diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 000155ac8..7e0f4ca2e 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -370,3 +370,45 @@ jobs:
       # deliberate). Floating both halves keeps caller and callee in step,
       # which is the only configuration in which a pinned path cannot expire.
       enable-hydra-gates: true
+      # ── Cost controls (see ConductionNL/.github#596, #599) ───────────────
+      # Run PHPUnit and Playwright only when the diff could change their
+      # verdict. Fails safe TOWARDS running: an unreadable diff, a force-push,
+      # a branch creation or a dispatch all run everything, and a filtered
+      # skip is a declared state in the Quality Report, not a missing one.
+      enable-path-filtering: true
+      # PR-time PHPUnit runs the primary PHP against the newest declared
+      # Nextcloud; the full matrix still runs on every push to a default
+      # branch and on the release PR into beta. Breadth moves from
+      # per-commit to per-merge, it is not dropped.
+      reduce-pr-matrix: true
+
+  # ── l10n parity, as a WARNING ─────────────────────────────────────────────
+  # tests/l10n/check-l10n-parity.js ran in no CI lane, so #559 left 35 of the
+  # 36 required locales without "Admin settings" and nothing noticed for six
+  # days: gate-102 only guards nl.json, and only for manifest strings.
+  #
+  # It lives HERE, in this repo's own workflow, and not in the shared
+  # ConductionNL/.github quality.yml, whose changes reach the whole fleet the
+  # minute they merge. And it ships as a warning first, the way every new check
+  # does: a failure raises an annotation and marks this step, but
+  # `continue-on-error` keeps the job and the run green. Make it blocking once
+  # it has held for a while, by deleting `continue-on-error`.
+  #
+  # Dependency-free Node, so it needs no `npm ci`.
+  l10n-parity:
+    name: l10n parity (warning only)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Every required locale carries every source key
+        continue-on-error: true
+        run: |
+          if ! npm run --silent check:l10n-parity; then
+            echo "::warning title=l10n parity::A required locale is missing a translation. Warning only, not blocking: see this step's log for the locale and the key."
+            exit 1
+          fi
diff --git a/appinfo/info.xml b/appinfo/info.xml
index c050e2d66..fd5cc1b17 100644
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -10,49 +10,49 @@
 	<name lang="nl">LaunchPad</name>
 	<summary lang="en">Drag-and-drop dashboards with templates, tiles, and smart visibility</summary>
 	<summary lang="nl">Drag-and-drop dashboards met templates, tegels en slimme zichtbaarheid</summary>
-	<description lang="en"><![CDATA[LaunchPad supercharges the Nextcloud dashboard. Create personalized workspaces with drag-and-drop widgets, custom shortcut tiles, and smart visibility rules — then let admins roll out templates to entire teams.
-
-**Key Features**
-
-- **Drag-and-drop grid layout** — Position and resize widgets freely on a flexible grid
-- **Multiple dashboards** — Create as many dashboards as you need and switch between them
-- **Custom tiles** — Add shortcut cards with icons, colors, and links to your most-used tools
-- **Admin templates** — Pre-configure dashboards and distribute them to user groups with one click
-- **Permission levels** — Choose view-only, add-only, or full customization per template
-- **Conditional visibility** — Show or hide widgets based on group membership, time of day, or date
-- **Widget styling** — Customize colors, borders, and titles for each individual widget
-- **Compulsory widgets** — Admins can pin important widgets that users cannot remove
-- **Full Nextcloud compatibility** — Works with every existing Nextcloud dashboard widget out of the box
-- **Role-based widget access** — Restrict which widget types a group of users may add, resolved from Nextcloud group membership
-- **Dashboard sharing** — Share a dashboard with specific users or groups, or publish a brute-force-protected read-only public link
-- **Group dashboards** — One shared dashboard per group, in addition to personal dashboards
+	<description lang="en"><![CDATA[LaunchPad supercharges the Nextcloud dashboard. Create personalized workspaces with drag-and-drop widgets, custom shortcut tiles, and smart visibility rules. Admins roll out templates to entire teams.
+
+**Key features**
+
+- **Drag-and-drop grid layout**: Position and resize widgets freely on a flexible grid
+- **Multiple dashboards**: Create as many dashboards as you need and switch between them
+- **Custom tiles**: Add shortcut cards with icons, colors, and links to your most-used tools
+- **Admin templates**: Pre-configure dashboards and distribute them to user groups with one click
+- **Permission levels**: Choose view-only, add-only, or full customization per template
+- **Conditional visibility**: Show or hide widgets based on group membership, time of day, or date
+- **Widget styling**: Customize colors, borders, and titles for each individual widget
+- **Compulsory widgets**: Admins can pin important widgets that users cannot remove
+- **Full Nextcloud compatibility**: Works with every existing Nextcloud dashboard widget out of the box
+- **Role-based widget access**: Restrict which widget types a group of users may add, resolved from Nextcloud group membership
+- **Dashboard sharing**: Share a dashboard with specific users or groups, or publish a brute-force-protected read-only public link
+- **Group dashboards**: One shared dashboard per group, in addition to personal dashboards
 
 Perfect for organizations that want consistent, curated dashboards for their teams while still giving users freedom to personalize.
 
 Free and open source under the EUPL-1.2 license.
     ]]></description>
-	<description lang="nl"><![CDATA[LaunchPad geeft het Nextcloud-dashboard superkrachten. Maak persoonlijke werkruimtes met drag-and-drop widgets, eigen snelkoppelingstegels en slimme zichtbaarheidsregels — en laat beheerders templates uitrollen naar hele teams.
+	<description lang="nl"><![CDATA[LaunchPad geeft het Nextcloud-dashboard superkrachten. Maak persoonlijke werkruimtes met drag-and-drop widgets, eigen snelkoppelingstegels en slimme zichtbaarheidsregels. Beheerders rollen templates uit naar hele teams.
 
 **Belangrijkste functies**
 
-- **Drag-and-drop grid layout** — Positioneer en schaal widgets vrij op een flexibel raster
-- **Meerdere dashboards** — Maak zoveel dashboards als je nodig hebt en wissel ertussen
-- **Eigen tegels** — Voeg snelkoppelingskaarten toe met iconen, kleuren en links naar je meestgebruikte tools
-- **Beheerdertemplates** — Configureer dashboards vooraf en distribueer ze met een klik naar gebruikersgroepen
-- **Rechtenniveaus** — Kies tussen alleen bekijken, toevoegen, of volledige aanpassing per template
-- **Conditionele zichtbaarheid** — Toon of verberg widgets op basis van groepslidmaatschap, tijdstip of datum
-- **Widget-styling** — Pas kleuren, randen en titels aan voor elke individuele widget
-- **Verplichte widgets** — Beheerders kunnen belangrijke widgets vastzetten die gebruikers niet kunnen verwijderen
-- **Volledige Nextcloud-compatibiliteit** — Werkt direct met elke bestaande Nextcloud dashboard-widget
-- **Rolgebaseerde widget-toegang** — Beperk welke widget-types een gebruikersgroep mag toevoegen, op basis van Nextcloud-groepslidmaatschap
-- **Dashboards delen** — Deel een dashboard met specifieke gebruikers of groepen, of publiceer een tegen brute-force beveiligde alleen-lezen publieke link
-- **Groepsdashboards** — Eén gedeeld dashboard per groep, naast persoonlijke dashboards
+- **Drag-and-drop grid layout**: Positioneer en schaal widgets vrij op een flexibel raster
+- **Meerdere dashboards**: Maak zoveel dashboards als je nodig hebt en wissel ertussen
+- **Eigen tegels**: Voeg snelkoppelingskaarten toe met iconen, kleuren en links naar je meestgebruikte tools
+- **Beheerdertemplates**: Configureer dashboards vooraf en distribueer ze met een klik naar gebruikersgroepen
+- **Rechtenniveaus**: Kies tussen alleen bekijken, toevoegen, of volledige aanpassing per template
+- **Conditionele zichtbaarheid**: Toon of verberg widgets op basis van groepslidmaatschap, tijdstip of datum
+- **Widget-styling**: Pas kleuren, randen en titels aan voor elke individuele widget
+- **Verplichte widgets**: Beheerders kunnen belangrijke widgets vastzetten die gebruikers niet kunnen verwijderen
+- **Volledige Nextcloud-compatibiliteit**: Werkt direct met elke bestaande Nextcloud dashboard-widget
+- **Rolgebaseerde widget-toegang**: Beperk welke widget-types een gebruikersgroep mag toevoegen, op basis van Nextcloud-groepslidmaatschap
+- **Dashboards delen**: Deel een dashboard met specifieke gebruikers of groepen, of publiceer een tegen brute-force beveiligde alleen-lezen publieke link
+- **Groepsdashboards**: Eén gedeeld dashboard per groep, naast persoonlijke dashboards
 
 Ideaal voor organisaties die consistente, samengestelde dashboards willen voor hun teams, terwijl gebruikers de vrijheid houden om te personaliseren.
 
 Vrij en open source onder de EUPL-1.2-licentie.
     ]]></description>
-	<version>1.0.25-unstable.20260831161142</version>
+	<version>1.1.4-unstable.20260910141110</version>
 	<licence>EUPL-1.2</licence>
 	<author mail="info@conduction.nl" homepage="https://www.conduction.nl/">Conduction</author>
 	<namespace>LaunchPad</namespace>
diff --git a/appinfo/routes.php b/appinfo/routes.php
index d16a23be7..73c709ada 100644
--- a/appinfo/routes.php
+++ b/appinfo/routes.php
@@ -21,6 +21,24 @@
 		['name' => 'metrics#index', 'url' => '/api/metrics', 'verb' => 'GET'],
 		['name' => 'health#index', 'url' => '/api/health', 'verb' => 'GET'],
 
+		// Store plane (ADR-080). LaunchPad declares a `type: "store"` page, which
+		// renders CnStorePage, which calls the item routes on mount and on an install
+		// click. Without them that page is in the navigation and 404s.
+		//
+		// Discovery is OpenRegister's `GenericStoreService`; install is ours,
+		// because a dashboard lives in LaunchPad's tables and no engine install
+		// op can write one. `store#*` therefore resolves to
+		// `OCA\LaunchPad\Controller\StoreController`, which is also what keeps
+		// the engine's alias off this app (see that class).
+		//
+		// The slug requirement matches the engine's, so a malformed slug fails
+		// at the router rather than inside a registry URL.
+		['name' => 'store#search', 'url' => '/api/store/items', 'verb' => 'GET'],
+		['name' => 'store#getConfig', 'url' => '/api/store/config', 'verb' => 'GET'],
+		['name' => 'store#updateConfig', 'url' => '/api/store/config', 'verb' => 'PUT'],
+		['name' => 'store#install', 'url' => '/api/store/items/{slug}/install', 'verb' => 'POST',
+		 'requirements' => ['slug' => '[a-z0-9][a-z0-9\-]*[a-z0-9]']],
+
 		// Generic per-user preferences (used by shared nextcloud-vue widgets, e.g. CnSupportDialog).
 		['name' => 'preferences#getPreference', 'url' => '/api/preferences/{key}', 'verb' => 'GET'],
 		['name' => 'preferences#setPreference', 'url' => '/api/preferences/{key}', 'verb' => 'PUT'],
diff --git a/composer.json b/composer.json
index 2662f4cf8..566e4d6ad 100644
--- a/composer.json
+++ b/composer.json
@@ -47,10 +47,10 @@
         "phpcs": "./vendor/bin/phpcs --standard=phpcs.xml",
         "phpcs:fix": "./vendor/bin/phpcbf --standard=phpcs.xml",
         "phpcs:output": "./vendor/bin/phpcs --standard=phpcs.xml --report=json lib/ 2>/dev/null | tail -1 > phpcs-output.json",
-        "phpmd": "E=0; ./vendor/bin/phpmd lib text phpmd.xml || E=$?; ./vendor/bin/phpmd lib text vendor/conduction/hydra-gates/quality-config/phpmd-unusedparams.xml --baseline-file phpmd.baseline.xml || E=$?; exit $E",
+        "phpmd": "E=0; php -d memory_limit=2G ./vendor/bin/phpmd lib text phpmd.xml || E=$?; php -d memory_limit=2G ./vendor/bin/phpmd lib text vendor/conduction/hydra-gates/quality-config/phpmd-unusedparams.xml --baseline-file phpmd.baseline.xml || E=$?; exit $E",
         "phpmetrics": "./vendor/bin/phpmetrics --report-html=phpmetrics lib/",
         "phpmetrics:violations": "./vendor/bin/phpmetrics --violations-xml=phpmetrics/violations.xml lib/",
-        "psalm": "./vendor/bin/psalm --threads=1 --no-cache",
+        "psalm": "./vendor/bin/psalm --threads=1 --no-cache --memory-limit=2G",
         "phpstan": "./vendor/bin/phpstan analyse --memory-limit=1G",
         "test": "phpunit --configuration phpunit.xml",
         "test:unit": "./vendor/bin/phpunit --configuration phpunit.xml --colors=always",
diff --git a/composer.lock b/composer.lock
index 5847ff418..33f42c653 100644
--- a/composer.lock
+++ b/composer.lock
@@ -512,16 +512,16 @@
         },
         {
             "name": "conduction/hydra-gates",
-            "version": "v1.15.0",
+            "version": "v1.18.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/ConductionNL/.github.git",
-                "reference": "0bc214023be78aac94142035a9988986cfccccbc"
+                "reference": "477f930e84f1b3e709d2fb645d7c303d8d39a994"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/ConductionNL/.github/zipball/0bc214023be78aac94142035a9988986cfccccbc",
-                "reference": "0bc214023be78aac94142035a9988986cfccccbc",
+                "url": "https://api.github.com/repos/ConductionNL/.github/zipball/477f930e84f1b3e709d2fb645d7c303d8d39a994",
+                "reference": "477f930e84f1b3e709d2fb645d7c303d8d39a994",
                 "shasum": ""
             },
             "require": {
@@ -560,9 +560,9 @@
             "support": {
                 "docs": "https://github.com/ConductionNL/.github/blob/main/hydra-gates/README.md",
                 "issues": "https://github.com/ConductionNL/.github/issues",
-                "source": "https://github.com/ConductionNL/.github/tree/v1.15.0"
+                "source": "https://github.com/ConductionNL/.github/tree/v1.18.0"
             },
-            "time": "2026-09-04T16:24:04+00:00"
+            "time": "2026-09-10T10:15:53+00:00"
         },
         {
             "name": "consolidation/annotated-command",
@@ -3220,11 +3220,11 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "2.2.12",
+            "version": "2.2.13",
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/174b0d88710f00a42598886504dd7a146f91ace5",
-                "reference": "174b0d88710f00a42598886504dd7a146f91ace5",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/9ba9ac76ee9c5cf5b56d58eb5deec6315b7a0260",
+                "reference": "9ba9ac76ee9c5cf5b56d58eb5deec6315b7a0260",
                 "shasum": ""
             },
             "require": {
@@ -3280,7 +3280,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-08-31T19:09:43+00:00"
+            "time": "2026-09-03T20:38:19+00:00"
         },
         {
             "name": "phpunit/php-code-coverage",
diff --git a/data/demo-showcases/case-handler/case-handler.zip b/data/demo-showcases/case-handler/case-handler.zip
new file mode 100644
index 000000000..9f0f9460b
Binary files /dev/null and b/data/demo-showcases/case-handler/case-handler.zip differ
diff --git a/img/showcases/case-handler.png b/img/showcases/case-handler.png
new file mode 100644
index 000000000..248fb0977
Binary files /dev/null and b/img/showcases/case-handler.png differ
diff --git a/l10n/be.js b/l10n/be.js
index ae8629fc1..b0e434211 100644
--- a/l10n/be.js
+++ b/l10n/be.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Налады адміністравання",
     "Features & roadmap" : "Функцыі і дарожная карта",
     "Maximum dashboards per user" : "Максімальная колькасць дашбордаў на карыстальніка",
     "Maximum widgets per dashboard" : "Максімальная колькасць віджэтаў на дашборд",
@@ -1113,7 +1114,6 @@ OC.L10N.register(
     "Kind": "Від",
     "Version": "Версія",
     "How many dashboards there are, and who they belong to.": "Колькі ёсць панэляў і каму яны належаць.",
-    "Store": "Крама",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Усталюйце рэестры, схемы і патокі, апублікаваныя іншымі арганізацыямі."
+    "Store": "Крама"
 },
 "nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);");
diff --git a/l10n/be.json b/l10n/be.json
index f6ef36c15..28429c50b 100644
--- a/l10n/be.json
+++ b/l10n/be.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Налады адміністравання",
         "Maximum dashboards per user": "Максімальная колькасць дашбордаў на карыстальніка",
         "Maximum widgets per dashboard": "Максімальная колькасць віджэтаў на дашборд",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = без абмежаванняў. Зніжэнне ліміту ніколі не выдаляе існуючыя дашборды; яно толькі блакуе стварэнне новых, пакуль карыстальнікі не вернуцца пад ліміт.",
@@ -1090,7 +1091,6 @@
         "Kind": "Від",
         "Version": "Версія",
         "How many dashboards there are, and who they belong to.": "Колькі ёсць панэляў і каму яны належаць.",
-        "Store": "Крама",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Усталюйце рэестры, схемы і патокі, апублікаваныя іншымі арганізацыямі."
+        "Store": "Крама"
     }
 }
diff --git a/l10n/bg.js b/l10n/bg.js
index 80ffa6906..880d1d362 100644
--- a/l10n/bg.js
+++ b/l10n/bg.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Административни настройки",
     "Features & roadmap" : "Функции и пътна карта",
     "Maximum dashboards per user" : "Максимален брой табла на потребител",
     "Maximum widgets per dashboard" : "Максимален брой джаджи на табло",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Вид",
     "Version": "Версия",
     "How many dashboards there are, and who they belong to.": "Колко табла има и на кого принадлежат.",
-    "Store": "Магазин",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Инсталирайте регистри, схеми и потоци, публикувани от други организации."
+    "Store": "Магазин"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/bg.json b/l10n/bg.json
index c25bf273f..cf72a1c8f 100644
--- a/l10n/bg.json
+++ b/l10n/bg.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Административни настройки",
         "Maximum dashboards per user": "Максимален брой табла на потребител",
         "Maximum widgets per dashboard": "Максимален брой джаджи на табло",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = неограничено. Намаляването на ограничение никога не изтрива съществуващи табла; то само блокира новите, докато потребителите не се върнат под ограничението.",
@@ -1089,7 +1090,6 @@
         "Kind": "Вид",
         "Version": "Версия",
         "How many dashboards there are, and who they belong to.": "Колко табла има и на кого принадлежат.",
-        "Store": "Магазин",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Инсталирайте регистри, схеми и потоци, публикувани от други организации."
+        "Store": "Магазин"
     }
 }
diff --git a/l10n/bs.js b/l10n/bs.js
index 220f00d1b..06ceff758 100644
--- a/l10n/bs.js
+++ b/l10n/bs.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Admin settings",
     "Features & roadmap" : "Funkcije i plan razvoja",
     "Maximum dashboards per user" : "Maksimalan broj nadzornih ploča po korisniku",
     "Maximum widgets per dashboard" : "Maksimalan broj widgeta po nadzornoj ploči",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Vrsta",
     "Version": "Verzija",
     "How many dashboards there are, and who they belong to.": "Koliko ima kontrolnih tabli i kome pripadaju.",
-    "Store": "Trgovina",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instalirajte registre, šeme i tokove koje su objavile druge organizacije."
+    "Store": "Trgovina"
 },
 "nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);"
 );
diff --git a/l10n/bs.json b/l10n/bs.json
index 5616784b5..f8c906f49 100644
--- a/l10n/bs.json
+++ b/l10n/bs.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Admin settings",
         "Maximum dashboards per user": "Maksimalan broj nadzornih ploča po korisniku",
         "Maximum widgets per dashboard": "Maksimalan broj widgeta po nadzornoj ploči",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = neograničeno. Snižavanje ograničenja nikada ne briše postojeće nadzorne ploče; samo blokira nove dok se korisnici ne vrate ispod ograničenja.",
@@ -1090,7 +1091,6 @@
         "Kind": "Vrsta",
         "Version": "Verzija",
         "How many dashboards there are, and who they belong to.": "Koliko ima kontrolnih tabli i kome pripadaju.",
-        "Store": "Trgovina",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instalirajte registre, šeme i tokove koje su objavile druge organizacije."
+        "Store": "Trgovina"
     }
 }
diff --git a/l10n/ca.js b/l10n/ca.js
index 91f3d38bb..2bd88f34e 100644
--- a/l10n/ca.js
+++ b/l10n/ca.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Paràmetres d'administració",
     "Features & roadmap" : "Funcions i full de ruta",
     "Maximum dashboards per user" : "Màxim de taulers per usuari",
     "Maximum widgets per dashboard" : "Màxim de ginys per tauler",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Tipus",
     "Version": "Versió",
     "How many dashboards there are, and who they belong to.": "Quants taulers hi ha i a qui pertanyen.",
-    "Store": "Botiga",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instal·leu registres, esquemes i fluxos publicats per altres organitzacions."
+    "Store": "Botiga"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/ca.json b/l10n/ca.json
index e398926f3..577c887a7 100644
--- a/l10n/ca.json
+++ b/l10n/ca.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Paràmetres d'administració",
         "Maximum dashboards per user": "Màxim de taulers per usuari",
         "Maximum widgets per dashboard": "Màxim de ginys per tauler",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = il·limitat. Reduir un límit mai no suprimeix els taulers existents; només bloqueja els nous fins que els usuaris tornin a estar per sota del límit.",
@@ -1089,7 +1090,6 @@
         "Kind": "Tipus",
         "Version": "Versió",
         "How many dashboards there are, and who they belong to.": "Quants taulers hi ha i a qui pertanyen.",
-        "Store": "Botiga",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instal·leu registres, esquemes i fluxos publicats per altres organitzacions."
+        "Store": "Botiga"
     }
 }
diff --git a/l10n/cs.js b/l10n/cs.js
index 772d8d852..dcef39851 100644
--- a/l10n/cs.js
+++ b/l10n/cs.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Nastavení pro správu",
     "Features & roadmap" : "Funkce a plán vývoje",
     "Maximum dashboards per user" : "Maximální počet dashboardů na uživatele",
     "Maximum widgets per dashboard" : "Maximální počet widgetů na dashboard",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Druh",
     "Version": "Verze",
     "How many dashboards there are, and who they belong to.": "Kolik je přehledů a komu patří.",
-    "Store": "Obchod",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Nainstalujte registry, schémata a toky zveřejněné jinými organizacemi."
+    "Store": "Obchod"
 },
 "nplurals=3; plural=(n==1) ? 0 : (n>=2 && n<=4) ? 1 : 2;"
 );
diff --git a/l10n/cs.json b/l10n/cs.json
index 964024b54..a5e38c6e3 100644
--- a/l10n/cs.json
+++ b/l10n/cs.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Nastavení pro správu",
         "Maximum dashboards per user": "Maximální počet dashboardů na uživatele",
         "Maximum widgets per dashboard": "Maximální počet widgetů na dashboard",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = neomezeno. Snížení limitu nikdy neodstraní stávající dashboardy; pouze zablokuje nové, dokud se uživatelé nevrátí pod limit.",
@@ -1090,7 +1091,6 @@
         "Kind": "Druh",
         "Version": "Verze",
         "How many dashboards there are, and who they belong to.": "Kolik je přehledů a komu patří.",
-        "Store": "Obchod",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Nainstalujte registry, schémata a toky zveřejněné jinými organizacemi."
+        "Store": "Obchod"
     }
 }
diff --git a/l10n/da.js b/l10n/da.js
index 703b7d4cd..57cebacd9 100644
--- a/l10n/da.js
+++ b/l10n/da.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Systemindstillinger",
     "Features & roadmap" : "Funktioner og køreplan",
     "Maximum dashboards per user" : "Maksimalt antal dashboards pr. bruger",
     "Maximum widgets per dashboard" : "Maksimalt antal widgets pr. dashboard",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Type",
     "Version": "Version",
     "How many dashboards there are, and who they belong to.": "Hvor mange dashboards der er, og hvem de tilhører.",
-    "Store": "Butik",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installer registre, skemaer og flows, som andre organisationer har udgivet."
+    "Store": "Butik"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/da.json b/l10n/da.json
index b5b01f1df..7bdf63425 100644
--- a/l10n/da.json
+++ b/l10n/da.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Systemindstillinger",
         "Maximum dashboards per user": "Maksimalt antal dashboards pr. bruger",
         "Maximum widgets per dashboard": "Maksimalt antal widgets pr. dashboard",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = ubegrænset. Sænkning af en grænse sletter aldrig eksisterende dashboards; den blokerer kun nye, indtil brugerne igen er under grænsen.",
@@ -1089,7 +1090,6 @@
         "Kind": "Type",
         "Version": "Version",
         "How many dashboards there are, and who they belong to.": "Hvor mange dashboards der er, og hvem de tilhører.",
-        "Store": "Butik",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installer registre, skemaer og flows, som andre organisationer har udgivet."
+        "Store": "Butik"
     }
 }
diff --git a/l10n/de.js b/l10n/de.js
index 076fefe4c..c07f0e248 100644
--- a/l10n/de.js
+++ b/l10n/de.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Administrationseinstellungen",
     "Features & roadmap" : "Funktionen und Roadmap",
     "Maximum dashboards per user" : "Maximale Dashboards pro Benutzer",
     "Maximum widgets per dashboard" : "Maximale Widgets pro Dashboard",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Art",
     "Version": "Version",
     "How many dashboards there are, and who they belong to.": "Wie viele Dashboards es gibt und wem sie gehören.",
-    "Store": "Store",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installieren Sie Register, Schemata und Flows, die andere Organisationen veröffentlicht haben."
+    "Store": "Store"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/de.json b/l10n/de.json
index b9aee2771..8132dff65 100644
--- a/l10n/de.json
+++ b/l10n/de.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Administrationseinstellungen",
         "Maximum dashboards per user": "Maximale Dashboards pro Benutzer",
         "Maximum widgets per dashboard": "Maximale Widgets pro Dashboard",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = unbegrenzt. Das Verringern eines Limits löscht niemals vorhandene Dashboards; es blockiert nur neue, bis Benutzer wieder unter dem Limit sind.",
@@ -1089,7 +1090,6 @@
         "Kind": "Art",
         "Version": "Version",
         "How many dashboards there are, and who they belong to.": "Wie viele Dashboards es gibt und wem sie gehören.",
-        "Store": "Store",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installieren Sie Register, Schemata und Flows, die andere Organisationen veröffentlicht haben."
+        "Store": "Store"
     }
 }
diff --git a/l10n/el.js b/l10n/el.js
index 0f2a2d448..1e9ede047 100644
--- a/l10n/el.js
+++ b/l10n/el.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Ρυθμίσεις διαχείρισης",
     "Features & roadmap" : "Λειτουργίες και οδικός χάρτης",
     "Maximum dashboards per user" : "Μέγιστος αριθμός πινάκων ανά χρήστη",
     "Maximum widgets per dashboard" : "Μέγιστος αριθμός widget ανά πίνακα",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Είδος",
     "Version": "Έκδοση",
     "How many dashboards there are, and who they belong to.": "Πόσοι πίνακες υπάρχουν και σε ποιον ανήκουν.",
-    "Store": "Κατάστημα",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Εγκαταστήστε μητρώα, σχήματα και ροές που έχουν δημοσιεύσει άλλοι οργανισμοί."
+    "Store": "Κατάστημα"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/el.json b/l10n/el.json
index 39d7a422f..2692ca19e 100644
--- a/l10n/el.json
+++ b/l10n/el.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Ρυθμίσεις διαχείρισης",
         "Maximum dashboards per user": "Μέγιστος αριθμός πινάκων ανά χρήστη",
         "Maximum widgets per dashboard": "Μέγιστος αριθμός widget ανά πίνακα",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = απεριόριστο. Η μείωση ενός ορίου δεν διαγράφει ποτέ υπάρχοντες πίνακες· απλώς μπλοκάρει τη δημιουργία νέων μέχρι οι χρήστες να επανέλθουν κάτω από το όριο.",
@@ -1089,7 +1090,6 @@
         "Kind": "Είδος",
         "Version": "Έκδοση",
         "How many dashboards there are, and who they belong to.": "Πόσοι πίνακες υπάρχουν και σε ποιον ανήκουν.",
-        "Store": "Κατάστημα",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Εγκαταστήστε μητρώα, σχήματα και ροές που έχουν δημοσιεύσει άλλοι οργανισμοί."
+        "Store": "Κατάστημα"
     }
 }
diff --git a/l10n/en.js b/l10n/en.js
index 0bf06cfaa..bb3cf1c5b 100644
--- a/l10n/en.js
+++ b/l10n/en.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Admin settings",
     "Features & roadmap" : "Features & roadmap",
     "share_not_found" : "Share not found",
     "share_expired" : "This share has expired",
diff --git a/l10n/es.js b/l10n/es.js
index 6243efa2e..57429e95e 100644
--- a/l10n/es.js
+++ b/l10n/es.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Configuraciones de administración",
     "Features & roadmap" : "Funciones y hoja de ruta",
     "Maximum dashboards per user" : "Máximo de paneles por usuario",
     "Maximum widgets per dashboard" : "Máximo de widgets por panel",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Tipo",
     "Version": "Versión",
     "How many dashboards there are, and who they belong to.": "Cuántos paneles hay y a quién pertenecen.",
-    "Store": "Tienda",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instale registros, esquemas y flujos publicados por otras organizaciones."
+    "Store": "Tienda"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/es.json b/l10n/es.json
index d91406652..7e5e8a942 100644
--- a/l10n/es.json
+++ b/l10n/es.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Configuraciones de administración",
         "Maximum dashboards per user": "Máximo de paneles por usuario",
         "Maximum widgets per dashboard": "Máximo de widgets por panel",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = sin límite. Reducir un límite nunca elimina los paneles existentes; solo bloquea los nuevos hasta que los usuarios vuelvan a estar por debajo del límite.",
@@ -1089,7 +1090,6 @@
         "Kind": "Tipo",
         "Version": "Versión",
         "How many dashboards there are, and who they belong to.": "Cuántos paneles hay y a quién pertenecen.",
-        "Store": "Tienda",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instale registros, esquemas y flujos publicados por otras organizaciones."
+        "Store": "Tienda"
     }
 }
diff --git a/l10n/et.js b/l10n/et.js
index a6c0a3acf..c72bc77cb 100644
--- a/l10n/et.js
+++ b/l10n/et.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Administreerimise seaded",
     "Features & roadmap" : "Funktsioonid ja teekaart",
     "Maximum dashboards per user" : "Töölaudade maksimumarv kasutaja kohta",
     "Maximum widgets per dashboard" : "Vidinate maksimumarv töölaua kohta",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Liik",
     "Version": "Versioon",
     "How many dashboards there are, and who they belong to.": "Kui palju töölaudu on ja kellele need kuuluvad.",
-    "Store": "Pood",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Paigalda registrid, skeemid ja voog, mille teised organisatsioonid on avaldanud."
+    "Store": "Pood"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/et.json b/l10n/et.json
index 85440907e..876ff0165 100644
--- a/l10n/et.json
+++ b/l10n/et.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Administreerimise seaded",
         "Maximum dashboards per user": "Töölaudade maksimumarv kasutaja kohta",
         "Maximum widgets per dashboard": "Vidinate maksimumarv töölaua kohta",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = piiramatu. Piirangu vähendamine ei kustuta kunagi olemasolevaid töölaudu; see üksnes blokeerib uute loomise, kuni kasutajad on jälle piirist allpool.",
@@ -1089,7 +1090,6 @@
         "Kind": "Liik",
         "Version": "Versioon",
         "How many dashboards there are, and who they belong to.": "Kui palju töölaudu on ja kellele need kuuluvad.",
-        "Store": "Pood",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Paigalda registrid, skeemid ja voog, mille teised organisatsioonid on avaldanud."
+        "Store": "Pood"
     }
 }
diff --git a/l10n/fi.js b/l10n/fi.js
index 9afdecf86..6e355f626 100644
--- a/l10n/fi.js
+++ b/l10n/fi.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Ylläpitäjän asetukset",
     "Features & roadmap" : "Ominaisuudet ja tiekartta",
     "Maximum dashboards per user" : "Koontinäyttöjen enimmäismäärä käyttäjää kohden",
     "Maximum widgets per dashboard" : "Pienoisohjelmien enimmäismäärä koontinäyttöä kohden",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Laji",
     "Version": "Versio",
     "How many dashboards there are, and who they belong to.": "Kuinka monta koontinäyttöä on ja kenelle ne kuuluvat.",
-    "Store": "Kauppa",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Asenna muiden organisaatioiden julkaisemia rekistereitä, skeemoja ja vuokaavioita."
+    "Store": "Kauppa"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/fi.json b/l10n/fi.json
index d8874af76..d8a67eb5a 100644
--- a/l10n/fi.json
+++ b/l10n/fi.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Ylläpitäjän asetukset",
         "Maximum dashboards per user": "Koontinäyttöjen enimmäismäärä käyttäjää kohden",
         "Maximum widgets per dashboard": "Pienoisohjelmien enimmäismäärä koontinäyttöä kohden",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = rajoittamaton. Rajan alentaminen ei koskaan poista olemassa olevia koontinäyttöjä; se vain estää uusien luomisen, kunnes käyttäjät ovat jälleen rajan alapuolella.",
@@ -1089,7 +1090,6 @@
         "Kind": "Laji",
         "Version": "Versio",
         "How many dashboards there are, and who they belong to.": "Kuinka monta koontinäyttöä on ja kenelle ne kuuluvat.",
-        "Store": "Kauppa",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Asenna muiden organisaatioiden julkaisemia rekistereitä, skeemoja ja vuokaavioita."
+        "Store": "Kauppa"
     }
 }
diff --git a/l10n/fr.js b/l10n/fr.js
index 93e86e612..51d66638f 100644
--- a/l10n/fr.js
+++ b/l10n/fr.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Paramètres d'administration",
     "Features & roadmap" : "Fonctionnalités et feuille de route",
     "Maximum dashboards per user" : "Nombre maximal de tableaux de bord par utilisateur",
     "Maximum widgets per dashboard" : "Nombre maximal de widgets par tableau de bord",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Type",
     "Version": "Version",
     "How many dashboards there are, and who they belong to.": "Combien de tableaux de bord il y a, et à qui ils appartiennent.",
-    "Store": "Boutique",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installez des registres, schémas et flux publiés par d'autres organisations."
+    "Store": "Boutique"
 },
 "nplurals=2; plural=(n > 1);"
 );
diff --git a/l10n/fr.json b/l10n/fr.json
index fe423b618..caee966ce 100644
--- a/l10n/fr.json
+++ b/l10n/fr.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Paramètres d'administration",
         "Maximum dashboards per user": "Nombre maximal de tableaux de bord par utilisateur",
         "Maximum widgets per dashboard": "Nombre maximal de widgets par tableau de bord",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = illimité. Réduire une limite ne supprime jamais les tableaux de bord existants ; cela bloque uniquement les nouveaux jusqu’à ce que les utilisateurs repassent sous la limite.",
@@ -1089,7 +1090,6 @@
         "Kind": "Type",
         "Version": "Version",
         "How many dashboards there are, and who they belong to.": "Combien de tableaux de bord il y a, et à qui ils appartiennent.",
-        "Store": "Boutique",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installez des registres, schémas et flux publiés par d'autres organisations."
+        "Store": "Boutique"
     }
 }
diff --git a/l10n/ga.js b/l10n/ga.js
index dbf5623b9..5ce064b10 100644
--- a/l10n/ga.js
+++ b/l10n/ga.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Socruithe riaracháin",
     "Features & roadmap" : "Gnéithe agus treochlár",
     "Maximum dashboards per user" : "Uaslíon deais-chláir in aghaidh an úsáideora",
     "Maximum widgets per dashboard" : "Uaslíon giuirléidí in aghaidh an deais-chláir",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Cineál",
     "Version": "Leagan",
     "How many dashboards there are, and who they belong to.": "Cé mhéad painéal atá ann, agus cé leis iad.",
-    "Store": "Siopa",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Suiteáil cláir, scéimeanna agus sruthanna a d'fhoilsigh eagraíochtaí eile."
+    "Store": "Siopa"
 },
 "nplurals=5; plural=(n==1 ? 0 : n==2 ? 1 : n<7 ? 2 : n<11 ? 3 : 4);"
 );
diff --git a/l10n/ga.json b/l10n/ga.json
index 2df121449..ca50e5947 100644
--- a/l10n/ga.json
+++ b/l10n/ga.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Socruithe riaracháin",
         "Maximum dashboards per user": "Uaslíon deais-chláir in aghaidh an úsáideora",
         "Maximum widgets per dashboard": "Uaslíon giuirléidí in aghaidh an deais-chláir",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = gan teorainn. Ní scriosann ísliú teorann deais-chláir atá ann cheana; ní dhéanann sé ach cinn nua a bhac go dtí go mbeidh úsáideoirí faoin teorainn arís.",
@@ -1092,7 +1093,6 @@
         "Kind": "Cineál",
         "Version": "Leagan",
         "How many dashboards there are, and who they belong to.": "Cé mhéad painéal atá ann, agus cé leis iad.",
-        "Store": "Siopa",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Suiteáil cláir, scéimeanna agus sruthanna a d'fhoilsigh eagraíochtaí eile."
+        "Store": "Siopa"
     }
 }
diff --git a/l10n/hr.js b/l10n/hr.js
index 38b1fb360..0e1ce400a 100644
--- a/l10n/hr.js
+++ b/l10n/hr.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Admin settings",
     "Features & roadmap" : "Značajke i plan razvoja",
     "Maximum dashboards per user" : "Najveći broj nadzornih ploča po korisniku",
     "Maximum widgets per dashboard" : "Najveći broj widgeta po nadzornoj ploči",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Vrsta",
     "Version": "Verzija",
     "How many dashboards there are, and who they belong to.": "Koliko nadzornih ploča ima i kome pripadaju.",
-    "Store": "Trgovina",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instalirajte registre, sheme i tokove koje su objavile druge organizacije."
+    "Store": "Trgovina"
 },
 "nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);"
 );
diff --git a/l10n/hr.json b/l10n/hr.json
index 954d1e411..9ae1c8436 100644
--- a/l10n/hr.json
+++ b/l10n/hr.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Admin settings",
         "Maximum dashboards per user": "Najveći broj nadzornih ploča po korisniku",
         "Maximum widgets per dashboard": "Najveći broj widgeta po nadzornoj ploči",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = neograničeno. Snižavanje ograničenja nikada ne briše postojeće nadzorne ploče; samo blokira nove dok se korisnici ne vrate ispod ograničenja.",
@@ -1090,7 +1091,6 @@
         "Kind": "Vrsta",
         "Version": "Verzija",
         "How many dashboards there are, and who they belong to.": "Koliko nadzornih ploča ima i kome pripadaju.",
-        "Store": "Trgovina",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instalirajte registre, sheme i tokove koje su objavile druge organizacije."
+        "Store": "Trgovina"
     }
 }
diff --git a/l10n/hu.js b/l10n/hu.js
index 97af73a64..373fa5bd4 100644
--- a/l10n/hu.js
+++ b/l10n/hu.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Rendszergazdai beállítások",
     "Features & roadmap" : "Funkciók és ütemterv",
     "Maximum dashboards per user" : "Felhasználónkénti maximális irányítópultok száma",
     "Maximum widgets per dashboard" : "Irányítópultonkénti maximális modulok száma",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Fajta",
     "Version": "Verzió",
     "How many dashboards there are, and who they belong to.": "Hány irányítópult van, és kihez tartoznak.",
-    "Store": "Áruház",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Telepítsen más szervezetek által közzétett nyilvántartásokat, sémákat és folyamatokat."
+    "Store": "Áruház"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/hu.json b/l10n/hu.json
index b63a6ee64..0a50f14f6 100644
--- a/l10n/hu.json
+++ b/l10n/hu.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Rendszergazdai beállítások",
         "Maximum dashboards per user": "Felhasználónkénti maximális irányítópultok száma",
         "Maximum widgets per dashboard": "Irányítópultonkénti maximális modulok száma",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = korlátlan. A korlát csökkentése soha nem törli a meglévő irányítópultokat; csak az újak létrehozását tiltja, amíg a felhasználók ismét a korlát alá nem kerülnek.",
@@ -1089,7 +1090,6 @@
         "Kind": "Fajta",
         "Version": "Verzió",
         "How many dashboards there are, and who they belong to.": "Hány irányítópult van, és kihez tartoznak.",
-        "Store": "Áruház",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Telepítsen más szervezetek által közzétett nyilvántartásokat, sémákat és folyamatokat."
+        "Store": "Áruház"
     }
 }
diff --git a/l10n/is.js b/l10n/is.js
index a5f931d47..147f95504 100644
--- a/l10n/is.js
+++ b/l10n/is.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Stillingar stjórnunar",
     "Features & roadmap" : "Eiginleikar og vegvísir",
     "Maximum dashboards per user" : "Hámarksfjöldi mælaborða á notanda",
     "Maximum widgets per dashboard" : "Hámarksfjöldi viðmótshluta á mælaborð",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Tegund",
     "Version": "Útgáfa",
     "How many dashboards there are, and who they belong to.": "Hversu mörg mælaborð eru til og hverjum þau tilheyra.",
-    "Store": "Verslun",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Settu upp skrár, skemu og flæði sem aðrar stofnanir hafa birt."
+    "Store": "Verslun"
 },
 "nplurals=2; plural=(n%10!=1 || n%100==11);"
 );
diff --git a/l10n/is.json b/l10n/is.json
index a2ccedfe4..1b99975db 100644
--- a/l10n/is.json
+++ b/l10n/is.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Stillingar stjórnunar",
         "Maximum dashboards per user": "Hámarksfjöldi mælaborða á notanda",
         "Maximum widgets per dashboard": "Hámarksfjöldi viðmótshluta á mælaborð",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = ótakmarkað. Lækkun á mörkum eyðir aldrei núverandi mælaborðum; hún hindrar aðeins ný þar til notendur eru aftur undir mörkunum.",
@@ -1089,7 +1090,6 @@
         "Kind": "Tegund",
         "Version": "Útgáfa",
         "How many dashboards there are, and who they belong to.": "Hversu mörg mælaborð eru til og hverjum þau tilheyra.",
-        "Store": "Verslun",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Settu upp skrár, skemu og flæði sem aðrar stofnanir hafa birt."
+        "Store": "Verslun"
     }
 }
diff --git a/l10n/it.js b/l10n/it.js
index eacd46bf1..5f58b50f8 100644
--- a/l10n/it.js
+++ b/l10n/it.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Impostazioni di amministrazione",
     "Features & roadmap" : "Funzionalità e roadmap",
     "Maximum dashboards per user" : "Numero massimo di dashboard per utente",
     "Maximum widgets per dashboard" : "Numero massimo di widget per dashboard",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Tipo",
     "Version": "Versione",
     "How many dashboards there are, and who they belong to.": "Quante dashboard ci sono e a chi appartengono.",
-    "Store": "Store",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installa registri, schemi e flussi pubblicati da altre organizzazioni."
+    "Store": "Store"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/it.json b/l10n/it.json
index 4adb4eb72..262f00b62 100644
--- a/l10n/it.json
+++ b/l10n/it.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Impostazioni di amministrazione",
         "Maximum dashboards per user": "Numero massimo di dashboard per utente",
         "Maximum widgets per dashboard": "Numero massimo di widget per dashboard",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = illimitato. La riduzione di un limite non elimina mai le dashboard esistenti; blocca solo quelle nuove finché gli utenti non tornano sotto il limite.",
@@ -1089,7 +1090,6 @@
         "Kind": "Tipo",
         "Version": "Versione",
         "How many dashboards there are, and who they belong to.": "Quante dashboard ci sono e a chi appartengono.",
-        "Store": "Store",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installa registri, schemi e flussi pubblicati da altre organizzazioni."
+        "Store": "Store"
     }
 }
diff --git a/l10n/lb.js b/l10n/lb.js
index ced45303e..887dff034 100644
--- a/l10n/lb.js
+++ b/l10n/lb.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Admin settings",
     "Features & roadmap" : "Funktiounen a Roadmap",
     "Maximum dashboards per user" : "Maximal Dashboards pro Benotzer",
     "Maximum widgets per dashboard" : "Maximal Widgets pro Dashboard",
@@ -1113,8 +1114,7 @@ OC.L10N.register(
     "Kind": "Aart",
     "Version": "Versioun",
     "How many dashboards there are, and who they belong to.": "Wéi vill Dashboards et gëtt a wiem se gehéieren.",
-    "Store": "Buttek",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installéiert Registeren, Schemaen a Flows déi aner Organisatiounen publizéiert hunn."
+    "Store": "Buttek"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/lb.json b/l10n/lb.json
index 14d24506f..40fe64d6c 100644
--- a/l10n/lb.json
+++ b/l10n/lb.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Admin settings",
         "Maximum dashboards per user": "Maximal Dashboards pro Benotzer",
         "Maximum widgets per dashboard": "Maximal Widgets pro Dashboard",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = onbegrenzt. D'Erofsetze vun enger Limitt läscht ni existéierend Dashboards; et blockéiert nëmme nei bis d'Benotzer erëm ënner der Limitt sinn.",
@@ -1089,7 +1090,6 @@
         "Kind": "Aart",
         "Version": "Versioun",
         "How many dashboards there are, and who they belong to.": "Wéi vill Dashboards et gëtt a wiem se gehéieren.",
-        "Store": "Buttek",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installéiert Registeren, Schemaen a Flows déi aner Organisatiounen publizéiert hunn."
+        "Store": "Buttek"
     }
 }
diff --git a/l10n/lt.js b/l10n/lt.js
index 0cc0ad989..d0691af5c 100644
--- a/l10n/lt.js
+++ b/l10n/lt.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Administravimo nustatymai",
     "Features & roadmap" : "Funkcijos ir planas",
     "Maximum dashboards per user" : "Didžiausias skydelių skaičius vienam naudotojui",
     "Maximum widgets per dashboard" : "Didžiausias valdiklių skaičius viename skydelyje",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Rūšis",
     "Version": "Versija",
     "How many dashboards there are, and who they belong to.": "Kiek yra skydelių ir kam jie priklauso.",
-    "Store": "Parduotuvė",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Įdiekite registrus, schemas ir srautus, kuriuos paskelbė kitos organizacijos."
+    "Store": "Parduotuvė"
 },
 "nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && (n%100<10 || n%100>=20) ? 1 : 2);"
 );
diff --git a/l10n/lt.json b/l10n/lt.json
index 053ac15f3..46e3713ec 100644
--- a/l10n/lt.json
+++ b/l10n/lt.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Administravimo nustatymai",
         "Maximum dashboards per user": "Didžiausias skydelių skaičius vienam naudotojui",
         "Maximum widgets per dashboard": "Didžiausias valdiklių skaičius viename skydelyje",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = neribota. Apribojimo sumažinimas niekada netrina esamų skydelių; jis tik blokuoja naujų kūrimą, kol naudotojai vėl bus mažiau už ribą.",
@@ -1090,7 +1091,6 @@
         "Kind": "Rūšis",
         "Version": "Versija",
         "How many dashboards there are, and who they belong to.": "Kiek yra skydelių ir kam jie priklauso.",
-        "Store": "Parduotuvė",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Įdiekite registrus, schemas ir srautus, kuriuos paskelbė kitos organizacijos."
+        "Store": "Parduotuvė"
     }
 }
diff --git a/l10n/lv.js b/l10n/lv.js
index 229881a28..717c0eb7a 100644
--- a/l10n/lv.js
+++ b/l10n/lv.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Pārvaldīšanas iestatījumi",
     "Features & roadmap" : "Funkcijas un ceļvedis",
     "Maximum dashboards per user" : "Maksimālais informācijas paneļu skaits uz lietotāju",
     "Maximum widgets per dashboard" : "Maksimālais logrīku skaits uz informācijas paneli",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Veids",
     "Version": "Versija",
     "How many dashboards there are, and who they belong to.": "Cik ir infopaneļu un kam tie pieder.",
-    "Store": "Veikals",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instalējiet reģistrus, shēmas un plūsmas, ko publicējušas citas organizācijas."
+    "Store": "Veikals"
 },
 "nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n != 0 ? 1 : 2);"
 );
diff --git a/l10n/lv.json b/l10n/lv.json
index 1f8d229a7..9bb4873f0 100644
--- a/l10n/lv.json
+++ b/l10n/lv.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Pārvaldīšanas iestatījumi",
         "Maximum dashboards per user": "Maksimālais informācijas paneļu skaits uz lietotāju",
         "Maximum widgets per dashboard": "Maksimālais logrīku skaits uz informācijas paneli",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = neierobežots. Ierobežojuma samazināšana nekad nedzēš esošos informācijas paneļus; tā tikai bloķē jaunus, līdz lietotāji atkal ir zem ierobežojuma.",
@@ -1090,7 +1091,6 @@
         "Kind": "Veids",
         "Version": "Versija",
         "How many dashboards there are, and who they belong to.": "Cik ir infopaneļu un kam tie pieder.",
-        "Store": "Veikals",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instalējiet reģistrus, shēmas un plūsmas, ko publicējušas citas organizācijas."
+        "Store": "Veikals"
     }
 }
diff --git a/l10n/mk.js b/l10n/mk.js
index f4db1155a..fa0853271 100644
--- a/l10n/mk.js
+++ b/l10n/mk.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Административни параметри",
     "Features & roadmap" : "Функции и патоказ",
     "Maximum dashboards per user" : "Максимален број контролни табли по корисник",
     "Maximum widgets per dashboard" : "Максимален број виџети по контролна табла",
@@ -1113,8 +1114,7 @@ OC.L10N.register(
     "Kind": "Вид",
     "Version": "Верзија",
     "How many dashboards there are, and who they belong to.": "Колку контролни табли има и кому припаѓаат.",
-    "Store": "Продавница",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Инсталирајте регистри, шеми и текови објавени од други организации."
+    "Store": "Продавница"
 },
 "nplurals=2; plural=(n%10==1 && n%100!=11 ? 0 : 1);"
 );
diff --git a/l10n/mk.json b/l10n/mk.json
index 7537697cb..a36b82daa 100644
--- a/l10n/mk.json
+++ b/l10n/mk.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Административни параметри",
         "Maximum dashboards per user": "Максимален број контролни табли по корисник",
         "Maximum widgets per dashboard": "Максимален број виџети по контролна табла",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = неограничено. Намалувањето на ограничувањето никогаш не ги брише постоечките контролни табли; само ги блокира новите додека корисниците не се вратат под ограничувањето.",
@@ -1089,7 +1090,6 @@
         "Kind": "Вид",
         "Version": "Верзија",
         "How many dashboards there are, and who they belong to.": "Колку контролни табли има и кому припаѓаат.",
-        "Store": "Продавница",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Инсталирајте регистри, шеми и текови објавени од други организации."
+        "Store": "Продавница"
     }
 }
diff --git a/l10n/mt.js b/l10n/mt.js
index 32ec35bbe..51925453c 100644
--- a/l10n/mt.js
+++ b/l10n/mt.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Admin settings",
     "Features & roadmap" : "Funzjonijiet u pjan direzzjonali",
     "Maximum dashboards per user" : "Numru massimu ta' dashboards għal kull utent",
     "Maximum widgets per dashboard" : "Numru massimu ta' widgets għal kull dashboard",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Tip",
     "Version": "Verżjoni",
     "How many dashboards there are, and who they belong to.": "Kemm hemm dashboards, u ta' min huma.",
-    "Store": "Ħanut",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installa reġistri, skemi u flussi ppubblikati minn organizzazzjonijiet oħra."
+    "Store": "Ħanut"
 },
 "nplurals=4; plural=(n==1 ? 0 : n==0 || (n%100>1 && n%100<11) ? 1 : (n%100>10 && n%100<20) ? 2 : 3);"
 );
diff --git a/l10n/mt.json b/l10n/mt.json
index 09f78ccaa..c5ecfac41 100644
--- a/l10n/mt.json
+++ b/l10n/mt.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Admin settings",
         "Maximum dashboards per user": "Numru massimu ta' dashboards għal kull utent",
         "Maximum widgets per dashboard": "Numru massimu ta' widgets għal kull dashboard",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = bla limitu. It-tnaqqis ta' limitu qatt ma jħassar dashboards eżistenti; jimblokka biss oħrajn ġodda sakemm l-utenti jerġgħu jkunu taħt il-limitu.",
@@ -1091,7 +1092,6 @@
         "Kind": "Tip",
         "Version": "Verżjoni",
         "How many dashboards there are, and who they belong to.": "Kemm hemm dashboards, u ta' min huma.",
-        "Store": "Ħanut",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installa reġistri, skemi u flussi ppubblikati minn organizzazzjonijiet oħra."
+        "Store": "Ħanut"
     }
 }
diff --git a/l10n/nb.js b/l10n/nb.js
index 0bbcf9d01..9e85b8e82 100644
--- a/l10n/nb.js
+++ b/l10n/nb.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Administrasjonsinnstillinger",
     "Features & roadmap" : "Funksjoner og veikart",
     "Maximum dashboards per user" : "Maksimalt antall dashbord per bruker",
     "Maximum widgets per dashboard" : "Maksimalt antall widgeter per dashbord",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Type",
     "Version": "Versjon",
     "How many dashboards there are, and who they belong to.": "Hvor mange dashbord det er, og hvem de tilhører.",
-    "Store": "Butikk",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installer registre, skjemaer og flyter som andre organisasjoner har publisert."
+    "Store": "Butikk"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/nb.json b/l10n/nb.json
index d7b4db265..07254e51a 100644
--- a/l10n/nb.json
+++ b/l10n/nb.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Administrasjonsinnstillinger",
         "Maximum dashboards per user": "Maksimalt antall dashbord per bruker",
         "Maximum widgets per dashboard": "Maksimalt antall widgeter per dashbord",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = ubegrenset. Å senke en grense sletter aldri eksisterende dashbord; den blokkerer kun nye til brukerne igjen er under grensen.",
@@ -1089,7 +1090,6 @@
         "Kind": "Type",
         "Version": "Versjon",
         "How many dashboards there are, and who they belong to.": "Hvor mange dashbord det er, og hvem de tilhører.",
-        "Store": "Butikk",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installer registre, skjemaer og flyter som andre organisasjoner har publisert."
+        "Store": "Butikk"
     }
 }
diff --git a/l10n/nl.js b/l10n/nl.js
index 0cbcdeaed..8ecad5470 100644
--- a/l10n/nl.js
+++ b/l10n/nl.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Beheerinstellingen",
     "Features & roadmap" : "Functies en roadmap",
     "share_not_found" : "Gedeeld dashboard niet gevonden",
     "share_expired" : "Dit gedeelde dashboard is verlopen",
@@ -1150,7 +1151,22 @@ OC.L10N.register(
     "Version": "Versie",
     "How many dashboards there are, and who they belong to.": "Hoeveel dashboards er zijn, en van wie ze zijn.",
     "Store": "Store",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installeer registers, schema's en flows die andere organisaties hebben gepubliceerd.",
+    "Install a dashboard another organisation published. Point LaunchPad at a registry and browse what it offers.": "Installeer een dashboard dat een andere organisatie publiceerde. Wijs LaunchPad naar een register en bekijk het aanbod.",
+    "Dashboard registry": "Dashboardregister",
+    "Connect a registry to install dashboards that other organisations published.": "Koppel een register om dashboards te installeren die andere organisaties publiceerden.",
+    "Enable OpenRegister so you can reach a registry.": "Schakel OpenRegister in om een register te bereiken.",
+    "Registry URL": "Register-URL",
+    "Use the address of the instance that publishes the templates.": "Gebruik het adres van de omgeving die de sjablonen publiceert.",
+    "Register": "Register",
+    "Leave empty to use launchpad.": "Laat leeg om launchpad te gebruiken.",
+    "Access token": "Toegangstoken",
+    "A token is set. Enter a new one to replace it.": "Er is een token ingesteld. Voer een nieuw token in om het te vervangen.",
+    "No token is set. Add one if the registry asks for it.": "Er is geen token ingesteld. Voeg er een toe als het register erom vraagt.",
+    "Save registry": "Register opslaan",
+    "Remove token": "Token verwijderen",
+    "Registry saved.": "Register opgeslagen.",
+    "Token removed.": "Token verwijderd.",
+    "The registry could not be saved.": "Het register kon niet worden opgeslagen.",
     "Load example data?": "Voorbeeldgegevens laden?",
     "Example data fills the lists, detail pages and dashboards so you can see the app working straight away. Pick \"None\" on a production install.": "Voorbeeldgegevens vullen de lijsten, detailpagina’s en dashboards, zodat je de app meteen ziet werken. Kies \"Geen\" op een productieomgeving.",
     "Load the example data": "Laad de voorbeeldgegevens",
diff --git a/l10n/nl.json b/l10n/nl.json
index c651ef281..a4ef4783c 100644
--- a/l10n/nl.json
+++ b/l10n/nl.json
@@ -1135,7 +1135,22 @@
         "Version": "Versie",
         "How many dashboards there are, and who they belong to.": "Hoeveel dashboards er zijn, en van wie ze zijn.",
         "Store": "Store",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installeer registers, schema's en flows die andere organisaties hebben gepubliceerd.",
+        "Install a dashboard another organisation published. Point LaunchPad at a registry and browse what it offers.": "Installeer een dashboard dat een andere organisatie publiceerde. Wijs LaunchPad naar een register en bekijk het aanbod.",
+        "Dashboard registry": "Dashboardregister",
+        "Connect a registry to install dashboards that other organisations published.": "Koppel een register om dashboards te installeren die andere organisaties publiceerden.",
+        "Enable OpenRegister so you can reach a registry.": "Schakel OpenRegister in om een register te bereiken.",
+        "Registry URL": "Register-URL",
+        "Use the address of the instance that publishes the templates.": "Gebruik het adres van de omgeving die de sjablonen publiceert.",
+        "Register": "Register",
+        "Leave empty to use launchpad.": "Laat leeg om launchpad te gebruiken.",
+        "Access token": "Toegangstoken",
+        "A token is set. Enter a new one to replace it.": "Er is een token ingesteld. Voer een nieuw token in om het te vervangen.",
+        "No token is set. Add one if the registry asks for it.": "Er is geen token ingesteld. Voeg er een toe als het register erom vraagt.",
+        "Save registry": "Register opslaan",
+        "Remove token": "Token verwijderen",
+        "Registry saved.": "Register opgeslagen.",
+        "Token removed.": "Token verwijderd.",
+        "The registry could not be saved.": "Het register kon niet worden opgeslagen.",
         "Admin settings": "Beheerinstellingen"
     }
 }
diff --git a/l10n/pl.js b/l10n/pl.js
index a4607ce1d..72d97b692 100644
--- a/l10n/pl.js
+++ b/l10n/pl.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Ustawienia administracyjne",
     "Features & roadmap" : "Funkcje i plan rozwoju",
     "Maximum dashboards per user" : "Maksymalna liczba pulpitów na użytkownika",
     "Maximum widgets per dashboard" : "Maksymalna liczba widżetów na pulpit",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Rodzaj",
     "Version": "Wersja",
     "How many dashboards there are, and who they belong to.": "Ile jest pulpitów i do kogo należą.",
-    "Store": "Sklep",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Zainstaluj rejestry, schematy i przepływy opublikowane przez inne organizacje."
+    "Store": "Sklep"
 },
 "nplurals=3; plural=(n==1 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);"
 );
diff --git a/l10n/pl.json b/l10n/pl.json
index 37b14a19a..dae5fe537 100644
--- a/l10n/pl.json
+++ b/l10n/pl.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Ustawienia administracyjne",
         "Maximum dashboards per user": "Maksymalna liczba pulpitów na użytkownika",
         "Maximum widgets per dashboard": "Maksymalna liczba widżetów na pulpit",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = bez ograniczeń. Obniżenie limitu nigdy nie usuwa istniejących pulpitów; jedynie blokuje nowe, dopóki użytkownicy nie zejdą poniżej limitu.",
@@ -1090,7 +1091,6 @@
         "Kind": "Rodzaj",
         "Version": "Wersja",
         "How many dashboards there are, and who they belong to.": "Ile jest pulpitów i do kogo należą.",
-        "Store": "Sklep",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Zainstaluj rejestry, schematy i przepływy opublikowane przez inne organizacje."
+        "Store": "Sklep"
     }
 }
diff --git a/l10n/pt.js b/l10n/pt.js
index 780b18faf..b6fd7c7b9 100644
--- a/l10n/pt.js
+++ b/l10n/pt.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Admin settings",
     "Features & roadmap" : "Funcionalidades e roteiro",
     "Maximum dashboards per user" : "Máximo de painéis por utilizador",
     "Maximum widgets per dashboard" : "Máximo de widgets por painel",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Tipo",
     "Version": "Versão",
     "How many dashboards there are, and who they belong to.": "Quantos painéis existem e a quem pertencem.",
-    "Store": "Loja",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instale registos, esquemas e fluxos publicados por outras organizações."
+    "Store": "Loja"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/pt.json b/l10n/pt.json
index cd574a62a..81ac87a7d 100644
--- a/l10n/pt.json
+++ b/l10n/pt.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Admin settings",
         "Maximum dashboards per user": "Máximo de painéis por utilizador",
         "Maximum widgets per dashboard": "Máximo de widgets por painel",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = ilimitado. Reduzir um limite nunca elimina os painéis existentes; apenas bloqueia os novos até que os utilizadores voltem a estar abaixo do limite.",
@@ -1089,7 +1090,6 @@
         "Kind": "Tipo",
         "Version": "Versão",
         "How many dashboards there are, and who they belong to.": "Quantos painéis existem e a quem pertencem.",
-        "Store": "Loja",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instale registos, esquemas e fluxos publicados por outras organizações."
+        "Store": "Loja"
     }
 }
diff --git a/l10n/rm.js b/l10n/rm.js
index ea897b80e..941b0a9fa 100644
--- a/l10n/rm.js
+++ b/l10n/rm.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Admin settings",
     "Features & roadmap" : "Funcziuns e plan da svilup",
     "Maximum dashboards per user" : "Maximum da dashboards per utilisader",
     "Maximum widgets per dashboard" : "Maximum da widgets per dashboard",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Gener",
     "Version": "Versiun",
     "How many dashboards there are, and who they belong to.": "Quants panels ch'i dat e tgi ch'els appartegnan.",
-    "Store": "Butia",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installescha registers, schemas e process ch'autras organisaziuns han publitgà."
+    "Store": "Butia"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/rm.json b/l10n/rm.json
index 4b0245b57..f98864d96 100644
--- a/l10n/rm.json
+++ b/l10n/rm.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Admin settings",
         "Maximum dashboards per user": "Maximum da dashboards per utilisader",
         "Maximum widgets per dashboard": "Maximum da widgets per dashboard",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = senza limita. Sbassar ina limita stizza mai dashboards existents; el bloccha mo ils nums fin che ils utilisaders èn puspè sut la limita.",
@@ -1089,7 +1090,6 @@
         "Kind": "Gener",
         "Version": "Versiun",
         "How many dashboards there are, and who they belong to.": "Quants panels ch'i dat e tgi ch'els appartegnan.",
-        "Store": "Butia",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installescha registers, schemas e process ch'autras organisaziuns han publitgà."
+        "Store": "Butia"
     }
 }
diff --git a/l10n/ro.js b/l10n/ro.js
index 72b4c07dd..fe0ad3aa6 100644
--- a/l10n/ro.js
+++ b/l10n/ro.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Setări de administrare",
     "Features & roadmap" : "Funcții și foaie de parcurs",
     "Maximum dashboards per user" : "Numărul maxim de tablouri de bord per utilizator",
     "Maximum widgets per dashboard" : "Numărul maxim de widgeturi per tablou de bord",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Fel",
     "Version": "Versiune",
     "How many dashboards there are, and who they belong to.": "Câte tablouri de bord există și cui aparțin.",
-    "Store": "Magazin",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instalați registre, scheme și fluxuri publicate de alte organizații."
+    "Store": "Magazin"
 },
 "nplurals=3; plural=(n==1 ? 0 : (n==0 || (n%100>0 && n%100<20)) ? 1 : 2);"
 );
diff --git a/l10n/ro.json b/l10n/ro.json
index 18070f124..f65fed0f4 100644
--- a/l10n/ro.json
+++ b/l10n/ro.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Setări de administrare",
         "Maximum dashboards per user": "Numărul maxim de tablouri de bord per utilizator",
         "Maximum widgets per dashboard": "Numărul maxim de widgeturi per tablou de bord",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = nelimitat. Reducerea unei limite nu șterge niciodată tablourile de bord existente; blochează doar pe cele noi până când utilizatorii revin sub limită.",
@@ -1090,7 +1091,6 @@
         "Kind": "Fel",
         "Version": "Versiune",
         "How many dashboards there are, and who they belong to.": "Câte tablouri de bord există și cui aparțin.",
-        "Store": "Magazin",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instalați registre, scheme și fluxuri publicate de alte organizații."
+        "Store": "Magazin"
     }
 }
diff --git a/l10n/ru.js b/l10n/ru.js
index cf4c5baad..847bffa6c 100644
--- a/l10n/ru.js
+++ b/l10n/ru.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Параметры сервера",
     "Features & roadmap" : "Функции и дорожная карта",
     "Maximum dashboards per user" : "Максимальное количество панелей на пользователя",
     "Maximum widgets per dashboard" : "Максимальное количество виджетов на панель",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Вид",
     "Version": "Версия",
     "How many dashboards there are, and who they belong to.": "Сколько есть панелей и кому они принадлежат.",
-    "Store": "Магазин",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Установите реестры, схемы и потоки, опубликованные другими организациями."
+    "Store": "Магазин"
 },
 "nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);"
 );
diff --git a/l10n/ru.json b/l10n/ru.json
index 3b9583a36..a1e718f7f 100644
--- a/l10n/ru.json
+++ b/l10n/ru.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Параметры сервера",
         "Maximum dashboards per user": "Максимальное количество дашбордов на пользователя",
         "Maximum widgets per dashboard": "Максимальное количество виджетов на дашборд",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = без ограничений. Снижение лимита никогда не удаляет существующие дашборды; оно лишь блокирует создание новых, пока пользователи не вернутся под лимит.",
@@ -1090,7 +1091,6 @@
         "Kind": "Вид",
         "Version": "Версия",
         "How many dashboards there are, and who they belong to.": "Сколько есть панелей и кому они принадлежат.",
-        "Store": "Магазин",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Установите реестры, схемы и потоки, опубликованные другими организациями."
+        "Store": "Магазин"
     }
 }
diff --git a/l10n/sk.js b/l10n/sk.js
index 85bc42bbf..eb2bc99c4 100644
--- a/l10n/sk.js
+++ b/l10n/sk.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Nastavenia administrácie",
     "Features & roadmap" : "Funkcie a plán vývoja",
     "Maximum dashboards per user" : "Maximálny počet dashboardov na používateľa",
     "Maximum widgets per dashboard" : "Maximálny počet widgetov na dashboard",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Druh",
     "Version": "Verzia",
     "How many dashboards there are, and who they belong to.": "Koľko je prehľadov a komu patria.",
-    "Store": "Obchod",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Nainštalujte registre, schémy a toky zverejnené inými organizáciami."
+    "Store": "Obchod"
 },
 "nplurals=3; plural=(n==1) ? 0 : (n>=2 && n<=4) ? 1 : 2;"
 );
diff --git a/l10n/sk.json b/l10n/sk.json
index f7457867c..3f3e0a653 100644
--- a/l10n/sk.json
+++ b/l10n/sk.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Nastavenia administrácie",
         "Maximum dashboards per user": "Maximálny počet dashboardov na používateľa",
         "Maximum widgets per dashboard": "Maximálny počet widgetov na dashboard",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = neobmedzené. Zníženie limitu nikdy neodstráni existujúce dashboardy; iba zablokuje nové, kým sa používatelia nevrátia pod limit.",
@@ -1090,7 +1091,6 @@
         "Kind": "Druh",
         "Version": "Verzia",
         "How many dashboards there are, and who they belong to.": "Koľko je prehľadov a komu patria.",
-        "Store": "Obchod",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Nainštalujte registre, schémy a toky zverejnené inými organizáciami."
+        "Store": "Obchod"
     }
 }
diff --git a/l10n/sl.js b/l10n/sl.js
index abd2c882e..cec16c49a 100644
--- a/l10n/sl.js
+++ b/l10n/sl.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Skrbniške nastavitve",
     "Features & roadmap" : "Funkcije in načrt razvoja",
     "Maximum dashboards per user" : "Največje število nadzornih plošč na uporabnika",
     "Maximum widgets per dashboard" : "Največje število gradnikov na nadzorno ploščo",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Vrsta",
     "Version": "Različica",
     "How many dashboards there are, and who they belong to.": "Koliko je nadzornih plošč in komu pripadajo.",
-    "Store": "Trgovina",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Namestite registre, sheme in tokove, ki so jih objavile druge organizacije."
+    "Store": "Trgovina"
 },
 "nplurals=4; plural=(n%100==1 ? 0 : n%100==2 ? 1 : n%100==3 || n%100==4 ? 2 : 3);"
 );
diff --git a/l10n/sl.json b/l10n/sl.json
index ca58d393f..a98b91ec8 100644
--- a/l10n/sl.json
+++ b/l10n/sl.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Skrbniške nastavitve",
         "Maximum dashboards per user": "Največje število nadzornih plošč na uporabnika",
         "Maximum widgets per dashboard": "Največje število gradnikov na nadzorno ploščo",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = neomejeno. Zmanjšanje omejitve nikoli ne izbriše obstoječih nadzornih plošč; le prepreči nove, dokler uporabniki niso ponovno pod omejitvijo.",
@@ -1091,7 +1092,6 @@
         "Kind": "Vrsta",
         "Version": "Različica",
         "How many dashboards there are, and who they belong to.": "Koliko je nadzornih plošč in komu pripadajo.",
-        "Store": "Trgovina",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Namestite registre, sheme in tokove, ki so jih objavile druge organizacije."
+        "Store": "Trgovina"
     }
 }
diff --git a/l10n/sq.js b/l10n/sq.js
index 08852df26..250599de3 100644
--- a/l10n/sq.js
+++ b/l10n/sq.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Admin settings",
     "Features & roadmap" : "Veçoritë dhe plani i zhvillimit",
     "Maximum dashboards per user" : "Numri maksimal i paneleve për përdorues",
     "Maximum widgets per dashboard" : "Numri maksimal i widget-eve për panel",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Lloji",
     "Version": "Versioni",
     "How many dashboards there are, and who they belong to.": "Sa panele ka dhe kujt i përkasin.",
-    "Store": "Dyqani",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instaloni regjistra, skema dhe rrjedha të publikuara nga organizata të tjera."
+    "Store": "Dyqani"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/sq.json b/l10n/sq.json
index 7853241bb..45088f228 100644
--- a/l10n/sq.json
+++ b/l10n/sq.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Admin settings",
         "Maximum dashboards per user": "Numri maksimal i paneleve për përdorues",
         "Maximum widgets per dashboard": "Numri maksimal i widget-eve për panel",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = i pakufizuar. Ulja e një kufiri nuk fshin kurrë panelet ekzistuese; ajo vetëm bllokon krijimin e të rejave derisa përdoruesit të kthehen nën kufi.",
@@ -1089,7 +1090,6 @@
         "Kind": "Lloji",
         "Version": "Versioni",
         "How many dashboards there are, and who they belong to.": "Sa panele ka dhe kujt i përkasin.",
-        "Store": "Dyqani",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Instaloni regjistra, skema dhe rrjedha të publikuara nga organizata të tjera."
+        "Store": "Dyqani"
     }
 }
diff --git a/l10n/sr.js b/l10n/sr.js
index 55318526f..62349d493 100644
--- a/l10n/sr.js
+++ b/l10n/sr.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Административна подешавања",
     "Features & roadmap" : "Функције и план развоја",
     "Maximum dashboards per user" : "Максималан број контролних табли по кориснику",
     "Maximum widgets per dashboard" : "Максималан број виџета по контролној табли",
@@ -1113,7 +1114,6 @@ OC.L10N.register(
     "Kind": "Врста",
     "Version": "Верзија",
     "How many dashboards there are, and who they belong to.": "Колико има контролних табли и коме припадају.",
-    "Store": "Продавница",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Инсталирајте регистре, шеме и токове које су објавиле друге организације."
+    "Store": "Продавница"
 },
 "nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);");
diff --git a/l10n/sr.json b/l10n/sr.json
index fb240ca9a..686e1911c 100644
--- a/l10n/sr.json
+++ b/l10n/sr.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Административна подешавања",
         "Maximum dashboards per user": "Максималан број контролних табли по кориснику",
         "Maximum widgets per dashboard": "Максималан број виџета по контролној табли",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = неограничено. Снижавање ограничења никада не брише постојеће контролне табле; само блокира нове док се корисници не врате испод ограничења.",
@@ -1090,7 +1091,6 @@
         "Kind": "Врста",
         "Version": "Верзија",
         "How many dashboards there are, and who they belong to.": "Колико има контролних табли и коме припадају.",
-        "Store": "Продавница",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Инсталирајте регистре, шеме и токове које су објавиле друге организације."
+        "Store": "Продавница"
     }
 }
diff --git a/l10n/sv.js b/l10n/sv.js
index 858518c46..4954a6065 100644
--- a/l10n/sv.js
+++ b/l10n/sv.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Administration",
     "Features & roadmap" : "Funktioner och färdplan",
     "Maximum dashboards per user" : "Maximalt antal dashboards per användare",
     "Maximum widgets per dashboard" : "Maximalt antal widgets per dashboard",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Typ",
     "Version": "Version",
     "How many dashboards there are, and who they belong to.": "Hur många instrumentpaneler det finns, och vem de tillhör.",
-    "Store": "Butik",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installera register, scheman och flöden som andra organisationer har publicerat."
+    "Store": "Butik"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/sv.json b/l10n/sv.json
index 990c43d8a..59a4bd689 100644
--- a/l10n/sv.json
+++ b/l10n/sv.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Administration",
         "Maximum dashboards per user": "Maximalt antal dashboards per användare",
         "Maximum widgets per dashboard": "Maximalt antal widgets per dashboard",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = obegränsat. Att sänka en gräns raderar aldrig befintliga dashboards; den blockerar endast nya tills användarna åter ligger under gränsen.",
@@ -1089,7 +1090,6 @@
         "Kind": "Typ",
         "Version": "Version",
         "How many dashboards there are, and who they belong to.": "Hur många instrumentpaneler det finns, och vem de tillhör.",
-        "Store": "Butik",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Installera register, scheman och flöden som andra organisationer har publicerat."
+        "Store": "Butik"
     }
 }
diff --git a/l10n/tr.js b/l10n/tr.js
index 9672dbed8..d9e906636 100644
--- a/l10n/tr.js
+++ b/l10n/tr.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Yönetim ayarları",
     "Features & roadmap" : "Özellikler ve yol haritası",
     "Maximum dashboards per user" : "Kullanıcı başına en fazla pano",
     "Maximum widgets per dashboard" : "Pano başına en fazla araç",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Tür",
     "Version": "Sürüm",
     "How many dashboards there are, and who they belong to.": "Kaç panonun olduğu ve kime ait oldukları.",
-    "Store": "Mağaza",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Diğer kuruluşların yayımladığı kayıtları, şemaları ve akışları yükleyin."
+    "Store": "Mağaza"
 },
 "nplurals=2; plural=(n != 1);"
 );
diff --git a/l10n/tr.json b/l10n/tr.json
index 65629878c..3b8fa3299 100644
--- a/l10n/tr.json
+++ b/l10n/tr.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Yönetim ayarları",
         "Maximum dashboards per user": "Kullanıcı başına en fazla pano",
         "Maximum widgets per dashboard": "Pano başına en fazla araç",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = sınırsız. Bir sınırın düşürülmesi var olan panoları asla silmez; yalnızca kullanıcılar sınırın altına dönene kadar yenilerinin oluşturulmasını engeller.",
@@ -1089,7 +1090,6 @@
         "Kind": "Tür",
         "Version": "Sürüm",
         "How many dashboards there are, and who they belong to.": "Kaç panonun olduğu ve kime ait oldukları.",
-        "Store": "Mağaza",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Diğer kuruluşların yayımladığı kayıtları, şemaları ve akışları yükleyin."
+        "Store": "Mağaza"
     }
 }
diff --git a/l10n/uk.js b/l10n/uk.js
index 915d3d481..09e1433b5 100644
--- a/l10n/uk.js
+++ b/l10n/uk.js
@@ -1,6 +1,7 @@
 OC.L10N.register(
     "launchpad",
     {
+    "Admin settings" : "Адміністрування",
     "Features & roadmap" : "Функції та дорожня карта",
     "Maximum dashboards per user" : "Максимальна кількість дашбордів на користувача",
     "Maximum widgets per dashboard" : "Максимальна кількість віджетів на дашборд",
@@ -1122,8 +1123,7 @@ OC.L10N.register(
     "Kind": "Вид",
     "Version": "Версія",
     "How many dashboards there are, and who they belong to.": "Скільки є дашбордів і кому вони належать.",
-    "Store": "Магазин",
-    "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Встановлюйте реєстри, схеми та потоки, опубліковані іншими організаціями."
+    "Store": "Магазин"
 },
 "nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);"
 );
diff --git a/l10n/uk.json b/l10n/uk.json
index a14b9a3e9..f84467e75 100644
--- a/l10n/uk.json
+++ b/l10n/uk.json
@@ -1,5 +1,6 @@
 {
     "translations": {
+        "Admin settings": "Адміністрування",
         "Maximum dashboards per user": "Максимальна кількість дашбордів на користувача",
         "Maximum widgets per dashboard": "Максимальна кількість віджетів на дашборд",
         "0 = unlimited. Lowering a limit never deletes existing dashboards; it only blocks new ones until users are back under the limit.": "0 = без обмежень. Зниження ліміту ніколи не видаляє наявні дашборди; воно лише блокує створення нових, доки користувачі не повернуться під ліміт.",
@@ -1090,7 +1091,6 @@
         "Kind": "Вид",
         "Version": "Версія",
         "How many dashboards there are, and who they belong to.": "Скільки є дашбордів і кому вони належать.",
-        "Store": "Магазин",
-        "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them.": "Встановлюйте реєстри, схеми та потоки, опубліковані іншими організаціями."
+        "Store": "Магазин"
     }
 }
diff --git a/lib/AppInfo/Application.php b/lib/AppInfo/Application.php
index 758f7886c..6a0e7c6f9 100644
--- a/lib/AppInfo/Application.php
+++ b/lib/AppInfo/Application.php
@@ -23,6 +23,7 @@
 use OCA\LaunchPad\Controller\MetricsController;
 use OCA\LaunchPad\Event\DashboardDeletedEvent;
 use OCA\LaunchPad\Listener\CspListener;
+use OCA\LaunchPad\Listener\DashboardSharesListener;
 use OCA\LaunchPad\Listener\GroupDeletedListener;
 use OCA\LaunchPad\Listener\LocksListener;
 use OCA\LaunchPad\Listener\MetadataValuesListener;
@@ -36,7 +37,9 @@
 use OCA\LaunchPad\Listener\WidgetPlacementsListener;
 use OCA\LaunchPad\Notification\Notifier;
 use OCA\LaunchPad\Search\LaunchPadSearchProvider;
+use OCA\LaunchPad\Service\ImportService;
 use OCA\LaunchPad\Service\PublicShareContext;
+use OCA\LaunchPad\Service\StoreService;
 use OCP\AppFramework\App;
 use OCP\AppFramework\Bootstrap\IBootContext;
 use OCP\AppFramework\Bootstrap\IBootstrap;
@@ -92,6 +95,11 @@ public function register(IRegistrationContext $context): void {
 		// runtime app id `launchpad`; the engine reads the manifest under it and
 		// emits the launchpad_ Prometheus prefix, preserving the contract.
 		$this->registerObservability(context: $context);
+
+		// Store plane (ADR-080). Same laziness as above: the discovery client is
+		// resolved through self::optional(), so an instance without OpenRegister
+		// gets a store that reports `not_configured` rather than a fatal.
+		$this->registerStore(context: $context);
 	}//end register()
 
 	/**
@@ -194,6 +202,10 @@ private function registerCascadeListeners(IRegistrationContext $context): void {
 			event: DashboardDeletedEvent::class,
 			listener: PublicSharesListener::class
 		);
+		$context->registerEventListener(
+			event: DashboardDeletedEvent::class,
+			listener: DashboardSharesListener::class
+		);
 		$context->registerEventListener(
 			event: DashboardDeletedEvent::class,
 			listener: MetadataValuesListener::class
@@ -234,6 +246,44 @@ private function registerIntegrations(IRegistrationContext $context): void {
 		);
 	}//end registerIntegrations()
 
+	/**
+	 * Wire the store service (ADR-080).
+	 *
+	 * `GenericStoreService` is OpenRegister's, and OpenRegister is optional:
+	 * LaunchPad declares no `<app>` dependency on it, so it can be absent or
+	 * disabled. The class is named as a STRING and resolved through
+	 * {@see self::optional()}, so nothing touches an `OCA\OpenRegister\…`
+	 * symbol at registration time and a missing engine degrades the store to
+	 * `not_configured` instead of fatalling NC bootstrap.
+	 *
+	 * `StoreController` is NOT registered here. Declaring the class is already
+	 * what stops the engine aliasing its own `GenericStoreController` at that
+	 * name, and its remaining collaborators resolve by type.
+	 *
+	 * @param IRegistrationContext $context The registration context.
+	 *
+	 * @return void
+	 *
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-002-an-absent-openregister-must-degrade-never-fatal
+	 */
+	private function registerStore(IRegistrationContext $context): void {
+		$context->registerService(
+			StoreService::class,
+			// @psalm-suppress UnusedClosureParam,TooManyArguments
+			static function (\Psr\Container\ContainerInterface $c): StoreService {
+				return new StoreService(
+					discovery: self::optional(
+						container: $c,
+						id: 'OCA\\OpenRegister\\AppHost\\Service\\GenericStoreService'
+					),
+					importService: $c->get(ImportService::class),
+					appConfig: $c->get(\OCP\IAppConfig::class),
+					logger: $c->get(\Psr\Log\LoggerInterface::class)
+				);
+			}
+		);
+	}//end registerStore()
+
 	/**
 	 * Wire the AppHost observability controllers (ADR-040).
 	 *
diff --git a/lib/Command/DashboardDeleteCommand.php b/lib/Command/DashboardDeleteCommand.php
index e930eae23..9ce076fc8 100644
--- a/lib/Command/DashboardDeleteCommand.php
+++ b/lib/Command/DashboardDeleteCommand.php
@@ -262,7 +262,8 @@ private function applyDeletion(
 				dashboardUuid: $uuid,
 				ownerUserId:   (string)($dashboard->getUserId() ?? ''),
 				type:          (string)($dashboard->getType() ?? Dashboard::TYPE_USER),
-				deletedAt:     new DateTimeImmutable()
+				deletedAt:     new DateTimeImmutable(),
+				dashboardId:   (int)$dashboard->getId()
 			)
 		);
 	}//end applyDeletion()
diff --git a/lib/Controller/AdminController.php b/lib/Controller/AdminController.php
index 51657756d..c04d59c1e 100644
--- a/lib/Controller/AdminController.php
+++ b/lib/Controller/AdminController.php
@@ -416,6 +416,13 @@ public function getSettings(): JSONResponse {
 	/**
 	 * Update admin settings.
 	 *
+	 * Five settings are read under one name and written under another: GET
+	 * answers `allowUserDashboards`, this PUT took only `allowUserDash`. An
+	 * unrecognised key binds to null, null means "not supplied", so a caller
+	 * round-tripping GET into PUT wrote nothing and was told `{"status":
+	 * "ok"}`. Both spellings are accepted; the short one wins, since
+	 * AdminSettings.vue sends it. Covered by AdminControllerSettingsAliasTest.
+	 *
 	 * @param string|null $defaultPermLevel Default permission level.
 	 * @param bool|null $allowUserDash Allow user dashboards.
 	 * @param bool|null $allowMultiDash Allow multiple dashboards.
@@ -456,6 +463,11 @@ public function getSettings(): JSONResponse {
 	 *                                               `{query}`.
 	 *                                               tile-quick-search
 	 *                                               REQ-QSEARCH-004.
+	 * @param string|null $defaultPermissionLevel Alias of `$defaultPermLevel`.
+	 * @param bool|null $allowUserDashboards Alias of `$allowUserDash`.
+	 * @param bool|null $allowMultipleDashboards Alias of `$allowMultiDash`.
+	 * @param int|null $defaultGridColumns Alias of `$defaultGridCols`.
+	 * @param array|null $linkCreateFileExtensions Alias of `$linkCreateFileExts`.
 	 *
 	 * @return JSONResponse The update confirmation.
 	 *
@@ -475,7 +487,19 @@ public function updateSettings(
 		?int $maxDashboardsPerUser = null,
 		?int $maxWidgetsPerDashboard = null,
 		?string $quicksearchFallbackTarget = null,
+		?string $defaultPermissionLevel = null,
+		?bool $allowUserDashboards = null,
+		?bool $allowMultipleDashboards = null,
+		?int $defaultGridColumns = null,
+		?array $linkCreateFileExtensions = null,
 	): JSONResponse {
+		// Read-side aliases, see the docblock. Short form wins.
+		$defaultPermLevel ??= $defaultPermissionLevel;
+		$allowUserDash ??= $allowUserDashboards;
+		$allowMultiDash ??= $allowMultipleDashboards;
+		$defaultGridCols ??= $defaultGridColumns;
+		$linkCreateFileExts ??= $linkCreateFileExtensions;
+
 		try {
 			$this->settingsService->updateSettings(
 				defaultPermLevel: $defaultPermLevel,
diff --git a/lib/Controller/StoreController.php b/lib/Controller/StoreController.php
new file mode 100644
index 000000000..e05f08279
--- /dev/null
+++ b/lib/Controller/StoreController.php
@@ -0,0 +1,215 @@
+<?php
+
+/**
+ * StoreController
+ *
+ * The store endpoints `CnStorePage` calls. LaunchPad declares a
+ * `type: "store"` page in `src/manifest.json`, which renders that shared
+ * component, which fetches `/api/store/items` on mount and posts to
+ * `/api/store/items/{slug}/install` on an install click.
+ *
+ * 🔴 THIS CLASS IS ALSO WHAT KEEPS THE ENGINE'S ALIAS OFF LAUNCHPAD.
+ * `OCA\OpenRegister\AppHost\Bootstrap::aliasStoreController()` binds the
+ * engine's `GenericStoreController` at `Controller\StoreController` UNLESS the
+ * leaf defines that class itself. LaunchPad must define it: the engine installs
+ * by writing OpenRegister objects or applying a configuration bundle, and a
+ * LaunchPad dashboard is neither — it lives in LaunchPad's own tables behind
+ * `DashboardMapper`. Deleting this class would not fall back to a working
+ * store, it would fall back to a store that can never install a dashboard.
+ *
+ * Implements the `dashboard-store` capability (REQ-STORE-001, REQ-STORE-004).
+ *
+ * @category  Controller
+ * @package   OCA\LaunchPad\Controller
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ * @version   GIT:auto
+ * @link      https://conduction.nl
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace OCA\LaunchPad\Controller;
+
+use OCA\LaunchPad\AppInfo\Application;
+use OCA\LaunchPad\Service\StoreService;
+use OCA\LaunchPad\Settings\LaunchPadAdmin;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\IRequest;
+use OCP\IUserSession;
+
+/**
+ * Browse a dashboard registry and install one of its templates.
+ *
+ * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md
+ */
+class StoreController extends Controller {
+	/**
+	 * Constructor.
+	 *
+	 * @param IRequest     $request      The HTTP request.
+	 * @param StoreService $storeService Discovery delegation and install.
+	 * @param IUserSession $userSession  The current session.
+	 *
+	 * @return void
+	 */
+	public function __construct(
+		IRequest $request,
+		private readonly StoreService $storeService,
+		private readonly IUserSession $userSession,
+	) {
+		parent::__construct(
+			appName: Application::APP_ID,
+			request: $request
+		);
+	}//end __construct()
+
+	/**
+	 * Search the configured registry.
+	 *
+	 * Signed-in rather than admin: browsing is how a user finds out what an
+	 * administrator could install for them, and the response carries only
+	 * normalised cards. The engine drops every remote property outside the
+	 * descriptor's card map, so the registry URL and token never ride back.
+	 *
+	 * The guard is in the body rather than only in the attribute so an
+	 * anonymous caller gets an explicit 401 instead of a login redirect into a
+	 * fetch that expected JSON.
+	 *
+	 * @return JSONResponse 200 with `{outcome, cards}`, or 401 for anonymous.
+	 *
+	 * @no-admin-idor-exempt Addresses no object of this instance. The query and
+	 *   kind filter are forwarded to an EXTERNAL registry and the response is
+	 *   normalised cards, so there is no local identifier to guess.
+	 *
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-004-installing-must-require-an-administrator
+	 */
+	#[NoAdminRequired]
+	public function search(): JSONResponse {
+		if ($this->userSession->getUser() === null) {
+			return new JSONResponse(
+				data: ['outcome' => 'unauthenticated', 'cards' => []],
+				statusCode: Http::STATUS_UNAUTHORIZED
+			);
+		}
+
+		$result = $this->storeService->search(
+			query: $this->stringParam(name: 'q'),
+			kind: $this->stringParam(name: 'kind')
+		);
+
+		return new JSONResponse(
+			data: [
+				'outcome' => $result['outcome'],
+				'cards' => $result['cards'],
+				'kinds' => [],
+				'builtIn' => [],
+			],
+			statusCode: Http::STATUS_OK
+		);
+	}//end search()
+
+	/**
+	 * Install one registry template into this instance.
+	 *
+	 * Administrative. An install writes dashboards from a third-party server
+	 * into the instance, so it is gated exactly like the rest of LaunchPad's
+	 * admin surface (ADR-005).
+	 *
+	 * @param string $slug The remote item slug.
+	 *
+	 * @return JSONResponse 200 with a per-component report, or 400 when the install was refused.
+	 *
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-004-installing-must-require-an-administrator
+	 */
+	#[AuthorizedAdminSetting(LaunchPadAdmin::class)]
+	public function install(string $slug): JSONResponse {
+		$user = $this->userSession->getUser();
+		if ($user === null) {
+			return new JSONResponse(
+				data: ['success' => false, 'message' => 'Sign in to install a template.', 'components' => []],
+				statusCode: Http::STATUS_UNAUTHORIZED
+			);
+		}
+
+		$result = $this->storeService->install(slug: $slug, userId: $user->getUID());
+
+		// A refusal that installed nothing is a 400 so the page shows the
+		// message rather than an empty success. A PARTIAL install is a 200: the
+		// dashboards that arrived are real, and the report names the rest.
+		$status = Http::STATUS_OK;
+		if ($result['success'] === false) {
+			$status = Http::STATUS_BAD_REQUEST;
+		}
+
+		return new JSONResponse(data: $result, statusCode: $status);
+	}//end install()
+
+	/**
+	 * Read the registry connection.
+	 *
+	 * The token is reported as a boolean and never as a value.
+	 *
+	 * @return JSONResponse 200 with `{registryUrl, registryRegister, tokenConfigured}`.
+	 *
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-007-the-registry-token-must-not-be-readable-back
+	 */
+	#[AuthorizedAdminSetting(LaunchPadAdmin::class)]
+	public function getConfig(): JSONResponse {
+		return new JSONResponse(
+			data: ($this->storeService->getRegistryConfig() + ['available' => $this->storeService->isAvailable()]),
+			statusCode: Http::STATUS_OK
+		);
+	}//end getConfig()
+
+	/**
+	 * Write the registry connection.
+	 *
+	 * An omitted key leaves the stored value alone, so a form can change the
+	 * URL without resubmitting the token. An empty string clears the key.
+	 *
+	 * @return JSONResponse 200 with the redacted connection.
+	 *
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-007-the-registry-token-must-not-be-readable-back
+	 */
+	#[AuthorizedAdminSetting(LaunchPadAdmin::class)]
+	public function updateConfig(): JSONResponse {
+		$this->storeService->updateRegistryConfig(
+			registryUrl: $this->stringParam(name: 'registryUrl'),
+			registryToken: $this->stringParam(name: 'registryToken'),
+			registryRegister: $this->stringParam(name: 'registryRegister')
+		);
+
+		return new JSONResponse(
+			data: $this->storeService->getRegistryConfig(),
+			statusCode: Http::STATUS_OK
+		);
+	}//end updateConfig()
+
+	/**
+	 * Read one request parameter as a string, or null when it was not sent.
+	 *
+	 * The null is load-bearing: it is what distinguishes "leave this key alone"
+	 * from "clear this key", and the empty string means the second.
+	 *
+	 * @param string $name The parameter name.
+	 *
+	 * @return string|null The value, or null when absent or not a string.
+	 */
+	private function stringParam(string $name): ?string {
+		$value = $this->request->getParam($name);
+		if (is_string($value) === false) {
+			return null;
+		}
+
+		return $value;
+	}//end stringParam()
+}//end class
diff --git a/lib/Db/DashboardShareMapper.php b/lib/Db/DashboardShareMapper.php
index de5e32bcb..4bbb3abc7 100644
--- a/lib/Db/DashboardShareMapper.php
+++ b/lib/Db/DashboardShareMapper.php
@@ -235,12 +235,15 @@ public function findForRecipient(string $userId, array $groupIds): array {
 	/**
 	 * Delete all shares for a dashboard.
 	 *
+	 * Keyed on the integer id, so it works after the dashboard row itself
+	 * has been deleted, which is when `DashboardDeletedEvent` fires.
+	 *
 	 * @param int $dashboardId The dashboard ID.
 	 *
-	 * @return void
+	 * @return int The number of rows deleted.
 	 * @spec   openspec/changes/launchpad-legacy-quality-cleanup/tasks.md#task-1
 	 */
-	public function deleteByDashboardId(int $dashboardId): void {
+	public function deleteByDashboardId(int $dashboardId): int {
 		$qb = $this->db->getQueryBuilder();
 		$qb->delete(delete: $this->getTableName())
 			->where(
@@ -253,7 +256,7 @@ public function deleteByDashboardId(int $dashboardId): void {
 				)
 			);
 
