_key: string;
-  provider: string;
-  provider_label: string;
-  http_status: number;
-  category: string;
-  category_label: string;
-  title: string;
-  meta_description: string;
-  h1: string;
-  body_what: string;
-  body_fix: string;
-  sample_message: string;
-  faq: { q: string; a: string }[];
-  tenants: number;
-  volume_7d: number;
-  volume_30d: number;
-  recovery_rate: number;
-  variants?: string[];
-}
-
-const DAY_MS = 86400000;
-const TREND_DAYS = 14;
-
-/**
- * Build a 14-day occurrence sparkline that sums to roughly the 30-day volume,
- * with a gentle upward ramp and a deterministic wave (so the demo chart looks
- * alive without random noise, and tests stay stable). Never emits a zero day,
- * so the line always renders.
- */
-export function seedTrend(volume30d: number, salt: number, endMs: number): ErrorPageTrendPoint[] {
-  const perDay = Math.max(1, Math.round(volume30d / 30));
-  const start = endMs - (TREND_DAYS - 1) * DAY_MS;
-  const points: ErrorPageTrendPoint[] = [];
-  for (let d = 0; d < TREND_DAYS; d++) {
-    const wave = 0.7 + 0.6 * Math.abs(Math.sin((d + salt) * 0.6));
-    const ramp = 0.6 + (0.8 * d) / (TREND_DAYS - 1);
-    const count = Math.max(1, Math.round(perDay * wave * ramp));
-    points.push({ date: new Date(start + d * DAY_MS).toISOString().slice(0, 10), count });
-  }
-  return points;
-}
-
-export const ERROR_PAGE_SEEDS: ErrorPageSeed[] = [
-  {
-    slug: 'gemini-429-quota-exceeded',
-    cluster_key: 'gemini|rate_limited|429|RESOURCE_EXHAUSTED',
-    provider: 'gemini',
-    provider_label: 'Google Gemini',
-    http_status: 429,
-    category: 'rate_limit',
-    category_label: 'Rate limit',
-    title: 'Fix Gemini 429 "You exceeded your current quota"',
-    meta_description:
-      'Why Google Gemini returns 429 RESOURCE_EXHAUSTED across AI agents and how to stop it breaking runs.',
-    h1: 'Gemini 429 — You exceeded your current quota',
-    body_what:
-      'Gemini returns HTTP 429 with RESOURCE_EXHAUSTED when a project crosses its per-minute or per-day quota. Bursty agent loops hit it first.',
-    body_fix:
-      '- Back off and retry with exponential jitter\n- Request a quota increase in Google AI Studio\n- Spread load across keys or fall back to another model',
-    sample_message:
-      '{ "error": { "code": 429, "message": "You exceeded your current quota, please check your plan and billing details.", "status": "RESOURCE_EXHAUSTED" } }',
-    faq: [
-      {
-        q: 'Is a Gemini 429 the same as being rate limited?',
-        a: 'Yes. RESOURCE_EXHAUSTED means you hit a per-minute or per-day quota; it clears once the window resets.',
-      },
-    ],
-    tenants: 120,
-    volume_7d: 297,
-    volume_30d: 720,
-    recovery_rate: 0.74,
-    variants: [
-      'Resource has been exhausted (e.g. check quota).',
-      'Quota exceeded for quota metric "Generate Content API requests per minute".',
-    ],
-  },
-  {
-    slug: 'gemini-400-missing-thought-signature',
-    cluster_key: 'gemini|error|400|INVALID_ARGUMENT',
-    provider: 'gemini',
-    provider_label: 'Google Gemini',
-    http_status: 400,
-    category: 'bad_request',
-    category_label: 'Bad request',
-    title: 'Fix Gemini 400 "missing thought_signature" in function calls',
-    meta_description:
-      'Gemini 2.5 rejects tool calls that drop the thought_signature. Here is why and how to keep function calling working.',
-    h1: 'Gemini 400 — Function call missing a thought_signature',
-    body_what:
-      'Gemini 2.5 returns 400 INVALID_ARGUMENT when a functionCall part is replayed without the thought_signature it originally issued.',
-    body_fix:
-      '- Preserve thought_signature on every functionCall part you send back\n- Keep function turns immediately after the matching user or tool turn\n- Do not hand-edit or truncate prior tool messages',
-    sample_message:
-      '{ "error": { "code": 400, "message": "Function call is missing a thought_signature in functionCall parts.", "status": "INVALID_ARGUMENT" } }',
-    faq: [
-      {
-        q: 'Why did this start after upgrading to Gemini 2.5?',
-        a: 'Thought signatures are new to 2.5 thinking models; older clients that strip unknown fields drop them and trigger the 400.',
-      },
-    ],
-    tenants: 42,
-    volume_7d: 61,
-    volume_30d: 168,
-    recovery_rate: 0.66,
-  },
-  {
-    slug: 'gemini-503-overloaded',
-    cluster_key: 'gemini|error|503|UNAVAILABLE',
-    provider: 'gemini',
-    provider_label: 'Google Gemini',
-    http_status: 503,
-    category: 'server',
-    category_label: 'Server error',
-    title: 'Fix Gemini 503 "model is overloaded / UNAVAILABLE"',
-    meta_description:
-      'Gemini 503 UNAVAILABLE spikes when demand surges. How to ride it out without failing agent runs.',
-    h1: 'Gemini 503 — The model is currently overloaded',
-    body_what:
-      'A 503 UNAVAILABLE is server-side: Gemini is briefly saturated. It is transient but clusters during peak hours.',
-    body_fix:
-      '- Retry after a short delay with backoff\n- Fail over to a second model on repeated 503s\n- Avoid hammering the same region during a spike',
-    sample_message:
-      '{ "error": { "code": 503, "message": "The model is currently experiencing high demand. Spikes in demand are usually temporary.", "status": "UNAVAILABLE" } }',
-    faq: [
-      {
-        q: 'Is a 503 my fault?',
-        a: 'No. It is a temporary capacity issue on the provider; a retry or fallback usually succeeds within seconds.',
-      },
-    ],
-    tenants: 40,
-    volume_7d: 96,
-    volume_30d: 150,
-    recovery_rate: 0.79,
-  },
-  {
-    slug: 'openai-401-invalid-authentication',
-    cluster_key: 'openai|error|401|invalid_authentication',
-    provider: 'openai',
-    provider_label: 'OpenAI',
-    http_status: 401,
-    category: 'auth',
-    category_label: 'Authentication',
-    title: 'Fix OpenAI 401 "invalid authentication" / bad API key',
-    meta_description:
-      'OpenAI 401 invalid_authentication means the key is missing, wrong, or revoked. How to find and fix it fast.',
-    h1: 'OpenAI 401 — Invalid authentication',
-    body_what:
-      'OpenAI returns 401 when the API key is missing, malformed, revoked, or scoped to the wrong org or project.',
-    body_fix:
-      '- Confirm the Authorization: Bearer header carries a current key\n- Rotate the key if it may be leaked or revoked\n- Check the org and project the key is scoped to',
-    sample_message:
-      '{ "error": { "message": "Your authentication token has been invalidated. Please try signing in again.", "type": "invalid_request_error", "code": "invalid_authentication" } }',
-    faq: [
-      {
-        q: 'Why did a working key suddenly 401?',
-        a: 'Keys 401 the moment they are rotated or revoked, or if the project they belong to is deleted.',
-      },
-    ],
-    tenants: 55,
-    volume_7d: 120,
-    volume_30d: 385,
-    recovery_rate: 0.42,
-    variants: ['Incorrect API key provided.'],
-  },
-  {
-    slug: 'openai-429-rate-limit',
-    cluster_key: 'openai|rate_limited|429|rate_limit_exceeded',
-    provider: 'openai',
-    provider_label: 'OpenAI',
-    http_status: 429,
-    category: 'rate_limit',
-    category_label: 'Rate limit',
-    title: 'Fix OpenAI 429 "rate limit exceeded"',
-    meta_description:
-      'OpenAI 429s cap requests-per-minute and tokens-per-minute. How to smooth bursts so agents keep running.',
-    h1: 'OpenAI 429 — Rate limit exceeded',
-    body_what:
-      'OpenAI throttles by requests-per-minute and tokens-per-minute per model. Parallel agent calls trip it in bursts.',
-    body_fix:
-      '- Honor the Retry-After header before retrying\n- Add client-side concurrency limits\n- Request a higher tier or split traffic across models',
-    sample_message:
-      '{ "error": { "message": "Rate limit reached for requests. Limit 3500 per min.", "type": "requests", "code": "rate_limit_exceeded" } }',
-    faq: [
-      {
-        q: 'RPM or TPM — which limit am I hitting?',
-        a: 'The error names it: "requests" is per-minute request cap, "tokens" is per-minute token cap.',
-      },
-    ],
-    tenants: 68,
-    volume_7d: 210,
-    volume_30d: 540,
-    recovery_rate: 0.7,
-  },
-  {
-    slug: 'openai-400-context-length-exceeded',
-    cluster_key: 'openai|error|400|context_length_exceeded',
-    provider: 'openai',
-    provider_label: 'OpenAI',
-    http_status: 400,
-    category: 'bad_request',
-    category_label: 'Bad request',
-    title: 'Fix OpenAI 400 "context length exceeded"',
-    meta_description:
-      "OpenAI 400 context_length_exceeded means the prompt plus completion is over the model's window. How to trim it.",
-    h1: 'OpenAI 400 — Context length exceeded',
-    body_what:
-      "A 400 context_length_exceeded fires when input tokens plus max_tokens exceed the model's context window.",
-    body_fix:
-      '- Trim or summarize history before sending\n- Lower max_tokens to leave room for the prompt\n- Move to a longer-context model for big inputs',
-    sample_message:
-      '{ "error": { "message": "This model\'s maximum context length is 128000 tokens.", "type": "invalid_request_error", "code": "context_length_exceeded" } }',
-    faq: [
-      {
-        q: 'Does max_tokens count toward the limit?',
-        a: 'Yes. The window must fit prompt tokens plus the completion you reserve with max_tokens.',
-      },
-    ],
-    tenants: 34,
-    volume_7d: 70,
-    volume_30d: 210,
-    recovery_rate: 0.88,
-  },
-  {
-    slug: 'anthropic-400-out-of-extra-usage',
-    cluster_key: 'anthropic|error|400|invalid_request_error',
-    provider: 'anthropic',
-    provider_label: 'Anthropic',
-    http_status: 400,
-    category: 'bad_request',
-    category_label: 'Bad request',
-    title: 'Fix Anthropic "you are out of extra usage"',
-    meta_description:
-      'Claude returns a 400 invalid_request_error when a plan runs out of extra usage. What it means and how to keep going.',
-    h1: 'Anthropic 400 — You are out of extra usage',
-    body_what:
-      'Claude rejects the request when the account has spent its included plus extra usage allowance for the period.',
-    body_fix:
-      '- Add or raise the extra usage limit at claude.ai\n- Switch that agent to an API-key provider with credit\n- Fall back to a cheaper model for low-stakes calls',
-    sample_message:
-      '{ "type": "error", "error": { "type": "invalid_request_error", "message": "You are out of extra usage. Add more at claude.ai to keep going." } }',
-    faq: [
-      {
-        q: 'Is this a billing or a rate error?',
-        a: 'Billing. It clears when you raise the usage cap or the billing period resets, not by retrying.',
-      },
-    ],
-    tenants: 30,
-    volume_7d: 66,
-    volume_30d: 150,
-    recovery_rate: 0.7,
-  },
-  {
-    slug: 'anthropic-529-overloaded',
-    cluster_key: 'anthropic|error|529|overloaded_error',
-    provider: 'anthropic',
-    provider_label: 'Anthropic',
-    http_status: 529,
-    category: 'server',
-    category_label: 'Server error',
-    title: 'Fix Anthropic 529 "overloaded_error"',
-    meta_description:
-      'Claude 529 overloaded_error means the API is briefly saturated. How to retry and fail over cleanly.',
-    h1: 'Anthropic 529 — Overloaded',
-    body_what:
-      'A 529 overloaded_error is server-side back-pressure from Anthropic during demand spikes. It is transient.',
-    body_fix:
-      '- Retry with exponential backoff and jitter\n- Fail over to another provider on repeated 529s\n- Cap concurrency during known peak windows',
-    sample_message:
-      '{ "type": "error", "error": { "type": "overloaded_error", "message": "Overloaded" } }',
-    faq: [
-      {
-        q: 'Why 529 and not 503?',
-        a: 'Anthropic uses 529 specifically for capacity overload; treat it like a retryable 503.',
-      },
-    ],
-    tenants: 26,
-    volume_7d: 72,
-    volume_30d: 96,
-    recovery_rate: 0.83,
-  },
-  {
-    slug: 'openrouter-402-insufficient-credits',
-    cluster_key: 'openrouter|error|402|insufficient_credits',
-    provider: 'openrouter',
-    provider_label: 'OpenRouter',
-    http_status: 402,
-    category: 'billing',
-    category_label: 'Billing / quota',
-    title: 'Fix OpenRouter 402 "insufficient credits"',
-    meta_description:
-      'OpenRouter 402 means the account or free tier is out of credits. How to top up or route around it.',
-    h1: 'OpenRouter 402 — Insufficient credits',
-    body_what:
-      'OpenRouter returns 402 when paid credits run out, or when a free model exhausts its daily allowance.',
-    body_fix:
-      '- Top up credits on the OpenRouter dashboard\n- Route free-tier traffic to a key-backed provider\n- Watch the free-models-per-day cap in agent loops',
-    sample_message:
-      '{ "error": { "message": "Rate limit exceeded: free-models-per-day. Add 10 credits to unlock 1000 free model requests per day.", "code": 402 } }',
-    faq: [
-      {
-        q: 'Why a 402 on a free model?',
-        a: 'Free models share a daily request cap; once spent, OpenRouter returns 402 until you add credits or the day resets.',
-      },
-    ],
-    tenants: 70,
-    volume_7d: 150,
-    volume_30d: 420,
-    recovery_rate: 0.88,
-  },
-  {
-    slug: 'openrouter-404-model-not-found',
-    cluster_key: 'openrouter|error|404|no_endpoints',
-    provider: 'openrouter',
-    provider_label: 'OpenRouter',
-    http_status: 404,
-    category: 'model_unavailable',
-    category_label: 'Model unavailable',
-    title: 'Fix OpenRouter 404 "no endpoints found for model"',
-    meta_description:
-      'OpenRouter 404 means the requested model id has no available provider right now. How to pick a live one.',
-    h1: 'OpenRouter 404 — No endpoints found for model',
-    body_what:
-      'A 404 means the model slug is wrong, deprecated, or every provider behind it is temporarily unavailable.',
-    body_fix:
-      '- Verify the exact model id against the OpenRouter models list\n- Drop provider filters that exclude every endpoint\n- Fall back to an equivalent model that is live',
-    sample_message:
-      '{ "error": { "message": "No endpoints found for the requested model.", "code": 404 } }',
-    faq: [
-      {
-        q: 'The model existed yesterday — why 404 now?',
-        a: 'Models get deprecated or briefly lose all providers; pin to a current id or add a fallback.',
-      },
-    ],
-    tenants: 80,
-    volume_7d: 130,
-    volume_30d: 400,
-    recovery_rate: 0.81,
-  },
-  {
-    slug: 'deepseek-400-reasoning-content-required',
-    cluster_key: 'deepseek|error|400|reasoning_content',
-    provider: 'deepseek',
-    provider_label: 'DeepSeek',
-    http_status: 400,
-    category: 'bad_request',
-    category_label: 'Bad request',
-    title: 'Fix DeepSeek 400 "reasoning_content must be passed"',
-    meta_description:
-      'DeepSeek reasoner rejects turns that drop reasoning_content or stack same-role messages. How to shape the request.',
-    h1: 'DeepSeek 400 — reasoning_content must be passed',
-    body_what:
-      'deepseek-reasoner requires the prior reasoning_content on follow-up turns and rejects successive same-role messages.',
-    body_fix:
-      '- Echo the assistant reasoning_content back on the next turn\n- Never send two user or two assistant messages in a row\n- Strip reasoning_content only for non-reasoner models',
-    sample_message:
-      '{ "error": { "message": "The reasoning_content in the thinking mode must be passed.", "code": 400 } }',
-    faq: [
-      {
-        q: 'Do normal chat models need reasoning_content?',
-        a: 'No. Only the reasoner enforces it; sending it to a plain chat model can itself error.',
-      },
-    ],
-    tenants: 48,
-    volume_7d: 96,
-    volume_30d: 240,
-    recovery_rate: 0.6,
-  },
-  {
-    slug: 'groq-429-rate-limit',
-    cluster_key: 'groq|rate_limited|429|rate_limit_exceeded',
-    provider: 'groq',
-    provider_label: 'Groq',
-    http_status: 429,
-    category: 'rate_limit',
-    category_label: 'Rate limit',
-    title: 'Fix Groq 429 "rate limit exceeded"',
-    meta_description:
-      'Groq 429s cap requests and tokens per minute per model. How to pace bursts so agents keep flowing.',
-    h1: 'Groq 429 — Rate limit exceeded',
-    body_what:
-      'Groq enforces tight per-minute request and token limits per model; fast agent loops hit them in bursts.',
-    body_fix:
-      '- Wait for the window in the Retry-After header\n- Throttle concurrency on the client\n- Spread load across models or request a limit bump',
-    sample_message:
-      '{ "error": { "message": "Rate limit reached for model llama-3.3-70b in organization on tokens per minute (TPM).", "code": "rate_limit_exceeded", "type": "tokens" } }',
-    faq: [
-      {
-        q: 'Why does Groq rate limit so aggressively?',
-        a: 'Its very high throughput comes with tight per-minute caps; pacing and fallbacks keep runs alive.',
-      },
-    ],
-    tenants: 38,
-    volume_7d: 140,
-    volume_30d: 300,
-    recovery_rate: 0.76,
-  },
-];
diff --git a/packages/backend/src/error-pages/error-page-seeder.service.spec.ts b/packages/backend/src/error-pages/error-page-seeder.service.spec.ts
deleted file mode 100644
index a313ccf1..00000000
--- a/packages/backend/src/error-pages/error-page-seeder.service.spec.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-import { ErrorPageSeederService } from './error-page-seeder.service';
-import { ErrorPagesService } from './error-pages.service';
-import { ERROR_PAGE_SEEDS } from './error-page-seed-data';
-
-describe('ErrorPageSeederService', () => {
-  let pages: { getBySlug: jest.Mock; upsert: jest.Mock };
-  let service: ErrorPageSeederService;
-  const prev = process.env['SEED_DATA'];
-
-  beforeEach(() => {
-    pages = {
-      getBySlug: jest.fn().mockResolvedValue(null),
-      upsert: jest.fn().mockResolvedValue({ ok: true }),
-    };
-    service = new ErrorPageSeederService(pages as unknown as ErrorPagesService);
-  });
-
-  afterEach(() => {
-    if (prev === undefined) delete process.env['SEED_DATA'];
-    else process.env['SEED_DATA'] = prev;
-  });
-
-  it('does nothing unless SEED_DATA=true', async () => {
-    delete process.env['SEED_DATA'];
-    await service.onModuleInit();
-    expect(pages.getBySlug).not.toHaveBeenCalled();
-    expect(pages.upsert).not.toHaveBeenCalled();
-  });
-
-  it('skips when the demo pages are already published', async () => {
-    process.env['SEED_DATA'] = 'true';
-    pages.getBySlug.mockResolvedValue({ slug: ERROR_PAGE_SEEDS[0].slug });
-    await service.onModuleInit();
-    expect(pages.upsert).not.toHaveBeenCalled();
-  });
-
-  it('publishes every demo page with a populated 14-day trend when not yet seeded', async () => {
-    process.env['SEED_DATA'] = 'true';
-    await service.onModuleInit();
-    expect(pages.upsert).toHaveBeenCalledTimes(ERROR_PAGE_SEEDS.length);
-    const first = pages.upsert.mock.calls[0][0];
-    expect(first.slug).toBe(ERROR_PAGE_SEEDS[0].slug);
-    expect(first.stats.tenants).toBe(ERROR_PAGE_SEEDS[0].tenants);
-    expect(first.stats.trend).toHaveLength(14);
-    expect(first.stats.variants).toEqual(ERROR_PAGE_SEEDS[0].variants ?? []);
-    expect(first.stats.last_seen).toBeTruthy();
-    // an entry without explicit variants still publishes a [] variants array
-    const noVariant = pages.upsert.mock.calls
-      .map((c) => c[0])
-      .find((d) => d.slug === 'gemini-400-missing-thought-signature');
-    expect(noVariant.stats.variants).toEqual([]);
-  });
-});
diff --git a/packages/backend/src/error-pages/error-page-seeder.service.ts b/packages/backend/src/error-pages/error-page-seeder.service.ts
deleted file mode 100644
index 653b9b5e..00000000
--- a/packages/backend/src/error-pages/error-page-seeder.service.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
-import { ErrorPagesService } from './error-pages.service';
-import { ERROR_PAGE_SEEDS, seedTrend } from './error-page-seed-data';
-import type { ErrorPageStats } from '../entities/public-error-page.entity';
-
-/**
- * Publishes the curated demo error pages (dev/test only) through the same
- * `ErrorPagesService.upsert` valve a real Peacock CMS push uses — so the
- * marketing `/errors/` catalog renders a full, chart-rich set (sparkline trends
- * included) without a live CMS. Gated by `SEED_DATA=true`; idempotent (skips if
- * the first demo page is already published, so an operator can unpublish freely).
- */
-@Injectable()
-export class ErrorPageSeederService implements OnModuleInit {
-  private readonly logger = new Logger(ErrorPageSeederService.name);
-
-  constructor(private readonly pages: ErrorPagesService) {}
-
-  async onModuleInit(): Promise<void> {
-    if (process.env['SEED_DATA'] !== 'true') return;
-    if (await this.pages.getBySlug(ERROR_PAGE_SEEDS[0].slug)) return;
-
-    const now = Date.now();
-    const nowIso = new Date(now).toISOString();
-    for (let i = 0; i < ERROR_PAGE_SEEDS.length; i++) {
-      const s = ERROR_PAGE_SEEDS[i];
-      const stats: ErrorPageStats = {
-        tenants: s.tenants,
-        volume_7d: s.volume_7d,
-        volume_30d: s.volume_30d,
-        recovery_rate: s.recovery_rate,
-        last_seen: nowIso,
-        trend: seedTrend(s.volume_30d, i, now),
-        variants: s.variants ?? [],
-      };
-      await this.pages.upsert({
-        slug: s.slug,
-        cluster_key: s.cluster_key,
-        provider: s.provider,
-        provider_label: s.provider_label,
-        http_status: s.http_status,
-        category: s.category,
-        category_label: s.category_label,
-        title: s.title,
-        meta_description: s.meta_description,
-        h1: s.h1,
-        body_what: s.body_what,
-        body_fix: s.body_fix,
-        sample_message: s.sample_message,
-        faq: s.faq,
-        stats,
-      });
-    }
-    this.logger.log(`Seeded ${ERROR_PAGE_SEEDS.length} public error pages (dev demo, with trends)`);
-  }
-}
diff --git a/packages/backend/src/error-pages/error-pages.module.ts b/packages/backend/src/error-pages/error-pages.module.ts
deleted file mode 100644
index 75a0f1ad..00000000
--- a/packages/backend/src/error-pages/error-pages.module.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { Module } from '@nestjs/common';
-import { TypeOrmModule } from '@nestjs/typeorm';
-import { PublicErrorPage } from '../entities/public-error-page.entity';
-import { AgentMessage } from '../entities/agent-message.entity';
-import { ErrorPagesService } from './error-pages.service';
-import { ErrorDiscoveryService } from './error-discovery.service';
-import { ErrorClusterSeederService } from './error-cluster-seeder.service';
-import { ErrorPageSeederService } from './error-page-seeder.service';
-import { PublicErrorPagesController } from './public-error-pages.controller';
-import { InternalErrorPagesController } from './internal-error-pages.controller';
-
-@Module({
-  imports: [TypeOrmModule.forFeature([PublicErrorPage, AgentMessage])],
-  controllers: [PublicErrorPagesController, InternalErrorPagesController],
-  providers: [
-    ErrorPagesService,
-    ErrorDiscoveryService,
-    ErrorClusterSeederService,
-    ErrorPageSeederService,
-  ],
-})
-export class ErrorPagesModule {}
diff --git a/packages/backend/src/error-pages/error-pages.service.spec.ts b/packages/backend/src/error-pages/error-pages.service.spec.ts
deleted file mode 100644
index d85dbd2d..00000000
--- a/packages/backend/src/error-pages/error-pages.service.spec.ts
+++ /dev/null
@@ -1,244 +0,0 @@
-import { BadRequestException } from '@nestjs/common';
-import { ErrorPagesService, MIN_TENANTS_FOR_PUBLIC } from './error-pages.service';
-import type { PublicErrorPage, ErrorPageStats } from '../entities/public-error-page.entity';
-import type { UpsertErrorPageDto } from './dto/upsert-error-page.dto';
-
-function makeStats(overrides: Partial<ErrorPageStats> = {}): ErrorPageStats {
-  return {
-    tenants: 12,
-    volume_7d: 100,
-    volume_30d: 400,
-    recovery_rate: 0.5,
-    last_seen: '2026-06-01T00:00:00.000Z',
-    trend: [],
-    ...overrides,
-  };
-}
-
-function makeDto(overrides: Partial<UpsertErrorPageDto> = {}): UpsertErrorPageDto {
-  return {
-    slug: 'gemini-429-rate-limit',
-    cluster_key: 'gemini|429',
-    provider: 'gemini',
-    title: 'Gemini 429 rate limit',
-    meta_description: 'A description',
-    h1: 'Gemini rate limit',
-    stats: makeStats(),
-    ...overrides,
-  } as UpsertErrorPageDto;
-}
-
-describe('ErrorPagesService', () => {
-  let service: ErrorPagesService;
-  let mockRepo: {
-    find: jest.Mock;
-    findOne: jest.Mock;
-    save: jest.Mock;
-    delete: jest.Mock;
-    count: jest.Mock;
-  };
-
-  beforeEach(() => {
-    mockRepo = {
-      find: jest.fn(),
-      findOne: jest.fn(),
-      save: jest.fn(),
-      delete: jest.fn(),
-      count: jest.fn(),
-    };
-    service = new ErrorPagesService(mockRepo as never);
-  });
-
-  it('exposes the k-anonymity floor constant', () => {
-    expect(MIN_TENANTS_FOR_PUBLIC).toBe(10);
-  });
-
-  describe('listPublished', () => {
-    it('returns pages ordered by published_at DESC', async () => {
-      const pages = [{ slug: 'a' }, { slug: 'b' }] as PublicErrorPage[];
-      mockRepo.find.mockResolvedValue(pages);
-
-      const result = await service.listPublished();
-
-      expect(result).toBe(pages);
-      expect(mockRepo.find).toHaveBeenCalledWith({ order: { published_at: 'DESC' } });
-    });
-  });
-
-  describe('getBySlug', () => {
-    it('looks up a single page by slug', async () => {
-      const page = { slug: 'gemini-429' } as PublicErrorPage;
-      mockRepo.findOne.mockResolvedValue(page);
-
-      const result = await service.getBySlug('gemini-429');
-
-      expect(result).toBe(page);
-      expect(mockRepo.findOne).toHaveBeenCalledWith({ where: { slug: 'gemini-429' } });
-    });
-
-    it('returns null when no page matches', async () => {
-      mockRepo.findOne.mockResolvedValue(null);
-
-      expect(await service.getBySlug('missing')).toBeNull();
-    });
-  });
-
-  describe('upsert', () => {
-    it('rejects when tenants is below the k-anonymity floor', async () => {
-      const dto = makeDto({ stats: makeStats({ tenants: 9 }) });
-
-      await expect(service.upsert(dto)).rejects.toBeInstanceOf(BadRequestException);
-      await expect(service.upsert(dto)).rejects.toThrow(
-        'cluster affects 9 tenants, below the k-anonymity floor of 10',
-      );
-      expect(mockRepo.save).not.toHaveBeenCalled();
-    });
-
-    it('rejects when stats is missing entirely (defaults tenants to 0)', async () => {
-      const dto = { ...makeDto(), stats: undefined } as unknown as UpsertErrorPageDto;
-
-      await expect(service.upsert(dto)).rejects.toBeInstanceOf(BadRequestException);
-      await expect(service.upsert(dto)).rejects.toThrow('cluster affects 0 tenants');
-      expect(mockRepo.save).not.toHaveBeenCalled();
-    });
-
-    it('rejects when tenants is non-finite (NaN)', async () => {
-      const dto = makeDto({
-        stats: makeStats({ tenants: 'oops' as unknown as number }),
-      });
-
-      await expect(service.upsert(dto)).rejects.toBeInstanceOf(BadRequestException);
-      expect(mockRepo.save).not.toHaveBeenCalled();
-    });
-
-    it('rejects a custom: provider even above the floor (never a public page)', async () => {
-      const dto = makeDto({ provider: 'custom:1aee1812', stats: makeStats({ tenants: 500 }) });
-      await expect(service.upsert(dto)).rejects.toBeInstanceOf(BadRequestException);
-      await expect(service.upsert(dto)).rejects.toThrow('custom providers are tenant-specific');
-      expect(mockRepo.save).not.toHaveBeenCalled();
-    });
-
-    it('accepts exactly the floor (10 tenants)', async () => {
-      const dto = makeDto({ stats: makeStats({ tenants: MIN_TENANTS_FOR_PUBLIC }) });
-      mockRepo.findOne.mockResolvedValue(null);
-      mockRepo.save.mockResolvedValue(undefined);
-
-      const result = await service.upsert(dto);
-
-      expect(result).toEqual({ ok: true, slug: dto.slug });
-      expect(mockRepo.save).toHaveBeenCalledTimes(1);
-    });
-
-    it('scrubs secrets from sample_message before persisting', async () => {
-      const dto = makeDto({
-        sample_message: 'token leaked: sk-proj-ABCDEF1234567890 in the body',
-      });
-      mockRepo.findOne.mockResolvedValue(null);
-      mockRepo.save.mockResolvedValue(undefined);
-
-      await service.upsert(dto);
-
-      const saved = mockRepo.save.mock.calls[0][0] as PublicErrorPage;
-      expect(saved.sample_message).toBe('token leaked: [REDACTED] in the body');
-      expect(saved.sample_message).not.toContain('sk-proj-ABCDEF1234567890');
-    });
-
-    it('preserves an existing published_at on re-upsert', async () => {
-      const original = '2026-01-01T00:00:00.000Z';
-      mockRepo.findOne.mockResolvedValue({ published_at: original } as PublicErrorPage);
-      mockRepo.save.mockResolvedValue(undefined);
-
-      await service.upsert(makeDto());
-
-      const saved = mockRepo.save.mock.calls[0][0] as PublicErrorPage;
-      expect(saved.published_at).toBe(original);
-      // updated_at is always refreshed to "now", distinct from the preserved value.
-      expect(saved.updated_at).not.toBe(original);
-    });
-
-    it('sets published_at to now for a brand-new page', async () => {
-      mockRepo.findOne.mockResolvedValue(null);
-      mockRepo.save.mockResolvedValue(undefined);
-
-      await service.upsert(makeDto());
-
-      const saved = mockRepo.save.mock.calls[0][0] as PublicErrorPage;
-      expect(saved.published_at).toBe(saved.updated_at);
-      expect(() => new Date(saved.published_at).toISOString()).not.toThrow();
-    });
-
-    it('fills defaults for optional fields', async () => {
-      mockRepo.findOne.mockResolvedValue(null);
-      mockRepo.save.mockResolvedValue(undefined);
-
-      await service.upsert(makeDto({ provider: 'gemini' }));
-
-      const saved = mockRepo.save.mock.calls[0][0] as PublicErrorPage;
-      expect(saved.provider_label).toBe('gemini'); // ← provider
-      expect(saved.http_status).toBeNull();
-      expect(saved.category).toBe('unknown');
-      expect(saved.category_label).toBe('');
-      expect(saved.body_what).toBe('');
-      expect(saved.body_fix).toBe('');
-      expect(saved.body_manifest).toBe('');
-      expect(saved.sample_message).toBe('');
-      expect(saved.faq).toEqual([]);
-      expect(saved.related).toEqual([]);
-      expect(saved.noindex).toBe(false);
-    });
-
-    it('keeps explicitly provided optional fields', async () => {
-      mockRepo.findOne.mockResolvedValue(null);
-      mockRepo.save.mockResolvedValue(undefined);
-      const dto = makeDto({
-        provider_label: 'Google Gemini',
-        http_status: 429,
-        category: 'rate_limit',
-        category_label: 'Rate limit',
-        body_what: 'what',
-        body_fix: 'fix',
-        body_manifest: 'manifest',
-        faq: [{ q: 'why?', a: 'because' }],
-        related: [{ slug: 'other', title: 'Other' }],
-        noindex: true,
-      });
-
-      await service.upsert(dto);
-
-      const saved = mockRepo.save.mock.calls[0][0] as PublicErrorPage;
-      expect(saved.provider_label).toBe('Google Gemini');
-      expect(saved.http_status).toBe(429);
-      expect(saved.category).toBe('rate_limit');
-      expect(saved.category_label).toBe('Rate limit');
-      expect(saved.body_what).toBe('what');
-      expect(saved.body_fix).toBe('fix');
-      expect(saved.body_manifest).toBe('manifest');
-      expect(saved.faq).toEqual([{ q: 'why?', a: 'because' }]);
-      expect(saved.related).toEqual([{ slug: 'other', title: 'Other' }]);
-      expect(saved.noindex).toBe(true);
-      expect(saved.cluster_key).toBe(dto.cluster_key);
-      expect(saved.stats).toBe(dto.stats);
-    });
-
-    it('treats an explicit null http_status as null', async () => {
-      mockRepo.findOne.mockResolvedValue(null);
-      mockRepo.save.mockResolvedValue(undefined);
-
-      await service.upsert(makeDto({ http_status: null }));
-
-      const saved = mockRepo.save.mock.calls[0][0] as PublicErrorPage;
-      expect(saved.http_status).toBeNull();
-    });
-  });
-
-  describe('remove', () => {
-    it('deletes by slug and echoes the slug', async () => {
-      mockRepo.delete.mockResolvedValue(undefined);
-
-      const result = await service.remove('gemini-429');
-
-      expect(result).toEqual({ ok: true, slug: 'gemini-429' });
-      expect(mockRepo.delete).toHaveBeenCalledWith({ slug: 'gemini-429' });
-    });
-  });
-});
diff --git a/packages/backend/src/error-pages/error-pages.service.ts b/packages/backend/src/error-pages/error-pages.service.ts
deleted file mode 100644
index 3569186c..00000000
--- a/packages/backend/src/error-pages/error-pages.service.ts
+++ /dev/null
@@ -1,100 +0,0 @@
-import { BadRequestException, Injectable } from '@nestjs/common';
-import { InjectRepository } from '@nestjs/typeorm';
-import { Repository } from 'typeorm';
-import { PublicErrorPage } from '../entities/public-error-page.entity';
-import { scrubSecrets } from '../common/utils/secret-scrub';
-import { UpsertErrorPageDto } from './dto/upsert-error-page.dto';
-
-/**
- * k-anonymity floor: a cluster is never published as a public page unless it
- * affected at least this many distinct tenants. Enforced here (defensively) in
- * addition to the Peacock CMS, so even a CMS bug can't leak a sub-threshold
- * cluster through the push endpoint.
- */
-export const MIN_TENANTS_FOR_PUBLIC = 10;
-
-// Public valve scrub: provider-credential redaction (shared util) PLUS email
-// redaction. This is the single choke point — every sample reaching
-// `public_error_pages` passes through here regardless of which source pushed it.
-const EMAIL_RE = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
-function scrubForPublic(text: string | null | undefined): string {
-  return scrubSecrets(text ?? '').replace(EMAIL_RE, '[email]');
-}
-
-// A `custom:<id>` provider is a single tenant's private endpoint — its errors
-// are tenant-specific and can never become a public page. Rejected here at the
-// valve (the single choke point) no matter what the caller pushes, mirroring the
-// `custom:%` exclusion already applied in discovery.
-function isCustomProvider(provider: string): boolean {
-  return /^custom($|[:/])/i.test(provider);
-}
-
-@Injectable()
-export class ErrorPagesService {
-  constructor(
-    @InjectRepository(PublicErrorPage)
-    private readonly repo: Repository<PublicErrorPage>,
-  ) {}
-
-  listPublished(): Promise<PublicErrorPage[]> {
-    return this.repo.find({ order: { published_at: 'DESC' } });
-  }
-
-  getBySlug(slug: string): Promise<PublicErrorPage | null> {
-    return this.repo.findOne({ where: { slug } });
-  }
-
-  /**
-   * Publish or refresh a page. Re-validates the k-anonymity floor and re-scrubs
-   * the public sample message before persisting, regardless of what the caller
-   * sent — the public table must never hold an un-vetted row.
-   */
-  async upsert(dto: UpsertErrorPageDto): Promise<{ ok: true; slug: string }> {
-    if (isCustomProvider(dto.provider)) {
-      throw new BadRequestException(
-        `Refusing to publish "${dto.slug}": custom providers are tenant-specific and cannot be public pages.`,
-      );
-    }
-
-    const tenants = Number(dto.stats?.tenants ?? 0);
-    if (!Number.isFinite(tenants) || tenants < MIN_TENANTS_FOR_PUBLIC) {
-      throw new BadRequestException(
-        `Refusing to publish "${dto.slug}": cluster affects ${tenants} tenants, below the k-anonymity floor of ${MIN_TENANTS_FOR_PUBLIC}.`,
-      );
-    }
-
-    const now = new Date().toISOString();
-    const existing = await this.repo.findOne({ where: { slug: dto.slug } });
-
-    const row: PublicErrorPage = {
-      slug: dto.slug,
-      cluster_key: dto.cluster_key,
-      provider: dto.provider,
-      provider_label: dto.provider_label ?? dto.provider,
-      http_status: dto.http_status ?? null,
-      category: dto.category ?? 'unknown',
-      category_label: dto.category_label ?? '',
-      title: dto.title,
-      meta_description: dto.meta_description,
-      h1: dto.h1,
-      body_what: dto.body_what ?? '',
-      body_fix: dto.body_fix ?? '',
-      body_manifest: dto.body_manifest ?? '',
-      sample_message: scrubForPublic(dto.sample_message),
-      faq: dto.faq ?? [],
-      stats: dto.stats,
-      related: dto.related ?? [],
-      noindex: dto.noindex ?? false,
-      published_at: existing?.published_at ?? now,
-      updated_at: now,
-    };
-
-    await this.repo.save(row);
-    return { ok: true, slug: dto.slug };
-  }
-
-  async remove(slug: string): Promise<{ ok: true; slug: string }> {
-    await this.repo.delete({ slug });
-    return { ok: true, slug };
-  }
-}
diff --git a/packages/backend/src/error-pages/internal-error-pages.controller.spec.ts b/packages/backend/src/error-pages/internal-error-pages.controller.spec.ts
deleted file mode 100644
index 8dc1a90a..00000000
--- a/packages/backend/src/error-pages/internal-error-pages.controller.spec.ts
+++ /dev/null
@@ -1,118 +0,0 @@
-import { UnauthorizedException } from '@nestjs/common';
-import type { ConfigService } from '@nestjs/config';
-import { InternalErrorPagesController } from './internal-error-pages.controller';
-import type { ErrorPagesService } from './error-pages.service';
-import type { ErrorDiscoveryService } from './error-discovery.service';
-import type { UpsertErrorPageDto } from './dto/upsert-error-page.dto';
-
-const SECRET = 'super-secret-push-token';
-
-function makeConfig(secret: string | undefined): ConfigService {
-  return {
-    get: jest.fn((key: string) => (key === 'app.errorPagePushSecret' ? secret : undefined)),
-  } as unknown as ConfigService;
-}
-
-describe('InternalErrorPagesController', () => {
-  let mockService: { upsert: jest.Mock; remove: jest.Mock };
-  let mockDiscovery: { discover: jest.Mock };
-
-  beforeEach(() => {
-    mockService = { upsert: jest.fn(), remove: jest.fn() };
-    mockDiscovery = { discover: jest.fn() };
-  });
-
-  function makeController(secret: string | undefined): InternalErrorPagesController {
-    return new InternalErrorPagesController(
-      mockService as unknown as ErrorPagesService,
-      mockDiscovery as unknown as ErrorDiscoveryService,
-      makeConfig(secret),
-    );
-  }
-
-  const dto = { slug: 'gemini-429' } as UpsertErrorPageDto;
-
-  describe('secret rejection', () => {
-    it('rejects clusters when the header is missing', async () => {
-      const controller = makeController(SECRET);
-
-      await expect(controller.clusters(undefined as unknown as string)).rejects.toBeInstanceOf(
-        UnauthorizedException,
-      );
-      expect(mockDiscovery.discover).not.toHaveBeenCalled();
-    });
-
-    it('rejects clusters when the header is wrong', async () => {
-      const controller = makeController(SECRET);
-
-      await expect(controller.clusters('nope')).rejects.toBeInstanceOf(UnauthorizedException);
-      expect(mockDiscovery.discover).not.toHaveBeenCalled();
-    });
-
-    it('rejects when the configured secret is empty even if header matches it', async () => {
-      const controller = makeController('');
-
-      // Both provided and expected would be '' — but an empty configured secret
-      // must never authorize, so this still rejects.
-      await expect(controller.clusters('')).rejects.toBeInstanceOf(UnauthorizedException);
-      expect(mockDiscovery.discover).not.toHaveBeenCalled();
-    });
-
-    it('rejects when the configured secret is unset (undefined → "")', async () => {
-      const controller = makeController(undefined);
-
-      await expect(controller.clusters('anything')).rejects.toBeInstanceOf(UnauthorizedException);
-    });
-
-    it('rejects upsert with a bad secret without touching the service', async () => {
-      const controller = makeController(SECRET);
-
-      await expect(controller.upsert('wrong', dto)).rejects.toBeInstanceOf(UnauthorizedException);
-      expect(mockService.upsert).not.toHaveBeenCalled();
-    });
-
-    it('rejects remove with a bad secret without touching the service', async () => {
-      const controller = makeController(SECRET);
-
-      await expect(controller.remove('wrong', 'gemini-429')).rejects.toBeInstanceOf(
-        UnauthorizedException,
-      );
-      expect(mockService.remove).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('with the correct secret', () => {
-    it('clusters delegates to the discovery service', async () => {
-      const clusters = [{ cluster_key: 'gemini|429' }];
-      mockDiscovery.discover.mockResolvedValue(clusters);
-      const controller = makeController(SECRET);
-
-      const result = await controller.clusters(SECRET);
-
-      expect(result).toBe(clusters);
-      expect(mockDiscovery.discover).toHaveBeenCalledTimes(1);
-    });
-
-    it('upsert delegates to the pages service', async () => {
-      const response = { ok: true as const, slug: 'gemini-429' };
-      mockService.upsert.mockResolvedValue(response);
-      const controller = makeController(SECRET);
-
-      const result = await controller.upsert(SECRET, dto);
-
-      expect(result).toBe(response);
-      expect(mockService.upsert).toHaveBeenCalledWith(dto);
-    });
-
-    it('remove delegates to the pages service', async () => {
-      const response = { ok: true as const, slug: 'gemini-429' };
-      mockService.remove.mockResolvedValue(response);
-      const controller = makeController(SECRET);
-
-      const result = await controller.remove(SECRET, 'gemini-429');
-
-      expect(result).toBe(response);
-      expect(mockService.remove).toHaveBeenCalledWith('gemini-429');
-    });
-  });
-});
diff --git a/packages/backend/src/error-pages/internal-error-pages.controller.ts b/packages/backend/src/error-pages/internal-error-pages.controller.ts
deleted file mode 100644
index 51816c34..00000000
--- a/packages/backend/src/error-pages/internal-error-pages.controller.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import {
-  Body,
-  Controller,
-  Delete,
-  Get,
-  Headers,
-  Param,
-  Post,
-  UnauthorizedException,
-} from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { Public } from '../common/decorators/public.decorator';
-import { ErrorPagesService } from './error-pages.service';
-import { ErrorDiscoveryService } from './error-discovery.service';
-import { UpsertErrorPageDto } from './dto/upsert-error-page.dto';
-
-/**
- * Internal write API. The Peacock CMS pushes published pages here (and deletes
- * on unpublish). Marked @Public() to skip the session/api-key guards, then
- * gated by a shared secret in the `x-internal-secret` header — this is the only
- * way a row reaches `public_error_pages`. Lives under /api/* so the SPA static
- * fallback never shadows it.
- */
-@Controller('api/v1/internal/error-pages')
-export class InternalErrorPagesController {
-  constructor(
-    private readonly service: ErrorPagesService,
-    private readonly discovery: ErrorDiscoveryService,
-    private readonly config: ConfigService,
-  ) {}
-
-  private assertSecret(provided: string | undefined): void {
-    const expected = this.config.get<string>('app.errorPagePushSecret') ?? '';
-    if (!expected || provided !== expected) {
-      throw new UnauthorizedException('Invalid or missing push secret');
-    }
-  }
-
-  // Live cross-tenant cluster rollup the Peacock CMS pulls from to discover and
-  // refresh clusters. Same secret as the push endpoints.
-  @Public()
-  @Get('clusters')
-  async clusters(@Headers('x-internal-secret') secret: string) {
-    this.assertSecret(secret);
-    return this.discovery.discover();
-  }
-
-  @Public()
-  @Post()
-  async upsert(@Headers('x-internal-secret') secret: string, @Body() dto: UpsertErrorPageDto) {
-    this.assertSecret(secret);
-    return this.service.upsert(dto);
-  }
-
-  @Public()
-  @Delete(':slug')
-  async remove(@Headers('x-internal-secret') secret: string, @Param('slug') slug: string) {
-    this.assertSecret(secret);
-    return this.service.remove(slug);
-  }
-}
diff --git a/packages/backend/src/error-pages/public-error-pages.controller.spec.ts b/packages/backend/src/error-pages/public-error-pages.controller.spec.ts
deleted file mode 100644
index 31e15824..00000000
--- a/packages/backend/src/error-pages/public-error-pages.controller.spec.ts
+++ /dev/null
@@ -1,153 +0,0 @@
-import { NotFoundException } from '@nestjs/common';
-import type { ConfigService } from '@nestjs/config';
-import { PublicErrorPagesController } from './public-error-pages.controller';
-import type { ErrorPagesService } from './error-pages.service';
-import type { PublicErrorPage } from '../entities/public-error-page.entity';
-
-function makeConfig(enabled: boolean): ConfigService {
-  return {
-    get: jest.fn((key: string) => (key === 'app.publicErrorPagesEnabled' ? enabled : undefined)),
-  } as unknown as ConfigService;
-}
-
-function makePage(overrides: Partial<PublicErrorPage> = {}): PublicErrorPage {
-  return {
-    slug: 'gemini-429-rate-limit',
-    cluster_key: 'gemini|429',
-    provider: 'gemini',
-    provider_label: 'Google Gemini',
-    http_status: 429,
-    category: 'rate_limit',
-    category_label: 'Rate limit',
-    title: 'Gemini 429',
-    meta_description: 'desc',
-    h1: 'Gemini rate limit',
-    body_what: 'what',
-    body_fix: 'fix',
-    body_manifest: 'manifest',
-    sample_message: 'sample',
-    faq: [],
-    stats: {
-      tenants: 42,
-      volume_7d: 100,
-      volume_30d: 400,
-      recovery_rate: 0.74,
-      last_seen: '2026-06-01T00:00:00.000Z',
-      trend: [],
-    },
-    related: [],
-    noindex: false,
-    published_at: '2026-05-01T00:00:00.000Z',
-    updated_at: '2026-06-01T00:00:00.000Z',
-    ...overrides,
-  };
-}
-
-describe('PublicErrorPagesController', () => {
-  let mockService: { listPublished: jest.Mock; getBySlug: jest.Mock };
-
-  beforeEach(() => {
-    mockService = {
-      listPublished: jest.fn(),
-      getBySlug: jest.fn(),
-    };
-  });
-
-  function makeController(enabled: boolean): PublicErrorPagesController {
-    return new PublicErrorPagesController(
-      mockService as unknown as ErrorPagesService,
-      makeConfig(enabled),
-    );
-  }
-
-  describe('when public stats are disabled', () => {
-    it('throws NotFoundException from list without calling the service', async () => {
-      const controller = makeController(false);
-
-      await expect(controller.list()).rejects.toBeInstanceOf(NotFoundException);
-      expect(mockService.listPublished).not.toHaveBeenCalled();
-    });
-
-    it('throws NotFoundException from detail without calling the service', async () => {
-      const controller = makeController(false);
-
-      await expect(controller.detail('gemini-429')).rejects.toBeInstanceOf(NotFoundException);
-      expect(mockService.getBySlug).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('list (enabled)', () => {
-    it('projects only the public summary fields plus cached_at', async () => {
-      mockService.listPublished.mockResolvedValue([makePage()]);
-      const controller = makeController(true);
-
-      const result = await controller.list();
-
-      expect(mockService.listPublished).toHaveBeenCalledTimes(1);
-      expect(result.cached_at).toBeDefined();
-      expect(typeof result.cached_at).toBe('string');
-      expect(result.pages).toHaveLength(1);
-
-      const page = result.pages[0];
-      expect(page).toEqual({
-        slug: 'gemini-429-rate-limit',
-        title: 'Gemini 429',
-        h1: 'Gemini rate limit',
-        meta_description: 'desc',
-        provider: 'gemini',
-        provider_label: 'Google Gemini',
-        http_status: 429,
-        category: 'rate_limit',
-        category_label: 'Rate limit',
-        stats: makePage().stats,
-        noindex: false,
-        published_at: '2026-05-01T00:00:00.000Z',
-        updated_at: '2026-06-01T00:00:00.000Z',
-      });
-    });
-
-    it('does not leak internal/body fields in the projection', async () => {
-      mockService.listPublished.mockResolvedValue([makePage()]);
-      const controller = makeController(true);
-
-      const page = (await controller.list()).pages[0] as Record<string, unknown>;
-
-      expect(page).not.toHaveProperty('cluster_key');
-      expect(page).not.toHaveProperty('body_what');
-      expect(page).not.toHaveProperty('body_fix');
-      expect(page).not.toHaveProperty('body_manifest');
-      expect(page).not.toHaveProperty('sample_message');
-      expect(page).not.toHaveProperty('faq');
-      expect(page).not.toHaveProperty('related');
-    });
-
-    it('returns an empty pages array when nothing is published', async () => {
-      mockService.listPublished.mockResolvedValue([]);
-      const controller = makeController(true);
-
-      const result = await controller.list();
-
-      expect(result.pages).toEqual([]);
-    });
-  });
-
-  describe('detail (enabled)', () => {
-    it('returns the full page when found', async () => {
-      const page = makePage();
-      mockService.getBySlug.mockResolvedValue(page);
-      const controller = makeController(true);
-
-      const result = await controller.detail('gemini-429-rate-limit');
-
-      expect(result).toBe(page);
-      expect(mockService.getBySlug).toHaveBeenCalledWith('gemini-429-rate-limit');
-    });
-
-    it('throws NotFoundException when the page is missing', async () => {
-      mockService.getBySlug.mockResolvedValue(null);
-      const controller = makeController(true);
-
-      await expect(controller.detail('missing')).rejects.toBeInstanceOf(NotFoundException);
-    });
-  });
-});
diff --git a/packages/backend/src/error-pages/public-error-pages.controller.ts b/packages/backend/src/error-pages/public-error-pages.controller.ts
deleted file mode 100644
index 258f072b..00000000
--- a/packages/backend/src/error-pages/public-error-pages.controller.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-import { Controller, Get, NotFoundException, Param } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { Public } from '../common/decorators/public.decorator';
-import { ErrorPagesService } from './error-pages.service';
-
-/**
- * Public, unauthenticated read API consumed by the marketing site
- * (manifest.build/errors/...). Gated by MANIFEST_PUBLIC_STATS, 404 (not 403)
- * when disabled so probes can't distinguish "off" from "absent".
- */
-@Controller('api/v1/public/error-pages')
-export class PublicErrorPagesController {
-  constructor(
-    private readonly service: ErrorPagesService,
-    private readonly config: ConfigService,
-  ) {}
-
-  private assertEnabled(): void {
-    if (!this.config.get<boolean>('app.publicErrorPagesEnabled')) {
-      throw new NotFoundException();
-    }
-  }
-
-  @Public()
-  @Get()
-  async list() {
-    this.assertEnabled();
-    const pages = await this.service.listPublished();
-    return {
-      pages: pages.map((p) => ({
-        slug: p.slug,
-        title: p.title,
-        h1: p.h1,
-        meta_description: p.meta_description,
-        provider: p.provider,
-        provider_label: p.provider_label,
-        http_status: p.http_status,
-        category: p.category,
-        category_label: p.category_label,
-        stats: p.stats,
-        noindex: p.noindex,
-        published_at: p.published_at,
-        updated_at: p.updated_at,
-      })),
-      cached_at: new Date().toISOString(),
-    };
-  }
-
-  @Public()
-  @Get(':slug')
-  async detail(@Param('slug') slug: string) {
-    this.assertEnabled();
-    const page = await this.service.getBySlug(slug);
-    if (!page) throw new NotFoundException();
-    return page;
-  }
-}
diff --git a/packages/backend/src/free-models/free-models-provider-metadata.ts b/packages/backend/src/free-models/free-models-provider-metadata.ts
deleted file mode 100644
index de43f17f..00000000
--- a/packages/backend/src/free-models/free-models-provider-metadata.ts
+++ /dev/null
@@ -1,96 +0,0 @@
-export interface ProviderMetadata {
-  /** Path to self-hosted icon, e.g. '/icons/cohere.svg' */
-  logo: string;
-  /** Override the display name from GitHub data.json */
-  displayName?: string;
-  /** Bullet-point tags shown under the provider name */
-  tags: string[];
-  /** Yellow warning banner text */
-  warning: string;
-}
-
-/**
- * UI-specific metadata keyed by the exact `name` from GitHub data.json.
- * baseUrl and model IDs come from GitHub — this map only holds
- * display/UX fields that don't belong in the shared data source.
- */
-export const PROVIDER_METADATA: Readonly<Record<string, ProviderMetadata>> = {
-  Cerebras: {
-    logo: '/icons/cerebras.svg',
-    tags: ['Fast inference', 'No credit card required'],
-    warning: '',
-  },
-  'Cloudflare Workers AI': {
-    logo: '/icons/workersai.svg',
-    tags: ['10,000 neurons/day free', 'No credit card required'],
-    warning: '',
-  },
-  Cohere: {
-    logo: '/icons/cohere.svg',
-    tags: ['Up to 1,000 calls/month', 'No credit card required'],
-    warning:
-      'Trial keys cannot be used for production or commercial workloads. Data may be used for training.',
-  },
-  'GitHub Models': {
-    logo: '/icons/github.svg',
-    tags: ['Rate-limited free tier', 'No credit card required'],
-    warning: '',
-  },
-  'Google Gemini': {
-    logo: '/icons/gemini.svg',
-    tags: ['250K TPM (Tokens / Minute) shared across models', 'No credit card required'],
-    warning:
-      'Rate limits apply per Google Cloud project, not per API key. On the free tier, prompts and responses may be used to improve Google products.',
-  },
-  Groq: {
-    logo: '/icons/groq.svg',
-    tags: ['Fast inference', 'No credit card required'],
-    warning: '',
-  },
-  'Hugging Face': {
-    logo: '/icons/huggingface.svg',
-    tags: ['Serverless Inference API', 'No credit card required'],
-    warning: '',
-  },
-  'Kilo Code': {
-    logo: '/icons/kilocode.svg',
-    tags: ['No credit card required'],
-    warning: 'Prompts and outputs are logged on free models to improve provider products.',
-  },
-  'LLM7.io': {
-    logo: '',
-    tags: ['No credit card required'],
-    warning: '',
-  },
-  'Mistral AI': {
-    logo: '/icons/providers/mistral.svg',
-    tags: ['No credit card required'],
-    warning: '',
-  },
-  'NVIDIA NIM': {
-    logo: '/icons/nvidia.svg',
-    tags: ['1,000 free credits', 'No credit card required'],
-    warning: '',
-  },
-  'Ollama Cloud': {
-    logo: '/icons/ollama.svg',
-    tags: ['No credit card required'],
-    warning: '',
-  },
-  OpenRouter: {
-    logo: '/icons/openrouter.svg',
-    tags: ['Free tier models available', 'No credit card required'],
-    warning: '',
-  },
-  SiliconFlow: {
-    logo: '/icons/siliconflow.svg',
-    tags: ['No credit card required'],
-    warning: '',
-  },
-  'Z AI (Zhipu AI)': {
-    logo: '/icons/zai.svg',
-    displayName: 'Z AI',
-    tags: ['No credit card required'],
-    warning: '',
-  },
-};
diff --git a/packages/backend/src/free-models/free-models-sync.service.spec.ts b/packages/backend/src/free-models/free-models-sync.service.spec.ts
deleted file mode 100644
index f751ab76..00000000
--- a/packages/backend/src/free-models/free-models-sync.service.spec.ts
+++ /dev/null
@@ -1,290 +0,0 @@
-import { FreeModelsSyncService } from './free-models-sync.service';
-
-const GITHUB_RAW_URL =
-  'https://raw.githubusercontent.com/mnfst/awesome-free-llm-apis/8b0feb0e3adda96455bcc380b815454944ff3832/data.json';
-
-const sampleData = {
-  lastUpdated: '2026-04-17',
-  providers: [
-    {
-      name: 'Cohere',
-      category: 'provider_api',
-      country: 'CA',
-      flag: '\u{1F1E8}\u{1F1E6}',
-      url: 'https://dashboard.cohere.com/api-keys',
-      baseUrl: 'https://api.cohere.ai/compatibility/v1',
-      description: 'Free trial API key.',
-      footnoteRef: null,
-      models: [
-        {
-          id: 'command-a-03-2025',
-          name: 'Command A (111B)',
-          context: '256K',
-          maxOutput: '4K',
-          modality: 'Text',
-          rateLimit: '20 RPM',
-        },
-      ],
-    },
-    {
-      name: 'Google Gemini',
-      category: 'provider_api',
-      country: 'US',
-      flag: '\u{1F1FA}\u{1F1F8}',
-      url: 'https://aistudio.google.com/app/apikey',
-      baseUrl: 'https://generativelanguage.googleapis.com/v1beta/openai/',
-      description: 'Free tier.',
-      footnoteRef: 1,
-      models: [
-        {
-          id: 'gemini-2.5-flash',
-          name: 'Gemini 2.5 Flash',
-          context: '1M',
-          maxOutput: '65K',
-          modality: 'Text + Image',
-          rateLimit: '10 RPM',
-        },
-      ],
-    },
-  ],
-};
-
-let fetchSpy: jest.SpyInstance;
-
-describe('FreeModelsSyncService', () => {
-  let service: FreeModelsSyncService;
-
-  beforeEach(() => {
-    service = new FreeModelsSyncService();
-    fetchSpy = jest.spyOn(global, 'fetch');
-  });
-
-  afterEach(() => {
-    fetchSpy.mockRestore();
-  });
-
-  describe('onModuleInit', () => {
-    it('kicks off refreshCache without blocking and populates the cache', async () => {
-      const refresh = jest.spyOn(service, 'refreshCache');
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => sampleData,
-      });
-
-      // Fire-and-forget (must not block boot — see #1894); await the kicked-off
-      // refresh deterministically via the spy's returned promise.
-      service.onModuleInit();
-      await refresh.mock.results[0].value;
-      expect(fetchSpy).toHaveBeenCalledWith(
-        GITHUB_RAW_URL,
-        expect.objectContaining({ signal: expect.any(AbortSignal) }),
-      );
-      expect(service.getAll()).toHaveLength(2);
-    });
-
-    it('does not leave an unhandled rejection when refreshCache rejects', async () => {
-      const refresh = jest
-        .spyOn(service, 'refreshCache')
-        .mockRejectedValue(new Error('Unexpected'));
-      service.onModuleInit();
-      // onModuleInit attaches a .catch that swallows the failure.
-      await expect(refresh.mock.results[0].value).rejects.toThrow('Unexpected');
-    });
-  });
-
-  describe('refreshCache', () => {
-    it('populates cache with successful response', async () => {
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => sampleData,
-      });
-
-      const count = await service.refreshCache();
-      expect(count).toBe(2);
-      expect(service.getAll()).toHaveLength(2);
-      expect(service.getAll()[0].name).toBe('Cohere');
-      expect(service.getAll()[1].name).toBe('Google Gemini');
-      expect(service.getLastFetchedAt()).toBeInstanceOf(Date);
-    });
-
-    it('returns 0 when API returns non-OK status', async () => {
-      fetchSpy.mockResolvedValue({ ok: false, status: 503 });
-
-      const count = await service.refreshCache();
-      expect(count).toBe(0);
-      expect(service.getAll()).toHaveLength(0);
-    });
-
-    it('returns 0 when fetch throws', async () => {
-      fetchSpy.mockRejectedValue(new Error('Network error'));
-
-      const count = await service.refreshCache();
-      expect(count).toBe(0);
-      expect(service.getAll()).toHaveLength(0);
-    });
-
-    it('returns 0 when providers array is missing', async () => {
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => ({ lastUpdated: '2026-04-17' }),
-      });
-
-      const count = await service.refreshCache();
-      expect(count).toBe(0);
-    });
-
-    it('keeps stale cache when fetch fails after previous success', async () => {
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => sampleData,
-      });
-      await service.refreshCache();
-      expect(service.getAll()).toHaveLength(2);
-
-      fetchSpy.mockRejectedValue(new Error('Network error'));
-      const count = await service.refreshCache();
-      expect(count).toBe(0);
-      // Stale cache preserved
-      expect(service.getAll()).toHaveLength(2);
-    });
-
-    it('drops entries whose url is not https', async () => {
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => ({
-          lastUpdated: '2026-04-17',
-          providers: [
-            { ...sampleData.providers[0], url: 'http://insecure.example/keys' },
-            sampleData.providers[1],
-          ],
-        }),
-      });
-      const count = await service.refreshCache();
-      expect(count).toBe(1);
-      expect(service.getAll()[0].name).toBe('Google Gemini');
-    });
-
-    it('drops entries whose url string cannot be parsed as a URL', async () => {
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => ({
-          lastUpdated: '2026-04-17',
-          providers: [{ ...sampleData.providers[0], url: ':::not a url' }, sampleData.providers[1]],
-        }),
-      } as never);
-      const count = await service.refreshCache();
-      expect(count).toBe(1);
-      expect(service.getAll()[0].name).toBe('Google Gemini');
-    });
-
-    it('drops entries whose baseUrl is not https or null', async () => {
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => ({
-          lastUpdated: '2026-04-17',
-          providers: [
-            { ...sampleData.providers[0], baseUrl: 'http://insecure.example/v1' },
-            sampleData.providers[1],
-          ],
-        }),
-      });
-      const count = await service.refreshCache();
-      expect(count).toBe(1);
-    });
-
-    it('keeps entries whose baseUrl is null', async () => {
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => ({
-          lastUpdated: '2026-04-17',
-          providers: [{ ...sampleData.providers[0], baseUrl: null }],
-        }),
-      });
-      const count = await service.refreshCache();
-      expect(count).toBe(1);
-    });
-
-    it('drops entries with non-string name', async () => {
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => ({
-          lastUpdated: '2026-04-17',
-          providers: [{ ...sampleData.providers[0], name: 123 }, sampleData.providers[1]],
-        }),
-      });
-      const count = await service.refreshCache();
-      expect(count).toBe(1);
-      expect(service.getAll()[0].name).toBe('Google Gemini');
-    });
-
-    it('drops entries whose models array contains non-objects', async () => {
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => ({
-          lastUpdated: '2026-04-17',
-          providers: [
-            { ...sampleData.providers[0], models: ['not-an-object'] },
-            sampleData.providers[1],
-          ],
-        }),
-      });
-      const count = await service.refreshCache();
-      expect(count).toBe(1);
-    });
-
-    it('drops null providers without throwing', async () => {
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => ({
-          lastUpdated: '2026-04-17',
-          providers: [null, sampleData.providers[1]],
-        }),
-      });
-      const count = await service.refreshCache();
-      expect(count).toBe(1);
-    });
-
-    it('replaces entire cache on successful refresh', async () => {
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => sampleData,
-      });
-      await service.refreshCache();
-      expect(service.getAll()).toHaveLength(2);
-
-      fetchSpy.mockResolvedValue({
-        ok: true,
-        json: async () => ({
-          lastUpdated: '2026-04-18',
-          providers: [sampleData.providers[0]],
-        }),
-      });
-      await service.refreshCache();
-      expect(service.getAll()).toHaveLength(1);
-    });
-  });
-
-  describe('getAll', () => {
-    it('returns empty array initially', () => {
-      expect(service.getAll()).toEqual([]);
-    });
-  });
-
-  describe('getLastFetchedAt', () => {
-    it('returns null before any refresh', () => {
-      expect(service.getLastFetchedAt()).toBeNull();
-    });
-
-    it('does not update when fetch fails', async () => {
-      fetchSpy.mockRejectedValue(new Error('fail'));
-      await service.refreshCache();
-      expect(service.getLastFetchedAt()).toBeNull();
-    });
-
-    it('does not update when API returns non-OK', async () => {
-      fetchSpy.mockResolvedValue({ ok: false, status: 500 });
-      await service.refreshCache();
-      expect(service.getLastFetchedAt()).toBeNull();
-    });
-  });
-});
diff --git a/packages/backend/src/free-models/free-models-sync.service.ts b/packages/backend/src/free-models/free-models-sync.service.ts
deleted file mode 100644
index 4b5a1486..00000000
--- a/packages/backend/src/free-models/free-models-sync.service.ts
+++ /dev/null
@@ -1,135 +0,0 @@
-import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
-import { Cron, CronExpression } from '@nestjs/schedule';
-
-export interface GitHubModel {
-  id: string | null;
-  name: string;
-  context: string;
-  maxOutput: string;
-  modality: string;
-  rateLimit: string;
-}
-
-export interface GitHubProvider {
-  name: string;
-  category: string;
-  country: string;
-  flag: string;
-  url: string;
-  baseUrl: string | null;
-  description: string;
-  footnoteRef: number | null;
-  models: GitHubModel[];
-}
-
-interface GitHubDataJson {
-  lastUpdated: string;
-  providers: GitHubProvider[];
-}
-
-// Pinned to an immutable commit SHA so a compromise of the awesome-free-llm-apis
-// repo (or its `main` branch) cannot deliver a poisoned data.json that the
-// frontend would render. Bump this SHA when refreshing the upstream data.
-const GITHUB_RAW_REF = '8b0feb0e3adda96455bcc380b815454944ff3832';
-const GITHUB_RAW_URL = `https://raw.githubusercontent.com/mnfst/awesome-free-llm-apis/${GITHUB_RAW_REF}/data.json`;
-const FETCH_TIMEOUT_MS = 10000;
-
-function isHttpsUrl(value: unknown): value is string {
-  if (typeof value !== 'string') return false;
-  try {
-    return new URL(value).protocol === 'https:';
-  } catch {
-    return false;
-  }
-}
-
-function isOptionalHttpsUrl(value: unknown): value is string | null {
-  return value === null || value === undefined || isHttpsUrl(value);
-}
-
-function isValidProvider(p: unknown): p is GitHubProvider {
-  if (!p || typeof p !== 'object') return false;
-  const v = p as Record<string, unknown>;
-  if (typeof v.name !== 'string' || v.name.length === 0) return false;
-  if (typeof v.category !== 'string') return false;
-  if (typeof v.country !== 'string') return false;
-  if (typeof v.flag !== 'string') return false;
-  if (!isHttpsUrl(v.url)) return false;
-  if (!isOptionalHttpsUrl(v.baseUrl)) return false;
-  if (typeof v.description !== 'string') return false;
-  if (!Array.isArray(v.models)) return false;
-  return v.models.every(
-    (m) => m && typeof m === 'object' && typeof (m as { name?: unknown }).name === 'string',
-  );
-}
-
-@Injectable()
-export class FreeModelsSyncService implements OnModuleInit {
-  private readonly logger = new Logger(FreeModelsSyncService.name);
-  private cache: GitHubProvider[] = [];
-  private lastFetchedAt: Date | null = null;
-
-  onModuleInit(): void {
-    // Fire-and-forget so a slow GitHub fetch can't delay app.listen() and trip
-    // Railway's healthcheck (see #1894). Nothing reads this cache during boot;
-    // the free-models endpoints tolerate an empty cache until the fetch lands.
-    void this.refreshCache().catch((err) => {
-      this.logger.error(`Startup free models sync failed: ${err}`);
-    });
-  }
-
-  @Cron(CronExpression.EVERY_DAY_AT_MIDNIGHT)
-  async refreshCache(): Promise<number> {
-    this.logger.log('Refreshing free models cache from GitHub...');
-    const data = await this.fetchData();
-    if (!data) return 0;
-
-    const validated = data.providers.filter((p) => {
-      if (!isValidProvider(p)) {
-        this.logger.warn(
-          `Dropping free-models provider with invalid shape: ${
-            (p as { name?: unknown })?.name ?? '<unnamed>'
-          }`,
-        );
-        return false;
-      }
-      return true;
-    });
-
-    this.cache = validated;
-    this.lastFetchedAt = new Date();
-    this.logger.log(`Free models cache loaded: ${validated.length} providers`);
-    return validated.length;
-  }
-
-  getAll(): readonly GitHubProvider[] {
-    return this.cache;
-  }
-
-  getLastFetchedAt(): Date | null {
-    return this.lastFetchedAt;
-  }
-
-  private async fetchData(): Promise<GitHubDataJson | null> {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-    try {
-      const res = await fetch(GITHUB_RAW_URL, { signal: controller.signal });
-      if (!res.ok) {
-        this.logger.error(`GitHub raw returned ${res.status}`);
-        return null;
-      }
-      const body = (await res.json()) as GitHubDataJson;
-      if (!Array.isArray(body.providers)) {
-        this.logger.error('GitHub data.json missing providers array');
-        return null;
-      }
-      return body;
-    } catch (err) {
-      this.logger.error(`Failed to fetch free models data: ${err}`);
-      return null;
-    } finally {
-      clearTimeout(timeout);
-    }
-  }
-}
diff --git a/packages/backend/src/free-models/free-models.controller.spec.ts b/packages/backend/src/free-models/free-models.controller.spec.ts
deleted file mode 100644
index c47f1e67..00000000
--- a/packages/backend/src/free-models/free-models.controller.spec.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-import { FreeModelsController } from './free-models.controller';
-import { FreeModelsService, FreeModelsResponse } from './free-models.service';
-
-describe('FreeModelsController', () => {
-  let controller: FreeModelsController;
-  let service: FreeModelsService;
-
-  const mockResponse: FreeModelsResponse = {
-    providers: [
-      {
-        name: 'Cohere',
-        logo: '/icons/cohere.svg',
-        description: 'Free trial.',
-        tags: ['No credit card required'],
-        api_key_url: 'https://dashboard.cohere.com/api-keys',
-        base_url: 'https://api.cohere.ai/compatibility/v1',
-        warning: 'Trial keys only.',
-        country: 'CA',
-        flag: '\u{1F1E8}\u{1F1E6}',
-        models: [
-          {
-            id: 'command-a-03-2025',
-            name: 'Command A (111B)',
-            context: '256K',
-            max_output: '4K',
-            modality: 'Text',
-            rate_limit: '20 RPM',
-          },
-        ],
-      },
-    ],
-    last_synced_at: '2026-04-17T00:00:00.000Z',
-  };
-
-  beforeEach(() => {
-    service = { getAll: jest.fn().mockReturnValue(mockResponse) } as unknown as FreeModelsService;
-    controller = new FreeModelsController(service);
-  });
-
-  describe('getFreeModels', () => {
-    it('delegates to service.getAll()', () => {
-      const result = controller.getFreeModels();
-      expect(service.getAll).toHaveBeenCalled();
-      expect(result).toEqual(mockResponse);
-    });
-  });
-});
diff --git a/packages/backend/src/free-models/free-models.controller.ts b/packages/backend/src/free-models/free-models.controller.ts
deleted file mode 100644
index 440dbe32..00000000
--- a/packages/backend/src/free-models/free-models.controller.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { Controller, Get, UseInterceptors } from '@nestjs/common';
-import { CacheInterceptor, CacheTTL } from '@nestjs/cache-manager';
-import { FreeModelsService } from './free-models.service';
-import { FREE_MODELS_CACHE_TTL_MS } from '../common/constants/cache.constants';
-
-@Controller('api/v1')
-export class FreeModelsController {
-  constructor(private readonly freeModelsService: FreeModelsService) {}
-
-  @Get('free-models')
-  @UseInterceptors(CacheInterceptor)
-  @CacheTTL(FREE_MODELS_CACHE_TTL_MS)
-  getFreeModels() {
-    return this.freeModelsService.getAll();
-  }
-}
diff --git a/packages/backend/src/free-models/free-models.module.ts b/packages/backend/src/free-models/free-models.module.ts
deleted file mode 100644
index 701c1860..00000000
--- a/packages/backend/src/free-models/free-models.module.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { Module } from '@nestjs/common';
-import { FreeModelsController } from './free-models.controller';
-import { FreeModelsService } from './free-models.service';
-import { FreeModelsSyncService } from './free-models-sync.service';
-
-@Module({
-  controllers: [FreeModelsController],
-  providers: [FreeModelsService, FreeModelsSyncService],
-  exports: [FreeModelsSyncService, FreeModelsService],
-})
-export class FreeModelsModule {}
diff --git a/packages/backend/src/free-models/free-models.service.spec.ts b/packages/backend/src/free-models/free-models.service.spec.ts
deleted file mode 100644
index 3174b13b..00000000
--- a/packages/backend/src/free-models/free-models.service.spec.ts
+++ /dev/null
@@ -1,172 +0,0 @@
-import { FreeModelsService } from './free-models.service';
-import { FreeModelsSyncService, GitHubProvider } from './free-models-sync.service';
-
-function makeSyncService(
-  providers: GitHubProvider[] = [],
-  lastFetchedAt: Date | null = null,
-): FreeModelsSyncService {
-  return {
-    getAll: () => providers,
-    getLastFetchedAt: () => lastFetchedAt,
-  } as unknown as FreeModelsSyncService;
-}
-
-const cohereProvider: GitHubProvider = {
-  name: 'Cohere',
-  category: 'provider_api',
-  country: 'CA',
-  flag: '\u{1F1E8}\u{1F1E6}',
-  url: 'https://dashboard.cohere.com/api-keys',
-  baseUrl: 'https://api.cohere.ai/compatibility/v1',
-  description: 'Free trial API key.',
-  footnoteRef: null,
-  models: [
-    {
-      id: 'command-a-03-2025',
-      name: 'Command A (111B)',
-      context: '256K',
-      maxOutput: '4K',
-      modality: 'Text',
-      rateLimit: '20 RPM',
-    },
-  ],
-};
-
-const unknownProvider: GitHubProvider = {
-  name: 'NewProvider',
-  category: 'inference_provider',
-  country: 'DE',
-  flag: '\u{1F1E9}\u{1F1EA}',
-  url: 'https://newprovider.com/keys',
-  baseUrl: 'https://api.newprovider.com/v1',
-  description: 'A new provider.',
-  footnoteRef: null,
-  models: [
-    {
-      id: 'model-x',
-      name: 'Model X',
-      context: '128K',
-      maxOutput: '32K',
-      modality: 'Text',
-      rateLimit: '30 RPM',
-    },
-  ],
-};
-
-const providerWithNullBaseUrl: GitHubProvider = {
-  name: 'Ollama Cloud',
-  category: 'inference_provider',
-  country: 'US',
-  flag: '\u{1F1FA}\u{1F1F8}',
-  url: 'https://ollama.com/settings/keys',
-  baseUrl: null,
-  description: 'Free tier.',
-  footnoteRef: null,
-  models: [
-    {
-      id: 'llama3.1:cloud',
-      name: 'llama3.1',
-      context: '128K',
-      maxOutput: '8K',
-      modality: 'Text',
-      rateLimit: '30 RPM',
-    },
-  ],
-};
-
-const providerWithNullModelId: GitHubProvider = {
-  name: 'Cohere',
-  category: 'provider_api',
-  country: 'CA',
-  flag: '\u{1F1E8}\u{1F1E6}',
-  url: 'https://dashboard.cohere.com/api-keys',
-  baseUrl: 'https://api.cohere.ai/compatibility/v1',
-  description: 'Free trial.',
-  footnoteRef: null,
-  models: [
-    {
-      id: null,
-      name: '+ 5 more models',
-      context: 'Varies',
-      maxOutput: 'Varies',
-      modality: 'Text',
-      rateLimit: 'Varies',
-    },
-  ],
-};
-
-describe('FreeModelsService', () => {
-  describe('getAll', () => {
-    it('returns empty providers when sync has no data', () => {
-      const service = new FreeModelsService(makeSyncService());
-      const result = service.getAll();
-      expect(result.providers).toEqual([]);
-      expect(result.last_synced_at).toBeNull();
-    });
-
-    it('transforms known provider with metadata', () => {
-      const now = new Date('2026-04-17T00:00:00Z');
-      const service = new FreeModelsService(makeSyncService([cohereProvider], now));
-      const result = service.getAll();
-
-      expect(result.providers).toHaveLength(1);
-      expect(result.last_synced_at).toBe(now.toISOString());
-
-      const p = result.providers[0];
-      expect(p.name).toBe('Cohere');
-      expect(p.logo).toBe('/icons/cohere.svg');
-      expect(p.description).toBe('Free trial API key.');
-      expect(p.tags).toEqual(['Up to 1,000 calls/month', 'No credit card required']);
-      expect(p.api_key_url).toBe('https://dashboard.cohere.com/api-keys');
-      expect(p.base_url).toBe('https://api.cohere.ai/compatibility/v1');
-      expect(p.warning).toContain('Trial keys cannot be used');
-      expect(p.country).toBe('CA');
-      expect(p.flag).toBe('\u{1F1E8}\u{1F1E6}');
-
-      expect(p.models).toHaveLength(1);
-      expect(p.models[0]).toEqual({
-        id: 'command-a-03-2025',
-        name: 'Command A (111B)',
-        context: '256K',
-        max_output: '4K',
-        modality: 'Text',
-        rate_limit: '20 RPM',
-      });
-    });
-
-    it('handles unknown provider without metadata', () => {
-      const service = new FreeModelsService(makeSyncService([unknownProvider]));
-      const result = service.getAll();
-
-      const p = result.providers[0];
-      expect(p.name).toBe('NewProvider');
-      expect(p.logo).toBeNull();
-      expect(p.tags).toEqual([]);
-      expect(p.warning).toBeNull();
-      expect(p.base_url).toBe('https://api.newprovider.com/v1');
-    });
-
-    it('handles provider with null baseUrl', () => {
-      const service = new FreeModelsService(makeSyncService([providerWithNullBaseUrl]));
-      const result = service.getAll();
-
-      expect(result.providers[0].base_url).toBeNull();
-    });
-
-    it('handles models with null id', () => {
-      const service = new FreeModelsService(makeSyncService([providerWithNullModelId]));
-      const result = service.getAll();
-
-      expect(result.providers[0].models[0].id).toBeNull();
-      expect(result.providers[0].models[0].name).toBe('+ 5 more models');
-    });
-
-    it('transforms multiple providers', () => {
-      const service = new FreeModelsService(
-        makeSyncService([cohereProvider, unknownProvider, providerWithNullBaseUrl]),
-      );
-      const result = service.getAll();
-      expect(result.providers).toHaveLength(3);
-    });
-  });
-});
diff --git a/packages/backend/src/free-models/free-models.service.ts b/packages/backend/src/free-models/free-models.service.ts
deleted file mode 100644
index 89322520..00000000
--- a/packages/backend/src/free-models/free-models.service.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-import { Injectable } from '@nestjs/common';
-import { FreeModelsSyncService } from './free-models-sync.service';
-import { PROVIDER_METADATA } from './free-models-provider-metadata';
-
-export interface FreeModelDto {
-  id: string | null;
-  name: string;
-  context: string;
-  max_output: string;
-  modality: string;
-  rate_limit: string;
-}
-
-export interface FreeProviderDto {
-  name: string;
-  logo: string | null;
-  description: string;
-  tags: string[];
-  api_key_url: string;
-  base_url: string | null;
-  warning: string | null;
-  country: string;
-  flag: string;
-  models: FreeModelDto[];
-}
-
-export interface FreeModelsResponse {
-  providers: FreeProviderDto[];
-  last_synced_at: string | null;
-}
-
-@Injectable()
-export class FreeModelsService {
-  constructor(private readonly syncService: FreeModelsSyncService) {}
-
-  getAll(): FreeModelsResponse {
-    const githubProviders = this.syncService.getAll();
-    const lastSyncedAt = this.syncService.getLastFetchedAt()?.toISOString() ?? null;
-
-    const providers = githubProviders.map((gp) => {
-      const meta = PROVIDER_METADATA[gp.name];
-      return {
-        name: meta?.displayName ?? gp.name,
-        logo: meta?.logo ?? null,
-        description: gp.description,
-        tags: meta?.tags ?? [],
-        api_key_url: gp.url,
-        base_url: gp.baseUrl,
-        warning: meta?.warning ?? null,
-        country: gp.country,
-        flag: gp.flag,
-        models: gp.models.map((m) => ({
-          id: m.id ?? null,
-          name: m.name,
-          context: m.context,
-          max_output: m.maxOutput,
-          modality: m.modality,
-          rate_limit: m.rateLimit,
-        })),
-      };
-    });
-
-    return { providers, last_synced_at: lastSyncedAt };
-  }
-}
diff --git a/packages/backend/src/github/github.controller.spec.ts b/packages/backend/src/github/github.controller.spec.ts
deleted file mode 100644
index 9b45d9b1..00000000
--- a/packages/backend/src/github/github.controller.spec.ts
+++ /dev/null
@@ -1,229 +0,0 @@
-const fetchMock = jest.fn();
-(global as unknown as Record<string, unknown>).fetch = fetchMock;
-
-describe('GithubController', () => {
-  let controller: InstanceType<typeof import('./github.controller').GithubController>;
-  // Capture the real Date.now once at module load so individual tests can
-  // overwrite Date.now safely. afterEach restores it unconditionally so a
-  // failing test cannot leak a fake Date.now into sibling tests.
-  const realDateNow = Date.now;
-
-  /** Re-imports the module with fresh module-level cache variables. */
-  async function freshImport() {
-    const mod = await import('./github.controller');
-    return new mod.GithubController();
-  }
-
-  beforeEach(async () => {
-    jest.resetModules();
-    fetchMock.mockReset();
-    controller = await freshImport();
-  });
-
-  afterEach(() => {
-    // Restore Date.now even when a test throws before its inline restore.
-    Date.now = realDateNow;
-  });
-
-  // ── Happy path ────────────────────────────────────────────────
-
-  it('should fetch stars from GitHub API on first call', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      json: async () => ({ stargazers_count: 42 }),
-    });
-
-    const result = await controller.getStars();
-
-    expect(result).toEqual({ stars: 42 });
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(fetchMock).toHaveBeenCalledWith('https://api.github.com/repos/mnfst/llm-gateway', {
-      headers: { Accept: 'application/vnd.github.v3+json' },
-    });
-  });
-
-  it('should return cached stars within TTL without fetching', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      json: async () => ({ stargazers_count: 100 }),
-    });
-
-    // First call populates the cache
-    await controller.getStars();
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    // Second call should use the cache
-    const result = await controller.getStars();
-
-    expect(result).toEqual({ stars: 100 });
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-  });
-
-  it('should re-fetch after cache TTL expires', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      json: async () => ({ stargazers_count: 50 }),
-    });
-
-    await controller.getStars();
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    // Advance time past the 10-minute TTL. afterEach restores Date.now.
-    Date.now = () => realDateNow() + 11 * 60 * 1000;
-
-    fetchMock.mockResolvedValue({
-      ok: true,
-      json: async () => ({ stargazers_count: 75 }),
-    });
-
-    const result = await controller.getStars();
-
-    expect(result).toEqual({ stars: 75 });
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-  });
-
-  // ── Error handling ────────────────────────────────────────────
-
-  it('should return null when API fails on first call', async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 500 });
-
-    const result = await controller.getStars();
-
-    expect(result).toEqual({ stars: null });
-  });
-
-  it('should return stale cache when API fails after previous success', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      json: async () => ({ stargazers_count: 200 }),
-    });
-    await controller.getStars();
-
-    // Expire the cache. afterEach restores Date.now.
-    Date.now = () => realDateNow() + 11 * 60 * 1000;
-
-    fetchMock.mockResolvedValue({ ok: false, status: 503 });
-
-    const result = await controller.getStars();
-
-    expect(result).toEqual({ stars: 200 });
-  });
-
-  it('should return null when fetch throws on first call', async () => {
-    fetchMock.mockRejectedValue(new Error('network error'));
-
-    const result = await controller.getStars();
-
-    expect(result).toEqual({ stars: null });
-  });
-
-  it('should return stale cache when fetch throws after previous success', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      json: async () => ({ stargazers_count: 300 }),
-    });
-    await controller.getStars();
-
-    // Expire the cache. afterEach restores Date.now.
-    Date.now = () => realDateNow() + 11 * 60 * 1000;
-
-    fetchMock.mockRejectedValue(new Error('timeout'));
-
-    const result = await controller.getStars();
-
-    expect(result).toEqual({ stars: 300 });
-  });
-
-  // ── Edge cases ────────────────────────────────────────────────
-
-  it('should not update cache when stargazers_count is missing', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      json: async () => ({ some_other_field: 'abc' }),
-    });
-
-    const result = await controller.getStars();
-
-    expect(result).toEqual({ stars: null });
-  });
-
-  it('should not update cache when stargazers_count is not a number', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      json: async () => ({ stargazers_count: 'not-a-number' }),
-    });
-
-    const result = await controller.getStars();
-
-    expect(result).toEqual({ stars: null });
-  });
-
-  it('should update cache when stargazers_count is zero', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      json: async () => ({ stargazers_count: 0 }),
-    });
-
-    const result = await controller.getStars();
-
-    expect(result).toEqual({ stars: 0 });
-  });
-
-  // ── Concurrency ───────────────────────────────────────────────
-
-  it('should deduplicate concurrent requests during cache expiry', async () => {
-    // Step 1: prime the cache with a known value so we can exercise the
-    // "expired cache + many concurrent callers" code path.
-    fetchMock.mockResolvedValueOnce({
-      ok: true,
-      json: async () => ({ stargazers_count: 100 }),
-    });
-    await controller.getStars();
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    // Step 2: expire the cache by advancing Date.now past the 10-minute TTL.
-    Date.now = () => realDateNow() + 11 * 60 * 1000;
-
-    // Step 3: fire 10 concurrent calls while a single fetch is in flight.
-    // The fetch resolution is gated by a manual trigger so all 10 callers
-    // observe the in-flight request before it completes.
-    let triggerFetchResolve: (value: {
-      ok: boolean;
-      json: () => Promise<{ stargazers_count: number }>;
-    }) => void = () => undefined;
-    const pendingFetch = new Promise<{
-      ok: boolean;
-      json: () => Promise<{ stargazers_count: number }>;
-    }>((resolve) => {
-      triggerFetchResolve = resolve;
-    });
-    fetchMock.mockReturnValue(pendingFetch);
-
-    const concurrentCalls = Array.from({ length: 10 }, () => controller.getStars());
-
-    // Yield to the microtask queue so each call has a chance to enter the
-    // controller and either share or trigger its own fetch.
-    await Promise.resolve();
-
-    // Documents the current behavior: the module-level cache has NO in-flight
-    // request coalescing, so every concurrent caller past TTL triggers its
-    // own fetch (thundering herd). This test pins the existing semantics so a
-    // future deduplication patch shows up as an intentional change here.
-    // Total includes the 1 priming call + 10 concurrent calls = 11.
-    expect(fetchMock).toHaveBeenCalledTimes(11);
-
-    // Step 4: release the gated fetch and verify all 10 concurrent callers
-    // resolve to the same, consistent star count.
-    triggerFetchResolve({
-      ok: true,
-      json: async () => ({ stargazers_count: 250 }),
-    });
-
-    const results = await Promise.all(concurrentCalls);
-
-    expect(results).toHaveLength(10);
-    for (const result of results) {
-      expect(result).toEqual({ stars: 250 });
-    }
-  });
-});
diff --git a/packages/backend/src/github/github.controller.ts b/packages/backend/src/github/github.controller.ts
deleted file mode 100644
index fd6729ce..00000000
--- a/packages/backend/src/github/github.controller.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import { Controller, Get } from '@nestjs/common';
-import { Public } from '../common/decorators/public.decorator';
-
-const GITHUB_REPO = 'mnfst/llm-gateway';
-const CACHE_TTL_MS = 10 * 60 * 1000; // 10 minutes
-
-let cachedStars: number | null = null;
-let cachedAt = 0;
-
-@Controller('api/v1')
-export class GithubController {
-  @Public()
-  @Get('github/stars')
-  async getStars(): Promise<{ stars: number | null }> {
-    if (cachedStars !== null && Date.now() - cachedAt < CACHE_TTL_MS) {
-      return { stars: cachedStars };
-    }
-
-    try {
-      const res = await fetch(`https://api.github.com/repos/${GITHUB_REPO}`, {
-        headers: { Accept: 'application/vnd.github.v3+json' },
-      });
-      if (!res.ok) {
-        return { stars: cachedStars };
-      }
-      const data = (await res.json()) as { stargazers_count?: number };
-      if (typeof data.stargazers_count === 'number') {
-        cachedStars = data.stargazers_count;
-        cachedAt = Date.now();
-      }
-    } catch {
-      // Return stale cache or null on failure
-    }
-
-    return { stars: cachedStars };
-  }
-}
diff --git a/packages/backend/src/github/github.module.ts b/packages/backend/src/github/github.module.ts
deleted file mode 100644
index 97cb23d5..00000000
--- a/packages/backend/src/github/github.module.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-import { Module } from '@nestjs/common';
-import { GithubController } from './github.controller';
-
-@Module({
-  controllers: [GithubController],
-})
-export class GithubModule {}
diff --git a/packages/backend/src/main.ts b/packages/backend/src/main.ts
index 5a9b324c..534365a1 100644
--- a/packages/backend/src/main.ts
+++ b/packages/backend/src/main.ts
@@ -18,7 +18,6 @@ import {
   createProxyBodyBudgetMiddleware,
 } from './common/middleware/body-parser-limits';
 import {
-  applyPivotClaimCors,
   applyPrivateNetworkAllow,
   buildCorsOptions,
   buildDevAllowedOrigins,
@@ -110,18 +109,6 @@ export async function bootstrap() {
     applyPrivateNetworkAllow(req, corsAllowedOrigins, (name, value) => res.setHeader(name, value));
     next();
   });
-  // The pivot waiting-list claim is posted from self-hosted dashboards in the
-  // browser, so this one route answers CORS for any origin. Registered before
-  // the allow-list cors middleware so its preflight wins; see
-  // `applyPivotClaimCors` for why this is safe.
-  app.use((req: express.Request, res: express.Response, next: express.NextFunction) => {
-    const handled = applyPivotClaimCors(req, (name, value) => res.setHeader(name, value));
-    if (handled) {
-      res.sendStatus(204);
-      return;
-    }
-    next();
-  });
   app.enableCors(buildCorsOptions(corsAllowedOrigins));
 
   app.useGlobalPipes(
diff --git a/packages/backend/src/model-discovery/filter-non-chat-models.spec.ts b/packages/backend/src/model-discovery/filter-non-chat-models.spec.ts
index a8dce4ba..928dfd66 100644
--- a/packages/backend/src/model-discovery/filter-non-chat-models.spec.ts
+++ b/packages/backend/src/model-discovery/filter-non-chat-models.spec.ts
@@ -226,31 +226,6 @@ describe('filterNonChatModels', () => {
     });
   });
 
-  describe('Gemini Free LiteLLM catalog', () => {
-    it('keeps usable Gemini chat models', () => {
-      const models = [
-        makeModel('gemini/gemini-2.5-flash'),
-        makeModel('gemini/gemini-2.5-pro'),
-        makeModel('gemini/gemini-3-flash-preview'),
-      ];
-      expect(filterNonChatModels(models, 'gemini-free')).toEqual(models);
-    });
-
-    it('filters media-only, retired, and experimental Gemini models', () => {
-      const models = [
-        makeModel('gemini/gemini-2.5-flash'),
-        makeModel('gemini/gemini-2.5-flash-image'),
-        makeModel('gemini/gemini-2.5-flash-native-audio-latest'),
-        makeModel('gemini/gemini-1.5-flash'),
-        makeModel('gemini/gemini-exp-1206'),
-        makeModel('gemini/veo-3.1-generate-001'),
-      ];
-      expect(filterNonChatModels(models, 'gemini-free').map((model) => model.id)).toEqual([
-        'gemini/gemini-2.5-flash',
-      ]);
-    });
-  });
-
   describe('Mistral-specific patterns', () => {
     it('filters mistral-ocr model', () => {
       const models = [makeModel('mistral-ocr'), makeModel('mistral-large-latest')];
diff --git a/packages/backend/src/model-discovery/provider-model-fetcher.service.spec.ts b/packages/backend/src/model-discovery/provider-model-fetcher.service.spec.ts
index be9809f6..ae4cb8c2 100644
--- a/packages/backend/src/model-discovery/provider-model-fetcher.service.spec.ts
+++ b/packages/backend/src/model-discovery/provider-model-fetcher.service.spec.ts
@@ -47,7 +47,6 @@ describe('ProviderModelFetcherService', () => {
       'anthropic',
       'gemini',
       'openrouter',
-      'gemini-free',
       'ollama',
       'ollama-cloud',
       'copilot',
@@ -58,35 +57,13 @@ describe('ProviderModelFetcherService', () => {
     }
   });
 
-  it('discovers only Gemini models from the Gemini Free LiteLLM catalog', async () => {
-    process.env['CREDITS_BASE_URL'] = 'https://credits.test';
-    fetchSpy.mockResolvedValue({
-      ok: true,
-      json: async () => ({
-        data: [
-          { id: 'gpt-5' },
-          { id: 'gemini-2.5-flash' },
-          { id: 'gemini/gemini-2.5-flash' },
-          { id: 'gemini/gemini-2.5-pro' },
-          { id: 'gemini/*' },
-        ],
-      }),
-    });
+  it('has no fetcher for the removed managed Gemini Free provider', async () => {
+    expect(PROVIDER_CONFIGS['gemini-free']).toBeUndefined();
 
     const result = await service.fetch('gemini-free', 'sk-virtual');
 
-    expect(fetchSpy).toHaveBeenCalledWith(
-      'https://credits.test/v1/models',
-      expect.objectContaining({
-        headers: expect.objectContaining({
-          Authorization: 'Bearer sk-virtual',
-        }),
-      }),
-    );
-    expect(result.map((model) => model.id)).toEqual([
-      'gemini/gemini-2.5-flash',
-      'gemini/gemini-2.5-pro',
-    ]);
+    expect(result).toEqual([]);
+    expect(fetchSpy).not.toHaveBeenCalled();
   });
 
   describe('huggingface provider', () => {
diff --git a/packages/backend/src/model-discovery/provider-model-fetcher.service.ts b/packages/backend/src/model-discovery/provider-model-fetcher.service.ts
index 7eb9a64b..bf3b3001 100644
--- a/packages/backend/src/model-discovery/provider-model-fetcher.service.ts
+++ b/packages/backend/src/model-discovery/provider-model-fetcher.service.ts
@@ -1,11 +1,6 @@
 import { Inject, Injectable, Logger, Optional } from '@nestjs/common';
 import { DiscoveredModel, FetcherConfig, DEFAULT_CONTEXT_WINDOW } from './model-fetcher';
 import { parseModalities } from './model-capabilities';
-import {
-  getManagedFreeLiteLlmModelsUrl,
-  MANAGED_FREE_PROVIDER_CONFIGS,
-  ManagedFreeProviderConfig,
-} from '../common/constants/managed-free-providers';
 import { OLLAMA_CLOUD_HOST, OLLAMA_HOST } from '../common/constants/ollama';
 import {
   CODEX_CLI_ORIGINATOR,
@@ -222,31 +217,6 @@ const parseBedrockCrisProfiles = createModelParser<BedrockInferenceProfileEntry>
   supportedEndpoints: (entry) => getBedrockRuntimeSupportedEndpoints(entry.inferenceProfileId),
 });
 
-/** Keep only the configured model family and prefer LiteLLM's vendor-prefixed ID. */
-function parseManagedFreeLiteLlm(
-  body: unknown,
-  provider: string,
-  config: ManagedFreeProviderConfig,
-): DiscoveredModel[] {
-  const models = parseOpenAI(body, provider).filter((model) => {
-    const bare = model.id.slice(model.id.lastIndexOf('/') + 1);
-    return !model.id.includes('*') && bare.startsWith(config.catalogModelIdPrefix);
-  });
-  const byBareId = new Map<string, DiscoveredModel>();
-  for (const model of models) {
-    const bare = model.id.slice(model.id.lastIndexOf('/') + 1);
-    const existing = byBareId.get(bare);
-    if (
-      !existing ||
-      (model.id.startsWith(config.preferredModelIdPrefix) &&
-        !existing.id.startsWith(config.preferredModelIdPrefix))
-    ) {
-      byBareId.set(bare, model);
-    }
-  }
-  return Array.from(byBareId.values());
-}
-
 const parsePioneer = createModelParser<PioneerModelEntry>({
   arrayKey: 'data',
   filter: (entry) => typeof entry.id === 'string' && entry.id.length > 0,
@@ -459,9 +429,6 @@ export const PROVIDER_NON_CHAT: Record<string, RegExp> = {
   // and Veo under their own names.
   vertex:
     /(?:^aqs-|nano-banana|^deep-research|computer-use|^lyria|^imagen|^veo|robotics|flash-lite-preview-\d{2}-\d{4}$)/i,
-  ...Object.fromEntries(
-    MANAGED_FREE_PROVIDER_CONFIGS.map((config) => [config.id, config.nonChatModelPattern]),
-  ),
   mistral:
     /(?:^mistral-ocr|moderation|voxtral-.*-(?:transcribe|realtime)|^labs-|^mistral-vibe-cli)/i,
   'mistral-subscription': /(?:^mistral-ocr|moderation|voxtral-.*-(?:transcribe|realtime)|^labs-)/i,
@@ -895,17 +862,6 @@ const parseOpencodeZen = createModelParser<OpenAIModelEntry>({
 
 /* ── Provider configs ── */
 
-const MANAGED_FREE_FETCHER_CONFIGS: Record<string, FetcherConfig> = Object.fromEntries(
-  MANAGED_FREE_PROVIDER_CONFIGS.map((config) => [
-    config.id,
-    {
-      endpoint: (_key: string) => getManagedFreeLiteLlmModelsUrl(),
-      buildHeaders: bearerHeaders,
-      parse: (body: unknown, provider: string) => parseManagedFreeLiteLlm(body, provider, config),
-    },
-  ]),
-);
-
 export const PROVIDER_CONFIGS: Record<string, FetcherConfig> = {
   openai: {
     endpoint: 'https://api.openai.com/v1/models',
@@ -1076,7 +1032,6 @@ export const PROVIDER_CONFIGS: Record<string, FetcherConfig> = {
     buildHeaders: () => ({}),
     parse: parseOpenRouter,
   },
-  ...MANAGED_FREE_FETCHER_CONFIGS,
   ollama: {
     endpoint: `${OLLAMA_HOST}/api/tags`,
     buildHeaders: () => ({}),
diff --git a/packages/backend/src/routing/managed-free-provider/managed-free-provider.controller.spec.ts b/packages/backend/src/routing/managed-free-provider/managed-free-provider.controller.spec.ts
deleted file mode 100644
index d81ea729..00000000
--- a/packages/backend/src/routing/managed-free-provider/managed-free-provider.controller.spec.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-import { ManagedFreeProviderController } from './managed-free-provider.controller';
-
-describe('ManagedFreeProviderController', () => {
-  const managedFreeProvider = {
-    ensureConnection: jest.fn(),
-  };
-  const tenantCache = {
-    ensureForUser: jest.fn(),
-  };
-  let controller: ManagedFreeProviderController;
-
-  beforeEach(() => {
-    jest.resetAllMocks();
-    controller = new ManagedFreeProviderController(
-      managedFreeProvider as never,
-      tenantCache as never,
-    );
-  });
-
-  it('uses the authenticated tenant context', async () => {
-    const expected = {
-      connected: true,
-      connection_id: 'conn-1',
-      source: 'existing',
-      auto_available: true,
-    };
-    managedFreeProvider.ensureConnection.mockResolvedValue(expected);
-
-    await expect(
-      controller.ensure(
-        'gemini-free',
-        { tenantId: 'tenant-1', userId: 'user-1' },
-        { id: 'user-1', email: 'user@example.com' },
-        { apiKey: 'sk-virtual' },
-      ),
-    ).resolves.toBe(expected);
-    expect(tenantCache.ensureForUser).not.toHaveBeenCalled();
-    expect(managedFreeProvider.ensureConnection).toHaveBeenCalledWith('gemini-free', {
-      tenantId: 'tenant-1',
-      userId: 'user-1',
-      userEmail: 'user@example.com',
-      apiKey: 'sk-virtual',
-    });
-  });
-
-  it('creates a tenant lazily for an authenticated user', async () => {
-    tenantCache.ensureForUser.mockResolvedValue('tenant-created');
-    managedFreeProvider.ensureConnection.mockResolvedValue({ connected: false });
-
-    await controller.ensure(
-      'gemini-free',
-      { tenantId: null, userId: null },
-      { id: 'user-1', email: 'user@example.com' },
-      {},
-    );
-
-    expect(tenantCache.ensureForUser).toHaveBeenCalledWith('user-1');
-    expect(managedFreeProvider.ensureConnection).toHaveBeenCalledWith('gemini-free', {
-      tenantId: 'tenant-created',
-      userId: 'user-1',
-      userEmail: 'user@example.com',
-      apiKey: undefined,
-    });
-  });
-
-  it('returns unavailable when no tenant can be resolved', async () => {
-    await expect(
-      controller.ensure('gemini-free', { tenantId: null, userId: null }, {}, undefined as never),
-    ).resolves.toEqual({
-      connected: false,
-      connection_id: null,
-      source: 'none',
-      auto_available: false,
-    });
-    expect(managedFreeProvider.ensureConnection).not.toHaveBeenCalled();
-  });
-});
diff --git a/packages/backend/src/routing/managed-free-provider/managed-free-provider.controller.ts b/packages/backend/src/routing/managed-free-provider/managed-free-provider.controller.ts
deleted file mode 100644
index e1e49237..00000000
--- a/packages/backend/src/routing/managed-free-provider/managed-free-provider.controller.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-import { Body, Controller, Param, Post } from '@nestjs/common';
-import { IsOptional, IsString, MaxLength } from 'class-validator';
-import { CurrentUser } from '../../auth/current-user.decorator';
-import { TenantCtx, TenantContext } from '../../common/decorators/tenant-context.decorator';
-import { TenantCacheService } from '../../common/services/tenant-cache.service';
-import { ManagedFreeProviderService } from './managed-free-provider.service';
-
-class EnsureManagedFreeProviderBody {
-  /** Optional LiteLLM virtual key for a manually provisioned connection. */
-  @IsOptional()
-  @IsString()
-  @MaxLength(500)
-  apiKey?: string;
-}
-
-@Controller('api/v1/providers')
-export class ManagedFreeProviderController {
-  constructor(
-    private readonly managedFreeProvider: ManagedFreeProviderService,
-    private readonly tenantCache: TenantCacheService,
-  ) {}
-
-  /** Ensure a provider-scoped LiteLLM connection without returning the raw key. */
-  @Post(':providerId/ensure')
-  async ensure(
-    @Param('providerId') providerId: string,
-    @TenantCtx() ctx: TenantContext,
-    @CurrentUser() user: { id?: string; email?: string },
-    @Body() body: EnsureManagedFreeProviderBody,
-  ) {
-    const tenantId =
-      ctx.tenantId ?? (user.id ? await this.tenantCache.ensureForUser(user.id) : null);
-    if (!tenantId) {
-      return {
-        connected: false,
-        connection_id: null,
-        source: 'none' as const,
-        auto_available: false,
-      };
-    }
-
-    return this.managedFreeProvider.ensureConnection(providerId, {
-      tenantId,
-      userId: ctx.userId ?? user.id ?? null,
-      userEmail: user.email ?? null,
-      apiKey: body?.apiKey,
-    });
-  }
-}
diff --git a/packages/backend/src/routing/managed-free-provider/managed-free-provider.service.spec.ts b/packages/backend/src/routing/managed-free-provider/managed-free-provider.service.spec.ts
deleted file mode 100644
index 7bfa008a..00000000
--- a/packages/backend/src/routing/managed-free-provider/managed-free-provider.service.spec.ts
+++ /dev/null
@@ -1,275 +0,0 @@
-import { BadRequestException, NotFoundException } from '@nestjs/common';
-import {
-  getManagedFreeProviderConfig,
-  ManagedFreeProviderConfig,
-} from '../../common/constants/managed-free-providers';
-import { ManagedFreeProviderService } from './managed-free-provider.service';
-
-describe('ManagedFreeProviderService', () => {
-  const providerRepo = {
-    find: jest.fn(),
-  };
-  const providerService = {
-    upsertProvider: jest.fn(),
-  };
-  const discoveryService = {
-    discoverModels: jest.fn().mockResolvedValue(undefined),
-  };
-
-  let service: ManagedFreeProviderService;
-  const originalFetch = global.fetch;
-  const env = process.env;
-
-  beforeEach(() => {
-    jest.resetAllMocks();
-    process.env = { ...env };
-    process.env['CREDITS_MASTER_KEY'] = 'sk-master';
-    process.env['CREDITS_BASE_URL'] = 'https://credits.test';
-    delete process.env['CREDITS_AUTO_PROVISION_ALLOWLIST'];
-    service = new ManagedFreeProviderService(
-      providerRepo as never,
-      providerService as never,
-      discoveryService as never,
-    );
-    global.fetch = jest.fn();
-  });
-
-  afterAll(() => {
-    global.fetch = originalFetch;
-    process.env = env;
-  });
-
-  it('returns an existing connection without minting', async () => {
-    providerRepo.find.mockResolvedValue([{ id: 'conn-1', is_active: true }]);
-
-    await expect(
-      service.ensureConnection('gemini-free', {
-        tenantId: 't1',
-        userId: 'u1',
-        userEmail: 'a@x.com',
-      }),
-    ).resolves.toEqual({
-      connected: true,
-      connection_id: 'conn-1',
-      source: 'existing',
-      auto_available: true,
-    });
-    expect(global.fetch).not.toHaveBeenCalled();
-  });
-
-  it('preserves an explicit disconnect without minting a replacement key', async () => {
-    providerRepo.find.mockResolvedValue([{ id: 'conn-1', is_active: false }]);
-
-    await expect(
-      service.ensureConnection('gemini-free', {
-        tenantId: 't1',
-        userId: 'u1',
-        userEmail: 'a@x.com',
-      }),
-    ).resolves.toEqual({
-      connected: false,
-      connection_id: null,
-      source: 'none',
-      auto_available: true,
-    });
-    expect(global.fetch).not.toHaveBeenCalled();
-    expect(providerService.upsertProvider).not.toHaveBeenCalled();
-  });
-
-  it('stores a pasted LiteLLM virtual key under Gemini Free', async () => {
-    providerRepo.find.mockResolvedValueOnce([]).mockResolvedValueOnce([]);
-    providerService.upsertProvider.mockResolvedValue({
-      provider: { id: 'conn-2' },
-      isNew: true,
-    });
-
-    const result = await service.ensureConnection('gemini-free', {
-      tenantId: 't1',
-      userId: 'u1',
-      userEmail: 'a@x.com',
-      apiKey: 'sk-virtual',
-    });
-
-    expect(result).toMatchObject({ connection_id: 'conn-2', source: 'manual' });
-    expect(providerService.upsertProvider).toHaveBeenCalledWith(
-      null,
-      't1',
-      'gemini-free',
-      'sk-virtual',
-      'api_key',
-      undefined,
-      undefined,
-      'u1',
-    );
-    expect(global.fetch).not.toHaveBeenCalled();
-  });
-
-  it('keeps a connection when immediate model discovery fails', async () => {
-    providerRepo.find.mockResolvedValueOnce([]).mockResolvedValueOnce([]);
-    providerService.upsertProvider.mockResolvedValue({
-      provider: { id: 'conn-2' },
-      isNew: true,
-    });
-    discoveryService.discoverModels.mockRejectedValueOnce('catalog unavailable');
-
-    await expect(
-      service.ensureConnection('gemini-free', {
-        tenantId: 't1',
-        userId: 'u1',
-        userEmail: 'a@x.com',
-        apiKey: 'sk-virtual',
-      }),
-    ).resolves.toMatchObject({ connection_id: 'conn-2', source: 'manual' });
-  });
-
-  it('mints a virtual key scoped to Gemini models', async () => {
-    providerRepo.find.mockResolvedValueOnce([]).mockResolvedValueOnce([]);
-    (global.fetch as jest.Mock).mockResolvedValue({
-      ok: true,
-      json: async () => ({ key: 'sk-minted' }),
-    });
-    providerService.upsertProvider.mockResolvedValue({
-      provider: { id: 'conn-3' },
-      isNew: true,
-    });
-
-    await expect(
-      service.ensureConnection('gemini-free', {
-        tenantId: 't1',
-        userId: 'u1',
-        userEmail: 'a@x.com',
-      }),
-    ).resolves.toEqual({
-      connected: true,
-      connection_id: 'conn-3',
-      source: 'auto',
-      auto_available: true,
-    });
-
-    expect(global.fetch).toHaveBeenCalledWith(
-      'https://credits.test/key/generate',
-      expect.objectContaining({
-        method: 'POST',
-        headers: expect.objectContaining({ Authorization: 'Bearer sk-master' }),
-        signal: expect.any(AbortSignal),
-      }),
-    );
-    const body = JSON.parse((global.fetch as jest.Mock).mock.calls[0][1].body as string);
-    expect(body).toMatchObject({
-      models: ['gemini/*'],
-      max_budget: 10,
-      key_alias: 'gemini-free:t1',
-      metadata: {
-        source: 'gemini-free',
-        tenant_id: 't1',
-        user_email: 'a@x.com',
-      },
-    });
-  });
-
-  it('returns none when automatic provisioning is unavailable', async () => {
-    delete process.env['CREDITS_MASTER_KEY'];
-    providerRepo.find.mockResolvedValue([]);
-
-    await expect(
-      service.ensureConnection('gemini-free', {
-        tenantId: 't1',
-        userId: 'u1',
-        userEmail: 'a@x.com',
-      }),
-    ).resolves.toEqual({
-      connected: false,
-      connection_id: null,
-      source: 'none',
-      auto_available: false,
-    });
-  });
-
-  it('rejects direct key generation when the master key is missing', async () => {
-    delete process.env['CREDITS_MASTER_KEY'];
-    const privateService = service as unknown as {
-      mintVirtualKey(
-        config: ManagedFreeProviderConfig,
-        tenantId: string,
-        userEmail: string | null,
-      ): Promise<string>;
-    };
-
-    await expect(
-      privateService.mintVirtualKey(getManagedFreeProviderConfig('gemini-free')!, 't1', 'a@x.com'),
-    ).rejects.toBeInstanceOf(BadRequestException);
-  });
-
-  it('rejects a concurrent second connection', async () => {
-    providerRepo.find
-      .mockResolvedValueOnce([])
-      .mockResolvedValueOnce([{ id: 'conn-existing', is_active: true }]);
-
-    await expect(
-      service.ensureConnection('gemini-free', {
-        tenantId: 't1',
-        userId: 'u1',
-        userEmail: 'a@x.com',
-        apiKey: 'sk-virtual',
-      }),
-    ).rejects.toBeInstanceOf(BadRequestException);
-    expect(providerService.upsertProvider).not.toHaveBeenCalled();
-  });
-
-  it('rejects failed key generation', async () => {
-    providerRepo.find.mockResolvedValue([]);
-    (global.fetch as jest.Mock).mockResolvedValue({
-      ok: false,
-      status: 500,
-      text: async () => 'boom',
-    });
-
-    await expect(
-      service.ensureConnection('gemini-free', {
-        tenantId: 't1',
-        userId: 'u1',
-        userEmail: 'a@x.com',
-      }),
-    ).rejects.toBeInstanceOf(BadRequestException);
-  });
-
-  it('rejects a failed or timed-out key-generation request', async () => {
-    providerRepo.find.mockResolvedValue([]);
-    (global.fetch as jest.Mock).mockRejectedValue(new Error('request timed out'));
-
-    await expect(
-      service.ensureConnection('gemini-free', {
-        tenantId: 't1',
-        userId: 'u1',
-        userEmail: 'a@x.com',
-      }),
-    ).rejects.toBeInstanceOf(BadRequestException);
-  });
-
-  it('rejects a key-generation response without a virtual key', async () => {
-    providerRepo.find.mockResolvedValue([]);
-    (global.fetch as jest.Mock).mockResolvedValue({
-      ok: true,
-      json: async () => ({}),
-    });
-
-    await expect(
-      service.ensureConnection('gemini-free', {
-        tenantId: 't1',
-        userId: 'u1',
-        userEmail: 'a@x.com',
-      }),
-    ).rejects.toBeInstanceOf(BadRequestException);
-  });
-
-  it('rejects provider IDs that are not registered as managed free providers', async () => {
-    await expect(
-      service.ensureConnection('future-free', {
-        tenantId: 't1',
-        userId: 'u1',
-        userEmail: 'a@x.com',
-      }),
-    ).rejects.toBeInstanceOf(NotFoundException);
-    expect(providerRepo.find).not.toHaveBeenCalled();
-  });
-});
diff --git a/packages/backend/src/routing/managed-free-provider/managed-free-provider.service.ts b/packages/backend/src/routing/managed-free-provider/managed-free-provider.service.ts
deleted file mode 100644
index 29f0d4fa..00000000
--- a/packages/backend/src/routing/managed-free-provider/managed-free-provider.service.ts
+++ /dev/null
@@ -1,213 +0,0 @@
-import { BadRequestException, Injectable, Logger, NotFoundException } from '@nestjs/common';
-import { InjectRepository } from '@nestjs/typeorm';
-import { Repository } from 'typeorm';
-import {
-  getManagedFreeLiteLlmKeyGenerateUrl,
-  getManagedFreeLiteLlmMasterKey,
-  getManagedFreeLiteLlmMaxBudgetUsd,
-  getManagedFreeProviderConfig,
-  isManagedFreeLiteLlmAutoEligible,
-  ManagedFreeProviderConfig,
-} from '../../common/constants/managed-free-providers';
-import { TenantProvider } from '../../entities/tenant-provider.entity';
-import { ModelDiscoveryService } from '../../model-discovery/model-discovery.service';
-import { ProviderService } from '../routing-core/provider.service';
-
-export interface ManagedFreeEnsureResult {
-  connected: boolean;
-  connection_id: string | null;
-  source: 'existing' | 'auto' | 'manual' | 'none';
-  auto_available: boolean;
-}
-
-const MANAGED_FREE_KEY_GENERATE_TIMEOUT_MS = 5_000;
-
-@Injectable()
-export class ManagedFreeProviderService {
-  private readonly logger = new Logger(ManagedFreeProviderService.name);
-
-  constructor(
-    @InjectRepository(TenantProvider)
-    private readonly providerRepo: Repository<TenantProvider>,
-    private readonly providerService: ProviderService,
-    private readonly discoveryService: ModelDiscoveryService,
-  ) {}
-
-  private getConfig(providerId: string): ManagedFreeProviderConfig {
-    const config = getManagedFreeProviderConfig(providerId);
-    if (!config) {
-      throw new NotFoundException(`Unknown managed free provider: ${providerId}`);
-    }
-    return config;
-  }
-
-  async findConnection(
-    config: ManagedFreeProviderConfig,
-    tenantId: string,
-  ): Promise<TenantProvider | null> {
-    const rows = await this.providerRepo.find({
-      where: {
-        tenant_id: tenantId,
-        provider: config.id,
-        auth_type: 'api_key',
-      },
-    });
-    return rows.find((row) => row.is_active) ?? rows[0] ?? null;
-  }
-
-  async ensureConnection(
-    providerId: string,
-    opts: {
-      tenantId: string;
-      userId: string | null;
-      userEmail: string | null | undefined;
-      apiKey?: string;
-    },
-  ): Promise<ManagedFreeEnsureResult> {
-    const config = this.getConfig(providerId);
-    const { tenantId, userId, userEmail, apiKey } = opts;
-    const autoAvailable = isManagedFreeLiteLlmAutoEligible(userEmail);
-
-    const existing = await this.findConnection(config, tenantId);
-    if (existing?.is_active) {
-      return {
-        connected: true,
-        connection_id: existing.id,
-        source: 'existing',
-        auto_available: autoAvailable,
-      };
-    }
-
-    const trimmedKey = apiKey?.trim();
-    if (trimmedKey) {
-      const row = await this.persistKey(config, tenantId, userId, trimmedKey);
-      return {
-        connected: true,
-        connection_id: row.id,
-        source: 'manual',
-        auto_available: autoAvailable,
-      };
-    }
-
-    // An inactive row records an explicit disconnect. Do not silently mint a
-    // replacement key when the provider list is fetched later.
-    if (existing) {
-      return {
-        connected: false,
-        connection_id: null,
-        source: 'none',
-        auto_available: autoAvailable,
-      };
-    }
-
-    if (!autoAvailable) {
-      return {
-        connected: false,
-        connection_id: null,
-        source: 'none',
-        auto_available: false,
-      };
-    }
-
-    const minted = await this.mintVirtualKey(config, tenantId, userEmail);
-    const row = await this.persistKey(config, tenantId, userId, minted);
-    return {
-      connected: true,
-      connection_id: row.id,
-      source: 'auto',
-      auto_available: true,
-    };
-  }
-
-  private async persistKey(
-    config: ManagedFreeProviderConfig,
-    tenantId: string,
-    userId: string | null,
-    apiKey: string,
-  ): Promise<TenantProvider> {
-    const existing = await this.findConnection(config, tenantId);
-    if (existing?.is_active) {
-      throw new BadRequestException(
-        `${config.displayName} already has a connection for this workspace`,
-      );
-    }
-
-    const { provider } = await this.providerService.upsertProvider(
-      null,
-      tenantId,
-      config.id,
-      apiKey,
-      'api_key',
-      undefined,
-      undefined,
-      userId,
-    );
-
-    try {
-      await this.discoveryService.discoverModels(provider);
-    } catch (error) {
-      this.logger.warn(
-        `${config.displayName} model discovery failed after connect: ${
-          error instanceof Error ? error.message : String(error)
-        }`,
-      );
-    }
-
-    return provider;
-  }
-
-  private async mintVirtualKey(
-    config: ManagedFreeProviderConfig,
-    tenantId: string,
-    userEmail: string | null | undefined,
-  ): Promise<string> {
-    const masterKey = getManagedFreeLiteLlmMasterKey();
-    if (!masterKey) {
-      throw new BadRequestException('LiteLLM master key is not configured');
-    }
-
-    const body = {
-      models: [...config.litellmModels],
-      max_budget: getManagedFreeLiteLlmMaxBudgetUsd(config),
-      key_alias: `${config.id}:${tenantId}`,
-      metadata: {
-        source: config.id,
-        tenant_id: tenantId,
-        user_email: userEmail ?? null,
-      },
-    };
-
-    let response: Response;
-    try {
-      response = await fetch(getManagedFreeLiteLlmKeyGenerateUrl(), {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${masterKey}`,
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(body),
-        signal: AbortSignal.timeout(MANAGED_FREE_KEY_GENERATE_TIMEOUT_MS),
-      });
-    } catch (error) {
-      this.logger.error(
-        `LiteLLM /key/generate request failed: ${
-          error instanceof Error ? error.message : String(error)
-        }`,
-      );
-      throw new BadRequestException(`Failed to create ${config.displayName} key`);
-    }
-
-    if (!response.ok) {
-      const text = await response.text().catch(() => '');
-      this.logger.error(`LiteLLM /key/generate failed (${response.status}): ${text.slice(0, 300)}`);
-      throw new BadRequestException(`Failed to create ${config.displayName} key`);
-    }
-
-    const json = (await response.json()) as { key?: string; token?: string };
-    const key = json.key ?? json.token;
-    if (!key || typeof key !== 'string') {
-      throw new BadRequestException('LiteLLM did not return a virtual key');
-    }
-    return key;
-  }
-}
diff --git a/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts b/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
index 1b5cde08..027fd313 100644
--- a/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
@@ -1300,26 +1300,17 @@ describe('ProviderClient', () => {
       expect(sentBody.model).toBe('openrouter/auto');
     });
 
-    it('preserves the Gemini vendor prefix for Gemini Free LiteLLM requests', async () => {
-      process.env['CREDITS_BASE_URL'] = 'https://credits.test';
-      mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
-
-      await client.forward({
-        provider: 'gemini-free',
-        apiKey: 'sk-virtual',
-        model: 'gemini/gemini-2.5-flash',
-        body,
-        stream: false,
-      });
-
-      expect(mockFetch).toHaveBeenCalledWith(
-        'https://credits.test/v1/chat/completions',
-        expect.objectContaining({
-          headers: expect.objectContaining({ Authorization: 'Bearer sk-virtual' }),
+    it('refuses the removed managed Gemini Free provider without calling out', async () => {
+      await expect(
+        client.forward({
+          provider: 'gemini-free',
+          apiKey: 'sk-virtual',
+          model: 'gemini/gemini-2.5-flash',
+          body,
+          stream: false,
         }),
-      );
-      const sentBody = JSON.parse(mockFetch.mock.calls[0][1].body);
-      expect(sentBody.model).toBe('gemini/gemini-2.5-flash');
+      ).rejects.toThrow('No endpoint configured for provider: gemini-free');
+      expect(mockFetch).not.toHaveBeenCalled();
     });
 
     it('builds Nous Portal requests without stripping vendor-prefixed model IDs', async () => {
diff --git a/packages/backend/src/routing/proxy/__tests__/provider-endpoints.spec.ts b/packages/backend/src/routing/proxy/__tests__/provider-endpoints.spec.ts
index 26191aa9..f0bf6686 100644
--- a/packages/backend/src/routing/proxy/__tests__/provider-endpoints.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/provider-endpoints.spec.ts
@@ -76,7 +76,6 @@ describe('resolveEndpointKey', () => {
     expect(resolveEndpointKey('commandcode')).toBe('commandcode');
     expect(resolveEndpointKey('fireworks')).toBe('fireworks');
     expect(resolveEndpointKey('huggingface')).toBe('huggingface');
-    expect(resolveEndpointKey('gemini-free')).toBe('gemini-free');
     expect(resolveEndpointKey('nous')).toBe('nous');
     expect(resolveEndpointKey('nvidia')).toBe('nvidia');
     expect(resolveEndpointKey('ollama')).toBe('ollama');
@@ -170,7 +169,7 @@ describe('resolveEndpointKey', () => {
     expect(known).toContain('commandcode-anthropic');
     expect(known).toContain('fireworks');
     expect(known).toContain('huggingface');
-    expect(known).toContain('gemini-free');
+    expect(known).not.toContain('gemini-free');
     expect(known).toContain('nous');
     expect(known).toContain('openrouter');
     expect(known).toContain('nvidia');
@@ -363,16 +362,10 @@ describe('PROVIDER_ENDPOINTS', () => {
     },
   );
 
-  it('routes Gemini Free through the configured LiteLLM gateway', () => {
-    process.env['CREDITS_BASE_URL'] = 'https://credits.test/';
-    const endpoint = PROVIDER_ENDPOINTS['gemini-free'];
-
-    expect(endpoint.baseUrl).toBe('https://credits.test');
-    expect(endpoint.buildPath('gemini/gemini-2.5-flash')).toBe('/v1/chat/completions');
-    expect(endpoint.buildHeaders('sk-virtual')).toEqual({
-      Authorization: 'Bearer sk-virtual',
-      'Content-Type': 'application/json',
-    });
+  it('has no endpoint for the removed managed Gemini Free provider', () => {
+    expect(PROVIDER_ENDPOINTS['gemini-free']).toBeUndefined();
+    expect(resolveEndpointKey('gemini-free')).toBeNull();
+    expect(resolveEndpointKey('gemini free')).toBeNull();
   });
 
   it('huggingface uses the OpenAI-compatible Inference Providers endpoint', () => {
diff --git a/packages/backend/src/routing/proxy/__tests__/responses-stream-tools.spec.ts b/packages/backend/src/routing/proxy/__tests__/responses-stream-tools.spec.ts
index e2e01461..ffb38e2d 100644
--- a/packages/backend/src/routing/proxy/__tests__/responses-stream-tools.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/responses-stream-tools.spec.ts
@@ -64,7 +64,7 @@ describe('Responses streaming tool calls', () => {
 
   it('restores namespaces on every item and keeps tool-before-text ordering', () => {
     const names = responsesToolNames([
-      { type: 'namespace', name: 'crm', tools: [{ type: 'function', name: 'lookup' }] },
+      { type: 'namespace', name: 'contacts', tools: [{ type: 'function', name: 'lookup' }] },
     ]);
     const name = [...names.keys()][0];
     const t = createResponsesStreamTransformer('auto', { toolNames: names });
@@ -75,9 +75,9 @@ describe('Responses streaming tool calls', () => {
     ].join('');
     const output = collectResponsesSseResponse(sse).output as any[];
     expect(output.map((i) => i.type)).toEqual(['function_call', 'message']);
-    expect(output[0]).toMatchObject({ name: 'lookup', namespace: 'crm', arguments: '{}' });
+    expect(output[0]).toMatchObject({ name: 'lookup', namespace: 'contacts', arguments: '{}' });
     for (const e of events(sse).filter((e) => e.item?.type === 'function_call')) {
-      expect(e.item).toMatchObject({ name: 'lookup', namespace: 'crm' });
+      expect(e.item).toMatchObject({ name: 'lookup', namespace: 'contacts' });
     }
   });
 
diff --git a/packages/backend/src/routing/proxy/__tests__/responses-tools.spec.ts b/packages/backend/src/routing/proxy/__tests__/responses-tools.spec.ts
index d32de079..e9290a13 100644
--- a/packages/backend/src/routing/proxy/__tests__/responses-tools.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/responses-tools.spec.ts
@@ -14,7 +14,7 @@ const fn = {
 };
 const tools = [
   fn,
-  { type: 'namespace', name: 'crm', tools: [fn] },
+  { type: 'namespace', name: 'contacts', tools: [fn] },
   { type: 'namespace', name: 'billing', tools: [fn] },
   { type: 'web_search' },
 ];
@@ -31,7 +31,7 @@ describe('Responses namespace tools', () => {
       expect(tool.function.name).toMatch(/^[a-zA-Z0-9_-]{1,64}$/);
     }
     expect([...names.values()]).toEqual([
-      { name: 'lookup', namespace: 'crm' },
+      { name: 'lookup', namespace: 'contacts' },
       { name: 'lookup', namespace: 'billing' },
       { name: 'lookup' },
     ]);
@@ -42,7 +42,7 @@ describe('Responses namespace tools', () => {
     const wireName = [...names.keys()][0];
     const call = {
       type: 'function_call',
-      namespace: 'crm',
+      namespace: 'contacts',
       name: 'lookup',
       call_id: 'call1',
       arguments: '{}',
@@ -55,7 +55,7 @@ describe('Responses namespace tools', () => {
         { type: 'function_call_output', call_id: 'call1', output: 'one' },
         { type: 'function_call_output', call_id: 'call2', output: 'two' },
       ],
-      tool_choice: { type: 'function', namespace: 'crm', name: 'lookup' },
+      tool_choice: { type: 'function', namespace: 'contacts', name: 'lookup' },
     };
     const chat = toChatCompletionsRequest(body) as any;
     expect(chat.tool_choice).toEqual({ type: 'function', function: { name: wireName } });
@@ -76,11 +76,14 @@ describe('Responses namespace tools', () => {
   });
 
   it('keeps aliases stable for reordered tools and historical calls', () => {
-    const name = chatToolName({ namespace: 'crm', name: 'lookup' }, responsesToolNames(tools));
+    const name = chatToolName({ namespace: 'contacts', name: 'lookup' }, responsesToolNames(tools));
     expect(
-      chatToolName({ namespace: 'crm', name: 'lookup' }, responsesToolNames([...tools].reverse())),
+      chatToolName(
+        { namespace: 'contacts', name: 'lookup' },
+        responsesToolNames([...tools].reverse()),
+      ),
     ).toBe(name);
-    expect(chatToolName({ namespace: 'crm', name: 'lookup' }, new Map())).toBe(name);
+    expect(chatToolName({ namespace: 'contacts', name: 'lookup' }, new Map())).toBe(name);
   });
 
   it('avoids collisions with top-level names and handles long namespace names', () => {
@@ -96,10 +99,10 @@ describe('Responses namespace tools', () => {
     const invalid = [
       null,
       { type: 'namespace' },
-      { type: 'namespace', name: 'crm' },
+      { type: 'namespace', name: 'contacts' },
       {
         type: 'namespace',
-        name: 'crm',
+        name: 'contacts',
         tools: [null, { type: 'web_search' }, { type: 'function' }],
       },
     ];
@@ -109,7 +112,7 @@ describe('Responses namespace tools', () => {
         [
           null,
           { type: 'namespace' },
-          { type: 'namespace', name: 'crm', tools: [null, { type: 'web_search' }] },
+          { type: 'namespace', name: 'contacts', tools: [null, { type: 'web_search' }] },
         ],
         new Map(),
       ),
diff --git a/packages/backend/src/routing/proxy/provider-client.ts b/packages/backend/src/routing/proxy/provider-client.ts
index 080e822c..2768e29e 100644
--- a/packages/backend/src/routing/proxy/provider-client.ts
+++ b/packages/backend/src/routing/proxy/provider-client.ts
@@ -48,7 +48,6 @@ import { ProviderModelRegistryService } from '../../model-discovery/provider-mod
 import { qualifyChatGptResponse } from './chatgpt-response-qualifier';
 import { isProviderAvailableForDeployment } from '../../common/utils/provider-availability';
 import { ManifestError } from '../../common/errors/manifest-error';
-import { MANAGED_FREE_PROVIDER_BY_ID } from '../../common/constants/managed-free-providers';
 import { isBedrockProvider } from '../bedrock-region';
 import { getBedrockRuntimeCapabilities } from '../bedrock-runtime-capabilities';
 
@@ -325,8 +324,8 @@ function openRouterCacheMode(model: string): 'anthropic' | 'message' | null {
  * Models synced from OpenRouter use vendor prefixes, but native APIs expect bare names.
  */
 function stripModelPrefix(model: string, endpointKey: string): string {
-  // OpenRouter and managed free providers expect vendor prefixes.
-  if (endpointKey === 'openrouter' || MANAGED_FREE_PROVIDER_BY_ID.has(endpointKey)) return model;
+  // OpenRouter expects vendor prefixes.
+  if (endpointKey === 'openrouter') return model;
   if (endpointKey === 'commandcode' || endpointKey === 'commandcode-anthropic') {
     return model.startsWith('commandcode/') ? model.slice('commandcode/'.length) : model;
   }
diff --git a/packages/backend/src/routing/proxy/provider-endpoints.ts b/packages/backend/src/routing/proxy/provider-endpoints.ts
index 97ebcc5c..d2a98caa 100644
--- a/packages/backend/src/routing/proxy/provider-endpoints.ts
+++ b/packages/backend/src/routing/proxy/provider-endpoints.ts
@@ -1,7 +1,3 @@
-import {
-  getManagedFreeLiteLlmBaseUrl,
-  MANAGED_FREE_PROVIDER_CONFIGS,
-} from '../../common/constants/managed-free-providers';
 import { OLLAMA_CLOUD_HOST, OLLAMA_HOST } from '../../common/constants/ollama';
 import { stripVendorPrefix } from '../../common/constants/openai-models';
 import { PROVIDER_BY_ID_OR_ALIAS } from '../../common/constants/providers';
@@ -182,21 +178,6 @@ const chatgptSubscriptionHeaders = (apiKey: string) => ({
   'user-agent': CODEX_CLI_USER_AGENT,
 });
 
-const MANAGED_FREE_ENDPOINTS: Record<string, ProviderEndpoint> = Object.fromEntries(
-  MANAGED_FREE_PROVIDER_CONFIGS.map((config) => [
-    config.id,
-    {
-      get baseUrl() {
-        return getManagedFreeLiteLlmBaseUrl();
-      },
-      buildHeaders: openaiHeaders,
-      buildPath: openaiPath,
-      format: 'openai',
-      ...openaiStreamUsage,
-    },
-  ]),
-);
-
 export const PROVIDER_ENDPOINTS: Record<string, ProviderEndpoint> = {
   openai: {
     baseUrl: 'https://api.openai.com',
@@ -571,7 +552,6 @@ export const PROVIDER_ENDPOINTS: Record<string, ProviderEndpoint> = {
     format: 'openai',
     ...openaiStreamUsage,
   },
-  ...MANAGED_FREE_ENDPOINTS,
   ollama: {
     baseUrl: OLLAMA_HOST,
     buildHeaders: () => ({ 'Content-Type': 'application/json' }),
diff --git a/packages/backend/src/routing/routing-core/provider.service.ts b/packages/backend/src/routing/routing-core/provider.service.ts
index 71aea89e..ba92b4d1 100644
--- a/packages/backend/src/routing/routing-core/provider.service.ts
+++ b/packages/backend/src/routing/routing-core/provider.service.ts
@@ -50,9 +50,7 @@ import {
   isMinimaxRegion,
 } from '../oauth/minimax/minimax-oauth-helpers';
 import { filterProvidersForDeployment } from '../../common/utils/provider-availability';
-import { getManagedFreeProviderConfig } from '../../common/constants/managed-free-providers';
 
-const MAX_KEYS_MANAGED_FREE_PROVIDER = 1;
 const MAX_LABEL_LENGTH = 50;
 const DEFAULT_LABEL = 'Default';
 // Bounds for withSubscriptionCredentialLock's critical section (the provider
@@ -495,13 +493,9 @@ export class ProviderService {
     }
 
     const activeCount = existingRows.filter((r) => r.is_active).length;
-    const managedFreeConfig = getManagedFreeProviderConfig(provider);
-    const maxKeys = managedFreeConfig ? MAX_KEYS_MANAGED_FREE_PROVIDER : MAX_KEYS_PER_PROVIDER;
-    if (activeCount >= maxKeys) {
+    if (activeCount >= MAX_KEYS_PER_PROVIDER) {
       throw new BadRequestException(
-        maxKeys === 1
-          ? `You can connect at most 1 key for ${managedFreeConfig!.displayName}`
-          : `You can connect at most ${maxKeys} keys per provider`,
+        `You can connect at most ${MAX_KEYS_PER_PROVIDER} keys per provider`,
       );
     }
 
diff --git a/packages/backend/src/routing/routing.module.ts b/packages/backend/src/routing/routing.module.ts
index 07fd6dd9..ce34a90e 100644
--- a/packages/backend/src/routing/routing.module.ts
+++ b/packages/backend/src/routing/routing.module.ts
@@ -19,8 +19,6 @@ import { SpecificityController } from './specificity.controller';
 import { ModelParamsController } from './model-params.controller';
 import { TenantProvidersController } from './tenant-providers.controller';
 import { AgentEnabledProvidersController } from './agent-enabled-providers.controller';
-import { ManagedFreeProviderController } from './managed-free-provider/managed-free-provider.controller';
-import { ManagedFreeProviderService } from './managed-free-provider/managed-free-provider.service';
 import { OllamaSyncService } from '../database/ollama-sync.service';
 import { NotificationsModule } from '../notifications/notifications.module';
 import { TenantProvider } from '../entities/tenant-provider.entity';
@@ -68,9 +66,8 @@ import { InstallMetadata } from '../entities/install-metadata.entity';
     ModelParamsController,
     TenantProvidersController,
     AgentEnabledProvidersController,
-    ManagedFreeProviderController,
   ],
-  providers: [OllamaSyncService, ManagedFreeProviderService],
+  providers: [OllamaSyncService],
   exports: [RoutingCoreModule, CustomProviderModule, OAuthModule],
 })
 export class RoutingModule {}
diff --git a/packages/backend/src/waitlist/dto/pivot-claim.dto.spec.ts b/packages/backend/src/waitlist/dto/pivot-claim.dto.spec.ts
deleted file mode 100644
index eb5ef8be..00000000
--- a/packages/backend/src/waitlist/dto/pivot-claim.dto.spec.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-import { plainToInstance } from 'class-transformer';
-import { validateSync } from 'class-validator';
-import { PivotClaimDto } from './pivot-claim.dto';
-
-function validate(payload: Record<string, unknown>) {
-  const dto = plainToInstance(PivotClaimDto, payload);
-  return { dto, errors: validateSync(dto, { whitelist: true, forbidNonWhitelisted: true }) };
-}
-
-describe('PivotClaimDto', () => {
-  it('accepts a valid email and trims surrounding whitespace', () => {
-    const { dto, errors } = validate({ email: '  jane@example.com ' });
-    expect(errors).toHaveLength(0);
-    expect(dto.email).toBe('jane@example.com');
-  });
-
-  it('rejects an invalid email', () => {
-    const { errors } = validate({ email: 'not-an-email' });
-    expect(errors.map((error) => error.property)).toContain('email');
-  });
-
-  it('leaves non-string values to the email validator', () => {
-    const { errors } = validate({ email: 42 });
-    expect(errors.map((error) => error.property)).toContain('email');
-  });
-
-  it('rejects unknown fields', () => {
-    const { errors } = validate({ email: 'jane@example.com', newsletter: true });
-    expect(errors.map((error) => error.property)).toContain('newsletter');
-  });
-
-  it('rejects an explicit null source; only omission earns the default', () => {
-    const { errors } = validate({ email: 'a@b.co', source: null });
-    expect(errors.map((error) => error.property)).toContain('source');
-  });
-
-  it('accepts the two claim sources and rejects anything else', () => {
-    expect(validate({ email: 'a@b.co', source: 'cloud' }).errors).toHaveLength(0);
-    expect(validate({ email: 'a@b.co', source: 'self-hosted' }).errors).toHaveLength(0);
-    const { errors } = validate({ email: 'a@b.co', source: 'website' });
-    expect(errors.map((error) => error.property)).toContain('source');
-  });
-});
diff --git a/packages/backend/src/waitlist/dto/pivot-claim.dto.ts b/packages/backend/src/waitlist/dto/pivot-claim.dto.ts
deleted file mode 100644
index 5710bb4c..00000000
--- a/packages/backend/src/waitlist/dto/pivot-claim.dto.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import { Transform } from 'class-transformer';
-import { IsEmail, IsIn, MaxLength, ValidateIf } from 'class-validator';
-
-/** Claim origins this route may record; `website` belongs to Peacock's own form. */
-export const PIVOT_CLAIM_SOURCES = ['cloud', 'self-hosted'] as const;
-export type PivotClaimSource = (typeof PIVOT_CLAIM_SOURCES)[number];
-
-/** Fallback when a claim carries no source and no same-origin signal. */
-export const DEFAULT_PIVOT_CLAIM_SOURCE: PivotClaimSource = 'self-hosted';
-
-/** Body of the public pivot waiting-list claim. */
-export class PivotClaimDto {
-  @Transform(({ value }) => (typeof value === 'string' ? value.trim() : value))
-  @IsEmail()
-  @MaxLength(254)
-  email!: string;
-
-  /** Where the claim was made; absent defaults to self-hosted. Explicit
-   * null is rejected: only omission earns the default. */
-  @ValidateIf((claim) => claim.source !== undefined)
-  @IsIn([...PIVOT_CLAIM_SOURCES])
-  source?: PivotClaimSource;
-}
diff --git a/packages/backend/src/waitlist/waitlist.controller.spec.ts b/packages/backend/src/waitlist/waitlist.controller.spec.ts
deleted file mode 100644
index 7620e4ef..00000000
--- a/packages/backend/src/waitlist/waitlist.controller.spec.ts
+++ /dev/null
@@ -1,110 +0,0 @@
-import { Request } from 'express';
-import { Repository } from 'typeorm';
-import { WaitlistClaim } from '../entities/waitlist-claim.entity';
-import { WaitlistController, claimRequestIsSameOrigin } from './waitlist.controller';
-
-function reqWith(headers: Record<string, string> = {}): Request {
-  return { headers } as unknown as Request;
-}
-
-describe('claimRequestIsSameOrigin', () => {
-  it('matches when the Origin host equals the Host header', () => {
-    expect(
-      claimRequestIsSameOrigin({
-        origin: 'https://app.manifest.build',
-        host: 'app.manifest.build',
-      }),
-    ).toBe(true);
-  });
-
-  it('rejects a foreign origin', () => {
-    expect(
-      claimRequestIsSameOrigin({ origin: 'https://someone.example', host: 'app.manifest.build' }),
-    ).toBe(false);
-  });
-
-  it('rejects missing, array, or malformed headers', () => {
-    expect(claimRequestIsSameOrigin({})).toBe(false);
-    expect(claimRequestIsSameOrigin({ origin: ['a', 'b'], host: 'x' })).toBe(false);
-    expect(claimRequestIsSameOrigin({ origin: 'not a url', host: 'x' })).toBe(false);
-  });
-});
-
-describe('WaitlistController', () => {
-  let chain: {
-    insert: jest.Mock;
-    into: jest.Mock;
-    values: jest.Mock;
-    orUpdate: jest.Mock;
-    execute: jest.Mock;
-  };
-  let controller: WaitlistController;
-
-  beforeEach(() => {
-    chain = {
-      insert: jest.fn(),
-      into: jest.fn(),
-      values: jest.fn(),
-      orUpdate: jest.fn(),
-      execute: jest.fn().mockResolvedValue(undefined),
-    };
-    chain.insert.mockReturnValue(chain);
-    chain.into.mockReturnValue(chain);
-    chain.values.mockReturnValue(chain);
-    chain.orUpdate.mockReturnValue(chain);
-    controller = new WaitlistController({
-      createQueryBuilder: () => chain,
-    } as unknown as Repository<WaitlistClaim>);
-  });
-
-  it('keeps the legacy self-hosted claim endpoint as a no-op success', () => {
-    expect(controller.receiveClaim()).toEqual({ ok: true });
-    expect(chain.execute).not.toHaveBeenCalled();
-  });
-
-  it('stores a claim with a normalized email and the declared source', async () => {
-    await expect(
-      controller.receivePivotClaim({ email: '  Jane@Example.COM ', source: 'cloud' }, reqWith()),
-    ).resolves.toEqual({ ok: true });
-
-    expect(chain.values).toHaveBeenCalledWith(
-      expect.objectContaining({ email: 'jane@example.com', source: 'cloud' }),
-    );
-    const row = chain.values.mock.calls[0][0] as { claimed_at: string };
-    expect(Number.isNaN(Date.parse(row.claimed_at))).toBe(false);
-  });
-
-  it('infers cloud for a sourceless same-origin claim (stale cloud bundle)', async () => {
-    await controller.receivePivotClaim(
-      { email: 'jane@example.com' },
-      reqWith({ origin: 'https://app.manifest.build', host: 'app.manifest.build' }),
-    );
-    expect(chain.values).toHaveBeenCalledWith(expect.objectContaining({ source: 'cloud' }));
-  });
-
-  it('defaults a sourceless cross-origin or headerless claim to self-hosted', async () => {
-    await controller.receivePivotClaim({ email: 'jane@example.com' }, reqWith());
-    expect(chain.values).toHaveBeenCalledWith(expect.objectContaining({ source: 'self-hosted' }));
-  });
-
-  it('lets an explicit source win over the origin inference', async () => {
-    await controller.receivePivotClaim(
-      { email: 'jane@example.com', source: 'self-hosted' },
-      reqWith({ origin: 'https://app.manifest.build', host: 'app.manifest.build' }),
-    );
-    expect(chain.values).toHaveBeenCalledWith(expect.objectContaining({ source: 'self-hosted' }));
-  });
-
-  it('lets the latest claim win on conflict, but never over a website row', async () => {
-    await controller.receivePivotClaim(
-      { email: 'jane@example.com', source: 'self-hosted' },
-      reqWith(),
-    );
-    expect(chain.orUpdate).toHaveBeenCalledWith(['source', 'claimed_at'], ['email'], {
-      overwriteCondition: {
-        where: '"waitlist_claims"."source" != :websiteSource',
-        parameters: { websiteSource: 'website' },
-      },
-    });
-  });
-});
diff --git a/packages/backend/src/waitlist/waitlist.controller.ts b/packages/backend/src/waitlist/waitlist.controller.ts
deleted file mode 100644
index 47e23531..00000000
--- a/packages/backend/src/waitlist/waitlist.controller.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-import { Body, Controller, HttpCode, HttpStatus, Post, Req } from '@nestjs/common';
-import { Request } from 'express';
-import { InjectRepository } from '@nestjs/typeorm';
-import { Repository } from 'typeorm';
-import { Public } from '../common/decorators/public.decorator';
-import { WaitlistClaim } from '../entities/waitlist-claim.entity';
-import { DEFAULT_PIVOT_CLAIM_SOURCE, PivotClaimDto } from './dto/pivot-claim.dto';
-
-/**
- * Same-origin check for the sourceless fallback: a stale cloud bundle from
- * before the source field posts same-origin to its own backend, while
- * self-hosted dashboards post cross-origin. Explicit sources bypass this.
- */
-export function claimRequestIsSameOrigin(headers: {
-  origin?: string | string[];
-  host?: string | string[];
-}): boolean {
-  const origin = headers.origin;
-  const host = headers.host;
-  if (typeof origin !== 'string' || typeof host !== 'string') return false;
-  try {
-    return new URL(origin).host === host;
-  } catch {
-    return false;
-  }
-}
-
-@Controller('api/v1/waitlist')
-export class WaitlistController {
-  constructor(
-    @InjectRepository(WaitlistClaim)
-    private readonly claimRepo: Repository<WaitlistClaim>,
-  ) {}
-
-  /**
-   * Compatibility endpoint for self-hosted versions that predate Autofix GA.
-   * Keep returning 200 during the deprecation window, but do not retain new
-   * waitlist claims now that every tenant has access.
-   */
-  @Public()
-  @Post('autofix/claim')
-  @HttpCode(HttpStatus.OK)
-  receiveClaim(): { ok: boolean } {
-    return { ok: true };
-  }
-
-  /**
-   * Pivot waiting-list claim. Public and CORS-open on purpose: cloud posts
-   * same-origin and self-hosted dashboards post here straight from the
-   * browser, so any locally-registered user can join with a corrected email.
-   * The upsert dedupes by email and the latest claim wins, source included:
-   * attribution reflects where the person last joined from, matching the
-   * historical phone-home behavior. The global throttler still applies.
-   */
-  @Public()
-  @Post('pivot/claim')
-  @HttpCode(HttpStatus.OK)
-  async receivePivotClaim(
-    @Body() dto: PivotClaimDto,
-    @Req() req: Request,
-  ): Promise<{ ok: boolean }> {
-    // An explicit source always wins; a sourceless same-origin post is the
-    // cloud dashboard (a cached pre-source bundle) talking to its own
-    // backend, anything else defaults to self-hosted.
-    const source =
-      dto.source ?? (claimRequestIsSameOrigin(req.headers) ? 'cloud' : DEFAULT_PIVOT_CLAIM_SOURCE);
-    await this.claimRepo
-      .createQueryBuilder()
-      .insert()
-      .into(WaitlistClaim)
-      .values({
-        email: dto.email.trim().toLowerCase(),
-        source,
-        claimed_at: new Date().toISOString(),
-      })
-      // Latest claim wins among the sources this route owns; a website row
-      // (Peacock's own form) is never overwritten by this public endpoint.
-      .orUpdate(['source', 'claimed_at'], ['email'], {
-        overwriteCondition: {
-          where: '"waitlist_claims"."source" != :websiteSource',
-          parameters: { websiteSource: 'website' },
-        },
-      })
-      .execute();
-    return { ok: true };
-  }
-}
diff --git a/packages/backend/src/waitlist/waitlist.module.ts b/packages/backend/src/waitlist/waitlist.module.ts
deleted file mode 100644
index 195b8d9f..00000000
--- a/packages/backend/src/waitlist/waitlist.module.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import { Module } from '@nestjs/common';
-import { TypeOrmModule } from '@nestjs/typeorm';
-import { WaitlistClaim } from '../entities/waitlist-claim.entity';
-import { WaitlistController } from './waitlist.controller';
-
-@Module({
-  imports: [TypeOrmModule.forFeature([WaitlistClaim])],
-  controllers: [WaitlistController],
-})
-export class WaitlistModule {}
diff --git a/packages/backend/test/crm-metrics.e2e-spec.ts b/packages/backend/test/crm-metrics.e2e-spec.ts
deleted file mode 100644
index 9c7c56bc..00000000
--- a/packages/backend/test/crm-metrics.e2e-spec.ts
+++ /dev/null
@@ -1,366 +0,0 @@
-import request from 'supertest';
-import { INestApplication } from '@nestjs/common';
-import { DataSource } from 'typeorm';
-import { v4 as uuid } from 'uuid';
-import { createTestApp, TEST_TENANT_ID, TEST_AGENT_ID } from './helpers';
-import { AddRequestsAutofixHealedIndex1802200000000 } from '../src/database/migrations/1802200000000-AddRequestsAutofixHealedIndex';
-
-/**
- * Exercises the real SQL against real Postgres. The unit specs mock the
- * DataSource entirely, so this is the only place a syntax error, a bad column
- * name, or an invalid index definition would surface.
- */
-
-const SECRET = 'e2e-crm-metrics-secret-at-least-32-chars';
-const HEALED_INDEX = 'IDX_requests_autofix_healed';
-const TENANT_TIMESTAMP_INDEX = 'IDX_requests_tenant_timestamp';
-
-const OWNER_ID = 'crm-owner-001';
-const OWNER_EMAIL = 'healed.user@example.com';
-
-/** Local wall clock, matching how the pg driver writes these naive columns. */
-function localSqlTimestamp(d: Date): string {
-  const pad = (n: number) => String(n).padStart(2, '0');
-  return (
-    `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ` +
-    `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`
-  );
-}
-
-describe('Internal CRM metrics (e2e)', () => {
-  let app: INestApplication;
-  let ds: DataSource;
-  let previousMode: string | undefined;
-
-  beforeAll(async () => {
-    process.env['CRM_METRICS_SECRET'] = SECRET;
-    // The migration and the module registration are both Cloud-only. Pin the
-    // mode so this suite does not depend on whether the runner happens to look
-    // containerised to `isSelfHosted()`.
-    previousMode = process.env['MANIFEST_MODE'];
-    process.env['MANIFEST_MODE'] = 'cloud';
-    app = await createTestApp();
-    ds = app.get(DataSource);
-
-    // Better Auth owns the `user` table and its migrations do not run in e2e.
-    await ds.query(
-      `CREATE TABLE IF NOT EXISTS "user" (
-         id VARCHAR PRIMARY KEY,
-         name VARCHAR,
-         email VARCHAR,
-         "emailVerified" BOOLEAN,
-         "createdAt" TIMESTAMPTZ
-       )`,
-    );
-
-    // The partial index lives in a migration, not on the entity, so
-    // synchronize() never creates it. Run the real migration rather than a
-    // copy of its DDL: a hand-copied index would keep passing even if the
-    // migration drifted, which is exactly the defect this suite exists to
-    // catch. CONCURRENTLY needs to be outside a transaction, and a bare
-    // queryRunner autocommits.
-    const runner = ds.createQueryRunner();
-    try {
-      await runner.connect();
-      await new AddRequestsAutofixHealedIndex1802200000000().up(runner);
-    } finally {
-      await runner.release();
-    }
-
-    // The signups feed refuses to run without this one, because the lateral
-    // degrades to a sequential scan of `requests` per row (22s and 6.9 GB of
-    // reads, measured). Production gets it from migration 1801000000000, which
-    // also creates the tables synchronize() has already built here — so run
-    // just the index. It is a plain two-column btree with no partial predicate
-    // to drift, unlike the healed index above.
-    await ds.query(
-      `CREATE INDEX IF NOT EXISTS "${TENANT_TIMESTAMP_INDEX}" ON "requests" ("tenant_id", "timestamp")`,
-    );
-
-    const [built] = (await ds.query(`SELECT indexdef FROM pg_indexes WHERE indexname = $1`, [
-      HEALED_INDEX,
-    ])) as Array<{ indexdef: string }>;
-    expect(built?.indexdef).toContain('INCLUDE (status)');
-    expect(built?.indexdef).toContain(`WHERE ((autofix_status)::text = 'retry_succeeded'::text)`);
-  });
-
-  afterAll(async () => {
-    await app.close();
-    delete process.env['CRM_METRICS_SECRET'];
-    // Restore rather than delete: e2e runs --runInBand, so every spec shares one
-    // process, and a shell that exports MANIFEST_MODE would otherwise lose it
-    // for every sibling suite that reads isSelfHosted().
-    if (previousMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = previousMode;
-  });
-
-  beforeEach(async () => {
-    await ds.query('DELETE FROM agent_messages');
-    await ds.query('DELETE FROM requests');
-    await ds.query('DELETE FROM waitlist_claims');
-    await ds.query('DELETE FROM "user"');
-    await ds.query(
-      `INSERT INTO "user" (id, name, email, "emailVerified", "createdAt")
-       VALUES ($1, $2, $3, true, now() - interval '10 days')`,
-      [OWNER_ID, 'Healed User', OWNER_EMAIL],
-    );
-    await ds.query(`UPDATE tenants SET owner_user_id = $1 WHERE id = $2`, [
-      OWNER_ID,
-      TEST_TENANT_ID,
-    ]);
-  });
-
-  async function seedHealedRequest(ageDays: number, status = 'success'): Promise<void> {
-    const requestId = uuid();
-    const at = localSqlTimestamp(new Date(Date.now() - ageDays * 86_400_000));
-    await ds.query(
-      `INSERT INTO requests (id, tenant_id, agent_id, agent_name, timestamp, status, autofix_status)
-       VALUES ($1, $2, $3, 'demo-agent', $4, $5, 'retry_succeeded')`,
-      [requestId, TEST_TENANT_ID, TEST_AGENT_ID, at, status],
-    );
-    await ds.query(
-      `INSERT INTO agent_messages (id, tenant_id, agent_id, agent_name, request_id, timestamp, provider, model, autofix_applied)
-       VALUES ($1, $2, $3, 'demo-agent', $4, $5, $6, 'some-model', true)`,
-      [uuid(), TEST_TENANT_ID, TEST_AGENT_ID, requestId, at, 'openai'],
-    );
-  }
-
-  const get = (path: string) =>
-    request(app.getHttpServer()).get(`/api/v1/internal/crm-metrics${path}`);
-
-  /**
-   * Results are memoised per window for 60s, which outlives this suite, so each
-   * cohort assertion asks for its own `days` value. They are all far shorter
-   * than the 40-day-old row seeded below, so the window itself never matters —
-   * only that the cache keys differ.
-   */
-  let windowDays = 6;
-  const nextWindow = () => `?days=${++windowDays}`;
-
-  describe('auth', () => {
-    it('rejects a request with no secret', async () => {
-      await get('').expect(401);
-    });
-
-    it('rejects a request with the wrong secret', async () => {
-      await get('').set('x-internal-secret', 'wrong').expect(401);
-    });
-
-    it('rejects the conversions route without the secret', async () => {
-      await get('/conversions').expect(401);
-    });
-  });
-
-  describe('validation', () => {
-    it('rejects an out-of-range window', async () => {
-      await get('?days=0').set('x-internal-secret', SECRET).expect(400);
-      await get('?days=400').set('x-internal-secret', SECRET).expect(400);
-    });
-
-    it('rejects an undeclared query parameter', async () => {
-      await get('?nope=1').set('x-internal-secret', SECRET).expect(400);
-    });
-  });
-
-  describe('cohort', () => {
-    it('returns a healed user with their counts', async () => {
-      await seedHealedRequest(1);
-      await seedHealedRequest(2);
-      await seedHealedRequest(3);
-
-      const res = await get(nextWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(res.body).toHaveLength(1);
-      expect(res.body[0]).toMatchObject({
-        email: OWNER_EMAIL,
-        name: 'Healed User',
-        healed_recent: 3,
-        healed_all: 3,
-      });
-    });
-
-    it('counts older heals in the all-time total but not the window', async () => {
-      await seedHealedRequest(1);
-      await seedHealedRequest(40);
-
-      const res = await get(nextWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(res.body[0]).toMatchObject({ healed_recent: 1, healed_all: 2 });
-    });
-
-    it('ignores a retry that succeeded on a request which still failed', async () => {
-      await seedHealedRequest(1, 'failed');
-
-      const res = await get(nextWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(res.body).toEqual([]);
-    });
-
-    it('omits users whose email is unverified', async () => {
-      await seedHealedRequest(1);
-      await ds.query(`UPDATE "user" SET "emailVerified" = false WHERE id = $1`, [OWNER_ID]);
-
-      const res = await get(nextWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(res.body).toEqual([]);
-    });
-
-    it('omits internal addresses', async () => {
-      await seedHealedRequest(1);
-      await ds.query(`UPDATE "user" SET email = 'bruno@buddyweb.fr' WHERE id = $1`, [OWNER_ID]);
-
-      const res = await get(nextWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(res.body).toEqual([]);
-    });
-
-    it('returns an empty list when nothing was healed', async () => {
-      const res = await get(nextWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(res.body).toEqual([]);
-    });
-  });
-
-  describe('conversions', () => {
-    it('returns waitlist claims in the window, lowercased', async () => {
-      await ds.query(
-        `INSERT INTO waitlist_claims (id, email, source, claimed_at) VALUES ($1, $2, $3, now())`,
-        [uuid(), 'Converted@Example.com', 'cloud'],
-      );
-      await ds.query(
-        `INSERT INTO waitlist_claims (id, email, source, claimed_at)
-         VALUES ($1, $2, $3, now() - interval '200 days')`,
-        [uuid(), 'ancient@example.com', 'cloud'],
-      );
-
-      const res = await get('/conversions?days=90').set('x-internal-secret', SECRET).expect(200);
-
-      expect(res.body).toHaveLength(1);
-      expect(res.body[0]).toMatchObject({ email: 'converted@example.com', source: 'cloud' });
-    });
-  });
-
-  describe('signups', () => {
-    // Same cache caveat as the cohort block: distinct windows per assertion.
-    let signupWindow = 100;
-    const nextSignupWindow = () => `/signups?days=${++signupWindow}`;
-
-    /** A corporate address, so the filters in crm-metrics.filters.ts keep it. */
-    const addUser = async (
-      id: string,
-      email: string,
-      opts: { tenantId?: string; name?: string } = {},
-    ): Promise<void> => {
-      await ds.query(
-        `INSERT INTO "user" (id, name, email, "emailVerified", "createdAt")
-         VALUES ($1, $2, $3, true, now() - interval '5 days')`,
-        [id, opts.name ?? 'Ada Lovelace', email],
-      );
-      if (opts.tenantId) {
-        await ds.query(`UPDATE tenants SET owner_user_id = $1 WHERE id = $2`, [id, opts.tenantId]);
-      }
-    };
-
-    interface SignupRow {
-      email: string;
-      last_request_at: string | null;
-    }
-
-    const signupFor = (body: unknown[], email: string): SignupRow | undefined =>
-      (body as SignupRow[]).find((row) => row.email === email);
-
-    it('returns a corporate signup that never sent a request', async () => {
-      await addUser('signup-1', 'ada@acmecorp.io', { tenantId: TEST_TENANT_ID });
-
-      const res = await get(nextSignupWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(signupFor(res.body, 'ada@acmecorp.io')).toMatchObject({
-        email: 'ada@acmecorp.io',
-        name: 'Ada Lovelace',
-        domain: 'acmecorp.io',
-        last_request_at: null,
-        has_traffic: false,
-        domain_signups: 1,
-      });
-    });
-
-    it('keeps a verified user who never created a tenant', async () => {
-      // The regression this exists for. Tenants are created lazily on first
-      // agent creation, so this user has no tenant row at all — and is exactly
-      // who the campaign targets. An inner join would drop them silently.
-      await addUser('signup-orphan', 'grace@orphancorp.io');
-
-      const res = await get(nextSignupWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(signupFor(res.body, 'grace@orphancorp.io')).toMatchObject({
-        has_traffic: false,
-        last_request_at: null,
-      });
-    });
-
-    it('marks a signup whose tenant has sent a request', async () => {
-      await addUser('signup-2', 'ada@trafficcorp.io', { tenantId: TEST_TENANT_ID });
-      await ds.query(
-        `INSERT INTO requests (id, tenant_id, agent_id, agent_name, timestamp, status)
-         VALUES ($1, $2, $3, 'demo-agent', $4, 'success')`,
-        [uuid(), TEST_TENANT_ID, TEST_AGENT_ID, localSqlTimestamp(new Date())],
-      );
-
-      const res = await get(nextSignupWindow()).set('x-internal-secret', SECRET).expect(200);
-      const signup = signupFor(res.body, 'ada@trafficcorp.io');
-
-      expect(signup).toMatchObject({ has_traffic: true });
-      expect(signup?.last_request_at).not.toBeNull();
-    });
-
-    it('counts people sharing a domain', async () => {
-      await addUser('signup-3a', 'ada@teamcorp.io');
-      await addUser('signup-3b', 'grace@teamcorp.io');
-
-      const res = await get(nextSignupWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(signupFor(res.body, 'ada@teamcorp.io')).toMatchObject({ domain_signups: 2 });
-      expect(signupFor(res.body, 'grace@teamcorp.io')).toMatchObject({ domain_signups: 2 });
-    });
-
-    it('omits consumer mailboxes and role addresses', async () => {
-      await addUser('signup-4', 'ada@gmail.com');
-      await addUser('signup-5', 'support@acmecorp.io');
-
-      const res = await get(nextSignupWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(signupFor(res.body, 'ada@gmail.com')).toBeUndefined();
-      expect(signupFor(res.body, 'support@acmecorp.io')).toBeUndefined();
-    });
-
-    it('omits anyone who claimed the pivot waiting list', async () => {
-      // Waitlist people are contacted by hand. Match is case-insensitive,
-      // because the claim form and the auth record need not agree on case.
-      await addUser('signup-wl', 'ada@waitlisted.io');
-      await ds.query(
-        `INSERT INTO waitlist_claims (id, email, source, claimed_at) VALUES ($1, $2, 'self-hosted', now())`,
-        [uuid(), 'Ada@Waitlisted.io'],
-      );
-
-      const res = await get(nextSignupWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(signupFor(res.body, 'ada@waitlisted.io')).toBeUndefined();
-    });
-
-    it('omits unverified signups', async () => {
-      await ds.query(
-        `INSERT INTO "user" (id, name, email, "emailVerified", "createdAt")
-         VALUES ($1, 'Un Verified', $2, false, now())`,
-        ['signup-6', 'ada@unverifiedcorp.io'],
-      );
-
-      const res = await get(nextSignupWindow()).set('x-internal-secret', SECRET).expect(200);
-
-      expect(signupFor(res.body, 'ada@unverifiedcorp.io')).toBeUndefined();
-    });
-
-    it('requires the secret', async () => {
-      await get('/signups').expect(401);
-    });
-  });
-});
diff --git a/packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts b/packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts
new file mode 100644
index 00000000..9a3a8ba9
--- /dev/null
+++ b/packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts
@@ -0,0 +1,182 @@
+import { DataSource } from 'typeorm';
+import { entities, migrations } from '../src/database/data-source-definitions';
+import { DropSaasFeatureSchema1803300000000 } from '../src/database/migrations/1803300000000-DropSaasFeatureSchema';
+import { toLocalSqlTimestamp } from '../src/common/utils/postgres-sql';
+
+const TENANT = 'saas-drop-tenant';
+const OTHER_TENANT = 'saas-drop-other-tenant';
+const AGENT = 'saas-drop-agent';
+const TIMESTAMP = toLocalSqlTimestamp(new Date(Date.now() - 60 * 1000));
+
+interface SaasArtifacts {
+  waitlistTable: string | null;
+  errorPagesTable: string | null;
+  crmIndex: string | null;
+}
+
+async function saasArtifacts(ds: DataSource): Promise<SaasArtifacts> {
+  const rows: SaasArtifacts[] = await ds.query(`
+    SELECT
+      to_regclass('waitlist_claims')::text AS "waitlistTable",
+      to_regclass('public_error_pages')::text AS "errorPagesTable",
+      to_regclass('"IDX_requests_autofix_healed"')::text AS "crmIndex"
+  `);
+  return rows[0]!;
+}
+
+const NONE: SaasArtifacts = { waitlistTable: null, errorPagesTable: null, crmIndex: null };
+
+async function runDropMigration(ds: DataSource, direction: 'up' | 'down'): Promise<void> {
+  const queryRunner = ds.createQueryRunner();
+  try {
+    // Mirror the deploy runner (transaction mode 'each'): SET LOCAL only
+    // applies inside a transaction.
+    await queryRunner.startTransaction();
+    await new DropSaasFeatureSchema1803300000000()[direction](queryRunner);
+    await queryRunner.commitTransaction();
+  } catch (error) {
+    await queryRunner.rollbackTransaction();
+    throw error;
+  } finally {
+    await queryRunner.release();
+  }
+}
+
+async function insertConnection(
+  ds: DataSource,
+  id: string,
+  tenantId: string,
+  provider: string,
+): Promise<void> {
+  await ds.query(
+    `INSERT INTO "tenant_providers"
+       ("id", "tenant_id", "provider", "auth_type", "api_key_encrypted", "label", "is_active")
+     VALUES ($1, $2, $3, 'api_key', 'encrypted-placeholder', 'Default', true)`,
+    [id, tenantId, provider],
+  );
+}
+
+async function ids(ds: DataSource, sql: string): Promise<string[]> {
+  const rows: Array<{ id: string }> = await ds.query(sql);
+  return rows.map((row) => row.id).sort();
+}
+
+describe('DropSaasFeatureSchema migration (e2e)', () => {
+  let ds: DataSource;
+
+  beforeAll(async () => {
+    ds = new DataSource({
+      type: 'postgres',
+      url:
+        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase',
+      // The exact registries the deploy runner uses, not a glob.
+      entities,
+      migrations,
+      synchronize: false,
+      dropSchema: true,
+      logging: false,
+    });
+    await ds.initialize();
+    await ds.runMigrations({ transaction: 'each' });
+
+    for (const tenant of [TENANT, OTHER_TENANT]) {
+      await ds.query(`INSERT INTO "tenants" ("id", "name", "is_active") VALUES ($1, $1, true)`, [
+        tenant,
+      ]);
+    }
+    await ds.query(
+      `INSERT INTO "agents" ("id", "tenant_id", "name", "display_name", "is_playground")
+       VALUES ($1, $2, $1, $1, false)`,
+      [AGENT, TENANT],
+    );
+  }, 120_000);
+
+  afterAll(async () => {
+    if (ds?.isInitialized) await ds.destroy();
+  });
+
+  it('leaves no SaaS schema on a database migrated from empty', async () => {
+    expect(await saasArtifacts(ds)).toEqual(NONE);
+    const applied: Array<{ name: string }> = await ds.query(
+      `SELECT "name" FROM "migrations" WHERE "name" = 'DropSaasFeatureSchema1803300000000'`,
+    );
+    expect(applied).toHaveLength(1);
+  });
+
+  it('reverts to the self-hosted tables and applies again', async () => {
+    await runDropMigration(ds, 'down');
+    expect(await saasArtifacts(ds)).toEqual({
+      waitlistTable: 'waitlist_claims',
+      errorPagesTable: 'public_error_pages',
+      crmIndex: null,
+    });
+    // The restored tables accept the rows their old writers inserted.
+    await ds.query(`INSERT INTO "waitlist_claims" ("email") VALUES ('a@example.com')`);
+    await ds.query(
+      `INSERT INTO "public_error_pages" ("slug", "cluster_key", "provider", "title", "meta_description", "h1")
+       VALUES ('s', 'k', 'openai', 't', 'm', 'h')`,
+    );
+
+    await runDropMigration(ds, 'up');
+    expect(await saasArtifacts(ds)).toEqual(NONE);
+
+    // Idempotent: a second run on the cleaned schema is a no-op.
+    await runDropMigration(ds, 'up');
+    expect(await saasArtifacts(ds)).toEqual(NONE);
+  });
+
+  it('drops a leftover cloud-mode CRM index', async () => {
+    await ds.query(
+      `CREATE INDEX "IDX_requests_autofix_healed" ON "requests" ("tenant_id", "timestamp")
+       INCLUDE ("status") WHERE "autofix_status" = 'retry_succeeded'`,
+    );
+    expect((await saasArtifacts(ds)).crmIndex).toBe('"IDX_requests_autofix_healed"');
+
+    await runDropMigration(ds, 'up');
+
+    expect(await saasArtifacts(ds)).toEqual(NONE);
+  });
+
+  it('deletes Gemini Free connections and their grants, keeping everything else', async () => {
+    await insertConnection(ds, 'tp-gemini-free', TENANT, 'gemini-free');
+    await insertConnection(ds, 'tp-gemini-free-other', OTHER_TENANT, 'Gemini-Free');
+    await insertConnection(ds, 'tp-gemini', TENANT, 'gemini');
+    await insertConnection(ds, 'tp-openai', TENANT, 'openai');
+    for (const providerId of ['tp-gemini-free', 'tp-gemini', 'tp-openai']) {
+      await ds.query(
+        `INSERT INTO "agent_enabled_providers" ("agent_id", "tenant_provider_id") VALUES ($1, $2)`,
+        [AGENT, providerId],
+      );
+    }
+    await ds.query(
+      `INSERT INTO "requests" ("id", "tenant_id", "agent_id", "timestamp", "status")
+       VALUES ('gemini-free-request', $1, $2, $3, 'success')`,
+      [TENANT, AGENT, TIMESTAMP],
+    );
+    await ds.query(
+      `INSERT INTO "agent_messages" (
+         "id", "request_id", "tenant_id", "agent_id", "agent_name", "timestamp",
+         "status", "input_tokens", "output_tokens", "cache_read_tokens",
+         "cache_creation_tokens", "provider", "tenant_provider_id"
+       )
+       VALUES ('gemini-free-attempt', 'gemini-free-request', $1, $2, $2, $3,
+               'success', 1, 1, 0, 0, 'gemini-free', 'tp-gemini-free')`,
+      [TENANT, AGENT, TIMESTAMP],
+    );
+
+    await runDropMigration(ds, 'up');
+
+    expect(await ids(ds, `SELECT "id" FROM "tenant_providers"`)).toEqual([
+      'tp-gemini',
+      'tp-openai',
+    ]);
+    expect(
+      await ids(ds, `SELECT "tenant_provider_id" AS "id" FROM "agent_enabled_providers"`),
+    ).toEqual(['tp-gemini', 'tp-openai']);
+    // History survives with its provider label; only the dangling link goes.
+    const history: Array<{ provider: string; tenant_provider_id: string | null }> = await ds.query(
+      `SELECT "provider", "tenant_provider_id" FROM "agent_messages" WHERE "id" = 'gemini-free-attempt'`,
+    );
+    expect(history).toEqual([{ provider: 'gemini-free', tenant_provider_id: null }]);
+  });
+});
diff --git a/packages/backend/test/helpers.ts b/packages/backend/test/helpers.ts
index c79b7693..79597fb9 100644
--- a/packages/backend/test/helpers.ts
+++ b/packages/backend/test/helpers.ts
@@ -38,8 +38,6 @@ import { PlaygroundColumn } from '../src/entities/playground-column.entity';
 import { ReasoningContentCacheEntry } from '../src/entities/reasoning-content-cache-entry.entity';
 import { AgentEnabledProvider } from '../src/entities/agent-enabled-provider.entity';
 import { BackfillState } from '../src/entities/backfill-state.entity';
-import { PublicErrorPage } from '../src/entities/public-error-page.entity';
-import { WaitlistClaim } from '../src/entities/waitlist-claim.entity';
 import { CliAuthCode } from '../src/entities/cli-auth-code.entity';
 import { AuthModule } from '../src/auth/auth.module';
 import { HealthModule } from '../src/health/health.module';
@@ -52,8 +50,6 @@ import { RoutingModule } from '../src/routing/routing.module';
 import { PlaygroundModule } from '../src/playground/playground.module';
 import { CommonModule } from '../src/common/common.module';
 import { SetupModule } from '../src/setup/setup.module';
-import { WaitlistModule } from '../src/waitlist/waitlist.module';
-import { CrmMetricsModule } from '../src/crm-metrics/crm-metrics.module';
 import { ProviderModelFetcherService } from '../src/model-discovery/provider-model-fetcher.service';
 
 export const TEST_USER_ID = 'test-user-001';
@@ -84,8 +80,6 @@ const entities = [
   ReasoningContentCacheEntry,
   AgentEnabledProvider,
   BackfillState,
-  PublicErrorPage,
-  WaitlistClaim,
   CliAuthCode,
 ];
 const OPENROUTER_MODELS_URL = 'https://openrouter.ai/api/v1/models';
@@ -246,8 +240,6 @@ export async function createTestApp(options: CreateTestAppOptions = {}): Promise
         RoutingModule,
         PlaygroundModule,
         SetupModule,
-        WaitlistModule,
-        CrmMetricsModule,
       ],
       providers: [{ provide: APP_GUARD, useClass: MockSessionGuard }],
     })
diff --git a/packages/backend/test/removed-saas-routes.e2e-spec.ts b/packages/backend/test/removed-saas-routes.e2e-spec.ts
new file mode 100644
index 00000000..0be6ed52
--- /dev/null
+++ b/packages/backend/test/removed-saas-routes.e2e-spec.ts
@@ -0,0 +1,53 @@
+/**
+ * The Manifest Cloud and marketing surfaces removed in #15 are gone: the
+ * waitlist, the CRM metrics feed, GitHub stars, free models, the public and
+ * internal error pages, and the managed Gemini Free provider. Their routes
+ * answer 404 and Gemini Free can no longer be connected.
+ */
+import { INestApplication } from '@nestjs/common';
+import request from 'supertest';
+import { createTestApp, TEST_API_KEY } from './helpers';
+
+let app: INestApplication;
+
+beforeAll(async () => {
+  app = await createTestApp();
+});
+
+afterAll(async () => {
+  await app.close();
+});
+
+describe('removed SaaS routes', () => {
+  it.each([
+    ['post', '/api/v1/waitlist/pivot/claim'],
+    ['post', '/api/v1/waitlist/autofix/claim'],
+    ['get', '/api/v1/internal/crm-metrics'],
+    ['get', '/api/v1/internal/crm-metrics/signups'],
+    ['get', '/api/v1/github/stars'],
+    ['get', '/api/v1/free-models'],
+    ['get', '/api/v1/public/error-pages'],
+    ['get', '/api/v1/public/error-pages/some-slug'],
+    ['get', '/api/v1/internal/error-pages/clusters'],
+    ['post', '/api/v1/internal/error-pages'],
+    ['post', '/api/v1/providers/gemini-free/ensure'],
+  ] as const)('%s %s answers 404', async (method, path) => {
+    const res = await request(app.getHttpServer())
+      [method](path)
+      .set('x-api-key', TEST_API_KEY)
+      .set('x-internal-secret', 'x'.repeat(40))
+      .send({ email: 'someone@example.com' });
+
+    expect(res.status).toBe(404);
+  });
+
+  it('rejects connecting the managed Gemini Free provider', async () => {
+    const res = await request(app.getHttpServer())
+      .post('/api/v1/routing/test-agent/providers')
+      .set('x-api-key', TEST_API_KEY)
+      .send({ provider: 'gemini-free', apiKey: 'sk-virtual-key-123456' });
+
+    expect(res.status).toBe(400);
+    expect(JSON.stringify(res.body)).toContain('provider must be one of');
+  });
+});
diff --git a/packages/backend/test/waitlist.e2e-spec.ts b/packages/backend/test/waitlist.e2e-spec.ts
deleted file mode 100644
index f5ba8164..00000000
--- a/packages/backend/test/waitlist.e2e-spec.ts
+++ /dev/null
@@ -1,141 +0,0 @@
-import { INestApplication } from '@nestjs/common';
-import { DataSource } from 'typeorm';
-import request from 'supertest';
-import { createTestApp } from './helpers';
-
-let app: INestApplication;
-
-beforeAll(async () => {
-  app = await createTestApp();
-});
-
-afterAll(async () => {
-  await app.close();
-});
-
-beforeEach(async () => {
-  const ds = app.get(DataSource);
-  await ds.query(`DELETE FROM waitlist_claims`);
-});
-
-describe('POST /api/v1/waitlist/pivot/claim', () => {
-  it('stores a claim with a normalized email and the declared cloud source', async () => {
-    await request(app.getHttpServer())
-      .post('/api/v1/waitlist/pivot/claim')
-      .send({ email: '  Jane@Example.COM ', source: 'cloud' })
-      .expect(200)
-      .expect({ ok: true });
-
-    const ds = app.get(DataSource);
-    const rows = await ds.query(`SELECT email, source FROM waitlist_claims`);
-    expect(rows).toEqual([{ email: 'jane@example.com', source: 'cloud' }]);
-  });
-
-  it('defaults a sourceless claim to self-hosted', async () => {
-    await request(app.getHttpServer())
-      .post('/api/v1/waitlist/pivot/claim')
-      .send({ email: 'a@b.co' })
-      .expect(200);
-
-    const ds = app.get(DataSource);
-    const rows = await ds.query(`SELECT source FROM waitlist_claims`);
-    expect(rows).toEqual([{ source: 'self-hosted' }]);
-  });
-
-  it('infers cloud for a sourceless same-origin claim', async () => {
-    await request(app.getHttpServer())
-      .post('/api/v1/waitlist/pivot/claim')
-      .set('Host', 'claims.test')
-      .set('Origin', 'http://claims.test')
-      .send({ email: 'stale@b.co' })
-      .expect(200);
-
-    const ds = app.get(DataSource);
-    const rows = await ds.query(`SELECT source FROM waitlist_claims`);
-    expect(rows).toEqual([{ source: 'cloud' }]);
-  });
-
-  it('never overwrites a website row, while still answering ok', async () => {
-    const ds = app.get(DataSource);
-    await ds.query(
-      `INSERT INTO waitlist_claims (email, source, claimed_at) VALUES ($1, $2, now() - interval '1 day')`,
-      ['site@b.co', 'website'],
-    );
-
-    await request(app.getHttpServer())
-      .post('/api/v1/waitlist/pivot/claim')
-      .send({ email: 'site@b.co', source: 'cloud' })
-      .expect(200)
-      .expect({ ok: true });
-
-    const rows = await ds.query(
-      `SELECT source, claimed_at < now() - interval '1 hour' AS untouched FROM waitlist_claims`,
-    );
-    expect(rows).toEqual([{ source: 'website', untouched: true }]);
-  });
-
-  it('rejects a source outside cloud/self-hosted', async () => {
-    await request(app.getHttpServer())
-      .post('/api/v1/waitlist/pivot/claim')
-      .send({ email: 'a@b.co', source: 'website' })
-      .expect(400);
-  });
-
-  it('dedupes by email on a second claim', async () => {
-    const server = app.getHttpServer();
-    await request(server).post('/api/v1/waitlist/pivot/claim').send({ email: 'a@b.co' });
-    await request(server).post('/api/v1/waitlist/pivot/claim').send({ email: 'A@b.co' });
-
-    const ds = app.get(DataSource);
-    const rows = await ds.query(`SELECT email FROM waitlist_claims`);
-    expect(rows).toHaveLength(1);
-  });
-
-  it('lets the latest claim overwrite the source of an already-registered email', async () => {
-    const ds = app.get(DataSource);
-    await ds.query(
-      `INSERT INTO waitlist_claims (email, source, claimed_at) VALUES ($1, $2, now() - interval '1 day')`,
-      ['old@b.co', 'self-hosted'],
-    );
-
-    await request(app.getHttpServer())
-      .post('/api/v1/waitlist/pivot/claim')
-      .send({ email: 'old@b.co', source: 'cloud' })
-      .expect(200);
-
-    const rows = await ds.query(
-      `SELECT email, source, claimed_at > now() - interval '1 hour' AS refreshed FROM waitlist_claims`,
-    );
-    expect(rows).toEqual([{ email: 'old@b.co', source: 'cloud', refreshed: true }]);
-  });
-
-  it('rejects an invalid email with 400 and stores nothing', async () => {
-    await request(app.getHttpServer())
-      .post('/api/v1/waitlist/pivot/claim')
-      .send({ email: 'not-an-email' })
-      .expect(400);
-
-    const ds = app.get(DataSource);
-    const rows = await ds.query(`SELECT email FROM waitlist_claims`);
-    expect(rows).toHaveLength(0);
-  });
-
-  it('rejects unknown fields with 400', async () => {
-    await request(app.getHttpServer())
-      .post('/api/v1/waitlist/pivot/claim')
-      .send({ email: 'a@b.co', newsletter: true })
-      .expect(400);
-  });
-
-  it('keeps the legacy autofix claim as a storing-nothing no-op', async () => {
-    await request(app.getHttpServer())
-      .post('/api/v1/waitlist/autofix/claim')
-      .send({ email: 'a@b.co' })
-      .expect(200)
-      .expect({ ok: true });
-
-    const ds = app.get(DataSource);
-    const rows = await ds.query(`SELECT email FROM waitlist_claims`);
-    expect(rows).toHaveLength(0);
-  });
-});
diff --git a/packages/cli/src/provider-catalog.gen.ts b/packages/cli/src/provider-catalog.gen.ts
index 3a8f70fa..c9da937e 100644
--- a/packages/cli/src/provider-catalog.gen.ts
+++ b/packages/cli/src/provider-catalog.gen.ts
@@ -95,12 +95,6 @@ export const PROVIDER_CATALOG: readonly ProviderCatalogEntry[] = [
     aliases: ['google'],
     authTypes: ['api_key', 'subscription'],
   },
-  {
-    id: 'gemini-free',
-    displayName: 'Gemini Free',
-    aliases: ['gemini free'],
-    authTypes: ['api_key'],
-  },
   {
     id: 'kiro',
     displayName: 'Kiro',
diff --git a/packages/shared/__tests__/error-taxonomy.spec.ts b/packages/shared/__tests__/error-taxonomy.spec.ts
index dc867d9a..f8e0bd6e 100644
--- a/packages/shared/__tests__/error-taxonomy.spec.ts
+++ b/packages/shared/__tests__/error-taxonomy.spec.ts
@@ -89,7 +89,6 @@ describe('classifyMessageError', () => {
     ['local_provider_unavailable', 'config', 'local_provider_unavailable'],
     ['key_expired', 'config', 'auth'],
     ['limit_exceeded', 'policy', 'limit_exceeded'],
-    ['plan_request_limit_exceeded', 'policy', 'plan_request_limit_exceeded'],
     ['manifest_rate_limited', 'policy', 'rate_limit'],
     ['manifest_ip_rate_limited', 'policy', 'rate_limit'],
     ['manifest_concurrency_limited', 'policy', 'rate_limit'],
@@ -220,7 +219,7 @@ describe('classifyMessageError', () => {
     ).toEqual({ error_origin: 'config', error_class: 'no_provider_key', superseded: true });
   });
 
-  it('keeps legacy 402 request-quota rows distinct from user-configured limits', () => {
+  it('classifies a 402 limit stub as a user-configured limit (no plan quota class)', () => {
     expect(
       classifyMessageError({
         status: 'error',
@@ -229,9 +228,10 @@ describe('classifyMessageError', () => {
       }),
     ).toEqual({
       error_origin: 'policy',
-      error_class: 'plan_request_limit_exceeded',
+      error_class: 'limit_exceeded',
       superseded: false,
     });
+    expect(ERROR_CLASSES).not.toContain('plan_request_limit_exceeded');
   });
 });
 
diff --git a/packages/shared/__tests__/providers.spec.ts b/packages/shared/__tests__/providers.spec.ts
index c92013cd..e68def9e 100644
--- a/packages/shared/__tests__/providers.spec.ts
+++ b/packages/shared/__tests__/providers.spec.ts
@@ -158,14 +158,10 @@ describe('SHARED_PROVIDER_BY_ID', () => {
     expect(groq!.openRouterPrefixes).toEqual([]);
   });
 
-  it('registers Gemini Free separately from the Google provider', () => {
-    const provider = SHARED_PROVIDER_BY_ID.get('gemini-free');
-    expect(provider).toBeDefined();
-    expect(provider!.displayName).toBe('Gemini Free');
-    expect(provider!.aliases).toEqual(['gemini free']);
-    expect(provider!.openRouterPrefixes).toEqual([]);
-    expect(provider!.keyPlaceholder).toBe('sk-...');
-    expect(provider!.managedFree).toBe(true);
+  it('does not register the removed managed Gemini Free provider', () => {
+    expect(SHARED_PROVIDER_BY_ID.get('gemini-free')).toBeUndefined();
+    expect(SHARED_PROVIDER_BY_ID_OR_ALIAS.get('gemini free')).toBeUndefined();
+    expect(SHARED_PROVIDER_BY_ID_OR_ALIAS.get('gemini-free')).toBeUndefined();
   });
 
   it('nvidia has no openRouter prefixes (native NIM /models is authoritative)', () => {
diff --git a/packages/shared/src/error-taxonomy.ts b/packages/shared/src/error-taxonomy.ts
index 7a74b719..6f467ed3 100644
--- a/packages/shared/src/error-taxonomy.ts
+++ b/packages/shared/src/error-taxonomy.ts
@@ -150,7 +150,6 @@ export const ERROR_CLASSES = [
   'subscription_credentials_unusable',
   'local_provider_unavailable',
   'limit_exceeded',
-  'plan_request_limit_exceeded',
   'internal',
 ] as const;
 export type ErrorClass = (typeof ERROR_CLASSES)[number];
@@ -181,10 +180,6 @@ const MANIFEST_REASON_TO_CLASSIFICATION: Record<
   },
   key_expired: { origin: 'config', errorClass: 'auth' },
   limit_exceeded: { origin: 'policy', errorClass: 'limit_exceeded' },
-  plan_request_limit_exceeded: {
-    origin: 'policy',
-    errorClass: 'plan_request_limit_exceeded',
-  },
   // Three distinct limits (per-user / per-IP / concurrency) that used to
   // collapse into `manifest_rate_limited`. That legacy reason stays mapped so
   // rows written before the split keep classifying.
@@ -263,13 +258,6 @@ export function classifyMessageError(signals: MessageErrorSignals): MessageError
     ? MANIFEST_REASON_TO_CLASSIFICATION[signals.routingReason]
     : undefined;
   if (manifest) {
-    if (signals.routingReason === 'limit_exceeded' && signals.errorHttpStatus === 402) {
-      return {
-        error_origin: 'policy',
-        error_class: 'plan_request_limit_exceeded',
-        superseded,
-      };
-    }
     return { error_origin: manifest.origin, error_class: manifest.errorClass, superseded };
   }
 
diff --git a/packages/shared/src/providers.ts b/packages/shared/src/providers.ts
index 901d17bc..bd609959 100644
--- a/packages/shared/src/providers.ts
+++ b/packages/shared/src/providers.ts
@@ -33,8 +33,6 @@ export interface SharedProviderEntry {
   minKeyLength: number;
   /** Placeholder shown in the UI's API-key input. */
   keyPlaceholder: string;
-  /** Whether Manifest provisions this provider through its managed free-provider flow. */
-  managedFree?: boolean;
   /**
    * Tiles that deep-link users into the local-server detail view (LM
    * Studio today). They do not have a fixed proxy endpoint — once
@@ -253,19 +251,6 @@ export const SHARED_PROVIDERS: readonly SharedProviderEntry[] = [
     minKeyLength: 30,
     keyPlaceholder: 'API key',
   },
-  {
-    id: 'gemini-free',
-    displayName: 'Gemini Free',
-    aliases: ['gemini free'],
-    openRouterPrefixes: [],
-    requiresApiKey: true,
-    localOnly: false,
-    color: '#4285f4',
-    keyPrefix: 'sk-',
-    minKeyLength: 10,
-    keyPlaceholder: 'sk-...',
-    managedFree: true,
-  },
   {
     id: 'kiro',
     displayName: 'Kiro',

From 7dfb7188870e627b6157e9850d6c99f8f00288ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 01:03:11 -0300
Subject: [PATCH 06/17] feat(backend)!: remove Autofix and the Phoenix healer
 from the backend

Autofix sent failing requests to Manifest's hosted healer
(autofix.manifest.build) and pinged it at every production boot. Thinker
makes no such call (#16). The local self-heal of v0.6 will build on the
fallback chain on its own terms.

- Delete routing/autofix (AutofixService, healing clients, health probe,
  observation reporter, Phoenix types and vendored contract) and the
  contract:refresh script with its ajv/js-yaml devDependencies.
- Proxy: drop the heal-once branch from the primary and fallback hops and
  the wire-body retry hook from ForwardResult. A failed request now goes
  straight to shouldTriggerFallback, exactly as for an agent that never
  opted in. The primary is always attempt 1, the x-manifest-provider /
  x-manifest-auth-type replay rewrite is gone, and the recorder writes no
  repair columns or auto_fixed rows.
- Analytics: move the generic reliability metrics to
  /api/v1/overview/reliability/{stats,timeseries,per-agent,per-provider,
  per-model} without the Autofix fields; drop the healed disposition, the
  auto_fixed counter, the autofix trigger filter and the connection
  breakdown's Autofix attempts.
- Remove /autofix/status, /autofix/enable-all, the per-harness
  /routing/:agent/autofix endpoints, the autofix_enabled create field, the
  MCP Autofix tools and the CLI `routing autofix` command and `--autofix`.
- Schema: DropAutofixSchema1803400000000 drops the autofix columns, check
  constraint and indexes (lock_timeout, IF EXISTS, full revert).
  1802200000000 now runs its self-hosted no-op path everywhere.
- Shared: drop deriveAutofixStatus, AUTOFIX_STATUSES and auto_fixed.
- Delete the unused doctor-release email.
- Frontend: call the neutral reliability paths and drop the temporary
  autofix_enabled opt-out, the duplicate PATCH and the healed fold.
- Docs: move the PoC spec to docs/referencia/, remove AUTOFIX_* from the
  guide, .env.example and the Docker README.

BREAKING CHANGE: the Autofix API, analytics paths, MCP tools and CLI
command are removed; the reliability analytics moved to
/api/v1/overview/reliability/*.

Closes #16

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docker/DOCKER_README.md                       |   51 +-
 docs/dev/manifest-guide.md                    |   75 +-
 .../autofix-self-healing-poc.md               |   11 +-
 package-lock.json                             |   34 +-
 packages/backend/.env.example                 |    6 -
 packages/backend/package.json                 |    5 -
 .../scripts/refresh-phoenix-contract.mjs      |   32 -
 .../backend/src/analytics/analytics.module.ts |   13 +-
 .../controllers/agents.controller.spec.ts     |   54 -
 .../controllers/agents.controller.ts          |   35 +-
 .../autofix-analytics.controller.spec.ts      |   94 --
 .../autofix-analytics.controller.ts           |  104 --
 .../provider-analytics.controller.spec.ts     |    7 -
 .../provider-analytics.controller.ts          |    4 +-
 .../reliability-analytics.controller.spec.ts  |   84 ++
 .../reliability-analytics.controller.ts       |   82 +
 .../analytics/dto/messages-query.dto.spec.ts  |    4 +-
 .../src/analytics/dto/messages-query.dto.ts   |    6 +-
 .../services/attempt-stats.service.spec.ts    |   11 +-
 .../services/attempt-stats.service.ts         |   22 +-
 .../services/autofix-stats.service.spec.ts    |  451 ------
 .../services/error-breakdown.service.spec.ts  |   45 +-
 .../services/error-breakdown.service.ts       |   46 +-
 .../services/message-details.service.spec.ts  |   56 +-
 .../services/message-details.service.ts       |   63 +-
 .../services/messages-query.requests.spec.ts  |   18 +-
 .../services/messages-query.service.spec.ts   |   31 +-
 .../services/messages-query.service.ts        |   44 +-
 .../analytics/services/query-helpers.spec.ts  |   23 +-
 .../src/analytics/services/query-helpers.ts   |   17 +-
 .../reliability-stats.service.spec.ts         |  229 +++
 ...ervice.ts => reliability-stats.service.ts} |  284 +---
 .../services/request-volume.service.spec.ts   |   30 +-
 .../services/request-volume.service.ts        |   29 +-
 .../src/common/dto/create-agent.dto.spec.ts   |   16 +-
 .../src/common/dto/create-agent.dto.ts        |    5 -
 .../src/common/utils/dashboard-url.spec.ts    |    4 +-
 .../backfill-requests.gateway.spec.ts         |   31 +-
 .../backfills/backfill-requests.gateway.ts    |  111 +-
 .../backfills/backfill-requests.spec.ts       |    1 -
 .../src/database/data-source-definitions.ts   |    2 +
 ...0000-AddRequestsAutofixHealedIndex.spec.ts |   82 +-
 ...200000000-AddRequestsAutofixHealedIndex.ts |   96 +-
 .../1803400000000-DropAutofixSchema.spec.ts   |   60 +
 .../1803400000000-DropAutofixSchema.ts        |   94 ++
 .../src/entities/agent-message.entity.spec.ts |   10 +-
 .../src/entities/agent-message.entity.ts      |   32 -
 packages/backend/src/entities/agent.entity.ts |    7 -
 .../src/entities/install-metadata.entity.ts   |    4 -
 .../backend/src/entities/request.entity.ts    |    5 -
 packages/backend/src/mcp/mcp.controller.ts    |   12 +-
 packages/backend/src/mcp/mcp.module.ts        |    2 -
 packages/backend/src/mcp/tool-deps.ts         |    6 -
 .../backend/src/mcp/tools/agents.tools.ts     |   17 +-
 .../backend/src/mcp/tools/routing.tools.ts    |   59 +-
 packages/backend/src/mcp/tools/tools.spec.ts  |   27 +-
 .../emails/doctor-release.spec.ts             |   37 -
 .../notifications/emails/doctor-release.tsx   |  218 ---
 .../notifications/emails/email-assets.spec.ts |   22 +-
 .../src/otlp/services/api-key.service.spec.ts |   17 +-
 .../src/otlp/services/api-key.service.ts      |    8 +-
 .../src/playground/playground.service.ts      |    3 -
 .../__tests__/autofix-healing-config.spec.ts  |   25 -
 .../__tests__/autofix-health-probe.spec.ts    |  120 --
 .../autofix/__tests__/autofix.module.spec.ts  |  237 ---
 .../autofix/__tests__/autofix.service.spec.ts | 1317 -----------------
 .../__tests__/http-healing-client.spec.ts     |  357 -----
 .../__tests__/mock-healing-client.spec.ts     |  161 --
 .../__tests__/phoenix-contract.spec.ts        |  180 ---
 .../provider-error-normalizer.spec.ts         |  290 ----
 .../routing/autofix/autofix-healing-config.ts |   24 -
 .../routing/autofix/autofix-health-probe.ts   |   57 -
 .../src/routing/autofix/autofix.module.ts     |   86 --
 .../src/routing/autofix/autofix.service.ts    |  594 --------
 .../src/routing/autofix/autofix.types.ts      |   62 -
 .../autofix/contract/phoenix-openapi.yaml     |  714 ---------
 .../src/routing/autofix/healing-client.ts     |   57 -
 .../routing/autofix/http-healing-client.ts    |  153 --
 .../routing/autofix/mock-healing-client.ts    |   74 -
 .../autofix/observation-payload.spec.ts       |  299 ----
 .../routing/autofix/observation-payload.ts    |  204 ---
 .../autofix/observation-reporter.spec.ts      |  308 ----
 .../routing/autofix/observation-reporter.ts   |  188 ---
 .../src/routing/autofix/phoenix.types.ts      |  156 --
 .../autofix/provider-error-normalizer.ts      |  137 --
 .../backend/src/routing/dto/routing.dto.ts    |    6 -
 .../proxy/__tests__/anthropic-adapter.spec.ts |    4 +-
 .../provider-client-converters.spec.ts        |    2 +-
 .../proxy/__tests__/provider-client.spec.ts   |   92 +-
 .../__tests__/proxy-fallback.failures.spec.ts |    5 -
 .../__tests__/proxy-fallback.routes.spec.ts   |    5 -
 .../__tests__/proxy-fallback.service.spec.ts  |  566 ++-----
 .../proxy-message-recorder.routes.spec.ts     |   39 -
 .../__tests__/proxy-message-recorder.spec.ts  |  478 +-----
 .../__tests__/proxy-request-recorder.spec.ts  |   47 +-
 .../__tests__/proxy-response-handler.spec.ts  |  553 +------
 .../proxy/__tests__/proxy.controller.spec.ts  |  101 +-
 .../proxy/__tests__/proxy.service.spec.ts     |  757 +---------
 .../proxy/__tests__/stream-warmup.spec.ts     |    4 +-
 .../src/routing/proxy/anthropic-adapter.ts    |    2 +-
 .../proxy/provider-client-converters.ts       |    8 +-
 .../src/routing/proxy/provider-client.ts      |  131 +-
 .../routing/proxy/proxy-fallback.service.ts   |  223 +--
 .../routing/proxy/proxy-message-recorder.ts   |  229 +--
 .../routing/proxy/proxy-response-handler.ts   |  192 +--
 .../src/routing/proxy/proxy.controller.ts     |  117 +-
 .../backend/src/routing/proxy/proxy.module.ts |    2 -
 .../src/routing/proxy/proxy.service.ts        |  343 +----
 .../backend/src/routing/routing.module.ts     |    4 -
 .../src/routing/tier.controller.spec.ts       |  152 --
 .../backend/src/routing/tier.controller.ts    |   81 -
 .../src/telemetry/dto/telemetry-payload.ts    |    3 +-
 .../src/telemetry/install-id.service.spec.ts  |    1 -
 .../backend/src/telemetry/telemetry.module.ts |    3 -
 .../test/attempt-analytics.e2e-spec.ts        |   22 +-
 .../test/autofix-null-flag.e2e-spec.ts        |   57 -
 .../backend/test/codex-responses.e2e-spec.ts  |    1 -
 .../test/cross-tenant-isolation.e2e-spec.ts   |   13 +-
 .../drop-autofix-schema-migration.e2e-spec.ts |  155 ++
 ...-saas-feature-schema-migration.e2e-spec.ts |    4 +-
 .../test/messages-request-filters.e2e-spec.ts |   44 +-
 .../test/no-autofix-egress.e2e-spec.ts        |   64 +
 .../test/playground-exclusion.e2e-spec.ts     |    2 +-
 .../test/reliability-analytics.e2e-spec.ts    |  173 +++
 .../request-backfill-fallbacks.e2e-spec.ts    |  130 +-
 packages/cli/skill/SKILL.md                   |    6 +-
 packages/cli/src/commands/commands.spec.ts    |   52 +-
 packages/cli/src/commands/configure.ts        |   24 +-
 packages/cli/src/commands/requests.ts         |    1 -
 packages/cli/src/commands/routing.ts          |    9 +-
 packages/cli/src/index.spec.ts                |    3 -
 packages/cli/src/index.ts                     |    5 +-
 packages/cli/src/skill-content.gen.ts         |    2 +-
 packages/frontend/src/services/api/agents.ts  |   44 +-
 .../frontend/src/services/api/analytics.ts    |   58 +-
 .../tests/components/AddAgentModal.test.tsx   |    3 +-
 .../tests/services/api/agents.test.ts         |   42 +-
 .../tests/services/api/analytics.test.ts      |   67 +-
 .../shared/__tests__/autofix-status.spec.ts   |   70 -
 .../shared/__tests__/error-taxonomy.spec.ts   |   12 +-
 packages/shared/src/autofix-status.ts         |   54 -
 packages/shared/src/error-taxonomy.ts         |   17 +-
 packages/shared/src/index.ts                  |    3 -
 143 files changed, 1670 insertions(+), 12505 deletions(-)
 rename docs/{ => referencia}/autofix-self-healing-poc.md (97%)
 delete mode 100644 packages/backend/scripts/refresh-phoenix-contract.mjs
 delete mode 100644 packages/backend/src/analytics/controllers/autofix-analytics.controller.spec.ts
 delete mode 100644 packages/backend/src/analytics/controllers/autofix-analytics.controller.ts
 create mode 100644 packages/backend/src/analytics/controllers/reliability-analytics.controller.spec.ts
 create mode 100644 packages/backend/src/analytics/controllers/reliability-analytics.controller.ts
 delete mode 100644 packages/backend/src/analytics/services/autofix-stats.service.spec.ts
 create mode 100644 packages/backend/src/analytics/services/reliability-stats.service.spec.ts
 rename packages/backend/src/analytics/services/{autofix-stats.service.ts => reliability-stats.service.ts} (50%)
 create mode 100644 packages/backend/src/database/migrations/1803400000000-DropAutofixSchema.spec.ts
 create mode 100644 packages/backend/src/database/migrations/1803400000000-DropAutofixSchema.ts
 delete mode 100644 packages/backend/src/notifications/emails/doctor-release.spec.ts
 delete mode 100644 packages/backend/src/notifications/emails/doctor-release.tsx
 delete mode 100644 packages/backend/src/routing/autofix/__tests__/autofix-healing-config.spec.ts
 delete mode 100644 packages/backend/src/routing/autofix/__tests__/autofix-health-probe.spec.ts
 delete mode 100644 packages/backend/src/routing/autofix/__tests__/autofix.module.spec.ts
 delete mode 100644 packages/backend/src/routing/autofix/__tests__/autofix.service.spec.ts
 delete mode 100644 packages/backend/src/routing/autofix/__tests__/http-healing-client.spec.ts
 delete mode 100644 packages/backend/src/routing/autofix/__tests__/mock-healing-client.spec.ts
 delete mode 100644 packages/backend/src/routing/autofix/__tests__/phoenix-contract.spec.ts
 delete mode 100644 packages/backend/src/routing/autofix/__tests__/provider-error-normalizer.spec.ts
 delete mode 100644 packages/backend/src/routing/autofix/autofix-healing-config.ts
 delete mode 100644 packages/backend/src/routing/autofix/autofix-health-probe.ts
 delete mode 100644 packages/backend/src/routing/autofix/autofix.module.ts
 delete mode 100644 packages/backend/src/routing/autofix/autofix.service.ts
 delete mode 100644 packages/backend/src/routing/autofix/autofix.types.ts
 delete mode 100644 packages/backend/src/routing/autofix/contract/phoenix-openapi.yaml
 delete mode 100644 packages/backend/src/routing/autofix/healing-client.ts
 delete mode 100644 packages/backend/src/routing/autofix/http-healing-client.ts
 delete mode 100644 packages/backend/src/routing/autofix/mock-healing-client.ts
 delete mode 100644 packages/backend/src/routing/autofix/observation-payload.spec.ts
 delete mode 100644 packages/backend/src/routing/autofix/observation-payload.ts
 delete mode 100644 packages/backend/src/routing/autofix/observation-reporter.spec.ts
 delete mode 100644 packages/backend/src/routing/autofix/observation-reporter.ts
 delete mode 100644 packages/backend/src/routing/autofix/phoenix.types.ts
 delete mode 100644 packages/backend/src/routing/autofix/provider-error-normalizer.ts
 delete mode 100644 packages/backend/test/autofix-null-flag.e2e-spec.ts
 create mode 100644 packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts
 create mode 100644 packages/backend/test/no-autofix-egress.e2e-spec.ts
 create mode 100644 packages/backend/test/reliability-analytics.e2e-spec.ts
 delete mode 100644 packages/shared/__tests__/autofix-status.spec.ts
 delete mode 100644 packages/shared/src/autofix-status.ts

diff --git a/docker/DOCKER_README.md b/docker/DOCKER_README.md
index 2a1ecdbc..38ff7d31 100644
--- a/docker/DOCKER_README.md
+++ b/docker/DOCKER_README.md
@@ -17,11 +17,10 @@
 
 ## What is Manifest Gateway?
 
-Manifest Gateway is an open-source LLM gateway for agents and apps. It sits between your agents and your LLM providers (OpenAI, Anthropic, Gemini, local models, and 300+ more) and gives you complete control over routing decisions. Define custom routing rules, set fallbacks when models fail, enable self-healing with Autofix, and track everything from one dashboard.
+Manifest Gateway is an open-source LLM gateway for agents and apps. It sits between your agents and your LLM providers (OpenAI, Anthropic, Gemini, local models, and 300+ more) and gives you complete control over routing decisions. Define custom routing rules, set fallbacks when models fail, and track everything from one dashboard.
 
 - **Custom routing rules**: route by model, header, complexity, or task type
 - **Automatic fallbacks**: if a model fails, the next one picks up instantly
-- **Self-healing with Autofix**: failed requests are repaired in real time before they break your app
 - **Cost control**: set limits and track spending across all providers
 - **Self-hosted**: your requests, your providers, your data — complete privacy
 
@@ -420,7 +419,6 @@ sets this automatically).
 | `SENTRY_DSN`                       | No          | unset                                        | Opt-in error monitoring. Sentry is not initialised unless set                                                                                                                                              |
 | `MANIFEST_TELEMETRY_DISABLED`      | No          | `0`                                          | Set `1` to disable anonymous usage telemetry                                                                                                                                                               |
 | `TELEMETRY_ENDPOINT`               | No          | `https://telemetry.manifest.build/v1/report` | Send the usage report to your own collector instead                                                                                                                                                        |
-| `AUTOFIX_GLOBAL_ENABLED`           | No          | `true`                                       | Deployment-wide Autofix kill switch. Set `false` to make no calls to the Autofix service at all, boot health check included                                                                                |
 
 `NODE_ENV` and `SEED_DATA` are deliberately fixed by the compose file and are
 not knobs here: the image is a production artifact, and the demo-data seeder
@@ -443,53 +441,6 @@ To disable, set `MANIFEST_TELEMETRY_DISABLED=1` in your `.env` file and
 restart the container. The full field list is published at
 [manifest.build/llm-gateway/docs/self-hosted#telemetry](https://manifest.build/llm-gateway/docs/self-hosted/#telemetry).
 
