From f63af7081cc373bd77cf42246f2fd515011119c9 Mon Sep 17 00:00:00 2001
From: Valeriy Selitskiy <239034+iamwavecut@users.noreply.github.com>
Date: Sun, 8 Nov 2026 00:39:35 +0100
Subject: [PATCH] refactor: untangle provider routing and durable delivery

---
 .env.example                                  |     1 -
 Cargo.lock                                    |     4 +-
 crates/openplotva-app/src/asr.rs              |    40 +-
 crates/openplotva-app/src/callbacks.rs        |   122 +-
 crates/openplotva-app/src/checkin.rs          |   716 +-
 crates/openplotva-app/src/control_jobs.rs     |   683 +-
 .../src/control_jobs/test_support.rs          |   190 +
 crates/openplotva-app/src/delete_drawing.rs   |   191 +-
 crates/openplotva-app/src/delete_lyrics.rs    |   174 +-
 crates/openplotva-app/src/delete_message.rs   |   140 +-
 crates/openplotva-app/src/dialog_debounce.rs  |     8 +-
 .../openplotva-app/src/dialog_jobs/effects.rs |   103 +-
 crates/openplotva-app/src/dialog_jobs/mod.rs  |     1 +
 crates/openplotva-app/src/dialog_messages.rs  |   333 +-
 crates/openplotva-app/src/dialog_runtime.rs   |   971 +-
 crates/openplotva-app/src/dialog_tools.rs     |    10 +-
 .../openplotva-app/src/dialog_turn/session.rs |     7 +-
 crates/openplotva-app/src/embedder.rs         |    40 +-
 crates/openplotva-app/src/gradius_ads.rs      |    17 +-
 .../src/gradius_utility_outbox.rs             |    26 +-
 crates/openplotva-app/src/help.rs             |   114 +-
 crates/openplotva-app/src/history_summary.rs  |   528 +-
 crates/openplotva-app/src/http/assets.rs      |    36 +
 crates/openplotva-app/src/http/auth.rs        |   304 +
 crates/openplotva-app/src/http/common.rs      |   185 +
 crates/openplotva-app/src/http/entities.rs    |  1260 ++
 crates/openplotva-app/src/http/ingress.rs     |    46 +
 crates/openplotva-app/src/http/memory.rs      |   943 ++
 crates/openplotva-app/src/http/mod.rs         |    75 +
 .../openplotva-app/src/http/observability.rs  |  1033 ++
 crates/openplotva-app/src/http/redis.rs       |   197 +
 crates/openplotva-app/src/http/routing.rs     |  1183 ++
 crates/openplotva-app/src/http/settings.rs    |  2107 +++
 crates/openplotva-app/src/http/shield.rs      |   570 +
 crates/openplotva-app/src/http/taskman.rs     |   685 +
 crates/openplotva-app/src/image_jobs.rs       |   119 +-
 crates/openplotva-app/src/lib.rs              | 11228 ++--------------
 crates/openplotva-app/src/llm_translate.rs    |    13 +-
 crates/openplotva-app/src/media.rs            |   472 +-
 crates/openplotva-app/src/members.rs          |   587 +-
 crates/openplotva-app/src/memory_runtime.rs   |   833 +-
 crates/openplotva-app/src/memory_workers.rs   |   194 +
 crates/openplotva-app/src/model_routing.rs    |   499 +-
 crates/openplotva-app/src/music_jobs.rs       |   805 +-
 .../src/openrouter_free_pool.rs               |    19 +-
 crates/openplotva-app/src/payments.rs         |  1628 +--
 crates/openplotva-app/src/permissions.rs      |     4 +-
 .../openplotva-app/src/provider_transport.rs  |   400 +
 crates/openplotva-app/src/python_sandbox.rs   |     1 +
 crates/openplotva-app/src/rate_limits.rs      |     4 +-
 crates/openplotva-app/src/rates.rs            |   502 +-
 crates/openplotva-app/src/rich.rs             |   410 +-
 crates/openplotva-app/src/routed_attempts.rs  |    38 +-
 crates/openplotva-app/src/runtime_cache.rs    |    12 +-
 .../openplotva-app/src/runtime_dispatcher.rs  |   507 +
 crates/openplotva-app/src/runtime_entities.rs |   445 +-
 crates/openplotva-app/src/runtime_llm.rs      |    12 +-
 crates/openplotva-app/src/runtime_redis.rs    |    94 +
 crates/openplotva-app/src/runtime_routing.rs  |    22 +
 crates/openplotva-app/src/runtime_taskman.rs  |    12 +-
 .../src/runtime_virtual_dialog.rs             |     2 +
 crates/openplotva-app/src/settings.rs         |   299 +-
 crates/openplotva-app/src/task_queue.rs       |   180 +
 crates/openplotva-app/src/telegram_outbox.rs  |   181 +-
 crates/openplotva-app/src/translate.rs        |   326 +-
 crates/openplotva-app/src/vision.rs           |    59 +-
 crates/openplotva-app/src/youtube.rs          |   524 +-
 crates/openplotva-config/src/lib.rs           |    12 -
 crates/openplotva-dialog/src/lib.rs           |     3 +
 crates/openplotva-dialog/src/transcript.rs    |     1 +
 crates/openplotva-llm/src/aifarm.rs           |     4 +-
 crates/openplotva-llm/src/gemini.rs           |     4 +-
 crates/openplotva-llm/src/gradius.rs          |     6 +-
 crates/openplotva-llm/src/lib.rs              |     1 +
 crates/openplotva-llm/src/provider_schema.rs  |    13 +-
 crates/openplotva-llm/src/redaction.rs        |  1191 ++
 crates/openplotva-llm/src/router/table.rs     |   112 +
 crates/openplotva-memory/Cargo.toml           |     6 +-
 crates/openplotva-memory/src/lib.rs           |   969 +-
 crates/openplotva-prompts/src/lib.rs          |     9 +-
 crates/openplotva-server/Cargo.toml           |     1 +
 crates/openplotva-server/src/lib.rs           |   315 +-
 crates/openplotva-storage/src/app_settings.rs |    38 +
 crates/openplotva-storage/src/entities.rs     |   423 +
 crates/openplotva-storage/src/gradius_ads.rs  |    16 +-
 crates/openplotva-storage/src/lib.rs          |   200 +-
 crates/openplotva-storage/src/llm_routing.rs  |    88 +-
 .../openplotva-storage/src/redis_inspector.rs |   175 +
 crates/openplotva-storage/src/songs.rs        |   260 +
 .../src/telegram_delivery.rs                  |    15 +
 .../openplotva-storage/src/telegram_outbox.rs |   182 +-
 crates/openplotva-telegram/src/lib.rs         |     4 +-
 .../openplotva-telegram/src/update_startup.rs |    20 +-
 docs/CODEBASE_MAP.md                          |    77 +-
 .../213_prepared_song_delivery.down.sql       |     2 +
 migrations/213_prepared_song_delivery.up.sql  |     2 +
 ...4_prepared_song_delivery_identity.down.sql |     2 +
 ...214_prepared_song_delivery_identity.up.sql |     4 +
 tools/provider-smoke.sh                       |    27 +-
 99 files changed, 18114 insertions(+), 19542 deletions(-)
 create mode 100644 crates/openplotva-app/src/control_jobs/test_support.rs
 create mode 100644 crates/openplotva-app/src/http/assets.rs
 create mode 100644 crates/openplotva-app/src/http/auth.rs
 create mode 100644 crates/openplotva-app/src/http/common.rs
 create mode 100644 crates/openplotva-app/src/http/entities.rs
 create mode 100644 crates/openplotva-app/src/http/ingress.rs
 create mode 100644 crates/openplotva-app/src/http/memory.rs
 create mode 100644 crates/openplotva-app/src/http/mod.rs
 create mode 100644 crates/openplotva-app/src/http/observability.rs
 create mode 100644 crates/openplotva-app/src/http/redis.rs
 create mode 100644 crates/openplotva-app/src/http/routing.rs
 create mode 100644 crates/openplotva-app/src/http/settings.rs
 create mode 100644 crates/openplotva-app/src/http/shield.rs
 create mode 100644 crates/openplotva-app/src/http/taskman.rs
 create mode 100644 crates/openplotva-app/src/memory_workers.rs
 create mode 100644 crates/openplotva-app/src/provider_transport.rs
 create mode 100644 crates/openplotva-app/src/runtime_redis.rs
 create mode 100644 crates/openplotva-llm/src/redaction.rs
 create mode 100644 crates/openplotva-storage/src/app_settings.rs
 create mode 100644 crates/openplotva-storage/src/entities.rs
 create mode 100644 crates/openplotva-storage/src/redis_inspector.rs
 create mode 100644 crates/openplotva-storage/src/songs.rs
 create mode 100644 migrations/213_prepared_song_delivery.down.sql
 create mode 100644 migrations/213_prepared_song_delivery.up.sql
 create mode 100644 migrations/214_prepared_song_delivery_identity.down.sql
 create mode 100644 migrations/214_prepared_song_delivery_identity.up.sql

diff --git a/.env.example b/.env.example
index b863f7df..9831085a 100644
--- a/.env.example
+++ b/.env.example
@@ -300,7 +300,6 @@
 # Bootstrap/default client settings for the managed memory_extraction and
 # memory_subject_merge workflows; their model order and retry budgets are edited
 # independently in the routing admin after the first seed.
-# MEMORY_CONSOLIDATION_PROVIDER=aifarm
 # MEMORY_CONSOLIDATION_MODEL=qwen3.8-27b
 # MEMORY_CONSOLIDATION_TIMEOUT_SECONDS=600
 # Startup and each HH:02 UTC tick enqueue all missing completed chat hours
diff --git a/Cargo.lock b/Cargo.lock
index 7bf88728..a54cc5d8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2230,15 +2230,12 @@ dependencies = [
 name = "openplotva-memory"
 version = "0.1.0"
 dependencies = [
- "base64",
  "futures-util",
- "reqwest",
  "serde",
  "serde_json",
  "thiserror",
  "time",
  "tokio",
- "url",
 ]
 
 [[package]]
@@ -2299,6 +2296,7 @@ dependencies = [
  "time",
  "tokio",
  "tokio-rustls",
+ "tower",
  "tracing",
  "x509-parser",
 ]
diff --git a/crates/openplotva-app/src/asr.rs b/crates/openplotva-app/src/asr.rs
index fc34a49c..ebf9e7cd 100644
--- a/crates/openplotva-app/src/asr.rs
+++ b/crates/openplotva-app/src/asr.rs
@@ -619,41 +619,19 @@ fn routed_asr_client(
     mut config: DiscoveryAsrConfig,
     attempt: &RoutedAttempt,
 ) -> Result<DiscoveryAsrClient, AsrClientError> {
-    if let Some(endpoint) = attempt
-        .model_base_url
-        .as_deref()
-        .or(attempt.provider_endpoint.as_deref())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
+    if attempt.protocol != Some(openplotva_llm::provider_schema::Protocol::DiscoveryAsr) {
+        return Err(AsrClientError::Discovery(
+            "selected protocol does not support this Discovery adapter".to_owned(),
+        ));
+    }
+    if let Some(endpoint) = attempt.endpoint() {
         config.base_url = endpoint.to_owned();
     }
-    if let Some(service_name) = attempt
-        .discovery_service_name
-        .as_deref()
-        .or_else(|| {
-            attempt
-                .provider_config
-                .get("service_name")
-                .and_then(serde_json::Value::as_str)
-        })
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
+    let (service_name, endpoint_name) = attempt.discovery_names();
+    if let Some(service_name) = service_name {
         config.service_name = service_name.to_owned();
     }
-    if let Some(endpoint_name) = attempt
-        .discovery_endpoint_name
-        .as_deref()
-        .or_else(|| {
-            attempt
-                .provider_config
-                .get("endpoint_name")
-                .and_then(serde_json::Value::as_str)
-        })
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
+    if let Some(endpoint_name) = endpoint_name {
         config.endpoint_name = endpoint_name.to_owned();
     }
     if attempt.model_name.trim().is_empty() {
diff --git a/crates/openplotva-app/src/callbacks.rs b/crates/openplotva-app/src/callbacks.rs
index 07fada35..7c8e3ae4 100644
--- a/crates/openplotva-app/src/callbacks.rs
+++ b/crates/openplotva-app/src/callbacks.rs
@@ -3,12 +3,12 @@
 use std::{fmt, future::Future, pin::Pin, sync::Arc};
 
 use carapax::types::{
-    CallbackQuery as TelegramCallbackQuery, MaybeInaccessibleMessage, Update as TelegramUpdate,
-    UpdateType,
+    CallbackQuery as TelegramCallbackQuery, ChatMember as TelegramChatMember,
+    MaybeInaccessibleMessage, Update as TelegramUpdate, UpdateType,
 };
 use openplotva_telegram::{
-    CallbackHandlerKind, CallbackQueryRoute, TelegramOutboundMethod, callback_query_ack_method,
-    callback_query_route, settings_callback_ack_method,
+    CallbackHandlerKind, CallbackQueryRoute, TelegramOutboundMethod, build_get_chat_member_method,
+    callback_query_ack_method, callback_query_route, settings_callback_ack_method,
 };
 use thiserror::Error;
 use time::OffsetDateTime;
@@ -18,6 +18,120 @@ use crate::{
     updates::UpdateHandler,
 };
 
+/// Boxed future returned by Telegram membership APIs.
+pub type DeleteMemberFuture<'a, E> =
+    Pin<Box<dyn Future<Output = Result<TelegramChatMember, E>> + Send + 'a>>;
+
+pub trait DeleteMemberApi {
+    /// Concrete API error.
+    type Error: fmt::Display + Send + Sync + 'static;
+
+    /// Fetch one Telegram chat member.
+    fn get_chat_member<'a>(
+        &'a self,
+        chat_id: i64,
+        user_id: i64,
+    ) -> DeleteMemberFuture<'a, Self::Error>;
+}
+
+impl DeleteMemberApi for openplotva_telegram::TelegramClient {
+    type Error = carapax::api::ExecuteError;
+
+    fn get_chat_member<'a>(
+        &'a self,
+        chat_id: i64,
+        user_id: i64,
+    ) -> DeleteMemberFuture<'a, Self::Error> {
+        Box::pin(async move {
+            self.execute(build_get_chat_member_method(chat_id, user_id))
+                .await
+        })
+    }
+}
+
+/// Boxed future returned by delete callback effects.
+pub type DeleteEffectFuture<'a, E> = Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
+
+pub trait DeleteCallbackEffects {
+    /// Concrete effect error.
+    type Error: fmt::Display + Send + Sync + 'static;
+
+    /// Execute one direct Telegram Bot API method.
+    fn execute_delete_method<'a>(
+        &'a self,
+        method: TelegramOutboundMethod,
+    ) -> DeleteEffectFuture<'a, Self::Error>;
+}
+
+impl DeleteCallbackEffects for openplotva_telegram::TelegramClient {
+    type Error = carapax::api::ExecuteError;
+
+    fn execute_delete_method<'a>(
+        &'a self,
+        method: TelegramOutboundMethod,
+    ) -> DeleteEffectFuture<'a, Self::Error> {
+        Box::pin(async move { method.execute_with(self).await.map(|_| ()) })
+    }
+}
+
+#[must_use]
+pub fn telegram_member_can_delete(member: &TelegramChatMember) -> bool {
+    match member {
+        TelegramChatMember::Creator(_) => true,
+        TelegramChatMember::Administrator(admin) => admin.can_delete_messages,
+        TelegramChatMember::Kicked(_)
+        | TelegramChatMember::Left(_)
+        | TelegramChatMember::Member { .. }
+        | TelegramChatMember::Restricted(_) => false,
+    }
+}
+
+pub(crate) async fn try_execute_delete_method<Effects>(
+    effects: &Effects,
+    method: TelegramOutboundMethod,
+    context: &'static str,
+) where
+    Effects: DeleteCallbackEffects + Sync,
+{
+    let method_name = method.method_name();
+    if let Err(error) = effects.execute_delete_method(method).await {
+        tracing::warn!(
+            message = %error,
+            method = method_name,
+            context,
+            "generic delete callback Telegram side effect failed"
+        );
+    }
+}
+
+pub(crate) async fn can_delete_owned_content<MemberApi>(
+    member_api: &MemberApi,
+    query: &TelegramCallbackQuery,
+    data_user_id: i64,
+    data_chat_id: i64,
+) -> bool
+where
+    MemberApi: DeleteMemberApi + Sync,
+{
+    let requester_id = i64::from(query.from.id);
+    if requester_id == data_user_id {
+        return true;
+    }
+
+    match member_api.get_chat_member(data_chat_id, requester_id).await {
+        Ok(member) => telegram_member_can_delete(&member),
+        Err(error) => {
+            tracing::warn!(
+                message = %error,
+                chat_id = data_chat_id,
+                user_id = requester_id,
+                "failed to authorize delete callback"
+            );
+            false
+        }
+    }
+}
+
 /// Boxed future returned by callback-query side effects.
 pub type CallbackQueryFuture<'a, E> = Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
 
diff --git a/crates/openplotva-app/src/checkin.rs b/crates/openplotva-app/src/checkin.rs
index 0105d476..aad467f2 100644
--- a/crates/openplotva-app/src/checkin.rs
+++ b/crates/openplotva-app/src/checkin.rs
@@ -1,5 +1,8 @@
 //! App-level check-in callback control-job behavior.
 
+#[cfg(test)]
+use crate::control_jobs::ControlJobEnqueueFuture;
+use crate::control_jobs::ControlJobQueue;
 use std::{
     collections::{HashMap, HashSet},
     fmt,
@@ -15,8 +18,8 @@ use carapax::types::{
     User as TelegramUser,
 };
 use openplotva_taskman::{
-    CONTROL_QUEUE_NAME, ControlJobData, ControlJobParams, ControlKind, HIGH_PRIORITY, JobType,
-    StatelessJobItem, control_job_params_from_stateless_job, new_control_job_at,
+    CONTROL_QUEUE_NAME, ControlJobData, ControlJobParams, ControlKind, HIGH_PRIORITY,
+    StatelessJobItem, new_control_job_at,
 };
 use openplotva_telegram::{
     ChatRef, DispatcherConfig, DispatcherQueue, InlineKeyboardMarkup, OUTBOUND_SEND_MAX_ATTEMPTS,
@@ -55,16 +58,14 @@ const CHECKIN_EPHEMERAL_TIMEOUT: Duration = Duration::from_secs(30);
 const NEW_CHAT_WARMUP_WINDOW: time::Duration = time::Duration::hours(24);
 const CHECKIN_DIRECT_RETRY_AFTER_INLINE_CAP_SECS: u64 = 15;
 
-/// Boxed future returned by check-in control-job queue calls.
-pub type CheckinControlJobQueueFuture<'a, E> =
-    Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
-
-/// Boxed future returned by check-in control-job worker queue calls.
-pub type CheckinControlJobWorkerFuture<'a, T, E> =
-    Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>;
-
 /// Boxed future returned by check-in control-job effects.
-pub type CheckinControlJobFuture<'a, E> = Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
+pub type CheckinControlJobFuture<'a, E> = Pin<
+    Box<
+        dyn Future<Output = Result<Option<crate::telegram_outbox::QueuedBatchReceipt>, E>>
+            + Send
+            + 'a,
+    >,
+>;
 
 /// Boxed future returned by check-in game storage calls.
 pub type CheckinGameStoreFuture<'a, T, E> = Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>;
@@ -87,17 +88,6 @@ pub type CheckinThemeEffectFuture<'a, E> = Pin<Box<dyn Future<Output = Result<()
 pub type CheckinCallbackMethodFuture<'a, E> =
     Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
 
-pub trait CheckinControlJobQueue {
-    /// Error returned by the concrete queue implementation.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    fn assign_checkin_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-    ) -> CheckinControlJobQueueFuture<'a, Self::Error>;
-}
-
 pub trait CheckinCommandPermission {
     /// Error returned by the concrete permission policy.
     type Error: fmt::Display + Send + Sync + 'static;
@@ -136,92 +126,13 @@ where
     }
 }
 
-impl<T> CheckinControlJobQueue for T
-where
-    T: crate::payments::PaymentControlJobQueue + Sync,
-{
-    type Error = T::Error;
-
-    fn assign_checkin_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-    ) -> CheckinControlJobQueueFuture<'a, Self::Error> {
-        self.assign_payment_control_job(queue_name, job)
-    }
-}
-
-/// Queue/status boundary for check-in taskman control-job workers.
-pub trait CheckinControlJobWorkerQueue {
-    /// Queue error type.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    fn dequeue_checkin_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-    ) -> CheckinControlJobWorkerFuture<
-        'a,
-        Option<crate::payments::PaymentControlJobWorkItem>,
-        Self::Error,
-    >;
-
-    /// Mark one check-in control job completed.
-    fn complete_checkin_control_job<'a>(
-        &'a self,
-        job_id: i64,
-    ) -> CheckinControlJobWorkerFuture<'a, (), Self::Error>;
-
-    /// Mark one check-in control job failed.
-    fn fail_checkin_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> CheckinControlJobWorkerFuture<'a, (), Self::Error>;
-}
-
-impl<T> CheckinControlJobWorkerQueue for T
-where
-    T: crate::payments::SharedControlJobWorkerQueue + Sync,
-{
-    type Error = T::Error;
-
-    fn dequeue_checkin_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-    ) -> CheckinControlJobWorkerFuture<
-        'a,
-        Option<crate::payments::PaymentControlJobWorkItem>,
-        Self::Error,
-    > {
-        self.dequeue_shared_control_job_matching(
-            queue_name,
-            "checkin-control",
-            is_checkin_control_job,
-        )
-    }
-
-    fn complete_checkin_control_job<'a>(
-        &'a self,
-        job_id: i64,
-    ) -> CheckinControlJobWorkerFuture<'a, (), Self::Error> {
-        self.complete_shared_control_job(job_id)
-    }
-
-    fn fail_checkin_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> CheckinControlJobWorkerFuture<'a, (), Self::Error> {
-        self.fail_shared_control_job(job_id, error)
-    }
-}
-
 pub trait CheckinControlJobEffects {
     /// Error returned by the concrete game runner.
     type Error: fmt::Display + Send + Sync + 'static;
 
     fn run_checkin_game<'a>(
         &'a self,
+        job_id: i64,
         params: &'a ControlJobParams,
     ) -> CheckinControlJobFuture<'a, Self::Error>;
 }
@@ -318,6 +229,7 @@ pub struct CheckinGameMessage {
 
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct CheckinGameRunRequest {
+    pub job_id: i64,
     /// Reconstructed control-job message context.
     pub message: CheckinGameMessage,
     /// Telegram chat type string.
@@ -343,6 +255,19 @@ pub trait CheckinGameSender {
     /// Error returned by the concrete sender.
     type Error: fmt::Display + Send + Sync + 'static;
 
+    fn queued_checkin<'a>(
+        &'a self,
+        job_id: i64,
+    ) -> CheckinGameSendFuture<'a, Option<crate::telegram_outbox::QueuedBatchReceipt>, Self::Error>;
+
+    fn finish_checkin_html<'a>(
+        &'a self,
+        job_id: i64,
+        reply_to: CheckinGameMessage,
+        target_message_id: Option<i32>,
+        html: String,
+    ) -> CheckinGameSendFuture<'a, crate::telegram_outbox::QueuedBatchReceipt, Self::Error>;
+
     /// Send one immediate HTML reply. Returns Telegram message ID when available.
     fn send_checkin_html<'a>(
         &'a self,
@@ -517,31 +442,6 @@ impl CheckinGameStore for PostgresCheckinGameStore {
     }
 }
 
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub enum CheckinGameRunOutcome {
-    /// Private chat or text-send permission blocked the game before side effects.
-    SkippedByChatPolicy,
-    /// Game disabled in chat settings.
-    Disabled,
-    /// Existing daily winner was reported.
-    ExistingWinner,
-    /// Not enough valid participants.
-    NotEnoughParticipants {
-        /// Valid participant count.
-        count: usize,
-    },
-    /// New winner recorded, stats increment attempted, and winner message sent.
-    WinnerRecorded {
-        /// Winner user ID.
-        user_id: i64,
-        /// Theme key used for storage/output.
-        theme: String,
-    },
-    /// Insert raced with another worker; existing winner was reported when visible.
-    RecordRaceExistingWinner,
-    RecordFailedNoWinner,
-}
-
 /// Recoverable check-in game runner errors.
 #[derive(Clone, Debug, Eq, Error, PartialEq)]
 pub enum CheckinGameRunError {
@@ -570,6 +470,7 @@ pub struct CheckinGameRuntimeEffects<Store, Sender> {
 
 #[derive(Clone)]
 pub struct TelegramCheckinGameSender {
+    delivery: Arc<crate::rich::RichOutbox>,
     ephemeral_store: openplotva_storage::RedisEphemeralMessageStore,
     telegram: openplotva_telegram::TelegramClient,
     rich: openplotva_telegram::RichApiClient,
@@ -583,8 +484,10 @@ impl TelegramCheckinGameSender {
         ephemeral_store: openplotva_storage::RedisEphemeralMessageStore,
         telegram: openplotva_telegram::TelegramClient,
         rich: openplotva_telegram::RichApiClient,
+        delivery: Arc<crate::rich::RichOutbox>,
     ) -> Self {
         Self {
+            delivery,
             ephemeral_store,
             telegram,
             rich,
@@ -603,6 +506,59 @@ impl TelegramCheckinGameSender {
 impl CheckinGameSender for TelegramCheckinGameSender {
     type Error = CheckinGameSenderError;
 
+    fn queued_checkin<'a>(
+        &'a self,
+        job_id: i64,
+    ) -> CheckinGameSendFuture<'a, Option<crate::telegram_outbox::QueuedBatchReceipt>, Self::Error>
+    {
+        Box::pin(async move {
+            self.delivery
+                .queued(&checkin_delivery_source(job_id), Some(job_id))
+                .await
+                .map_err(|error| CheckinGameSenderError::Telegram(error.to_string()))
+        })
+    }
+
+    fn finish_checkin_html<'a>(
+        &'a self,
+        job_id: i64,
+        reply_to: CheckinGameMessage,
+        target_message_id: Option<i32>,
+        html: String,
+    ) -> CheckinGameSendFuture<'a, crate::telegram_outbox::QueuedBatchReceipt, Self::Error> {
+        Box::pin(async move {
+            let method = match target_message_id {
+                Some(message_id) => {
+                    TelegramOutboundMethod::from(openplotva_telegram::EditRichMessage {
+                        chat_id: reply_to.chat_id,
+                        message_id: i64::from(message_id),
+                        html,
+                        reply_markup: None,
+                    })
+                }
+                None => TelegramOutboundMethod::from(openplotva_telegram::SendRichMessage {
+                    chat_id: reply_to.chat_id,
+                    html,
+                    options: openplotva_telegram::RichSendOptions {
+                        message_thread_id: reply_to.thread_id.map(i64::from),
+                        reply_to_message_id: Some(i64::from(reply_to.message_id)),
+                        allow_sending_without_reply: true,
+                        ..Default::default()
+                    },
+                }),
+            };
+            self.delivery
+                .enqueue(
+                    &checkin_delivery_source(job_id),
+                    reply_to.thread_id.map(i64::from),
+                    method,
+                    Some(job_id),
+                )
+                .await
+                .map_err(|error| CheckinGameSenderError::Telegram(error.to_string()))
+        })
+    }
+
     fn send_checkin_html<'a>(
         &'a self,
         reply_to: CheckinGameMessage,
@@ -673,19 +629,19 @@ pub enum CheckinGameSenderError {
 }
 
 #[derive(Clone)]
-pub struct CheckinCommandDispatcherEffects {
+pub struct CheckinCommandDelivery {
     queue: Arc<DispatcherQueue>,
-    rich: Arc<dyn crate::rich::RichSender>,
+    delivery: Arc<crate::rich::RichOutbox>,
     next_virtual_id: VirtualIdFactory,
 }
 
-impl CheckinCommandDispatcherEffects {
+impl CheckinCommandDelivery {
     /// Build check-in command effects over an existing dispatcher queue.
     #[must_use]
-    pub fn new(queue: Arc<DispatcherQueue>, rich: Arc<dyn crate::rich::RichSender>) -> Self {
+    pub fn new(queue: Arc<DispatcherQueue>, delivery: Arc<crate::rich::RichOutbox>) -> Self {
         Self {
             queue,
-            rich,
+            delivery,
             next_virtual_id: monotonic_virtual_id_factory("checkin-command-vmsg"),
         }
     }
@@ -707,7 +663,7 @@ pub enum CheckinCommandEffectError {
     RichSend(String),
 }
 
-impl CheckinCommandEffects for CheckinCommandDispatcherEffects {
+impl CheckinCommandEffects for CheckinCommandDelivery {
     type Error = CheckinCommandEffectError;
 
     fn send_checkin_today_winner_with_stats<'a>(
@@ -724,8 +680,20 @@ impl CheckinCommandEffects for CheckinCommandDispatcherEffects {
                 disable_notification: false,
                 reply_markup: None,
             };
-            self.rich
-                .send_rich(reply_to.chat_id, &html, &options)
+            self.delivery
+                .enqueue(
+                    &format!(
+                        "checkin-command:{}:{}",
+                        reply_to.chat_id, reply_to.message_id
+                    ),
+                    options.message_thread_id,
+                    openplotva_telegram::SendRichMessage {
+                        chat_id: reply_to.chat_id,
+                        html,
+                        options,
+                    },
+                    None,
+                )
                 .await
                 .map_err(|error| CheckinCommandEffectError::RichSend(error.to_string()))?;
             Ok(())
@@ -1018,9 +986,18 @@ where
 
     fn run_checkin_game<'a>(
         &'a self,
+        job_id: i64,
         params: &'a ControlJobParams,
     ) -> CheckinControlJobFuture<'a, Self::Error> {
         Box::pin(async move {
+            if let Some(receipt) = self
+                .sender
+                .queued_checkin(job_id)
+                .await
+                .map_err(sender_error)?
+            {
+                return Ok(Some(receipt));
+            }
             let message = CheckinGameMessage {
                 chat_id: params.chat_id,
                 message_id: params.message_id,
@@ -1041,6 +1018,7 @@ where
                 &self.store,
                 &self.sender,
                 CheckinGameRunRequest {
+                    job_id,
                     message,
                     chat_type: params.data.chat_type.clone(),
                     theme_override: params.data.theme.clone(),
@@ -1060,17 +1038,17 @@ where
                     }),
             )
             .await
-            .map(|_| ())
         })
     }
 }
 
-pub async fn run_checkin_game_at<Store, Sender, Pick>(
+#[cfg(test)]
+async fn run_checkin_game_at<Store, Sender, Pick>(
     store: &Store,
     sender: &Sender,
     request: CheckinGameRunRequest,
     pick_index: Pick,
-) -> Result<CheckinGameRunOutcome, CheckinGameRunError>
+) -> Result<Option<crate::telegram_outbox::QueuedBatchReceipt>, CheckinGameRunError>
 where
     Store: CheckinGameStore + Sync,
     Sender: CheckinGameSender + Sync,
@@ -1093,14 +1071,14 @@ async fn run_checkin_game_inner<Store, Sender, Pick>(
     pick_index: &Pick,
     sleep_between_steps: bool,
     utility_ads: Option<CheckinUtilityAds<'_>>,
-) -> Result<CheckinGameRunOutcome, CheckinGameRunError>
+) -> Result<Option<crate::telegram_outbox::QueuedBatchReceipt>, CheckinGameRunError>
 where
     Store: CheckinGameStore + Sync,
     Sender: CheckinGameSender + Sync,
     Pick: Fn(usize) -> usize + Sync + ?Sized,
 {
     if request.chat_type.eq_ignore_ascii_case("private") || !request.can_send_text {
-        return Ok(CheckinGameRunOutcome::SkippedByChatPolicy);
+        return Ok(None);
     }
 
     let message = request.message;
@@ -1117,12 +1095,13 @@ where
             )
             .await
             .map_err(sender_error)?;
-        return Ok(CheckinGameRunOutcome::Disabled);
+        return Ok(None);
     }
 
     if let Some(winner) = load_today_winner(store, message.chat_id).await {
-        send_today_winner_message(store, sender, message, &winner).await;
-        return Ok(CheckinGameRunOutcome::ExistingWinner);
+        let receipt =
+            send_today_winner_message(store, sender, request.job_id, message, &winner).await?;
+        return Ok(Some(receipt));
     }
 
     let theme = resolve_checkin_theme(&settings, &request.theme_override);
@@ -1139,9 +1118,7 @@ where
             )
             .await
             .map_err(sender_error)?;
-        return Ok(CheckinGameRunOutcome::NotEnoughParticipants {
-            count: participants.len(),
-        });
+        return Ok(None);
     }
 
     let picked = pick_index(participants.len()).min(participants.len() - 1);
@@ -1157,7 +1134,7 @@ where
             {
                 tracing::warn!(message = %error, chat_id = message.chat_id, winner_id, "failed to increment check-in game stats");
             }
-            run_checkin_animation(
+            let receipt = run_checkin_animation(
                 store,
                 sender,
                 message,
@@ -1166,21 +1143,20 @@ where
                 pick_index,
                 sleep_between_steps,
                 utility_ads,
-                request.now,
+                request.job_id,
             )
             .await?;
-            Ok(CheckinGameRunOutcome::WinnerRecorded {
-                user_id: winner_id,
-                theme: theme.key.to_owned(),
-            })
+            Ok(Some(receipt))
         }
         Err(error) => {
             tracing::warn!(message = %error, chat_id = message.chat_id, winner_id, "failed to record check-in daily winner");
             if let Some(existing) = load_today_winner(store, message.chat_id).await {
-                send_today_winner_message(store, sender, message, &existing).await;
-                Ok(CheckinGameRunOutcome::RecordRaceExistingWinner)
+                let receipt =
+                    send_today_winner_message(store, sender, request.job_id, message, &existing)
+                        .await?;
+                Ok(Some(receipt))
             } else {
-                Ok(CheckinGameRunOutcome::RecordFailedNoWinner)
+                Ok(None)
             }
         }
     }
@@ -1333,6 +1309,10 @@ fn daily_game_disabled(settings: &openplotva_core::ChatSettings) -> bool {
     settings.enable_daily_game == Some(false)
 }
 
+pub(crate) fn checkin_delivery_source(job_id: i64) -> String {
+    format!("checkin-final:job:{job_id}")
+}
+
 #[allow(clippy::too_many_arguments)]
 async fn run_checkin_animation<Store, Sender, Pick>(
     store: &Store,
@@ -1343,8 +1323,8 @@ async fn run_checkin_animation<Store, Sender, Pick>(
     pick_index: &Pick,
     sleep_between_steps: bool,
     utility_ads: Option<CheckinUtilityAds<'_>>,
-    game_at: OffsetDateTime,
-) -> Result<(), CheckinGameRunError>
+    job_id: i64,
+) -> Result<crate::telegram_outbox::QueuedBatchReceipt, CheckinGameRunError>
 where
     Store: CheckinGameStore + Sync,
     Sender: CheckinGameSender + Sync,
@@ -1362,7 +1342,8 @@ where
         .ok()
         .flatten()
     else {
-        return Ok(());
+        let linked_name = winner_link(store, winner_id).await;
+        return sender.finish_checkin_html(job_id, message, None, theme.winner_text(&linked_name)).await.map_err(sender_error);
     };
     for step in progress.iter().skip(1) {
         if sleep_between_steps {
@@ -1386,17 +1367,7 @@ where
     text.push_str("\n\n");
     text.push_str(&theme.winner_text(&linked_name));
     if let Some(utility) = utility_ads {
-        if let Err(_error) = sender
-            .edit_checkin_html(message, message_id, text.clone())
-            .await
-        {
-            tracing::warn!(
-                chat_id = message.chat_id,
-                message_id,
-                "failed to edit check-in winner message before optional ad"
-            );
-        }
-        let source_id = format!("{}:{}", message.chat_id, game_at.date());
+        let source_id = format!("job:{job_id}");
         let result_context = openplotva_telegram::strip_telegram_html(&text);
         let prepared = utility
             .ads
@@ -1404,10 +1375,7 @@ where
                 surface: crate::gradius_ads::GradiusUtilitySurface::Checkin,
                 include_vip_appendix: false,
                 source_id: source_id.clone(),
-                attempt_key: format!(
-                    "checkin-final:{source_id}:{}",
-                    OffsetDateTime::now_utc().unix_timestamp_nanos()
-                ),
+                attempt_key: checkin_delivery_source(job_id),
                 user_id: utility.initiator_id,
                 chat_id: message.chat_id,
                 thread_id: message.thread_id,
@@ -1430,10 +1398,19 @@ where
                         message.thread_id,
                         i64::from(message_id),
                         html,
+                        job_id,
                     )
                     .await
                 {
-                    Ok(_) => return Ok(()),
+                    Ok(_) => {
+                        return sender
+                            .queued_checkin(job_id)
+                            .await
+                            .map_err(sender_error)?
+                            .ok_or_else(|| CheckinGameRunError::Sender {
+                                message: "check-in final batch was not persisted".into(),
+                            });
+                    }
                     Err(_error) => {
                         tracing::warn!(
                             opportunity_id = ad.opportunity_id,
@@ -1453,17 +1430,11 @@ where
                 )
             }
         }
-        return Ok(());
     }
-    if let Err(error) = sender.edit_checkin_html(message, message_id, text).await {
-        tracing::warn!(
-            message = %error,
-            chat_id = message.chat_id,
-            message_id,
-            "failed to edit check-in winner message"
-        );
-    }
-    Ok(())
+    sender
+        .finish_checkin_html(job_id, message, Some(message_id), text)
+        .await
+        .map_err(sender_error)
 }
 
 fn checkin_progress_lines<Pick>(theme: CheckinGameTheme, pick_index: &Pick) -> Vec<String>
@@ -1492,9 +1463,11 @@ where
 async fn send_today_winner_message<Store, Sender>(
     store: &Store,
     sender: &Sender,
+    job_id: i64,
     message: CheckinGameMessage,
     winner: &openplotva_storage::ChatGameResult,
-) where
+) -> Result<crate::telegram_outbox::QueuedBatchReceipt, CheckinGameRunError>
+where
     Store: CheckinGameStore + Sync,
     Sender: CheckinGameSender + Sync,
 {
@@ -1505,9 +1478,10 @@ async fn send_today_winner_message<Store, Sender>(
         theme.name,
         theme.winner_text(&linked_name)
     );
-    if let Err(error) = sender.send_checkin_html(message, text).await {
-        tracing::warn!(message = %error, chat_id = message.chat_id, "failed to send today's check-in winner");
-    }
+    sender
+        .finish_checkin_html(job_id, message, None, text)
+        .await
+        .map_err(sender_error)
 }
 
 async fn today_winner_with_stats_html<Store>(
@@ -2220,12 +2194,6 @@ pub enum CheckinThemeCallbackOutcome {
     QueueError,
 }
 
-/// Result of one check-in control-job execution.
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub enum CheckinControlJobOutcome {
-    Completed,
-}
-
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub enum CheckinCommandOutcome {
     /// Update did not belong to this slice and was delegated.
@@ -2243,28 +2211,6 @@ pub enum CheckinCommandOutcome {
     MissingMessage,
 }
 
-/// Result of one check-in taskman worker tick.
-#[derive(Clone, Debug, Default, Eq, PartialEq)]
-pub struct CheckinControlJobWorkerReport {
-    /// Whether a job was dequeued.
-    pub dequeued: bool,
-    /// Dequeued taskman job ID.
-    pub job_id: Option<i64>,
-    /// Check-in executor result, when payload decoding succeeded.
-    pub execution: Option<CheckinControlJobOutcome>,
-    /// The job was finalized as completed.
-    pub completed: bool,
-    /// The job was finalized as failed.
-    pub failed: bool,
-    /// Queue dequeue failed.
-    pub dequeue_error: Option<String>,
-    pub decode_error: Option<String>,
-    /// Game runner failed.
-    pub execution_error: Option<String>,
-    /// Completion/failure status write failed.
-    pub status_error: Option<String>,
-}
-
 /// Fatal errors from the check-in callback wrapper.
 #[derive(Clone, Debug, Eq, Error, PartialEq)]
 pub enum CheckinThemeCallbackError {
@@ -2303,7 +2249,7 @@ impl<Queue, Effects, Next> CheckinThemeCallbackUpdateHandler<Queue, Effects, Nex
 
 impl<Queue, Effects, Next> UpdateHandler for CheckinThemeCallbackUpdateHandler<Queue, Effects, Next>
 where
-    Queue: CheckinControlJobQueue + Send + Sync,
+    Queue: ControlJobQueue + Send + Sync,
     Effects: CheckinThemeEffects + Send + Sync,
     Next: UpdateHandler + Send + Sync,
 {
@@ -2359,7 +2305,7 @@ impl<Queue, Store, Permission, Effects, Next>
 impl<Queue, Store, Permission, Effects, Next> UpdateHandler
     for CheckinCommandUpdateHandler<Queue, Store, Permission, Effects, Next>
 where
-    Queue: CheckinControlJobQueue + Send + Sync,
+    Queue: ControlJobQueue + Send + Sync,
     Store: CheckinGameStore + Send + Sync,
     Permission: CheckinCommandPermission + Send + Sync,
     Effects: CheckinCommandEffects + Send + Sync,
@@ -2417,7 +2363,7 @@ pub async fn handle_checkin_theme_callback_update_or_else_at<
     handle_other: HandleFn,
 ) -> Result<CheckinThemeCallbackOutcome, CheckinThemeCallbackError>
 where
-    Queue: CheckinControlJobQueue + Sync,
+    Queue: ControlJobQueue + Sync,
     Effects: CheckinThemeEffects + Sync,
     HandleFn: FnOnce(TelegramUpdate) -> HandleFuture,
     HandleFuture: Future<Output = Result<(), HandleError>>,
@@ -2452,7 +2398,7 @@ pub async fn handle_checkin_theme_callback_at<Queue, Effects>(
     created: OffsetDateTime,
 ) -> CheckinThemeCallbackOutcome
 where
-    Queue: CheckinControlJobQueue + Sync,
+    Queue: ControlJobQueue + Sync,
     Effects: CheckinThemeEffects + Sync,
 {
     let (ack, blocked) = openplotva_telegram::checkin_theme_selection_ack_method(
@@ -2472,10 +2418,7 @@ where
         return CheckinThemeCallbackOutcome::MissingMessage;
     };
 