-		$qb->executeStatement();
+		return $qb->executeStatement();
 	}//end deleteByDashboardId()
 
 	/**
@@ -460,9 +463,14 @@ public function deleteByOwnerAndRecipient(
 	/**
 	 * Delete all shares for a dashboard identified by UUID.
 	 *
-	 * Uses a subquery to translate the UUID to an integer dashboard_id so
-	 * the caller (DashboardDeletedEvent) never has to resolve the ID itself.
-	 * Triggered by cascade-event processing (REQ-CSC-003).
+	 * Uses a subquery to translate the UUID to an integer dashboard_id.
+	 *
+	 * ⚠️ ONLY WHILE THE DASHBOARD ROW STILL EXISTS. This used to say it was
+	 * triggered by cascade-event processing. Nothing called it, and it could
+	 * not have worked there: `DashboardDeletedEvent` fires after the row is
+	 * gone, so the subquery matches nothing and zero rows are deleted.
+	 * `DashboardSharesListener` deletes by id and uses this only as the
+	 * fallback for an event that carries no id.
 	 *
 	 * @param string $dashboardUuid The dashboard UUID.
 	 *
diff --git a/lib/Event/DashboardDeletedEvent.php b/lib/Event/DashboardDeletedEvent.php
index 7a459d0fc..1886e1755 100644
--- a/lib/Event/DashboardDeletedEvent.php
+++ b/lib/Event/DashboardDeletedEvent.php
@@ -40,6 +40,7 @@
  * @see \OCA\LaunchPad\Listener\LocksListener
  * @see \OCA\LaunchPad\Listener\VersionsListener
  * @see \OCA\LaunchPad\Listener\PublicSharesListener
+ * @see \OCA\LaunchPad\Listener\DashboardSharesListener
  * @see \OCA\LaunchPad\Listener\MetadataValuesListener
  * @see \OCA\LaunchPad\Listener\TranslationsListener
  * @see \OCA\LaunchPad\Listener\ViewAnalyticsListener
@@ -53,12 +54,15 @@ final class DashboardDeletedEvent extends Event {
 	 * @param string $ownerUserId The owner user ID at the time of deletion.
 	 * @param string $type The dashboard type (`user`, `group_shared`, `admin_template`).
 	 * @param DateTimeImmutable $deletedAt The instant the soft-delete completed.
+	 * @param int|null $dashboardId The integer id of the deleted row, or null
+	 *                              when the dispatcher did not have it.
 	 */
 	public function __construct(
 		private readonly string $dashboardUuid,
 		private readonly string $ownerUserId,
 		private readonly string $type,
 		private readonly DateTimeImmutable $deletedAt,
+		private readonly ?int $dashboardId = null,
 	) {
 		parent::__construct();
 	}//end __construct()
@@ -102,4 +106,26 @@ public function getType(): string {
 	public function getDeletedAt(): DateTimeImmutable {
 		return $this->deletedAt;
 	}//end getDeletedAt()
+
+	/**
+	 * Get the integer id of the deleted dashboard row.
+	 *
+	 * 🔴 WHY THE EVENT CARRIES THE ID AT ALL. Every dispatcher fires this
+	 * event AFTER the dashboard row is gone. A dependent table keyed on
+	 * `dashboard_id` therefore cannot be cleaned by translating the UUID
+	 * through `oc_launchpad_dashboards`: that subquery finds nothing, and
+	 * the delete silently removes zero rows. `oc_launchpad_dashboard_shares`
+	 * is such a table, which is why `DashboardSharesListener` reads this.
+	 *
+	 * Null when a dispatcher did not supply it. A listener that needs it
+	 * must then fall back to the UUID, which only works while the row
+	 * still exists.
+	 *
+	 * @return int|null The dashboard id, or null.
+	 *
+	 * @spec openspec/specs/dashboard-cascade-events/spec.md#requirement-req-csc-001-dashboarddeletedevent-definition
+	 */
+	public function getDashboardId(): ?int {
+		return $this->dashboardId;
+	}//end getDashboardId()
 }//end class
diff --git a/lib/Listener/DashboardSharesListener.php b/lib/Listener/DashboardSharesListener.php
new file mode 100644
index 000000000..7c7dc07ee
--- /dev/null
+++ b/lib/Listener/DashboardSharesListener.php
@@ -0,0 +1,135 @@
+<?php
+
+/**
+ * DashboardSharesListener
+ *
+ * Deletes the user and group shares of a deleted dashboard, the rows in
+ * `oc_launchpad_dashboard_shares`. REQ-CSC-002, REQ-CSC-003.
+ *
+ * 🔴 WHY THIS LISTENER EXISTS. The cascade registry cleaned placements,
+ * reactions, locks, versions, public shares, metadata values, translations
+ * and view analytics, and nothing cleaned user and group shares. Deleting a
+ * shared dashboard left its share rows behind until the orphan sweep
+ * (`OrphanedSharesCategory`) found them. The mapper already had a
+ * `deleteByDashboardUuid()` documented as cascade-triggered; nothing called
+ * it, and it could not have worked here (see below).
+ *
+ * 🔴 BY ID, NOT BY UUID. Every dispatcher fires `DashboardDeletedEvent` after
+ * the dashboard row is gone, and the share table is keyed on `dashboard_id`.
+ * Translating the UUID through `oc_launchpad_dashboards` therefore finds
+ * nothing and deletes zero rows without complaint. The event carries the id
+ * for exactly this reason. The UUID path is kept only as the fallback for an
+ * event dispatched without an id, which works while the row still exists.
+ *
+ * @category  Listener
+ * @package   OCA\LaunchPad\Listener
+ * @author    Conduction Development Team <info@conduction.nl>
+ * @copyright 2026 Conduction B.V.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * @link https://conduction.nl
+ *
+ * @spec openspec/specs/dashboard-cascade-events/spec.md#requirement-req-csc-003-dependent-data-listener-group
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace OCA\LaunchPad\Listener;
+
+use OCA\LaunchPad\Db\DashboardShareMapper;
+use OCA\LaunchPad\Event\DashboardDeletedEvent;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use Psr\Log\LoggerInterface;
+use Throwable;
+
+/**
+ * Deletes user and group shares for a deleted dashboard.
+ *
+ * @implements IEventListener<DashboardDeletedEvent>
+ *
+ * @spec openspec/specs/dashboard-cascade-events/spec.md#requirement-req-csc-003-dependent-data-listener-group
+ */
+class DashboardSharesListener implements IEventListener {
+	/**
+	 * Constructor.
+	 *
+	 * @param DashboardShareMapper $shareMapper User and group share mapper.
+	 * @param LoggerInterface      $logger      PSR-3 logger for log-and-continue
+	 *                                          failure handling per REQ-CSC-006.
+	 */
+	public function __construct(
+		private readonly DashboardShareMapper $shareMapper,
+		private readonly LoggerInterface $logger,
+	) {
+	}//end __construct()
+
+	/**
+	 * Handle the DashboardDeletedEvent by deleting every share of the dashboard.
+	 *
+	 * @param Event $event The event.
+	 *
+	 * @return void
+	 *
+	 * @spec openspec/specs/dashboard-cascade-events/spec.md#requirement-req-csc-003-dependent-data-listener-group
+	 */
+	public function handle(Event $event): void {
+		if (($event instanceof DashboardDeletedEvent) === false) {
+			return;
+		}
+
+		$uuid = $event->getDashboardUuid();
+
+		try {
+			$deleted = $this->deleteShares(
+				uuid: $uuid,
+				dashboardId: $event->getDashboardId()
+			);
+
+			$this->logger->debug(
+				message: sprintf(
+					'launchpad DashboardSharesListener: deleted %d share row(s) for dashboard %s',
+					$deleted,
+					$uuid
+				),
+				context: ['app' => 'launchpad']
+			);
+		} catch (Throwable $t) {
+			// Failure isolation per REQ-CSC-006: log at WARN, do not rethrow,
+			// so peer listeners still execute.
+			$this->logger->warning(
+				message: sprintf(
+					'launchpad DashboardSharesListener: failed for dashboard %s: %s',
+					$uuid,
+					$t->getMessage()
+				),
+				context: ['app' => 'launchpad']
+			);
+		}//end try
+	}//end handle()
+
+	/**
+	 * Delete the shares by id, or by UUID when the event carries no id.
+	 *
+	 * The id path is the one that works after the dashboard row is gone, which
+	 * is when every dispatcher fires. The UUID path translates through
+	 * `oc_launchpad_dashboards` and only works while the row still exists.
+	 *
+	 * @param string   $uuid        The deleted dashboard's UUID.
+	 * @param int|null $dashboardId The deleted row's id, or null.
+	 *
+	 * @return int The number of share rows deleted.
+	 *
+	 * @spec openspec/specs/dashboard-cascade-events/spec.md#requirement-req-csc-003-dependent-data-listener-group
+	 */
+	private function deleteShares(string $uuid, ?int $dashboardId): int {
+		if ($dashboardId !== null && $dashboardId > 0) {
+			return $this->shareMapper->deleteByDashboardId(dashboardId: $dashboardId);
+		}
+
+		return $this->shareMapper->deleteByDashboardUuid(dashboardUuid: $uuid);
+	}//end deleteShares()
+}//end class
diff --git a/lib/Listener/TreeListener.php b/lib/Listener/TreeListener.php
index afddeb89e..ba4af9fb5 100644
--- a/lib/Listener/TreeListener.php
+++ b/lib/Listener/TreeListener.php
@@ -100,7 +100,8 @@ public function handle(Event $event): void {
 						dashboardUuid: $childUuid,
 						ownerUserId:   $childOwnerId,
 						type:          $childType,
-						deletedAt:     $deletedAt
+						deletedAt:     $deletedAt,
+						dashboardId:   $child->getId()
 					)
 				);
 			}//end foreach
diff --git a/lib/Listener/UserDeletedListener.php b/lib/Listener/UserDeletedListener.php
index e4e27d94d..64f1ac234 100644
--- a/lib/Listener/UserDeletedListener.php
+++ b/lib/Listener/UserDeletedListener.php
@@ -202,7 +202,8 @@ private function handleOwnedDashboard(
 							dashboardUuid: $deletedUuid,
 							ownerUserId:   $deletedUserId,
 							type:          (string)($dashboard->getType() ?? Dashboard::TYPE_USER),
-							deletedAt:     new DateTimeImmutable()
+							deletedAt:     new DateTimeImmutable(),
+							dashboardId:   $dashboardId
 						)
 					);
 				}
diff --git a/lib/Service/AdminTemplateService.php b/lib/Service/AdminTemplateService.php
index 99fda313c..7f4d8d896 100644
--- a/lib/Service/AdminTemplateService.php
+++ b/lib/Service/AdminTemplateService.php
@@ -383,7 +383,8 @@ public function deleteTemplate(int $id): void {
 					dashboardUuid: $deletedUuid,
 					ownerUserId:   (string)($template->getUserId() ?? ''),
 					type:          Dashboard::TYPE_ADMIN_TEMPLATE,
-					deletedAt:     new DateTimeImmutable()
+					deletedAt:     new DateTimeImmutable(),
+					dashboardId:   $id
 				)
 			);
 		}
diff --git a/lib/Service/BulkOperationService.php b/lib/Service/BulkOperationService.php
index f21177e24..ed02f5ffa 100644
--- a/lib/Service/BulkOperationService.php
+++ b/lib/Service/BulkOperationService.php
@@ -891,7 +891,8 @@ private function performDelete(
 					dashboardUuid: $rowUuid,
 					ownerUserId:   (string)($dashboard->getUserId() ?? $userId),
 					type:          (string)($dashboard->getType() ?? Dashboard::TYPE_USER),
-					deletedAt:     new DateTimeImmutable()
+					deletedAt:     new DateTimeImmutable(),
+					dashboardId:   (int)$dashboard->getId()
 				)
 			);
 		}
diff --git a/lib/Service/ConfluenceImportService.php b/lib/Service/ConfluenceImportService.php
index cf4e0579a..49e0b27d9 100644
--- a/lib/Service/ConfluenceImportService.php
+++ b/lib/Service/ConfluenceImportService.php
@@ -462,6 +462,14 @@ private function buildPlaceholderWidget(int $dashboardId, ParsedPage $page): Wid
 		$placement->setShowTitle(1);
 		$placement->setSortOrder(0);
 
+		// `created_at` and `updated_at` are NOT NULL with no default. Without
+		// these two lines every page's placement insert failed with SQLSTATE
+		// 23502, the page rolled back, and the import reported it as skipped:
+		// the same defect #612 fixed in ImportService.
+		$now = (new DateTime())->format(format: 'Y-m-d H:i:s');
+		$placement->setCreatedAt($now);
+		$placement->setUpdatedAt($now);
+
 		$placement->setStyleConfigArray(
 			config: [
 				'text' => '',
diff --git a/lib/Service/DashboardService.php b/lib/Service/DashboardService.php
index a47214489..1d80156d1 100644
--- a/lib/Service/DashboardService.php
+++ b/lib/Service/DashboardService.php
@@ -937,7 +937,8 @@ private function dispatchDashboardDeleted(
 				dashboardUuid: $uuid,
 				ownerUserId:   $resolvedOwnerId,
 				type:          (string)($dashboard->getType() ?? Dashboard::TYPE_USER),
-				deletedAt:     new DateTimeImmutable()
+				deletedAt:     new DateTimeImmutable(),
+				dashboardId:   $dashboard->getId()
 			)
 		);
 	}//end dispatchDashboardDeleted()
@@ -1200,7 +1201,8 @@ public function deleteGroupShared(
 					dashboardUuid: $deletedUuid,
 					ownerUserId:   $actorUserId,
 					type:          (string)($dashboard->getType() ?? Dashboard::TYPE_GROUP_SHARED),
-					deletedAt:     new DateTimeImmutable()
+					deletedAt:     new DateTimeImmutable(),
+					dashboardId:   $dashboard->getId()
 				)
 			);
 		}
diff --git a/lib/Service/DashboardTreeService.php b/lib/Service/DashboardTreeService.php
index 48f189793..9149a9161 100644
--- a/lib/Service/DashboardTreeService.php
+++ b/lib/Service/DashboardTreeService.php
@@ -562,7 +562,8 @@ private function deleteDashboardWithPlacements(
 					dashboardUuid: $targetUuid,
 					ownerUserId:   (string)($target->getUserId() ?? $fallback->getUserId() ?? ''),
 					type:          (string)($target->getType() ?? $fallback->getType() ?? Dashboard::TYPE_USER),
-					deletedAt:     $deletedAt
+					deletedAt:     $deletedAt,
+					dashboardId:   $targetId
 				)
 			);
 		}
diff --git a/lib/Service/DemoShowcasesService.php b/lib/Service/DemoShowcasesService.php
index 5cfb2b9ee..c5b77edb8 100644
--- a/lib/Service/DemoShowcasesService.php
+++ b/lib/Service/DemoShowcasesService.php
@@ -38,7 +38,6 @@
 use OCA\LaunchPad\AppInfo\Application;
 use OCA\LaunchPad\Db\Dashboard;
 use OCA\LaunchPad\Db\DashboardMapper;
-use OCA\LaunchPad\Db\WidgetPlacement;
 use OCA\LaunchPad\Db\WidgetPlacementMapper;
 use OCA\LaunchPad\Event\DashboardDeletedEvent;
 use OCA\LaunchPad\Exception\ShowcaseNotFoundException;
@@ -79,13 +78,22 @@ class DemoShowcasesService {
 	/**
 	 * Bundled showcase IDs.
 	 *
-	 * The set is fixed at v1 (REQ-DEMO-001). The Dutch fictional
-	 * organisation names mirror the reference source dataset so
-	 * existing copy / screenshots remain reusable.
+	 * Two kinds, and the difference is what a reader is meant to take
+	 * away. The five Dutch fictional ORGANISATIONS mirror the reference
+	 * source dataset so existing copy and screenshots stay reusable;
+	 * they answer "what does an intranet built on this look like".
+	 *
+	 * `case-handler` is the first ROLE showcase and answers a different
+	 * question: what one person's working day looks like on one page.
+	 * It is in English because the widgets it places are the fleet's own
+	 * (a dossiq case list, the Tasks app, a calendar, unread mail) and
+	 * those carry English labels, so a Dutch shell around English
+	 * content would read as a half-translation.
 	 *
 	 * @var array<int, string>
 	 */
 	public const BUNDLED_IDS = [
+		'case-handler',
 		'de-bron',
 		'de-linden',
 		'gemeente-duin',
@@ -93,6 +101,17 @@ class DemoShowcasesService {
 		'van-der-berg',
 	];
 
+	/**
+	 * Where the list of LaunchPad's own widget types lives.
+	 *
+	 * Shared with the frontend: `widgetRegistry.completeness.spec.js`
+	 * asserts the registry's keys equal this file, so the types the
+	 * installer keeps and the types the workspace can render cannot drift.
+	 *
+	 * @var string
+	 */
+	private const WIDGET_TYPES_PATH = __DIR__ . '/../widget-types.json';
+
 	/**
 	 * Optional data-directory override (test seam).
 	 *
@@ -100,6 +119,23 @@ class DemoShowcasesService {
 	 */
 	private ?string $dataDirOverride = null;
 
+	/**
+	 * LaunchPad widget types, keyed by type, loaded once per instance.
+	 *
+	 * @var array<string, true>|null
+	 */
+	private ?array $launchpadWidgetTypes = null;
+
+	/**
+	 * Builds placements from the archive; see PlacementPayloadHydrator for
+	 * which fields travel and why the importer uses the same one. It holds
+	 * no state and has no dependencies, so it is constructed here rather
+	 * than injected.
+	 *
+	 * @var PlacementPayloadHydrator
+	 */
+	private readonly PlacementPayloadHydrator $placementHydrator;
+
 	/**
 	 * Constructor.
 	 *
@@ -133,6 +169,7 @@ public function __construct(
 		private readonly IURLGenerator $urlGenerator,
 		private readonly ?IEventDispatcher $eventDispatcher = null,
 	) {
+		$this->placementHydrator = new PlacementPayloadHydrator();
 	}//end __construct()
 
 	/**
@@ -223,15 +260,29 @@ public function describeShowcase(string $showcaseId): ?array {
 			$installedDashboardId = $installedUuid;
 		}
 
+		// The imagePath() call THROWS when the image is absent, and this runs once per
+		// showcase inside the listing, so one showcase without a preview used
+		// to 500 the whole gallery. A missing thumbnail is a cosmetic gap in
+		// one card, not a reason to hide the other five.
+		$thumbnailUrl = null;
+		try {
+			$thumbnailUrl = $this->urlGenerator->imagePath(
+				Application::APP_ID,
+				'showcases/' . $showcaseId . '.png'
+			);
+		} catch (\RuntimeException $e) {
+			$this->logger->warning(
+				message: 'Showcase ' . $showcaseId . ' has no preview image',
+				context: ['exception' => $e]
+			);
+		}
+
 		return [
 			'id' => $showcaseId,
 			'name' => (string)($manifest['showcaseName'] ?? $showcaseId),
 			'description' => (string)($manifest['showcaseDescription'] ?? ''),
 			'language' => (string)($manifest['showcaseLanguage'] ?? 'nl'),
-			'thumbnailUrl' => $this->urlGenerator->imagePath(
-				Application::APP_ID,
-				'showcases/' . $showcaseId . '.png'
-			),
+			'thumbnailUrl' => $thumbnailUrl,
 			'isInstalled' => $installedUuid !== '',
 			'installedDashboardUuid' => $installedDashboardId,
 		];
@@ -344,7 +395,7 @@ private function doInstallShowcase(string $showcaseId, string $lang): array {
 		try {
 			$persisted = $this->dashboardMapper->insert(entity: $dashboard);
 			foreach ($valid as $widgetPayload) {
-				$placement = $this->buildPlacement(
+				$placement = $this->placementHydrator->hydrate(
 					dashboardId: (int)$persisted->getId(),
 					payload: $widgetPayload
 				);
@@ -418,7 +469,8 @@ public function uninstallShowcase(string $showcaseId): void {
 						dashboardUuid: $deletedUuid,
 						ownerUserId:   (string)($dashboard->getUserId() ?? ''),
 						type:          (string)($dashboard->getType() ?? Dashboard::TYPE_GROUP_SHARED),
-						deletedAt:     new DateTimeImmutable()
+						deletedAt:     new DateTimeImmutable(),
+						dashboardId:   $dashId
 					)
 				);
 			}
@@ -452,13 +504,32 @@ public function getInstalledUuid(string $showcaseId): string {
 	}//end getInstalledUuid()
 
 	/**
-	 * Cross-reference a widget collection against the registered
-	 * Nextcloud dashboard widget registry, returning valid + skipped
-	 * partitions (REQ-DEMO-005).
+	 * Split a showcase's widgets into the ones to place and the ones to
+	 * skip (REQ-DEMO-005).
 	 *
-	 * Tile placements (rows where `tileType` is non-null) are always
-	 * considered valid — tiles are owned by LaunchPad itself and do not
-	 * require a third-party widget registration.
+	 * A widget is kept when LaunchPad can render it. That is true in three
+	 * cases, checked in this order:
+	 *
+	 * 1. it is a tile (`tileType` set), rendered by LaunchPad's tile renderer;
+	 * 2. its `widgetId` is one of LaunchPad's OWN widget types
+	 *    (`lib/widget-types.json`: `object-list`, `nc-widget`, `calendar`,
+	 *    `text` and the rest), rendered by the workspace's widget registry;
+	 * 3. its `widgetId` is a Nextcloud dashboard widget registered on this
+	 *    instance (`IManager::getWidgets()`), rendered through the bridge.
+	 *
+	 * Anything else is skipped, which is what the skip exists for: a bare
+	 * Nextcloud widget id whose app is not installed here.
+	 *
+	 * Case 2 is new. Before it, a LaunchPad type counted as "unknown"
+	 * because it is not in Nextcloud's registry, so the `case-handler`
+	 * showcase, built entirely from LaunchPad types, installed as an empty
+	 * dashboard and still reported success.
+	 *
+	 * An `nc-widget` is kept whatever widget it proxies. The check is on the
+	 * widget's TYPE, as REQ-DEMO-005 words it; whether the proxied app is
+	 * installed decides what the tile shows, not whether it exists. Checking
+	 * the target here would make a showcase's shape depend on which apps an
+	 * instance happens to have.
 	 *
 	 * @param array<int, mixed> $widgets Widget payloads from the
 	 *                                   showcase JSON.
@@ -473,6 +544,8 @@ public function partitionWidgets(array $widgets): array {
 			$registered[$widget->getId()] = true;
 		}
 
+		$ownTypes = $this->getLaunchpadWidgetTypes();
+
 		$valid = [];
 		$skipped = [];
 		foreach ($widgets as $widget) {
@@ -490,7 +563,9 @@ public function partitionWidgets(array $widgets): array {
 				continue;
 			}
 
-			if (isset($registered[$widgetId]) === true) {
+			if (isset($ownTypes[$widgetId]) === true
+				|| isset($registered[$widgetId]) === true
+			) {
 				$valid[] = $widget;
 				continue;
 			}
@@ -503,6 +578,51 @@ public function partitionWidgets(array $widgets): array {
 		return [$valid, $skipped];
 	}//end partitionWidgets()
 
+	/**
+	 * Load LaunchPad's own widget types from `lib/widget-types.json`.
+	 *
+	 * Throws rather than returning an empty set when the file is missing or
+	 * unreadable. An empty set is exactly the defect this list fixes: every
+	 * LaunchPad widget in a showcase would be skipped and the install would
+	 * still report success, which is the failure nobody noticed the first
+	 * time. A packaging error must be loud.
+	 *
+	 * @return array<string, true> The types, keyed for `isset()` lookups.
+	 *
+	 * @throws RuntimeException When the list is missing or malformed.
+	 *
+	 * @spec openspec/specs/demo-data-showcases/spec.md
+	 */
+	private function getLaunchpadWidgetTypes(): array {
+		if ($this->launchpadWidgetTypes !== null) {
+			return $this->launchpadWidgetTypes;
+		}
+
+		$decoded = null;
+		if (is_readable(filename: self::WIDGET_TYPES_PATH) === true) {
+			$raw = file_get_contents(filename: self::WIDGET_TYPES_PATH);
+			if (is_string($raw) === true) {
+				$decoded = json_decode(json: $raw, associative: true);
+			}
+		}
+
+		if (is_array($decoded) === false || is_array($decoded['types'] ?? null) === false) {
+			throw new RuntimeException(
+				message: 'LaunchPad widget type list missing or malformed: ' . self::WIDGET_TYPES_PATH
+			);
+		}
+
+		$types = [];
+		foreach ($decoded['types'] as $type) {
+			if (is_string($type) === true && $type !== '') {
+				$types[$type] = true;
+			}
+		}
+
+		$this->launchpadWidgetTypes = $types;
+		return $types;
+	}//end getLaunchpadWidgetTypes()
+
 	/**
 	 * Resolve the on-disk ZIP path for a showcase ID.
 	 *
@@ -675,89 +795,6 @@ private function buildDashboardEntity(
 		return $dashboard;
 	}//end buildDashboardEntity()
 
-	/**
-	 * Hydrate a WidgetPlacement entity from a payload.
-	 *
-	 * Mirrors {@see ImportService::buildPlacement} so the showcase
-	 * format and the export-import format stay byte-compatible.
-	 *
-	 * @param int $dashboardId The freshly-inserted
-	 *                         dashboard ID.
-	 * @param array<string, mixed> $payload The widget payload.
-	 *
-	 * @return WidgetPlacement The placement entity.
-	 *
-	 * @SuppressWarnings(PHPMD.CyclomaticComplexity)
-	 *      Field-by-field guards mirror the export-import format and
-	 *      are clearer than a map-driven setter.
-	 * @SuppressWarnings(PHPMD.NPathComplexity)
-	 *      Consequence of the same field-by-field guards: each optional
-	 *      payload key contributes an independent present/absent branch, so
-	 *      the acyclic-path count multiplies across fields even though the
-	 *      method is a flat sequence with no nesting.
-	 */
-	private function buildPlacement(
-		int $dashboardId,
-		array $payload,
-	): WidgetPlacement {
-		$placement = new WidgetPlacement();
-		$now = (new DateTime())->format(format: 'Y-m-d H:i:s');
-
-		// phpcs:disable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-		$placement->setDashboardId($dashboardId);
-		$placement->setWidgetId((string)($payload['widgetId'] ?? ''));
-		$placement->setGridX((int)($payload['gridX'] ?? 0));
-		$placement->setGridY((int)($payload['gridY'] ?? 0));
-		$placement->setGridWidth((int)($payload['gridWidth'] ?? 4));
-		$placement->setGridHeight((int)($payload['gridHeight'] ?? 4));
-		$placement->setIsVisible((int)($payload['isVisible'] ?? 1));
-		$placement->setShowTitle((int)($payload['showTitle'] ?? 1));
-		$placement->setSortOrder((int)($payload['sortOrder'] ?? 0));
-		$placement->setCreatedAt($now);
-		$placement->setUpdatedAt($now);
-
-		if (isset($payload['styleConfig']) === true && is_array($payload['styleConfig']) === true) {
-			$placement->setStyleConfigArray(config: $payload['styleConfig']);
-		}
-
-		if (isset($payload['customTitle']) === true) {
-			$placement->setCustomTitle((string)$payload['customTitle']);
-		}
-
-		// Tile fields — see WidgetPlacement::jsonSerialize().
-		if (isset($payload['tileType']) === true) {
-			$placement->setTileType((string)$payload['tileType']);
-			$placement->setTileTitle((string)($payload['tileTitle'] ?? ''));
-			if (isset($payload['tileIcon']) === true) {
-				$placement->setTileIcon((string)$payload['tileIcon']);
-			}
-
-			if (isset($payload['tileIconType']) === true) {
-				$placement->setTileIconType((string)$payload['tileIconType']);
-			}
-
-			if (isset($payload['tileBackgroundColor']) === true) {
-				$placement->setTileBackgroundColor((string)$payload['tileBackgroundColor']);
-			}
-
-			if (isset($payload['tileTextColor']) === true) {
-				$placement->setTileTextColor((string)$payload['tileTextColor']);
-			}
-
-			if (isset($payload['tileLinkType']) === true) {
-				$placement->setTileLinkType((string)$payload['tileLinkType']);
-			}
-
-			if (isset($payload['tileLinkValue']) === true) {
-				$placement->setTileLinkValue((string)$payload['tileLinkValue']);
-			}
-		}//end if
-
-		// phpcs:enable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-
-		return $placement;
-	}//end buildPlacement()
-
 	/**
 	 * Persist the per-showcase install marker.
 	 *
diff --git a/lib/Service/ImportService.php b/lib/Service/ImportService.php
index 1e2eb3255..09f3d5169 100644
--- a/lib/Service/ImportService.php
+++ b/lib/Service/ImportService.php
@@ -25,10 +25,10 @@
 
 namespace OCA\LaunchPad\Service;
 
+use DateTime;
 use InvalidArgumentException;
 use OCA\LaunchPad\Db\Dashboard;
 use OCA\LaunchPad\Db\DashboardMapper;
-use OCA\LaunchPad\Db\WidgetPlacement;
 use OCA\LaunchPad\Db\WidgetPlacementMapper;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\IDBConnection;
@@ -80,6 +80,27 @@ class ImportService {
 	 */
 	public const ERR_INVALID_DASHBOARD = 'invalidDashboard';
 
+	/**
+	 * Internal payload key holding the UUID an archive gave a dashboard.
+	 *
+	 * Set by {@see self::remapUuids()} when it mints a fresh UUID, and read
+	 * only when reporting an error, so the admin is told which file in their
+	 * archive went wrong rather than a UUID this import invented.
+	 *
+	 * @var string
+	 */
+	private const KEY_SOURCE_UUID = '__sourceUuid__';
+
+	/**
+	 * Builds placements from their exported form; see PlacementPayloadHydrator
+	 * for which fields travel and why this is one builder and not two. It
+	 * holds no state and has no dependencies, so it is constructed here rather
+	 * than injected.
+	 *
+	 * @var PlacementPayloadHydrator
+	 */
+	private readonly PlacementPayloadHydrator $placementHydrator;
+
 	/**
 	 * Constructor.
 	 *
@@ -94,6 +115,7 @@ public function __construct(
 		private readonly IDBConnection $db,
 		private readonly LoggerInterface $logger,
 	) {
+		$this->placementHydrator = new PlacementPayloadHydrator();
 	}//end __construct()
 
 	/**
@@ -208,6 +230,14 @@ public function validateZipStructure(ZipArchive $zip): array {
 		if (is_int($version) === false || $version !== self::SCHEMA_VERSION) {
 			$head = 'Unsupported manifest schema version: ' . (string)$version . '.';
 			$tail = ' Only version ' . (string)self::SCHEMA_VERSION . ' is supported.';
+			// An archive from a NEWER LaunchPad is the one case the admin can
+			// act on, and REQ-EXIM-009 asks for them to be told how. A version
+			// below 1 is not an older format, it is a broken manifest, so it
+			// gets no such advice.
+			if (is_int($version) === true && $version > self::SCHEMA_VERSION) {
+				$tail .= ' Upgrade LaunchPad to import archives of version ' . (string)$version . '.';
+			}
+
 			throw new InvalidArgumentException(message: ($head . $tail));
 		}
 
@@ -244,6 +274,11 @@ public function remapUuids(array $dashboards, bool $preserveUuids): array {
 			$original = (string)($dashboard['uuid'] ?? '');
 			if ($original !== '' && isset($uuidMap[$original]) === true) {
 				$dashboard['uuid'] = $uuidMap[$original];
+				// Keep the UUID the archive used. A dashboard that is then
+				// SKIPPED never exists under the new one, so reporting the new
+				// UUID names a row nobody can look up and a file the admin
+				// cannot find. The source UUID is the file's own name.
+				$dashboard[self::KEY_SOURCE_UUID] = $original;
 			}
 
 			$parent = $dashboard['parentUuid'] ?? null;
@@ -280,15 +315,13 @@ private function importDashboardBatch(
 		$errors = [];
 
 		foreach ($dashboards as $payload) {
-			$uuid = (string)($payload['uuid'] ?? '');
+			// The archive's UUID, not the one a remap may have minted: it is
+			// what the admin can find in their file.
+			$uuid = $this->reportableUuid(payload: $payload);
 			$missing = $this->validateDashboardPayload(payload: $payload);
 			if ($missing !== null) {
 				$skipped++;
-				$errors[] = [
-					'type' => self::ERR_INVALID_DASHBOARD,
-					'uuid' => $uuid,
-					'message' => 'Missing required field: ' . $missing,
-				];
+				$errors[] = $this->invalidDashboardError(payload: $payload, missing: $missing);
 				continue;
 			}
 
@@ -309,7 +342,7 @@ private function importDashboardBatch(
 							continue;
 						}
 
-						$placement = $this->buildPlacement(
+						$placement = $this->placementHydrator->hydrate(
 							dashboardId: (int)$persisted->getId(),
 							payload: $widgetPayload
 						);
@@ -324,7 +357,7 @@ private function importDashboardBatch(
 				$skipped++;
 				$errors[] = [
 					'type' => self::ERR_INVALID_DASHBOARD,
-					'uuid' => $uuid,
+					'uuid' => $this->reportableUuid(payload: $payload),
 					'message' => 'Failed to import dashboard: ' . $e->getMessage(),
 				];
 				$this->logger->warning(
@@ -455,6 +488,55 @@ private function validateDashboardPayload(array $payload): ?string {
 		return null;
 	}//end validateDashboardPayload()
 
+	/**
+	 * The error entry for a dashboard the import has to skip.
+	 *
+	 * A dashboard file that is not valid JSON has no `uuid` to report, so it
+	 * used to come back as `uuid: ""` with the message "Missing required
+	 * field: corrupt JSON payload", which names neither the file nor what is
+	 * wrong with it. REQ-EXIM-004 asks for the corrupt dashboard to be
+	 * identified; the archive entry name is the only identity it has, and the
+	 * file name is the exported UUID.
+	 *
+	 * @param array<string, mixed> $payload The payload that failed validation.
+	 * @param string               $missing What validation reported missing.
+	 *
+	 * @return array<string, string> The entry for the `errors` array.
+	 */
+	private function invalidDashboardError(array $payload, string $missing): array {
+		if (isset($payload['__corrupt__']) === true) {
+			$entry = (string)($payload['__entry__'] ?? '');
+			return [
+				'type' => self::ERR_INVALID_DASHBOARD,
+				'uuid' => basename(path: $entry, suffix: '.json'),
+				'entry' => $entry,
+				'message' => $entry . ' is not valid JSON',
+			];
+		}
+
+		return [
+			'type' => self::ERR_INVALID_DASHBOARD,
+			'uuid' => $this->reportableUuid(payload: $payload),
+			'message' => 'Missing required field: ' . $missing,
+		];
+	}//end invalidDashboardError()
+
+	/**
+	 * The UUID to name in an error: the archive's, not the remapped one.
+	 *
+	 * @param array<string, mixed> $payload The dashboard payload.
+	 *
+	 * @return string The UUID the archive used, or the current one.
+	 */
+	private function reportableUuid(array $payload): string {
+		$source = (string)($payload[self::KEY_SOURCE_UUID] ?? '');
+		if ($source !== '') {
+			return $source;
+		}
+
+		return (string)($payload['uuid'] ?? '');
+	}//end reportableUuid()
+
 	/**
 	 * Hydrate a Dashboard entity from a payload.
 	 *
@@ -486,6 +568,19 @@ private function buildEntity(
 		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
 		$dashboard->setIsDefault(0);
 
+		// `created_at` and `updated_at` are NOT NULL with no default
+		// (DashboardTableBuilder). Nothing here set them, so on every database
+		// that enforces NOT NULL the insert failed, the dashboard was reported
+		// as skipped, and no import had landed a dashboard at all: measured on
+		// PostgreSQL as SQLSTATE 23502 on created_at. The unit tests mock the
+		// mapper, so none of them could see it. An import creates a new row,
+		// so it gets the time of the import rather than the exported one.
+		$now = (new DateTime())->format(format: 'Y-m-d H:i:s');
+		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$dashboard->setCreatedAt($now);
+		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$dashboard->setUpdatedAt($now);
+
 		return $dashboard;
 	}//end buildEntity()
 
@@ -642,50 +737,6 @@ private function applyEntityPlacement(
 		}
 	}//end applyEntityPlacement()
 
-	/**
-	 * Hydrate a WidgetPlacement entity from a payload.
-	 *
-	 * @param int $dashboardId The freshly-inserted dashboard ID.
-	 * @param array<string, mixed> $payload The widget payload.
-	 *
-	 * @return WidgetPlacement The placement entity (not yet persisted).
-	 */
-	private function buildPlacement(
-		int $dashboardId,
-		array $payload,
-	): WidgetPlacement {
-		$placement = new WidgetPlacement();
-		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-		$placement->setDashboardId($dashboardId);
-		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-		$placement->setWidgetId((string)($payload['widgetId'] ?? ''));
-		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-		$placement->setGridX((int)($payload['gridX'] ?? 0));
-		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-		$placement->setGridY((int)($payload['gridY'] ?? 0));
-		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-		$placement->setGridWidth((int)($payload['gridWidth'] ?? 4));
-		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-		$placement->setGridHeight((int)($payload['gridHeight'] ?? 4));
-		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-		$placement->setIsVisible((int)($payload['isVisible'] ?? 1));
-		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-		$placement->setShowTitle((int)($payload['showTitle'] ?? 1));
-		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-		$placement->setSortOrder((int)($payload['sortOrder'] ?? 0));
-
-		if (isset($payload['styleConfig']) === true && is_array($payload['styleConfig']) === true) {
-			$placement->setStyleConfigArray(config: $payload['styleConfig']);
-		}
-
-		if (isset($payload['customTitle']) === true) {
-			// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
-			$placement->setCustomTitle((string)$payload['customTitle']);
-		}
-
-		return $placement;
-	}//end buildPlacement()
-
 	/**
 	 * Generate a v4 UUID for re-mapped imports.
 	 *
diff --git a/lib/Service/LiveTileService.php b/lib/Service/LiveTileService.php
index 87f3e7934..3b4c65b5f 100644
--- a/lib/Service/LiveTileService.php
+++ b/lib/Service/LiveTileService.php
@@ -6,14 +6,17 @@
  * Resolves a `livetile` widget placement's configured data source to a
  * value, server-side (REQ-LIVETILE-003). Two source modes:
  *
- *  - `connector` — OpenConnector's `dashboard-http-datasource` capability
- *    is called through its documented runtime source-run API, ONLY when a
+ *  - `connector` — Integriq's `dashboard-http-datasource` capability is
+ *    called through its documented runtime resolve API, ONLY when a
  *    capability probe confirms the app is installed AND the expected
- *    service is resolvable. This file never statically imports an
- *    OpenConnector class (REQ-LIVETILE-005 "No direct class dependency") —
- *    the FQCN is referenced only as a string, exactly mirroring
+ *    service is resolvable. This file never statically imports an Integriq
+ *    class (REQ-LIVETILE-005 "No direct class dependency") — the FQCN is
+ *    referenced only as a string, exactly mirroring
  *    {@see WeatherService::WEATHER_STATUS_SERVICE_CLASS}'s reuse of the
- *    optional `weather_status` app.
+ *    optional `weather_status` app. Both the id and the namespace are
+ *    resolved through {@see FleetAppId} rather than hardcoded, because the
+ *    fleet rename moved both and an instance in the field may still be on
+ *    either name.
  *  - `url` — a server-side allow-listed HTTP GET, extracting a value via a
  *    JSONPath-lite expression (`$.a.b`, `$.a[0].b`). The allow-list
  *    (`livetile_allowed_hosts`, IAppConfig) is enforced FAIL-CLOSED: an
@@ -48,6 +51,7 @@
 use DateTime;
 use OCA\LaunchPad\AppInfo\Application;
 use OCA\LaunchPad\Db\WidgetPlacementMapper;
+use OCA\LaunchPad\Support\FleetAppId;
 use OCP\App\IAppManager;
 use OCP\Http\Client\IClientService;
 use OCP\IAppConfig;
@@ -62,12 +66,12 @@
  * readings.
  *
  * @SuppressWarnings(PHPMD.ExcessiveClassComplexity) Combines dual-source
- *     resolution (OpenConnector leaf + allow-listed direct GET), JSONPath-
+ *     resolution (Integriq leaf + allow-listed direct GET), JSONPath-
  *     lite extraction, formatting, badge thresholding, caching, and
  *     stale-fallback in one cohesive unit — mirrors WeatherService's shape
  *     for the same class of capability.
  * @SuppressWarnings(PHPMD.CouplingBetweenObjects)   Same cause as the complexity
- *     above: the dual-source resolution necessarily reaches OpenConnector, the
+ *     above: the dual-source resolution necessarily reaches Integriq, the
  *     HTTP client, the cache and the config. The collaborators are the feature.
  * @spec                                             openspec/specs/live-data-tile-widget/spec.md
  */
@@ -113,31 +117,42 @@ class LiveTileService {
 	public const CONFIG_KEY_ALLOWED_HOSTS = 'livetile_allowed_hosts';
 
 	/**
-	 * App id of the optional OpenConnector leaf.
+	 * Canonical name of the optional connector leaf. Never used as a literal
+	 * app id: {@see FleetAppId} maps it onto whichever of `integriq` /
+	 * `openconnector` this instance actually registered, so the probe works
+	 * on a migrated instance and on one still running an older release.
 	 *
 	 * @var string
 	 */
-	private const OPENCONNECTOR_APP_ID = 'openconnector';
+	private const CONNECTOR_APP = 'integriq';
 
 	/**
-	 * FQCN of OpenConnector's dashboard data-source resolver, referenced
-	 * only as a string so this file never hard-requires the class to
-	 * exist (REQ-LIVETILE-005 "No direct class dependency") — resolved
-	 * through the container only when the capability probe passes.
+	 * Class name of the connector's dashboard data-source resolver, RELATIVE
+	 * to the app's PSR-4 root and referenced only as a string so this file
+	 * never hard-requires the class to exist (REQ-LIVETILE-005 "No direct
+	 * class dependency"). {@see FleetAppId::classCandidates()} prefixes it
+	 * with `OCA\Integriq` and then `OCA\OpenConnector`.
+	 *
+	 * Verified against integriq `development` (2026-09-09): the class lives
+	 * at `lib/Service/Datasource/DashboardDatasourceService.php` and shipped
+	 * under `OCA\OpenConnector\Service\Datasource` before the rename. The
+	 * previous value here named `Service\DashboardDataSourceService` — an
+	 * extra namespace segment short and a capital `S` out — which has never
+	 * existed under either name.
 	 *
 	 * @var string
 	 */
-	private const OPENCONNECTOR_DATASOURCE_SERVICE_CLASS = 'OCA\\OpenConnector\\Service\\DashboardDataSourceService';
+	private const CONNECTOR_DATASOURCE_SERVICE_CLASS = 'Service\\Datasource\\DashboardDatasourceService';
 
 	/**
-	 * Method OpenConnector's data-source resolver is expected to expose:
-	 * `resolveDashboardValue(string $sourceId, string $valueExpr): array{value: mixed}`.
+	 * Method the connector's data-source resolver exposes:
+	 * `resolve(string $sourceId, string $valueExpr, array $params = [], ?int $ttl = null): array{value: mixed, fetchedAt: string, stale: bool}`.
 	 * Guarded with `method_exists()` before every call — a shape mismatch
 	 * degrades to "source unavailable" rather than a fatal error.
 	 *
 	 * @var string
 	 */
-	private const OPENCONNECTOR_DATASOURCE_METHOD = 'resolveDashboardValue';
+	private const CONNECTOR_DATASOURCE_METHOD = 'resolve';
 
 	/**
 	 * Badge threshold states, in priority order for icon/label fallback.
@@ -156,9 +171,10 @@ class LiveTileService {
 	/**
 	 * Constructor.
 	 *
-	 * @param IAppManager $appManager Detects whether `openconnector` is enabled.
+	 * @param IAppManager $appManager Detects whether the connector leaf is enabled,
+	 *                                under whichever id it registered.
 	 * @param ContainerInterface $container App container used to optionally resolve
-	 *                                      OpenConnector's data-source service
+	 *                                      Integriq's data-source service
 	 *                                      (REQ-LIVETILE-005 capability probe).
 	 * @param IClientService $clientService HTTP client factory for the direct-URL fetch.
 	 * @param ICacheFactory $cacheFactory Backing factory for the distributed value cache.
@@ -283,24 +299,34 @@ public function validateSourceConfig(array $config): array {
 	}//end validateSourceConfig()
 
 	/**
-	 * Whether the OpenConnector `dashboard-http-datasource` capability is
+	 * Whether Integriq's `dashboard-http-datasource` capability is
 	 * currently resolvable — app enabled AND the expected service present
 	 * in the container. Never throws (REQ-LIVETILE-005).
 	 *
 	 * @return boolean
 	 *
+	 * @SuppressWarnings(PHPMD.StaticAccess) FleetAppId is a stateless resolver.
+	 *
 	 * @spec openspec/specs/live-data-tile-widget/spec.md
 	 */
 	public function isConnectorAvailable(): bool {
 		try {
-			if ($this->appManager->isEnabledForUser(appId: self::OPENCONNECTOR_APP_ID) === false) {
+			$enabled = FleetAppId::isEnabledForUser(
+				appManager: $this->appManager,
+				canonical: self::CONNECTOR_APP
+			);
+			if ($enabled === false) {
 				return false;
 			}
 
-			return $this->container->has(id: self::OPENCONNECTOR_DATASOURCE_SERVICE_CLASS);
+			return FleetAppId::hasService(
+				container: $this->container,
+				canonical: self::CONNECTOR_APP,
+				relative: self::CONNECTOR_DATASOURCE_SERVICE_CLASS
+			);
 		} catch (Throwable $exception) {
 			$this->logger->info(
-				message: 'LiveTileService: OpenConnector capability probe failed, treating as absent',
+				message: 'LiveTileService: connector capability probe failed, treating as absent',
 				context: ['app' => Application::APP_ID, 'exception' => $exception->getMessage()]
 			);
 			return false;
@@ -331,7 +357,7 @@ private function fetchFresh(array $config): ?array {
 	}//end fetchFresh()
 
 	/**
-	 * Resolve via OpenConnector's `dashboard-http-datasource` capability
+	 * Resolve via Integriq's `dashboard-http-datasource` capability
 	 * (REQ-LIVETILE-005). Returns `null` — never throws — when the
 	 * capability probe fails, the service's expected method is absent, or
 	 * the call itself fails; the caller then falls back to a stale cached
@@ -343,6 +369,8 @@ private function fetchFresh(array $config): ?array {
 	 * @param array<string,mixed> $config The placement's resolved config (`sourceId`, `valueExpr`).
 	 *
 	 * @return array<string,mixed>|null `{rawValue: mixed}` or `null`.
+	 *
+	 * @SuppressWarnings(PHPMD.StaticAccess) FleetAppId is a stateless resolver.
 	 */
 	private function fetchFromConnector(array $config): ?array {
 		if ($this->isConnectorAvailable() === false) {
@@ -356,15 +384,23 @@ private function fetchFromConnector(array $config): ?array {
 		}
 
 		try {
-			$service = $this->container->get(id: self::OPENCONNECTOR_DATASOURCE_SERVICE_CLASS);
-			if (method_exists(object_or_class: $service, method: self::OPENCONNECTOR_DATASOURCE_METHOD) === false) {
+			$service = FleetAppId::getService(
+				container: $this->container,
+				canonical: self::CONNECTOR_APP,
+				relative: self::CONNECTOR_DATASOURCE_SERVICE_CLASS
+			);
+			if ($service === null) {
+				return null;
+			}
+
+			if (method_exists(object_or_class: $service, method: self::CONNECTOR_DATASOURCE_METHOD) === false) {
 				return null;
 			}
 
-			$result = $service->{self::OPENCONNECTOR_DATASOURCE_METHOD}($sourceId, $valueExpr);
+			$result = $service->{self::CONNECTOR_DATASOURCE_METHOD}($sourceId, $valueExpr);
 		} catch (Throwable $exception) {
 			$this->logger->info(
-				message: 'LiveTileService: OpenConnector source-run call failed',
+				message: 'LiveTileService: connector resolve call failed',
 				context: ['app' => Application::APP_ID, 'exception' => $exception->getMessage()]
 			);
 			return null;
diff --git a/lib/Service/PlacementPayloadHydrator.php b/lib/Service/PlacementPayloadHydrator.php
new file mode 100644
index 000000000..f1321f222
--- /dev/null
+++ b/lib/Service/PlacementPayloadHydrator.php
@@ -0,0 +1,169 @@
+<?php
+
+/**
+ * PlacementPayloadHydrator
+ *
+ * Builds a WidgetPlacement from the array a placement is exported as — the
+ * shape `WidgetPlacement::jsonSerialize()` writes into a
+ * `launchpad-export-v1` archive. Every path that reads such an archive back
+ * goes through here: the dashboard importer (`ImportService`, which the
+ * store's install path also uses) and the bundled showcase installer
+ * (`DemoShowcasesService`).
+ *
+ * WHY ONE BUILDER. Each of those paths used to carry its own copy, and each
+ * copy kept a different subset of the fields export writes. The importer kept
+ * the grid, the style and the title and dropped the rest, so a dashboard that
+ * went out through export and came back through import lost every widget's
+ * configuration (`content`) and every tile's identity (`tileType` and its
+ * fields). The showcase installer dropped `content` too, until launchpad#606.
+ * Two copies drifted; one cannot.
+ *
+ * WHAT IS DELIBERATELY NOT CARRIED. Fields that point at THIS instance or at a
+ * workflow on it rather than describing the widget: `id`, `dashboardId`,
+ * `templatePlacementId` (the id of another placement row), `isCompulsory`
+ * (an admin push, not part of a dashboard's layout), the mandatory-read
+ * `acknowledgement*` fields and `announcementKey`. A fresh placement gets
+ * fresh timestamps.
+ *
+ * @category  Service
+ * @package   OCA\LaunchPad\Service
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ * @version   GIT:auto
+ * @link      https://conduction.nl
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * @spec openspec/specs/dashboard-export-import/spec.md
+ */
+
+declare(strict_types=1);
+
+namespace OCA\LaunchPad\Service;
+
+use DateTime;
+use OCA\LaunchPad\Db\WidgetPlacement;
+
+/**
+ * Build a placement entity from its exported array form.
+ */
+class PlacementPayloadHydrator {
+	/**
+	 * Tile fields, copied as strings when present.
+	 *
+	 * Mirrors the block `WidgetPlacement::jsonSerialize()` emits when a
+	 * placement is a tile.
+	 *
+	 * @var array<int, string>
+	 */
+	private const TILE_FIELDS = [
+		'tileIcon',
+		'tileIconType',
+		'tileBackgroundColor',
+		'tileTextColor',
+		'tileLinkType',
+		'tileLinkValue',
+	];
+
+	/**
+	 * Build an unsaved placement on a dashboard from an exported payload.
+	 *
+	 * @param int                  $dashboardId The dashboard the placement joins.
+	 * @param array<string, mixed> $payload     One entry of an exported dashboard's
+	 *                                          `widgets` array.
+	 *
+	 * @return WidgetPlacement The placement, not yet persisted.
+	 *
+	 * @spec openspec/specs/dashboard-export-import/spec.md
+	 */
+	public function hydrate(int $dashboardId, array $payload): WidgetPlacement {
+		$placement = new WidgetPlacement();
+		$now = (new DateTime())->format(format: 'Y-m-d H:i:s');
+
+		// Entity setters resolve through __call, which reads $args[0]; named
+		// arguments would break that forwarding.
+		// phpcs:disable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$placement->setDashboardId($dashboardId);
+		$placement->setWidgetId((string)($payload['widgetId'] ?? ''));
+		$placement->setGridX((int)($payload['gridX'] ?? 0));
+		$placement->setGridY((int)($payload['gridY'] ?? 0));
+		$placement->setGridWidth((int)($payload['gridWidth'] ?? 4));
+		$placement->setGridHeight((int)($payload['gridHeight'] ?? 4));
+		$placement->setIsVisible((int)($payload['isVisible'] ?? 1));
+		$placement->setShowTitle((int)($payload['showTitle'] ?? 1));
+		$placement->setSortOrder((int)($payload['sortOrder'] ?? 0));
+		$placement->setCreatedAt($now);
+		$placement->setUpdatedAt($now);
+
+		if (isset($payload['customTitle']) === true) {
+			$placement->setCustomTitle((string)$payload['customTitle']);
+		}
+
+		if (isset($payload['customIcon']) === true) {
+			$placement->setCustomIcon((string)$payload['customIcon']);
+		}
+
+		// phpcs:enable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+
+		$this->applyTile(placement: $placement, payload: $payload);
+		$this->applyBlobs(placement: $placement, payload: $payload);
+
+		return $placement;
+	}//end hydrate()
+
+	/**
+	 * Copy a tile's type and fields, when the payload is a tile.
+	 *
+	 * @param WidgetPlacement      $placement The placement being built.
+	 * @param array<string, mixed> $payload   The exported payload.
+	 *
+	 * @return void
+	 */
+	private function applyTile(WidgetPlacement $placement, array $payload): void {
+		if (isset($payload['tileType']) === false) {
+			return;
+		}
+
+		// phpcs:disable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$placement->setTileType((string)$payload['tileType']);
+		// A tile always gets a title, empty if the payload has none.
+		$placement->setTileTitle((string)($payload['tileTitle'] ?? ''));
+		foreach (self::TILE_FIELDS as $field) {
+			if (isset($payload[$field]) === true) {
+				$placement->{'set' . ucfirst($field)}((string)$payload[$field]);
+			}
+		}
+
+		// phpcs:enable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+	}//end applyTile()
+
+	/**
+	 * Copy the two JSON blobs: `styleConfig` and `content`.
+	 *
+	 * A registry widget's configuration lives in `content`: which register an
+	 * object-list reads, which Nextcloud widget an nc-widget proxies, what a
+	 * text widget says. Without it the placement lands and renders as an
+	 * unconfigured widget, which nothing on the way in can notice. Export
+	 * writes an empty blob as `{}`, which decodes to `[]`; that carries
+	 * nothing, so the column is left NULL rather than set to `[]`.
+	 *
+	 * @param WidgetPlacement      $placement The placement being built.
+	 * @param array<string, mixed> $payload   The exported payload.
+	 *
+	 * @return void
+	 */
+	private function applyBlobs(WidgetPlacement $placement, array $payload): void {
+		if (isset($payload['styleConfig']) === true && is_array($payload['styleConfig']) === true) {
+			$placement->setStyleConfigArray(config: $payload['styleConfig']);
+		}
+
+		if (isset($payload['content']) === true
+			&& is_array($payload['content']) === true
+			&& $payload['content'] !== []
+		) {
+			$placement->setContentArray(content: $payload['content']);
+		}
+	}//end applyBlobs()
+}//end class
diff --git a/lib/Service/RoleFeaturePermissionService.php b/lib/Service/RoleFeaturePermissionService.php
index b43fb2831..12868fee5 100644
--- a/lib/Service/RoleFeaturePermissionService.php
+++ b/lib/Service/RoleFeaturePermissionService.php
@@ -148,6 +148,7 @@ public function savePermission(array $data): RoleFeaturePermission {
 		}
 
 		$entity = $this->resolvePermissionEntity(groupId: $groupId);
+		$this->requireNameForNewRow(isNew: ($entity->getId() === null), data: $data);
 
 		$this->applyPermissionCopy(entity: $entity, data: $data);
 		$this->applyPermissionWidgetLists(entity: $entity, data: $data);
@@ -315,6 +316,7 @@ public function saveLayoutDefault(array $data): RoleLayoutDefault {
 			groupId: $groupId,
 			widgetId: $widgetId
 		);
+		$this->requireNameForNewRow(isNew: ($entity->getId() === null), data: $data);
 
 		$this->applyLayoutDefaultCopy(entity: $entity, data: $data);
 		$this->applyLayoutDefaultGeometry(entity: $entity, data: $data);
@@ -745,4 +747,28 @@ private function groupIdsForUser(string $userId): array {
 