-## Autofix privacy and instance identity
-
-Autofix is off by default for every agent in self-hosted Manifest. When you turn
-it on for an agent, Autofix calls announce your install's random anonymous ID,
-the Manifest version, and the agent platform from a fixed list; custom platform
-names are sent as `other`. There is no registration step and no credential: the
-ID is announced, not issued, and the healing service records it the first time
-it sees it.
-
-**That ID is the same anonymous install UUID the usage report uses.** One
-identity per install, so Autofix activity and the aggregate telemetry report can
-be linked to the same install by Manifest. Neither carries a user, tenant, or
-email. If you want them unlinked, there is no setting for that today — the
-identifier is shared by design.
-
-Autofix works by sending a failed request to the healing service so it can
-produce a corrected body. The failing request body, provider error, provider,
-and API mode are therefore sent after known secrets are scrubbed. Secret
-scrubbing does not remove arbitrary personal information from prompts. Successful
-traffic is not sent. If `AUTOFIX_REPORT_ALL_4XX=true`, scrubbed bodies for other
-request-side 4xx failures are also sent as diagnostic observations (up to
-256 KiB), under the same per-agent opt-in.
-
-If no agent has Autofix enabled, no healing call is made and **no ID is ever
-created** — it is generated on first use, so an install that never enables
-Autofix and never reports telemetry has no identity at all. Only the public,
-unauthenticated boot-time health check may contact the service, and it never
-creates an identity. Set `AUTOFIX_GLOBAL_ENABLED=false` to disable every Autofix
-service call, boot health check included.
-
-The Autofix endpoint itself is not configurable — it is a constant in the image
-(`https://autofix.manifest.build`). There is no supported way to point an
-install at a different healing service.
-
-`MANIFEST_TELEMETRY_DISABLED=1` stops the aggregate usage report and nothing
-else; it does not disable Autofix, and it does not stop Autofix from creating and
-announcing the shared ID.
-
-After restoring or cloning a database, you can force a fresh identity:
-
-```sql
-DELETE FROM install_metadata;
-```
-
-This resets the shared ID, so the next Autofix call and the next usage report
-both announce a new one. Your install will look like a new install to both.
-
 ## Links
 
 - [GitHub](https://github.com/mnfst/llm-gateway)
diff --git a/docs/dev/manifest-guide.md b/docs/dev/manifest-guide.md
index 055c9497..d46a9f53 100644
--- a/docs/dev/manifest-guide.md
+++ b/docs/dev/manifest-guide.md
@@ -2,7 +2,7 @@
 > Thinker is a self-hosted-only fork. While this file is being rewritten, apply these overrides to everything below:
 >
 > - **Ignore every "Cloud Mode Always" / `MANIFEST_MODE=cloud` directive.** Thinker has no cloud mode; use the self-hosted mode.
-> - **The dashboard has no Wingman drawer, update check, Discovery step or Autofix UI** (#13). Backend leftovers go in #16/#17.
+> - **The dashboard has no Wingman drawer, update check, Discovery step or Autofix UI** (#13), and the backend has no Autofix (#16). Remaining backend leftovers go in #17.
 > - **Never call `app.manifest.build` or any other Manifest-hosted endpoint.**
 > - **Do not use the `mnfst` CLI against Manifest's cloud.** The CLI becomes `thinker` and only talks to a Thinker instance.
 
@@ -20,7 +20,7 @@ Manifest is a smart model router for **AI agents**. It sits between an agent and
 
 **Supported agents**: see `AGENT_PLATFORMS` in `packages/shared/src/agent-type.ts` for the current list (OpenClaw, Hermes, Claude Code, OpenCode, generic OpenAI/Anthropic SDK slots, and others — don't duplicate the list here, it grows independently of this doc). OpenClaw remains the deepest integration, but no new code or copy should frame Manifest as OpenClaw-only. When adding examples, prefer "AI agent" as the noun and pick OpenClaw as the worked example rather than the sole target. Manifest is consumed as a generic OpenAI-compatible HTTP endpoint — there are no first-party OpenClaw plugins in this repo anymore.
 
-The dashboard makes no outbound call of its own (#13): no Wingman drawer, no "new version" check (the version badge reads the build-time `__MANIFEST_VERSION__` constant from `vite.config.ts`), no post-signup Discovery questionnaire, and no Autofix UI. Setup and signup go straight to the dashboard (`/` and `/welcome`). The backend `wingman`/CORS, `version/`, `discovery/` and Autofix modules still exist until #16/#17 remove them; the dashboard no longer calls them, except the generic reliability analytics still served under the legacy `/api/v1/overview/autofix-*` paths (see `RELIABILITY_PATHS` in `packages/frontend/src/services/api/analytics.ts`).
+The dashboard makes no outbound call of its own (#13): no Wingman drawer, no "new version" check (the version badge reads the build-time `__MANIFEST_VERSION__` constant from `vite.config.ts`), no post-signup Discovery questionnaire, and no Autofix UI. Setup and signup go straight to the dashboard (`/` and `/welcome`). The backend `wingman`/CORS, `version/` and `discovery/` modules still exist until #17 removes them; the dashboard no longer calls them. Autofix is gone from the backend too (#16, see [Autofix removed](#autofix-removed)); the generic reliability analytics the dashboard reads live under `/api/v1/overview/reliability/*` (see `RELIABILITY_PATHS` in `packages/frontend/src/services/api/analytics.ts`).
 
 **Three management surfaces share one REST API.** The dashboard, the `mnfst` CLI (`packages/cli/`), and the remote MCP server (`packages/backend/src/mcp/`) all drive the same `/api/v1/*` services with the same tenant scoping. Add a capability to the service layer once, then expose it on whichever surfaces need it; never fork logic per surface. See [CLI login](#cli-login-mnfst-login) and [Remote MCP server](#remote-mcp-server) below.
 
@@ -123,7 +123,6 @@ packages/
 │   │   │   └── services/api-key.service.ts  # Agent onboarding (creates tenant+agent+key)
 │   │   ├── routing/                         # LLM routing (providers, tiers, proxy, scorer)
 │   │   │   ├── proxy/                       # OpenAI-compatible proxy (anthropic/google adapters, fallback chain, attempt recording, caller-classifier)
-│   │   │   ├── autofix/                     # Autofix self-healing (Phoenix client + heal-once flow)
 │   │   │   ├── routing-core/               # Tier, provider, specificity services + cache
 │   │   │   ├── resolve/                     # Scoring-based tier + specificity resolution
 │   │   │   ├── custom-provider/             # Custom provider CRUD (+ `alias`, the public model-id prefix in /v1/models)
@@ -205,7 +204,7 @@ Beyond `packages/`, the repo root also carries:
 - `contracts/gateway/` — gateway API contract tests.
 - `design-system/` — machine-readable design registry (generated `registry/components.json` + `registry/llms.txt`; generator `generate-registry.mjs`).
 - `deploy/` — one-click deployment templates (apple-containers, aws, coolify, digitalocean, easypanel, fly, gcp, heroku, koyeb).
-- `docs/` — `glossary.md` (canonical terminology contract), `autofix-self-healing-poc.md`, `model-parameters-schema.md`, `providers/subscription-based-providers.md`.
+- `docs/` — `glossary.md` (canonical terminology contract), `referencia/autofix-self-healing-poc.md` (the removed upstream Autofix design, kept as input for the v0.6 local self-heal), `model-parameters-schema.md`, `providers/subscription-based-providers.md`.
 
 ## Single-Service Deployment
 
@@ -370,7 +369,7 @@ The CLI refuses HTTP redirects (so the key cannot leak cross-origin) and strips
 - **Discovery**: `mcp-discovery.ts` (mounted in `main.ts`) serves the OAuth documents at the well-known **root** paths (`/.well-known/oauth-authorization-server`, `/.well-known/oauth-protected-resource[/api/v1/mcp]`) in addition to Better Auth's `/api/auth/.well-known/…`, because clients start from the MCP origin's root.
 - **Consent**: `pages/Consent.tsx` at `/consent` is the OAuth consent screen.
 - **Scopes**: `mcp:read` is required for every token; each `register*Tools()` returns before registering its write tools unless `operator.scopes` has `mcp:write`, so a read-only client never sees them (the server `instructions` string tells it to reconnect with the write scope). Revealing an ingest key also requires `mcp:write` because it is a live secret.
-- **Tools** (`mcp/tools/*.tools.ts`): identity, agents, environment (+ a `doctor` that walks dependencies in order), providers (including custom providers), routing (status, fallbacks, Autofix, recording, custom/header tiers, per-tier model params), models/pricing, and the request ledger. They call the same services as the REST controllers through `McpToolDeps` (`tool-deps.ts`); `tool-result.ts` is the shared result envelope.
+- **Tools** (`mcp/tools/*.tools.ts`): identity, agents, environment (+ a `doctor` that walks dependencies in order), providers (including custom providers), routing (status, fallbacks, recording, custom/header tiers, per-tier model params), models/pricing, and the request ledger. They call the same services as the REST controllers through `McpToolDeps` (`tool-deps.ts`); `tool-result.ts` is the shared result envelope.
 - **Testing**: `auth.instance.ts` is ESM-only and cannot load under Jest on Node 22, which is why the scope constants live in the leaf module `auth/mcp-scopes.ts` — import from there in guards, tools, and specs.
 
 ## Multi-Tenancy Model
@@ -418,12 +417,11 @@ Every resource belongs to a tenant; users only authenticate and (optionally) app
 | GET                       | `/api/v1/providers` / `/api/v1/providers/usage` | Session/API Key                     | Connected provider list + usage                                                                             |
 | GET                       | `/api/v1/provider-analytics/*`                  | Session/API Key                     | Per-provider analytics                                                                                      |
 | GET                       | `/api/v1/errors/breakdown`                      | Session/API Key                     | Error breakdown analytics                                                                                   |
-| GET/POST                  | `/api/v1/autofix/status` / `.../enable-all`     | Session/API Key                     | Workspace Autofix coverage + API-only fleet enable (no dashboard caller)                                    |
-| GET                       | `/api/v1/overview/autofix-*`                    | Session/API Key                     | Autofix analytics (stats, timeseries, per-agent/provider/model)                                             |
+| GET                       | `/api/v1/overview/reliability/*`                | Session/API Key                     | Request reliability (`stats`, `timeseries`, `per-agent`, `per-provider`, `per-model`)                       |
 | POST                      | `/api/v1/discovery/complete`                    | Session/API Key                     | Best-effort self-hosted discovery submission forwarded to Peacock                                           |
 | GET/PUT/DELETE            | `/api/v1/agents/:agentName/enabled-providers*`  | Session/API Key                     | Per-agent provider enable/disable + impact preview                                                          |
 | GET/POST/PATCH/DELETE     | `/api/v1/notifications/*`                       | Session/API Key                     | Notification rules CRUD + email provider config                                                             |
-| GET/POST/PUT/PATCH/DELETE | `/api/v1/routing/:agentName/*`                  | Session/API Key                     | Routing config (tiers, providers, model-params, header-tiers, custom-providers, specificity, autofix, recording, etc.) |
+| GET/POST/PUT/PATCH/DELETE | `/api/v1/routing/:agentName/*`                  | Session/API Key                     | Routing config (tiers, providers, model-params, header-tiers, custom-providers, specificity, recording, etc.) |
 | GET/PATCH                 | `/api/v1/routing/:agentName/tiers/:tier/model-params` | Session/API Key                     | Model params addressed by tier (`default` or a custom tier name) + `?model=` (defaults to the tier primary); backs `mnfst routing params` and the MCP `manifest_routing_params_*` tools. Writes the same rows as the scope-keyed `…/model-params` |
 | POST                      | `/api/v1/routing/ollama/sync`                   | Session/API Key                     | Sync Ollama models                                                                                          |
 | GET                       | `/api/v1/routing/pricing-health`                | Session/API Key                     | OpenRouter pricing sync health                                                                              |
@@ -501,13 +499,10 @@ See `packages/backend/.env.example` for all variables. Key ones:
 - `WINGMAN_PORT` — Dev-only. Port a locally-running Wingman build listens on, allowed through CSP `frame-src` and CORS alongside the hosted Wingman origin. Default: backend `PORT` + 1.
 - `AUTH_DB_POOL_MAX` — Connection pool size for Better Auth's own `pg.Pool`, separate from `DB_POOL_MAX`. Default: `5`.
 - `OLLAMA_HOST` — Ollama endpoint for the built-in tile. Defaults to `http://localhost:11434` outside Docker and `http://host.docker.internal:11434` inside the bundled `docker/docker-compose.yml`.
-- The Phoenix healer URL is **not** configurable. It is the `AUTOFIX_URL` constant in `routing/autofix/autofix-healing-config.ts`; production (cloud and self-hosted alike) always heals against it, dev/test always uses the in-process mock. To switch Autofix off, use `AUTOFIX_GLOBAL_ENABLED=false`. See [Autofix](#autofix-self-healing-via-phoenix).
-- `AUTOFIX_HEALING_API_KEY` — Sent as `x-api-key` on every call to Phoenix. Required for a cloud/production Phoenix that enforces a static key; omit it for a keyless dev/test Phoenix. **Self-hosted installs need no key**: with no key set, Manifest announces its anonymous install id instead (see [Autofix](#autofix-self-healing-via-phoenix)).
-- `AUTOFIX_GLOBAL_ENABLED` — Set `false` to disable Autofix for all agents (default on). Companions: `AUTOFIX_TIMEOUT_MS` (per heal call, default `10000`), `AUTOFIX_REPAIRABLE_STATUSES` (default `400,404,422`).
-- `AUTOFIX_REPORT_ALL_4XX` — Set `true` to stream an agent's request-side 4xx (4xx except 401/402/403/429) to Phoenix's `POST /api/heal/observe` as evidence, carrying the full request body. Serves no fix and creates no heal attempt; it only lets Phoenix see the body that failed. Wider than the heal path in scope (not limited to `AUTOFIX_REPAIRABLE_STATUSES`) but **gated to agents with Autofix on** — `AutofixService.isActiveFor()`, the same per-agent flag that healing checks. Turning Autofix on is what consents to sending failing requests to the healing service; the check fails closed. Off by default: a second, deployment-level switch on top. Manifest persists nothing; the body is secret-scrubbed, capped at 256 KB, batched, and dropped under backpressure. Skipped when Autofix already reported the same failure via `/api/heal`. See `routing/autofix/observation-reporter.ts`.
 - `REQUEST_RECORDING_STORAGE` / `REQUEST_RECORDING_FILESYSTEM_PATH` / `REQUEST_RECORDING_S3_*` / `REQUEST_RECORDING_RETENTION_DAYS` — Provider Attempt body recording storage + retention. See [Request Recording](#request-recording-provider-attempt-bodies).
 - Thinker has no billing, plans or request quotas (#14): the `STRIPE_*`, `PLAN_LIMIT_*` and `PLAN_REQUEST_QUOTA_RESET_AT` variables are gone and ignored if set. The proxy no longer checks a plan limit per request and never answers 402 on its own; `DropBillingSchema1803200000000` drops the leftover billing tables and columns.
 - Thinker has no waitlist, CRM metrics feed, GitHub stars, free-models catalog, public error pages or managed Gemini Free (#15): `MANIFEST_PUBLIC_STATS`, `ERROR_PAGE_PUSH_SECRET`, `CRM_METRICS_SECRET` and `CREDITS_*` are gone and ignored if set, and so are their outbound calls (`credits.manifest.build`, `api.github.com`, the `mnfst/awesome-free-llm-apis` list on `raw.githubusercontent.com`). `DropSaasFeatureSchema1803300000000` drops `waitlist_claims`, `public_error_pages` and the cloud-only `IDX_requests_autofix_healed` index (with `lock_timeout` set), and deletes every `gemini-free` connection in `tenant_providers` together with its agent grants: the key only worked against `credits.manifest.build`. Request history keeps its `gemini-free` label, and routes that still name the provider resolve as unavailable and fall through to their fallbacks, as after a disconnect.
+- Thinker has no Autofix (#16): `AUTOFIX_GLOBAL_ENABLED`, `AUTOFIX_URL`, `AUTOFIX_TIMEOUT_MS`, `AUTOFIX_HEALING_API_KEY`, `AUTOFIX_HEALING_URL`, `AUTOFIX_REPORT_ALL_4XX`, `AUTOFIX_REPAIRABLE_STATUSES`, `AUTOFIX_ROLLOUT` and `HEALING_CLIENT` are gone and ignored if set, and so is every call to `autofix.manifest.build` (the boot-time health probe included). See [Autofix removed](#autofix-removed).
 
 ## Domain Terminology
 
@@ -553,7 +548,7 @@ Every failure Manifest itself produces — as opposed to one a provider returned
 
 ### Fallback exhaustion is a provider error, not a Manifest code
 
-When the primary and every fallback fail, the response **says what the provider said**: the message leads with the primary provider's own sentence followed by a one-line summary of every attempt, `source` is always `provider`, and `code` holds only the provider's own code. Exhaustion is a routing outcome, carried by `fallback_exhausted: true` in the body and the `X-Manifest-Fallback-Exhausted` header — it is **not** an error class and gets no `M###` code. Each `attempted_fallbacks[]` entry carries its sanitized `message`, `code`, and `auth_type`, plus a request-scoped `autofix` summary (`{ applied, original_status, retry_status }`) on the primary and on any hop where Phoenix was consulted. The provider-error parsers also understand FastAPI-style `{detail}` bodies (how ChatGPT Codex rejects an unsupported model) and bare `{"error": "…"}` strings, so those no longer collapse to a generic "Bad request to upstream provider".
+When the primary and every fallback fail, the response **says what the provider said**: the message leads with the primary provider's own sentence followed by a one-line summary of every attempt, `source` is always `provider`, and `code` holds only the provider's own code. Exhaustion is a routing outcome, carried by `fallback_exhausted: true` in the body and the `X-Manifest-Fallback-Exhausted` header — it is **not** an error class and gets no `M###` code. Each `attempted_fallbacks[]` entry carries its sanitized `message`, `code`, and `auth_type`. The provider-error parsers also understand FastAPI-style `{detail}` bodies (how ChatGPT Codex rejects an unsupported model) and bare `{"error": "…"}` strings, so those no longer collapse to a generic "Bad request to upstream provider".
 
 ## Request Recording (Provider Attempt bodies)
 
@@ -563,7 +558,7 @@ Opt-in, **per-harness** recording of Provider Attempt request/response bodies, b
 - **Storage selection** (`REQUEST_RECORDING_STORAGE=auto|s3|filesystem|disabled`, default `auto`): complete S3 credentials win; otherwise self-hosted falls back to the filesystem path (`REQUEST_RECORDING_FILESYSTEM_PATH`, default `/data/request-recordings`). Managed Cloud never silently falls back to ephemeral local disk. S3 config: `REQUEST_RECORDING_S3_BUCKET/ENDPOINT/REGION/ACCESS_KEY_ID/SECRET_ACCESS_KEY/FORCE_PATH_STYLE`.
 - **Encryption at rest**: recordings are encrypted under the **current** `MANIFEST_ENCRYPTION_KEY` only. The `MANIFEST_ENCRYPTION_KEY_PREVIOUS` re-encryption pass does **not** rewrite recordings — after a key change, older recordings are unreadable until retention removes them. Pre-encryption gzip-only recordings stay readable.
 - **Retention** (`REQUEST_RECORDING_RETENTION_DAYS`): one instance-wide value, default 365d (no per-plan retention). Cleanup cron in `database/request-recording-retention.service.ts`.
-- **Privacy**: inline base64 images are stripped from recordings (and from Phoenix observation payloads).
+- **Privacy**: inline base64 images are stripped from recordings.
 - **Code**: `common/services/request-recording-storage.service.ts` (storage backends), `common/utils/request-recording-codec.ts` (gzip + encryption codec), `routing/proxy/attempt-recording.service.ts` + `attempt-recording-capture.ts` (capture in the proxy path).
 - **Deploy templates** provision durable recording storage (see README deploy table). Volume-backed templates are single-instance; use S3-compatible storage before scaling horizontally.
 
@@ -721,54 +716,16 @@ Dev seeding (`packages/backend/src/database/seed-cohorts.ts`, `seedRoutingCohort
 
 Still to come (not in this phase): a migration assistant (task-specific → header rules, complexity → collapse to default) and a committed end date.
 
-## Autofix (self-healing via Phoenix)
+## Autofix removed
 
-**Autofix** repairs a failing request before the next hop of the fallback chain runs. When an agent request fails with a **repairable request-side 4xx** (default allow-list `400,404,422` — never 401/403/429/5xx), Manifest hands the failed request + normalized provider error to an external healing service (**Phoenix**), gets back a patched request, and resends it **once** on the same transport. It runs **before** `shouldTriggerFallback` on the primary **and on every failed fallback hop** (`proxy-fallback.service.ts` `maybeHealFallback()`): a fallback model that rejects a request-side param can carry its own Phoenix patch, and retrying it in place recovers the request instead of recording a dead hop and burning the rest of the chain. The fallback chain remains the safety net when healing doesn't clear the error. It is available to every tenant and toggled **per agent** (`agents.autofix_enabled`); consent is enforced inside `maybeHeal()` for primary and fallback alike.
+Thinker has no Autofix (#16; the dashboard side went in #13). Upstream's Autofix handed a failed request to Manifest's hosted healer (Phoenix, `autofix.manifest.build`) and resent the patched body once before the fallback chain ran; it also pinged the healer at every production boot. All of that is gone:
 
-**Per-agent default is deployment-mode-dependent.** `agents.autofix_enabled` is **nullable**: `NULL` means "no explicit choice — inherit the mode default", which is **ON in cloud, OFF in self-hosted** (resolved by `AutofixService.resolveEnabled()` via `isSelfHosted()`, computed once at boot). An explicit `true`/`false` (the user flipping the Settings toggle) always wins. The `GET/PATCH …/autofix` endpoints return the _resolved_ effective value, so the UI shows the right default state without persisting one. Migration `1799000300000` drops the old blanket `false` default and resets pre-feature `false` rows to `NULL` so they inherit the mode default.
+- **Proxy:** a failed primary goes straight to `shouldTriggerFallback` and the fallback chain, exactly as for an agent that never opted in. `ForwardResult` no longer exposes the wire body or a retry hook (only `wireFormat` remains, for the response handler), there is no heal-once branch, no observation reporter, and the `x-manifest-provider` / `x-manifest-auth-type` headers no longer rewrite the routing model. The primary is always attempt 1.
+- **API:** `GET/PATCH /api/v1/routing/:agentName/autofix`, `GET /api/v1/autofix/status`, `POST /api/v1/autofix/enable-all` and the `/api/v1/overview/autofix-*` analytics answer 404. The generic reliability metrics moved to `/api/v1/overview/reliability/{stats,timeseries,per-agent,per-provider,per-model}` without the Autofix fields (`autofix_saves`, `coverage`, `dispositions`, `needs_attention`, per-agent `autofixed`, the `autofix` timeseries dimension, the `healed` disposition). The Requests log `trigger` filter accepts `none` and `fallback` only. `autofix_enabled` is rejected on agent create. The MCP `manifest_routing_autofix_*` tools and the CLI `routing autofix` command and `--autofix` flag are gone.
+- **Schema:** `DropAutofixSchema1803400000000` drops `agents.autofix_enabled`, the `agent_messages.autofix_*` columns (`autofix_phoenix` included), `requests.autofix_status` with its check constraint, `install_metadata.autofix_consented_at`, and the `IDX_agent_messages_autofix_group`, `IDX_agent_messages_autofix_request` and `IDX_requests_autofix_healed` indexes, with `lock_timeout` set and `IF EXISTS` throughout. `down()` restores them, empty. `AddRequestsAutofixHealedIndex1802200000000` now runs its self-hosted path (no-op) everywhere.
+- **Shared:** `deriveAutofixStatus`, `AUTOFIX_STATUSES` and the `auto_fixed` status are gone.
 
-**Scope:** non-streaming responses + streaming that fails before the first byte (a repairable 4xx makes `providerResponse.ok=false` before any client bytes are sent). **One attempt per hop — there is no retry budget.** If the single patched retry still fails, Manifest reports the outcome to Phoenix and hands off to the next fallback.
-
-**Explicit models use provider passthrough.** A concrete model that is missing from Manifest's discovered catalog still routes when its provider can be identified and the matching credential is enabled on the harness. The provider—not the cached catalog—is authoritative on whether the model exists. A real provider `model_not_found` response follows the standard `maybeHeal` path, so Phoenix receives the actual provider/auth/protocol/error and any renamed model is re-resolved through the same passthrough logic. M302 remains for requests with no unambiguous connected provider route (for example, an unknown bare ID or a bare ID spanning multiple auth connections); those requests never contacted a provider and are not synthesized into Autofix failures.
-
-**Code:** `packages/backend/src/routing/autofix/`
-
-- `autofix.service.ts` — `maybeHeal()` gates on (globally enabled + repairable status + circuit breaker closed + agent opted in), then `runHealOnce()` does one heal + one reforward. Any throw degrades to the original provider error (never a Manifest 500). The per-agent consent flag is read from the database on every repairable failure so enable and disable changes take effect across all replicas immediately. **Circuit breaker:** after 3 consecutive heal-call transport failures the breaker opens for 30s and `maybeHeal()` skips healing (returns null → straight to fallback), so a slow/down Phoenix stops adding latency to every repairable 4xx; any successful round-trip clears the streak.
-- `healing-client.ts` — the `HealingClient` port + `HEALING_CLIENT` DI token. Chosen at boot in `autofix.module.ts` from `NODE_ENV` alone: `HttpHealingClient` against the `AUTOFIX_URL` constant in production, the in-process **`MockHealingClient` in dev/test**. There is no URL to configure, so there is no "healer not wired" state to fall back from — which is why the old inert `NoopHealingClient` is gone. The mock's hardcoded catalog stays off real traffic because it is unreachable in production.
-- `phoenix.types.ts` — the wire contract. `provider-error-normalizer.ts` — turns a raw 4xx body into `{message,type,param,code}`. `autofix.types.ts` — internal `AutofixRecord` / `AutofixChainEntry`.
-- `autofix-health-probe.ts` — on boot (`OnApplicationBootstrap`), in production only, pings Phoenix `GET /api/health` once (fire-and-forget, never blocks/fails boot) and warns if unreachable — so blocked egress or a down Phoenix surfaces at deploy, not on the first repairable 4xx.
-- **Contract guardrail (anti-drift):** `phoenix.types.ts` is kept in lockstep with Phoenix's OpenAPI, vendored at `contract/phoenix-openapi.yaml`. `__tests__/phoenix-contract.spec.ts` (ajv) fails CI if the status enums or required fields drift — the status unions live as `as const` arrays (`HEAL_STATUSES`/`ISSUE_STATUSES`/`OUTCOME_STATUSES`) so they're compared to the spec at runtime. Refresh with `npm run contract:refresh --workspace=packages/backend` (uses `gh`; needs read access to the private `mnfst/phoenix`). `.github/workflows/phoenix-contract-drift.yml` flags weekly when the vendored copy falls behind Phoenix `main` (needs a `PHOENIX_CONTRACT_TOKEN` secret).
-- **Hooks:** `proxy.service.ts`, after the primary forward and _before_ `shouldTriggerFallback`; and `proxy-fallback.service.ts` (`maybeHealFallback()`), after each failed fallback forward, when the hop carries a wire body and a `retryWireBody` hook. `ProxyResult.autofix` threads the primary record to the recorder; a healed fallback hop records the original failure as its own terminal provider attempt plus the patched retry.
-
-**Self-hosted identity is an identifier, not a credential.** A self-hosted install with no `AUTOFIX_HEALING_API_KEY` announces `X-Manifest-Instance: <install_id>` on every Phoenix call, alongside `X-Manifest-Version` and `X-Manifest-Harness`. That id is the **same anonymous `install_metadata.install_id` the telemetry sender uses** — one identity per install, so Phoenix heal history and Peacock telemetry can be correlated on it. It is deliberately not secret and there is **no registration handshake**: Phoenix creates the instance row the first time it sees an id. A handshake would only have carried `version`, which already rides on every request.
-
-The id is minted lazily by `InstallIdService.getOrCreate()` (exported from `TelemetryModule`), so an install that never enables Autofix and never reports telemetry never creates one. Creating the row does **not** start telemetry: `TelemetryService` gates every send on `MANIFEST_TELEMETRY_DISABLED` independently, so the opt-out still holds. Consequence to keep in mind: because there is no secret, `PATCH /api/heal-attempts/{healAttemptId}` is spoofable by anyone who learns an install id, and those outcomes feed Phoenix's patch adjudication — that path wants server-side sanity checks rather than trusting the reported outcome.
-
-**Phoenix = [`mnfst/phoenix`](https://github.com/mnfst/phoenix)** (separate repo). Contract (v2):
-
-- `POST /api/heal` — body `{traceId, provider, api, url?, request, response:{statusCode, error:{message,type?,param?,code?}}}`. **`traceId` is required** (Phoenix rejects a body without it) and **the provider error is nested under `response`** (a flat `providerError` is rejected), and `api` is the proxy `apiMode` verbatim (`chat_completions` | `responses` | `messages`). The response is discriminated on `status`: `patched` / `unverified` (both carry `healedBody` + `healAttemptId` → apply the patch and resend; `patched` = verified issue, `unverified` = fresh patch) | `resolving` (Phoenix is still authoring a fix — nothing to resend) | `no_patch`. Also returns `issueId`, `patchId?`, `operations?`.
-- `PATCH /api/heal-attempts/{healAttemptId}` — report the retry outcome `{retryStatusCode, error?}` (`error` required when ≥400). Fire-and-forget; Phoenix decides succeeded/failed. Only possible when a patch handed out a `healAttemptId` — `no_patch`/`resolving` carry none, so those outcomes are **not** reported.
-- `traceId` is stable across the logical request (Manifest reuses the internal `groupId`).
-
-**Recording separates the request verdict from attempt audit.** `requests.autofix_status` is the one outcome for the logical request; only `retry_succeeded` means the request was recovered by Autofix. Actual provider calls remain `agent_messages` rows with their own `status`. When Manifest sends a patched retry, the related attempt rows use `autofix_applied`, `autofix_group_id`, `autofix_role`, and `autofix_operations`; Phoenix's decision metadata is exposed by the entity as `autofix_decision` (`{status,issueId,patchId,healAttemptId,explanation}`) and mapped to the retained physical column `autofix_phoenix`. A Phoenix consultation that produces no patched retry must not create a fake provider attempt.
-
-**Frontend:** none. The dashboard's Autofix UI (Settings toggle, create-time switch, KPI card, badges, filters, Phoenix panels and the notification bell) was removed in #13.
-
-**Until #16 removes the backend side, the dashboard opts every new harness out.** A harness stored with `autofix_enabled = NULL` inherits `!isSelfHosted()`, which is **ON** whenever the backend detects no container (`/.dockerenv`, `/run/.containerenv`, `KUBERNETES_SERVICE_HOST`) and no `MANIFEST_MODE=selfhosted` — a bare-metal `npm start` or a dev run. Such a harness would send its repairable 4xx failures to the hosted healer. So `createAgent` in `packages/frontend/src/services/api/agents.ts` always sends `autofix_enabled: false`, and `duplicateAgent` follows the copy with `PATCH /api/v1/routing/:agent/autofix {enabled:false}` (the duplicate endpoint has no field for it).
-
-**Operator workaround for harnesses created before that** (or through the API/MCP/CLI without the flag): set `AUTOFIX_GLOBAL_ENABLED=false` (the global kill switch, checked before any per-agent flag), or run with `MANIFEST_MODE=selfhosted` so NULL resolves to off. The Docker image is already detected as self-hosted.
-
-**Self-hosted consent is once, and rides on the per-agent enable.** On self-hosted, consent is remembered via `install_metadata.autofix_consented_at` — a single nullable column on the existing telemetry singleton. Consent is recorded by **any** enable path: the per-agent `PATCH …/autofix` with `enabled: true` (a disable never mints it), the enable-all endpoint, and the Autofix switch on first agent creation. The singleton row is upserted, minting an `install_id` if telemetry never did — so consent alone never starts telemetry.
-
-**The dashboard has no Autofix enablement or disablement path** (#13); use `AUTOFIX_GLOBAL_ENABLED=false` above.
-
-`POST /api/v1/autofix/enable-all` remains as an API-level fleet backfill (no dashboard caller): it runs `UPDATE agents SET autofix_enabled = true` for every live, non-playground agent in the tenant (**including any previously turned off**), invalidates the per-tenant config cache, records consent, and returns the refreshed workspace status. Soft-deleted agents are left alone so resurrecting one doesn't silently arrive with Autofix on.
-
-`GET /api/v1/autofix/status` → `{ any_enabled, enabled_agents, disabled_agents, needs_enable_all, consented }`. `needs_enable_all` is kept for API compatibility but no UI consumes it; with the sidebar card gone, no dashboard surface consumes `disabled_agents` either. The per-agent PATCH busts the cached status (`${tenantId}:/api/v1/autofix/status`) on both enable and disable. Cloud never consults or writes the consent — `consented` is always true there.
-
-**Endpoints:** `GET/PATCH /api/v1/routing/:agentName/autofix` → `{ enabled, consented }`; `GET /api/v1/autofix/status`; `POST /api/v1/autofix/enable-all`.
-
-**Env:** `AUTOFIX_HEALING_API_KEY` (sent as `x-api-key`; cloud only — self-hosted sends its install id instead), `AUTOFIX_GLOBAL_ENABLED` (`false` disables Autofix everywhere, and is the hard opt-out; default on), `AUTOFIX_TIMEOUT_MS` (per heal call, default `10000`), `AUTOFIX_REPAIRABLE_STATUSES` (default `400,404,422`). The healer URL is the `AUTOFIX_URL` constant, not an env var.
+The local self-heal planned for v0.6 will extend the fallback chain on its own terms; the upstream design is kept in `docs/referencia/autofix-self-healing-poc.md` as input.
 
 ## Providers & Models
 
diff --git a/docs/autofix-self-healing-poc.md b/docs/referencia/autofix-self-healing-poc.md
similarity index 97%
rename from docs/autofix-self-healing-poc.md
rename to docs/referencia/autofix-self-healing-poc.md
index 3cf9bbea..61a32510 100644
--- a/docs/autofix-self-healing-poc.md
+++ b/docs/referencia/autofix-self-healing-poc.md
@@ -1,5 +1,12 @@
 # Autofix (self-healing requests) — POC specification
 
+> **Nota do Thinker:** documento de referência, insumo para o self-heal local
+> (v0.6). O Autofix do upstream dependia do serviço hospedado Phoenix da
+> Manifest e foi removido do Thinker: a UI em #13 e o backend em #16. Nenhum
+> arquivo, endpoint, coluna ou variável citado abaixo existe mais no código;
+> o texto fica como registro do desenho original. Veja
+> `docs/decisoes-iniciais.md` (§3 e §7).
+
 **Status:** Backend + frontend implemented, green, verified live · **Last updated:** 2026-07-01
 
 > **⚠️ This spec describes the original aspirational design and has diverged from
@@ -56,8 +63,8 @@ from a waitlist shell; today the engine and settings surface are generally avail
 
 | Surface     | File                                                     | What it is                                       |
 | ----------- | -------------------------------------------------------- | ------------------------------------------------ |
-| Settings    | `packages/frontend/src/pages/SettingsAutofixSection.tsx` | Per-agent Autofix toggle, shown to every tenant |
-| Routing API | `packages/backend/src/routing/tier.controller.ts`        | `GET/PATCH /api/v1/routing/:agentName/autofix`   |
+| Settings    | `SettingsAutofixSection.tsx` (removed from Thinker in #13) | Per-agent Autofix toggle, shown to every tenant |
+| Routing API | `tier.controller.ts` (endpoints removed from Thinker in #16) | `GET/PATCH /api/v1/routing/:agentName/autofix`   |
 
 The marketing copy is the product promise we're now building the engine for:
 
diff --git a/package-lock.json b/package-lock.json
index cc7d8f08..eb2addcc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5861,13 +5861,6 @@
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/@types/js-yaml": {
-      "version": "4.0.9",
-      "resolved": "https://registry.npmjs.org/@types/js-yaml/-/js-yaml-4.0.9.tgz",
-      "integrity": "sha512-k4MGaQl5TGo/iipqb2UDG2UwjXziSWkh0uysQelTlJpX1qGlpUZYm8PnO4DxG1qBomtJUdYJ6qR6xdIah10JLg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/json-schema": {
       "version": "7.0.15",
       "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
@@ -15141,27 +15134,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/stripe": {
-      "version": "18.5.0",
-      "resolved": "https://registry.npmjs.org/stripe/-/stripe-18.5.0.tgz",
-      "integrity": "sha512-Hp+wFiEQtCB0LlNgcFh5uVyKznpDjzyUZ+CNVEf+I3fhlYvh7rZruIg+jOwzJRCpy0ZTPMjlzm7J2/M2N6d+DA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "qs": "^6.11.0"
-      },
-      "engines": {
-        "node": ">=12.*"
-      },
-      "peerDependencies": {
-        "@types/node": ">=12.x.x"
-      },
-      "peerDependenciesMeta": {
-        "@types/node": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/strtok3": {
       "version": "10.3.5",
       "resolved": "https://registry.npmjs.org/strtok3/-/strtok3-10.3.5.tgz",
@@ -17074,17 +17046,13 @@
         "@types/compression": "^1.8.1",
         "@types/express": "^5.0.6",
         "@types/jest": "^30.0.0",
-        "@types/js-yaml": "^4.0.9",
         "@types/node": "^22.20.1",
         "@types/pg": "^8.23.1",
         "@types/react": "^19.2.18",
         "@types/react-dom": "^19.2.7",
         "@types/supertest": "^6.0.0",
         "@types/uuid": "^10.0.0",
-        "ajv": "8.20.0",
-        "ajv-formats": "^3.0.1",
         "jest": "^30.5.1",
-        "js-yaml": "^4.3.2",
         "supertest": "^7.0.0",
         "ts-jest": "^29.4.12",
         "ts-node": "^10.9.2",
@@ -19130,7 +19098,7 @@
       }
     },
     "packages/manifest": {
-      "version": "6.25.4"
+      "version": "6.28.6"
     },
     "packages/shared": {
       "name": "manifest-shared",
diff --git a/packages/backend/.env.example b/packages/backend/.env.example
index 8071b2c8..3f5d9aab 100644
--- a/packages/backend/.env.example
+++ b/packages/backend/.env.example
@@ -135,9 +135,3 @@ BETTER_AUTH_URL=http://localhost:3001
 # ── Internal ────────────────────────────────────────
 # MANIFEST_FRONTEND_DIR=      # Custom path to frontend dist directory
 # MANIFEST_EMBEDDED=          # Set to skip auto-start (used by embedded server)
-
-# ── Release announcement email (Auto-fix / Doctor version) ──
-# The sending tool lives OUTSIDE this repo (sebconejo/autofix-email-to-subscribers);
-# only the React Email template stays here. These two knobs feed the template.
-# ANNOUNCE_APP_URL=https://app.manifest.build
-# DOCTOR_TUTORIAL_URL=                # the blog article; omitted from the email while empty
diff --git a/packages/backend/package.json b/packages/backend/package.json
index 38985a87..b1a0bbaf 100644
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -11,7 +11,6 @@
     "test:watch": "jest --watch",
     "test:e2e": "jest --config ./test/jest-e2e.json --runInBand",
     "lint": "eslint src/",
-    "contract:refresh": "node scripts/refresh-phoenix-contract.mjs",
     "migration:generate": "typeorm-ts-node-commonjs migration:generate -d src/database/datasource.ts",
     "migration:run": "ts-node -T src/database/migrate.ts",
     "migration:run:prod": "node dist/database/migrate.js",
@@ -68,17 +67,13 @@
     "@types/compression": "^1.8.1",
     "@types/express": "^5.0.6",
     "@types/jest": "^30.0.0",
-    "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.20.1",
     "@types/pg": "^8.23.1",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.7",
     "@types/supertest": "^6.0.0",
     "@types/uuid": "^10.0.0",
-    "ajv": "8.20.0",
-    "ajv-formats": "^3.0.1",
     "jest": "^30.5.1",
-    "js-yaml": "^4.3.2",
     "supertest": "^7.0.0",
     "ts-jest": "^29.4.12",
     "ts-node": "^10.9.2",
diff --git a/packages/backend/scripts/refresh-phoenix-contract.mjs b/packages/backend/scripts/refresh-phoenix-contract.mjs
deleted file mode 100644
index 2a2ba3fd..00000000
--- a/packages/backend/scripts/refresh-phoenix-contract.mjs
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-/**
- * Refresh the vendored Phoenix OpenAPI contract from its source of truth.
- *
- * Phoenix (`mnfst/phoenix`) is a private repo, so the spec is fetched through the
- * authenticated GitHub CLI rather than a raw URL. Run after Phoenix changes its
- * `/api/heal*` contract, then review the diff and reconcile `phoenix.types.ts`.
- *
- *   npm run contract:refresh --workspace=packages/backend
- *
- * Requires `gh auth login` with read access to mnfst/phoenix. The scheduled
- * `.github/workflows/phoenix-contract-drift.yml` runs this and fails on any diff.
- */
-import { execFileSync } from 'node:child_process';
-import { writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const REPO = 'mnfst/phoenix';
-const REF = process.env.PHOENIX_CONTRACT_REF ?? 'main';
-const SPEC = 'phoenix-openapi.yaml';
-
-const here = dirname(fileURLToPath(import.meta.url));
-const dest = join(here, '..', 'src', 'routing', 'autofix', 'contract', 'phoenix-openapi.yaml');
-
-const base64 = execFileSync(
-  'gh',
-  ['api', `repos/${REPO}/contents/${SPEC}?ref=${REF}`, '--jq', '.content'],
-  { encoding: 'utf8' },
-);
-writeFileSync(dest, Buffer.from(base64, 'base64'));
-console.log(`Refreshed ${dest}\n  from ${REPO}@${REF}:${SPEC}`);
diff --git a/packages/backend/src/analytics/analytics.module.ts b/packages/backend/src/analytics/analytics.module.ts
index 21a0d99c..dd0a90b4 100644
--- a/packages/backend/src/analytics/analytics.module.ts
+++ b/packages/backend/src/analytics/analytics.module.ts
@@ -3,7 +3,6 @@ import { TypeOrmModule } from '@nestjs/typeorm';
 import { AgentMessage } from '../entities/agent-message.entity';
 import { ManifestRequest } from '../entities/request.entity';
 import { Agent } from '../entities/agent.entity';
-import { InstallMetadata } from '../entities/install-metadata.entity';
 import { Tenant } from '../entities/tenant.entity';
 import { CustomProvider } from '../entities/custom-provider.entity';
 import { TenantProvider } from '../entities/tenant-provider.entity';
@@ -37,10 +36,9 @@ import { ProviderAnalyticsController } from './controllers/provider-analytics.co
 import { ErrorsController } from './controllers/errors.controller';
 import { AttemptAnalyticsController } from './controllers/attempt-analytics.controller';
 import { AttemptStatsService } from './services/attempt-stats.service';
-import { AutofixAnalyticsController } from './controllers/autofix-analytics.controller';
-import { AutofixStatsService } from './services/autofix-stats.service';
+import { ReliabilityAnalyticsController } from './controllers/reliability-analytics.controller';
+import { ReliabilityStatsService } from './services/reliability-stats.service';
 import { RequestVolumeService } from './services/request-volume.service';
-import { AutofixModule } from '../routing/autofix/autofix.module';
 import { AgentUsageDailyService } from './services/agent-usage-daily.service';
 
 @Module({
@@ -49,7 +47,6 @@ import { AgentUsageDailyService } from './services/agent-usage-daily.service';
       AgentMessage,
       ManifestRequest,
       Agent,
-      InstallMetadata,
       Tenant,
       CustomProvider,
       TenantProvider,
@@ -62,7 +59,6 @@ import { AgentUsageDailyService } from './services/agent-usage-daily.service';
     OtlpModule,
     RoutingCoreModule,
     ModelPricesModule,
-    AutofixModule,
   ],
   controllers: [
     OverviewController,
@@ -75,7 +71,7 @@ import { AgentUsageDailyService } from './services/agent-usage-daily.service';
     ProviderUsageController,
     ErrorsController,
     AttemptAnalyticsController,
-    AutofixAnalyticsController,
+    ReliabilityAnalyticsController,
   ],
   providers: [
     AggregationService,
@@ -90,7 +86,7 @@ import { AgentUsageDailyService } from './services/agent-usage-daily.service';
     AgentAnalyticsService,
     ProviderUsageService,
     AttemptStatsService,
-    AutofixStatsService,
+    ReliabilityStatsService,
     RequestVolumeService,
     AgentUsageDailyService,
   ],
@@ -100,7 +96,6 @@ import { AgentUsageDailyService } from './services/agent-usage-daily.service';
     AgentLifecycleService,
     TimeseriesQueriesService,
     MessagesQueryService,
-    AutofixStatsService,
   ],
 })
 export class AnalyticsModule {}
diff --git a/packages/backend/src/analytics/controllers/agents.controller.spec.ts b/packages/backend/src/analytics/controllers/agents.controller.spec.ts
index 2a0a3597..4191b074 100644
--- a/packages/backend/src/analytics/controllers/agents.controller.spec.ts
+++ b/packages/backend/src/analytics/controllers/agents.controller.spec.ts
@@ -13,7 +13,6 @@ import { TenantCacheService } from '../../common/services/tenant-cache.service';
 import { AgentListCacheService } from '../../common/services/agent-list-cache.service';
 import { IngestEventBusService } from '../../common/services/ingest-event-bus.service';
 import { ProviderService } from '../../routing/routing-core/provider.service';
-import { AutofixStatsService } from '../services/autofix-stats.service';
 
 // Shared no-op ProviderService stub. createAgent now auto-enables every usable
 // provider on the new agent (symmetric global-providers auto-connect), so every
@@ -23,17 +22,11 @@ const providerServiceProvider = () => ({
   useValue: { enableAllProvidersForAgent: jest.fn().mockResolvedValue(undefined) },
 });
 
-const autofixStatsProvider = (recordAutofixConsent = jest.fn().mockResolvedValue(undefined)) => ({
-  provide: AutofixStatsService,
-  useValue: { recordAutofixConsent },
-});
-
 describe('AgentsController', () => {
   let controller: AgentsController;
   let cacheManager: Cache;
   let mockGetAgentList: jest.Mock;
   let mockOnboardAgent: jest.Mock;
-  let mockRecordAutofixConsent: jest.Mock;
   let mockGetKeyForAgent: jest.Mock;
   let mockRotateKey: jest.Mock;
   let mockConfigGet: jest.Mock;
@@ -54,7 +47,6 @@ describe('AgentsController', () => {
       agentId: 'new-agent-id',
       apiKey: 'mnfst_new_agent_key',
     });
-    mockRecordAutofixConsent = jest.fn().mockResolvedValue(undefined);
     mockGetKeyForAgent = jest.fn().mockResolvedValue({ keyPrefix: 'mnfst_test1234' });
     mockRotateKey = jest.fn().mockResolvedValue({ apiKey: 'mnfst_new_key_123' });
     mockConfigGet = jest.fn().mockReturnValue('');
@@ -141,7 +133,6 @@ describe('AgentsController', () => {
         },
         providerServiceProvider(),
         AgentListCacheService,
-        autofixStatsProvider(mockRecordAutofixConsent),
       ],
     }).compile();
 
@@ -277,36 +268,6 @@ describe('AgentsController', () => {
     ).rejects.toThrow(/reserved/i);
   });
 
-  it('records install consent before creating an explicitly enabled agent', async () => {
-    await controller.createAgent(
-      ctx as never,
-      {
-        name: 'Enabled Agent',
-        autofix_enabled: true,
-      } as never,
-    );
-
-    expect(mockRecordAutofixConsent).toHaveBeenCalledTimes(1);
-    expect(mockOnboardAgent).toHaveBeenCalledWith(
-      expect.objectContaining({ autofixEnabled: true }),
-    );
-    expect(mockRecordAutofixConsent.mock.invocationCallOrder[0]).toBeLessThan(
-      mockOnboardAgent.mock.invocationCallOrder[0],
-    );
-  });
-
-  it('does not record install consent for an explicitly disabled agent', async () => {
-    await controller.createAgent(
-      ctx as never,
-      {
-        name: 'Disabled Agent',
-        autofix_enabled: false,
-      } as never,
-    );
-
-    expect(mockRecordAutofixConsent).not.toHaveBeenCalled();
-  });
-
   it('deletes agent and returns success', async () => {
     const result = await controller.deleteAgent(ctx as never, 'bot-1');
 
@@ -351,7 +312,6 @@ describe('AgentsController', () => {
         },
         providerServiceProvider(),
         AgentListCacheService,
-        autofixStatsProvider(),
       ],
     }).compile();
 
@@ -365,7 +325,6 @@ describe('AgentsController', () => {
         name: 'My Agent',
         agent_category: 'personal',
         agent_platform: 'openclaw',
-        autofix_enabled: false,
         record_messages: true,
       } as never,
     );
@@ -374,7 +333,6 @@ describe('AgentsController', () => {
       expect.objectContaining({
         agentCategory: 'personal',
         agentPlatform: 'openclaw',
-        autofixEnabled: false,
         recordMessages: true,
       }),
     );
@@ -415,7 +373,6 @@ describe('AgentsController', () => {
         },
         providerServiceProvider(),
         AgentListCacheService,
-        autofixStatsProvider(),
       ],
     }).compile();
 
@@ -474,7 +431,6 @@ describe('AgentsController', () => {
         },
         providerServiceProvider(),
         AgentListCacheService,
-        autofixStatsProvider(),
       ],
     }).compile();
 
@@ -490,7 +446,6 @@ describe('AgentsController', () => {
     // cache is keyed by the tenant the onboard returned (t1), not the user id.
     expect(delSpy).toHaveBeenCalledWith('t1:/api/v1/agents:playground=false:g0');
     expect(delSpy).toHaveBeenCalledWith('t1:/api/v1/agents:playground=true:g0');
-    expect(delSpy).toHaveBeenCalledWith('t1:/api/v1/autofix/status');
   });
 
   it('rolls back the agent and clears the list cache when provider enable fails', async () => {
@@ -531,7 +486,6 @@ describe('AgentsController', () => {
           useValue: { enableAllProvidersForAgent: jest.fn().mockRejectedValue(enableErr) },
         },
         AgentListCacheService,
-        autofixStatsProvider(),
       ],
     }).compile();
 
@@ -551,10 +505,6 @@ describe('AgentsController', () => {
     // not linger in a cached list (both tenant-keyed entries).
     expect(delSpy).toHaveBeenCalledWith('t1:/api/v1/agents:playground=false:g0');
     expect(delSpy).toHaveBeenCalledWith('t1:/api/v1/agents:playground=true:g0');
-    // ...along with the Autofix status entry, which would otherwise keep
-    // reporting the rolled-back agent as enabled until the dashboard TTL, so
-    // the sidebar contradicts a workspace the agent no longer appears in.
-    expect(delSpy).toHaveBeenCalledWith('t1:/api/v1/autofix/status');
   });
 
   it('still re-throws the enable error when the compensating delete also fails', async () => {
@@ -595,7 +545,6 @@ describe('AgentsController', () => {
           },
         },
         AgentListCacheService,
-        autofixStatsProvider(),
       ],
     }).compile();
 
@@ -636,7 +585,6 @@ describe('AgentsController', () => {
         },
         providerServiceProvider(),
         AgentListCacheService,
-        autofixStatsProvider(),
       ],
     }).compile();
 
@@ -678,7 +626,6 @@ describe('AgentsController', () => {
         },
         providerServiceProvider(),
         AgentListCacheService,
-        autofixStatsProvider(),
       ],
     }).compile();
 
@@ -801,7 +748,6 @@ describe('AgentsController', () => {
         },
         providerServiceProvider(),
         AgentListCacheService,
-        autofixStatsProvider(),
       ],
     }).compile();
 
diff --git a/packages/backend/src/analytics/controllers/agents.controller.ts b/packages/backend/src/analytics/controllers/agents.controller.ts
index b80e1a55..bda2815c 100644
--- a/packages/backend/src/analytics/controllers/agents.controller.ts
+++ b/packages/backend/src/analytics/controllers/agents.controller.ts
@@ -5,7 +5,6 @@ import {
   Controller,
   Delete,
   Get,
-  Inject,
   Logger,
   NotFoundException,
   Param,
@@ -15,8 +14,7 @@ import {
   UseInterceptors,
 } from '@nestjs/common';
 import { QueryFailedError } from 'typeorm';
-import { CACHE_MANAGER, CacheTTL } from '@nestjs/cache-manager';
-import type { Cache } from 'cache-manager';
+import { CacheTTL } from '@nestjs/cache-manager';
 import { TimeseriesQueriesService } from '../services/timeseries-queries.service';
 import { AgentLifecycleService } from '../services/agent-lifecycle.service';
 import { AgentDuplicationService } from '../services/agent-duplication.service';
@@ -32,7 +30,6 @@ import { AgentListCacheService } from '../../common/services/agent-list-cache.se
 import { slugify } from '../../common/utils/slugify';
 import { PLAYGROUND_AGENT_SLUG } from '../../common/constants/playground.constants';
 import { ProviderService } from '../../routing/routing-core/provider.service';
-import { AutofixStatsService } from '../services/autofix-stats.service';
 
 @Controller('api/v1')
 export class AgentsController {
@@ -45,9 +42,7 @@ export class AgentsController {
     private readonly apiKeyGenerator: ApiKeyGeneratorService,
     private readonly eventBus: IngestEventBusService,
     private readonly providerService: ProviderService,
-    private readonly autofixStats: AutofixStatsService,
     private readonly agentListCache: AgentListCacheService,
-    @Inject(CACHE_MANAGER) private readonly cacheManager: Cache,
   ) {}
 
   private async invalidateAgentListCache(tenantId: string | null): Promise<void> {
@@ -59,11 +54,6 @@ export class AgentsController {
     await this.agentListCache.invalidate(tenantId);
   }
 
-  private async invalidateAutofixStatusCache(tenantId: string | null): Promise<void> {
-    if (!tenantId) return;
-    await this.cacheManager.del(`${tenantId}:/api/v1/autofix/status`);
-  }
-
   private emitAgentEvent(tenantId: string | null, userId: string | null): void {
     // The event bus is tenant-keyed; the user id rides along as attribution
     // only. No tenant → nobody can be subscribed to the change.
@@ -93,13 +83,6 @@ export class AgentsController {
     const displayName = body.name.trim();
     let result: Awaited<ReturnType<ApiKeyGeneratorService['onboardAgent']>>;
     try {
-      // The create dialog presents the hosted Autofix disclosure and legal
-      // links whenever this explicit opt-in is on. Persist that install-level
-      // consent before creating an enabled agent so failures stay fail-closed.
-      if (body.autofix_enabled === true) {
-        await this.autofixStats.recordAutofixConsent();
-        await this.invalidateAutofixStatusCache(ctx.tenantId);
-      }
       result = await this.apiKeyGenerator.onboardAgent({
         tenantId: ctx.tenantId,
         ownerUserId: ctx.userId,
@@ -107,7 +90,6 @@ export class AgentsController {
         displayName,
         agentCategory: body.agent_category,
         agentPlatform: body.agent_platform,
-        autofixEnabled: body.autofix_enabled,
         recordMessages: body.record_messages,
       });
     } catch (error) {
@@ -141,20 +123,11 @@ export class AgentsController {
       }
       // The agent was committed (briefly visible) then rolled back, so drop the
       // cache entries that captured it — deleteAgent only clears the resolve +
-      // routing caches. The Autofix status key matters as much as the agent
-      // list: without it, /autofix/status keeps reporting the rolled-back agent
-      // as enabled for the dashboard TTL, so the sidebar disagrees with the
-      // workspace about an agent that no longer exists.
-      await Promise.all([
-        this.invalidateAgentListCache(result.tenantId),
-        this.invalidateAutofixStatusCache(result.tenantId),
-      ]);
+      // routing caches.
+      await this.invalidateAgentListCache(result.tenantId);
       throw error;
     }
-    await Promise.all([
-      this.invalidateAgentListCache(result.tenantId),
-      this.invalidateAutofixStatusCache(result.tenantId),
-    ]);
+    await this.invalidateAgentListCache(result.tenantId);
     this.emitAgentEvent(result.tenantId, ctx.userId);
     return {
       agent: {
diff --git a/packages/backend/src/analytics/controllers/autofix-analytics.controller.spec.ts b/packages/backend/src/analytics/controllers/autofix-analytics.controller.spec.ts
deleted file mode 100644
index 7ed0a8a7..00000000
--- a/packages/backend/src/analytics/controllers/autofix-analytics.controller.spec.ts
+++ /dev/null
@@ -1,94 +0,0 @@
-import { AutofixAnalyticsController } from './autofix-analytics.controller';
-
-describe('AutofixAnalyticsController', () => {
-  const service = {
-    getWorkspaceStatus: jest.fn(),
-    enableAll: jest.fn(),
-    getStats: jest.fn(),
-    getTimeseries: jest.fn(),
-    getPerAgentStats: jest.fn(),
-    getPerProviderStats: jest.fn(),
-  };
-  const cache = { del: jest.fn().mockResolvedValue(undefined) };
-  const controller = new AutofixAnalyticsController(service as never, cache as never);
-  const ctx = { tenantId: 'tenant' } as never;
-
-  beforeEach(() => jest.clearAllMocks());
-
-  it('delegates every Autofix analytics route with tenant scope', async () => {
-    service.getWorkspaceStatus.mockResolvedValue({
-      any_enabled: true,
-      enabled_agents: ['demo'],
-      needs_enable_all: false,
-      consented: true,
-    });
-    service.getStats.mockResolvedValue({ autofix_saves: { value: 1 } });
-    service.getTimeseries.mockResolvedValue({ buckets: [] });
-    service.getPerAgentStats.mockResolvedValue([]);
-    service.getPerProviderStats.mockResolvedValue([]);
-
-    await controller.getStatus(ctx);
-    await controller.getStats({ range: '30d', agent_name: 'demo' }, ctx);
-    await controller.getTimeseries(
-      { range: '24h', agent_name: 'demo', by: 'autofix', failed_only: 'true' },
-      ctx,
-    );
-    await controller.getPerAgent({ range: '7d' }, ctx);
-    await controller.getPerProvider({ range: '90d', agent_name: 'demo' }, ctx);
-
-    expect(service.getWorkspaceStatus).toHaveBeenCalledWith('tenant');
-    expect(service.getStats).toHaveBeenCalledWith({
-      tenantId: 'tenant',
-      range: '30d',
-      agentName: 'demo',
-    });
-    expect(service.getTimeseries).toHaveBeenCalledWith({
-      tenantId: 'tenant',
-      range: '24h',
-      by: 'autofix',
-      agentName: 'demo',
-      failedOnly: true,
-    });
-    expect(service.getPerAgentStats).toHaveBeenCalledWith({ tenantId: 'tenant', range: '7d' });
-    expect(service.getPerProviderStats).toHaveBeenCalledWith({
-      tenantId: 'tenant',
-      range: '90d',
-      agentName: 'demo',
-    });
-  });
-
-  it('treats non-true failed_only values as false', async () => {
-    await controller.getTimeseries({ failed_only: 'false' }, ctx);
-    expect(service.getTimeseries).toHaveBeenCalledWith({
-      tenantId: 'tenant',
-      range: undefined,
-      by: undefined,
-      agentName: undefined,
-      failedOnly: false,
-    });
-  });
-
-  it('delegates enable-all to the stats service and busts the status cache', async () => {
-    service.enableAll.mockResolvedValue({
-      any_enabled: true,
-      enabled_agents: ['demo'],
-      needs_enable_all: false,
-      consented: true,
-    });
-    await expect(controller.enableAll(ctx)).resolves.toEqual({
-      any_enabled: true,
-      enabled_agents: ['demo'],
-      needs_enable_all: false,
-      consented: true,
-    });
-    expect(service.enableAll).toHaveBeenCalledWith('tenant');
-    expect(cache.del).toHaveBeenCalledWith('tenant:/api/v1/autofix/status');
-  });
-
-  it('rejects enable-all without a resolved tenant', async () => {
-    await expect(controller.enableAll({ tenantId: null } as never)).rejects.toThrow(
-      'No workspace resolved',
-    );
-    expect(service.enableAll).not.toHaveBeenCalled();
-  });
-});
diff --git a/packages/backend/src/analytics/controllers/autofix-analytics.controller.ts b/packages/backend/src/analytics/controllers/autofix-analytics.controller.ts
deleted file mode 100644
index 5778989a..00000000
--- a/packages/backend/src/analytics/controllers/autofix-analytics.controller.ts
+++ /dev/null
@@ -1,104 +0,0 @@
-import {
-  BadRequestException,
-  Controller,
-  Get,
-  Inject,
-  Post,
-  Query,
-  UseInterceptors,
-} from '@nestjs/common';
-import { CACHE_MANAGER, CacheTTL } from '@nestjs/cache-manager';
-import type { Cache } from 'cache-manager';
-import { IsIn, IsOptional, IsString } from 'class-validator';
-import { RangeQueryDto } from '../../common/dto/range-query.dto';
-import { AUTOFIX_TS_DIMENSIONS } from '../services/autofix-stats.service';
-import { AutofixStatsService } from '../services/autofix-stats.service';
-import { TenantCtx, TenantContext } from '../../common/decorators/tenant-context.decorator';
-import { UserCacheInterceptor } from '../../common/interceptors/user-cache.interceptor';
-import { DASHBOARD_CACHE_TTL_MS } from '../../common/constants/cache.constants';
-
-class AutofixTimeseriesQueryDto extends RangeQueryDto {
-  @IsOptional()
-  @IsString()
-  @IsIn([...AUTOFIX_TS_DIMENSIONS])
-  by?: string;
-
-  @IsOptional()
-  @IsString()
-  failed_only?: string;
-}
-
-@Controller('api/v1')
-@UseInterceptors(UserCacheInterceptor)
-@CacheTTL(DASHBOARD_CACHE_TTL_MS)
-export class AutofixAnalyticsController {
-  constructor(
-    private readonly autofixStats: AutofixStatsService,
-    @Inject(CACHE_MANAGER) private readonly cacheManager: Cache,
-  ) {}
-
-  @Get('autofix/status')
-  async getStatus(@TenantCtx() ctx: TenantContext) {
-    return this.autofixStats.getWorkspaceStatus(ctx.tenantId);
-  }
-
-  /** Enable Autofix for every agent in the workspace and record consent. */
-  @Post('autofix/enable-all')
-  async enableAll(@TenantCtx() ctx: TenantContext) {
-    if (!ctx.tenantId) {
-      throw new BadRequestException('No workspace resolved');
-    }
-    const result = await this.autofixStats.enableAll(ctx.tenantId);
-    // UserCacheInterceptor keys GET /autofix/status as `${tenantId}:/api/v1/autofix/status`.
-    // Bust it so a subsequent status read reflects the consent just recorded —
-    // otherwise a second tab can re-show the modal for the dashboard TTL.
-    await this.cacheManager.del(`${ctx.tenantId}:/api/v1/autofix/status`);
-    return result;
-  }
-
-  @Get('overview/autofix-stats')
-  async getStats(@Query() query: RangeQueryDto, @TenantCtx() ctx: TenantContext) {
-    return this.autofixStats.getStats({
-      tenantId: ctx.tenantId,
-      range: query.range,
-      agentName: query.agent_name,
-    });
-  }
-
-  @Get('overview/autofix-timeseries')
-  async getTimeseries(@Query() query: AutofixTimeseriesQueryDto, @TenantCtx() ctx: TenantContext) {
-    return this.autofixStats.getTimeseries({
-      tenantId: ctx.tenantId,
-      range: query.range,
-      by: query.by,
-      agentName: query.agent_name,
-      failedOnly: query.failed_only === 'true',
-    });
-  }
-
-  @Get('overview/autofix-per-agent')
-  async getPerAgent(@Query() query: RangeQueryDto, @TenantCtx() ctx: TenantContext) {
-    return this.autofixStats.getPerAgentStats({
-      tenantId: ctx.tenantId,
-      range: query.range,
-    });
-  }
-
-  @Get('overview/autofix-per-provider')
-  async getPerProvider(@Query() query: RangeQueryDto, @TenantCtx() ctx: TenantContext) {
-    return this.autofixStats.getPerProviderStats({
-      tenantId: ctx.tenantId,
-      range: query.range,
-      agentName: query.agent_name,
-    });
-  }
-
-  @Get('overview/autofix-per-model')
-  async getPerModel(@Query() query: RangeQueryDto, @TenantCtx() ctx: TenantContext) {
-    return this.autofixStats.getPerModelStats({
-      tenantId: ctx.tenantId,
-      range: query.range,
-      agentName: query.agent_name,
-    });
-  }
-}
diff --git a/packages/backend/src/analytics/controllers/provider-analytics.controller.spec.ts b/packages/backend/src/analytics/controllers/provider-analytics.controller.spec.ts
index 40b19e83..9b6dddde 100644
--- a/packages/backend/src/analytics/controllers/provider-analytics.controller.spec.ts
+++ b/packages/backend/src/analytics/controllers/provider-analytics.controller.spec.ts
@@ -49,7 +49,6 @@ describe('ProviderAnalyticsController', () => {
     getAgentNamesByAuthType: jest.Mock;
   };
   let providerRepo: { findOne: jest.Mock };
-  let autofixStats: { getConnectionTimeseries: jest.Mock };
   let attemptStats: {
     getConnectionStatusTimeseries: jest.Mock;
     getConnectionAttemptsByAgentTimeseries: jest.Mock;
@@ -74,11 +73,6 @@ describe('ProviderAnalyticsController', () => {
       getAgentNamesByAuthType: jest.fn().mockResolvedValue(['agent-1']),
     };
     providerRepo = { findOne: jest.fn() };
-    autofixStats = {
-      getConnectionTimeseries: jest
-        .fn()
-        .mockResolvedValue({ range: '7d', by: 'disposition', keys: [], buckets: [] }),
-    };
     attemptStats = {
       getConnectionStatusTimeseries: jest
         .fn()
@@ -96,7 +90,6 @@ describe('ProviderAnalyticsController', () => {
     controller = new ProviderAnalyticsController(
       aggregation as unknown as AggregationService,
       timeseries as unknown as TimeseriesQueriesService,
-      autofixStats as never,
       attemptStats as never,
       providerRepo as unknown as Repository<TenantProvider>,
       messageRepo as unknown as Repository<AgentMessage>,
diff --git a/packages/backend/src/analytics/controllers/provider-analytics.controller.ts b/packages/backend/src/analytics/controllers/provider-analytics.controller.ts
index 062c1177..548a147a 100644
--- a/packages/backend/src/analytics/controllers/provider-analytics.controller.ts
+++ b/packages/backend/src/analytics/controllers/provider-analytics.controller.ts
@@ -3,7 +3,6 @@ import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 import { TenantCtx, TenantContext } from '../../common/decorators/tenant-context.decorator';
 import { AggregationService } from '../services/aggregation.service';
-import { AutofixStatsService } from '../services/autofix-stats.service';
 import { AttemptStatsService } from '../services/attempt-stats.service';
 import { TimeseriesQueriesService } from '../services/timeseries-queries.service';
 import { TenantProvider } from '../../entities/tenant-provider.entity';
@@ -27,7 +26,6 @@ export class ProviderAnalyticsController {
   constructor(
     private readonly aggregation: AggregationService,
     private readonly timeseries: TimeseriesQueriesService,
-    private readonly autofixStats: AutofixStatsService,
     private readonly attemptStats: AttemptStatsService,
     @InjectRepository(TenantProvider)
     private readonly providerRepo: Repository<TenantProvider>,
@@ -345,7 +343,7 @@ export class ProviderAnalyticsController {
       .addSelect('MAX(a.agent_platform)', 'agent_platform')
       // Attempt-world reliability columns: every provider call this
       // connection served for the harness counts, by its own outcome.
-      // Healing is a request concept and does not belong here.
+      // Recovery is a request concept and does not belong here.
       .addSelect('COUNT(*)', 'attempts')
       .addSelect(`COUNT(*) FILTER (WHERE ${sqlIsSuccessStatus('at.status')})`, 'succeeded')
       // Join on agent identity, not name: a soft-deleted agent sharing a slug
diff --git a/packages/backend/src/analytics/controllers/reliability-analytics.controller.spec.ts b/packages/backend/src/analytics/controllers/reliability-analytics.controller.spec.ts
new file mode 100644
index 00000000..efb5c7c0
--- /dev/null
+++ b/packages/backend/src/analytics/controllers/reliability-analytics.controller.spec.ts
@@ -0,0 +1,84 @@
+import { PATH_METADATA } from '@nestjs/common/constants';
+import { ReliabilityAnalyticsController } from './reliability-analytics.controller';
+
+describe('ReliabilityAnalyticsController', () => {
+  const service = {
+    getStats: jest.fn(),
+    getTimeseries: jest.fn(),
+    getPerAgentStats: jest.fn(),
+    getPerProviderStats: jest.fn(),
+    getPerModelStats: jest.fn(),
+  };
+  const controller = new ReliabilityAnalyticsController(service as never);
+  const ctx = { tenantId: 'tenant' } as never;
+
+  beforeEach(() => jest.clearAllMocks());
+
+  it('serves every route under the neutral /api/v1/overview/reliability prefix', () => {
+    const proto = ReliabilityAnalyticsController.prototype;
+    expect(Reflect.getMetadata(PATH_METADATA, ReliabilityAnalyticsController)).toBe(
+      'api/v1/overview/reliability',
+    );
+    expect(
+      [
+        proto.getStats,
+        proto.getTimeseries,
+        proto.getPerAgent,
+        proto.getPerProvider,
+        proto.getPerModel,
+      ].map((handler) => Reflect.getMetadata(PATH_METADATA, handler)),
+    ).toEqual(['stats', 'timeseries', 'per-agent', 'per-provider', 'per-model']);
+  });
+
+  it('delegates every reliability route with tenant scope', async () => {
+    service.getStats.mockResolvedValue({ success_rate: { value: 1, previous: 1 } });
+    service.getTimeseries.mockResolvedValue({ buckets: [] });
+    service.getPerAgentStats.mockResolvedValue([]);
+    service.getPerProviderStats.mockResolvedValue([]);
+    service.getPerModelStats.mockResolvedValue([]);
+
+    await controller.getStats({ range: '30d', agent_name: 'demo' }, ctx);
+    await controller.getTimeseries(
+      { range: '24h', agent_name: 'demo', by: 'provider', failed_only: 'true' },
+      ctx,
+    );
+    await controller.getPerAgent({ range: '7d' }, ctx);
+    await controller.getPerProvider({ range: '90d', agent_name: 'demo' }, ctx);
+    await controller.getPerModel({ range: '24h', agent_name: 'demo' }, ctx);
+
+    expect(service.getStats).toHaveBeenCalledWith({
+      tenantId: 'tenant',
+      range: '30d',
+      agentName: 'demo',
+    });
+    expect(service.getTimeseries).toHaveBeenCalledWith({
+      tenantId: 'tenant',
+      range: '24h',
+      by: 'provider',
+      agentName: 'demo',
+      failedOnly: true,
+    });
+    expect(service.getPerAgentStats).toHaveBeenCalledWith({ tenantId: 'tenant', range: '7d' });
+    expect(service.getPerProviderStats).toHaveBeenCalledWith({
+      tenantId: 'tenant',
+      range: '90d',
+      agentName: 'demo',
+    });
+    expect(service.getPerModelStats).toHaveBeenCalledWith({
+      tenantId: 'tenant',
+      range: '24h',
+      agentName: 'demo',
+    });
+  });
+
+  it('treats non-true failed_only values as false', async () => {
+    await controller.getTimeseries({ failed_only: 'false' }, ctx);
+    expect(service.getTimeseries).toHaveBeenCalledWith({
+      tenantId: 'tenant',
+      range: undefined,
+      by: undefined,
+      agentName: undefined,
+      failedOnly: false,
+    });
+  });
+});
diff --git a/packages/backend/src/analytics/controllers/reliability-analytics.controller.ts b/packages/backend/src/analytics/controllers/reliability-analytics.controller.ts
new file mode 100644
index 00000000..8562734f
--- /dev/null
+++ b/packages/backend/src/analytics/controllers/reliability-analytics.controller.ts
@@ -0,0 +1,82 @@
+import { Controller, Get, Query, UseInterceptors } from '@nestjs/common';
+import { CacheTTL } from '@nestjs/cache-manager';
+import { IsIn, IsOptional, IsString } from 'class-validator';
+import { RangeQueryDto } from '../../common/dto/range-query.dto';
+import {
+  RELIABILITY_TS_DIMENSIONS,
+  ReliabilityStatsService,
+} from '../services/reliability-stats.service';
+import { TenantCtx, TenantContext } from '../../common/decorators/tenant-context.decorator';
+import { UserCacheInterceptor } from '../../common/interceptors/user-cache.interceptor';
+import { DASHBOARD_CACHE_TTL_MS } from '../../common/constants/cache.constants';
+
+class ReliabilityTimeseriesQueryDto extends RangeQueryDto {
+  @IsOptional()
+  @IsString()
+  @IsIn([...RELIABILITY_TS_DIMENSIONS])
+  by?: string;
+
+  @IsOptional()
+  @IsString()
+  failed_only?: string;
+}
+
+/**
+ * Request reliability for the dashboard (success rate, fallback recoveries,
+ * request status over time, per-harness/provider/model reliability).
+ */
+@Controller('api/v1/overview/reliability')
+@UseInterceptors(UserCacheInterceptor)
+@CacheTTL(DASHBOARD_CACHE_TTL_MS)
+export class ReliabilityAnalyticsController {
+  constructor(private readonly reliabilityStats: ReliabilityStatsService) {}
+
+  @Get('stats')
+  async getStats(@Query() query: RangeQueryDto, @TenantCtx() ctx: TenantContext) {
+    return this.reliabilityStats.getStats({
+      tenantId: ctx.tenantId,
+      range: query.range,
+      agentName: query.agent_name,
+    });
+  }
+
+  @Get('timeseries')
+  async getTimeseries(
+    @Query() query: ReliabilityTimeseriesQueryDto,
+    @TenantCtx() ctx: TenantContext,
+  ) {
+    return this.reliabilityStats.getTimeseries({
+      tenantId: ctx.tenantId,
+      range: query.range,
+      by: query.by,
+      agentName: query.agent_name,
+      failedOnly: query.failed_only === 'true',
+    });
+  }
+
+  @Get('per-agent')
+  async getPerAgent(@Query() query: RangeQueryDto, @TenantCtx() ctx: TenantContext) {
+    return this.reliabilityStats.getPerAgentStats({
+      tenantId: ctx.tenantId,
+      range: query.range,
+    });
+  }
+
+  @Get('per-provider')
+  async getPerProvider(@Query() query: RangeQueryDto, @TenantCtx() ctx: TenantContext) {
+    return this.reliabilityStats.getPerProviderStats({
+      tenantId: ctx.tenantId,
+      range: query.range,
+      agentName: query.agent_name,
+    });
+  }
+
+  @Get('per-model')
+  async getPerModel(@Query() query: RangeQueryDto, @TenantCtx() ctx: TenantContext) {
+    return this.reliabilityStats.getPerModelStats({
+      tenantId: ctx.tenantId,
+      range: query.range,
+      agentName: query.agent_name,
+    });
+  }
+}
diff --git a/packages/backend/src/analytics/dto/messages-query.dto.spec.ts b/packages/backend/src/analytics/dto/messages-query.dto.spec.ts
index 6cbb011b..949efc18 100644
--- a/packages/backend/src/analytics/dto/messages-query.dto.spec.ts
+++ b/packages/backend/src/analytics/dto/messages-query.dto.spec.ts
@@ -73,7 +73,7 @@ describe('MessagesQueryDto', () => {
   });
 
   it('accepts each known trigger filter value', async () => {
-    for (const trigger of ['none', 'fallback', 'autofix']) {
+    for (const trigger of ['none', 'fallback']) {
       const dto = plainToInstance(MessagesQueryDto, { trigger });
       const errors = await validate(dto);
       expect(errors).toHaveLength(0);
@@ -102,7 +102,7 @@ describe('MessagesQueryDto', () => {
   });
 
   it('accepts a comma-separated trigger list', async () => {
-    const dto = plainToInstance(MessagesQueryDto, { trigger: 'autofix,fallback' });
+    const dto = plainToInstance(MessagesQueryDto, { trigger: 'none,fallback' });
     const errors = await validate(dto);
     expect(errors).toHaveLength(0);
   });
diff --git a/packages/backend/src/analytics/dto/messages-query.dto.ts b/packages/backend/src/analytics/dto/messages-query.dto.ts
index 3dc88632..7ff5e4d5 100644
--- a/packages/backend/src/analytics/dto/messages-query.dto.ts
+++ b/packages/backend/src/analytics/dto/messages-query.dto.ts
@@ -37,7 +37,7 @@ export const MESSAGE_STATUS_FILTER_VALUES = [
 ] as const;
 export type MessageStatusFilter = (typeof MESSAGE_STATUS_FILTER_VALUES)[number];
 
-export const MESSAGE_TRIGGER_FILTER_VALUES = ['none', 'fallback', 'autofix'] as const;
+export const MESSAGE_TRIGGER_FILTER_VALUES = ['none', 'fallback'] as const;
 export type MessageTriggerFilter = (typeof MESSAGE_TRIGGER_FILTER_VALUES)[number];
 
 /**
@@ -128,9 +128,9 @@ export class MessagesQueryDto {
   })
   attempts?: string;
 
-  /** One or several (comma-separated) of: none, fallback, autofix. */
+  /** One or several (comma-separated) of: none, fallback. */
   @IsOptional()
-  @Matches(/^(none|fallback|autofix)(,(none|fallback|autofix))*$/, {
+  @Matches(/^(none|fallback)(,(none|fallback))*$/, {
     message: `trigger must be a comma-separated list of: ${MESSAGE_TRIGGER_FILTER_VALUES.join(', ')}`,
   })
   trigger?: string;
diff --git a/packages/backend/src/analytics/services/attempt-stats.service.spec.ts b/packages/backend/src/analytics/services/attempt-stats.service.spec.ts
index 854c33b1..bfdf8e5d 100644
--- a/packages/backend/src/analytics/services/attempt-stats.service.spec.ts
+++ b/packages/backend/src/analytics/services/attempt-stats.service.spec.ts
@@ -63,7 +63,6 @@ describe('AttemptStatsService', () => {
       expect(
         qb.andWhere.mock.calls.some(([clause]) => String(clause).includes('liveAgentName')),
       ).toBe(true);
-      expect(qb.addSelect.mock.calls.flat()).not.toContain('autofix_role');
     }
   });
 
@@ -217,15 +216,13 @@ describe('AttemptStatsService', () => {
     ]);
   });
 
-  it('computes the connection breakdown with both retry families', async () => {
+  it('computes the connection breakdown with its fallback retries', async () => {
     const qb = mockQueryBuilder({
       rawOne: {
         attempts: '216',
         succeeded: '162',
         fallback_retries: '10',
         fallback_retries_succeeded: '8',
-        autofix_attempts: '12',
-        autofix_attempts_succeeded: '10',
       },
     });
     const service = makeService([qb]);
@@ -237,12 +234,10 @@ describe('AttemptStatsService', () => {
       failed: 54,
       fallback_retries: 10,
       fallback_retries_succeeded: 8,
-      autofix_attempts: 12,
-      autofix_attempts_succeeded: 10,
     });
     const selects = qb.addSelect.mock.calls.flat().join(' ');
-    // A fallback is a retry; an autofix produces an attempt (autofix_role).
+    // A fallback is a retry, and the only retry family left.
     expect(selects).toContain('at.fallback_from_model IS NOT NULL');
-    expect(selects).toContain("at.autofix_role = 'retry'");
+    expect(selects).not.toMatch(/auto_?fix/);
   });
 });
diff --git a/packages/backend/src/analytics/services/attempt-stats.service.ts b/packages/backend/src/analytics/services/attempt-stats.service.ts
index 8d2ab358..2069eb7b 100644
--- a/packages/backend/src/analytics/services/attempt-stats.service.ts
+++ b/packages/backend/src/analytics/services/attempt-stats.service.ts
@@ -45,10 +45,8 @@ interface AttemptCounts {
 
 /**
  * Universal attempt aggregates. Request totals remain on
- * `overview.request_reliability`; Autofix totals remain on the adjacent
- * Autofix/error aggregates. When those surfaces are composed, the canonical
- * Autofixed attempt is the successful `autofix_role='retry'` row. No cohort
- * or eligibility predicate belongs in this service.
+ * `overview.request_reliability`. No cohort or eligibility predicate belongs
+ * in this service.
  */
 @Injectable()
 export class AttemptStatsService {
@@ -160,7 +158,7 @@ export class AttemptStatsService {
    * Attempt-status timeseries scoped to ONE provider connection: every
    * provider call counts where it ran (retries and fallback attempts
    * included), keyed by its OWN outcome. Success = ok, error = everything
-   * else. No healing notion: that belongs to requests.
+   * else. No recovery notion: that belongs to requests.
    */
   async getConnectionStatusTimeseries(params: {
     tenantId: string | null;
@@ -320,8 +318,7 @@ export class AttemptStatsService {
 
   /**
    * The connection's attempt breakdown for the header cards: totals, and the
-   * two retry families with their own outcomes. Fallback retries exist for
-   * everyone; autofixed attempts only exist with the Doctor version.
+   * fallback retries with their own outcome.
    */
   async getConnectionBreakdown(params: {
     tenantId: string | null;
@@ -336,8 +333,6 @@ export class AttemptStatsService {
     failed: number;
     fallback_retries: number;
     fallback_retries_succeeded: number;
-    autofix_attempts: number;
-    autofix_attempts_succeeded: number;
   }> {
     const empty = {
       attempts: 0,
@@ -345,8 +340,6 @@ export class AttemptStatsService {
       failed: 0,
       fallback_retries: 0,
       fallback_retries_succeeded: 0,
-      autofix_attempts: 0,
-      autofix_attempts_succeeded: 0,
     };
     if (!params.tenantId) return empty;
     const range = params.range ?? '7d';
@@ -361,11 +354,6 @@ export class AttemptStatsService {
         `COUNT(*) FILTER (WHERE at.fallback_from_model IS NOT NULL AND ${okExpr})`,
         'fallback_retries_succeeded',
       )
-      .addSelect(`COUNT(*) FILTER (WHERE at.autofix_role = 'retry')`, 'autofix_attempts')
-      .addSelect(
-        `COUNT(*) FILTER (WHERE at.autofix_role = 'retry' AND ${okExpr})`,
-        'autofix_attempts_succeeded',
-      )
       .where('at.timestamp >= :cutoff', { cutoff })
       .andWhere(sqlIsCompletedStatus('at.status'));
     addTenantFilter(qb, params.tenantId);
@@ -381,8 +369,6 @@ export class AttemptStatsService {
       failed: attempts - succeeded,
       fallback_retries: Number(row?.fallback_retries ?? 0),
       fallback_retries_succeeded: Number(row?.fallback_retries_succeeded ?? 0),
-      autofix_attempts: Number(row?.autofix_attempts ?? 0),
-      autofix_attempts_succeeded: Number(row?.autofix_attempts_succeeded ?? 0),
     };
   }
 
diff --git a/packages/backend/src/analytics/services/autofix-stats.service.spec.ts b/packages/backend/src/analytics/services/autofix-stats.service.spec.ts
deleted file mode 100644
index 0d1798a6..00000000
--- a/packages/backend/src/analytics/services/autofix-stats.service.spec.ts
+++ /dev/null
@@ -1,451 +0,0 @@
-import { AutofixStatsService } from './autofix-stats.service';
-
-const queryBuilder = () => {
-  const qb = {
-    select: jest.fn(),
-    addSelect: jest.fn(),
-    where: jest.fn(),
-    andWhere: jest.fn(),
-    leftJoin: jest.fn(),
-    groupBy: jest.fn(),
-    addGroupBy: jest.fn(),
-    orderBy: jest.fn(),
-    limit: jest.fn(),
-    getRawOne: jest.fn(),
-    getRawMany: jest.fn(),
-  };
-  for (const key of [
-    'select',
-    'addSelect',
-    'where',
-    'andWhere',
-    'leftJoin',
-    'groupBy',
-    'addGroupBy',
-    'orderBy',
-    'limit',
-  ] as const) {
-    qb[key].mockReturnValue(qb);
-  }
-  return qb;
-};
-
-const ORIGINAL_MANIFEST_MODE = process.env.MANIFEST_MODE;
-
-describe('AutofixStatsService', () => {
-  beforeAll(() => {
-    // Pin cloud mode so consented:true assertions hold regardless of the
-    // shell's MANIFEST_MODE (dev often exports selfhosted).
-    process.env.MANIFEST_MODE = 'cloud';
-  });
-  afterAll(() => {
-    if (ORIGINAL_MANIFEST_MODE === undefined) delete process.env.MANIFEST_MODE;
-    else process.env.MANIFEST_MODE = ORIGINAL_MANIFEST_MODE;
-  });
-
-  const agentRepo = { find: jest.fn(), update: jest.fn() };
-  const messageRepo = { createQueryBuilder: jest.fn() };
-  const autofix = {
-    resolveEnabled: jest.fn((stored: boolean | null) => stored ?? true),
-  };
-  const requestVolume = {
-    getDispositionTimeseries: jest.fn().mockResolvedValue([]),
-    getDispositionTotalsForWindows: jest.fn().mockResolvedValue({
-      current: { total: 0, success: 0, healed: 0, fallback: 0, error: 0 },
-      previous: { total: 0, success: 0, healed: 0, fallback: 0, error: 0 },
-    }),
-    getVolumeByDimension: jest.fn().mockResolvedValue([]),
-    getVolumeByProviderTimeseries: jest.fn().mockResolvedValue([]),
-    getVolumeByAgentTimeseries: jest.fn().mockResolvedValue([]),
-  };
-  let service: AutofixStatsService;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    messageRepo.createQueryBuilder.mockReset();
-    autofix.resolveEnabled.mockImplementation((stored: boolean | null) => stored ?? true);
-    requestVolume.getDispositionTimeseries.mockResolvedValue([]);
-    requestVolume.getDispositionTotalsForWindows.mockResolvedValue({
-      current: { total: 0, success: 0, healed: 0, fallback: 0, error: 0 },
-      previous: { total: 0, success: 0, healed: 0, fallback: 0, error: 0 },
-    });
-    requestVolume.getVolumeByDimension.mockResolvedValue([]);
-    service = new AutofixStatsService(
-      agentRepo as never,
-      messageRepo as never,
-      { findOne: jest.fn().mockResolvedValue(null) } as never,
-      autofix as never,
-      requestVolume as never,
-    );
-  });
-
-  it('returns an empty status without a tenant', async () => {
-    await expect(service.getWorkspaceStatus(null)).resolves.toEqual({
-      any_enabled: false,
-      consented: true,
-      enabled_agents: [],
-      disabled_agents: [],
-      needs_enable_all: false,
-    });
-    expect(agentRepo.find).not.toHaveBeenCalled();
-  });
-
-  it('returns effectively enabled agent names for a cloud workspace', async () => {
-    agentRepo.find.mockResolvedValue([
-      { name: 'inherited', autofix_enabled: null },
-      { name: 'disabled', autofix_enabled: false },
-      { name: 'enabled', autofix_enabled: true },
-    ]);
-    await expect(service.getWorkspaceStatus('tenant')).resolves.toEqual({
-      any_enabled: true,
-      enabled_agents: ['inherited', 'enabled'],
-      disabled_agents: ['disabled'],
-      needs_enable_all: false,
-      consented: true,
-    });
-    expect(agentRepo.find).toHaveBeenCalledWith({
-      where: { tenant_id: 'tenant', deleted_at: expect.anything(), is_playground: false },
-      select: ['name', 'autofix_enabled'],
-    });
-  });
-
-  it('keeps inherited agents disabled under the self-hosted default', async () => {
-    autofix.resolveEnabled.mockImplementation((stored: boolean | null) => stored ?? false);
-    agentRepo.find.mockResolvedValue([
-      { name: 'inherited', autofix_enabled: null },
-      { name: 'enabled', autofix_enabled: true },
-    ]);
-
-    await expect(service.getWorkspaceStatus('tenant')).resolves.toEqual({
-      any_enabled: true,
-      enabled_agents: ['enabled'],
-      disabled_agents: ['inherited'],
-      needs_enable_all: false,
-      consented: true,
-    });
-  });
-
-  describe('fleet-enable CTA (self-hosted)', () => {
-    // The CTA only exists on self-hosted: cloud is always "consented" and NULL
-    // resolves to enabled there, so the condition can never hold. Build the
-    // service against a real self-hosted consent lookup rather than mixing a
-    // self-hosted resolveEnabled with cloud's implicit consent.
-    const selfHostedService = (consentedAt: string | null) => {
-      process.env.MANIFEST_MODE = 'selfhosted';
-      autofix.resolveEnabled.mockImplementation((stored: boolean | null) => stored ?? false);
-      return new AutofixStatsService(
-        agentRepo as never,
-        messageRepo as never,
-        {
-          findOne: jest
-            .fn()
-            .mockResolvedValue(consentedAt ? { autofix_consented_at: consentedAt } : null),
-        } as never,
-        autofix as never,
-        requestVolume as never,
-      );
-    };
-    afterEach(() => {
-      process.env.MANIFEST_MODE = 'cloud';
-    });
-
-    it('offers fleet enable for an unconsented install with unconfigured agents', async () => {
-      agentRepo.find.mockResolvedValue([
-        { name: 'legacy', autofix_enabled: null },
-        { name: 'explicitly-disabled', autofix_enabled: false },
-      ]);
-
-      await expect(selfHostedService(null).getWorkspaceStatus('tenant')).resolves.toMatchObject({
-        any_enabled: false,
-        enabled_agents: [],
-        needs_enable_all: true,
-      });
-    });
-
-    it('does not offer it when every agent already made an explicit choice', async () => {
-      // Pins the NULL term specifically: this install is self-hosted AND
-      // unconsented, so it clears both other gates. Only "no agent is
-      // unconfigured" keeps the CTA away from someone who deliberately turned
-      // Autofix off everywhere.
-      agentRepo.find.mockResolvedValue([
-        { name: 'chose-off', autofix_enabled: false },
-        { name: 'also-chose-off', autofix_enabled: false },
-      ]);
-
-      await expect(selfHostedService(null).getWorkspaceStatus('tenant')).resolves.toMatchObject({
-        any_enabled: false,
-        enabled_agents: [],
-        needs_enable_all: false,
-        consented: false,
-      });
-    });
-
-    it('stops offering it once the install has consented', async () => {
-      // NULL is the "inherit the mode default" state, not a legacy marker — an
-      // OTLP-onboarded agent stores it too. Keying the one-time CTA on NULL
-      // alone re-prompted installs that had already decided.
-      agentRepo.find.mockResolvedValue([{ name: 'inherited', autofix_enabled: null }]);
-
-      await expect(
-        selfHostedService('2026-08-05T00:00:00.000Z').getWorkspaceStatus('tenant'),
-      ).resolves.toMatchObject({
-        any_enabled: false,
-        enabled_agents: [],
-        needs_enable_all: false,
-        consented: true,
-      });
-    });
-  });
-
-  it.each([
-    ['an empty workspace', []],
-    ['only explicitly disabled new agents', [{ name: 'new-agent', autofix_enabled: false }]],
-  ])('does not offer fleet enable for %s', async (_label, agents) => {
-    autofix.resolveEnabled.mockImplementation((stored: boolean | null) => stored ?? false);
-    agentRepo.find.mockResolvedValue(agents);
-
-    await expect(service.getWorkspaceStatus('tenant')).resolves.toMatchObject({
-      any_enabled: false,
-      enabled_agents: [],
-      needs_enable_all: false,
-    });
-  });
-
-  it('computes Autofix-only stats for current and previous windows', async () => {
-    const internals = service as unknown as {
-      queryNeedsAttention: jest.Mock;
-    };
-    // ONE terminal-CTE scan yields both windows; getStats derives the KPI
-    // counts from that single result instead of scanning twice.
-    requestVolume.getDispositionTotalsForWindows.mockResolvedValue({
-      current: { total: 10, success: 5, healed: 2, fallback: 1, error: 2 },
-      previous: { total: 0, success: 0, healed: 0, fallback: 0, error: 0 },
-    });
-    internals.queryNeedsAttention = jest.fn().mockResolvedValue([{ error_message: 'bad' }]);
-
-    await expect(
-      service.getStats({ tenantId: 'tenant', range: '30d', agentName: 'agent' }),
-    ).resolves.toEqual({
-      success_rate: { value: 0.8, previous: 0 },
-      autofix_saves: { value: 2, previous: 0 },
-      fallback_saves: { value: 1, previous: 0 },
-      total_requests: { value: 10, previous: 0 },
-      errors_remaining: { value: 2, previous: 0 },
-      coverage: { rate: 0.5, previous_rate: 0 },
-      dispositions: { healed: 2, no_fix_found: 2, resolving: 0, ineffective: 0 },
-      needs_attention: [{ error_message: 'bad' }],
-    });
-    expect(requestVolume.getDispositionTotalsForWindows).toHaveBeenCalledTimes(1);
-    expect(requestVolume.getDispositionTotalsForWindows).toHaveBeenCalledWith({
-      tenantId: 'tenant',
-      from: expect.any(String),
-      splitAt: expect.any(String),
-      to: expect.any(String),
-      agentName: 'agent',
-    });
-  });
-
-  it('maps per-provider, per-agent and per-model reliability rows', async () => {
-    // Provider and model tables live in the ATTEMPT world: every provider
-    // call counts by its own outcome, no retry exclusion, no healing fields.
-    const providerQb = queryBuilder();
-    providerQb.getRawMany.mockResolvedValue([
-      {
-        provider: 'openai',
-        auth_type: 'subscription',
-        key_label: 'Default',
-        attempts: '12',
-        failed: '3',
-        succeeded: '9',
-      },
-    ]);
-    requestVolume.getVolumeByDimension.mockResolvedValue([
-      {
-        key: 'demo',
-        requests: 8,
-        failed: 2,
-        healed: 1,
-        fallback: 2,
-        succeeded: 7,
-      },
-    ]);
-    messageRepo.createQueryBuilder.mockReturnValueOnce(providerQb);
-
-    await expect(
-      service.getPerProviderStats({ tenantId: 'tenant', agentName: 'demo' }),
-    ).resolves.toEqual([
-      {
-        provider: 'openai',
-        auth_type: 'subscription',
-        key_label: 'Default',
-        attempts: 12,
-        failed: 3,
-        succeeded: 9,
-      },
-    ]);
-    // Connection grain: grouped by provider + folded auth_type + folded label.
-    const providerGroupSql = providerQb.addGroupBy.mock.calls.flat().join(' ');
-    expect(providerGroupSql).toContain("COALESCE(at.auth_type, 'api_key')");
-    expect(providerGroupSql).toContain("COALESCE(at.provider_key_label, 'Default')");
-    const providerSql = providerQb.addSelect.mock.calls.flat().join(' ');
-    // Canonical success and legacy NULL/ok remain compatible.
-    expect(providerSql).toContain("at.status IN ('ok', 'success')");
-    expect(providerSql).toContain("at.status NOT IN ('pending', 'cancelled', 'ok', 'success')");
-    // No retry exclusion: an autofix retry is a real provider call here.
-    expect(providerQb.andWhere.mock.calls.flat()).not.toContain(
-      "(at.autofix_role IS NULL OR at.autofix_role != 'retry')",
-    );
-
-    // The harness table stays in the REQUEST world (unchanged shape).
-    await expect(service.getPerAgentStats({ tenantId: 'tenant' })).resolves.toEqual([
-      { agent_name: 'demo', requests: 8, failed: 2, autofixed: 1, fallback_saves: 2, succeeded: 7 },
-    ]);
-    expect(requestVolume.getVolumeByDimension).toHaveBeenCalledWith('agent_name', {
-      tenantId: 'tenant',
-    });
-
-    const modelQb = queryBuilder();
-    modelQb.getRawMany.mockResolvedValue([
-      { model: 'gpt-4o', attempts: '6', failed: '1', succeeded: '5' },
-    ]);
-    messageRepo.createQueryBuilder.mockReturnValueOnce(modelQb);
-    await expect(
-      service.getPerModelStats({ tenantId: 'tenant', agentName: 'demo' }),
-    ).resolves.toEqual([{ model: 'gpt-4o', attempts: 6, failed: 1, succeeded: 5 }]);
-  });
-
-  it('builds hourly failed-only timeseries and preserves disposition order', async () => {
-    // #2511: the disposition dimension counts logical requests via the
-    // request-volume service (terminal-attempt attribution), not attempts.
-    requestVolume.getDispositionTimeseries.mockResolvedValue([
-      { bucket: '2026-01-01 10:00:00', dim: 'error', count: '2' },
-      { bucket: '2026-01-01 10:00:00', dim: 'success', count: '5' },
-      { bucket: '2026-01-01 11:00:00', dim: 'success', count: '1' },
-      { bucket: '2026-01-01 10:00:00', dim: null, count: '3' },
-    ]);
-
-    await expect(
-      service.getTimeseries({
-        tenantId: 'tenant',
-        range: '24h',
-        by: 'invalid',
-        failedOnly: true,
-      }),
-    ).resolves.toEqual({
-      range: '24h',
-      by: 'disposition',
-      keys: ['success', 'error', 'unknown'],
-      buckets: [
-        { bucket: '2026-01-01 10:00:00', counts: [5, 2, 3] },
-        { bucket: '2026-01-01 11:00:00', counts: [1, 0, 0] },
-      ],
-    });
-    expect(requestVolume.getDispositionTimeseries).toHaveBeenCalledWith({
-      tenantId: 'tenant',
-      range: '24h',
-      hourly: true,
-      agentName: undefined,
-      failedOnly: true,
-    });
-    // The disposition path never scans attempts directly anymore.
-    expect(messageRepo.createQueryBuilder).not.toHaveBeenCalled();
-  });
-
-  it.each(['http_status', 'provider', 'error_kind', 'autofix'])(
-    'supports the %s timeseries dimension',
-    async (by) => {
-      const qb = queryBuilder();
-      qb.getRawMany.mockResolvedValue([
-        { bucket: '2026-01-02', dim: 'zeta', count: '1' },
-        { bucket: '2026-01-01', dim: 'alpha', count: '2' },
-      ]);
-      messageRepo.createQueryBuilder.mockReturnValue(qb);
-      const result = await service.getTimeseries({ tenantId: null, range: '7d', by });
-      expect(result.keys).toEqual(['alpha', 'zeta']);
-      expect(result.buckets[0]!.bucket).toBe('2026-01-01');
-      expect(qb.addSelect.mock.calls[0]![0]).toEqual(expect.any(String));
-    },
-  );
-
-  it('derives window counts from the request-level disposition totals', () => {
-    const internals = service as unknown as {
-      windowCounts: (t: {
-        total: number;
-        success: number;
-        healed: number;
-        fallback: number;
-        error: number;
-      }) => unknown;
-    };
-    // ONE definition: the KPI window reads the same reducer as the chart.
-    expect(
-      internals.windowCounts({ total: 100, success: 70, healed: 4, fallback: 6, error: 20 }),
-    ).toEqual({
-      total: 100,
-      successes: 80, // success + recovered by Autofix + recovered by fallback
-      saves: 4, // autofix_status = retry_succeeded
-      fallback_saves: 6,
-      errors: 20,
-      healed: 4,
-      no_fix_found: 20,
-      resolving: 0,
-      ineffective: 0,
-    });
-    // No attempt-table scan and no sibling join anymore.
-    expect(messageRepo.createQueryBuilder).not.toHaveBeenCalled();
-  });
-
-  it('maps needs-attention failures and defaults nullable fields', async () => {
-    const internals = service as unknown as {
-      queryNeedsAttention: (
-        cutoff: string,
-        tenantId: string | null,
-        agentName?: string,
-      ) => Promise<unknown>;
-    };
-    const qb = queryBuilder();
-    qb.getRawMany.mockResolvedValue([
-      {
-        error_message: null,
-        provider: 'openai',
-        model: 'gpt',
-        count: '4',
-        phoenix_issue_id: null,
-      },
-    ]);
-    messageRepo.createQueryBuilder.mockReturnValue(qb);
-    await expect(internals.queryNeedsAttention('cutoff', 'tenant', 'demo')).resolves.toEqual([
-      {
-        error_message: '',
-        provider: 'openai',
-        model: 'gpt',
-        count: 4,
-        phoenix_issue_id: null,
-      },
-    ]);
-    const filterSql = qb.andWhere.mock.calls.flat().join(' ');
-    expect(qb.leftJoin).toHaveBeenCalled();
-    expect(filterSql).toContain("r.autofix_status <> 'retry_succeeded'");
-    expect(filterSql).toContain('FROM agent_messages sib');
-    expect(filterSql).not.toContain('FROM provider_attempts sib');
-  });
-
-  describe('enableAll', () => {
-    it('updates only live non-playground agents and records consent', async () => {
-      agentRepo.update.mockResolvedValue({ affected: 2 });
-      agentRepo.find.mockResolvedValue([{ name: 'a', autofix_enabled: true }]);
-      await expect(service.enableAll('tenant')).resolves.toMatchObject({
-        any_enabled: true,
-        enabled_agents: ['a'],
-      });
-      expect(agentRepo.update).toHaveBeenCalledWith(
-        expect.objectContaining({
-          tenant_id: 'tenant',
-          is_playground: false,
-          deleted_at: expect.objectContaining({ _type: 'isNull' }),
-        }),
-        { autofix_enabled: true },
-      );
-    });
-  });
-});
diff --git a/packages/backend/src/analytics/services/error-breakdown.service.spec.ts b/packages/backend/src/analytics/services/error-breakdown.service.spec.ts
index 6d51b26a..aee7e5c5 100644
--- a/packages/backend/src/analytics/services/error-breakdown.service.spec.ts
+++ b/packages/backend/src/analytics/services/error-breakdown.service.spec.ts
@@ -8,7 +8,7 @@ interface GroupRow {
   count: string;
 }
 
-function makeQb(groups: GroupRow[], successful: number, autoFixed: number) {
+function makeQb(groups: GroupRow[], successful: number) {
   return {
     select: jest.fn().mockReturnThis(),
     addSelect: jest.fn().mockReturnThis(),
@@ -18,16 +18,12 @@ function makeQb(groups: GroupRow[], successful: number, autoFixed: number) {
     groupBy: jest.fn().mockReturnThis(),
     addGroupBy: jest.fn().mockReturnThis(),
     getRawMany: jest.fn().mockResolvedValue(groups),
-    // querySuccessful resolves first, queryAutoFixed second (Promise.all order).
-    getRawOne: jest
-      .fn()
-      .mockResolvedValueOnce({ count: String(successful) })
-      .mockResolvedValue({ count: String(autoFixed) }),
+    getRawOne: jest.fn().mockResolvedValue({ count: String(successful) }),
   };
 }
 
-function makeService(groups: GroupRow[], successful: number, autoFixed = 0) {
-  const qb = makeQb(groups, successful, autoFixed);
+function makeService(groups: GroupRow[], successful: number) {
+  const qb = makeQb(groups, successful);
   const repo = {
     createQueryBuilder: jest.fn().mockReturnValue(qb),
   } as unknown as Repository<AgentMessage>;
@@ -97,26 +93,23 @@ describe('ErrorBreakdownService', () => {
     expect(result.provider_error_rate).toBeCloseTo(3 / 10, 10);
   });
 
-  it('counts requests whose Autofix retry succeeded, independent of the error groups', async () => {
-    const { service, qb } = makeService(GROUPS, 81, 7);
+  it('returns only the error and success aggregates, with no repair counter', async () => {
+    const { service } = makeService(GROUPS, 81);
     const result = await service.getBreakdown({ tenantId: 't1', range: '7d' });
 
-    expect(result.auto_fixed).toBe(7);
-    // The heal count must not inflate the error totals — it is a view over rows
-    // already inside total_errors, not a new bucket.
-    expect(result.total_errors).toBe(21);
-    const filtersAutoFixed = (qb.andWhere as jest.Mock).mock.calls
-      .flat()
-      .filter((clause): clause is string => typeof clause === 'string')
-      .join(' ');
-    expect(filtersAutoFixed).toContain("r.autofix_status = 'retry_succeeded'");
-    expect(filtersAutoFixed).toContain("retry.status IN ('ok', 'success')");
-  });
-
-  it('reports auto_fixed as 0 when nothing was healed', async () => {
-    const { service } = makeService(GROUPS, 81);
-    const result = await service.getBreakdown({ tenantId: 't1' });
-    expect(result.auto_fixed).toBe(0);
+    expect(Object.keys(result).sort()).toEqual(
+      [
+        'by_class',
+        'by_origin',
+        'manifest_errors',
+        'provider_error_rate',
+        'provider_errors',
+        'range',
+        'successful',
+        'total_errors',
+        'transport_errors',
+      ].sort(),
+    );
   });
 
   it('defaults the range to 30d when none is supplied', async () => {
diff --git a/packages/backend/src/analytics/services/error-breakdown.service.ts b/packages/backend/src/analytics/services/error-breakdown.service.ts
index 6e62b799..cd212c74 100644
--- a/packages/backend/src/analytics/services/error-breakdown.service.ts
+++ b/packages/backend/src/analytics/services/error-breakdown.service.ts
@@ -3,7 +3,6 @@ import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 import { ERROR_ORIGINS, MANIFEST_ERROR_ORIGINS } from 'manifest-shared';
 import { AgentMessage } from '../../entities/agent-message.entity';
-import { ManifestRequest } from '../../entities/request.entity';
 import { rangeToInterval } from '../../common/utils/range.util';
 import { computeCutoff } from '../../common/utils/postgres-sql';
 import { addTenantFilter, excludePlaygroundAgents, sqlIsSuccessStatus } from './query-helpers';
@@ -20,13 +19,6 @@ export interface ErrorBreakdownResponse {
   transport_errors: number;
   /** Manifest's OWN config/policy/internal rejections — NOT a provider failure. */
   manifest_errors: number;
-  /**
-   * Requests healed by Autofix in the window — one per healed request. NOT additive with
-   * `total_errors`: the healed original is a superseded attempt that is already
-   * included in `total_errors`/`by_origin`, so treat this as "of those errors,
-   * this many were autofixed", never as a separate error bucket to sum.
-   */
-  auto_fixed: number;
   by_origin: Record<string, number>;
   by_class: Record<string, number>;
   /** provider_errors / (provider_errors + successful), 0..1. */
@@ -54,13 +46,12 @@ export class ErrorBreakdownService {
     const range = params.range ?? '30d';
     const cutoff = computeCutoff(rangeToInterval(range));
 
-    const [groups, successful, autoFixed] = await Promise.all([
+    const [groups, successful] = await Promise.all([
       this.queryErrorGroups(cutoff, params.tenantId, params.agentName),
       this.querySuccessful(cutoff, params.tenantId, params.agentName),
-      this.queryAutoFixed(cutoff, params.tenantId, params.agentName),
     ]);
 
-    return this.assemble(range, groups, successful, autoFixed);
+    return this.assemble(range, groups, successful);
   }
 
   private async queryErrorGroups(
@@ -106,42 +97,10 @@ export class ErrorBreakdownService {
     return Number(row?.count ?? 0);
   }
 
-  /** Count each request whose Autofix retry actually succeeded. */
-  private async queryAutoFixed(
-    cutoff: string,
-    tenantId: string | null,
-    agentName?: string,
-  ): Promise<number> {
-    const qb = this.messageRepo
-      .createQueryBuilder('at')
-      .leftJoin(ManifestRequest, 'r', 'r.id = at.request_id')
-      .select('COUNT(DISTINCT COALESCE(at.request_id, at.autofix_group_id, at.id))', 'count')
-      .where('at.timestamp >= :cutoff', { cutoff })
-      .andWhere("(at.autofix_role = 'original' OR at.status = 'auto_fixed')")
-      .andWhere(
-        `(r.autofix_status = 'retry_succeeded' OR (
-          r.id IS NULL
-          AND at.status = 'auto_fixed'
-          AND EXISTS (
-            SELECT 1 FROM agent_messages retry
-            WHERE retry.autofix_group_id = at.autofix_group_id
-              AND retry.tenant_id = at.tenant_id
-              AND retry.autofix_role = 'retry'
-              AND ${sqlIsSuccessStatus('retry.status')}
-          )
-        ))`,
-      );
-    addTenantFilter(qb, tenantId, agentName);
-    excludePlaygroundAgents(qb);
-    const row = await qb.getRawOne<{ count: string }>();
-    return Number(row?.count ?? 0);
-  }
-
   private assemble(
     range: string,
     groups: ErrorGroupRow[],
     successful: number,
-    autoFixed: number,
   ): ErrorBreakdownResponse {
     const by_origin: Record<string, number> = Object.fromEntries(ERROR_ORIGINS.map((o) => [o, 0]));
     const by_class: Record<string, number> = {};
@@ -161,7 +120,6 @@ export class ErrorBreakdownService {
       provider_errors: provider,
       transport_errors: by_origin['transport'] ?? 0,
       manifest_errors: manifest,
-      auto_fixed: autoFixed,
       by_origin,
       by_class,
       provider_error_rate: denom > 0 ? provider / denom : 0,
diff --git a/packages/backend/src/analytics/services/message-details.service.spec.ts b/packages/backend/src/analytics/services/message-details.service.spec.ts
index 3aac4e80..66b7c740 100644
--- a/packages/backend/src/analytics/services/message-details.service.spec.ts
+++ b/packages/backend/src/analytics/services/message-details.service.spec.ts
@@ -69,11 +69,6 @@ describe('MessageDetailsService', () => {
     header_tier_color: null,
     specificity_category: null,
     specificity_miscategorized: false,
-    autofix_applied: false,
-    autofix_group_id: null,
-    autofix_role: null,
-    autofix_operations: null,
-    autofix_decision: null,
   };
 
   beforeEach(async () => {
@@ -126,7 +121,6 @@ describe('MessageDetailsService', () => {
       agent_name: 'my-agent',
       model: 'gpt-4o',
       status: 'ok',
-      autofix_status: null,
       error_message: null,
       error_http_status: null,
       error_origin: null,
@@ -160,49 +154,9 @@ describe('MessageDetailsService', () => {
       header_tier_id: null,
       header_tier_name: null,
       header_tier_color: null,
-      autofix_applied: false,
-      autofix_role: null,
-      autofix_operations: null,
-      autofix_decision: null,
-      autofix_sibling: null,
     });
   });
 
-  it('maps autofix_decision ids when the message carries them', async () => {
-    // The "maps all fields" test above covers the null case; here the stored
-    // row has a non-null autofix_decision, exercising the `?? null` mapping's
-    // non-null branch.
-    const phoenix = { status: 'patched', issueId: 'i', patchId: 'p', healAttemptId: 'h' };
-    msgQb.getOne.mockResolvedValue({ ...baseMessage, autofix_decision: phoenix });
-    const result = await service.getDetails('msg-1', 'u1');
-    expect(result.message.autofix_decision).toEqual(phoenix);
-  });
-
-  it('resolves the autofix sibling when the message has a group id', async () => {
-    msgQb.getOne
-      .mockResolvedValueOnce({
-        ...baseMessage,
-        id: 'msg-1',
-        autofix_group_id: 'grp-9',
-        autofix_role: 'original',
-      })
-      .mockResolvedValueOnce({ id: 'msg-retry', autofix_role: 'retry', status: 'ok' });
-    const result = await service.getDetails('msg-1', 'u1');
-    expect(result.message.autofix_sibling).toEqual({
-      id: 'msg-retry',
-      role: 'retry',
-      status: 'ok',
-    });
-  });
-
-  it('returns a null sibling when no paired row exists', async () => {
-    msgQb.getOne
-      .mockResolvedValueOnce({ ...baseMessage, id: 'msg-1', autofix_group_id: 'grp-9' })
-      .mockResolvedValueOnce(null);
-    const result = await service.getDetails('msg-1', 'u1');
-    expect(result.message.autofix_sibling).toBeNull();
-  });
-
   it('does not expose a request-level recording or restore legacy trace payloads', async () => {
     const result = (await service.getDetails('msg-1', 'u1')) as unknown as Record<string, unknown>;
 
@@ -310,7 +264,6 @@ describe('MessageDetailsService', () => {
       agent_name: 'my-agent',
       requested_model: 'requested-model',
       status: 'ok',
-      autofix_status: 'retry_failed',
       error_message: null,
       error_code: null,
       error_http_status: null,
@@ -352,8 +305,6 @@ describe('MessageDetailsService', () => {
         cache_creation_tokens: 4,
         cost_usd: 0.12,
         duration_ms: 400,
-        autofix_applied: true,
-        autofix_role: 'retry',
         fallback_from_model: 'gpt-4o',
         fallback_index: 0,
         request_headers: { 'user-agent': 'test-agent' },
@@ -390,8 +341,6 @@ describe('MessageDetailsService', () => {
         trace_id: 'trace-request',
         session_key: 'session-request',
         feedback_tags: ['Accurate', 'Fast'],
-        autofix_applied: true,
-        autofix_status: 'retry_failed',
       }),
     );
     expect(result.message.attempts).toEqual([
@@ -405,7 +354,7 @@ describe('MessageDetailsService', () => {
       wire_format: 'anthropic_messages',
     });
     // The drawer tells each attempt's full story — the projection must carry
-    // the error, fallback, autofix, token and headers/params surface.
+    // the error, fallback, token and headers/params surface.
     expect(result.message.attempts![0]).toEqual(
       expect.objectContaining({
         status: 'error',
@@ -416,8 +365,6 @@ describe('MessageDetailsService', () => {
     );
     expect(result.message.attempts![1]).toEqual(
       expect.objectContaining({
-        autofix_applied: true,
-        autofix_role: 'retry',
         fallback_from_model: 'gpt-4o',
         fallback_index: 0,
         input_tokens: 20,
@@ -503,7 +450,6 @@ describe('MessageDetailsService', () => {
           agent_name: null,
           requested_model: 'gpt-4o',
           status: 'error',
-          autofix_status: null,
           error_message: 'No provider',
           error_code: 'MNFST001',
           error_http_status: 400,
diff --git a/packages/backend/src/analytics/services/message-details.service.ts b/packages/backend/src/analytics/services/message-details.service.ts
index b98de1c1..7c600bb6 100644
--- a/packages/backend/src/analytics/services/message-details.service.ts
+++ b/packages/backend/src/analytics/services/message-details.service.ts
@@ -3,8 +3,7 @@ import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 import { AgentMessage } from '../../entities/agent-message.entity';
 import type { CallerAttribution } from '../../routing/proxy/caller-classifier';
-import type { PhoenixExplanation, PhoenixOperation } from '../../routing/autofix/phoenix.types';
-import { isSuccessStatus, type AutofixStatus, type RequestParamDefaults } from 'manifest-shared';
+import { isSuccessStatus, type RequestParamDefaults } from 'manifest-shared';
 import { ManifestRequest } from '../../entities/request.entity';
 import type { RecordingResponseBody } from '../../routing/proxy/attempt-recording.types';
 import { RequestRecordingStorageService } from '../../common/services/request-recording-storage.service';
@@ -17,7 +16,6 @@ export interface MessageDetailResponse {
     agent_name: string | null;
     model: string | null;
     status: string;
-    autofix_status: AutofixStatus | null;
     error_message: string | null;
     error_code: string | null;
     error_http_status: number | null;
@@ -52,19 +50,6 @@ export interface MessageDetailResponse {
     header_tier_id: string | null;
     header_tier_name: string | null;
     header_tier_color: string | null;
-    autofix_applied: boolean;
-    autofix_role: string | null;
-    autofix_operations: PhoenixOperation[] | null;
-    /** Phoenix's decision behind this provider attempt. */
-    autofix_decision: {
-      status: string | null;
-      issueId: string | null;
-      patchId: string | null;
-      healAttemptId: string | null;
-      explanation?: PhoenixExplanation | null;
-    } | null;
-    /** The paired row (failed original ↔ successful retry), for the visual link. */
-    autofix_sibling: { id: string; role: string | null; status: string } | null;
     attempts?: Array<{
       id: string;
       model: string | null;
@@ -83,10 +68,6 @@ export interface MessageDetailResponse {
       fallback_index: number | null;
       request_headers: Record<string, string> | null;
       request_params: object | null;
-      autofix_applied: boolean;
-      autofix_role: string | null;
-      autofix_operations: object | null;
-      autofix_decision: object | null;
       recording: AttemptRecordingDetail | null;
     }>;
   };
@@ -158,10 +139,6 @@ export class MessageDetailsService {
 
     const recordingsByAttempt = await this.loadAttemptRecordings(attempts);
 
-    const autofix_sibling = message?.autofix_group_id
-      ? await this.findAutofixSibling(message.id, message.autofix_group_id, tenantId)
-      : null;
-
     const inputTokens = request
       ? attempts.reduce((sum, attempt) => sum + attempt.input_tokens, 0)
       : message!.input_tokens;
@@ -190,7 +167,6 @@ export class MessageDetailsService {
         agent_name: request?.agent_name ?? message?.agent_name ?? null,
         model: message?.model ?? request?.requested_model ?? null,
         status: request?.status ?? message!.status,
-        autofix_status: request?.autofix_status ?? null,
         error_message: request?.error_message ?? message?.error_message ?? null,
         error_code: request ? (request.error_code ?? null) : message!.error_code,
         error_http_status: request?.error_http_status ?? message?.error_http_status ?? null,
@@ -226,24 +202,10 @@ export class MessageDetailsService {
         header_tier_id: message?.header_tier_id ?? null,
         header_tier_name: message?.header_tier_name ?? null,
         header_tier_color: message?.header_tier_color ?? null,
-        autofix_applied:
-          attempts.some((attempt) => attempt.autofix_applied) ||
-          (message?.autofix_applied ?? false),
-        autofix_role: message?.autofix_role ?? null,
-        autofix_operations: (message?.autofix_operations as PhoenixOperation[] | null) ?? null,
-        autofix_decision:
-          (message?.autofix_decision as {
-            status: string | null;
-            issueId: string | null;
-            patchId: string | null;
-            healAttemptId: string | null;
-            explanation?: PhoenixExplanation | null;
-          } | null) ?? null,
-        autofix_sibling,
         ...(request
           ? {
               // The drawer renders each attempt's full story (details, error
-              // card, fallback/autofix context cards, headers/params tabs) —
+              // card, fallback context cards, headers/params tabs) —
               // project the whole per-attempt surface, not just the summary.
               attempts: attempts.map((attempt) => ({
                 id: attempt.id,
@@ -263,10 +225,6 @@ export class MessageDetailsService {
                 fallback_index: attempt.fallback_index,
                 request_headers: attempt.request_headers,
                 request_params: attempt.request_params,
-                autofix_applied: attempt.autofix_applied,
-                autofix_role: attempt.autofix_role,
-                autofix_operations: attempt.autofix_operations,
-                autofix_decision: attempt.autofix_decision,
                 recording: recordingsByAttempt.get(attempt.id) ?? null,
               })),
             }
@@ -310,21 +268,4 @@ export class MessageDetailsService {
       return null;
     }
   }
-
-  /** Resolve the paired Autofix row (failed original ↔ successful retry). */
-  private async findAutofixSibling(
-    id: string,
-    groupId: string,
-    tenantId: string,
-  ): Promise<{ id: string; role: string | null; status: string } | null> {
-    const sibling = await this.messageRepo
-      .createQueryBuilder('m')
-      .where('m.autofix_group_id = :groupId', { groupId })
-      .andWhere('m.tenant_id = :tenantId', { tenantId })
-      .andWhere('m.id != :id', { id })
-      .orderBy('m.timestamp', 'DESC')
-      .getOne();
-    if (!sibling) return null;
-    return { id: sibling.id, role: sibling.autofix_role, status: sibling.status };
-  }
 }
diff --git a/packages/backend/src/analytics/services/messages-query.requests.spec.ts b/packages/backend/src/analytics/services/messages-query.requests.spec.ts
index 29171d8f..01326799 100644
--- a/packages/backend/src/analytics/services/messages-query.requests.spec.ts
+++ b/packages/backend/src/analytics/services/messages-query.requests.spec.ts
@@ -315,19 +315,20 @@ describe('MessagesQueryService request-first queries', () => {
       tenantId: 'tenant-1',
       limit: 10,
       connections: ['conn-1'],
-      triggers: ['autofix', 'fallback'],
+      triggers: ['none', 'fallback'],
       include_total: false,
       include_filter_options: false,
     });
 
     const clause = requestQb.andWhere.mock.calls
       .map((call) => String(call[0]))
-      .find((c) => c.includes('trigger_attempt.autofix_applied'));
+      .find((c) => c.includes('trigger_attempt.fallback_from_model'));
     expect(clause).toBeDefined();
     // Both kinds OR together...
-    expect(clause).toContain('trigger_attempt.fallback_from_model IS NOT NULL');
+    expect(clause).toContain('EXISTS');
+    expect(clause).toContain('NOT EXISTS');
     expect(clause).toContain(' OR ');
-    // ...and each recovery attempt must be ON a selected connection.
+    // ...and the fallback attempt must be ON a selected connection.
     expect(clause).toContain('trigger_attempt.tenant_provider_id');
   });
 
@@ -528,7 +529,7 @@ describe('MessagesQueryService request-first queries', () => {
         tenantId: null,
         status: 'ok' as const,
         origin: 'provider' as const,
-        triggers: ['autofix' as const],
+        triggers: ['none' as const],
       },
     ],
     [
@@ -673,15 +674,14 @@ describe('MessagesQueryService request-first queries', () => {
       expect(clause).not.toContain('requestCutoff');
     });
 
-    it('tests "no recovery attempt" as two anti-joins, one per recovery kind', async () => {
+    it('tests "no recovery attempt" as one anti-join on the fallback attempt', async () => {
       const { requestQb } = await run({ tenantId: 'tenant-1', range: '7d', triggers: ['none'] });
 
       const clause = requestQb.andWhere.mock.calls
         .map((call) => String(call[0]))
         .find((c) => c.includes('trigger_attempt'));
-      expect(clause?.match(/NOT EXISTS/g)).toHaveLength(2);
-      expect(clause).toMatch(/autofix_applied = true\s+\)\s+AND NOT EXISTS/);
-      expect(clause).not.toContain('autofix_applied = true OR');
+      expect(clause?.match(/NOT EXISTS/g)).toHaveLength(1);
+      expect(clause).toContain('trigger_attempt.fallback_from_model IS NOT NULL');
     });
 
     it('resolves the harness to its id first so Postgres plans with the value', async () => {
diff --git a/packages/backend/src/analytics/services/messages-query.service.spec.ts b/packages/backend/src/analytics/services/messages-query.service.spec.ts
index cae79939..7564891f 100644
--- a/packages/backend/src/analytics/services/messages-query.service.spec.ts
+++ b/packages/backend/src/analytics/services/messages-query.service.spec.ts
@@ -796,12 +796,12 @@ describe('MessagesQueryService', () => {
     [
       'failed',
       'at.status IN (:...failedStatuses)',
-      { failedStatuses: ['error', 'fallback_error', 'rate_limited', 'auto_fixed', 'failed'] },
+      { failedStatuses: ['error', 'fallback_error', 'rate_limited', 'failed'] },
     ],
     [
       'errors',
       'at.status IN (:...errorStatuses)',
-      { errorStatuses: ['error', 'fallback_error', 'rate_limited', 'auto_fixed', 'failed'] },
+      { errorStatuses: ['error', 'fallback_error', 'rate_limited', 'failed'] },
     ],
     ['ok', "at.status IN ('ok', 'success')", undefined],
   ])('passes %s status filter through to the query builder', async (status, clause, bindings) => {
@@ -855,23 +855,8 @@ describe('MessagesQueryService', () => {
     return andWhereSpy;
   }
 
-  it('filters autofix trigger rows by retry role', async () => {
-    const andWhereSpy = await runWithTrigger('autofix');
-    const triggerCall = andWhereSpy.mock.calls.find(
-      ([clause]) => clause === 'at.autofix_role = :triggerAutofixRole',
-    );
-    expect(triggerCall).toBeDefined();
-    expect(triggerCall?.[1]).toEqual({ triggerAutofixRole: 'retry' });
-  });
-
-  it('filters fallback trigger rows while preserving autofix precedence', async () => {
+  it('filters fallback trigger rows', async () => {
     const andWhereSpy = await runWithTrigger('fallback');
-    expect(
-      andWhereSpy.mock.calls.find(
-        ([clause]) =>
-          clause === '(at.autofix_role IS NULL OR at.autofix_role != :triggerAutofixRole)',
-      )?.[1],
-    ).toEqual({ triggerAutofixRole: 'retry' });
     expect(
       andWhereSpy.mock.calls.find(
         ([clause]) =>
@@ -882,12 +867,6 @@ describe('MessagesQueryService', () => {
 
   it('filters ordinary rows with no trigger badge', async () => {
     const andWhereSpy = await runWithTrigger('none');
-    expect(
-      andWhereSpy.mock.calls.find(
-        ([clause]) =>
-          clause === '(at.autofix_role IS NULL OR at.autofix_role != :triggerAutofixRole)',
-      )?.[1],
-    ).toEqual({ triggerAutofixRole: 'retry' });
     expect(
       andWhereSpy.mock.calls.find(
         ([clause]) => clause === "(at.fallback_from_model IS NULL OR at.fallback_from_model = '')",
@@ -1118,7 +1097,7 @@ describe('MessagesQueryService', () => {
       range: '24h',
       tenantId: 'test-user',
       limit: 20,
-      triggers: ['fallback'],
+      triggers: ['none'],
       include_filter_options: false,
     });
 
@@ -1131,7 +1110,7 @@ describe('MessagesQueryService', () => {
       range: '24h',
       tenantId: 'test-user',
       limit: 20,
-      triggers: ['autofix'],
+      triggers: ['fallback'],
       cursor: '2026-02-16 10:00:00|msg-1',
       include_filter_options: false,
     });
diff --git a/packages/backend/src/analytics/services/messages-query.service.ts b/packages/backend/src/analytics/services/messages-query.service.ts
index 2528d0ce..f229a4bb 100644
--- a/packages/backend/src/analytics/services/messages-query.service.ts
+++ b/packages/backend/src/analytics/services/messages-query.service.ts
@@ -36,7 +36,6 @@ import { HeaderTier } from '../../entities/header-tier.entity';
 // share one definition of an error status (see query-helpers.sqlCountMessages).
 const FAILED_STATUSES = ERROR_MESSAGE_STATUSES;
 const ERROR_STATUSES = ERROR_MESSAGE_STATUSES;
-const AUTOFIX_TRIGGER_ROLE = 'retry';
 
 const MODELS_CACHE_TTL_MS = 5 * 60_000;
 const DISTINCT_MODELS_DEFAULT_INTERVAL = '90 days';
@@ -450,20 +449,14 @@ export class MessagesQueryService {
           AND ${condition}${connScope}
       )`;
       const parts = params.triggers.map((trigger) => {
-        if (trigger === 'autofix') return triggerExists('trigger_attempt.autofix_applied = true');
         if (trigger === 'fallback')
           return triggerExists('trigger_attempt.fallback_from_model IS NOT NULL');
-        // 'none': no recovery attempt anywhere on the request. Two anti-joins
-        // rather than one over `autofix OR fallback`: each kind has its own
-        // partial index, and the OR forced a heap read of every attempt in range.
-        const noAttempt = (condition: string): string => `NOT EXISTS (
+        // 'none': no fallback attempt anywhere on the request.
+        return `NOT EXISTS (
           SELECT 1 FROM agent_messages trigger_attempt
           WHERE trigger_attempt.request_id = r.id AND ${window('trigger_attempt')}
-            AND ${condition}
+            AND trigger_attempt.fallback_from_model IS NOT NULL
         )`;
-        return `(${noAttempt('trigger_attempt.autofix_applied = true')} AND ${noAttempt(
-          'trigger_attempt.fallback_from_model IS NOT NULL',
-        )})`;
       });
       qb.andWhere(`(${parts.join(' OR ')})`, triggerParameters);
     }
@@ -560,7 +553,7 @@ export class MessagesQueryService {
     }
 
     qb.leftJoin(AgentMessage, 'at', 'at.request_id = r.id');
-    const rank = `CASE WHEN ${sqlIsSuccessStatus('at.status')} THEN 3 WHEN NOT COALESCE(at.superseded, false) AND at.status NOT IN ('fallback_error', 'auto_fixed') THEN 2 ELSE 1 END`;
+    const rank = `CASE WHEN ${sqlIsSuccessStatus('at.status')} THEN 3 WHEN NOT COALESCE(at.superseded, false) AND at.status <> 'fallback_error' THEN 2 ELSE 1 END`;
     const picked = (column: string): string =>
       `(ARRAY_AGG(${column} ORDER BY at.attempt_number DESC NULLS LAST, ${rank} DESC, at.timestamp DESC, at.id DESC) FILTER (WHERE at.id IS NOT NULL))[1]`;
     const safeCost = sqlSanitizeCost('at.cost_usd');
@@ -597,11 +590,6 @@ export class MessagesQueryService {
       .addSelect(picked('at.header_tier_color'), 'header_tier_color')
       .addSelect(picked('at.provider_key_label'), 'provider_key_label')
       .addSelect(picked('cp.name'), 'custom_provider_name')
-      .addSelect('COALESCE(BOOL_OR(at.autofix_applied), false)', 'autofix_applied')
-      .addSelect(
-        `CASE WHEN COALESCE(BOOL_OR(at.autofix_applied), false) THEN 'retry' ELSE NULL END`,
-        'autofix_role',
-      )
       .addSelect('COALESCE(SUM(at.cache_read_tokens), 0)', 'cache_read_tokens')
       .addSelect('COALESCE(SUM(at.cache_creation_tokens), 0)', 'cache_creation_tokens')
       .addSelect('COUNT(at.id)::int', 'attempt_count')
@@ -984,28 +972,16 @@ export class MessagesQueryService {
     if (!triggers?.length) return;
     if (triggers.length > 1) {
       // Attempt-grain OR of the selected kinds.
-      const conditions = triggers.map((t) => {
-        if (t === 'autofix') return 'at.autofix_role = :triggerAutofixRole';
-        if (t === 'fallback')
-          return "(COALESCE(at.autofix_role, '') != :triggerAutofixRole AND at.fallback_from_model IS NOT NULL AND at.fallback_from_model != '')";
-        return "(COALESCE(at.autofix_role, '') != :triggerAutofixRole AND (at.fallback_from_model IS NULL OR at.fallback_from_model = ''))";
-      });
-      qb.andWhere(`(${conditions.join(' OR ')})`, { triggerAutofixRole: AUTOFIX_TRIGGER_ROLE });
+      const conditions = triggers.map((t) =>
+        t === 'fallback'
+          ? "(at.fallback_from_model IS NOT NULL AND at.fallback_from_model != '')"
+          : "(at.fallback_from_model IS NULL OR at.fallback_from_model = '')",
+      );
+      qb.andWhere(`(${conditions.join(' OR ')})`);
       return;
     }
     const trigger = triggers[0];
 
-    if (trigger === 'autofix') {
-      qb.andWhere('at.autofix_role = :triggerAutofixRole', {
-        triggerAutofixRole: AUTOFIX_TRIGGER_ROLE,
-      });
-      return;
-    }
-
-    qb.andWhere('(at.autofix_role IS NULL OR at.autofix_role != :triggerAutofixRole)', {
-      triggerAutofixRole: AUTOFIX_TRIGGER_ROLE,
-    });
-
     if (trigger === 'fallback') {
       qb.andWhere("at.fallback_from_model IS NOT NULL AND at.fallback_from_model != ''");
     } else {
diff --git a/packages/backend/src/analytics/services/query-helpers.spec.ts b/packages/backend/src/analytics/services/query-helpers.spec.ts
index b1203ec4..6927a19c 100644
--- a/packages/backend/src/analytics/services/query-helpers.spec.ts
+++ b/packages/backend/src/analytics/services/query-helpers.spec.ts
@@ -532,20 +532,13 @@ describe('selectMessageRowColumns', () => {
     expect(nameCall).toEqual(['cp.name', 'custom_provider_name']);
   });
 
-  it('projects autofix_applied and autofix_role for Autofix rendering', () => {
+  it('projects no repair columns', () => {
     const { qb, addSelectCalls } = makeMockQb();
     selectMessageRowColumns(qb, 'cost');
 
-    expect(addSelectCalls.find(([, a]) => a === 'autofix_applied')).toEqual([
-      'at.autofix_applied',
-      'autofix_applied',
-    ]);
-    expect(addSelectCalls.find(([, a]) => a === 'autofix_role')).toEqual([
-      'at.autofix_role',
-      'autofix_role',
-    ]);
-    expect(MESSAGE_ROW_SELECT_ALIASES).toContain('autofix_applied');
-    expect(MESSAGE_ROW_SELECT_ALIASES).toContain('autofix_role');
+    const aliases = addSelectCalls.map(([, alias]) => alias);
+    expect(aliases.filter((alias) => String(alias).startsWith('auto'))).toEqual([]);
+    expect(MESSAGE_ROW_SELECT_ALIASES.filter((alias) => alias.startsWith('auto'))).toEqual([]);
   });
 
   it('keys the join on the custom:-prefixed provider id', () => {
@@ -571,13 +564,7 @@ describe('sqlCountMessages', () => {
   });
 
   it('keeps the shared error-status set for request log filters', () => {
-    expect(ERROR_MESSAGE_STATUSES).toEqual([
-      'error',
-      'fallback_error',
-      'rate_limited',
-      'auto_fixed',
-      'failed',
-    ]);
+    expect(ERROR_MESSAGE_STATUSES).toEqual(['error', 'fallback_error', 'rate_limited', 'failed']);
   });
 });
 
diff --git a/packages/backend/src/analytics/services/query-helpers.ts b/packages/backend/src/analytics/services/query-helpers.ts
index a5a5732b..833ef400 100644
--- a/packages/backend/src/analytics/services/query-helpers.ts
+++ b/packages/backend/src/analytics/services/query-helpers.ts
@@ -32,20 +32,15 @@ export function computeTrend(current: number, previous: number): number {
  * "what is an error" — consumed both by the Messages-log error filter and by
  * every "messages" KPI count below, so the two notions can never drift.
  */
-// `auto_fixed` is the failed-original row of a healed Autofix pair; its paired
-// `ok` retry row is the real success, so the original is excluded here to avoid
-// double-counting one logical request.
-//
-// Both vocabularies are listed on purpose: `error`/`rate_limited`/`fallback_error`/
-// `auto_fixed` are the legacy values still present on historical rows and on writes
-// from not-yet-drained replicas, while `failed` is the canonical value new writes
+// Both vocabularies are listed on purpose: `error`/`rate_limited`/`fallback_error`
+// are the legacy values still present on historical rows and on writes from
+// not-yet-drained replicas, while `failed` is the canonical value new writes
 // use. Listing both keeps the "real message" count correct across the transition —
 // the reason a row failed now lives on `error_class` / `superseded`, not on `status`.
 export const ERROR_MESSAGE_STATUSES = [
   'error',
   'fallback_error',
   'rate_limited',
-  'auto_fixed',
   'failed',
 ] as const;
 
@@ -399,8 +394,6 @@ export const MESSAGE_ROW_SELECT_ALIASES = [
   'header_tier_color',
   'provider_key_label',
   'custom_provider_name',
-  'autofix_applied',
-  'autofix_role',
 ] as const;
 
 export function selectMessageRowColumns<T extends ObjectLiteral>(
@@ -436,7 +429,5 @@ export function selectMessageRowColumns<T extends ObjectLiteral>(
     .addSelect('at.header_tier_name', 'header_tier_name')
     .addSelect('at.header_tier_color', 'header_tier_color')
     .addSelect('at.provider_key_label', 'provider_key_label')
-    .addSelect('cp.name', 'custom_provider_name')
-    .addSelect('at.autofix_applied', 'autofix_applied')
-    .addSelect('at.autofix_role', 'autofix_role');
+    .addSelect('cp.name', 'custom_provider_name');
 }
diff --git a/packages/backend/src/analytics/services/reliability-stats.service.spec.ts b/packages/backend/src/analytics/services/reliability-stats.service.spec.ts
new file mode 100644
index 00000000..902fe83e
--- /dev/null
+++ b/packages/backend/src/analytics/services/reliability-stats.service.spec.ts
@@ -0,0 +1,229 @@
+import { ReliabilityStatsService } from './reliability-stats.service';
+
+const queryBuilder = () => {
+  const qb = {
+    select: jest.fn(),
+    addSelect: jest.fn(),
+    where: jest.fn(),
+    andWhere: jest.fn(),
+    leftJoin: jest.fn(),
+    groupBy: jest.fn(),
+    addGroupBy: jest.fn(),
+    orderBy: jest.fn(),
+    limit: jest.fn(),
+    getRawOne: jest.fn(),
+    getRawMany: jest.fn(),
+  };
+  for (const key of [
+    'select',
+    'addSelect',
+    'where',
+    'andWhere',
+    'leftJoin',
+    'groupBy',
+    'addGroupBy',
+    'orderBy',
+    'limit',
+  ] as const) {
+    qb[key].mockReturnValue(qb);
+  }
+  return qb;
+};
+
+describe('ReliabilityStatsService', () => {
+  const messageRepo = { createQueryBuilder: jest.fn() };
+  const emptyTotals = { total: 0, success: 0, fallback: 0, error: 0 };
+  const requestVolume = {
+    getDispositionTimeseries: jest.fn().mockResolvedValue([]),
+    getDispositionTotalsForWindows: jest.fn(),
+    getVolumeByDimension: jest.fn().mockResolvedValue([]),
+  };
+  let service: ReliabilityStatsService;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    messageRepo.createQueryBuilder.mockReset();
+    requestVolume.getDispositionTimeseries.mockResolvedValue([]);
+    requestVolume.getDispositionTotalsForWindows.mockResolvedValue({
+      current: emptyTotals,
+      previous: emptyTotals,
+    });
+    requestVolume.getVolumeByDimension.mockResolvedValue([]);
+    service = new ReliabilityStatsService(messageRepo as never, requestVolume as never);
+  });
+
+  it('computes request reliability stats for the current and previous windows', async () => {
+    // ONE terminal-CTE scan yields both windows; getStats derives the KPI
+    // counts from that single result instead of scanning twice.
+    requestVolume.getDispositionTotalsForWindows.mockResolvedValue({
+      current: { total: 10, success: 7, fallback: 1, error: 2 },
+      previous: { total: 4, success: 2, fallback: 0, error: 2 },
+    });
+
+    await expect(
+      service.getStats({ tenantId: 'tenant', range: '30d', agentName: 'agent' }),
+    ).resolves.toEqual({
+      success_rate: { value: 0.8, previous: 0.5 },
+      fallback_saves: { value: 1, previous: 0 },
+      total_requests: { value: 10, previous: 4 },
+      errors_remaining: { value: 2, previous: 2 },
+    });
+    expect(requestVolume.getDispositionTotalsForWindows).toHaveBeenCalledTimes(1);
+    expect(requestVolume.getDispositionTotalsForWindows).toHaveBeenCalledWith({
+      tenantId: 'tenant',
+      from: expect.any(String),
+      splitAt: expect.any(String),
+      to: expect.any(String),
+      agentName: 'agent',
+    });
+    // The stats never scan attempts directly.
+    expect(messageRepo.createQueryBuilder).not.toHaveBeenCalled();
+  });
+
+  it('reports a zero success rate for an idle window', async () => {
+    await expect(service.getStats({ tenantId: 'tenant' })).resolves.toEqual({
+      success_rate: { value: 0, previous: 0 },
+      fallback_saves: { value: 0, previous: 0 },
+      total_requests: { value: 0, previous: 0 },
+      errors_remaining: { value: 0, previous: 0 },
+    });
+  });
+
+  it('maps per-provider, per-agent and per-model reliability rows', async () => {
+    // Provider and model tables live in the ATTEMPT world: every provider
+    // call counts by its own outcome.
+    const providerQb = queryBuilder();
+    providerQb.getRawMany.mockResolvedValue([
+      {
+        provider: 'openai',
+        auth_type: 'subscription',
+        key_label: 'Default',
+        attempts: '12',
+        failed: '3',
+        succeeded: '9',
+      },
+    ]);
+    requestVolume.getVolumeByDimension.mockResolvedValue([
+      { key: 'demo', requests: 8, failed: 2, fallback: 2, succeeded: 6 },
+    ]);
+    messageRepo.createQueryBuilder.mockReturnValueOnce(providerQb);
+
+    await expect(
+      service.getPerProviderStats({ tenantId: 'tenant', agentName: 'demo' }),
+    ).resolves.toEqual([
+      {
+        provider: 'openai',
+        auth_type: 'subscription',
+        key_label: 'Default',
+        attempts: 12,
+        failed: 3,
+        succeeded: 9,
+      },
+    ]);
+    // Connection grain: grouped by provider + folded auth_type + folded label.
+    const providerGroupSql = providerQb.addGroupBy.mock.calls.flat().join(' ');
+    expect(providerGroupSql).toContain("COALESCE(at.auth_type, 'api_key')");
+    expect(providerGroupSql).toContain("COALESCE(at.provider_key_label, 'Default')");
+    const providerSql = providerQb.addSelect.mock.calls.flat().join(' ');
+    // Canonical success and legacy NULL/ok remain compatible.
+    expect(providerSql).toContain("at.status IN ('ok', 'success')");
+    expect(providerSql).toContain("at.status NOT IN ('pending', 'cancelled', 'ok', 'success')");
+
+    // The harness table stays in the REQUEST world.
+    await expect(service.getPerAgentStats({ tenantId: 'tenant' })).resolves.toEqual([
+      { agent_name: 'demo', requests: 8, failed: 2, fallback_saves: 2, succeeded: 6 },
+    ]);
+    expect(requestVolume.getVolumeByDimension).toHaveBeenCalledWith('agent_name', {
+      tenantId: 'tenant',
+    });
+
+    const modelQb = queryBuilder();
+    modelQb.getRawMany.mockResolvedValue([
+      { model: 'gpt-4o', attempts: '6', failed: '1', succeeded: '5' },
+    ]);
+    messageRepo.createQueryBuilder.mockReturnValueOnce(modelQb);
+    await expect(
+      service.getPerModelStats({ tenantId: 'tenant', agentName: 'demo' }),
+    ).resolves.toEqual([{ model: 'gpt-4o', attempts: 6, failed: 1, succeeded: 5 }]);
+  });
+
+  it('builds hourly failed-only timeseries and preserves disposition order', async () => {
+    // #2511: the disposition dimension counts logical requests via the
+    // request-volume service (terminal-attempt attribution), not attempts.
+    requestVolume.getDispositionTimeseries.mockResolvedValue([
+      { bucket: '2026-01-01 10:00:00', dim: 'error', count: '2' },
+      { bucket: '2026-01-01 10:00:00', dim: 'fallback', count: '1' },
+      { bucket: '2026-01-01 10:00:00', dim: 'success', count: '5' },
+      { bucket: '2026-01-01 11:00:00', dim: 'success', count: '1' },
+      { bucket: '2026-01-01 10:00:00', dim: null, count: '3' },
+    ]);
+
+    await expect(
+      service.getTimeseries({
+        tenantId: 'tenant',
+        range: '24h',
+        by: 'invalid',
+        failedOnly: true,
+      }),
+    ).resolves.toEqual({
+      range: '24h',
+      by: 'disposition',
+      keys: ['success', 'fallback', 'error', 'unknown'],
+      buckets: [
+        { bucket: '2026-01-01 10:00:00', counts: [5, 1, 2, 3] },
+        { bucket: '2026-01-01 11:00:00', counts: [1, 0, 0, 0] },
+      ],
+    });
+    expect(requestVolume.getDispositionTimeseries).toHaveBeenCalledWith({
+      tenantId: 'tenant',
+      range: '24h',
+      hourly: true,
+      agentName: undefined,
+      failedOnly: true,
+    });
+    // The disposition path never scans attempts directly.
+    expect(messageRepo.createQueryBuilder).not.toHaveBeenCalled();
+  });
+
+  it.each(['http_status', 'provider', 'error_kind'])(
+    'supports the %s timeseries dimension',
+    async (by) => {
+      const qb = queryBuilder();
+      qb.getRawMany.mockResolvedValue([
+        { bucket: '2026-01-02', dim: 'zeta', count: '1' },
+        { bucket: '2026-01-01', dim: 'alpha', count: '2' },
+      ]);
+      messageRepo.createQueryBuilder.mockReturnValue(qb);
+      const result = await service.getTimeseries({ tenantId: null, range: '7d', by });
+      expect(result.by).toBe(by);
+      expect(result.keys).toEqual(['alpha', 'zeta']);
+      expect(result.buckets[0]!.bucket).toBe('2026-01-01');
+      expect(qb.addSelect.mock.calls[0]![0]).toEqual(expect.any(String));
+    },
+  );
+
+  it('falls back to the disposition view for a dimension it no longer serves', async () => {
+    const result = await service.getTimeseries({ tenantId: 'tenant', range: '7d', by: 'healed' });
+
+    expect(result.by).toBe('disposition');
+    expect(requestVolume.getDispositionTimeseries).toHaveBeenCalled();
+  });
+
+  it('derives window counts from the request-level disposition totals', () => {
+    const internals = service as unknown as {
+      windowCounts: (t: {
+        total: number;
+        success: number;
+        fallback: number;
+        error: number;
+      }) => unknown;
+    };
+    // ONE definition: the KPI window reads the same reducer as the chart.
+    expect(internals.windowCounts({ total: 100, success: 74, fallback: 6, error: 20 })).toEqual({
+      total: 100,
+      successes: 80, // success + recovered by fallback
+      fallback_saves: 6,
+      errors: 20,
+    });
+  });
+});
diff --git a/packages/backend/src/analytics/services/autofix-stats.service.ts b/packages/backend/src/analytics/services/reliability-stats.service.ts
similarity index 50%
rename from packages/backend/src/analytics/services/autofix-stats.service.ts
rename to packages/backend/src/analytics/services/reliability-stats.service.ts
index 24194f5e..d82c5fdc 100644
--- a/packages/backend/src/analytics/services/autofix-stats.service.ts
+++ b/packages/backend/src/analytics/services/reliability-stats.service.ts
@@ -1,13 +1,7 @@
 import { Injectable } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
-import { IsNull, Repository } from 'typeorm';
-import { Agent } from '../../entities/agent.entity';
+import { Repository } from 'typeorm';
 import { AgentMessage } from '../../entities/agent-message.entity';
-import { ManifestRequest } from '../../entities/request.entity';
-import { AutofixService } from '../../routing/autofix/autofix.service';
-import { InstallMetadata } from '../../entities/install-metadata.entity';
-import { isSelfHosted } from '../../common/utils/detect-self-hosted';
-import { v4 as uuid } from 'uuid';
 import {
   rangeToInterval,
   rangeToPreviousInterval,
@@ -23,56 +17,24 @@ import {
 } from './query-helpers';
 import { RequestVolumeService, type DispositionTotals } from './request-volume.service';
 
-export interface AutofixStatusResponse {
-  /** At least one agent is effectively enabled after deployment-mode defaults. */
-  any_enabled: boolean;
-  /** Names of agents effectively enabled after deployment-mode defaults. */
-  enabled_agents: string[];
-  /** Names of agents effectively disabled after deployment-mode defaults. */
-  disabled_agents: string[];
-  /** Legacy agents need the one-time fleet enable action. */
-  needs_enable_all: boolean;
-  /**
-   * Self-hosted consent-once. Cloud always reports true (no gate). False only
-   * when the install has never confirmed the enable modal.
-   */
-  consented: boolean;
-}
-
-export interface AutofixStatsResponse {
+export interface ReliabilityStatsResponse {
   success_rate: { value: number; previous: number };
-  autofix_saves: { value: number; previous: number };
-  /** Additive: requests recovered by a successful fallback attempt. */
+  /** Requests recovered by a successful fallback attempt. */
   fallback_saves: { value: number; previous: number };
-  /** Additive: window total, denominator for the self-healed share. */
+  /** Window total, denominator for the recovered-requests share. */
   total_requests: { value: number; previous: number };
   errors_remaining: { value: number; previous: number };
-  coverage: { rate: number; previous_rate: number };
-  dispositions: {
-    healed: number;
-    no_fix_found: number;
-    resolving: number;
-    ineffective: number;
-  };
-  needs_attention: Array<{
-    error_message: string;
-    provider: string;
-    model: string;
-    count: number;
-    phoenix_issue_id: string | null;
-  }>;
 }
 
-export const AUTOFIX_TS_DIMENSIONS = [
+export const RELIABILITY_TS_DIMENSIONS = [
   'disposition',
   'http_status',
   'provider',
   'error_kind',
-  'autofix',
 ] as const;
-export type AutofixTsDimension = (typeof AUTOFIX_TS_DIMENSIONS)[number];
+export type ReliabilityTsDimension = (typeof RELIABILITY_TS_DIMENSIONS)[number];
 
-export interface AutofixTimeseriesResponse {
+export interface ReliabilityTimeseriesResponse {
   range: string;
   by: string;
   keys: string[];
@@ -82,158 +44,49 @@ export interface AutofixTimeseriesResponse {
 interface WindowCounts {
   total: number;
   successes: number;
-  saves: number;
   fallback_saves: number;
   errors: number;
-  healed: number;
-  no_fix_found: number;
-  resolving: number;
-  ineffective: number;
 }
 
+/**
+ * Generic request reliability for the dashboard: success rate, fallback
+ * recoveries, request status over time, and per-harness/provider/model
+ * reliability. Served under `/api/v1/overview/reliability/*`.
+ */
 @Injectable()
-export class AutofixStatsService {
+export class ReliabilityStatsService {
   constructor(
-    @InjectRepository(Agent)
-    private readonly agentRepo: Repository<Agent>,
     @InjectRepository(AgentMessage)
     private readonly messageRepo: Repository<AgentMessage>,
-    @InjectRepository(InstallMetadata)
-    private readonly installMetadataRepo: Repository<InstallMetadata>,
-    private readonly autofix: AutofixService,
     private readonly requestVolume: RequestVolumeService,
   ) {}
 
-  async getWorkspaceStatus(tenantId: string | null): Promise<AutofixStatusResponse> {
-    if (!tenantId) {
-      return {
-        any_enabled: false,
-        enabled_agents: [],
-        disabled_agents: [],
-        needs_enable_all: false,
-        consented: await this.hasConsent(),
-      };
-    }
-
-    const agents = await this.agentRepo.find({
-      where: { tenant_id: tenantId, deleted_at: IsNull(), is_playground: false },
-      select: ['name', 'autofix_enabled'],
-    });
-    const enabledAgents: string[] = [];
-    const disabledAgents: string[] = [];
-    for (const agent of agents) {
-      (this.autofix.resolveEnabled(agent.autofix_enabled) ? enabledAgents : disabledAgents).push(
-        agent.name,
-      );
-    }
-
-    const consented = await this.hasConsent();
-    return {
-      any_enabled: enabledAgents.length > 0,
-      enabled_agents: enabledAgents,
-      disabled_agents: disabledAgents,
-      // The fleet CTA is a one-time onboarding nudge, so it takes all three
-      // terms: nothing is enabled, the install has never consented, and some
-      // agent never made an explicit choice.
-      //
-      // `autofix_enabled IS NULL` on its own is NOT a "row predates the
-      // feature" marker — NULL is the deliberate "inherit the deployment-mode
-      // default" state (see AutofixService.resolveEnabled, and migration
-      // 1799000300000 which reset pre-feature rows *to* NULL for exactly that
-      // reason). Only the create dialog sends an explicit choice; agents
-      // onboarded over OTLP, or by API clients that omit the field, still
-      // store NULL. Without the consent term those installs get re-prompted
-      // after they have already decided.
-      needs_enable_all:
-        enabledAgents.length === 0 &&
-        !consented &&
-        agents.some((agent) => agent.autofix_enabled == null),
-      consented,
-    };
-  }
-
-  /**
-   * Enable Autofix for every non-playground agent in the tenant and record
-   * the install's once-consent. Used by the sidebar fleet CTA — not by the
-   * per-agent toggle, which only ever touches one agent.
-   */
-  async enableAll(tenantId: string): Promise<AutofixStatusResponse> {
-    // Match getWorkspaceStatus: only live, non-playground agents. Soft-deleted
-    // rows must keep whatever they had — resurrecting them later shouldn't
-    // surprise the operator with Autofix flipped on.
-    await this.agentRepo.update(
-      { tenant_id: tenantId, is_playground: false, deleted_at: IsNull() },
-      { autofix_enabled: true },
-    );
-    await this.recordAutofixConsent();
-    return this.getWorkspaceStatus(tenantId);
-  }
-
-  private async hasConsent(): Promise<boolean> {
-    if (!isSelfHosted()) return true;
-    const row = await this.installMetadataRepo.findOne({ where: { id: 'singleton' } });
-    return row?.autofix_consented_at != null;
-  }
-
-  async recordAutofixConsent(): Promise<void> {
-    if (!isSelfHosted()) return;
-    if (await this.hasConsent()) return;
-    await this.installMetadataRepo
-      .createQueryBuilder()
-      .insert()
-      .into(InstallMetadata)
-      .values({
-        id: 'singleton',
-        install_id: uuid(),
-        autofix_consented_at: new Date().toISOString(),
-      })
-      .orUpdate(['autofix_consented_at'], ['id'])
-      .execute();
-  }
-
   async getStats(params: {
     tenantId: string | null;
     range?: string;
     agentName?: string;
-  }): Promise<AutofixStatsResponse> {
+  }): Promise<ReliabilityStatsResponse> {
     const range = params.range ?? '7d';
     const cutoff = computeCutoff(rangeToInterval(range));
     const prevCutoff = computeCutoff(rangeToPreviousInterval(range));
 
-    const [windows, attention] = await Promise.all([
-      this.requestVolume.getDispositionTotalsForWindows({
-        tenantId: params.tenantId,
-        from: prevCutoff,
-        splitAt: cutoff,
-        to: computeCutoff('0 hours'),
-        agentName: params.agentName,
-      }),
-      this.queryNeedsAttention(cutoff, params.tenantId, params.agentName),
-    ]);
+    const windows = await this.requestVolume.getDispositionTotalsForWindows({
+      tenantId: params.tenantId,
+      from: prevCutoff,
+      splitAt: cutoff,
+      to: computeCutoff('0 hours'),
+      agentName: params.agentName,
+    });
     const current = this.windowCounts(windows.current);
     const previous = this.windowCounts(windows.previous);
 
     const rate = (c: WindowCounts) => (c.total > 0 ? c.successes / c.total : 0);
-    const afxTotal = (c: WindowCounts) => c.healed + c.no_fix_found + c.resolving + c.ineffective;
-    const covRate = (c: WindowCounts) => {
-      const d = afxTotal(c);
-      return d > 0 ? c.healed / d : 0;
-    };
 
     return {
       success_rate: { value: rate(current), previous: rate(previous) },
-      autofix_saves: { value: current.saves, previous: previous.saves },
       fallback_saves: { value: current.fallback_saves, previous: previous.fallback_saves },
       total_requests: { value: current.total, previous: previous.total },
       errors_remaining: { value: current.errors, previous: previous.errors },
-      coverage: { rate: covRate(current), previous_rate: covRate(previous) },
-      dispositions: {
-        healed: current.healed,
-        no_fix_found: current.no_fix_found,
-        resolving: current.resolving,
-        ineffective: current.ineffective,
-      },
-      needs_attention: attention,
     };
   }
 
@@ -241,8 +94,8 @@ export class AutofixStatsService {
    * Attempt-world reliability per CONNECTION: every provider call counts
    * where it ran, by its own outcome, at the grain the dashboards render a
    * row for — (provider, auth_type, key label). Legacy folds match the usage
-   * lists: NULL auth_type reads api_key, NULL label reads Default. Healing is
-   * a request concept and deliberately absent here.
+   * lists: NULL auth_type reads api_key, NULL label reads Default. Fallback
+   * recovery is a request concept and deliberately absent here.
    */
   async getPerProviderStats(params: {
     tenantId: string | null;
@@ -302,7 +155,6 @@ export class AutofixStatsService {
       agent_name: string;
       requests: number;
       failed: number;
-      autofixed: number;
       fallback_saves: number;
       succeeded: number;
     }>
@@ -312,7 +164,6 @@ export class AutofixStatsService {
       agent_name: v.key,
       requests: v.requests,
       failed: v.failed,
-      autofixed: v.healed,
       fallback_saves: v.fallback,
       succeeded: v.succeeded,
     }));
@@ -320,7 +171,7 @@ export class AutofixStatsService {
 
   /**
    * Attempt-world reliability per model: total attempts and their outcomes.
-   * A model is not healed; it acts. Feeds the Model usage tables.
+   * Feeds the Model usage tables.
    */
   async getPerModelStats(params: {
     tenantId: string | null;
@@ -369,10 +220,10 @@ export class AutofixStatsService {
     by?: string;
     agentName?: string;
     failedOnly?: boolean;
-  }): Promise<AutofixTimeseriesResponse> {
+  }): Promise<ReliabilityTimeseriesResponse> {
     const range = params.range ?? '7d';
-    const by = (AUTOFIX_TS_DIMENSIONS as readonly string[]).includes(params.by ?? '')
-      ? (params.by as AutofixTsDimension)
+    const by = (RELIABILITY_TS_DIMENSIONS as readonly string[]).includes(params.by ?? '')
+      ? (params.by as ReliabilityTsDimension)
       : 'disposition';
     const cutoff = computeCutoff(rangeToInterval(range));
     const hourly = isHourlyRange(range);
@@ -401,8 +252,7 @@ export class AutofixStatsService {
       .addSelect(dimExpr, 'dim')
       .addSelect('COUNT(*)', 'count')
       .where('at.timestamp >= :cutoff', { cutoff })
-      .andWhere(sqlIsCompletedStatus('at.status'))
-      .andWhere("(at.autofix_role IS NULL OR at.autofix_role != 'retry')");
+      .andWhere(sqlIsCompletedStatus('at.status'));
 
     if (params.failedOnly) {
       qb.andWhere(sqlIsFailedStatus('at.status'));
@@ -416,11 +266,10 @@ export class AutofixStatsService {
     return this.pivotTimeseries(range, by, rows);
   }
 
-  private dimensionExpr(by: AutofixTsDimension): string {
+  private dimensionExpr(by: ReliabilityTsDimension): string {
     switch (by) {
       case 'disposition':
         return `CASE
-          WHEN at.status = 'auto_fixed' THEN 'healed'
           WHEN at.status IN ('error','fallback_error','rate_limited') THEN 'error'
           WHEN ${sqlIsSuccessStatus('at.status')} AND at.fallback_from_model IS NOT NULL THEN 'fallback'
           ELSE 'success' END`;
@@ -431,8 +280,6 @@ export class AutofixStatsService {
         return `CASE WHEN at.provider LIKE 'custom:%' THEN 'custom' ELSE at.provider END`;
       case 'error_kind':
         return `COALESCE(at.error_class, 'none')`;
-      case 'autofix':
-        return `CASE WHEN at.autofix_applied = true THEN 'auto-fixed' ELSE 'not fixed' END`;
     }
   }
 
@@ -440,7 +287,7 @@ export class AutofixStatsService {
     range: string,
     by: string,
     rows: Array<{ bucket: string; dim: string | null; count: string }>,
-  ): AutofixTimeseriesResponse {
+  ): ReliabilityTimeseriesResponse {
     const keySet = new Set<string>();
     const bucketMap = new Map<string, Map<string, number>>();
     for (const r of rows) {
@@ -453,12 +300,11 @@ export class AutofixStatsService {
       }
       m.set(dim, (m.get(dim) ?? 0) + Number(r.count));
     }
-    // For disposition, use a fixed order: success → autofix → fallback → error.
+    // For disposition, use a fixed order: success → fallback → error.
     const DISPOSITION_ORDER: Record<string, number> = {
       success: 0,
-      autofix: 1,
-      fallback: 2,
-      error: 3,
+      fallback: 1,
+      error: 2,
     };
     const keys =
       by === 'disposition'
@@ -475,75 +321,17 @@ export class AutofixStatsService {
 
   /**
    * KPI window counts, read from the SAME request-level reducer as the
-   * By request status chart (one request, one disposition; Recovered by
-   * Autofix = requests.autofix_status = 'retry_succeeded'). One definition,
+   * By request status chart (one request, one disposition). One definition,
    * every surface. Pure — the window totals come from a single
    * `getDispositionTotalsForWindows` scan for both the current and previous
-   * window, so the KPI no longer scans the request/attempt window twice.
+   * window.
    */
   private windowCounts(t: DispositionTotals): WindowCounts {
     return {
       total: t.total,
-      successes: t.success + t.healed + t.fallback,
-      saves: t.healed,
+      successes: t.success + t.fallback,
       fallback_saves: t.fallback,
       errors: t.error,
-      healed: t.healed,
-      no_fix_found: t.error,
-      resolving: 0,
-      ineffective: 0,
     };
   }
-
-  private async queryNeedsAttention(
-    cutoff: string,
-    tenantId: string | null,
-    agentName?: string,
-  ): Promise<AutofixStatsResponse['needs_attention']> {
-    const qb = this.messageRepo
-      .createQueryBuilder('at')
-      .leftJoin(ManifestRequest, 'r', 'r.id = at.request_id')
-      .select('LEFT(at.error_message, 200)', 'error_message')
-      .addSelect('at.provider', 'provider')
-      .addSelect('at.model', 'model')
-      .addSelect('COUNT(*)', 'count')
-      .addSelect("(at.autofix_phoenix->>'issueId')::text", 'phoenix_issue_id')
-      .where('at.timestamp >= :cutoff', { cutoff })
-      .andWhere("(at.autofix_role = 'original' OR at.status = 'auto_fixed')")
-      .andWhere(sqlIsFailedStatus('at.status'))
-      .andWhere("(r.autofix_status IS NULL OR r.autofix_status <> 'retry_succeeded')")
-      .andWhere(
-        `(r.id IS NOT NULL OR NOT EXISTS (
-          SELECT 1 FROM agent_messages sib
-          WHERE sib.autofix_group_id = at.autofix_group_id
-            AND sib.tenant_id = at.tenant_id
-            AND sib.autofix_role = 'retry'
-            AND ${sqlIsSuccessStatus('sib.status')}
-        ))`,
-      )
-      .groupBy('LEFT(at.error_message, 200)')
-      .addGroupBy('at.provider')
-      .addGroupBy('at.model')
-      .addGroupBy("(at.autofix_phoenix->>'issueId')::text")
-      .orderBy('count', 'DESC')
-      .limit(5);
-    addTenantFilter(qb, tenantId, agentName);
-    excludePlaygroundAgents(qb);
-
-    const rows = await qb.getRawMany<{
-      error_message: string | null;
-      provider: string;
-      model: string;
-      count: string;
-      phoenix_issue_id: string | null;
-    }>();
-
-    return rows.map((r) => ({
-      error_message: r.error_message ?? '',
-      provider: r.provider,
-      model: r.model,
-      count: Number(r.count),
-      phoenix_issue_id: r.phoenix_issue_id ?? null,
-    }));
-  }
 }
diff --git a/packages/backend/src/analytics/services/request-volume.service.spec.ts b/packages/backend/src/analytics/services/request-volume.service.spec.ts
index ff5b491e..ce201bde 100644
--- a/packages/backend/src/analytics/services/request-volume.service.spec.ts
+++ b/packages/backend/src/analytics/services/request-volume.service.spec.ts
@@ -24,7 +24,7 @@ describe('RequestVolumeService (#2511 request-level volume)', () => {
     expect(sql).toContain('DISTINCT ON (r.id)');
     // The Requests list's ranking: canonical/legacy success wins, else the terminal failure.
     expect(sql).toContain("pa.status IN ('ok', 'success')");
-    expect(sql).toContain("pa.status NOT IN ('fallback_error', 'auto_fixed') THEN 2");
+    expect(sql).toContain("pa.status <> 'fallback_error' THEN 2");
     // In-flight requests have no outcome to chart.
     expect(sql).toContain("r.status NOT IN ('pending', 'cancelled')");
     // Unlinked legacy attempts stay in the universe (KPI parity).
@@ -38,10 +38,9 @@ describe('RequestVolumeService (#2511 request-level volume)', () => {
   it('maps dispositions from how the request CONCLUDED, one count each', async () => {
     await service.getDispositionTimeseries({ tenantId: 't1', range: '24h', hourly: true });
     const sql = lastSql();
-    // Method is the request-level Autofix outcome; a rescued request counts once.
+    // A rescued request counts once, by the method of its terminal attempt.
     expect(sql).toContain("t.request_status IN ('ok', 'success')");
-    expect(sql).toContain("t.autofix_status = 'retry_succeeded' THEN 'healed'");
-    expect(sql).toContain('r.autofix_status');
+    expect(sql).not.toMatch(/auto_?fix|healed/);
     expect(sql).toContain("t.fallback_from_model IS NOT NULL THEN 'fallback'");
     expect(sql).toContain("THEN 'success'");
     expect(sql).toContain("ELSE 'error'");
@@ -80,12 +79,10 @@ describe('RequestVolumeService (#2511 request-level volume)', () => {
 
   it('computes per-dimension request totals with terminal outcomes', async () => {
     messageRepo.query.mockResolvedValue([
-      { key: 'openai', requests: '10', failed: '2', succeeded: '8', healed: '1', fallback: '2' },
+      { key: 'openai', requests: '10', failed: '2', succeeded: '8', fallback: '2' },
     ]);
     const rows = await service.getVolumeByDimension('provider', { tenantId: 't1', range: '7d' });
-    expect(rows).toEqual([
-      { key: 'openai', requests: 10, failed: 2, succeeded: 8, healed: 1, fallback: 2 },
-    ]);
+    expect(rows).toEqual([{ key: 'openai', requests: 10, failed: 2, succeeded: 8, fallback: 2 }]);
     const sql = lastSql();
     // The trio fold: custom:<uuid> providers group as 'custom'.
     expect(sql).toContain("THEN 'custom'");
@@ -130,8 +127,8 @@ describe('RequestVolumeService (#2511 request-level volume)', () => {
       splitAt: '2026-01-08',
     });
     expect(windows).toEqual({
-      current: { total: 5, success: 3, healed: 0, fallback: 0, error: 2 },
-      previous: { total: 5, success: 4, healed: 0, fallback: 0, error: 1 },
+      current: { total: 5, success: 3, fallback: 0, error: 2 },
+      previous: { total: 5, success: 4, fallback: 0, error: 1 },
     });
     const sql = lastSql();
     // No agent scope: the split is the 4th parameter, after the defaulted `to`.
@@ -146,14 +143,11 @@ describe('RequestVolumeService (#2511 request-level volume)', () => {
     expect(params[1]).toBe('2026-01-01');
     expect(typeof params[2]).toBe('string'); // `to` defaulted to now
     expect(params[3]).toBe('2026-01-08');
-    // Recovered by Autofix reads the materialized request verdict.
-    expect(sql).toContain("t.autofix_status = 'retry_succeeded'");
   });
 
   it('splits current and previous disposition totals from ONE scan', async () => {
     messageRepo.query.mockResolvedValue([
-      { dim: 'success', current_count: 70, previous_count: 60 },
-      { dim: 'healed', current_count: 4, previous_count: 3 },
+      { dim: 'success', current_count: 74, previous_count: 63 },
       { dim: 'fallback', current_count: 6, previous_count: 5 },
       { dim: 'error', current_count: 20, previous_count: 30 },
     ]);
@@ -165,8 +159,8 @@ describe('RequestVolumeService (#2511 request-level volume)', () => {
       agentName: 'demo',
     });
     expect(windows).toEqual({
-      current: { total: 100, success: 70, healed: 4, fallback: 6, error: 20 },
-      previous: { total: 98, success: 60, healed: 3, fallback: 5, error: 30 },
+      current: { total: 100, success: 74, fallback: 6, error: 20 },
+      previous: { total: 98, success: 63, fallback: 5, error: 30 },
     });
     // A single terminal-CTE execution for both windows.
     expect(messageRepo.query).toHaveBeenCalledTimes(1);
@@ -187,8 +181,8 @@ describe('RequestVolumeService (#2511 request-level volume)', () => {
         splitAt: '2026-01-08',
       }),
     ).resolves.toEqual({
-      current: { total: 0, success: 0, healed: 0, fallback: 0, error: 0 },
-      previous: { total: 0, success: 0, healed: 0, fallback: 0, error: 0 },
+      current: { total: 0, success: 0, fallback: 0, error: 0 },
+      previous: { total: 0, success: 0, fallback: 0, error: 0 },
     });
     expect(messageRepo.query).not.toHaveBeenCalled();
   });
diff --git a/packages/backend/src/analytics/services/request-volume.service.ts b/packages/backend/src/analytics/services/request-volume.service.ts
index d867cc1b..c6754c63 100644
--- a/packages/backend/src/analytics/services/request-volume.service.ts
+++ b/packages/backend/src/analytics/services/request-volume.service.ts
@@ -31,18 +31,16 @@ import {
 /** Same ranking as the Requests list: success wins, else the terminal failure. */
 const TERMINAL_RANK = `CASE WHEN ${sqlIsSuccessStatus('pa.status')} THEN 3
        WHEN NOT COALESCE(pa.superseded, false)
-            AND pa.status NOT IN ('fallback_error', 'auto_fixed') THEN 2
+            AND pa.status <> 'fallback_error' THEN 2
        ELSE 1 END`;
 
 const REQUEST_SUCCEEDED = sqlIsSuccessStatus('t.request_status');
 
 /**
- * How the request CONCLUDED. Autofix comes from the request outcome; fallback
- * comes from the terminal attempt. These mark the method that produced the
- * conclusion, never mere attempts along the way.
+ * How the request CONCLUDED. Fallback comes from the terminal attempt: it marks
+ * the method that produced the conclusion, never mere attempts along the way.
  */
 const DISPOSITION_EXPR = `CASE
-    WHEN ${REQUEST_SUCCEEDED} AND t.autofix_status = 'retry_succeeded' THEN 'healed'
     WHEN ${REQUEST_SUCCEEDED} AND t.fallback_from_model IS NOT NULL THEN 'fallback'
     WHEN ${REQUEST_SUCCEEDED} THEN 'success'
     ELSE 'error'
@@ -58,7 +56,6 @@ export interface DispositionRow {
 export interface DispositionTotals {
   total: number;
   success: number;
-  healed: number;
   fallback: number;
   error: number;
 }
@@ -86,8 +83,6 @@ export interface DimensionVolumeRow {
   requests: number;
   failed: number;
   succeeded: number;
-  /** Requests recovered by Autofix (autofix_status = retry_succeeded). */
-  healed: number;
   /** Requests recovered by fallback (terminal ok attempt with a fallback origin). */
   fallback: number;
 }
@@ -129,7 +124,6 @@ export class RequestVolumeService {
           r.id,
           r.timestamp AS ts,
           r.status AS request_status,
-          r.autofix_status,
           r.agent_name,
           pa.provider,
           pa.model,
@@ -158,8 +152,6 @@ export class RequestVolumeService {
           pa.id,
           pa.timestamp,
           pa.status,
-          CASE WHEN pa.autofix_role = 'retry' AND ${sqlIsSuccessStatus('pa.status')}
-            THEN 'retry_succeeded' ELSE NULL END,
           pa.agent_name,
           pa.provider,
           pa.model,
@@ -236,7 +228,6 @@ export class RequestVolumeService {
     const empty = (): DispositionTotals => ({
       total: 0,
       success: 0,
-      healed: 0,
       fallback: 0,
       error: 0,
     });
@@ -272,9 +263,6 @@ export class RequestVolumeService {
       if (r.dim === 'success') {
         current.success += c;
         previous.success += p;
-      } else if (r.dim === 'healed') {
-        current.healed += c;
-        previous.healed += p;
       } else if (r.dim === 'fallback') {
         current.fallback += c;
         previous.fallback += p;
@@ -287,9 +275,9 @@ export class RequestVolumeService {
   }
 
   /**
-   * Request-level disposition timeseries: feeds the "By request status" chart
-   * and the Healed requests tab. One count per request, keyed by how it
-   * concluded (success / healed / fallback / error).
+   * Request-level disposition timeseries: feeds the "By request status" chart.
+   * One count per request, keyed by how it concluded (success / fallback /
+   * error).
    */
   async getDispositionTimeseries(params: {
     tenantId: string | null;
@@ -338,7 +326,7 @@ export class RequestVolumeService {
 
   /**
    * Request-level totals per dimension for the Overview trio tables
-   * (Total requests / Healed / Success rate). `succeeded` counts requests
+   * (Total requests / Recovered / Success rate). `succeeded` counts requests
    * whose terminal outcome is ok (recovered included), so Success rate =
    * succeeded / requests keeps the "success includes rescued" story.
    */
@@ -357,7 +345,6 @@ export class RequestVolumeService {
         COUNT(*)::int AS requests,
         COUNT(*) FILTER (WHERE ${sqlIsFailedStatus('t.request_status')})::int AS failed,
         COUNT(*) FILTER (WHERE ${REQUEST_SUCCEEDED})::int AS succeeded,
-        COUNT(*) FILTER (WHERE ${DISPOSITION_EXPR} = 'healed')::int AS healed,
         COUNT(*) FILTER (WHERE ${DISPOSITION_EXPR} = 'fallback')::int AS fallback
       FROM terminal t
       ${dim === 'provider' ? '' : `WHERE t.${dim} IS NOT NULL`}
@@ -370,7 +357,6 @@ export class RequestVolumeService {
       requests: number;
       failed: number;
       succeeded: number;
-      healed: number;
       fallback: number;
     }>;
     return rows.map((r) => ({
@@ -378,7 +364,6 @@ export class RequestVolumeService {
       requests: Number(r.requests),
       failed: Number(r.failed),
       succeeded: Number(r.succeeded),
-      healed: Number(r.healed),
       fallback: Number(r.fallback),
     }));
   }
diff --git a/packages/backend/src/common/dto/create-agent.dto.spec.ts b/packages/backend/src/common/dto/create-agent.dto.spec.ts
index b4c012f2..bd14b582 100644
--- a/packages/backend/src/common/dto/create-agent.dto.spec.ts
+++ b/packages/backend/src/common/dto/create-agent.dto.spec.ts
@@ -106,35 +106,23 @@ describe('CreateAgentDto', () => {
     expect(errors).toHaveLength(0);
   });
 
-  it('accepts boolean autofix_enabled and record_messages', async () => {
+  it('accepts a boolean record_messages', async () => {
     const dto = plainToInstance(CreateAgentDto, {
       name: 'my-agent',
-      autofix_enabled: false,
       record_messages: true,
     });
     const errors = await validate(dto);
     expect(errors).toHaveLength(0);
-    expect(dto.autofix_enabled).toBe(false);
     expect(dto.record_messages).toBe(true);
   });
 
-  it('allows omitting autofix_enabled and record_messages', async () => {
+  it('allows omitting record_messages', async () => {
     const dto = plainToInstance(CreateAgentDto, { name: 'my-agent' });
     const errors = await validate(dto);
     expect(errors).toHaveLength(0);
-    expect(dto.autofix_enabled).toBeUndefined();
     expect(dto.record_messages).toBeUndefined();
   });
 
-  it('rejects non-boolean autofix_enabled', async () => {
-    const dto = plainToInstance(CreateAgentDto, {
-      name: 'my-agent',
-      autofix_enabled: 'yes',
-    });
-    const errors = await validate(dto);
-    expect(errors.some((e) => e.property === 'autofix_enabled')).toBe(true);
-  });
-
   it('rejects non-boolean record_messages', async () => {
     const dto = plainToInstance(CreateAgentDto, {
       name: 'my-agent',
diff --git a/packages/backend/src/common/dto/create-agent.dto.ts b/packages/backend/src/common/dto/create-agent.dto.ts
index 874c76f7..44ac3810 100644
--- a/packages/backend/src/common/dto/create-agent.dto.ts
+++ b/packages/backend/src/common/dto/create-agent.dto.ts
@@ -30,11 +30,6 @@ export class CreateAgentDto {
   @IsIn([...AGENT_PLATFORMS])
   agent_platform?: string;
 
-  /** Explicit Autofix choice at creation. Omit to inherit the mode default. */
-  @IsOptional()
-  @IsBoolean()
-  autofix_enabled?: boolean;
-
   /** Explicit recording choice at creation. Omit to keep the column default. */
   @IsOptional()
   @IsBoolean()
diff --git a/packages/backend/src/common/utils/dashboard-url.spec.ts b/packages/backend/src/common/utils/dashboard-url.spec.ts
index c7401e8a..d0f6f0ec 100644
--- a/packages/backend/src/common/utils/dashboard-url.spec.ts
+++ b/packages/backend/src/common/utils/dashboard-url.spec.ts
@@ -25,8 +25,8 @@ describe('dashboard URLs', () => {
 
   it('keeps an explicitly supplied dashboard ahead of the deployment default', () => {
     process.env['BETTER_AUTH_URL'] = 'https://selfhosted.example';
-    expect(getEmailAssetUrl('autofix-icon-email.png', 'https://dashboard.example/')).toBe(
-      'https://dashboard.example/autofix-icon-email.png',
+    expect(getEmailAssetUrl('manifest-logo.png', 'https://dashboard.example/')).toBe(
+      'https://dashboard.example/manifest-logo.png',
     );
   });
 
diff --git a/packages/backend/src/database/backfills/backfill-requests.gateway.spec.ts b/packages/backend/src/database/backfills/backfill-requests.gateway.spec.ts
index 939f86b9..d234e829 100644
--- a/packages/backend/src/database/backfills/backfill-requests.gateway.spec.ts
+++ b/packages/backend/src/database/backfills/backfill-requests.gateway.spec.ts
@@ -36,19 +36,18 @@ const timeouts = { lockTimeoutMs: 5_000, statementTimeoutMs: 60_000 };
 const before = '2026-01-01 00:00:00';
 
 describe('TypeOrmRequestBackfillGateway', () => {
-  it('derives every request-level Autofix status during historical backfill', () => {
-    const sql = `${INSERT_ATTEMPT_REQUESTS_SQL}\n${REFRESH_ATTEMPT_REQUESTS_SQL}`;
-    for (const status of [
-      'no_patch',
-      'resolving',
-      'retry_succeeded',
-      'retry_failed',
-      'service_error',
-    ]) {
-      expect(sql).toContain(`'${status}'`);
-    }
-    expect(sql).toContain("autofix_phoenix->>'status'");
-    expect(sql).toContain("autofix_phoenix->>'healAttemptId'");
+  it('reads and writes no dropped repair columns', () => {
+    const sql = [
+      INSERT_ATTEMPT_REQUESTS_SQL,
+      REFRESH_ATTEMPT_REQUESTS_SQL,
+      LINK_ATTEMPTS_SQL,
+      INSERT_LEGACY_FALLBACK_REQUESTS_SQL,
+      INSERT_REJECTIONS_SQL,
+      FINALIZE_PENDING_REQUESTS_SQL,
+    ].join('\n');
+    // Migration 1803400000000 (#16) dropped these columns; a backfill that
+    // still named them would fail at boot on a migrated database.
+    expect(sql).not.toMatch(/auto_?fix/);
   });
 
   it('preserves non-outcome attempts when deriving request status', () => {
@@ -57,10 +56,8 @@ describe('TypeOrmRequestBackfillGateway', () => {
     expect(sql).toContain("WHEN status IN ('pending', 'cancelled') THEN status");
   });
 
-  it('precomputes legacy Autofix group sizes once per window', () => {
-    expect(LINK_ATTEMPTS_SQL).toContain('target_autofix_groups AS MATERIALIZED');
-    expect(LINK_ATTEMPTS_SQL).toContain('autofix_group_stats AS MATERIALIZED');
-    expect(LINK_ATTEMPTS_SQL).toContain('LEFT JOIN autofix_group_stats stats');
+  it('numbers a trace-less legacy attempt as the first attempt of its own request', () => {
+    expect(LINK_ATTEMPTS_SQL).toContain('CASE WHEN pa.trace_id IS NULL THEN 1 ELSE NULL END');
     expect(LINK_ATTEMPTS_SQL).not.toMatch(/WHEN \(\s*SELECT count\(\*\)/);
   });
 
diff --git a/packages/backend/src/database/backfills/backfill-requests.gateway.ts b/packages/backend/src/database/backfills/backfill-requests.gateway.ts
index d40ac5cc..3be53ea2 100644
--- a/packages/backend/src/database/backfills/backfill-requests.gateway.ts
+++ b/packages/backend/src/database/backfills/backfill-requests.gateway.ts
@@ -42,44 +42,12 @@ const REQUEST_LEVEL_ORIGINS = `'config', 'policy', 'request', 'internal'`;
  * `success` / `failed` vocabulary, same as the live recorder now writes, so the
  * `requests` table is coherent regardless of which side created a row. Historical
  * `agent_messages.status` still holds the legacy values (`ok` / `error` /
- * `rate_limited` / `fallback_error` / `auto_fixed`); this collapses a terminal
+ * `rate_limited` / `fallback_error`); this collapses a terminal
  * attempt status onto the request outcome while preserving in-flight work.
  */
 const normalizeAttemptStatusSql = (expr: string): string =>
   `CASE WHEN ${expr} IN ('pending', 'cancelled') THEN ${expr} WHEN ${expr} IN ('ok', 'success') THEN 'success' ELSE 'failed' END`;
 
-/**
- * Historical decisions written before this migration have no JSON `status`.
- * With no retry evidence those rows are necessarily no-patch or resolving, but
- * the two cannot be distinguished retrospectively; use the terminal no_patch
- * value rather than inventing an in-progress state for old traffic.
- */
-const autofixStatusFromAttempt = (alias: string): string => `CASE
-  WHEN ${alias}.autofix_role = 'retry' THEN
-    CASE WHEN ${alias}.status IN ('ok', 'success') THEN 'retry_succeeded' ELSE 'retry_failed' END
-  WHEN COALESCE(${alias}.autofix_applied, false)
-    AND ${alias}.autofix_phoenix->>'healAttemptId' IS NOT NULL THEN 'retry_failed'
-  WHEN ${alias}.autofix_phoenix->>'status' = 'resolving' THEN 'resolving'
-  WHEN ${alias}.autofix_phoenix->>'status' = 'no_patch' THEN 'no_patch'
-  WHEN ${alias}.autofix_phoenix IS NOT NULL THEN 'no_patch'
-  WHEN COALESCE(${alias}.autofix_applied, false) THEN 'service_error'
-  ELSE NULL
-END`;
-
-const autofixStatusFromAttempts = (alias: string): string => `CASE
-  WHEN BOOL_OR(${alias}.autofix_role = 'retry' AND ${alias}.status IN ('ok', 'success'))
-    THEN 'retry_succeeded'
-  WHEN BOOL_OR(${alias}.autofix_role = 'retry')
-    OR BOOL_OR(COALESCE(${alias}.autofix_applied, false)
-      AND ${alias}.autofix_phoenix->>'healAttemptId' IS NOT NULL)
-    THEN 'retry_failed'
-  WHEN BOOL_OR(${alias}.autofix_phoenix->>'status' = 'resolving') THEN 'resolving'
-  WHEN BOOL_OR(${alias}.autofix_phoenix->>'status' = 'no_patch') THEN 'no_patch'
-  WHEN BOOL_OR(${alias}.autofix_phoenix IS NOT NULL) THEN 'no_patch'
-  WHEN BOOL_OR(COALESCE(${alias}.autofix_applied, false)) THEN 'service_error'
-  ELSE NULL
-END`;
-
 /**
  * The legacy recorder encoded fallback chains with exact 100 ms timestamp
  * offsets but did not stamp a shared id. Recover only chains whose primary,
@@ -173,7 +141,7 @@ export const INSERT_LEGACY_FALLBACK_PAIRS_SQL = `
     JOIN "request_backfill_fallback_indexes" fi ON true
     JOIN "agent_messages" t
       ON t."request_id" IS NULL
-     AND t.status NOT IN ('ok', 'fallback_error', 'auto_fixed')
+     AND t.status NOT IN ('ok', 'fallback_error')
      AND NOT COALESCE(t.superseded, false)
      AND t.fallback_from_model = p.model
      AND t.fallback_index = fi.fallback_index
@@ -338,8 +306,7 @@ export const INSERT_LEGACY_FALLBACK_REQUESTS_SQL = `
   ), totals AS (
     SELECT g.request_id,
            min(pa.timestamp) AS started_at,
-           sum(pa.duration_ms)::int AS duration_ms,
-           ${autofixStatusFromAttempts('pa')} AS autofix_status
+           sum(pa.duration_ms)::int AS duration_ms
     FROM groups g
     JOIN "request_backfill_fallback_groups" member ON member.request_id = g.request_id
     JOIN "agent_messages" pa ON pa.id = member.attempt_id
@@ -348,14 +315,14 @@ export const INSERT_LEGACY_FALLBACK_REQUESTS_SQL = `
     INSERT INTO "requests" (
       id, tenant_id, agent_id, user_id, agent_name, trace_id, session_key, session_id,
       timestamp, duration_ms, status, error_message, error_http_status, error_code,
-      autofix_status, error_origin, error_class, requested_model, caller_attribution, request_headers,
+      error_origin, error_class, requested_model, caller_attribution, request_headers,
       request_params, feedback_rating, feedback_tags, feedback_details
     )
     SELECT
       g.request_id, terminal.tenant_id, terminal.agent_id, terminal.user_id,
       terminal.agent_name, terminal.trace_id, terminal.session_key, terminal.session_id,
       totals.started_at, totals.duration_ms, ${normalizeAttemptStatusSql('terminal.status')}, terminal.error_message,
-      terminal.error_http_status, terminal.error_code, totals.autofix_status, terminal.error_origin,
+      terminal.error_http_status, terminal.error_code, terminal.error_origin,
       terminal.error_class, primary_attempt.model, terminal.caller_attribution,
       terminal.request_headers, terminal.request_params, terminal.feedback_rating,
       terminal.feedback_tags, terminal.feedback_details
@@ -399,13 +366,13 @@ export const INSERT_REJECTIONS_SQL = `
     INSERT INTO "requests" (
       id, tenant_id, agent_id, user_id, agent_name, trace_id, session_key, session_id,
       timestamp, duration_ms, status, error_message, error_http_status, error_code,
-      autofix_status, error_origin, error_class, requested_model, caller_attribution, request_headers,
+      error_origin, error_class, requested_model, caller_attribution, request_headers,
       request_params, feedback_rating, feedback_tags, feedback_details
     )
     SELECT
       id, tenant_id, agent_id, user_id, agent_name, trace_id, session_key, session_id,
       timestamp, duration_ms, ${normalizeAttemptStatusSql('status')}, error_message, error_http_status, error_code,
-      ${autofixStatusFromAttempt('batch')}, error_origin, error_class, model, caller_attribution, request_headers,
+      error_origin, error_class, model, caller_attribution, request_headers,
       request_params, feedback_rating, feedback_tags, feedback_details
     FROM batch
     ON CONFLICT (id) DO NOTHING
@@ -430,8 +397,6 @@ export const MARK_REJECTIONS_SQL = `
 `;
 
 const LEGACY_REQUEST_ID = `CASE
-  WHEN autofix_group_id IS NOT NULL THEN
-    'legacy-autofix-' || md5(COALESCE(tenant_id, '') || ':' || COALESCE(agent_id, '') || ':' || autofix_group_id)
   WHEN trace_id IS NOT NULL THEN
     'legacy-trace-' || md5(COALESCE(tenant_id, '') || ':' || COALESCE(agent_id, '') || ':' || trace_id)
   ELSE id
@@ -440,7 +405,7 @@ END`;
 const OUTCOME_RANK = `CASE
   WHEN status IN ('ok', 'success') THEN 3
   WHEN NOT COALESCE(superseded, false)
-    AND status NOT IN ('fallback_error', 'auto_fixed') THEN 2
+    AND status <> 'fallback_error' THEN 2
   ELSE 1
 END`;
 
@@ -458,7 +423,7 @@ export const INSERT_ATTEMPT_REQUESTS_SQL = `
     INSERT INTO "requests" (
       id, tenant_id, agent_id, user_id, agent_name, trace_id, session_key, session_id,
       timestamp, duration_ms, status, error_message, error_http_status, error_code,
-      autofix_status, error_origin, error_class, requested_model, caller_attribution, request_headers,
+      error_origin, error_class, requested_model, caller_attribution, request_headers,
       request_params, feedback_rating, feedback_tags, feedback_details
     )
     SELECT
@@ -468,7 +433,6 @@ export const INSERT_ATTEMPT_REQUESTS_SQL = `
       CASE WHEN outcome_rank = 1 THEN NULL ELSE error_message END,
       CASE WHEN outcome_rank = 1 THEN NULL ELSE error_http_status END,
       CASE WHEN outcome_rank = 1 THEN NULL ELSE error_code END,
-      ${autofixStatusFromAttempt('terminal')},
       CASE WHEN outcome_rank = 1 THEN NULL ELSE error_origin END,
       CASE WHEN outcome_rank = 1 THEN NULL ELSE error_class END,
       COALESCE(fallback_from_model, model), caller_attribution, request_headers,
@@ -482,7 +446,6 @@ export const INSERT_ATTEMPT_REQUESTS_SQL = `
         WHEN EXCLUDED.status = 'pending' THEN requests.status
         ELSE EXCLUDED.status
       END,
-      autofix_status = COALESCE(EXCLUDED.autofix_status, requests.autofix_status),
       error_message = CASE WHEN requests.status IN ('ok', 'success') OR EXCLUDED.status = 'pending'
         THEN requests.error_message ELSE EXCLUDED.error_message END,
       error_http_status = CASE WHEN requests.status IN ('ok', 'success') OR EXCLUDED.status = 'pending'
@@ -499,51 +462,11 @@ export const INSERT_ATTEMPT_REQUESTS_SQL = `
 `;
 
 export const LINK_ATTEMPTS_SQL = `
-  WITH target_autofix_groups AS MATERIALIZED (
-    SELECT DISTINCT
-      COALESCE(tenant_id, '') AS tenant_key,
-      COALESCE(agent_id, '') AS agent_key,
-      autofix_group_id AS group_id
-    FROM "agent_messages"
-    WHERE "request_id" IS NULL AND id > $1 AND id <= $2
-      AND timestamp < $3
-      AND autofix_group_id IS NOT NULL
-      AND autofix_role IS NULL
-  ), autofix_group_stats AS MATERIALIZED (
-    SELECT target.tenant_key,
-           target.agent_key,
-           target.group_id,
-           count(*)::int AS attempt_count,
-           count(*) FILTER (
-             WHERE other.status = 'auto_fixed' AND COALESCE(other.superseded, false)
-           )::int AS original_count
-    FROM target_autofix_groups target
-    JOIN "agent_messages" other
-      ON COALESCE(other.tenant_id, '') = target.tenant_key
-     AND COALESCE(other.agent_id, '') = target.agent_key
-     AND other.autofix_group_id = target.group_id
-    GROUP BY target.tenant_key, target.agent_key, target.group_id
-  ), batch AS (
+  WITH batch AS (
     SELECT pa.id,
            ${LEGACY_REQUEST_ID} AS legacy_request_id,
-           CASE
-             WHEN pa.autofix_group_id IS NOT NULL THEN CASE
-               WHEN pa.autofix_role = 'original' THEN 1
-               WHEN pa.autofix_role = 'retry' THEN 2
-               WHEN stats.attempt_count = 2 AND stats.original_count = 1 THEN CASE
-                 WHEN pa.status = 'auto_fixed' AND COALESCE(pa.superseded, false) THEN 1
-                 ELSE 2
-               END
-               ELSE NULL
-             END
-             WHEN pa.trace_id IS NULL THEN 1
-             ELSE NULL
-           END AS attempt_number
+           CASE WHEN pa.trace_id IS NULL THEN 1 ELSE NULL END AS attempt_number
     FROM "agent_messages" pa
-    LEFT JOIN autofix_group_stats stats
-      ON stats.tenant_key = COALESCE(pa.tenant_id, '')
-     AND stats.agent_key = COALESCE(pa.agent_id, '')
-     AND stats.group_id = pa.autofix_group_id
     WHERE pa."request_id" IS NULL AND pa.id > $1 AND pa.id <= $2
       AND pa.timestamp < $3
   ), updated AS (
@@ -581,22 +504,16 @@ export const REFRESH_ATTEMPT_REQUESTS_SQL = `
       CASE
         WHEN pa.status IN ('ok', 'success') THEN 3
         WHEN NOT COALESCE(pa.superseded, false)
-          AND pa.status NOT IN ('fallback_error', 'auto_fixed') THEN 2
+          AND pa.status <> 'fallback_error' THEN 2
         ELSE 1
       END DESC,
       pa.timestamp DESC,
       pa.id DESC
-  ), autofix AS (
-    SELECT pa.request_id, ${autofixStatusFromAttempts('pa')} AS autofix_status
-    FROM "agent_messages" pa
-    JOIN affected a ON a.request_id = pa.request_id
-    GROUP BY pa.request_id
   )
   UPDATE "requests" r
   SET timestamp = totals.started_at,
       duration_ms = totals.duration_ms,
       status = ${normalizeAttemptStatusSql('terminal.status')},
-      autofix_status = autofix.autofix_status,
       error_message = terminal.error_message,
       error_http_status = terminal.error_http_status,
       error_code = terminal.error_code,
@@ -604,7 +521,6 @@ export const REFRESH_ATTEMPT_REQUESTS_SQL = `
       error_class = terminal.error_class
   FROM totals
   JOIN terminal ON terminal.request_id = totals.request_id
-  JOIN autofix ON autofix.request_id = totals.request_id
   WHERE r.id = totals.request_id
 `;
 
@@ -614,8 +530,7 @@ export const FINALIZE_PENDING_REQUESTS_SQL = `
     FROM "requests" r
     WHERE r.status = 'pending'
       AND (
-        r.id LIKE 'legacy-autofix-%'
-        OR r.id LIKE 'legacy-trace-%'
+        r.id LIKE 'legacy-trace-%'
         OR EXISTS (
           SELECT 1 FROM "agent_messages" pa
           WHERE pa.request_id = r.id AND pa.id = r.id
diff --git a/packages/backend/src/database/backfills/backfill-requests.spec.ts b/packages/backend/src/database/backfills/backfill-requests.spec.ts
index 4cc62cc8..0643f8b6 100644
--- a/packages/backend/src/database/backfills/backfill-requests.spec.ts
+++ b/packages/backend/src/database/backfills/backfill-requests.spec.ts
@@ -313,7 +313,6 @@ describe('runRequestBackfill', () => {
 
 describe('request backfill finalization', () => {
   it('only finalizes backfill-created pending parents', () => {
-    expect(FINALIZE_PENDING_REQUESTS_SQL).toContain("r.id LIKE 'legacy-autofix-%'");
     expect(FINALIZE_PENDING_REQUESTS_SQL).toContain("r.id LIKE 'legacy-trace-%'");
     expect(FINALIZE_PENDING_REQUESTS_SQL).toContain('pa.id = r.id');
     expect(FINALIZE_PENDING_REQUESTS_SQL).not.toContain(
diff --git a/packages/backend/src/database/data-source-definitions.ts b/packages/backend/src/database/data-source-definitions.ts
index ec921e84..97097930 100644
--- a/packages/backend/src/database/data-source-definitions.ts
+++ b/packages/backend/src/database/data-source-definitions.ts
@@ -56,6 +56,7 @@ import { CoverRequestsLogFilters1803000000000 } from './migrations/1803000000000
 import { CoverHarnessRequestsIndex1803100000000 } from './migrations/1803100000000-CoverHarnessRequestsIndex';
 import { DropBillingSchema1803200000000 } from './migrations/1803200000000-DropBillingSchema';
 import { DropSaasFeatureSchema1803300000000 } from './migrations/1803300000000-DropSaasFeatureSchema';
+import { DropAutofixSchema1803400000000 } from './migrations/1803400000000-DropAutofixSchema';
 import { InitialSchema1771464895790 } from './migrations/1771464895790-InitialSchema';
 import { HashApiKeys1771500000000 } from './migrations/1771500000000-HashApiKeys';
 import { ModelPricingImprovements1771600000000 } from './migrations/1771600000000-ModelPricingImprovements';
@@ -350,4 +351,5 @@ export const migrations = [
   CoverHarnessRequestsIndex1803100000000,
   DropBillingSchema1803200000000,
   DropSaasFeatureSchema1803300000000,
+  DropAutofixSchema1803400000000,
 ];
diff --git a/packages/backend/src/database/migrations/1802200000000-AddRequestsAutofixHealedIndex.spec.ts b/packages/backend/src/database/migrations/1802200000000-AddRequestsAutofixHealedIndex.spec.ts
index 83d733f8..f8ce09ef 100644
--- a/packages/backend/src/database/migrations/1802200000000-AddRequestsAutofixHealedIndex.spec.ts
+++ b/packages/backend/src/database/migrations/1802200000000-AddRequestsAutofixHealedIndex.spec.ts
@@ -1,106 +1,38 @@
 import { AddRequestsAutofixHealedIndex1802200000000 } from './1802200000000-AddRequestsAutofixHealedIndex';
-import { isSelfHosted } from '../../common/utils/detect-self-hosted';
-
-jest.mock('../../common/utils/detect-self-hosted', () => ({ isSelfHosted: jest.fn() }));
-const mockedIsSelfHosted = jest.mocked(isSelfHosted);
 
 describe('AddRequestsAutofixHealedIndex1802200000000', () => {
   const migration = new AddRequestsAutofixHealedIndex1802200000000();
   let queries: string[];
-  let args: unknown[][];
-  let invalidRows: unknown[];
 
   const mockQueryRunner = {
-    query: jest.fn().mockImplementation((sql: string, ...params: unknown[]) => {
+    query: jest.fn().mockImplementation((sql: string) => {
       queries.push(sql);
-      args.push(params);
-      if (sql.includes('NOT i.indisvalid')) {
-        return Promise.resolve(invalidRows);
-      }
       return Promise.resolve([]);
     }),
   } as never;
 
   beforeEach(() => {
     queries = [];
-    args = [];
-    invalidRows = [];
     jest.clearAllMocks();
-    mockedIsSelfHosted.mockReturnValue(false);
   });
 
-  it('exposes the expected migration name', () => {
+  it('keeps the recorded migration name', () => {
     expect(migration.name).toBe('AddRequestsAutofixHealedIndex1802200000000');
   });
 
-  it('runs outside a transaction so CONCURRENTLY is legal', () => {
+  it('runs outside a transaction so CONCURRENTLY is legal on revert', () => {
     expect(migration.transaction).toBe(false);
   });
 
-  it('builds the partial index, then refreshes the planner stats', async () => {
-    await migration.up(mockQueryRunner);
-
-    expect(queries).toHaveLength(3);
-    expect(queries[0]).toContain('NOT i.indisvalid');
-    expect(args[0]).toEqual([['IDX_requests_autofix_healed']]);
-    expect(queries[1]).toContain(
-      'CREATE INDEX CONCURRENTLY IF NOT EXISTS "IDX_requests_autofix_healed"',
-    );
-    expect(queries[1]).toContain('ON "requests" ("tenant_id", "timestamp")');
-    expect(queries[1]).toContain('INCLUDE ("status")');
-    expect(queries[1]).toContain(`WHERE "autofix_status" = 'retry_succeeded'`);
-    expect(queries[2]).toBe('ANALYZE "requests"');
-  });
-
-  it('keeps a valid index instead of rebuilding it on a retried deploy', async () => {
-    // A deploy interrupted after the build succeeded but before TypeORM
-    // recorded the migration re-runs up(). Dropping unconditionally here would
-    // throw away a usable index and leave the feed 503ing while it rebuilt.
-    await migration.up(mockQueryRunner);
-
-    expect(queries.some((sql) => sql.startsWith('DROP INDEX'))).toBe(false);
-  });
-
-  it('drops an INVALID shell before rebuilding, since IF NOT EXISTS matches on name', async () => {
-    invalidRows = [{}];
-
-    await migration.up(mockQueryRunner);
+  it('touches nothing on the way up, like the self-hosted path always did', async () => {
+    await migration.up();
 
-    expect(queries).toHaveLength(4);
-    expect(queries[0]).toContain('NOT i.indisvalid');
-    expect(queries[1]).toBe('DROP INDEX CONCURRENTLY IF EXISTS "IDX_requests_autofix_healed"');
-    expect(queries[2]).toContain(
-      'CREATE INDEX CONCURRENTLY IF NOT EXISTS "IDX_requests_autofix_healed"',
-    );
-    expect(queries[3]).toBe('ANALYZE "requests"');
+    expect(queries).toEqual([]);
   });
 
-  it('drops the index on rollback', async () => {
+  it('still drops the index on rollback, a no-op where it never existed', async () => {
     await migration.down(mockQueryRunner);
 
     expect(queries).toEqual(['DROP INDEX CONCURRENTLY IF EXISTS "IDX_requests_autofix_healed"']);
   });
-
-  describe('self-hosted', () => {
-    // The feed is Cloud-only and its module is not registered on self-hosted,
-    // so the index would be dead weight. Skipping also spares those upgrades a
-    // whole-table CONCURRENTLY scan during boot.
-    it('touches nothing on the way up', async () => {
-      mockedIsSelfHosted.mockReturnValue(true);
-
-      await migration.up(mockQueryRunner);
-
-      expect(queries).toEqual([]);
-    });
-
-    it('still drops on the way down, so a cloud-built index is never orphaned', async () => {
-      // A database migrated in cloud mode can be reverted while the process
-      // looks self-hosted. DROP ... IF EXISTS is a no-op where it never existed.
-      mockedIsSelfHosted.mockReturnValue(true);
-
-      await migration.down(mockQueryRunner);
-
-      expect(queries).toEqual(['DROP INDEX CONCURRENTLY IF EXISTS "IDX_requests_autofix_healed"']);
-    });
-  });
 });
diff --git a/packages/backend/src/database/migrations/1802200000000-AddRequestsAutofixHealedIndex.ts b/packages/backend/src/database/migrations/1802200000000-AddRequestsAutofixHealedIndex.ts
index 05b65281..1e9d1925 100644
--- a/packages/backend/src/database/migrations/1802200000000-AddRequestsAutofixHealedIndex.ts
+++ b/packages/backend/src/database/migrations/1802200000000-AddRequestsAutofixHealedIndex.ts
@@ -1,51 +1,19 @@
 import { MigrationInterface, QueryRunner } from 'typeorm';
-import { isSelfHosted } from '../../common/utils/detect-self-hosted';
 
 /**
- * Partial index over the requests Autofix repaired, for the CRM metrics feed.
- *
- * `GET /api/v1/internal/crm-metrics` groups every healed request by tenant.
- * No existing `requests` index mentions `autofix_status`, so the planner fell
- * back to a sequential scan: measured on production, 7,016,836 rows discarded
- * by the filter and 845,495 shared buffers (~6.6 GB) read to return 59 rows,
- * in 2.4s. `shared_buffers` there is ~128 MB, so the damage is not the latency
- * but the eviction — one call flushes the working set of every other query.
- *
- * Healed requests are a rounding error of the table (~8.3k of 7.0M), so a
- * partial index costs almost nothing to store, and turns that scan into a read
- * of a few hundred pages.
- *
- * `tenant_id` leads because the feed needs *every* healed row (the all-time
- * count takes no time bound) grouped by tenant, and because the same index
- * then serves `WHERE tenant_id = ANY(...)`. The timestamp-leading partial
- * index added in 1795100000000 solved the opposite shape — a narrow window
- * across all tenants — where a tenant-leading key forced a scan of every error
- * row ever. Revisit if healed rows ever approach seven figures.
- *
- * `status` is INCLUDEd rather than filtered from the heap: the feed applies the
- * canonical healed predicate (`sqlIsSuccessStatus` AND retry_succeeded, per
- * request-volume.service.ts), and carrying `status` in the index keeps that
- * check off the heap. `autofix_status` itself is deliberately absent — it is
- * constant inside a partial index and would be pure waste.
- *
- * Write-path cost is negligible despite the predicate column blocking HOT
- * updates: `status` is already indexed and already flips pending -> terminal on
- * every request, so those upserts are non-HOT today regardless.
- *
- * Built CONCURRENTLY (so `transaction = false`) to avoid the ACCESS EXCLUSIVE
- * lock that deadlocks against live writes during a deploy. Budget minutes for
- * this one: two heap passes over ~6.6 GB, and it blocks autovacuum on
- * `requests` while it runs.
- *
- * `npm run migration:revert` passes `--transaction none`, so `down()` runs
- * outside a transaction as CONCURRENTLY requires. Under the default
- * transaction mode Postgres would reject the statement.
- *
- * Cloud only, mirroring 1801300000000: a self-hosted install gets no schema
- * change at all. Consequence to know about — an install that ran this while
- * self-hosted and later switches `MANIFEST_MODE=cloud` will not re-run it,
- * because TypeORM has already recorded it. The endpoint reports that state
- * explicitly (503 naming the missing index) rather than silently scanning.
+ * Upstream built a cloud-only partial index here, over the requests Autofix
+ * repaired, for Manifest Cloud's CRM metrics feed.
+ *
+ * Thinker has neither the feed (#15) nor Autofix (#16). On the self-hosted path
+ * this migration never changed the schema, so `up()` is now that path on every
+ * install: the minimal edit that drops the deployment-mode branch and keeps the
+ * self-hosted SQL. The class name and timestamp stay, so databases that already
+ * recorded it are unaffected. 1803300000000 and 1803400000000 drop the index
+ * where an earlier cloud-mode run left it behind.
+ *
+ * `down()` still drops the index (a no-op where it never existed).
+ * `npm run migration:revert` passes `--transaction none`, so it runs outside a
+ * transaction as CONCURRENTLY requires.
  */
 export class AddRequestsAutofixHealedIndex1802200000000 implements MigrationInterface {
   name = 'AddRequestsAutofixHealedIndex1802200000000';
@@ -53,47 +21,13 @@ export class AddRequestsAutofixHealedIndex1802200000000 implements MigrationInte
 
   private static readonly INDEX = 'IDX_requests_autofix_healed';
 