-    if let Err(error) = queue
-        .assign_checkin_control_job(CONTROL_QUEUE_NAME, job)
-        .await
-    {
+    if let Err(error) = queue.assign_control_job(CONTROL_QUEUE_NAME, job).await {
         tracing::warn!(message = %error, "failed to assign check-in control job");
         try_send_checkin_queue_error_notice(effects, message).await;
         return CheckinThemeCallbackOutcome::QueueError;
@@ -2558,7 +2501,7 @@ pub async fn handle_checkin_command_update_or_else_at<
     handle_other: HandleFn,
 ) -> Result<CheckinCommandOutcome, CheckinThemeCallbackError>
 where
-    Queue: CheckinControlJobQueue + Sync,
+    Queue: ControlJobQueue + Sync,
     Store: CheckinGameStore + Sync,
     Effects: CheckinCommandEffects + Sync,
     HandleFn: FnOnce(TelegramUpdate) -> HandleFuture,
@@ -2603,7 +2546,7 @@ pub async fn handle_checkin_command_message_at<Queue, Store, Effects>(
     created: OffsetDateTime,
 ) -> CheckinCommandOutcome
 where
-    Queue: CheckinControlJobQueue + Sync,
+    Queue: ControlJobQueue + Sync,
     Store: CheckinGameStore + Sync,
     Effects: CheckinCommandEffects + Sync,
 {
@@ -2644,10 +2587,7 @@ where
     let Some(job) = checkin_control_job_from_message_at(message, "", created) else {
         return CheckinCommandOutcome::MissingMessage;
     };
-    if let Err(error) = queue
-        .assign_checkin_control_job(CONTROL_QUEUE_NAME, job)
-        .await
-    {
+    if let Err(error) = queue.assign_control_job(CONTROL_QUEUE_NAME, job).await {
         tracing::warn!(message = %error, chat_id = reply_to.chat_id, "failed to assign /checkin control job");
         try_send_checkin_command_queue_error(effects, reply_to).await;
         return CheckinCommandOutcome::QueueError;
@@ -2656,89 +2596,6 @@ where
     CheckinCommandOutcome::ControlJobQueued
 }
 
-/// Process one check-in control job, if available.
-pub async fn process_checkin_control_job_once_at<Queue, Effects>(
-    queue: &Queue,
-    effects: &Effects,
-) -> CheckinControlJobWorkerReport
-where
-    Queue: CheckinControlJobWorkerQueue + Sync,
-    Effects: CheckinControlJobEffects + Sync,
-{
-    let mut report = CheckinControlJobWorkerReport::default();
-    let item = match queue.dequeue_checkin_control_job(CONTROL_QUEUE_NAME).await {
-        Ok(item) => item,
-        Err(error) => {
-            report.dequeue_error = Some(error.to_string());
-            return report;
-        }
-    };
-
-    let Some(item) = item else {
-        return report;
-    };
-    report.dequeued = true;
-    report.job_id = Some(item.id);
-
-    let params = match control_job_params_from_stateless_job(&item.job) {
-        Ok(params) => params,
-        Err(error) => {
-            let error = error.to_string();
-            report.decode_error = Some(error.clone());
-            mark_checkin_control_job_failed(queue, item.id, &error, &mut report).await;
-            return report;
-        }
-    };
-
-    if params.data.kind != ControlKind::Checkin {
-        let error = format!(
-            "unsupported check-in control job kind: {:?}",
-            params.data.kind
-        );
-        report.execution_error = Some(error.clone());
-        mark_checkin_control_job_failed(queue, item.id, &error, &mut report).await;
-        return report;
-    }
-
-    match effects.run_checkin_game(&params).await {
-        Ok(()) => match queue.complete_checkin_control_job(item.id).await {
-            Ok(()) => {
-                report.completed = true;
-                report.execution = Some(CheckinControlJobOutcome::Completed);
-            }
-            Err(error) => report.status_error = Some(error.to_string()),
-        },
-        Err(error) => {
-            let error = error.to_string();
-            report.execution_error = Some(error.clone());
-            mark_checkin_control_job_failed(queue, item.id, &error, &mut report).await;
-        }
-    }
-    report
-}
-
-async fn mark_checkin_control_job_failed<Queue>(
-    queue: &Queue,
-    job_id: i64,
-    error: &str,
-    report: &mut CheckinControlJobWorkerReport,
-) where
-    Queue: CheckinControlJobWorkerQueue + Sync,
-{
-    match queue.fail_checkin_control_job(job_id, error).await {
-        Ok(()) => report.failed = true,
-        Err(error) => report.status_error = Some(error.to_string()),
-    }
-}
-
-fn is_checkin_control_job(job: &StatelessJobItem) -> bool {
-    job.data.job_type == JobType::Control
-        && matches!(
-            job.data.control_data.as_ref().map(|data| data.kind),
-            Some(ControlKind::Checkin)
-        )
-}
-
 fn checkin_theme_callback_data(
     query: &TelegramCallbackQuery,
 ) -> Option<openplotva_telegram::CallbackActionData> {
@@ -2905,12 +2762,11 @@ mod tests {
         CallbackQueryEffects, CallbackQueryFuture, CallbackQueryUpdateRoute,
         CallbackRateLimitFuture, CallbackRateLimitPolicy, handle_callback_query_update_or_else,
     };
-    use crate::payments::{InMemoryPaymentControlJobQueue, InMemoryPaymentControlJobStatus};
     use crate::updates::{
         TelegramFileMetadataStoreFuture, UpdateHandler, UpdateStateStore, UpdateStateStoreFuture,
         process_update_with_state_store_at,
     };
-    use openplotva_taskman::{JobPayload, JobType};
+    use openplotva_taskman::{JobPayload, JobType, control_job_params_from_stateless_job};
     use openplotva_telegram::{
         CallbackHandlerKind, DispatcherConfig, DispatcherQueue, TelegramOutboundMethodKind,
     };
@@ -2923,6 +2779,65 @@ mod tests {
         time::{Duration, SystemTime, UNIX_EPOCH},
     };
 
+    #[tokio::test]
+    async fn live_checkin_stats_replay_reuses_the_prepared_rich_message()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let Ok(dsn) = std::env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
+            return Ok(());
+        };
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(2)
+            .connect(&dsn)
+            .await?;
+        openplotva_storage::run_migrations_on(&pool).await?;
+        let bot_id = OffsetDateTime::now_utc().unix_timestamp_nanos() as i64;
+        let effects = CheckinCommandDelivery::new(
+            Arc::new(DispatcherQueue::new(Default::default())),
+            Arc::new(crate::rich::RichOutbox::new(
+                openplotva_storage::PostgresTelegramOutboxStore::new(pool.clone()),
+                bot_id,
+            )),
+        );
+        let reply = CheckinGameMessage {
+            chat_id: -10042,
+            message_id: 77,
+            thread_id: Some(9),
+        };
+        effects
+            .send_checkin_today_winner_with_stats(reply, "<h2>Winner</h2><p>Ada</p>".into())
+            .await?;
+        effects
+            .send_checkin_today_winner_with_stats(reply, "changed stats on replay".into())
+            .await?;
+        let rows: Vec<(String, serde_json::Value)> =
+            sqlx::query_as("SELECT state, payload FROM telegram_outbox WHERE bot_id = $1")
+                .bind(bot_id)
+                .fetch_all(&pool)
+                .await?;
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0].0, "pending");
+        assert_eq!(rows[0].1["chat_id"], -10042);
+        assert_eq!(rows[0].1["options"]["message_thread_id"], 9);
+        assert_eq!(rows[0].1["options"]["reply_to_message_id"], 77);
+        assert!(
+            rows[0].1["html"]
+                .as_str()
+                .expect("rich HTML")
+                .contains("Ada")
+        );
+        assert!(
+            !rows[0].1["html"]
+                .as_str()
+                .expect("rich HTML")
+                .contains("changed stats")
+        );
+        sqlx::query("DELETE FROM telegram_outbox WHERE bot_id = $1")
+            .bind(bot_id)
+            .execute(&pool)
+            .await?;
+        Ok(())
+    }
+
     #[tokio::test]
     async fn checkin_theme_callback_acks_and_queues_go_control_job()
     -> Result<(), Box<dyn std::error::Error>> {
@@ -3380,34 +3295,51 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn checkin_control_worker_skips_other_jobs_and_runs_checkin_game()
+    async fn postgres_checkin_final_edit_is_durable_and_reuses_its_payload()
     -> Result<(), Box<dyn std::error::Error>> {
-        let queue = InMemoryPaymentControlJobQueue::new();
-        let effects = CheckinControlEffectsStub::default();
-        let translate_job = checkin_test_control_job(ControlKind::Translate, "translate", "");
-        let checkin_job = checkin_test_control_job(ControlKind::Checkin, "checkin", "classic");
-        queue
-            .assign_checkin_control_job(CONTROL_QUEUE_NAME, translate_job)
-            .await?;
-        queue
-            .assign_checkin_control_job(CONTROL_QUEUE_NAME, checkin_job.clone())
+        let Ok(dsn) = std::env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
+            return Ok(());
+        };
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(4)
+            .connect(&dsn)
             .await?;
-
-        let report = process_checkin_control_job_once_at(&queue, &effects).await;
-
-        assert!(report.dequeued);
-        assert_eq!(report.job_id, Some(2));
-        assert_eq!(report.execution, Some(CheckinControlJobOutcome::Completed));
-        assert!(report.completed);
-        assert!(!report.failed);
-        assert_eq!(effects.runs(), vec![(-10042, 777000, "classic".to_owned())]);
-        let snapshot = queue.snapshot();
-        assert_eq!(snapshot[0].status, InMemoryPaymentControlJobStatus::Pending);
-        assert_eq!(
-            snapshot[1].status,
-            InMemoryPaymentControlJobStatus::Completed
+        openplotva_storage::run_migrations_on(&pool).await?;
+        let delivery = Arc::new(crate::rich::RichOutbox::new(
+            openplotva_storage::PostgresTelegramOutboxStore::new(pool.clone()),
+            7,
+        ));
+        let sender = TelegramCheckinGameSender::new(
+            openplotva_storage::RedisEphemeralMessageStore::new(redis::Client::open(
+                "redis://127.0.0.1:1/",
+            )?),
+            openplotva_telegram::telegram_client_with_base_url("123:test", "http://127.0.0.1:1")?,
+            openplotva_telegram::RichApiClient::with_base_url("123:test", "http://127.0.0.1:1")?,
+            delivery,
         );
-        assert_eq!(snapshot[1].job, checkin_job);
+        let job_id = OffsetDateTime::now_utc().unix_timestamp_nanos() as i64;
+        let message = game_message();
+        assert!(sender.queued_checkin(job_id).await?.is_none());
+        let first = sender
+            .finish_checkin_html(job_id, message, Some(9001), "<h2>Winner</h2>".into())
+            .await?;
+        assert!(!first.delivery_complete());
+        let replay = sender
+            .finish_checkin_html(job_id, message, Some(9001), "<h2>Changed</h2>".into())
+            .await?;
+        assert_eq!(first, replay);
+        let saved: (serde_json::Value, String, String, Option<i64>) = sqlx::query_as(
+            "SELECT payload, delivery_policy, ordering_key, dialog_job_id FROM telegram_outbox WHERE batch_id = $1"
+        ).bind(&first.batch_id).fetch_one(&pool).await?;
+        assert_eq!(saved.0["message_id"], 9001);
+        assert_eq!(saved.0["html"], "<h2>Winner</h2>");
+        assert_eq!(saved.1, "target_idempotent");
+        assert_eq!(saved.2, "dialog:7:-10042:77");
+        assert_eq!(saved.3, Some(job_id));
+        sqlx::query("DELETE FROM telegram_outbox WHERE batch_id = $1")
+            .bind(&first.batch_id)
+            .execute(&pool)
+            .await?;
         Ok(())
     }
 
@@ -3432,13 +3364,7 @@ mod tests {
             run_checkin_game_at(&store, &sender, game_request("supergroup", "kotik"), |_| 1)
                 .await?;
 
-        assert_eq!(
-            outcome,
-            CheckinGameRunOutcome::WinnerRecorded {
-                user_id: 102,
-                theme: "kotik".to_owned(),
-            }
-        );
+        assert!(outcome.is_some());
         assert_eq!(store.recorded(), vec![(-10042, 102, "kotik".to_owned())]);
         assert_eq!(store.incremented(), vec![(-10042, 102)]);
         assert_eq!(sender.ephemeral(), Vec::<String>::new());
@@ -3506,7 +3432,7 @@ mod tests {
         let outcome =
             run_checkin_game_at(&store, &sender, game_request("group", ""), |_| 0).await?;
 
-        assert_eq!(outcome, CheckinGameRunOutcome::ExistingWinner);
+        assert!(outcome.is_some());
         assert!(store.recorded().is_empty());
         assert_eq!(sender.edits(), Vec::<String>::new());
         assert_eq!(sender.ephemeral(), Vec::<String>::new());
@@ -3581,7 +3507,7 @@ mod tests {
         let outcome =
             run_checkin_game_at(&store, &sender, game_request("supergroup", ""), |_| 0).await?;
 
-        assert_eq!(outcome, CheckinGameRunOutcome::Disabled);
+        assert!(outcome.is_none());
         assert_eq!(
             sender.ephemeral(),
             vec!["🚫 Игра выключена в настройках".to_owned()]
@@ -3943,30 +3869,6 @@ mod tests {
         })
     }
 
-    fn checkin_test_control_job(kind: ControlKind, title: &str, theme: &str) -> StatelessJobItem {
-        new_control_job_at(
-            ControlJobParams {
-                chat_id: -10042,
-                message_id: 555,
-                user_id: 777000,
-                user_full_name: "Plotva Bot".to_owned(),
-                thread_id: Some(77),
-                data: ControlJobData {
-                    kind,
-                    theme: theme.to_owned(),
-                    chat_type: "supergroup".to_owned(),
-                    user_name: "plotva_bot".to_owned(),
-                    first_name: "Plotva".to_owned(),
-                    last_name: "Bot".to_owned(),
-                    ..ControlJobData::default()
-                },
-            },
-            OffsetDateTime::UNIX_EPOCH,
-        )
-        .with_name(title)
-        .with_priority(HIGH_PRIORITY)
-    }
-
     #[derive(Default)]
     struct QueueStub {
         state: Mutex<QueueState>,
@@ -3997,14 +3899,14 @@ mod tests {
         }
     }
 
-    impl CheckinControlJobQueue for QueueStub {
+    impl ControlJobQueue for QueueStub {
         type Error = io::Error;
 
-        fn assign_checkin_control_job<'a>(
+        fn assign_control_job<'a>(
             &'a self,
             queue_name: &'static str,
             job: StatelessJobItem,
-        ) -> CheckinControlJobQueueFuture<'a, Self::Error> {
+        ) -> ControlJobEnqueueFuture<'a, Self::Error> {
             Box::pin(async move {
                 let mut state = self.lock();
                 state.assigned.push((queue_name, job));
@@ -4136,35 +4038,6 @@ mod tests {
         }
     }
 
-    #[derive(Default)]
-    struct CheckinControlEffectsStub {
-        runs: Mutex<Vec<(i64, i64, String)>>,
-    }
-
-    impl CheckinControlEffectsStub {
-        fn runs(&self) -> Vec<(i64, i64, String)> {
-            self.runs.lock().expect("checkin runs").clone()
-        }
-    }
-
-    impl CheckinControlJobEffects for CheckinControlEffectsStub {
-        type Error = io::Error;
-
-        fn run_checkin_game<'a>(
-            &'a self,
-            params: &'a ControlJobParams,
-        ) -> CheckinControlJobFuture<'a, Self::Error> {
-            Box::pin(async move {
-                self.runs.lock().expect("checkin runs").push((
-                    params.chat_id,
-                    params.user_id,
-                    params.data.theme.clone(),
-                ));
-                Ok(())
-            })
-        }
-    }
-
     #[derive(Default)]
     struct GameStoreStub {
         state: Mutex<GameStoreState>,
@@ -4372,6 +4245,38 @@ mod tests {
     impl CheckinGameSender for GameSenderStub {
         type Error = io::Error;
 
+        fn queued_checkin<'a>(
+            &'a self,
+            _job_id: i64,
+        ) -> CheckinGameSendFuture<
+            'a,
+            Option<crate::telegram_outbox::QueuedBatchReceipt>,
+            Self::Error,
+        > {
+            Box::pin(async { Ok(None) })
+        }
+        fn finish_checkin_html<'a>(
+            &'a self,
+            job_id: i64,
+            _reply_to: CheckinGameMessage,
+            target_message_id: Option<i32>,
+            html: String,
+        ) -> CheckinGameSendFuture<'a, crate::telegram_outbox::QueuedBatchReceipt, Self::Error>
+        {
+            Box::pin(async move {
+                if target_message_id.is_some() {
+                    self.edits.lock().expect("edits").push(html);
+                } else {
+                    self.sent_html.lock().expect("sent html").push(html);
+                }
+                Ok(crate::telegram_outbox::QueuedBatchReceipt::durable_outbox(
+                    checkin_delivery_source(job_id),
+                    vec!["checkin-final".into()],
+                    false,
+                ))
+            })
+        }
+
         fn send_checkin_html<'a>(
             &'a self,
             _reply_to: CheckinGameMessage,
@@ -4418,6 +4323,7 @@ mod tests {
 
     fn game_request(chat_type: &str, theme_override: &str) -> CheckinGameRunRequest {
         CheckinGameRunRequest {
+            job_id: 555,
             message: game_message(),
             chat_type: chat_type.to_owned(),
             theme_override: theme_override.to_owned(),
diff --git a/crates/openplotva-app/src/control_jobs.rs b/crates/openplotva-app/src/control_jobs.rs
index 5fa54f66..1a60df42 100644
--- a/crates/openplotva-app/src/control_jobs.rs
+++ b/crates/openplotva-app/src/control_jobs.rs
@@ -1,3 +1,545 @@
+use crate::rate_limits::TaskEnqueueRateLimit;
+use openplotva_taskman::{InMemoryTaskQueue, TaskQueueRecord, TaskQueueSchedule};
+#[cfg(test)]
+use serde::{Deserialize, Serialize};
+use std::sync::Arc;
+use thiserror::Error;
+
+/// Boxed future returned by taskman control-job assignment calls.
+pub type ControlJobEnqueueFuture<'a, E> = Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
+/// Queue operations used by the shared control worker.
+pub type ControlJobQueueFuture<'a, T, E> = Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>;
+/// A taskman row ready for the shared control worker.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct ControlJobWorkItem {
+    /// Taskman job ID used for completion/failure writes.
+    pub id: i64,
+    pub job: StatelessJobItem,
+}
+
+pub trait ControlJobQueue {
+    /// Error returned by the concrete queue implementation.
+    type Error: fmt::Display + Send + Sync + 'static;
+
+    /// Assign a control job to a named taskman queue.
+    fn assign_control_job<'a>(
+        &'a self,
+        queue_name: &'static str,
+        job: StatelessJobItem,
+    ) -> ControlJobEnqueueFuture<'a, Self::Error>;
+
+    /// Assign or replace a pending control job under a stable debounce key.
+    fn schedule_control_job<'a>(
+        &'a self,
+        queue_name: &'static str,
+        job: StatelessJobItem,
+        schedule: TaskQueueSchedule,
+    ) -> ControlJobEnqueueFuture<'a, Self::Error> {
+        drop(schedule);
+        self.assign_control_job(queue_name, job)
+    }
+}
+
+pub trait SharedControlJobWorkerQueue {
+    /// Error returned by the concrete queue implementation.
+    type Error: fmt::Display + Send + Sync + 'static;
+
+    /// Dequeue the next pending control job owned by one executor family.
+    fn dequeue_shared_control_job_matching<'a>(
+        &'a self,
+        queue_name: &'static str,
+        worker_id: &'static str,
+        predicate: fn(&StatelessJobItem) -> bool,
+    ) -> ControlJobQueueFuture<'a, Option<ControlJobWorkItem>, Self::Error>;
+
+    /// Mark one shared control job completed.
+    fn complete_shared_control_job<'a>(
+        &'a self,
+        job_id: i64,
+    ) -> ControlJobQueueFuture<'a, (), Self::Error>;
+
+    fn wait_for_shared_control_delivery<'a>(
+        &'a self,
+        job_id: i64,
+    ) -> ControlJobQueueFuture<'a, (), Self::Error>;
+
+    /// Mark one shared control job failed.
+    fn fail_shared_control_job<'a>(
+        &'a self,
+        job_id: i64,
+        error: &'a str,
+    ) -> ControlJobQueueFuture<'a, (), Self::Error>;
+}
+
+#[cfg(test)]
+#[derive(Clone, Debug)]
+pub struct InMemoryControlJobQueue {
+    queue: InMemoryTaskQueue,
+}
+
+#[cfg(test)]
+/// Queue status projection for fixtures.
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum InMemoryControlJobStatus {
+    /// Job is pending worker execution.
+    Pending,
+    /// Job has been dequeued by a worker.
+    Processing,
+    /// Job completed.
+    Completed,
+    /// Job failed and carries an error string.
+    Failed,
+}
+
+#[cfg(test)]
+/// Queue snapshot used by fixtures.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct InMemoryControlJobRecord {
+    /// Taskman job ID.
+    pub id: i64,
+    pub queue_name: String,
+    /// Current in-memory status.
+    pub status: InMemoryControlJobStatus,
+    pub job: StatelessJobItem,
+    /// Worker failure.
+    pub error: Option<String>,
+}
+
+/// Rejected taskman operation.
+#[derive(Clone, Debug, Error, Eq, PartialEq)]
+pub enum InMemoryControlJobQueueError {
+    /// A status update targeted a job ID this queue has never assigned.
+    #[error("payment control job {0} not found")]
+    JobNotFound(i64),
+    /// The shared taskman queue core rejected an operation unexpectedly.
+    #[error("payment control job queue: {0}")]
+    Taskman(String),
+}
+
+#[cfg(test)]
+impl InMemoryControlJobQueue {
+    /// Build an empty control queue for fixtures.
+    #[must_use]
+    pub fn new() -> Self {
+        Self {
+            queue: InMemoryTaskQueue::new(),
+        }
+    }
+
+    /// Return a stable ID-ordered snapshot of the queue state.
+    #[cfg(test)]
+    #[must_use]
+    pub fn snapshot(&self) -> Vec<InMemoryControlJobRecord> {
+        let records = self.queue.records();
+        control_records_from_taskman(&records)
+    }
+
+    /// Return raw taskman records with worker IDs and timestamps for runtime diagnostics.
+    #[must_use]
+    pub fn taskman_records(&self) -> Vec<TaskQueueRecord> {
+        self.queue.records()
+    }
+}
+
+/// Control queue storage or enqueue failure.
+#[derive(Debug, Error)]
+pub enum PersistentControlJobQueueError {
+    #[error(transparent)]
+    Storage(#[from] openplotva_storage::StorageError),
+    /// The inner queue operation failed.
+    #[error(transparent)]
+    Queue(#[from] InMemoryControlJobQueueError),
+    /// User/chat-originated control job creation was rejected by the task enqueue limiter.
+    #[error("task enqueue rate limited")]
+    TaskEnqueueRateLimited,
+}
+
+/// Shared control queue with enqueue limiting and a Postgres journal.
+#[derive(Clone)]
+pub struct PersistentControlJobQueue {
+    queue: InMemoryTaskQueue,
+    task_enqueue_rate_limit: Option<Arc<dyn TaskEnqueueRateLimit>>,
+    db_journal: Option<
+        crate::task_queue::BufferedTaskQueueJournal<openplotva_storage::PostgresTaskQueueStore>,
+    >,
+}
+
+impl PersistentControlJobQueue {
+    #[must_use]
+    pub fn from_task_queue(queue: InMemoryTaskQueue) -> Self {
+        Self {
+            queue,
+            task_enqueue_rate_limit: None,
+            db_journal: None,
+        }
+    }
+
+    #[must_use]
+    pub fn with_task_enqueue_rate_limit(
+        mut self,
+        rate_limit: Arc<dyn TaskEnqueueRateLimit>,
+    ) -> Self {
+        self.task_enqueue_rate_limit = Some(rate_limit);
+        self
+    }
+
+    /// Attach the shared Postgres journal so control/payment enqueues are flushed
+    /// to Postgres synchronously. Payment jobs (e.g. SuccessfulPayment) must be
+    /// durable before the update is acked: a lost enqueue would silently drop money.
+    #[must_use]
+    pub fn with_db_journal(
+        mut self,
+        journal: crate::task_queue::BufferedTaskQueueJournal<
+            openplotva_storage::PostgresTaskQueueStore,
+        >,
+    ) -> Self {
+        self.db_journal = Some(journal);
+        self
+    }
+
+    /// Return a stable ID-ordered snapshot of the queue state.
+    #[cfg(test)]
+    #[must_use]
+    pub fn snapshot(&self) -> Vec<InMemoryControlJobRecord> {
+        control_records_from_taskman(&self.queue.records())
+    }
+
+    /// Return raw taskman records with worker IDs and timestamps for runtime diagnostics.
+    #[must_use]
+    pub fn taskman_records(&self) -> Vec<TaskQueueRecord> {
+        self.queue.records()
+    }
+}
+
+/// Synchronous-flush retry budget for payment-flow control jobs before falling back
+/// to the background sync worker.
+const PAYMENT_CONTROL_FLUSH_ATTEMPTS: u32 = 3;
+const PAYMENT_CONTROL_FLUSH_RETRY_DELAY: std::time::Duration = std::time::Duration::from_millis(50);
+
+/// Control kinds that must never be dropped by enqueue rate limiting.
+const fn control_kind_skips_task_enqueue_rate_limit(kind: ControlKind) -> bool {
+    matches!(
+        kind,
+        ControlKind::SuccessfulPayment
+            | ControlKind::VipInvoice
+            | ControlKind::DonateInvoice
+            | ControlKind::ChatAdminsSync
+            | ControlKind::ChatMemberSync
+    )
+}
+
+impl PersistentControlJobQueue {
+    async fn assign_control_job_with_schedule(
+        &self,
+        queue_name: &'static str,
+        job: StatelessJobItem,
+        schedule: Option<TaskQueueSchedule>,
+    ) -> Result<(), PersistentControlJobQueueError> {
+        let params = control_job_params_from_stateless_job(&job)
+            .map_err(|error| InMemoryControlJobQueueError::Taskman(error.to_string()))?;
+        let chat_id = params.chat_id;
+        let user_id = params.user_id;
+        let control_kind = params.data.kind;
+        // Payment and member-state control jobs are exempt from enqueue throttling:
+        // dropping them would silently lose durable payment intent or Telegram state.
+        // They are rare control-plane events, not the dialog burst the limiter targets.
+        let rate_limit = if control_kind_skips_task_enqueue_rate_limit(control_kind) {
+            None
+        } else {
+            self.task_enqueue_rate_limit.as_ref()
+        };
+        if let Some(rate_limit) = rate_limit {
+            let now = OffsetDateTime::now_utc();
+            let report = rate_limit
+                .check_task_enqueue_rate_limit(chat_id, user_id, now)
+                .await;
+            if report.limited {
+                tracing::warn!(
+                    queue_name,
+                    chat_id,
+                    user_id,
+                    control_kind = ?control_kind,
+                    rate_limit_scope = ?report.scope,
+                    rate_limit_error = ?report.error,
+                    "task enqueue rate limit rejected control job"
+                );
+                return Err(PersistentControlJobQueueError::TaskEnqueueRateLimited);
+            }
+            if let Some(error) = report.error {
+                tracing::warn!(
+                    queue_name,
+                    chat_id,
+                    user_id,
+                    control_kind = ?control_kind,
+                    error,
+                    "task enqueue rate limit store check failed before control job assignment"
+                );
+            }
+        }
+        if let Some(schedule) = schedule {
+            self.queue.schedule_or_replace(queue_name, job, schedule);
+        } else {
+            self.queue.assign(queue_name, job);
+        }
+        // Best-effort synchronous durability for the payment-flow job: retry the
+        // flush a few times to ride out a transient Postgres blip so the job is
+        // durable before the update is acked. If every attempt fails, the 1s
+        // background sync worker remains the durability backstop (a crash inside
+        // that residual window would re-deliver the update, which is idempotent).
+        if let Some(journal) = &self.db_journal {
+            let mut last_error = None;
+            for attempt in 0..PAYMENT_CONTROL_FLUSH_ATTEMPTS {
+                match journal.flush_dirty().await {
+                    Ok(_) => {
+                        last_error = None;
+                        break;
+                    }
+                    Err(error) => {
+                        last_error = Some(error);
+                        if attempt + 1 < PAYMENT_CONTROL_FLUSH_ATTEMPTS {
+                            tokio::time::sleep(PAYMENT_CONTROL_FLUSH_RETRY_DELAY).await;
+                        }
+                    }
+                }
+            }
+            if let Some(error) = last_error {
+                tracing::error!(
+                    queue_name,
+                    control_kind = ?control_kind,
+                    %error,
+                    "control job not durably flushed after retries; relying on background sync worker"
+                );
+            }
+        }
+        if let Some(rate_limit) = rate_limit {
+            let report = rate_limit
+                .grow_task_enqueue_rate_limit(chat_id, user_id, OffsetDateTime::now_utc())
+                .await;
+            for error in report.save_errors {
+                tracing::warn!(
+                    queue_name,
+                    chat_id,
+                    user_id,
+                    control_kind = ?control_kind,
+                    error,
+                    "task enqueue rate limit store save failed after control job assignment"
+                );
+            }
+        }
+        Ok(())
+    }
+}
+
+impl ControlJobQueue for PersistentControlJobQueue {
+    type Error = PersistentControlJobQueueError;
+
+    fn assign_control_job<'a>(
+        &'a self,
+        queue_name: &'static str,
+        job: StatelessJobItem,
+    ) -> ControlJobEnqueueFuture<'a, Self::Error> {
+        Box::pin(self.assign_control_job_with_schedule(queue_name, job, None))
+    }
+
+    fn schedule_control_job<'a>(
+        &'a self,
+        queue_name: &'static str,
+        job: StatelessJobItem,
+        schedule: TaskQueueSchedule,
+    ) -> ControlJobEnqueueFuture<'a, Self::Error> {
+        Box::pin(self.assign_control_job_with_schedule(queue_name, job, Some(schedule)))
+    }
+}
+
+impl SharedControlJobWorkerQueue for PersistentControlJobQueue {
+    type Error = PersistentControlJobQueueError;
+
+    fn dequeue_shared_control_job_matching<'a>(
+        &'a self,
+        queue_name: &'static str,
+        worker_id: &'static str,
+        predicate: fn(&StatelessJobItem) -> bool,
+    ) -> ControlJobQueueFuture<'a, Option<ControlJobWorkItem>, Self::Error> {
+        Box::pin(async move {
+            Ok(self
+                .queue
+                .dequeue_matching(queue_name, worker_id, OffsetDateTime::now_utc(), predicate)
+                .map(|item| ControlJobWorkItem {
+                    id: item.id,
+                    job: item.job,
+                }))
+        })
+    }
+
+    fn complete_shared_control_job<'a>(
+        &'a self,
+        job_id: i64,
+    ) -> ControlJobQueueFuture<'a, (), Self::Error> {
+        Box::pin(async move {
+            self.queue
+                .complete(job_id, OffsetDateTime::now_utc())
+                .map_err(control_queue_error)?;
+            Ok(())
+        })
+    }
+
+    fn wait_for_shared_control_delivery<'a>(
+        &'a self,
+        job_id: i64,
+    ) -> ControlJobQueueFuture<'a, (), Self::Error> {
+        Box::pin(async move {
+            self.queue
+                .wait_for_delivery(job_id)
+                .map_err(control_queue_error)?;
+            if let Some(journal) = &self.db_journal {
+                journal.flush_job(job_id).await?;
+            }
+            Ok(())
+        })
+    }
+
+    fn fail_shared_control_job<'a>(
+        &'a self,
+        job_id: i64,
+        error: &'a str,
+    ) -> ControlJobQueueFuture<'a, (), Self::Error> {
+        Box::pin(async move {
+            self.queue
+                .fail(job_id, error, OffsetDateTime::now_utc())
+                .map_err(control_queue_error)?;
+            Ok(())
+        })
+    }
+}
+
+#[cfg(test)]
+impl Default for InMemoryControlJobQueue {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[cfg(test)]
+impl ControlJobQueue for InMemoryControlJobQueue {
+    type Error = InMemoryControlJobQueueError;
+
+    fn assign_control_job<'a>(
+        &'a self,
+        queue_name: &'static str,
+        job: StatelessJobItem,
+    ) -> ControlJobEnqueueFuture<'a, Self::Error> {
+        Box::pin(async move {
+            self.queue.assign(queue_name, job);
+            Ok(())
+        })
+    }
+
+    fn schedule_control_job<'a>(
+        &'a self,
+        queue_name: &'static str,
+        job: StatelessJobItem,
+        schedule: TaskQueueSchedule,
+    ) -> ControlJobEnqueueFuture<'a, Self::Error> {
+        Box::pin(async move {
+            self.queue.schedule_or_replace(queue_name, job, schedule);
+            Ok(())
+        })
+    }
+}
+
+#[cfg(test)]
+impl SharedControlJobWorkerQueue for InMemoryControlJobQueue {
+    type Error = InMemoryControlJobQueueError;
+
+    fn dequeue_shared_control_job_matching<'a>(
+        &'a self,
+        queue_name: &'static str,
+        worker_id: &'static str,
+        predicate: fn(&StatelessJobItem) -> bool,
+    ) -> ControlJobQueueFuture<'a, Option<ControlJobWorkItem>, Self::Error> {
+        Box::pin(async move {
+            Ok(self
+                .queue
+                .dequeue_matching(queue_name, worker_id, OffsetDateTime::now_utc(), predicate)
+                .map(|item| ControlJobWorkItem {
+                    id: item.id,
+                    job: item.job,
+                }))
+        })
+    }
+
+    fn complete_shared_control_job<'a>(
+        &'a self,
+        job_id: i64,
+    ) -> ControlJobQueueFuture<'a, (), Self::Error> {
+        Box::pin(async move {
+            self.queue
+                .complete(job_id, OffsetDateTime::now_utc())
+                .map_err(control_queue_error)?;
+            Ok(())
+        })
+    }
+
+    fn wait_for_shared_control_delivery<'a>(
+        &'a self,
+        job_id: i64,
+    ) -> ControlJobQueueFuture<'a, (), Self::Error> {
+        Box::pin(async move {
+            self.queue
+                .wait_for_delivery(job_id)
+                .map_err(control_queue_error)?;
+            Ok(())
+        })
+    }
+
+    fn fail_shared_control_job<'a>(
+        &'a self,
+        job_id: i64,
+        error: &'a str,
+    ) -> ControlJobQueueFuture<'a, (), Self::Error> {
+        Box::pin(async move {
+            self.queue
+                .fail(job_id, error, OffsetDateTime::now_utc())
+                .map_err(control_queue_error)?;
+            Ok(())
+        })
+    }
+}
+
+fn control_queue_error(error: openplotva_taskman::TaskQueueError) -> InMemoryControlJobQueueError {
+    match error {
+        openplotva_taskman::TaskQueueError::JobNotFound(job_id) => {
+            InMemoryControlJobQueueError::JobNotFound(job_id)
+        }
+        error => InMemoryControlJobQueueError::Taskman(error.to_string()),
+    }
+}
+
+#[cfg(test)]
+fn control_records_from_taskman(records: &[TaskQueueRecord]) -> Vec<InMemoryControlJobRecord> {
+    records
+        .iter()
+        .map(|record| InMemoryControlJobRecord {
+            id: record.id,
+            queue_name: record.queue_name.clone(),
+            status: control_status_from_taskman(record.status),
+            job: record.job.clone(),
+            error: record.error.clone(),
+        })
+        .collect()
+}
+
+#[cfg(test)]
+fn control_status_from_taskman(status: openplotva_taskman::JobStatus) -> InMemoryControlJobStatus {
+    use openplotva_taskman::JobStatus;
+    match status {
+        JobStatus::Pending => InMemoryControlJobStatus::Pending,
+        JobStatus::Processing | JobStatus::WaitingDelivery => InMemoryControlJobStatus::Processing,
+        JobStatus::Completed => InMemoryControlJobStatus::Completed,
+        JobStatus::Failed | JobStatus::Cancelled => InMemoryControlJobStatus::Failed,
+    }
+}
+
 use std::{fmt, future::Future, pin::Pin, time::Duration};
 
 use openplotva_taskman::{
@@ -8,11 +550,11 @@ use openplotva_telegram::DispatcherQueue;
 use time::OffsetDateTime;
 
 use crate::{
-    checkin::{CheckinControlJobEffects, CheckinControlJobOutcome},
+    checkin::CheckinControlJobEffects,
     members::{MemberStateControlJobEffects, MemberStateControlJobExecution},
     payments::{
-        PaymentControlJobReport, SharedControlJobWorkerQueue, SuccessfulPaymentStore,
-        execute_payment_control_job_at, payment_control_job_failure_message,
+        PaymentControlJobReport, SuccessfulPaymentStore, execute_payment_control_job_at,
+        payment_control_job_failure_message,
     },
     settings::{
         GroupSettingsControlJobEffects, NewMembersFollowupControlJobEffects,
@@ -43,7 +585,7 @@ pub enum ControlJobExecution {
     /// Chat-admin/member sync executor result.
     MemberState(MemberStateControlJobExecution),
     /// Check-in game executor result.
-    Checkin(CheckinControlJobOutcome),
+    Checkin,
 }
 
 /// Result returned by one control-kind executor.
@@ -51,6 +593,7 @@ pub enum ControlJobExecution {
 pub enum ControlJobExecutionResult {
     /// Executor completed and the queue row should be marked completed.
     Completed(ControlJobExecution),
+    WaitingDelivery(crate::telegram_outbox::QueuedBatchReceipt),
     /// Executor failed and the queue row should be marked failed.
     Failed {
         /// Optional partial execution details.
@@ -73,6 +616,7 @@ pub struct ControlJobWorkerReport {
     pub execution: Option<ControlJobExecution>,
     /// The job was finalized as completed.
     pub completed: bool,
+    pub waiting_delivery: bool,
     /// The job was finalized as failed.
     pub failed: bool,
     /// Queue dequeue failed.
@@ -93,6 +637,7 @@ pub struct ControlJobWorkerRunReport {
     pub dequeued: u64,
     /// Number of jobs completed.
     pub completed: u64,
+    pub waiting_delivery: u64,
     /// Number of jobs failed.
     pub failed: u64,
     /// Number of queue dequeue errors.
@@ -105,6 +650,7 @@ pub trait ControlJobExecutorRegistry {
     /// Execute one already-decoded control job.
     fn execute_control_job<'a>(
         &'a self,
+        job_id: i64,
         params: &'a ControlJobParams,
         now: OffsetDateTime,
     ) -> ControlJobExecutorFuture<'a>;
@@ -183,6 +729,7 @@ where
 {
     fn execute_control_job<'a>(
         &'a self,
+        job_id: i64,
         params: &'a ControlJobParams,
         now: OffsetDateTime,
     ) -> ControlJobExecutorFuture<'a> {
@@ -285,15 +832,18 @@ where
                         MemberStateControlJobExecution::SupersededByProjectionMaterializer,
                     ))
                 }
-                ControlKind::Checkin => match self.checkin_effects.run_checkin_game(params).await {
-                    Ok(()) => ControlJobExecutionResult::Completed(ControlJobExecution::Checkin(
-                        CheckinControlJobOutcome::Completed,
-                    )),
-                    Err(error) => ControlJobExecutionResult::Failed {
-                        execution: None,
-                        error: error.to_string(),
-                    },
-                },
+                ControlKind::Checkin => {
+                    match self.checkin_effects.run_checkin_game(job_id, params).await {
+                        Ok(Some(receipt)) => ControlJobExecutionResult::WaitingDelivery(receipt),
+                        Ok(None) => {
+                            ControlJobExecutionResult::Completed(ControlJobExecution::Checkin)
+                        }
+                        Err(error) => ControlJobExecutionResult::Failed {
+                            execution: None,
+                            error: error.to_string(),
+                        },
+                    }
+                }
                 kind => unsupported_control_job_kind(kind),
             }
         })
@@ -371,7 +921,7 @@ where
 
     let result = match tokio::time::timeout(
         control_job_timeout(params.data.kind),
-        registry.execute_control_job(&params, now),
+        registry.execute_control_job(item.id, &params, now),
     )
     .await
     {
@@ -394,6 +944,12 @@ where
                 Err(error) => report.status_error = Some(error.to_string()),
             }
         }
+        ControlJobExecutionResult::WaitingDelivery(_) => {
+            match queue.wait_for_shared_control_delivery(item.id).await {
+                Ok(()) => report.waiting_delivery = true,
+                Err(error) => report.status_error = Some(error.to_string()),
+            }
+        }
         ControlJobExecutionResult::Failed { execution, error } => {
             report.execution = execution;
             report.execution_error = Some(error.clone());
@@ -464,6 +1020,9 @@ impl ControlJobWorkerRunReport {
         if tick.completed {
             self.completed += 1;
         }
+        if tick.waiting_delivery {
+            self.waiting_delivery += 1;
+        }
         if tick.failed {
             self.failed += 1;
         }
@@ -516,14 +1075,15 @@ fn is_control_job(job: &StatelessJobItem) -> bool {
 
 impl<F> ControlJobExecutorRegistry for F
 where
-    F: for<'a> Fn(&'a ControlJobParams, OffsetDateTime) -> ControlJobExecutorFuture<'a> + Sync,
+    F: for<'a> Fn(i64, &'a ControlJobParams, OffsetDateTime) -> ControlJobExecutorFuture<'a> + Sync,
 {
     fn execute_control_job<'a>(
         &'a self,
+        job_id: i64,
         params: &'a ControlJobParams,
         now: OffsetDateTime,
     ) -> ControlJobExecutorFuture<'a> {
-        self(params, now)
+        self(job_id, params, now)
     }
 }
 