 		return $this->adminTemplateService->getUserGroupIdsFor(userId: $userId);
 	}//end groupIdsForUser()
+	/**
+	 * Refuse a new row that carries no `name`.
+	 *
+	 * `name` is NOT NULL with no default in both tables, and the spec lists it
+	 * as required. The copy helpers set it only when the payload carries it, so
+	 * a new row without it used to reach the database with the column missing
+	 * and fail there with SQLSTATE 23502, which the API reported as a bare
+	 * "Operation failed". An existing row keeps its stored name, and an empty
+	 * string is still accepted, as the admin editors send one.
+	 *
+	 * @param bool                 $isNew Whether the save will INSERT.
+	 * @param array<string, mixed> $data  The request payload.
+	 *
+	 * @return void
+	 *
+	 * @throws InvalidArgumentException When a new row carries no name.
+	 *
+	 * @spec openspec/specs/role-feature-permissions/spec.md
+	 */
+	private function requireNameForNewRow(bool $isNew, array $data): void {
+		if ($isNew === true && array_key_exists(key: 'name', array: $data) === false) {
+			throw new InvalidArgumentException(message: 'name is required');
+		}
+	}//end requireNameForNewRow()
 }//end class
diff --git a/lib/Service/StoreService.php b/lib/Service/StoreService.php
new file mode 100644
index 000000000..1feee8d4a
--- /dev/null
+++ b/lib/Service/StoreService.php
@@ -0,0 +1,509 @@
+<?php
+
+/**
+ * StoreService
+ *
+ * Cross-instance dashboard sharing over OpenRegister's AppHost store plane
+ * (ADR-080). Discovery is the engine's: `GenericStoreService` owns the SSRF
+ * guard, the redirect refusal, the Bearer-only token transport, the outcome
+ * vocabulary and card normalisation. Install is LaunchPad's, because a
+ * dashboard lives in LaunchPad's own tables and neither engine install op
+ * (`writeObject`, `setAppConfig`) nor a federated configuration bundle can
+ * produce one.
+ *
+ * 🔴 THE ENGINE IS OPTIONAL AND MAY BE NULL. LaunchPad declares no `<app>`
+ * dependency on OpenRegister, so it can run without it. Every OpenRegister
+ * class here is named as a STRING and instantiated only once the injected
+ * client proved non-null, which keeps NC bootstrap fatal-free when OpenRegister
+ * is disabled or absent. The degraded state is `not_configured`, the same
+ * outcome an unconfigured registry produces, so the store page falls back to
+ * its built-in items either way.
+ *
+ * Implements the `dashboard-store` capability (REQ-STORE-002..007).
+ *
+ * @category  Service
+ * @package   OCA\LaunchPad\Service
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ * @version   GIT:auto
+ * @link      https://conduction.nl
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace OCA\LaunchPad\Service;
+
+use OCA\LaunchPad\AppInfo\Application;
+use OCP\IAppConfig;
+use Psr\Log\LoggerInterface;
+use RuntimeException;
+use Throwable;
+use ZipArchive;
+
+/**
+ * Browse a remote dashboard registry and install one of its templates.
+ *
+ * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md
+ */
+class StoreService {
+	/**
+	 * Remote schema slug this store reads.
+	 *
+	 * A registry publishes dashboard templates as objects of this schema. It is
+	 * deliberately NOT one of the `openregister.configset` types: a non-empty
+	 * `types` list selects the engine's federated configuration path, which
+	 * trades registers, schemas and flows rather than dashboards.
+	 */
+	public const REMOTE_SCHEMA = 'dashboard-template';
+
+	/**
+	 * Register segment used when `registry_register` is unset or empty.
+	 */
+	public const DEFAULT_REGISTER = 'launchpad';
+
+	/**
+	 * Card field name to remote object property.
+	 *
+	 * The engine flattens a remote object to a card using ONLY this map plus
+	 * `kind`, so anything a registry sends outside it — a manifest, a
+	 * credential-shaped field — never reaches the browser.
+	 *
+	 * @var array<string, string>
+	 */
+	public const CARD_FIELDS = [
+		'slug' => 'slug',
+		'title' => 'title',
+		'description' => 'description',
+		'category' => 'category',
+		'version' => 'version',
+		'publisher' => 'publisher',
+	];
+
+	/**
+	 * Fully-qualified name of the engine's descriptor value object.
+	 *
+	 * Held as a string so no `OCA\OpenRegister\…` symbol is touched at load
+	 * time. Instantiated only after the injected client proved non-null.
+	 */
+	private const DESCRIPTOR_CLASS = 'OCA\\OpenRegister\\AppHost\\Service\\StoreDescriptor';
+
+	/**
+	 * Outcome reported when there is nothing to talk to.
+	 */
+	public const OUTCOME_NOT_CONFIGURED = 'not_configured';
+
+	/**
+	 * Config key holding the registry base URL.
+	 */
+	public const CONFIG_URL = 'registry_url';
+
+	/**
+	 * Config key holding the registry Bearer token.
+	 */
+	public const CONFIG_TOKEN = 'registry_token';
+
+	/**
+	 * Config key holding the remote register segment.
+	 */
+	public const CONFIG_REGISTER = 'registry_register';
+
+	/**
+	 * Constructor.
+	 *
+	 * @param object|null     $discovery     OpenRegister's `GenericStoreService`, or null when
+	 *                                       OpenRegister is unavailable. Untyped on purpose: a
+	 *                                       typed parameter would load the class at resolution
+	 *                                       time and fatal on an instance without OpenRegister.
+	 * @param ImportService   $importService LaunchPad's one and only dashboard importer.
+	 * @param IAppConfig      $appConfig     Where the engine reads the registry connection.
+	 * @param LoggerInterface $logger        PSR logger — server-side diagnostics only.
+	 *
+	 * @return void
+	 */
+	public function __construct(
+		private readonly ?object $discovery,
+		private readonly ImportService $importService,
+		private readonly IAppConfig $appConfig,
+		private readonly LoggerInterface $logger,
+	) {
+	}//end __construct()
+
+	/**
+	 * Whether the discovery engine is present at all.
+	 *
+	 * @return bool True when OpenRegister supplied a store client.
+	 *
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-002-an-absent-openregister-must-degrade-never-fatal
+	 */
+	public function isAvailable(): bool {
+		return $this->discovery !== null;
+	}//end isAvailable()
+
+	/**
+	 * Search the configured registry for dashboard templates.
+	 *
+	 * The engine's outcome is passed through VERBATIM. `store_unreachable` and
+	 * `store_invalid_response` are deliberately not collapsed: a misconfigured
+	 * registry would otherwise read as an offline one, and the two need
+	 * different fixes.
+	 *
+	 * @param string|null $query Optional free-text search term.
+	 * @param string|null $kind  Optional kind filter.
+	 *
+	 * @return array{outcome: string, cards: array<int, array<string, mixed>>}
+	 *
+	 * @psalm-suppress MixedMethodCall The discovery client is untyped on purpose.
+	 *
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-003-the-engines-outcome-must-reach-the-caller-unchanged
+	 */
+	public function search(?string $query = null, ?string $kind = null): array {
+		if ($this->discovery === null) {
+			return ['outcome' => self::OUTCOME_NOT_CONFIGURED, 'cards' => []];
+		}
+
+		$result = $this->discovery->search(
+			descriptor: $this->descriptor(),
+			query: $query,
+			kind: $kind
+		);
+
+		if (is_array($result) === false) {
+			return ['outcome' => self::OUTCOME_NOT_CONFIGURED, 'cards' => []];
+		}
+
+		$cards = ($result['cards'] ?? []);
+		if (is_array($cards) === false) {
+			$cards = [];
+		}
+
+		return [
+			'outcome' => (string)($result['outcome'] ?? self::OUTCOME_NOT_CONFIGURED),
+			'cards' => $cards,
+		];
+	}//end search()
+
+	/**
+	 * Install one remote dashboard template into this instance.
+	 *
+	 * The resolved payload is materialised into a `launchpad-export-v1` archive
+	 * and handed to {@see ImportService::import()}. LaunchPad gains no second
+	 * path from a dashboard payload to rows: the importer that validates an
+	 * administrator's uploaded ZIP is the importer that validates this one.
+	 *
+	 * `preserveUuids` is FALSE, which is what makes a store install additive. A
+	 * template published by a foreign instance carries that instance's UUIDs and
+	 * one of them can collide with a live local dashboard.
+	 *
+	 * @param string $slug   The remote item slug.
+	 * @param string $userId The installing administrator's UID.
+	 *
+	 * @return array{success: bool, message: string, components: array<int, array<string, string>>}
+	 *
+	 * @psalm-suppress MixedMethodCall The discovery client is untyped on purpose.
+	 *
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-005-an-install-must-reuse-importservice-not-reimplement-it
+	 */
+	public function install(string $slug, string $userId): array {
+		if ($this->discovery === null) {
+			return $this->failure(message: 'No dashboard registry is available on this instance.');
+		}
+
+		$item = $this->discovery->resolve(descriptor: $this->descriptor(), slug: $slug);
+		if (is_array($item) === false) {
+			return $this->failure(message: 'That template could not be found in the registry.');
+		}
+
+		$dashboards = $this->dashboardsFrom(item: $item);
+		if ($dashboards === []) {
+			return $this->failure(message: 'That template carries no dashboard.');
+		}
+
+		try {
+			$archivePath = $this->materialise(dashboards: $dashboards, slug: $slug, userId: $userId);
+		} catch (Throwable $e) {
+			$this->logger->error(
+				message: 'Could not build a store archive for ' . $slug . ': ' . $e->getMessage(),
+				context: ['app' => Application::APP_ID]
+			);
+			return $this->failure(message: 'That template could not be prepared for import.');
+		}
+
+		try {
+			$report = $this->importService->import(
+				zipPath: $archivePath,
+				preserveUuids: false,
+				currentUserId: $userId
+			);
+		} catch (Throwable $e) {
+			// Detail to the log, a plain sentence to the browser. A registry's
+			// malformed payload is not the administrator's business to debug.
+			$this->logger->error(
+				message: 'Store install failed for ' . $slug . ': ' . $e->getMessage(),
+				context: ['app' => Application::APP_ID]
+			);
+			return $this->failure(message: 'That template could not be installed.');
+		} finally {
+			// Runs on the throwing path too, so a failed install leaves nothing
+			// behind in the temp directory.
+			$this->discard(path: $archivePath);
+		}//end try
+
+		return $this->report(report: $report, dashboards: $dashboards);
+	}//end install()
+
+	/**
+	 * The registry connection, with the token redacted.
+	 *
+	 * 🔴 THE TOKEN NEVER LEAVES THE SERVER. The read reports only WHETHER one
+	 * is set. Returning it so an admin form could pre-fill would put a
+	 * credential in a browser response, and the form does not need it: an empty
+	 * submission clears the token and a non-empty one replaces it.
+	 *
+	 * @return array{registryUrl: string, registryRegister: string, tokenConfigured: bool}
+	 *
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-007-the-registry-token-must-not-be-readable-back
+	 */
+	public function getRegistryConfig(): array {
+		return [
+			'registryUrl' => $this->config(key: self::CONFIG_URL),
+			'registryRegister' => $this->config(key: self::CONFIG_REGISTER),
+			'tokenConfigured' => ($this->config(key: self::CONFIG_TOKEN) !== ''),
+		];
+	}//end getRegistryConfig()
+
+	/**
+	 * Write the registry connection.
+	 *
+	 * Each value is optional: a null leaves the stored key untouched, which is
+	 * what lets a form change the URL without resubmitting the token. An empty
+	 * string is a real value and CLEARS the key.
+	 *
+	 * @param string|null $registryUrl      Registry base URL, or null to leave it.
+	 * @param string|null $registryToken    Bearer token, or null to leave it.
+	 * @param string|null $registryRegister Remote register segment, or null to leave it.
+	 *
+	 * @return void
+	 *
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-007-the-registry-token-must-not-be-readable-back
+	 */
+	public function updateRegistryConfig(
+		?string $registryUrl = null,
+		?string $registryToken = null,
+		?string $registryRegister = null,
+	): void {
+		if ($registryUrl !== null) {
+			$this->appConfig->setValueString(Application::APP_ID, self::CONFIG_URL, trim($registryUrl));
+		}
+
+		if ($registryToken !== null) {
+			$this->appConfig->setValueString(Application::APP_ID, self::CONFIG_TOKEN, trim($registryToken));
+		}
+
+		if ($registryRegister !== null) {
+			$this->appConfig->setValueString(Application::APP_ID, self::CONFIG_REGISTER, trim($registryRegister));
+		}
+	}//end updateRegistryConfig()
+
+	/**
+	 * Build the engine descriptor for this app's store.
+	 *
+	 * Only ever called once `$this->discovery` proved non-null, which is what
+	 * guarantees the OpenRegister class is loadable here.
+	 *
+	 * @return object The engine's StoreDescriptor.
+	 *
+	 * @throws RuntimeException When OpenRegister supplied a client but not a descriptor class.
+	 *
+	 * @psalm-suppress MixedMethodCall Instantiated from a class string by design.
+	 */
+	private function descriptor(): object {
+		$class = self::DESCRIPTOR_CLASS;
+		if (class_exists($class) === false) {
+			throw new RuntimeException(message: 'OpenRegister store descriptor is unavailable.');
+		}
+
+		return new $class(
+			appId: Application::APP_ID,
+			schema: self::REMOTE_SCHEMA,
+			defaultRegister: self::DEFAULT_REGISTER,
+			cardFields: self::CARD_FIELDS,
+			types: []
+		);
+	}//end descriptor()
+
+	/**
+	 * Pull the dashboard payloads out of a resolved registry item.
+	 *
+	 * A registry may store the payload as a nested list or as a JSON string, so
+	 * both are accepted. Anything else yields an empty list, and the caller
+	 * refuses the install rather than importing an empty archive.
+	 *
+	 * @param array<string, mixed> $item The resolved remote object.
+	 *
+	 * @return array<int, array<string, mixed>> The dashboard payloads.
+	 */
+	private function dashboardsFrom(array $item): array {
+		$raw = ($item['dashboards'] ?? null);
+		if (is_string($raw) === true) {
+			$raw = json_decode(json: $raw, associative: true);
+		}
+
+		if (is_array($raw) === false) {
+			return [];
+		}
+
+		$dashboards = [];
+		foreach ($raw as $payload) {
+			if (is_array($payload) === true && (string)($payload['uuid'] ?? '') !== '') {
+				$dashboards[] = $payload;
+			}
+		}
+
+		return $dashboards;
+	}//end dashboardsFrom()
+
+	/**
+	 * Write the payloads into a `launchpad-export-v1` archive.
+	 *
+	 * The shape mirrors {@see ExportService} exactly, because
+	 * {@see ImportService::validateZipStructure()} is what reads it back.
+	 *
+	 * @param array<int, array<string, mixed>> $dashboards The dashboard payloads.
+	 * @param string                           $slug       The remote item slug, for the manifest.
+	 * @param string                           $userId     The installing UID, for the manifest.
+	 *
+	 * @return string Path to the temporary archive.
+	 *
+	 * @throws RuntimeException When the archive cannot be allocated or opened.
+	 */
+	private function materialise(array $dashboards, string $slug, string $userId): string {
+		$tempPath = tempnam(directory: sys_get_temp_dir(), prefix: 'launchpad-store-');
+		if ($tempPath === false) {
+			throw new RuntimeException(message: 'Could not allocate a temporary file for the install.');
+		}
+
+		$zip = new ZipArchive();
+		if ($zip->open(filename: $tempPath, flags: ZipArchive::OVERWRITE) !== true) {
+			unlink(filename: $tempPath);
+			throw new RuntimeException(message: 'Could not open the store archive for writing.');
+		}
+
+		$manifest = [
+			'schemaVersion' => ImportService::SCHEMA_VERSION,
+			'exportedAt' => gmdate(format: 'Y-m-d\TH:i:s\Z'),
+			'exportedBy' => $userId,
+			'launchpadVersion' => 'launchpad/v1',
+			'scope' => 'dashboard',
+			'dashboardCount' => count($dashboards),
+			'includedAssets' => [],
+			'sourceSlug' => $slug,
+		];
+
+		$zip->addFromString(name: 'manifest.json', content: $this->encode(payload: $manifest));
+
+		foreach ($dashboards as $payload) {
+			$zip->addFromString(
+				name: 'dashboards/' . (string)$payload['uuid'] . '.json',
+				content: $this->encode(payload: $payload)
+			);
+		}
+
+		$zip->addFromString(name: 'metadata-fields.json', content: $this->encode(payload: []));
+		$zip->close();
+
+		return $tempPath;
+	}//end materialise()
+
+	/**
+	 * Turn the importer's result into the store page's per-component report.
+	 *
+	 * `CnStorePage` reads `components[].status` and names every entry that is
+	 * not `installed`, so a partial install states which dashboard did not
+	 * arrive instead of reporting a flat failure.
+	 *
+	 * @param array<string, mixed>             $report     The importer's result.
+	 * @param array<int, array<string, mixed>> $dashboards The payloads that were offered.
+	 *
+	 * @return array{success: bool, message: string, components: array<int, array<string, string>>}
+	 */
+	private function report(array $report, array $dashboards): array {
+		$imported = (int)($report['importedDashboardCount'] ?? 0);
+
+		$components = [];
+		$index = 0;
+		foreach ($dashboards as $payload) {
+			$name = (string)($payload['name'] ?? $payload['uuid'] ?? 'dashboard');
+
+			$status = 'refused';
+			if ($index < $imported) {
+				$status = 'installed';
+			}
+
+			$components[] = ['schema' => $name, 'status' => $status];
+			$index++;
+		}
+
+		$message = 'Installed ' . (string)$imported . ' of ' . (string)count($dashboards) . '.';
+
+		return [
+			'success' => ($imported > 0),
+			'message' => $message,
+			'components' => $components,
+		];
+	}//end report()
+
+	/**
+	 * Remove a temporary archive, tolerating one that is already gone.
+	 *
+	 * @param string $path The archive path.
+	 *
+	 * @return void
+	 */
+	private function discard(string $path): void {
+		if (file_exists(filename: $path) === true) {
+			unlink(filename: $path);
+		}
+	}//end discard()
+
+	/**
+	 * Read one registry config value.
+	 *
+	 * @param string $key The config key.
+	 *
+	 * @return string The trimmed value, or the empty string.
+	 */
+	private function config(string $key): string {
+		return trim($this->appConfig->getValueString(Application::APP_ID, $key, ''));
+	}//end config()
+
+	/**
+	 * JSON-encode an archive entry.
+	 *
+	 * @param array<mixed> $payload The payload.
+	 *
+	 * @return string The encoded JSON.
+	 */
+	private function encode(array $payload): string {
+		$encoded = json_encode(value: $payload, flags: (JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
+		if ($encoded === false) {
+			return '{}';
+		}
+
+		return $encoded;
+	}//end encode()
+
+	/**
+	 * A refusal carrying no components.
+	 *
+	 * @param string $message The sentence the administrator reads.
+	 *
+	 * @return array{success: bool, message: string, components: array<int, array<string, string>>}
+	 */
+	private function failure(string $message): array {
+		return ['success' => false, 'message' => $message, 'components' => []];
+	}//end failure()
+}//end class
diff --git a/lib/Support/FleetAppId.php b/lib/Support/FleetAppId.php
new file mode 100644
index 000000000..17346165c
--- /dev/null
+++ b/lib/Support/FleetAppId.php
@@ -0,0 +1,353 @@
+<?php
+
+/**
+ * FleetAppId — resolve a Conduction fleet app's installed id across the rename.
+ *
+ * The fleet renamed: `openconnector` became `integriq`, `docudesk` became
+ * `filinq`, and so on. As of September 2026 the new names have reached
+ * `main`, `beta` and `development` alike, so a current instance answers to the
+ * new id — but an instance pinned to an older release still answers only to
+ * the old one, and both are in the field at once.
+ *
+ * That matters because every cross-app reference is a DUCK-TYPED RUNTIME
+ * LOOKUP. `IAppManager::isInstalled('openconnector')` against an instance
+ * running `integriq` does not error — it returns false, and the integration
+ * silently does nothing. A hard swap to the new id has the same failure in
+ * the other direction against an older deployment.
+ *
+ * So neither name alone is correct. This resolver takes a LIST, newest first,
+ * and returns whichever the instance actually has. Callers ask for the
+ * canonical (new) name and get back the identity that really exists.
+ *
+ * The rename moved TWO things — the app id and the PHP namespace — and each
+ * breaks its own set of call sites. `resolve()`, `isInstalled()`,
+ * `isEnabledForUser()` and `appPath()` cover the id. `classCandidates()`,
+ * `resolveClass()`, `getService()` and `isInstanceOf()` cover the namespace.
+ * Fixing one half and not the other leaves the integration just as dark,
+ * which is how thirteen filinq bindings across five apps stayed broken for a
+ * fortnight.
+ *
+ * This file is a port of `OCA\Dossiq\Support\FleetAppId`, kept deliberately
+ * identical below the namespace line so the two stay diffable and a future
+ * rename is one copy, not two edits.
+ *
+ * @category  Support
+ * @package   OCA\LaunchPad\Support
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ * @version   GIT:auto
+ * @link      https://conduction.nl
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace OCA\LaunchPad\Support;
+
+use OCP\App\IAppManager;
+use Psr\Container\ContainerInterface;
+use Throwable;
+
+/**
+ * Resolves fleet app ids and namespaces across the in-flight rename.
+ *
+ * @spec exclude infrastructure utility with no feature requirement of its own; it is
+ *   exercised through the features that call it
+ */
+final class FleetAppId {
+
+	/**
+	 * Candidate ids per canonical app, NEWEST FIRST.
+	 *
+	 * Order is the contract: the first entry that is installed wins, so a
+	 * fully migrated instance resolves to the new id and a beta/main instance
+	 * falls back to the old one. Adding a new rename means prepending, never
+	 * replacing — dropping the old id here is what silently breaks the
+	 * integrations this class exists to protect.
+	 *
+	 * @var array<string,list<string>>
+	 */
+	private const CANDIDATES = [
+		'integriq' => ['integriq', 'openconnector'],
+		'filinq' => ['filinq', 'docudesk'],
+		'thematiq' => ['thematiq', 'nldesign'],
+		'stackiq' => ['stackiq', 'softwarecatalog'],
+		'larpinq' => ['larpinq', 'larpingapp'],
+		'dossiq' => ['dossiq', 'procest'],
+		'learniq' => ['learniq', 'scholiq'],
+		'decidiq' => ['decidiq', 'decidesk'],
+		'buildiq' => ['buildiq', 'openbuild'],
+		'keepiq' => ['keepiq', 'doriath'],
+	];
+
+	/**
+	 * Candidate PHP namespaces per canonical app, NEWEST FIRST.
+	 *
+	 * The rename moved each app's PSR-4 root as well as its id, and the two
+	 * halves break differently. A stale id makes `isInstalled()` answer false;
+	 * a stale namespace makes `class_exists()` answer false and
+	 * `ContainerInterface::get()` throw. Both fail into the same silent no-op,
+	 * because every cross-app binding in the fleet is guarded.
+	 *
+	 * Every pair below was read out of that app's own composer.json history,
+	 * not inferred from its id — `openbuild` shipped `OCA\OpenBuilt`, which no
+	 * naming rule would have produced.
+	 *
+	 * @var array<string,list<string>>
+	 */
+	private const NAMESPACES = [
+		'integriq' => ['OCA\Integriq', 'OCA\OpenConnector'],
+		'filinq' => ['OCA\Filinq', 'OCA\DocuDesk'],
+		'thematiq' => ['OCA\Thematiq', 'OCA\NLDesign'],
+		'stackiq' => ['OCA\Stackiq', 'OCA\SoftwareCatalog'],
+		'larpinq' => ['OCA\Larpinq', 'OCA\LarpingApp'],
+		'dossiq' => ['OCA\Dossiq', 'OCA\Procest'],
+		'learniq' => ['OCA\Learniq', 'OCA\Scholiq'],
+		'decidiq' => ['OCA\Decidiq', 'OCA\Decidesk'],
+		'buildiq' => ['OCA\Buildiq', 'OCA\OpenBuilt'],
+		'keepiq' => ['OCA\Keepiq', 'OCA\Doriath'],
+	];
+
+	/**
+	 * The id this instance actually has installed, or null if none is.
+	 *
+	 * @param IAppManager $appManager The Nextcloud app manager.
+	 * @param string      $canonical  Canonical (new) app name, e.g. 'integriq'.
+	 *
+	 * @return string|null The installed id, or null when the app is absent.
+	 *
+	 * @spec exclude infrastructure utility with no feature requirement of its own; it is
+	 *   exercised through the features that call it
+	 */
+	public static function resolve(IAppManager $appManager, string $canonical): ?string {
+		foreach ((self::CANDIDATES[$canonical] ?? [$canonical]) as $candidate) {
+			try {
+				if ($appManager->isInstalled($candidate) === true) {
+					return $candidate;
+				}
+			} catch (Throwable $exception) {
+				// An app manager that cannot answer for one candidate must not
+				// abort the search — the next candidate may still resolve.
+				continue;
+			}
+		}
+
+		return null;
+	}//end resolve()
+
+	/**
+	 * Whether any candidate id for this app is installed.
+	 *
+	 * @param IAppManager $appManager The Nextcloud app manager.
+	 * @param string      $canonical  Canonical (new) app name, e.g. 'integriq'.
+	 *
+	 * @return boolean True when the app is present under some id.
+	 *
+	 * @spec exclude infrastructure utility with no feature requirement of its own; it is
+	 *   exercised through the features that call it
+	 */
+	public static function isInstalled(IAppManager $appManager, string $canonical): bool {
+		return self::resolve(appManager: $appManager, canonical: $canonical) !== null;
+	}//end isInstalled()
+
+	/**
+	 * Whether the app is installed AND enabled for the current user.
+	 *
+	 * Resolves the id first so the enabled check runs against the same id the
+	 * instance actually has, rather than against a name it never registered.
+	 *
+	 * @param IAppManager $appManager The Nextcloud app manager.
+	 * @param string      $canonical  Canonical (new) app name, e.g. 'integriq'.
+	 *
+	 * @return boolean True when present and enabled for the current user.
+	 *
+	 * @spec exclude infrastructure utility with no feature requirement of its own; it is
+	 *   exercised through the features that call it
+	 */
+	public static function isEnabledForUser(IAppManager $appManager, string $canonical): bool {
+		$id = self::resolve(appManager: $appManager, canonical: $canonical);
+		if ($id === null) {
+			return false;
+		}
+
+		try {
+			return $appManager->isEnabledForUser($id);
+		} catch (Throwable $exception) {
+			return false;
+		}
+	}//end isEnabledForUser()
+
+	/**
+	 * Build an app-scoped path using the id the instance actually has.
+	 *
+	 * A URL like `/apps/openconnector/api/sources` is a routing key: Nextcloud
+	 * mounts routes under the REGISTERED app id, so the path is only valid for
+	 * the id that is really installed. Hardcoding either name yields a 404 on
+	 * half the fleet.
+	 *
+	 * @param IAppManager $appManager The Nextcloud app manager.
+	 * @param string      $canonical  Canonical (new) app name, e.g. 'integriq'.
+	 * @param string      $suffix     Path after the app segment, no leading slash.
+	 *
+	 * @return string|null The path, or null when the app is not installed.
+	 *
+	 * @spec exclude infrastructure utility with no feature requirement of its own; it is
+	 *   exercised through the features that call it
+	 */
+	public static function appPath(IAppManager $appManager, string $canonical, string $suffix = ''): ?string {
+		$id = self::resolve(appManager: $appManager, canonical: $canonical);
+		if ($id === null) {
+			return null;
+		}
+
+		$path = '/apps/' . $id;
+		if ($suffix !== '') {
+			$path .= '/' . ltrim($suffix, '/');
+		}
+
+		return $path;
+	}//end appPath()
+
+	/**
+	 * Every fully-qualified name a class could have, newest namespace first.
+	 *
+	 * Use this rather than {@see self::resolveClass()} when the answer is
+	 * needed BEFORE the other app's autoloader is certain to be registered —
+	 * most importantly when registering an event listener during
+	 * `Application::register()`. Registering the listener under every candidate
+	 * name is safe: dispatch matches on the concrete event class, so the names
+	 * that never materialise simply never fire.
+	 *
+	 * @param string $canonical Canonical (new) app name, e.g. 'integriq'.
+	 * @param string $relative  Class name below the app root, e.g. 'Service\Datasource\DashboardDatasourceService'.
+	 *
+	 * @return list<string> Candidate FQCNs, newest first; empty when unknown.
+	 *
+	 * @spec exclude infrastructure utility with no feature requirement of its own; it is
+	 *   exercised through the features that call it
+	 */
+	public static function classCandidates(string $canonical, string $relative): array {
+		$relative = ltrim($relative, '\\');
+		$candidates = [];
+
+		foreach ((self::NAMESPACES[$canonical] ?? []) as $namespace) {
+			$candidates[] = $namespace . '\\' . $relative;
+		}
+
+		return $candidates;
+	}//end classCandidates()
+
+	/**
+	 * The fully-qualified name this instance actually has, or null.
+	 *
+	 * @param string $canonical Canonical (new) app name, e.g. 'integriq'.
+	 * @param string $relative  Class name below the app root.
+	 *
+	 * @return string|null The FQCN that exists, or null when none does.
+	 *
+	 * @spec exclude infrastructure utility with no feature requirement of its own; it is
+	 *   exercised through the features that call it
+	 */
+	public static function resolveClass(string $canonical, string $relative): ?string {
+		foreach (self::classCandidates(canonical: $canonical, relative: $relative) as $fqcn) {
+			if (class_exists($fqcn) === true || interface_exists($fqcn) === true) {
+				return $fqcn;
+			}
+		}
+
+		return null;
+	}//end resolveClass()
+
+	/**
+	 * Fetch a service from another fleet app, whatever namespace it ships under.
+	 *
+	 * Replaces `$container->get('OCA\SomeOldName\Service\Thing')`, which throws
+	 * when that app has renamed and — because every call site of that shape is
+	 * wrapped in a try/catch that degrades gracefully — turns a rename into a
+	 * feature that quietly stops working rather than an error anybody sees.
+	 *
+	 * @param ContainerInterface $container The service container.
+	 * @param string             $canonical Canonical (new) app name, e.g. 'integriq'.
+	 * @param string             $relative  Class name below the app root.
+	 *
+	 * @return object|null The service, or null when no candidate resolves.
+	 *
+	 * @spec exclude infrastructure utility with no feature requirement of its own; it is
+	 *   exercised through the features that call it
+	 */
+	public static function getService(ContainerInterface $container, string $canonical, string $relative): ?object {
+		foreach (self::classCandidates(canonical: $canonical, relative: $relative) as $fqcn) {
+			try {
+				$service = $container->get($fqcn);
+				if (is_object($service) === true) {
+					return $service;
+				}
+			} catch (Throwable $exception) {
+				// This candidate is not registered — try the next name before
+				// concluding the app is absent.
+				continue;
+			}
+		}
+
+		return null;
+	}//end getService()
+
+	/**
+	 * Whether the container can resolve the class under any candidate namespace.
+	 *
+	 * The capability-probe counterpart to {@see self::getService()}: answers
+	 * "is this binding present?" without constructing the service.
+	 *
+	 * @param ContainerInterface $container The service container.
+	 * @param string             $canonical Canonical (new) app name, e.g. 'integriq'.
+	 * @param string             $relative  Class name below the app root.
+	 *
+	 * @return boolean True when some candidate FQCN is resolvable.
+	 *
+	 * @spec exclude infrastructure utility with no feature requirement of its own; it is
+	 *   exercised through the features that call it
+	 */
+	public static function hasService(ContainerInterface $container, string $canonical, string $relative): bool {
+		foreach (self::classCandidates(canonical: $canonical, relative: $relative) as $fqcn) {
+			try {
+				if ($container->has($fqcn) === true) {
+					return true;
+				}
+			} catch (Throwable $exception) {
+				continue;
+			}
+		}
+
+		return false;
+	}//end hasService()
+
+	/**
+	 * Whether a value is an instance of the named class under any candidate namespace.
+	 *
+	 * The listener-side counterpart to {@see self::classCandidates()}: a
+	 * listener registered under both names receives whichever event the other
+	 * app actually dispatches, so the type check has to accept both too.
+	 *
+	 * @param mixed  $value     The value to test, normally a dispatched event.
+	 * @param string $canonical Canonical (new) app name, e.g. 'integriq'.
+	 * @param string $relative  Class name below the app root.
+	 *
+	 * @return boolean True when $value is an instance of some candidate.
+	 *
+	 * @spec exclude infrastructure utility with no feature requirement of its own; it is
+	 *   exercised through the features that call it
+	 */
+	public static function isInstanceOf(mixed $value, string $canonical, string $relative): bool {
+		foreach (self::classCandidates(canonical: $canonical, relative: $relative) as $fqcn) {
+			if ($value instanceof $fqcn) {
+				return true;
+			}
+		}
+
+		return false;
+	}//end isInstanceOf()
+
+}//end class
diff --git a/lib/widget-types.json b/lib/widget-types.json
new file mode 100644
index 000000000..8425bdb6f
--- /dev/null
+++ b/lib/widget-types.json
@@ -0,0 +1,42 @@
+{
+	"_comment": [
+		"The widget types LaunchPad renders itself, keyed by the `widgetId` a placement carries.",
+		"One list, two readers. src/constants/__tests__/widgetRegistry.completeness.spec.js asserts",
+		"the frontend widgetRegistry's keys EQUAL this list, and DemoShowcasesService::partitionWidgets()",
+		"keeps a showcase widget whose type is on it. Before this file the PHP side knew only tiles and",
+		"Nextcloud dashboard ids, so the case-handler showcase installed with none of its four widgets.",
+		"Add or remove a type in the registry and here in the same commit; the vitest names the drift."
+	],
+	"types": [
+		"calendar",
+		"chart",
+		"clock",
+		"container",
+		"delta",
+		"divider",
+		"files",
+		"gauge",
+		"header",
+		"iframe",
+		"image",
+		"label",
+		"link",
+		"links",
+		"livetile",
+		"menu",
+		"nc-widget",
+		"news",
+		"object-list",
+		"people",
+		"quicklinks",
+		"search",
+		"spend-analytics",
+		"stat",
+		"stats-block",
+		"table",
+		"text",
+		"tile",
+		"video",
+		"weather"
+	]
+}
diff --git a/openspec/changes/e2e-coverage-programme/.openspec.yaml b/openspec/changes/e2e-coverage-programme/.openspec.yaml
new file mode 100644
index 000000000..515eaae39
--- /dev/null
+++ b/openspec/changes/e2e-coverage-programme/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-09-11
diff --git a/openspec/changes/e2e-coverage-programme/proposal.md b/openspec/changes/e2e-coverage-programme/proposal.md
new file mode 100644
index 000000000..139571700
--- /dev/null
+++ b/openspec/changes/e2e-coverage-programme/proposal.md
@@ -0,0 +1,61 @@
+# Give every LaunchPad scenario its own e2e verdict
+
+## Why
+
+LaunchPad's specs describe 2,834 scenarios across 78 capabilities. On 2026-09-11, 147 of them (5%) were cited by a Playwright test. 46 specs covered every scenario with one spec-level `@e2e exclude` line, which hides 1,862 scenarios from gate-19.
+
+A blanket exclusion says nothing about any single scenario. It cannot tell a scenario nobody can test from one nobody has tried. The first spec to lose its blanket shows what that costs.
+
+`dashboard-export-import` had 48 scenarios under one exclusion. Covering them one by one (#616) found three real defects. A corrupt file was reported with a blank ID. A skipped dashboard was reported under an invented ID. The admin page replaced the server's refusal reason with "Import failed. Please try again." Before that, #612 found that no import had ever landed a dashboard. The importer never set two required columns, and the unit tests mocked the database, so nothing noticed.
+
+Every blanket still in place may hide the same kind of defect.
+
+## What changes
+
+Each spec in LaunchPad ends with one verdict per scenario and no spec-level blanket. A scenario gets exactly one of three verdicts:
+
+- **Cited.** A Playwright test carries `// @e2e <spec>::<scenario-slug>` and asserts every THEN and AND clause of that scenario. A test that only loads a page does not count.
+- **New e2e.** Someone writes the test. It drives what a person does through the product's own controls, and uses the API only to seed and tear down.
+- **Excluded, with a reason.** The scenario carries `@e2e exclude <reason>`. The reason names the unit or Newman test that pins the behaviour, or says plainly that none exists or the feature was never built. Check `git log --all` before writing "never built".
+
+When a test shows the product disagreeing with its scenario, that is a defect. It gets fixed with a unit test. The e2e is not weakened to match the product.
+
+This change adds no requirements. It changes tests, the `@e2e` annotations in `openspec/specs/`, and product code wherever a test exposes a defect.
+
+## Order of work
+
+Specs are worked in five tiers. The tier decides the order, not the size.
+
+1. **Tier 0, safety (8 specs, 343 scenarios).** Who may see, change or share what. A false green here reads as proof that a protection works. Started on 2026-09-11.
+2. **Tier 1, data integrity (11 specs, 341 scenarios).** Deletes, cascades, versions, locks, quotas and bulk writes. #612 shows why: write paths tested only against a mocked database.
+   Since #617, CI's PHPUnit boots a real Nextcloud, so a write path can be pinned by a database test as well as an e2e. #617 checked all 33 insert sites against the 73 required columns and found two more silent failures: Confluence import never saved a dashboard, and a role permission saved without a name hit the database constraint.
+3. **Tier 2, core surfaces (19 specs, 823 scenarios).** Dashboards, widgets, the grid, tiles, templates and the setup wizard.
+4. **Tier 3, widgets (24 specs, 817 scenarios).** One spec per widget type.
+5. **Tier 4, admin, operations and integrations (14 specs, 419 scenarios).** CLI commands, background jobs, metrics and search providers. Many of these have no browser surface, so expect honest exclusions naming the PHPUnit or Newman test, rather than new e2e.
+
+## Rules for safety specs
+
+These apply in tier 0 and to any refusal in a later tier.
+
+- Probe a refusal with the least privileged principal that should be refused, logged in. An ordinary account proves the rule. A superuser success proves almost nothing, and an anonymous probe says nothing about a logged-in user.
+- Assert the exact status the spec names, not "not 200". Then re-read as the owner to confirm that nothing was written.
+- Prove the allowed principal can do it, in the same test. Otherwise a broken endpoint passes as a refusal.
+- Create test accounts over basic auth with an explicit header. Nextcloud expires password confirmation 30 minutes after login, so accounts created through the admin session fail when a run starts late.
+
+## How a spec is done
+
+- Every scenario has one verdict, and the spec-level blanket is gone.
+- Every new guard has been seen to fail. Break the rule in product code, watch the right assertion go red, then restore the file. Turn PHP opcache revalidation off in the test container first. On #616, two mutations read green because the container still ran the cached, unbroken code.
+- `composer check:strict` exits 0, and so do `npm run lint` and `npm run format`. The scoped hydra gates exit 0, including gate-19.
+- The PR's CI shows the new tests ran. A spec that did not run looks exactly like one that passed.
+
+## Capacity
+
+One spec of about 50 scenarios took one agent roughly an hour, plus a CI run of 20 to 30 minutes. At that rate the whole programme is about 60 agent-hours. With three agents in parallel it is two to three working days of wall time, bounded by CI queues rather than writing.
+
+A PR per spec keeps each review small, and lets one spec's defect ship without waiting for the others.
+
+## Out of scope
+
+- dossiq and nextcloud-vue. dossiq already runs its own programme (`e2e-citation-integrity`, dossiq #2461 and its follow-ups). nextcloud-vue gets its own change when this one is past tier 1.
+- Rewriting scenarios. Where a scenario is wrong, fix the scenario text in the same PR and say why. Do not delete a scenario to make the count look better.
diff --git a/openspec/changes/e2e-coverage-programme/tasks.md b/openspec/changes/e2e-coverage-programme/tasks.md
new file mode 100644
index 000000000..0ba96cdc6
--- /dev/null
+++ b/openspec/changes/e2e-coverage-programme/tasks.md
@@ -0,0 +1,117 @@
+# Tasks
+
+One PR per spec, or per requirement group for the two largest. Each task is done when the spec meets "How a spec is done" in `proposal.md`.
+
+Counts are scenarios, and scenarios cited by a Playwright test, measured on `development` on 2026-09-11. "Blanket" means the spec hides every scenario behind one spec-level `@e2e exclude`.
+
+## Done
+
+- [x] `dashboard-export-import`: 48 scenarios, each with its own verdict. Three import defects fixed (#616, with #612 before it).
+- [x] `demo-data-showcases`: per-scenario verdicts replaced the stale "no UI surface" exclusion (#606).
+
+## 1. Tier 0, safety
+
+8 specs, 343 scenarios.
+
+- [ ] 1.1 `admin-settings`: 83 scenarios, 2 cited, blanket. Access requirements in progress 2026-09-11. Its settings-behaviour scenarios stay open under this task.
+- [ ] 1.2 `admin-roles`: 55 scenarios, 0 cited, blanket. In progress 2026-09-11.
+- [ ] 1.3 `conditional-visibility`: 49 scenarios, 0 cited, blanket. In progress 2026-09-11.
+- [ ] 1.4 `permissions`: 42 scenarios, 0 cited, blanket. In progress 2026-09-11, with `admin-roles` and the access requirements of `admin-settings`.
+- [ ] 1.5 `dashboard-public-share`: 38 scenarios, 25 cited. In progress 2026-09-11.
+- [ ] 1.6 `dashboard-sharing`: 34 scenarios, 10 cited. In progress 2026-09-11. Supersedes `add-dashboard-sharing-e2e-coverage`.
+- [ ] 1.7 `role-feature-permissions`: 27 scenarios, 0 cited. Queued 2026-09-11, after the permissions PR.
+- [ ] 1.8 `launchpad-enterprise-security-access`: 15 scenarios, 0 cited, blanket. Queued 2026-09-11, after the permissions PR.
+
+## 2. Tier 1, data integrity
+
+11 specs, 341 scenarios.
+
+- [ ] 2.1 `dashboard-bulk-operations`: 50 scenarios, 0 cited, blanket.
+- [ ] 2.2 `resource-uploads`: 46 scenarios, 0 cited, blanket.
+- [ ] 2.3 `dashboard-versioning`: 38 scenarios, 0 cited, blanket.
+- [ ] 2.4 `orphaned-data-cleanup`: 36 scenarios, 0 cited, blanket.
+- [ ] 2.5 `dashboard-cascade-events`: 35 scenarios, 1 cited, blanket.
+- [ ] 2.6 `dashboard-locking`: 29 scenarios, 0 cited, blanket.
+- [ ] 2.7 `dashboard-metadata-fields`: 28 scenarios, 0 cited, blanket.
+- [ ] 2.8 `dashboard-quota-limits`: 24 scenarios, 0 cited, blanket.
+- [ ] 2.9 `legacy-widget-bridge`: 21 scenarios, 0 cited, blanket.
+- [ ] 2.10 `launchpad-compliance-audit-panel`: 18 scenarios, 0 cited, blanket.
+- [ ] 2.11 `dashboard-acknowledgements`: 16 scenarios, 3 cited.
+
+## 3. Tier 2, core surfaces
+
+19 specs, 823 scenarios.
+
+- [ ] 3.1 `dashboards`: 167 scenarios, 0 cited, blanket. The largest spec. Split it by requirement across several PRs.
+- [ ] 3.2 `widgets`: 110 scenarios, 0 cited, blanket. Split it by requirement across several PRs.
+- [ ] 3.3 `admin-templates`: 86 scenarios, 0 cited, blanket.
+- [ ] 3.4 `grid-layout`: 56 scenarios, 16 cited.
+- [ ] 3.5 `setup-wizard`: 55 scenarios, 0 cited, blanket.
+- [ ] 3.6 `footer-customization`: 47 scenarios, 0 cited, blanket.
+- [ ] 3.7 `navigation-editor-org`: 45 scenarios, 0 cited, blanket.
+- [ ] 3.8 `tiles`: 38 scenarios, 0 cited.
+- [ ] 3.9 `dashboard-language-content`: 35 scenarios, 0 cited, blanket.
+- [ ] 3.10 `dashboard-reactions`: 31 scenarios, 0 cited, blanket.
+- [ ] 3.11 `tile-quick-search`: 28 scenarios, 8 cited.
+- [ ] 3.12 `dashboard-icons`: 25 scenarios, 0 cited, blanket.
+- [ ] 3.13 `conditional-visibility-editor`: 23 scenarios, 13 cited.
+- [ ] 3.14 `dashboard-kiosk-mode`: 23 scenarios, 0 cited.
+- [ ] 3.15 `dashboard-switcher`: 20 scenarios, 11 cited.
+- [ ] 3.16 `runtime-shell`: 16 scenarios, 5 cited.
+- [ ] 3.17 `dashboard-deeplinking`: 7 scenarios, 0 cited.
+- [ ] 3.18 `default-widget-bundle`: 6 scenarios, 0 cited.
+- [ ] 3.19 `effective-default-marker`: 5 scenarios, 0 cited.
+
+## 4. Tier 3, widgets
+
+24 specs, 817 scenarios.
+
+- [ ] 4.1 `text-display-widget`: 90 scenarios, 9 cited.
+- [ ] 4.2 `news-widget`: 58 scenarios, 0 cited, blanket.
+- [ ] 4.3 `files-widget`: 57 scenarios, 0 cited, blanket.
+- [ ] 4.4 `header-widget`: 56 scenarios, 0 cited.
+- [ ] 4.5 `calendar-widget`: 52 scenarios, 0 cited, blanket.
+- [ ] 4.6 `links-widget`: 52 scenarios, 0 cited.
+- [ ] 4.7 `video-widget`: 51 scenarios, 0 cited.
+- [ ] 4.8 `link-button-widget`: 50 scenarios, 0 cited.
+- [ ] 4.9 `people-widget`: 49 scenarios, 0 cited, blanket.
+- [ ] 4.10 `image-widget`: 45 scenarios, 8 cited.
+- [ ] 4.11 `menu-widget`: 37 scenarios, 0 cited.
+- [ ] 4.12 `quicklinks-widget`: 36 scenarios, 0 cited.
+- [ ] 4.13 `divider-widget`: 29 scenarios, 3 cited.
+- [ ] 4.14 `clock-weather-widgets`: 21 scenarios, 0 cited.
+- [ ] 4.15 `launchpad-spend-analytics-widget`: 21 scenarios, 0 cited, blanket.
+- [ ] 4.16 `launchpad-ai-dashboard-assistant`: 18 scenarios, 0 cited, blanket.
+- [ ] 4.17 `iframe-embed-widget`: 15 scenarios, 0 cited.
+- [ ] 4.18 `launchpad-mobile-remote-access`: 15 scenarios, 0 cited, blanket.
+- [ ] 4.19 `live-data-tile-widget`: 15 scenarios, 0 cited.
+- [ ] 4.20 `launchpad-meeting-calendar-actions`: 14 scenarios, 0 cited, blanket.
+- [ ] 4.21 `label-widget`: 12 scenarios, 11 cited.
+- [ ] 4.22 `launchpad-file-access-widget`: 12 scenarios, 0 cited, blanket.
+- [ ] 4.23 `container-widget`: 8 scenarios, 0 cited, blanket.
+- [ ] 4.24 `nc-dashboard-widget-proxy`: 4 scenarios, 0 cited, blanket.
+
+## 5. Tier 4, admin, operations and integrations
+
+14 specs, 419 scenarios.
+
+- [ ] 5.1 `dashboard-view-analytics`: 65 scenarios, 0 cited, blanket.
+- [ ] 5.2 `background-job-feed-refresh`: 56 scenarios, 0 cited, blanket.
+- [ ] 5.3 `cli-commands`: 53 scenarios, 0 cited, blanket.
+- [ ] 5.4 `activity-feed-integration`: 52 scenarios, 0 cited, blanket.
+- [ ] 5.5 `nc-unified-search-integration`: 48 scenarios, 0 cited, blanket.
+- [ ] 5.6 `confluence-html-import`: 41 scenarios, 0 cited, blanket.
+- [ ] 5.7 `prometheus-metrics`: 23 scenarios, 0 cited, blanket.
+- [ ] 5.8 `launchpad-adopt-or-abstractions`: 20 scenarios, 1 cited.
+- [ ] 5.9 `infrastructure-helpers`: 17 scenarios, 0 cited, blanket.
+- [ ] 5.10 `service-health-ping`: 15 scenarios, 0 cited.
+- [ ] 5.11 `initial-state-contract`: 11 scenarios, 0 cited, blanket.
+- [ ] 5.12 `runtime-or-consumption`: 11 scenarios, 0 cited, blanket.
+- [ ] 5.13 `license-header-consistency`: 7 scenarios, 0 cited, blanket.
+- [ ] 5.14 `groupfolder-storage-backend`: 0 scenarios, 0 cited. Has no scenarios. Decide whether the spec is still wanted.
+
+## 6. Close the programme
+
+- [ ] 6.1 Re-measure every spec with the same count, and publish the before and after totals in this change.
+- [ ] 6.2 Confirm no spec-level `@e2e exclude` remains in `openspec/specs/`.
+- [ ] 6.3 Archive `add-dashboard-sharing-e2e-coverage` once tier 0 covers it, repointing any citation into it first.
diff --git a/openspec/changes/store-plane-dashboard-sharing/design.md b/openspec/changes/store-plane-dashboard-sharing/design.md
new file mode 100644
index 000000000..c18d54538
--- /dev/null
+++ b/openspec/changes/store-plane-dashboard-sharing/design.md
@@ -0,0 +1,195 @@
+# Design: cross-instance dashboard sharing over the AppHost store plane
+
+## Phase 1 findings
+
+This is the investigation that produced the proposal. It is written down because
+three of its findings are defects that exist on `development` today, and one of
+them contradicts the brief this work started from.
+
+### Finding 1: LaunchPad already renders a Store page that cannot answer
+
+`src/manifest.json` declares a page `{"id": "Store", "type": "store"}`. That type
+dispatches to `CnStorePage` in `@conduction/nextcloud-vue`, which fetches
+`/apps/launchpad/api/store/items` on mount.
+
+`appinfo/routes.php` declares no such route. LaunchPad hand-writes its route
+table rather than adopting `OCA\OpenRegister\AppHost\Routes::standard()`, so the
+two store routes never register. The page is in the navigation and its only
+request 404s.
+
+This is a variant of a failure OpenRegister already recorded on 2026-09-03, where
+decidiq, filinq and planninq each returned HTTP 500 on `/api/store/items`. Those
+apps took the route table and skipped the controller binding. LaunchPad took
+neither, so it 404s instead of 500ing. Same cause: the store surface is wired in
+one place and not the other.
+
+### Finding 2: the declared store block describes somebody else's store
+
+The `store` block on `development` is:
+
+```json
+{ "types": ["openregister.configset", "openregister.flows"], "localRegister": "launchpad" }
+```
+
+`types` being non-empty selects FEDERATED discovery in
+`StoreDescriptor::isFederated()`, which routes both search and install to
+`FederatedStoreCatalog`. That catalogue trades OpenRegister configuration sets:
+registers, schemas, views, flows, sources and mappings.
+
+A LaunchPad dashboard is none of those. The block, its `_note` included, is
+decidiq's block with the app name changed. Had the routes existed, the Store page
+would have offered configuration sets to somebody looking for a dashboard.
+
+### Finding 3: the engine cannot install a LaunchPad dashboard, and that is fine
+
+The store plane offers two install paths and neither reaches a dashboard.
+
+`GenericStoreInstaller` supports two ops, `writeObject` and `setAppConfig`. The
+first writes rows into OpenRegister schemas named by the `installable` allowlist.
+`FederatedStoreCatalog` applies configuration bundles through their owning type.
+
+LaunchPad dashboards live in LaunchPad's own tables. `ImportService` takes a
+`DashboardMapper`, a `WidgetPlacementMapper` and an `IDBConnection`. No
+OpenRegister schema holds a dashboard, so no `writeObject` component can create
+one.
+
+The engine anticipates this. `Bootstrap::aliasControllerUnlessLeafDefinesIt()`
+is a no-op when the leaf ships its own `Controller\StoreController`, and the
+comment beside the store alias names dossiq as an app that keeps winning the
+alias until its own class is deleted. A leaf-owned store controller is a
+supported state, not a workaround.
+
+### Finding 4: the brief and the spec disagree, and the spec moved most recently
+
+The brief describes ADR-080 Decision 3: discovery is engine-owned, install stays
+per app, the leaf builds a `StoreDescriptor` and three routes.
+
+`openspec/specs/apphost-store-plane/spec.md` carries a later requirement, "A leaf
+app MUST declare its store rather than implement one", which amends Decision 3.
+Under it a leaf declares a `store` block and aliases the engine controller.
+
+We follow the brief's split for LaunchPad, and the reason is the amendment's own
+reason. The amendment says install semantics were made data because "the only
+thing that actually varied was which schemas an install may write". For LaunchPad
+that is not what varies. The install is a ZIP import against LaunchPad's own
+tables, expressible as neither `writeObject` nor `setAppConfig`. The amendment
+holds for apps whose install is a schema write. This is not one.
+
+### What the plane gives LaunchPad for free
+
+Everything on the discovery half, and it is the half with the security surface:
+
+- SSRF guarding through `SecurityService::assertSafeFetchUrl()`, fail-closed, on
+  every built URL before any request is issued.
+- `allow_redirects => false`, so a public host cannot bounce the Bearer token to
+  a private, link-local or metadata address.
+- Bearer-only token transport. The token never enters the URL or query string and
+  never returns to a caller.
+- Outcome mapping that separates `store_unreachable` from
+  `store_invalid_response`, so a misconfigured registry does not read as offline.
+- Card normalisation against `cardFields`, which drops every remote property
+  outside the map. A registry cannot smuggle a field onto a card.
+- Slug verification in `resolve()`, so a registry that ignores an unknown query
+  parameter cannot return an arbitrary first row.
+- 10 second connect and request timeouts, and a 50 item search cap.
+
+All of that was read from `lib/AppHost/Service/GenericStoreService.php`, not
+assumed from the spec.
+
+### What LaunchPad must build
+
+- The two routes, and the controller behind them.
+- Install: resolve the item, then hand its payload to `ImportService`.
+- The registry configuration surface, because of the finding below.
+- A correct `store` block, replacing the configuration-set one.
+
+### Finding 5: the registry config has no admin surface in LaunchPad
+
+`GenericStoreService` reads `registry_url`, `registry_token` and
+`registry_register` from `IAppConfig` under the calling app's id. LaunchPad's
+admin settings do not go there: `AdminSettingsService` writes through
+`AdminSettingMapper` into a LaunchPad table.
+
+So the keys the engine reads are reachable only by `occ config:app:set`. We add a
+small admin-gated config endpoint that reads and writes those three keys in
+`IAppConfig`, and a form for it on Beheer ▸ Sharing. The token is write-only
+across both: the read returns whether a token is set, never the token, and the
+form's token field always starts empty.
+
+## The install mechanism
+
+`ImportService::import()` takes a path to a ZIP. The registry hands back a JSON
+object. Bridging them has three candidate shapes and only one is honest.
+
+Writing a payload-shaped importer beside the ZIP-shaped one gives LaunchPad two
+import paths that must agree forever. Fetching a ZIP URL named by the remote
+payload adds a second outbound fetch that the plane does not guard, which throws
+away the SSRF property that is the main reason to adopt the plane at all.
+
+So we materialise. The resolved payload's dashboards are written into a
+`launchpad-export-v1` ZIP in a temporary directory, and that path goes to
+`ImportService::import()`. The importer is unchanged and remains the only code
+that turns a dashboard payload into rows. `ExportService` already writes exactly
+this container, so the two stay symmetrical by construction.
+
+`preserveUuids` is false for a store install. A template arriving from a foreign
+instance carrying a UUID that collides with a local dashboard must become a new
+dashboard, never replace one. This is the same class of defect the plane records
+under "An install MUST create a new object, never replace one", reached by a
+different route: `saveObject()` resolves its target from the payload, and
+`ImportService` with `preserveUuids: true` fails closed on collision rather than
+overwriting, so passing false is what makes an install additive.
+
+## Publishing is not solved here, and cannot be
+
+The plane is a read-only client. Nothing in it writes to a registry, and no
+requirement in its spec describes a publish. So the answer to "how does a
+dashboard get into a registry" is: not through this change.
+
+What publishing would actually take, honestly:
+
+1. A schema on the registry instance holding a dashboard template, with the
+   `cardFields` properties and an inline dashboard payload.
+2. An authenticated write from the publishing instance to that schema, which is a
+   new outbound write path with its own SSRF guarding, its own token scope, and a
+   token that is no longer read-only. The current `registry_token` grants read.
+3. A moderation posture. A registry that accepts writes from every instance that
+   holds a token is a spam target, and the plane's trust boundary for a bundle is
+   its publisher.
+4. Versioning and withdrawal. A published template that turns out to be wrong
+   needs a way to be superseded and a way to be pulled.
+
+Steps 2 and 3 are the expensive ones and neither is a LaunchPad decision alone.
+Until they land, a registry is populated out of band: an administrator exports a
+dashboard and loads it into the registry instance directly. That is a real
+workflow and it is worth saying it is the workflow, rather than implying the
+store closes the loop.
+
+## How this relates to the sharing LaunchPad already has
+
+LaunchPad's existing sharing is all in-instance and stays untouched.
+`DashboardShareService` shares to users and groups, `PublicShareService` publishes
+a read-only link, and templates seed new dashboards. Each of those moves a
+dashboard between people who already share a Nextcloud.
+
+Export and import already move a dashboard between instances, by hand, through a
+file an administrator carries. The store does not add a capability so much as
+remove the carrying: the same ZIP contract, fetched over a guarded HTTP client
+instead of downloaded and re-uploaded.
+
+Nothing here changes who may see a dashboard once it exists. An installed
+dashboard is owned by the installing administrator and obeys the same permission
+model as one made by hand.
+
+## Cost
+
+Roughly 900 lines including tests, in five files plus the manifest and the route
+table. The discovery half is a delegation, the install half is the ZIP
+materialiser, and the rest is configuration.
+
+The standing cost is the coupling to two contracts we do not own: the engine's
+`GenericStoreService` signatures, and the shape of a remote dashboard-template
+object. The first is a normal in-fleet dependency and is resolved optionally, so
+an absent OpenRegister degrades to `not_configured` rather than fatal. The second
+is the real exposure, and it is bounded by the fact that a malformed payload
+fails in `ImportService`'s existing validation rather than in new code.
diff --git a/openspec/changes/store-plane-dashboard-sharing/proposal.md b/openspec/changes/store-plane-dashboard-sharing/proposal.md
new file mode 100644
index 000000000..21b015881
--- /dev/null
+++ b/openspec/changes/store-plane-dashboard-sharing/proposal.md
@@ -0,0 +1,74 @@
+# Store plane dashboard sharing
+
+LaunchPad shares dashboards well inside one instance and not at all between two.
+`DashboardShareService` reaches users and groups, `PublicShareService` publishes a
+read-only link, and templates seed new dashboards. Every one of them stops at the
+instance boundary. Moving a dashboard to another Nextcloud means an administrator
+exports a ZIP, carries the file, and imports it on the other side.
+
+This change adopts OpenRegister's AppHost store plane so that carrying step
+disappears. An administrator points LaunchPad at a registry, browses the dashboard
+templates it publishes, and installs one. The fetched payload goes to LaunchPad's
+existing `ImportService`, so an installed dashboard and an imported ZIP produce
+the same rows through the same code.
+
+It also fixes a surface that is broken on `development`. LaunchPad declares a
+`type: "store"` page, which renders `CnStorePage`, which calls
+`/apps/launchpad/api/store/items`. That route does not exist. The page is in the
+navigation and its only request 404s. The `store` block beside it declares
+OpenRegister configuration sets rather than dashboards, so even with routes it
+would have offered the wrong thing.
+
+## Affected code units
+
+- **NEW** `lib/Service/StoreService.php`: descriptor construction, discovery delegation, payload to ZIP materialisation, install
+- **NEW** `lib/Controller/StoreController.php`: the three store endpoints and the registry config endpoints
+- **NEW** `tests/Unit/Service/StoreServiceTest.php`
+- **NEW** `tests/Unit/Controller/StoreControllerTest.php`
+- **MODIFY** `appinfo/routes.php`: register the store routes the page already calls
+- **MODIFY** `lib/AppInfo/Application.php`: bind `StoreService` with an optional `GenericStoreService`
+- **NEW** `src/components/admin/DashboardRegistrySettings.vue`: the registry form on Beheer ▸ Sharing
+- **NEW** `src/components/admin/__tests__/DashboardRegistrySettings.spec.js`
+- **NEW** `tests/e2e/dashboard-store.spec.ts`
+- **MODIFY** `src/components/admin/tabs/SharingTab.vue`: host the registry form
+- **MODIFY** `src/services/api.js`: `getStoreConfig()` and `updateStoreConfig()`
+- **MODIFY** `src/manifest.json`: remove the configuration-set store block, which configured an engine controller LaunchPad does not use
+
+## Capabilities
+
+### New Capabilities
+
+- `dashboard-store`: browse a remote registry of dashboard templates and install one into this instance, over the engine's guarded discovery client.
+
+### Modified Capabilities
+
+- `dashboard-export-import`: the ZIP container gains a second producer. A store install builds one in memory and imports it, so the container contract now has to hold for payloads that never touched a disk an administrator chose.
+
+## Why the leaf owns install
+
+The store plane's spec carries a requirement that a leaf app declares its store
+and ships no controller, aliasing the engine's `GenericStoreController` instead.
+That requirement amends ADR-080 Decision 3 on the grounds that "the only thing
+that actually varied was which schemas an install may write".
+
+For LaunchPad that is not what varies. The engine offers two install ops,
+`writeObject` and `setAppConfig`, plus configuration bundles through
+`FederatedStoreCatalog`. A dashboard is none of them: it lives in LaunchPad's own
+tables behind `DashboardMapper`, and no OpenRegister schema holds one. So there is
+no allowlist entry that makes the engine's installer able to do this.
+
+The engine treats a leaf-owned controller as a supported state.
+`Bootstrap::aliasControllerUnlessLeafDefinesIt()` is a no-op when the leaf ships
+its own `Controller\StoreController`, and the comment beside the store alias names
+dossiq as an app in exactly this position. Discovery stays engine-owned, which is
+where the SSRF guarding, the redirect refusal and the token handling live.
+
+## What this change does not do
+
+It does not publish. The plane is a read-only client and nothing in it writes to a
+registry. A registry is populated out of band until a publish path exists, which
+needs an authenticated outbound write, a wider token scope, and a moderation
+posture. `design.md` says what that would take.
+
+It does not touch in-instance sharing. Nothing about who may see an existing
+dashboard changes.
diff --git a/openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md b/openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md
new file mode 100644
index 000000000..e8da25dc2
--- /dev/null
+++ b/openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md
@@ -0,0 +1,299 @@
+---
+capability: dashboard-store
+status: draft
+---
+
+# Dashboard store: new capability from change `store-plane-dashboard-sharing`
+
+## Context
+
+A registry is another OpenRegister instance publishing dashboard templates as
+objects of a `dashboard-template` schema. LaunchPad reaches it through
+OpenRegister's AppHost store plane, which owns discovery: the SSRF guard, the
+redirect refusal, the Bearer-only token transport, the outcome vocabulary and card
+normalisation. LaunchPad owns install, because a dashboard lives in LaunchPad's
+own tables and no engine install op can write one.
+
+Browser coverage lives in `tests/e2e/dashboard-store.spec.ts`: the store page's
+not-configured state, the admin form round-trip, the token redaction, and the
+admin gate probed with a non-admin account. Scenarios with no browser-visible
+effect (degraded discovery with OpenRegister absent, outcome pass-through,
+ZIP materialisation, additive install, temp-file cleanup) are PHPUnit-covered
+and carry their own reason below.
+
+A SUCCESSFUL remote install has no e2e test, deliberately. It needs a second
+OpenRegister instance publishing a `dashboard-template` object, and CI
+provisions one instance. Faking the registry inside the suite would test the
+fake. `StoreServiceTest` covers the install path against the engine's real
+signatures.
+
+## NEW Requirements
+
+### Requirement: REQ-STORE-001 The store routes MUST exist wherever the store page is declared
+
+LaunchPad's manifest declares a `type: "store"` page, which renders `CnStorePage`,
+which calls `GET /apps/launchpad/api/store/items` on mount and
+`POST /apps/launchpad/api/store/items/{slug}/install` on an install click.
+`appinfo/routes.php` SHALL declare both, and the `{slug}` route SHALL constrain
+the slug to `[a-z0-9][a-z0-9-]*[a-z0-9]` so a malformed slug fails at the router
+rather than reaching the registry URL.
+
+#### Scenario: The declared page can reach its endpoint
+
+- **GIVEN** `src/manifest.json` declares a page of type `store`
+- **WHEN** the route table is read
+- **THEN** it MUST contain `store#search` at `/api/store/items`
+- **AND** it MUST contain `store#install` at `/api/store/items/{slug}/install`
+
+@e2e exclude route-table shape: asserted by reading appinfo/routes.php in tests/Unit/Support/StoreWiringTest.php; the browser consequence is the next scenario
+
+#### Scenario: An unconfigured store shows the not-configured state
+
+- **GIVEN** no `registry_url` is configured
+- **WHEN** an administrator opens the Store page
+- **THEN** `GET /api/store/items` MUST answer 200 with outcome `not_configured`
+- **AND** the page MUST show its not-configured note
+- **AND** it MUST NOT show the unreachable note or an empty result grid
+
+---
+
+### Requirement: REQ-STORE-002 An absent OpenRegister MUST degrade, never fatal
+
+`GenericStoreService` is resolved optionally, exactly as LaunchPad already
+resolves the AppHost observability collaborators. When OpenRegister is disabled or
+absent the collaborator is null. `search()` MUST then return outcome
+`not_configured` with an empty card list, and `install()` MUST refuse, and neither
+MUST touch an `OCA\OpenRegister\…` symbol.
+
+An engine that is present but unconfigured behaves the same way, because
+`GenericStoreService::isConfigured()` reports false for an empty `registry_url`
+and makes no network call.
+
+#### Scenario: No OpenRegister yields not_configured
+
+- **GIVEN** the store service holds a null discovery client
+- **WHEN** `search()` is called
+- **THEN** the outcome MUST be `not_configured` and the card list MUST be empty
+
+@e2e exclude requires an instance WITHOUT OpenRegister, and CI installs it; asserted in tests/Unit/Service/StoreServiceTest.php
+
+#### Scenario: No OpenRegister refuses an install rather than half-running one
+
+- **GIVEN** the store service holds a null discovery client
+- **WHEN** `install()` is called for any slug
+- **THEN** it MUST report failure and MUST NOT call `ImportService`
+
+@e2e exclude requires an instance WITHOUT OpenRegister, and CI installs it; asserted in tests/Unit/Service/StoreServiceTest.php
+
+---
+
+### Requirement: REQ-STORE-003 The engine's outcome MUST reach the caller unchanged
+
+The plane distinguishes `store_unreachable` from `store_invalid_response` so a
+misconfigured registry does not read as an offline one. LaunchPad SHALL pass the
+outcome through verbatim and MUST NOT collapse the two, and MUST NOT substitute
+its own. Upstream error detail MUST NOT reach the caller; the engine already keeps
+it server-side.
+
+#### Scenario: An invalid response is not reported as unreachable
+
+- **GIVEN** the engine returns outcome `store_invalid_response`
+- **WHEN** the service returns
+- **THEN** the outcome MUST be `store_invalid_response`
+
+@e2e exclude needs a registry that answers malformed JSON, and CI has no registry; asserted in tests/Unit/Service/StoreServiceTest.php
+
+---
+
+### Requirement: REQ-STORE-004 Installing MUST require an administrator
+
+An install writes dashboards into the instance from a third-party server. The
+install endpoint SHALL carry `#[AuthorizedAdminSetting(LaunchPadAdmin::class)]`,
+the posture LaunchPad already uses for its other administrative endpoints.
+
+Search SHALL carry `#[NoAdminRequired]`, because browsing a registry addresses no
+object of this instance. It forwards a query to an external registry and returns
+normalised cards, so there is no local identifier to guess and no IDOR to create.
+
+#### Scenario: Every store route declares a posture
+
+- **GIVEN** the store controller
+- **WHEN** its public methods are read
+- **THEN** `search` MUST carry `#[NoAdminRequired]`
+- **AND** `install` MUST carry `#[AuthorizedAdminSetting]`
+
+@e2e exclude attribute presence: asserted by reflection in tests/Unit/Controller/StoreControllerTest.php; the two scenarios below prove the attributes hold at runtime
+
+#### Scenario: A non-admin is refused the registry config
+
+- **GIVEN** a signed-in account that is not an administrator, holding a valid request token
+- **WHEN** it reads or writes `/api/store/config`
+- **THEN** both requests MUST answer 403
+- **AND** the stored registry MUST be unchanged afterwards
+
+#### Scenario: A non-admin is refused an install
+
+- **GIVEN** the same account
+- **WHEN** it posts to `/api/store/items/{slug}/install`
+- **THEN** the request MUST answer 403
+
+---
+
+### Requirement: REQ-STORE-005 An install MUST reuse ImportService, not reimplement it
+
+The resolved payload SHALL be materialised into a `launchpad-export-v1` ZIP in a
+temporary directory and handed to `ImportService::import()`. LaunchPad MUST NOT
+gain a second code path that turns a dashboard payload into rows.
+
+The materialised archive MUST carry a `manifest.json` with `schemaVersion` equal
+to the importer's supported version and a `scope`, and one
+`dashboards/{uuid}.json` entry per dashboard, because that is what
+`validateZipStructure()` requires and what `ExportService` writes.
+
+The temporary archive MUST be removed whether the import succeeds or throws.
+
+#### Scenario: The payload reaches the existing importer
+
+- **GIVEN** a resolved item carrying one dashboard payload
+- **WHEN** it is installed
+- **THEN** `ImportService::import()` MUST be called exactly once
+- **AND** the path it receives MUST be an existing ZIP containing `manifest.json`
+
+@e2e exclude needs a second OpenRegister publishing a template, and CI has one instance; asserted in tests/Unit/Service/StoreServiceTest.php
+
+#### Scenario: An install with no registry is refused with a reason
+
+- **GIVEN** no `registry_url` is configured
+- **WHEN** an administrator posts an install for any slug
+- **THEN** the request MUST answer 400 with `success` false and a message
+- **AND** it MUST NOT answer 500
+
+#### Scenario: A payload with no dashboards is refused before any import
+
+- **GIVEN** a resolved item whose dashboards list is empty or absent
+- **WHEN** it is installed
+- **THEN** the install MUST fail and `ImportService::import()` MUST NOT be called
+
+@e2e exclude needs a registry serving a malformed item, and CI has no registry; asserted in tests/Unit/Service/StoreServiceTest.php
+
+#### Scenario: The temporary archive does not survive a failing import
+
+- **GIVEN** `ImportService::import()` throws
+- **WHEN** the install returns
+- **THEN** no temporary archive from that install MUST remain on disk
+
+@e2e exclude a temp-directory effect with no browser surface; asserted in tests/Unit/Service/StoreServiceTest.php
+
+---
+
+### Requirement: REQ-STORE-006 A store install MUST create dashboards, never replace them
+
+The install SHALL call `ImportService::import()` with `preserveUuids` false. A
+template published by a foreign instance carries that instance's UUIDs, and one of
+them can collide with a live local dashboard. Re-mapping makes the install
+additive.
+
+This mirrors the plane's own rule that an install creates rather than replaces,
+reached by a different route: the identity that would do the damage is the
+dashboard UUID rather than an object `uuid`.
+
+#### Scenario: A colliding UUID still creates
+
+- **GIVEN** a resolved item whose dashboard UUID matches a local dashboard
+- **WHEN** it is installed
+- **THEN** `import()` MUST be called with `preserveUuids` false
+
+@e2e exclude needs a second OpenRegister publishing a template, and CI has one instance; asserted in tests/Unit/Service/StoreServiceTest.php
+
+---
+
+### Requirement: REQ-STORE-007 The registry token MUST NOT be readable back
+
+`registry_url`, `registry_token` and `registry_register` live in `IAppConfig`
+under `launchpad`, because that is where `GenericStoreService` reads them.
+LaunchPad's own admin settings write to a different store, so the change adds an
+admin-gated endpoint for these three keys.
+
+The read endpoint SHALL return the URL and the register, and for the token SHALL
+return only whether one is set. The token value MUST NOT appear in any response.
+
+#### Scenario: Reading the config never returns the token
+
+- **GIVEN** `registry_token` holds a value
+- **WHEN** the config is read
+- **THEN** the response MUST report that a token is set
+- **AND** the response MUST NOT contain the token value
+
+#### Scenario: An empty token submission clears rather than blanks around
+
+- **GIVEN** a stored token
+- **WHEN** the config is written with an empty token
+- **THEN** the stored token MUST be cleared
+
+@e2e exclude the clear-versus-keep distinction is a request-payload property the browser cannot see; asserted in tests/Unit/Service/StoreServiceTest.php and src/components/admin/__tests__/DashboardRegistrySettings.spec.js
+
+---
+
+### Requirement: REQ-STORE-008 The manifest MUST NOT declare a store block
+
+`src/manifest.json` MUST NOT carry a `store` key. That block exists to configure
+OpenRegister's `GenericStoreController`, which LaunchPad does not use, so a block
+here would declare a schema and card fields that nothing reads while
+`StoreService` declares the ones that are used.
+
+A non-empty `types` list is the specific harm, because it selects the engine's
+federated configuration path. The block on `development` declared
+`openregister.configset` and `openregister.flows`, which trade registers, schemas
+and flows. Had the routes existed, the store page would have offered
+configuration sets to somebody looking for a dashboard.
+
+#### Scenario: No store block is declared
+
+- **GIVEN** `src/manifest.json`
+- **WHEN** it is decoded
+- **THEN** it MUST NOT contain a `store` key
+
+@e2e exclude a source-file property; asserted in tests/Unit/Support/StoreWiringTest.php
+
+#### Scenario: The store page still declares itself
+
+- **GIVEN** the same manifest
+- **WHEN** its pages are read
+- **THEN** exactly one page MUST carry `type` of `store`
+
+
+@e2e exclude a source-file property; asserted in tests/Unit/Support/StoreWiringTest.php
+
+---
+
+### Requirement: REQ-STORE-009 An administrator MUST be able to connect a registry without a shell
+
+The three registry keys live in `IAppConfig`, which LaunchPad's own admin
+settings do not write. So Beheer ▸ Sharing SHALL carry a form for
+`registry_url`, `registry_register` and the token, backed by
+`/api/store/config`.
+
+The token field SHALL be write-only. It MUST start empty on every load, and
+the page MUST say whether a token is set without showing it. Saving with an
+empty token field MUST leave the stored token alone; removing it is a
+separate action.
+
+#### Scenario: An administrator saves a registry and reads it back
+
+- **GIVEN** an administrator on Beheer ▸ Sharing
+- **WHEN** they enter a registry URL, a register and a token, and save
+- **THEN** after a reload the URL and register fields MUST show what they entered
+- **AND** the page MUST say a token is set
+
+#### Scenario: The token is never shown back
+
+- **GIVEN** a stored token
+- **WHEN** the form loads
+- **THEN** the token field MUST be empty
+- **AND** neither the page nor the config response MUST contain the token
+
+#### Scenario: The saved registry is the one the store reads
+
+- **GIVEN** an administrator saved a registry URL whose host does not resolve
+- **WHEN** they open the Store page
+- **THEN** the page MUST show the unreachable note rather than the not-configured one
diff --git a/openspec/changes/store-plane-dashboard-sharing/tasks.md b/openspec/changes/store-plane-dashboard-sharing/tasks.md
new file mode 100644
index 000000000..f623125c5
--- /dev/null
+++ b/openspec/changes/store-plane-dashboard-sharing/tasks.md
@@ -0,0 +1,35 @@
+# Tasks: store-plane-dashboard-sharing
+
+## Backend
+
+- [x] Task 1: Add `lib/Service/StoreService.php`: descriptor construction, discovery delegation against an optional `GenericStoreService`, payload to ZIP materialisation, install through `ImportService`, registry config read and write (REQ-STORE-002, 003, 005, 006, 007)
+- [x] Task 2: Add `lib/Controller/StoreController.php`: `search`, `install`, `getConfig`, `updateConfig` with explicit auth attributes (REQ-STORE-004)
+- [x] Task 3: Register the store routes in `appinfo/routes.php`, with the slug requirement (REQ-STORE-001)
+- [x] Task 4: Bind `StoreService` in `lib/AppInfo/Application.php`, resolving `GenericStoreService` optionally (REQ-STORE-002)
+
+## Manifest
+
+- [x] Task 5: Remove the configuration-set `store` block, which configured an engine controller LaunchPad does not use (REQ-STORE-008)
+
+## Tests
+
+- [x] Task 6: `tests/Unit/Service/StoreServiceTest.php`: degraded discovery, outcome pass-through, ZIP shape, additive install, temp cleanup, token redaction
+- [x] Task 7: `tests/Unit/Controller/StoreControllerTest.php`: auth attributes, outcome pass-through, install reporting
+
+## Admin form
+
+- [x] Task 8: `src/components/admin/DashboardRegistrySettings.vue` on Beheer ▸ Sharing, with a write-only token field (REQ-STORE-009)
+- [x] Task 9: `src/components/admin/__tests__/DashboardRegistrySettings.spec.js`: the token is never pre-filled, an empty field on save leaves the stored token alone, removing it is explicit
+
+## End to end
+
+- [x] Task 10: `tests/e2e/dashboard-store.spec.ts`: the not-configured state paired with the route's answer, the form round-trip, token redaction, the form's registry reaching the engine, and the admin gate probed with a fresh non-admin account
+
+## Before archiving
+
+- The `@e2e` anchors in `tests/e2e/dashboard-store.spec.ts` name this change directory. When the spec is synced to `openspec/specs/dashboard-store/spec.md`, repoint them there, or archiving this change leaves them resolving to nothing.
+
+## Not in this change
+
+- Publishing a dashboard to a registry. See `design.md`; it needs an outbound write path, a wider token scope and a moderation posture.
+- An e2e test of a SUCCESSFUL remote install. It needs a second OpenRegister publishing a template, and CI provisions one instance.
diff --git a/openspec/specs/admin-settings/spec.md b/openspec/specs/admin-settings/spec.md
index bcd795201..ea1406cf2 100644
--- a/openspec/specs/admin-settings/spec.md
+++ b/openspec/specs/admin-settings/spec.md
@@ -10,7 +10,7 @@ Admin settings provide Nextcloud administrators with global configuration option
 
 ## Data Model
 
-@e2e exclude all scenarios test REST/service/config API — admin UI reads settings from API; no dedicated Playwright-testable UI flow shipped in v1.0.5
+@e2e exclude Most scenarios here are REST, service or config contracts, covered by PHPUnit and Newman rather than a browser. The browser-observable parts are still exercised: the two REQ-ASET-002 round-trip scenarios are cited by tests/e2e/admin-settings-key-roundtrip.spec.ts, and the personal-dashboard flag's sidebar effect is covered by tests/e2e/allow-personal-dashboards-flag.spec.ts.
 
 ### Admin Settings (oc_launchpad_admin_settings)
 Settings are stored as key-value pairs:
@@ -27,24 +27,40 @@ Settings are stored as key-value pairs:
 | `allow_multiple_dashboards` | `allowMultipleDashboards` | boolean | `true` | Whether users can have more than one dashboard |
 | `default_permission_level` | `defaultPermissionLevel` | string | `add_only` | Default permission level for user-created dashboards |
 | `default_grid_columns` | `defaultGridColumns` | integer | `12` | Default number of grid columns for new dashboards |
+| `link_create_file_extensions` | `linkCreateFileExtensions` | `string[]` | `["txt","md","docx","xlsx","csv","odt"]` | Extensions the link-button widget's "create file" action may create (REQ-LBN-004). An empty stored list resolves to the default. |
+| `content_storage` | `launchpad.content_storage` | string | `database` | Active content storage backend (REQ-GFSB-006). The response key is dotted, unlike the others. |
+| `default_share_permission_level` | `defaultSharePermissionLevel` | string | `add_only` | Org-wide default permission for a new share (dashboard-sharing spec) |
+| `forced_share_groups` | `forcedShareGroups` | `string[]` | `[]` | Groups every new dashboard is force-shared with (dashboard-sharing spec) |
+| `legacy_widget_bridge_enabled` | `legacyWidgetBridgeEnabled` | boolean | `false` | Whether the workspace reads Nextcloud's widget registry (legacy-widget-bridge spec) |
+| `max_dashboards_per_user` | `maxDashboardsPerUser` | integer | `0` | Personal dashboard quota per user, `0` = unlimited (REQ-QUOTA-001) |
+| `max_widgets_per_dashboard` | `maxWidgetsPerDashboard` | integer | `0` | Placement quota per dashboard, `0` = unlimited (REQ-QUOTA-001) |
+| `quicksearch_fallback_target` | `quicksearchFallbackTarget` | string | `none` | Quick-search no-match fallback: `none`, `unified-search` or an https URL template (REQ-QSEARCH-004). A stored value that no longer validates reads as `none`. |
 | `group_order` | n/a (separate `/api/admin/groups` endpoints) | `string[]` (JSON) | `[]` | Ordered list of Nextcloud group IDs that are "active" for LaunchPad workspace routing (REQ-ASET-012). Read via `AdminSettingsService::getGroupOrder()`; written via `setGroupOrder()`. Corrupt JSON resolves to `[]`. |
 
-NOTE: The DB stores settings with snake_case keys, but the API response returns camelCase keys. The factory default for `defaultPermissionLevel` is `add_only` (Dashboard::PERMISSION_ADD_ONLY), NOT `full`. The API update endpoint accepts abbreviated camelCase parameter names: `defaultPermLevel`, `allowUserDash`, `allowMultiDash`, `defaultGridCols`.
+NOTE: The DB stores settings with snake_case keys, but the API response returns camelCase keys. The factory default for `defaultPermissionLevel` is `add_only` (Dashboard::PERMISSION_ADD_ONLY), NOT `full`. The API update endpoint accepts each setting under the key the GET response uses (`defaultPermissionLevel`, `allowUserDashboards`, `allowMultipleDashboards`, `defaultGridColumns`, `linkCreateFileExtensions`) and under its short parameter name (`defaultPermLevel`, `allowUserDash`, `allowMultiDash`, `defaultGridCols`, `linkCreateFileExts`). When both arrive in one body the short name wins. See REQ-ASET-002.
 ## Requirements
 ### Requirement: Retrieve Admin Settings (REQ-ASET-001)
 
-Administrators MUST be able to retrieve all current admin settings via the API. The endpoint returns a flat JSON object with all four settings using camelCase keys.
+Administrators MUST be able to retrieve all current admin settings via the API. The endpoint returns a flat JSON object with the twelve settings listed under Defined Settings, each under its API response key. `group_order` is not among them; it has its own endpoints (REQ-ASET-012).
 
 #### Scenario: Get all settings with defaults
 - GIVEN no admin settings have been explicitly configured (fresh installation)
 - WHEN the admin sends GET /api/admin/settings
-- THEN the system MUST return HTTP 200 with all settings at their default values:
+- THEN the system MUST return HTTP 200 with all twelve settings at their default values:
   ```json
   {
     "defaultPermissionLevel": "add_only",
     "allowUserDashboards": false,
     "allowMultipleDashboards": true,
-    "defaultGridColumns": 12
+    "defaultGridColumns": 12,
+    "linkCreateFileExtensions": ["txt", "md", "docx", "xlsx", "csv", "odt"],
+    "launchpad.content_storage": "database",
+    "defaultSharePermissionLevel": "add_only",
+    "forcedShareGroups": [],
+    "legacyWidgetBridgeEnabled": false,
+    "maxDashboardsPerUser": 0,
+    "maxWidgetsPerDashboard": 0,
+    "quicksearchFallbackTarget": "none"
   }
   ```
 - NOTE: `allowUserDashboards` defaults to `false` (REQ-ASET-003) — admins MUST opt in to personal dashboard creation.
@@ -52,15 +68,8 @@ Administrators MUST be able to retrieve all current admin settings via the API.
 #### Scenario: Get settings after modification
 - GIVEN the admin has set `allowUserDashboards` to `false`
 - WHEN the admin sends GET /api/admin/settings
-- THEN the system MUST return the updated value:
-  ```json
-  {
-    "defaultPermissionLevel": "add_only",
-    "allowUserDashboards": false,
-    "allowMultipleDashboards": true,
-    "defaultGridColumns": 12
-  }
-  ```
+- THEN the response MUST carry `"allowUserDashboards": false`
+- AND the other eleven keys MUST still be present with their current values
 
 #### Scenario: Non-admin user retrieves settings
 - GIVEN a regular user "alice"
@@ -77,8 +86,9 @@ Administrators MUST be able to retrieve all current admin settings via the API.
 #### Scenario: Settings response format consistency
 - GIVEN the admin has configured various settings at different times
 - WHEN GET /api/admin/settings is called
-- THEN the response MUST always return exactly four keys: `defaultPermissionLevel`, `allowUserDashboards`, `allowMultipleDashboards`, `defaultGridColumns`
+- THEN the response MUST always return exactly the twelve keys listed under Defined Settings: `defaultPermissionLevel`, `allowUserDashboards`, `allowMultipleDashboards`, `defaultGridColumns`, `linkCreateFileExtensions`, `launchpad.content_storage`, `defaultSharePermissionLevel`, `forcedShareGroups`, `legacyWidgetBridgeEnabled`, `maxDashboardsPerUser`, `maxWidgetsPerDashboard`, `quicksearchFallbackTarget`
 - AND no additional keys MUST be present in the response
+- NOTE: This scenario said "exactly four keys" long after the response had grown to twelve. The list above is taken from `AdminSettingsService::getSettings()`; a key added there MUST be added here and to the Defined Settings table.
 - AND the response MUST be a flat JSON object (no nesting)
 
 ### Requirement: Update Admin Settings (REQ-ASET-002)
@@ -90,7 +100,21 @@ Administrators MUST be able to update individual or multiple admin settings in a
 - WHEN they send PUT /api/admin/settings with body `{"allowUserDash": false}`
 - THEN the system MUST update the `allowUserDashboards` setting to `false`
 - AND the response MUST return HTTP 200 with `{"status": "ok"}`
-- NOTE: The API update endpoint accepts abbreviated camelCase parameter names (`defaultPermLevel`, `allowUserDash`, `allowMultiDash`, `defaultGridCols`), NOT the full response key names. The response returns `{"status": "ok"}`, NOT the full settings object.
+- NOTE: The update endpoint accepts a setting under the key GET returns (`allowUserDashboards`, `allowMultipleDashboards`, `defaultGridColumns`, `linkCreateFileExtensions`, `defaultPermissionLevel`) as well as under its short parameter name (`allowUserDash`, `allowMultiDash`, `defaultGridCols`, `linkCreateFileExts`, `defaultPermLevel`). The response returns `{"status": "ok"}`, NOT the full settings object.
+- NOTE: Until launchpad#605 this endpoint accepted ONLY the short names. Nextcloud leaves a parameter it cannot bind at its default, every one of these defaults to null, and null means "not supplied", so a caller that sent the GET keys wrote nothing and was still answered `{"status": "ok"}`. This note used to describe that as the contract.
+
+#### Scenario: A settings object read from GET can be written back through PUT
+- GIVEN the admin reads GET /api/admin/settings
+- WHEN they change one value and send it back under the same key, for example PUT with body `{"allowUserDashboards": false}` or `{"defaultGridColumns": 8}`
+- THEN the system MUST store the new value
+- AND a following GET MUST return it
+- AND this MUST hold for each of `allowUserDashboards`, `allowMultipleDashboards`, `defaultGridColumns`, `linkCreateFileExtensions` and `defaultPermissionLevel`
+
+#### Scenario: Both spellings in one body resolve to the short one
+- GIVEN the admin sends PUT /api/admin/settings with body `{"allowUserDash": true, "allowUserDashboards": false}`
+- WHEN the settings are updated
+- THEN `allowUserDashboards` MUST be `true`
+- NOTE: The short name is the documented parameter and the one the admin UI sends, so an alias MUST NOT override it.
 
 #### Scenario: Update multiple settings at once
 - GIVEN the admin wants to change several settings
diff --git a/openspec/specs/dashboard-cascade-events/spec.md b/openspec/specs/dashboard-cascade-events/spec.md
index 8ba995cf7..b79a45c8c 100644
--- a/openspec/specs/dashboard-cascade-events/spec.md
+++ b/openspec/specs/dashboard-cascade-events/spec.md
@@ -25,6 +25,10 @@ The system MUST define a `DashboardDeletedEvent` class at `lib/Event/DashboardDe
 - AND `getOwnerUserId()` MUST return `'alice'`
 - AND `getType()` MUST return `'user'`
 - AND `getDeletedAt()` MUST return a `\DateTimeImmutable` equal to `2026-05-01T10:00:00Z`
+- AND `getDashboardId()` MUST return the deleted row's integer id when the dispatcher supplied it, and `null` otherwise
+- NOTE: every dispatcher fires after the dashboard row is gone, so a listener for a table keyed on `dashboard_id` cannot recover the id from the UUID. It MUST read `getDashboardId()`. Every dispatcher in LaunchPad supplies it.
+
+@e2e exclude event payload shape with no HTTP surface; asserted in tests/Unit/Event/DashboardDeletedEventTest.php
 
 #### Scenario: Event is dispatched after soft-delete and before response
 
@@ -64,7 +68,9 @@ Every listener MUST be registered in `Application` via `IEventDispatcher::addLis
 
 - GIVEN LaunchPad is bootstrapped
 - WHEN `Application::register()` runs
-- THEN `IEventDispatcher` MUST have listeners registered for `DashboardDeletedEvent::class` covering: `WidgetPlacementsListener`, `CommentsListener`, `ReactionsListener`, `LocksListener`, `VersionsListener`, `PublicSharesListener`, `MetadataValuesListener`, `TranslationsListener`, `ViewAnalyticsListener`, `TreeListener`
+- THEN `IEventDispatcher` MUST have listeners registered for `DashboardDeletedEvent::class` covering: `WidgetPlacementsListener`, `CommentsListener`, `ReactionsListener`, `LocksListener`, `VersionsListener`, `PublicSharesListener`, `DashboardSharesListener`, `MetadataValuesListener`, `TranslationsListener`, `ViewAnalyticsListener`, `TreeListener`
+
+@e2e exclude registration is wiring with no HTTP surface; asserted by running Application::register() in tests/Unit/Listener/DashboardSharesListenerTest.php
 
 #### Scenario: Lifecycle listeners are registered for NC events
 
@@ -84,8 +90,8 @@ Every listener MUST be registered in `Application` via `IEventDispatcher::addLis
 
 A set of listeners MUST clean up every dependent table when `DashboardDeletedEvent` fires. Listeners for disjoint data MUST execute independently and MUST NOT interfere with each other.
 
-- NOTE: Of the ten listeners in this group, only `CommentsListener` is derived from the reference implementation's pattern, which uses `ICommentsManager::deleteCommentsAtObject()` as its sole cleanup mechanism for a single listener registered on the delete event.
-- NOTE: The remaining nine listeners — `WidgetPlacementsListener`, `ReactionsListener`, `LocksListener`, `VersionsListener`, `PublicSharesListener`, `MetadataValuesListener`, `TranslationsListener`, `ViewAnalyticsListener`, and `TreeListener` — are LaunchPad-specific additions. The reference implementation cleans those targets (if they exist at all) either inline in the service layer or not at all; LaunchPad's richer schema warrants dedicated listeners. The table list MUST be validated against LaunchPad's actual migration files before implementation.
+- NOTE: Of the eleven listeners in this group, only `CommentsListener` is derived from the reference implementation's pattern, which uses `ICommentsManager::deleteCommentsAtObject()` as its sole cleanup mechanism for a single listener registered on the delete event.
+- NOTE: The remaining ten listeners: `WidgetPlacementsListener`, `ReactionsListener`, `LocksListener`, `VersionsListener`, `PublicSharesListener`, `DashboardSharesListener`, `MetadataValuesListener`, `TranslationsListener`, `ViewAnalyticsListener`, and `TreeListener` — are LaunchPad-specific additions. The reference implementation cleans those targets (if they exist at all) either inline in the service layer or not at all; LaunchPad's richer schema warrants dedicated listeners. The table list MUST be validated against LaunchPad's actual migration files before implementation.
 - NOTE: `TreeListener` (see REQ-CSC-010) is a LaunchPad improvement over the reference implementation. The reference silently deletes child pages via a recursive filesystem operation without firing the delete event for each child, meaning child-level dependent data (locks, analytics, etc.) is never cleaned up. LaunchPad's `TreeListener` corrects this gap by explicitly dispatching `DashboardDeletedEvent` for each child so that the full listener stack runs for every node in the tree.
 
 #### Scenario: Widget placements are deleted on dashboard delete
@@ -112,6 +118,15 @@ A set of listeners MUST clean up every dependent table when `DashboardDeletedEve
 - AND neither row MUST be hard-deleted (audit trail is preserved)
 - NOTE: LaunchPad-specific listener — the reference implementation has no public-shares table.
 
+#### Scenario: User and group shares are deleted with their dashboard
+
+- GIVEN dashboard `D1` is shared with user `bob` and with group `sales`, two rows in `oc_launchpad_dashboard_shares`
+- WHEN `D1` is deleted and `DashboardDeletedEvent` fires
+- THEN `DashboardSharesListener` MUST delete both rows, keyed on the event's `getDashboardId()`
+- AND neither `bob` nor a member of `sales` MUST see `D1` any longer
+- AND no share row pointing at `D1` MUST remain for the orphan sweep to find
+- NOTE: until this listener existed, the rows stayed behind until `OrphanedSharesCategory` swept them. That sweep stays, for rows orphaned before the fix.
+
 #### Scenario: Versions file is deleted in GroupFolder mode
 
 - GIVEN the instance uses GroupFolder storage backend
diff --git a/openspec/specs/dashboard-export-import/spec.md b/openspec/specs/dashboard-export-import/spec.md
index a82451d17..be95cc360 100644
--- a/openspec/specs/dashboard-export-import/spec.md
+++ b/openspec/specs/dashboard-export-import/spec.md
@@ -11,8 +11,6 @@ Dashboard export and import allow LaunchPad administrators to create versioned s
 ## Data Model
 
 
-@e2e exclude pure backend — all scenarios are PHP/service/API/data-layer; no UI surface
-
 ### ZIP Container Format: `launchpad-export-v1.zip`
 
 ```
@@ -68,12 +66,14 @@ The export output MUST be a ZIP container with a versioned schema that includes
 - AND the manifest MUST declare `scope: "dashboard"` and `dashboardCount: 1`
 - AND all file paths inside the ZIP MUST be relative (no leading `/`)
 
+@e2e exclude The admin page exports the whole site; there is no control for exporting one dashboard, so only a direct API caller reaches this. The archive layout is pinned by ExportServiceTest::testExportDashboardProducesValidArchive. Its metadata-fields and assets clauses are REQ-EXIM-006 and REQ-EXIM-007, which were deferred and never built.
+
 #### Scenario: Site export includes all dashboards
 - GIVEN an admin exports the entire site via `POST /api/admin/export?scope=site`
 - WHEN the export completes
 - THEN the ZIP MUST contain one JSON file per dashboard in `dashboards/` (personal, admin_template, group_shared)
 - AND the manifest MUST declare `scope: "site"` and `dashboardCount: N` matching the actual count
-- AND a single `metadata-fields.json` MUST be present listing all metadata field definitions in the instance
+- AND a single `metadata-fields.json` MUST be present (what it should contain is REQ-EXIM-006, which is not implemented: the file is always an empty list)
 
 #### Scenario: Manifest schema version enforces forward compatibility
 - GIVEN the export ZIP is created with `manifest.json`
@@ -87,8 +87,12 @@ The export output MUST be a ZIP container with a versioned schema that includes
 - THEN all file references MUST use relative asset paths (e.g., `"assets/icons/dashboard-icon.png"` or `"assets/widgets/<placement-uuid>/image.png"`)
 - AND these paths MUST correspond to actual files in the ZIP archive
 
+@e2e exclude Not implemented. The export reserves empty `assets/icons/` and `assets/widgets/<uuid>/` directories and writes no asset bytes or paths (change task 1.5), and asset import was deferred with task 2.6. See REQ-EXIM-007.
+
 ### Requirement: REQ-EXIM-002 Dashboard Scope Export
 
+@e2e exclude Single-dashboard export has no control on the admin page, which offers "Download all dashboards" only, so none of these is reachable from a browser. They are pinned by AdminControllerExportImportTest: testExportDashboardNotFoundReturns404, testExportDashboardRejectsInvalidUuidFormat and testExportDashboardRequiresUuid (each asserting the message, not just the status), and by ExportServiceTest::testSerializeDashboardEmbedsWidgets and testExportDashboardProducesValidArchive. The metadata-fields clause is REQ-EXIM-006 and not implemented.
+
 An admin MUST be able to export a single dashboard with all its configuration, widgets, and associated assets. The export MUST include only the selected dashboard and its dependencies (metadata fields and assets).
 
 #### Scenario: Export single dashboard with widgets
@@ -117,11 +121,13 @@ An admin MUST be able to export a single dashboard with all its configuration, w
 An admin MUST be able to export all dashboards in the instance in a single operation. The export MUST include all personal, admin_template, and group_shared dashboards, plus all metadata field definitions and assets.
 
 #### Scenario: Site export includes all dashboard types
-- GIVEN the instance contains 5 personal dashboards, 2 admin templates, and 1 group_shared dashboard
-- WHEN a Nextcloud admin calls `POST /api/admin/export?scope=site`
-- THEN the response MUST be HTTP 200 with a ZIP containing all 8 `dashboards/<uuid>.json` files
-- AND the manifest `dashboardCount` MUST be `8`
-- AND the `metadata-fields.json` MUST contain all metadata field definitions used across all 8 dashboards (deduplicated by key)
+- GIVEN the instance contains personal dashboards, admin templates and group_shared dashboards
+- WHEN a Nextcloud admin exports the site, from the admin page or `POST /api/admin/export?scope=site`
+- THEN the archive MUST contain one `dashboards/<uuid>.json` for every dashboard in the instance, of every one of those three types
+- AND the manifest `dashboardCount` MUST equal the number of dashboard files in the archive
+- AND every dashboard file MUST be readable and carry its uuid, name and widgets
+- NOTE: This scenario used to read "5 personal, 2 admin templates and 1 group_shared, so dashboardCount MUST be 8". No test can arrange exactly that on an instance it shares with other suites' fixtures, and demanding it would measure those fixtures rather than the export. What it is about is that a site export leaves no dashboard out and that the manifest agrees with the archive, which is what is now written and tested.
+- NOTE: The metadata field definitions this scenario also asked for are REQ-EXIM-006 and are not implemented.
 
 #### Scenario: Empty instance site export
 - GIVEN an instance with no dashboards
@@ -130,6 +136,8 @@ An admin MUST be able to export all dashboards in the instance in a single opera
 - AND the manifest MUST declare `dashboardCount: 0`
 - AND the `dashboards/` directory MUST be empty (or absent)
 
+@e2e exclude Needs an instance with no dashboards at all; the e2e suite shares its instance with every other spec's fixtures, and emptying it would destroy their data. Pinned by ExportServiceTest::testEmptySiteExportIsAValidArchiveWithNoDashboards.
+
 #### Scenario: Memory efficiency for large site exports
 - GIVEN an instance with 1000+ dashboards
 - WHEN an admin calls `POST /api/admin/export?scope=site`
@@ -138,10 +146,31 @@ An admin MUST be able to export all dashboards in the instance in a single opera
 - AND peak memory usage MUST NOT exceed 100 MB (independent of dashboard count)
 - NOTE: Implementation MUST use streaming writes via ZipArchive or equivalent
 
+@e2e exclude A load measurement, not a browser behaviour: it needs 1000+ dashboards and a memory profile. The archive is built on disk with ZipArchive and streamed (change tasks 8.1 and 8.3), but the 100 MB bound has never been measured — task 8.2 was deferred and is still open.
+
 ### Requirement: REQ-EXIM-004 Import Endpoint
 
 An admin MUST be able to import a previously exported ZIP archive into the same or a different LaunchPad instance. The import process MUST validate the ZIP structure, create or update dashboards, handle collisions, and return a summary of imported/skipped records.
 
+Each imported widget MUST arrive as it was exported, apart from what names the exporting instance. Its `content` (a text widget's text, the register an object-list reads, the widget an nc-widget proxies), its `customTitle`, `customIcon`, `styleConfig`, grid position, and for a tile its `tileType` and every tile field MUST be carried. Fields that point at a row or a workflow on the exporting instance MUST NOT be carried: `id`, `dashboardId`, `templatePlacementId`, `isCompulsory`, the `acknowledgement*` fields and `announcementKey`. One builder (`PlacementPayloadHydrator`) does this for every path that reads an archive: this import, the store install that feeds it, and the bundled showcase installer.
+
+An imported dashboard and each imported placement MUST be written with `created_at` and `updated_at` set to the time of the import. Both columns are NOT NULL on both tables.
+
+**Why this was written down.** Until the fix the importer set neither timestamp, so on any database that enforces NOT NULL the dashboard insert failed and the dashboard was reported as skipped: no import had landed a dashboard at all (measured on PostgreSQL, SQLSTATE 23502 on `created_at`). Behind that, the importer kept only each widget's grid, style and title, so even a landed dashboard would have lost every widget's configuration and every tile's identity. The store install path hands its payload to this importer, so store installs failed the same way. The unit tests mocked the mapper and saw neither.
+
+#### Scenario: An exported dashboard imported again keeps every widget's configuration
+- GIVEN a dashboard whose widgets are configured: a text widget with text, an object-list with a register and schema, an nc-widget proxying `tasks`, and a tile with its type, icon, colours and link
+- WHEN an admin exports it and imports the archive through the admin page
+- THEN every imported widget MUST carry the content, title, icon, style and tile fields it was exported with
+- AND the imported text widget MUST render its text
+
+#### Scenario: A dashboard installed from a store arrives with its widgets configured
+- GIVEN a registry template whose dashboard carries configured widgets
+- WHEN an admin installs it from the store
+- THEN each placement MUST carry the `content` the template declared
+
+@e2e exclude Needs a second, publishing instance to install from, which neither CI nor the dev environment has; pinned by StoreServiceTest::testAStoreInstallArrivesWithItsWidgetsConfigured, which runs the real importer behind the store.
+
 #### Scenario: Import valid ZIP creates new dashboards
 - GIVEN a valid `launchpad-export-v1.zip` with 3 dashboards
 - WHEN an admin calls `POST /api/admin/import` with the ZIP file (multipart/form-data, file field)
@@ -166,7 +195,7 @@ An admin MUST be able to import a previously exported ZIP archive into the same
 - WHEN admin imports the ZIP
 - THEN the system MUST return HTTP 200 (partial success)
 - AND the response MUST include `importedDashboardCount: 2, skippedDashboardCount: 1`
-- AND the `errors` array MUST contain an error message identifying the corrupt dashboard
+- AND the `errors` array MUST identify the corrupt dashboard by the archive entry that failed, for example `dashboards/<uuid>.json is not valid JSON`, with its `uuid` taken from that file name
 - AND the other 2 valid dashboards MUST be imported
 
 #### Scenario: Import multipart file upload
@@ -218,10 +247,21 @@ When importing dashboards with preserved UUIDs, the system MUST detect and repor
 - WHEN the import includes dashboards with existing UUIDs
 - THEN the system MUST behave as if `preserveUuids=false` (assign fresh UUIDs)
 
+@e2e exclude The admin page always sends the switch's state, so a browser cannot omit the parameter; only a direct caller can. The default lives on the controller signature and is pinned by AdminControllerExportImportTest::testImportDefaultsToFreshUuids.
+
 ### Requirement: REQ-EXIM-006 Metadata Field Collision Handling
 
+@e2e exclude Not implemented, so there is nothing to drive. The export writes `metadata-fields.json` as an empty list and every dashboard's `metadataFieldAssignments` as `[]`; the import never reads that file; `ImportService::ERR_FIELD_TYPE_MISMATCH` has been declared and unused since the first commit. Change tasks 2.4, 2.5, 3.1, 9.6 and 9.7 were deferred and never picked up. Their stated reason (no MetadataFieldMapper on the parent stack) is now stale: lib/Db/MetadataFieldMapper.php exists.
+
 When importing dashboards that reference metadata fields, the system MUST detect field collisions by key. If a collision occurs with the same field type, reuse the existing field; if types differ, skip the affected dashboard and report the mismatch.
 
+#### Scenario: An export carries the metadata field definitions its dashboards use
+- GIVEN dashboards that reference metadata fields
+- WHEN an admin exports them, at either scope
+- THEN `metadata-fields.json` MUST list every metadata field definition those dashboards use, deduplicated by key
+- AND each dashboard's `metadataFieldAssignments` MUST name the fields it uses
+- NOTE: This is where REQ-EXIM-001, REQ-EXIM-002 and REQ-EXIM-003 used to state the same promise in passing. It is written once, here, beside the import half that has to read it back.
+
 #### Scenario: Reuse existing field on key collision (same type)
 - GIVEN the instance has a metadata field `{key: "department", type: "string"}`
 - AND the imported ZIP contains a dashboard that references `{fieldKey: "department", type: "string"}`
@@ -255,6 +295,8 @@ When importing dashboards that reference metadata fields, the system MUST detect
 
 ### Requirement: REQ-EXIM-007 Asset Import and Collision Handling
 
+@e2e exclude Not implemented, so there is nothing to drive. The export reserves empty `assets/icons/` and `assets/widgets/<uuid>/` directories and writes no bytes (change task 1.5); asset import was deferred with task 2.6 and the collision-rename test with 9.8, pending a read/write-by-uuid surface on the dashboard-icons and resource-uploads capabilities.
+
 When importing dashboards with asset references (icons, widget uploads), the system MUST extract and restore those assets to Nextcloud storage. On filename collision, assets MUST be renamed with a collision-suffix rather than overwriting existing files.
 
 #### Scenario: Icons imported to Nextcloud storage
@@ -294,7 +336,8 @@ The import process MUST validate the ZIP structure, manifest schema, and per-das
 #### Scenario: Reject unsupported schema version
 - GIVEN a ZIP with `manifest.json` containing `schemaVersion: 2`
 - WHEN admin calls `POST /api/admin/import`
-- THEN the system MUST return HTTP 400 with error message `"Unsupported manifest schema version: 2. Only version 1 is supported."`
+- THEN the system MUST return HTTP 400 with error message `"Unsupported manifest schema version: 2. Only version 1 is supported. Upgrade LaunchPad to import archives of version 2."`
+- AND a version BELOW 1 MUST be refused too, without the upgrade advice: it is a broken manifest, not an older format
 - AND no dashboards MUST be imported
 
 #### Scenario: Reject manifest with invalid JSON
@@ -312,6 +355,7 @@ The import process MUST validate the ZIP structure, manifest schema, and per-das
 - WHEN admin imports
 - THEN the system MUST skip that dashboard
 - AND report in `errors` array: `{type: "invalidDashboard", uuid: "<uuid>", message: "Missing required field: name"}`
+- AND that `uuid` MUST be the one the ARCHIVE used, not a UUID the import minted while remapping
 - AND other valid dashboards in the batch MUST still be imported
 
 #### Scenario: ZIP file is not a valid ZIP archive
@@ -335,6 +379,8 @@ The export format MUST support forward-compatible versioning. Only `schemaVersio
 - AND the importer MUST refuse `schemaVersion: 2` on v1-only instances with HTTP 400
 - AND migration tooling (if needed) MUST be provided in a separate change proposal
 
+@e2e exclude A documentation and process requirement: it asks for a future ADR and for migration tooling in a separate change proposal, neither of which a test can observe. Its one behavioural clause, that a v2 archive is refused with HTTP 400, is covered under REQ-EXIM-008.
+
 #### Scenario: Version mismatch does not corrupt existing data
 - GIVEN an instance running export/import for `schemaVersion: 1`
 - WHEN an unsupported `schemaVersion: 2` ZIP is encountered
@@ -344,6 +390,8 @@ The export format MUST support forward-compatible versioning. Only `schemaVersio
 
 ### Requirement: REQ-EXIM-010 CLI Commands for Export and Import
 
+@e2e exclude `occ` commands have no browser surface. They are implemented in lib/Command/ExportCommand.php and lib/Command/ImportCommand.php and have no tests of their own, so their output strings and exit codes are unverified.
+
 Administrators MUST be able to export and import dashboards via command-line interface for automation, backup scripting, and disaster recovery workflows.
 
 #### Scenario: Export all dashboards via CLI
@@ -388,6 +436,8 @@ Each dashboard import MUST be wrapped in a database transaction to ensure consis
 - AND the dashboard MUST NOT partially exist in the database
 - AND the error MUST be reported in the `errors` array
 
+@e2e exclude Needs a widget insert to fail in the middle of a dashboard, which no uploaded archive can force: whatever the file contains, the importer builds rows the database accepts. Pinned by ImportServiceTest::testPartialFailureRollsBackOneDashboard.
+
 #### Scenario: Partial import on multi-dashboard failure
 - GIVEN a ZIP with 10 dashboards, where dashboard #5 has corrupt widget JSON
 - WHEN import processes the batch
@@ -402,9 +452,13 @@ Each dashboard import MUST be wrapped in a database transaction to ensure consis
 - AND the ZIP output MUST be streamed to the HTTP response in chunks
 - AND peak memory usage MUST remain under 100 MB
 
+@e2e exclude The same load measurement as REQ-EXIM-003's memory scenario: 1000 dashboards and a memory profile, which change task 8.2 deferred and nobody has measured since.
+
 #### Scenario: Streaming preserves response stream integrity
 - GIVEN an export of 500 dashboards is being streamed
 - WHEN the response body is transmitted to the client
 - THEN the resulting ZIP file on disk MUST be valid and extractable
 - AND the manifest and all dashboard files MUST be intact
 
+@e2e exclude Needs 500 dashboards. That the streamed archive arrives valid and extractable, with its manifest and every dashboard file intact, is asserted at this instance's size by tests/e2e/dashboard-site-export.spec.ts.
+
diff --git a/openspec/specs/demo-data-showcases/spec.md b/openspec/specs/demo-data-showcases/spec.md
index b8bdf298a..da67b713b 100644
--- a/openspec/specs/demo-data-showcases/spec.md
+++ b/openspec/specs/demo-data-showcases/spec.md
@@ -118,33 +118,60 @@ The system maintains a registry of installed showcases by querying existing dash
 ## Requirements
 
 
-@e2e exclude pure backend — all scenarios are PHP/service/API/data-layer; no UI surface
-
 ### Requirement: REQ-DEMO-001 Bundled showcase ZIP archives
 
-The system MUST ship with exactly 5 showcase ZIP archives under `showcases/{id}/{id}.zip`. Each ZIP MUST contain a valid `export.json` manifest plus a `nl/` locale directory tree. Each `export.json` MUST contain:
-- `exportVersion`: Schema version string
-- `schemaVersion`: Schema version string
-- `requiresMinVersion`: Minimum app version required to install
-- `language`: Locale code (`'nl'` for all v1 showcases)
-- `pages`: Array of page objects with `_exportPath`, `uniqueId`, `title`, and `content`
-- `navigation`: Navigation configuration object
-- `footer`: Footer configuration object
-
-The 5 bundled showcases MUST be:
-- `de-bron` — healthcare/nursing organization
-- `de-linden` — university
-- `gemeente-duin` — municipality
-- `horizon-labs` — tech startup
-- `van-der-berg` — law firm
-
-All 5 showcases are NL-only in v1. Multi-locale support (EN, DE, FR variants) is a v2 goal.
+The system MUST ship a showcase ZIP archive per bundled id under
+`data/demo-showcases/{id}/{id}.zip`, and `DemoShowcasesService::BUNDLED_IDS` is the
+list of record. Each ZIP MUST carry a `manifest.json` plus one
+`dashboards/{uuid}.json`, and MAY carry `metadata-fields.json` and an `assets/`
+tree. Each `manifest.json` MUST contain:
+- `schemaVersion`: schema version integer
+- `scope`: `"dashboard"`
+- `dashboardCount`: number of dashboards in the archive
+- `showcaseId`: the bundled id, matching the directory and file name
+- `showcaseName`: the name an admin sees in the gallery
+- `showcaseDescription`: one sentence saying what the dashboard shows
+- `showcaseLanguage`: locale code of the dashboard's own copy
+
+Each `dashboards/{uuid}.json` MUST declare `type: "group_shared"`, a null `userId`,
+`permissionLevel: "view_only"` and a `showcase-{id}` slug, so an installed showcase
+is a read-only group dashboard rather than someone's personal one.
+
+**This paragraph previously described an `export.json` plus a `nl/` locale tree, and
+neither has ever been in any bundled ZIP.** The archives have always been
+`manifest.json` + `dashboards/`, which is what `ExportService` writes and
+`ImportService` reads. The spec described a format the code does not produce, so a
+reader implementing against it would have built something no bundled archive matches.
+
+Two kinds of showcase are bundled, and the difference is what a reader takes away.
+
+**Organisation showcases** answer "what does an intranet built on this look like".
+They are Dutch, and they mirror the reference source dataset so existing copy and
+screenshots stay reusable:
+- `de-bron`, a healthcare and nursing organisation
+- `de-linden`, a university
+- `gemeente-duin`, a municipality
+- `horizon-labs`, a tech startup
+- `van-der-berg`, a law firm
+
+**Role showcases** answer a different question: what one person's working day looks
+like on one page.
+- `case-handler`, a case handler's cases, tasks, agenda and unread mail
+
+A role showcase MAY be in English. `case-handler` places the fleet's own widgets (a
+dossiq case list, the Tasks app, a calendar, unread mail) and those carry English
+labels, so a Dutch shell around English content would read as a half-translation.
+The five organisation showcases stay NL-only. Multi-locale variants of any showcase
+remain a v2 goal.
 
 #### Scenario: Showcase ZIP archives exist and load without error
 - **GIVEN** LaunchPad is installed and enabled
 - **WHEN** the system initializes
-- **THEN** all 5 showcase ZIP archives MUST be readable from `showcases/{id}/{id}.zip`
-- **AND** each ZIP MUST contain a valid `export.json` parseable as JSON with required fields
+- **THEN** every id in `BUNDLED_IDS` MUST be readable from `data/demo-showcases/{id}/{id}.zip`
+- **AND** each ZIP MUST contain a `manifest.json` parseable as JSON, carrying the required fields
+- **AND** each `manifest.json` `showcaseId` MUST equal the directory and file name it was read from
+
+@e2e exclude Archive shape is a packaging contract with no browser surface; pinned for every bundled id by DemoShowcasesServiceTest::testEveryBundledIdShipsAReadableArchive.
 
 #### Scenario: export.json version is checked against minimum app version
 - **GIVEN** showcase `de-bron` with `"requiresMinVersion": "0.8.11"` in `export.json`
@@ -152,21 +179,33 @@ All 5 showcases are NL-only in v1. Multi-locale support (EN, DE, FR variants) is
 - **THEN** the system MUST reject the install with HTTP 422 and a clear version mismatch message
 - **AND** the showcase MUST still appear in the list endpoint with `isInstalled: false`
 
-#### Scenario: All showcases are NL-only in v1
-- **GIVEN** showcase `gemeente-duin`
-- **WHEN** admin requests install with any language parameter
-- **THEN** the system MUST always resolve to the `nl/` locale tree
-- **AND** the installed dashboard MUST carry `metadata.sourceLanguage = 'nl'`
+@e2e exclude Not implemented: the archives carry a manifest.json with no requiresMinVersion, and the install path has no version check or 422 response.
+
+#### Scenario: A showcase declares the language of its own copy
+- **GIVEN** showcase `gemeente-duin` and showcase `case-handler`
+- **WHEN** an admin lists the available showcases
+- **THEN** `gemeente-duin` MUST declare `showcaseLanguage: "nl"`
+- **AND** `case-handler` MUST declare `showcaseLanguage: "en"`, because a role showcase places widgets whose labels are English
+
+#### Scenario: A role showcase installs as a read-only group dashboard
+- **GIVEN** showcase `case-handler`
+- **WHEN** an admin installs it
+- **THEN** the installed dashboard MUST carry `type: "group_shared"` and `permissionLevel: "view_only"`
+- **AND** it MUST place exactly four widgets: the case list, tasks, today's agenda and unread mail
 
 #### Scenario: Invalid showcase ZIP is rejected
-- **GIVEN** a showcase ZIP whose `export.json` is malformed or missing
+- **GIVEN** a showcase ZIP whose `manifest.json` is malformed or missing
 - **WHEN** the system attempts to load it
 - **THEN** the system MUST log an error
 - **AND** the showcase MUST NOT appear in the available list
 - **AND** installation attempts MUST return HTTP 500
 
+@e2e exclude The bundled archives are all valid, so a browser run cannot arrange a broken one; a missing archive is pinned by DemoShowcasesServiceTest::testDescribeShowcaseReturnsNullWhenZipMissing, a malformed one by no test yet.
+
 ### Requirement: REQ-DEMO-002 List available showcases endpoint
 
+@e2e exclude Endpoint auth and install-state flags are API contracts: 401/403 and the list shape are pinned by AdminDemoShowcasesControllerTest and Newman's GET /api/admin/demo-showcases. The case-handler gallery entry is covered in the browser under REQ-DEMO-001.
+
 The system MUST expose `GET /api/admin/demo-showcases` returning a JSON array of available showcases. Response format:
 