-  public async up(queryRunner: QueryRunner): Promise<void> {
-    // The CRM feed is a Cloud outreach concern and its module is not even
-    // registered on self-hosted, so the index would be dead weight there.
-    // Skipping also spares self-hosted upgrades a CONCURRENTLY build, which
-    // scans the whole `requests` table however few rows match the predicate,
-    // and runs during boot where it would delay container startup.
-    if (isSelfHosted()) return;
-
-    const { INDEX } = AddRequestsAutofixHealedIndex1802200000000;
-    // A cancelled CONCURRENTLY build leaves an INVALID shell that
-    // `CREATE ... IF NOT EXISTS` would skip over by name, leaving the feed
-    // permanently unindexed. Drop only that shell: an unconditional drop would
-    // also destroy a *valid* index when a deploy is interrupted after the build
-    // succeeded but before TypeORM recorded the migration, costing minutes of
-    // 503s on the retry while it rebuilds.
-    if (await this.indexIsInvalid(queryRunner, INDEX)) {
-      await queryRunner.query(`DROP INDEX CONCURRENTLY IF EXISTS "${INDEX}"`);
-    }
-    await queryRunner.query(
-      `CREATE INDEX CONCURRENTLY IF NOT EXISTS "${INDEX}" ON "requests" ("tenant_id", "timestamp") INCLUDE ("status") WHERE "autofix_status" = 'retry_succeeded'`,
-    );
-    // The planner only picks the index if it believes the predicate is
-    // selective; refresh the stats it reasons from before the first read.
-    await queryRunner.query(`ANALYZE "requests"`);
+  public async up(): Promise<void> {
+    // Intentionally empty: the self-hosted path made no schema change.
   }
 
-  // Deliberately ungated, unlike up(): a database migrated in cloud mode and
-  // reverted while MANIFEST_MODE=selfhosted would otherwise keep the index
-  // forever. DROP ... IF EXISTS is already a no-op where it was never created.
   public async down(queryRunner: QueryRunner): Promise<void> {
     await queryRunner.query(
       `DROP INDEX CONCURRENTLY IF EXISTS "${AddRequestsAutofixHealedIndex1802200000000.INDEX}"`,
     );
   }
-
-  /** True when an index of this name exists but is INVALID (interrupted build). */
-  private async indexIsInvalid(queryRunner: QueryRunner, indexName: string): Promise<boolean> {
-    const rows: unknown[] = await queryRunner.query(
-      `SELECT 1 FROM pg_index i JOIN pg_class c ON c.oid = i.indexrelid WHERE c.relname = $1 AND NOT i.indisvalid`,
-      [indexName],
-    );
-    return rows.length > 0;
-  }
 }
diff --git a/packages/backend/src/database/migrations/1803400000000-DropAutofixSchema.spec.ts b/packages/backend/src/database/migrations/1803400000000-DropAutofixSchema.spec.ts
new file mode 100644
index 00000000..84bfe1dd
--- /dev/null
+++ b/packages/backend/src/database/migrations/1803400000000-DropAutofixSchema.spec.ts
@@ -0,0 +1,60 @@
+import { DropAutofixSchema1803400000000 } from './1803400000000-DropAutofixSchema';
+
+async function run(direction: 'up' | 'down'): Promise<string[]> {
+  const query = jest.fn(async () => []);
+  await new DropAutofixSchema1803400000000()[direction]({ query } as never);
+  return query.mock.calls.map((call) => String((call as unknown[])[0]));
+}
+
+describe('DropAutofixSchema1803400000000', () => {
+  it('keeps a name ordered after the #15 schema drop', () => {
+    expect(new DropAutofixSchema1803400000000().name).toBe('DropAutofixSchema1803400000000');
+  });
+
+  it('sets a transaction-local lock timeout before taking any lock', async () => {
+    const sql = await run('up');
+
+    expect(sql[0]).toBe(`SET LOCAL lock_timeout = '10s'`);
+  });
+
+  it('drops every repair column, index and constraint idempotently', async () => {
+    const sql = (await run('up')).join('\n');
+
+    for (const fragment of [
+      'DROP INDEX IF EXISTS "IDX_agent_messages_autofix_request"',
+      'DROP INDEX IF EXISTS "IDX_agent_messages_autofix_group"',
+      'DROP INDEX IF EXISTS "IDX_requests_autofix_healed"',
+      'DROP COLUMN IF EXISTS "autofix_applied"',
+      'DROP COLUMN IF EXISTS "autofix_group_id"',
+      'DROP COLUMN IF EXISTS "autofix_role"',
+      'DROP COLUMN IF EXISTS "autofix_operations"',
+      'DROP COLUMN IF EXISTS "autofix_phoenix"',
+      'DROP CONSTRAINT IF EXISTS "CHK_requests_autofix_status"',
+      'ALTER TABLE "requests" DROP COLUMN IF EXISTS "autofix_status"',
+      'ALTER TABLE "agents" DROP COLUMN IF EXISTS "autofix_enabled"',
+      'ALTER TABLE "install_metadata" DROP COLUMN IF EXISTS "autofix_consented_at"',
+    ]) {
+      expect(sql).toContain(fragment);
+    }
+    expect(sql).not.toMatch(/DROP (INDEX|COLUMN|CONSTRAINT) (?!IF EXISTS)/);
+    expect(sql).not.toMatch(/CONCURRENTLY/);
+  });
+
+  it('restores the self-hosted columns, constraint and indexes on revert', async () => {
+    const sql = (await run('down')).join('\n');
+
+    expect(sql).toContain('ADD COLUMN IF NOT EXISTS "autofix_enabled" boolean');
+    expect(sql).toContain(
+      'ADD COLUMN IF NOT EXISTS "autofix_applied" boolean NOT NULL DEFAULT false',
+    );
+    expect(sql).toContain('ADD COLUMN IF NOT EXISTS "autofix_phoenix" jsonb');
+    expect(sql).toContain('ADD COLUMN IF NOT EXISTS "autofix_status" varchar');
+    expect(sql).toContain('ADD COLUMN IF NOT EXISTS "autofix_consented_at" timestamp');
+    expect(sql).toContain('ADD CONSTRAINT "CHK_requests_autofix_status"');
+    expect(sql).toContain('CREATE INDEX IF NOT EXISTS "IDX_agent_messages_autofix_group"');
+    expect(sql).toContain('CREATE INDEX IF NOT EXISTS "IDX_agent_messages_autofix_request"');
+    // The cloud-only CRM index was never part of the self-hosted path.
+    expect(sql).not.toContain('IDX_requests_autofix_healed');
+    expect(sql).not.toContain('SET LOCAL');
+  });
+});
diff --git a/packages/backend/src/database/migrations/1803400000000-DropAutofixSchema.ts b/packages/backend/src/database/migrations/1803400000000-DropAutofixSchema.ts
new file mode 100644
index 00000000..c707f58b
--- /dev/null
+++ b/packages/backend/src/database/migrations/1803400000000-DropAutofixSchema.ts
@@ -0,0 +1,94 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+/**
+ * Drops the schema of the removed Autofix feature (#16). Autofix sent failing
+ * requests to Manifest's hosted healing service and is gone from the product;
+ * the local self-heal planned for v0.6 will bring its own schema.
+ *
+ * - `agents.autofix_enabled`, the per-harness opt-in.
+ * - `agent_messages.autofix_applied`, `autofix_group_id`, `autofix_role`,
+ *   `autofix_operations` and `autofix_phoenix` (the healing service's decision),
+ *   with the two indexes that only served them: `IDX_agent_messages_autofix_group`
+ *   (1799000100000) and `IDX_agent_messages_autofix_request` (1802700000000).
+ * - `requests.autofix_status` and its `CHK_requests_autofix_status` constraint,
+ *   plus `IDX_requests_autofix_healed` (1802200000000), which 1803300000000
+ *   already drops; repeating it here is a no-op.
+ * - `install_metadata.autofix_consented_at`, the self-hosted consent stamp.
+ *
+ * Dropping a column also drops the indexes and constraints that reference it,
+ * but each one is named here so the intent survives a future reader, and every
+ * statement is idempotent (`IF EXISTS`). `lock_timeout` makes the migration fail
+ * fast instead of queueing behind a long-running query while it holds up writes
+ * to `agent_messages` and `requests`; a failed run is retried on the next boot.
+ * `DROP COLUMN` only touches the catalog, so no table is rewritten.
+ *
+ * `down()` restores the columns, constraint and indexes as the earlier
+ * migrations created them on the self-hosted path, empty. The cloud-only
+ * `IDX_requests_autofix_healed` was never part of that path.
+ */
+export class DropAutofixSchema1803400000000 implements MigrationInterface {
+  name = 'DropAutofixSchema1803400000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`SET LOCAL lock_timeout = '10s'`);
+    await queryRunner.query(`DROP INDEX IF EXISTS "IDX_agent_messages_autofix_request"`);
+    await queryRunner.query(`DROP INDEX IF EXISTS "IDX_agent_messages_autofix_group"`);
+    await queryRunner.query(`DROP INDEX IF EXISTS "IDX_requests_autofix_healed"`);
+    await queryRunner.query(`
+      ALTER TABLE "agent_messages"
+        DROP COLUMN IF EXISTS "autofix_applied",
+        DROP COLUMN IF EXISTS "autofix_group_id",
+        DROP COLUMN IF EXISTS "autofix_role",
+        DROP COLUMN IF EXISTS "autofix_operations",
+        DROP COLUMN IF EXISTS "autofix_phoenix"
+    `);
+    await queryRunner.query(
+      `ALTER TABLE "requests" DROP CONSTRAINT IF EXISTS "CHK_requests_autofix_status"`,
+    );
+    await queryRunner.query(`ALTER TABLE "requests" DROP COLUMN IF EXISTS "autofix_status"`);
+    await queryRunner.query(`ALTER TABLE "agents" DROP COLUMN IF EXISTS "autofix_enabled"`);
+    await queryRunner.query(
+      `ALTER TABLE "install_metadata" DROP COLUMN IF EXISTS "autofix_consented_at"`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "install_metadata" ADD COLUMN IF NOT EXISTS "autofix_consented_at" timestamp DEFAULT NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "agents" ADD COLUMN IF NOT EXISTS "autofix_enabled" boolean`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "requests" ADD COLUMN IF NOT EXISTS "autofix_status" varchar`,
+    );
+    await queryRunner.query(`
+      DO $$
+      BEGIN
+        IF NOT EXISTS (
+          SELECT 1 FROM pg_constraint WHERE conname = 'CHK_requests_autofix_status'
+        ) THEN
+          ALTER TABLE "requests" ADD CONSTRAINT "CHK_requests_autofix_status" CHECK (
+            "autofix_status" IN (
+              'no_patch', 'resolving', 'retry_succeeded', 'retry_failed', 'service_error'
+            )
+          );
+        END IF;
+      END $$
+    `);
+    await queryRunner.query(`
+      ALTER TABLE "agent_messages"
+        ADD COLUMN IF NOT EXISTS "autofix_applied" boolean NOT NULL DEFAULT false,
+        ADD COLUMN IF NOT EXISTS "autofix_group_id" character varying,
+        ADD COLUMN IF NOT EXISTS "autofix_role" character varying,
+        ADD COLUMN IF NOT EXISTS "autofix_operations" jsonb,
+        ADD COLUMN IF NOT EXISTS "autofix_phoenix" jsonb
+    `);
+    await queryRunner.query(
+      `CREATE INDEX IF NOT EXISTS "IDX_agent_messages_autofix_group" ON "agent_messages" ("tenant_id", "autofix_group_id") WHERE "autofix_group_id" IS NOT NULL`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX IF NOT EXISTS "IDX_agent_messages_autofix_request" ON "agent_messages" ("request_id") WHERE "autofix_applied" = true`,
+    );
+  }
+}
diff --git a/packages/backend/src/entities/agent-message.entity.spec.ts b/packages/backend/src/entities/agent-message.entity.spec.ts
index 980f0aec..6a536f12 100644
--- a/packages/backend/src/entities/agent-message.entity.spec.ts
+++ b/packages/backend/src/entities/agent-message.entity.spec.ts
@@ -2,15 +2,17 @@ import { getMetadataArgsStorage } from 'typeorm';
 import { AgentMessage } from './agent-message.entity';
 
 describe('AgentMessage schema mapping', () => {
-  it('keeps the legacy physical table and Autofix column names', () => {
+  it('keeps the legacy physical table name and maps no repair columns', () => {
     const metadata = getMetadataArgsStorage();
     const table = metadata.tables.find((entry) => entry.target === AgentMessage);
-    const autofixDecision = metadata.columns.find(
-      (entry) => entry.target === AgentMessage && entry.propertyName === 'autofix_decision',
+    const repairColumns = metadata.columns.filter(
+      (entry) =>
+        entry.target === AgentMessage &&
+        /^auto_?fix/i.test(String(entry.options.name ?? entry.propertyName)),
     );
 
     expect(table?.name).toBe('agent_messages');
-    expect(autofixDecision?.options.name).toBe('autofix_phoenix');
+    expect(repairColumns).toEqual([]);
   });
 
   it('keeps the new request linkage nullable for legacy writers', () => {
diff --git a/packages/backend/src/entities/agent-message.entity.ts b/packages/backend/src/entities/agent-message.entity.ts
index 6848adff..9bfa20bb 100644
--- a/packages/backend/src/entities/agent-message.entity.ts
+++ b/packages/backend/src/entities/agent-message.entity.ts
@@ -22,9 +22,6 @@ import type { CallerAttribution } from '../routing/proxy/caller-classifier';
 // ON DELETE SET NULL against the same column. tenant_provider_id leads so one
 // index serves both the connection-detail reads and the parent-delete cleanup.
 @Index(['tenant_provider_id', 'tenant_id', 'timestamp'])
-// Resolve the sibling row (failed original ↔ successful retry) of a healed
-// request by shared group id within the tenant.
-@Index(['tenant_id', 'autofix_group_id'])
 export class AgentMessage {
   @PrimaryColumn('varchar')
   id!: string;
@@ -218,33 +215,4 @@ export class AgentMessage {
   // it). NULL for pre-upgrade history, local/Ollama, and blind-proxy paths.
   @Column('varchar', { nullable: true })
   tenant_provider_id!: string | null;
-
-  // Autofix (self-healing) audit. A healed request is recorded as TWO rows:
-  // the failed original (status='auto_fixed') and the successful retry
-  // (status='ok'), both sharing `autofix_group_id`. `autofix_role` distinguishes
-  // them; `autofix_operations` holds the Phoenix edits that fixed it.
-  @Column('boolean', { default: false })
-  autofix_applied!: boolean;
-
-  // Links the failed original row and the successful retry row of one healed
-  // request (same value on both). NULL for non-autofix rows.
-  @Column('varchar', { nullable: true })
-  autofix_group_id!: string | null;
-
-  // 'original' (the failed request that was autofixed) or 'retry' (the
-  // successful re-send). NULL for non-autofix rows.
-  @Column('varchar', { nullable: true })
-  autofix_role!: string | null;
-
-  // The deterministic edits Phoenix applied to heal the request (e.g.
-  // rename_param max_tokens -> max_output_tokens). Typed `object` (like
-  // request_params) so TypeORM's deep-partial insert type stays simple.
-  @Column('jsonb', { nullable: true })
-  autofix_operations!: object | null;
-
-  // Phoenix's decision behind this attempt ({ status, issueId, patchId,
-  // healAttemptId, explanation }). Keep the physical legacy column name so
-  // replicas from the previous release can keep writing during a rolling deploy.
-  @Column('jsonb', { name: 'autofix_phoenix', nullable: true })
-  autofix_decision!: object | null;
 }
diff --git a/packages/backend/src/entities/agent.entity.ts b/packages/backend/src/entities/agent.entity.ts
index 8d9058c7..efa75dec 100644
--- a/packages/backend/src/entities/agent.entity.ts
+++ b/packages/backend/src/entities/agent.entity.ts
@@ -30,13 +30,6 @@ export class Agent {
   @Column('boolean', { default: false })
   complexity_routing_enabled!: boolean;
 
-  // Autofix: when enabled, a request-side 4xx is sent to the healing service
-  // (Phoenix) and the patched request is resent once before the fallback chain runs.
-  // Nullable: NULL means "no explicit choice — inherit the deployment-mode default"
-  // (ON in cloud, OFF in self-hosted), resolved in AutofixService.resolveEnabled().
-  @Column('boolean', { nullable: true })
-  autofix_enabled!: boolean | null;
-
   // Enabled for newly created agents. Existing agents keep their persisted
   // choice because the migration changes only the column default.
   @Column('boolean', { default: true })
diff --git a/packages/backend/src/entities/install-metadata.entity.ts b/packages/backend/src/entities/install-metadata.entity.ts
index d6fea691..2a544a3f 100644
--- a/packages/backend/src/entities/install-metadata.entity.ts
+++ b/packages/backend/src/entities/install-metadata.entity.ts
@@ -23,8 +23,4 @@ export class InstallMetadata {
 
   @Column(timestampType(), { nullable: true })
   last_sent_at!: string | null;
-
-  /** When the self-hosted install consented to Autofix (null = never). */
-  @Column(timestampType(), { nullable: true })
-  autofix_consented_at!: string | null;
 }
diff --git a/packages/backend/src/entities/request.entity.ts b/packages/backend/src/entities/request.entity.ts
index 1ae9dcf2..a52d796d 100644
--- a/packages/backend/src/entities/request.entity.ts
+++ b/packages/backend/src/entities/request.entity.ts
@@ -2,7 +2,6 @@ import { Column, Entity, Index, PrimaryColumn } from 'typeorm';
 import { timestampType } from '../common/utils/postgres-sql';
 import type { CallerAttribution } from '../routing/proxy/caller-classifier';
 import type { ProxyApiMode } from '../routing/proxy/proxy-types';
-import type { AutofixStatus } from 'manifest-shared';
 
 /**
  * One request made by a caller to Manifest.
@@ -56,10 +55,6 @@ export class ManifestRequest {
   @Column(timestampType(), { nullable: true })
   agent_usage_rolled_up_at?: string | null;
 
-  /** How Autofix ended for this request. NULL means it was not recorded. */
-  @Column('varchar', { nullable: true })
-  autofix_status!: AutofixStatus | null;
-
   @Column('varchar', { nullable: true })
   error_message!: string | null;
 
diff --git a/packages/backend/src/mcp/mcp.controller.ts b/packages/backend/src/mcp/mcp.controller.ts
index b52ff528..9449af9b 100644
--- a/packages/backend/src/mcp/mcp.controller.ts
+++ b/packages/backend/src/mcp/mcp.controller.ts
@@ -1,4 +1,4 @@
-import { Controller, Delete, Get, Post, Req, Res, Inject, Logger } from '@nestjs/common';
+import { Controller, Delete, Get, Post, Req, Res, Logger } from '@nestjs/common';
 import { createMcpProtectedRequestHandler } from '@better-auth/mcp';
 import { createDpopReplayStore } from 'better-auth/oauth2';
 import { createMcpHandler } from '@modelcontextprotocol/server';
@@ -6,8 +6,6 @@ import { fromNodeHeaders } from 'better-auth/node';
 import { Readable } from 'node:stream';
 import type { ReadableStream as NodeReadableStream } from 'node:stream/web';
 import { pipeline } from 'node:stream/promises';
-import { CACHE_MANAGER } from '@nestjs/cache-manager';
-import type { Cache } from 'cache-manager';
 import type { Request, Response } from 'express';
 import { DataSource, Repository } from 'typeorm';
 import { InjectRepository } from '@nestjs/typeorm';
@@ -20,7 +18,6 @@ import { AgentRecordingConfigService } from '../common/services/agent-recording-
 import { TimeseriesQueriesService } from '../analytics/services/timeseries-queries.service';
 import { AgentLifecycleService } from '../analytics/services/agent-lifecycle.service';
 import { MessagesQueryService } from '../analytics/services/messages-query.service';
-import { AutofixStatsService } from '../analytics/services/autofix-stats.service';
 import { ApiKeyGeneratorService } from '../otlp/services/api-key.service';
 import { ProviderService } from '../routing/routing-core/provider.service';
 import { TierService } from '../routing/routing-core/tier.service';
@@ -28,7 +25,6 @@ import { SpecificityService } from '../routing/routing-core/specificity.service'
 import { ResolveAgentService } from '../routing/routing-core/resolve-agent.service';
 import { HeaderTierService } from '../routing/header-tiers/header-tier.service';
 import { CustomProviderService } from '../routing/custom-provider/custom-provider.service';
-import { AutofixService } from '../routing/autofix/autofix.service';
 import { ModelDiscoveryService } from '../model-discovery/model-discovery.service';
 import { PricingSyncService } from '../database/pricing-sync.service';
 import { ModelPricesService } from '../model-prices/model-prices.service';
@@ -61,7 +57,6 @@ export class McpController {
   constructor(
     private readonly dataSource: DataSource,
     private readonly tenantCache: TenantCacheService,
-    @Inject(CACHE_MANAGER) private readonly cacheManager: Cache,
     private readonly agentListCache: AgentListCacheService,
     private readonly eventBus: IngestEventBusService,
     private readonly recording: AgentRecordingConfigService,
@@ -69,14 +64,12 @@ export class McpController {
     private readonly lifecycle: AgentLifecycleService,
     private readonly apiKeys: ApiKeyGeneratorService,
     private readonly messages: MessagesQueryService,
-    private readonly autofixStats: AutofixStatsService,
     private readonly providers: ProviderService,
     private readonly tiers: TierService,
     private readonly specificity: SpecificityService,
     private readonly resolveAgentService: ResolveAgentService,
     private readonly headerTiers: HeaderTierService,
     private readonly customProviders: CustomProviderService,
-    private readonly autofix: AutofixService,
     private readonly routeModelParams: RouteModelParamsService,
     private readonly modelDiscovery: ModelDiscoveryService,
     private readonly pricingSync: PricingSyncService,
@@ -93,14 +86,12 @@ export class McpController {
     return {
       dataSource: this.dataSource,
       tenantCache: this.tenantCache,
-      cacheManager: this.cacheManager,
       agentListCache: this.agentListCache,
       eventBus: this.eventBus,
       recording: this.recording,
       timeseries: this.timeseries,
       lifecycle: this.lifecycle,
       apiKeys: this.apiKeys,
-      autofixStats: this.autofixStats,
       messages: this.messages,
       providers: this.providers,
       tiers: this.tiers,
@@ -108,7 +99,6 @@ export class McpController {
       resolveAgent: this.resolveAgentService,
       headerTiers: this.headerTiers,
       customProviders: this.customProviders,
-      autofix: this.autofix,
       routeModelParams: this.routeModelParams,
       modelDiscovery: this.modelDiscovery,
       pricingSync: this.pricingSync,
diff --git a/packages/backend/src/mcp/mcp.module.ts b/packages/backend/src/mcp/mcp.module.ts
index 0ff72267..00481a90 100644
--- a/packages/backend/src/mcp/mcp.module.ts
+++ b/packages/backend/src/mcp/mcp.module.ts
@@ -3,7 +3,6 @@ import { RouteModelParamsModule } from '../routing/model-params/route-model-para
 import { TypeOrmModule } from '@nestjs/typeorm';
 import { AnalyticsModule } from '../analytics/analytics.module';
 import { CommonModule } from '../common/common.module';
-import { AutofixModule } from '../routing/autofix/autofix.module';
 import { CustomProviderModule } from '../routing/custom-provider/custom-provider.module';
 import { HeaderTiersModule } from '../routing/header-tiers/header-tiers.module';
 import { RoutingCoreModule } from '../routing/routing-core/routing-core.module';
@@ -28,7 +27,6 @@ import { McpController } from './mcp.controller';
     RoutingCoreModule,
     HeaderTiersModule,
     CustomProviderModule,
-    AutofixModule,
     ModelDiscoveryModule,
     ModelPricesModule,
     OtlpModule,
diff --git a/packages/backend/src/mcp/tool-deps.ts b/packages/backend/src/mcp/tool-deps.ts
index 3f187839..7d304cd8 100644
--- a/packages/backend/src/mcp/tool-deps.ts
+++ b/packages/backend/src/mcp/tool-deps.ts
@@ -1,5 +1,4 @@
 import { DataSource, Repository } from 'typeorm';
-import type { Cache } from 'cache-manager';
 import { TenantProvider } from '../entities/tenant-provider.entity';
 import { AgentEnabledProvider } from '../entities/agent-enabled-provider.entity';
 import { Agent } from '../entities/agent.entity';
@@ -10,7 +9,6 @@ import { AgentRecordingConfigService } from '../common/services/agent-recording-
 import { TimeseriesQueriesService } from '../analytics/services/timeseries-queries.service';
 import { AgentLifecycleService } from '../analytics/services/agent-lifecycle.service';
 import { MessagesQueryService } from '../analytics/services/messages-query.service';
-import { AutofixStatsService } from '../analytics/services/autofix-stats.service';
 import { ApiKeyGeneratorService } from '../otlp/services/api-key.service';
 import { ProviderService } from '../routing/routing-core/provider.service';
 import { TierService } from '../routing/routing-core/tier.service';
@@ -18,7 +16,6 @@ import { SpecificityService } from '../routing/routing-core/specificity.service'
 import { ResolveAgentService } from '../routing/routing-core/resolve-agent.service';
 import { HeaderTierService } from '../routing/header-tiers/header-tier.service';
 import { CustomProviderService } from '../routing/custom-provider/custom-provider.service';
-import { AutofixService } from '../routing/autofix/autofix.service';
 import { RouteModelParamsService } from '../routing/model-params/route-model-params.service';
 import { ModelDiscoveryService } from '../model-discovery/model-discovery.service';
 import { PricingSyncService } from '../database/pricing-sync.service';
@@ -32,14 +29,12 @@ import { ModelPricesService } from '../model-prices/model-prices.service';
 export interface McpToolDeps {
   dataSource: DataSource;
   tenantCache: TenantCacheService;
-  cacheManager: Cache;
   agentListCache: AgentListCacheService;
   eventBus: IngestEventBusService;
   recording: AgentRecordingConfigService;
   timeseries: TimeseriesQueriesService;
   lifecycle: AgentLifecycleService;
   apiKeys: ApiKeyGeneratorService;
-  autofixStats: AutofixStatsService;
   messages: MessagesQueryService;
   providers: ProviderService;
   tiers: TierService;
@@ -47,7 +42,6 @@ export interface McpToolDeps {
   resolveAgent: ResolveAgentService;
   headerTiers: HeaderTierService;
   customProviders: CustomProviderService;
-  autofix: AutofixService;
   routeModelParams: RouteModelParamsService;
   modelDiscovery: ModelDiscoveryService;
   pricingSync: PricingSyncService;
diff --git a/packages/backend/src/mcp/tools/agents.tools.ts b/packages/backend/src/mcp/tools/agents.tools.ts
index 4f439b81..06d11e58 100644
--- a/packages/backend/src/mcp/tools/agents.tools.ts
+++ b/packages/backend/src/mcp/tools/agents.tools.ts
@@ -22,12 +22,6 @@ export function registerAgentTools(
     if (tenantId) await deps.agentListCache.invalidate(tenantId);
   };
 
-  // The dashboard caches a workspace Autofix verdict under this key; a create or
-  // update that flips Autofix must drop it or the sidebar keeps the old state.
-  const invalidateAutofixStatus = async (tenantId: string | null): Promise<void> => {
-    if (tenantId) await deps.cacheManager.del(`${tenantId}:/api/v1/autofix/status`);
-  };
-
   server.registerTool(
     'manifest_agent_list',
     {
@@ -104,20 +98,15 @@ export function registerAgentTools(
         name: z.string().min(1).max(100),
         agent_category: z.enum(AGENT_CATEGORIES).optional(),
         agent_platform: z.enum(AGENT_PLATFORMS).optional(),
-        autofix_enabled: z.boolean().optional(),
         record_messages: z.boolean().optional(),
       }),
     },
-    async ({ name, agent_category, agent_platform, autofix_enabled, record_messages }) =>
+    async ({ name, agent_category, agent_platform, record_messages }) =>
       result(
         (async () => {
           const slug = slugify(name);
           if (!slug) throw new Error('Agent name produces an empty slug');
           if (slug === PLAYGROUND_AGENT_SLUG) throw new Error('"Playground" is a reserved name');
-          if (autofix_enabled === true) {
-            await deps.autofixStats.recordAutofixConsent();
-            await invalidateAutofixStatus(operator.tenantId);
-          }
           const created = await deps.apiKeys.onboardAgent({
             tenantId: operator.tenantId,
             ownerUserId: operator.userId,
@@ -125,7 +114,6 @@ export function registerAgentTools(
             displayName: name.trim(),
             agentCategory: agent_category,
             agentPlatform: agent_platform,
-            autofixEnabled: autofix_enabled,
             recordMessages: record_messages,
           });
           try {
@@ -141,11 +129,9 @@ export function registerAgentTools(
               // Best effort: the caller sees the provider error either way.
             }
             await invalidate(created.tenantId);
-            await invalidateAutofixStatus(created.tenantId);
             throw error;
           }
           await invalidate(created.tenantId);
-          await invalidateAutofixStatus(created.tenantId);
           deps.eventBus.emit(created.tenantId, 'agent', operator.userId);
           return {
             agent: {
@@ -213,7 +199,6 @@ export function registerAgentTools(
         (async () => {
           await deps.lifecycle.deleteAgent(operator.tenantId, agent);
           await invalidate(operator.tenantId);
-          await invalidateAutofixStatus(operator.tenantId);
           deps.eventBus.emit(operator.tenantId, 'agent', operator.userId);
           return { deleted: true, agent };
         })(),
diff --git a/packages/backend/src/mcp/tools/routing.tools.ts b/packages/backend/src/mcp/tools/routing.tools.ts
index fc869b06..a9d54274 100644
--- a/packages/backend/src/mcp/tools/routing.tools.ts
+++ b/packages/backend/src/mcp/tools/routing.tools.ts
@@ -86,8 +86,8 @@ function hasSurfacePayload(surface: string, parsed: Record<string, unknown>): bo
 }
 
 /**
- * Routing tools: readiness, default-tier fallbacks, per-agent Autofix/recording
- * switches, and the custom (header) tier lifecycle. "Custom tier" is the CLI's
+ * Routing tools: readiness, default-tier fallbacks, per-agent recording
+ * switch, and the custom (header) tier lifecycle. "Custom tier" is the CLI's
  * name for a header tier — a rule that overrides the route when a request
  * carries a matching header.
  */
@@ -237,44 +237,6 @@ export function registerRoutingTools(
         ),
     );
 
-  server.registerTool(
-    'manifest_routing_autofix_get',
-    {
-      title: 'Get Autofix state',
-      description: 'Report whether Autofix is effective for a harness.',
-      inputSchema: z.object({ agent: z.string().min(1) }),
-      annotations: { readOnlyHint: true },
-    },
-    async ({ agent: agentName }) =>
-      result(
-        (async () => {
-          const agent = await deps.resolveAgent.resolve(operator.tenantId, agentName);
-          return { enabled: deps.autofix.resolveEnabled(agent.autofix_enabled) };
-        })(),
-      ),
-  );
-
-  if (canWrite)
-    server.registerTool(
-      'manifest_routing_autofix_set',
-      {
-        title: 'Set Autofix state',
-        description: 'Enable or disable Autofix for a harness.',
-        inputSchema: z.object({ agent: z.string().min(1), enabled: z.boolean() }),
-      },
-      async ({ agent: agentName, enabled }) =>
-        result(
-          (async () => {
-            const agent = await deps.resolveAgent.resolve(operator.tenantId, agentName);
-            if (enabled) await deps.autofixStats.recordAutofixConsent();
-            await deps.agentRepo.update(agent.id, { autofix_enabled: enabled });
-            deps.resolveAgent.invalidate(agent.tenant_id, agentName);
-            await deps.cacheManager.del(`${agent.tenant_id}:/api/v1/autofix/status`);
-            return { enabled: deps.autofix.resolveEnabled(enabled) };
-          })(),
-        ),
-    );
-
   server.registerTool(
     'manifest_routing_recording_get',
     {
@@ -453,7 +415,7 @@ export function registerRoutingTools(
       {
         title: 'Configure an agent',
         description:
-          'Set the default route and fallback chain (or a custom header tier), and/or toggle Autofix and recording. `models` is the full chain: first is the route, the rest are fallbacks.',
+          'Set the default route and fallback chain (or a custom header tier), and/or toggle recording. `models` is the full chain: first is the route, the rest are fallbacks.',
         inputSchema: z.object({
           agent: z.string().min(1),
           models: z.array(z.string().min(1)).min(1).max(6).optional(),
@@ -465,7 +427,6 @@ export function registerRoutingTools(
             .min(1)
             .optional()
             .describe('Upsert this custom header tier instead of the default route.'),
-          autofix: z.boolean().optional(),
           recording: z.boolean().optional(),
           force: z.boolean().optional().describe('Skip the discovered-model check.'),
         }),
@@ -477,7 +438,6 @@ export function registerRoutingTools(
         auth_type,
         key_label,
         tier,
-        autofix,
         recording,
         force,
       }) =>
@@ -490,10 +450,8 @@ export function registerRoutingTools(
               provider !== undefined ||
               auth_type !== undefined ||
               key_label !== undefined;
-            if (!wantsRoute && autofix === undefined && recording === undefined) {
-              throw new Error(
-                'Nothing to configure — pass models + provider, autofix, and/or recording',
-              );
+            if (!wantsRoute && recording === undefined) {
+              throw new Error('Nothing to configure — pass models + provider and/or recording');
             }
             if (tier !== undefined && !wantsRoute)
               throw new Error('tier needs models and provider');
@@ -594,13 +552,6 @@ export function registerRoutingTools(
                 );
               }
             }
-            if (autofix !== undefined) {
-              if (autofix) await deps.autofixStats.recordAutofixConsent();
-              await deps.agentRepo.update(agent.id, { autofix_enabled: autofix });
-              deps.resolveAgent.invalidate(agent.tenant_id, agentName);
-              await deps.cacheManager.del(`${agent.tenant_id}:/api/v1/autofix/status`);
-              output['autofix'] = { enabled: deps.autofix.resolveEnabled(autofix) };
-            }
             if (recording !== undefined) {
               await deps.agentRepo.update(agent.id, { record_messages: recording });
               deps.resolveAgent.invalidate(agent.tenant_id, agentName);
diff --git a/packages/backend/src/mcp/tools/tools.spec.ts b/packages/backend/src/mcp/tools/tools.spec.ts
index 0aa73d6b..d7b578da 100644
--- a/packages/backend/src/mcp/tools/tools.spec.ts
+++ b/packages/backend/src/mcp/tools/tools.spec.ts
@@ -26,7 +26,7 @@ function capture(): { server: McpServer; tools: Map<string, Handler> } {
 }
 
 const TENANT = 'tenant-1';
-const AGENT = { id: 'agent-1', tenant_id: TENANT, name: 'demo', autofix_enabled: null };
+const AGENT = { id: 'agent-1', tenant_id: TENANT, name: 'demo' };
 const CONNECTION = {
   id: 'conn-1',
   provider: 'openai',
@@ -53,7 +53,6 @@ function makeDeps(): McpToolDeps {
   return {
     dataSource: {} as never,
     tenantCache: {} as never,
-    cacheManager: { del: jest.fn().mockResolvedValue(undefined) } as never,
     agentListCache: { invalidate: jest.fn().mockResolvedValue(undefined) } as never,
     eventBus: { emit: jest.fn() } as never,
     recording: { isRecording: jest.fn().mockResolvedValue(true) } as never,
@@ -78,7 +77,6 @@ function makeDeps(): McpToolDeps {
       getKeyForAgent: jest.fn().mockResolvedValue({ keyPrefix: 'p', fullKey: 'full' }),
       rotateKey: jest.fn().mockResolvedValue({ apiKey: 'r' }),
     } as never,
-    autofixStats: { recordAutofixConsent: jest.fn().mockResolvedValue(undefined) } as never,
     messages: {
       getMessages: jest
         .fn()
@@ -126,7 +124,6 @@ function makeDeps(): McpToolDeps {
       remove: jest.fn().mockResolvedValue(undefined),
       probeModels: jest.fn().mockResolvedValue([{ model_name: 'm' }]),
     } as never,
-    autofix: { resolveEnabled: jest.fn().mockReturnValue(true) } as never,
     routeModelParams: {
       get: jest.fn().mockResolvedValue({ tier: 'default', params: [] }),
       update: jest.fn().mockResolvedValue({ tier: 'default', params: [] }),
@@ -230,7 +227,7 @@ describe('MCP tools', () => {
         name: 'My Agent',
         agent_platform: 'codex',
         agent_category: 'automation',
-        autofix_enabled: true,
+        record_messages: false,
       });
       expect(data).toMatchObject({ agent: { name: 'my-agent' }, apiKey: 'k' });
     });
@@ -583,15 +580,9 @@ describe('MCP tools', () => {
       expect(tools.has('manifest_routing_params_set')).toBe(false);
     });
 
-    it('reads and writes Autofix and recording', async () => {
+    it('reads and writes recording, and exposes no repair toggle', async () => {
       const tools = registerAll(makeDeps());
-      expect(
-        (await call(tools, 'manifest_routing_autofix_get', { agent: 'demo' })).error,
-      ).toBeFalsy();
-      expect(
-        (await call(tools, 'manifest_routing_autofix_set', { agent: 'demo', enabled: false }))
-          .error,
-      ).toBeFalsy();
+      expect([...tools.keys()].filter((name) => name.includes('auto'))).toEqual([]);
       expect(
         (await call(tools, 'manifest_routing_recording_get', { agent: 'demo' })).error,
       ).toBeFalsy();
@@ -703,7 +694,6 @@ describe('MCP tools', () => {
         (
           await call(tools, 'manifest_agent_configure', {
             agent: 'demo',
-            autofix: false,
             recording: true,
           })
         ).error,
@@ -790,8 +780,13 @@ describe('MCP tools', () => {
       const tools = registerAll(makeDeps());
       // tier with another toggle set reaches the "tier needs models" guard.
       expect(
-        (await call(tools, 'manifest_agent_configure', { agent: 'demo', tier: 'x', autofix: true }))
-          .error,
+        (
+          await call(tools, 'manifest_agent_configure', {
+            agent: 'demo',
+            tier: 'x',
+            recording: true,
+          })
+        ).error,
       ).toBe(true);
 
       const deps = makeDeps();
diff --git a/packages/backend/src/notifications/emails/doctor-release.spec.ts b/packages/backend/src/notifications/emails/doctor-release.spec.ts
deleted file mode 100644
index 37c14759..00000000
--- a/packages/backend/src/notifications/emails/doctor-release.spec.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import { renderToStaticMarkup } from 'react-dom/server';
-import * as React from 'react';
-import { DoctorReleaseEmail } from './doctor-release';
-
-// Same approach as threshold-alert.spec: react-email's `render` uses dynamic
-// imports that fight Jest's CJS transform, so we render the React tree to
-// static markup, which is the layer carrying the content we assert on.
-function renderEmail(props: Parameters<typeof DoctorReleaseEmail>[0]): string {
-  return renderToStaticMarkup(React.createElement(DoctorReleaseEmail, props));
-}
-
-describe('DoctorReleaseEmail', () => {
-  it('renders the announcement with the two CTAs and waitlist footer', () => {
-    const html = renderEmail({
-      appUrl: 'https://app.manifest.build',
-      tutorialUrl: 'https://manifest.build/blog/auto-fix',
-    });
-    expect(html).toContain('Autofix is live on your account');
-    expect(html).toContain('already running on your account');
-    expect(html).toContain('https://app.manifest.build');
-    expect(html).toContain('Open your dashboard');
-    expect(html).toContain('How Autofix works');
-    expect(html).toContain('https://manifest.build/blog/auto-fix');
-    expect(html).toContain('because you joined the Autofix');
-    // The header reads "New: <icon> Autofix", not the old green badge.
-    expect(html).toContain('New:');
-    expect(html).toContain('autofix-icon-email.png');
-    // House copy rules: no em dashes in user-facing sentences.
-    expect(html).not.toContain('\u2014');
-  });
-
-  it('omits the tutorial button until the article URL exists', () => {
-    const html = renderEmail({ appUrl: 'https://app.manifest.build' });
-    expect(html).not.toContain('How Autofix works');
-    expect(html).toContain('Open your dashboard');
-  });
-});
diff --git a/packages/backend/src/notifications/emails/doctor-release.tsx b/packages/backend/src/notifications/emails/doctor-release.tsx
deleted file mode 100644
index e8d6a13c..00000000
--- a/packages/backend/src/notifications/emails/doctor-release.tsx
+++ /dev/null
@@ -1,218 +0,0 @@
-import { getEmailAssetUrl } from '../../common/utils/dashboard-url';
-import * as React from 'react';
-import {
-  Html,
-  Head,
-  Body,
-  Container,
-  Section,
-  Text,
-  Preview,
-  Hr,
-  Link,
-  Img,
-  Button,
-} from '@react-email/components';
-
-export interface DoctorReleaseProps {
-  /** The dashboard the reader lands on. */
-  appUrl: string;
-  /** The tutorial article (blog). Optional until published. */
-  tutorialUrl?: string;
-  logoUrl?: string;
-  /** The Autofix gradient sparkle mark (hosted PNG). */
-  autofixIconUrl?: string;
-}
-
-/**
- * The Autofix release announcement, sent once to every waitlist member when
- * the Doctor version ships. Copy rules: recovery vocabulary (a fallback is a
- * retry, an autofix produces an attempt), no em dashes, short sentences.
- */
-export function DoctorReleaseEmail(props: DoctorReleaseProps) {
-  const {
-    appUrl,
-    tutorialUrl,
-    logoUrl = getEmailAssetUrl('manifest-logo.png', props.appUrl),
-    autofixIconUrl = getEmailAssetUrl('autofix-icon-email.png', props.appUrl),
-  } = props;
-
-  return (
-    <Html>
-      <Head />
-      <Preview>
-        Autofix is live on your account. Your failing requests can now repair themselves.
-      </Preview>
-      <Body style={body}>
-        <Container style={container}>
-          <Section style={logoSection}>
-            <Img src={logoUrl} alt="Manifest LLM Gateway" width="174" height="32" style={logoImg} />
-          </Section>
-
-          <Section style={card}>
-            <Section style={badgeContainer}>
-              <Text style={newLine}>
-                <span style={newLabel}>New:</span>{' '}
-                <Img src={autofixIconUrl} alt="" width="18" height="18" style={autofixIcon} />{' '}
-                <span style={autofixName}>Autofix</span>
-              </Text>
-            </Section>
-
-            <Text style={heading}>Autofix is live on your account</Text>
-
-            <Text style={paragraph}>
-              You joined the waitlist. Here it is: Autofix shipped today, and it is already running
-              on your account. You have nothing to turn on.
-            </Text>
-
-            <Text style={paragraph}>
-              From now on, when a provider rejects one of your requests with a fixable error, a
-              renamed parameter, an unsupported field, a deprecated model, Manifest repairs the
-              request and sends it again. Your agent gets its answer. You see the whole story in
-              your dashboard: the failure, the fix, the retry.
-            </Text>
-
-            <Text style={paragraph}>
-              Autofix learns from real traffic. Each new error we patch works for every account, so
-              the share of requests it can repair grows week after week.
-            </Text>
-
-            <Section style={buttonSection}>
-              <Button href={appUrl} style={buttonPrimary}>
-                Open your dashboard
-              </Button>
-              {tutorialUrl ? (
-                <Button href={tutorialUrl} style={buttonSecondary}>
-                  How Autofix works
-                </Button>
-              ) : null}
-            </Section>
-
-            <Hr style={hr} />
-
-            <Text style={footer}>
-              You are receiving this email because you joined the Autofix waitlist on Manifest.
-            </Text>
-          </Section>
-        </Container>
-      </Body>
-    </Html>
-  );
-}
-
-const brandBg = '#faf9f6';
-const brandCardBg = '#ffffff';
-const brandBorder = '#e8e5df';
-const brandFont =
-  "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif";
-const brandInk = '#1a1a1a';
-const brandMuted = '#6b6b6b';
-
-const body: React.CSSProperties = {
-  backgroundColor: brandBg,
-  fontFamily: brandFont,
-  margin: 0,
-  padding: 0,
-};
-
-const container: React.CSSProperties = {
-  maxWidth: '520px',
-  margin: '0 auto',
-  padding: '40px 20px',
-};
-
-const logoSection: React.CSSProperties = {
-  textAlign: 'center' as const,
-  paddingBottom: '32px',
-};
-
-const logoImg: React.CSSProperties = {
-  margin: '0 auto',
-};
-
-const card: React.CSSProperties = {
-  backgroundColor: brandCardBg,
-  borderRadius: '12px',
-  padding: '40px 36px',
-  border: `1px solid ${brandBorder}`,
-};
-
-const badgeContainer: React.CSSProperties = {
-  marginBottom: '16px',
-};
-
-const newLine: React.CSSProperties = {
-  fontSize: '14px',
-  margin: 0,
-  lineHeight: '18px',
-};
-
-const newLabel: React.CSSProperties = {
-  color: brandInk,
-  fontWeight: 600,
-};
-
-const autofixIcon: React.CSSProperties = {
-  display: 'inline-block',
-  verticalAlign: 'middle',
-  borderRadius: '4px',
-  margin: '0 2px',
-};
-
-const autofixName: React.CSSProperties = {
-  color: brandInk,
-  fontWeight: 700,
-};
-
-const heading: React.CSSProperties = {
-  fontSize: '22px',
-  fontWeight: 700,
-  color: brandInk,
-  margin: '0 0 16px',
-  lineHeight: '1.3',
-};
-
-const paragraph: React.CSSProperties = {
-  fontSize: '14px',
-  lineHeight: '1.6',
-  color: brandInk,
-  margin: '0 0 16px',
-};
-
-const buttonSection: React.CSSProperties = {
-  textAlign: 'left' as const,
-  margin: '28px 0 20px',
-};
-
-const buttonBase: React.CSSProperties = {
-  fontSize: '14px',
-  fontWeight: 600,
-  borderRadius: '8px',
-  padding: '12px 24px',
-  textDecoration: 'none',
-};
-
-const buttonPrimary: React.CSSProperties = {
-  ...buttonBase,
-  backgroundColor: brandInk,
-  color: '#ffffff',
-  marginRight: '12px',
-};
-
-const buttonSecondary: React.CSSProperties = {
-  ...buttonBase,
-  backgroundColor: brandCardBg,
-  color: brandInk,
-  border: `1px solid ${brandBorder}`,
-};
-
-const hr: React.CSSProperties = {
-  borderColor: brandBorder,
-  margin: '24px 0 16px',
-};
-
-const footer: React.CSSProperties = {
-  fontSize: '12px',
-  color: brandMuted,
-  margin: 0,
-};
diff --git a/packages/backend/src/notifications/emails/email-assets.spec.ts b/packages/backend/src/notifications/emails/email-assets.spec.ts
index b5ecd216..4da04f0e 100644
--- a/packages/backend/src/notifications/emails/email-assets.spec.ts
+++ b/packages/backend/src/notifications/emails/email-assets.spec.ts
@@ -3,7 +3,6 @@ import { VerifyEmailEmail } from './verify-email';
 import { ResetPasswordEmail } from './reset-password';
 import { TestEmail } from './test-email';
 import { ThresholdAlertEmail } from './threshold-alert';
-import { DoctorReleaseEmail } from './doctor-release';
 
 const dashboard = 'https://dashboard.example';
 const renderers = {
@@ -20,7 +19,6 @@ const renderers = {
       timestamp: '2026-09-11 12:00',
       agentUrl: `${dashboard}/harnesses/demo`,
     }),
-  announcement: () => DoctorReleaseEmail({ appUrl: dashboard }),
 };
 
 describe('email image deployment URLs', () => {
@@ -42,23 +40,9 @@ describe('email image deployment URLs', () => {
     },
   );
 
-  it('honors explicit image hosting overrides', () => {
-    const html = renderToStaticMarkup(
-      DoctorReleaseEmail({
-        appUrl: dashboard,
-        logoUrl: 'https://cdn.example/logo.png',
-        autofixIconUrl: 'https://cdn.example/autofix.png',
-      }),
-    );
+  it('honors an explicit logo hosting override', () => {
+    const html = renderToStaticMarkup(TestEmail({ logoUrl: 'https://cdn.example/logo.png' }));
     expect(html).toContain('src="https://cdn.example/logo.png"');
-    expect(html).toContain('src="https://cdn.example/autofix.png"');
-  });
-
-  it('uses the email dashboard for images even when the server has another default', () => {
-    process.env['BETTER_AUTH_URL'] = 'https://server.example';
-    const html = renderToStaticMarkup(DoctorReleaseEmail({ appUrl: dashboard }));
-    expect(html).toContain(`src="${dashboard}/manifest-logo.png"`);
-    expect(html).toContain(`src="${dashboard}/autofix-icon-email.png"`);
-    expect(html).not.toContain('server.example');
+    expect(html).not.toContain(`${dashboard}/manifest-logo.png`);
   });
 });
diff --git a/packages/backend/src/otlp/services/api-key.service.spec.ts b/packages/backend/src/otlp/services/api-key.service.spec.ts
index 94ac3ca4..af4970b0 100644
--- a/packages/backend/src/otlp/services/api-key.service.spec.ts
+++ b/packages/backend/src/otlp/services/api-key.service.spec.ts
@@ -204,31 +204,24 @@ describe('ApiKeyGeneratorService', () => {
         }),
       );
     });
-    it('writes explicit Autofix and recording choices when provided', async () => {
+    it('writes an explicit recording choice when provided', async () => {
       mockTenantFindOne.mockResolvedValue(null);
 
-      await service.onboardAgent({
-        ...defaultParams,
-        autofixEnabled: false,
-        recordMessages: false,
-      });
+      await service.onboardAgent({ ...defaultParams, recordMessages: false });
 
       expect(mockAgentInsert).toHaveBeenCalledWith(
-        expect.objectContaining({
-          autofix_enabled: false,
-          record_messages: false,
-        }),
+        expect.objectContaining({ record_messages: false }),
       );
     });
 
-    it('omits Autofix and recording when the caller made no choice', async () => {
+    it('omits recording when the caller made no choice', async () => {
       mockTenantFindOne.mockResolvedValue(null);
 
       await service.onboardAgent(defaultParams);
 
       const inserted = mockAgentInsert.mock.calls[0][0];
-      expect(inserted).not.toHaveProperty('autofix_enabled');
       expect(inserted).not.toHaveProperty('record_messages');
+      expect(Object.keys(inserted).filter((key) => key.startsWith('auto'))).toEqual([]);
     });
 
     it('should store encrypted key, key_hash and key_prefix', async () => {
diff --git a/packages/backend/src/otlp/services/api-key.service.ts b/packages/backend/src/otlp/services/api-key.service.ts
index 22cd9843..fc1e9080 100644
--- a/packages/backend/src/otlp/services/api-key.service.ts
+++ b/packages/backend/src/otlp/services/api-key.service.ts
@@ -44,8 +44,6 @@ export class ApiKeyGeneratorService {
     displayName?: string;
     agentCategory?: string;
     agentPlatform?: string;
-    /** Explicit Autofix choice. Undefined → column default / mode inherit (NULL). */
-    autofixEnabled?: boolean;
     /** Explicit recording choice. Undefined → column default (true for new agents). */
     recordMessages?: boolean;
   }): Promise<{ tenantId: string; agentId: string; apiKey: string }> {
@@ -83,10 +81,8 @@ export class ApiKeyGeneratorService {
       description: params.agentDescription ?? null,
       agent_category: params.agentCategory ?? null,
       agent_platform: params.agentPlatform ?? null,
-      // Only set when the caller made an explicit choice. Leaving them out lets
-      // the column default / NULL-inherit path apply (Autofix mode default,
-      // recording ON for new agents).
-      ...(params.autofixEnabled !== undefined ? { autofix_enabled: params.autofixEnabled } : {}),
+      // Only set when the caller made an explicit choice. Leaving it out lets
+      // the column default apply (recording ON for new agents).
       ...(params.recordMessages !== undefined ? { record_messages: params.recordMessages } : {}),
       is_active: true,
       tenant_id: tenantId,
diff --git a/packages/backend/src/playground/playground.service.ts b/packages/backend/src/playground/playground.service.ts
index 91bbd151..be34299f 100644
--- a/packages/backend/src/playground/playground.service.ts
+++ b/packages/backend/src/playground/playground.service.ts
@@ -516,7 +516,6 @@ export class PlaygroundService {
           timestamp,
           duration_ms: metrics.durationMs,
           status: 'success',
-          autofix_status: null,
           error_message: null,
           error_http_status: null,
           error_code: null,
@@ -594,7 +593,6 @@ export class PlaygroundService {
           timestamp,
           duration_ms: durationMs,
           status: 'failed',
-          autofix_status: null,
           error_message: errorMessage,
           error_http_status: status,
           error_code: null,
@@ -644,7 +642,6 @@ export class PlaygroundService {
         timestamp: new Date().toISOString(),
         duration_ms: 0,
         status: 'failed',
-        autofix_status: null,
         error_message: errorMessage,
         error_http_status: status,
         error_code: null,
diff --git a/packages/backend/src/routing/autofix/__tests__/autofix-healing-config.spec.ts b/packages/backend/src/routing/autofix/__tests__/autofix-healing-config.spec.ts
deleted file mode 100644
index 80845169..00000000
--- a/packages/backend/src/routing/autofix/__tests__/autofix-healing-config.spec.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { AUTOFIX_URL, resolveHealingUrl } from '../autofix-healing-config';
-
-describe('resolveHealingUrl', () => {
-  it('sends production at hosted Phoenix regardless of deployment mode', () => {
-    // Cloud and self-hosted heal against the same service; only the auth
-    // header differs, and that is decided in the module, not here.
-    expect(resolveHealingUrl('production')).toBe(AUTOFIX_URL);
-  });
-
-  it('resolves no URL outside production so dev/test reach the in-process mock', () => {
-    // A developer running the stack locally must never post real failures at
-    // the production healer, and a test must never depend on the network.
-    expect(resolveHealingUrl('development')).toBeUndefined();
-    expect(resolveHealingUrl('test')).toBeUndefined();
-    expect(resolveHealingUrl(undefined)).toBeUndefined();
-  });
-
-  it('pins the only production healer origin', () => {
-    // The URL is a constant with no override, so this literal is the whole
-    // contract. Demo and Railway-generated hostnames are not valid here.
-    expect(AUTOFIX_URL).toBe('https://autofix.manifest.build');
-    expect(new URL(AUTOFIX_URL).hostname).toBe('autofix.manifest.build');
-    expect(new URL(AUTOFIX_URL).pathname).toBe('/');
-  });
-});
diff --git a/packages/backend/src/routing/autofix/__tests__/autofix-health-probe.spec.ts b/packages/backend/src/routing/autofix/__tests__/autofix-health-probe.spec.ts
deleted file mode 100644
index cbdd2e49..00000000
--- a/packages/backend/src/routing/autofix/__tests__/autofix-health-probe.spec.ts
+++ /dev/null
@@ -1,120 +0,0 @@
-import { Logger } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { AutofixHealthProbe } from '../autofix-health-probe';
-import { AUTOFIX_URL } from '../autofix-healing-config';
-
-const HEALTH_URL = `${AUTOFIX_URL}/api/health`;
-
-function makeConfig(overrides: Record<string, string | undefined> = {}): ConfigService {
-  return { get: jest.fn((key: string) => overrides[key]) } as unknown as ConfigService;
-}
-
-function makeProbe(overrides: Record<string, string | undefined> = {}): AutofixHealthProbe {
-  return new AutofixHealthProbe(makeConfig(overrides));
-}
-
-function fakeResponse(ok: boolean, status: number): Response {
-  return { ok, status } as unknown as Response;
-}
-
-describe('AutofixHealthProbe', () => {
-  let fetchSpy: jest.SpyInstance;
-  let previousMode: string | undefined;
-
-  beforeEach(() => {
-    previousMode = process.env.MANIFEST_MODE;
-    process.env.MANIFEST_MODE = 'cloud';
-    fetchSpy = jest.spyOn(global, 'fetch');
-  });
-
-  afterEach(() => {
-    if (previousMode === undefined) delete process.env.MANIFEST_MODE;
-    else process.env.MANIFEST_MODE = previousMode;
-    jest.restoreAllMocks();
-  });
-
-  it('does not probe outside production (NODE_ENV unset)', async () => {
-    await makeProbe({}).probe();
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it('does not probe in development, even in self-hosted mode', async () => {
-    // Dev runs the in-process mock, so there is no healer to reach.
-    process.env.MANIFEST_MODE = 'selfhosted';
-    await makeProbe({ NODE_ENV: 'development' }).probe();
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it('makes no contact at all when AUTOFIX_GLOBAL_ENABLED=false', async () => {
-    // This is the only opt-out left now that the healer URL is a constant, so
-    // it has to cover the boot probe too, not just the heal path.
-    process.env.MANIFEST_MODE = 'selfhosted';
-
-    await makeProbe({ NODE_ENV: 'production', AUTOFIX_GLOBAL_ENABLED: 'false' }).probe();
-
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it('probes hosted Phoenix in self-hosted production', async () => {
-    process.env.MANIFEST_MODE = 'selfhosted';
-    fetchSpy.mockResolvedValue(fakeResponse(true, 200));
-    jest.spyOn(Logger.prototype, 'log').mockImplementation(() => undefined);
-
-    await makeProbe({ NODE_ENV: 'production' }).probe();
-
-    expect(fetchSpy.mock.calls[0][0]).toBe(HEALTH_URL);
-    expect(fetchSpy.mock.calls[0][1].headers).toBeUndefined();
-  });
-
-  it('probes hosted Phoenix in cloud production too, and logs success on 2xx', async () => {
-    fetchSpy.mockResolvedValue(fakeResponse(true, 200));
-    const logSpy = jest.spyOn(Logger.prototype, 'log').mockImplementation(() => undefined);
-    const warnSpy = jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-
-    await makeProbe({ NODE_ENV: 'production' }).probe();
-
-    expect(fetchSpy.mock.calls[0][0]).toBe(HEALTH_URL);
-    expect(logSpy).toHaveBeenCalled();
-    expect(warnSpy).not.toHaveBeenCalled();
-  });
-
-  it('warns on a non-2xx health response', async () => {
-    fetchSpy.mockResolvedValue(fakeResponse(false, 503));
-    const warnSpy = jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-
-    await makeProbe({ NODE_ENV: 'production' }).probe();
-
-    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('503'));
-  });
-
-  it('warns (never throws) when the probe fetch rejects', async () => {
-    fetchSpy.mockRejectedValue(new Error('ECONNREFUSED'));
-    const warnSpy = jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-
-    await expect(makeProbe({ NODE_ENV: 'production' }).probe()).resolves.toBeUndefined();
-    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('ECONNREFUSED'));
-  });
-
-  it('never sends x-api-key to the public health endpoint, even when a key is set', async () => {
-    fetchSpy.mockResolvedValue(fakeResponse(true, 200));
-    jest.spyOn(Logger.prototype, 'log').mockImplementation(() => undefined);
-
-    await makeProbe({
-      NODE_ENV: 'production',
-      AUTOFIX_HEALING_API_KEY: 'secret',
-    }).probe();
-
-    // /api/health is public in the Phoenix contract; the probe must not attach
-    // the key.
-    expect(fetchSpy.mock.calls[0][1].headers).toBeUndefined();
-  });
-
-  it('onApplicationBootstrap fires the probe without awaiting it', () => {
-    const probe = makeProbe({});
-    const spy = jest.spyOn(probe, 'probe').mockResolvedValue(undefined);
-
-    probe.onApplicationBootstrap();
-
-    expect(spy).toHaveBeenCalledTimes(1);
-  });
-});
diff --git a/packages/backend/src/routing/autofix/__tests__/autofix.module.spec.ts b/packages/backend/src/routing/autofix/__tests__/autofix.module.spec.ts
deleted file mode 100644
index 38bf0d23..00000000
--- a/packages/backend/src/routing/autofix/__tests__/autofix.module.spec.ts
+++ /dev/null
@@ -1,237 +0,0 @@
-import { ConfigModule } from '@nestjs/config';
-import { Test } from '@nestjs/testing';
-import { getRepositoryToken } from '@nestjs/typeorm';
-import { Agent } from '../../../entities/agent.entity';
-import { AgentMessage } from '../../../entities/agent-message.entity';
-import { ManifestRequest } from '../../../entities/request.entity';
-import { InstallMetadata } from '../../../entities/install-metadata.entity';
-import { InstallIdService } from '../../../telemetry/install-id.service';
-import { ApiKey } from '../../../entities/api-key.entity';
-import { AutofixModule } from '../autofix.module';
-import { HEALING_CLIENT } from '../healing-client';
-import { HttpHealingClient } from '../http-healing-client';
-import { AUTOFIX_URL } from '../autofix-healing-config';
-import { MockHealingClient } from '../mock-healing-client';
-
-/**
- * Compile AutofixModule with a global ConfigModule seeded from `configValues`
- * (a real ConfigService, so the factory reads exactly what the app would) and
- * the TypeORM Agent repo stubbed, then resolve the HEALING_CLIENT the factory
- * produced. A global ConfigModule exports ConfigService into AutofixModule's
- * scope — a root-level provider would be encapsulated out of the imported
- * module.
- */
-async function resolveHealingClient(configValues: Record<string, string>) {
-  const previousMode = process.env.MANIFEST_MODE;
-  process.env.MANIFEST_MODE = configValues.MANIFEST_MODE ?? 'cloud';
-  try {
-    const moduleRef = await Test.createTestingModule({
-      imports: [
-        ConfigModule.forRoot({ isGlobal: true, ignoreEnvFile: true, load: [() => configValues] }),
-        AutofixModule,
-      ],
-    })
-      .overrideProvider(getRepositoryToken(Agent))
-      .useValue({})
-      .overrideProvider(getRepositoryToken(AgentMessage))
-      .useValue({})
-      .overrideProvider(getRepositoryToken(ManifestRequest))
-      .useValue({})
-      // Autofix pulls the install id from TelemetryModule; stub its repo so the
-      // module graph resolves without a database.
-      .overrideProvider(getRepositoryToken(InstallMetadata))
-      .useValue({})
-      // The telemetry payload builder also reads api_keys (and the raw OAuth
-      // tables through that repo's manager); stub it too.
-      .overrideProvider(getRepositoryToken(ApiKey))
-      .useValue({})
-      .compile();
-
-    const client = moduleRef.get(HEALING_CLIENT);
-    await moduleRef.close();
-    return client;
-  } finally {
-    if (previousMode === undefined) delete process.env.MANIFEST_MODE;
-    else process.env.MANIFEST_MODE = previousMode;
-  }
-}
-
-describe('AutofixModule HEALING_CLIENT factory', () => {
-  it('provides a MockHealingClient outside production (NODE_ENV unset)', async () => {
-    const client = await resolveHealingClient({});
-
-    expect(client).toBeInstanceOf(MockHealingClient);
-  });
-
-  it('provides a MockHealingClient outside production even when NODE_ENV=development', async () => {
-    // Explicit non-production NODE_ENV still exercises the dev/test branch.
-    const client = await resolveHealingClient({ NODE_ENV: 'development' });
-
-    expect(client).toBeInstanceOf(MockHealingClient);
-  });
-
-  it('keeps the mock in a self-hosted DEV run rather than dialling hosted Phoenix', async () => {
-    // A developer running self-hosted mode locally must not post real failures
-    // at the production healer just because the mode matches.
-    const client = await resolveHealingClient({
-      NODE_ENV: 'development',
-      MANIFEST_MODE: 'selfhosted',
-    });
-
-    expect(client).toBeInstanceOf(MockHealingClient);
-  });
-
-  it('dials hosted Phoenix in self-hosted production', async () => {
-    const client = await resolveHealingClient({
-      NODE_ENV: 'production',
-      MANIFEST_MODE: 'selfhosted',
-    });
-
-    expect(client).toBeInstanceOf(HttpHealingClient);
-    expect((client as unknown as { baseUrl: string }).baseUrl).toBe(AUTOFIX_URL);
-  });
-
-  it('dials the same hosted Phoenix in CLOUD production', async () => {
-    // Regression guard for dropping AUTOFIX_HEALING_URL: cloud used to depend
-    // on that variable and would go inert without it, silently killing
-    // Autofix in production for every hosted tenant.
-    const client = await resolveHealingClient({
-      NODE_ENV: 'production',
-      MANIFEST_MODE: 'cloud',
-    });
-
-    expect(client).toBeInstanceOf(HttpHealingClient);
-    expect((client as unknown as { baseUrl: string }).baseUrl).toBe(AUTOFIX_URL);
-  });
-
-  it('forwards AUTOFIX_HEALING_API_KEY and sends no instance id when set (cloud)', async () => {
-    const client = await resolveHealingClient({
-      NODE_ENV: 'production',
-      AUTOFIX_HEALING_API_KEY: 'secret',
-    });
-
-    expect(client).toBeInstanceOf(HttpHealingClient);
-    const inner = client as unknown as { apiKey?: string; instanceId?: unknown };
-    expect(inner.apiKey).toBe('secret');
-    expect(inner.instanceId).toBeUndefined();
-  });
-
-  it('provides an HttpHealingClient with a valid AUTOFIX_TIMEOUT_MS override', async () => {
-    // Exercises the truthy side of the timeout ternary (parsed integer > 0).
-    const client = await resolveHealingClient({
-      NODE_ENV: 'production',
-      AUTOFIX_TIMEOUT_MS: '5000',
-    });
-
-    expect(client).toBeInstanceOf(HttpHealingClient);
-    expect((client as unknown as { timeoutMs: number }).timeoutMs).toBe(5000);
-  });
-
-  it('falls back to the default timeout when AUTOFIX_TIMEOUT_MS is invalid', async () => {
-    // Number.parseInt('abc', 10) is NaN → Number.isInteger false → default.
-    const client = await resolveHealingClient({
-      NODE_ENV: 'production',
-      AUTOFIX_TIMEOUT_MS: 'abc',
-    });
-
-    expect(client).toBeInstanceOf(HttpHealingClient);
-  });
-
-  it('falls back to the default timeout when AUTOFIX_TIMEOUT_MS is non-positive', async () => {
-    // parsed = 0 → `parsed > 0` false → default branch.
-    const client = await resolveHealingClient({
-      NODE_ENV: 'production',
-      AUTOFIX_TIMEOUT_MS: '0',
-    });
-
-    expect(client).toBeInstanceOf(HttpHealingClient);
-  });
-
-  it('rejects a numeric-prefixed AUTOFIX_TIMEOUT_MS (5abc) and uses the default', async () => {
-    // `Number.parseInt('5abc')` would silently yield 5; the digits-only guard
-    // rejects it, so the client keeps the 10s default instead of a 5ms timeout.
-    const client = await resolveHealingClient({
-      NODE_ENV: 'production',
-      AUTOFIX_TIMEOUT_MS: '5abc',
-    });
-
-    expect(client).toBeInstanceOf(HttpHealingClient);
-    expect((client as unknown as { timeoutMs: number }).timeoutMs).toBe(10_000);
-  });
-
-  it('resolves the install id once per process instead of per request', async () => {
-    const previousMode = process.env.MANIFEST_MODE;
-    process.env.MANIFEST_MODE = 'selfhosted';
-    const getOrCreate = jest.fn().mockResolvedValue({ install_id: 'install-1' });
-    const fetchMock = jest.fn().mockResolvedValue({
-      ok: true,
-      status: 200,
-      json: async () => ({ status: 'no_patch', issueId: 'issue-1' }),
-    });
-    const realFetch = global.fetch;
-    global.fetch = fetchMock as unknown as typeof fetch;
-    try {
-      const moduleRef = await Test.createTestingModule({
-        imports: [
-          ConfigModule.forRoot({
-            isGlobal: true,
-            ignoreEnvFile: true,
-            load: [() => ({ NODE_ENV: 'production' })],
-          }),
-          AutofixModule,
-        ],
-      })
-        .overrideProvider(getRepositoryToken(Agent))
-        .useValue({})
-        .overrideProvider(getRepositoryToken(AgentMessage))
-        .useValue({})
-        .overrideProvider(getRepositoryToken(ManifestRequest))
-        .useValue({})
-        .overrideProvider(getRepositoryToken(InstallMetadata))
-        .useValue({})
-        .overrideProvider(getRepositoryToken(ApiKey))
-        .useValue({})
-        .overrideProvider(InstallIdService)
-        .useValue({ getOrCreate })
-        .compile();
-
-      const client = moduleRef.get(HEALING_CLIENT) as {
-        heal: (input: unknown, context: { harness: string }) => Promise<unknown>;
-      };
-      const heal = () =>
-        client.heal(
-          {
-            traceId: 't',
-            tenantId: 'tenant-1',
-            provider: 'openai',
-            authType: 'api_key',
-            api: 'chat_completions',
-            request: { max_tokens: 1 },
-            response: { statusCode: 400, error: { message: 'bad' } },
-          },
-          { harness: 'claude-code' },
-        );
-
-      await heal();
-      await heal();
-
-      // The factory memoizes the resolved id, so the DB is read once even
-      // though the client calls the provider on every request.
-      expect(getOrCreate).toHaveBeenCalledTimes(1);
-
-      // And the id actually reaches Phoenix, not just the memoizer.
-      const healCalls = fetchMock.mock.calls.filter(([url]) => String(url).endsWith('/api/heal'));
-      expect(healCalls).toHaveLength(2);
-      for (const [, init] of healCalls) {
-        expect((init as RequestInit).headers).toMatchObject({
-          'X-Manifest-Instance': 'install-1',
-        });
-      }
-      await moduleRef.close();
-    } finally {
-      global.fetch = realFetch;
-      if (previousMode === undefined) delete process.env.MANIFEST_MODE;
-      else process.env.MANIFEST_MODE = previousMode;
-    }
-  });
-});
diff --git a/packages/backend/src/routing/autofix/__tests__/autofix.service.spec.ts b/packages/backend/src/routing/autofix/__tests__/autofix.service.spec.ts
deleted file mode 100644
index 681d8677..00000000
--- a/packages/backend/src/routing/autofix/__tests__/autofix.service.spec.ts
+++ /dev/null
@@ -1,1317 +0,0 @@
-import { Logger } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { Repository } from 'typeorm';
-import { Agent } from '../../../entities/agent.entity';
-import type { ForwardResult } from '../../proxy/provider-client';
-import { AutofixService, type MaybeHealParams } from '../autofix.service';
-import { HealContractError, type HealingClient } from '../healing-client';
-import type { HealResponse } from '../phoenix.types';
-
-// ---------------------------------------------------------------------------
-// Test helpers
-// ---------------------------------------------------------------------------
-
-/** Build a ForwardResult around the global (undici) Response, all flags false. */
-function makeForward(body: string, status: number): ForwardResult {
-  return {
-    response: new Response(body, { status }),
-    isGoogle: false,
-    isAnthropic: false,
-    isChatGpt: false,
-    isResponses: false,
-    isCodeAssist: false,
-  };
-}
-
-type HealingClientMock = {
-  heal: jest.Mock<Promise<HealResponse>, [unknown, unknown?]>;
-  reportOutcome: jest.Mock;
-};
-
-function makeHealingClient(): HealingClientMock {
-  return {
-    heal: jest.fn(),
-    // A landed report (null means "didn't reach Phoenix" and triggers resends).
-    reportOutcome: jest.fn().mockResolvedValue({ healAttemptId: 'heal-1', status: 'succeeded' }),
-  };
-}
-
-/** ConfigService stub whose `get` reads from a plain map (undefined by default). */
-function makeConfig(overrides: Record<string, string | undefined> = {}): ConfigService {
-  return {
-    get: jest.fn((key: string) => overrides[key]),
-  } as unknown as ConfigService;
-}
-
-function makeAgentRepo(findOneImpl?: () => unknown): {
-  repo: Repository<Agent>;
-  findOne: jest.Mock;
-} {
-  const findOne = jest.fn(findOneImpl ?? (() => null));
-  return { repo: { findOne } as unknown as Repository<Agent>, findOne };
-}
-
-function makeService(opts: {
-  client?: HealingClient;
-  repo?: Repository<Agent>;
-  config?: ConfigService;
-}): AutofixService {
-  return new AutofixService(
-    opts.client ?? (makeHealingClient() as unknown as HealingClient),
-    opts.repo ?? makeAgentRepo().repo,
-    opts.config ?? makeConfig(),
-  );
-}
-
-/** Base params for maybeHeal; individual tests override `forward` / `reforward`. */
-function makeParams(overrides: Partial<MaybeHealParams>): MaybeHealParams {
-  return {
-    forward: makeForward('{"error":{"message":"boom"}}', 400),
-    agentId: 'agent-1',
-    tenantId: 'tenant-1',
-    provider: 'anthropic',
-    model: 'gpt',
-    authType: 'subscription',
-    apiMode: 'chat_completions',
-    requestBody: { model: 'gpt', max_tokens: 100 },
-    url: 'https://api.example.com/v1/chat/completions',
-    reforward: jest.fn(),
-    ...overrides,
-  } as MaybeHealParams;
-}
-
-const patchedHeal = (over: Partial<HealResponse> = {}): HealResponse => ({
-  status: 'patched',
-  issueId: 'issue-1',
-  patchId: 'patch-1',
-  healAttemptId: 'heal-1',
-  operations: [{ type: 'rename_param', from: 'max_tokens', to: 'max_output_tokens' }],
-  explanation: {
-    summary: 'Renamed the "max_tokens" parameter to "max_output_tokens".',
-    operations: [
-      {
-        type: 'rename_param',
-        detail: 'Renamed the "max_tokens" parameter to "max_output_tokens".',
-      },
-    ],
-    source: 'deterministic',
-  },
-  healedBody: { model: 'gpt', max_output_tokens: 100 },
-  ...over,
-});
-
-/**
- * A `reforward` mock that returns a FRESH ForwardResult on every call. Reusing a
- * single Response fails: the service reads the retry body (`.text()`), so a
- * shared Response would be "already read" on a later access.
- */
-function reforwardMock(
-  body: string,
-  status: number,
-): jest.Mock<Promise<ForwardResult>, [Record<string, unknown>]> {
-  return jest.fn((_healedBody: Record<string, unknown>) =>
-    Promise.resolve(makeForward(body, status)),
-  );
-}
-
-// ---------------------------------------------------------------------------
-
-describe('AutofixService', () => {
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  // -------------------------------------------------------------------------
-  // Constructor config parsing
-  // -------------------------------------------------------------------------
-  describe('constructor config parsing', () => {
-    it('defaults globalEnabled to true when AUTOFIX_GLOBAL_ENABLED is unset', () => {
-      const { findOne } = makeAgentRepo();
-      const service = makeService({ config: makeConfig() });
-      // Directly assert the parsed default (only `'false'` disables), and that
-      // construction never touches the DB.
-      expect((service as unknown as { globalEnabled: boolean }).globalEnabled).toBe(true);
-      expect(findOne).not.toHaveBeenCalled();
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // resolveEnabled — deployment-mode default when autofix_enabled is NULL
-  // -------------------------------------------------------------------------
-  describe('resolveEnabled (deployment-mode default)', () => {
-    let savedMode: string | undefined;
-    beforeEach(() => {
-      savedMode = process.env.MANIFEST_MODE;
-    });
-    afterEach(() => {
-      if (savedMode === undefined) delete process.env.MANIFEST_MODE;
-      else process.env.MANIFEST_MODE = savedMode;
-    });
-
-    it('an explicit true/false overrides the mode default', () => {
-      process.env.MANIFEST_MODE = 'selfhosted';
-      const service = makeService({});
-      expect(service.resolveEnabled(true)).toBe(true);
-      expect(service.resolveEnabled(false)).toBe(false);
-    });
-
-    it('a NULL/undefined flag inherits ON in cloud mode', () => {
-      process.env.MANIFEST_MODE = 'cloud';
-      const service = makeService({});
-      expect(service.resolveEnabled(null)).toBe(true);
-      expect(service.resolveEnabled(undefined)).toBe(true);
-    });
-
-    it('a NULL flag inherits OFF in self-hosted mode', () => {
-      process.env.MANIFEST_MODE = 'selfhosted';
-      const service = makeService({});
-      expect(service.resolveEnabled(null)).toBe(false);
-    });
-
-    it('heals an unset agent in cloud (NULL → default ON)', async () => {
-      process.env.MANIFEST_MODE = 'cloud';
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue(patchedHeal());
-      const reforward = jest.fn().mockResolvedValue(makeForward('{"ok":true}', 200));
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: null }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      const result = await service.maybeHeal(makeParams({ reforward }));
-
-      expect(result!.record.outcome).toBe('healed');
-      expect(client.heal).toHaveBeenCalled();
-    });
-
-    it('skips an unset agent in self-hosted (NULL → default OFF)', async () => {
-      process.env.MANIFEST_MODE = 'selfhosted';
-      const client = makeHealingClient();
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: null }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      const result = await service.maybeHeal(makeParams({}));
-
-      expect(result).toBeNull();
-      expect(client.heal).not.toHaveBeenCalled();
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // isRepairable / parseStatuses
-  // -------------------------------------------------------------------------
-  describe('isRepairable', () => {
-    it('uses the default 400/404/422 set when config is unset', () => {
-      const service = makeService({ config: makeConfig() });
-      expect(service.isRepairable(400)).toBe(true);
-      expect(service.isRepairable(404)).toBe(true);
-      expect(service.isRepairable(422)).toBe(true);
-      expect(service.isRepairable(500)).toBe(false);
-      expect(service.isRepairable(401)).toBe(false);
-    });
-
-    it('honours a custom AUTOFIX_REPAIRABLE_STATUSES so 422 becomes non-repairable', () => {
-      const service = makeService({
-        config: makeConfig({ AUTOFIX_REPAIRABLE_STATUSES: '400,404' }),
-      });
-      expect(service.isRepairable(400)).toBe(true);
-      expect(service.isRepairable(404)).toBe(true);
-      expect(service.isRepairable(422)).toBe(false);
-    });
-
-    it('falls back to defaults for empty / whitespace config', () => {
-      const service = makeService({ config: makeConfig({ AUTOFIX_REPAIRABLE_STATUSES: '   ' }) });
-      expect(service.isRepairable(400)).toBe(true);
-      expect(service.isRepairable(404)).toBe(true);
-      expect(service.isRepairable(422)).toBe(true);
-    });
-
-    it('falls back to defaults when every entry is garbage / out of range', () => {
-      // Non-numeric and out-of-[400,500) entries are all filtered out, so the
-      // parsed set is empty → the DEFAULT set is used.
-      const service = makeService({
-        config: makeConfig({ AUTOFIX_REPAIRABLE_STATUSES: 'abc,200,500,600' }),
-      });
-      expect(service.isRepairable(400)).toBe(true);
-      expect(service.isRepairable(404)).toBe(true);
-      expect(service.isRepairable(422)).toBe(true);
-      expect(service.isRepairable(200)).toBe(false);
-      expect(service.isRepairable(500)).toBe(false);
-    });
-
-    it('keeps only in-range entries and drops out-of-range ones', () => {
-      // 429 is a valid 4xx and kept; 500/399 are filtered out.
-      const service = makeService({
-        config: makeConfig({ AUTOFIX_REPAIRABLE_STATUSES: '429,500,399' }),
-      });
-      expect(service.isRepairable(429)).toBe(true);
-      expect(service.isRepairable(500)).toBe(false);
-      expect(service.isRepairable(399)).toBe(false);
-      // Default 400 is NOT present because a non-empty valid set replaced defaults.
-      expect(service.isRepairable(400)).toBe(false);
-    });
-
-    it('rejects a numeric-prefixed token (404abc) that parseInt would misread as 404', () => {
-      // Old code used bare parseInt, which accepts '404abc' as 404; the digits-only
-      // filter drops it, so only the clean 422 survives.
-      const service = makeService({
-        config: makeConfig({ AUTOFIX_REPAIRABLE_STATUSES: '404abc,422' }),
-      });
-      expect(service.isRepairable(404)).toBe(false);
-      expect(service.isRepairable(422)).toBe(true);
-    });
-  });
-  // -------------------------------------------------------------------------
-  // maybeHeal — hot-path no-ops (no config load, no body read)
-  // -------------------------------------------------------------------------
-  describe('maybeHeal hot-path no-ops', () => {
-    it('returns null and never loads config when the forward is ok', async () => {
-      const { repo, findOne } = makeAgentRepo();
-      const service = makeService({ repo });
-      const forward = makeForward('ok', 200);
-
-      const result = await service.maybeHeal(makeParams({ forward }));
-
-      expect(result).toBeNull();
-      expect(findOne).not.toHaveBeenCalled();
-      // Body was never consumed.
-      expect(forward.response.bodyUsed).toBe(false);
-    });
-
-    it('returns null when AUTOFIX_GLOBAL_ENABLED is "false"', async () => {
-      const { repo, findOne } = makeAgentRepo();
-      const service = makeService({
-        repo,
-        config: makeConfig({ AUTOFIX_GLOBAL_ENABLED: 'false' }),
-      });
-      const forward = makeForward('{"error":{"message":"boom"}}', 400);
-
-      const result = await service.maybeHeal(makeParams({ forward }));
-
-      expect(result).toBeNull();
-      expect(findOne).not.toHaveBeenCalled();
-      expect(forward.response.bodyUsed).toBe(false);
-    });
-
-    it('returns null for a non-repairable status without loading config or reading body', async () => {
-      const { repo, findOne } = makeAgentRepo();
-      const service = makeService({ repo });
-      const forward = makeForward('server error', 500);
-
-      const result = await service.maybeHeal(makeParams({ forward }));
-
-      expect(result).toBeNull();
-      expect(findOne).not.toHaveBeenCalled();
-      expect(forward.response.bodyUsed).toBe(false);
-    });
-
-    it('returns null for a 401 (non-repairable) status', async () => {
-      const { repo, findOne } = makeAgentRepo();
-      const service = makeService({ repo });
-      const forward = makeForward('unauthorized', 401);
-
-      const result = await service.maybeHeal(makeParams({ forward }));
-
-      expect(result).toBeNull();
-      expect(findOne).not.toHaveBeenCalled();
-    });
-
-    it('does not send Anthropic subscription extra-usage exhaustion to Phoenix', async () => {
-      const client = makeHealingClient();
-      const { repo, findOne } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-      const forward = makeForward(
-        JSON.stringify({
-          type: 'error',
-          error: {
-            type: 'invalid_request_error',
-            message: 'You are out of extra usage. Add more at claude.ai to keep going.',
-          },
-        }),
-        400,
-      );
-
-      const result = await service.maybeHeal(makeParams({ forward, provider: 'anthropic' }));
-
-      expect(result).toBeNull();
-      expect(client.heal).not.toHaveBeenCalled();
-      expect(findOne).not.toHaveBeenCalled();
-      expect(forward.response.status).toBe(400);
-      expect(forward.response.bodyUsed).toBe(false);
-    });
-
-    it('keeps status-based healing when Anthropic billing inspection fails', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue({ status: 'no_patch', issueId: 'issue-1' });
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-      const forward = makeForward('{"error":{"message":"boom"}}', 400);
-      jest.spyOn(forward.response, 'clone').mockImplementation(() => {
-        throw new Error('clone failed');
-      });
-      const warn = jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-
-      const result = await service.maybeHeal(makeParams({ forward, provider: 'anthropic' }));
-
-      expect(result?.record.outcome).toBe('unfixable');
-      expect(client.heal).toHaveBeenCalledTimes(1);
-      expect(warn).toHaveBeenCalledWith(
-        'could not inspect Anthropic 400 for billing semantics: clone failed',
-      );
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // maybeHeal — agent config gating
-  // -------------------------------------------------------------------------
-  describe('maybeHeal agent config gating', () => {
-    it('returns null when the agent row is not found', async () => {
-      const { repo } = makeAgentRepo(() => null);
-      const service = makeService({ repo });
-
-      const result = await service.maybeHeal(makeParams({}));
-
-      expect(result).toBeNull();
-    });
-
-    it('returns null when the agent has autofix disabled', async () => {
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: false }));
-      const service = makeService({ repo });
-
-      const result = await service.maybeHeal(makeParams({}));
-
-      expect(result).toBeNull();
-    });
-
-    it('queries the agent scoped by id + tenant, selecting the PK so a NULL flag row is still found', async () => {
-      const { repo, findOne } = makeAgentRepo(() => null);
-      const service = makeService({ repo });
-
-      await service.maybeHeal(makeParams({ agentId: 'a-9', tenantId: 't-9' }));
-
-      // `id` must stay in the select: TypeORM returns null for a row whose only
-      // selected column is NULL, so selecting the nullable `autofix_enabled`
-      // alone makes every default (NULL-flag) agent look not-found. See the
-      // real-DB regression in test/autofix-null-flag.e2e-spec.ts.
-      expect(findOne).toHaveBeenCalledWith({
-        where: { id: 'a-9', tenant_id: 't-9' },
-        select: ['id', 'autofix_enabled', 'agent_platform'],
-      });
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // maybeHeal — happy heal on the single attempt
-  // -------------------------------------------------------------------------
-  describe('maybeHeal happy path', () => {
-    it('finishes the original Provider Attempt before Autofix consumes its response', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue({ status: 'no_patch', issueId: 'issue-recording' });
-      const finishRecording = jest.fn().mockResolvedValue(undefined);
-      const forward = {
-        ...makeForward('{"error":{"message":"invalid","api_key":"provider-secret"}}', 400),
-        attempt: { finishRecording } as never,
-      };
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      await service.maybeHeal(makeParams({ forward }));
-
-      expect(finishRecording).toHaveBeenCalledWith({
-        type: 'json',
-        body: {
-          error: {
-            message: 'invalid',
-            api_key: 'provider-secret',
-          },
-        },
-      });
-    });
-
-    it('sends the provider exchange to Phoenix and preserves provider response headers', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue({ status: 'no_patch', issueId: 'issue-wire' });
-      const forward = {
-        ...makeForward('{"error":{"message":"invalid thinking"}}', 400),
-        response: new Response('{"error":{"message":"invalid thinking"}}', {
-          status: 400,
-          headers: { 'x-provider-request-id': 'provider-request-1' },
-        }),
-        wireFormat: 'anthropic_messages' as const,
-        wireRequestUrl: 'https://api.anthropic.com/v1/messages?key=provider-secret',
-      };
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      const result = await service.maybeHeal(makeParams({ forward }));
-
-      expect(client.heal.mock.calls[0][0]).toEqual(
-        expect.objectContaining({
-          providerExchange: {
-            format: 'anthropic_messages',
-            url: 'https://api.anthropic.com/v1/messages?key=%5BREDACTED%5D',
-            request: {
-              body: { model: 'gpt', max_tokens: 100 },
-              redactedFields: [],
-            },
-            response: {
-              statusCode: 400,
-              body: { error: { message: 'invalid thinking' } },
-            },
-          },
-        }),
-      );
-      expect(result!.forward.response.headers.get('x-provider-request-id')).toBe(
-        'provider-request-1',
-      );
-    });
-
-    it('keeps a plain-text provider response and omits an absent provider URL', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue({ status: 'no_patch', issueId: 'issue-wire-text' });
-      const forward = {
-        ...makeForward('invalid thinking', 400),
-        wireFormat: 'anthropic_messages' as const,
-      };
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      await service.maybeHeal(makeParams({ forward }));
-
-      expect(client.heal.mock.calls[0][0]).toEqual(
-        expect.objectContaining({
-          providerExchange: {
-            format: 'anthropic_messages',
-            request: {
-              body: { model: 'gpt', max_tokens: 100 },
-              redactedFields: [],
-            },
-            response: { statusCode: 400, body: 'invalid thinking' },
-          },
-        }),
-      );
-    });
-
-    it('coerces the cached agent platform into the Phoenix harness context', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue({ status: 'no_patch', issueId: 'issue-1' });
-      const { repo } = makeAgentRepo(() => ({
-        autofix_enabled: true,
-        agent_platform: 'claude-code',
-      }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      await service.maybeHeal(makeParams({}));
-
-      expect(client.heal.mock.calls[0][1]).toEqual({ harness: 'claude-code' });
-    });
-
-    it('never sends an unknown persisted platform value to Phoenix', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue({ status: 'no_patch', issueId: 'issue-1' });
-      const { repo } = makeAgentRepo(() => ({
-        autofix_enabled: true,
-        agent_platform: 'customer-specific-name',
-      }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      await service.maybeHeal(makeParams({}));
-
-      expect(client.heal.mock.calls[0][1]).toEqual({ harness: 'other' });
-    });
-
-    it('heals on the patched retry, reports the cleared retry, and records the chain', async () => {
-      const client = makeHealingClient();
-      const heal = patchedHeal();
-      client.heal.mockResolvedValue(heal);
-      const healedForward = makeForward('{"ok":true}', 200);
-      const reforward = jest.fn().mockResolvedValue(healedForward);
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      const result = await service.maybeHeal(makeParams({ reforward }));
-
-      expect(result).not.toBeNull();
-      expect(result!.record.outcome).toBe('healed');
-      expect(result!.record.original_http_status).toBe(400);
-
-      // Returned forward is the healed 200.
-      expect(result!.forward).toBe(healedForward);
-      expect(result!.forward.response.status).toBe(200);
-
-      // reforward called once with Phoenix's healedBody.
-      expect(reforward).toHaveBeenCalledTimes(1);
-      expect(reforward).toHaveBeenCalledWith(heal.healedBody);
-
-      // reportOutcome called once with the cleared 2xx retry status and no error.
-      expect(client.reportOutcome).toHaveBeenCalledTimes(1);
-      expect(client.reportOutcome).toHaveBeenCalledWith(
-        'heal-1',
-        { retryStatusCode: 200 },
-        { harness: 'other' },
-      );
-      // The success report carries no `error` key.
-      expect(client.reportOutcome.mock.calls[0][1]).not.toHaveProperty('error');
-
-      // Chain: original entry (attempt 0, with error + decision + patch_worked)
-      // followed by the terminal autofix success entry (attempt 1, status 200, no error).
-      const chain = result!.record.chain;
-      expect(chain).toHaveLength(2);
-
-      const original = chain[0];
-      expect(original.attempt).toBe(0);
-      expect(original.origin).toBe('original');
-      expect(original.http_status).toBe(400);
-      expect(original.error).toBeDefined();
-      expect(original.error!.message).toBe('boom');
-      expect(original.phoenix_status).toBe('patched');
-      expect(original.issue_id).toBe('issue-1');
-      expect(original.patch_id).toBe('patch-1');
-      expect(original.heal_attempt_id).toBe('heal-1');
-      expect(original.operations).toEqual(heal.operations);
-      // Phoenix's human-readable "why" rides the same entry, for the recorder to persist.
-      expect(original.explanation).toEqual(heal.explanation);
-      expect(original.patch_worked).toBe(true);
-
-      const terminal = chain[1];
-      expect(terminal.attempt).toBe(1);
-      expect(terminal.origin).toBe('autofix');
-      expect(terminal.http_status).toBe(200);
-      expect(terminal.error).toBeUndefined();
-      expect(terminal.request).toEqual(heal.healedBody);
-    });
-
-    it('passes the normalized request/response into the heal call', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue(patchedHeal());
-      const reforward = jest.fn().mockResolvedValue(makeForward('{"ok":true}', 200));
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-      const requestBody = { model: 'gpt', max_tokens: 5 };
-
-      await service.maybeHeal(
-        makeParams({
-          reforward,
-          requestBody,
-          provider: 'openai',
-          apiMode: 'chat_completions',
-          url: 'u',
-        }),
-      );
-
-      expect(client.heal).toHaveBeenCalledTimes(1);
-      const arg = client.heal.mock.calls[0][0] as Record<string, unknown>;
-      expect(arg.provider).toBe('openai');
-      expect(arg.authType).toBe('subscription');
-      expect(arg.api).toBe('chat_completions');
-      expect(arg.url).toBe('u');
-      expect(arg.request).toEqual(requestBody);
-      expect(typeof arg.traceId).toBe('string');
-      expect(arg.tenantId).toBe('tenant-1');
-      expect(arg.response).toEqual({
-        statusCode: 400,
-        error: { message: 'boom', type: null, param: null, code: null },
-      });
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // maybeHeal — provider wire body
-  // -------------------------------------------------------------------------
-  describe('maybeHeal provider wire body', () => {
-    it('reports the failed provider body and reforwards the healed body verbatim', async () => {
-      const client = makeHealingClient();
-      const requestBody = {
-        model: 'claude-opus-4-8',
-        messages: [],
-        thinking: { type: 'adaptive', budget_tokens: 8192 },
-      };
-      const healedBody = {
-        model: 'claude-opus-4-8',
-        messages: [],
-        thinking: { type: 'adaptive' },
-      };
-      client.heal.mockResolvedValue(
-        patchedHeal({
-          status: 'unverified',
-          operations: [{ type: 'drop_param' }],
-          healedBody,
-        }),
-      );
-      const reforward = reforwardMock('{"ok":true}', 200);
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      const result = await service.maybeHeal(makeParams({ reforward, requestBody }));
-
-      expect(result!.record.outcome).toBe('healed');
-      const healArg = client.heal.mock.calls[0][0] as { request: Record<string, unknown> };
-      expect(healArg.request).toBe(requestBody);
-      expect(reforward.mock.calls[0][0]).toBe(healedBody);
-    });
-
-    it('keeps native Gemini model metadata outside the exact provider request', async () => {
-      const client = makeHealingClient();
-      const requestBody = {
-        contents: [{ role: 'user', parts: [{ text: 'hi' }] }],
-        generationConfig: { maxOutputTokens: 32_000, topP: 1 },
-      };
-      const healedBody = {
-        contents: [{ role: 'user', parts: [{ text: 'hi' }] }],
-        generationConfig: { maxOutputTokens: 32_000 },
-      };
-      client.heal.mockResolvedValue(
-        patchedHeal({
-          status: 'unverified',
-          operations: [{ type: 'drop_param' }],
-          healedBody,
-        }),
-      );
-      const forward = {
-        ...makeForward('{"error":{"message":"topP is unsupported"}}', 400),
-        wireFormat: 'google_generate_content' as const,
-        wireRequestUrl:
-          'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent',
-      };
-      const reforward = reforwardMock('{"ok":true}', 200);
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      await service.maybeHeal(
-        makeParams({
-          forward,
-          reforward,
-          provider: 'gemini',
-          model: 'gemini-2.5-flash',
-          requestBody,
-        }),
-      );
-
-      expect(client.heal.mock.calls[0][0]).toEqual(
-        expect.objectContaining({
-          model: 'gemini-2.5-flash',
-          request: requestBody,
-          providerExchange: expect.objectContaining({
-            format: 'google_generate_content',
-            request: { body: requestBody, redactedFields: [] },
-          }),
-        }),
-      );
-      expect(requestBody).not.toHaveProperty('model');
-      expect(reforward).toHaveBeenCalledWith(healedBody);
-      expect(healedBody).not.toHaveProperty('model');
-    });
-
-    it('does not mutate the provider body', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue(
-        patchedHeal({ healedBody: { model: 'gpt', max_output_tokens: 100 } }),
-      );
-      const reforward = reforwardMock('{"ok":true}', 200);
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-      const requestBody = { model: 'gpt', max_tokens: 100 };
-
-      await service.maybeHeal(makeParams({ reforward, requestBody }));
-
-      expect(requestBody).toEqual({ model: 'gpt', max_tokens: 100 });
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // maybeHeal — unfixable / resolving / missing body
-  // -------------------------------------------------------------------------
-  describe('maybeHeal non-patch decisions', () => {
-    it('no_patch → unfixable, returns the rebuilt original error, no confirm', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue({ status: 'no_patch', issueId: 'issue-2' });
-      const reforward = jest.fn();
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-      const originalBody = '{"error":{"message":"nope"}}';
-
-      const result = await service.maybeHeal(
-        makeParams({ forward: makeForward(originalBody, 422), reforward }),
-      );
-
-      expect(result!.record.outcome).toBe('unfixable');
-      expect(reforward).not.toHaveBeenCalled();
-      expect(client.reportOutcome).not.toHaveBeenCalled();
-
-      // The returned forward is the rebuilt original — still readable.
-      expect(result!.forward.response.status).toBe(422);
-      await expect(result!.forward.response.text()).resolves.toBe(originalBody);
-
-      // Chain records the null patch/heal fields for the no_patch decision.
-      const original = result!.record.chain[0];
-      expect(original.phoenix_status).toBe('no_patch');
-      expect(original.patch_id).toBeNull();
-      expect(original.heal_attempt_id).toBeNull();
-      expect(original.operations).toBeNull();
-    });
-
-    it('resolving → outcome resolving, no reforward, no confirm', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue({
-        status: 'resolving',
-        issueId: 'issue-3',
-        retryAfterMs: 5000,
-      });
-      const reforward = jest.fn();
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      const result = await service.maybeHeal(makeParams({ reforward }));
-
-      expect(result!.record.outcome).toBe('resolving');
-      expect(reforward).not.toHaveBeenCalled();
-      expect(client.reportOutcome).not.toHaveBeenCalled();
-    });
-
-    it('patched but healedBody missing → unfixable', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue(patchedHeal({ healedBody: null }));
-      const reforward = jest.fn();
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      const result = await service.maybeHeal(makeParams({ reforward }));
-
-      expect(result!.record.outcome).toBe('unfixable');
-      expect(reforward).not.toHaveBeenCalled();
-      expect(client.reportOutcome).not.toHaveBeenCalled();
-    });
-
-    it('patched but healAttemptId missing → unfixable', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue(patchedHeal({ healAttemptId: null }));
-      const reforward = jest.fn();
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      const result = await service.maybeHeal(makeParams({ reforward }));
-
-      expect(result!.record.outcome).toBe('unfixable');
-      expect(reforward).not.toHaveBeenCalled();
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // maybeHeal — single attempt (no retry budget)
-  // -------------------------------------------------------------------------
-  describe('maybeHeal single attempt', () => {
-    it('preserves a failed patched retry as the terminal exhausted attempt', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue(patchedHeal());
-      // The patched retry still fails with a repairable 400 — Autofix does NOT
-      // re-heal; it reports and returns the retry as the terminal attempt.
-      const reforward = reforwardMock('{"error":{"message":"still-broken","code":"dup"}}', 400);
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-      const originalBody = '{"error":{"message":"first"}}';
-
-      const result = await service.maybeHeal(
-        makeParams({ forward: makeForward(originalBody, 400), reforward }),
-      );
-
-      expect(result!.record.outcome).toBe('exhausted');
-      // Exactly one heal + one reforward — there is no retry budget.
-      expect(client.heal).toHaveBeenCalledTimes(1);
-      expect(reforward).toHaveBeenCalledTimes(1);
-      // The single failed retry is reported to Phoenix with its status + error.
-      expect(client.reportOutcome).toHaveBeenCalledTimes(1);
-      expect(client.reportOutcome).toHaveBeenCalledWith(
-        'heal-1',
-        {
-          retryStatusCode: 400,
-          error: { message: 'still-broken', type: null, param: null, code: 'dup' },
-        },
-        { harness: 'other' },
-      );
-
-      // The original is linked to the distinct failed retry that Phoenix produced.
-      expect(result!.record.chain).toHaveLength(2);
-      expect(result!.record.chain[0].patch_worked).toBe(false);
-      expect(result!.record.chain[1]).toEqual({
-        attempt: 1,
-        origin: 'autofix',
-        request: { model: 'gpt', max_output_tokens: 100 },
-        http_status: 400,
-        error: { message: 'still-broken', type: null, param: null, code: 'dup' },
-      });
-
-      // Continues with the rebuilt retry error, still readable downstream.
-      expect(result!.forward.response.status).toBe(400);
-      await expect(result!.forward.response.text()).resolves.toBe(
-        '{"error":{"message":"still-broken","code":"dup"}}',
-      );
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // maybeHeal — heal transport failure
-  // -------------------------------------------------------------------------
-  describe('maybeHeal heal transport failure', () => {
-    it('returns exhausted (no reforward, no report) when the heal call throws', async () => {
-      const client = makeHealingClient();
-      client.heal.mockRejectedValue(new Error('phoenix down'));
-      const reforward = jest.fn();
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      // Silence the expected "heal call failed" warning.
-      jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-      const originalBody = '{"error":{"message":"boom"}}';
-
-      const result = await service.maybeHeal(
-        makeParams({ forward: makeForward(originalBody, 400), reforward }),
-      );
-
-      expect(result!.record.outcome).toBe('exhausted');
-      expect(reforward).not.toHaveBeenCalled();
-      expect(client.reportOutcome).not.toHaveBeenCalled();
-
-      // Returns the rebuilt original error.
-      expect(result!.forward.response.status).toBe(400);
-      await expect(result!.forward.response.text()).resolves.toBe(originalBody);
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // maybeHeal — a fresh `unverified` patch applies exactly like `patched`
-  // -------------------------------------------------------------------------
-  describe('maybeHeal unverified status', () => {
-    it('applies an unverified patch (fresh, not yet confirmed) and heals', async () => {
-      const client = makeHealingClient();
-      // The common real-Phoenix answer for a novel resolvable error: a served
-      // patch that is not yet verified. It must apply just like `patched`.
-      client.heal.mockResolvedValue(patchedHeal({ status: 'unverified' }));
-      const reforward = jest.fn().mockResolvedValue(makeForward('{"ok":true}', 200));
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      const result = await service.maybeHeal(makeParams({ reforward }));
-
-      expect(result!.record.outcome).toBe('healed');
-      expect(reforward).toHaveBeenCalledTimes(1);
-      // Phoenix's real status is recorded verbatim on the chain.
-      expect(result!.record.chain[0].phoenix_status).toBe('unverified');
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // maybeHeal — heal contract error (4xx from Phoenix: bad contract / auth)
-  // -------------------------------------------------------------------------
-  describe('maybeHeal heal contract error', () => {
-    it('returns exhausted and does NOT trip the breaker on a HealContractError', async () => {
-      const client = makeHealingClient();
-      // Phoenix is up but rejects every call (e.g. a missing API key → 401).
-      client.heal.mockRejectedValue(new HealContractError(401, 'unauthorized'));
-      const errorSpy = jest.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
-      const service = makeService({
-        client: client as unknown as HealingClient,
-        repo: makeAgentRepo(() => ({ autofix_enabled: true })).repo,
-      });
-
-      // Four consecutive contract errors: a transport failure would open the
-      // breaker after three and skip the fourth. A contract error must not — the
-      // healer is reachable, so every call still reaches it.
-      for (let i = 0; i < 4; i++) {
-        const r = await service.maybeHeal(
-          makeParams({ forward: makeForward('{"error":{}}', 400) }),
-        );
-        expect(r!.record.outcome).toBe('exhausted');
-      }
-      expect(client.heal).toHaveBeenCalledTimes(4);
-      // Surfaced loudly (error level), not swallowed as a routine warning.
-      expect(errorSpy).toHaveBeenCalled();
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // Circuit breaker — shed a slow/down healing service off the request path
-  // -------------------------------------------------------------------------
-  describe('circuit breaker', () => {
-    const enabledRepo = () => makeAgentRepo(() => ({ autofix_enabled: true })).repo;
-
-    it('opens after repeated heal failures and skips further heal calls', async () => {
-      const client = makeHealingClient();
-      client.heal.mockRejectedValue(new Error('phoenix down'));
-      jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-      const service = makeService({
-        client: client as unknown as HealingClient,
-        repo: enabledRepo(),
-      });
-
-      // Three repairable failures trip the breaker (each still returns exhausted).
-      for (let i = 0; i < 3; i++) {
-        const r = await service.maybeHeal(
-          makeParams({ forward: makeForward('{"error":{}}', 400) }),
-        );
-        expect(r!.record.outcome).toBe('exhausted');
-      }
-      expect(client.heal).toHaveBeenCalledTimes(3);
-
-      // Breaker open: the next repairable failure skips healing entirely and
-      // hands the forward back untouched (null → the proxy runs its fallback).
-      const skipped = await service.maybeHeal(
-        makeParams({ forward: makeForward('{"error":{}}', 400) }),
-      );
-      expect(skipped).toBeNull();
-      expect(client.heal).toHaveBeenCalledTimes(3);
-    });
-
-    it('resets the failure streak after a successful heal round-trip', async () => {
-      const client = makeHealingClient();
-      client.heal
-        .mockRejectedValueOnce(new Error('down'))
-        .mockRejectedValueOnce(new Error('down'))
-        .mockResolvedValueOnce({ status: 'no_patch', issueId: 'i' })
-        .mockRejectedValueOnce(new Error('down'))
-        .mockRejectedValueOnce(new Error('down'))
-        .mockRejectedValueOnce(new Error('down'));
-      jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-      const service = makeService({
-        client: client as unknown as HealingClient,
-        repo: enabledRepo(),
-      });
-
-      // fail, fail, success (streak → 0), fail, fail: never reaches 3 in a row.
-      for (let i = 0; i < 5; i++) {
-        await service.maybeHeal(makeParams({ forward: makeForward('{"error":{}}', 400) }));
-      }
-      // Breaker still closed, so a 6th repairable failure reaches the healer.
-      await service.maybeHeal(makeParams({ forward: makeForward('{"error":{}}', 400) }));
-      expect(client.heal).toHaveBeenCalledTimes(6);
-    });
-
-    it('re-attempts healing once the cooldown window elapses', async () => {
-      const nowSpy = jest.spyOn(Date, 'now').mockReturnValue(1_000);
-      const client = makeHealingClient();
-      client.heal.mockRejectedValue(new Error('down'));
-      jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-      const service = makeService({
-        client: client as unknown as HealingClient,
-        repo: enabledRepo(),
-      });
-
-      // Trip the breaker at t=1000 (open for the 30s cooldown).
-      for (let i = 0; i < 3; i++) {
-        await service.maybeHeal(makeParams({ forward: makeForward('{"error":{}}', 400) }));
-      }
-      expect(client.heal).toHaveBeenCalledTimes(3);
-
-      // Still inside the cooldown → skipped, no heal call.
-      nowSpy.mockReturnValue(20_000);
-      const during = await service.maybeHeal(
-        makeParams({ forward: makeForward('{"error":{}}', 400) }),
-      );
-      expect(during).toBeNull();
-      expect(client.heal).toHaveBeenCalledTimes(3);
-
-      // Past the cooldown → the healer is probed again.
-      nowSpy.mockReturnValue(31_001);
-      await service.maybeHeal(makeParams({ forward: makeForward('{"error":{}}', 400) }));
-      expect(client.heal).toHaveBeenCalledTimes(4);
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // reportOutcome — fire-and-forget error handling
-  // -------------------------------------------------------------------------
-  describe('reportOutcome fire-and-forget', () => {
-    afterEach(() => {
-      jest.useRealTimers();
-    });
-
-    it('does not throw out of maybeHeal when reportOutcome rejects, and resends', async () => {
-      jest.useFakeTimers();
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue(patchedHeal());
-      client.reportOutcome.mockRejectedValueOnce(new Error('report exploded'));
-      const reforward = jest.fn().mockResolvedValue(makeForward('{"ok":true}', 200));
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      // Silence the expected "reportOutcome ... failed" warning from the catch.
-      jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      // Should resolve normally (the delivery loop handles the rejection).
-      const result = await service.maybeHeal(makeParams({ reforward }));
-      expect(result!.record.outcome).toBe('healed');
-
-      // Let the fire-and-forget catch run; must not surface as an unhandled rejection.
-      await jest.advanceTimersByTimeAsync(0);
-      expect(client.reportOutcome).toHaveBeenCalledWith(
-        'heal-1',
-        { retryStatusCode: 200 },
-        { harness: 'other' },
-      );
-
-      // The rejected send is retried after the first resend delay and lands.
-      await jest.advanceTimersByTimeAsync(1_000);
-      expect(client.reportOutcome).toHaveBeenCalledTimes(2);
-    });
-
-    it('resends a report the healer dropped, then stops once it lands', async () => {
-      jest.useFakeTimers();
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue(patchedHeal());
-      // null = the PATCH did not land (transport failure or non-2xx).
-      client.reportOutcome
-        .mockResolvedValueOnce(null)
-        .mockResolvedValueOnce({ healAttemptId: 'heal-1', status: 'succeeded' });
-      const reforward = jest.fn().mockResolvedValue(makeForward('{"ok":true}', 200));
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      await service.maybeHeal(makeParams({ reforward }));
-      expect(client.reportOutcome).toHaveBeenCalledTimes(1);
-
-      await jest.advanceTimersByTimeAsync(1_000);
-      expect(client.reportOutcome).toHaveBeenCalledTimes(2);
-
-      // Landed on the second send — the schedule stops, no further resends.
-      await jest.advanceTimersByTimeAsync(60_000);
-      expect(client.reportOutcome).toHaveBeenCalledTimes(2);
-    });
-
-    it('gives up once the resend schedule is exhausted', async () => {
-      jest.useFakeTimers();
-      const warn = jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue(patchedHeal());
-      client.reportOutcome.mockResolvedValue(null);
-      const reforward = jest.fn().mockResolvedValue(makeForward('{"ok":true}', 200));
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      await service.maybeHeal(makeParams({ reforward }));
-      await jest.advanceTimersByTimeAsync(1_000);
-      await jest.advanceTimersByTimeAsync(5_000);
-      await jest.advanceTimersByTimeAsync(60_000);
-
-      // Initial send + one resend per schedule slot, then a loud give-up.
-      expect(client.reportOutcome).toHaveBeenCalledTimes(3);
-      expect(warn).toHaveBeenCalledWith(expect.stringContaining('giving up after 3 sends'));
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // maybeHeal — graceful degradation (H1): never turn a provider 4xx into a 500
-  // -------------------------------------------------------------------------
-  describe('maybeHeal graceful degradation', () => {
-    it('resolves null (does not throw) when the agent config load rejects', async () => {
-      const { repo, findOne } = makeAgentRepo(() => {
-        throw new Error('db down');
-      });
-      // Silence the expected "autofix config load failed" warning.
-      jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-      const service = makeService({ repo });
-
-      await expect(service.maybeHeal(makeParams({}))).resolves.toBeNull();
-      expect(findOne).toHaveBeenCalledTimes(1);
-    });
-
-    it('degrades to the readable original error and preserves the audit chain when reforward rejects', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue(patchedHeal());
-      // The heal produced a patch, but resending it blows up (network death).
-      const reforward = jest.fn().mockRejectedValue(new Error('socket hang up'));
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      // Silence the expected "autofix reforward failed" warning.
-      jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-      const originalBody = '{"error":{"message":"boom"}}';
-
-      const result = await service.maybeHeal(
-        makeParams({ forward: makeForward(originalBody, 400), reforward }),
-      );
-
-      // Never re-throws: degrades to 'unfixable' but KEEPS the audit chain — the
-      // original entry with the Phoenix ids already stamped, now patch_worked=false.
-      expect(result!.record.outcome).toBe('unfixable');
-      expect(result!.record.original_http_status).toBe(400);
-      expect(result!.record.chain).toHaveLength(1);
-      expect(result!.record.chain[0].origin).toBe('original');
-      expect(result!.record.chain[0].issue_id).toBe('issue-1');
-      expect(result!.record.chain[0].patch_worked).toBe(false);
-      expect(typeof result!.record.groupId).toBe('string');
-
-      // The evidence loop still closes: a dead retry has no provider status to
-      // send, so the death is reported as a synthetic 499 — otherwise the served
-      // attempt dangles `pending` until Phoenix's sweeper expires it.
-      expect(client.reportOutcome).toHaveBeenCalledWith(
-        'heal-1',
-        {
-          retryStatusCode: 499,
-          error: {
-            message: 'patched retry never completed: socket hang up',
-            type: 'retry_not_completed',
-          },
-        },
-        { harness: 'other' },
-      );
-
-      // The returned forward is the rebuilt original — still readable downstream.
-      expect(result!.forward.response.status).toBe(400);
-      await expect(result!.forward.response.text()).resolves.toBe(originalBody);
-    });
-
-    it('degrades via the outer backstop (exhausted, empty chain) on an unexpected throw', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue(patchedHeal());
-      // The patch retry fails (non-ok) AND reading its body throws — an unexpected
-      // path caught only by maybeHeal's outer backstop, which must still degrade
-      // cleanly (never a 500) rather than surface the throw.
-      const badRetry = {
-        response: {
-          ok: false,
-          status: 400,
-          text: () => Promise.reject(new Error('body already consumed')),
-        },
-      } as unknown as ForwardResult;
-      const reforward = jest.fn().mockResolvedValue(badRetry);
-      const { repo } = makeAgentRepo(() => ({ autofix_enabled: true }));
-      jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      const result = await service.maybeHeal(
-        makeParams({ forward: makeForward('{"error":{"message":"boom"}}', 400), reforward }),
-      );
-
-      expect(result!.record.outcome).toBe('exhausted');
-      expect(result!.record.chain).toEqual([]);
-      expect(result!.forward.response.status).toBe(400);
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // maybeHeal — per-agent config freshness
-  // -------------------------------------------------------------------------
-  describe('maybeHeal config freshness', () => {
-    it('observes toggles made by another replica without local invalidation', async () => {
-      const client = makeHealingClient();
-      client.heal.mockResolvedValue({ status: 'no_patch', issueId: 'issue-x' });
-      let enabled = false;
-      const { repo, findOne } = makeAgentRepo(() => ({ autofix_enabled: enabled }));
-      const service = makeService({ client: client as unknown as HealingClient, repo });
-
-      // This replica first observes the agent as disabled.
-      await service.maybeHeal(
-        makeParams({ forward: makeForward('{"error":{"message":"a"}}', 400) }),
-      );
-      expect(findOne).toHaveBeenCalledTimes(1);
-      expect(client.heal).not.toHaveBeenCalled();
-
-      // Another replica enables the agent. The next failure must read the new
-      // value immediately instead of reusing this replica's previous value.
-      enabled = true;
-      await service.maybeHeal(
-        makeParams({ forward: makeForward('{"error":{"message":"b"}}', 400) }),
-      );
-      expect(findOne).toHaveBeenCalledTimes(2);
-      expect(client.heal).toHaveBeenCalledTimes(1);
-
-      // Disabling is equally immediate because this flag controls consent to
-      // send the request body to Phoenix.
-      enabled = false;
-      await service.maybeHeal(
-        makeParams({ forward: makeForward('{"error":{"message":"c"}}', 400) }),
-      );
-      expect(findOne).toHaveBeenCalledTimes(3);
-      expect(client.heal).toHaveBeenCalledTimes(1);
-    });
-
-    it('queues a fresh shared consent read for requests that arrive during an older read', async () => {
-      const resolveLoads: Array<(agent: Partial<Agent>) => void> = [];
-      const findOne = jest.fn(
-        () =>
-          new Promise<Partial<Agent>>((resolve) => {
-            resolveLoads.push(resolve);
-          }),
-      );
-      const service = makeService({
-        repo: { findOne } as unknown as Repository<Agent>,
-      });
-
-      const first = service.isActiveFor('tenant-1', 'agent-1');
-      const second = service.isActiveFor('tenant-1', 'agent-1');
-      const third = service.isActiveFor('tenant-1', 'agent-1');
-      expect(findOne).toHaveBeenCalledTimes(1);
-
-      // The first result can predate a toggle. Later callers ignore it and share
-      // a generation that begins only after this read has completed.
-      resolveLoads[0]({ id: 'agent-1', autofix_enabled: false });
-      await expect(first).resolves.toBe(false);
-      await Promise.resolve();
-      expect(findOne).toHaveBeenCalledTimes(2);
-
-      resolveLoads[1]({ id: 'agent-1', autofix_enabled: true });
-      await expect(Promise.all([second, third])).resolves.toEqual([true, true]);
-
-      findOne.mockResolvedValue({ id: 'agent-1', autofix_enabled: false });
-      await expect(service.isActiveFor('tenant-1', 'agent-1')).resolves.toBe(false);
-      expect(findOne).toHaveBeenCalledTimes(3);
-    });
-  });
-});
-
-describe('isActiveFor (the consent gate)', () => {
-  it('is active when the deployment and agent allow it', async () => {
-    const service = makeService({ repo: makeAgentRepo(() => ({ autofix_enabled: true })).repo });
-
-    await expect(service.isActiveFor('tenant-1', 'agent-1')).resolves.toBe(true);
-  });
-
-  /**
-   * `defaultAgentEnabled` is `!isSelfHosted()`, resolved in the constructor, and
-   * `isSelfHosted()` sniffs for `/.dockerenv` / `/run/.containerenv` / Kubernetes.
-   * Pin `MANIFEST_MODE` (priority 1, always wins) so these assertions don't invert
-   * when the suite runs inside a container.
-   */
-  async function withMode(mode: string, run: () => Promise<void>): Promise<void> {
-    const previous = process.env['MANIFEST_MODE'];
-    process.env['MANIFEST_MODE'] = mode;
-    try {
-      await run();
-    } finally {
-      if (previous === undefined) delete process.env['MANIFEST_MODE'];
-      else process.env['MANIFEST_MODE'] = previous;
-    }
-  }
-
-  it('inherits the cloud default when the agent never chose', async () => {
-    await withMode('cloud', async () => {
-      const service = makeService({ repo: makeAgentRepo(() => ({ autofix_enabled: null })).repo });
-
-      await expect(service.isActiveFor('tenant-1', 'agent-1')).resolves.toBe(true);
-    });
-  });
-
-  it('inherits the self-hosted default, where Autofix is opt-in', async () => {
-    await withMode('selfhosted', async () => {
-      const service = makeService({ repo: makeAgentRepo(() => ({ autofix_enabled: null })).repo });
-
-      await expect(service.isActiveFor('tenant-1', 'agent-1')).resolves.toBe(false);
-    });
-  });
-
-  it('is inactive when the deployment killed Autofix globally', async () => {
-    const service = makeService({ config: makeConfig({ AUTOFIX_GLOBAL_ENABLED: 'false' }) });
-
-    await expect(service.isActiveFor('tenant-1', 'agent-1')).resolves.toBe(false);
-  });
-
-  it('is inactive when the agent turned Autofix off', async () => {
-    const service = makeService({ repo: makeAgentRepo(() => ({ autofix_enabled: false })).repo });
-
-    await expect(service.isActiveFor('tenant-1', 'agent-1')).resolves.toBe(false);
-  });
-
-  it('rejects rather than reporting false, so callers fail closed on a DB error', async () => {
-    const service = makeService({
-      repo: makeAgentRepo(() => {
-        throw new Error('db down');
-      }).repo,
-    });
-
-    await expect(service.isActiveFor('tenant-1', 'agent-1')).rejects.toThrow('db down');
-  });
-});
diff --git a/packages/backend/src/routing/autofix/__tests__/http-healing-client.spec.ts b/packages/backend/src/routing/autofix/__tests__/http-healing-client.spec.ts
deleted file mode 100644
index 1c936cdd..00000000
--- a/packages/backend/src/routing/autofix/__tests__/http-healing-client.spec.ts
+++ /dev/null
@@ -1,357 +0,0 @@
-import { HealContractError } from '../healing-client';
-import { HttpHealingClient } from '../http-healing-client';
-import type { HealOutcome, HealRequest, HealResponse } from '../phoenix.types';
-
-/** Minimal Response-like stub for fetch resolutions. */
-function fakeResponse(ok: boolean, status: number, body: unknown): Response {
-  return {
-    ok,
-    status,
-    json: async () => body,
-  } as unknown as Response;
-}
-
-function makeHealRequest(): HealRequest {
-  return {
-    traceId: 'trace-1',
-    tenantId: 'tenant-1',
-    provider: 'openai',
-    authType: 'api_key',
-    api: 'responses',
-    request: { max_tokens: 100 },
-    response: { statusCode: 400, error: { message: 'bad' } },
-  };
-}
-
-function makeInstanceId(id = 'install-1') {
-  return jest.fn(async () => id);
-}
-
-const context = { harness: 'claude-code' } as const;
-
-describe('HttpHealingClient', () => {
-  let fetchSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    fetchSpy = jest.spyOn(global, 'fetch');
-  });
-
-  afterEach(() => {
-    fetchSpy.mockRestore();
-  });
-
-  describe('heal', () => {
-    it('POSTs to `${baseUrl}/api/heal` and returns parsed JSON on 200', async () => {
-      const healResponse: HealResponse = { status: 'no_patch', issueId: 'i-1' };
-      fetchSpy.mockResolvedValue(fakeResponse(true, 200, healResponse));
-      const client = new HttpHealingClient('http://x', 1000);
-      const input = makeHealRequest();
-
-      const res = await client.heal(input, context);
-
-      expect(res).toEqual(healResponse);
-      expect(fetchSpy).toHaveBeenCalledTimes(1);
-      const [url, init] = fetchSpy.mock.calls[0];
-      expect(url).toBe('http://x/api/heal');
-      expect(init.method).toBe('POST');
-      expect(init.headers).toEqual({ 'content-type': 'application/json' });
-      expect(init.body).toBe(JSON.stringify(input));
-    });
-
-    it('throws a plain Error (a transport failure the breaker counts) on a 5xx', async () => {
-      fetchSpy.mockResolvedValue(fakeResponse(false, 500, {}));
-      const client = new HttpHealingClient('http://x', 1000);
-
-      const err = await client.heal(makeHealRequest(), context).catch((e: unknown) => e);
-      expect(err).toBeInstanceOf(Error);
-      expect(err).not.toBeInstanceOf(HealContractError);
-      expect((err as Error).message).toBe('Phoenix /api/heal responded 500');
-    });
-
-    it('throws a HealContractError carrying the status on a 4xx (contract/auth error)', async () => {
-      // 401 = Phoenix is up but rejected us (missing/invalid key). The service
-      // must be able to tell this apart from an outage so it never trips the breaker.
-      fetchSpy.mockResolvedValue(fakeResponse(false, 401, {}));
-      const client = new HttpHealingClient('http://x', 1000, 'secret');
-
-      const err = await client.heal(makeHealRequest(), context).catch((e: unknown) => e);
-      expect(err).toBeInstanceOf(HealContractError);
-      expect((err as HealContractError).status).toBe(401);
-    });
-
-    it('sends the API key and Manifest version when an API key is configured', async () => {
-      fetchSpy.mockResolvedValue(fakeResponse(true, 200, { status: 'no_patch', issueId: 'i' }));
-      const client = new HttpHealingClient('http://x', 1000, 'secret-key', undefined, '6.19.1');
-
-      await client.heal(makeHealRequest(), context);
-
-      const [, init] = fetchSpy.mock.calls[0];
-      expect(init.headers).toEqual({
-        'content-type': 'application/json',
-        'x-api-key': 'secret-key',
-        'X-Manifest-Version': '6.19.1',
-      });
-    });
-
-    it('announces the install id on the first call, with no registration round-trip', async () => {
-      fetchSpy.mockResolvedValue(
-        fakeResponse(true, 200, { status: 'no_patch', issueId: 'issue-1' }),
-      );
-      const client = new HttpHealingClient('http://x', 1000, undefined, makeInstanceId(), '6.15.1');
-
-      await client.heal(makeHealRequest(), context);
-
-      // One call, straight to /api/heal. The old design spent a request on
-      // /api/instances/register before it could send anything.
-      expect(fetchSpy).toHaveBeenCalledTimes(1);
-      expect(fetchSpy.mock.calls[0][0]).toBe('http://x/api/heal');
-      expect(fetchSpy.mock.calls[0][1].headers).toEqual({
-        'content-type': 'application/json',
-        'X-Manifest-Instance': 'install-1',
-        'X-Manifest-Version': '6.15.1',
-        'X-Manifest-Harness': 'claude-code',
-      });
-    });
-
-    it('sends no bearer secret: the id is an identifier, not a credential', async () => {
-      fetchSpy.mockResolvedValue(fakeResponse(true, 200, { status: 'no_patch', issueId: 'i' }));
-      const client = new HttpHealingClient('http://x', 1000, undefined, makeInstanceId(), '6.15.1');
-
-      await client.heal(makeHealRequest(), context);
-
-      expect(fetchSpy.mock.calls[0][1].headers).not.toHaveProperty('Authorization');
-    });
-
-    it('surfaces a 401 instead of rotating, since there is nothing to rotate', async () => {
-      fetchSpy.mockResolvedValue(fakeResponse(false, 401, {}));
-      const client = new HttpHealingClient('http://x', 1000, undefined, makeInstanceId(), '6.15.1');
-
-      const err = await client.heal(makeHealRequest(), context).catch((e: unknown) => e);
-
-      expect(err).toBeInstanceOf(HealContractError);
-      expect((err as HealContractError).status).toBe(401);
-      expect(fetchSpy).toHaveBeenCalledTimes(1);
-    });
-
-    it('resolves the id through the provider on every call', async () => {
-      fetchSpy.mockResolvedValue(fakeResponse(true, 200, { status: 'no_patch', issueId: 'i' }));
-      const instanceId = makeInstanceId();
-      const client = new HttpHealingClient('http://x', 1000, undefined, instanceId, '6.15.1');
-
-      await client.heal(makeHealRequest(), context);
-      await client.heal(makeHealRequest(), context);
-
-      // The provider caches; the client stays stateless so it never holds a
-      // stale id across a rotation on the telemetry side.
-      expect(instanceId).toHaveBeenCalledTimes(2);
-    });
-
-    it('falls back to "unknown" when the manifest version is unavailable', async () => {
-      fetchSpy.mockResolvedValue(fakeResponse(true, 200, { status: 'no_patch', issueId: 'i' }));
-      const client = new HttpHealingClient('http://x', 1000, undefined, makeInstanceId());
-
-      await client.heal(makeHealRequest(), context);
-
-      expect(fetchSpy.mock.calls[0][1].headers['X-Manifest-Version']).toBe('unknown');
-    });
-
-    it('requires a bounded harness on the instance-identified path', async () => {
-      const client = new HttpHealingClient('http://x', 1000, undefined, makeInstanceId(), '6.15.1');
-
-      // The type makes this unreachable for typed callers; the cast reproduces
-      // an untyped JS caller, which the runtime guard still has to reject.
-      await expect(client.heal(makeHealRequest(), undefined as never)).rejects.toThrow(
-        'Autofix harness is required',
-      );
-      expect(fetchSpy).not.toHaveBeenCalled();
-    });
-
-    it('gives the static API key precedence over the instance id', async () => {
-      fetchSpy.mockResolvedValue(fakeResponse(true, 200, { status: 'no_patch', issueId: 'i' }));
-      const instanceId = makeInstanceId();
-      const client = new HttpHealingClient('http://x', 1000, 'static-key', instanceId, '6.15.1');
-
-      await client.heal(makeHealRequest(), context);
-
-      expect(instanceId).not.toHaveBeenCalled();
-      expect(fetchSpy.mock.calls[0][1].headers).toEqual({
-        'content-type': 'application/json',
-        'x-api-key': 'static-key',
-        'X-Manifest-Version': '6.15.1',
-      });
-    });
-
-    it('strips a trailing slash from baseUrl so the heal URL has no double slash', async () => {
-      fetchSpy.mockResolvedValue(fakeResponse(true, 200, { status: 'no_patch', issueId: 'i' }));
-      const client = new HttpHealingClient('http://x/', 1000);
-
-      await client.heal(makeHealRequest(), context);
-
-      expect(fetchSpy.mock.calls[0][0]).toBe('http://x/api/heal');
-    });
-  });
-
-  describe('reportOutcome', () => {
-    const outcome: HealOutcome = { retryStatusCode: 200 };
-
-    it('PATCHes `${baseUrl}/api/heal-attempts/<id>` (URL-encoded) and returns parsed JSON on 200', async () => {
-      const confirmResponse = {
-        healAttemptId: 'heal/1',
-        status: 'succeeded',
-        issueStatus: 'verified',
-      };
-      fetchSpy.mockResolvedValue(fakeResponse(true, 200, confirmResponse));
-      const client = new HttpHealingClient('http://x', 1000);
-
-      const res = await client.reportOutcome('heal/1', outcome, context);
-
-      expect(res).toEqual(confirmResponse);
-      const [url, init] = fetchSpy.mock.calls[0];
-      // The '/' in the id must be percent-encoded.
-      expect(url).toBe('http://x/api/heal-attempts/heal%2F1');
-      expect(init.method).toBe('PATCH');
-      expect(init.headers).toEqual({ 'content-type': 'application/json' });
-      expect(init.body).toBe(JSON.stringify(outcome));
-    });
-
-    it('sends the x-api-key header on the PATCH when an API key is configured', async () => {
-      fetchSpy.mockResolvedValue(
-        fakeResponse(true, 200, {
-          healAttemptId: 'h',
-          status: 'succeeded',
-          issueStatus: 'unverified',
-        }),
-      );
-      const client = new HttpHealingClient('http://x', 1000, 'secret-key');
-
-      await client.reportOutcome('h', outcome, context);
-
-      const [, init] = fetchSpy.mock.calls[0];
-      expect(init.headers).toEqual({
-        'content-type': 'application/json',
-        'x-api-key': 'secret-key',
-        'X-Manifest-Version': 'unknown',
-      });
-    });
-
-    it('sends instance identity headers on the PATCH', async () => {
-      fetchSpy.mockResolvedValue(
-        fakeResponse(true, 200, {
-          healAttemptId: 'h',
-          status: 'succeeded',
-          issueStatus: 'unverified',
-        }),
-      );
-      const client = new HttpHealingClient(
-        'http://x',
-        1000,
-        undefined,
-        makeInstanceId('instance-1'),
-        '6.15.1',
-      );
-
-      await client.reportOutcome('h', outcome, context);
-
-      expect(fetchSpy.mock.calls[0][1].headers['X-Manifest-Harness']).toBe('claude-code');
-      expect(fetchSpy.mock.calls[0][1].headers['X-Manifest-Instance']).toBe('instance-1');
-      expect(fetchSpy.mock.calls[0][1].headers).not.toHaveProperty('Authorization');
-    });
-
-    it('returns null on a non-ok response', async () => {
-      fetchSpy.mockResolvedValue(fakeResponse(false, 404, {}));
-      const client = new HttpHealingClient('http://x', 1000);
-
-      const res = await client.reportOutcome('heal-1', outcome, context);
-
-      expect(res).toBeNull();
-    });
-
-    it('returns null (does not throw) when fetch rejects', async () => {
-      fetchSpy.mockRejectedValue(new Error('network down'));
-      const client = new HttpHealingClient('http://x', 1000);
-
-      await expect(client.reportOutcome('heal-1', outcome, context)).resolves.toBeNull();
-    });
-  });
-
-  describe('observe', () => {
-    /** Response stub whose body records that it was released. */
-    function observeResponse(ok: boolean, status: number, cancel = jest.fn()) {
-      return {
-        response: { ok, status, body: { cancel } } as unknown as Response,
-        cancel,
-      };
-    }
-
-    it('POSTs the batch to `${baseUrl}/api/heal/observe`', async () => {
-      const { response } = observeResponse(true, 200);
-      fetchSpy.mockResolvedValue(response);
-      const client = new HttpHealingClient('http://x', 1000, 'secret-key');
-      const batch = [makeHealRequest()];
-
-      await client.observe(batch, context);
-
-      const [url, init] = fetchSpy.mock.calls[0];
-      expect(url).toBe('http://x/api/heal/observe');
-      expect(init.method).toBe('POST');
-      expect(init.headers).toEqual({
-        'content-type': 'application/json',
-        'x-api-key': 'secret-key',
-        'X-Manifest-Version': 'unknown',
-      });
-      expect(JSON.parse(init.body)).toEqual({ observations: batch });
-    });
-
-    it('sends instance identity headers on observations', async () => {
-      const { response } = observeResponse(true, 200);
-      fetchSpy.mockResolvedValue(response);
-      const client = new HttpHealingClient(
-        'http://x',
-        1000,
-        undefined,
-        makeInstanceId('instance-1'),
-        '6.15.1',
-      );
-
-      await client.observe([makeHealRequest()], context);
-
-      expect(fetchSpy.mock.calls[0][1].headers['X-Manifest-Harness']).toBe('claude-code');
-      expect(fetchSpy.mock.calls[0][1].headers['X-Manifest-Instance']).toBe('instance-1');
-      expect(fetchSpy.mock.calls[0][1].headers).not.toHaveProperty('Authorization');
-    });
-
-    it('releases the response body so the connection is not held open', async () => {
-      const { response, cancel } = observeResponse(true, 200);
-      fetchSpy.mockResolvedValue(response);
-      const client = new HttpHealingClient('http://x', 1000);
-
-      await client.observe([makeHealRequest()], context);
-
-      expect(cancel).toHaveBeenCalledTimes(1);
-    });
-
-    it('does not call fetch for an empty batch', async () => {
-      const client = new HttpHealingClient('http://x', 1000);
-
-      await client.observe([], context);
-
-      expect(fetchSpy).not.toHaveBeenCalled();
-    });
-
-    it('swallows a non-ok response — evidence is lost, never the request', async () => {
-      const { response, cancel } = observeResponse(false, 401);
-      fetchSpy.mockResolvedValue(response);
-      const client = new HttpHealingClient('http://x', 1000);
-
-      await expect(client.observe([makeHealRequest()], context)).resolves.toBeUndefined();
-      expect(cancel).toHaveBeenCalledTimes(1);
-    });
-
-    it('swallows a transport failure', async () => {
-      fetchSpy.mockRejectedValue(new Error('network down'));
-      const client = new HttpHealingClient('http://x', 1000);
-
-      await expect(client.observe([makeHealRequest()], context)).resolves.toBeUndefined();
-    });
-  });
-});
diff --git a/packages/backend/src/routing/autofix/__tests__/mock-healing-client.spec.ts b/packages/backend/src/routing/autofix/__tests__/mock-healing-client.spec.ts
deleted file mode 100644
index 94b1ea02..00000000
--- a/packages/backend/src/routing/autofix/__tests__/mock-healing-client.spec.ts
+++ /dev/null
@@ -1,161 +0,0 @@
-import { MOCK_RENAME_CATALOG, MockHealingClient } from '../mock-healing-client';
-import type { HealRequest, PhoenixProviderError } from '../phoenix.types';
-
-/**
- * Build a minimal HealRequest for the mock. Callers override the error fields
- * and request body per case.
- */
-function makeRequest(error: PhoenixProviderError, request: Record<string, unknown>): HealRequest {
-  return {
-    traceId: 'trace-1',
-    tenantId: 'tenant-1',
-    provider: 'openai',
-    authType: 'api_key',
-    api: 'responses',
-    request,
-    response: { statusCode: 400, error },
-  };
-}
-
-const context = { harness: 'claude-code' } as const;
-
-describe('MOCK_RENAME_CATALOG', () => {
-  it('is exported and maps max_tokens to max_output_tokens', () => {
-    expect(MOCK_RENAME_CATALOG).toBeDefined();
-    expect(MOCK_RENAME_CATALOG.max_tokens).toBe('max_output_tokens');
-  });
-});
-
-describe('MockHealingClient', () => {
-  let client: MockHealingClient;
-
-  beforeEach(() => {
-    client = new MockHealingClient();
-  });
-
-  describe('heal', () => {
-    it('patches an unknown_parameter with a renamable param present in the body', async () => {
-      const input = makeRequest(
-        { message: 'unknown param', code: 'unknown_parameter', param: 'max_tokens' },
-        { max_tokens: 100, model: 'x' },
-      );
-
-      const res = await client.heal(input, context);
-
-      // A freshly served patch is `unverified` (Phoenix only answers `patched`
-      // for an already-verified issue); the loop still applies it.
-      expect(res.status).toBe('unverified');
-      expect(res.operations).toEqual([
-        { type: 'rename_param', from: 'max_tokens', to: 'max_output_tokens' },
-      ]);
-      // The healed body renames the key and drops the old one.
-      expect(res.healedBody).toEqual({ max_output_tokens: 100, model: 'x' });
-      expect(res.healedBody).not.toHaveProperty('max_tokens');
-      // Identifiers are present strings.
-      expect(typeof res.issueId).toBe('string');
-      expect(typeof res.patchId).toBe('string');
-      expect(typeof res.healAttemptId).toBe('string');
-    });
-
-    it('returns no_patch for unknown_parameter when the param is not in the rename catalog', async () => {
-      const input = makeRequest(
-        { message: 'unknown param', code: 'unknown_parameter', param: 'temperature' },
-        { temperature: 0.5, model: 'x' },
-      );
-
-      const res = await client.heal(input, context);
-
-      expect(res.status).toBe('no_patch');
-      expect(typeof res.issueId).toBe('string');
-      expect(res.operations).toBeUndefined();
-      expect(res.healedBody).toBeUndefined();
-    });
-
-    it('returns no_patch when a renamable param is not present in the request body', async () => {
-      const input = makeRequest(
-        { message: 'unknown param', code: 'unknown_parameter', param: 'max_tokens' },
-        { model: 'x' }, // max_tokens missing → `param in input.request` is false
-      );
-
-      const res = await client.heal(input, context);
-
-      expect(res.status).toBe('no_patch');
-    });
-
-    it('returns no_patch for a different error code', async () => {
-      const input = makeRequest(
-        { message: 'rate limited', code: 'rate_limit_exceeded', param: 'max_tokens' },
-        { max_tokens: 100, model: 'x' },
-      );
-
-      const res = await client.heal(input, context);
-
-      expect(res.status).toBe('no_patch');
-    });
-
-    it('returns no_patch when param is null (falsy short-circuits the rename lookup)', async () => {
-      const input = makeRequest(
-        { message: 'unknown param', code: 'unknown_parameter', param: null },
-        { max_tokens: 100, model: 'x' },
-      );
-
-      const res = await client.heal(input, context);
-
-      // param is null → `param ? MOCK_RENAME_CATALOG[param] : undefined` yields
-      // undefined, so the patched branch is skipped.
-      expect(res.status).toBe('no_patch');
-    });
-
-    it('returns no_patch for a prototype-chain param name (e.g. toString)', async () => {
-      // `toString` is inherited on every object; the own-property checks must stop
-      // it from resolving to `Object.prototype.toString` in the catalog or request.
-      const input = makeRequest(
-        { message: 'unknown param', code: 'unknown_parameter', param: 'toString' },
-        { model: 'x' },
-      );
-
-      const res = await client.heal(input, context);
-
-      expect(res.status).toBe('no_patch');
-      expect(res.healedBody).toBeUndefined();
-    });
-  });
-
-  describe('reportOutcome', () => {
-    it('reports succeeded (issue stays unverified) for a 2xx retry status', async () => {
-      const res = await client.reportOutcome('heal-123', { retryStatusCode: 200 }, context);
-
-      expect(res).toEqual({
-        healAttemptId: 'heal-123',
-        status: 'succeeded',
-        issueStatus: 'unverified',
-      });
-    });
-
-    it('reports failed (issue stays unverified) for a >=400 retry status', async () => {
-      const res = await client.reportOutcome(
-        'heal-456',
-        {
-          retryStatusCode: 400,
-          error: { message: 'still bad' },
-        },
-        context,
-      );
-
-      expect(res).toEqual({
-        healAttemptId: 'heal-456',
-        status: 'failed',
-        issueStatus: 'unverified',
-      });
-    });
-  });
-
-  describe('observe', () => {
-    it('discards the batch — the mock has no issue base to grow', async () => {
-      const client = new MockHealingClient();
-      const batch = [makeRequest({ message: 'bad' }, { model: 'gpt-5.1' })];
-
-      await expect(client.observe(batch, context)).resolves.toBeUndefined();
-    });
-  });
-});
diff --git a/packages/backend/src/routing/autofix/__tests__/phoenix-contract.spec.ts b/packages/backend/src/routing/autofix/__tests__/phoenix-contract.spec.ts
deleted file mode 100644
index 3b542ab5..00000000
--- a/packages/backend/src/routing/autofix/__tests__/phoenix-contract.spec.ts
+++ /dev/null
@@ -1,180 +0,0 @@
-import { readFileSync } from 'fs';
-import { join } from 'path';
-import Ajv2020 from 'ajv/dist/2020';
-import type { ValidateFunction } from 'ajv';
-import addFormats from 'ajv-formats';
-import { load } from 'js-yaml';
-import { AGENT_PLATFORMS } from 'manifest-shared';
-import { HEAL_STATUSES, ISSUE_STATUSES, OUTCOME_STATUSES } from '../phoenix.types';
-
-/**
- * Contract test — the anti-drift guardrail. Manifest's hand-written Phoenix types
- * (phoenix.types.ts) must stay in lockstep with Phoenix's OpenAPI spec, vendored
- * at ./contract/phoenix-openapi.yaml and refreshed with `npm run contract:refresh`.
- *
- * This is what would have caught, in CI, both drifts we hit by hand:
- *  - Phase 0: `traceId` became required (we still sent `requestId`).
- *  - Phase 1: the status enums were renamed (pending_confirmation → unverified, …).
- */
-
-const SPEC_PATH = join(__dirname, '..', 'contract', 'phoenix-openapi.yaml');
-
-interface SchemaObject {
-  properties?: Record<string, { enum?: string[] }>;
-}
-interface OpenApiDoc {
-  security: Array<Record<string, unknown[]>>;
-  paths: Record<string, Record<string, { security?: Array<Record<string, unknown[]>> }>>;
-  components: {
-    schemas: Record<string, SchemaObject>;
-    parameters: Record<string, { schema?: { enum?: string[] } }>;
-    securitySchemes: Record<string, unknown>;
-  };
-}
-
-const doc = load(readFileSync(SPEC_PATH, 'utf8')) as OpenApiDoc;
-const schemas = doc.components.schemas;
-
-/** The `status` enum a schema declares in the vendored spec. */
-function statusEnum(schemaName: string): string[] {
-  const values = schemas[schemaName]?.properties?.status?.enum;
-  if (!values) throw new Error(`${schemaName}.status enum missing from the vendored spec`);
-  return values;
-}
-
-// Register just the schemas subtree so `$ref: #/components/schemas/X` resolves and
-// ajv never scans `securitySchemes` (whose `type: apiKey` is not a JSON-Schema type).
-const ajv = new Ajv2020({ strict: false, allErrors: true, validateSchema: false });
-addFormats(ajv);
-ajv.addSchema({ components: { schemas } }, 'phoenix');
-
-function validator(schemaName: string): ValidateFunction {
-  const validate = ajv.getSchema(`phoenix#/components/schemas/${schemaName}`);
-  if (!validate) throw new Error(`schema ${schemaName} not found in the vendored spec`);
-  return validate;
-}
-
-describe('Phoenix wire contract (vendored OpenAPI)', () => {
-  describe('status enums stay in lockstep with the spec', () => {
-    it('HealResult.status === HEAL_STATUSES', () => {
-      expect([...HEAL_STATUSES].sort()).toEqual([...statusEnum('HealResult')].sort());
-    });
-    it('IssueView.status === ISSUE_STATUSES', () => {
-      expect([...ISSUE_STATUSES].sort()).toEqual([...statusEnum('IssueView')].sort());
-    });
-    it('OutcomeResult.status === OUTCOME_STATUSES', () => {
-      expect([...OUTCOME_STATUSES].sort()).toEqual([...statusEnum('OutcomeResult')].sort());
-    });
-  });
-
-  describe('HealRequest — the body HttpHealingClient sends', () => {
-    const validate = validator('HealRequest');
-    // Mirrors the heal() call in AutofixService.runHealOnce — keep them aligned.
-    const valid = {
-      traceId: 'trace-abc',
-      tenantId: 'tenant-abc',
-      provider: 'openai',
-      authType: 'api_key',
-      api: 'chat_completions',
-      url: 'https://api.openai.com/v1/chat/completions',
-      request: { model: 'gpt-4o', max_tokens: 100 },
-      response: {
-        statusCode: 400,
-        error: {
-          message: 'unknown parameter',
-          code: 'unknown_parameter',
-          param: 'max_tokens',
-          type: 'invalid_request_error',
-        },
-      },
-    };
-
-    it('accepts the request the client builds', () => {
-      expect(validate(valid)).toBe(true);
-    });
-
-    it('rejects a request missing the required traceId (the Phase 0 break)', () => {
-      const noTrace: Record<string, unknown> = { ...valid };
-      delete noTrace.traceId;
-      expect(validate(noTrace)).toBe(false);
-      expect(JSON.stringify(validate.errors)).toContain('traceId');
-    });
-
-    it('rejects an `api` value outside the enum', () => {
-      expect(validate({ ...valid, api: 'completions' })).toBe(false);
-    });
-
-    it('rejects an auth type outside the enum', () => {
-      expect(validate({ ...valid, authType: 'oauth' })).toBe(false);
-    });
-  });
-
-  describe('instance identification', () => {
-    it('exposes no registration handshake', () => {
-      // The id is announced, never issued: there is nothing to register for.
-      expect(doc.paths['/api/instances/register']).toBeUndefined();
-    });
-
-    it('accepts a static key or a bare instance id on the gateway operations', () => {
-      expect(doc.security).toEqual([{ ApiKeyAuth: [] }]);
-      for (const operation of [
-        doc.paths['/api/heal'].post,
-        doc.paths['/api/heal/observe'].post,
-        doc.paths['/api/heal-attempts/{id}'].patch,
-      ]) {
-        expect(operation.security).toEqual([{ ApiKeyAuth: [] }, { ManifestInstanceAuth: [] }]);
-      }
-      expect(doc.components.securitySchemes).toHaveProperty('ApiKeyAuth');
-      expect(doc.components.securitySchemes).toHaveProperty('ManifestInstanceAuth');
-    });
-
-    it('carries no bearer-secret scheme', () => {
-      // Identifier, not credential — a secret scheme reappearing here means
-      // Phoenix went back to issuing credentials and Manifest must follow.
-      expect(doc.components.securitySchemes).not.toHaveProperty('InstanceBearerAuth');
-      const scheme = doc.components.securitySchemes.ManifestInstanceAuth as {
-        in: string;
-        name: string;
-      };
-      expect(scheme.in).toBe('header');
-      expect(scheme.name).toBe('X-Manifest-Instance');
-    });
-
-    it('keeps the harness header allowlist in lockstep with AGENT_PLATFORMS', () => {
-      expect(doc.components.parameters.ManifestHarness.schema?.enum).toEqual([...AGENT_PLATFORMS]);
-    });
-  });
-
-  describe('HealOutcome — the PATCH body', () => {
-    const validate = validator('HealOutcome');
-    it('accepts a 2xx outcome and a >=400 outcome with an error', () => {
-      expect(validate({ retryStatusCode: 200 })).toBe(true);
-      expect(validate({ retryStatusCode: 400, error: { message: 'still bad' } })).toBe(true);
-    });
-  });
-
-  describe('response shapes the client parses', () => {
-    const UUID = '11111111-1111-4111-8111-111111111111';
-
-    it('HealResult: an unverified served patch validates', () => {
-      const validate = validator('HealResult');
-      expect(
-        validate({
-          status: 'unverified',
-          issueId: UUID,
-          patchId: UUID,
-          healAttemptId: UUID,
-          operations: [{ type: 'rename_param', from: 'max_tokens', to: 'max_output_tokens' }],
-          healedBody: { model: 'gpt-4o', max_output_tokens: 100 },
-        }),
-      ).toBe(true);
-    });
-
-    it('OutcomeResult validates', () => {
-      const validate = validator('OutcomeResult');
-      expect(
-        validate({ healAttemptId: UUID, status: 'succeeded', issueStatus: 'unverified' }),
-      ).toBe(true);
-    });
-  });
-});
diff --git a/packages/backend/src/routing/autofix/__tests__/provider-error-normalizer.spec.ts b/packages/backend/src/routing/autofix/__tests__/provider-error-normalizer.spec.ts
deleted file mode 100644
index 8b358555..00000000
--- a/packages/backend/src/routing/autofix/__tests__/provider-error-normalizer.spec.ts
+++ /dev/null
@@ -1,290 +0,0 @@
-import { normalizeProviderError, serializeProviderError } from '../provider-error-normalizer';
-import type { PhoenixProviderError } from '../phoenix.types';
-
-describe('normalizeProviderError', () => {
-  it('extracts all four fields from an OpenAI-compatible envelope', () => {
-    const raw = JSON.stringify({
-      error: { message: 'm', type: 't', param: 'p', code: 'c' },
-    });
-
-    const result = normalizeProviderError(raw);
-
-    // Assert the returned shape matches PhoenixProviderError exactly.
-    const expected: PhoenixProviderError = {
-      message: 'm',
-      type: 't',
-      param: 'p',
-      code: 'c',
-    };
-    expect(result).toEqual(expected);
-  });
-
-  it('reads message from a flat body (no error key) and nulls the rest', () => {
-    const raw = JSON.stringify({ message: 'm' });
-
-    const result = normalizeProviderError(raw);
-
-    expect(result).toEqual({ message: 'm', type: null, param: null, code: null });
-  });
-
-  it('reads message from a FastAPI-style {detail} body', () => {
-    const body = JSON.stringify({
-      detail: "The 'gpt-5.4-mini' model is not supported when using Codex with a ChatGPT account.",
-    });
-
-    expect(normalizeProviderError(body)).toEqual({
-      message: "The 'gpt-5.4-mini' model is not supported when using Codex with a ChatGPT account.",
-      type: null,
-      param: null,
-      code: null,
-    });
-  });
-
-  it('treats a whitespace-only bare error string as absent and falls back to the raw body', () => {
-    const body = JSON.stringify({ error: '   ' });
-    expect(normalizeProviderError(body).message).toBe(body);
-  });
-
-  it('reads message from a bare string error field', () => {
-    expect(normalizeProviderError(JSON.stringify({ error: 'model not found' }))).toEqual({
-      message: 'model not found',
-      type: null,
-      param: null,
-      code: null,
-    });
-  });
-
-  it('uses the raw body as the message for a non-JSON body', () => {
-    const result = normalizeProviderError('boom');
-
-    expect(result).toEqual({ message: 'boom', type: null, param: null, code: null });
-  });
-
-  it('falls back to the raw body when JSON parses to a non-object (number)', () => {
-    const result = normalizeProviderError('123');
-
-    // JSON.parse('123') === 123, which is not an object → parsed stays null.
-    expect(result).toEqual({ message: '123', type: null, param: null, code: null });
-  });
-
-  it('falls back to the raw body when JSON parses to null', () => {
-    const result = normalizeProviderError('null');
-
-    // JSON.parse('null') === null → the `json && typeof json === 'object'`
-    // guard is false, so parsed stays null.
-    expect(result).toEqual({ message: 'null', type: null, param: null, code: null });
-  });
-
-  it('scrubs an Anthropic-style secret out of the message', () => {
-    const secret = `sk-ant-${'a'.repeat(24)}`;
-    const raw = JSON.stringify({ error: { message: `bad key ${secret}` } });
-
-    const result = normalizeProviderError(raw);
-
-    expect(result.message).not.toContain(secret);
-    expect(result.message).toContain('[REDACTED]');
-  });
-
-  it('scrubs a Bearer token out of the message', () => {
-    const raw = JSON.stringify({
-      error: { message: 'auth failed: Bearer abcdefghijklmnop' },
-    });
-
-    const result = normalizeProviderError(raw);
-
-    expect(result.message).not.toContain('abcdefghijklmnop');
-    expect(result.message).toContain('Bearer [REDACTED]');
-  });
-
-  it('scrubs secrets out of type, param and code (not just message)', () => {
-    const secret = `sk-ant-${'a'.repeat(24)}`;
-    const raw = JSON.stringify({
-      error: { message: 'm', type: `t ${secret}`, param: `p ${secret}`, code: `c ${secret}` },
-    });
-
-    const result = normalizeProviderError(raw);
-
-    for (const field of [result.type, result.param, result.code]) {
-      expect(field).not.toContain(secret);
-      expect(field).toContain('[REDACTED]');
-    }
-  });
-
-  it('truncates a very long message to 2000 characters', () => {
-    const longMessage = 'x'.repeat(5000);
-    const raw = JSON.stringify({ error: { message: longMessage } });
-
-    const result = normalizeProviderError(raw);
-
-    expect(result.message).toHaveLength(2000);
-    expect(result.message).toBe('x'.repeat(2000));
-  });
-
-  it('prefers error.message over a top-level message when both are present', () => {
-    const raw = JSON.stringify({
-      message: 'top',
-      error: { message: 'nested', type: 'nested_type' },
-    });
-
-    const result = normalizeProviderError(raw);
-
-    expect(result.message).toBe('nested');
-    expect(result.type).toBe('nested_type');
-  });
-
-  it('ignores an empty-string error.message and falls back to the top-level message', () => {
-    // coerceString returns null for empty strings, exercising the ?? chain's
-    // first fallback (error.message empty → parsed.message).
-    const raw = JSON.stringify({ message: 'fallback', error: { message: '' } });
-
-    const result = normalizeProviderError(raw);
-
-    expect(result.message).toBe('fallback');
-  });
-
-  it('treats a null error field as absent and reads the flat body', () => {
-    // parsed.error is present but null → the `parsed.error !== null` guard is
-    // false, so errorObj falls back to parsed itself.
-    const raw = JSON.stringify({ message: 'flat', error: null });
-
-    const result = normalizeProviderError(raw);
-
-    expect(result).toEqual({ message: 'flat', type: null, param: null, code: null });
-  });
-});
-
-describe('serializeProviderError', () => {
-  const openaiError = JSON.stringify({
-    error: {
-      message: "Unsupported value: 'temperature' does not support 0.7 with this model.",
-      type: 'invalid_request_error',
-      param: 'temperature',
-      code: 'unsupported_value',
-    },
-  });
-
-  it('round-trips an envelope through normalize → serialize → normalize', () => {
-    const normalized = normalizeProviderError(openaiError);
-
-    const restored = normalizeProviderError(serializeProviderError(normalized));
-
-    // The dims survive the trip. Losing them is what split one error into two
-    // Phoenix issues when a stored row was later re-ingested.
-    expect(restored).toEqual(normalized);
-    expect(restored.param).toBe('temperature');
-    expect(restored.code).toBe('unsupported_value');
-  });
-
-  it('omits the dimensions the provider did not give us', () => {
-    const serialized = serializeProviderError({
-      message: 'boom',
-      type: null,
-      param: null,
-      code: null,
-    });
-
-    expect(JSON.parse(serialized)).toEqual({ error: { message: 'boom' } });
-  });
-
-  it('trims the message so a long error still parses as JSON', () => {
-    const serialized = serializeProviderError({
-      message: 'x'.repeat(2000),
-      type: 'invalid_request_error',
-      param: 'temperature',
-      code: 'unsupported_value',
-    });
-
-    expect(serialized.length).toBeLessThanOrEqual(2000);
-    const parsed = normalizeProviderError(serialized);
-    expect(parsed.message.startsWith('xxx')).toBe(true);
-    expect(parsed.param).toBe('temperature'); // the dims are never the thing that gets cut
-    expect(parsed.code).toBe('unsupported_value');
-  });
-
-  it('clips a pathologically long dimension rather than storing it whole', () => {
-    const serialized = serializeProviderError({
-      message: 'm',
-      type: null,
-      param: 'p'.repeat(5000),
-      code: null,
-    });
-
-    expect(normalizeProviderError(serialized).param).toHaveLength(1024);
-  });
-
-  it('never exceeds the cap, whatever the provider pads', () => {
-    // Control characters escape to six JSON bytes each, so bounded dimensions can still
-    // exhaust the budget between them. The envelope must fit regardless.
-    const cases: PhoenixProviderError[] = [
-      { message: 'x'.repeat(9000), type: 't', param: 'p', code: 'c' },
-      {
-        message: 'm',
-        type: '\u0000'.repeat(1024),
-        param: '"'.repeat(1024),
-        code: '\\'.repeat(1024),
-      },
-      { message: 'x'.repeat(9000), type: '\u0000'.repeat(1024), param: null, code: null },
-      { message: '"'.repeat(3000), type: null, param: null, code: null },
-    ];
-
-    for (const error of cases) {
-      const serialized = serializeProviderError(error);
-      expect(serialized.length).toBeLessThanOrEqual(2000);
-      expect(() => JSON.parse(serialized)).not.toThrow();
-    }
-  });
-
-  it('does not split an astral character when trimming to fit', () => {
-    // Cutting a surrogate pair in half orphans one, which JSON renders as `\ud83d`: six
-    // characters where there was one. A naive trim therefore grows the envelope past the
-    // cap. n=1975 is the length whose cut lands exactly between the two halves.
-    for (let n = 1970; n <= 1980; n++) {
-      const serialized = serializeProviderError({
-        message: 'x'.repeat(n) + '\u{1F600}',
-        type: null,
-        param: null,
-        code: null,
-      });
-
-      expect(serialized.length).toBeLessThanOrEqual(2000);
-      expect(serialized).not.toContain('\\ud83d');
-      expect(() => JSON.parse(serialized)).not.toThrow();
-    }
-  });
-
-  it('drops the dimensions rather than the whole message when they alone blow the cap', () => {
-    const serialized = serializeProviderError({
-      message: 'the real error',
-      type: '\u0000'.repeat(1024),
-      param: '\u0000'.repeat(1024),
-      code: '\u0000'.repeat(1024),
-    });
-
-    expect(JSON.parse(serialized)).toEqual({ error: { message: 'the real error' } });
-  });
-
-  it('escapes a message that would otherwise break the envelope', () => {
-    const message = 'he said "hi"\n\\ and left';
-
-    const parsed = normalizeProviderError(
-      serializeProviderError({ message, type: null, param: null, code: null }),
-    );
-
-    expect(parsed.message).toBe(message);
-  });
-
-  it('scrubs secrets even from an error that never went through normalizeProviderError', () => {
-    // This is a storage boundary: it must not assume its input is already clean.
-    const secret = `sk-ant-${'a'.repeat(24)}`;
-
-    const serialized = serializeProviderError({
-      message: `bad key ${secret}`,
-      type: `t ${secret}`,
-      param: `p ${secret}`,
-      code: `c ${secret}`,
-    });
-
-    expect(serialized).not.toContain(secret);
-    expect(serialized).toContain('[REDACTED]');
-  });
-});
diff --git a/packages/backend/src/routing/autofix/autofix-healing-config.ts b/packages/backend/src/routing/autofix/autofix-healing-config.ts
deleted file mode 100644
index 6146fa7f..00000000
--- a/packages/backend/src/routing/autofix/autofix-healing-config.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/**
- * The one hosted Phoenix every deployment heals against. This is a constant,
- * not an operator knob: cloud and self-hosted talk to the same service, and the
- * only thing that differs is how they authenticate (a static
- * `AUTOFIX_HEALING_API_KEY` for cloud, the anonymous install id for
- * self-hosted). Pointing an install at some other healer is not a supported
- * configuration, so there is no URL to typo, to redirect, or to leak a key to.
- */
-export const AUTOFIX_URL = 'https://autofix.manifest.build';
-
-/**
- * Resolve the healer URL for the running environment.
- *
- * Production — cloud or self-hosted — always gets hosted Phoenix. Dev and test
- * get `undefined` so the caller selects the deterministic in-process mock: a
- * developer running the stack locally must never post real failures at the
- * production healer, and a test must never depend on the network.
- *
- * To switch Autofix off entirely, set `AUTOFIX_GLOBAL_ENABLED=false`; that
- * short-circuits in `AutofixService` before any heal call is made.
- */
-export function resolveHealingUrl(nodeEnv: string | undefined): string | undefined {
-  return nodeEnv === 'production' ? AUTOFIX_URL : undefined;
-}
diff --git a/packages/backend/src/routing/autofix/autofix-health-probe.ts b/packages/backend/src/routing/autofix/autofix-health-probe.ts
deleted file mode 100644
index a11ec9b1..00000000
--- a/packages/backend/src/routing/autofix/autofix-health-probe.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-import { Injectable, Logger, type OnApplicationBootstrap } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { resolveHealingUrl } from './autofix-healing-config';
-
-const PROBE_TIMEOUT_MS = 5_000;
-
-/**
- * On boot, ping hosted Phoenix's public `GET /api/health` once. Only
- * production probes — dev/test run the in-process mock and have nothing to
- * reach. The probe never registers or sends credentials, and never delays or
- * fails app boot.
- */
-@Injectable()
-export class AutofixHealthProbe implements OnApplicationBootstrap {
-  private readonly logger = new Logger(AutofixHealthProbe.name);
-
-  constructor(private readonly config: ConfigService) {}
-
-  onApplicationBootstrap(): void {
-    // Do not await: a slow/unreachable healer must not hold up boot.
-    void this.probe();
-  }
-
-  async probe(): Promise<void> {
-    // With no healer URL to blank out, `AUTOFIX_GLOBAL_ENABLED=false` is the
-    // only opt-out an operator has left — so it has to mean *no contact at
-    // all*, boot probe included. Previously `AUTOFIX_HEALING_URL=off` carried
-    // that guarantee and the probe was allowed to run regardless.
-    if (this.config.get<string>('AUTOFIX_GLOBAL_ENABLED') === 'false') return;
-
-    const url = resolveHealingUrl(this.config.get<string>('NODE_ENV'));
-    if (!url) return; // Dev/test runs the in-process mock — nothing to probe.
-
-    const target = `${url.replace(/\/+$/, '')}/api/health`;
-    try {
-      // `/api/health` is public in the Phoenix contract (`security: []`), so send
-      // no `x-api-key` here — the key belongs only on guarded `/api/heal*` calls,
-      // and shipping it to a wrong/misconfigured URL would leak the credential.
-      const res = await fetch(target, {
-        signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
-      });
-      if (!res.ok) {
-        this.logger.warn(
-          `Autofix: Phoenix health probe ${target} returned ${res.status} — ` +
-            `Autofix will not heal until this is resolved.`,
-        );
-        return;
-      }
-      this.logger.log(`Autofix: Phoenix healer reachable at ${url}.`);
-    } catch (err) {
-      this.logger.warn(
-        `Autofix: Phoenix health probe ${target} failed (${(err as Error).message}) — ` +
-          `check this host's outbound network access.`,
-      );
-    }
-  }
-}
diff --git a/packages/backend/src/routing/autofix/autofix.module.ts b/packages/backend/src/routing/autofix/autofix.module.ts
deleted file mode 100644
index 31a53c0d..00000000
--- a/packages/backend/src/routing/autofix/autofix.module.ts
+++ /dev/null
@@ -1,86 +0,0 @@
-import { Module } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { TypeOrmModule } from '@nestjs/typeorm';
-import { Agent } from '../../entities/agent.entity';
-import { AgentMessage } from '../../entities/agent-message.entity';
-import { ManifestRequest } from '../../entities/request.entity';
-import { isSelfHosted } from '../../common/utils/detect-self-hosted';
-import { readManifestVersion } from '../../telemetry/telemetry.config';
-import { TelemetryModule } from '../../telemetry/telemetry.module';
-import { AutofixService } from './autofix.service';
-import { AutofixHealthProbe } from './autofix-health-probe';
-import { resolveHealingUrl } from './autofix-healing-config';
-import { HEALING_CLIENT, type HealingClient } from './healing-client';
-import { HttpHealingClient } from './http-healing-client';
-import { InstallIdService } from '../../telemetry/install-id.service';
-import { MockHealingClient } from './mock-healing-client';
-import { ObservationReporter } from './observation-reporter';
-
-const DEFAULT_TIMEOUT_MS = 10_000;
-
-/**
- * Wires Autofix. The active healing client is chosen at boot from the
- * environment alone — the healer URL is a constant, not configuration:
- * - production (cloud or self-hosted) talks to hosted Phoenix over HTTP;
- * - dev/test uses the deterministic in-process mock, so local runs and CI
- *   never reach the production healer.
- *
- * Auth is what differs between the two production modes: cloud sends its
- * static `AUTOFIX_HEALING_API_KEY`, self-hosted announces its anonymous
- * install id. `AUTOFIX_GLOBAL_ENABLED=false` disables the feature outright.
- */
-@Module({
-  imports: [TypeOrmModule.forFeature([Agent, AgentMessage, ManifestRequest]), TelemetryModule],
-  providers: [
-    AutofixService,
-    AutofixHealthProbe,
-    ObservationReporter,
-    {
-      provide: HEALING_CLIENT,
-      useFactory: (config: ConfigService, installIds: InstallIdService): HealingClient => {
-        const nodeEnv = config.get<string>('NODE_ENV');
-        const selfHosted = isSelfHosted();
-        const url = resolveHealingUrl(nodeEnv);
-        // Digits-only: `Number.parseInt` stops at the first non-digit, so a typo'd
-        // `AUTOFIX_TIMEOUT_MS` like `'5abc'` would silently override the timeout with
-        // `5`. Require a clean positive integer or fall back to the default.
-        const rawTimeout = config.get<string>('AUTOFIX_TIMEOUT_MS')?.trim() ?? '';
-        const parsed = /^\d+$/.test(rawTimeout) ? Number.parseInt(rawTimeout, 10) : NaN;
-        const timeoutMs = parsed > 0 ? parsed : DEFAULT_TIMEOUT_MS;
-        if (url) {
-          // Cloud sends its static key; self-hosted omits it and identifies by
-          // install id instead.
-          const apiKey = config.get<string>('AUTOFIX_HEALING_API_KEY')?.trim() || undefined;
-          // Self-hosted with no static key announces the install's anonymous id,
-          // minted lazily (an install that never enables Autofix or reports
-          // telemetry never creates one) and memoized for the process lifetime —
-          // InstallIdService reads the row on every call, so without this each
-          // heal request would do its own lookup. Only successful resolutions
-          // are cached: a transient DB failure must not disable Autofix for
-          // the rest of the process.
-          const instanceId =
-            !apiKey && selfHosted
-              ? (() => {
-                  let cached: Promise<string> | null = null;
-                  return async (): Promise<string> => {
-                    if (cached) return cached;
-                    cached = installIds.getOrCreate().then((i) => i.install_id);
-                    try {
-                      return await cached;
-                    } catch (err) {
-                      cached = null;
-                      throw err;
-                    }
-                  };
-                })()
-              : undefined;
-          return new HttpHealingClient(url, timeoutMs, apiKey, instanceId, readManifestVersion());
-        }
-        return new MockHealingClient();
-      },
-      inject: [ConfigService, InstallIdService],
-    },
-  ],
-  exports: [AutofixService, ObservationReporter],
-})
-export class AutofixModule {}
diff --git a/packages/backend/src/routing/autofix/autofix.service.ts b/packages/backend/src/routing/autofix/autofix.service.ts
deleted file mode 100644
index 64765a86..00000000
--- a/packages/backend/src/routing/autofix/autofix.service.ts
+++ /dev/null
@@ -1,594 +0,0 @@
-import { Inject, Injectable, Logger } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { InjectRepository } from '@nestjs/typeorm';
-import { Repository } from 'typeorm';
-import { v4 as uuid } from 'uuid';
-import {
-  coerceAgentPlatform,
-  isAnthropicExtraUsageError,
-  type AgentPlatform,
-  type AuthType,
-} from 'manifest-shared';
-import { Agent } from '../../entities/agent.entity';
-import { isSelfHosted } from '../../common/utils/detect-self-hosted';
-import type { ForwardResult } from '../proxy/provider-client';
-import type { ProxyApiMode } from '../proxy/proxy-types';
-import {
-  HEALING_CLIENT,
-  HealContractError,
-  type HealingClient,
-  type HealingRequestContext,
-} from './healing-client';
-import { normalizeProviderError } from './provider-error-normalizer';
-import { scrubSecrets } from '../../common/utils/secret-scrub';
-import { scrubProviderUrl } from './observation-payload';
-import type { AutofixChainEntry, AutofixRecord } from './autofix.types';
-import type { HealOutcome, HealResponse } from './phoenix.types';
-import { recordingResponseFromText } from '../proxy/attempt-recording-capture';
-
-export interface MaybeHealParams {
-  forward: ForwardResult;
-  agentId: string;
-  tenantId: string;
-  provider: string;
-  /** Logical model identity when the provider encodes it outside the JSON body. */
-  model: string;
-  authType: AuthType;
-  apiMode: ProxyApiMode;
-  /** The request body that was actually forwarded and failed. */
-  requestBody: Record<string, unknown>;
-  /** Optional endpoint URL, forwarded to Phoenix as readability context. */
-  url?: string;
-  /** Re-send a patched body to the provider and return the fresh forward. */
-  reforward: (healedBody: Record<string, unknown>) => Promise<ForwardResult>;
-}
-
-export interface AutofixAttempt {
-  /** Forward to continue with: the latest provider response, rebuilt if consumed. */
-  forward: ForwardResult;
-  record: AutofixRecord;
-}
-
-interface AgentAutofixConfig {
-  enabled: boolean;
-  harness: AgentPlatform;
-}
-
-interface AgentConfigLoad {
-  generation: number;
-  promise: Promise<AgentAutofixConfig>;
-}
-
-const DEFAULT_REPAIRABLE_STATUSES = '400,404,422';
-
-// Circuit breaker for the healing service. After this many consecutive heal-call
-// transport failures (timeout / unreachable), stop calling Phoenix for the
-// cooldown window so a slow or down healer stops adding latency to every
-// repairable 4xx BEFORE the fallback chain (the next safety net) gets to run.
-const HEAL_FAILURE_THRESHOLD = 3;
-const BREAKER_COOLDOWN_MS = 30_000;
-/**
- * Delays between outcome-report resends. A lost report leaves the heal attempt
- * dangling `pending` on Phoenix until a sweeper expires it an hour later — the
- * adjudication evidence is gone for good — so a transient failure gets spaced
- * resends before we give up.
- */
-const OUTCOME_RESEND_DELAYS_MS = [1_000, 5_000];
-
-function parseStatuses(raw: string | undefined): Set<number> {
-  const source = raw && raw.trim().length > 0 ? raw : DEFAULT_REPAIRABLE_STATUSES;
-  const parsed = source
-    .split(',')
-    .map((s) => s.trim())
-    // Digits-only: reject malformed tokens like `'404abc'` (which `parseInt` would
-    // silently accept as `404`) so a typo can't quietly enable/disable a status.
-    .filter((s) => /^\d+$/.test(s))
-    .map((s) => Number.parseInt(s, 10))
-    .filter((n) => n >= 400 && n < 500);
-  return new Set(parsed.length > 0 ? parsed : DEFAULT_REPAIRABLE_STATUSES.split(',').map(Number));
-}
-
-function headersToObject(headers: Headers): Record<string, string> {
-  const out: Record<string, string> = {};
-  headers.forEach((value, key) => {
-    out[key] = value;
-  });
-  return out;
-}
-
-function parseProviderBody(raw: string): unknown {
-  const scrubbed = scrubSecrets(raw);
-  try {
-    return JSON.parse(scrubbed) as unknown;
-  } catch {
-    return scrubbed;
-  }
-}
-
-function rebuildForward(base: ForwardResult, body: string, status: number): ForwardResult {
-  return {
-    ...base,
-    response: new Response(body, { status, headers: headersToObject(base.response.headers) }),
-  };
-}
-
-/**
- * Autofix: heal a repairable request-side 4xx by handing the failed request and
- * its provider error to Phoenix and resending the patched body ONCE — all BEFORE
- * the fallback chain runs. A no-op unless the forward already failed with a
- * repairable status AND the agent opted in, so successful traffic is never
- * touched. Any unexpected failure inside the flow degrades to the original
- * provider error — healing never makes a request worse.
- */
-@Injectable()
-export class AutofixService {
-  private readonly logger = new Logger(AutofixService.name);
-  private readonly globalEnabled: boolean;
-  // Effective default when an agent has no explicit choice (autofix_enabled NULL):
-  // ON in cloud, OFF in self-hosted. Computed once at boot.
-  private readonly defaultAgentEnabled: boolean;
-  private readonly repairableStatuses: Set<number>;
-  private readonly configLoads = new Map<string, AgentConfigLoad>();
-  private configLoadGeneration = 0;
-  // Circuit-breaker state (process-local). `breakerOpenUntil` is an epoch-ms
-  // deadline; while it is in the future, heal calls are skipped.
-  private healFailureStreak = 0;
-  private breakerOpenUntil = 0;
-
-  constructor(
-    @Inject(HEALING_CLIENT) private readonly client: HealingClient,
-    @InjectRepository(Agent) private readonly agentRepo: Repository<Agent>,
-    config: ConfigService,
-  ) {
-    this.globalEnabled = config.get<string>('AUTOFIX_GLOBAL_ENABLED') !== 'false';
-    this.defaultAgentEnabled = !isSelfHosted();
-    this.repairableStatuses = parseStatuses(config.get<string>('AUTOFIX_REPAIRABLE_STATUSES'));
-    // Boot-time snapshot of the resolved configuration. Logged once so an operator can
-    // confirm what the process actually loaded — e.g. whether the global kill
-    // switch is off, or self-hosted detection flipped the per-agent default off
-    // — straight from the deploy logs, without shell access. This is the first
-    // thing to check when "Autofix never runs".
-    this.logger.log(
-      `config: globalEnabled=${this.globalEnabled} ` +
-        `defaultAgentEnabled=${this.defaultAgentEnabled} ` +
-        `repairableStatuses=[${[...this.repairableStatuses].join(',')}]`,
-    );
-  }
-
-  /**
-   * Resolve an agent's stored Autofix flag to an effective on/off value. A
-   * NULL/undefined flag means "no explicit choice" and inherits the
-   * deployment-mode default: ON in cloud, OFF in self-hosted.
-   */
-  resolveEnabled(stored: boolean | null | undefined): boolean {
-    return stored ?? this.defaultAgentEnabled;
-  }
-
-  /** Whether a status is one Autofix will try to heal. */
-  isRepairable(status: number): boolean {
-    return this.repairableStatuses.has(status);
-  }
-
-  /**
-   * Is Autofix active for this agent — deployment-wide and for the agent itself?
-   * These are exactly the gates {@link maybeHeal} clears before
-   * it hands a request to Phoenix (it checks them inline so it can log *which*
-   * one short-circuited; keep the two in lockstep).
-   *
-   * Excludes the two checks that aren't about the agent's opt-in: the repairable
-   * status set (scope) and the circuit breaker (availability).
-   *
-   * This is the **consent boundary** for anything that ships a caller's request to
-   * the healing service. Turning Autofix on is what agrees to that; the evidence
-   * reporter must not send a body for an agent that never did. Rejects rather than
-   * resolves false on a DB hiccup, so callers fail closed on purpose.
-   */
-  async isActiveFor(tenantId: string, agentId: string): Promise<boolean> {
-    return (await this.getHealingContext(tenantId, agentId)) !== null;
-  }
-
-  /** Resolve consent and the bounded per-agent metadata needed by Phoenix. */
-  async getHealingContext(
-    tenantId: string,
-    agentId: string,
-  ): Promise<HealingRequestContext | null> {
-    if (!this.globalEnabled) return null;
-    const cfg = await this.loadAgentConfig(agentId, tenantId);
-    return cfg.enabled ? { harness: cfg.harness } : null;
-  }
-
-  /** A heal call reached the healer (any decision) — clear the failure streak. */
-  private recordHealSuccess(): void {
-    this.healFailureStreak = 0;
-  }
-
-  /**
-   * A heal call failed at the transport layer (timeout / unreachable). Once the
-   * streak crosses the threshold, open the breaker for the cooldown window so
-   * subsequent failures stop adding latency to the request path.
-   */
-  private recordHealFailure(): void {
-    this.healFailureStreak += 1;
-    if (this.healFailureStreak >= HEAL_FAILURE_THRESHOLD) {
-      this.breakerOpenUntil = Date.now() + BREAKER_COOLDOWN_MS;
-      this.healFailureStreak = 0;
-      this.logger.warn(
-        `autofix: healing service unreachable — circuit breaker open for ${BREAKER_COOLDOWN_MS}ms`,
-      );
-    }
-  }
-
-  async maybeHeal(params: MaybeHealParams): Promise<AutofixAttempt | null> {
-    const { forward } = params;
-    // Hot path: successful forwards never enter healing — return silently so we
-    // don't emit a log line on every request.
-    if (forward.response.ok) return null;
-
-    // Everything below runs ONLY for failed forwards, so these diagnostics stay
-    // low-volume. They make "why didn't Autofix run?" answerable from logs
-    // alone: one line per failed request stamped with the resolved configuration,
-    // then a single reason whenever a check short-circuits the heal.
-    const status = forward.response.status;
-    this.logger.log(
-      `maybeHeal: failed forward status=${status} agent=${params.agentId} ` +
-        `tenant=${params.tenantId} globalEnabled=${this.globalEnabled}`,
-    );
-    if (!this.globalEnabled) {
-      this.logger.warn(`skip status=${status}: globally disabled (AUTOFIX_GLOBAL_ENABLED=false)`);
-      return null;
-    }
-    if (!this.isRepairable(status)) {
-      this.logger.log(
-        `skip status=${status}: not in repairable set [${[...this.repairableStatuses].join(',')}]`,
-      );
-      return null;
-    }
-    if (status === 400 && params.provider.trim().toLowerCase() === 'anthropic') {
-      try {
-        const errorBody = await forward.response.clone().text();
-        if (
-          isAnthropicExtraUsageError({
-            provider: params.provider,
-            httpStatus: status,
-            errorBody,
-          })
-        ) {
-          this.logger.log(`skip status=${status}: Anthropic subscription billing exhaustion`);
-          return null;
-        }
-      } catch (err) {
-        // Classification is best-effort. If the cloned body cannot be read, keep
-        // the existing status-based behavior and leave the original response intact.
-        this.logger.warn(
-          `could not inspect Anthropic 400 for billing semantics: ${(err as Error).message}`,
-        );
-      }
-    }
-
-    // Circuit breaker: while the healing service is tripped, skip healing
-    // entirely and hand the forward back untouched, so a slow/unreachable
-    // Phoenix never delays the fallback chain (the next safety net).
-    if (this.breakerOpenUntil > Date.now()) {
-      this.logger.warn(`skip status=${status}: circuit breaker open`);
-      return null;
-    }
-
-    let cfg: AgentAutofixConfig;
-    try {
-      cfg = await this.loadAgentConfig(params.agentId, params.tenantId);
-    } catch (err) {
-      // A config-load failure (DB hiccup) must never turn a recoverable provider
-      // error into a crash — skip healing; the forward is still intact.
-      this.logger.warn(`autofix config load failed, skipping: ${(err as Error).message}`);
-      return null;
-    }
-    if (!cfg.enabled) {
-      this.logger.log(
-        `skip status=${status}: agent ${params.agentId} tenant ${params.tenantId} ` +
-          `disabled (defaultAgentEnabled=${this.defaultAgentEnabled})`,
-      );
-      return null;
-    }
-
-    // Include tenant + agent so a healing event is self-contained for
-    // tenant-scoped log filtering (the entry line above can interleave across
-    // requests once the two awaited gate checks run between them).
-    this.logger.log(
-      `healing status=${status} agent=${params.agentId} ` +
-        `tenant=${params.tenantId} provider=${params.provider}`,
-    );
-
-    // Read the original error once, then rebuild it so it stays readable
-    // downstream (fallback / recorder) whether or not we heal.
-    const originalText = await forward.response.text();
-    await forward.attempt?.finishRecording?.(recordingResponseFromText(originalText));
-    const originalForward = rebuildForward(forward, originalText, status);
-
-    try {
-      return await this.runHealOnce(params, cfg, status, originalText, originalForward);
-    } catch (err) {
-      // Defensive backstop: the common reforward failure is handled inside
-      // runHealOnce (which preserves the chain), so this only fires on a truly
-      // unexpected throw (e.g. reading the failed retry body). Degrade to the
-      // original provider error — never a Manifest 500.
-      this.logger.warn(`autofix failed, using original error: ${(err as Error).message}`);
-      return {
-        forward: originalForward,
-        record: { groupId: uuid(), outcome: 'exhausted', original_http_status: status, chain: [] },
-      };
-    }
-  }
-
-  /**
-   * One heal attempt: ask Phoenix, and if it hands out a patch, resend the
-   * patched body exactly once. There is no retry budget — a patch that doesn't
-   * clear the error is reported to Phoenix and then we give up (the fallback
-   * chain is the next safety net).
-   */
-  private async runHealOnce(
-    params: MaybeHealParams,
-    config: AgentAutofixConfig,
-    status: number,
-    originalText: string,
-    originalForward: ForwardResult,
-  ): Promise<AutofixAttempt> {
-    const groupId = uuid();
-    const normalized = normalizeProviderError(originalText);
-
-    const entry: AutofixChainEntry = {
-      attempt: 0,
-      origin: 'original',
-      request: params.requestBody,
-      http_status: status,
-      error: normalized,
-    };
-    const chain: AutofixChainEntry[] = [entry];
-
-    let heal: HealResponse;
-    try {
-      heal = await this.client.heal(
-        {
-          traceId: groupId,
-          tenantId: params.tenantId,
-          provider: params.provider,
-          model: params.model,
-          authType: params.authType,
-          api: params.apiMode,
-          url: params.url,
-          request: params.requestBody,
-          response: { statusCode: status, error: normalized },
-          ...(originalForward.wireFormat
-            ? {
-                providerExchange: {
-                  format: originalForward.wireFormat,
-                  ...(originalForward.wireRequestUrl
-                    ? { url: scrubProviderUrl(originalForward.wireRequestUrl) }
-                    : {}),
-                  request: { body: params.requestBody, redactedFields: [] },
-                  response: {
-                    statusCode: status,
-                    body: parseProviderBody(originalText),
-                  },
-                },
-              }
-            : {}),
-        },
-        { harness: config.harness },
-      );
-    } catch (err) {
-      if (err instanceof HealContractError) {
-        // Phoenix is reachable but rejected the request (4xx) — a contract or
-        // API-key bug on our side, not an outage. Don't trip the breaker (that
-        // would just mask it); surface it loudly so it gets fixed.
-        this.logger.error(
-          `autofix: Phoenix rejected the heal request (HTTP ${err.status}) — check the ` +
-            `wire contract and AUTOFIX_HEALING_API_KEY: ${err.message}`,
-        );
-      } else {
-        this.recordHealFailure();
-        this.logger.warn(`heal call failed: ${(err as Error).message}`);
-      }
-      return {
-        forward: originalForward,
-        record: { groupId, outcome: 'exhausted', original_http_status: status, chain },
-      };
-    }
-    // The healer answered (any decision) — it is alive, so clear the streak.
-    this.recordHealSuccess();
-
-    entry.phoenix_status = heal.status;
-    entry.issue_id = heal.issueId;
-    entry.patch_id = heal.patchId ?? null;
-    entry.heal_attempt_id = heal.healAttemptId ?? null;
-    entry.operations = heal.operations ?? null;
-    entry.explanation = heal.explanation ?? null;
-
-    // Phoenix is still authoring a patch for this novel error — nothing to resend.
-    if (heal.status === 'resolving') {
-      return {
-        forward: originalForward,
-        record: { groupId, outcome: 'resolving', original_http_status: status, chain },
-      };
-    }
-    // No patch available (or a malformed patch response) — give up cleanly.
-    if (heal.status === 'no_patch' || !heal.healedBody || !heal.healAttemptId) {
-      return {
-        forward: originalForward,
-        record: { groupId, outcome: 'unfixable', original_http_status: status, chain },
-      };
-    }
-
-    // A patch to apply: reached on `patched` (already verified) or `unverified`
-    // (a fresh patch) — and any future patch-bearing status — because the guard
-    // above keys off the presence of healedBody + healAttemptId, not a status
-    // allow-list. Keep it that way so a new Phoenix status never silently no-ops.
-    const healAttemptId = heal.healAttemptId;
-    const healedBody = heal.healedBody;
-    let next: ForwardResult;
-    try {
-      next = await params.reforward(healedBody);
-    } catch (err) {
-      // The patched resend threw (a provider transport error or the caller
-      // aborting mid-retry, NOT a Phoenix failure — so it must not trip the
-      // heal breaker). Preserve the audit chain (the original error plus the
-      // Phoenix issue/patch ids already stamped on `entry`) instead of dropping
-      // it, and degrade to the original provider error; the fallback chain is
-      // the next safety net. Still close the evidence loop: without a report
-      // the served attempt dangles `pending` until Phoenix's sweeper expires
-      // it, so the death is reported as a synthetic 499 (retry never completed
-      // — no provider status exists to send).
-      this.logger.warn(`autofix reforward failed, using original error: ${(err as Error).message}`);
-      entry.patch_worked = false;
-      this.reportOutcome(
-        healAttemptId,
-        {
-          retryStatusCode: 499,
-          error: {
-            message: `patched retry never completed: ${(err as Error).message}`,
-            type: 'retry_not_completed',
-          },
-        },
-        config.harness,
-      );
-      return {
-        forward: originalForward,
-        record: { groupId, outcome: 'unfixable', original_http_status: status, chain },
-      };
-    }
-    const ok = next.response.ok;
-    entry.patch_worked = ok;
-
-    if (ok) {
-      // Report the cleared retry so Phoenix can promote the patch.
-      this.reportOutcome(healAttemptId, { retryStatusCode: next.response.status }, config.harness);
-      chain.push({
-        attempt: 1,
-        origin: 'autofix',
-        request: healedBody,
-        http_status: next.response.status,
-      });
-      return {
-        forward: next,
-        record: { groupId, outcome: 'healed', original_http_status: status, chain },
-      };
-    }
-
-    // The patch didn't clear the error. Preserve that retry as its own provider
-    // attempt, report it to Phoenix, and continue with its rebuilt response so
-    // fallback and terminal recording see what actually happened last.
-    const retryText = await next.response.text();
-    const retryError = normalizeProviderError(retryText);
-    chain.push({
-      attempt: 1,
-      origin: 'autofix',
-      request: healedBody,
-      http_status: next.response.status,
-      error: retryError,
-    });
-    this.reportOutcome(
-      healAttemptId,
-      {
-        retryStatusCode: next.response.status,
-        error: retryError,
-      },
-      config.harness,
-    );
-    return {
-      forward: rebuildForward(next, retryText, next.response.status),
-      record: { groupId, outcome: 'exhausted', original_http_status: status, chain },
-    };
-  }
-
-  private async loadAgentConfig(agentId: string, tenantId: string): Promise<AgentAutofixConfig> {
-    // Autofix enablement is the consent boundary for sending request bodies to
-    // Phoenix. Read it from the database on every repairable failure so a toggle
-    // handled by one replica takes effect immediately on every other replica.
-    const key = `${tenantId}:${agentId}`;
-    const existing = this.configLoads.get(key);
-    // A request that arrives during an older read waits for the next generation.
-    // This prevents a post-toggle request from joining a query that began before
-    // the toggle, while all requests queued behind that query share one new read.
-    const minimumGeneration = existing ? existing.generation + 1 : 0;
-    return this.loadAgentConfigGeneration(agentId, tenantId, key, minimumGeneration);
-  }
-
-  private async loadAgentConfigGeneration(
-    agentId: string,
-    tenantId: string,
-    key: string,
-    minimumGeneration: number,
-  ): Promise<AgentAutofixConfig> {
-    const existing = this.configLoads.get(key);
-    if (existing) {
-      if (existing.generation >= minimumGeneration) return existing.promise;
-
-      // The caller arrived after this generation started. Wait for it to leave
-      // the slot, then create or join the next generation. Its result is ignored.
-      try {
-        await existing.promise;
-      } catch {
-        // A fresh generation below gets its own database result or error.
-      }
-      if (this.configLoads.get(key) === existing) this.configLoads.delete(key);
-      return this.loadAgentConfigGeneration(agentId, tenantId, key, minimumGeneration);
-    }
-
-    const promise = (async (): Promise<AgentAutofixConfig> => {
-      const agent = await this.agentRepo.findOne({
-        where: { id: agentId, tenant_id: tenantId },
-        // Select the PK alongside the flag. TypeORM's entity transformer treats a
-        // row whose only selected column is NULL as "no entity" and returns null,
-        // so `select: ['autofix_enabled']` alone makes every NULL-flag agent (the
-        // default "inherit the mode default" state) look not-found — which then
-        // resolves to `enabled: false` below and silently disables Autofix for it.
-        // The always-present `id` keeps the row materialized so the NULL flag is read.
-        select: ['id', 'autofix_enabled', 'agent_platform'],
-      });
-      // Unknown agent → off. Known agent → its explicit flag, or the mode default
-      // when unset (NULL).
-      return {
-        enabled: agent ? this.resolveEnabled(agent.autofix_enabled) : false,
-        harness: coerceAgentPlatform(agent?.agent_platform),
-      };
-    })();
-    const load = { generation: ++this.configLoadGeneration, promise };
-    this.configLoads.set(key, load);
-    try {
-      return await promise;
-    } finally {
-      if (this.configLoads.get(key) === load) this.configLoads.delete(key);
-    }
-  }
-
-  /** Fire-and-forget the learning signal so it never delays the client. */
-  private reportOutcome(healAttemptId: string, outcome: HealOutcome, harness: AgentPlatform): void {
-    void this.deliverOutcome(healAttemptId, outcome, harness);
-  }
-
-  /**
-   * Deliver the outcome report, resending when it didn't land. The client
-   * resolves `null` for a report that never reached Phoenix (transport failure
-   * or a non-2xx), and an unreported attempt costs the adjudication evidence —
-   * Phoenix can only expire it. Spaced resends ride out a blip; only a process
-   * death still loses a report.
-   */
-  private async deliverOutcome(
-    healAttemptId: string,
-    outcome: HealOutcome,
-    harness: AgentPlatform,
-  ): Promise<void> {
-    for (let send = 0; ; send++) {
-      try {
-        if ((await this.client.reportOutcome(healAttemptId, outcome, { harness })) !== null) return;
-      } catch (err) {
-        this.logger.warn(`reportOutcome ${healAttemptId} failed: ${(err as Error).message}`);
-      }
-      const delay = OUTCOME_RESEND_DELAYS_MS[send];
-      if (delay === undefined) {
-        this.logger.warn(`reportOutcome ${healAttemptId}: giving up after ${send + 1} sends`);
-        return;
-      }
-      await new Promise((resolve) => setTimeout(resolve, delay));
-    }
-  }
-}
diff --git a/packages/backend/src/routing/autofix/autofix.types.ts b/packages/backend/src/routing/autofix/autofix.types.ts
deleted file mode 100644
index 69f130f6..00000000
--- a/packages/backend/src/routing/autofix/autofix.types.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-import type {
-  PhoenixExplanation,
-  PhoenixHealStatus,
-  PhoenixOperation,
-  PhoenixProviderError,
-} from './phoenix.types';
-
-/**
- * How an Autofix attempt ended:
- * - `healed`     — a patched request eventually succeeded.
- * - `unfixable`  — Phoenix had no patch (`no_patch`) or returned an empty one.
- * - `resolving`  — Phoenix is still authoring a patch (novel error); nothing to
- *                  resend this time. A later request for the same issue may heal.
- * - `exhausted`  — a patched retry failed, or the healing flow aborted before
- *                  it could complete. Inspect `chain` to tell whether a retry
- *                  was actually sent.
- */
-export type AutofixOutcome = 'healed' | 'unfixable' | 'resolving' | 'exhausted';
-
-/**
- * One request actually sent to the provider during healing, in order. Entry 0
- * (`origin: 'original'`) is the agent's own request; later `autofix` entries are
- * the bodies Phoenix produced. The heal decision fields (`issue_id` … ) describe
- * what Phoenix said about THIS entry's failure; `patch_worked` says whether the
- * patch derived here produced a working request.
- */
-export interface AutofixChainEntry {
-  attempt: number;
-  origin: 'original' | 'autofix';
-  request: Record<string, unknown>;
-  http_status: number;
-  /** Absent on the terminal success entry. */
-  error?: PhoenixProviderError;
-  phoenix_status?: PhoenixHealStatus;
-  issue_id?: string;
-  patch_id?: string | null;
-  heal_attempt_id?: string | null;
-  operations?: PhoenixOperation[] | null;
-  /** Phoenix's human-readable "why" for the fix derived here (null when none). */
-  explanation?: PhoenixExplanation | null;
-  patch_worked?: boolean;
-}
-
-/**
- * The full Autofix story. An `autofix` chain entry exists if and only if a
- * patched request was actually sent to the provider. The recorder uses that
- * invariant—not Phoenix consultation alone—to decide whether Autofix was
- * applied. When a retry exists, the failed original and retry are recorded as
- * linked `agent_messages` rows sharing `groupId`.
- */
-export interface AutofixRecord {
-  /** Shared id linking the failed-original and retry rows, when a retry exists. */
-  groupId: string;
-  outcome: AutofixOutcome;
-  original_http_status: number;
-  chain: AutofixChainEntry[];
-}
-
-/** The patched provider attempt, when Manifest actually sent one. */
-export function getAutofixRetry(autofix: AutofixRecord | undefined): AutofixChainEntry | undefined {
-  return autofix?.chain.find((entry) => entry.origin === 'autofix');
-}
diff --git a/packages/backend/src/routing/autofix/contract/phoenix-openapi.yaml b/packages/backend/src/routing/autofix/contract/phoenix-openapi.yaml
deleted file mode 100644
index b444307e..00000000
--- a/packages/backend/src/routing/autofix/contract/phoenix-openapi.yaml
+++ /dev/null
@@ -1,714 +0,0 @@
-openapi: 3.1.0
-info:
-  title: Phoenix MVP — request-healing API
-  version: 0.0.1
-  description: >
-    Advisory request-healing for LLM providers. Submit a failed request plus the
-    provider error to get a corrected request body, then report whether the retry
-    worked. See README.md for the full loop and data model.
-servers:
-  - url: http://127.0.0.1:3000
-    description: Local development
-  - url: https://your-app.up.railway.app
-    description: Production — set to your Railway deployment URL
-
-security:
-  - ApiKeyAuth: []
-
-paths:
-  /api/heal:
-    post:
-      summary: Resolve a patch for a failed request
-      security:
-        - ApiKeyAuth: []
-        - ManifestInstanceAuth: []
-      parameters:
-        - $ref: '#/components/parameters/ManifestVersion'
-        - $ref: '#/components/parameters/ManifestHarness'
-      description: >
-        Fingerprints the error and returns a healed request body if a
-        deterministic patch exists. Only request-side errors are healable.
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/HealRequest'
-      responses:
-        '200':
-          description: A heal decision (patched, pending confirmation, still resolving, or no patch).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/HealResult'
-        '400':
-          description: Malformed body (failed schema validation).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ZodError'
-        '401':
-          description: Missing or invalid API key (when API_KEY is enforced).
-        '422':
-          description: Error is not request-side (5xx / auth / rate-limit); nothing to heal.
-
-  /api/heal/observe:
-    post:
-      summary: Record failed requests as diagnostic evidence
-      security:
-        - ApiKeyAuth: []
-        - ManifestInstanceAuth: []
-      parameters:
-        - $ref: '#/components/parameters/ManifestVersion'
-        - $ref: '#/components/parameters/ManifestHarness'
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/ObservationBatch'
-      responses:
-        '200':
-          description: Observation batch accepted.
-        '401':
-          description: Missing or invalid static key or instance credential.
-
-  /api/heal-attempts/{id}:
-    parameters:
-      - $ref: '#/components/parameters/Id'
-    get:
-      summary: Read a heal attempt and its parent issue
-      responses:
-        '200':
-          description: The heal attempt.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/HealAttemptView'
-        '401':
-          description: Missing or invalid API key (when API_KEY is enforced).
-        '404':
-          description: Unknown or non-UUID id.
-    patch:
-      summary: Report the outcome of a retried request
-      security:
-        - ApiKeyAuth: []
-        - ManifestInstanceAuth: []
-      parameters:
-        - $ref: '#/components/parameters/ManifestVersion'
-        - $ref: '#/components/parameters/ManifestHarness'
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/HealOutcome'
-      responses:
-        '200':
-          description: Recorded outcome (idempotent).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/OutcomeResult'
-        '400':
-          description: Malformed body, or error omitted when retryStatusCode >= 400.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ZodError'
-        '401':
-          description: Missing or invalid API key (when API_KEY is enforced).
-        '404':
-          description: No such heal attempt.
-
-  /api/issues/{id}:
-    parameters:
-      - $ref: '#/components/parameters/Id'
-    get:
-      summary: Read an issue and its resolved patch
-      responses:
-        '200':
-          description: The issue.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/IssueView'
-        '401':
-          description: Missing or invalid API key (when API_KEY is enforced).
-        '404':
-          description: Unknown or non-UUID id.
-
-  /api/issues:
-    get:
-      summary: List issues (most-recently-updated first)
-      parameters:
-        - name: patchId
-          in: query
-          schema: { type: string, format: uuid }
-          description: Only issues fixed by this patch.
-        - $ref: '#/components/parameters/Limit'
-        - $ref: '#/components/parameters/Offset'
-      responses:
-        '200':
-          description: Issues.
-          content:
-            application/json:
-              schema:
-                type: array
-                items: { $ref: '#/components/schemas/IssueListItem' }
-        '400':
-          description: Malformed query.
-        '401':
-          description: Missing or invalid API key (when API_KEY is enforced).
-
-  /api/heal-attempts:
-    get:
-      summary: List heal attempts (most-recent first)
-      parameters:
-        - name: issueId
-          in: query
-          schema: { type: string, format: uuid }
-        - name: patchId
-          in: query
-          schema: { type: string, format: uuid }
-        - name: traceId
-          in: query
-          schema: { type: string }
-        - $ref: '#/components/parameters/Limit'
-        - $ref: '#/components/parameters/Offset'
-      responses:
-        '200':
-          description: Heal attempts.
-          content:
-            application/json:
-              schema:
-                type: array
-                items: { $ref: '#/components/schemas/AttemptListItem' }
-        '400':
-          description: Malformed query.
-        '401':
-          description: Missing or invalid API key (when API_KEY is enforced).
-
-  /api/patches:
-    get:
-      summary: List patches with usage counts (most-recent first)
-      parameters:
-        - $ref: '#/components/parameters/Limit'
-        - $ref: '#/components/parameters/Offset'
-      responses:
-        '200':
-          description: Patches.
-          content:
-            application/json:
-              schema:
-                type: array
-                items: { $ref: '#/components/schemas/PatchListItem' }
-        '401':
-          description: Missing or invalid API key (when API_KEY is enforced).
-
-  /api/patches/{id}:
-    parameters:
-      - $ref: '#/components/parameters/Id'
-    get:
-      summary: Read a patch and the issues it fixes
-      responses:
-        '200':
-          description: The patch.
-          content:
-            application/json:
-              schema: { $ref: '#/components/schemas/PatchDetail' }
-        '401':
-          description: Missing or invalid API key (when API_KEY is enforced).
-        '404':
-          description: Unknown or non-UUID id.
-
-  /api/traces:
-    get:
-      summary: List traces with per-trace outcome counts (most-recent first)
-      parameters:
-        - $ref: '#/components/parameters/Limit'
-        - $ref: '#/components/parameters/Offset'
-      responses:
-        '200':
-          description: Traces.
-          content:
-            application/json:
-              schema:
-                type: array
-                items: { $ref: '#/components/schemas/TraceListItem' }
-        '401':
-          description: Missing or invalid API key (when API_KEY is enforced).
-
-  /api/traces/{traceId}:
-    parameters:
-      - name: traceId
-        in: path
-        required: true
-        schema: { type: string }
-    get:
-      summary: A trace's heal attempts, oldest-first
-      responses:
-        '200':
-          description: The trace timeline.
-          content:
-            application/json:
-              schema: { $ref: '#/components/schemas/TraceDetail' }
-        '401':
-          description: Missing or invalid API key (when API_KEY is enforced).
-        '404':
-          description: No such trace.
-
-  /api/health:
-    get:
-      summary: Liveness probe (public — no API key)
-      security: []
-      responses:
-        '200':
-          description: Process is up.
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  status: { type: string, example: ok }
-                  uptimeSeconds: { type: integer }
-
-  /api/ready:
-    get:
-      summary: Readiness probe — process up and database reachable (public)
-      security: []
-      responses:
-        '200':
-          description: Ready.
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  status: { type: string, example: ready }
-        '503':
-          description: Database not ready.
-
-components:
-  securitySchemes:
-    ApiKeyAuth:
-      type: apiKey
-      in: header
-      name: x-api-key
-      description: >
-        Static API key. Send as `x-api-key: <key>` (an `Authorization: Bearer
-        <key>` header is also accepted). Enforced in deployed environments where
-        the API_KEY env var is set; disabled locally when it is unset.
-    ManifestInstanceAuth:
-      type: apiKey
-      in: header
-      name: X-Manifest-Instance
-      description: >
-        Anonymous install identifier announced by a self-hosted Manifest. This
-        is an identifier, not a credential: it is not secret and no registration
-        handshake issues it. Phoenix creates the instance row the first time it
-        sees an id. Accepted in place of ApiKeyAuth on the gateway write
-        operations.
-
-  parameters:
-    Id:
-      name: id
-      in: path
-      required: true
-      schema:
-        type: string
-        format: uuid
-    Limit:
-      name: limit
-      in: query
-      description: Page size (default 50, max 200).
-      schema: { type: integer, minimum: 1, maximum: 200, default: 50 }
-    Offset:
-      name: offset
-      in: query
-      description: Rows to skip for pagination.
-      schema: { type: integer, minimum: 0, default: 0 }
-    ManifestVersion:
-      name: X-Manifest-Version
-      in: header
-      required: false
-      description: Running Manifest release version. Invalid values become `unknown` in analytics.
-      schema:
-        type: string
-        maxLength: 32
-        pattern: '^[0-9]+\.[0-9]+\.[0-9]+'
-    ManifestHarness:
-      name: X-Manifest-Harness
-      in: header
-      required: false
-      description: Agent platform slug. Missing or unknown values become `other` in analytics.
-      schema:
-        type: string
-        enum:
-          [
-            openclaw,
-            hermes,
-            nanobot,
-            craft,
-            n8n,
-            claude-code,
-            opencode,
-            codex,
-            openai-sdk,
-            anthropic-sdk,
-            vercel-ai-sdk,
-            langchain,
-            curl,
-            other,
-          ]
-  schemas:
-    InstanceRegistration:
-      type: object
-      required: [version, schema_version]
-      properties:
-        version:
-          type: string
-          maxLength: 32
-          pattern: '^[0-9]+\.[0-9]+\.[0-9]+'
-        schema_version:
-          type: integer
-          const: 1
-      additionalProperties: true
-
-    InstanceCredential:
-      type: object
-      required: [instance_id, secret]
-      properties:
-        instance_id: { type: string, format: uuid }
-        secret:
-          type: string
-          description: Opaque 256-bit base64url bearer token. Returned only once.
-      additionalProperties: false
-
-    ObservationBatch:
-      type: object
-      required: [observations]
-      properties:
-        observations:
-          type: array
-          minItems: 1
-          maxItems: 200
-          items: { $ref: '#/components/schemas/HealRequest' }
-
-    ProviderError:
-      type: object
-      required: [message]
-      properties:
-        message: { type: string }
-        type: { type: [string, 'null'] }
-        param: { type: [string, 'null'] }
-        code: { type: [string, 'null'] }
-
-    Operation:
-      type: object
-      description: A deterministic transform applied to the request body.
-      required: [type]
-      properties:
-        type: { type: string }
-      additionalProperties: true
-      example: { type: rename_param, from: max_tokens, to: max_output_tokens }
-
-    HealRequest:
-      type: object
-      required: [traceId, provider, api, request, response]
-      properties:
-        traceId:
-          type: string
-          minLength: 1
-          description: >
-            Caller-supplied id of the logical request being healed. Send the
-            same value on every heal of that request's retry chain (not the
-            provider's per-call request id) — it groups the attempts into one
-            trace.
-        tenantId:
-          type: string
-          minLength: 1
-          description: >
-            Opaque id of the gateway tenant this request belongs to (Manifest's
-            Tenant.id). Optional on the wire; recorded so a failure can be
-            attributed to a tenant. Manifest always sends it on the proxy path.
-        provider: { type: string, minLength: 1, example: openai }
-        model:
-          type: string
-          minLength: 1
-          maxLength: 1024
-          description: >
-            Logical provider model identity. Native transports may encode it in
-            the URL rather than in the JSON request body.
-        authType:
-          type: string
-          enum: [api_key, subscription, local]
-          description: Provider credential route. Optional during the Manifest rollout.
-        api:
-          type: string
-          enum: [responses, chat_completions, messages]
-        url: { type: string, format: uri }
-        request:
-          type: object
-          description: The original outgoing request body, verbatim.
-          additionalProperties: true
-        response:
-          type: object
-          required: [statusCode, error]
-          properties:
-            statusCode: { type: integer, example: 400 }
-            error: { $ref: '#/components/schemas/ProviderError' }
-        providerExchange:
-          type: object
-          description: Final provider-native transport exchange, separate from the patch input.
-          required: [format, request, response]
-          properties:
-            format:
-              type: string
-              enum:
-                - openai_chat_completions
-                - openai_responses
-                - anthropic_messages
-                - google_generate_content
-                - google_code_assist
-            url: { type: string, format: uri }
-            request:
-              type: object
-              required: [body]
-              properties:
-                body: { type: object, additionalProperties: true }
-                redactedFields: { type: array, items: { type: string } }
-            response:
-              type: object
-              required: [statusCode, body]
-              properties:
-                statusCode: { type: integer }
-                body: {}
-        responseTimeMs: { type: integer, minimum: 0 }
-        responseSizeBytes: { type: integer, minimum: 0 }
-
-    HealResult:
-      type: object
-      required: [status, issueId]
-      properties:
-        status:
-          type: string
-          enum: [patched, unverified, resolving, no_patch]
-        issueId: { type: string, format: uuid }
-        patchId: { type: string, format: uuid }
-        healAttemptId: { type: string, format: uuid }
-        operations:
-          type: array
-          items: { $ref: '#/components/schemas/Operation' }
-        healedBody:
-          type: object
-          additionalProperties: true
-        explanation:
-          type: object
-          description: >
-            Human-readable "why" for a served heal (present on "patched" /
-            "unverified"). operations[].detail is always deterministic (built from
-            the operations); summary prefers an authored rationale (source "agent" /
-            "operator") and falls back to the deterministic composition (source
-            "deterministic").
-          required: [summary, operations, source]
-          properties:
-            summary: { type: string }
-            operations:
-              type: array
-              items:
-                type: object
-                required: [type, detail]
-                properties:
-                  type: { type: string }
-                  detail: { type: string }
-            source:
-              type: string
-              enum: [deterministic, agent, operator]
-        retryAfterMs:
-          type: integer
-          description: Present only when status is "resolving".
-
-    HealOutcome:
-      type: object
-      required: [retryStatusCode]
-      description: error is required when retryStatusCode >= 400.
-      properties:
-        retryStatusCode: { type: integer, example: 200 }
-        error: { $ref: '#/components/schemas/ProviderError' }
-
-    OutcomeResult:
-      type: object
-      required: [healAttemptId, status, issueStatus]
-      properties:
-        healAttemptId: { type: string, format: uuid }
-        status:
-          type: string
-          enum: [succeeded, failed, expired]
-        issueStatus: { type: string }
-
-    IssueView:
-      type: object
-      properties:
-        id: { type: string, format: uuid }
-        fingerprint: { type: string }
-        provider: { type: string }
-        api: { type: string }
-        model: { type: [string, 'null'] }
-        error:
-          type: object
-          properties:
-            code: { type: [string, 'null'] }
-            type: { type: [string, 'null'] }
-            param: { type: [string, 'null'] }
-        status:
-          type: string
-          enum: [resolving, unverified, verified, ineffective, no_fix_found]
-        occurrenceCount: { type: integer }
-        createdAt: { type: string, format: date-time }
-        updatedAt: { type: string, format: date-time }
-        patch:
-          type: [object, 'null']
-          properties:
-            id: { type: string, format: uuid }
-            operations:
-              type: array
-              items: { $ref: '#/components/schemas/Operation' }
-
-    HealAttemptView:
-      type: object
-      properties:
-        id: { type: string, format: uuid }
-        issueId: { type: string, format: uuid }
-        patchId: { type: string, format: uuid }
-        traceId: { type: string }
-        status:
-          type: string
-          enum: [pending, succeeded, failed, expired]
-        retryStatusCode: { type: [integer, 'null'] }
-        retryErrorFingerprint: { type: [string, 'null'] }
-        confirmedAt: { type: [string, 'null'], format: date-time }
-        createdAt: { type: string, format: date-time }
-        updatedAt: { type: string, format: date-time }
-        issue:
-          type: [object, 'null']
-          properties:
-            id: { type: string, format: uuid }
-            status: { type: string }
-            provider: { type: string }
-            api: { type: string }
-            model: { type: [string, 'null'] }
-            fingerprint: { type: string }
-
-    IssueListItem:
-      type: object
-      properties:
-        id: { type: string, format: uuid }
-        fingerprint: { type: string }
-        provider: { type: string }
-        api: { type: string }
-        model: { type: [string, 'null'] }
-        errorCode: { type: [string, 'null'] }
-        errorType: { type: [string, 'null'] }
-        errorParam: { type: [string, 'null'] }
-        status:
-          type: string
-          enum: [resolving, unverified, verified, ineffective, no_fix_found]
-        patchId: { type: [string, 'null'], format: uuid }
-        occurrenceCount: { type: integer }
-        createdAt: { type: string, format: date-time }
-        updatedAt: { type: string, format: date-time }
-
-    AttemptListItem:
-      type: object
-      properties:
-        id: { type: string, format: uuid }
-        issueId: { type: string, format: uuid }
-        patchId: { type: string, format: uuid }
-        traceId: { type: string }
-        status:
-          type: string
-          enum: [pending, succeeded, failed, expired]
-        retryStatusCode: { type: [integer, 'null'] }
-        retryErrorFingerprint: { type: [string, 'null'] }
-        confirmedAt: { type: [string, 'null'], format: date-time }
-        createdAt: { type: string, format: date-time }
-        updatedAt: { type: string, format: date-time }
-
-    PatchListItem:
-      type: object
-      properties:
-        id: { type: string, format: uuid }
-        operations:
-          type: array
-          items: { $ref: '#/components/schemas/Operation' }
-        operationsHash: { type: string }
-        issueCount: { type: integer }
-        attemptCount: { type: integer }
-        createdAt: { type: string, format: date-time }
-        updatedAt: { type: string, format: date-time }
-
-    PatchDetail:
-      allOf:
-        - $ref: '#/components/schemas/PatchListItem'
-        - type: object
-          properties:
-            issues:
-              type: array
-              items: { $ref: '#/components/schemas/IssueListItem' }
-
-    TraceListItem:
-      type: object
-      properties:
-        traceId: { type: string }
-        attemptCount: { type: integer }
-        pendingCount: { type: integer }
-        succeededCount: { type: integer }
-        failedCount: { type: integer }
-        firstAt: { type: string, format: date-time }
-        lastAt: { type: string, format: date-time }
-
-    TraceAttempt:
-      allOf:
-        - $ref: '#/components/schemas/AttemptListItem'
-        - type: object
-          properties:
-            issue:
-              type: object
-              properties:
-                id: { type: string, format: uuid }
-                status: { type: string }
-                provider: { type: string }
-                api: { type: string }
-                model: { type: [string, 'null'] }
-                errorCode: { type: [string, 'null'] }
-                errorType: { type: [string, 'null'] }
-                errorParam: { type: [string, 'null'] }
-            patch:
-              type: object
-              properties:
-                id: { type: string, format: uuid }
-                operations:
-                  type: array
-                  items: { $ref: '#/components/schemas/Operation' }
-
-    TraceDetail:
-      type: object
-      properties:
-        traceId: { type: string }
-        attempts:
-          type: array
-          items: { $ref: '#/components/schemas/TraceAttempt' }
-
-    ZodError:
-      type: object
-      description: Flattened zod validation error.
-      properties:
-        formErrors:
-          type: array
-          items: { type: string }
-        fieldErrors:
-          type: object
-          additionalProperties:
-            type: array
-            items: { type: string }
diff --git a/packages/backend/src/routing/autofix/healing-client.ts b/packages/backend/src/routing/autofix/healing-client.ts
deleted file mode 100644
index 8bf09cb1..00000000
--- a/packages/backend/src/routing/autofix/healing-client.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-import type { ConfirmResponse, HealOutcome, HealRequest, HealResponse } from './phoenix.types';
-import type { AgentPlatform } from 'manifest-shared';
-
-/** Per-agent metadata sent as bounded headers on authenticated Autofix calls. */
-export interface HealingRequestContext {
-  harness: AgentPlatform;
-}
-
-/**
- * Port to the Phoenix healing service. The proxy loop depends only on this
- * interface; the concrete client (mock vs HTTP) is chosen at module wiring time
- * by `NODE_ENV`. Keeping this seam stable means swapping in the real
- * service — or a future contract revision — never touches the loop.
- */
-export interface HealingClient {
-  /** Submit a failed request + provider error; get a heal decision back. */
-  heal(input: HealRequest, context: HealingRequestContext): Promise<HealResponse>;
-  /**
-   * Report the post-retry outcome of an applied patch (Phoenix's learning loop).
-   * Phoenix decides succeeded/failed from the retry status + error. Best-effort:
-   * returns null on transport failure rather than throwing, so a missed report
-   * never breaks the user's request.
-   */
-  reportOutcome(
-    healAttemptId: string,
-    outcome: HealOutcome,
-    context: HealingRequestContext,
-  ): Promise<ConfirmResponse | null>;
-  /**
-   * Bulk-report failed requests as evidence, without asking for a fix. Phoenix
-   * fingerprints each into an issue and stores the body; nothing is served back
-   * and no heal attempt is created. Best-effort like {@link reportOutcome}: never
-   * throws, so a healer outage costs evidence rather than a request.
-   */
-  observe(observations: HealRequest[], context: HealingRequestContext): Promise<void>;
-}
-
-/** DI token for the active HealingClient implementation. */
-export const HEALING_CLIENT = Symbol('HEALING_CLIENT');
-
-/**
- * Thrown by a HealingClient when the healer is REACHABLE but rejected the heal
- * request with a 4xx — a contract mismatch, a malformed payload, or a missing/
- * invalid API key. It is deliberately distinct from a transport failure (timeout,
- * unreachable, 5xx): the service treats a contract error as a bug to surface, not
- * an outage, so it never trips the circuit breaker (shedding heal calls would
- * only hide the real problem). Carries the HTTP status for logging.
- */
-export class HealContractError extends Error {
-  constructor(
-    readonly status: number,
-    message: string,
-  ) {
-    super(message);
-    this.name = 'HealContractError';
-  }
-}
diff --git a/packages/backend/src/routing/autofix/http-healing-client.ts b/packages/backend/src/routing/autofix/http-healing-client.ts
deleted file mode 100644
index f7eb3b37..00000000
--- a/packages/backend/src/routing/autofix/http-healing-client.ts
+++ /dev/null
@@ -1,153 +0,0 @@
-import { Logger } from '@nestjs/common';
-import {
-  HealContractError,
-  type HealingClient,
-  type HealingRequestContext,
-} from './healing-client';
-import type { ConfirmResponse, HealOutcome, HealRequest, HealResponse } from './phoenix.types';
-
-/** Resolves the install identity self-hosted calls announce to Phoenix. */
-export type InstanceIdProvider = () => Promise<string>;
-
-/**
- * HTTP client for Phoenix. Static API keys retain the cloud path unchanged.
- * Self-hosted clients announce the install's anonymous id on every call.
- *
- * The id is the *identifier* Phoenix keys an install's history on, not a
- * credential: it is not secret, and Phoenix creates the instance row the first
- * time it sees one. There is deliberately no registration handshake — it would
- * only have carried `version`, which already rides on every request as
- * `X-Manifest-Version`.
- */
-export class HttpHealingClient implements HealingClient {
-  private readonly logger = new Logger(HttpHealingClient.name);
-  private readonly baseUrl: string;
-
-  constructor(
-    baseUrl: string,
-    private readonly timeoutMs: number,
-    private readonly apiKey?: string,
-    private readonly instanceId?: InstanceIdProvider,
-    private readonly manifestVersion?: string,
-  ) {
-    this.baseUrl = baseUrl.trim().replace(/\/+$/, '');
-  }
-
-  async heal(input: HealRequest, context: HealingRequestContext): Promise<HealResponse> {
-    const res = await this.authenticatedFetch(
-      '/api/heal',
-      {
-        method: 'POST',
-        body: JSON.stringify(input),
-      },
-      context,
-    );
-    if (!res.ok) {
-      // Release the connection: an unconsumed error body keeps the socket
-      // reserved in undici, which under a burst of 4xx/5xx replies would leak
-      // connections instead of letting them return to the pool.
-      await res.body?.cancel();
-      const message = `Phoenix /api/heal responded ${res.status}`;
-      if (res.status >= 400 && res.status < 500) {
-        throw new HealContractError(res.status, message);
-      }
-      throw new Error(message);
-    }
-    return (await res.json()) as HealResponse;
-  }
-
-  async observe(observations: HealRequest[], context: HealingRequestContext): Promise<void> {
-    if (observations.length === 0) return;
-    try {
-      const res = await this.authenticatedFetch(
-        '/api/heal/observe',
-        {
-          method: 'POST',
-          body: JSON.stringify({ observations }),
-        },
-        context,
-      );
-      await res.body?.cancel();
-      if (!res.ok) {
-        this.logger.warn(`Phoenix /api/heal/observe responded ${res.status}`);
-      }
-    } catch (err) {
-      this.logger.warn(`Phoenix /api/heal/observe failed: ${(err as Error).message}`);
-    }
-  }
-
-  async reportOutcome(
-    healAttemptId: string,
-    outcome: HealOutcome,
-    context: HealingRequestContext,
-  ): Promise<ConfirmResponse | null> {
-    try {
-      const path = `/api/heal-attempts/${encodeURIComponent(healAttemptId)}`;
-      const res = await this.authenticatedFetch(
-        path,
-        {
-          method: 'PATCH',
-          body: JSON.stringify(outcome),
-        },
-        context,
-      );
-      if (!res.ok) {
-        await res.body?.cancel();
-        this.logger.warn(`Phoenix heal-attempt ${healAttemptId} responded ${res.status}`);
-        return null;
-      }
-      return (await res.json()) as ConfirmResponse;
-    } catch (err) {
-      this.logger.warn(`Phoenix heal-attempt ${healAttemptId} failed: ${(err as Error).message}`);
-      return null;
-    }
-  }
-
-  private async authenticatedFetch(
-    path: string,
-    init: Omit<RequestInit, 'headers' | 'signal'>,
-    context?: HealingRequestContext,
-  ): Promise<Response> {
-    if (this.apiKey) {
-      return this.request(path, init, {
-        'content-type': 'application/json',
-        'x-api-key': this.apiKey,
-        'X-Manifest-Version': this.manifestVersion ?? 'unknown',
-      });
-    }
-    if (!this.instanceId) {
-      return this.request(path, init, { 'content-type': 'application/json' });
-    }
-    // Typed callers always supply this; the guard only catches an untyped JS
-    // caller, since a missing harness would otherwise reach Phoenix as
-    // `undefined` and fail the header allowlist with a confusing 400.
-    if (!context) {
-      throw new Error('Autofix harness is required for instance-identified requests');
-    }
-    return this.request(path, init, this.instanceHeaders(await this.instanceId(), context));
-  }
-
-  private request(
-    path: string,
-    init: Omit<RequestInit, 'headers' | 'signal'>,
-    headers: Record<string, string>,
-  ): Promise<Response> {
-    return fetch(`${this.baseUrl}${path}`, {
-      ...init,
-      headers,
-      signal: AbortSignal.timeout(this.timeoutMs),
-    });
-  }
-
-  private instanceHeaders(
-    instanceId: string,
-    context: HealingRequestContext,
-  ): Record<string, string> {
-    return {
-      'content-type': 'application/json',
-      'X-Manifest-Instance': instanceId,
-      'X-Manifest-Version': this.manifestVersion ?? 'unknown',
-      'X-Manifest-Harness': context.harness,
-    };
-  }
-}
diff --git a/packages/backend/src/routing/autofix/mock-healing-client.ts b/packages/backend/src/routing/autofix/mock-healing-client.ts
deleted file mode 100644
index 3226c212..00000000
--- a/packages/backend/src/routing/autofix/mock-healing-client.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { v4 as uuid } from 'uuid';
-import type { HealingClient, HealingRequestContext } from './healing-client';
-import type { ConfirmResponse, HealOutcome, HealRequest, HealResponse } from './phoenix.types';
-
-/**
- * Deterministic in-process stand-in for Phoenix, used outside production so a
- * local run never posts real failures at the hosted healer and a test never
- * depends on the network. It implements the MVP #1 case end-to-end — an unknown-parameter 4xx
- * whose `param` has a known rename (e.g. the Responses API rejecting
- * `max_tokens`) is patched into `max_output_tokens` via a `rename_param`
- * operation. Everything else returns `no_patch`. Lets the whole heal → resend →
- * confirm loop be exercised without the external service.
- */
-export const MOCK_RENAME_CATALOG: Record<string, string> = {
-  max_tokens: 'max_output_tokens',
-};
-
-@Injectable()
-export class MockHealingClient implements HealingClient {
-  private readonly logger = new Logger(MockHealingClient.name);
-
-  heal(input: HealRequest, _context: HealingRequestContext): Promise<HealResponse> {
-    const issueId = uuid();
-    const { code, param } = input.response.error;
-    // `param` comes from an untrusted provider error. Use own-property checks so a
-    // prototype name (`toString`, `constructor`, …) can't resolve to an inherited
-    // member of the catalog or the request and trigger a bogus rename.
-    const rename =
-      param && Object.hasOwn(MOCK_RENAME_CATALOG, param) ? MOCK_RENAME_CATALOG[param] : undefined;
-
-    if (code === 'unknown_parameter' && param && rename && Object.hasOwn(input.request, param)) {
-      const healedBody: Record<string, unknown> = { ...input.request };
-      healedBody[rename] = healedBody[param];
-      delete healedBody[param];
-      this.logger.debug(`mock heal: rename_param ${param} -> ${rename}`);
-      // A freshly served patch is `unverified` in Phoenix (only an already-verified
-      // issue answers `patched`); the mock is stateless, so it always serves unverified.
-      return Promise.resolve({
-        status: 'unverified',
-        issueId,
-        patchId: uuid(),
-        healAttemptId: uuid(),
-        operations: [{ type: 'rename_param', from: param, to: rename }],
-        healedBody,
-      });
-    }
-
-    return Promise.resolve({ status: 'no_patch', issueId });
-  }
-
-  observe(observations: HealRequest[], _context: HealingRequestContext): Promise<void> {
-    this.logger.log(`mock observe: ${observations.length} observation(s) discarded`);
-    return Promise.resolve();
-  }
-
-  reportOutcome(
-    healAttemptId: string,
-    outcome: HealOutcome,
-    _context: HealingRequestContext,
-  ): Promise<ConfirmResponse | null> {
-    // Phoenix decides from the retry outcome: a cleared target (2xx or a
-    // different error) succeeds; the same error recurring fails. The mock has no
-    // memory of the original error, so it treats any non-4xx retry as success.
-    const succeeded = outcome.retryStatusCode < 400;
-    return Promise.resolve({
-      healAttemptId,
-      status: succeeded ? 'succeeded' : 'failed',
-      // Reporting an outcome is evidence-only in Phoenix — it never moves the
-      // issue's status — so a served patch stays `unverified` either way.
-      issueStatus: 'unverified',
-    });
-  }
-}
diff --git a/packages/backend/src/routing/autofix/observation-payload.spec.ts b/packages/backend/src/routing/autofix/observation-payload.spec.ts
deleted file mode 100644
index 49b1abfe..00000000
--- a/packages/backend/src/routing/autofix/observation-payload.spec.ts
+++ /dev/null
@@ -1,299 +0,0 @@
-import {
-  MAX_BODY_BYTES,
-  isReportableStatus,
-  scrubBody,
-  scrubProviderUrl,
-  toObservation,
-  type ObservationInput,
-} from './observation-payload';
-
-const baseInput: ObservationInput = {
-  traceId: 'trace-1',
-  tenantId: 'tenant-1',
-  agentId: 'agent-1',
-  provider: 'openai',
-  model: 'gpt-5.1',
-  authType: 'api_key',
-  apiMode: 'chat_completions',
-  requestBody: { model: 'gpt-5.1', temperature: 5, messages: [{ role: 'user', content: 'hi' }] },
-  status: 400,
-  errorBody: JSON.stringify({ error: { message: 'temperature must be <= 2', code: 'bad_param' } }),
-};
-
-describe('isReportableStatus', () => {
-  it.each([400, 404, 413, 422])('reports request-side %i', (status) => {
-    expect(isReportableStatus(status)).toBe(true);
-  });
-
-  it.each([401, 402, 403, 429])('skips credential/quota/throttle %i', (status) => {
-    expect(isReportableStatus(status)).toBe(false);
-  });
-
-  it.each([200, 302, 500, 503])('skips non-4xx %i', (status) => {
-    expect(isReportableStatus(status)).toBe(false);
-  });
-});
-
-describe('scrubBody', () => {
-  it('keeps an ordinary body intact', () => {
-    const body = { model: 'gpt-5.1', temperature: 5 };
-    expect(scrubBody(body)).toEqual(body);
-  });
-
-  it('redacts a provider key pasted into message content', () => {
-    const scrubbed = scrubBody({
-      messages: [{ role: 'user', content: 'use sk-ant-abcdefghijklmno please' }],
-    });
-    expect(JSON.stringify(scrubbed)).not.toContain('sk-ant-abcdefghijklmno');
-    expect(JSON.stringify(scrubbed)).toContain('[REDACTED]');
-  });
-
-  it('redacts an authorization header echoed into the body', () => {
-    const scrubbed = scrubBody({ headers: { authorization: 'Bearer supersecrettoken123' } });
-    expect(JSON.stringify(scrubbed)).not.toContain('supersecrettoken123');
-  });
-
-  it('redacts a credential key whatever its value type', () => {
-    expect(scrubBody({ authorization: 123 })).toEqual({ authorization: '[REDACTED]' });
-    expect(scrubBody({ headers: { 'X-Api-Key': { nested: 'k' } } })).toEqual({
-      headers: { 'X-Api-Key': '[REDACTED]' },
-    });
-  });
-
-  it.each([
-    'api_key',
-    'apiKey',
-    'X-API-KEY',
-    'clientSecret',
-    'accessToken',
-    'refresh_token',
-    'client.secret',
-    'access.token',
-    'api key',
-  ])('redacts the opaque credential field %s', (key) => {
-    expect(scrubBody({ [key]: 'opaquevalue1234' })).toEqual({ [key]: '[REDACTED]' });
-  });
-
-  it('scrubs a secret used as a property name', () => {
-    const scrubbed = scrubBody({ 'sk-ant-abcdefghijklmno': 'v' });
-    expect(Object.keys(scrubbed!)).toEqual(['[REDACTED]']);
-  });
-
-  it('redacts a header-shaped secret quoted inside message content', () => {
-    // Serializing first would escape these quotes and defeat the header pattern,
-    // so the body is walked and each string scrubbed unescaped.
-    const scrubbed = scrubBody({
-      messages: [{ role: 'user', content: 'why does {"authorization":"Basic c2VjcmV0dmFs"} 401?' }],
-    });
-    expect(JSON.stringify(scrubbed)).not.toContain('c2VjcmV0dmFs');
-    expect(JSON.stringify(scrubbed)).toContain('[REDACTED]');
-  });
-
-  it('leaves the structure intact while scrubbing', () => {
-    const scrubbed = scrubBody({ model: 'gpt-5.1', tools: [{ name: 't', args: { n: 1 } }] });
-    expect(scrubbed).toEqual({ model: 'gpt-5.1', tools: [{ name: 't', args: { n: 1 } }] });
-  });
-
-  it('drops a body larger than the cap rather than truncating it', () => {
-    const huge = { messages: [{ role: 'user', content: 'x'.repeat(MAX_BODY_BYTES) }] };
-    expect(scrubBody(huge)).toBeNull();
-  });
-
-  it('replaces an inline base64 image with a marker', () => {
-    const base64 = 'A'.repeat(2048);
-    const body = {
-      messages: [
-        {
-          role: 'user',
-          content: [{ type: 'image_url', image_url: { url: `data:image/png;base64,${base64}` } }],
-        },
-      ],
-    };
-    const scrubbed = JSON.stringify(scrubBody(body));
-
-    expect(scrubbed).not.toContain(base64);
-    expect(scrubbed).toContain('[inline image: image/png,');
-    expect(JSON.stringify(body)).toContain(base64);
-  });
-
-  it('ships a body that only exceeded the cap because of its images', () => {
-    const body = {
-      messages: [
-        {
-          role: 'user',
-          content: [
-            {
-              type: 'image_url',
-              image_url: { url: `data:image/jpeg;base64,${'B'.repeat(MAX_BODY_BYTES)}` },
-            },
-          ],
-        },
-      ],
-    };
-    expect(JSON.stringify(scrubBody(body))).toContain('[inline image: image/jpeg,');
-  });
-});
-
-describe('scrubProviderUrl', () => {
-  it('keeps routing query parameters but removes credentials', () => {
-    expect(scrubProviderUrl('https://provider.test/generate?alt=sse&key=secret-value')).toBe(
-      'https://provider.test/generate?alt=sse&key=%5BREDACTED%5D',
-    );
-  });
-
-  it('scrubs secrets even when the provider URL is malformed', () => {
-    expect(scrubProviderUrl('not-a-url sk-ant-abcdefghijklmno')).toBe('not-a-url [REDACTED]');
-  });
-});
-
-describe('toObservation', () => {
-  it('builds the observe payload with the normalized provider error', () => {
-    const obs = toObservation(baseInput);
-    expect(obs).not.toBeNull();
-    expect(obs!.traceId).toBe('trace-1');
-    expect(obs!.tenantId).toBe('tenant-1');
-    expect(obs!.provider).toBe('openai');
-    expect(obs!.authType).toBe('api_key');
-    expect(obs!.api).toBe('chat_completions');
-    expect(obs!.request).toMatchObject({ model: 'gpt-5.1', temperature: 5 });
-    expect(obs!.response.statusCode).toBe(400);
-    expect(obs!.response.error.message).toContain('temperature');
-  });
-
-  it('keeps the caller messages, which the historical scrape never carried', () => {
-    const obs = toObservation(baseInput);
-    expect(obs!.request.messages).toEqual([{ role: 'user', content: 'hi' }]);
-  });
-
-  it('never leaks the agent id — it only resolves the consent gate', () => {
-    const obs = toObservation(baseInput);
-    expect(obs).not.toHaveProperty('agentId');
-    expect(JSON.stringify(obs)).not.toContain('agent-1');
-  });
-
-  it('keeps the provider-facing model and body shape intact', () => {
-    const obs = toObservation({
-      ...baseInput,
-      apiMode: 'messages',
-      requestBody: {
-        model: 'claude-opus-4-8',
-        thinking: { type: 'adaptive', budget_tokens: 8192 },
-      },
-    });
-    expect(obs!.api).toBe('messages');
-    expect(obs!.request).toEqual({
-      model: 'claude-opus-4-8',
-      thinking: { type: 'adaptive', budget_tokens: 8192 },
-    });
-  });
-
-  it('keeps a native Gemini provider exchange separate from Phoenix patch identity', () => {
-    const wireBody = {
-      generationConfig: { maxOutputTokens: 32000, topP: 1, temperature: 1 },
-      contents: [{ role: 'user', parts: [{ text: 'hi' }] }],
-    };
-    const obs = toObservation({
-      ...baseInput,
-      provider: 'gemini',
-      model: 'gemini-2.5-flash-lite',
-      requestBody: wireBody,
-      providerWire: {
-        format: 'google_generate_content',
-        url: 'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-lite:generateContent',
-        body: wireBody,
-      },
-    });
-    expect(obs?.model).toBe('gemini-2.5-flash-lite');
-    expect(obs?.request).toEqual(wireBody);
-    expect(obs?.request).not.toHaveProperty('model');
-    expect(obs?.providerExchange).toEqual({
-      format: 'google_generate_content',
-      url: 'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-lite:generateContent',
-      request: { body: wireBody, redactedFields: [] },
-      response: {
-        statusCode: 400,
-        body: { error: { message: 'temperature must be <= 2', code: 'bad_param' } },
-      },
-    });
-  });
-
-  it('omits an absent provider URL from the exchange', () => {
-    const obs = toObservation({
-      ...baseInput,
-      providerWire: {
-        format: 'openai_chat_completions',
-        body: { model: 'gpt-5.1', max_tokens: 128 },
-      },
-      errorBody: 'plain provider failure',
-    });
-
-    expect(obs?.providerExchange).toEqual({
-      format: 'openai_chat_completions',
-      request: {
-        body: { model: 'gpt-5.1', max_tokens: 128 },
-        redactedFields: [],
-      },
-      response: { statusCode: 400, body: 'plain provider failure' },
-    });
-  });
-
-  it('returns null when the provider-native body is too large to ship', () => {
-    expect(
-      toObservation({
-        ...baseInput,
-        providerWire: {
-          format: 'google_generate_content',
-          body: { contents: [{ text: 'x'.repeat(MAX_BODY_BYTES) }] },
-        },
-      }),
-    ).toBeNull();
-  });
-
-  it('carries the response time when measured', () => {
-    expect(toObservation({ ...baseInput, responseTimeMs: 42 })!.responseTimeMs).toBe(42);
-    expect(toObservation(baseInput)!.responseTimeMs).toBeUndefined();
-  });
-
-  it('returns null for a non-request-side failure', () => {
-    expect(toObservation({ ...baseInput, status: 429 })).toBeNull();
-  });
-
-  it('does not report Anthropic subscription extra-usage exhaustion', () => {
-    expect(
-      toObservation({
-        ...baseInput,
-        provider: 'anthropic',
-        status: 400,
-        errorBody: JSON.stringify({
-          type: 'error',
-          error: {
-            type: 'invalid_request_error',
-            message: 'You are out of extra usage. Add more at claude.ai to keep going.',
-          },
-        }),
-      }),
-    ).toBeNull();
-  });
-
-  it('returns null when the body is too large to ship', () => {
-    const requestBody = { messages: [{ content: 'x'.repeat(MAX_BODY_BYTES) }] };
-    expect(toObservation({ ...baseInput, requestBody })).toBeNull();
-  });
-
-  it('sends no inline image bytes to Phoenix', () => {
-    const base64 = 'A'.repeat(4096);
-    const requestBody = {
-      model: 'gpt-5.1',
-      messages: [
-        {
-          role: 'user',
-          content: [{ type: 'image_url', image_url: { url: `data:image/webp;base64,${base64}` } }],
-        },
-      ],
-    };
-    const observation = toObservation({ ...baseInput, requestBody });
-
-    expect(JSON.stringify(observation)).not.toContain(base64);
-    expect(JSON.stringify(observation?.request)).toContain('[inline image: image/webp,');
-  });
-});
diff --git a/packages/backend/src/routing/autofix/observation-payload.ts b/packages/backend/src/routing/autofix/observation-payload.ts
deleted file mode 100644
index 32034d60..00000000
--- a/packages/backend/src/routing/autofix/observation-payload.ts
+++ /dev/null
@@ -1,204 +0,0 @@
-import { isAnthropicExtraUsageError } from 'manifest-shared';
-import { scrubSecrets } from '../../common/utils/secret-scrub';
-import { redactInlineImageDataUrls } from '../proxy/inline-image-redaction';
-import type { ProviderWireFormat, ProxyApiMode } from '../proxy/proxy-types';
-import type { AuthType } from 'manifest-shared';
-import { normalizeProviderError } from './provider-error-normalizer';
-import type { HealRequest } from './phoenix.types';
-
-/**
- * 4xx codes that are never a defect in the request body: the caller is
- * unauthenticated, out of credit, forbidden, or throttled. Rewriting the request
- * cannot fix any of them, so reporting them to Phoenix would only pad its issue
- * base with noise. Mirrors the exclusion list Peacock's historical scrape uses
- * (`phoenix-ingestion-sql.ts`), so the live feed and the scrape agree on scope.
- */
-const NON_REQUEST_SIDE = new Set([401, 402, 403, 429]);
-
-/**
- * Cap on the serialized observation body. Phoenix stores request bodies
- * uncapped, and a single agent can forward a multi-megabyte prompt; an
- * observation is diagnostic evidence, not an archive, so oversized ones are
- * dropped rather than truncated (a half-body would fingerprint the same but
- * heal wrong).
- */
-export const MAX_BODY_BYTES = 256 * 1024;
-
-/** Whether a failed forward is a request-side 4xx worth reporting. */
-export function isReportableStatus(status: number): boolean {
-  return status >= 400 && status < 500 && !NON_REQUEST_SIDE.has(status);
-}
-
-/**
- * Keys whose value is a credential whatever its shape. {@link scrubSecrets} only
- * matches text, so a non-string value (a number, an object) under one of these
- * would survive it. Compared after {@link normalizeKey}, so every separator and
- * casing variant a caller might send — `api_key`, `apiKey`, `X-API-Key` — folds
- * onto one entry.
- */
-const CREDENTIAL_KEYS = new Set([
-  'xapikey',
-  'authorization',
-  'apikey',
-  'apisecret',
-  'refreshtoken',
-  'clientsecret',
-  'accesstoken',
-  'devicecode',
-]);
-
-/**
- * Fold a JSON key to its separator- and case-insensitive form. Every
- * non-alphanumeric character goes, not just `-`/`_`, so `client.secret` and
- * `access token` fold onto the same entry as `clientSecret` and `access_token`.
- */
-function normalizeKey(key: string): string {
-  return key.toLowerCase().replace(/[^a-z0-9]/g, '');
-}
-
-function isPlainRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-/** Keep the resolved endpoint while removing credentials from query parameters. */
-export function scrubProviderUrl(raw: string): string {
-  try {
-    const url = new URL(raw);
-    for (const key of [...url.searchParams.keys()]) {
-      if (/key|token|secret|signature|credential/i.test(key)) {
-        url.searchParams.set(key, '[REDACTED]');
-      }
-    }
-    return url.toString();
-  } catch {
-    return scrubSecrets(raw);
-  }
-}
-
-/**
- * Recursively scrub credentials out of a body.
- *
- * Walk the values rather than the serialized JSON. Scrubbing the serialized form
- * would miss a secret nested inside message content — `{"authorization":"Basic …"}`
- * quoted inside a prompt serializes to `{\"authorization\":\"Basic …\"}`, whose
- * escaped quotes defeat the header pattern — and a replacement landing outside a
- * string literal would leave invalid JSON. Walking sidesteps both: every string
- * reaches {@link scrubSecrets} unescaped, and the structure is never touched.
- *
- * Property names are caller-controlled too, so they are scrubbed like any other
- * string — a key that IS a secret would otherwise ride along untouched.
- */
-function scrubValue(value: unknown): unknown {
-  if (typeof value === 'string') return scrubSecrets(value);
-  if (Array.isArray(value)) return value.map(scrubValue);
-  if (!isPlainRecord(value)) return value;
-  const out: Record<string, unknown> = {};
-  for (const [key, nested] of Object.entries(value)) {
-    const scrubbed = CREDENTIAL_KEYS.has(normalizeKey(key)) ? '[REDACTED]' : scrubValue(nested);
-    out[scrubSecrets(key)] = scrubbed;
-  }
-  return out;
-}
-
-/**
- * Strip credentials and inline base64 images from a request body before it
- * leaves this process, or return null when the body is too large to ship. The
- * body is the caller's, not ours, and it can carry a key a user pasted into a
- * prompt or a tool definition.
- */
-export function scrubBody(body: Record<string, unknown>): Record<string, unknown> | null {
-  // Inline base64 images go first: an observation is evidence about the shape of
-  // a request, and no Phoenix operation reads image bytes. Dropping them before
-  // the size check also keeps a request that only failed the cap because of a
-  // screenshot reportable.
-  const withoutImages = redactInlineImageDataUrls(body);
-  if (Buffer.byteLength(JSON.stringify(withoutImages), 'utf8') > MAX_BODY_BYTES) return null;
-  return scrubValue(withoutImages) as Record<string, unknown>;
-}
-
-export interface ObservationInput {
-  /**
-   * The `traceparent` trace id when the caller sent one. Phoenix keys its ledger
-   * on `(issue, traceId)`, and Peacock's scrape reports the same
-   * `agent_messages.trace_id`, so passing it through is what lets a live
-   * observation and a later scrape of the same failure collapse into one row.
-   */
-  traceId: string;
-  tenantId: string;
-  /**
-   * The agent the request routed through. Used ONLY to resolve the Autofix
-   * consent gate (`isActiveFor`) — never part of the observation, since Phoenix
-   * attributes failures to a tenant, not to an agent.
-   */
-  agentId: string;
-  provider: string;
-  /** Logical model identity when the provider encodes it in the URL. */
-  model: string;
-  authType: AuthType;
-  apiMode: ProxyApiMode;
-  /**
-   * The provider-facing body. Inline base64 images are redacted below because an
-   * observation is evidence only and no Phoenix operation needs the image bytes.
-   */
-  requestBody: Record<string, unknown>;
-  providerWire?: {
-    format: ProviderWireFormat;
-    url?: string;
-    body: Record<string, unknown>;
-  };
-  status: number;
-  /** Raw text of the provider's error response. */
-  errorBody: string;
-  responseTimeMs?: number;
-}
-
-/**
- * Build the `/api/heal/observe` payload for one failed forward, or null when the
- * failure isn't request-side or the body can't be safely shipped.
- */
-export function toObservation(input: ObservationInput): HealRequest | null {
-  if (!isReportableStatus(input.status)) return null;
-  if (
-    isAnthropicExtraUsageError({
-      provider: input.provider,
-      httpStatus: input.status,
-      errorBody: input.errorBody,
-    })
-  ) {
-    return null;
-  }
-  const scrubbed = scrubBody(input.requestBody);
-  if (!scrubbed) return null;
-  const scrubbedProviderBody = input.providerWire ? scrubBody(input.providerWire.body) : null;
-  if (input.providerWire && !scrubbedProviderBody) return null;
-
-  const safeErrorBody = scrubSecrets(input.errorBody);
-  let providerResponseBody: unknown = safeErrorBody;
-  try {
-    providerResponseBody = JSON.parse(safeErrorBody) as unknown;
-  } catch {
-    // Plain-text provider responses remain plain text.
-  }
-
-  return {
-    traceId: input.traceId,
-    tenantId: input.tenantId,
-    provider: input.provider,
-    model: input.model,
-    authType: input.authType,
-    api: input.apiMode,
-    request: scrubbed,
-    response: { statusCode: input.status, error: normalizeProviderError(input.errorBody) },
-    ...(input.providerWire
-      ? {
-          providerExchange: {
-            format: input.providerWire.format,
-            ...(input.providerWire.url ? { url: scrubProviderUrl(input.providerWire.url) } : {}),
-            request: { body: scrubbedProviderBody!, redactedFields: [] },
-            response: { statusCode: input.status, body: providerResponseBody },
-          },
-        }
-      : {}),
-    ...(input.responseTimeMs != null ? { responseTimeMs: input.responseTimeMs } : {}),
-  };
-}
diff --git a/packages/backend/src/routing/autofix/observation-reporter.spec.ts b/packages/backend/src/routing/autofix/observation-reporter.spec.ts
deleted file mode 100644
index 01ba2200..00000000
--- a/packages/backend/src/routing/autofix/observation-reporter.spec.ts
+++ /dev/null
@@ -1,308 +0,0 @@
-import { ConfigService } from '@nestjs/config';
-import type { AutofixService } from './autofix.service';
-import { ObservationReporter } from './observation-reporter';
-import type { HealingClient } from './healing-client';
-import type { ObservationInput } from './observation-payload';
-
-function makeConfig(values: Record<string, string> = {}): ConfigService {
-  return { get: (key: string) => values[key] } as unknown as ConfigService;
-}
-
-/** Autofix consent gate. Active by default; each test overrides what it needs. */
-function makeAutofix(
-  getHealingContext: jest.Mock = jest.fn().mockResolvedValue({ harness: 'other' }),
-): AutofixService {
-  return { getHealingContext } as unknown as AutofixService;
-}
-
-function makeClient(): jest.Mocked<HealingClient> {
-  return {
-    observe: jest.fn().mockResolvedValue(undefined),
-    heal: jest.fn(),
-    reportOutcome: jest.fn(),
-  } as unknown as jest.Mocked<HealingClient>;
-}
-
-const input: ObservationInput = {
-  traceId: 'trace-1',
-  tenantId: 'tenant-1',
-  agentId: 'agent-1',
-  provider: 'openai',
-  model: 'gpt-5.1',
-  authType: 'api_key',
-  apiMode: 'chat_completions',
-  requestBody: { model: 'gpt-5.1', messages: [{ role: 'user', content: 'hi' }] },
-  status: 400,
-  errorBody: '{"error":{"message":"bad request"}}',
-};
-
-function enabledReporter(
-  client: HealingClient,
-  autofix: AutofixService = makeAutofix(),
-): ObservationReporter {
-  return new ObservationReporter(client, autofix, makeConfig({ AUTOFIX_REPORT_ALL_4XX: 'true' }));
-}
-
-/**
- * `report()` returns before its gate resolves. Drain the microtask queue so the
- * detached chain finishes — works under fake timers, which `setImmediate` doesn't.
- */
-async function settle(): Promise<void> {
-  for (let i = 0; i < 5; i++) await Promise.resolve();
-}
-
-/**
- * Queue `count` reports, letting each clear the gate before the next. Real traffic
- * arrives over time; firing them all synchronously would instead saturate the
- * in-flight cap and drop most of them.
- */
-async function reportMany(reporter: ObservationReporter, count: number): Promise<void> {
-  for (let i = 0; i < count; i++) {
-    reporter.report({ ...input, traceId: `trace-${i}` });
-    await settle();
-  }
-}
-
-describe('ObservationReporter', () => {
-  afterEach(() => jest.useRealTimers());
-
-  describe('gating', () => {
-    it('does nothing when the deployment switch is off', async () => {
-      const client = makeClient();
-      const autofix = makeAutofix();
-      const reporter = new ObservationReporter(client, autofix, makeConfig());
-
-      reporter.report(input);
-      await settle();
-      await reporter.flush();
-
-      expect(client.observe).not.toHaveBeenCalled();
-      expect(autofix.getHealingContext).not.toHaveBeenCalled();
-    });
-
-    it('does not ship a body for an agent without Autofix on', async () => {
-      const client = makeClient();
-      const reporter = enabledReporter(client, makeAutofix(jest.fn().mockResolvedValue(false)));
-
-      reporter.report(input);
-      await settle();
-      await reporter.flush();
-
-      expect(client.observe).not.toHaveBeenCalled();
-    });
-
-    it("resolves the gate against the request's own tenant and agent", async () => {
-      const client = makeClient();
-      const getHealingContext = jest.fn().mockResolvedValue({ harness: 'other' });
-      const reporter = enabledReporter(client, makeAutofix(getHealingContext));
-
-      reporter.report(input);
-      await settle();
-
-      expect(getHealingContext).toHaveBeenCalledWith('tenant-1', 'agent-1');
-    });
-
-    it('fails closed when the gate itself throws', async () => {
-      const client = makeClient();
-      const gate = jest.fn().mockRejectedValue(new Error('db down'));
-      const reporter = enabledReporter(client, makeAutofix(gate));
-
-      reporter.report(input);
-      await settle();
-      await reporter.flush();
-
-      // No consent proven → no body sent, and nothing propagates to the proxy.
-      expect(client.observe).not.toHaveBeenCalled();
-    });
-
-    it('drops a report rather than let consent checks pile up unbounded', async () => {
-      const client = makeClient();
-      // A gate that never answers: every report stays in flight.
-      const reporter = enabledReporter(client, makeAutofix(jest.fn(() => new Promise(() => {}))));
-
-      for (let i = 0; i < 150; i++) reporter.report({ ...input, traceId: `trace-${i}` });
-      await settle();
-
-      // Bodies are retained per in-flight check, so the cap bounds them before the
-      // queue cap (which only applies once a check has cleared) ever gets to.
-      expect(reporter['inFlight'].size).toBe(100);
-      expect(client.observe).not.toHaveBeenCalled();
-    });
-
-    it('waits for an in-flight consent check before draining on shutdown', async () => {
-      const client = makeClient();
-      let allow!: () => void;
-      const gate = jest.fn(() => new Promise<boolean>((resolve) => (allow = () => resolve(true))));
-      const reporter = enabledReporter(client, makeAutofix(gate));
-
-      reporter.report(input);
-      const shutdown = reporter.onModuleDestroy();
-      allow();
-      await shutdown;
-
-      // The observation was still inside its gate when shutdown began.
-      expect(client.observe).toHaveBeenCalledTimes(1);
-    });
-
-    it('never consults the gate for a failure it would not report anyway', async () => {
-      const client = makeClient();
-      const autofix = makeAutofix();
-      const reporter = enabledReporter(client, autofix);
-
-      reporter.report({ ...input, status: 401 });
-      await settle();
-
-      // Rejecting on status first keeps a 4xx storm off the gate's DB read.
-      expect(autofix.getHealingContext).not.toHaveBeenCalled();
-      expect(client.observe).not.toHaveBeenCalled();
-    });
-  });
-
-  it('sends a queued observation with the full body on flush', async () => {
-    const client = makeClient();
-    const reporter = enabledReporter(client);
-
-    reporter.report(input);
-    await settle();
-    await reporter.flush();
-
-    expect(client.observe).toHaveBeenCalledTimes(1);
-    const [batch] = client.observe.mock.calls[0];
-    expect(batch).toHaveLength(1);
-    expect(batch[0].request.messages).toEqual([{ role: 'user', content: 'hi' }]);
-    expect(client.observe.mock.calls[0][1]).toEqual({ harness: 'other' });
-  });
-
-  it('keeps different harnesses in separate authenticated batches', async () => {
-    const client = makeClient();
-    const contexts = jest
-      .fn()
-      .mockResolvedValueOnce({ harness: 'claude-code' })
-      .mockResolvedValueOnce({ harness: 'openclaw' });
-    const reporter = enabledReporter(client, makeAutofix(contexts));
-
-    reporter.report({ ...input, traceId: 'coding' });
-    reporter.report({ ...input, traceId: 'personal' });
-    await settle();
-    await reporter.flush();
-    await reporter.flush();
-
-    expect(client.observe).toHaveBeenCalledTimes(2);
-    expect(client.observe.mock.calls[0][0][0].traceId).toBe('coding');
-    expect(client.observe.mock.calls[0][1]).toEqual({ harness: 'claude-code' });
-    expect(client.observe.mock.calls[1][0][0].traceId).toBe('personal');
-    expect(client.observe.mock.calls[1][1]).toEqual({ harness: 'openclaw' });
-  });
-
-  it('flushes automatically once a full batch accumulates', async () => {
-    const client = makeClient();
-    const reporter = enabledReporter(client);
-
-    await reportMany(reporter, 50);
-
-    expect(client.observe).toHaveBeenCalledTimes(1);
-    expect(client.observe.mock.calls[0][0]).toHaveLength(50);
-  });
-
-  it('flushes on the timer when the batch never fills', async () => {
-    jest.useFakeTimers();
-    const client = makeClient();
-    const reporter = enabledReporter(client);
-
-    reporter.report(input);
-    await settle();
-    expect(client.observe).not.toHaveBeenCalled();
-
-    jest.advanceTimersByTime(2_000);
-    expect(client.observe).toHaveBeenCalledTimes(1);
-  });
-
-  it('bounds the queue at 500, dropping the oldest observations first', async () => {
-    const client = makeClient();
-    const reporter = enabledReporter(client);
-    // Stub the drain so the queue actually reaches the cap; otherwise the
-    // batch-full auto-flush empties it long before any observation is dropped.
-    jest.spyOn(reporter, 'flush').mockResolvedValue(undefined);
-
-    await reportMany(reporter, 601);
-
-    const queue = reporter['queue'];
-    expect(queue).toHaveLength(500);
-    // 101 dropped off the front; the newest is still there.
-    expect(queue[0].observation.traceId).toBe('trace-101');
-    expect(queue[queue.length - 1].observation.traceId).toBe('trace-600');
-  });
-
-  it('keeps flushing while more than one batch is queued', async () => {
-    const client = makeClient();
-    const reporter = enabledReporter(client);
-    // Fill past one batch without letting the batch-full auto-flush drain it.
-    const drain = jest.spyOn(reporter, 'flush').mockResolvedValue(undefined);
-    await reportMany(reporter, 120);
-    drain.mockRestore();
-
-    jest.useFakeTimers();
-    await reporter.flush();
-    expect(client.observe).toHaveBeenCalledTimes(1);
-
-    jest.advanceTimersByTime(2_000);
-    expect(client.observe).toHaveBeenCalledTimes(2);
-  });
-
-  it('never throws when a body cannot be serialized', async () => {
-    const client = makeClient();
-    const reporter = enabledReporter(client);
-    const circular: Record<string, unknown> = { model: 'gpt-5.1' };
-    circular.self = circular;
-
-    expect(() => reporter.report({ ...input, requestBody: circular })).not.toThrow();
-    await settle();
-
-    expect(client.observe).not.toHaveBeenCalled();
-  });
-
-  it('swallows a healer failure so the proxy never sees it', async () => {
-    const client = makeClient();
-    client.observe.mockRejectedValue(new Error('phoenix down'));
-    const reporter = enabledReporter(client);
-
-    reporter.report(input);
-    await settle();
-
-    await expect(reporter.flush()).resolves.toBeUndefined();
-  });
-
-  it('drains the queue on shutdown', async () => {
-    const client = makeClient();
-    const reporter = enabledReporter(client);
-
-    reporter.report(input);
-    await settle();
-    await reporter.onModuleDestroy();
-
-    expect(client.observe).toHaveBeenCalledTimes(1);
-  });
-
-  it('drains every queued batch on shutdown, not just the first', async () => {
-    const client = makeClient();
-    const reporter = enabledReporter(client);
-    // Hold the queue at 120 so shutdown faces a multi-batch backlog.
-    const drain = jest.spyOn(reporter, 'flush').mockResolvedValue(undefined);
-    await reportMany(reporter, 120);
-    drain.mockRestore();
-
-    await reporter.onModuleDestroy();
-
-    expect(client.observe).toHaveBeenCalledTimes(3);
-    expect(reporter['queue']).toHaveLength(0);
-  });
-
-  it('is a no-op flush when nothing is queued', async () => {
-    const client = makeClient();
-    const reporter = enabledReporter(client);
-
-    await reporter.flush();
-
-    expect(client.observe).not.toHaveBeenCalled();
-  });
-});
diff --git a/packages/backend/src/routing/autofix/observation-reporter.ts b/packages/backend/src/routing/autofix/observation-reporter.ts
deleted file mode 100644
index 18d9c2cf..00000000
--- a/packages/backend/src/routing/autofix/observation-reporter.ts
+++ /dev/null
@@ -1,188 +0,0 @@
-import { Inject, Injectable, Logger, OnModuleDestroy } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import { AutofixService } from './autofix.service';
-import { HEALING_CLIENT, type HealingClient, type HealingRequestContext } from './healing-client';
-import { toObservation, type ObservationInput } from './observation-payload';
-import type { HealRequest } from './phoenix.types';
-
-/** Phoenix's `/api/heal/observe` accepts at most 200 observations per call. */
-const BATCH_MAX = 50;
-const FLUSH_INTERVAL_MS = 2_000;
-/**
- * Backpressure ceiling. A provider outage can turn every request into a 4xx, and
- * a queue that grows with traffic would trade a Phoenix outage for a Manifest
- * one. Past this depth the oldest observations are dropped: evidence is
- * sampled-by-nature (Phoenix folds recurrences into one issue), so losing some
- * is strictly better than holding the heap.
- */
-const MAX_QUEUE = 500;
-/**
- * Ceiling on consent checks awaiting a verdict. Each one retains a request body,
- * and {@link MAX_QUEUE} only bounds what has already cleared the gate — so a slow
- * gate against a struggling DB would otherwise let bodies pile up behind it,
- * unbounded. Concurrent gates for the same agent share one in-flight DB read.
- */
-const MAX_IN_FLIGHT_GATES = 100;
-
-interface QueuedObservation {
-  observation: HealRequest;
-  context: HealingRequestContext;
-}
-
-/**
- * Streams an agent's request-side 4xx to Phoenix as observations, carrying the
- * full request body.
- *
- * Autofix itself only reports the requests it actually heals: the narrow
- * `AUTOFIX_REPAIRABLE_STATUSES` set, the primary attempt only, and only when the
- * heal call gets through. Everything else reached Phoenix solely through
- * Peacock's hourly scrape of `agent_messages`, which stores the model-parameter
- * snapshot and not the messages — so those issues arrived without the body that
- * caused them. This reporter closes that gap without persisting a single byte in
- * Manifest: the body is scrubbed, batched, and POSTed to Phoenix, which is where
- * request evidence already lives.
- *
- * **Only for agents with Autofix on** ({@link AutofixService.isActiveFor}).
- * Turning Autofix on is what agrees to send failing requests to the healing
- * service; an agent that never did must not have its callers' prompt content
- * shipped there. The gate is checked per report and fails closed.
- *
- * Wholly best-effort. Nothing here is awaited by the request path, no failure
- * propagates, and the queue is bounded — a Phoenix outage costs dropped
- * evidence, never a slow or failed proxy response.
- *
- * Off unless `AUTOFIX_REPORT_ALL_4XX=true`, a second, deployment-level switch on
- * top of the per-agent gate.
- */
-@Injectable()
-export class ObservationReporter implements OnModuleDestroy {
-  private readonly logger = new Logger(ObservationReporter.name);
-  private readonly enabled: boolean;
-  private queue: QueuedObservation[] = [];
-  /** Consent checks that have not resolved yet — awaited on shutdown, capped on entry. */
-  private readonly inFlight = new Set<Promise<void>>();
-  private timer: NodeJS.Timeout | null = null;
-  private dropped = 0;
-
-  constructor(
-    @Inject(HEALING_CLIENT) private readonly client: HealingClient,
-    private readonly autofix: AutofixService,
-    config: ConfigService,
-  ) {
-    this.enabled = config.get<string>('AUTOFIX_REPORT_ALL_4XX')?.trim() === 'true';
-    this.logger.log(`config: enabled=${this.enabled}`);
-  }
-
-  /**
-   * Queue a failed forward for reporting, if the agent has Autofix on.
-   * Synchronous and non-throwing by contract — the caller is on the request path
-   * and must never wait on, or fail because of, evidence collection. The consent
-   * gate is async (a fresh DB read, coalesced per agent while in flight), so it
-   * runs detached.
-   */
-  report(input: ObservationInput): void {
-    if (!this.enabled) return;
-    if (this.inFlight.size >= MAX_IN_FLIGHT_GATES) {
-      this.countDrop();
-      return;
-    }
-    const pending: Promise<void> = this.gateAndEnqueue(input).finally(() => {
-      this.inFlight.delete(pending);
-    });
-    this.inFlight.add(pending);
-  }
-
-  /** Note a dropped observation, logging once per 100 so a saturated feed can't flood. */
-  private countDrop(): void {
-    this.dropped += 1;
-    // Enough to see sustained backpressure in the logs without a failing Phoenix
-    // (or a slow gate) turning into a log flood of its own.
-    if (this.dropped % 100 === 0) {
-      this.logger.warn(`observation feed saturated — dropped ${this.dropped} so far`);
-    }
-  }
-
-  private async gateAndEnqueue(input: ObservationInput): Promise<void> {
-    try {
-      // Build first: a body we can't scrub or a status we don't report costs
-      // nothing to reject, and skips the gate's DB read entirely.
-      const observation = toObservation(input);
-      if (!observation) return;
-      const context = await this.autofix.getHealingContext(input.tenantId, input.agentId);
-      if (!context) return;
-      this.enqueue({ observation, context });
-    } catch (err) {
-      // Includes a gate that threw (DB hiccup): no consent proven, no body sent.
-      this.logger.warn(`observation dropped: ${(err as Error).message}`);
-    }
-  }
-
-  private enqueue(observation: QueuedObservation): void {
-    if (this.queue.length >= MAX_QUEUE) {
-      this.queue.shift();
-      this.countDrop();
-    }
-    this.queue.push(observation);
-    if (this.queue.length >= BATCH_MAX) {
-      void this.flush();
-      return;
-    }
-    this.scheduleFlush();
-  }
-
-  private scheduleFlush(): void {
-    if (this.timer) return;
-    this.timer = setTimeout(() => {
-      this.timer = null;
-      void this.flush();
-    }, FLUSH_INTERVAL_MS);
-    // Never hold the event loop open on a pending batch.
-    this.timer.unref?.();
-  }
-
-  /** Drain one batch to Phoenix. Swallows every failure; the batch is lost, not retried. */
-  async flush(): Promise<void> {
-    if (this.timer) {
-      clearTimeout(this.timer);
-      this.timer = null;
-    }
-    if (this.queue.length === 0) return;
-    const context = this.queue[0].context;
-    const batch: QueuedObservation[] = [];
-    const remaining: QueuedObservation[] = [];
-    for (const item of this.queue) {
-      if (batch.length < BATCH_MAX && item.context.harness === context.harness) {
-        batch.push(item);
-      } else {
-        remaining.push(item);
-      }
-    }
-    this.queue = remaining;
-    try {
-      await this.client.observe(
-        batch.map((item) => item.observation),
-        context,
-      );
-    } catch (err) {
-      this.logger.warn(`observe batch of ${batch.length} failed: ${(err as Error).message}`);
-    }
-    if (this.queue.length > 0) this.scheduleFlush();
-  }
-
-  /**
-   * Drain everything on shutdown, not just one batch. `flush()` sends at most
-   * BATCH_MAX and reschedules the rest on a timer that will never fire once the
-   * process is going down. It always removes the batch it took (a failed batch is
-   * dropped, not retried), so the queue strictly shrinks and this terminates.
-   *
-   * Settle the outstanding consent checks first, or the observations still inside
-   * one would never reach the queue we are about to drain.
-   *
-   * No timer to clear afterwards: one is only ever scheduled while the queue is
-   * non-empty, and `flush()` clears it on entry — so an empty queue implies none.
-   */
-  async onModuleDestroy(): Promise<void> {
-    await Promise.allSettled([...this.inFlight]);
-    while (this.queue.length > 0) await this.flush();
-  }
-}
diff --git a/packages/backend/src/routing/autofix/phoenix.types.ts b/packages/backend/src/routing/autofix/phoenix.types.ts
deleted file mode 100644
index 04b79bbb..00000000
--- a/packages/backend/src/routing/autofix/phoenix.types.ts
+++ /dev/null
@@ -1,156 +0,0 @@
-import type { ProviderWireFormat, ProxyApiMode } from '../proxy/proxy-types';
-import type { AuthType } from 'manifest-shared';
-
-/**
- * Wire contract for the Phoenix healing service (mnfst/phoenix). Mirrors
- * Phoenix's `phoenix-openapi.yaml` (the source of truth): POST /api/heal returns
- * a discriminated heal decision, and PATCH /api/heal-attempts/{healAttemptId}
- * reports the post-retry outcome. Keep these shapes in lockstep with Phoenix —
- * the HttpHealingClient maps 1:1.
- */
-
-/** Normalised provider error — the four fields Phoenix fingerprints on. */
-export interface PhoenixProviderError {
-  message: string;
-  type?: string | null;
-  param?: string | null;
-  code?: string | null;
-}
-
-export interface PhoenixProviderResponse {
-  statusCode: number;
-  error: PhoenixProviderError;
-}
-
-/** Final provider-side exchange, separate from the request shape Phoenix patches. */
-export interface PhoenixProviderExchange {
-  format: ProviderWireFormat;
-  url?: string;
-  request: {
-    body: Record<string, unknown>;
-    redactedFields?: string[];
-  };
-  response: {
-    statusCode: number;
-    body: unknown;
-  };
-}
-
-/** POST /api/heal request body. Route identity scopes Phoenix's fingerprint. */
-export interface HealRequest {
-  /**
-   * Correlates every heal within one logical request's retry chain — Phoenix's
-   * `traceId` (Manifest reuses the message-link group id). REQUIRED: Phoenix
-   * rejects a heal request without it (`400`).
-   */
-  traceId: string;
-  /**
-   * The Manifest tenant this request belongs to (`Tenant.id`). Attributes the
-   * failure to a customer so Phoenix can report affected tenants per issue and
-   * browse a tenant's failures. Always available on the proxy heal path (the
-   * agent key resolves a tenant), so we always send it; Phoenix treats it as an
-   * optional, opaque label.
-   */
-  tenantId: string;
-  provider: string;
-  /** Logical model identity; native transports may encode it in the URL. */
-  model?: string;
-  authType: AuthType;
-  /**
-   * Provider-facing wire protocol. `request` uses this shape, and Phoenix must
-   * return `healedBody` in the same shape so Manifest can resend it verbatim.
-   */
-  api: ProxyApiMode;
-  url?: string;
-  request: Record<string, unknown>;
-  response: PhoenixProviderResponse;
-  providerExchange?: PhoenixProviderExchange;
-  responseTimeMs?: number;
-  responseSizeBytes?: number;
-}
-
-/**
- * Heal decision from `POST /api/heal`. Both `patched` (the issue is already
- * verified) and `unverified` (a freshly served patch, not yet confirmed) carry a
- * `healedBody` + `healAttemptId` to resend — the client keys off their presence,
- * not an allow-list, so a future patch-bearing status still applies. `resolving`
- * means Phoenix is still authoring a fix (nothing to resend); `no_patch` is terminal.
- *
- * Declared as a runtime array so `phoenix-contract.spec.ts` can assert it stays
- * in lockstep with the OpenAPI `HealResult.status` enum.
- */
-export const HEAL_STATUSES = ['patched', 'unverified', 'resolving', 'no_patch'] as const;
-export type PhoenixHealStatus = (typeof HEAL_STATUSES)[number];
-
-/** One deterministic edit from the Phoenix catalog (MVP #1: rename_param). */
-export interface PhoenixOperation {
-  type: string;
-  from?: string;
-  to?: string;
-}
-
-/**
- * Phoenix's own human-readable "why" for a served heal — render this instead of
- * re-deriving prose from the raw operations (which we did before, incompletely).
- * `operations[].detail` is a plain sentence per edit (built from the real args);
- * `summary` is the one-line story; `source` says whether the text was composed
- * deterministically, written by the investigator agent, or by an operator.
- */
-export interface PhoenixExplanation {
-  summary: string;
-  operations: Array<{ type: string; detail: string }>;
-  source: 'deterministic' | 'agent' | 'operator';
-}
-
-/** POST /api/heal response — discriminated on `status`. */
-export interface HealResponse {
-  status: PhoenixHealStatus;
-  issueId: string;
-  patchId?: string | null;
-  /** Present when a patch was handed out; report its outcome via PATCH /api/heal-attempts/{healAttemptId}. */
-  healAttemptId?: string | null;
-  operations?: PhoenixOperation[] | null;
-  /** Human-readable "why" for the fix, present when a patch was handed out. */
-  explanation?: PhoenixExplanation | null;
-  healedBody?: Record<string, unknown> | null;
-  retryAfterMs?: number | null;
-}
-
-/**
- * PATCH /api/heal-attempts/{healAttemptId} request body — what happened after we
- * applied the patch and retried. Phoenix (not us) decides succeeded/failed from
- * this. `error` is REQUIRED when `retryStatusCode >= 400`, omitted on 2xx.
- */
-export interface HealOutcome {
-  retryStatusCode: number;
-  error?: PhoenixProviderError;
-}
-
-/** Issue lifecycle states — kept in lockstep with the OpenAPI `IssueView.status` enum. */
-export const ISSUE_STATUSES = [
-  'resolving',
-  'unverified',
-  'verified',
-  'ineffective',
-  'no_fix_found',
-] as const;
-export type PhoenixIssueStatus = (typeof ISSUE_STATUSES)[number];
-
-/** Adjudicated attempt outcome — kept in lockstep with the OpenAPI `OutcomeResult.status` enum. */
-export const OUTCOME_STATUSES = ['succeeded', 'failed', 'expired'] as const;
-export type OutcomeStatus = (typeof OUTCOME_STATUSES)[number];
-
-/** PATCH /api/heal-attempts/{healAttemptId} response body. */
-export interface ConfirmResponse {
-  healAttemptId: string;
-  /** `expired` when the attempt was swept (no outcome reported in time) before this call. */
-  status: OutcomeStatus;
-  /**
-   * The issue's status after this outcome. Typed as a plain string to match the
-   * vendored OpenAPI (`OutcomeResult.issueStatus: { type: string }`) rather than
-   * narrowing to {@link PhoenixIssueStatus} — Phoenix does not guarantee the enum
-   * on this field, so callers must not assume exhaustiveness. Reporting is
-   * fire-and-forget, so this value is not consumed today.
-   */
-  issueStatus: string;
-}
diff --git a/packages/backend/src/routing/autofix/provider-error-normalizer.ts b/packages/backend/src/routing/autofix/provider-error-normalizer.ts
deleted file mode 100644
index c6481661..00000000
--- a/packages/backend/src/routing/autofix/provider-error-normalizer.ts
+++ /dev/null
@@ -1,137 +0,0 @@
-import { scrubSecrets } from '../../common/utils/secret-scrub';
-import { providerDetailMessage } from '../proxy/proxy-error-sanitizer';
-import type { PhoenixProviderError } from './phoenix.types';
-
-const MAX_MESSAGE_LENGTH = 2000;
-
-function coerceString(value: unknown): string | null {
-  return typeof value === 'string' && value.trim().length > 0 ? value : null;
-}
-
-/**
- * Like {@link coerceString} but scrubs secrets from the result. Every string
- * lifted off the upstream error body (`type`/`param`/`code`, not just `message`)
- * is shipped to Phoenix, so a provider that echoes a key in any of them must not
- * leak it.
- */
-function coerceScrubbed(value: unknown): string | null {
-  const raw = coerceString(value);
-  return raw === null ? null : scrubSecrets(raw);
-}
-
-/**
- * Turn a raw upstream error body (the text of a 4xx provider response) into the
- * normalised `{ message, type, param, code }` shape Phoenix fingerprints on.
- *
- * Handles the OpenAI-compatible envelope (`{ error: { message, type, param,
- * code } }`), a flat `{ message, ... }` body, a bare `{ error: "…" }` string, a
- * FastAPI-style `{ detail }`, and non-JSON bodies (the raw text becomes the
- * message). Secrets are scrubbed and the message is length-capped so
- * we never ship a key or an unbounded blob to the healing service.
- */
-export function normalizeProviderError(rawBody: string): PhoenixProviderError {
-  let parsed: Record<string, unknown> | null = null;
-  try {
-    const json = JSON.parse(rawBody) as unknown;
-    if (json && typeof json === 'object') parsed = json as Record<string, unknown>;
-  } catch {
-    parsed = null;
-  }
-
-  const errorObj =
-    parsed && typeof parsed.error === 'object' && parsed.error !== null
-      ? (parsed.error as Record<string, unknown>)
-      : parsed;
-
-  const rawMessage =
-    coerceString(errorObj?.message) ??
-    coerceString(parsed?.message) ??
-    coerceString(parsed?.error) ??
-    providerDetailMessage(parsed?.detail) ??
-    rawBody;
-  const message = scrubSecrets(rawMessage).slice(0, MAX_MESSAGE_LENGTH);
-
-  return {
-    message,
-    type: coerceScrubbed(errorObj?.type),
-    param: coerceScrubbed(errorObj?.param),
-    code: coerceScrubbed(errorObj?.code),
-  };
-}
-
-/** Cap on the dimension fields, mirroring the bound Phoenix's wire schema enforces. */
-const MAX_FIELD_LENGTH = 1024;
-
-/** The same error stripped of its dimensions — the fallback when they don't fit. */
-function bare(message: string): PhoenixProviderError {
-  return { message, type: null, param: null, code: null };
-}
-
-/** Build the envelope, omitting the dimensions the provider didn't give us. */
-function envelopeOf(error: PhoenixProviderError, message: string): string {
-  return JSON.stringify({
-    error: {
-      message,
-      ...(error.type ? { type: error.type } : {}),
-      ...(error.param ? { param: error.param } : {}),
-      ...(error.code ? { code: error.code } : {}),
-    },
-  });
-}
-
-/**
- * Re-serialize a normalised error into the OpenAI-compatible `{"error":{…}}` envelope —
- * the inverse of {@link normalizeProviderError}, and the shape every other
- * `agent_messages.error_message` already holds.
- *
- * Autofix rows used to persist `error.message` alone, silently dropping `type`, `param`
- * and `code`. Those are exactly the dimensions Phoenix fingerprints on, so a downstream
- * re-ingest of such a row (Peacock's historical scrape) landed on a *different* issue than
- * the live `/heal` that had already reported the same failure — one error, two issues,
- * split occurrence counts.
- *
- * Every field is scrubbed and bounded here rather than at the call site: this is a storage
- * boundary, and it must not assume its input already went through
- * {@link normalizeProviderError}. The result never exceeds {@link MAX_MESSAGE_LENGTH} and
- * always parses — only field *contents* are trimmed, never the JSON.
- */
-export function serializeProviderError(error: PhoenixProviderError): string {
-  const clip = (v: string | null | undefined) =>
-    v ? scrubSecrets(v).slice(0, MAX_FIELD_LENGTH) : null;
-  const safe: PhoenixProviderError = {
-    message: scrubSecrets(error.message),
-    type: clip(error.type),
-    param: clip(error.param),
-    code: clip(error.code),
-  };
-
-  // The dimensions identify the error, so they are kept and the message absorbs the trim.
-  // Unless they exhaust the budget on their own — a provider padding them with characters
-  // JSON escapes to six bytes each. Then drop them and keep the message, which is all this
-  // row stored before anyway. Either way an empty message now fits, so the trim below can
-  // always close the gap.
-  const target = envelopeOf(safe, '').length <= MAX_MESSAGE_LENGTH ? safe : bare(safe.message);
-
-  let message = target.message;
-  let out = envelopeOf(target, message);
-  while (out.length > MAX_MESSAGE_LENGTH && message.length > 0) {
-    message = dropTail(message, Math.max(out.length - MAX_MESSAGE_LENGTH, 1));
-    out = envelopeOf(target, message);
-  }
-  return out;
-}
-
-/**
- * Drop `count` UTF-16 code units off the end of `s`, never leaving a lone high surrogate.
- *
- * Trimming a message usually shrinks its JSON by as much as it removes. Cutting an astral
- * character in half does the opposite: `JSON.stringify` renders the orphaned half as the
- * six-character escape `\ud83d`, so a one-unit cut can grow the envelope by four. Dropping
- * the orphan restores the "shrinks by at least `count`" property the caller's loop needs to
- * make progress.
- */
-function dropTail(s: string, count: number): string {
-  const cut = s.slice(0, Math.max(0, s.length - count));
-  const last = cut.charCodeAt(cut.length - 1);
-  return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
-}
diff --git a/packages/backend/src/routing/dto/routing.dto.ts b/packages/backend/src/routing/dto/routing.dto.ts
index 4e35ba69..d30a02f3 100644
--- a/packages/backend/src/routing/dto/routing.dto.ts
+++ b/packages/backend/src/routing/dto/routing.dto.ts
@@ -252,12 +252,6 @@ export function responseModeFromDto(body: SetResponseModeDto): ResponseMode | un
   return body.response_mode ?? body.responseMode;
 }
 