@@ -531,6 +1091,7 @@ impl fmt::Display for ControlJobExecutionResult {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
             Self::Completed(_) => formatter.write_str("completed"),
+            Self::WaitingDelivery(_) => formatter.write_str("waiting_delivery"),
             Self::Failed { error, .. } => error.fmt(formatter),
         }
     }
@@ -549,22 +1110,23 @@ mod tests {
     };
 
     use super::*;
-    use crate::payments::{InMemoryPaymentControlJobStatus, PaymentControlJobQueue};
+
+    use crate::control_jobs::{ControlJobQueue, InMemoryControlJobStatus};
 
     #[tokio::test]
     async fn unified_control_worker_dequeues_next_pending_control_job_by_go_order()
     -> Result<(), Box<dyn Error>> {
-        let queue = crate::payments::InMemoryPaymentControlJobQueue::new();
+        let queue = crate::control_jobs::InMemoryControlJobQueue::new();
         let now = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
         queue
-            .assign_payment_control_job(
+            .assign_control_job(
                 CONTROL_QUEUE_NAME,
                 control_job(ControlKind::Translate, now, 0),
             )
             .await?;
         let low_id = queue.snapshot().last().expect("low job").id;
         queue
-            .assign_payment_control_job(
+            .assign_control_job(
                 CONTROL_QUEUE_NAME,
                 control_job(
                     ControlKind::Checkin,
@@ -584,22 +1146,17 @@ mod tests {
 
         assert_eq!(report.job_id, Some(high_id));
         assert_eq!(report.kind, Some(ControlKind::Checkin));
-        assert_eq!(
-            report.execution,
-            Some(ControlJobExecution::Checkin(
-                CheckinControlJobOutcome::Completed
-            ))
-        );
+        assert_eq!(report.execution, Some(ControlJobExecution::Checkin));
         assert!(report.completed);
         assert_eq!(*seen.lock().expect("seen"), vec![ControlKind::Checkin]);
         let snapshot = queue.snapshot();
         assert_eq!(
             snapshot_record(&snapshot, high_id).status,
-            InMemoryPaymentControlJobStatus::Completed
+            InMemoryControlJobStatus::Completed
         );
         assert_eq!(
             snapshot_record(&snapshot, low_id).status,
-            InMemoryPaymentControlJobStatus::Pending
+            InMemoryControlJobStatus::Pending
         );
         Ok(())
     }
@@ -607,16 +1164,16 @@ mod tests {
     #[tokio::test]
     async fn transactional_control_job_overtakes_older_membership_sync()
     -> Result<(), Box<dyn Error>> {
-        let queue = crate::payments::InMemoryPaymentControlJobQueue::new();
+        let queue = crate::control_jobs::InMemoryControlJobQueue::new();
         let now = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
         queue
-            .assign_payment_control_job(
+            .assign_control_job(
                 CONTROL_QUEUE_NAME,
                 control_job(ControlKind::ChatMemberSync, now, HIGH_PRIORITY),
             )
             .await?;
         queue
-            .assign_payment_control_job(
+            .assign_control_job(
                 CONTROL_QUEUE_NAME,
                 control_job(
                     ControlKind::SuccessfulPayment,
@@ -641,12 +1198,52 @@ mod tests {
         Ok(())
     }
 
+    #[tokio::test]
+    async fn queued_control_result_waits_for_delivery_without_completing()
+    -> Result<(), Box<dyn Error>> {
+        fn queued(
+            job_id: i64,
+            _params: &ControlJobParams,
+            _now: OffsetDateTime,
+        ) -> ControlJobExecutorFuture<'_> {
+            Box::pin(async move {
+                ControlJobExecutionResult::WaitingDelivery(
+                    crate::telegram_outbox::QueuedBatchReceipt::durable_outbox(
+                        crate::checkin::checkin_delivery_source(job_id),
+                        vec!["checkin-part".into()],
+                        false,
+                    ),
+                )
+            })
+        }
+        let queue = crate::control_jobs::InMemoryControlJobQueue::new();
+        let now = OffsetDateTime::now_utc();
+        queue
+            .assign_control_job(
+                CONTROL_QUEUE_NAME,
+                control_job(ControlKind::Checkin, now, HIGH_PRIORITY),
+            )
+            .await?;
+        let report = process_control_job_once_at(&queue, &queued, now).await;
+        assert!(report.waiting_delivery);
+        assert!(!report.completed);
+        assert!(!report.failed);
+        let records = queue.taskman_records();
+        assert_eq!(
+            records[0].status,
+            openplotva_taskman::JobStatus::WaitingDelivery
+        );
+        assert_eq!(records[0].result_message_id, None);
+        assert_eq!(records[0].completed_at, None);
+        Ok(())
+    }
+
     #[tokio::test]
     async fn unified_control_worker_fails_unknown_control_kind() -> Result<(), Box<dyn Error>> {
-        let queue = crate::payments::InMemoryPaymentControlJobQueue::new();
+        let queue = crate::control_jobs::InMemoryControlJobQueue::new();
         let now = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
         queue
-            .assign_payment_control_job(
+            .assign_control_job(
                 CONTROL_QUEUE_NAME,
                 control_job(ControlKind::Unknown, now, HIGH_PRIORITY),
             )
@@ -665,7 +1262,7 @@ mod tests {
         );
         let snapshot = queue.snapshot();
         let record = snapshot_record(&snapshot, job_id);
-        assert_eq!(record.status, InMemoryPaymentControlJobStatus::Failed);
+        assert_eq!(record.status, InMemoryControlJobStatus::Failed);
         assert_eq!(
             record.error.as_deref(),
             Some("unsupported control job kind: Unknown")
@@ -725,6 +1322,7 @@ mod tests {
     impl ControlJobExecutorRegistry for RecordingRegistry {
         fn execute_control_job<'a>(
             &'a self,
+            _job_id: i64,
             params: &'a ControlJobParams,
             _now: OffsetDateTime,
         ) -> ControlJobExecutorFuture<'a> {
@@ -743,9 +1341,9 @@ mod tests {
                     ControlKind::Translate => ControlJobExecutionResult::Completed(
                         ControlJobExecution::Translate(TranslateControlJobOutcome::Sent),
                     ),
-                    ControlKind::Checkin => ControlJobExecutionResult::Completed(
-                        ControlJobExecution::Checkin(CheckinControlJobOutcome::Completed),
-                    ),
+                    ControlKind::Checkin => {
+                        ControlJobExecutionResult::Completed(ControlJobExecution::Checkin)
+                    }
                     kind => unsupported_control_job_kind(kind),
                 }
             })
@@ -755,11 +1353,11 @@ mod tests {
     #[tokio::test(start_paused = true)]
     async fn worker_drains_ready_control_jobs_without_poll_interval_between_them()
     -> Result<(), Box<dyn Error>> {
-        let queue = crate::payments::InMemoryPaymentControlJobQueue::new();
+        let queue = crate::control_jobs::InMemoryControlJobQueue::new();
         let now = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
         for kind in [ControlKind::Translate, ControlKind::Checkin] {
             queue
-                .assign_payment_control_job(CONTROL_QUEUE_NAME, control_job(kind, now, 0))
+                .assign_control_job(CONTROL_QUEUE_NAME, control_job(kind, now, 0))
                 .await?;
         }
         let notify = Arc::new(tokio::sync::Notify::new());
@@ -805,12 +1403,15 @@ mod tests {
     }
 
     fn snapshot_record(
-        snapshot: &[crate::payments::InMemoryPaymentControlJobRecord],
+        snapshot: &[crate::control_jobs::InMemoryControlJobRecord],
         id: i64,
-    ) -> &crate::payments::InMemoryPaymentControlJobRecord {
+    ) -> &crate::control_jobs::InMemoryControlJobRecord {
         snapshot
             .iter()
             .find(|record| record.id == id)
             .expect("snapshot record")
     }
 }
+
+#[cfg(test)]
+pub(crate) mod test_support;
diff --git a/crates/openplotva-app/src/control_jobs/test_support.rs b/crates/openplotva-app/src/control_jobs/test_support.rs
new file mode 100644
index 00000000..c3be03a0
--- /dev/null
+++ b/crates/openplotva-app/src/control_jobs/test_support.rs
@@ -0,0 +1,190 @@
+use super::*;
+use crate::checkin::*;
+use crate::members::*;
+use crate::payments::*;
+use crate::settings::*;
+use crate::translate::*;
+use openplotva_core::UserState;
+use openplotva_storage::*;
+
+pub struct UnusedControlPorts;
+
+impl SuccessfulPaymentStore for UnusedControlPorts {
+    type Error = std::convert::Infallible;
+    fn upsert_payment_user<'a>(
+        &'a self,
+        _user: &'a UserState,
+    ) -> PaymentStoreFuture<'a, (), Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn create_subscription<'a>(
+        &'a self,
+        _subscription: SubscriptionCreate<'a>,
+    ) -> PaymentStoreFuture<'a, SubscriptionRecord, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn get_subscription_by_telegram_payment_charge_id<'a>(
+        &'a self,
+        _telegram_payment_charge_id: &'a str,
+    ) -> PaymentStoreFuture<'a, Option<SubscriptionRecord>, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn get_vip_summary_by_user<'a>(
+        &'a self,
+        _user_id: i64,
+    ) -> PaymentStoreFuture<'a, Option<VipSummaryRecord>, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn get_vip_event_by_subscription_id<'a>(
+        &'a self,
+        _subscription_id: i64,
+    ) -> PaymentStoreFuture<'a, Option<VipEventRecord>, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn create_donation<'a>(
+        &'a self,
+        _donation: DonationCreate<'a>,
+    ) -> PaymentStoreFuture<'a, DonationRecord, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn get_donation_by_telegram_payment_charge_id<'a>(
+        &'a self,
+        _telegram_payment_charge_id: &'a str,
+    ) -> PaymentStoreFuture<'a, Option<DonationRecord>, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn create_vip_event<'a>(
+        &'a self,
+        _event: VipEventCreate<'a>,
+    ) -> PaymentStoreFuture<'a, VipEventRecord, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn is_duplicate_insert_no_row(_error: &Self::Error) -> bool {
+        panic!("unexpected control executor port")
+    }
+}
+
+impl PaymentInvoiceEffects for UnusedControlPorts {
+    type Error = std::convert::Infallible;
+    fn create_subscription_invoice_link<'a>(
+        &'a self,
+        _request: &'a openplotva_telegram::SubscriptionInvoiceLinkRequest,
+    ) -> PaymentInvoiceLinkFuture<'a, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn subscription_price_override(&self, _user_id: i64) -> Option<i64> {
+        panic!("unexpected control executor port")
+    }
+    fn create_donation_invoice_link<'a>(
+        &'a self,
+        _request: &'a openplotva_telegram::DonationInvoiceLinkRequest,
+    ) -> PaymentInvoiceLinkFuture<'a, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn send_invoice_button_message<'a>(
+        &'a self,
+        _message: InvoiceButtonMessage,
+    ) -> PaymentEffectsFuture<'a, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn send_invoice_error_text<'a>(
+        &'a self,
+        _chat_id: i64,
+        _reply_to_message_id: i32,
+        _text: &'a str,
+        _parse_mode: &'a str,
+    ) -> PaymentEffectsFuture<'a, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+}
+
+impl SuccessfulPaymentEffects for UnusedControlPorts {
+    type Error = std::convert::Infallible;
+    fn send_text<'a>(
+        &'a self,
+        _message: PaymentTextMessage<'a>,
+    ) -> PaymentEffectsFuture<'a, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn invalidate_vip_cache<'a>(&'a self, _user_id: i64) -> PaymentEffectsFuture<'a, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn support_url(&self) -> &str {
+        panic!("unexpected control executor port")
+    }
+}
+
+impl GroupSettingsControlJobEffects for UnusedControlPorts {
+    type Error = std::convert::Infallible;
+    fn can_open_group_settings<'a>(
+        &'a self,
+        _chat_id: i64,
+        _user_id: i64,
+    ) -> GroupSettingsControlJobFuture<'a, bool, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn sync_chat_admins<'a>(&'a self, _chat_id: i64) -> GroupSettingsSyncFuture<'a> {
+        panic!("unexpected control executor port")
+    }
+}
+
+impl NewMembersFollowupControlJobEffects for UnusedControlPorts {
+    fn enable_chat_communication<'a>(&'a self, _chat_id: i64) -> NewMembersFollowupFuture<'a, ()> {
+        panic!("unexpected control executor port")
+    }
+    fn is_chat_blocked<'a>(&'a self, _chat_id: i64) -> NewMembersFollowupFuture<'a, bool> {
+        panic!("unexpected control executor port")
+    }
+    fn try_send_greeting_for_join_wave<'a>(
+        &'a self,
+        _greeting: NewMembersGreeting,
+    ) -> NewMembersFollowupFuture<'a, ()> {
+        panic!("unexpected control executor port")
+    }
+}
+
+impl TextTranslator for UnusedControlPorts {
+    type Error = std::convert::Infallible;
+    fn translate_text<'a>(
+        &'a self,
+        _text: &'a str,
+        _target_lang: &'a str,
+    ) -> TranslateProviderFuture<'a, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+}
+
+impl TranslateEffects for UnusedControlPorts {
+    type Error = std::convert::Infallible;
+    fn send_translate_notice<'a>(
+        &'a self,
+        _message: TranslateCommandMessage,
+        _text: String,
+        _delete_after: Duration,
+    ) -> TranslateEffectFuture<'a, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+    fn send_translation_result<'a>(
+        &'a self,
+        _plan: TranslateResultPlan,
+    ) -> TranslateEffectFuture<'a, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+}
+
+impl MemberStateControlJobEffects for UnusedControlPorts {
+    fn sync_chat_admins<'a>(&'a self, _chat_id: i64) -> MemberStateControlJobFuture<'a> {
+        panic!("unexpected control executor port")
+    }
+}
+
+impl CheckinControlJobEffects for UnusedControlPorts {
+    type Error = std::convert::Infallible;
+    fn run_checkin_game<'a>(
+        &'a self,
+        _job_id: i64,
+        _params: &'a ControlJobParams,
+    ) -> CheckinControlJobFuture<'a, Self::Error> {
+        panic!("unexpected control executor port")
+    }
+}
diff --git a/crates/openplotva-app/src/delete_drawing.rs b/crates/openplotva-app/src/delete_drawing.rs
index a30a6050..c2322a22 100644
--- a/crates/openplotva-app/src/delete_drawing.rs
+++ b/crates/openplotva-app/src/delete_drawing.rs
@@ -1,28 +1,36 @@
 //! App-level fetcher `/delete_drawing` command behavior.
 
+#[cfg(test)]
+use crate::callbacks::DeleteMemberFuture;
+use crate::callbacks::{
+    DeleteCallbackEffects, DeleteMemberApi, can_delete_owned_content, try_execute_delete_method,
+};
+#[cfg(test)]
+use carapax::types::ChatMember as TelegramChatMember;
+#[cfg(test)]
+use openplotva_telegram::TelegramOutboundMethod;
 use std::{fmt, future::Future, pin::Pin, sync::Arc, time::Duration};
 
 use carapax::types::{
-    CallbackQuery as TelegramCallbackQuery, ChatMember as TelegramChatMember,
-    MaybeInaccessibleMessage, Message as TelegramMessage, Update as TelegramUpdate,
-    UpdateType as TelegramUpdateType,
+    CallbackQuery as TelegramCallbackQuery, MaybeInaccessibleMessage, Message as TelegramMessage,
+    Update as TelegramUpdate, UpdateType as TelegramUpdateType,
 };
 use openplotva_telegram::{
     CallbackActionParse, CallbackAnswerRequest, ChatRef, DeleteMessageRequest, DispatcherQueue,
     EditCaptionMessageRequest, EditReplyMarkupMessageRequest, EditTextMessageRequest,
-    OutboundBuildError, ReplyMarkup, ReplyMessageRef, TELEGRAM_PARSE_MODE_HTML,
-    TelegramOutboundMethod, TextMessageRequest, build_callback_answer_method,
-    build_delete_drawing_confirm_keyboard, build_delete_drawing_frame_confirm_keyboard,
-    build_delete_drawing_frame_picker_keyboard, build_delete_drawing_initial_keyboard,
-    build_delete_message_method, build_edit_caption_message_method,
-    build_edit_reply_markup_message_method, build_edit_text_message_method,
-    build_get_chat_member_method, parse_callback_action, parse_callback_i64,
+    OutboundBuildError, ReplyMarkup, ReplyMessageRef, TELEGRAM_PARSE_MODE_HTML, TextMessageRequest,
+    build_callback_answer_method, build_delete_drawing_confirm_keyboard,
+    build_delete_drawing_frame_confirm_keyboard, build_delete_drawing_frame_picker_keyboard,
+    build_delete_drawing_initial_keyboard, build_delete_message_method,
+    build_edit_caption_message_method, build_edit_reply_markup_message_method,
+    build_edit_text_message_method, parse_callback_action, parse_callback_i64,
 };
 use openplotva_updates::parse_leading_bot_command;
 use thiserror::Error;
 use time::OffsetDateTime;
 
 use crate::updates::UpdateHandler;
+
 use crate::virtual_messages::{
     QueueTextRequest, VirtualIdFactory, monotonic_virtual_id_factory, queue_text_message_parts,
 };
@@ -162,37 +170,6 @@ impl DeleteDrawingCallbackStore for openplotva_storage::RedisLastGenerationStore
     }
 }
 
-/// Boxed future returned by Telegram membership APIs.
-pub type DeleteDrawingMemberFuture<'a, E> =
-    Pin<Box<dyn Future<Output = Result<TelegramChatMember, E>> + Send + 'a>>;
-
-pub trait DeleteDrawingMemberApi {
-    /// Concrete API error.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    /// Fetch one Telegram chat member.
-    fn get_chat_member<'a>(
-        &'a self,
-        chat_id: i64,
-        user_id: i64,
-    ) -> DeleteDrawingMemberFuture<'a, Self::Error>;
-}
-
-impl DeleteDrawingMemberApi for openplotva_telegram::TelegramClient {
-    type Error = carapax::api::ExecuteError;
-
-    fn get_chat_member<'a>(
-        &'a self,
-        chat_id: i64,
-        user_id: i64,
-    ) -> DeleteDrawingMemberFuture<'a, Self::Error> {
-        Box::pin(async move {
-            self.execute(build_get_chat_member_method(chat_id, user_id))
-                .await
-        })
-    }
-}
-
 /// Boxed future returned by VIP status lookups.
 pub type DeleteDrawingVipFuture<'a> = Pin<Box<dyn Future<Output = bool> + Send + 'a>>;
 
@@ -275,28 +252,6 @@ impl DeleteDrawingCommandEffects for DeleteDrawingCommandDispatcherEffects {
     }
 }
 
-pub trait DeleteDrawingCallbackEffects {
-    /// Concrete effect error.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    /// Execute one direct Telegram Bot API method.
-    fn execute_delete_drawing_method<'a>(
-        &'a self,
-        method: TelegramOutboundMethod,
-    ) -> DeleteDrawingEffectFuture<'a, Self::Error>;
-}
-
-impl DeleteDrawingCallbackEffects for openplotva_telegram::TelegramClient {
-    type Error = carapax::api::ExecuteError;
-
-    fn execute_delete_drawing_method<'a>(
-        &'a self,
-        method: TelegramOutboundMethod,
-    ) -> DeleteDrawingEffectFuture<'a, Self::Error> {
-        Box::pin(async move { method.execute_with(self).await.map(|_| ()) })
-    }
-}
-
 /// Result of one decoded update through the delete-drawing wrapper.
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub enum DeleteDrawingCommandOutcome {
@@ -432,9 +387,9 @@ impl<Store, MemberApi, Vip, Effects, Next> UpdateHandler
     for DeleteDrawingCallbackUpdateHandler<Store, MemberApi, Vip, Effects, Next>
 where
     Store: DeleteDrawingCallbackStore + Send + Sync,
-    MemberApi: DeleteDrawingMemberApi + Send + Sync,
+    MemberApi: DeleteMemberApi + Send + Sync,
     Vip: DeleteDrawingVipStatus + Send + Sync,
-    Effects: DeleteDrawingCallbackEffects + Send + Sync,
+    Effects: DeleteCallbackEffects + Send + Sync,
     Next: UpdateHandler + Send + Sync,
 {
     type Error = DeleteDrawingCallbackError;
@@ -509,9 +464,9 @@ pub async fn handle_delete_drawing_callback_update_or_else<
 ) -> Result<DeleteDrawingCallbackOutcome, DeleteDrawingCallbackError>
 where
     Store: DeleteDrawingCallbackStore + Sync,
-    MemberApi: DeleteDrawingMemberApi + Sync,
+    MemberApi: DeleteMemberApi + Sync,
     Vip: DeleteDrawingVipStatus + Sync,
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
     HandleFn: FnOnce(TelegramUpdate) -> HandleFuture,
     HandleFuture: Future<Output = Result<(), HandleError>>,
     HandleError: fmt::Display,
@@ -558,11 +513,11 @@ pub async fn handle_delete_drawing_callback<Store, MemberApi, Vip, Effects>(
 ) -> DeleteDrawingCallbackOutcome
 where
     Store: DeleteDrawingCallbackStore + Sync,
-    MemberApi: DeleteDrawingMemberApi + Sync,
+    MemberApi: DeleteMemberApi + Sync,
     Vip: DeleteDrawingVipStatus + Sync,
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
-    if !is_authorized_for_delete_drawing(member_api, query, data.user_id, data.chat_id).await {
+    if !can_delete_owned_content(member_api, query, data.user_id, data.chat_id).await {
         try_answer_callback(
             effects,
             &query.id,
@@ -706,7 +661,7 @@ async fn handle_delete_drawing_init<Store, Vip, Effects>(
 where
     Store: DeleteDrawingCallbackStore + Sync,
     Vip: DeleteDrawingVipStatus + Sync,
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     let Some(generation) = load_callback_generation(store, data, true).await else {
         try_answer_callback(
@@ -755,7 +710,7 @@ async fn handle_delete_drawing_confirm<Store, Effects>(
 ) -> DeleteDrawingCallbackOutcome
 where
     Store: DeleteDrawingCallbackStore + Sync,
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     let Some(generation) = load_callback_generation(store, data, false).await else {
         try_answer_callback(
@@ -800,7 +755,7 @@ async fn handle_delete_drawing_frame_pick<Vip, Effects>(
 ) -> DeleteDrawingCallbackOutcome
 where
     Vip: DeleteDrawingVipStatus + Sync,
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     if !vip.is_delete_drawing_vip(i64::from(query.from.id)).await {
         try_answer_callback(
@@ -843,7 +798,7 @@ async fn handle_delete_drawing_frame_confirm<Store, Vip, Effects>(
 where
     Store: DeleteDrawingCallbackStore + Sync,
     Vip: DeleteDrawingVipStatus + Sync,
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     if !vip.is_delete_drawing_vip(i64::from(query.from.id)).await {
         try_answer_callback(
@@ -970,7 +925,7 @@ async fn handle_delete_drawing_close<Effects>(
     control_message: DeleteDrawingControlMessage,
 ) -> DeleteDrawingCallbackOutcome
 where
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     try_delete_message(
         effects,
@@ -1045,7 +1000,7 @@ async fn try_answer_callback<Effects>(
     show_alert: bool,
     context: &'static str,
 ) where
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     let request = CallbackAnswerRequest {
         callback_query_id: query_id.to_owned(),
@@ -1054,7 +1009,7 @@ async fn try_answer_callback<Effects>(
         url: String::new(),
         cache_time: 0,
     };
-    try_execute_delete_drawing_method(
+    try_execute_delete_method(
         effects,
         build_callback_answer_method(&request).into(),
         context,
@@ -1067,10 +1022,10 @@ async fn try_edit_reply_markup<Effects>(
     request: EditReplyMarkupMessageRequest,
     context: &'static str,
 ) where
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     match build_edit_reply_markup_message_method(&request) {
-        Ok(method) => try_execute_delete_drawing_method(effects, method.into(), context).await,
+        Ok(method) => try_execute_delete_method(effects, method.into(), context).await,
         Err(error) => tracing::warn!(message = %error, "failed to build delete drawing method"),
     }
 }
@@ -1080,10 +1035,10 @@ async fn try_edit_text<Effects>(
     request: EditTextMessageRequest,
     context: &'static str,
 ) where
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     match build_edit_text_message_method(&request) {
-        Ok(method) => try_execute_delete_drawing_method(effects, method.into(), context).await,
+        Ok(method) => try_execute_delete_method(effects, method.into(), context).await,
         Err(error) => tracing::warn!(message = %error, "failed to build delete drawing method"),
     }
 }
@@ -1093,10 +1048,10 @@ async fn try_edit_caption<Effects>(
     request: EditCaptionMessageRequest,
     context: &'static str,
 ) where
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     match build_edit_caption_message_method(&request) {
-        Ok(method) => try_execute_delete_drawing_method(effects, method.into(), context).await,
+        Ok(method) => try_execute_delete_method(effects, method.into(), context).await,
         Err(error) => tracing::warn!(message = %error, "failed to build delete drawing method"),
     }
 }
@@ -1107,75 +1062,17 @@ async fn try_delete_message<Effects>(
     message_id: i64,
     context: &'static str,
 ) where
-    Effects: DeleteDrawingCallbackEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     match build_delete_message_method(&DeleteMessageRequest {
         chat_id,
         message_id,
     }) {
-        Ok(method) => try_execute_delete_drawing_method(effects, method.into(), context).await,
+        Ok(method) => try_execute_delete_method(effects, method.into(), context).await,
         Err(error) => tracing::warn!(message = %error, "failed to build delete drawing method"),
     }
 }
 
-async fn try_execute_delete_drawing_method<Effects>(
-    effects: &Effects,
-    method: TelegramOutboundMethod,
-    context: &'static str,
-) where
-    Effects: DeleteDrawingCallbackEffects + Sync,
-{
-    let method_name = method.method_name();
-    if let Err(error) = effects.execute_delete_drawing_method(method).await {
-        tracing::warn!(
-            message = %error,
-            method = method_name,
-            context,
-            "delete drawing callback Telegram side effect failed"
-        );
-    }
-}
-
-async fn is_authorized_for_delete_drawing<MemberApi>(
-    member_api: &MemberApi,
-    query: &TelegramCallbackQuery,
-    data_user_id: i64,
-    data_chat_id: i64,
-) -> bool
-where
-    MemberApi: DeleteDrawingMemberApi + Sync,
-{
-    let requester_id = i64::from(query.from.id);
-    if requester_id == data_user_id {
-        return true;
-    }
-
-    match member_api.get_chat_member(data_chat_id, requester_id).await {
-        Ok(member) => telegram_member_can_delete_drawing(&member),
-        Err(error) => {
-            tracing::warn!(
-                message = %error,
-                chat_id = data_chat_id,
-                user_id = requester_id,
-                "failed to authorize delete drawing callback"
-            );
-            false
-        }
-    }
-}
-
-#[must_use]
-pub fn telegram_member_can_delete_drawing(member: &TelegramChatMember) -> bool {
-    match member {
-        TelegramChatMember::Creator(_) => true,
-        TelegramChatMember::Administrator(admin) => admin.can_delete_messages,
-        TelegramChatMember::Kicked(_)
-        | TelegramChatMember::Left(_)
-        | TelegramChatMember::Member { .. }
-        | TelegramChatMember::Restricted(_) => false,
-    }
-}
-
 #[must_use]
 pub fn plan_delete_drawing_frame(
     generation: &LastGeneration,
@@ -2277,10 +2174,10 @@ mod tests {
         }
     }
 
-    impl DeleteDrawingCallbackEffects for EffectsStub {
+    impl DeleteCallbackEffects for EffectsStub {
         type Error = io::Error;
 
-        fn execute_delete_drawing_method<'a>(
+        fn execute_delete_method<'a>(
             &'a self,
             method: TelegramOutboundMethod,
         ) -> DeleteDrawingEffectFuture<'a, Self::Error> {
@@ -2361,14 +2258,14 @@ mod tests {
         }
     }
 
-    impl DeleteDrawingMemberApi for MemberApiStub {
+    impl DeleteMemberApi for MemberApiStub {
         type Error = io::Error;
 
         fn get_chat_member<'a>(
             &'a self,
             chat_id: i64,
             user_id: i64,
-        ) -> DeleteDrawingMemberFuture<'a, Self::Error> {
+        ) -> DeleteMemberFuture<'a, Self::Error> {
             Box::pin(async move {
                 self.calls
                     .lock()
diff --git a/crates/openplotva-app/src/delete_lyrics.rs b/crates/openplotva-app/src/delete_lyrics.rs
index 259df1c8..7f3207bb 100644
--- a/crates/openplotva-app/src/delete_lyrics.rs
+++ b/crates/openplotva-app/src/delete_lyrics.rs
@@ -1,17 +1,27 @@
 //! App-level generated-lyrics delete callback behavior.
 
-use std::{fmt, future::Future, pin::Pin, sync::Arc};
+#[cfg(test)]
+use crate::callbacks::DeleteEffectFuture;
+#[cfg(test)]
+use crate::callbacks::DeleteMemberFuture;
+use crate::callbacks::{
+    DeleteCallbackEffects, DeleteMemberApi, can_delete_owned_content, try_execute_delete_method,
+};
+#[cfg(test)]
+use carapax::types::ChatMember as TelegramChatMember;
+#[cfg(test)]
+use openplotva_telegram::TelegramOutboundMethod;
+use std::{fmt, future::Future, sync::Arc};
 
 use carapax::types::{
-    CallbackQuery as TelegramCallbackQuery, ChatMember as TelegramChatMember,
-    MaybeInaccessibleMessage, Update as TelegramUpdate, UpdateType as TelegramUpdateType,
+    CallbackQuery as TelegramCallbackQuery, MaybeInaccessibleMessage, Update as TelegramUpdate,
+    UpdateType as TelegramUpdateType,
 };
 use openplotva_telegram::{
     CallbackActionParse, CallbackAnswerRequest, ChatRef, DeleteMessageRequest,
-    EditReplyMarkupMessageRequest, TelegramOutboundMethod, build_callback_answer_method,
-    build_delete_message_method, build_edit_reply_markup_message_method,
-    build_get_chat_member_method, build_lyrics_delete_confirm_keyboard, parse_callback_action,
-    parse_callback_i64,
+    EditReplyMarkupMessageRequest, build_callback_answer_method, build_delete_message_method,
+    build_edit_reply_markup_message_method, build_lyrics_delete_confirm_keyboard,
+    parse_callback_action, parse_callback_i64,
 };
 use thiserror::Error;
 
@@ -20,62 +30,6 @@ use crate::updates::UpdateHandler;
 const DELETE_LYRICS_AUTH_ALERT_TEXT: &str = "Удаление доступно только автору или администраторам.";
 const DELETE_LYRICS_DELETED_TEXT: &str = "✅ Текст удалён";
 
-/// Boxed future returned by Telegram membership APIs.
-pub type DeleteLyricsMemberFuture<'a, E> =
-    Pin<Box<dyn Future<Output = Result<TelegramChatMember, E>> + Send + 'a>>;
-
-pub trait DeleteLyricsMemberApi {
-    /// Concrete API error.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    /// Fetch one Telegram chat member.
-    fn get_chat_member<'a>(
-        &'a self,
-        chat_id: i64,
-        user_id: i64,
-    ) -> DeleteLyricsMemberFuture<'a, Self::Error>;
-}
-
-impl DeleteLyricsMemberApi for openplotva_telegram::TelegramClient {
-    type Error = carapax::api::ExecuteError;
-
-    fn get_chat_member<'a>(
-        &'a self,
-        chat_id: i64,
-        user_id: i64,
-    ) -> DeleteLyricsMemberFuture<'a, Self::Error> {
-        Box::pin(async move {
-            self.execute(build_get_chat_member_method(chat_id, user_id))
-                .await
-        })
-    }
-}
-
-/// Boxed future returned by delete-lyrics effects.
-pub type DeleteLyricsEffectFuture<'a, E> = Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
-
-pub trait DeleteLyricsEffects {
-    /// Concrete effect error.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    /// Execute one direct Telegram Bot API method.
-    fn execute_delete_lyrics_method<'a>(
-        &'a self,
-        method: TelegramOutboundMethod,
-    ) -> DeleteLyricsEffectFuture<'a, Self::Error>;
-}
-
-impl DeleteLyricsEffects for openplotva_telegram::TelegramClient {
-    type Error = carapax::api::ExecuteError;
-
-    fn execute_delete_lyrics_method<'a>(
-        &'a self,
-        method: TelegramOutboundMethod,
-    ) -> DeleteLyricsEffectFuture<'a, Self::Error> {
-        Box::pin(async move { method.execute_with(self).await.map(|_| ()) })
-    }
-}
-
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct DeleteLyricsCallbackData {
     pub action: String,
@@ -138,8 +92,8 @@ impl<MemberApi, Effects, Next> DeleteLyricsCallbackUpdateHandler<MemberApi, Effe
 impl<MemberApi, Effects, Next> UpdateHandler
     for DeleteLyricsCallbackUpdateHandler<MemberApi, Effects, Next>
 where
-    MemberApi: DeleteLyricsMemberApi + Send + Sync,
-    Effects: DeleteLyricsEffects + Send + Sync,
+    MemberApi: DeleteMemberApi + Send + Sync,
+    Effects: DeleteCallbackEffects + Send + Sync,
     Next: UpdateHandler + Send + Sync,
 {
     type Error = DeleteLyricsCallbackError;
@@ -169,8 +123,8 @@ pub async fn handle_delete_lyrics_callback_update_or_else<
     handle_other: HandleFn,
 ) -> Result<DeleteLyricsCallbackOutcome, DeleteLyricsCallbackError>
 where
-    MemberApi: DeleteLyricsMemberApi + Sync,
-    Effects: DeleteLyricsEffects + Sync,
+    MemberApi: DeleteMemberApi + Sync,
+    Effects: DeleteCallbackEffects + Sync,
     HandleFn: FnOnce(TelegramUpdate) -> HandleFuture,
     HandleFuture: Future<Output = Result<(), HandleError>>,
     HandleError: fmt::Display,
@@ -206,15 +160,15 @@ pub async fn handle_delete_lyrics_callback<MemberApi, Effects>(
     data: DeleteLyricsCallbackData,
 ) -> DeleteLyricsCallbackOutcome
 where
-    MemberApi: DeleteLyricsMemberApi + Sync,
-    Effects: DeleteLyricsEffects + Sync,
+    MemberApi: DeleteMemberApi + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     if data.user_id == 0 || data.chat_id == 0 {
         try_answer_callback(effects, &query.id, "", false, "bad lyrics data ack").await;
         return DeleteLyricsCallbackOutcome::BadDataAck;
     }
 
-    if !is_authorized_for_delete_lyrics(member_api, query, data.user_id, data.chat_id).await {
+    if !can_delete_owned_content(member_api, query, data.user_id, data.chat_id).await {
         try_answer_callback(
             effects,
             &query.id,
@@ -270,7 +224,7 @@ async fn try_answer_callback<Effects>(
     show_alert: bool,
     context: &'static str,
 ) where
-    Effects: DeleteLyricsEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     let request = CallbackAnswerRequest {
         callback_query_id: query_id.to_owned(),
@@ -279,7 +233,7 @@ async fn try_answer_callback<Effects>(
         url: String::new(),
         cache_time: 0,
     };
-    try_execute_delete_lyrics_method(
+    try_execute_delete_method(
         effects,
         build_callback_answer_method(&request).into(),
         context,
@@ -292,10 +246,10 @@ async fn try_edit_reply_markup<Effects>(
     request: EditReplyMarkupMessageRequest,
     context: &'static str,
 ) where
-    Effects: DeleteLyricsEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     match build_edit_reply_markup_message_method(&request) {
-        Ok(method) => try_execute_delete_lyrics_method(effects, method.into(), context).await,
+        Ok(method) => try_execute_delete_method(effects, method.into(), context).await,
         Err(error) => tracing::warn!(message = %error, "failed to build delete lyrics method"),
     }
 }
@@ -306,75 +260,17 @@ async fn try_delete_message<Effects>(
     message_id: i64,
     context: &'static str,
 ) where
-    Effects: DeleteLyricsEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     match build_delete_message_method(&DeleteMessageRequest {
         chat_id,
         message_id,
     }) {
-        Ok(method) => try_execute_delete_lyrics_method(effects, method.into(), context).await,
+        Ok(method) => try_execute_delete_method(effects, method.into(), context).await,
         Err(error) => tracing::warn!(message = %error, "failed to build delete lyrics method"),
     }
 }
 
-async fn try_execute_delete_lyrics_method<Effects>(
-    effects: &Effects,
-    method: TelegramOutboundMethod,
-    context: &'static str,
-) where
-    Effects: DeleteLyricsEffects + Sync,
-{
-    let method_name = method.method_name();
-    if let Err(error) = effects.execute_delete_lyrics_method(method).await {
-        tracing::warn!(
-            message = %error,
-            method = method_name,
-            context,
-            "delete lyrics callback Telegram side effect failed"
-        );
-    }
-}
-
-async fn is_authorized_for_delete_lyrics<MemberApi>(
-    member_api: &MemberApi,
-    query: &TelegramCallbackQuery,
-    data_user_id: i64,
-    data_chat_id: i64,
-) -> bool
-where
-    MemberApi: DeleteLyricsMemberApi + Sync,
-{
-    let requester_id = i64::from(query.from.id);
-    if requester_id == data_user_id {
-        return true;
-    }
-
-    match member_api.get_chat_member(data_chat_id, requester_id).await {
-        Ok(member) => telegram_member_can_delete_lyrics(&member),
-        Err(error) => {
-            tracing::warn!(
-                message = %error,
-                chat_id = data_chat_id,
-                user_id = requester_id,
-                "failed to authorize delete lyrics callback"
-            );
-            false
-        }
-    }
-}
-
-#[must_use]
-pub fn telegram_member_can_delete_lyrics(member: &TelegramChatMember) -> bool {
-    match member {
-        TelegramChatMember::Creator(_) => true,
-        TelegramChatMember::Administrator(admin) => admin.can_delete_messages,
-        TelegramChatMember::Kicked(_)
-        | TelegramChatMember::Left(_)
-        | TelegramChatMember::Member { .. }
-        | TelegramChatMember::Restricted(_) => false,
-    }
-}
-
 fn delete_lyrics_callback_data_from_query(
     query: &TelegramCallbackQuery,
 ) -> Option<DeleteLyricsCallbackData> {
@@ -767,14 +663,14 @@ mod tests {
         }
     }
 
-    impl DeleteLyricsMemberApi for MemberApiStub {
+    impl DeleteMemberApi for MemberApiStub {
         type Error = io::Error;
 
         fn get_chat_member<'a>(
             &'a self,
             chat_id: i64,
             user_id: i64,
-        ) -> DeleteLyricsMemberFuture<'a, Self::Error> {
+        ) -> DeleteMemberFuture<'a, Self::Error> {
             Box::pin(async move {
                 self.calls
                     .lock()
@@ -804,13 +700,13 @@ mod tests {
         }
     }
 
-    impl DeleteLyricsEffects for EffectsStub {
+    impl DeleteCallbackEffects for EffectsStub {
         type Error = io::Error;
 
-        fn execute_delete_lyrics_method<'a>(
+        fn execute_delete_method<'a>(
             &'a self,
             method: TelegramOutboundMethod,
-        ) -> DeleteLyricsEffectFuture<'a, Self::Error> {
+        ) -> DeleteEffectFuture<'a, Self::Error> {
             Box::pin(async move {
                 let name = method.method_name().to_owned();
                 let payload = method_payload(method)?;
diff --git a/crates/openplotva-app/src/delete_message.rs b/crates/openplotva-app/src/delete_message.rs
index 086715c5..11319ead 100644
--- a/crates/openplotva-app/src/delete_message.rs
+++ b/crates/openplotva-app/src/delete_message.rs
@@ -1,6 +1,15 @@
 //! App-level generic callback message deletion behavior.
 