 ```json
@@ -210,6 +249,8 @@ The endpoint MUST be admin-only (HTTP 403 for non-admin users). Response MUST in
 
 ### Requirement: REQ-DEMO-003 Install showcase endpoint
 
+@e2e exclude The endpoint contract (201, 200 when already installed, 404, 403, surfaced skips) is pinned by AdminDemoShowcasesControllerTest and Newman's unknown-id 404; the group_shared result is covered in the browser for case-handler under REQ-DEMO-001. The nl/ locale tree, metadata.sourceLanguage and media extraction scenarios describe behaviour the archive format does not have.
+
 The system MUST expose `POST /api/admin/demo-showcases/{id}/install` creating an installed showcase as a `group_shared` dashboard with `groupId = 'default'`. An optional `?lang=` query parameter is accepted for forward compatibility but always resolves to `nl` in v1. The created dashboard MUST be visible to all users (via REQ-DASH-012). Response format:
 
 ```json
@@ -272,6 +313,8 @@ If any widget types are unknown at install time, they MUST be silently skipped a
 
 ### Requirement: REQ-DEMO-004 Idempotent installation
 
+@e2e exclude Not observable in the browser beyond the gallery's installed state; pinned by DemoShowcasesServiceTest::testInstallIsIdempotent and AdminDemoShowcasesControllerTest::testInstallReturns200WhenAlreadyInstalled. Installation is tracked by an app-config marker, not by dashboard metadata as written.
+
 Reinstalling an already-installed showcase MUST return the existing dashboard's UUID without creating a duplicate. The system MUST track installation state by querying existing `group_shared` dashboards with matching `showcaseId` in metadata.
 
 > **NOTE**: The reference implementation tracked idempotency using a single app-wide boolean flag, which only supports one demo dataset. LaunchPad's per-showcase `metadata.showcaseId` approach is more granular and is the correct design for a multi-showcase system. This is a LaunchPad improvement, not a port.
@@ -291,21 +334,54 @@ Reinstalling an already-installed showcase MUST return the existing dashboard's
 
 ### Requirement: REQ-DEMO-005 Widget type validation and skip-on-missing
 
-At install time, the system MUST validate each widget type in the showcase against the registered widget registry. If a widget type is not registered (unknown), it MUST be silently skipped, recorded in the response, and logged; the installation MUST succeed with valid widgets only. The 8 widget types known to ship in bundled showcases are: `heading`, `text`, `divider`, `links`, `image`, `file`, `news`, `video`, `people`.
+At install time the system MUST decide, per widget, whether LaunchPad can render it, and place only those. A widget MUST be kept when any of these holds:
 
-#### Scenario: All known widget types are installed
-- **GIVEN** a showcase with widgets of types `heading`, `text`, and `image` (all registered)
-- **WHEN** the showcase is installed
-- **THEN** all 3 widgets MUST be created
+- it is a tile (`tileType` set), rendered by LaunchPad's tile renderer;
+- its `widgetId` is one of LaunchPad's own widget types, listed in `lib/widget-types.json` (`object-list`, `nc-widget`, `calendar`, `text` and the rest);
+- its `widgetId` is a Nextcloud dashboard widget registered on this instance (`IManager::getWidgets()`).
+
+Anything else MUST be skipped, recorded in `skippedWidgets` and logged, and the installation MUST still succeed with the widgets that were kept. The case this exists for is a bare Nextcloud widget id whose app is not installed.
+
+`lib/widget-types.json` is the one list of LaunchPad's own types. The frontend widget registry MUST equal it (`widgetRegistry.completeness.spec.js` reads the same file), so the types the installer keeps and the types the workspace renders cannot drift. A missing or malformed list MUST fail the install loudly rather than skip every LaunchPad widget.
+
+An `nc-widget` MUST be kept whatever Nextcloud widget it proxies. The check is on the widget's type; whether the proxied app is installed decides what the tile shows, not whether it is placed. Checking the target would make a showcase's shape depend on which apps an instance happens to have.
+
+A kept widget MUST keep its configuration: its `content` (the register an object-list reads, the widget an nc-widget proxies, a calendar's layout) MUST be copied onto the placement.
+
+**Why this requirement was rewritten.** It used to say widgets were validated against "the registered widget registry", and the code read that as Nextcloud's registry only. LaunchPad's own types are not in it, so the `case-handler` showcase, built entirely from them, installed as an empty dashboard and still reported success. Behind that, the installer did not copy `content`, so a kept widget would have landed unconfigured. The first was caught by the e2e in `tests/e2e/demo-showcase-case-handler.spec.ts`, not by the unit suite, which opened the archive but never ran the install. The second was found while fixing the first, and the same e2e's configuration assertions would have been its next failure.
+
+#### Scenario: A LaunchPad widget type is installed although Nextcloud does not register it
+- **GIVEN** showcase `case-handler`, whose widgets are `object-list`, `nc-widget`, `calendar` and `nc-widget`
+- **AND** none of those ids is in Nextcloud's dashboard registry
+- **WHEN** an admin installs it
+- **THEN** all four widgets MUST be placed
 - **AND** `skippedWidgets` MUST be empty
 
+#### Scenario: A kept widget keeps its configuration
+- **GIVEN** showcase `case-handler`
+- **WHEN** an admin installs it
+- **THEN** the `object-list` placement MUST read register `dossiq`, schema `case`
+- **AND** the two `nc-widget` placements MUST proxy `tasks` and `mail-unread`
+- **AND** the `calendar` placement MUST carry its `internalCalendars` setting
+
+#### Scenario: A Nextcloud widget whose app is not installed is skipped
+- **GIVEN** a showcase with a `text` widget, a `recommendations` widget and a `mail-unread` widget
+- **AND** Nextcloud registers `recommendations` but not `mail-unread`, because the Mail app is not installed
+- **WHEN** the showcase is installed
+- **THEN** `text` and `recommendations` MUST be placed
+- **AND** `skippedWidgets` MUST be `["mail-unread"]`
+
+@e2e exclude Needs an instance where a Nextcloud widget's app is deliberately absent, and no bundled showcase carries such a widget in a stable way; pinned by DemoShowcasesServiceTest::testInstallStillSkipsANextcloudWidgetWhoseAppIsMissing.
+
 #### Scenario: Unknown widget type is skipped
-- **GIVEN** a showcase with widget type `future-timeline` (not registered)
+- **GIVEN** a showcase with widget type `future-timeline` (neither a LaunchPad type nor registered)
 - **WHEN** the showcase is installed
 - **THEN** that widget MUST NOT be created
 - **AND** `skippedWidgets` MUST include `"future-timeline"`
 - **AND** other widgets in the showcase MUST still be created
 
+@e2e exclude The bundled archives contain no unknown widget type, so no browser run can arrange one; pinned by DemoShowcasesServiceTest::testInstallSkipsUnknownWidgetTypes and testPartitionWidgetsTreatsTilesAsValid.
+
 #### Scenario: Mixed valid and invalid widgets
 - **GIVEN** a showcase with 5 widgets: 3 known, 2 unknown
 - **WHEN** the showcase is installed
@@ -314,14 +390,27 @@ At install time, the system MUST validate each widget type in the showcase again
 - **AND** `skippedWidgets` MUST be `["unknown-1", "unknown-2"]`
 - **AND** the response MUST warn the admin
 
+@e2e exclude Same limit as the scenario above, the bundled archives carry no unknown types; the partition is pinned by DemoShowcasesServiceTest and the surfaced list by AdminDemoShowcasesControllerTest::testInstallSurfacesSkippedWidgets.
+
+#### Scenario: The list of LaunchPad types is the list the workspace renders
+- **GIVEN** `lib/widget-types.json` and the frontend widget registry
+- **WHEN** the frontend unit tests run
+- **THEN** the registry's keys MUST equal the types in `lib/widget-types.json`
+
+@e2e exclude A build-time contract with no runtime surface, enforced by src/constants/__tests__/widgetRegistry.completeness.spec.js, which reads lib/widget-types.json.
+
 #### Scenario: Skip is logged for audit
 - **GIVEN** a showcase installation with skipped widgets
 - **WHEN** the installation completes
 - **THEN** the system MUST log the event with showcase ID, widget types skipped, and admin user ID
 - **AND** logs MUST be queryable for audit purposes
 
+@e2e exclude Log output has no browser surface. Note the install log today carries the showcase id, dashboard uuid, skipped list and language, but not the admin user id this scenario asks for.
+
 ### Requirement: REQ-DEMO-006 Uninstall showcase endpoint
 
+@e2e exclude An API contract pinned by the DemoShowcasesServiceTest uninstall tests, the AdminDemoShowcasesControllerTest destroy tests and Newman's DELETE. The case-handler e2e uninstalls in afterAll but asserts nothing about it.
+
 The system MUST expose `DELETE /api/admin/demo-showcases/{id}` soft-removing an installed showcase (delete the dashboard and cascade to widget placements). The endpoint MUST be idempotent: calling it twice MUST both return HTTP 204, whether the showcase was installed or not.
 
 #### Scenario: Uninstall deletes the dashboard
@@ -358,21 +447,38 @@ All v1 bundled showcases are NL-only. Each showcase ZIP contains a single `nl/`
 - **THEN** the system MUST load and install from the `nl/` locale tree
 - **AND** the dashboard metadata MUST record `sourceLanguage: 'nl'`
 
+@e2e exclude Describes an nl/ locale tree the archive format does not have; each showcase declares its language in its manifest instead (see REQ-DEMO-001).
+
 #### Scenario: Language parameter accepted for forward compatibility
 - **GIVEN** admin sends `POST /api/admin/demo-showcases/de-linden/install?lang=en`
 - **WHEN** no `en/` locale exists in the ZIP
 - **THEN** the system MUST fall back to `nl/` (the only available locale)
 - **AND** MUST NOT return an error — graceful fallback is required
 
+@e2e exclude An API parameter with no browser surface; the ?lang= value is passed through as the source language and has no test of its own.
+
 #### Scenario: List endpoint includes language code
 - **GIVEN** showcase list response
 - **WHEN** items are returned
 - **THEN** each item MUST include a `language` field (e.g. `'nl'`)
 - **AND** the frontend MUST display the language to the admin
 
+@e2e exclude Only partly covered: the case-handler e2e asserts the language field on two entries (case-handler and gemeente-duin), not every item, and nothing checks that the gallery displays it.
+
 ### Requirement: REQ-DEMO-008 Read-only showcase source files
 
-Bundled showcase ZIP archives under `showcases/` are read-only template definitions and MUST NOT be edited or deleted by admins via the admin UI. Only the installed dashboard (a copy in `oc_launchpad_dashboards` table) is mutable. The admin UI MUST display showcase templates as non-editable and non-deletable, with "Install" and "Uninstall" buttons for managing installations only.
+@e2e exclude No browser test covers this requirement. The edit rule is pinned by PermissionServiceGroupSharedTest (a member reads, an Editor or a LaunchPad admin edits) and forking by DashboardServiceForkTest; nothing yet asserts the gallery offers only Install and Uninstall.
+
+Bundled showcase archives under `data/demo-showcases/` are read-only source definitions and MUST NOT be edited or deleted through the admin UI, which offers "Install" and "Uninstall" only.
+
+Installing a showcase creates a `group_shared` dashboard in the `default` group with `permissionLevel: view_only` (REQ-DEMO-001). Who may change it follows the rule for every group-shared dashboard (`PermissionService::getEffectivePermissionLevel()`), not the stored level alone:
+
+- Nextcloud admins, LaunchPad admins and users with the Editor role or higher get `full` and MUST be able to edit it: widgets, layout, name.
+- Everyone else MUST see it read-only.
+
+Anyone who wants an editable version of their own MUST be able to fork it. The sidebar's "Add dashboard" button forks the dashboard currently shown into a personal copy (REQ-DASH-020, `POST /api/dashboards/{uuid}/fork`), and the copy carries every widget with its `content` and tile fields. Forking is refused while personal dashboards are switched off (REQ-ASET-003) and is bound by the per-user dashboard quota.
+
+**Why this was rewritten.** It used to say "Installed dashboard is fully editable", which read as a contradiction of the `view_only` the showcases install with. Both were half the rule: `view_only` is what the audience gets, and admins and Editors can still edit.
 
 #### Scenario: Showcase source files are not listed in editable templates
 - **GIVEN** admin views the template management or dashboard list
@@ -380,11 +486,23 @@ Bundled showcase ZIP archives under `showcases/` are read-only template definiti
 - **THEN** showcase source files MUST NOT appear
 - **AND** showcase installations (installed dashboards) MUST appear as regular group-shared dashboards
 
-#### Scenario: Installed dashboard is fully editable
-- **GIVEN** admin has installed showcase `horizon-labs`
-- **WHEN** they view the installed dashboard
-- **THEN** it MUST be editable like any other group-shared dashboard
-- **AND** they MUST be able to modify widgets, rename, reorder, etc.
+#### Scenario: An installed showcase is read-only for its audience
+- **GIVEN** showcase `case-handler` is installed
+- **AND** user "alice" holds no admin or Editor role
+- **WHEN** she opens it
+- **THEN** she MUST be able to see it
+- **AND** she MUST NOT be able to change its widgets, layout or name
+
+#### Scenario: Admins and Editors can edit an installed showcase
+- **GIVEN** showcase `case-handler` is installed
+- **WHEN** a LaunchPad admin, a Nextcloud admin or a user with the Editor role opens it
+- **THEN** they MUST be able to edit it like any other group-shared dashboard
+
+#### Scenario: A user makes an editable copy of an installed showcase
+- **GIVEN** showcase `case-handler` is installed and personal dashboards are allowed
+- **WHEN** a user viewing it presses "Add dashboard" in the sidebar
+- **THEN** a personal copy MUST be created that they own and can edit
+- **AND** the copy MUST carry every widget with its configuration
 
 #### Scenario: Admin UI prevents editing showcase source
 - **GIVEN** the admin UI displaying a showcase card
@@ -394,6 +512,8 @@ Bundled showcase ZIP archives under `showcases/` are read-only template definiti
 
 ### Requirement: REQ-DEMO-009 CLI commands for operations
 
+@e2e exclude occ commands have no browser surface. DemoShowcasesInstallCommand and DemoShowcasesListCommand have no tests yet.
+
 The system MUST expose two Symfony console commands for showcase management.
 
 1. `php occ launchpad:demo-showcases:install <showcase-id> [--lang=nl] [--force]` — installs the specified showcase. The `--force` flag bypasses the idempotency guard and reinstalls even if the showcase is already installed (creating a new dashboard). Without `--force`, reinstall returns the existing UUID. Output MUST include the installed dashboard UUID and any skipped widgets.
diff --git a/package-lock.json b/package-lock.json
index 5d89498db..cd4069f96 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,7 @@
 			"version": "1.0.0",
 			"license": "EUPL-1.2",
 			"dependencies": {
-				"@conduction/nextcloud-vue": "^2.37.0",
+				"@conduction/nextcloud-vue": "^2.46.0",
 				"@mdi/js": "^7.4.47",
 				"@nextcloud/axios": "^2.6.0",
 				"@nextcloud/dialogs": "^7.4.1",
@@ -18,10 +18,10 @@
 				"@nextcloud/router": "^3.1.0",
 				"@nextcloud/vue": "^9.11.0",
 				"dexie": "^4.4.5",
-				"dompurify": "^3.4.14",
+				"dompurify": "^3.4.15",
 				"gridstack": "^12.2.1",
-				"marked": "^18.0.3",
-				"pinia": "~2.1.7",
+				"marked": "^18.0.12",
+				"pinia": "^4.0.3",
 				"vue": "^3.5.42",
 				"vue-loader": "^17.4.2",
 				"vue-material-design-icons": "^5.2.0",
@@ -37,8 +37,8 @@
 				"@nextcloud/prettier-config": "^1.2.0",
 				"@nextcloud/stylelint-config": "^3.2.2",
 				"@nextcloud/webpack-vue-config": "^7.0.2",
-				"@playwright/test": "^1.59.1",
-				"@typescript-eslint/parser": "^8.69.0",
+				"@playwright/test": "^1.63.0",
+				"@typescript-eslint/parser": "^8.70.0",
 				"@vitejs/plugin-vue": "^6.0.8",
 				"@vitest/coverage-v8": "^4.1.11",
 				"@vitest/ui": "^4.1.11",
@@ -46,11 +46,11 @@
 				"@vue/server-renderer": "^3.5.42",
 				"@vue/test-utils": "^2.5.0",
 				"@vue/tsconfig": "^0.9.1",
-				"eslint": "^10.8.1",
+				"eslint": "^10.10.0",
 				"eslint-config-prettier": "^10.1.8",
 				"jsdom": "^30.0.1",
 				"prettier": "^3.9.6",
-				"stylelint": "^17.9.1",
+				"stylelint": "^17.15.0",
 				"terser-webpack-plugin": "^5.3.11",
 				"typescript": "^5.4.0",
 				"vitest": "^4.1.11",
@@ -1786,7 +1786,7 @@
 			"version": "2.2.0",
 			"resolved": "https://registry.npmjs.org/@cacheable/memory/-/memory-2.2.0.tgz",
 			"integrity": "sha512-CTLKqLItRCEixEAewD3/j9DB3/o96gpTPD4eJ1v+DGOlxZRZncRQkGYqqnAGCscYd6RNeXfGeiuCphsPtqyIfQ==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
 				"@cacheable/utils": "^2.5.0",
@@ -1795,54 +1795,17 @@
 				"keyv": "^5.6.0"
 			}
 		},
-		"node_modules/@cacheable/memory/node_modules/@keyv/bigmap": {
-			"version": "1.3.1",
-			"resolved": "https://registry.npmjs.org/@keyv/bigmap/-/bigmap-1.3.1.tgz",
-			"integrity": "sha512-WbzE9sdmQtKy8vrNPa9BRnwZh5UF4s1KTmSK0KUVLo3eff5BlQNNWDnFOouNpKfPKDnms9xynJjsMYjMaT/aFQ==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"hashery": "^1.4.0",
-				"hookified": "^1.15.0"
-			},
-			"engines": {
-				"node": ">= 18"
-			},
-			"peerDependencies": {
-				"keyv": "^5.6.0"
-			}
-		},
-		"node_modules/@cacheable/memory/node_modules/keyv": {
-			"version": "5.6.0",
-			"resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz",
-			"integrity": "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"@keyv/serialize": "^1.1.1"
-			}
-		},
 		"node_modules/@cacheable/utils": {
 			"version": "2.5.0",
 			"resolved": "https://registry.npmjs.org/@cacheable/utils/-/utils-2.5.0.tgz",
 			"integrity": "sha512-buipgOVDkkPXNR5+xBpDw7Zk2n1EvU7qBJCNUcL7rhQ//kfpOXPAvQ511Os0vpLYJ1pZnvudNytkQt2hst3wqA==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
 				"hashery": "^1.5.1",
 				"keyv": "^5.6.0"
 			}
 		},
-		"node_modules/@cacheable/utils/node_modules/keyv": {
-			"version": "5.6.0",
-			"resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz",
-			"integrity": "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"@keyv/serialize": "^1.1.1"
-			}
-		},
 		"node_modules/@ckpack/vue-color": {
 			"version": "1.6.0",
 			"resolved": "https://registry.npmjs.org/@ckpack/vue-color/-/vue-color-1.6.0.tgz",
@@ -2010,9 +1973,9 @@
 			}
 		},
 		"node_modules/@conduction/nextcloud-vue": {
-			"version": "2.37.0",
-			"resolved": "https://registry.npmjs.org/@conduction/nextcloud-vue/-/nextcloud-vue-2.37.0.tgz",
-			"integrity": "sha512-3+c+vPHlcswZS0+yEO+HjaFTkgI0ET0Lk33LEmMnZc/E7rDV6lPILq9LNlmxC04WuyQNILx4+zsckkSMYEg7hQ==",
+			"version": "2.46.0",
+			"resolved": "https://registry.npmjs.org/@conduction/nextcloud-vue/-/nextcloud-vue-2.46.0.tgz",
+			"integrity": "sha512-dN8ICjedNn9H5bTpfge6qMpxKlz/wciO0rjc8C6Km5WjFXdkJqEQ4mXtusNA0qqm3zv1cOE6KzFsGMgL3niWpQ==",
 			"license": "EUPL-1.2",
 			"dependencies": {
 				"@ckpack/vue-color": "^1.6.0",
@@ -2043,12 +2006,10 @@
 				"ajv-formats": "^3.0.1",
 				"apexcharts": "^4.7.0",
 				"codemirror": "^6.0.0",
-				"dompurify": "^3.0.0",
 				"leaflet": "^1.9.0",
 				"leaflet.markercluster": "^1.5.3",
 				"linkifyjs": "^4.3.3",
 				"lodash": "^4.17.21",
-				"marked": "^12.0.0",
 				"style-mod": "^4.0.0",
 				"vue-codemirror6": "^1.4.3",
 				"vue3-apexcharts": "~1.8.0",
@@ -2075,7 +2036,7 @@
 				"eslint": "^8.56.0 || ^9.0.0 || ^10.0.0",
 				"eslint-plugin-vue": "^9.21.0 || ^10.0.0",
 				"gridstack": "^12.0.0 || ^13.0.0",
-				"marked": "^12.0.0",
+				"marked": ">=12 <19",
 				"pinia": "^2.0.0 || ^3.0.0 || ^4.0.0",
 				"vue": "^3.5.0",
 				"vue-eslint-parser": "^9.4.0 || ^10.0.0",
@@ -2085,38 +2046,17 @@
 				"axe-core": {
 					"optional": true
 				},
-				"dexie": {
-					"optional": true
-				},
-				"dompurify": {
-					"optional": true
-				},
 				"eslint": {
 					"optional": true
 				},
 				"eslint-plugin-vue": {
 					"optional": true
 				},
-				"marked": {
-					"optional": true
-				},
 				"vue-eslint-parser": {
 					"optional": true
 				}
 			}
 		},
-		"node_modules/@conduction/nextcloud-vue/node_modules/marked": {
-			"version": "12.0.2",
-			"resolved": "https://registry.npmjs.org/marked/-/marked-12.0.2.tgz",
-			"integrity": "sha512-qXUm7e/YKFoqFPYPa3Ukg9xlI5cyAtGmyEIzMfW//m6kXwCy2Ps9DYf5ioijFKQ8qyuscrHoY04iJGctu2Kg0Q==",
-			"license": "MIT",
-			"bin": {
-				"marked": "bin/marked.js"
-			},
-			"engines": {
-				"node": ">= 18"
-			}
-		},
 		"node_modules/@csstools/color-helpers": {
 			"version": "6.1.1",
 			"resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.1.tgz",
@@ -3026,9 +2966,9 @@
 			}
 		},
 		"node_modules/@eslint/plugin-kit": {
-			"version": "0.7.2",
-			"resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.2.tgz",
-			"integrity": "sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==",
+			"version": "0.7.3",
+			"resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.3.tgz",
+			"integrity": "sha512-IkO+/KEUvwbVpiURZg+P7zF74z5Jxe0UgJxVni+RtoHQ6IZieXaO02kmadomap/q+l6bc/jdPGGqTjhuZnuz1Q==",
 			"devOptional": true,
 			"license": "Apache-2.0",
 			"dependencies": {
@@ -3717,11 +3657,28 @@
 				"tslib": "2"
 			}
 		},
+		"node_modules/@keyv/bigmap": {
+			"version": "1.3.1",
+			"resolved": "https://registry.npmjs.org/@keyv/bigmap/-/bigmap-1.3.1.tgz",
+			"integrity": "sha512-WbzE9sdmQtKy8vrNPa9BRnwZh5UF4s1KTmSK0KUVLo3eff5BlQNNWDnFOouNpKfPKDnms9xynJjsMYjMaT/aFQ==",
+			"devOptional": true,
+			"license": "MIT",
+			"dependencies": {
+				"hashery": "^1.4.0",
+				"hookified": "^1.15.0"
+			},
+			"engines": {
+				"node": ">= 18"
+			},
+			"peerDependencies": {
+				"keyv": "^5.6.0"
+			}
+		},
 		"node_modules/@keyv/serialize": {
 			"version": "1.1.1",
 			"resolved": "https://registry.npmjs.org/@keyv/serialize/-/serialize-1.1.1.tgz",
 			"integrity": "sha512-dXn3FZhPv0US+7dtJsIi2R+c7qWYiReoEh5zUntWCf4oSpMNib8FDhSoed6m3QyZdx5hK7iLFkYk3rNxwt8vTA==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT"
 		},
 		"node_modules/@leichtgewicht/ip-codec": {
@@ -4816,15 +4773,6 @@
 				"node": "^20.0.0 || ^22.0.0 || ^24.0.0"
 			}
 		},
-		"node_modules/@nextcloud/vue/node_modules/@vue/devtools-api": {
-			"version": "8.2.1",
-			"resolved": "https://registry.npmjs.org/@vue/devtools-api/-/devtools-api-8.2.1.tgz",
-			"integrity": "sha512-6u4vXBlIBAC1wMplIZgpyPn7uh/s4Bf6F5bMzvLv+EdJ0aHs/+4B7Ygv864EStQSjRbsRzTko/kUG1A1IejQ3A==",
-			"license": "MIT",
-			"dependencies": {
-				"@vue/devtools-kit": "^8.2.1"
-			}
-		},
 		"node_modules/@nextcloud/vue/node_modules/esbuild": {
 			"version": "0.28.2",
 			"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
@@ -4868,33 +4816,18 @@
 				"@esbuild/win32-x64": "0.28.2"
 			}
 		},
-		"node_modules/@nextcloud/vue/node_modules/fsevents": {
-			"version": "2.3.3",
-			"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-			"integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-			"hasInstallScript": true,
-			"license": "MIT",
-			"optional": true,
-			"os": [
-				"darwin"
-			],
-			"peer": true,
-			"engines": {
-				"node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-			}
-		},
 		"node_modules/@nextcloud/vue/node_modules/vite": {
-			"version": "8.2.2",
-			"resolved": "https://registry.npmjs.org/vite/-/vite-8.2.2.tgz",
-			"integrity": "sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q==",
+			"version": "8.3.0",
+			"resolved": "https://registry.npmjs.org/vite/-/vite-8.3.0.tgz",
+			"integrity": "sha512-lhZBVvEHefgE+HQZC9O7EBJgCU/nVzFNl7vkS4RE0APtWLP02/8QVIkQtzBxPquh7lq5/78NHipTj7ODQ6XuyQ==",
 			"license": "MIT",
 			"optional": true,
 			"peer": true,
 			"dependencies": {
 				"lightningcss": "^1.33.0",
-				"picomatch": "^4.0.5",
-				"postcss": "^8.5.26",
-				"rolldown": "~1.2.4",
+				"picomatch": "^4.0.7",
+				"postcss": "^8.5.28",
+				"rolldown": "~1.2.6",
 				"tinyglobby": "^0.2.17"
 			},
 			"bin": {
@@ -4911,7 +4844,7 @@
 			},
 			"peerDependencies": {
 				"@types/node": "^20.19.0 || >=22.12.0",
-				"@vitejs/devtools": "^0.4.0 || ^0.5.0",
+				"@vitejs/devtools": "^0.7.1",
 				"esbuild": "^0.27.0 || ^0.28.0",
 				"jiti": ">=1.21.0",
 				"less": "^4.0.0",
@@ -5241,9 +5174,9 @@
 			}
 		},
 		"node_modules/@oxc-project/types": {
-			"version": "0.148.0",
-			"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.148.0.tgz",
-			"integrity": "sha512-Nm4s/jB+4FpFsPhWGEC4h7rzksesmtnMXomo6rCMcg/b8zLQuOziRgkCS1fxDCXOlJB/6Q8oABOZ/OP6RIPj9A==",
+			"version": "0.149.0",
+			"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.149.0.tgz",
+			"integrity": "sha512-Efcc+iF0j3Bf67YjEqIqWXbX5XddXoK/Mw4K1/JuXwRCZ8N16VR7iT23nlCc9XrveFVh/E5Rqs2StT0V8v9LdA==",
 			"license": "MIT",
 			"optional": true,
 			"peer": true,
@@ -5775,13 +5708,13 @@
 			}
 		},
 		"node_modules/@playwright/test": {
-			"version": "1.62.1",
-			"resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.62.1.tgz",
-			"integrity": "sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ==",
+			"version": "1.63.0",
+			"resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.63.0.tgz",
+			"integrity": "sha512-oxMK4vllB9RK5NQ2l1pq1IfOf2AvnEuj/vYGDj0H2nMtmtZpKtCwt/l00GEO6xjGfpBNAvjovvYdCm50dRQkpQ==",
 			"dev": true,
 			"license": "Apache-2.0",
 			"dependencies": {
-				"playwright": "1.62.1"
+				"playwright": "1.63.0"
 			},
 			"bin": {
 				"playwright": "cli.js"
@@ -5798,9 +5731,9 @@
 			"license": "MIT"
 		},
 		"node_modules/@rolldown/binding-android-arm-eabi": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.7.tgz",
-			"integrity": "sha512-EypzgnYCwyVY4NDHKzGmNJT5b+XaQEBniHxsMdeIQLB/tcCzZnhqrzHpZFbX9iaxx+5RiB8caATBtfvZP7zVxQ==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.8.tgz",
+			"integrity": "sha512-tN5aztYkKCte4i5SIrrz5yK/HMjEuCqCSCJa418jOV8tZ1cBY3YF2otxB1ktPxzsLA1BeTqwapK0bfjxNvHJVw==",
 			"cpu": [
 				"arm"
 			],
@@ -5815,9 +5748,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-android-arm64": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.7.tgz",
-			"integrity": "sha512-l17HE9EweWaqJZhuUuNBN/FzM62xw+DECVnJyvMsxn8vJFAGLy5QfLDoYAcronkAN8VxKZHezDpulHDPx95vFw==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.8.tgz",
+			"integrity": "sha512-dIYTWl9XprMUiQFoc55KUyk/oS8SKYH3zFl0LTR7RT0Xj4hgSVyuJcroH8JUu8RcpF8fTB6E0aOwCkZoYPcDSQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -5832,9 +5765,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-darwin-arm64": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.7.tgz",
-			"integrity": "sha512-8ED8ELFvHXc6OCETIn4gXObPiaR6bckM/ipXtbzlPVDRMBfEGjCKgO90F9YtfdpDatVx/ZQw7aZ1vUMf/+T3Mw==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.8.tgz",
+			"integrity": "sha512-PCSDQGXD2IyTEFrcgPyBM8jJuGmrbCMuoIOXdbEGVemruKACXoLQJrb+A45Z0L5t1RQkdfJprAYPkikbh7dzdA==",
 			"cpu": [
 				"arm64"
 			],
@@ -5849,9 +5782,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-darwin-x64": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.7.tgz",
-			"integrity": "sha512-/WPripjtiAIZ2tWY7ddijORT0Ujg87wxWW/qcoFVCKAWVDPhtY0xr7Dj0M3GyNGz60jGwTElhro/mkF9dT7dDQ==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.8.tgz",
+			"integrity": "sha512-Uk7lRsGhPFHVX/sAUC6D5H9Ol30dFHd6iquokll2th3LpdJ3F5CzQB+7DHn0Ri2mG+U7k2zXiPHDrwZenXhwSA==",
 			"cpu": [
 				"x64"
 			],
@@ -5866,9 +5799,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-freebsd-x64": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.7.tgz",
-			"integrity": "sha512-14DI4NcqpvbICxSnGLx3PmtDaWqRP/KGSGb6C+JLLVPeZRl6dKdHba3pGsqT3vpdTqhEYIPG0MMQ8c0xYqoJxA==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.8.tgz",
+			"integrity": "sha512-DjszaTEVogPqA5bYzsEeqDCQxbcp2fexQwKcRspYji2yzR68fCf+e4fx6kBSRDwX5/brZaHw/hWS9+A/+/w9sQ==",
 			"cpu": [
 				"x64"
 			],
@@ -5883,9 +5816,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.7.tgz",
-			"integrity": "sha512-bxrWIRvHWQvbJwi+VIie/kDJmQxcNE6xxWwZdqF/ExVAigtHkv54WTLQPb+QsZdnFy18fg7JPfWGL0RH6vwIlQ==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.8.tgz",
+			"integrity": "sha512-zmwa7FTmdzB6aaEEuuls18H6Ap5JmJPSoPTuXixeJZV6tG40SyLkApQtz1g8ptZtiEKqj9OM0oNLPh1AgvE31Q==",
 			"cpu": [
 				"arm"
 			],
@@ -5900,9 +5833,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm64-gnu": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.7.tgz",
-			"integrity": "sha512-toOY2BChBZyuxU7OYX6Tn389di4IzAqPTycVcci0O7FSfBqzRB3RZn+K5Is6ANf4tmgRd/K1yZTsNTXbkXsnLg==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.8.tgz",
+			"integrity": "sha512-KdYQDPHwJVnbFwdTGMgxsI9SqblBlz6STGM+w1We/d5B8OWWidYH0MwkU/uA1wM5fIpO2MkOVxXrNzzuZhw9ew==",
 			"cpu": [
 				"arm64"
 			],
@@ -5917,9 +5850,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm64-musl": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.7.tgz",
-			"integrity": "sha512-lAIXTH/aiLRLxsTgQvfhjo4K1ydWIp00+V0voOr9beb/9ZmkUFrSIb03dXNFRgMNvkE6oGsF10ioQ6UsI+vS5Q==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.8.tgz",
+			"integrity": "sha512-jFJTifHnNPY+yzOoNZQfSIysrVyXzEQPhPnOUjmD1bcQGHH6s7c8cViKWar8YplQImE5N9JRqMCLrM2CdxOrZA==",
 			"cpu": [
 				"arm64"
 			],
@@ -5934,9 +5867,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-ppc64-gnu": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.7.tgz",
-			"integrity": "sha512-kdnwS28Pkenp/mZMRwjXXXwxQ7pIsm+bF919LUK93BOyhcLsrVKdP2p9fxpiPNPAbNuch8ypQt0pm2P2LYCAGg==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.8.tgz",
+			"integrity": "sha512-FhiOziBDWPBjbcmRzfLyIJnaP7AVMFXT7YCXPjXxj7wKU3vx24RjrCNN/zjvVa+N2vVoHJwCoUBvsrN/DG3zIA==",
 			"cpu": [
 				"ppc64"
 			],
@@ -5951,9 +5884,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-s390x-gnu": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.7.tgz",
-			"integrity": "sha512-516OdsyLdr5E65paF3yBF55t8mfm9+gmtCsK3xI7XKXIT7EfRlHhxL8K/NR6Hu8BWSgF5+1w74lTL0+nxcc8Qw==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.8.tgz",
+			"integrity": "sha512-WnHfADMzOV2Y55wlx1hzzQnar/wDt/VdvWSD99r18Mz9ylNieIGOkRx3UV21h7m/eJvjySYJkO26VvGNFkwsIQ==",
 			"cpu": [
 				"s390x"
 			],
@@ -5968,9 +5901,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-x64-gnu": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.7.tgz",
-			"integrity": "sha512-r8/z8n7GFaYRln3xmP1Cxy0HH/HLM0uBUPkEuSVEfKGDA89M0FsZRZJRSwe/tJjRx+fpH/gjorfhB8tmEbSFLA==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.8.tgz",
+			"integrity": "sha512-H9tRr5ibfXFVLxbPOseVewewFpl28zcEdjRDt2FTUZU7odxP0gEv1ki4/kGmcGOh78oRwZuuQllGLZ9zTJp84g==",
 			"cpu": [
 				"x64"
 			],
@@ -5985,9 +5918,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-x64-musl": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.7.tgz",
-			"integrity": "sha512-pAsE8iiDxUg1xBqdhrTfg45AVDVpirjz00sblEYClGNNcMnDb+e8beQgqIAw6LvauX/APvgxUnwrgun/YYGBhw==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.8.tgz",
+			"integrity": "sha512-UefiqfM3D6IVNlZ8tSGs9+Ejjud2T+oxO0IHADU45Y+lyEjD2dVFyZHbkfX0LUb5Zugo/oIv1eCO/KVYhgYJYA==",
 			"cpu": [
 				"x64"
 			],
@@ -6002,9 +5935,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-openharmony-arm64": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.7.tgz",
-			"integrity": "sha512-lTcIYmmnQQA8Or/2DatS6oSqcdLHvendjS+zLu+FwgToynWMRSmQdpM65fTANJgIS4mjbMOo5KT2lnT9SAb96w==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.8.tgz",
+			"integrity": "sha512-637Ke4kWSy6rp9cxQ9gMOXlxPgIw/c1beASV4M//3+9I4uwBVOOl74G+e3zyU3u19U7RkRl/HuewixZ/Z6+Rjg==",
 			"cpu": [
 				"arm64"
 			],
@@ -6019,9 +5952,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-win32-arm64-msvc": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.7.tgz",
-			"integrity": "sha512-e3Gu3WxbNk/UqQhxqU7YIYO+9ZBvWNz3U+h/qRFosscMFzdRPbXYSaSWgSnklv2fz1TgzBTcti2z35c/7irsHw==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.8.tgz",
+			"integrity": "sha512-xWBkPOF1Q9k/Gv1nQXnVdLxKu74jXppuOM4Z3mnypVUJJJwLsMl7hNJGRAUJoG8A5MgOI1ACKM+wBFxSJzKy4A==",
 			"cpu": [
 				"arm64"
 			],
@@ -6036,9 +5969,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-win32-x64-msvc": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.7.tgz",
-			"integrity": "sha512-W/jg5qoRSqjsEv0+dZi4e687mcHqmVuU0P4fK6qS/xjetW2Gmc1W8j//z5nAeNcC8Ttm0hV46IjcYeuVwYhuiw==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.8.tgz",
+			"integrity": "sha512-uz2ZvfgXbxqNwijjjbxrnvALwpyODDcgc1T1N8N3rf/DXKQmaFwmB4LX4yyjggpwN2obdQLb2rgirX5ffCWYng==",
 			"cpu": [
 				"x64"
 			],
@@ -6879,16 +6812,16 @@
 			}
 		},
 		"node_modules/@typescript-eslint/parser": {
-			"version": "8.69.0",
-			"resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.69.0.tgz",
-			"integrity": "sha512-l4b0DhWioGg6Gt2ebGlvfkFMOjRsauxtsnDRwUSRX1qHq3HdTfQHV8wW9zEXeciai6HfeaKOedQn2Zoofx3WBw==",
+			"version": "8.70.0",
+			"resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.70.0.tgz",
+			"integrity": "sha512-zYvrmj9Yxd63UGaXw+kdt6A0F0s0qveJyuatIM77bYC2DE4pgmg7a50u8LR7PRtXd0x+h+Tl3eXabGm06SWd3Q==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@typescript-eslint/scope-manager": "8.69.0",
-				"@typescript-eslint/types": "8.69.0",
-				"@typescript-eslint/typescript-estree": "8.69.0",
-				"@typescript-eslint/visitor-keys": "8.69.0",
+				"@typescript-eslint/scope-manager": "8.70.0",
+				"@typescript-eslint/types": "8.70.0",
+				"@typescript-eslint/typescript-estree": "8.70.0",
+				"@typescript-eslint/visitor-keys": "8.70.0",
 				"debug": "^4.4.3"
 			},
 			"engines": {
@@ -6904,14 +6837,14 @@
 			}
 		},
 		"node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/project-service": {
-			"version": "8.69.0",
-			"resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.69.0.tgz",
-			"integrity": "sha512-yi4obFrHMmnsesWehHbkg9zMA7Jt8cXT+mKM08G999pH1yT6nqgsHx7MYm0uY1wAj8CqiBXYRJ7WAT0QdQHQXg==",
+			"version": "8.70.0",
+			"resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.0.tgz",
+			"integrity": "sha512-hFHbTNqhU9G+2eKFXCBVb1tjFT/LceiJ4+HfLO4pTpDI0KHi6iajpcFFkaSQ9gXmCh7n82A0PthaayEdN6mspQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@typescript-eslint/tsconfig-utils": "^8.69.0",
-				"@typescript-eslint/types": "^8.69.0",
+				"@typescript-eslint/tsconfig-utils": "^8.70.0",
+				"@typescript-eslint/types": "^8.70.0",
 				"debug": "^4.4.3"
 			},
 			"engines": {
@@ -6926,14 +6859,14 @@
 			}
 		},
 		"node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager": {
-			"version": "8.69.0",
-			"resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.69.0.tgz",
-			"integrity": "sha512-ewfspqWvSxKSOaplqAUNbaSFO0eB6w1EtQ+esfYFRm3614Ty4uNtExkcbgd6nWsXphbqKyf9ZYdbZdv2xEoWEQ==",
+			"version": "8.70.0",
+			"resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.70.0.tgz",
+			"integrity": "sha512-8nP3Kwh5hlgZ4FicGvmznAmJe8UL4sdU8tLukrPaMuQmDuk4Y8xYfzu/aYZW4xT2JCgc7H/TpDI5cGlxcWJSqQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@typescript-eslint/types": "8.69.0",
-				"@typescript-eslint/visitor-keys": "8.69.0"
+				"@typescript-eslint/types": "8.70.0",
+				"@typescript-eslint/visitor-keys": "8.70.0"
 			},
 			"engines": {
 				"node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -6944,9 +6877,9 @@
 			}
 		},
 		"node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/tsconfig-utils": {
-			"version": "8.69.0",
-			"resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.69.0.tgz",
-			"integrity": "sha512-xNqK7YTDZsLniQMV/4rpFR8Z5JlqeRvVjuG1YgF/mdPVH84HSD19L8CczMA0qg2RfwEV231GHH3VnToJDo4MfQ==",
+			"version": "8.70.0",
+			"resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.0.tgz",
+			"integrity": "sha512-adnkeeNq9Sq1sUf4+FRVc0KdgYghzsgFpZSQVZVvY0LCuUuN0FnQgyGzCJeC4fW1cdXseBAjU2EOqUIjbNcZUw==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -6961,9 +6894,9 @@
 			}
 		},
 		"node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/types": {
-			"version": "8.69.0",
-			"resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.69.0.tgz",
-			"integrity": "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA==",
+			"version": "8.70.0",
+			"resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.70.0.tgz",
+			"integrity": "sha512-asTOIYhDg4zdzOScCyaytrsV3cR6B4ecPQlXw/dJIm7J/MZTtCtfVII9JD8Geh4jTCrK/Xe6cg5UevoleMcoJQ==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -6975,16 +6908,16 @@
 			}
 		},
 		"node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree": {
-			"version": "8.69.0",
-			"resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.69.0.tgz",
-			"integrity": "sha512-AdFkgqck3Vudb/kWnxlyafU/4aBhHrbQ9locP2N4psXTy5mOBg0SHJumnLvx7r6g1gV4DKvUFwV2nJZBoqOD8w==",
+			"version": "8.70.0",
+			"resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.0.tgz",
+			"integrity": "sha512-d9NmHMPEKQ7QCLLm1jI3zmoQBwT5KwFYjXBJ9ymZfKCUU+5rmTRykKAFvH5Qn/ZCds3CEAFS9OC9M/jkl0X2bA==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@typescript-eslint/project-service": "8.69.0",
-				"@typescript-eslint/tsconfig-utils": "8.69.0",
-				"@typescript-eslint/types": "8.69.0",
-				"@typescript-eslint/visitor-keys": "8.69.0",
+				"@typescript-eslint/project-service": "8.70.0",
+				"@typescript-eslint/tsconfig-utils": "8.70.0",
+				"@typescript-eslint/types": "8.70.0",
+				"@typescript-eslint/visitor-keys": "8.70.0",
 				"debug": "^4.4.3",
 				"minimatch": "^10.2.2",
 				"semver": "^7.7.3",
@@ -7003,13 +6936,13 @@
 			}
 		},
 		"node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/visitor-keys": {
-			"version": "8.69.0",
-			"resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.69.0.tgz",
-			"integrity": "sha512-+rmdgPA+EXkNgKYvHvFfhrs35utXbwaC5PGpDquSXcoXQDKUA5UjV0LmTucG/4JXkM31BTu4TilHtrN8IVBe8w==",
+			"version": "8.70.0",
+			"resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.70.0.tgz",
+			"integrity": "sha512-BoC8PiO4Hkdo0TVJh9Ntxr5MxPDI7/oFsrygN5ADelFSeXG/qgNuucIGA+L5Z6JpPTE/uRfcTWtscjbUaufepQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@typescript-eslint/types": "8.69.0",
+				"@typescript-eslint/types": "8.70.0",
 				"eslint-visitor-keys": "^5.0.0"
 			},
 			"engines": {
@@ -7600,10 +7533,13 @@
 			}
 		},
 		"node_modules/@vue/devtools-api": {
-			"version": "6.6.4",
-			"resolved": "https://registry.npmjs.org/@vue/devtools-api/-/devtools-api-6.6.4.tgz",
-			"integrity": "sha512-sGhTPMuXqZ1rVOk32RylztWkfXTRhuS7vgAKv0zjqk8gbsHkJ7xfFf+jbySxt7tWObEJwyKaHMikV/WGDiQm8g==",
-			"license": "MIT"
+			"version": "8.2.1",
+			"resolved": "https://registry.npmjs.org/@vue/devtools-api/-/devtools-api-8.2.1.tgz",
+			"integrity": "sha512-6u4vXBlIBAC1wMplIZgpyPn7uh/s4Bf6F5bMzvLv+EdJ0aHs/+4B7Ygv864EStQSjRbsRzTko/kUG1A1IejQ3A==",
+			"license": "MIT",
+			"dependencies": {
+				"@vue/devtools-kit": "^8.2.1"
+			}
 		},
 		"node_modules/@vue/devtools-kit": {
 			"version": "8.2.1",
@@ -9147,7 +9083,7 @@
 			"version": "2.5.0",
 			"resolved": "https://registry.npmjs.org/cacheable/-/cacheable-2.5.0.tgz",
 			"integrity": "sha512-60cyAOytib/OzBw1JNSoSV/boK1AtHryDIjvVBk7XbN4ugfkM3+Sry7fEjNgPMGgOjuaZPAp8ruZ0Cxafwyq9g==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
 				"@cacheable/memory": "^2.2.0",
@@ -9157,16 +9093,6 @@
 				"qified": "^0.10.1"
 			}
 		},
-		"node_modules/cacheable/node_modules/keyv": {
-			"version": "5.6.0",
-			"resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz",
-			"integrity": "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"@keyv/serialize": "^1.1.1"
-			}
-		},
 		"node_modules/call-bind": {
 			"version": "1.0.9",
 			"resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.9.tgz",
@@ -10525,9 +10451,9 @@
 			}
 		},
 		"node_modules/dompurify": {
-			"version": "3.4.14",
-			"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.14.tgz",
-			"integrity": "sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg==",
+			"version": "3.4.15",
+			"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz",
+			"integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==",
 			"license": "(MPL-2.0 OR Apache-2.0)",
 			"optionalDependencies": {
 				"@types/trusted-types": "^2.0.7"
@@ -10887,9 +10813,9 @@
 			}
 		},
 		"node_modules/eslint": {
-			"version": "10.9.1",
-			"resolved": "https://registry.npmjs.org/eslint/-/eslint-10.9.1.tgz",
-			"integrity": "sha512-9VaAkDURekixUQJy0oJYl2DcN6oKMfxay7XzaGYAWQwsb6qfKf+x76R2k1L8kb1boc+FyCAaTA9GmiKaaiaF+A==",
+			"version": "10.10.0",
+			"resolved": "https://registry.npmjs.org/eslint/-/eslint-10.10.0.tgz",
+			"integrity": "sha512-NPXn6r5zl4uET1DAVPaOwzX3rut4c0wcmw3dWJAfOsTM5+TogXo0DDjz8pwm/hL8cyVNpHqeK4JpN0NjnyFFNw==",
 			"devOptional": true,
 			"license": "MIT",
 			"workspaces": [
@@ -10901,7 +10827,7 @@
 				"@eslint/config-array": "^0.23.5",
 				"@eslint/config-helpers": "^0.7.0",
 				"@eslint/core": "^1.2.1",
-				"@eslint/plugin-kit": "^0.7.2",
+				"@eslint/plugin-kit": "^0.7.3",
 				"@humanfs/node": "^0.16.6",
 				"@humanwhocodes/module-importer": "^1.0.1",
 				"@humanwhocodes/retry": "^0.4.2",
@@ -10916,7 +10842,7 @@
 				"esquery": "^1.7.0",
 				"esutils": "^2.0.2",
 				"fast-deep-equal": "^3.1.3",
-				"file-entry-cache": "^8.0.0",
+				"file-entry-cache": "11.1.5 || >11.1.6 <12",
 				"find-up": "^5.0.0",
 				"glob-parent": "^6.0.2",
 				"ignore": "^5.2.0",
@@ -11652,16 +11578,13 @@
 			"license": "MIT"
 		},
 		"node_modules/file-entry-cache": {
-			"version": "8.0.0",
-			"resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
-			"integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
+			"version": "11.1.5",
+			"resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-11.1.5.tgz",
+			"integrity": "sha512-+PFTHITI08JIGhnNpGNI8T8inUpgZfk3GNEqfT9R2zZV2iFXg3CvqzSl/uEhs7TSGujYRELEANyDvS8Fj7+S7Q==",
 			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
-				"flat-cache": "^4.0.0"
-			},
-			"engines": {
-				"node": ">=16.0.0"
+				"flat-cache": "^6.1.23"
 			}
 		},
 		"node_modules/file-uri-to-path": {
@@ -11737,17 +11660,15 @@
 			}
 		},
 		"node_modules/flat-cache": {
-			"version": "4.0.1",
-			"resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
-			"integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
+			"version": "6.1.23",
+			"resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-6.1.23.tgz",
+			"integrity": "sha512-f++BY9pTk+983xK1FLzlLpmM0i0z+jHmx3QESGkURMXujQZz1k5wzwX6hjnQ8goaD0B+sYnDK1yZ6MTyZfUaqA==",
 			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
-				"flatted": "^3.2.9",
-				"keyv": "^4.5.4"
-			},
-			"engines": {
-				"node": ">=16"
+				"cacheable": "^2.5.0",
+				"flatted": "^3.4.2",
+				"hookified": "^1.15.0"
 			}
 		},
 		"node_modules/flatted": {
@@ -11922,10 +11843,9 @@
 			}
 		},
 		"node_modules/fsevents": {
-			"version": "2.3.2",
-			"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
-			"integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-			"dev": true,
+			"version": "2.3.3",
+			"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+			"integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
 			"hasInstallScript": true,
 			"license": "MIT",
 			"optional": true,
@@ -12298,7 +12218,7 @@
 			"version": "1.5.1",
 			"resolved": "https://registry.npmjs.org/hashery/-/hashery-1.5.1.tgz",
 			"integrity": "sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
 				"hookified": "^1.15.0"
@@ -12420,7 +12340,7 @@
 			"version": "1.15.1",
 			"resolved": "https://registry.npmjs.org/hookified/-/hookified-1.15.1.tgz",
 			"integrity": "sha512-MvG/clsADq1GPM2KGo2nyfaWVyn9naPiXrqIe4jYjXNZQt238kWyOGrsyc/DmRAQ+Re6yeo6yX/yoNCG5KAEVg==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT"
 		},
 		"node_modules/hosted-git-info": {
@@ -13538,13 +13458,6 @@
 				"node": ">=6"
 			}
 		},
-		"node_modules/json-buffer": {
-			"version": "3.0.1",
-			"resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
-			"integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
-			"devOptional": true,
-			"license": "MIT"
-		},
 		"node_modules/json-parse-even-better-errors": {
 			"version": "2.3.1",
 			"resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz",
@@ -13580,13 +13493,13 @@
 			}
 		},
 		"node_modules/keyv": {
-			"version": "4.5.4",
-			"resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
-			"integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
+			"version": "5.6.0",
+			"resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz",
+			"integrity": "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==",
 			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
-				"json-buffer": "3.0.1"
+				"@keyv/serialize": "^1.1.1"
 			}
 		},
 		"node_modules/kind-of": {
@@ -14138,9 +14051,9 @@
 			}
 		},
 		"node_modules/marked": {
-			"version": "18.0.11",
-			"resolved": "https://registry.npmjs.org/marked/-/marked-18.0.11.tgz",
-			"integrity": "sha512-HnslJfsZkRPBDJRHvVtAaWlZHEpSu7u8LgQuJCELjRKuWR+hpq4A7sLq3p8HaI9ypVoXDXxV34CsQJEe1+J5Aw==",
+			"version": "18.0.12",
+			"resolved": "https://registry.npmjs.org/marked/-/marked-18.0.12.tgz",
+			"integrity": "sha512-LEm4ga2YeI2T3GVHj9b0BaDPPk93LLTHMFeMyQbNIzPxc8vCI0y/scy0ZA6z6lXKyT9j9Nhl/OC6ZYKYGuFScA==",
 			"license": "MIT",
 			"bin": {
 				"marked": "bin/marked.js"
@@ -16361,25 +16274,24 @@
 			}
 		},
 		"node_modules/pinia": {
-			"version": "2.1.7",
-			"resolved": "https://registry.npmjs.org/pinia/-/pinia-2.1.7.tgz",
-			"integrity": "sha512-+C2AHFtcFqjPih0zpYuvof37SFxMQ7OEG2zV9jRI12i9BOy3YQVAHwdKtyyc8pDcDyIc33WCIsZaCFWU7WWxGQ==",
+			"version": "4.0.3",
+			"resolved": "https://registry.npmjs.org/pinia/-/pinia-4.0.3.tgz",
+			"integrity": "sha512-XMQqpvjgG7LMqVhhFUzKLT4KEbsYbfZZ0CZU9PgdFm1O2VKBmIkykL8+SfNhOaT7sR0wT6BEgKT0YNDYWgmVRA==",
 			"license": "MIT",
 			"dependencies": {
-				"@vue/devtools-api": "^6.5.0",
-				"vue-demi": ">=0.14.5"
+				"nostics": "^1.1.4"
 			},
 			"funding": {
 				"url": "https://github.com/sponsors/posva"
 			},
 			"peerDependencies": {
-				"@vue/composition-api": "^1.4.0",
-				"typescript": ">=4.4.4",
-				"vue": "^2.6.14 || ^3.3.0"
+				"@vue/devtools-api": "^8.1.5",
+				"typescript": ">=5.6.0",
+				"vue": "^3.5.11"
 			},
 			"peerDependenciesMeta": {
-				"@vue/composition-api": {
-					"optional": true
+				"@vue/devtools-api": {
+					"optional": false
 				},
 				"typescript": {
 					"optional": true
@@ -16491,28 +16403,25 @@
 			}
 		},
 		"node_modules/playwright": {
-			"version": "1.62.1",
-			"resolved": "https://registry.npmjs.org/playwright/-/playwright-1.62.1.tgz",
-			"integrity": "sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg==",
+			"version": "1.63.0",
+			"resolved": "https://registry.npmjs.org/playwright/-/playwright-1.63.0.tgz",
+			"integrity": "sha512-+7ziBLidS4NaNCdt57SUDT+wYmmd5fmiQejUic/kb+YsYSCPyOOE9sebzMjNmQrsnNpDJqd4WHvV/8lfKfUDUg==",
 			"dev": true,
 			"license": "Apache-2.0",
 			"dependencies": {
-				"playwright-core": "1.62.1"
+				"playwright-core": "1.63.0"
 			},
 			"bin": {
 				"playwright": "cli.js"
 			},
 			"engines": {
 				"node": ">=20"
-			},
-			"optionalDependencies": {
-				"fsevents": "2.3.2"
 			}
 		},
 		"node_modules/playwright-core": {
-			"version": "1.62.1",
-			"resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.62.1.tgz",
-			"integrity": "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==",
+			"version": "1.63.0",
+			"resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.63.0.tgz",
+			"integrity": "sha512-rYCsBF/M5HjUch52bbtVONEFjv6Xu8sm8h72dNlR5bzIE1fvC/bxgspzkjSfU+MweEMmPM8KJebG6nnyxo5mCg==",
 			"dev": true,
 			"license": "Apache-2.0",
 			"bin": {
@@ -16534,9 +16443,9 @@
 			}
 		},
 		"node_modules/postcss": {
-			"version": "8.5.26",
-			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
-			"integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
+			"version": "8.5.28",
+			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.28.tgz",
+			"integrity": "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==",
 			"funding": [
 				{
 					"type": "opencollective",
@@ -16553,7 +16462,7 @@
 			],
 			"license": "MIT",
 			"dependencies": {
-				"nanoid": "^3.3.17",
+				"nanoid": "^3.3.18",
 				"picocolors": "^1.1.1",
 				"source-map-js": "^1.2.1"
 			},
@@ -17110,7 +17019,7 @@
 			"version": "0.10.1",
 			"resolved": "https://registry.npmjs.org/qified/-/qified-0.10.1.tgz",
 			"integrity": "sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
 				"hookified": "^2.1.1"
@@ -17123,7 +17032,7 @@
 			"version": "2.2.0",
 			"resolved": "https://registry.npmjs.org/hookified/-/hookified-2.2.0.tgz",
 			"integrity": "sha512-p/LgFzRN5FeoD3DLS6bkUapeye6E4SI6yJs6KetENd18S+FBthqYq2amJUWpt5z0EQwwHemidjY5OqJGEKm5uA==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT"
 		},
 		"node_modules/qs": {
@@ -17739,14 +17648,14 @@
 			"peer": true
 		},
 		"node_modules/rolldown": {
-			"version": "1.2.7",
-			"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.7.tgz",
-			"integrity": "sha512-g0EtLvBjTUB7jhyV0S/TCup3v/XSVl45vUIGbOGU4QPiyjTenCe4mKuFvW9fEgYmS2Fo42AUssRmNuMziXdrig==",
+			"version": "1.2.8",
+			"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.8.tgz",
+			"integrity": "sha512-Z67nTmhZe7anqnM/EjI392w5i/ANUinjip7QYsOyN37oayduxt3ksdX0hf5OOamkAd53BiIHfbfSzfUmzKFQqQ==",
 			"license": "MIT",
 			"optional": true,
 			"peer": true,
 			"dependencies": {
-				"@oxc-project/types": "=0.148.0",
+				"@oxc-project/types": "=0.149.0",
 				"@rolldown/pluginutils": "^1.0.0"
 			},
 			"bin": {
@@ -17756,21 +17665,21 @@
 				"node": "^20.19.0 || >=22.12.0"
 			},
 			"optionalDependencies": {
-				"@rolldown/binding-android-arm-eabi": "1.2.7",
-				"@rolldown/binding-android-arm64": "1.2.7",
-				"@rolldown/binding-darwin-arm64": "1.2.7",
-				"@rolldown/binding-darwin-x64": "1.2.7",
-				"@rolldown/binding-freebsd-x64": "1.2.7",
-				"@rolldown/binding-linux-arm-gnueabihf": "1.2.7",
-				"@rolldown/binding-linux-arm64-gnu": "1.2.7",
-				"@rolldown/binding-linux-arm64-musl": "1.2.7",
-				"@rolldown/binding-linux-ppc64-gnu": "1.2.7",
-				"@rolldown/binding-linux-s390x-gnu": "1.2.7",
-				"@rolldown/binding-linux-x64-gnu": "1.2.7",
-				"@rolldown/binding-linux-x64-musl": "1.2.7",
-				"@rolldown/binding-openharmony-arm64": "1.2.7",
-				"@rolldown/binding-win32-arm64-msvc": "1.2.7",
-				"@rolldown/binding-win32-x64-msvc": "1.2.7"
+				"@rolldown/binding-android-arm-eabi": "1.2.8",
+				"@rolldown/binding-android-arm64": "1.2.8",
+				"@rolldown/binding-darwin-arm64": "1.2.8",
+				"@rolldown/binding-darwin-x64": "1.2.8",
+				"@rolldown/binding-freebsd-x64": "1.2.8",
+				"@rolldown/binding-linux-arm-gnueabihf": "1.2.8",
+				"@rolldown/binding-linux-arm64-gnu": "1.2.8",
+				"@rolldown/binding-linux-arm64-musl": "1.2.8",
+				"@rolldown/binding-linux-ppc64-gnu": "1.2.8",
+				"@rolldown/binding-linux-s390x-gnu": "1.2.8",
+				"@rolldown/binding-linux-x64-gnu": "1.2.8",
+				"@rolldown/binding-linux-x64-musl": "1.2.8",
+				"@rolldown/binding-openharmony-arm64": "1.2.8",
+				"@rolldown/binding-win32-arm64-msvc": "1.2.8",
+				"@rolldown/binding-win32-x64-msvc": "1.2.8"
 			}
 		},
 		"node_modules/rollup": {
@@ -19103,9 +19012,9 @@
 			}
 		},
 		"node_modules/stylelint": {
-			"version": "17.14.1",
-			"resolved": "https://registry.npmjs.org/stylelint/-/stylelint-17.14.1.tgz",
-			"integrity": "sha512-xVQwyiuxALUBNB2fBe0tmNemg9KqLtdj3T64mioFDar79B2cU8LIyz+3KL6LdiHs9NkeNfwxpKSaIVOY8f112g==",
+			"version": "17.15.0",
+			"resolved": "https://registry.npmjs.org/stylelint/-/stylelint-17.15.0.tgz",
+			"integrity": "sha512-mWIkesYQvQjf4Kvdeu9ns0IL8/K/wtjaGxPqsPd6DlLZvaQxGysJsocxUDrBcyHQ5VleAk4uSMat4yMrVED7PA==",
 			"dev": true,
 			"funding": [
 				{
@@ -19119,14 +19028,14 @@
 			],
 			"license": "MIT",
 			"dependencies": {
-				"@csstools/css-calc": "^3.2.1",
+				"@csstools/css-calc": "^3.3.0",
 				"@csstools/css-parser-algorithms": "^4.0.0",
-				"@csstools/css-syntax-patches-for-csstree": "^1.1.6",
+				"@csstools/css-syntax-patches-for-csstree": "^1.1.9",
 				"@csstools/css-tokenizer": "^4.0.0",
 				"@csstools/media-query-list-parser": "^5.0.0",
-				"@csstools/selector-resolve-nested": "^4.0.0",
+				"@csstools/selector-resolve-nested": "^4.0.1",
 				"@csstools/selector-specificity": "^6.0.0",
-				"colord": "^2.9.3",
+				"colord": "^2.10.0",
 				"cosmiconfig": "^9.0.2",
 				"css-functions-list": "^3.3.3",
 				"css-tree": "^3.2.1",
@@ -19135,21 +19044,21 @@
 				"fastest-levenshtein": "^1.0.16",
 				"file-entry-cache": "^11.1.5",
 				"global-modules": "^2.0.0",
-				"globby": "^16.2.1",
+				"globby": "^16.2.4",
 				"globjoin": "^0.1.4",
 				"html-tags": "^5.1.0",
-				"ignore": "^7.0.5",
+				"ignore": "^7.0.6",
 				"import-meta-resolve": "^4.2.0",
 				"mathml-tag-names": "^4.0.0",
 				"meow": "^14.1.0",
 				"micromatch": "^4.0.8",
 				"normalize-path": "^3.0.0",
 				"picocolors": "^1.1.1",
-				"postcss": "^8.5.16",
+				"postcss": "^8.5.26",
 				"postcss-safe-parser": "^7.0.1",
-				"postcss-selector-parser": "^7.1.4",
+				"postcss-selector-parser": "^7.1.5",
 				"postcss-value-parser": "^4.2.0",
-				"string-width": "^8.2.1",
+				"string-width": "^8.2.2",
 				"supports-hyperlinks": "^4.5.0",
 				"svg-tags": "^1.0.0",
 				"table": "^6.9.0",
@@ -19330,28 +19239,6 @@
 				"@csstools/css-tokenizer": "^4.0.0"
 			}
 		},
-		"node_modules/stylelint/node_modules/file-entry-cache": {
-			"version": "11.1.5",
-			"resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-11.1.5.tgz",
-			"integrity": "sha512-+PFTHITI08JIGhnNpGNI8T8inUpgZfk3GNEqfT9R2zZV2iFXg3CvqzSl/uEhs7TSGujYRELEANyDvS8Fj7+S7Q==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"flat-cache": "^6.1.23"
-			}
-		},
-		"node_modules/stylelint/node_modules/flat-cache": {
-			"version": "6.1.23",
-			"resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-6.1.23.tgz",
-			"integrity": "sha512-f++BY9pTk+983xK1FLzlLpmM0i0z+jHmx3QESGkURMXujQZz1k5wzwX6hjnQ8goaD0B+sYnDK1yZ6MTyZfUaqA==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"cacheable": "^2.5.0",
-				"flatted": "^3.4.2",
-				"hookified": "^1.15.0"
-			}
-		},
 		"node_modules/stylelint/node_modules/ignore": {
 			"version": "7.0.6",
 			"resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.6.tgz",
@@ -20775,21 +20662,6 @@
 				}
 			}
 		},
-		"node_modules/vite/node_modules/fsevents": {
-			"version": "2.3.3",
-			"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-			"integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-			"dev": true,
-			"hasInstallScript": true,
-			"license": "MIT",
-			"optional": true,
-			"os": [
-				"darwin"
-			],
-			"engines": {
-				"node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-			}
-		},
 		"node_modules/vitest": {
 			"version": "4.1.11",
 			"resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.11.tgz",
@@ -21052,6 +20924,12 @@
 				"vue": "^3.5.0"
 			}
 		},
+		"node_modules/vue-router/node_modules/@vue/devtools-api": {
+			"version": "6.6.4",
+			"resolved": "https://registry.npmjs.org/@vue/devtools-api/-/devtools-api-6.6.4.tgz",
+			"integrity": "sha512-sGhTPMuXqZ1rVOk32RylztWkfXTRhuS7vgAKv0zjqk8gbsHkJ7xfFf+jbySxt7tWObEJwyKaHMikV/WGDiQm8g==",
+			"license": "MIT"
+		},
 		"node_modules/vue3-apexcharts": {
 			"version": "1.8.0",
 			"resolved": "https://registry.npmjs.org/vue3-apexcharts/-/vue3-apexcharts-1.8.0.tgz",
diff --git a/package.json b/package.json
index 17539eb4d..c826bcf9e 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,7 @@
 		"watch": "NODE_ENV=development webpack --config webpack.config.js --progress --watch",
 		"check:schema-l10n": "node scripts/check-schema-l10n.js",
 		"check:manifest": "node scripts/check-manifest.js",
+		"check:l10n-parity": "node tests/l10n/check-l10n-parity.js",
 		"lint": "eslint src tests scripts && npm run check:manifest && npm run lint:initial-state && npm run lint:translation-domain",
 		"lint:fix": "eslint src --fix",
 		"lint:initial-state": "node ./scripts/lint-initial-state.js",
@@ -34,7 +35,7 @@
 		"prepare": "git config core.hooksPath .githooks || true"
 	},
 	"dependencies": {
-		"@conduction/nextcloud-vue": "^2.37.0",
+		"@conduction/nextcloud-vue": "^2.46.0",
 		"@mdi/js": "^7.4.47",
 		"@nextcloud/axios": "^2.6.0",
 		"@nextcloud/dialogs": "^7.4.1",
@@ -43,10 +44,10 @@
 		"@nextcloud/router": "^3.1.0",
 		"@nextcloud/vue": "^9.11.0",
 		"dexie": "^4.4.5",
-		"dompurify": "^3.4.14",
+		"dompurify": "^3.4.15",
 		"gridstack": "^12.2.1",
-		"marked": "^18.0.3",
-		"pinia": "~2.1.7",
+		"marked": "^18.0.12",
+		"pinia": "^4.0.3",
 		"vue": "^3.5.42",
 		"vue-loader": "^17.4.2",
 		"vue-material-design-icons": "^5.2.0",
@@ -62,8 +63,8 @@
 		"@nextcloud/prettier-config": "^1.2.0",
 		"@nextcloud/stylelint-config": "^3.2.2",
 		"@nextcloud/webpack-vue-config": "^7.0.2",
-		"@playwright/test": "^1.59.1",
-		"@typescript-eslint/parser": "^8.69.0",
+		"@playwright/test": "^1.63.0",
+		"@typescript-eslint/parser": "^8.70.0",
 		"@vitejs/plugin-vue": "^6.0.8",
 		"@vitest/coverage-v8": "^4.1.11",
 		"@vitest/ui": "^4.1.11",
@@ -71,11 +72,11 @@
 		"@vue/server-renderer": "^3.5.42",
 		"@vue/test-utils": "^2.5.0",
 		"@vue/tsconfig": "^0.9.1",
-		"eslint": "^10.8.1",
+		"eslint": "^10.10.0",
 		"eslint-config-prettier": "^10.1.8",
 		"jsdom": "^30.0.1",
 		"prettier": "^3.9.6",
-		"stylelint": "^17.9.1",
+		"stylelint": "^17.15.0",
 		"terser-webpack-plugin": "^5.3.11",
 		"typescript": "^5.4.0",
 		"vitest": "^4.1.11",
diff --git a/phpunit-stubs.xml b/phpunit-stubs.xml
index 002b0b538..2bf421505 100644
--- a/phpunit-stubs.xml
+++ b/phpunit-stubs.xml
@@ -25,6 +25,16 @@
         </exclude>
     </source>
     <php>
+        <!--
+            Hard memory cap for every PHPUnit run. The CLI php.ini on developer
+            machines sets memory_limit=-1, so a runaway test has nothing to stop
+            it: on 2026-09-08 one openregister test recursed inside the DI
+            container and took 19 GB of RAM. The Unit suite of this app peaks at
+            123 MB without coverage; 2G leaves room for coverage runs and
+            still fails a leak within seconds. Raise it here, with the new
+            measurement, never with -d memory_limit on the command line.
+        -->
+        <ini name="memory_limit" value="2G"/>
         <env name="PHPUNIT_RUN" value="1"/>
     </php>
 </phpunit>
diff --git a/phpunit.xml b/phpunit.xml
index 26f9fe057..78a04de3b 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -25,6 +25,32 @@
         </exclude>
     </source>
     <php>
+        <!--
+            Hard memory cap for every PHPUnit run. The CLI php.ini on developer
+            machines sets memory_limit=-1, so a runaway test has nothing to stop
+            it: on 2026-09-08 one openregister test recursed inside the DI
+            container and took 19 GB of RAM. The Unit suite of this app peaks at
+            123 MB without coverage; 2G leaves room for coverage runs and
+            still fails a leak within seconds. Raise it here, with the new
+            measurement, never with -d memory_limit on the command line.
+        -->
+        <ini name="memory_limit" value="2G"/>
         <env name="PHPUNIT_RUN" value="1"/>
+        <!--
+            Boot the real Nextcloud WHEN THIS TREE SITS INSIDE AN INSTALLED ONE,
+            which is exactly CI's PHPUnit job (server/apps/launchpad inside a
+            server it installed with `occ maintenance:install`). Unset, that job
+            ran every test against OCP stubs, so a test that needs a real
+            database skipped there and could never fail. That is how #612
+            shipped: the importer never set created_at, every insert failed
+            with SQLSTATE 23502, and the mocked unit tests stayed green.
+
+            Outside an installed instance (a plain clone running
+            `composer check:strict`), tests/bootstrap.php refuses the full boot
+            on its own `installed` check, prints one line saying so, and falls
+            back to the stubs. Measured before enabling: the whole suite under
+            a full boot, on Nextcloud 34 with PostgreSQL, 1690 tests, exit 0.
+        -->
+        <env name="PHPUNIT_USE_NC_BOOTSTRAP" value="1"/>
     </php>
 </phpunit>
diff --git a/src/App.vue b/src/App.vue
index faaa7d11e..2edcce6bc 100644
--- a/src/App.vue
+++ b/src/App.vue
@@ -17,6 +17,7 @@
 		:manifest="liveManifest"
 		:registry="registry"
 		:pageTypes="pageTypes"
+		:permissions="permissions"
 		appId="launchpad" />
 </template>
 
@@ -114,6 +115,31 @@ export default {
 			type: Object,
 			required: true,
 		},
+
+		/**
+		 * The permission strings this account holds, built by
+		 * `utils/permissions.js` from the server's `isAdmin` answer and
+		 * forwarded to `CnAppNav`'s filter.
+		 *
+		 * 🔴 THIS PROP USED TO BE ABSENT, and its absence was the bug.
+		 * `manifest.menu` declares `permission: "admin"` on `admin-templates`
+		 * and `admin-settings`, and `CnAppNav.passesPermission` reads a missing
+		 * or empty list as "the app did not say" and renders the entry anyway:
+		 *
+		 *     if (!this.permissions || this.permissions.length === 0) return true
+		 *
+		 * So both admin entries rendered for every authenticated account and
+		 * the declaration did nothing. `currentPermissions()` never answers an
+		 * empty array, which is what keeps that escape from firing.
+		 *
+		 * `required: false` with a DENYING default rather than `required: true`:
+		 * a mount that forgets this prop should hide the gated entries, not
+		 * throw a dev-only warning in production and show them.
+		 */
+		permissions: {
+			type: Array,
+			default: () => ['user'],
+		},
 	},
 
 	computed: {
diff --git a/src/components/admin/DashboardExportImport.vue b/src/components/admin/DashboardExportImport.vue
index 51a33e983..fe7af234f 100644
--- a/src/components/admin/DashboardExportImport.vue
+++ b/src/components/admin/DashboardExportImport.vue
@@ -181,6 +181,18 @@ export default {
 				const data = err?.response?.data
 				if (data && Array.isArray(data.errors)) {
 					this.importResult = data
+				} else if (typeof data?.error === 'string' && data.error !== '') {
+					// Show the server's reason. It used to be swallowed in
+					// favour of "please try again", so an admin whose archive
+					// was refused for a nameable reason (no manifest.json, not
+					// a ZIP, a schema version this LaunchPad cannot read) was
+					// told only that something went wrong, and REQ-EXIM-009's
+					// "instruct the user to upgrade" could never reach them.
+					this.importError = this.t(
+						'launchpad',
+						'Import failed: {reason}',
+						{ reason: data.error },
+					)
 				} else {
 					this.importError = this.t(
 						'launchpad',
diff --git a/src/components/admin/DashboardRegistrySettings.vue b/src/components/admin/DashboardRegistrySettings.vue
new file mode 100644
index 000000000..867ee0b56
--- /dev/null
+++ b/src/components/admin/DashboardRegistrySettings.vue
@@ -0,0 +1,263 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+  - SPDX-License-Identifier: EUPL-1.2
+-->
+
+<template>
+	<div class="registry-settings" data-test="dashboard-registry-settings">
+		<h3>{{ t('launchpad', 'Dashboard registry') }}</h3>
+		<p class="registry-settings__hint">
+			{{
+				t(
+					'launchpad',
+					'Connect a registry to install dashboards that other organisations published.',
+				)
+			}}
+		</p>
+
+		<NcNoteCard
+			v-if="loaded && !available"
+			type="warning"
+			data-test="registry-engine-missing">
+			{{ t('launchpad', 'Enable OpenRegister so you can reach a registry.') }}
+		</NcNoteCard>
+
+		<form class="registry-settings__form" @submit.prevent="save">
+			<div class="registry-settings__field">
+				<NcTextField
+					v-model="registryUrl"
+					:label="t('launchpad', 'Registry URL')"
+					:helperText="
+						t(
+							'launchpad',
+							'Use the address of the instance that publishes the templates.',
+						)
+					"
+					type="url"
+					autocomplete="off"
+					:disabled="!loaded || saving"
+					data-test="registry-url" />
+			</div>
+
+			<div class="registry-settings__field">
+				<NcTextField
+					v-model="registryRegister"
+					:label="t('launchpad', 'Register')"
+					:helperText="t('launchpad', 'Leave empty to use launchpad.')"
+					autocomplete="off"
+					:disabled="!loaded || saving"
+					data-test="registry-register" />
+			</div>
+
+			<div class="registry-settings__field">
+				<!--
+				  The token field is WRITE-ONLY and always starts empty. The server
+				  never returns the token, only whether one is set, so there is
+				  nothing to pre-fill and nothing to leak. `new-password` stops
+				  the browser offering to autofill the administrator's own
+				  Nextcloud password into it.
+				-->
+				<NcPasswordField
+					v-model="tokenInput"
+					:label="t('launchpad', 'Access token')"
+					autocomplete="new-password"
+					:disabled="!loaded || saving"
+					data-test="registry-token" />
+				<p class="registry-settings__hint" data-test="registry-token-status">
+					{{
+						tokenConfigured
+							? t(
+									'launchpad',
+									'A token is set. Enter a new one to replace it.',
+								)
+							: t(
+									'launchpad',
+									'No token is set. Add one if the registry asks for it.',
+								)
+					}}
+				</p>
+			</div>
+
+			<div class="registry-settings__actions">
+				<NcButton
+					type="submit"
+					variant="primary"
+					:disabled="!loaded || saving"
+					data-test="registry-save">
+					{{ t('launchpad', 'Save registry') }}
+				</NcButton>
+				<NcButton
+					v-if="tokenConfigured"
+					variant="tertiary"
+					:disabled="!loaded || saving"
+					data-test="registry-remove-token"
+					@click="removeToken">
+					{{ t('launchpad', 'Remove token') }}
+				</NcButton>
+			</div>
+		</form>
+	</div>
+</template>
+
+<script>
+import {
+	NcButton,
+	NcNoteCard,
+	NcPasswordField,
+	NcTextField,
+} from '@conduction/nextcloud-vue'
+import { showError, showSuccess } from '@nextcloud/dialogs'
+import { t } from '@nextcloud/l10n'
+import { api } from '../../services/api.js'
+import { logger } from '../../utils/logger.js'
+
+/**
+ * DashboardRegistrySettings — Beheer ▸ Sharing section that connects
+ * LaunchPad to a dashboard registry (dashboard-store spec, REQ-STORE-009).
+ *
+ * The three values live in Nextcloud's app config under `launchpad`, which
+ * is where OpenRegister's store client reads them. LaunchPad's other admin
+ * settings live in a table of their own, so these have their own endpoint.
+ *
+ * 🔴 THE TOKEN IS WRITE-ONLY. The server answers `tokenConfigured` and never
+ * the token itself, and this component never sends the token back unless
+ * the administrator typed a new one. An empty token field on save means
+ * "leave it alone"; removing the token is its own explicit button, so a save
+ * that only changes the URL cannot wipe a token by accident.
+ */
+export default {
+	name: 'DashboardRegistrySettings',
+
+	components: {
+		NcButton,
+		NcNoteCard,
+		NcPasswordField,
+		NcTextField,
+	},
+
+	data() {
+		return {
+			registryUrl: '',
+			registryRegister: '',
+			tokenInput: '',
+			tokenConfigured: false,
+			available: true,
+			loaded: false,
+			saving: false,
+		}
+	},
+
+	/** @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-009-an-administrator-must-be-able-to-connect-a-registry-without-a-shell */
+	created() {
+		this.load()
+	},
+
+	methods: {
+		t,
+
+		/**
+		 * Read the redacted connection and fill the form from it.
+		 *
+		 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-009-an-administrator-must-be-able-to-connect-a-registry-without-a-shell
+		 * @return {Promise<void>}
+		 */
+		async load() {
+			try {
+				const { data } = await api.getStoreConfig()
+				this.apply(data)
+				this.available = data?.available !== false
+			} catch (error) {
+				logger.error('Failed to load the dashboard registry:', error)
+			} finally {
+				this.loaded = true
+			}
+		},
+
+		/**
+		 * Save the URL and register, and the token only when one was typed.
+		 *
+		 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-009-an-administrator-must-be-able-to-connect-a-registry-without-a-shell
+		 * @return {Promise<void>}
+		 */
+		async save() {
+			const payload = {
+				registryUrl: this.registryUrl.trim(),
+				registryRegister: this.registryRegister.trim(),
+			}
+			if (this.tokenInput !== '') {
+				payload.registryToken = this.tokenInput
+			}
+
+			await this.write(payload, t('launchpad', 'Registry saved.'))
+		},
+
+		/**
+		 * Clear the stored token, and nothing else.
+		 *
+		 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-009-an-administrator-must-be-able-to-connect-a-registry-without-a-shell
+		 * @return {Promise<void>}
+		 */
+		async removeToken() {
+			await this.write({ registryToken: '' }, t('launchpad', 'Token removed.'))
+		},
+
+		/**
+		 * Send one update and apply the redacted answer.
+		 *
+		 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-009-an-administrator-must-be-able-to-connect-a-registry-without-a-shell
+		 * @param {object} payload The keys to change.
+		 * @param {string} message The toast shown on success.
+		 * @return {Promise<void>}
+		 */
+		async write(payload, message) {
+			this.saving = true
+			try {
+				const { data } = await api.updateStoreConfig(payload)
+				this.apply(data)
+				showSuccess(message)
+			} catch (error) {
+				logger.error('Failed to save the dashboard registry:', error)
+				showError(t('launchpad', 'The registry could not be saved.'))
+			} finally {
+				this.saving = false
+			}
+		},
+
+		/**
+		 * Fill the form from a server answer. The token field is always
+		 * emptied: whatever was typed has been sent, and the server has
+		 * nothing to give back.
+		 *
+		 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-009-an-administrator-must-be-able-to-connect-a-registry-without-a-shell
+		 * @param {object} data The redacted connection.
+		 */
+		apply(data) {
+			this.registryUrl =
+				typeof data?.registryUrl === 'string' ? data.registryUrl : ''
+			this.registryRegister =
+				typeof data?.registryRegister === 'string'
+					? data.registryRegister
+					: ''
+			this.tokenConfigured = data?.tokenConfigured === true
+			this.tokenInput = ''
+		},
+	},
+}
+</script>
+
+<style scoped>
+.registry-settings__hint {
+	color: var(--color-text-maxcontrast);
+	margin-bottom: 16px;
+}
+
+.registry-settings__field {
+	margin-bottom: 16px;
+	max-width: 480px;
+}
+
+.registry-settings__actions {
+	display: flex;
+	gap: 8px;
+}
+</style>
diff --git a/src/components/admin/__tests__/DashboardExportImport.spec.js b/src/components/admin/__tests__/DashboardExportImport.spec.js
new file mode 100644
index 000000000..d3e0df90d
--- /dev/null
+++ b/src/components/admin/__tests__/DashboardExportImport.spec.js
@@ -0,0 +1,118 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * Vitest tests for `DashboardExportImport.vue`: what the admin is told when an
+ * import is refused (REQ-EXIM-008, REQ-EXIM-009).
+ *
+ * The server names the reason an archive was rejected: `manifest.json not found
+ * in archive`, `Uploaded file is not a valid ZIP archive`, or the schema-version
+ * message that tells the admin to upgrade LaunchPad. The component used to
+ * discard all of it and render "Import failed. Please try again.", so the one
+ * instruction REQ-EXIM-009 asks for could never reach the person who needed it.
+ */
+
+import { mount } from '@vue/test-utils'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@nextcloud/axios', () => ({
+	default: { get: vi.fn(), post: vi.fn(), put: vi.fn(), delete: vi.fn() },
+}))
+
+const importDashboards = vi.fn()
+vi.mock('../../../services/api.js', () => ({
+	api: {
+		exportDashboards: vi.fn(),
+		importDashboards: (...args) => importDashboards(...args),
+	},
+}))
+
+import DashboardExportImport from '../DashboardExportImport.vue'
+
+/** Mount the component with a file already chosen. */
+function mountWithFile() {
+	const wrapper = mount(DashboardExportImport, {
+		global: {
+			// The suite-wide `t` stub returns the key and drops the variables,
+			// which would hide whether the reason is interpolated at all.
+			mocks: {
+				t: (_app, source, vars) =>
+					source.replace(
+						/\{(\w+)\}/g,
+						(_m, key) => vars?.[key] ?? `{${key}}`,
+					),
+			},
+			stubs: {
+				NcButton: { template: '<button><slot /></button>' },
+				NcCheckboxRadioSwitch: { template: '<label><slot /></label>' },
+				Download: true,
+				Upload: true,
+			},
+		},
+	})
+	wrapper.vm.selectedFile = new File(['zip'], 'archive.zip')
+	return wrapper
+}
+
+/** An axios-shaped rejection carrying a response body. */
+function rejectionWith(data) {
+	return Object.assign(new Error('Request failed'), { response: { data } })
+}
+
+describe('DashboardExportImport — a refused import', () => {
+	beforeEach(() => {
+		importDashboards.mockReset()
+	})
+
+	it("shows the server's reason, so the admin learns what to fix", async () => {
+		importDashboards.mockRejectedValue(
+			rejectionWith({ error: 'manifest.json not found in archive' }),
+		)
+
+		const wrapper = mountWithFile()
+		await wrapper.vm.runImport()
+
+		expect(wrapper.vm.importError).toBe(
+			'Import failed: manifest.json not found in archive',
+		)
+		expect(wrapper.text()).toContain('manifest.json not found in archive')
+	})
+
+	it('passes the upgrade instruction through for a newer archive', async () => {
+		const reason =
+			'Unsupported manifest schema version: 2. Only version 1 is supported. '
+			+ 'Upgrade LaunchPad to import archives of version 2.'
+		importDashboards.mockRejectedValue(rejectionWith({ error: reason }))
+
+		const wrapper = mountWithFile()
+		await wrapper.vm.runImport()
+
+		expect(wrapper.text()).toContain('Upgrade LaunchPad')
+	})
+
+	it('falls back to the generic message when the server names no reason', async () => {
+		importDashboards.mockRejectedValue(rejectionWith(undefined))
+
+		const wrapper = mountWithFile()
+		await wrapper.vm.runImport()
+
+		expect(wrapper.vm.importError).toBe('Import failed. Please try again.')
+	})
+
+	it('still renders a per-dashboard error list rather than the banner', async () => {
+		// A 409 collision carries `errors`, which belongs in the result list.
+		importDashboards.mockRejectedValue(
+			rejectionWith({
+				importedDashboardCount: 0,
+				skippedDashboardCount: 0,
+				errors: [{ type: 'uuidCollision', message: 'Dashboard exists' }],
+			}),
+		)
+
+		const wrapper = mountWithFile()
+		await wrapper.vm.runImport()
+
+		expect(wrapper.vm.importError).toBe('')
+		expect(wrapper.vm.importResult.errors).toHaveLength(1)
+	})
+})
diff --git a/src/components/admin/__tests__/DashboardRegistrySettings.spec.js b/src/components/admin/__tests__/DashboardRegistrySettings.spec.js
new file mode 100644
index 000000000..94443c46a
--- /dev/null
+++ b/src/components/admin/__tests__/DashboardRegistrySettings.spec.js
@@ -0,0 +1,164 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * Vitest unit tests for `DashboardRegistrySettings.vue` (dashboard-store
+ * spec, REQ-STORE-009). These pin the token handling, which is the part a
+ * browser test cannot see go wrong: an e2e run can check that the field is
+ * empty, but not that a save without a typed token leaves the stored one
+ * alone. The server keeps an omitted key and clears an empty string, so
+ * sending `registryToken: ''` on every save would wipe the token silently.
+ *
+ * The `api` module is mocked at the import boundary, and the field stubs
+ * below bind `modelValue` so v-model round-trips through them.
+ */
+
+import { flushPromises, mount } from '@vue/test-utils'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import DashboardRegistrySettings from '../DashboardRegistrySettings.vue'
+import { api } from '../../../services/api.js'
+
+vi.mock('../../../services/api.js', () => ({
+	api: {
+		getStoreConfig: vi.fn(),
+		updateStoreConfig: vi.fn(),
+	},
+}))
+
+vi.mock('@nextcloud/dialogs', () => ({
+	showError: vi.fn(),
+	showSuccess: vi.fn(),
+}))
+
+/**
+ * A field stub that round-trips `v-model` through a real `<input>`.
+ *
+ * @param {string} name The component name it stands in for.
+ * @return {object} The stub component.
+ */
+function fieldStub(name) {
+	return {
+		name,
+		props: ['modelValue', 'label'],
+		emits: ['update:modelValue'],
+		template:
+			'<input :value="modelValue" @input="$emit(\'update:modelValue\', $event.target.value)" />',
+	}
+}
+
+const stubs = {
+	NcTextField: fieldStub('NcTextField'),
+	NcPasswordField: fieldStub('NcPasswordField'),
+	NcNoteCard: { name: 'NcNoteCard', template: '<div><slot /></div>' },
+	NcButton: {
+		name: 'NcButton',
+		props: ['type', 'variant', 'disabled'],
+		emits: ['click'],
+		template:
+			'<button type="button" @click="$emit(\'click\')"><slot /></button>',
+	},
+}
+
+const STORED = {
+	registryUrl: 'https://registry.example.org/',
+	registryRegister: 'launchpad',
+	tokenConfigured: true,
+	available: true,
+}
+
+/**
+ * Mount the component against a given server answer and let `load()` settle.
+ *
+ * @param {object} config The redacted connection `getStoreConfig` returns.
+ * @return {Promise<import('@vue/test-utils').VueWrapper>}
+ */
+async function mountWith(config) {
+	api.getStoreConfig.mockResolvedValue({ data: config })
+	const wrapper = mount(DashboardRegistrySettings, { global: { stubs } })
+	await flushPromises()
+	return wrapper
+}
+
+beforeEach(() => {
+	api.getStoreConfig.mockReset()
+	api.updateStoreConfig.mockReset().mockImplementation((payload) =>
+		Promise.resolve({
+			data: {
+				...STORED,
+				...('registryUrl' in payload
+					? { registryUrl: payload.registryUrl }
+					: {}),
+				tokenConfigured:
+					'registryToken' in payload ? payload.registryToken !== '' : true,
+			},
+		}),
+	)
+})
+
+describe('DashboardRegistrySettings', () => {
+	it('fills the URL and register but never the token', async () => {
+		const wrapper = await mountWith(STORED)
+
+		expect(wrapper.find('[data-test="registry-url"]').element.value).toBe(
+			STORED.registryUrl,
+		)
+		expect(wrapper.find('[data-test="registry-register"]').element.value).toBe(
+			'launchpad',
+		)
+		expect(wrapper.find('[data-test="registry-token"]').element.value).toBe('')
+		expect(wrapper.find('[data-test="registry-token-status"]').text()).toBe(
+			'A token is set. Enter a new one to replace it.',
+		)
+	})
+
+	it('leaves the stored token alone when the field is empty on save', async () => {
+		const wrapper = await mountWith(STORED)
+
+		await wrapper
+			.find('[data-test="registry-url"]')
+			.setValue('https://other.example.org/')
+		await wrapper.find('form').trigger('submit')
+		await flushPromises()
+
+		expect(api.updateStoreConfig).toHaveBeenCalledTimes(1)
+		const payload = api.updateStoreConfig.mock.calls[0][0]
+		expect(payload).not.toHaveProperty('registryToken')
+		expect(payload.registryUrl).toBe('https://other.example.org/')
+	})
+
+	it('sends a typed token once and then empties the field', async () => {
+		const wrapper = await mountWith({ ...STORED, tokenConfigured: false })
+
+		await wrapper.find('[data-test="registry-token"]').setValue('new-secret')
+		await wrapper.find('form').trigger('submit')
+		await flushPromises()
+
+		expect(api.updateStoreConfig.mock.calls[0][0].registryToken).toBe(
+			'new-secret',
+		)
+		expect(wrapper.find('[data-test="registry-token"]').element.value).toBe('')
+		expect(wrapper.find('[data-test="registry-token-status"]').text()).toBe(
+			'A token is set. Enter a new one to replace it.',
+		)
+	})
+
+	it('clears only the token when the administrator removes it', async () => {
+		const wrapper = await mountWith(STORED)
+
+		await wrapper.find('[data-test="registry-remove-token"]').trigger('click')
+		await flushPromises()
+
+		expect(api.updateStoreConfig).toHaveBeenCalledWith({ registryToken: '' })
+		expect(wrapper.find('[data-test="registry-remove-token"]').exists()).toBe(
+			false,
+		)
+	})
+
+	it('says so when OpenRegister is not available', async () => {
+		const wrapper = await mountWith({ ...STORED, available: false })
+
+		expect(wrapper.find('[data-test="registry-engine-missing"]').exists()).toBe(
+			true,
+		)
+	})
+})
diff --git a/src/components/admin/tabs/SharingTab.vue b/src/components/admin/tabs/SharingTab.vue
index f9c1131f1..30472493b 100644
--- a/src/components/admin/tabs/SharingTab.vue
+++ b/src/components/admin/tabs/SharingTab.vue
@@ -8,22 +8,28 @@
 		<DashboardSharingPolicy :groups="groups" />
 		<div class="sharing-tab__spacer" />
 		<GroupPriorityOrder :initialActive="configuredGroups" />
+		<div class="sharing-tab__spacer" />
+		<DashboardRegistrySettings />
 	</div>
 </template>
 
 <script>
+import DashboardRegistrySettings from '../DashboardRegistrySettings.vue'
 import DashboardSharingPolicy from '../DashboardSharingPolicy.vue'
 import GroupPriorityOrder from '../GroupPriorityOrder.vue'
 
 /**
  * SharingTab — Beheer ▸ Sharing tab (dashboard-sharing spec). Hosts the
  * org-wide sharing defaults plus the relocated `GroupPriorityOrder` editor
- * (group resolution order is a sharing concern).
+ * (group resolution order is a sharing concern), and the dashboard registry
+ * connection, which is how dashboards are shared ACROSS instances
+ * (dashboard-store spec).
  */
 export default {
 	name: 'SharingTab',
 
 	components: {
+		DashboardRegistrySettings,
 		DashboardSharingPolicy,
 		GroupPriorityOrder,
 	},
diff --git a/src/constants/__tests__/widgetRegistry.completeness.spec.js b/src/constants/__tests__/widgetRegistry.completeness.spec.js
index 59892937a..007d89986 100644
--- a/src/constants/__tests__/widgetRegistry.completeness.spec.js
+++ b/src/constants/__tests__/widgetRegistry.completeness.spec.js
@@ -26,50 +26,22 @@
  */
 
 import { beforeEach, describe, expect, it } from 'vitest'
+import widgetTypes from '../../../lib/widget-types.json'
 
 beforeEach(() => {
 	globalThis.t = (_app, key) => key
 })
 
-// Canonical widget type set. Sorted alphabetically. Update in lockstep
-// with `src/constants/widgetRegistry.js` whenever a widget capability is
-// added or removed -- the tests below will fail with a precise diff if
-// this constant drifts out of sync with the registry.
-const EXPECTED_TYPES = [
-	'calendar',
-	'clock',
-	'container',
-	'divider',
-	'files',
-	'header',
-	'iframe',
-	'image',
-	'label',
-	'link',
-	'links',
-	'livetile',
-	'menu',
-	'nc-widget',
-	'news',
-	'people',
-	'quicklinks',
-	// tile-quick-search: the quick-search bar became a placeable widget
-	// rather than runtime-shell chrome (REQ-QSEARCH-001).
-	'search',
-	'spend-analytics',
-	'text',
-	'tile',
-	'video',
-	'weather',
-	// Analytics widgets (OpenBuild parity) — OpenRegister-data-driven.
-	'stat',
-	'delta',
-	'gauge',
-	'object-list',
-	'chart',
-	'stats-block',
-	'table',
-]
+// Canonical widget type set, read from `lib/widget-types.json` rather than
+// written out here. That file is the ONE list both sides consult: this spec
+// asserts the frontend registry equals it, and