-export class UpdateAutofixDto {
-  @IsOptional()
-  @IsBoolean()
-  enabled?: boolean;
-}
-
 export class UpdateRecordingDto {
   @IsOptional()
   @IsBoolean()
diff --git a/packages/backend/src/routing/proxy/__tests__/anthropic-adapter.spec.ts b/packages/backend/src/routing/proxy/__tests__/anthropic-adapter.spec.ts
index 45bba78a..779c88d8 100644
--- a/packages/backend/src/routing/proxy/__tests__/anthropic-adapter.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/anthropic-adapter.spec.ts
@@ -157,7 +157,7 @@ describe('Anthropic Adapter', () => {
       expect(result.stop_sequences).toEqual(['STOP', 'END']);
     });
 
-    it('preserves adaptive thinking for model-specific Autofix', () => {
+    it('preserves adaptive thinking for the provider to judge', () => {
       const body = {
         messages: [{ role: 'user', content: 'Hi' }],
         thinking: { type: 'adaptive' },
@@ -196,7 +196,7 @@ describe('Anthropic Adapter', () => {
       });
     });
 
-    it('preserves the manual budget for adaptive-thinking Autofix', () => {
+    it('preserves the manual budget alongside adaptive thinking', () => {
       const thinking = { type: 'adaptive', budget_tokens: 8192, display: 'omitted' };
 
       const result = toAnthropicRequest(
diff --git a/packages/backend/src/routing/proxy/__tests__/provider-client-converters.spec.ts b/packages/backend/src/routing/proxy/__tests__/provider-client-converters.spec.ts
index 6e780327..5910b5f0 100644
--- a/packages/backend/src/routing/proxy/__tests__/provider-client-converters.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/provider-client-converters.spec.ts
@@ -214,7 +214,7 @@ describe('provider-client-converters', () => {
 
     /* ── Message field preservation ── */
 
-    it('should preserve reasoning_content for provider-specific Autofix', () => {
+    it('should preserve reasoning_content for the provider to judge', () => {
       const body = {
         messages: [{ role: 'assistant', content: 'Hi', reasoning_content: 'I thought...' }],
       };
diff --git a/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts b/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
index 027fd313..04aa3e39 100644
--- a/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
@@ -177,31 +177,15 @@ describe('ProviderClient', () => {
       });
     });
 
-    it('records an empty retry response against the retry attempt', async () => {
-      const retryBody = { choices: [] };
-      mockFetch
-        .mockResolvedValueOnce(
-          new Response(
-            JSON.stringify({
-              choices: [
-                {
-                  index: 0,
-                  message: { role: 'assistant', content: 'Initial response' },
-                  finish_reason: 'stop',
-                },
-              ],
-            }),
-            { status: 200, headers: { 'content-type': 'application/json' } },
-          ),
-        )
-        .mockResolvedValueOnce(
-          new Response(JSON.stringify(retryBody), {
-            status: 200,
-            headers: { 'content-type': 'application/json' },
-          }),
-        );
-      const originalFinishRecording = jest.fn().mockResolvedValue(undefined);
-      const retryFinishRecording = jest.fn().mockResolvedValue(undefined);
+    it('records an empty response against the forward attempt', async () => {
+      const emptyBody = { choices: [] };
+      mockFetch.mockResolvedValueOnce(
+        new Response(JSON.stringify(emptyBody), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        }),
+      );
+      const finishRecording = jest.fn().mockResolvedValue(undefined);
 
       const result = await client.forward({
         provider: 'openai',
@@ -211,26 +195,17 @@ describe('ProviderClient', () => {
         stream: false,
         apiMode: 'chat_completions',
         attempt: {
-          id: 'attempt-original',
+          id: 'attempt-1',
           attemptNumber: 1,
           startedAtMs: 0,
           startedAt: new Date(0).toISOString(),
           pendingWrite: Promise.resolve(true),
-          finishRecording: originalFinishRecording,
+          finishRecording,
         },
       });
-      const retry = await result.retryWireBody!(body, {
-        id: 'attempt-retry',
-        attemptNumber: 2,
-        startedAtMs: 1,
-        startedAt: new Date(1).toISOString(),
-        pendingWrite: Promise.resolve(true),
-        finishRecording: retryFinishRecording,
-      });
 
-      expect(retry.response.status).toBe(502);
-      expect(originalFinishRecording).not.toHaveBeenCalled();
-      expect(retryFinishRecording).toHaveBeenCalledWith({ type: 'json', body: retryBody });
+      expect(result.response.status).toBe(502);
+      expect(finishRecording).toHaveBeenCalledWith({ type: 'json', body: emptyBody });
     });
 
     it.each([
@@ -369,29 +344,20 @@ describe('ProviderClient', () => {
       expect(sentBody.prompt_cache_key).toBe('caller-conversation');
     });
 
-    it('captures the wire body and retries a healed body without rebuilding it', async () => {
+    it('sends the built wire body exactly once and reports its wire format', async () => {
       mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
 
-      const first = await client.forward({
+      const result = await client.forward({
         provider: 'openai',
         apiKey: 'sk-test',
         model: 'gpt-4o',
         body,
         stream: false,
       });
-      const healedBody = {
-        model: 'gpt-4o',
-        messages: body.messages,
-        healed_provider_extension: true,
-      };
-      const retry = await first.retryWireBody!(healedBody);
 
-      expect(first.wireApiMode).toBe('chat_completions');
-      expect(first.wireRequestBody).toEqual(JSON.parse(mockFetch.mock.calls[0][1].body));
-      expect(mockFetch).toHaveBeenCalledTimes(2);
-      expect(JSON.parse(mockFetch.mock.calls[1][1].body)).toEqual(healedBody);
-      expect(retry.wireRequestBody).toBe(healedBody);
-      expect(retry.retryWireBody).toBe(first.retryWireBody);
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+      expect(result.wireFormat).toBe('openai_chat_completions');
+      expect(result).not.toHaveProperty('retryWireBody');
     });
 
     it('preserves image parts for OpenAI-compatible providers', async () => {
@@ -736,7 +702,7 @@ describe('ProviderClient', () => {
       expect(sentBody.messages).toBeUndefined();
       expect(sentBody.stream).toBe(false);
       expect(result.isChatGpt).toBe(true);
-      expect(result.wireApiMode).toBe('responses');
+      expect(result.wireFormat).toBe('openai_responses');
     });
 
     it('preserves Bedrock Responses conversion for a selected region', async () => {
@@ -899,7 +865,7 @@ describe('ProviderClient', () => {
         { role: 'user', content: [{ type: 'text', text: 'Hello' }] },
       ]);
       expect(result.isAnthropic).toBe(true);
-      expect(result.wireApiMode).toBe('messages');
+      expect(result.wireFormat).toBe('anthropic_messages');
     });
 
     it.each(['us.anthropic.claude-sonnet-5-5', 'bedrock/us.anthropic.claude-sonnet-5-5'])(
@@ -929,7 +895,7 @@ describe('ProviderClient', () => {
         const sentBody = JSON.parse(mockFetch.mock.calls[0][1].body);
         expect(sentBody.model).toBe('us.anthropic.claude-sonnet-5-5');
         expect(result.isAnthropic).toBe(true);
-        expect(result.wireApiMode).toBe('messages');
+        expect(result.wireFormat).toBe('anthropic_messages');
       },
     );
 
@@ -1688,8 +1654,7 @@ describe('ProviderClient', () => {
       ]);
       // Inbound body untouched (no surprise mutations).
       expect((anthropicBody.tools[1] as Record<string, unknown>).cache_control).toBeUndefined();
-      expect(result.wireApiMode).toBe('messages');
-      expect(result.wireRequestBody).toEqual(sent);
+      expect(result.wireFormat).toBe('anthropic_messages');
       expect(resolveChatBody).not.toHaveBeenCalled();
     });
 
@@ -2250,10 +2215,7 @@ describe('ProviderClient', () => {
       expect(init.headers['x-goog-api-key']).toBe('AIza-test');
       expect(result.isGoogle).toBe(true);
       expect(result.isAnthropic).toBe(false);
-      expect(result.wireApiMode).toBeUndefined();
       expect(result.wireFormat).toBe('google_generate_content');
-      expect(result.wireRequestUrl).toBe(url);
-      expect(result.wireRequestBody).toEqual(JSON.parse(mockFetch.mock.calls[0][1].body));
     });
 
     it('streams through streamGenerateContent with alt=sse', async () => {
@@ -4896,7 +4858,7 @@ describe('ProviderClient', () => {
         thinking: { type: 'enabled' },
         reasoning_effort: 'max',
       });
-      expect(result.wireRequestBody).toEqual(sentBody);
+      expect(result.wireFormat).toBe('openai_chat_completions');
     });
 
     it('preserves DeepSeek max_tokens above a possible provider limit', async () => {
@@ -4914,7 +4876,7 @@ describe('ProviderClient', () => {
       expect(sentBody.max_tokens).toBe(12000);
     });
 
-    it('preserves non-positive DeepSeek max_tokens values for Autofix', async () => {
+    it('preserves non-positive DeepSeek max_tokens values for the provider to judge', async () => {
       mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
 
       await client.forward({
@@ -4929,7 +4891,7 @@ describe('ProviderClient', () => {
       expect(sentBody.max_tokens).toBe(0);
     });
 
-    it('preserves string DeepSeek max_tokens values for Autofix', async () => {
+    it('preserves string DeepSeek max_tokens values for the provider to judge', async () => {
       mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
 
       await client.forward({
@@ -4944,7 +4906,7 @@ describe('ProviderClient', () => {
       expect(sentBody.max_tokens).toBe('9000');
     });
 
-    it('preserves reasoning_content for Mistral Autofix without mutating the input', async () => {
+    it('preserves reasoning_content for Mistral without mutating the input', async () => {
       mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
       const bodyWithReasoningContent = makeBodyWithReasoningContent();
 
@@ -4979,7 +4941,7 @@ describe('ProviderClient', () => {
       expect(sentBody.messages[1].reasoning_content).toBe('Detailed internal reasoning');
     });
 
-    it('preserves reasoning_content for native OpenAI Autofix', async () => {
+    it('preserves reasoning_content for native OpenAI', async () => {
       mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
       const bodyWithReasoningContent = makeBodyWithReasoningContent();
 
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy-fallback.failures.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy-fallback.failures.spec.ts
index b7e1a9be..e539b99e 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy-fallback.failures.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy-fallback.failures.spec.ts
@@ -15,7 +15,6 @@ import { CopilotTokenService } from '../copilot-token.service';
 import { ModelPricingCacheService } from '../../../model-prices/model-pricing-cache.service';
 import { AgentModelParamsService } from '../../routing-core/agent-model-params.service';
 import { ProviderParamSpecService } from '../../routing-core/provider-param-spec.service';
-import { AutofixService } from '../../autofix/autofix.service';
 import type { StartProviderAttempt } from '../proxy-types';
 
 /**
@@ -149,10 +148,6 @@ describe('ProxyFallbackService.tryFallbacks — failure chain by status code', (
         list: jest.fn().mockResolvedValue([]),
       } as unknown as ProviderParamSpecService,
       new ReasoningContentCache(),
-      {
-        isRepairable: jest.fn().mockReturnValue(false),
-        maybeHeal: jest.fn(),
-      } as unknown as AutofixService,
     );
   });
 
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy-fallback.routes.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy-fallback.routes.spec.ts
index 1df87a33..a7d8d64b 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy-fallback.routes.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy-fallback.routes.spec.ts
@@ -15,7 +15,6 @@ import { CopilotTokenService } from '../copilot-token.service';
 import { ModelPricingCacheService } from '../../../model-prices/model-pricing-cache.service';
 import { AgentModelParamsService } from '../../routing-core/agent-model-params.service';
 import { ProviderParamSpecService } from '../../routing-core/provider-param-spec.service';
-import { AutofixService } from '../../autofix/autofix.service';
 
 /**
  * Locks the route-aware behavior of ProxyFallbackService.tryFallbacks:
@@ -159,10 +158,6 @@ describe('ProxyFallbackService.tryFallbacks — route-aware path', () => {
       modelParamsService,
       providerParamSpecs,
       new ReasoningContentCache(),
-      {
-        isRepairable: jest.fn().mockReturnValue(false),
-        maybeHeal: jest.fn(),
-      } as unknown as AutofixService,
     );
   });
 
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy-fallback.service.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy-fallback.service.spec.ts
index 028c314c..bd9622ef 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy-fallback.service.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy-fallback.service.spec.ts
@@ -17,7 +17,6 @@ import { ReasoningContentCache } from '../reasoning-content-cache';
 import { ModelPricingCacheService } from '../../../model-prices/model-pricing-cache.service';
 import { AgentModelParamsService } from '../../routing-core/agent-model-params.service';
 import { ProviderParamSpecService } from '../../routing-core/provider-param-spec.service';
-import { AutofixService } from '../../autofix/autofix.service';
 import { getProviderParamSpecs, type ProviderParamSpecCatalog } from 'manifest-shared';
 
 // A short warm-up window keeps the stalled-stream fallback tests fast. Only
@@ -62,7 +61,6 @@ describe('ProxyFallbackService', () => {
   let modelParamsService: jest.Mocked<AgentModelParamsService>;
   let providerParamSpecs: jest.Mocked<ProviderParamSpecService>;
   let reasoningCache: jest.Mocked<Pick<ReasoningContentCache, 'prepareRequest'>>;
-  let autofixService: jest.Mocked<AutofixService>;
 
   beforeEach(() => {
     providerKeyService = {
@@ -182,11 +180,6 @@ describe('ProxyFallbackService', () => {
       ),
     };
 
-    autofixService = {
-      isRepairable: jest.fn().mockReturnValue(false),
-      maybeHeal: jest.fn().mockResolvedValue(null),
-    } as unknown as jest.Mocked<AutofixService>;
-
     service = new ProxyFallbackService(
       providerKeyService,
       customProviderRepo,
@@ -202,7 +195,6 @@ describe('ProxyFallbackService', () => {
       modelParamsService,
       providerParamSpecs,
       reasoningCache as unknown as ReasoningContentCache,
-      autofixService,
     );
   });
 
@@ -873,32 +865,15 @@ describe('ProxyFallbackService', () => {
 
       it('rethrows a non-transport body failure with the attempt still attached', async () => {
         const started = attempt();
-        const retryWireBody = jest.fn().mockResolvedValue({
+        providerClient.forward.mockResolvedValue({
           response: new Response(failingBody(new Error('boom')), { status: 200 }),
           isGoogle: false,
           isAnthropic: false,
           isChatGpt: false,
         });
-        const original = {
-          response: new Response('{}', { status: 400 }),
-          isGoogle: false,
-          isAnthropic: false,
-          isChatGpt: false,
-          retryWireBody,
-        };
 
         const error = await service
-          .retryWireBody(
-            original,
-            { model: 'gpt-4o' },
-            {
-              provider: 'openai',
-              model: 'gpt-4o',
-              authType: 'api_key',
-              stream: false,
-              startProviderAttempt: jest.fn(() => started),
-            },
-          )
+          .tryForwardToProvider(forwardOpts({ startProviderAttempt: jest.fn(() => started) }))
           .catch((err: unknown) => err);
 
         expect(error).toBeInstanceOf(Error);
@@ -1761,210 +1736,6 @@ describe('ProxyFallbackService', () => {
     });
   });
 
-  describe('retryWireBody', () => {
-    it('delegates the healed body to the captured provider transport', async () => {
-      const healedBody = { model: 'gpt-4o', max_tokens: 128 };
-      const retried = {
-        response: new Response('{}', { status: 200 }),
-        isGoogle: false,
-        isAnthropic: false,
-        isChatGpt: false,
-      };
-      const retryWireBody = jest.fn().mockResolvedValue(retried);
-      const original = {
-        response: new Response('{}', { status: 400 }),
-        isGoogle: false,
-        isAnthropic: false,
-        isChatGpt: false,
-        retryWireBody,
-      };
-
-      await expect(service.retryWireBody(original, healedBody)).resolves.toBe(retried);
-      expect(retryWireBody).toHaveBeenCalledWith(healedBody);
-      expect(providerClient.forward).not.toHaveBeenCalled();
-    });
-
-    it('tracks the provider attempt for an exact wire-body retry', async () => {
-      const healedBody = { model: 'gpt-4o', max_tokens: 128 };
-      const attempt = {
-        id: 'attempt-2',
-        attemptNumber: 2,
-        startedAtMs: Date.now(),
-        startedAt: new Date().toISOString(),
-        pendingWrite: Promise.resolve(true),
-      };
-      const startProviderAttempt = jest.fn(() => attempt);
-      const retryWireBody = jest.fn().mockResolvedValue({
-        response: new Response('{}', { status: 200 }),
-        isGoogle: false,
-        isAnthropic: false,
-        isChatGpt: false,
-      });
-      const original = {
-        response: new Response('{}', { status: 400 }),
-        isGoogle: false,
-        isAnthropic: false,
-        isChatGpt: false,
-        retryWireBody,
-      };
-
-      const result = await service.retryWireBody(original, healedBody, {
-        provider: 'openai',
-        model: 'gpt-4o',
-        authType: 'api_key',
-        tenantProviderId: 'connection-1',
-        providerKeyLabel: 'Work',
-        startProviderAttempt,
-      });
-
-      // The retry rides the same connection as the original call, so the
-      // pending attempt row it opens must name that connection's label too.
-      expect(startProviderAttempt).toHaveBeenCalledWith({
-        provider: 'openai',
-        model: 'gpt-4o',
-        authType: 'api_key',
-        tenantProviderId: 'connection-1',
-        keyLabel: 'Work',
-      });
-      expect(result.attempt).toBe(attempt);
-      expect(result.providerCallStarted).toBe(true);
-      expect(attempt).toEqual(expect.objectContaining({ completedAtMs: expect.any(Number) }));
-      expect(providerClient.forward).not.toHaveBeenCalled();
-    });
-
-    it('tracks transport failures from an exact wire-body retry', async () => {
-      const healedBody = { model: 'gpt-4o', max_tokens: 128 };
-      const attempt = {
-        id: 'attempt-2',
-        attemptNumber: 2,
-        startedAtMs: Date.now(),
-        startedAt: new Date().toISOString(),
-        pendingWrite: Promise.resolve(true),
-      };
-      const retryWireBody = jest.fn().mockRejectedValue(new Error('fetch failed'));
-      const original = {
-        response: new Response('{}', { status: 400 }),
-        isGoogle: false,
-        isAnthropic: false,
-        isChatGpt: false,
-        retryWireBody,
-      };
-
-      const result = await service.retryWireBody(original, healedBody, {
-        provider: 'openai',
-        model: 'gpt-4o',
-        authType: 'api_key',
-        tenantProviderId: 'connection-1',
-        startProviderAttempt: jest.fn(() => attempt),
-      });
-
-      expect(result.response.status).toBe(503);
-      await expect(result.response.json()).resolves.toEqual({
-        error: { message: 'Failed to reach upstream provider' },
-      });
-      expect(result.attempt).toBe(attempt);
-      expect(result.providerCallStarted).toBe(true);
-      expect(attempt).toEqual(expect.objectContaining({ completedAtMs: expect.any(Number) }));
-      expect(providerClient.forward).not.toHaveBeenCalled();
-    });
-
-    it('turns a body-read failure on a non-streaming healed retry into a transport failure', async () => {
-      const failing = new ReadableStream<Uint8Array>({
-        start(controller) {
-          controller.error(new TypeError('terminated'));
-        },
-      });
-      const attempt = {
-        id: 'attempt-2',
-        attemptNumber: 2,
-        startedAtMs: Date.now(),
-        startedAt: new Date().toISOString(),
-        pendingWrite: Promise.resolve(true),
-      };
-      const retryWireBody = jest.fn().mockResolvedValue({
-        response: new Response(failing, { status: 200 }),
-        isGoogle: false,
-        isAnthropic: false,
-        isChatGpt: false,
-      });
-      const original = {
-        response: new Response('{}', { status: 400 }),
-        isGoogle: false,
-        isAnthropic: false,
-        isChatGpt: false,
-        retryWireBody,
-      };
-
-      const result = await service.retryWireBody(
-        original,
-        { model: 'gpt-4o' },
-        {
-          provider: 'openai',
-          model: 'gpt-4o',
-          authType: 'api_key',
-          stream: false,
-          startProviderAttempt: jest.fn(() => attempt),
-        },
-      );
-
-      expect(result.response.status).toBe(503);
-      await expect(result.response.json()).resolves.toEqual({
-        error: { message: 'Failed to reach upstream provider: terminated' },
-      });
-      expect(result.attempt).toBe(attempt);
-      expect(result.providerCallStarted).toBe(true);
-    });
-
-    it('records a route cooldown when the healed retry is rate-limited', async () => {
-      const retryWireBody = jest.fn().mockResolvedValue({
-        response: new Response('rate limited', {
-          status: 429,
-          headers: { 'retry-after': '30' },
-        }),
-        isGoogle: false,
-        isAnthropic: false,
-        isChatGpt: false,
-      });
-      const original = {
-        response: new Response('{}', { status: 400 }),
-        isGoogle: false,
-        isAnthropic: false,
-        isChatGpt: false,
-        retryWireBody,
-      };
-
-      await service.retryWireBody(
-        original,
-        { model: 'gpt-4o' },
-        {
-          provider: 'openai',
-          model: 'gpt-4o',
-          authType: 'api_key',
-          agentId: 'agent-1',
-          providerKeyLabel: 'Work',
-        },
-      );
-
-      // The next attempt on the same route must honor the cooldown instead of
-      // hammering a provider that just rate-limited the healed retry.
-      const next = await service.tryForwardToProvider({
-        provider: 'openai',
-        apiKey: 'sk-test',
-        model: 'gpt-4o',
-        body,
-        stream: false,
-        sessionKey: 'sess-1',
-        authType: 'api_key',
-        agentId: 'agent-1',
-        providerKeyLabel: 'Work',
-      });
-
-      expect(next.response.status).toBe(429);
-      expect(next.providerCallStarted).toBe(false);
-      expect(providerClient.forward).not.toHaveBeenCalled();
-    });
-  });
-
   describe('tryFallbacks', () => {
     it('returns success on first successful fallback', async () => {
       providerKeyService.getProviderApiKey.mockResolvedValue('sk-ant');
@@ -2640,7 +2411,7 @@ describe('ProxyFallbackService', () => {
 
       it('keeps a healthy fallback stream intact', async () => {
         const forward = streamForward(dataStream('data: one\n\ndata: two\n\n'), {
-          wireRequestBody: { model: 'claude-sonnet-4' },
+          wireFormat: 'anthropic_messages',
         });
         providerClient.forward.mockResolvedValueOnce(forward as never);
 
@@ -2650,224 +2421,41 @@ describe('ProxyFallbackService', () => {
         const served = result.success!.forward;
         expect(served.response.status).toBe(200);
         expect(served.response.headers.get('content-type')).toBe('text/event-stream');
-        expect(served.wireRequestBody).toEqual({ model: 'claude-sonnet-4' });
+        expect(served.wireFormat).toBe('anthropic_messages');
         expect(await served.response.text()).toBe('data: one\n\ndata: two\n\n');
         expect(result.failures).toHaveLength(0);
       });
-
-      it('warms up a healed retry before Autofix judges it', async () => {
-        const retryWireBody = jest.fn().mockResolvedValue(streamForward(stalledStream()));
-        providerClient.forward.mockResolvedValueOnce({
-          response: new Response('{"error":{"message":"bad param"}}', { status: 400 }),
-          wireRequestBody: { model: 'claude-sonnet-4', messages: [] },
-          wireApiMode: 'chat_completions',
-          retryWireBody,
-          providerCallStarted: true,
-          isGoogle: false,
-          isAnthropic: false,
-          isChatGpt: false,
-        } as never);
-        autofixService.isRepairable.mockReturnValue(true);
-        autofixService.maybeHeal.mockResolvedValue(null);
-
-        await runStream(['claude-sonnet-4']);
-
-        const healArgs = autofixService.maybeHeal.mock.calls[0][0];
-        const retried = await healArgs.reforward({ model: 'claude-sonnet-4', messages: [] });
-        // A retry whose stream stalls is a failed patch, not a healed request.
-        expect(retried.response.ok).toBe(false);
-        expect(retried.response.status).toBe(502);
-      });
     });
 
-    describe('Autofix on fallback hops', () => {
-      const failedForwardWithWire = (status: number, withRetry = true): Record<string, unknown> => {
-        const retryWireBody = jest.fn().mockResolvedValue({
-          response: new Response('{}', { status: 200 }),
-          isGoogle: false,
-          isAnthropic: false,
-          isChatGpt: false,
-        });
-        return {
-          response: new Response(
-            JSON.stringify({ error: { message: 'This response_format type is unavailable now' } }),
-            { status, headers: { 'content-type': 'application/json' } },
-          ),
-          wireRequestBody: { model: 'deepseek-flash', messages: [] },
-          wireApiMode: 'chat_completions',
-          ...(withRetry ? { retryWireBody } : {}),
-          providerCallStarted: true,
-          isGoogle: false,
-          isAnthropic: false,
-          isChatGpt: false,
-        };
-      };
-
-      const runFallback = (): Promise<{
-        success: { forward: unknown; provider: string; autofix?: unknown } | null;
-        failures: Array<{
-          status: number;
-          errorBody: string;
-          provider: string;
-          autofixRole?: string;
-          autofix?: unknown;
-        }>;
-      }> =>
-        service.tryFallbacks(
-          'agent-1',
-          'tenant-1',
-          ['deepseek-flash'],
-          body,
-          false,
-          'sess-1',
-          'gpt-4o',
-          undefined,
-          undefined,
-          undefined,
-          undefined,
-          undefined,
-          'chat_completions',
-          undefined,
-          [{ provider: 'opencode-go', authType: 'api_key', model: 'deepseek-flash' }],
-        ) as never;
-
-      it('heals a repairable failed fallback hop and returns the healed retry', async () => {
-        providerKeyService.getProviderApiKey.mockResolvedValue('sk-ant');
-        const failedForward = failedForwardWithWire(400);
-        providerClient.forward.mockResolvedValue(failedForward as never);
-
-        const healedForward = {
-          response: new Response('{}', { status: 200 }),
-          isGoogle: false,
-          isAnthropic: false,
-          isChatGpt: false,
-        };
-        autofixService.isRepairable.mockReturnValue(true);
-        const record = {
-          groupId: 'g',
-          outcome: 'healed' as const,
-          original_http_status: 400,
-          chain: [
-            { attempt: 0, origin: 'original' as const, request: {}, http_status: 400 },
-            { attempt: 1, origin: 'autofix' as const, request: {}, http_status: 200 },
-          ],
-        };
-        autofixService.maybeHeal.mockResolvedValue({
-          forward: healedForward as never,
-          record,
-        });
-
-        const result = await runFallback();
-
-        expect(result.success).not.toBeNull();
-        expect(result.success!.forward).toBe(healedForward);
-        expect(result.success!.provider).toBe('opencode-go');
-        // The fallback's own Phoenix audit travels with the winning retry.
-        expect(result.success!.autofix).toBe(record);
-        // The hop that failed first is still recorded for the audit trail.
-        expect(result.failures).toHaveLength(1);
-        expect(result.failures[0]).toMatchObject({ status: 400, provider: 'opencode-go' });
-        expect(result.failures[0].errorBody).toContain('response_format');
-        expect(result.failures[0].autofixRole).toBe('original');
-
-        const healArgs = autofixService.maybeHeal.mock.calls[0][0];
-        expect(healArgs).toMatchObject({
-          provider: 'opencode-go',
-          model: 'deepseek-flash',
-          authType: 'api_key',
-          apiMode: 'chat_completions',
-        });
-        // The reforward must reuse the SAME fallback transport, not re-resolve
-        // routing back to the primary.
-        await healArgs.reforward({ model: 'deepseek-flash', messages: [] });
-        expect(failedForward.retryWireBody as jest.Mock).toHaveBeenCalled();
-      });
-
-      it('records a normal fallback failure when Autofix has no patch', async () => {
-        providerKeyService.getProviderApiKey.mockResolvedValue('sk-ant');
-        providerClient.forward.mockResolvedValue(failedForwardWithWire(400) as never);
-        autofixService.isRepairable.mockReturnValue(true);
-        autofixService.maybeHeal.mockResolvedValue(null);
-
-        const result = await runFallback();
-
-        expect(result.success).toBeNull();
-        expect(result.failures).toHaveLength(1);
-        expect(result.failures[0].status).toBe(400);
-        expect(autofixService.maybeHeal).toHaveBeenCalledTimes(1);
+    describe('request-side 4xx on fallback hops', () => {
+      // Before #16 a 400/404/422 hop could be handed to a hosted repair
+      // service. It now takes the ordinary failure path: one recorded failure
+      // with the provider's own body, then the next route.
+      const failedForward = (status: number): Record<string, unknown> => ({
+        response: new Response(
+          JSON.stringify({ error: { message: 'This response_format type is unavailable now' } }),
+          { status, headers: { 'content-type': 'application/json' } },
+        ),
+        providerCallStarted: true,
+        isGoogle: false,
+        isAnthropic: false,
+        isChatGpt: false,
       });
-
-      it('does not consult Autofix for a non-repairable fallback status', async () => {
-        providerKeyService.getProviderApiKey.mockResolvedValue('sk-ant');
-        providerClient.forward.mockResolvedValue(failedForwardWithWire(500) as never);
-
-        const result = await runFallback();
-
-        expect(result.success).toBeNull();
-        expect(result.failures).toHaveLength(1);
-        expect(autofixService.maybeHeal).not.toHaveBeenCalled();
+      const okForward = () => ({
+        response: new Response('{"choices":[]}', { status: 200 }),
+        providerCallStarted: true,
+        isGoogle: false,
+        isAnthropic: false,
+        isChatGpt: false,
       });
 
-      it('does not consult Autofix when the fallback forward cannot be retried', async () => {
-        providerKeyService.getProviderApiKey.mockResolvedValue('sk-ant');
-        providerClient.forward.mockResolvedValue(failedForwardWithWire(400, false) as never);
-        autofixService.isRepairable.mockReturnValue(true);
-
-        const result = await runFallback();
-
-        expect(result.success).toBeNull();
-        expect(result.failures).toHaveLength(1);
-        expect(autofixService.maybeHeal).not.toHaveBeenCalled();
-      });
-
-      it('records both the original hop and the failed retry when a patch does not clear the error', async () => {
-        providerKeyService.getProviderApiKey.mockResolvedValue('sk-ant');
-        providerClient.forward.mockResolvedValue(failedForwardWithWire(400) as never);
-        autofixService.isRepairable.mockReturnValue(true);
-        const record = {
-          groupId: 'g',
-          outcome: 'exhausted' as const,
-          original_http_status: 400,
-          chain: [
-            { attempt: 0, origin: 'original' as const, request: {}, http_status: 400 },
-            { attempt: 1, origin: 'autofix' as const, request: {}, http_status: 400 },
-          ],
-        };
-        autofixService.maybeHeal.mockResolvedValue({
-          forward: {
-            response: new Response('still broken', { status: 400 }),
-            attempt: { id: 'retry-attempt' },
-            providerCallStarted: true,
-            isGoogle: false,
-            isAnthropic: false,
-            isChatGpt: false,
-          } as never,
-          record,
-        });
-
-        const result = await runFallback();
-
-        expect(result.success).toBeNull();
-        // Both provider attempts get a terminal row. The original must not be
-        // left dangling pending after Autofix consumed its response.
-        expect(result.failures).toHaveLength(2);
-        expect(result.failures[0]).toMatchObject({ status: 400, autofixRole: 'original' });
-        expect(result.failures[1]).toMatchObject({ status: 400, autofixRole: 'retry' });
-        expect(result.failures[0].errorBody).toContain('response_format');
-        expect(result.failures[1].errorBody).toBe('still broken');
-      });
-
-      it('skips Autofix when the fallback has no resolvable api mode', async () => {
-        providerKeyService.getProviderApiKey.mockResolvedValue('sk-ant');
-        const failedForward = failedForwardWithWire(400);
-        delete failedForward.wireApiMode;
-        providerClient.forward.mockResolvedValue(failedForward as never);
-        autofixService.isRepairable.mockReturnValue(true);
-
-        const result = await service.tryFallbacks(
+      const runFallback = (
+        routes: Array<{ provider: string; model: string }>,
+      ): ReturnType<ProxyFallbackService['tryFallbacks']> =>
+        service.tryFallbacks(
           'agent-1',
           'tenant-1',
-          ['deepseek-flash'],
+          routes.map((r) => r.model),
           body,
           false,
           'sess-1',
@@ -2877,54 +2465,68 @@ describe('ProxyFallbackService', () => {
           undefined,
           undefined,
           undefined,
-          undefined, // apiMode
+          'chat_completions',
           undefined,
-          [{ provider: 'opencode-go', authType: 'api_key', model: 'deepseek-flash' }],
+          routes.map((r) => ({ ...r, authType: 'api_key' as const })),
         );
 
-        expect(result.success).toBeNull();
-        expect(result.failures).toHaveLength(1);
-        expect(autofixService.maybeHeal).not.toHaveBeenCalled();
-      });
-
-      it('stamps the Phoenix decision on an unfixable fallback hop', async () => {
-        providerKeyService.getProviderApiKey.mockResolvedValue('sk-ant');
-        providerClient.forward.mockResolvedValue(failedForwardWithWire(400) as never);
-        autofixService.isRepairable.mockReturnValue(true);
-        const record = {
-          groupId: 'g',
-          outcome: 'unfixable' as const,
-          original_http_status: 400,
-          chain: [
-            {
-              attempt: 0,
-              origin: 'original' as const,
-              request: {},
-              http_status: 400,
-              issue_id: 'issue-1',
-              operations: [{ type: 'drop_param' }],
-            },
-          ],
-        };
-        autofixService.maybeHeal.mockResolvedValue({
-          forward: {
-            response: new Response('still broken', { status: 400 }),
-            isGoogle: false,
-            isAnthropic: false,
-            isChatGpt: false,
-            providerCallStarted: true,
-          } as never,
-          record,
-        });
+      it.each([400, 404, 422])(
+        'records a %i hop once, with the provider body, and moves to the next route',
+        async (status) => {
+          providerKeyService.getProviderApiKey.mockResolvedValue('sk-test');
+          providerClient.forward
+            .mockResolvedValueOnce(failedForward(status) as never)
+            .mockResolvedValueOnce(okForward() as never);
+
+          const result = await runFallback([
+            { provider: 'opencode-go', model: 'deepseek-flash' },
+            { provider: 'openai', model: 'gpt-4o-mini' },
+          ]);
+
+          expect(providerClient.forward).toHaveBeenCalledTimes(2);
+          expect(result.success).toMatchObject({ provider: 'openai', fallbackIndex: 1 });
+          expect(result.failures).toHaveLength(1);
+          expect(result.failures[0]).toMatchObject({
+            provider: 'opencode-go',
+            model: 'deepseek-flash',
+            fallbackIndex: 0,
+            status,
+          });
+          expect(result.failures[0].errorBody).toContain('response_format type is unavailable');
+          // Exactly the plain failure shape: no repair audit rides along.
+          expect(Object.keys(result.failures[0]).sort()).toEqual(
+            [
+              'attempt',
+              'authType',
+              'errorBody',
+              'fallbackIndex',
+              'keyLabel',
+              'model',
+              'provider',
+              'providerCallStarted',
+              'status',
+              'tenantProviderId',
+            ].sort(),
+          );
+        },
+      );
 
-        const result = await runFallback();
+      it('returns every hop as a failure when all of them reject the request', async () => {
+        providerKeyService.getProviderApiKey.mockResolvedValue('sk-test');
+        providerClient.forward
+          .mockResolvedValueOnce(failedForward(400) as never)
+          .mockResolvedValueOnce(failedForward(422) as never);
+
+        const result = await runFallback([
+          { provider: 'opencode-go', model: 'deepseek-flash' },
+          { provider: 'openai', model: 'gpt-4o-mini' },
+        ]);
 
         expect(result.success).toBeNull();
-        // No retry was sent, so this is the original hop and it still carries
-        // Phoenix's decision for the audit trail.
-        expect(result.failures).toHaveLength(1);
-        expect(result.failures[0]).toMatchObject({ status: 400, autofixRole: 'original' });
-        expect(result.failures[0].autofix).toBe(record);
+        expect(result.failures.map((f) => [f.provider, f.status])).toEqual([
+          ['opencode-go', 400],
+          ['openai', 422],
+        ]);
       });
     });
   });
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.routes.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.routes.spec.ts
index ef118e84..a5c6f079 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.routes.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.routes.spec.ts
@@ -156,43 +156,4 @@ describe('ProxyMessageRecorder.recordFailedFallbacks — per-failure auth_type',
     expect(rows[0].auth_type).toBe('subscription');
     expect(rows[1].auth_type).toBe('api_key');
   });
-
-  it('stamps the Autofix audit carried by a recovered fallback hop', async () => {
-    const failures = [
-      {
-        model: 'deepseek-flash',
-        provider: 'opencode-go',
-        status: 400,
-        errorBody: 'response_format unavailable',
-        fallbackIndex: 0,
-        autofixRole: 'original' as const,
-        autofix: {
-          groupId: 'group-1',
-          outcome: 'healed' as const,
-          original_http_status: 400,
-          chain: [
-            {
-              attempt: 0,
-              origin: 'original' as const,
-              request: {},
-              http_status: 400,
-              issue_id: 'issue-1',
-              patch_id: 'patch-1',
-              operations: [{ type: 'drop_param' }],
-            },
-            { attempt: 1, origin: 'autofix' as const, request: {}, http_status: 200 },
-          ],
-        },
-      },
-    ];
-
-    await recorder.recordFailedFallbacks(ctx, 'standard', 'gpt-4o', failures);
-
-    const rows = insertMock.mock.calls[0][0] as Array<Record<string, unknown>>;
-    expect(rows[0]).toMatchObject({
-      autofix_applied: true,
-      autofix_group_id: 'group-1',
-      autofix_role: 'original',
-    });
-  });
 });
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.spec.ts
index f5f1ae8f..ce0defc1 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy-message-recorder.spec.ts
@@ -2,33 +2,8 @@ import { ProxyMessageRecorder } from '../proxy-message-recorder';
 import { ModelPricingCacheService } from '../../../model-prices/model-pricing-cache.service';
 import { IngestEventBusService } from '../../../common/services/ingest-event-bus.service';
 import { IngestionContext } from '../../../otlp/interfaces/ingestion-context.interface';
-import type { AutofixRecord } from '../../autofix/autofix.types';
 import type { ProviderAttemptRef } from '../proxy-types';
 
-const sampleAutofix: AutofixRecord = {
-  groupId: 'grp-1',
-  outcome: 'healed',
-  original_http_status: 400,
-  chain: [
-    {
-      attempt: 0,
-      origin: 'original',
-      request: { max_tokens: 5 },
-      http_status: 400,
-      error: {
-        message: 'Unknown parameter',
-        type: 'invalid_request_error',
-        param: 'max_tokens',
-        code: 'unknown_parameter',
-      },
-      operations: [{ type: 'rename_param', from: 'max_tokens', to: 'max_output_tokens' }],
-      heal_attempt_id: 'heal-1',
-      patch_worked: true,
-    },
-    { attempt: 1, origin: 'autofix', request: { max_output_tokens: 5 }, http_status: 200 },
-  ],
-};
-
 const ctx: IngestionContext = {
   tenantId: 'tenant-1',
   agentId: 'agent-1',
@@ -387,63 +362,6 @@ describe('ProxyMessageRecorder', () => {
       });
     });
 
-    it('stamps the Autofix retry columns when the fallback hop was healed', async () => {
-      await recorder.recordFallbackSuccess(ctx, 'deepseek-flash', 'standard', {
-        fallbackFromModel: 'gpt-4o',
-        fallbackIndex: 0,
-        timestamp: new Date().toISOString(),
-        authType: 'api_key',
-        fallbackAutofix: {
-          groupId: 'group-1',
-          outcome: 'healed',
-          original_http_status: 400,
-          chain: [
-            {
-              attempt: 0,
-              origin: 'original',
-              request: {},
-              http_status: 400,
-              issue_id: 'issue-1',
-              patch_id: 'patch-1',
-              operations: [{ type: 'drop_param' }],
-            },
-            { attempt: 1, origin: 'autofix', request: {}, http_status: 200 },
-          ],
-        },
-      });
-
-      expect(insertMock.mock.calls[0][0]).toMatchObject({
-        autofix_applied: true,
-        autofix_group_id: 'group-1',
-        autofix_role: 'retry',
-      });
-    });
-
-    it('does not stamp the primary Autofix record on an ordinary fallback success', async () => {
-      // Regression: a failed primary Autofix that later fell back must not leak
-      // its retry metadata onto the winning fallback's row.
-      await recorder.recordFallbackSuccess(ctx, 'gpt-4o', 'standard', {
-        fallbackFromModel: 'claude-opus',
-        fallbackIndex: 0,
-        timestamp: new Date().toISOString(),
-        authType: 'api_key',
-        autofix: {
-          groupId: 'primary-group',
-          outcome: 'exhausted',
-          original_http_status: 400,
-          chain: [
-            { attempt: 0, origin: 'original', request: {}, http_status: 400 },
-            { attempt: 1, origin: 'autofix', request: {}, http_status: 400 },
-          ],
-        },
-      });
-
-      const row = insertMock.mock.calls[0][0] as Record<string, unknown>;
-      expect(row.autofix_applied).toBeUndefined();
-      expect(row.autofix_group_id).toBeUndefined();
-      expect(row.autofix_role).toBeUndefined();
-    });
-
     it('inserts when only prompt_tokens is non-zero', async () => {
       await recorder.recordFallbackSuccess(ctx, 'gpt-4o', 'standard', {
         traceId: 'trace-1',
@@ -939,102 +857,6 @@ describe('ProxyMessageRecorder', () => {
       });
     });
 
-    it('keeps the failed row and stamps the decision when a heal did not clear the block', async () => {
-      const before = Date.now();
-      await recorder.recordManifestBlockedRequest(ctx, {
-        errorMessage: '[🦚 Manifest M302] Model "ghost" is not available for this agent.',
-        errorCode: 'M302',
-        reason: 'model_not_available',
-        autofix: {
-          groupId: 'g-miss',
-          outcome: 'unfixable',
-          original_http_status: 404,
-          chain: [
-            {
-              attempt: 0,
-              origin: 'original',
-              request: { model: 'ghost' },
-              http_status: 404,
-              error: { message: 'model not found' },
-              phoenix_status: 'no_patch',
-              issue_id: 'issue-m302',
-            },
-          ],
-        },
-      });
-
-      const row = insertMock.mock.calls[0][0];
-      expect(row).toMatchObject({
-        status: 'failed',
-        error_code: 'M302',
-        superseded: false,
-        autofix_decision: {
-          status: 'no_patch',
-          issueId: 'issue-m302',
-          patchId: null,
-          healAttemptId: null,
-          explanation: null,
-        },
-      });
-      expect(row.autofix_applied).toBeUndefined();
-      expect(new Date(row.timestamp).getTime()).toBeGreaterThanOrEqual(before - 100);
-    });
-
-    it('finalizes the real provider retry when a patched M302 still fails', async () => {
-      const completeFailure = jest.fn().mockResolvedValue(undefined);
-      await recorder.recordManifestBlockedRequest(ctx, {
-        errorMessage: '[🦚 Manifest M302] Model "ghost" is not available for this agent.',
-        errorCode: 'M302',
-        reason: 'model_not_available',
-        attempt: {
-          id: 'attempt-m302-retry',
-          attemptNumber: 1,
-          startedAtMs: 1_000,
-          startedAt: '1970-01-01T00:00:01.000Z',
-          pendingWrite: Promise.resolve(true),
-          completeFailure,
-        },
-        autofix: {
-          groupId: 'g-retry-failed',
-          outcome: 'exhausted',
-          original_http_status: 404,
-          chain: [
-            {
-              attempt: 0,
-              origin: 'original',
-              request: { model: 'ghost' },
-              http_status: 404,
-              error: { message: 'model not found' },
-            },
-            {
-              attempt: 1,
-              origin: 'autofix',
-              request: { model: 'still-ghost' },
-              http_status: 503,
-              error: {
-                message: 'patched provider failed',
-                type: 'server_error',
-                param: null,
-                code: 'upstream_unavailable',
-              },
-            },
-          ],
-        },
-      });
-
-      expect(completeFailure).toHaveBeenCalledWith({
-        status: 503,
-        errorBody: JSON.stringify({
-          error: {
-            message: 'patched provider failed',
-            type: 'server_error',
-            code: 'upstream_unavailable',
-          },
-        }),
-        superseded: false,
-      });
-    });
-
     it('records an expired key as a setup error against its agent', async () => {
       await recorder.recordManifestBlockedRequest(ctx, {
         httpStatus: 401,
@@ -1602,39 +1424,24 @@ describe('ProxyMessageRecorder', () => {
       expect(insertMock.mock.calls[0][0].routing_reason).toBe('header-match');
     });
 
-    it('records the superseded patched retry when heal-then-fallback ran', async () => {
-      await recorder.recordPrimaryFailure(
-        ctx,
-        'standard',
-        'gpt-4o',
-        'Unknown parameter',
-        '2025-01-01T00:00:00.000Z',
-        'api_key',
-        { provider: 'openai', autofix: sampleAutofix, httpStatus: 400 },
-      );
-      const row = insertMock.mock.calls[0][0];
-      expect(row.status).toBe('failed');
-      expect(row.superseded).toBe(true);
-      expect(row.autofix_applied).toBe(true);
-      expect(row.autofix_group_id).toBe('grp-1');
-      expect(row.autofix_role).toBe('retry');
-      expect(row.error_http_status).toBe(400);
-      expect(row.autofix_operations).toEqual([
-        { type: 'rename_param', from: 'max_tokens', to: 'max_output_tokens' },
-      ]);
-    });
-
-    it('leaves autofix columns unset on a plain primary failure (no autofix)', async () => {
+    it('records a plain superseded primary failure', async () => {
       await recorder.recordPrimaryFailure(
         ctx,
         'standard',
         'gpt-4o',
         'upstream error',
         '2025-01-01T00:00:00.000Z',
+        'api_key',
+        { provider: 'openai', httpStatus: 400 },
       );
       const row = insertMock.mock.calls[0][0];
-      expect(row.autofix_applied).toBeUndefined();
-      expect(row.autofix_group_id).toBeUndefined();
+      expect(row).toMatchObject({
+        status: 'failed',
+        superseded: true,
+        error_http_status: 400,
+        provider: 'openai',
+      });
+      expect(Object.keys(row).filter((key) => key.startsWith('auto'))).toEqual([]);
     });
   });
 
@@ -2137,271 +1944,6 @@ describe('ProxyMessageRecorder', () => {
     });
   });
 
-  describe('autofix persistence', () => {
-    const operations = [{ type: 'rename_param', from: 'max_tokens', to: 'max_output_tokens' }];
-    const failedRetryAutofix: AutofixRecord = {
-      ...sampleAutofix,
-      outcome: 'exhausted',
-      chain: [
-        sampleAutofix.chain[0],
-        {
-          attempt: 1,
-          origin: 'autofix',
-          request: { max_output_tokens: 5 },
-          http_status: 400,
-          error: { message: 'Retry also failed' },
-        },
-      ],
-    };
-
-    it('recordProviderError records a failed patched request as the retry', async () => {
-      await recorder.recordProviderError(ctx, 400, 'Retry also failed', {
-        autofix: failedRetryAutofix,
-      });
-      const row = insertMock.mock.calls.at(-1)![0];
-      expect(row.autofix_applied).toBe(true);
-      expect(row.autofix_group_id).toBe('grp-1');
-      expect(row.autofix_role).toBe('retry');
-      expect(row.autofix_operations).toEqual(operations);
-    });
-
-    it('recordProviderError keeps a no-patch Phoenix audit without claiming Autofix', async () => {
-      const noPatch: AutofixRecord = {
-        groupId: 'grp-no-patch',
-        outcome: 'unfixable',
-        original_http_status: 400,
-        chain: [
-          {
-            attempt: 0,
-            origin: 'original',
-            request: {},
-            http_status: 400,
-            error: { message: 'Unknown parameter' },
-            phoenix_status: 'no_patch',
-            issue_id: 'issue-no-patch',
-            patch_id: null,
-            heal_attempt_id: null,
-          },
-        ],
-      };
-
-      await recorder.recordProviderError(ctx, 400, 'Unknown parameter', { autofix: noPatch });
-
-      const row = insertMock.mock.calls.at(-1)![0];
-      expect(row.autofix_applied).toBeUndefined();
-      expect(row.autofix_group_id).toBeUndefined();
-      expect(row.autofix_role).toBeUndefined();
-      expect(row.autofix_decision).toEqual({
-        status: 'no_patch',
-        issueId: 'issue-no-patch',
-        patchId: null,
-        healAttemptId: null,
-        explanation: null,
-      });
-    });
-
-    it('recordPrimaryFailure keeps a failed retry identity through fallback', async () => {
-      await recorder.recordPrimaryFailure(
-        ctx,
-        'standard',
-        'gpt-4o',
-        'Retry also failed',
-        '2026-07-15T12:00:00.000Z',
-        'api_key',
-        { autofix: failedRetryAutofix, httpStatus: 400 },
-      );
-
-      const row = insertMock.mock.calls.at(-1)![0];
-      expect(row.status).toBe('failed');
-      expect(row.superseded).toBe(true);
-      expect(row.error_http_status).toBe(400);
-      expect(row.autofix_applied).toBe(true);
-      expect(row.autofix_role).toBe('retry');
-      expect(row.autofix_group_id).toBe('grp-1');
-    });
-
-    it('recordProviderError leaves autofix columns unset when omitted', async () => {
-      await recorder.recordProviderError(ctx, 400, 'boom');
-      const row = insertMock.mock.calls.at(-1)![0];
-      expect(row.autofix_applied).toBeUndefined();
-      expect(row.autofix_group_id).toBeUndefined();
-    });
-
-    it('recordAutofixOriginal writes a linked auto_fixed original row', async () => {
-      await recorder.recordAutofixOriginal(ctx, 'gpt-4o', 'default', sampleAutofix, {
-        provider: 'openai',
-        reason: 'default',
-        authType: 'api_key',
-        traceId: 'trace-af',
-      });
-      const row = insertMock.mock.calls.at(-1)![0] as Record<string, unknown>;
-      expect(row.status).toBe('failed');
-      expect(row.superseded).toBe(true);
-      expect(row.error_http_status).toBe(400);
-      // The full provider envelope, like every other error row. Storing the bare message
-      // would drop type/param/code — the dimensions that identify the error downstream.
-      expect(JSON.parse(row.error_message as string)).toEqual({
-        error: {
-          message: 'Unknown parameter',
-          type: 'invalid_request_error',
-          param: 'max_tokens',
-          code: 'unknown_parameter',
-        },
-      });
-      expect(row.autofix_applied).toBe(true);
-      expect(row.autofix_group_id).toBe('grp-1');
-      expect(row.autofix_role).toBe('original');
-      expect(row.autofix_operations).toEqual(operations);
-      // Persist Phoenix's own identifiers for the heal decision. sampleAutofix's
-      // failed entry carries only heal_attempt_id, so issueId/patchId fall to
-      // null while healAttemptId is preserved (covers the non-null branch).
-      expect(row.autofix_decision).toEqual({
-        status: null,
-        issueId: null,
-        patchId: null,
-        healAttemptId: 'heal-1',
-        explanation: null,
-      });
-    });
-
-    it('recordAutofixOriginal falls each absent Phoenix id to null while keeping the present one', async () => {
-      // The ternary is entered via patch_id alone, so issueId + healAttemptId
-      // exercise the `?? null` fallback (covers the null side of each field).
-      await recorder.recordAutofixOriginal(ctx, 'gpt-4o', 'default', {
-        ...sampleAutofix,
-        chain: [
-          {
-            attempt: 0,
-            origin: 'original',
-            request: { max_tokens: 5 },
-            http_status: 400,
-            error: { message: 'Unknown parameter' },
-            patch_id: 'patch-xyz',
-          },
-          { attempt: 1, origin: 'autofix', request: { max_output_tokens: 5 }, http_status: 200 },
-        ],
-      });
-      const row = insertMock.mock.calls.at(-1)![0] as Record<string, unknown>;
-      expect(row.autofix_decision).toEqual({
-        status: null,
-        issueId: null,
-        patchId: 'patch-xyz',
-        healAttemptId: null,
-        explanation: null,
-      });
-    });
-
-    it('recordAutofixOriginal carries the Phoenix explanation onto autofix_decision', async () => {
-      // Phoenix's human-readable "why" is persisted alongside the ids so the
-      // dashboard Autofix card can render it (not re-derive it locally).
-      const explanation = {
-        summary: 'Renamed the "max_tokens" parameter to "max_output_tokens".',
-        operations: [
-          {
-            type: 'rename_param',
-            detail: 'Renamed the "max_tokens" parameter to "max_output_tokens".',
-          },
-        ],
-        source: 'deterministic' as const,
-      };
-      await recorder.recordAutofixOriginal(ctx, 'gpt-4o', 'default', {
-        ...sampleAutofix,
-        chain: [
-          {
-            attempt: 0,
-            origin: 'original',
-            request: { max_tokens: 5 },
-            http_status: 400,
-            error: { message: 'Unknown parameter' },
-            issue_id: 'issue-9',
-            heal_attempt_id: 'heal-9',
-            explanation,
-          },
-          { attempt: 1, origin: 'autofix', request: { max_output_tokens: 5 }, http_status: 200 },
-        ],
-      });
-      const row = insertMock.mock.calls.at(-1)![0] as Record<string, unknown>;
-      expect(row.autofix_decision).toEqual({
-        status: null,
-        issueId: 'issue-9',
-        patchId: null,
-        healAttemptId: 'heal-9',
-        explanation,
-      });
-    });
-
-    it('recordAutofixOriginal sets autofix_decision to null when the failed entry has no Phoenix ids', async () => {
-      // A failed chain entry with none of issue_id/patch_id/heal_attempt_id must
-      // leave autofix_decision null (covers the `: null` branch of the ternary).
-      await recorder.recordAutofixOriginal(ctx, 'gpt-4o', 'default', {
-        ...sampleAutofix,
-        chain: [
-          {
-            attempt: 0,
-            origin: 'original',
-            request: { max_tokens: 5 },
-            http_status: 400,
-            error: { message: 'Unknown parameter' },
-          },
-          { attempt: 1, origin: 'autofix', request: { max_output_tokens: 5 }, http_status: 200 },
-        ],
-      });
-      const row = insertMock.mock.calls.at(-1)![0] as Record<string, unknown>;
-      expect(row.autofix_decision).toBeNull();
-    });
-
-    it('recordAutofixOriginal is a no-op when the chain has no failed original', async () => {
-      await recorder.recordAutofixOriginal(ctx, 'gpt-4o', 'default', {
-        ...sampleAutofix,
-        chain: [{ attempt: 1, origin: 'autofix', request: {}, http_status: 200 }],
-      });
-      expect(insertMock).not.toHaveBeenCalled();
-    });
-
-    it('recordAutofixOriginal is a no-op when Phoenix supplied no patch', async () => {
-      await recorder.recordAutofixOriginal(ctx, 'gpt-4o', 'default', {
-        ...sampleAutofix,
-        outcome: 'unfixable',
-        chain: [sampleAutofix.chain[0]],
-      });
-      expect(insertMock).not.toHaveBeenCalled();
-    });
-
-    it('recordSuccessMessage persists the autofix audit on insert and update paths', async () => {
-      await recorder.recordSuccessMessage(
-        ctx,
-        'gpt-4o',
-        'standard',
-        'scored',
-        { prompt_tokens: 1, completion_tokens: 1 },
-        { autofix: sampleAutofix },
-      );
-      const inserted = insertMock.mock.calls.at(-1)![0];
-      expect(inserted.autofix_applied).toBe(true);
-      expect(inserted.autofix_role).toBe('retry');
-      expect(inserted.autofix_group_id).toBe('grp-1');
-
-      const attempt: ProviderAttemptRef = {
-        id: 'attempt-autofix-update',
-        attemptNumber: 1,
-        startedAtMs: 1_000,
-        startedAt: '1970-01-01T00:00:01.000Z',
-        completedAtMs: 1_050,
-        pendingWrite: Promise.resolve(true),
-      };
-      await recorder.recordSuccessMessage(
-        ctx,
-        'gpt-4o',
-        'standard',
-        'scored',
-        { prompt_tokens: 5, completion_tokens: 5 },
-        { autofix: sampleAutofix, attempt },
-      );
-      expect(updateMock.mock.calls[0][1].autofix_applied).toBe(true);
-      expect(updateMock.mock.calls[0][1].autofix_role).toBe('retry');
-    });
-  });
-
   describe('cooldown overflow eviction', () => {
     it('evicts expired entries when cooldown map exceeds MAX_COOLDOWN_ENTRIES', async () => {
       // Fill the cooldown map to capacity by recording 429 errors for unique agents
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy-request-recorder.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy-request-recorder.spec.ts
index e703bcf6..c031cc9b 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy-request-recorder.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy-request-recorder.spec.ts
@@ -1,5 +1,4 @@
 import { ProxyMessageRecorder } from '../proxy-message-recorder';
-import type { AutofixRecord } from '../../autofix/autofix.types';
 
 describe('ProxyMessageRecorder request parents', () => {
   const ctx = {
@@ -60,7 +59,6 @@ describe('ProxyMessageRecorder request parents', () => {
       expect.objectContaining({
         id: 'request-1',
         status: 'failed',
-        autofix_status: null,
         error_origin: 'transport',
         api_mode: 'responses',
       }),
@@ -273,51 +271,16 @@ describe('ProxyMessageRecorder request parents', () => {
     recorder.onModuleDestroy();
   });
 
-  it.each([
-    [
-      'no_patch',
-      [
-        {
-          attempt: 0,
-          origin: 'original',
-          request: {},
-          http_status: 400,
-          phoenix_status: 'no_patch',
-        },
-      ],
-    ],
-    [
-      'resolving',
-      [
-        {
-          attempt: 0,
-          origin: 'original',
-          request: {},
-          http_status: 400,
-          phoenix_status: 'resolving',
-        },
-      ],
-    ],
-    ['retry_succeeded', [{ attempt: 1, origin: 'autofix', request: {}, http_status: 200 }]],
-    ['retry_failed', [{ attempt: 1, origin: 'autofix', request: {}, http_status: 422 }]],
-    ['service_error', []],
-  ] as const)('records the %s Autofix outcome on the request', async (expected, chain) => {
+  it('writes no repair outcome column on the request row', async () => {
     const { recorder, requestValues } = setup();
-    const autofix: AutofixRecord = {
-      groupId: 'autofix-1',
-      outcome: 'exhausted',
-      original_http_status: 400,
-      chain: [...chain],
-    } as AutofixRecord;
 
     await recorder.recordProviderError(ctx, 400, 'provider error', {
-      requestId: `request-${expected}`,
-      autofix,
+      requestId: 'request-plain-400',
     });
 
-    expect(requestValues).toHaveBeenCalledWith(
-      expect.objectContaining({ autofix_status: expected }),
-    );
+    const row = requestValues.mock.calls[0][0] as Record<string, unknown>;
+    expect(row).toMatchObject({ id: 'request-plain-400', status: 'failed' });
+    expect(Object.keys(row).filter((key) => key.startsWith('auto'))).toEqual([]);
     recorder.onModuleDestroy();
   });
 
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy-response-handler.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy-response-handler.spec.ts
index 8baedf20..7839852a 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy-response-handler.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy-response-handler.spec.ts
@@ -12,7 +12,6 @@ import { FailedFallback } from '../proxy-fallback.service';
 import { IngestionContext } from '../../../otlp/interfaces/ingestion-context.interface';
 import { StreamUsage } from '../stream-writer';
 import { Logger } from '@nestjs/common';
-import type { AutofixRecord } from '../../autofix/autofix.types';
 
 const testCtx: IngestionContext = {
   tenantId: 'tenant-1',
@@ -58,34 +57,6 @@ function mockRecorder() {
     recordFallbackSuccess: jest.fn().mockResolvedValue(undefined),
     recordSuccessMessage: jest.fn().mockResolvedValue(undefined),
     recordManifestBlockedRequest: jest.fn().mockResolvedValue(undefined),
-    recordAutofixOriginal: jest.fn().mockResolvedValue(undefined),
-  };
-}
-
-function failedAutofixRetry(): AutofixRecord {
-  return {
-    groupId: 'grp-failed-retry',
-    outcome: 'exhausted',
-    original_http_status: 400,
-    chain: [
-      {
-        attempt: 0,
-        origin: 'original',
-        request: { max_tokens: 5 },
-        http_status: 400,
-        error: { message: 'Unknown parameter' },
-        issue_id: 'issue-1',
-        patch_id: 'patch-1',
-        heal_attempt_id: 'heal-1',
-      },
-      {
-        attempt: 1,
-        origin: 'autofix',
-        request: { max_output_tokens: 5 },
-        http_status: 422,
-        error: { message: 'Retry also failed' },
-      },
-    ],
   };
 }
 
@@ -166,7 +137,6 @@ describe('proxy-response-handler', () => {
         'trace-1',
         undefined,
         undefined,
-        undefined,
         'request-1',
         undefined,
         'responses',
@@ -254,40 +224,49 @@ describe('proxy-response-handler', () => {
       );
     });
 
-    it('records the original and terminal retry when a patched request fails', async () => {
+    it('records a request-side 4xx as one provider error on the first attempt', async () => {
       const { res } = mockResponse();
       const recorder = mockRecorder();
       const meta = makeMeta();
-      const autofix = failedAutofixRetry();
+      const body = JSON.stringify({ error: { message: 'Unknown parameter: max_tokens' } });
 
       await handleProviderError(
         res as any,
         testCtx,
         meta,
         buildMetaHeaders(meta),
-        422,
-        'Retry also failed',
+        400,
+        body,
         undefined,
         recorder as any,
-        'trace-retry',
+        'trace-400',
         null,
         { 'x-request': '1' },
-        autofix,
+        'request-400',
       );
 
-      expect(recorder.recordAutofixOriginal).toHaveBeenCalledWith(
-        testCtx,
-        'gpt-4o',
-        'standard',
-        autofix,
-        expect.objectContaining({ traceId: 'trace-retry', provider: 'openai' }),
-      );
+      expect(recorder.recordProviderError).toHaveBeenCalledTimes(1);
       expect(recorder.recordProviderError).toHaveBeenCalledWith(
         testCtx,
-        422,
-        'Retry also failed',
-        expect.objectContaining({ autofix }),
+        400,
+        body,
+        expect.objectContaining({
+          requestId: 'request-400',
+          attemptNumber: 1,
+          traceId: 'trace-400',
+          provider: 'openai',
+        }),
       );
+      expect(recorder.recordPrimaryFailure).not.toHaveBeenCalled();
+      expect(recorder.recordFailedFallbacks).not.toHaveBeenCalled();
+      expect(res.status).toHaveBeenCalledWith(400);
+      expect(res.json).toHaveBeenCalledWith({
+        error: expect.objectContaining({
+          message: 'Unknown parameter: max_tokens',
+          source: 'provider',
+          status: 400,
+        }),
+      });
     });
 
     it('should handle fallback exhausted when failedFallbacks present and no fallbackFromModel', async () => {
@@ -317,7 +296,6 @@ describe('proxy-response-handler', () => {
         undefined,
         undefined,
         undefined,
-        undefined,
         'request-exhausted',
         undefined,
         'messages',
@@ -364,56 +342,6 @@ describe('proxy-response-handler', () => {
       );
     });
 
-    it('keeps a no-patch audit unlinked when the fallback chain exhausted', async () => {
-      const { res } = mockResponse();
-      const recorder = mockRecorder();
-      const meta = makeMeta();
-      const metaHeaders = buildMetaHeaders(meta);
-      const failedFallbacks: FailedFallback[] = [
-        { model: 'claude', provider: 'anthropic', fallbackIndex: 0, status: 500, errorBody: 'x' },
-      ];
-      const autofix: AutofixRecord = {
-        groupId: 'grp-exh',
-        outcome: 'unfixable',
-        original_http_status: 400,
-        chain: [
-          {
-            attempt: 0,
-            origin: 'original',
-            request: {},
-            http_status: 400,
-            error: { message: 'x' },
-          },
-        ],
-      };
-
-      await handleProviderError(
-        res as any,
-        testCtx,
-        meta,
-        metaHeaders,
-        400,
-        'Bad Request',
-        failedFallbacks,
-        recorder as any,
-        undefined,
-        undefined,
-        undefined,
-        autofix,
-      );
-
-      expect(recorder.recordPrimaryFailure).toHaveBeenCalledWith(
-        testCtx,
-        expect.anything(),
-        'gpt-4o',
-        expect.any(String),
-        expect.any(String),
-        undefined,
-        expect.objectContaining({ autofix, httpStatus: 400 }),
-      );
-      expect(recorder.recordAutofixOriginal).not.toHaveBeenCalled();
-    });
-
     it('preserves provider context overflow code when fallback chain is exhausted', async () => {
       const { res } = mockResponse();
       const recorder = mockRecorder();
@@ -579,7 +507,6 @@ describe('proxy-response-handler', () => {
         undefined,
         undefined,
         undefined,
-        undefined,
         'messages',
       );
 
@@ -776,7 +703,6 @@ describe('proxy-response-handler', () => {
           undefined,
           undefined,
           undefined,
-          undefined,
           'messages',
         );
 
@@ -855,7 +781,6 @@ describe('proxy-response-handler', () => {
         undefined,
         undefined,
         undefined,
-        undefined,
         'messages',
       );
 
@@ -881,7 +806,6 @@ describe('proxy-response-handler', () => {
       errorStatus?: number;
       errorBody?: string;
       failedFallbacks?: FailedFallback[];
-      autofix?: AutofixRecord;
       meta?: Partial<RoutingMeta>;
     }) {
       const { res, headers } = mockResponse();
@@ -904,7 +828,6 @@ describe('proxy-response-handler', () => {
         undefined,
         undefined,
         undefined,
-        opts.autofix,
         'request-shape',
       );
       const body = res.json.mock.calls[0][0] as { error: Record<string, unknown> };
@@ -1007,78 +930,30 @@ describe('proxy-response-handler', () => {
       ]);
     });
 
-    it('summarizes the primary Autofix attempt only when Phoenix was consulted', async () => {
-      const withAutofix = await exhausted({ autofix: failedAutofixRetry() });
-      expect(withAutofix.error.autofix).toEqual({
-        applied: true,
-        original_status: 400,
-        retry_status: 422,
-      });
-
-      const without = await exhausted({});
-      expect(without.error).not.toHaveProperty('autofix');
-    });
-
-    it('collapses a patched-then-failed fallback hop into one entry carrying its Autofix summary', async () => {
-      const retried = failedAutofixRetry();
-      const unfixable: AutofixRecord = {
-        groupId: 'grp-unfixable',
-        outcome: 'unfixable',
-        original_http_status: 403,
-        chain: [
-          {
-            attempt: 0,
-            origin: 'original',
-            request: {},
-            http_status: 403,
-            error: { message: 'x' },
-          },
-        ],
-      };
+    it('lists one plain entry per failed hop, in chain order', async () => {
       const { error } = await exhausted({
         failedFallbacks: [
-          {
-            model: 'grok-4.5',
-            provider: 'xai',
-            fallbackIndex: 0,
-            status: 403,
-            errorBody: 'x',
-            autofix: unfixable,
-            autofixRole: 'original',
-          },
-          {
-            model: 'deepseek-flash',
-            provider: 'opencode-go',
-            fallbackIndex: 1,
-            status: 400,
-            errorBody: 'x',
-            autofix: retried,
-            autofixRole: 'original',
-          },
+          { model: 'grok-4.5', provider: 'xai', fallbackIndex: 0, status: 403, errorBody: 'x' },
           {
             model: 'deepseek-flash',
             provider: 'opencode-go',
             fallbackIndex: 1,
             status: 422,
             errorBody: 'x',
-            autofix: retried,
-            autofixRole: 'retry',
           },
         ],
       });
 
-      expect(error.attempted_fallbacks).toEqual([
-        expect.objectContaining({
-          model: 'grok-4.5',
-          status: 403,
-          autofix: { applied: false, original_status: 403, retry_status: null },
-        }),
-        expect.objectContaining({
-          model: 'deepseek-flash',
-          status: 422,
-          autofix: { applied: true, original_status: 400, retry_status: 422 },
-        }),
+      const entries = error.attempted_fallbacks as Array<Record<string, unknown>>;
+      expect(entries.map((e) => [e.model, e.status])).toEqual([
+        ['grok-4.5', 403],
+        ['deepseek-flash', 422],
       ]);
+      for (const entry of entries) {
+        expect(Object.keys(entry).sort()).toEqual(
+          ['auth_type', 'code', 'message', 'model', 'provider', 'status'].sort(),
+        );
+      }
       expect(error.message).toContain(
         'Every attempt failed: openai/gpt-5.4-mini 400, xai/grok-4.5 403, opencode-go/deepseek-flash 422.',
       );
@@ -1122,23 +997,14 @@ describe('proxy-response-handler', () => {
       expect(recorder.recordFailedFallbacks).toHaveBeenCalled();
     });
 
-    it('numbers an Autofix retry before its fallback attempts', () => {
+    it('numbers the primary as attempt 1 and its fallbacks after it', () => {
       const recorder = mockRecorder();
       const meta = makeMeta({ fallbackFromModel: 'gpt-4o' });
       const failedFallbacks: FailedFallback[] = [
         { model: 'claude', provider: 'anthropic', fallbackIndex: 0, status: 500, errorBody: '' },
       ];
-      const autofix: AutofixRecord = {
-        groupId: 'grp-order',
-        outcome: 'exhausted',
-        original_http_status: 400,
-        chain: [
-          { attempt: 0, origin: 'original', request: {}, http_status: 400 },
-          { attempt: 1, origin: 'autofix', request: {}, http_status: 400 },
-        ],
-      };
 
-      recordFallbackFailures(testCtx, meta, failedFallbacks, recorder as any, null, null, autofix);
+      recordFallbackFailures(testCtx, meta, failedFallbacks, recorder as any, null, null);
 
       expect(recorder.recordPrimaryFailure).toHaveBeenCalledWith(
         testCtx,
@@ -1147,139 +1013,14 @@ describe('proxy-response-handler', () => {
         expect.anything(),
         expect.anything(),
         undefined,
-        expect.objectContaining({ attemptNumber: 2 }),
+        expect.objectContaining({ attemptNumber: 1 }),
       );
       expect(recorder.recordFailedFallbacks).toHaveBeenCalledWith(
         testCtx,
         expect.anything(),
         expect.anything(),
         failedFallbacks,
-        expect.objectContaining({ firstAttemptNumber: 3 }),
-      );
-    });
-
-    it('passes a no-patch audit to the plain primary failure', () => {
-      const recorder = mockRecorder();
-      const meta = makeMeta({ fallbackFromModel: 'gpt-4o', primaryErrorStatus: 400 });
-      const autofix: AutofixRecord = {
-        groupId: 'grp-b',
-        outcome: 'unfixable',
-        original_http_status: 400,
-        chain: [
-          {
-            attempt: 0,
-            origin: 'original',
-            request: {},
-            http_status: 400,
-            error: { message: 'x' },
-          },
-        ],
-      };
-
-      recordFallbackFailures(testCtx, meta, undefined, recorder as any, null, null, autofix);
-
-      expect(recorder.recordPrimaryFailure).toHaveBeenCalledWith(
-        testCtx,
-        expect.anything(),
-        'gpt-4o',
-        expect.any(String),
-        expect.any(String),
-        undefined,
-        expect.objectContaining({ autofix }),
-      );
-      expect(recorder.recordAutofixOriginal).not.toHaveBeenCalled();
-    });
-
-    it('records the original and failed Autofix retry before a successful fallback', () => {
-      const recorder = mockRecorder();
-      const meta = makeMeta({
-        fallbackFromModel: 'gpt-4o',
-        primaryErrorBody: 'Retry also failed',
-        primaryErrorStatus: 422,
-        primaryProvider: 'openai',
-        primaryAuthType: 'api_key',
-        primaryTenantProviderId: 'primary-key',
-        provider: 'anthropic',
-        model: 'claude-sonnet',
-      });
-      const autofix = failedAutofixRetry();
-
-      recordFallbackFailures(testCtx, meta, undefined, recorder as any, null, null, autofix);
-
-      expect(recorder.recordAutofixOriginal).toHaveBeenCalledWith(
-        testCtx,
-        'gpt-4o',
-        'standard',
-        autofix,
-        expect.objectContaining({
-          provider: 'openai',
-          authType: 'api_key',
-          tenantProviderId: 'primary-key',
-        }),
-      );
-      expect(recorder.recordPrimaryFailure).toHaveBeenCalledWith(
-        testCtx,
-        expect.anything(),
-        'gpt-4o',
-        'Retry also failed',
-        expect.any(String),
-        'api_key',
-        expect.objectContaining({ autofix, httpStatus: 422 }),
-      );
-    });
-
-    it('attributes the Autofix original row to the primary connection label', () => {
-      // The retry that failed ran on the PRIMARY connection; meta.provider_key_label
-      // already names the fallback that recovered the request, so the
-      // autofix_role='original' row must read primaryKeyLabel instead —
-      // otherwise it pairs the primary's tenant_provider_id with the
-      // fallback's label.
-      const recorder = mockRecorder();
-      const meta = makeMeta({
-        fallbackFromModel: 'gpt-4o',
-        primaryProvider: 'openai',
-        primaryAuthType: 'api_key',
-        primaryTenantProviderId: 'up-work',
-        primaryKeyLabel: 'Work',
-        provider: 'anthropic',
-        model: 'claude-sonnet',
-        provider_key_label: 'Personal',
-      });
-      const autofix = failedAutofixRetry();
-
-      recordFallbackFailures(testCtx, meta, undefined, recorder as any, null, null, autofix);
-
-      expect(recorder.recordAutofixOriginal).toHaveBeenCalledWith(
-        testCtx,
-        'gpt-4o',
-        'standard',
-        autofix,
-        expect.objectContaining({
-          provider: 'openai',
-          tenantProviderId: 'up-work',
-          providerKeyLabel: 'Work',
-        }),
-      );
-    });
-
-    it('does not attribute the Autofix original to the fallback provider', () => {
-      const recorder = mockRecorder();
-      const meta = makeMeta({
-        fallbackFromModel: 'gpt-4o',
-        primaryProvider: undefined,
-        provider: 'anthropic',
-        model: 'claude-sonnet',
-      });
-      const autofix = failedAutofixRetry();
-
-      recordFallbackFailures(testCtx, meta, undefined, recorder as any, null, null, autofix);
-
-      expect(recorder.recordAutofixOriginal).toHaveBeenCalledWith(
-        testCtx,
-        'gpt-4o',
-        'standard',
-        autofix,
-        expect.objectContaining({ provider: undefined }),
+        expect.objectContaining({ firstAttemptNumber: 2 }),
       );
     });
 
@@ -1623,9 +1364,8 @@ describe('proxy-response-handler', () => {
     });
 
     it('converts a native Responses upstream for a Chat Completions client', async () => {
-      // An Autofix heal that changes the model re-routes the Codex wire body in
-      // `responses` mode, so the forward carries isResponses, not isChatGpt,
-      // while the client still speaks Chat Completions.
+      // A native Responses forward (isResponses, not isChatGpt) still has to
+      // reach a client that speaks Chat Completions in its own shape.
       const { res } = mockResponse();
       const forward = mockForward({ isResponses: true });
       const client = mockProviderClient();
@@ -2406,9 +2146,8 @@ describe('proxy-response-handler', () => {
     });
 
     it('collects native Responses SSE for a non-streaming Chat Completions client', async () => {
-      // Regression: an Autofix heal that changed the model re-routed the Codex
-      // wire body in `responses` mode. The forward came back isResponses (not
-      // isChatGpt) and the handler JSON-parsed the SSE body, answering M500
+      // Regression: a forward that came back isResponses (not isChatGpt) had its
+      // SSE body JSON-parsed, answering M500
       // `Unexpected token 'e', "event: res"... is not valid JSON`.
       const { res } = mockResponse();
       const client = mockProviderClient();
@@ -2954,7 +2693,6 @@ describe('proxy-response-handler', () => {
         undefined,
         undefined,
         undefined,
-        undefined,
         'request-order',
         4,
       );
@@ -2994,7 +2732,6 @@ describe('proxy-response-handler', () => {
         1000,
         undefined,
         undefined,
-        undefined,
         'request-1',
         1,
         'messages',
@@ -3123,45 +2860,6 @@ describe('proxy-response-handler', () => {
       );
     });
 
-    it('forwards the winning fallback Autofix record to the fallback-success row', () => {
-      const recorder = mockRecorder();
-      const meta = makeMeta({ fallbackFromModel: 'gpt-4o', fallbackIndex: 1 });
-      const fallbackAutofix: AutofixRecord = {
-        groupId: 'fallback-group',
-        outcome: 'healed',
-        original_http_status: 400,
-        chain: [
-          { attempt: 0, origin: 'original', request: {}, http_status: 400 },
-          { attempt: 1, origin: 'autofix', request: {}, http_status: 200 },
-        ],
-      };
-
-      recordSuccess(
-        testCtx,
-        meta,
-        null,
-        '2025-01-01T00:00:00Z',
-        recorder as any,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        fallbackAutofix,
-      );
-
-      expect(recorder.recordFallbackSuccess).toHaveBeenCalledWith(
-        testCtx,
-        'gpt-4o',
-        'standard',
-        expect.objectContaining({ fallbackAutofix }),
-      );
-    });
-
     it('should pass specificityCategory when set on meta', () => {
       const recorder = mockRecorder();
       const meta = makeMeta({ specificity_category: 'coding' });
@@ -3178,169 +2876,6 @@ describe('proxy-response-handler', () => {
         expect.objectContaining({ specificityCategory: 'coding' }),
       );
     });
-
-    // A healed Autofix chain: the failed original attempt is recorded as its
-    // own auto_fixed row, linked to the successful-retry success row above.
-    const healedAutofix: AutofixRecord = {
-      groupId: 'grp-1',
-      outcome: 'healed',
-      original_http_status: 400,
-      chain: [
-        {
-          attempt: 0,
-          origin: 'original',
-          request: {},
-          http_status: 400,
-          error: { message: 'Unknown parameter' },
-        },
-        { attempt: 1, origin: 'autofix', request: {}, http_status: 200 },
-      ],
-    };
-
-    it('records the failed Autofix original(s) when the chain has a failed entry (healed)', () => {
-      const recorder = mockRecorder();
-      const meta = makeMeta();
-      const usage: StreamUsage = { prompt_tokens: 100, completion_tokens: 50 };
-
-      recordSuccess(
-        testCtx,
-        meta,
-        usage,
-        undefined,
-        recorder as any,
-        'trace-1',
-        'session-1',
-        undefined,
-        null,
-        undefined,
-        healedAutofix,
-      );
-
-      expect(recorder.recordAutofixOriginal).toHaveBeenCalledWith(
-        testCtx,
-        'gpt-4o',
-        'standard',
-        healedAutofix,
-        expect.objectContaining({ provider: 'openai', reason: 'auto', traceId: 'trace-1' }),
-      );
-      expect(recorder.recordManifestBlockedRequest).not.toHaveBeenCalled();
-    });
-
-    it('does NOT record a separate auto_fixed original when healed but a fallback took over', () => {
-      // Edge: heal succeeded (outcome 'healed') but a later stream fallback took
-      // the request, so meta.fallbackFromModel is set and meta.model is now the
-      // fallback route. A standalone auto_fixed row here would be mis-attributed
-      // under the fallback model — the fallback path already carries the stamp.
-      const recorder = mockRecorder();
-      const meta = makeMeta({ fallbackFromModel: 'claude-opus', fallbackIndex: 0 });
-
-      recordSuccess(
-        testCtx,
-        meta,
-        { prompt_tokens: 1, completion_tokens: 1 },
-        '2025-01-01T00:00:00Z',
-        recorder as any,
-        'trace-1',
-        'session-1',
-        undefined,
-        null,
-        undefined,
-        healedAutofix,
-      );
-
-      expect(recorder.recordFallbackSuccess).toHaveBeenCalled();
-      expect(recorder.recordAutofixOriginal).not.toHaveBeenCalled();
-    });
-
-    it('does NOT record a separate auto_fixed original when healing EXHAUSTED but a fallback then succeeded', () => {
-      // Fallback-success path: meta.fallbackFromModel is set (so the
-      // recordFallbackSuccess branch runs) and the Autofix chain carries a
-      // failed attempt — but healing did NOT heal. The failed primary is
-      // already recorded exactly once as the `fallback_error` row (stamped with
-      // the Autofix audit by recordFallbackFailures), so emitting an
-      // `auto_fixed` row here too would double-count it under the fallback model.
-      const recorder = mockRecorder();
-      const meta = makeMeta({ fallbackFromModel: 'claude-opus', fallbackIndex: 0 });
-      const exhaustedAutofix: AutofixRecord = {
-        groupId: 'grp-exhausted',
-        outcome: 'exhausted',
-        original_http_status: 400,
-        chain: [
-          {
-            attempt: 0,
-            origin: 'original',
-            request: {},
-            http_status: 400,
-            error: { message: 'x' },
-          },
-        ],
-      };
-
-      recordSuccess(
-        testCtx,
-        meta,
-        { prompt_tokens: 1, completion_tokens: 1 },
-        '2025-01-01T00:00:00Z',
-        recorder as any,
-        undefined,
-        undefined,
-        undefined,
-        null,
-        undefined,
-        exhaustedAutofix,
-      );
-
-      // The success itself came from the fallback model.
-      expect(recorder.recordFallbackSuccess).toHaveBeenCalled();
-      expect(recorder.recordSuccessMessage).not.toHaveBeenCalled();
-      // …and no duplicate auto_fixed row is written for the failed primary.
-      expect(recorder.recordAutofixOriginal).not.toHaveBeenCalled();
-    });
-
-    it('does not record Autofix originals when healing did not heal (outcome !== healed)', () => {
-      // An Autofix record that did not heal must not trigger
-      // recordAutofixOriginal — the guard is the presence of a real retry.
-      const recorder = mockRecorder();
-      const meta = makeMeta();
-      const emptyChainAutofix: AutofixRecord = {
-        groupId: 'grp-empty',
-        outcome: 'exhausted',
-        original_http_status: 400,
-        chain: [],
-      };
-
-      recordSuccess(
-        testCtx,
-        meta,
-        { prompt_tokens: 1, completion_tokens: 1 },
-        undefined,
-        recorder as any,
-        undefined,
-        undefined,
-        undefined,
-        null,
-        undefined,
-        emptyChainAutofix,
-      );
-
-      expect(recorder.recordAutofixOriginal).not.toHaveBeenCalled();
-    });
-
-    it('does not record Autofix originals when autofix is absent', () => {
-      // Guards the `autofix && …` short-circuit: no autofix record at all.
-      const recorder = mockRecorder();
-      const meta = makeMeta();
-
-      recordSuccess(
-        testCtx,
-        meta,
-        { prompt_tokens: 1, completion_tokens: 1 },
-        undefined,
-        recorder as any,
-      );
-
-      expect(recorder.recordAutofixOriginal).not.toHaveBeenCalled();
-    });
   });
 
   describe('requestHeaders propagation', () => {
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy.controller.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy.controller.spec.ts
index b7d7852f..adedd268 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy.controller.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy.controller.spec.ts
@@ -149,7 +149,6 @@ describe('ProxyController', () => {
   let providerParamSpecs: { getCapabilities: jest.Mock };
   let modelsDevSync: { lookupModelCapabilities: jest.Mock };
   let recorder: ProxyMessageRecorder;
-  let observationReporter: { report: jest.Mock };
   let recordingConfig: { isRecording: jest.Mock };
   let attemptRecording: { available: boolean; save: jest.Mock };
 
@@ -190,7 +189,6 @@ describe('ProxyController', () => {
     };
     providerParamSpecs = { getCapabilities: jest.fn().mockResolvedValue(null) };
     modelsDevSync = { lookupModelCapabilities: jest.fn().mockReturnValue(null) };
-    observationReporter = { report: jest.fn() };
     recordingConfig = { isRecording: jest.fn().mockResolvedValue(false) };
     attemptRecording = {
       available: true,
@@ -225,7 +223,6 @@ describe('ProxyController', () => {
       new ThinkingBlockCache(),
       new ReasoningContentCache(),
       modelDiscovery as never,
-      observationReporter as never,
       providerParamSpecs as never,
       modelsDevSync as never,
       recordingConfig as never,
@@ -617,7 +614,7 @@ describe('ProxyController', () => {
     expect(headers['X-Manifest-Reason']).toBe('scored');
   });
 
-  it('routes a native Phoenix replay through the requested subscription connection', async () => {
+  it('routes on the body model and ignores provider/auth-type routing headers', async () => {
     const responseBody = { choices: [{ message: { content: 'hello' } }] };
     proxyService.proxyRequest.mockResolvedValue({
       forward: {
@@ -644,13 +641,12 @@ describe('ProxyController', () => {
 
     await controller.chatCompletions(req as never, res as never);
 
+    // These headers used to rewrite the routing model for replays from the
+    // removed hosted repair service. They are now plain request headers.
     expect(proxyService.proxyRequest).toHaveBeenCalledWith(
       expect.objectContaining({
         body,
-        routingBody: {
-          model: 'openai/gpt-5.5-subscription',
-          messages: [{ role: 'user', content: 'hi' }],
-        },
+        routingBody: { model: 'gpt-5.5', messages: [{ role: 'user', content: 'hi' }] },
       }),
     );
   });
@@ -810,7 +806,7 @@ describe('ProxyController', () => {
     );
   });
 
-  it('keeps Autofix original and retry payloads on separate Provider Attempts', async () => {
+  it('keeps the payloads of two Provider Attempts on separate recordings', async () => {
     recordingConfig.isRecording.mockResolvedValue(true);
     const originalBody = { model: 'gpt-4o', messages: [], unsupported: true };
     const retryBody = { model: 'gpt-4o', messages: [] };
@@ -854,7 +850,7 @@ describe('ProxyController', () => {
             model: 'gpt-4o',
             provider: 'openai',
             confidence: 0.9,
-            reason: 'auto-fix',
+            reason: 'scored',
             attempt: retry,
           },
         };
@@ -1826,20 +1822,12 @@ describe('ProxyController', () => {
     });
   });
 
-  it('should report the provider-facing body and API mode to Phoenix', async () => {
-    const wireRequestBody = {
-      model: 'claude-opus-4-8',
-      messages: [{ role: 'user', content: 'test' }],
-      thinking: { type: 'adaptive', budget_tokens: 8192 },
-    };
+  it('returns a request-side 400 to the caller and records it once', async () => {
+    const providerSpy = jest.spyOn(recorder, 'recordProviderError');
     proxyService.proxyRequest.mockResolvedValue({
       forward: {
-        response: new Response('{"error":"invalid thinking"}', { status: 400 }),
-        wireRequestBody,
-        wireRequestUrl: 'https://api.anthropic.com/v1/messages',
+        response: new Response('{"error":{"message":"invalid thinking"}}', { status: 400 }),
         wireFormat: 'anthropic_messages',
-        wireApiMode: 'messages',
-        retryWireBody: jest.fn(),
         isGoogle: false,
         isAnthropic: true,
         isChatGpt: false,
@@ -1862,67 +1850,24 @@ describe('ProxyController', () => {
 
     await controller.chatCompletions(req as never, res as never);
 
-    expect(observationReporter.report).toHaveBeenCalledWith(
-      expect.objectContaining({
-        model: 'claude-opus-4-8',
+    expect(proxyService.proxyRequest).toHaveBeenCalledTimes(1);
+    expect(res.status).toHaveBeenCalledWith(400);
+    expect(res.json).toHaveBeenCalledWith({
+      error: expect.objectContaining({
+        message: 'invalid thinking',
+        status: 400,
+        source: 'provider',
         provider: 'Anthropic',
-        authType: 'api_key',
-        apiMode: 'messages',
-        requestBody: wireRequestBody,
-        providerWire: {
-          format: 'anthropic_messages',
-          url: 'https://api.anthropic.com/v1/messages',
-          body: wireRequestBody,
-        },
+        model: 'claude-opus-4-8',
       }),
-    );
-    expect(observationReporter.report.mock.calls[0][0]).not.toHaveProperty('resolvedModel');
-  });
-
-  it('reports native Gemini failures with model metadata outside the exact provider body', async () => {
-    const wireRequestBody = {
-      contents: [{ role: 'user', parts: [{ text: 'test' }] }],
-      generationConfig: { maxOutputTokens: 32000, topP: 1, temperature: 1 },
-    };
-    proxyService.proxyRequest.mockResolvedValue({
-      forward: {
-        response: new Response('{"error":{"message":"model unavailable"}}', { status: 404 }),
-        wireRequestBody,
-        wireRequestUrl:
-          'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-lite:generateContent',
-        wireFormat: 'google_generate_content',
-        wireApiMode: undefined,
-        isGoogle: true,
-        isAnthropic: false,
-        isChatGpt: false,
-      },
-      meta: {
-        tier: 'standard',
-        model: 'gemini-2.5-flash-lite',
-        provider: 'Gemini',
-        auth_type: 'api_key',
-        confidence: 0.8,
-        reason: 'scored',
-      },
     });
-
-    const req = mockRequest({ model: 'auto', messages: [{ role: 'user', content: 'test' }] });
-    const { res } = mockResponse();
-    await controller.chatCompletions(req as never, res as never);
-
-    expect(observationReporter.report).toHaveBeenCalledWith(
-      expect.objectContaining({
-        model: 'gemini-2.5-flash-lite',
-        apiMode: 'chat_completions',
-        requestBody: wireRequestBody,
-        providerWire: {
-          format: 'google_generate_content',
-          url: 'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-lite:generateContent',
-          body: wireRequestBody,
-        },
-      }),
+    expect(providerSpy).toHaveBeenCalledTimes(1);
+    expect(providerSpy).toHaveBeenCalledWith(
+      expect.anything(),
+      400,
+      '{"error":{"message":"invalid thinking"}}',
+      expect.objectContaining({ attemptNumber: 1, provider: 'Anthropic' }),
     );
-    expect(observationReporter.report.mock.calls[0][0].requestBody).not.toHaveProperty('model');
   });
 
   it('should handle 500 errors from proxyService as friendly chat message', async () => {
diff --git a/packages/backend/src/routing/proxy/__tests__/proxy.service.spec.ts b/packages/backend/src/routing/proxy/__tests__/proxy.service.spec.ts
index f3a264b5..fe2c7e05 100644
--- a/packages/backend/src/routing/proxy/__tests__/proxy.service.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/proxy.service.spec.ts
@@ -1,7 +1,6 @@
 import { ManifestError } from '../../../common/errors/manifest-error';
 import { ConfigService } from '@nestjs/config';
 import {
-  deriveAutofixStatus,
   getProviderParamSpecs,
   type AuthType,
   type ModelRoute,
@@ -23,8 +22,6 @@ import type { ThoughtSignatureCache } from '../thought-signature-cache';
 import type { ThinkingBlockCache } from '../thinking-block-cache';
 import { AgentModelParamsService } from '../../routing-core/agent-model-params.service';
 import type { ProviderParamSpecService } from '../../routing-core/provider-param-spec.service';
-import { AutofixService } from '../../autofix/autofix.service';
-import type { HealingClient } from '../../autofix/healing-client';
 import type { ModelDiscoveryService } from '../../../model-discovery/model-discovery.service';
 import type { DiscoveredModel } from '../../../model-discovery/model-fetcher';
 
@@ -115,14 +112,13 @@ describe('ProxyService — orchestration', () => {
   >;
   let limitCheck: jest.Mocked<Pick<LimitCheckService, 'checkLimits'>>;
   let fallbackService: jest.Mocked<
-    Pick<ProxyFallbackService, 'tryForwardToProvider' | 'retryWireBody' | 'tryFallbacks'>
+    Pick<ProxyFallbackService, 'tryForwardToProvider' | 'tryFallbacks'>
   >;
   let configService: ConfigService;
   let signatureCache: ThoughtSignatureCache;
   let thinkingCache: ThinkingBlockCache;
   let modelParamsService: { get: jest.Mock; list: jest.Mock; set: jest.Mock; delete: jest.Mock };
   let providerParamSpecs: { getSpecs: jest.Mock; list: jest.Mock };
-  let autofixService: { maybeHeal: jest.Mock };
   let svc: ProxyService;
   let modelDiscovery: jest.Mocked<Pick<ModelDiscoveryService, 'getModelsForAgent'>>;
 
@@ -183,7 +179,6 @@ describe('ProxyService — orchestration', () => {
     limitCheck = { checkLimits: jest.fn().mockResolvedValue(null) };
     fallbackService = {
       tryForwardToProvider: jest.fn(),
-      retryWireBody: jest.fn(),
       tryFallbacks: jest.fn(),
     };
     configService = { get: jest.fn().mockReturnValue(undefined) } as unknown as ConfigService;
@@ -203,7 +198,6 @@ describe('ProxyService — orchestration', () => {
       ),
       list: jest.fn().mockResolvedValue(specCatalog),
     };
-    autofixService = { maybeHeal: jest.fn().mockResolvedValue(null) };
 
     svc = new ProxyService(
       resolveService as unknown as ResolveService,
@@ -223,7 +217,6 @@ describe('ProxyService — orchestration', () => {
       thinkingCache,
       modelParamsService as unknown as AgentModelParamsService,
       providerParamSpecs as unknown as ProviderParamSpecService,
-      autofixService as unknown as AutofixService,
     );
   });
 
@@ -385,727 +378,6 @@ describe('ProxyService — orchestration', () => {
     });
   });
 
-  describe('autofix integration', () => {
-    const routableResolve = () =>
-      resolveService.resolve.mockResolvedValue({
-        tier: 'standard',
-        route: route('openai', 'api_key', 'gpt-4o'),
-        fallback_routes: null,
-        confidence: 0.9,
-        score: 5,
-        reason: 'scored',
-      });
-    const fwd = (
-      status: number,
-      wireRequestBody: Record<string, unknown> = { model: 'gpt-4o' },
-      wireApiMode: 'chat_completions' | 'responses' | 'messages' = 'chat_completions',
-    ) => ({
-      response: okResponse(status),
-      wireRequestBody,
-      wireApiMode,
-      retryWireBody: jest.fn(),
-      isGoogle: false,
-      isAnthropic: false,
-      isChatGpt: false,
-    });
-
-    it('uses the healed forward and attaches the autofix record when maybeHeal succeeds', async () => {
-      routableResolve();
-      const healed = fwd(200);
-      fallbackService.tryForwardToProvider.mockResolvedValue(fwd(400));
-      const record = { outcome: 'healed', attempts: 1, original_http_status: 400, chain: [] };
-      autofixService.maybeHeal.mockResolvedValue({ forward: healed, record });
-
-      const result = await svc.proxyRequest(baseOpts());
-
-      expect(result.forward).toBe(healed);
-      expect(result.autofix).toBe(record);
-      expect(autofixService.maybeHeal).toHaveBeenCalledWith(
-        expect.objectContaining({ provider: 'openai', authType: 'api_key' }),
-      );
-    });
-
-    it('retries the patched same-model wire body without rebuilding it', async () => {
-      routableResolve();
-      const healed = fwd(200);
-      const failed = fwd(400, { model: 'gpt-4o', max_tokens: 7 });
-      fallbackService.tryForwardToProvider.mockResolvedValueOnce(failed);
-      fallbackService.retryWireBody.mockResolvedValueOnce(healed);
-      autofixService.maybeHeal.mockImplementation(
-        async (params: { reforward: (b: Record<string, unknown>) => Promise<unknown> }) => {
-          const forward = await params.reforward({ model: 'gpt-4o', max_tokens: 5 });
-          return {
-            forward,
-            record: { outcome: 'healed', attempts: 1, original_http_status: 400, chain: [] },
-          };
-        },
-      );
-
-      const result = await svc.proxyRequest(
-        baseOpts({ body: { model: 'auto', messages: [{ role: 'user', content: 'hi' }] } }),
-      );
-
-      expect(result.forward).toBe(healed);
-      expect(fallbackService.tryForwardToProvider).toHaveBeenCalledTimes(1);
-      expect(fallbackService.retryWireBody).toHaveBeenCalledWith(
-        failed,
-        { model: 'gpt-4o', max_tokens: 5 },
-        expect.objectContaining({
-          provider: 'openai',
-          model: 'gpt-4o',
-          authType: 'api_key',
-        }),
-      );
-    });
-
-    it('reports the captured provider body and provider-facing API mode to Autofix', async () => {
-      routableResolve();
-      const wireBody = {
-        model: 'claude-opus-4-8',
-        thinking: { type: 'adaptive', budget_tokens: 8192 },
-      };
-      fallbackService.tryForwardToProvider.mockResolvedValueOnce(fwd(400, wireBody, 'messages'));
-
-      await svc.proxyRequest(baseOpts());
-
-      expect(autofixService.maybeHeal).toHaveBeenCalledWith(
-        expect.objectContaining({
-          apiMode: 'messages',
-          requestBody: wireBody,
-        }),
-      );
-      expect(autofixService.maybeHeal.mock.calls[0][0]).not.toHaveProperty('resolvedModel');
-    });
-
-    it('sends native Gemini failures to Autofix with the exact provider body', async () => {
-      resolveService.resolve.mockResolvedValue({
-        tier: 'standard',
-        route: route('gemini', 'api_key', 'gemini-2.5-flash'),
-        fallback_routes: null,
-        confidence: 0.9,
-        score: 5,
-        reason: 'scored',
-      });
-      const wireRequestBody = {
-        contents: [{ role: 'user', parts: [{ text: 'hi' }] }],
-        generationConfig: { maxOutputTokens: 32_000, topP: 1 },
-      };
-      fallbackService.tryForwardToProvider.mockResolvedValueOnce({
-        response: okResponse(400),
-        wireRequestBody,
-        wireRequestUrl:
-          'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent',
-        wireFormat: 'google_generate_content',
-        retryWireBody: jest.fn(),
-        isGoogle: true,
-        isAnthropic: false,
-        isChatGpt: false,
-      });
-
-      await svc.proxyRequest(baseOpts());
-
-      expect(autofixService.maybeHeal).toHaveBeenCalledWith(
-        expect.objectContaining({
-          provider: 'gemini',
-          model: 'gemini-2.5-flash',
-          apiMode: 'chat_completions',
-          requestBody: wireRequestBody,
-        }),
-      );
-      expect(autofixService.maybeHeal.mock.calls[0][0].requestBody).not.toHaveProperty('model');
-    });
-
-    it('re-resolves routing and forwards to the newly-resolved route when the heal changes the model (M5)', async () => {
-      routableResolve();
-      const healed = fwd(200);
-      // Primary forward fails; the re-resolved forward for the new model succeeds.
-      fallbackService.tryForwardToProvider
-        .mockResolvedValueOnce(fwd(400))
-        .mockResolvedValueOnce(healed);
-      // The healed body targets a DIFFERENT model. In chat_completions mode a
-      // concrete (non-"auto") model id re-resolves via the explicit-model path:
-      // modelDiscovery.getModelsForAgent + routeForOpenAiModelId. Publish a model
-      // whose OpenAI-compatible id matches so the re-resolve finds a route.
-      modelDiscovery.getModelsForAgent.mockResolvedValue([
-        discoveredModel({ id: 'gpt-4o-mini', provider: 'openai', authType: 'api_key' }),
-      ]);
-      autofixService.maybeHeal.mockImplementation(
-        async (params: { reforward: (b: Record<string, unknown>) => Promise<unknown> }) => {
-          const forward = await params.reforward({
-            model: 'openai/gpt-4o-mini',
-            max_output_tokens: 5,
-          });
-          return {
-            forward,
-            record: { outcome: 'healed', attempts: 1, original_http_status: 400, chain: [] },
-          };
-        },
-      );
-
-      const result = await svc.proxyRequest(baseOpts());
-
-      expect(result.forward).toBe(healed);
-      // Re-resolve happened: getModelsForAgent was consulted for the healed model
-      // (the primary route used resolveService.resolve, never getModelsForAgent).
-      expect(modelDiscovery.getModelsForAgent).toHaveBeenCalledWith('tenant-1', 'agent-1');
-      // Credentials were re-selected for the re-resolved provider.
-      expect(providerKeyService.selectProviderKey).toHaveBeenCalledWith(
-        'tenant-1',
-        'openai',
-        'api_key',
-        undefined,
-        'agent-1',
-      );
-      // A second forward went to the newly-resolved model.
-      expect(fallbackService.tryForwardToProvider).toHaveBeenCalledTimes(2);
-      const reforwardOpts = fallbackService.tryForwardToProvider.mock.calls[1][0];
-      expect(reforwardOpts.model).toBe('gpt-4o-mini');
-      expect(reforwardOpts.provider).toBe('openai');
-    });
-
-    it('routes a native Autofix remap through the original subscription auth type', async () => {
-      resolveService.resolve.mockResolvedValue({
-        tier: 'standard',
-        route: route('openai', 'subscription', 'gpt-5.4'),
-        fallback_routes: null,
-        confidence: 0.9,
-        score: 5,
-        reason: 'scored',
-      });
-      const healed = fwd(200, { model: 'gpt-5.5' });
-      fallbackService.tryForwardToProvider
-        .mockResolvedValueOnce(fwd(400, { model: 'gpt-5.4' }))
-        .mockResolvedValueOnce(healed);
-      modelDiscovery.getModelsForAgent.mockResolvedValue([
-        discoveredModel({ id: 'gpt-5.5', provider: 'openai', authType: 'api_key' }),
-        discoveredModel({ id: 'gpt-5.5', provider: 'openai', authType: 'subscription' }),
-      ]);
-      autofixService.maybeHeal.mockImplementation(
-        async (params: { reforward: (b: Record<string, unknown>) => Promise<unknown> }) => ({
-          forward: await params.reforward({ model: 'gpt-5.5', max_output_tokens: 5 }),
-          record: { outcome: 'healed', attempts: 1, original_http_status: 400, chain: [] },
-        }),
-      );
-
-      const result = await svc.proxyRequest(baseOpts());
-
-      expect(result.forward).toBe(healed);
-      expect(fallbackService.tryForwardToProvider).toHaveBeenCalledTimes(2);
-      expect(fallbackService.tryForwardToProvider.mock.calls[1][0]).toEqual(
-        expect.objectContaining({
-          provider: 'openai',
-          authType: 'subscription',
-          model: 'gpt-5.5',
-          body: expect.objectContaining({ model: 'gpt-5.5' }),
-        }),
-      );
-    });
-
-    it('keeps a native remap body on the original subscription transport when discovery is stale', async () => {
-      const failed = fwd(400, { model: 'gpt-5.4' });
-      const healed = fwd(200, { model: 'gpt-5.5' });
-      fallbackService.tryForwardToProvider.mockResolvedValueOnce(failed);
-      fallbackService.retryWireBody.mockResolvedValueOnce(healed);
-      modelDiscovery.getModelsForAgent.mockResolvedValue([]);
-      resolveService.resolve.mockResolvedValueOnce({
-        tier: 'standard',
-        route: route('openai', 'subscription', 'gpt-5.4'),
-        fallback_routes: null,
-        confidence: 0.9,
-        score: 5,
-        reason: 'scored',
-      });
-      autofixService.maybeHeal.mockImplementation(
-        async (params: { reforward: (b: Record<string, unknown>) => Promise<unknown> }) => ({
-          forward: await params.reforward({ model: 'gpt-5.5', max_output_tokens: 5 }),
-          record: { outcome: 'healed', attempts: 1, original_http_status: 400, chain: [] },
-        }),
-      );
-
-      const result = await svc.proxyRequest(baseOpts());
-
-      expect(result.forward).toBe(healed);
-      expect(fallbackService.tryForwardToProvider).toHaveBeenCalledTimes(1);
-      expect(fallbackService.retryWireBody).toHaveBeenCalledWith(
-        failed,
-        { model: 'gpt-5.5', max_output_tokens: 5 },
-        expect.objectContaining({
-          provider: 'openai',
-          model: 'gpt-5.5',
-          authType: 'subscription',
-        }),
-      );
-    });
-
-    it('keeps legacy suffixed Autofix remaps idempotent', async () => {
-      resolveService.resolve.mockResolvedValue({
-        tier: 'standard',
-        route: route('openai', 'subscription', 'gpt-5.4'),
-        fallback_routes: null,
-        confidence: 0.9,
-        score: 5,
-        reason: 'scored',
-      });
-      const healed = fwd(200, { model: 'gpt-5.5' });
-      fallbackService.tryForwardToProvider
-        .mockResolvedValueOnce(fwd(400, { model: 'gpt-5.4' }))
-        .mockResolvedValueOnce(healed);
-      modelDiscovery.getModelsForAgent.mockResolvedValue([
-        discoveredModel({ id: 'gpt-5.5', provider: 'openai', authType: 'subscription' }),
-      ]);
-      autofixService.maybeHeal.mockImplementation(
-        async (params: { reforward: (b: Record<string, unknown>) => Promise<unknown> }) => ({
-          forward: await params.reforward({
-            model: 'openai/gpt-5.5-subscription',
-            max_output_tokens: 5,
-          }),
-          record: { outcome: 'healed', attempts: 1, original_http_status: 400, chain: [] },
-        }),
-      );
-
-      await svc.proxyRequest(baseOpts());
-
-      expect(fallbackService.tryForwardToProvider.mock.calls[1][0]).toEqual(
-        expect.objectContaining({
-          authType: 'subscription',
-          model: 'gpt-5.5',
-          body: expect.objectContaining({ model: 'openai/gpt-5.5-subscription' }),
-        }),
-      );
-    });
-
-    it('re-resolves an uncatalogued healed model through connected-provider passthrough', async () => {
-      routableResolve();
-      const healed = fwd(200, { model: 'gpt-new' });
-      fallbackService.tryForwardToProvider
-        .mockResolvedValueOnce(fwd(404))
-        .mockResolvedValueOnce(healed);
-      modelDiscovery.getModelsForAgent.mockResolvedValue([]);
-      providerKeyService.hasRouteCredentials.mockImplementation(
-        async (_tenantId, candidate) =>
-          candidate.provider === 'openai' && candidate.authType === 'api_key',
-      );
-      autofixService.maybeHeal.mockImplementation(
-        async (params: { reforward: (b: Record<string, unknown>) => Promise<unknown> }) => ({
-          forward: await params.reforward({ model: 'openai/gpt-new', max_output_tokens: 5 }),
-          record: { outcome: 'healed', attempts: 1, original_http_status: 404, chain: [] },
-        }),
-      );
-
-      const result = await svc.proxyRequest(baseOpts());
-
-      expect(result.forward).toBe(healed);
-      expect(providerKeyService.hasRouteCredentials).toHaveBeenCalledWith(
-        'tenant-1',
-        { provider: 'openai', authType: 'api_key', model: 'gpt-new' },
-        'agent-1',
-      );
-      expect(fallbackService.tryForwardToProvider).toHaveBeenCalledTimes(2);
-      expect(fallbackService.tryForwardToProvider.mock.calls[1][0]).toEqual(
-        expect.objectContaining({
-          provider: 'openai',
-          authType: 'api_key',
-          model: 'gpt-new',
-        }),
-      );
-    });
-
-    it('retries on the original transport when the heal changes to a model that no longer resolves (M5 no-route)', async () => {
-      routableResolve();
-      const failed = fwd(400);
-      const healed = fwd(200);
-      fallbackService.tryForwardToProvider.mockResolvedValueOnce(failed);
-      fallbackService.retryWireBody.mockResolvedValueOnce(healed);
-      // No discovered models → the healed model resolves to no route (a stale
-      // per-tenant catalog, typically — the provider may still serve it). The
-      // original forward's transport is proven, so the reforward pins the healed
-      // body there instead of synthesizing a 502.
-      modelDiscovery.getModelsForAgent.mockResolvedValue([]);
-      resolveService.resolve.mockResolvedValue({
-        tier: 'standard',
-        route: null,
-        fallback_routes: null,
-        confidence: 0.9,
-        score: 5,
-        reason: 'scored',
-      });
-      resolveService.resolve.mockResolvedValueOnce({
-        tier: 'standard',
-        route: route('openai', 'api_key', 'gpt-4o'),
-        fallback_routes: null,
-        confidence: 0.9,
-        score: 5,
-        reason: 'scored',
-      });
-      let reforwardResult: { response: Response } | undefined;
-      autofixService.maybeHeal.mockImplementation(
-        async (params: {
-          reforward: (b: Record<string, unknown>) => Promise<{ response: Response }>;
-        }) => {
-          reforwardResult = await params.reforward({
-            model: 'ghost/unknown-model',
-            max_output_tokens: 5,
-          });
-          return {
-            forward: reforwardResult,
-            record: { outcome: 'healed', attempts: 1, original_http_status: 400, chain: [] },
-          };
-        },
-      );
-
-      const result = await svc.proxyRequest(baseOpts());
-
-      // The healed body went out on the original provider's transport with the
-      // healed model pinned — the provider judges the model, not the cache.
-      expect(reforwardResult).toBe(healed);
-      expect(fallbackService.retryWireBody).toHaveBeenCalledWith(
-        failed,
-        { model: 'ghost/unknown-model', max_output_tokens: 5 },
-        expect.objectContaining({
-          provider: 'openai',
-          model: 'ghost/unknown-model',
-          authType: 'api_key',
-        }),
-      );
-      // Only the primary forward reached tryForwardToProvider — the re-resolve
-      // found no route and fell back to the pinned wire retry.
-      expect(fallbackService.tryForwardToProvider).toHaveBeenCalledTimes(1);
-      expect(result.forward).toBeDefined();
-    });
-
-    it('keeps the synthetic 502 when the original forward has no wire transport to pin', async () => {
-      // Unreachable via proxyRequest (the maybeHeal gate requires retryWireBody)
-      // but the fallback guards it type-level: no transport → no invented
-      // provider call, surface the synthetic 502.
-      const failed = { ...fwd(400), retryWireBody: undefined };
-      const result = await (
-        svc as unknown as {
-          retryHealedOnOriginalTransport: (
-            healedBody: Record<string, unknown>,
-            originalForward: unknown,
-            ctx: { provider: string; model: string },
-            reason: string,
-          ) => Promise<{ response: Response }>;
-        }
-      ).retryHealedOnOriginalTransport(
-        { model: 'ghost/unknown-model' },
-        failed,
-        { provider: 'openai', model: 'gpt-4o' },
-        'no route resolved for the healed model',
-      );
-
-      expect(result.response.status).toBe(502);
-      expect(fallbackService.retryWireBody).not.toHaveBeenCalled();
-      expect(await result.response.text()).toContain('Autofix');
-    });
-
-    it('uses the original model when a pinned healed retry omits the model', async () => {
-      const failed = fwd(400);
-      const healed = fwd(200);
-      fallbackService.retryWireBody.mockResolvedValueOnce(healed);
-
-      const result = await (
-        svc as unknown as {
-          retryHealedOnOriginalTransport: (
-            healedBody: Record<string, unknown>,
-            originalForward: unknown,
-            ctx: { provider: string; model: string },
-            reason: string,
-          ) => Promise<{ response: Response }>;
-        }
-      ).retryHealedOnOriginalTransport(
-        { max_output_tokens: 5 },
-        failed,
-        { provider: 'openai', model: 'gpt-4o' },
-        'no route resolved for the healed model',
-      );
-
-      expect(result).toBe(healed);
-      expect(fallbackService.retryWireBody).toHaveBeenCalledWith(
-        failed,
-        { max_output_tokens: 5 },
-        expect.objectContaining({
-          provider: 'openai',
-          model: 'gpt-4o',
-        }),
-      );
-    });
-
-    it('retries on the original transport when the re-resolved model has a route but no provider key (M5 no-credentials)', async () => {
-      routableResolve();
-      const failed = fwd(400);
-      const healed = fwd(200);
-      fallbackService.tryForwardToProvider.mockResolvedValueOnce(failed);
-      fallbackService.retryWireBody.mockResolvedValueOnce(healed);
-      // The healed model DOES resolve to a route, but the connection for it is
-      // gone: selectProviderKey succeeds for the primary attempt, then returns
-      // null on the re-resolve so resolveCredentials yields no key. The original
-      // transport still holds a working credential — retry there.
-      modelDiscovery.getModelsForAgent.mockResolvedValue([
-        discoveredModel({ id: 'gpt-4o-mini', provider: 'openai', authType: 'api_key' }),
-      ]);
-      providerKeyService.selectProviderKey
-        .mockResolvedValueOnce({
-          apiKey: 'decrypted-key',
-          id: 'up-default',
-          region: null,
-          label: 'Default',
-          priority: 0,
-        })
-        .mockResolvedValue(null);
-      let reforwardResult: { response: Response } | undefined;
-      autofixService.maybeHeal.mockImplementation(
-        async (params: {
-          reforward: (b: Record<string, unknown>) => Promise<{ response: Response }>;
-        }) => {
-          reforwardResult = await params.reforward({
-            model: 'openai/gpt-4o-mini',
-            max_output_tokens: 5,
-          });
-          return {
-            forward: reforwardResult,
-            record: { outcome: 'healed', attempts: 1, original_http_status: 400, chain: [] },
-          };
-        },
-      );
-
-      const result = await svc.proxyRequest(baseOpts());
-
-      // A route was found (getModelsForAgent + a second selectProviderKey call),
-      // but the missing key falls back to the pinned wire retry, not a 502.
-      expect(reforwardResult).toBe(healed);
-      expect(providerKeyService.selectProviderKey).toHaveBeenCalledTimes(2);
-      expect(fallbackService.retryWireBody).toHaveBeenCalledWith(
-        failed,
-        { model: 'openai/gpt-4o-mini', max_output_tokens: 5 },
-        expect.objectContaining({
-          provider: 'openai',
-          model: 'openai/gpt-4o-mini',
-          authType: 'api_key',
-        }),
-      );
-      expect(fallbackService.tryForwardToProvider).toHaveBeenCalledTimes(1);
-      expect(result.forward).toBeDefined();
-    });
-
-    it('takes the same-model branch when the heal drops the model field entirely', async () => {
-      routableResolve();
-      const healed = fwd(200);
-      const failed = fwd(400);
-      fallbackService.tryForwardToProvider.mockResolvedValueOnce(failed);
-      fallbackService.retryWireBody.mockResolvedValueOnce(healed);
-      // Healed body has no `model` → healedModel is undefined → reforwardHealed
-      // falls through to the same-model branch (reuses the primary route).
-      autofixService.maybeHeal.mockImplementation(
-        async (params: { reforward: (b: Record<string, unknown>) => Promise<unknown> }) => {
-          const forward = await params.reforward({ max_output_tokens: 5 });
-          return {
-            forward,
-            record: { outcome: 'healed', attempts: 1, original_http_status: 400, chain: [] },
-          };
-        },
-      );
-
-      const result = await svc.proxyRequest(baseOpts());
-
-      expect(result.forward).toBe(healed);
-      expect(fallbackService.tryForwardToProvider).toHaveBeenCalledTimes(1);
-      // No re-resolve — the same-model branch never consults getModelsForAgent.
-      expect(modelDiscovery.getModelsForAgent).not.toHaveBeenCalled();
-      expect(fallbackService.retryWireBody).toHaveBeenCalledWith(
-        failed,
-        { max_output_tokens: 5 },
-        expect.objectContaining({
-          provider: 'openai',
-          model: 'gpt-4o',
-          authType: 'api_key',
-        }),
-      );
-    });
-
-    it('re-resolves via scoring (not the explicit-model path) when the heal switches the model to auto (M5)', async () => {
-      // Primary request has no model → originalModel undefined. The heal sets
-      // model="auto", which differs → model-changed branch → forwardResolvedHealed
-      // re-resolves through the SCORING path (auto is not an explicit override),
-      // so the re-resolved forward carries a defined paramMergeContext.
-      resolveService.resolve.mockResolvedValue({
-        tier: 'standard',
-        route: route('openai', 'api_key', 'gpt-4o'),
-        fallback_routes: null,
-        confidence: 0.9,
-        score: 5,
-        reason: 'scored',
-      });
-      const healed = fwd(200);
-      fallbackService.tryForwardToProvider
-        .mockResolvedValueOnce(fwd(400))
-        .mockResolvedValueOnce(healed);
-      autofixService.maybeHeal.mockImplementation(
-        async (params: { reforward: (b: Record<string, unknown>) => Promise<unknown> }) => {
-          // A patched body still carries the original messages, so the scoring
-          // re-resolve for model="auto" has something to score.
-          const forward = await params.reforward({
-            model: 'auto',
-            messages: [{ role: 'user', content: 'hi' }],
-            max_output_tokens: 5,
-          });
-          return {
-            forward,
-            record: { outcome: 'healed', attempts: 1, original_http_status: 400, chain: [] },
-          };
-        },
-      );
-
-      const result = await svc.proxyRequest(baseOpts());
-
-      expect(result.forward).toBe(healed);
-      // resolveService.resolve ran a SECOND time for the re-resolve (primary + heal).
-      expect(resolveService.resolve).toHaveBeenCalledTimes(2);
-      // The explicit-model path (getModelsForAgent) was never taken by the re-resolve.
-      expect(modelDiscovery.getModelsForAgent).not.toHaveBeenCalled();
-      const reforwardOpts = fallbackService.tryForwardToProvider.mock.calls[1][0];
-      expect(reforwardOpts.model).toBe('gpt-4o');
-      // Non-explicit re-resolve → defined param-merge context for the healed forward.
-      expect(reforwardOpts.paramMergeContext).toEqual({
-        agentId: 'agent-1',
-        scopeKey: 'tier:standard',
-      });
-    });
-  });
-
-  describe('autofix healed streaming retry', () => {
-    // The real AutofixService, so the request verdict and the Phoenix outcome
-    // report are the ones production derives from the retry.
-    let healingClient: { heal: jest.Mock; reportOutcome: jest.Mock };
-
-    beforeEach(() => {
-      // clearAllMocks keeps implementations; start each test from a clean peek.
-      mockedPeek.mockReset();
-      healingClient = {
-        heal: jest.fn().mockResolvedValue({
-          status: 'patched',
-          issueId: 'issue-1',
-          patchId: 'patch-1',
-          healAttemptId: 'heal-1',
-          healedBody: { model: 'gpt-4o', max_tokens: 5 },
-        }),
-        reportOutcome: jest.fn().mockResolvedValue({ healAttemptId: 'heal-1' }),
-      };
-      const realAutofix = new AutofixService(
-        healingClient as unknown as HealingClient,
-        { findOne: jest.fn().mockResolvedValue({ id: 'agent-1', autofix_enabled: true }) } as never,
-        { get: jest.fn().mockReturnValue(undefined) } as unknown as ConfigService,
-      );
-      (svc as unknown as { autofixService: AutofixService }).autofixService = realAutofix;
-      resolveService.resolve.mockResolvedValue({
-        tier: 'standard',
-        route: route('openai', 'api_key', 'gpt-4o'),
-        fallback_routes: [route('anthropic', 'api_key', 'claude')],
-        confidence: 0.9,
-        score: 5,
-        reason: 'scored',
-      });
-      fallbackService.tryForwardToProvider.mockImplementation(
-        async () =>
-          ({
-            response: new Response('{"error":{"message":"bad param"}}', { status: 400 }),
-            wireRequestBody: { model: 'gpt-4o', max_tokens: 7 },
-            wireApiMode: 'chat_completions',
-            retryWireBody: jest.fn(),
-            isGoogle: false,
-            isAnthropic: false,
-            isChatGpt: false,
-          }) as never,
-      );
-      fallbackService.retryWireBody.mockResolvedValue({
-        response: new Response(new ReadableStream(), {
-          status: 200,
-          headers: { 'content-type': 'text/event-stream' },
-        }),
-        isGoogle: false,
-        isAnthropic: false,
-        isChatGpt: false,
-      } as never);
-      fallbackService.tryFallbacks.mockResolvedValue({
-        success: {
-          forward: { response: okResponse(), isGoogle: false, isAnthropic: true, isChatGpt: false },
-          model: 'claude',
-          provider: 'anthropic',
-          fallbackIndex: 0,
-        },
-        failures: [],
-      } as never);
-    });
-
-    const streamOpts = () =>
-      baseOpts({ body: { messages: [{ role: 'user', content: 'hi' }], stream: true } });
-
-    it('does not credit Autofix when the healed stream fails warm-up and a fallback serves', async () => {
-      mockedPeek.mockResolvedValue({
-        ok: false,
-        reason: 'timeout',
-        message: 'No data within 15000ms',
-      } as never);
-
-      const result = await svc.proxyRequest(streamOpts());
-
-      expect(result.meta.fallbackFromModel).toBe('gpt-4o');
-      expect(deriveAutofixStatus(result.autofix)).toBe('retry_failed');
-      const retry = result.autofix?.chain.find((entry) => entry.origin === 'autofix');
-      expect(retry?.http_status).toBe(502);
-      expect(healingClient.reportOutcome).toHaveBeenCalledWith(
-        'heal-1',
-        expect.objectContaining({
-          retryStatusCode: 502,
-          error: expect.objectContaining({
-            message: expect.stringContaining('No data within 15000ms'),
-          }),
-        }),
-        expect.anything(),
-      );
-    });
-
-    it('still credits Autofix when the healed stream delivers data', async () => {
-      mockedPeek.mockImplementation(async () => ({ ok: true, stream: new ReadableStream() }));
-
-      const result = await svc.proxyRequest(streamOpts());
-
-      expect(result.meta.fallbackFromModel).toBeUndefined();
-      expect(result.forward.response.status).toBe(200);
-      expect(deriveAutofixStatus(result.autofix)).toBe('retry_succeeded');
-      expect(healingClient.reportOutcome).toHaveBeenCalledWith(
-        'heal-1',
-        { retryStatusCode: 200 },
-        expect.anything(),
-      );
-      expect(fallbackService.tryFallbacks).not.toHaveBeenCalled();
-    });
-
-    it('only warms up a healed retry that returned a streaming body', async () => {
-      fallbackService.retryWireBody
-        .mockResolvedValueOnce({
-          response: new Response('{"error":{"message":"still bad"}}', { status: 400 }),
-          isGoogle: false,
-          isAnthropic: false,
-          isChatGpt: false,
-        } as never)
-        .mockResolvedValueOnce({
-          response: new Response(null, { status: 200 }),
-          isGoogle: false,
-          isAnthropic: false,
-          isChatGpt: false,
-        } as never);
-
-      const failed = await svc.proxyRequest(streamOpts());
-      expect(deriveAutofixStatus(failed.autofix)).toBe('retry_failed');
-      expect(failed.meta.fallbackFromModel).toBe('gpt-4o');
-
-      const bodiless = await svc.proxyRequest(streamOpts());
-      expect(deriveAutofixStatus(bodiless.autofix)).toBe('retry_succeeded');
-      expect(mockedPeek).not.toHaveBeenCalled();
-    });
-  });
-
   describe('limit enforcement', () => {
     it('returns a friendly limit response when checkLimits flags an excess', async () => {
       limitCheck.checkLimits.mockResolvedValue({
@@ -1595,7 +867,6 @@ describe('ProxyService — orchestration', () => {
         reason: 'model_not_available',
         manifest_error_code: 'M302',
       });
-      expect(autofixService.maybeHeal).not.toHaveBeenCalled();
     });
 
     it('prefers the subscription when one provider carries a bare name on both auths', async () => {
@@ -1781,18 +1052,13 @@ describe('ProxyService — orchestration', () => {
       expect(fallbackService.tryForwardToProvider).not.toHaveBeenCalled();
       expect(body).toContain('M302');
       expect(result.meta.manifest_error_code).toBe('M302');
-      expect(autofixService.maybeHeal).not.toHaveBeenCalled();
     });
 
-    it('sends the real provider model-not-found response to Autofix', async () => {
+    it('returns the real provider model-not-found response unchanged', async () => {
       providerKeyService.hasRouteCredentials.mockImplementation(
         async (_tenantId, candidate) =>
           candidate.provider === 'openai' && candidate.authType === 'api_key',
       );
-      const wireRequestBody = {
-        model: 'gpt-new',
-        messages: [{ role: 'user', content: 'hi' }],
-      };
       const providerFailure = {
         response: new Response(
           JSON.stringify({
@@ -1804,9 +1070,6 @@ describe('ProxyService — orchestration', () => {
           }),
           { status: 404, headers: { 'content-type': 'application/json' } },
         ),
-        wireRequestBody,
-        wireApiMode: 'chat_completions' as const,
-        retryWireBody: jest.fn(),
         providerCallStarted: true,
         isGoogle: false,
         isAnthropic: false,
@@ -1820,15 +1083,13 @@ describe('ProxyService — orchestration', () => {
         }),
       );
 
-      expect(autofixService.maybeHeal).toHaveBeenCalledWith(
-        expect.objectContaining({
-          forward: providerFailure,
-          provider: 'openai',
-          model: 'gpt-new',
-          authType: 'api_key',
-          requestBody: wireRequestBody,
-        }),
+      expect(fallbackService.tryForwardToProvider).toHaveBeenCalledTimes(1);
+      expect(fallbackService.tryForwardToProvider).toHaveBeenCalledWith(
+        expect.objectContaining({ provider: 'openai', model: 'gpt-new', authType: 'api_key' }),
       );
+      // An explicit model never runs the fallback chain: the provider's own
+      // 404 is the response.
+      expect(fallbackService.tryFallbacks).not.toHaveBeenCalled();
       expect(result.forward).toBe(providerFailure);
       expect(result.meta.manifest_error_code).toBeUndefined();
     });
@@ -3119,7 +2380,7 @@ describe('ProxyService — orchestration', () => {
   });
 
   describe('routing dispatch', () => {
-    it('treats non-array messages from a healed body as empty scorer input', async () => {
+    it('treats non-array messages as empty scorer input', async () => {
       resolveService.resolve.mockResolvedValue({
         tier: 'standard',
         route: route('openai', 'api_key', 'gpt-4o'),
diff --git a/packages/backend/src/routing/proxy/__tests__/stream-warmup.spec.ts b/packages/backend/src/routing/proxy/__tests__/stream-warmup.spec.ts
index ee5f0c86..c9f3a377 100644
--- a/packages/backend/src/routing/proxy/__tests__/stream-warmup.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/stream-warmup.spec.ts
@@ -197,8 +197,8 @@ describe('peekStream', () => {
   });
 
   it('peeks an already-peeked stream without waiting for new data', async () => {
-    // The healed Autofix retry is warmed up once, then proxyRequest warms up
-    // the returned stream again: the buffered first chunk must satisfy it.
+    // A stream that was already warmed up once can be peeked again: the
+    // buffered first chunk must satisfy the second peek.
     const enc = new TextEncoder();
     const first = await peekStream(makeStream([enc.encode('a'), enc.encode('b')], 500), 1_000);
     if (!first.ok) throw new Error('first peek failed');
diff --git a/packages/backend/src/routing/proxy/anthropic-adapter.ts b/packages/backend/src/routing/proxy/anthropic-adapter.ts
index 940a748b..7b77d0f3 100644
--- a/packages/backend/src/routing/proxy/anthropic-adapter.ts
+++ b/packages/backend/src/routing/proxy/anthropic-adapter.ts
@@ -525,7 +525,7 @@ export function toAnthropicRequest(
   // Anthropic-native fields forwarded when the inbound request originated as
   // Anthropic Messages (POST /v1/messages). Chat-completions clients won't
   // set these, so this is a no-op for the OpenAI-compat path. Model-specific
-  // rejection fixes belong in Autofix, not in this protocol adapter.
+  // rejection fixes do not belong in this protocol adapter.
   if (body.thinking !== undefined) {
     result.thinking = body.thinking;
   }
diff --git a/packages/backend/src/routing/proxy/provider-client-converters.ts b/packages/backend/src/routing/proxy/provider-client-converters.ts
index 58193295..1f41ebe7 100644
--- a/packages/backend/src/routing/proxy/provider-client-converters.ts
+++ b/packages/backend/src/routing/proxy/provider-client-converters.ts
@@ -104,8 +104,8 @@ export type { SignatureLookup, ThinkingBlockLookup } from './proxy-types';
 // This layer keeps unconditional wire-format adaptations: provider-level
 // protocol facts (a field that is simply not part of a given API) and
 // cross-protocol translations. Model- and version-specific corrections — a
-// parameter that some models accept and others reject — stay out of here and
-// belong to Autofix, where the provider error can scope a patch.
+// parameter that some models accept and others reject — stay out of here: the
+// provider error, not a static table, is what can scope such a fix.
 