-use std::{fmt, future::Future, pin::Pin, sync::Arc};
+#[cfg(test)]
+use crate::callbacks::DeleteEffectFuture;
+#[cfg(test)]
+use crate::callbacks::DeleteMemberFuture;
+use crate::callbacks::{
+    DeleteCallbackEffects, DeleteMemberApi, telegram_member_can_delete, try_execute_delete_method,
+};
+#[cfg(test)]
+use openplotva_telegram::TelegramOutboundMethod;
+use std::{fmt, future::Future, sync::Arc};
 
 use carapax::types::{
     CallbackQuery as TelegramCallbackQuery, ChatMember as TelegramChatMember,
@@ -8,8 +17,7 @@ use carapax::types::{
 };
 use openplotva_telegram::{
     CallbackActionParse, CallbackAnswerRequest, ChatRef, DeleteMessageRequest,
-    TelegramOutboundMethod, build_callback_answer_method, build_delete_message_method,
-    build_get_chat_member_method, parse_callback_action,
+    build_callback_answer_method, build_delete_message_method, parse_callback_action,
 };
 use thiserror::Error;
 
@@ -18,63 +26,6 @@ use crate::updates::UpdateHandler;
 const DELETE_CALLBACK_ACTION: &str = "delete";
 const DELETE_CALLBACK_UNAUTHORIZED_TEXT: &str = "Я подчинюсь только автору или администраторам.";
 
-/// Boxed future returned by Telegram membership APIs.
-pub type DeleteMessageMemberFuture<'a, E> =
-    Pin<Box<dyn Future<Output = Result<TelegramChatMember, E>> + Send + 'a>>;
-
-pub trait DeleteMessageMemberApi {
-    /// Concrete API error.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    /// Fetch one Telegram chat member.
-    fn get_chat_member<'a>(
-        &'a self,
-        chat_id: i64,
-        user_id: i64,
-    ) -> DeleteMessageMemberFuture<'a, Self::Error>;
-}
-
-impl DeleteMessageMemberApi for openplotva_telegram::TelegramClient {
-    type Error = carapax::api::ExecuteError;
-
-    fn get_chat_member<'a>(
-        &'a self,
-        chat_id: i64,
-        user_id: i64,
-    ) -> DeleteMessageMemberFuture<'a, Self::Error> {
-        Box::pin(async move {
-            self.execute(build_get_chat_member_method(chat_id, user_id))
-                .await
-        })
-    }
-}
-
-/// Boxed future returned by delete callback effects.
-pub type DeleteMessageEffectFuture<'a, E> =
-    Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
-
-pub trait DeleteMessageEffects {
-    /// Concrete effect error.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    /// Execute one direct Telegram Bot API method.
-    fn execute_delete_message_method<'a>(
-        &'a self,
-        method: TelegramOutboundMethod,
-    ) -> DeleteMessageEffectFuture<'a, Self::Error>;
-}
-
-impl DeleteMessageEffects for openplotva_telegram::TelegramClient {
-    type Error = carapax::api::ExecuteError;
-
-    fn execute_delete_message_method<'a>(
-        &'a self,
-        method: TelegramOutboundMethod,
-    ) -> DeleteMessageEffectFuture<'a, Self::Error> {
-        Box::pin(async move { method.execute_with(self).await.map(|_| ()) })
-    }
-}
-
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct DeleteMessageCallbackTarget {
     /// Callback message chat.
@@ -132,8 +83,8 @@ impl<MemberApi, Effects, Next> DeleteMessageCallbackUpdateHandler<MemberApi, Eff
 impl<MemberApi, Effects, Next> UpdateHandler
     for DeleteMessageCallbackUpdateHandler<MemberApi, Effects, Next>
 where
-    MemberApi: DeleteMessageMemberApi + Send + Sync,
-    Effects: DeleteMessageEffects + Send + Sync,
+    MemberApi: DeleteMemberApi + Send + Sync,
+    Effects: DeleteCallbackEffects + Send + Sync,
     Next: UpdateHandler + Send + Sync,
 {
     type Error = DeleteMessageCallbackError;
@@ -163,8 +114,8 @@ pub async fn handle_delete_message_callback_update_or_else<
     handle_other: HandleFn,
 ) -> Result<DeleteMessageCallbackOutcome, DeleteMessageCallbackError>
 where
-    MemberApi: DeleteMessageMemberApi + Sync,
-    Effects: DeleteMessageEffects + Sync,
+    MemberApi: DeleteMemberApi + Sync,
+    Effects: DeleteCallbackEffects + Sync,
     HandleFn: FnOnce(TelegramUpdate) -> HandleFuture,
     HandleFuture: Future<Output = Result<(), HandleError>>,
     HandleError: fmt::Display,
@@ -196,8 +147,8 @@ pub async fn handle_delete_message_callback<MemberApi, Effects>(
     query: &TelegramCallbackQuery,
 ) -> DeleteMessageCallbackOutcome
 where
-    MemberApi: DeleteMessageMemberApi + Sync,
-    Effects: DeleteMessageEffects + Sync,
+    MemberApi: DeleteMemberApi + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     let Some(target) = delete_message_callback_target(query) else {
         try_answer_callback(
@@ -268,20 +219,7 @@ fn delete_callback_allows_delete(
     member: &TelegramChatMember,
 ) -> bool {
     target.reply_chat_id == target.message_chat.id
-        && (target.reply_author_user_id == Some(requester_id)
-            || telegram_member_can_delete_message(member))
-}
-
-#[must_use]
-pub fn telegram_member_can_delete_message(member: &TelegramChatMember) -> bool {
-    match member {
-        TelegramChatMember::Creator(_) => true,
-        TelegramChatMember::Administrator(admin) => admin.can_delete_messages,
-        TelegramChatMember::Kicked(_)
-        | TelegramChatMember::Left(_)
-        | TelegramChatMember::Member { .. }
-        | TelegramChatMember::Restricted(_) => false,
-    }
+        && (target.reply_author_user_id == Some(requester_id) || telegram_member_can_delete(member))
 }
 
 fn is_delete_message_callback(query: &TelegramCallbackQuery) -> bool {
@@ -326,7 +264,7 @@ async fn try_answer_callback<Effects>(
     cache_time: i64,
     context: &'static str,
 ) where
-    Effects: DeleteMessageEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     let request = CallbackAnswerRequest {
         callback_query_id: query_id.to_owned(),
@@ -335,7 +273,7 @@ async fn try_answer_callback<Effects>(
         url: String::new(),
         cache_time,
     };
-    try_execute_delete_message_method(
+    try_execute_delete_method(
         effects,
         build_callback_answer_method(&request).into(),
         context,
@@ -349,35 +287,17 @@ async fn try_delete_message<Effects>(
     message_id: i64,
     context: &'static str,
 ) where
-    Effects: DeleteMessageEffects + Sync,
+    Effects: DeleteCallbackEffects + Sync,
 {
     match build_delete_message_method(&DeleteMessageRequest {
         chat_id,
         message_id,
     }) {
-        Ok(method) => try_execute_delete_message_method(effects, method.into(), context).await,
+        Ok(method) => try_execute_delete_method(effects, method.into(), context).await,
         Err(error) => tracing::warn!(message = %error, "failed to build delete callback method"),
     }
 }
 
-async fn try_execute_delete_message_method<Effects>(
-    effects: &Effects,
-    method: TelegramOutboundMethod,
-    context: &'static str,
-) where
-    Effects: DeleteMessageEffects + Sync,
-{
-    let method_name = method.method_name();
-    if let Err(error) = effects.execute_delete_message_method(method).await {
-        tracing::warn!(
-            message = %error,
-            method = method_name,
-            context,
-            "generic delete callback Telegram side effect failed"
-        );
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -671,9 +591,9 @@ mod tests {
 
     #[test]
     fn delete_message_member_permission_matches_go_rights() {
-        assert!(telegram_member_can_delete_message(&creator(1)));
-        assert!(telegram_member_can_delete_message(&deleting_admin(2)));
-        assert!(!telegram_member_can_delete_message(&member(3)));
+        assert!(telegram_member_can_delete(&creator(1)));
+        assert!(telegram_member_can_delete(&deleting_admin(2)));
+        assert!(!telegram_member_can_delete(&member(3)));
     }
 
     #[derive(Default)]
@@ -695,14 +615,14 @@ mod tests {
         }
     }
 
-    impl DeleteMessageMemberApi for MemberApiStub {
+    impl DeleteMemberApi for MemberApiStub {
         type Error = io::Error;
 
         fn get_chat_member<'a>(
             &'a self,
             chat_id: i64,
             user_id: i64,
-        ) -> DeleteMessageMemberFuture<'a, Self::Error> {
+        ) -> DeleteMemberFuture<'a, Self::Error> {
             Box::pin(async move {
                 self.calls
                     .lock()
@@ -732,13 +652,13 @@ mod tests {
         }
     }
 
-    impl DeleteMessageEffects for EffectsStub {
+    impl DeleteCallbackEffects for EffectsStub {
         type Error = io::Error;
 
-        fn execute_delete_message_method<'a>(
+        fn execute_delete_method<'a>(
             &'a self,
             method: TelegramOutboundMethod,
-        ) -> DeleteMessageEffectFuture<'a, Self::Error> {
+        ) -> DeleteEffectFuture<'a, Self::Error> {
             Box::pin(async move {
                 let name = method.method_name().to_owned();
                 let payload = method_payload(method)?;
diff --git a/crates/openplotva-app/src/dialog_debounce.rs b/crates/openplotva-app/src/dialog_debounce.rs
index db840aea..feb05147 100644
--- a/crates/openplotva-app/src/dialog_debounce.rs
+++ b/crates/openplotva-app/src/dialog_debounce.rs
@@ -17,7 +17,7 @@ use tokio::task::JoinHandle;
 
 use crate::edited::EditedDialogJobUpdate;
 
-pub const GO_DIALOG_DEBOUNCE_INTERVAL: Duration = Duration::from_secs(5);
+pub const DIALOG_DEBOUNCE_INTERVAL: Duration = Duration::from_secs(5);
 pub type DialogDebounceAssignObserverFuture<'a> = Pin<Box<dyn Future<Output = ()> + Send + 'a>>;
 
 pub trait DialogDebounceAssignObserver: Send + Sync {
@@ -104,7 +104,7 @@ impl InMemoryDialogDebounce {
     #[must_use]
     pub fn delay_or_default(delay: Duration) -> Duration {
         if delay.is_zero() {
-            GO_DIALOG_DEBOUNCE_INTERVAL
+            DIALOG_DEBOUNCE_INTERVAL
         } else {
             delay
         }
@@ -357,13 +357,13 @@ mod tests {
 
     use crate::edited::EditedDialogJobUpdate;
 
-    use super::{DialogDebounceKey, GO_DIALOG_DEBOUNCE_INTERVAL, InMemoryDialogDebounce};
+    use super::{DIALOG_DEBOUNCE_INTERVAL, DialogDebounceKey, InMemoryDialogDebounce};
 
     #[test]
     fn debounce_delay_uses_go_default_for_zero_only() {
         assert_eq!(
             InMemoryDialogDebounce::delay_or_default(Duration::ZERO),
-            GO_DIALOG_DEBOUNCE_INTERVAL
+            DIALOG_DEBOUNCE_INTERVAL
         );
         assert_eq!(
             InMemoryDialogDebounce::delay_or_default(Duration::from_millis(150)),
diff --git a/crates/openplotva-app/src/dialog_jobs/effects.rs b/crates/openplotva-app/src/dialog_jobs/effects.rs
index 5bf42a61..a1df7ddb 100644
--- a/crates/openplotva-app/src/dialog_jobs/effects.rs
+++ b/crates/openplotva-app/src/dialog_jobs/effects.rs
@@ -15,7 +15,6 @@ use openplotva_telegram::{
     build_text_message_methods_without_link_previews,
     build_text_message_methods_without_link_previews_with_atomic_tail,
 };
-use sqlx::Row;
 use thiserror::Error;
 use time::OffsetDateTime;
 
@@ -29,15 +28,7 @@ use super::{
     DialogJobEffectFuture, DialogJobReceiptFuture, DialogJobReceiptLookupFuture,
     dialog_response_requires_rich,
 };
-
-/// Identity returned after all final-answer parts were accepted by one queue.
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub struct QueuedBatchReceipt {
-    pub batch_id: String,
-    pub operation_ids: Vec<String>,
-    delivery: QueuedDelivery,
-    delivery_complete: bool,
-}
+use crate::telegram_outbox::{QueuedBatchReceipt, telegram_outbox_ordering_key};
 
 /// Final-answer delivery behavior derived from the completed dialog session.
 #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
@@ -56,48 +47,6 @@ impl DialogAnswerSendOptions {
     }
 }
 
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-enum QueuedDelivery {
-    Dispatcher,
-    DurableOutbox,
-}
-
-impl QueuedBatchReceipt {
-    pub(crate) fn dispatcher(batch_id: String, operation_ids: Vec<String>) -> Self {
-        Self {
-            batch_id,
-            operation_ids,
-            delivery: QueuedDelivery::Dispatcher,
-            delivery_complete: false,
-        }
-    }
-
-    pub(crate) fn durable_outbox(
-        batch_id: String,
-        operation_ids: Vec<String>,
-        delivery_complete: bool,
-    ) -> Self {
-        Self {
-            batch_id,
-            operation_ids,
-            delivery: QueuedDelivery::DurableOutbox,
-            delivery_complete,
-        }
-    }
-
-    /// Whether taskman must wait for real Telegram receipts before completion.
-    #[must_use]
-    pub fn requires_delivery_wait(&self) -> bool {
-        self.delivery == QueuedDelivery::DurableOutbox
-    }
-
-    /// Whether every durable part already has a real Telegram receipt.
-    #[must_use]
-    pub fn delivery_complete(&self) -> bool {
-        self.requires_delivery_wait() && self.delivery_complete
-    }
-}
-
 /// Side effects performed after a provider returns a dialog answer.
 pub trait DialogJobEffects {
     /// Error returned by concrete side effects.
@@ -345,30 +294,19 @@ impl DialogJobEffects for DialogDispatcherEffects {
                 return Ok(None);
             };
             let batch_id = dialog_answer_batch_id(outbox.bot_id, dialog_job_id);
-            let rows = sqlx::query(
-                "SELECT operation_id, state FROM telegram_outbox \
-                 WHERE batch_id = $1 AND dialog_job_id = $2 \
-                 ORDER BY part_index",
-            )
-            .bind(&batch_id)
-            .bind(dialog_job_id)
-            .fetch_all(outbox.store.pool())
-            .await
-            .map_err(openplotva_storage::StorageError::from)?;
-            if rows.is_empty() {
+            let Some(queued) = outbox
+                .store
+                .queued_batch(outbox.bot_id, &batch_id, Some(dialog_job_id))
+                .await?
+            else {
                 return Ok(None);
-            }
-            let delivery_complete = rows.iter().all(|row| {
-                matches!(
-                    row.try_get::<String, _>("state").as_deref(),
-                    Ok("delivered")
-                )
-            });
-            let operation_ids = rows
+            };
+            let delivery_complete = queued.parts.iter().all(|part| part.state == "delivered");
+            let operation_ids = queued
+                .parts
                 .into_iter()
-                .map(|row| row.try_get("operation_id"))
-                .collect::<Result<Vec<String>, sqlx::Error>>()
-                .map_err(openplotva_storage::StorageError::from)?;
+                .map(|part| part.operation_id)
+                .collect();
             Ok(Some(QueuedBatchReceipt::durable_outbox(
                 batch_id,
                 operation_ids,
@@ -562,6 +500,7 @@ fn dialog_intermediate_outbox_batch(
     parts: Vec<TelegramOutboxPartInput>,
 ) -> TelegramOutboxBatchInput {
     TelegramOutboxBatchInput {
+        content_policy: openplotva_storage::TelegramOutboxContentPolicy::Immutable,
         batch_id: if params.meta["agent_final_reply"].as_bool() == Some(true) {
             dialog_answer_batch_id(bot_id, dialog_job_id)
         } else {
@@ -570,7 +509,7 @@ fn dialog_intermediate_outbox_batch(
         bot_id,
         chat_id: Some(params.chat_id),
         thread_id: params.thread_id,
-        ordering_key: dialog_outbox_ordering_key(bot_id, params.chat_id, params.thread_id),
+        ordering_key: telegram_outbox_ordering_key(bot_id, params.chat_id, params.thread_id),
         causation_update_id,
         dialog_job_id: Some(dialog_job_id),
         trigger_message_id: Some(i64::from(params.message_id)),
@@ -582,17 +521,6 @@ fn dialog_intermediate_outbox_batch(
 }
 
 /// Per-chat delivery order shared by dialog messages and the banners queued after them.
-pub(crate) fn dialog_outbox_ordering_key(
-    bot_id: i64,
-    chat_id: i64,
-    thread_id: Option<i32>,
-) -> String {
-    format!(
-        "dialog:{bot_id}:{chat_id}:{}",
-        thread_id.unwrap_or_default()
-    )
-}
-
 fn dialog_answer_batch_id(bot_id: i64, dialog_job_id: i64) -> String {
     format!("dialog-answer:v1:{bot_id}:{dialog_job_id}")
 }
@@ -662,11 +590,12 @@ async fn enqueue_durable_dialog_answer(
         .collect::<Result<Vec<_>, _>>()?;
     let batch_id = dialog_answer_batch_id(outbox.bot_id, dialog_job_id);
     let batch = TelegramOutboxBatchInput {
+        content_policy: openplotva_storage::TelegramOutboxContentPolicy::Immutable,
         batch_id: batch_id.clone(),
         bot_id: outbox.bot_id,
         chat_id: Some(params.chat_id),
         thread_id: params.thread_id,
-        ordering_key: dialog_outbox_ordering_key(outbox.bot_id, params.chat_id, params.thread_id),
+        ordering_key: telegram_outbox_ordering_key(outbox.bot_id, params.chat_id, params.thread_id),
         causation_update_id,
         dialog_job_id: Some(dialog_job_id),
         trigger_message_id: Some(i64::from(params.message_id)),
diff --git a/crates/openplotva-app/src/dialog_jobs/mod.rs b/crates/openplotva-app/src/dialog_jobs/mod.rs
index 9a80ce56..8fbd9e94 100644
--- a/crates/openplotva-app/src/dialog_jobs/mod.rs
+++ b/crates/openplotva-app/src/dialog_jobs/mod.rs
@@ -5,6 +5,7 @@
 
 use std::{future::Future, pin::Pin, time::Duration};
 
+use crate::telegram_outbox::QueuedBatchReceipt;
 use openplotva_dialog::DialogInput;
 use openplotva_taskman::{DIALOG_AIFARM_QUEUE_NAME, TEXT_QUEUE_NAME};
 use thiserror::Error;
diff --git a/crates/openplotva-app/src/dialog_messages.rs b/crates/openplotva-app/src/dialog_messages.rs
index b19d8c56..5908aef7 100644
--- a/crates/openplotva-app/src/dialog_messages.rs
+++ b/crates/openplotva-app/src/dialog_messages.rs
@@ -2277,7 +2277,7 @@ where
         .ok()
         .flatten()
         .unwrap_or_else(|| ChatSettings::defaults(chat_id));
-    if settings_row.reactivity_percentage == GO_SETTINGS_REACTIVITY_OFF {
+    if settings_row.reactivity_percentage == SETTINGS_REACTIVITY_OFF {
         return Ok(DialogMessageUpdateRoute::RandomSkippedReactivityOff);
     }
 
@@ -2409,7 +2409,7 @@ fn aifarm_dialog_max_output_tokens(
 }
 
 fn random_response_triggers(reactivity_percentage: i32, roll: i32) -> bool {
-    if reactivity_percentage == GO_SETTINGS_REACTIVITY_OFF {
+    if reactivity_percentage == SETTINGS_REACTIVITY_OFF {
         return false;
     }
     roll > 100 - reactivity_percentage
@@ -2443,7 +2443,7 @@ fn obscenify_string(text: &str, variant_roll: i32) -> String {
 fn first_obscenify_vowel_with_suffix(value: &str) -> Option<(&str, &str)> {
     let (index, _) = value
         .char_indices()
-        .find(|(_, ch)| GO_OBSCENIFY_VOWELS.contains(*ch))?;
+        .find(|(_, ch)| OBSCENIFY_VOWELS.contains(*ch))?;
     let next = index + value[index..].chars().next()?.len_utf8();
     (next < value.len()).then_some((&value[index..next], &value[next..]))
 }
@@ -2530,8 +2530,8 @@ const LONG_DIALOG_PHRASES: &[&str] = &[
     "review",
 ];
 
-const GO_SETTINGS_REACTIVITY_OFF: i32 = 0;
-const GO_OBSCENIFY_VOWELS: &str = "ауоыиэяюёе";
+const SETTINGS_REACTIVITY_OFF: i32 = 0;
+const OBSCENIFY_VOWELS: &str = "ауоыиэяюёе";
 
 #[cfg(test)]
 mod tests {
@@ -2657,7 +2657,7 @@ mod tests {
         let scheduler = TaskmanDialogMessageScheduler::new(
             Arc::clone(&queue),
             debounce,
-            crate::dialog_debounce::GO_DIALOG_DEBOUNCE_INTERVAL,
+            crate::dialog_debounce::DIALOG_DEBOUNCE_INTERVAL,
             durability,
         )
         .with_typing_effects(typing);
@@ -2700,7 +2700,7 @@ mod tests {
         let scheduler = TaskmanDialogMessageScheduler::new(
             Arc::clone(&queue),
             Arc::new(InMemoryDialogDebounce::new()),
-            crate::dialog_debounce::GO_DIALOG_DEBOUNCE_INTERVAL,
+            crate::dialog_debounce::DIALOG_DEBOUNCE_INTERVAL,
             Arc::new(NoopDialogTaskDurabilityBarrier),
         )
         .with_typing_effects(Arc::new(PendingTypingStub));
@@ -5520,6 +5520,20 @@ mod tests {
         let Ok(redis_url) = env::var("OPENPLOTVA_TEST_REDIS_URL") else {
             return Ok(());
         };
+        let Ok(dsn) = env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
+            return Ok(());
+        };
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(4)
+            .connect(&dsn)
+            .await?;
+        openplotva_storage::run_migrations_on(&pool).await?;
+        let (runtime, _) =
+            crate::task_queue::SharedTaskQueueRuntime::load_from_postgres_with_id_allocator(
+                openplotva_storage::PostgresTaskQueueStore::new(pool.clone()),
+                openplotva_taskman::TaskQueueIdAllocator::default(),
+            )
+            .await?;
         let redis_client = redis::Client::open(redis_url)?;
         let suffix = SystemTime::now().duration_since(UNIX_EPOCH)?.as_nanos();
         let key = format!("openplotva:test:decoded-song:{suffix}");
@@ -5542,7 +5556,7 @@ mod tests {
             .ok_or_else(|| std::io::Error::other("expected decoded song update"))?;
 
         let state_store = UpdateStateStoreStub::default();
-        let queue = Arc::new(InMemoryTaskQueue::new());
+        let queue = runtime.queue();
         let song_scheduler = crate::dialog_tools::TaskmanDialogToolAdapter::new(Arc::clone(&queue))
             .with_draw_image_vip_status(Arc::new(VipStatusStub(true)));
         let scheduler = SchedulerStub::default();
@@ -5602,19 +5616,34 @@ mod tests {
                 "user:99:Ada:ada_l".to_owned()
             ]
         );
-        assert_eq!(
+        assert!(matches!(
             *lock(&route),
-            Some(DialogMessageUpdateRoute::SongScheduled {
-                status: "scheduled".to_owned(),
-                no_reply: false,
-            })
-        );
-        assert!(scheduler.calls().is_empty());
+            Some(DialogMessageUpdateRoute::Scheduled { .. })
+        ));
+        assert_eq!(scheduler.calls().len(), 1);
+        assert_eq!(scheduler.metas()[0].requested_tool, "generate_song");
         assert!(effects.sent_song_notices().is_empty());
-        let job_id = {
+        let scheduled = song_scheduler
+            .schedule_song(crate::dialog_tools::SongScheduleRequest {
+                chat_id: -100,
+                message_id: 78,
+                user_id: 99,
+                user_full_name: "Ada".into(),
+                topic: "neon rain".into(),
+                message_text: "!song neon rain".into(),
+                message_meta: scheduler.metas()[0].clone(),
+                ..Default::default()
+            })
+            .await
+            .map_err(|error| std::io::Error::other(error.to_string()))?;
+        assert_eq!(scheduled.status, "scheduled");
+        let job_id = scheduled.job_id.expect("scheduled song job");
+        {
             let records = queue.records();
-            assert_eq!(records.len(), 1);
-            let record = &records[0];
+            let record = records
+                .iter()
+                .find(|record| record.id == job_id)
+                .expect("music job");
             assert_eq!(record.queue_name, MUSIC_VIP_QUEUE_NAME);
             assert_eq!(record.status, JobStatus::Pending);
             assert_eq!(record.job.title, "music");
@@ -5626,8 +5655,7 @@ mod tests {
             let music = record.job.data.music_data.as_ref().expect("music");
             assert_eq!(music.topic, "neon rain");
             assert_eq!(music.reference_file_id, "");
-            record.id
-        };
+        }
 
         let material_provider = MusicMaterialProviderStub::new(crate::music_jobs::SongMaterial {
             title: "Neon Rain".to_owned(),
@@ -5648,12 +5676,34 @@ mod tests {
         ));
         let music_files = MusicReferenceFileStoreCapture::default();
         let music_sender = MusicTelegramSenderCapture::new(vec![]);
-        let music_rich = Arc::new(crate::rich::MockRichSender::default());
+        let uploads = Arc::new(Mutex::new(Vec::new()));
+        let captured_uploads = uploads.clone();
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await?;
+        let uploader = openplotva_media::uploader::UploaderClient::new(
+            openplotva_media::uploader::UploaderConfig {
+                base_url: format!("http://{}", listener.local_addr()?),
+                secret: "test-secret".into(),
+                ..Default::default()
+            },
+        )?;
+        let server =
+            tokio::spawn(async move {
+                axum::serve(listener, axum::Router::new().route("/upload", axum::routing::post(
+                move |headers: axum::http::HeaderMap, body: axum::body::Bytes| async move {
+                    assert_eq!(headers["authorization"], "Bearer test-secret");
+                    captured_uploads.lock().expect("uploads").push(body);
+                    axum::Json(serde_json::json!({"url":"https://media.example.test/song.mp3"}))
+                }
+            ))).await
+            });
+        let store = openplotva_storage::PostgresTelegramOutboxStore::new(pool.clone());
         let music_effects = crate::music_jobs::TelegramMusicJobEffects::new(
             permissions,
             music_files.clone(),
             music_sender.clone(),
-            music_rich.clone(),
+            uploader,
+            Arc::new(crate::rich::RichOutbox::new(store.clone(), 7)),
+            openplotva_storage::PostgresGeneratedSongStore::new(pool.clone()),
         );
         let worker_report = crate::music_jobs::run_music_queue_once(
             &queue,
@@ -5669,7 +5719,7 @@ mod tests {
             crate::music_jobs::MusicQueuePollReport {
                 queue_name: MUSIC_VIP_QUEUE_NAME.to_owned(),
                 job_id: Some(job_id),
-                outcome: crate::music_jobs::MusicQueuePollOutcome::Completed,
+                outcome: crate::music_jobs::MusicQueuePollOutcome::WaitingDelivery,
                 error: None,
                 activity: crate::telegram_activity::TelegramActivitySnapshot::default(),
             }
@@ -5700,17 +5750,127 @@ mod tests {
             music_sender.methods().is_empty(),
             "song now sends one rich message, not classic audio + lyrics"
         );
-        {
-            let sent = music_rich.sent.lock().expect("rich sent");
-            assert_eq!(sent.len(), 1);
-            assert_eq!(sent[0].chat_id, -100);
-            assert_eq!(sent[0].reply_to_message_id, Some(78));
-            assert!(sent[0].html.contains(r#"<audio src="#));
-            assert!(sent[0].html.contains("Neon Rain"));
-            assert!(sent[0].html.contains("Synthwave"));
-            assert!(sent[0].html.contains("neon rain"));
+        assert_eq!(
+            queue
+                .records()
+                .into_iter()
+                .find(|record| record.id == job_id)
+                .expect("music job")
+                .status,
+            JobStatus::WaitingDelivery
+        );
+        assert_eq!(
+            queue
+                .records()
+                .into_iter()
+                .find(|record| record.id == job_id)
+                .expect("music job")
+                .result_message_id,
+            None
+        );
+        runtime.durability_barrier(job_id).await?;
+        let payload: serde_json::Value =
+            sqlx::query_scalar("SELECT payload FROM telegram_outbox WHERE dialog_job_id = $1")
+                .bind(job_id)
+                .fetch_one(&pool)
+                .await?;
+        assert_eq!(payload["chat_id"], -100);
+        assert_eq!(payload["options"]["reply_to_message_id"], 78);
+        let html = payload["html"].as_str().expect("rich HTML");
+        for expected in [
+            "https://media.example.test/song.mp3",
+            "Neon Rain",
+            "Synthwave",
+            "neon rain",
+        ] {
+            assert!(html.contains(expected), "{html}");
         }
-        assert_eq!(queue.records()[0].status, JobStatus::Completed);
+        {
+            let uploads = uploads.lock().expect("uploads");
+            assert_eq!(uploads.len(), 1);
+            let body = String::from_utf8_lossy(&uploads[0]);
+            assert!(body.contains("MP3"));
+            assert!(body.contains("audio/mpeg"));
+        }
+        let (restored, _) =
+            crate::task_queue::SharedTaskQueueRuntime::load_from_postgres_with_id_allocator(
+                openplotva_storage::PostgresTaskQueueStore::new(pool.clone()),
+                openplotva_taskman::TaskQueueIdAllocator::default(),
+            )
+            .await?;
+        let queue = restored.queue();
+        assert_eq!(
+            queue
+                .records()
+                .into_iter()
+                .find(|record| record.id == job_id)
+                .expect("music job")
+                .status,
+            JobStatus::WaitingDelivery
+        );
+        let resolver = crate::telegram_outbox::RunAwareTelegramOutboxJobResolver::new(
+            restored,
+            crate::runtime_llm_runs::RuntimeLlmRunBuffer::new(4),
+            openplotva_storage::gradius_ads::PostgresGradiusAdStore::new(pool.clone()),
+            store.clone(),
+            None,
+        );
+        let (stop_tx, stop_rx) = tokio::sync::oneshot::channel();
+        let worker = tokio::spawn(crate::telegram_outbox::run_telegram_outbox_worker_until(
+            store,
+            openplotva_storage::PostgresHistoryStore::new(pool.clone()),
+            MusicReceiptTransport,
+            resolver,
+            "music-test",
+            7,
+            crate::telegram_outbox::TelegramOutboxWorkerConfig::default(),
+            crate::telegram_outbox::TelegramOutboxWorkerMetrics::default(),
+            async {
+                let _ = stop_rx.await;
+            },
+        ));
+        tokio::time::timeout(Duration::from_secs(5), async {
+            while queue
+                .records()
+                .iter()
+                .find(|record| record.id == job_id)
+                .expect("song")
+                .status
+                != JobStatus::Completed
+            {
+                tokio::time::sleep(Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
+        let _ = stop_tx.send(());
+        let delivery = worker.await?;
+        assert_eq!(delivery.delivered, 1, "{delivery:?}");
+        assert_eq!(delivery.errors, 0, "{delivery:?}");
+        assert_eq!(
+            queue
+                .records()
+                .into_iter()
+                .find(|record| record.id == job_id)
+                .expect("music job")
+                .result_message_id,
+            Some(100)
+        );
+        let song_message: Option<i32> = sqlx::query_scalar("SELECT result_message_id FROM generated_songs WHERE job_id = $1 AND prepared_delivery IS NOT NULL")
+            .bind(job_id).fetch_one(&pool).await?;
+        assert_eq!(song_message, Some(100));
+        server.abort();
+        sqlx::query("DELETE FROM telegram_outbox WHERE dialog_job_id = $1")
+            .bind(job_id)
+            .execute(&pool)
+            .await?;
+        sqlx::query("DELETE FROM generated_songs WHERE job_id = $1")
+            .bind(job_id)
+            .execute(&pool)
+            .await?;
+        sqlx::query("DELETE FROM taskman_jobs WHERE id = $1")
+            .bind(job_id)
+            .execute(&pool)
+            .await?;
         assert_eq!(update_queue.len().await?, 0);
 
         let _: i64 = redis::cmd("DEL").arg(&key).query_async(&mut redis).await?;
@@ -5947,7 +6107,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn live_postgres_serialized_album_schedules_one_edit_with_original_caption()
+    async fn live_postgres_serialized_album_preserves_caption_and_source_limit()
     -> Result<(), Box<dyn std::error::Error>> {
         let Ok(dsn) = env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
             return Ok(());
@@ -5956,13 +6116,21 @@ mod tests {
             .max_connections(2)
             .connect(&dsn)
             .await?;
+        openplotva_storage::run_migrations_on(&pool).await?;
         let bot_id = i64::from(rand::random::<u32>()) + 1000;
         let store = openplotva_storage::PostgresTelegramDeliveryStore::new(pool.clone());
         let files = openplotva_storage::PostgresTelegramFileStore::new(pool.clone());
         let now = OffsetDateTime::now_utc().unix_timestamp();
-        for (case, (count, caption_last)) in [(2, false), (10, false), (2, true), (10, true)]
-            .into_iter()
-            .enumerate()
+        for (case, (count, caption_last)) in [
+            (2, false),
+            (openplotva_core::MAX_IMAGE_EDIT_SOURCE_IMAGES, false),
+            (openplotva_core::MAX_IMAGE_EDIT_SOURCE_IMAGES + 1, false),
+            (2, true),
+            (openplotva_core::MAX_IMAGE_EDIT_SOURCE_IMAGES, true),
+            (openplotva_core::MAX_IMAGE_EDIT_SOURCE_IMAGES + 1, true),
+        ]
+        .into_iter()
+        .enumerate()
         {
             let album = format!("serial-album-{bot_id}-{case}");
             let caption_index = if caption_last { count - 1 } else { 0 };
@@ -6026,32 +6194,54 @@ mod tests {
                 )
                 .await?;
                 if index == caption_index {
-                    assert!(matches!(
-                        route,
-                        DialogMessageUpdateRoute::DrawImageScheduled { .. }
-                    ));
+                    assert!(matches!(route, DialogMessageUpdateRoute::Scheduled { .. }));
                 } else {
                     assert_eq!(route, DialogMessageUpdateRoute::SkippedEmptyDialogTrigger);
                 }
                 sqlx::query("UPDATE telegram_update_inbox SET status='completed' WHERE bot_id=$1 AND update_id=$2")
                     .bind(bot_id).bind(case as i64 * 100 + index as i64).execute(&pool).await?;
             }
-            assert!(scheduler.calls().is_empty());
-            let records = queue.records();
-            assert_eq!(records.len(), 1);
-            let data = &records[0].job.data;
-            let image = data.image_data.as_ref().expect("image edit");
-            assert!(image.image_urls.is_empty());
-            assert_eq!(image.image_file_ids, expected_file_ids);
-            assert_eq!(image.prompt, prompt);
-            assert_eq!(image.original_text, prompt);
-            assert_eq!(
-                data.telegram_data
-                    .as_ref()
-                    .expect("telegram target")
-                    .message_id,
-                77 + caption_index as i32
-            );
+            assert_eq!(scheduler.calls().len(), 1);
+            let meta = scheduler.metas()[0].clone();
+            assert_eq!(meta.requested_tool, "draw_image");
+            let scheduled = image_scheduler
+                .schedule_image(crate::dialog_tools::DrawImageScheduleRequest {
+                    chat_id: 42,
+                    message_id: 77 + caption_index as i32,
+                    user_id: meta.sender_id,
+                    user_full_name: meta.sender_name.clone(),
+                    prompt: prompt.to_owned(),
+                    original_prompt: prompt.to_owned(),
+                    message_text: prompt.to_owned(),
+                    attachments: meta.attachments,
+                    edit_media_group_id: album.clone(),
+                    ..Default::default()
+                })
+                .await;
+            if count > openplotva_core::MAX_IMAGE_EDIT_SOURCE_IMAGES {
+                let error = scheduled.expect_err("oversized album must be rejected");
+                assert_eq!(error.to_string(), "too many album reference images");
+                assert!(queue.records().is_empty());
+            } else {
+                let scheduled =
+                    scheduled.map_err(|error| std::io::Error::other(error.to_string()))?;
+                assert_eq!(scheduled.status, "scheduled");
+                let records = queue.records();
+                assert_eq!(records.len(), 1);
+                let data = &records[0].job.data;
+                let image = data.image_data.as_ref().expect("image edit");
+                assert!(image.image_urls.is_empty());
+                assert_eq!(image.image_file_ids, expected_file_ids);
+                assert_eq!(image.prompt, prompt);
+                assert_eq!(image.original_text, prompt);
+                assert_eq!(
+                    data.telegram_data
+                        .as_ref()
+                        .expect("telegram target")
+                        .message_id,
+                    77 + caption_index as i32
+                );
+            }
             sqlx::query("DELETE FROM telegram_update_inbox WHERE bot_id=$1")
                 .bind(bot_id)
                 .execute(&pool)
@@ -6829,6 +7019,27 @@ mod tests {
     }
 
     #[derive(Clone, Debug)]
+    struct MusicReceiptTransport;
+
+    impl crate::telegram_outbox::TelegramOutboxTransport for MusicReceiptTransport {
+        fn execute<'a>(
+            &'a self,
+            command: openplotva_telegram::OutboundCommand,
+        ) -> crate::telegram_outbox::TelegramOutboxTransportFuture<'a> {
+            Box::pin(async move {
+                let (_, _, payload) = command.into_storage_parts().expect("rich command");
+                assert_eq!(payload["chat_id"], -100);
+                let message = serde_json::from_value(serde_json::json!({
+                    "message_id":100,"date":1,"chat":{"id":-100,"type":"supergroup","title":"Group"}
+                }))
+                .expect("Telegram receipt");
+                Ok(openplotva_telegram::TelegramOutboundResponse::Message(
+                    Box::new(message),
+                ))
+            })
+        }
+    }
+
     struct MusicMaterialProviderStub {
         material: crate::music_jobs::SongMaterial,
         calls: Arc<Mutex<Vec<String>>>,
@@ -7029,14 +7240,6 @@ mod tests {
     }
 
     impl crate::music_jobs::MusicTelegramSender for TelegramMethodCapture {
-        fn send_music_method<'a>(
-            &'a self,
-            method: TelegramOutboundMethod,
-        ) -> crate::music_jobs::MusicJobEffectFuture<'a, Result<TelegramOutboundResponse, String>>
-        {
-            Box::pin(async move { self.record_method(&method) })
-        }
-
         fn download_music_file<'a>(
             &'a self,
             file_id: &'a str,
diff --git a/crates/openplotva-app/src/dialog_runtime.rs b/crates/openplotva-app/src/dialog_runtime.rs
index bf1e6a38..96bca601 100644
--- a/crates/openplotva-app/src/dialog_runtime.rs
+++ b/crates/openplotva-app/src/dialog_runtime.rs
@@ -6,35 +6,19 @@ use std::{
 };
 
 use openplotva_config::AppConfig;
-use openplotva_dialog::{
-    ChatStepRequest, DialogToolbox, PROVIDER_AIFARM, PROVIDER_GENKIT, PROVIDER_NVIDIA,
-    PROVIDER_VMLX, ToolsMode,
-};
+use openplotva_dialog::{ChatStepRequest, PROVIDER_AIFARM, PROVIDER_GENKIT, ToolsMode};
 use openplotva_llm::{
     ChatProvider, ChatProviderError, ChatStepFuture, ChatStepProvider,
-    aifarm::{
-        AifarmClientConfig, AifarmDialogConfig, AifarmDialogProvider, GatewayRequestFields,
-        ReqwestAifarmTransport, normalize_chat_completions_url, rejection_verdict_for,
-    },
-    gemini::{
-        GeminiDialogConfig, GeminiDialogProvider, GeminiExplicitCacheConfig,
-        is_gemini_provider_model,
-    },
+    aifarm::{AifarmDialogConfig, AifarmDialogProvider, rejection_verdict_for},
+    gemini::{GeminiDialogConfig, GeminiDialogProvider, GeminiExplicitCacheConfig},
     retry::{FailureReason, retryable_reason},
     router::{BreakerSet, PoolRegistry, RouterHandle, TriggerState},
     whitecircle::{WhiteCircleClientConfig, WhiteCirclePreToolConfig},
 };
-use thiserror::Error;
 