+// `DemoShowcasesService::partitionWidgets()` keeps a showcase widget whose type
+// is on it. While the list lived only in this file the PHP side could not see
+// it, and the case-handler showcase installed with none of its four widgets
+// (`object-list`, `nc-widget`, `calendar`) because the server knew only tiles
+// and Nextcloud dashboard ids. Add or remove a type in the registry AND the
+// JSON in the same commit; the tests below fail with a precise diff otherwise.
+const EXPECTED_TYPES = widgetTypes.types
 
 describe('widgetRegistry completeness (REQ-WDG-023)', () => {
 	it('registry keys MUST equal EXPECTED_TYPES (set equality)', async () => {
@@ -89,7 +61,7 @@ describe('widgetRegistry completeness (REQ-WDG-023)', () => {
 		if (unexpectedInRegistry.length) {
 			diagnostic.push(
 				`DRIFT: widgetRegistry contains type(s) not in EXPECTED_TYPES: ${JSON.stringify(unexpectedInRegistry)}. `
-					+ 'Update EXPECTED_TYPES in widgetRegistry.completeness.spec.js',
+					+ 'Add them to lib/widget-types.json, which the showcase installer reads too',
 			)
 		}
 
diff --git a/src/main.js b/src/main.js
index 90adbea0a..719f13398 100644
--- a/src/main.js
+++ b/src/main.js
@@ -50,7 +50,9 @@ import bundledStub from './manifest.json'
 import registry from './registry.js'
 import { loadInitialState } from './utils/loadInitialState.js'
 import { logger } from './utils/logger.js'
+import { permissionGuard, routesFromManifest } from './utils/manifestRoutes.js'
 import { mergeManifestFragments } from './utils/mergeManifestFragments.js'
+import { currentPermissions } from './utils/permissions.js'
 
 import './publicPath.js'
 import './services/widgetBridge.js'
@@ -183,33 +185,23 @@ function routerBase() {
 	return match ? match[1] : generateUrl('/apps/launchpad')
 }
 
-/**
- * Build the vue-router config from the manifest. Each declared page becomes one
- * route, named for its `id`, so a page cannot be declared without being served.
- *
- * @param {object} manifest The merged manifest.
- * @return {Array<object>} vue-router 4 routes.
- */
-function routesFromManifest(manifest) {
-	const routes = (manifest.pages ?? []).map((page) => ({
-		name: page.id,
-		path: page.route,
-		component: RoutePageRenderer,
-		props: page.route.includes(':'),
-	}))
-
-	// ⚠️ vue-router 4 REMOVED the bare `path: '*'` wildcard, and does not warn:
-	// the route simply never matches, so an unknown URL renders the shell with
-	// an empty content area. The named-param form is the v4 spelling.
-	routes.push({ path: '/:pathMatch(.*)*', redirect: '/' })
-	return routes
-}
+// The permissions this account holds, from the server's own answer rather than
+// from `window`. `initialState.isAdmin` is pushed by `PageController` and
+// defaults to `false`, so a server that has not deployed the key yet denies
+// rather than permits. One list, read by BOTH surfaces: the nav filter in
+// `App.vue` and the route guard below. They used to disagree because the nav
+// had no list at all.
+const permissions = currentPermissions(initialState.isAdmin)
 
 const router = createRouter({
 	history: createWebHistory(routerBase()),
-	routes: routesFromManifest(mergedManifest),
+	routes: routesFromManifest(mergedManifest, RoutePageRenderer),
 })
 
+// The route half of `permission`. Without it, hiding the nav entry is the whole
+// gate and a typed URL walks straight past it.
+router.beforeEach((to) => permissionGuard(to, permissions))
+
 // Shallow copies: the library exports `defaultPageTypes` and the registry as
 // FROZEN module objects in some bundle shapes, and the renderer may attach
 // bookkeeping to what it is handed.
@@ -223,6 +215,7 @@ const app = createApp({
 			manifest: mergedManifest,
 			registry: registryProp,
 			pageTypes: pageTypesProp,
+			permissions,
 		}),
 })
 
diff --git a/src/manifest.json b/src/manifest.json
index 68cc24561..1a120bf9a 100644
--- a/src/manifest.json
+++ b/src/manifest.json
@@ -85,14 +85,6 @@
       }
     ]
   },
-  "store": {
-    "_note": "Configuration exchange, not rows. A configuration set carries the registers, schemas, objects, views, flows, sources and mappings that make one way of working hold together. There is deliberately NO `installable` allowlist: a set exists to introduce schemas the instance does not have YET, so listing schemas this app already owns would refuse exactly the sets worth installing. The trust boundary for a bundle is its publisher, enforced by the engine's source allowlist and trusted-key check. ⚠️ An EMPTY `installable` means install NOTHING, not install anything — omitting the key and declaring an empty list are different things.",
-    "types": [
-      "openregister.configset",
-      "openregister.flows"
-    ],
-    "localRegister": "launchpad"
-  },
   "menu": [
     {
       "id": "dashboards",
@@ -105,7 +97,7 @@
       "id": "admin-templates",
       "label": "Templates",
       "icon": "FileReplaceOutline",
-      "route": "/admin/templates",
+      "route": "admin-templates-index",
       "section": "settings",
       "permission": "admin"
     },
@@ -113,7 +105,7 @@
       "id": "admin-settings",
       "label": "Admin settings",
       "icon": "CogOutline",
-      "route": "/admin/settings",
+      "route": "admin-settings",
       "section": "settings",
       "permission": "admin"
     },
@@ -175,9 +167,9 @@
       "config": {
         "app": "launchpad",
         "title": "Store",
-        "description": "Install dashboard configurations that other organisations have published: a set of tiles, a layout, or the flows behind them."
+        "description": "Install a dashboard another organisation published. Point LaunchPad at a registry and browse what it offers."
       },
-      "_note": "ADR-114 Decision 4 / ADR-080. Declarative: openregister hosts the store plane, so this app writes NO store controller. With no registry configured the page renders the app's built-in items and makes NO network call."
+      "_note": "ADR-080. Discovery is engine-owned: openregister's GenericStoreService owns the SSRF guard, the redirect refusal and the Bearer-only token. Install is LaunchPad's, in Controller\\StoreController, and runs through the existing ImportService. With no registry configured the page makes NO network call and reports not_configured. There is deliberately NO top-level `store` block: it configures the engine's GenericStoreController, which cannot write a LaunchPad dashboard, so the engine alias yields to the leaf controller. The block this replaced declared `openregister.configset` types, which would have offered configuration sets to somebody looking for a dashboard."
     },
     {
       "id": "dashboard-detail",
@@ -197,6 +189,7 @@
       "type": "custom",
       "title": "Templates",
       "component": "AdminSettingsRedirect",
+      "permission": "admin",
       "_note": "REDIRECTS to /settings/admin/launchpad. TemplatesPage is a TAB inside the Nextcloud admin section, not a page of its own; routing it in-app would render half an admin surface next to the real one.",
       "config": {
         "documentationUrl": "https://launchpad.conduction.nl"
@@ -208,6 +201,7 @@
       "type": "custom",
       "title": "Admin settings",
       "component": "AdminSettingsRedirect",
+      "permission": "admin",
       "_note": "REDIRECTS to /settings/admin/launchpad. The admin surface is a Nextcloud settings section (lib/Settings/LaunchPadAdmin.php, mounted by src/admin.js), not an in-app page — the component this once named, AdminSettingsPage, has never existed. The route resolves so the menu entry is not a dead link, and lands where the functionality is."
     },
     {
diff --git a/src/modals/TileEditor.vue b/src/modals/TileEditor.vue
index 118f8e6d0..f7c6740d5 100644
--- a/src/modals/TileEditor.vue
+++ b/src/modals/TileEditor.vue
@@ -328,7 +328,7 @@ export default {
 	methods: {
 		/**
 		 * Store the picked icon. CnIconBrowser emits an SVG path (MDI) or a URL
-		 * (NlDesign/upload); derive iconType from the value so TileWidget renders
+		 * (Thematiq/upload); derive iconType from the value so TileWidget renders
 		 * the right element. `isCustomIconUrl` is the REQ-ICON-005 URL/name
 		 * discriminator — `iconType` is derived from it rather than guessed,
 		 * so a picked value and its stored type can never disagree.
diff --git a/src/modals/__tests__/TileEditor.spec.js b/src/modals/__tests__/TileEditor.spec.js
index 8e58a4126..e93556836 100644
--- a/src/modals/__tests__/TileEditor.spec.js
+++ b/src/modals/__tests__/TileEditor.spec.js
@@ -55,7 +55,7 @@ describe('TileEditor legacy-icon display', () => {
 	})
 
 	it('passes a custom icon URL through unchanged', () => {
-		const url = '/apps/nldesign/img/icons/Star.svg'
+		const url = '/apps/thematiq/img/icons/Star.svg'
 		const wrapper = mountEditor({
 			id: 4,
 			title: 'Url',
@@ -87,8 +87,8 @@ describe('TileEditor onIcon / isUrlIcon', () => {
 
 	it('onIcon stores a custom URL as iconType "url"', () => {
 		const wrapper = mountEditor({ id: 2, title: 'X', icon: '', iconType: 'svg' })
-		wrapper.vm.onIcon('/apps/nldesign/img/icons/Star.svg')
-		expect(wrapper.vm.form.icon).toBe('/apps/nldesign/img/icons/Star.svg')
+		wrapper.vm.onIcon('/apps/thematiq/img/icons/Star.svg')
+		expect(wrapper.vm.form.icon).toBe('/apps/thematiq/img/icons/Star.svg')
 		expect(wrapper.vm.form.iconType).toBe('url')
 	})
 
diff --git a/src/services/__tests__/graphqlClient.spec.js b/src/services/__tests__/graphqlClient.spec.js
index 941d908b8..181655ed6 100644
--- a/src/services/__tests__/graphqlClient.spec.js
+++ b/src/services/__tests__/graphqlClient.spec.js
@@ -55,11 +55,11 @@ describe('graphqlClient (REQ-SAW-004 / REQ-SAW-005)', () => {
 	it('maps a 404 to a not_installed GraphQLSourceError', async () => {
 		axios.post.mockRejectedValue({ response: { status: 404 } })
 		await expect(
-			queryGraphql({ app: 'procest', query: 'q' }),
+			queryGraphql({ app: 'dossiq', query: 'q' }),
 		).rejects.toMatchObject({
 			name: 'GraphQLSourceError',
 			code: 'not_installed',
-			app: 'procest',
+			app: 'dossiq',
 		})
 	})
 
diff --git a/src/services/__tests__/spendAnalytics.spec.js b/src/services/__tests__/spendAnalytics.spec.js
index ef63838a7..d06c525f9 100644
--- a/src/services/__tests__/spendAnalytics.spec.js
+++ b/src/services/__tests__/spendAnalytics.spec.js
@@ -129,6 +129,11 @@ describe('spendAnalytics data layer', () => {
 		const result = await fetchSpendNarrative({ summary: { total: 100 } })
 		expect(result).toEqual({ available: true, narrative: 'Spend is up 12%.' })
 		const [url, body] = axios.post.mock.calls[0]
+		// @stale-fleet-app-id exclude this pins the path the caller deliberately
+		// leaves stale. integriq publishes no `/api/sources/{source}/call` under
+		// either name (re-verified 2026-09-10 by git log -S over its full history),
+		// so the assertion moves in the same change that gives REQ-SAW-006 a real
+		// integriq endpoint to call. See fetchSpendNarrative in spendAnalytics.js.
 		expect(url).toContain('/apps/openconnector/')
 		expect(url).not.toContain('11434')
 		// Conduction local-LLM defaults.
@@ -146,8 +151,8 @@ describe('spendAnalytics data layer', () => {
 		expect(resolveDeepLink('financeq', 'transaction', 'tx-1')).toBe(
 			'/apps/financeq/transaction/tx-1',
 		)
-		expect(resolveDeepLink('procest', 'vendor', 'acme')).toBe(
-			'/apps/procest/vendor/acme',
+		expect(resolveDeepLink('dossiq', 'vendor', 'acme')).toBe(
+			'/apps/dossiq/vendor/acme',
 		)
 	})
 })
diff --git a/src/services/api.js b/src/services/api.js
index b80cff275..1c655ffc9 100644
--- a/src/services/api.js
+++ b/src/services/api.js
@@ -685,6 +685,33 @@ export const api = {
 		return axios.get(`${baseUrl}/api/admin/settings`)
 	},
 
+	/**
+	 * Read the dashboard registry connection. Admin-only on the server.
+	 *
+	 * The response never carries the token, only `tokenConfigured`.
+	 *
+	 * @return {Promise} Axios response resolving to
+	 *   `{ registryUrl, registryRegister, tokenConfigured, available }`.
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-009-an-administrator-must-be-able-to-connect-a-registry-without-a-shell
+	 */
+	getStoreConfig() {
+		return axios.get(`${baseUrl}/api/store/config`)
+	},
+
+	/**
+	 * Write the dashboard registry connection. Admin-only on the server.
+	 *
+	 * Omit a key to leave it unchanged. Send `registryToken: ''` to clear the
+	 * token; any other string replaces it.
+	 *
+	 * @param {object} data Any of `registryUrl`, `registryRegister`, `registryToken`.
+	 * @return {Promise} Axios response resolving to the redacted connection.
+	 * @spec openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#requirement-req-store-009-an-administrator-must-be-able-to-connect-a-registry-without-a-shell
+	 */
+	updateStoreConfig(data) {
+		return axios.put(`${baseUrl}/api/store/config`, data)
+	},
+
 	/**
 	 * Persist changed instance-wide admin settings.
 	 *
diff --git a/src/services/graphqlClient.js b/src/services/graphqlClient.js
index 8bbc06220..73d58790a 100644
--- a/src/services/graphqlClient.js
+++ b/src/services/graphqlClient.js
@@ -62,7 +62,7 @@ export class GraphQLSourceError extends Error {
 /**
  * Resolve a sibling app id to its OR-mounted GraphQL endpoint URL.
  *
- * @param {string} app the sibling app id (e.g. `financeq`, `procest`)
+ * @param {string} app the sibling app id (e.g. `financeq`, `dossiq`)
  * @return {string} the absolute Nextcloud route for the app's `/graphql`
  */
 function resolveGraphqlUrl(app) {
diff --git a/src/services/spendAnalytics.js b/src/services/spendAnalytics.js
index 52c80f9a6..dad6511b4 100644
--- a/src/services/spendAnalytics.js
+++ b/src/services/spendAnalytics.js
@@ -23,7 +23,22 @@ import axios from '@nextcloud/axios'
 import { generateUrl } from '@nextcloud/router'
 import { GraphQLSourceError, queryGraphql } from './graphqlClient.js'
 
-/** Sibling app ids this widget reads from (REQ-SAW-004). */
+/**
+ * Sibling app ids this widget reads from (REQ-SAW-004).
+ *
+ * NOT REPOINTED, DELIBERATELY (2026-09-09). `procest` is a retired app id and
+ * its successor is `dossiq`, but renaming it here would look like a fix and be
+ * none: both ids feed `queryGraphql()`, which builds `/apps/<app>/graphql`, and
+ * that route is published by NO fleet app under either name. Read off dossiq
+ * `development`: `appinfo/routes.php` has no `graphql` entry at all. OpenRegister
+ * serves GraphQL at `/apps/openregister/api/graphql`, so the endpoint this module
+ * needs is OR's, not the sibling's, and `resolveGraphqlUrl()` is what has to
+ * change. `financeq` is not a fleet app at all.
+ *
+ * Fix the endpoint first; the id then follows in the same change, resolved
+ * through `OC.appswebroots` rather than hardcoded, so an instance on either
+ * release keeps working.
+ */
 export const SPEND_SOURCES = Object.freeze({
 	FINANCE: 'financeq',
 	PROCEST: 'procest',
@@ -215,6 +230,29 @@ export const LLM_SOURCE_ALIAS = 'local-llm'
  * @spec openspec/specs/launchpad-spend-analytics-widget/spec.md
  */
 export async function fetchSpendNarrative({ summary, timeoutMs = 5000 }) {
+	// NOT REPOINTED, DELIBERATELY (2026-09-09). `openconnector` is retired and
+	// its successor is `integriq`, but `/api/sources/{source}/call` is not a
+	// route integriq publishes, and `git log -S` over openconnector's full
+	// history finds it was never added under the old name either. Integriq's
+	// SourcesController exposes only `test`, `logs` and the two circuit-breaker
+	// actions, and the app has no LLM/inference endpoint at all: no `local-llm`,
+	// no Ollama reference anywhere in the repo.
+	//
+	// Renaming the segment would turn one 404 into another while the diff read
+	// as a fix, and would hide the real gap: REQ-SAW-006 depends on a connector
+	// surface that does not exist. The nearest published thing is
+	// `POST /api/datasource/{sourceId}/resolve`, a read-only dashboard value
+	// resolver that dispatches a GET, which is not an inference call. This needs
+	// an integriq-side endpoint before the name here means anything.
+	//
+	// @stale-fleet-app-id exclude the route exists under NEITHER name. Re-verified
+	// 2026-09-10 against integriq `development`: SourcesController publishes only
+	// test, logs, tripCircuitBreaker and resetCircuitBreaker, and
+	// `git log -S "sources/{source}/call"` and `git log -S "sources#call"` over its
+	// full 3,960-commit history, which spans the whole openconnector era, both
+	// return nothing. The app has no inference endpoint at all. REQ-SAW-006 waits
+	// on an integriq surface that has never been built, so repointing the segment
+	// would turn one 404 into another while hiding that gap.
 	const url = generateUrl('/apps/openconnector/api/sources/{source}/call', {
 		source: LLM_SOURCE_ALIAS,
 	})
diff --git a/src/utils/__tests__/permissions.spec.js b/src/utils/__tests__/permissions.spec.js
new file mode 100644
index 000000000..41ca55c43
--- /dev/null
+++ b/src/utils/__tests__/permissions.spec.js
@@ -0,0 +1,256 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * Guards for the manifest `permission` field: the nav list, the route table
+ * that carries it, and the guard that denies on it.
+ *
+ * WHAT THESE TESTS ARE FOR, and what they cannot do.
+ * -------------------------------------------------
+ * Every assertion below is on the DENIED case, because a permission test that
+ * only asserts the permitted case passes against a broken gate. And each
+ * denial is asserted in two parts wherever emptiness could substitute for a
+ * decision: a list that omits `admin` is only a gate if it is ALSO non-empty,
+ * since `CnAppNav.passesPermission` renders every entry when handed `[]`.
+ *
+ * `vitest.config.js` redirects `@conduction/nextcloud-vue` to a stub for EVERY
+ * spec in this suite, so no unit test here can mount the real `CnAppNav` and
+ * none of these prove the library filters anything. They prove the list this
+ * app hands it cannot trip the library's empty-list escape, and they prove the
+ * route guard denies. The library integration is proved by
+ * `tests/e2e/admin-menu-permissions.spec.ts`, against a real non-admin
+ * session and the real bundle.
+ */
+
+import { describe, expect, it } from 'vitest'
+import manifest from '../../manifest.json'
+import { permissionGuard, routesFromManifest } from '../manifestRoutes.js'
+import { currentPermissions, permits } from '../permissions.js'
+
+/**
+ * `CnAppNav.passesPermission`, copied verbatim from
+ * `@conduction/nextcloud-vue` (`src/components/CnAppNav/CnAppNav.vue:1061`).
+ *
+ * Copied rather than imported because the library is stubbed in this suite.
+ * It is here to pin ONE property: that the list this app supplies never hits
+ * the middle line, which is the line that made the declaration inert.
+ *
+ * @param {object}        item        A manifest menu entry.
+ * @param {Array<string>} permissions The permissions held.
+ *
+ * @return {boolean} Whether the library would render the entry.
+ */
+function libraryPassesPermission(item, permissions) {
+	if (!item.permission) return true
+	if (!permissions || permissions.length === 0) return true
+	return permissions.includes(item.permission)
+}
+
+const COMPONENT = { name: 'StubPage' }
+
+describe('currentPermissions', () => {
+	it('DENIES admin to a non-admin, and answers a NON-EMPTY list while doing it', () => {
+		const held = currentPermissions(false)
+
+		expect(held).not.toContain('admin')
+		// The second half is the whole test. `[]` also fails `toContain`, and
+		// `[]` is exactly the value that made CnAppNav render everything.
+		expect(held.length, 'an empty list fails OPEN in CnAppNav').toBeGreaterThan(
+			0,
+		)
+	})
+
+	it('grants admin to an admin', () => {
+		expect(currentPermissions(true)).toContain('admin')
+	})
+
+	it.each([
+		['undefined', undefined],
+		['null', null],
+		['the string "true"', 'true'],
+		['1', 1],
+		['an empty object', {}],
+	])('fails CLOSED on %s rather than coercing it to admin', (_label, value) => {
+		const held = currentPermissions(value)
+
+		expect(held).not.toContain('admin')
+		expect(held.length).toBeGreaterThan(0)
+	})
+})
+
+describe('permits', () => {
+	it('DENIES a required permission the account does not hold', () => {
+		expect(permits('admin', ['user'])).toBe(false)
+	})
+
+	it('DENIES on an empty list rather than failing open like the nav rule does', () => {
+		// This is the one line where this function deliberately disagrees with
+		// CnAppNav. On a nav entry an empty list is a visibility bug; on a
+		// route it would be the entire gate.
+		expect(permits('admin', [])).toBe(false)
+		expect(libraryPassesPermission({ permission: 'admin' }, [])).toBe(true)
+	})
+
+	it.each([
+		['undefined', undefined],
+		['null', null],
+		['a string', 'admin'],
+		['an object', { admin: true }],
+	])('DENIES when the permission list is %s', (_label, value) => {
+		expect(permits('admin', value)).toBe(false)
+	})
+
+	it('allows anything that declares no permission', () => {
+		expect(permits('', ['user'])).toBe(true)
+		expect(permits(undefined, ['user'])).toBe(true)
+	})
+
+	it('allows a permission the account holds', () => {
+		expect(permits('admin', ['user', 'admin'])).toBe(true)
+	})
+})
+
+describe('routesFromManifest', () => {
+	it('carries a declared page permission onto the route as meta.permission', () => {
+		const routes = routesFromManifest(
+			{ pages: [{ id: 'p', route: '/admin/x', permission: 'admin' }] },
+			COMPONENT,
+		)
+
+		expect(routes[0].meta.permission).toBe('admin')
+	})
+
+	it('leaves an undeclared page open rather than defaulting it to undefined', () => {
+		const routes = routesFromManifest(
+			{ pages: [{ id: 'p', route: '/x' }] },
+			COMPONENT,
+		)
+
+		expect(routes[0].meta.permission).toBe('')
+	})
+
+	it('still appends the vue-router 4 catch-all', () => {
+		const routes = routesFromManifest({ pages: [] }, COMPONENT)
+
+		expect(routes.at(-1)).toEqual({
+			path: '/:pathMatch(.*)*',
+			redirect: '/',
+		})
+	})
+})
+
+describe('permissionGuard', () => {
+	const nonAdmin = currentPermissions(false)
+	const admin = currentPermissions(true)
+
+	it('REDIRECTS a non-admin away from an admin route', () => {
+		const verdict = permissionGuard(
+			{ path: '/admin/settings', meta: { permission: 'admin' } },
+			nonAdmin,
+		)
+
+		expect(verdict).toEqual({ path: '/' })
+	})
+
+	it('lets an admin through the same route', () => {
+		expect(
+			permissionGuard(
+				{ path: '/admin/settings', meta: { permission: 'admin' } },
+				admin,
+			),
+		).toBe(true)
+	})
+
+	it('lets a non-admin through a route that declares nothing', () => {
+		expect(
+			permissionGuard({ path: '/', meta: { permission: '' } }, nonAdmin),
+		).toBe(true)
+	})
+
+	it('DENIES a gated route when the guard is handed no list at all', () => {
+		expect(
+			permissionGuard({
+				path: '/admin/settings',
+				meta: { permission: 'admin' },
+			}),
+		).toEqual({ path: '/' })
+	})
+})
+
+describe('the shipped manifest, gated as a non-admin', () => {
+	const nonAdmin = currentPermissions(false)
+	const pageById = new Map((manifest.pages ?? []).map((page) => [page.id, page]))
+
+	it('hides every gated MENU entry from a non-admin', () => {
+		const gated = (manifest.menu ?? []).filter((item) => item.permission)
+
+		// Guard the guard: if nothing declares a permission any more, this
+		// whole describe block is vacuous and must say so out loud.
+		expect(gated.length, 'no menu entry declares a permission').toBeGreaterThan(
+			0,
+		)
+
+		for (const item of gated) {
+			expect(
+				libraryPassesPermission(item, nonAdmin),
+				`menu entry "${item.id}" renders for a non-admin`,
+			).toBe(false)
+		}
+	})
+
+	it('redirects a non-admin off every gated ROUTE', () => {
+		const routes = routesFromManifest(manifest, COMPONENT)
+		const gated = routes.filter((r) => r.meta?.permission)
+
+		expect(gated.length, 'no page declares a permission').toBeGreaterThan(0)
+
+		for (const route of gated) {
+			expect(
+				permissionGuard(route, nonAdmin),
+				`route "${route.path}" is reachable by a non-admin`,
+			).toEqual({ path: '/' })
+		}
+	})
+
+	it('gates the PAGE wherever it gates the MENU ENTRY', () => {
+		// The invariant that catches the second door. Dossiq shipped four admin
+		// surfaces reachable by URL because three of them had a gated menu
+		// entry and a page that declared nothing — and the working nav half is
+		// what hid it, since everyone checks visibility through the menu.
+		for (const item of manifest.menu ?? []) {
+			if (!item.permission) {
+				continue
+			}
+			const page = pageById.get(item.route)
+			expect(page, `menu entry "${item.id}" routes nowhere`).toBeDefined()
+			expect(
+				page.permission,
+				`menu entry "${item.id}" is gated on "${item.permission}" but its page is not`,
+			).toBe(item.permission)
+		}
+	})
+
+	it('names a page that EXISTS, on every menu entry that routes at all', () => {
+		// 🔴 A SECOND DEFECT, found while proving the first. `CnAppNav.itemTo`
+		// builds `{ name: item.route }` — `route` is a route NAME, and the
+		// route table names each route for its page `id`. Both admin entries
+		// declared a PATH (`/admin/settings`), which names no route, so
+		// vue-router's `resolve` threw and the entry rendered as a nav item
+		// with no working link. Measured in the browser: four
+		// `Object.resolve` errors on the console and no anchor for either
+		// entry, for an ADMIN.
+		//
+		// That is why the fail-open filter went unnoticed. The visible symptom
+		// was "a menu entry that does nothing", which reads as a dead link
+		// rather than as an ungated one.
+		for (const item of manifest.menu ?? []) {
+			if (item.href || !item.route) {
+				continue
+			}
+			expect(
+				pageById.get(item.route),
+				`menu entry "${item.id}" routes to "${item.route}", which is not a page id — CnAppNav builds { name: route } and vue-router cannot resolve it`,
+			).toBeDefined()
+		}
+	})
+})
diff --git a/src/utils/manifestRoutes.js b/src/utils/manifestRoutes.js
new file mode 100644
index 000000000..bd5ce2dee
--- /dev/null
+++ b/src/utils/manifestRoutes.js
@@ -0,0 +1,83 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * The manifest's `pages[]` turned into a vue-router table, plus the guard that
+ * enforces what those pages declare.
+ *
+ * Both halves live here rather than in `main.js` for one reason: `main.js`
+ * calls `createApp`, installs Pinia, reads `window.location` and fires an HTTP
+ * request on import, so nothing can unit-test a function defined inside it.
+ * A permission check nothing can test is a permission check nobody has watched
+ * fail — which is how the nav half of this same field stayed inert.
+ *
+ * @spec openspec/specs/runtime-shell/spec.md
+ */
+
+import { permits } from './permissions.js'
+
+/**
+ * Build the vue-router config from the manifest. Each declared page becomes one
+ * route, named for its `id`, so a page cannot be declared without being served.
+ *
+ * The page's declared `permission` travels with the route as `meta.permission`,
+ * which is what {@link permissionGuard} reads. It used to be dropped here,
+ * while the v2 manifest schema calls that field "the permission identifier
+ * required to access this page" (`app-manifest-v2.schema.json`).
+ *
+ * @param {object} manifest  The merged manifest.
+ * @param {object} component The component every manifest route renders.
+ *
+ * @return {Array<object>} vue-router 4 routes.
+ *
+ * @spec openspec/specs/runtime-shell/spec.md
+ */
+export function routesFromManifest(manifest, component) {
+	const routes = (manifest.pages ?? []).map((page) => ({
+		name: page.id,
+		path: page.route,
+		component,
+		props: page.route.includes(':'),
+		meta: { permission: page.permission ?? '' },
+	}))
+
+	// ⚠️ vue-router 4 REMOVED the bare `path: '*'` wildcard, and does not warn:
+	// the route simply never matches, so an unknown URL renders the shell with
+	// an empty content area. The named-param form is the v4 spelling.
+	routes.push({ path: '/:pathMatch(.*)*', redirect: '/' })
+	return routes
+}
+
+/**
+ * The route half of the manifest's `permission` field.
+ *
+ * `CnAppNav` filters the MENU entry. Nothing filtered the ROUTE — not this app
+ * and not `@conduction/nextcloud-vue`, which never sees the router because the
+ * app builds it. Fixing only the nav would reproduce exactly the defect Dossiq
+ * shipped (ConductionNL/dossiq#2307): the working half is what hides the
+ * broken one, because everybody checks "can a non-admin see this?" by opening
+ * the menu, and the menu answers correctly.
+ *
+ * A redirect to the dashboard rather than an error page: after the nav fix the
+ * only ways onto a gated route are a hand-typed URL and a link that outlived
+ * somebody's group membership. Both want the dashboard, which is where the
+ * catch-all already sends an unmatched path.
+ *
+ * READ IT FOR WHAT IT IS. This stops the page from rendering. It is not an
+ * authorization boundary and nothing behind it depends on it: launchpad's
+ * two gated pages redirect to a Nextcloud settings section that Nextcloud
+ * gates server-side, and its data endpoints check the caller themselves.
+ *
+ * @param {object}        to          The route being entered.
+ * @param {Array<string>} permissions The permissions the account holds.
+ *
+ * @return {boolean|object} True to allow, or the redirect target.
+ *
+ * @spec openspec/specs/runtime-shell/spec.md
+ */
+export function permissionGuard(to, permissions) {
+	if (permits(to?.meta?.permission, permissions)) {
+		return true
+	}
+	return { path: '/' }
+}
diff --git a/src/utils/permissions.js b/src/utils/permissions.js
new file mode 100644
index 000000000..d6d9096e5
--- /dev/null
+++ b/src/utils/permissions.js
@@ -0,0 +1,90 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * The permission vocabulary the manifest is written in, and the two rules that
+ * read it.
+ *
+ * 🔴 THE ADMIN MENU ENTRIES RENDERED FOR EVERY ACCOUNT. `manifest.menu`
+ * declares `permission: "admin"` on `admin-templates` and `admin-settings`,
+ * and `App.vue` passed no `permissions` prop to `CnAppRoot`. `CnAppNav`'s
+ * filter is written to treat an absent or empty list as "the app did not say":
+ *
+ *     if (!item.permission) return true
+ *     if (!this.permissions || this.permissions.length === 0) return true
+ *     return this.permissions.includes(item.permission)
+ *
+ * so the second line fired for everyone and the declaration was inert. A gate
+ * that fails open is not a gate.
+ *
+ * WHAT THOSE TWO ENTRIES ACTUALLY REACH, said plainly rather than implied.
+ * Both `/admin/templates` and `/admin/settings` render
+ * `views/AdminSettingsRedirect.vue`, which bounces to
+ * `/settings/admin/launchpad` — a Nextcloud settings section registered by
+ * `lib/Settings/LaunchPadAdmin.php` and gated by Nextcloud's own settings
+ * framework. So an ordinary account following either entry today lands on a
+ * page the server refuses it. This is a broken affordance, not a disclosure:
+ * no launchpad data was ever served through those two routes. It is worth
+ * fixing anyway, because the next admin surface added under `/admin/*`
+ * inherits whichever behaviour is in place when it arrives.
+ *
+ * @spec openspec/specs/runtime-shell/spec.md
+ */
+
+/**
+ * The permission strings the current account holds.
+ *
+ * Never empty, and that is the point rather than a detail: `CnAppNav` reads an
+ * empty array as "unspecified" and renders every entry regardless of what it
+ * declares. `user` is what everyone holds and no manifest entry asks for; it
+ * exists to keep the list non-empty for accounts that hold nothing else.
+ *
+ * A BOOLEAN ARGUMENT RATHER THAN A `window` READ, deliberately. Seventeen apps
+ * in this fleet compute this list as `window.OC?.currentUser?.permissions ?? []`.
+ * `OC.currentUser` is the uid STRING (`core/src/OC/currentuser.js`), so
+ * `.permissions` is always `undefined` and that expression always answers `[]`
+ * — the empty-list escape, every time, for every account. Launchpad does not
+ * need `window` at all: `PageController` already pushes a server-computed
+ * `isAdmin` into the initial state (`utils/loadInitialState.js`), defaulting to
+ * `false`, and both call sites have it in hand.
+ *
+ * @param {boolean} isAdmin Whether the server said this account is an admin.
+ *
+ * @return {Array<string>} The permission strings held, always non-empty.
+ *
+ * @spec openspec/specs/runtime-shell/spec.md
+ */
+export function currentPermissions(isAdmin) {
+	return isAdmin === true ? ['user', 'admin'] : ['user']
+}
+
+/**
+ * Whether an account holding `permissions` may open something declaring
+ * `required`.
+ *
+ * Deliberately NOT the shape `CnAppNav.passesPermission` uses. There is no
+ * "the app did not say" escape here: an empty or absent list denies anything
+ * that asks for a permission. On a nav entry an empty list is a visibility
+ * bug; on a route it would be the whole gate. The two rules fail in opposite
+ * directions on the same input and that is intended, so they are written
+ * separately rather than shared.
+ *
+ * A page that declares nothing stays open, which is every page but the two
+ * admin ones.
+ *
+ * @param {string}        required    The declared permission, or '' / undefined.
+ * @param {Array<string>} permissions The permissions held.
+ *
+ * @return {boolean} True when access is allowed.
+ *
+ * @spec openspec/specs/runtime-shell/spec.md
+ */
+export function permits(required, permissions) {
+	if (!required) {
+		return true
+	}
+	if (!Array.isArray(permissions)) {
+		return false
+	}
+	return permissions.includes(required)
+}
diff --git a/tests/Stubs/OpenRegisterStubs.php b/tests/Stubs/OpenRegisterStubs.php
new file mode 100644
index 000000000..34ddace3e
--- /dev/null
+++ b/tests/Stubs/OpenRegisterStubs.php
@@ -0,0 +1,81 @@
+<?php
+
+/**
+ * OpenRegister AppHost store-plane stubs for unit tests.
+ *
+ * `StoreService` names OpenRegister's classes as STRINGS, so LaunchPad can run
+ * without OpenRegister installed. Unit tests still need the two symbols to
+ * exist: one to instantiate as a descriptor, one to build a test double from.
+ *
+ * The `class_exists` guards make this a no-op inside a Nextcloud container that
+ * has the real OpenRegister loaded, so a test asserting against these stubs is
+ * asserting against the real signatures there.
+ *
+ * The signatures mirror
+ * `openregister/lib/AppHost/Service/StoreDescriptor.php` and
+ * `openregister/lib/AppHost/Service/GenericStoreService.php` as of 2026-09-10.
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace OCA\OpenRegister\AppHost\Service {
+	if (class_exists(__NAMESPACE__ . '\\StoreDescriptor', false) === false) {
+		/**
+		 * Stub mirroring the engine's immutable descriptor value object.
+		 */
+		final class StoreDescriptor {
+			/**
+			 * Constructor.
+			 *
+			 * @param string                $appId           App holding the registry config.
+			 * @param string                $schema          Remote schema slug.
+			 * @param string                $defaultRegister Register used when config is empty.
+			 * @param array<string, string> $cardFields      Card field to remote property.
+			 * @param array<int, string>    $types           Shareable configuration type ids.
+			 */
+			public function __construct(
+				public readonly string $appId,
+				public readonly string $schema,
+				public readonly string $defaultRegister,
+				public readonly array $cardFields = [],
+				public readonly array $types = [],
+			) {
+			}//end __construct()
+		}//end class
+	}
+
+	if (class_exists(__NAMESPACE__ . '\\GenericStoreService', false) === false) {
+		/**
+		 * Stub mirroring the engine's guarded discovery client.
+		 */
+		class GenericStoreService {
+			/**
+			 * Search the remote store.
+			 *
+			 * @param StoreDescriptor $descriptor Store parameters.
+			 * @param string|null     $query      Free-text term.
+			 * @param string|null     $kind       Kind filter.
+			 *
+			 * @return array{outcome: string, cards: array<int, array<string, mixed>>}
+			 */
+			public function search(StoreDescriptor $descriptor, ?string $query = null, ?string $kind = null): array {
+				return ['outcome' => 'not_configured', 'cards' => []];
+			}//end search()
+
+			/**
+			 * Resolve one remote item by slug.
+			 *
+			 * @param StoreDescriptor $descriptor Store parameters.
+			 * @param string          $slug       The item slug.
+			 *
+			 * @return array<string, mixed>|null
+			 */
+			public function resolve(StoreDescriptor $descriptor, string $slug): ?array {
+				return null;
+			}//end resolve()
+		}//end class
+	}
+}
diff --git a/tests/Unit/Controller/AdminControllerExportImportTest.php b/tests/Unit/Controller/AdminControllerExportImportTest.php
index 9c5efc913..e4a1506d5 100644
--- a/tests/Unit/Controller/AdminControllerExportImportTest.php
+++ b/tests/Unit/Controller/AdminControllerExportImportTest.php
@@ -27,6 +27,7 @@
 use OCA\LaunchPad\Service\ExportService;
 use OCA\LaunchPad\Service\FooterService;
 use OCA\LaunchPad\Service\ImportService;
+use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\JSONResponse;
 use OCP\IGroupManager;
@@ -104,6 +105,69 @@ private function loginAsAdmin(): void {
 		$this->groupManager->method('isAdmin')->with('alice')->willReturn(true);
 	}
 
+	/**
+	 * REQ-EXIM-002 "Export non-existent dashboard": a UUID nothing answers to
+	 * is a 404, not a 500 and not an empty archive.
+	 *
+	 * @return void
+	 */
+	public function testExportDashboardNotFoundReturns404(): void {
+		$this->loginAsAdmin();
+		$this->exportService->method('exportDashboard')->willThrowException(
+			exception: new DoesNotExistException(msg: 'no such dashboard')
+		);
+
+		$response = $this->controller->export(
+			scope: 'dashboard',
+			dashboardUuid: '00000000-0000-0000-0000-000000000000'
+		);
+
+		$this->assertInstanceOf(expected: JSONResponse::class, actual: $response);
+		$this->assertSame(expected: Http::STATUS_NOT_FOUND, actual: $response->getStatus());
+	}//end testExportDashboardNotFoundReturns404()
+
+	/**
+	 * REQ-EXIM-005 "preserveUuids parameter default is false": omitting the
+	 * parameter imports with fresh UUIDs.
+	 *
+	 * The admin page always sends the switch's state, so only a direct caller
+	 * can leave it out; this is where that default lives.
+	 *
+	 * @return void
+	 */
+	public function testImportDefaultsToFreshUuids(): void {
+		$this->loginAsAdmin();
+
+		$seen = null;
+		$this->importService->method('import')->willReturnCallback(
+			static function (string $zipPath, bool $preserveUuids, string $userId) use (&$seen): array {
+				$seen = $preserveUuids;
+				return [
+					'status' => 'ok',
+					'importedDashboardCount' => 0,
+					'skippedDashboardCount' => 0,
+					'errors' => [],
+					'manifest' => [],
+				];
+			}
+		);
+
+		$tmp = (string)tempnam(directory: sys_get_temp_dir(), prefix: 'launchpad-default-');
+		$_FILES['file'] = ['tmp_name' => $tmp, 'name' => 'archive.zip', 'error' => 0, 'size' => 1];
+
+		try {
+			$this->controller->import();
+		} finally {
+			unset($_FILES['file']);
+			@unlink(filename: $tmp);
+		}
+
+		$this->assertFalse(
+			condition: $seen,
+			message: 'omitting preserveUuids must import with fresh UUIDs'
+		);
+	}//end testImportDefaultsToFreshUuids()
+
 	public function testExportNonAdminForbidden(): void {
 		$this->loginAsNonAdmin();
 
@@ -138,6 +202,10 @@ public function testExportDashboardRequiresUuid(): void {
 
 		$this->assertInstanceOf(expected: JSONResponse::class, actual: $response);
 		$this->assertSame(expected: Http::STATUS_BAD_REQUEST, actual: $response->getStatus());
+		$this->assertSame(
+			expected: 'dashboardUuid parameter is required when scope=dashboard',
+			actual: $response->getData()['error'] ?? null
+		);
 	}
 
 	public function testExportDashboardRejectsInvalidUuidFormat(): void {
@@ -150,6 +218,11 @@ public function testExportDashboardRejectsInvalidUuidFormat(): void {
 
 		$this->assertInstanceOf(expected: JSONResponse::class, actual: $response);
 		$this->assertSame(expected: Http::STATUS_BAD_REQUEST, actual: $response->getStatus());
+		// REQ-EXIM-002 pins the message, not just the status.
+		$this->assertSame(
+			expected: 'Invalid dashboard UUID format',
+			actual: $response->getData()['error'] ?? null
+		);
 	}
 
 	public function testImportMissingFileReturns400(): void {
diff --git a/tests/Unit/Controller/AdminControllerSettingsAliasTest.php b/tests/Unit/Controller/AdminControllerSettingsAliasTest.php
new file mode 100644
index 000000000..0d62bc564
--- /dev/null
+++ b/tests/Unit/Controller/AdminControllerSettingsAliasTest.php
@@ -0,0 +1,158 @@
+<?php
+
+/**
+ * AdminControllerSettingsAliasTest
+ *
+ * `GET /api/admin/settings` returns `allowUserDashboards`; `PUT
+ * /api/admin/settings` accepted only `allowUserDash`. Five settings had a
+ * read name and a write name, and they did not match.
+ *
+ * Nextcloud's parameter binding leaves an unrecognised key null, and null
+ * here means "not supplied", so a caller that round-tripped GET into PUT
+ * wrote NOTHING and was answered `{"status": "ok"}`. Measured on the dev
+ * instance: `PUT {"allowUserDashboards": true}` reported success and left the
+ * flag off, which reads as "the setting will not stick" rather than as a
+ * rejected key.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Controller
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Controller;
+
+use OCA\LaunchPad\Controller\AdminController;
+use OCA\LaunchPad\Service\ActionAuthService;
+use OCA\LaunchPad\Service\AdminSettingsService;
+use OCA\LaunchPad\Service\AdminTemplateService;
+use OCA\LaunchPad\Service\ExportService;
+use OCA\LaunchPad\Service\FooterService;
+use OCA\LaunchPad\Service\ImportService;
+use OCP\IGroupManager;
+use OCP\IRequest;
+use OCP\IUserSession;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+class AdminControllerSettingsAliasTest extends TestCase {
+	private AdminController $controller;
+
+	/** @var AdminSettingsService&MockObject */
+	private $settingsService;
+
+	protected function setUp(): void {
+		$this->settingsService = $this->createMock(AdminSettingsService::class);
+
+		$this->controller = new AdminController(
+			request: $this->createMock(IRequest::class),
+			templateService: $this->createMock(AdminTemplateService::class),
+			settingsService: $this->settingsService,
+			groupManager: $this->createMock(IGroupManager::class),
+			userSession: $this->createMock(IUserSession::class),
+			exportService: $this->createMock(ExportService::class),
+			importService: $this->createMock(ImportService::class),
+			roleService: $this->createMock(\OCA\LaunchPad\Service\RoleService::class),
+			feedRefresh: $this->createMock(\OCA\LaunchPad\Service\FeedRefreshService::class),
+			footerService: $this->createMock(FooterService::class),
+			setupWizardService: $this->createMock(\OCA\LaunchPad\Service\SetupWizardService::class),
+			actionAuth: $this->createMock(ActionAuthService::class),
+			resyncService: $this->createMock(\OCA\LaunchPad\Service\TemplateResyncService::class),
+		);
+	}//end setUp()
+
+	/**
+	 * A payload spelled the way GET spells it must reach the service.
+	 *
+	 * @return void
+	 */
+	public function testReadSideNamesAreAccepted(): void {
+		$this->settingsService->expects($this->once())
+			->method('updateSettings')
+			->with(
+				$this->equalTo('full'),
+				$this->isTrue(),
+				$this->isFalse(),
+				$this->equalTo(8),
+				$this->equalTo(['md']),
+			);
+
+		$this->controller->updateSettings(
+			defaultPermissionLevel: 'full',
+			allowUserDashboards: true,
+			allowMultipleDashboards: false,
+			defaultGridColumns: 8,
+			linkCreateFileExtensions: ['md'],
+		);
+	}//end testReadSideNamesAreAccepted()
+
+	/**
+	 * The short names AdminSettings.vue sends keep working unchanged.
+	 *
+	 * @return void
+	 */
+	public function testWriteSideNamesStillWork(): void {
+		$this->settingsService->expects($this->once())
+			->method('updateSettings')
+			->with(
+				$this->equalTo('view_only'),
+				$this->isTrue(),
+				$this->isNull(),
+				$this->equalTo(12),
+			);
+
+		$this->controller->updateSettings(
+			defaultPermLevel: 'view_only',
+			allowUserDash: true,
+			defaultGridCols: 12,
+		);
+	}//end testWriteSideNamesStillWork()
+
+	/**
+	 * When both spellings arrive, the short one wins.
+	 *
+	 * AdminSettings.vue sends the short form, and an explicit short-form
+	 * value is the one a form actually submitted, so it must not be
+	 * overridden by a long-form key that happened to ride along.
+	 *
+	 * @return void
+	 */
+	public function testShortNameWinsWhenBothAreSupplied(): void {
+		$this->settingsService->expects($this->once())
+			->method('updateSettings')
+			->with($this->anything(), $this->isFalse());
+
+		$this->controller->updateSettings(
+			allowUserDash: false,
+			allowUserDashboards: true,
+		);
+	}//end testShortNameWinsWhenBothAreSupplied()
+
+	/**
+	 * A setting nobody sent stays null, so it is left alone.
+	 *
+	 * The aliasing must not turn "not supplied" into a write, or every PUT
+	 * would rewrite every setting it did not mention.
+	 *
+	 * @return void
+	 */
+	public function testUnsuppliedSettingsStayNull(): void {
+		$this->settingsService->expects($this->once())
+			->method('updateSettings')
+			->with(
+				$this->isNull(),
+				$this->isNull(),
+				$this->isNull(),
+				$this->isNull(),
+				$this->isNull(),
+			);
+
+		$this->controller->updateSettings(allowUserDash: null);
+	}//end testUnsuppliedSettingsStayNull()
+}//end class
diff --git a/tests/Unit/Controller/StoreControllerTest.php b/tests/Unit/Controller/StoreControllerTest.php
new file mode 100644
index 000000000..773fb7025
--- /dev/null
+++ b/tests/Unit/Controller/StoreControllerTest.php
@@ -0,0 +1,251 @@
+<?php
+
+/**
+ * StoreControllerTest
+ *
+ * Unit tests for {@see \OCA\LaunchPad\Controller\StoreController} covering the
+ * `dashboard-store` capability — REQ-STORE-004 (auth posture) and the outcome
+ * and report pass-through the store page reads.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Controller
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Controller;
+
+use OCA\LaunchPad\Controller\StoreController;
+use OCA\LaunchPad\Service\StoreService;
+use OCA\LaunchPad\Settings\LaunchPadAdmin;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\IRequest;
+use OCP\IUser;
+use OCP\IUserSession;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use ReflectionMethod;
+
+/**
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects) Mirrors the constructor.
+ */
+class StoreControllerTest extends TestCase {
+	/** @var IRequest&MockObject */
+	private $request;
+
+	/** @var StoreService&MockObject */
+	private $storeService;
+
+	/** @var IUserSession&MockObject */
+	private $userSession;
+
+	private StoreController $controller;
+
+	/**
+	 * Build the controller under test with an anonymous session by default.
+	 *
+	 * @return void
+	 */
+	protected function setUp(): void {
+		parent::setUp();
+
+		$this->request = $this->createMock(IRequest::class);
+		$this->storeService = $this->createMock(StoreService::class);
+		$this->userSession = $this->createMock(IUserSession::class);
+
+		$this->controller = new StoreController(
+			request: $this->request,
+			storeService: $this->storeService,
+			userSession: $this->userSession
+		);
+	}//end setUp()
+
+	/**
+	 * Put a signed-in user on the session.
+	 *
+	 * @param string $uid The user id.
+	 *
+	 * @return void
+	 */
+	private function signIn(string $uid): void {
+		$user = $this->createMock(IUser::class);
+		$user->method('getUID')->willReturn($uid);
+		$this->userSession->method('getUser')->willReturn($user);
+	}//end signIn()
+
+	/**
+	 * REQ-STORE-004: search is signed-in, install and config are admin.
+	 *
+	 * A route whose method declares NO Nextcloud auth attribute is rejected by
+	 * the middleware before the controller runs, so the absence of an attribute
+	 * is a dead endpoint rather than an open one. Asserted by reflection so a
+	 * removed attribute reddens here rather than at dispatch time.
+	 *
+	 * @return void
+	 */
+	public function testEveryRouteDeclaresItsAuthPosture(): void {
+		$search = new ReflectionMethod(StoreController::class, 'search');
+		$this->assertCount(1, $search->getAttributes(NoAdminRequired::class));
+
+		foreach (['install', 'getConfig', 'updateConfig'] as $name) {
+			$method = new ReflectionMethod(StoreController::class, $name);
+			$attributes = $method->getAttributes(AuthorizedAdminSetting::class);
+			$this->assertCount(1, $attributes, $name . ' must be admin-gated');
+			$this->assertSame(
+				[LaunchPadAdmin::class],
+				$attributes[0]->getArguments(),
+				$name . ' must name the LaunchPad admin setting'
+			);
+		}
+	}//end testEveryRouteDeclaresItsAuthPosture()
+
+	/**
+	 * REQ-STORE-004: install is NOT reachable without the admin attribute.
+	 *
+	 * Stated separately from the sweep above because this is the one that costs
+	 * something if it regresses: search discloses a remote registry's cards,
+	 * install writes into the instance.
+	 *
+	 * @return void
+	 */
+	public function testInstallIsNotMerelyLoginRequired(): void {
+		$method = new ReflectionMethod(StoreController::class, 'install');
+
+		$this->assertCount(0, $method->getAttributes(NoAdminRequired::class));
+	}//end testInstallIsNotMerelyLoginRequired()
+
+	/**
+	 * An anonymous search gets an explicit 401, not a login redirect.
+	 *
+	 * @return void
+	 */
+	public function testAnonymousSearchIsUnauthorised(): void {
+		$this->userSession->method('getUser')->willReturn(null);
+		$this->storeService->expects($this->never())->method('search');
+
+		$response = $this->controller->search();
+
+		$this->assertSame(Http::STATUS_UNAUTHORIZED, $response->getStatus());
+	}//end testAnonymousSearchIsUnauthorised()
+
+	/**
+	 * REQ-STORE-003: the engine's outcome reaches the page unchanged.
+	 *
+	 * @return void
+	 */
+	public function testSearchReturnsTheServiceOutcome(): void {
+		$this->signIn(uid: 'alice');
+		$this->request->method('getParam')->willReturn(null);
+		$this->storeService->method('search')->willReturn(
+			['outcome' => 'store_unreachable', 'cards' => []]
+		);
+
+		$response = $this->controller->search();
+		$data = $response->getData();
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame('store_unreachable', $data['outcome']);
+		$this->assertArrayHasKey('builtIn', $data, 'CnStorePage reads builtIn unconditionally');
+		$this->assertArrayHasKey('kinds', $data, 'CnStorePage reads kinds unconditionally');
+	}//end testSearchReturnsTheServiceOutcome()
+
+	/**
+	 * A refused install is a 400 so the page shows the message.
+	 *
+	 * `CnStorePage` reads `body.message` only when the response is not ok. A
+	 * refusal returned as 200 would render as a silent success.
+	 *
+	 * @return void
+	 */
+	public function testARefusedInstallIsNotReportedAsSuccess(): void {
+		$this->signIn(uid: 'alice');
+		$this->storeService->method('install')->willReturn(
+			['success' => false, 'message' => 'That template carries no dashboard.', 'components' => []]
+		);
+
+		$response = $this->controller->install(slug: 'empty');
+
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+		$this->assertFalse($response->getData()['success']);
+	}//end testARefusedInstallIsNotReportedAsSuccess()
+
+	/**
+	 * A partial install is a 200 carrying the per-component report.
+	 *
+	 * @return void
+	 */
+	public function testAPartialInstallReturnsTheComponentReport(): void {
+		$this->signIn(uid: 'alice');
+		$components = [
+			['schema' => 'Sales overview', 'status' => 'installed'],
+			['schema' => 'Refused board', 'status' => 'refused'],
+		];
+		$this->storeService->method('install')->willReturn(
+			['success' => true, 'message' => 'Installed 1 of 2.', 'components' => $components]
+		);
+
+		$response = $this->controller->install(slug: 'sales-overview');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame($components, $response->getData()['components']);
+	}//end testAPartialInstallReturnsTheComponentReport()
+
+	/**
+	 * The install runs as the calling administrator, not as a fixed identity.
+	 *
+	 * @return void
+	 */
+	public function testInstallRunsAsTheCallingAdministrator(): void {
+		$this->signIn(uid: 'alice');
+		$this->storeService->expects($this->once())->method('install')->with('sales-overview', 'alice')
+			->willReturn(['success' => true, 'message' => '', 'components' => []]);
+
+		$this->controller->install(slug: 'sales-overview');
+	}//end testInstallRunsAsTheCallingAdministrator()
+
+	/**
+	 * REQ-STORE-007: the config response never carries a token value.
+	 *
+	 * @return void
+	 */
+	public function testTheConfigResponseCarriesNoToken(): void {
+		$this->storeService->method('getRegistryConfig')->willReturn(
+			['registryUrl' => 'https://registry.example.org/', 'registryRegister' => 'launchpad', 'tokenConfigured' => true]
+		);
+		$this->storeService->method('isAvailable')->willReturn(true);
+
+		$data = $this->controller->getConfig()->getData();
+
+		$this->assertArrayNotHasKey('registryToken', $data);
+		$this->assertTrue($data['tokenConfigured']);
+		$this->assertTrue($data['available']);
+	}//end testTheConfigResponseCarriesNoToken()
+
+	/**
+	 * REQ-STORE-007: an absent parameter stays null so the key is left alone.
+	 *
+	 * @return void
+	 */
+	public function testAnAbsentParameterIsPassedAsNull(): void {
+		$this->request->method('getParam')->willReturnCallback(
+			static function (string $name) {
+				return ($name === 'registryUrl') ? 'https://registry.example.org/' : null;
+			}
+		);
+		$this->storeService->method('getRegistryConfig')->willReturn(
+			['registryUrl' => '', 'registryRegister' => '', 'tokenConfigured' => false]
+		);
+		$this->storeService->expects($this->once())->method('updateRegistryConfig')
+			->with('https://registry.example.org/', null, null);
+
+		$this->controller->updateConfig();
+	}//end testAnAbsentParameterIsPassedAsNull()
+}//end class
diff --git a/tests/Unit/Database/ConfluenceImportDatabaseTest.php b/tests/Unit/Database/ConfluenceImportDatabaseTest.php
new file mode 100644
index 000000000..ddca0d4cb
--- /dev/null
+++ b/tests/Unit/Database/ConfluenceImportDatabaseTest.php
@@ -0,0 +1,99 @@
+<?php
+
+/**
+ * ConfluenceImportDatabaseTest
+ *
+ * A Confluence import, through ConfluenceImportService, against a real
+ * database: each page must land as a dashboard with its placeholder widget.
+ *
+ * 🔴 WHY. The placeholder widget was built without `created_at` or
+ * `updated_at`, both NOT NULL with no default, so on PostgreSQL every page's
+ * placement insert failed with SQLSTATE 23502, the page's transaction rolled
+ * back, and the import reported "Imported 0 dashboards, skipped 1" while
+ * exiting 0. No test wrote an import to a database: the Confluence tests
+ * covered parsing only. It is the #612 importer bug again, in the other
+ * importer.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Database
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Database;
+
+use OCA\LaunchPad\Service\ConfluenceImportService;
+use OCP\Server;
+use ZipArchive;
+
+/**
+ * @SuppressWarnings(PHPMD.StaticAccess) Server::get() is the only way in from a test.
+ */
+class ConfluenceImportDatabaseTest extends RealDatabaseTestCase {
+	/**
+	 * A one-page export lands as one dashboard with its placeholder widget.
+	 *
+	 * @return void
+	 */
+	public function testAOnePageExportLandsAsADashboardWithItsWidget(): void {
+		$owner = $this->makeUser(prefix: 'db-confluence');
+		$this->cleanup(function () use ($owner): void {
+			foreach ($this->storedRows('launchpad_dashboards', 'user_id', $owner) as $row) {
+				$this->deleteRows('launchpad_widget_placements', 'dashboard_id', (int)$row['id']);
+			}
+
+			$this->deleteRows('launchpad_dashboards', 'user_id', $owner);
+		});
+
+		$result = Server::get(ConfluenceImportService::class)->import(
+			zipPath: $this->onePageExport(),
+			currentUserId: $owner
+		);
+
+		$this->assertSame([], $result['errors'], 'the import reported errors: ' . json_encode($result['errors']));
+		$this->assertSame(1, $result['createdDashboardCount'], 'the page did not land as a dashboard');
+
+		$dashboards = $this->storedRows('launchpad_dashboards', 'user_id', $owner);
+		$this->assertCount(1, $dashboards, 'the dashboard row was not stored');
+		$this->assertSame('Architecture', $dashboards[0]['name']);
+
+		$placements = $this->storedRows('launchpad_widget_placements', 'dashboard_id', (int)$dashboards[0]['id']);
+		$this->assertCount(1, $placements, 'the placeholder widget was not stored');
+		$this->assertColumnsFilled(
+			row: $placements[0],
+			columns: ['dashboard_id', 'widget_id', 'created_at', 'updated_at']
+		);
+	}//end testAOnePageExportLandsAsADashboardWithItsWidget()
+
+	/**
+	 * Write a one-page Confluence HTML export, removed again in tearDown.
+	 *
+	 * @return string Path to the ZIP.
+	 */
+	private function onePageExport(): string {
+		$path = (string)tempnam(sys_get_temp_dir(), 'launchpad-confluence-');
+		$this->cleanup(static function () use ($path): void {
+			if (file_exists($path) === true) {
+				unlink($path);
+			}
+		});
+
+		$zip = new ZipArchive();
+		$zip->open($path, ZipArchive::OVERWRITE);
+		$zip->addFromString('index.html', '<html><body><ul><li><a href="SPACE/page-1.html">P1</a></li></ul></body></html>');
+		$zip->addFromString(
+			'SPACE/page-1.html',
+			'<html><head><title>SPACE : Architecture</title></head><body>'
+			. '<div id="main-content"><p>Body of P1</p></div></body></html>'
+		);
+		$zip->close();
+
+		return $path;
+	}//end onePageExport()
+}//end class
diff --git a/tests/Unit/Database/DashboardShareWriteDatabaseTest.php b/tests/Unit/Database/DashboardShareWriteDatabaseTest.php
new file mode 100644
index 000000000..ffc1a5e90
--- /dev/null
+++ b/tests/Unit/Database/DashboardShareWriteDatabaseTest.php
@@ -0,0 +1,67 @@
+<?php
+
+/**
+ * DashboardShareWriteDatabaseTest
+ *
+ * Sharing a dashboard with a user, through DashboardShareService, against a
+ * real database: the stored share must carry every column the table requires.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Database
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Database;
+
+use OCA\LaunchPad\Service\DashboardService;
+use OCA\LaunchPad\Service\DashboardShareService;
+use OCP\Server;
+
+/**
+ * @SuppressWarnings(PHPMD.StaticAccess) Server::get() is the only way in from a test.
+ */
+class DashboardShareWriteDatabaseTest extends RealDatabaseTestCase {
+	/**
+	 * A new share is stored with every required column filled.
+	 *
+	 * @return void
+	 */
+	public function testAddShareStoresEveryRequiredColumn(): void {
+		$owner = $this->makeUser(prefix: 'db-owner');
+		$recipient = $this->makeUser(prefix: 'db-recipient');
+
+		$dashboard = Server::get(DashboardService::class)->createDashboard(
+			userId: $owner,
+			name: 'Share write test'
+		);
+		$dashboardId = (int)$dashboard->getId();
+		$this->cleanup(function () use ($dashboardId): void {
+			$this->deleteRows('launchpad_dashboard_shares', 'dashboard_id', $dashboardId);
+			$this->deleteRows('launchpad_widget_placements', 'dashboard_id', $dashboardId);
+			$this->deleteRows('launchpad_dashboards', 'id', $dashboardId);
+		});
+
+		Server::get(DashboardShareService::class)->addShare(
+			dashboardId: $dashboardId,
+			shareType: 'user',
+			shareWith: $recipient,
+			permissionLevel: 'view_only',
+			callerId: $owner
+		);
+
+		$rows = $this->storedRows('launchpad_dashboard_shares', 'dashboard_id', $dashboardId);
+		$this->assertCount(1, $rows, 'the share was not stored');
+		$this->assertColumnsFilled(
+			row: $rows[0],
+			columns: ['dashboard_id', 'share_type', 'share_with', 'created_at']
+		);
+		$this->assertSame($recipient, $rows[0]['share_with']);
+	}//end testAddShareStoresEveryRequiredColumn()
+}//end class
diff --git a/tests/Unit/Database/DashboardWriteDatabaseTest.php b/tests/Unit/Database/DashboardWriteDatabaseTest.php
new file mode 100644
index 000000000..46a20dc9a
--- /dev/null
+++ b/tests/Unit/Database/DashboardWriteDatabaseTest.php
@@ -0,0 +1,89 @@
+<?php
+
+/**
+ * DashboardWriteDatabaseTest
+ *
+ * Dashboard create and update, through DashboardService, against a real
+ * database: the stored row must carry every column the table requires.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Database
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Database;
+
+use OCA\LaunchPad\Service\DashboardService;
+use OCP\Server;
+
+/**
+ * @SuppressWarnings(PHPMD.StaticAccess) Server::get() is the only way in from a test.
+ */
+class DashboardWriteDatabaseTest extends RealDatabaseTestCase {
+	/**
+	 * Columns of `oc_launchpad_dashboards` that are NOT NULL with no default.
+	 */
+	private const REQUIRED = ['uuid', 'name', 'created_at', 'updated_at'];
+
+	/**
+	 * Create a dashboard as a fresh owner; remove it again in tearDown.
+	 *
+	 * @param string $owner The owner.
+	 *
+	 * @return int The stored dashboard id.
+	 */
+	private function createFor(string $owner): int {
+		$dashboard = Server::get(DashboardService::class)->createDashboard(
+			userId: $owner,
+			name: 'Database write test'
+		);
+		$id = (int)$dashboard->getId();
+		$this->cleanup(function () use ($id): void {
+			$this->deleteRows('launchpad_widget_placements', 'dashboard_id', $id);
+			$this->deleteRows('launchpad_dashboards', 'id', $id);
+		});
+
+		return $id;
+	}//end createFor()
+
+	/**
+	 * A created dashboard is stored with every required column filled.
+	 *
+	 * @return void
+	 */
+	public function testCreateStoresEveryRequiredColumn(): void {
+		$id = $this->createFor(owner: $this->uniqueId(prefix: 'db-owner'));
+
+		$rows = $this->storedRows('launchpad_dashboards', 'id', $id);
+		$this->assertCount(1, $rows, 'the dashboard was not stored');
+		$this->assertColumnsFilled(row: $rows[0], columns: self::REQUIRED);
+		$this->assertSame('Database write test', $rows[0]['name']);
+	}//end testCreateStoresEveryRequiredColumn()
+
+	/**
+	 * An update is stored, and leaves every required column filled.
+	 *
+	 * @return void
+	 */
+	public function testUpdateIsStoredAndKeepsEveryRequiredColumn(): void {
+		$owner = $this->uniqueId(prefix: 'db-owner');
+		$id = $this->createFor(owner: $owner);
+
+		Server::get(DashboardService::class)->updateDashboard(
+			dashboardId: $id,
+			userId: $owner,
+			data: ['name' => 'Renamed in the database']
+		);
+
+		$rows = $this->storedRows('launchpad_dashboards', 'id', $id);
+		$this->assertSame('Renamed in the database', $rows[0]['name'], 'the update was not stored');
+		$this->assertColumnsFilled(row: $rows[0], columns: self::REQUIRED);
+	}//end testUpdateIsStoredAndKeepsEveryRequiredColumn()
+}//end class
diff --git a/tests/Unit/Database/RealDatabaseTestCase.php b/tests/Unit/Database/RealDatabaseTestCase.php
new file mode 100644
index 000000000..b73d7b2e5
--- /dev/null
+++ b/tests/Unit/Database/RealDatabaseTestCase.php
@@ -0,0 +1,191 @@
+<?php
+
+/**
+ * RealDatabaseTestCase
+ *
+ * Base for tests that write through LaunchPad's real services into a real
+ * database and then read the STORED row back with SQL.
+ *
+ * 🔴 WHY THESE EXIST. #612 shipped an importer that never set `created_at`.
+ * Every insert failed with SQLSTATE 23502 and was reported as "skipped", and
+ * the unit tests stayed green because they mock the mapper, so no INSERT ever
+ * reached a table with a NOT NULL constraint. A mocked test checks what the
+ * code ASKS for. These check what the database ACCEPTED.
+ *
+ * WHERE THEY RUN. They need a live Nextcloud. phpunit.xml sets
+ * PHPUNIT_USE_NC_BOOTSTRAP=1, so tests/bootstrap.php boots the real server
+ * whenever this tree sits inside an installed instance, which is what CI's
+ * PHPUnit job is. Anywhere else, such as a plain clone, they skip and say why.
+ *
+ * Every row a test creates is registered with `cleanup()`, and tearDown runs
+ * those whether or not the test passed.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Database
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Database;
+
+use OCP\DB\QueryBuilder\IQueryBuilder;
+use OCP\IDBConnection;
+use OCP\IUserManager;
+use OCP\Server;
+use PHPUnit\Framework\TestCase;
+use Throwable;
+
+/**
+ * @SuppressWarnings(PHPMD.StaticAccess) Server::get() is the only way in from a test.
+ */
+abstract class RealDatabaseTestCase extends TestCase {
+	/**
+	 * Cleanup callbacks, run in reverse order in tearDown.
+	 *
+	 * @var array<int, callable>
+	 */
+	private array $cleanups = [];
+
+	/**
+	 * Skip unless a live Nextcloud, and so a live database, is bootstrapped.
+	 *
+	 * @return void
+	 */
+	protected function setUp(): void {
+		parent::setUp();
+
+		if (class_exists(class: '\OC', autoload: false) === false) {
+			$this->markTestSkipped(
+				message: 'Needs a live Nextcloud database. CI boots one (phpunit.xml sets '
+				. 'PHPUNIT_USE_NC_BOOTSTRAP=1); a plain clone does not.'
+			);
+		}
+	}//end setUp()
+
+	/**
+	 * Run every registered cleanup, newest first, even after a failure.
+	 *
+	 * @return void
+	 */
+	protected function tearDown(): void {
+		foreach (array_reverse($this->cleanups) as $cleanup) {
+			try {
+				$cleanup();
+			} catch (Throwable) {
+				// A cleanup that fails must not hide the test's own verdict.
+			}
+		}
+
+		$this->cleanups = [];
+		parent::tearDown();
+	}//end tearDown()
+
+	/**
+	 * Register a cleanup to run in tearDown.
+	 *
+	 * @param callable $cleanup The cleanup.
+	 *
+	 * @return void
+	 */
+	protected function cleanup(callable $cleanup): void {
+		$this->cleanups[] = $cleanup;
+	}//end cleanup()
+
+	/**
+	 * A unique id for this test's rows.
+	 *
+	 * @param string $prefix A readable prefix.
+	 *
+	 * @return string The id.
+	 */
+	protected function uniqueId(string $prefix): string {
+		return $prefix . '-' . bin2hex(random_bytes(4));
+	}//end uniqueId()
+
+	/**
+	 * Provision a real Nextcloud account, removed again in tearDown.
+	 *
+	 * @param string $prefix A readable prefix.
+	 *
+	 * @return string The new user's id.
+	 */
+	protected function makeUser(string $prefix): string {
+		$uid = $this->uniqueId(prefix: $prefix);
+		$user = Server::get(IUserManager::class)->createUser($uid, 'Db-' . bin2hex(random_bytes(6)) . 'A1!');
+		$this->assertNotFalse($user, 'CONTROL: the test account could be created');
+		$this->cleanup(static function () use ($uid): void {
+			Server::get(IUserManager::class)->get($uid)?->delete();
+		});
+
+		return $uid;
+	}//end makeUser()
+
+	/**
+	 * Read the stored rows of a table matching one column, straight from SQL.
+	 *
+	 * @param string     $table  Table name without prefix.
+	 * @param string     $column Column to match.
+	 * @param int|string $value  Value to match.
+	 *
+	 * @return array<int, array<string, mixed>> The rows.
+	 */
+	protected function storedRows(string $table, string $column, int|string $value): array {
+		$qb = Server::get(IDBConnection::class)->getQueryBuilder();
+		$type = IQueryBuilder::PARAM_STR;
+		if (is_int($value) === true) {
+			$type = IQueryBuilder::PARAM_INT;
+		}
+
+		$qb->select('*')
+			->from($table)
+			->where($qb->expr()->eq($column, $qb->createNamedParameter($value, $type)));
+		$result = $qb->executeQuery();
+		$rows = $result->fetchAll();
+		$result->closeCursor();
+
+		return $rows;
+	}//end storedRows()
+
+	/**
+	 * Delete the rows of a table matching one column.
+	 *
+	 * @param string     $table  Table name without prefix.
+	 * @param string     $column Column to match.
+	 * @param int|string $value  Value to match.
+	 *
+	 * @return void
+	 */
+	protected function deleteRows(string $table, string $column, int|string $value): void {
+		$qb = Server::get(IDBConnection::class)->getQueryBuilder();
+		$type = IQueryBuilder::PARAM_STR;
+		if (is_int($value) === true) {
+			$type = IQueryBuilder::PARAM_INT;
+		}
+
+		$qb->delete($table)
+			->where($qb->expr()->eq($column, $qb->createNamedParameter($value, $type)));
+		$qb->executeStatement();
+	}//end deleteRows()
+
+	/**
+	 * Assert a stored row carries a value in every named column.
+	 *
+	 * @param array<string, mixed> $row     The stored row.
+	 * @param array<int, string>   $columns Columns that must be non-empty.
+	 *
+	 * @return void
+	 */
+	protected function assertColumnsFilled(array $row, array $columns): void {
+		foreach ($columns as $column) {
+			$this->assertArrayHasKey($column, $row, 'column ' . $column . ' is absent from the stored row');
+			$this->assertNotNull($row[$column], 'column ' . $column . ' was stored as NULL');
+			$this->assertNotSame('', (string)$row[$column], 'column ' . $column . ' was stored empty');
+		}
+	}//end assertColumnsFilled()
+}//end class
diff --git a/tests/Unit/Database/RoleFeaturePermissionDatabaseTest.php b/tests/Unit/Database/RoleFeaturePermissionDatabaseTest.php
new file mode 100644
index 000000000..fa95c18c3
--- /dev/null
+++ b/tests/Unit/Database/RoleFeaturePermissionDatabaseTest.php
@@ -0,0 +1,122 @@
+<?php
+
+/**
+ * RoleFeaturePermissionDatabaseTest
+ *
+ * Role feature permissions and role layout defaults, through
+ * RoleFeaturePermissionService, against a real database.
+ *
+ * 🔴 WHY. `name` is NOT NULL with no default in both tables, and the spec
+ * lists it as required. The service set it only when the payload carried it.
+ * A new row saved without `name` therefore reached the database with the
+ * column missing, failed with SQLSTATE 23502, and the API answered 400
+ * "Operation failed" with nothing to say which field. A missing required
+ * field is now refused as one, before any insert.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Database
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Database;
+
+use InvalidArgumentException;
+use OCA\LaunchPad\Service\RoleFeaturePermissionService;
+use OCP\Server;
+
+/**
+ * @SuppressWarnings(PHPMD.StaticAccess) Server::get() is the only way in from a test.
+ */
+class RoleFeaturePermissionDatabaseTest extends RealDatabaseTestCase {
+	/**
+	 * A new permission row is stored with every required column filled.
+	 *
+	 * @return void
+	 */
+	public function testANewPermissionIsStoredWithItsName(): void {
+		$groupId = $this->uniqueId(prefix: 'db-group');
+		$this->cleanup(fn () => $this->deleteRows('launchpad_role_feat_perms', 'group_id', $groupId));
+
+		Server::get(RoleFeaturePermissionService::class)->savePermission(
+			data: ['groupId' => $groupId, 'name' => 'Database probe', 'allowedWidgets' => ['activity']]
+		);
+
+		$rows = $this->storedRows('launchpad_role_feat_perms', 'group_id', $groupId);
+		$this->assertCount(1, $rows, 'the permission was not stored');
+		$this->assertColumnsFilled(row: $rows[0], columns: ['group_id', 'name']);
+	}//end testANewPermissionIsStoredWithItsName()
+
+	/**
+	 * A new permission without a name is refused as a missing field, not by the database.
+	 *
+	 * @return void
+	 */
+	public function testANewPermissionWithoutANameIsRefusedBeforeTheInsert(): void {
+		$groupId = $this->uniqueId(prefix: 'db-group');
+		$this->cleanup(fn () => $this->deleteRows('launchpad_role_feat_perms', 'group_id', $groupId));
+
+		$this->expectException(InvalidArgumentException::class);
+		$this->expectExceptionMessage('name is required');
+
+		Server::get(RoleFeaturePermissionService::class)->savePermission(
+			data: ['groupId' => $groupId, 'allowedWidgets' => ['activity']]
+		);
+	}//end testANewPermissionWithoutANameIsRefusedBeforeTheInsert()
+
+	/**
+	 * A new layout default without a name is refused as a missing field.
+	 *
+	 * @return void
+	 */
+	public function testANewLayoutDefaultWithoutANameIsRefusedBeforeTheInsert(): void {
+		$groupId = $this->uniqueId(prefix: 'db-group');
+		$this->cleanup(fn () => $this->deleteRows('launchpad_role_layout_def', 'group_id', $groupId));
+
+		$this->expectException(InvalidArgumentException::class);
+		$this->expectExceptionMessage('name is required');
+
+		Server::get(RoleFeaturePermissionService::class)->saveLayoutDefault(
+			data: [
+				'groupId' => $groupId,
+				'widgetId' => 'activity',
+				'gridX' => 0,
+				'gridY' => 0,
+				'gridWidth' => 4,
+				'gridHeight' => 4,
+			]
+		);
+	}//end testANewLayoutDefaultWithoutANameIsRefusedBeforeTheInsert()
+
+	/**
+	 * A new layout default with a name is stored with every required column filled.
+	 *
+	 * @return void
+	 */
+	public function testANewLayoutDefaultIsStoredWithItsName(): void {
+		$groupId = $this->uniqueId(prefix: 'db-group');
+		$this->cleanup(fn () => $this->deleteRows('launchpad_role_layout_def', 'group_id', $groupId));
+
+		Server::get(RoleFeaturePermissionService::class)->saveLayoutDefault(
+			data: [
+				'groupId' => $groupId,
+				'name' => 'Database probe',
+				'widgetId' => 'activity',
+				'gridX' => 0,
+				'gridY' => 0,
+				'gridWidth' => 4,
+				'gridHeight' => 4,
+			]
+		);
+
+		$rows = $this->storedRows('launchpad_role_layout_def', 'group_id', $groupId);
+		$this->assertCount(1, $rows, 'the layout default was not stored');
+		$this->assertColumnsFilled(row: $rows[0], columns: ['group_id', 'name', 'widget_id']);
+	}//end testANewLayoutDefaultIsStoredWithItsName()
+}//end class
diff --git a/tests/Unit/Database/WidgetPlacementWriteDatabaseTest.php b/tests/Unit/Database/WidgetPlacementWriteDatabaseTest.php
new file mode 100644
index 000000000..1b952fc5a
--- /dev/null
+++ b/tests/Unit/Database/WidgetPlacementWriteDatabaseTest.php
@@ -0,0 +1,60 @@
+<?php
+
+/**
+ * WidgetPlacementWriteDatabaseTest
+ *
+ * Adding a widget, through PlacementService, against a real database: the
+ * stored placement must carry every column the table requires.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Database
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Database;
+
+use OCA\LaunchPad\Service\DashboardService;
+use OCA\LaunchPad\Service\PlacementService;
+use OCP\Server;
+
+/**
+ * @SuppressWarnings(PHPMD.StaticAccess) Server::get() is the only way in from a test.
+ */
+class WidgetPlacementWriteDatabaseTest extends RealDatabaseTestCase {
+	/**
+	 * An added widget is stored with every required column filled.
+	 *
+	 * @return void
+	 */
+	public function testAddWidgetStoresEveryRequiredColumn(): void {
+		$dashboard = Server::get(DashboardService::class)->createDashboard(
+			userId: $this->uniqueId(prefix: 'db-owner'),
+			name: 'Placement write test'
+		);
+		$dashboardId = (int)$dashboard->getId();
+		$this->cleanup(function () use ($dashboardId): void {
+			$this->deleteRows('launchpad_widget_placements', 'dashboard_id', $dashboardId);
+			$this->deleteRows('launchpad_dashboards', 'id', $dashboardId);
+		});
+
+		$placement = Server::get(PlacementService::class)->addWidget(
+			dashboardId: $dashboardId,
+			widgetId: 'activity'
+		);
+
+		$rows = $this->storedRows('launchpad_widget_placements', 'id', (int)$placement->getId());
+		$this->assertCount(1, $rows, 'the placement was not stored');
+		$this->assertColumnsFilled(
+			row: $rows[0],
+			columns: ['dashboard_id', 'widget_id', 'created_at', 'updated_at']
+		);
+		$this->assertSame('activity', $rows[0]['widget_id']);
+	}//end testAddWidgetStoresEveryRequiredColumn()
+}//end class
diff --git a/tests/Unit/Event/DashboardDeletedEventTest.php b/tests/Unit/Event/DashboardDeletedEventTest.php
index e80e2449e..a2b23b001 100644
--- a/tests/Unit/Event/DashboardDeletedEventTest.php
+++ b/tests/Unit/Event/DashboardDeletedEventTest.php
@@ -92,4 +92,31 @@ public function testExtendsNextcloudEventBase(): void {
 
 		$this->assertInstanceOf(expected: Event::class, actual: $event);
 	}//end testExtendsNextcloudEventBase()
+
+	/**
+	 * REQ-CSC-001: the event carries the deleted row's id when given, else null.
+	 *
+	 * Listeners on tables keyed by `dashboard_id` need it, because the row is
+	 * already gone when the event fires.
+	 *
+	 * @return void
+	 */
+	public function testCarriesTheDashboardIdWhenGivenAndNullOtherwise(): void {
+		$withId = new DashboardDeletedEvent(
+			dashboardUuid: 'x',
+			ownerUserId: 'y',
+			type: 'user',
+			deletedAt: new DateTimeImmutable(),
+			dashboardId: 42,
+		);
+		$withoutId = new DashboardDeletedEvent(
+			dashboardUuid: 'x',
+			ownerUserId: 'y',
+			type: 'user',
+			deletedAt: new DateTimeImmutable(),
+		);
+
+		$this->assertSame(expected: 42, actual: $withId->getDashboardId());
+		$this->assertNull(actual: $withoutId->getDashboardId());
+	}//end testCarriesTheDashboardIdWhenGivenAndNullOtherwise()
 }//end class
diff --git a/tests/Unit/Listener/DashboardSharesCascadeDatabaseTest.php b/tests/Unit/Listener/DashboardSharesCascadeDatabaseTest.php
new file mode 100644
index 000000000..c37c72b96
--- /dev/null
+++ b/tests/Unit/Listener/DashboardSharesCascadeDatabaseTest.php
@@ -0,0 +1,122 @@
+<?php
+
+/**
+ * DashboardSharesCascadeDatabaseTest
+ *
+ * Row-level proof that deleting a dashboard removes its user and group
+ * shares (dashboard-cascade-events REQ-CSC-002, REQ-CSC-003), through the
+ * real delete path: `DashboardService::deleteDashboard()`, the real
+ * dispatcher and the real cascade listeners, against a real database.
+ *
+ * It needs a live Nextcloud database. phpunit.xml sets PHPUNIT_USE_NC_BOOTSTRAP=1,
+ * so it runs wherever this tree sits inside an installed instance, which is
+ * what CI's PHPUnit job is. This used to say it skipped in CI: it did, until
+ * that line was added. A plain clone still skips it. The e2e twin is
+ * "deleting a dashboard removes its user and group shares" in
+ * tests/e2e/ci/dashboard-share-api.spec.ts.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Listener
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Listener;
+
+use OCA\LaunchPad\Db\DashboardMapper;
+use OCA\LaunchPad\Db\DashboardShare;
+use OCA\LaunchPad\Db\DashboardShareMapper;
+use OCA\LaunchPad\Service\DashboardFactory;
+use OCA\LaunchPad\Service\DashboardService;
+use OCP\DB\QueryBuilder\IQueryBuilder;
+use OCP\IDBConnection;
+use OCP\Server;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @SuppressWarnings(PHPMD.StaticAccess) Server::get() is the only way in from a test.
+ */
+class DashboardSharesCascadeDatabaseTest extends TestCase {
+	/**
+	 * Skip unless a live Nextcloud (and so a live database) is bootstrapped.
+	 *
+	 * @return void
+	 */
+	protected function setUp(): void {
+		parent::setUp();
+
+		if (class_exists(class: '\OC', autoload: false) === false) {
+			$this->markTestSkipped(
+				message: 'Needs a live Nextcloud database. CI boots one (phpunit.xml sets '
+				. 'PHPUNIT_USE_NC_BOOTSTRAP=1); a plain clone does not.'
+			);
+		}
+	}//end setUp()
+
+	/**
+	 * Delete a dashboard that has a user share and a group share; both rows go.
+	 *
+	 * @return void
+	 */
+	public function testDeletingADashboardRemovesItsUserAndGroupShares(): void {
+		$dashboards = Server::get(DashboardMapper::class);
+		$shares = Server::get(DashboardShareMapper::class);
+		$owner = 'cascade-owner-' . bin2hex(random_bytes(4));
+
+		$dashboard = $dashboards->insert(
+			Server::get(DashboardFactory::class)->create(userId: $owner, name: 'Cascade test')
+		);
+		$dashboardId = (int)$dashboard->getId();
+
+		try {
+			foreach ([['user', 'cascade-recipient'], ['group', 'cascade-group']] as [$type, $with]) {
+				$share = new DashboardShare();
+				$share->setDashboardId($dashboardId);
+				$share->setShareType($type);
+				$share->setShareWith($with);
+				$share->setPermissionLevel('view_only');
+				$share->setCreatedAt(gmdate(format: 'Y-m-d H:i:s'));
+				$share->setUpdatedAt(gmdate(format: 'Y-m-d H:i:s'));
+				$shares->insert($share);
+			}
+
+			$this->assertSame(2, $this->countShares(dashboardId: $dashboardId), 'CONTROL: both shares exist before the delete');
+
+			Server::get(DashboardService::class)->deleteDashboard(dashboardId: $dashboardId, userId: $owner);
+
+			$this->assertSame(
+				0,
+				$this->countShares(dashboardId: $dashboardId),
+				'deleting the dashboard left its user and group shares behind'
+			);
+		} finally {
+			// Leaves nothing behind whether or not the assertion held.
+			$shares->deleteByDashboardId(dashboardId: $dashboardId);
+		}//end try
+	}//end testDeletingADashboardRemovesItsUserAndGroupShares()
+
+	/**
+	 * Count the share rows pointing at a dashboard id.
+	 *
+	 * @param int $dashboardId The dashboard id.
+	 *
+	 * @return int The row count.
+	 */
+	private function countShares(int $dashboardId): int {
+		$qb = Server::get(IDBConnection::class)->getQueryBuilder();
+		$qb->select($qb->func()->count('*', 'n'))
+			->from('launchpad_dashboard_shares')
+			->where($qb->expr()->eq('dashboard_id', $qb->createNamedParameter($dashboardId, IQueryBuilder::PARAM_INT)));
+		$result = $qb->executeQuery();
+		$count = (int)$result->fetchOne();
+		$result->closeCursor();
+
+		return $count;
+	}//end countShares()
+}//end class
diff --git a/tests/Unit/Listener/DashboardSharesListenerTest.php b/tests/Unit/Listener/DashboardSharesListenerTest.php
new file mode 100644
index 000000000..9fa340818
--- /dev/null
+++ b/tests/Unit/Listener/DashboardSharesListenerTest.php
@@ -0,0 +1,182 @@
+<?php
+
+/**
+ * DashboardSharesListenerTest
+ *
+ * Unit tests for {@see \OCA\LaunchPad\Listener\DashboardSharesListener}, the
+ * cascade listener that deletes a deleted dashboard's user and group shares
+ * (dashboard-cascade-events REQ-CSC-002, REQ-CSC-003, REQ-CSC-006).
+ *
+ * The row-level proof, a real dashboard with a real user share and group
+ * share deleted through DashboardService, is
+ * DashboardSharesCascadeDatabaseTest, which needs a live database. This file
+ * pins the two things a database test cannot isolate: that the listener keys
+ * on the event's ID, and that it is actually registered.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Listener
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Listener;
+
+use DateTimeImmutable;
+use OCA\LaunchPad\AppInfo\Application;
+use OCA\LaunchPad\Db\DashboardShareMapper;
+use OCA\LaunchPad\Event\DashboardDeletedEvent;
+use OCA\LaunchPad\Listener\DashboardSharesListener;
+use OCP\AppFramework\Bootstrap\IRegistrationContext;
+use OCP\EventDispatcher\Event;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+use ReflectionClass;
+use RuntimeException;
+
+/**
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects) Mirrors the collaborators.
+ */
+class DashboardSharesListenerTest extends TestCase {
+	/** @var DashboardShareMapper&MockObject */
+	private $shareMapper;
+
+	/** @var LoggerInterface&MockObject */
+	private $logger;
+
+	/**
+	 * Build the collaborators every test shares.
+	 *
+	 * @return void
+	 */
+	protected function setUp(): void {
+		parent::setUp();
+
+		$this->shareMapper = $this->createMock(originalClassName: DashboardShareMapper::class);
+		$this->logger = $this->createMock(originalClassName: LoggerInterface::class);
+	}//end setUp()
+
+	/**
+	 * Build a deletion event.
+	 *
+	 * @param int|null $dashboardId The deleted row's id, or null.
+	 *
+	 * @return DashboardDeletedEvent
+	 */
+	private function event(?int $dashboardId): DashboardDeletedEvent {
+		return new DashboardDeletedEvent(
+			dashboardUuid: 'abc-123',
+			ownerUserId: 'alice',
+			type: 'user',
+			deletedAt: new DateTimeImmutable(),
+			dashboardId: $dashboardId,
+		);
+	}//end event()
+
+	/**
+	 * The listener under test.
+	 *
+	 * @return DashboardSharesListener
+	 */