 /**
  * Providers that use `max_completion_tokens` without a legacy alias rewrite.
@@ -336,7 +336,7 @@ export interface SanitizeOpenAiBodyOptions {
 
 /**
  * Normalize unconditional OpenAI-compatible wire differences. Provider- and
- * model-specific parameter corrections are intentionally left to Autofix.
+ * model-specific parameter corrections are intentionally left out.
  */
 export function sanitizeOpenAiBody(
   body: Record<string, unknown>,
@@ -392,7 +392,7 @@ export function sanitizeOpenAiBody(
     }
     if (OPENAI_ONLY_FIELDS.has(key)) continue;
     // Ollama's OpenAI-compatible endpoint does not accept the Anthropic-style
-    // `thinking` block; other non-passthrough providers are left to Autofix.
+    // `thinking` block; other non-passthrough providers receive it unchanged.
     if (key === 'thinking' && OLLAMA_ENDPOINTS.has(endpointKey.toLowerCase())) continue;
     if (key === 'max_completion_tokens') {
       // Preserve max_completion_tokens for endpoints that require it; otherwise
diff --git a/packages/backend/src/routing/proxy/provider-client.ts b/packages/backend/src/routing/proxy/provider-client.ts
index 2768e29e..9934f6f1 100644
--- a/packages/backend/src/routing/proxy/provider-client.ts
+++ b/packages/backend/src/routing/proxy/provider-client.ts
@@ -53,19 +53,8 @@ import { getBedrockRuntimeCapabilities } from '../bedrock-runtime-capabilities';
 
 export interface ForwardResult {
   response: Response;
-  /** Exact JSON body sent to the resolved provider transport. */
-  wireRequestBody?: Record<string, unknown>;
-  /** Exact URL used by the resolved provider transport. */
-  wireRequestUrl?: string;
   /** Provider-native protocol emitted at the transport boundary. */
   wireFormat?: ProviderWireFormat;
-  /** Provider-facing API shape of {@link wireRequestBody}. */
-  wireApiMode?: ProxyApiMode;
-  /** Re-send a healed wire body through the already-resolved transport. */
-  retryWireBody?: (
-    body: Record<string, unknown>,
-    attempt?: ProviderAttemptRef,
-  ) => Promise<ForwardResult>;
   /** False only when Manifest produced a response without invoking provider transport. */
   providerCallStarted?: boolean;
   /** Persisted provider-call identity, when request tracking is available. */
@@ -89,13 +78,6 @@ export interface ForwardResult {
   responsesToolNames?: ResponsesToolNames;
 }
 
-function wireApiMode(endpoint: ProviderEndpoint): ProxyApiMode | undefined {
-  if (endpoint.format === 'openai') return 'chat_completions';
-  if (endpoint.format === 'anthropic') return 'messages';
-  if (endpoint.format === 'chatgpt') return 'responses';
-  return undefined;
-}
-
 function wireFormat(endpoint: ProviderEndpoint): ProviderWireFormat | undefined {
   if (endpoint.format === 'openai') return 'openai_chat_completions';
   if (endpoint.format === 'anthropic') return 'anthropic_messages';
@@ -403,7 +385,6 @@ export class ProviderClient {
     const isChatGpt = endpoint.format === 'chatgpt' && !isResponses;
     const isCodeAssist = !!endpoint.codeAssistEnvelope;
     const textFormat = responsesTextFormat(body, opts.apiMode);
-    const resolvedWireApiMode = wireApiMode(endpoint);
     const resolvedWireFormat = wireFormat(endpoint);
     const needsChatBody =
       opts.apiMode !== undefined &&
@@ -432,9 +413,7 @@ export class ProviderClient {
         isGoogle: false,
         isAnthropic: false,
         isChatGpt: false,
-        wireRequestBody: requestSource,
         wireFormat: 'kiro_chat',
-        wireApiMode: opts.apiMode,
         responsesTextFormat: textFormat,
         responsesToolNames:
           opts.apiMode === 'responses' ? responsesToolNames(body.tools) : undefined,
@@ -472,73 +451,55 @@ export class ProviderClient {
     const finalHeaders =
       affinity || extraHeaders ? { ...headers, ...extraHeaders, ...affinity?.headers } : headers;
 
-    const retryWireBody = async (
-      wireRequestBody: Record<string, unknown>,
-      attempt: ProviderAttemptRef | undefined = opts.attempt,
-    ): Promise<ForwardResult> => {
-      if (resolvedWireFormat) {
-        attempt?.startRecording?.({
-          requestBody: wireRequestBody,
-          wireFormat: resolvedWireFormat,
-        });
-      }
-      this.logger.debug(`Forwarding to ${endpointKey}: ${url.replace(/key=[^&]+/, 'key=***')}`);
-
-      // SSRF defense in depth for user-supplied endpoint URLs (custom providers,
-      // subscription resource URLs). Re-check every actual forward, including
-      // an immediate Autofix retry, because DNS may have rebound in between.
-      if (endpoint.requiresSsrfRevalidation) {
-        try {
-          await validatePublicUrl(url, { allowPrivate: isSelfHosted() });
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          throw new Error(`Refusing to forward to disallowed URL: ${message}`);
-        }
-      }
-
-      const result = await this.executeFetch(url, finalHeaders, wireRequestBody, signal, stream, {
-        isGoogle,
-        isAnthropic,
-        isChatGpt,
-        isResponses,
-        isCodeAssist,
-        responsesTextFormat: textFormat,
-        responsesToolNames:
-          opts.apiMode === 'responses' ? responsesToolNames(body.tools) : undefined,
+    const attempt = opts.attempt;
+    if (resolvedWireFormat) {
+      attempt?.startRecording?.({
+        requestBody,
+        wireFormat: resolvedWireFormat,
       });
-      const response =
-        !stream &&
-        endpoint.format === 'openai' &&
-        (opts.apiMode === undefined || opts.apiMode === 'chat_completions')
-          ? await qualifyEmptyChatCompletion(result.response, attempt)
-          : result.response;
-      const qualifiedResult =
-        endpointKey === 'openai-subscription'
-          ? {
-              ...result,
-              response: await qualifyChatGptResponse(response, {
-                downstreamFormat: isResponses ? 'responses' : 'chat-completions',
-              }),
-            }
-          : { ...result, response };
-      if (affinity) {
-        this.codexAffinity.capture(
-          affinity.storeKey,
-          qualifiedResult.response,
-          affinity.incarnation,
-        );
+    }
+    this.logger.debug(`Forwarding to ${endpointKey}: ${url.replace(/key=[^&]+/, 'key=***')}`);
+
+    // SSRF defense in depth for user-supplied endpoint URLs (custom providers,
+    // subscription resource URLs). Re-check on every actual forward, because DNS
+    // may have rebound since the URL was first validated.
+    if (endpoint.requiresSsrfRevalidation) {
+      try {
+        await validatePublicUrl(url, { allowPrivate: isSelfHosted() });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Refusing to forward to disallowed URL: ${message}`);
       }
-      return {
-        ...qualifiedResult,
-        wireRequestBody,
-        wireRequestUrl: url,
-        wireFormat: resolvedWireFormat,
-        wireApiMode: resolvedWireApiMode,
-        retryWireBody,
-      };
-    };
+    }
 
-    return retryWireBody(requestBody);
+    const result = await this.executeFetch(url, finalHeaders, requestBody, signal, stream, {
+      isGoogle,
+      isAnthropic,
+      isChatGpt,
+      isResponses,
+      isCodeAssist,
+      responsesTextFormat: textFormat,
+      responsesToolNames: opts.apiMode === 'responses' ? responsesToolNames(body.tools) : undefined,
+    });
+    const response =
+      !stream &&
+      endpoint.format === 'openai' &&
+      (opts.apiMode === undefined || opts.apiMode === 'chat_completions')
+        ? await qualifyEmptyChatCompletion(result.response, attempt)
+        : result.response;
+    const qualifiedResult =
+      endpointKey === 'openai-subscription'
+        ? {
+            ...result,
+            response: await qualifyChatGptResponse(response, {
+              downstreamFormat: isResponses ? 'responses' : 'chat-completions',
+            }),
+          }
+        : { ...result, response };
+    if (affinity) {
+      this.codexAffinity.capture(affinity.storeKey, qualifiedResult.response, affinity.incarnation);
+    }
+    return { ...qualifiedResult, wireFormat: resolvedWireFormat };
   }
 
   private async resolveEndpoint(
diff --git a/packages/backend/src/routing/proxy/proxy-fallback.service.ts b/packages/backend/src/routing/proxy/proxy-fallback.service.ts
index a86abc6e..205f28f4 100644
--- a/packages/backend/src/routing/proxy/proxy-fallback.service.ts
+++ b/packages/backend/src/routing/proxy/proxy-fallback.service.ts
@@ -5,8 +5,6 @@ import type { AuthType, ModelRoute } from 'manifest-shared';
 import { applyRequestParamDefaults } from 'manifest-shared';
 import { AgentModelParamsService } from '../routing-core/agent-model-params.service';
 import { ProviderParamSpecService } from '../routing-core/provider-param-spec.service';
-import { AutofixService, type AutofixAttempt } from '../autofix/autofix.service';
-import { getAutofixRetry, type AutofixRecord } from '../autofix/autofix.types';
 
 /**
  * Context for the per-attempt param-defaults merge. Carries the agentId so
@@ -137,13 +135,6 @@ export interface FailedFallback {
   attempt?: ProviderAttemptRef;
   /** False when the route was rejected locally (for example by a cooldown). */
   providerCallStarted?: boolean;
-  /**
-   * Autofix audit for this hop when Phoenix was consulted. Stamped onto the
-   * failed hop's row so a recovered fallback keeps its Phoenix decision.
-   */
-  autofix?: AutofixRecord;
-  /** Which side of the Autofix retry pair this row is. Defaults to `original`. */
-  autofixRole?: 'original' | 'retry';
 }
 
 @Injectable()
@@ -168,7 +159,6 @@ export class ProxyFallbackService {
     private readonly modelParamsService: AgentModelParamsService,
     private readonly providerParamSpecs: ProviderParamSpecService,
     private readonly reasoningCache: ReasoningContentCache,
-    private readonly autofixService: AutofixService,
   ) {}
 
   /**
@@ -233,8 +223,6 @@ export class ProxyFallbackService {
       authType?: AuthType;
       keyLabel?: string;
       tenantProviderId: string | null;
-      /** Phoenix audit when this hop was recovered by Autofix. */
-      autofix?: AutofixRecord;
     } | null;
     failures: FailedFallback[];
   }> {
@@ -366,71 +354,10 @@ export class ProxyFallbackService {
         { stream, provider, model },
       );
 
-      // Autofix runs on a failed fallback hop too, not just the primary: a
-      // fallback that rejects a request-side param (e.g. an unsupported
-      // response_format) can carry its own Phoenix patch, and retrying it on
-      // this same transport recovers the request instead of recording a dead
-      // hop. Consent is enforced inside maybeHeal, exactly like the primary.
-      let autofixAttempt: AutofixAttempt | null = null;
-      let preHealErrorBody: string | null = null;
-      const fallbackApiMode = forward.wireApiMode ?? apiMode;
-      if (
-        !forward.response.ok &&
-        this.autofixService.isRepairable(forward.response.status) &&
-        forward.wireRequestBody &&
-        forward.retryWireBody &&
-        fallbackApiMode
-      ) {
-        // Keep the failed body readable for the audit row if the patch heals —
-        // maybeHeal consumes the live response.
-        preHealErrorBody = await forward.response.clone().text();
-        autofixAttempt = await this.maybeHealFallback({
-          forward,
-          requestBody: forward.wireRequestBody,
-          apiMode: fallbackApiMode,
-          agentId,
-          tenantId,
-          provider,
-          model,
-          authType,
-          tenantProviderId,
-          providerKeyLabel,
-          signal,
-          startProviderAttempt,
-          stream,
-        });
-      }
-      const finalForward = autofixAttempt?.forward ?? forward;
-      // A retry is sent only when Phoenix handed back a patch. When one was
-      // sent, the original hop is a distinct provider attempt that needs its own
-      // terminal row; otherwise finalForward IS the original.
-      const retrySent = autofixAttempt
-        ? getAutofixRetry(autofixAttempt.record) !== undefined
-        : false;
-      const originalFailure = (): FailedFallback => ({
-        model,
-        provider,
-        fallbackIndex: i,
-        status: forward.response.status,
-        errorBody: preHealErrorBody!,
-        authType,
-        tenantProviderId,
-        // Selected-row label (credentials.keyLabel already folded in above),
-        // so this row's label and tenant_provider_id name the same connection.
-        keyLabel: providerKeyLabel,
-        attempt: forward.attempt,
-        providerCallStarted: forward.providerCallStarted,
-        autofix: autofixAttempt?.record,
-        autofixRole: 'original',
-      });
-
-      if (finalForward.response.ok) {
-        // The hop that failed first is still recorded when Autofix recovers it,
-        // so a healed fallback keeps the same audit trail as a healed primary.
-        if (retrySent) failures.push(originalFailure());
+      if (forward.response.ok) {
         return {
           success: {
-            forward: finalForward,
+            forward,
             model,
             provider,
             fallbackIndex: i,
@@ -439,35 +366,26 @@ export class ProxyFallbackService {
             // alongside its tenant_provider_id so the pair always matches.
             keyLabel: providerKeyLabel,
             tenantProviderId,
-            // Fallback's own Phoenix audit, threaded to the recorder so a healed
-            // fallback hop carries the same metadata as a healed primary.
-            autofix: retrySent ? autofixAttempt?.record : undefined,
           },
           failures,
         };
       }
 
-      const errorBody = await finalForward.response.text();
-      await finalForward.attempt?.finishRecording?.(recordingResponseFromText(errorBody));
-      // A failed patched retry is a second provider attempt: record the original
-      // hop too, so Autofix never leaves it dangling `pending`.
-      if (retrySent) failures.push(originalFailure());
+      const errorBody = await forward.response.text();
+      await forward.attempt?.finishRecording?.(recordingResponseFromText(errorBody));
       failures.push({
         model,
         provider,
         fallbackIndex: i,
-        status: finalForward.response.status,
+        status: forward.response.status,
         errorBody,
         authType,
         tenantProviderId,
         // Selected-row label (credentials.keyLabel already folded in above),
         // so this row's label and tenant_provider_id name the same connection.
         keyLabel: providerKeyLabel,
-        attempt: finalForward.attempt,
-        providerCallStarted: finalForward.providerCallStarted,
-        ...(autofixAttempt
-          ? { autofix: autofixAttempt.record, autofixRole: retrySent ? 'retry' : 'original' }
-          : {}),
+        attempt: forward.attempt,
+        providerCallStarted: forward.providerCallStarted,
       });
 
       const existing = failedAuthByProvider.get(provider.toLowerCase());
@@ -480,63 +398,6 @@ export class ProxyFallbackService {
     return { success: null, failures };
   }
 
-  /**
-   * Heal a failed fallback hop before giving up on it. Phoenix patches are
-   * scoped per provider/model, so a fallback model with its own known issue can
-   * be recovered even when the primary could not. The patched body is resent
-   * through the SAME fallback transport (`retryWireBody`) rather than
-   * re-resolved against the full routing chain: the fallback is already the
-   * deliberate alternative route, and hopping back to the primary here would
-   * undo that.
-   *
-   * Returns null when Autofix declines (off for the agent, non-repairable status,
-   * no patch) — callers then keep the original failure. The caller has already
-   * established that the forward carries a wire body and a retry hook.
-   */
-  private async maybeHealFallback(input: {
-    forward: ForwardResult;
-    requestBody: Record<string, unknown>;
-    apiMode: ProxyApiMode;
-    agentId: string;
-    tenantId: string;
-    provider: string;
-    model: string;
-    authType: AuthType;
-    tenantProviderId: string | null;
-    providerKeyLabel?: string;
-    signal?: AbortSignal;
-    startProviderAttempt?: StartProviderAttempt;
-    stream: boolean;
-  }): Promise<AutofixAttempt | null> {
-    return this.autofixService.maybeHeal({
-      forward: input.forward,
-      agentId: input.agentId,
-      tenantId: input.tenantId,
-      provider: input.provider,
-      model: input.model,
-      authType: input.authType,
-      apiMode: input.apiMode,
-      requestBody: input.requestBody,
-      // Warm up the patched retry before Autofix sees it, so a retry whose
-      // stream stalls counts as a failed patch rather than a healed request.
-      reforward: async (healedBody) =>
-        this.warmUpStreamBody(
-          await this.retryWireBody(input.forward, healedBody, {
-            provider: input.provider,
-            model: input.model,
-            authType: input.authType,
-            agentId: input.agentId,
-            tenantProviderId: input.tenantProviderId,
-            providerKeyLabel: input.providerKeyLabel,
-            startProviderAttempt: input.startProviderAttempt,
-            signal: input.signal,
-            stream: input.stream,
-          }),
-          input,
-        ),
-    });
-  }
-
   /**
    * Streaming counterpart of {@link bufferNonStreamBody} for fallback hops.
    * Peek at the first chunk before the hop is committed; on a stall, error or
@@ -677,76 +538,6 @@ export class ProxyFallbackService {
     }
   }
 
-  /** Re-send a healed body without rebuilding the already-resolved provider request. */
-  async retryWireBody(
-    forward: ForwardResult,
-    healedBody: Record<string, unknown>,
-    opts?: Pick<
-      ForwardProviderOptions,
-      | 'provider'
-      | 'model'
-      | 'authType'
-      | 'agentId'
-      | 'tenantProviderId'
-      | 'providerKeyLabel'
-      | 'startProviderAttempt'
-      | 'signal'
-    > & { stream?: boolean },
-  ): Promise<ForwardResult> {
-    if (!forward.retryWireBody) {
-      throw new Error('Provider forward does not support wire-body retry');
-    }
-    if (!opts) return forward.retryWireBody(healedBody);
-    const attempt = opts.startProviderAttempt?.({
-      provider: opts.provider,
-      model: opts.model,
-      authType: opts.authType,
-      tenantProviderId: opts.tenantProviderId,
-      keyLabel: opts.providerKeyLabel,
-    });
-    try {
-      const retried = await forward.retryWireBody(healedBody, attempt);
-      if (attempt) attempt.completedAtMs = Date.now();
-      // A healed retry can itself be rate-limited. Record the cooldown so the
-      // next attempt on this route skips it, exactly as tryForwardToProvider
-      // does for a first attempt.
-      this.recordRateLimitCooldownForKey(
-        this.rateLimitCooldownKey({
-          agentId: opts.agentId,
-          authType: opts.authType,
-          provider: opts.provider,
-          providerKeyLabel: opts.providerKeyLabel,
-          model: opts.model,
-        }),
-        retried.response,
-      );
-      return await this.bufferNonStreamBody(
-        { ...retried, attempt, providerCallStarted: true },
-        opts,
-      );
-    } catch (error) {
-      if (attempt) attempt.completedAtMs = Date.now();
-      if (attempt && error instanceof Error) {
-        (error as AttemptTaggedError)[PROVIDER_ATTEMPT_REF] = attempt;
-      }
-      if (opts.signal?.aborted || !isTransportError(error)) throw error;
-
-      const failureResponse = buildTransportErrorResponse(error);
-      const message = describeTransportError(error);
-      this.logger.warn(
-        `Provider transport failure: provider=${opts.provider} model=${opts.model} status=${failureResponse.status} message=${message}`,
-      );
-      return {
-        response: failureResponse,
-        attempt,
-        providerCallStarted: true,
-        isGoogle: false,
-        isAnthropic: false,
-        isChatGpt: false,
-      };
-    }
-  }
-
   private getActiveRateLimitCooldown(opts: ForwardProviderOptions): number | null {
     const key = this.rateLimitCooldownKey(opts);
     if (!key) return null;
diff --git a/packages/backend/src/routing/proxy/proxy-message-recorder.ts b/packages/backend/src/routing/proxy/proxy-message-recorder.ts
index 71731402..93b6f465 100644
--- a/packages/backend/src/routing/proxy/proxy-message-recorder.ts
+++ b/packages/backend/src/routing/proxy/proxy-message-recorder.ts
@@ -4,7 +4,6 @@ import { Repository } from 'typeorm';
 import { v4 as uuid } from 'uuid';
 import {
   classifyMessageError,
-  deriveAutofixStatus,
   FAILED_STATUS,
   normalizeStatus,
   CANCELLED_STATUS,
@@ -36,73 +35,10 @@ import {
   isRecordableManifestCode,
   type ManifestBlockedRequestReason,
 } from '../../common/errors/manifest-error';
-import {
-  getAutofixRetry,
-  type AutofixChainEntry,
-  type AutofixRecord,
-} from '../autofix/autofix.types';
-import { serializeProviderError } from '../autofix/provider-error-normalizer';
 import { normalizeProviderErrorForStorage } from './proxy-error-sanitizer';
 
 export const FAILED_WITHOUT_MESSAGE = 'Request failed without an error message.';
 
-/**
- * Phoenix's decision metadata for a healed row: its issue/patch/heal-attempt ids
- * plus the human-readable "why" ({@link AutofixChainEntry.explanation}). Null when
- * the entry carries none (e.g. the heal call never reached Phoenix).
- */
-function buildAutofixDecision(entry: AutofixChainEntry | undefined): object | null {
-  if (!entry) return null;
-  const present =
-    entry.phoenix_status != null ||
-    entry.issue_id != null ||
-    entry.patch_id != null ||
-    entry.heal_attempt_id != null ||
-    entry.explanation != null;
-  if (!present) return null;
-  return {
-    status: entry.phoenix_status ?? null,
-    issueId: entry.issue_id ?? null,
-    patchId: entry.patch_id ?? null,
-    healAttemptId: entry.heal_attempt_id ?? null,
-    explanation: entry.explanation ?? null,
-  };
-}
-
-/**
- * Autofix audit for every Phoenix decision, plus linked-flow columns only when
- * Manifest actually sent a patched retry.
- */
-function autofixColumns(
-  autofix: AutofixRecord | undefined,
-  role: 'original' | 'retry',
-): Partial<AgentMessage> {
-  if (!autofix) return {};
-  // The heal decision (ids, operations, explanation) rides the attempt-0 entry.
-  const healEntry = autofix.chain.find(
-    (e) =>
-      e.operations != null ||
-      e.issue_id != null ||
-      e.heal_attempt_id != null ||
-      e.explanation != null,
-  );
-  const decision = buildAutofixDecision(healEntry);
-  if (!getAutofixRetry(autofix)) {
-    return decision ? { autofix_decision: decision } : {};
-  }
-  return {
-    autofix_applied: true,
-    autofix_group_id: autofix.groupId,
-    autofix_role: role,
-    autofix_operations: (healEntry?.operations as object | null) ?? null,
-    autofix_decision: buildAutofixDecision(healEntry),
-  };
-}
-
-function terminalAutofixRole(autofix: AutofixRecord | undefined): 'original' | 'retry' {
-  return getAutofixRetry(autofix) ? 'retry' : 'original';
-}
-
 export interface HeaderTierRef {
   headerTierId?: string | null;
   headerTierName?: string | null;
@@ -144,8 +80,6 @@ export interface ProviderErrorOpts extends HeaderTierRef {
    * provider request. Persisted to `agent_messages.request_params`.
    */
   requestParams?: RequestParamDefaults | null;
-  /** Autofix audit when this error was the terminal outcome after healing. */
-  autofix?: AutofixRecord;
   /** API surface to retain when this terminal write creates the Request. */
   apiMode?: ProxyApiMode;
 }
@@ -154,8 +88,6 @@ export type { ManifestBlockedRequestReason };
 
 export interface ManifestBlockedRequestOpts {
   requestId?: string;
-  /** Real provider retry to finalize when Autofix did not clear a Manifest block. */
-  attempt?: ProviderAttemptRef;
   /**
    * The status the caller saw, when there was one. Omitted for the HTTP-200
    * friendly stubs (no provider was contacted, so there is no upstream status
@@ -171,13 +103,6 @@ export interface ManifestBlockedRequestOpts {
   sessionKey?: string;
   callerAttribution?: CallerAttribution | null;
   requestHeaders?: Record<string, string> | null;
-  /**
-   * Autofix audit when this Manifest-blocked failure was handed to the healing
-   * service (e.g. an M302 unknown model). This path is used only when the block
-   * remains caller-visible; a healed request finishes through the success path
-   * and records only the provider retry Attempt.
-   */
-  autofix?: AutofixRecord;
   /** End-to-end time until Manifest returned the rejection. */
   durationMs?: number;
   /**
@@ -258,14 +183,6 @@ export interface FallbackSuccessOpts extends HeaderTierRef {
    * known params apply. Persisted to `agent_messages.request_params`.
    */
   requestParams?: RequestParamDefaults | null;
-  /** Request-level Autofix outcome when a failed retry later fell back. */
-  autofix?: AutofixRecord;
-  /**
-   * Autofix audit of the winning fallback hop itself. Only this record stamps
-   * the fallback-success row's linkage columns, so an ordinary fallback success
-   * never inherits the primary's Autofix retry metadata.
-   */
-  fallbackAutofix?: AutofixRecord;
   /** API surface to retain when this terminal write creates the Request. */
   apiMode?: ProxyApiMode;
 }
@@ -290,28 +207,10 @@ export interface SuccessMessageOpts extends HeaderTierRef {
   callerAttribution?: CallerAttribution | null;
   requestHeaders?: Record<string, string> | null;
   requestParams?: RequestParamDefaults | null;
-  /** Autofix audit when a healed request succeeded. */
-  autofix?: AutofixRecord;
   /** API surface to retain when this terminal write creates the Request. */
   apiMode?: ProxyApiMode;
 }
 
-export interface AutofixOriginalOpts extends HeaderTierRef {
-  requestId?: string;
-  attemptNumber?: number;
-  attempt?: ProviderAttemptRef;
-  provider?: string;
-  reason?: string;
-  authType?: string;
-  traceId?: string;
-  specificityCategory?: string;
-  providerKeyLabel?: string;
-  tenantProviderId?: string | null;
-  callerAttribution?: CallerAttribution | null;
-  requestHeaders?: Record<string, string> | null;
-  requestParams?: RequestParamDefaults | null;
-}
-
 function buildMessageRow(
   ctx: IngestionContext,
   overrides: Partial<AgentMessage>,
@@ -332,8 +231,8 @@ function buildMessageRow(
   };
   // Stamp the orthogonal error axes from this row's own signals so every insert
   // site is classified identically (and identically to the backfill migration).
-  // classifyRow reads the *rich* status (`rate_limited` / `fallback_error` /
-  // `auto_fixed`) to derive error_class + superseded, then the stored status is
+  // classifyRow reads the *rich* status (`rate_limited` / `fallback_error`) to
+  // derive error_class + superseded, then the stored status is
   // collapsed onto the canonical `success`/`failed` vocabulary — the reason it
   // failed now lives entirely on those orthogonal columns.
   const classified = classifyRow(row);
@@ -370,7 +269,6 @@ function buildRequestRow(
   requestId: string,
   attempt: Partial<AgentMessage>,
   terminal: boolean,
-  autofix?: AutofixRecord,
   apiMode?: ProxyApiMode,
 ): ManifestRequest {
   const classified = classifyRow(attempt);
@@ -396,7 +294,6 @@ function buildRequestRow(
     timestamp,
     duration_ms: attempt.duration_ms ?? null,
     status,
-    autofix_status: deriveAutofixStatus(autofix),
     error_message: errorMessage,
     error_http_status: terminal ? (attempt.error_http_status ?? null) : null,
     error_code: terminal ? (attempt.error_code ?? null) : null,
@@ -584,7 +481,6 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
     requestId: string,
     attempt: Partial<AgentMessage>,
     terminal: boolean,
-    autofix?: AutofixRecord,
     apiMode?: ProxyApiMode,
   ): Promise<boolean> {
     // Unit-test repository doubles predate the request table. Production
@@ -593,7 +489,7 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
     if (!getRepository) return false;
     const repo = getRepository(ManifestRequest);
     if (typeof repo.createQueryBuilder !== 'function') return false;
-    const row = buildRequestRow(ctx, requestId, attempt, terminal, autofix, apiMode);
+    const row = buildRequestRow(ctx, requestId, attempt, terminal, apiMode);
     const insert = repo.createQueryBuilder().insert().into(ManifestRequest).values(row);
     if (terminal) {
       // Most terminal writers do not need to repeat the ingress surface. When
@@ -607,7 +503,6 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
         'session_id',
         'duration_ms',
         'status',
-        'autofix_status',
         'error_message',
         'error_http_status',
         'error_code',
@@ -678,7 +573,6 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
         request_headers: opts.requestHeaders ?? null,
       },
       false,
-      undefined,
       opts.apiMode,
     );
   }
@@ -731,7 +625,7 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       error_message: null,
       error_http_status: null,
     });
-    await this.persistRequest(ctx, opts.requestId, row, true, undefined, opts.apiMode);
+    await this.persistRequest(ctx, opts.requestId, row, true, opts.apiMode);
     if (opts.attempt) await this.persistAttempt(row, opts.attempt);
     this.eventBus.emit(ctx.tenantId, 'message', ctx.userId);
   }
@@ -820,18 +714,9 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       headerTierId,
       headerTierName,
       headerTierColor,
-      autofix,
       apiMode,
     } = opts ?? {};
-    // A real Autofix retry must never disappear behind the generic 429
-    // deduplication window; it is required to complete the linked attempt story.
-    if (
-      httpStatus === 429 &&
-      !attempt &&
-      !skipAttempt &&
-      !getAutofixRetry(autofix) &&
-      this.shouldSkipRateLimitRecord(ctx)
-    ) {
+    if (httpStatus === 429 && !attempt && !skipAttempt && this.shouldSkipRateLimitRecord(ctx)) {
       return;
     }
 
@@ -855,7 +740,6 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
         2000,
       ),
       error_http_status: httpStatus,
-      ...autofixColumns(autofix, terminalAutofixRole(autofix)),
       model: canonical.model,
       provider: canonical.provider,
       routing_tier: tier ?? null,
@@ -873,7 +757,7 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       header_tier_name: headerTierName ?? null,
       header_tier_color: headerTierColor ?? null,
     });
-    await this.persistRequest(ctx, requestId, row, true, autofix, apiMode);
+    await this.persistRequest(ctx, requestId, row, true, apiMode);
     await this.persistAttempt(row, attempt);
     this.eventBus.emit(ctx.tenantId, 'message', ctx.userId);
   }
@@ -905,9 +789,7 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       sessionKey,
       callerAttribution,
       requestHeaders,
-      autofix,
       durationMs,
-      attempt,
       apiMode,
       routing,
     } = opts;
@@ -925,7 +807,6 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       timestamp: new Date().toISOString(),
       duration_ms: durationMs ?? null,
       status: httpStatus === 429 ? 'rate_limited' : 'error',
-      ...autofixColumns(autofix, 'original'),
       error_message: scrubSecrets(errorMessage).slice(0, 2000),
       error_code: errorCode ?? null,
       error_http_status: httpStatus ?? null,
@@ -946,17 +827,7 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       header_tier_name: routing?.headerTierName ?? null,
       header_tier_color: routing?.headerTierColor ?? null,
     });
-    // An M302 patched retry is real provider work even when Manifest ultimately
-    // returns its friendly stub; finish that pending Attempt from the audit.
-    await this.persistRequest(ctx, requestId, row, true, autofix, apiMode);
-    const retry = getAutofixRetry(autofix);
-    if (attempt && retry?.error) {
-      await attempt.completeFailure?.({
-        status: retry.http_status,
-        errorBody: serializeProviderError(retry.error),
-        superseded: false,
-      });
-    }
+    await this.persistRequest(ctx, requestId, row, true, apiMode);
     await this.persistAttempt(row);
     this.eventBus.emit(ctx.tenantId, 'message', ctx.userId);
   }
@@ -1071,9 +942,6 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
           header_tier_id: headerTierId ?? null,
           header_tier_name: headerTierName ?? null,
           header_tier_color: headerTierColor ?? null,
-          // Autofix audit for a fallback hop Phoenix was consulted on, so a
-          // recovered hop keeps its issue/patch/operations like a healed primary.
-          ...autofixColumns(f.autofix, f.autofixRole ?? 'original'),
         }),
       );
     }
@@ -1116,14 +984,8 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       headerTierId?: string | null;
       headerTierName?: string | null;
       headerTierColor?: string | null;
-      /** Provider status for the superseded primary or failed Autofix retry. */
+      /** Provider status for the superseded primary. */
       httpStatus?: number | null;
-      /**
-       * Autofix audit when this superseded primary was also an Autofix
-       * attempt. Stamped onto THIS row (not a separate `auto_fixed` row) so a
-       * heal-then-fallback flow records the primary failure exactly once.
-       */
-      autofix?: AutofixRecord;
       /** HTTP status returned to the caller when every fallback was exhausted. */
       terminalHttpStatus?: number;
       /** API surface to retain when the exhausted chain creates the Request. */
@@ -1145,7 +1007,6 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       timestamp,
       duration_ms: opts?.requestDurationMs ?? null,
       status: 'fallback_error',
-      ...autofixColumns(opts?.autofix, terminalAutofixRole(opts?.autofix)),
       error_message: errorMessage,
       // Credential failures (M100/M102) land here with a peacock body; stamp
       // error_code so Messages filters and analytics can group on it.
@@ -1179,7 +1040,6 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       requestId,
       requestOutcome,
       Boolean(opts?.terminalHttpStatus),
-      opts?.autofix,
       opts?.apiMode,
     );
     await this.persistAttempt(row, opts?.attempt);
@@ -1213,8 +1073,6 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       headerTierId,
       headerTierName,
       headerTierColor,
-      autofix,
-      fallbackAutofix,
       apiMode,
     } = opts ?? {};
 
@@ -1274,16 +1132,8 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       header_tier_id: headerTierId ?? null,
       header_tier_name: headerTierName ?? null,
       header_tier_color: headerTierColor ?? null,
-      // A healed fallback's winning attempt is the Autofix retry: stamp the
-      // group, role, operations, and Phoenix decision so it links to the
-      // original hop recorded in recordFailedFallbacks. Only the fallback's own
-      // record qualifies — an ordinary fallback success must not inherit the
-      // primary's Autofix retry metadata.
-      ...autofixColumns(fallbackAutofix, 'retry'),
     });
-    // The request-level Autofix status prefers the fallback's own outcome when
-    // it healed, falling back to the primary's record otherwise.
-    await this.persistRequest(ctx, requestId, row, true, fallbackAutofix ?? autofix, apiMode);
+    await this.persistRequest(ctx, requestId, row, true, apiMode);
     await this.persistAttempt(row, attempt);
     this.eventBus.emit(ctx.tenantId, 'message', ctx.userId);
   }
@@ -1314,7 +1164,6 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       headerTierId,
       headerTierName,
       headerTierColor,
-      autofix,
       apiMode,
     } = opts ?? {};
     const requestId = providedRequestId ?? uuid();
@@ -1380,70 +1229,12 @@ export class ProxyMessageRecorder implements OnModuleDestroy {
       header_tier_id: headerTierId ?? null,
       header_tier_name: headerTierName ?? null,
       header_tier_color: headerTierColor ?? null,
-      ...autofixColumns(autofix, 'retry'),
     });
-    await this.persistRequest(ctx, requestId, requestRow, true, autofix, apiMode);
+    await this.persistRequest(ctx, requestId, requestRow, true, apiMode);
     await this.persistAttempt(requestRow, attempt);
     this.eventBus.emit(ctx.tenantId, 'message', ctx.userId);
   }
 
-  /**
-   * Record the failed original request of an Autofix flow as its own row,
-   * linked to the successful or failed retry via `autofix.groupId`.
-   */
-  async recordAutofixOriginal(
-    ctx: IngestionContext,
-    model: string,
-    tier: string,
-    autofix: AutofixRecord,
-    opts?: AutofixOriginalOpts,
-  ): Promise<void> {
-    if (!getAutofixRetry(autofix)) return;
-    const original = autofix.chain.find((entry) => entry.origin === 'original' && entry.error);
-    if (!original?.error) return;
-
-    const canonical = await this.customProviders.canonicalizeAgentMessageKeys(
-      ctx.tenantId,
-      opts?.provider,
-      model,
-    );
-    const requestId = opts?.requestId ?? uuid();
-    const row = buildMessageRow(ctx, {
-      request_id: requestId,
-      ...attemptIdentity(opts?.attempt, opts?.attemptNumber),
-      trace_id: opts?.traceId ?? null,
-      timestamp: new Date(Date.now() - 1000).toISOString(),
-      status: 'auto_fixed',
-      // The full `{"error":{…}}` envelope, like every other error row — storing the
-      // bare message would drop the `type`/`param`/`code` that identify the error
-      // downstream (see serializeProviderError).
-      error_message: serializeProviderError(original.error),
-      error_http_status: original.http_status,
-      model: canonical.model,
-      provider: canonical.provider,
-      routing_tier: tier ?? null,
-      routing_reason: opts?.reason ?? null,
-      auth_type: opts?.authType ?? null,
-      specificity_category: opts?.specificityCategory ?? null,
-      provider_key_label: opts?.providerKeyLabel ?? null,
-      tenant_provider_id: opts?.tenantProviderId ?? null,
-      caller_attribution: opts?.callerAttribution ?? null,
-      request_headers: opts?.requestHeaders ?? null,
-      request_params: opts?.requestParams ?? null,
-      header_tier_id: opts?.headerTierId ?? null,
-      header_tier_name: opts?.headerTierName ?? null,
-      header_tier_color: opts?.headerTierColor ?? null,
-      autofix_applied: true,
-      autofix_group_id: autofix.groupId,
-      autofix_role: 'original',
-      autofix_operations: (original.operations as object | null) ?? null,
-      autofix_decision: buildAutofixDecision(original),
-    });
-    await this.persistRequest(ctx, requestId, row, false, autofix);
-    await this.persistAttempt(row, opts?.attempt);
-    this.eventBus.emit(ctx.tenantId, 'message', ctx.userId);
-  }
-
   /**
    * Resolve the per-request USD cost for subscription providers that bill
    * against a dollar quota (today: OpenCode Go). Returns `null` for every
diff --git a/packages/backend/src/routing/proxy/proxy-response-handler.ts b/packages/backend/src/routing/proxy/proxy-response-handler.ts
index 5613a7c6..a11aa128 100644
--- a/packages/backend/src/routing/proxy/proxy-response-handler.ts
+++ b/packages/backend/src/routing/proxy/proxy-response-handler.ts
@@ -3,7 +3,6 @@ import { v4 as uuid } from 'uuid';
 import { Response as ExpressResponse } from 'express';
 import { IngestionContext } from '../../otlp/interfaces/ingestion-context.interface';
 import { RoutingMeta } from './proxy.service';
-import { getAutofixRetry, type AutofixRecord } from '../autofix/autofix.types';
 import { FailedFallback } from './proxy-fallback.service';
 import { ForwardResult } from './provider-client';
 import { ProxyMessageRecorder } from './proxy-message-recorder';
@@ -59,10 +58,8 @@ import type { AttemptRecordingCapture } from './attempt-recording-capture';
 
 const logger = new Logger('ProxyResponseHandler');
 
-/** The current primary is attempt 2 only when Autofix actually sent a retry. */
-export function currentPrimaryAttemptNumber(autofix: AutofixRecord | undefined): number {
-  return getAutofixRetry(autofix) ? 2 : 1;
-}
+/** The primary provider call is always the request's first attempt. */
+export const PRIMARY_ATTEMPT_NUMBER = 1;
 
 interface ResponsesSequenceTracker {
   feed(chunk: string): void;
@@ -110,53 +107,6 @@ function recordSafely(promise: Promise<unknown>, label: string): void {
   promise.catch((e) => logger.warn(`Failed to record ${label}: ${e}`));
 }
 
-function recordAutofixOriginalIfRetried(
-  ctx: IngestionContext,
-  meta: RoutingMeta,
-  recorder: ProxyMessageRecorder,
-  autofix: AutofixRecord | undefined,
-  traceId?: string,
-  callerAttribution?: CallerAttribution | null,
-  requestHeaders?: Record<string, string> | null,
-  requestId?: string,
-  route?: {
-    model?: string;
-    provider?: string;
-    authType?: string;
-    tenantProviderId?: string | null;
-  },
-): void {
-  if (!autofix || !getAutofixRetry(autofix) || meta.autofixOriginalProviderCallStarted === false)
-    return;
-  recordSafely(
-    recorder.recordAutofixOriginal(ctx, route?.model ?? meta.model, meta.tier, autofix, {
-      requestId,
-      attemptNumber: 1,
-      attempt: meta.autofixOriginalAttempt,
-      provider: route ? route.provider : meta.provider,
-      reason: meta.reason,
-      authType: route?.authType ?? meta.auth_type,
-      traceId,
-      callerAttribution,
-      requestHeaders,
-      requestParams: meta.request_params,
-      specificityCategory: meta.specificity_category,
-      // Same rule as tenantProviderId below: on a fallback-success flow
-      // `provider_key_label` names the connection that RECOVERED the request,
-      // while this row belongs to the primary that failed. The direct-success
-      // call site is guarded by `!meta.fallbackFromModel`, so primaryKeyLabel
-      // is absent there and the meta label is already the right one.
-      providerKeyLabel: meta.primaryKeyLabel ?? meta.provider_key_label,
-      tenantProviderId:
-        route?.tenantProviderId === undefined ? meta.tenantProviderId : route.tenantProviderId,
-      headerTierId: meta.header_tier_id,
-      headerTierName: meta.header_tier_name,
-      headerTierColor: meta.header_tier_color,
-    }),
-    'autofix original',
-  );
-}
-
 function thinkingRouteContext(meta: RoutingMeta): ThinkingBlockRouteContext {
   return {
     provider: meta.provider,
@@ -240,22 +190,10 @@ export async function handleProviderError(
   traceId?: string,
   callerAttribution?: CallerAttribution | null,
   requestHeaders?: Record<string, string> | null,
-  autofix?: AutofixRecord,
   requestId: string = uuid(),
   requestDurationMs?: number,
   apiMode?: ProxyApiMode,
 ): Promise<void> {
-  recordAutofixOriginalIfRetried(
-    ctx,
-    meta,
-    recorder,
-    autofix,
-    traceId,
-    callerAttribution,
-    requestHeaders,
-    requestId,
-  );
-
   if (failedFallbacks && failedFallbacks.length > 0 && !meta.fallbackFromModel) {
     await handleFallbackExhausted(
       res,
@@ -269,7 +207,6 @@ export async function handleProviderError(
       traceId,
       callerAttribution,
       requestHeaders,
-      autofix,
       requestId,
       requestDurationMs,
       apiMode,
@@ -280,7 +217,7 @@ export async function handleProviderError(
   recordSafely(
     recorder.recordProviderError(ctx, errorStatus, errorBody, {
       requestId,
-      attemptNumber: currentPrimaryAttemptNumber(autofix),
+      attemptNumber: PRIMARY_ATTEMPT_NUMBER,
       attempt: meta.attempt,
       skipAttempt: meta.providerCallStarted === false,
       requestDurationMs,
@@ -301,7 +238,6 @@ export async function handleProviderError(
       headerTierId: meta.header_tier_id,
       headerTierName: meta.header_tier_name,
       headerTierColor: meta.header_tier_color,
-      autofix,
       apiMode,
     }),
     'provider error',
@@ -339,13 +275,12 @@ function handleFallbackExhausted(
   traceId: string | undefined,
   callerAttribution: CallerAttribution | null | undefined,
   requestHeaders: Record<string, string> | null | undefined,
-  autofix: AutofixRecord | undefined,
   requestId: string,
   requestDurationMs?: number,
   apiMode?: ProxyApiMode,
 ): void {
   const baseTime = Date.now();
-  const primaryAttemptNumber = currentPrimaryAttemptNumber(autofix);
+  const primaryAttemptNumber = PRIMARY_ATTEMPT_NUMBER;
   recordSafely(
     recorder.recordFailedFallbacks(ctx, meta.tier, meta.model, failedFallbacks, {
       requestId,
@@ -395,9 +330,6 @@ function handleFallbackExhausted(
         headerTierColor: meta.header_tier_color,
         httpStatus: errorStatus,
         terminalHttpStatus: errorStatus,
-        // When a patched retry exists this row is that retry; otherwise it is
-        // the plain original failure carrying only Phoenix's audit.
-        autofix,
         apiMode,
       },
     ),
@@ -409,7 +341,6 @@ function handleFallbackExhausted(
   setHeaders(res, metaHeaders);
   res.setHeader('X-Manifest-Fallback-Exhausted', 'true');
   const attempted = attemptedFallbackEntries(failedFallbacks, apiMode);
-  const primaryAutofix = autofixSummary(autofix);
   // Every attempt reached a provider, so the error is provider-authored: the
   // exhaustion is a routing outcome (the boolean + header), not an error class,
   // and `code` keeps whatever the primary provider sent (null when nothing).
@@ -423,7 +354,6 @@ function handleFallbackExhausted(
       fallback_exhausted: true,
       primary_model: meta.model,
       primary_provider: meta.provider,
-      ...(primaryAutofix ? { autofix: primaryAutofix } : {}),
       attempted_fallbacks: attempted,
     },
   });
@@ -440,53 +370,25 @@ function handleFallbackExhausted(
   res.json(responseBody);
 }
 
-/** Request-scoped Autofix evidence for the wire error body (never config). */
-function autofixSummary(
-  record: AutofixRecord | undefined,
-): { applied: boolean; original_status: number; retry_status: number | null } | undefined {
-  if (!record) return undefined;
-  const retry = getAutofixRetry(record);
-  return {
-    applied: retry !== undefined,
-    original_status: record.original_http_status,
-    retry_status: retry?.http_status ?? null,
-  };
-}
-
-/**
- * One wire entry per fallback hop, each with the same sanitized message/code the
- * primary gets. A patched retry and the original it replaced are two provider
- * attempts (two audit rows) but one hop to the caller: keep the retry's entry
- * and let its Autofix summary carry the pre-heal status.
- */
+/** One wire entry per fallback hop, each with the same sanitized message/code the primary gets. */
 function attemptedFallbackEntries(
   failedFallbacks: FailedFallback[],
   apiMode?: ProxyApiMode,
 ): Array<Record<string, unknown> & { provider: string; model: string; status: number }> {
-  const retriedHops = new Set(
-    failedFallbacks.filter((f) => f.autofixRole === 'retry').map((f) => f.fallbackIndex),
-  );
-  return failedFallbacks
-    .filter((f) => !(f.autofixRole === 'original' && retriedHops.has(f.fallbackIndex)))
-    .map((f) => {
-      const hop = buildOpenAiCompatibleError(f.status, f.errorBody, { apiMode });
-      const hopAutofix = autofixSummary(f.autofix);
-      return {
-        model: f.model,
-        provider: f.provider,
-        auth_type: f.authType ?? null,
-        status: f.status,
-        code: hop.code ?? null,
-        message: hop.message,
-        ...(hopAutofix ? { autofix: hopAutofix } : {}),
-      };
-    });
+  return failedFallbacks.map((f) => {
+    const hop = buildOpenAiCompatibleError(f.status, f.errorBody, { apiMode });
+    return {
+      model: f.model,
+      provider: f.provider,
+      auth_type: f.authType ?? null,
+      status: f.status,
+      code: hop.code ?? null,
+      message: hop.message,
+    };
+  });
 }
 
-/**
- * Lead with the primary provider's own sentence, then list the chain. No count:
- * a patched-then-failed hop is two provider attempts but one entry here.
- */
+/** Lead with the primary provider's own sentence, then list the chain. */
 function exhaustedMessage(
   primaryMessage: string,
   attempts: Array<{ provider: string; model: string; status: number }>,
@@ -503,35 +405,18 @@ export function recordFallbackFailures(
   recorder: ProxyMessageRecorder,
   callerAttribution?: CallerAttribution | null,
   requestHeaders?: Record<string, string> | null,
-  autofix?: AutofixRecord,
   requestId: string = uuid(),
 ): string | undefined {
   if (!meta.fallbackFromModel) return undefined;
 
   const fallbackBaseTime = Date.now();
   const failures = failedFallbacks ?? [];
-  const primaryAttemptNumber = currentPrimaryAttemptNumber(autofix);
+  const primaryAttemptNumber = PRIMARY_ATTEMPT_NUMBER;
 
   // The primary's auth_type is preserved separately on a fallback-success flow
   // (see RoutingMeta.primaryAuthType / #1173). Older meta shapes only carry
   // `auth_type`, so fall back to it when primaryAuthType is absent.
   const primaryAuthType = meta.primaryAuthType ?? meta.auth_type;
-  recordAutofixOriginalIfRetried(
-    ctx,
-    meta,
-    recorder,
-    autofix,
-    undefined,
-    callerAttribution,
-    requestHeaders,
-    requestId,
-    {
-      model: meta.fallbackFromModel,
-      provider: meta.primaryProvider,
-      authType: primaryAuthType,
-      tenantProviderId: meta.primaryTenantProviderId,
-    },
-  );
   recordSafely(
     recorder.recordPrimaryFailure(
       ctx,
@@ -568,9 +453,6 @@ export function recordFallbackFailures(
         headerTierName: meta.header_tier_name,
         headerTierColor: meta.header_tier_color,
         httpStatus: meta.primaryErrorStatus,
-        // A failed patched retry is the primary failure that triggered fallback.
-        // No-patch consultations remain an unmarked original with audit only.
-        autofix,
       },
     ),
     'primary failure',
@@ -730,9 +612,8 @@ export async function handleStreamResponse(
       relayOptions,
     );
   }
-  // A native Responses upstream reaches this point only for a Chat Completions
-  // or Messages client (an Autofix heal that re-routes the Codex wire body), and
-  // its SSE is the same Responses stream the ChatGPT transformer converts.
+  // A native Responses upstream speaks the same Responses SSE the ChatGPT
+  // transformer converts.
   if (forward.isChatGpt || forward.isResponses) {
     // Stateful: must be created once per stream and fed events in order.
     const chatGptTransformer = providerClient.createChatGptStreamTransformer(meta.model);
@@ -875,9 +756,6 @@ export async function handleNonStreamResponse(
     }
     delete (responseBody as Record<string, unknown>)._extractedThinkingBlocks;
   } else if (forward.isChatGpt || forward.isResponses) {
-    // A native Responses upstream lands here for a Chat Completions or Messages
-    // client: an Autofix heal that changes the model re-routes the Codex wire
-    // body in `responses` mode, so its forward is isResponses, not isChatGpt.
     // Responses-format upstreams differ on their non-streaming shape. The
     // ChatGPT Codex subscription backend always returns SSE even when
     // stream:false, but the Bedrock mantle /openai/v1/responses endpoint (and
@@ -976,16 +854,9 @@ export function recordSuccess(
   startTime?: number,
   callerAttribution?: CallerAttribution | null,
   requestHeaders?: Record<string, string> | null,
-  autofix?: AutofixRecord,
   requestId: string = uuid(),
-  attemptNumber: number = currentPrimaryAttemptNumber(autofix),
+  attemptNumber: number = PRIMARY_ATTEMPT_NUMBER,
   apiMode?: ProxyApiMode,
-  /**
-   * Autofix audit of the winning fallback hop. When set, the fallback-success
-   * row is stamped with the fallback's Phoenix metadata (role `retry`) instead
-   * of the primary's record.
-   */
-  fallbackAutofix?: AutofixRecord,
 ): void {
   if (meta.fallbackFromModel && fallbackSuccessTs) {
     const requestDurationMs = startTime == null ? undefined : Date.now() - startTime;
@@ -1011,11 +882,6 @@ export function recordSuccess(
         headerTierId: meta.header_tier_id,
         headerTierName: meta.header_tier_name,
         headerTierColor: meta.header_tier_color,
-        // `autofix` is the primary's record (request-level status); the winning
-        // fallback's own record is passed separately so only it can stamp the
-        // fallback-success row.
-        autofix,
-        fallbackAutofix,
         apiMode,
       }),
       'fallback success',
@@ -1042,25 +908,9 @@ export function recordSuccess(
         headerTierId: meta.header_tier_id,
         headerTierName: meta.header_tier_name,
         headerTierColor: meta.header_tier_color,
-        autofix,
         apiMode,
       }),
       'success message',
     );
   }
-
-  // Fallback-success flows recorded the original and failed retry above in
-  // recordFallbackFailures. A direct Autofix success records its original here.
-  if (!meta.fallbackFromModel) {
-    recordAutofixOriginalIfRetried(
-      ctx,
-      meta,
-      recorder,
-      autofix,
-      traceId,
-      callerAttribution,
-      requestHeaders,
-      requestId,
-    );
-  }
 }
diff --git a/packages/backend/src/routing/proxy/proxy.controller.ts b/packages/backend/src/routing/proxy/proxy.controller.ts
index 0075074e..9ec9bcdb 100644
--- a/packages/backend/src/routing/proxy/proxy.controller.ts
+++ b/packages/backend/src/routing/proxy/proxy.controller.ts
@@ -29,14 +29,12 @@ import { ModelsDevSyncService } from '../../database/models-dev-sync.service';
 import { ProviderParamSpecService } from '../routing-core/provider-param-spec.service';
 import { resolveModelCapabilityMetadata } from '../../model-discovery/model-capabilities';
 import { classifyCaller } from './caller-classifier';
-import { ObservationReporter } from '../autofix/observation-reporter';
-import type { AutofixRecord } from '../autofix/autofix.types';
 import { sanitizeRequestHeaders } from './request-headers';
 import { buildProxySessionScope } from './proxy-session-scope';
 import {
   buildMetaHeaders,
   buildOpenAiCompatibleError,
-  currentPrimaryAttemptNumber,
+  PRIMARY_ATTEMPT_NUMBER,
   handleProviderError,
   recordFallbackFailures,
   handleStreamResponse,
@@ -61,7 +59,7 @@ import type {
 import { ResponsesSseError } from './chatgpt-adapter';
 import { redactInlineImageDataUrls } from './inline-image-redaction';
 import { scrubSecrets } from '../../common/utils/secret-scrub';
-import { openAiModelId, subscriptionOpenAiModelId } from './openai-model-id';
+import { openAiModelId } from './openai-model-id';
 import { openAiModelCapabilities, type OpenAiModelCapabilities } from './openai-model-capabilities';
 import { StreamFailure } from './stream-writer';
 import { AgentRecordingConfigService } from '../../common/services/agent-recording-config.service';
@@ -135,7 +133,6 @@ export class ProxyController {
     private readonly thinkingCache: ThinkingBlockCache,
     private readonly reasoningCache: ReasoningContentCache,
     private readonly modelDiscovery: ModelDiscoveryService,
-    private readonly observationReporter: ObservationReporter,
     private readonly providerParamSpecs: ProviderParamSpecService,
     private readonly modelsDevSync: ModelsDevSyncService,
     @Optional()
@@ -350,27 +347,26 @@ export class ProxyController {
       this.rateLimiter.checkIpLimit(req.ip ?? '');
       this.rateLimiter.acquireSlot(tenantId);
       slotAcquired = true;
-      routingBody = redactInlineImageDataUrls(this.routingBody(body, req));
+      routingBody = redactInlineImageDataUrls(body);
       const specificityOverride = req.headers['x-manifest-specificity'] as string | undefined;
-      const { forward, meta, failedFallbacks, autofix, fallbackAutofix } =
-        await this.proxyService.proxyRequest({
-          agentId: req.ingestionContext.agentId,
-          tenantId,
-          // Attribution only — the recorder writes it to agent_messages.user_id.
-          userId: req.ingestionContext.userId,
-          body,
-          routingBody,
-          sessionKey,
-          sessionCacheKey: sessionScope.cacheKey,
-          providerCacheKey: sessionScope.providerCacheKey,
-          sessionMomentumKey: sessionScope.momentumKey,
-          agentName: req.ingestionContext.agentName,
-          signal: clientAbort.signal,
-          specificityOverride,
-          headers: req.headers,
-          apiMode,
-          startProviderAttempt,
-        });
+      const { forward, meta, failedFallbacks } = await this.proxyService.proxyRequest({
+        agentId: req.ingestionContext.agentId,
+        tenantId,
+        // Attribution only — the recorder writes it to agent_messages.user_id.
+        userId: req.ingestionContext.userId,
+        body,
+        routingBody,
+        sessionKey,
+        sessionCacheKey: sessionScope.cacheKey,
+        providerCacheKey: sessionScope.providerCacheKey,
+        sessionMomentumKey: sessionScope.momentumKey,
+        agentName: req.ingestionContext.agentName,
+        signal: clientAbort.signal,
+        specificityOverride,
+        headers: req.headers,
+        apiMode,
+        startProviderAttempt,
+      });
       currentMeta = meta;
 
       this.trackFirstProxyRequest(tenantId);
@@ -382,46 +378,6 @@ export class ProxyController {
       if (!providerResponse.ok) {
         const errorBody = await providerResponse.text();
         await forward.attempt?.finishRecording?.(recordingResponseFromText(errorBody));
-        // Evidence feed (AUTOFIX_REPORT_ALL_4XX). Autofix already hands Phoenix
-        // the full body for the requests it heals; every other request-side 4xx
-        // reaches Phoenix only via Peacock's hourly scrape, which carries the
-        // model-parameter snapshot and not the messages. Report it live instead —
-        // but only for agents that turned Autofix on (the reporter's own gate).
-        //
-        // `traceId` is the `traceparent` id Peacock's scrape reports for the same
-        // row, so a scraped duplicate collapses onto this one in Phoenix's ledger.
-        // Callers that send no `traceparent` get a fresh id, which the scrape
-        // cannot match — those failures are recorded twice until the scrape is
-        // retired for live traffic.
-        //
-        // Autofix reports the PRIMARY attempt itself. The fallback chain runs
-        // after it, so when the response we're about to return came from a
-        // fallback model it is a different provider/model failing and Phoenix has
-        // never seen it — skipping on `autofix` alone would hide it.
-        const alreadyReportedByAutofix = Boolean(autofix) && !meta.fallbackFromModel;
-        const wireRequestBody = forward.wireRequestBody;
-        const wireApiMode = forward.wireApiMode;
-        const wireFormat = forward.wireFormat;
-        if (!alreadyReportedByAutofix && meta.auth_type && wireRequestBody && wireFormat) {
-          this.observationReporter.report({
-            traceId: traceId ?? uuid(),
-            tenantId,
-            agentId: req.ingestionContext.agentId,
-            provider: meta.provider,
-            model: meta.model,
-            authType: meta.auth_type,
-            apiMode: wireApiMode ?? apiMode,
-            requestBody: wireRequestBody,
-            providerWire: {
-              format: wireFormat,
-              ...(forward.wireRequestUrl ? { url: forward.wireRequestUrl } : {}),
-              body: wireRequestBody,
-            },
-            status: providerResponse.status,
-            errorBody,
-            responseTimeMs: Date.now() - startTime,
-          });
-        }
         await handleProviderError(
           res,
           req.ingestionContext,
@@ -434,7 +390,6 @@ export class ProxyController {
           traceId,
           callerAttribution,
           requestHeaders,
-          autofix,
           requestId,
           Date.now() - startTime,
           apiMode,
@@ -449,7 +404,6 @@ export class ProxyController {
         this.recorder,
         callerAttribution,
         requestHeaders,
-        autofix,
         requestId,
       );
 
@@ -502,7 +456,6 @@ export class ProxyController {
           sessionKey,
           callerAttribution,
           requestHeaders,
-          autofix,
           Date.now() - startTime,
           apiMode,
         );
@@ -518,12 +471,10 @@ export class ProxyController {
           startTime,
           callerAttribution,
           requestHeaders,
-          autofix,
           requestId,
-          currentPrimaryAttemptNumber(autofix) +
+          PRIMARY_ATTEMPT_NUMBER +
             (meta.fallbackFromModel ? (failedFallbacks?.length ?? 0) + 1 : 0),
           apiMode,
-          fallbackAutofix,
         );
       }
     } catch (err: unknown) {
@@ -546,7 +497,7 @@ export class ProxyController {
       await (currentMeta?.attempt ?? currentAttempt)?.finishRecording?.();
       if (clientAbort.signal.aborted) {
         // recordCancelledRequest completes only the last attempt. Earlier ones
-        // (a failed primary, failed fallback hops, an Autofix retry) were
+        // (a failed primary, failed fallback hops) were
         // carried in the chain's local state, which the abort threw away. The
         // last one is included too: the pending guard makes it a no-op unless
         // recordCancelledRequest failed to write it.
@@ -557,24 +508,6 @@ export class ProxyController {
     }
   }
 
-  /**
-   * Phoenix replays a provider-native model while naming the original route in
-   * headers. Keep Manifest's public `-subscription` syntax inside Manifest: the
-   * original body remains provider-native and only the routing view is encoded.
-   */
-  private routingBody(
-    body: Record<string, unknown>,
-    req: Request & { ingestionContext: IngestionContext },
-  ): Record<string, unknown> {
-    const provider = req.headers['x-manifest-provider'];
-    const authType = req.headers['x-manifest-auth-type'];
-    const model = body.model;
-    if (typeof provider !== 'string' || authType !== 'subscription' || typeof model !== 'string') {
-      return body;
-    }
-    return { ...body, model: subscriptionOpenAiModelId(provider, model) };
-  }
-
   /**
    * Record the HTTP-200 friendly stub Manifest returned in place of a completion.
    * `meta.manifest_error_message` is the rendered `[🦚 Manifest M100] …` text the
@@ -589,7 +522,6 @@ export class ProxyController {
     sessionKey: string | undefined,
     callerAttribution: ReturnType<typeof classifyCaller>,
     requestHeaders: ReturnType<typeof sanitizeRequestHeaders>,
-    autofix: AutofixRecord | undefined,
     durationMs: number,
     apiMode: ProxyApiMode,
   ): void {
@@ -606,9 +538,6 @@ export class ProxyController {
         sessionKey,
         callerAttribution,
         requestHeaders,
-        // A failed heal attempt still stamps its Phoenix audit on the M row.
-        autofix,
-        attempt: meta.attempt,
         durationMs,
         apiMode,
       })
diff --git a/packages/backend/src/routing/proxy/proxy.module.ts b/packages/backend/src/routing/proxy/proxy.module.ts
index 73dcab79..4857de84 100644
--- a/packages/backend/src/routing/proxy/proxy.module.ts
+++ b/packages/backend/src/routing/proxy/proxy.module.ts
@@ -12,7 +12,6 @@ import { OAuthModule } from '../oauth/oauth.module';
 import { ResolveModule } from '../resolve/resolve.module';
 import { CustomProviderModule } from '../custom-provider/custom-provider.module';
 import { HeaderTiersModule } from '../header-tiers/header-tiers.module';
-import { AutofixModule } from '../autofix/autofix.module';
 import { ProxyController } from './proxy.controller';
 import { ProxyService } from './proxy.service';
 import { ProxyFallbackService } from './proxy-fallback.service';
@@ -41,7 +40,6 @@ import { AttemptRecordingService } from './attempt-recording.service';
     ResolveModule,
     CustomProviderModule,
     HeaderTiersModule,
-    AutofixModule,
   ],
   controllers: [ProxyController],
   providers: [
diff --git a/packages/backend/src/routing/proxy/proxy.service.ts b/packages/backend/src/routing/proxy/proxy.service.ts
index e026d1b5..de618056 100644
--- a/packages/backend/src/routing/proxy/proxy.service.ts
+++ b/packages/backend/src/routing/proxy/proxy.service.ts
@@ -68,10 +68,7 @@ import {
   OPENAI_MODEL_ID_AUTO,
   routeForOpenAiModelId,
   SUBSCRIPTION_MODEL_SUFFIX,
-  subscriptionOpenAiModelId,
 } from './openai-model-id';
-import { AutofixService } from '../autofix/autofix.service';
-import type { AutofixRecord } from '../autofix/autofix.types';
 import { recordingResponseFromText } from './attempt-recording-capture';
 
 type ResolvedRouting = Awaited<ReturnType<ResolveService['resolve']>> & {
@@ -166,58 +163,18 @@ export interface RoutingMeta {
   primaryAttempt?: ProviderAttemptRef;
   /** Whether the primary/retry actually crossed the provider transport boundary. */
   primaryProviderCallStarted?: boolean;
-  /** Internal identity of the original failure before an Autofix retry. */
-  autofixOriginalAttempt?: ProviderAttemptRef;
-  /** Whether the pre-Autofix original actually invoked provider transport. */
-  autofixOriginalProviderCallStarted?: boolean;
 }
 
 export interface ProxyResult {
   forward: ForwardResult;
   meta: RoutingMeta;
   failedFallbacks?: FailedFallback[];
-  /** Autofix audit when a repairable failure was sent to the healing service. */
-  autofix?: AutofixRecord;
-  /**
-   * Autofix audit for the winning fallback hop. Separate from {@link autofix}
-   * (which is the primary's) so a recovered fallback's Phoenix metadata is
-   * recorded without overwriting the primary's attribution.
-   */
-  fallbackAutofix?: AutofixRecord;
-}
-
-/** Everything Autofix's reforward needs to re-send a healed body to a provider. */
-interface HealedReforwardContext {
-  agentId: string;
-  tenantId: string;
-  apiMode: ProxyApiMode;
-  sessionKey: string;
-  sessionCacheKey?: string;
-  providerCacheKey?: string;
-  sessionMomentumKey?: string;
-  signal?: AbortSignal;
-  stream: boolean;
-  specificityOverride?: ProxyRequestOptions['specificityOverride'];
-  headers?: ProxyRequestOptions['headers'];
-  signatureLookup: SignatureLookup;
-  thinkingLookup: ThinkingBlockLookup;
-  startProviderAttempt?: StartProviderAttempt;
-  provider: string;
-  apiKey: string;
-  rawApiKey: string;
-  model: string;
-  keyLabel?: string;
-  authType?: AuthType;
-  resourceUrl?: string;
-  providerRegion?: string | null;
-  paramMergeContext: ParamMergeContext | undefined;
-  tenantProviderId: string | null;
 }
 
 /**
  * Stand-in for a streaming 200 whose body never produced a byte. Keeps the
- * attempt and wire fields so fallback, Autofix and recording treat it as a
- * failed provider response.
+ * attempt and wire fields so fallback and recording treat it as a failed
+ * provider response.
  */
 function warmupFailureForward(forward: ForwardResult, message: string): ForwardResult {
   return {
@@ -251,7 +208,6 @@ export class ProxyService {
     private readonly thinkingCache: ThinkingBlockCache,
     private readonly modelParamsService: AgentModelParamsService,
     private readonly providerParamSpecs: ProviderParamSpecService,
-    private readonly autofixService: AutofixService,
   ) {}
 
   async proxyRequest(opts: ProxyRequestOptions): Promise<ProxyResult> {
@@ -440,7 +396,7 @@ export class ProxyService {
       );
     }
 
-    let forward = await this.fallbackService.tryForwardToProvider({
+    const forward = await this.fallbackService.tryForwardToProvider({
       provider: route.provider,
       apiKey: credentials.apiKey,
       model: primaryModel,
@@ -468,63 +424,6 @@ export class ProxyService {
       tenantProviderId: credentials.tenantProviderId,
       startProviderAttempt,
     });
-    const autofixOriginalAttempt = forward.attempt;
-    const autofixOriginalProviderCallStarted = forward.providerCallStarted;
-
-    // Autofix runs BEFORE the fallback chain: heal a repairable 4xx and retry
-    // the patched request, so a fixable request isn't sprayed across every
-    // fallback provider. A no-op unless the agent opted in and the forward
-    // failed with a repairable status, so successful traffic is untouched.
-    const wireRequestBody = forward.wireRequestBody;
-    const wireApiMode = forward.wireApiMode;
-    const wireFormat = forward.wireFormat;
-    const retryWireBody = forward.retryWireBody;
-    const autofixApiMode = wireApiMode ?? apiMode;
-    const autofixAttempt =
-      wireRequestBody && retryWireBody && (wireApiMode || wireFormat)
-        ? await this.autofixService.maybeHeal({
-            forward,
-            agentId,
-            tenantId,
-            provider: route.provider,
-            model: primaryModel,
-            authType: route.authType,
-            apiMode: autofixApiMode,
-            requestBody: wireRequestBody,
-            reforward: (healedBody) =>
-              this.reforwardHealed(healedBody, forward, {
-                agentId,
-                tenantId,
-                apiMode: autofixApiMode,
-                sessionKey,
-                sessionCacheKey,
-                providerCacheKey,
-                sessionMomentumKey,
-                signal,
-                stream,
-                specificityOverride,
-                headers,
-                provider: route.provider,
-                apiKey: credentials.apiKey,
-                rawApiKey: credentials.rawApiKey,
-                model: primaryModel,
-                // The selected row's label, so the healed-retry row stamps the
-                // same connection its tenant_provider_id points at.
-                keyLabel: credentials.keyLabel,
-                authType: route.authType,
-                resourceUrl: credentials.resourceUrl,
-                providerRegion: credentials.providerRegion,
-                paramMergeContext,
-                signatureLookup,
-                thinkingLookup,
-                tenantProviderId: credentials.tenantProviderId,
-                startProviderAttempt,
-              }),
-          })
-        : null;
-    const autofixRecord = autofixAttempt?.record;
-    if (autofixAttempt) forward = autofixAttempt.forward;
-
     if (
       !explicitModelOverride &&
       !forward.response.ok &&
@@ -555,17 +454,7 @@ export class ProxyService {
         credentialDashboardUrl: dashboardUrl,
         clientAnthropicBeta: headers?.['anthropic-beta'],
       });
-      if (fallbackResult) {
-        return {
-          ...fallbackResult,
-          meta: {
-            ...fallbackResult.meta,
-            autofixOriginalAttempt,
-            autofixOriginalProviderCallStarted,
-          },
-          autofix: autofixRecord,
-        };
-      }
+      if (fallbackResult) return fallbackResult;
     }
 
     // Stream warm-up: for streaming 200 responses, verify the provider
@@ -588,11 +477,7 @@ export class ProxyService {
           isCodeAssist: forward.isCodeAssist,
           responsesTextFormat: forward.responsesTextFormat,
           responsesToolNames: forward.responsesToolNames,
-          wireRequestBody: forward.wireRequestBody,
-          wireRequestUrl: forward.wireRequestUrl,
           wireFormat: forward.wireFormat,
-          wireApiMode: forward.wireApiMode,
-          retryWireBody: forward.retryWireBody,
           providerCallStarted: forward.providerCallStarted,
         };
         this.recordTierIfScoring(sessionMomentumKey, resolved.tier);
@@ -607,10 +492,7 @@ export class ProxyService {
             provider_key_label: credentials.keyLabel,
             attempt: forward.attempt,
             providerCallStarted: forward.providerCallStarted,
-            autofixOriginalAttempt,
-            autofixOriginalProviderCallStarted,
           }),
-          autofix: autofixRecord,
         };
       }
 
@@ -644,17 +526,7 @@ export class ProxyService {
           credentialDashboardUrl: dashboardUrl,
           clientAnthropicBeta: headers?.['anthropic-beta'],
         });
-        if (fallbackResult) {
-          return {
-            ...fallbackResult,
-            meta: {
-              ...fallbackResult.meta,
-              autofixOriginalAttempt,
-              autofixOriginalProviderCallStarted,
-            },
-            autofix: autofixRecord,
-          };
-        }
+        if (fallbackResult) return fallbackResult;
       }
 
       // Warmup failed and no fallbacks available: return the synthetic 502
@@ -669,10 +541,7 @@ export class ProxyService {
           provider_key_label: credentials.keyLabel,
           attempt: forward.attempt,
           providerCallStarted: forward.providerCallStarted,
-          autofixOriginalAttempt,
-          autofixOriginalProviderCallStarted,
         }),
-        autofix: autofixRecord,
       };
     }
 
@@ -686,10 +555,7 @@ export class ProxyService {
         provider_key_label: credentials.keyLabel,
         attempt: forward.attempt,
         providerCallStarted: forward.providerCallStarted,
-        autofixOriginalAttempt,
-        autofixOriginalProviderCallStarted,
       }),
-      autofix: autofixRecord,
     };
   }
 
@@ -714,200 +580,6 @@ export class ProxyService {
     return undefined;
   }
 
-  /**
-   * Re-send an Autofix-healed wire body. Same model → use the exact resolved
-   * transport without re-merging or translating. Model changed (e.g. an
-   * unknown-model fix) → re-resolve so it reaches the right provider/key (M5).
-   */
-  private async reforwardHealed(
-    healedBody: Record<string, unknown>,
-    originalForward: ForwardResult,
-    ctx: HealedReforwardContext,
-  ): Promise<ForwardResult> {
-    const retry = await this.sendHealedRetry(healedBody, originalForward, ctx);
-    // Autofix judges the patch by this response. A streaming 200 that never
-    // produces a byte is not a working patch: warm it up here, so the Autofix
-    // verdict and the outcome reported to Phoenix see the stall, and the
-    // fallback chain runs from a failed retry instead of a "healed" one.
-    if (!ctx.stream || !retry.response.ok || !retry.response.body) return retry;
-    const warmup = await peekStream(retry.response.body, STREAM_WARMUP_MS);
-    if (!warmup.ok) {
-      this.logger.warn(
-        `Autofix retry stream warmup failed: provider=${ctx.provider} model=${ctx.model} ` +
-          `reason=${warmup.reason} message=${warmup.message}`,
-      );
-      return warmupFailureForward(retry, warmup.message);
-    }
-    return {
-      ...retry,
-      response: new Response(warmup.stream, {
-        status: retry.response.status,
-        statusText: retry.response.statusText,
-        headers: retry.response.headers,
-      }),
-    };
-  }
-
-  private sendHealedRetry(
-    healedBody: Record<string, unknown>,
-    originalForward: ForwardResult,
-    ctx: HealedReforwardContext,
-  ): Promise<ForwardResult> {
-    const originalModel = originalForward.wireRequestBody?.model;
-    const healedModel = typeof healedBody.model === 'string' ? healedBody.model : undefined;
-    if (healedModel && healedModel !== originalModel) {
-      // Phoenix speaks in provider-native model ids. Manifest owns the public
-      // `-subscription` route syntax, so add it only while resolving the healed
-      // retry. The helper is idempotent for older Phoenix patches that already
-      // carry the legacy route id.
-      const routingBody =
-        ctx.authType === 'subscription'
-          ? {
-              ...healedBody,
-              model: subscriptionOpenAiModelId(ctx.provider, healedModel),
-            }
-          : healedBody;
-      return this.forwardResolvedHealed(routingBody, healedBody, originalForward, ctx);
-    }
-    return this.fallbackService.retryWireBody(originalForward, healedBody, {
-      provider: ctx.provider,
-      model: ctx.model,
-      signal: ctx.signal,
-      stream: ctx.stream,
-      authType: ctx.authType,
-      agentId: ctx.agentId,
-      tenantProviderId: ctx.tenantProviderId,
-      providerKeyLabel: ctx.keyLabel,
-      startProviderAttempt: ctx.startProviderAttempt,
-    });
-  }
-
-  private async forwardResolvedHealed(
-    routingBody: Record<string, unknown>,
-    healedBody: Record<string, unknown>,
-    originalForward: ForwardResult,
-    ctx: HealedReforwardContext,
-  ): Promise<ForwardResult> {
-    const resolveChatBody = this.createChatBodyResolver(ctx.apiMode, healedBody);
-    const resolveRoutingChatBody =
-      routingBody === healedBody
-        ? resolveChatBody
-        : this.createChatBodyResolver(ctx.apiMode, routingBody);
-    const resolved = await this.resolveRouting(
-      ctx.agentId,
-      ctx.tenantId,
-      routingBody,
-      resolveRoutingChatBody,
-      ctx.sessionMomentumKey,
-      ctx.specificityOverride,
-      ctx.headers,
-      ctx.apiMode,
-    );
-    const route = resolved.route;
-    if (!route) {
-      return this.retryHealedOnOriginalTransport(
-        healedBody,
-        originalForward,
-        ctx,
-        'no route resolved for the healed model',
-      );
-    }
-    const credentials = await this.resolveCredentials(ctx.agentId, ctx.tenantId, {
-      provider: route.provider,
-      auth_type: route.authType,
-      provider_key_label: route.keyLabel ?? undefined,
-    });
-    if (!credentials.ok) {
-      return this.retryHealedOnOriginalTransport(
-        healedBody,
-        originalForward,
-        ctx,
-        'no provider key for the healed model',
-      );
-    }
-    const model = normalizeProviderModel(route.provider, route.model);
-    const explicitModelOverride = resolved.explicit_model_override === true;
-    const scopeKey = modelParamsScopeForRouting({
-      tier: resolved.tier,
-      specificityCategory: resolved.specificity_category,
-      headerTierId: resolved.header_tier_id,
-    });
-    return this.fallbackService.tryForwardToProvider({
-      provider: route.provider,
-      apiKey: credentials.apiKey,
-      model,
-      body: healedBody,
-      resolveChatBody,
-      stream: ctx.stream,
-      sessionKey: ctx.sessionKey,
-      reasoningCacheKey: ctx.sessionCacheKey,
-      providerCacheKey: ctx.providerCacheKey,
-      signal: ctx.signal,
-      agentId: ctx.agentId,
-      tenantId: ctx.tenantId,
-      rawApiKey: credentials.rawApiKey,
-      // Selected row's label so the recorded connection matches
-      // credentials.tenantProviderId.
-      providerKeyLabel: credentials.keyLabel,
-      authType: route.authType,
-      apiMode: ctx.apiMode,
-      resourceUrl: credentials.resourceUrl,
-      providerRegion: credentials.providerRegion,
-      signatureLookup: ctx.signatureLookup,
-      thinkingLookup: ctx.thinkingLookup,
-      clientAnthropicBeta: ctx.headers?.['anthropic-beta'],
-      paramMergeContext: explicitModelOverride ? undefined : { agentId: ctx.agentId, scopeKey },
-      tenantProviderId: credentials.tenantProviderId,
-      startProviderAttempt: ctx.startProviderAttempt,
-    });
-  }
-
-  /**
-   * The healed model didn't re-resolve for this tenant — usually a stale
-   * `cached_models` snapshot, not a genuinely missing provider: the original
-   * request already reached a provider over a working connection. Retry the
-   * healed body on that same transport and let the provider judge the model,
-   * instead of synthesizing a 502 the caller can't act on. Only a
-   * Manifest-blocked original (no wire transport to reuse) keeps the
-   * synthetic 502.
-   */
-  private retryHealedOnOriginalTransport(
-    healedBody: Record<string, unknown>,
-    originalForward: ForwardResult,
-    ctx: HealedReforwardContext,
-    reason: string,
-  ): Promise<ForwardResult> {
-    if (!originalForward.retryWireBody) {
-      return Promise.resolve(this.autofixReforwardError(reason));
-    }
-    const healedModel = typeof healedBody.model === 'string' ? healedBody.model : ctx.model;
-    return this.fallbackService.retryWireBody(originalForward, healedBody, {
-      provider: ctx.provider,
-      model: healedModel,
-      signal: ctx.signal,
-      stream: ctx.stream,
-      authType: ctx.authType,
-      tenantProviderId: ctx.tenantProviderId,
-      providerKeyLabel: ctx.keyLabel,
-      startProviderAttempt: ctx.startProviderAttempt,
-    });
-  }
-
-  /** Synthetic failed forward so a heal that can't be re-routed surfaces the original error. */
-  private autofixReforwardError(reason: string): ForwardResult {
-    return {
-      response: new Response(JSON.stringify({ error: { message: `Autofix: ${reason}` } }), {
-        status: 502,
-        headers: { 'content-type': 'application/json' },
-      }),
-      isGoogle: false,
-      isAnthropic: false,
-      isChatGpt: false,
-      isResponses: false,
-      isCodeAssist: false,
-    };
-  }
-
   private validatePayload(body: ProxyRequestOptions['body'], apiMode: ProxyApiMode): void {
     if (apiMode === 'responses') {
       const hasInstructions =
@@ -992,8 +664,8 @@ export class ProxyService {
           tenantId,
           async () => {
             const scoringBody = resolveChatBody ? await resolveChatBody() : body;
-            // Not guaranteed to be an array here: a healed body reaches this
-            // path without validatePayload after Phoenix rewrites it.
+            // Not guaranteed to be an array: the scorer must tolerate a body
+            // whose `messages` field is missing or malformed.
             const messages = (
               Array.isArray(scoringBody.messages) ? scoringBody.messages : []
             ) as ScorerMessage[];
@@ -1328,7 +1000,6 @@ export class ProxyService {
           request_params: fallbackRequestParams,
         }),
         failedFallbacks: failures,
-        fallbackAutofix: success.autofix,
       };
     }
 
diff --git a/packages/backend/src/routing/routing.module.ts b/packages/backend/src/routing/routing.module.ts
index ce34a90e..d0d7de21 100644
--- a/packages/backend/src/routing/routing.module.ts
+++ b/packages/backend/src/routing/routing.module.ts
@@ -10,7 +10,6 @@ import { OAuthModule } from './oauth/oauth.module';
 import { CustomProviderModule } from './custom-provider/custom-provider.module';
 import { ResolveModule } from './resolve/resolve.module';
 import { HeaderTiersModule } from './header-tiers/header-tiers.module';
-import { AutofixModule } from './autofix/autofix.module';
 import { ProviderController } from './provider.controller';
 import { TierController } from './tier.controller';
 import { ModelController } from './model.controller';
@@ -29,7 +28,6 @@ import { Tenant } from '../entities/tenant.entity';
 import { TierAssignment } from '../entities/tier-assignment.entity';
 import { SpecificityAssignment } from '../entities/specificity-assignment.entity';
 import { HeaderTier } from '../entities/header-tier.entity';
-import { InstallMetadata } from '../entities/install-metadata.entity';
 
 @Module({
   imports: [
@@ -42,7 +40,6 @@ import { InstallMetadata } from '../entities/install-metadata.entity';
       TierAssignment,
       SpecificityAssignment,
       HeaderTier,
-      InstallMetadata,
     ]),
     RoutingCoreModule,
     ModelPricesModule,
@@ -54,7 +51,6 @@ import { InstallMetadata } from '../entities/install-metadata.entity';
     CustomProviderModule,
     ResolveModule,
     HeaderTiersModule,
-    AutofixModule,
     RouteModelParamsModule,
   ],
   controllers: [
diff --git a/packages/backend/src/routing/tier.controller.spec.ts b/packages/backend/src/routing/tier.controller.spec.ts
index 6bb9d059..e3b1cd01 100644
--- a/packages/backend/src/routing/tier.controller.spec.ts
+++ b/packages/backend/src/routing/tier.controller.spec.ts
@@ -4,27 +4,16 @@ import { TierController } from './tier.controller';
 import { TierService } from './routing-core/tier.service';
 import { ResolveAgentService } from './routing-core/resolve-agent.service';
 import { Agent } from '../entities/agent.entity';
-import { InstallMetadata } from '../entities/install-metadata.entity';
-import { AutofixService } from './autofix/autofix.service';
 import type { TenantContext } from '../common/decorators/tenant-context.decorator';
 import { AgentRecordingConfigService } from '../common/services/agent-recording-config.service';
-import type { Cache } from 'cache-manager';
-
-const ORIGINAL_MANIFEST_MODE = process.env.MANIFEST_MODE;
 
 describe('TierController', () => {
-  afterAll(() => {
-    if (ORIGINAL_MANIFEST_MODE === undefined) delete process.env.MANIFEST_MODE;
-    else process.env.MANIFEST_MODE = ORIGINAL_MANIFEST_MODE;
-  });
-
   const ctx: TenantContext = { tenantId: 'tenant-1', userId: 'user-1' };
   const agent = {
     id: 'agent-1',
     name: 'demo',
     tenant_id: 'tenant-1',
     complexity_routing_enabled: true,
-    autofix_enabled: false,
     record_messages: false,
   };
   let tierService: jest.Mocked<Partial<TierService>>;
@@ -34,21 +23,9 @@ describe('TierController', () => {
     invalidateTenant: jest.Mock;
   };
   let agentRepo: jest.Mocked<Partial<Repository<Agent>>>;
-  let autofixService: {
-    resolveEnabled: jest.Mock;
-  };
   let controller: TierController;
-  let cacheDel: jest.Mock;
   let recordingConfig: { isRecording: jest.Mock };
-  let installMetadataRepo: {
-    findOne: jest.Mock;
-    createQueryBuilder: jest.Mock;
-  };
-
   beforeEach(() => {
-    // Pin cloud mode: a dev shell exporting MANIFEST_MODE=selfhosted must not
-    // flip the consent gate under the cloud-behavior tests below.
-    process.env.MANIFEST_MODE = 'cloud';
     tierService = {
       getTiers: jest.fn().mockResolvedValue([]),
       setOverride: jest.fn(),
@@ -66,31 +43,12 @@ describe('TierController', () => {
     agentRepo = {
       update: jest.fn().mockResolvedValue(undefined),
     };
-    autofixService = {
-      // Mirror the real resolver: explicit flag wins, NULL inherits a default.
-      resolveEnabled: jest.fn((stored: boolean | null) => stored ?? false),
-    };
     recordingConfig = { isRecording: jest.fn().mockResolvedValue(false) };
-    installMetadataRepo = {
-      findOne: jest.fn().mockResolvedValue(null),
-      createQueryBuilder: jest.fn().mockReturnValue({
-        insert: jest.fn().mockReturnThis(),
-        into: jest.fn().mockReturnThis(),
-        values: jest.fn().mockReturnThis(),
-        orUpdate: jest.fn().mockReturnThis(),
-        execute: jest.fn().mockResolvedValue(undefined),
-      }),
-    };
-    const cacheManager = { del: jest.fn().mockResolvedValue(undefined) };
-    cacheDel = cacheManager.del;
     controller = new TierController(
       tierService as unknown as TierService,
       resolveAgentService as unknown as ResolveAgentService,
       agentRepo as unknown as Repository<Agent>,
-      installMetadataRepo as unknown as Repository<InstallMetadata>,
-      autofixService as unknown as AutofixService,
       recordingConfig as unknown as AgentRecordingConfigService,
-      cacheManager as unknown as Cache,
     );
   });
 
@@ -180,116 +138,6 @@ describe('TierController', () => {
     expect(resolveAgentService.invalidate).toHaveBeenCalledWith('tenant-1', 'demo');
   });
 
-  it('GET autofix returns the enabled flag', async () => {
-    // Cloud mode: no consent gate, so `consented` is always true.
-    expect(await controller.getAutofix(ctx, 'demo')).toEqual({ enabled: false, consented: true });
-  });
-
-  it('GET autofix resolves the mode default via the service when the flag is unset (null)', async () => {
-    // A NULL stored flag is handed to the service, which resolves the
-    // deployment-mode default (here stubbed to ON).
-    resolveAgentService.resolve.mockResolvedValueOnce({ ...agent, autofix_enabled: null });
-    autofixService.resolveEnabled.mockReturnValueOnce(true);
-    expect(await controller.getAutofix(ctx, 'demo')).toEqual({ enabled: true, consented: true });
-    expect(autofixService.resolveEnabled).toHaveBeenCalledWith(null);
-  });
-
-  it('PATCH autofix updates the enabled flag and invalidates the agent lookup', async () => {
-    const out = await controller.updateAutofix(ctx, 'demo', { enabled: true });
-    expect(out).toEqual({ enabled: true, consented: true });
-    expect(agentRepo.update).toHaveBeenCalledWith('agent-1', { autofix_enabled: true });
-    expect(resolveAgentService.invalidate).toHaveBeenCalledWith('tenant-1', 'demo');
-    // Cloud: no consent to record, and no backfill requested.
-    expect(installMetadataRepo.createQueryBuilder).not.toHaveBeenCalled();
-    expect(resolveAgentService.invalidateTenant).not.toHaveBeenCalled();
-    // The workspace status the sidebar reads is cached per tenant; both
-    // `any_enabled` and `consented` just changed, so it has to be dropped or
-    // the CTA keeps prompting for the dashboard TTL.
-    expect(cacheDel).toHaveBeenCalledWith('tenant-1:/api/v1/autofix/status');
-  });
-
-  it('PATCH autofix leaves the workspace status cache alone on a no-op', async () => {
-    await controller.updateAutofix(ctx, 'demo', {});
-    expect(cacheDel).not.toHaveBeenCalled();
-  });
-
-  it('PATCH autofix with an empty body is a no-op and echoes the current value', async () => {
-    const out = await controller.updateAutofix(ctx, 'demo', {});
-    expect(out).toEqual({ enabled: false, consented: true });
-    expect(agentRepo.update).not.toHaveBeenCalled();
-    expect(resolveAgentService.invalidate).not.toHaveBeenCalled();
-  });
-
-  it('PATCH autofix treats a null enabled as a no-op (never resets the flag to null)', async () => {
-    // @IsOptional() lets `{"enabled": null}` past validation; the controller must
-    // not write null (which would wipe the stored flag) nor echo `enabled: null`.
-    const out = await controller.updateAutofix(ctx, 'demo', {
-      enabled: null as unknown as boolean,
-    });
-    expect(out).toEqual({ enabled: false, consented: true });
-    expect(agentRepo.update).not.toHaveBeenCalled();
-    expect(resolveAgentService.invalidate).not.toHaveBeenCalled();
-  });
-
-  describe('self-hosted consent + backfill', () => {
-    let savedMode: string | undefined;
-    beforeEach(() => {
-      savedMode = process.env.MANIFEST_MODE;
-      process.env.MANIFEST_MODE = 'selfhosted';
-      installMetadataRepo.findOne.mockReset();
-    });
-    afterEach(() => {
-      if (savedMode === undefined) delete process.env.MANIFEST_MODE;
-      else process.env.MANIFEST_MODE = savedMode;
-    });
-
-    it('reports consented=false until the install consents', async () => {
-      installMetadataRepo.findOne.mockResolvedValue(null);
-      expect(await controller.getAutofix(ctx, 'demo')).toEqual({
-        enabled: false,
-        consented: false,
-      });
-    });
-
-    it('reports consented=true once the install consented', async () => {
-      installMetadataRepo.findOne.mockResolvedValue({
-        id: 'singleton',
-        autofix_consented_at: new Date().toISOString(),
-      });
-      expect(await controller.getAutofix(ctx, 'demo')).toEqual({
-        enabled: false,
-        consented: true,
-      });
-    });
-
-    it('records the once-consent when enabling', async () => {
-      installMetadataRepo.findOne.mockResolvedValue(null);
-      await controller.updateAutofix(ctx, 'demo', { enabled: true });
-      expect(installMetadataRepo.createQueryBuilder).toHaveBeenCalled();
-    });
-
-    it('does not record consent again once it exists', async () => {
-      installMetadataRepo.findOne.mockResolvedValue({
-        id: 'singleton',
-        autofix_consented_at: new Date().toISOString(),
-      });
-      await controller.updateAutofix(ctx, 'demo', { enabled: true });
-      expect(installMetadataRepo.createQueryBuilder).not.toHaveBeenCalled();
-    });
-
-    it('does not record consent on a disable, but still busts the status cache', async () => {
-      // Consent means "I agree to turn Autofix on" — switching an agent off
-      // must never mint it. The write still changes `any_enabled`, so the
-      // cached workspace status has to be dropped like on an enable.
-      installMetadataRepo.findOne.mockResolvedValue(null);
-      const out = await controller.updateAutofix(ctx, 'demo', { enabled: false });
-      expect(out).toEqual({ enabled: false, consented: false });
-      expect(agentRepo.update).toHaveBeenCalledWith('agent-1', { autofix_enabled: false });
-      expect(installMetadataRepo.createQueryBuilder).not.toHaveBeenCalled();
-      expect(cacheDel).toHaveBeenCalledWith('tenant-1:/api/v1/autofix/status');
-    });
-  });
-
   it('GET recording returns the per-agent opt-in flag', async () => {
     expect(await controller.getRecording(ctx, 'demo')).toEqual({ enabled: false });
     expect(recordingConfig.isRecording).toHaveBeenCalledWith('agent-1');
diff --git a/packages/backend/src/routing/tier.controller.ts b/packages/backend/src/routing/tier.controller.ts
index 36a2c8ab..cf3ae454 100644
--- a/packages/backend/src/routing/tier.controller.ts
+++ b/packages/backend/src/routing/tier.controller.ts
@@ -4,14 +4,11 @@ import {
   Controller,
   Delete,
   Get,
-  Inject,
   Param,
   Patch,
   Post,
   Put,
 } from '@nestjs/common';
-import { CACHE_MANAGER } from '@nestjs/cache-manager';
-import type { Cache } from 'cache-manager';
 import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 import { TIER_SLOTS } from 'manifest-shared';
@@ -24,14 +21,9 @@ import {
   SetFallbacksDto,
   SetResponseModeDto,
   responseModeFromDto,
-  UpdateAutofixDto,
   UpdateRecordingDto,
 } from './dto/routing.dto';
-import { v4 as uuid } from 'uuid';
 import { Agent } from '../entities/agent.entity';
-import { InstallMetadata } from '../entities/install-metadata.entity';
-import { isSelfHosted } from '../common/utils/detect-self-hosted';
-import { AutofixService } from './autofix/autofix.service';
 import { AgentRecordingConfigService } from '../common/services/agent-recording-config.service';
 
 @Controller('api/v1/routing')
@@ -41,11 +33,7 @@ export class TierController {
     private readonly resolveAgentService: ResolveAgentService,
     @InjectRepository(Agent)
     private readonly agentRepo: Repository<Agent>,
-    @InjectRepository(InstallMetadata)
-    private readonly installMetadataRepo: Repository<InstallMetadata>,
-    private readonly autofixService: AutofixService,
     private readonly recordingConfig: AgentRecordingConfigService,
-    @Inject(CACHE_MANAGER) private readonly cacheManager: Cache,
   ) {}
 
   @Get(':agentName/tiers')
@@ -168,75 +156,6 @@ export class TierController {
     return { enabled: newValue };
   }
 
-  @Get(':agentName/autofix')
-  async getAutofix(@TenantCtx() ctx: TenantContext, @Param('agentName') agentName: string) {
-    const agent = await this.resolveAgentService.resolve(ctx.tenantId, agentName);
-    return {
-      enabled: this.autofixService.resolveEnabled(agent.autofix_enabled),
-      consented: await this.hasAutofixConsent(),
-    };
-  }
-
-  @Patch(':agentName/autofix')
-  async updateAutofix(
-    @TenantCtx() ctx: TenantContext,
-    @Param('agentName') agentName: string,
-    @Body() body: UpdateAutofixDto,
-  ) {
-    const agent = await this.resolveAgentService.resolve(ctx.tenantId, agentName);
-    // Require an explicit boolean: `@IsOptional()` lets `{"enabled": null}` through,
-    // and a bare presence check would then reset the stored flag to null and echo
-    // back `enabled: null` (off-contract). Undefined/null → no write, read-back.
-    const applied = typeof body.enabled === 'boolean';
-    if (applied) {
-      await this.agentRepo.update(agent.id, { autofix_enabled: body.enabled });
-      this.resolveAgentService.invalidate(agent.tenant_id, agentName);
-
-      if (body.enabled) {
-        // Per-agent enable also records consent-once so the sidebar CTA doesn't
-        // keep prompting after a single agent was turned on deliberately.
-        if (!(await this.hasAutofixConsent())) await this.recordAutofixConsent();
-      }
-      // Both `any_enabled` and `consented` just changed. `UserCacheInterceptor`
-      // keys the workspace status as `${tenantId}:/api/v1/autofix/status`, so
-      // without this the sidebar keeps prompting for consent already given —
-      // or keeps offering the fleet CTA — until the dashboard TTL expires.
-      if (agent.tenant_id) {
-        await this.cacheManager.del(`${agent.tenant_id}:/api/v1/autofix/status`);
-      }
-    }
-    return {
-      enabled: applied
-        ? (body.enabled as boolean)
-        : this.autofixService.resolveEnabled(agent.autofix_enabled),
-      consented: await this.hasAutofixConsent(),
-    };
-  }
-
-  /** Consent-once: the modal never shows again once the install consented. */
-  private async hasAutofixConsent(): Promise<boolean> {
-    if (!isSelfHosted()) return true;
-    const row = await this.installMetadataRepo.findOne({ where: { id: 'singleton' } });
-    return row?.autofix_consented_at != null;
-  }
-
-  private async recordAutofixConsent(): Promise<void> {
-    // The singleton row may not exist yet (telemetry disabled, Autofix enabled
-    // directly). install_id is NOT NULL, so mint one alongside the consent; the
-    // healing client's lazy getOrCreate() then reuses it.
-    await this.installMetadataRepo
-      .createQueryBuilder()
-      .insert()
-      .into(InstallMetadata)
-      .values({
-        id: 'singleton',
-        install_id: uuid(),
-        autofix_consented_at: new Date().toISOString(),
-      })
-      .orUpdate(['autofix_consented_at'], ['id'])
-      .execute();
-  }
-
   @Get(':agentName/recording')
   async getRecording(@TenantCtx() ctx: TenantContext, @Param('agentName') agentName: string) {
     const agent = await this.resolveAgentService.resolve(ctx.tenantId, agentName);
diff --git a/packages/backend/src/telemetry/dto/telemetry-payload.ts b/packages/backend/src/telemetry/dto/telemetry-payload.ts
index a65536d5..dca5fc10 100644
--- a/packages/backend/src/telemetry/dto/telemetry-payload.ts
+++ b/packages/backend/src/telemetry/dto/telemetry-payload.ts
@@ -50,8 +50,7 @@ export interface TelemetryPayloadV1 {
 
   /**
    * Requests that ended `failed` over the same window. Together with
-   * `errors_by_class` this gives the receiver error visibility for installs
-   * whose failures never reach the Phoenix heal path.
+   * `errors_by_class` this gives the receiver error visibility.
    */
   errors_total?: number;
 
diff --git a/packages/backend/src/telemetry/install-id.service.spec.ts b/packages/backend/src/telemetry/install-id.service.spec.ts
index 9b654be6..b6137617 100644
--- a/packages/backend/src/telemetry/install-id.service.spec.ts
+++ b/packages/backend/src/telemetry/install-id.service.spec.ts
@@ -16,7 +16,6 @@ describe('InstallIdService', () => {
     created_at: '2026-04-20T00:00:00',
     first_send_at: null,
     last_sent_at: null,
-    autofix_consented_at: null,
   };
 
   beforeEach(async () => {
diff --git a/packages/backend/src/telemetry/telemetry.module.ts b/packages/backend/src/telemetry/telemetry.module.ts
index f78efc30..d1483290 100644
--- a/packages/backend/src/telemetry/telemetry.module.ts
+++ b/packages/backend/src/telemetry/telemetry.module.ts
@@ -14,9 +14,6 @@ import { TelemetryService } from './telemetry.service';
     TypeOrmModule.forFeature([InstallMetadata, AgentMessage, Agent, ManifestRequest, ApiKey]),
   ],
   providers: [InstallIdService, PayloadBuilderService, TelemetryService],
-  // Autofix announces the same anonymous install id to Phoenix, so the id
-  // service is shared rather than duplicated. Telemetry sending stays gated on
-  // its own opt-out: exporting the id does not send anything.
   exports: [InstallIdService],
 })
 export class TelemetryModule {}
diff --git a/packages/backend/test/attempt-analytics.e2e-spec.ts b/packages/backend/test/attempt-analytics.e2e-spec.ts
index 447a26f9..292f1894 100644
--- a/packages/backend/test/attempt-analytics.e2e-spec.ts
+++ b/packages/backend/test/attempt-analytics.e2e-spec.ts
@@ -25,22 +25,16 @@ beforeAll(async () => {
   );
   await ds.query(
     `INSERT INTO agent_messages
-       (id, tenant_id, agent_id, agent_name, timestamp, status, model,
-        fallback_from_model, autofix_applied, autofix_group_id, autofix_role)
+       (id, tenant_id, agent_id, agent_name, timestamp, status, model, fallback_from_model)
      VALUES
-       ('attempt-direct', $1, $2, 'test-agent', $3, 'ok', 'model-a', NULL, false, NULL, NULL),
-       ('attempt-fallback-primary', $1, $2, 'test-agent', $3, 'fallback_error', 'model-a',
-        NULL, false, NULL, NULL),
-       ('attempt-fallback-destination', $1, $2, 'test-agent', $3, 'ok', 'model-b',
-        'model-a', false, NULL, NULL),
-       ('attempt-autofix-retry', $1, $2, 'test-agent', $3, 'ok', 'model-a', NULL,
-        true, 'heal-1', 'retry'),
-       ('attempt-previous-primary', $1, $2, 'test-agent', $4, 'fallback_error', 'model-a',
-        NULL, false, NULL, NULL),
-       ('attempt-previous-fallback', $1, $2, 'test-agent', $4, 'ok', 'model-b',
-        'model-a', false, NULL, NULL),
+       ('attempt-direct', $1, $2, 'test-agent', $3, 'ok', 'model-a', NULL),
+       ('attempt-fallback-primary', $1, $2, 'test-agent', $3, 'fallback_error', 'model-a', NULL),
+       ('attempt-fallback-destination', $1, $2, 'test-agent', $3, 'ok', 'model-b', 'model-a'),
+       ('attempt-direct-second', $1, $2, 'test-agent', $3, 'ok', 'model-a', NULL),
+       ('attempt-previous-primary', $1, $2, 'test-agent', $4, 'fallback_error', 'model-a', NULL),
+       ('attempt-previous-fallback', $1, $2, 'test-agent', $4, 'ok', 'model-b', 'model-a'),
        ('attempt-playground-fallback', $1, 'playground-attempt-analytics', 'Playground', $3,
-        'ok', 'model-b', 'model-a', false, NULL, NULL)`,
+        'ok', 'model-b', 'model-a')`,
     [TEST_TENANT_ID, TEST_AGENT_ID, current, previous],
   );
 });
diff --git a/packages/backend/test/autofix-null-flag.e2e-spec.ts b/packages/backend/test/autofix-null-flag.e2e-spec.ts
deleted file mode 100644
index 47a5b297..00000000
--- a/packages/backend/test/autofix-null-flag.e2e-spec.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-import { INestApplication } from '@nestjs/common';
-import { DataSource } from 'typeorm';
-import { createTestApp, TEST_TENANT_ID } from './helpers';
-import { Agent } from '../src/entities/agent.entity';
-
-/**
- * Regression for the prod bug where Autofix silently never ran for any agent
- * that had never toggled it — i.e. `autofix_enabled = NULL`, the default state
- * that is supposed to inherit the deployment-mode default (ON in cloud).
- *
- * `AutofixService.loadAgentConfig` looked the agent up with
- * `findOne({ where: { id, tenant_id }, select: ['autofix_enabled'] })`. TypeORM's
- * entity transformer treats a row whose only selected column is NULL as "no
- * entity" and returns null, so every NULL-flag agent looked not-found and
- * resolved to `enabled: false`. The mocked unit tests missed it because the mock
- * returns a truthy object; only a real datasource reproduces it. The fix adds
- * the always-present primary key to the select.
- */
-let app: INestApplication;
-let ds: DataSource;
-
-beforeAll(async () => {
-  app = await createTestApp();
-  ds = app.get(DataSource);
-});
-
-afterAll(async () => {
-  await app.close();
-});
-
-describe('Autofix NULL-flag agent lookup (real TypeORM)', () => {
-  it('materialises a NULL autofix_enabled agent only when the PK is selected', async () => {
-    const agentRepo = ds.getRepository(Agent);
-    await agentRepo.save({
-      id: 'nullflag-agent',
-      name: 'nullflag-agent',
-      tenant_id: TEST_TENANT_ID,
-      autofix_enabled: null,
-    });
-
-    // The fix: selecting the PK alongside the NULL flag keeps the row.
-    const withId = await agentRepo.findOne({
-      where: { id: 'nullflag-agent', tenant_id: TEST_TENANT_ID },
-      select: ['id', 'autofix_enabled'],
-    });
-    expect(withId).not.toBeNull();
-    expect(withId!.autofix_enabled).toBeNull();
-
-    // The footgun the fix works around: selecting only the NULL column drops the
-    // whole row, which is what silently disabled Autofix for default agents.
-    const flagOnly = await agentRepo.findOne({
-      where: { id: 'nullflag-agent', tenant_id: TEST_TENANT_ID },
-      select: ['autofix_enabled'],
-    });
-    expect(flagOnly).toBeNull();
-  });
-});
diff --git a/packages/backend/test/codex-responses.e2e-spec.ts b/packages/backend/test/codex-responses.e2e-spec.ts
index 875f72e9..cdee0afb 100644
--- a/packages/backend/test/codex-responses.e2e-spec.ts
+++ b/packages/backend/test/codex-responses.e2e-spec.ts
@@ -116,7 +116,6 @@ describe('Codex Responses tool loop (e2e)', () => {
         name: 'Codex E2E',
         agent_category: 'coding',
         agent_platform: 'codex',
-        autofix_enabled: false,
       })
       .expect(201);
     apiKey = created.body.apiKey;
diff --git a/packages/backend/test/cross-tenant-isolation.e2e-spec.ts b/packages/backend/test/cross-tenant-isolation.e2e-spec.ts
index 7d47d18c..29802264 100644
--- a/packages/backend/test/cross-tenant-isolation.e2e-spec.ts
+++ b/packages/backend/test/cross-tenant-isolation.e2e-spec.ts
@@ -53,7 +53,9 @@ describe('cross-tenant isolation (e2e)', () => {
     req.set('x-api-key', TEST_API_KEY).set('x-test-user-id', USER_B);
 
   it('the owning tenant can read its harness', async () => {
-    const res = await asA(request(app.getHttpServer()).get('/api/v1/agents/test-agent')).expect(200);
+    const res = await asA(request(app.getHttpServer()).get('/api/v1/agents/test-agent')).expect(
+      200,
+    );
     expect(res.body.agent?.agent_name ?? res.body.agent?.name).toBe('test-agent');
   });
 
@@ -74,7 +76,6 @@ describe('cross-tenant isolation (e2e)', () => {
   it.each([
     ['GET', '/api/v1/agents/test-agent/key'],
     ['GET', '/api/v1/routing/test-agent/tiers'],
-    ['GET', '/api/v1/routing/test-agent/autofix'],
     ['GET', '/api/v1/routing/test-agent/recording'],
   ])('a foreign tenant cannot GET %s (%s)', async (_label, path) => {
     // Tenant-first resolution throws NotFound for a foreign harness.
@@ -89,9 +90,7 @@ describe('cross-tenant isolation (e2e)', () => {
     ).expect(404);
 
     await asB(
-      request(app.getHttpServer())
-        .post('/api/v1/agents/test-agent/rotate-key')
-        .send({}),
+      request(app.getHttpServer()).post('/api/v1/agents/test-agent/rotate-key').send({}),
     ).expect(404);
 
     await asB(request(app.getHttpServer()).delete('/api/v1/agents/test-agent')).expect(404);
@@ -116,7 +115,9 @@ describe('cross-tenant isolation (e2e)', () => {
   });
 
   it('the owning agent still exists after the foreign attempts', async () => {
-    const row = await ds.query(`SELECT tenant_id, deleted_at FROM agents WHERE name = 'test-agent'`);
+    const row = await ds.query(
+      `SELECT tenant_id, deleted_at FROM agents WHERE name = 'test-agent'`,
+    );
     expect(row).toHaveLength(1);
     expect(row[0].tenant_id).toBe(TEST_TENANT_ID);
     expect(row[0].deleted_at).toBeNull();
diff --git a/packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts b/packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts
new file mode 100644
index 00000000..86cb631f
--- /dev/null
+++ b/packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts
@@ -0,0 +1,155 @@
+import { DataSource } from 'typeorm';
+import { entities, migrations } from '../src/database/data-source-definitions';
+import { DropAutofixSchema1803400000000 } from '../src/database/migrations/1803400000000-DropAutofixSchema';
+
+/** Every Autofix column the migration drops, as `table.column`. */
+const AUTOFIX_COLUMNS = [
+  'agents.autofix_enabled',
+  'agent_messages.autofix_applied',
+  'agent_messages.autofix_group_id',
+  'agent_messages.autofix_role',
+  'agent_messages.autofix_operations',
+  'agent_messages.autofix_phoenix',
+  'requests.autofix_status',
+  'install_metadata.autofix_consented_at',
+].sort();
+
+const AUTOFIX_INDEXES = [
+  'IDX_agent_messages_autofix_group',
+  'IDX_agent_messages_autofix_request',
+  'IDX_requests_autofix_healed',
+];
+
+interface AutofixArtifacts {
+  columns: string[];
+  indexes: string[];
+  checks: string[];
+}
+
+async function autofixArtifacts(ds: DataSource): Promise<AutofixArtifacts> {
+  const columns: Array<{ name: string }> = await ds.query(
+    `SELECT table_name || '.' || column_name AS name
+     FROM information_schema.columns
+     WHERE table_schema = 'public' AND column_name LIKE 'autofix%'
+     ORDER BY 1`,
+  );
+  const indexes: Array<{ name: string }> = await ds.query(
+    `SELECT indexname AS name FROM pg_indexes
+     WHERE schemaname = 'public' AND indexname = ANY($1)
+     ORDER BY 1`,
+    [AUTOFIX_INDEXES],
+  );
+  const checks: Array<{ name: string }> = await ds.query(
+    `SELECT conname AS name FROM pg_constraint WHERE conname = 'CHK_requests_autofix_status'`,
+  );
+  return {
+    columns: columns.map((row) => row.name),
+    indexes: indexes.map((row) => row.name),
+    checks: checks.map((row) => row.name),
+  };
+}
+
+const NONE: AutofixArtifacts = { columns: [], indexes: [], checks: [] };
+
+async function runDropMigration(ds: DataSource, direction: 'up' | 'down'): Promise<void> {
+  const queryRunner = ds.createQueryRunner();
+  try {
+    // Mirror the deploy runner (transaction mode 'each'): SET LOCAL only
+    // applies inside a transaction.
+    await queryRunner.startTransaction();
+    await new DropAutofixSchema1803400000000()[direction](queryRunner);
+    await queryRunner.commitTransaction();
+  } catch (error) {
+    await queryRunner.rollbackTransaction();
+    throw error;
+  } finally {
+    await queryRunner.release();
+  }
+}
+
+describe('DropAutofixSchema migration (e2e)', () => {
+  let ds: DataSource;
+
+  beforeAll(async () => {
+    ds = new DataSource({
+      type: 'postgres',
+      url:
+        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase',
+      // The exact registries the deploy runner uses, not a glob.
+      entities,
+      migrations,
+      synchronize: false,
+      dropSchema: true,
+      logging: false,
+    });
+    await ds.initialize();
+    await ds.runMigrations({ transaction: 'each' });
+  }, 120_000);
+
+  afterAll(async () => {
+    if (ds?.isInitialized) await ds.destroy();
+  });
+
+  it('leaves no Autofix schema on a database migrated from empty', async () => {
+    expect(await autofixArtifacts(ds)).toEqual(NONE);
+    const applied: Array<{ name: string }> = await ds.query(
+      `SELECT "name" FROM "migrations" WHERE "name" = 'DropAutofixSchema1803400000000'`,
+    );
+    expect(applied).toHaveLength(1);
+  });
+
+  it('restores the self-hosted schema on revert and drops it again', async () => {
+    await runDropMigration(ds, 'down');
+    expect(await autofixArtifacts(ds)).toEqual({
+      columns: AUTOFIX_COLUMNS,
+      indexes: ['IDX_agent_messages_autofix_group', 'IDX_agent_messages_autofix_request'],
+      checks: ['CHK_requests_autofix_status'],
+    });
+
+    // The restored constraint still guards the column the way 1801000000000 did.
+    await expect(
+      ds.query(
+        `INSERT INTO "requests" ("id", "timestamp", "status", "autofix_status")
+         VALUES ('bad-autofix-status', now(), 'success', 'bogus')`,
+      ),
+    ).rejects.toThrow(/CHK_requests_autofix_status/);
+
+    // A revert on an already-reverted schema is a no-op.
+    await runDropMigration(ds, 'down');
+
+    await runDropMigration(ds, 'up');
+    expect(await autofixArtifacts(ds)).toEqual(NONE);
+
+    // Idempotent: a second run on the cleaned schema is a no-op.
+    await runDropMigration(ds, 'up');
+    expect(await autofixArtifacts(ds)).toEqual(NONE);
+  });
+
+  it('drops a leftover cloud-mode healed-requests index along with its column', async () => {
+    await runDropMigration(ds, 'down');
+    await ds.query(
+      `CREATE INDEX "IDX_requests_autofix_healed" ON "requests" ("tenant_id", "timestamp")
+       INCLUDE ("status") WHERE "autofix_status" = 'retry_succeeded'`,
+    );
+    expect((await autofixArtifacts(ds)).indexes).toContain('IDX_requests_autofix_healed');
+
+    await runDropMigration(ds, 'up');
+
+    expect(await autofixArtifacts(ds)).toEqual(NONE);
+  });
+
+  it('keeps existing rows when the columns go', async () => {
+    await runDropMigration(ds, 'down');
+    await ds.query(
+      `INSERT INTO "requests" ("id", "timestamp", "status", "autofix_status")
+       VALUES ('kept-request', now(), 'success', 'retry_succeeded')`,
+    );
+
+    await runDropMigration(ds, 'up');
+
+    const rows: Array<{ id: string; status: string }> = await ds.query(
+      `SELECT "id", "status" FROM "requests" WHERE "id" = 'kept-request'`,
+    );
+    expect(rows).toEqual([{ id: 'kept-request', status: 'success' }]);
+  });
+});
diff --git a/packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts b/packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts
index 9a3a8ba9..17e1a189 100644
--- a/packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts
+++ b/packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts
@@ -127,8 +127,10 @@ describe('DropSaasFeatureSchema migration (e2e)', () => {
 
   it('drops a leftover cloud-mode CRM index', async () => {
     await ds.query(
+      // The real index filtered on requests.autofix_status, which #16 dropped;
+      // only its name matters to this migration.
       `CREATE INDEX "IDX_requests_autofix_healed" ON "requests" ("tenant_id", "timestamp")
-       INCLUDE ("status") WHERE "autofix_status" = 'retry_succeeded'`,
+       INCLUDE ("status")`,
     );
     expect((await saasArtifacts(ds)).crmIndex).toBe('"IDX_requests_autofix_healed"');
 
diff --git a/packages/backend/test/messages-request-filters.e2e-spec.ts b/packages/backend/test/messages-request-filters.e2e-spec.ts
index 971e5939..370497f2 100644
--- a/packages/backend/test/messages-request-filters.e2e-spec.ts
+++ b/packages/backend/test/messages-request-filters.e2e-spec.ts
@@ -9,7 +9,7 @@ import { createTestApp, TEST_API_KEY, TEST_TENANT_ID } from './helpers';
  *
  * Attempt lookups are bounded by the parent's tenant and time window, the
  * harness is resolved to its id before the query, and "no recovery attempt" is
- * two anti-joins. Those are planner hints: every filter and combination here
+ * an anti-join on the fallback attempt. Those are planner hints: every filter and combination here
  * must return exactly the requests it returned before, with a matching total.
  */
 
@@ -23,7 +23,6 @@ type Attempt = {
   model: string;
   status: string;
   fallbackFrom?: string;
-  autofix?: boolean;
 };
 
 let app: INestApplication;
@@ -74,8 +73,8 @@ async function seedRequest(
   );
   for (const [index, attempt] of opts.attempts.entries()) {
     await ds.query(
-      `INSERT INTO agent_messages (id, request_id, attempt_number, tenant_id, agent_id, agent_name, user_id, timestamp, status, provider, model, fallback_from_model, autofix_applied, input_tokens, output_tokens, service_type)
-       VALUES ($1, $2, $3, $4, $5, $6, 'test-user-001', $7, $8, $9, $10, $11, $12, 10, 5, 'agent')`,
+      `INSERT INTO agent_messages (id, request_id, attempt_number, tenant_id, agent_id, agent_name, user_id, timestamp, status, provider, model, fallback_from_model, input_tokens, output_tokens, service_type)
+       VALUES ($1, $2, $3, $4, $5, $6, 'test-user-001', $7, $8, $9, $10, $11, 10, 5, 'agent')`,
       [
         uuid(),
         id,
@@ -89,7 +88,6 @@ async function seedRequest(
         attempt.provider,
         attempt.model,
         attempt.fallbackFrom ?? null,
-        attempt.autofix ?? false,
       ],
     );
   }
@@ -119,11 +117,12 @@ beforeAll(async () => {
       { provider: 'openai', model: 'probe-a', status: 'success', fallbackFrom: 'probe-b' },
     ],
   });
-  await seedRequest(ds, 'autofix', {
+  // A failed attempt retried on the same route, with no fallback hop.
+  await seedRequest(ds, 'retried', {
     msAgo: 3 * HOUR,
     attempts: [
       { provider: 'openai', model: 'probe-a', status: 'error' },
-      { provider: 'openai', model: 'probe-a', status: 'success', autofix: true },
+      { provider: 'openai', model: 'probe-a', status: 'success' },
     ],
   });
   await seedRequest(ds, 'failed', {
@@ -201,18 +200,16 @@ async function expectHarnessWeek(filters: string, expected: string[]): Promise<v
 
 describe('GET /api/v1/messages request filters', () => {
   it('lists the harness week with no other filter', async () => {
-    await expectHarnessWeek('', ['plain', 'fallback', 'autofix', 'failed', 'blocked', 'edge']);
+    await expectHarnessWeek('', ['plain', 'fallback', 'retried', 'failed', 'blocked', 'edge']);
   });
 
   it.each([
     ['trigger=fallback', ['fallback', 'edge']],
-    ['trigger=autofix', ['autofix']],
-    ['trigger=none', ['plain', 'failed', 'blocked']],
-    ['trigger=fallback,none', ['plain', 'fallback', 'failed', 'blocked', 'edge']],
-    ['trigger=autofix,fallback', ['fallback', 'autofix', 'edge']],
+    ['trigger=none', ['plain', 'retried', 'failed', 'blocked']],
+    ['trigger=fallback,none', ['plain', 'fallback', 'retried', 'failed', 'blocked', 'edge']],
     ['status=failed', ['failed', 'blocked']],
-    ['status=ok', ['plain', 'fallback', 'autofix', 'edge']],
-    ['status=ok&trigger=autofix', ['autofix']],
+    ['status=ok', ['plain', 'fallback', 'retried', 'edge']],
+    ['status=ok&trigger=none', ['plain', 'retried']],
     ['status=failed&trigger=none', ['failed', 'blocked']],
     ['origin=provider', ['failed']],
     ['origin=manifest', ['blocked']],
@@ -220,13 +217,20 @@ describe('GET /api/v1/messages request filters', () => {
     ['provider=anthropic&trigger=none', ['failed']],
     ['model=probe-b', ['fallback', 'failed', 'edge']],
     ['model=probe-blocked', ['blocked']],
-    ['model=probe-a&trigger=autofix', ['autofix']],
-    ['attempts=has_failed', ['fallback', 'autofix', 'failed', 'edge']],
-    ['attempts=has_failed,has_succeeded', ['fallback', 'autofix', 'edge']],
+    ['model=probe-a&trigger=none', ['plain', 'retried']],
+    ['attempts=has_failed', ['fallback', 'retried', 'failed', 'edge']],
+    ['attempts=has_failed,has_succeeded', ['fallback', 'retried', 'edge']],
   ])('%s', async (filters, expected) => {
     await expectHarnessWeek(filters, expected);
   });
 
+  it('rejects the trigger value of the removed Autofix feature', async () => {
+    await request(app.getHttpServer())
+      .get(`/api/v1/messages?range=7d&agent_name=${HARNESS}&trigger=autofix`)
+      .set('x-api-key', TEST_API_KEY)
+      .expect(400);
+  });
+
   it('keeps requests older than the range out and lets a wider range in', async () => {
     const month = await log(`range=30d&agent_name=${HARNESS}&trigger=fallback`);
     expect(keysOf(month)).toEqual(['fallback', 'edge', 'old']);
@@ -245,18 +249,18 @@ describe('GET /api/v1/messages request filters', () => {
   it('pages a filtered view with a stable total', async () => {
     const first = await log(`range=7d&agent_name=${HARNESS}&trigger=fallback,none&limit=2`);
     expect(keysOf(first)).toEqual(['plain', 'fallback']);
-    expect(first.total_count).toBe(5);
+    expect(first.total_count).toBe(6);
 
     const cursor = encodeURIComponent(first.next_cursor ?? '');
     const second = await log(
       `range=7d&agent_name=${HARNESS}&trigger=fallback,none&limit=2&cursor=${cursor}`,
     );
-    expect(keysOf(second)).toEqual(['failed', 'blocked']);
+    expect(keysOf(second)).toEqual(['retried', 'failed']);
 
     const third = await log(
       `range=7d&agent_name=${HARNESS}&trigger=fallback,none&limit=2&cursor=${encodeURIComponent(second.next_cursor ?? '')}`,
     );
-    expect(keysOf(third)).toEqual(['edge']);
+    expect(keysOf(third)).toEqual(['blocked', 'edge']);
     expect(third.next_cursor).toBeNull();
   });
 
diff --git a/packages/backend/test/no-autofix-egress.e2e-spec.ts b/packages/backend/test/no-autofix-egress.e2e-spec.ts
new file mode 100644
index 00000000..5ac3537c
--- /dev/null
+++ b/packages/backend/test/no-autofix-egress.e2e-spec.ts
@@ -0,0 +1,64 @@
+/**
+ * #16: Thinker makes no call to Manifest's hosted healer. Upstream pinged
+ * `autofix.manifest.build` on every production boot (AutofixHealthProbe) and on
+ * every repairable 4xx (the heal-once flow). Both are gone; this guards against
+ * either coming back.
+ */
+import { readdirSync, readFileSync, statSync } from 'fs';
+import { join } from 'path';
+import { INestApplication } from '@nestjs/common';
+import { createTestApp } from './helpers';
+
+const HEALER_HOST = 'autofix.manifest.build';
+const SRC = join(__dirname, '..', 'src');
+
+function sourceFiles(dir: string): string[] {
+  return readdirSync(dir).flatMap((entry) => {
+    const path = join(dir, entry);
+    if (statSync(path).isDirectory()) return sourceFiles(path);
+    return /\.(ts|tsx|mjs|js|json|ya?ml)$/.test(entry) ? [path] : [];
+  });
+}
+
+describe('no Autofix egress', () => {
+  it('names the hosted healer nowhere in the backend source', () => {
+    const offenders = sourceFiles(SRC).filter((file) =>
+      readFileSync(file, 'utf8').includes(HEALER_HOST),
+    );
+    expect(offenders).toEqual([]);
+  });
+
+  it('ships no boot-time healer probe or healing client', () => {
+    const offenders = sourceFiles(SRC).filter((file) =>
+      /AutofixHealthProbe|HttpHealingClient|HEALING_CLIENT|ObservationReporter/.test(
+        readFileSync(file, 'utf8'),
+      ),
+    );
+    expect(offenders).toEqual([]);
+  });
+
+  describe('at boot', () => {
+    let app: INestApplication | undefined;
+    const originalFetch = globalThis.fetch;
+    const urls: string[] = [];
+
+    beforeAll(async () => {
+      globalThis.fetch = (async (input: Parameters<typeof fetch>[0], init?: RequestInit) => {
+        urls.push(
+          typeof input === 'string' ? input : input instanceof URL ? input.href : input.url,
+        );
+        return originalFetch(input, init);
+      }) as typeof fetch;
+      app = await createTestApp();
+    });
+
+    afterAll(async () => {
+      await app?.close();
+      globalThis.fetch = originalFetch;
+    });
+
+    it('makes no request to the hosted healer while the app boots', () => {
+      expect(urls.filter((url) => url.includes(HEALER_HOST))).toEqual([]);
+    });
+  });
+});
diff --git a/packages/backend/test/playground-exclusion.e2e-spec.ts b/packages/backend/test/playground-exclusion.e2e-spec.ts
index 9eabdf2a..437ce0fa 100644
--- a/packages/backend/test/playground-exclusion.e2e-spec.ts
+++ b/packages/backend/test/playground-exclusion.e2e-spec.ts
@@ -240,7 +240,7 @@ describe('Playground exclusion (behavioural, not SQL-shape)', () => {
 
   it('charts exactly the rows the reference predicate keeps', async () => {
     const res = await auth(
-      api().get('/api/v1/overview/autofix-timeseries?range=24h&by=disposition'),
+      api().get('/api/v1/overview/reliability/timeseries?range=24h&by=disposition'),
     ).expect(200);
     const charted = (res.body.buckets as Array<{ counts: number[] }>).reduce(
       (sum, b) => sum + b.counts.reduce((a, c) => a + Number(c), 0),
diff --git a/packages/backend/test/reliability-analytics.e2e-spec.ts b/packages/backend/test/reliability-analytics.e2e-spec.ts
new file mode 100644
index 00000000..d6239acd
--- /dev/null
+++ b/packages/backend/test/reliability-analytics.e2e-spec.ts
@@ -0,0 +1,173 @@
+/**
+ * Request reliability moved to neutral paths when Autofix left the backend
+ * (#16): `/api/v1/overview/reliability/*` serves the dashboard's success rate,
+ * fallback recoveries, request status series and per-harness/provider/model
+ * reliability. The Autofix routes and the legacy `/overview/autofix-*` paths
+ * answer 404, and the removed per-harness flag is no longer accepted.
+ */
+import { INestApplication } from '@nestjs/common';
+import { DataSource } from 'typeorm';
+import request from 'supertest';
+import { createTestApp, TEST_AGENT_ID, TEST_API_KEY, TEST_TENANT_ID } from './helpers';
+
+let app: INestApplication;
+
+/** Local wall-clock, the way the gateway writes `timestamp` columns. */
+function sqlTime(msAgo: number): string {
+  const d = new Date(Date.now() - msAgo);
+  const pad = (n: number) => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`;
+}
+
+const HOUR = 3_600_000;
+const REQUESTS = ['rel-success', 'rel-fallback', 'rel-error'];
+
+beforeAll(async () => {
+  app = await createTestApp();
+  const ds = app.get(DataSource);
+  const seed = async (
+    id: string,
+    status: string,
+    attempts: Array<{ status: string; model: string; fallbackFrom?: string }>,
+  ) => {
+    await ds.query(
+      `INSERT INTO requests (id, tenant_id, agent_id, agent_name, timestamp, status)
+       VALUES ($1, $2, $3, 'test-agent', $4, $5)`,
+      [id, TEST_TENANT_ID, TEST_AGENT_ID, sqlTime(HOUR), status],
+    );
+    for (const [index, attempt] of attempts.entries()) {
+      await ds.query(
+        `INSERT INTO agent_messages (id, request_id, attempt_number, tenant_id, agent_id, agent_name,
+           timestamp, status, provider, model, fallback_from_model, input_tokens, output_tokens)
+         VALUES ($1, $2, $3, $4, $5, 'test-agent', $6, $7, 'openai', $8, $9, 1, 1)`,
+        [
+          `${id}-${index + 1}`,
+          id,
+          index + 1,
+          TEST_TENANT_ID,
+          TEST_AGENT_ID,
+          sqlTime(HOUR - (index + 1) * 1_000),
+          attempt.status,
+          attempt.model,
+          attempt.fallbackFrom ?? null,
+        ],
+      );
+    }
+  };
+  await seed('rel-success', 'success', [{ status: 'success', model: 'rel-model-a' }]);
+  await seed('rel-fallback', 'success', [
+    { status: 'fallback_error', model: 'rel-model-a' },
+    { status: 'success', model: 'rel-model-b', fallbackFrom: 'rel-model-a' },
+  ]);
+  await seed('rel-error', 'failed', [{ status: 'error', model: 'rel-model-a' }]);
+});
+
+afterAll(async () => {
+  const ds = app.get(DataSource);
+  await ds.query('DELETE FROM agent_messages WHERE request_id = ANY($1)', [REQUESTS]);
+  await ds.query('DELETE FROM requests WHERE id = ANY($1)', [REQUESTS]);
+  await app.close();
+});
+
+const get = (path: string) => request(app.getHttpServer()).get(path).set('x-api-key', TEST_API_KEY);
+
+describe('GET /api/v1/overview/reliability/*', () => {
+  it('serves the request reliability KPIs with fallback recoveries', async () => {
+    const res = await get(
+      '/api/v1/overview/reliability/stats?range=24h&agent_name=test-agent',
+    ).expect(200);
+
+    expect(res.body).toEqual({
+      success_rate: { value: 2 / 3, previous: 0 },
+      fallback_saves: { value: 1, previous: 0 },
+      total_requests: { value: 3, previous: 0 },
+      errors_remaining: { value: 1, previous: 0 },
+    });
+  });
+
+  it('serves the request status series with success, fallback and error only', async () => {
+    const res = await get(
+      '/api/v1/overview/reliability/timeseries?range=24h&by=disposition&agent_name=test-agent',
+    ).expect(200);
+
+    expect(res.body.by).toBe('disposition');
+    expect(res.body.keys).toEqual(['success', 'fallback', 'error']);
+    const totals = (res.body.buckets as Array<{ counts: number[] }>).reduce(
+      (sum, bucket) => sum.map((value, i) => value + bucket.counts[i]!),
+      [0, 0, 0],
+    );
+    expect(totals).toEqual([1, 1, 1]);
+  });
+
+  it('rejects the removed Autofix series dimension', async () => {
+    await get('/api/v1/overview/reliability/timeseries?range=24h&by=autofix').expect(400);
+  });
+
+  it('serves per-harness, per-provider and per-model reliability', async () => {
+    const agents = await get('/api/v1/overview/reliability/per-agent?range=24h').expect(200);
+    expect(agents.body).toEqual(
+      expect.arrayContaining([
+        { agent_name: 'test-agent', requests: 3, failed: 1, fallback_saves: 1, succeeded: 2 },
+      ]),
+    );
+
+    const providers = await get(
+      '/api/v1/overview/reliability/per-provider?range=24h&agent_name=test-agent',
+    ).expect(200);
+    expect(providers.body).toEqual([
+      {
+        provider: 'openai',
+        auth_type: 'api_key',
+        key_label: 'Default',
+        attempts: 4,
+        failed: 2,
+        succeeded: 2,
+      },
+    ]);
+
+    const models = await get(
+      '/api/v1/overview/reliability/per-model?range=24h&agent_name=test-agent',
+    ).expect(200);
+    expect(models.body).toEqual(
+      expect.arrayContaining([
+        { model: 'rel-model-a', attempts: 3, failed: 2, succeeded: 1 },
+        { model: 'rel-model-b', attempts: 1, failed: 0, succeeded: 1 },
+      ]),
+    );
+  });
+
+  it('requires authentication', async () => {
+    await request(app.getHttpServer()).get('/api/v1/overview/reliability/stats').expect(401);
+  });
+});
+
+describe('removed Autofix surface', () => {
+  it.each([
+    ['get', '/api/v1/overview/autofix-stats'],
+    ['get', '/api/v1/overview/autofix-timeseries'],
+    ['get', '/api/v1/overview/autofix-per-agent'],
+    ['get', '/api/v1/overview/autofix-per-provider'],
+    ['get', '/api/v1/overview/autofix-per-model'],
+    ['get', '/api/v1/autofix/status'],
+    ['post', '/api/v1/autofix/enable-all'],
+    ['get', '/api/v1/routing/test-agent/autofix'],
+    ['patch', '/api/v1/routing/test-agent/autofix'],
+  ] as const)('%s %s answers 404', async (method, path) => {
+    const res = await request(app.getHttpServer())
+      [method](path)
+      .set('x-api-key', TEST_API_KEY)
+      .send({ enabled: true });
+
+    expect(res.status).toBe(404);
+  });
+
+  it('rejects the removed per-harness flag on create', async () => {
+    const res = await request(app.getHttpServer())
+      .post('/api/v1/agents')
+      .set('x-api-key', TEST_API_KEY)
+      .send({ name: 'Flagged Harness', autofix_enabled: false })
+      .expect(400);
+
+    expect(JSON.stringify(res.body)).toContain('autofix_enabled');
+  });
+});
diff --git a/packages/backend/test/request-backfill-fallbacks.e2e-spec.ts b/packages/backend/test/request-backfill-fallbacks.e2e-spec.ts
index 39e4675c..2715443f 100644
--- a/packages/backend/test/request-backfill-fallbacks.e2e-spec.ts
+++ b/packages/backend/test/request-backfill-fallbacks.e2e-spec.ts
@@ -12,10 +12,6 @@ interface LegacyAttempt {
   fallbackFrom?: string;
   fallbackIndex?: number;
   superseded?: boolean;
-  autofixGroup?: string;
-  autofixApplied?: boolean;
-  autofixRole?: string;
-  autofixDecision?: object;
   errorOrigin?: string;
   requestParams?: object;
   traceId?: string;
@@ -67,10 +63,6 @@ describe('request backfill legacy fallback reconstruction (e2e)', () => {
         feedback_rating varchar,
         feedback_tags varchar,
         feedback_details text,
-        autofix_group_id varchar,
-        autofix_applied boolean DEFAULT false,
-        autofix_role varchar,
-        autofix_phoenix jsonb,
         superseded boolean DEFAULT false,
         fallback_from_model varchar,
         fallback_index integer
@@ -90,13 +82,12 @@ describe('request backfill legacy fallback reconstruction (e2e)', () => {
       `INSERT INTO agent_messages (
         id, tenant_id, agent_id, agent_name, timestamp, duration_ms, status,
         model, fallback_from_model, fallback_index, superseded,
-        autofix_group_id, autofix_applied, autofix_role, autofix_phoenix,
         error_origin, caller_attribution, request_headers,
         request_params, trace_id, session_key, session_id
       ) VALUES (
         $1, 'tenant-1', 'agent-1', 'Agent', $2, 100, $3, $4, $5, $6, $7,
-        $8, $9, $10, $11, $12, '{"agent":"openai-sdk"}',
-        '{"content-type":"application/json"}', $13, $14, $15, $16
+        $8, '{"agent":"openai-sdk"}',
+        '{"content-type":"application/json"}', $9, $10, $11, $12
       )`,
       [
         attempt.id,
@@ -106,10 +97,6 @@ describe('request backfill legacy fallback reconstruction (e2e)', () => {
         attempt.fallbackFrom ?? null,
         attempt.fallbackIndex ?? null,
         attempt.superseded ?? false,
-        attempt.autofixGroup ?? null,
-        attempt.autofixApplied ?? false,
-        attempt.autofixRole ?? null,
-        attempt.autofixDecision ?? null,
         attempt.errorOrigin ?? null,
         attempt.requestParams ?? { model: 'openai/gpt-4o' },
         attempt.traceId ?? null,
@@ -580,26 +567,25 @@ describe('request backfill legacy fallback reconstruction (e2e)', () => {
 
     await dataSource.query(`
       INSERT INTO agent_messages (
-        id, tenant_id, agent_id, agent_name, timestamp, status, model, autofix_phoenix
+        id, tenant_id, agent_id, agent_name, timestamp, status, model, error_origin
       ) VALUES (
         'old-replica', 'tenant-1', 'agent-1', 'Agent',
-        '2026-01-01 00:05:00.000', 'error', 'openai/gpt-4o',
-        '{"status":"no_patch","issueId":"issue-1"}'::jsonb
+        '2026-01-01 00:05:00.000', 'error', 'openai/gpt-4o', 'provider'
       )
     `);
     await dataSource.query(`
       UPDATE agent_messages
-      SET status = 'ok', autofix_phoenix = '{"status":"no_patch","issueId":"issue-2"}'::jsonb
+      SET status = 'ok', error_origin = NULL
       WHERE id = 'old-replica'
     `);
 
     const [attempt] = await dataSource.query(
-      `SELECT status, autofix_phoenix, request_id, attempt_number
+      `SELECT status, error_origin, request_id, attempt_number
        FROM agent_messages WHERE id = 'old-replica'`,
     );
     expect(attempt).toEqual({
       status: 'ok',
-      autofix_phoenix: { status: 'no_patch', issueId: 'issue-2' },
+      error_origin: null,
       request_id: null,
       attempt_number: null,
     });
@@ -625,7 +611,7 @@ describe('request backfill legacy fallback reconstruction (e2e)', () => {
     expect(request).toEqual({ status: 'failed' });
   });
 
-  it('preserves ordinary and Autofix grouping behavior', async () => {
+  it('turns each trace-less ordinary attempt into its own first-attempt request', async () => {
     await insertAttempt({
       id: 'plain',
       timestamp: '2026-01-01 00:03:00.000',
@@ -633,106 +619,24 @@ describe('request backfill legacy fallback reconstruction (e2e)', () => {
       model: 'openai/gpt-4o',
     });
     await insertAttempt({
-      id: 'autofix-original',
+      id: 'plain-failed',
       timestamp: '2026-01-01 00:03:01.000',
-      status: 'auto_fixed',
+      status: 'error',
       model: 'openai/gpt-4o',
-      superseded: true,
-      autofixGroup: 'heal-1',
       errorOrigin: 'provider',
     });
-    await insertAttempt({
-      id: 'autofix-retry',
-      timestamp: '2026-01-01 00:03:01.100',
-      status: 'ok',
-      model: 'openai/gpt-4o',
-      autofixGroup: 'heal-1',
-    });
 
     await backfill();
 
-    const [{ requests, parents, ordered }] = await dataSource.query(
-      `SELECT (SELECT count(*)::int FROM requests) requests,
-              (SELECT count(DISTINCT request_id)::int FROM agent_messages) parents,
-              (SELECT array_agg(attempt_number ORDER BY attempt_number)
-               FROM agent_messages
-               WHERE autofix_group_id = 'heal-1') ordered`,
+    const rows = await dataSource.query(
+      `SELECT pa.id, pa.attempt_number, r.status
+       FROM agent_messages pa
+       JOIN requests r ON r.id = pa.request_id
+       ORDER BY pa.id`,
     );
-    expect({ requests, parents, ordered }).toEqual({
-      requests: 2,
-      parents: 2,
-      ordered: [1, 2],
-    });
-  });
-
-  it('backfills each recorded Autofix outcome onto its request', async () => {
-    const base = {
-      timestamp: '2026-01-01 00:03:00.000',
-      status: 'error',
-      model: 'openai/gpt-4o',
-      errorOrigin: 'provider',
-      autofixApplied: true,
-    };
-    await insertAttempt({
-      ...base,
-      id: 'no-patch',
-      autofixDecision: { status: 'no_patch', issueId: 'issue-no-patch' },
-    });
-    await insertAttempt({
-      ...base,
-      id: 'resolving',
-      autofixDecision: { status: 'resolving', issueId: 'issue-resolving' },
-    });
-    await insertAttempt({ ...base, id: 'service-error' });
-    await insertAttempt({
-      ...base,
-      id: 'legacy-no-patch',
-      autofixDecision: { issueId: 'legacy-issue' },
-    });
-    await insertAttempt({
-      ...base,
-      id: 'retry-success-original',
-      status: 'auto_fixed',
-      superseded: true,
-      autofixGroup: 'success-group',
-      autofixRole: 'original',
-      autofixDecision: { status: 'patched', healAttemptId: 'heal-success' },
-    });
-    await insertAttempt({
-      ...base,
-      id: 'retry-success',
-      timestamp: '2026-01-01 00:03:00.100',
-      status: 'ok',
-      autofixGroup: 'success-group',
-      autofixRole: 'retry',
-    });
-    await insertAttempt({
-      ...base,
-      id: 'retry-failed',
-      autofixGroup: 'failed-group',
-      autofixRole: 'retry',
-      autofixDecision: { status: 'patched', healAttemptId: 'heal-failed' },
-    });
-
-    await backfill({ batchSize: 1 });
-
-    const rows = await dataSource.query(`
-      SELECT pa.id, r.autofix_status
-      FROM agent_messages pa
-      JOIN requests r ON r.id = pa.request_id
-      WHERE pa.id IN (
-        'no-patch', 'resolving', 'service-error', 'legacy-no-patch',
-        'retry-success', 'retry-failed'
-      )
-      ORDER BY pa.id
-    `);
     expect(rows).toEqual([
-      { id: 'legacy-no-patch', autofix_status: 'no_patch' },
-      { id: 'no-patch', autofix_status: 'no_patch' },
-      { id: 'resolving', autofix_status: 'resolving' },
-      { id: 'retry-failed', autofix_status: 'retry_failed' },
-      { id: 'retry-success', autofix_status: 'retry_succeeded' },
-      { id: 'service-error', autofix_status: 'service_error' },
+      { id: 'plain', attempt_number: 1, status: 'success' },
+      { id: 'plain-failed', attempt_number: 1, status: 'failed' },
     ]);
   });
 });
diff --git a/packages/cli/skill/SKILL.md b/packages/cli/skill/SKILL.md
index 91e54251..b82e07c1 100644
--- a/packages/cli/skill/SKILL.md
+++ b/packages/cli/skill/SKILL.md
@@ -7,7 +7,7 @@ description: Use when creating or operating AI agents that make LLM calls — pr
 
 ## Overview
 
-`mnfst` manages Manifest, the LLM gateway. Every call routed through a Manifest agent gets model routing with fallbacks, per-agent cost attribution, self-healing (Auto-fix), and a request log — for free. Default practice: never hand an app or automation a raw provider key; give it a Manifest agent.
+`mnfst` manages Manifest, the LLM gateway. Every call routed through a Manifest agent gets model routing with fallbacks, per-agent cost attribution, and a request log — for free. Default practice: never hand an app or automation a raw provider key; give it a Manifest agent.
 
 Commands emit JSON on stdout (human hints on stderr) — except `agent env`, which prints dotenv lines by design — exit 0/1, and never block on prompts when credentials come from flags or env. Full surface: `mnfst --help`.
 
@@ -34,7 +34,7 @@ Namespace = scope: `provider *` acts tenant-wide, `agent *` acts on one agent, `
 | Proxy returns HTTP 200 but the "answer" starts with `[🦚 Manifest M###]` | An error wearing an assistant costume — check the content, not the status. `routing test` unmasks these automatically |
 | `cost: "0.000000"` on subscription-auth traffic | Flat-rate subscription: per-request cost is genuinely zero, not broken billing |
 | `agent configure`'s echo differs from later reads | Mutation bodies echo raw API rows — the canonical readback is `routing status <agent>` |
-| "Which requests used a fallback or Auto-fix?" | Those fields are trimmed from default output — `requests get --full` |
+| "Which requests used a fallback?" | Those fields are trimmed from default output — `requests get --full` |
 | 401s missing from the request log | Rejected-auth attempts are never recorded (no tenant to attribute them to); a leaked key's blast radius cannot be proven from the log |
 | `MANIFEST_AGENT_URL` | Already ends in `/v1` — append `/chat/completions` directly |
 | Model prices needed before any agent exists | `mnfst model prices [--provider <p>]` — install-wide, no agent needed (`models <agent>` is the per-agent routable set) |
@@ -46,7 +46,7 @@ Namespace = scope: `provider *` acts tenant-wide, `agent *` acts on one agent, `
 
 ## Common mistakes
 
-- Handing an app a raw provider key — it loses fallbacks, cost attribution, healing, and the log. Create an agent and use `agent env`.
+- Handing an app a raw provider key — it loses fallbacks, cost attribution, and the log. Create an agent and use `agent env`.
 - Verifying a route with hand-rolled `curl` — fake-200s read as success. Use `routing test`.
 - Slurping the whole request log — pagination is one page per call by design; loop on `next_cursor`.
 
diff --git a/packages/cli/src/commands/commands.spec.ts b/packages/cli/src/commands/commands.spec.ts
index e7494978..0379c912 100644
--- a/packages/cli/src/commands/commands.spec.ts
+++ b/packages/cli/src/commands/commands.spec.ts
@@ -2071,8 +2071,6 @@ describe('requests get', () => {
       header_tier_color: null,
       provider_key_label: null,
       custom_provider_name: null,
-      autofix_applied: false,
-      autofix_role: null,
       cache_read_tokens: '0',
       cache_creation_tokens: '0',
     };
@@ -2103,13 +2101,12 @@ describe('requests get', () => {
     expect(full).toHaveProperty('cache_read_tokens');
   });
 
-  it('keeps meaningful conditionals: custom tier, fallback, autofix', async () => {
+  it('keeps meaningful conditionals: custom tier, fallback', async () => {
     const row = {
       id: 'r2',
       status: 'ok',
       header_tier_name: 'deep',
       fallback_from_model: 'grok-4.5',
-      autofix_applied: true,
       custom_provider_name: 'My LiteLLM',
     };
     const { io } = authedIo([{ status: 200, body: { items: [row], next_cursor: null } }]);
@@ -2117,7 +2114,6 @@ describe('requests get', () => {
     expect((io.lastJson() as { requests: object[] }).requests[0]).toMatchObject({
       header_tier_name: 'deep',
       fallback_from_model: 'grok-4.5',
-      autofix_applied: true,
       custom_provider_name: 'My LiteLLM',
     });
   });
@@ -2188,7 +2184,6 @@ describe('routing commands', () => {
           },
         ],
       },
-      { status: 200, body: { enabled: true } },
       { status: 200, body: { enabled: false } },
     ]);
     expect(await run(io, ['routing', 'status', 'John'])).toBe(0);
@@ -2197,7 +2192,6 @@ describe('routing commands', () => {
       [
         `${HOST}/api/v1/routing/john/tiers`,
         `${HOST}/api/v1/routing/john/header-tiers`,
-        `${HOST}/api/v1/routing/john/autofix`,
         `${HOST}/api/v1/routing/john/recording`,
       ].sort(),
     );
@@ -2216,7 +2210,6 @@ describe('routing commands', () => {
           fallbacks: [],
         },
       ],
-      autofix: true,
       recording: false,
     });
   });
@@ -2226,7 +2219,6 @@ describe('routing commands', () => {
       { status: 200, body: [] },
       { status: 200, body: [] },
       { status: 200, body: { enabled: false } },
-      { status: 200, body: { enabled: false } },
     ]);
     expect(await run(io, ['routing', 'status', 'john'])).toBe(0);
     expect(io.lastJson()).toMatchObject({
@@ -2493,20 +2485,18 @@ describe('routing commands', () => {
     expect(calls[0].url).toBe(`${HOST}/api/v1/routing/john/tiers/default`);
   });
 
-  it('agent configure toggles autofix/recording, alone or combined', async () => {
-    const { io, calls } = authedIo([
-      { status: 200, body: { enabled: true } },
-      { status: 200, body: { enabled: false } },
-    ]);
-    expect(
-      await run(io, ['agent', 'configure', 'john', '--autofix', 'true', '--recording', 'false']),
-    ).toBe(0);
-    expect(calls[0].url).toBe(`${HOST}/api/v1/routing/john/autofix`);
-    expect(calls[1].url).toBe(`${HOST}/api/v1/routing/john/recording`);
-    expect(io.lastJson()).toMatchObject({
-      autofix: { enabled: true },
-      recording: { enabled: false },
-    });
+  it('agent configure toggles recording alone', async () => {
+    const { io, calls } = authedIo([{ status: 200, body: { enabled: false } }]);
+    expect(await run(io, ['agent', 'configure', 'john', '--recording', 'false'])).toBe(0);
+    expect(calls).toHaveLength(1);
+    expect(calls[0].url).toBe(`${HOST}/api/v1/routing/john/recording`);
+    expect(io.lastJson()).toMatchObject({ recording: { enabled: false } });
+  });
+
+  it('agent configure rejects the removed --autofix flag', async () => {
+    const { io, calls } = authedIo([]);
+    expect(await run(io, ['agent', 'configure', 'john', '--autofix', 'true'])).toBe(1);
+    expect(calls).toHaveLength(0);
   });
 
   it('agent configure validates its input combinations', async () => {
@@ -2515,9 +2505,9 @@ describe('routing commands', () => {
     expect(io.lastJson()).toMatchObject({ error: 'missing_flag' });
 
     const { io: io2 } = authedIo([]);
-    // --autofix keeps the command non-empty so the tier-needs-route rule fires
+    // --recording keeps the command non-empty so the tier-needs-route rule fires
     expect(
-      await run(io2, ['agent', 'configure', 'john', '--tier', 'test', '--autofix', 'true']),
+      await run(io2, ['agent', 'configure', 'john', '--tier', 'test', '--recording', 'true']),
     ).toBe(1);
     expect((io2.lastJson() as { message: string }).message).toContain('--tier needs');
 
@@ -2995,17 +2985,21 @@ describe('routing commands', () => {
     expect(io3.lastJson()).toMatchObject({ error: 'invalid_flag' });
   });
 
-  it('autofix and recording get/set wrap GET/PATCH with a strict boolean', async () => {
+  it('recording get/set wrap GET/PATCH with a strict boolean', async () => {
     const { io, calls } = authedIo([{ status: 200, body: { enabled: true } }]);
-    expect(await run(io, ['routing', 'autofix', 'get', 'a'])).toBe(0);
-    expect(calls[0].url).toBe(`${HOST}/api/v1/routing/a/autofix`);
+    expect(await run(io, ['routing', 'recording', 'get', 'a'])).toBe(0);
+    expect(calls[0].url).toBe(`${HOST}/api/v1/routing/a/recording`);
 
     const { io: io2, calls: calls2 } = authedIo([{ status: 200, body: { enabled: false } }]);
     expect(await run(io2, ['routing', 'recording', 'set', 'a', '--enabled', 'false'])).toBe(0);
     expect(JSON.parse(calls2[0].body!)).toEqual({ enabled: false });
 
     const { io: io3 } = authedIo([]);
-    expect(await run(io3, ['routing', 'autofix', 'set', 'a', '--enabled', 'maybe'])).toBe(1);
+    expect(await run(io3, ['routing', 'recording', 'set', 'a', '--enabled', 'maybe'])).toBe(1);
+
+    const { io: io4, calls: calls4 } = authedIo([]);
+    expect(await run(io4, ['routing', 'autofix', 'get', 'a'])).toBe(1);
+    expect(calls4).toHaveLength(0);
   });
 });
 
diff --git a/packages/cli/src/commands/configure.ts b/packages/cli/src/commands/configure.ts
index f2036e41..93a30a51 100644
--- a/packages/cli/src/commands/configure.ts
+++ b/packages/cli/src/commands/configure.ts
@@ -14,7 +14,7 @@ function agentPath(agent: string, suffix: string): string {
  *
  *   mnfst agent configure <name> --models <primary,fb1,fb2> --provider <p>
  *   mnfst agent configure <name> --tier test --models <primary> --provider <p>
- *   mnfst agent configure <name> --autofix true --recording false
+ *   mnfst agent configure <name> --recording false
  *
  * --models is the FULL desired chain: first entry is the route, the rest are
  * fallbacks, and stating a single model clears any existing fallbacks.
@@ -26,16 +26,7 @@ function agentPath(agent: string, suffix: string): string {
  */
 export async function agentConfigure(io: CliIo, argv: string[]): Promise<void> {
   const args = parseArgs(argv, {
-    strings: [
-      'url',
-      'models',
-      'provider',
-      'auth-type',
-      'key-label',
-      'tier',
-      'autofix',
-      'recording',
-    ],
+    strings: ['url', 'models', 'provider', 'auth-type', 'key-label', 'tier', 'recording'],
     booleans: ['force'],
     maxPositionals: 1,
   });
@@ -51,12 +42,11 @@ export async function agentConfigure(io: CliIo, argv: string[]): Promise<void> {
     args.strings['provider'] !== undefined ||
     args.strings['auth-type'] !== undefined ||
     args.strings['key-label'] !== undefined;
-  const wantsAutofix = args.strings['autofix'] !== undefined;
   const wantsRecording = args.strings['recording'] !== undefined;
-  if (!wantsRoute && !wantsAutofix && !wantsRecording) {
+  if (!wantsRoute && !wantsRecording) {
     throw new CliError(
       'missing_flag',
-      'Nothing to configure — pass --models + --provider, --autofix, and/or --recording',
+      'Nothing to configure — pass --models + --provider and/or --recording',
     );
   }
   if (args.strings['tier'] !== undefined && !wantsRoute) {
@@ -117,12 +107,6 @@ export async function agentConfigure(io: CliIo, argv: string[]): Promise<void> {
     }
   }
 
-  if (wantsAutofix) {
-    const enabled = parseBooleanFlag(args.strings['autofix'] as string, 'autofix');
-    output['autofix'] = await client.request('PATCH', agentPath(agent, '/autofix'), {
-      body: { enabled },
-    });
-  }
   if (wantsRecording) {
     const enabled = parseBooleanFlag(args.strings['recording'] as string, 'recording');
     output['recording'] = await client.request('PATCH', agentPath(agent, '/recording'), {
diff --git a/packages/cli/src/commands/requests.ts b/packages/cli/src/commands/requests.ts
index b0153dd8..6a3b3b8b 100644
--- a/packages/cli/src/commands/requests.ts
+++ b/packages/cli/src/commands/requests.ts
@@ -43,7 +43,6 @@ function trimRow(row: unknown): unknown {
   const out: Record<string, unknown> = {};
   for (const f of CORE_FIELDS) if (f in r) out[f] = r[f];
   for (const f of WHEN_SET_FIELDS) if (r[f] !== null && r[f] !== undefined) out[f] = r[f];
-  if (r['autofix_applied'] === true) out['autofix_applied'] = true;
   return out;
 }
 
diff --git a/packages/cli/src/commands/routing.ts b/packages/cli/src/commands/routing.ts
index 7d988c5a..65cfb7df 100644
--- a/packages/cli/src/commands/routing.ts
+++ b/packages/cli/src/commands/routing.ts
@@ -50,7 +50,7 @@ interface HeaderTierListRow {
 /**
  * The composite readback for everything `agent configure` writes: default
  * route + fallbacks, custom tiers with their triggers and routes, and the
- * autofix/recording toggles. (The backend's /status endpoint only reports the
+ * recording toggle. (The backend's /status endpoint only reports the
  * deprecated complexity-routing flag, so this composes the real config.)
  */
 export async function routingStatus(io: CliIo, argv: string[]): Promise<void> {
@@ -58,10 +58,9 @@ export async function routingStatus(io: CliIo, argv: string[]): Promise<void> {
   const agent = slugifyAgentName(requirePositional(args, 0, '<agent-name>'));
   const { client } = clientFromFlags(io, args);
 
-  const [tiers, customTiers, autofix, recording] = await Promise.all([
+  const [tiers, customTiers, recording] = await Promise.all([
     client.request('GET', agentPath(agent, '/tiers')),
     client.request('GET', agentPath(agent, '/header-tiers')),
-    client.request('GET', agentPath(agent, '/autofix')),
     client.request('GET', agentPath(agent, '/recording')),
   ]);
 
@@ -86,7 +85,6 @@ export async function routingStatus(io: CliIo, argv: string[]): Promise<void> {
       fallbacks: defaultTier?.fallback_routes ?? [],
     },
     custom_tiers: custom,
-    autofix: (autofix as { enabled?: boolean } | null)?.enabled ?? null,
     recording: (recording as { enabled?: boolean } | null)?.enabled ?? null,
   });
 }
@@ -469,7 +467,7 @@ export async function routingTest(io: CliIo, argv: string[]): Promise<number | v
   });
 }
 
-function toggleCommand(feature: 'autofix' | 'recording') {
+function toggleCommand(feature: 'recording') {
   return {
     get: async (io: CliIo, argv: string[]): Promise<void> => {
       const args = parseArgs(argv, { ...URL_ONLY, maxPositionals: 1 });
@@ -490,7 +488,6 @@ function toggleCommand(feature: 'autofix' | 'recording') {
   };
 }
 
-export const routingAutofix = toggleCommand('autofix');
 export const routingRecording = toggleCommand('recording');
 
 function tierParamsPath(agent: string, tier: string | undefined): string {
diff --git a/packages/cli/src/index.spec.ts b/packages/cli/src/index.spec.ts
index ed38b613..d4226359 100644
--- a/packages/cli/src/index.spec.ts
+++ b/packages/cli/src/index.spec.ts
@@ -111,9 +111,6 @@ describe('run', () => {
     expect(USAGE).toMatch(/provider custom remove[^\n]*--agent <name>/);
     expect(USAGE).toMatch(/agent key show <name> \[--raw\]/);
     // --enabled belongs to `set`, not `get`.
-    expect(USAGE).toContain(
-      'mnfst routing autofix get <agent> | mnfst routing autofix set <agent> --enabled true|false',
-    );
     expect(USAGE).toContain(
       'mnfst routing recording get <agent> | mnfst routing recording set <agent> --enabled true|false',
     );
diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts
index 9387ba27..035bf884 100644
--- a/packages/cli/src/index.ts
+++ b/packages/cli/src/index.ts
@@ -63,8 +63,6 @@ export const COMMANDS: Record<string, Handler> = {
   'routing custom list': routing.routingCustom.list,
   'routing custom create': routing.routingCustom.create,
   'routing custom delete': routing.routingCustom.delete,
-  'routing autofix get': routing.routingAutofix.get,
-  'routing autofix set': routing.routingAutofix.set,
   'routing recording get': routing.routingRecording.get,
   'routing recording set': routing.routingRecording.set,
   'routing params get': routing.routingParams.get,
@@ -99,7 +97,7 @@ Agents
   mnfst agent list [--include-playground]
   mnfst agent platforms
   mnfst agent create --name <name> --platform <p> [--category <${CATEGORY_CATALOG.join('|')}>] [--key-file <path>] [--if-absent]
-  mnfst agent configure <name> --models <primary,fb1,fb2> --provider <p> [--auth-type <a>] [--key-label <l>] [--tier <custom>] [--autofix true|false] [--recording true|false] [--force]
+  mnfst agent configure <name> --models <primary,fb1,fb2> --provider <p> [--auth-type <a>] [--key-label <l>] [--tier <custom>] [--recording true|false] [--force]
     (--models is the full chain: first = route, rest = fallbacks, one entry clears fallbacks;
      default route unless --tier names a custom tier, upserted on "x-manifest-tier: <name>";
      models are checked against the agent's discovered set — --force writes them anyway)
@@ -138,7 +136,6 @@ Routing readouts + custom-tier lifecycle (route writes go through mnfst agent co
   mnfst routing custom list <agent>
   mnfst routing custom create <agent> --name <n> --model <m> --provider <p> [--auth-type <a>] [--fallbacks <m1,m2>] [--header-key <k>] [--header-value <v>] [--force]
   mnfst routing custom delete <agent> <name> --yes
-  mnfst routing autofix get <agent> | mnfst routing autofix set <agent> --enabled true|false
   mnfst routing recording get <agent> | mnfst routing recording set <agent> --enabled true|false
   mnfst routing params get <agent> [--tier <t>] [--model <m>]
   mnfst routing params set <agent> [--tier <t>] [--model <m>] [--set <path>=<value> ...] [--unset <path> ...]
diff --git a/packages/cli/src/skill-content.gen.ts b/packages/cli/src/skill-content.gen.ts
index 54982214..5ac42b68 100644
--- a/packages/cli/src/skill-content.gen.ts
+++ b/packages/cli/src/skill-content.gen.ts
@@ -4,7 +4,7 @@
 
 /** The mnfst agent skill, embedded so the CLI can install it anywhere. */
 export const SKILL_MD: string =
-  '---\nname: mnfst-cli\ndescription: Use when creating or operating AI agents that make LLM calls — provisioning model routing and keys, wiring an app or automation to an LLM endpoint, testing routes, rotating leaked keys, or investigating LLM request failures and costs on a Manifest install.\n---\n\n# Operating Manifest from the CLI\n\n## Overview\n\n`mnfst` manages Manifest, the LLM gateway. Every call routed through a Manifest agent gets model routing with fallbacks, per-agent cost attribution, self-healing (Auto-fix), and a request log — for free. Default practice: never hand an app or automation a raw provider key; give it a Manifest agent.\n\nCommands emit JSON on stdout (human hints on stderr) — except `agent env`, which prints dotenv lines by design — exit 0/1, and never block on prompts when credentials come from flags or env. Full surface: `mnfst --help`.\n\n## The flow\n\n| Step | Command |\n|---|---|\n| Auth (human) | `mnfst login` — browser, one click, 30-day sliding token |\n| Auth (script/agent) | env `MANIFEST_URL` + `MANIFEST_API_KEY` — no login step |\n| Provision | `mnfst agent create --name X --platform <p> --if-absent` → response includes `setup` (the platform\'s config block) |\n| Check connections | `mnfst provider list [--agent X]` FIRST — the provider you need is often already connected. A connection is only usable if `cached_model_count` > 0; `is_active: true` with 0 models is hollow — run `mnfst provider refresh [<provider>]` (re-runs discovery tenant-wide, prints the new counts); still 0 means a bad credential, so reconnect, don\'t route on it |\n| Connect provider | `mnfst provider connect xai --auth-type api_key --credential-env KEY` · `provider catalog` lists all 30+ with auth types · subscription auth opens a browser (impossible headless — reuse an existing subscription connection instead) · own gateway: `provider custom add --name gw --endpoint <url>` |\n| Route | `mnfst agent configure X --models primary,fb1,fb2 --provider p [--auth-type a]` — first model is the route, the rest are fallbacks, and the whole chain rides the one `--provider` you name (cross-provider fallbacks are dashboard-only) · add `--tier deep` to upsert a custom tier callers select per-request with header `x-manifest-tier: deep` |\n| Verify | `mnfst routing test X` — one real request through the platform\'s actual API surface; broken routes fail loudly. It writes real rows to the request log — count them in later audits |\n| Wire the app | deployed → `mnfst agent env X >> .env` (one .env per service — the lines always name `MANIFEST_AGENT_KEY`, so appending two agents to one file silently keeps only the loader\'s winner; for several agents in one process use `mnfst run --agent X --env ROLE_KEY -- <cmd>`) |\n| Observe | `mnfst requests get --agent X [--status failed]` — paginated; pass `next_cursor` back for the next page |\n\nNamespace = scope: `provider *` acts tenant-wide, `agent *` acts on one agent, `routing *` holds readouts and custom-tier lifecycle.\n\n## Gotchas `--help` cannot tell you\n\n| Symptom | Reality |\n|---|---|\n| Proxy returns HTTP 200 but the "answer" starts with `[🦚 Manifest M###]` | An error wearing an assistant costume — check the content, not the status. `routing test` unmasks these automatically |\n| `cost: "0.000000"` on subscription-auth traffic | Flat-rate subscription: per-request cost is genuinely zero, not broken billing |\n| `agent configure`\'s echo differs from later reads | Mutation bodies echo raw API rows — the canonical readback is `routing status <agent>` |\n| "Which requests used a fallback or Auto-fix?" | Those fields are trimmed from default output — `requests get --full` |\n| 401s missing from the request log | Rejected-auth attempts are never recorded (no tenant to attribute them to); a leaked key\'s blast radius cannot be proven from the log |\n| `MANIFEST_AGENT_URL` | Already ends in `/v1` — append `/chat/completions` directly |\n| Model prices needed before any agent exists | `mnfst model prices [--provider <p>]` — install-wide, no agent needed (`models <agent>` is the per-agent routable set) |\n| Auditing escalation traffic by `routing_tier` | Custom-tier requests log `routing_tier: "standard"` — the tier identity lives in `header_tier_name` |\n| Route resolves but requests fail on one connection | A connection can be `is_active: false` while a sibling auth-type works — pass `--auth-type` explicitly when a provider has several connections |\n| Every command answers `Invalid API key — Run mnfst login` under env auth | Not always an auth problem: a wrong `MANIFEST_URL` (dead or different install) answers exactly like a bad key. Run `mnfst doctor` — it checks config, host, credential, connections and agents in that order, so it separates "host is dead" from "key is wrong for this host" — and never tells you to re-login on an env key |\n| Need a different reasoning effort, temperature, or other model param without editing the app | `mnfst routing params get X [--tier t] [--model m]` lists what the routed model accepts and what is saved; `mnfst routing params set X [--tier t] [--model m] --set reasoning.effort=high [--unset temperature]` saves it. Saved params **override** what the app sends, per tier and per model (a fallback keeps its own), but only on requests Manifest routes: `model: "auto"` or a matching custom-tier header. A request naming a concrete model skips them |\n| `agent configure` / `routing custom create` reject a model as undiscovered | Both validate against the agent\'s *discovered* models, and a connection with `cached_model_count: 0` contributes none: run `mnfst provider refresh` (stale or empty catalog), or pass `--force` — the backend still routes uncatalogued models through provider-qualified passthrough |\n\n## Common mistakes\n\n- Handing an app a raw provider key — it loses fallbacks, cost attribution, healing, and the log. Create an agent and use `agent env`.\n- Verifying a route with hand-rolled `curl` — fake-200s read as success. Use `routing test`.\n- Slurping the whole request log — pagination is one page per call by design; loop on `next_cursor`.\n\nAlso on the surface when needed: `mnfst doctor` (first stop when anything is wrong), `agent setup <name> [--reveal]` (setup block anytime; key masked unless revealed), `agent key path|show`, `agent provider enable|disable <agent> <provider>`, `agent rotate-key` (revocation is instant), `mnfst models <agent> --cost --capabilities`.\n';
+  '---\nname: mnfst-cli\ndescription: Use when creating or operating AI agents that make LLM calls — provisioning model routing and keys, wiring an app or automation to an LLM endpoint, testing routes, rotating leaked keys, or investigating LLM request failures and costs on a Manifest install.\n---\n\n# Operating Manifest from the CLI\n\n## Overview\n\n`mnfst` manages Manifest, the LLM gateway. Every call routed through a Manifest agent gets model routing with fallbacks, per-agent cost attribution, and a request log — for free. Default practice: never hand an app or automation a raw provider key; give it a Manifest agent.\n\nCommands emit JSON on stdout (human hints on stderr) — except `agent env`, which prints dotenv lines by design — exit 0/1, and never block on prompts when credentials come from flags or env. Full surface: `mnfst --help`.\n\n## The flow\n\n| Step | Command |\n|---|---|\n| Auth (human) | `mnfst login` — browser, one click, 30-day sliding token |\n| Auth (script/agent) | env `MANIFEST_URL` + `MANIFEST_API_KEY` — no login step |\n| Provision | `mnfst agent create --name X --platform <p> --if-absent` → response includes `setup` (the platform\'s config block) |\n| Check connections | `mnfst provider list [--agent X]` FIRST — the provider you need is often already connected. A connection is only usable if `cached_model_count` > 0; `is_active: true` with 0 models is hollow — run `mnfst provider refresh [<provider>]` (re-runs discovery tenant-wide, prints the new counts); still 0 means a bad credential, so reconnect, don\'t route on it |\n| Connect provider | `mnfst provider connect xai --auth-type api_key --credential-env KEY` · `provider catalog` lists all 30+ with auth types · subscription auth opens a browser (impossible headless — reuse an existing subscription connection instead) · own gateway: `provider custom add --name gw --endpoint <url>` |\n| Route | `mnfst agent configure X --models primary,fb1,fb2 --provider p [--auth-type a]` — first model is the route, the rest are fallbacks, and the whole chain rides the one `--provider` you name (cross-provider fallbacks are dashboard-only) · add `--tier deep` to upsert a custom tier callers select per-request with header `x-manifest-tier: deep` |\n| Verify | `mnfst routing test X` — one real request through the platform\'s actual API surface; broken routes fail loudly. It writes real rows to the request log — count them in later audits |\n| Wire the app | deployed → `mnfst agent env X >> .env` (one .env per service — the lines always name `MANIFEST_AGENT_KEY`, so appending two agents to one file silently keeps only the loader\'s winner; for several agents in one process use `mnfst run --agent X --env ROLE_KEY -- <cmd>`) |\n| Observe | `mnfst requests get --agent X [--status failed]` — paginated; pass `next_cursor` back for the next page |\n\nNamespace = scope: `provider *` acts tenant-wide, `agent *` acts on one agent, `routing *` holds readouts and custom-tier lifecycle.\n\n## Gotchas `--help` cannot tell you\n\n| Symptom | Reality |\n|---|---|\n| Proxy returns HTTP 200 but the "answer" starts with `[🦚 Manifest M###]` | An error wearing an assistant costume — check the content, not the status. `routing test` unmasks these automatically |\n| `cost: "0.000000"` on subscription-auth traffic | Flat-rate subscription: per-request cost is genuinely zero, not broken billing |\n| `agent configure`\'s echo differs from later reads | Mutation bodies echo raw API rows — the canonical readback is `routing status <agent>` |\n| "Which requests used a fallback?" | Those fields are trimmed from default output — `requests get --full` |\n| 401s missing from the request log | Rejected-auth attempts are never recorded (no tenant to attribute them to); a leaked key\'s blast radius cannot be proven from the log |\n| `MANIFEST_AGENT_URL` | Already ends in `/v1` — append `/chat/completions` directly |\n| Model prices needed before any agent exists | `mnfst model prices [--provider <p>]` — install-wide, no agent needed (`models <agent>` is the per-agent routable set) |\n| Auditing escalation traffic by `routing_tier` | Custom-tier requests log `routing_tier: "standard"` — the tier identity lives in `header_tier_name` |\n| Route resolves but requests fail on one connection | A connection can be `is_active: false` while a sibling auth-type works — pass `--auth-type` explicitly when a provider has several connections |\n| Every command answers `Invalid API key — Run mnfst login` under env auth | Not always an auth problem: a wrong `MANIFEST_URL` (dead or different install) answers exactly like a bad key. Run `mnfst doctor` — it checks config, host, credential, connections and agents in that order, so it separates "host is dead" from "key is wrong for this host" — and never tells you to re-login on an env key |\n| Need a different reasoning effort, temperature, or other model param without editing the app | `mnfst routing params get X [--tier t] [--model m]` lists what the routed model accepts and what is saved; `mnfst routing params set X [--tier t] [--model m] --set reasoning.effort=high [--unset temperature]` saves it. Saved params **override** what the app sends, per tier and per model (a fallback keeps its own), but only on requests Manifest routes: `model: "auto"` or a matching custom-tier header. A request naming a concrete model skips them |\n| `agent configure` / `routing custom create` reject a model as undiscovered | Both validate against the agent\'s *discovered* models, and a connection with `cached_model_count: 0` contributes none: run `mnfst provider refresh` (stale or empty catalog), or pass `--force` — the backend still routes uncatalogued models through provider-qualified passthrough |\n\n## Common mistakes\n\n- Handing an app a raw provider key — it loses fallbacks, cost attribution, and the log. Create an agent and use `agent env`.\n- Verifying a route with hand-rolled `curl` — fake-200s read as success. Use `routing test`.\n- Slurping the whole request log — pagination is one page per call by design; loop on `next_cursor`.\n\nAlso on the surface when needed: `mnfst doctor` (first stop when anything is wrong), `agent setup <name> [--reveal]` (setup block anytime; key masked unless revealed), `agent key path|show`, `agent provider enable|disable <agent> <provider>`, `agent rotate-key` (revocation is instant), `mnfst models <agent> --cost --capabilities`.\n';
 
 /** The CLI version this copy of the skill shipped with. */
 export const SKILL_VERSION = '6.24.0';
diff --git a/packages/frontend/src/services/api/agents.ts b/packages/frontend/src/services/api/agents.ts
index 26762052..b70e84c3 100644
--- a/packages/frontend/src/services/api/agents.ts
+++ b/packages/frontend/src/services/api/agents.ts
@@ -1,4 +1,4 @@
-import { fetchJson, fetchMutate, routingPath } from './core.js';
+import { fetchJson, fetchMutate } from './core.js';
 
 export function getAgents(includePlayground = false) {
   // includePlayground surfaces the reserved Playground (is_playground) agent — the
@@ -86,46 +86,14 @@ export interface DuplicateAgentResult {
   copied: DuplicateAgentPreview['copied'];
 }
 
-// ---------------------------------------------------------------------------
-// Temporary legacy Autofix opt-out, removed by #16.
-//
-// The dashboard has no Autofix UI, but until #16 deletes Autofix from the
-// backend, a harness stored without an explicit `autofix_enabled` inherits the
-// backend default. That default is ON whenever the backend does not detect a
-// container (bare-metal `npm start`, dev runs), which would send failing
-// requests to Manifest's hosted healer. Every harness the dashboard creates
-// therefore opts out explicitly, here in the client so no caller can forget.
-// ---------------------------------------------------------------------------
-const LEGACY_AUTOFIX_OPT_OUT = { autofix_enabled: false } as const;
-
-/** Turn the legacy per-harness Autofix flag off (the duplicate endpoint has no field for it). */
-function optOutOfLegacyAutofix(agentName: string) {
-  return fetchMutate(routingPath(agentName, 'autofix'), {
-    method: 'PATCH',
+export function duplicateAgent(sourceName: string, name: string) {
+  return fetchMutate<DuplicateAgentResult>(`/agents/${encodeURIComponent(sourceName)}/duplicate`, {
+    method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ enabled: false }),
+    body: JSON.stringify({ name }),
   });
 }
 
-export async function duplicateAgent(sourceName: string, name: string) {
-  const result = await fetchMutate<DuplicateAgentResult>(
-    `/agents/${encodeURIComponent(sourceName)}/duplicate`,
-    {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name }),
-    },
-  );
-  if (result?.agent?.name) {
-    try {
-      await optOutOfLegacyAutofix(result.agent.name);
-    } catch {
-      // The copy exists either way; fetchMutate already surfaced the error.
-    }
-  }
-  return result;
-}
-
 export function createAgent(params: CreateAgentParams) {
   return fetchMutate<{
     agent: {
@@ -139,6 +107,6 @@ export function createAgent(params: CreateAgentParams) {
   }>('/agents', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ ...params, ...LEGACY_AUTOFIX_OPT_OUT }),
+    body: JSON.stringify(params),
   });
 }
diff --git a/packages/frontend/src/services/api/analytics.ts b/packages/frontend/src/services/api/analytics.ts
index 05408385..65dd6b32 100644
--- a/packages/frontend/src/services/api/analytics.ts
+++ b/packages/frontend/src/services/api/analytics.ts
@@ -273,18 +273,15 @@ export interface AttemptTimeseries {
 // ---------------------------------------------------------------------------
 
 /**
- * Request-reliability endpoints. The backend still serves these generic
- * metrics (success rate, fallback recoveries, per-harness/provider/model
- * reliability, request status over time) under the legacy Autofix paths
- * inherited from upstream. #16 moves them to neutral paths when it removes
- * Autofix from the backend; keeping them here makes that a one-place change.
+ * Request-reliability endpoints: success rate, fallback recoveries,
+ * per-harness/provider/model reliability and request status over time.
  */
 const RELIABILITY_PATHS = {
-  stats: '/overview/autofix-stats',
-  requestStatusTimeseries: '/overview/autofix-timeseries',
-  perAgent: '/overview/autofix-per-agent',
-  perProvider: '/overview/autofix-per-provider',
-  perModel: '/overview/autofix-per-model',
+  stats: '/overview/reliability/stats',
+  requestStatusTimeseries: '/overview/reliability/timeseries',
+  perAgent: '/overview/reliability/per-agent',
+  perProvider: '/overview/reliability/per-provider',
+  perModel: '/overview/reliability/per-model',
 } as const;
 
 export interface ReliabilityStats {
@@ -325,54 +322,19 @@ export function getReliabilityStats(range = '7d', agentName?: string): Promise<R
   }) as Promise<ReliabilityStats>;
 }
 
-/**
- * Legacy request-status key for requests recovered by the removed Autofix. A
- * backend that predates #16 can still return it for old rows (or for a harness
- * that inherited the backend's Autofix default before the dashboard opted every
- * create out). The backend's success rate already counts those requests as
- * successes, so they are folded into `success`: the stacked bars keep summing
- * to the Requests total, Success + Recovered + Error matches the Success rate
- * card, and Recovered stays the fallback-only number the KPI shows.
- */
-const LEGACY_RECOVERED_KEY = 'healed';
-
-/** Fold the legacy key into `success` (see LEGACY_RECOVERED_KEY). Pure. */
-export function foldLegacyRecoveredKey(ts: StatusTimeseries): StatusTimeseries {
-  const legacyIdx = ts.keys.indexOf(LEGACY_RECOVERED_KEY);
-  if (legacyIdx === -1) return ts;
-  const keys = ts.keys.filter((_, i) => i !== legacyIdx);
-  const hasSuccess = keys.includes('success');
-  const outKeys = hasSuccess ? keys : ['success', ...keys];
-  const successOut = outKeys.indexOf('success');
-  const successIn = ts.keys.indexOf('success');
-  return {
-    ...ts,
-    keys: outKeys,
-    buckets: ts.buckets.map((b) => {
-      const counts = outKeys.map((k) =>
-        k === 'success' ? 0 : (b.counts[ts.keys.indexOf(k)] ?? 0),
-      );
-      counts[successOut] =
-        (successIn === -1 ? 0 : (b.counts[successIn] ?? 0)) + (b.counts[legacyIdx] ?? 0);
-      return { bucket: b.bucket, counts };
-    }),
-  };
-}
-
 /**
  * Logical requests over time by final status (`success`, `fallback`,
  * `error`): the "By request status" chart and its recovered subset.
  */
-export async function getRequestStatusTimeseries(
+export function getRequestStatusTimeseries(
   range = '7d',
   agentName?: string,
 ): Promise<StatusTimeseries> {
-  const ts = (await fetchJson(RELIABILITY_PATHS.requestStatusTimeseries, {
+  return fetchJson(RELIABILITY_PATHS.requestStatusTimeseries, {
     range,
     by: 'disposition',
     ...(agentName ? { agent_name: agentName } : {}),
-  })) as StatusTimeseries;
-  return ts && Array.isArray(ts.keys) ? foldLegacyRecoveredKey(ts) : ts;
+  }) as Promise<StatusTimeseries>;
 }
 
 /**
diff --git a/packages/frontend/tests/components/AddAgentModal.test.tsx b/packages/frontend/tests/components/AddAgentModal.test.tsx
index 806af278..811ee352 100644
--- a/packages/frontend/tests/components/AddAgentModal.test.tsx
+++ b/packages/frontend/tests/components/AddAgentModal.test.tsx
@@ -95,8 +95,7 @@ describe('AddAgentModal', () => {
     fireEvent.input(input, { target: { value: 'first-agent' } });
     fireEvent.click(createBtn);
     await vi.waitFor(() => expect(mockCreateAgent).toHaveBeenCalled());
-    // The modal sends no Autofix choice of its own; the API client adds the
-    // legacy opt-out to every create (tests/services/api/agents.test.ts).
+    // The modal sends no Autofix choice: the backend no longer has one.
     expect(mockCreateAgent.mock.calls[0]![0]).not.toHaveProperty('autofix_enabled');
   });
 
diff --git a/packages/frontend/tests/services/api/agents.test.ts b/packages/frontend/tests/services/api/agents.test.ts
index 7363e4c0..02e8f12c 100644
--- a/packages/frontend/tests/services/api/agents.test.ts
+++ b/packages/frontend/tests/services/api/agents.test.ts
@@ -132,7 +132,7 @@ describe('agents API client', () => {
     expect(url).toContain('/api/v1/agents/demo/duplicate-preview');
   });
 
-  it('duplicateAgent POSTs the new name, then opts the copy out of legacy Autofix', async () => {
+  it('duplicateAgent POSTs the new name in a single request', async () => {
     const fetchMock = setupFetch({
       agent: { id: '1', name: 'demo-copy', display_name: 'Demo Copy' },
       apiKey: 'mnfst_new',
@@ -150,38 +150,7 @@ describe('agents API client', () => {
     expect(url).toContain('/api/v1/agents/demo/duplicate');
     expect((init as RequestInit).method).toBe('POST');
     expect(JSON.parse((init as RequestInit).body as string)).toEqual({ name: 'demo-copy' });
-    // Until #16: the duplicate endpoint takes no Autofix field, so the copy is
-    // switched off right after it is created.
-    const [optOutUrl, optOutInit] = fetchMock.mock.calls[1];
-    expect(optOutUrl).toContain('/api/v1/routing/demo-copy/autofix');
-    expect((optOutInit as RequestInit).method).toBe('PATCH');
-    expect(JSON.parse((optOutInit as RequestInit).body as string)).toEqual({ enabled: false });
-  });
-
-  it('duplicateAgent still returns the copy when the Autofix opt-out fails', async () => {
-    const created = {
-      agent: { id: '1', name: 'demo-copy', display_name: 'Demo Copy' },
-      apiKey: 'mnfst_new',
-      copied: { providers: 0, tierAssignments: 0, specificityAssignments: 0, modelParams: 0 },
-    };
-    const fetchMock = vi
-      .fn()
-      .mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        json: async () => created,
-        text: async () => JSON.stringify(created),
-      })
-      .mockResolvedValueOnce({
-        ok: false,
-        status: 500,
-        json: async () => ({ message: 'boom' }),
-        text: async () => JSON.stringify({ message: 'boom' }),
-      });
-    vi.stubGlobal('fetch', fetchMock);
-    const out = await agents.duplicateAgent('demo', 'demo-copy');
-    expect(out.agent.name).toBe('demo-copy');
-    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
   });
 
   it('createAgent POSTs the create payload', async () => {
@@ -204,19 +173,18 @@ describe('agents API client', () => {
     const [url, init] = fetchMock.mock.calls[0];
     expect(url).toContain('/api/v1/agents');
     expect((init as RequestInit).method).toBe('POST');
-    // Until #16: every create opts out of the legacy backend Autofix default.
     expect(JSON.parse((init as RequestInit).body as string)).toEqual({
       name: 'new-agent',
       agent_category: 'coding',
       agent_platform: 'openclaw',
-      autofix_enabled: false,
     });
   });
 
-  it('createAgent always sends autofix_enabled: false, even for a bare name', async () => {
+  it('createAgent sends exactly the given fields for a bare name', async () => {
     const fetchMock = setupFetch({ agent: { name: 'my-agent' }, apiKey: 'k' });
     await agents.createAgent({ name: 'my-agent' });
     const body = JSON.parse((fetchMock.mock.calls[0][1] as RequestInit).body as string);
-    expect(body).toEqual({ name: 'my-agent', autofix_enabled: false });
+    expect(body).toEqual({ name: 'my-agent' });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
   });
 });
diff --git a/packages/frontend/tests/services/api/analytics.test.ts b/packages/frontend/tests/services/api/analytics.test.ts
index 2a4531af..50e82864 100644
--- a/packages/frontend/tests/services/api/analytics.test.ts
+++ b/packages/frontend/tests/services/api/analytics.test.ts
@@ -92,28 +92,28 @@ describe('analytics API client', () => {
   it('calls the request-reliability routes with their optional scopes', async () => {
     let fetchMock = setupFetch({});
     await analytics.getReliabilityStats('30d', 'demo');
-    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/autofix-stats');
+    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/reliability/stats');
     expect(fetchMock.mock.calls[0][0]).toContain('range=30d');
     expect(fetchMock.mock.calls[0][0]).toContain('agent_name=demo');
 
     fetchMock = setupFetch({});
     await analytics.getRequestStatusTimeseries('24h', 'demo');
-    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/autofix-timeseries');
+    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/reliability/timeseries');
     expect(fetchMock.mock.calls[0][0]).toContain('by=disposition');
     expect(fetchMock.mock.calls[0][0]).toContain('agent_name=demo');
 
     fetchMock = setupFetch({});
     await analytics.getPerProviderReliability('7d', 'demo');
-    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/autofix-per-provider');
+    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/reliability/per-provider');
     expect(fetchMock.mock.calls[0][0]).toContain('agent_name=demo');
 
     fetchMock = setupFetch({});
     await analytics.getPerAgentReliability('90d');
-    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/autofix-per-agent');
+    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/reliability/per-agent');
 
     fetchMock = setupFetch({});
     await analytics.getPerModelReliability('7d', 'demo');
-    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/autofix-per-model');
+    expect(fetchMock.mock.calls[0][0]).toContain('/api/v1/overview/reliability/per-model');
 
     fetchMock = setupFetch({});
     await analytics.getErrorBreakdown('30d', 'demo');
@@ -137,44 +137,32 @@ describe('analytics API client', () => {
     }
   });
 
-  it('folds a legacy healed request-status series into success', async () => {
-    setupFetch({
+  it('returns the request-status series as the backend sends it', async () => {
+    const series = {
       range: '7d',
       by: 'disposition',
-      keys: ['success', 'healed', 'fallback', 'error'],
-      buckets: [
-        { bucket: '2026-06-04', counts: [5, 2, 3, 1] },
-        { bucket: '2026-06-05', counts: [1, 0, 0, 4] },
-      ],
-    });
-    const ts = await analytics.getRequestStatusTimeseries('7d');
-    expect(ts.keys).toEqual(['success', 'fallback', 'error']);
-    // Bars still sum to the request total: 11 and 5.
-    expect(ts.buckets).toEqual([
-      { bucket: '2026-06-04', counts: [7, 3, 1] },
-      { bucket: '2026-06-05', counts: [1, 0, 4] },
-    ]);
-  });
-
-  it('creates the success series when only the legacy key carries successes', () => {
-    const ts = analytics.foldLegacyRecoveredKey({
-      range: '24h',
-      by: 'disposition',
-      keys: ['healed', 'error'],
-      buckets: [{ bucket: 'b', counts: [2, 1] }],
-    });
-    expect(ts.keys).toEqual(['success', 'error']);
-    expect(ts.buckets[0]!.counts).toEqual([2, 1]);
+      keys: ['success', 'fallback', 'error'],
+      buckets: [{ bucket: '2026-06-04', counts: [7, 3, 1] }],
+    };
+    setupFetch(series);
+    await expect(analytics.getRequestStatusTimeseries('7d')).resolves.toEqual(series);
   });
 
-  it('leaves a timeseries without the legacy key untouched', () => {
-    const input = {
-      range: '24h',
-      by: 'disposition',
-      keys: ['success', 'fallback'],
-      buckets: [{ bucket: 'b', counts: [2, 1] }],
-    };
-    expect(analytics.foldLegacyRecoveredKey(input)).toBe(input);
+  it('never calls the legacy Autofix paths', async () => {
+    const calls = [
+      () => analytics.getReliabilityStats(),
+      () => analytics.getRequestStatusTimeseries(),
+      () => analytics.getPerProviderReliability(),
+      () => analytics.getPerAgentReliability(),
+      () => analytics.getPerModelReliability(),
+    ];
+    for (const call of calls) {
+      const fetchMock = setupFetch({});
+      await call();
+      const url = fetchMock.mock.calls[0][0] as string;
+      expect(url).toContain('/api/v1/overview/reliability/');
+      expect(url).not.toContain('autofix');
+    }
   });
 
   it('counts recovered requests from fallback saves only', () => {
@@ -191,6 +179,7 @@ describe('analytics API client', () => {
     expect(exported).not.toContain('getWorkspaceAutofixStatus');
     expect(exported).not.toContain('getAutofixStats');
     expect(exported).not.toContain('getAutofixTimeseries');
+    expect(exported).not.toContain('foldLegacyRecoveredKey');
   });
 
   it('getHealth GETs /health', async () => {
diff --git a/packages/shared/__tests__/autofix-status.spec.ts b/packages/shared/__tests__/autofix-status.spec.ts
deleted file mode 100644
index 746f7fc5..00000000
--- a/packages/shared/__tests__/autofix-status.spec.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-import {
-  AUTOFIX_STATUSES,
-  AUTOFIX_STATUS_LABELS,
-  deriveAutofixStatus,
-} from '../src/autofix-status';
-
-describe('deriveAutofixStatus', () => {
-  it('uses null for requests with no recorded Autofix flow', () => {
-    expect(deriveAutofixStatus(undefined)).toBeNull();
-    expect(deriveAutofixStatus(null)).toBeNull();
-  });
-
-  it.each([
-    [200, 'retry_succeeded'],
-    [299, 'retry_succeeded'],
-    [400, 'retry_failed'],
-  ] as const)('derives retry status from HTTP %i', (http_status, expected) => {
-    expect(deriveAutofixStatus({ chain: [{ origin: 'autofix', http_status }] })).toBe(expected);
-  });
-
-  it.each([
-    ['resolving', 'resolving'],
-    ['no_patch', 'no_patch'],
-  ] as const)('preserves the Phoenix %s decision', (phoenix_status, expected) => {
-    expect(
-      deriveAutofixStatus({
-        chain: [{ origin: 'original', http_status: 400, phoenix_status }],
-      }),
-    ).toBe(expected);
-  });
-
-  it('records a retry failure when the patched resend throws', () => {
-    expect(
-      deriveAutofixStatus({
-        chain: [
-          {
-            origin: 'original',
-            http_status: 400,
-            phoenix_status: 'patched',
-            heal_attempt_id: 'heal-1',
-            patch_worked: false,
-          },
-        ],
-      }),
-    ).toBe('retry_failed');
-  });
-
-  it('uses service_error for an attempted flow without a usable result', () => {
-    expect(deriveAutofixStatus({ chain: [] })).toBe('service_error');
-    expect(deriveAutofixStatus({ chain: [{ origin: 'original', http_status: 400 }] })).toBe(
-      'service_error',
-    );
-    expect(
-      deriveAutofixStatus({
-        chain: [{ origin: 'original', http_status: 400, phoenix_status: 'patched' }],
-      }),
-    ).toBe('service_error');
-  });
-
-  it('defines a frontend label for every stored status', () => {
-    expect(Object.keys(AUTOFIX_STATUS_LABELS)).toEqual([...AUTOFIX_STATUSES]);
-    expect(Object.values(AUTOFIX_STATUS_LABELS)).toEqual([
-      'No patch',
-      'Resolving',
-      'Retry succeeded',
-      'Retry failed',
-      'Service error',
-    ]);
-  });
-});
diff --git a/packages/shared/__tests__/error-taxonomy.spec.ts b/packages/shared/__tests__/error-taxonomy.spec.ts
index f8e0bd6e..88ee7981 100644
--- a/packages/shared/__tests__/error-taxonomy.spec.ts
+++ b/packages/shared/__tests__/error-taxonomy.spec.ts
@@ -191,16 +191,6 @@ describe('classifyMessageError', () => {
     });
   });
 
-  it('marks an auto_fixed row (healed original) as superseded while classifying its cause', () => {
-    // The failed original of a healed request was recovered by the retry, so it
-    // must not count as a live fault — same as fallback_error.
-    expect(classifyMessageError({ status: 'auto_fixed', errorHttpStatus: 400 })).toEqual({
-      error_origin: 'provider',
-      error_class: 'invalid_request',
-      superseded: true,
-    });
-  });
-
   it('marks a fallback_error row with no HTTP status as superseded transport/network', () => {
     expect(classifyMessageError({ status: 'fallback_error', errorHttpStatus: null })).toEqual({
       error_origin: 'transport',
@@ -355,7 +345,7 @@ describe('canonical status vocabulary', () => {
       expect(normalizeStatus(undefined)).toBe('success');
     });
 
-    it.each(['error', 'rate_limited', 'fallback_error', 'auto_fixed', 'failed', 'anything-else'])(
+    it.each(['error', 'rate_limited', 'fallback_error', 'failed', 'anything-else'])(
       'collapses %s onto failed',
       (value) => {
         expect(normalizeStatus(value)).toBe('failed');
diff --git a/packages/shared/src/autofix-status.ts b/packages/shared/src/autofix-status.ts
deleted file mode 100644
index abdb4ab3..00000000
--- a/packages/shared/src/autofix-status.ts
+++ /dev/null
@@ -1,54 +0,0 @@
-export const AUTOFIX_STATUSES = [
-  'no_patch',
-  'resolving',
-  'retry_succeeded',
-  'retry_failed',
-  'service_error',
-] as const;
-
-export type AutofixStatus = (typeof AUTOFIX_STATUSES)[number];
-
-export const AUTOFIX_STATUS_LABELS: Record<AutofixStatus, string> = {
-  no_patch: 'No patch',
-  resolving: 'Resolving',
-  retry_succeeded: 'Retry succeeded',
-  retry_failed: 'Retry failed',
-  service_error: 'Service error',
-};
-
-export interface AutofixStatusChainEntry {
-  origin: 'original' | 'autofix';
-  http_status: number;
-  phoenix_status?: string;
-  heal_attempt_id?: string | null;
-  patch_worked?: boolean;
-}
-
-export interface AutofixStatusRecord {
-  chain: AutofixStatusChainEntry[];
-}
-
-/** Derive the request-level Autofix outcome from its recorded execution. */
-export function deriveAutofixStatus(
-  record: AutofixStatusRecord | null | undefined,
-): AutofixStatus | null {
-  if (!record) return null;
-
-  const retry = record.chain.find((entry) => entry.origin === 'autofix');
-  if (retry) {
-    return retry.http_status >= 200 && retry.http_status < 300 ? 'retry_succeeded' : 'retry_failed';
-  }
-
-  const decision = record.chain.find(
-    (entry) => entry.phoenix_status != null || entry.heal_attempt_id != null,
-  );
-  // A patch was handed out but the resend threw before producing a response.
-  if (decision?.heal_attempt_id != null && decision.patch_worked === false) {
-    return 'retry_failed';
-  }
-  if (decision?.phoenix_status === 'resolving') return 'resolving';
-  if (decision?.phoenix_status === 'no_patch') return 'no_patch';
-
-  // The flow was entered, but Phoenix failed or returned an unusable contract.
-  return 'service_error';
-}
diff --git a/packages/shared/src/error-taxonomy.ts b/packages/shared/src/error-taxonomy.ts
index 6f467ed3..e662103b 100644
--- a/packages/shared/src/error-taxonomy.ts
+++ b/packages/shared/src/error-taxonomy.ts
@@ -37,24 +37,22 @@ export const OK_STATUS = 'ok';
 export const RATE_LIMITED_STATUS = 'rate_limited';
 /** A row that failed but was recovered by a later attempt (retry / fallback). */
 export const SUPERSEDED_STATUS = 'fallback_error';
-/** The failed original of a healed Autofix flow — recovered by the retry row. */
-export const AUTOFIX_ORIGINAL_STATUS = 'auto_fixed';
 /** Every status whose row is a recovered (superseded) attempt, not a terminal failure. */
-export const SUPERSEDED_STATUSES: readonly string[] = [SUPERSEDED_STATUS, AUTOFIX_ORIGINAL_STATUS];
+export const SUPERSEDED_STATUSES: readonly string[] = [SUPERSEDED_STATUS];
 
 /**
  * Canonical outcome vocabulary for `requests.status` and `agent_messages.status`.
  *
  * The legacy `status` column conflated the outcome with the *reason* it failed
- * (`rate_limited`, `fallback_error`, `auto_fixed`). Those reasons now live on the
- * orthogonal axes — `error_class` (rate limit), `superseded` (recovered attempt),
- * and the `autofix_*` columns — so `status` carries only the terminal outcome:
+ * (`rate_limited`, `fallback_error`). Those reasons now live on the orthogonal
+ * axes — `error_class` (rate limit) and `superseded` (recovered attempt) — so
+ * `status` carries only the terminal outcome:
  *
  *  - `pending` — accepted, no terminal outcome yet.
  *  - `cancelled` — the caller disconnected before a terminal provider outcome.
  *  - `success` — completed successfully (legacy `ok`).
  *  - `failed`  — completed without succeeding (legacy `error` / `rate_limited` /
- *    `fallback_error` / `auto_fixed`).
+ *    `fallback_error`).
  *
  * Rolling-deploy note: during a deploy, old replicas still write the legacy
  * values while new replicas write these. Every reader must therefore compare
@@ -86,7 +84,7 @@ export type AttemptStatus = (typeof ATTEMPT_STATUSES)[number];
 
 /**
  * Collapse any status value — legacy (`ok`/`error`/`rate_limited`/
- * `fallback_error`/`auto_fixed`) or canonical — onto the canonical vocabulary.
+ * `fallback_error`) or canonical — onto the canonical vocabulary.
  * A nullish value is treated as `success`, matching the legacy writer convention
  * where an absent status meant `ok`. Unknown non-null values fail closed.
  */
@@ -249,8 +247,7 @@ export function classifyMessageError(signals: MessageErrorSignals): MessageError
     return { error_origin: null, error_class: null, superseded: false };
   }
 
-  // `auto_fixed` (the failed original of a healed request) is a recovered attempt
-  // just like `fallback_error`, so it's superseded too — otherwise it would count
+  // A `fallback_error` row was recovered by a later attempt, so it must not count
   // as a live fault against the provider.
   const superseded = SUPERSEDED_STATUSES.includes(signals.status);
 
diff --git a/packages/shared/src/index.ts b/packages/shared/src/index.ts
index e2da002f..1b7b1a44 100644
--- a/packages/shared/src/index.ts
+++ b/packages/shared/src/index.ts
@@ -43,7 +43,6 @@ export {
   RATE_LIMITED_STATUS,
   SUPERSEDED_STATUS,
   SUPERSEDED_STATUSES,
-  AUTOFIX_ORIGINAL_STATUS,
   PENDING_STATUS,
   CANCELLED_STATUS,
   SUCCESS_STATUS,
@@ -172,8 +171,6 @@ export type {
   PlaygroundHistoryRunSummary,
   PlaygroundHistoryRunDetail,
 } from './playground';
-export { AUTOFIX_STATUSES, AUTOFIX_STATUS_LABELS, deriveAutofixStatus } from './autofix-status';
-export type { AutofixStatus, AutofixStatusChainEntry, AutofixStatusRecord } from './autofix-status';
 export {
   coerceContentToText,
   extractRecordedConversationMessages,

From a07cccf9ddfe910aaafa96cf3c9881c4c2412cbb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 01:25:42 -0300
Subject: [PATCH 07/17] feat(backend)!: remove phone-home from the backend and
 the CLI

Thinker makes no outbound call of its own. Remove every upstream
phone-home from the backend and the CLI:

- usage telemetry (telemetry/, InstallIdService, PayloadBuilderService,
  the InstallMetadata entity) and the CLI usage spool
  (packages/cli/src/telemetry.ts);
- the daily update check (version/, GET /api/v1/version, the GitHub
  releases URL);
- the discovery forwarding to blue.manifest.build (discovery/,
  POST /api/v1/discovery/complete);
- Sentry (instrument.ts, sentry/, SentryModule/SentryGlobalFilter,
  the @sentry/nestjs dependency);
- the hosted Wingman origin in CORS and CSP frame-src; frame-src is
  'self' in every mode and WINGMAN_CORS_ORIGINS becomes
  THINKER_CORS_ORIGINS with the same meaning;
- the modelparams.dev fetch on boot and hourly cron; parameter specs
  come only from the bundled modelparams package snapshot.

DropInstallMetadata1803500000000 drops the install_metadata table
(lock_timeout, IF EXISTS, revert recreates it empty).

The removed variables leave docker-compose, the .env examples, the
Docker README, the deploy templates and the developer guide.

A new e2e guard fails if the backend, CLI or shared source names a
removed destination again, or if a production-mode boot of the real
server fetches or resolves anything outside the ADR 0003 catalogs.

BREAKING CHANGE: GET /api/v1/version and POST /api/v1/discovery/complete
are gone, the hosted Wingman origin is no longer allowed by CORS, and
WINGMAN_CORS_ORIGINS is renamed THINKER_CORS_ORIGINS.

Closes #17

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CONTRIBUTING.md                               |   2 +-
 deploy/apple-containers/start.sh              |   1 -
 deploy/easypanel/TUTORIAL.md                  |   2 -
 deploy/easypanel/template/index.ts            |   1 -
 deploy/easypanel/template/meta.yaml           |  14 +-
 deploy/fly/TUTORIAL.md                        |   1 -
 docker/.env.example                           |  26 +-
 docker/DOCKER_README.md                       |  21 +-
 docker/Dockerfile                             |   4 -
 docker/docker-compose.yml                     |  17 +-
 docs/dev/manifest-guide.md                    | 122 +---
 package-lock.json                             | 277 +-------
 packages/backend/.env.example                 |   7 +-
 packages/backend/package.json                 |   2 -
 packages/backend/src/app.module.ts            |  21 +-
 packages/backend/src/cors-csp-config.spec.ts  | 111 ++-
 packages/backend/src/cors-csp-config.ts       | 104 ++-
 .../src/database/data-source-definitions.ts   |   4 +-
 .../1803500000000-DropInstallMetadata.spec.ts |  39 ++
 .../1803500000000-DropInstallMetadata.ts      |  39 ++
 .../discovery/discovery-sync.service.spec.ts  |  94 ---
 .../src/discovery/discovery-sync.service.ts   |  37 -
 .../discovery/discovery.controller.spec.ts    |  13 -
 .../src/discovery/discovery.controller.ts     |  15 -
 .../backend/src/discovery/discovery.module.ts |   9 -
 .../dto/complete-discovery.dto.spec.ts        |  41 --
 .../discovery/dto/complete-discovery.dto.ts   |  33 -
 .../src/entities/install-metadata.entity.ts   |  26 -
 packages/backend/src/instrument.ts            |   9 -
 packages/backend/src/main.ts                  |  28 +-
 .../provider-param-spec.service.spec.ts       | 201 +++---
 .../provider-param-spec.service.ts            | 117 +---
 .../__tests__/debug-sentry.controller.spec.ts |   7 -
 .../sentry/__tests__/sentry-options.spec.ts   |  52 --
 .../src/sentry/debug-sentry.controller.ts     |  11 -
 packages/backend/src/sentry/sentry-options.ts |  29 -
 .../src/telemetry/dto/telemetry-payload.ts    | 101 ---
 .../src/telemetry/install-id.service.spec.ts  | 122 ----
 .../src/telemetry/install-id.service.ts       |  52 --
 .../telemetry/payload-builder.service.spec.ts | 642 ------------------
 .../src/telemetry/payload-builder.service.ts  | 433 ------------
 .../src/telemetry/telemetry.config.spec.ts    | 122 ----
 .../backend/src/telemetry/telemetry.config.ts |  50 --
 .../backend/src/telemetry/telemetry.module.ts |  19 -
 .../src/telemetry/telemetry.service.spec.ts   | 249 -------
 .../src/telemetry/telemetry.service.ts        |  79 ---
 .../src/version/version-check.config.spec.ts  | 182 -----
 .../src/version/version-check.config.ts       | 102 ---
 .../src/version/version-check.service.spec.ts | 275 --------
 .../src/version/version-check.service.ts      | 135 ----
 .../src/version/version.controller.spec.ts    |  34 -
 .../backend/src/version/version.controller.ts |  17 -
 .../backend/src/version/version.module.ts     |  13 -
 packages/backend/test/cors.e2e-spec.ts        | 195 +++---
 packages/backend/test/csp.e2e-spec.ts         |   9 +
 .../drop-autofix-schema-migration.e2e-spec.ts |   9 +
 ...rop-install-metadata-migration.e2e-spec.ts |  95 +++
 packages/backend/test/helpers.ts              |   2 -
 .../test/no-phonehome-egress.e2e-spec.ts      | 237 +++++++
 .../backend/test/support/egress-recorder.cjs  |  52 ++
 packages/cli/README.md                        |   6 +-
 packages/cli/src/commands/commands.spec.ts    |   6 +-
 packages/cli/src/index.spec.ts                |  27 +-
 packages/cli/src/index.ts                     |  12 -
 packages/cli/src/telemetry.spec.ts            | 400 -----------
 packages/cli/src/telemetry.ts                 | 357 ----------
 packages/cli/test/helpers.ts                  |   6 +-
 67 files changed, 831 insertions(+), 4746 deletions(-)
 create mode 100644 packages/backend/src/database/migrations/1803500000000-DropInstallMetadata.spec.ts
 create mode 100644 packages/backend/src/database/migrations/1803500000000-DropInstallMetadata.ts
 delete mode 100644 packages/backend/src/discovery/discovery-sync.service.spec.ts
 delete mode 100644 packages/backend/src/discovery/discovery-sync.service.ts
 delete mode 100644 packages/backend/src/discovery/discovery.controller.spec.ts
 delete mode 100644 packages/backend/src/discovery/discovery.controller.ts
 delete mode 100644 packages/backend/src/discovery/discovery.module.ts
 delete mode 100644 packages/backend/src/discovery/dto/complete-discovery.dto.spec.ts
 delete mode 100644 packages/backend/src/discovery/dto/complete-discovery.dto.ts
 delete mode 100644 packages/backend/src/entities/install-metadata.entity.ts
 delete mode 100644 packages/backend/src/instrument.ts
 delete mode 100644 packages/backend/src/sentry/__tests__/debug-sentry.controller.spec.ts
 delete mode 100644 packages/backend/src/sentry/__tests__/sentry-options.spec.ts
 delete mode 100644 packages/backend/src/sentry/debug-sentry.controller.ts
 delete mode 100644 packages/backend/src/sentry/sentry-options.ts
 delete mode 100644 packages/backend/src/telemetry/dto/telemetry-payload.ts
 delete mode 100644 packages/backend/src/telemetry/install-id.service.spec.ts
 delete mode 100644 packages/backend/src/telemetry/install-id.service.ts
 delete mode 100644 packages/backend/src/telemetry/payload-builder.service.spec.ts
 delete mode 100644 packages/backend/src/telemetry/payload-builder.service.ts
 delete mode 100644 packages/backend/src/telemetry/telemetry.config.spec.ts
 delete mode 100644 packages/backend/src/telemetry/telemetry.config.ts
 delete mode 100644 packages/backend/src/telemetry/telemetry.module.ts
 delete mode 100644 packages/backend/src/telemetry/telemetry.service.spec.ts
 delete mode 100644 packages/backend/src/telemetry/telemetry.service.ts
 delete mode 100644 packages/backend/src/version/version-check.config.spec.ts
 delete mode 100644 packages/backend/src/version/version-check.config.ts
 delete mode 100644 packages/backend/src/version/version-check.service.spec.ts
 delete mode 100644 packages/backend/src/version/version-check.service.ts
 delete mode 100644 packages/backend/src/version/version.controller.spec.ts
 delete mode 100644 packages/backend/src/version/version.controller.ts
 delete mode 100644 packages/backend/src/version/version.module.ts
 create mode 100644 packages/backend/test/drop-install-metadata-migration.e2e-spec.ts
 create mode 100644 packages/backend/test/no-phonehome-egress.e2e-spec.ts
 create mode 100644 packages/backend/test/support/egress-recorder.cjs
 delete mode 100644 packages/cli/src/telemetry.spec.ts
 delete mode 100644 packages/cli/src/telemetry.ts

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b4bb3c0b..e64d49b9 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -100,7 +100,7 @@ cd packages/backend && NODE_OPTIONS='-r dotenv/config' npx nest start --watch
 npm run dev
 ```
 
-The frontend runs on `http://localhost:3000` and proxies API requests to the backend on `http://localhost:3001`. The Wingman drawer in the bottom-right (FAB or `⌘/Ctrl+Shift+W`) embeds the hosted SPA at `https://wingman.manifest.build` — no local setup required. It only renders in dev mode and is stripped from production bundles.
+The frontend runs on `http://localhost:3000` and proxies API requests to the backend on `http://localhost:3001`.
 
 `npm run dev` is filtered to exactly `manifest-frontend` — adding a new workspace with a `dev` script will not silently join the dev set.
 
diff --git a/deploy/apple-containers/start.sh b/deploy/apple-containers/start.sh
index 1f44a379..bbe6e38a 100755
--- a/deploy/apple-containers/start.sh
+++ b/deploy/apple-containers/start.sh
@@ -316,7 +316,6 @@ cmd_up() {
     --env REQUEST_RECORDING_S3_ACCESS_KEY_ID="${REQUEST_RECORDING_S3_ACCESS_KEY_ID:-}" \
     --env REQUEST_RECORDING_S3_SECRET_ACCESS_KEY="${REQUEST_RECORDING_S3_SECRET_ACCESS_KEY:-}" \
     --env REQUEST_RECORDING_S3_FORCE_PATH_STYLE="${REQUEST_RECORDING_S3_FORCE_PATH_STYLE:-false}" \
-    --env MANIFEST_TELEMETRY_DISABLED="${MANIFEST_TELEMETRY_DISABLED:-0}" \
     manifestdotbuild/manifest:latest
 
   echo "waiting for manifest to become healthy..."
diff --git a/deploy/easypanel/TUTORIAL.md b/deploy/easypanel/TUTORIAL.md
index 50217df9..4a95c48d 100644
--- a/deploy/easypanel/TUTORIAL.md
+++ b/deploy/easypanel/TUTORIAL.md
@@ -61,7 +61,6 @@ DB_POOL_MAX=10
 AUTH_DB_POOL_MAX=5
 REQUEST_RECORDING_STORAGE=filesystem
 REQUEST_RECORDING_FILESYSTEM_PATH=/data/request-recordings
-MANIFEST_TELEMETRY_DISABLED=0
 ```
 
 Generate secrets locally:
@@ -107,7 +106,6 @@ Before publishing a template, smoke test the full first-run flow:
 - Back up the PostgreSQL service through Easypanel or your server provider.
 - Use a real HTTPS domain before enabling OAuth providers.
 - Keep `BETTER_AUTH_SECRET` and `MANIFEST_ENCRYPTION_KEY` as separate values.
-- Set `MANIFEST_TELEMETRY_DISABLED=1` to disable anonymous self-hosted telemetry.
 - If you deploy more than one Manifest replica, lower database pool sizes or upgrade PostgreSQL connection capacity.
 