-use crate::media::{
-    agent_client_config_from_named_provider, aifarm_dialog_config_from_app_config,
-    nvidia_dialog_config_from_app_config, vmlx_dialog_config_from_app_config,
-};
+use crate::media::{agent_client_config_from_named_provider, aifarm_dialog_config_from_app_config};
+use crate::provider_transport::aifarm_discovery_provider_name;
 use crate::routed_attempts::{RoutedAttemptRunError, RoutedAttemptWalker, RoutedRequestContext};
-use crate::runtime_gemini_cache::resolve_google_ai_key;
-
-const OPENROUTER_MODEL_PREFIX: &str = "openrouter/";
-const OPENROUTER_CHAT_COMPLETIONS_URL: &str = "https://openrouter.ai/api/v1/chat/completions";
 
 /// Shared dialog provider handle.
 pub type DialogProviderHandle = Arc<dyn ChatProvider>;
@@ -42,213 +26,105 @@ pub type DialogProviderHandle = Arc<dyn ChatProvider>;
 /// Workflow key the dialog worker routes through.
 const DIALOG_WORKFLOW_KEY: &str = "dialog";
 
-/// Builds and caches per-provider transport clients from DB provider rows, so
-/// a provider added in the admin panel is immediately routable without a
-/// restart. Env-built clients (aifarm, genkit, vram-cloud, the GPU reasoner)
-/// seed the static map and keep their toolbox wiring; everything else is
-/// constructed from the row's protocol + endpoint + key and cached under a
-/// fingerprint that invalidates when the row changes.
+#[derive(Clone, PartialEq)]
+enum DialogClientConfig {
+    OpenAi(Box<AifarmDialogConfig>),
+    Gemini(GeminiDialogConfig),
+}
+
+/// Caches adapters for the selected route, including resolved credentials.
 pub struct ChatClientFactory {
-    handle: Arc<RouterHandle>,
+    config: AppConfig,
     template: AifarmDialogConfig,
-    static_clients: HashMap<String, DialogProviderHandle>,
-    default_client: DialogProviderHandle,
-    cache: std::sync::Mutex<HashMap<(i64, i64), (u64, DialogProviderHandle)>>,
+    injected_clients: HashMap<String, DialogProviderHandle>,
+    cache: Mutex<HashMap<(i64, i64), (DialogClientConfig, DialogProviderHandle)>>,
     prompt_store: Arc<openplotva_prompts::PromptStore>,
 }
 
 impl ChatClientFactory {
     #[must_use]
     pub fn new(
-        handle: Arc<RouterHandle>,
+        config: &AppConfig,
         template: AifarmDialogConfig,
-        static_clients: HashMap<String, DialogProviderHandle>,
-        default_client: DialogProviderHandle,
+        injected_clients: HashMap<String, DialogProviderHandle>,
         prompt_store: Arc<openplotva_prompts::PromptStore>,
     ) -> Self {
         Self {
-            handle,
+            config: config.clone(),
             template,
-            static_clients,
-            default_client,
-            cache: std::sync::Mutex::new(HashMap::new()),
+            injected_clients,
+            cache: Mutex::new(HashMap::new()),
             prompt_store,
         }
     }
 
-    /// Resolve the transport client for one routed attempt. Static (env-built)
-    /// clients win by provider name; unknown providers are built from their
-    /// row when the protocol allows it. `Err` carries a retryable
-    /// `ProviderUnavailable`, so the walker moves on to the next candidate
-    /// instead of failing the whole run.
     fn resolve(
         &self,
         attempt: &crate::routed_attempts::RoutedAttempt,
     ) -> Result<DialogProviderHandle, openplotva_llm::retry::ProviderError> {
-        if let Some(client) = self.static_clients.get(&attempt.provider_name) {
+        if let Some(client) = self.injected_clients.get(&attempt.provider_name) {
             return Ok(Arc::clone(client));
         }
-        let table = self.handle.snapshot();
-        let Some(row) = table.provider(attempt.provider_id) else {
-            // The row vanished between selection and execution; the seeded
-            // default keeps legacy behavior for the built-in providers.
-            return Ok(Arc::clone(&self.default_client));
-        };
-        let gateway = GatewayRequestFields::from_overrides(&attempt.overrides.extra);
-        let fingerprint = provider_row_fingerprint(row, &gateway);
-        let key = (row.id, attempt.model_id);
-        {
-            let cache = self
-                .cache
-                .lock()
-                .unwrap_or_else(std::sync::PoisonError::into_inner);
-            if let Some((cached_fingerprint, client)) = cache.get(&key)
-                && *cached_fingerprint == fingerprint
-            {
-                return Ok(Arc::clone(client));
-            }
-        }
-        let client = self.build_client(row, gateway)?;
+        let config = self.client_config(attempt)?;
+        let key = (attempt.provider_id, attempt.model_id);
         let mut cache = self
             .cache
             .lock()
             .unwrap_or_else(std::sync::PoisonError::into_inner);
-        cache.insert(key, (fingerprint, Arc::clone(&client)));
+        if let Some((cached, client)) = cache.get(&key)
+            && *cached == config
+        {
+            return Ok(Arc::clone(client));
+        }
+        let client: DialogProviderHandle = match &config {
+            DialogClientConfig::OpenAi(config) => Arc::new(
+                AifarmDialogProvider::new(*config.clone())
+                    .with_prompt_store(Arc::clone(&self.prompt_store)),
+            ),
+            DialogClientConfig::Gemini(config) => Arc::new(
+                GeminiDialogProvider::new(config.clone())
+                    .with_prompt_store(Arc::clone(&self.prompt_store)),
+            ),
+        };
+        cache.insert(key, (config, Arc::clone(&client)));
         Ok(client)
     }
 
-    fn build_client(
+    fn client_config(
         &self,
-        row: &openplotva_llm::router::ProviderRow,
-        gateway: GatewayRequestFields,
-    ) -> Result<DialogProviderHandle, openplotva_llm::retry::ProviderError> {
-        let cfg = self.dynamic_dialog_config(row, gateway)?;
-        let provider =
-            AifarmDialogProvider::new(cfg).with_prompt_store(Arc::clone(&self.prompt_store));
-        Ok(Arc::new(provider))
-    }
-
-    /// Dialog config for a provider row without an env-built client: the shared
-    /// template pointed at the row's endpoint or Discovery service, carrying the
-    /// route's gateway fields (OpenRouter `reasoning` and `provider`).
-    fn dynamic_dialog_config(
-        &self,
-        row: &openplotva_llm::router::ProviderRow,
-        gateway: GatewayRequestFields,
-    ) -> Result<AifarmDialogConfig, openplotva_llm::retry::ProviderError> {
-        let protocol = row.protocol.as_deref().unwrap_or(
-            // Legacy rows without a protocol: chat-kind non-genkit rows are
-            // OpenAI-compatible in this deployment.
-            "openai_compat",
-        );
-        if protocol != "openai_compat" {
-            return Err(openplotva_llm::retry::ProviderError::new(
-                row.name.clone(),
-                openplotva_llm::retry::FailureReason::ProviderUnavailable,
-                format!(
-                    "no transport client for provider {} (protocol {protocol} has no dynamic dialog adapter)",
-                    row.name
-                ),
-            ));
-        }
-        let mut cfg = self.template.clone();
-        cfg.client.gateway_fields = gateway;
-        cfg.provider_name = row.name.clone();
-        cfg.model = String::new();
-        cfg.client.default_model = String::new();
-        cfg.client.api_key =
-            resolve_provider_api_key(row.api_key_ref.as_deref(), row.api_key_encrypted.as_deref())
-                .unwrap_or_default();
-        cfg.client.runtime_hint = row.runtime_hint.clone().unwrap_or_default();
-        cfg.client.supports_message_name = row
-            .config
-            .get("supports_message_name")
-            .and_then(serde_json::Value::as_bool)
-            .unwrap_or(true);
-        cfg.client.supports_cache_control =
-            crate::routed_attempts::provider_supports_cache_control(&row.config);
-        match (&row.discovery_service_name, &row.endpoint) {
-            (Some(service), _) => {
-                cfg.client.service_name = service.clone();
-                cfg.client.endpoint_name = row
-                    .discovery_endpoint_name
-                    .clone()
-                    .unwrap_or_else(|| cfg.client.endpoint_name.clone());
-                cfg.client.direct_url = String::new();
-                if let Some(endpoint) = &row.endpoint
-                    && !endpoint.trim().is_empty()
-                {
-                    cfg.client.base_url = endpoint.clone();
-                }
-            }
-            (None, Some(endpoint)) if !endpoint.trim().is_empty() => {
-                cfg.client.direct_url = normalize_chat_completions_url(endpoint);
-            }
-            _ => {
-                return Err(openplotva_llm::retry::ProviderError::new(
-                    row.name.clone(),
-                    openplotva_llm::retry::FailureReason::ProviderUnavailable,
-                    format!(
-                        "provider {} has neither an endpoint nor a discovery service",
-                        row.name
-                    ),
-                ));
-            }
-        }
-        Ok(cfg)
-    }
-}
-
-/// Resolve a provider row's API key: an env-var reference wins, otherwise the
-/// AES-GCM sealed blob is opened under the operator's `MASTER_KEY`.
-pub(crate) fn resolve_provider_api_key(
-    api_key_ref: Option<&str>,
-    api_key_encrypted: Option<&[u8]>,
-) -> Option<String> {
-    if let Some(reference) = api_key_ref.filter(|reference| !reference.trim().is_empty()) {
-        return std::env::var(reference.trim()).ok();
-    }
-    let sealed = api_key_encrypted?;
-    let master = std::env::var("MASTER_KEY").unwrap_or_default();
-    match openplotva_storage::llm_routing::open_key(&master, sealed) {
-        Ok(key) => Some(key),
-        Err(error) => {
-            tracing::warn!(%error, "failed to open sealed provider api key");
-            None
+        attempt: &crate::routed_attempts::RoutedAttempt,
+    ) -> Result<DialogClientConfig, openplotva_llm::retry::ProviderError> {
+        if attempt.protocol == Some(openplotva_llm::provider_schema::Protocol::Genkit) {
+            let (api_key, base_url) =
+                crate::provider_transport::gemini_endpoint_for_attempt(&self.config, attempt)?;
+            return Ok(DialogClientConfig::Gemini(GeminiDialogConfig {
+                api_key,
+                base_url,
+                model: attempt.model_name.clone(),
+                request_timeout: positive_seconds(self.config.llm.dialog.request_timeout_seconds),
+                cache: GeminiExplicitCacheConfig::chat_core_multi_turn(),
+                ..GeminiDialogConfig::default()
+            }));
         }
+        let local = local_reasoner_dialog_config_from_app_config(&self.config);
+        let mut cfg = if attempt.provider_name == local.provider_name
+            && local.provider_name != PROVIDER_AIFARM
+        {
+            local
+        } else {
+            self.template.clone()
+        };
+        cfg.client = crate::provider_transport::openai_client_for_attempt(
+            &self.config,
+            attempt,
+            cfg.client,
+        )?;
+        cfg.provider_name.clone_from(&attempt.provider_name);
+        cfg.model.clone_from(&cfg.client.default_model);
+        Ok(DialogClientConfig::OpenAi(Box::new(cfg)))
     }
 }
 
-/// Change-detection fingerprint over the client-relevant provider row fields
-/// and the route's gateway fields.
-fn provider_row_fingerprint(
-    row: &openplotva_llm::router::ProviderRow,
-    gateway: &GatewayRequestFields,
-) -> u64 {
-    use std::hash::{Hash, Hasher};
-    let mut hasher = std::collections::hash_map::DefaultHasher::new();
-    row.name.hash(&mut hasher);
-    row.protocol.hash(&mut hasher);
-    row.runtime_hint.hash(&mut hasher);
-    row.endpoint.hash(&mut hasher);
-    row.discovery_service_name.hash(&mut hasher);
-    row.discovery_endpoint_name.hash(&mut hasher);
-    row.api_key_ref.hash(&mut hasher);
-    row.api_key_encrypted.hash(&mut hasher);
-    row.config.to_string().hash(&mut hasher);
-    gateway
-        .provider
-        .as_ref()
-        .map(ToString::to_string)
-        .hash(&mut hasher);
-    gateway
-        .reasoning
-        .as_ref()
-        .map(ToString::to_string)
-        .hash(&mut hasher);
-    hasher.finish()
-}
-
 /// Dialog provider that selects its concrete backend per request from the
 /// DB-backed routing table (weighted primaries, ordered fallback, trigger-engaged
 /// overflow), recording circuit-breaker outcomes. Transport clients come from
@@ -446,56 +322,20 @@ impl ChatStepProvider for RouterChatProvider {
     }
 }
 
-/// Build the DB-backed dialog provider. The env-built aifarm and genkit
-/// transport clients seed the factory's static map by provider name (`gemini`
-/// overflow shares the Google AI / genkit client); providers created in the
-/// admin panel are built on demand from their rows. Falls back to the aifarm
-/// primary when a selected row vanishes mid-request.
-#[allow(clippy::too_many_arguments)]
+/// Build the dialog executor from the shared routing policy.
 pub fn router_dialog_provider(
     config: &AppConfig,
-    toolbox: Arc<dyn DialogToolbox>,
     handle: Arc<RouterHandle>,
     breakers: Arc<BreakerSet>,
     triggers: Arc<TriggerState>,
     pools: Arc<PoolRegistry>,
-    genkit_fallback: Option<DialogProviderHandle>,
     routing_events: Option<crate::runtime_routing::RoutingEventReporter>,
     prompt_store: Arc<openplotva_prompts::PromptStore>,
 ) -> DialogProviderHandle {
-    // Env pool secondaries are first-class DB models routed through their own
-    // `vram-cloud` client below, so admin weights control them without a hidden pool.
-    let aifarm_cfg = aifarm_dialog_config_from_app_config(config);
-    let aifarm =
-        AifarmDialogProvider::new(aifarm_cfg.clone()).with_prompt_store(Arc::clone(&prompt_store));
-    let aifarm: DialogProviderHandle = Arc::new(aifarm);
-
-    let genkit = genkit_fallback.or_else(|| {
-        genkit_dialog_provider_from_app_config_with_prompt_store(config, Arc::clone(&prompt_store))
-    });
-
-    let mut clients: HashMap<String, DialogProviderHandle> = HashMap::new();
-    clients.insert(PROVIDER_AIFARM.to_owned(), Arc::clone(&aifarm));
-    if let Some(genkit) = genkit {
-        clients.insert(PROVIDER_GENKIT.to_owned(), Arc::clone(&genkit));
-        clients.insert("gemini".to_owned(), genkit);
-    }
-    if let Some(vram_cloud) =
-        vram_cloud_dialog_provider(config, Arc::clone(&toolbox), &prompt_store)
-    {
-        clients.insert(VRAM_CLOUD_PROVIDER_NAME.to_owned(), vram_cloud);
-    }
-    if let Some(local_reasoner) =
-        local_reasoner_dialog_provider(config, Arc::clone(&toolbox), &prompt_store)
-    {
-        clients.insert(local_reasoner.provider_name().to_owned(), local_reasoner);
-    }
-
     let factory = Arc::new(ChatClientFactory::new(
-        Arc::clone(&handle),
-        aifarm_cfg,
-        clients,
-        aifarm,
+        config,
+        aifarm_dialog_config_from_app_config(config),
+        HashMap::new(),
         prompt_store,
     ));
     // A negative value is a config slip, not a way to disable the re-sampling;
@@ -518,48 +358,6 @@ pub fn router_dialog_provider(
 /// Provider name for the direct OpenAI-compatible VRAM Cloud endpoint.
 pub const VRAM_CLOUD_PROVIDER_NAME: &str = "vram-cloud";
 
-/// Build a single-backend, direct OpenAI-compatible client for the configured
-/// VRAM Cloud endpoint. Each DB model selects itself via the per-attempt model
-/// override, so one client serves every model on that endpoint.
-fn vram_cloud_dialog_provider(
-    config: &AppConfig,
-    _toolbox: Arc<dyn DialogToolbox>,
-    prompt_store: &Arc<openplotva_prompts::PromptStore>,
-) -> Option<DialogProviderHandle> {
-    let cfg = vram_cloud_dialog_config(config)?;
-    let provider = AifarmDialogProvider::new(cfg).with_prompt_store(Arc::clone(prompt_store));
-    Some(Arc::new(provider))
-}
-
-fn vram_cloud_dialog_config(config: &AppConfig) -> Option<AifarmDialogConfig> {
-    let dialog = &config.llm.dialog;
-    let model = dialog.aifarm_pool_models.first()?;
-    let base = dialog.aifarm_pool_base_urls.first()?;
-    if model.trim().is_empty() || base.trim().is_empty() {
-        return None;
-    }
-    let mut cfg = aifarm_dialog_config_from_app_config(config);
-    cfg.provider_name = VRAM_CLOUD_PROVIDER_NAME.to_owned();
-    cfg.client.direct_url = normalize_chat_completions_url(base);
-    cfg.client.api_key = dialog.aifarm_pool_api_key.clone();
-    cfg.client.default_model = model.clone();
-    cfg.model = model.clone();
-    Some(cfg)
-}
-
-fn local_reasoner_dialog_provider(
-    config: &AppConfig,
-    _toolbox: Arc<dyn DialogToolbox>,
-    prompt_store: &Arc<openplotva_prompts::PromptStore>,
-) -> Option<DialogProviderHandle> {
-    let cfg = local_reasoner_dialog_config_from_app_config(config);
-    if cfg.provider_name.eq_ignore_ascii_case(PROVIDER_AIFARM) {
-        return None;
-    }
-    let provider = AifarmDialogProvider::new(cfg).with_prompt_store(Arc::clone(prompt_store));
-    Some(Arc::new(provider))
-}
-
 fn local_reasoner_dialog_config_from_app_config(config: &AppConfig) -> AifarmDialogConfig {
     let spec = crate::agent_runtime::local_reasoner_named_provider_config(config);
     let mut cfg = aifarm_dialog_config_from_app_config(config);
@@ -594,203 +392,6 @@ fn dialog_sampling_from_overrides(
     }
 }
 
-fn aifarm_discovery_provider_name(service: &str, config: &AppConfig) -> String {
-    let service = service.trim();
-    if service.is_empty() || service == config.llm.dialog.discovery_service_name {
-        return PROVIDER_AIFARM.to_owned();
-    }
-    if service.eq_ignore_ascii_case(crate::agent_runtime::DEFAULT_LOCAL_REASONER_SERVICE_NAME) {
-        return crate::agent_runtime::LOCAL_REASONER_PROVIDER_NAME.to_owned();
-    }
-    if service.eq_ignore_ascii_case(crate::agent_runtime::VIBETHINKER_SERVICE_NAME) {
-        return crate::agent_runtime::VIBETHINKER_PROVIDER_NAME.to_owned();
-    }
-    format!(
-        "aifarm-{}",
-        service
-            .trim_start_matches("llm-openai-")
-            .trim_start_matches("llm-")
-    )
-}
-
-/// Error returned while building the configured dialog provider.
-#[derive(Clone, Debug, Error, Eq, PartialEq)]
-pub enum DialogProviderBuildError {
-    #[error("google ai key is required for genkit dialog provider")]
-    GenkitGoogleAiKeyRequired,
-    /// A GenKit OpenAI-compatible plugin route was selected without its provider key.
-    #[error("{provider} api key is required for genkit dialog provider")]
-    GenkitProviderApiKeyRequired {
-        /// Provider name used in the model prefix.
-        provider: &'static str,
-    },
-    /// A GenKit OpenAI-compatible plugin route was selected without a concrete model suffix.
-    #[error("{provider} model is required for genkit dialog provider")]
-    GenkitProviderModelRequired {
-        /// Provider name used in the model prefix.
-        provider: &'static str,
-    },
-    #[error("unsupported dialog provider {provider:?}")]
-    Unsupported {
-        /// Raw provider name after trimming/lowercasing.
-        provider: String,
-    },
-}
-
-/// Build the env-configured dialog provider directly, bypassing the DB router.
-/// Off the production path (dialog runs through [`router_dialog_provider`]);
-/// kept for provider-construction tests and the live provider smokes.
-pub fn dialog_provider_from_app_config(
-    config: &AppConfig,
-) -> Result<DialogProviderHandle, DialogProviderBuildError> {
-    primary_dialog_provider_from_app_config(config)
-}
-
-pub fn genkit_dialog_provider_from_app_config(config: &AppConfig) -> Option<DialogProviderHandle> {
-    genkit_dialog_provider_result_from_app_config(config, None).ok()
-}
-
-pub fn genkit_dialog_provider_from_app_config_with_prompt_store(
-    config: &AppConfig,
-    prompt_store: Arc<openplotva_prompts::PromptStore>,
-) -> Option<DialogProviderHandle> {
-    genkit_dialog_provider_result_from_app_config(config, Some(prompt_store)).ok()
-}
-
-fn genkit_dialog_provider_result_from_app_config(
-    config: &AppConfig,
-    prompt_store: Option<Arc<openplotva_prompts::PromptStore>>,
-) -> Result<DialogProviderHandle, DialogProviderBuildError> {
-    let api_key = resolve_google_ai_key(&config.google_ai);
-    if api_key.trim().is_empty() {
-        return Err(DialogProviderBuildError::GenkitGoogleAiKeyRequired);
-    }
-    if let Some(cfg) = genkit_openai_compatible_dialog_config_result_from_app_config(config)? {
-        let provider = AifarmDialogProvider::new(cfg);
-        let provider = match prompt_store {
-            Some(prompts) => provider.with_prompt_store(prompts),
-            None => provider,
-        };
-        return Ok(Arc::new(provider));
-    }
-    let model = genkit_dialog_model_from_app_config(config);
-    let provider = GeminiDialogProvider::new(GeminiDialogConfig {
-        api_key,
-        model: if is_gemini_provider_model(&model) {
-            model
-        } else {
-            String::new()
-        },
-        request_timeout: std::time::Duration::from_secs(
-            config.llm.dialog.request_timeout_seconds.max(1) as u64,
-        ),
-        cache: GeminiExplicitCacheConfig::chat_core_multi_turn(),
-        ..GeminiDialogConfig::default()
-    });
-    let provider = match prompt_store {
-        Some(prompts) => provider.with_prompt_store(prompts),
-        None => provider,
-    };
-    Ok(Arc::new(provider))
-}
-
-#[must_use]
-pub fn genkit_openai_compatible_dialog_config_from_app_config(
-    config: &AppConfig,
-) -> Option<AifarmDialogConfig> {
-    genkit_openai_compatible_dialog_config_result_from_app_config(config)
-        .ok()
-        .flatten()
-}
-
-fn genkit_openai_compatible_dialog_config_result_from_app_config(
-    config: &AppConfig,
-) -> Result<Option<AifarmDialogConfig>, DialogProviderBuildError> {
-    let raw_model = genkit_dialog_model_from_app_config(config);
-    let raw_model = raw_model.trim();
-    let (provider, direct_url, api_key, model, request_timeout_seconds) =
-        if let Some(model) = strip_provider_prefix_fold(raw_model, OPENROUTER_MODEL_PREFIX) {
-            (
-                "openrouter",
-                OPENROUTER_CHAT_COMPLETIONS_URL,
-                config.open_router.key.trim().to_owned(),
-                model.trim().to_owned(),
-                config.open_router.request_timeout_seconds,
-            )
-        } else {
-            return Ok(None);
-        };
-    if api_key.is_empty() {
-        return Err(DialogProviderBuildError::GenkitProviderApiKeyRequired { provider });
-    }
-    if model.is_empty() {
-        return Err(DialogProviderBuildError::GenkitProviderModelRequired { provider });
-    }
-    Ok(Some(AifarmDialogConfig {
-        provider_name: PROVIDER_GENKIT.to_owned(),
-        client: AifarmClientConfig {
-            direct_url: direct_url.to_owned(),
-            api_key,
-            request_timeout: positive_seconds(request_timeout_seconds),
-            default_model: model.clone(),
-            ..AifarmClientConfig::default()
-        },
-        model,
-        max_tokens: 8192,
-        temperature: Some(0.9),
-        top_p: Some(0.97),
-        include_reasoning: Some(false),
-        ..AifarmDialogConfig::default()
-    }))
-}
-
-fn genkit_dialog_model_from_app_config(config: &AppConfig) -> String {
-    let model = config.llm.dialog.model.trim();
-    if model.is_empty() {
-        crate::memory_runtime::genkit_runtime_default_model(config)
-    } else {
-        model.to_owned()
-    }
-}
-
-fn primary_dialog_provider_from_app_config(
-    config: &AppConfig,
-) -> Result<DialogProviderHandle, DialogProviderBuildError> {
-    match configured_dialog_provider_name(config).as_str() {
-        PROVIDER_AIFARM => Ok(Arc::new(aifarm_dialog_provider_from_app_config(config))),
-        PROVIDER_NVIDIA => Ok(Arc::new(nvidia_dialog_provider_from_app_config(config))),
-        PROVIDER_VMLX => Ok(Arc::new(vmlx_dialog_provider_from_app_config(config))),
-        PROVIDER_GENKIT => genkit_dialog_provider_result_from_app_config(config, None),
-        provider => Err(DialogProviderBuildError::Unsupported {
-            provider: provider.to_owned(),
-        }),
-    }
-}
-
-/// Build the reqwest-backed AIFarm provider.
-#[must_use]
-pub fn aifarm_dialog_provider_from_app_config(
-    config: &AppConfig,
-) -> AifarmDialogProvider<ReqwestAifarmTransport> {
-    AifarmDialogProvider::new(aifarm_dialog_config_from_app_config(config))
-}
-
-/// Build the reqwest-backed NVIDIA provider.
-#[must_use]
-pub fn nvidia_dialog_provider_from_app_config(
-    config: &AppConfig,
-) -> AifarmDialogProvider<ReqwestAifarmTransport> {
-    AifarmDialogProvider::new(nvidia_dialog_config_from_app_config(config))
-}
-
-/// Build the reqwest-backed VMLX provider.
-#[must_use]
-pub fn vmlx_dialog_provider_from_app_config(
-    config: &AppConfig,
-) -> AifarmDialogProvider<ReqwestAifarmTransport> {
-    AifarmDialogProvider::new(vmlx_dialog_config_from_app_config(config))
-}
-
 #[must_use]
 pub fn configured_dialog_provider_name(config: &AppConfig) -> String {
     let provider = config.llm.dialog.provider.trim().to_ascii_lowercase();
@@ -828,13 +429,6 @@ pub fn white_circle_pre_tool_config_from_app_config(
     }
 }
 
-fn strip_provider_prefix_fold<'a>(value: &'a str, prefix: &str) -> Option<&'a str> {
-    value
-        .get(..prefix.len())
-        .is_some_and(|head| head.eq_ignore_ascii_case(prefix))
-        .then(|| &value[prefix.len()..])
-}
-
 fn positive_seconds(seconds: i32) -> std::time::Duration {
     if seconds <= 0 {
         std::time::Duration::ZERO
@@ -847,7 +441,7 @@ fn positive_seconds(seconds: i32) -> std::time::Duration {
 mod tests {
     use std::sync::Mutex;
 
-    use openplotva_dialog::{DialogInput, DialogOutput, DialogToolbox};
+    use openplotva_dialog::{DialogInput, DialogOutput};
     use openplotva_llm::{
         ChatProviderError,
         retry::{FailureReason, ProviderError},
@@ -859,27 +453,16 @@ mod tests {
 
     use super::*;
 
-    #[derive(Default)]
-    struct EmptyToolbox;
-
-    impl DialogToolbox for EmptyToolbox {}
-
     #[test]
     fn chat_client_factory_keeps_application_prompt_store() {
         let prompts = Arc::new(openplotva_prompts::PromptStore::load().expect("prompt store"));
-        let default_provider: DialogProviderHandle = Arc::new(SequencedProvider::new(
-            "aifarm",
-            vec![Ok(DialogOutput::default())],
-        ));
-
+        let config = AppConfig::from_raw(Default::default()).expect("config");
         let factory = ChatClientFactory::new(
-            RouterHandle::new(openplotva_llm::router::RoutingTable::default()),
+            &config,
             AifarmDialogConfig::default(),
             HashMap::new(),
-            default_provider,
             Arc::clone(&prompts),
         );
-
         assert!(Arc::ptr_eq(&factory.prompt_store, &prompts));
     }
 
@@ -894,56 +477,6 @@ mod tests {
         assert_eq!(configured_dialog_provider_name(&config), PROVIDER_GENKIT);
     }
 
-    #[test]
-    fn dialog_provider_factory_builds_aifarm_provider_from_default_config() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig::default()).expect("config");
-        let _toolbox: Arc<dyn DialogToolbox> = Arc::new(EmptyToolbox);
-
-        let provider = dialog_provider_from_app_config(&config).expect("provider");
-
-        assert_eq!(provider.provider_name(), PROVIDER_AIFARM);
-    }
-
-    #[test]
-    fn dialog_provider_factory_builds_nvidia_and_vmlx_providers() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            dialog_provider: Some(" NVIDIA ".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-        let _toolbox: Arc<dyn DialogToolbox> = Arc::new(EmptyToolbox);
-
-        let provider = dialog_provider_from_app_config(&config).expect("nvidia provider");
-
-        assert_eq!(provider.provider_name(), PROVIDER_NVIDIA);
-
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            dialog_provider: Some(" VMLX ".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-        let _toolbox: Arc<dyn DialogToolbox> = Arc::new(EmptyToolbox);
-
-        let provider = dialog_provider_from_app_config(&config).expect("vmlx provider");
-
-        assert_eq!(provider.provider_name(), PROVIDER_VMLX);
-    }
-
-    #[test]
-    fn dialog_provider_factory_builds_genkit_primary_when_key_is_available() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            dialog_provider: Some("genkit".to_owned()),
-            googleai_key: Some("gemini-key".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-        let _toolbox: Arc<dyn DialogToolbox> = Arc::new(EmptyToolbox);
-
-        let provider = dialog_provider_from_app_config(&config).expect("provider");
-
-        assert_eq!(provider.provider_name(), PROVIDER_GENKIT);
-    }
-
     #[test]
     fn local_reasoner_dialog_config_targets_ninfer_with_tools() {
         let config = AppConfig::from_raw(openplotva_config::RawConfig::default()).expect("config");
@@ -960,23 +493,6 @@ mod tests {
         assert_eq!(cfg.enable_thinking, Some(false));
     }
 
-    #[test]
-    fn dialog_provider_factory_reports_unavailable_genkit_without_google_key() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            dialog_provider: Some("genkit".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-        let _toolbox: Arc<dyn DialogToolbox> = Arc::new(EmptyToolbox);
-
-        let error = dialog_provider_from_app_config(&config).err();
-
-        assert_eq!(
-            error,
-            Some(DialogProviderBuildError::GenkitGoogleAiKeyRequired)
-        );
-    }
-
     #[tokio::test]
     async fn router_chat_provider_emits_route_unavailable_without_default_fallback() {
         let default_provider = Arc::new(SequencedProvider::new(
@@ -1033,7 +549,6 @@ mod tests {
         let pools = Arc::new(PoolRegistry::new());
         pools.apply(&table.pool_specs());
         let _busy = pools.try_acquire(Some(1)).expect("occupy the GPU pool");
-        let default_provider = Arc::new(SequencedProvider::new("unused", vec![]));
         let reporter = crate::runtime_routing::RoutingEventReporter::new(
             crate::runtime_routing::RoutingEventBuffer::new(8),
             None,
@@ -1044,7 +559,7 @@ mod tests {
             Arc::new(BreakerSet::new()),
             Arc::new(TriggerState::new()),
             pools,
-            test_factory(handle, HashMap::new(), default_provider),
+            test_factory(HashMap::new()),
         )
         .with_routing_event_reporter(reporter.clone());
         let started = tokio::time::Instant::now();
@@ -1155,7 +670,6 @@ mod tests {
 
     #[tokio::test]
     async fn router_chat_provider_marks_provider_capacity_cooldown() {
-        let default_provider = Arc::new(SequencedProvider::new("unused", vec![]));
         let routed_provider = Arc::new(SequencedProvider::new(
             "aifarm",
             vec![Err(Box::new(ProviderError::new(
@@ -1211,7 +725,7 @@ mod tests {
             Arc::new(BreakerSet::new()),
             Arc::clone(&triggers),
             Arc::new(PoolRegistry::new()),
-            test_factory(handle, clients, default_provider),
+            test_factory(clients),
         )
         .with_routing_event_reporter(reporter.clone());
 
@@ -1565,136 +1079,48 @@ mod tests {
         })
         .expect("config");
 
-        let cfg = vram_cloud_dialog_config(&config).expect("pool config");
+        let factory = ChatClientFactory::new(
+            &config,
+            aifarm_dialog_config_from_app_config(&config),
+            HashMap::new(),
+            Arc::new(openplotva_prompts::PromptStore::load().expect("prompts")),
+        );
+        let mut attempt = attempt_for(1, VRAM_CLOUD_PROVIDER_NAME);
+        attempt.provider_endpoint = Some("https://pool.test/v1".into());
+        let DialogClientConfig::OpenAi(cfg) = factory.client_config(&attempt).expect("config")
+        else {
+            panic!("openai")
+        };
 
         assert_eq!(cfg.provider_name, VRAM_CLOUD_PROVIDER_NAME);
         assert_eq!(cfg.max_tokens, 1024);
         assert_eq!(cfg.enable_thinking, Some(false));
     }
 
-    #[test]
-    fn genkit_dialog_provider_factory_builds_direct_gemini_when_key_is_available() {
-        let missing = AppConfig::from_raw(openplotva_config::RawConfig::default()).expect("config");
-        assert!(genkit_dialog_provider_from_app_config(&missing).is_none());
-
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            googleai_key: Some(" gemini-key ".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        let provider = genkit_dialog_provider_from_app_config(&config).expect("provider");
-
-        assert_eq!(provider.provider_name(), PROVIDER_GENKIT);
-    }
-
-    #[test]
-    fn genkit_dialog_provider_factory_builds_openrouter_plugin_route() {
-        let openrouter = AppConfig::from_raw(openplotva_config::RawConfig {
-            dialog_provider: Some("genkit".to_owned()),
-            dialog_model: Some("openrouter/x-ai/grok-4.1-fast".to_owned()),
-            googleai_key: Some("gemini-key".to_owned()),
-            openrouter_key: Some(" openrouter-key ".to_owned()),
-            openrouter_request_timeout_seconds: Some("321".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("openrouter config");
-
-        let cfg = genkit_openai_compatible_dialog_config_from_app_config(&openrouter)
-            .expect("openrouter config");
-
-        assert_eq!(cfg.provider_name, PROVIDER_GENKIT);
-        assert_eq!(cfg.model, "x-ai/grok-4.1-fast");
-        assert_eq!(
-            cfg.client.direct_url,
-            "https://openrouter.ai/api/v1/chat/completions"
-        );
-        assert_eq!(cfg.client.api_key, "openrouter-key");
-        assert_eq!(cfg.client.request_timeout.as_secs(), 321);
-        assert_eq!(cfg.max_tokens, 8192);
-        assert_eq!(cfg.temperature, Some(0.9));
-        assert_eq!(cfg.top_p, Some(0.97));
-        let _toolbox: Arc<dyn DialogToolbox> = Arc::new(EmptyToolbox);
-        let provider = dialog_provider_from_app_config(&openrouter).expect("provider");
-        assert_eq!(provider.provider_name(), PROVIDER_GENKIT);
-
-        let openrouter_default = AppConfig::from_raw(openplotva_config::RawConfig {
-            dialog_provider: Some("genkit".to_owned()),
-            dialog_model: Some(" ".to_owned()),
-            genkit_default_model: Some("openrouter/default-model".to_owned()),
-            googleai_key: Some("gemini-key".to_owned()),
-            openrouter_key: Some(" openrouter-key ".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("openrouter default config");
-        let cfg = genkit_openai_compatible_dialog_config_from_app_config(&openrouter_default)
-            .expect("openrouter default config");
-        assert_eq!(cfg.model, "default-model");
-    }
-
-    #[test]
-    fn genkit_dialog_provider_factory_preserves_go_google_key_requirement_for_plugin_routes() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            dialog_provider: Some("genkit".to_owned()),
-            dialog_model: Some("openrouter/x-ai/grok-4.1-fast".to_owned()),
-            openrouter_key: Some("openrouter-key".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        let _toolbox: Arc<dyn DialogToolbox> = Arc::new(EmptyToolbox);
-        let error = dialog_provider_from_app_config(&config).err();
-
-        assert_eq!(
-            error,
-            Some(DialogProviderBuildError::GenkitGoogleAiKeyRequired)
-        );
-    }
-
-    #[test]
-    fn genkit_dialog_provider_factory_reports_prefixed_missing_keys_without_gemini_fallthrough() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            dialog_provider: Some("genkit".to_owned()),
-            dialog_model: Some("openrouter/x-ai/grok-4.1-fast".to_owned()),
-            googleai_key: Some("gemini-key".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        let _toolbox: Arc<dyn DialogToolbox> = Arc::new(EmptyToolbox);
-        let error = dialog_provider_from_app_config(&config).err();
-
-        assert_eq!(
-            error,
-            Some(DialogProviderBuildError::GenkitProviderApiKeyRequired {
-                provider: "openrouter",
-            })
-        );
-    }
-
     #[tokio::test]
-    #[ignore = "live OpenRouter GenKit-compatible dialog smoke"]
+    #[ignore = "live OpenRouter routed dialog smoke"]
     async fn live_genkit_openrouter_dialog_smoke_completes_minimal_prompt()
     -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         let openrouter_key = required_env("OPENROUTER_KEY")?;
-        let googleai_key = optional_env("GOOGLEAI_KEY");
-        let googleai_key_stats_file = optional_env("GOOGLEAI_KEY_STATS_FILE");
-        if googleai_key.is_none() && googleai_key_stats_file.is_none() {
-            return Err("GOOGLEAI_KEY or GOOGLEAI_KEY_STATS_FILE is required by the configured GenKit plugin route".into());
-        }
         let model = std::env::var("OPENPLOTVA_OPENROUTER_SMOKE_MODEL")
             .unwrap_or_else(|_| "openai/gpt-4o-mini".to_owned());
         let config = AppConfig::from_raw(openplotva_config::RawConfig {
             dialog_provider: Some("genkit".to_owned()),
             dialog_model: Some(format!("openrouter/{model}")),
-            googleai_key,
-            googleai_key_stats_file,
             openrouter_key: Some(openrouter_key),
             dialog_request_timeout_seconds: Some("60".to_owned()),
             ..openplotva_config::RawConfig::default()
         })?;
-        let _toolbox: Arc<dyn DialogToolbox> = Arc::new(EmptyToolbox);
-        let provider = dialog_provider_from_app_config(&config)?;
+        let prompts = Arc::new(openplotva_prompts::PromptStore::load()?);
+        let factory = ChatClientFactory::new(
+            &config,
+            aifarm_dialog_config_from_app_config(&config),
+            HashMap::new(),
+            prompts,
+        );
+        let mut attempt = attempt_for(1, "openrouter");
+        attempt.model_name = model;
+        let provider = factory.resolve(&attempt)?;
 
         let output = provider
             .as_chat_step()
@@ -1748,7 +1174,7 @@ mod tests {
 
     fn router_provider_for_test(
         snapshot: RoutingSnapshot,
-        default_provider: Arc<SequencedProvider>,
+        _default_provider: Arc<SequencedProvider>,
         clients: HashMap<String, DialogProviderHandle>,
         reporter: crate::runtime_routing::RoutingEventReporter,
     ) -> RouterChatProvider {
@@ -1758,38 +1184,23 @@ mod tests {
             Arc::new(BreakerSet::new()),
             Arc::new(TriggerState::new()),
             Arc::new(PoolRegistry::new()),
-            test_factory(handle, clients, default_provider),
+            test_factory(clients),
         )
         .with_routing_event_reporter(reporter)
     }
 
-    fn test_factory(
-        handle: Arc<RouterHandle>,
-        clients: HashMap<String, DialogProviderHandle>,
-        default_provider: DialogProviderHandle,
-    ) -> Arc<ChatClientFactory> {
+    fn test_factory(clients: HashMap<String, DialogProviderHandle>) -> Arc<ChatClientFactory> {
         Arc::new(ChatClientFactory::new(
-            handle,
+            &AppConfig::from_raw(Default::default()).expect("config"),
             AifarmDialogConfig::default(),
             clients,
-            default_provider,
             Arc::new(openplotva_prompts::PromptStore::load().expect("prompt store")),
         ))
     }
 
-    fn admin_created_provider_snapshot(protocol: &str, endpoint: &str) -> RoutingSnapshot {
-        let mut snapshot = routed_dialog_snapshot();
-        snapshot.providers[0].id = 5;
-        snapshot.providers[0].name = "my-sglang".to_owned();
-        snapshot.providers[0].protocol = Some(protocol.to_owned());
-        snapshot.providers[0].endpoint = Some(endpoint.to_owned());
-        snapshot.providers[0].api_key_ref = None;
-        snapshot.models[0].provider_id = 5;
-        snapshot
-    }
-
     fn attempt_for(provider_id: i64, provider_name: &str) -> crate::routed_attempts::RoutedAttempt {
         crate::routed_attempts::RoutedAttempt {
+            protocol: Some(openplotva_llm::provider_schema::Protocol::OpenAiCompat),
             provider_id,
             model_id: 10,
             provider_name: provider_name.to_owned(),
@@ -1810,154 +1221,58 @@ mod tests {
     }
 