+	private function listener(): DashboardSharesListener {
+		return new DashboardSharesListener(
+			shareMapper: $this->shareMapper,
+			logger: $this->logger
+		);
+	}//end listener()
+
+	/**
+	 * With an id on the event, shares are deleted BY ID and never by UUID.
+	 *
+	 * The UUID path translates through `oc_launchpad_dashboards`, and every
+	 * dispatcher fires after that row is gone, so taking it would delete zero
+	 * rows. This is the assertion that fails if the listener regresses to it.
+	 *
+	 * @return void
+	 */
+	public function testDeletesByTheIdTheEventCarries(): void {
+		$this->shareMapper->expects($this->once())
+			->method('deleteByDashboardId')
+			->with(42)
+			->willReturn(2);
+		$this->shareMapper->expects($this->never())->method('deleteByDashboardUuid');
+
+		$this->listener()->handle(event: $this->event(dashboardId: 42));
+	}//end testDeletesByTheIdTheEventCarries()
+
+	/**
+	 * Without an id, it falls back to the UUID, which works while the row exists.
+	 *
+	 * @return void
+	 */
+	public function testFallsBackToTheUuidWhenTheEventCarriesNoId(): void {
+		$this->shareMapper->expects($this->never())->method('deleteByDashboardId');
+		$this->shareMapper->expects($this->once())
+			->method('deleteByDashboardUuid')
+			->with('abc-123')
+			->willReturn(1);
+
+		$this->listener()->handle(event: $this->event(dashboardId: null));
+	}//end testFallsBackToTheUuidWhenTheEventCarriesNoId()
+
+	/**
+	 * REQ-CSC-006: a failing delete is logged and swallowed, never rethrown.
+	 *
+	 * @return void
+	 */
+	public function testAFailingDeleteIsLoggedAndDoesNotStopPeerListeners(): void {
+		$this->shareMapper->method('deleteByDashboardId')
+			->willThrowException(new RuntimeException(message: 'db gone'));
+		$this->logger->expects($this->once())->method('warning');
+
+		$this->listener()->handle(event: $this->event(dashboardId: 42));
+	}//end testAFailingDeleteIsLoggedAndDoesNotStopPeerListeners()
+
+	/**
+	 * Any other event is ignored.
+	 *
+	 * @return void
+	 */
+	public function testIgnoresOtherEvents(): void {
+		$this->shareMapper->expects($this->never())->method('deleteByDashboardId');
+		$this->shareMapper->expects($this->never())->method('deleteByDashboardUuid');
+
+		$this->listener()->handle(event: new Event());
+	}//end testIgnoresOtherEvents()
+
+	/**
+	 * REQ-CSC-002: the listener is registered for DashboardDeletedEvent.
+	 *
+	 * A listener class nobody registers deletes nothing, and every test above
+	 * would still pass. So this runs the real `Application::register()`
+	 * against a recording context. The constructor is skipped because
+	 * `App::__construct()` needs a live server, and `register()` touches only
+	 * the context it is given.
+	 *
+	 * @return void
+	 */
+	public function testIsRegisteredForDashboardDeletedEvent(): void {
+		$registered = [];
+		$context = $this->createMock(originalClassName: IRegistrationContext::class);
+		$context->method('registerEventListener')->willReturnCallback(
+			static function (string $event, string $listener) use (&$registered): void {
+				$registered[] = [$event, $listener];
+			}
+		);
+
+		$application = (new ReflectionClass(objectOrClass: Application::class))->newInstanceWithoutConstructor();
+		$application->register(context: $context);
+
+		$this->assertContains(
+			needle: [DashboardDeletedEvent::class, DashboardSharesListener::class],
+			haystack: $registered,
+			message: 'DashboardSharesListener is not registered for DashboardDeletedEvent'
+		);
+	}//end testIsRegisteredForDashboardDeletedEvent()
+}//end class
diff --git a/tests/Unit/Service/AdminSettingsServiceTest.php b/tests/Unit/Service/AdminSettingsServiceTest.php
index 97d26194b..72b15535c 100644
--- a/tests/Unit/Service/AdminSettingsServiceTest.php
+++ b/tests/Unit/Service/AdminSettingsServiceTest.php
@@ -51,6 +51,40 @@ public function testGetSettingsReturnsDefaults(): void {
 		);
 	}//end testGetSettingsReturnsDefaults()
 
+	/**
+	 * REQ-ASET-001 "Settings response format consistency": the response holds
+	 * exactly the twelve documented keys, each at its documented default.
+	 *
+	 * The spec said "exactly four keys" long after the response had grown to
+	 * twelve, because nothing compared the two. This pins the whole response,
+	 * so a key added to getSettings() without the spec (and this list) fails
+	 * here by name.
+	 *
+	 * @return void
+	 */
+	public function testGetSettingsReturnsExactlyTheDocumentedKeysAtTheirDefaults(): void {
+		$this->settingMapper->method('getAllAsArray')->willReturn([]);
+
+		$this->assertSame(
+			[
+				'defaultPermissionLevel' => 'add_only',
+				'allowUserDashboards' => false,
+				'allowMultipleDashboards' => true,
+				'defaultGridColumns' => 12,
+				'linkCreateFileExtensions' => ['txt', 'md', 'docx', 'xlsx', 'csv', 'odt'],
+				'launchpad.content_storage' => 'database',
+				'defaultSharePermissionLevel' => 'add_only',
+				'forcedShareGroups' => [],
+				'legacyWidgetBridgeEnabled' => false,
+				'maxDashboardsPerUser' => 0,
+				'maxWidgetsPerDashboard' => 0,
+				'quicksearchFallbackTarget' => 'none',
+			],
+			$this->service->getSettings(),
+			'GET /api/admin/settings no longer matches REQ-ASET-001; update the spec and this list together'
+		);
+	}//end testGetSettingsReturnsExactlyTheDocumentedKeysAtTheirDefaults()
+
 	public function testGetSettingsReturnsStoredValues(): void {
 		$this->settingMapper->method('getAllAsArray')->willReturn(
 			[
diff --git a/tests/Unit/Service/DemoShowcasesServiceTest.php b/tests/Unit/Service/DemoShowcasesServiceTest.php
index f561bb8ab..2f11edfcd 100644
--- a/tests/Unit/Service/DemoShowcasesServiceTest.php
+++ b/tests/Unit/Service/DemoShowcasesServiceTest.php
@@ -363,6 +363,130 @@ public function testPartitionWidgetsTreatsTilesAsValid(): void {
 		$this->assertSame(expected: ['unknown-id'], actual: $skipped);
 	}
 
+	/**
+	 * REQ-DEMO-005: installing the REAL bundled `case-handler` archive places
+	 * all four of its widgets, configured.
+	 *
+	 * This runs the install path, not just the zip. The earlier archive tests
+	 * opened `case-handler.zip` and checked its shape, which is how a showcase
+	 * that installed with ZERO widgets passed the suite: `partitionWidgets()`
+	 * knew only tiles and Nextcloud dashboard ids, and all four widgets here
+	 * are LaunchPad types (`object-list`, `nc-widget`, `calendar`). Measured
+	 * in CI on launchpad#606: `skippedWidgets` was all four.
+	 *
+	 * The Nextcloud registry is empty on purpose. That is the CI instance
+	 * (no Tasks, no Mail installed), and it proves the two `nc-widget`
+	 * proxies are kept on their TYPE rather than on whether their target app
+	 * is present.
+	 *
+	 * The content assertions guard the second half of the same defect:
+	 * `buildPlacement()` did not copy `content`, so even a kept widget would
+	 * have landed without knowing what to show.
+	 *
+	 * @return void
+	 */
+	public function testInstallingTheRealCaseHandlerArchivePlacesAllFourWidgets(): void {
+		$this->service->setDataDirForTesting(
+			path: dirname(path: __DIR__, levels: 3) . '/data/demo-showcases'
+		);
+
+		$this->dashboardManager->method('getWidgets')->willReturn([]);
+		$this->appConfig->method('getValueString')->willReturn('');
+
+		$persisted = new Dashboard();
+		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$persisted->setId(55);
+		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$persisted->setUuid('installed-case-handler');
+		$this->dashboardMapper->method('insert')->willReturn($persisted);
+
+		$placed = [];
+		$this->placementMapper->method('insert')->willReturnCallback(
+			static function (WidgetPlacement $placement) use (&$placed): WidgetPlacement {
+				$placed[] = $placement;
+				return $placement;
+			}
+		);
+
+		$result = $this->service->installShowcase(showcaseId: 'case-handler', lang: 'en');
+
+		$this->assertSame(
+			expected: [],
+			actual: $result['skippedWidgets'],
+			message: 'the case-handler install dropped widgets it can render'
+		);
+		$this->assertSame(
+			expected: ['object-list', 'nc-widget', 'calendar', 'nc-widget'],
+			actual: array_map(
+				callback: static fn (WidgetPlacement $p): string => (string)$p->getWidgetId(),
+				array: $placed
+			),
+			message: 'the install must write the four case-handler widgets, in order'
+		);
+
+		$contents = array_map(
+			callback: static fn (WidgetPlacement $p): array => $p->getContentArray(),
+			array: $placed
+		);
+		$this->assertSame(expected: 'dossiq', actual: $contents[0]['register'] ?? null);
+		$this->assertSame(expected: 'case', actual: $contents[0]['schema'] ?? null);
+		$this->assertSame(expected: 'tasks', actual: $contents[1]['widgetId'] ?? null);
+		$this->assertArrayHasKey(key: 'internalCalendars', array: $contents[2]);
+		$this->assertSame(expected: 'mail-unread', actual: $contents[3]['widgetId'] ?? null);
+	}//end testInstallingTheRealCaseHandlerArchivePlacesAllFourWidgets()
+
+	/**
+	 * REQ-DEMO-005: a Nextcloud widget id whose app is not installed is still
+	 * skipped, next to LaunchPad types that are kept.
+	 *
+	 * Admitting LaunchPad's own types must not turn the filter into "keep
+	 * everything". `mail-unread` is a real Nextcloud dashboard widget, absent
+	 * from this registry the way it is on an instance without the Mail app;
+	 * that is the case the skip exists for. `recommendations` is registered
+	 * and kept, `text` is a LaunchPad type and kept.
+	 *
+	 * @return void
+	 */
+	public function testInstallStillSkipsANextcloudWidgetWhoseAppIsMissing(): void {
+		$this->writeFixtureZip(
+			showcaseId: 'de-bron',
+			manifest: ['schemaVersion' => 1, 'showcaseName' => 'De Bron', 'showcaseLanguage' => 'nl'],
+			dashboardPayload: $this->validDashboardPayload(
+				uuid: 'src-uuid',
+				widgets: [
+					['widgetId' => 'text', 'content' => ['text' => 'Hello']],
+					['widgetId' => 'mail-unread', 'gridX' => 4],
+					['widgetId' => 'recommendations', 'gridX' => 8],
+				]
+			),
+		);
+
+		$registered = $this->createMock(originalClassName: IWidget::class);
+		$registered->method('getId')->willReturn('recommendations');
+		$this->dashboardManager->method('getWidgets')->willReturn([$registered]);
+		$this->appConfig->method('getValueString')->willReturn('');
+
+		$persisted = new Dashboard();
+		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$persisted->setId(8);
+		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$persisted->setUuid('installed-uuid');
+		$this->dashboardMapper->method('insert')->willReturn($persisted);
+
+		$placed = [];
+		$this->placementMapper->method('insert')->willReturnCallback(
+			static function (WidgetPlacement $placement) use (&$placed): WidgetPlacement {
+				$placed[] = (string)$placement->getWidgetId();
+				return $placement;
+			}
+		);
+
+		$result = $this->service->installShowcase(showcaseId: 'de-bron');
+
+		$this->assertSame(expected: ['mail-unread'], actual: $result['skippedWidgets']);
+		$this->assertSame(expected: ['text', 'recommendations'], actual: $placed);
+	}//end testInstallStillSkipsANextcloudWidgetWhoseAppIsMissing()
+
 	private function validDashboardPayload(string $uuid, array $widgets): array {
 		return [
 			'uuid' => $uuid,
@@ -393,6 +517,202 @@ private function writeFixtureZip(string $showcaseId, array $manifest, array $das
 		$zip->close();
 	}
 
+	/**
+	 * REQ-DEMO-001: every bundled id resolves to a REAL archive that
+	 * carries the manifest fields the gallery reads.
+	 *
+	 * Every other test in this file writes its own fixture ZIP into a temp
+	 * directory, which is right for exercising the service but means the
+	 * archives actually shipped in `data/demo-showcases/` were never opened
+	 * by any test. A showcase added to `BUNDLED_IDS` with a missing,
+	 * malformed or mis-named ZIP would therefore pass the whole suite and
+	 * fail on a user's instance, where the only symptom is a gallery entry
+	 * that will not install.
+	 *
+	 * @return void
+	 */
+	public function testEveryBundledIdShipsAReadableArchive(): void {
+		$root = dirname(path: __DIR__, levels: 3) . '/data/demo-showcases';
+
+		foreach (DemoShowcasesService::BUNDLED_IDS as $showcaseId) {
+			$path = $root . '/' . $showcaseId . '/' . $showcaseId . '.zip';
+			$this->assertFileExists(
+				filename: $path,
+				message: $showcaseId . ' is in BUNDLED_IDS but ships no archive'
+			);
+
+			$zip = new \ZipArchive();
+			$this->assertTrue(
+				condition: $zip->open(filename: $path) === true,
+				message: $showcaseId . ' archive is not a readable ZIP'
+			);
+
+			$raw = $zip->getFromName(name: 'manifest.json');
+			$this->assertNotFalse($raw, $showcaseId . ' has no manifest.json');
+
+			$manifest = json_decode(json: (string)$raw, associative: true);
+			$this->assertIsArray(actual: $manifest, message: $showcaseId . ' manifest.json is not JSON');
+
+			// The id has to agree with where the file was found, or the
+			// gallery lists one showcase and installs another.
+			$this->assertSame(
+				expected: $showcaseId,
+				actual: $manifest['showcaseId'] ?? null,
+				message: $showcaseId . ' manifest declares a different showcaseId'
+			);
+
+			foreach (['showcaseName', 'showcaseDescription', 'showcaseLanguage', 'schemaVersion'] as $key) {
+				$this->assertArrayHasKey(
+					key: $key,
+					array: $manifest,
+					message: $showcaseId . ' manifest is missing ' . $key
+				);
+			}
+
+			$dashboards = [];
+			for ($i = 0; $i < $zip->numFiles; $i++) {
+				$name = (string)$zip->getNameIndex(index: $i);
+				if (str_starts_with(haystack: $name, needle: 'dashboards/') === true
+					&& str_ends_with(haystack: $name, needle: '.json') === true
+				) {
+					$dashboards[] = $name;
+				}
+			}
+
+			$this->assertCount(
+				expectedCount: (int)($manifest['dashboardCount'] ?? 0),
+				haystack: $dashboards,
+				message: $showcaseId . ' ships a different number of dashboards than it declares'
+			);
+
+			$zip->close();
+		}//end foreach
+	}//end testEveryBundledIdShipsAReadableArchive()
+
+	/**
+	 * REQ-DEMO-001: the role showcase installs as a read-only group
+	 * dashboard, and places the four widgets a case handler works from.
+	 *
+	 * A showcase is authored on somebody's instance as their PERSONAL
+	 * dashboard. Shipping that shape would hand every installing admin a
+	 * dashboard owned by a user id that does not exist there, so the
+	 * re-shaping to `group_shared` is the part worth pinning.
+	 *
+	 * @return void
+	 */
+	public function testCaseHandlerShowcaseIsAReadOnlyGroupDashboard(): void {
+		$root = dirname(path: __DIR__, levels: 3) . '/data/demo-showcases';
+		$zip = new \ZipArchive();
+		$this->assertTrue(condition: $zip->open(filename: $root . '/case-handler/case-handler.zip') === true);
+
+		$payload = null;
+		for ($i = 0; $i < $zip->numFiles; $i++) {
+			$name = (string)$zip->getNameIndex(index: $i);
+			if (str_starts_with(haystack: $name, needle: 'dashboards/') === true
+				&& str_ends_with(haystack: $name, needle: '.json') === true
+			) {
+				$payload = json_decode(json: (string)$zip->getFromName(name: $name), associative: true);
+				break;
+			}
+		}
+
+		$zip->close();
+		$this->assertIsArray(actual: $payload, message: 'case-handler ships no dashboard payload');
+
+		$this->assertSame(expected: 'group_shared', actual: $payload['type'] ?? null);
+		$this->assertArrayHasKey(key: 'userId', array: $payload);
+		$this->assertNull(actual: $payload['userId'], message: 'a showcase must not carry its author');
+		$this->assertSame(expected: 'view_only', actual: $payload['permissionLevel'] ?? null);
+		$this->assertSame(expected: 'showcase-case-handler', actual: $payload['slug'] ?? null);
+
+		$types = array_map(
+			callback: static fn (array $w) => $w['widgetId'] ?? '',
+			array: ($payload['widgets'] ?? [])
+		);
+		$this->assertCount(expectedCount: 4, haystack: $types);
+		$this->assertSame(
+			expected: ['object-list', 'nc-widget', 'calendar', 'nc-widget'],
+			actual: $types,
+			message: 'the case handler dashboard places cases, tasks, today and mail'
+		);
+
+		// The calendar widget must ship with NO calendar chosen: the ids on
+		// the authoring instance mean nothing anywhere else, and pointing a
+		// stranger's widget at calendar "1" is worse than asking them.
+		$calendar = null;
+		foreach (($payload['widgets'] ?? []) as $widget) {
+			if (($widget['widgetId'] ?? '') === 'calendar') {
+				$calendar = $widget;
+				break;
+			}
+		}
+
+		$this->assertIsArray(actual: $calendar);
+		$this->assertSame(expected: [], actual: $calendar['content']['internalCalendars'] ?? null);
+	}//end testCaseHandlerShowcaseIsAReadOnlyGroupDashboard()
+
+	/**
+	 * Every bundled id ships the preview image the gallery asks for.
+	 *
+	 * `IURLGenerator::imagePath()` THROWS for an image that does not exist,
+	 * and the setUp() stand-in above always returns a string, so no unit test
+	 * here could see it. CI's Newman lane did: adding `case-handler` without
+	 * `img/showcases/case-handler.png` turned GET /api/admin/demo-showcases
+	 * into a 500 for every showcase, not just the new one.
+	 *
+	 * @return void
+	 */
+	public function testEveryBundledIdShipsAPreviewImage(): void {
+		$root = dirname(path: __DIR__, levels: 3) . '/img/showcases';
+		foreach (DemoShowcasesService::BUNDLED_IDS as $showcaseId) {
+			$this->assertFileExists(
+				filename: $root . '/' . $showcaseId . '.png',
+				message: $showcaseId . ' is in BUNDLED_IDS but has no img/showcases preview'
+			);
+		}
+	}//end testEveryBundledIdShipsAPreviewImage()
+
+	/**
+	 * A showcase with no preview still lists, with a null thumbnail.
+	 *
+	 * The guard above keeps the bundled set honest; this one keeps the
+	 * listing standing when it is not. One missing image is a cosmetic gap
+	 * in one card, not a reason to hide every other showcase behind a 500.
+	 *
+	 * @return void
+	 */
+	public function testAMissingPreviewDoesNotFailTheListing(): void {
+		$throwing = $this->createMock(originalClassName: IURLGenerator::class);
+		$throwing->method('imagePath')->willThrowException(
+			new \RuntimeException('image not found: image:showcases/de-bron.png webroot: serverroot:')
+		);
+
+		$service = new DemoShowcasesService(
+			dashboardMapper: $this->dashboardMapper,
+			placementMapper: $this->placementMapper,
+			db: $this->db,
+			appConfig: $this->appConfig,
+			dashboardManager: $this->dashboardManager,
+			logger: new NullLogger(),
+			lockingProvider: $this->lockingProvider,
+			urlGenerator: $throwing,
+		);
+		$service->setDataDirForTesting(path: $this->fixtureDir);
+
+		$this->writeFixtureZip(
+			showcaseId: 'de-bron',
+			manifest: ['schemaVersion' => 1, 'showcaseName' => 'De Bron', 'showcaseLanguage' => 'nl'],
+			dashboardPayload: $this->validDashboardPayload(uuid: 'a-uuid', widgets: []),
+		);
+		$this->appConfig->method('getValueString')->willReturn('');
+
+		$row = $service->describeShowcase(showcaseId: 'de-bron');
+
+		$this->assertIsArray(actual: $row, message: 'a missing preview must not drop the showcase');
+		$this->assertSame(expected: 'de-bron', actual: $row['id']);
+		$this->assertNull(actual: $row['thumbnailUrl']);
+	}//end testAMissingPreviewDoesNotFailTheListing()
+
 	private function rrmdir(string $dir): void {
 		if (is_dir(filename: $dir) === false) {
 			return;
diff --git a/tests/Unit/Service/ExportServiceTest.php b/tests/Unit/Service/ExportServiceTest.php
index b5b366a79..b0112c153 100644
--- a/tests/Unit/Service/ExportServiceTest.php
+++ b/tests/Unit/Service/ExportServiceTest.php
@@ -179,6 +179,54 @@ public function testExportDashboardProducesValidArchive(): void {
 		@unlink(filename: $tempPath);
 	}
 
+	/**
+	 * REQ-EXIM-003 "Empty instance site export": an instance with no dashboards
+	 * still exports a valid archive.
+	 *
+	 * No e2e can arrange this: the suite shares an instance with every other
+	 * spec's fixtures, and emptying it would be destroying their data.
+	 *
+	 * @return void
+	 */
+	public function testEmptySiteExportIsAValidArchiveWithNoDashboards(): void {
+		$this->dashboardMapper->method('findAdminTemplates')->willReturn([]);
+		$this->dashboardMapper->method('findByParent')->willReturn([]);
+		$this->dashboardMapper->method('findDescendants')->willReturn([]);
+		$this->groupManager->method('search')->willReturn([]);
+		$this->placementMapper->method('findByDashboardId')->willReturn([]);
+
+		$response = $this->service->exportSite(currentUserId: 'admin');
+
+		$reflection = new \ReflectionObject(object: $response);
+		$prop = $reflection->getProperty(name: 'filePath');
+		$prop->setAccessible(accessible: true);
+		$tempPath = (string)$prop->getValue(object: $response);
+
+		$zip = new ZipArchive();
+		$this->assertTrue(condition: $zip->open(filename: $tempPath) === true);
+
+		/** @var array<string, mixed> $manifest */
+		$manifest = json_decode(
+			json: (string)$zip->getFromName(name: 'manifest.json'),
+			associative: true
+		);
+		$this->assertSame(expected: 'site', actual: $manifest['scope']);
+		$this->assertSame(expected: 0, actual: $manifest['dashboardCount']);
+
+		$dashboards = [];
+		for ($i = 0; $i < $zip->numFiles; $i++) {
+			$name = (string)$zip->getNameIndex(index: $i);
+			if (str_starts_with(haystack: $name, needle: 'dashboards/') === true
+				&& str_ends_with(haystack: $name, needle: '.json') === true
+			) {
+				$dashboards[] = $name;
+			}
+		}
+
+		$this->assertSame(expected: [], actual: $dashboards);
+		$zip->close();
+	}//end testEmptySiteExportIsAValidArchiveWithNoDashboards()
+
 	/**
 	 * REQ-EXIM-003: site export aggregates admin templates and personal
 	 * dashboards and stamps the manifest with the count.
diff --git a/tests/Unit/Service/ImportServiceTest.php b/tests/Unit/Service/ImportServiceTest.php
index 6e6b6fb07..60d08b0bc 100644
--- a/tests/Unit/Service/ImportServiceTest.php
+++ b/tests/Unit/Service/ImportServiceTest.php
@@ -25,10 +25,13 @@
 use InvalidArgumentException;
 use OCA\LaunchPad\Db\Dashboard;
 use OCA\LaunchPad\Db\DashboardMapper;
+use OCA\LaunchPad\Db\WidgetPlacement;
 use OCA\LaunchPad\Db\WidgetPlacementMapper;
+use OCA\LaunchPad\Service\ExportService;
 use OCA\LaunchPad\Service\ImportService;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\IDBConnection;
+use OCP\IGroupManager;
 use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;
 use Psr\Log\NullLogger;
@@ -254,6 +257,126 @@ public function testInvalidDashboardSkippedNotFatal(): void {
 		@unlink(filename: $zipPath);
 	}
 
+	/**
+	 * REQ-EXIM-004 "Invalid JSON in dashboard file skips that dashboard": the
+	 * error names the corrupt file.
+	 *
+	 * A file that is not valid JSON has no `uuid` to report, so it used to come
+	 * back as `uuid: ""` with "Missing required field: corrupt JSON payload",
+	 * which identified nothing. The entry name is its only identity, and the
+	 * file name is the exported UUID.
+	 *
+	 * @return void
+	 */
+	public function testACorruptDashboardFileIsNamedInTheError(): void {
+		$good = static fn (string $uuid): string => (string)json_encode(
+			value: ['uuid' => $uuid, 'name' => 'Good ' . $uuid, 'widgets' => []]
+		);
+		$zipPath = $this->makeZip(entries: [
+			'manifest.json' => (string)json_encode(value: ['schemaVersion' => 1, 'scope' => 'site']),
+			'dashboards/good-one.json' => $good('good-one'),
+			'dashboards/broken-uuid.json' => '{"uuid": "broken-uuid", "name": ',
+			'dashboards/good-two.json' => $good('good-two'),
+		]);
+
+		$this->dashboardMapper->method('findByUuid')
+			->willThrowException(exception: new DoesNotExistException(msg: 'no'));
+		$this->dashboardMapper->method('insert')->willReturnCallback(
+			static function (Dashboard $dashboard): Dashboard {
+				// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+				$dashboard->setId(3);
+				return $dashboard;
+			}
+		);
+
+		try {
+			$result = $this->service->import(zipPath: $zipPath, preserveUuids: false, currentUserId: 'admin');
+		} finally {
+			@unlink(filename: $zipPath);
+		}
+
+		$this->assertSame(expected: 2, actual: $result['importedDashboardCount']);
+		$this->assertSame(expected: 1, actual: $result['skippedDashboardCount']);
+		$this->assertCount(expectedCount: 1, haystack: $result['errors']);
+		$this->assertSame(expected: 'broken-uuid', actual: $result['errors'][0]['uuid']);
+		$this->assertSame(
+			expected: 'dashboards/broken-uuid.json is not valid JSON',
+			actual: $result['errors'][0]['message']
+		);
+	}//end testACorruptDashboardFileIsNamedInTheError()
+
+	/**
+	 * REQ-EXIM-008 "Dashboard JSON missing required fields": the error names the
+	 * UUID the ARCHIVE used.
+	 *
+	 * With `preserveUuids=false` every dashboard is given a fresh UUID before
+	 * validation runs, so a skipped dashboard used to be reported under a UUID
+	 * this import had just invented — a row that does not exist, and a name the
+	 * admin cannot find in the file they uploaded. Found by the e2e that drives
+	 * the admin page.
+	 *
+	 * @return void
+	 */
+	public function testASkippedDashboardIsReportedUnderTheArchivesUuid(): void {
+		$zipPath = $this->makeZip(entries: [
+			'manifest.json' => (string)json_encode(value: ['schemaVersion' => 1, 'scope' => 'site']),
+			// No `name`, so validation skips it.
+			'dashboards/nameless.json' => (string)json_encode(
+				value: ['uuid' => 'archive-uuid', 'widgets' => []]
+			),
+		]);
+
+		$this->dashboardMapper->method('findByUuid')
+			->willThrowException(exception: new DoesNotExistException(msg: 'no'));
+
+		try {
+			$result = $this->service->import(zipPath: $zipPath, preserveUuids: false, currentUserId: 'admin');
+		} finally {
+			@unlink(filename: $zipPath);
+		}
+
+		$this->assertSame(expected: 1, actual: $result['skippedDashboardCount']);
+		$this->assertSame(
+			expected: 'archive-uuid',
+			actual: $result['errors'][0]['uuid'],
+			message: 'the error must name the UUID the archive used, not a remapped one'
+		);
+	}//end testASkippedDashboardIsReportedUnderTheArchivesUuid()
+
+	/**
+	 * REQ-EXIM-009 "Version mismatch does not corrupt existing data": an
+	 * archive from a newer LaunchPad tells the admin to upgrade, and a
+	 * nonsense version does not.
+	 *
+	 * @return void
+	 */
+	public function testAnArchiveFromANewerVersionSaysToUpgrade(): void {
+		$messageFor = function (int $version): string {
+			$zipPath = $this->makeZip(entries: [
+				'manifest.json' => (string)json_encode(value: ['schemaVersion' => $version, 'scope' => 'site']),
+			]);
+			try {
+				$this->service->import(zipPath: $zipPath, preserveUuids: false, currentUserId: 'admin');
+			} catch (InvalidArgumentException $e) {
+				return $e->getMessage();
+			} finally {
+				@unlink(filename: $zipPath);
+			}
+
+			return '(no exception)';
+		};
+
+		$this->assertSame(
+			expected: 'Unsupported manifest schema version: 2. Only version 1 is supported. '
+				. 'Upgrade LaunchPad to import archives of version 2.',
+			actual: $messageFor(2)
+		);
+		$this->assertSame(
+			expected: 'Unsupported manifest schema version: 0. Only version 1 is supported.',
+			actual: $messageFor(0)
+		);
+	}//end testAnArchiveFromANewerVersionSaysToUpgrade()
+
 	/**
 	 * REQ-EXIM-011: a corrupt widget JSON triggers a per-dashboard
 	 * rollback while sibling dashboards still import successfully.
@@ -345,6 +468,241 @@ public function testRemapUuidsRewritesParentReferences(): void {
 		);
 	}
 
+	/**
+	 * An imported dashboard and its placements carry the timestamps the
+	 * schema requires.
+	 *
+	 * `created_at` and `updated_at` are NOT NULL without a default on both
+	 * `launchpad_dashboards` (DashboardTableBuilder) and
+	 * `launchpad_widget_placements` (PlacementTableBuilder). The importer set
+	 * neither, so on a real database every dashboard insert failed and was
+	 * reported as skipped: no import had ever landed a dashboard. Measured on
+	 * PostgreSQL as SQLSTATE 23502 on created_at. Every other test in this file
+	 * mocks the mapper and so accepts a row the database would refuse; this
+	 * one looks at the row.
+	 *
+	 * @return void
+	 */
+	public function testAnImportedRowCarriesTheTimestampsTheSchemaRequires(): void {
+		$zipPath = $this->makeZip(entries: [
+			'manifest.json' => (string)json_encode(value: ['schemaVersion' => 1, 'scope' => 'dashboard']),
+			'dashboards/ts-uuid.json' => (string)json_encode(value: [
+				'uuid' => 'ts-uuid',
+				'name' => 'Timestamps',
+				'widgets' => [['widgetId' => 'text', 'content' => ['text' => 'x']]],
+			]),
+		]);
+
+		$this->dashboardMapper->method('findByUuid')
+			->willThrowException(exception: new DoesNotExistException(msg: 'no'));
+
+		$rows = [];
+		$this->dashboardMapper->method('insert')->willReturnCallback(
+			static function (Dashboard $dashboard) use (&$rows): Dashboard {
+				$rows[] = $dashboard;
+				// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+				$dashboard->setId(5);
+				return $dashboard;
+			}
+		);
+		$this->placementMapper->method('insert')->willReturnCallback(
+			static function (WidgetPlacement $placement) use (&$rows): WidgetPlacement {
+				$rows[] = $placement;
+				return $placement;
+			}
+		);
+
+		try {
+			$this->service->import(zipPath: $zipPath, preserveUuids: false, currentUserId: 'admin');
+		} finally {
+			@unlink(filename: $zipPath);
+		}
+
+		$this->assertCount(expectedCount: 2, haystack: $rows, message: 'one dashboard and one placement row');
+		foreach ($rows as $row) {
+			$this->assertNotEmpty(
+				actual: $row->getCreatedAt(),
+				message: get_class($row) . ' reached the mapper without created_at, which the schema declares NOT NULL'
+			);
+			$this->assertNotEmpty(
+				actual: $row->getUpdatedAt(),
+				message: get_class($row) . ' reached the mapper without updated_at, which the schema declares NOT NULL'
+			);
+		}
+	}//end testAnImportedRowCarriesTheTimestampsTheSchemaRequires()
+
+	/**
+	 * REQ-EXIM-002 + REQ-EXIM-004: a dashboard that goes out through export
+	 * and back in through import keeps every widget's configuration.
+	 *
+	 * This is a real round trip: the archive is built from the actual
+	 * `ExportService` output and read by the actual `ImportService`. Before
+	 * the fix the importer kept each widget's grid, style and title and
+	 * dropped the rest, so every text widget came back empty, every
+	 * object-list forgot its register, every nc-widget forgot what it
+	 * proxies, and every tile lost its type and link. The store install path
+	 * (launchpad#607) hands its payload to the same importer, so a dashboard
+	 * installed from a registry arrived unconfigured the same way.
+	 *
+	 * The comparison is everything export writes, minus exactly the fields the
+	 * builder deliberately leaves behind (see PlacementPayloadHydrator), so a
+	 * field that silently stops travelling fails here by name.
+	 *
+	 * @return void
+	 */
+	public function testExportThenImportKeepsEveryWidgetsConfiguration(): void {
+		$sources = [
+			$this->configuredPlacement(widgetId: 'text', content: ['text' => 'Welcome to the desk', 'fontSize' => 18]),
+			$this->configuredPlacement(
+				widgetId: 'object-list',
+				content: ['register' => 'dossiq', 'schema' => 'case', 'limit' => 10, 'filter' => ['assignee' => '@me']]
+			),
+			$this->configuredPlacement(widgetId: 'nc-widget', content: ['widgetId' => 'tasks', 'displayMode' => 'vertical']),
+			$this->configuredTile(),
+		];
+
+		$source = new Dashboard();
+		// phpcs:disable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$source->setId(7);
+		$source->setUuid('round-trip-source');
+		$source->setName('Round trip');
+		// phpcs:enable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+
+		$exportPlacements = $this->createMock(originalClassName: WidgetPlacementMapper::class);
+		$exportPlacements->method('findByDashboardId')->willReturn($sources);
+		$exporter = new ExportService(
+			dashboardMapper: $this->createMock(originalClassName: DashboardMapper::class),
+			placementMapper: $exportPlacements,
+			groupManager: $this->createMock(originalClassName: IGroupManager::class),
+			logger: new NullLogger(),
+		);
+
+		$payload = $exporter->serializeDashboard(dashboard: $source);
+		$zipPath = $this->makeZip(entries: [
+			'manifest.json' => (string)json_encode(
+				value: $exporter->buildManifest(scope: 'dashboard', dashboardCount: 1, currentUserId: 'admin')
+			),
+			'dashboards/round-trip-source.json' => (string)json_encode(value: $payload),
+			'metadata-fields.json' => '[]',
+		]);
+
+		$this->dashboardMapper->method('findByUuid')
+			->willThrowException(exception: new DoesNotExistException(msg: 'no'));
+		$inserted = new Dashboard();
+		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$inserted->setId(99);
+		$this->dashboardMapper->method('insert')->willReturn($inserted);
+
+		$imported = [];
+		$this->placementMapper->method('insert')->willReturnCallback(
+			static function (WidgetPlacement $placement) use (&$imported): WidgetPlacement {
+				$imported[] = $placement;
+				return $placement;
+			}
+		);
+
+		try {
+			$result = $this->service->import(zipPath: $zipPath, preserveUuids: false, currentUserId: 'admin');
+		} finally {
+			@unlink(filename: $zipPath);
+		}
+
+		$this->assertSame(expected: 1, actual: $result['importedDashboardCount']);
+		$this->assertCount(expectedCount: 4, haystack: $imported);
+
+		// Spot checks first, so a failure reads as the defect rather than a diff.
+		$this->assertSame(expected: 'Welcome to the desk', actual: $imported[0]->getContentArray()['text'] ?? null);
+		$this->assertSame(expected: 'dossiq', actual: $imported[1]->getContentArray()['register'] ?? null);
+		$this->assertSame(expected: 'tasks', actual: $imported[2]->getContentArray()['widgetId'] ?? null);
+		$this->assertSame(expected: 'shortcut', actual: $imported[3]->getTileType());
+		$this->assertSame(expected: '/apps/files', actual: $imported[3]->getTileLinkValue());
+
+		$this->assertSame(
+			expected: array_map(callback: [$this, 'travelling'], array: $sources),
+			actual: array_map(callback: [$this, 'travelling'], array: $imported),
+			message: 'a field export writes did not survive import'
+		);
+	}//end testExportThenImportKeepsEveryWidgetsConfiguration()
+
+	/**
+	 * The part of a placement that should survive an export-import round trip.
+	 *
+	 * Everything `jsonSerialize()` writes, minus the fields that name a row or
+	 * a workflow on the exporting instance (PlacementPayloadHydrator's
+	 * "deliberately not carried" list) and the timestamps a new row gets.
+	 *
+	 * @param WidgetPlacement $placement The placement.
+	 *
+	 * @return array<string, mixed>
+	 */
+	public function travelling(WidgetPlacement $placement): array {
+		$data = json_decode(json: (string)json_encode(value: $placement->jsonSerialize()), associative: true);
+		foreach ([
+			'id', 'dashboardId', 'createdAt', 'updatedAt', 'templatePlacementId', 'isCompulsory',
+			'requiresAcknowledgement', 'acknowledgementPrompt', 'acknowledgementDeadline',
+			'reacknowledgeOnChange', 'acknowledgementContentVersion', 'announcementKey',
+		] as $instanceBound) {
+			unset($data[$instanceBound]);
+		}
+
+		return $data;
+	}//end travelling()
+
+	/**
+	 * A widget placement configured the way a user configures one.
+	 *
+	 * @param string               $widgetId The widget type.
+	 * @param array<string, mixed> $content  Its configuration.
+	 *
+	 * @return WidgetPlacement
+	 */
+	private function configuredPlacement(string $widgetId, array $content): WidgetPlacement {
+		$placement = new WidgetPlacement();
+		// phpcs:disable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$placement->setWidgetId($widgetId);
+		$placement->setGridX(2);
+		$placement->setGridY(3);
+		$placement->setGridWidth(6);
+		$placement->setGridHeight(5);
+		$placement->setIsVisible(1);
+		$placement->setShowTitle(1);
+		$placement->setSortOrder(4);
+		$placement->setCustomTitle('Title of ' . $widgetId);
+		$placement->setCustomIcon('Star');
+		// phpcs:enable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$placement->setStyleConfigArray(config: ['backgroundColor' => '#123456']);
+		$placement->setContentArray(content: $content);
+		return $placement;
+	}//end configuredPlacement()
+
+	/**
+	 * A tile placement with every tile field set.
+	 *
+	 * @return WidgetPlacement
+	 */
+	private function configuredTile(): WidgetPlacement {
+		$tile = new WidgetPlacement();
+		// phpcs:disable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$tile->setWidgetId('tile-files');
+		$tile->setGridX(0);
+		$tile->setGridY(0);
+		$tile->setGridWidth(2);
+		$tile->setGridHeight(2);
+		$tile->setIsVisible(1);
+		$tile->setShowTitle(0);
+		$tile->setSortOrder(0);
+		$tile->setTileType('shortcut');
+		$tile->setTileTitle('Files');
+		$tile->setTileIcon('Folder');
+		$tile->setTileIconType('mdi');
+		$tile->setTileBackgroundColor('#283593');
+		$tile->setTileTextColor('#ffffff');
+		$tile->setTileLinkType('url');
+		$tile->setTileLinkValue('/apps/files');
+		// phpcs:enable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		return $tile;
+	}//end configuredTile()
+
 	/**
 	 * Build a temporary ZIP archive containing the provided entries.
 	 *
diff --git a/tests/Unit/Service/LiveTileServiceTest.php b/tests/Unit/Service/LiveTileServiceTest.php
index 50a205d0a..83fe9ea6c 100644
--- a/tests/Unit/Service/LiveTileServiceTest.php
+++ b/tests/Unit/Service/LiveTileServiceTest.php
@@ -7,7 +7,7 @@
  * validation), REQ-LIVETILE-003 (JSONPath-lite value extraction, TTL
  * cache hit, stale fallback, allow-list fail-closed at fetch time),
  * REQ-LIVETILE-004 (formatting, threshold badge), and REQ-LIVETILE-005
- * (connector-absent capability probe, no static OpenConnector import).
+ * (connector-absent capability probe, no static Integriq import).
  *
  * @category  Test
  * @package   OCA\LaunchPad\Tests\Unit\Service
@@ -127,6 +127,33 @@ private function placementWithConfig(int $id, array $config): WidgetPlacement {
 		return $placement;
 	}//end placementWithConfig()
 
+	/**
+	 * Present the connector leaf under exactly ONE installed id, the way a
+	 * real instance does.
+	 *
+	 * The rename means an instance answers to `integriq` OR `openconnector`,
+	 * never both, and `IAppManager::isInstalled()` on the other name returns
+	 * false rather than raising — which is precisely how a stale literal took
+	 * this integration dark without a log line. Mocking per-id keeps that
+	 * asymmetry in the test instead of flattening it to "true".
+	 *
+	 * @param string $installedId The id this fake instance registered.
+	 */
+	private function connectorInstalledAs(string $installedId): void {
+		$this->appManager->method('isInstalled')
+			->willReturnCallback(static fn (string $appId): bool => $appId === $installedId);
+		$this->appManager->method('isEnabledForUser')
+			->willReturnCallback(static fn (string $appId): bool => $appId === $installedId);
+	}//end connectorInstalledAs()
+
+	/**
+	 * No candidate id for the connector leaf is installed.
+	 */
+	private function connectorAbsent(): void {
+		$this->appManager->method('isInstalled')->willReturn(false);
+		$this->appManager->method('isEnabledForUser')->willReturn(false);
+	}//end connectorAbsent()
+
 	private function allowHost(string $host): void {
 		$this->appConfig->method('getValueString')->willReturn(json_encode([$host]));
 	}//end allowHost()
@@ -426,7 +453,7 @@ public function testBadgeConveysAlertStateWithLabel(): void {
 	// -------------------------------------------------------------
 
 	public function testConnectorAbsentDegradesToNullStaleWithNoCache(): void {
-		$this->appManager->method('isEnabledForUser')->with('openconnector')->willReturn(false);
+		$this->connectorAbsent();
 		$placement = $this->placementWithConfig(id: 11, config: [
 			'sourceMode' => 'connector',
 			'sourceId' => 'src-1',
@@ -442,18 +469,54 @@ public function testConnectorAbsentDegradesToNullStaleWithNoCache(): void {
 	}//end testConnectorAbsentDegradesToNullStaleWithNoCache()
 
 	public function testIsConnectorAvailableFalseWhenAppDisabled(): void {
-		$this->appManager->method('isEnabledForUser')->with('openconnector')->willReturn(false);
+		$this->connectorAbsent();
 		$this->assertFalse($this->service->isConnectorAvailable());
 	}//end testIsConnectorAvailableFalseWhenAppDisabled()
 
 	public function testIsConnectorAvailableTrueWhenAppEnabledAndServicePresent(): void {
-		$this->appManager->method('isEnabledForUser')->with('openconnector')->willReturn(true);
+		$this->connectorInstalledAs(installedId: 'integriq');
 		$this->container->method('has')->willReturn(true);
 		$this->assertTrue($this->service->isConnectorAvailable());
 	}//end testIsConnectorAvailableTrueWhenAppEnabledAndServicePresent()
 
+	/**
+	 * An instance still on the pre-rename release must resolve too.
+	 *
+	 * This is the half a plain literal cannot satisfy in either direction:
+	 * hardcoding `openconnector` breaks a migrated instance, hardcoding
+	 * `integriq` breaks this one, and both failures are silent.
+	 */
+	public function testIsConnectorAvailableTrueOnAnInstanceStillOnTheOldAppId(): void {
+		$this->connectorInstalledAs(installedId: 'openconnector');
+		$this->container->method('has')
+			->willReturnCallback(
+				static fn (string $id): bool => $id === 'OCA\OpenConnector\Service\Datasource\DashboardDatasourceService'
+			);
+
+		$this->assertTrue($this->service->isConnectorAvailable());
+	}//end testIsConnectorAvailableTrueOnAnInstanceStillOnTheOldAppId()
+
+	/**
+	 * The probe must ask for the class name the connector really ships.
+	 *
+	 * Pins the FQCN read out of integriq `development`: the container answers
+	 * only for that exact name, so a regression to the previous
+	 * `Service\DashboardDataSourceService` — an extra namespace segment short
+	 * and a capital `S` out — reddens here instead of degrading to an empty
+	 * tile in production.
+	 */
+	public function testProbeAsksForTheConnectorsRealServiceClass(): void {
+		$this->connectorInstalledAs(installedId: 'integriq');
+		$this->container->method('has')
+			->willReturnCallback(
+				static fn (string $id): bool => $id === 'OCA\Integriq\Service\Datasource\DashboardDatasourceService'
+			);
+
+		$this->assertTrue($this->service->isConnectorAvailable());
+	}//end testProbeAsksForTheConnectorsRealServiceClass()
+
 	public function testValidateSourceConfigFlagsConnectorUnavailable(): void {
-		$this->appManager->method('isEnabledForUser')->willReturn(false);
+		$this->connectorAbsent();
 
 		$errors = $this->service->validateSourceConfig(config: [
 			'sourceMode' => 'connector',
@@ -463,13 +526,22 @@ public function testValidateSourceConfigFlagsConnectorUnavailable(): void {
 		$this->assertContains('connector_unavailable', $errors);
 	}//end testValidateSourceConfigFlagsConnectorUnavailable()
 
+	/**
+	 * The fake below mirrors the REAL surface of
+	 * `OCA\Integriq\Service\Datasource\DashboardDatasourceService::resolve()`
+	 * as read off integriq `development` — name, parameters and the
+	 * `{value, fetchedAt, stale}` return shape. The previous fake declared
+	 * `resolveDashboardValue()`, a method that has never existed in that
+	 * app's history, so this test passed against a contract nothing on the
+	 * other side implements.
+	 */
 	public function testResolvesViaConnectorWhenAvailable(): void {
-		$this->appManager->method('isEnabledForUser')->with('openconnector')->willReturn(true);
+		$this->connectorInstalledAs(installedId: 'integriq');
 		$this->container->method('has')->willReturn(true);
 
 		$connectorService = new class {
-			public function resolveDashboardValue(string $sourceId, string $valueExpr): array {
-				return ['value' => 77];
+			public function resolve(string $sourceId, string $valueExpr, array $params = [], ?int $ttl = null): array {
+				return ['value' => 77, 'fetchedAt' => '2026-09-09T12:00:00+00:00', 'stale' => false];
 			}
 		};
 		$this->container->method('get')->willReturn($connectorService);
diff --git a/tests/Unit/Service/PermissionServiceGroupSharedTest.php b/tests/Unit/Service/PermissionServiceGroupSharedTest.php
new file mode 100644
index 000000000..a82d0b9f7
--- /dev/null
+++ b/tests/Unit/Service/PermissionServiceGroupSharedTest.php
@@ -0,0 +1,122 @@
+<?php
+
+/**
+ * PermissionServiceGroupSharedTest
+ *
+ * Who may edit an installed demo showcase (REQ-DEMO-008).
+ *
+ * A showcase installs as a `group_shared` dashboard in the `default` sentinel
+ * group with `permissionLevel: view_only`. The spec used to say an installed
+ * showcase is "fully editable", which read as a contradiction of that
+ * `view_only`. Neither statement was the whole rule, and no test pinned the
+ * rule at all: for a group-shared dashboard, Nextcloud admins, LaunchPad
+ * admins and Editors get `full`, and everyone else gets `view_only`, whatever
+ * the row's own permission level says.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Service
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Service;
+
+use OCA\LaunchPad\Db\AdminSettingMapper;
+use OCA\LaunchPad\Db\Dashboard;
+use OCA\LaunchPad\Db\DashboardMapper;
+use OCA\LaunchPad\Db\WidgetPlacementMapper;
+use OCA\LaunchPad\Service\AdminTemplateService;
+use OCA\LaunchPad\Service\DashboardShareService;
+use OCA\LaunchPad\Service\PermissionService;
+use OCA\LaunchPad\Service\RoleService;
+use OCP\IGroupManager;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects) Mirrors the constructor.
+ */
+class PermissionServiceGroupSharedTest extends TestCase {
+	/**
+	 * Build a PermissionService for one kind of user and an installed showcase.
+	 *
+	 * @param bool $launchpadAdmin Whether the user holds the LaunchPad admin role.
+	 * @param bool $editor         Whether the user holds the Editor role or higher.
+	 *
+	 * @return PermissionService
+	 */
+	private function serviceFor(bool $launchpadAdmin, bool $editor): PermissionService {
+		$showcase = new Dashboard();
+		// phpcs:disable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$showcase->setId(12);
+		$showcase->setType(Dashboard::TYPE_GROUP_SHARED);
+		$showcase->setGroupId(Dashboard::DEFAULT_GROUP_ID);
+		$showcase->setPermissionLevel(Dashboard::PERMISSION_VIEW_ONLY);
+		// phpcs:enable CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+
+		$dashboards = $this->createMock(DashboardMapper::class);
+		$dashboards->method('find')->willReturn($showcase);
+
+		$roles = $this->createMock(RoleService::class);
+		$roles->method('isViewer')->willReturn(false);
+		$roles->method('isAdmin')->willReturn($launchpadAdmin);
+		$roles->method('isEditorOrHigher')->willReturn($editor || $launchpadAdmin);
+
+		$groups = $this->createMock(IGroupManager::class);
+		$groups->method('isAdmin')->willReturn(false);
+
+		return new PermissionService(
+			dashboardMapper: $dashboards,
+			placementMapper: $this->createMock(WidgetPlacementMapper::class),
+			settingMapper: $this->createMock(AdminSettingMapper::class),
+			shareService: $this->createMock(DashboardShareService::class),
+			groupManager: $groups,
+			adminTemplateService: $this->createMock(AdminTemplateService::class),
+			roleService: $roles,
+		);
+	}//end serviceFor()
+
+	/**
+	 * A plain member of the default group sees an installed showcase and
+	 * cannot change it.
+	 *
+	 * @return void
+	 */
+	public function testAMemberSeesAShowcaseReadOnly(): void {
+		$service = $this->serviceFor(launchpadAdmin: false, editor: false);
+
+		$this->assertTrue($service->canViewDashboard(userId: 'alice', dashboardId: 12));
+		$this->assertFalse(
+			$service->canEditDashboard(userId: 'alice', dashboardId: 12),
+			'a plain member must not be able to edit an installed showcase'
+		);
+	}//end testAMemberSeesAShowcaseReadOnly()
+
+	/**
+	 * An Editor can edit an installed showcase despite its view_only level.
+	 *
+	 * @return void
+	 */
+	public function testAnEditorCanEditAShowcase(): void {
+		$service = $this->serviceFor(launchpadAdmin: false, editor: true);
+
+		$this->assertTrue($service->canEditDashboard(userId: 'eve', dashboardId: 12));
+	}//end testAnEditorCanEditAShowcase()
+
+	/**
+	 * A LaunchPad admin can edit an installed showcase despite its view_only
+	 * level, which is what the spec's old "fully editable" was reaching for.
+	 *
+	 * @return void
+	 */
+	public function testALaunchpadAdminCanEditAShowcase(): void {
+		$service = $this->serviceFor(launchpadAdmin: true, editor: false);
+
+		$this->assertTrue($service->canEditDashboard(userId: 'admin', dashboardId: 12));
+	}//end testALaunchpadAdminCanEditAShowcase()
+}//end class
diff --git a/tests/Unit/Service/StoreServiceTest.php b/tests/Unit/Service/StoreServiceTest.php
new file mode 100644
index 000000000..6376c5b5c
--- /dev/null
+++ b/tests/Unit/Service/StoreServiceTest.php
@@ -0,0 +1,458 @@
+<?php
+
+/**
+ * StoreServiceTest
+ *
+ * Unit tests for {@see \OCA\LaunchPad\Service\StoreService} covering the
+ * `dashboard-store` capability — REQ-STORE-002 (degraded discovery),
+ * REQ-STORE-003 (outcome pass-through), REQ-STORE-005 (reuse of
+ * ImportService), REQ-STORE-006 (additive install), REQ-STORE-007 (token
+ * redaction).
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Service
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Service;
+
+use OCA\LaunchPad\Db\Dashboard;
+use OCA\LaunchPad\Db\DashboardMapper;
+use OCA\LaunchPad\Db\WidgetPlacement;
+use OCA\LaunchPad\Db\WidgetPlacementMapper;
+use OCA\LaunchPad\Service\ImportService;
+use OCA\LaunchPad\Service\StoreService;
+use OCA\OpenRegister\AppHost\Service\GenericStoreService;
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\IAppConfig;
+use OCP\IDBConnection;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use RuntimeException;
+use ZipArchive;
+
+require_once __DIR__ . '/../../Stubs/OpenRegisterStubs.php';
+
+/**
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects) Mirrors the constructor.
+ * @SuppressWarnings(PHPMD.TooManyPublicMethods) One test per declared scenario.
+ */
+class StoreServiceTest extends TestCase {
+	/**
+	 * A resolved registry item carrying one dashboard.
+	 *
+	 * @var array<string, mixed>
+	 */
+	private const ITEM = [
+		'slug' => 'sales-overview',
+		'title' => 'Sales overview',
+		'dashboards' => [
+			['uuid' => 'aaaa-bbbb', 'name' => 'Sales overview', 'gridColumns' => 4],
+		],
+	];
+
+	/** @var ImportService&MockObject */
+	private $importService;
+
+	/** @var IAppConfig&MockObject */
+	private $appConfig;
+
+	/** @var array<string, string> */
+	private array $configValues = [];
+
+	/**
+	 * Build the collaborators every test shares.
+	 *
+	 * @return void
+	 */
+	protected function setUp(): void {
+		parent::setUp();
+
+		$this->importService = $this->createMock(ImportService::class);
+		$this->appConfig = $this->createMock(IAppConfig::class);
+
+		$this->appConfig->method('getValueString')->willReturnCallback(
+			function (string $app, string $key, string $default = ''): string {
+				return ($this->configValues[$key] ?? $default);
+			}
+		);
+		$this->appConfig->method('setValueString')->willReturnCallback(
+			function (string $app, string $key, string $value): bool {
+				$this->configValues[$key] = $value;
+				return true;
+			}
+		);
+	}//end setUp()
+
+	/**
+	 * REQ-STORE-005: a template installed from a registry arrives with its
+	 * widgets configured.
+	 *
+	 * Every other install test here mocks the importer, which proves the
+	 * payload reaches it and nothing about what it does with the payload. This
+	 * one runs the REAL `ImportService` behind the store. That matters because
+	 * the importer used to drop each widget's `content`, so a store install
+	 * placed an object-list that knew no register and a text widget with no
+	 * text, and reported success.
+	 *
+	 * @return void
+	 */
+	public function testAStoreInstallArrivesWithItsWidgetsConfigured(): void {
+		$dashboards = $this->createMock(originalClassName: DashboardMapper::class);
+		$dashboards->method('findByUuid')->willThrowException(exception: new DoesNotExistException(msg: 'no'));
+		$persisted = new Dashboard();
+		// phpcs:ignore CustomSniffs.Functions.NamedParameters.RequireNamedParameters
+		$persisted->setId(31);
+		$dashboards->method('insert')->willReturn($persisted);
+
+		$placed = [];
+		$placements = $this->createMock(originalClassName: WidgetPlacementMapper::class);
+		$placements->method('insert')->willReturnCallback(
+			static function (WidgetPlacement $placement) use (&$placed): WidgetPlacement {
+				$placed[] = $placement;
+				return $placement;
+			}
+		);
+
+		$importer = new ImportService(
+			dashboardMapper: $dashboards,
+			placementMapper: $placements,
+			db: $this->createMock(originalClassName: IDBConnection::class),
+			logger: new NullLogger(),
+		);
+
+		$discovery = $this->createMock(GenericStoreService::class);
+		$discovery->method('resolve')->willReturn([
+			'slug' => 'case-desk',
+			'title' => 'Case desk',
+			'dashboards' => [[
+				'uuid' => 'store-dash',
+				'name' => 'Case desk',
+				'widgets' => [
+					['widgetId' => 'object-list', 'content' => ['register' => 'dossiq', 'schema' => 'case']],
+					['widgetId' => 'text', 'content' => ['text' => 'Start here']],
+				],
+			]],
+		]);
+
+		$store = new StoreService(
+			discovery: $discovery,
+			importService: $importer,
+			appConfig: $this->appConfig,
+			logger: new NullLogger()
+		);
+
+		$result = $store->install(slug: 'case-desk', userId: 'alice');
+
+		$this->assertTrue($result['success'], $result['message']);
+		$this->assertCount(2, $placed);
+		$this->assertSame(['register' => 'dossiq', 'schema' => 'case'], $placed[0]->getContentArray());
+		$this->assertSame(['text' => 'Start here'], $placed[1]->getContentArray());
+	}//end testAStoreInstallArrivesWithItsWidgetsConfigured()
+
+	/**
+	 * Build the service under test.
+	 *
+	 * @param object|null $discovery The discovery client, or null.
+	 *
+	 * @return StoreService
+	 */
+	private function service(?object $discovery): StoreService {
+		return new StoreService(
+			discovery: $discovery,
+			importService: $this->importService,
+			appConfig: $this->appConfig,
+			logger: new NullLogger()
+		);
+	}//end service()
+
+	/**
+	 * REQ-STORE-002: an absent OpenRegister degrades to `not_configured`.
+	 *
+	 * @return void
+	 */
+	public function testSearchWithoutTheEngineReportsNotConfigured(): void {
+		$result = $this->service(discovery: null)->search();
+
+		$this->assertSame('not_configured', $result['outcome']);
+		$this->assertSame([], $result['cards']);
+	}//end testSearchWithoutTheEngineReportsNotConfigured()
+
+	/**
+	 * REQ-STORE-002: `isAvailable()` reports the engine's presence.
+	 *
+	 * @return void
+	 */
+	public function testAvailabilityFollowsTheInjectedClient(): void {
+		$this->assertFalse($this->service(discovery: null)->isAvailable());
+		$this->assertTrue(
+			$this->service(discovery: $this->createMock(GenericStoreService::class))->isAvailable()
+		);
+	}//end testAvailabilityFollowsTheInjectedClient()
+
+	/**
+	 * REQ-STORE-003: an invalid response is NOT reported as unreachable.
+	 *
+	 * The two outcomes need different fixes, so collapsing them would send an
+	 * administrator to check the network for a configuration mistake.
+	 *
+	 * @return void
+	 */
+	public function testInvalidResponseIsNotCollapsedIntoUnreachable(): void {
+		$discovery = $this->createMock(GenericStoreService::class);
+		$discovery->method('search')->willReturn(
+			['outcome' => 'store_invalid_response', 'cards' => []]
+		);
+
+		$result = $this->service(discovery: $discovery)->search();
+
+		$this->assertSame('store_invalid_response', $result['outcome']);
+	}//end testInvalidResponseIsNotCollapsedIntoUnreachable()
+
+	/**
+	 * REQ-STORE-003: cards come back as the engine normalised them.
+	 *
+	 * @return void
+	 */
+	public function testCardsArePassedThroughUnchanged(): void {
+		$cards = [['slug' => 'sales-overview', 'title' => 'Sales overview', 'kind' => '']];
+		$discovery = $this->createMock(GenericStoreService::class);
+		$discovery->method('search')->willReturn(['outcome' => 'ok', 'cards' => $cards]);
+
+		$result = $this->service(discovery: $discovery)->search(query: 'sales');
+
+		$this->assertSame('ok', $result['outcome']);
+		$this->assertSame($cards, $result['cards']);
+	}//end testCardsArePassedThroughUnchanged()
+
+	/**
+	 * REQ-STORE-002: no engine means no import, not a half-run install.
+	 *
+	 * @return void
+	 */
+	public function testInstallWithoutTheEngineNeverImports(): void {
+		$this->importService->expects($this->never())->method('import');
+
+		$result = $this->service(discovery: null)->install(slug: 'sales-overview', userId: 'alice');
+
+		$this->assertFalse($result['success']);
+		$this->assertSame([], $result['components']);
+	}//end testInstallWithoutTheEngineNeverImports()
+
+	/**
+	 * REQ-STORE-005: an unresolved slug is refused before any import.
+	 *
+	 * @return void
+	 */
+	public function testUnresolvedSlugIsRefused(): void {
+		$discovery = $this->createMock(GenericStoreService::class);
+		$discovery->method('resolve')->willReturn(null);
+		$this->importService->expects($this->never())->method('import');
+
+		$result = $this->service(discovery: $discovery)->install(slug: 'nope', userId: 'alice');
+
+		$this->assertFalse($result['success']);
+	}//end testUnresolvedSlugIsRefused()
+
+	/**
+	 * REQ-STORE-005: an item carrying no dashboard never reaches the importer.
+	 *
+	 * Importing an empty archive would report a cheerful "installed 0" instead
+	 * of naming the registry's mistake.
+	 *
+	 * @return void
+	 */
+	public function testItemWithoutDashboardsIsRefusedBeforeImport(): void {
+		$discovery = $this->createMock(GenericStoreService::class);
+		$discovery->method('resolve')->willReturn(['slug' => 'empty', 'dashboards' => []]);
+		$this->importService->expects($this->never())->method('import');
+
+		$result = $this->service(discovery: $discovery)->install(slug: 'empty', userId: 'alice');
+
+		$this->assertFalse($result['success']);
+	}//end testItemWithoutDashboardsIsRefusedBeforeImport()
+
+	/**
+	 * REQ-STORE-005: the payload reaches the EXISTING importer, as a ZIP whose
+	 * shape `ImportService::validateZipStructure()` accepts.
+	 *
+	 * @return void
+	 */
+	public function testThePayloadIsMaterialisedAsALaunchpadExportArchive(): void {
+		$seen = [];
+		$this->importService->expects($this->once())->method('import')->willReturnCallback(
+			function (string $zipPath, bool $preserveUuids, string $currentUserId) use (&$seen): array {
+				$zip = new ZipArchive();
+				$this->assertTrue($zip->open($zipPath) === true, 'the archive must open');
+				$seen['manifest'] = json_decode((string)$zip->getFromName('manifest.json'), true);
+				$seen['dashboard'] = $zip->getFromName('dashboards/aaaa-bbbb.json');
+				$zip->close();
+
+				return ['status' => 'ok', 'importedDashboardCount' => 1, 'skippedDashboardCount' => 0, 'errors' => [], 'manifest' => []];
+			}
+		);
+
+		$result = $this->serviceResolving(item: self::ITEM)->install(slug: 'sales-overview', userId: 'alice');
+
+		$this->assertTrue($result['success']);
+		$this->assertSame(ImportService::SCHEMA_VERSION, $seen['manifest']['schemaVersion']);
+		$this->assertSame('dashboard', $seen['manifest']['scope']);
+		$this->assertNotFalse($seen['dashboard'], 'the dashboard entry must be present');
+	}//end testThePayloadIsMaterialisedAsALaunchpadExportArchive()
+
+	/**
+	 * REQ-STORE-006: a store install creates, it never replaces.
+	 *
+	 * A foreign template carries the publishing instance's UUIDs, one of which
+	 * can name a live local dashboard.
+	 *
+	 * @return void
+	 */
+	public function testInstallIsAdditiveRatherThanReplacing(): void {
+		$this->importService->expects($this->once())->method('import')->with(
+			$this->anything(),
+			$this->isFalse(),
+			'alice'
+		)->willReturn(
+			['status' => 'ok', 'importedDashboardCount' => 1, 'skippedDashboardCount' => 0, 'errors' => [], 'manifest' => []]
+		);
+
+		$this->serviceResolving(item: self::ITEM)->install(slug: 'sales-overview', userId: 'alice');
+	}//end testInstallIsAdditiveRatherThanReplacing()
+
+	/**
+	 * REQ-STORE-005: a failing import leaves no archive behind.
+	 *
+	 * @return void
+	 */
+	public function testTheTemporaryArchiveIsRemovedWhenTheImportThrows(): void {
+		$path = null;
+		$this->importService->method('import')->willReturnCallback(
+			function (string $zipPath) use (&$path): array {
+				$path = $zipPath;
+				throw new RuntimeException(message: 'boom');
+			}
+		);
+
+		$result = $this->serviceResolving(item: self::ITEM)->install(slug: 'sales-overview', userId: 'alice');
+
+		$this->assertFalse($result['success']);
+		$this->assertNotNull($path);
+		$this->assertFileDoesNotExist($path);
+	}//end testTheTemporaryArchiveIsRemovedWhenTheImportThrows()
+
+	/**
+	 * REQ-STORE-005: a succeeding import leaves no archive behind either.
+	 *
+	 * @return void
+	 */
+	public function testTheTemporaryArchiveIsRemovedOnSuccess(): void {
+		$path = null;
+		$this->importService->method('import')->willReturnCallback(
+			function (string $zipPath) use (&$path): array {
+				$path = $zipPath;
+				return ['status' => 'ok', 'importedDashboardCount' => 1, 'skippedDashboardCount' => 0, 'errors' => [], 'manifest' => []];
+			}
+		);
+
+		$this->serviceResolving(item: self::ITEM)->install(slug: 'sales-overview', userId: 'alice');
+
+		$this->assertNotNull($path);
+		$this->assertFileDoesNotExist($path);
+	}//end testTheTemporaryArchiveIsRemovedOnSuccess()
+
+	/**
+	 * REQ-STORE-005: a partly-imported item names what did not arrive.
+	 *
+	 * @return void
+	 */
+	public function testAPartialImportNamesTheDashboardThatDidNotArrive(): void {
+		$item = self::ITEM;
+		$item['dashboards'][] = ['uuid' => 'cccc-dddd', 'name' => 'Refused board'];
+
+		$this->importService->method('import')->willReturn(
+			['status' => 'ok', 'importedDashboardCount' => 1, 'skippedDashboardCount' => 1, 'errors' => [], 'manifest' => []]
+		);
+
+		$result = $this->serviceResolving(item: $item)->install(slug: 'sales-overview', userId: 'alice');
+
+		$this->assertTrue($result['success']);
+		$this->assertSame('installed', $result['components'][0]['status']);
+		$this->assertSame('refused', $result['components'][1]['status']);
+		$this->assertSame('Refused board', $result['components'][1]['schema']);
+	}//end testAPartialImportNamesTheDashboardThatDidNotArrive()
+
+	/**
+	 * REQ-STORE-005: a JSON-encoded dashboards property is accepted too.
+	 *
+	 * @return void
+	 */
+	public function testAJsonEncodedDashboardsPropertyIsAccepted(): void {
+		$item = ['slug' => 'sales-overview', 'dashboards' => json_encode(self::ITEM['dashboards'])];
+		$this->importService->expects($this->once())->method('import')->willReturn(
+			['status' => 'ok', 'importedDashboardCount' => 1, 'skippedDashboardCount' => 0, 'errors' => [], 'manifest' => []]
+		);
+
+		$result = $this->serviceResolving(item: $item)->install(slug: 'sales-overview', userId: 'alice');
+
+		$this->assertTrue($result['success']);
+	}//end testAJsonEncodedDashboardsPropertyIsAccepted()
+
+	/**
+	 * REQ-STORE-007: the token is reported, never returned.
+	 *
+	 * @return void
+	 */
+	public function testTheRegistryTokenIsNeverReadBack(): void {
+		$this->configValues = [
+			StoreService::CONFIG_URL => 'https://registry.example.org/',
+			StoreService::CONFIG_TOKEN => 'super-secret-token',
+			StoreService::CONFIG_REGISTER => 'launchpad',
+		];
+
+		$config = $this->service(discovery: null)->getRegistryConfig();
+
+		$this->assertTrue($config['tokenConfigured']);
+		$this->assertSame('https://registry.example.org/', $config['registryUrl']);
+		$this->assertNotContains('super-secret-token', $config);
+		$this->assertArrayNotHasKey('registryToken', $config);
+	}//end testTheRegistryTokenIsNeverReadBack()
+
+	/**
+	 * REQ-STORE-007: an omitted key is left alone, an empty one clears.
+	 *
+	 * @return void
+	 */
+	public function testAnOmittedKeyIsLeftAloneAndAnEmptyOneClears(): void {
+		$this->configValues = [StoreService::CONFIG_TOKEN => 'super-secret-token'];
+		$service = $this->service(discovery: null);
+
+		$service->updateRegistryConfig(registryUrl: 'https://registry.example.org/');
+		$this->assertTrue($service->getRegistryConfig()['tokenConfigured'], 'an omitted token must survive');
+
+		$service->updateRegistryConfig(registryToken: '');
+		$this->assertFalse($service->getRegistryConfig()['tokenConfigured'], 'an empty token must clear');
+	}//end testAnOmittedKeyIsLeftAloneAndAnEmptyOneClears()
+
+	/**
+	 * A service whose discovery client resolves to the given item.
+	 *
+	 * @param array<string, mixed> $item The resolved registry item.
+	 *
+	 * @return StoreService
+	 */
+	private function serviceResolving(array $item): StoreService {
+		$discovery = $this->createMock(GenericStoreService::class);
+		$discovery->method('resolve')->willReturn($item);
+
+		return $this->service(discovery: $discovery);
+	}//end serviceResolving()
+}//end class
diff --git a/tests/Unit/Support/FleetAppIdFixtures.php b/tests/Unit/Support/FleetAppIdFixtures.php
new file mode 100644
index 000000000..3680c21ad
--- /dev/null
+++ b/tests/Unit/Support/FleetAppIdFixtures.php
@@ -0,0 +1,33 @@
+<?php
+
+/**
+ * FleetAppIdFixtures
+ *
+ * A class under a PRE-RENAME fleet namespace, so {@see FleetAppId::resolveClass()}
+ * and {@see FleetAppId::isInstanceOf()} can be exercised against a name that
+ * really is absent under the new namespace and present under the old one.
+ *
+ * `buildiq` / `OCA\OpenBuilt` is used on purpose: no launchpad code binds to
+ * that app, so declaring a fixture in its namespace cannot collide with a real
+ * class or influence any other test.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Support
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace OCA\OpenBuilt\Fixture;
+
+/**
+ * Stand-in for a class an app shipped before its rename.
+ */
+class LegacyProbe {
+
+}//end class
diff --git a/tests/Unit/Support/FleetAppIdTest.php b/tests/Unit/Support/FleetAppIdTest.php
new file mode 100644
index 000000000..2dcca90b3
--- /dev/null
+++ b/tests/Unit/Support/FleetAppIdTest.php
@@ -0,0 +1,342 @@
+<?php
+
+/**
+ * FleetAppIdTest
+ *
+ * Covers the fleet-rename resolver that every cross-app binding in this app
+ * now goes through.
+ *
+ * These are not incidental branches. A cross-app lookup fails SILENTLY in
+ * every direction that matters: `isInstalled()` on a name the instance never
+ * registered returns false rather than raising, `class_exists()` on a moved
+ * namespace answers false, and `ContainerInterface::get()` throws into a
+ * caller that is already catching. So the paths exercised here — old id only,
+ * neither id, an app manager that throws, a container that throws — are the
+ * ones that decide whether an integration works on a half-migrated instance,
+ * and none of them announces itself when it goes wrong.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Support
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Support;
+
+use OCA\LaunchPad\Support\FleetAppId;
+use OCP\App\IAppManager;
+use PHPUnit\Framework\Attributes\Small;
+use PHPUnit\Framework\TestCase;
+use Psr\Container\ContainerInterface;
+use RuntimeException;
+
+// Declares a class under a PRE-RENAME fleet namespace. Not autoloadable:
+// composer's autoload-dev maps only `Unit\` onto tests/, and the whole point
+// of the fixture is to live outside that root.
+require_once __DIR__ . '/FleetAppIdFixtures.php';
+
+#[Small]
+class FleetAppIdTest extends TestCase {
+
+	/**
+	 * An app manager where exactly the named ids are installed.
+	 *
+	 * Deliberately answers FALSE rather than throwing for every other id: that
+	 * is what Nextcloud does, and it is the whole reason a stale literal goes
+	 * dark instead of erroring.
+	 *
+	 * @param list<string> $installed Ids this fake instance registered.
+	 * @param list<string> $enabled   Ids also enabled for the current user.
+	 */
+	private function appManager(array $installed, ?array $enabled = null): IAppManager {
+		$enabled = ($enabled ?? $installed);
+		$manager = $this->createMock(originalClassName: IAppManager::class);
+		$manager->method('isInstalled')
+			->willReturnCallback(static fn (string $appId): bool => in_array($appId, $installed, true));
+		$manager->method('isEnabledForUser')
+			->willReturnCallback(static fn (string $appId): bool => in_array($appId, $enabled, true));
+		return $manager;
+	}//end appManager()
+
+	// -------------------------------------------------------------
+	// resolve() — the id half.
+	// -------------------------------------------------------------
+
+	public function testResolvePrefersTheNewIdOnAMigratedInstance(): void {
+		$manager = $this->appManager(installed: ['integriq']);
+		$this->assertSame('integriq', FleetAppId::resolve(appManager: $manager, canonical: 'integriq'));
+	}//end testResolvePrefersTheNewIdOnAMigratedInstance()
+
+	/**
+	 * The case a hard swap to the new literal breaks.
+	 */
+	public function testResolveFallsBackToTheOldIdOnAPreRenameInstance(): void {
+		$manager = $this->appManager(installed: ['openconnector']);
+		$this->assertSame('openconnector', FleetAppId::resolve(appManager: $manager, canonical: 'integriq'));
+	}//end testResolveFallsBackToTheOldIdOnAPreRenameInstance()
+
+	/**
+	 * Order is the contract: newest first, even when both answer.
+	 */
+	public function testResolvePrefersTheNewIdWhenBothAreInstalled(): void {
+		$manager = $this->appManager(installed: ['openconnector', 'integriq']);
+		$this->assertSame('integriq', FleetAppId::resolve(appManager: $manager, canonical: 'integriq'));
+	}//end testResolvePrefersTheNewIdWhenBothAreInstalled()
+
+	public function testResolveReturnsNullWhenNoCandidateIsInstalled(): void {
+		$manager = $this->appManager(installed: []);
+		$this->assertNull(FleetAppId::resolve(appManager: $manager, canonical: 'integriq'));
+	}//end testResolveReturnsNullWhenNoCandidateIsInstalled()
+
+	/**
+	 * An app with no rename entry still resolves under its own name, so a
+	 * caller need not check the map before asking.
+	 */
+	public function testResolveFallsBackToTheCanonicalNameForAnUnmappedApp(): void {
+		$manager = $this->appManager(installed: ['openregister']);
+		$this->assertSame('openregister', FleetAppId::resolve(appManager: $manager, canonical: 'openregister'));
+	}//end testResolveFallsBackToTheCanonicalNameForAnUnmappedApp()
+
+	/**
+	 * One unanswerable candidate must not abort the search.
+	 *
+	 * Without the per-candidate catch, an app manager that raises on the FIRST
+	 * (new) id would report the app absent on an instance that has it under
+	 * the old one — a silent no-op produced by the resolver itself.
+	 */
+	public function testResolveKeepsSearchingWhenACandidateThrows(): void {
+		$manager = $this->createMock(originalClassName: IAppManager::class);
+		$manager->method('isInstalled')->willReturnCallback(
+			static function (string $appId): bool {
+				if ($appId === 'integriq') {
+					throw new RuntimeException('app manager blew up');
+				}
+
+				return $appId === 'openconnector';
+			}
+		);
+
+		$this->assertSame('openconnector', FleetAppId::resolve(appManager: $manager, canonical: 'integriq'));
+	}//end testResolveKeepsSearchingWhenACandidateThrows()
+
+	public function testIsInstalledReportsPresenceUnderEitherName(): void {
+		$this->assertTrue(FleetAppId::isInstalled($this->appManager(installed: ['procest']), 'dossiq'));
+		$this->assertTrue(FleetAppId::isInstalled($this->appManager(installed: ['dossiq']), 'dossiq'));
+		$this->assertFalse(FleetAppId::isInstalled($this->appManager(installed: []), 'dossiq'));
+	}//end testIsInstalledReportsPresenceUnderEitherName()
+
+	// -------------------------------------------------------------
+	// isEnabledForUser() — presence and enablement are separate questions.
+	// -------------------------------------------------------------
+
+	public function testIsEnabledForUserChecksTheIdTheInstanceActuallyHas(): void {
+		$manager = $this->appManager(installed: ['openconnector']);
+		$this->assertTrue(FleetAppId::isEnabledForUser(appManager: $manager, canonical: 'integriq'));
+	}//end testIsEnabledForUserChecksTheIdTheInstanceActuallyHas()
+
+	/**
+	 * Installed but disabled for this user is not available.
+	 */
+	public function testIsEnabledForUserFalseWhenInstalledButDisabled(): void {
+		$manager = $this->appManager(installed: ['integriq'], enabled: []);
+		$this->assertFalse(FleetAppId::isEnabledForUser(appManager: $manager, canonical: 'integriq'));
+	}//end testIsEnabledForUserFalseWhenInstalledButDisabled()
+
+	public function testIsEnabledForUserFalseWhenAbsentEntirely(): void {
+		$manager = $this->appManager(installed: []);
+		$this->assertFalse(FleetAppId::isEnabledForUser(appManager: $manager, canonical: 'integriq'));
+	}//end testIsEnabledForUserFalseWhenAbsentEntirely()
+
+	/**
+	 * A throwing enablement check degrades to "unavailable", never a fatal.
+	 */
+	public function testIsEnabledForUserFalseWhenTheCheckThrows(): void {
+		$manager = $this->createMock(originalClassName: IAppManager::class);
+		$manager->method('isInstalled')->willReturn(true);
+		$manager->method('isEnabledForUser')->willThrowException(new RuntimeException('boom'));
+
+		$this->assertFalse(FleetAppId::isEnabledForUser(appManager: $manager, canonical: 'integriq'));
+	}//end testIsEnabledForUserFalseWhenTheCheckThrows()
+
+	// -------------------------------------------------------------
+	// appPath() — a URL is a routing key, valid only for the registered id.
+	// -------------------------------------------------------------
+
+	public function testAppPathUsesTheRegisteredIdNotTheCanonicalOne(): void {
+		$manager = $this->appManager(installed: ['openconnector']);
+		$this->assertSame(
+			'/apps/openconnector/api/sources',
+			FleetAppId::appPath(appManager: $manager, canonical: 'integriq', suffix: 'api/sources')
+		);
+	}//end testAppPathUsesTheRegisteredIdNotTheCanonicalOne()
+
+	public function testAppPathWithoutASuffixIsTheBareAppRoot(): void {
+		$manager = $this->appManager(installed: ['integriq']);
+		$this->assertSame('/apps/integriq', FleetAppId::appPath(appManager: $manager, canonical: 'integriq'));
+	}//end testAppPathWithoutASuffixIsTheBareAppRoot()
+
+	/**
+	 * A caller that supplies a leading slash must not produce `/apps/x//y`.
+	 */
+	public function testAppPathDoesNotDoubleTheSeparator(): void {
+		$manager = $this->appManager(installed: ['integriq']);
+		$this->assertSame(
+			'/apps/integriq/api/health',
+			FleetAppId::appPath(appManager: $manager, canonical: 'integriq', suffix: '/api/health')
+		);
+	}//end testAppPathDoesNotDoubleTheSeparator()
+
+	/**
+	 * No installed id means no valid path — null, never a URL that 404s.
+	 */
+	public function testAppPathReturnsNullWhenTheAppIsAbsent(): void {
+		$manager = $this->appManager(installed: []);
+		$this->assertNull(FleetAppId::appPath(appManager: $manager, canonical: 'integriq', suffix: 'api/sources'));
+	}//end testAppPathReturnsNullWhenTheAppIsAbsent()
+
+	// -------------------------------------------------------------
+	// classCandidates() — the namespace half.
+	// -------------------------------------------------------------
+
+	public function testClassCandidatesAreNewestFirst(): void {
+		$this->assertSame(
+			[
+				'OCA\Integriq\Service\Datasource\DashboardDatasourceService',
+				'OCA\OpenConnector\Service\Datasource\DashboardDatasourceService',
+			],
+			FleetAppId::classCandidates(canonical: 'integriq', relative: 'Service\Datasource\DashboardDatasourceService')
+		);
+	}//end testClassCandidatesAreNewestFirst()
+
+	/**
+	 * `openbuild` shipped `OCA\OpenBuilt`, which no naming rule produces.
+	 *
+	 * Pinned because it is the entry most likely to be "corrected" to
+	 * `OCA\OpenBuild` by someone deriving the namespace from the id, which
+	 * would take every buildiq binding dark without an error.
+	 */
+	public function testClassCandidatesPreserveTheIrregularBuildiqNamespace(): void {
+		$this->assertSame(
+			['OCA\Buildiq\Service\Thing', 'OCA\OpenBuilt\Service\Thing'],
+			FleetAppId::classCandidates(canonical: 'buildiq', relative: 'Service\Thing')
+		);
+	}//end testClassCandidatesPreserveTheIrregularBuildiqNamespace()
+
+	public function testClassCandidatesToleratesALeadingSeparator(): void {
+		$this->assertSame(
+			['OCA\Thematiq\Icon', 'OCA\NLDesign\Icon'],
+			FleetAppId::classCandidates(canonical: 'thematiq', relative: '\\Icon')
+		);
+	}//end testClassCandidatesToleratesALeadingSeparator()
+
+	public function testClassCandidatesAreEmptyForAnUnmappedApp(): void {
+		$this->assertSame([], FleetAppId::classCandidates(canonical: 'openregister', relative: 'Service\Thing'));
+	}//end testClassCandidatesAreEmptyForAnUnmappedApp()
+
+	// -------------------------------------------------------------
+	// resolveClass() / isInstanceOf().
+	// -------------------------------------------------------------
+
+	/**
+	 * Only the OLD namespace exists here (see the fixture at the foot of this
+	 * file), which is the pre-rename instance the fallback exists for.
+	 */
+	public function testResolveClassFindsTheOldNamespaceWhenTheNewOneIsAbsent(): void {
+		$this->assertSame(
+			'OCA\OpenBuilt\Fixture\LegacyProbe',
+			FleetAppId::resolveClass(canonical: 'buildiq', relative: 'Fixture\LegacyProbe')
+		);
+	}//end testResolveClassFindsTheOldNamespaceWhenTheNewOneIsAbsent()
+
+	public function testResolveClassReturnsNullWhenNoCandidateExists(): void {
+		$this->assertNull(FleetAppId::resolveClass(canonical: 'buildiq', relative: 'Fixture\NoSuchProbe'));
+	}//end testResolveClassReturnsNullWhenNoCandidateExists()
+
+	public function testIsInstanceOfMatchesUnderTheOldNamespace(): void {
+		$event = new \OCA\OpenBuilt\Fixture\LegacyProbe();
+		$this->assertTrue(FleetAppId::isInstanceOf($event, 'buildiq', 'Fixture\LegacyProbe'));
+	}//end testIsInstanceOfMatchesUnderTheOldNamespace()
+
+	public function testIsInstanceOfFalseForAnUnrelatedValue(): void {
+		$this->assertFalse(FleetAppId::isInstanceOf(new \stdClass(), 'buildiq', 'Fixture\LegacyProbe'));
+	}//end testIsInstanceOfFalseForAnUnrelatedValue()
+
+	// -------------------------------------------------------------
+	// getService() / hasService() — the container half.
+	// -------------------------------------------------------------
+
+	/**
+	 * A container that only knows the OLD name still yields the service.
+	 *
+	 * This is the exact shape that took thirteen filinq bindings dark: the
+	 * caller asks for one FQCN, `get()` throws, and the surrounding try/catch
+	 * turns it into a feature that quietly stops working.
+	 */
+	public function testGetServiceFallsBackToTheOldNamespace(): void {
+		$service = new \stdClass();
+		$container = $this->createMock(originalClassName: ContainerInterface::class);
+		$container->method('get')->willReturnCallback(
+			static function (string $id) use ($service): object {
+				if ($id === 'OCA\OpenConnector\Service\Datasource\DashboardDatasourceService') {
+					return $service;
+				}
+
+				throw new class ('not registered') extends RuntimeException implements \Psr\Container\NotFoundExceptionInterface {
+				};
+			}
+		);
+
+		$this->assertSame(
+			$service,
+			FleetAppId::getService($container, 'integriq', 'Service\Datasource\DashboardDatasourceService')
+		);
+	}//end testGetServiceFallsBackToTheOldNamespace()
+
+	public function testGetServiceReturnsNullWhenNoCandidateResolves(): void {
+		$container = $this->createMock(originalClassName: ContainerInterface::class);
+		$container->method('get')->willThrowException(new RuntimeException('absent'));
+
+		$this->assertNull(
+			FleetAppId::getService($container, 'integriq', 'Service\Datasource\DashboardDatasourceService')
+		);
+	}//end testGetServiceReturnsNullWhenNoCandidateResolves()
+
+	public function testHasServiceTrueWhenOnlyTheOldNameIsRegistered(): void {
+		$container = $this->createMock(originalClassName: ContainerInterface::class);
+		$container->method('has')->willReturnCallback(
+			static fn (string $id): bool => $id === 'OCA\OpenConnector\Service\Datasource\DashboardDatasourceService'
+		);
+
+		$this->assertTrue(
+			FleetAppId::hasService($container, 'integriq', 'Service\Datasource\DashboardDatasourceService')
+		);
+	}//end testHasServiceTrueWhenOnlyTheOldNameIsRegistered()
+
+	public function testHasServiceFalseWhenNoCandidateIsRegistered(): void {
+		$container = $this->createMock(originalClassName: ContainerInterface::class);
+		$container->method('has')->willReturn(false);
+
+		$this->assertFalse(
+			FleetAppId::hasService($container, 'integriq', 'Service\Datasource\DashboardDatasourceService')
+		);
+	}//end testHasServiceFalseWhenNoCandidateIsRegistered()
+
+	/**
+	 * A container that raises on `has()` must read as absent, not crash.
+	 */
+	public function testHasServiceFalseWhenTheContainerThrows(): void {
+		$container = $this->createMock(originalClassName: ContainerInterface::class);
+		$container->method('has')->willThrowException(new RuntimeException('container blew up'));
+
+		$this->assertFalse(
+			FleetAppId::hasService($container, 'integriq', 'Service\Datasource\DashboardDatasourceService')
+		);
+	}//end testHasServiceFalseWhenTheContainerThrows()
+
+}//end class
diff --git a/tests/Unit/Support/StoreWiringTest.php b/tests/Unit/Support/StoreWiringTest.php
new file mode 100644
index 000000000..5a9c23d39
--- /dev/null
+++ b/tests/Unit/Support/StoreWiringTest.php
@@ -0,0 +1,138 @@
+<?php
+
+/**
+ * StoreWiringTest
+ *
+ * Guards the two wiring defects this capability was written to fix, both of
+ * which shipped on `development` and neither of which any unit test could see.
+ *
+ * The store page was declared in `src/manifest.json` while `appinfo/routes.php`
+ * declared no store route, so `CnStorePage` 404'd on mount (REQ-STORE-001). And
+ * the `store` block declared `openregister.configset` types, which select the
+ * engine's federated configuration path and cannot produce a dashboard
+ * (REQ-STORE-008).
+ *
+ * Both live in files no service test loads, which is exactly why they need a
+ * test that reads the files.
+ *
+ * @category  Test
+ * @package   OCA\LaunchPad\Tests\Unit\Support
+ * @author    Conduction b.v. <info@conduction.nl>
+ * @copyright 2026 Conduction b.v.
+ * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * SPDX-FileCopyrightText: 2026 LaunchPad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ */
+
+declare(strict_types=1);
+
+namespace Unit\Support;
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Route and manifest wiring for the dashboard store.
+ */
+class StoreWiringTest extends TestCase {
+	/**
+	 * The decoded route table.
+	 *
+	 * @return array<int, array<string, mixed>>
+	 */
+	private function routes(): array {
+		$table = require dirname(__DIR__, 3) . '/appinfo/routes.php';
+
+		return $table['routes'];
+	}//end routes()
+
+	/**
+	 * The decoded frontend manifest.
+	 *
+	 * @return array<string, mixed>
+	 */
+	private function manifest(): array {
+		$raw = file_get_contents(dirname(__DIR__, 3) . '/src/manifest.json');
+		$decoded = json_decode((string)$raw, true);
+		$this->assertIsArray($decoded, 'src/manifest.json must be valid JSON');
+
+		return $decoded;
+	}//end manifest()
+
+	/**
+	 * REQ-STORE-001: the endpoints CnStorePage calls must be routed.
+	 *
+	 * @return void
+	 */
+	public function testTheStorePageCanReachItsEndpoints(): void {
+		$urls = [];
+		foreach ($this->routes() as $route) {