 Relevant Easypanel docs:
diff --git a/deploy/easypanel/template/index.ts b/deploy/easypanel/template/index.ts
index 4c142cd8..e9dbab00 100644
--- a/deploy/easypanel/template/index.ts
+++ b/deploy/easypanel/template/index.ts
@@ -40,7 +40,6 @@ export function generate(input: Input): Output {
         "AUTH_DB_POOL_MAX=5",
         "REQUEST_RECORDING_STORAGE=filesystem",
         "REQUEST_RECORDING_FILESYSTEM_PATH=/data/request-recordings",
-        `MANIFEST_TELEMETRY_DISABLED=${input.telemetryDisabled || "0"}`,
       ].join("\n"),
       mounts: [
         {
diff --git a/deploy/easypanel/template/meta.yaml b/deploy/easypanel/template/meta.yaml
index 504e26b0..ec4f4e7c 100644
--- a/deploy/easypanel/template/meta.yaml
+++ b/deploy/easypanel/template/meta.yaml
@@ -7,8 +7,7 @@ description:
 instructions:
   Open the generated domain after deployment and create the first admin account.
   Fresh installs redirect to /setup. Use a real HTTPS domain before configuring
-  OAuth callback URLs or production authentication flows. Anonymous telemetry is
-  enabled by default and can be disabled from the template options.
+  OAuth callback URLs or production authentication flows.
 changeLog:
   - date: 2026-08-06
     description: Persist compressed request recordings in a dedicated app volume
@@ -45,17 +44,6 @@ schema:
       type: string
       title: Database Service Name
       default: manifest-db
-    telemetryDisabled:
-      type: string
-      title: Anonymous Telemetry
-      default: "0"
-      oneOf:
-        - enum:
-            - "0"
-          title: Enabled (default)
-        - enum:
-            - "1"
-          title: Disabled
 benefits:
   - title: One endpoint for AI agents
     description:
diff --git a/deploy/fly/TUTORIAL.md b/deploy/fly/TUTORIAL.md
index 80b9be69..f161b82e 100644
--- a/deploy/fly/TUTORIAL.md
+++ b/deploy/fly/TUTORIAL.md
@@ -123,7 +123,6 @@ fly logs --app <your-fly-app>
 - Tigris is shared across Machines, so recording storage remains consistent if you scale the Manifest app horizontally.
 - For production, choose a larger Postgres configuration or Fly Managed Postgres instead of the small script default.
 - Add a custom domain before configuring OAuth callback URLs.
-- Set `MANIFEST_TELEMETRY_DISABLED=1` as a Fly secret if you want to disable anonymous self-hosted telemetry.
 - Destroy the app, database, and recording bucket when testing is done. Export any recordings you need before destroying the bucket:
 
 ```bash
diff --git a/docker/.env.example b/docker/.env.example
index 5066a536..25d915dd 100644
--- a/docker/.env.example
+++ b/docker/.env.example
@@ -178,25 +178,9 @@ BETTER_AUTH_SECRET=
 # AGENT_USAGE_DAILY_RUN_BUDGET_MS=5000
 
 
-# ─── Error monitoring (optional) ───────────────────────────────────────────
+# ─── Browser access from other origins (optional) ──────────────────────────
 #
-# Sentry stays completely uninitialised unless SENTRY_DSN is set. Error
-# capture only — performance tracing, request bodies, headers, and user data
-# are all disabled in code.
-# SENTRY_DSN=
-# SENTRY_ENVIRONMENT=production
-# SENTRY_RELEASE=
-
-
-# ─── Anonymous usage telemetry (optional, opt-out) ─────────────────────────
-#
-# Manifest sends one small anonymous usage report per 24h so the maintainers
-# can see how the project is being used. Aggregates only — no prompts, no
-# message contents, no API keys, nothing that identifies a user. Full field
-# list + payload spec: https://manifest.build/llm-gateway/docs/self-hosted/#telemetry
-#
-# To disable, uncomment the line below.
-# MANIFEST_TELEMETRY_DISABLED=1
-
-# Or keep telemetry on and send it to your own collector instead.
-# TELEMETRY_ENDPOINT=https://telemetry.example.internal/v1/report
+# The dashboard is same-origin, so no other browser origin may call the
+# gateway by default. List extra origins here (comma-separated) to allow a
+# browser tool you run elsewhere.
+# THINKER_CORS_ORIGINS=https://tools.example.internal
diff --git a/docker/DOCKER_README.md b/docker/DOCKER_README.md
index 38ff7d31..075b1b7b 100644
--- a/docker/DOCKER_README.md
+++ b/docker/DOCKER_README.md
@@ -312,8 +312,6 @@ docker compose up -d
 
 Database migrations run automatically on boot, no manual steps. Your data in the `pgdata` volume is preserved across upgrades. Pin to a specific major version (e.g. `manifestdotbuild/manifest:6`) in `docker-compose.yml` if you want control over when major upgrades happen.
 
-The dashboard checks GitHub once a day for the latest release and shows a "new version available" badge linking to the [changelog](https://manifest.build/changelog/). The check only reads the public release list and sends nothing about your install. To turn it off (for example on an air-gapped host), set `MANIFEST_UPDATE_CHECK_DISABLED=1` in `.env`.
-
 ## Backup & persistence
 
 PostgreSQL state lives in the `mnfst_pgdata` named volume mounted at `/var/lib/postgresql/data` in the `postgres` service. The Compose install also stores local request recordings in the `mnfst_recordings` volume mounted at `/data/request-recordings`; those recordings are not included in a PostgreSQL dump. For ephemeral hosts or multiple instances, configure durable S3-compatible storage instead.
@@ -416,9 +414,6 @@ sets this automatically).
 | `MANIFEST_DISABLE_HSTS`            | No          | unset                                        | Set `1` to silence the boot warning about serving over plain HTTP on a LAN                                                                                                                                 |
 | `THROTTLE_LIMIT` / `THROTTLE_TTL`  | No          | `100` / `60000`                              | Rate limit: requests per window, window in ms                                                                                                                                                              |
 | `DB_POOL_MAX` / `AUTH_DB_POOL_MAX` | No          | `10` / `5`                                   | PostgreSQL pool sizes (app pool, Better Auth pool)                                                                                                                                                         |
-| `SENTRY_DSN`                       | No          | unset                                        | Opt-in error monitoring. Sentry is not initialised unless set                                                                                                                                              |
-| `MANIFEST_TELEMETRY_DISABLED`      | No          | `0`                                          | Set `1` to disable anonymous usage telemetry                                                                                                                                                               |
-| `TELEMETRY_ENDPOINT`               | No          | `https://telemetry.manifest.build/v1/report` | Send the usage report to your own collector instead                                                                                                                                                        |
 
 `NODE_ENV` and `SEED_DATA` are deliberately fixed by the compose file and are
 not knobs here: the image is a production artifact, and the demo-data seeder
@@ -428,18 +423,12 @@ first-run setup wizard to create your admin account.
 Full env var reference:
 [manifest.build/llm-gateway/docs/reference/environment-variables](https://manifest.build/llm-gateway/docs/reference/environment-variables/)
 
-## Anonymous usage telemetry
-
-Manifest sends a small anonymous usage report once per 24h so the maintainers
-can see how the project is being used. Aggregates only — no prompts, no
-message contents, no API keys, nothing that identifies a user. The report is
-a random install UUID (generated once, no PII), the Manifest version, and
-aggregate counters grouped by provider, routing tier, auth type, agent
-platform, OS, and arch.
+## No telemetry
 
-To disable, set `MANIFEST_TELEMETRY_DISABLED=1` in your `.env` file and
-restart the container. The full field list is published at
-[manifest.build/llm-gateway/docs/self-hosted#telemetry](https://manifest.build/llm-gateway/docs/self-hosted/#telemetry).
+The container makes no outbound call of its own: no usage telemetry, no update
+check, no error reporting. It only reaches the inference providers you
+configure and the public model catalogs (openrouter.ai, models.dev and, for
+OpenCode Go, raw.githubusercontent.com).
 
 ## Links
 
diff --git a/docker/Dockerfile b/docker/Dockerfile
index dd6f5952..3bea7a9e 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -86,10 +86,6 @@ COPY --from=build --chown=nonroot:nonroot /app/packages/backend/dist packages/ba
 COPY --from=build --chown=nonroot:nonroot /app/packages/frontend/dist packages/frontend/dist
 COPY --chown=nonroot:nonroot packages/shared/package.json packages/shared/
 COPY --chown=nonroot:nonroot packages/backend/package.json packages/backend/
-# The telemetry sender reads the canonical Manifest version from this
-# file at boot. Without it, readManifestVersion() falls back to "unknown"
-# and the sender ends up posting invalid semver to the ingest endpoint.
-COPY --chown=nonroot:nonroot packages/manifest/package.json packages/manifest/
 
 EXPOSE 2099
 
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 9cd584f2..1f544680 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -148,27 +148,14 @@ services:
       # anywhere reachable from the internet.
       - MANIFEST_DISABLE_HSTS=${MANIFEST_DISABLE_HSTS:-}
       # Extra browser origins allowed to call the gateway (comma-separated).
-      - WINGMAN_CORS_ORIGINS=${WINGMAN_CORS_ORIGINS:-}
-      # Error monitoring (opt-in). Sentry stays completely uninitialised
-      # unless SENTRY_DSN is set.
-      - SENTRY_DSN=${SENTRY_DSN:-}
-      - SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT:-}
-      - SENTRY_RELEASE=${SENTRY_RELEASE:-}
-      # Anonymous usage telemetry (opt-out). Set MANIFEST_TELEMETRY_DISABLED=1
-      # to disable, or point TELEMETRY_ENDPOINT at your own collector. See
-      # https://manifest.build/llm-gateway/docs/self-hosted/#telemetry for the payload shape.
-      - MANIFEST_TELEMETRY_DISABLED=${MANIFEST_TELEMETRY_DISABLED:-0}
-      - TELEMETRY_ENDPOINT=${TELEMETRY_ENDPOINT:-}
+      # None by default: the dashboard is same-origin.
+      - THINKER_CORS_ORIGINS=${THINKER_CORS_ORIGINS:-}
       # Daily Harness usage rollup. Reads stay off until backfill parity passes.
       - AGENT_USAGE_DAILY_WORKER=${AGENT_USAGE_DAILY_WORKER:-}
       - AGENT_USAGE_DAILY_READS=${AGENT_USAGE_DAILY_READS:-}
       - AGENT_USAGE_DAILY_READ_TENANTS=${AGENT_USAGE_DAILY_READ_TENANTS:-}
       - AGENT_USAGE_DAILY_BATCH_SIZE=${AGENT_USAGE_DAILY_BATCH_SIZE:-}
       - AGENT_USAGE_DAILY_RUN_BUDGET_MS=${AGENT_USAGE_DAILY_RUN_BUDGET_MS:-}
-      # Update check (opt-out). Once a day the dashboard asks GitHub for the
-      # latest Manifest release so it can show a "new version available"
-      # badge. Set MANIFEST_UPDATE_CHECK_DISABLED=1 on air-gapped installs.
-      - MANIFEST_UPDATE_CHECK_DISABLED=${MANIFEST_UPDATE_CHECK_DISABLED:-0}
     depends_on:
       postgres:
         condition: service_healthy
diff --git a/docs/dev/manifest-guide.md b/docs/dev/manifest-guide.md
index d46a9f53..986651ac 100644
--- a/docs/dev/manifest-guide.md
+++ b/docs/dev/manifest-guide.md
@@ -2,13 +2,13 @@
 > Thinker is a self-hosted-only fork. While this file is being rewritten, apply these overrides to everything below:
 >
 > - **Ignore every "Cloud Mode Always" / `MANIFEST_MODE=cloud` directive.** Thinker has no cloud mode; use the self-hosted mode.
-> - **The dashboard has no Wingman drawer, update check, Discovery step or Autofix UI** (#13), and the backend has no Autofix (#16). Remaining backend leftovers go in #17.
+> - **The dashboard has no Wingman drawer, update check, Discovery step or Autofix UI** (#13), the backend has no Autofix (#16), and neither the backend nor the CLI phones home (#17, see [No phone-home](#no-phone-home)).
 > - **Never call `app.manifest.build` or any other Manifest-hosted endpoint.**
 > - **Do not use the `mnfst` CLI against Manifest's cloud.** The CLI becomes `thinker` and only talks to a Thinker instance.
 
 # Manifest Development Guidelines
 
-Last updated: 2026-09-14
+Last updated: 2026-10-11
 
 ## What Manifest Is
 
@@ -20,7 +20,7 @@ Manifest is a smart model router for **AI agents**. It sits between an agent and
 
 **Supported agents**: see `AGENT_PLATFORMS` in `packages/shared/src/agent-type.ts` for the current list (OpenClaw, Hermes, Claude Code, OpenCode, generic OpenAI/Anthropic SDK slots, and others — don't duplicate the list here, it grows independently of this doc). OpenClaw remains the deepest integration, but no new code or copy should frame Manifest as OpenClaw-only. When adding examples, prefer "AI agent" as the noun and pick OpenClaw as the worked example rather than the sole target. Manifest is consumed as a generic OpenAI-compatible HTTP endpoint — there are no first-party OpenClaw plugins in this repo anymore.
 
-The dashboard makes no outbound call of its own (#13): no Wingman drawer, no "new version" check (the version badge reads the build-time `__MANIFEST_VERSION__` constant from `vite.config.ts`), no post-signup Discovery questionnaire, and no Autofix UI. Setup and signup go straight to the dashboard (`/` and `/welcome`). The backend `wingman`/CORS, `version/` and `discovery/` modules still exist until #17 removes them; the dashboard no longer calls them. Autofix is gone from the backend too (#16, see [Autofix removed](#autofix-removed)); the generic reliability analytics the dashboard reads live under `/api/v1/overview/reliability/*` (see `RELIABILITY_PATHS` in `packages/frontend/src/services/api/analytics.ts`).
+The dashboard makes no outbound call of its own (#13): no Wingman drawer, no "new version" check (the version badge reads the build-time `__MANIFEST_VERSION__` constant from `vite.config.ts`), no post-signup Discovery questionnaire, and no Autofix UI. Setup and signup go straight to the dashboard (`/` and `/welcome`). The backend side went in #17 (see [No phone-home](#no-phone-home)). Autofix is gone from the backend too (#16, see [Autofix removed](#autofix-removed)); the generic reliability analytics the dashboard reads live under `/api/v1/overview/reliability/*` (see `RELIABILITY_PATHS` in `packages/frontend/src/services/api/analytics.ts`).
 
 **Three management surfaces share one REST API.** The dashboard, the `mnfst` CLI (`packages/cli/`), and the remote MCP server (`packages/backend/src/mcp/`) all drive the same `/api/v1/*` services with the same tenant scoping. Add a capability to the service layer once, then expose it on whichever surfaces need it; never fork logic per surface. See [CLI login](#cli-login-mnfst-login) and [Remote MCP server](#remote-mcp-server) below.
 
@@ -79,7 +79,6 @@ The `AgentKeyAuthGuard` accepts any non-`mnfst_*` token from loopback IPs in the
 packages/
 ├── backend/
 │   ├── src/
-│   │   ├── instrument.ts                    # Sentry init, imported first (before any other import)
 │   │   ├── main.ts                          # Bootstrap: Helmet, ValidationPipe, Better Auth mount, CORS
 │   │   ├── app.module.ts                    # Root module (guards: ApiKey, Session, Throttler)
 │   │   ├── config/app.config.ts             # Environment variable config
@@ -139,11 +138,7 @@ packages/
 │   │   ├── sse/                             # Server-Sent Events for real-time updates
 │   │   ├── setup/                           # First-run admin setup wizard
 │   │   ├── model-discovery/                 # Per-provider model fetching + fallback
-│   │   ├── discovery/                       # Self-hosted discovery onboarding (forwarded to Peacock)
-│   │   ├── cors-csp-config.ts               # Wingman CORS/CSP origin allowlists
-│   │   ├── sentry/                          # Sentry init-options builder (SENTRY_DSN-gated)
-│   │   ├── telemetry/                       # Anonymous self-hosted telemetry
-│   │   ├── version/                         # GET /api/v1/version — self-hosted "new version available" check
+│   │   ├── cors-csp-config.ts               # CORS allow-lists (THINKER_CORS_ORIGINS), frame-ancestors parsing
 │   │   └── mcp/                             # Remote MCP server (OAuth 2.1 bearer, stateless per-POST, tools/ per domain)
 │   └── test/                                # E2E tests (supertest)
 ├── frontend/
@@ -418,7 +413,6 @@ Every resource belongs to a tenant; users only authenticate and (optionally) app
 | GET                       | `/api/v1/provider-analytics/*`                  | Session/API Key                     | Per-provider analytics                                                                                      |
 | GET                       | `/api/v1/errors/breakdown`                      | Session/API Key                     | Error breakdown analytics                                                                                   |
 | GET                       | `/api/v1/overview/reliability/*`                | Session/API Key                     | Request reliability (`stats`, `timeseries`, `per-agent`, `per-provider`, `per-model`)                       |
-| POST                      | `/api/v1/discovery/complete`                    | Session/API Key                     | Best-effort self-hosted discovery submission forwarded to Peacock                                           |
 | GET/PUT/DELETE            | `/api/v1/agents/:agentName/enabled-providers*`  | Session/API Key                     | Per-agent provider enable/disable + impact preview                                                          |
 | GET/POST/PATCH/DELETE     | `/api/v1/notifications/*`                       | Session/API Key                     | Notification rules CRUD + email provider config                                                             |
 | GET/POST/PUT/PATCH/DELETE | `/api/v1/routing/:agentName/*`                  | Session/API Key                     | Routing config (tiers, providers, model-params, header-tiers, custom-providers, specificity, recording, etc.) |
@@ -439,7 +433,6 @@ Every resource belongs to a tenant; users only authenticate and (optionally) app
 | ALL                       | `/otlp/v1/*`, `/v1/{traces,metrics,logs}`       | Public                              | Structured **410 Gone** — OTLP ingest is removed (`otlp-deprecated.controller.ts`)                          |
 | GET/POST/PATCH            | `/api/v1/playground/*`                          | Session/API Key                     | Playground runs (run, list, star, mark best)                                                                |
 | GET                       | `/api/v1/events`                                | Session                             | SSE real-time events                                                                                        |
-| GET                       | `/api/v1/version`                               | Session/API Key                     | Running version + latest GitHub release for the self-hosted update badge (24h cache; off in cloud)          |
 | GET                       | `/api/v1/me`                                    | Session/API Key (tenant required)   | Identity probe for CLI/API clients: `{ tenantId, userId, authMethod, expiresAt }`; env `API_KEY` gets 401    |
 | POST                      | `/api/v1/cli/authorize`                         | Session only                        | Browser side of `mnfst login`: mints a PKCE-bound short-lived code                                          |
 | POST/DELETE               | `/api/v1/cli/token`                             | Public (code + verifier) / API Key  | Exchange the code for a `cli` PAT; DELETE revokes the calling PAT on logout                                 |
@@ -456,9 +449,9 @@ See `packages/backend/.env.example` for all variables. Key ones:
 - `MANIFEST_ENCRYPTION_KEY_PREVIOUS` — Optional, rotation only. A secret that stored values may still be encrypted under. Decryption always tries `MANIFEST_ENCRYPTION_KEY`, then this, then `BETTER_AUTH_SECRET`, so old rows stay readable. While it is set, one replica rewrites every row found under an older secret onto the current one after boot (`database/secret-reencryption.service.ts`, advisory-locked, never blocks or fails boot); a normal boot without it never scans. Rotation: set the new `MANIFEST_ENCRYPTION_KEY` and `MANIFEST_ENCRYPTION_KEY_PREVIOUS=<old>`, deploy, wait for the log line `Nothing left under an older secret`, then remove `PREVIOUS`. Introducing a dedicated key on an install that used the `BETTER_AUTH_SECRET` fallback: set `MANIFEST_ENCRYPTION_KEY` (old rows keep decrypting via the session secret); to move them onto the new key, set `PREVIOUS` to the session secret's value for one deploy. Request recordings are not rewritten by this pass: they decrypt under the current key only, so a key change makes older recordings unreadable until retention removes them.
 - `PORT` — Server port. Default: `3001`
 - `BIND_ADDRESS` — Bind address. Default: `127.0.0.1` (use `0.0.0.0` for Railway/Docker)
-- `NODE_ENV` — `development` or `production`. Dev allows broad CORS (local dashboard + Wingman); production allows the hosted Wingman origin plus any `WINGMAN_CORS_ORIGINS` entries.
+- `NODE_ENV` — `development` or `production`. Dev allows the Vite dashboard origin (`CORS_ORIGIN`); production allows no cross-origin browser caller beyond `THINKER_CORS_ORIGINS`.
 - `CORS_ORIGIN` — Allowed CORS origin (dev). Default: `http://localhost:3000`
-- `WINGMAN_CORS_ORIGINS` — Production only. Extra browser origins allowed to call the gateway (comma-separated). The hosted Wingman (`https://wingman.manifest.build`) is always allowed.
+- `THINKER_CORS_ORIGINS` — Extra browser origins allowed to call the gateway (comma-separated, exact match, trailing slash ignored), in dev and production. Empty by default: the dashboard is same-origin. Replaces upstream's `WINGMAN_CORS_ORIGINS` (#17).
 - `BETTER_AUTH_URL` — Base URL for Better Auth. Default: `http://localhost:{PORT}`
 - `FRONTEND_PORT` — Extra trusted origin port for Better Auth.
 - `MCP_ENABLED` — Set `false` to run without the remote MCP server. MCP needs an HTTPS `BETTER_AUTH_URL` (loopback HTTP is fine in dev) because `@better-auth/mcp` validates its protected-resource URL as the plugin is built; a plain-HTTP LAN or tailnet origin turns MCP off **automatically**, so this variable is only for switching it off on an install that could otherwise serve it. See [Remote MCP server](#remote-mcp-server).
@@ -470,7 +463,6 @@ See `packages/backend/.env.example` for all variables. Key ones:
 - `DB_POOL_MAX` — PostgreSQL connection pool size. Default: `10`
 - `RUN_MIGRATIONS_ON_BOOT` — Whether the app runs pending migrations at startup. Default: `true`; set `false` for multi-replica deploys where only one instance should migrate.
 - `MANIFEST_MIGRATION_FORCE` — Set `1` to let the tenant-scoping migrations (`1792500000000`, `1792600000000`) delete pre-tenant rows with a NULL `tenant_id` instead of aborting boot with instructions. One-off upgrade escape hatch; never set it permanently.
-- `MODELPARAMS_API_URL` / `MODELPARAMS_API_DISABLED` — Live refresh of the modelparams provider-parameter catalog (`routing-core/provider-param-spec.service.ts`) from `https://modelparams.dev/api/v1/models.json`, fire-and-forget on boot. Override the URL, or set `DISABLED=true` to stay on the vendored `modelparams` package data (air-gapped installs).
 - `MANIFEST_FRONTEND_DIR` / `MANIFEST_EMBEDDED` — Internal. Custom path to the built frontend (`common/utils/frontend-path.ts`), and a flag that skips the auto `bootstrap()` in `main.ts` when the backend is embedded by another process.
 - `ANNOUNCE_APP_URL` / `DOCTOR_TUTORIAL_URL` — Inputs to the release-announcement React Email template only; the sending tool lives outside this repo. Not read by the server.
 - `PLUGIN_OTLP_ENDPOINT` — Dead. Still listed in `.env.example` but no code reads it since OTLP ingest was removed; safe to delete.
@@ -491,12 +483,6 @@ See `packages/backend/.env.example` for all variables. Key ones:
 - `DISCORD_CLIENT_ID` / `DISCORD_CLIENT_SECRET` — Discord OAuth (optional)
 - `SEED_DATA` — Set `true` to seed demo data on startup. Dev/test only — ignored when `NODE_ENV=production` (use the first-run setup wizard instead).
 - `MANIFEST_MODE` — `selfhosted` or `cloud` (default: `cloud`; auto-detected as `selfhosted` inside Docker via `/.dockerenv` or Podman via `/run/.containerenv`). Self-hosted mode allows custom-provider URLs with `http://` / private IPs. `local` is accepted as a legacy alias for `selfhosted`.
-- `MANIFEST_TELEMETRY_DISABLED` — Set `1` to opt out of anonymous telemetry (self-hosted only).
-- `MANIFEST_UPDATE_CHECK_DISABLED` — Set `1` to stop the self-hosted dashboard's daily "new version available" check against GitHub Releases (`GET /api/v1/version`, `version/` module). Separate from the telemetry opt-out: air-gapped installs want no outbound calls at all. Never runs in cloud mode.
-- `TELEMETRY_ENDPOINT` — Where self-hosted installs POST the anonymous usage report. Default: `https://telemetry.manifest.build/v1/report`. See [Telemetry](#anonymous-usage-telemetry-self-hosted).
-- `DISCOVERY_ENDPOINT` — Optional override for the discovery submission endpoint. Default: `https://blue.manifest.build/v1/self-hosted/discovery`.
-- `SENTRY_DSN` / `SENTRY_ENVIRONMENT` / `SENTRY_RELEASE` — Opt-in Sentry error monitoring. Unset `SENTRY_DSN` disables Sentry entirely; `SENTRY_ENVIRONMENT` defaults to `NODE_ENV`. See [Error Monitoring](#error-monitoring-sentry-opt-in).
-- `WINGMAN_PORT` — Dev-only. Port a locally-running Wingman build listens on, allowed through CSP `frame-src` and CORS alongside the hosted Wingman origin. Default: backend `PORT` + 1.
 - `AUTH_DB_POOL_MAX` — Connection pool size for Better Auth's own `pg.Pool`, separate from `DB_POOL_MAX`. Default: `5`.
 - `OLLAMA_HOST` — Ollama endpoint for the built-in tile. Defaults to `http://localhost:11434` outside Docker and `http://host.docker.internal:11434` inside the bundled `docker/docker-compose.yml`.
 - `REQUEST_RECORDING_STORAGE` / `REQUEST_RECORDING_FILESYSTEM_PATH` / `REQUEST_RECORDING_S3_*` / `REQUEST_RECORDING_RETENTION_DAYS` — Provider Attempt body recording storage + retention. See [Request Recording](#request-recording-provider-attempt-bodies).
@@ -580,90 +566,18 @@ To add a new font or icon library:
 3. Reference the local CSS in `index.html` (e.g. `<link href="/fonts/..." />`)
 4. Do **not** add external domains to the CSP directives
 
-## Anonymous Usage Telemetry (self-hosted)
-
-Self-hosted installs (Docker / `node dist/main.js` with `NODE_ENV=production`)
-send one aggregate usage report per 24h to `TELEMETRY_ENDPOINT` (default
-`https://telemetry.manifest.build/v1/report`). The module lives at
-`packages/backend/src/telemetry/`.
-
-**Payload fields (v1) — keep this list minimal**:
-
-- `schema_version`, `install_id` (random UUIDv4, persisted once in
-  `install_metadata`), `manifest_version`
-- Last 24h aggregates from `agent_messages` (payload field names remain legacy for protocol compatibility): `messages_total`,
-  `messages_by_provider` (bucketed via `PROVIDER_BY_ID_OR_ALIAS` — unknown
-  values collapse to `"custom"`, NULL to `"unknown"`), `messages_by_tier`
-  (`simple` / `standard` / `complex` / `reasoning`, NULL → `"unknown"`),
-  `messages_by_auth_type` (`api_key` / `subscription`), `tokens_input_total`,
-  `tokens_output_total`, `cost_usd_total`, `cost_usd_by_provider` (rounded to
-  cents)
-- Configuration: `agents_total`, `agents_by_platform`
-- Management surfaces (all read from existing tables at send time — there is
-  deliberately no per-call counter and no new table): `cli_keys_total` /
-  `cli_keys_active_7d` (rows of `api_keys` named `cli`, i.e. `mnfst login`
-  PATs, active = `last_used_at` within 7 days); `mcp_clients_total`,
-  `mcp_consents_total`, `mcp_tokens_issued_24h`, `mcp_clients_active_24h`
-  (from the Better Auth OAuth tables `oauthClient` / `oauthConsent` /
-  `oauthAccessToken`; access tokens live 15 min, so tokens-per-24h is the MCP
-  activity proxy), `mcp_clients_by_name` (declared client name whitelisted to
-  known MCP hosts, else `"other"`, NULL → `"unknown"`). Missing OAuth tables
-  degrade to zeros, never a failed report. The CLI itself reports from the
-  user's machine (`packages/cli/src/telemetry.ts`), **not per command**: each
-  command appends one anonymous event to a local spool
-  (`~/.config/manifest/telemetry-spool.jsonl`, mode 0600, capped at 500) and the
-  spool ships as one envelope per install per day to `/v1/cli-report` on the
-  telemetry host (the very first command flushes immediately; a failed send is
-  retried at most hourly). The envelope carries `schema_version`, `anon_id`,
-  `cli_version`, `os`, `target` (`cloud` | `self-hosted` — the class of Manifest
-  the install points at, never the URL) and an `events[]` array of
-  `{command, ok, duration_ms, agent_runtime?, at}`. Same
-  `MANIFEST_TELEMETRY_DISABLED=1` opt-out.
-- Runtime: `platform` (`process.platform`), `arch` (`process.arch`)
-
-User-facing spec: https://manifest.build/llm-gateway/docs/self-hosted/#telemetry
-
-**Explicitly never sent**: tenant/user IDs, emails, API keys, prompts,
-message contents, model names, custom provider URLs, OAuth client IDs,
-raw IPs.
-
-**Opt-out**: `MANIFEST_TELEMETRY_DISABLED=1`. Also auto-disabled when
-`NODE_ENV !== 'production'` so dev instances never report.
-
-**Cadence**: `@Cron(CronExpression.EVERY_HOUR)` fires once an hour but
-short-circuits unless the last send was ≥24h ago (and the first-send jitter
-window has elapsed). Hourly tick + timestamp check beats a daily cron
-because it survives restarts without missing windows.
-
-**Extending the payload**: bump `TELEMETRY_SCHEMA_VERSION` and add fields
-additively — the ingest (peacock-backend) rejects unknown `schema_version`
-values with 400, so downgrades stay safe.
-
-## Error Monitoring (Sentry, opt-in)
-
-The backend integrates the Sentry NestJS SDK for optional error monitoring. It
-is disabled unless the process environment provides `SENTRY_DSN`. This applies
-equally to Cloud and self-hosted deployments; the bundled self-hosted
-configuration simply leaves it unset by default.
-
-- **Init**: `packages/backend/src/instrument.ts` is imported on the very first
-  line of `main.ts` (before any other import). It calls
-  `Sentry.init(buildSentryInitOptions(process.env))` only when the builder
-  returns non-null. The option-building logic lives in
-  `src/sentry/sentry-options.ts` (fully unit-tested); `instrument.ts` is a thin
-  boot shell excluded from coverage like `main.ts`.
-- **Scope**: error monitoring only. Performance tracing is explicitly disabled
-  and the profiling package is not installed. Request headers, cookies, query
-  parameters, bodies, user data, GenAI inputs/outputs, local variables, and
-  breadcrumbs are disabled through the SDK's `dataCollection` options.
-- **Error capture**: when enabled, `SentryModule.forRoot()` and
-  `SentryGlobalFilter` are registered in `app.module.ts` for otherwise-unhandled
-  errors. When disabled, neither is part of the Nest application.
-- **Setup check**: when Sentry is enabled outside production,
-  `GET /api/v1/debug-sentry` throws a test error. The controller is not
-  registered in production.
-- **Optional tags**: `SENTRY_ENVIRONMENT` and `SENTRY_RELEASE` may be supplied
-  alongside `SENTRY_DSN`.
+## No phone-home
+
+Thinker makes no outbound call of its own (#17). Upstream Manifest had six, all removed from the backend and the CLI along with their variables:
+
+- **Usage telemetry**: the backend's daily report to `telemetry.manifest.build` (`telemetry/`, `InstallIdService`, `MANIFEST_TELEMETRY_DISABLED`, `TELEMETRY_ENDPOINT`) and the CLI's spooled usage events (`packages/cli/src/telemetry.ts`, `MANIFEST_CLI_TELEMETRY_ENDPOINT`). `DropInstallMetadata1803500000000` drops the `install_metadata` table that held the anonymous install id (`lock_timeout`, `IF EXISTS`; `down()` recreates it empty).
+- **Update check**: `version/` and `GET /api/v1/version` (daily GitHub releases lookup, `MANIFEST_UPDATE_CHECK_*`). The dashboard's version badge reads the build-time constant (#13). It does not come back, not even pointing at Thinker.
+- **Discovery**: `discovery/` and `POST /api/v1/discovery/complete`, which forwarded the setup questionnaire to `blue.manifest.build` (`DISCOVERY_ENDPOINT`).
+- **Sentry**: `instrument.ts`, `sentry/`, `SentryModule`/`SentryGlobalFilter`, the `@sentry/nestjs` dependency and `SENTRY_*`. Open observability (v0.5) will be pull/export configured by the operator, never a push to a third party.
+- **Hosted Wingman origin**: CORS no longer always allows `wingman.manifest.build`, and CSP `frame-src` is `'self'` in every mode (`WINGMAN_PORT` is gone). `WINGMAN_CORS_ORIGINS` became `THINKER_CORS_ORIGINS`, with the same meaning.
+- **modelparams.dev**: `ProviderParamSpecService` serves only the snapshot of the bundled `modelparams` package, loaded synchronously at construction. There is no boot fetch, no hourly cron and no `MODELPARAMS_API_*`; the snapshot moves forward with dependency updates.
+
+The only outbound destinations left are the providers the operator configures and the public catalogs of ADR 0003 (openrouter.ai, models.dev, and raw.githubusercontent.com for OpenCode Go). `test/no-phonehome-egress.e2e-spec.ts` fails if the backend, CLI or shared source names a removed destination again, or if a production-mode boot fetches anything outside that list.
 
 ## Architecture Notes
 
diff --git a/package-lock.json b/package-lock.json
index eb2addcc..55f3b303 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3970,110 +3970,6 @@
         "@octokit/openapi-types": "^27.0.0"
       }
     },
-    "node_modules/@opentelemetry/api": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz",
-      "integrity": "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/@opentelemetry/api-logs": {
-      "version": "0.220.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.220.0.tgz",
-      "integrity": "sha512-CmVa4ImJ+ynfrPMNaAXHET6Bhb44SwzmfyVJFq9ni2jgXJR/l7C6gfVFddNmHP+ZOkP9cf4f9DBe68qVLTHc9w==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      },
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/@opentelemetry/core": {
-      "version": "2.11.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.11.0.tgz",
-      "integrity": "sha512-7YP44XH0tV6+Mb54x2YGf84i7yi+31MBZlE8JwvozkxyTvXbSp10X7cI7YE49ChJ3shMJoBmCJF3+1QFBJctGA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/instrumentation": {
-      "version": "0.220.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.220.0.tgz",
-      "integrity": "sha512-xQx3E2WxP1mDvKzxLxX+CTCtNLa560YJZ3087qYHerl2YmiKpv7AH+dAy7vmx+eVrZ5BwhfWUAVoKOoxCNHcpw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.220.0",
-        "import-in-the-middle": "^3.0.0",
-        "require-in-the-middle": "^8.0.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      }
-    },
-    "node_modules/@opentelemetry/resources": {
-      "version": "2.11.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.11.0.tgz",
-      "integrity": "sha512-Ie7+8q8MDF4FAEQCKVMTx3ReUvxiIAgIiiW3c9JdmP8+HMcDy20puT+AHjexnExgnbvBxjQ9fjkFDWrikJ2jQA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.11.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/sdk-trace": {
-      "version": "2.11.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace/-/sdk-trace-2.11.0.tgz",
-      "integrity": "sha512-fFnTqGm8/G73GQVnxYi7LXa1ZVYEUvgL6XI1LpvV0bPC7WQ/ZGgKxCSl8FnlZBKto9JHHEFTO6s6CUpvvtwFrA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.11.0",
-        "@opentelemetry/resources": "2.11.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.11.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.11.0.tgz",
-      "integrity": "sha512-H19x/TX/LZdqiYOjM7fqtSxwlplC5pgelavqbQdHbhdq0q/AI/TGkM2dfGuuynTXmJPeF2HoZVoPDu+TGoW78A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.11.0",
-        "@opentelemetry/resources": "2.11.0",
-        "@opentelemetry/sdk-trace": "2.11.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
-      }
-    },
     "node_modules/@opentelemetry/semantic-conventions": {
       "version": "1.43.0",
       "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.43.0.tgz",
@@ -5136,138 +5032,6 @@
         "url": "https://ko-fi.com/killymxi"
       }
     },
-    "node_modules/@sentry/conventions": {
-      "version": "0.16.0",
-      "resolved": "https://registry.npmjs.org/@sentry/conventions/-/conventions-0.16.0.tgz",
-      "integrity": "sha512-fO9PLmHdVURcSPUpWCItWAtgKiMwGdJHbovoSEyLplX5sxs2ugvI4CBPTrkkgqhObnZOD0CnWBKDzSVQYBKEyQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
-    "node_modules/@sentry/core": {
-      "version": "10.74.0",
-      "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.74.0.tgz",
-      "integrity": "sha512-u9rY8vcZfktccwm6LznfCZlqP5C9A+p76r4/pFS1grqpuTO0m21Cl8rosnlESrDGP/Xd9tfr91rWYk0jPH8jeQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@sentry/conventions": "^0.16.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@sentry/nestjs": {
-      "version": "10.74.0",
-      "resolved": "https://registry.npmjs.org/@sentry/nestjs/-/nestjs-10.74.0.tgz",
-      "integrity": "sha512-IItszVxTE958jFfUh3VlZbKAv19yNHmthv/Frxcr+bp964xJduYEakfmNw3UO2AgKV+jMTG8OQAqYqWqFOvE6A==",
-      "license": "MIT",
-      "dependencies": {
-        "@opentelemetry/api": "^1.9.1",
-        "@opentelemetry/instrumentation": "^0.220.0",
-        "@sentry/conventions": "^0.16.0",
-        "@sentry/core": "10.74.0",
-        "@sentry/node": "10.74.0",
-        "@sentry/server-utils": "10.74.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@nestjs/common": "^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
-        "@nestjs/core": "^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0"
-      }
-    },
-    "node_modules/@sentry/node": {
-      "version": "10.74.0",
-      "resolved": "https://registry.npmjs.org/@sentry/node/-/node-10.74.0.tgz",
-      "integrity": "sha512-u1wsarTOWHn9CCev81Da5T4IQHZgdcosXRfX2+4DMII/lVJMBYesKixTQuMwXexjVG2+pkf16zTmgjZDa+75jA==",
-      "license": "MIT",
-      "dependencies": {
-        "@opentelemetry/api": "^1.9.1",
-        "@opentelemetry/instrumentation": "^0.220.0",
-        "@opentelemetry/sdk-trace-base": "^2.9.0",
-        "@sentry/conventions": "^0.16.0",
-        "@sentry/core": "10.74.0",
-        "@sentry/node-core": "10.74.0",
-        "@sentry/opentelemetry": "10.74.0",
-        "@sentry/server-utils": "10.74.0",
-        "import-in-the-middle": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@sentry/node-core": {
-      "version": "10.74.0",
-      "resolved": "https://registry.npmjs.org/@sentry/node-core/-/node-core-10.74.0.tgz",
-      "integrity": "sha512-btgZXcGmkOGgojbxHo/gfGiyqYpzC9E8zVR78Q3MtM6Xnemk9gwJiQlhNmEX/FM+C36WBRPZrdcZcnMaJhbfJw==",
-      "license": "MIT",
-      "dependencies": {
-        "@sentry/conventions": "^0.16.0",
-        "@sentry/core": "10.74.0",
-        "@sentry/opentelemetry": "10.74.0",
-        "import-in-the-middle": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.9.0",
-        "@opentelemetry/core": "^1.30.1 || ^2.1.0",
-        "@opentelemetry/exporter-trace-otlp-http": ">=0.57.0 <1",
-        "@opentelemetry/instrumentation": ">=0.57.1 <1",
-        "@opentelemetry/sdk-trace-base": "^1.30.1 || ^2.1.0"
-      },
-      "peerDependenciesMeta": {
-        "@opentelemetry/api": {
-          "optional": true
-        },
-        "@opentelemetry/core": {
-          "optional": true
-        },
-        "@opentelemetry/exporter-trace-otlp-http": {
-          "optional": true
-        },
-        "@opentelemetry/instrumentation": {
-          "optional": true
-        },
-        "@opentelemetry/sdk-trace-base": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@sentry/opentelemetry": {
-      "version": "10.74.0",
-      "resolved": "https://registry.npmjs.org/@sentry/opentelemetry/-/opentelemetry-10.74.0.tgz",
-      "integrity": "sha512-ua5mt0NDBfye+/ACKjAw9Ad2i+y42lOLvhxXZepZXjszblMz80MEsIZflMB7uLZUCTNH7MbZN8tlzCy8KsJKmQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@sentry/conventions": "^0.16.0",
-        "@sentry/core": "10.74.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.9.0",
-        "@opentelemetry/core": "^1.30.1 || ^2.1.0",
-        "@opentelemetry/sdk-trace-base": "^1.30.1 || ^2.1.0"
-      }
-    },
-    "node_modules/@sentry/server-utils": {
-      "version": "10.74.0",
-      "resolved": "https://registry.npmjs.org/@sentry/server-utils/-/server-utils-10.74.0.tgz",
-      "integrity": "sha512-AHmPIGE8yVRyywpZRhAkm/H0cHTgsQSPhFZFbaeQLcYHFE/eOP9bAMh8Nj/Apr7WMagFXYHd04tR/63BxtLgKw==",
-      "license": "MIT",
-      "dependencies": {
-        "@sentry/conventions": "^0.16.0",
-        "@sentry/core": "10.74.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/@sinclair/typebox": {
       "version": "0.34.52",
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.52.tgz",
@@ -7706,6 +7470,7 @@
       "version": "2.2.1",
       "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.1.tgz",
       "integrity": "sha512-Ca8swihM+/4yKecYHY52kgJd300hi2lADU/a1RxNTRe+RJ9jvqQlESpbz9DnG9mowez8qwXHB8qYdIUw9e+F5Q==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/class-transformer": {
@@ -11122,26 +10887,6 @@
         "node": ">=4"
       }
     },
-    "node_modules/import-in-the-middle": {
-      "version": "3.5.0",
-      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.5.0.tgz",
-      "integrity": "sha512-O6wo8l0lhBuytKz3x8S65TvacFtoopji+gCVeEBbjCaRy75gkk4bCBQoVmY7OEZ63cbFK+yf77pDCTWaadV7hQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "cjs-module-lexer": "^2.2.0",
-        "es-module-lexer": "^3.0.2",
-        "module-details-from-path": "^1.0.4"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/import-in-the-middle/node_modules/es-module-lexer": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-3.0.2.tgz",
-      "integrity": "sha512-BuIB67FngDSyQ/dpQNOZybwdEBDUGJQvOqwWr4ha/ufYiqzuEwPkKO2zLhRAgay28tStRIHUeWmszZAJo3GCOg==",
-      "license": "MIT"
-    },
     "node_modules/import-local": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz",
@@ -13014,12 +12759,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/module-details-from-path": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/module-details-from-path/-/module-details-from-path-1.0.4.tgz",
-      "integrity": "sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==",
-      "license": "MIT"
-    },
     "node_modules/motion": {
       "version": "12.42.2",
       "resolved": "https://registry.npmjs.org/motion/-/motion-12.42.2.tgz",
@@ -14292,19 +14031,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/require-in-the-middle": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-8.0.1.tgz",
-      "integrity": "sha512-QT7FVMXfWOYFbeRBF6nu+I6tr2Tf3u0q8RIEjNob/heKY/nh7drD/k7eeMFmSQgnTtCzLDcCu/XEnpW2wk4xCQ==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.5",
-        "module-details-from-path": "^1.0.3"
-      },
-      "engines": {
-        "node": ">=9.3.0 || >=8.10.0 <9.0.0"
-      }
-    },
     "node_modules/resolve": {
       "version": "1.22.12",
       "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
@@ -17018,7 +16744,6 @@
         "@nestjs/typeorm": "^11.0.3",
         "@react-email/components": "^1.0.12",
         "@react-email/render": "^2.0.4",
-        "@sentry/nestjs": "^10.73.0",
         "better-auth": "1.7.4",
         "cache-manager": "^7.2.9",
         "cacheable": "^2.5.0",
diff --git a/packages/backend/.env.example b/packages/backend/.env.example
index 3f5d9aab..cf78f76e 100644
--- a/packages/backend/.env.example
+++ b/packages/backend/.env.example
@@ -22,7 +22,7 @@ CORS_ORIGIN=http://localhost:3000
 BETTER_AUTH_URL=http://localhost:3001
 # BETTER_AUTH_ALLOWED_HOSTS= # Extra hosts that may serve the dashboard/API (comma-separated). The OAuth callback and session cookie follow the request host, so set this when the same service answers on more than one domain (production only; BETTER_AUTH_URL and CORS_ORIGIN are always allowed). Wildcards like *.example.com work.
 # FRONTEND_PORT=             # Extra trusted origin port for Better Auth
-# WINGMAN_CORS_ORIGINS=      # Prod only: extra browser origins allowed to call the gateway (comma-separated). The hosted Wingman (https://wingman.manifest.build) is always allowed.
+# THINKER_CORS_ORIGINS=      # Extra browser origins allowed to call the gateway (comma-separated). None by default: the dashboard is same-origin.
 # MCP_ENABLED=               # Set false to run without the remote MCP server (/api/v1/mcp) and its OAuth endpoints. MCP needs an HTTPS BETTER_AUTH_URL (loopback HTTP is fine in dev); a plain-HTTP LAN or tailnet origin turns it off by itself and says so at boot, so set this only to acknowledge that or to switch MCP off on an install that could serve it.
 
 # ── Database ─────────────────────────────────────────
@@ -127,11 +127,6 @@ BETTER_AUTH_URL=http://localhost:3001
 # ── Data Seeding ────────────────────────────────────
 # SEED_DATA=true              # Seed demo data + admin user on startup (self-hosted first boot)
 
-# ── Update Check (self-hosted) ──────────────────────
-# Once a day the dashboard asks GitHub for the latest Manifest release and
-# shows a "new version available" badge. Never runs in cloud mode.
-# MANIFEST_UPDATE_CHECK_DISABLED=1   # Opt out (air-gapped installs)
-
 # ── Internal ────────────────────────────────────────
 # MANIFEST_FRONTEND_DIR=      # Custom path to frontend dist directory
 # MANIFEST_EMBEDDED=          # Set to skip auto-start (used by embedded server)
diff --git a/packages/backend/package.json b/packages/backend/package.json
index b1a0bbaf..e9f4a32f 100644
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -39,7 +39,6 @@
     "@nestjs/typeorm": "^11.0.3",
     "@react-email/components": "^1.0.12",
     "@react-email/render": "^2.0.4",
-    "@sentry/nestjs": "^10.73.0",
     "better-auth": "1.7.4",
     "cache-manager": "^7.2.9",
     "cacheable": "^2.5.0",
@@ -95,7 +94,6 @@
       "**/*.ts",
       "!**/*.spec.ts",
       "!main.ts",
-      "!instrument.ts",
       "!**/database/migrations/**",
       "!**/database/datasource.ts",
       "!**/database/data-source-definitions.ts",
diff --git a/packages/backend/src/app.module.ts b/packages/backend/src/app.module.ts
index 3efbffc3..91621b51 100644
--- a/packages/backend/src/app.module.ts
+++ b/packages/backend/src/app.module.ts
@@ -1,6 +1,5 @@
 import { Module } from '@nestjs/common';
-import { APP_FILTER, APP_GUARD } from '@nestjs/core';
-import { SentryModule, SentryGlobalFilter } from '@sentry/nestjs/setup';
+import { APP_GUARD } from '@nestjs/core';
 import { CacheModule } from '@nestjs/cache-manager';
 import { ConfigModule } from '@nestjs/config';
 import { ServeStaticModule } from '@nestjs/serve-static';
@@ -25,13 +24,9 @@ import { RoutingModule } from './routing/routing.module';
 import { PlaygroundModule } from './playground/playground.module';
 import { CommonModule } from './common/common.module';
 import { SseModule } from './sse/sse.module';
-import { VersionModule } from './version/version.module';
 import { SetupModule } from './setup/setup.module';
-import { TelemetryModule } from './telemetry/telemetry.module';
-import { DiscoveryModule } from './discovery/discovery.module';
 import { McpModule } from './mcp/mcp.module';
 import { mcpAvailability } from './auth/mcp-availability';
-import { DebugSentryController } from './sentry/debug-sentry.controller';
 
 const frontendPath = resolveFrontendDir();
 const ONE_YEAR_S = 365 * 24 * 60 * 60;
@@ -55,14 +50,6 @@ const serveStaticImports = frontendPath
     ]
   : [];
 
-const sentryEnabled = Boolean(process.env['SENTRY_DSN']?.trim());
-const sentryImports = sentryEnabled ? [SentryModule.forRoot()] : [];
-const sentryProviders = sentryEnabled
-  ? [{ provide: APP_FILTER, useClass: SentryGlobalFilter }]
-  : [];
-const sentryDebugControllers =
-  sentryEnabled && process.env['NODE_ENV'] !== 'production' ? [DebugSentryController] : [];
-
 // The remote MCP server is off on installs whose origin cannot carry an MCP
 // resource, and on installs that set MCP_ENABLED=false. Leaving the module
 // unregistered means `/api/v1/mcp` does not exist rather than answering an
@@ -72,7 +59,6 @@ const mcpImports = mcpAvailability().enabled ? [McpModule] : [];
 
 @Module({
   imports: [
-    ...sentryImports,
     ConfigModule.forRoot({ isGlobal: true, load: [appConfig] }),
     CacheModule.register({
       isGlobal: true,
@@ -98,19 +84,14 @@ const mcpImports = mcpAvailability().enabled ? [McpModule] : [];
     RoutingModule,
     PlaygroundModule,
     SseModule,
-    VersionModule,
     SetupModule,
-    TelemetryModule,
     BackfillModule,
-    DiscoveryModule,
     ...mcpImports,
   ],
   providers: [
-    ...sentryProviders,
     { provide: APP_GUARD, useClass: SessionGuard },
     { provide: APP_GUARD, useClass: ApiKeyGuard },
     { provide: APP_GUARD, useClass: ThrottlerGuard },
   ],
-  controllers: [...sentryDebugControllers],
 })
 export class AppModule {}
diff --git a/packages/backend/src/cors-csp-config.spec.ts b/packages/backend/src/cors-csp-config.spec.ts
index b3e28ac9..70766fe5 100644
--- a/packages/backend/src/cors-csp-config.spec.ts
+++ b/packages/backend/src/cors-csp-config.spec.ts
@@ -1,91 +1,64 @@
 import {
   CORS_PREFLIGHT_MAX_AGE_SECONDS,
-  HOSTED_WINGMAN_ORIGIN,
   applyPrivateNetworkAllow,
   buildCorsOptions,
   buildDevAllowedOrigins,
   buildProdAllowedOrigins,
-  buildFrameSrc,
   createCorsOriginHandler,
+  parseExtraOrigins,
   parseFrameAncestors,
 } from './cors-csp-config';
 
-describe('HOSTED_WINGMAN_ORIGIN', () => {
-  it('points at the hosted Wingman SPA', () => {
-    expect(HOSTED_WINGMAN_ORIGIN).toBe('https://wingman.manifest.build');
+const TOOL_ORIGIN = 'https://tools.acme.dev';
+
+describe('parseExtraOrigins', () => {
+  it('returns nothing when unset or blank', () => {
+    expect(parseExtraOrigins(undefined)).toEqual([]);
+    expect(parseExtraOrigins('')).toEqual([]);
+    expect(parseExtraOrigins('  , ,')).toEqual([]);
+  });
+
+  it('trims entries and strips a trailing slash', () => {
+    expect(parseExtraOrigins(' https://a.example.com/ , https://b.example.com')).toEqual([
+      'https://a.example.com',
+      'https://b.example.com',
+    ]);
   });
 });
 
 describe('buildDevAllowedOrigins', () => {
-  it('allows the Vite frontend, both loopback Wingman ports, and the hosted Wingman (deduped)', () => {
-    expect(
-      buildDevAllowedOrigins({
-        configuredOrigin: 'http://localhost:3000',
-        wingmanPort: 3002,
-      }),
-    ).toEqual([
+  it('allows only the configured Vite frontend by default', () => {
+    expect(buildDevAllowedOrigins({ configuredOrigin: 'http://localhost:3000' })).toEqual([
       'http://localhost:3000',
-      'http://localhost:3002',
-      'http://127.0.0.1:3002',
-      HOSTED_WINGMAN_ORIGIN,
     ]);
   });
 
-  it('respects a custom Wingman port and configured origin', () => {
-    const allowed = buildDevAllowedOrigins({
-      configuredOrigin: 'http://localhost:38240',
-      wingmanPort: 38239,
-    });
-    expect(allowed).toContain('http://localhost:38240');
-    expect(allowed).toContain('http://localhost:38239');
-    expect(allowed).toContain('http://127.0.0.1:38239');
-    expect(allowed).toContain(HOSTED_WINGMAN_ORIGIN);
+  it('adds THINKER_CORS_ORIGINS extras, deduped', () => {
+    expect(
+      buildDevAllowedOrigins({
+        configuredOrigin: 'http://localhost:3000',
+        extraOrigins: `${TOOL_ORIGIN}, http://localhost:3000/`,
+      }),
+    ).toEqual(['http://localhost:3000', TOOL_ORIGIN]);
   });
 });
 
 describe('buildProdAllowedOrigins', () => {
-  it('allows the hosted Wingman origin by default', () => {
-    expect(buildProdAllowedOrigins()).toEqual([HOSTED_WINGMAN_ORIGIN]);
+  it('allows no cross-origin caller by default', () => {
+    expect(buildProdAllowedOrigins()).toEqual([]);
+    expect(buildProdAllowedOrigins({ extraOrigins: '' })).toEqual([]);
   });
 
-  it('appends operator-configured extra origins, trimmed and deduped', () => {
+  it('allows only operator-configured origins, trimmed and deduped', () => {
     expect(
       buildProdAllowedOrigins({
-        extraOrigins:
-          ' https://wingman.acme.dev , https://wingman.manifest.build ,https://tools.acme.dev',
+        extraOrigins: ` ${TOOL_ORIGIN} , https://other.acme.dev ,${TOOL_ORIGIN}/`,
       }),
-    ).toEqual([HOSTED_WINGMAN_ORIGIN, 'https://wingman.acme.dev', 'https://tools.acme.dev']);
+    ).toEqual([TOOL_ORIGIN, 'https://other.acme.dev']);
   });
 
   it('ignores empty / whitespace-only extra origins', () => {
-    expect(buildProdAllowedOrigins({ extraOrigins: '  , ,' })).toEqual([HOSTED_WINGMAN_ORIGIN]);
-    expect(buildProdAllowedOrigins({ extraOrigins: '' })).toEqual([HOSTED_WINGMAN_ORIGIN]);
-  });
-
-  it('strips a trailing slash so it matches the browser Origin header', () => {
-    expect(buildProdAllowedOrigins({ extraOrigins: 'https://wingman.acme.dev/' })).toEqual([
-      HOSTED_WINGMAN_ORIGIN,
-      'https://wingman.acme.dev',
-    ]);
-  });
-});
-
-describe('buildFrameSrc', () => {
-  it('in production, allows only self (drawer is dev-only)', () => {
-    expect(buildFrameSrc({ isDev: false, wingmanPort: 3002 })).toEqual(["'self'"]);
-  });
-
-  it('in dev, allows local Wingman ports and the hosted Wingman', () => {
-    expect(buildFrameSrc({ isDev: true, wingmanPort: 3002 })).toEqual([
-      "'self'",
-      'http://localhost:3002',
-      'http://127.0.0.1:3002',
-      HOSTED_WINGMAN_ORIGIN,
-    ]);
-  });
-
-  it('respects a custom Wingman port in dev', () => {
-    expect(buildFrameSrc({ isDev: true, wingmanPort: 38239 })).toContain('http://localhost:38239');
+    expect(buildProdAllowedOrigins({ extraOrigins: '  , ,' })).toEqual([]);
   });
 });
 
@@ -137,7 +110,7 @@ describe('parseFrameAncestors', () => {
 });
 
 describe('createCorsOriginHandler', () => {
-  const handler = createCorsOriginHandler([HOSTED_WINGMAN_ORIGIN, 'http://localhost:3000']);
+  const handler = createCorsOriginHandler([TOOL_ORIGIN, 'http://localhost:3000']);
 
   it('allows requests with no Origin header (same-origin / curl / server-to-server)', () => {
     const cb = jest.fn();
@@ -147,7 +120,7 @@ describe('createCorsOriginHandler', () => {
 
   it('allows a listed origin', () => {
     const cb = jest.fn();
-    handler(HOSTED_WINGMAN_ORIGIN, cb);
+    handler(TOOL_ORIGIN, cb);
     expect(cb).toHaveBeenCalledWith(null, true);
   });
 
@@ -160,19 +133,19 @@ describe('createCorsOriginHandler', () => {
 
 describe('buildCorsOptions', () => {
   it('caches the preflight via maxAge so reloads stop re-running it', () => {
-    const opts = buildCorsOptions([HOSTED_WINGMAN_ORIGIN]);
+    const opts = buildCorsOptions([TOOL_ORIGIN]);
     expect(opts.maxAge).toBe(CORS_PREFLIGHT_MAX_AGE_SECONDS);
     expect(CORS_PREFLIGHT_MAX_AGE_SECONDS).toBe(7200);
   });
 
   it('keeps credentials off the cross-origin path (bearer keys, never cookies)', () => {
-    expect(buildCorsOptions([HOSTED_WINGMAN_ORIGIN]).credentials).toBe(false);
+    expect(buildCorsOptions([TOOL_ORIGIN]).credentials).toBe(false);
   });
 
   it('wires the allow-list origin handler (allows listed, blocks unlisted)', () => {
-    const { origin } = buildCorsOptions([HOSTED_WINGMAN_ORIGIN]);
+    const { origin } = buildCorsOptions([TOOL_ORIGIN]);
     const allow = jest.fn();
-    origin(HOSTED_WINGMAN_ORIGIN, allow);
+    origin(TOOL_ORIGIN, allow);
     expect(allow).toHaveBeenCalledWith(null, true);
     const block = jest.fn();
     origin('https://evil.example.com', block);
@@ -181,7 +154,7 @@ describe('buildCorsOptions', () => {
 });
 
 describe('applyPrivateNetworkAllow', () => {
-  const allowed = [HOSTED_WINGMAN_ORIGIN, 'http://localhost:3000'];
+  const allowed = [TOOL_ORIGIN, 'http://localhost:3000'];
 
   it('echoes the PNA allow header for OPTIONS preflight from a listed origin', () => {
     const setHeader = jest.fn();
@@ -189,7 +162,7 @@ describe('applyPrivateNetworkAllow', () => {
       {
         method: 'OPTIONS',
         headers: {
-          origin: HOSTED_WINGMAN_ORIGIN,
+          origin: TOOL_ORIGIN,
           'access-control-request-private-network': 'true',
         },
       },
@@ -205,7 +178,7 @@ describe('applyPrivateNetworkAllow', () => {
       {
         method: 'GET',
         headers: {
-          origin: HOSTED_WINGMAN_ORIGIN,
+          origin: TOOL_ORIGIN,
           'access-control-request-private-network': 'true',
         },
       },
@@ -218,7 +191,7 @@ describe('applyPrivateNetworkAllow', () => {
   it('does not echo when the PNA request header is missing', () => {
     const setHeader = jest.fn();
     applyPrivateNetworkAllow(
-      { method: 'OPTIONS', headers: { origin: HOSTED_WINGMAN_ORIGIN } },
+      { method: 'OPTIONS', headers: { origin: TOOL_ORIGIN } },
       allowed,
       setHeader,
     );
@@ -260,7 +233,7 @@ describe('applyPrivateNetworkAllow', () => {
       {
         method: 'OPTIONS',
         headers: {
-          origin: [HOSTED_WINGMAN_ORIGIN, HOSTED_WINGMAN_ORIGIN],
+          origin: [TOOL_ORIGIN, TOOL_ORIGIN],
           'access-control-request-private-network': 'true',
         },
       },
diff --git a/packages/backend/src/cors-csp-config.ts b/packages/backend/src/cors-csp-config.ts
index 0673ff87..5d6f618a 100644
--- a/packages/backend/src/cors-csp-config.ts
+++ b/packages/backend/src/cors-csp-config.ts
@@ -1,72 +1,49 @@
-// Single source of truth for the CORS allow-lists and the CSP `frame-src`
-// directive. CORS allows the hosted Wingman gateway tester in both dev and
-// production (it's a legitimate cross-origin caller of the gateway). The CSP
-// `frame-src` — which governs embedding the Wingman drawer in the dashboard —
-// stays dev-only, since that drawer is dead-code-eliminated from production.
-
-export const HOSTED_WINGMAN_ORIGIN = 'https://wingman.manifest.build';
+// Single source of truth for the CORS allow-lists. The dashboard is
+// same-origin, so by default no cross-origin browser caller is allowed in
+// production. An operator who runs a browser tool on another origin that must
+// call the gateway opts it in with `THINKER_CORS_ORIGINS`. No third-party origin
+// is ever allowed by default (#17).
 
 export interface DevOriginBuilderOptions {
+  /** The Vite dev server origin (`CORS_ORIGIN`, defaults to http://localhost:3000). */
   configuredOrigin: string;
-  wingmanPort: number;
+  /** Comma-separated extra origins from `THINKER_CORS_ORIGINS`. */
+  extraOrigins?: string;
 }
 
 export interface ProdOriginBuilderOptions {
   /**
-   * Comma-separated extra origins from `WINGMAN_CORS_ORIGINS` — lets an
-   * operator whose self-hosted Wingman lives on a different origin than the
-   * gateway opt it in without a code change.
+   * Comma-separated extra origins from `THINKER_CORS_ORIGINS`: browser origins,
+   * other than the gateway's own, that the operator authorizes to call it.
    */
   extraOrigins?: string;
 }
 
-export interface FrameSrcOptions {
-  isDev: boolean;
-  wingmanPort: number;
+/**
+ * Splits a comma-separated origin list, trimming whitespace and any trailing
+ * slash: browser `Origin` headers never carry one, so an exact-match entry like
+ * `https://tools.acme.dev/` would never match otherwise.
+ */
+export function parseExtraOrigins(raw: string | undefined): string[] {
+  return (raw ?? '')
+    .split(',')
+    .map((v) => v.trim().replace(/\/+$/, ''))
+    .filter((v) => v.length > 0);
 }
 
 export function buildDevAllowedOrigins({
   configuredOrigin,
-  wingmanPort,
+  extraOrigins,
 }: DevOriginBuilderOptions): string[] {
-  return Array.from(
-    new Set([
-      configuredOrigin,
-      `http://localhost:${wingmanPort}`,
-      `http://127.0.0.1:${wingmanPort}`,
-      'http://localhost:3002',
-      HOSTED_WINGMAN_ORIGIN,
-    ]),
-  );
+  return Array.from(new Set([configuredOrigin, ...parseExtraOrigins(extraOrigins)]));
 }
 
-// Production CORS allow-list. The dashboard is same-origin, but the hosted
-// Wingman gateway tester (https://wingman.manifest.build) is a legitimate
-// cross-origin caller of the gateway routes (`/v1/chat/completions`,
-// `/v1/messages`), so production must allow its origin. Exact match only, and
-// `credentials: false` at the call site keeps this safe: an allow-listed origin
-// still needs the user's own bearer key and no session cookie can ride along.
+// Production CORS allow-list: only the origins the operator configured. Exact
+// match only, and `credentials: false` at the call site keeps this safe: an
+// allow-listed origin still needs the user's own bearer key and no session
+// cookie can ride along.
 export function buildProdAllowedOrigins({ extraOrigins }: ProdOriginBuilderOptions = {}): string[] {
-  const extras = (extraOrigins ?? '')
-    .split(',')
-    // Strip a trailing slash: browser `Origin` headers never carry one, so an
-    // exact-match allow-list entry like `https://wingman.acme.dev/` would never
-    // match otherwise.
-    .map((v) => v.trim().replace(/\/+$/, ''))
-    .filter((v) => v.length > 0);
-  return Array.from(new Set([HOSTED_WINGMAN_ORIGIN, ...extras]));
-}
-
-export function buildFrameSrc({ isDev, wingmanPort }: FrameSrcOptions): string[] {
-  if (!isDev) {
-    return ["'self'"];
-  }
-  return [
-    "'self'",
-    `http://localhost:${wingmanPort}`,
-    `http://127.0.0.1:${wingmanPort}`,
-    HOSTED_WINGMAN_ORIGIN,
-  ];
+  return Array.from(new Set(parseExtraOrigins(extraOrigins)));
 }
 
 // Matches a well-formed CSP host-source: an http(s) origin with an optional
@@ -108,11 +85,11 @@ export function createCorsOriginHandler(allowedOrigins: string[]): CorsOriginHan
 
 // Preflight cache lifetime (seconds), shared by the dev and production CORS
 // paths. Without a max-age the browser re-runs the preflight — including the
-// legacy dev Private Network Access preflight — roughly every 5s, so every dashboard
-// reload (dev) or burst of Wingman requests (production) re-issues one. Each
-// round trip is another chance for a transient blip to surface as a spurious
-// CORS error. Caching the preflight collapses those repeats. 7200s (2h) is the
-// ceiling Chrome honors.
+// legacy Private Network Access preflight — roughly every 5s, so every dashboard
+// reload (dev) or burst of cross-origin requests (production) re-issues one.
+// Each round trip is another chance for a transient blip to surface as a
+// spurious CORS error. Caching the preflight collapses those repeats. 7200s
+// (2h) is the ceiling Chrome honors.
 export const CORS_PREFLIGHT_MAX_AGE_SECONDS = 7200;
 
 export interface CorsOptions {
@@ -124,12 +101,12 @@ export interface CorsOptions {
 // The exact `enableCors()` options main.ts uses (both dev and production —
 // only the allow-list differs), kept here so the e2e/unit tests exercise the
 // real shape rather than a hand-rolled copy. `credentials: false` is
-// deliberate — Wingman uses bearer keys, never cookies, so keeping credentials
-// off the cross-origin path means a misconfigured allow-list can't leak session
-// cookies. `allowedHeaders` is intentionally omitted so the cors middleware
-// reflects the request's `Access-Control-Request-Headers` (Wingman replays real
-// SDK fingerprints like the `X-Stainless-*` family; a fixed allow-list would
-// fail those preflights).
+// deliberate — gateway callers use bearer keys, never cookies, so keeping
+// credentials off the cross-origin path means a misconfigured allow-list can't
+// leak session cookies. `allowedHeaders` is intentionally omitted so the cors
+// middleware reflects the request's `Access-Control-Request-Headers` (browser
+// SDKs send fingerprints like the `X-Stainless-*` family; a fixed allow-list
+// would fail those preflights).
 export function buildCorsOptions(allowedOrigins: string[]): CorsOptions {
   return {
     origin: createCorsOriginHandler(allowedOrigins),
@@ -155,9 +132,8 @@ export function buildCorsOptions(allowedOrigins: string[]): CorsOptions {
 // `--disable-features=LocalNetworkAccessChecks`.
 //
 // The fix is not to send another header — it's to not cross the address-space
-// boundary. The dashboard's dev drawer serves Wingman from a loopback origin
-// for that reason (see packages/frontend/wingman-dev-proxy.ts). This header
-// stays because pre-138 Chrome still honours it and it costs nothing.
+// boundary. This header stays because pre-138 Chrome still honours it and it
+// costs nothing.
 //
 // Shape kept narrow on purpose: takes only the request fields read and
 // a setHeader callback so it composes with Express middleware and unit
diff --git a/packages/backend/src/database/data-source-definitions.ts b/packages/backend/src/database/data-source-definitions.ts
index 97097930..bf04eeab 100644
--- a/packages/backend/src/database/data-source-definitions.ts
+++ b/packages/backend/src/database/data-source-definitions.ts
@@ -17,7 +17,6 @@ import { TierAssignment } from '../entities/tier-assignment.entity';
 import { CustomProvider } from '../entities/custom-provider.entity';
 import { SpecificityAssignment } from '../entities/specificity-assignment.entity';
 import { HeaderTier } from '../entities/header-tier.entity';
-import { InstallMetadata } from '../entities/install-metadata.entity';
 import { BackfillState } from '../entities/backfill-state.entity';
 import { AgentModelParams } from '../entities/agent-model-params.entity';
 import { PlaygroundRun } from '../entities/playground-run.entity';
@@ -57,6 +56,7 @@ import { CoverHarnessRequestsIndex1803100000000 } from './migrations/18031000000
 import { DropBillingSchema1803200000000 } from './migrations/1803200000000-DropBillingSchema';
 import { DropSaasFeatureSchema1803300000000 } from './migrations/1803300000000-DropSaasFeatureSchema';
 import { DropAutofixSchema1803400000000 } from './migrations/1803400000000-DropAutofixSchema';
+import { DropInstallMetadata1803500000000 } from './migrations/1803500000000-DropInstallMetadata';
 import { InitialSchema1771464895790 } from './migrations/1771464895790-InitialSchema';
 import { HashApiKeys1771500000000 } from './migrations/1771500000000-HashApiKeys';
 import { ModelPricingImprovements1771600000000 } from './migrations/1771600000000-ModelPricingImprovements';
@@ -191,7 +191,6 @@ export const entities = [
   CustomProvider,
   SpecificityAssignment,
   HeaderTier,
-  InstallMetadata,
   AgentModelParams,
   PlaygroundRun,
   PlaygroundColumn,
@@ -352,4 +351,5 @@ export const migrations = [
   DropBillingSchema1803200000000,
   DropSaasFeatureSchema1803300000000,
   DropAutofixSchema1803400000000,
+  DropInstallMetadata1803500000000,
 ];
diff --git a/packages/backend/src/database/migrations/1803500000000-DropInstallMetadata.spec.ts b/packages/backend/src/database/migrations/1803500000000-DropInstallMetadata.spec.ts
new file mode 100644
index 00000000..03d2e263
--- /dev/null
+++ b/packages/backend/src/database/migrations/1803500000000-DropInstallMetadata.spec.ts
@@ -0,0 +1,39 @@
+import { DropInstallMetadata1803500000000 } from './1803500000000-DropInstallMetadata';
+
+async function run(direction: 'up' | 'down'): Promise<string[]> {
+  const query = jest.fn(async () => []);
+  await new DropInstallMetadata1803500000000()[direction]({ query } as never);
+  return query.mock.calls.map((call) => String((call as unknown[])[0]));
+}
+
+describe('DropInstallMetadata1803500000000', () => {
+  it('keeps a name ordered after the #16 schema drop', () => {
+    expect(new DropInstallMetadata1803500000000().name).toBe('DropInstallMetadata1803500000000');
+  });
+
+  it('sets a transaction-local lock timeout, then drops the table idempotently', async () => {
+    expect(await run('up')).toEqual([
+      `SET LOCAL lock_timeout = '10s'`,
+      'DROP TABLE IF EXISTS "install_metadata"',
+    ]);
+  });
+
+  it('recreates the telemetry table, empty and idempotently, on revert', async () => {
+    const sql = (await run('down')).join('\n');
+
+    expect(sql).toContain('CREATE TABLE IF NOT EXISTS "install_metadata"');
+    for (const column of [
+      '"id"',
+      '"install_id"',
+      '"created_at"',
+      '"first_send_at"',
+      '"last_sent_at"',
+    ]) {
+      expect(sql).toContain(column);
+    }
+    expect(sql).toContain('CONSTRAINT "PK_install_metadata" PRIMARY KEY ("id")');
+    expect(sql).not.toContain('autofix_consented_at');
+    expect(sql).not.toMatch(/INSERT/i);
+    expect(sql).not.toContain('SET LOCAL');
+  });
+});
diff --git a/packages/backend/src/database/migrations/1803500000000-DropInstallMetadata.ts b/packages/backend/src/database/migrations/1803500000000-DropInstallMetadata.ts
new file mode 100644
index 00000000..1614cbac
--- /dev/null
+++ b/packages/backend/src/database/migrations/1803500000000-DropInstallMetadata.ts
@@ -0,0 +1,39 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+/**
+ * Drops `install_metadata` (#17). The table only held the anonymous install id
+ * and send schedule of the removed usage telemetry (1775700000000); its last
+ * other column, the Autofix consent stamp, already left in 1803400000000.
+ * Nothing in Thinker reads or writes it, and the id it holds identified this
+ * install to Manifest's telemetry ingest, so it is not worth keeping.
+ *
+ * `IF EXISTS` keeps the drop idempotent. `lock_timeout` makes it fail fast
+ * instead of queueing behind a long-running query; a failed run is retried on
+ * the next boot.
+ *
+ * `down()` recreates the table as 1775700000000 created it, empty, so that
+ * reverting 1803400000000 next can restore its column. The old install id is
+ * not restored: it is never used again. Like the other drops, `down()` sets no
+ * `SET LOCAL`: `migration:revert` runs with `--transaction none`.
+ */
+export class DropInstallMetadata1803500000000 implements MigrationInterface {
+  name = 'DropInstallMetadata1803500000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`SET LOCAL lock_timeout = '10s'`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "install_metadata"`);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE IF NOT EXISTS "install_metadata" (
+        "id" varchar NOT NULL,
+        "install_id" varchar NOT NULL,
+        "created_at" timestamp NOT NULL DEFAULT NOW(),
+        "first_send_at" timestamp DEFAULT NULL,
+        "last_sent_at" timestamp DEFAULT NULL,
+        CONSTRAINT "PK_install_metadata" PRIMARY KEY ("id")
+      )`,
+    );
+  }
+}
diff --git a/packages/backend/src/discovery/discovery-sync.service.spec.ts b/packages/backend/src/discovery/discovery-sync.service.spec.ts
deleted file mode 100644
index 84143592..00000000
--- a/packages/backend/src/discovery/discovery-sync.service.spec.ts
+++ /dev/null
@@ -1,94 +0,0 @@
-import { isSelfHosted } from '../common/utils/detect-self-hosted';
-import { DiscoverySyncService } from './discovery-sync.service';
-
-jest.mock('../common/utils/detect-self-hosted', () => ({
-  isSelfHosted: jest.fn(),
-}));
-
-const mockIsSelfHosted = isSelfHosted as jest.MockedFunction<typeof isSelfHosted>;
-
-describe('DiscoverySyncService', () => {
-  const originalNodeEnv = process.env['NODE_ENV'];
-  const originalDiscoveryEndpoint = process.env['DISCOVERY_ENDPOINT'];
-  let service: DiscoverySyncService;
-  let fetchSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    process.env['NODE_ENV'] = 'production';
-    delete process.env['DISCOVERY_ENDPOINT'];
-    mockIsSelfHosted.mockReturnValue(true);
-    fetchSpy = jest.spyOn(globalThis, 'fetch').mockResolvedValue({ ok: true } as Response);
-    service = new DiscoverySyncService();
-  });
-
-  afterEach(() => {
-    fetchSpy.mockRestore();
-    jest.clearAllMocks();
-  });
-
-  afterAll(() => {
-    if (originalNodeEnv === undefined) delete process.env['NODE_ENV'];
-    else process.env['NODE_ENV'] = originalNodeEnv;
-    if (originalDiscoveryEndpoint === undefined) delete process.env['DISCOVERY_ENDPOINT'];
-    else process.env['DISCOVERY_ENDPOINT'] = originalDiscoveryEndpoint;
-  });
-
-  it('posts the submission to the neutral Blue ingest endpoint', async () => {
-    const submission = {
-      name: 'Jane',
-      email: 'jane@example.com',
-      projectType: 'ai_agent',
-      companySize: '1-20',
-    };
-
-    await service.submit(submission);
-
-    expect(fetchSpy).toHaveBeenCalledWith('https://blue.manifest.build/v1/self-hosted/discovery', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify(submission),
-      signal: expect.any(AbortSignal),
-    });
-  });
-
-  it('supports a local endpoint override for end-to-end testing', async () => {
-    process.env['DISCOVERY_ENDPOINT'] = ' http://127.0.0.1:39102/v1/self-hosted/discovery ';
-
-    await service.submit({ email: 'jane@example.com' });
-
-    expect(fetchSpy).toHaveBeenCalledWith(
-      'http://127.0.0.1:39102/v1/self-hosted/discovery',
-      expect.any(Object),
-    );
-  });
-
-  it('does not send Skip or whitespace-only submissions', async () => {
-    await service.submit({});
-    await service.submit({ name: '   ' });
-
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it('does not send outside a production self-hosted deployment', async () => {
-    mockIsSelfHosted.mockReturnValue(false);
-    await service.submit({ email: 'jane@example.com' });
-
-    process.env['NODE_ENV'] = 'development';
-    mockIsSelfHosted.mockReturnValue(true);
-    await service.submit({ email: 'jane@example.com' });
-
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it('does not fail completion when Peacock rejects the submission', async () => {
-    fetchSpy.mockResolvedValueOnce({ ok: false, status: 500 } as Response);
-
-    await expect(service.submit({ email: 'jane@example.com' })).resolves.toBeUndefined();
-  });
-
-  it('does not fail completion when Peacock is unreachable', async () => {
-    fetchSpy.mockRejectedValueOnce(new Error('network down'));
-
-    await expect(service.submit({ email: 'jane@example.com' })).resolves.toBeUndefined();
-  });
-});
diff --git a/packages/backend/src/discovery/discovery-sync.service.ts b/packages/backend/src/discovery/discovery-sync.service.ts
deleted file mode 100644
index 24143b45..00000000
--- a/packages/backend/src/discovery/discovery-sync.service.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { isSelfHosted } from '../common/utils/detect-self-hosted';
-import { CompleteDiscoveryDto } from './dto/complete-discovery.dto';
-
-const DEFAULT_DISCOVERY_ENDPOINT = 'https://blue.manifest.build/v1/self-hosted/discovery';
-const DISCOVERY_SYNC_TIMEOUT_MS = 10_000;
-
-@Injectable()
-export class DiscoverySyncService {
-  private readonly logger = new Logger(DiscoverySyncService.name);
-
-  async submit(submission: CompleteDiscoveryDto): Promise<void> {
-    if (!isSelfHosted() || process.env['NODE_ENV'] !== 'production') return;
-    if (!hasContent(submission)) return;
-
-    try {
-      const endpoint = process.env['DISCOVERY_ENDPOINT']?.trim() || DEFAULT_DISCOVERY_ENDPOINT;
-      const response = await fetch(endpoint, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify(submission),
-        signal: AbortSignal.timeout(DISCOVERY_SYNC_TIMEOUT_MS),
-      });
-      if (!response.ok) {
-        this.logger.warn(`Discovery sync returned ${response.status}`);
-      }
-    } catch (error) {
-      this.logger.warn(`Discovery sync failed: ${String(error)}`);
-    }
-  }
-}
-
-function hasContent(submission: CompleteDiscoveryDto): boolean {
-  return Object.values(submission).some(
-    (value) => typeof value === 'string' && value.trim().length > 0,
-  );
-}
diff --git a/packages/backend/src/discovery/discovery.controller.spec.ts b/packages/backend/src/discovery/discovery.controller.spec.ts
deleted file mode 100644
index c758d253..00000000
--- a/packages/backend/src/discovery/discovery.controller.spec.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import { DiscoveryController } from './discovery.controller';
-import type { DiscoverySyncService } from './discovery-sync.service';
-
-describe('DiscoveryController', () => {
-  it('starts a best-effort Peacock sync and returns success immediately', () => {
-    const submit = jest.fn().mockResolvedValue(undefined);
-    const controller = new DiscoveryController({ submit } as unknown as DiscoverySyncService);
-    const submission = { name: 'Jane', projectType: 'ai_agent' };
-
-    expect(controller.complete(submission)).toEqual({ ok: true });
-    expect(submit).toHaveBeenCalledWith(submission);
-  });
-});
diff --git a/packages/backend/src/discovery/discovery.controller.ts b/packages/backend/src/discovery/discovery.controller.ts
deleted file mode 100644
index 1df881cc..00000000
--- a/packages/backend/src/discovery/discovery.controller.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { Body, Controller, HttpCode, HttpStatus, Post } from '@nestjs/common';
-import { CompleteDiscoveryDto } from './dto/complete-discovery.dto';
-import { DiscoverySyncService } from './discovery-sync.service';
-
-@Controller('api/v1/discovery')
-export class DiscoveryController {
-  constructor(private readonly discoverySync: DiscoverySyncService) {}
-
-  @Post('complete')
-  @HttpCode(HttpStatus.OK)
-  complete(@Body() submission: CompleteDiscoveryDto): { ok: true } {
-    void this.discoverySync.submit(submission);
-    return { ok: true };
-  }
-}
diff --git a/packages/backend/src/discovery/discovery.module.ts b/packages/backend/src/discovery/discovery.module.ts
deleted file mode 100644
index 0d6519d0..00000000
--- a/packages/backend/src/discovery/discovery.module.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-import { Module } from '@nestjs/common';
-import { DiscoveryController } from './discovery.controller';
-import { DiscoverySyncService } from './discovery-sync.service';
-
-@Module({
-  controllers: [DiscoveryController],
-  providers: [DiscoverySyncService],
-})
-export class DiscoveryModule {}
diff --git a/packages/backend/src/discovery/dto/complete-discovery.dto.spec.ts b/packages/backend/src/discovery/dto/complete-discovery.dto.spec.ts
deleted file mode 100644
index 2094def9..00000000
--- a/packages/backend/src/discovery/dto/complete-discovery.dto.spec.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-import { plainToInstance } from 'class-transformer';
-import { validateSync } from 'class-validator';
-import { CompleteDiscoveryDto } from './complete-discovery.dto';
-
-function validate(payload: Record<string, unknown>) {
-  const dto = plainToInstance(CompleteDiscoveryDto, payload);
-  return validateSync(dto, { whitelist: true, forbidNonWhitelisted: true });
-}
-
-describe('CompleteDiscoveryDto', () => {
-  it('accepts the complete discovery payload', () => {
-    expect(
-      validate({
-        name: 'Jane Doe',
-        email: 'jane@example.com',
-        projectType: 'ai_agent',
-        companySize: '21-100',
-      }),
-    ).toHaveLength(0);
-  });
-
-  it('accepts an empty payload for Skip', () => {
-    expect(validate({})).toHaveLength(0);
-  });
-
-  it('rejects invalid select values and emails', () => {
-    const errors = validate({
-      email: 'not-an-email',
-      projectType: 'unexpected',
-      companySize: 'huge',
-    });
-
-    expect(errors.map((error) => error.property).sort()).toEqual(
-      ['email', 'projectType', 'companySize'].sort(),
-    );
-  });
-
-  it('rejects unknown fields', () => {
-    expect(validate({ newsletter: true }).map((error) => error.property)).toContain('newsletter');
-  });
-});
diff --git a/packages/backend/src/discovery/dto/complete-discovery.dto.ts b/packages/backend/src/discovery/dto/complete-discovery.dto.ts
deleted file mode 100644
index a5eae875..00000000
--- a/packages/backend/src/discovery/dto/complete-discovery.dto.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import { IsEmail, IsIn, IsOptional, IsString, MaxLength } from 'class-validator';
-
-const PROJECT_TYPES = [
-  'ai_product',
-  'ai_agent',
-  'internal_tool',
-  'workflow_platform',
-  'personal_project',
-  'other',
-] as const;
-
-const COMPANY_SIZES = ['not_for_work', '1-20', '21-100', '101-500', '501-1000', '1000+'] as const;
-
-/** Optional fields from the one-time self-hosted discovery form. */
-export class CompleteDiscoveryDto {
-  @IsOptional()
-  @IsString()
-  @MaxLength(120)
-  name?: string;
-
-  @IsOptional()
-  @IsEmail()
-  @MaxLength(254)
-  email?: string;
-
-  @IsOptional()
-  @IsIn(PROJECT_TYPES)
-  projectType?: string;
-
-  @IsOptional()
-  @IsIn(COMPANY_SIZES)
-  companySize?: string;
-}
diff --git a/packages/backend/src/entities/install-metadata.entity.ts b/packages/backend/src/entities/install-metadata.entity.ts
deleted file mode 100644
index 2a544a3f..00000000
--- a/packages/backend/src/entities/install-metadata.entity.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import { Entity, Column, PrimaryColumn } from 'typeorm';
-import { timestampType, timestampDefault } from '../common/utils/postgres-sql';
-
-/**
- * Singleton row holding the anonymous install identity used by the telemetry
- * sender. Only one row exists per installation — the PK is the literal string
- * `'singleton'` so `INSERT ... ON CONFLICT DO NOTHING` is idempotent across
- * parallel boots.
- */
-@Entity('install_metadata')
-export class InstallMetadata {
-  @PrimaryColumn('varchar')
-  id!: string;
-
-  @Column('varchar')
-  install_id!: string;
-
-  @Column(timestampType(), { default: timestampDefault() })
-  created_at!: string;
-
-  @Column(timestampType(), { nullable: true })
-  first_send_at!: string | null;
-
-  @Column(timestampType(), { nullable: true })
-  last_sent_at!: string | null;
-}
diff --git a/packages/backend/src/instrument.ts b/packages/backend/src/instrument.ts
deleted file mode 100644
index ad4e908f..00000000
--- a/packages/backend/src/instrument.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-// Sentry is opt-in on every deployment: no client is initialized unless the
-// process environment provides SENTRY_DSN.
-import * as Sentry from '@sentry/nestjs';
-import { buildSentryInitOptions } from './sentry/sentry-options';
-
-const options = buildSentryInitOptions(process.env);
-if (options) {
-  Sentry.init(options);
-}
diff --git a/packages/backend/src/main.ts b/packages/backend/src/main.ts
index 534365a1..297ad2ca 100644
--- a/packages/backend/src/main.ts
+++ b/packages/backend/src/main.ts
@@ -1,5 +1,3 @@
-// Keep this first so opt-in Sentry error monitoring initializes before Nest.
-import './instrument';
 import { NestFactory } from '@nestjs/core';
 import { ConsoleLogger, Logger, ValidationPipe } from '@nestjs/common';
 import helmet from 'helmet';
@@ -22,7 +20,6 @@ import {
   buildCorsOptions,
   buildDevAllowedOrigins,
   buildProdAllowedOrigins,
-  buildFrameSrc,
   parseFrameAncestors,
 } from './cors-csp-config';
 import { createRateLimitReachedHandler } from './common/middleware/rate-limit-log';
@@ -42,15 +39,6 @@ export async function bootstrap() {
   const hstsEnabled = /^https:\/\//i.test(betterAuthUrl);
   const isDev = process.env['NODE_ENV'] !== 'production';
 
-  // The Wingman drawer is a dev-only affordance — `frame-src` only loosens
-  // up when NODE_ENV !== 'production' to allow the hosted Wingman SPA
-  // (https://wingman.manifest.build) and locally-running Wingman builds
-  // at `WINGMAN_PORT` (defaults to backend port + 1). Docker / cloud
-  // builds keep the strict 'self'-only frame policy.
-  const backendPort = Number(process.env['PORT']) || 3001;
-  const wingmanPort = Number(process.env['WINGMAN_PORT']) || backendPort + 1;
-  const frameSrc = buildFrameSrc({ isDev, wingmanPort });
-
   app.use(
     helmet({
       hsts: hstsEnabled,
@@ -63,7 +51,7 @@ export async function bootstrap() {
           connectSrc: ["'self'"],
           fontSrc: ["'self'"],
           objectSrc: ["'none'"],
-          frameSrc,
+          frameSrc: ["'self'"],
           frameAncestors: parseFrameAncestors(process.env['FRAME_ANCESTORS']),
           // Disable helmet's default `upgrade-insecure-requests`: it breaks
           // HTTP-only LAN deployments (10.x / 192.168.x / 172.16-31.x) where
@@ -81,21 +69,19 @@ export async function bootstrap() {
   // the package's default content-type filter.
   app.use(compression({ filter: shouldCompress }));
 
-  // CORS: the dashboard is same-origin, but the hosted Wingman gateway tester
-  // (https://wingman.manifest.build) is a legitimate cross-origin caller of the
-  // gateway routes, so both dev and production allow its origin. Dev also allows
-  // the Vite frontend on :3000 and the local Wingman build at `WINGMAN_PORT`;
-  // production allows the hosted Wingman origin plus any `WINGMAN_CORS_ORIGINS` a
-  // self-hoster opts into.
+  // CORS: the dashboard is same-origin, so production allows no cross-origin
+  // browser caller unless the operator lists it in `THINKER_CORS_ORIGINS`. Dev
+  // also allows the Vite frontend (`CORS_ORIGIN`, default :3000).
   //
   // See `buildCorsOptions` for the rationale behind `credentials: false`, the
   // omitted `allowedHeaders`, and the preflight `maxAge`.
+  const extraCorsOrigins = process.env['THINKER_CORS_ORIGINS'];
   const corsAllowedOrigins = isDev
     ? buildDevAllowedOrigins({
         configuredOrigin: process.env['CORS_ORIGIN'] || 'http://localhost:3000',
-        wingmanPort,
+        extraOrigins: extraCorsOrigins,
       })
-    : buildProdAllowedOrigins({ extraOrigins: process.env['WINGMAN_CORS_ORIGINS'] });
+    : buildProdAllowedOrigins({ extraOrigins: extraCorsOrigins });
   // Legacy Private Network Access support, for browsers older than Chrome 138.
   // Newer Chrome replaced PNA with Local Network Access, a user permission that
   // no response header can satisfy — so this does *not* fix a blocked
diff --git a/packages/backend/src/routing/routing-core/__tests__/provider-param-spec.service.spec.ts b/packages/backend/src/routing/routing-core/__tests__/provider-param-spec.service.spec.ts
index 8f7f3860..407e439f 100644
--- a/packages/backend/src/routing/routing-core/__tests__/provider-param-spec.service.spec.ts
+++ b/packages/backend/src/routing/routing-core/__tests__/provider-param-spec.service.spec.ts
@@ -1,4 +1,7 @@
-import { ProviderParamSpecService } from '../provider-param-spec.service';
+import {
+  ProviderParamSpecService,
+  parseModelParametersCatalog,
+} from '../provider-param-spec.service';
 
 describe('ProviderParamSpecService', () => {
   it('loads model parameter specs from the modelparams package without network fetches', async () => {
@@ -202,141 +205,91 @@ describe('ProviderParamSpecService', () => {
   });
 });
 
-describe('ProviderParamSpecService API refresh', () => {
-  const CATALOG_BODY = JSON.stringify({
-    models: [
-      {
-        provider: 'openai',
-        authType: 'api_key',
-        model: 'gpt-refreshed',
-        params: [
-          {
-            path: 'max_tokens',
-            type: 'integer',
-            label: 'Max tokens',
-            description: 'Maximum number of tokens.',
-            group: 'generation_length',
-          },
-        ],
-      },
-    ],
-  });
-
-  const jsonResponse = (body: string, init?: ResponseInit): Response =>
-    new Response(body, { status: 200, ...init });
-
-  let fetchSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    fetchSpy = jest.spyOn(globalThis, 'fetch');
-  });
-
-  afterEach(() => {
-    fetchSpy.mockRestore();
-    delete process.env.MODELPARAMS_API_DISABLED;
-    delete process.env.MODELPARAMS_API_URL;
-  });
-
-  it('swaps in a fetched catalog and remembers its ETag', async () => {
-    fetchSpy.mockResolvedValue(jsonResponse(CATALOG_BODY, { headers: { etag: '"v1"' } }));
-    const service = new ProviderParamSpecService();
-
-    await expect(service.refreshCatalog()).resolves.toBe(true);
-    const specs = await service.getSpecs('openai', 'api_key', 'gpt-refreshed');
-    expect(specs.map((spec) => spec.path)).toEqual(['max_tokens']);
-
-    fetchSpy.mockResolvedValue(new Response(null, { status: 304 }));
-    await expect(service.refreshCatalog()).resolves.toBe(false);
-    const [, secondInit] = fetchSpy.mock.calls[1] as [string, RequestInit];
-    expect(secondInit.headers).toEqual({ 'if-none-match': '"v1"' });
-    // The 304 keeps the previously fetched catalog.
-    expect((await service.getSpecs('openai', 'api_key', 'gpt-refreshed')).length).toBe(1);
-  });
-
-  it('honors MODELPARAMS_API_URL and sends no conditional header on the first fetch', async () => {
-    process.env.MODELPARAMS_API_URL = 'https://example.test/catalog.json';
-    fetchSpy.mockResolvedValue(jsonResponse(CATALOG_BODY));
-    const service = new ProviderParamSpecService();
-
-    await expect(service.refreshCatalog()).resolves.toBe(true);
-    const [url, init] = fetchSpy.mock.calls[0] as [string, RequestInit];
-    expect(url).toBe('https://example.test/catalog.json');
-    expect(init.headers).toBeUndefined();
-  });
-
-  it('does nothing when MODELPARAMS_API_DISABLED is set', async () => {
-    process.env.MODELPARAMS_API_DISABLED = 'true';
-    const service = new ProviderParamSpecService();
-
-    await expect(service.refreshCatalog()).resolves.toBe(false);
-    expect(fetchSpy).not.toHaveBeenCalled();
+describe('ProviderParamSpecService bundled snapshot only (#17)', () => {
+  it('never fetches the catalog: no boot hook, no scheduled refresh, no network call', async () => {
+    const fetchSpy = jest.spyOn(globalThis, 'fetch');
+    try {
+      const service = new ProviderParamSpecService() as unknown as Record<string, unknown>;
+
+      expect(service['onModuleInit']).toBeUndefined();
+      expect(service['scheduledRefresh']).toBeUndefined();
+      expect(service['refreshCatalog']).toBeUndefined();
+      await (service as unknown as ProviderParamSpecService).list();
+      expect(fetchSpy).not.toHaveBeenCalled();
+    } finally {
+      fetchSpy.mockRestore();
+    }
   });
+});
 
-  it('shares one in-flight refresh between concurrent callers', async () => {
-    let release!: (value: Response) => void;
-    fetchSpy.mockReturnValue(
-      new Promise<Response>((resolve) => {
-        release = resolve;
-      }),
-    );
-    const service = new ProviderParamSpecService();
-
-    const first = service.refreshCatalog();
-    const second = service.refreshCatalog();
-    release(jsonResponse(CATALOG_BODY));
-    await expect(Promise.all([first, second])).resolves.toEqual([true, true]);
-    expect(fetchSpy).toHaveBeenCalledTimes(1);
+describe('parseModelParametersCatalog', () => {
+  const validParam = {
+    path: 'max_tokens',
+    type: 'integer',
+    label: 'Max tokens',
+    description: 'Maximum number of tokens.',
+    group: 'generation_length',
+  };
+  const entry = (overrides: Record<string, unknown> = {}) => ({
+    provider: 'openai',
+    authType: 'api_key',
+    model: 'gpt-test',
+    params: [validParam],
+    ...overrides,
   });
 
   it.each([
-    ['a network error', () => fetchSpy.mockRejectedValue(new Error('boom'))],
-    ['a non-2xx status', () => fetchSpy.mockResolvedValue(new Response('nope', { status: 503 }))],
-    ['invalid JSON', () => fetchSpy.mockResolvedValue(jsonResponse('{not json'))],
-    ['an empty body', () => fetchSpy.mockResolvedValue(new Response(null, { status: 200 }))],
-    [
-      'a body that fails catalog validation',
-      () => fetchSpy.mockResolvedValue(jsonResponse(JSON.stringify({ models: 'wat' }))),
-    ],
-  ])('keeps the bundled catalog on %s', async (_label, arm) => {
-    arm();
-    const service = new ProviderParamSpecService();
-
-    await expect(service.refreshCatalog()).resolves.toBe(false);
-    const specs = await service.getSpecs('openai', 'api_key', 'gpt-4o');
-    expect(specs.length).toBeGreaterThan(0);
+    ['a non-object body', 'wat'],
+    ['an array body', []],
+    ['a body without models', {}],
+    ['a non-array models field', { models: 'wat' }],
+    ['a body with no usable entry', { models: [entry({ authType: 'bogus' })] }],
+  ])('rejects %s', (_label, raw) => {
+    expect(parseModelParametersCatalog(raw)).toBeNull();
   });
 
-  it('rejects an oversized Content-Length without reading the body', async () => {
-    const response = jsonResponse(CATALOG_BODY, {
-      headers: { 'content-length': String(17 * 1024 * 1024) },
+  it('keeps valid entries and drops malformed ones', () => {
+    const catalog = parseModelParametersCatalog({
+      models: [
+        entry(),
+        entry({ model: '' }),
+        entry({ provider: 42 }),
+        entry({ params: 'wat' }),
+        entry({ model: 'only-bad-params', params: [{ ...validParam, type: 'nope' }] }),
+        entry({ model: 'bad-capability', capabilities: ['not-a-capability'] }),
+      ],
     });
-    fetchSpy.mockResolvedValue(response);
-    const service = new ProviderParamSpecService();
-
-    await expect(service.refreshCatalog()).resolves.toBe(false);
-    expect(response.bodyUsed).toBe(false);
+    expect(catalog?.map((e) => e.model)).toEqual(['gpt-test']);
   });
 
-  it('keeps the bundled catalog when reading the response body throws', async () => {
-    const stream = new ReadableStream<Uint8Array>({
-      start(controller) {
-        controller.error(new Error('socket reset'));
-      },
+  it('drops API-level params, enums without values and invalid defaults', () => {
+    const catalog = parseModelParametersCatalog({
+      models: [
+        entry({
+          params: [
+            validParam,
+            { ...validParam, path: 'stream', type: 'boolean' },
+            { ...validParam, path: 'reasoning_effort', type: 'enum', group: 'reasoning' },
+            {
+              ...validParam,
+              path: 'temperature',
+              type: 'number',
+              range: { min: 0, max: 2 },
+              default: 5,
+            },
+            { ...validParam, path: 'top_p', type: 'number', range: { step: 0 } },
+          ],
+        }),
+      ],
     });
-    fetchSpy.mockResolvedValue(new Response(stream, { status: 200 }));
-    const service = new ProviderParamSpecService();
-
-    await expect(service.refreshCatalog()).resolves.toBe(false);
+    expect(catalog?.[0].params.map((p) => p.path)).toEqual(['max_tokens']);
   });
 
-  it('refreshes on module init and on the cron tick, surviving failures', async () => {
-    fetchSpy.mockRejectedValue(new Error('offline'));
-    const service = new ProviderParamSpecService();
-
-    service.onModuleInit();
-    await service.scheduledRefresh();
-    expect(fetchSpy).toHaveBeenCalled();
-    // Both paths swallow the failure; the bundled catalog still serves.
-    expect((await service.list()).length).toBeGreaterThan(0);
+  it('accepts a capability-only entry', () => {
+    const catalog = parseModelParametersCatalog({
+      models: [entry({ params: undefined, capabilities: ['tools', 'tools'] })],
+    });
+    expect(catalog?.[0].capabilities).toEqual(['tools']);
+    expect(catalog?.[0].params).toEqual([]);
   });
 });
diff --git a/packages/backend/src/routing/routing-core/provider-param-spec.service.ts b/packages/backend/src/routing/routing-core/provider-param-spec.service.ts
index ffdca88b..df517727 100644
--- a/packages/backend/src/routing/routing-core/provider-param-spec.service.ts
+++ b/packages/backend/src/routing/routing-core/provider-param-spec.service.ts
@@ -1,8 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { dirname, join } from 'node:path';
-import { Injectable, Logger, type OnModuleInit } from '@nestjs/common';
-import { Cron } from '@nestjs/schedule';
+import { Injectable } from '@nestjs/common';
 import {
   AUTH_TYPES,
   MODEL_CAPABILITIES,
@@ -29,10 +28,6 @@ import {
 
 const MODELPARAMS_PACKAGE_JSON = 'modelparams/package.json';
 const MODELPARAMS_DATA_RELATIVE_PATH = 'dist/generated/data.js';
-const MODELPARAMS_API_DEFAULT_URL = 'https://modelparams.dev/api/v1/models.json';
-const MODELPARAMS_API_TIMEOUT_MS = 10000;
-/** Sanity bound on the buffered payload; today's catalog is ~0.6 MB. */
-const MODELPARAMS_API_MAX_BYTES = 16 * 1024 * 1024;
 const SUBSCRIPTION_MODEL_SUFFIX = '-subscription';
 const SHORT_CLAUDE_MODEL_RE = /^claude-(opus|sonnet|haiku)-/i;
 const DOTTED_CLAUDE_MINOR_RE = /-(\d+)\.(\d{1,2})(?=$|-\d{8}$)/g;
@@ -62,7 +57,7 @@ const MOONSHOT_PARAM_MODEL_ALIASES: Readonly<Record<string, string>> = {
   'kimi-for-coding-highspeed': 'kimi-k2.7-code-highspeed',
 };
 
-interface ModelParametersApiResponse {
+interface ModelParametersCatalogData {
   models?: unknown;
 }
 
@@ -74,103 +69,13 @@ interface ProviderlessModelParamCandidate {
 const requireFromThisModule = createRequire(__filename);
 
 @Injectable()
-export class ProviderParamSpecService implements OnModuleInit {
-  private readonly logger = new Logger(ProviderParamSpecService.name);
+export class ProviderParamSpecService {
   /**
-   * Seeded synchronously from the bundled modelparams package so the service
-   * always has a catalog (offline installs, API outages, cold boots), then
-   * kept fresh from the modelparams.dev API.
+   * Loaded synchronously from the `modelparams` package bundled with this
+   * build. Thinker never fetches the catalog at runtime (#17, ADR 0003): the
+   * snapshot moves forward with dependency updates.
    */
-  private specs: ProviderParamSpecCatalog = loadModelparamsCatalog();
-  private catalogEtag: string | null = null;
-  private refreshInFlight: Promise<boolean> | null = null;
-
-  onModuleInit(): void {
-    // Fire-and-forget so a slow modelparams.dev fetch can't delay app.listen()
-    // (same rationale as ModelsDevSyncService — see #1894). refreshCatalog
-    // never rejects, so no dangling rejection to handle here.
-    void this.refreshCatalog();
-  }
-
-  /** Hourly, off the top of the hour to avoid stampeding the CDN with every deploy. */
-  @Cron('34 * * * *')
-  async scheduledRefresh(): Promise<void> {
-    await this.refreshCatalog();
-  }
-
-  /**
-   * Fetch the live catalog from modelparams.dev and swap it in atomically.
-   * Conditional on the last ETag (304 = no work), validated before the swap,
-   * and stale-on-error: any failure keeps the current catalog. Never rejects.
-   * Returns true when a new catalog was applied.
-   */
-  refreshCatalog(): Promise<boolean> {
-    if (process.env.MODELPARAMS_API_DISABLED === 'true') return Promise.resolve(false);
-    // Concurrent callers share one in-flight refresh instead of racing the swap.
-    if (this.refreshInFlight) return this.refreshInFlight;
-    this.refreshInFlight = this.fetchAndSwapCatalog()
-      .catch((err: unknown) => {
-        this.logger.warn(`modelparams catalog refresh failed, keeping current catalog: ${err}`);
-        return false;
-      })
-      .finally(() => {
-        this.refreshInFlight = null;
-      });
-    return this.refreshInFlight;
-  }
-
-  private async fetchAndSwapCatalog(): Promise<boolean> {
-    const url = process.env.MODELPARAMS_API_URL ?? MODELPARAMS_API_DEFAULT_URL;
-    let response: Response;
-    try {
-      response = await fetch(url, {
-        headers: this.catalogEtag ? { 'if-none-match': this.catalogEtag } : undefined,
-        signal: AbortSignal.timeout(MODELPARAMS_API_TIMEOUT_MS),
-      });
-    } catch (err) {
-      this.logger.warn(`modelparams catalog fetch failed, keeping current catalog: ${err}`);
-      return false;
-    }
-
-    if (response.status === 304) return false;
-    if (!response.ok) {
-      this.logger.warn(
-        `modelparams catalog fetch returned ${response.status}, keeping current catalog`,
-      );
-      return false;
-    }
-
-    // Reject an oversized declared payload before buffering it. A chunked or
-    // lying response is deliberately left to the 10s AbortSignal (which also
-    // bounds body consumption) rather than a streaming byte cap — this is our
-    // own CDN, and the simplicity is worth the residual risk.
-    if (Number(response.headers.get('content-length')) > MODELPARAMS_API_MAX_BYTES) {
-      this.logger.warn(
-        `modelparams catalog response declares more than ${MODELPARAMS_API_MAX_BYTES} bytes, keeping current catalog`,
-      );
-      return false;
-    }
-    const body = await response.text();
-
-    let raw: unknown;
-    try {
-      raw = JSON.parse(body) as unknown;
-    } catch {
-      this.logger.warn('modelparams catalog response is not valid JSON, keeping current catalog');
-      return false;
-    }
-
-    const catalog = parseModelParametersCatalog(raw);
-    if (!catalog) {
-      this.logger.warn('modelparams catalog response failed validation, keeping current catalog');
-      return false;
-    }
-
-    this.specs = freezeCatalog(catalog);
-    this.catalogEtag = response.headers.get('etag');
-    this.logger.log(`modelparams catalog refreshed: ${catalog.length} entries`);
-    return true;
-  }
+  private readonly specs: ProviderParamSpecCatalog = loadModelparamsCatalog();
 
   async list(): Promise<ProviderParamSpecCatalog> {
     return this.specs;
@@ -426,9 +331,13 @@ function freezeCatalog(catalog: ProviderParamSpecCatalog): ProviderParamSpecCata
   );
 }
 
-function parseModelParametersCatalog(raw: unknown): ProviderParamSpecCatalog | null {
+/**
+ * Validates the bundled catalog data: malformed entries and params are dropped,
+ * and a body with no usable entry yields null. Exported for tests.
+ */
+export function parseModelParametersCatalog(raw: unknown): ProviderParamSpecCatalog | null {
   if (!isRecord(raw)) return null;
-  const models = (raw as ModelParametersApiResponse).models;
+  const models = (raw as ModelParametersCatalogData).models;
   if (!Array.isArray(models)) return null;
 
   const catalog: ProviderModelParamSpec[] = [];
diff --git a/packages/backend/src/sentry/__tests__/debug-sentry.controller.spec.ts b/packages/backend/src/sentry/__tests__/debug-sentry.controller.spec.ts
deleted file mode 100644
index 44865938..00000000
--- a/packages/backend/src/sentry/__tests__/debug-sentry.controller.spec.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-import { DebugSentryController } from '../debug-sentry.controller';
-
-describe('DebugSentryController', () => {
-  it('throws a test error', () => {
-    expect(() => new DebugSentryController().getError()).toThrow('My first Sentry error!');
-  });
-});
diff --git a/packages/backend/src/sentry/__tests__/sentry-options.spec.ts b/packages/backend/src/sentry/__tests__/sentry-options.spec.ts
deleted file mode 100644
index 8790d257..00000000
--- a/packages/backend/src/sentry/__tests__/sentry-options.spec.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-import { buildSentryInitOptions } from '../sentry-options';
-
-describe('buildSentryInitOptions', () => {
-  it('returns null when SENTRY_DSN is unset', () => {
-    expect(buildSentryInitOptions({})).toBeNull();
-  });
-
-  it('returns null when SENTRY_DSN is only whitespace', () => {
-    expect(buildSentryInitOptions({ SENTRY_DSN: '   ' })).toBeNull();
-  });
-
-  it('builds error-only options without request-derived data', () => {
-    const opts = buildSentryInitOptions({
-      SENTRY_DSN: 'https://key@o1.ingest.sentry.io/1',
-      NODE_ENV: 'production',
-    });
-
-    expect(opts).not.toBeNull();
-    expect(opts!.dsn).toBe('https://key@o1.ingest.sentry.io/1');
-    expect(opts!.environment).toBe('production');
-    expect(opts!.release).toBeUndefined();
-    expect(opts!.tracesSampleRate).toBeUndefined();
-    expect(opts!.maxBreadcrumbs).toBe(0);
-    expect(opts!.dataCollection).toEqual({
-      userInfo: false,
-      cookies: false,
-      httpHeaders: { request: false, response: false },
-      httpBodies: [],
-      queryParams: false,
-      genAI: { inputs: false, outputs: false },
-      stackFrameVariables: false,
-      frameContextLines: 5,
-    });
-  });
-
-  it('falls back to "development" environment when NODE_ENV is unset', () => {
-    const opts = buildSentryInitOptions({ SENTRY_DSN: 'https://key@o1.ingest.sentry.io/1' });
-    expect(opts!.environment).toBe('development');
-  });
-
-  it('honors environment and release overrides', () => {
-    const opts = buildSentryInitOptions({
-      SENTRY_DSN: 'https://key@o1.ingest.sentry.io/1',
-      NODE_ENV: 'production',
-      SENTRY_ENVIRONMENT: 'staging',
-      SENTRY_RELEASE: 'v1.2.3',
-    });
-
-    expect(opts!.environment).toBe('staging');
-    expect(opts!.release).toBe('v1.2.3');
-  });
-});
diff --git a/packages/backend/src/sentry/debug-sentry.controller.ts b/packages/backend/src/sentry/debug-sentry.controller.ts
deleted file mode 100644
index 54e7ecf3..00000000
--- a/packages/backend/src/sentry/debug-sentry.controller.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { Controller, Get } from '@nestjs/common';
-import { Public } from '../common/decorators/public.decorator';
-
-@Controller('api/v1')
-export class DebugSentryController {
-  @Public()
-  @Get('debug-sentry')
-  getError(): never {
-    throw new Error('My first Sentry error!');
-  }
-}
diff --git a/packages/backend/src/sentry/sentry-options.ts b/packages/backend/src/sentry/sentry-options.ts
deleted file mode 100644
index 43b78597..00000000
--- a/packages/backend/src/sentry/sentry-options.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import type { NodeOptions } from '@sentry/nestjs';
-
-/**
- * Build Sentry error-monitoring options, or return `null` when disabled.
- *
- * Sentry is opt-in on every deployment. No client is initialized unless the
- * process environment provides `SENTRY_DSN`.
- */
-export function buildSentryInitOptions(env: NodeJS.ProcessEnv): NodeOptions | null {
-  const dsn = env['SENTRY_DSN']?.trim();
-  if (!dsn) return null;
-
-  return {
-    dsn,
-    environment: env['SENTRY_ENVIRONMENT']?.trim() || env['NODE_ENV'] || 'development',
-    release: env['SENTRY_RELEASE']?.trim() || undefined,
-    maxBreadcrumbs: 0,
-    dataCollection: {
-      userInfo: false,
-      cookies: false,
-      httpHeaders: { request: false, response: false },
-      httpBodies: [],
-      queryParams: false,
-      genAI: { inputs: false, outputs: false },
-      stackFrameVariables: false,
-      frameContextLines: 5,
-    },
-  };
-}
diff --git a/packages/backend/src/telemetry/dto/telemetry-payload.ts b/packages/backend/src/telemetry/dto/telemetry-payload.ts
deleted file mode 100644
index dca5fc10..00000000
--- a/packages/backend/src/telemetry/dto/telemetry-payload.ts
+++ /dev/null
@@ -1,101 +0,0 @@
-/**
- * Shape of the payload POSTed once per 24h from a self-hosted install to the
- * ingest endpoint. All fields are derived aggregates — no per-request events,
- * no identifiers beyond the random `install_id` and the Manifest version.
- * Additive changes keep `schema_version: 1`; breaking changes bump it.
- *
- * Optional fields are flagged as such because installs running older Manifest
- * versions emit a strict subset. Receivers should feature-detect on presence,
- * not on `schema_version`.
- */
-export interface TelemetryPayloadV1 {
-  schema_version: 1;
-  install_id: string;
-  manifest_version: string;
-
-  // Activity
-  messages_total: number;
-  messages_by_provider: Record<string, number>;
-  messages_by_tier: Record<string, number>;
-  messages_by_auth_type: Record<string, number>;
-
-  // Volume
-  tokens_input_total: number;
-  tokens_output_total: number;
-
-  /**
-   * Total dollar value flowing through the install over the 24h window,
-   * summed from the same `cost_usd` Manifest computes at routing time.
-   * Rounded to cents to avoid leaking precision. Always present on installs
-   * that ship this field — `0` when nothing chargeable was routed (e.g.
-   * Ollama-only fleets). Optional in the DTO because older installs predate
-   * the field; absence means "fall back to estimating from token counts".
-   */
-  cost_usd_total?: number;
-
-  /**
-   * Per-provider breakdown of `cost_usd_total`, keyed by the same canonical
-   * provider buckets as `messages_by_provider` (registry ID for known
-   * providers, `"custom"` for user-defined ones, `"unknown"` for legacy
-   * NULLs). Values rounded to cents. Empty `{}` when no chargeable rows.
-   */
-  cost_usd_by_provider?: Record<string, number>;
-
-  /**
-   * Caller requests over the 24h window (request-first model: one row per
-   * caller call; provider retries/fallbacks are attempts under it and are
-   * NOT counted here). Optional because older installs predate the field.
-   */
-  requests_total?: number;
-
-  /**
-   * Requests that ended `failed` over the same window. Together with
-   * `errors_by_class` this gives the receiver error visibility.
-   */
-  errors_total?: number;
-
-  /**
-   * Per-`error_class` split of `errors_total`, using the shared taxonomy
-   * (`rate_limit`, `auth`, `invalid_request`, ...). Unknown values collapse
-   * to `"other"` and unclassified NULLs to `"unknown"` — same
-   * defense-in-depth as the tier map.
-   */
-  errors_by_class?: Record<string, number>;
-
-  // Configuration
-  agents_total: number;
-  agents_by_platform: Record<string, number>;
-
-  // Management surfaces (CLI + remote MCP). All derived from existing tables at
-  // send time; nothing is counted per call. Optional because older installs
-  // predate the fields.
-
-  /** PATs minted by `mnfst login` (rows of `api_keys` named `cli`). */
-  cli_keys_total?: number;
-  /** Of those, keys that authenticated at least once in the last 7 days. */
-  cli_keys_active_7d?: number;
-
-  /** OAuth clients registered against the remote MCP server (not disabled). */
-  mcp_clients_total?: number;
-  /** Consent grants users gave to those clients. */
-  mcp_consents_total?: number;
-  /**
-   * Access tokens minted in the 24h window. Tokens live 15 minutes, so an
-   * actively used MCP session mints ~4/hour — this is the activity proxy
-   * that stands in for a per-tool-call counter.
-   */
-  mcp_tokens_issued_24h?: number;
-  /** Distinct clients that minted at least one access token in the window. */
-  mcp_clients_active_24h?: number;
-  /**
-   * Registered clients keyed by their declared name, whitelisted to known MCP
-   * hosts (`claude-code`, `cursor`, …). Anything else collapses to `"other"`
-   * and a missing name to `"unknown"`, so a free-form client name never
-   * leaves the install.
-   */
-  mcp_clients_by_name?: Record<string, number>;
-
-  // Runtime
-  platform: string;
-  arch: string;
-}
diff --git a/packages/backend/src/telemetry/install-id.service.spec.ts b/packages/backend/src/telemetry/install-id.service.spec.ts
deleted file mode 100644
index b6137617..00000000
--- a/packages/backend/src/telemetry/install-id.service.spec.ts
+++ /dev/null
@@ -1,122 +0,0 @@
-import { Test, TestingModule } from '@nestjs/testing';
-import { getRepositoryToken } from '@nestjs/typeorm';
-import { InstallMetadata } from '../entities/install-metadata.entity';
-import { InstallIdService, SINGLETON_ID } from './install-id.service';
-
-describe('InstallIdService', () => {
-  let service: InstallIdService;
-  let findOne: jest.Mock;
-  let update: jest.Mock;
-  let execute: jest.Mock;
-  let values: jest.Mock;
-
-  const rowTemplate: InstallMetadata = {
-    id: SINGLETON_ID,
-    install_id: '00000000-0000-0000-0000-000000000000',
-    created_at: '2026-04-20T00:00:00',
-    first_send_at: null,
-    last_sent_at: null,
-  };
-
-  beforeEach(async () => {
-    findOne = jest.fn();
-    update = jest.fn().mockResolvedValue({ affected: 1 });
-    execute = jest.fn().mockResolvedValue({ raw: [] });
-
-    values = jest.fn().mockReturnThis();
-    const qb = {
-      insert: jest.fn().mockReturnThis(),
-      into: jest.fn().mockReturnThis(),
-      values,
-      orIgnore: jest.fn().mockReturnThis(),
-      execute,
-    };
-
-    const module: TestingModule = await Test.createTestingModule({
-      providers: [
-        InstallIdService,
-        {
-          provide: getRepositoryToken(InstallMetadata),
-          useValue: {
-            findOne,
-            update,
-            createQueryBuilder: () => qb,
-          },
-        },
-      ],
-    }).compile();
-
-    service = module.get(InstallIdService);
-  });
-
-  describe('getOrCreate', () => {
-    it('returns the existing singleton row without inserting', async () => {
-      findOne.mockResolvedValueOnce(rowTemplate);
-
-      const result = await service.getOrCreate();
-
-      expect(result).toBe(rowTemplate);
-      expect(execute).not.toHaveBeenCalled();
-    });
-
-    it('inserts a new singleton row when none exists and returns it', async () => {
-      findOne
-        .mockResolvedValueOnce(null)
-        .mockResolvedValueOnce({ ...rowTemplate, install_id: 'freshly-created-uuid' });
-
-      const result = await service.getOrCreate();
-
-      expect(execute).toHaveBeenCalledTimes(1);
-      expect(result.install_id).toBe('freshly-created-uuid');
-    });
-
-    it('throws if the row is still missing after the upsert (should never happen)', async () => {
-      findOne.mockResolvedValue(null);
-
-      await expect(service.getOrCreate()).rejects.toThrow(/missing after upsert/);
-    });
-
-    it('inserts first_send_at within the next 24h (jitter)', async () => {
-      findOne.mockResolvedValueOnce(null).mockResolvedValueOnce(rowTemplate);
-      const before = Date.now();
-
-      await service.getOrCreate();
-
-      const inserted = values.mock.calls[0]?.[0] as { first_send_at: string };
-      expect(inserted.first_send_at).toBeDefined();
-      const fsa = new Date(inserted.first_send_at).getTime();
-      expect(fsa).toBeGreaterThanOrEqual(before);
-      expect(fsa).toBeLessThanOrEqual(Date.now() + 24 * 60 * 60 * 1000);
-    });
-
-    it('picks a different first_send_at on successive calls (jitter is random)', async () => {
-      // Two fresh services that each insert — the first_send_at values
-      // should differ because Math.random is seeded per-call. A regression
-      // that always returned `Date.now()` would make them equal.
-      findOne.mockResolvedValueOnce(null).mockResolvedValueOnce(rowTemplate);
-      await service.getOrCreate();
-      const first = (values.mock.calls[0]?.[0] as { first_send_at: string }).first_send_at;
-
-      values.mockClear();
-      findOne.mockReset();
-      findOne.mockResolvedValueOnce(null).mockResolvedValueOnce(rowTemplate);
-      // Force a different Math.random bucket so the test is deterministic.
-      const spy = jest.spyOn(Math, 'random').mockReturnValue(0.999);
-      await service.getOrCreate();
-      const second = (values.mock.calls[0]?.[0] as { first_send_at: string }).first_send_at;
-      spy.mockRestore();
-
-      expect(second).not.toBe(first);
-    });
-  });
-
-  describe('markSent', () => {
-    it('updates last_sent_at on the singleton row', async () => {
-      const now = new Date('2026-04-20T12:00:00Z');
-
-      await service.markSent(now);
-
-      expect(update).toHaveBeenCalledWith(SINGLETON_ID, { last_sent_at: now.toISOString() });
-    });
-  });
-});
diff --git a/packages/backend/src/telemetry/install-id.service.ts b/packages/backend/src/telemetry/install-id.service.ts
deleted file mode 100644
index a5c4231b..00000000
--- a/packages/backend/src/telemetry/install-id.service.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-import { Injectable } from '@nestjs/common';
-import { InjectRepository } from '@nestjs/typeorm';
-import { randomUUID } from 'crypto';
-import { Repository } from 'typeorm';
-import { InstallMetadata } from '../entities/install-metadata.entity';
-
-export const SINGLETON_ID = 'singleton';
-
-@Injectable()
-export class InstallIdService {
-  constructor(
-    @InjectRepository(InstallMetadata)
-    private readonly repo: Repository<InstallMetadata>,
-  ) {}
-
-  async getOrCreate(): Promise<InstallMetadata> {
-    const existing = await this.repo.findOne({ where: { id: SINGLETON_ID } });
-    if (existing) return existing;
-
-    // `orIgnore()` handles the parallel-boot race: if two workers race on
-    // first boot, only one row wins and the other silently no-ops.
-    await this.repo
-      .createQueryBuilder()
-      .insert()
-      .into(InstallMetadata)
-      .values({
-        id: SINGLETON_ID,
-        install_id: randomUUID(),
-        first_send_at: this.computeFirstSendAt(),
-        last_sent_at: null,
-      })
-      .orIgnore()
-      .execute();
-
-    const row = await this.repo.findOne({ where: { id: SINGLETON_ID } });
-    if (!row) throw new Error('install_metadata row missing after upsert');
-    return row;
-  }
-
-  async markSent(now: Date): Promise<void> {
-    await this.repo.update(SINGLETON_ID, { last_sent_at: now.toISOString() });
-  }
-
-  /**
-   * Random 0–24h offset on first boot. Prevents a fleet of installs booted
-   * via a rolling upgrade from all hitting the ingest at the same minute.
-   */
-  private computeFirstSendAt(): string {
-    const jitterMs = Math.floor(Math.random() * 24 * 60 * 60 * 1000);
-    return new Date(Date.now() + jitterMs).toISOString();
-  }
-}
diff --git a/packages/backend/src/telemetry/payload-builder.service.spec.ts b/packages/backend/src/telemetry/payload-builder.service.spec.ts
deleted file mode 100644
index b138e753..00000000
--- a/packages/backend/src/telemetry/payload-builder.service.spec.ts
+++ /dev/null
@@ -1,642 +0,0 @@
-import { Test, TestingModule } from '@nestjs/testing';
-import { getRepositoryToken } from '@nestjs/typeorm';
-import { Agent } from '../entities/agent.entity';
-import { ApiKey } from '../entities/api-key.entity';
-import { AgentMessage } from '../entities/agent-message.entity';
-import { ManifestRequest } from '../entities/request.entity';
-import { PayloadBuilderService } from './payload-builder.service';
-
-interface ProviderRow {
-  provider: string | null;
-  count: string;
-  cost?: string | null;
-}
-interface BucketRow {
-  bucket: string | null;
-  count: string;
-}
-interface CategoryPlatformRow {
-  category: string | null;
-  platform: string | null;
-  count: string;
-}
-interface TotalsRow {
-  total: string;
-  input_tokens: string | null;
-  output_tokens: string | null;
-  cost?: string | null;
-}
-
-interface RequestTotalsRow {
-  total: string;
-  failed: string | null;
-}
-
-interface CliKeyRow {
-  total: string;
-  active: string | null;
-}
-interface McpCountsRow {
-  clients: string;
-  consents: string;
-  tokens: string;
-  active_clients: string;
-}
-interface McpNameRow {
-  name: string | null;
-  count: string;
-}
-
-interface MockData {
-  providers: ProviderRow[];
-  tiers: BucketRow[];
-  authTypes: BucketRow[];
-  totals: TotalsRow | undefined;
-  agentPlatforms: CategoryPlatformRow[];
-  agentsCount: number;
-  requestTotals: RequestTotalsRow | undefined;
-  errorClasses: BucketRow[];
-  cliKeys: CliKeyRow | undefined;
-  mcpCounts: McpCountsRow | undefined;
-  mcpNames: McpNameRow[];
-  /** When set, every raw OAuth query rejects with this error. */
-  mcpQueryError: Error | undefined;
-}
-
-function defaultData(): MockData {
-  return {
-    providers: [],
-    tiers: [],
-    authTypes: [],
-    totals: { total: '0', input_tokens: '0', output_tokens: '0' },
-    agentPlatforms: [],
-    agentsCount: 0,
-    requestTotals: { total: '0', failed: '0' },
-    errorClasses: [],
-    cliKeys: { total: '0', active: '0' },
-    mcpCounts: { clients: '0', consents: '0', tokens: '0', active_clients: '0' },
-    mcpNames: [],
-    mcpQueryError: undefined,
-  };
-}
-
-interface MakeServiceResult {
-  service: PayloadBuilderService;
-  agentsRepo: {
-    createQueryBuilder: jest.Mock;
-  };
-}
-
-async function makeService(partial: Partial<MockData>): Promise<PayloadBuilderService> {
-  return (await makeServiceWithRepo(partial)).service;
-}
-
-async function makeServiceWithRepo(partial: Partial<MockData>): Promise<MakeServiceResult> {
-  const data: MockData = { ...defaultData(), ...partial };
-
-  const messagesQueue = [
-    { rows: data.providers, mode: 'getRawMany' as const },
-    { rows: data.tiers, mode: 'getRawMany' as const },
-    { rows: data.authTypes, mode: 'getRawMany' as const },
-    { row: data.totals, mode: 'getRawOne' as const },
-  ];
-  // userAgentsCount() uses getRawOne returning {count: string};
-  // agentsByPlatform() uses getRawMany returning CategoryPlatformRow[].
-  const agentsQueue = [
-    { row: { count: String(data.agentsCount) }, mode: 'getRawOne' as const },
-    { rows: data.agentPlatforms, mode: 'getRawMany' as const },
-  ];
-  // requestCounts() uses getRawOne; failedRequestsByClass() uses getRawMany.
-  const requestsQueue = [
-    { row: data.requestTotals, mode: 'getRawOne' as const },
-    { rows: data.errorClasses, mode: 'getRawMany' as const },
-  ];
-
-  function makeQb(entry: { rows?: unknown; row?: unknown; mode: 'getRawMany' | 'getRawOne' }) {
-    return {
-      select: jest.fn().mockReturnThis(),
-      addSelect: jest.fn().mockReturnThis(),
-      where: jest.fn().mockReturnThis(),
-      andWhere: jest.fn().mockReturnThis(),
-      groupBy: jest.fn().mockReturnThis(),
-      addGroupBy: jest.fn().mockReturnThis(),
-      getRawMany: jest.fn().mockResolvedValue(entry.rows ?? []),
-      getRawOne: jest.fn().mockResolvedValue(entry.row),
-    };
-  }
-
-  const messagesRepo = {
-    createQueryBuilder: jest.fn(() => makeQb(messagesQueue.shift()!)),
-  };
-  const agentsRepoMock = {
-    createQueryBuilder: jest.fn(() => makeQb(agentsQueue.shift()!)),
-  };
-  const requestsRepo = {
-    createQueryBuilder: jest.fn(() => makeQb(requestsQueue.shift()!)),
-  };
-  // The OAuth tables have no entity, so the builder goes through the api_keys
-  // repository's entity manager. Two statements: the scalar counts (no GROUP BY)
-  // and the per-name rollup.
-  const apiKeysRepo = {
-    createQueryBuilder: jest.fn(() => makeQb({ row: data.cliKeys, mode: 'getRawOne' })),
-    manager: {
-      query: jest.fn((sql: string) => {
-        if (data.mcpQueryError) return Promise.reject(data.mcpQueryError);
-        if (sql.includes('GROUP BY')) return Promise.resolve(data.mcpNames);
-        return Promise.resolve(data.mcpCounts ? [data.mcpCounts] : []);
-      }),
-    },
-  };
-
-  const module: TestingModule = await Test.createTestingModule({
-    providers: [
-      PayloadBuilderService,
-      { provide: getRepositoryToken(AgentMessage), useValue: messagesRepo },
-      { provide: getRepositoryToken(Agent), useValue: agentsRepoMock },
-      { provide: getRepositoryToken(ManifestRequest), useValue: requestsRepo },
-      { provide: getRepositoryToken(ApiKey), useValue: apiKeysRepo },
-    ],
-  }).compile();
-
-  return { service: module.get(PayloadBuilderService), agentsRepo: agentsRepoMock };
-}
-
-describe('PayloadBuilderService', () => {
-  it('builds a payload with the full v1 shape', async () => {
-    const service = await makeService({
-      providers: [{ provider: 'anthropic', count: '3' }],
-      totals: { total: '3', input_tokens: '100', output_tokens: '50' },
-      agentsCount: 2,
-    });
-
-    const payload = await service.build('inst-123', '5.47.0');
-
-    expect(payload.schema_version).toBe(1);
-    expect(payload.install_id).toBe('inst-123');
-    expect(payload.manifest_version).toBe('5.47.0');
-    expect(payload.platform).toBe(process.platform);
-    expect(payload.arch).toBe(process.arch);
-  });
-
-  it('aggregates message counts and token totals across the 24h window', async () => {
-    const service = await makeService({
-      providers: [
-        { provider: 'anthropic', count: '10' },
-        { provider: 'openai', count: '5' },
-      ],
-      totals: { total: '15', input_tokens: '1200', output_tokens: '800' },
-      agentsCount: 4,
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.messages_total).toBe(15);
-    expect(payload.tokens_input_total).toBe(1200);
-    expect(payload.tokens_output_total).toBe(800);
-    expect(payload.agents_total).toBe(4);
-    expect(payload.messages_by_provider).toEqual({ anthropic: 10, openai: 5 });
-  });
-
-  it('collapses unknown provider names to "custom" to prevent leakage', async () => {
-    const service = await makeService({
-      providers: [
-        { provider: 'anthropic', count: '2' },
-        { provider: 'my-self-hosted-vllm', count: '4' },
-        { provider: 'another-custom', count: '1' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.messages_by_provider).toEqual({ anthropic: 2, custom: 5 });
-  });
-
-  it('maps NULL providers to an "unknown" bucket', async () => {
-    const service = await makeService({ providers: [{ provider: null, count: '2' }] });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.messages_by_provider).toEqual({ unknown: 2 });
-  });
-
-  it('respects provider registry aliases (e.g. "google" → "gemini")', async () => {
-    const service = await makeService({
-      providers: [{ provider: 'google', count: '3' }],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(Object.keys(payload.messages_by_provider)).toContain('gemini');
-  });
-
-  it('treats missing token sums as zero', async () => {
-    const service = await makeService({
-      totals: { total: '0', input_tokens: null, output_tokens: null },
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.tokens_input_total).toBe(0);
-    expect(payload.tokens_output_total).toBe(0);
-    expect(payload.messages_total).toBe(0);
-  });
-
-  it('defaults totals to zero when the query returns undefined', async () => {
-    const service = await makeService({ totals: undefined });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.messages_total).toBe(0);
-    expect(payload.tokens_input_total).toBe(0);
-    expect(payload.tokens_output_total).toBe(0);
-  });
-
-  it('emits request-level counters split by error class', async () => {
-    const service = await makeService({
-      requestTotals: { total: '20', failed: '6' },
-      errorClasses: [
-        { bucket: 'rate_limit', count: '4' },
-        { bucket: 'auth', count: '2' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.requests_total).toBe(20);
-    expect(payload.errors_total).toBe(6);
-    expect(payload.errors_by_class).toEqual({ rate_limit: 4, auth: 2 });
-  });
-
-  it('buckets NULL error classes as "unknown" and off-taxonomy strings as "other"', async () => {
-    const service = await makeService({
-      requestTotals: { total: '9', failed: '3' },
-      errorClasses: [
-        { bucket: null, count: '1' },
-        { bucket: 'totally-novel-class', count: '2' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.errors_by_class).toEqual({ unknown: 1, other: 2 });
-  });
-
-  it('treats a NULL failed sum (empty window) and a missing row as zero errors', async () => {
-    const withNullSum = await makeService({ requestTotals: { total: '0', failed: null } });
-    expect((await withNullSum.build('inst', '1.0.0')).errors_total).toBe(0);
-
-    const withNoRow = await makeService({ requestTotals: undefined });
-    const payload = await withNoRow.build('inst', '1.0.0');
-    expect(payload.requests_total).toBe(0);
-    expect(payload.errors_total).toBe(0);
-    expect(payload.errors_by_class).toEqual({});
-  });
-
-  it('emits cost_usd_total = 0 and cost_usd_by_provider = {} when no cost data', async () => {
-    const service = await makeService({
-      providers: [{ provider: 'anthropic', count: '3' }],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.cost_usd_total).toBe(0);
-    expect(payload.cost_usd_by_provider).toEqual({});
-  });
-
-  it('sums cost_usd_total from totals.cost and rounds to cents', async () => {
-    const service = await makeService({
-      totals: {
-        total: '10',
-        input_tokens: '0',
-        output_tokens: '0',
-        cost: '12.345678',
-      },
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.cost_usd_total).toBe(12.35);
-  });
-
-  it('buckets cost_usd_by_provider with the same canonicalization as messages', async () => {
-    const service = await makeService({
-      providers: [
-        { provider: 'anthropic', count: '10', cost: '5.4321' },
-        { provider: 'openai', count: '5', cost: '2.1' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.cost_usd_by_provider).toEqual({ anthropic: 5.43, openai: 2.1 });
-  });
-
-  it('collapses custom provider costs into a single "custom" bucket', async () => {
-    const service = await makeService({
-      providers: [
-        { provider: 'anthropic', count: '2', cost: '1.00' },
-        { provider: 'my-self-hosted-vllm', count: '4', cost: '0.50' },
-        { provider: 'another-custom', count: '1', cost: '0.25' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.cost_usd_by_provider).toEqual({ anthropic: 1, custom: 0.75 });
-  });
-
-  it('skips zero and null costs from cost_usd_by_provider', async () => {
-    const service = await makeService({
-      providers: [
-        { provider: 'ollama', count: '100', cost: '0' },
-        { provider: 'anthropic', count: '3', cost: '1.50' },
-        { provider: 'openai', count: '1', cost: null },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.cost_usd_by_provider).toEqual({ anthropic: 1.5 });
-  });
-
-  it('drops cost_usd_by_provider buckets that round to 0 after rounding', async () => {
-    const service = await makeService({
-      providers: [{ provider: 'anthropic', count: '1', cost: '0.001' }],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.cost_usd_by_provider).toEqual({});
-  });
-
-  it('returns messages_by_tier grouped across the 4 canonical tiers', async () => {
-    const service = await makeService({
-      tiers: [
-        { bucket: 'simple', count: '80' },
-        { bucket: 'standard', count: '40' },
-        { bucket: 'complex', count: '7' },
-        { bucket: 'reasoning', count: '3' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.messages_by_tier).toEqual({
-      simple: 80,
-      standard: 40,
-      complex: 7,
-      reasoning: 3,
-    });
-  });
-
-  it('returns messages_by_auth_type grouped by api_key vs subscription', async () => {
-    const service = await makeService({
-      authTypes: [
-        { bucket: 'api_key', count: '100' },
-        { bucket: 'subscription', count: '20' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.messages_by_auth_type).toEqual({ api_key: 100, subscription: 20 });
-  });
-
-  it('buckets NULL routing_tier rows under "unknown"', async () => {
-    const service = await makeService({
-      tiers: [
-        { bucket: null, count: '5' },
-        { bucket: 'simple', count: '10' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.messages_by_tier).toEqual({ unknown: 5, simple: 10 });
-  });
-
-  it('keeps message-only routing tiers in telemetry buckets', async () => {
-    const service = await makeService({
-      tiers: [
-        { bucket: 'direct', count: '3' },
-        { bucket: 'playground', count: '2' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.messages_by_tier).toEqual({ direct: 3, playground: 2 });
-  });
-
-  it('collapses unknown routing_tier strings to "other" so a future write path cannot leak verbatim values', async () => {
-    // Defense-in-depth: if some caller writes "warp-speed" into routing_tier,
-    // the whitelist clamps it to "other" before it leaves the install.
-    const service = await makeService({
-      tiers: [
-        { bucket: 'simple', count: '4' },
-        { bucket: 'warp-speed', count: '6' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.messages_by_tier).toEqual({ simple: 4, other: 6 });
-  });
-
-  it('returns agents_by_platform grouped by agent_platform with bare keys for known platforms', async () => {
-    const service = await makeService({
-      agentPlatforms: [
-        { category: 'personal', platform: 'openclaw', count: '3' },
-        { category: 'personal', platform: 'hermes', count: '1' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.agents_by_platform).toEqual({ openclaw: 3, hermes: 1 });
-  });
-
-  it('emits composite "<category>:other" keys so peacock can tell the three Other variants apart', async () => {
-    const service = await makeService({
-      agentPlatforms: [
-        { category: 'personal', platform: 'other', count: '5' },
-        { category: 'app', platform: 'other', count: '2' },
-        { category: 'coding', platform: 'other', count: '1' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.agents_by_platform).toEqual({
-      'personal:other': 5,
-      'app:other': 2,
-      'coding:other': 1,
-    });
-  });
-
-  it('mixes bare and composite keys in the same payload (known platforms stay bare)', async () => {
-    const service = await makeService({
-      agentPlatforms: [
-        { category: 'personal', platform: 'openclaw', count: '4' },
-        { category: 'coding', platform: 'claude-code', count: '2' },
-        { category: 'personal', platform: 'other', count: '3' },
-        { category: 'coding', platform: 'other', count: '1' },
-      ],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.agents_by_platform).toEqual({
-      openclaw: 4,
-      'claude-code': 2,
-      'personal:other': 3,
-      'coding:other': 1,
-    });
-  });
-
-  it('falls back to bare "other" when the row has no category (legacy un-migrated rows)', async () => {
-    const service = await makeService({
-      agentPlatforms: [{ category: null, platform: 'other', count: '7' }],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.agents_by_platform).toEqual({ other: 7 });
-  });
-
-  it('buckets NULL agent_platform rows under "unknown"', async () => {
-    const service = await makeService({
-      agentPlatforms: [{ category: 'personal', platform: null, count: '2' }],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.agents_by_platform).toEqual({ unknown: 2 });
-  });
-
-  it('excludes playground agents from agents_total count (is_playground = false filter applied)', async () => {
-    // The count query is for user agents only — playground agents (e.g. Playground)
-    // must not inflate the install telemetry.
-    const { service, agentsRepo } = await makeServiceWithRepo({ agentsCount: 3 });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.agents_total).toBe(3);
-    // The count QB must have received a where clause filtering playground agents.
-    const countQb = agentsRepo.createQueryBuilder.mock.results[0].value as {
-      where: jest.Mock;
-    };
-    expect(countQb.where).toHaveBeenCalledWith('a.is_playground = false');
-  });
-
-  it('excludes playground agents from agents_by_platform (is_playground = false filter applied)', async () => {
-    const { service, agentsRepo } = await makeServiceWithRepo({
-      agentPlatforms: [{ category: 'personal', platform: 'openclaw', count: '2' }],
-    });
-
-    const payload = await service.build('inst', '1.0.0');
-
-    expect(payload.agents_by_platform).toEqual({ openclaw: 2 });
-    // The platform QB (second agents QB call) must filter playground agents.
-    const platformQb = agentsRepo.createQueryBuilder.mock.results[1].value as {
-      where: jest.Mock;
-    };
-    expect(platformQb.where).toHaveBeenCalledWith('a.is_playground = false');
-  });
-  describe('management-surface adoption (CLI + MCP)', () => {
-    it('reports CLI key totals and 7-day actives from the api_keys rollup', async () => {
-      const service = await makeService({ cliKeys: { total: '5', active: '2' } });
-
-      const payload = await service.build('inst', '1.0.0');
-
-      expect(payload.cli_keys_total).toBe(5);
-      expect(payload.cli_keys_active_7d).toBe(2);
-    });
-
-    it('treats a missing CLI rollup row and a NULL active sum as zero', async () => {
-      const none = await makeService({ cliKeys: undefined });
-      expect((await none.build('inst', '1.0.0')).cli_keys_total).toBe(0);
-
-      const nullActive = await makeService({ cliKeys: { total: '3', active: null } });
-      const payload = await nullActive.build('inst', '1.0.0');
-      expect(payload.cli_keys_total).toBe(3);
-      expect(payload.cli_keys_active_7d).toBe(0);
-    });
-
-    it('reports MCP client, consent, and token counts from the OAuth tables', async () => {
-      const service = await makeService({
-        mcpCounts: { clients: '3', consents: '4', tokens: '96', active_clients: '2' },
-      });
-
-      const payload = await service.build('inst', '1.0.0');
-
-      expect(payload.mcp_clients_total).toBe(3);
-      expect(payload.mcp_consents_total).toBe(4);
-      expect(payload.mcp_tokens_issued_24h).toBe(96);
-      expect(payload.mcp_clients_active_24h).toBe(2);
-    });
-
-    it('whitelists MCP client names and collapses the rest to "other" / "unknown"', async () => {
-      const service = await makeService({
-        mcpNames: [
-          { name: 'Claude Code', count: '2' },
-          { name: 'cursor', count: '1' },
-          { name: "Guillaume's laptop agent", count: '1' },
-          { name: 'https://internal.example.com/tool', count: '1' },
-          // Declared but empty: a name we decline to forward, not a missing one.
-          { name: '', count: '1' },
-          { name: null, count: '1' },
-        ],
-      });
-
-      const payload = await service.build('inst', '1.0.0');
-
-      expect(payload.mcp_clients_by_name).toEqual({
-        'claude-code': 2,
-        cursor: 1,
-        other: 3,
-        unknown: 1,
-      });
-    });
-
-    it('degrades to zeros when the OAuth tables are missing instead of failing the report', async () => {
-      const service = await makeService({
-        mcpQueryError: new Error('relation "oauthClient" does not exist'),
-        cliKeys: { total: '1', active: '1' },
-      });
-
-      const payload = await service.build('inst', '1.0.0');
-
-      expect(payload.mcp_clients_total).toBe(0);
-      expect(payload.mcp_consents_total).toBe(0);
-      expect(payload.mcp_tokens_issued_24h).toBe(0);
-      expect(payload.mcp_clients_active_24h).toBe(0);
-      expect(payload.mcp_clients_by_name).toEqual({});
-      // The rest of the payload is unaffected.
-      expect(payload.cli_keys_total).toBe(1);
-    });
-
-    it('degrades to zeros on a non-Error rejection too', async () => {
-      const service = await makeService({
-        mcpQueryError: 'connection reset' as unknown as Error,
-      });
-
-      const payload = await service.build('inst', '1.0.0');
-
-      expect(payload.mcp_clients_total).toBe(0);
-      expect(payload.mcp_clients_by_name).toEqual({});
-    });
-
-    it('degrades to zeros when the counts query returns no row', async () => {
-      const service = await makeService({
-        mcpCounts: undefined,
-        mcpNames: [{ name: 'zed', count: '1' }],
-      });
-
-      const payload = await service.build('inst', '1.0.0');
-
-      expect(payload.mcp_clients_total).toBe(0);
-      expect(payload.mcp_clients_by_name).toEqual({});
-    });
-  });
-});
diff --git a/packages/backend/src/telemetry/payload-builder.service.ts b/packages/backend/src/telemetry/payload-builder.service.ts
deleted file mode 100644
index 5b104cec..00000000
--- a/packages/backend/src/telemetry/payload-builder.service.ts
+++ /dev/null
@@ -1,433 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { InjectRepository } from '@nestjs/typeorm';
-import { Repository } from 'typeorm';
-import { ALL_TIERS, AUTH_TYPES, ERROR_CLASSES, TIER_SLOTS } from 'manifest-shared';
-import { PROVIDER_BY_ID_OR_ALIAS } from '../common/constants/providers';
-import { Agent } from '../entities/agent.entity';
-import { ApiKey } from '../entities/api-key.entity';
-import { AgentMessage } from '../entities/agent-message.entity';
-import { ManifestRequest } from '../entities/request.entity';
-import { sqlIsFailedStatus } from '../analytics/services/query-helpers';
-import { CLI_KEY_NAME } from '../auth/cli-auth.service';
-import type { TelemetryPayloadV1 } from './dto/telemetry-payload';
-import { TELEMETRY_SCHEMA_VERSION } from './telemetry.config';
-
-const TIER_WHITELIST: ReadonlySet<string> = new Set<string>([...TIER_SLOTS, ...ALL_TIERS]);
-const AUTH_TYPE_WHITELIST: ReadonlySet<string> = new Set<string>(AUTH_TYPES);
-const ERROR_CLASS_WHITELIST: ReadonlySet<string> = new Set<string>(ERROR_CLASSES);
-
-/**
- * MCP hosts we recognise by the `client_name` they register with (via CIMD or
- * DCR), after `slugifyClientName`. Anything else is a free-form string an
- * operator or client chose, so it collapses to `"other"` — same posture as
- * custom provider names.
- */
-const MCP_CLIENT_NAME_WHITELIST: ReadonlySet<string> = new Set<string>([
-  'claude-code',
-  'claude',
-  'claude-desktop',
-  'cursor',
-  'windsurf',
-  'vs-code',
-  'visual-studio-code',
-  'codex',
-  'codex-cli',
-  'chatgpt',
-  'gemini-cli',
-  'cline',
-  'zed',
-  'goose',
-  'opencode',
-  'mcp-inspector',
-]);
-
-interface CliKeyRow {
-  total: string;
-  active: string | null;
-}
-
-interface McpCountsRow {
-  clients: string;
-  consents: string;
-  tokens: string;
-  active_clients: string;
-}
-
-interface McpClientNameRow {
-  name: string | null;
-  count: string;
-}
-
-interface McpAggregates {
-  clients_total: number;
-  consents_total: number;
-  tokens_issued_24h: number;
-  clients_active_24h: number;
-  clients_by_name: Record<string, number>;
-}
-
-interface ProviderAggregateRow {
-  provider: string | null;
-  count: string;
-  cost: string | null;
-}
-
-interface BucketRow {
-  bucket: string | null;
-  count: string;
-}
-
-interface TotalsRow {
-  total: string;
-  input_tokens: string | null;
-  output_tokens: string | null;
-  cost: string | null;
-}
-
-/**
- * Builds the daily telemetry payload by aggregating the last 24h of
- * `agent_messages` plus the total agent count + runtime metadata. All
- * SELECTs are parameterised so the window is consistent across queries.
- */
-@Injectable()
-export class PayloadBuilderService {
-  private readonly logger = new Logger(PayloadBuilderService.name);
-
-  constructor(
-    @InjectRepository(AgentMessage)
-    private readonly messages: Repository<AgentMessage>,
-    @InjectRepository(Agent)
-    private readonly agents: Repository<Agent>,
-    @InjectRepository(ManifestRequest)
-    private readonly requests: Repository<ManifestRequest>,
-    @InjectRepository(ApiKey)
-    private readonly apiKeys: Repository<ApiKey>,
-  ) {}
-
-  async build(installId: string, manifestVersion: string): Promise<TelemetryPayloadV1> {
-    const [
-      providerRows,
-      tierRows,
-      authRows,
-      totals,
-      agentsTotal,
-      agentPlatformRows,
-      requestCounts,
-      errorClassRows,
-      cliKeys,
-      mcp,
-    ] = await Promise.all([
-      this.messagesByProvider(),
-      this.messagesByBucket('routing_tier'),
-      this.messagesByBucket('auth_type'),
-      this.totals(),
-      this.userAgentsCount(),
-      this.agentsByPlatform(),
-      this.requestCounts(),
-      this.failedRequestsByClass(),
-      this.cliKeyCounts(),
-      this.mcpAggregates(),
-    ]);
-
-    return {
-      schema_version: TELEMETRY_SCHEMA_VERSION,
-      install_id: installId,
-      manifest_version: manifestVersion,
-      messages_total: Number(totals.total),
-      messages_by_provider: this.collapseProviders(providerRows),
-      // Defense in depth: whitelist tier and auth_type values against the
-      // shared enums. If a future write path inserts an unexpected string,
-      // it collapses to `"other"` instead of leaking verbatim to the
-      // telemetry endpoint.
-      messages_by_tier: this.bucketsToRecord(tierRows, 'unknown', TIER_WHITELIST),
-      messages_by_auth_type: this.bucketsToRecord(authRows, 'unknown', AUTH_TYPE_WHITELIST),
-      tokens_input_total: Number(totals.input_tokens ?? 0),
-      tokens_output_total: Number(totals.output_tokens ?? 0),
-      cost_usd_total: roundCents(Number(totals.cost ?? 0)),
-      cost_usd_by_provider: this.collapseProviderCosts(providerRows),
-      requests_total: Number(requestCounts.total),
-      errors_total: Number(requestCounts.failed ?? 0),
-      // NULL error_class (unclassified failures) buckets under "unknown";
-      // anything outside the shared taxonomy collapses to "other".
-      errors_by_class: this.bucketsToRecord(errorClassRows, 'unknown', ERROR_CLASS_WHITELIST),
-      agents_total: agentsTotal,
-      agents_by_platform: this.bucketsToRecord(agentPlatformRows, 'unknown'),
-      cli_keys_total: cliKeys.total,
-      cli_keys_active_7d: cliKeys.active7d,
-      mcp_clients_total: mcp.clients_total,
-      mcp_consents_total: mcp.consents_total,
-      mcp_tokens_issued_24h: mcp.tokens_issued_24h,
-      mcp_clients_active_24h: mcp.clients_active_24h,
-      mcp_clients_by_name: mcp.clients_by_name,
-      platform: process.platform,
-      arch: process.arch,
-    };
-  }
-
-  private async messagesByProvider(): Promise<ProviderAggregateRow[]> {
-    return this.messages
-      .createQueryBuilder('m')
-      .select('m.provider', 'provider')
-      .addSelect('COUNT(*)', 'count')
-      .addSelect('COALESCE(SUM(m.cost_usd), 0)', 'cost')
-      .where(`m.timestamp >= NOW() - INTERVAL '24 hours'`)
-      .groupBy('m.provider')
-      .getRawMany<ProviderAggregateRow>();
-  }
-
-  /**
-   * Groups the 24h-window messages by any column whose values are already a
-   * short stable set (`routing_tier`, `auth_type`). We trust the set because
-   * the producer — our own proxy — writes known enum strings.
-   */
-  private async messagesByBucket(column: 'routing_tier' | 'auth_type'): Promise<BucketRow[]> {
-    return this.messages
-      .createQueryBuilder('m')
-      .select(`m.${column}`, 'bucket')
-      .addSelect('COUNT(*)', 'count')
-      .where(`m.timestamp >= NOW() - INTERVAL '24 hours'`)
-      .groupBy(`m.${column}`)
-      .getRawMany<BucketRow>();
-  }
-
-  /**
-   * `other` is a sentinel valid in every category (personal/app/coding), so a
-   * bare `agent_platform` bucket loses the category dimension peacock needs to
-   * tell "Other personal agent" from "Other coding tool". For the `other`
-   * platform we emit a composite `<category>:other` key (peacock's
-   * platform-classification.ts already handles this format); known platforms
-   * stay as bare keys so existing self-hosted reports don't change shape.
-   */
-  private async agentsByPlatform(): Promise<BucketRow[]> {
-    interface CategoryPlatformRow {
-      category: string | null;
-      platform: string | null;
-      count: string;
-    }
-    const rows = await this.agents
-      .createQueryBuilder('a')
-      .select('a.agent_category', 'category')
-      .addSelect('a.agent_platform', 'platform')
-      .addSelect('COUNT(*)', 'count')
-      .where('a.is_playground = false')
-      .groupBy('a.agent_category')
-      .addGroupBy('a.agent_platform')
-      .getRawMany<CategoryPlatformRow>();
-    return rows.map((r) => ({
-      bucket: r.platform === 'other' && r.category ? `${r.category}:${r.platform}` : r.platform,
-      count: r.count,
-    }));
-  }
-
-  /** Count only user-created agents; playground agents (e.g. Playground) are excluded. */
-  private async userAgentsCount(): Promise<number> {
-    const result = await this.agents
-      .createQueryBuilder('a')
-      .select('COUNT(*)', 'count')
-      .where('a.is_playground = false')
-      .getRawOne<{ count: string }>();
-    return Number(result?.count ?? 0);
-  }
-
-  /**
-   * Request-level counters over the same 24h window. `requests` is the
-   * request-first ledger (one row per caller call), so `total` never counts
-   * provider retries/fallbacks twice, and `failed` is the caller-visible
-   * failure count — including gateway rejections that never produced an
-   * attempt row in `agent_messages`.
-   */
-  private async requestCounts(): Promise<{ total: string; failed: string | null }> {
-    const row = await this.requests
-      .createQueryBuilder('r')
-      .select('COUNT(*)', 'total')
-      // Shared legacy-aware predicate: rows written by a not-yet-drained old
-      // replica (or pre-normalization backfill) say `error`/`rate_limited`/…
-      // rather than the canonical `failed`; a bare `= 'failed'` would
-      // undercount them.
-      .addSelect(`SUM(CASE WHEN ${sqlIsFailedStatus('r.status')} THEN 1 ELSE 0 END)`, 'failed')
-      .where(`r.timestamp >= NOW() - INTERVAL '24 hours'`)
-      .getRawOne<{ total: string; failed: string | null }>();
-    return row ?? { total: '0', failed: '0' };
-  }
-
-  /** Failed requests grouped by their shared-taxonomy `error_class`. */
-  private async failedRequestsByClass(): Promise<BucketRow[]> {
-    return this.requests
-      .createQueryBuilder('r')
-      .select('r.error_class', 'bucket')
-      .addSelect('COUNT(*)', 'count')
-      .where(`r.timestamp >= NOW() - INTERVAL '24 hours'`)
-      .andWhere(sqlIsFailedStatus('r.status'))
-      .groupBy('r.error_class')
-      .getRawMany<BucketRow>();
-  }
-
-  /**
-   * Management-CLI adoption. `mnfst login` mints a PAT named `cli`
-   * (`CLI_KEY_NAME`) and nothing else does, so the name is the durable marker.
-   * `active` reads `last_used_at`, which the API-key guard stamps with the DB
-   * clock on every authenticated call — so it is compared against `NOW()`.
-   */
-  private async cliKeyCounts(): Promise<{ total: number; active7d: number }> {
-    const row = await this.apiKeys
-      .createQueryBuilder('k')
-      .select('COUNT(*)', 'total')
-      .addSelect(
-        `SUM(CASE WHEN k.last_used_at >= NOW() - INTERVAL '7 days' THEN 1 ELSE 0 END)`,
-        'active',
-      )
-      .where('k.name = :name', { name: CLI_KEY_NAME })
-      .getRawOne<CliKeyRow>();
-    return { total: Number(row?.total ?? 0), active7d: Number(row?.active ?? 0) };
-  }
-
-  /**
-   * Remote-MCP adoption, read from the OAuth tables the Better Auth MCP plugin
-   * owns (`oauthClient`, `oauthConsent`, `oauthAccessToken`). They have no
-   * TypeORM entity, so this is raw SQL through the api_keys repository's
-   * entity manager — the same connection, one fewer injected dependency.
-   * Access tokens live 15 minutes and a
-   * connected client refreshes them for as long as it is in use, so tokens
-   * minted per 24h is the activity proxy — no per-tool-call counter exists.
-   *
-   * Better Auth creates these tables on its own migration path; an install
-   * that has not run it yet has none. That must degrade to zeros, never fail
-   * the whole daily report.
-   */
-  private async mcpAggregates(): Promise<McpAggregates> {
-    const empty: McpAggregates = {
-      clients_total: 0,
-      consents_total: 0,
-      tokens_issued_24h: 0,
-      clients_active_24h: 0,
-      clients_by_name: {},
-    };
-    try {
-      const [countRows, nameRows] = await Promise.all([
-        this.apiKeys.manager.query<McpCountsRow[]>(`
-          SELECT
-            (SELECT COUNT(*) FROM "oauthClient" WHERE "disabled" IS NOT TRUE) AS clients,
-            (SELECT COUNT(*) FROM "oauthConsent") AS consents,
-            (SELECT COUNT(*) FROM "oauthAccessToken"
-              WHERE "createdAt" >= NOW() - INTERVAL '24 hours') AS tokens,
-            (SELECT COUNT(DISTINCT "clientId") FROM "oauthAccessToken"
-              WHERE "createdAt" >= NOW() - INTERVAL '24 hours') AS active_clients
-        `),
-        this.apiKeys.manager.query<McpClientNameRow[]>(`
-          SELECT "name" AS name, COUNT(*) AS count
-          FROM "oauthClient"
-          WHERE "disabled" IS NOT TRUE
-          GROUP BY "name"
-        `),
-      ]);
-      const counts = countRows[0];
-      if (!counts) return empty;
-      const byName: Record<string, number> = {};
-      for (const row of nameRows) {
-        // Only a NULL name is `unknown`; an empty or unrecognised declared name
-        // is a name we chose not to forward, i.e. `other`.
-        const slug = row.name === null ? null : slugifyClientName(row.name);
-        const key =
-          slug === null ? 'unknown' : MCP_CLIENT_NAME_WHITELIST.has(slug) ? slug : 'other';
-        byName[key] = (byName[key] ?? 0) + Number(row.count);
-      }
-      return {
-        clients_total: Number(counts.clients),
-        consents_total: Number(counts.consents),
-        tokens_issued_24h: Number(counts.tokens),
-        clients_active_24h: Number(counts.active_clients),
-        clients_by_name: byName,
-      };
-    } catch (error) {
-      this.logger.debug(
-        `MCP telemetry aggregates unavailable: ${error instanceof Error ? error.message : String(error)}`,
-      );
-      return empty;
-    }
-  }
-
-  private async totals(): Promise<TotalsRow> {
-    const row = await this.messages
-      .createQueryBuilder('m')
-      .select('COUNT(*)', 'total')
-      .addSelect('SUM(m.input_tokens)', 'input_tokens')
-      .addSelect('SUM(m.output_tokens)', 'output_tokens')
-      .addSelect('COALESCE(SUM(m.cost_usd), 0)', 'cost')
-      .where(`m.timestamp >= NOW() - INTERVAL '24 hours'`)
-      .getRawOne<TotalsRow>();
-    return row ?? { total: '0', input_tokens: '0', output_tokens: '0', cost: '0' };
-  }
-
-  /**
-   * Maps each raw `provider` value to either its canonical registry ID or
-   * the bucket `"custom"` (for user-defined providers) / `"unknown"` (for
-   * pre-provider-column rows). Prevents custom provider names — which may
-   * leak URLs or user configuration — from escaping the box.
-   */
-  private collapseProviders(rows: ProviderAggregateRow[]): Record<string, number> {
-    const out: Record<string, number> = {};
-    for (const row of rows) {
-      const bucket = this.bucketFor(row.provider);
-      out[bucket] = (out[bucket] ?? 0) + Number(row.count);
-    }
-    return out;
-  }
-
-  /**
-   * Same bucketing as `collapseProviders`, but sums `cost_usd` instead of
-   * row counts. Custom provider names collapse into a single `"custom"`
-   * bucket, so admin-configured BYOK pricing never appears keyed by the
-   * raw provider string. Values are rounded to cents to avoid emitting
-   * micro-precision floats over the wire.
-   */
-  private collapseProviderCosts(rows: ProviderAggregateRow[]): Record<string, number> {
-    const out: Record<string, number> = {};
-    for (const row of rows) {
-      const cost = row.cost == null ? 0 : Number(row.cost);
-      if (!Number.isFinite(cost) || cost <= 0) continue;
-      const bucket = this.bucketFor(row.provider);
-      out[bucket] = (out[bucket] ?? 0) + cost;
-    }
-    for (const key of Object.keys(out)) {
-      const rounded = roundCents(out[key]);
-      if (rounded === 0) delete out[key];
-      else out[key] = rounded;
-    }
-    return out;
-  }
-
-  private bucketFor(provider: string | null): string {
-    if (!provider) return 'unknown';
-    const entry = PROVIDER_BY_ID_OR_ALIAS.get(provider.toLowerCase());
-    return entry ? entry.id : 'custom';
-  }
-
-  private bucketsToRecord(
-    rows: BucketRow[],
-    nullLabel: string,
-    whitelist?: ReadonlySet<string>,
-  ): Record<string, number> {
-    const out: Record<string, number> = {};
-    for (const row of rows) {
-      let key = row.bucket ?? nullLabel;
-      if (whitelist && row.bucket !== null && !whitelist.has(row.bucket)) {
-        key = 'other';
-      }
-      out[key] = (out[key] ?? 0) + Number(row.count);
-    }
-    return out;
-  }
-}
-
-/** `"Claude Code"` → `claude-code`; the whitelist above is keyed on this form. */
-function slugifyClientName(name: string): string {
-  return name
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, '-')
-    .replace(/^-+|-+$/g, '');
-}
-
-function roundCents(value: number): number {
-  if (!Number.isFinite(value)) return 0;
-  return Math.round(value * 100) / 100;
-}
diff --git a/packages/backend/src/telemetry/telemetry.config.spec.ts b/packages/backend/src/telemetry/telemetry.config.spec.ts
deleted file mode 100644
index 983bf09d..00000000
--- a/packages/backend/src/telemetry/telemetry.config.spec.ts
+++ /dev/null
@@ -1,122 +0,0 @@
-import {
-  buildTelemetryConfig,
-  DEFAULT_TELEMETRY_ENDPOINT,
-  readManifestVersion,
-} from './telemetry.config';
-
-describe('buildTelemetryConfig', () => {
-  it('is enabled in production when no disable flag is set', () => {
-    const cfg = buildTelemetryConfig({ NODE_ENV: 'production' });
-    expect(cfg.enabled).toBe(true);
-    expect(cfg.endpoint).toBe(DEFAULT_TELEMETRY_ENDPOINT);
-    expect(cfg.manifestVersion).toEqual(expect.any(String));
-  });
-
-  it('is disabled outside production so dev instances never phone home', () => {
-    expect(buildTelemetryConfig({ NODE_ENV: 'development' }).enabled).toBe(false);
-    expect(buildTelemetryConfig({ NODE_ENV: 'test' }).enabled).toBe(false);
-    expect(buildTelemetryConfig({}).enabled).toBe(false);
-  });
-
-  it('is disabled when MANIFEST_TELEMETRY_DISABLED is "1" or "true" even in production', () => {
-    expect(
-      buildTelemetryConfig({ NODE_ENV: 'production', MANIFEST_TELEMETRY_DISABLED: '1' }).enabled,
-    ).toBe(false);
-    expect(
-      buildTelemetryConfig({ NODE_ENV: 'production', MANIFEST_TELEMETRY_DISABLED: 'true' }).enabled,
-    ).toBe(false);
-  });
-
-  it('ignores unrecognised disable values (opt-out must be explicit)', () => {
-    expect(
-      buildTelemetryConfig({ NODE_ENV: 'production', MANIFEST_TELEMETRY_DISABLED: 'yes' }).enabled,
-    ).toBe(true);
-  });
-
-  it('uses TELEMETRY_ENDPOINT override when set', () => {
-    const cfg = buildTelemetryConfig({
-      NODE_ENV: 'production',
-      TELEMETRY_ENDPOINT: 'http://127.0.0.1:9999/ingest',
-    });
-    expect(cfg.endpoint).toBe('http://127.0.0.1:9999/ingest');
-  });
-
-  it('falls back to the default endpoint when TELEMETRY_ENDPOINT is blank', () => {
-    // docker-compose forwards unset optional vars as an empty string
-    // (`- TELEMETRY_ENDPOINT=${TELEMETRY_ENDPOINT:-}`). Treating `''` as a
-    // deliberate override would silently POST every report to nowhere.
-    for (const blank of ['', '   ']) {
-      expect(
-        buildTelemetryConfig({ NODE_ENV: 'production', TELEMETRY_ENDPOINT: blank }).endpoint,
-      ).toBe(DEFAULT_TELEMETRY_ENDPOINT);
-    }
-  });
-
-  it('trims a padded TELEMETRY_ENDPOINT', () => {
-    expect(
-      buildTelemetryConfig({
-        NODE_ENV: 'production',
-        TELEMETRY_ENDPOINT: '  http://127.0.0.1:9999/ingest  ',
-      }).endpoint,
-    ).toBe('http://127.0.0.1:9999/ingest');
-  });
-
-  it('is disabled when the Manifest version cannot be read', () => {
-    // Simulates a misconfigured image that ships without
-    // packages/manifest/package.json. readManifestVersion() falls back to
-    // "unknown", which the ingest would reject as invalid semver — better
-    // to stay silent than to spam the endpoint.
-    jest.isolateModules(() => {
-      jest.doMock('fs', () => {
-        const actual = jest.requireActual<typeof import('fs')>('fs');
-        return {
-          ...actual,
-          readFileSync: jest.fn(() => {
-            throw new Error('ENOENT');
-          }),
-        };
-      });
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      const mod = require('./telemetry.config') as typeof import('./telemetry.config');
-      const cfg = mod.buildTelemetryConfig({ NODE_ENV: 'production' });
-      expect(cfg.manifestVersion).toBe('unknown');
-      expect(cfg.enabled).toBe(false);
-    });
-  });
-});
-
-describe('readManifestVersion', () => {
-  it('returns a semver-shaped string from the real manifest/package.json', () => {
-    const version = readManifestVersion();
-    expect(version).toMatch(/^\d+\.\d+\.\d+/);
-  });
-
-  it('returns "unknown" when the package.json read fails', () => {
-    jest.isolateModules(() => {
-      jest.doMock('fs', () => {
-        const actual = jest.requireActual<typeof import('fs')>('fs');
-        return {
-          ...actual,
-          readFileSync: jest.fn(() => {
-            throw new Error('ENOENT');
-          }),
-        };
-      });
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      const mod = require('./telemetry.config') as typeof import('./telemetry.config');
-      expect(mod.readManifestVersion()).toBe('unknown');
-    });
-  });
-
-  it('returns "unknown" when the package.json lacks a string version field', () => {
-    jest.isolateModules(() => {
-      jest.doMock('fs', () => {
-        const actual = jest.requireActual<typeof import('fs')>('fs');
-        return { ...actual, readFileSync: jest.fn(() => '{"version":123}') };
-      });
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      const mod = require('./telemetry.config') as typeof import('./telemetry.config');
-      expect(mod.readManifestVersion()).toBe('unknown');
-    });
-  });
-});
diff --git a/packages/backend/src/telemetry/telemetry.config.ts b/packages/backend/src/telemetry/telemetry.config.ts
deleted file mode 100644
index 547f6866..00000000
--- a/packages/backend/src/telemetry/telemetry.config.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-import { readFileSync } from 'fs';
-import { resolve } from 'path';
-
-export const DEFAULT_TELEMETRY_ENDPOINT = 'https://telemetry.manifest.build/v1/report';
-export const TELEMETRY_SCHEMA_VERSION = 1;
-export const TELEMETRY_DOCS_URL = 'https://manifest.build/llm-gateway/docs/self-hosted/#telemetry';
-
-export interface TelemetryConfig {
-  enabled: boolean;
-  endpoint: string;
-  manifestVersion: string;
-}
-
-/**
- * Opt-out with `MANIFEST_TELEMETRY_DISABLED=1`. Also auto-silenced outside
- * production so dev instances and test runs never report. Also silenced
- * when the Manifest version can't be read — the ingest validates
- * `manifest_version` as semver, so a misconfigured image without
- * `packages/manifest/package.json` would otherwise spam the endpoint
- * with 400s.
- */
-export function buildTelemetryConfig(env: NodeJS.ProcessEnv = process.env): TelemetryConfig {
-  const disabled = env['MANIFEST_TELEMETRY_DISABLED'];
-  const isProd = (env['NODE_ENV'] ?? 'development') === 'production';
-  const isDisabled = disabled === '1' || disabled === 'true';
-  const manifestVersion = readManifestVersion();
-  const versionReadable = manifestVersion !== UNKNOWN_VERSION;
-  return {
-    enabled: isProd && !isDisabled && versionReadable,
-    // `||`, not `??`: docker-compose passes unset optional vars through as an
-    // empty string (`- TELEMETRY_ENDPOINT=${TELEMETRY_ENDPOINT:-}`), and `??`
-    // would accept `''` as a deliberate override and POST reports to nowhere.
-    endpoint: env['TELEMETRY_ENDPOINT']?.trim() || DEFAULT_TELEMETRY_ENDPOINT,
-    manifestVersion,
-  };
-}
-
-export const UNKNOWN_VERSION = 'unknown';
-
-export function readManifestVersion(): string {
-  try {
-    const path = resolve(__dirname, '../../../manifest/package.json');
-    const raw = readFileSync(path, 'utf8');
-    const pkg = JSON.parse(raw) as { version?: unknown };
-    if (typeof pkg.version === 'string') return pkg.version;
-    return UNKNOWN_VERSION;
-  } catch {
-    return UNKNOWN_VERSION;
-  }
-}
diff --git a/packages/backend/src/telemetry/telemetry.module.ts b/packages/backend/src/telemetry/telemetry.module.ts
deleted file mode 100644
index d1483290..00000000
--- a/packages/backend/src/telemetry/telemetry.module.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { Module } from '@nestjs/common';
-import { TypeOrmModule } from '@nestjs/typeorm';
-import { Agent } from '../entities/agent.entity';
-import { ApiKey } from '../entities/api-key.entity';
-import { AgentMessage } from '../entities/agent-message.entity';
-import { InstallMetadata } from '../entities/install-metadata.entity';
-import { ManifestRequest } from '../entities/request.entity';
-import { InstallIdService } from './install-id.service';
-import { PayloadBuilderService } from './payload-builder.service';
-import { TelemetryService } from './telemetry.service';
-
-@Module({
-  imports: [
-    TypeOrmModule.forFeature([InstallMetadata, AgentMessage, Agent, ManifestRequest, ApiKey]),
-  ],
-  providers: [InstallIdService, PayloadBuilderService, TelemetryService],
-  exports: [InstallIdService],
-})
-export class TelemetryModule {}
diff --git a/packages/backend/src/telemetry/telemetry.service.spec.ts b/packages/backend/src/telemetry/telemetry.service.spec.ts
deleted file mode 100644
index 96e7c0c2..00000000
--- a/packages/backend/src/telemetry/telemetry.service.spec.ts
+++ /dev/null
@@ -1,249 +0,0 @@
-import { TelemetryService } from './telemetry.service';
-import type { InstallIdService } from './install-id.service';
-import type { PayloadBuilderService } from './payload-builder.service';
-import type { TelemetryPayloadV1 } from './dto/telemetry-payload';
-
-function makeService(overrides?: { enabled?: boolean; endpoint?: string }): {
-  service: TelemetryService;
-  install: { getOrCreate: jest.Mock; markSent: jest.Mock };
-  payloadBuilder: { build: jest.Mock };
-} {
-  const install = {
-    getOrCreate: jest.fn(),
-    markSent: jest.fn().mockResolvedValue(undefined),
-  };
-  const payloadBuilder = {
-    build: jest.fn<Promise<TelemetryPayloadV1>, [string, string]>(),
-  };
-
-  const service = new TelemetryService(
-    install as unknown as InstallIdService,
-    payloadBuilder as unknown as PayloadBuilderService,
-  );
-  // Override the frozen config captured at construction time
-  (
-    service as unknown as {
-      config: { enabled: boolean; endpoint: string; manifestVersion: string };
-    }
-  ).config = {
-    enabled: overrides?.enabled ?? true,
-    endpoint: overrides?.endpoint ?? 'http://ingest.test/v1/report',
-    manifestVersion: '9.9.9',
-  };
-  return { service, install, payloadBuilder };
-}
-
-const baseInstall = {
-  id: 'singleton',
-  install_id: 'inst-1',
-  created_at: '2026-04-01T00:00:00',
-  first_send_at: '2026-04-01T00:00:00',
-  last_sent_at: null as string | null,
-};
-
-function payloadStub(overrides: Partial<TelemetryPayloadV1> = {}): TelemetryPayloadV1 {
-  return {
-    schema_version: 1,
-    install_id: 'inst-1',
-    manifest_version: '9.9.9',
-    messages_total: 0,
-    messages_by_provider: {},
-    messages_by_tier: {},
-    messages_by_auth_type: {},
-    tokens_input_total: 0,
-    tokens_output_total: 0,
-    agents_total: 0,
-    agents_by_platform: {},
-    platform: 'linux',
-    arch: 'x64',
-    ...overrides,
-  };
-}
-
-describe('TelemetryService', () => {
-  let fetchSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    fetchSpy = jest.spyOn(global, 'fetch');
-  });
-
-  afterEach(() => {
-    fetchSpy.mockRestore();
-    jest.restoreAllMocks();
-  });
-
-  describe('onModuleInit', () => {
-    it('logs a short message and returns early when disabled', async () => {
-      const { service, install } = makeService({ enabled: false });
-
-      await service.onModuleInit();
-
-      expect(install.getOrCreate).not.toHaveBeenCalled();
-    });
-
-    it('ensures the install row exists and logs the install ID when enabled', async () => {
-      const { service, install } = makeService();
-      install.getOrCreate.mockResolvedValue(baseInstall);
-
-      await service.onModuleInit();
-
-      expect(install.getOrCreate).toHaveBeenCalledTimes(1);
-    });
-  });
-
-  describe('tick', () => {
-    it('skips immediately when telemetry is disabled', async () => {
-      const { service, install } = makeService({ enabled: false });
-
-      await service.tick();
-
-      expect(install.getOrCreate).not.toHaveBeenCalled();
-      expect(fetchSpy).not.toHaveBeenCalled();
-    });
-
-    it('skips when the first-send jitter window has not elapsed', async () => {
-      const { service, install, payloadBuilder } = makeService();
-      const future = new Date('2030-01-01T00:00:00').toISOString();
-      install.getOrCreate.mockResolvedValue({ ...baseInstall, first_send_at: future });
-
-      await service.tick(new Date('2026-04-20T00:00:00'));
-
-      expect(payloadBuilder.build).not.toHaveBeenCalled();
-      expect(fetchSpy).not.toHaveBeenCalled();
-    });
-
-    it('skips when first_send_at is one millisecond in the future (boundary)', async () => {
-      const { service, install, payloadBuilder } = makeService();
-      const now = new Date('2026-04-20T12:00:00.000Z');
-      const oneMsAhead = new Date(now.getTime() + 1).toISOString();
-      install.getOrCreate.mockResolvedValue({
-        ...baseInstall,
-        first_send_at: oneMsAhead,
-        last_sent_at: null,
-      });
-
-      await service.tick(now);
-
-      expect(payloadBuilder.build).not.toHaveBeenCalled();
-      expect(fetchSpy).not.toHaveBeenCalled();
-      expect(install.markSent).not.toHaveBeenCalled();
-    });
-
-    it('sends when first_send_at is exactly now (boundary uses strict greater-than)', async () => {
-      const { service, install, payloadBuilder } = makeService();
-      const now = new Date('2026-04-20T12:00:00.000Z');
-      install.getOrCreate.mockResolvedValue({
-        ...baseInstall,
-        first_send_at: now.toISOString(),
-        last_sent_at: null,
-      });
-      payloadBuilder.build.mockResolvedValue(payloadStub());
-      fetchSpy.mockResolvedValue(new Response('{}', { status: 200 }));
-
-      await service.tick(now);
-
-      expect(payloadBuilder.build).toHaveBeenCalledTimes(1);
-      expect(fetchSpy).toHaveBeenCalledTimes(1);
-      expect(install.markSent).toHaveBeenCalledWith(now);
-    });
-
-    it('sends when first_send_at is one millisecond in the past (boundary)', async () => {
-      const { service, install, payloadBuilder } = makeService();
-      const now = new Date('2026-04-20T12:00:00.000Z');
-      const oneMsAgo = new Date(now.getTime() - 1).toISOString();
-      install.getOrCreate.mockResolvedValue({
-        ...baseInstall,
-        first_send_at: oneMsAgo,
-        last_sent_at: null,
-      });
-      payloadBuilder.build.mockResolvedValue(payloadStub());
-      fetchSpy.mockResolvedValue(new Response('{}', { status: 200 }));
-
-      await service.tick(now);
-
-      expect(payloadBuilder.build).toHaveBeenCalledTimes(1);
-      expect(fetchSpy).toHaveBeenCalledTimes(1);
-      expect(install.markSent).toHaveBeenCalledTimes(1);
-    });
-
-    it('skips when the last send was less than 24h ago', async () => {
-      const { service, install, payloadBuilder } = makeService();
-      const now = new Date('2026-04-20T12:00:00');
-      const recent = new Date(now.getTime() - 1000).toISOString();
-      install.getOrCreate.mockResolvedValue({
-        ...baseInstall,
-        first_send_at: '2026-04-01T00:00:00',
-        last_sent_at: recent,
-      });
-
-      await service.tick(now);
-
-      expect(payloadBuilder.build).not.toHaveBeenCalled();
-    });
-
-    it('sends when no previous send exists and jitter has elapsed', async () => {
-      const { service, install, payloadBuilder } = makeService();
-      install.getOrCreate.mockResolvedValue(baseInstall);
-      payloadBuilder.build.mockResolvedValue(payloadStub());
-      fetchSpy.mockResolvedValue(new Response('{}', { status: 200 }));
-
-      await service.tick(new Date('2026-04-20T00:00:00'));
-
-      expect(fetchSpy).toHaveBeenCalledWith(
-        'http://ingest.test/v1/report',
-        expect.objectContaining({ method: 'POST' }),
-      );
-      expect(install.markSent).toHaveBeenCalledTimes(1);
-    });
-
-    it('sends again when 24h have elapsed since last send', async () => {
-      const { service, install, payloadBuilder } = makeService();
-      const now = new Date('2026-04-20T12:00:00');
-      const old = new Date(now.getTime() - 25 * 60 * 60 * 1000).toISOString();
-      install.getOrCreate.mockResolvedValue({
-        ...baseInstall,
-        first_send_at: '2026-04-01T00:00:00',
-        last_sent_at: old,
-      });
-      payloadBuilder.build.mockResolvedValue(
-        payloadStub({
-          messages_total: 1,
-          messages_by_provider: { anthropic: 1 },
-          messages_by_tier: { simple: 1 },
-          messages_by_auth_type: { api_key: 1 },
-          tokens_input_total: 10,
-          tokens_output_total: 5,
-          agents_total: 1,
-          agents_by_platform: { openclaw: 1 },
-        }),
-      );
-      fetchSpy.mockResolvedValue(new Response('{}', { status: 200 }));
-
-      await service.tick(now);
-
-      expect(install.markSent).toHaveBeenCalled();
-    });
-
-    it('does not mark sent when the endpoint returns non-2xx', async () => {
-      const { service, install, payloadBuilder } = makeService();
-      install.getOrCreate.mockResolvedValue(baseInstall);
-      payloadBuilder.build.mockResolvedValue(payloadStub());
-      fetchSpy.mockResolvedValue(new Response('down', { status: 503 }));
-
-      await service.tick(new Date('2026-04-20T00:00:00'));
-
-      expect(install.markSent).not.toHaveBeenCalled();
-    });
-
-    it('swallows fetch errors so the cron never crashes the process', async () => {
-      const { service, install, payloadBuilder } = makeService();
-      install.getOrCreate.mockResolvedValue(baseInstall);
-      payloadBuilder.build.mockResolvedValue(payloadStub());
-      fetchSpy.mockRejectedValue(new Error('offline'));
-
-      await expect(service.tick(new Date('2026-04-20T00:00:00'))).resolves.toBeUndefined();
-
-      expect(install.markSent).not.toHaveBeenCalled();
-    });
-  });
-});
diff --git a/packages/backend/src/telemetry/telemetry.service.ts b/packages/backend/src/telemetry/telemetry.service.ts
deleted file mode 100644
index aa8e2ae2..00000000
--- a/packages/backend/src/telemetry/telemetry.service.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
-import { Cron, CronExpression } from '@nestjs/schedule';
-import { InstallIdService } from './install-id.service';
-import { PayloadBuilderService } from './payload-builder.service';
-import { buildTelemetryConfig, TELEMETRY_DOCS_URL, type TelemetryConfig } from './telemetry.config';
-
-const TWENTY_FOUR_HOURS_MS = 24 * 60 * 60 * 1000;
-
-/**
- * Drives the once-per-24h telemetry send for self-hosted installs.
- *
- * Opt-out: `MANIFEST_TELEMETRY_DISABLED=1` silences all outbound traffic.
- * Dev safety: when `NODE_ENV !== 'production'` the sender is also silent, so
- * local development and tests never report.
- *
- * The cron ticks hourly (not daily) so restarts don't skip windows — each
- * tick checks `last_sent_at + jitter` and fires only when 24h have elapsed.
- */
-@Injectable()
-export class TelemetryService implements OnModuleInit {
-  private readonly logger = new Logger(TelemetryService.name);
-  private readonly config: TelemetryConfig = buildTelemetryConfig();
-
-  constructor(
-    private readonly installIds: InstallIdService,
-    private readonly payloadBuilder: PayloadBuilderService,
-  ) {}
-
-  async onModuleInit(): Promise<void> {
-    if (!this.config.enabled) {
-      this.logger.log('Anonymous usage telemetry is disabled for this process.');
-      return;
-    }
-    const install = await this.installIds.getOrCreate();
-    this.logger.log(
-      `Anonymous usage telemetry is enabled. Install ID: ${install.install_id}. ` +
-        `To disable: set MANIFEST_TELEMETRY_DISABLED=1. What we send: ${TELEMETRY_DOCS_URL}`,
-    );
-  }
-
-  @Cron(CronExpression.EVERY_HOUR)
-  async tick(now: Date = new Date()): Promise<void> {
-    if (!this.config.enabled) return;
-
-    const install = await this.installIds.getOrCreate();
-    if (!this.shouldSend(install.first_send_at, install.last_sent_at, now)) return;
-
-    const payload = await this.payloadBuilder.build(
-      install.install_id,
-      this.config.manifestVersion,
-    );
-    const ok = await this.postPayload(payload);
-    if (ok) await this.installIds.markSent(now);
-  }
-
-  private shouldSend(firstSendAt: string | null, lastSentAt: string | null, now: Date): boolean {
-    if (firstSendAt && new Date(firstSendAt).getTime() > now.getTime()) return false;
-    if (!lastSentAt) return true;
-    return now.getTime() - new Date(lastSentAt).getTime() >= TWENTY_FOUR_HOURS_MS;
-  }
-
-  private async postPayload(payload: unknown): Promise<boolean> {
-    try {
-      const res = await fetch(this.config.endpoint, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify(payload),
-      });
-      if (!res.ok) {
-        this.logger.warn(`Telemetry endpoint returned ${res.status}`);
-        return false;
-      }
-      return true;
-    } catch (err) {
-      this.logger.warn(`Telemetry send failed: ${err}`);
-      return false;
-    }
-  }
-}
diff --git a/packages/backend/src/version/version-check.config.spec.ts b/packages/backend/src/version/version-check.config.spec.ts
deleted file mode 100644
index df43c9e1..00000000
--- a/packages/backend/src/version/version-check.config.spec.ts
+++ /dev/null
@@ -1,182 +0,0 @@
-import { isSelfHosted } from '../common/utils/detect-self-hosted';
-import { readManifestVersion } from '../telemetry/telemetry.config';
-import {
-  buildVersionCheckConfig,
-  changelogUrlFor,
-  compareVersions,
-  githubReleaseUrlFor,
-  parseReleaseTag,
-  summarizeReleases,
-  UPGRADE_COMMAND,
-  UPGRADE_DOCS_URL,
-} from './version-check.config';
-
-jest.mock('../common/utils/detect-self-hosted', () => ({
-  isSelfHosted: jest.fn(),
-}));
-jest.mock('../telemetry/telemetry.config', () => ({
-  readManifestVersion: jest.fn(),
-  UNKNOWN_VERSION: 'unknown',
-}));
-
-const mockIsSelfHosted = isSelfHosted as jest.MockedFunction<typeof isSelfHosted>;
-const mockReadVersion = readManifestVersion as jest.MockedFunction<typeof readManifestVersion>;
-
-describe('compareVersions', () => {
-  it('returns 0 for equal versions', () => {
-    expect(compareVersions('6.21.1', '6.21.1')).toBe(0);
-  });
-
-  it('returns a negative number when the first version is older', () => {
-    expect(compareVersions('6.21.1', '6.22.0')).toBeLessThan(0);
-    expect(compareVersions('6.21.1', '7.0.0')).toBeLessThan(0);
-    expect(compareVersions('6.21.1', '6.21.2')).toBeLessThan(0);
-  });
-
-  it('returns a positive number when the first version is newer', () => {
-    expect(compareVersions('6.22.0', '6.21.9')).toBeGreaterThan(0);
-  });
-
-  it('compares numerically, not lexically', () => {
-    expect(compareVersions('6.9.0', '6.10.0')).toBeLessThan(0);
-  });
-
-  it('returns null when either side is not a strict X.Y.Z version', () => {
-    expect(compareVersions('unknown', '6.22.0')).toBeNull();
-    expect(compareVersions('6.22.0', '6.22')).toBeNull();
-    expect(compareVersions('6.22.0-beta.1', '6.22.0')).toBeNull();
-  });
-});
-
-describe('parseReleaseTag', () => {
-  it('extracts the version from a manifest@X.Y.Z release tag', () => {
-    expect(parseReleaseTag('manifest@6.22.0')).toBe('6.22.0');
-  });
-
-  it('returns null for tags that are not Manifest releases', () => {
-    expect(parseReleaseTag('n8n-nodes-manifest-v0.2.1')).toBeNull();
-    expect(parseReleaseTag('v5.0.5')).toBeNull();
-    expect(parseReleaseTag('manifest@6.22')).toBeNull();
-    expect(parseReleaseTag(undefined)).toBeNull();
-  });
-});
-
-describe('summarizeReleases', () => {
-  const release = (tag: string, extra: Record<string, unknown> = {}) => ({
-    tag_name: tag,
-    draft: false,
-    prerelease: false,
-    ...extra,
-  });
-
-  it('returns the newest version and how many releases are newer than current', () => {
-    const body = [
-      release('manifest@6.21.1'),
-      release('manifest@6.21.0'),
-      release('manifest@6.20.0'),
-      release('manifest@6.19.0'),
-    ];
-    expect(summarizeReleases(body, '6.19.0')).toEqual({ latest: '6.21.1', releasesBehind: 3 });
-  });
-
-  it('reports zero behind when current is the newest', () => {
-    const body = [release('manifest@6.21.1'), release('manifest@6.21.0')];
-    expect(summarizeReleases(body, '6.21.1')).toEqual({ latest: '6.21.1', releasesBehind: 0 });
-  });
-
-  it('ignores drafts, pre-releases, and non-Manifest tags', () => {
-    const body = [
-      release('manifest@7.0.0', { draft: true }),
-      release('manifest@6.22.0', { prerelease: true }),
-      release('n8n-nodes-manifest-v0.2.1'),
-      release('manifest@6.21.1'),
-    ];
-    expect(summarizeReleases(body, '6.21.0')).toEqual({ latest: '6.21.1', releasesBehind: 1 });
-  });
-
-  it('does not rely on the API ordering to find the newest', () => {
-    const body = [
-      release('manifest@6.20.0'),
-      release('manifest@6.21.1'),
-      release('manifest@6.21.0'),
-    ];
-    expect(summarizeReleases(body, '6.20.0')).toEqual({ latest: '6.21.1', releasesBehind: 2 });
-  });
-
-  it('returns null when the body holds no usable release', () => {
-    expect(summarizeReleases([release('v5.0.5')], '6.21.1')).toBeNull();
-    expect(summarizeReleases([], '6.21.1')).toBeNull();
-    expect(summarizeReleases({ message: 'rate limited' }, '6.21.1')).toBeNull();
-    expect(summarizeReleases(['not-an-object', null], '6.21.1')).toBeNull();
-  });
-
-  it('reports an unknown distance when current cannot be parsed', () => {
-    const body = [release('manifest@6.21.1'), release('manifest@6.21.0')];
-    expect(summarizeReleases(body, 'unknown')).toEqual({ latest: '6.21.1', releasesBehind: null });
-  });
-});
-
-describe('release URLs', () => {
-  it('points changelogUrlFor at the website anchor for that version', () => {
-    expect(changelogUrlFor('6.22.0')).toBe('https://manifest.build/changelog/#v6-22-0');
-  });
-
-  it('points githubReleaseUrlFor at the encoded GitHub release tag', () => {
-    expect(githubReleaseUrlFor('6.22.0')).toBe(
-      'https://github.com/mnfst/llm-gateway/releases/tag/manifest%406.22.0',
-    );
-  });
-
-  it('exposes the documented upgrade instructions', () => {
-    expect(UPGRADE_DOCS_URL).toBe('https://manifest.build/llm-gateway/docs/self-hosted/#upgrading');
-    expect(UPGRADE_COMMAND).toBe('docker compose pull && docker compose up -d');
-  });
-});
-
-describe('buildVersionCheckConfig', () => {
-  beforeEach(() => {
-    mockIsSelfHosted.mockReset();
-    mockReadVersion.mockReset();
-    mockReadVersion.mockReturnValue('6.21.1');
-  });
-
-  it('enables the check on self-hosted installs by default', () => {
-    mockIsSelfHosted.mockReturnValue(true);
-    expect(buildVersionCheckConfig({})).toEqual({ enabled: true, currentVersion: '6.21.1' });
-  });
-
-  it('never checks in cloud mode', () => {
-    mockIsSelfHosted.mockReturnValue(false);
-    expect(buildVersionCheckConfig({}).enabled).toBe(false);
-  });
-
-  it('honours MANIFEST_UPDATE_CHECK_DISABLED as 1 or true', () => {
-    mockIsSelfHosted.mockReturnValue(true);
-    expect(buildVersionCheckConfig({ MANIFEST_UPDATE_CHECK_DISABLED: '1' }).enabled).toBe(false);
-    expect(buildVersionCheckConfig({ MANIFEST_UPDATE_CHECK_DISABLED: 'true' }).enabled).toBe(false);
-  });
-
-  it('treats an empty or 0 MANIFEST_UPDATE_CHECK_DISABLED as not disabled', () => {
-    mockIsSelfHosted.mockReturnValue(true);
-    expect(buildVersionCheckConfig({ MANIFEST_UPDATE_CHECK_DISABLED: '' }).enabled).toBe(true);
-    expect(buildVersionCheckConfig({ MANIFEST_UPDATE_CHECK_DISABLED: '0' }).enabled).toBe(true);
-  });
-
-  it('reads process.env when no environment is passed', () => {
-    mockIsSelfHosted.mockReturnValue(true);
-    const previous = process.env['MANIFEST_UPDATE_CHECK_DISABLED'];
-    process.env['MANIFEST_UPDATE_CHECK_DISABLED'] = '1';
-    try {
-      expect(buildVersionCheckConfig().enabled).toBe(false);
-    } finally {
-      if (previous === undefined) delete process.env['MANIFEST_UPDATE_CHECK_DISABLED'];
-      else process.env['MANIFEST_UPDATE_CHECK_DISABLED'] = previous;
-    }
-  });
-
-  it('disables the check when the running version cannot be read', () => {
-    mockIsSelfHosted.mockReturnValue(true);
-    mockReadVersion.mockReturnValue('unknown');
-    expect(buildVersionCheckConfig({})).toEqual({ enabled: false, currentVersion: 'unknown' });
-  });
-});
diff --git a/packages/backend/src/version/version-check.config.ts b/packages/backend/src/version/version-check.config.ts
deleted file mode 100644
index 2f2625d8..00000000
--- a/packages/backend/src/version/version-check.config.ts
+++ /dev/null
@@ -1,102 +0,0 @@
-import { isSelfHosted } from '../common/utils/detect-self-hosted';
-import { readManifestVersion, UNKNOWN_VERSION } from '../telemetry/telemetry.config';
-
-/**
- * The GitHub releases the Docker publish job creates for every version. They
- * are the source of truth for "what is the latest Manifest?" — the website
- * changelog is generated from them. One page of 100 is enough to both find
- * the newest and count how far behind an install is (capped at 100).
- */
-export const RELEASES_PAGE_SIZE = 100;
-export const RELEASES_URL = `https://api.github.com/repos/mnfst/llm-gateway/releases?per_page=${RELEASES_PAGE_SIZE}`;
-export const UPGRADE_DOCS_URL = 'https://manifest.build/llm-gateway/docs/self-hosted/#upgrading';
-export const UPGRADE_COMMAND = 'docker compose pull && docker compose up -d';
-
-export interface VersionCheckConfig {
-  /** False in cloud mode, when opted out, or when the running version is unreadable. */
-  enabled: boolean;
-  currentVersion: string;
-}
-
-/**
- * Opt-out with `MANIFEST_UPDATE_CHECK_DISABLED=1`. Deliberately separate from
- * the telemetry opt-out: one is "don't send data about me", the other is
- * "don't make outbound calls at all" (air-gapped installs). Cloud never
- * checks — cloud users are always on the latest deploy.
- */
-export function buildVersionCheckConfig(env: NodeJS.ProcessEnv = process.env): VersionCheckConfig {
-  const disabled = env['MANIFEST_UPDATE_CHECK_DISABLED'];
-  const isDisabled = disabled === '1' || disabled === 'true';
-  const currentVersion = readManifestVersion();
-  return {
-    enabled: isSelfHosted() && !isDisabled && currentVersion !== UNKNOWN_VERSION,
-    currentVersion,
-  };
-}
-
-const STRICT_SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
-const RELEASE_TAG = /^manifest@(\d+\.\d+\.\d+)$/;
-
-/**
- * Numeric three-part compare. Changesets only ever emits strict `X.Y.Z`, so
- * anything else (pre-releases, `unknown`) returns null rather than guessing.
- */
-export function compareVersions(a: string, b: string): number | null {
-  const pa = STRICT_SEMVER.exec(a);
-  const pb = STRICT_SEMVER.exec(b);
-  if (!pa || !pb) return null;
-  for (let i = 1; i <= 3; i++) {
-    const diff = Number(pa[i]) - Number(pb[i]);
-    if (diff !== 0) return diff;
-  }
-  return 0;
-}
-
-/** `manifest@6.22.0` → `6.22.0`; anything else → null. */
-export function parseReleaseTag(tag: unknown): string | null {
-  if (typeof tag !== 'string') return null;
-  const match = RELEASE_TAG.exec(tag);
-  return match ? match[1] : null;
-}
-
-export interface ReleaseSummary {
-  latest: string;
-  /** Releases newer than `current`; null when `current` is not a strict X.Y.Z. */
-  releasesBehind: number | null;
-}
-
-/**
- * Reduces a GitHub release-list body to the newest published Manifest
- * version and the number of releases newer than `current`. Drafts,
- * pre-releases, and other tags in the repo (the n8n node) are ignored, and
- * the API ordering is not trusted. Null when nothing usable is in the body.
- */
-export function summarizeReleases(body: unknown, current: string): ReleaseSummary | null {
-  if (!Array.isArray(body)) return null;
-  const versions: string[] = [];
-  for (const entry of body) {
-    if (typeof entry !== 'object' || entry === null) continue;
-    const release = entry as { tag_name?: unknown; draft?: unknown; prerelease?: unknown };
-    if (release.draft === true || release.prerelease === true) continue;
-    const version = parseReleaseTag(release.tag_name);
-    if (version) versions.push(version);
-  }
-  if (versions.length === 0) return null;
-
-  let latest = versions[0];
-  let releasesBehind: number | null = STRICT_SEMVER.test(current) ? 0 : null;
-  for (const version of versions) {
-    if ((compareVersions(version, latest) ?? 0) > 0) latest = version;
-    if (releasesBehind !== null && (compareVersions(version, current) ?? 0) > 0) releasesBehind++;
-  }
-  return { latest, releasesBehind };
-}
-
-/** Website changelog, scrolled to that version's entry. */
-export function changelogUrlFor(version: string): string {
-  return `https://manifest.build/changelog/#v${version.replace(/\./g, '-')}`;
-}
-
-export function githubReleaseUrlFor(version: string): string {
-  return `https://github.com/mnfst/llm-gateway/releases/tag/${encodeURIComponent(`manifest@${version}`)}`;
-}
diff --git a/packages/backend/src/version/version-check.service.spec.ts b/packages/backend/src/version/version-check.service.spec.ts
deleted file mode 100644
index da9a095e..00000000
--- a/packages/backend/src/version/version-check.service.spec.ts
+++ /dev/null
@@ -1,275 +0,0 @@
-import { Logger } from '@nestjs/common';
-import { VersionCheckService } from './version-check.service';
-import { RELEASES_URL, UPGRADE_COMMAND, UPGRADE_DOCS_URL } from './version-check.config';
-
-const fetchMock = jest.fn();
-(global as unknown as Record<string, unknown>).fetch = fetchMock;
-
-const HOUR_MS = 60 * 60 * 1000;
-const realDateNow = Date.now;
-
-/** A GitHub release-list body: newest first, like the real API. */
-function releasesResponse(...tagNames: unknown[]) {
-  const body = tagNames.map((tag_name) => ({ tag_name, draft: false, prerelease: false }));
-  return { ok: true, status: 200, json: async () => body };
-}
-
-function make(enabled = true, currentVersion = '6.21.1') {
-  return new VersionCheckService({ enabled, currentVersion });
-}
-
-describe('VersionCheckService', () => {
-  let warnSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    fetchMock.mockReset();
-    Date.now = () => 1_800_000_000_000;
-    warnSpy = jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-  });
-
-  afterEach(() => {
-    Date.now = realDateNow;
-    warnSpy.mockRestore();
-  });
-
-  it('makes no outbound call and reports check_enabled=false when disabled', async () => {
-    const info = await make(false).getVersionInfo();
-
-    expect(fetchMock).not.toHaveBeenCalled();
-    expect(info).toEqual({
-      current: '6.21.1',
-      latest: null,
-      update_available: false,
-      releases_behind: null,
-      release_url: null,
-      github_release_url: null,
-      upgrade_docs_url: UPGRADE_DOCS_URL,
-      upgrade_command: UPGRADE_COMMAND,
-      check_enabled: false,
-      checked_at: null,
-    });
-  });
-
-  it('reports an available update with changelog and release links', async () => {
-    fetchMock.mockResolvedValue(releasesResponse('manifest@6.22.0', 'manifest@6.21.1'));
-
-    const info = await make().getVersionInfo();
-
-    expect(info).toEqual({
-      current: '6.21.1',
-      latest: '6.22.0',
-      update_available: true,
-      releases_behind: 1,
-      release_url: 'https://manifest.build/changelog/#v6-22-0',
-      github_release_url: 'https://github.com/mnfst/llm-gateway/releases/tag/manifest%406.22.0',
-      upgrade_docs_url: UPGRADE_DOCS_URL,
-      upgrade_command: UPGRADE_COMMAND,
-      check_enabled: true,
-      checked_at: new Date(1_800_000_000_000).toISOString(),
-    });
-  });
-
-  it('counts how many releases sit between current and latest', async () => {
-    fetchMock.mockResolvedValue(
-      releasesResponse(
-        'manifest@6.22.0',
-        'manifest@6.21.1',
-        'manifest@6.21.0',
-        'manifest@6.20.0',
-        'manifest@6.19.0',
-      ),
-    );
-
-    const info = await make(true, '6.19.0').getVersionInfo();
-
-    expect(info.latest).toBe('6.22.0');
-    expect(info.releases_behind).toBe(4);
-  });
-
-  it('calls the GitHub release-list API with a JSON accept header and a timeout', async () => {
-    fetchMock.mockResolvedValue(releasesResponse('manifest@6.22.0'));
-
-    await make().getVersionInfo();
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-    expect(url).toBe(RELEASES_URL);
-    expect(init.headers).toEqual({ Accept: 'application/vnd.github+json' });
-    expect(init.signal).toBeInstanceOf(AbortSignal);
-  });
-
-  it('reports no update when already on the latest release', async () => {
-    fetchMock.mockResolvedValue(releasesResponse('manifest@6.21.1', 'manifest@6.21.0'));
-
-    const info = await make().getVersionInfo();
-
-    expect(info.latest).toBe('6.21.1');
-    expect(info.update_available).toBe(false);
-    expect(info.releases_behind).toBe(0);
-    expect(info.release_url).toBe('https://manifest.build/changelog/#v6-21-1');
-  });
-
-  it('reports no update when running a version newer than the latest release', async () => {
-    fetchMock.mockResolvedValue(releasesResponse('manifest@6.21.0'));
-
-    const info = await make().getVersionInfo();
-
-    expect(info.update_available).toBe(false);
-    expect(info.releases_behind).toBe(0);
-  });
-
-  it('coalesces concurrent callers into a single GitHub request', async () => {
-    let resolveFetch: (value: unknown) => void = () => undefined;
-    fetchMock.mockReturnValue(new Promise((resolve) => (resolveFetch = resolve)));
-    const service = make();
-
-    const first = service.getVersionInfo();
-    const second = service.getVersionInfo();
-    const third = service.getVersionInfo();
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    resolveFetch(releasesResponse('manifest@6.22.0'));
-    const results = await Promise.all([first, second, third]);
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    for (const info of results) {
-      expect(info.latest).toBe('6.22.0');
-      expect(info.update_available).toBe(true);
-    }
-  });
-
-  it('lets a caller after a coalesced failure see the failure, not hang', async () => {
-    let rejectFetch: (reason: unknown) => void = () => undefined;
-    fetchMock.mockReturnValue(new Promise((_, reject) => (rejectFetch = reject)));
-    const service = make();
-
-    const first = service.getVersionInfo();
-    const second = service.getVersionInfo();
-    rejectFetch(new Error('boom'));
-    const [a, b] = await Promise.all([first, second]);
-
-    expect(a.latest).toBeNull();
-    expect(b.latest).toBeNull();
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(warnSpy).toHaveBeenCalledTimes(1);
-  });
-
-  it('serves the cached result for 24 hours, then refreshes', async () => {
-    fetchMock.mockResolvedValue(releasesResponse('manifest@6.22.0'));
-    const service = make();
-
-    await service.getVersionInfo();
-    Date.now = () => 1_800_000_000_000 + 23 * HOUR_MS;
-    await service.getVersionInfo();
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    Date.now = () => 1_800_000_000_000 + 25 * HOUR_MS;
-    fetchMock.mockResolvedValue(releasesResponse('manifest@6.23.0'));
-    const info = await service.getVersionInfo();
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(info.latest).toBe('6.23.0');
-  });
-
-  it('degrades to "unknown latest" when the network call throws, and warns once', async () => {
-    fetchMock.mockRejectedValue(new Error('ENETUNREACH'));
-
-    const info = await make().getVersionInfo();
-
-    expect(info.latest).toBeNull();
-    expect(info.update_available).toBe(false);
-    expect(info.releases_behind).toBeNull();
-    expect(info.release_url).toBeNull();
-    expect(info.github_release_url).toBeNull();
-    expect(info.check_enabled).toBe(true);
-    expect(info.checked_at).toBeNull();
-    expect(warnSpy).toHaveBeenCalledTimes(1);
-    expect(warnSpy.mock.calls[0][0]).toContain('ENETUNREACH');
-  });
-
-  it('logs a non-Error rejection without crashing', async () => {
-    fetchMock.mockRejectedValue('socket hang up');
-
-    const info = await make().getVersionInfo();
-
-    expect(info.latest).toBeNull();
-    expect(warnSpy.mock.calls[0][0]).toContain('socket hang up');
-  });
-
-  it('treats a non-OK response as a failure', async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 403, json: async () => ({}) });
-
-    const info = await make().getVersionInfo();
-
-    expect(info.latest).toBeNull();
-    expect(warnSpy.mock.calls[0][0]).toContain('403');
-  });
-
-  it('treats a body without any Manifest release as a failure', async () => {
-    fetchMock.mockResolvedValue(releasesResponse('v5.0.5'));
-
-    const info = await make().getVersionInfo();
-
-    expect(info.latest).toBeNull();
-    expect(warnSpy.mock.calls[0][0]).toContain('no Manifest release');
-  });
-
-  it('backs off for an hour after a failure instead of retrying every request', async () => {
-    fetchMock.mockRejectedValue(new Error('boom'));
-    const service = make();
-
-    await service.getVersionInfo();
-    Date.now = () => 1_800_000_000_000 + 30 * 60 * 1000;
-    await service.getVersionInfo();
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    Date.now = () => 1_800_000_000_000 + 61 * 60 * 1000;
-    fetchMock.mockResolvedValue(releasesResponse('manifest@6.22.0'));
-    const info = await service.getVersionInfo();
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(info.latest).toBe('6.22.0');
-  });
-
-  it('keeps serving the last good result when a refresh fails', async () => {
-    fetchMock.mockResolvedValue(releasesResponse('manifest@6.22.0'));
-    const service = make();
-    await service.getVersionInfo();
-
-    Date.now = () => 1_800_000_000_000 + 25 * HOUR_MS;
-    fetchMock.mockRejectedValue(new Error('boom'));
-    const info = await service.getVersionInfo();
-
-    expect(info.latest).toBe('6.22.0');
-    expect(info.update_available).toBe(true);
-    expect(info.releases_behind).toBe(1);
-    expect(info.checked_at).toBe(new Date(1_800_000_000_000).toISOString());
-  });
-
-  it('only warns once per outage, not on every failed refresh', async () => {
-    fetchMock.mockRejectedValue(new Error('boom'));
-    const service = make();
-
-    await service.getVersionInfo();
-    Date.now = () => 1_800_000_000_000 + 2 * HOUR_MS;
-    await service.getVersionInfo();
-
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(warnSpy).toHaveBeenCalledTimes(1);
-  });
-
-  it('warns again after a recovery when a new outage starts', async () => {
-    const service = make();
-    fetchMock.mockRejectedValue(new Error('first'));
-    await service.getVersionInfo();
-
-    Date.now = () => 1_800_000_000_000 + 2 * HOUR_MS;
-    fetchMock.mockResolvedValue(releasesResponse('manifest@6.22.0'));
-    await service.getVersionInfo();
-
-    Date.now = () => 1_800_000_000_000 + 27 * HOUR_MS;
-    fetchMock.mockRejectedValue(new Error('second'));
-    await service.getVersionInfo();
-
-    expect(warnSpy).toHaveBeenCalledTimes(2);
-    expect(warnSpy.mock.calls[1][0]).toContain('second');
-  });
-});
diff --git a/packages/backend/src/version/version-check.service.ts b/packages/backend/src/version/version-check.service.ts
deleted file mode 100644
index 3427d30b..00000000
--- a/packages/backend/src/version/version-check.service.ts
+++ /dev/null
@@ -1,135 +0,0 @@
-import { Inject, Injectable, Logger } from '@nestjs/common';
-import {
-  changelogUrlFor,
-  compareVersions,
-  githubReleaseUrlFor,
-  RELEASES_URL,
-  summarizeReleases,
-  UPGRADE_COMMAND,
-  UPGRADE_DOCS_URL,
-  type ReleaseSummary,
-  type VersionCheckConfig,
-} from './version-check.config';
-
-export const VERSION_CHECK_CONFIG = Symbol('VERSION_CHECK_CONFIG');
-
-/** Successful checks are reused for a day; failures back off for an hour. */
-const SUCCESS_TTL_MS = 24 * 60 * 60 * 1000;
-const FAILURE_BACKOFF_MS = 60 * 60 * 1000;
-const FETCH_TIMEOUT_MS = 5000;
-
-export interface VersionInfo {
-  current: string;
-  latest: string | null;
-  update_available: boolean;
-  /**
-   * Releases published after `current`, capped at the 100 the check fetches.
-   * Null until the first successful check or when `current` is unreadable.
-   */
-  releases_behind: number | null;
-  /** Website changelog anchored at `latest`. */
-  release_url: string | null;
-  github_release_url: string | null;
-  upgrade_docs_url: string;
-  upgrade_command: string;
-  /** False in cloud mode or when `MANIFEST_UPDATE_CHECK_DISABLED` is set. */
-  check_enabled: boolean;
-  /** When `latest` was last confirmed; null until the first successful check. */
-  checked_at: string | null;
-}
-
-interface CachedCheck extends ReleaseSummary {
-  checkedAt: number;
-}
-
-/**
- * Answers "is there a newer Manifest, and how far behind am I?" for
- * self-hosted dashboards.
- *
- * One outbound call to GitHub per day per process, never on cloud, never when
- * opted out, and never more than once an hour while GitHub is unreachable —
- * the dashboard may poll this on every page load, and the unauthenticated
- * GitHub API allows 60 requests an hour.
- */
-@Injectable()
-export class VersionCheckService {
-  private readonly logger = new Logger(VersionCheckService.name);
-  private cached: CachedCheck | null = null;
-  private lastFailureAt: number | null = null;
-  /** The refresh in progress, so concurrent callers share one GitHub request. */
-  private inflight: Promise<void> | null = null;
-
-  constructor(@Inject(VERSION_CHECK_CONFIG) private readonly config: VersionCheckConfig) {}
-
-  async getVersionInfo(): Promise<VersionInfo> {
-    if (this.config.enabled) {
-      await this.refreshIfDue();
-    }
-    return this.buildInfo();
-  }
-
-  private refreshIfDue(): Promise<void> {
-    const now = Date.now();
-    if (this.cached && now - this.cached.checkedAt < SUCCESS_TTL_MS) return Promise.resolve();
-    if (this.lastFailureAt !== null && now - this.lastFailureAt < FAILURE_BACKOFF_MS) {
-      return Promise.resolve();
-    }
-    if (!this.inflight) {
-      this.inflight = this.refresh(now).finally(() => {
-        this.inflight = null;
-      });
-    }
-    return this.inflight;
-  }
-
-  /** Never rejects: a failure is recorded for backoff and the caller gets stale/null data. */
-  private async refresh(now: number): Promise<void> {
-    try {
-      const summary = await this.fetchReleases();
-      this.cached = { ...summary, checkedAt: now };
-      this.lastFailureAt = null;
-    } catch (err) {
-      // Warn once per outage: the first failure after a success (or at boot)
-      // is worth a log line; repeating it every hour is noise.
-      if (this.lastFailureAt === null) {
-        const message = err instanceof Error ? err.message : String(err);
-        this.logger.warn(`Update check failed (${message}); will retry in an hour`);
-      }
-      this.lastFailureAt = now;
-    }
-  }
-
-  private async fetchReleases(): Promise<ReleaseSummary> {
-    const res = await fetch(RELEASES_URL, {
-      headers: { Accept: 'application/vnd.github+json' },
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-    });
-    if (!res.ok) {
-      throw new Error(`GitHub responded ${res.status}`);
-    }
-    const summary = summarizeReleases(await res.json(), this.config.currentVersion);
-    if (!summary) {
-      throw new Error('no Manifest release in the GitHub response');
-    }
-    return summary;
-  }
-
-  private buildInfo(): VersionInfo {
-    const current = this.config.currentVersion;
-    const cached = this.config.enabled ? this.cached : null;
-    const latest = cached?.latest ?? null;
-    const cmp = latest ? compareVersions(current, latest) : null;
-    return {
-      current,
-      latest,
-      update_available: cmp !== null && cmp < 0,
-      releases_behind: cached?.releasesBehind ?? null,
-      release_url: latest ? changelogUrlFor(latest) : null,
-      github_release_url: latest ? githubReleaseUrlFor(latest) : null,
-      upgrade_docs_url: UPGRADE_DOCS_URL,
-      upgrade_command: UPGRADE_COMMAND,
-      check_enabled: this.config.enabled,
-      checked_at: cached ? new Date(cached.checkedAt).toISOString() : null,
-    };
-  }
-}
diff --git a/packages/backend/src/version/version.controller.spec.ts b/packages/backend/src/version/version.controller.spec.ts
deleted file mode 100644
index 38d1d470..00000000
--- a/packages/backend/src/version/version.controller.spec.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import { IS_PUBLIC_KEY } from '../common/decorators/public.decorator';
-import { VersionController } from './version.controller';
-import type { VersionCheckService, VersionInfo } from './version-check.service';
-
-describe('VersionController', () => {
-  const info: VersionInfo = {
-    current: '6.21.1',
-    latest: '6.22.0',
-    update_available: true,
-    releases_behind: 1,
-    release_url: 'https://manifest.build/changelog/#v6-22-0',
-    github_release_url: 'https://github.com/mnfst/llm-gateway/releases/tag/manifest%406.22.0',
-    upgrade_docs_url: 'https://manifest.build/llm-gateway/docs/self-hosted/#upgrading',
-    upgrade_command: 'docker compose pull && docker compose up -d',
-    check_enabled: true,
-    checked_at: '2026-09-04T09:00:00.000Z',
-  };
-
-  it('returns the version info from the service', async () => {
-    const service = { getVersionInfo: jest.fn().mockResolvedValue(info) };
-    const controller = new VersionController(service as unknown as VersionCheckService);
-
-    await expect(controller.getVersion()).resolves.toEqual(info);
-  });
-
-  it('is served at GET /api/v1/version behind the normal session/API-key guards', () => {
-    const prefix = Reflect.getMetadata('path', VersionController);
-    const route = Reflect.getMetadata('path', VersionController.prototype.getVersion);
-    const isPublic = Reflect.getMetadata(IS_PUBLIC_KEY, VersionController.prototype.getVersion);
-
-    expect(`${prefix}/${route}`).toBe('api/v1/version');
-    expect(isPublic).toBeUndefined();
-  });
-});
diff --git a/packages/backend/src/version/version.controller.ts b/packages/backend/src/version/version.controller.ts
deleted file mode 100644
index d8b4f2e8..00000000
--- a/packages/backend/src/version/version.controller.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { Controller, Get } from '@nestjs/common';
-import { VersionCheckService, type VersionInfo } from './version-check.service';
-
-/**
- * Running version + latest release for the self-hosted dashboard's update
- * badge. Session/API-key guarded like the rest of the dashboard API: the
- * version an install runs is not something to hand to anonymous callers.
- */
-@Controller('api/v1')
-export class VersionController {
-  constructor(private readonly versionCheck: VersionCheckService) {}
-
-  @Get('version')
-  getVersion(): Promise<VersionInfo> {
-    return this.versionCheck.getVersionInfo();
-  }
-}
diff --git a/packages/backend/src/version/version.module.ts b/packages/backend/src/version/version.module.ts
deleted file mode 100644
index 675a2d24..00000000
--- a/packages/backend/src/version/version.module.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import { Module } from '@nestjs/common';
-import { buildVersionCheckConfig } from './version-check.config';
-import { VERSION_CHECK_CONFIG, VersionCheckService } from './version-check.service';
-import { VersionController } from './version.controller';
-
-@Module({
-  controllers: [VersionController],
-  providers: [
-    { provide: VERSION_CHECK_CONFIG, useFactory: buildVersionCheckConfig },
-    VersionCheckService,
-  ],
-})
-export class VersionModule {}
diff --git a/packages/backend/test/cors.e2e-spec.ts b/packages/backend/test/cors.e2e-spec.ts
index 0718e16e..bb7ca5e3 100644
--- a/packages/backend/test/cors.e2e-spec.ts
+++ b/packages/backend/test/cors.e2e-spec.ts
@@ -4,13 +4,17 @@ import type { INestApplication } from '@nestjs/common';
 import type { NextFunction, Request, Response } from 'express';
 import request from 'supertest';
 import {
-  HOSTED_WINGMAN_ORIGIN,
   applyPrivateNetworkAllow,
   buildCorsOptions,
   buildDevAllowedOrigins,
   buildProdAllowedOrigins,
 } from '../src/cors-csp-config';
 
+/** An origin an operator opts in with THINKER_CORS_ORIGINS. */
+const OPERATOR_ORIGIN = 'https://tools.acme.dev';
+/** The hosted gateway tester upstream allowed by default; Thinker must not (#17). */
+const FORMER_HOSTED_ORIGIN = ['https://wingman', 'manifest', 'build'].join('.');
+
 @Controller()
 class CorsTestController {
   @Get('/api/v1/health')
@@ -27,18 +31,11 @@ class CorsTestController {
 @Module({ controllers: [CorsTestController] })
 class CorsTestModule {}
 
-// Boots a minimal NestJS app and calls `enableCors()` with the exact same
-// inputs main.ts uses in dev: the dev allow-list, the PNA middleware, and the
-// shared CORS options (header reflection + preflight maxAge).
-async function buildDevApp(): Promise<INestApplication> {
+async function buildApp(allowedOrigins: string[]): Promise<INestApplication> {
   const moduleRef = await Test.createTestingModule({
     imports: [CorsTestModule],
   }).compile();
   const app = moduleRef.createNestApplication();
-  const allowedOrigins = buildDevAllowedOrigins({
-    configuredOrigin: 'http://localhost:3000',
-    wingmanPort: 3002,
-  });
   app.use((req: Request, res: Response, next: NextFunction) => {
     applyPrivateNetworkAllow(req, allowedOrigins, (name, value) => res.setHeader(name, value));
     next();
@@ -48,23 +45,18 @@ async function buildDevApp(): Promise<INestApplication> {
   return app;
 }
 
-// Boots a minimal NestJS app with the exact CORS config main.ts uses in
-// production: the hosted Wingman origin (plus WINGMAN_CORS_ORIGINS opt-ins), the
-// PNA middleware (so a browser-hosted Wingman can reach a self-hosted gateway on
-// a LAN address), and the shared CORS options.
-async function buildProdApp(extraOrigins?: string): Promise<INestApplication> {
-  const moduleRef = await Test.createTestingModule({
-    imports: [CorsTestModule],
-  }).compile();
-  const app = moduleRef.createNestApplication();
-  const allowedOrigins = buildProdAllowedOrigins({ extraOrigins });
-  app.use((req: Request, res: Response, next: NextFunction) => {
-    applyPrivateNetworkAllow(req, allowedOrigins, (name, value) => res.setHeader(name, value));
-    next();
-  });
-  app.enableCors(buildCorsOptions(allowedOrigins));
-  await app.init();
-  return app;
+// The exact inputs main.ts uses in dev: the dev allow-list, the PNA middleware,
+// and the shared CORS options (header reflection + preflight maxAge).
+function buildDevApp(extraOrigins?: string): Promise<INestApplication> {
+  return buildApp(
+    buildDevAllowedOrigins({ configuredOrigin: 'http://localhost:3000', extraOrigins }),
+  );
+}
+
+// The exact CORS config main.ts uses in production: only THINKER_CORS_ORIGINS
+// opt-ins, the PNA middleware, and the shared CORS options.
+function buildProdApp(extraOrigins?: string): Promise<INestApplication> {
+  return buildApp(buildProdAllowedOrigins({ extraOrigins }));
 }
 
 describe('CORS — development', () => {
@@ -86,46 +78,29 @@ describe('CORS — development', () => {
     expect(res.headers['access-control-allow-origin']).toBe('http://localhost:3000');
   });
 
-  it('allows the local Wingman dev server', async () => {
-    const res = await request(app.getHttpServer())
-      .options('/v1/chat/completions')
-      .set('Origin', 'http://localhost:3002')
-      .set('Access-Control-Request-Method', 'POST');
-    expect(res.headers['access-control-allow-origin']).toBe('http://localhost:3002');
-  });
-
-  it('allows preflight from the hosted Wingman origin', async () => {
-    const res = await request(app.getHttpServer())
-      .options('/v1/chat/completions')
-      .set('Origin', HOSTED_WINGMAN_ORIGIN)
-      .set('Access-Control-Request-Method', 'POST')
-      .set('Access-Control-Request-Headers', 'authorization,content-type');
-    expect(res.headers['access-control-allow-origin']).toBe(HOSTED_WINGMAN_ORIGIN);
-    const allowHeaders = (res.headers['access-control-allow-headers'] ?? '').toLowerCase();
-    expect(allowHeaders).toContain('authorization');
-    expect(allowHeaders).toContain('content-type');
-  });
+  it.each([FORMER_HOSTED_ORIGIN, 'http://localhost:3002', 'https://evil.example.com'])(
+    'rejects %s (no Allow-Origin header echoed)',
+    async (origin) => {
+      const res = await request(app.getHttpServer())
+        .options('/v1/chat/completions')
+        .set('Origin', origin)
+        .set('Access-Control-Request-Method', 'POST');
+      expect(res.headers['access-control-allow-origin']).toBeUndefined();
+    },
+  );
 
   it('does not echo Access-Control-Allow-Credentials (no cookies cross-origin)', async () => {
     const res = await request(app.getHttpServer())
-      .options('/v1/chat/completions')
-      .set('Origin', HOSTED_WINGMAN_ORIGIN)
-      .set('Access-Control-Request-Method', 'POST');
+      .options('/api/v1/health')
+      .set('Origin', 'http://localhost:3000')
+      .set('Access-Control-Request-Method', 'GET');
     expect(res.headers['access-control-allow-credentials']).toBeUndefined();
   });
 
-  it('rejects unknown origins (no Allow-Origin header echoed)', async () => {
-    const res = await request(app.getHttpServer())
-      .options('/v1/chat/completions')
-      .set('Origin', 'https://evil.example.com')
-      .set('Access-Control-Request-Method', 'POST');
-    expect(res.headers['access-control-allow-origin']).toBeUndefined();
-  });
-
   it('echoes Access-Control-Allow-Private-Network for PNA preflight from a listed origin', async () => {
     const res = await request(app.getHttpServer())
       .options('/api/v1/health')
-      .set('Origin', HOSTED_WINGMAN_ORIGIN)
+      .set('Origin', 'http://localhost:3000')
       .set('Access-Control-Request-Method', 'GET')
       .set('Access-Control-Request-Private-Network', 'true');
     expect(res.headers['access-control-allow-private-network']).toBe('true');
@@ -134,21 +109,34 @@ describe('CORS — development', () => {
   it('does not echo Allow-Private-Network when the request header is missing', async () => {
     const res = await request(app.getHttpServer())
       .options('/api/v1/health')
-      .set('Origin', HOSTED_WINGMAN_ORIGIN)
+      .set('Origin', 'http://localhost:3000')
       .set('Access-Control-Request-Method', 'GET');
     expect(res.headers['access-control-allow-private-network']).toBeUndefined();
   });
 
   it('caches the preflight (maxAge) so a reload does not re-run it every few seconds', async () => {
     const res = await request(app.getHttpServer())
-      .options('/v1/chat/completions')
-      .set('Origin', HOSTED_WINGMAN_ORIGIN)
-      .set('Access-Control-Request-Method', 'POST');
+      .options('/api/v1/health')
+      .set('Origin', 'http://localhost:3000')
+      .set('Access-Control-Request-Method', 'GET');
     expect(res.headers['access-control-max-age']).toBe('7200');
   });
+
+  it('allows a THINKER_CORS_ORIGINS opt-in in dev too', async () => {
+    const scoped = await buildDevApp(OPERATOR_ORIGIN);
+    try {
+      const res = await request(scoped.getHttpServer())
+        .options('/v1/chat/completions')
+        .set('Origin', OPERATOR_ORIGIN)
+        .set('Access-Control-Request-Method', 'POST');
+      expect(res.headers['access-control-allow-origin']).toBe(OPERATOR_ORIGIN);
+    } finally {
+      await scoped.close();
+    }
+  });
 });
 
-describe('CORS — production', () => {
+describe('CORS — production, default', () => {
   let app: INestApplication;
 
   beforeAll(async () => {
@@ -159,18 +147,54 @@ describe('CORS — production', () => {
     await app.close();
   });
 
-  it('allows preflight from the hosted Wingman origin', async () => {
+  it.each([FORMER_HOSTED_ORIGIN, 'https://evil.example.com', 'http://localhost:3000'])(
+    'allows no cross-origin caller: rejects %s',
+    async (origin) => {
+      const preflight = await request(app.getHttpServer())
+        .options('/v1/chat/completions')
+        .set('Origin', origin)
+        .set('Access-Control-Request-Method', 'POST')
+        .set('Access-Control-Request-Private-Network', 'true');
+      expect(preflight.headers['access-control-allow-origin']).toBeUndefined();
+      expect(preflight.headers['access-control-allow-private-network']).toBeUndefined();
+
+      const post = await request(app.getHttpServer())
+        .post('/v1/chat/completions')
+        .set('Origin', origin)
+        .send({ model: 'auto' });
+      expect(post.headers['access-control-allow-origin']).toBeUndefined();
+    },
+  );
+
+  it('still serves same-origin and non-browser callers (no Origin header)', async () => {
+    const res = await request(app.getHttpServer()).post('/v1/chat/completions').send({});
+    expect(res.status).toBe(201);
+  });
+});
+
+describe('CORS — production, THINKER_CORS_ORIGINS', () => {
+  let app: INestApplication;
+
+  beforeAll(async () => {
+    app = await buildProdApp(`${OPERATOR_ORIGIN}/`);
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('allows the preflight from an operator-configured origin', async () => {
     const res = await request(app.getHttpServer())
       .options('/v1/chat/completions')
-      .set('Origin', HOSTED_WINGMAN_ORIGIN)
+      .set('Origin', OPERATOR_ORIGIN)
       .set('Access-Control-Request-Method', 'POST');
-    expect(res.headers['access-control-allow-origin']).toBe(HOSTED_WINGMAN_ORIGIN);
+    expect(res.headers['access-control-allow-origin']).toBe(OPERATOR_ORIGIN);
   });
 
   it('reflects the SDK fingerprint headers on the preflight (X-Stainless-*)', async () => {
     const res = await request(app.getHttpServer())
       .options('/v1/chat/completions')
-      .set('Origin', HOSTED_WINGMAN_ORIGIN)
+      .set('Origin', OPERATOR_ORIGIN)
       .set('Access-Control-Request-Method', 'POST')
       .set(
         'Access-Control-Request-Headers',
@@ -186,54 +210,41 @@ describe('CORS — production', () => {
   it('echoes Allow-Origin on the actual POST, not just the preflight', async () => {
     const res = await request(app.getHttpServer())
       .post('/v1/chat/completions')
-      .set('Origin', HOSTED_WINGMAN_ORIGIN)
+      .set('Origin', OPERATOR_ORIGIN)
       .send({ model: 'auto' });
-    expect(res.headers['access-control-allow-origin']).toBe(HOSTED_WINGMAN_ORIGIN);
+    expect(res.headers['access-control-allow-origin']).toBe(OPERATOR_ORIGIN);
   });
 
   it('does not echo Access-Control-Allow-Credentials (no cookies cross-origin)', async () => {
     const res = await request(app.getHttpServer())
       .options('/v1/chat/completions')
-      .set('Origin', HOSTED_WINGMAN_ORIGIN)
+      .set('Origin', OPERATOR_ORIGIN)
       .set('Access-Control-Request-Method', 'POST');
     expect(res.headers['access-control-allow-credentials']).toBeUndefined();
   });
 
-  it('rejects unknown origins (no Allow-Origin header echoed)', async () => {
+  it('answers the Private Network Access preflight for an allow-listed origin', async () => {
     const res = await request(app.getHttpServer())
       .options('/v1/chat/completions')
-      .set('Origin', 'https://evil.example.com')
-      .set('Access-Control-Request-Method', 'POST');
-    expect(res.headers['access-control-allow-origin']).toBeUndefined();
-  });
-
-  it('answers the Private Network Access preflight for an allow-listed origin (self-hosted LAN gateways)', async () => {
-    const res = await request(app.getHttpServer())
-      .options('/v1/chat/completions')
-      .set('Origin', HOSTED_WINGMAN_ORIGIN)
+      .set('Origin', OPERATOR_ORIGIN)
       .set('Access-Control-Request-Method', 'POST')
       .set('Access-Control-Request-Private-Network', 'true');
     expect(res.headers['access-control-allow-private-network']).toBe('true');
   });
 
-  it('caches the preflight (maxAge) to avoid a preflight per Wingman request', async () => {
+  it('caches the preflight (maxAge)', async () => {
     const res = await request(app.getHttpServer())
       .options('/v1/chat/completions')
-      .set('Origin', HOSTED_WINGMAN_ORIGIN)
+      .set('Origin', OPERATOR_ORIGIN)
       .set('Access-Control-Request-Method', 'POST');
     expect(res.headers['access-control-max-age']).toBe('7200');
   });
 
-  it('allows an operator-configured extra origin via WINGMAN_CORS_ORIGINS', async () => {
-    const scoped = await buildProdApp('https://wingman.acme.dev');
-    try {
-      const res = await request(scoped.getHttpServer())
-        .options('/v1/chat/completions')
-        .set('Origin', 'https://wingman.acme.dev')
-        .set('Access-Control-Request-Method', 'POST');
-      expect(res.headers['access-control-allow-origin']).toBe('https://wingman.acme.dev');
-    } finally {
-      await scoped.close();
-    }
+  it('still rejects origins the operator did not list', async () => {
+    const res = await request(app.getHttpServer())
+      .options('/v1/chat/completions')
+      .set('Origin', FORMER_HOSTED_ORIGIN)
+      .set('Access-Control-Request-Method', 'POST');
+    expect(res.headers['access-control-allow-origin']).toBeUndefined();
   });
 });
diff --git a/packages/backend/test/csp.e2e-spec.ts b/packages/backend/test/csp.e2e-spec.ts
index 5100d9bb..3e30304f 100644
--- a/packages/backend/test/csp.e2e-spec.ts
+++ b/packages/backend/test/csp.e2e-spec.ts
@@ -21,6 +21,7 @@ function buildApp() {
           connectSrc: ["'self'"],
           fontSrc: ["'self'"],
           objectSrc: ["'none'"],
+          frameSrc: ["'self'"],
           frameAncestors: parseFrameAncestors(process.env['FRAME_ANCESTORS']),
           upgradeInsecureRequests: null,
         },
@@ -59,6 +60,14 @@ describe('CSP header', () => {
     expect(csp).toContain("object-src 'none'");
   });
 
+  it("frames only 'self' and names no hosted third-party origin (#17)", async () => {
+    const res = await request(server).get('/').expect(200);
+    const csp = res.headers['content-security-policy'] as string;
+    expect(csp.split(';')).toContain("frame-src 'self'");
+    expect(csp).not.toMatch(/https?:\/\//);
+    expect(csp).not.toMatch(/localhost|127\.0\.0\.1/);
+  });
+
   it('honors a configured FRAME_ANCESTORS and drops the bare wildcard', async () => {
     const prev = process.env['FRAME_ANCESTORS'];
     process.env['FRAME_ANCESTORS'] = 'https://app.example.com, *';
diff --git a/packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts b/packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts
index 86cb631f..3b396130 100644
--- a/packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts
+++ b/packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts
@@ -1,6 +1,7 @@
 import { DataSource } from 'typeorm';
 import { entities, migrations } from '../src/database/data-source-definitions';
 import { DropAutofixSchema1803400000000 } from '../src/database/migrations/1803400000000-DropAutofixSchema';
+import { DropInstallMetadata1803500000000 } from '../src/database/migrations/1803500000000-DropInstallMetadata';
 
 /** Every Autofix column the migration drops, as `table.column`. */
 const AUTOFIX_COLUMNS = [
@@ -84,6 +85,14 @@ describe('DropAutofixSchema migration (e2e)', () => {
     });
     await ds.initialize();
     await ds.runMigrations({ transaction: 'each' });
+    // #17 drops `install_metadata` after this migration. Revert in the order the
+    // runner would, so the table this migration's revert touches exists again.
+    const queryRunner = ds.createQueryRunner();
+    try {
+      await new DropInstallMetadata1803500000000().down(queryRunner);
+    } finally {
+      await queryRunner.release();
+    }
   }, 120_000);
 
   afterAll(async () => {
diff --git a/packages/backend/test/drop-install-metadata-migration.e2e-spec.ts b/packages/backend/test/drop-install-metadata-migration.e2e-spec.ts
new file mode 100644
index 00000000..6f9b7e25
--- /dev/null
+++ b/packages/backend/test/drop-install-metadata-migration.e2e-spec.ts
@@ -0,0 +1,95 @@
+import { DataSource } from 'typeorm';
+import { entities, migrations } from '../src/database/data-source-definitions';
+import { DropAutofixSchema1803400000000 } from '../src/database/migrations/1803400000000-DropAutofixSchema';
+import { DropInstallMetadata1803500000000 } from '../src/database/migrations/1803500000000-DropInstallMetadata';
+
+async function installMetadataColumns(ds: DataSource): Promise<string[]> {
+  const rows: Array<{ name: string }> = await ds.query(
+    `SELECT column_name AS name FROM information_schema.columns
+     WHERE table_schema = 'public' AND table_name = 'install_metadata'
+     ORDER BY 1`,
+  );
+  return rows.map((row) => row.name);
+}
+
+async function run(
+  ds: DataSource,
+  migration: DropInstallMetadata1803500000000 | DropAutofixSchema1803400000000,
+  direction: 'up' | 'down',
+): Promise<void> {
+  const queryRunner = ds.createQueryRunner();
+  try {
+    // Mirror the deploy runner (transaction mode 'each'): SET LOCAL only
+    // applies inside a transaction.
+    await queryRunner.startTransaction();
+    await migration[direction](queryRunner);
+    await queryRunner.commitTransaction();
+  } catch (error) {
+    await queryRunner.rollbackTransaction();
+    throw error;
+  } finally {
+    await queryRunner.release();
+  }
+}
+
+const TELEMETRY_COLUMNS = ['created_at', 'first_send_at', 'id', 'install_id', 'last_sent_at'];
+
+describe('DropInstallMetadata migration (e2e)', () => {
+  let ds: DataSource;
+
+  beforeAll(async () => {
+    ds = new DataSource({
+      type: 'postgres',
+      url:
+        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase',
+      // The exact registries the deploy runner uses, not a glob.
+      entities,
+      migrations,
+      synchronize: false,
+      dropSchema: true,
+      logging: false,
+    });
+    await ds.initialize();
+    await ds.runMigrations({ transaction: 'each' });
+  }, 120_000);
+
+  afterAll(async () => {
+    if (ds?.isInitialized) await ds.destroy();
+  });
+
+  it('leaves no install_metadata table on a database migrated from empty', async () => {
+    expect(await installMetadataColumns(ds)).toEqual([]);
+    const applied: Array<{ name: string }> = await ds.query(
+      `SELECT "name" FROM "migrations" WHERE "name" = 'DropInstallMetadata1803500000000'`,
+    );
+    expect(applied).toHaveLength(1);
+  });
+
+  it('drops a populated table from an existing install, and is idempotent', async () => {
+    await run(ds, new DropInstallMetadata1803500000000(), 'down');
+    expect(await installMetadataColumns(ds)).toEqual(TELEMETRY_COLUMNS);
+    await ds.query(
+      `INSERT INTO "install_metadata" ("id", "install_id") VALUES ('singleton', 'some-uuid')`,
+    );
+
+    await run(ds, new DropInstallMetadata1803500000000(), 'up');
+    expect(await installMetadataColumns(ds)).toEqual([]);
+
+    await run(ds, new DropInstallMetadata1803500000000(), 'up');
+    expect(await installMetadataColumns(ds)).toEqual([]);
+  });
+
+  it('reverts in runner order through the #16 drop and re-applies cleanly', async () => {
+    await run(ds, new DropInstallMetadata1803500000000(), 'down');
+    // A revert on an already-reverted schema is a no-op.
+    await run(ds, new DropInstallMetadata1803500000000(), 'down');
+    await run(ds, new DropAutofixSchema1803400000000(), 'down');
+    expect(await installMetadataColumns(ds)).toEqual(
+      [...TELEMETRY_COLUMNS, 'autofix_consented_at'].sort(),
+    );
+
+    await run(ds, new DropAutofixSchema1803400000000(), 'up');
+    await run(ds, new DropInstallMetadata1803500000000(), 'up');
+    expect(await installMetadataColumns(ds)).toEqual([]);
+  });
+});
diff --git a/packages/backend/test/helpers.ts b/packages/backend/test/helpers.ts
index 79597fb9..e9a4c4f5 100644
--- a/packages/backend/test/helpers.ts
+++ b/packages/backend/test/helpers.ts
@@ -31,7 +31,6 @@ import { CustomProvider } from '../src/entities/custom-provider.entity';
 import { EmailProviderConfig } from '../src/entities/email-provider-config.entity';
 import { SpecificityAssignment } from '../src/entities/specificity-assignment.entity';
 import { HeaderTier } from '../src/entities/header-tier.entity';
-import { InstallMetadata } from '../src/entities/install-metadata.entity';
 import { AgentModelParams } from '../src/entities/agent-model-params.entity';
 import { PlaygroundRun } from '../src/entities/playground-run.entity';
 import { PlaygroundColumn } from '../src/entities/playground-column.entity';
@@ -73,7 +72,6 @@ const entities = [
   EmailProviderConfig,
   SpecificityAssignment,
   HeaderTier,
-  InstallMetadata,
   AgentModelParams,
   PlaygroundRun,
   PlaygroundColumn,
diff --git a/packages/backend/test/no-phonehome-egress.e2e-spec.ts b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
new file mode 100644
index 00000000..d889deeb
--- /dev/null
+++ b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
@@ -0,0 +1,237 @@
+/**
+ * #17: Thinker makes no outbound call of its own. Upstream Manifest phoned home
+ * from the backend and the CLI: usage telemetry, a daily update check against
+ * GitHub releases, the setup-questionnaire forwarding, Sentry, the hourly
+ * modelparams.dev catalog refresh, and a hosted Wingman origin always allowed by
+ * CORS/CSP. All of it is gone; this guards against any of it coming back.
+ *
+ * The only outbound catalog destinations allowed are the ones in ADR 0003
+ * (openrouter.ai, models.dev, and raw.githubusercontent.com for OpenCode Go).
+ */
+import { spawn, type ChildProcess } from 'child_process';
+import { mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'fs';
+import { createServer } from 'net';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { DataSource } from 'typeorm';
+
+const FORBIDDEN_DESTINATIONS = [
+  'telemetry.manifest.build',
+  'blue.manifest.build',
+  'api.github.com/repos/mnfst',
+  'modelparams.dev',
+  'wingman.manifest.build',
+  'sentry.io',
+];
+const ADR_0003_CATALOG_HOSTS = new Set([
+  'openrouter.ai',
+  'models.dev',
+  'raw.githubusercontent.com',
+]);
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+
+const BACKEND = join(__dirname, '..');
+const SOURCE_ROOTS = [
+  join(BACKEND, 'src'),
+  join(BACKEND, '..', 'cli', 'src'),
+  join(BACKEND, '..', 'shared', 'src'),
+];
+
+function sourceFiles(dir: string): string[] {
+  return readdirSync(dir).flatMap((entry) => {
+    const path = join(dir, entry);
+    if (statSync(path).isDirectory()) return sourceFiles(path);
+    return /\.(ts|tsx|mjs|js|json|ya?ml)$/.test(entry) ? [path] : [];
+  });
+}
+
+/** Source files (old migrations aside) whose text matches, relative to packages/. */
+function filesMatching(pattern: RegExp): string[] {
+  return SOURCE_ROOTS.flatMap(sourceFiles)
+    .filter((file) => !file.includes(join('database', 'migrations')))
+    .filter((file) => pattern.test(readFileSync(file, 'utf8')))
+    .map((file) => file.slice(join(BACKEND, '..').length + 1));
+}
+
+function freePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address();
+      server.close(() =>
+        typeof address === 'object' && address
+          ? resolve(address.port)
+          : reject(new Error('no port')),
+      );
+    });
+  });
+}
+
+async function waitForHealth(base: string, child: ChildProcess, output: () => string) {
+  const deadline = Date.now() + 150_000;
+  while (Date.now() < deadline) {
+    if (child.exitCode !== null) {
+      throw new Error(`server exited with ${child.exitCode}:\n${output()}`);
+    }
+    try {
+      const res = await fetch(`${base}/api/v1/health`);
+      if (res.ok) return;
+    } catch {
+      /* not listening yet */
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+  throw new Error(`server did not become healthy:\n${output()}`);
+}
+
+interface EgressRecord {
+  kind: 'fetch' | 'dns';
+  target: string;
+}
+
+describe('no phone-home egress', () => {
+  it.each(FORBIDDEN_DESTINATIONS)(
+    'names %s nowhere in the backend, CLI or shared source',
+    (host) => {
+      expect(filesMatching(new RegExp(host.replace(/[.]/g, '\\.')))).toEqual([]);
+    },
+  );
+
+  it('ships no telemetry, update check, discovery forwarding, Sentry or Wingman code', () => {
+    expect(
+      filesMatching(
+        /TelemetryService|InstallIdService|VersionCheckService|DiscoverySyncService|@sentry\/|SENTRY_DSN|MANIFEST_TELEMETRY|TELEMETRY_ENDPOINT|UPDATE_CHECK|DISCOVERY_ENDPOINT|MODELPARAMS_API|WINGMAN_/,
+      ),
+    ).toEqual([]);
+  });
+
+  it('does not depend on the Sentry SDK', () => {
+    const pkg = JSON.parse(readFileSync(join(BACKEND, 'package.json'), 'utf8')) as {
+      dependencies?: Record<string, string>;
+      devDependencies?: Record<string, string>;
+    };
+    const deps = Object.keys({ ...pkg.dependencies, ...pkg.devDependencies });
+    expect(deps.filter((name) => name.startsWith('@sentry/'))).toEqual([]);
+  });
+
+  /**
+   * Boots the real server (`src/main.ts`, every module of AppModule) in its own
+   * process, in production mode and with none of upstream's opt-out variables,
+   * with `test/support/egress-recorder.cjs` preloaded to record every fetch and
+   * DNS lookup while keeping the process off the network.
+   */
+  describe('at boot (production mode, no opt-out variable)', () => {
+    let child: ChildProcess | undefined;
+    let workDir: string;
+    let base: string;
+    let output = '';
+    let records: EgressRecord[] = [];
+
+    beforeAll(async () => {
+      const databaseUrl =
+        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase';
+      // Start from an empty schema: the real server migrates on boot, and
+      // earlier suites leave a synchronize()-built schema behind.
+      const reset = new DataSource({ type: 'postgres', url: databaseUrl, dropSchema: true });
+      await reset.initialize();
+      await reset.destroy();
+
+      workDir = mkdtempSync(join(tmpdir(), 'thinker-egress-'));
+      const egressLog = join(workDir, 'egress.jsonl');
+      writeFileSync(egressLog, '');
+      const port = await freePort();
+      base = `http://127.0.0.1:${port}`;
+
+      const env: NodeJS.ProcessEnv = {};
+      for (const [key, value] of Object.entries(process.env)) {
+        if (!/TELEMETRY|UPDATE_CHECK|DISCOVERY|SENTRY|MODELPARAMS|WINGMAN|EMBEDDED/.test(key)) {
+          env[key] = value;
+        }
+      }
+      Object.assign(env, {
+        NODE_ENV: 'production',
+        DATABASE_URL: databaseUrl,
+        PORT: String(port),
+        BIND_ADDRESS: '127.0.0.1',
+        BETTER_AUTH_URL: base,
+        BETTER_AUTH_SECRET:
+          process.env['BETTER_AUTH_SECRET'] ?? 'test-secret-for-e2e-at-least-32chars!!',
+        SHUTDOWN_DRAIN_MS: '0',
+        EGRESS_LOG: egressLog,
+      });
+
+      child = spawn(
+        process.execPath,
+        [
+          '-r',
+          require.resolve('ts-node/register/transpile-only'),
+          '-r',
+          join(__dirname, 'support', 'egress-recorder.cjs'),
+          join('src', 'main.ts'),
+        ],
+        { cwd: BACKEND, env, stdio: ['ignore', 'pipe', 'pipe'] },
+      );
+      child.stdout?.on('data', (chunk: Buffer) => (output += chunk.toString()));
+      child.stderr?.on('data', (chunk: Buffer) => (output += chunk.toString()));
+
+      await waitForHealth(base, child, () => output);
+      // Let fire-and-forget onModuleInit / onApplicationBootstrap work start.
+      await new Promise((resolve) => setTimeout(resolve, 3000));
+      records = readFileSync(egressLog, 'utf8')
+        .split('\n')
+        .filter((line) => line.length > 0)
+        .map((line) => JSON.parse(line) as EgressRecord);
+    }, 180_000);
+
+    afterAll(async () => {
+      if (child && child.exitCode === null) {
+        const exited = new Promise((resolve) => child!.once('exit', resolve));
+        child.kill('SIGTERM');
+        const timer = setTimeout(() => child!.kill('SIGKILL'), 10_000);
+        await exited;
+        clearTimeout(timer);
+      }
+      if (workDir) rmSync(workDir, { recursive: true, force: true });
+    }, 30_000);
+
+    it('boots and runs the egress recorder', () => {
+      expect(output).toContain('Server running on');
+      expect(records.length).toBeGreaterThan(0);
+    });
+
+    it('makes no request to a phone-home destination', () => {
+      const offenders = records.filter((record) =>
+        FORBIDDEN_DESTINATIONS.some((destination) => record.target.includes(destination)),
+      );
+      expect(offenders).toEqual([]);
+    });
+
+    it('fetches nothing outside the ADR 0003 catalogs', () => {
+      const remote = records
+        .filter((record) => record.kind === 'fetch')
+        .map((record) => new URL(record.target).hostname)
+        .filter((host) => !LOCAL_HOSTS.has(host));
+      expect(remote.filter((host) => !ADR_0003_CATALOG_HOSTS.has(host))).toEqual([]);
+    });
+
+    it('resolves no remote hostname, so nothing bypasses fetch to reach the network', () => {
+      const remote = records
+        .filter((record) => record.kind === 'dns')
+        .map((record) => record.target)
+        .filter((host) => !LOCAL_HOSTS.has(host));
+      expect(remote).toEqual([]);
+    });
+
+    it('no longer serves the update-check or discovery routes', async () => {
+      const version = await fetch(`${base}/api/v1/version`);
+      const discovery = await fetch(`${base}/api/v1/discovery/complete`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: '{}',
+      });
+      expect(version.status).toBe(404);
+      expect(discovery.status).toBe(404);
+    });
+  });
+});
diff --git a/packages/backend/test/support/egress-recorder.cjs b/packages/backend/test/support/egress-recorder.cjs
new file mode 100644
index 00000000..df519254
--- /dev/null
+++ b/packages/backend/test/support/egress-recorder.cjs
@@ -0,0 +1,52 @@
+/**
+ * Preloaded (`node -r`) into the server process that
+ * `no-phonehome-egress.e2e-spec.ts` boots. Records every `fetch` URL and every
+ * DNS lookup to the JSON-lines file named by `EGRESS_LOG`, and keeps the
+ * process off the network: a remote `fetch` gets a 503 and a remote hostname
+ * fails to resolve. The DNS hook also sees `http`/`https`/`net` connections
+ * that bypass `fetch`.
+ */
+'use strict';
+
+const fs = require('fs');
+const dns = require('dns');
+
+const logFile = process.env.EGRESS_LOG;
+if (!logFile) throw new Error('EGRESS_LOG is required');
+
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+
+function record(kind, target) {
+  fs.appendFileSync(logFile, JSON.stringify({ kind, target }) + '\n');
+}
+
+function notFound(hostname) {
+  return Object.assign(new Error(`getaddrinfo ENOTFOUND ${hostname}`), {
+    code: 'ENOTFOUND',
+    hostname,
+  });
+}
+
+const realFetch = globalThis.fetch;
+globalThis.fetch = async function recordedFetch(input, init) {
+  const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+  record('fetch', url);
+  if (LOCAL_HOSTS.has(new URL(url).hostname)) return realFetch(input, init);
+  return new Response('offline', { status: 503 });
+};
+
+const realLookup = dns.lookup;
+dns.lookup = function recordedLookup(hostname, options, callback) {
+  record('dns', hostname);
+  if (LOCAL_HOSTS.has(hostname)) return realLookup.apply(this, arguments);
+  const cb = typeof options === 'function' ? options : callback;
+  process.nextTick(() => cb(notFound(hostname)));
+  return undefined;
+};
+
+const realPromisesLookup = dns.promises.lookup;
+dns.promises.lookup = async function recordedPromisesLookup(hostname, options) {
+  record('dns', hostname);
+  if (LOCAL_HOSTS.has(hostname)) return realPromisesLookup.call(this, hostname, options);
+  throw notFound(hostname);
+};
diff --git a/packages/cli/README.md b/packages/cli/README.md
index d8be38a1..3bb18637 100644
--- a/packages/cli/README.md
+++ b/packages/cli/README.md
@@ -69,11 +69,9 @@ The CLI stores login credentials for each gateway host in `~/.config/manifest/co
 
 Agent keys are separate from management credentials. The CLI stores a newly created agent key in its local keystore and does not print it in `mnfst agent setup` unless you pass `--reveal`. Use `mnfst agent env my-app` to get the key and URL for your application; its output contains the key, so handle it as a secret.
 
-## Usage telemetry
+## No telemetry
 
-The CLI records usage telemetry by default. It batches events locally and normally sends one request per install per day. The payload contains a random, persistent install ID; CLI version; operating system; Cloud or self-hosted target; and each command's name, result, duration, and minute-level time. It may include the detected coding-agent runtime. It does not include command arguments, agent or provider names, gateway URLs, prompts, or credentials.
-
-Set `MANIFEST_TELEMETRY_DISABLED=1` to opt out. Telemetry files are stored beside the CLI config. You can set `MANIFEST_CLI_TELEMETRY_ENDPOINT` to send usage data to your own endpoint.
+The CLI collects no usage data and makes no network call of its own: it only talks to the gateway you point it at.
 
 ## Documentation
 
diff --git a/packages/cli/src/commands/commands.spec.ts b/packages/cli/src/commands/commands.spec.ts
index 0379c912..6fbeb0b5 100644
--- a/packages/cli/src/commands/commands.spec.ts
+++ b/packages/cli/src/commands/commands.spec.ts
@@ -3321,7 +3321,7 @@ describe('doctor', () => {
 
   it('calls an unreachable host by its name, and skips auth rather than blaming the key', async () => {
     const io = makeIo({
-      env: { MANIFEST_URL: HOST, MANIFEST_API_KEY: 'env-key', MANIFEST_TELEMETRY_DISABLED: '1' },
+      env: { MANIFEST_URL: HOST, MANIFEST_API_KEY: 'env-key' },
       fetchImpl: (async () => {
         throw new Error('ECONNREFUSED');
       }) as typeof fetch,
@@ -3339,7 +3339,7 @@ describe('doctor', () => {
 
   it('stringifies a non-Error transport failure', async () => {
     const io = makeIo({
-      env: { MANIFEST_URL: HOST, MANIFEST_API_KEY: 'k', MANIFEST_TELEMETRY_DISABLED: '1' },
+      env: { MANIFEST_URL: HOST, MANIFEST_API_KEY: 'k' },
       fetchImpl: (() => Promise.reject('dns exploded')) as unknown as typeof fetch,
     });
     expect(await run(io, ['doctor'])).toBe(1);
@@ -3357,7 +3357,7 @@ describe('doctor', () => {
     });
 
     const io2 = makeIo({
-      env: { MANIFEST_URL: HOST, MANIFEST_API_KEY: 'k', MANIFEST_TELEMETRY_DISABLED: '1' },
+      env: { MANIFEST_URL: HOST, MANIFEST_API_KEY: 'k' },
       fetchImpl: (async () =>
         new Response('<html>gateway</html>', { status: 502 })) as typeof fetch,
     });
diff --git a/packages/cli/src/index.spec.ts b/packages/cli/src/index.spec.ts
index d4226359..4bb12c50 100644
--- a/packages/cli/src/index.spec.ts
+++ b/packages/cli/src/index.spec.ts
@@ -90,6 +90,28 @@ describe('run', () => {
     expect(io.lastJson()).toMatchObject({ error: 'internal_error', message: 'boom' });
   });
 
+  it('sends only the command request: no usage report, no spool on disk (#17)', async () => {
+    const urls: string[] = [];
+    const io = makeIo({
+      env: { MANIFEST_URL: 'http://localhost:2099', MANIFEST_API_KEY: 'k' },
+      fetchImpl: async (input) => {
+        urls.push(String(input));
+        return new Response(JSON.stringify({ agents: [] }), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        });
+      },
+    });
+    for (const ok of [true, false]) {
+      if (!ok) io.env['MANIFEST_API_KEY'] = '';
+      await run(io, ['agent', 'list']);
+    }
+    expect(urls.length).toBeGreaterThan(0);
+    expect(urls.every((url) => url.startsWith('http://localhost:2099/'))).toBe(true);
+    const written = fs.readdirSync(io.configDir, { recursive: true }).map(String);
+    expect(written.filter((name) => /telemetry/.test(name))).toEqual([]);
+  });
+
   it('usage documents every registered command group', () => {
     for (const key of Object.keys(COMMANDS)) {
       const firstWord = key.split(' ')[0];
@@ -120,9 +142,8 @@ describe('run', () => {
     );
   });
 
-  it('usage names the persistent anonymous install id in the telemetry notice', () => {
-    expect(USAGE).toContain('~/.config/manifest/telemetry-id');
-    expect(USAGE).toContain('MANIFEST_TELEMETRY_DISABLED=1');
+  it('usage carries no telemetry notice: the CLI reports nothing (#17)', () => {
+    expect(USAGE).not.toMatch(/telemetry/i);
   });
 });
 
diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts
index 035bf884..680133ae 100644
--- a/packages/cli/src/index.ts
+++ b/packages/cli/src/index.ts
@@ -10,7 +10,6 @@ import * as provider from './commands/provider';
 import * as customProvider from './commands/custom-provider';
 import * as routing from './commands/routing';
 import * as runCommand from './commands/run';
-import { reportUsage, urlFlagOf } from './telemetry';
 import * as models from './commands/models';
 import * as configure from './commands/configure';
 import * as requests from './commands/requests';
@@ -156,12 +155,6 @@ Run (key injection, 1Password-style)
     The key never crosses stdout or your transcript.
 
 Environment: MANIFEST_URL, MANIFEST_API_KEY (overrides stored login)
-Telemetry: anonymous, batched — commands are spooled locally and sent once a day
-in one request: a persistent anonymous install id (a random UUID stored at
-~/.config/manifest/telemetry-id), command names, CLI version, ok, duration, os, and
-whether the install targets Cloud or a self-hosted server (never the URL).
-Never arguments, agent names, URLs, or keys.
-Disable with MANIFEST_TELEMETRY_DISABLED=1. Details: packages/cli/README.md.
 Credentials are stored per-host in ~/.config/manifest/config.json (mode 0600).`;
 
 export function resolveCommand(
@@ -201,18 +194,13 @@ export async function run(io: CliIo, argv: string[]): Promise<number> {
     );
     return 1;
   }
-  const started = Date.now();
-  // Only the host class is derived from the flag, never the URL (see telemetry.ts).
-  const flagUrl = urlFlagOf(resolved.rest);
   try {
     const code = await resolved.handler(io, resolved.rest);
     const ok = (code ?? 0) === 0;
-    await reportUsage(io, resolved.key, ok, Date.now() - started, flagUrl);
     // Only after a success: a failing command's stderr belongs to the failure.
     if (ok) skill.maybeNudgeSkill(io, resolved.key);
     return code ?? 0;
   } catch (error) {
-    await reportUsage(io, resolved.key, false, Date.now() - started, flagUrl);
     if (error instanceof CliError) {
       io.stdout(JSON.stringify(error.toJSON(), null, 2));
       return 1;
diff --git a/packages/cli/src/telemetry.spec.ts b/packages/cli/src/telemetry.spec.ts
deleted file mode 100644
index 3e6f6eca..00000000
--- a/packages/cli/src/telemetry.spec.ts
+++ /dev/null
@@ -1,400 +0,0 @@
-import * as fs from 'fs';
-import * as path from 'path';
-import {
-  DEFAULT_TELEMETRY_ENDPOINT,
-  FLUSH_AT_EVENTS,
-  FLUSH_INTERVAL_MS,
-  LOCK_STALE_MS,
-  MAX_SPOOL_EVENTS,
-  RETRY_BACKOFF_MS,
-  reportUsage,
-  spoolPath,
-  telemetryAnonId,
-  telemetryTarget,
-  urlFlagOf,
-} from './telemetry';
-import { makeIo, type TestIo } from '../test/helpers';
-
-type Call = { url: string; body: Record<string, unknown> };
-
-function capturing(calls: Call[], status = 202): typeof fetch {
-  return (async (url: string | URL | Request, init?: RequestInit) => {
-    calls.push({ url: String(url), body: JSON.parse(String(init?.body)) });
-    return new Response('{}', { status });
-  }) as typeof fetch;
-}
-
-function on(env: Record<string, string> = {}, fetchImpl?: typeof fetch): TestIo {
-  return makeIo({ env: { MANIFEST_TELEMETRY_DISABLED: '0', ...env }, fetchImpl });
-}
-
-function spoolLines(io: TestIo): string[] {
-  try {
-    return fs.readFileSync(spoolPath(io), 'utf8').split('\n').filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-
-function writeState(io: TestIo, state: Record<string, string>) {
-  const file = path.join(io.configDir, 'manifest', 'telemetry-state.json');
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, JSON.stringify(state));
-}
-
-function readState(io: TestIo): Record<string, string> {
-  return JSON.parse(
-    fs.readFileSync(path.join(io.configDir, 'manifest', 'telemetry-state.json'), 'utf8'),
-  );
-}
-
-describe('telemetry', () => {
-  it('classifies the target as cloud or self-hosted, never as a URL', () => {
-    // Fresh install, nothing configured: the CLI defaults to Cloud.
-    expect(telemetryTarget(makeIo())).toBe('cloud');
-    expect(telemetryTarget(makeIo({ env: { MANIFEST_URL: 'https://APP.manifest.build/' } }))).toBe(
-      'cloud',
-    );
-    expect(telemetryTarget(makeIo({ env: { MANIFEST_URL: 'http://localhost:3001' } }))).toBe(
-      'self-hosted',
-    );
-    // The active config host counts when no env override is set.
-    const configured = makeIo();
-    fs.mkdirSync(path.join(configured.configDir, 'manifest'), { recursive: true });
-    fs.writeFileSync(
-      path.join(configured.configDir, 'manifest', 'config.json'),
-      JSON.stringify({ activeHost: 'https://manifest.acme.internal', hosts: {} }),
-    );
-    expect(telemetryTarget(configured)).toBe('self-hosted');
-    // A corrupt config falls through to the default; a bad URL is not Cloud.
-    const corrupt = makeIo();
-    fs.mkdirSync(path.join(corrupt.configDir, 'manifest'), { recursive: true });
-    fs.writeFileSync(path.join(corrupt.configDir, 'manifest', 'config.json'), '{not json');
-    expect(telemetryTarget(corrupt)).toBe('cloud');
-    expect(telemetryTarget(makeIo({ env: { MANIFEST_URL: 'not a url' } }))).toBe('self-hosted');
-    // A per-command --url outranks everything, as it does for the command itself.
-    expect(
-      telemetryTarget(
-        makeIo({ env: { MANIFEST_URL: 'https://app.manifest.build' } }),
-        'http://10.0.0.5:3001',
-      ),
-    ).toBe('self-hosted');
-  });
-
-  it('reads the --url flag out of a command line, stopping at the -- separator', () => {
-    expect(urlFlagOf(['agent', 'list', '--url', 'http://localhost:3001'])).toBe(
-      'http://localhost:3001',
-    );
-    expect(urlFlagOf(['--url=https://x.internal', 'whoami'])).toBe('https://x.internal');
-    expect(
-      urlFlagOf(['--agent', 'a', '--', 'node', 'tool.js', '--url', 'http://child']),
-    ).toBeUndefined();
-    expect(urlFlagOf(['whoami'])).toBeUndefined();
-    // Mirrors parseArgs: the last occurrence wins; a missing or flag-like value does not count.
-    expect(urlFlagOf(['--url', 'http://a', '--url', 'http://b'])).toBe('http://b');
-    expect(urlFlagOf(['--url', '--yes'])).toBeUndefined();
-    expect(urlFlagOf(['--url'])).toBeUndefined();
-    expect(urlFlagOf(['--url='])).toBe('');
-    expect(telemetryTarget(makeIo(), '')).toBe('self-hosted');
-    expect(urlFlagOf(['--url', 'http://a', '--url'])).toBe('http://a');
-  });
-
-  it('tags the batch with the last command’s target and keeps the class off the wire events', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    writeState(io, { last_flush_at: new Date(Date.now() - FLUSH_INTERVAL_MS - 1).toISOString() });
-    await reportUsage(io, 'whoami', true, 1, 'http://localhost:3001');
-
-    expect(calls[0].body.target).toBe('self-hosted');
-    const events = calls[0].body.events as Array<Record<string, unknown>>;
-    expect(events[0]).not.toHaveProperty('target');
-  });
-
-  it('tags a mixed spool (legacy + new events) by its latest event', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    writeState(io, { last_flush_at: '2020-01-01T00:00:00.000Z' });
-    fs.mkdirSync(path.dirname(spoolPath(io)), { recursive: true });
-    fs.writeFileSync(
-      spoolPath(io),
-      JSON.stringify({
-        command: 'login',
-        ok: true,
-        duration_ms: 5,
-        at: '2026-09-12T10:00:00.000Z',
-      }) + '\n',
-    );
-    // Mixed spool: the legacy line has no class, the new event does — the latest wins.
-    await reportUsage(io, 'whoami', true, 1);
-    expect(calls[0].body.target).toBe('cloud');
-    expect((calls[0].body.events as unknown[]).length).toBe(2);
-  });
-
-  it('mints a persistent anon id (0600) and reuses it', () => {
-    const io = makeIo();
-    const first = telemetryAnonId(io);
-    expect(first).toMatch(/^[0-9a-f-]{36}$/);
-    const idPath = path.join(io.configDir, 'manifest', 'telemetry-id');
-    expect(fs.statSync(idPath).mode & 0o777).toBe(0o600);
-    expect(telemetryAnonId(io)).toBe(first);
-  });
-
-  it('first run ever: spools the event and flushes it at once (new install shows up today)', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    await reportUsage(io, 'agent create', true, 123);
-
-    expect(calls).toHaveLength(1);
-    expect(calls[0].url).toBe(DEFAULT_TELEMETRY_ENDPOINT);
-    expect(calls[0].body).toEqual({
-      schema_version: 1,
-      anon_id: expect.stringMatching(/^[0-9a-f-]{36}$/),
-      cli_version: expect.any(String),
-      os: expect.any(String),
-      target: 'cloud',
-      events: [
-        {
-          command: 'agent create',
-          ok: true,
-          duration_ms: 123,
-          at: expect.stringMatching(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:00\.000Z$/),
-        },
-      ],
-    });
-    // Sent → spool emptied, flush stamped, file stays private.
-    expect(spoolLines(io)).toHaveLength(0);
-    expect(fs.statSync(spoolPath(io)).mode & 0o777).toBe(0o600);
-    expect(readState(io).last_flush_at).toBeDefined();
-  });
-
-  it('within 24h of the last flush: spools locally and sends nothing', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    writeState(io, { last_flush_at: new Date(Date.now() - FLUSH_INTERVAL_MS / 2).toISOString() });
-
-    await reportUsage(io, 'whoami', true, 1);
-    await reportUsage(io, 'doctor', false, 2);
-
-    expect(calls).toHaveLength(0);
-    expect(spoolLines(io)).toHaveLength(2);
-  });
-
-  it('24h after the last flush: ships every spooled event in one request, oldest first', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    writeState(io, { last_flush_at: new Date(Date.now() - FLUSH_INTERVAL_MS - 1).toISOString() });
-    fs.mkdirSync(path.dirname(spoolPath(io)), { recursive: true });
-    fs.writeFileSync(
-      spoolPath(io),
-      [
-        JSON.stringify({
-          command: 'login',
-          ok: true,
-          duration_ms: 5,
-          at: '2026-09-12T10:00:00.000Z',
-        }),
-        'not json {{{', // a torn line from a crashed write is skipped, not fatal
-        '',
-      ].join('\n'),
-    );
-
-    await reportUsage(io, 'agent list', true, 7);
-
-    expect(calls).toHaveLength(1);
-    const events = calls[0].body.events as Array<{ command: string }>;
-    expect(events.map((e) => e.command)).toEqual(['login', 'agent list']);
-    expect(spoolLines(io)).toHaveLength(0);
-  });
-
-  it('flushes early once the spool reaches the safety valve', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    writeState(io, { last_flush_at: new Date().toISOString() });
-    for (let i = 0; i < FLUSH_AT_EVENTS - 1; i++) await reportUsage(io, 'whoami', true, 1);
-    expect(calls).toHaveLength(0);
-
-    await reportUsage(io, 'whoami', true, 1);
-
-    expect(calls).toHaveLength(1);
-    expect((calls[0].body.events as unknown[]).length).toBe(FLUSH_AT_EVENTS);
-  });
-
-  it('caps the spool, dropping the oldest events, while the endpoint is unreachable', async () => {
-    const io = on({}, (async () => {
-      throw new Error('ECONNREFUSED');
-    }) as typeof fetch);
-    // Far in the past so every command is "due", but backoff stops the retries.
-    writeState(io, { last_flush_at: '2020-01-01T00:00:00.000Z' });
-    for (let i = 0; i < MAX_SPOOL_EVENTS + 5; i++) await reportUsage(io, `c${i}`, true, 1);
-
-    const lines = spoolLines(io);
-    expect(lines).toHaveLength(MAX_SPOOL_EVENTS);
-    expect(JSON.parse(lines[0]).command).toBe('c5');
-  });
-
-  it('after a failed send: keeps the spool and backs off for an hour', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls, 503));
-    await reportUsage(io, 'whoami', true, 1); // first run → attempts, gets 503
-    expect(calls).toHaveLength(1);
-    expect(spoolLines(io)).toHaveLength(1);
-    expect(readState(io).last_flush_at).toBeUndefined();
-    expect(readState(io).last_attempt_at).toBeDefined();
-
-    await reportUsage(io, 'whoami', true, 1); // inside the backoff window
-    expect(calls).toHaveLength(1);
-    expect(spoolLines(io)).toHaveLength(2);
-
-    // Backoff elapsed → retried with both events.
-    writeState(io, {
-      last_attempt_at: new Date(Date.now() - RETRY_BACKOFF_MS - 1).toISOString(),
-    });
-    await reportUsage(io, 'whoami', true, 1);
-    expect(calls).toHaveLength(2);
-    expect((calls[1].body.events as unknown[]).length).toBe(3);
-  });
-
-  it('adds agent_runtime per event only when a coding agent is driving the CLI', async () => {
-    const calls: Call[] = [];
-    const agent = on({ CLAUDECODE: '1' }, capturing(calls));
-    await reportUsage(agent, 'doctor', true, 1);
-    expect((calls[0].body.events as Array<Record<string, unknown>>)[0]).toMatchObject({
-      agent_runtime: 'claude-code',
-    });
-
-    const human = on({}, capturing(calls));
-    await reportUsage(human, 'doctor', true, 1);
-    expect((calls[1].body.events as Array<Record<string, unknown>>)[0]).not.toHaveProperty(
-      'agent_runtime',
-    );
-  });
-
-  it('honors MANIFEST_TELEMETRY_DISABLED (no spool, no send) and a custom endpoint', async () => {
-    const calls: Call[] = [];
-    const off = makeIo({ env: { MANIFEST_TELEMETRY_DISABLED: '1' }, fetchImpl: capturing(calls) });
-    await reportUsage(off, 'whoami', true, 1);
-    expect(calls).toHaveLength(0);
-    expect(spoolLines(off)).toHaveLength(0);
-
-    const custom = on(
-      { MANIFEST_CLI_TELEMETRY_ENDPOINT: 'http://peacock.local/v1/cli-report' },
-      capturing(calls),
-    );
-    await reportUsage(custom, 'whoami', true, 1);
-    expect(calls[0].url).toBe('http://peacock.local/v1/cli-report');
-  });
-
-  it('drains the response body so an unread socket cannot delay exit', async () => {
-    const streamed = new Response('{"ok":true}', { status: 202 });
-    const io = on({}, (async () => streamed) as typeof fetch);
-    await reportUsage(io, 'whoami', true, 1);
-    expect(streamed.bodyUsed).toBe(true);
-
-    // A bodyless reply (204) has no stream to cancel — the arrayBuffer path.
-    const empty = new Response(null, { status: 204 });
-    const io2 = on({}, (async () => empty) as typeof fetch);
-    await expect(reportUsage(io2, 'whoami', true, 1)).resolves.toBeUndefined();
-  });
-
-  it('swallows transport failures and clamps duration', async () => {
-    const io = on({}, (async () => {
-      throw new Error('ECONNREFUSED');
-    }) as typeof fetch);
-    await expect(reportUsage(io, 'login', false, 9_999_999)).resolves.toBeUndefined();
-    expect(JSON.parse(spoolLines(io)[0]).duration_ms).toBe(600000);
-  });
-
-  it('stays silent when the config dir is unwritable', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    // A file where the config directory should be: every mkdir/write throws.
-    fs.writeFileSync(path.join(io.configDir, 'manifest'), '');
-    await expect(reportUsage(io, 'whoami', true, 1)).resolves.toBeUndefined();
-    expect(calls).toHaveLength(0);
-  });
-
-  it('a concurrent run holding the lock only appends; the holder ships the batch', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    const lock = path.join(io.configDir, 'manifest', 'telemetry.lock');
-    fs.mkdirSync(path.dirname(lock), { recursive: true });
-    fs.writeFileSync(lock, ''); // fresh: another mnfst is mid-flush
-
-    await reportUsage(io, 'whoami', true, 1); // first run → would flush, but not while locked
-
-    expect(calls).toHaveLength(0);
-    expect(spoolLines(io)).toHaveLength(1);
-    expect(fs.existsSync(lock)).toBe(true); // not ours to release
-  });
-
-  it('reclaims a stale lock left by a crashed run, then releases its own', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    const lock = path.join(io.configDir, 'manifest', 'telemetry.lock');
-    fs.mkdirSync(path.dirname(lock), { recursive: true });
-    fs.writeFileSync(lock, '');
-    const old = (Date.now() - LOCK_STALE_MS - 5_000) / 1000;
-    fs.utimesSync(lock, old, old);
-
-    await reportUsage(io, 'whoami', true, 1);
-
-    expect(calls).toHaveLength(1);
-    expect(fs.existsSync(lock)).toBe(false);
-    // Rewrites go through a temp file + rename: nothing half-written is left behind.
-    expect(fs.readdirSync(path.dirname(lock)).filter((f) => f.endsWith('.tmp'))).toEqual([]);
-  });
-
-  it('gives up on a stale lock it cannot reclaim (unlink fails)', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    // A non-empty directory in the lock's place with an old mtime: `wx` fails,
-    // the stale check passes, and the reclaiming unlink throws.
-    const lock = path.join(io.configDir, 'manifest', 'telemetry.lock');
-    fs.mkdirSync(path.join(lock, 'child'), { recursive: true }); // unlink will fail (not a file)
-    const old = (Date.now() - LOCK_STALE_MS - 5_000) / 1000;
-    fs.utimesSync(lock, old, old); // after the child: creating it would bump mtime
-
-    await reportUsage(io, 'whoami', true, 1);
-
-    expect(calls).toHaveLength(0);
-    expect(spoolLines(io)).toHaveLength(1);
-  });
-
-  it('never removes a lock that a successor reclaimed while it was paused', async () => {
-    // Slow endpoint: while this run is mid-flush, simulate a reclaim by a
-    // successor that overwrote the lock with its own token.
-    let lock = '';
-    const io = on({}, (async () => {
-      fs.writeFileSync(lock, 'successor-token');
-      return new Response('{}', { status: 202 });
-    }) as typeof fetch);
-    lock = path.join(io.configDir, 'manifest', 'telemetry.lock');
-
-    await reportUsage(io, 'whoami', true, 1);
-
-    // Our release saw a foreign token and left the file alone.
-    expect(fs.readFileSync(lock, 'utf8')).toBe('successor-token');
-  });
-
-  it('releases the lock and sends nothing when the spool cannot be rewritten', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    // A directory where the spool file should be: the rename over it fails.
-    fs.mkdirSync(spoolPath(io), { recursive: true });
-
-    await reportUsage(io, 'whoami', true, 1);
-
-    expect(calls).toHaveLength(0);
-    expect(fs.existsSync(path.join(io.configDir, 'manifest', 'telemetry.lock'))).toBe(false);
-  });
-
-  it('treats an unparsable state file and a non-object spool line as empty', async () => {
-    const calls: Call[] = [];
-    const io = on({}, capturing(calls));
-    fs.mkdirSync(path.join(io.configDir, 'manifest'), { recursive: true });
-    fs.writeFileSync(path.join(io.configDir, 'manifest', 'telemetry-state.json'), 'null');
-    fs.writeFileSync(spoolPath(io), '42\n');
-    await reportUsage(io, 'whoami', true, 1);
-    expect((calls[0].body.events as unknown[]).length).toBe(1);
-  });
-});
diff --git a/packages/cli/src/telemetry.ts b/packages/cli/src/telemetry.ts
deleted file mode 100644
index f797c7f4..00000000
--- a/packages/cli/src/telemetry.ts
+++ /dev/null
@@ -1,357 +0,0 @@
-import * as fs from 'fs';
-import * as path from 'path';
-import { randomUUID } from 'crypto';
-import { CliIo } from './context';
-import { DEFAULT_URL, configFilePath, loadConfig, normalizeOrigin } from './config';
-import { VERSION } from './version';
-import { detectAgentRuntime } from './agent-runtime';
-
-export const DEFAULT_TELEMETRY_ENDPOINT = 'https://telemetry.manifest.build/v1/cli-report';
-/** Send once per install per day, like the backend's install report. */
-export const FLUSH_INTERVAL_MS = 24 * 60 * 60 * 1000;
-/** After a failed send, leave the endpoint alone for this long. */
-export const RETRY_BACKOFF_MS = 60 * 60 * 1000;
-/** Spool safety valve: flush early rather than let a scripted loop pile up. */
-export const FLUSH_AT_EVENTS = 200;
-/** Hard cap on what is kept between flushes; oldest events are dropped first. */
-export const MAX_SPOOL_EVENTS = 500;
-const SEND_TIMEOUT_MS = 1500;
-/** A lock older than this belongs to a process that died mid-flush; reclaim it. */
-export const LOCK_STALE_MS = 60 * 1000;
-
-export interface CliUsageEvent {
-  command: string;
-  ok: boolean;
-  duration_ms: number;
-  /** ISO-8601 UTC, minute precision — enough for "commands per day". */
-  at: string;
-  agent_runtime?: string;
-  /**
-   * Spool-only: the Manifest class this command targeted, resolved at record
-   * time so a `--url` flag counts. Hoisted to the envelope at flush and
-   * stripped from the wire events.
-   */
-  target?: TelemetryTarget;
-}
-
-export type TelemetryTarget = 'cloud' | 'self-hosted';
-
-/**
- * Which class of Manifest a command targets — Cloud or a self-hosted server —
- * never the URL itself. Same precedence as command resolution (`--url`, then
- * MANIFEST_URL, then the active config host, then Cloud). A corrupt config
- * falls through to that default; an unparsable URL is not Cloud.
- */
-export function telemetryTarget(io: CliIo, flagUrl?: string): TelemetryTarget {
-  let activeHost: string | undefined;
-  try {
-    activeHost = loadConfig(configFilePath(io.env)).activeHost;
-  } catch {
-    /* corrupt config: the login command reports it; here it just means "default" */
-  }
-  try {
-    const origin = normalizeOrigin(flagUrl ?? io.env['MANIFEST_URL'] ?? activeHost ?? DEFAULT_URL);
-    return origin === normalizeOrigin(DEFAULT_URL) || origin === 'https://gateway.manifest.build'
-      ? 'cloud'
-      : 'self-hosted';
-  } catch {
-    return 'self-hosted';
-  }
-}
-
-/**
- * The value of a `--url <x>` / `--url=<x>` flag in a command's argv, resolved
- * the way parseArgs does: the last occurrence wins, and an occurrence with no
- * value (or a flag where the value should be) does not count.
- */
-export function urlFlagOf(argv: readonly string[]): string | undefined {
-  let value: string | undefined;
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === '--') break; // everything after is the child command (mnfst run)
-    if (arg === '--url') {
-      const next = argv[i + 1];
-      if (next !== undefined && !next.startsWith('--')) {
-        value = next;
-        i++;
-      }
-    } else if (arg.startsWith('--url=')) {
-      // A bare `--url=` is an empty value, as parseArgs records it; the command
-      // then fails resolution, and here an unparsable URL classifies as not Cloud.
-      value = arg.slice('--url='.length);
-    }
-  }
-  return value;
-}
-
-interface FlushState {
-  last_flush_at?: string;
-  last_attempt_at?: string;
-}
-
-/**
- * Anonymous usage telemetry, following the product's install-telemetry
- * doctrine: on by default, opt-out via MANIFEST_TELEMETRY_DISABLED=1, and
- * ONE request per install per day. Each command appends a small event to a
- * local spool (0600, next to the config); the first command that runs 24h
- * after the last flush — or the first command ever, so a new install shows
- * up the same day — ships the spool in one POST. Nothing is sent per
- * command, so a scripted loop never hammers the endpoint and never pays the
- * network on every call. The payload is the registry command key ("agent
- * create" — NEVER arguments, URLs, agent names, or keys), the CLI version,
- * the platform, success/failure, duration, and the anon install id: a random
- * UUID persisted next to the config that identifies an install, not a person
- * or tenant.
- */
-export function telemetryAnonId(io: CliIo): string {
-  const idPath = path.join(telemetryDir(io), 'telemetry-id');
-  try {
-    const existing = fs.readFileSync(idPath, 'utf8').trim();
-    if (/^[0-9a-f-]{36}$/.test(existing)) return existing;
-  } catch {
-    /* first run — mint below */
-  }
-  const fresh = randomUUID();
-  try {
-    fs.mkdirSync(path.dirname(idPath), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(idPath, fresh + '\n', { mode: 0o600 });
-  } catch {
-    /* unwritable config dir — still return a (per-process) id */
-  }
-  return fresh;
-}
-
-export function telemetryDisabled(io: CliIo): boolean {
-  const v = io.env['MANIFEST_TELEMETRY_DISABLED'];
-  return v === '1' || v === 'true';
-}
-
-function telemetryDir(io: CliIo): string {
-  return path.dirname(configFilePath(io.env));
-}
-
-export function spoolPath(io: CliIo): string {
-  return path.join(telemetryDir(io), 'telemetry-spool.jsonl');
-}
-
-function statePath(io: CliIo): string {
-  return path.join(telemetryDir(io), 'telemetry-state.json');
-}
-
-function lockPath(io: CliIo): string {
-  return path.join(telemetryDir(io), 'telemetry.lock');
-}
-
-/**
- * Per-install mutex around read-modify-write of the spool and the flush, so
- * two `mnfst` processes finishing together cannot both pass the due check and
- * send the day's batch twice, or interleave spool rewrites. `wx` makes the
- * create-or-fail atomic; a stale lock (crash mid-flush) is reclaimed.
- */
-/**
- * Returns an ownership token on success, null when another run holds the
- * lock. The token is written into the lock file and checked again on release,
- * so a holder that was paused past the stale window (and whose lock was
- * reclaimed) can no longer delete the new owner's lock on its way out. Two
- * flushes in that pathological case are harmless: the ingest rejects a second
- * batch from the same install within minutes.
- */
-function acquireLock(io: CliIo, now: number): string | null {
-  const file = lockPath(io);
-  const token = randomUUID();
-  if (tryCreateLock(file, token)) return token;
-  if (!isStaleLock(file, now)) return null;
-  try {
-    fs.unlinkSync(file);
-  } catch {
-    return null; // not a plain file, or gone already: not ours to reclaim
-  }
-  // A racer may re-take it between the unlink and this create; then it is theirs.
-  return tryCreateLock(file, token) ? token : null;
-}
-
-function tryCreateLock(file: string, token: string): boolean {
-  try {
-    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(file, token, { flag: 'wx', mode: 0o600 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function isStaleLock(file: string, now: number): boolean {
-  try {
-    return now - fs.statSync(file).mtimeMs > LOCK_STALE_MS;
-  } catch {
-    return false; // unreadable: neither ours nor safely reclaimable
-  }
-}
-
-/** Remove the lock only while it still carries our token — never a successor's. */
-function releaseLock(io: CliIo, token: string): void {
-  const file = lockPath(io);
-  try {
-    if (fs.readFileSync(file, 'utf8') === token) fs.unlinkSync(file);
-  } catch {
-    /* already gone */
-  }
-}
-
-function readSpool(io: CliIo): CliUsageEvent[] {
-  try {
-    return fs
-      .readFileSync(spoolPath(io), 'utf8')
-      .split('\n')
-      .filter((line) => line.length > 0)
-      .flatMap((line) => {
-        try {
-          const parsed: unknown = JSON.parse(line);
-          return typeof parsed === 'object' && parsed !== null ? [parsed as CliUsageEvent] : [];
-        } catch {
-          return []; // a torn line from a crashed write — skip it, keep the rest
-        }
-      });
-  } catch {
-    return [];
-  }
-}
-
-/**
- * Full rewrite through a temp file + rename, so a crash or a full disk mid-write
- * leaves the previous spool intact instead of a truncated one.
- */
-function writeSpool(io: CliIo, events: CliUsageEvent[]): void {
-  const file = spoolPath(io);
-  const tmp = `${file}.${process.pid}.tmp`;
-  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-  fs.writeFileSync(tmp, events.map((e) => JSON.stringify(e) + '\n').join(''), { mode: 0o600 });
-  fs.chmodSync(tmp, 0o600);
-  fs.renameSync(tmp, file);
-}
-
-/** Lock-free fallback for a concurrent run: one small append, no rewrite, no flush. */
-function appendSpool(io: CliIo, event: CliUsageEvent): void {
-  const file = spoolPath(io);
-  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-  fs.appendFileSync(file, JSON.stringify(event) + '\n', { mode: 0o600 });
-}
-
-function readState(io: CliIo): FlushState {
-  try {
-    const parsed: unknown = JSON.parse(fs.readFileSync(statePath(io), 'utf8'));
-    return typeof parsed === 'object' && parsed !== null ? (parsed as FlushState) : {};
-  } catch {
-    return {};
-  }
-}
-
-function writeState(io: CliIo, state: FlushState): void {
-  const file = statePath(io);
-  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-  fs.writeFileSync(file, JSON.stringify(state) + '\n', { mode: 0o600 });
-}
-
-function msSince(iso: string | undefined, now: number): number {
-  if (!iso) return Number.POSITIVE_INFINITY;
-  const t = Date.parse(iso);
-  return Number.isFinite(t) ? now - t : Number.POSITIVE_INFINITY;
-}
-
-/** Record one command in the spool, then ship the spool if it is due. */
-export async function reportUsage(
-  io: CliIo,
-  command: string,
-  ok: boolean,
-  durationMs: number,
-  flagUrl?: string,
-): Promise<void> {
-  if (telemetryDisabled(io)) return;
-  const now = Date.now();
-  // Which coding agent is driving the CLI, when one is — a coarse runtime id
-  // ("claude-code"), never a version, path, or anything about the session.
-  // Omitted for human/script runs.
-  const runtime = detectAgentRuntime(io.env);
-  const event: CliUsageEvent = {
-    command,
-    ok,
-    duration_ms: Math.max(0, Math.min(600_000, Math.round(durationMs))),
-    at: new Date(now).toISOString().slice(0, 16) + ':00.000Z',
-    ...(runtime ? { agent_runtime: runtime.id } : {}),
-    target: telemetryTarget(io, flagUrl),
-  };
-  const token = acquireLock(io, now);
-  if (token === null) {
-    // Another mnfst is mid-flush (or the dir is unwritable): just record the
-    // event; the holder — or the next command — ships it.
-    try {
-      appendSpool(io, event);
-    } catch {
-      /* unwritable config dir: no spool, no send — telemetry stays invisible */
-    }
-    return;
-  }
-  try {
-    let spool: CliUsageEvent[];
-    try {
-      spool = [...readSpool(io), event].slice(-MAX_SPOOL_EVENTS);
-      writeSpool(io, spool);
-    } catch {
-      return; // unwritable config dir: no spool, no send — telemetry stays invisible
-    }
-
-    const state = readState(io);
-    const due =
-      msSince(state.last_flush_at, now) >= FLUSH_INTERVAL_MS || spool.length >= FLUSH_AT_EVENTS;
-    const backingOff = msSince(state.last_attempt_at, now) < RETRY_BACKOFF_MS;
-    if (!due || backingOff) return;
-    await flush(io, spool, state, now);
-  } finally {
-    releaseLock(io, token);
-  }
-}
-
-async function flush(io: CliIo, events: CliUsageEvent[], state: FlushState, now: number) {
-  const endpoint = io.env['MANIFEST_CLI_TELEMETRY_ENDPOINT'] ?? DEFAULT_TELEMETRY_ENDPOINT;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), SEND_TIMEOUT_MS);
-  let sent = false;
-  try {
-    const response = await io.fetchImpl(endpoint, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        schema_version: 1,
-        anon_id: telemetryAnonId(io),
-        cli_version: VERSION,
-        os: ['darwin', 'linux', 'win32'].includes(process.platform) ? process.platform : 'other',
-        // One class per batch (the ingest contract): the most recent command's.
-        // A spool written before the field shipped falls back to the current
-        // resolution.
-        target: events[events.length - 1]?.target ?? telemetryTarget(io),
-        events: events.map(({ target: _target, ...wire }) => wire),
-      }),
-      signal: controller.signal,
-    });
-    // Drain the body: an unread response keeps the socket alive and can delay
-    // process exit past the command's own work — telemetry must be invisible.
-    await (response.body?.cancel() ?? response.arrayBuffer());
-    sent = response.ok;
-  } catch {
-    /* telemetry must never affect the command */
-  } finally {
-    clearTimeout(timer);
-  }
-  try {
-    const attemptedAt = new Date(now).toISOString();
-    if (sent) {
-      // Keep only what arrived after the snapshot we just shipped.
-      writeSpool(io, readSpool(io).slice(events.length));
-      writeState(io, { last_flush_at: attemptedAt });
-    } else {
-      writeState(io, { ...state, last_attempt_at: attemptedAt });
-    }
-  } catch {
-    /* state unwritable: the next command simply tries again */
-  }
-}
diff --git a/packages/cli/test/helpers.ts b/packages/cli/test/helpers.ts
index 6cbd09d4..97ec1641 100644
--- a/packages/cli/test/helpers.ts
+++ b/packages/cli/test/helpers.ts
@@ -26,9 +26,9 @@ export function makeIo(options: TestIoOptions = {}): TestIo {
   const lines: string[] = [];
   const errLines: string[] = [];
   return {
-    // Telemetry off by default so command specs' fetch stubs see only
-    // their own traffic; telemetry.spec re-enables explicitly.
-    env: { XDG_CONFIG_HOME: configDir, MANIFEST_TELEMETRY_DISABLED: '1', ...options.env },
+    // No opt-out variable: the CLI makes no call of its own (#17), so a
+    // command's fetch stub sees only that command's traffic.
+    env: { XDG_CONFIG_HOME: configDir, ...options.env },
     fetchImpl:
       options.fetchImpl ??
       (async () => {

From d168f73df1b36bdf1450a7dae26840ba456fec6f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 01:31:36 -0300
Subject: [PATCH 08/17] fix(cli): default to a local gateway instead of
 Manifest Cloud

With no --url, MANIFEST_URL or stored login, the CLI targeted
https://app.manifest.build, so a MANIFEST_API_KEY set without a host
went to Manifest's cloud. DEFAULT_URL is now http://localhost:2099, the
default Thinker port, and the invalid-URL hint and README follow.

The backend's 404 hint for /chat/completions told callers to point
their baseURL at https://app.manifest.build/v1; it now refers to this
gateway.

The egress guard now fails on app.manifest.build or
gateway.manifest.build anywhere in the CLI or shared source (tests
included), on a new backend production file naming them, on a CLI
default that is not local, and on a boot request to either host. The
three remaining backend files (Cloud trusted origins, the dashboard
link fallback and the OG-tag placeholder) are pinned for #18, #22 and
#25 and may only shrink.

Refs #17

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../otlp/otlp-deprecated.controller.spec.ts   |  6 +--
 .../src/otlp/otlp-deprecated.controller.ts    |  2 +-
 .../test/no-phonehome-egress.e2e-spec.ts      | 40 ++++++++++++++++++-
 packages/cli/README.md                        |  4 +-
 packages/cli/src/client.spec.ts               |  2 +-
 packages/cli/src/commands/commands.spec.ts    |  2 +-
 packages/cli/src/config.spec.ts               | 17 ++++++--
 packages/cli/src/config.ts                    | 10 ++++-
 packages/cli/src/index.spec.ts                | 21 ++++++++++
 packages/cli/src/keystore.spec.ts             |  2 +-
 10 files changed, 90 insertions(+), 16 deletions(-)

diff --git a/packages/backend/src/otlp/otlp-deprecated.controller.spec.ts b/packages/backend/src/otlp/otlp-deprecated.controller.spec.ts
index c042f316..60f3e3b5 100644
--- a/packages/backend/src/otlp/otlp-deprecated.controller.spec.ts
+++ b/packages/backend/src/otlp/otlp-deprecated.controller.spec.ts
@@ -31,7 +31,6 @@ describe('OtlpDeprecatedController', () => {
       const result = controller.traces();
       expect(result.error.message).toContain('/v1/chat/completions');
     });
-
   });
 
   describe('metrics', () => {
@@ -112,9 +111,10 @@ describe('OtlpDeprecatedController', () => {
       expect(result.error.type).toBe('invalid_request_error');
     });
 
-    it('includes the correct baseURL hint', () => {
+    it('points the baseURL hint at this gateway, never a hosted one', () => {
       const result = controller.wrongChatPath();
-      expect(result.error.message).toContain('https://app.manifest.build/v1');
+      expect(result.error.message).toContain('this gateway URL followed by /v1');
+      expect(result.error.message).not.toMatch(/manifest\.build/);
     });
   });
 });
diff --git a/packages/backend/src/otlp/otlp-deprecated.controller.ts b/packages/backend/src/otlp/otlp-deprecated.controller.ts
index bed112ac..623b07ff 100644
--- a/packages/backend/src/otlp/otlp-deprecated.controller.ts
+++ b/packages/backend/src/otlp/otlp-deprecated.controller.ts
@@ -29,7 +29,7 @@ const WRONG_PATH_RESPONSE = {
   error: {
     message:
       'Use /v1/chat/completions (not /chat/completions). ' +
-      'Set your baseURL to https://app.manifest.build/v1',
+      'Set your baseURL to this gateway URL followed by /v1 (for example http://localhost:2099/v1).',
     type: 'invalid_request_error',
     status: 404,
   },
diff --git a/packages/backend/test/no-phonehome-egress.e2e-spec.ts b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
index d889deeb..4c8c69f5 100644
--- a/packages/backend/test/no-phonehome-egress.e2e-spec.ts
+++ b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
@@ -12,7 +12,7 @@ import { spawn, type ChildProcess } from 'child_process';
 import { mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'fs';
 import { createServer } from 'net';
 import { tmpdir } from 'os';
-import { join } from 'path';
+import { join, sep } from 'path';
 import { DataSource } from 'typeorm';
 
 const FORBIDDEN_DESTINATIONS = [
@@ -23,6 +23,22 @@ const FORBIDDEN_DESTINATIONS = [
   'wingman.manifest.build',
   'sentry.io',
 ];
+/**
+ * Manifest Cloud's API hosts. A CLI defaulting to one sent the user's key there
+ * whenever no host was configured; nothing may target them by default.
+ */
+const HOSTED_GATEWAY_HOSTS = ['app.manifest.build', 'gateway.manifest.build'];
+/**
+ * Backend production files that still name a hosted gateway host, none of them
+ * as a request destination: Cloud trusted origins (#18), and the dashboard link
+ * fallback with the OG-tag placeholder it matches in the frontend's index.html
+ * (#22, #25). The list may only shrink.
+ */
+const BACKEND_HOSTED_GATEWAY_LEFTOVERS = [
+  'backend/src/auth/auth.instance.ts',
+  'backend/src/common/utils/dashboard-url.ts',
+  'backend/src/common/utils/og-rewrite.ts',
+];
 const ADR_0003_CATALOG_HOSTS = new Set([
   'openrouter.ai',
   'models.dev',
@@ -98,6 +114,24 @@ describe('no phone-home egress', () => {
     },
   );
 
+  it('names no hosted gateway host anywhere in the CLI or shared source, tests included', () => {
+    const pattern = new RegExp(HOSTED_GATEWAY_HOSTS.map((h) => h.replace(/[.]/g, '\\.')).join('|'));
+    expect(filesMatching(pattern).filter((file) => /^(cli|shared)[\\/]/.test(file))).toEqual([]);
+  });
+
+  it('adds no backend production file naming a hosted gateway host', () => {
+    const pattern = new RegExp(HOSTED_GATEWAY_HOSTS.map((h) => h.replace(/[.]/g, '\\.')).join('|'));
+    const backendFiles = filesMatching(pattern)
+      .map((file) => file.split(sep).join('/'))
+      .filter((file) => file.startsWith('backend/') && !/\.spec\.tsx?$/.test(file));
+    expect(backendFiles.sort()).toEqual(BACKEND_HOSTED_GATEWAY_LEFTOVERS);
+  });
+
+  it('defaults the CLI to a local gateway', () => {
+    const config = readFileSync(join(BACKEND, '..', 'cli', 'src', 'config.ts'), 'utf8');
+    expect(config).toMatch(/export const DEFAULT_URL = 'http:\/\/localhost:2099';/);
+  });
+
   it('ships no telemetry, update check, discovery forwarding, Sentry or Wingman code', () => {
     expect(
       filesMatching(
@@ -202,7 +236,9 @@ describe('no phone-home egress', () => {
 
     it('makes no request to a phone-home destination', () => {
       const offenders = records.filter((record) =>
-        FORBIDDEN_DESTINATIONS.some((destination) => record.target.includes(destination)),
+        [...FORBIDDEN_DESTINATIONS, ...HOSTED_GATEWAY_HOSTS].some((destination) =>
+          record.target.includes(destination),
+        ),
       );
       expect(offenders).toEqual([]);
     });
diff --git a/packages/cli/README.md b/packages/cli/README.md
index 3bb18637..c80af761 100644
--- a/packages/cli/README.md
+++ b/packages/cli/README.md
@@ -19,7 +19,7 @@ npx mnfst-gateway-cli --help
 
 ## Quick start
 
-Sign in to the hosted Manifest gateway, then create an agent and connect a provider:
+Sign in to your gateway, then create an agent and connect a provider. With no `--url`, `MANIFEST_URL` or stored login, the CLI targets a gateway on this machine at `http://localhost:2099`; it never falls back to a hosted service.
 