     #[test]
-    fn factory_builds_client_for_admin_created_openai_provider() {
-        let snapshot = admin_created_provider_snapshot("openai_compat", "https://sglang.local/v1");
-        let handle = RouterHandle::new(crate::model_routing::build_routing_table(&snapshot));
-        let default_provider: DialogProviderHandle =
-            Arc::new(SequencedProvider::new("default", vec![]));
-        let factory = test_factory(handle, HashMap::new(), default_provider);
-
-        let client = factory
-            .resolve(&attempt_for(5, "my-sglang"))
-            .expect("dynamic client for an admin-created provider");
+    fn factory_caches_the_captured_route_and_refreshes_when_it_changes() {
+        let factory = test_factory(HashMap::new());
+        let mut attempt = attempt_for(5, "custom");
+        attempt.provider_endpoint = Some("https://gateway.test/v1".into());
+        let first = factory.resolve(&attempt).expect("first");
+        assert!(Arc::ptr_eq(
+            &first,
+            &factory.resolve(&attempt).expect("cached")
+        ));
+        attempt.provider_runtime_hint = Some("mlx".into());
+        assert!(!Arc::ptr_eq(
+            &first,
+            &factory.resolve(&attempt).expect("changed")
+        ));
+        attempt.provider_config = json!({"supports_cache_control": false});
+        let DialogClientConfig::OpenAi(cfg) = factory.client_config(&attempt).expect("config")
+        else {
+            panic!("openai")
+        };
+        assert!(!cfg.client.supports_cache_control);
         assert_eq!(
-            client.provider_name(),
-            "my-sglang",
-            "the request must go to the new provider, never the default"
-        );
-    }
-
-    #[test]
-    fn factory_reuses_cache_until_the_row_changes() {
-        let snapshot = admin_created_provider_snapshot("openai_compat", "https://sglang.local/v1");
-        let handle = RouterHandle::new(crate::model_routing::build_routing_table(&snapshot));
-        let default_provider: DialogProviderHandle =
-            Arc::new(SequencedProvider::new("default", vec![]));
-        let factory = test_factory(Arc::clone(&handle), HashMap::new(), default_provider);
-
-        let first = factory
-            .resolve(&attempt_for(5, "my-sglang"))
-            .expect("first");
-        let second = factory
-            .resolve(&attempt_for(5, "my-sglang"))
-            .expect("second");
-        assert!(
-            Arc::ptr_eq(&first, &second),
-            "an unchanged row must reuse the cached client"
-        );
-
-        let mut changed =
-            admin_created_provider_snapshot("openai_compat", "https://sglang.local/v1");
-        changed.providers[0].runtime_hint = Some("mlx".to_owned());
-        handle.store(crate::model_routing::build_routing_table(&changed));
-        let third = factory
-            .resolve(&attempt_for(5, "my-sglang"))
-            .expect("third");
-        assert!(
-            !Arc::ptr_eq(&first, &third),
-            "a runtime-hint-only change must invalidate the cached client"
+            cfg.client.direct_url,
+            "https://gateway.test/v1/chat/completions"
         );
     }
 
     #[test]
-    fn factory_config_follows_the_provider_cache_control_switch() {
-        let mut snapshot =
-            admin_created_provider_snapshot("openai_compat", "https://gateway.local/v1");
-        let handle = RouterHandle::new(crate::model_routing::build_routing_table(&snapshot));
-        let default_provider: DialogProviderHandle =
-            Arc::new(SequencedProvider::new("default", vec![]));
-        let factory = test_factory(Arc::clone(&handle), HashMap::new(), default_provider);
-        let config_for = |handle: &RouterHandle| {
-            let table = handle.snapshot();
-            let row = table.provider(5).expect("provider row");
-            factory
-                .dynamic_dialog_config(row, GatewayRequestFields::default())
-                .expect("dynamic config")
-        };
-
-        assert!(config_for(&handle).client.supports_cache_control);
-
-        snapshot.providers[0].config = json!({ "supports_cache_control": false });
-        handle.store(crate::model_routing::build_routing_table(&snapshot));
-        assert!(!config_for(&handle).client.supports_cache_control);
-    }
-
-    #[test]
-    fn factory_client_carries_the_route_gateway_fields() {
-        let snapshot = admin_created_provider_snapshot("openai_compat", "https://gateway.local/v1");
-        let handle = RouterHandle::new(crate::model_routing::build_routing_table(&snapshot));
-        let default_provider: DialogProviderHandle =
-            Arc::new(SequencedProvider::new("default", vec![]));
-        let factory = test_factory(Arc::clone(&handle), HashMap::new(), default_provider);
-        let table = handle.snapshot();
-        let row = table.provider(5).expect("provider row");
-        let overrides = json!({ "reasoning": { "effort": "none" } });
-
-        let cfg = factory
-            .dynamic_dialog_config(row, GatewayRequestFields::from_overrides(&overrides))
-            .expect("dynamic config");
-
+    fn factory_rejects_unsupported_protocols_before_using_a_transport() {
+        let factory = test_factory(HashMap::new());
+        let mut attempt = attempt_for(5, "custom");
+        attempt.protocol = Some(openplotva_llm::provider_schema::Protocol::AceStep);
         assert_eq!(
-            cfg.client.gateway_fields.reasoning,
-            Some(json!({ "effort": "none" }))
-        );
-        assert_eq!(
-            cfg.client.direct_url,
-            "https://gateway.local/v1/chat/completions"
-        );
-
-        let plain = factory
-            .resolve(&attempt_for(5, "my-sglang"))
-            .expect("plain");
-        let mut quiet = attempt_for(5, "my-sglang");
-        quiet.overrides.extra = overrides;
-        let quiet_client = factory.resolve(&quiet).expect("reasoning off");
-        assert!(
-            !Arc::ptr_eq(&plain, &quiet_client),
-            "different gateway fields must not share a cached client"
-        );
-        let mut other_model = attempt_for(5, "my-sglang");
-        other_model.model_id = 11;
-        let other_client = factory.resolve(&other_model).expect("second model");
-        assert!(
-            !Arc::ptr_eq(&plain, &other_client),
-            "each model of a provider gets its own cached client"
+            retryable_reason(&factory.resolve(&attempt).err().expect("unsupported")),
+            Some(FailureReason::ProviderUnavailable)
         );
     }
 
     #[test]
-    fn factory_rejects_protocols_without_a_dynamic_adapter_as_retryable() {
-        let snapshot = admin_created_provider_snapshot("acestep", "https://music.local");
-        let handle = RouterHandle::new(crate::model_routing::build_routing_table(&snapshot));
-        let default_provider: DialogProviderHandle =
-            Arc::new(SequencedProvider::new("default", vec![]));
-        let factory = test_factory(handle, HashMap::new(), default_provider);
-
-        let Err(error) = factory.resolve(&attempt_for(5, "my-sglang")) else {
-            panic!("acestep must have no dynamic dialog adapter");
+    fn factory_respects_explicit_openai_protocol_on_a_google_named_provider() {
+        let factory = test_factory(HashMap::new());
+        let mut attempt = attempt_for(5, "genkit");
+        attempt.provider_endpoint = Some("https://custom.test/v1".into());
+        let DialogClientConfig::OpenAi(cfg) = factory.client_config(&attempt).expect("config")
+        else {
+            panic!("openai")
         };
         assert_eq!(
-            openplotva_llm::retry::retryable_reason(&error),
-            Some(openplotva_llm::retry::FailureReason::ProviderUnavailable),
-            "the walker must skip to the next candidate, not fail the run"
+            cfg.client.direct_url,
+            "https://custom.test/v1/chat/completions"
         );
     }
 
-    #[test]
-    fn factory_prefers_static_clients_by_name() {
-        let snapshot = routed_dialog_snapshot();
-        let handle = RouterHandle::new(crate::model_routing::build_routing_table(&snapshot));
-        let aifarm: DialogProviderHandle = Arc::new(SequencedProvider::new("aifarm", vec![]));
-        let default_provider: DialogProviderHandle =
-            Arc::new(SequencedProvider::new("default", vec![]));
-        let mut clients = HashMap::new();
-        clients.insert("aifarm".to_owned(), Arc::clone(&aifarm));
-        let factory = test_factory(handle, clients, default_provider);
-
-        let resolved = factory.resolve(&attempt_for(1, "aifarm")).expect("static");
-        assert!(Arc::ptr_eq(&resolved, &aifarm));
-    }
-
     fn routed_dialog_snapshot() -> RoutingSnapshot {
         RoutingSnapshot {
             providers: vec![ProviderRecord {
diff --git a/crates/openplotva-app/src/dialog_tools.rs b/crates/openplotva-app/src/dialog_tools.rs
index 0688ec0b..1262e538 100644
--- a/crates/openplotva-app/src/dialog_tools.rs
+++ b/crates/openplotva-app/src/dialog_tools.rs
@@ -4154,6 +4154,7 @@ mod tests {
 
     fn context() -> ToolContext {
         ToolContext {
+            invocation_id: None,
             chat_id: -100,
             thread_id: Some(7),
             message_id: 11,
@@ -4445,6 +4446,7 @@ mod tests {
         };
         let request = DrawRequest {
             context: ToolContext {
+                invocation_id: None,
                 message_meta: meta,
                 message_text: "объедини эти картинки".to_owned(),
                 ..context()
@@ -4960,6 +4962,7 @@ mod tests {
         };
         let mut request = DrawRequest {
             context: ToolContext {
+                invocation_id: None,
                 image_attachments: vec![first.clone(), second.clone(), unrelated],
                 ..Default::default()
             },
@@ -5001,6 +5004,7 @@ mod tests {
                 .collect();
             let mut request = DrawRequest {
                 context: ToolContext {
+                    invocation_id: None,
                     message_meta: ChatMessageMeta {
                         attachments: vec![images[0].clone()],
                         ..Default::default()
@@ -5120,6 +5124,7 @@ mod tests {
         };
         let request = SongRequest {
             context: ToolContext {
+                invocation_id: None,
                 message_meta: meta.clone(),
                 ..context()
             },
@@ -5194,6 +5199,7 @@ mod tests {
         };
         let request = VisionRequest {
             context: ToolContext {
+                invocation_id: None,
                 message_meta: meta.clone(),
                 ..context()
             },
@@ -5754,7 +5760,6 @@ mod tests {
     -> Result<(), ToolboxError> {
         let queue = Arc::new(InMemoryTaskQueue::new());
         let vip = Arc::new(DrawImageVipStatusStub::new(true));
-        let rich = Arc::new(crate::rich::MockRichSender::default());
         let reactions = Arc::new(crate::reactions::test_support::RecordingReactionSink::default());
         let adapter = TaskmanDialogToolAdapter::new(Arc::clone(&queue))
             .with_generation_reactions(
@@ -5777,7 +5782,7 @@ mod tests {
         assert_eq!(scheduled.status, "scheduled");
         // Reactions take precedence: no ⏳ placeholder message, a 👀 reaction
         // on the trigger instead, and no queue-position id to reuse later.
-        assert!(rich.sent.lock().expect("rich sent").is_empty());
+        assert!(queue.records()[0].messages.is_empty());
         let calls = reactions.calls.lock().expect("reaction calls").clone();
         assert_eq!(calls.len(), 1);
         assert_eq!(calls[0].0, "queued");
@@ -6960,6 +6965,7 @@ mod tests {
     fn fallback_draw_request() -> DrawRequest {
         DrawRequest {
             context: ToolContext {
+                invocation_id: None,
                 message_meta: ChatMessageMeta {
                     attachments: vec![
                         image_attachment("reference-a"),
diff --git a/crates/openplotva-app/src/dialog_turn/session.rs b/crates/openplotva-app/src/dialog_turn/session.rs
index ccdf6540..f32d1e11 100644
--- a/crates/openplotva-app/src/dialog_turn/session.rs
+++ b/crates/openplotva-app/src/dialog_turn/session.rs
@@ -1377,6 +1377,7 @@ where
                 let slice = session_tool_slice(&budget, cfg, failure_now);
                 let result = tokio::time::timeout(slice, execute_session_tool(
                     SessionToolExecution {
+                        invocation_id: format!("dialog-job:{}:step:{iteration}:call:{call_index}", ctx.item_id),
                         call,
                         cfg,
                         meta: &tool_context,
@@ -1997,6 +1998,7 @@ async fn dispatch_session_tool_with_timeout(
 }
 
 struct SessionToolExecution<'a, 'b> {
+    invocation_id: String,
     call: &'a ChatStepToolCall,
     cfg: &'a SessionTurnConfig<'b>,
     meta: &'a ToolContext,
@@ -2026,6 +2028,7 @@ where
 {
     let step = &exec.call.step;
     let mut tool_meta = exec.meta.clone();
+    tool_meta.invocation_id = Some(exec.invocation_id.clone());
     tool_meta.message_meta.agent_gift = false;
     if step.gift {
         let granted = exec
@@ -2412,7 +2415,7 @@ async fn queue_gradius_banner(
 async fn append_session_queued_marker<Queue>(
     queue: &Queue,
     job_id: i64,
-    receipt: &crate::dialog_jobs::QueuedBatchReceipt,
+    receipt: &crate::telegram_outbox::QueuedBatchReceipt,
     at: OffsetDateTime,
 ) where
     Queue: DialogJobWorkerQueue + Sync + ?Sized,
@@ -2699,7 +2702,7 @@ impl DialogJobEffects for CaptureDelivery {
                 .lock()
                 .expect("capture delivery")
                 .push(answer.to_owned());
-            Ok(crate::dialog_jobs::QueuedBatchReceipt::dispatcher(
+            Ok(crate::telegram_outbox::QueuedBatchReceipt::dispatcher(
                 "capture".to_owned(),
                 Vec::new(),
             ))
diff --git a/crates/openplotva-app/src/embedder.rs b/crates/openplotva-app/src/embedder.rs
index 90a56d20..ef7e4d7c 100644
--- a/crates/openplotva-app/src/embedder.rs
+++ b/crates/openplotva-app/src/embedder.rs
@@ -624,6 +624,11 @@ fn routed_embedder_client(
     attempt: &RoutedAttempt,
     dimension: i32,
 ) -> Result<DiscoveryEmbedderClient, EmbedderClientError> {
+    if attempt.protocol != Some(openplotva_llm::provider_schema::Protocol::DiscoveryJobs) {
+        return Err(EmbedderClientError::discovery(
+            "selected protocol does not support this Discovery adapter".to_owned(),
+        ));
+    }
     if let Some(embedding_dim) = attempt.embedding_dim
         && embedding_dim != dimension
     {
@@ -631,41 +636,14 @@ fn routed_embedder_client(
             "embedding dimension mismatch: route has {embedding_dim}, request needs {dimension}"
         )));
     }
-    if let Some(endpoint) = attempt
-        .model_base_url
-        .as_deref()
-        .or(attempt.provider_endpoint.as_deref())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
+    if let Some(endpoint) = attempt.endpoint() {
         config.base_url = endpoint.to_owned();
     }
-    if let Some(service_name) = attempt
-        .discovery_service_name
-        .as_deref()
-        .or_else(|| {
-            attempt
-                .provider_config
-                .get("service_name")
-                .and_then(serde_json::Value::as_str)
-        })
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
+    let (service_name, endpoint_name) = attempt.discovery_names();
+    if let Some(service_name) = service_name {
         config.service_name = service_name.to_owned();
     }
-    if let Some(endpoint_name) = attempt
-        .discovery_endpoint_name
-        .as_deref()
-        .or_else(|| {
-            attempt
-                .provider_config
-                .get("endpoint_name")
-                .and_then(serde_json::Value::as_str)
-        })
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
+    if let Some(endpoint_name) = endpoint_name {
         config.endpoint_name = endpoint_name.to_owned();
     }
     if attempt.model_name.trim().is_empty() {
diff --git a/crates/openplotva-app/src/gradius_ads.rs b/crates/openplotva-app/src/gradius_ads.rs
index d0a69bb1..e91122b3 100644
--- a/crates/openplotva-app/src/gradius_ads.rs
+++ b/crates/openplotva-app/src/gradius_ads.rs
@@ -1543,6 +1543,7 @@ fn banner_outbox_batch(
             .and_then(OutboundCommand::into_storage_parts)
             .map_err(|error| error.to_string())?;
     Ok(TelegramOutboxBatchInput {
+        content_policy: openplotva_storage::TelegramOutboxContentPolicy::Immutable,
         batch_id: format!(
             "{GRADIUS_BANNER_BATCH_PREFIX}{bot_id}:{}",
             target.dialog_job_id
@@ -1550,7 +1551,7 @@ fn banner_outbox_batch(
         bot_id,
         chat_id: Some(target.chat_id),
         thread_id: target.thread_id,
-        ordering_key: crate::dialog_jobs::dialog_outbox_ordering_key(
+        ordering_key: crate::telegram_outbox::telegram_outbox_ordering_key(
             bot_id,
             target.chat_id,
             target.thread_id,
@@ -1596,9 +1597,9 @@ fn render_ad_tail(
 #[must_use]
 pub fn gradius_privacy_config(
     config: &openplotva_config::AppConfig,
-) -> openplotva_memory::DiscoveryRedactorConfig {
+) -> openplotva_llm::redaction::DiscoveryRedactorConfig {
     let memory = &config.memory;
-    openplotva_memory::DiscoveryRedactorConfig {
+    openplotva_llm::redaction::DiscoveryRedactorConfig {
         base_url: config.llm.discovery.base_url.clone(),
         service_name: memory.redaction_service_name.clone(),
         endpoint_name: memory.redaction_endpoint_name.clone(),
@@ -2146,7 +2147,7 @@ mod tests {
     #[tokio::test]
     async fn postgres_rates_ads_keep_rich_table_and_separator_in_durable_outbox()
     -> Result<(), Box<dyn std::error::Error>> {
-        use crate::rates::{RatesEffects, RatesTextPlan, RatesUtilityEffects};
+        use crate::rates::{RatesDelivery, RatesEffects, RatesTextPlan};
         use openplotva_storage::{
             PostgresTelegramOutboxStore, gradius_ads::PostgresGradiusAdStore,
         };
@@ -2167,8 +2168,11 @@ mod tests {
             Arc::new(PostgresGradiusAdStore::new(pool.clone())),
             Arc::new(VipStub(false)),
         ));
-        let rich = Arc::new(crate::rich::MockRichSender::default());
-        let effects = RatesUtilityEffects::new(rich.clone()).with_utility_ads(
+        let rich = Arc::new(crate::rich::RichOutbox::new(
+            PostgresTelegramOutboxStore::new(pool.clone()),
+            7,
+        ));
+        let effects = RatesDelivery::new(rich.clone()).with_utility_ads(
             ads,
             Arc::new(crate::gradius_utility_outbox::GradiusUtilityOutbox::new(
                 PostgresTelegramOutboxStore::new(pool.clone()),
@@ -2235,7 +2239,6 @@ mod tests {
                 .await?;
         }
         assert_eq!(client.calls.lock().expect("provider calls").len(), 2);
-        assert!(rich.sent.lock().expect("fallback calls").is_empty());
         Ok(())
     }
 
diff --git a/crates/openplotva-app/src/gradius_utility_outbox.rs b/crates/openplotva-app/src/gradius_utility_outbox.rs
index 5dd72b93..9667f65e 100644
--- a/crates/openplotva-app/src/gradius_utility_outbox.rs
+++ b/crates/openplotva-app/src/gradius_utility_outbox.rs
@@ -177,6 +177,7 @@ impl GradiusUtilityOutbox {
             reply_to_message_id,
             TelegramDeliveryPolicy::Create,
             TelegramOutboundMethod::from(method),
+            None,
         )
         .await
     }
@@ -211,6 +212,7 @@ impl GradiusUtilityOutbox {
             reply_to_message_id,
             TelegramDeliveryPolicy::Create,
             method,
+            None,
         )
         .await
     }
@@ -225,6 +227,7 @@ impl GradiusUtilityOutbox {
         thread_id: Option<i32>,
         message_id: i64,
         html: String,
+        job_id: i64,
     ) -> Result<Option<String>, String> {
         let method = match utility_rich_edit(chat_id, message_id, &html) {
             Ok(method) => method,
@@ -244,6 +247,7 @@ impl GradiusUtilityOutbox {
             message_id,
             TelegramDeliveryPolicy::TargetIdempotent,
             method,
+            Some(job_id),
         )
         .await
     }
@@ -259,6 +263,7 @@ impl GradiusUtilityOutbox {
         trigger_message_id: i64,
         policy: TelegramDeliveryPolicy,
         method: TelegramOutboundMethod,
+        job_id: Option<i64>,
     ) -> Result<Option<String>, String> {
         let command = match OutboundCommand::try_from_method(method) {
             Ok(command) => command,
@@ -281,17 +286,26 @@ impl GradiusUtilityOutbox {
         let batch_id = format!("gradius-utility:v1:{}:{source_key}", self.bot_id);
         let now = OffsetDateTime::now_utc();
         let batch = TelegramOutboxBatchInput {
+            content_policy: openplotva_storage::TelegramOutboxContentPolicy::Immutable,
             batch_id: batch_id.clone(),
             bot_id: self.bot_id,
             chat_id: Some(chat_id),
             thread_id,
-            ordering_key: format!(
-                "gradius-utility:{}:{chat_id}:{}",
-                self.bot_id,
-                thread_id.unwrap_or_default()
-            ),
+            ordering_key: if method_kind == "sendRichMessage" || job_id.is_some() {
+                crate::telegram_outbox::telegram_outbox_ordering_key(
+                    self.bot_id,
+                    chat_id,
+                    thread_id,
+                )
+            } else {
+                format!(
+                    "gradius-utility:{}:{chat_id}:{}",
+                    self.bot_id,
+                    thread_id.unwrap_or_default()
+                )
+            },
             causation_update_id: None,
-            dialog_job_id: None,
+            dialog_job_id: job_id,
             trigger_message_id: Some(trigger_message_id),
             delivery_policy: policy,
             protected: true,
diff --git a/crates/openplotva-app/src/help.rs b/crates/openplotva-app/src/help.rs
index e5856942..cce620cc 100644
--- a/crates/openplotva-app/src/help.rs
+++ b/crates/openplotva-app/src/help.rs
@@ -146,21 +146,21 @@ pub type HelpVirtualIdFactory = VirtualIdFactory;
 pub struct HelpDispatcherEffects<Next> {
     telegram: TelegramClient,
     delegated_next: Arc<Next>,
-    rich: Arc<dyn crate::rich::RichSender>,
+    delivery: Arc<crate::rich::RichOutbox>,
 }
 
 impl<Next> HelpDispatcherEffects<Next> {
-    /// Build help effects: rich private help + classic direct group redirect + delegation.
+    /// Build queued private help, group redirects, and private-start delegation.
     #[must_use]
     pub fn new(
         telegram: TelegramClient,
         delegated_next: Arc<Next>,
-        rich: Arc<dyn crate::rich::RichSender>,
+        delivery: Arc<crate::rich::RichOutbox>,
     ) -> Self {
         Self {
             telegram,
             delegated_next,
-            rich,
+            delivery,
         }
     }
 }
@@ -212,8 +212,17 @@ where
                     .as_ref()
                     .and_then(|markup| serde_json::to_value(markup).ok()),
             };
-            self.rich
-                .send_rich(chat_id, &plan.message.text, &options)
+            self.delivery
+                .enqueue(
+                    &format!("help:{chat_id}:{}", plan.reply_to.message_id),
+                    options.message_thread_id,
+                    openplotva_telegram::SendRichMessage {
+                        chat_id,
+                        html: plan.message.text,
+                        options,
+                    },
+                    None,
+                )
                 .await
                 .map_err(|error| HelpDispatchEffectError::RichSend(error.to_string()))?;
             Ok(())
@@ -746,6 +755,99 @@ mod tests {
         Ok(())
     }
 
+    #[tokio::test]
+    async fn postgres_help_and_vip_status_queue_prepared_payloads_by_command()
+    -> Result<(), Box<dyn std::error::Error>> {
+        use crate::payments::VipStatusEffects;
+        let Ok(dsn) = std::env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
+            return Ok(());
+        };
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(4)
+            .connect(&dsn)
+            .await?;
+        openplotva_storage::run_migrations_on(&pool).await?;
+        let delivery = Arc::new(crate::rich::RichOutbox::new(
+            openplotva_storage::PostgresTelegramOutboxStore::new(pool.clone()),
+            7,
+        ));
+        let telegram =
+            openplotva_telegram::telegram_client_with_base_url("123:test", "http://127.0.0.1:1")?;
+        let help = HelpDispatcherEffects::new(
+            telegram.clone(),
+            Arc::new(UpdateHandlerStub::default()),
+            delivery.clone(),
+        );
+        let plan = private_help_plan(&bot(), &private_command("/help", 5)?);
+        help.send_help_text(plan.clone()).await?;
+        let mut replay = plan.clone();
+        replay.message.text = "changed help".into();
+        help.send_help_text(replay).await?;
+        let source = format!(
+            "help:{}:{}",
+            plan.reply_to.chat.id, plan.reply_to.message_id
+        );
+        let help_receipt = delivery.queued(&source, None).await?.expect("queued help");
+        assert!(!help_receipt.delivery_complete());
+        let saved: serde_json::Value =
+            sqlx::query_scalar("SELECT payload FROM telegram_outbox WHERE batch_id = $1")
+                .bind(&help_receipt.batch_id)
+                .fetch_one(&pool)
+                .await?;
+        assert_eq!(
+            saved["html"],
+            openplotva_telegram::format_rich_html(&plan.message.text)
+        );
+        assert_eq!(
+            saved["options"]["reply_to_message_id"],
+            plan.reply_to.message_id
+        );
+        let vip = crate::payments::RichPaymentEffects::new(telegram, delivery.clone());
+        let mut status = crate::payments::VipStatusMessage {
+            chat_id: 42,
+            reply_to_message_id: 101,
+            message_thread_id: None,
+            text: "✅ VIP active\n\n<b>Until tomorrow</b>".into(),
+            show_cancel_button: true,
+        };
+        vip.send_vip_status_message(status.clone()).await?;
+        status.text = "a newer status".into();
+        vip.send_vip_status_message(status.clone()).await?;
+        status.reply_to_message_id = 102;
+        vip.send_vip_status_message(status).await?;
+        let first = delivery
+            .queued("vip-status:42:101", None)
+            .await?
+            .expect("first command");
+        let next = delivery
+            .queued("vip-status:42:102", None)
+            .await?
+            .expect("next command");
+        assert_ne!(first.operation_ids, next.operation_ids);
+        let saved: serde_json::Value =
+            sqlx::query_scalar("SELECT payload FROM telegram_outbox WHERE batch_id = $1")
+                .bind(&first.batch_id)
+                .fetch_one(&pool)
+                .await?;
+        assert!(
+            saved["html"]
+                .as_str()
+                .expect("VIP HTML")
+                .contains("VIP active")
+        );
+        assert_eq!(saved["options"]["reply_to_message_id"], 101);
+        assert_eq!(
+            saved["options"]["reply_markup"]["inline_keyboard"][0][0]["callback_data"],
+            r#"{"action":"cancel_vip"}"#
+        );
+        let ids = vec![help_receipt.batch_id, first.batch_id, next.batch_id];
+        sqlx::query("DELETE FROM telegram_outbox WHERE batch_id = ANY($1)")
+            .bind(ids)
+            .execute(&pool)
+            .await?;
+        Ok(())
+    }
+
     #[test]
     fn private_help_plan_matches_go_html_message() -> Result<(), Box<dyn std::error::Error>> {
         let message = private_command("/help", 5)?;
diff --git a/crates/openplotva-app/src/history_summary.rs b/crates/openplotva-app/src/history_summary.rs
index 6ce51f1e..26ae554a 100644
--- a/crates/openplotva-app/src/history_summary.rs
+++ b/crates/openplotva-app/src/history_summary.rs
@@ -18,21 +18,18 @@ use openplotva_history::{
     build_ordered_summary_input_assembly, build_summary_input,
     decode_summary_message_entry_payloads, estimate_summary_tokens,
     filter_summary_entries_with_content, fit_summary_input_to_token_limit, hash_text,
-    history_summary_generate_error_retryable, history_summary_model, history_summary_provider,
-    history_summary_scope, history_summary_timeout_seconds, merge_edge_summary_input,
-    normalize_generated_summary_content, normalize_summary_request, normalized_summary_window,
-    parse_history_summary_since, render_history_summary_html, select_reusable_summary_spans,
-    stamp_summary_input_metadata, summary_message_entry_timestamp, summary_requested_range,
-    summary_reset_at,
+    history_summary_model, history_summary_scope, history_summary_timeout_seconds,
+    merge_edge_summary_input, normalize_generated_summary_content, normalize_summary_request,
+    normalized_summary_window, parse_history_summary_since, render_history_summary_html,
+    select_reusable_summary_spans, stamp_summary_input_metadata, summary_message_entry_timestamp,
+    summary_requested_range, summary_reset_at,
 };
 use openplotva_llm::aifarm::{
-    AifarmClientConfig, AifarmHistorySummaryConfig, AifarmHistorySummaryError,
-    AifarmHistorySummaryGenerator, GenkitOpenAiCompatibleHistorySummaryConfig,
-    GenkitOpenAiCompatibleHistorySummaryError, GenkitOpenAiCompatibleHistorySummaryGenerator,
-    ReqwestAifarmTransport,
+    AifarmClientConfig, AifarmHistorySummaryConfig, AifarmHistorySummaryGenerator,
+    GenkitOpenAiCompatibleHistorySummaryConfig, GenkitOpenAiCompatibleHistorySummaryGenerator,
 };
 use openplotva_llm::gemini::{GeminiHistorySummaryConfig, GeminiHistorySummaryGenerator};
-use openplotva_llm::retry::{FailureReason, retryable_reason, retryable_reason_from_message};
+use openplotva_llm::retry::{FailureReason, retryable_reason_from_message};
 use openplotva_storage::{PostgresHistoryStore, StorageError};
 use thiserror::Error;
 use time::OffsetDateTime;
@@ -43,17 +40,10 @@ use crate::dialog_tools::{
 use crate::routed_attempts::{
     RoutedAttempt, RoutedAttemptRunError, RoutedAttemptWalker, RoutedRequestContext,
 };
-use crate::runtime_gemini_cache::resolve_google_ai_key;
 
-const OPENROUTER_MODEL_PREFIX: &str = "openrouter/";
-const OPENROUTER_CHAT_COMPLETIONS_URL: &str = "https://openrouter.ai/api/v1/chat/completions";
 /// Stage-one chunks summarized at the same time.
 const STAGE_ONE_CONCURRENCY: usize = 3;
 
-/// Concrete app history-summary service used by the dialog toolbox runtime.
-pub type AppHistorySummaryService =
-    ChatHistorySummaryService<PostgresHistoryStore, RuntimeHistorySummaryGenerator>;
-
 /// Boxed future returned by history reset stores.
 pub type HistoryResetFuture<'a> = Pin<
     Box<dyn Future<Output = Result<Option<OffsetDateTime>, HistorySummaryInputError>> + Send + 'a>,
@@ -181,57 +171,6 @@ pub enum HistorySummaryServiceError {
     },
 }
 
-/// Error returned while building a concrete history-summary runtime.
-#[derive(Debug, Error)]
-pub enum HistorySummaryRuntimeBuildError {
-    #[error("google ai key is required for genkit history summary provider")]
-    GoogleAiKeyRequired,
-    /// GenKit OpenAI-compatible provider was requested without its API key.
-    #[error("{provider} api key is required for genkit history summary provider")]
-    ProviderApiKeyRequired {
-        /// Provider name.
-        provider: &'static str,
-    },
-    #[error("unsupported history summary provider {provider:?}")]
-    UnsupportedProvider {
-        /// Canonical provider name.
-        provider: String,
-    },
-}
-
-#[derive(Clone)]
-pub enum RuntimeHistorySummaryGenerator {
-    /// AIFarm history-summary path.
-    Aifarm {
-        /// Primary AIFarm generator.
-        primary: Box<AifarmHistorySummaryGenerator>,
-        primary_model: String,
-        /// Runtime GenKit fallback branch, present only when a concrete runtime provider resolves.
-        fallback: Option<Box<AppGenkitHistorySummaryGenerator>>,
-    },
-    Genkit(Box<AppGenkitHistorySummaryGenerator>),
-}
-
-/// App-owned GenKit history-summary branch.
-#[derive(Clone)]
-pub enum AppGenkitHistorySummaryGenerator {
-    /// Direct Gemini implementation.
-    Gemini(GeminiHistorySummaryGenerator<ReqwestAifarmTransport>),
-    /// OpenAI-compatible GenKit plugin implementation.
-    OpenAiCompatible(Box<GenkitOpenAiCompatibleHistorySummaryGenerator<ReqwestAifarmTransport>>),
-}
-
-/// App-owned GenKit history-summary error.
-#[derive(Debug, Error)]
-pub enum AppGenkitHistorySummaryError {
-    /// Direct Gemini implementation failed.
-    #[error(transparent)]
-    Gemini(#[from] openplotva_llm::gemini::GeminiHistorySummaryError),
-    /// OpenAI-compatible plugin implementation failed.
-    #[error(transparent)]
-    OpenAiCompatible(#[from] GenkitOpenAiCompatibleHistorySummaryError),
-}
-
 #[derive(Clone)]
 pub struct RoutedHistorySummaryGenerator {
     walker: RoutedAttemptWalker,
@@ -571,134 +510,6 @@ pub fn aifarm_history_summary_config_from_app_config(
     .with_defaults()
 }
 
-#[must_use]
-pub fn gemini_history_summary_config_from_app_config(
-    config: &AppConfig,
-) -> GeminiHistorySummaryConfig {
-    let history = &config.llm.history_summary;
-    GeminiHistorySummaryConfig {
-        api_key: resolve_google_ai_key(&config.google_ai),
-        model: history_summary_model(
-            &history.model,
-            &history.provider,
-            &config.memory.consolidation_model,
-            Some(&crate::memory_runtime::genkit_runtime_default_model(config)),
-        ),
-        request_timeout: positive_seconds(history.timeout_seconds),
-        ..GeminiHistorySummaryConfig::default()
-    }
-    .with_defaults()
-}
-
-#[must_use]
-pub fn gemini_history_summary_fallback_config_from_app_config(
-    config: &AppConfig,
-) -> GeminiHistorySummaryConfig {
-    GeminiHistorySummaryConfig {
-        api_key: resolve_google_ai_key(&config.google_ai),
-        model: crate::memory_runtime::genkit_runtime_default_model(config),
-        request_timeout: positive_seconds(config.llm.history_summary.timeout_seconds),
-        ..GeminiHistorySummaryConfig::default()
-    }
-    .with_defaults()
-}
-
-fn genkit_history_summary_generator_from_app_config(
-    config: &AppConfig,
-    model_override: Option<&str>,
-) -> Result<AppGenkitHistorySummaryGenerator, HistorySummaryRuntimeBuildError> {
-    let history = &config.llm.history_summary;
-    let model = model_override
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .map_or_else(
-            || {
-                history_summary_model(
-                    &history.model,
-                    &history.provider,
-                    &config.memory.consolidation_model,
-                    Some(&crate::memory_runtime::genkit_runtime_default_model(config)),
-                )
-            },
-            ToOwned::to_owned,
-        );
-    if let Some(cfg) =
-        genkit_openai_compatible_history_summary_config_from_app_config(config, &model)?
-    {
-        return Ok(AppGenkitHistorySummaryGenerator::OpenAiCompatible(
-            Box::new(GenkitOpenAiCompatibleHistorySummaryGenerator::new(cfg)),
-        ));
-    }
-    let cfg = GeminiHistorySummaryConfig {
-        api_key: resolve_google_ai_key(&config.google_ai),
-        model,
-        request_timeout: positive_seconds(history.timeout_seconds),
-        ..GeminiHistorySummaryConfig::default()
-    }
-    .with_defaults();
-    if cfg.api_key.trim().is_empty() {
-        return Err(HistorySummaryRuntimeBuildError::GoogleAiKeyRequired);
-    }
-    Ok(AppGenkitHistorySummaryGenerator::Gemini(
-        GeminiHistorySummaryGenerator::new(cfg),
-    ))
-}
-
-fn genkit_openai_compatible_history_summary_config_from_app_config(
-    config: &AppConfig,
-    model: &str,
-) -> Result<Option<GenkitOpenAiCompatibleHistorySummaryConfig>, HistorySummaryRuntimeBuildError> {
-    let model = model.trim();
-    let (direct_url, api_key, model, request_timeout_seconds, provider) =
-        if let Some(model) = strip_provider_prefix_fold(model, OPENROUTER_MODEL_PREFIX) {
-            (
-                OPENROUTER_CHAT_COMPLETIONS_URL,
-                config.open_router.key.trim().to_owned(),
-                model.trim().to_owned(),
-                config.open_router.request_timeout_seconds,
-                "openrouter",
-            )
-        } else {
-            return Ok(None);
-        };
-    if model.is_empty() {
-        return Ok(None);
-    }
-    if api_key.trim().is_empty() {
-        return Err(HistorySummaryRuntimeBuildError::ProviderApiKeyRequired { provider });
-    }
-    Ok(Some(GenkitOpenAiCompatibleHistorySummaryConfig {
-        direct_url: direct_url.to_owned(),
-        api_key,
-        model,
-        request_timeout: positive_seconds(request_timeout_seconds),
-        ..GenkitOpenAiCompatibleHistorySummaryConfig::default()
-    }))
-}
-
-fn strip_provider_prefix_fold<'a>(value: &'a str, prefix: &str) -> Option<&'a str> {
-    value
-        .get(..prefix.len())
-        .is_some_and(|head| head.eq_ignore_ascii_case(prefix))
-        .then(|| &value[prefix.len()..])
-}
-
-/// Build the concrete history-summary service for dialog toolbox wiring.
-pub fn history_summary_service_from_app_config(
-    config: &AppConfig,
-    store: Arc<PostgresHistoryStore>,
-) -> Result<AppHistorySummaryService, HistorySummaryRuntimeBuildError> {
-    let generator = history_summary_generator_from_app_config(config)?;
-    let options = HistorySummaryServiceOptions::default()
-        .with_max_input_tokens(config.memory.max_input_tokens)
-        .with_timeout_seconds(config.llm.history_summary.timeout_seconds);
-    Ok(ChatHistorySummaryService::new_with_options(
-        store,
-        Arc::new(generator),
-        options,
-    ))
-}
-
 pub fn routed_history_summary_service_from_app_config(
     config: &AppConfig,
     store: Arc<PostgresHistoryStore>,
@@ -711,38 +522,6 @@ pub fn routed_history_summary_service_from_app_config(
     ChatHistorySummaryService::new_with_options(store, Arc::new(generator), options)
 }
 
-/// Build the concrete provider generator without binding storage.
-pub fn history_summary_generator_from_app_config(
-    config: &AppConfig,
-) -> Result<RuntimeHistorySummaryGenerator, HistorySummaryRuntimeBuildError> {
-    let provider = history_summary_provider(&config.llm.history_summary.provider);
-    let generator = match provider {
-        "aifarm" => {
-            let cfg = aifarm_history_summary_config_from_app_config(config);
-            let fallback = genkit_history_summary_generator_from_app_config(
-                config,
-                Some(&crate::memory_runtime::genkit_runtime_default_model(config)),
-            )
-            .ok()
-            .map(Box::new);
-            RuntimeHistorySummaryGenerator::Aifarm {
-                primary_model: cfg.model.clone(),
-                primary: Box::new(AifarmHistorySummaryGenerator::new(cfg)),
-                fallback,
-            }
-        }
-        "genkit" => RuntimeHistorySummaryGenerator::Genkit(Box::new(
-            genkit_history_summary_generator_from_app_config(config, None)?,
-        )),
-        provider => {
-            return Err(HistorySummaryRuntimeBuildError::UnsupportedProvider {
-                provider: provider.to_owned(),
-            });
-        }
-    };
-    Ok(generator)
-}
-
 fn positive_seconds(seconds: i32) -> Duration {
     if seconds <= 0 {
         Duration::ZERO
@@ -1021,30 +800,6 @@ where
     }
 }
 