+			$urls[$route['name']] = $route['url'];
+		}
+
+		$this->assertSame('/api/store/items', ($urls['store#search'] ?? null));
+		$this->assertSame('/api/store/items/{slug}/install', ($urls['store#install'] ?? null));
+	}//end testTheStorePageCanReachItsEndpoints()
+
+	/**
+	 * REQ-STORE-001: a malformed slug fails at the router, not at the registry.
+	 *
+	 * @return void
+	 */
+	public function testTheInstallRouteConstrainsTheSlug(): void {
+		$pattern = null;
+		foreach ($this->routes() as $route) {
+			if ($route['name'] === 'store#install') {
+				$pattern = ($route['requirements']['slug'] ?? null);
+			}
+		}
+
+		$this->assertIsString($pattern);
+		$this->assertSame(1, preg_match('/^' . $pattern . '$/', 'sales-overview'));
+		$this->assertSame(0, preg_match('/^' . $pattern . '$/', '../../etc/passwd'));
+		$this->assertSame(0, preg_match('/^' . $pattern . '$/', 'Sales_Overview'));
+	}//end testTheInstallRouteConstrainsTheSlug()
+
+	/**
+	 * REQ-STORE-008: the manifest declares the page and no engine store block.
+	 *
+	 * @return void
+	 */
+	public function testTheManifestDeclaresThePageButNoStoreBlock(): void {
+		$manifest = $this->manifest();
+
+		$this->assertArrayNotHasKey(
+			'store',
+			$manifest,
+			'a store block configures the engine controller LaunchPad does not use'
+		);
+
+		$storePages = array_filter(
+			$manifest['pages'],
+			static fn (array $page): bool => (($page['type'] ?? '') === 'store')
+		);
+		$this->assertCount(1, $storePages);
+	}//end testTheManifestDeclaresThePageButNoStoreBlock()
+
+	/**
+	 * The store page's copy follows the Conduction voice.
+	 *
+	 * No em-dash, sentence case, and short sentences. A gate rejects the
+	 * em-dash in a manifest after the fact; this catches it in the suite.
+	 *
+	 * @return void
+	 */
+	public function testTheStorePageCopyHasNoEmDash(): void {
+		$page = array_values(
+			array_filter(
+				$this->manifest()['pages'],
+				static fn (array $candidate): bool => (($candidate['type'] ?? '') === 'store')
+			)
+		)[0];
+
+		$description = (string)($page['config']['description'] ?? '');
+		$this->assertNotSame('', $description);
+		$this->assertStringNotContainsString('—', $description);
+		$this->assertStringNotContainsString('–', $description);
+	}//end testTheStorePageCopyHasNoEmDash()
+}//end class
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
index 9e9138d01..1f93013f0 100644
--- a/tests/bootstrap.php
+++ b/tests/bootstrap.php
@@ -31,11 +31,98 @@
 // (PHPUNIT_USE_NC_BOOTSTRAP=1) or when the environment is pre-configured
 // (e.g. a running NC container). Fall back to OCP stubs otherwise so that
 // unit tests can run in any CI builder container without a live NC install.
+//
+// "Pre-configured" means INSTALLED, not merely checked out. `lib/base.php`
+// from a source tree that was never installed (the workspace checkout above
+// apps-extra/ has a 0-byte config/config.php) still declares `OC` and builds
+// `\OC::$server` before it throws "Not installed". That server cannot be
+// undone (`OC::$server` is a typed static), so from then on every
+// `\OC::$server->get()` in the code under test hits a container that knows
+// none of this app's registrations and autowires from scratch; constructor
+// cycles then recurse until memory runs out (19 GB and 6 GB of swap in one
+// openregister run on 2026-09-08). The decision therefore has to be made
+// BEFORE base.php is loaded, on the `installed` flag in config/config.php.
+
+/**
+ * Tell whether a Nextcloud root is an INSTALLED instance, not just a source tree.
+ *
+ * @param string $ncRoot Candidate Nextcloud root.
+ *
+ * @return bool True when config/config.php declares `installed => true`.
+ */
+function launchpad_nc_root_is_installed(string $ncRoot): bool
+{
+	$configFile = $ncRoot . '/config/config.php';
+	if (is_file($configFile) === false || filesize($configFile) === 0) {
+		return false;
+	}
+
+	// The config file is a plain `$CONFIG = [...]` script; including it in a
+	// closure keeps `$CONFIG` out of the global scope.
+	$config = (static function () use ($configFile): array {
+		$CONFIG = [];
+		try {
+			include $configFile;
+		} catch (\Throwable) {
+			return [];
+		}
+
+		if (is_array($CONFIG) === false) {
+			return [];
+		}
+
+		return $CONFIG;
+	})();
+
+	return ($config['installed'] ?? false) === true;
+}//end launchpad_nc_root_is_installed()
+
+$ncRoot = realpath(__DIR__ . '/../../..');
 $ncBasePhp = __DIR__ . '/../../../lib/base.php';
-$ncUseFull = (file_exists($ncBasePhp) === true)
+$ncRequested = (file_exists($ncBasePhp) === true)
 	&& getenv('PHPUNIT_USE_NC_BOOTSTRAP') === '1';
+$ncUseFull = $ncRequested === true
+	&& $ncRoot !== false
+	&& launchpad_nc_root_is_installed($ncRoot) === true;
+if ($ncRequested === true && $ncUseFull === false) {
+	fwrite(
+		STDERR,
+		sprintf(
+			"[launchpad/tests/bootstrap] Nextcloud root at %s is not an installed instance (config/config.php lacks installed => true); "
+			. "skipping lib/base.php and running with composer autoload and OCP stubs only (pure-unit mode).\n",
+			(string) $ncRoot
+		)
+	);
+}
+
 if ($ncUseFull === true) {
-	include_once $ncBasePhp;
+	try {
+		include_once $ncBasePhp;
+	} catch (\Throwable $e) {
+		// The tree IS installed, so the dangerous case this guard exists for
+		// (loading a bare source tree) did not happen. base.php still failed
+		// part-way.
+		//
+		// This does NOT abort. `OC::$server` is a typed static, so a half-built
+		// container cannot be unset, and aborting was tried: it turned all six
+		// PHPUnit legs red on a suite that passes (humaniq, 2026-09-08). The
+		// runaway this guard exists for needs an autowiring lookup to reach the
+		// poisoned container, this app has none in lib, and phpunit.xml's 2G cap
+		// bounds one anyway.
+		//
+		// So: say plainly that the container is unreliable, and let the pure unit
+		// tests run. A container-bound test failing loudly is the intended outcome.
+		fwrite(
+			STDERR,
+			sprintf(
+				"[launchpad/tests/bootstrap] Nextcloud at %s could not finish booting (%s).\n"
+				. "  \\OC::\$server now holds a HALF-BUILT container and cannot be unset. Pure unit tests\n"
+				. "  continue; anything resolving a service from that container is UNVERIFIED by this run.\n",
+				(string) $ncRoot,
+				$e->getMessage()
+			)
+		);
+	}
 } elseif (is_dir(__DIR__ . '/../vendor/nextcloud/ocp/OCP') === true) {
 	// Outside the container we register the OCP stubs from
 	// vendor/nextcloud/ocp so unit tests that mock OCP interfaces
diff --git a/tests/e2e/admin-menu-permissions.spec.ts b/tests/e2e/admin-menu-permissions.spec.ts
new file mode 100644
index 000000000..89cd7f881
--- /dev/null
+++ b/tests/e2e/admin-menu-permissions.spec.ts
@@ -0,0 +1,413 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * The manifest's `permission` field, proved against a real non-admin session
+ * and the real `@conduction/nextcloud-vue` bundle.
+ *
+ * 🔴 WHY THIS FILE EXISTS AT ALL. `manifest.menu` declares
+ * `permission: "admin"` on `admin-templates` and `admin-settings`, and
+ * `App.vue` passed no `permissions` prop to `CnAppRoot`.
+ * `CnAppNav.passesPermission` renders every entry when the list is missing or
+ * empty, so both admin entries rendered for every authenticated account and
+ * the declaration was inert.
+ *
+ * The unit suite cannot prove this fixed. `vitest.config.js` redirects
+ * `@conduction/nextcloud-vue` to a stub for EVERY spec, so nothing in it runs
+ * the real filter. This is the only test that does.
+ *
+ * ⚠️ THREE WAYS A TEST LIKE THIS PASSES WITHOUT PROVING ANYTHING, all of which
+ * have shipped in this fleet, and each of which is closed below:
+ *
+ *  1. The "non-admin" context is the admin. `browser.newContext()` merges
+ *     playwright.config's `use.storageState`, so a context created without an
+ *     explicit override carries the admin cookie. `loginAs` passes
+ *     `storageState: undefined` for exactly this reason. Dossiq's version of
+ *     this test asked whether an admin could see an admin page and therefore
+ *     could only ever fail (ConductionNL/dossiq#2307).
+ *  2. The session is anonymous. Clearing the storage state without logging in
+ *     lands on `/login`, where the nav has no entries and the route has no
+ *     content — so both assertions pass for reasons unrelated to permissions.
+ *  3. The page never rendered. "No admin links" is also what a blank page
+ *     looks like.
+ *
+ * So the identity is asserted FIRST, and every absence assertion is paired
+ * with a presence assertion that fails if the shell did not render.
+ *
+ * Gate-19 @e2e traceability:
+ *   @e2e runtime-shell::admin-menu-entries-are-hidden-from-non-admins
+ *   @e2e runtime-shell::admin-routes-redirect-non-admins
+ *   @e2e runtime-shell::admin-menu-entries-render-for-admins
+ *
+ * @spec openspec/specs/runtime-shell/spec.md
+ */
+
+import type { Page } from '@playwright/test'
+
+import { expect, test } from '@playwright/test'
+import {
+	deprovisionUser,
+	loginAs,
+	provisionThrowawayUser,
+} from './fixtures/secondary-user.ts'
+import { installBundleOverride } from './support/bundleOverride.ts'
+
+const APP_BASE = '/apps/launchpad'
+
+/**
+ * The two admin surfaces, by all three of the names they go by: the manifest
+ * MENU ENTRY id, the URL path, and the route NAME the entry resolves through.
+ *
+ * 🔴 `id` IS HERE BECAUSE THE ABSENCE ASSERTIONS MUST KEY ON IT, and getting
+ * that wrong made this test pass against a bundle with the bug in it.
+ *
+ * The first version of this file identified the entries by `data-cn-route`,
+ * which renders `item.route` verbatim. But this fix CHANGES `item.route`:
+ * both entries used to declare the URL path (`/admin/templates`) where
+ * `CnAppNav` wants a route name (`admin-templates-index`). So against the
+ * unfixed bundle `expect(routes).not.toContain('admin-templates-index')`
+ * passed — not because the entry was hidden, but because the unfixed manifest
+ * never emits that string. The entries were on screen the whole time, under
+ * the names the same run recorded for the admin:
+ *
+ *     ["Workspace","Store","Reports","FeaturesRoadmap","Flows",
+ *      "/admin/templates","/admin/settings"]
+ *
+ * An absence assertion is only worth what its locator is worth, and a locator
+ * keyed to a value the fix introduces can never see the unfixed state. `id`
+ * is untouched by this change and by any future re-routing, so it is what the
+ * absence is asserted on. `route` stays, used only where the question really
+ * is about the route: whether an admin's entry resolves to a working link.
+ */
+const ADMIN_PAGES = [
+	{
+		id: 'admin-templates',
+		path: '/admin/templates',
+		route: 'admin-templates-index',
+	},
+	{ id: 'admin-settings', path: '/admin/settings', route: 'admin-settings' },
+] as const
+
+/** A menu entry every account holds, as the positive control. */
+const UNGATED_ENTRY_ID = 'dashboards'
+
+/**
+ * Who the browser is actually signed in as, read from Nextcloud itself rather
+ * than assumed from how the context was built.
+ *
+ * @param page The page.
+ * @return The uid and admin flag.
+ */
+async function whoami(page: Page): Promise<{ uid: unknown; isAdmin: unknown }> {
+	return page.evaluate(() => ({
+		uid: (window as any).OC?.getCurrentUser?.()?.uid ?? null,
+
+		isAdmin: (window as any).OC?.isUserAdmin?.() ?? null,
+	}))
+}
+
+/**
+ * Open the app and wait for the shell AND the shared navigation to be present.
+ *
+ * Waiting for the nav specifically is load-bearing: every assertion below is
+ * about which entries the nav holds, and a nav that never rendered holds none
+ * of them.
+ *
+ * @param page The page.
+ */
+async function openApp(page: Page): Promise<void> {
+	await page.goto(`${APP_BASE}/`, { waitUntil: 'domcontentloaded' })
+
+	// 60s, not 30s. A cold boot of this app on a loaded instance went past 30s
+	// and turned a run that had already passed on the same bundle red at
+	// `.workspace-shell`. A guard test whose setup is marginal reports the
+	// environment, not the guard.
+	await expect(page.locator('.workspace-shell')).toBeVisible({ timeout: 60_000 })
+	await expect(page.locator('[data-testid="cn-nav"]')).toBeVisible({
+		timeout: 60_000,
+	})
+}
+
+/**
+ * The manifest routes the navigation currently holds, read from
+ * `CnAppNav`'s own `data-cn-route` attribute.
+ *
+ * ⚠️ BY ATTRIBUTE, NOT BY LABEL OR BY LINK, and both alternatives were tried
+ * and rejected against the running instance:
+ *
+ *  - By anchor. `CnAppNav.itemTo` builds `{ name: item.route }`, so an entry
+ *    whose route name vue-router cannot resolve renders a nav item with NO
+ *    `<a>` at all. Counting anchors therefore reports zero for an entry that
+ *    is on screen, which is the exact false pass this test exists to prevent.
+ *  - By label. The settings foldout also contains the LIBRARY's own
+ *    auto-injected "Admin settings" link to `/settings/admin/launchpad`
+ *    (`CnAppNav.showAdminSettingsLink`), which is gated separately on
+ *    `isAdmin` and is not a manifest entry. Matching the text "Admin
+ *    settings" cannot tell the two apart, so a passing run would prove the
+ *    library's gate and say nothing about this app's.
+ *
+ * `data-cn-route` is rendered on the nav item itself and carries the manifest
+ * `route` verbatim, so it identifies exactly the entries under test.
+ *
+ * @param page The page.
+ * @return The manifest route names present in the nav.
+ */
+async function navRoutes(page: Page): Promise<string[]> {
+	return page
+		.locator('[data-testid="cn-nav"] [data-cn-route]')
+		.evaluateAll((nodes) =>
+			nodes.map((n) => n.getAttribute('data-cn-route') ?? ''),
+		)
+}
+
+/**
+ * The manifest menu-entry IDS the navigation currently holds.
+ *
+ * `CnAppNav` renders `data-testid="cn-nav-entry-${item.id}"` on every
+ * non-caption entry. Unlike `data-cn-route` this does not move when a route is
+ * re-pointed, which is what makes it the right key for asking whether an entry
+ * is on screen at all. See the note on ADMIN_PAGES for what keying the
+ * question on the route instead cost.
+ *
+ * @param page The page.
+ * @return The manifest menu entry ids present in the nav.
+ */
+async function navEntryIds(page: Page): Promise<string[]> {
+	return page
+		.locator('[data-testid="cn-nav"] [data-testid^="cn-nav-entry-"]')
+		.evaluateAll((nodes) =>
+			nodes.map((n) =>
+				(n.getAttribute('data-testid') ?? '').replace(/^cn-nav-entry-/, ''),
+			),
+		)
+}
+
+test.describe('manifest permission: the admin surfaces', () => {
+	// Three of these four tests provision a brand-new account and log it in
+	// cold. That is a first login for that user: Nextcloud builds the home
+	// folder, copies the skeleton, and — on any instance where `seed.sh` has
+	// not disabled it — runs the first-run wizard. Measured on the shared dev
+	// box, that path alone took 59s, so the config's 60s budget expired
+	// during LOGIN and all three reported a timeout instead of an assertion.
+	//
+	// A timeout is the worst possible outcome for a guard test: it is red
+	// whether the guard works or not, so it can neither confirm nor deny.
+	// The budget is raised rather than the waits shortened — nothing here is
+	// asserted more weakly, it just gets far enough to assert at all.
+	test.describe.configure({ timeout: 180_000 })
+
+	let account: { username: string; password: string }
+
+	test.beforeAll(async () => {
+		// A freshly provisioned account holds no group membership at all, so
+		// it cannot have inherited admin from a reused instance — which is how
+		// a "non-admin" fixture quietly becomes an admin over time.
+		account = await provisionThrowawayUser('e2e-perm')
+	})
+
+	test.afterAll(async () => {
+		if (account) {
+			await deprovisionUser(account.username)
+		}
+	})
+
+	test('hides both admin menu entries from an account that is not an admin', async ({
+		browser,
+	}) => {
+		const { context, page } = await loginAs(
+			browser,
+			account.username,
+			account.password,
+		)
+		try {
+			await openApp(page)
+
+			// FIRST, and before anything that could pass for the wrong reason.
+			const who = await whoami(page)
+			expect(who.uid, 'the session under test is the throwaway account').toBe(
+				account.username,
+			)
+			expect(who.isAdmin, 'the account under test is not an admin').toBe(false)
+
+			const entryIds = await navEntryIds(page)
+
+			// The positive control, asserted BEFORE the absence. Without it a
+			// nav that never built satisfies the next assertion perfectly.
+			expect(
+				entryIds,
+				'the navigation rendered its ungated entries',
+			).toContain(UNGATED_ENTRY_ID)
+
+			for (const { id } of ADMIN_PAGES) {
+				expect(
+					entryIds,
+					`admin-gated menu entry "${id}" rendered for a non-admin`,
+				).not.toContain(id)
+			}
+		} finally {
+			await context.close()
+		}
+	})
+
+	for (const { path: route } of ADMIN_PAGES) {
+		test(`redirects a non-admin off ${route}`, async ({ browser }) => {
+			const { context, page } = await loginAs(
+				browser,
+				account.username,
+				account.password,
+			)
+			try {
+				// IDENTITY FIRST, AND ON A PAGE THAT CAN ANSWER IT.
+				//
+				// `whoami` used to be read after navigating to the gated
+				// route. Against an unguarded bundle that lands on
+				// /settings/admin/launchpad, which Nextcloud refuses to a
+				// non-admin with an error page that loads no `OC` bundle at
+				// all, so `OC.getCurrentUser()` returned null and the test
+				// died on "expected e2e-perm-..., received null". Red for the
+				// right underlying reason, reported as something else
+				// entirely.
+				//
+				// Reading it here also puts the check where it belongs: the
+				// session is confirmed to be the throwaway non-admin BEFORE
+				// the action under test, not after.
+				await openApp(page)
+
+				const who = await whoami(page)
+				expect(
+					who.uid,
+					'the session under test is the throwaway account',
+				).toBe(account.username)
+				expect(who.isAdmin, 'the account under test is not an admin').toBe(
+					false,
+				)
+
+				await page.goto(`${APP_BASE}${route}`, {
+					waitUntil: 'domcontentloaded',
+				})
+				// A SETTLE, NOT AN ASSERTION, and the rejection is swallowed
+				// on purpose: the shell is asserted properly further down,
+				// once the URL has been checked.
+				//
+				// The order matters more than it looks. This wait used to be
+				// an assertion in this position, and against an unguarded
+				// bundle it is the FIRST thing to fail, so both tests
+				// reported `.workspace-shell` not visible. That is true, and
+				// it is not the point: the shell is missing because the
+				// browser left LaunchPad for /settings/admin/launchpad, which
+				// is to say the non-admin reached the admin surface. "Shell
+				// not visible" equally describes an app that failed to boot,
+				// so the run could not tell a security failure from a broken
+				// build. Checking the URL first makes the failure name
+				// itself.
+				await page
+					.locator('.workspace-shell')
+					.waitFor({ state: 'visible', timeout: 30_000 })
+					.catch(() => undefined)
+
+				// WHERE IT LANDED, not merely that it left, and not pinned to
+				// one exact path.
+				//
+				// Two different wrong outcomes look alike if you only assert
+				// that the admin page is absent. The guard letting the route
+				// through lands on Nextcloud's own admin settings, because
+				// `AdminSettingsRedirect` bounces there; the app failing to
+				// boot lands nowhere at all. Both are "not the admin route".
+				// So the assertion is that the browser is still inside this
+				// app and no longer on an admin path.
+				//
+				// Pinning the exact landing URL was the earlier mistake here,
+				// and it was made twice. First the pattern was
+				// `${APP_BASE}/?$`, but the guard sends the browser to '/'
+				// and LaunchPad resolves '/' onward to its active dashboard,
+				// so a WORKING redirect arrives at `/apps/launchpad/dashboard`
+				// and was called a failure. Then the replacement anchored the
+				// path at the start with `^`, which passes locally and fails
+				// in CI: Nextcloud there serves `index.php` routing, so the
+				// same working redirect arrives at
+				// `/index.php/apps/launchpad/dashboard`.
+				//
+				// So the test is UNANCHORED and built from APP_BASE rather
+				// than a literal. It asks the only question that matters,
+				// which is whether the browser is somewhere under this app,
+				// and it stays false for the unguarded outcome: an unguarded
+				// route lands on `/settings/admin/launchpad`, under either
+				// routing style, which does not contain `/apps/launchpad/`.
+				const landed = new URL(page.url())
+				expect(
+					landed.pathname,
+					'a non-admin was not bounced back into the app',
+				).toMatch(new RegExp(`${APP_BASE}/`))
+				expect(
+					landed.pathname,
+					'a non-admin still reached an admin surface',
+				).not.toMatch(/\/admin\//)
+				await expect(
+					page.locator('[data-testid="AdminSettingsRedirect"]'),
+					'the admin redirect page rendered for a non-admin',
+				).toHaveCount(0)
+
+				// And the app is genuinely on screen. Without this, a page
+				// that rendered nothing at all satisfies every assertion
+				// above.
+				await expect(
+					page.locator('.workspace-shell'),
+					'the app did not render after the redirect',
+				).toBeVisible({ timeout: 30_000 })
+			} finally {
+				await context.close()
+			}
+		})
+	}
+
+	test('still shows both admin entries, and serves both routes, to an admin', async ({
+		page,
+	}) => {
+		// This context is the config's, not one `loginAs` built, so the bundle
+		// override has to be installed here too — and before the first
+		// navigation. Without `LAUNCHPAD_BUNDLE_DIR` it does nothing.
+		await installBundleOverride(page.context())
+
+		// The other half of the gate. Without this, hiding the entries from
+		// EVERYONE — including admins — also passes the tests above, and that
+		// is a regression rather than a fix.
+		await openApp(page)
+
+		const who = await whoami(page)
+		expect(who.isAdmin, 'the default e2e session is the admin').toBe(true)
+
+		const entryIds = await navEntryIds(page)
+		for (const { id } of ADMIN_PAGES) {
+			expect(
+				entryIds,
+				`admin-gated menu entry "${id}" is missing for an admin`,
+			).toContain(id)
+		}
+
+		// And the entries point where they are supposed to. This is the one
+		// question that really is about the route, so it reads `data-cn-route`
+		// rather than the id: an entry can be present and still declare a
+		// route name vue-router cannot resolve, which is what both of these
+		// used to do.
+		const routes = await navRoutes(page)
+		for (const { route } of ADMIN_PAGES) {
+			expect(
+				routes,
+				`admin-gated menu entry "${route}" declares no resolvable route`,
+			).toContain(route)
+		}
+
+		// The entry must also WORK, not merely render. Both entries used to
+		// declare a URL path where CnAppNav expects a route NAME, so
+		// vue-router could not resolve either one and both rendered as nav
+		// items with no anchor — visible, inert, and for everybody.
+		for (const { path: routePath, route } of ADMIN_PAGES) {
+			await expect(
+				page
+					.locator(`[data-cn-route="${route}"] a, a[href$="${routePath}"]`)
+					.first(),
+				`admin-gated menu entry "${route}" renders no working link`,
+			).toBeAttached()
+		}
+	})
+})
diff --git a/tests/e2e/admin-settings-key-roundtrip.spec.ts b/tests/e2e/admin-settings-key-roundtrip.spec.ts
new file mode 100644
index 000000000..ae26eb282
--- /dev/null
+++ b/tests/e2e/admin-settings-key-roundtrip.spec.ts
@@ -0,0 +1,411 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * The admin-settings GET → PUT round-trip (REQ-ASET-001, REQ-ASET-002).
+ *
+ * 🔴 WHY THIS EXISTS: A `{"status":"ok"}` THAT WROTE NOTHING
+ * =========================================================
+ * `GET /api/admin/settings` answers with long keys — `allowUserDashboards`,
+ * `allowMultipleDashboards`, `defaultGridColumns`, `linkCreateFileExtensions`,
+ * `defaultPermissionLevel`. `PUT /api/admin/settings` bound only the SHORT
+ * spellings — `allowUserDash`, `allowMultiDash`, `defaultGridCols`,
+ * `linkCreateFileExts`, `defaultPermLevel`.
+ *
+ * Nextcloud does not reject a parameter it cannot bind; it leaves the argument
+ * at its default, and every one of those arguments defaults to `null` — which
+ * `AdminSettingsService::updateSettings()` reads as "not supplied". So a caller
+ * that reads the settings, edits one field and writes the object back wrote
+ * NOTHING, and was answered `{"status":"ok"}` for it.
+ *
+ * Measured on a live instance before the fix:
+ *
+ *     PUT {"allowUserDashboards":true,"defaultGridColumns":8}  ->  {"status":"ok"}
+ *     GET                                    ->  allowUserDashboards=false, defaultGridColumns=12
+ *
+ * A 200 that changed nothing is indistinguishable from a 200 that worked, which
+ * is why nothing caught this. THE ASSERTION THAT MATTERS IS THEREFORE NOT THE
+ * STATUS CODE — it is the re-read. Every test below writes, then reads back, and
+ * fails on the value rather than on the response.
+ *
+ * THE SPEC USED TO BLESS THE DEFECT. REQ-ASET-002's scenario "Update a single
+ * boolean setting" carried a NOTE reading "The API update endpoint accepts
+ * abbreviated camelCase parameter names ... NOT the full response key names."
+ * That note was rewritten alongside these tests, and REQ-ASET-002 gained the two
+ * scenarios this file cites: the GET-to-PUT round trip, and the rule that the
+ * short name wins when both arrive.
+ *
+ * WHAT IS DELIBERATELY NOT ASSERTED. That an unknown key is *rejected*. It is
+ * not — REQ-ASET-002 "Update with unknown setting key" says unrecognised keys
+ * are ignored, and that stays true. The defect was never that unknown keys are
+ * ignored; it was that the endpoint's OWN read vocabulary was among them.
+ *
+ * @spec openspec/specs/admin-settings/spec.md
+ */
+
+import type { APIRequestContext, Page, request } from '@playwright/test'
+import type { SeededDashboard } from './support/dashboardFixture.ts'
+
+import { expect, test } from '@playwright/test'
+import { BASE_URL as BASE } from './support/baseUrl.ts'
+import {
+	removeSeededDashboard,
+	seedActiveDashboard,
+} from './support/dashboardFixture.ts'
+
+const ADMIN = {
+	user: process.env.NC_ADMIN_USER ?? 'admin',
+	pass: process.env.NC_ADMIN_PASS ?? 'admin',
+}
+
+const SETTINGS = `${BASE}/index.php/apps/launchpad/api/admin/settings`
+const APP_URL = '/index.php/apps/launchpad'
+
+/**
+ * Every key the GET side publishes that the PUT side aliases, paired with the
+ * short spelling that has always worked and a value guaranteed to differ from
+ * the factory default.
+ *
+ * The short spelling is here for two reasons: it restores the instance in
+ * `afterAll` through a path that is known good, and it lets the tie-break test
+ * send both spellings in one body.
+ */
+const ALIASED_KEYS: Array<{
+	long: string
+	short: string
+	/** A value that differs from this instance's default. */
+	probe: unknown
+	/** A second distinct value, so neither leg can pass on a stuck state. */
+	counterProbe: unknown
+}> = [
+	{
+		long: 'allowUserDashboards',
+		short: 'allowUserDash',
+		probe: false,
+		counterProbe: true,
+	},
+	{
+		long: 'allowMultipleDashboards',
+		short: 'allowMultiDash',
+		probe: false,
+		counterProbe: true,
+	},
+	{
+		long: 'defaultGridColumns',
+		short: 'defaultGridCols',
+		probe: 8,
+		counterProbe: 12,
+	},
+	{
+		long: 'linkCreateFileExtensions',
+		short: 'linkCreateFileExts',
+		probe: ['txt', 'md'],
+		counterProbe: ['txt', 'md', 'docx'],
+	},
+	{
+		long: 'defaultPermissionLevel',
+		short: 'defaultPermLevel',
+		probe: 'view_only',
+		counterProbe: 'add_only',
+	},
+]
+
+/** An admin-authenticated request context using HTTP Basic auth. */
+async function adminApi(playwright: {
+	request: { newContext: typeof request.newContext }
+}): Promise<APIRequestContext> {
+	return playwright.request.newContext({
+		baseURL: BASE,
+		httpCredentials: { username: ADMIN.user, password: ADMIN.pass },
+		extraHTTPHeaders: { 'OCS-APIRequest': 'true' },
+	})
+}
+
+/** Read the whole settings object, failing loudly on a non-2xx. */
+async function readSettings(
+	api: APIRequestContext,
+): Promise<Record<string, unknown>> {
+	const res = await api.get(SETTINGS)
+	expect(res.status(), await res.text()).toBe(200)
+	return (await res.json()) as Record<string, unknown>
+}
+
+/**
+ * Write a body and assert only that the call was accepted.
+ *
+ * The status is NOT evidence of a write — that is the whole point of this file
+ * — so callers must follow every `writeSettings` with a `readSettings`.
+ *
+ * @param api an admin-authenticated request context.
+ * @param body the PUT payload.
+ * @return the parsed response body.
+ */
+async function writeSettings(
+	api: APIRequestContext,
+	body: Record<string, unknown>,
+): Promise<unknown> {
+	const res = await api.put(SETTINGS, { data: body })
+	expect(res.status(), await res.text()).toBe(200)
+	return await res.json()
+}
+
+/*
+ * NOT `serial`. Under `serial` the first red test skips the remaining six, and
+ * the run list would show one failure where five distinct keys are broken — the
+ * reviewer could not tell how wide the defect is. The config already pins
+ * `workers: 1` and `fullyParallel: false`, so they still run one at a time.
+ *
+ * 🔴 WHAT MAKES THAT SAFE IS `afterEach`, AND IT WAS MISSING AT FIRST. These
+ * tests used to rely on each one arranging its own precondition, and that held
+ * only while the writes were broken. The first CI run against the fixed
+ * controller proved it: the `allowMultipleDashboards` test really did leave the
+ * flag `false`, which caps every user at one dashboard, and the browser leg two
+ * tests later failed its PRECONDITION — the Add-Dashboard control was on screen
+ * but disabled, and a disabled control swaps its accessible name for the quota
+ * tooltip ("You have reached the limit of 1 dashboards"). Reproduced on the dev
+ * instance by applying exactly that leaked state. A leak that only exists once
+ * the fix works is invisible on the code the test was written against.
+ */
+test.describe('admin settings — the keys GET publishes are the keys PUT accepts', () => {
+	let api: APIRequestContext
+	let baseline: Record<string, unknown>
+	let seeded: SeededDashboard | null = null
+
+	/**
+	 * Put every aliased key back to the value it had before this file ran.
+	 *
+	 * Written through the SHORT spellings on purpose: they work on fixed and
+	 * unfixed code alike, so the restore succeeds whether or not the fix is
+	 * present — which is the one situation a cleanup must not depend on.
+	 *
+	 * @return nothing.
+	 */
+	const restoreBaseline = async (): Promise<void> => {
+		const restore: Record<string, unknown> = {}
+		for (const { long, short } of ALIASED_KEYS) {
+			if (baseline[long] !== undefined) {
+				restore[short] = baseline[long]
+			}
+		}
+		await api.put(SETTINGS, { data: restore })
+	}
+
+	test.beforeAll(async ({ playwright }) => {
+		api = await adminApi({ request: playwright.request })
+		baseline = await readSettings(api)
+
+		// Seeding a second personal dashboard is refused outright ("Multiple
+		// dashboards not allowed") while `allowMultipleDashboards` is off and
+		// the admin already owns one — measured on the dev instance. The
+		// baseline is restored in `afterAll`.
+		await api.put(SETTINGS, { data: { allowMultiDash: true } })
+
+		/*
+		 * SEED A DASHBOARD FOR THE BROWSER LEG. `.launchpad-sidebar-toggle`
+		 * lives in `.launchpad-floating-controls`, which renders only once a
+		 * dashboard is ACTIVE. `tests/e2e/seed.sh` creates the `e2e-grantee`
+		 * USER and nothing else, so on the cold instance CI provisions
+		 * LaunchPad renders "No dashboards available" and the toggle is simply
+		 * absent — the failure mode that had four other specs excluded from
+		 * this suite. Seeding here rather than leaning on whatever an earlier
+		 * spec left behind is why this passes on a cold rig as well as a warm
+		 * one.
+		 */
+		seeded = await seedActiveDashboard(api, `E2E SettingsKeys ${Date.now()}`)
+	})
+
+	/*
+	 * 🔴 RESTORE IN `afterAll`, NOT AT THE END OF A TEST BODY. These tests flip
+	 * `allowUserDashboards` off, and this suite runs against an instance other
+	 * specs share — `dashboardFixture.seedActiveDashboard` refuses to create a
+	 * dashboard while that flag is off. A test that failed halfway through and
+	 * left the flag down would redden every spec scheduled after it, and the
+	 * cause would be invisible in their output.
+	 *
+	 * The restore goes through the SHORT spellings on purpose: they are the
+	 * ones that work on unfixed code, so cleanup succeeds whether or not the
+	 * fix is present.
+	 */
+	test.afterEach(async () => {
+		if (api !== undefined && baseline !== undefined) {
+			await restoreBaseline()
+		}
+	})
+
+	test.afterAll(async () => {
+		if (api === undefined || baseline === undefined) {
+			return
+		}
+		// Personal-dashboard creation must be ON for the delete to be allowed,
+		// and the baseline may have it OFF.
+		await api.put(SETTINGS, { data: { allowUserDash: true } })
+		await removeSeededDashboard(api, seeded)
+		await restoreBaseline()
+		await api.dispose()
+	})
+
+	for (const { long, short, probe, counterProbe } of ALIASED_KEYS) {
+		// @e2e admin-settings::a-settings-object-read-from-get-can-be-written-back-through-put
+		test(`PUT accepts the response key "${long}" and the value actually lands`, async () => {
+			// Arrange through the SHORT spelling, which works on unfixed code.
+			// Without this the probe could coincide with the value already
+			// stored, and a no-op write would read back as a success.
+			await writeSettings(api, { [short]: counterProbe })
+			const before = await readSettings(api)
+			expect(
+				before[long],
+				`could not establish a starting value for ${long}`,
+			).toEqual(counterProbe)
+
+			// Act through the LONG spelling — the one a GET → edit → PUT caller
+			// naturally sends, and the one that was silently dropped.
+			const ack = await writeSettings(api, { [long]: probe })
+
+			// The endpoint said ok. That is not the assertion.
+			expect(ack).toMatchObject({ status: 'ok' })
+
+			// THIS is the assertion. Re-read and require the write to have landed.
+			const after = await readSettings(api)
+			expect(
+				after[long],
+				`PUT {"${long}": ${JSON.stringify(probe)}} answered ${JSON.stringify(ack)} `
+					+ `and left the stored value at ${JSON.stringify(after[long])}. `
+					+ `A 200 that wrote nothing is the defect this test exists for: the `
+					+ `PUT side must bind "${long}" as well as "${short}".`,
+			).toEqual(probe)
+		})
+	}
+
+	// @e2e admin-settings::both-spellings-in-one-body-resolve-to-the-short-one
+	test('a body carrying BOTH spellings resolves to the short one', async () => {
+		/*
+		 * Accepting two names for one setting creates a case that did not exist
+		 * before: what happens when both arrive and disagree. The rule is that
+		 * the short spelling wins — it is the documented parameter, every
+		 * existing caller in this repo sends it (`support/dashboardFixture.ts`
+		 * among them), and a new alias must not be able to override it.
+		 *
+		 * Unpinned, this is exactly the kind of tie-break that flips during a
+		 * later refactor without anything going red.
+		 *
+		 * ⚠️ BE HONEST ABOUT WHAT THIS PROVES TODAY. On unfixed code the long
+		 * spelling is dropped entirely, so this test passes without the tie-break
+		 * ever being exercised — "short wins" and "long is ignored" are the same
+		 * observation here. It only starts measuring the rule once the PUT side
+		 * binds both names, which is precisely when the rule starts to exist. It
+		 * is a green line in the run list that is not yet evidence.
+		 */
+		await writeSettings(api, { allowUserDash: false })
+		expect((await readSettings(api)).allowUserDashboards).toBe(false)
+
+		await writeSettings(api, {
+			allowUserDash: true,
+			allowUserDashboards: false,
+		})
+
+		expect(
+			(await readSettings(api)).allowUserDashboards,
+			'when both spellings are supplied the short one must win',
+		).toBe(true)
+	})
+
+	// @e2e admin-settings::a-settings-object-read-from-get-can-be-written-back-through-put
+	test('a value written through the response key reaches the rendered app', async ({
+		page,
+	}) => {
+		/*
+		 * TWO FULL SHELL LOADS IN ONE TEST, AND THEY ARE NOT CHEAP. Measured on
+		 * this fleet's dev instance, one `/apps/launchpad` load takes 55-60s to
+		 * settle the workspace shell — a 13 MB main bundle plus, with the legacy
+		 * widget bridge on, every enabled app's widget scripts. Two of them
+		 * overrun the config's 60s per-test timeout, and the symptom is not a
+		 * timeout message but `locator.click: Target page, context or browser has
+		 * been closed`, which reads like a bug in the test. `test.slow()` triples
+		 * the budget, the same way `spec-coverage/demo-data-setup-step.spec.ts`
+		 * buys room for its genuinely slow import.
+		 */
+		test.slow()
+
+		/*
+		 * 🔴 THE BROWSER LEG. The tests above prove the value reaches storage.
+		 * This one proves it reaches a user, which is the reason the setting
+		 * exists at all — `allowUserDashboards` is pushed into the initial state
+		 * by `InitialStateBuilder` and gates the sidebar's Add-Dashboard control.
+		 *
+		 * Both directions are asserted in one test on purpose. A single
+		 * direction can pass on a stuck instance: if the flag happened to
+		 * already sit where the test wanted it, a write that did nothing would
+		 * still show the expected UI.
+		 */
+		const addButton = async (): Promise<void> => {
+			// `domcontentloaded`, not the default `load`. This instance serves a
+			// 13 MB main bundle and, with the legacy widget bridge on, the widget
+			// scripts of every enabled app on top — measured at 55-60s to fire
+			// `load`, which is the config's whole 60s navigationTimeout. The
+			// `waitForSelector` below is the real gate anyway: it waits for the
+			// shell to have rendered, which `load` does not promise either.
+			await page.goto(APP_URL, { waitUntil: 'domcontentloaded' })
+			await page.waitForSelector(
+				'.launchpad-floating-controls, .workspace-shell',
+				{ timeout: 20_000 },
+			)
+			await openSidebar(page)
+		}
+
+		// Precondition through the short spelling: flag ON, control present.
+		// `allowMultiDash` is set too because the control's accessible name
+		// depends on it: with multiple dashboards off, the admin is at a quota
+		// of one and the button renders DISABLED, named after the quota
+		// tooltip rather than "Add dashboard". A baseline with that flag off
+		// would fail this precondition for a reason unrelated to the setting
+		// under test.
+		await writeSettings(api, { allowUserDash: true, allowMultiDash: true })
+		await addButton()
+		const sidebar = page.locator('.dashboard-switcher-sidebar')
+		const add = sidebar.getByRole('button', {
+			name: /add dashboard|dashboard toevoegen/i,
+		})
+		await expect(
+			add,
+			'precondition failed: the control is absent with the flag ON',
+		).toBeVisible({ timeout: 8_000 })
+
+		// Turn it OFF through the LONG spelling only. On unfixed code this
+		// write is a no-op and the control below stays on screen.
+		await writeSettings(api, { allowUserDashboards: false })
+		await addButton()
+		await expect(
+			page
+				.locator('.dashboard-switcher-sidebar')
+				.getByRole('button', { name: /add dashboard|dashboard toevoegen/i }),
+			'PUT {"allowUserDashboards": false} did not reach the rendered app: '
+				+ 'the Add-Dashboard control is still there.',
+		).toHaveCount(0)
+	})
+})
+
+/**
+ * Open the dashboard-switcher sidebar via the floating toggle.
+ *
+ * Targets `.launchpad-sidebar-toggle` exactly. `.launchpad-floating-controls`
+ * also hosts the dashboard-cog and Share buttons and the cog precedes the
+ * toggle in DOM order, so a comma-selector `.first()` opens the wrong popover
+ * and leaves the sidebar shut.
+ *
+ * @param page the page showing the workspace shell.
+ * @return nothing.
+ */
+async function openSidebar(page: Page): Promise<void> {
+	const toggle = page.locator('.launchpad-sidebar-toggle').first()
+	await expect(toggle).toBeVisible({ timeout: 10_000 })
+	const isOpen = await page
+		.locator('.dashboard-switcher-sidebar.open')
+		.isVisible()
+		.catch(() => false)
+	if (!isOpen) {
+		await toggle.click()
+		await page.waitForSelector('.dashboard-switcher-sidebar.open', {
+			timeout: 8_000,
+		})
+	}
+}
diff --git a/tests/e2e/ci/dashboard-share-api.spec.ts b/tests/e2e/ci/dashboard-share-api.spec.ts
index eb08b0e2e..eee5138a7 100644
--- a/tests/e2e/ci/dashboard-share-api.spec.ts
+++ b/tests/e2e/ci/dashboard-share-api.spec.ts
@@ -64,6 +64,7 @@ import type { APIRequestContext } from '@playwright/test'
 
 import { expect, request, test } from '@playwright/test'
 import { ensureDefaultWidgetRestriction } from '../fixtures/role-feature-permissions.ts'
+import { BASE_URL } from '../support/baseUrl.ts'
 
 /*
  * THE WIDGET THE REQ-SHARE-004 TEST ADDS, AND WHY IT IS NOT `label`.
@@ -105,13 +106,14 @@ const ADMIN = {
 
 /*
  * `baseURL` is a TEST-scoped Playwright option and cannot be destructured in
- * a worker-scoped hook. The neighbouring public-share specs read the same
- * environment variable the config resolves it from; so does this file.
+ * a worker-scoped hook, so the hooks here use the same resolver the config
+ * does, tests/e2e/support/baseUrl.ts.
  */
-const ENV_BASE_URL = (process.env.BASE_URL ?? process.env.NC_BASE_URL ?? '').replace(
-	/\/$/,
-	'',
-)
+// Through the shared resolver, not a private read of `BASE_URL`. That read
+// ignored `PLAYWRIGHT_BASE_URL`, the variable tests/e2e/support/baseUrl.ts
+// documents, so a local run that set only it failed here with `Invalid URL`.
+// CI exports `BASE_URL`, which the resolver still honours.
+const ENV_BASE_URL = BASE_URL
 
 const SETTINGS = '/index.php/apps/launchpad/api/admin/settings'
 const DASHBOARDS = '/index.php/apps/launchpad/api/dashboard'
@@ -914,3 +916,101 @@ test.describe('REQ-SHARE-009 bulk replace', () => {
 		await asBob.dispose()
 	})
 })
+
+/**
+ * How many share rows point at a dashboard that no longer exists.
+ *
+ * 🔴 WHY THIS, AND NOT THE SHARE LIST OR THE RECIPIENT'S VIEW. An orphaned
+ * share row is unreachable from every product path: its dashboard is gone, so
+ * the share list answers 404 and the recipient's visible list drops it,
+ * whether or not the row was deleted. Those assertions pass with or without
+ * the cascade and so cannot prove it. The orphan count can.
+ *
+ * It is read through a DRY-RUN purge, not `/api/admin/cleanup/scan`. The scan
+ * serves a cached result for 300 seconds and only a real purge invalidates
+ * it, so a before/after pair of scans compares the same cached number with
+ * itself. The dry run counts live, inside a rolled-back transaction, and
+ * deletes nothing.
+ *
+ * @param admin An admin API client.
+ * @return The number of orphaned user and group share rows.
+ */
+async function orphanedShareCount(admin: APIRequestContext): Promise<number> {
+	const res = await admin.post(
+		'/index.php/apps/launchpad/api/admin/cleanup/purge',
+		{
+			data: { categories: ['expired_share_tokens'], dryRun: true },
+		},
+	)
+	expect(res.status(), await res.text()).toBe(200)
+	const body = await res.json()
+	expect(body.dryRun, 'the orphan count must come from a dry run').toBe(true)
+	return Number(body.purgedByCategory?.expired_share_tokens ?? 0)
+}
+
+test.describe('REQ-CSC-002 deleting a dashboard removes its shares', () => {
+	// @e2e dashboard-cascade-events::user-and-group-shares-are-deleted-with-their-dashboard
+	test('deleting a dashboard removes its user and group shares', async () => {
+		const owner = await apiAs(ADMIN)
+		const asBob = await apiAs(bob)
+		const asCarol = await apiAs(carol)
+		const dash = await createDashboard(owner, 'cascade')
+
+		for (const [shareType, shareWith] of [
+			['user', bob.user],
+			['group', salesGroup],
+		]) {
+			const grant = await owner.post(sharesUrl(dash.id), {
+				data: { shareType, shareWith, permissionLevel: 'view_only' },
+			})
+			expect(grant.status(), await grant.text()).toBeLessThan(300)
+		}
+
+		// CONTROLS: both shares exist, and both recipients see the dashboard.
+		// Without these, every absence below would also hold for a share that
+		// was never made.
+		expect(
+			await listShares(owner, dash.id),
+			'CONTROL: the user share and the group share both exist',
+		).toHaveLength(2)
+		expect(
+			(await listVisible(asBob)).map((d) => Number(d.id)),
+			'CONTROL: the named recipient sees the dashboard',
+		).toContain(dash.id)
+		expect(
+			(await listVisible(asCarol)).map((d) => Number(d.id)),
+			'CONTROL: the group member sees the dashboard',
+		).toContain(dash.id)
+
+		const orphansBefore = await orphanedShareCount(owner)
+
+		const deleted = await owner.delete(dashboardUrl(dash.id))
+		expect(deleted.status(), await deleted.text()).toBeLessThan(300)
+
+		// What a person sees: gone for both recipients, and not listed.
+		expect(
+			(await listVisible(asBob)).map((d) => Number(d.id)),
+			'the named recipient still sees a deleted dashboard',
+		).not.toContain(dash.id)
+		expect(
+			(await listVisible(asCarol)).map((d) => Number(d.id)),
+			'the group member still sees a deleted dashboard',
+		).not.toContain(dash.id)
+		const shareList = await owner.get(sharesUrl(dash.id))
+		expect(
+			shareList.status(),
+			'the share API still answers for a deleted dashboard',
+		).toBe(404)
+
+		// What only the database knows: the two share rows went with it.
+		// This is the assertion the cascade decides; see orphanedShareCount.
+		expect(
+			await orphanedShareCount(owner),
+			'deleting the dashboard left its user and group shares behind',
+		).toBe(orphansBefore)
+
+		await owner.dispose()
+		await asBob.dispose()
+		await asCarol.dispose()
+	})
+})
diff --git a/tests/e2e/ci/public-share-lifecycle.spec.ts b/tests/e2e/ci/public-share-lifecycle.spec.ts
index 03b30a14f..32414d1ff 100644
--- a/tests/e2e/ci/public-share-lifecycle.spec.ts
+++ b/tests/e2e/ci/public-share-lifecycle.spec.ts
@@ -64,6 +64,7 @@
 import type { APIRequestContext } from '@playwright/test'
 
 import { expect, request, test } from '@playwright/test'
+import { BASE_URL } from '../support/baseUrl.ts'
 
 const ADMIN = {
 	user: process.env.ADMIN_USER ?? process.env.NC_ADMIN_USER ?? 'admin',
@@ -190,13 +191,14 @@ let priorAllowUserDash = true
 /*
  * `baseURL` is a TEST-scoped option, so it cannot be destructured in a
  * worker-scoped hook — Playwright rejects that with "Fixture "baseURL" has
- * "test" scope but is used in beforeAll hook". These hooks read the same
- * environment variable the config resolves it from.
+ * "test" scope but is used in beforeAll hook". These hooks use the same
+ * resolver the config does, tests/e2e/support/baseUrl.ts.
  */
-const ENV_BASE_URL = (process.env.BASE_URL ?? process.env.NC_BASE_URL ?? '').replace(
-	/\/$/,
-	'',
-)
+// Through the shared resolver, not a private read of `BASE_URL`. That read
+// ignored `PLAYWRIGHT_BASE_URL`, the variable tests/e2e/support/baseUrl.ts
+// documents, so a local run that set only it failed here with `Invalid URL`.
+// CI exports `BASE_URL`, which the resolver still honours.
+const ENV_BASE_URL = BASE_URL
 
 test.beforeAll(async () => {
 	const admin = await apiAs(ENV_BASE_URL, ADMIN)
diff --git a/tests/e2e/conditional-visibility-editor.spec.ts b/tests/e2e/conditional-visibility-editor.spec.ts
index f45233a88..33f25a49b 100644
--- a/tests/e2e/conditional-visibility-editor.spec.ts
+++ b/tests/e2e/conditional-visibility-editor.spec.ts
@@ -80,15 +80,17 @@
 import type { APIRequestContext, Locator, Page } from '@playwright/test'
 
 import { expect, request, test } from '@playwright/test'
+import { BASE_URL } from './support/baseUrl.ts'
 
 const ADMIN = {
 	user: process.env.ADMIN_USER ?? process.env.NC_ADMIN_USER ?? 'admin',
 	pass: process.env.ADMIN_PASSWORD ?? process.env.NC_ADMIN_PASS ?? 'admin',
 }
-const ENV_BASE_URL = (process.env.BASE_URL ?? process.env.NC_BASE_URL ?? '').replace(
-	/\/$/,
-	'',
-)
+// Through the shared resolver, not a private read of `BASE_URL`. That read
+// ignored `PLAYWRIGHT_BASE_URL`, the variable tests/e2e/support/baseUrl.ts
+// documents, so a local run that set only it failed here with `Invalid URL`.
+// CI exports `BASE_URL`, which the resolver still honours.
+const ENV_BASE_URL = BASE_URL
 
 const APP_URL = '/index.php/apps/launchpad'
 const SETTINGS = '/index.php/apps/launchpad/api/admin/settings'
diff --git a/tests/e2e/dashboard-export-import-roundtrip.spec.ts b/tests/e2e/dashboard-export-import-roundtrip.spec.ts
new file mode 100644
index 000000000..b748c22c4
--- /dev/null
+++ b/tests/e2e/dashboard-export-import-roundtrip.spec.ts
@@ -0,0 +1,259 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * A dashboard exported and imported again keeps its widgets' configuration
+ * (REQ-EXIM-004).
+ *
+ * 🔴 WHY THIS EXISTS: AN IMPORT THAT REPORTED SUCCESS AND LOST EVERYTHING
+ * ======================================================================
+ * Export writes each widget placement whole. The importer used to keep only
+ * its grid, style and title, so a dashboard that went out and came back had
+ * the right number of widgets in the right places, every one of them
+ * unconfigured: text widgets with no text, object-lists with no register,
+ * nc-widget proxies pointing at nothing, tiles without their type or link.
+ * The import answered "Imported 1 dashboards, skipped 0" all the same.
+ *
+ * Behind that sat a worse defect. The importer set no `created_at` or
+ * `updated_at`, and both are NOT NULL on the dashboards and placements tables,
+ * so on a real database the insert failed and the dashboard was reported as
+ * skipped: no import had landed a dashboard at all. The first run of this spec
+ * against the unfixed code measured exactly that, on PostgreSQL:
+ * `importedDashboardCount: 0`, SQLSTATE 23502 on `created_at`. The content
+ * loss was hidden behind it; the unit tests mock the mapper and saw neither.
+ *
+ * It mattered more than a backup feature usually does, because the store
+ * install path (launchpad#607) hands its payload to the same importer: every
+ * dashboard installed from a registry arrived unconfigured too.
+ *
+ * So the assertion is not the import report. It is the imported text widget
+ * RENDERING the text it was exported with.
+ *
+ * WHICH SURFACE, EXACTLY. The import goes through the product's own admin
+ * page: Beheer ▸ Operations, its file input and its "Upload archive" button,
+ * the same controls an administrator uses. The export goes through the same
+ * endpoint that page's "Download all dashboards" button calls
+ * (`POST /api/admin/export`), narrowed to `scope=dashboard`. The button only
+ * offers the SITE scope, and importing a site archive back would duplicate
+ * every dashboard on the instance, which on a shared or CI instance means
+ * every other spec's fixtures.
+ *
+ * WHY THE SOURCE IS DELETED BEFORE THE RENDER CHECK. The source dashboard
+ * carries the same marker text. Deleting it first means the only place the
+ * marker can come from is the imported copy, so a green render cannot be the
+ * source dashboard showing through.
+ *
+ * @spec openspec/specs/dashboard-export-import/spec.md
+ */
+
+import type { APIRequestContext, request } from '@playwright/test'
+
+import { expect, test } from '@playwright/test'
+import { BASE_URL as BASE } from './support/baseUrl.ts'
+
+const ADMIN = {
+	user: process.env.NC_ADMIN_USER ?? 'admin',
+	pass: process.env.NC_ADMIN_PASS ?? 'admin',
+}
+
+const API = '/index.php/apps/launchpad/api'
+const SETTINGS = `${API}/admin/settings`
+const SETTINGS_PAGE = `${BASE}/index.php/settings/admin/launchpad`
+const APP_URL = '/index.php/apps/launchpad'
+
+const STAMP = Date.now()
+const DASHBOARD_NAME = `E2E RoundTrip ${STAMP}`
+// Plain words only: the text widget renders markdown, and the marker has to
+// come out of the renderer unchanged to be findable on the page.
+const MARKER = `Round trip marker ${STAMP}`
+
+/** An admin-authenticated request context using HTTP Basic auth. */
+async function adminApi(playwright: {
+	request: { newContext: typeof request.newContext }
+}): Promise<APIRequestContext> {
+	return playwright.request.newContext({
+		baseURL: BASE,
+		httpCredentials: { username: ADMIN.user, password: ADMIN.pass },
+		extraHTTPHeaders: { 'OCS-APIRequest': 'true' },
+	})
+}
+
+test.describe('dashboard export and import — widget configuration survives', () => {
+	let api: APIRequestContext
+	let allowUserDashboardsBefore: unknown
+	let previousActiveUuid: string | null = null
+	let sourceId: number | null = null
+	let sourceUuid = ''
+	let archive: Buffer | null = null
+	const importedIds: number[] = []
+
+	test.beforeAll(async ({ playwright }) => {
+		api = await adminApi({ request: playwright.request })
+
+		const settings = await api.get(SETTINGS)
+		expect(settings.status(), await settings.text()).toBe(200)
+		allowUserDashboardsBefore = (await settings.json()).allowUserDashboards
+
+		const active = await api.get(`${API}/dashboard`)
+		if (active.ok()) {
+			const uuid = (await active.json())?.dashboard?.uuid
+			previousActiveUuid = typeof uuid === 'string' ? uuid : null
+		}
+
+		// Personal dashboards must be allowed to create the source, and a second
+		// one must be allowed for the imported copy.
+		const allow = await api.put(SETTINGS, {
+			data: { allowUserDash: true, allowMultiDash: true },
+		})
+		expect(allow.status(), await allow.text()).toBe(200)
+
+		const created = await api.post(`${API}/dashboard`, {
+			data: { name: DASHBOARD_NAME },
+		})
+		expect(created.status(), await created.text()).toBeLessThan(300)
+		const body = await created.json()
+		const dash = body.dashboard ?? body
+		sourceId = Number(dash.id)
+		sourceUuid = String(dash.uuid)
+
+		const widget = await api.post(`${API}/dashboard/${sourceId}/widgets`, {
+			data: {
+				widgetId: 'text',
+				gridX: 0,
+				gridY: 0,
+				gridWidth: 6,
+				gridHeight: 3,
+				content: { text: MARKER, contentMode: 'markdown' },
+			},
+		})
+		expect(widget.status(), await widget.text()).toBeLessThan(300)
+
+		const exported = await api.post(
+			`${API}/admin/export?scope=dashboard&dashboardUuid=${sourceUuid}`,
+		)
+		expect(exported.status(), await exported.text()).toBe(200)
+		archive = await exported.body()
+		// A ZIP starts with "PK". Anything else is an error page served as 200.
+		expect(archive.subarray(0, 2).toString()).toBe('PK')
+	})
+
+	/*
+	 * 🔴 CLEANUP IN `afterAll`. The test creates a source dashboard and imports
+	 * a copy of it, and switches the admin's active dashboard. A failure
+	 * halfway must not leave either dashboard behind for later specs, or the
+	 * active preference pointing at one of them.
+	 */
+	test.afterAll(async () => {
+		if (api === undefined) {
+			return
+		}
+		for (const id of [sourceId, ...importedIds]) {
+			if (id !== null) {
+				await api.delete(`${API}/dashboard/${id}`)
+			}
+		}
+		if (previousActiveUuid !== null) {
+			await api.post(`${API}/dashboards/active`, {
+				data: { uuid: previousActiveUuid },
+			})
+		}
+		if (typeof allowUserDashboardsBefore === 'boolean') {
+			await api.put(SETTINGS, {
+				data: { allowUserDash: allowUserDashboardsBefore },
+			})
+		}
+		await api.dispose()
+	})
+
+	// @e2e dashboard-export-import::an-exported-dashboard-imported-again-keeps-every-widgets-configuration
+	test('a dashboard imported through the admin page renders its widgets configured', async ({
+		page,
+	}) => {
+		// Two page loads of a heavy shell, measured at up to a minute each on
+		// the shared dev instance; the default budget holds one.
+		test.slow()
+		expect(archive, 'beforeAll produced no export archive').not.toBeNull()
+
+		// ── Import through the admin page ────────────────────────────────────
+		await page
+			.context()
+			.setHTTPCredentials({ username: ADMIN.user, password: ADMIN.pass })
+		await page.goto(SETTINGS_PAGE, { waitUntil: 'domcontentloaded' })
+		await page.locator('[data-test="tab-operations"]').click({ timeout: 30_000 })
+
+		await page.locator('[data-test="import-file-input"]').setInputFiles({
+			name: `launchpad-roundtrip-${STAMP}.zip`,
+			mimeType: 'application/zip',
+			buffer: archive!,
+		})
+
+		const importResponse = page.waitForResponse(
+			(res) =>
+				res.url().includes('/api/admin/import')
+				&& res.request().method() === 'POST',
+		)
+		await page.locator('[data-test="import-submit"]').click()
+		const report = await (await importResponse).json()
+		expect(
+			report.importedDashboardCount,
+			`the import did not bring the dashboard back: ${JSON.stringify(report)}`,
+		).toBe(1)
+		await expect(page.locator('.launchpad-export-import__result')).toBeVisible()
+
+		// ── Find the imported copy: same name, fresh UUID ────────────────────
+		const list = await api.get(`${API}/dashboards`)
+		expect(list.status(), await list.text()).toBe(200)
+		const copies = ((await list.json()).items ?? []).filter(
+			(d: { name: string; uuid: string }) =>
+				d.name === DASHBOARD_NAME && d.uuid !== sourceUuid,
+		)
+		for (const copy of copies) {
+			importedIds.push(Number(copy.id))
+		}
+		expect(copies, 'exactly one imported copy should exist').toHaveLength(1)
+		const imported = copies[0]
+
+		/*
+		 * THE STORED FACT. Before the fix the imported text widget existed with
+		 * an empty `content`, so this names the defect precisely: the widget
+		 * arrived, its configuration did not.
+		 */
+		const detail = await api.get(`${API}/dashboard/${imported.id}`)
+		expect(detail.status(), await detail.text()).toBe(200)
+		const textWidgets = ((await detail.json()).placements ?? []).filter(
+			(p: { widgetId: string }) => p.widgetId === 'text',
+		)
+		expect(
+			textWidgets,
+			'the imported dashboard has no text widget',
+		).toHaveLength(1)
+		expect(
+			textWidgets[0].content?.text,
+			'the text widget was imported but its configuration was dropped',
+		).toBe(MARKER)
+
+		// ── The rendered fact ────────────────────────────────────────────────
+		// Delete the source first: from here on, the marker can only come from
+		// the imported copy.
+		const removed = await api.delete(`${API}/dashboard/${sourceId}`)
+		expect(removed.status(), await removed.text()).toBeLessThan(300)
+		sourceId = null
+
+		const activate = await api.post(`${API}/dashboards/active`, {
+			data: { uuid: imported.uuid },
+		})
+		expect(activate.status(), await activate.text()).toBeLessThan(300)
+
+		await page.goto(APP_URL, { waitUntil: 'domcontentloaded' })
+		await page.waitForSelector(
+			'.launchpad-floating-controls, .workspace-shell',
+			{
+				timeout: 30_000,
+			},
+		)
+		await expect(
+			page.getByText(MARKER),
+			'the imported text widget does not render the text it was exported with',
+		).toBeVisible({ timeout: 20_000 })
+	})
+})
diff --git a/tests/e2e/dashboard-import-archives.spec.ts b/tests/e2e/dashboard-import-archives.spec.ts
new file mode 100644
index 000000000..68a14df8b
--- /dev/null
+++ b/tests/e2e/dashboard-import-archives.spec.ts
@@ -0,0 +1,571 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * Importing archives through the admin page (REQ-EXIM-004, REQ-EXIM-005,
+ * REQ-EXIM-008, REQ-EXIM-011).
+ *
+ * Every test here uploads through the controls an administrator uses: Beheer ▸
+ * Operations, its file input, its "Preserve original dashboard UUIDs" switch
+ * and its "Upload archive" button. The API is used only to seed a dashboard
+ * worth colliding with and to clean up afterwards.
+ *
+ * WHY THE ARCHIVES ARE BUILT IN THE TEST. These scenarios are all about
+ * archives that are wrong in one specific way: no manifest, a manifest that is
+ * not JSON, a schema version this LaunchPad cannot read, one dashboard file out
+ * of ten corrupt. An export cannot produce those, so `support/zipArchive.ts`
+ * writes them byte by byte.
+ *
+ * WHAT IS ASSERTED, AND IN WHICH ORDER. The response the page received, then
+ * what the page shows the admin, then what the instance actually holds. A
+ * refusal that reports 400 while creating dashboards anyway, or one the admin
+ * is never told the reason for, both pass a status-code check and fail here.
+ */
+
+import type { APIRequestContext, Page, request } from '@playwright/test'
+
+import { expect, test } from '@playwright/test'
+import { BASE_URL as BASE } from './support/baseUrl.ts'
+import { buildZip, dashboardPayload, manifest } from './support/zipArchive.ts'
+
+const ADMIN = {
+	user: process.env.NC_ADMIN_USER ?? 'admin',
+	pass: process.env.NC_ADMIN_PASS ?? 'admin',
+}
+
+const API = '/index.php/apps/launchpad/api'
+const SETTINGS_PAGE = `${BASE}/index.php/settings/admin/launchpad`
+
+/** Every dashboard this file creates carries this prefix, so cleanup is exact. */
+const STAMP = `E2E ImportArchive ${Date.now()}`
+
+/** An admin-authenticated request context using HTTP Basic auth. */
+async function adminApi(playwright: {
+	request: { newContext: typeof request.newContext }
+}): Promise<APIRequestContext> {
+	return playwright.request.newContext({
+		baseURL: BASE,
+		httpCredentials: { username: ADMIN.user, password: ADMIN.pass },
+		extraHTTPHeaders: { 'OCS-APIRequest': 'true' },
+	})
+}
+
+/** Open Beheer ▸ Operations, where the export/import panel lives. */
+async function openOperationsTab(page: Page): Promise<void> {
+	await page
+		.context()
+		.setHTTPCredentials({ username: ADMIN.user, password: ADMIN.pass })
+	await page.goto(SETTINGS_PAGE, {
+		waitUntil: 'domcontentloaded',
+		timeout: 60_000,
+	})
+	await page.locator('[data-test="tab-operations"]').click({ timeout: 30_000 })
+	await expect(page.locator('[data-test="import-file-input"]')).toBeVisible({
+		timeout: 20_000,
+	})
+}
+
+interface ImportOutcome {
+	status: number
+	body: any
+	contentType: string
+}
+
+/**
+ * Upload one archive through the page and answer with what came back.
+ *
+ * @param page the admin page, already on the Operations tab.
+ * @param archive the archive bytes.
+ * @param options `preserveUuids` ticks the switch before uploading.
+ * @return the status, parsed body and request content type.
+ */
+async function importThroughThePage(
+	page: Page,
+	archive: Buffer,
+	options: { preserveUuids?: boolean; filename?: string } = {},
+): Promise<ImportOutcome> {
+	await page.locator('[data-test="import-file-input"]').setInputFiles({
+		name: options.filename ?? 'archive.zip',
+		mimeType: 'application/zip',
+		buffer: archive,
+	})
+
+	if (options.preserveUuids === true) {
+		// Click the switch's LABEL. NcCheckboxRadioSwitch hides the real
+		// `input` behind a styled span, so `check()` on the input times out
+		// against the span that covers it — the same control a person clicks.
+		await page
+			.locator('.launchpad-export-import')
+			.getByText('Preserve original dashboard UUIDs')
+			.click()
+		await expect(
+			page.locator('.launchpad-export-import input[type="checkbox"]').first(),
+		).toBeChecked()
+	}
+
+	const pending = page.waitForResponse(
+		(res) =>
+			res.url().includes('/api/admin/import')
+			&& res.request().method() === 'POST',
+		{ timeout: 60_000 },
+	)
+	await page.locator('[data-test="import-submit"]').click()
+	const response = await pending
+
+	let body: any
+	try {
+		body = await response.json()
+	} catch {
+		body = null
+	}
+
+	return {
+		status: response.status(),
+		body,
+		contentType: response.request().headers()['content-type'] ?? '',
+	}
+}
+
+test.describe('importing an archive through the admin page', () => {
+	let api: APIRequestContext
+	let seededUuid = ''
+	let seededName = ''
+
+	test.beforeAll(async ({ playwright }) => {
+		api = await adminApi({ request: playwright.request })
+
+		// Personal dashboards must be allowed, and more than one of them,
+		// because most of these tests import a copy alongside an original.
+		const allow = await api.put(`${API}/admin/settings`, {
+			data: { allowUserDash: true, allowMultiDash: true },
+		})
+		expect(allow.status(), await allow.text()).toBe(200)
+
+		seededName = `${STAMP} original`
+		const created = await api.post(`${API}/dashboard`, {
+			data: { name: seededName },
+		})
+		expect(created.status(), await created.text()).toBeLessThan(300)
+		const body = await created.json()
+		seededUuid = String((body.dashboard ?? body).uuid)
+	})
+
+	/*
+	 * 🔴 CLEANUP AFTER EVERY TEST, NOT AT THE END OF ONE. Each test imports
+	 * dashboards, and a test that fails halfway still leaves them behind: the
+	 * next test's "how many dashboards are there now" assertion would then be
+	 * measuring the previous failure. Sweeping by name prefix removes the
+	 * copies (an import keeps the name and mints a new UUID) without touching
+	 * anything another spec owns.
+	 */
+	test.afterEach(async () => {
+		const list = await api.get(`${API}/dashboards`)
+		if (!list.ok()) {
+			return
+		}
+		for (const dashboard of (await list.json()).items ?? []) {
+			const name = String(dashboard.name ?? '')
+			if (name.startsWith(STAMP) && String(dashboard.uuid) !== seededUuid) {
+				await api.delete(`${API}/dashboard/${dashboard.id}`)
+			}
+		}
+	})
+
+	test.afterAll(async () => {
+		if (api === undefined) {
+			return
+		}
+		const list = await api.get(`${API}/dashboards`)
+		if (list.ok()) {
+			for (const dashboard of (await list.json()).items ?? []) {
+				if (String(dashboard.name ?? '').startsWith(STAMP)) {
+					await api.delete(`${API}/dashboard/${dashboard.id}`)
+				}
+			}
+		}
+		await api.dispose()
+	})
+
+	/** How many dashboards the admin owns whose name starts with the stamp. */
+	async function stampedDashboards(): Promise<
+		Array<{ id: number; uuid: string; name: string }>
+	> {
+		const list = await api.get(`${API}/dashboards`)
+		expect(list.status(), await list.text()).toBe(200)
+		return ((await list.json()).items ?? []).filter((d: { name: string }) =>
+			String(d.name ?? '').startsWith(STAMP),
+		)
+	}
+
+	// @e2e dashboard-export-import::import-valid-zip-creates-new-dashboards
+	// @e2e dashboard-export-import::import-multipart-file-upload
+	test('a valid archive imports every dashboard in it, with fresh UUIDs', async ({
+		page,
+	}) => {
+		const names = [`${STAMP} one`, `${STAMP} two`, `${STAMP} three`]
+		const archive = buildZip([
+			{ name: 'manifest.json', content: manifest({ dashboardCount: 3 }) },
+			...names.map((name, index) => ({
+				name: `dashboards/fixed-uuid-${index}.json`,
+				content: dashboardPayload(`fixed-uuid-${index}`, name),
+			})),
+		])
+
+		await openOperationsTab(page)
+		const outcome = await importThroughThePage(page, archive)
+
+		expect(outcome.status).toBe(200)
+		expect(outcome.body).toMatchObject({
+			importedDashboardCount: 3,
+			skippedDashboardCount: 0,
+			errors: [],
+		})
+		// REQ-EXIM-004's multipart scenario: the page sends the archive as a
+		// multipart form, and the server takes the file out of it.
+		expect(outcome.contentType).toContain('multipart/form-data')
+
+		await expect(page.locator('.launchpad-export-import__result')).toContainText(
+			'3',
+		)
+
+		const created = (await stampedDashboards()).filter((d) =>
+			names.includes(d.name),
+		)
+		expect(created, 'all three dashboards must exist afterwards').toHaveLength(3)
+		for (const dashboard of created) {
+			expect(
+				dashboard.uuid.startsWith('fixed-uuid-'),
+				`imported dashboard kept the archive's UUID ${dashboard.uuid}; `
+					+ 'the default is a fresh one',
+			).toBe(false)
+		}
+	})
+
+	// @e2e dashboard-export-import::missing-manifestjson-fails-import
+	test('an archive without a manifest is refused, and the page says why', async ({
+		page,
+	}) => {
+		const before = (await stampedDashboards()).length
+		const archive = buildZip([
+			{
+				name: 'dashboards/no-manifest.json',
+				content: dashboardPayload('no-manifest', `${STAMP} orphan`),
+			},
+		])
+
+		await openOperationsTab(page)
+		const outcome = await importThroughThePage(page, archive)
+
+		expect(outcome.status).toBe(400)
+		expect(outcome.body?.error).toBe('manifest.json not found in archive')
+		await expect(page.locator('.launchpad-export-import__error')).toContainText(
+			'manifest.json not found in archive',
+		)
+		expect(
+			(await stampedDashboards()).length,
+			'a refused import must create nothing',
+		).toBe(before)
+	})
+
+	// @e2e dashboard-export-import::reject-manifest-with-invalid-json
+	// @e2e dashboard-export-import::reject-zip-missing-required-manifest-fields
+	test('a manifest that is broken or incomplete is refused by name', async ({
+		page,
+	}) => {
+		await openOperationsTab(page)
+
+		const notJson = await importThroughThePage(
+			page,
+			buildZip([{ name: 'manifest.json', content: '{ "schemaVersion": ' }]),
+		)
+		expect(notJson.status).toBe(400)
+		expect(notJson.body?.error).toBe('manifest.json is not valid JSON')
+		await expect(page.locator('.launchpad-export-import__error')).toContainText(
+			'manifest.json is not valid JSON',
+		)
+
+		const missingFields = await importThroughThePage(
+			page,
+			buildZip([
+				{
+					name: 'manifest.json',
+					content: JSON.stringify({ exportedBy: 'admin' }),
+				},
+			]),
+		)
+		expect(missingFields.status).toBe(400)
+		// The message has to say WHICH fields, or the admin cannot fix the file.
+		expect(missingFields.body?.error).toContain('schemaVersion')
+		expect(missingFields.body?.error).toContain('scope')
+	})
+
+	// @e2e dashboard-export-import::reject-unsupported-schema-version
+	// @e2e dashboard-export-import::version-mismatch-does-not-corrupt-existing-data
+	test('an archive from another schema version is refused and changes nothing', async ({
+		page,
+	}) => {
+		const before = await stampedDashboards()
+
+		await openOperationsTab(page)
+		const newer = await importThroughThePage(
+			page,
+			buildZip([
+				{ name: 'manifest.json', content: manifest({ schemaVersion: 2 }) },
+				{
+					name: 'dashboards/from-the-future.json',
+					content: dashboardPayload('from-the-future', `${STAMP} future`),
+				},
+			]),
+		)
+
+		expect(newer.status).toBe(400)
+		expect(newer.body?.error).toBe(
+			'Unsupported manifest schema version: 2. Only version 1 is supported. '
+				+ 'Upgrade LaunchPad to import archives of version 2.',
+		)
+		// REQ-EXIM-009 asks for the admin to be TOLD to upgrade, which means on
+		// the page, not only in a response body they never see.
+		await expect(page.locator('.launchpad-export-import__error')).toContainText(
+			'Upgrade LaunchPad',
+		)
+
+		const older = await importThroughThePage(
+			page,
+			buildZip([
+				{ name: 'manifest.json', content: manifest({ schemaVersion: 0 }) },
+			]),
+		)
+		expect(older.status).toBe(400)
+		expect(older.body?.error).toContain('Unsupported manifest schema version: 0')
+
+		const after = await stampedDashboards()
+		expect(
+			after.map((d) => d.uuid).sort(),
+			'the instance must be untouched by a refused import',
+		).toEqual(before.map((d) => d.uuid).sort())
+	})
+
+	// @e2e dashboard-export-import::zip-file-is-not-a-valid-zip-archive
+	test('a file that is not a ZIP at all is refused', async ({ page }) => {
+		await openOperationsTab(page)
+		const outcome = await importThroughThePage(
+			page,
+			Buffer.from('I am a text file, not an archive.\n', 'utf8'),
+			{ filename: 'notes.zip' },
+		)
+
+		expect(outcome.status).toBe(400)
+		expect(outcome.body?.error).toBe('Uploaded file is not a valid ZIP archive')
+		await expect(page.locator('.launchpad-export-import__error')).toContainText(
+			'not a valid ZIP archive',
+		)
+	})
+
+	// @e2e dashboard-export-import::dashboard-json-missing-required-fields
+	test('a dashboard missing a required field is skipped and the rest are imported', async ({
+		page,
+	}) => {
+		const keeper = `${STAMP} keeper`
+		const archive = buildZip([
+			{ name: 'manifest.json', content: manifest({ dashboardCount: 2 }) },
+			{
+				name: 'dashboards/nameless.json',
+				content: JSON.stringify({ uuid: 'nameless-uuid', widgets: [] }),
+			},
+			{
+				name: 'dashboards/keeper.json',
+				content: dashboardPayload('keeper-uuid', keeper),
+			},
+		])
+
+		await openOperationsTab(page)
+		const outcome = await importThroughThePage(page, archive)
+
+		expect(outcome.status).toBe(200)
+		expect(outcome.body?.importedDashboardCount).toBe(1)
+		expect(outcome.body?.skippedDashboardCount).toBe(1)
+		expect(outcome.body?.errors?.[0]).toMatchObject({
+			type: 'invalidDashboard',
+			uuid: 'nameless-uuid',
+			message: 'Missing required field: name',
+		})
+		await expect(page.locator('.launchpad-export-import__result')).toContainText(
+			'Missing required field: name',
+		)
+
+		const created = (await stampedDashboards()).filter((d) => d.name === keeper)
+		expect(created, 'the valid dashboard must still arrive').toHaveLength(1)
+	})
+
+	// @e2e dashboard-export-import::invalid-json-in-dashboard-file-skips-that-dashboard
+	// @e2e dashboard-export-import::partial-import-on-multi-dashboard-failure
+	test('a corrupt dashboard file is skipped, named, and does not stop the batch', async ({
+		page,
+	}) => {
+		await openOperationsTab(page)
+
+		const three = buildZip([
+			{ name: 'manifest.json', content: manifest({ dashboardCount: 3 }) },
+			{
+				name: 'dashboards/good-a.json',
+				content: dashboardPayload('good-a', `${STAMP} good a`),
+			},
+			{ name: 'dashboards/broken.json', content: '{"uuid": "broken", ' },
+			{
+				name: 'dashboards/good-b.json',
+				content: dashboardPayload('good-b', `${STAMP} good b`),
+			},
+		])
+		const outcome = await importThroughThePage(page, three)
+
+		expect(outcome.status).toBe(200)
+		expect(outcome.body?.importedDashboardCount).toBe(2)
+		expect(outcome.body?.skippedDashboardCount).toBe(1)
+		expect(
+			outcome.body?.errors?.[0]?.message,
+			'the error must identify the corrupt dashboard file',
+		).toBe('dashboards/broken.json is not valid JSON')
+
+		// REQ-EXIM-011: the same in a larger batch — one bad file, the other
+		// nine still land, each in its own transaction.
+		const ten = buildZip([
+			{ name: 'manifest.json', content: manifest({ dashboardCount: 10 }) },
+			...Array.from({ length: 10 }, (_unused, index) =>
+				index === 4
+					? {
+							name: 'dashboards/batch-5.json',
+							content: '{"uuid": "batch-5", "name": ',
+						}
+					: {
+							name: `dashboards/batch-${index + 1}.json`,
+							content: dashboardPayload(
+								`batch-${index + 1}`,
+								`${STAMP} batch ${index + 1}`,
+							),
+						},
+			),
+		])
+		const batch = await importThroughThePage(page, ten)
+
+		expect(batch.status).toBe(200)
+		expect(batch.body?.importedDashboardCount).toBe(9)
+		expect(batch.body?.skippedDashboardCount).toBe(1)
+		expect(batch.body?.errors?.[0]?.uuid).toBe('batch-5')
+	})
+
+	// @e2e dashboard-export-import::fresh-uuids-by-default-safe-re-import
+	test('re-importing a dashboard that still exists makes a copy beside it', async ({
+		page,
+	}) => {
+		const archive = buildZip([
+			{ name: 'manifest.json', content: manifest() },
+			{
+				name: `dashboards/${seededUuid}.json`,
+				content: dashboardPayload(seededUuid, `${STAMP} re-import`),
+			},
+		])
+
+		await openOperationsTab(page)
+		const outcome = await importThroughThePage(page, archive)
+
+		expect(outcome.status).toBe(200)
+		expect(outcome.body?.importedDashboardCount).toBe(1)
+
+		const all = await stampedDashboards()
+		const original = all.filter((d) => d.uuid === seededUuid)
+		const copy = all.filter((d) => d.name === `${STAMP} re-import`)
+		expect(original, 'the original dashboard must survive').toHaveLength(1)
+		expect(copy, 'the copy must exist').toHaveLength(1)
+		expect(
+			copy[0].uuid,
+			'the copy must have a fresh UUID, not the one in the archive',
+		).not.toBe(seededUuid)
+	})
+
+	// @e2e dashboard-export-import::preserve-uuids-with-collision-detection
+	test('preserving UUIDs refuses an archive whose dashboard already exists', async ({
+		page,
+	}) => {
+		const before = await stampedDashboards()
+		const archive = buildZip([
+			{ name: 'manifest.json', content: manifest() },
+			{
+				name: `dashboards/${seededUuid}.json`,
+				content: dashboardPayload(seededUuid, `${STAMP} collider`),
+			},
+		])
+
+		await openOperationsTab(page)
+		const outcome = await importThroughThePage(page, archive, {
+			preserveUuids: true,
+		})
+
+		expect(outcome.status).toBe(409)
+		expect(outcome.body).toMatchObject({
+			importedDashboardCount: 0,
+			skippedDashboardCount: 0,
+		})
+		expect(outcome.body?.errors?.[0]).toMatchObject({
+			type: 'uuidCollision',
+			dashboard: seededUuid,
+		})
+		expect(outcome.body?.errors?.[0]?.message).toContain('already exists')
+		// The admin sees the collision listed, not a bare failure.
+		await expect(page.locator('.launchpad-export-import__result')).toContainText(
+			'already exists',
+		)
+
+		expect(
+			(await stampedDashboards()).map((d) => d.uuid).sort(),
+			'nothing may be imported when a UUID collides',
+		).toEqual(before.map((d) => d.uuid).sort())
+	})
+
+	// @e2e dashboard-export-import::multiple-uuid-collisions-reported-together
+	test('every colliding dashboard is listed, and none of the archive is imported', async ({
+		page,
+	}) => {
+		// Three dashboards that exist, two that do not: the archive collides on
+		// three of five.
+		const existing = [seededUuid]
+		for (const suffix of ['second', 'third']) {
+			const created = await api.post(`${API}/dashboard`, {
+				data: { name: `${STAMP} ${suffix}` },
+			})
+			expect(created.status(), await created.text()).toBeLessThan(300)
+			existing.push(String(((await created.json()).dashboard ?? {}).uuid))
+		}
+
+		const before = await stampedDashboards()
+		const archive = buildZip([
+			{ name: 'manifest.json', content: manifest({ dashboardCount: 5 }) },
+			...existing.map((uuid, index) => ({
+				name: `dashboards/${uuid}.json`,
+				content: dashboardPayload(uuid, `${STAMP} collide ${index}`),
+			})),
+			...['fresh-one', 'fresh-two'].map((uuid) => ({
+				name: `dashboards/${uuid}.json`,
+				content: dashboardPayload(uuid, `${STAMP} ${uuid}`),
+			})),
+		])
+
+		await openOperationsTab(page)
+		const outcome = await importThroughThePage(page, archive, {
+			preserveUuids: true,
+		})
+
+		expect(outcome.status).toBe(409)
+		expect(
+			(outcome.body?.errors ?? [])
+				.map((e: { dashboard: string }) => e.dashboard)
+				.sort(),
+			'all three colliding UUIDs must be reported together',
+		).toEqual([...existing].sort())
+		expect(outcome.body?.importedDashboardCount).toBe(0)
+
+		expect(
+			(await stampedDashboards()).map((d) => d.uuid).sort(),
+			'a collision is all-or-nothing: the two fresh dashboards must not land',
+		).toEqual(before.map((d) => d.uuid).sort())
+	})
+})
diff --git a/tests/e2e/dashboard-sharing.spec.ts b/tests/e2e/dashboard-sharing.spec.ts
index 6145bb14d..1d2327727 100644
--- a/tests/e2e/dashboard-sharing.spec.ts
+++ b/tests/e2e/dashboard-sharing.spec.ts
@@ -28,7 +28,9 @@
  * installed, the authenticated owner storage state from
  * `tests/e2e/global-setup.ts`, and at least one recipient account
  * ("recipient" by default, overridable via LAUNCHPAD_E2E_SHAREE) that the
- * owner can share to. In CI the Hydra pipeline wires this up; locally run
+ * owner can share to. The owner's personal dashboard is NOT a prerequisite:
+ * this file seeds its own in `beforeAll` and removes it in `afterAll`.
+ * In CI the Hydra pipeline wires this up; locally run
  * `npm run test:e2e` after starting the dev stack.
  *
  * Gate-19 @e2e traceability:
@@ -40,11 +42,17 @@
  * @spec openspec/changes/add-dashboard-sharing-e2e-coverage/tasks.md
  */
 
-import type { Locator } from '@playwright/test'
+import type { APIRequestContext, Locator } from '@playwright/test'
 import type { Page } from '@playwright/test'
+import type { SeededDashboard } from './support/dashboardFixture.ts'
 
-import { expect, test } from '@playwright/test'
+import { expect, request, test } from '@playwright/test'
 import { ensureKnownPassword, loginAs } from './fixtures/secondary-user.ts'
+import { BASE_URL } from './support/baseUrl.ts'
+import {
+	removeSeededDashboard,
+	seedActiveDashboard,
+} from './support/dashboardFixture.ts'
 
 // The recipient account the owner shares to. Overridable so the same spec
 // works against fixtures that seed a different second user.
@@ -56,6 +64,17 @@ const SHAREE = process.env.LAUNCHPAD_E2E_SHAREE ?? 'recipient'
 const RECIPIENT_PASSWORD =
 	process.env.LAUNCHPAD_E2E_SHAREE_PASS ?? 'Recipient-e2e-A1!'
 
+const ADMIN = {
+	user: process.env.NC_ADMIN_USER ?? 'admin',
+	pass: process.env.NC_ADMIN_PASS ?? 'admin',
+}
+
+/** Admin API client for seeding and cleanup. */
+let api: APIRequestContext
+
+/** The personal dashboard this file shares. Seeded in `beforeAll`. */
+let seeded: SeededDashboard | null = null
+
 /**
  * Open the active personal dashboard's config modal and switch to the
  * Sharing tab.
@@ -77,11 +96,21 @@ async function openSharingTab(page: Page) {
 		timeout: 8_000,
 	})
 
-	// Open the active personal dashboard's cog menu → "Dashboard settings".
+	// Open THIS FILE'S dashboard's cog menu → "Dashboard settings".
+	//
+	// It used to take the first personal row it could find, and this file
+	// created none. On a fresh instance the admin has no personal dashboard,
+	// so there was no row and all four tests timed out here, run alone. In the
+	// full suite they passed on a dashboard some EARLIER spec left behind,
+	// which is the ambient-state trap tests/e2e/support/dashboardFixture.ts
+	// was written to close. The row is now picked by the seeded name, so a
+	// warm instance with other personal dashboards cannot redirect it either.
+	if (seeded === null) {
+		throw new Error('dashboard-sharing: beforeAll did not seed a dashboard')
+	}
 	const activeRow = page
-		.locator(
-			'[data-source="user"].dashboard-switcher-sidebar__item.active, [data-source="user"].dashboard-switcher-sidebar__item',
-		)
+		.locator('[data-source="user"].dashboard-switcher-sidebar__item')
+		.and(page.locator(`[aria-label="${seeded.name}"]`))
 		.first()
 	await activeRow.locator('.dashboard-row-actions button').first().click()
 	await page.locator('[data-testid="cog-dashboard-config"]').click()
@@ -131,6 +160,26 @@ async function saveConfig(page: Page) {
 }
 
 test.describe('dashboard-sharing UI (REQ-SHARE-001/002/004)', () => {
+	// One dashboard for the whole file, not one per test: the tests build on
+	// each other (add a share, change its level, remove it), exactly as they
+	// always did on the borrowed dashboard.
+	test.beforeAll(async () => {
+		api = await request.newContext({
+			baseURL: BASE_URL,
+			httpCredentials: { username: ADMIN.user, password: ADMIN.pass },
+			extraHTTPHeaders: { 'OCS-APIRequest': 'true' },
+		})
+		seeded = await seedActiveDashboard(api, `E2E Sharing ${Date.now()}`)
+	})
+
+	// In afterAll, so the dashboard (and the share on it) goes even when a