 ```bash
 mnfst login
@@ -33,7 +33,7 @@ mnfst agent setup my-app
 
 Set `OPENAI_API_KEY` in your environment before connecting the provider. Choose a model shown by `mnfst models` if `gpt-4o-mini` is unavailable to your account. `mnfst agent setup` returns wiring instructions with the agent key masked.
 
-For a self-hosted gateway, pass its URL when you sign in:
+For a gateway on another host, pass its URL when you sign in:
 
 ```bash
 mnfst login --url https://gateway.example.com
diff --git a/packages/cli/src/client.spec.ts b/packages/cli/src/client.spec.ts
index 4ae92d59..06ff3945 100644
--- a/packages/cli/src/client.spec.ts
+++ b/packages/cli/src/client.spec.ts
@@ -47,7 +47,7 @@ describe('ApiClient', () => {
   it('refuses a redirect with one request instead of following it', async () => {
     const stub = fetchStub([{ status: 302, body: {} }]);
     const client = new ApiClient({
-      origin: 'https://app.manifest.build',
+      origin: 'https://gateway.example.com',
       apiKey: 'secret-key',
       fetchImpl: stub.impl,
     });
diff --git a/packages/cli/src/commands/commands.spec.ts b/packages/cli/src/commands/commands.spec.ts
index 6fbeb0b5..3ba096c7 100644
--- a/packages/cli/src/commands/commands.spec.ts
+++ b/packages/cli/src/commands/commands.spec.ts
@@ -3306,7 +3306,7 @@ describe('doctor', () => {
     expect(checks[0]).toEqual({
       name: 'config',
       ok: false,
-      detail: 'no credential for https://app.manifest.build (origin from default)',
+      detail: 'no credential for http://localhost:2099 (origin from default)',
       hint: 'Run mnfst login, or set MANIFEST_URL + MANIFEST_API_KEY',
     });
     expect(checks[1].ok).toBe(true);
diff --git a/packages/cli/src/config.spec.ts b/packages/cli/src/config.spec.ts
index 5bf729d9..f199c1b8 100644
--- a/packages/cli/src/config.spec.ts
+++ b/packages/cli/src/config.spec.ts
@@ -30,8 +30,8 @@ describe('configFilePath', () => {
 
 describe('normalizeOrigin', () => {
   it('reduces URLs to a lowercase origin', () => {
-    expect(normalizeOrigin('HTTPS://App.Manifest.Build/dashboard?x=1')).toBe(
-      'https://app.manifest.build',
+    expect(normalizeOrigin('HTTPS://Gateway.Example.COM/dashboard?x=1')).toBe(
+      'https://gateway.example.com',
     );
     expect(normalizeOrigin('http://localhost:2099/api')).toBe('http://localhost:2099');
   });
@@ -96,7 +96,18 @@ describe('resolveTarget', () => {
     },
   };
 
-  it('resolves url as flag > MANIFEST_URL > activeHost > cloud default', () => {
+  it('defaults to a local Thinker, never a hosted service (#17)', () => {
+    expect(DEFAULT_URL).toBe('http://localhost:2099');
+    expect(normalizeOrigin(DEFAULT_URL)).toBe('http://localhost:2099');
+    // An env key with nothing else configured stays on this machine.
+    expect(resolveTarget(undefined, { MANIFEST_API_KEY: 'env-key' }, {})).toEqual({
+      origin: 'http://localhost:2099',
+      apiKey: 'env-key',
+      source: 'env',
+    });
+  });
+
+  it('resolves url as flag > MANIFEST_URL > activeHost > local default', () => {
     expect(resolveTarget('http://flag:1', { MANIFEST_URL: 'http://env:2' }, config).origin).toBe(
       'http://flag:1',
     );
diff --git a/packages/cli/src/config.ts b/packages/cli/src/config.ts
index 1deed0af..810313ce 100644
--- a/packages/cli/src/config.ts
+++ b/packages/cli/src/config.ts
@@ -3,7 +3,13 @@ import * as path from 'path';
 import * as os from 'os';
 import { CliError } from './errors';
 
-export const DEFAULT_URL = 'https://app.manifest.build';
+/**
+ * Origin used when no `--url`, `MANIFEST_URL` or stored login selects one: a
+ * Thinker instance on this machine, at its default port. Never a hosted
+ * service, so a key from `MANIFEST_API_KEY` cannot leave the machine by
+ * default (#17).
+ */
+export const DEFAULT_URL = 'http://localhost:2099';
 
 export interface HostConfig {
   apiKey: string;
@@ -32,7 +38,7 @@ export function normalizeOrigin(url: string): string {
     throw new CliError(
       'invalid_url',
       `Not a valid URL: ${url}`,
-      'Pass a full origin like https://app.manifest.build',
+      'Pass a full origin like http://localhost:2099',
     );
   }
   if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
diff --git a/packages/cli/src/index.spec.ts b/packages/cli/src/index.spec.ts
index 4bb12c50..dc70ee60 100644
--- a/packages/cli/src/index.spec.ts
+++ b/packages/cli/src/index.spec.ts
@@ -112,6 +112,27 @@ describe('run', () => {
     expect(written.filter((name) => /telemetry/.test(name))).toEqual([]);
   });
 
+  it('sends an env key only to the local default when no host is configured (#17)', async () => {
+    const calls: Array<{ url: string; key: string | undefined }> = [];
+    const io = makeIo({
+      env: { MANIFEST_API_KEY: 'env-key' },
+      fetchImpl: async (input, init) => {
+        const headers = (init?.headers ?? {}) as Record<string, string>;
+        calls.push({ url: String(input), key: headers['X-API-Key'] });
+        return new Response(JSON.stringify({ agents: [] }), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        });
+      },
+    });
+    expect(await run(io, ['agent', 'list'])).toBe(0);
+    expect(calls.length).toBeGreaterThan(0);
+    for (const call of calls) {
+      expect(call.url.startsWith('http://localhost:2099/')).toBe(true);
+    }
+    expect(calls[0].key).toBe('env-key');
+  });
+
   it('usage documents every registered command group', () => {
     for (const key of Object.keys(COMMANDS)) {
       const firstWord = key.split(' ')[0];
diff --git a/packages/cli/src/keystore.spec.ts b/packages/cli/src/keystore.spec.ts
index 441e8c2a..7b035d17 100644
--- a/packages/cli/src/keystore.spec.ts
+++ b/packages/cli/src/keystore.spec.ts
@@ -19,7 +19,7 @@ describe('keystore', () => {
   });
 
   it('encodes agent names that need it (spaces stay unambiguous)', () => {
-    const p = agentKeyPath(env(), 'https://app.manifest.build', 'My Bot 2');
+    const p = agentKeyPath(env(), 'https://gateway.example.com', 'My Bot 2');
     expect(path.basename(p)).toBe('My%20Bot%202.key');
   });
 

From 7fcc7bfc5b7d7f7f484f1c650fe75a0259ee3d51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 02:01:30 -0300
Subject: [PATCH 09/17] feat(backend): single self-hosted mode, drop
 MANIFEST_MODE

Thinker has one deployment mode. The backend no longer decides between
"cloud" and "self-hosted" from MANIFEST_MODE or container markers
(/.dockerenv, /run/.containerenv, KUBERNETES_SERVICE_HOST); it always
keeps the former self-hosted behavior, on any runtime:

- built-in local providers (Ollama, LM Studio, llama.cpp) are always
  available: the cloud-only filters, the M303 rejection and its error
  code are gone;
- custom-provider URLs validate with allowPrivate: LAN, loopback and
  http:// destinations are a feature, http:// to a public host is still
  refused, and cloud metadata endpoints stay blocked (now also by name:
  metadata.google.internal, metadata.goog, metadata, instance-data);
- request recordings fall back to the filesystem without S3 credentials;
- the boot backfills always run on the app's DATABASE_URL connection;
- GET /api/v1/setup/status drops isSelfHosted and always probes Ollama.

The CIMD client_id fetch does NOT inherit the old self-hosted allowance:
that URL comes from an unauthenticated MCP client, so it is public-only
by default (DNS failure is an error), with THINKER_CIMD_ALLOW_PRIVATE=true
as the opt-in for LAN-hosted clients.

auth.instance.ts no longer trusts the Manifest Cloud hosts
(app/gateway.manifest.build) as origins or MCP resources; MCP is bound to
the canonical BETTER_AUTH_URL origin only, and the file leaves the
no-phonehome allow-list.

detect-self-hosted.ts becomes container-host.ts with only
getContainerHostAlias(). Unit tests no longer depend on /.dockerenv.

Closes #18
Closes #46

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CONTRIBUTING.md                               |   4 +-
 docker/.env.example                           |  11 +
 docker/DOCKER_README.md                       |  22 +-
 docker/docker-compose.yml                     |  10 +-
 docs/dev/manifest-guide.md                    |  17 +-
 packages/backend/.env.example                 |   5 +-
 .../provider-usage.controller.spec.ts         |  18 +-
 .../controllers/provider-usage.controller.ts  |   4 +-
 .../backend/src/auth/auth.instance.spec.ts    |  85 +++----
 packages/backend/src/auth/auth.instance.ts    |  37 +--
 .../auth/cimd-client-metadata-fetch.spec.ts   | 148 +++++++-----
 .../src/auth/cimd-client-metadata-fetch.ts    |  32 ++-
 .../backend/src/auth/session.guard.spec.ts    |  42 +---
 .../errors/__tests__/manifest-error.spec.ts   |   4 +-
 .../backend/src/common/errors/error-codes.ts  |   5 -
 .../src/common/errors/manifest-error.ts       |   3 +-
 .../request-recording-storage.service.spec.ts |  26 +--
 .../request-recording-storage.service.ts      |  10 +-
 .../src/common/utils/container-host.spec.ts   |  39 ++++
 .../src/common/utils/container-host.ts        |  22 ++
 .../common/utils/detect-self-hosted.spec.ts   | 113 ----------
 .../src/common/utils/detect-self-hosted.ts    |  44 ----
 .../utils/provider-availability.spec.ts       |  37 +--
 .../src/common/utils/provider-availability.ts |  20 +-
 .../src/common/utils/url-validation.spec.ts   |  15 +-
 .../src/common/utils/url-validation.ts        |  45 ++--
 ...age-provider-backfill.boot.service.spec.ts |  14 --
 .../message-provider-backfill.boot.service.ts |   8 +-
 .../request-backfill.boot.service.spec.ts     | 137 ++----------
 .../request-backfill.boot.service.ts          |  59 +----
 .../backend/src/mcp/mcp-discovery.spec.ts     |  26 +--
 packages/backend/src/mcp/mcp-discovery.ts     |  25 +--
 .../backend/src/mcp/mcp.controller.spec.ts    |  18 +-
 packages/backend/src/mcp/mcp.controller.ts    |   6 +-
 .../backend/src/mcp/tools/providers.tools.ts  |   7 -
 packages/backend/src/mcp/tools/tools.spec.ts  |  18 +-
 .../model-discovery.service.spec.ts           |  38 +---
 .../model-discovery.service.ts                |  30 +--
 ...custom-provider.service.edge-cases.spec.ts |  29 +--
 .../custom-provider.service.spec.ts           |  17 +-
 ...stom-provider.service.transactions.spec.ts |   3 -
 .../custom-provider.service.ts                |  17 +-
 .../src/routing/model.controller.spec.ts      |  16 --
 .../backend/src/routing/model.controller.ts   |   9 +-
 .../src/routing/provider.controller.spec.ts   |  32 ---
 .../src/routing/provider.controller.ts        |  10 -
 .../proxy/__tests__/provider-client.spec.ts   |  29 +--
 .../__tests__/provider-client.ssrf.spec.ts    |  17 +-
 .../src/routing/proxy/provider-client.ts      |  12 +-
 .../__tests__/provider.service.spec.ts        |  12 +-
 .../routing/routing-core/provider.service.ts  |   9 +-
 .../tenant-providers.controller.spec.ts       |  17 +-
 .../routing/tenant-providers.controller.ts    |   7 +-
 .../src/setup/setup.controller.spec.ts        |  51 ++---
 .../backend/src/setup/setup.controller.ts     |   6 +-
 .../backend/src/setup/setup.service.spec.ts   |  29 ---
 packages/backend/src/setup/setup.service.ts   |  10 +-
 ...ustom-providers.url-validation.e2e-spec.ts | 128 ++++++-----
 .../backend/test/mcp-cimd-ssrf.e2e-spec.ts    | 211 ++++++++++++++++++
 .../test/no-phonehome-egress.e2e-spec.ts      |   7 +-
 packages/backend/test/setup.e2e-spec.ts       |  14 +-
 .../backend/test/support/cimd-dns-pin.cjs     |  23 ++
 62 files changed, 783 insertions(+), 1136 deletions(-)
 create mode 100644 packages/backend/src/common/utils/container-host.spec.ts
 create mode 100644 packages/backend/src/common/utils/container-host.ts
 delete mode 100644 packages/backend/src/common/utils/detect-self-hosted.spec.ts
 delete mode 100644 packages/backend/src/common/utils/detect-self-hosted.ts
 create mode 100644 packages/backend/test/mcp-cimd-ssrf.e2e-spec.ts
 create mode 100644 packages/backend/test/support/cimd-dns-pin.cjs

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e64d49b9..08307c85 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -114,11 +114,11 @@ This section walks through **OpenClaw** because it's the deepest integration and
 
 To test routing against your local backend, add Manifest as a model provider in your OpenClaw config:
 
-1. Build and start the backend in self-hosted mode:
+1. Build and start the backend:
 
 ```bash
 npm run build
-MANIFEST_MODE=selfhosted PORT=38238 BIND_ADDRESS=127.0.0.1 \
+PORT=38238 BIND_ADDRESS=127.0.0.1 \
   node -r dotenv/config packages/backend/dist/main.js
 ```
 
diff --git a/docker/.env.example b/docker/.env.example
index 25d915dd..61aac8a1 100644
--- a/docker/.env.example
+++ b/docker/.env.example
@@ -184,3 +184,14 @@ BETTER_AUTH_SECRET=
 # gateway by default. List extra origins here (comma-separated) to allow a
 # browser tool you run elsewhere.
 # THINKER_CORS_ORIGINS=https://tools.example.internal
+
+
+# ─── MCP clients on your LAN (optional) ─────────────────────────────────────
+#
+# An MCP client may identify itself with an HTTPS URL (a Client ID Metadata
+# Document) that Thinker fetches during OAuth. Since that URL comes from an
+# unauthenticated client, Thinker only fetches it from public addresses. Set
+# true if you host MCP clients on a private or loopback address. Cloud
+# metadata endpoints stay blocked either way. Custom providers on your LAN
+# (Ollama, LM Studio, vLLM) are always allowed and do not need this.
+# THINKER_CIMD_ALLOW_PRIVATE=false
diff --git a/docker/DOCKER_README.md b/docker/DOCKER_README.md
index 075b1b7b..86225eb5 100644
--- a/docker/DOCKER_README.md
+++ b/docker/DOCKER_README.md
@@ -389,16 +389,16 @@ If Ollama runs on a different host on your LAN, set `OLLAMA_HOST` in `.env` to t
 
 ### Podman / rootless containers
 
-Podman doesn't ship `/.dockerenv` or `host.docker.internal`. Manifest still
-auto-detects Podman via `/run/.containerenv` and treats the install as
-self-hosted, but the canonical hostname for reaching the host from inside
-a Podman container is `host.containers.internal` (Podman 4+ exposes this
-by default; older versions need `--add-host=host.containers.internal:host-gateway`).
-If you run Manifest as one Podman service and your LLM server (llama.cpp,
-Ollama, etc.) as another, point Manifest at the service name on the shared
-network — e.g. `http://llamacpp:8080/v1` — and **Add custom provider** will
-accept it as long as `MANIFEST_MODE=selfhosted` (the bundled compose file
-sets this automatically).
+Podman doesn't ship `/.dockerenv` or `host.docker.internal`. The canonical
+hostname for reaching the host from inside a Podman container is
+`host.containers.internal` (Podman 4+ exposes this by default; older versions
+need `--add-host=host.containers.internal:host-gateway`), and Thinker suggests
+it when it finds `/run/.containerenv`.
+If you run Thinker as one Podman service and your LLM server (llama.cpp,
+Ollama, etc.) as another, point Thinker at the service name on the shared
+network — e.g. `http://llamacpp:8080/v1`. **Add custom provider** accepts
+LAN, loopback and `http://` URLs on any runtime; only cloud metadata
+endpoints (such as `169.254.169.254`) are always refused.
 
 ## Environment variables
 
@@ -410,7 +410,7 @@ sets this automatically).
 | `BETTER_AUTH_URL`                  | No          | `http://localhost:${PORT}`                   | Public URL. Must match the URL in the browser                                                                                                                                                              |
 | `PORT`                             | No          | `2099`                                       | Dashboard port — sets both the published host port and the internal listener                                                                                                                               |
 | `OLLAMA_HOST`                      | No          | `http://host.docker.internal:11434`          | Ollama endpoint for the built-in tile. Override to point at a LAN-hosted Ollama.                                                                                                                           |
-| `MANIFEST_MODE`                    | No          | auto (Docker → selfhosted)                   | `selfhosted` or `cloud`. `local` is a legacy alias. Self-hosted mode allows private/http URLs for custom providers.                                                                                        |
+| `THINKER_CIMD_ALLOW_PRIVATE`       | No          | `false`                                      | Set `true` to let MCP clients whose Client ID Metadata Document URL resolves to a private or loopback address sign in. Off by default to block SSRF from unauthenticated clients.                          |
 | `MANIFEST_DISABLE_HSTS`            | No          | unset                                        | Set `1` to silence the boot warning about serving over plain HTTP on a LAN                                                                                                                                 |
 | `THROTTLE_LIMIT` / `THROTTLE_TTL`  | No          | `100` / `60000`                              | Rate limit: requests per window, window in ms                                                                                                                                                              |
 | `DB_POOL_MAX` / `AUTH_DB_POOL_MAX` | No          | `10` / `5`                                   | PostgreSQL pool sizes (app pool, Better Auth pool)                                                                                                                                                         |
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 1f544680..56e9f0e6 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -88,13 +88,9 @@ services:
       # would only offer a setting that cannot take effect.
       - SEED_DATA=false
       - NODE_ENV=production
-      # Force self-hosted semantics regardless of the container runtime.
-      # The auto-detection inside the app reads /.dockerenv (Docker),
-      # /run/.containerenv (Podman), and KUBERNETES_SERVICE_HOST, but
-      # explicit beats inferred — and a number of rootless / nspawn /
-      # exotic runtimes produce neither marker. Setting this avoids
-      # silently flipping users back to cloud-mode SSRF rules (issue #1780).
-      - MANIFEST_MODE=${MANIFEST_MODE:-selfhosted}
+      # MCP clients whose Client ID Metadata Document lives on a private or
+      # loopback host are refused unless this is true (SSRF guard, #18).
+      - THINKER_CIMD_ALLOW_PRIVATE=${THINKER_CIMD_ALLOW_PRIVATE:-false}
       # Message recordings use this mounted Docker volume automatically when
       # S3-compatible bucket credentials are not present.
       - REQUEST_RECORDING_STORAGE=${REQUEST_RECORDING_STORAGE:-auto}
diff --git a/docs/dev/manifest-guide.md b/docs/dev/manifest-guide.md
index 986651ac..3163e8e7 100644
--- a/docs/dev/manifest-guide.md
+++ b/docs/dev/manifest-guide.md
@@ -1,7 +1,7 @@
 > **WARNING FOR AGENTS: this is the inherited Manifest guide, under rewrite in v0.1.**
 > Thinker is a self-hosted-only fork. While this file is being rewritten, apply these overrides to everything below:
 >
-> - **Ignore every "Cloud Mode Always" / `MANIFEST_MODE=cloud` directive.** Thinker has no cloud mode; use the self-hosted mode.
+> - **There is no deployment mode** (#18). `MANIFEST_MODE` and the container detection are gone: the backend always behaves as self-hosted (local providers and LAN/`http://` custom-provider URLs accepted, filesystem recordings without S3), on any runtime.
 > - **The dashboard has no Wingman drawer, update check, Discovery step or Autofix UI** (#13), the backend has no Autofix (#16), and neither the backend nor the CLI phones home (#17, see [No phone-home](#no-phone-home)).
 > - **Never call `app.manifest.build` or any other Manifest-hosted endpoint.**
 > - **Do not use the `mnfst` CLI against Manifest's cloud.** The CLI becomes `thinker` and only talks to a Thinker instance.
@@ -24,9 +24,9 @@ The dashboard makes no outbound call of its own (#13): no Wingman drawer, no "ne
 
 **Three management surfaces share one REST API.** The dashboard, the `mnfst` CLI (`packages/cli/`), and the remote MCP server (`packages/backend/src/mcp/`) all drive the same `/api/v1/*` services with the same tenant scoping. Add a capability to the service layer once, then expose it on whichever surfaces need it; never fork logic per surface. See [CLI login](#cli-login-mnfst-login) and [Remote MCP server](#remote-mcp-server) below.
 
-## IMPORTANT: Cloud Mode Always
+## IMPORTANT: Fresh Database per Session
 
-When starting the app for development or testing (e.g. `/serve`), **always use `MANIFEST_MODE=cloud`** (the default). Every dev session must use a **fresh PostgreSQL database** via Docker — multiple concurrent dev instances sharing one DB cause cross-run data pollution and intermittent test failures:
+When starting the app for development or testing (e.g. `/serve`), every dev session must use a **fresh PostgreSQL database** via Docker — multiple concurrent dev instances sharing one DB cause cross-run data pollution and intermittent test failures:
 