-impl HistorySummaryGenerator for AppGenkitHistorySummaryGenerator {
-    fn generate_history_stage<'a>(
-        &'a self,
-        input: &'a SummaryInput,
-        stage: HistoryStage,
-        payload: &'a str,
-    ) -> HistoryStageFuture<'a> {
-        Box::pin(async move {
-            match self {
-                Self::Gemini(generator) => {
-                    generator
-                        .generate_history_stage(input, stage, payload)
-                        .await
-                }
-                Self::OpenAiCompatible(generator) => {
-                    generator
-                        .generate_history_stage(input, stage, payload)
-                        .await
-                }
-            }
-        })
-    }
-}
-
 impl HistorySummaryGenerator for RoutedHistorySummaryGenerator {
     fn generate_history_stage<'a>(
         &'a self,
@@ -1098,72 +853,63 @@ async fn generate_history_stage_with_attempt(
     stage: HistoryStage,
     payload: &str,
 ) -> Result<HistoryStageReply, HistorySummaryServiceError> {
-    if routed_attempt_is_genkit(&attempt) {
-        let model = genkit_model_for_attempt(&attempt);
-        let generator = genkit_history_summary_generator_from_app_config(config, Some(&model))
-            .map_err(|error| HistorySummaryServiceError::Generate {
-                message: error.to_string(),
-            })?;
+    if attempt.protocol == Some(openplotva_llm::provider_schema::Protocol::Genkit) {
+        let (api_key, base_url) = crate::provider_transport::gemini_endpoint_for_attempt(
+            config, &attempt,
+        )
+        .map_err(|error| HistorySummaryServiceError::Generate {
+            message: error.to_string(),
+        })?;
+        let generator = GeminiHistorySummaryGenerator::new(GeminiHistorySummaryConfig {
+            api_key,
+            base_url,
+            model: attempt.model_name.clone(),
+            request_timeout: positive_seconds(config.llm.history_summary.timeout_seconds),
+            ..GeminiHistorySummaryConfig::default()
+        });
+        return generator
+            .generate_history_stage(input, stage, payload)
+            .await;
+    }
+    if crate::provider_transport::is_openrouter(&attempt) {
+        let client = crate::provider_transport::openai_client_for_attempt(
+            config,
+            &attempt,
+            AifarmClientConfig::default(),
+        )
+        .map_err(|error| HistorySummaryServiceError::Generate {
+            message: error.to_string(),
+        })?;
+        let generator = GenkitOpenAiCompatibleHistorySummaryGenerator::new(
+            GenkitOpenAiCompatibleHistorySummaryConfig {
+                direct_url: client.direct_url,
+                api_key: client.api_key,
+                model: client.default_model,
+                request_timeout: client.request_timeout,
+                ..GenkitOpenAiCompatibleHistorySummaryConfig::default()
+            },
+        );
         return generator
             .generate_history_stage(input, stage, payload)
             .await;
     }
     let generator =
-        AifarmHistorySummaryGenerator::new(aifarm_history_config_for_attempt(config, &attempt));
+        AifarmHistorySummaryGenerator::new(aifarm_history_config_for_attempt(config, &attempt)?);
     generator
         .generate_history_stage(input, stage, payload)
         .await
 }
 
-fn routed_attempt_is_genkit(attempt: &RoutedAttempt) -> bool {
-    attempt.provider_name.eq_ignore_ascii_case("genkit")
-        || attempt.provider_name.eq_ignore_ascii_case("gemini")
-        || attempt.provider_name.eq_ignore_ascii_case("openrouter")
-}
-
-fn genkit_model_for_attempt(attempt: &RoutedAttempt) -> String {
-    if attempt.provider_name.eq_ignore_ascii_case("openrouter")
-        && !attempt
-            .model_name
-            .get(..OPENROUTER_MODEL_PREFIX.len())
-            .is_some_and(|head| head.eq_ignore_ascii_case(OPENROUTER_MODEL_PREFIX))
-    {
-        format!("{OPENROUTER_MODEL_PREFIX}{}", attempt.model_name.trim())
-    } else {
-        attempt.model_name.clone()
-    }
-}
-
 fn aifarm_history_config_for_attempt(
     config: &AppConfig,
     attempt: &RoutedAttempt,
-) -> AifarmHistorySummaryConfig {
+) -> Result<AifarmHistorySummaryConfig, HistorySummaryServiceError> {
     let mut cfg = aifarm_history_summary_config_from_app_config(config);
-    cfg.model = attempt.model_name.clone();
-    cfg.client.default_model = attempt.model_name.clone();
-    if let Some(endpoint) = routed_attempt_endpoint(attempt) {
-        if attempt.discovery_service_name.is_some() || attempt.discovery_endpoint_name.is_some() {
-            cfg.client.base_url = endpoint;
-        } else {
-            cfg.client.direct_url =
-                openplotva_llm::aifarm::normalize_chat_completions_url(&endpoint);
-            if attempt
-                .provider_name
-                .eq_ignore_ascii_case(crate::dialog_runtime::VRAM_CLOUD_PROVIDER_NAME)
-            {
-                cfg.client.api_key = config.llm.dialog.aifarm_pool_api_key.clone();
-            }
-        }
-    }
-    if let Some(service) = attempt.discovery_service_name.as_deref() {
-        cfg.client.service_name = service.to_owned();
-    }
-    cfg.client.runtime_hint = attempt.provider_runtime_hint.clone().unwrap_or_default();
-    cfg.client.supports_message_name = attempt.supports_message_name();
-    cfg.client.supports_cache_control = attempt.supports_cache_control();
-    if let Some(endpoint) = attempt.discovery_endpoint_name.as_deref() {
-        cfg.client.endpoint_name = endpoint.to_owned();
-    }
+    cfg.client = crate::provider_transport::openai_client_for_attempt(config, attempt, cfg.client)
+        .map_err(|error| HistorySummaryServiceError::Generate {
+            message: error.to_string(),
+        })?;
+    cfg.model.clone_from(&cfg.client.default_model);
     if let Some(max_tokens) = attempt.overrides.max_tokens
         && max_tokens > 0
     {
@@ -1188,17 +934,7 @@ fn aifarm_history_config_for_attempt(
     {
         cfg.include_reasoning = Some(include_reasoning);
     }
-    cfg.with_defaults()
-}
-
-fn routed_attempt_endpoint(attempt: &RoutedAttempt) -> Option<String> {
-    attempt
-        .model_base_url
-        .as_deref()
-        .or(attempt.provider_endpoint.as_deref())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .map(str::to_owned)
+    Ok(cfg.with_defaults())
 }
 
 fn history_summary_service_retryable_reason(
@@ -1210,63 +946,6 @@ fn history_summary_service_retryable_reason(
     }
 }
 
-impl HistorySummaryGenerator for RuntimeHistorySummaryGenerator {
-    fn generate_history_stage<'a>(
-        &'a self,
-        input: &'a SummaryInput,
-        stage: HistoryStage,
-        payload: &'a str,
-    ) -> HistoryStageFuture<'a> {
-        match self {
-            Self::Aifarm {
-                primary,
-                primary_model,
-                fallback,
-            } => Box::pin(async move {
-                let mut ignore_status = |_status: openplotva_llm::aifarm::StatusUpdate| {};
-                match primary
-                    .complete_stage(stage, payload, &mut ignore_status)
-                    .await
-                {
-                    Ok(text) => Ok(HistoryStageReply {
-                        text,
-                        model: primary_model.trim().to_owned(),
-                    }),
-                    Err(err) => {
-                        if !aifarm_history_summary_error_retryable(&err) {
-                            return Err(HistorySummaryServiceError::Generate {
-                                message: err.to_string(),
-                            });
-                        }
-                        let Some(fallback) = fallback.as_ref() else {
-                            return Err(HistorySummaryServiceError::Generate {
-                                message: err.to_string(),
-                            });
-                        };
-                        match fallback.generate_history_stage(input, stage, payload).await {
-                            Ok(mut reply) => {
-                                reply.model = primary_model.trim().to_owned();
-                                Ok(reply)
-                            }
-                            Err(fallback_err) => Err(HistorySummaryServiceError::Generate {
-                                message: format!(
-                                    "aifarm chat history summary failed: {err}; genkit fallback failed: {fallback_err}"
-                                ),
-                            }),
-                        }
-                    }
-                }
-            }),
-            Self::Genkit(generator) => generator.generate_history_stage(input, stage, payload),
-        }
-    }
-}
-
-fn aifarm_history_summary_error_retryable(err: &AifarmHistorySummaryError) -> bool {
-    let retry_reason = retryable_reason(err).map(|reason| reason.as_str());
-    history_summary_generate_error_retryable(&err.to_string(), false, false, retry_reason)
-}
-
 fn go_zero_time() -> OffsetDateTime {
     let date = time::Date::from_calendar_date(1, time::Month::January, 1)
         .expect("year 1 January 1 is representable");
@@ -1284,7 +963,6 @@ mod tests {
     use time::format_description::well_known::Rfc3339;
 
     use super::*;
-    use openplotva_llm::gemini::MODEL_GEMINI_FLASH_LITE;
 
     #[derive(Clone, Debug, PartialEq)]
     struct PayloadCall {
@@ -1576,6 +1254,7 @@ mod tests {
         let result = service
             .summarize(HistorySummaryRequest {
                 context: ToolContext {
+                    invocation_id: None,
                     chat_id: 100,
                     thread_id: Some(9),
                     user_id: 55,
@@ -1639,6 +1318,7 @@ mod tests {
         let result = service
             .summarize(HistorySummaryRequest {
                 context: ToolContext {
+                    invocation_id: None,
                     chat_id: 100,
                     thread_id: Some(9),
                     user_id: 55,
@@ -1699,6 +1379,7 @@ mod tests {
         let result = service
             .summarize(HistorySummaryRequest {
                 context: ToolContext {
+                    invocation_id: None,
                     chat_id: 100,
                     user_id: 55,
                     ..ToolContext::default()
@@ -1744,6 +1425,7 @@ mod tests {
         let result = service
             .summarize(HistorySummaryRequest {
                 context: ToolContext {
+                    invocation_id: None,
                     chat_id: 100,
                     user_id: 55,
                     ..ToolContext::default()
@@ -1782,6 +1464,7 @@ mod tests {
         let result = service
             .summarize(HistorySummaryRequest {
                 context: ToolContext {
+                    invocation_id: None,
                     chat_id: 100,
                     user_id: 55,
                     ..ToolContext::default()
@@ -1868,106 +1551,11 @@ mod tests {
         assert_eq!(cfg.client.default_model, "memory-model");
     }
 