+	// test fails part-way, and the file leaves nothing behind.
+	test.afterAll(async () => {
+		await removeSeededDashboard(api, seeded)
+		seeded = null
+		await api?.dispose()
+	})
+
 	test('owner adds a user share and it appears in the shares list', async ({
 		page,
 	}) => {
diff --git a/tests/e2e/dashboard-site-export.spec.ts b/tests/e2e/dashboard-site-export.spec.ts
new file mode 100644
index 000000000..9c35f699c
--- /dev/null
+++ b/tests/e2e/dashboard-site-export.spec.ts
@@ -0,0 +1,291 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * The site export an administrator downloads (REQ-EXIM-001, REQ-EXIM-003,
+ * REQ-EXIM-009).
+ *
+ * The archive is taken the way an admin takes it: Beheer ▸ Operations, the
+ * "Download all dashboards" button, and the file the browser saves. The API is
+ * used only to seed the three kinds of dashboard the scenarios name and to
+ * clean them up, because the admin page has no control for creating an admin
+ * template or a group dashboard.
+ *
+ * WHY "EVERY DASHBOARD" IS COMPARED AGAINST SEEDED IDS AND A COUNT, NOT A
+ * FIXED NUMBER. REQ-EXIM-003 is written as "5 personal, 2 admin templates and
+ * 1 group_shared, so dashboardCount MUST be 8". No suite can arrange exactly
+ * that on an instance other specs also use, and a test that demanded it would
+ * be measuring the other specs' fixtures. What the scenario is really about is
+ * that a site export leaves no dashboard out and that the manifest agrees with
+ * the archive, so this seeds one dashboard of each type and asserts all three
+ * are in the archive, and that `dashboardCount` equals the number of dashboard
+ * files actually written.
+ *
+ * WHAT THE ARCHIVE DOES NOT CARRY. Metadata field definitions and asset bytes
+ * are specified under REQ-EXIM-006 and REQ-EXIM-007 and were deferred when this
+ * capability shipped; `metadata-fields.json` is always an empty list. This spec
+ * asserts the file is present, which is what the format promises, and does not
+ * pretend the contents are there.
+ */
+
+import type { APIRequestContext, Page, request } from '@playwright/test'
+
+import { expect, test } from '@playwright/test'
+import * as fs from 'fs'
+import * as os from 'os'
+import * as path from 'path'
+import { BASE_URL as BASE } from './support/baseUrl.ts'
+import {
+	buildZip,
+	dashboardEntries,
+	readJsonEntry,
+	readZip,
+} from './support/zipArchive.ts'
+
+const ADMIN = {
+	user: process.env.NC_ADMIN_USER ?? 'admin',
+	pass: process.env.NC_ADMIN_PASS ?? 'admin',
+}
+
+const API = '/index.php/apps/launchpad/api'
+const SETTINGS_PAGE = `${BASE}/index.php/settings/admin/launchpad`
+const STAMP = `E2E SiteExport ${Date.now()}`
+
+/** An admin-authenticated request context using HTTP Basic auth. */
+async function adminApi(playwright: {
+	request: { newContext: typeof request.newContext }
+}): Promise<APIRequestContext> {
+	return playwright.request.newContext({
+		baseURL: BASE,
+		httpCredentials: { username: ADMIN.user, password: ADMIN.pass },
+		extraHTTPHeaders: { 'OCS-APIRequest': 'true' },
+	})
+}
+
+/** Open Beheer ▸ Operations, where the export/import panel lives. */
+async function openOperationsTab(page: Page): Promise<void> {
+	await page
+		.context()
+		.setHTTPCredentials({ username: ADMIN.user, password: ADMIN.pass })
+	await page.goto(SETTINGS_PAGE, {
+		waitUntil: 'domcontentloaded',
+		timeout: 60_000,
+	})
+	await page.locator('[data-test="tab-operations"]').click({ timeout: 30_000 })
+	await expect(page.locator('[data-test="export-site-button"]')).toBeVisible({
+		timeout: 20_000,
+	})
+}
+
+/**
+ * Press "Download all dashboards" and answer with the bytes the browser saved.
+ *
+ * @param page the admin page, already on the Operations tab.
+ * @return the archive the admin ends up with on disk.
+ */
+async function downloadSiteExport(page: Page): Promise<Buffer> {
+	const pending = page.waitForEvent('download', { timeout: 60_000 })
+	await page.locator('[data-test="export-site-button"]').click()
+	const download = await pending
+
+	const target = path.join(
+		fs.mkdtempSync(path.join(os.tmpdir(), 'launchpad-e2e-')),
+		download.suggestedFilename(),
+	)
+	await download.saveAs(target)
+	const bytes = fs.readFileSync(target)
+	fs.rmSync(path.dirname(target), { recursive: true, force: true })
+
+	return bytes
+}
+
+test.describe('the site export an administrator downloads', () => {
+	let api: APIRequestContext
+	const seeded: Array<{ kind: string; uuid: string; delete: string }> = []
+
+	test.beforeAll(async ({ playwright }) => {
+		api = await adminApi({ request: playwright.request })
+
+		const allow = await api.put(`${API}/admin/settings`, {
+			data: { allowUserDash: true, allowMultiDash: true },
+		})
+		expect(allow.status(), await allow.text()).toBe(200)
+
+		// One dashboard of each kind REQ-EXIM-003 names.
+		const personal = await api.post(`${API}/dashboard`, {
+			data: { name: `${STAMP} personal` },
+		})
+		expect(personal.status(), await personal.text()).toBeLessThan(300)
+		const personalBody = (await personal.json()).dashboard ?? {}
+		seeded.push({
+			kind: 'personal',
+			uuid: String(personalBody.uuid),
+			delete: `${API}/dashboard/${personalBody.id}`,
+		})
+
+		const template = await api.post(`${API}/admin/templates`, {
+			data: { name: `${STAMP} template` },
+		})
+		expect(template.status(), await template.text()).toBeLessThan(300)
+		const templateBody = await template.json()
+		seeded.push({
+			kind: 'admin_template',
+			uuid: String(templateBody.uuid ?? templateBody.dashboard?.uuid),
+			delete: `${API}/admin/templates/${templateBody.id ?? templateBody.dashboard?.id}`,
+		})
+
+		const group = await api.post(`${API}/dashboards/group/admin`, {
+			data: { name: `${STAMP} group` },
+		})
+		expect(group.status(), await group.text()).toBeLessThan(300)
+		const groupBody = (await group.json()).dashboard ?? {}
+		seeded.push({
+			kind: 'group_shared',
+			uuid: String(groupBody.uuid),
+			delete: `${API}/dashboards/group/admin/${groupBody.uuid}`,
+		})
+	})
+
+	/*
+	 * 🔴 REMOVE THE SEEDED DASHBOARDS IN `afterAll`. They are of three
+	 * different kinds, and an admin template left behind is offered to every
+	 * user of the instance by the template gallery, so a failure here would
+	 * change what later specs see.
+	 */
+	test.afterAll(async () => {
+		if (api === undefined) {
+			return
+		}
+		for (const entry of seeded) {
+			await api.delete(entry.delete)
+		}
+		await api.dispose()
+	})
+
+	// @e2e dashboard-export-import::site-export-includes-all-dashboards
+	// @e2e dashboard-export-import::site-export-includes-all-dashboard-types
+	test('holds one file per dashboard, of every kind, and a manifest that agrees', async ({
+		page,
+	}) => {
+		test.slow()
+		await openOperationsTab(page)
+		const archive = readZip(await downloadSiteExport(page))
+
+		const entries = dashboardEntries(archive)
+		for (const entry of seeded) {
+			expect(
+				entries,
+				`the site export left out the ${entry.kind} dashboard`,
+			).toContain(`dashboards/${entry.uuid}.json`)
+		}
+
+		const manifestJson = readJsonEntry(archive, 'manifest.json')
+		expect(manifestJson.scope).toBe('site')
+		expect(
+			manifestJson.dashboardCount,
+			'the manifest must count what the archive actually holds',
+		).toBe(entries.length)
+
+		// The format promises this file; REQ-EXIM-006 governs its contents,
+		// which are not implemented.
+		expect(Object.keys(archive)).toContain('metadata-fields.json')
+
+		// Every dashboard file must be readable and carry the state the format
+		// describes: a half-written archive would still satisfy a name check.
+		for (const entry of entries) {
+			const dashboard = readJsonEntry(archive, entry)
+			expect(String(dashboard.uuid ?? ''), `${entry} has no uuid`).not.toBe('')
+			expect(String(dashboard.name ?? ''), `${entry} has no name`).not.toBe('')
+			expect(Array.isArray(dashboard.widgets), `${entry} has no widgets`).toBe(
+				true,
+			)
+		}
+
+		// Paths inside the archive are relative (REQ-EXIM-001).
+		for (const name of Object.keys(archive)) {
+			expect(name.startsWith('/'), `${name} is an absolute path`).toBe(false)
+		}
+	})
+
+	// @e2e dashboard-export-import::manifest-schema-version-enforces-forward-compatibility
+	// @e2e dashboard-export-import::current-version-is-schemaversion-1
+	test('declares schema version 1, and an archive claiming another is refused', async ({
+		page,
+	}) => {
+		test.slow()
+		await openOperationsTab(page)
+		const bytes = await downloadSiteExport(page)
+		const archive = readZip(bytes)
+
+		expect(readJsonEntry(archive, 'manifest.json').schemaVersion).toBe(1)
+
+		// Re-package this instance's own export under a version it cannot read.
+		// Nothing else about the archive changes, so a refusal can only be the
+		// version check.
+		const claimingTwo = buildZip(
+			Object.entries(archive).map(([name, content]) => ({
+				name,
+				content:
+					name === 'manifest.json'
+						? JSON.stringify({
+								...readJsonEntry(archive, 'manifest.json'),
+								schemaVersion: 2,
+							})
+						: content,
+			})),
+		)
+
+		await page.locator('[data-test="import-file-input"]').setInputFiles({
+			name: 'from-a-newer-launchpad.zip',
+			mimeType: 'application/zip',
+			buffer: claimingTwo,
+		})
+		const pending = page.waitForResponse(
+			(res) =>
+				res.url().includes('/api/admin/import')
+				&& res.request().method() === 'POST',
+			{ timeout: 60_000 },
+		)
+		await page.locator('[data-test="import-submit"]').click()
+		const response = await pending
+
+		expect(response.status()).toBe(400)
+		expect((await response.json())?.error).toContain(
+			'Unsupported manifest schema version: 2',
+		)
+
+		// The scenario names 2 and 0 as examples: a version BELOW the supported
+		// one is not an older archive, it is a broken manifest, and it is
+		// refused just the same.
+		const claimingZero = buildZip(
+			Object.entries(archive).map(([name, content]) => ({
+				name,
+				content:
+					name === 'manifest.json'
+						? JSON.stringify({
+								...readJsonEntry(archive, 'manifest.json'),
+								schemaVersion: 0,
+							})
+						: content,
+			})),
+		)
+		await page.locator('[data-test="import-file-input"]').setInputFiles({
+			name: 'version-zero.zip',
+			mimeType: 'application/zip',
+			buffer: claimingZero,
+		})
+		const pendingZero = page.waitForResponse(
+			(res) =>
+				res.url().includes('/api/admin/import')
+				&& res.request().method() === 'POST',
+			{ timeout: 60_000 },
+		)
+		await page.locator('[data-test="import-submit"]').click()
+		const zeroResponse = await pendingZero
+
+		expect(zeroResponse.status()).toBe(400)
+		expect((await zeroResponse.json())?.error).toContain(
+			'Unsupported manifest schema version: 0',
+		)
+	})
+})
diff --git a/tests/e2e/dashboard-store.spec.ts b/tests/e2e/dashboard-store.spec.ts
new file mode 100644
index 000000000..f3847a9ac
--- /dev/null
+++ b/tests/e2e/dashboard-store.spec.ts
@@ -0,0 +1,486 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * The dashboard store, end to end: the Store page, the registry form on
+ * Beheer ▸ Sharing, and the admin gate on both.
+ *
+ * 🔴 WHAT THIS FILE DOES NOT PROVE, AND WHY. A SUCCESSFUL remote install needs
+ * a second OpenRegister instance publishing a `dashboard-template` object. CI
+ * provisions exactly one instance, so there is no registry to install from.
+ * Faking one inside the suite would test the fake, so nothing here pretends a
+ * template arrived. The install path is covered by
+ * tests/Unit/Service/StoreServiceTest.php against the engine's signatures, and
+ * here only as far as a real instance can take it: a refusal, with a reason,
+ * and never a 500.
+ *
+ * 🔴 WHY THE STORE PAGE'S NOTE IS NOT ENOUGH ON ITS OWN. `CnStorePage` shows
+ * its not-configured note WITHOUT making a request when it has no app id. So
+ * the note alone cannot tell "our route answered not_configured" from "the
+ * page never asked". Before this change the route did not exist at all, and
+ * the page showed the UNREACHABLE note. Every UI assertion below is therefore
+ * paired with the response that produced it.
+ *
+ * 🔴 THE NON-ADMIN IS A FRESH ACCOUNT WITH A VALID REQUEST TOKEN. A 403 is only
+ * evidence of the admin gate if nothing else could have produced it. The
+ * account is provisioned here, so it holds no group that could have made it an
+ * admin on a warm instance, and its requests carry the page's own request
+ * token, so a CSRF refusal (412) cannot pass for the gate. A positive control
+ * on the login-only search route proves the session and token work.
+ *
+ * Every test resets the registry connection before and after it runs, so the
+ * not-configured test does not depend on the order the file runs in, and the
+ * suite leaves no registry URL behind for the specs that follow.
+ */
+
+import type { APIRequestContext, Page } from '@playwright/test'
+
+import { expect, request as pwRequest, test } from '@playwright/test'
+import {
+	deprovisionUser,
+	loginAs,
+	provisionThrowawayUser,
+} from './fixtures/secondary-user.ts'
+import { BASE_URL as BASE } from './support/baseUrl.ts'
+import { installBundleOverride } from './support/bundleOverride.ts'
+
+const ADMIN = {
+	user: process.env.NC_ADMIN_USER ?? 'admin',
+	pass: process.env.NC_ADMIN_PASS ?? 'admin',
+}
+
+const APP_BASE = '/apps/launchpad'
+const STORE_URL = `${BASE}/index.php${APP_BASE}/store`
+const SHARING_URL = `${BASE}/index.php/settings/admin/launchpad?tab=sharing`
+
+/**
+ * A registry host that never resolves. `.invalid` is reserved (RFC 6761), so
+ * the engine's SSRF guard rejects it before any request leaves the instance:
+ * the suite makes no outbound call, and the store reports `store_unreachable`.
+ */
+const UNRESOLVABLE_REGISTRY = 'https://registry.invalid/'
+
+/** A slug the install route accepts, for probing the gate. */
+const PROBE_SLUG = 'sales-overview'
+
+/**
+ * An admin API client that bypasses the browser, for setup and teardown.
+ *
+ * `OCS-APIRequest` satisfies Nextcloud's CSRF check for a request that
+ * carries no request token, which a basic-auth client cannot have.
+ *
+ * @return The request context. Caller disposes it.
+ */
+async function adminApi(): Promise<APIRequestContext> {
+	return pwRequest.newContext({
+		baseURL: BASE,
+		httpCredentials: { username: ADMIN.user, password: ADMIN.pass },
+		extraHTTPHeaders: { 'OCS-APIRequest': 'true' },
+	})
+}
+
+/**
+ * Clear every registry key, so the store is unconfigured.
+ *
+ * @return Resolves once the server confirmed the write.
+ */
+async function resetRegistry(): Promise<void> {
+	const api = await adminApi()
+	try {
+		const res = await api.put(`/index.php${APP_BASE}/api/store/config`, {
+			data: { registryUrl: '', registryRegister: '', registryToken: '' },
+		})
+		expect(res.status(), 'the admin could reset the registry').toBe(200)
+	} finally {
+		await api.dispose()
+	}
+}
+
+/**
+ * Read the registry connection as the admin, bypassing the browser.
+ *
+ * @return The redacted connection.
+ */
+async function readRegistry(): Promise<Record<string, unknown>> {
+	const api = await adminApi()
+	try {
+		const res = await api.get(`/index.php${APP_BASE}/api/store/config`)
+		expect(res.status()).toBe(200)
+		return (await res.json()) as Record<string, unknown>
+	} finally {
+		await api.dispose()
+	}
+}
+
+/**
+ * Who the browser is signed in as, read from Nextcloud rather than assumed.
+ *
+ * @param page The page.
+ * @return The uid and admin flag.
+ */
+async function whoami(page: Page): Promise<{ uid: unknown; isAdmin: unknown }> {
+	return page.evaluate(() => ({
+		uid: (window as any).OC?.getCurrentUser?.()?.uid ?? null,
+		isAdmin: (window as any).OC?.isUserAdmin?.() ?? null,
+	}))
+}
+
+/**
+ * Call an app route from INSIDE the page, the way the frontend would: the
+ * session cookie and the page's own request token ride along, so the only
+ * thing that can refuse the call is the route's own auth posture.
+ *
+ * @param page   The page, already on a Nextcloud page that loaded `OC`.
+ * @param method HTTP verb.
+ * @param path   App-relative path, e.g. `/apps/launchpad/api/store/config`.
+ * @param body   Optional JSON body.
+ * @return The status and raw body text.
+ */
+async function callFromPage(
+	page: Page,
+	method: string,
+	path: string,
+	body?: Record<string, unknown>,
+): Promise<{ status: number; text: string }> {
+	return page.evaluate(
+		async ({ method, path, body }) => {
+			const oc = (window as any).OC
+			const url =
+				typeof oc?.generateUrl === 'function'
+					? oc.generateUrl(path)
+					: `/index.php${path}`
+			const res = await fetch(url, {
+				method,
+				headers: {
+					'Content-Type': 'application/json',
+					requesttoken: oc?.requestToken ?? '',
+				},
+				body: body === undefined ? undefined : JSON.stringify(body),
+			})
+			return { status: res.status, text: await res.text() }
+		},
+		{ method, path, body },
+	)
+}
+
+/**
+ * Open the Store page and return the search response that fed it.
+ *
+ * The listener is registered BEFORE navigating, so a fast response cannot be
+ * missed and read as "no request was made".
+ *
+ * @param page The page.
+ * @return The HTTP status and decoded body of `GET /api/store/items`.
+ */
+async function openStore(
+	page: Page,
+): Promise<{ status: number; body: Record<string, unknown> }> {
+	const searched = page.waitForResponse(
+		(res) =>
+			res.url().includes(`${APP_BASE}/api/store/items`)
+			&& res.request().method() === 'GET',
+		{ timeout: 60_000 },
+	)
+	await page.goto(STORE_URL, { waitUntil: 'domcontentloaded' })
+	const res = await searched
+	await expect(page.locator('[data-testid="store-page"]')).toBeVisible({
+		timeout: 60_000,
+	})
+	// Parsed defensively. An unrouted endpoint answers Nextcloud's HTML 404
+	// page, and letting `res.json()` throw on it reports a SyntaxError instead
+	// of the status assertion that names the actual defect.
+	let body: Record<string, unknown>
+	try {
+		body = (await res.json()) as Record<string, unknown>
+	} catch {
+		body = {}
+	}
+	return { status: res.status(), body }
+}
+
+/**
+ * Open Beheer ▸ Sharing and wait for the registry form to finish loading.
+ *
+ * @param page The page.
+ */
+async function openRegistryForm(page: Page): Promise<void> {
+	const loaded = page.waitForResponse(
+		(res) =>
+			res.url().includes(`${APP_BASE}/api/store/config`)
+			&& res.request().method() === 'GET',
+		{ timeout: 60_000 },
+	)
+	await page.goto(SHARING_URL, { waitUntil: 'domcontentloaded' })
+	await loaded
+	await expect(
+		page.locator('[data-test="dashboard-registry-settings"]'),
+	).toBeVisible({ timeout: 30_000 })
+	// Enabled means `load()` finished and the fields hold the server's values.
+	await expect(page.locator('input[data-test="registry-url"]')).toBeEnabled()
+}
+
+test.describe('dashboard store', () => {
+	test.beforeEach(async ({ page }) => {
+		await installBundleOverride(page.context())
+		await resetRegistry()
+	})
+
+	test.afterEach(async () => {
+		// In afterEach, not in the test body, so a failing test still leaves
+		// no registry URL behind for the specs that run after this file.
+		await resetRegistry()
+	})
+
+	/*
+	 * @e2e openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#scenario-an-unconfigured-store-shows-the-not-configured-state
+	 */
+	test('an unconfigured store shows the not-configured note, answered by the route', async ({
+		page,
+	}) => {
+		const { status, body } = await openStore(page)
+
+		// The route answered, and answered not_configured. Before this change
+		// there was no route, and this read 404.
+		expect(status, 'GET /api/store/items is routed').toBe(200)
+		expect(body.outcome).toBe('not_configured')
+
+		await expect(
+			page.locator('[data-testid="store-not-configured"]'),
+		).toBeVisible()
+		await expect(page.locator('[data-testid="store-unreachable"]')).toHaveCount(
+			0,
+		)
+		await expect(page.locator('[data-testid="store-results"]')).toHaveCount(0)
+	})
+
+	/*
+	 * @e2e openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#scenario-an-install-with-no-registry-is-refused-with-a-reason
+	 */
+	test('an admin install with no registry is refused with a reason, not a 500', async ({
+		page,
+	}) => {
+		await openStore(page)
+		expect(
+			(await whoami(page)).isAdmin,
+			'the default session is the admin',
+		).toBe(true)
+
+		const res = await callFromPage(
+			page,
+			'POST',
+			`${APP_BASE}/api/store/items/${PROBE_SLUG}/install`,
+		)
+
+		expect(res.status).toBe(400)
+		const body = JSON.parse(res.text)
+		expect(body.success).toBe(false)
+		expect(typeof body.message).toBe('string')
+		expect(body.message.length).toBeGreaterThan(0)
+	})
+
+	/*
+	 * @e2e openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#scenario-an-administrator-saves-a-registry-and-reads-it-back
+	 * @e2e openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#scenario-the-token-is-never-shown-back
+	 * @e2e openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#scenario-reading-the-config-never-returns-the-token
+	 */
+	test('an admin saves a registry, reads it back, and never sees the token again', async ({
+		page,
+	}) => {
+		const secret = `e2e-token-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+		await openRegistryForm(page)
+		await expect(page.locator('[data-test="registry-token-status"]')).toHaveText(
+			'No token is set. Add one if the registry asks for it.',
+		)
+
+		await page
+			.locator('input[data-test="registry-url"]')
+			.fill(UNRESOLVABLE_REGISTRY)
+		await page
+			.locator('input[data-test="registry-register"]')
+			.fill('e2e-register')
+		await page.locator('input[data-test="registry-token"]').fill(secret)
+
+		const saved = page.waitForResponse(
+			(res) =>
+				res.url().includes(`${APP_BASE}/api/store/config`)
+				&& res.request().method() === 'PUT',
+		)
+		await page.locator('[data-test="registry-save"]').click()
+		const saveRes = await saved
+		expect(saveRes.status()).toBe(200)
+		expect(
+			await saveRes.text(),
+			'the save response echoed the token',
+		).not.toContain(secret)
+
+		// A RELOAD, so what the fields show is what the server holds rather
+		// than what is still sitting in the component's memory.
+		const reread = page.waitForResponse(
+			(res) =>
+				res.url().includes(`${APP_BASE}/api/store/config`)
+				&& res.request().method() === 'GET',
+		)
+		await openRegistryForm(page)
+		const readRes = await reread
+		const readText = await readRes.text()
+
+		await expect(page.locator('input[data-test="registry-url"]')).toHaveValue(
+			UNRESOLVABLE_REGISTRY,
+		)
+		await expect(
+			page.locator('input[data-test="registry-register"]'),
+		).toHaveValue('e2e-register')
+
+		// The token was stored, and is reported as stored...
+		expect(JSON.parse(readText).tokenConfigured).toBe(true)
+		await expect(page.locator('[data-test="registry-token-status"]')).toHaveText(
+			'A token is set. Enter a new one to replace it.',
+		)
+		// ...and is nowhere a browser can read it.
+		await expect(page.locator('input[data-test="registry-token"]')).toHaveValue(
+			'',
+		)
+		expect(readText, 'the config response carried the token').not.toContain(
+			secret,
+		)
+		expect(await page.content(), 'the page carried the token').not.toContain(
+			secret,
+		)
+	})
+
+	/*
+	 * @e2e openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#scenario-the-saved-registry-is-the-one-the-store-reads
+	 */
+	test('the registry the form saves is the one the store reads', async ({
+		page,
+	}) => {
+		// Save through the FORM, not the API, so this proves the form and the
+		// engine agree on which config keys hold the registry.
+		await openRegistryForm(page)
+		await page
+			.locator('input[data-test="registry-url"]')
+			.fill(UNRESOLVABLE_REGISTRY)
+		const saved = page.waitForResponse(
+			(res) =>
+				res.url().includes(`${APP_BASE}/api/store/config`)
+				&& res.request().method() === 'PUT',
+		)
+		await page.locator('[data-test="registry-save"]').click()
+		expect((await saved).status()).toBe(200)
+
+		const { status, body } = await openStore(page)
+
+		// Unreachable, NOT not-configured: the engine saw the URL the form
+		// wrote, and its SSRF guard refused a host that does not resolve.
+		expect(status).toBe(200)
+		expect(body.outcome).toBe('store_unreachable')
+		await expect(page.locator('[data-testid="store-unreachable"]')).toBeVisible()
+		await expect(
+			page.locator('[data-testid="store-not-configured"]'),
+		).toHaveCount(0)
+	})
+
+	test.describe('a non-admin account', () => {
+		// A cold first login for a brand-new account builds its home folder
+		// and can take most of a minute on a loaded instance. The budget is
+		// raised so the guard gets far enough to assert, not so it asserts
+		// more weakly. Same reasoning as admin-menu-permissions.spec.ts.
+		test.describe.configure({ timeout: 180_000 })
+
+		let account: { username: string; password: string }
+
+		test.beforeAll(async () => {
+			account = await provisionThrowawayUser('e2e-store')
+		})
+
+		test.afterAll(async () => {
+			if (account) {
+				await deprovisionUser(account.username)
+			}
+		})
+
+		/*
+		 * @e2e openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#scenario-a-non-admin-is-refused-the-registry-config
+		 * @e2e openspec/changes/store-plane-dashboard-sharing/specs/dashboard-store/spec.md#scenario-a-non-admin-is-refused-an-install
+		 */
+		test('is refused the registry config and the install, but may search', async ({
+			browser,
+		}) => {
+			const { context, page } = await loginAs(
+				browser,
+				account.username,
+				account.password,
+			)
+			try {
+				// A Nextcloud page that loads `OC`, so the identity and the
+				// request token can be read from the session itself.
+				await page.goto(`${BASE}/index.php${APP_BASE}/`, {
+					waitUntil: 'domcontentloaded',
+				})
+				await page.waitForFunction(
+					() => Boolean((window as any).OC?.requestToken),
+					{
+						timeout: 60_000,
+					},
+				)
+
+				// IDENTITY FIRST. A "non-admin" context that is really the
+				// admin makes every assertion below pass for the wrong reason.
+				const who = await whoami(page)
+				expect(who.uid, 'the session is the throwaway account').toBe(
+					account.username,
+				)
+				expect(who.isAdmin, 'the throwaway account is not an admin').toBe(
+					false,
+				)
+
+				// POSITIVE CONTROL. The same session and token reach the
+				// login-only route. Without this, a broken session would
+				// produce the refusals below and read as a working gate.
+				const search = await callFromPage(
+					page,
+					'GET',
+					`${APP_BASE}/api/store/items`,
+				)
+				expect(search.status, 'a signed-in non-admin may search').toBe(200)
+				expect(JSON.parse(search.text).outcome).toBe('not_configured')
+
+				const read = await callFromPage(
+					page,
+					'GET',
+					`${APP_BASE}/api/store/config`,
+				)
+				expect(read.status, 'a non-admin read the registry config').toBe(403)
+
+				const write = await callFromPage(
+					page,
+					'PUT',
+					`${APP_BASE}/api/store/config`,
+					{
+						registryUrl: UNRESOLVABLE_REGISTRY,
+					},
+				)
+				expect(write.status, 'a non-admin wrote the registry config').toBe(
+					403,
+				)
+
+				const install = await callFromPage(
+					page,
+					'POST',
+					`${APP_BASE}/api/store/items/${PROBE_SLUG}/install`,
+				)
+				expect(install.status, 'a non-admin reached the install').toBe(403)
+
+				// A refused write must also not have landed.
+				const stored = await readRegistry()
+				expect(
+					stored.registryUrl,
+					'the refused write changed the registry',
+				).toBe('')
+			} finally {
+				await context.close()
+			}
+		})
+	})
+})
diff --git a/tests/e2e/demo-showcase-case-handler.spec.ts b/tests/e2e/demo-showcase-case-handler.spec.ts
new file mode 100644
index 000000000..424a03500
--- /dev/null
+++ b/tests/e2e/demo-showcase-case-handler.spec.ts
@@ -0,0 +1,395 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * The `case-handler` bundled demo showcase (REQ-DEMO-001..006).
+ *
+ * WHAT THE SHOWCASE IS. A sixth entry in `DemoShowcasesService::BUNDLED_IDS`,
+ * shipped as `data/demo-showcases/case-handler/case-handler.zip`. Installing it
+ * creates one read-only group dashboard carrying exactly four widgets: an
+ * `object-list` over dossiq cases, an `nc-widget` proxying the Tasks app, a
+ * `calendar`, and an `nc-widget` proxying unread mail.
+ *
+ * 🔴 WHY "EXACTLY FOUR" IS THE ASSERTION AND NOT A DETAIL
+ * ======================================================
+ * `DemoShowcasesService::partitionWidgets()` decides what actually lands, and
+ * when this spec was written it kept a widget only if it was a tile or its
+ * `widgetId` was in Nextcloud's own dashboard registry (`IManager::getWidgets()`).
+ * Everything else went into `skippedWidgets` and the install still answered
+ * success. None of `object-list`, `nc-widget` or `calendar` is a Nextcloud
+ * registry id: they are LaunchPad's own widget types.
+ *
+ * So this showcase installed as an EMPTY dashboard. Measured twice on
+ * 2026-09-11: once by calling that `partitionWidgets()` inside the dev
+ * container on the shipped `case-handler.zip` payload, against the live
+ * 39-widget registry, with a raw `mail-unread` row and a tile row as controls
+ * (both controls kept, all four showcase widgets skipped); and once in this
+ * spec's first CI run on launchpad#606, which reported
+ * `skippedWidgets: ["object-list","nc-widget","calendar","nc-widget"]`, zero
+ * placements and zero rendered frames. The existing showcases hit the same
+ * filter: `van-der-berg` lost its `calendar`, while its tiles and its `mail`
+ * widget (a Nextcloud registry id) landed.
+ *
+ * Fixed in the same PR: LaunchPad's own types now live in
+ * `lib/widget-types.json`, which the installer reads and the frontend registry
+ * is tested against. The installer also copies each widget's `content`, which
+ * it never did, so the placements now arrive configured. The configuration
+ * assertions below guard that second half.
+ *
+ * So the assertion here is deliberately not "the endpoint answered 200". It is
+ * `skippedWidgets` being empty AND four placements existing AND their ids being
+ * the right four. Any one of those alone can be green while the operator gets a
+ * blank page.
+ *
+ * WHY `internalCalendars` IS CHECKED FOR SHAPE AND NOT FOR CONTENT. The
+ * showcase ships the list EMPTY on purpose (ConductionNL/launchpad#605): the
+ * calendar ids on the authoring instance mean nothing anywhere else, and
+ * pointing a stranger's widget at calendar "1" is worse than asking them. That
+ * is right, and the unit test on that change pins the empty list. The cost is
+ * worth knowing though: an empty list is not an error, it fetches nothing and
+ * returns zero events with zero failures, so until the installer picks a
+ * calendar the tile reads like a quiet day. This spec asserts only that the
+ * widget is configured as a calendar at all.
+ *
+ * WHAT THIS DOES NOT ASSERT. That the Tasks and Mail tiles render CONTENT. Both
+ * are `nc-widget` proxies and the Tasks widget implements only `IWidget` with
+ * `itemApiVersions: []`, so it can never serve the items API — it renders
+ * through the legacy widget bridge or not at all, and that bridge is an
+ * instance-level admin setting this spec has no business flipping (turning it
+ * on makes the workspace load every enabled app's widget scripts, measured at
+ * ~118 MB on this fleet). The frames are asserted; their innards are not.
+ *
+ * @spec openspec/specs/demo-data-showcases/spec.md
+ */
+
+import type { APIRequestContext, request } from '@playwright/test'
+
+import { expect, test } from '@playwright/test'
+import { BASE_URL as BASE } from './support/baseUrl.ts'
+
+const ADMIN = {
+	user: process.env.NC_ADMIN_USER ?? 'admin',
+	pass: process.env.NC_ADMIN_PASS ?? 'admin',
+}
+
+const API = `${BASE}/index.php/apps/launchpad/api`
+const SHOWCASES = `${API}/admin/demo-showcases`
+const APP_URL = '/index.php/apps/launchpad'
+
+const SHOWCASE_ID = 'case-handler'
+
+/**
+ * The four widgets the showcase promises, keyed the way a placement carries
+ * them: `widgetId` is the LaunchPad widget type, and for an `nc-widget` proxy
+ * `content.widgetId` names the Nextcloud widget being proxied.
+ */
+const EXPECTED_WIDGETS = [
+	{ widgetId: 'object-list', proxies: null },
+	{ widgetId: 'nc-widget', proxies: 'tasks' },
+	{ widgetId: 'calendar', proxies: null },
+	{ widgetId: 'nc-widget', proxies: 'mail-unread' },
+]
+
+interface Placement {
+	widgetId: string
+	content: Record<string, unknown> | null
+	customTitle: string | null
+}
+
+/** An admin-authenticated request context using HTTP Basic auth. */
+async function adminApi(playwright: {
+	request: { newContext: typeof request.newContext }
+}): Promise<APIRequestContext> {
+	return playwright.request.newContext({
+		baseURL: BASE,
+		httpCredentials: { username: ADMIN.user, password: ADMIN.pass },
+		extraHTTPHeaders: { 'OCS-APIRequest': 'true' },
+	})
+}
+
+/**
+ * Resolve an installed dashboard's numeric id from its UUID.
+ *
+ * The install endpoint answers a UUID, but `GET /api/dashboard/{uuid}` is a
+ * 404 — that route binds a numeric id, and the UUID-shaped route
+ * (`/api/dashboards/{uuid}/resolved`) answers translations rather than
+ * placements. Measured both ways on the dev instance before writing this.
+ *
+ * 🔴 `/api/dashboards/visible`, NOT `/api/dashboards`. The plain list returns
+ * only the caller's OWN dashboards, and a showcase installs as a
+ * `group_shared` dashboard owned by nobody, so it is never in that list. The
+ * first CI run of this spec looked it up there and failed with "the install
+ * reported uuid … but /api/dashboards does not list it" — a lookup bug that
+ * would have stayed red after the showcase itself was fixed. Measured on the
+ * dev instance with `van-der-berg`: absent from `/api/dashboards`, present in
+ * `/api/dashboards/visible` and `/api/dashboards/group/default`, and
+ * `/api/dashboard/{id}` then answers its placements.
+ *
+ * @param api an admin-authenticated request context.
+ * @param uuid the dashboard UUID the install returned.
+ * @return the dashboard's numeric id.
+ */
+async function idForUuid(api: APIRequestContext, uuid: string): Promise<number> {
+	const res = await api.get(`${API}/dashboards/visible`)
+	expect(res.status(), await res.text()).toBe(200)
+	const body = await res.json()
+	const items = (body.items ?? body) as Array<{ id: number; uuid: string }>
+	const found = items.find((d) => d.uuid === uuid)
+	expect(
+		found,
+		`the install reported uuid ${uuid} but /api/dashboards/visible does not list it`,
+	).toBeTruthy()
+	return Number(found!.id)
+}
+
+/** Read a dashboard and its placements by numeric id. */
+async function readDashboard(
+	api: APIRequestContext,
+	id: number,
+): Promise<{ dashboard: Record<string, unknown>; placements: Placement[] }> {
+	const res = await api.get(`${API}/dashboard/${id}`)
+	expect(res.status(), await res.text()).toBe(200)
+	return await res.json()
+}
+
+/*
+ * NOT `serial`, and the install happens ONCE, in `beforeAll`. Under `serial` a
+ * red install test skips every test after it, so a showcase that installs
+ * empty would show one failure and hide the fact that the composition and the
+ * rendered grid are wrong too. Installing up front lets each test report its
+ * own verdict on the same install. If Playwright restarts the worker after a
+ * failure it re-runs this hook, which uninstalls first, so the later tests
+ * still measure a fresh install rather than a leftover.
+ */
+test.describe('demo showcase — case-handler', () => {
+	let api: APIRequestContext
+	let installStatus = 0
+	let installBody: Record<string, unknown> = {}
+	let installedUuid: string | null = null
+	let previousActiveUuid: string | null = null
+
+	test.beforeAll(async ({ playwright }) => {
+		api = await adminApi({ request: playwright.request })
+
+		// The render test below switches the admin's active dashboard to the
+		// showcase. Remember what it was, so `afterAll` can hand it back rather
+		// than leave a preference pointing at a dashboard it then uninstalls.
+		const active = await api.get(`${API}/dashboard`)
+		if (active.ok()) {
+			const uuid = (await active.json())?.dashboard?.uuid
+			previousActiveUuid = typeof uuid === 'string' ? uuid : null
+		}
+
+		// Start from a known state. The uninstall is idempotent, so this is safe
+		// whether or not an earlier run left the showcase behind, and without it
+		// a re-run would take the `alreadyInstalled` path and measure nothing.
+		await api.delete(`${SHOWCASES}/${SHOWCASE_ID}`)
+
+		const res = await api.post(`${SHOWCASES}/${SHOWCASE_ID}/install`)
+		installStatus = res.status()
+		installBody = await res.json().catch(async () => ({ raw: await res.text() }))
+		const uuid = String(installBody.installedDashboardUuid ?? '')
+		installedUuid = /^[0-9a-f-]{36}$/.test(uuid) ? uuid : null
+	})
+
+	/*
+	 * 🔴 UNINSTALL IN `afterAll`. The install writes a group-shared dashboard
+	 * scoped to the `default` sentinel group, which means EVERY user of the
+	 * instance sees it — including whatever spec runs next. Leaving it behind
+	 * changes the dashboard other specs resolve to, and the uninstall is
+	 * documented idempotent (REQ-DEMO-006), so calling it unconditionally is
+	 * safe even when the install never happened.
+	 */
+	test.afterAll(async () => {
+		if (api === undefined) {
+			return
+		}
+		await api.delete(`${SHOWCASES}/${SHOWCASE_ID}`)
+		if (previousActiveUuid !== null) {
+			await api.post(`${API}/dashboards/active`, {
+				data: { uuid: previousActiveUuid },
+			})
+		}
+		await api.dispose()
+	})
+
+	// @e2e demo-data-showcases::a-showcase-declares-the-language-of-its-own-copy
+	test('the showcase is listed among the bundled ones', async () => {
+		const res = await api.get(SHOWCASES)
+		expect(res.status(), await res.text()).toBe(200)
+		const list = (await res.json()) as Array<Record<string, unknown>>
+
+		const entry = list.find((s) => s.id === SHOWCASE_ID)
+		expect(
+			entry,
+			`GET /api/admin/demo-showcases must offer "${SHOWCASE_ID}". `
+				+ `It listed: ${list.map((s) => s.id).join(', ')}. A showcase absent `
+				+ `from this list cannot be installed from the admin UI at all — the `
+				+ `list is where the cards come from.`,
+		).toBeTruthy()
+
+		// A card with no name renders as an empty tile the admin cannot identify.
+		expect(String(entry!.name ?? '').length).toBeGreaterThan(0)
+		expect(String(entry!.description ?? '').length).toBeGreaterThan(0)
+		expect(
+			String(entry!.thumbnailUrl ?? ''),
+			'the card needs a thumbnail path to render',
+		).toContain(SHOWCASE_ID)
+
+		/*
+		 * The language is declared per showcase, not assumed for the set. The
+		 * five organisation showcases are Dutch; `case-handler` is the first
+		 * role showcase and is English because the widgets it places carry
+		 * English labels. A gallery that labelled it "nl" would promise the
+		 * admin a Dutch dashboard and install an English one.
+		 */
+		expect(entry!.language, 'case-handler declares English copy').toBe('en')
+		const organisation = list.find((s) => s.id === 'gemeente-duin')
+		expect(
+			organisation?.language,
+			'an organisation showcase stays Dutch next to the role showcase',
+		).toBe('nl')
+	})
+
+	// @e2e demo-data-showcases::a-role-showcase-installs-as-a-read-only-group-dashboard
+	// @e2e demo-data-showcases::a-launchpad-widget-type-is-installed-although-nextcloud-does-not-register-it
+	test('installing it skips nothing', async () => {
+		expect(installStatus, JSON.stringify(installBody)).toBeLessThan(300)
+		const body = installBody
+		expect(
+			installedUuid,
+			`the install must name the dashboard it created: ${JSON.stringify(body)}`,
+		).toBeTruthy()
+
+		/*
+		 * THE ASSERTION. `partitionWidgets` drops a widget it believes it
+		 * cannot render and the install still succeeds, so a wrong belief is
+		 * silent. Every widget in this showcase is a LaunchPad-native type,
+		 * which is exactly what it used to get wrong: this list being empty is
+		 * the difference between the promised dashboard and a blank one.
+		 */
+		expect(
+			body.skippedWidgets,
+			`the install dropped widgets and reported success anyway: `
+				+ `${JSON.stringify(body.skippedWidgets)}. `
+				+ `DemoShowcasesService::partitionWidgets() must keep LaunchPad's own `
+				+ `types (lib/widget-types.json) as well as tiles and ids in `
+				+ `IManager::getWidgets().`,
+		).toEqual([])
+	})
+
+	// @e2e demo-data-showcases::a-role-showcase-installs-as-a-read-only-group-dashboard
+	// @e2e demo-data-showcases::a-kept-widget-keeps-its-configuration
+	test('it installs a read-only group dashboard carrying the four promised widgets', async () => {
+		expect(
+			installedUuid,
+			`the install in beforeAll produced no dashboard: ${JSON.stringify(installBody)}`,
+		).toBeTruthy()
+		const id = await idForUuid(api, installedUuid!)
+		const { dashboard, placements } = await readDashboard(api, id)
+
+		// Read-only, and shared with everyone rather than owned by the admin who
+		// pressed Install (REQ-DASH-012 — the `default` sentinel group).
+		expect(dashboard.type, 'a showcase installs as a group dashboard').toBe(
+			'group_shared',
+		)
+		expect(
+			dashboard.permissionLevel,
+			'the showcase dashboard is read-only for its audience',
+		).toBe('view_only')
+
+		expect(
+			placements.length,
+			`expected the four promised widgets, got `
+				+ `${placements.map((p) => p.widgetId).join(', ') || '(none)'}`,
+		).toBe(4)
+
+		// Compare as a multiset: layout order is the showcase author's business,
+		// the composition is the contract.
+		expect(placements.map((p) => p.widgetId).sort()).toEqual(
+			EXPECTED_WIDGETS.map((w) => w.widgetId).sort(),
+		)
+
+		/*
+		 * An `nc-widget` with the wrong `content.widgetId` is the failure this
+		 * catches: the placement exists, the frame renders, the title reads
+		 * "My tasks", and the proxy points somewhere else entirely. Nothing
+		 * about the count would show it.
+		 */
+		const proxied = placements
+			.filter((p) => p.widgetId === 'nc-widget')
+			.map((p) => String(p.content?.widgetId ?? ''))
+			.sort()
+		expect(
+			proxied,
+			'the two nc-widget proxies must name the Tasks and unread-mail widgets',
+		).toEqual(['mail-unread', 'tasks'])
+
+		// The object-list must actually point at dossiq cases; an object-list
+		// with no register renders an empty table and no error.
+		const objectList = placements.find((p) => p.widgetId === 'object-list')
+		expect(objectList?.content?.register, 'the case list reads dossiq').toBe(
+			'dossiq',
+		)
+		expect(
+			objectList?.content?.schema,
+			'the case list reads the case schema',
+		).toBe('case')
+
+		/*
+		 * The calendar must arrive configured AS a calendar: a placement with
+		 * no `internalCalendars` key at all is a widget that never learned what
+		 * it renders from. The list itself is shipped empty on purpose (see the
+		 * file header), so its length is deliberately not asserted.
+		 */
+		const calendar = placements.find((p) => p.widgetId === 'calendar')
+		expect(
+			calendar?.content,
+			'the calendar placement carries no content at all',
+		).toBeTruthy()
+		expect(
+			Array.isArray(calendar!.content!.internalCalendars),
+			'the calendar widget renders from content.internalCalendars',
+		).toBe(true)
+	})
+
+	test('all four widgets render as frames on the installed dashboard', async ({
+		page,
+	}) => {
+		expect(
+			installedUuid,
+			`the install in beforeAll produced no dashboard: ${JSON.stringify(installBody)}`,
+		).toBeTruthy()
+
+		// Make the showcase the active dashboard for this user, the way the
+		// switcher does — the shell resolves through the per-user UUID
+		// preference, not the legacy is_active column.
+		const activate = await api.post(`${API}/dashboards/active`, {
+			data: { uuid: installedUuid },
+		})
+		expect(activate.status(), await activate.text()).toBeLessThan(300)
+
+		// `domcontentloaded`, not the default `load`: this instance takes 55-60s
+		// to fire `load` on the workspace page, which is the entire configured
+		// navigationTimeout. The selector wait below is the real gate.
+		await page.goto(APP_URL, { waitUntil: 'domcontentloaded' })
+		await page.waitForSelector(
+			'.launchpad-floating-controls, .workspace-shell',
+			{
+				timeout: 20_000,
+			},
+		)
+
+		/*
+		 * Count the rendered grid items rather than trusting the API count
+		 * again. A placement the frontend cannot map to a registered widget
+		 * type is dropped at render time, which is a second, independent way
+		 * to end up with fewer tiles than the showcase promised.
+		 */
+		const items = page.locator('.grid-stack-item')
+		await expect(
+			items,
+			'the showcase promises four widgets; the grid rendered a different number',
+		).toHaveCount(4, { timeout: 20_000 })
+	})
+})
diff --git a/tests/e2e/fixtures/secondary-user.ts b/tests/e2e/fixtures/secondary-user.ts
index c01cc02c9..a8f4e4912 100644
--- a/tests/e2e/fixtures/secondary-user.ts
+++ b/tests/e2e/fixtures/secondary-user.ts
@@ -23,6 +23,7 @@ import type {
 
 import { request as pwRequest } from '@playwright/test'
 import { BASE_URL as BASE } from '../support/baseUrl.ts'
+import { installBundleOverride } from '../support/bundleOverride.ts'
 
 const ADMIN = {
 	user: process.env.NC_ADMIN_USER ?? 'admin',
@@ -156,6 +157,12 @@ export async function loginAs(
 		baseURL: BASE,
 		storageState: undefined,
 	})
+
+	// Before the first navigation, because Playwright routing only applies to
+	// requests a context makes after the route is installed. A no-op unless
+	// `LAUNCHPAD_BUNDLE_DIR` is set; see support/bundleOverride.ts.
+	await installBundleOverride(context)
+
 	const page = await context.newPage()
 	await page.goto('/index.php/login')
 	await page.locator('input[name="user"]').fill(username)
diff --git a/tests/e2e/shared-instance.ts b/tests/e2e/shared-instance.ts
new file mode 100644
index 000000000..9d17712a9
--- /dev/null
+++ b/tests/e2e/shared-instance.ts
@@ -0,0 +1,330 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Launchpad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * Whether this e2e run is allowed to touch the instance it is aimed at.
+ *
+ * GENERATED FROM hydra/templates/e2e/shared-instance.ts.tmpl. The only thing
+ * that differs per app is `APP_ID` below. Edit the template, not the copies.
+ *
+ * The problem
+ * -----------
+ * Every Conduction dev box runs one shared Nextcloud on port 8080 (or 80 when
+ * it is published without a port). It bind-mounts the host checkouts under
+ * `apps-extra/`, so it serves whatever everybody on the box is editing, and it
+ * carries data colleagues are working on. An e2e suite seeds OpenRegister
+ * objects and then deletes them again. Pointed at that instance it is not
+ * running tests, it is editing someone else's environment. Two apps were
+ * caught doing exactly this, by default, because their base URL fell back to
+ * `http://localhost:8080` when nothing was set.
+ *
+ * The rule
+ * --------
+ * Aiming at a shared instance is allowed. Aiming at one BY ACCIDENT is not.
+ * So the target has to be named twice: once as the base URL, and once in an
+ * opt-in variable that holds the origin you permit.
+ *
+ *     E2E_ALLOW_SHARED_INSTANCE=http://localhost:8080 \
+ *     PLAYWRIGHT_BASE_URL=http://localhost:8080 \
+ *     npx playwright test
+ *
+ * The flag holds an ORIGIN, not `1`. A bare `1` left in a shell profile goes
+ * on permitting every shared instance the suite ever meets. An origin permits
+ * the one you typed and nothing else, so aiming somewhere new makes you type
+ * the new one.
+ *
+ * Two spellings are accepted and they mean the same thing:
+ *
+ *   E2E_ALLOW_SHARED_INSTANCE              fleet-wide, permits any app's suite
+ *   LAUNCHPAD_E2E_ALLOW_SHARED_INSTANCE  this app only
+ *
+ * The app-specific spelling is the safer one to leave in a profile, because it
+ * stops at this app. The fleet-wide one is for a session that deliberately
+ * drives several suites at one instance.
+ *
+ * CI is exempt
+ * ------------
+ * On a GitHub runner `localhost:8080` is the runner's own throwaway Nextcloud,
+ * started by the shared ConductionNL/.github workflow and destroyed with the
+ * job. Nothing there is shared with anybody. Treating it as shared would break
+ * every e2e run in the fleet, so `isCI()` short-circuits the whole rule.
+ *
+ * This is one of three guards, and they do not overlap
+ * ---------------------------------------------------
+ *  1. An age bound on the cross-run residue sweep stops one session deleting
+ *     another session's LIVE fixtures.
+ *  2. A run ledger stops a run's own teardown reaching rows it never created,
+ *     at any age. Content matching (`JSON.stringify(row).includes(prefix)`) is
+ *     not ownership: it deletes anything that happens to carry the string.
+ *  3. This flag stops the cross-run sweep deleting anything at all on a shared
+ *     box, because there it cannot tell your leftovers from a colleague's.
+ *
+ * Guard 3 is the only portable one, which is why it is the one in this
+ * template. Guard 2 needs a single create funnel and is written per app.
+ */
+
+/** The app this copy belongs to. Substituted when the template is rendered. */
+export const APP_ID = 'launchpad'
+
+/** The app-specific opt-in variable. Holds an origin, not a boolean. */
+export const SHARED_INSTANCE_FLAG = 'LAUNCHPAD_E2E_ALLOW_SHARED_INSTANCE'
+
+/** The fleet-wide opt-in variable. Same contract, wider blast radius. */
+export const FLEET_INSTANCE_FLAG = 'E2E_ALLOW_SHARED_INSTANCE'
+
+/**
+ * Both spellings, app-specific first so it wins a disagreement.
+ */
+export const SHARED_INSTANCE_FLAGS = [
+	SHARED_INSTANCE_FLAG,
+	FLEET_INSTANCE_FLAG,
+] as const
+
+/**
+ * Origins that belong to the shared Conduction development stack.
+ *
+ * Port 8080 is the `nextcloud` container every dev box runs, and port 80 is
+ * the same stack published without a port. A disposable rig gets its own high
+ * port (8095, 8614, 8731 and so on), never matches this list, and needs no
+ * flag.
+ */
+const SHARED_PORTS = new Set(['80', '8080'])
+
+/** Loopback spellings that all name the same host. */
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0'])
+
+/** A URL split into the three things this module compares. */
+interface OriginParts {
+	/** `http:` or `https:`, including the colon. */
+	protocol: string
+	/** Hostname, with every loopback spelling folded onto `localhost`. */
+	host: string
+	/** Port as a string, with the protocol default made explicit. */
+	port: string
+}
+
+/**
+ * Split a URL into protocol, folded host and explicit port.
+ *
+ * The explicit port is the whole point. `new URL('http://127.0.0.1').port` is
+ * the empty string, not `80`, so a comparison against a port list silently
+ * misses every shared origin written without one. That is the failure this
+ * helper exists to make impossible, by being the only place a port is read.
+ *
+ * @param value A base URL.
+ * @return The parts, or null when the value will not parse.
+ */
+function splitOrigin(value: string): OriginParts | null {
+	let url: URL
+	try {
+		url = new URL(value)
+	} catch {
+		return null
+	}
+	return {
+		protocol: url.protocol,
+		host: LOOPBACK.has(url.hostname) ? 'localhost' : url.hostname,
+		port: url.port !== '' ? url.port : url.protocol === 'https:' ? '443' : '80',
+	}
+}
+
+/**
+ * Reduce a URL to `scheme://host:port`, with loopback spellings folded onto
+ * `localhost` and the default port made explicit.
+ *
+ * Returns the trimmed input when it will not parse, so a malformed value fails
+ * later on its own HTTP probe with a message about the real problem rather
+ * than here.
+ *
+ * @param value A base URL.
+ * @return The normalised origin.
+ */
+export function normaliseOrigin(value: string): string {
+	const parts = splitOrigin(value)
+	if (parts === null) return value.trim().replace(/\/+$/, '')
+	return `${parts.protocol}//${parts.host}:${parts.port}`
+}
+
+/**
+ * Whether this URL names an instance shared with other people.
+ *
+ * Shared means loopback on port 80 or 8080. A remote host is somebody's
+ * deployment and is out of scope here: this guard is about the box you are
+ * sitting at.
+ *
+ * @param value A base URL.
+ * @return True when the origin is the shared development stack.
+ */
+export function isSharedOrigin(value: string): boolean {
+	const parts = splitOrigin(value)
+	if (parts === null) return false
+	return parts.host === 'localhost' && SHARED_PORTS.has(parts.port)
+}
+
+/**
+ * Whether this process runs on a CI runner.
+ *
+ * @return True on GitHub Actions, or any CI that exports `CI`.
+ */
+export function isCI(): boolean {
+	return Boolean(process.env.CI) || Boolean(process.env.GITHUB_ACTIONS)
+}
+
+/**
+ * The flag value that permits this origin, if any flag does.
+ *
+ * @param target The base URL being aimed at.
+ * @param env    The environment to read.
+ * @return The variable name and its value, or null when none matches.
+ */
+export function permittingFlag(
+	target: string,
+	env: NodeJS.ProcessEnv = process.env,
+): { name: string; value: string } | null {
+	const wanted = normaliseOrigin(target)
+	for (const name of SHARED_INSTANCE_FLAGS) {
+		const value = (env[name] ?? '').trim()
+		if (value === '') continue
+		if (normaliseOrigin(value) === wanted) return { name, value }
+	}
+	return null
+}
+
+/**
+ * Whether this run deliberately targets an instance shared with other people.
+ *
+ * False on CI even at `localhost:8080`, and false for a rig on its own port.
+ * Every safety rule in a suite keys off this one answer: teardown deletes only
+ * recorded ids, the cross-run residue sweep reports instead of deleting, and
+ * specs that would change instance-wide settings refuse to run.
+ *
+ * @param target The base URL under test.
+ * @return True when the target is shared and this run said so.
+ */
+export function isSharedInstance(target: string): boolean {
+	return isCI() === false && isSharedOrigin(target)
+}
+
+/**
+ * The message an operator reads when they aimed at a shared instance without
+ * saying so.
+ *
+ * @param target The base URL they asked for.
+ * @param env    The environment to read.
+ * @return The full error text.
+ */
+function refusalMessage(
+	target: string,
+	env: NodeJS.ProcessEnv = process.env,
+): string {
+	const origin = normaliseOrigin(target)
+	const setButWrong = SHARED_INSTANCE_FLAGS.map((name) => {
+		const value = (env[name] ?? '').trim()
+		if (value === '') return ''
+		return (
+			`${name} is set to "${value}", which normalises to `
+			+ `${normaliseOrigin(value)} and does not match ${origin}.\n`
+		)
+	}).join('')
+
+	return (
+		`[${APP_ID} e2e] ${target} is the SHARED development instance, and this run `
+		+ 'did not say it meant to go there.\n'
+		+ setButWrong
+		+ 'That instance bind-mounts host checkouts and holds data your colleagues '
+		+ 'are working on. This suite seeds and deletes objects.\n\n'
+		+ 'Point the suite at your own disposable rig:\n\n'
+		+ '    PLAYWRIGHT_BASE_URL=http://localhost:8095 npx playwright test\n\n'
+		+ 'Or aim at the shared instance on purpose, naming the origin you permit:\n\n'
+		+ `    ${SHARED_INSTANCE_FLAG}=${origin} \\\n`
+		+ `    PLAYWRIGHT_BASE_URL=${target} \\\n`
+		+ '    npx playwright test\n\n'
+		+ `Read the header of tests/e2e/shared-instance.ts first. The flag changes `
+		+ 'what teardown may delete and what the residue sweep may remove.'
+	)
+}
+
+/**
+ * Refuse the run when it aims at a shared instance without the opt-in.
+ *
+ * Call this from the module that resolves the base URL, on the resolved value,
+ * so there is one place a target can enter the suite.
+ *
+ * @param target The base URL under test.
+ * @param env    The environment to read.
+ * @return The target, unchanged, so the call can be inlined.
+ * @throws when the target is shared and no flag names it.
+ */
+export function assertInstancePermitted(
+	target: string,
+	env: NodeJS.ProcessEnv = process.env,
+): string {
+	if (isCI()) return target
+	if (isSharedOrigin(target) === false) return target
+	if (permittingFlag(target, env) !== null) return target
+	throw new Error(refusalMessage(target, env))
+}
+
+/**
+ * Refuse one capability on a shared instance, even when the flag permitted the
+ * suite itself.
+ *
+ * For work that changes instance-wide state: enabling a workflow engine,
+ * flipping an app setting, purging a register. Call it from `test.beforeAll`
+ * so the refusal is reported as a failure with its reason. A skip reads as
+ * "nothing to see here", which is the opposite of the message.
+ *
+ * @param target The base URL under test.
+ * @param what   The spec or capability being refused.
+ * @param reason Why it must not run on a shared instance.
+ * @throws when this run targets a shared instance.
+ */
+export function refuseOnSharedInstance(
+	target: string,
+	what: string,
+	reason: string,
+): void {
+	if (isSharedInstance(target) === false) return
+	throw new Error(
+		`[${APP_ID} e2e] ${what} must not run on ${target}.\n`
+			+ `${reason}\n`
+			+ `${SHARED_INSTANCE_FLAG} permits the suite on a shared instance. It does `
+			+ 'not permit this.\n'
+			+ 'Start a disposable rig and point the suite at that instead:\n\n'
+			+ '    PLAYWRIGHT_BASE_URL=http://localhost:8095 npx playwright test\n',
+	)
+}
+
+/**
+ * The occ invocation for the instance under test, as a command prefix.
+ *
+ * The binding matters on a shared box: `php occ` run from this checkout talks
+ * to whatever server root sits two directories up, which on CI is the instance
+ * under test and on a dev box may be a different one entirely. Naming the
+ * container is how the two are tied together.
+ *
+ * Resolution order:
+ *  1. `LAUNCHPAD_E2E_OCC`, a complete prefix, for any rig shape the guesses
+ *     below do not cover.
+ *  2. `LAUNCHPAD_E2E_CONTAINER` or `NEXTCLOUD_CONTAINER`, a container name,
+ *     turned into `docker exec -u www-data <name> php occ`.
+ *  3. `php occ` from the server root, which is the CI case.
+ *
+ * @param env The environment to read.
+ * @return The argv prefix, already split, for `execFile` rather than a shell.
+ */
+export function occPrefix(env: NodeJS.ProcessEnv = process.env): string[] {
+	const explicit = (env.LAUNCHPAD_E2E_OCC ?? '').trim()
+	if (explicit !== '') return explicit.split(/\s+/).filter((p) => p !== '')
+
+	const container = (
+		env.LAUNCHPAD_E2E_CONTAINER
+		?? env.NEXTCLOUD_CONTAINER
+		?? ''
+	).trim()
+	if (container !== '') {
+		return ['docker', 'exec', '-u', 'www-data', container, 'php', 'occ']
+	}
+
+	return ['php', 'occ']
+}
diff --git a/tests/e2e/support/baseUrl.ts b/tests/e2e/support/baseUrl.ts
index e946ab682..20f08d008 100644
--- a/tests/e2e/support/baseUrl.ts
+++ b/tests/e2e/support/baseUrl.ts
@@ -27,8 +27,15 @@
  *     everywhere it mattered. `NEXTCLOUD_URL` and `NC_BASE_URL` are the names
  *     this repo's own docs and docker-compose helpers have always used, so they
  *     stay honoured; only the fallback value is gone.
+ *
+ *  3. A target that names the shared instance has to say so. The resolved URL
+ *     goes through `assertInstancePermitted`, which refuses loopback port 80
+ *     or 8080 unless the run set an opt-in variable holding that same origin.
+ *     See tests/e2e/shared-instance.ts.
  */
 
+import { assertInstancePermitted } from '../shared-instance.ts'
+
 const RAW =
 	process.env.PLAYWRIGHT_BASE_URL?.trim()
 	|| process.env.BASE_URL?.trim()
@@ -53,7 +60,7 @@ if (!RAW) {
 /**
  * The base URL of the Nextcloud under test, without a trailing slash.
  */
-export const BASE_URL: string = RAW.replace(/\/+$/, '')
+export const BASE_URL: string = assertInstancePermitted(RAW.replace(/\/+$/, ''))
 
 /**
  * Build an absolute URL against the instance under test.
diff --git a/tests/e2e/support/bundleOverride.ts b/tests/e2e/support/bundleOverride.ts
new file mode 100644
index 000000000..3a5a608e7
--- /dev/null
+++ b/tests/e2e/support/bundleOverride.ts
@@ -0,0 +1,113 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * Serve LaunchPad's compiled JavaScript from a local directory instead of from
+ * the instance under test.
+ *
+ * 🔴 WHY THIS EXISTS. A guard test is not finished until you have watched it
+ * fail, and the guard this repo needed to prove — the manifest's `permission`
+ * field — lives entirely in the BUNDLE: the manifest is compiled in
+ * (`import bundledStub from './manifest.json'`), the nav filter runs in
+ * `CnAppNav`, and the route guard is installed by `main.js`. There is no
+ * runtime switch that turns it off, so the only way to see the assertions
+ * redden is to run the same spec against a bundle built without the fix.
+ *
+ * Doing that by swapping the app's `js/` directory means writing into a
+ * checkout that other sessions share, and a build artefact left behind after
+ * an interrupted run is indistinguishable from a real regression. Routing the
+ * requests instead leaves the instance untouched, and — more importantly —
+ * puts BOTH legs of the comparison through the identical mechanism, so
+ * anything the interception itself perturbs is common-mode and cancels.
+ *
+ * INERT UNLESS ASKED. With `LAUNCHPAD_BUNDLE_DIR` unset this installs no
+ * route at all, which is how CI and an ordinary local run behave: they test
+ * the bundle the instance actually serves. Set it only to run the comparison:
+ *
+ *   LAUNCHPAD_BUNDLE_DIR=/path/to/js npx playwright test <spec>
+ *
+ * A request for a file the directory does not hold falls through to the
+ * server rather than 404ing, so a lazily-loaded chunk that only exists in the
+ * deployed build still resolves.
+ */
+
+import type { BrowserContext } from '@playwright/test'
+
+import * as fs from 'fs'
+import * as path from 'path'
+
+/** Where LaunchPad's compiled assets are requested from, under any webroot. */
+const BUNDLE_URL_GLOB = '**/custom_apps/launchpad/js/**'
+
+/** Content types keyed by the extensions the bundle directory actually holds. */
+const CONTENT_TYPES: Record<string, string> = {
+	'.js': 'application/javascript; charset=utf-8',
+	'.map': 'application/json; charset=utf-8',
+	'.txt': 'text/plain; charset=utf-8',
+	'.css': 'text/css; charset=utf-8',
+}
+
+/**
+ * The directory to serve the bundle from, or null when the override is off.
+ *
+ * Throws rather than silently disabling itself when the variable names a
+ * directory that is not there: a comparison run that quietly tested the
+ * deployed bundle twice would report two identical results and read as
+ * "the fix changes nothing".
+ *
+ * @return {string|null} An absolute directory path, or null.
+ */
+export function bundleOverrideDir(): string | null {
+	const raw = process.env.LAUNCHPAD_BUNDLE_DIR?.trim()
+	if (!raw) {
+		return null
+	}
+	const dir = path.resolve(raw)
+	if (!fs.existsSync(path.join(dir, 'launchpad-main.js'))) {
+		throw new Error(
+			`LAUNCHPAD_BUNDLE_DIR=${raw} holds no launchpad-main.js.\n`
+				+ 'Refusing to run: an override that silently did nothing would\n'
+				+ 'test the deployed bundle and report it as the one you built.\n',
+		)
+	}
+	return dir
+}
+
+/**
+ * Install the override on one browser context, if it is switched on.
+ *
+ * Call it on every context a spec creates — the default `page` fixture's
+ * context included — because Playwright routing is per context.
+ *
+ * @param {BrowserContext} context The context to route.
+ * @return {Promise<string|null>} The directory now being served, or null.
+ */
+export async function installBundleOverride(
+	context: BrowserContext,
+): Promise<string | null> {
+	const dir = bundleOverrideDir()
+	if (!dir) {
+		return null
+	}
+
+	await context.route(BUNDLE_URL_GLOB, async (route) => {
+		const name = path.basename(new URL(route.request().url()).pathname)
+		const file = path.join(dir, name)
+
+		// `path.basename` already strips any directory part, so a crafted
+		// path cannot escape the directory; this only guards a typo.
+		if (!file.startsWith(dir + path.sep) || !fs.existsSync(file)) {
+			await route.fallback()
+			return
+		}
+
+		await route.fulfill({
+			status: 200,
+			contentType:
+				CONTENT_TYPES[path.extname(name)] ?? 'application/octet-stream',
+			body: fs.readFileSync(file),
+		})
+	})
+
+	return dir
+}
diff --git a/tests/e2e/support/zipArchive.ts b/tests/e2e/support/zipArchive.ts
new file mode 100644
index 000000000..103fa1bc6
--- /dev/null
+++ b/tests/e2e/support/zipArchive.ts
@@ -0,0 +1,199 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * Build and read ZIP archives inside an e2e test.
+ *
+ * The export-import specs need two things no other spec needed: archives
+ * crafted to be WRONG in one specific way (no manifest, a manifest that is not
+ * JSON, a schema version this LaunchPad cannot read, one dashboard file out of
+ * ten corrupt), and a way to look inside the archive the admin page hands back
+ * from a download.
+ *
+ * WHY THERE IS NO LIBRARY HERE. `fflate` exists in `node_modules`, but only as
+ * something another package depends on. Reaching into a transitive dependency
+ * means this suite breaks the next time that package's tree changes, for a
+ * reason that has nothing to do with LaunchPad, so this uses Node's own
+ * `zlib` instead: STORE (no compression) on the way out, STORE and DEFLATE on
+ * the way in. That is the whole of what these tests need, and it is the same
+ * format `ZipArchive` reads on the server.
+ */
+
+import { inflateRawSync } from 'zlib'
+
+/** One file in an archive. */
+export interface ZipEntry {
+	name: string
+	content: string | Buffer
+}
+
+/** CRC-32, the checksum every ZIP entry carries. */
+function crc32(buf: Buffer): number {
+	let crc = -1
+	for (let i = 0; i < buf.length; i++) {
+		crc ^= buf[i]
+		for (let bit = 0; bit < 8; bit++) {
+			// 0xEDB88320 is the reversed polynomial ZIP uses.
+			crc = crc & 1 ? (crc >>> 1) ^ 0xedb88320 : crc >>> 1
+		}
+	}
+	return (crc ^ -1) >>> 0
+}
+
+/**
+ * Build a ZIP archive from a list of entries, stored uncompressed.
+ *
+ * @param entries the files to put in the archive.
+ * @return the archive bytes, ready to hand to a file input.
+ */
+export function buildZip(entries: ZipEntry[]): Buffer {
+	const locals: Buffer[] = []
+	const centrals: Buffer[] = []
+	let offset = 0
+
+	for (const entry of entries) {
+		const name = Buffer.from(entry.name, 'utf8')
+		const data = Buffer.isBuffer(entry.content)
+			? entry.content
+			: Buffer.from(entry.content, 'utf8')
+		const sum = crc32(data)
+
+		const local = Buffer.alloc(30 + name.length)
+		local.writeUInt32LE(0x04034b50, 0) // local file header
+		local.writeUInt16LE(20, 4) // version needed
+		local.writeUInt16LE(0, 6) // flags
+		local.writeUInt16LE(0, 8) // method: stored
+		local.writeUInt32LE(0, 10) // time + date
+		local.writeUInt32LE(sum, 14)
+		local.writeUInt32LE(data.length, 18)
+		local.writeUInt32LE(data.length, 22)
+		local.writeUInt16LE(name.length, 26)
+		local.writeUInt16LE(0, 28) // extra length
+		name.copy(local, 30)
+		locals.push(local, data)
+
+		const central = Buffer.alloc(46 + name.length)
+		central.writeUInt32LE(0x02014b50, 0) // central directory header
+		central.writeUInt16LE(20, 4) // version made by
+		central.writeUInt16LE(20, 6) // version needed
+		central.writeUInt16LE(0, 8)
+		central.writeUInt16LE(0, 10)
+		central.writeUInt32LE(0, 12)
+		central.writeUInt32LE(sum, 16)
+		central.writeUInt32LE(data.length, 20)
+		central.writeUInt32LE(data.length, 24)
+		central.writeUInt16LE(name.length, 28)
+		central.writeUInt32LE(0, 30) // extra + comment lengths
+		central.writeUInt16LE(0, 36) // disk number
+		central.writeUInt32LE(0, 38) // attributes
+		central.writeUInt32LE(offset, 42)
+		name.copy(central, 46)
+		centrals.push(central)
+
+		offset += local.length + data.length
+	}
+
+	const centralBytes = Buffer.concat(centrals)
+	const end = Buffer.alloc(22)
+	end.writeUInt32LE(0x06054b50, 0) // end of central directory
+	end.writeUInt16LE(entries.length, 8)
+	end.writeUInt16LE(entries.length, 10)
+	end.writeUInt32LE(centralBytes.length, 12)
+	end.writeUInt32LE(offset, 16)
+
+	return Buffer.concat([...locals, centralBytes, end])
+}
+
+/**
+ * Read an archive into a name-to-bytes map.
+ *
+ * Reads the central directory rather than scanning for local headers, so an
+ * entry the archive lists but never wrote shows up as missing rather than
+ * being silently skipped. Handles stored and deflated entries, which is
+ * everything `ZipArchive` writes.
+ *
+ * @param buffer the archive bytes.
+ * @return every entry, keyed by name. Directory entries are included as empty.
+ */
+export function readZip(buffer: Buffer): Record<string, Buffer> {
+	const endIndex = buffer.lastIndexOf(Buffer.from([0x50, 0x4b, 0x05, 0x06]))
+	if (endIndex < 0) {
+		throw new Error('not a ZIP archive: no end-of-central-directory record')
+	}
+
+	const count = buffer.readUInt16LE(endIndex + 10)
+	let pointer = buffer.readUInt32LE(endIndex + 16)
+	const out: Record<string, Buffer> = {}
+
+	for (let i = 0; i < count; i++) {
+		if (buffer.readUInt32LE(pointer) !== 0x02014b50) {
+			throw new Error(`corrupt central directory at entry ${i}`)
+		}
+		const method = buffer.readUInt16LE(pointer + 10)
+		const compressedSize = buffer.readUInt32LE(pointer + 20)
+		const nameLength = buffer.readUInt16LE(pointer + 28)
+		const extraLength = buffer.readUInt16LE(pointer + 30)
+		const commentLength = buffer.readUInt16LE(pointer + 32)
+		const localOffset = buffer.readUInt32LE(pointer + 42)
+		const name = buffer
+			.subarray(pointer + 46, pointer + 46 + nameLength)
+			.toString('utf8')
+
+		const localNameLength = buffer.readUInt16LE(localOffset + 26)
+		const localExtraLength = buffer.readUInt16LE(localOffset + 28)
+		const dataStart = localOffset + 30 + localNameLength + localExtraLength
+		const raw = buffer.subarray(dataStart, dataStart + compressedSize)
+		out[name] = method === 0 ? raw : inflateRawSync(raw)
+
+		pointer += 46 + nameLength + extraLength + commentLength
+	}
+
+	return out
+}
+
+/**
+ * Read one entry as JSON.
+ *
+ * @param archive the map `readZip` returned.
+ * @param name the entry name.
+ * @return the parsed value.
+ */
+export function readJsonEntry(archive: Record<string, Buffer>, name: string): any {
+	const entry = archive[name]
+	if (entry === undefined) {
+		throw new Error(
+			`archive has no ${name}; it holds: ${Object.keys(archive).join(', ')}`,
+		)
+	}
+	return JSON.parse(entry.toString('utf8'))
+}
+
+/** The names of the dashboard files in an archive. */
+export function dashboardEntries(archive: Record<string, Buffer>): string[] {
+	return Object.keys(archive).filter(
+		(name) => name.startsWith('dashboards/') && name.endsWith('.json'),
+	)
+}
+
+/** A minimal valid dashboard payload for a crafted archive. */
+export function dashboardPayload(
+	uuid: string,
+	name: string,
+	extra: Record<string, unknown> = {},
+): string {
+	return JSON.stringify({ uuid, name, widgets: [], ...extra })
+}
+
+/** A manifest for a crafted archive. */
+export function manifest(overrides: Record<string, unknown> = {}): string {
+	return JSON.stringify({
+		schemaVersion: 1,
+		exportedAt: '2026-01-01T00:00:00Z',
+		exportedBy: 'admin',
+		launchpadVersion: 'launchpad/v1',
+		scope: 'site',
+		dashboardCount: 1,
+		includedAssets: [],
+		...overrides,
+	})
+}
diff --git a/tests/e2e/tile-quick-search.spec.ts b/tests/e2e/tile-quick-search.spec.ts
index da9989cae..77fc95077 100644
--- a/tests/e2e/tile-quick-search.spec.ts
+++ b/tests/e2e/tile-quick-search.spec.ts
@@ -41,15 +41,17 @@
 import type { APIRequestContext, Page } from '@playwright/test'
 
 import { expect, request, test } from '@playwright/test'
+import { BASE_URL } from './support/baseUrl.ts'
 
 const ADMIN = {
 	user: process.env.ADMIN_USER ?? process.env.NC_ADMIN_USER ?? 'admin',
 	pass: process.env.ADMIN_PASSWORD ?? process.env.NC_ADMIN_PASS ?? 'admin',
 }
-const ENV_BASE_URL = (process.env.BASE_URL ?? process.env.NC_BASE_URL ?? '').replace(
-	/\/$/,
-	'',
-)
+// Through the shared resolver, not a private read of `BASE_URL`. That read
+// ignored `PLAYWRIGHT_BASE_URL`, the variable tests/e2e/support/baseUrl.ts
+// documents, so a local run that set only it failed here with `Invalid URL`.
+// CI exports `BASE_URL`, which the resolver still honours.
+const ENV_BASE_URL = BASE_URL
 
 const APP_URL = '/index.php/apps/launchpad'
 const SETTINGS = '/index.php/apps/launchpad/api/admin/settings'
diff --git a/tests/l10n/check-l10n-parity.js b/tests/l10n/check-l10n-parity.js
index 460ccf467..4b72f2c85 100644
--- a/tests/l10n/check-l10n-parity.js
+++ b/tests/l10n/check-l10n-parity.js
@@ -20,7 +20,10 @@
  *      for plural arrays, no element may be empty.
  *
  * Values identical to English are allowed (cognates / proper nouns / acronyms
- * are legitimately the same) and only counted.
+ * are legitimately the same) and are NOT reported. This used to say they were
+ * "counted"; nothing counts them. So an English copy standing in for a missing
+ * translation passes silently, and it can only be found by its key. Name any
+ * such copy in the commit that adds it.
  *
  * Sparse override locales (en, en_US and any other regional en_*) are skipped.
  *
diff --git a/tests/vitest/shared-instance.spec.ts b/tests/vitest/shared-instance.spec.ts
new file mode 100644
index 000000000..0c331c240
--- /dev/null
+++ b/tests/vitest/shared-instance.spec.ts
@@ -0,0 +1,120 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Launchpad Contributors
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * The guard that decides whether this suite may touch the instance it is aimed
+ * at, tested without an instance.
+ *
+ * GENERATED FROM hydra/templates/e2e/shared-instance.test.ts.tmpl.
+ *
+ * Worth testing rather than reading, because every case here is one somebody
+ * already got wrong: `http://127.0.0.1` parses with an EMPTY port, so a port
+ * comparison that trusts `URL.port` misses the shared instance written without
+ * one, and a flag holding `1` used to permit every shared instance the suite
+ * ever met.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+	APP_ID,
+	assertInstancePermitted,
+	isSharedOrigin,
+	normaliseOrigin,
+	occPrefix,
+	SHARED_INSTANCE_FLAG,
+} from '../e2e/shared-instance.ts'
+
+/** An environment with neither flag set. */
+const NONE = {} as NodeJS.ProcessEnv
+
+/*
+ * The guard exempts CI, and a unit runner runs ON CI. So without this, the
+ * three refusal cases below pass on a laptop and fail on every runner:
+ * measured before the stub, `CI=true npx vitest run` gave 3 failed, 7 passed.
+ * A test whose verdict depends on where it runs is worse than no test.
+ */
+
+describe(`${APP_ID} shared-instance guard`, () => {
+	beforeEach(() => {
+		vi.stubEnv('CI', '')
+		vi.stubEnv('GITHUB_ACTIONS', '')
+	})
+
+	afterEach(() => {
+		vi.unstubAllEnvs()
+	})
+
+	it('folds every loopback spelling onto localhost', () => {
+		expect(normaliseOrigin('http://127.0.0.1:8080')).toBe(
+			'http://localhost:8080',
+		)
+		expect(normaliseOrigin('http://[::1]:8080')).toBe('http://localhost:8080')
+		expect(normaliseOrigin('http://localhost:8080/')).toBe(
+			'http://localhost:8080',
+		)
+	})
+
+	it('makes the implicit port explicit', () => {
+		expect(normaliseOrigin('http://127.0.0.1')).toBe('http://localhost:80')
+		expect(normaliseOrigin('https://example.org')).toBe(
+			'https://example.org:443',
+		)
+	})
+
+	it('calls loopback 80 and 8080 shared, and nothing else', () => {
+		expect(isSharedOrigin('http://localhost:8080')).toBe(true)
+		expect(isSharedOrigin('http://127.0.0.1')).toBe(true)
+		expect(isSharedOrigin('http://localhost:8095')).toBe(false)
+		expect(isSharedOrigin('http://nextcloud.example.org:8080')).toBe(false)
+	})
+
+	it('refuses a shared instance that no flag names', () => {
+		expect(() => assertInstancePermitted('http://localhost:8080', NONE)).toThrow(
+			/SHARED development instance/,
+		)
+	})
+
+	it('refuses a flag holding a boolean rather than an origin', () => {
+		const env = { [SHARED_INSTANCE_FLAG]: '1' } as unknown as NodeJS.ProcessEnv
+		expect(() => assertInstancePermitted('http://localhost:8080', env)).toThrow()
+	})
+
+	it('refuses a flag that names a different origin', () => {
+		const env = {
+			[SHARED_INSTANCE_FLAG]: 'http://localhost:80',
+		} as unknown as NodeJS.ProcessEnv
+		expect(() => assertInstancePermitted('http://localhost:8080', env)).toThrow()
+	})
+
+	it('permits the origin the flag names, in any loopback spelling', () => {
+		const env = {
+			[SHARED_INSTANCE_FLAG]: 'http://127.0.0.1:8080',
+		} as unknown as NodeJS.ProcessEnv
+		expect(assertInstancePermitted('http://localhost:8080', env)).toBe(
+			'http://localhost:8080',
+		)
+	})
+
+	it('accepts the fleet-wide spelling too', () => {
+		const env = {
+			E2E_ALLOW_SHARED_INSTANCE: 'http://localhost:8080',
+		} as unknown as NodeJS.ProcessEnv
+		expect(assertInstancePermitted('http://localhost:8080', env)).toBe(
+			'http://localhost:8080',
+		)
+	})
+
+	it('lets a disposable rig through without a flag', () => {
+		expect(assertInstancePermitted('http://localhost:8095', NONE)).toBe(
+			'http://localhost:8095',
+		)
+	})
+
+	it('binds occ to a named container, and falls back to the server root', () => {
+		expect(occPrefix(NONE).join(' ')).toBe('php occ')
+		const env = { NEXTCLOUD_CONTAINER: 'nextcloud' } as NodeJS.ProcessEnv
+		expect(occPrefix(env).join(' ')).toBe(
+			'docker exec -u www-data nextcloud php occ',
+		)
+	})
+})
diff --git a/tests/vitest/stubs/conduction-nextcloud-vue.js b/tests/vitest/stubs/conduction-nextcloud-vue.js
index 4aad5b45d..5ce8208bf 100644
--- a/tests/vitest/stubs/conduction-nextcloud-vue.js
+++ b/tests/vitest/stubs/conduction-nextcloud-vue.js
@@ -47,6 +47,8 @@ const stub = (name) => ({ name, render: () => h('div') })
 export const NcModal = stub('NcModal')
 export const NcButton = stub('NcButton')
 export const NcTextField = stub('NcTextField')
+export const NcPasswordField = stub('NcPasswordField')
+export const NcNoteCard = stub('NcNoteCard')
 export const NcSelect = stub('NcSelect')
 export const NcEmptyContent = stub('NcEmptyContent')
 export const NcAppNavigation = stub('NcAppNavigation')
@@ -437,6 +439,8 @@ export default {
 	NcModal,
 	NcButton,
 	NcTextField,
+	NcPasswordField,
+	NcNoteCard,
 	NcSelect,
 	NcEmptyContent,
 	NcAppNavigation,
diff --git a/tools/spec-annotations-allowlist.txt b/tools/spec-annotations-allowlist.txt
index 1ecac47e5..b772a7cf2 100644
--- a/tools/spec-annotations-allowlist.txt
+++ b/tools/spec-annotations-allowlist.txt
@@ -773,3 +773,35 @@ OCA\LaunchPad\Exception\QuotaExceededException::getLimit
 OCA\LaunchPad\Exception\QuotaExceededException::getCurrent
 # Error-response serialiser for the quota exception, covered by the dashboard-quota-limits REQ.
 OCA\LaunchPad\Exception\QuotaExceededException::toResponseBody
+#
+# 2026-09-09: twelve methods that post-date the 2026-05-03 baseline and match
+# shapes already allowlisted wholesale above — mapper query methods, entity
+# serialisers, a migration schema hook and a framework label getter. Added here
+# rather than tagged because none is a discrete requirement of its own; each is
+# covered by the capability whose data it moves. `composer lint:spec-annotations`
+# has been red on `development` since these landed.
+#
+# Repair-step label required by NC's IRepairStep interface, no discrete spec REQ.
+OCA\LaunchPad\Repair\ImportLaunchpadRegister::getName
+# Tile-click query method, covered by the tile-analytics REQ.
+OCA\LaunchPad\Db\TileClickMapper::findByPlacementAndBucket
+# Tile-click query method, covered by the tile-analytics REQ.
+OCA\LaunchPad\Db\TileClickMapper::findTopTilesInRange
+# Tile-click query method, covered by the tile-analytics REQ.
+OCA\LaunchPad\Db\TileClickMapper::findByDashboardInRange
+# Tile-click query method, covered by the tile-analytics REQ.
+OCA\LaunchPad\Db\TileClickMapper::findAllInRange
+# Tile-click write path, covered by the tile-analytics REQ.
+OCA\LaunchPad\Db\TileClickMapper::upsertClick
+# Tile-click retention pruning, covered by the tile-analytics REQ.
+OCA\LaunchPad\Db\TileClickMapper::deleteOlderThan
+# Tile-click cascade delete, covered by the tile-analytics REQ.
+OCA\LaunchPad\Db\TileClickMapper::deleteByPlacement
+# Entity column/property name mapping, framework plumbing with no spec REQ.
+OCA\LaunchPad\Db\WidgetPlacement::propertyToColumn
+# Entity column/property name mapping, framework plumbing with no spec REQ.
+OCA\LaunchPad\Db\WidgetPlacement::columnToProperty
+# Entity serialiser, same shape as the other Db jsonSerialize entries above.
+OCA\LaunchPad\Db\TileClick::jsonSerialize
+# Migration schema hook, same shape as every other changeSchema entry above.
+OCA\LaunchPad\Migration\Version002007Date20260724000000::changeSchema
diff --git a/vitest.config.js b/vitest.config.js
index 39261f232..29abc9a8b 100644
--- a/vitest.config.js
+++ b/vitest.config.js
@@ -60,7 +60,12 @@ module.exports = {
 		// overruns the 10s default hook timeout on a loaded machine — the
 		// symptom is "Hook timed out in 10000ms" with no assertion failure.
 		hookTimeout: 30000,
-		include: ['src/**/__tests__/**/*.spec.{js,ts}'],
+		// `tests/e2e/**/*.test.ts` is the second entry on purpose. The e2e
+		// suite's own Playwright specs are named `*.spec.ts` and are not
+		// matched here; only plain unit tests that live beside the e2e
+		// helpers are, such as the shared-instance guard, which is pure
+		// logic and needs no browser.
+		include: ['src/**/__tests__/**/*.spec.{js,ts}', 'tests/vitest/**/*.spec.ts'],
 		setupFiles: [path.resolve(__dirname, 'tests/vitest/setup.js')],
 		server: {
 			deps: {
diff --git a/webpack.config.js b/webpack.config.js
index 6f051797e..7ebe3b791 100644
--- a/webpack.config.js
+++ b/webpack.config.js
@@ -32,7 +32,19 @@ webpackConfig.resolve = {
 		// Deduplicate shared packages so the aliased library source uses
 		// the same instances as the app (prevents dual-Pinia / dual-Vue bugs).
 		vue$: path.resolve(__dirname, 'node_modules/vue'),
-		pinia$: path.resolve(__dirname, 'node_modules/pinia'),
+		// pinia 4 JOINED THE ESM-ONLY CATEGORY DESCRIBED JUST BELOW. 2.1.7
+		// declared `main: index.js` and `module: dist/pinia.mjs`, so a
+		// directory alias resolved; 4.0.3 declares NEITHER, only an `exports`
+		// map of `{".": "./dist/pinia.js"}`. The directory alias then bypasses
+		// `exports`, finds no main/index, and resolves to nothing — and because
+		// webpack names the ISSUER, the error reads
+		//
+		//     Can't resolve 'pinia' in
+		//       node_modules/@conduction/nextcloud-vue/dist/esm/composables
+		//
+		// which looks like a broken shared library rather than a stale line
+		// here. Same shape as the `@nextcloud/axios` alias that broke on 2.6.0.
+		pinia$: path.resolve(__dirname, 'node_modules/pinia/dist/pinia.js'),
 		// @nextcloud/vue@9 and @nextcloud/dialogs@7 (the Vue-3 lines) are
 		// ESM-only: no `main`/`module`, just an `exports` map with a single
 		// "import" condition. Aliasing to the package DIRECTORY (as before)