 ```bash
 # 1. Ensure the postgres_db container is running
@@ -50,7 +50,7 @@ This guarantees each session starts with a clean, isolated database and avoids a
 To test routing from an OpenClaw agent against a local Manifest dev server, point OpenClaw at the dev server's OpenAI-compatible proxy directly — there is no plugin anymore:
 
 ```bash
-# 1. Build and start the backend in cloud mode
+# 1. Build and start the backend
 npm run build
 PORT=38238 BIND_ADDRESS=127.0.0.1 \
   node -r dotenv/config packages/backend/dist/main.js
@@ -112,7 +112,7 @@ packages/
 │   │   │   ├── interceptors/               # agent-cache, user-cache
 │   │   │   ├── constants/                   # api-key, cache, ollama, providers, openai-models, xai-models, subscription-clients
 │   │   │   ├── services/                    # ingest-event-bus, manifest-runtime, tenant-cache, request-recording-storage
-│   │   │   └── utils/                       # crypto, hash, range, period, slugify, url-validation, provider-inference, postgres-sql, cost-calculator, detect-self-hosted, frontend-path, og-rewrite, secret-scrub, ttl-cache, local-ip, etc.
+│   │   │   └── utils/                       # crypto, hash, range, period, slugify, url-validation, provider-inference, postgres-sql, cost-calculator, container-host, frontend-path, og-rewrite, secret-scrub, ttl-cache, local-ip, etc.
 │   │   ├── health/                          # @Public() health check
 │   │   ├── analytics/                       # Dashboard analytics
 │   │   │   ├── controllers/                 # overview, tokens, costs, messages, agents
@@ -466,7 +466,7 @@ See `packages/backend/.env.example` for all variables. Key ones:
 - `MANIFEST_FRONTEND_DIR` / `MANIFEST_EMBEDDED` — Internal. Custom path to the built frontend (`common/utils/frontend-path.ts`), and a flag that skips the auto `bootstrap()` in `main.ts` when the backend is embedded by another process.
 - `ANNOUNCE_APP_URL` / `DOCTOR_TUTORIAL_URL` — Inputs to the release-announcement React Email template only; the sending tool lives outside this repo. Not read by the server.
 - `PLUGIN_OTLP_ENDPOINT` — Dead. Still listed in `.env.example` but no code reads it since OTLP ingest was removed; safe to delete.
-- `MIGRATION_DATABASE_URL` / `BACKFILL_DATABASE_URL` — Cloud-only direct (non-PgBouncer) database URLs used for migrations and backfills; unset on self-hosted (falls back to `DATABASE_URL`).
+- `MIGRATION_DATABASE_URL` / `BACKFILL_DATABASE_URL` — Direct (non-PgBouncer) database URLs for migrations and the standalone `request-backfill.cli.ts` worker. The boot-time backfills always use the app's `DATABASE_URL` connection (#18).
 - `PROVIDER_TIMEOUT_MS` — Per-attempt timeout (ms) for upstream provider requests. Default: `180000`
 - `STREAM_WARMUP_MS` — Timeout (ms) to wait for the first chunk of a streaming response before trying a fallback. Default: `15000`
 - `STREAM_IDLE_TIMEOUT_MS` — Max silence (ms) between upstream streaming events before the attempt is failed with HTTP 504. Default: `180000`
@@ -482,7 +482,8 @@ See `packages/backend/.env.example` for all variables. Key ones:
 - `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional)
 - `DISCORD_CLIENT_ID` / `DISCORD_CLIENT_SECRET` — Discord OAuth (optional)
 - `SEED_DATA` — Set `true` to seed demo data on startup. Dev/test only — ignored when `NODE_ENV=production` (use the first-run setup wizard instead).
-- `MANIFEST_MODE` — `selfhosted` or `cloud` (default: `cloud`; auto-detected as `selfhosted` inside Docker via `/.dockerenv` or Podman via `/run/.containerenv`). Self-hosted mode allows custom-provider URLs with `http://` / private IPs. `local` is accepted as a legacy alias for `selfhosted`.
+- `THINKER_CIMD_ALLOW_PRIVATE` — `true` lets an MCP client whose Client ID Metadata Document URL (its OAuth `client_id`) resolves to a private or loopback address sign in. Default `false`: that URL comes from an unauthenticated client, so `auth/cimd-client-metadata-fetch.ts` only fetches from public addresses and treats a DNS failure as an error. Cloud metadata addresses are refused either way.
+- **SSRF policy (#18).** There is no deployment mode any more (`MANIFEST_MODE` was removed; it is ignored if set). Custom-provider URLs (`custom-provider.service.ts`, and the forward-time revalidation in `provider-client.ts`) always validate with `validatePublicUrl(url, { allowPrivate: true })`: LAN, loopback and `http://` destinations are a feature (Ollama, LM Studio, vLLM), the URL comes from an authenticated tenant member, and `http://` to a public address is still refused. Cloud metadata endpoints (`169.254.169.254`, `169.254.169.253`, `100.100.100.200`, `fd00:ec2::254`, IPv4-mapped forms, and the names `metadata.google.internal`, `metadata.goog`, `metadata`, `instance-data`, `instance-data.ec2.internal`) are always refused. Per-organization hardening is v0.3 work.
 - `AUTH_DB_POOL_MAX` — Connection pool size for Better Auth's own `pg.Pool`, separate from `DB_POOL_MAX`. Default: `5`.
 - `OLLAMA_HOST` — Ollama endpoint for the built-in tile. Defaults to `http://localhost:11434` outside Docker and `http://host.docker.internal:11434` inside the bundled `docker/docker-compose.yml`.
 - `REQUEST_RECORDING_STORAGE` / `REQUEST_RECORDING_FILESYSTEM_PATH` / `REQUEST_RECORDING_S3_*` / `REQUEST_RECORDING_RETENTION_DAYS` — Provider Attempt body recording storage + retention. See [Request Recording](#request-recording-provider-attempt-bodies).
@@ -541,7 +542,7 @@ When the primary and every fallback fail, the response **says what the provider
 Opt-in, **per-harness** recording of Provider Attempt request/response bodies, browsable from the Requests log.
 
 - **Toggle**: `GET/PATCH /api/v1/routing/:agentName/recording` (in `tier.controller.ts`); UI in `pages/SettingsRecordingSection.tsx`. **Default ON for newly created harnesses only** — enabling the feature never changed existing harnesses' settings. Setting changes apply immediately across replicas.
-- **Storage selection** (`REQUEST_RECORDING_STORAGE=auto|s3|filesystem|disabled`, default `auto`): complete S3 credentials win; otherwise self-hosted falls back to the filesystem path (`REQUEST_RECORDING_FILESYSTEM_PATH`, default `/data/request-recordings`). Managed Cloud never silently falls back to ephemeral local disk. S3 config: `REQUEST_RECORDING_S3_BUCKET/ENDPOINT/REGION/ACCESS_KEY_ID/SECRET_ACCESS_KEY/FORCE_PATH_STYLE`.
+- **Storage selection** (`REQUEST_RECORDING_STORAGE=auto|s3|filesystem|disabled`, default `auto`): complete S3 credentials win; otherwise recordings go to the filesystem path (`REQUEST_RECORDING_FILESYSTEM_PATH`, default `/data/request-recordings` in production, `.data/request-recordings` under the working directory otherwise). S3 config: `REQUEST_RECORDING_S3_BUCKET/ENDPOINT/REGION/ACCESS_KEY_ID/SECRET_ACCESS_KEY/FORCE_PATH_STYLE`.
 - **Encryption at rest**: recordings are encrypted under the **current** `MANIFEST_ENCRYPTION_KEY` only. The `MANIFEST_ENCRYPTION_KEY_PREVIOUS` re-encryption pass does **not** rewrite recordings — after a key change, older recordings are unreadable until retention removes them. Pre-encryption gzip-only recordings stay readable.
 - **Retention** (`REQUEST_RECORDING_RETENTION_DAYS`): one instance-wide value, default 365d (no per-plan retention). Cleanup cron in `database/request-recording-retention.service.ts`.
 - **Privacy**: inline base64 images are stripped from recordings.
diff --git a/packages/backend/.env.example b/packages/backend/.env.example
index cf78f76e..afbf5d10 100644
--- a/packages/backend/.env.example
+++ b/packages/backend/.env.example
@@ -23,12 +23,13 @@ BETTER_AUTH_URL=http://localhost:3001
 # BETTER_AUTH_ALLOWED_HOSTS= # Extra hosts that may serve the dashboard/API (comma-separated). The OAuth callback and session cookie follow the request host, so set this when the same service answers on more than one domain (production only; BETTER_AUTH_URL and CORS_ORIGIN are always allowed). Wildcards like *.example.com work.
 # FRONTEND_PORT=             # Extra trusted origin port for Better Auth
 # THINKER_CORS_ORIGINS=      # Extra browser origins allowed to call the gateway (comma-separated). None by default: the dashboard is same-origin.
+# THINKER_CIMD_ALLOW_PRIVATE=false # Set true to let MCP clients whose Client ID Metadata Document URL resolves to a private or loopback address sign in. Off by default: that URL comes from an unauthenticated client (SSRF). Cloud metadata endpoints stay blocked either way.
 # MCP_ENABLED=               # Set false to run without the remote MCP server (/api/v1/mcp) and its OAuth endpoints. MCP needs an HTTPS BETTER_AUTH_URL (loopback HTTP is fine in dev); a plain-HTTP LAN or tailnet origin turns it off by itself and says so at boot, so set this only to acknowledge that or to switch MCP off on an install that could serve it.
 
 # ── Database ─────────────────────────────────────────
 # DB_POOL_MAX=10             # PostgreSQL connection pool size (default: 10)
-# MIGRATION_DATABASE_URL=    # Cloud-only direct URL for migrations and request backfills; never PgBouncer
-# BACKFILL_DATABASE_URL=     # Optional Cloud-only direct override for request backfills
+# MIGRATION_DATABASE_URL=    # Direct (non-PgBouncer) URL for migrations and the standalone request-backfill worker
+# BACKFILL_DATABASE_URL=     # Optional direct override for the standalone request-backfill worker
 # AGENT_USAGE_DAILY_WORKER=true          # Set false to pause the asynchronous rollup worker
 # AGENT_USAGE_DAILY_READS=               # Automatic by default; true forces rollups, false forces raw queries
 # AGENT_USAGE_DAILY_READ_TENANTS=        # Optional comma-separated tenant rollout before global cutover
diff --git a/packages/backend/src/analytics/controllers/provider-usage.controller.spec.ts b/packages/backend/src/analytics/controllers/provider-usage.controller.spec.ts
index 90a9fc59..9fd474d3 100644
--- a/packages/backend/src/analytics/controllers/provider-usage.controller.spec.ts
+++ b/packages/backend/src/analytics/controllers/provider-usage.controller.spec.ts
@@ -7,17 +7,6 @@ import { DASHBOARD_CACHE_TTL_MS } from '../../common/constants/cache.constants';
 import type { ProviderUsageSummary } from '../services/provider-usage.service';
 
 describe('ProviderUsageController', () => {
-  const previousMode = process.env['MANIFEST_MODE'];
-
-  beforeEach(() => {
-    process.env['MANIFEST_MODE'] = 'cloud';
-  });
-
-  afterAll(() => {
-    if (previousMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = previousMode;
-  });
-
   it('caches the expensive 30-day aggregation per tenant', () => {
     expect(Reflect.getMetadata(CACHE_TTL_METADATA, ProviderUsageController)).toBe(
       DASHBOARD_CACHE_TTL_MS,
@@ -62,7 +51,7 @@ describe('ProviderUsageController', () => {
     expect(result).toEqual({ providers: [] });
   });
 
-  it('hides built-in local usage in cloud without hiding custom tunnel usage', async () => {
+  it('reports built-in local usage alongside custom provider usage', async () => {
     const base = {
       auth_type: 'local',
       consumption_tokens: 10,
@@ -81,6 +70,9 @@ describe('ProviderUsageController', () => {
 
     const result = await controller.getUsage({ tenantId: 'tenant-1', userId: 'user-1' });
 
-    expect(result.providers.map((provider) => provider.provider)).toEqual(['custom:runtime-id']);
+    expect(result.providers.map((provider) => provider.provider)).toEqual([
+      'ollama',
+      'custom:runtime-id',
+    ]);
   });
 });
diff --git a/packages/backend/src/analytics/controllers/provider-usage.controller.ts b/packages/backend/src/analytics/controllers/provider-usage.controller.ts
index 149510cd..6c349b49 100644
--- a/packages/backend/src/analytics/controllers/provider-usage.controller.ts
+++ b/packages/backend/src/analytics/controllers/provider-usage.controller.ts
@@ -4,7 +4,6 @@ import { TenantCtx, TenantContext } from '../../common/decorators/tenant-context
 import { UserCacheInterceptor } from '../../common/interceptors/user-cache.interceptor';
 import { DASHBOARD_CACHE_TTL_MS } from '../../common/constants/cache.constants';
 import { ProviderUsageService, ProviderUsageSummary } from '../services/provider-usage.service';
-import { filterProvidersForDeployment } from '../../common/utils/provider-availability';
 
 /**
  * Usage half of the provider dashboard split. Config (cheap, from
@@ -24,7 +23,6 @@ export class ProviderUsageController {
 
   @Get()
   async getUsage(@TenantCtx() ctx: TenantContext): Promise<{ providers: ProviderUsageSummary[] }> {
-    const providers = await this.providerUsage.getUsage(ctx.tenantId);
-    return { providers: filterProvidersForDeployment(providers) };
+    return { providers: await this.providerUsage.getUsage(ctx.tenantId) };
   }
 }
diff --git a/packages/backend/src/auth/auth.instance.spec.ts b/packages/backend/src/auth/auth.instance.spec.ts
index ccb72091..f8bac8cc 100644
--- a/packages/backend/src/auth/auth.instance.spec.ts
+++ b/packages/backend/src/auth/auth.instance.spec.ts
@@ -499,81 +499,59 @@ describe('auth.instance', () => {
       expect(config.baseURL).toBe('https://manifest.example.com');
     });
 
-    it('keeps both Cloud hosts usable when app is canonical', () => {
+    it('never trusts or binds MCP to the former hosted-service domains', () => {
       process.env['BETTER_AUTH_URL'] = 'https://app.manifest.build';
       process.env['CORS_ORIGIN'] = 'https://app.manifest.build';
       const mod = loadModule();
 
+      // Even an operator whose canonical URL happens to be one of those hosts
+      // gets only what they configured: no implicit sibling host.
       const config = mockBetterAuth.mock.calls[0][0];
-      expect(config.baseURL).toEqual({
-        allowedHosts: expect.arrayContaining(['app.manifest.build', 'gateway.manifest.build']),
-        fallback: 'https://app.manifest.build',
-        protocol: 'https',
-      });
-      expect(config.trustedOrigins).toEqual(
-        expect.arrayContaining(['https://app.manifest.build', 'https://gateway.manifest.build']),
-      );
-      expect(mod.mcpResources).toEqual([
-        'https://app.manifest.build/api/v1/mcp',
-        'https://gateway.manifest.build/api/v1/mcp',
-      ]);
-      expect(mod.mcpResourceForHost('gateway.manifest.build')).toBe(
-        'https://gateway.manifest.build/api/v1/mcp',
-      );
-      expect(mod.mcpResourceForHost('gateway.manifest.build:443')).toBe(
-        'https://gateway.manifest.build/api/v1/mcp',
-      );
-      expect(mod.mcpResourceForHost('gateway.manifest.build:444')).toBe(
-        'https://app.manifest.build/api/v1/mcp',
-      );
-      expect(mod.authIssuerForHost('gateway.manifest.build')).toBe(
-        'https://gateway.manifest.build/api/auth',
-      );
-      expect(mod.mcpResourceForHost('unknown.example')).toBe(
-        'https://app.manifest.build/api/v1/mcp',
-      );
+      expect(config.baseURL).toBe('https://app.manifest.build');
+      expect(config.trustedOrigins).not.toContain('https://gateway.manifest.build');
+      expect(mod.mcpResource).toBe('https://app.manifest.build/api/v1/mcp');
+      expect(mod).not.toHaveProperty('mcpResources');
+      expect(mod).not.toHaveProperty('mcpResourceForHost');
     });
 
     it('resolves per request when the dashboard origin differs from the API origin', () => {
-      process.env['BETTER_AUTH_URL'] = 'https://gateway.manifest.build';
-      process.env['CORS_ORIGIN'] = 'https://app.manifest.build';
+      process.env['BETTER_AUTH_URL'] = 'https://gateway.example.com';
+      process.env['CORS_ORIGIN'] = 'https://app.example.com';
       loadModule();
 
       const config = mockBetterAuth.mock.calls[0][0];
       expect(config.baseURL).toEqual({
-        allowedHosts: expect.arrayContaining(['gateway.manifest.build', 'app.manifest.build']),
-        fallback: 'https://gateway.manifest.build',
+        allowedHosts: expect.arrayContaining(['gateway.example.com', 'app.example.com']),
+        fallback: 'https://gateway.example.com',
         protocol: 'https',
       });
       expect(config.baseURL.allowedHosts).toHaveLength(2);
     });
 
     it('adds extra hosts from BETTER_AUTH_ALLOWED_HOSTS, including wildcards', () => {
-      process.env['BETTER_AUTH_URL'] = 'https://gateway.manifest.build';
+      process.env['BETTER_AUTH_URL'] = 'https://gateway.example.com';
       delete process.env['CORS_ORIGIN'];
-      process.env['BETTER_AUTH_ALLOWED_HOSTS'] =
-        'dashboard.manifest.build, *.preview.manifest.build';
+      process.env['BETTER_AUTH_ALLOWED_HOSTS'] = 'dashboard.example.com, *.preview.example.com';
       loadModule();
 
       const config = mockBetterAuth.mock.calls[0][0];
       expect([...config.baseURL.allowedHosts].sort()).toEqual([
-        '*.preview.manifest.build',
-        'app.manifest.build',
-        'dashboard.manifest.build',
-        'gateway.manifest.build',
+        '*.preview.example.com',
+        'dashboard.example.com',
+        'gateway.example.com',
       ]);
     });
 
     it('ignores malformed allowed-host entries', () => {
-      process.env['BETTER_AUTH_URL'] = 'https://gateway.manifest.build';
-      process.env['CORS_ORIGIN'] = 'https://app.manifest.build';
+      process.env['BETTER_AUTH_URL'] = 'https://gateway.example.com';
+      process.env['CORS_ORIGIN'] = 'https://app.example.com';
       process.env['BETTER_AUTH_ALLOWED_HOSTS'] = ',   ,not a url';
       loadModule();
 
       const config = mockBetterAuth.mock.calls[0][0];
       expect([...config.baseURL.allowedHosts].sort()).toEqual([
-        'app.manifest.build',
-        'gateway.manifest.build',
+        'app.example.com',
+        'gateway.example.com',
       ]);
     });
 
@@ -597,8 +575,8 @@ describe('auth.instance', () => {
     });
 
     it('exports the same base URL passed to betterAuth', () => {
-      process.env['BETTER_AUTH_URL'] = 'https://gateway.manifest.build';
-      process.env['CORS_ORIGIN'] = 'https://app.manifest.build';
+      process.env['BETTER_AUTH_URL'] = 'https://gateway.example.com';
+      process.env['CORS_ORIGIN'] = 'https://app.example.com';
       const mod = loadModule();
 
       expect(mod.authBaseURL).toEqual(mockBetterAuth.mock.calls[0][0].baseURL);
@@ -688,22 +666,21 @@ describe('auth.instance', () => {
       );
     });
 
-    it('registers both Cloud MCP resources for new OAuth clients', () => {
-      process.env['BETTER_AUTH_URL'] = 'https://app.manifest.build';
+    it('registers only the canonical MCP resource, even with extra allowed hosts', () => {
+      process.env['NODE_ENV'] = 'production';
+      process.env['BETTER_AUTH_SECRET'] = 'a]3kF9!xLm2@pQzR7^wYu4&vN6*cE0hT';
+      process.env['BETTER_AUTH_URL'] = 'https://gateway.example.com';
+      process.env['CORS_ORIGIN'] = 'https://app.example.com';
       loadModule();
 
       const { mcp } = jest.requireMock('@better-auth/mcp') as { mcp: jest.Mock };
       const config = mcp.mock.calls[0][0];
-      expect(config.resource).toBe('https://app.manifest.build/api/v1/mcp');
+      expect(config.resource).toBe('https://gateway.example.com/api/v1/mcp');
       expect(
         config.resources.map((resource: { identifier: string }) => resource.identifier),
-      ).toEqual([
-        'https://app.manifest.build/api/v1/mcp',
-        'https://gateway.manifest.build/api/v1/mcp',
-      ]);
+      ).toEqual(['https://gateway.example.com/api/v1/mcp']);
       expect(config.clientRegistrationDefaultResources).toEqual([
-        'https://app.manifest.build/api/v1/mcp',
-        'https://gateway.manifest.build/api/v1/mcp',
+        'https://gateway.example.com/api/v1/mcp',
       ]);
     });
 
diff --git a/packages/backend/src/auth/auth.instance.ts b/packages/backend/src/auth/auth.instance.ts
index f6cc53b4..05e8148e 100644
--- a/packages/backend/src/auth/auth.instance.ts
+++ b/packages/backend/src/auth/auth.instance.ts
@@ -41,30 +41,6 @@ export const mcpEnabled = mcpDecision.enabled;
 export const mcpDisabledReason = mcpDecision.reason;
 export { MCP_READ_SCOPE, MCP_WRITE_SCOPE, MCP_SCOPES } from './mcp-scopes';
 
-const CLOUD_ORIGINS = ['https://app.manifest.build', 'https://gateway.manifest.build'];
-const cloudOrigins = CLOUD_ORIGINS.includes(authOrigin) ? CLOUD_ORIGINS : [];
-export const mcpResources = (cloudOrigins.length ? cloudOrigins : [authOrigin]).map(
-  (origin) => `${origin}/api/v1/mcp`,
-);
-
-/** Keep each Cloud MCP endpoint bound to the host the client connected to. */
-export function authOriginForHost(host: string | undefined): string {
-  const normalizedHost = parseOriginHost(host);
-  return (
-    (cloudOrigins.length ? cloudOrigins : [authOrigin]).find(
-      (origin) => new URL(origin).host === normalizedHost,
-    ) ?? authOrigin
-  );
-}
-
-export function authIssuerForHost(host: string | undefined): string {
-  return `${authOriginForHost(host)}/api/auth`;
-}
-
-export function mcpResourceForHost(host: string | undefined): string {
-  return `${authOriginForHost(host)}/api/v1/mcp`;
-}
-
 /** Host (with optional port) of an origin or bare hostname, or null when junk. */
 function parseOriginHost(value: string | undefined): string | null {
   const raw = value?.trim();
@@ -79,14 +55,13 @@ function parseOriginHost(value: string | undefined): string | null {
 
 /**
  * Better Auth pins the OAuth callback and the session cookie to its `baseURL`.
- * The dashboard and the API can answer on more than one host — the hosted
- * Cloud serves app.manifest.build and gateway.manifest.build from the same
- * service — so a single static origin sends a user who started on host A
+ * The dashboard and the API can answer on more than one host (for example a
+ * LAN name and a public name), so a single static origin sends a user who started on host A
  * through a callback on host B, where the session cookie lands on an origin
  * the dashboard cannot read. When a second host is configured, resolve the
  * base URL from the request host instead, restricted to an allow-list.
  *
- * Hosts come from `BETTER_AUTH_URL` (canonical), both Cloud domains,
+ * Hosts come from `BETTER_AUTH_URL` (canonical),
  * `CORS_ORIGIN` (the dashboard origin already trusted for cross-origin calls),
  * and the optional
  * `BETTER_AUTH_ALLOWED_HOSTS` (comma-separated patterns, `*.` wildcards
@@ -104,7 +79,6 @@ function buildAuthBaseURL():
   };
   add(process.env['BETTER_AUTH_URL']);
   add(process.env['CORS_ORIGIN']);
-  for (const origin of cloudOrigins) add(origin);
   for (const entry of (process.env['BETTER_AUTH_ALLOWED_HOSTS'] ?? '').split(',')) add(entry);
   if (hosts.size <= 1) return authOrigin;
   return {
@@ -146,7 +120,6 @@ function buildTrustedOrigins(): string[] {
   if (process.env['CORS_ORIGIN']) {
     origins.push(process.env['CORS_ORIGIN']);
   }
-  origins.push(...cloudOrigins);
   if (isDev) {
     origins.push(
       `http://localhost:3000`,
@@ -185,7 +158,7 @@ function buildMcpPlugins() {
       consentPage: '/consent',
       resource: mcpResource,
       scopes: [...MCP_SCOPES, 'offline_access'],
-      resources: mcpResources.map((identifier) => ({
+      resources: [mcpResource].map((identifier) => ({
         identifier,
         name: 'Manifest MCP',
         // Short-lived bearer tokens; the refresh token (offline_access) is
@@ -193,7 +166,7 @@ function buildMcpPlugins() {
         accessTokenTtl: 15 * 60,
         allowedScopes: [...MCP_SCOPES, 'offline_access'],
       })),
-      clientRegistrationDefaultResources: mcpResources,
+      clientRegistrationDefaultResources: [mcpResource],
       resourceSeedMode: 'overwrite',
       clientRegistrationDefaultScopes: [MCP_READ_SCOPE],
       clientRegistrationAllowedScopes: [MCP_WRITE_SCOPE, 'offline_access'],
diff --git a/packages/backend/src/auth/cimd-client-metadata-fetch.spec.ts b/packages/backend/src/auth/cimd-client-metadata-fetch.spec.ts
index 973c2ee4..fe03bfee 100644
--- a/packages/backend/src/auth/cimd-client-metadata-fetch.spec.ts
+++ b/packages/backend/src/auth/cimd-client-metadata-fetch.spec.ts
@@ -1,6 +1,7 @@
 import { EventEmitter } from 'node:events';
 import { Readable } from 'node:stream';
-import { fetchClientMetadataResource } from './cimd-client-metadata-fetch';
+import { isPrivateIp } from '../common/utils/url-validation';
+import { cimdAllowsPrivateHosts, fetchClientMetadataResource } from './cimd-client-metadata-fetch';
 
 jest.mock('@better-auth/core/utils/host', () => ({
   isPublicRoutableHost: jest.fn(() => true),
@@ -36,12 +37,23 @@ function fakeRequest(
 }
 
 describe('fetchClientMetadataResource', () => {
+  const previousAllowPrivate = process.env['THINKER_CIMD_ALLOW_PRIVATE'];
+
   beforeEach(() => {
+    // Behavior must not depend on the host environment (issue #46): start every
+    // case from the default, public-only policy.
+    delete process.env['THINKER_CIMD_ALLOW_PRIVATE'];
+    isPublicRoutableHost.mockReset();
     isPublicRoutableHost.mockReturnValue(true);
     lookup.mockReset();
     request.mockReset();
   });
 
+  afterAll(() => {
+    if (previousAllowPrivate === undefined) delete process.env['THINKER_CIMD_ALLOW_PRIVATE'];
+    else process.env['THINKER_CIMD_ALLOW_PRIVATE'] = previousAllowPrivate;
+  });
+
   it('fetches and returns a metadata document', async () => {
     lookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]);
     let captured: { lookup: (...a: unknown[]) => void } | undefined;
@@ -184,82 +196,108 @@ describe('fetchClientMetadataResource', () => {
     expect(await response.text()).toBe('');
   });
 
-  it('allows a private host in self-hosted mode regardless of the public gate', async () => {
-    const previous = process.env['MANIFEST_MODE'];
-    process.env['MANIFEST_MODE'] = 'selfhosted';
-    try {
-      isPublicRoutableHost.mockReturnValue(false);
-      lookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }]);
+  describe('private and loopback hosts (THINKER_CIMD_ALLOW_PRIVATE)', () => {
+    beforeEach(() => {
+      // Better Auth's classifier is ESM-only and cannot load under Jest's CJS
+      // runtime, so stand in with the shared private-range classifier. The e2e
+      // suite exercises the real one.
+      isPublicRoutableHost.mockImplementation((address: string) => !isPrivateIp(address));
       request.mockImplementation((_url, _opts, cb) => fakeRequest(cb));
-      expect((await fetchClientMetadataResource('https://lan.local/meta')).status).toBe(200);
+    });
+
+    it.each([
+      ['10.0.0.5', 4],
+      ['192.168.1.20', 4],
+      ['127.0.0.1', 4],
+      ['::1', 6],
+      ['fd12:3456::1', 6],
+    ])('refuses a host resolving to %s by default', async (address, family) => {
+      lookup.mockResolvedValue([{ address, family }]);
+      await expect(fetchClientMetadataResource('https://lan.example/meta')).rejects.toThrow(
+        /public-routable/,
+      );
+      expect(request).not.toHaveBeenCalled();
+    });
+
+    it('refuses a mixed public/private answer by default', async () => {
+      lookup.mockResolvedValue([
+        { address: '93.184.216.34', family: 4 },
+        { address: '10.0.0.5', family: 4 },
+      ]);
+      await expect(fetchClientMetadataResource('https://lan.example/meta')).rejects.toThrow(
+        /public-routable/,
+      );
+    });
+
+    it('treats a DNS failure as an error by default', async () => {
+      lookup.mockRejectedValue(new Error('ENOTFOUND'));
+      await expect(fetchClientMetadataResource('https://lan.example/meta')).rejects.toThrow(
+        /ENOTFOUND/,
+      );
+      expect(request).not.toHaveBeenCalled();
+    });
+
+    it('does not treat values other than "true" as an opt-in', async () => {
+      for (const value of ['1', 'yes', 'false', '']) {
+        process.env['THINKER_CIMD_ALLOW_PRIVATE'] = value;
+        expect(cimdAllowsPrivateHosts()).toBe(false);
+      }
+      process.env['THINKER_CIMD_ALLOW_PRIVATE'] = ' TRUE ';
+      expect(cimdAllowsPrivateHosts()).toBe(true);
+    });
+
+    it('accepts private and loopback hosts with THINKER_CIMD_ALLOW_PRIVATE=true', async () => {
+      process.env['THINKER_CIMD_ALLOW_PRIVATE'] = 'true';
+      lookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }]);
+      expect((await fetchClientMetadataResource('https://lan.example/meta')).status).toBe(200);
+
+      lookup.mockResolvedValue([{ address: '127.0.0.1', family: 4 }]);
+      expect((await fetchClientMetadataResource('https://lan.example/meta')).status).toBe(200);
 
       // A host.containers.internal-style link-local address is allowed too.
       lookup.mockResolvedValue([{ address: '169.254.1.2', family: 4 }]);
-      expect((await fetchClientMetadataResource('https://lan.local/meta')).status).toBe(200);
-    } finally {
-      if (previous === undefined) delete process.env['MANIFEST_MODE'];
-      else process.env['MANIFEST_MODE'] = previous;
-    }
-  });
+      expect((await fetchClientMetadataResource('https://lan.example/meta')).status).toBe(200);
+    });
 
-  it('blocks cloud-metadata addresses even in self-hosted mode', async () => {
-    const previous = process.env['MANIFEST_MODE'];
-    process.env['MANIFEST_MODE'] = 'selfhosted';
-    try {
+    it('blocks cloud-metadata addresses even with the opt-in', async () => {
+      process.env['THINKER_CIMD_ALLOW_PRIVATE'] = 'true';
       lookup.mockResolvedValue([{ address: '169.254.169.254', family: 4 }]);
-      await expect(fetchClientMetadataResource('https://lan.local/meta')).rejects.toThrow(
+      await expect(fetchClientMetadataResource('https://lan.example/meta')).rejects.toThrow(
         /cloud metadata/,
       );
 
-      // Alibaba/OCI IMDS, covered by the shared classifier.
+      // Alibaba/OCI IMDS and the AWS IPv6 IMDS, covered by the shared classifier.
       lookup.mockResolvedValue([{ address: '100.100.100.200', family: 4 }]);
-      await expect(fetchClientMetadataResource('https://lan.local/meta')).rejects.toThrow(
+      await expect(fetchClientMetadataResource('https://lan.example/meta')).rejects.toThrow(
         /cloud metadata/,
       );
-    } finally {
-      if (previous === undefined) delete process.env['MANIFEST_MODE'];
-      else process.env['MANIFEST_MODE'] = previous;
-    }
-  });
-
-  it('blocks a private host in cloud mode', async () => {
-    const previous = process.env['MANIFEST_MODE'];
-    process.env['MANIFEST_MODE'] = 'cloud';
-    try {
-      lookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }]);
-      isPublicRoutableHost.mockReturnValueOnce(false);
-      await expect(fetchClientMetadataResource('https://lan.local/meta')).rejects.toThrow(
-        /public-routable/,
+      lookup.mockResolvedValue([{ address: 'fd00:ec2::254', family: 6 }]);
+      await expect(fetchClientMetadataResource('https://lan.example/meta')).rejects.toThrow(
+        /cloud metadata/,
       );
-    } finally {
-      if (previous === undefined) delete process.env['MANIFEST_MODE'];
-      else process.env['MANIFEST_MODE'] = previous;
-    }
+      expect(request).not.toHaveBeenCalled();
+    });
+
+    it('lets a lookup failure fall through to the request resolver with the opt-in', async () => {
+      process.env['THINKER_CIMD_ALLOW_PRIVATE'] = 'true';
+      lookup.mockRejectedValue(new Error('ENOTFOUND'));
+      request.mockImplementation((_url, opts, cb) => {
+        expect((opts as { lookup?: unknown }).lookup).toBeUndefined();
+        return fakeRequest(cb);
+      });
+      expect((await fetchClientMetadataResource('https://lan.example/meta')).status).toBe(200);
+    });
   });
 
   it('rejects a direct IP literal', async () => {
     await expect(fetchClientMetadataResource('https://127.0.0.1/meta')).rejects.toThrow(
       /IP literal/,
     );
+    process.env['THINKER_CIMD_ALLOW_PRIVATE'] = 'true';
+    await expect(fetchClientMetadataResource('https://[::1]/meta')).rejects.toThrow(/IP literal/);
     expect(lookup).not.toHaveBeenCalled();
   });
 
-  it('lets a self-hosted lookup failure fall through to the request resolver', async () => {
-    const previous = process.env['MANIFEST_MODE'];
-    process.env['MANIFEST_MODE'] = 'selfhosted';
-    try {
-      lookup.mockRejectedValue(new Error('ENOTFOUND'));
-      request.mockImplementation((_url, opts, cb) => {
-        expect((opts as { lookup?: unknown }).lookup).toBeUndefined();
-        return fakeRequest(cb);
-      });
-      expect((await fetchClientMetadataResource('https://lan.local/meta')).status).toBe(200);
-    } finally {
-      if (previous === undefined) delete process.env['MANIFEST_MODE'];
-      else process.env['MANIFEST_MODE'] = previous;
-    }
-  });
-
   it('rejects a protocol upgrade and destroys its socket', async () => {
     lookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }]);
     const socket = { destroy: jest.fn() };
diff --git a/packages/backend/src/auth/cimd-client-metadata-fetch.ts b/packages/backend/src/auth/cimd-client-metadata-fetch.ts
index c54eb91c..43069668 100644
--- a/packages/backend/src/auth/cimd-client-metadata-fetch.ts
+++ b/packages/backend/src/auth/cimd-client-metadata-fetch.ts
@@ -6,9 +6,21 @@ import type { IncomingHttpHeaders } from 'node:http';
 import { request, type RequestOptions } from 'node:https';
 import { isIP, type LookupFunction } from 'node:net';
 import { Readable } from 'node:stream';
-import { isSelfHosted } from '../common/utils/detect-self-hosted';
 import { isCloudMetadataIp } from '../common/utils/url-validation';
 
+/**
+ * Whether a CIMD `client_id` URL may resolve to a private or loopback address.
+ *
+ * The URL comes from an unauthenticated MCP client during OAuth, so allowing
+ * private hosts would let anyone make the server fetch from its internal
+ * network (SSRF). Off by default; operators who host MCP clients on their LAN
+ * opt in with `THINKER_CIMD_ALLOW_PRIVATE=true`. Read per call so the setting
+ * follows the environment without a restart in tests.
+ */
+export function cimdAllowsPrivateHosts(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env['THINKER_CIMD_ALLOW_PRIVATE']?.trim().toLowerCase() === 'true';
+}
+
 const BODY_FORBIDDEN_RESPONSE_STATUSES = new Set([204, 205, 304]);
 
 function responseHeaders(headers: IncomingHttpHeaders): Headers {
@@ -70,25 +82,25 @@ export const fetchClientMetadataResource: ClientMetadataResourceFetch = async (i
   }
 
   const hostname = url.hostname.replace(/^\[|\]$/g, '');
-  // A literal address bypasses DNS pinning, and in self-hosted mode the
-  // private-host allowance would let a client reach an arbitrary local service.
+  // A literal address bypasses DNS pinning, and with the opt-in private-host
+  // allowance it would let a client reach an arbitrary local service.
   // Require a hostname.
   if (isIP(hostname) !== 0) {
     throw new TypeError('CIMD Node transport requires a hostname, not an IP literal');
   }
-  // Self-hosted operators control their network, so a CIMD document on a private
-  // or loopback host is legitimate there. Cloud installs keep the strict gate.
-  const allowPrivate = isSelfHosted();
+  // Public addresses only, unless the operator opted in to LAN-hosted clients.
+  const allowPrivate = cimdAllowsPrivateHosts();
   let addresses: LookupAddress[] | undefined;
   try {
     addresses = await lookup(hostname, { all: true, verbatim: true });
   } catch (error) {
-    // A self-hosted operator may use a LAN name its own resolver handles; let
-    // the request try to resolve it rather than failing before the fetch.
+    // With the opt-in, the operator may use a LAN name its own resolver
+    // handles; let the request try to resolve it rather than failing before the
+    // fetch. By default a DNS failure is an error.
     if (!allowPrivate) throw error;
   }
-  // Address validation always runs, even when the local-mode lookup failed: a
-  // cloud-metadata answer must never be reached.
+  // Address validation always runs when the lookup succeeded: a cloud-metadata
+  // answer must never be reached.
   const pinnedAddress = addresses ? selectPinnedAddress(addresses, allowPrivate) : undefined;
   const headers = Object.fromEntries(webRequest.headers.entries());
   headers.host = url.host;
diff --git a/packages/backend/src/auth/session.guard.spec.ts b/packages/backend/src/auth/session.guard.spec.ts
index c5ee104a..e622b7a1 100644
--- a/packages/backend/src/auth/session.guard.spec.ts
+++ b/packages/backend/src/auth/session.guard.spec.ts
@@ -169,18 +169,7 @@ describe('SessionGuard', () => {
     expect(request['authMethod']).toBeUndefined();
   });
 
-  describe('cloud mode (default) — no loopback fallback', () => {
-    const originalEnv = process.env['MANIFEST_MODE'];
-
-    beforeEach(() => {
-      delete process.env['MANIFEST_MODE'];
-    });
-
-    afterEach(() => {
-      if (originalEnv === undefined) delete process.env['MANIFEST_MODE'];
-      else process.env['MANIFEST_MODE'] = originalEnv;
-    });
-
+  describe('loopback requests — no synthetic user', () => {
     it('does NOT inject synthetic user for loopback IP without session', async () => {
       jest.spyOn(reflector, 'getAllAndOverride').mockReturnValue(false);
       (auth.api.getSession as jest.Mock).mockResolvedValue(null);
@@ -206,8 +195,8 @@ describe('SessionGuard', () => {
     it('attaches real user when Better Auth session is valid (loopback IP)', async () => {
       jest.spyOn(reflector, 'getAllAndOverride').mockReturnValue(false);
       const mockSession = {
-        user: { id: 'cloud-user-1', name: 'Cloud User', email: 'cloud@example.com' },
-        session: { id: 'session-cloud' },
+        user: { id: 'user-1', name: 'User One', email: 'user1@example.com' },
+        session: { id: 'session-loopback' },
       };
       (auth.api.getSession as jest.Mock).mockResolvedValue(mockSession);
       const { context, request } = createMockContext({ ip: '127.0.0.1' });
@@ -217,32 +206,9 @@ describe('SessionGuard', () => {
       expect(request['user']).toEqual(mockSession.user);
       expect(request['authMethod']).toBe('session');
     });
-
-    it('does NOT inject synthetic user when MANIFEST_MODE is "cloud"', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
-      jest.spyOn(reflector, 'getAllAndOverride').mockReturnValue(false);
-      (auth.api.getSession as jest.Mock).mockResolvedValue(null);
-      const { context, request } = createMockContext({ ip: '127.0.0.1' });
-
-      await guard.canActivate(context);
-
-      expect(request['user']).toBeUndefined();
-      expect(request['authMethod']).toBeUndefined();
-    });
   });
 
-  describe('self-hosted mode — no loopback auto-login', () => {
-    const originalEnv = process.env['MANIFEST_MODE'];
-
-    beforeEach(() => {
-      process.env['MANIFEST_MODE'] = 'selfhosted';
-    });
-
-    afterEach(() => {
-      if (originalEnv === undefined) delete process.env['MANIFEST_MODE'];
-      else process.env['MANIFEST_MODE'] = originalEnv;
-    });
-
+  describe('loopback requests — no auto-login', () => {
     it('uses real session when Better Auth session exists (preserves per-user isolation)', async () => {
       jest.spyOn(reflector, 'getAllAndOverride').mockReturnValue(false);
       const mockSession = {
diff --git a/packages/backend/src/common/errors/__tests__/manifest-error.spec.ts b/packages/backend/src/common/errors/__tests__/manifest-error.spec.ts
index 861c7d71..0a4ad234 100644
--- a/packages/backend/src/common/errors/__tests__/manifest-error.spec.ts
+++ b/packages/backend/src/common/errors/__tests__/manifest-error.spec.ts
@@ -92,10 +92,10 @@ describe('every documented error code is accounted for', () => {
     expect(error_class).toBe('not_found');
   });
 
-  it('puts a cloud-inaccessible local provider on the config origin', () => {
+  it('still classifies historical local_provider_unavailable rows on the config origin', () => {
     const { error_origin, error_class } = classifyMessageError({
       status: 'error',
-      routingReason: MANIFEST_CODE_TO_REASON.M303,
+      routingReason: 'local_provider_unavailable',
     });
 
     expect(error_origin).toBe('config');
diff --git a/packages/backend/src/common/errors/error-codes.ts b/packages/backend/src/common/errors/error-codes.ts
index 2f1a6434..6fa055df 100644
--- a/packages/backend/src/common/errors/error-codes.ts
+++ b/packages/backend/src/common/errors/error-codes.ts
@@ -67,11 +67,6 @@ export const MANIFEST_ERRORS = {
     template:
       'Model "{model}" is not available for this agent. Use GET /v1/models to list available model IDs, or make the provider available for this agent here: {dashboardUrl}',
   },
-  M303: {
-    title: 'Local provider unavailable on Manifest Cloud',
-    template:
-      'Built-in local providers are only available in self-hosted Manifest. On Manifest Cloud, expose the runtime through a public URL or tunnel and connect it as a custom provider.',
-  },
   M500: {
     title: 'Internal server error',
     template: 'Something broke on our end. Try again in a moment.',
diff --git a/packages/backend/src/common/errors/manifest-error.ts b/packages/backend/src/common/errors/manifest-error.ts
index accb0b9c..7b3bb437 100644
--- a/packages/backend/src/common/errors/manifest-error.ts
+++ b/packages/backend/src/common/errors/manifest-error.ts
@@ -17,6 +17,8 @@ export const MANIFEST_BLOCKED_REQUEST_REASONS = [
   'manifest_ip_rate_limited',
   'manifest_concurrency_limited',
   'manifest_invalid_request',
+  // No longer raised (it was the M303 cloud-only rejection), but kept so rows
+  // recorded before the single self-hosted mode still classify.
   'local_provider_unavailable',
   'model_not_available',
   'manifest_internal_error',
@@ -55,7 +57,6 @@ export const MANIFEST_CODE_TO_REASON: Record<RecordableManifestCode, ManifestBlo
     M203: 'manifest_concurrency_limited',
     M300: 'manifest_invalid_request',
     M302: 'model_not_available',
-    M303: 'local_provider_unavailable',
     M500: 'manifest_internal_error',
   };
 
diff --git a/packages/backend/src/common/services/request-recording-storage.service.spec.ts b/packages/backend/src/common/services/request-recording-storage.service.spec.ts
index 049ccb26..811501f4 100644
--- a/packages/backend/src/common/services/request-recording-storage.service.spec.ts
+++ b/packages/backend/src/common/services/request-recording-storage.service.spec.ts
@@ -27,7 +27,6 @@ describe('request recording storage selection', () => {
           'app.requestRecordingS3AccessKeyId': 'access',
           'app.requestRecordingS3SecretAccessKey': 'secret',
         }),
-        true,
       ),
     ).toEqual(
       expect.objectContaining({
@@ -38,7 +37,7 @@ describe('request recording storage selection', () => {
     );
   });
 
-  it('uses filesystem storage for self-hosting without S3 configuration', () => {
+  it('uses filesystem storage in production without S3 configuration', () => {
     expect(
       resolveRecordingStorage(
         config({
@@ -46,23 +45,25 @@ describe('request recording storage selection', () => {
           'app.nodeEnv': 'production',
           'app.requestRecordingFilesystemPath': '/data/request-recordings',
         }),
-        true,
       ),
     ).toEqual({ backend: 'filesystem', path: '/data/request-recordings' });
   });
 
-  it('does not fall back to ephemeral filesystem storage in managed Cloud', () => {
+  it('defaults production to the persistent /data path without any S3 credentials', () => {
     expect(
       resolveRecordingStorage(
         config({
           'app.requestRecordingStorage': 'auto',
           'app.nodeEnv': 'production',
         }),
-        false,
       ),
-    ).toEqual({
-      backend: null,
-      reason: 'Managed Cloud requires S3 recording storage credentials',
+    ).toEqual({ backend: 'filesystem', path: '/data/request-recordings' });
+  });
+
+  it('defaults development to a project-local path', () => {
+    expect(resolveRecordingStorage(config({ 'app.nodeEnv': 'development' }), '/thinker')).toEqual({
+      backend: 'filesystem',
+      path: '/thinker/.data/request-recordings',
     });
   });
 
@@ -76,7 +77,6 @@ describe('request recording storage selection', () => {
           'app.requestRecordingS3Region': 'auto',
           'app.requestRecordingS3AccessKeyId': 'access',
         }),
-        true,
       ),
     ).toEqual(
       expect.objectContaining({
@@ -87,9 +87,7 @@ describe('request recording storage selection', () => {
   });
 
   it('supports explicit disabled, filesystem, and S3 modes', () => {
-    expect(
-      resolveRecordingStorage(config({ 'app.requestRecordingStorage': 'disabled' }), true),
-    ).toEqual({
+    expect(resolveRecordingStorage(config({ 'app.requestRecordingStorage': 'disabled' }))).toEqual({
       backend: null,
       reason: 'Recording storage was explicitly disabled',
     });
@@ -99,7 +97,6 @@ describe('request recording storage selection', () => {
           'app.requestRecordingStorage': 'filesystem',
           'app.nodeEnv': 'development',
         }),
-        false,
         '/manifest',
       ),
     ).toEqual({
@@ -113,7 +110,6 @@ describe('request recording storage selection', () => {
           'app.requestRecordingS3Bucket': 'recordings',
           'app.requestRecordingS3Region': 'eu-west-1',
         }),
-        false,
       ),
     ).toEqual(
       expect.objectContaining({
@@ -126,7 +122,7 @@ describe('request recording storage selection', () => {
 
   it('rejects unknown storage modes', () => {
     expect(
-      resolveRecordingStorage(config({ 'app.requestRecordingStorage': 'somewhere-else' }), true),
+      resolveRecordingStorage(config({ 'app.requestRecordingStorage': 'somewhere-else' })),
     ).toEqual({
       backend: null,
       reason: 'Unknown REQUEST_RECORDING_STORAGE value "somewhere-else"',
diff --git a/packages/backend/src/common/services/request-recording-storage.service.ts b/packages/backend/src/common/services/request-recording-storage.service.ts
index bdb3c76f..dc0a88dc 100644
--- a/packages/backend/src/common/services/request-recording-storage.service.ts
+++ b/packages/backend/src/common/services/request-recording-storage.service.ts
@@ -8,7 +8,6 @@ import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname, join, resolve, sep } from 'node:path';
-import { isSelfHosted } from '../utils/detect-self-hosted';
 
 export type RecordingStorageBackend = 'filesystem' | 's3';
 
@@ -45,7 +44,6 @@ interface RecordingStorageConfigSource {
 
 export function resolveRecordingStorage(
   config: RecordingStorageConfigSource,
-  selfHosted = isSelfHosted(),
   cwd = process.cwd(),
 ): ResolvedRecordingStorage {
   const requested = (config.get<string>('app.requestRecordingStorage') ?? 'auto').toLowerCase();
@@ -97,13 +95,7 @@ export function resolveRecordingStorage(
     };
   }
   if (bucket || region || hasPartialCredentials || endpoint) return s3();
-  if (selfHosted || nodeEnv !== 'production') {
-    return { backend: 'filesystem', path: filesystemPath };
-  }
-  return {
-    backend: null,
-    reason: 'Managed Cloud requires S3 recording storage credentials',
-  };
+  return { backend: 'filesystem', path: filesystemPath };
 }
 
 class FilesystemRecordingStorage implements RecordingStorage {
diff --git a/packages/backend/src/common/utils/container-host.spec.ts b/packages/backend/src/common/utils/container-host.spec.ts
new file mode 100644
index 00000000..503f70bb
--- /dev/null
+++ b/packages/backend/src/common/utils/container-host.spec.ts
@@ -0,0 +1,39 @@
+import { getContainerHostAlias } from './container-host';
+import * as fs from 'fs';
+
+jest.mock('fs');
+
+const mockedExistsSync = jest.mocked(fs.existsSync);
+
+describe('getContainerHostAlias', () => {
+  afterEach(() => {
+    mockedExistsSync.mockReset();
+  });
+
+  it("returns 'host.docker.internal' when /.dockerenv exists", () => {
+    mockedExistsSync.mockImplementation((p) => p === '/.dockerenv');
+    expect(getContainerHostAlias()).toBe('host.docker.internal');
+  });
+
+  it("returns 'host.containers.internal' when only /run/.containerenv exists (Podman)", () => {
+    mockedExistsSync.mockImplementation((p) => p === '/run/.containerenv');
+    expect(getContainerHostAlias()).toBe('host.containers.internal');
+  });
+
+  it("prefers 'host.docker.internal' when both markers exist (Docker writes both in some setups)", () => {
+    mockedExistsSync.mockReturnValue(true);
+    expect(getContainerHostAlias()).toBe('host.docker.internal');
+  });
+
+  it("returns 'localhost' when no marker exists", () => {
+    mockedExistsSync.mockReturnValue(false);
+    expect(getContainerHostAlias()).toBe('localhost');
+  });
+
+  it("returns 'localhost' when existsSync throws", () => {
+    mockedExistsSync.mockImplementation(() => {
+      throw new Error('EACCES');
+    });
+    expect(getContainerHostAlias()).toBe('localhost');
+  });
+});
diff --git a/packages/backend/src/common/utils/container-host.ts b/packages/backend/src/common/utils/container-host.ts
new file mode 100644
index 00000000..a0feec4b
--- /dev/null
+++ b/packages/backend/src/common/utils/container-host.ts
@@ -0,0 +1,22 @@
+import { existsSync } from 'fs';
+
+/**
+ * Returns the canonical hostname the container should use to reach the
+ * host. Docker uses `host.docker.internal` (mapped via `host-gateway` in
+ * compose). Podman exposes the same gateway as `host.containers.internal`.
+ * Outside any container, `localhost` resolves correctly.
+ *
+ * This only picks a hostname for local LLM servers. Thinker has a single
+ * (self-hosted) deployment mode, so no behavior depends on container detection.
+ */
+export function getContainerHostAlias(): string {
+  try {
+    if (existsSync('/run/.containerenv') && !existsSync('/.dockerenv')) {
+      return 'host.containers.internal';
+    }
+    if (existsSync('/.dockerenv')) return 'host.docker.internal';
+  } catch {
+    // fall through
+  }
+  return 'localhost';
+}
diff --git a/packages/backend/src/common/utils/detect-self-hosted.spec.ts b/packages/backend/src/common/utils/detect-self-hosted.spec.ts
deleted file mode 100644
index 5db0e977..00000000
--- a/packages/backend/src/common/utils/detect-self-hosted.spec.ts
+++ /dev/null
@@ -1,113 +0,0 @@
-import { getContainerHostAlias, isSelfHosted } from './detect-self-hosted';
-import * as fs from 'fs';
-
-jest.mock('fs');
-
-const mockedExistsSync = jest.mocked(fs.existsSync);
-
-describe('isSelfHosted', () => {
-  const originalMode = process.env['MANIFEST_MODE'];
-  const originalK8s = process.env['KUBERNETES_SERVICE_HOST'];
-
-  afterEach(() => {
-    if (originalMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = originalMode;
-    if (originalK8s === undefined) delete process.env['KUBERNETES_SERVICE_HOST'];
-    else process.env['KUBERNETES_SERVICE_HOST'] = originalK8s;
-    mockedExistsSync.mockReset();
-  });
-
-  it('returns true when MANIFEST_MODE is "selfhosted"', () => {
-    process.env['MANIFEST_MODE'] = 'selfhosted';
-    expect(isSelfHosted()).toBe(true);
-  });
-
-  it('returns true when MANIFEST_MODE is legacy "local"', () => {
-    process.env['MANIFEST_MODE'] = 'local';
-    expect(isSelfHosted()).toBe(true);
-  });
-
-  it('returns false when MANIFEST_MODE is "cloud"', () => {
-    process.env['MANIFEST_MODE'] = 'cloud';
-    delete process.env['KUBERNETES_SERVICE_HOST'];
-    expect(isSelfHosted()).toBe(false);
-  });
-
-  it('returns false when MANIFEST_MODE is "cloud" even inside Docker', () => {
-    process.env['MANIFEST_MODE'] = 'cloud';
-    delete process.env['KUBERNETES_SERVICE_HOST'];
-    mockedExistsSync.mockReturnValue(true);
-    expect(isSelfHosted()).toBe(false);
-  });
-
-  it('auto-detects Docker via /.dockerenv when MANIFEST_MODE is not set', () => {
-    delete process.env['MANIFEST_MODE'];
-    delete process.env['KUBERNETES_SERVICE_HOST'];
-    mockedExistsSync.mockImplementation((p) => p === '/.dockerenv');
-    expect(isSelfHosted()).toBe(true);
-    expect(mockedExistsSync).toHaveBeenCalledWith('/.dockerenv');
-  });
-
-  it('auto-detects Podman via /run/.containerenv when MANIFEST_MODE is not set', () => {
-    delete process.env['MANIFEST_MODE'];
-    delete process.env['KUBERNETES_SERVICE_HOST'];
-    mockedExistsSync.mockImplementation((p) => p === '/run/.containerenv');
-    expect(isSelfHosted()).toBe(true);
-  });
-
-  it('auto-detects Kubernetes via KUBERNETES_SERVICE_HOST', () => {
-    delete process.env['MANIFEST_MODE'];
-    process.env['KUBERNETES_SERVICE_HOST'] = '10.0.0.1';
-    mockedExistsSync.mockReturnValue(false);
-    expect(isSelfHosted()).toBe(true);
-  });
-
-  it('returns false when no container marker is present and MANIFEST_MODE is not set', () => {
-    delete process.env['MANIFEST_MODE'];
-    delete process.env['KUBERNETES_SERVICE_HOST'];
-    mockedExistsSync.mockReturnValue(false);
-    expect(isSelfHosted()).toBe(false);
-  });
-
-  it('returns false when existsSync throws', () => {
-    delete process.env['MANIFEST_MODE'];
-    delete process.env['KUBERNETES_SERVICE_HOST'];
-    mockedExistsSync.mockImplementation(() => {
-      throw new Error('permission denied');
-    });
-    expect(isSelfHosted()).toBe(false);
-  });
-});
-
-describe('getContainerHostAlias', () => {
-  afterEach(() => {
-    mockedExistsSync.mockReset();
-  });
-
-  it("returns 'host.docker.internal' when /.dockerenv exists", () => {
-    mockedExistsSync.mockImplementation((p) => p === '/.dockerenv');
-    expect(getContainerHostAlias()).toBe('host.docker.internal');
-  });
-
-  it("returns 'host.containers.internal' when only /run/.containerenv exists (Podman)", () => {
-    mockedExistsSync.mockImplementation((p) => p === '/run/.containerenv');
-    expect(getContainerHostAlias()).toBe('host.containers.internal');
-  });
-
-  it("prefers 'host.docker.internal' when both markers exist (Docker writes both in some setups)", () => {
-    mockedExistsSync.mockReturnValue(true);
-    expect(getContainerHostAlias()).toBe('host.docker.internal');
-  });
-
-  it("returns 'localhost' when no marker exists", () => {
-    mockedExistsSync.mockReturnValue(false);
-    expect(getContainerHostAlias()).toBe('localhost');
-  });
-
-  it("returns 'localhost' when existsSync throws", () => {
-    mockedExistsSync.mockImplementation(() => {
-      throw new Error('EACCES');
-    });
-    expect(getContainerHostAlias()).toBe('localhost');
-  });
-});
diff --git a/packages/backend/src/common/utils/detect-self-hosted.ts b/packages/backend/src/common/utils/detect-self-hosted.ts
deleted file mode 100644
index c098980d..00000000
--- a/packages/backend/src/common/utils/detect-self-hosted.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-import { existsSync } from 'fs';
-
-/**
- * Detects whether the app is running in the self-hosted version.
- *
- * Priority:
- * 1. Explicit `MANIFEST_MODE` env var — always wins
- *    - `selfhosted` (canonical) or legacy `local` → self-hosted
- *    - `cloud` → cloud
- * 2. Auto-detect a containerised runtime → self-hosted
- *    - Docker writes `/.dockerenv`
- *    - Podman writes `/run/.containerenv` (rootless and rootful)
- *    - Kubernetes injects `KUBERNETES_SERVICE_HOST`
- * 3. Default → cloud
- */
-export function isSelfHosted(): boolean {
-  const explicit = process.env['MANIFEST_MODE'];
-  if (explicit === 'cloud') return false;
-  if (explicit === 'selfhosted' || explicit === 'local') return true;
-  if (process.env['KUBERNETES_SERVICE_HOST']) return true;
-  try {
-    return existsSync('/.dockerenv') || existsSync('/run/.containerenv');
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Returns the canonical hostname the container should use to reach the
- * host. Docker uses `host.docker.internal` (mapped via `host-gateway` in
- * compose). Podman exposes the same gateway as `host.containers.internal`.
- * Outside any container, `localhost` resolves correctly.
- */
-export function getContainerHostAlias(): string {
-  try {
-    if (existsSync('/run/.containerenv') && !existsSync('/.dockerenv')) {
-      return 'host.containers.internal';
-    }
-    if (existsSync('/.dockerenv')) return 'host.docker.internal';
-  } catch {
-    // fall through
-  }
-  return 'localhost';
-}
diff --git a/packages/backend/src/common/utils/provider-availability.spec.ts b/packages/backend/src/common/utils/provider-availability.spec.ts
index 24307195..0e0fa611 100644
--- a/packages/backend/src/common/utils/provider-availability.spec.ts
+++ b/packages/backend/src/common/utils/provider-availability.spec.ts
@@ -1,17 +1,6 @@
-import {
-  filterProvidersForDeployment,
-  isLocalOnlyProvider,
-  isProviderAvailableForDeployment,
-} from './provider-availability';
+import { isLocalOnlyProvider } from './provider-availability';
 
 describe('provider availability', () => {
-  const previousMode = process.env['MANIFEST_MODE'];
-
-  afterEach(() => {
-    if (previousMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = previousMode;
-  });
-
   it('recognizes canonical local providers and their aliases', () => {
     expect(isLocalOnlyProvider('ollama')).toBe(true);
     expect(isLocalOnlyProvider(' LM Studio ')).toBe(true);
@@ -21,28 +10,4 @@ describe('provider availability', () => {
     expect(isLocalOnlyProvider('openai')).toBe(false);
     expect(isLocalOnlyProvider('custom:runtime-id')).toBe(false);
   });
-
-  it('allows built-in local providers only in self-hosted mode', () => {
-    process.env['MANIFEST_MODE'] = 'cloud';
-    expect(isProviderAvailableForDeployment('ollama')).toBe(false);
-    expect(isProviderAvailableForDeployment('custom:runtime-id')).toBe(true);
-
-    process.env['MANIFEST_MODE'] = 'selfhosted';
-    expect(isProviderAvailableForDeployment('ollama')).toBe(true);
-  });
-
-  it('filters local provider rows in cloud without cloning unchanged arrays', () => {
-    process.env['MANIFEST_MODE'] = 'cloud';
-    const providers = [{ provider: 'openai' }, { provider: 'ollama' }];
-    expect(filterProvidersForDeployment(providers)).toEqual([{ provider: 'openai' }]);
-
-    const unchanged = [{ provider: 'custom:runtime-id' }];
-    expect(filterProvidersForDeployment(unchanged)).toBe(unchanged);
-  });
-
-  it('keeps all provider rows in self-hosted mode', () => {
-    process.env['MANIFEST_MODE'] = 'selfhosted';
-    const providers = [{ provider: 'openai' }, { provider: 'ollama' }];
-    expect(filterProvidersForDeployment(providers)).toBe(providers);
-  });
 });
diff --git a/packages/backend/src/common/utils/provider-availability.ts b/packages/backend/src/common/utils/provider-availability.ts
index de8fd13a..4de56c6d 100644
--- a/packages/backend/src/common/utils/provider-availability.ts
+++ b/packages/backend/src/common/utils/provider-availability.ts
@@ -1,9 +1,10 @@
 import { normalizeProviderName, SHARED_PROVIDER_BY_ID_OR_ALIAS } from 'manifest-shared';
-import { isSelfHosted } from './detect-self-hosted';
-
-export const CLOUD_LOCAL_PROVIDER_MESSAGE =
-  'Built-in local providers are only available in self-hosted Manifest. On Manifest Cloud, expose the runtime through a public URL or tunnel and connect it as a custom provider.';
 
+/**
+ * True for built-in providers that run on the operator's own machine or LAN
+ * (Ollama, LM Studio, llama.cpp). Thinker is always self-hosted, so these are
+ * always available; the flag only drives display and accounting (no cost).
+ */
 export function isLocalOnlyProvider(provider: string): boolean {
   const lower = provider.trim().toLowerCase();
   const entry =
@@ -11,14 +12,3 @@ export function isLocalOnlyProvider(provider: string): boolean {
     SHARED_PROVIDER_BY_ID_OR_ALIAS.get(normalizeProviderName(lower));
   return entry?.localOnly === true;
 }
-
-export function isProviderAvailableForDeployment(provider: string): boolean {
-  return isSelfHosted() || !isLocalOnlyProvider(provider);
-}
-
-export function filterProvidersForDeployment<T extends { provider: string }>(providers: T[]): T[] {
-  if (isSelfHosted() || !providers.some((provider) => isLocalOnlyProvider(provider.provider))) {
-    return providers;
-  }
-  return providers.filter((provider) => !isLocalOnlyProvider(provider.provider));
-}
diff --git a/packages/backend/src/common/utils/url-validation.spec.ts b/packages/backend/src/common/utils/url-validation.spec.ts
index 67680d33..cf3c423f 100644
--- a/packages/backend/src/common/utils/url-validation.spec.ts
+++ b/packages/backend/src/common/utils/url-validation.spec.ts
@@ -275,14 +275,19 @@ describe('validatePublicUrl', () => {
 
   it('rejects plaintext http scheme (AC-2 passive exfiltration)', async () => {
     await expect(validatePublicUrl('http://example.com/api')).rejects.toThrow(
-      /Only https URLs are allowed in cloud mode/,
+      /Only https URLs are allowed/,
     );
   });
 
-  it('hints at MANIFEST_MODE=selfhosted when http is rejected (issue #1780)', async () => {
-    await expect(validatePublicUrl('http://llamacpp:8080/v1')).rejects.toThrow(
-      /MANIFEST_MODE=selfhosted/,
-    );
+  it.each([
+    'http://metadata.google.internal/computeMetadata/v1/',
+    'http://METADATA.GOOGLE.INTERNAL./computeMetadata/v1/',
+    'http://metadata/computeMetadata/v1/',
+    'http://metadata.goog/',
+    'http://instance-data.ec2.internal/latest/meta-data/',
+  ])('rejects the cloud metadata hostname in %s even with allowPrivate', async (url) => {
+    await expect(validatePublicUrl(url, { allowPrivate: true })).rejects.toThrow('cloud metadata');
+    expect(mockLookup).not.toHaveBeenCalled();
   });
 
   it('rejects IP literal pointing to private network', async () => {
diff --git a/packages/backend/src/common/utils/url-validation.ts b/packages/backend/src/common/utils/url-validation.ts
index f46e948d..1751b389 100644
--- a/packages/backend/src/common/utils/url-validation.ts
+++ b/packages/backend/src/common/utils/url-validation.ts
@@ -95,11 +95,10 @@ export function isPrivateIp(ip: string): boolean {
 // Only the specific IMDS addresses, not the whole link-local /16. Rootless
 // Podman maps `host.containers.internal` to a 169.254.x.y address (commonly
 // 169.254.1.2 with pasta/slirp4netns), and blocking the entire range would
-// stop self-hosted users from reaching their host gateway. The remaining
-// link-local space is still rejected in cloud mode by the private-IP guard
-// (PRIVATE_RANGES below), so the only path that goes through here is
-// allowPrivate: true — and there we still want to block the IMDS endpoints
-// even on a self-hosted box, in case the operator deployed inside EC2/GCE.
+// stop users from reaching their host gateway. The remaining link-local space
+// is still rejected by the private-IP guard (PRIVATE_RANGES above) when
+// allowPrivate is off; with allowPrivate on we still block the IMDS endpoints,
+// in case the operator deployed inside EC2/GCE/Azure.
 const CLOUD_METADATA_RANGES: { addr: bigint; mask: bigint }[] = [
   cidr('169.254.169.254', 32), // AWS / GCP / Azure / OpenStack IMDS
   cidr('169.254.169.253', 32), // Alibaba Cloud / OCI IMDS
@@ -111,6 +110,21 @@ const CLOUD_METADATA_RANGES: { addr: bigint; mask: bigint }[] = [
 // `fd00:ec2::254` is the AWS IPv6 IMDS endpoint.
 const CLOUD_METADATA_V6 = ['fd00:ec2::254'];
 
+// Metadata hostnames. Inside the cloud they resolve to the IMDS address and the
+// resolved-address check catches them, but with allowPrivate a DNS failure is
+// tolerated, so refuse the well-known names up front as well.
+const CLOUD_METADATA_HOSTNAMES = new Set([
+  'metadata',
+  'metadata.google.internal',
+  'metadata.goog',
+  'instance-data',
+  'instance-data.ec2.internal',
+]);
+
+export function isCloudMetadataHostname(hostname: string): boolean {
+  return CLOUD_METADATA_HOSTNAMES.has(hostname.toLowerCase().replace(/\.$/, ''));
+}
+
 export function isCloudMetadataIp(ip: string): boolean {
   const normalizedIp = unwrapMappedIpv4(ip);
 
@@ -145,28 +159,23 @@ export async function validatePublicUrl(
   const allowPrivate = opts.allowPrivate === true;
 
   // Only http(s) schemes are acceptable. Everything else (ftp, file, gopher,
-  // etc.) is rejected in both modes.
+  // etc.) is always rejected.
   if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
     throw new Error('Only http and https URLs are allowed');
   }
-  // HTTPS-only when we can't allow private destinations. Manifest forwards
+  // HTTPS-only when we can't allow private destinations. Thinker forwards
   // API keys in Authorization headers and plaintext prompts/completions to
   // this URL; any non-TLS hop would expose them to passive wire-sniffing
-  // (AC-2 in the Mine paper, arXiv:2604.08407). In self-hosted mode we allow
-  // http:// for local destinations only — see the final check below.
+  // (AC-2 in the Mine paper, arXiv:2604.08407). With allowPrivate we allow
+  // http:// for private destinations only — see the final check below.
   if (parsed.protocol === 'http:' && !allowPrivate) {
-    throw new Error(
-      'Only https URLs are allowed in cloud mode. ' +
-        'Self-hosted installs allow http:// for private destinations — ' +
-        'set MANIFEST_MODE=selfhosted if you are running Manifest yourself ' +
-        '(e.g. inside Docker, Podman, or Kubernetes).',
-    );
+    throw new Error('Only https URLs are allowed for this destination');
   }
 
   const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
 
-  // Cloud-metadata endpoints are always blocked (even in self-hosted mode).
-  if (isCloudMetadataIp(hostname)) {
+  // Cloud-metadata endpoints are always blocked, whatever allowPrivate says.
+  if (isCloudMetadataIp(hostname) || isCloudMetadataHostname(hostname)) {
     throw new Error('URLs pointing to cloud metadata endpoints are not allowed');
   }
 
@@ -188,7 +197,7 @@ export async function validatePublicUrl(
       const result = await lookup(hostname, { all: true });
       addresses = Array.isArray(result) ? result : [result];
     } catch {
-      // Self-hosted deployments sometimes use hostnames that only resolve
+      // Local deployments sometimes use hostnames that only resolve
       // inside the host's resolver (mDNS, /etc/hosts aliases, LAN-only
       // names). In allowPrivate mode we trust the operator and let the
       // subsequent fetch attempt decide — cloud metadata is still caught
diff --git a/packages/backend/src/database/backfills/message-provider-backfill.boot.service.spec.ts b/packages/backend/src/database/backfills/message-provider-backfill.boot.service.spec.ts
index 289cbe44..35b61f2d 100644
--- a/packages/backend/src/database/backfills/message-provider-backfill.boot.service.spec.ts
+++ b/packages/backend/src/database/backfills/message-provider-backfill.boot.service.spec.ts
@@ -37,10 +37,8 @@ describe('MessageProviderBackfillBootService', () => {
   let logSpy: jest.SpyInstance;
   let errSpy: jest.SpyInstance;
   const originalEnv = process.env['NODE_ENV'];
-  const originalMode = process.env['MANIFEST_MODE'];
 
   beforeEach(() => {
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     logSpy = jest.spyOn(Logger.prototype, 'log').mockImplementation(() => undefined);
     errSpy = jest.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
   });
@@ -48,8 +46,6 @@ describe('MessageProviderBackfillBootService', () => {
     logSpy.mockRestore();
     errSpy.mockRestore();
     process.env['NODE_ENV'] = originalEnv;
-    if (originalMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = originalMode;
   });
 
   describe('onApplicationBootstrap', () => {
@@ -60,16 +56,6 @@ describe('MessageProviderBackfillBootService', () => {
       expect(ds.createQueryRunner).not.toHaveBeenCalled();
     });
 
-    it('leaves Cloud coordination to the direct request-backfill connection', () => {
-      process.env['NODE_ENV'] = 'production';
-      process.env['MANIFEST_MODE'] = 'cloud';
-      const ds = { createQueryRunner: jest.fn() } as unknown as DataSource;
-
-      new MessageProviderBackfillBootService(ds, makeState(false).repo).onApplicationBootstrap();
-
-      expect(ds.createQueryRunner).not.toHaveBeenCalled();
-    });
-
     it('fires the backfill in production and logs (not throws) on failure', async () => {
       process.env['NODE_ENV'] = 'production';
       const state = makeState(false);
diff --git a/packages/backend/src/database/backfills/message-provider-backfill.boot.service.ts b/packages/backend/src/database/backfills/message-provider-backfill.boot.service.ts
index 1de5273b..900b6ce7 100644
--- a/packages/backend/src/database/backfills/message-provider-backfill.boot.service.ts
+++ b/packages/backend/src/database/backfills/message-provider-backfill.boot.service.ts
@@ -2,7 +2,6 @@ import { Injectable, Logger, OnApplicationBootstrap } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
 import { DataSource, Repository } from 'typeorm';
 
-import { isSelfHosted } from '../../common/utils/detect-self-hosted';
 import { BackfillState } from '../../entities/backfill-state.entity';
 import {
   BackfillOptions,
@@ -35,8 +34,7 @@ const defaultRunner: BackfillRunner = (dataSource, options) =>
  * Runs the post-deploy agent-message attribution backfill automatically, once,
  * after the app is up — so operators never have to invoke the CLI by hand.
  *
- * - Self-hosted production only; Cloud coordinates it over the direct backfill
- *   connection before starting the request-history backfill.
+ * - Production only (`NODE_ENV=production`).
  * - Fire-and-forget from onApplicationBootstrap: never blocks readiness/health
  *   and never crashes boot.
  * - Single-runner across replicas via a Postgres advisory lock.
@@ -59,9 +57,7 @@ export class MessageProviderBackfillBootService implements OnApplicationBootstra
 
   onApplicationBootstrap(): void {
     // Only on real deploys, and never await — boot must not wait on the backfill.
-    if (process.env['NODE_ENV'] !== 'production' || !isSelfHosted()) {
-      return;
-    }
+    if (process.env['NODE_ENV'] !== 'production') return;
     void this.runUntilComplete().catch((error) => {
       this.logger.error(
         `post-deploy backfill failed: ${error instanceof Error ? error.message : String(error)}`,
diff --git a/packages/backend/src/database/backfills/request-backfill.boot.service.spec.ts b/packages/backend/src/database/backfills/request-backfill.boot.service.spec.ts
index 8c078875..555af951 100644
--- a/packages/backend/src/database/backfills/request-backfill.boot.service.spec.ts
+++ b/packages/backend/src/database/backfills/request-backfill.boot.service.spec.ts
@@ -40,7 +40,6 @@ function makeState(completed: boolean, transitionFinalized = false) {
 
 describe('RequestBackfillBootService', () => {
   const originalEnv = process.env['NODE_ENV'];
-  const originalMode = process.env['MANIFEST_MODE'];
   const originalBackfillUrl = process.env['BACKFILL_DATABASE_URL'];
   const originalMigrationUrl = process.env['MIGRATION_DATABASE_URL'];
   const originalUnpooledUrl = process.env['DATABASE_UNPOOLED_URL'];
@@ -52,8 +51,6 @@ describe('RequestBackfillBootService', () => {
 
   afterEach(() => {
     process.env['NODE_ENV'] = originalEnv;
-    if (originalMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = originalMode;
     if (originalBackfillUrl === undefined) delete process.env['BACKFILL_DATABASE_URL'];
     else process.env['BACKFILL_DATABASE_URL'] = originalBackfillUrl;
     if (originalMigrationUrl === undefined) delete process.env['MIGRATION_DATABASE_URL'];
@@ -70,80 +67,35 @@ describe('RequestBackfillBootService', () => {
     expect(ds.createQueryRunner).not.toHaveBeenCalled();
   });
 
-  it('uses a separate direct DataSource in cloud production', async () => {
+  it('runs on the application DataSource in production, never a direct pool', async () => {
     process.env['NODE_ENV'] = 'production';
-    process.env['MANIFEST_MODE'] = 'cloud';
-    process.env['MIGRATION_DATABASE_URL'] = 'postgres://direct/cloud';
-    const appDataSource = { createQueryRunner: jest.fn() } as unknown as DataSource;
-    const directState = makeState(true);
-    const directDataSource = {
-      initialize: jest.fn(async () => undefined),
-      destroy: jest.fn(async () => undefined),
-      isInitialized: true,
-      getRepository: jest.fn(() => directState.repo),
+    // Even with a direct URL configured, the boot path stays on DATABASE_URL:
+    // there is no deployment mode that switches to a separate pool.
+    process.env['MIGRATION_DATABASE_URL'] = 'postgres://direct/db';
+    const state = makeState(true, true);
+    const ds = {
       query: jest.fn(async () => [{ present: false }]),
       createQueryRunner: jest.fn(),
     } as unknown as DataSource;
-    const factory = jest
-      .spyOn(requestBackfillDataSource, 'createRequestBackfillDataSource')
-      .mockReturnValue(directDataSource);
-    const providerBackfill = jest
-      .spyOn(MessageProviderBackfillBootService.prototype, 'runUntilComplete')
-      .mockResolvedValue(undefined);
-    const service = new RequestBackfillBootService(appDataSource, makeState(false).repo);
-
-    service.onApplicationBootstrap();
-    await new Promise((resolve) => setImmediate(resolve));
-
-    expect(factory).toHaveBeenCalledWith(process.env);
-    expect(directDataSource.initialize).toHaveBeenCalled();
-    expect(directDataSource.getRepository).toHaveBeenCalledWith(BackfillState);
-    expect(providerBackfill).toHaveBeenCalledTimes(1);
-    expect(appDataSource.createQueryRunner).not.toHaveBeenCalled();
-    expect(directDataSource.query).not.toHaveBeenCalled();
-    expect(directDataSource.destroy).toHaveBeenCalledTimes(1);
-    await service.onApplicationShutdown();
-    expect(directDataSource.destroy).toHaveBeenCalledTimes(1);
-  });
-
-  it('closes a Cloud direct pool that finishes connecting during shutdown', async () => {
-    process.env['NODE_ENV'] = 'production';
-    process.env['MANIFEST_MODE'] = 'cloud';
-    process.env['MIGRATION_DATABASE_URL'] = 'postgres://direct/cloud';
-    let finishInitialize!: () => void;
-    const directDataSource = {
-      initialize: jest.fn(
-        () =>
-          new Promise<void>((resolve) => {
-            finishInitialize = resolve;
-          }),
-      ),
-      destroy: jest.fn(async () => undefined),
-      isInitialized: true,
-      getRepository: jest.fn(),
-    } as unknown as DataSource;
-    jest
-      .spyOn(requestBackfillDataSource, 'createRequestBackfillDataSource')
-      .mockReturnValue(directDataSource);
-    const service = new RequestBackfillBootService(
-      { createQueryRunner: jest.fn() } as unknown as DataSource,
-      makeState(false).repo,
+    const factory = jest.spyOn(requestBackfillDataSource, 'createRequestBackfillDataSource');
+    const providerBackfill = jest.spyOn(
+      MessageProviderBackfillBootService.prototype,
+      'runUntilComplete',
     );
+    const service = new RequestBackfillBootService(ds, state.repo);
 
     service.onApplicationBootstrap();
-    await Promise.resolve();
-    await service.onApplicationShutdown();
-    finishInitialize();
     await new Promise((resolve) => setImmediate(resolve));
 
-    expect(directDataSource.destroy).toHaveBeenCalledTimes(1);
-    expect(directDataSource.getRepository).not.toHaveBeenCalled();
+    expect(state.countBy).toHaveBeenCalledWith({ name: REQUEST_BACKFILL_NAME });
+    expect(factory).not.toHaveBeenCalled();
+    expect(providerBackfill).not.toHaveBeenCalled();
+    await service.onApplicationShutdown();
   });
 
-  it('retries a self-hosted startup failure without requiring a restart or direct URL', async () => {
+  it('retries a startup failure without requiring a restart or direct URL', async () => {
     jest.useFakeTimers();
     process.env['NODE_ENV'] = 'production';
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     delete process.env['BACKFILL_DATABASE_URL'];
     delete process.env['MIGRATION_DATABASE_URL'];
     delete process.env['DATABASE_UNPOOLED_URL'];
@@ -174,10 +126,9 @@ describe('RequestBackfillBootService', () => {
     }
   });
 
-  it('stops retrying a self-hosted failure during shutdown', async () => {
+  it('stops retrying a failure during shutdown', async () => {
     jest.useFakeTimers();
     process.env['NODE_ENV'] = 'production';
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     const state = makeState(false);
     state.countBy.mockRejectedValue(new Error('db down'));
     const service = new RequestBackfillBootService(
@@ -200,58 +151,6 @@ describe('RequestBackfillBootService', () => {
     }
   });
 
-  it('recreates the Cloud direct pool after a transient coordinator failure', async () => {
-    jest.useFakeTimers();
-    process.env['NODE_ENV'] = 'production';
-    process.env['MANIFEST_MODE'] = 'cloud';
-    process.env['MIGRATION_DATABASE_URL'] = 'postgres://direct/cloud';
-    const failedState = makeState(false);
-    failedState.countBy.mockRejectedValue(new Error('connection reset'));
-    const completedState = makeState(true);
-    const firstDirect = {
-      initialize: jest.fn(async () => undefined),
-      destroy: jest.fn(async () => undefined),
-      isInitialized: true,
-      getRepository: jest.fn(() => failedState.repo),
-    } as unknown as DataSource;
-    const secondDirect = {
-      initialize: jest.fn(async () => undefined),
-      destroy: jest.fn(async () => undefined),
-      isInitialized: true,
-      getRepository: jest.fn(() => completedState.repo),
-      query: jest.fn(async () => [{ present: false }]),
-    } as unknown as DataSource;
-    const factory = jest
-      .spyOn(requestBackfillDataSource, 'createRequestBackfillDataSource')
-      .mockReturnValueOnce(firstDirect)
-      .mockReturnValueOnce(secondDirect);
-    const service = new RequestBackfillBootService(
-      { createQueryRunner: jest.fn() } as unknown as DataSource,
-      makeState(false).repo,
-    );
-
-    try {
-      service.onApplicationBootstrap();
-      await jest.advanceTimersByTimeAsync(0);
-
-      expect(firstDirect.destroy).toHaveBeenCalled();
-      expect(errorSpy).toHaveBeenCalledWith(
-        expect.stringContaining('connection reset; retrying in 30s'),
-      );
-
-      await jest.advanceTimersByTimeAsync(REQUEST_BACKFILL_LOCK_RETRY_MS);
-
-      expect(factory).toHaveBeenCalledTimes(2);
-      expect(secondDirect.initialize).toHaveBeenCalled();
-      expect(completedState.countBy).toHaveBeenCalled();
-      await service.onApplicationShutdown();
-      expect(secondDirect.destroy).toHaveBeenCalled();
-    } finally {
-      jest.clearAllTimers();
-      jest.useRealTimers();
-    }
-  });
-
   it('waits and retries when the shared lock is initially busy', async () => {
     jest.useFakeTimers();
     const state = makeState(false);
@@ -695,7 +594,6 @@ describe('RequestBackfillBootService', () => {
   it('waits through the rolling-deploy grace window before finalizing the transition', async () => {
     jest.useFakeTimers();
     process.env['NODE_ENV'] = 'production';
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     const ds = {
       query: jest.fn().mockResolvedValue([{ present: true }]),
       createQueryRunner: jest.fn(),
@@ -723,7 +621,6 @@ describe('RequestBackfillBootService', () => {
   it('reports a self-hosted tail failure and stops the timer on shutdown', async () => {
     jest.useFakeTimers();
     process.env['NODE_ENV'] = 'production';
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     const ds = {
       query: jest.fn().mockResolvedValue([{ present: true }]),
       createQueryRunner: jest.fn(),
diff --git a/packages/backend/src/database/backfills/request-backfill.boot.service.ts b/packages/backend/src/database/backfills/request-backfill.boot.service.ts
index 885085a1..476f4027 100644
--- a/packages/backend/src/database/backfills/request-backfill.boot.service.ts
+++ b/packages/backend/src/database/backfills/request-backfill.boot.service.ts
@@ -2,7 +2,6 @@ import { Injectable, Logger, OnApplicationBootstrap, OnApplicationShutdown } fro
 import { InjectRepository } from '@nestjs/typeorm';
 import { DataSource, Repository } from 'typeorm';
 import { toLocalSqlTimestamp } from '../../common/utils/postgres-sql';
-import { isSelfHosted } from '../../common/utils/detect-self-hosted';
 import { BackfillState } from '../../entities/backfill-state.entity';
 import {
   runRequestBackfill,
@@ -11,18 +10,14 @@ import {
 } from './backfill-requests';
 import { DEFAULT_BACKFILL_OPTIONS } from './backfill-message-providers';
 import { TypeOrmRequestBackfillGateway } from './backfill-requests.gateway';
-import {
-  MESSAGE_PROVIDER_BACKFILL_LOCK_KEY,
-  MessageProviderBackfillBootService,
-} from './message-provider-backfill.boot.service';
-import { createRequestBackfillDataSource } from './request-backfill.datasource';
+import { MESSAGE_PROVIDER_BACKFILL_LOCK_KEY } from './message-provider-backfill.boot.service';
 
 /** Initial historical pass marker; legacy-writer delta is tracked by unlinked rows. */
 export const REQUEST_BACKFILL_NAME = 'requests_agent_messages_v1';
 /** Post-reader cleanup and deferred constraint-validation marker. */
 export const REQUEST_TRANSITION_FINALIZATION_NAME = 'requests_agent_messages_v2';
 // Both post-deploy jobs update agent_messages. Sharing the lock guarantees
-// that Cloud never runs their batches concurrently; a contending job releases
+// that their batches never run concurrently; a contending job releases
 // its connection and retries until both completion markers exist.
 export const REQUEST_BACKFILL_LOCK_KEY = MESSAGE_PROVIDER_BACKFILL_LOCK_KEY;
 
@@ -65,16 +60,16 @@ const defaultTransitionFinalizer: RequestTransitionFinalizer = async (dataSource
 };
 
 /**
- * Runs historical regrouping without blocking application readiness. Self-hosted
- * reuses its DATABASE_URL-backed app connection. Cloud opens a separate direct
- * connection so session locks and temporary tables never cross PgBouncer.
+ * Runs historical regrouping without blocking application readiness, on the
+ * application's DATABASE_URL-backed connection. The standalone worker in
+ * `request-backfill.cli.ts` remains for operators who front Postgres with a
+ * transaction-mode pooler and need a direct connection.
  */
 @Injectable()
 export class RequestBackfillBootService implements OnApplicationBootstrap, OnApplicationShutdown {
   private readonly logger = new Logger(RequestBackfillBootService.name);
   private tailTimer: ReturnType<typeof setInterval> | undefined;
   private stopping = false;
-  private ownedDataSource: DataSource | undefined;
   private readonly transitionReadyAt = Date.now() + REQUEST_BACKFILL_GENERIC_GRACE_MS;
 
   constructor(
@@ -92,33 +87,16 @@ export class RequestBackfillBootService implements OnApplicationBootstrap, OnApp
   async onApplicationShutdown(): Promise<void> {
     this.stopping = true;
     this.stopTailSweep();
-    const ownedDataSource = this.ownedDataSource;
-    this.ownedDataSource = undefined;
-    if (ownedDataSource?.isInitialized) await ownedDataSource.destroy();
   }
 
-  /**
-   * Self-hosted reuses its DATABASE_URL-backed application DataSource. Cloud
-   * creates a separate direct pool so advisory locks and temporary staging
-   * tables never cross transaction-mode PgBouncer.
-   */
   private async runManagedBackfill(): Promise<void> {
     while (!this.stopping) {
       try {
-        const selfHosted = isSelfHosted();
-        const coordinator = selfHosted ? this : await this.createCloudCoordinator();
-        if (!coordinator || this.stopping) return;
-        await coordinator.runUntilComplete();
+        await this.runUntilComplete();
         if (this.stopping) return;
-        if (selfHosted) {
-          await coordinator.startTailSweep();
-          return;
-        }
-        // Cloud catch-up runs explicitly after the new deployment is healthy.
-        await this.releaseCloudCoordinator();
+        await this.startTailSweep();
         return;
       } catch (error) {
-        await this.releaseCloudCoordinator();
         if (this.stopping) return;
         this.logger.error(
           `post-deploy request backfill failed: ${error instanceof Error ? error.message : String(error)}; retrying in ${REQUEST_BACKFILL_LOCK_RETRY_MS / 1000}s`,
@@ -128,27 +106,6 @@ export class RequestBackfillBootService implements OnApplicationBootstrap, OnApp
     }
   }
 
-  private async createCloudCoordinator(): Promise<RequestBackfillBootService | null> {
-    const dataSource = createRequestBackfillDataSource(process.env);
-    await dataSource.initialize();
-    if (this.stopping) {
-      await dataSource.destroy();
-      return null;
-    }
-    this.ownedDataSource = dataSource;
-    const stateRepo = dataSource.getRepository(BackfillState);
-    // The older provider-attribution task uses the same direct connection in
-    // Cloud. Its session advisory lock must never cross transaction PgBouncer.
-    await new MessageProviderBackfillBootService(dataSource, stateRepo).runUntilComplete();
-    return new RequestBackfillBootService(dataSource, stateRepo);
-  }
-
-  private async releaseCloudCoordinator(): Promise<void> {
-    const dataSource = this.ownedDataSource;
-    this.ownedDataSource = undefined;
-    if (dataSource?.isInitialized) await dataSource.destroy().catch(() => undefined);
-  }
-
   private stopTailSweep(): void {
     if (this.tailTimer) clearInterval(this.tailTimer);
     this.tailTimer = undefined;
diff --git a/packages/backend/src/mcp/mcp-discovery.spec.ts b/packages/backend/src/mcp/mcp-discovery.spec.ts
index ec105a05..b26d2f83 100644
--- a/packages/backend/src/mcp/mcp-discovery.spec.ts
+++ b/packages/backend/src/mcp/mcp-discovery.spec.ts
@@ -7,16 +7,6 @@ jest.mock('../auth/auth.instance', () => ({
   authOrigin: 'http://localhost:3001',
   authIssuer: 'http://localhost:3001/api/auth',
   mcpResource: 'http://localhost:3001/api/v1/mcp',
-  authOriginForHost: (host: string) =>
-    host === 'gateway.manifest.build' ? 'https://gateway.manifest.build' : 'http://localhost:3001',
-  authIssuerForHost: (host: string) =>
-    host === 'gateway.manifest.build'
-      ? 'https://gateway.manifest.build/api/auth'
-      : 'http://localhost:3001/api/auth',
-  mcpResourceForHost: (host: string) =>
-    host === 'gateway.manifest.build'
-      ? 'https://gateway.manifest.build/api/v1/mcp'
-      : 'http://localhost:3001/api/v1/mcp',
   MCP_SCOPES: ['mcp:read', 'mcp:write'],
 }));
 jest.mock('@better-auth/oauth-provider', () => ({
@@ -68,14 +58,14 @@ describe('mountMcpDiscovery', () => {
     await request(makeApp()).head('/.well-known/oauth-protected-resource').expect(200);
   });
 
-  it('advertises the gateway resource and issuer to gateway clients', async () => {
+  it('advertises the canonical resource and issuer whatever the Host header', async () => {
     const res = await request(makeApp())
       .get('/.well-known/oauth-protected-resource/api/v1/mcp')
-      .set('Host', 'gateway.manifest.build')
+      .set('Host', 'other.example')
       .expect(200);
     expect(res.body).toMatchObject({
-      resource: 'https://gateway.manifest.build/api/v1/mcp',
-      authorization_servers: ['https://gateway.manifest.build/api/auth'],
+      resource: 'http://localhost:3001/api/v1/mcp',
+      authorization_servers: ['http://localhost:3001/api/auth'],
     });
   });
 
@@ -103,7 +93,7 @@ describe('mountMcpDiscovery', () => {
     expect(res.body).toEqual({ issuer: 'http://localhost:3001/api/auth' });
   });
 
-  it('uses the gateway host for gateway authorization metadata', async () => {
+  it('builds authorization metadata on the canonical origin, not the Host header', async () => {
     const serve = jest.fn(
       async (req: Request) =>
         new Response(JSON.stringify({ issuer: new URL(req.url).origin + '/api/auth' }), {
@@ -114,11 +104,11 @@ describe('mountMcpDiscovery', () => {
     oauthProviderAuthServerMetadata.mockReturnValue(serve);
     const res = await request(makeApp())
       .get('/.well-known/oauth-authorization-server/api/auth')
-      .set('Host', 'gateway.manifest.build')
+      .set('Host', 'other.example')
       .expect(200);
-    expect(res.body.issuer).toBe('https://gateway.manifest.build/api/auth');
+    expect(res.body.issuer).toBe('http://localhost:3001/api/auth');
     expect(serve.mock.calls[0][0].url).toBe(
-      'https://gateway.manifest.build/.well-known/oauth-authorization-server/api/auth',
+      'http://localhost:3001/.well-known/oauth-authorization-server/api/auth',
     );
   });
 
diff --git a/packages/backend/src/mcp/mcp-discovery.ts b/packages/backend/src/mcp/mcp-discovery.ts
index 75356a9b..0406e136 100644
--- a/packages/backend/src/mcp/mcp-discovery.ts
+++ b/packages/backend/src/mcp/mcp-discovery.ts
@@ -5,9 +5,9 @@ import type { Request, Response } from 'express';
 import { mcpOAuthResponse } from '../auth/mcp-oauth-response';
 import {
   authInstance,
-  authIssuerForHost,
-  authOriginForHost,
-  mcpResourceForHost,
+  authIssuer,
+  authOrigin,
+  mcpResource,
   MCP_SCOPES,
 } from '../auth/auth.instance';
 
@@ -43,13 +43,12 @@ export function mountMcpDiscovery(app: INestApplication): void {
   const serveAuthMetadata = async (req: Request, res: Response): Promise<void> => {
     cors(res);
     try {
-      const webRequest = new globalThis.Request(
-        `${authOriginForHost(req.headers.host)}${req.originalUrl}`,
-        {
-          method: req.method,
-          headers: fromNodeHeaders(req.headers),
-        },
-      );
+      // Always the canonical origin: the MCP resource and issuer are bound to
+      // BETTER_AUTH_URL, never to a client-supplied Host header.
+      const webRequest = new globalThis.Request(`${authOrigin}${req.originalUrl}`, {
+        method: req.method,
+        headers: fromNodeHeaders(req.headers),
+      });
       const response = await mcpOAuthResponse(webRequest, await authServerMetadata(webRequest));
       response.headers.forEach((value, key) => res.set(key, value));
       res.status(response.status).send(req.method === 'HEAD' ? undefined : await response.text());
@@ -75,11 +74,11 @@ export function mountMcpDiscovery(app: INestApplication): void {
   });
 
   for (const path of PROTECTED_RESOURCE_PATHS) {
-    expressApp.get(path, (req: Request, res: Response) => {
+    expressApp.get(path, (_req: Request, res: Response) => {
       cors(res);
       res.status(200).json({
-        resource: mcpResourceForHost(req.headers.host),
-        authorization_servers: [authIssuerForHost(req.headers.host)],
+        resource: mcpResource,
+        authorization_servers: [authIssuer],
         bearer_methods_supported: ['header'],
         scopes_supported: [...MCP_SCOPES],
       });
diff --git a/packages/backend/src/mcp/mcp.controller.spec.ts b/packages/backend/src/mcp/mcp.controller.spec.ts
index fb38653d..bf24a30a 100644
--- a/packages/backend/src/mcp/mcp.controller.spec.ts
+++ b/packages/backend/src/mcp/mcp.controller.spec.ts
@@ -7,14 +7,6 @@ jest.mock('../auth/auth.instance', () => ({
   auth: { $context: Promise.resolve({ baseURL: '', internalAdapter: {} }) },
   authIssuer: 'http://localhost:3001/api/auth',
   mcpResource: 'http://localhost:3001/api/v1/mcp',
-  authIssuerForHost: (host: string) =>
-    host === 'gateway.manifest.build'
-      ? 'https://gateway.manifest.build/api/auth'
-      : 'http://localhost:3001/api/auth',
-  mcpResourceForHost: (host: string) =>
-    host === 'gateway.manifest.build'
-      ? 'https://gateway.manifest.build/api/v1/mcp'
-      : 'http://localhost:3001/api/v1/mcp',
   MCP_READ_SCOPE: 'mcp:read',
 }));
 jest.mock('better-auth/node', () => ({ fromNodeHeaders: jest.fn(() => new Headers()) }));
@@ -313,18 +305,18 @@ describe('McpController', () => {
     );
   });
 
-  it('verifies gateway tokens against the gateway issuer and audience', async () => {
+  it('verifies tokens against the canonical issuer and audience whatever the Host header', async () => {
     createMcpProtectedRequestHandler.mockReturnValue(async () => new Response('OK'));
     const res = makeRes();
     await makeController('tenant-1').handle(
-      { ...req, headers: { host: 'gateway.manifest.build' } } as Request,
+      { ...req, headers: { host: 'other.example' } } as Request,
       res as never,
     );
     expect(createMcpProtectedRequestHandler).toHaveBeenCalledWith(
       expect.objectContaining({
-        issuer: 'https://gateway.manifest.build/api/auth',
-        audience: 'https://gateway.manifest.build/api/v1/mcp',
-        jwksUrl: 'https://gateway.manifest.build/api/auth/jwks',
+        issuer: 'http://localhost:3001/api/auth',
+        audience: 'http://localhost:3001/api/v1/mcp',
+        jwksUrl: 'http://localhost:3001/api/auth/jwks',
       }),
       expect.any(Function),
     );
diff --git a/packages/backend/src/mcp/mcp.controller.ts b/packages/backend/src/mcp/mcp.controller.ts
index 9449af9b..dbc31152 100644
--- a/packages/backend/src/mcp/mcp.controller.ts
+++ b/packages/backend/src/mcp/mcp.controller.ts
@@ -9,7 +9,7 @@ import { pipeline } from 'node:stream/promises';
 import type { Request, Response } from 'express';
 import { DataSource, Repository } from 'typeorm';
 import { InjectRepository } from '@nestjs/typeorm';
-import { auth, authIssuerForHost, mcpResourceForHost, MCP_READ_SCOPE } from '../auth/auth.instance';
+import { auth, authIssuer, mcpResource, MCP_READ_SCOPE } from '../auth/auth.instance';
 import { Public } from '../common/decorators/public.decorator';
 import { TenantCacheService } from '../common/services/tenant-cache.service';
 import { AgentListCacheService } from '../common/services/agent-list-cache.service';
@@ -132,8 +132,8 @@ export class McpController {
   @Public()
   async handle(@Req() req: Request, @Res() res: Response): Promise<void> {
     const deps = this.deps();
-    const resource = mcpResourceForHost(req.headers.host);
-    const issuer = authIssuerForHost(req.headers.host);
+    const resource = mcpResource;
+    const issuer = authIssuer;
     const webRequest = new globalThis.Request(resource, {
       method: req.method,
       headers: fromNodeHeaders(req.headers),
diff --git a/packages/backend/src/mcp/tools/providers.tools.ts b/packages/backend/src/mcp/tools/providers.tools.ts
index bacd19d4..bc7bbe2a 100644
--- a/packages/backend/src/mcp/tools/providers.tools.ts
+++ b/packages/backend/src/mcp/tools/providers.tools.ts
@@ -11,10 +11,6 @@ import {
 } from 'manifest-shared';
 import { AgentEnabledProvider } from '../../entities/agent-enabled-provider.entity';
 import { TenantProvider } from '../../entities/tenant-provider.entity';
-import {
-  CLOUD_LOCAL_PROVIDER_MESSAGE,
-  isProviderAvailableForDeployment,
-} from '../../common/utils/provider-availability';
 import { McpOperator, MCP_WRITE_SCOPE } from '../mcp-auth';
 import { McpToolDeps } from '../tool-deps';
 import { ok, result } from '../tool-result';
@@ -162,9 +158,6 @@ export function registerProviderTools(
             SHARED_PROVIDER_BY_ID_OR_ALIAS.get(normalized) ??
             SHARED_PROVIDER_BY_ID_OR_ALIAS.get(normalizeProviderName(normalized));
           if (!known) throw new Error(`Unknown provider: ${provider}`);
-          if (!isProviderAvailableForDeployment(provider)) {
-            throw new Error(CLOUD_LOCAL_PROVIDER_MESSAGE);
-          }
           const upserted = await deps.providers.upsertProvider(
             resolved.id,
             resolved.tenant_id,
diff --git a/packages/backend/src/mcp/tools/tools.spec.ts b/packages/backend/src/mcp/tools/tools.spec.ts
index d7b578da..eb497764 100644
--- a/packages/backend/src/mcp/tools/tools.spec.ts
+++ b/packages/backend/src/mcp/tools/tools.spec.ts
@@ -349,19 +349,11 @@ describe('MCP tools', () => {
       expect(
         (await call(tools, 'manifest_provider_connect', { provider: 'nope', agent: 'demo' })).error,
       ).toBe(true);
-      // Local-only providers are rejected outside self-hosted installs. Pin the
-      // deployment mode so a container marker cannot flip isSelfHosted().
-      const previousMode = process.env['MANIFEST_MODE'];
-      process.env['MANIFEST_MODE'] = 'cloud';
-      try {
-        expect(
-          (await call(tools, 'manifest_provider_connect', { provider: 'ollama', agent: 'demo' }))
-            .error,
-        ).toBe(true);
-      } finally {
-        if (previousMode === undefined) delete process.env['MANIFEST_MODE'];
-        else process.env['MANIFEST_MODE'] = previousMode;
-      }
+      // Built-in local providers connect with no deployment mode configured.
+      expect(
+        (await call(tools, 'manifest_provider_connect', { provider: 'ollama', agent: 'demo' }))
+          .error,
+      ).toBeFalsy();
 
       // Discovery failing after the connection is saved still succeeds.
       const discoveryFails = makeDeps();
diff --git a/packages/backend/src/model-discovery/model-discovery.service.spec.ts b/packages/backend/src/model-discovery/model-discovery.service.spec.ts
index 1806d02d..22686d8f 100644
--- a/packages/backend/src/model-discovery/model-discovery.service.spec.ts
+++ b/packages/backend/src/model-discovery/model-discovery.service.spec.ts
@@ -93,7 +93,6 @@ function makeMockRepo() {
 }
 
 describe('ModelDiscoveryService', () => {
-  const previousMode = process.env['MANIFEST_MODE'];
   let service: ModelDiscoveryService;
   let providerRepo: ReturnType<typeof makeMockRepo>;
   let customProviderRepo: ReturnType<typeof makeMockRepo>;
@@ -112,7 +111,6 @@ describe('ModelDiscoveryService', () => {
   let mockCopilotTokenService: { getCopilotToken: jest.Mock };
 
   beforeEach(() => {
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     providerRepo = makeMockRepo();
     customProviderRepo = makeMockRepo();
     fetcher = { fetch: jest.fn().mockResolvedValue([]) };
@@ -154,11 +152,6 @@ describe('ModelDiscoveryService', () => {
     );
   });
 
-  afterAll(() => {
-    if (previousMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = previousMode;
-  });
-
   afterEach(() => {
     jest.clearAllMocks();
   });
@@ -166,16 +159,15 @@ describe('ModelDiscoveryService', () => {
   /* ── discoverModels ── */
 
   describe('discoverModels', () => {
-    it('does not contact a built-in local runtime from cloud', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
+    it('discovers a built-in local runtime with no deployment mode configured', async () => {
+      fetcher.fetch.mockResolvedValue([makeModel({ id: 'qwen2.5:0.5b', provider: 'ollama' })]);
 
-      const result = await service.discoverModels(
+      await service.discoverModels(
         makeProvider({ provider: 'ollama', auth_type: 'local', api_key_encrypted: null }),
       );
 
-      expect(result).toEqual([]);
-      expect(fetcher.fetch).not.toHaveBeenCalled();
-      expect(providerRepo.save).not.toHaveBeenCalled();
+      expect(fetcher.fetch).toHaveBeenCalled();
+      expect(fetcher.fetch.mock.calls[0][0]).toBe('ollama');
     });
 
     it('should decrypt key, fetch, enrich, and cache models', async () => {
@@ -733,18 +725,11 @@ describe('ModelDiscoveryService', () => {
   /* ── refreshProvider ── */
 
   describe('refreshProvider', () => {
-    it('rejects built-in local refreshes in cloud before reading the provider row', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
-
+    it('refreshes built-in local providers with no deployment mode configured', async () => {
       const result = await service.refreshProvider('tenant-1', 'ollama', 'local');
 
-      expect(result).toEqual({
-        ok: false,
-        model_count: 0,
-        last_fetched_at: null,
-        error: expect.stringContaining('only available in self-hosted Manifest'),
-      });
-      expect(providerRepo.find).not.toHaveBeenCalled();
+      expect(providerRepo.find).toHaveBeenCalled();
+      expect(result.error ?? '').not.toMatch(/self-hosted|Cloud/);
     });
 
     it('returns Provider not found when no row matches', async () => {
@@ -919,8 +904,7 @@ describe('ModelDiscoveryService', () => {
   /* ── getModelsForAgent ── */
 
   describe('getModelsForAgent', () => {
-    it('hides built-in local models in cloud but keeps tunneled custom models', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
+    it('lists built-in local models alongside custom models', async () => {
       providerRepo.find.mockResolvedValue([
         makeProvider({
           id: 'ollama-row',
@@ -939,8 +923,8 @@ describe('ModelDiscoveryService', () => {
 
       const result = await service.getModelsForAgent('tenant-1');
 
-      expect(result.map((model) => model.id)).toEqual(['custom:cp-1/custom-llm']);
-      expect(result[0].authType).toBe('local');
+      expect(result.map((model) => model.id)).toEqual(['qwen2.5:0.5b', 'custom:cp-1/custom-llm']);
+      expect(result.every((model) => model.authType === 'local')).toBe(true);
     });
 
     it('should merge cached models from providers and custom providers', async () => {
diff --git a/packages/backend/src/model-discovery/model-discovery.service.ts b/packages/backend/src/model-discovery/model-discovery.service.ts
index 84a1b25a..0f79413c 100644
--- a/packages/backend/src/model-discovery/model-discovery.service.ts
+++ b/packages/backend/src/model-discovery/model-discovery.service.ts
@@ -49,11 +49,6 @@ import { resolveMetadataEntry } from './metadata-identity';
 import { lookupKnownPrice } from './known-model-prices';
 import { lookupKnownModalities } from './known-model-modalities';
 import { mergeModelCapabilities, modelSupportsStreaming } from './model-capabilities';
-import {
-  CLOUD_LOCAL_PROVIDER_MESSAGE,
-  filterProvidersForDeployment,
-  isProviderAvailableForDeployment,
-} from '../common/utils/provider-availability';
 // Import static helpers directly to avoid circular dependency with RoutingModule
 const customProviderKey = (id: string) => `custom:${id}`;
 const customModelKey = (id: string, modelName: string) => `custom:${id}/${modelName}`;
@@ -139,7 +134,6 @@ export class ModelDiscoveryService {
     provider: TenantProvider,
     options: DiscoverModelsOptions = {},
   ): Promise<DiscoveredModel[]> {
-    if (!isProviderAvailableForDeployment(provider.provider)) return [];
     let apiKey = '';
     let endpointOverride: string | undefined;
     const lowerProvider = provider.provider.toLowerCase();
@@ -388,11 +382,9 @@ export class ModelDiscoveryService {
     const discoveryOptions = options.forceRefresh
       ? { ...options, skipModelsDevRefresh: true }
       : options;
-    const providers = filterProvidersForDeployment(
-      await this.providerRepo.find({
-        where: { tenant_id: tenantId, is_active: true },
-      }),
-    );
+    const providers = await this.providerRepo.find({
+      where: { tenant_id: tenantId, is_active: true },
+    });
     await Promise.all(
       providers
         .filter((p) => !p.provider.startsWith('custom:'))
@@ -424,14 +416,6 @@ export class ModelDiscoveryService {
     last_fetched_at: string | null;
     error: string | null;
   }> {
-    if (!isProviderAvailableForDeployment(providerId)) {
-      return {
-        ok: false,
-        model_count: 0,
-        last_fetched_at: null,
-        error: CLOUD_LOCAL_PROVIDER_MESSAGE,
-      };
-    }
     const where: { tenant_id: string; provider: string; is_active: true; auth_type?: AuthType } = {
       tenant_id: tenantId,
       provider: providerId,
@@ -578,11 +562,9 @@ export class ModelDiscoveryService {
     tenantId: string,
     agentId?: string,
   ): Promise<DiscoveredModel[]> {
-    const allProviders = filterProvidersForDeployment(
-      await this.providerRepo.find({
-        where: { tenant_id: tenantId, is_active: true },
-      }),
-    );
+    const allProviders = await this.providerRepo.find({
+      where: { tenant_id: tenantId, is_active: true },
+    });
     const providers = await this.filterProvidersForAgent(allProviders, agentId);
 
     const models: DiscoveredModel[] = [];
diff --git a/packages/backend/src/routing/custom-provider/custom-provider.service.edge-cases.spec.ts b/packages/backend/src/routing/custom-provider/custom-provider.service.edge-cases.spec.ts
index fabd62d7..0b0083e3 100644
--- a/packages/backend/src/routing/custom-provider/custom-provider.service.edge-cases.spec.ts
+++ b/packages/backend/src/routing/custom-provider/custom-provider.service.edge-cases.spec.ts
@@ -9,9 +9,6 @@
 jest.mock('../../common/utils/url-validation', () => ({
   validatePublicUrl: jest.fn(),
 }));
-jest.mock('../../common/utils/detect-self-hosted', () => ({
-  isSelfHosted: jest.fn().mockReturnValue(false),
-}));
 
 import { BadRequestException } from '@nestjs/common';
 import { Repository } from 'typeorm';
@@ -24,8 +21,6 @@ import { ModelPricingCacheService } from '../../model-prices/model-pricing-cache
 import { ModelsDevSyncService } from '../../database/models-dev-sync.service';
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { validatePublicUrl } = require('../../common/utils/url-validation');
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { isSelfHosted } = require('../../common/utils/detect-self-hosted');
 
 function makeDeps(overrides: {
   findOneResults?: (CustomProvider | null)[];
@@ -86,8 +81,6 @@ describe('CustomProviderService edge cases', () => {
     jest.clearAllMocks();
     (validatePublicUrl as jest.Mock).mockReset();
     (validatePublicUrl as jest.Mock).mockResolvedValue(undefined);
-    (isSelfHosted as jest.Mock).mockReset();
-    (isSelfHosted as jest.Mock).mockReturnValue(false);
   });
 
   describe('canonicalizeAgentMessageKeys with stale references', () => {
@@ -188,22 +181,22 @@ describe('CustomProviderService edge cases', () => {
       await expect(svc.create('user-1', baseDto)).rejects.toThrow(/Invalid URL format/);
     });
 
-    it('rejects http URLs in cloud mode on create (cleartext credentials risk)', async () => {
+    it('rejects http URLs to public hosts on create (cleartext credentials risk)', async () => {
       (validatePublicUrl as jest.Mock).mockRejectedValue(
-        new Error('Only https URLs are allowed in cloud mode.'),
+        new Error('http:// is only allowed for private hosts'),
       );
       const { svc } = makeDeps({ findOneResults: [null] });
       await expect(
         svc.create('user-1', { ...baseDto, base_url: 'http://api.example.com' }),
-      ).rejects.toThrow(/Only https URLs are allowed/);
-      // allowPrivate must be false in non-self-hosted runs — the validator
-      // can't make that decision on its own without this option.
+      ).rejects.toThrow(/only allowed for private hosts/);
+      // Custom providers always validate with allowPrivate (LAN models are a
+      // feature); the validator still refuses plaintext to public hosts.
       expect(validatePublicUrl).toHaveBeenLastCalledWith('http://api.example.com', {
-        allowPrivate: false,
+        allowPrivate: true,
       });
     });
 
-    it('rejects private-IP URLs in cloud mode on create (SSRF guard)', async () => {
+    it('wraps a validator rejection on create as BadRequest (SSRF guard)', async () => {
       (validatePublicUrl as jest.Mock).mockRejectedValue(
         new Error('URLs pointing to private or internal networks are not allowed'),
       );
@@ -213,11 +206,10 @@ describe('CustomProviderService edge cases', () => {
       ).rejects.toThrow(/private or internal networks/);
     });
 
-    it('rejects cloud-metadata URLs on create even in self-hosted mode', async () => {
+    it('rejects cloud-metadata URLs on create even with allowPrivate', async () => {
       // Cloud metadata is the one destination that's always blocked, even
       // when allowPrivate is on — the validator throws and the service
       // must still wrap it as a BadRequestException.
-      (isSelfHosted as jest.Mock).mockReturnValue(true);
       (validatePublicUrl as jest.Mock).mockRejectedValue(
         new Error('URLs pointing to cloud metadata endpoints are not allowed'),
       );
@@ -243,7 +235,7 @@ describe('CustomProviderService edge cases', () => {
       );
     });
 
-    it('rejects private-IP URLs on update in cloud mode', async () => {
+    it('wraps a validator rejection on update as BadRequest', async () => {
       (validatePublicUrl as jest.Mock).mockRejectedValue(
         new Error('URLs pointing to private or internal networks are not allowed'),
       );
@@ -272,8 +264,7 @@ describe('CustomProviderService edge cases', () => {
       );
     });
 
-    it('passes allowPrivate=true to probeModels in self-hosted mode but still blocks bad URLs', async () => {
-      (isSelfHosted as jest.Mock).mockReturnValue(true);
+    it('passes allowPrivate=true to probeModels but still blocks bad URLs', async () => {
       (validatePublicUrl as jest.Mock).mockRejectedValue(
         new Error('Only http and https URLs are allowed'),
       );
diff --git a/packages/backend/src/routing/custom-provider/custom-provider.service.spec.ts b/packages/backend/src/routing/custom-provider/custom-provider.service.spec.ts
index 1af263df..6aaf61eb 100644
--- a/packages/backend/src/routing/custom-provider/custom-provider.service.spec.ts
+++ b/packages/backend/src/routing/custom-provider/custom-provider.service.spec.ts
@@ -1,9 +1,6 @@
 jest.mock('../../common/utils/url-validation', () => ({
   validatePublicUrl: jest.fn(),
 }));
-jest.mock('../../common/utils/detect-self-hosted', () => ({
-  isSelfHosted: jest.fn().mockReturnValue(false),
-}));
 
 import { BadRequestException, ConflictException, NotFoundException } from '@nestjs/common';
 import { Repository } from 'typeorm';
@@ -17,8 +14,6 @@ import { IngestEventBusService } from '../../common/services/ingest-event-bus.se
 import { ModelsDevSyncService } from '../../database/models-dev-sync.service';
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { validatePublicUrl } = require('../../common/utils/url-validation');
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { isSelfHosted } = require('../../common/utils/detect-self-hosted');
 
 function makeDeps(overrides: {
   findOneResults?: (CustomProvider | null)[];
@@ -127,8 +122,6 @@ describe('CustomProviderService', () => {
     jest.clearAllMocks();
     (validatePublicUrl as jest.Mock).mockReset();
     (validatePublicUrl as jest.Mock).mockResolvedValue(undefined);
-    (isSelfHosted as jest.Mock).mockReset();
-    (isSelfHosted as jest.Mock).mockReturnValue(false);
   });
 
   describe('static helpers', () => {
@@ -379,7 +372,7 @@ describe('CustomProviderService', () => {
         undefined,
         txManager,
       );
-      expect(validatePublicUrl).toHaveBeenCalledWith(dto.base_url, { allowPrivate: false });
+      expect(validatePublicUrl).toHaveBeenCalledWith(dto.base_url, { allowPrivate: true });
       // Price lookup cache must be refreshed so the proxy can compute cost
       // for messages routed to this provider's models immediately.
       expect(reloadPricing).toHaveBeenCalledTimes(1);
@@ -506,8 +499,7 @@ describe('CustomProviderService', () => {
       );
     });
 
-    it('passes allowPrivate=true in the self-hosted version so private URLs are accepted', async () => {
-      (isSelfHosted as jest.Mock).mockReturnValue(true);
+    it('passes allowPrivate=true so LAN and local URLs are accepted', async () => {
       const selfHostedDto = { ...dto, base_url: 'http://host.docker.internal:11434/v1' };
       const { svc } = makeDeps({ findOneResults: [null] });
       await svc.create('tenant-1', selfHostedDto);
@@ -765,12 +757,11 @@ describe('CustomProviderService', () => {
       } as CustomProvider;
       const { svc } = makeDeps({ findOneResults: [existing] });
       await svc.update('cp1', 'tenant-1', { base_url: 'https://b.example' });
-      expect(validatePublicUrl).toHaveBeenCalledWith('https://b.example', { allowPrivate: false });
+      expect(validatePublicUrl).toHaveBeenCalledWith('https://b.example', { allowPrivate: true });
       expect(existing.base_url).toBe('https://b.example');
     });
 
-    it('passes allowPrivate=true to validatePublicUrl in the self-hosted version', async () => {
-      (isSelfHosted as jest.Mock).mockReturnValue(true);
+    it('passes allowPrivate=true to validatePublicUrl with no deployment mode configured', async () => {
       const existing = { id: 'cp1', name: 'n' } as CustomProvider;
       const { svc } = makeDeps({ findOneResults: [existing] });
       await svc.update('cp1', 'tenant-1', {
diff --git a/packages/backend/src/routing/custom-provider/custom-provider.service.transactions.spec.ts b/packages/backend/src/routing/custom-provider/custom-provider.service.transactions.spec.ts
index 0c2e3b9f..ec63ef31 100644
--- a/packages/backend/src/routing/custom-provider/custom-provider.service.transactions.spec.ts
+++ b/packages/backend/src/routing/custom-provider/custom-provider.service.transactions.spec.ts
@@ -8,9 +8,6 @@
 jest.mock('../../common/utils/url-validation', () => ({
   validatePublicUrl: jest.fn().mockResolvedValue(undefined),
 }));
-jest.mock('../../common/utils/detect-self-hosted', () => ({
-  isSelfHosted: jest.fn().mockReturnValue(false),
-}));
 
 import { NotFoundException } from '@nestjs/common';
 import { Repository } from 'typeorm';
diff --git a/packages/backend/src/routing/custom-provider/custom-provider.service.ts b/packages/backend/src/routing/custom-provider/custom-provider.service.ts
index 3be816d8..54f0497f 100644
--- a/packages/backend/src/routing/custom-provider/custom-provider.service.ts
+++ b/packages/backend/src/routing/custom-provider/custom-provider.service.ts
@@ -29,7 +29,6 @@ import { ProviderService } from '../routing-core/provider.service';
 import { RoutingCacheService } from '../routing-core/routing-cache.service';
 import { CreateCustomProviderDto, UpdateCustomProviderDto } from '../dto/custom-provider.dto';
 import { validatePublicUrl } from '../../common/utils/url-validation';
-import { isSelfHosted } from '../../common/utils/detect-self-hosted';
 import { decryptWithAny, getDecryptionSecrets } from '../../common/utils/crypto.util';
 import { ModelPricingCacheService } from '../../model-prices/model-pricing-cache.service';
 import { ModelsDevSyncService } from '../../database/models-dev-sync.service';
@@ -38,6 +37,12 @@ import { classifyProbeError } from './probe-error';
 
 const PROBE_TIMEOUT_MS = 5000;
 
+// Private and LAN destinations are a feature: operators point custom providers
+// at Ollama, LM Studio or vLLM on their own network. Cloud metadata endpoints
+// stay blocked inside validatePublicUrl regardless of this flag.
+// The URL comes from an authenticated tenant member, not an anonymous client.
+const CUSTOM_PROVIDER_URL_POLICY = { allowPrivate: true } as const;
+
 /**
  * OpenAI-compatible `/v1/models` endpoints return every model the server
  * knows about — including embedding / reranker / moderation models that
@@ -306,7 +311,7 @@ export class CustomProviderService {
     if (alias && dto.alias !== undefined) this.assertAliasAvailable(alias, allForTenant);
 
     try {
-      await validatePublicUrl(dto.base_url, { allowPrivate: isSelfHosted() });
+      await validatePublicUrl(dto.base_url, CUSTOM_PROVIDER_URL_POLICY);
     } catch (err) {
       throw new BadRequestException((err as Error).message);
     }
@@ -409,7 +414,7 @@ export class CustomProviderService {
 
     if (dto.base_url !== undefined) {
       try {
-        await validatePublicUrl(dto.base_url, { allowPrivate: isSelfHosted() });
+        await validatePublicUrl(dto.base_url, CUSTOM_PROVIDER_URL_POLICY);
       } catch (err) {
         throw new BadRequestException((err as Error).message);
       }
@@ -552,7 +557,7 @@ export class CustomProviderService {
     providerName?: string,
   ): Promise<CustomProviderModel[]> {
     try {
-      await validatePublicUrl(baseUrl, { allowPrivate: isSelfHosted() });
+      await validatePublicUrl(baseUrl, CUSTOM_PROVIDER_URL_POLICY);
     } catch (err) {
       throw new BadRequestException((err as Error).message);
     }
@@ -571,8 +576,8 @@ export class CustomProviderService {
       }
       // User-controlled URL is intentional here — this endpoint exists to
       // connect to operator-chosen LLM servers. validatePublicUrl() above is
-      // our SSRF mitigation: cloud metadata is always blocked, private IPs
-      // only accepted in the self-hosted version. `redirect: 'error'`
+      // our SSRF mitigation: cloud metadata is always blocked; private and LAN
+      // hosts are allowed by design (local models). `redirect: 'error'`
       // ensures a hostile server can't redirect the probe to a destination
       // that would bypass validation.
       // codeql[js/request-forgery]
diff --git a/packages/backend/src/routing/model.controller.spec.ts b/packages/backend/src/routing/model.controller.spec.ts
index 89cdb54f..cc37e3cd 100644
--- a/packages/backend/src/routing/model.controller.spec.ts
+++ b/packages/backend/src/routing/model.controller.spec.ts
@@ -32,7 +32,6 @@ function makeDiscovered(overrides: Partial<DiscoveredModel> = {}): DiscoveredMod
 }
 
 describe('ModelController', () => {
-  const previousMode = process.env['MANIFEST_MODE'];
   let controller: ModelController;
   let mockDiscoveryService: Record<string, jest.Mock>;
   let mockOllamaSync: Record<string, jest.Mock>;
@@ -46,7 +45,6 @@ describe('ModelController', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     mockDiscoveryService = {
       getModelsForAgent: jest.fn().mockResolvedValue([]),
       discoverAllForAgent: jest.fn().mockResolvedValue(undefined),
@@ -101,11 +99,6 @@ describe('ModelController', () => {
     );
   });
 
-  afterAll(() => {
-    if (previousMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = previousMode;
-  });
-
   /* ── pricingHealth ── */
 
   describe('pricingHealth', () => {
@@ -171,15 +164,6 @@ describe('ModelController', () => {
       expect(mockOllamaSync.sync).toHaveBeenCalled();
       expect(result).toEqual({ count: 0 });
     });
-
-    it('rejects Ollama sync in cloud without dialing localhost', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
-
-      await expect(controller.syncOllama()).rejects.toThrow(
-        'Built-in local providers are only available in self-hosted Manifest',
-      );
-      expect(mockOllamaSync.sync).not.toHaveBeenCalled();
-    });
   });
 
   /* ── refreshModels ── */
diff --git a/packages/backend/src/routing/model.controller.ts b/packages/backend/src/routing/model.controller.ts
index 02bc04e6..4137c425 100644
--- a/packages/backend/src/routing/model.controller.ts
+++ b/packages/backend/src/routing/model.controller.ts
@@ -1,4 +1,4 @@
-import { BadRequestException, Controller, Get, Param, Post, Query } from '@nestjs/common';
+import { Controller, Get, Param, Post, Query } from '@nestjs/common';
 import { TenantCtx, TenantContext } from '../common/decorators/tenant-context.decorator';
 import { ResolveAgentService } from './routing-core/resolve-agent.service';
 import { CustomProviderService } from './custom-provider/custom-provider.service';
@@ -23,10 +23,6 @@ import {
   AgentProviderParamDto,
   RemoveProviderQueryDto,
 } from './dto/routing.dto';
-import {
-  CLOUD_LOCAL_PROVIDER_MESSAGE,
-  isProviderAvailableForDeployment,
-} from '../common/utils/provider-availability';
 
 function formatModelSlug(slug: string): string {
   return slug.replace(/[-_]/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
@@ -118,9 +114,6 @@ export class ModelController {
 
   @Post('ollama/sync')
   async syncOllama() {
-    if (!isProviderAvailableForDeployment('ollama')) {
-      throw new BadRequestException(CLOUD_LOCAL_PROVIDER_MESSAGE);
-    }
     return this.ollamaSync.sync();
   }
 
diff --git a/packages/backend/src/routing/provider.controller.spec.ts b/packages/backend/src/routing/provider.controller.spec.ts
index 98add012..dd5adc10 100644
--- a/packages/backend/src/routing/provider.controller.spec.ts
+++ b/packages/backend/src/routing/provider.controller.spec.ts
@@ -15,7 +15,6 @@ const TEST_AGENT_ID = 'agent-001';
 const TEST_TENANT_ID = 'tenant-1';
 
 describe('ProviderController', () => {
-  const previousMode = process.env['MANIFEST_MODE'];
   let controller: ProviderController;
   let mockProviderService: Record<string, jest.Mock>;
   let mockDiscoveryService: Record<string, jest.Mock>;
@@ -28,7 +27,6 @@ describe('ProviderController', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     mockProviderService = {
       getProviders: jest.fn().mockResolvedValue([]),
       upsertProvider: jest.fn().mockResolvedValue({ provider: {}, isNew: false }),
@@ -78,11 +76,6 @@ describe('ProviderController', () => {
     );
   });
 
-  afterAll(() => {
-    if (previousMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = previousMode;
-  });
-
   describe('upsertProvider region validation', () => {
     it('rejects an invalid Qwen region on connect', async () => {
       await expect(
@@ -528,31 +521,6 @@ describe('ProviderController', () => {
       expect(mockProviderService.upsertProvider).toHaveBeenCalled();
     });
 
-    it('rejects built-in local providers in cloud before contacting localhost', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
-
-      await expect(
-        controller.upsertProvider(mockCtx, mockAgentName, {
-          provider: 'ollama',
-          authType: 'local',
-        }),
-      ).rejects.toThrow('Built-in local providers are only available in self-hosted Manifest');
-
-      expect(mockOllamaSync.sync).not.toHaveBeenCalled();
-      expect(mockProviderService.upsertProvider).not.toHaveBeenCalled();
-    });
-
-    it('rejects local auth on a non-local built-in provider in cloud', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
-
-      await expect(
-        controller.upsertProvider(mockCtx, mockAgentName, {
-          provider: 'openai',
-          authType: 'local',
-        }),
-      ).rejects.toBeInstanceOf(BadRequestException);
-    });
-
     it('should accept region=cn for MiniMax subscription', async () => {
       mockProviderService.upsertProvider.mockResolvedValue({
         provider: {
diff --git a/packages/backend/src/routing/provider.controller.ts b/packages/backend/src/routing/provider.controller.ts
index 65891bfa..847eaf83 100644
--- a/packages/backend/src/routing/provider.controller.ts
+++ b/packages/backend/src/routing/provider.controller.ts
@@ -38,10 +38,6 @@ import {
   MINIMAX_API_KEY_REGION_VALIDATION_MESSAGE,
   isMinimaxRegion,
 } from './oauth/minimax/minimax-oauth-helpers';
-import {
-  CLOUD_LOCAL_PROVIDER_MESSAGE,
-  isProviderAvailableForDeployment,
-} from '../common/utils/provider-availability';
 
 @Controller('api/v1/routing')
 export class ProviderController {
@@ -145,12 +141,6 @@ export class ProviderController {
     const label = isCustomProvider
       ? await this.customConnectionLabel(agent.tenant_id, lowerProvider, body)
       : body.label;
-    if (
-      !isProviderAvailableForDeployment(lowerProvider) ||
-      (body.authType === 'local' && !isProviderAvailableForDeployment('ollama'))
-    ) {
-      throw new BadRequestException(CLOUD_LOCAL_PROVIDER_MESSAGE);
-    }
     const isQwenProvider = lowerProvider === 'qwen' || lowerProvider === 'alibaba';
     const isMinimaxApiKey =
       lowerProvider === 'minimax' && (body.authType ?? 'api_key') === 'api_key';
diff --git a/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts b/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
index 04aa3e39..3f3729ab 100644
--- a/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
@@ -1,6 +1,5 @@
 import { Buffer } from 'node:buffer';
 import { ProviderClient } from '../provider-client';
-import { ManifestError } from '../../../common/errors/manifest-error';
 import { buildCustomEndpoint, buildEndpointOverride } from '../provider-endpoints';
 import { ThinkingBlockCache, type ThinkingBlockRouteContext } from '../thinking-block-cache';
 import { ModelsDevReasoningCatalog } from '../reasoning-model-catalog';
@@ -39,30 +38,23 @@ function kiroEventFrame(eventType: string, payload: unknown, messageType = 'even
 }
 
 describe('ProviderClient', () => {
-  const previousMode = process.env['MANIFEST_MODE'];
   let client: ProviderClient;
 
   beforeEach(() => {
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     client = new ProviderClient();
     mockFetch.mockReset();
   });
 
-  afterAll(() => {
-    if (previousMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = previousMode;
-  });
-
   const body = {
     messages: [{ role: 'user', content: 'Hello' }],
     temperature: 0.7,
   };
 
   describe('OpenAI-compatible providers', () => {
-    it('refuses to dial a built-in local provider from cloud', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
+    it('dials a built-in local provider with no deployment mode configured', async () => {
+      mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
 
-      const request = client.forward({
+      await client.forward({
         provider: 'ollama',
         apiKey: '',
         model: 'qwen2.5:0.5b',
@@ -70,12 +62,7 @@ describe('ProviderClient', () => {
         stream: false,
       });
 
-      await expect(request).rejects.toMatchObject({ code: 'M303' });
-      await expect(request).rejects.toBeInstanceOf(ManifestError);
-      await expect(request).rejects.toThrow(
-        'Built-in local providers are only available in self-hosted Manifest',
-      );
-      expect(mockFetch).not.toHaveBeenCalled();
+      expect(mockFetch).toHaveBeenCalledTimes(1);
     });
 
     it('builds correct URL and headers for openai', async () => {
@@ -5887,19 +5874,11 @@ describe('ProviderClient', () => {
 });
 
 describe('ProviderClient provider-specific message fields', () => {
-  const previousMode = process.env['MANIFEST_MODE'];
-
   beforeEach(() => {
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     mockFetch.mockReset();
     mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
   });
 
-  afterAll(() => {
-    if (previousMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = previousMode;
-  });
-
   const reasoningBody = {
     messages: [
       {
diff --git a/packages/backend/src/routing/proxy/__tests__/provider-client.ssrf.spec.ts b/packages/backend/src/routing/proxy/__tests__/provider-client.ssrf.spec.ts
index 2c26e8bf..b6aaec7e 100644
--- a/packages/backend/src/routing/proxy/__tests__/provider-client.ssrf.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/provider-client.ssrf.spec.ts
@@ -5,22 +5,17 @@
 // that user-supplied custom-provider URLs can't be flipped to private /
 // metadata addresses via DNS rebinding *after* registration. The real
 // validator is a no-op when NODE_ENV === 'test' (see
-// `common/utils/url-validation.ts`), so we jest.mock both modules to
-// force the security branch to execute.
+// `common/utils/url-validation.ts`), so we jest.mock it to force the
+// security branch to execute.
 
 jest.mock('../../../common/utils/url-validation', () => ({
   validatePublicUrl: jest.fn(),
 }));
-jest.mock('../../../common/utils/detect-self-hosted', () => ({
-  isSelfHosted: jest.fn().mockReturnValue(false),
-}));
 
 import { ProviderClient } from '../provider-client';
 import { buildCustomEndpoint, ProviderEndpoint } from '../provider-endpoints';
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { validatePublicUrl } = require('../../../common/utils/url-validation');
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { isSelfHosted } = require('../../../common/utils/detect-self-hosted');
 
 const mockFetch = jest.fn();
 (globalThis as unknown as { fetch: typeof fetch }).fetch = mockFetch;
@@ -37,7 +32,6 @@ describe('ProviderClient — SSRF revalidation for custom endpoints', () => {
     client = new ProviderClient();
     mockFetch.mockReset();
     (validatePublicUrl as jest.Mock).mockReset();
-    (isSelfHosted as jest.Mock).mockReset().mockReturnValue(false);
   });
 
   it('re-validates URL through validatePublicUrl when endpoint requires revalidation', async () => {
@@ -60,14 +54,15 @@ describe('ProviderClient — SSRF revalidation for custom endpoints', () => {
     const [calledUrl, calledOpts] = (validatePublicUrl as jest.Mock).mock.calls[0];
     // normalizeProviderBaseUrl strips trailing /v1, then buildPath adds /v1/chat/completions.
     expect(calledUrl).toBe('https://upstream.example.com/v1/chat/completions');
-    expect(calledOpts).toEqual({ allowPrivate: false });
+    // LAN destinations are a feature; cloud metadata stays blocked inside the
+    // validator regardless of allowPrivate.
+    expect(calledOpts).toEqual({ allowPrivate: true });
     expect(mockFetch).toHaveBeenCalledTimes(1);
   });
 
-  it('forwards allowPrivate=true to validatePublicUrl in self-hosted mode', async () => {
+  it('allows a local endpoint with no deployment mode configured', async () => {
     mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
     (validatePublicUrl as jest.Mock).mockResolvedValue(undefined);
-    (isSelfHosted as jest.Mock).mockReturnValue(true);
 
     const customEndpoint = buildCustomEndpoint('http://localhost:8000');
 
diff --git a/packages/backend/src/routing/proxy/provider-client.ts b/packages/backend/src/routing/proxy/provider-client.ts
index 9934f6f1..30a5e608 100644
--- a/packages/backend/src/routing/proxy/provider-client.ts
+++ b/packages/backend/src/routing/proxy/provider-client.ts
@@ -9,7 +9,6 @@ import {
   resolveEndpointKey,
 } from './provider-endpoints';
 import { validatePublicUrl } from '../../common/utils/url-validation';
-import { isSelfHosted } from '../../common/utils/detect-self-hosted';
 import { resolveSubscriptionEndpointKey } from './provider-hooks';
 import { isAnthropicHost, mergeAnthropicBeta } from './anthropic-beta';
 import { injectOpenAiMessageCacheControl, injectOpenRouterCacheControl } from './cache-injection';
@@ -46,8 +45,6 @@ import { forwardKiroChat } from './kiro-adapter';
 import { OpencodeGoCatalogService } from '../../model-discovery/opencode-go-catalog.service';
 import { ProviderModelRegistryService } from '../../model-discovery/provider-model-registry.service';
 import { qualifyChatGptResponse } from './chatgpt-response-qualifier';
-import { isProviderAvailableForDeployment } from '../../common/utils/provider-availability';
-import { ManifestError } from '../../common/errors/manifest-error';
 import { isBedrockProvider } from '../bedrock-region';
 import { getBedrockRuntimeCapabilities } from '../bedrock-runtime-capabilities';
 
@@ -368,10 +365,6 @@ export class ProviderClient {
       authType,
     } = opts;
 
-    if (!customEndpoint && !isProviderAvailableForDeployment(provider)) {
-      throw new ManifestError('M303', HttpStatus.BAD_REQUEST);
-    }
-
     const { endpoint, endpointKey } = await this.resolveEndpoint(
       customEndpoint,
       provider,
@@ -462,10 +455,11 @@ export class ProviderClient {
 
     // SSRF defense in depth for user-supplied endpoint URLs (custom providers,
     // subscription resource URLs). Re-check on every actual forward, because DNS
-    // may have rebound since the URL was first validated.
+    // may have rebound since the URL was first validated. LAN destinations are
+    // allowed (local models are a feature); cloud metadata is always refused.
     if (endpoint.requiresSsrfRevalidation) {
       try {
-        await validatePublicUrl(url, { allowPrivate: isSelfHosted() });
+        await validatePublicUrl(url, { allowPrivate: true });
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         throw new Error(`Refusing to forward to disallowed URL: ${message}`);
diff --git a/packages/backend/src/routing/routing-core/__tests__/provider.service.spec.ts b/packages/backend/src/routing/routing-core/__tests__/provider.service.spec.ts
index 5bef3941..523b7960 100644
--- a/packages/backend/src/routing/routing-core/__tests__/provider.service.spec.ts
+++ b/packages/backend/src/routing/routing-core/__tests__/provider.service.spec.ts
@@ -56,7 +56,6 @@ const makeRepo = (agents: AgentRow[] = ['agent-1']) => ({
 });
 
 describe('ProviderService — route-only cleanup paths', () => {
-  const previousMode = process.env['MANIFEST_MODE'];
   let providerRepo: ReturnType<typeof makeRepo>;
   let tierRepo: ReturnType<typeof makeRepo>;
   let specRepo: ReturnType<typeof makeRepo>;
@@ -71,7 +70,6 @@ describe('ProviderService — route-only cleanup paths', () => {
   let svc: ProviderService;
 
   beforeEach(() => {
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     providerRepo = makeRepo();
     tierRepo = makeRepo();
     specRepo = makeRepo();
@@ -95,11 +93,6 @@ describe('ProviderService — route-only cleanup paths', () => {
     );
   });
 
-  afterAll(() => {
-    if (previousMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = previousMode;
-  });
-
   describe('removeProvider — route guards', () => {
     it('blocks disconnect when a tier override uses the provider', async () => {
       providerRepo.find.mockResolvedValueOnce([
@@ -1095,8 +1088,7 @@ describe('ProviderService — route-only cleanup paths', () => {
       expect(providerRepo.find).not.toHaveBeenCalled();
     });
 
-    it('filters legacy built-in local providers from cloud routing', async () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
+    it('routes to built-in local providers with no deployment mode configured', async () => {
       providerRepo.find.mockResolvedValue([
         { id: 'p1', provider: 'ollama', auth_type: 'local', is_active: true },
         { id: 'p2', provider: 'custom:runtime-id', auth_type: 'local', is_active: true },
@@ -1104,7 +1096,7 @@ describe('ProviderService — route-only cleanup paths', () => {
 
       const result = await svc.getProviders('tenant-1');
 
-      expect(result.map((provider) => provider.provider)).toEqual(['custom:runtime-id']);
+      expect(result.map((provider) => provider.provider)).toEqual(['ollama', 'custom:runtime-id']);
       expect(routingCache.setProviders).toHaveBeenCalledWith('tenant-1', result);
     });
   });
diff --git a/packages/backend/src/routing/routing-core/provider.service.ts b/packages/backend/src/routing/routing-core/provider.service.ts
index ba92b4d1..8b2b3359 100644
--- a/packages/backend/src/routing/routing-core/provider.service.ts
+++ b/packages/backend/src/routing/routing-core/provider.service.ts
@@ -49,7 +49,6 @@ import {
   MINIMAX_API_KEY_REGION_VALIDATION_MESSAGE,
   isMinimaxRegion,
 } from '../oauth/minimax/minimax-oauth-helpers';
-import { filterProvidersForDeployment } from '../../common/utils/provider-availability';
 
 const MAX_LABEL_LENGTH = 50;
 const DEFAULT_LABEL = 'Default';
@@ -143,13 +142,11 @@ export class ProviderService {
 
   async getProviders(tenantId: string): Promise<TenantProvider[]> {
     const cached = this.routingCache.getProviders(tenantId);
-    if (cached) return filterProvidersForDeployment(cached);
+    if (cached) return cached;
 
     await this.cleanupUnsupportedSubscriptionProviders(tenantId);
-    const providers = filterProvidersForDeployment(
-      (await this.providerRepo.find({ where: { tenant_id: tenantId } })).filter(
-        isManifestUsableProvider,
-      ),
+    const providers = (await this.providerRepo.find({ where: { tenant_id: tenantId } })).filter(
+      isManifestUsableProvider,
     );
     this.routingCache.setProviders(tenantId, providers);
     return providers;
diff --git a/packages/backend/src/routing/tenant-providers.controller.spec.ts b/packages/backend/src/routing/tenant-providers.controller.spec.ts
index 732ded05..12710ca8 100644
--- a/packages/backend/src/routing/tenant-providers.controller.spec.ts
+++ b/packages/backend/src/routing/tenant-providers.controller.spec.ts
@@ -3,18 +3,8 @@ import type { TenantContext } from '../common/decorators/tenant-context.decorato
 import type { TenantProvider } from '../entities/tenant-provider.entity';
 
 describe('TenantProvidersController', () => {
-  const previousMode = process.env['MANIFEST_MODE'];
   const ctx: TenantContext = { tenantId: 'tenant-1', userId: 'user-1' };
 
-  beforeEach(() => {
-    process.env['MANIFEST_MODE'] = 'cloud';
-  });
-
-  afterAll(() => {
-    if (previousMode === undefined) delete process.env['MANIFEST_MODE'];
-    else process.env['MANIFEST_MODE'] = previousMode;
-  });
-
   const makeProvider = (id: string, label: string): TenantProvider =>
     ({
       id,
@@ -119,7 +109,7 @@ describe('TenantProvidersController', () => {
     expect(result.model_counts).toEqual({});
   });
 
-  it('hides legacy built-in local rows in cloud but keeps tunneled custom providers', async () => {
+  it('lists built-in local rows alongside custom providers', async () => {
     const providerRepo = {
       find: jest.fn().mockResolvedValue([
         { ...makeProvider('ollama-row', 'Default'), provider: 'ollama', auth_type: 'local' },
@@ -142,7 +132,10 @@ describe('TenantProvidersController', () => {
 
     const result = await controller.listProviders(ctx);
 
-    expect(result.providers.map((provider) => provider.provider)).toEqual(['custom:runtime-id']);
+    expect(result.providers.map((provider) => provider.provider).sort()).toEqual([
+      'custom:runtime-id',
+      'ollama',
+    ]);
   });
 
   it('returns empty providers when ctx has no tenant (fresh account)', async () => {
diff --git a/packages/backend/src/routing/tenant-providers.controller.ts b/packages/backend/src/routing/tenant-providers.controller.ts
index 4026f2b0..30337f24 100644
--- a/packages/backend/src/routing/tenant-providers.controller.ts
+++ b/packages/backend/src/routing/tenant-providers.controller.ts
@@ -18,7 +18,6 @@ import { TenantCtx, TenantContext } from '../common/decorators/tenant-context.de
 import { TenantProvider } from '../entities/tenant-provider.entity';
 import { ModelPricingCacheService } from '../model-prices/model-pricing-cache.service';
 import { CustomProviderService } from './custom-provider/custom-provider.service';
-import { filterProvidersForDeployment } from '../common/utils/provider-availability';
 import { ProviderService } from './routing-core/provider.service';
 import { RoutingCacheService } from './routing-core/routing-cache.service';
 import { ModelDiscoveryService } from '../model-discovery/model-discovery.service';
@@ -131,9 +130,9 @@ export class TenantProvidersController {
   @Get()
   async listProviders(@TenantCtx() ctx: TenantContext) {
     const tenantId = ctx.tenantId;
-    const providers = filterProvidersForDeployment(
-      tenantId ? await this.providerRepo.find({ where: { tenant_id: tenantId } }) : [],
-    );
+    const providers = tenantId
+      ? await this.providerRepo.find({ where: { tenant_id: tenantId } })
+      : [];
 
     // Group providers and build response
     const grouped = new Map<
diff --git a/packages/backend/src/setup/setup.controller.spec.ts b/packages/backend/src/setup/setup.controller.spec.ts
index 05e7c1da..a7113502 100644
--- a/packages/backend/src/setup/setup.controller.spec.ts
+++ b/packages/backend/src/setup/setup.controller.spec.ts
@@ -11,7 +11,6 @@ describe('SetupController', () => {
   let mockNeedsSetup: jest.Mock;
   let mockCreateFirstAdmin: jest.Mock;
   let mockGetEnabledSocialProviders: jest.Mock;
-  let mockIsSelfHosted: jest.Mock;
   let mockIsOllamaAvailable: jest.Mock;
   let mockGetLocalLlmHost: jest.Mock;
   let mockIsEmailConfigured: jest.Mock;
@@ -21,7 +20,6 @@ describe('SetupController', () => {
     mockNeedsSetup = jest.fn();
     mockCreateFirstAdmin = jest.fn();
     mockGetEnabledSocialProviders = jest.fn().mockReturnValue([]);
-    mockIsSelfHosted = jest.fn().mockReturnValue(false);
     mockIsOllamaAvailable = jest.fn().mockResolvedValue(false);
     mockGetLocalLlmHost = jest.fn().mockReturnValue('localhost');
     mockIsEmailConfigured = jest.fn().mockReturnValue(true);
@@ -36,7 +34,6 @@ describe('SetupController', () => {
             needsSetup: mockNeedsSetup,
             createFirstAdmin: mockCreateFirstAdmin,
             getEnabledSocialProviders: mockGetEnabledSocialProviders,
-            isSelfHosted: mockIsSelfHosted,
             isOllamaAvailable: mockIsOllamaAvailable,
             getLocalLlmHost: mockGetLocalLlmHost,
             isEmailConfigured: mockIsEmailConfigured,
@@ -57,13 +54,12 @@ describe('SetupController', () => {
       expect(result.mcpEnabled).toBe(false);
     });
 
-    it('returns needsSetup=true with empty socialProviders in cloud mode', async () => {
+    it('returns needsSetup=true with empty socialProviders', async () => {
       mockNeedsSetup.mockResolvedValue(true);
       const result = await controller.getStatus();
       expect(result).toEqual({
         needsSetup: true,
         socialProviders: [],
-        isSelfHosted: false,
         ollamaAvailable: false,
         localLlmHost: 'localhost',
         emailConfigured: true,
@@ -71,13 +67,12 @@ describe('SetupController', () => {
       });
     });
 
-    it('returns needsSetup=false with empty socialProviders in cloud mode', async () => {
+    it('returns needsSetup=false with empty socialProviders', async () => {
       mockNeedsSetup.mockResolvedValue(false);
       const result = await controller.getStatus();
       expect(result).toEqual({
         needsSetup: false,
         socialProviders: [],
-        isSelfHosted: false,
         ollamaAvailable: false,
         localLlmHost: 'localhost',
         emailConfigured: true,
@@ -92,7 +87,6 @@ describe('SetupController', () => {
       expect(result).toEqual({
         needsSetup: false,
         socialProviders: ['google', 'github'],
-        isSelfHosted: false,
         ollamaAvailable: false,
         localLlmHost: 'localhost',
         emailConfigured: true,
@@ -100,31 +94,33 @@ describe('SetupController', () => {
       });
     });
 
-    it('returns isSelfHosted=true in the self-hosted version', async () => {
+    it('no longer reports a deployment mode', async () => {
       mockNeedsSetup.mockResolvedValue(false);
-      mockIsSelfHosted.mockReturnValue(true);
-      mockIsOllamaAvailable.mockResolvedValue(false);
       const result = await controller.getStatus();
-      expect(result).toEqual({
-        needsSetup: false,
-        socialProviders: [],
-        isSelfHosted: true,
-        ollamaAvailable: false,
-        localLlmHost: 'localhost',
-        emailConfigured: true,
-        mcpEnabled: true,
-      });
+      // The status carries no mode flag: exactly these fields, nothing else.
+      expect(Object.keys(result).sort()).toEqual([
+        'emailConfigured',
+        'localLlmHost',
+        'mcpEnabled',
+        'needsSetup',
+        'ollamaAvailable',
+        'socialProviders',
+      ]);
     });
 
-    it('returns ollamaAvailable=true in the self-hosted version when Ollama is reachable', async () => {
+    it('always probes Ollama, with no container or mode detection', async () => {
+      mockNeedsSetup.mockResolvedValue(false);
+      await controller.getStatus();
+      expect(mockIsOllamaAvailable).toHaveBeenCalledTimes(1);
+    });
+
+    it('returns ollamaAvailable=true when Ollama is reachable', async () => {
       mockNeedsSetup.mockResolvedValue(false);
-      mockIsSelfHosted.mockReturnValue(true);
       mockIsOllamaAvailable.mockResolvedValue(true);
       const result = await controller.getStatus();
       expect(result).toEqual({
         needsSetup: false,
         socialProviders: [],
-        isSelfHosted: true,
         ollamaAvailable: true,
         localLlmHost: 'localhost',
         emailConfigured: true,
@@ -134,7 +130,6 @@ describe('SetupController', () => {
 
     it('returns host.docker.internal as localLlmHost when running inside Docker', async () => {
       mockNeedsSetup.mockResolvedValue(false);
-      mockIsSelfHosted.mockReturnValue(true);
       mockGetLocalLlmHost.mockReturnValue('host.docker.internal');
       const result = await controller.getStatus();
       expect(result.localLlmHost).toBe('host.docker.internal');
@@ -146,14 +141,6 @@ describe('SetupController', () => {
       const result = await controller.getStatus();
       expect(result.emailConfigured).toBe(false);
     });
-
-    it('skips Ollama check in cloud mode (always false)', async () => {
-      mockNeedsSetup.mockResolvedValue(false);
-      mockIsSelfHosted.mockReturnValue(false);
-      const result = await controller.getStatus();
-      expect(result.ollamaAvailable).toBe(false);
-      expect(mockIsOllamaAvailable).not.toHaveBeenCalled();
-    });
   });
 
   describe('createAdmin', () => {
diff --git a/packages/backend/src/setup/setup.controller.ts b/packages/backend/src/setup/setup.controller.ts
index e723da83..cba981ec 100644
--- a/packages/backend/src/setup/setup.controller.ts
+++ b/packages/backend/src/setup/setup.controller.ts
@@ -12,19 +12,15 @@ export class SetupController {
   async getStatus(): Promise<{
     needsSetup: boolean;
     socialProviders: string[];
-    isSelfHosted: boolean;
     ollamaAvailable: boolean;
     localLlmHost: string;
     emailConfigured: boolean;
     mcpEnabled: boolean;
   }> {
-    const selfHosted = this.setupService.isSelfHosted();
-    const ollamaAvailable = selfHosted ? await this.setupService.isOllamaAvailable() : false;
     return {
       needsSetup: await this.setupService.needsSetup(),
       socialProviders: this.setupService.getEnabledSocialProviders(),
-      isSelfHosted: selfHosted,
-      ollamaAvailable,
+      ollamaAvailable: await this.setupService.isOllamaAvailable(),
       localLlmHost: this.setupService.getLocalLlmHost(),
       emailConfigured: this.setupService.isEmailConfigured(),
       mcpEnabled: this.setupService.isMcpEnabled(),
diff --git a/packages/backend/src/setup/setup.service.spec.ts b/packages/backend/src/setup/setup.service.spec.ts
index acf1db47..199481d8 100644
--- a/packages/backend/src/setup/setup.service.spec.ts
+++ b/packages/backend/src/setup/setup.service.spec.ts
@@ -84,35 +84,6 @@ describe('SetupService', () => {
     });
   });
 
-  describe('isSelfHosted', () => {
-    const originalMode = process.env['MANIFEST_MODE'];
-
-    afterEach(() => {
-      if (originalMode === undefined) delete process.env['MANIFEST_MODE'];
-      else process.env['MANIFEST_MODE'] = originalMode;
-    });
-
-    it('returns true when MANIFEST_MODE is selfhosted', () => {
-      process.env['MANIFEST_MODE'] = 'selfhosted';
-      expect(service.isSelfHosted()).toBe(true);
-    });
-
-    it('returns true for legacy MANIFEST_MODE=local', () => {
-      process.env['MANIFEST_MODE'] = 'local';
-      expect(service.isSelfHosted()).toBe(true);
-    });
-
-    it('returns false when MANIFEST_MODE is cloud', () => {
-      process.env['MANIFEST_MODE'] = 'cloud';
-      expect(service.isSelfHosted()).toBe(false);
-    });
-
-    it('returns false when MANIFEST_MODE is not set', () => {
-      delete process.env['MANIFEST_MODE'];
-      expect(service.isSelfHosted()).toBe(false);
-    });
-  });
-
   describe('isOllamaAvailable', () => {
     const originalFetch = global.fetch;
 
diff --git a/packages/backend/src/setup/setup.service.ts b/packages/backend/src/setup/setup.service.ts
index 0a6a7b41..35a462f0 100644
--- a/packages/backend/src/setup/setup.service.ts
+++ b/packages/backend/src/setup/setup.service.ts
@@ -2,7 +2,7 @@ import { ConflictException, Injectable, Logger } from '@nestjs/common';
 import { DataSource } from 'typeorm';
 import { CreateAdminDto } from './dto/create-admin.dto';
 import { OLLAMA_HOST } from '../common/constants/ollama';
-import { getContainerHostAlias, isSelfHosted } from '../common/utils/detect-self-hosted';
+import { getContainerHostAlias } from '../common/utils/container-host';
 import { isEmailConfigured } from '../notifications/services/email-providers/send-email';
 import { mcpAvailability } from '../auth/mcp-availability';
 
@@ -19,14 +19,6 @@ export class SetupService {
 
   constructor(private readonly dataSource: DataSource) {}
 
-  /**
-   * Returns true when running in the self-hosted version.
-   * Auto-detects Docker containers; can be overridden via MANIFEST_MODE env var.
-   */
-  isSelfHosted(): boolean {
-    return isSelfHosted();
-  }
-
   /**
    * Returns the hostname the backend should use to reach host-installed
    * LLM servers. Inside Docker the container reaches the host via
diff --git a/packages/backend/test/custom-providers.url-validation.e2e-spec.ts b/packages/backend/test/custom-providers.url-validation.e2e-spec.ts
index cef82b20..10da93c6 100644
--- a/packages/backend/test/custom-providers.url-validation.e2e-spec.ts
+++ b/packages/backend/test/custom-providers.url-validation.e2e-spec.ts
@@ -92,8 +92,8 @@ describe('Custom Providers URL validation (e2e)', () => {
 
     it('accepts http://localhost:9000 with explicit scheme', async () => {
       // Local LLM servers (Ollama, LM Studio, vLLM, llama.cpp) all bind
-      // to localhost. NODE_ENV=test skips SSRF, mirroring the real
-      // selfhosted allowPrivate path.
+      // to localhost. NODE_ENV=test skips SSRF here; the real validator
+      // allows it too (see the SSRF guard block below).
       const res = await request(app.getHttpServer())
         .post(`/api/v1/routing/${agentName}/custom-providers`)
         .set(headers)
@@ -119,84 +119,71 @@ describe('Custom Providers URL validation (e2e)', () => {
     });
   });
 
-  describe('POST — service-layer SSRF guard (cloud mode)', () => {
-    // Flip SKIP_SSRF_VALIDATION per-test so the NODE_ENV=test short-circuit
-    // is bypassed and the real cloud-mode behavior runs. MANIFEST_MODE is
-    // forced to "cloud" so a Docker auto-detect doesn't switch modes.
+  describe('POST — service-layer SSRF guard (single self-hosted mode)', () => {
+    // Flip SKIP_SSRF_VALIDATION per-test so the NODE_ENV=test short-circuit is
+    // bypassed and the real validator runs. No deployment-mode variable is set:
+    // Thinker has one mode, and LAN/local destinations are a feature (local
+    // models), while cloud metadata endpoints stay blocked. Hosts are literals
+    // or reserved names so the outcome never depends on the runner's DNS.
     let originalSkip: string | undefined;
-    let originalMode: string | undefined;
 
     beforeEach(() => {
       originalSkip = process.env['SKIP_SSRF_VALIDATION'];
-      originalMode = process.env['MANIFEST_MODE'];
       process.env['SKIP_SSRF_VALIDATION'] = 'false';
-      process.env['MANIFEST_MODE'] = 'cloud';
     });
 
-    afterEach(() => {
+    afterEach(async () => {
       if (originalSkip === undefined) delete process.env['SKIP_SSRF_VALIDATION'];
       else process.env['SKIP_SSRF_VALIDATION'] = originalSkip;
-      if (originalMode === undefined) delete process.env['MANIFEST_MODE'];
-      else process.env['MANIFEST_MODE'] = originalMode;
+      await deleteByName('LAN Ollama');
+      await deleteByName('Loopback');
     });
 
-    it('rejects plaintext http:// to a public host in cloud mode as 400', async () => {
-      // AC-2 in the Mine paper: forwarding API keys + completions over
-      // http leaks credentials to passive wire-sniffers.
+    it.each([
+      ['LAN Ollama', 'http://192.168.1.50:11434/v1'],
+      ['LAN Ollama', 'http://10.0.0.5:8000/v1'],
+      ['Loopback', 'http://127.0.0.1:1234/v1'],
+      ['Loopback', 'http://[::1]:8080/v1'],
+    ])('accepts a LAN or loopback URL (%s: %s) with no mode configured', async (name, url) => {
       const res = await request(app.getHttpServer())
         .post(`/api/v1/routing/${agentName}/custom-providers`)
         .set(headers)
-        .send({
-          name: 'Plaintext HTTP',
-          base_url: 'http://api.example.com/v1',
-          models: baseModels,
-        })
-        .expect(400);
+        .send({ name, base_url: url, models: baseModels })
+        .expect(201);
 
-      // The error message hints at MANIFEST_MODE=selfhosted; the "https"
-      // substring is the user-actionable key. Loose-match it so message
-      // refactors that preserve intent don't fail the test.
-      const body = res.body as { message?: string };
-      expect(typeof body.message === 'string' && body.message.includes('https')).toBe(true);
+      expect(res.body.base_url).toBe(url);
+      await deleteByName(name);
     });
 
-    it('rejects private-IP URLs in cloud mode as 400 (SSRF)', async () => {
-      // RFC 1918 private space must never be reachable from the cloud
-      // proxy — that's how attackers pivot to internal services.
-      await request(app.getHttpServer())
+    it('rejects plaintext http:// to a public host as 400', async () => {
+      // AC-2 in the Mine paper: forwarding API keys + completions over http
+      // to a public host leaks credentials to passive wire-sniffers.
+      const res = await request(app.getHttpServer())
         .post(`/api/v1/routing/${agentName}/custom-providers`)
         .set(headers)
-        .send({ name: 'Private IP', base_url: 'https://10.0.0.5/v1', models: baseModels })
+        .send({ name: 'Plaintext HTTP', base_url: 'http://93.184.216.34/v1', models: baseModels })
         .expect(400);
-    });
 
-    it('rejects 127.0.0.1 loopback URLs in cloud mode as 400', async () => {
-      // Loopback is the classic SSRF target (admin consoles bound there).
-      // Even with https://, cloud mode must refuse it.
-      await request(app.getHttpServer())
-        .post(`/api/v1/routing/${agentName}/custom-providers`)
-        .set(headers)
-        .send({ name: 'Loopback', base_url: 'https://127.0.0.1:8080/v1', models: baseModels })
-        .expect(400);
+      const body = res.body as { message?: string };
+      expect(body.message).toContain('http:// is only allowed for private hosts');
     });
 
-    it('rejects cloud-metadata IMDS URL even when self-hosted', async () => {
-      // The one URL family blocked in both modes: cloud metadata
-      // (169.254.169.254 etc.). Flipping into self-hosted proves the
-      // override path doesn't reopen the IMDS hole.
-      process.env['MANIFEST_MODE'] = 'selfhosted';
+    it.each([
+      'http://169.254.169.254/latest/meta-data',
+      'https://169.254.169.254/latest/meta-data',
+      'http://[fd00:ec2::254]/latest/meta-data',
+      'http://[::ffff:169.254.169.254]/latest/meta-data',
+      'http://100.100.100.200/latest/meta-data',
+      'http://metadata.google.internal/computeMetadata/v1/',
+    ])('rejects the cloud metadata endpoint %s as 400', async (url) => {
       const res = await request(app.getHttpServer())
         .post(`/api/v1/routing/${agentName}/custom-providers`)
         .set(headers)
-        .send({
-          name: 'IMDS',
-          base_url: 'http://169.254.169.254/latest/meta-data',
-          models: baseModels,
-        })
+        .send({ name: 'IMDS', base_url: url, models: baseModels })
         .expect(400);
 
       const body = res.body as { message?: string };
-      expect(typeof body.message === 'string' && body.message.includes('metadata')).toBe(true);
+      expect(body.message).toContain('cloud metadata');
     });
   });
 
@@ -238,23 +225,42 @@ describe('Custom Providers URL validation (e2e)', () => {
         .expect(400);
     });
 
-    it('rejects plaintext http to a public host on update in cloud mode', async () => {
+    async function withSsrfValidation(run: () => Promise<void>): Promise<void> {
       const originalSkip = process.env['SKIP_SSRF_VALIDATION'];
-      const originalMode = process.env['MANIFEST_MODE'];
       process.env['SKIP_SSRF_VALIDATION'] = 'false';
-      process.env['MANIFEST_MODE'] = 'cloud';
       try {
-        await request(app.getHttpServer())
-          .put(`/api/v1/routing/${agentName}/custom-providers/${createdId}`)
-          .set(headers)
-          .send({ base_url: 'http://api.example.com/v1' })
-          .expect(400);
+        await run();
       } finally {
         if (originalSkip === undefined) delete process.env['SKIP_SSRF_VALIDATION'];
         else process.env['SKIP_SSRF_VALIDATION'] = originalSkip;
-        if (originalMode === undefined) delete process.env['MANIFEST_MODE'];
-        else process.env['MANIFEST_MODE'] = originalMode;
       }
+    }
+
+    it('rejects plaintext http to a public host on update', async () => {
+      await withSsrfValidation(async () => {
+        await request(app.getHttpServer())
+          .put(`/api/v1/routing/${agentName}/custom-providers/${createdId}`)
+          .set(headers)
+          .send({ base_url: 'http://93.184.216.34/v1' })
+          .expect(400);
+      });
+    });
+
+    it('accepts a LAN URL on update and still rejects cloud metadata', async () => {
+      await withSsrfValidation(async () => {
+        const res = await request(app.getHttpServer())
+          .put(`/api/v1/routing/${agentName}/custom-providers/${createdId}`)
+          .set(headers)
+          .send({ base_url: 'http://192.168.1.50:11434/v1' })
+          .expect(200);
+        expect(res.body.base_url).toBe('http://192.168.1.50:11434/v1');
+
+        await request(app.getHttpServer())
+          .put(`/api/v1/routing/${agentName}/custom-providers/${createdId}`)
+          .set(headers)
+          .send({ base_url: 'http://169.254.169.254/latest/meta-data' })
+          .expect(400);
+      });
     });
 
     it('accepts a fresh valid https URL on update (sanity)', async () => {
diff --git a/packages/backend/test/mcp-cimd-ssrf.e2e-spec.ts b/packages/backend/test/mcp-cimd-ssrf.e2e-spec.ts
new file mode 100644
index 00000000..8ad8832b
--- /dev/null
+++ b/packages/backend/test/mcp-cimd-ssrf.e2e-spec.ts
@@ -0,0 +1,211 @@
+/**
+ * #18: CIMD SSRF guard on the real MCP OAuth flow.
+ *
+ * During OAuth an MCP client may use an HTTPS URL as its `client_id`, and the
+ * authorization server then fetches that Client ID Metadata Document. The URL
+ * is chosen by an unauthenticated client, so by default Thinker must refuse to
+ * fetch it when the name resolves to a private or loopback address. Operators
+ * who host MCP clients on their LAN opt in with THINKER_CIMD_ALLOW_PRIVATE=true.
+ *
+ * The real server (`src/main.ts`, Better Auth and its MCP/CIMD plugins) runs in
+ * its own process, because Better Auth's ESM dependencies cannot load in Jest's
+ * CommonJS runtime. Two preloads keep it hermetic: `egress-recorder.cjs` keeps
+ * it off the network and `cimd-dns-pin.cjs` resolves a public-looking client
+ * hostname to 127.0.0.1.
+ *
+ * Better Auth collapses every fetch failure into the same OAuth error, so the
+ * decisive observable is the private host itself: a TCP listener on 127.0.0.1
+ * counts the connections it receives. By default it must receive none.
+ */
+import { spawn, type ChildProcess } from 'child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'fs';
+import { createServer, type AddressInfo, type Server, type Socket } from 'net';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { DataSource } from 'typeorm';
+
+const BACKEND = join(__dirname, '..');
+// Better Auth's own client_id check rejects localhost, IP literals and metadata
+// names, so the URL needs a public-looking name; DNS pins it to loopback.
+const CLIENT_HOST = 'mcp-client.thinker-e2e.example';
+
+function freePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address();
+      server.close(() =>
+        typeof address === 'object' && address
+          ? resolve(address.port)
+          : reject(new Error('no port')),
+      );
+    });
+  });
+}
+
+interface RunningServer {
+  base: string;
+  child: ChildProcess;
+  output: () => string;
+}
+
+async function waitForHealth(server: RunningServer): Promise<void> {
+  const deadline = Date.now() + 150_000;
+  while (Date.now() < deadline) {
+    if (server.child.exitCode !== null) {
+      throw new Error(`server exited with ${server.child.exitCode}:\n${server.output()}`);
+    }
+    try {
+      const res = await fetch(`${server.base}/api/v1/health`);
+      if (res.ok) return;
+    } catch {
+      /* not listening yet */
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+  throw new Error(`server did not become healthy:\n${server.output()}`);
+}
+
+async function bootServer(
+  databaseUrl: string,
+  workDir: string,
+  extraEnv: NodeJS.ProcessEnv,
+): Promise<RunningServer> {
+  const port = await freePort();
+  const base = `http://127.0.0.1:${port}`;
+  const egressLog = join(workDir, `egress-${port}.jsonl`);
+  writeFileSync(egressLog, '');
+
+  const env: NodeJS.ProcessEnv = { ...process.env };
+  delete env['THINKER_CIMD_ALLOW_PRIVATE'];
+  delete env['MCP_ENABLED'];
+  Object.assign(env, {
+    NODE_ENV: 'production',
+    DATABASE_URL: databaseUrl,
+    PORT: String(port),
+    BIND_ADDRESS: '127.0.0.1',
+    // A loopback origin keeps the MCP plugins (and CIMD) enabled over http.
+    BETTER_AUTH_URL: base,
+    BETTER_AUTH_SECRET:
+      process.env['BETTER_AUTH_SECRET'] ?? 'test-secret-for-e2e-at-least-32chars!!',
+    SHUTDOWN_DRAIN_MS: '0',
+    EGRESS_LOG: egressLog,
+    CIMD_PINNED_HOST: CLIENT_HOST,
+    ...extraEnv,
+  });
+
+  let output = '';
+  const child = spawn(
+    process.execPath,
+    [
+      '-r',
+      require.resolve('ts-node/register/transpile-only'),
+      '-r',
+      join(__dirname, 'support', 'egress-recorder.cjs'),
+      '-r',
+      join(__dirname, 'support', 'cimd-dns-pin.cjs'),
+      join('src', 'main.ts'),
+    ],
+    { cwd: BACKEND, env, stdio: ['ignore', 'pipe', 'pipe'] },
+  );
+  child.stdout?.on('data', (chunk: Buffer) => (output += chunk.toString()));
+  child.stderr?.on('data', (chunk: Buffer) => (output += chunk.toString()));
+  const server = { base, child, output: () => output };
+  await waitForHealth(server);
+  return server;
+}
+
+async function stopServer(server: RunningServer | undefined): Promise<void> {
+  const child = server?.child;
+  if (!child || child.exitCode !== null) return;
+  const exited = new Promise((resolve) => child.once('exit', resolve));
+  child.kill('SIGTERM');
+  const timer = setTimeout(() => child.kill('SIGKILL'), 10_000);
+  await exited;
+  clearTimeout(timer);
+}
+
+describe('MCP OAuth CIMD client_id SSRF guard (e2e)', () => {
+  let workDir: string;
+  let defaultServer: RunningServer | undefined;
+  let optInServer: RunningServer | undefined;
+  let privateHost: Server;
+  let privatePort: number;
+  let connections = 0;
+  const sockets = new Set<Socket>();
+
+  beforeAll(async () => {
+    privateHost = createServer((socket) => {
+      connections += 1;
+      sockets.add(socket);
+      socket.on('close', () => sockets.delete(socket));
+      // Not a TLS server: the handshake fails, which is all the opt-in case needs.
+      socket.destroy();
+    });
+    await new Promise<void>((resolve) => privateHost.listen(0, '127.0.0.1', resolve));
+    privatePort = (privateHost.address() as AddressInfo).port;
+
+    const databaseUrl =
+      process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase';
+    // Start from an empty schema: the real server migrates on boot, and earlier
+    // suites leave a synchronize()-built schema behind.
+    const reset = new DataSource({ type: 'postgres', url: databaseUrl, dropSchema: true });
+    await reset.initialize();
+    await reset.destroy();
+
+    workDir = mkdtempSync(join(tmpdir(), 'thinker-cimd-'));
+    // Sequential boots: the first one applies the migrations.
+    defaultServer = await bootServer(databaseUrl, workDir, {});
+    optInServer = await bootServer(databaseUrl, workDir, { THINKER_CIMD_ALLOW_PRIVATE: 'true' });
+  }, 330_000);
+
+  afterAll(async () => {
+    await stopServer(defaultServer);
+    await stopServer(optInServer);
+    for (const socket of sockets) socket.destroy();
+    await new Promise<void>((resolve) => privateHost?.close(() => resolve()));
+    if (workDir) rmSync(workDir, { recursive: true, force: true });
+  }, 30_000);
+
+  beforeEach(() => {
+    connections = 0;
+  });
+
+  /** Starts an authorization-code flow whose client_id is a CIMD URL on the private host. */
+  async function authorize(server: RunningServer, path: string): Promise<string> {
+    const params = new URLSearchParams({
+      response_type: 'code',
+      client_id: `https://${CLIENT_HOST}:${privatePort}/${path}/client.json`,
+      redirect_uri: `https://${CLIENT_HOST}:${privatePort}/callback`,
+      code_challenge: 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM',
+      code_challenge_method: 'S256',
+      scope: 'mcp:read',
+      state: 'e2e-state',
+      resource: `${server.base}/api/v1/mcp`,
+    });
+    const res = await fetch(`${server.base}/api/auth/oauth2/authorize?${params}`, {
+      redirect: 'manual',
+    });
+    const location = res.headers.get('location');
+    const body = await res.text();
+    return `${res.status} ${location ?? ''} ${body}`;
+  }
+
+  it('refuses a client_id URL that resolves to a private address by default', async () => {
+    const outcome = await authorize(defaultServer!, 'default-policy');
+
+    expect(outcome).toMatch(/invalid_client/);
+    // The decisive check: the server never opened a connection to the private host.
+    expect(connections).toBe(0);
+  });
+
+  it('reaches a LAN-hosted client only with THINKER_CIMD_ALLOW_PRIVATE=true', async () => {
+    const outcome = await authorize(optInServer!, 'opt-in');
+
+    // The fetch is attempted (and fails on the non-TLS listener), proving the
+    // refusal above came from the private-address policy and nothing else.
+    expect(outcome).toMatch(/invalid_client/);
+    expect(connections).toBeGreaterThan(0);
+  });
+});
diff --git a/packages/backend/test/no-phonehome-egress.e2e-spec.ts b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
index 4c8c69f5..9c4c57a8 100644
--- a/packages/backend/test/no-phonehome-egress.e2e-spec.ts
+++ b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
@@ -30,12 +30,11 @@ const FORBIDDEN_DESTINATIONS = [
 const HOSTED_GATEWAY_HOSTS = ['app.manifest.build', 'gateway.manifest.build'];
 /**
  * Backend production files that still name a hosted gateway host, none of them
- * as a request destination: Cloud trusted origins (#18), and the dashboard link
- * fallback with the OG-tag placeholder it matches in the frontend's index.html
- * (#22, #25). The list may only shrink.
+ * as a request destination: the dashboard link fallback with the OG-tag
+ * placeholder it matches in the frontend's index.html (#22, #25). The list may
+ * only shrink.
  */
 const BACKEND_HOSTED_GATEWAY_LEFTOVERS = [
-  'backend/src/auth/auth.instance.ts',
   'backend/src/common/utils/dashboard-url.ts',
   'backend/src/common/utils/og-rewrite.ts',
 ];
diff --git a/packages/backend/test/setup.e2e-spec.ts b/packages/backend/test/setup.e2e-spec.ts
index 704b3685..0fbe84bb 100644
--- a/packages/backend/test/setup.e2e-spec.ts
+++ b/packages/backend/test/setup.e2e-spec.ts
@@ -37,11 +37,15 @@ describe('First-run setup wizard', () => {
     it('returns needsSetup=true when user table is empty', async () => {
       const res = await request(app.getHttpServer()).get('/api/v1/setup/status').expect(200);
       expect(res.body).toMatchObject({ needsSetup: true });
-      expect(res.body).toHaveProperty('socialProviders');
-      expect(res.body).toHaveProperty('isSelfHosted');
-      expect(res.body).toHaveProperty('localLlmHost');
-      expect(res.body).toHaveProperty('ollamaAvailable');
-      expect(res.body).toHaveProperty('emailConfigured');
+      // No deployment-mode flag any more (#18): exactly these fields.
+      expect(Object.keys(res.body).sort()).toEqual([
+        'emailConfigured',
+        'localLlmHost',
+        'mcpEnabled',
+        'needsSetup',
+        'ollamaAvailable',
+        'socialProviders',
+      ]);
     });
 
     it('returns needsSetup=false after a user has been inserted', async () => {
diff --git a/packages/backend/test/support/cimd-dns-pin.cjs b/packages/backend/test/support/cimd-dns-pin.cjs
new file mode 100644
index 00000000..e4e69c04
--- /dev/null
+++ b/packages/backend/test/support/cimd-dns-pin.cjs
@@ -0,0 +1,23 @@
+/**
+ * Preloaded (`node -r`, after `egress-recorder.cjs`) into the servers that
+ * `mcp-cimd-ssrf.e2e-spec.ts` boots. Resolves the hostname named by
+ * `CIMD_PINNED_HOST` to 127.0.0.1, so a public-looking CIMD `client_id` URL
+ * resolves to a private (loopback) address without depending on real DNS.
+ * Every other lookup goes to the previous resolver unchanged.
+ */
+'use strict';
+
+const dns = require('dns');
+
+const pinnedHost = process.env.CIMD_PINNED_HOST;
+if (!pinnedHost) throw new Error('CIMD_PINNED_HOST is required');
+
+const pinned = { address: '127.0.0.1', family: 4 };
+const previousPromisesLookup = dns.promises.lookup;
+dns.promises.lookup = async function pinnedPromisesLookup(hostname, options) {
+  if (hostname === pinnedHost) {
+    const all = typeof options === 'object' && options !== null && options.all === true;
+    return all ? [pinned] : pinned;
+  }
+  return previousPromisesLookup.call(this, hostname, options);
+};

From 7b1f1b86708a6ade7b6ad8db4e62d63f78489626 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 02:04:22 -0300
Subject: [PATCH 10/17] feat(backend): add THINKER_CATALOG_SYNC and gate the
 OpenCode Go doc on a provider

Implements ADR 0003 (#39):

- THINKER_CATALOG_SYNC=false (also 0/no/off) turns off all three public
  catalog fetches: no boot fetch, the daily crons and the pricing/model
  refresh paths become no-ops, and the OpenCode Go catalog returns []
  without fetching. OpenRouter and models.dev stay on by default.
- OpencodeGoCatalogService only warms the raw.githubusercontent.com doc at
  boot when a tenant_providers row for OpenCode Go (id or alias) exists.
  Every other caller is already scoped to an OpenCode Go provider, so a
  newly registered provider loads the doc lazily through its discovery.
- pricing-health and pricing/refresh report sync_enabled, and the routing
  status (REST and MCP) no longer blames the OpenRouter cache, which is
  empty by design with the sync off.
- The egress e2e boots the real server three times: no OpenCode Go
  provider (OpenRouter and models.dev fetched, no raw.githubusercontent.com),
  provider + THINKER_CATALOG_SYNC=false (no remote fetch at all), and
  provider + default (the doc is warmed).
- Documents the variable in both .env.example files, the compose file,
  DOCKER_README and the dev guide, including what pricing loses when the
  sync is off.

Closes #39

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docker/.env.example                           |  15 +
 docker/DOCKER_README.md                       |  16 +-
 docker/docker-compose.yml                     |   5 +
 docs/dev/manifest-guide.md                    |  18 +-
 packages/backend/.env.example                 |   3 +
 .../src/common/utils/catalog-sync.spec.ts     |  28 ++
 .../backend/src/common/utils/catalog-sync.ts  |  18 ++
 .../database/models-dev-sync.service.spec.ts  |  23 ++
 .../src/database/models-dev-sync.service.ts   |   9 +
 .../src/database/pricing-sync.service.spec.ts |  24 ++
 .../src/database/pricing-sync.service.ts      |   9 +
 .../backend/src/mcp/tools/routing.tools.ts    |   5 +-
 packages/backend/src/mcp/tools/tools.spec.ts  |  13 +
 .../opencode-go-catalog.service.gate.spec.ts  | 120 ++++++++
 .../opencode-go-catalog.service.spec.ts       |   7 +
 .../opencode-go-catalog.service.ts            |  72 ++++-
 .../src/routing/model.controller.spec.ts      |  28 +-
 .../backend/src/routing/model.controller.ts   |   4 +
 .../src/routing/provider.controller.spec.ts   |  18 ++
 .../src/routing/provider.controller.ts        |   5 +-
 .../test/no-phonehome-egress.e2e-spec.ts      | 273 ++++++++++++------
 .../backend/test/support/egress-recorder.cjs  |   3 +
 22 files changed, 623 insertions(+), 93 deletions(-)
 create mode 100644 packages/backend/src/common/utils/catalog-sync.spec.ts
 create mode 100644 packages/backend/src/common/utils/catalog-sync.ts
 create mode 100644 packages/backend/src/model-discovery/opencode-go-catalog.service.gate.spec.ts

diff --git a/docker/.env.example b/docker/.env.example
index 25d915dd..5a1c1f52 100644
--- a/docker/.env.example
+++ b/docker/.env.example
@@ -184,3 +184,18 @@ BETTER_AUTH_SECRET=
 # gateway by default. List extra origins here (comma-separated) to allow a
 # browser tool you run elsewhere.
 # THINKER_CORS_ORIGINS=https://tools.example.internal
+
+
+# ─── Public model catalogs (ADR 0003) ──────────────────────────────────────
+#
+# The only outbound calls Thinker makes on its own, besides the providers you
+# configure:
+#   - openrouter.ai/api/v1/models and models.dev/api.json, at boot and once a
+#     day, for model prices, context windows and capabilities;
+#   - the OpenCode Go doc on raw.githubusercontent.com, only when an OpenCode
+#     Go provider is registered, for its model list and per-request cost.
+# Set false to turn all three off (air-gapped installs). Thinker then uses only
+# the bundled data, which covers few models: most requests are recorded with no
+# known price and show as $0, OpenCode Go requests cost $0, and the model
+# picker shows no prices for most models.
+# THINKER_CATALOG_SYNC=true
diff --git a/docker/DOCKER_README.md b/docker/DOCKER_README.md
index 075b1b7b..46e8f571 100644
--- a/docker/DOCKER_README.md
+++ b/docker/DOCKER_README.md
@@ -413,6 +413,7 @@ sets this automatically).
 | `MANIFEST_MODE`                    | No          | auto (Docker → selfhosted)                   | `selfhosted` or `cloud`. `local` is a legacy alias. Self-hosted mode allows private/http URLs for custom providers.                                                                                        |
 | `MANIFEST_DISABLE_HSTS`            | No          | unset                                        | Set `1` to silence the boot warning about serving over plain HTTP on a LAN                                                                                                                                 |
 | `THROTTLE_LIMIT` / `THROTTLE_TTL`  | No          | `100` / `60000`                              | Rate limit: requests per window, window in ms                                                                                                                                                              |
+| `THINKER_CATALOG_SYNC`             | No          | `true`                                       | Set `false` to stop fetching the public model catalogs (see [No telemetry](#no-telemetry)). Costs then come from the bundled data only, so most models show $0                                                |
 | `DB_POOL_MAX` / `AUTH_DB_POOL_MAX` | No          | `10` / `5`                                   | PostgreSQL pool sizes (app pool, Better Auth pool)                                                                                                                                                         |
 
 `NODE_ENV` and `SEED_DATA` are deliberately fixed by the compose file and are
@@ -427,8 +428,19 @@ Full env var reference:
 
 The container makes no outbound call of its own: no usage telemetry, no update
 check, no error reporting. It only reaches the inference providers you
-configure and the public model catalogs (openrouter.ai, models.dev and, for
-OpenCode Go, raw.githubusercontent.com).
+configure and these public model catalogs:
+
+| Destination                                    | When                                                         |
+| ---------------------------------------------- | ------------------------------------------------------------ |
+| `openrouter.ai` (`/api/v1/models`)             | at boot and once a day                                       |
+| `models.dev` (`/api.json`)                     | at boot and once a day                                       |
+| `raw.githubusercontent.com` (OpenCode Go docs) | only when an OpenCode Go provider is registered, cached 1 h  |
+
+Set `THINKER_CATALOG_SYNC=false` to turn all three off, for example on an
+air-gapped host. Prices and capabilities then come only from the data bundled
+in the image, which covers few models: requests to most models are recorded
+without a known price and show as $0, OpenCode Go requests show $0, and the
+pricing refresh endpoint reports `sync_enabled: false`.
 
 ## Links
 
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 1f544680..9f187c9a 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -150,6 +150,11 @@ services:
       # Extra browser origins allowed to call the gateway (comma-separated).
       # None by default: the dashboard is same-origin.
       - THINKER_CORS_ORIGINS=${THINKER_CORS_ORIGINS:-}
+      # Public model/price catalogs (ADR 0003): openrouter.ai and models.dev at
+      # boot and daily, plus the OpenCode Go doc only when an OpenCode Go
+      # provider exists. Set false for air-gapped installs; costs then come
+      # from the bundled data only and most models show $0.
+      - THINKER_CATALOG_SYNC=${THINKER_CATALOG_SYNC:-true}
       # Daily Harness usage rollup. Reads stay off until backfill parity passes.
       - AGENT_USAGE_DAILY_WORKER=${AGENT_USAGE_DAILY_WORKER:-}
       - AGENT_USAGE_DAILY_READS=${AGENT_USAGE_DAILY_READS:-}
diff --git a/docs/dev/manifest-guide.md b/docs/dev/manifest-guide.md
index 986651ac..55559b2e 100644
--- a/docs/dev/manifest-guide.md
+++ b/docs/dev/manifest-guide.md
@@ -577,7 +577,23 @@ Thinker makes no outbound call of its own (#17). Upstream Manifest had six, all
 - **Hosted Wingman origin**: CORS no longer always allows `wingman.manifest.build`, and CSP `frame-src` is `'self'` in every mode (`WINGMAN_PORT` is gone). `WINGMAN_CORS_ORIGINS` became `THINKER_CORS_ORIGINS`, with the same meaning.
 - **modelparams.dev**: `ProviderParamSpecService` serves only the snapshot of the bundled `modelparams` package, loaded synchronously at construction. There is no boot fetch, no hourly cron and no `MODELPARAMS_API_*`; the snapshot moves forward with dependency updates.
 
-The only outbound destinations left are the providers the operator configures and the public catalogs of ADR 0003 (openrouter.ai, models.dev, and raw.githubusercontent.com for OpenCode Go). `test/no-phonehome-egress.e2e-spec.ts` fails if the backend, CLI or shared source names a removed destination again, or if a production-mode boot fetches anything outside that list.
+The only outbound destinations left are the providers the operator configures and the public catalogs of [ADR 0003](../adr/0003-excecao-catalogos-publicos.md) (#39):
+
+| Destination | Service | When |
+|---|---|---|
+| `openrouter.ai/api/v1/models` | `PricingSyncService` | boot (fire-and-forget) and daily at 03:00 |
+| `models.dev/api.json` | `ModelsDevSyncService` | boot (fire-and-forget) and daily at 04:00, plus manual model refreshes |
+| `raw.githubusercontent.com/.../go.mdx` | `OpencodeGoCatalogService` | only when an OpenCode Go provider is registered: the boot warmup checks `tenant_providers` first, and every other caller (that provider's discovery, its proxied requests and playground runs, its models in the picker) is already scoped to OpenCode Go; cached 1 h |
+
+**`THINKER_CATALOG_SYNC=false`** (also `0`, `no`, `off`; read at call time by `isCatalogSyncEnabled()` in `common/utils/catalog-sync.ts`) turns all three off: no boot fetch, the crons and `POST /api/v1/routing/pricing/refresh` become no-ops, and the OpenCode Go catalog returns `[]` without fetching. `GET /api/v1/routing/pricing-health` and the refresh endpoint report `sync_enabled`, and the routing status (REST and the MCP `manifest_routing_status` tool) no longer blames the empty OpenRouter cache for an unroutable agent, since that cache is empty by design.
+
+What the operator loses with the sync off, as ADR 0003 accepted:
+
+- **Recorded cost.** `ModelPricingCacheService` is built from the OpenRouter and models.dev caches plus custom providers' own prices. With both caches empty, a request to a non-custom, non-local model is recorded with `cost_usd` NULL ("price unknown"), unless the provider reports its own cost in the response usage (OpenRouter-style `usage.cost`). The dashboard shows NULL as $0.00 and totals sum it as 0. Subscriptions stay $0 as before, local providers stay $0, and custom providers keep their configured prices.
+- **OpenCode Go.** No docs catalog, so the per-request cost is $0, discovery lists only what OpenCode Go's own `/models` returns, and the API format comes from the model-family heuristic in `provider-client.ts`.
+- **Model metadata.** Discovery falls back to `known-model-prices.ts` (three prefixes today) for prices and to `known-model-modalities.ts` for modalities. Most models show no price in the picker, capability flags from models.dev are missing, and providers whose model list comes from the catalogs when their own API cannot (for example a Gemini subscription, or a provider whose `/models` is unreachable) may list no models.
+
+`test/no-phonehome-egress.e2e-spec.ts` fails if the backend, CLI or shared source names a removed destination again, or if a production-mode boot fetches anything outside that list. It boots the real server three times against the same database: with no OpenCode Go provider (openrouter.ai and models.dev are fetched, raw.githubusercontent.com is not), with an OpenCode Go provider and `THINKER_CATALOG_SYNC=false` (no remote fetch at all), and with that provider and the default (the OpenCode Go doc is warmed).
 
 ## Architecture Notes
 
diff --git a/packages/backend/.env.example b/packages/backend/.env.example
index cf78f76e..a0e817df 100644
--- a/packages/backend/.env.example
+++ b/packages/backend/.env.example
@@ -48,6 +48,9 @@ BETTER_AUTH_URL=http://localhost:3001
 # REQUEST_RECORDING_S3_SECRET_ACCESS_KEY=
 # REQUEST_RECORDING_S3_FORCE_PATH_STYLE=false
 
+# ── Public model catalogs (ADR 0003) ─────────────────
+# THINKER_CATALOG_SYNC=true  # Set false to stop the only outbound calls Thinker makes on its own: openrouter.ai and models.dev (boot + daily) and the OpenCode Go doc on raw.githubusercontent.com (only with an OpenCode Go provider). Costs then come from the bundled data only; most models show $0.
+
 # ── Rate Limiting ────────────────────────────────────
 # THROTTLE_TTL=60000         # Rate limit window in ms (default: 60000)
 # THROTTLE_LIMIT=100         # Max requests per window (default: 100)
diff --git a/packages/backend/src/common/utils/catalog-sync.spec.ts b/packages/backend/src/common/utils/catalog-sync.spec.ts
new file mode 100644
index 00000000..b4938474
--- /dev/null
+++ b/packages/backend/src/common/utils/catalog-sync.spec.ts
@@ -0,0 +1,28 @@
+import { isCatalogSyncEnabled } from './catalog-sync';
+
+describe('isCatalogSyncEnabled', () => {
+  it('is on by default (ADR 0003)', () => {
+    expect(isCatalogSyncEnabled({})).toBe(true);
+  });
+
+  it.each(['false', 'FALSE', ' false ', '0', 'no', 'off'])('is off for %p', (value) => {
+    expect(isCatalogSyncEnabled({ THINKER_CATALOG_SYNC: value })).toBe(false);
+  });
+
+  it.each(['true', '1', 'yes', 'on', ''])('stays on for %p', (value) => {
+    expect(isCatalogSyncEnabled({ THINKER_CATALOG_SYNC: value })).toBe(true);
+  });
+
+  it('reads process.env when no env is passed', () => {
+    const previous = process.env['THINKER_CATALOG_SYNC'];
+    try {
+      process.env['THINKER_CATALOG_SYNC'] = 'false';
+      expect(isCatalogSyncEnabled()).toBe(false);
+      delete process.env['THINKER_CATALOG_SYNC'];
+      expect(isCatalogSyncEnabled()).toBe(true);
+    } finally {
+      if (previous === undefined) delete process.env['THINKER_CATALOG_SYNC'];
+      else process.env['THINKER_CATALOG_SYNC'] = previous;
+    }
+  });
+});
diff --git a/packages/backend/src/common/utils/catalog-sync.ts b/packages/backend/src/common/utils/catalog-sync.ts
new file mode 100644
index 00000000..76265bd5
--- /dev/null
+++ b/packages/backend/src/common/utils/catalog-sync.ts
@@ -0,0 +1,18 @@
+/**
+ * ADR 0003: the public model and price catalogs (openrouter.ai, models.dev and
+ * the OpenCode Go doc on raw.githubusercontent.com) are the only outbound
+ * destinations Thinker may reach on its own. `THINKER_CATALOG_SYNC=false`
+ * turns all three off; the bundled data is then the only source.
+ *
+ * Read at call time, not cached, so the value an operator sets is the value
+ * every boot hook, cron and refresh endpoint sees.
+ */
+export const CATALOG_SYNC_ENV = 'THINKER_CATALOG_SYNC';
+
+const DISABLED_VALUES = new Set(['false', '0', 'no', 'off']);
+
+export function isCatalogSyncEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  const raw = env[CATALOG_SYNC_ENV];
+  if (raw === undefined) return true;
+  return !DISABLED_VALUES.has(raw.trim().toLowerCase());
+}
diff --git a/packages/backend/src/database/models-dev-sync.service.spec.ts b/packages/backend/src/database/models-dev-sync.service.spec.ts
index 0e14f792..67b0a2a5 100644
--- a/packages/backend/src/database/models-dev-sync.service.spec.ts
+++ b/packages/backend/src/database/models-dev-sync.service.spec.ts
@@ -389,6 +389,29 @@ describe('ModelsDevSyncService', () => {
     fetchSpy.mockRestore();
   });
 
+  describe('THINKER_CATALOG_SYNC=false', () => {
+    const previous = process.env['THINKER_CATALOG_SYNC'];
+    beforeEach(() => {
+      process.env['THINKER_CATALOG_SYNC'] = 'false';
+    });
+    afterEach(() => {
+      if (previous === undefined) delete process.env['THINKER_CATALOG_SYNC'];
+      else process.env['THINKER_CATALOG_SYNC'] = previous;
+    });
+
+    it('skips the boot fetch and resolves whenInitialized() at once', async () => {
+      service.onModuleInit();
+      await service.whenInitialized();
+      expect(fetchSpy).not.toHaveBeenCalled();
+      expect(service.getLastFetchedAt()).toBeNull();
+    });
+
+    it('makes the cron and the manual refresh a no-op', async () => {
+      await expect(service.refreshCache()).resolves.toBe(0);
+      expect(fetchSpy).not.toHaveBeenCalled();
+    });
+  });
+
   describe('refreshCache', () => {
     it('should fetch, parse, and cache models from api.json', async () => {
       fetchSpy.mockResolvedValue({
diff --git a/packages/backend/src/database/models-dev-sync.service.ts b/packages/backend/src/database/models-dev-sync.service.ts
index a08a19e0..be907a72 100644
--- a/packages/backend/src/database/models-dev-sync.service.ts
+++ b/packages/backend/src/database/models-dev-sync.service.ts
@@ -1,5 +1,6 @@
 import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
 import { Cron, CronExpression } from '@nestjs/schedule';
+import { CATALOG_SYNC_ENV, isCatalogSyncEnabled } from '../common/utils/catalog-sync';
 import { normalizeProviderName, type ModelCapability, type ModelModality } from 'manifest-shared';
 import { PROVIDER_BY_ID_OR_ALIAS } from '../common/constants/providers';
 import {
@@ -283,6 +284,12 @@ export class ModelsDevSyncService implements OnModuleInit {
   private initialLoad: Promise<void> | null = null;
 
   onModuleInit(): void {
+    if (!isCatalogSyncEnabled()) {
+      this.logger.log(
+        `${CATALOG_SYNC_ENV}=false: models.dev sync disabled, using bundled data only`,
+      );
+      return;
+    }
     // Fire-and-forget so a slow models.dev fetch can't delay app.listen() and
     // trip Railway's healthcheck (see #1894). ModelPricingCacheService awaits
     // whenInitialized() before its first reload so warmup still sees data.
@@ -300,6 +307,8 @@ export class ModelsDevSyncService implements OnModuleInit {
 
   @Cron(CronExpression.EVERY_DAY_AT_4AM)
   async refreshCache(): Promise<number> {
+    // Gates the boot fetch, the daily cron and the manual model refresh.
+    if (!isCatalogSyncEnabled()) return 0;
     this.logger.log('Refreshing models.dev cache...');
     const raw = await this.fetchModelsDevData();
     if (!raw) return 0;
diff --git a/packages/backend/src/database/pricing-sync.service.spec.ts b/packages/backend/src/database/pricing-sync.service.spec.ts
index 2cbb441f..a0a87931 100644
--- a/packages/backend/src/database/pricing-sync.service.spec.ts
+++ b/packages/backend/src/database/pricing-sync.service.spec.ts
@@ -14,6 +14,30 @@ describe('PricingSyncService', () => {
     fetchSpy.mockRestore();
   });
 
+  describe('THINKER_CATALOG_SYNC=false', () => {
+    const previous = process.env['THINKER_CATALOG_SYNC'];
+    beforeEach(() => {
+      process.env['THINKER_CATALOG_SYNC'] = 'false';
+    });
+    afterEach(() => {
+      if (previous === undefined) delete process.env['THINKER_CATALOG_SYNC'];
+      else process.env['THINKER_CATALOG_SYNC'] = previous;
+    });
+
+    it('skips the boot fetch and resolves whenInitialized() at once', async () => {
+      service.onModuleInit();
+      await service.whenInitialized();
+      expect(fetchSpy).not.toHaveBeenCalled();
+      expect(service.getAll().size).toBe(0);
+      expect(service.getLastFetchedAt()).toBeNull();
+    });
+
+    it('makes the cron and the refresh endpoint a no-op', async () => {
+      await expect(service.refreshCache()).resolves.toBe(0);
+      expect(fetchSpy).not.toHaveBeenCalled();
+    });
+  });
+
   describe('onModuleInit', () => {
     it('kicks off refreshCache without blocking and populates the cache', async () => {
       fetchSpy.mockResolvedValue({
diff --git a/packages/backend/src/database/pricing-sync.service.ts b/packages/backend/src/database/pricing-sync.service.ts
index c303d63d..316881cc 100644
--- a/packages/backend/src/database/pricing-sync.service.ts
+++ b/packages/backend/src/database/pricing-sync.service.ts
@@ -1,5 +1,6 @@
 import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
 import { Cron, CronExpression } from '@nestjs/schedule';
+import { CATALOG_SYNC_ENV, isCatalogSyncEnabled } from '../common/utils/catalog-sync';
 
 interface OpenRouterModel {
   id: string;
@@ -37,6 +38,12 @@ export class PricingSyncService implements OnModuleInit {
   private initialLoad: Promise<void> | null = null;
 
   onModuleInit(): void {
+    if (!isCatalogSyncEnabled()) {
+      this.logger.log(
+        `${CATALOG_SYNC_ENV}=false: OpenRouter pricing sync disabled, using bundled data only`,
+      );
+      return;
+    }
     // Kick off the startup fetch WITHOUT blocking boot. A slow or unreachable
     // OpenRouter previously stalled app.listen() — and with it Railway's
     // healthcheck — for up to undici's default header timeout (see #1894).
@@ -57,6 +64,8 @@ export class PricingSyncService implements OnModuleInit {
 
   @Cron(CronExpression.EVERY_DAY_AT_3AM)
   async refreshCache(): Promise<number> {
+    // Gates the boot fetch, the daily cron and POST /routing/pricing/refresh.
+    if (!isCatalogSyncEnabled()) return 0;
     this.logger.log('Refreshing OpenRouter pricing cache...');
     const data = await this.fetchOpenRouterModels();
     if (!data) return 0;
diff --git a/packages/backend/src/mcp/tools/routing.tools.ts b/packages/backend/src/mcp/tools/routing.tools.ts
index a9d54274..652cbadb 100644
--- a/packages/backend/src/mcp/tools/routing.tools.ts
+++ b/packages/backend/src/mcp/tools/routing.tools.ts
@@ -5,6 +5,7 @@ import { authOrigin } from '../../auth/auth.instance';
 import { McpOperator, MCP_WRITE_SCOPE } from '../mcp-auth';
 import { McpToolDeps } from '../tool-deps';
 import { result } from '../tool-result';
+import { isCatalogSyncEnabled } from '../../common/utils/catalog-sync';
 import {
   describeUnresolvedModel,
   matchesModelName,
@@ -111,7 +112,9 @@ export function registerRoutingTools(
           const agent = await deps.resolveAgent.resolve(operator.tenantId, agentName);
           const providers = await deps.providers.getProviders(agent.tenant_id);
           if (providers.length === 0) return { enabled: false, reason: 'no_provider' };
-          if (deps.pricingSync.getAll().size === 0)
+          // Empty by design with THINKER_CATALOG_SYNC=false, which does not
+          // stop routing.
+          if (isCatalogSyncEnabled() && deps.pricingSync.getAll().size === 0)
             return { enabled: false, reason: 'pricing_cache_empty' };
           const routable = await deps.tiers.hasRoutableTier(agent.id);
           return { enabled: routable, reason: routable ? null : 'no_routable_models' };
diff --git a/packages/backend/src/mcp/tools/tools.spec.ts b/packages/backend/src/mcp/tools/tools.spec.ts
index d7b578da..a9be3443 100644
--- a/packages/backend/src/mcp/tools/tools.spec.ts
+++ b/packages/backend/src/mcp/tools/tools.spec.ts
@@ -528,6 +528,19 @@ describe('MCP tools', () => {
         (await call(registerAll(noPricing), 'manifest_routing_status', { agent: 'demo' })).data,
       ).toMatchObject({ reason: 'pricing_cache_empty' });
 
+      // With THINKER_CATALOG_SYNC=false the cache is empty by design and does
+      // not stop routing.
+      const previous = process.env['THINKER_CATALOG_SYNC'];
+      process.env['THINKER_CATALOG_SYNC'] = 'false';
+      try {
+        expect(
+          (await call(registerAll(noPricing), 'manifest_routing_status', { agent: 'demo' })).data,
+        ).toMatchObject({ enabled: true, reason: null });
+      } finally {
+        if (previous === undefined) delete process.env['THINKER_CATALOG_SYNC'];
+        else process.env['THINKER_CATALOG_SYNC'] = previous;
+      }
+
       const notRoutable = makeDeps();
       (notRoutable.tiers.hasRoutableTier as jest.Mock).mockResolvedValue(false);
       expect(
diff --git a/packages/backend/src/model-discovery/opencode-go-catalog.service.gate.spec.ts b/packages/backend/src/model-discovery/opencode-go-catalog.service.gate.spec.ts
new file mode 100644
index 00000000..2810cb09
--- /dev/null
+++ b/packages/backend/src/model-discovery/opencode-go-catalog.service.gate.spec.ts
@@ -0,0 +1,120 @@
+/**
+ * #39 / ADR 0003: the OpenCode Go doc lives on raw.githubusercontent.com, so it
+ * is fetched only when an OpenCode Go provider is registered, and never with
+ * THINKER_CATALOG_SYNC=false.
+ */
+import { OpencodeGoCatalogService } from './opencode-go-catalog.service';
+
+const MDX = [
+  '| Model | Model ID | Endpoint | AI SDK package |',
+  '| ----- | -------- | -------- | -------------- |',
+  '| GLM-5.1 | glm-5.1 | `https://opencode.ai/zen/go/v1/chat/completions` | `@ai-sdk/openai-compatible` |',
+  '',
+].join('\n');
+
+function providerRepo(count: number | Error) {
+  const where = jest.fn(() => ({
+    getCount: async () => {
+      if (count instanceof Error) throw count;
+      return count;
+    },
+  }));
+  return {
+    repo: { createQueryBuilder: jest.fn(() => ({ where })) },
+    where,
+  };
+}
+
+const flush = () => new Promise((resolve) => setImmediate(resolve));
+
+describe('OpencodeGoCatalogService egress gate', () => {
+  let fetchSpy: jest.SpyInstance;
+  const previous = process.env['THINKER_CATALOG_SYNC'];
+
+  beforeEach(() => {
+    delete process.env['THINKER_CATALOG_SYNC'];
+    fetchSpy = jest.spyOn(global, 'fetch').mockResolvedValue({
+      ok: true,
+      status: 200,
+      text: async () => MDX,
+    } as Response);
+  });
+
+  afterEach(() => {
+    fetchSpy.mockRestore();
+    if (previous === undefined) delete process.env['THINKER_CATALOG_SYNC'];
+    else process.env['THINKER_CATALOG_SYNC'] = previous;
+  });
+
+  describe('boot warmup', () => {
+    it('does not fetch when no OpenCode Go provider is registered', async () => {
+      const { repo } = providerRepo(0);
+      new OpencodeGoCatalogService(repo as never).onModuleInit();
+      await flush();
+      expect(repo.createQueryBuilder).toHaveBeenCalled();
+      expect(fetchSpy).not.toHaveBeenCalled();
+    });
+
+    it('fetches once when an OpenCode Go provider is registered', async () => {
+      const { repo, where } = providerRepo(1);
+      const service = new OpencodeGoCatalogService(repo as never);
+      service.onModuleInit();
+      await flush();
+      expect(fetchSpy).toHaveBeenCalledTimes(1);
+      expect(String(fetchSpy.mock.calls[0][0])).toContain('raw.githubusercontent.com');
+      expect(service.getFormat('glm-5.1')).toBe('openai');
+      // Matches the registry id and its aliases, case-insensitively.
+      expect(where).toHaveBeenCalledWith('LOWER(p.provider) IN (:...keys)', {
+        keys: expect.arrayContaining(['opencode-go', 'opencodego']),
+      });
+    });
+
+    it('does not fetch without a repository to check', async () => {
+      new OpencodeGoCatalogService().onModuleInit();
+      await flush();
+      expect(fetchSpy).not.toHaveBeenCalled();
+    });
+
+    it('does not fetch when the provider lookup fails', async () => {
+      const { repo } = providerRepo(new Error('relation "tenant_providers" does not exist'));
+      new OpencodeGoCatalogService(repo as never).onModuleInit();
+      await flush();
+      expect(fetchSpy).not.toHaveBeenCalled();
+    });
+
+    it('neither queries nor fetches with THINKER_CATALOG_SYNC=false, even with a provider', async () => {
+      process.env['THINKER_CATALOG_SYNC'] = 'false';
+      const { repo } = providerRepo(1);
+      new OpencodeGoCatalogService(repo as never).onModuleInit();
+      await flush();
+      expect(repo.createQueryBuilder).not.toHaveBeenCalled();
+      expect(fetchSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('THINKER_CATALOG_SYNC=false', () => {
+    beforeEach(() => {
+      process.env['THINKER_CATALOG_SYNC'] = 'false';
+    });
+
+    it('list() and refresh() return [] without fetching', async () => {
+      const service = new OpencodeGoCatalogService();
+      await expect(service.list()).resolves.toEqual([]);
+      await expect(service.refresh()).resolves.toEqual([]);
+      expect(fetchSpy).not.toHaveBeenCalled();
+    });
+
+    it('prices OpenCode Go requests as unknown and leaves the format to the caller heuristic', async () => {
+      const service = new OpencodeGoCatalogService();
+      await expect(service.resolveCostPerRequest('opencode-go/glm-5.1')).resolves.toBeNull();
+      await expect(service.resolveFormat('glm-5.1')).resolves.toBeNull();
+      expect(fetchSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  it('fetches lazily on first use when sync is on (the path a new provider takes)', async () => {
+    const service = new OpencodeGoCatalogService();
+    await expect(service.resolveFormat('glm-5.1')).resolves.toBe('openai');
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/packages/backend/src/model-discovery/opencode-go-catalog.service.spec.ts b/packages/backend/src/model-discovery/opencode-go-catalog.service.spec.ts
index f6d2fedc..61c3473f 100644
--- a/packages/backend/src/model-discovery/opencode-go-catalog.service.spec.ts
+++ b/packages/backend/src/model-discovery/opencode-go-catalog.service.spec.ts
@@ -349,6 +349,13 @@ describe('OpencodeGoCatalogService', () => {
         status: 200,
         text: async () => SAMPLE_MDX,
       } as Response);
+      // The warmup only runs when an OpenCode Go provider is registered.
+      const providerRepo = {
+        createQueryBuilder: () => ({
+          where: () => ({ getCount: async () => 1 }),
+        }),
+      };
+      service = new OpencodeGoCatalogService(providerRepo as never);
       service.onModuleInit();
       // onModuleInit is fire-and-forget; flush the pending list() promise.
       await new Promise((r) => setImmediate(r));
diff --git a/packages/backend/src/model-discovery/opencode-go-catalog.service.ts b/packages/backend/src/model-discovery/opencode-go-catalog.service.ts
index 0ac7ae12..b4c3fa87 100644
--- a/packages/backend/src/model-discovery/opencode-go-catalog.service.ts
+++ b/packages/backend/src/model-discovery/opencode-go-catalog.service.ts
@@ -1,4 +1,9 @@
-import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+import { Inject, Injectable, Logger, OnModuleInit, Optional } from '@nestjs/common';
+import { getRepositoryToken } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { PROVIDER_BY_ID } from '../common/constants/providers';
+import { CATALOG_SYNC_ENV, isCatalogSyncEnabled } from '../common/utils/catalog-sync';
+import { TenantProvider } from '../entities/tenant-provider.entity';
 
 export interface OpencodeGoCatalogEntry {
   /** Bare model ID as listed in the docs (e.g. "glm-5.1"). */
@@ -23,6 +28,15 @@ const CACHE_TTL_MS = 60 * 60 * 1000;
 const ERROR_BACKOFF_MS = 5 * 60 * 1000;
 const FETCH_TIMEOUT_MS = 10_000;
 
+/**
+ * Every spelling a `tenant_providers.provider` row can carry for OpenCode Go
+ * (the registry id plus its aliases), lowercased.
+ */
+const OPENCODE_GO_PROVIDER_KEYS: readonly string[] = [
+  'opencode-go',
+  ...(PROVIDER_BY_ID.get('opencode-go')?.aliases ?? []),
+].map((key) => key.toLowerCase());
+
 /**
  * Published 5-hour quota in USD for an OpenCode Go subscription. The docs
  * express per-model usage as "requests per 5 hour", so dividing that dollar
@@ -39,6 +53,14 @@ export const OPENCODE_GO_BUDGET_5H_USD = 12;
  * in the markdown docs file the website renders from. We parse the
  * Endpoints table (for model IDs + API format) and the Usage Limits
  * table (for per-request cost) and cache the merged result in memory.
+ *
+ * ADR 0003: the doc lives on raw.githubusercontent.com, so it is fetched only
+ * for an instance that has an OpenCode Go provider registered, and never with
+ * `THINKER_CATALOG_SYNC=false`. Every caller of `list()` / `refresh()` /
+ * `resolve*()` other than the boot warmup is already scoped to an OpenCode Go
+ * provider (its discovery, its proxied requests, its models in the picker), so
+ * the boot warmup is the only path that has to check the database itself.
+ * Registering a provider runs its discovery, which loads the doc lazily.
  */
 @Injectable()
 export class OpencodeGoCatalogService implements OnModuleInit {
@@ -55,6 +77,12 @@ export class OpencodeGoCatalogService implements OnModuleInit {
    */
   private inflight: Promise<OpencodeGoCatalogEntry[]> | null = null;
 
+  constructor(
+    @Optional()
+    @Inject(getRepositoryToken(TenantProvider))
+    private readonly providerRepo: Repository<TenantProvider> | null = null,
+  ) {}
+
   /**
    * Warm the catalog in the background at boot so the per-request cost index
    * is populated before the proxy hot path runs. Discovery typically warms it
@@ -62,14 +90,50 @@ export class OpencodeGoCatalogService implements OnModuleInit {
    * against an empty index — the recorder treats a missing entry as $0,
    * which is the original bug. Fire-and-forget; failures fall through to the
    * existing fetch-on-demand path in `list()`.
+   *
+   * Skipped unless an OpenCode Go provider is registered (ADR 0003), so a
+   * default instance never reaches raw.githubusercontent.com at boot.
    */
   onModuleInit(): void {
-    void this.list().catch(() => {
+    void this.warmIfProviderRegistered().catch(() => {
       // `list()` already logs failures and arms the error-backoff window.
     });
   }
 
+  private async warmIfProviderRegistered(): Promise<void> {
+    if (!isCatalogSyncEnabled()) return;
+    if (!(await this.hasOpencodeGoProvider())) return;
+    await this.list();
+  }
+
+  /**
+   * Whether any tenant has an OpenCode Go provider registered, active or not.
+   * Without a repository (unit tests that build the service by hand) or when
+   * the lookup fails, answers false: a skipped warmup only delays the doc to
+   * its first real use, while a wrong true is an outbound call nobody needed.
+   */
+  private async hasOpencodeGoProvider(): Promise<boolean> {
+    if (!this.providerRepo) return false;
+    try {
+      const count = await this.providerRepo
+        .createQueryBuilder('p')
+        .where('LOWER(p.provider) IN (:...keys)', { keys: OPENCODE_GO_PROVIDER_KEYS })
+        .getCount();
+      return count > 0;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.logger.warn(`Could not check for OpenCode Go providers, skipping warmup: ${message}`);
+      return false;
+    }
+  }
+
+  /**
+   * The cached catalog, fetching it when the cache is cold or expired. Empty,
+   * without a fetch, when `THINKER_CATALOG_SYNC=false`: callers then price
+   * OpenCode Go requests at $0 and pick the API format from the model family.
+   */
   async list(): Promise<OpencodeGoCatalogEntry[]> {
+    if (!isCatalogSyncEnabled()) return [];
     const now = Date.now();
     if (this.cache && this.cache.expiresAt > now) {
       return this.cache.entries;
@@ -88,6 +152,10 @@ export class OpencodeGoCatalogService implements OnModuleInit {
    * models without restarting the backend.
    */
   async refresh(): Promise<OpencodeGoCatalogEntry[]> {
+    if (!isCatalogSyncEnabled()) {
+      this.logger.log(`${CATALOG_SYNC_ENV}=false: OpenCode Go docs catalog not fetched`);
+      return [];
+    }
     return this.startFetch(Date.now());
   }
 
diff --git a/packages/backend/src/routing/model.controller.spec.ts b/packages/backend/src/routing/model.controller.spec.ts
index 89cdb54f..4893ab58 100644
--- a/packages/backend/src/routing/model.controller.spec.ts
+++ b/packages/backend/src/routing/model.controller.spec.ts
@@ -123,6 +123,7 @@ describe('ModelController', () => {
       expect(result).toEqual({
         model_count: 2,
         last_fetched_at: '2026-04-12T10:00:00.000Z',
+        sync_enabled: true,
       });
     });
 
@@ -132,7 +133,24 @@ describe('ModelController', () => {
 
       const result = controller.pricingHealth();
 
-      expect(result).toEqual({ model_count: 0, last_fetched_at: null });
+      expect(result).toEqual({ model_count: 0, last_fetched_at: null, sync_enabled: true });
+    });
+
+    it('reports sync_enabled: false when THINKER_CATALOG_SYNC=false', () => {
+      const previous = process.env['THINKER_CATALOG_SYNC'];
+      process.env['THINKER_CATALOG_SYNC'] = 'false';
+      try {
+        mockPricingSync.getAll.mockReturnValue(new Map());
+        mockPricingSync.getLastFetchedAt.mockReturnValue(null);
+        expect(controller.pricingHealth()).toEqual({
+          model_count: 0,
+          last_fetched_at: null,
+          sync_enabled: false,
+        });
+      } finally {
+        if (previous === undefined) delete process.env['THINKER_CATALOG_SYNC'];
+        else process.env['THINKER_CATALOG_SYNC'] = previous;
+      }
     });
   });
 
@@ -150,6 +168,7 @@ describe('ModelController', () => {
         ok: true,
         model_count: 150,
         last_fetched_at: '2026-04-13T12:00:00.000Z',
+        sync_enabled: true,
       });
     });
 
@@ -159,7 +178,12 @@ describe('ModelController', () => {
 
       const result = await controller.refreshPricing();
 
-      expect(result).toEqual({ ok: false, model_count: 0, last_fetched_at: null });
+      expect(result).toEqual({
+        ok: false,
+        model_count: 0,
+        last_fetched_at: null,
+        sync_enabled: true,
+      });
     });
   });
 
diff --git a/packages/backend/src/routing/model.controller.ts b/packages/backend/src/routing/model.controller.ts
index 02bc04e6..cc3587e8 100644
--- a/packages/backend/src/routing/model.controller.ts
+++ b/packages/backend/src/routing/model.controller.ts
@@ -9,6 +9,7 @@ import { OllamaSyncService } from '../database/ollama-sync.service';
 import { PricingSyncService } from '../database/pricing-sync.service';
 import { ModelsDevSyncService } from '../database/models-dev-sync.service';
 import { RoutingCacheService } from './routing-core/routing-cache.service';
+import { isCatalogSyncEnabled } from '../common/utils/catalog-sync';
 import { resolveProviderMetadataIdentity } from 'manifest-shared';
 import {
   inputModalitiesFromCapabilities,
@@ -76,16 +77,19 @@ export class ModelController {
     return {
       model_count: this.pricingSync.getAll().size,
       last_fetched_at: this.pricingSync.getLastFetchedAt()?.toISOString() ?? null,
+      sync_enabled: isCatalogSyncEnabled(),
     };
   }
 
   @Post('pricing/refresh')
   async refreshPricing() {
+    // With THINKER_CATALOG_SYNC=false this reaches nothing and reports ok: false.
     const modelCount = await this.pricingSync.refreshCache();
     return {
       ok: modelCount > 0,
       model_count: modelCount,
       last_fetched_at: this.pricingSync.getLastFetchedAt()?.toISOString() ?? null,
+      sync_enabled: isCatalogSyncEnabled(),
     };
   }
 
diff --git a/packages/backend/src/routing/provider.controller.spec.ts b/packages/backend/src/routing/provider.controller.spec.ts
index 98add012..4542dca3 100644
--- a/packages/backend/src/routing/provider.controller.spec.ts
+++ b/packages/backend/src/routing/provider.controller.spec.ts
@@ -244,6 +244,24 @@ describe('ProviderController', () => {
       const result = await controller.getStatus(mockCtx, mockAgentName);
       expect(result).toEqual({ enabled: false, reason: 'pricing_cache_empty' });
     });
+
+    it('does not blame the empty pricing cache when THINKER_CATALOG_SYNC=false', async () => {
+      const previous = process.env['THINKER_CATALOG_SYNC'];
+      process.env['THINKER_CATALOG_SYNC'] = 'false';
+      try {
+        mockProviderService.getProviders.mockResolvedValue([
+          { id: 'p1', provider: 'openai', is_active: true },
+        ]);
+        mockTierService.hasRoutableTier.mockResolvedValue(false);
+        mockPricingSync.getAll.mockReturnValue(new Map());
+
+        const result = await controller.getStatus(mockCtx, mockAgentName);
+        expect(result).toEqual({ enabled: false, reason: 'no_routable_models' });
+      } finally {
+        if (previous === undefined) delete process.env['THINKER_CATALOG_SYNC'];
+        else process.env['THINKER_CATALOG_SYNC'] = previous;
+      }
+    });
   });
 
   /* ── getProviders ── */
diff --git a/packages/backend/src/routing/provider.controller.ts b/packages/backend/src/routing/provider.controller.ts
index 65891bfa..f04f7426 100644
--- a/packages/backend/src/routing/provider.controller.ts
+++ b/packages/backend/src/routing/provider.controller.ts
@@ -18,6 +18,7 @@ import { TenantCtx, TenantContext } from '../common/decorators/tenant-context.de
 import { ProviderService } from './routing-core/provider.service';
 import { CustomProviderService } from './custom-provider/custom-provider.service';
 import { ResolveAgentService } from './routing-core/resolve-agent.service';
+import { isCatalogSyncEnabled } from '../common/utils/catalog-sync';
 import { TierService } from './routing-core/tier.service';
 import { ModelDiscoveryService } from '../model-discovery/model-discovery.service';
 import { OllamaSyncService } from '../database/ollama-sync.service';
@@ -92,7 +93,9 @@ export class ProviderController {
     if (!hasRoutableTier) {
       // No tier resolves to a model. If the OpenRouter pricing cache is empty
       // (e.g. first-boot fetch failed), surface that as a more actionable hint.
-      const pricingCacheEmpty = this.pricingSync.getAll().size === 0;
+      // With THINKER_CATALOG_SYNC=false the cache is empty by design, so the
+      // hint would point at the wrong cause.
+      const pricingCacheEmpty = isCatalogSyncEnabled() && this.pricingSync.getAll().size === 0;
       return {
         enabled: false,
         reason: pricingCacheEmpty
diff --git a/packages/backend/test/no-phonehome-egress.e2e-spec.ts b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
index 4c8c69f5..8f132876 100644
--- a/packages/backend/test/no-phonehome-egress.e2e-spec.ts
+++ b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
@@ -7,6 +7,8 @@
  *
  * The only outbound catalog destinations allowed are the ones in ADR 0003
  * (openrouter.ai, models.dev, and raw.githubusercontent.com for OpenCode Go).
+ * #39 tightens that: the OpenCode Go doc is fetched only when an OpenCode Go
+ * provider is registered, and THINKER_CATALOG_SYNC=false silences all three.
  */
 import { spawn, type ChildProcess } from 'child_process';
 import { mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'fs';
@@ -39,11 +41,8 @@ const BACKEND_HOSTED_GATEWAY_LEFTOVERS = [
   'backend/src/common/utils/dashboard-url.ts',
   'backend/src/common/utils/og-rewrite.ts',
 ];
-const ADR_0003_CATALOG_HOSTS = new Set([
-  'openrouter.ai',
-  'models.dev',
-  'raw.githubusercontent.com',
-]);
+const OPENCODE_GO_DOC_HOST = 'raw.githubusercontent.com';
+const ADR_0003_CATALOG_HOSTS = new Set(['openrouter.ai', 'models.dev', OPENCODE_GO_DOC_HOST]);
 const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
 
 const BACKEND = join(__dirname, '..');
@@ -102,10 +101,114 @@ async function waitForHealth(base: string, child: ChildProcess, output: () => st
 }
 
 interface EgressRecord {
-  kind: 'fetch' | 'dns';
+  kind: 'boot' | 'fetch' | 'dns';
   target: string;
 }
 
+const DATABASE_URL =
+  process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase';
+
+/** Hostnames of the remote (non-loopback) fetches in a run. */
+function remoteFetchHosts(records: EgressRecord[]): string[] {
+  return records
+    .filter((record) => record.kind === 'fetch')
+    .map((record) => new URL(record.target).hostname)
+    .filter((host) => !LOCAL_HOSTS.has(host));
+}
+
+async function withDatabase(run: (db: DataSource) => Promise<void>, dropSchema = false) {
+  const db = new DataSource({ type: 'postgres', url: DATABASE_URL, dropSchema });
+  await db.initialize();
+  try {
+    await run(db);
+  } finally {
+    await db.destroy();
+  }
+}
+
+interface BootedServer {
+  base: string;
+  output: () => string;
+  records: EgressRecord[];
+  stop: () => Promise<void>;
+}
+
+/**
+ * Boots the real server (`src/main.ts`, every module of AppModule) in its own
+ * process, in production mode and with none of upstream's opt-out variables,
+ * with `test/support/egress-recorder.cjs` preloaded to record every fetch and
+ * DNS lookup while keeping the process off the network. Returns what it
+ * recorded once health passed and the fire-and-forget boot work had started.
+ */
+async function bootServer(extraEnv: NodeJS.ProcessEnv = {}): Promise<BootedServer> {
+  const workDir = mkdtempSync(join(tmpdir(), 'thinker-egress-'));
+  const egressLog = join(workDir, 'egress.jsonl');
+  writeFileSync(egressLog, '');
+  const port = await freePort();
+  const base = `http://127.0.0.1:${port}`;
+
+  const env: NodeJS.ProcessEnv = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (
+      !/TELEMETRY|UPDATE_CHECK|DISCOVERY|SENTRY|MODELPARAMS|WINGMAN|EMBEDDED|CATALOG_SYNC/.test(key)
+    ) {
+      env[key] = value;
+    }
+  }
+  Object.assign(env, {
+    NODE_ENV: 'production',
+    DATABASE_URL,
+    PORT: String(port),
+    BIND_ADDRESS: '127.0.0.1',
+    BETTER_AUTH_URL: base,
+    BETTER_AUTH_SECRET:
+      process.env['BETTER_AUTH_SECRET'] ?? 'test-secret-for-e2e-at-least-32chars!!',
+    SHUTDOWN_DRAIN_MS: '0',
+    EGRESS_LOG: egressLog,
+    ...extraEnv,
+  });
+
+  let output = '';
+  const child: ChildProcess = spawn(
+    process.execPath,
+    [
+      '-r',
+      require.resolve('ts-node/register/transpile-only'),
+      '-r',
+      join(__dirname, 'support', 'egress-recorder.cjs'),
+      join('src', 'main.ts'),
+    ],
+    { cwd: BACKEND, env, stdio: ['ignore', 'pipe', 'pipe'] },
+  );
+  child.stdout?.on('data', (chunk: Buffer) => (output += chunk.toString()));
+  child.stderr?.on('data', (chunk: Buffer) => (output += chunk.toString()));
+
+  const stop = async () => {
+    if (child.exitCode === null) {
+      const exited = new Promise((resolve) => child.once('exit', resolve));
+      child.kill('SIGTERM');
+      const timer = setTimeout(() => child.kill('SIGKILL'), 10_000);
+      await exited;
+      clearTimeout(timer);
+    }
+    rmSync(workDir, { recursive: true, force: true });
+  };
+
+  try {
+    await waitForHealth(base, child, () => output);
+    // Let fire-and-forget onModuleInit / onApplicationBootstrap work start.
+    await new Promise((resolve) => setTimeout(resolve, 3000));
+  } catch (err) {
+    await stop();
+    throw err;
+  }
+  const records = readFileSync(egressLog, 'utf8')
+    .split('\n')
+    .filter((line) => line.length > 0)
+    .map((line) => JSON.parse(line) as EgressRecord);
+  return { base, output: () => output, records, stop };
+}
+
 describe('no phone-home egress', () => {
   it.each(FORBIDDEN_DESTINATIONS)(
     'names %s nowhere in the backend, CLI or shared source',
@@ -150,92 +253,31 @@ describe('no phone-home egress', () => {
   });
 
   /**
-   * Boots the real server (`src/main.ts`, every module of AppModule) in its own
-   * process, in production mode and with none of upstream's opt-out variables,
-   * with `test/support/egress-recorder.cjs` preloaded to record every fetch and
-   * DNS lookup while keeping the process off the network.
+   * Each block boots the real server against the same database, in order: the
+   * first starts from an empty schema (the server migrates on boot), and the
+   * later ones register an OpenCode Go provider in it.
    */
   describe('at boot (production mode, no opt-out variable)', () => {
-    let child: ChildProcess | undefined;
-    let workDir: string;
-    let base: string;
-    let output = '';
-    let records: EgressRecord[] = [];
+    let server: BootedServer | undefined;
 
     beforeAll(async () => {
-      const databaseUrl =
-        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase';
       // Start from an empty schema: the real server migrates on boot, and
       // earlier suites leave a synchronize()-built schema behind.
-      const reset = new DataSource({ type: 'postgres', url: databaseUrl, dropSchema: true });
-      await reset.initialize();
-      await reset.destroy();
-
-      workDir = mkdtempSync(join(tmpdir(), 'thinker-egress-'));
-      const egressLog = join(workDir, 'egress.jsonl');
-      writeFileSync(egressLog, '');
-      const port = await freePort();
-      base = `http://127.0.0.1:${port}`;
-
-      const env: NodeJS.ProcessEnv = {};
-      for (const [key, value] of Object.entries(process.env)) {
-        if (!/TELEMETRY|UPDATE_CHECK|DISCOVERY|SENTRY|MODELPARAMS|WINGMAN|EMBEDDED/.test(key)) {
-          env[key] = value;
-        }
-      }
-      Object.assign(env, {
-        NODE_ENV: 'production',
-        DATABASE_URL: databaseUrl,
-        PORT: String(port),
-        BIND_ADDRESS: '127.0.0.1',
-        BETTER_AUTH_URL: base,
-        BETTER_AUTH_SECRET:
-          process.env['BETTER_AUTH_SECRET'] ?? 'test-secret-for-e2e-at-least-32chars!!',
-        SHUTDOWN_DRAIN_MS: '0',
-        EGRESS_LOG: egressLog,
-      });
-
-      child = spawn(
-        process.execPath,
-        [
-          '-r',
-          require.resolve('ts-node/register/transpile-only'),
-          '-r',
-          join(__dirname, 'support', 'egress-recorder.cjs'),
-          join('src', 'main.ts'),
-        ],
-        { cwd: BACKEND, env, stdio: ['ignore', 'pipe', 'pipe'] },
-      );
-      child.stdout?.on('data', (chunk: Buffer) => (output += chunk.toString()));
-      child.stderr?.on('data', (chunk: Buffer) => (output += chunk.toString()));
-
-      await waitForHealth(base, child, () => output);
-      // Let fire-and-forget onModuleInit / onApplicationBootstrap work start.
-      await new Promise((resolve) => setTimeout(resolve, 3000));
-      records = readFileSync(egressLog, 'utf8')
-        .split('\n')
-        .filter((line) => line.length > 0)
-        .map((line) => JSON.parse(line) as EgressRecord);
+      await withDatabase(async () => undefined, true);
+      server = await bootServer();
     }, 180_000);
 
     afterAll(async () => {
-      if (child && child.exitCode === null) {
-        const exited = new Promise((resolve) => child!.once('exit', resolve));
-        child.kill('SIGTERM');
-        const timer = setTimeout(() => child!.kill('SIGKILL'), 10_000);
-        await exited;
-        clearTimeout(timer);
-      }
-      if (workDir) rmSync(workDir, { recursive: true, force: true });
+      await server?.stop();
     }, 30_000);
 
     it('boots and runs the egress recorder', () => {
-      expect(output).toContain('Server running on');
-      expect(records.length).toBeGreaterThan(0);
+      expect(server!.output()).toContain('Server running on');
+      expect(server!.records.some((record) => record.kind === 'boot')).toBe(true);
     });
 
     it('makes no request to a phone-home destination', () => {
-      const offenders = records.filter((record) =>
+      const offenders = server!.records.filter((record) =>
         [...FORBIDDEN_DESTINATIONS, ...HOSTED_GATEWAY_HOSTS].some((destination) =>
           record.target.includes(destination),
         ),
@@ -244,15 +286,22 @@ describe('no phone-home egress', () => {
     });
 
     it('fetches nothing outside the ADR 0003 catalogs', () => {
-      const remote = records
-        .filter((record) => record.kind === 'fetch')
-        .map((record) => new URL(record.target).hostname)
-        .filter((host) => !LOCAL_HOSTS.has(host));
+      const remote = remoteFetchHosts(server!.records);
       expect(remote.filter((host) => !ADR_0003_CATALOG_HOSTS.has(host))).toEqual([]);
     });
 
+    it('syncs the OpenRouter and models.dev catalogs by default', () => {
+      const remote = new Set(remoteFetchHosts(server!.records));
+      expect(remote.has('openrouter.ai')).toBe(true);
+      expect(remote.has('models.dev')).toBe(true);
+    });
+
+    it('does not fetch the OpenCode Go doc without an OpenCode Go provider', () => {
+      expect(remoteFetchHosts(server!.records)).not.toContain(OPENCODE_GO_DOC_HOST);
+    });
+
     it('resolves no remote hostname, so nothing bypasses fetch to reach the network', () => {
-      const remote = records
+      const remote = server!.records
         .filter((record) => record.kind === 'dns')
         .map((record) => record.target)
         .filter((host) => !LOCAL_HOSTS.has(host));
@@ -260,8 +309,8 @@ describe('no phone-home egress', () => {
     });
 
     it('no longer serves the update-check or discovery routes', async () => {
-      const version = await fetch(`${base}/api/v1/version`);
-      const discovery = await fetch(`${base}/api/v1/discovery/complete`, {
+      const version = await fetch(`${server!.base}/api/v1/version`);
+      const discovery = await fetch(`${server!.base}/api/v1/discovery/complete`, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
         body: '{}',
@@ -270,4 +319,60 @@ describe('no phone-home egress', () => {
       expect(discovery.status).toBe(404);
     });
   });
+
+  describe('with an OpenCode Go provider registered', () => {
+    beforeAll(async () => {
+      // The schema exists: the boot above migrated it.
+      await withDatabase(async (db) => {
+        await db.query(
+          `INSERT INTO tenants (id, name) VALUES ('egress-tenant', 'egress-tenant')
+           ON CONFLICT (id) DO NOTHING`,
+        );
+        await db.query(
+          `INSERT INTO tenant_providers (id, tenant_id, provider, auth_type, label)
+           VALUES ('egress-opencode-go', 'egress-tenant', 'opencode-go', 'api_key', 'Default')
+           ON CONFLICT (id) DO NOTHING`,
+        );
+      });
+    }, 30_000);
+
+    describe('and THINKER_CATALOG_SYNC=false', () => {
+      let server: BootedServer | undefined;
+
+      beforeAll(async () => {
+        server = await bootServer({ THINKER_CATALOG_SYNC: 'false' });
+      }, 180_000);
+
+      afterAll(async () => {
+        await server?.stop();
+      }, 30_000);
+
+      it('boots and runs the egress recorder', () => {
+        expect(server!.output()).toContain('Server running on');
+        expect(server!.records.some((record) => record.kind === 'boot')).toBe(true);
+      });
+
+      it('fetches no catalog at all, nor anything else remote', () => {
+        expect(remoteFetchHosts(server!.records)).toEqual([]);
+      });
+    });
+
+    describe('and catalog sync on (default)', () => {
+      let server: BootedServer | undefined;
+
+      beforeAll(async () => {
+        server = await bootServer();
+      }, 180_000);
+
+      afterAll(async () => {
+        await server?.stop();
+      }, 30_000);
+
+      it('warms the OpenCode Go doc, and fetches nothing outside the ADR 0003 catalogs', () => {
+        const remote = remoteFetchHosts(server!.records);
+        expect(remote).toContain(OPENCODE_GO_DOC_HOST);
+        expect(remote.filter((host) => !ADR_0003_CATALOG_HOSTS.has(host))).toEqual([]);
+      });
+    });
+  });
 });
diff --git a/packages/backend/test/support/egress-recorder.cjs b/packages/backend/test/support/egress-recorder.cjs
index df519254..7e2472e4 100644
--- a/packages/backend/test/support/egress-recorder.cjs
+++ b/packages/backend/test/support/egress-recorder.cjs
@@ -20,6 +20,9 @@ function record(kind, target) {
   fs.appendFileSync(logFile, JSON.stringify({ kind, target }) + '\n');
 }
 
+// Proves the recorder is loaded even when a run makes no outbound call at all.
+record('boot', String(process.pid));
+
 function notFound(hostname) {
   return Object.assign(new Error(`getaddrinfo ENOTFOUND ${hostname}`), {
     code: 'ENOTFOUND',

From c83d10211f45c4164fd0cf592d5a507cc8884c6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 02:37:35 -0300
Subject: [PATCH 11/17] fix(backend): pin custom-provider connections against
 DNS rebinding

Review of #71 (S1): with allowPrivate now constant for custom providers,
a DNS failure passed validatePublicUrl, and fetch then resolved the name
again with no check. A hostile resolver could answer a public address
(or fail) during validation and 169.254.169.254 at connect time, so the
probe and the forward could reach cloud metadata.

- New common/utils/ssrf-safe-fetch.ts: undici fetch with a shared Agent
  whose connect.lookup resolves once, refuses the connection when any
  answer is a metadata address, and hands the socket only validated
  addresses. Metadata literals and names are refused before any socket.
  A DNS failure fails the request.
- The custom-provider probe and the provider-client forward for
  user-supplied endpoints (requiresSsrfRevalidation) use it.
- validatePublicUrl treats a DNS failure as an error even with
  allowPrivate (a .invalid host is refused).
- S2: block the AWS container credential endpoints 169.254.170.2 (ECS),
  169.254.170.23 and fd00:ec2::23 (EKS Pod Identity).
- N2: classify IMDS embedded in IPv6 (IPv4-compatible, NAT64
  64:ff9b::/96, 6to4, Teredo) as metadata; IPv6 metadata matches any
  textual form.
- undici 6.29.0 becomes a backend dependency (the root override already
  pins undici ^6); Node's built-in fetch cannot take a foreign Agent
  across Node versions, so undici's own fetch is used.

Tests: unit specs for the lookup and the classifier, and an e2e where a
hostname resolves to a public address at validation and to
169.254.169.254 at connect: the probe and the forward are refused and a
listener standing in for the metadata address receives 0 connections
(it receives them when pinning is removed).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docker/DOCKER_README.md                       |   6 +-
 docs/dev/manifest-guide.md                    |  10 +-
 package-lock.json                             |   8 +-
 packages/backend/package.json                 |   1 +
 .../src/common/utils/ssrf-safe-fetch.spec.ts  | 233 ++++++++++++++++++
 .../src/common/utils/ssrf-safe-fetch.ts       | 128 ++++++++++
 .../src/common/utils/url-validation.spec.ts   |  59 ++++-
 .../src/common/utils/url-validation.ts        |  84 ++++---
 .../custom-provider.service.spec.ts           |   9 +
 .../custom-provider.service.ts                |  14 +-
 .../proxy/__tests__/provider-client.spec.ts   |   4 +
 .../__tests__/provider-client.ssrf.spec.ts    |  42 ++++
 .../src/routing/proxy/provider-client.ts      |  43 ++--
 .../custom-provider-dns-rebinding.e2e-spec.ts | 230 +++++++++++++++++
 ...ustom-providers.url-validation.e2e-spec.ts |   7 +
 15 files changed, 814 insertions(+), 64 deletions(-)
 create mode 100644 packages/backend/src/common/utils/ssrf-safe-fetch.spec.ts
 create mode 100644 packages/backend/src/common/utils/ssrf-safe-fetch.ts
 create mode 100644 packages/backend/test/custom-provider-dns-rebinding.e2e-spec.ts

diff --git a/docker/DOCKER_README.md b/docker/DOCKER_README.md
index 86225eb5..0f01e50e 100644
--- a/docker/DOCKER_README.md
+++ b/docker/DOCKER_README.md
@@ -397,8 +397,10 @@ it when it finds `/run/.containerenv`.
 If you run Thinker as one Podman service and your LLM server (llama.cpp,
 Ollama, etc.) as another, point Thinker at the service name on the shared
 network — e.g. `http://llamacpp:8080/v1`. **Add custom provider** accepts
-LAN, loopback and `http://` URLs on any runtime; only cloud metadata
-endpoints (such as `169.254.169.254`) are always refused.
+LAN, loopback and `http://` URLs on any runtime, as long as the hostname
+resolves from inside the Thinker container. Cloud metadata and container
+credential endpoints (such as `169.254.169.254` or `169.254.170.2`) are always
+refused, including when a hostname starts resolving to them after it was saved.
 
 ## Environment variables
 
diff --git a/docs/dev/manifest-guide.md b/docs/dev/manifest-guide.md
index 3163e8e7..61a5bd61 100644
--- a/docs/dev/manifest-guide.md
+++ b/docs/dev/manifest-guide.md
@@ -483,7 +483,15 @@ See `packages/backend/.env.example` for all variables. Key ones:
 - `DISCORD_CLIENT_ID` / `DISCORD_CLIENT_SECRET` — Discord OAuth (optional)
 - `SEED_DATA` — Set `true` to seed demo data on startup. Dev/test only — ignored when `NODE_ENV=production` (use the first-run setup wizard instead).
 - `THINKER_CIMD_ALLOW_PRIVATE` — `true` lets an MCP client whose Client ID Metadata Document URL (its OAuth `client_id`) resolves to a private or loopback address sign in. Default `false`: that URL comes from an unauthenticated client, so `auth/cimd-client-metadata-fetch.ts` only fetches from public addresses and treats a DNS failure as an error. Cloud metadata addresses are refused either way.
-- **SSRF policy (#18).** There is no deployment mode any more (`MANIFEST_MODE` was removed; it is ignored if set). Custom-provider URLs (`custom-provider.service.ts`, and the forward-time revalidation in `provider-client.ts`) always validate with `validatePublicUrl(url, { allowPrivate: true })`: LAN, loopback and `http://` destinations are a feature (Ollama, LM Studio, vLLM), the URL comes from an authenticated tenant member, and `http://` to a public address is still refused. Cloud metadata endpoints (`169.254.169.254`, `169.254.169.253`, `100.100.100.200`, `fd00:ec2::254`, IPv4-mapped forms, and the names `metadata.google.internal`, `metadata.goog`, `metadata`, `instance-data`, `instance-data.ec2.internal`) are always refused. Per-organization hardening is v0.3 work.
+- **SSRF policy (#18).** There is no deployment mode any more (`MANIFEST_MODE` was removed; it is ignored if set). Custom-provider URLs and user-supplied provider base URLs follow one policy:
+  - **Allowed:** LAN, loopback and `http://` destinations are a feature (Ollama, LM Studio, vLLM). The URL comes from an authenticated tenant member. `http://` to a public address is still refused.
+  - **Up-front check:** `validatePublicUrl(url, { allowPrivate: true })` runs on create, update, probe and before each forward. A hostname that does not resolve is an error, never a pass.
+  - **At connect time:** the request itself (`custom-provider.service.ts` probe, and the `provider-client.ts` forward for endpoints with `requiresSsrfRevalidation`) goes through `common/utils/ssrf-safe-fetch.ts`. That module uses undici's own `fetch` with a shared `Agent` whose `connect.lookup` resolves the name once and refuses the connection if **any** answer is a metadata address. The socket gets only the validated addresses, so DNS rebinding between the check and the connection cannot reach IMDS. Undici's own `fetch` is used instead of Node's built-in one because Node bundles a different undici major, and passing a foreign `Agent` to the built-in `fetch` breaks across Node versions. Unit specs that mock `globalThis.fetch` mock `ssrf-safe-fetch` to delegate to it.
+  - **Always refused (metadata):**
+    - addresses `169.254.169.254`, `169.254.169.253`, `100.100.100.200`, `169.254.170.2` (ECS/Fargate credentials), `169.254.170.23`, `fd00:ec2::254`, `fd00:ec2::23` (EKS Pod Identity);
+    - any of those embedded in IPv6: IPv4-mapped, IPv4-compatible, NAT64 `64:ff9b::/96`, 6to4, Teredo;
+    - the names `metadata.google.internal`, `metadata.goog`, `metadata`, `instance-data`, `instance-data.ec2.internal`.
+  - Per-organization hardening is v0.3 work.
 - `AUTH_DB_POOL_MAX` — Connection pool size for Better Auth's own `pg.Pool`, separate from `DB_POOL_MAX`. Default: `5`.
 - `OLLAMA_HOST` — Ollama endpoint for the built-in tile. Defaults to `http://localhost:11434` outside Docker and `http://host.docker.internal:11434` inside the bundled `docker/docker-compose.yml`.
 - `REQUEST_RECORDING_STORAGE` / `REQUEST_RECORDING_FILESYSTEM_PATH` / `REQUEST_RECORDING_S3_*` / `REQUEST_RECORDING_RETENTION_DAYS` — Provider Attempt body recording storage + retention. See [Request Recording](#request-recording-provider-attempt-bodies).
diff --git a/package-lock.json b/package-lock.json
index 55f3b303..2e44eda3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15933,10 +15933,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.28.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
-      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
-      "dev": true,
+      "version": "6.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.0.tgz",
+      "integrity": "sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"
@@ -16761,6 +16760,7 @@
         "reflect-metadata": "^0.2.0",
         "rxjs": "^7.8.0",
         "typeorm": "^0.3.0",
+        "undici": "6.29.0",
         "uuid": "^11.0.0",
         "zod": "^4.4.3"
       },
diff --git a/packages/backend/package.json b/packages/backend/package.json
index e9f4a32f..f834a474 100644
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -56,6 +56,7 @@
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.8.0",
     "typeorm": "^0.3.0",
+    "undici": "6.29.0",
     "uuid": "^11.0.0",
     "zod": "^4.4.3"
   },
diff --git a/packages/backend/src/common/utils/ssrf-safe-fetch.spec.ts b/packages/backend/src/common/utils/ssrf-safe-fetch.spec.ts
new file mode 100644
index 00000000..57aeb45d
--- /dev/null
+++ b/packages/backend/src/common/utils/ssrf-safe-fetch.spec.ts
@@ -0,0 +1,233 @@
+import { createServer, type Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import {
+  assertConnectableHost,
+  resolveConnectableAddresses,
+  ssrfSafeFetch,
+  ssrfSafeLookup,
+  SsrfBlockedError,
+} from './ssrf-safe-fetch';
+
+jest.mock('node:dns/promises', () => ({ lookup: jest.fn() }));
+
+const { lookup } = jest.requireMock('node:dns/promises') as { lookup: jest.Mock };
+
+function runLookup(
+  hostname: string,
+  options: Record<string, unknown>,
+): Promise<{ err: Error | null; address: unknown; family?: number }> {
+  return new Promise((resolve) => {
+    ssrfSafeLookup(
+      hostname,
+      options as never,
+      ((err: Error | null, address: unknown, family?: number) =>
+        resolve({ err, address, family })) as never,
+    );
+  });
+}
+
+describe('assertConnectableHost', () => {
+  it.each([
+    'metadata.google.internal',
+    'METADATA.GOOGLE.INTERNAL.',
+    'metadata',
+    'instance-data.ec2.internal',
+    '169.254.169.254',
+    '169.254.170.2',
+    '[fd00:ec2::254]',
+    '[::ffff:169.254.169.254]',
+    '[64:ff9b::a9fe:a9fe]',
+  ])('refuses %s', (host) => {
+    expect(() => assertConnectableHost(host)).toThrow(SsrfBlockedError);
+  });
+
+  it.each(['192.168.1.20', '127.0.0.1', '[::1]', 'host.docker.internal', 'api.example.com'])(
+    'allows %s (LAN, loopback and public hosts are fine)',
+    (host) => {
+      expect(() => assertConnectableHost(host)).not.toThrow();
+    },
+  );
+});
+
+describe('resolveConnectableAddresses', () => {
+  beforeEach(() => lookup.mockReset());
+
+  it('returns the resolved addresses when none is metadata (private allowed)', async () => {
+    lookup.mockResolvedValue([
+      { address: '10.0.0.5', family: 4 },
+      { address: 'fd12::5', family: 6 },
+    ]);
+    await expect(resolveConnectableAddresses('ollama.lan')).resolves.toEqual([
+      { address: '10.0.0.5', family: 4 },
+      { address: 'fd12::5', family: 6 },
+    ]);
+    expect(lookup).toHaveBeenCalledWith('ollama.lan', { all: true, verbatim: true });
+  });
+
+  it.each([
+    [[{ address: '169.254.169.254', family: 4 }]],
+    [
+      [
+        { address: '93.184.216.34', family: 4 },
+        { address: '169.254.169.254', family: 4 },
+      ],
+    ],
+    [
+      [
+        { address: '93.184.216.34', family: 4 },
+        { address: 'fd00:ec2::254', family: 6 },
+      ],
+    ],
+    [[{ address: '169.254.170.2', family: 4 }]],
+    [[{ address: '::ffff:a9fe:a9fe', family: 6 }]],
+  ])('blocks the whole connection when any answer is metadata (%j)', async (answer) => {
+    lookup.mockResolvedValue(answer);
+    await expect(resolveConnectableAddresses('evil.example')).rejects.toBeInstanceOf(
+      SsrfBlockedError,
+    );
+  });
+
+  it('fails on a DNS error instead of letting the socket resolve again', async () => {
+    lookup.mockRejectedValue(
+      Object.assign(new Error('getaddrinfo ENOTFOUND x'), { code: 'ENOTFOUND' }),
+    );
+    await expect(resolveConnectableAddresses('nonexistent.invalid')).rejects.toThrow(/ENOTFOUND/);
+  });
+
+  it('fails on an empty answer', async () => {
+    lookup.mockResolvedValue([]);
+    await expect(resolveConnectableAddresses('empty.example')).rejects.toThrow(/ENOTFOUND/);
+  });
+
+  it('accepts a non-metadata IP literal without DNS and refuses a metadata one', async () => {
+    await expect(resolveConnectableAddresses('192.168.1.20')).resolves.toEqual([
+      { address: '192.168.1.20', family: 4 },
+    ]);
+    await expect(resolveConnectableAddresses('[::1]')).resolves.toEqual([
+      { address: '::1', family: 6 },
+    ]);
+    await expect(resolveConnectableAddresses('169.254.169.254')).rejects.toBeInstanceOf(
+      SsrfBlockedError,
+    );
+    expect(lookup).not.toHaveBeenCalled();
+  });
+
+  it('refuses metadata hostnames without resolving them', async () => {
+    await expect(resolveConnectableAddresses('metadata.google.internal')).rejects.toBeInstanceOf(
+      SsrfBlockedError,
+    );
+    expect(lookup).not.toHaveBeenCalled();
+  });
+});
+
+describe('ssrfSafeLookup', () => {
+  beforeEach(() => lookup.mockReset());
+
+  it('answers the all-addresses form with only validated addresses', async () => {
+    lookup.mockResolvedValue([
+      { address: '10.0.0.5', family: 4 },
+      { address: 'fd12::5', family: 6 },
+    ]);
+    const { err, address } = await runLookup('ollama.lan', { all: true });
+    expect(err).toBeNull();
+    expect(address).toEqual([
+      { address: '10.0.0.5', family: 4 },
+      { address: 'fd12::5', family: 6 },
+    ]);
+  });
+
+  it('answers the single-address form and honors a requested family', async () => {
+    lookup.mockResolvedValue([
+      { address: '10.0.0.5', family: 4 },
+      { address: 'fd12::5', family: 6 },
+    ]);
+    expect(await runLookup('ollama.lan', {})).toEqual({
+      err: null,
+      address: '10.0.0.5',
+      family: 4,
+    });
+    expect(await runLookup('ollama.lan', { family: 6 })).toEqual({
+      err: null,
+      address: 'fd12::5',
+      family: 6,
+    });
+    const missing = await runLookup('ollama.lan', { family: 'IPv6', all: true });
+    expect(missing.address).toEqual([{ address: 'fd12::5', family: 6 }]);
+  });
+
+  it('errors when no address of the requested family exists', async () => {
+    lookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }]);
+    const { err } = await runLookup('v4only.lan', { family: 6 });
+    expect(err?.message).toMatch(/ENOTFOUND/);
+  });
+
+  it('propagates a metadata refusal and a DNS failure as errors', async () => {
+    lookup.mockResolvedValue([{ address: '169.254.169.254', family: 4 }]);
+    expect((await runLookup('evil.example', { all: true })).err).toBeInstanceOf(SsrfBlockedError);
+
+    lookup.mockRejectedValue(new Error('getaddrinfo ENOTFOUND evil.example'));
+    expect((await runLookup('evil.example', {})).err?.message).toMatch(/ENOTFOUND/);
+  });
+});
+
+describe('ssrfSafeFetch (real sockets, pinned DNS)', () => {
+  let server: Server;
+  let port: number;
+  let requests = 0;
+
+  beforeAll(async () => {
+    server = createServer((_req, res) => {
+      requests += 1;
+      res.setHeader('content-type', 'application/json');
+      res.end('{"ok":true}');
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    port = (server.address() as AddressInfo).port;
+  });
+
+  afterAll(async () => {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  });
+
+  beforeEach(() => {
+    lookup.mockReset();
+    requests = 0;
+  });
+
+  it('connects to the validated address the name resolved to', async () => {
+    lookup.mockResolvedValue([{ address: '127.0.0.1', family: 4 }]);
+    const res = await ssrfSafeFetch(`http://models.lan:${port}/v1/models`, {
+      headers: { 'Content-Type': 'application/json' },
+      redirect: 'error',
+    });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ ok: true });
+    expect(requests).toBe(1);
+    expect(lookup).toHaveBeenCalledWith('models.lan', { all: true, verbatim: true });
+  });
+
+  it('refuses a name that resolves to metadata at connect time, without connecting', async () => {
+    lookup.mockResolvedValue([{ address: '169.254.169.254', family: 4 }]);
+    await expect(ssrfSafeFetch(`http://rebind.example:${port}/`)).rejects.toThrow();
+    expect(requests).toBe(0);
+  });
+
+  it('fails the request on a DNS failure', async () => {
+    lookup.mockRejectedValue(new Error('getaddrinfo ENOTFOUND nonexistent.invalid'));
+    await expect(ssrfSafeFetch(`http://nonexistent.invalid:${port}/`)).rejects.toThrow();
+    expect(requests).toBe(0);
+  });
+
+  it('refuses metadata literals and names before opening a socket', async () => {
+    await expect(ssrfSafeFetch('http://169.254.169.254/latest/meta-data')).rejects.toBeInstanceOf(
+      SsrfBlockedError,
+    );
+    await expect(ssrfSafeFetch('http://[fd00:ec2::23]/v1/credentials')).rejects.toBeInstanceOf(
+      SsrfBlockedError,
+    );
+    await expect(
+      ssrfSafeFetch('http://metadata.google.internal/computeMetadata/v1/'),
+    ).rejects.toBeInstanceOf(SsrfBlockedError);
+    expect(lookup).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/backend/src/common/utils/ssrf-safe-fetch.ts b/packages/backend/src/common/utils/ssrf-safe-fetch.ts
new file mode 100644
index 00000000..899a4938
--- /dev/null
+++ b/packages/backend/src/common/utils/ssrf-safe-fetch.ts
@@ -0,0 +1,128 @@
+import type { LookupAddress } from 'node:dns';
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { isIP, type LookupFunction } from 'node:net';
+import { Agent, fetch as undiciFetch, type RequestInit as UndiciRequestInit } from 'undici';
+import { isCloudMetadataHostname, isCloudMetadataIp } from './url-validation';
+
+/**
+ * Connection-time SSRF guard for requests to operator- or tenant-supplied URLs
+ * (custom providers, user-chosen provider base URLs).
+ *
+ * `validatePublicUrl()` checks a URL before it is used, but `fetch` resolves the
+ * hostname again on its own. A hostile resolver can answer a public address (or
+ * fail) during validation and a cloud metadata address at connect time (DNS
+ * rebinding). This module closes that gap: the dispatcher's `lookup` resolves
+ * the name once, refuses the connection when ANY returned address is a cloud
+ * metadata endpoint, and hands the socket only the addresses it validated, so
+ * the address checked is the address connected to. A DNS failure fails the
+ * request. Private and LAN addresses stay allowed: local models are a feature.
+ */
+
+export class SsrfBlockedError extends Error {
+  readonly code = 'ESSRFBLOCKED';
+
+  constructor(message: string) {
+    super(message);
+    this.name = 'SsrfBlockedError';
+  }
+}
+
+function stripBrackets(hostname: string): string {
+  return hostname.replace(/^\[|\]$/g, '');
+}
+
+/** Throws when the host is a metadata name or a metadata IP literal. */
+export function assertConnectableHost(hostname: string): void {
+  const host = stripBrackets(hostname);
+  if (isCloudMetadataHostname(host)) {
+    throw new SsrfBlockedError(`Refusing to connect to cloud metadata host ${host}`);
+  }
+  if (isIP(host) !== 0 && isCloudMetadataIp(host)) {
+    throw new SsrfBlockedError(`Refusing to connect to cloud metadata address ${host}`);
+  }
+}
+
+/**
+ * Resolves a hostname and returns its addresses only when none of them is a
+ * cloud metadata endpoint. One bad answer in a multi-address response blocks
+ * the whole connection, so the socket cannot fall back onto it.
+ */
+export async function resolveConnectableAddresses(hostname: string): Promise<LookupAddress[]> {
+  const host = stripBrackets(hostname);
+  assertConnectableHost(host);
+  const family = isIP(host);
+  if (family !== 0) return [{ address: host, family }];
+
+  const addresses = await dnsLookup(host, { all: true, verbatim: true });
+  if (addresses.length === 0) {
+    throw Object.assign(new Error(`getaddrinfo ENOTFOUND ${host}`), { code: 'ENOTFOUND' });
+  }
+  for (const { address } of addresses) {
+    if (isCloudMetadataIp(address)) {
+      throw new SsrfBlockedError(
+        `Refusing to connect: ${host} resolved to a cloud metadata address`,
+      );
+    }
+  }
+  return addresses;
+}
+
+type LookupCallback = (
+  err: NodeJS.ErrnoException | null,
+  address: string | LookupAddress[],
+  family?: number,
+) => void;
+
+function requestedFamily(options: unknown): 4 | 6 | 0 {
+  const family = (options as { family?: unknown } | undefined)?.family;
+  if (family === 4 || family === 'IPv4') return 4;
+  if (family === 6 || family === 'IPv6') return 6;
+  return 0;
+}
+
+/** `net.connect`-compatible lookup that only ever yields validated addresses. */
+export const ssrfSafeLookup: LookupFunction = (hostname, options, callback) => {
+  const done = callback as unknown as LookupCallback;
+  resolveConnectableAddresses(hostname).then(
+    (addresses) => {
+      const family = requestedFamily(options);
+      const matching = family ? addresses.filter((entry) => entry.family === family) : addresses;
+      if (matching.length === 0) {
+        const err = Object.assign(new Error(`getaddrinfo ENOTFOUND ${hostname}`), {
+          code: 'ENOTFOUND',
+        });
+        done(err, '', 0);
+        return;
+      }
+      if ((options as { all?: boolean } | undefined)?.all) {
+        done(null, matching);
+        return;
+      }
+      done(null, matching[0]!.address, matching[0]!.family);
+    },
+    (error: unknown) => done(error instanceof Error ? error : new Error(String(error)), '', 0),
+  );
+};
+
+let dispatcher: Agent | undefined;
+
+/** Shared keep-alive pool whose every connection goes through `ssrfSafeLookup`. */
+export function getSsrfSafeDispatcher(): Agent {
+  dispatcher ??= new Agent({ connect: { lookup: ssrfSafeLookup } });
+  return dispatcher;
+}
+
+/**
+ * `fetch` for operator- or tenant-supplied URLs. Uses undici's own `fetch`
+ * with the pinned dispatcher: Node's built-in `fetch` bundles a different
+ * undici major whose dispatcher interface is not stable across Node versions.
+ * Metadata literals and names are refused before any socket is opened.
+ */
+export async function ssrfSafeFetch(url: string, init: RequestInit = {}): Promise<Response> {
+  assertConnectableHost(new URL(url).hostname);
+  const response = await undiciFetch(url, {
+    ...(init as unknown as UndiciRequestInit),
+    dispatcher: getSsrfSafeDispatcher(),
+  });
+  return response as unknown as Response;
+}
diff --git a/packages/backend/src/common/utils/url-validation.spec.ts b/packages/backend/src/common/utils/url-validation.spec.ts
index cf3c423f..3dec4363 100644
--- a/packages/backend/src/common/utils/url-validation.spec.ts
+++ b/packages/backend/src/common/utils/url-validation.spec.ts
@@ -191,6 +191,34 @@ describe('isCloudMetadataIp', () => {
   it('allows public IPv6', () => {
     expect(isCloudMetadataIp('2001:db8::1')).toBe(false);
   });
+
+  it.each([
+    ['169.254.170.2', 'AWS ECS / Fargate task credentials'],
+    ['169.254.170.23', 'AWS EKS Pod Identity Agent'],
+    ['fd00:ec2::23', 'AWS EKS Pod Identity Agent (IPv6)'],
+    ['FD00:0EC2:0000:0000:0000:0000:0000:0023', 'EKS Pod Identity, uncompressed upper case'],
+    ['fd00:0ec2::0254', 'AWS IPv6 IMDS, zero-padded'],
+    ['::ffff:169.254.170.2', 'IPv4-mapped ECS credentials'],
+  ])('detects %s as cloud metadata (%s)', (ip) => {
+    expect(isCloudMetadataIp(ip)).toBe(true);
+  });
+
+  it.each([
+    ['::a9fe:a9fe', 'IPv4-compatible'],
+    ['::169.254.169.254', 'IPv4-compatible, dotted'],
+    ['64:ff9b::a9fe:a9fe', 'NAT64 well-known prefix'],
+    ['64:ff9b::169.254.169.254', 'NAT64, dotted'],
+    ['2002:a9fe:a9fe::', '6to4'],
+    ['2001:0:4136:e378:8000:63bf:5601:5601', 'Teredo (client 169.254.169.254, obfuscated)'],
+  ])('detects IMDS embedded in IPv6 %s (%s)', (ip) => {
+    expect(isCloudMetadataIp(ip)).toBe(true);
+  });
+
+  it('does not flag ordinary addresses in the embedding prefixes', () => {
+    expect(isCloudMetadataIp('64:ff9b::808:808')).toBe(false);
+    expect(isCloudMetadataIp('2002:808:808::1')).toBe(false);
+    expect(isCloudMetadataIp('::1')).toBe(false);
+  });
 });
 
 describe('isIpLiteral', () => {
@@ -435,11 +463,38 @@ describe('validatePublicUrl', () => {
       ).resolves.toBeUndefined();
     });
 
-    it('treats unresolvable hostnames as non-fatal (LAN-only names, mDNS)', async () => {
+    it('treats a DNS failure as an error, even with allowPrivate (rebinding bypass)', async () => {
+      // A hostile resolver could fail here and answer IMDS at connect time.
       mockLookup.mockRejectedValue(new Error('ENOTFOUND'));
       await expect(
         validatePublicUrl('http://my-lan-box.local/v1', { allowPrivate: true }),
-      ).resolves.toBeUndefined();
+      ).rejects.toThrow('Failed to resolve hostname');
+      await expect(
+        validatePublicUrl('http://nonexistent-xyz-thinker.invalid/', { allowPrivate: true }),
+      ).rejects.toThrow('Failed to resolve hostname');
+    });
+
+    it.each([
+      'http://169.254.170.2/v2/credentials/abc',
+      'http://169.254.170.23/v1/credentials',
+      'http://[fd00:ec2::23]/v1/credentials',
+      'http://[::ffff:169.254.170.2]/v2/metadata',
+      'http://[::a9fe:a9fe]/latest/meta-data',
+      'http://[64:ff9b::a9fe:a9fe]/latest/meta-data',
+      'http://[64:ff9b::169.254.169.254]/latest/meta-data',
+      'http://[2002:a9fe:a9fe::1]/latest/meta-data',
+      'http://[fd00:0ec2:0000::0254]/latest/meta-data',
+    ])('blocks the metadata endpoint %s even with allowPrivate', async (url) => {
+      await expect(validatePublicUrl(url, { allowPrivate: true })).rejects.toThrow(
+        'cloud metadata',
+      );
+    });
+
+    it('blocks a hostname resolving to a container credential endpoint', async () => {
+      mockLookup.mockResolvedValue([{ address: '169.254.170.2', family: 4 }] as never);
+      await expect(
+        validatePublicUrl('http://creds.example.com/', { allowPrivate: true }),
+      ).rejects.toThrow('cloud metadata');
     });
   });
 });
diff --git a/packages/backend/src/common/utils/url-validation.ts b/packages/backend/src/common/utils/url-validation.ts
index 1751b389..f0ddd83e 100644
--- a/packages/backend/src/common/utils/url-validation.ts
+++ b/packages/backend/src/common/utils/url-validation.ts
@@ -33,15 +33,9 @@ export function isIpLiteral(host: string): boolean {
   return isIP(host) !== 0;
 }
 
-// Collapse an IPv4-mapped IPv6 address to its dotted-quad IPv4 form so the
-// IPv4 range checks can see it. Node's URL parser normalizes
-// `[::ffff:169.254.169.254]` to the *hex* form `::ffff:a9fe:a9fe`, which a
-// dotted-only regex misses — that gap let a mapped literal smuggle a private
-// or cloud-metadata target past the SSRF guard. We expand the (already
-// isIP-validated) literal to its 8 hextets and, when it is IPv4-mapped
-// (`::ffff:0:0/96`), rebuild the embedded IPv4. Non-mapped hosts pass through.
-function unwrapMappedIpv4(host: string): string {
-  if (isIP(host) !== 6) return host;
+/** The 8 hextets of a valid IPv6 literal, or null for anything else. */
+function ipv6Hextets(host: string): number[] | null {
+  if (isIP(host) !== 6) return null;
   // host is a valid IPv6 literal, so `::` appears at most once and every
   // group is valid hex (or a single dotted-quad tail) — no defensive parsing.
   const parseGroups = (segment: string): number[] =>
@@ -59,21 +53,36 @@ function unwrapMappedIpv4(host: string): string {
   const [head, tail] = host.toLowerCase().split('::');
   const left = parseGroups(head);
   const right = tail === undefined ? [] : parseGroups(tail);
-  const hextets = [...left, ...Array<number>(8 - left.length - right.length).fill(0), ...right];
-
-  const mapped =
-    hextets[0] === 0 &&
-    hextets[1] === 0 &&
-    hextets[2] === 0 &&
-    hextets[3] === 0 &&
-    hextets[4] === 0 &&
-    hextets[5] === 0xffff;
-  if (!mapped) return host;
-  const hi = hextets[6];
-  const lo = hextets[7];
+  return [...left, ...Array<number>(8 - left.length - right.length).fill(0), ...right];
+}
+
+function ipv4FromHextets(hi: number, lo: number): string {
   return `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
 }
 
+// Collapse an IPv6 address that embeds an IPv4 address to its dotted-quad
+// IPv4 form so the IPv4 range checks can see it. Node's URL parser normalizes
+// `[::ffff:169.254.169.254]` to the *hex* form `::ffff:a9fe:a9fe`, which a
+// dotted-only regex misses — that gap let a mapped literal smuggle a private
+// or cloud-metadata target past the SSRF guard. Covered embeddings:
+// - IPv4-mapped `::ffff:0:0/96` and IPv4-compatible `::/96`;
+// - NAT64 well-known prefix `64:ff9b::/96` (RFC 6052);
+// - 6to4 `2002::/16` (RFC 3056), IPv4 in hextets 1-2;
+// - Teredo `2001::/32` (RFC 4380), client IPv4 obfuscated in hextets 6-7.
+// Other hosts pass through unchanged.
+function unwrapMappedIpv4(host: string): string {
+  const h = ipv6Hextets(host);
+  if (!h) return host;
+  const zeroPrefix = h[0] === 0 && h[1] === 0 && h[2] === 0 && h[3] === 0 && h[4] === 0;
+  if (zeroPrefix && (h[5] === 0xffff || h[5] === 0)) return ipv4FromHextets(h[6], h[7]);
+  if (h[0] === 0x64 && h[1] === 0xff9b && h[2] === 0 && h[3] === 0 && h[4] === 0 && h[5] === 0) {
+    return ipv4FromHextets(h[6], h[7]);
+  }
+  if (h[0] === 0x2002) return ipv4FromHextets(h[1], h[2]);
+  if (h[0] === 0x2001 && h[1] === 0) return ipv4FromHextets(~h[6] & 0xffff, ~h[7] & 0xffff);
+  return host;
+}
+
 export function isPrivateIp(ip: string): boolean {
   // Collapse IPv4-mapped IPv6 (any textual form) to dotted IPv4 first.
   const normalizedIp = unwrapMappedIpv4(ip);
@@ -103,16 +112,19 @@ const CLOUD_METADATA_RANGES: { addr: bigint; mask: bigint }[] = [
   cidr('169.254.169.254', 32), // AWS / GCP / Azure / OpenStack IMDS
   cidr('169.254.169.253', 32), // Alibaba Cloud / OCI IMDS
   cidr('100.100.100.200', 32), // Alibaba Cloud (alternative)
+  cidr('169.254.170.2', 32), // AWS ECS / Fargate task metadata and credentials
+  cidr('169.254.170.23', 32), // AWS EKS Pod Identity Agent
 ];
 
 // IPv6 IMDS endpoints. ULA (`fd00::/8`) and link-local (`fe80::/10`) are
 // regular private space — not metadata — so they are NOT in this list.
-// `fd00:ec2::254` is the AWS IPv6 IMDS endpoint.
-const CLOUD_METADATA_V6 = ['fd00:ec2::254'];
+// `fd00:ec2::254` is the AWS IPv6 IMDS endpoint and `fd00:ec2::23` the IPv6
+// EKS Pod Identity Agent. Stored as hextets so any textual form matches.
+const CLOUD_METADATA_V6 = ['fd00:ec2::254', 'fd00:ec2::23'].map((ip) => ipv6Hextets(ip)!);
 
 // Metadata hostnames. Inside the cloud they resolve to the IMDS address and the
-// resolved-address check catches them, but with allowPrivate a DNS failure is
-// tolerated, so refuse the well-known names up front as well.
+// resolved-address check catches them; refusing the well-known names up front
+// also covers a resolver that answers differently at connect time.
 const CLOUD_METADATA_HOSTNAMES = new Set([
   'metadata',
   'metadata.google.internal',
@@ -129,10 +141,13 @@ export function isCloudMetadataIp(ip: string): boolean {
   const normalizedIp = unwrapMappedIpv4(ip);
 
   if (normalizedIp.includes(':')) {
-    const lower = normalizedIp.toLowerCase();
-    // Exact match, not a prefix: `fd00:ec2::254:1` is a legitimate ULA address,
-    // not the AWS IMDS endpoint.
-    return CLOUD_METADATA_V6.some((metadata) => lower === metadata);
+    // Exact address match, not a prefix: `fd00:ec2::254:1` is a legitimate ULA
+    // address, not the AWS IMDS endpoint.
+    const hextets = ipv6Hextets(normalizedIp);
+    return (
+      hextets !== null &&
+      CLOUD_METADATA_V6.some((metadata) => metadata.every((value, i) => value === hextets[i]))
+    );
   }
 
   const parsed = normalizedIp.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
@@ -197,13 +212,10 @@ export async function validatePublicUrl(
       const result = await lookup(hostname, { all: true });
       addresses = Array.isArray(result) ? result : [result];
     } catch {
-      // Local deployments sometimes use hostnames that only resolve
-      // inside the host's resolver (mDNS, /etc/hosts aliases, LAN-only
-      // names). In allowPrivate mode we trust the operator and let the
-      // subsequent fetch attempt decide — cloud metadata is still caught
-      // on the resolved path when DNS succeeds, and a hostile public host
-      // isn't reachable if DNS can't resolve it from inside the container.
-      if (allowPrivate) return;
+      // A name that does not resolve here does not resolve for the fetch
+      // either (same resolver: /etc/hosts, mDNS and LAN DNS included), so a
+      // DNS failure is never a pass, even with allowPrivate. Accepting it let a
+      // hostile resolver fail validation and answer IMDS at connect time.
       throw new Error(`Failed to resolve hostname: ${hostname}`);
     }
   }
diff --git a/packages/backend/src/routing/custom-provider/custom-provider.service.spec.ts b/packages/backend/src/routing/custom-provider/custom-provider.service.spec.ts
index 6aaf61eb..37c9146d 100644
--- a/packages/backend/src/routing/custom-provider/custom-provider.service.spec.ts
+++ b/packages/backend/src/routing/custom-provider/custom-provider.service.spec.ts
@@ -1,3 +1,7 @@
+// Pinned fetch goes through the mocked global fetch here; its own behavior is covered by ssrf-safe-fetch.spec.ts.
+jest.mock('../../common/utils/ssrf-safe-fetch', () => ({
+  ssrfSafeFetch: jest.fn((url: string, init?: RequestInit) => globalThis.fetch(url, init)),
+}));
 jest.mock('../../common/utils/url-validation', () => ({
   validatePublicUrl: jest.fn(),
 }));
@@ -14,6 +18,8 @@ import { IngestEventBusService } from '../../common/services/ingest-event-bus.se
 import { ModelsDevSyncService } from '../../database/models-dev-sync.service';
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { validatePublicUrl } = require('../../common/utils/url-validation');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { ssrfSafeFetch } = require('../../common/utils/ssrf-safe-fetch');
 
 function makeDeps(overrides: {
   findOneResults?: (CustomProvider | null)[];
@@ -1095,8 +1101,11 @@ describe('CustomProviderService', () => {
           jsonResponse({ data: [{ id: 'm1' }, { id: 'm2' }] }),
         ) as unknown as typeof fetch;
 
+      (ssrfSafeFetch as jest.Mock).mockClear();
       const result = await svc.probeModels('http://host.docker.internal:8000/v1', 'sk-x');
       expect(result).toEqual([{ model_name: 'm1' }, { model_name: 'm2' }]);
+      // The probe goes through the pinned fetch (DNS rebinding guard).
+      expect(ssrfSafeFetch).toHaveBeenCalledTimes(1);
       expect((global.fetch as jest.Mock).mock.calls[0][0]).toBe(
         'http://host.docker.internal:8000/v1/models',
       );
diff --git a/packages/backend/src/routing/custom-provider/custom-provider.service.ts b/packages/backend/src/routing/custom-provider/custom-provider.service.ts
index 54f0497f..ed23b173 100644
--- a/packages/backend/src/routing/custom-provider/custom-provider.service.ts
+++ b/packages/backend/src/routing/custom-provider/custom-provider.service.ts
@@ -29,6 +29,7 @@ import { ProviderService } from '../routing-core/provider.service';
 import { RoutingCacheService } from '../routing-core/routing-cache.service';
 import { CreateCustomProviderDto, UpdateCustomProviderDto } from '../dto/custom-provider.dto';
 import { validatePublicUrl } from '../../common/utils/url-validation';
+import { ssrfSafeFetch } from '../../common/utils/ssrf-safe-fetch';
 import { decryptWithAny, getDecryptionSecrets } from '../../common/utils/crypto.util';
 import { ModelPricingCacheService } from '../../model-prices/model-pricing-cache.service';
 import { ModelsDevSyncService } from '../../database/models-dev-sync.service';
@@ -39,8 +40,10 @@ const PROBE_TIMEOUT_MS = 5000;
 
 // Private and LAN destinations are a feature: operators point custom providers
 // at Ollama, LM Studio or vLLM on their own network. Cloud metadata endpoints
-// stay blocked inside validatePublicUrl regardless of this flag.
-// The URL comes from an authenticated tenant member, not an anonymous client.
+// stay blocked inside validatePublicUrl regardless of this flag, and every
+// request to the URL goes through ssrfSafeFetch, which re-checks the address
+// it actually connects to (DNS rebinding). The URL comes from an authenticated
+// tenant member, not an anonymous client.
 const CUSTOM_PROVIDER_URL_POLICY = { allowPrivate: true } as const;
 
 /**
@@ -576,12 +579,13 @@ export class CustomProviderService {
       }
       // User-controlled URL is intentional here — this endpoint exists to
       // connect to operator-chosen LLM servers. validatePublicUrl() above is
-      // our SSRF mitigation: cloud metadata is always blocked; private and LAN
-      // hosts are allowed by design (local models). `redirect: 'error'`
+      // the early check and ssrfSafeFetch pins the connection to a validated
+      // address: cloud metadata is always blocked; private and LAN hosts are
+      // allowed by design (local models). `redirect: 'error'`
       // ensures a hostile server can't redirect the probe to a destination
       // that would bypass validation.
       // codeql[js/request-forgery]
-      const res = await fetch(url, {
+      const res = await ssrfSafeFetch(url, {
         headers,
         signal: controller.signal,
         redirect: 'error',
diff --git a/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts b/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
index 3f3729ab..2586d756 100644
--- a/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/provider-client.spec.ts
@@ -1,3 +1,7 @@
+// Pinned fetch goes through the mocked global fetch here; its own behavior is covered by ssrf-safe-fetch.spec.ts.
+jest.mock('../../../common/utils/ssrf-safe-fetch', () => ({
+  ssrfSafeFetch: jest.fn((url: string, init?: RequestInit) => globalThis.fetch(url, init)),
+}));
 import { Buffer } from 'node:buffer';
 import { ProviderClient } from '../provider-client';
 import { buildCustomEndpoint, buildEndpointOverride } from '../provider-endpoints';
diff --git a/packages/backend/src/routing/proxy/__tests__/provider-client.ssrf.spec.ts b/packages/backend/src/routing/proxy/__tests__/provider-client.ssrf.spec.ts
index b6aaec7e..edcea11d 100644
--- a/packages/backend/src/routing/proxy/__tests__/provider-client.ssrf.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/provider-client.ssrf.spec.ts
@@ -1,3 +1,7 @@
+// Pinned fetch goes through the mocked global fetch here; its own behavior is covered by ssrf-safe-fetch.spec.ts.
+jest.mock('../../../common/utils/ssrf-safe-fetch', () => ({
+  ssrfSafeFetch: jest.fn((url: string, init?: RequestInit) => globalThis.fetch(url, init)),
+}));
 // SSRF revalidation tests for ProviderClient.
 //
 // The provider-client.ts implements a defense-in-depth check
@@ -16,6 +20,8 @@ import { ProviderClient } from '../provider-client';
 import { buildCustomEndpoint, ProviderEndpoint } from '../provider-endpoints';
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { validatePublicUrl } = require('../../../common/utils/url-validation');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { ssrfSafeFetch } = require('../../../common/utils/ssrf-safe-fetch');
 
 const mockFetch = jest.fn();
 (globalThis as unknown as { fetch: typeof fetch }).fetch = mockFetch;
@@ -32,6 +38,7 @@ describe('ProviderClient — SSRF revalidation for custom endpoints', () => {
     client = new ProviderClient();
     mockFetch.mockReset();
     (validatePublicUrl as jest.Mock).mockReset();
+    (ssrfSafeFetch as jest.Mock).mockClear();
   });
 
   it('re-validates URL through validatePublicUrl when endpoint requires revalidation', async () => {
@@ -162,4 +169,39 @@ describe('ProviderClient — SSRF revalidation for custom endpoints', () => {
     expect(validatePublicUrl).not.toHaveBeenCalled();
     expect(mockFetch).toHaveBeenCalledTimes(1);
   });
+
+  it('sends a user-supplied endpoint through the pinned ssrfSafeFetch (DNS rebinding)', async () => {
+    mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
+    (validatePublicUrl as jest.Mock).mockResolvedValue(undefined);
+
+    await client.forward({
+      provider: 'custom:abc',
+      apiKey: 'sk-cust',
+      model: 'm',
+      body,
+      stream: false,
+      customEndpoint: buildCustomEndpoint('https://upstream.example.com/v1'),
+    });
+
+    expect(ssrfSafeFetch).toHaveBeenCalledTimes(1);
+    expect((ssrfSafeFetch as jest.Mock).mock.calls[0][0]).toBe(
+      'https://upstream.example.com/v1/chat/completions',
+    );
+    expect((ssrfSafeFetch as jest.Mock).mock.calls[0][1]).toMatchObject({ redirect: 'error' });
+  });
+
+  it('keeps built-in provider endpoints on the plain fetch', async () => {
+    mockFetch.mockResolvedValue(new Response('{}', { status: 200 }));
+
+    await client.forward({
+      provider: 'openai',
+      apiKey: 'sk-test',
+      model: 'gpt-4o',
+      body,
+      stream: false,
+    });
+
+    expect(ssrfSafeFetch).not.toHaveBeenCalled();
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/packages/backend/src/routing/proxy/provider-client.ts b/packages/backend/src/routing/proxy/provider-client.ts
index 30a5e608..37c9f7cf 100644
--- a/packages/backend/src/routing/proxy/provider-client.ts
+++ b/packages/backend/src/routing/proxy/provider-client.ts
@@ -9,6 +9,7 @@ import {
   resolveEndpointKey,
 } from './provider-endpoints';
 import { validatePublicUrl } from '../../common/utils/url-validation';
+import { ssrfSafeFetch } from '../../common/utils/ssrf-safe-fetch';
 import { resolveSubscriptionEndpointKey } from './provider-hooks';
 import { isAnthropicHost, mergeAnthropicBeta } from './anthropic-beta';
 import { injectOpenAiMessageCacheControl, injectOpenRouterCacheControl } from './cache-injection';
@@ -453,10 +454,12 @@ export class ProviderClient {
     }
     this.logger.debug(`Forwarding to ${endpointKey}: ${url.replace(/key=[^&]+/, 'key=***')}`);
 
-    // SSRF defense in depth for user-supplied endpoint URLs (custom providers,
-    // subscription resource URLs). Re-check on every actual forward, because DNS
-    // may have rebound since the URL was first validated. LAN destinations are
-    // allowed (local models are a feature); cloud metadata is always refused.
+    // SSRF defense for user-supplied endpoint URLs (custom providers,
+    // subscription resource URLs). This re-check refuses metadata literals,
+    // names and plaintext to public hosts early with a clear message; it cannot
+    // stop DNS rebinding on its own, so the request itself goes through
+    // ssrfSafeFetch, which validates the address it actually connects to.
+    // LAN destinations are allowed (local models are a feature).
     if (endpoint.requiresSsrfRevalidation) {
       try {
         await validatePublicUrl(url, { allowPrivate: true });
@@ -466,15 +469,24 @@ export class ProviderClient {
       }
     }
 
-    const result = await this.executeFetch(url, finalHeaders, requestBody, signal, stream, {
-      isGoogle,
-      isAnthropic,
-      isChatGpt,
-      isResponses,
-      isCodeAssist,
-      responsesTextFormat: textFormat,
-      responsesToolNames: opts.apiMode === 'responses' ? responsesToolNames(body.tools) : undefined,
-    });
+    const result = await this.executeFetch(
+      url,
+      finalHeaders,
+      requestBody,
+      signal,
+      stream,
+      {
+        isGoogle,
+        isAnthropic,
+        isChatGpt,
+        isResponses,
+        isCodeAssist,
+        responsesTextFormat: textFormat,
+        responsesToolNames:
+          opts.apiMode === 'responses' ? responsesToolNames(body.tools) : undefined,
+      },
+      endpoint.requiresSsrfRevalidation === true,
+    );
     const response =
       !stream &&
       endpoint.format === 'openai' &&
@@ -905,6 +917,8 @@ export class ProviderClient {
       responsesTextFormat?: Record<string, unknown>;
       responsesToolNames?: ResponsesToolNames;
     },
+    // User-supplied destination: pin the connection to a validated address.
+    pinDestination = false,
   ): Promise<ForwardResult> {
     let fetchSignal: AbortSignal;
     let timeout: ReturnType<typeof setTimeout> | undefined;
@@ -925,8 +939,9 @@ export class ProviderClient {
     }
 
     let response: Response;
+    const doFetch = pinDestination ? ssrfSafeFetch : fetch;
     try {
-      response = await fetch(url, {
+      response = await doFetch(url, {
         method: 'POST',
         headers,
         body: JSON.stringify(requestBody),
diff --git a/packages/backend/test/custom-provider-dns-rebinding.e2e-spec.ts b/packages/backend/test/custom-provider-dns-rebinding.e2e-spec.ts
new file mode 100644
index 00000000..5e0fd277
--- /dev/null
+++ b/packages/backend/test/custom-provider-dns-rebinding.e2e-spec.ts
@@ -0,0 +1,230 @@
+/**
+ * #18 review S1: DNS rebinding against custom-provider URLs.
+ *
+ * Custom providers may point at LAN and loopback hosts (local models), so the
+ * URL check runs with allowPrivate. A hostile resolver can answer a public
+ * address while the URL is validated and a cloud metadata address when the
+ * request connects. The request must be pinned to the address it validated:
+ * the probe and the forward go through `ssrfSafeFetch`, whose lookup refuses
+ * metadata at connect time.
+ *
+ * Harness, all in-process and offline:
+ * - both DNS modules are mocked: the attacker's hostname answers "public" a set
+ *   number of times, then 169.254.169.254;
+ * - `net.Socket.prototype.connect` is wrapped so any connection the process
+ *   would make to 169.254.169.254 lands on a local TCP listener instead. The
+ *   listener stands in for the metadata service and counts connections, so a
+ *   regression shows up as a counted connection rather than a hang.
+ */
+import * as net from 'node:net';
+import { INestApplication } from '@nestjs/common';
+import request from 'supertest';
+import { createTestApp, TEST_API_KEY, TEST_OTLP_KEY } from './helpers';
+
+const REBIND_HOST = 'rebind.thinker-e2e.example';
+
+interface MockRebindState {
+  /** Answers left before the attacker's name starts resolving to metadata. */
+  benignAnswersLeft: number;
+  /** What a benign answer is: a public address, or loopback (control case). */
+  benign: '93.184.216.34' | '127.0.0.1';
+  /** Answers handed out for the attacker's name, in order. */
+  answers: string[];
+}
+
+// Shared with the jest.mock factories below (they may only touch `mock*` names
+// or globals), so it lives on globalThis.
+const mockRebind: MockRebindState = {
+  benignAnswersLeft: 0,
+  benign: '93.184.216.34',
+  answers: [],
+};
+(globalThis as { mockRebind?: MockRebindState }).mockRebind = mockRebind;
+
+jest.mock('dns/promises', () => {
+  const actual = jest.requireActual('dns/promises');
+  return {
+    ...actual,
+    lookup: jest.fn((hostname: string, options?: { all?: boolean }) => {
+      const state = (globalThis as { mockRebind?: MockRebindState }).mockRebind!;
+      if (hostname !== 'rebind.thinker-e2e.example') return actual.lookup(hostname, options);
+      const address = state.benignAnswersLeft-- > 0 ? state.benign : '169.254.169.254';
+      state.answers.push(address);
+      const entry = { address, family: 4 };
+      return Promise.resolve(options?.all ? [entry] : entry);
+    }),
+  };
+});
+// Jest resolves `node:dns/promises` to the same module, so this one mock also
+// covers the import in ssrf-safe-fetch.ts.
+
+describe('Custom provider DNS rebinding to cloud metadata (e2e)', () => {
+  let app: INestApplication;
+  let metadataStandIn: net.Server;
+  let metadataPort: number;
+  let metadataConnections = 0;
+  let previousSkip: string | undefined;
+  const originalConnect = net.Socket.prototype.connect;
+  const api = () => request(app.getHttpServer());
+  const dashboard = (test: request.Test) => test.set('x-api-key', TEST_API_KEY);
+  const agent = (test: request.Test) => test.set('Authorization', `Bearer ${TEST_OTLP_KEY}`);
+
+  beforeAll(async () => {
+    metadataStandIn = net.createServer((socket) => {
+      metadataConnections += 1;
+      socket.destroy();
+    });
+    await new Promise<void>((resolve) => metadataStandIn.listen(0, '127.0.0.1', resolve));
+    metadataPort = (metadataStandIn.address() as net.AddressInfo).port;
+
+    // Divert every connection the process would open to 169.254.169.254 onto
+    // the stand-in, whichever resolver produced the address.
+    const divert = (address: string) => (address === '169.254.169.254' ? '127.0.0.1' : address);
+    net.Socket.prototype.connect = function patchedConnect(
+      this: net.Socket,
+      ...args: unknown[]
+    ): net.Socket {
+      const first = args[0];
+      const options = (Array.isArray(first) ? first[0] : first) as
+        (net.TcpNetConnectOpts & { lookup?: net.LookupFunction }) | undefined;
+      if (options && typeof options === 'object' && typeof options.host === 'string') {
+        const inner = options.lookup;
+        options.lookup = ((hostname: string, lookupOptions: unknown, callback: unknown) => {
+          const done = callback as (
+            err: Error | null,
+            address: string | { address: string; family: number }[],
+            family?: number,
+          ) => void;
+          if (!inner) {
+            // Plain fetch path: resolve the attacker's name like a real resolver would.
+            const state = mockRebind;
+            const address =
+              hostname === REBIND_HOST
+                ? state.benignAnswersLeft-- > 0
+                  ? state.benign
+                  : '169.254.169.254'
+                : hostname;
+            if (hostname === REBIND_HOST) state.answers.push(address);
+            const all = (lookupOptions as { all?: boolean } | undefined)?.all;
+            const mapped = divert(address === 'localhost' ? '127.0.0.1' : address);
+            if (all) done(null, [{ address: mapped, family: 4 }]);
+            else done(null, mapped, 4);
+            return;
+          }
+          inner(
+            hostname,
+            lookupOptions as never,
+            ((
+              err: Error | null,
+              address: string | { address: string; family: number }[],
+              family?: number,
+            ) => {
+              if (err) return done(err, '', 0);
+              if (Array.isArray(address)) {
+                return done(
+                  null,
+                  address.map((entry) => ({ ...entry, address: divert(entry.address) })),
+                );
+              }
+              return done(null, divert(address), family);
+            }) as never,
+          );
+        }) as net.LookupFunction;
+      }
+      return (originalConnect as (...a: unknown[]) => net.Socket).apply(this, args);
+    } as typeof net.Socket.prototype.connect;
+
+    previousSkip = process.env['SKIP_SSRF_VALIDATION'];
+    process.env['SKIP_SSRF_VALIDATION'] = 'false';
+    app = await createTestApp();
+  }, 30_000);
+
+  afterAll(async () => {
+    net.Socket.prototype.connect = originalConnect;
+    if (previousSkip === undefined) delete process.env['SKIP_SSRF_VALIDATION'];
+    else process.env['SKIP_SSRF_VALIDATION'] = previousSkip;
+    await app?.close();
+    await new Promise<void>((resolve) => metadataStandIn.close(() => resolve()));
+  });
+
+  beforeEach(() => {
+    metadataConnections = 0;
+    mockRebind.answers = [];
+  });
+
+  const rebindUrl = () => `https://${REBIND_HOST}:${metadataPort}/v1`;
+
+  it('control: the harness counts a connection when the name resolves to an allowed address', async () => {
+    mockRebind.benign = '127.0.0.1';
+    mockRebind.benignAnswersLeft = 100;
+
+    await dashboard(api().post('/api/v1/routing/test-agent/custom-providers/probe')).send({
+      base_url: rebindUrl(),
+    });
+
+    expect(metadataConnections).toBeGreaterThan(0);
+  });
+
+  it('probe: passes validation on a public answer, then refuses the metadata answer at connect', async () => {
+    mockRebind.benign = '93.184.216.34';
+    mockRebind.benignAnswersLeft = 1; // validation only
+
+    const res = await dashboard(
+      api().post('/api/v1/routing/test-agent/custom-providers/probe'),
+    ).send({ base_url: rebindUrl() });
+
+    expect(mockRebind.answers[0]).toBe('93.184.216.34');
+    expect(mockRebind.answers).toContain('169.254.169.254');
+    expect(res.status).toBeGreaterThanOrEqual(400);
+    expect(metadataConnections).toBe(0);
+  });
+
+  it('forward: create and revalidation see a public answer, the connection is refused', async () => {
+    mockRebind.benign = '93.184.216.34';
+    mockRebind.benignAnswersLeft = 2; // create-time validation + forward-time revalidation
+
+    const created = await dashboard(api().post('/api/v1/routing/test-agent/custom-providers'))
+      .send({
+        name: 'Rebinding Provider',
+        base_url: rebindUrl(),
+        apiKey: 'rebind-key',
+        models: [
+          {
+            model_name: 'rebind-model',
+            input_price_per_million_tokens: 0,
+            output_price_per_million_tokens: 0,
+          },
+        ],
+      })
+      .expect(201);
+    const model = `custom:${created.body.id as string}/rebind-model`;
+    for (const tier of ['simple', 'standard', 'complex', 'reasoning', 'default']) {
+      await dashboard(api().put(`/api/v1/routing/test-agent/tiers/${tier}`))
+        .send({ model })
+        .expect(200);
+    }
+
+    const res = await agent(api().post('/v1/chat/completions')).send({
+      model,
+      messages: [{ role: 'user', content: 'hello' }],
+      stream: false,
+    });
+
+    expect(mockRebind.answers.slice(0, 2)).toEqual(['93.184.216.34', '93.184.216.34']);
+    expect(mockRebind.answers).toContain('169.254.169.254');
+    expect(JSON.stringify(res.body)).not.toContain('recorded');
+    expect(metadataConnections).toBe(0);
+  });
+
+  it('refuses a custom provider whose hostname does not resolve (.invalid)', async () => {
+    const res = await dashboard(api().post('/api/v1/routing/test-agent/custom-providers'))
+      .send({
+        name: 'Unresolvable',
+        base_url: 'http://nonexistent-xyz-thinker.invalid/v1',
+        models: [{ model_name: 'm1' }],
+      })
+      .expect(400);
+
+    expect((res.body as { message?: string }).message).toContain('Failed to resolve hostname');
+  });
+});
diff --git a/packages/backend/test/custom-providers.url-validation.e2e-spec.ts b/packages/backend/test/custom-providers.url-validation.e2e-spec.ts
index 10da93c6..921cd0df 100644
--- a/packages/backend/test/custom-providers.url-validation.e2e-spec.ts
+++ b/packages/backend/test/custom-providers.url-validation.e2e-spec.ts
@@ -175,6 +175,13 @@ describe('Custom Providers URL validation (e2e)', () => {
       'http://[::ffff:169.254.169.254]/latest/meta-data',
       'http://100.100.100.200/latest/meta-data',
       'http://metadata.google.internal/computeMetadata/v1/',
+      // AWS container credential endpoints (ECS/Fargate, EKS Pod Identity).
+      'http://169.254.170.2/v2/credentials/abc',
+      'http://169.254.170.23/v1/credentials',
+      'http://[fd00:ec2::23]/v1/credentials',
+      // IMDS embedded in IPv6: IPv4-compatible and NAT64.
+      'http://[::a9fe:a9fe]/latest/meta-data',
+      'http://[64:ff9b::a9fe:a9fe]/latest/meta-data',
     ])('rejects the cloud metadata endpoint %s as 400', async (url) => {
       const res = await request(app.getHttpServer())
         .post(`/api/v1/routing/${agentName}/custom-providers`)

From 1213ffec71c8bbd648d433bdb822722a6f08b7d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 14:09:00 -0300
Subject: [PATCH 12/17] test(backend): route the billing drop e2e through the
 database guard

Refs #67

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../backend/test/drop-billing-schema-migration.e2e-spec.ts   | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/backend/test/drop-billing-schema-migration.e2e-spec.ts b/packages/backend/test/drop-billing-schema-migration.e2e-spec.ts
index e62d9b99..36b4f763 100644
--- a/packages/backend/test/drop-billing-schema-migration.e2e-spec.ts
+++ b/packages/backend/test/drop-billing-schema-migration.e2e-spec.ts
@@ -2,6 +2,7 @@ import { DataSource } from 'typeorm';
 import { entities, migrations } from '../src/database/data-source-definitions';
 import { DropBillingSchema1803200000000 } from '../src/database/migrations/1803200000000-DropBillingSchema';
 import { toLocalSqlTimestamp } from '../src/common/utils/postgres-sql';
+import { resolveE2eDatabaseUrl } from './e2e-db-guard';
 
 const TENANT = 'billing-drop-tenant';
 const AGENT = 'billing-drop-agent';
@@ -133,8 +134,8 @@ describe('DropBillingSchema migration (e2e)', () => {
   beforeAll(async () => {
     ds = new DataSource({
       type: 'postgres',
-      url:
-        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase',
+      // Goes through the e2e guard: dropSchema below wipes the database.
+      url: resolveE2eDatabaseUrl(),
       // The exact registries the deploy runner uses, not a glob.
       entities,
       migrations,

From 498de2300c4475461ba810df30009b1cdeff3475 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 14:24:01 -0300
Subject: [PATCH 13/17] test(backend): route the SaaS drop e2e through the
 database guard

Refs #67

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../test/drop-saas-feature-schema-migration.e2e-spec.ts      | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts b/packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts
index 9a3a8ba9..41458b76 100644
--- a/packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts
+++ b/packages/backend/test/drop-saas-feature-schema-migration.e2e-spec.ts
@@ -2,6 +2,7 @@ import { DataSource } from 'typeorm';
 import { entities, migrations } from '../src/database/data-source-definitions';
 import { DropSaasFeatureSchema1803300000000 } from '../src/database/migrations/1803300000000-DropSaasFeatureSchema';
 import { toLocalSqlTimestamp } from '../src/common/utils/postgres-sql';
+import { resolveE2eDatabaseUrl } from './e2e-db-guard';
 
 const TENANT = 'saas-drop-tenant';
 const OTHER_TENANT = 'saas-drop-other-tenant';
@@ -67,8 +68,8 @@ describe('DropSaasFeatureSchema migration (e2e)', () => {
   beforeAll(async () => {
     ds = new DataSource({
       type: 'postgres',
-      url:
-        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase',
+      // Goes through the e2e guard: dropSchema below wipes the database.
+      url: resolveE2eDatabaseUrl(),
       // The exact registries the deploy runner uses, not a glob.
       entities,
       migrations,

From 21ab0156bde27cddad16d8468933e9a6b95fd873 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 14:35:39 -0300
Subject: [PATCH 14/17] test(backend): route the Autofix drop e2e through the
 database guard

The DropAutofixSchema e2e spec opens its own DataSource with dropSchema,
so it now takes its URL from resolveE2eDatabaseUrl() like the other
migration specs instead of falling back to a default localhost database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../backend/test/drop-autofix-schema-migration.e2e-spec.ts   | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts b/packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts
index 86cb631f..903806c4 100644
--- a/packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts
+++ b/packages/backend/test/drop-autofix-schema-migration.e2e-spec.ts
@@ -1,6 +1,7 @@
 import { DataSource } from 'typeorm';
 import { entities, migrations } from '../src/database/data-source-definitions';
 import { DropAutofixSchema1803400000000 } from '../src/database/migrations/1803400000000-DropAutofixSchema';
+import { resolveE2eDatabaseUrl } from './e2e-db-guard';
 
 /** Every Autofix column the migration drops, as `table.column`. */
 const AUTOFIX_COLUMNS = [
@@ -73,8 +74,8 @@ describe('DropAutofixSchema migration (e2e)', () => {
   beforeAll(async () => {
     ds = new DataSource({
       type: 'postgres',
-      url:
-        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase',
+      // Goes through the e2e guard: dropSchema below wipes the database.
+      url: resolveE2eDatabaseUrl(),
       // The exact registries the deploy runner uses, not a glob.
       entities,
       migrations,

From d536bcede5be36adcde30f059f86565807bd3a09 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 14:45:59 -0300
Subject: [PATCH 15/17] test(backend): route the install-metadata drop e2e
 through the database guard

The DropInstallMetadata migration spec and the no-phone-home egress spec
both open a dropSchema connection. Resolve their URL with
resolveE2eDatabaseUrl() from test/e2e-db-guard instead of falling back to
localhost:5432, so neither can wipe a database that is not an explicit,
disposable test database (#67, #69).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../backend/test/drop-install-metadata-migration.e2e-spec.ts  | 4 ++--
 packages/backend/test/no-phonehome-egress.e2e-spec.ts         | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/backend/test/drop-install-metadata-migration.e2e-spec.ts b/packages/backend/test/drop-install-metadata-migration.e2e-spec.ts
index 6f9b7e25..20348e55 100644
--- a/packages/backend/test/drop-install-metadata-migration.e2e-spec.ts
+++ b/packages/backend/test/drop-install-metadata-migration.e2e-spec.ts
@@ -2,6 +2,7 @@ import { DataSource } from 'typeorm';
 import { entities, migrations } from '../src/database/data-source-definitions';
 import { DropAutofixSchema1803400000000 } from '../src/database/migrations/1803400000000-DropAutofixSchema';
 import { DropInstallMetadata1803500000000 } from '../src/database/migrations/1803500000000-DropInstallMetadata';
+import { resolveE2eDatabaseUrl } from './e2e-db-guard';
 
 async function installMetadataColumns(ds: DataSource): Promise<string[]> {
   const rows: Array<{ name: string }> = await ds.query(
@@ -40,8 +41,7 @@ describe('DropInstallMetadata migration (e2e)', () => {
   beforeAll(async () => {
     ds = new DataSource({
       type: 'postgres',
-      url:
-        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase',
+      url: resolveE2eDatabaseUrl(),
       // The exact registries the deploy runner uses, not a glob.
       entities,
       migrations,
diff --git a/packages/backend/test/no-phonehome-egress.e2e-spec.ts b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
index 4c8c69f5..d11d8d8f 100644
--- a/packages/backend/test/no-phonehome-egress.e2e-spec.ts
+++ b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
@@ -14,6 +14,7 @@ import { createServer } from 'net';
 import { tmpdir } from 'os';
 import { join, sep } from 'path';
 import { DataSource } from 'typeorm';
+import { resolveE2eDatabaseUrl } from './e2e-db-guard';
 
 const FORBIDDEN_DESTINATIONS = [
   'telemetry.manifest.build',
@@ -163,8 +164,7 @@ describe('no phone-home egress', () => {
     let records: EgressRecord[] = [];
 
     beforeAll(async () => {
-      const databaseUrl =
-        process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase';
+      const databaseUrl = resolveE2eDatabaseUrl();
       // Start from an empty schema: the real server migrates on boot, and
       // earlier suites leave a synchronize()-built schema behind.
       const reset = new DataSource({ type: 'postgres', url: databaseUrl, dropSchema: true });

From 10677282f18c067e624451d861a708a055220aee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 15:14:04 -0300
Subject: [PATCH 16/17] test(backend): drop MANIFEST_MODE from local-runner
 specs and fix the local log flake

- Remove the MANIFEST_MODE=selfhosted setup that #100, #103 and #104 added
  to provider-client.local-servers.spec.ts, local-providers.e2e-spec.ts,
  reserved-local-runner-aliases.e2e-spec.ts and
  playground-request-headers.e2e-spec.ts. There is one mode now, so the
  variable does nothing.
- local-providers.e2e-spec.ts: "logs local requests under the canonical
  provider at zero cost" read rows[0] of every llama.cpp row for the agent,
  with no ORDER BY, while earlier tests also log llama.cpp requests and a
  row starts as `pending` before its usage lands. Tag the request with its
  own traceparent and wait for that one settled row. Closes that part of
  #101.
- mcp-cimd-ssrf.e2e-spec.ts: take the database from resolveE2eDatabaseUrl()
  instead of falling back to localhost:5432 before dropping the schema.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../provider-client.local-servers.spec.ts     |  3 +-
 .../backend/test/local-providers.e2e-spec.ts  | 30 +++++++++++++------
 .../backend/test/mcp-cimd-ssrf.e2e-spec.ts    |  5 ++--
 .../playground-request-headers.e2e-spec.ts    |  8 -----
 .../reserved-local-runner-aliases.e2e-spec.ts |  3 +-
 5 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/packages/backend/src/routing/proxy/__tests__/provider-client.local-servers.spec.ts b/packages/backend/src/routing/proxy/__tests__/provider-client.local-servers.spec.ts
index 3cc799b8..d50ea302 100644
--- a/packages/backend/src/routing/proxy/__tests__/provider-client.local-servers.spec.ts
+++ b/packages/backend/src/routing/proxy/__tests__/provider-client.local-servers.spec.ts
@@ -7,12 +7,11 @@ const mockFetch = jest.fn();
 // Issue #76: LM Studio and llama.cpp connected as built-in local providers,
 // but every chat failed with "No endpoint configured for provider".
 describe('built-in local OpenAI-compatible servers (LM Studio, llama.cpp)', () => {
-  const ENV_KEYS = ['MANIFEST_MODE', 'THINKER_LMSTUDIO_BASE_URL', 'THINKER_LLAMACPP_BASE_URL'];
+  const ENV_KEYS = ['THINKER_LMSTUDIO_BASE_URL', 'THINKER_LLAMACPP_BASE_URL'];
   const saved = Object.fromEntries(ENV_KEYS.map((key) => [key, process.env[key]]));
   let client: ProviderClient;
 
   beforeEach(() => {
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     process.env['THINKER_LMSTUDIO_BASE_URL'] = 'http://127.0.0.1:41234/v1';
     process.env['THINKER_LLAMACPP_BASE_URL'] = 'http://127.0.0.1:48080';
     client = new ProviderClient();
diff --git a/packages/backend/test/local-providers.e2e-spec.ts b/packages/backend/test/local-providers.e2e-spec.ts
index e954e969..f50df4f4 100644
--- a/packages/backend/test/local-providers.e2e-spec.ts
+++ b/packages/backend/test/local-providers.e2e-spec.ts
@@ -1,3 +1,4 @@
+import { randomBytes } from 'crypto';
 import { json } from 'express';
 import { INestApplication } from '@nestjs/common';
 import type { IncomingMessage, Server, ServerResponse } from 'http';
@@ -124,7 +125,7 @@ function anthropicStreamText(sse: string): string {
 // Issue #76: LM Studio and llama.cpp connected (201, auth_type local) but
 // every chat failed with "No endpoint configured for provider".
 describe('Built-in local providers: LM Studio and llama.cpp (e2e)', () => {
-  const ENV_KEYS = ['MANIFEST_MODE', 'THINKER_LMSTUDIO_BASE_URL', 'THINKER_LLAMACPP_BASE_URL'];
+  const ENV_KEYS = ['THINKER_LMSTUDIO_BASE_URL', 'THINKER_LLAMACPP_BASE_URL'];
   const savedEnv = Object.fromEntries(ENV_KEYS.map((key) => [key, process.env[key]]));
   let app: INestApplication;
   let lmstudio: MockServer;
@@ -138,8 +139,6 @@ describe('Built-in local providers: LM Studio and llama.cpp (e2e)', () => {
   beforeAll(async () => {
     lmstudio = await startLocalServer('lmstudio');
     llamacpp = await startLocalServer('llamacpp');
-    // Built-in local providers are self-hosted only.
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     process.env['THINKER_LMSTUDIO_BASE_URL'] = baseUrl(lmstudio);
     process.env['THINKER_LLAMACPP_BASE_URL'] = baseUrl(llamacpp);
 
@@ -296,22 +295,35 @@ describe('Built-in local providers: LM Studio and llama.cpp (e2e)', () => {
   );
 
   it('logs local requests under the canonical provider at zero cost', async () => {
+    // Earlier tests in this suite also log llama.cpp requests, and a row is
+    // written as `pending` before its usage lands. Tag this request with its
+    // own W3C trace id and wait for that one row to settle (#101).
+    const traceId = randomBytes(16).toString('hex');
     await proxy('/v1/chat/completions')
+      .set('traceparent', `00-${traceId}-${randomBytes(8).toString('hex')}-01`)
       .send({ model: 'llamacpp/gemma-3-4b-it', messages: [{ role: 'user', content: 'Hi' }] })
       .expect(200);
 
     const ds = app.get(DataSource);
     let rows: Json[] = [];
-    for (let i = 0; i < 50 && rows.length === 0; i++) {
+    for (let i = 0; i < 100 && rows.length === 0; i++) {
       rows = await ds.query(
-        `SELECT provider, model, cost_usd, input_tokens, output_tokens
-           FROM agent_messages WHERE agent_id = $1 AND provider = 'llamacpp'`,
-        [agentId],
+        `SELECT provider, model, cost_usd, input_tokens, output_tokens, status
+           FROM agent_messages
+          WHERE agent_id = $1 AND trace_id = $2 AND status <> 'pending'
+          ORDER BY timestamp ASC`,
+        [agentId, traceId],
       );
       if (rows.length === 0) await new Promise((resolve) => setTimeout(resolve, 100));
     }
-    expect(rows.length).toBeGreaterThan(0);
-    expect(rows[0]).toMatchObject({ provider: 'llamacpp', input_tokens: 7, output_tokens: 4 });
+    expect(rows).toHaveLength(1);
+    expect(rows[0]).toMatchObject({
+      provider: 'llamacpp',
+      model: 'gemma-3-4b-it',
+      status: 'success',
+      input_tokens: 7,
+      output_tokens: 4,
+    });
     expect(Number(rows[0].cost_usd ?? 0)).toBe(0);
   });
 });
diff --git a/packages/backend/test/mcp-cimd-ssrf.e2e-spec.ts b/packages/backend/test/mcp-cimd-ssrf.e2e-spec.ts
index 8ad8832b..6420ac0d 100644
--- a/packages/backend/test/mcp-cimd-ssrf.e2e-spec.ts
+++ b/packages/backend/test/mcp-cimd-ssrf.e2e-spec.ts
@@ -23,6 +23,7 @@ import { createServer, type AddressInfo, type Server, type Socket } from 'net';
 import { tmpdir } from 'os';
 import { join } from 'path';
 import { DataSource } from 'typeorm';
+import { resolveE2eDatabaseUrl } from './e2e-db-guard';
 
 const BACKEND = join(__dirname, '..');
 // Better Auth's own client_id check rejects localhost, IP literals and metadata
@@ -146,8 +147,8 @@ describe('MCP OAuth CIMD client_id SSRF guard (e2e)', () => {
     await new Promise<void>((resolve) => privateHost.listen(0, '127.0.0.1', resolve));
     privatePort = (privateHost.address() as AddressInfo).port;
 
-    const databaseUrl =
-      process.env['DATABASE_URL'] ?? 'postgresql://myuser:mypassword@localhost:5432/mydatabase';
+    // Refuses anything but an explicit, disposable test database (#67).
+    const databaseUrl = resolveE2eDatabaseUrl();
     // Start from an empty schema: the real server migrates on boot, and earlier
     // suites leave a synchronize()-built schema behind.
     const reset = new DataSource({ type: 'postgres', url: databaseUrl, dropSchema: true });
diff --git a/packages/backend/test/playground-request-headers.e2e-spec.ts b/packages/backend/test/playground-request-headers.e2e-spec.ts
index cef1dc93..f08ffe13 100644
--- a/packages/backend/test/playground-request-headers.e2e-spec.ts
+++ b/packages/backend/test/playground-request-headers.e2e-spec.ts
@@ -124,8 +124,6 @@ function parsePlaygroundSse(text: string): Json[] {
 // provider. Credential, tenant-identity, gateway and transport headers must
 // never reach the upstream; ordinary custom headers still must.
 describe('Playground extra request headers (e2e)', () => {
-  const ENV_KEYS = ['MANIFEST_MODE'];
-  const savedEnv = Object.fromEntries(ENV_KEYS.map((key) => [key, process.env[key]]));
   let app: INestApplication;
   let mock: { server: Server; received: Received[] };
   const providerIds: Record<'openai' | 'anthropic', string> = { openai: '', anthropic: '' };
@@ -134,8 +132,6 @@ describe('Playground extra request headers (e2e)', () => {
 
   beforeAll(async () => {
     mock = await startMockProvider();
-    // Custom providers on a loopback URL are allowed only when self-hosted.
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     app = await createTestApp();
 
     const port = (mock.server.address() as AddressInfo).port;
@@ -165,10 +161,6 @@ describe('Playground extra request headers (e2e)', () => {
   afterAll(async () => {
     await app?.close();
     if (mock) await closeServer(mock.server);
-    for (const key of ENV_KEYS) {
-      if (savedEnv[key] === undefined) delete process.env[key];
-      else process.env[key] = savedEnv[key];
-    }
   });
 
   async function runPlayground(
diff --git a/packages/backend/test/reserved-local-runner-aliases.e2e-spec.ts b/packages/backend/test/reserved-local-runner-aliases.e2e-spec.ts
index 4945b97a..869a7667 100644
--- a/packages/backend/test/reserved-local-runner-aliases.e2e-spec.ts
+++ b/packages/backend/test/reserved-local-runner-aliases.e2e-spec.ts
@@ -59,7 +59,7 @@ function rootUrl(mock: MockServer): string {
 // Issue #101: a custom provider could take the alias `lmstudio` and publish
 // the same ids as the built-in LM Studio connection.
 describe('Reserved local runner aliases (e2e)', () => {
-  const ENV_KEYS = ['MANIFEST_MODE', 'THINKER_LMSTUDIO_BASE_URL'];
+  const ENV_KEYS = ['THINKER_LMSTUDIO_BASE_URL'];
   const savedEnv = Object.fromEntries(ENV_KEYS.map((key) => [key, process.env[key]]));
   const agentName = 'alias-e2e';
   const headers = { 'x-api-key': TEST_API_KEY };
@@ -85,7 +85,6 @@ describe('Reserved local runner aliases (e2e)', () => {
   beforeAll(async () => {
     native = await startServer('native', ['qwen/qwen3-8b']);
     secondBox = await startServer('second-box', ['qwen/qwen3-8b', 'mistral-7b']);
-    process.env['MANIFEST_MODE'] = 'selfhosted';
     process.env['THINKER_LMSTUDIO_BASE_URL'] = rootUrl(native);
 
     app = await createTestApp({

From 8aa729a84debf71c71937f1600401aa37e426646 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Brand=C3=A3o?= <patrickbrandao@gmail.com>
Date: Sun, 11 Oct 2026 15:46:40 -0300
Subject: [PATCH 17/17] test(backend): escape host names fully in the egress
 spec patterns

CodeQL flagged js/incomplete-sanitization: only dots were escaped before
building a RegExp from the host constants.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/backend/test/no-phonehome-egress.e2e-spec.ts | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/packages/backend/test/no-phonehome-egress.e2e-spec.ts b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
index d11d8d8f..f44349fa 100644
--- a/packages/backend/test/no-phonehome-egress.e2e-spec.ts
+++ b/packages/backend/test/no-phonehome-egress.e2e-spec.ts
@@ -102,6 +102,11 @@ async function waitForHealth(base: string, child: ChildProcess, output: () => st
   throw new Error(`server did not become healthy:\n${output()}`);
 }
 
+/** Escapes every RegExp metacharacter so a host name matches literally. */
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 interface EgressRecord {
   kind: 'fetch' | 'dns';
   target: string;
@@ -111,17 +116,17 @@ describe('no phone-home egress', () => {
   it.each(FORBIDDEN_DESTINATIONS)(
     'names %s nowhere in the backend, CLI or shared source',
     (host) => {
-      expect(filesMatching(new RegExp(host.replace(/[.]/g, '\\.')))).toEqual([]);
+      expect(filesMatching(new RegExp(escapeRegExp(host)))).toEqual([]);
     },
   );
 
   it('names no hosted gateway host anywhere in the CLI or shared source, tests included', () => {
-    const pattern = new RegExp(HOSTED_GATEWAY_HOSTS.map((h) => h.replace(/[.]/g, '\\.')).join('|'));
+    const pattern = new RegExp(HOSTED_GATEWAY_HOSTS.map(escapeRegExp).join('|'));
     expect(filesMatching(pattern).filter((file) => /^(cli|shared)[\\/]/.test(file))).toEqual([]);
   });
 
   it('adds no backend production file naming a hosted gateway host', () => {
-    const pattern = new RegExp(HOSTED_GATEWAY_HOSTS.map((h) => h.replace(/[.]/g, '\\.')).join('|'));
+    const pattern = new RegExp(HOSTED_GATEWAY_HOSTS.map(escapeRegExp).join('|'));
     const backendFiles = filesMatching(pattern)
       .map((file) => file.split(sep).join('/'))
       .filter((file) => file.startsWith('backend/') && !/\.spec\.tsx?$/.test(file));