-    #[test]
-    fn gemini_history_summary_config_maps_go_genkit_branch() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            googleai_key: Some(" gemini-key ".to_owned()),
-            genkit_history_summary_provider: Some(" genkit ".to_owned()),
-            genkit_history_summary_model: Some(" summary-model ".to_owned()),
-            genkit_history_summary_timeout_seconds: Some("333".to_owned()),
-            memory_consolidation_model: Some("memory-model".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        let cfg = gemini_history_summary_config_from_app_config(&config);
-
-        assert_eq!(cfg.api_key, "gemini-key");
-        assert_eq!(cfg.model, "summary-model");
-        assert_eq!(cfg.request_timeout, Duration::from_secs(333));
-        assert_eq!(cfg.max_output_tokens, 1024);
-        assert_eq!(cfg.temperature, 0.45);
-        assert_eq!(cfg.top_p, 0.9);
-    }
-
-    #[test]
-    fn gemini_history_summary_config_uses_runtime_fallback_model() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            googleai_key: Some("gemini-key".to_owned()),
-            genkit_history_summary_provider: Some("genkit".to_owned()),
-            genkit_history_summary_model: Some(" ".to_owned()),
-            memory_consolidation_model: Some("memory-model".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        let cfg = gemini_history_summary_config_from_app_config(&config);
-
-        assert_eq!(cfg.model, MODEL_GEMINI_FLASH_LITE);
-    }
-
-    #[test]
-    fn history_summary_generator_builds_genkit_openai_compatible_default_model() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            genkit_history_summary_provider: Some("genkit".to_owned()),
-            genkit_history_summary_model: Some(" ".to_owned()),
-            genkit_default_model: Some(" openrouter/summary-model ".to_owned()),
-            openrouter_key: Some(" openrouter-key ".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        let generator = history_summary_generator_from_app_config(&config).expect("generator");
-
-        let RuntimeHistorySummaryGenerator::Genkit(generator) = generator else {
-            panic!("expected genkit generator");
-        };
-        assert!(matches!(
-            *generator,
-            AppGenkitHistorySummaryGenerator::OpenAiCompatible(_)
-        ));
-    }
-
-    #[test]
-    fn aifarm_history_summary_generator_attaches_gemini_fallback_when_key_resolves() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            googleai_key: Some("gemini-key".to_owned()),
-            genkit_history_summary_provider: Some("aifarm".to_owned()),
-            memory_consolidation_model: Some("memory-model".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        let generator = history_summary_generator_from_app_config(&config).expect("generator");
-
-        let RuntimeHistorySummaryGenerator::Aifarm {
-            primary_model,
-            fallback,
-            ..
-        } = generator
-        else {
-            panic!("expected aifarm generator");
-        };
-        assert_eq!(primary_model, "memory-model");
-        assert!(fallback.is_some());
-    }
-
-    #[test]
-    fn aifarm_history_summary_generator_skips_gemini_fallback_without_key() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig::default()).expect("config");
-
-        let generator = history_summary_generator_from_app_config(&config).expect("generator");
-
-        let RuntimeHistorySummaryGenerator::Aifarm { fallback, .. } = generator else {
-            panic!("expected aifarm generator");
-        };
-        assert!(fallback.is_none());
-    }
-
     #[test]
     fn summary_request_from_dialog_tool_matches_go_scope_and_since_parse() {
         let got = summary_request_from_dialog_tool(&HistorySummaryRequest {
             context: ToolContext {
+                invocation_id: None,
                 chat_id: 100,
                 thread_id: Some(7),
                 user_id: 55,
diff --git a/crates/openplotva-app/src/http/assets.rs b/crates/openplotva-app/src/http/assets.rs
new file mode 100644
index 00000000..2e9b40a9
--- /dev/null
+++ b/crates/openplotva-app/src/http/assets.rs
@@ -0,0 +1,36 @@
+//! Embedded WebApp and admin assets exposed over HTTP.
+
+use axum::{
+    http::{StatusCode, header},
+    response::{IntoResponse, Response},
+};
+
+pub(crate) fn static_web_asset_response(
+    group: openplotva_web::StaticAssetGroup,
+    path: &str,
+) -> Response {
+    let Some(asset) = openplotva_web::static_asset(group, path) else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    (
+        StatusCode::OK,
+        [
+            (header::CONTENT_TYPE, asset.content_type),
+            (header::CACHE_CONTROL, "no-cache"),
+        ],
+        asset.bytes,
+    )
+        .into_response()
+}
+
+pub(crate) fn moved_permanently(location: &'static str) -> Response {
+    (
+        StatusCode::MOVED_PERMANENTLY,
+        [(header::LOCATION, location)],
+    )
+        .into_response()
+}
+
+pub(crate) fn found(location: &'static str) -> Response {
+    (StatusCode::FOUND, [(header::LOCATION, location)]).into_response()
+}
diff --git a/crates/openplotva-app/src/http/auth.rs b/crates/openplotva-app/src/http/auth.rs
new file mode 100644
index 00000000..27148c81
--- /dev/null
+++ b/crates/openplotva-app/src/http/auth.rs
@@ -0,0 +1,304 @@
+//! Admin login, signed sessions, and protected asset access.
+
+use super::{
+    HttpRouterState,
+    assets::{found, moved_permanently, static_web_asset_response},
+    common::{admin_error_response, admin_json_response, query_values as admin_auth_query_values},
+};
+use axum::{
+    extract::{Path, RawQuery, State},
+    http::{HeaderMap, Method, StatusCode, header},
+    response::{IntoResponse, Response},
+};
+use openplotva_storage::PostgresVirtualMessageStore;
+use std::{collections::BTreeMap, sync::Arc};
+use time::OffsetDateTime;
+
+#[derive(Clone)]
+pub(crate) struct AuthHttpState {
+    pub(crate) admin_ids: Arc<[i64]>,
+    pub(crate) bot_token: Arc<str>,
+    pub(crate) bot_username: Arc<str>,
+    pub(crate) state_store: Option<PostgresVirtualMessageStore>,
+    pub(crate) webapp_url: Arc<str>,
+}
+
+impl axum::extract::FromRef<Arc<HttpRouterState>> for AuthHttpState {
+    fn from_ref(routes: &Arc<HttpRouterState>) -> Self {
+        Self {
+            admin_ids: routes.admin_ids.clone(),
+            bot_token: routes.bot_token.clone(),
+            bot_username: routes.bot_username.clone(),
+            state_store: routes.state_store.clone(),
+            webapp_url: routes.webapp_url.clone(),
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn test_state(routes: &HttpRouterState) -> AuthHttpState {
+    use axum::extract::FromRef as _;
+    AuthHttpState::from_ref(&Arc::new(routes.clone()))
+}
+
+pub(crate) async fn admin_redirect() -> Response {
+    moved_permanently("/admin/")
+}
+
+pub(crate) async fn admin_auth(
+    method: Method,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<AuthHttpState>,
+) -> Response {
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET && method != Method::POST {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+
+    let values = admin_auth_query_values(raw_query);
+    let Some(user_id_raw) = values.get("id").filter(|value| !value.is_empty()) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "missing parameters");
+    };
+    let Some(hash) = values.get("hash").filter(|value| !value.is_empty()) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "missing parameters");
+    };
+    let Ok(user_id) = user_id_raw.parse::<i64>() else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "invalid user id");
+    };
+    if routes.bot_token.is_empty() {
+        return admin_error_response(StatusCode::BAD_REQUEST, "bot token not configured");
+    }
+
+    let pairs = values
+        .iter()
+        .map(|(key, value)| (key.as_str(), value.as_str()));
+    if !openplotva_web::validate_telegram_auth(pairs, &routes.bot_token, hash) {
+        tracing::error!("invalid admin auth signature");
+        return admin_error_response(StatusCode::FORBIDDEN, "invalid auth");
+    }
+
+    if !admin_auth_date_is_fresh(&values, OffsetDateTime::now_utc()) {
+        tracing::error!("admin auth rejected: stale or missing auth_date");
+        return admin_error_response(StatusCode::FORBIDDEN, "auth expired");
+    }
+
+    if !routes.admin_ids.contains(&user_id) {
+        tracing::error!(user_id, "authenticated Telegram user is not an admin");
+        return admin_error_response(StatusCode::FORBIDDEN, "forbidden");
+    }
+
+    persist_admin_session_user(routes, &values, user_id).await;
+    (
+        StatusCode::FOUND,
+        [
+            (header::LOCATION, "/admin/".to_owned()),
+            (
+                header::SET_COOKIE,
+                openplotva_web::admin_session_cookie(user_id, &routes.bot_token),
+            ),
+        ],
+    )
+        .into_response()
+}
+
+pub(crate) async fn admin_auth_check(
+    State(routes): State<AuthHttpState>,
+    headers: HeaderMap,
+) -> Response {
+    let authenticated_user_id = admin_session_user_id(&headers, &routes.bot_token)
+        .filter(|user_id| routes.admin_ids.contains(user_id));
+    match authenticated_user_id {
+        Some(user_id) => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({
+                "authenticated": true,
+                "user_id": user_id,
+            }),
+        ),
+        None => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "authenticated": false }),
+        ),
+    }
+}
+
+pub(crate) async fn admin_bootstrap(State(routes): State<AuthHttpState>) -> Response {
+    admin_json_response(
+        StatusCode::OK,
+        serde_json::json!({
+            "webapp_url": routes.webapp_url.as_ref(),
+            "bot_username": routes.bot_username.as_ref(),
+        }),
+    )
+}
+
+pub(crate) async fn admin_index(
+    State(routes): State<AuthHttpState>,
+    headers: HeaderMap,
+) -> Response {
+    admin_web_asset_response(&routes, &headers, "")
+}
+
+pub(crate) async fn admin_asset(
+    Path(path): Path<String>,
+    State(routes): State<AuthHttpState>,
+    headers: HeaderMap,
+) -> Response {
+    admin_web_asset_response(&routes, &headers, &path)
+}
+
+pub(crate) fn admin_web_asset_response(
+    routes: &AuthHttpState,
+    headers: &HeaderMap,
+    path: &str,
+) -> Response {
+    if admin_static_asset_requires_auth(path)
+        && !admin_session_is_authorized(headers, &routes.admin_ids, &routes.bot_token)
+    {
+        return found("/admin/login.html");
+    }
+    static_web_asset_response(openplotva_web::StaticAssetGroup::Admin, path)
+}
+
+/// Returns true if `auth_date` (unix seconds) is within the accepted freshness window
+/// relative to `now`. Missing/unparseable dates and far-future dates are rejected.
+pub(crate) fn admin_auth_date_is_fresh(
+    values: &BTreeMap<String, String>,
+    now: OffsetDateTime,
+) -> bool {
+    let Some(auth_date) = values
+        .get("auth_date")
+        .and_then(|v| v.trim().parse::<i64>().ok())
+    else {
+        return false;
+    };
+    let now_unix = now.unix_timestamp();
+    let age = now_unix - auth_date;
+    (-ADMIN_AUTH_FUTURE_SKEW_SECONDS..=ADMIN_AUTH_MAX_AGE_SECONDS).contains(&age)
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_auth_response(
+    routes: &AuthHttpState,
+    method: Method,
+    raw_query: Option<&str>,
+) -> Response {
+    admin_auth(
+        method,
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+    )
+    .await
+}
+
+pub(crate) async fn persist_admin_session_user(
+    routes: &AuthHttpState,
+    values: &BTreeMap<String, String>,
+    user_id: i64,
+) {
+    let Some(store) = &routes.state_store else {
+        return;
+    };
+    let user = admin_auth_user_state(values, user_id);
+    if let Err(error) = store.upsert_user_state(&user).await {
+        tracing::warn!(%error, user_id, "failed to persist admin session user");
+    }
+}
+
+pub(crate) fn admin_auth_user_state(
+    values: &BTreeMap<String, String>,
+    user_id: i64,
+) -> openplotva_core::UserState {
+    openplotva_core::UserState::new(
+        user_id,
+        trimmed_auth_value(values, "first_name").unwrap_or_else(|| "Telegram Admin".to_owned()),
+        trimmed_auth_value(values, "last_name"),
+        trimmed_auth_value(values, "username"),
+        trimmed_auth_value(values, "language_code"),
+        None,
+    )
+}
+
+pub(crate) fn trimmed_auth_value(values: &BTreeMap<String, String>, key: &str) -> Option<String> {
+    values
+        .get(key)
+        .map(|value| value.trim())
+        .filter(|value| !value.is_empty())
+        .map(str::to_owned)
+}
+
+pub(crate) fn admin_auth_failure_response(error: AdminAuthFailure) -> Response {
+    match error {
+        AdminAuthFailure::Unauthorized => {
+            admin_error_response(StatusCode::FORBIDDEN, "unauthorized")
+        }
+        AdminAuthFailure::Forbidden => admin_error_response(StatusCode::FORBIDDEN, "forbidden"),
+    }
+}
+
+pub(crate) fn require_admin_request(
+    headers: &HeaderMap,
+    admin_ids: &[i64],
+    secret: &str,
+) -> Result<(), AdminAuthFailure> {
+    let Some(user_id) = admin_session_user_id(headers, secret) else {
+        return Err(AdminAuthFailure::Unauthorized);
+    };
+    if !admin_ids.contains(&user_id) {
+        return Err(AdminAuthFailure::Forbidden);
+    }
+    Ok(())
+}
+
+pub(crate) fn admin_static_asset_requires_auth(path: &str) -> bool {
+    let path = path.trim_matches('/');
+    path.is_empty() || path == "index.html"
+}
+
+pub(crate) fn admin_session_is_authorized(
+    headers: &HeaderMap,
+    admin_ids: &[i64],
+    secret: &str,
+) -> bool {
+    admin_session_user_ids(headers, secret)
+        .into_iter()
+        .any(|user_id| admin_ids.contains(&user_id))
+}
+
+pub(crate) fn admin_session_user_id(headers: &HeaderMap, secret: &str) -> Option<i64> {
+    admin_session_user_ids(headers, secret).into_iter().next()
+}
+
+pub(crate) fn admin_session_user_ids(headers: &HeaderMap, secret: &str) -> Vec<i64> {
+    let Some(cookie) = headers
+        .get(header::COOKIE)
+        .and_then(|value| value.to_str().ok())
+    else {
+        return Vec::new();
+    };
+    cookie
+        .split(';')
+        .filter_map(|part| {
+            part.trim()
+                .strip_prefix(openplotva_web::ADMIN_SESSION_COOKIE_NAME)
+                .and_then(|value| value.strip_prefix('='))
+        })
+        .filter_map(|value| openplotva_web::verify_admin_session_value(value, secret))
+        .collect()
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum AdminAuthFailure {
+    Unauthorized,
+    Forbidden,
+}
+
+/// Maximum age of a Telegram Login `auth_date` accepted for admin authentication.
+const ADMIN_AUTH_MAX_AGE_SECONDS: i64 = 86_400;
+/// Small tolerance for clock skew on `auth_date` values slightly in the future.
+const ADMIN_AUTH_FUTURE_SKEW_SECONDS: i64 = 60;
+
+pub(crate) fn current_admin_user_id(headers: &HeaderMap, secret: &str) -> i64 {
+    admin_session_user_id(headers, secret).unwrap_or(0)
+}
diff --git a/crates/openplotva-app/src/http/common.rs b/crates/openplotva-app/src/http/common.rs
new file mode 100644
index 00000000..1205f670
--- /dev/null
+++ b/crates/openplotva-app/src/http/common.rs
@@ -0,0 +1,185 @@
+//! HTTP query parsing shared by the existing request contracts.
+
+use axum::{
+    http::{HeaderMap, StatusCode, header},
+    response::{IntoResponse, Response},
+};
+use std::collections::BTreeMap;
+
+pub(crate) fn query_values(raw_query: Option<&str>) -> BTreeMap<String, String> {
+    let mut values = BTreeMap::new();
+    let Some(raw_query) = raw_query else {
+        return values;
+    };
+    for (key, value) in url::form_urlencoded::parse(raw_query.as_bytes()) {
+        values
+            .entry(key.into_owned())
+            .or_insert_with(|| value.into_owned());
+    }
+    values
+}
+
+pub(crate) fn parse_memory_limit(value: Option<&str>) -> usize {
+    match value.and_then(|value| value.trim().parse::<usize>().ok()) {
+        Some(limit) if limit > 500 => 500,
+        Some(limit) if limit > 0 => limit,
+        _ => 100,
+    }
+}
+
+pub(crate) fn admin_error_response(status: StatusCode, error: &str) -> Response {
+    (
+        status,
+        [(header::CONTENT_TYPE, "text/plain; charset=utf-8")],
+        format!(r#"{{"error":"{error}"}}"#) + "\n",
+    )
+        .into_response()
+}
+
+pub(crate) fn admin_json_response(status: StatusCode, value: serde_json::Value) -> Response {
+    (
+        status,
+        [(header::CONTENT_TYPE, "application/json")],
+        format!("{value}\n"),
+    )
+        .into_response()
+}
+
+pub(crate) fn admin_json_no_cache_response(
+    status: StatusCode,
+    value: serde_json::Value,
+) -> Response {
+    (
+        status,
+        [
+            (header::CONTENT_TYPE, "application/json"),
+            (header::CACHE_CONTROL, "no-cache"),
+        ],
+        format!("{value}\n"),
+    )
+        .into_response()
+}
+
+pub(crate) fn admin_required_i64(
+    values: &BTreeMap<String, String>,
+    key: &str,
+    missing: &str,
+    invalid: &str,
+) -> Result<i64, Box<Response>> {
+    let Some(value) = values.get(key).filter(|value| !value.is_empty()) else {
+        return Err(Box::new(admin_error_response(
+            StatusCode::BAD_REQUEST,
+            missing,
+        )));
+    };
+    value
+        .parse::<i64>()
+        .map_err(|_| Box::new(admin_error_response(StatusCode::BAD_REQUEST, invalid)))
+}
+
+pub(crate) fn admin_non_empty_string(value: &str) -> Option<String> {
+    let normalized = value.trim().to_owned();
+    (!normalized.is_empty()).then_some(normalized)
+}
+
+pub(crate) fn admin_i64_from_json(value: &serde_json::Value) -> Option<i64> {
+    value.as_i64().or_else(|| {
+        value
+            .as_str()
+            .and_then(|value| value.trim().parse::<i64>().ok())
+    })
+}
+
+pub(crate) fn admin_format_time(value: OffsetDateTime) -> String {
+    value
+        .format(&Rfc3339)
+        .unwrap_or_else(|_| value.unix_timestamp().to_string())
+}
+
+pub(crate) fn admin_time_json(value: Option<OffsetDateTime>) -> serde_json::Value {
+    value
+        .map(admin_format_time)
+        .map(serde_json::Value::String)
+        .unwrap_or(serde_json::Value::Null)
+}
+
+use time::{OffsetDateTime, format_description::well_known::Rfc3339};
+
+pub(crate) fn admin_request_is_json(headers: &HeaderMap) -> bool {
+    headers
+        .get(header::CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|value| contains_ascii_fold(value, "application/json"))
+}
+
+pub(crate) fn contains_ascii_fold(haystack: &str, needle: &str) -> bool {
+    if needle.is_empty() {
+        return true;
+    }
+    haystack.as_bytes().windows(needle.len()).any(|window| {
+        std::str::from_utf8(window).is_ok_and(|part| part.eq_ignore_ascii_case(needle))
+    })
+}
+
+pub(crate) fn parse_go_bool(value: &str) -> Option<bool> {
+    match value.trim() {
+        "1" => Some(true),
+        "0" => Some(false),
+        value if value.eq_ignore_ascii_case("t") => Some(true),
+        value if value.eq_ignore_ascii_case("true") => Some(true),
+        value if value.eq_ignore_ascii_case("f") => Some(false),
+        value if value.eq_ignore_ascii_case("false") => Some(false),
+        _ => None,
+    }
+}
+
+pub(crate) fn parse_admin_positive_i32(
+    value: Option<&str>,
+    default_value: i32,
+    max_value: i32,
+) -> i32 {
+    match value
+        .map(str::trim)
+        .and_then(|value| value.parse::<i32>().ok())
+    {
+        Some(parsed) if parsed > 0 => parsed.min(max_value),
+        _ => default_value,
+    }
+}
+
+pub(crate) fn parse_admin_non_negative_i32(value: Option<&str>, default_value: i32) -> i32 {
+    match value
+        .map(str::trim)
+        .and_then(|value| value.parse::<i32>().ok())
+    {
+        Some(parsed) if parsed >= 0 => parsed,
+        _ => default_value,
+    }
+}
+
+pub(crate) fn parse_admin_optional_bool(value: Option<&str>) -> Option<bool> {
+    match value.map(str::trim).map(str::to_lowercase).as_deref() {
+        Some("true" | "1" | "yes") => Some(true),
+        Some("false" | "0" | "no") => Some(false),
+        _ => None,
+    }
+}
+
+pub(crate) async fn admin_app_setting(pool: Option<&sqlx::PgPool>, key: &str) -> Option<String> {
+    let pool = pool?;
+    openplotva_storage::app_settings::app_setting(pool, key)
+        .await
+        .ok()
+        .flatten()
+}
+
+pub(crate) async fn admin_upsert_app_setting(
+    pool: Option<&sqlx::PgPool>,
+    key: &str,
+    value: &str,
+) -> Result<(), openplotva_storage::StorageError> {
+    let Some(pool) = pool else {
+        return Ok(());
+    };
+    openplotva_storage::app_settings::upsert_app_setting(pool, key, value).await
+}
diff --git a/crates/openplotva-app/src/http/entities.rs b/crates/openplotva-app/src/http/entities.rs
new file mode 100644
index 00000000..ef21f6c0
--- /dev/null
+++ b/crates/openplotva-app/src/http/entities.rs
@@ -0,0 +1,1260 @@
+//! Admin users, chats, permissions, and VIP adjustments.
+
+use super::{
+    HttpRouterState,
+    auth::{admin_auth_failure_response, current_admin_user_id, require_admin_request},
+    common::{
+        admin_error_response, admin_format_time, admin_i64_from_json, admin_json_response,
+        admin_non_empty_string, admin_required_i64, admin_time_json,
+        query_values as admin_auth_query_values,
+    },
+};
+use crate::settings;
+use axum::{
+    body::Bytes,
+    extract::{RawQuery, State},
+    http::{HeaderMap, Method, StatusCode, header},
+    response::{IntoResponse, Response},
+};
+use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
+use openplotva_storage::{
+    PostgresChatMemberStore, PostgresChatSettingsStore, PostgresPaymentStore, PostgresVipStore,
+    RedisBlockedChatStore,
+    entities::{PostgresEntityStore, TelegramChatProfile, TelegramUserProfile, VipUserProfile},
+};
+use serde::Deserialize;
+use sqlx::PgPool;
+use std::{sync::Arc, time::Duration};
+use time::OffsetDateTime;
+const ADMIN_PAGE_LIMIT: i64 = 1000;
+
+#[derive(Clone)]
+pub(crate) struct EntitiesHttpState {
+    admin_ids: Arc<[i64]>,
+    bot_token: Arc<str>,
+    member_store: Option<PostgresChatMemberStore>,
+    postgres: Option<PgPool>,
+    redis: Option<redis::Client>,
+    settings_store: Option<PostgresChatSettingsStore>,
+    telegram: Option<openplotva_telegram::TelegramClient>,
+    vip_store: Option<PostgresVipStore>,
+}
+
+impl axum::extract::FromRef<Arc<HttpRouterState>> for EntitiesHttpState {
+    fn from_ref(routes: &Arc<HttpRouterState>) -> Self {
+        Self {
+            admin_ids: routes.admin_ids.clone(),
+            bot_token: routes.bot_token.clone(),
+            member_store: routes.member_store.clone(),
+            postgres: routes.postgres.clone(),
+            redis: routes.redis.clone(),
+            settings_store: routes.settings_store.clone(),
+            telegram: routes.telegram.clone(),
+            vip_store: routes.vip_store.clone(),
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn test_state(routes: &HttpRouterState) -> EntitiesHttpState {
+    use axum::extract::FromRef as _;
+    EntitiesHttpState::from_ref(&Arc::new(routes.clone()))
+}
+
+pub(crate) async fn admin_chat_get(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<EntitiesHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query);
+    let chat_id =
+        match admin_required_i64(&values, "chat_id", "chat_id required", "invalid chat_id") {
+            Ok(value) => value,
+            Err(response) => return *response,
+        };
+    let Some(pool) = routes.postgres.as_ref() else {
+        return admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({
+                "info": null,
+                "settings": null,
+                "permissions": null,
+                "members_count": 0,
+                "blocked": false,
+            }),
+        );
+    };
+    sync_admin_members_for_web(routes, chat_id).await;
+    let info = PostgresEntityStore::new(pool.clone())
+        .chat(chat_id)
+        .await
+        .ok()
+        .flatten()
+        .as_ref()
+        .map(admin_chat_json);
+    let settings = PostgresEntityStore::new(pool.clone())
+        .chat_settings(chat_id)
+        .await
+        .ok()
+        .flatten()
+        .as_ref()
+        .map(admin_settings_json);
+    let permissions = PostgresEntityStore::new(pool.clone())
+        .chat_permissions(chat_id)
+        .await
+        .ok()
+        .flatten()
+        .as_ref()
+        .map(admin_permissions_json);
+    let members_count = PostgresEntityStore::new(pool.clone())
+        .member_count(chat_id)
+        .await
+        .unwrap_or(0);
+    let blocked = match routes.redis.clone() {
+        Some(redis) => RedisBlockedChatStore::new(redis)
+            .blocked_until(chat_id)
+            .await
+            .ok()
+            .flatten()
+            .is_some(),
+        None => false,
+    };
+    admin_json_response(
+        StatusCode::OK,
+        serde_json::json!({
+            "info": info,
+            "settings": settings,
+            "permissions": permissions,
+            "members_count": members_count,
+            "blocked": blocked,
+        }),
+    )
+}
+
+pub(crate) async fn admin_chat_settings(
+    method: Method,
+    headers: HeaderMap,
+    State(routes): State<EntitiesHttpState>,
+    body: Bytes,
+) -> Response {
+    let headers = &headers;
+    let routes = &routes;
+    let body = body.as_ref();
+    if method != Method::POST && method != Method::PUT {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Ok(mut req) = serde_json::from_slice::<AdminChatSettingsUpdateRequest>(body) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "bad request");
+    };
+    if req.chat_id == 0 {
+        return admin_error_response(StatusCode::BAD_REQUEST, "chat_id required");
+    }
+    req.custom_persona = openplotva_web::truncate_custom_persona(req.custom_persona.take());
+    let Some(settings_store) = routes.settings_store.as_ref() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    let cur = settings_store
+        .get_chat_settings(req.chat_id)
+        .await
+        .ok()
+        .flatten()
+        .unwrap_or_else(|| openplotva_core::ChatSettings::defaults(req.chat_id));
+    let chat_type = admin_chat_type(routes, req.chat_id).await;
+    let update = openplotva_core::ChatSettingsUpdate {
+        chat_id: req.chat_id,
+        chat_type,
+        mood_alignment: req.mood_alignment,
+        custom_persona: req.custom_persona,
+        reactivity_percentage: req
+            .reactivity_percentage
+            .unwrap_or(cur.reactivity_percentage),
+        proactivity_percentage: req
+            .proactivity_percentage
+            .unwrap_or(cur.proactivity_percentage),
+        enable_global_text_reply: req
+            .enable_global_text_reply
+            .unwrap_or(cur.enable_global_text_reply),
+        enable_global_draw_reply: req
+            .enable_global_draw_reply
+            .unwrap_or(cur.enable_global_draw_reply),
+        enable_obscenifier: req.enable_obscenifier.unwrap_or(cur.enable_obscenifier),
+        enable_profanity: req.enable_profanity.unwrap_or(cur.enable_profanity),
+        enable_greet_joiners: req.enable_greet_joiners.unwrap_or(cur.enable_greet_joiners),
+        enable_daily_game: req
+            .enable_daily_game
+            .unwrap_or_else(|| cur.enable_daily_game.unwrap_or(true)),
+        daily_game_theme: req
+            .daily_game_theme
+            .unwrap_or_else(|| cur.daily_game_theme.unwrap_or_default()),
+        greeting_html: req.greeting_html,
+    };
+    match settings_store.upsert_chat_settings(&update).await {
+        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
+        Err(error) => {
+            tracing::warn!(%error, chat_id = req.chat_id, "failed to update admin chat settings");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_chat_block(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<EntitiesHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::POST {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query);
+    let chat_id =
+        match admin_required_i64(&values, "chat_id", "chat_id required", "invalid chat_id") {
+            Ok(value) => value,
+            Err(response) => return *response,
+        };
+    let minutes = values
+        .get("minutes")
+        .and_then(|value| value.parse::<i64>().ok())
+        .filter(|value| *value > 0)
+        .unwrap_or(10);
+    let until = OffsetDateTime::now_utc() + time::Duration::minutes(minutes);
+    let Some(redis) = routes.redis.clone() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    let ttl = Duration::from_secs((minutes as u64).saturating_mul(60));
+    match RedisBlockedChatStore::new(redis)
+        .block_chat_until_with_ttl(chat_id, until, ttl)
+        .await
+    {
+        Ok(()) => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "ok": true, "until": admin_format_time(until) }),
+        ),
+        Err(error) => {
+            tracing::warn!(%error, chat_id, "failed to block chat from admin web");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_chat_unblock(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<EntitiesHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::DELETE {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query);
+    let chat_id =
+        match admin_required_i64(&values, "chat_id", "chat_id required", "invalid chat_id") {
+            Ok(value) => value,
+            Err(response) => return *response,
+        };
+    let Some(redis_client) = routes.redis.clone() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    match RedisBlockedChatStore::new(redis_client)
+        .unblock_chat(chat_id)
+        .await
+    {
+        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
+        Err(error) => {
+            tracing::warn!(%error, chat_id, "failed to unblock chat from admin web");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_chat_members(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<EntitiesHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query);
+    let chat_id =
+        match admin_required_i64(&values, "chat_id", "chat_id required", "invalid chat_id") {
+            Ok(value) => value,
+            Err(response) => return *response,
+        };
+    let Some(pool) = routes.postgres.as_ref() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed to load members");
+    };
+    sync_admin_members_for_web(routes, chat_id).await;
+    match PostgresEntityStore::new(pool.clone())
+        .members_with_users(chat_id)
+        .await
+    {
+        Ok(rows) => {
+            let members = rows
+                .into_iter()
+                .map(|(member, user)| {
+                    serde_json::json!({
+                        "member": admin_chat_member_json(&member),
+                        "user": user.as_ref().map(admin_user_json),
+                    })
+                })
+                .collect::<Vec<_>>();
+            admin_json_response(StatusCode::OK, serde_json::json!({ "members": members }))
+        }
+        Err(error) => {
+            tracing::warn!(%error, chat_id, "failed to list admin chat members");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed to load members")
+        }
+    }
+}
+
+pub(crate) async fn admin_chats_list(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<EntitiesHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(pool) = routes.postgres.as_ref() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    let q = admin_auth_query_values(raw_query)
+        .remove("q")
+        .map(|value| value.trim().to_lowercase())
+        .filter(|value| !value.is_empty());
+    let rows = PostgresEntityStore::new(pool.clone())
+        .chats(q.as_deref(), ADMIN_PAGE_LIMIT, 0)
+        .await;
+    match rows {
+        Ok(rows) => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "chats": rows.iter().map(admin_chat_json).collect::<Vec<_>>() }),
+        ),
+        Err(error) => {
+            tracing::warn!(%error, "failed to list admin chats");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_chats_search_by_member(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<EntitiesHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query);
+    let username = values
+        .get("username")
+        .map(|value| value.trim().to_owned())
+        .filter(|value| !value.is_empty());
+    let user_id = values
+        .get("user_id")
+        .and_then(|value| value.parse::<i64>().ok());
+    if username.is_none() && user_id.is_none() {
+        return admin_error_response(StatusCode::BAD_REQUEST, "username or user_id required");
+    }
+    let Some(pool) = routes.postgres.as_ref() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error");
+    };
+    match PostgresEntityStore::new(pool.clone())
+        .search_chats_by_member(username.as_deref(), user_id, ADMIN_PAGE_LIMIT)
+        .await
+    {
+        Ok(rows) => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "chats": rows.iter().map(admin_chat_json).collect::<Vec<_>>() }),
+        ),
+        Err(error) => {
+            tracing::warn!(%error, "failed to search admin chats by member");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error")
+        }
+    }
+}
+
+pub(crate) async fn admin_users_list(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<EntitiesHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(pool) = routes.postgres.as_ref() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error");
+    };
+    let q = admin_auth_query_values(raw_query)
+        .remove("q")
+        .map(|value| value.trim().to_lowercase())
+        .filter(|value| !value.is_empty());
+    match PostgresEntityStore::new(pool.clone())
+        .users(q.as_deref(), ADMIN_PAGE_LIMIT, 0)
+        .await
+    {
+        Ok(rows) => (
+            StatusCode::OK,
+            [
+                (header::CONTENT_TYPE, "application/json"),
+                (header::CACHE_CONTROL, "no-cache"),
+            ],
+            format!(
+                "{}\n",
+                serde_json::json!({ "users": rows.iter().map(admin_user_json).collect::<Vec<_>>() })
+            ),
+        )
+            .into_response(),
+        Err(error) => {
+            tracing::warn!(%error, "failed to list admin users");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error")
+        }
+    }
+}
+
+pub(crate) async fn admin_vip_users_list(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<EntitiesHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(pool) = routes.postgres.as_ref() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error");
+    };
+    let values = admin_auth_query_values(raw_query);
+    let status = values
+        .get("status")
+        .map(|value| value.trim().to_lowercase())
+        .filter(|value| matches!(value.as_str(), "active" | "expired" | "all"))
+        .unwrap_or_else(|| "active".to_owned());
+    let q = values
+        .get("q")
+        .map(|value| value.trim().to_owned())
+        .filter(|value| !value.is_empty());
+    match PostgresEntityStore::new(pool.clone())
+        .vip_users(&status, q.as_deref(), ADMIN_PAGE_LIMIT, 0)
+        .await
+    {
+        Ok(rows) => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "users": rows.iter().map(admin_vip_user_json).collect::<Vec<_>>() }),
+        ),
+        Err(error) => {
+            tracing::warn!(%error, "failed to list admin vip users");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error")
+        }
+    }
+}
+
+pub(crate) async fn admin_user_get(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<EntitiesHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query);
+    let Some(pool) = routes.postgres.as_ref() else {
+        return admin_error_response(StatusCode::NOT_FOUND, "not found");
+    };
+    let user_row = if let Some(id_raw) = values.get("id").filter(|value| !value.is_empty()) {
+        let Ok(id) = id_raw.parse::<i64>() else {
+            return admin_error_response(StatusCode::BAD_REQUEST, "invalid id");
+        };
+        PostgresEntityStore::new(pool.clone()).user(id).await
+    } else if let Some(username) = values.get("username").filter(|value| !value.is_empty()) {
+        PostgresEntityStore::new(pool.clone())
+            .user_by_username(username)
+            .await
+    } else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "id or username required");
+    };
+    let user_row = match user_row {
+        Ok(Some(row)) => row,
+        Ok(None) | Err(_) => return admin_error_response(StatusCode::NOT_FOUND, "not found"),
+    };
+    let user_id = user_row.id;
+    let payment_store = PostgresPaymentStore::new(pool.clone());
+    let vip_store = routes
+        .vip_store
+        .clone()
+        .unwrap_or_else(|| PostgresVipStore::new(pool.clone()));
+    let subscription = payment_store
+        .get_active_subscription(user_id)
+        .await
+        .ok()
+        .flatten()
+        .map(admin_subscription_json);
+    let vip_cache = vip_store
+        .get_vip_cache(user_id)
+        .await
+        .ok()
+        .flatten()
+        .map(admin_vip_cache_json);
+    let vip_summary = match vip_store.get_vip_summary_by_user(user_id).await {
+        Ok(summary) => admin_vip_summary_json(summary.as_ref()),
+        Err(_) => admin_vip_summary_json(None),
+    };
+    let vip_events = match vip_store.list_vip_events_by_user(user_id).await {
+        Ok(events) => events.iter().map(admin_vip_event_json).collect::<Vec<_>>(),
+        Err(error) => {
+            tracing::warn!(%error, user_id, "failed to load admin vip events");
+            return admin_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "failed to load vip events",
+            );
+        }
+    };
+    let subscriptions = match payment_store.list_subscriptions_by_user(user_id).await {
+        Ok(items) => items
+            .iter()
+            .map(admin_subscription_artifact_json)
+            .collect::<Vec<_>>(),
+        Err(error) => {
+            tracing::warn!(%error, user_id, "failed to load admin subscriptions");
+            return admin_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "failed to load subscriptions",
+            );
+        }
+    };
+    admin_json_response(
+        StatusCode::OK,
+        serde_json::json!({
+            "user": admin_user_json(&user_row),
+            "subscription": subscription,
+            "vip": vip_cache,
+            "vip_summary": vip_summary,
+            "vip_events": vip_events,
+            "subscriptions": subscriptions,
+        }),
+    )
+}
+
+pub(crate) async fn admin_user_grant_vip(
+    method: Method,
+    headers: HeaderMap,
+    State(routes): State<EntitiesHttpState>,
+    body: Bytes,
+) -> Response {
+    let headers = &headers;
+    let routes = &routes;
+    let body = body.as_ref();
+    if method != Method::POST && method != Method::PUT {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Ok(req) = serde_json::from_slice::<AdminVipGrantRequest>(body) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "bad request");
+    };
+    let Some(user_id) = admin_i64_from_json(&req.user_id) else {
+        return admin_error_response(
+            StatusCode::BAD_REQUEST,
+            "user_id and non-zero signed days required",
+        );
+    };
+    if user_id == 0 || req.days == 0 {
+        return admin_error_response(
+            StatusCode::BAD_REQUEST,
+            "user_id and non-zero signed days required",
+        );
+    }
+    let Some(pool) = routes.postgres.as_ref() else {
+        return admin_error_response(StatusCode::NOT_FOUND, "user not found");
+    };
+    let placeholder_name = format!("Telegram user {user_id}");
+    if let Err(error) = PostgresEntityStore::new(pool.clone())
+        .ensure_user(user_id, &placeholder_name)
+        .await
+    {
+        tracing::warn!(%error, user_id, "failed to ensure admin vip user");
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "user not found");
+    }
+    let admin_id = current_admin_user_id(headers, &routes.bot_token);
+    let reason = admin_non_empty_string(&req.reason)
+        .unwrap_or_else(|| format!("web admin adjustment by {admin_id}"));
+    let actor_user_id = admin_existing_user_id(pool, admin_id).await;
+    let vip_store = routes
+        .vip_store
+        .clone()
+        .unwrap_or_else(|| PostgresVipStore::new(pool.clone()));
+    match vip_store
+        .create_vip_event(openplotva_storage::VipEventCreate {
+            user_id,
+            event_type: openplotva_core::VIP_EVENT_TYPE_ADMIN_ADJUSTMENT,
+            delta_seconds: openplotva_core::vip_days_to_seconds(req.days),
+            subscription_id: None,
+            actor_user_id,
+            reason: Some(&reason),
+        })
+        .await
+    {
+        Ok(event) => {
+            let cache_invalidated = match vip_store.delete_vip_cache(user_id).await {
+                Ok(()) => true,
+                Err(error) => {
+                    tracing::warn!(%error, user_id, "failed to invalidate admin vip cache");
+                    false
+                }
+            };
+            admin_json_response(
+                StatusCode::OK,
+                serde_json::json!({
+                    "ok": true,
+                    "event_id": event.id,
+                    "expires_at": admin_format_time(event.effective_expires_at),
+                    "cache_invalidated": cache_invalidated,
+                }),
+            )
+        }
+        Err(error) => {
+            tracing::warn!(%error, user_id, "failed to grant admin vip");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_user_revoke_vip(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<EntitiesHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::DELETE {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query);
+    let user_id =
+        match admin_required_i64(&values, "user_id", "user_id required", "invalid user_id") {
+            Ok(value) => value,
+            Err(response) => return *response,
+        };
+    let Some(pool) = routes.postgres.as_ref() else {
+        return admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "ok": true, "revoked": false }),
+        );
+    };
+    let vip_store = routes
+        .vip_store
+        .clone()
+        .unwrap_or_else(|| PostgresVipStore::new(pool.clone()));
+    let summary = vip_store
+        .get_vip_summary_by_user(user_id)
+        .await
+        .ok()
+        .flatten();
+    if !admin_vip_summary_can_be_revoked(summary.as_ref()) {
+        let cache_invalidated = match vip_store.delete_vip_cache(user_id).await {
+            Ok(()) => true,
+            Err(error) => {
+                tracing::warn!(%error, user_id, "failed to invalidate inactive admin vip cache");
+                false
+            }
+        };
+        return admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({
+                "ok": true,
+                "revoked": false,
+                "cache_invalidated": cache_invalidated,
+            }),
+        );
+    }
+    let summary = summary.expect("checked");
+    let admin_id = current_admin_user_id(headers, &routes.bot_token);
+    let reason = values
+        .get("reason")
+        .and_then(|value| admin_non_empty_string(value))
+        .unwrap_or_else(|| format!("web admin revoke by {admin_id}"));
+    let actor_user_id = admin_existing_user_id(pool, admin_id).await;
+    match vip_store
+        .create_vip_event(openplotva_storage::VipEventCreate {
+            user_id,
+            event_type: openplotva_core::VIP_EVENT_TYPE_ADMIN_REVOKE,
+            delta_seconds: -summary.remaining_seconds,
+            subscription_id: None,
+            actor_user_id,
+            reason: Some(&reason),
+        })
+        .await
+    {
+        Ok(_) => {
+            let cache_invalidated = match vip_store.delete_vip_cache(user_id).await {
+                Ok(()) => true,
+                Err(error) => {
+                    tracing::warn!(%error, user_id, "failed to invalidate revoked admin vip cache");
+                    false
+                }
+            };
+            admin_json_response(
+                StatusCode::OK,
+                serde_json::json!({
+                    "ok": true,
+                    "revoked": true,
+                    "cache_invalidated": cache_invalidated,
+                }),
+            )
+        }
+        Err(error) => {
+            tracing::warn!(%error, user_id, "failed to revoke admin vip");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_user_delete(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<EntitiesHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::DELETE {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query);
+    let user_id = match admin_required_i64(&values, "id", "id required", "invalid id") {
+        Ok(value) => value,
+        Err(response) => return *response,
+    };
+    let Some(pool) = routes.postgres.as_ref() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    match PostgresEntityStore::new(pool.clone())
+        .delete_user(user_id)
+        .await
+    {
+        Ok(_) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
+        Err(error) => {
+            tracing::warn!(%error, user_id, "failed to delete admin user");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_chat_get_response(
+    routes: &EntitiesHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    admin_chat_get(
+        method,
+        headers.clone(),
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+    )
+    .await
+}
+
+pub(crate) async fn sync_admin_members_for_web(routes: &EntitiesHttpState, chat_id: i64) {
+    let (Some(member_store), Some(telegram)) = (&routes.member_store, &routes.telegram) else {
+        return;
+    };
+    match settings::sync_chat_admins_with_sources(member_store, telegram, chat_id).await {
+        Ok(report) => tracing::debug!(
+            chat_id,
+            source = ?report.source,
+            admin_count = report.admin_count,
+            member_upsert_errors = report.member_upsert_errors,
+            user_upsert_errors = report.user_upsert_errors,
+            cache_errors = report.cache_errors,
+            "refreshed admin members for web route"
+        ),
+        Err(error) => {
+            tracing::debug!(%error, chat_id, "Telegram admin freshness failed for web route");
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_chats_search_by_member_response(
+    routes: &EntitiesHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    admin_chats_search_by_member(
+        method,
+        headers.clone(),
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+    )
+    .await
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_user_get_response(
+    routes: &EntitiesHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    admin_user_get(
+        method,
+        headers.clone(),
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+    )
+    .await
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_user_grant_vip_response(
+    routes: &EntitiesHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    body: &[u8],
+) -> Response {
+    admin_user_grant_vip(
+        method,
+        headers.clone(),
+        State(routes.clone()),
+        Bytes::copy_from_slice(body),
+    )
+    .await
+}
+
+pub(crate) async fn admin_chat_type(routes: &EntitiesHttpState, chat_id: i64) -> String {
+    let Some(pool) = routes.postgres.as_ref() else {
+        return "private".to_owned();
+    };
+    PostgresEntityStore::new(pool.clone())
+        .chat_type(chat_id)
+        .await
+        .ok()
+        .flatten()
+        .map(|value| value.trim().to_owned())
+        .filter(|value| !value.is_empty())
+        .unwrap_or_else(|| "private".to_owned())
+}
+
+pub(crate) async fn admin_existing_user_id(pool: &PgPool, user_id: i64) -> Option<i64> {
+    if user_id <= 0 {
+        return None;
+    }
+    PostgresEntityStore::new(pool.clone())
+        .user(user_id)
+        .await
+        .ok()
+        .flatten()
+        .map(|user| user.id)
+}
+
+pub(crate) fn admin_json_value_base64(value: Option<&serde_json::Value>) -> serde_json::Value {
+    value
+        .and_then(|value| serde_json::to_vec(value).ok())
+        .map(|bytes| serde_json::Value::String(BASE64_STANDARD.encode(bytes)))
+        .unwrap_or(serde_json::Value::Null)
+}
+
+pub(crate) fn admin_chat_json(row: &TelegramChatProfile) -> serde_json::Value {
+    serde_json::json!({
+        "id": row.id,
+        "type": row.chat_type,
+        "title": row.title,
+        "username": row.username,
+        "first_name": row.first_name,
+        "last_name": row.last_name,
+        "is_forum": row.is_forum,
+        "active_usernames": admin_json_value_base64(row.active_usernames.as_ref()),
+        "available_reactions": admin_json_value_base64(row.available_reactions.as_ref()),
+        "bio": row.bio,
+        "has_private_forwards": row.has_private_forwards,
+        "has_restricted_voice_and_video_messages": row.has_restricted_voice_and_video_messages,
+        "join_to_send_messages": row.join_to_send_messages,
+        "join_by_request": row.join_by_request,
+        "description": row.description,
+        "invite_link": row.invite_link,
+        "pinned_message": admin_json_value_base64(row.pinned_message.as_ref()),
+        "permissions": admin_json_value_base64(row.permissions.as_ref()),
+        "slow_mode_delay": row.slow_mode_delay,
+        "message_auto_delete_time": row.message_auto_delete_time,
+        "has_aggressive_anti_spam_enabled": row.has_aggressive_anti_spam_enabled,
+        "has_hidden_members": row.has_hidden_members,
+        "has_protected_content": row.has_protected_content,
+        "has_visible_history": row.has_visible_history,
+        "sticker_set_name": row.sticker_set_name,
+        "can_set_sticker_set": row.can_set_sticker_set,
+        "linked_chat_id": row.linked_chat_id,
+        "location": admin_json_value_base64(row.location.as_ref()),
+        "discovered": admin_time_json(row.discovered),
+        "updated": admin_time_json(row.updated),
+    })
+}
+
+pub(crate) fn admin_user_json(row: &TelegramUserProfile) -> serde_json::Value {
+    serde_json::json!({
+        "id": row.id,
+        "is_premium": row.is_premium,
+        "first_name": row.first_name,
+        "last_name": row.last_name,
+        "username": row.username,
+        "language_code": row.language_code,
+        "is_vip": row.is_vip,
+        "settings": admin_json_value_base64(row.settings.as_ref()),
+        "discovered": admin_time_json(row.discovered),
+        "updated": admin_time_json(row.updated),
+    })
+}
+
+pub(crate) fn admin_vip_user_json(row: &VipUserProfile) -> serde_json::Value {
+    let remaining_seconds = row.remaining_seconds.unwrap_or_default();
+    let remaining_days = ((remaining_seconds as f64 / openplotva_core::VIP_SECONDS_PER_DAY as f64)
+        .ceil() as i64)
+        .max(0);
+    serde_json::json!({
+        "user": admin_user_json(&row.user),
+        "vip_summary": {
+            "active": row.vip_active.unwrap_or(false),
+            "has_history": true,
+            "expires_at": admin_time_json(row.vip_expires_at),
+            "remaining_seconds": remaining_seconds,
+            "remaining_days": remaining_days,
+            "latest_event_id": row.latest_event_id,
+            "latest_event_type": row.latest_event_type,
+            "latest_delta_seconds": row.latest_delta_seconds.unwrap_or_default(),
+            "latest_reason": row.latest_reason,
+            "latest_created_at": admin_time_json(row.latest_created_at),
+        },
+        "subscriptions_count": row.subscriptions_count.unwrap_or_default(),
+        "latest_subscription_expires_at": admin_time_json(row.latest_subscription_expires_at),
+    })
+}
+
+pub(crate) fn admin_settings_json(
+    row: &openplotva_storage::entities::StoredChatSettings,
+) -> serde_json::Value {
+    serde_json::json!({
+        "chat_id": row.chat_id,
+        "mood_alignment": row.mood_alignment,
+        "custom_persona": row.custom_persona,
+        "updated": admin_time_json(row.updated),
+        "reactivity_percentage": row.reactivity_percentage,
+        "proactivity_percentage": row.proactivity_percentage,
+        "enable_global_text_reply": row.enable_global_text_reply,
+        "enable_global_draw_reply": row.enable_global_draw_reply,
+        "enable_obscenifier": row.enable_obscenifier,
+        "enable_profanity": row.enable_profanity,
+        "enable_greet_joiners": row.enable_greet_joiners,
+        "enable_daily_game": row.enable_daily_game,
+        "daily_game_theme": row.daily_game_theme,
+        "greeting_html": row.greeting_html,
+    })
+}
+
+pub(crate) fn admin_permissions_json(
+    row: &openplotva_storage::entities::StoredChatPermissions,
+) -> serde_json::Value {
+    serde_json::json!({
+        "chat_id": row.chat_id,
+        "status": row.status.as_deref().unwrap_or_default(),
+        "can_manage_chat": row.can_manage_chat,
+        "can_delete_messages": row.can_delete_messages,
+        "can_manage_video_chats": row.can_manage_video_chats,
+        "can_restrict_members": row.can_restrict_members,
+        "can_promote_members": row.can_promote_members,
+        "can_change_info": row.can_change_info,
+        "can_invite_users": row.can_invite_users,
+        "can_post_messages": row.can_post_messages,
+        "can_edit_messages": row.can_edit_messages,
+        "can_pin_messages": row.can_pin_messages,
+        "can_manage_topics": row.can_manage_topics,
+        "can_send_messages": row.can_send_messages,
+        "can_send_media_messages": row.can_send_media_messages,
+        "can_send_polls": row.can_send_polls,
+        "can_send_other_messages": row.can_send_other_messages,
+        "can_add_web_page_previews": row.can_add_web_page_previews,
+        "last_checked_at": admin_time_json(row.last_checked_at),
+        "last_error_at": admin_time_json(row.last_error_at),
+        "error_count": row.error_count,
+        "error_message": row.error_message,
+        "created_at": admin_time_json(row.created_at),
+        "updated_at": admin_time_json(row.updated_at),
+    })
+}
+
+pub(crate) fn admin_chat_member_json(
+    row: &openplotva_storage::entities::ChatMemberProfile,
+) -> serde_json::Value {
+    serde_json::json!({
+        "chat_id": row.membership.chat_id,
+        "user_id": row.membership.user_id,
+        "status": row.membership.status,
+        "is_anonymous": row.membership.is_anonymous,
+        "custom_title": row.membership.custom_title,
+        "can_be_edited": row.membership.can_be_edited,
+        "can_manage_chat": row.membership.can_manage_chat,
+        "can_delete_messages": row.membership.can_delete_messages,
+        "can_manage_video_chats": row.membership.can_manage_video_chats,
+        "can_restrict_members": row.membership.can_restrict_members,
+        "can_promote_members": row.membership.can_promote_members,
+        "can_change_info": row.membership.can_change_info,
+        "can_invite_users": row.membership.can_invite_users,
+        "can_post_messages": row.membership.can_post_messages,
+        "can_edit_messages": row.membership.can_edit_messages,
+        "can_pin_messages": row.membership.can_pin_messages,
+        "can_manage_topics": row.membership.can_manage_topics,
+        "can_send_messages": row.membership.can_send_messages,
+        "can_send_media_messages": row.membership.can_send_media_messages,
+        "can_send_polls": row.membership.can_send_polls,
+        "can_send_other_messages": row.membership.can_send_other_messages,
+        "can_add_web_page_previews": row.membership.can_add_web_page_previews,
+        "until_date": admin_time_json(row.membership.until_date),
+        "created_at": admin_time_json(row.created_at),
+        "updated_at": admin_time_json(row.updated_at),
+        "last_message_at": admin_time_json(row.last_message_at),
+    })
+}
+
+pub(crate) fn admin_subscription_json(
+    item: openplotva_storage::SubscriptionRecord,
+) -> serde_json::Value {
+    serde_json::json!({
+        "id": item.id,
+        "user_id": item.user_id,
+        "telegram_payment_charge_id": item.telegram_payment_charge_id,
+        "provider_payment_charge_id": item.provider_payment_charge_id,
+        "expires_at": admin_format_time(item.expires_at),
+        "created_at": admin_format_time(item.created_at),
+        "updated_at": admin_format_time(item.updated_at),
+        "canceled_at": admin_time_json(item.canceled_at),
+        "refunded_at": admin_time_json(item.refunded_at),
+    })
+}
+
+pub(crate) fn admin_subscription_artifact_json(
+    item: &openplotva_storage::SubscriptionRecord,
+) -> serde_json::Value {
+    serde_json::json!({
+        "id": item.id,
+        "telegram_payment_charge_id": item.telegram_payment_charge_id,
+        "provider_payment_charge_id": item.provider_payment_charge_id,
+        "expires_at": admin_format_time(item.expires_at),
+        "created_at": admin_format_time(item.created_at),
+        "updated_at": admin_format_time(item.updated_at),
+        "canceled_at": admin_time_json(item.canceled_at),
+        "refunded_at": admin_time_json(item.refunded_at),
+        "status": admin_subscription_status(item.expires_at, item.canceled_at, item.refunded_at),
+    })
+}
+
+pub(crate) fn admin_vip_cache_json(item: openplotva_storage::VipCacheRecord) -> serde_json::Value {
+    serde_json::json!({
+        "user_id": item.user_id,
+        "is_vip": item.is_vip,
+        "expires_at": admin_format_time(item.expires_at),
+        "created_at": admin_format_time(item.created_at),
+        "updated_at": admin_format_time(item.updated_at),
+    })
+}
+
+pub(crate) fn admin_vip_summary_json(
+    summary: Option<&openplotva_storage::VipSummaryRecord>,
+) -> serde_json::Value {
+    let Some(summary) = summary else {
+        return serde_json::json!({
+            "active": false,
+            "has_history": false,
+            "remaining_seconds": 0,
+            "remaining_days": 0,
+        });
+    };
+    let active = summary.is_active && OffsetDateTime::now_utc() < summary.effective_expires_at;
+    let remaining_days = if active {
+        let seconds = (summary.effective_expires_at - OffsetDateTime::now_utc()).whole_seconds();
+        ((seconds as f64 / openplotva_core::VIP_SECONDS_PER_DAY as f64).round() as i64).max(0)
+    } else {
+        0
+    };
+    serde_json::json!({
+        "active": active,
+        "has_history": true,
+        "expires_at": admin_format_time(summary.effective_expires_at),
+        "remaining_seconds": summary.remaining_seconds,
+        "remaining_days": remaining_days.max(0),
+        "latest_event_id": summary.latest_event_id,
+        "latest_event_type": summary.latest_event_type,
+        "latest_reason": summary.latest_reason,
+        "latest_created_at": admin_format_time(summary.latest_created_at),
+    })
+}
+
+pub(crate) fn admin_vip_event_json(
+    item: &openplotva_storage::VipEventListRecord,
+) -> serde_json::Value {
+    let actor_label = item
+        .actor_username
+        .as_ref()
+        .filter(|value| !value.is_empty())
+        .map(|value| format!("@{value}"))
+        .or_else(|| {
+            item.actor_first_name
+                .clone()
+                .filter(|value| !value.is_empty())
+        })
+        .or_else(|| item.actor_user_id.map(|value| value.to_string()))
+        .unwrap_or_default();
+    let subscription_status = if item.subscription_id.is_some() {
+        admin_subscription_status(
+            item.subscription_expires_at
+                .unwrap_or(item.effective_expires_at),
+            item.subscription_canceled_at,
+            item.subscription_refunded_at,
+        )
+    } else {
+        String::new()
+    };
+    serde_json::json!({
+        "id": item.id,
+        "event_type": item.event_type,
+        "delta_seconds": item.delta_seconds,
+        "delta_days": item.delta_seconds as f64 / openplotva_core::VIP_SECONDS_PER_DAY as f64,
+        "effective_expires_at": admin_format_time(item.effective_expires_at),
+        "actor_user_id": item.actor_user_id,
+        "actor_label": actor_label,
+        "reason": item.reason,
+        "created_at": admin_format_time(item.created_at),
+        "subscription_id": item.subscription_id,
+        "telegram_payment_charge_id": item.telegram_payment_charge_id,
+        "provider_payment_charge_id": item.provider_payment_charge_id,
+        "subscription_status": subscription_status,
+    })
+}
+
+pub(crate) fn admin_subscription_status(
+    expires_at: OffsetDateTime,
+    canceled_at: Option<OffsetDateTime>,
+    refunded_at: Option<OffsetDateTime>,
+) -> String {
+    if refunded_at.is_some() {
+        "refunded".to_owned()
+    } else if canceled_at.is_some() {
+        "canceled".to_owned()
+    } else if OffsetDateTime::now_utc() < expires_at {
+        "active".to_owned()
+    } else {
+        "expired".to_owned()
+    }
+}
+
+pub(crate) fn admin_vip_summary_can_be_revoked(
+    summary: Option<&openplotva_storage::VipSummaryRecord>,
+) -> bool {
+    summary
+        .map(|summary| {
+            summary.is_active && OffsetDateTime::now_utc() < summary.effective_expires_at
+        })
+        .unwrap_or(false)
+}
+
+#[derive(Debug, Deserialize)]
+struct AdminChatSettingsUpdateRequest {
+    chat_id: i64,
+    mood_alignment: Option<String>,
+    custom_persona: Option<String>,
+    reactivity_percentage: Option<i32>,
+    proactivity_percentage: Option<i32>,
+    enable_obscenifier: Option<bool>,
+    enable_profanity: Option<bool>,
+    enable_greet_joiners: Option<bool>,
+    enable_global_text_reply: Option<bool>,
+    enable_global_draw_reply: Option<bool>,
+    enable_daily_game: Option<bool>,
+    daily_game_theme: Option<String>,
+    greeting_html: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct AdminVipGrantRequest {
+    user_id: serde_json::Value,
+    days: i64,
+    #[serde(default)]
+    reason: String,
+}
diff --git a/crates/openplotva-app/src/http/ingress.rs b/crates/openplotva-app/src/http/ingress.rs
new file mode 100644
index 00000000..824e6c11
--- /dev/null
+++ b/crates/openplotva-app/src/http/ingress.rs
@@ -0,0 +1,46 @@
+//! Telegram webhook ingress and HTTP status mapping.
+use axum::{
+    body::Bytes,
+    extract::Extension,
+    http::{HeaderMap, Method, StatusCode},
+    response::{IntoResponse, Response},
+};
+use std::sync::Arc;
+#[derive(Clone)]
+pub(crate) struct TelegramWebhookRoute {
+    pub(crate) sender: openplotva_telegram::WebhookUpdateSender,
+    pub(crate) secret_token: Arc<str>,
+}
+
+pub(crate) async fn telegram_webhook(
+    Extension(route): Extension<TelegramWebhookRoute>,
+    method: Method,
+    headers: HeaderMap,
+    body: Bytes,
+) -> Response {
+    telegram_webhook_response(&route.sender, method, headers, &route.secret_token, body).await
+}
+
+pub async fn telegram_webhook_response(
+    sender: &openplotva_telegram::WebhookUpdateSender,
+    method: Method,
+    headers: HeaderMap,
+    secret_token: &str,
+    body: Bytes,
+) -> Response {
+    let provided_secret = headers
+        .get(openplotva_telegram::TELEGRAM_WEBHOOK_SECRET_HEADER)
+        .and_then(|value| value.to_str().ok());
+
+    match sender
+        .handle_webhook_request(method.as_str(), provided_secret, secret_token, &body)
+        .await
+    {
+        Ok(()) => StatusCode::OK.into_response(),
+        Err(error) => {
+            let status = StatusCode::from_u16(error.http_status())
+                .unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
+            status.into_response()
+        }
+    }
+}
diff --git a/crates/openplotva-app/src/http/memory.rs b/crates/openplotva-app/src/http/memory.rs
new file mode 100644
index 00000000..d54326de
--- /dev/null
+++ b/crates/openplotva-app/src/http/memory.rs
@@ -0,0 +1,943 @@
+use super::HttpRouterState;
+use super::auth::{admin_auth_failure_response, current_admin_user_id, require_admin_request};
+use super::common::{
+    admin_error_response, admin_json_response, admin_request_is_json, parse_go_bool,
+    parse_memory_limit, query_values as admin_auth_query_values,
+};
+use crate::{embedder, memory_runtime, routed_attempts};
+use axum::{
+    body::Bytes,
+    extract::{RawQuery, State},
+    http::{HeaderMap, Method, StatusCode},
+    response::Response,
+};
+use openplotva_config::AppConfig;
+use openplotva_storage::PostgresMemoryStore;
+use serde::Deserialize;
+use std::{sync::Arc, time::Duration};
+use time::OffsetDateTime;
+
+#[derive(Clone)]
+pub(crate) struct MemoryHttpState {
+    admin_ids: Arc<[i64]>,
+    bot_token: Arc<str>,
+    memory_admin_enabled: bool,
+    memory_consolidation_model: Arc<str>,
+    memory_enqueue_policy: openplotva_memory::MemoryRunEnqueuePolicy,
+    memory_max_input_tokens: i32,
+    memory_max_messages_per_run: i32,
+    memory_override_runtime: Option<AdminMemoryOverrideRuntime>,
+    memory_restart_trigger: Option<Arc<tokio::sync::Notify>>,
+    memory_retention: Duration,
+    memory_store: Option<PostgresMemoryStore>,
+    memory_token_estimator_source: Arc<str>,
+}
+
+impl axum::extract::FromRef<Arc<HttpRouterState>> for MemoryHttpState {
+    fn from_ref(routes: &Arc<HttpRouterState>) -> Self {
+        Self {
+            admin_ids: routes.admin_ids.clone(),
+            bot_token: routes.bot_token.clone(),
+            memory_admin_enabled: routes.memory_admin_enabled,
+            memory_consolidation_model: routes.memory_consolidation_model.clone(),
+            memory_enqueue_policy: routes.memory_enqueue_policy,
+            memory_max_input_tokens: routes.memory_max_input_tokens,
+            memory_max_messages_per_run: routes.memory_max_messages_per_run,
+            memory_override_runtime: routes.memory_override_runtime.clone(),
+            memory_restart_trigger: routes.memory_restart_trigger.clone(),
+            memory_retention: routes.memory_retention,
+            memory_store: routes.memory_store.clone(),
+            memory_token_estimator_source: routes.memory_token_estimator_source.clone(),
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn test_state(routes: &HttpRouterState) -> MemoryHttpState {
+    use axum::extract::FromRef as _;
+    MemoryHttpState::from_ref(&Arc::new(routes.clone()))
+}
+
+pub(crate) async fn admin_memory_cards(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<MemoryHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    match method {
+        Method::GET => admin_memory_cards_list_response(routes, headers, raw_query).await,
+        Method::DELETE => admin_memory_card_delete_response(routes, headers, raw_query).await,
+        _ => admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed"),
+    }
+}
+
+pub(crate) async fn admin_memory_card(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<MemoryHttpState>,
+    body: Bytes,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    let body = body.as_ref();
+    match method {
+        Method::GET => admin_memory_card_detail_response(routes, headers, raw_query).await,
+        Method::PATCH => admin_memory_card_update_response(routes, headers, body).await,
+        _ => admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed"),
+    }
+}
+
+pub(crate) async fn admin_memory_overview(
+    method: Method,
+    headers: HeaderMap,
+    State(routes): State<MemoryHttpState>,
+) -> Response {
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    admin_memory_overview_response(&routes, &headers).await
+}
+
+pub(crate) async fn admin_memory_runs(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<MemoryHttpState>,
+    body: Bytes,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    let body = body.as_ref();
+    match method {
+        Method::GET => admin_memory_runs_list_response(routes, headers, raw_query).await,
+        Method::POST => admin_memory_run_retry_response(routes, headers, raw_query, body).await,
+        _ => admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed"),
+    }
+}
+
+pub(crate) async fn admin_memory_restart(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<MemoryHttpState>,
+    body: Bytes,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    let body = body.as_ref();
+    if method != Method::POST {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let id = match admin_memory_optional_restart_id(raw_query) {
+        Ok(id) => id,
+        Err(response) => return *response,
+    };
+    let run_now = admin_auth_query_values(raw_query)
+        .get("run_now")
+        .and_then(|value| parse_go_bool(value))
+        .unwrap_or(false);
+    admin_memory_restart_execute_response(routes, headers, raw_query, body, id, run_now).await
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_memory_cards_response(
+    routes: &MemoryHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    admin_memory_cards(
+        method,
+        headers.clone(),
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+    )
+    .await
+}
+
+pub(crate) async fn admin_memory_card_update_response(
+    routes: &MemoryHttpState,
+    headers: &HeaderMap,
+    body: &[u8],
+) -> Response {
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let req: MemoryCardUpdate = match serde_json::from_slice(body) {
+        Ok(req) => req,
+        Err(_) => return admin_error_response(StatusCode::BAD_REQUEST, "invalid body"),
+    };
+    if req.id == 0 {
+        return admin_error_response(StatusCode::BAD_REQUEST, "id required");
+    }
+    let Some(store) = routes
+        .memory_store
+        .as_ref()
+        .filter(|_| routes.memory_admin_enabled)
+    else {
+        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "memory disabled");
+    };
+    let confidence = req.confidence.map(|v| v.clamp(0.0, 1.0));
+    let salience = req.salience.map(|v| v.clamp(0.0, 1.0));
+    if (confidence.is_some() || salience.is_some() || req.portable.is_some())
+        && let Err(error) = store
+            .update_card_fields(req.id, confidence, salience, req.portable)
+            .await
+    {
+        tracing::warn!(%error, id = req.id, "failed to update memory card fields");
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    }
+    if let Some(status) = req.status.as_deref() {
+        let result = match status {
+            "deleted" => {
+                store
+                    .soft_delete_card(req.id, current_admin_user_id(headers, &routes.bot_token))
+                    .await
+            }
+            "active" => store.restore_card(req.id).await,
+            _ => Ok(()),
+        };
+        if let Err(error) = result {
+            tracing::warn!(%error, id = req.id, "failed to change memory card status");
+            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+        }
+    }
+    admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true }))
+}
+
+pub(crate) async fn admin_memory_card_detail_response(
+    routes: &MemoryHttpState,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let id = match admin_memory_required_id(raw_query, "id required") {
+        Ok(id) => id,
+        Err(response) => return *response,
+    };
+    let Some(store) = routes
+        .memory_store
+        .as_ref()
+        .filter(|_| routes.memory_admin_enabled)
+    else {
+        return admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "card": serde_json::Value::Null, "links": [] }),
+        );
+    };
+    let card = match store.get_card(id).await {
+        Ok(Some(card)) => card,
+        Ok(None) => return admin_error_response(StatusCode::NOT_FOUND, "not found"),
+        Err(error) => {
+            tracing::warn!(%error, id, "failed to load admin memory card");
+            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+        }
+    };
+    let links = store.list_card_links(id).await.unwrap_or_default();
+    admin_json_response(
+        StatusCode::OK,
+        serde_json::json!({ "card": card, "links": links }),
+    )
+}
+
+pub(crate) async fn admin_memory_overview_response(
+    routes: &MemoryHttpState,
+    headers: &HeaderMap,
+) -> Response {
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(store) = routes
+        .memory_store
+        .as_ref()
+        .filter(|_| routes.memory_admin_enabled)
+    else {
+        return admin_json_response(StatusCode::OK, serde_json::json!({}));
+    };
+    match store.memory_overview().await {
+        Ok(overview) => admin_json_response(
+            StatusCode::OK,
+            serde_json::to_value(&overview).unwrap_or(serde_json::Value::Null),
+        ),
+        Err(error) => {
+            tracing::warn!(%error, "failed to load admin memory overview");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_memory_cards_list_response(
+    routes: &MemoryHttpState,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(store) = routes
+        .memory_store
+        .as_ref()
+        .filter(|_| routes.memory_admin_enabled)
+    else {
+        return admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "count": 0, "cards": serde_json::Value::Null }),
+        );
+    };
+    let filter = admin_memory_card_filter(raw_query);
+    match store.list_cards(&filter).await {
+        Ok(cards) => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({
+                "count": cards.len(),
+                "cards": cards,
+            }),
+        ),
+        Err(error) => {
+            tracing::warn!(%error, "failed to list admin memory cards");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_memory_card_delete_response(
+    routes: &MemoryHttpState,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let id = match admin_memory_required_id(raw_query, "id required") {
+        Ok(id) => id,
+        Err(response) => return *response,
+    };
+    if let Some(store) = routes
+        .memory_store
+        .as_ref()
+        .filter(|_| routes.memory_admin_enabled)
+        && let Err(error) = store
+            .soft_delete_card(id, current_admin_user_id(headers, &routes.bot_token))
+            .await
+    {
+        tracing::warn!(%error, id, "failed to delete admin memory card");
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    }
+    admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true }))
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_memory_runs_response(
+    routes: &MemoryHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+    body: &[u8],
+) -> Response {
+    admin_memory_runs(
+        method,
+        headers.clone(),
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+        Bytes::copy_from_slice(body),
+    )
+    .await
+}
+
+pub(crate) async fn admin_memory_runs_list_response(
+    routes: &MemoryHttpState,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(store) = routes
+        .memory_store
+        .as_ref()
+        .filter(|_| routes.memory_admin_enabled)
+    else {
+        return admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({
+                "count": 0,
+                "runs": serde_json::Value::Null,
+                "policy": admin_memory_policy_json(routes),
+                "enqueue_rollups": serde_json::Value::Null,
+            }),
+        );
+    };
+    let limit = parse_memory_limit(
+        admin_auth_query_values(raw_query)
+            .get("limit")
+            .map(String::as_str),
+    );
+    let runs = match store.list_runs(limit as i32).await {
+        Ok(runs) => runs,
+        Err(error) => {
+            tracing::warn!(%error, "failed to list admin memory runs");
+            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+        }
+    };
+    let enqueue_rollups = match store.list_enqueue_rollups(24).await {
+        Ok(rollups) => rollups,
+        Err(error) => {
+            tracing::warn!(%error, "failed to list admin memory enqueue rollups");
+            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+        }
+    };
+    admin_json_response(
+        StatusCode::OK,
+        serde_json::json!({
+            "count": runs.len(),
+            "runs": runs,
+            "policy": admin_memory_policy_json(routes),
+            "enqueue_rollups": enqueue_rollups,
+        }),
+    )
+}
+
+pub(crate) fn admin_memory_policy_json(routes: &MemoryHttpState) -> serde_json::Value {
+    serde_json::json!({
+        "min_messages_per_run": routes.memory_enqueue_policy.min_messages_per_run,
+        "max_queued_runs": null,
+        "max_messages_per_run": routes.memory_max_messages_per_run,
+        "max_input_tokens": routes.memory_max_input_tokens,
+        "token_estimator": routes.memory_token_estimator_source.as_ref(),
+        "consolidation_model": routes.memory_consolidation_model.as_ref(),
+    })
+}
+
+pub(crate) async fn admin_memory_run_retry_response(
+    routes: &MemoryHttpState,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+    body: &[u8],
+) -> Response {
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let id = match admin_memory_required_id(raw_query, "id required") {
+        Ok(id) => id,
+        Err(response) => return *response,
+    };
+    admin_memory_restart_execute_response(routes, headers, raw_query, body, id, false).await
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_memory_restart_response(
+    routes: &MemoryHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+    body: &[u8],
+) -> Response {
+    admin_memory_restart(
+        method,
+        headers.clone(),
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+        Bytes::copy_from_slice(body),
+    )
+    .await
+}
+
+pub(crate) async fn admin_memory_restart_execute_response(
+    routes: &MemoryHttpState,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+    body: &[u8],
+    id: i64,
+    run_now: bool,
+) -> Response {
+    let Some(store) = routes
+        .memory_store
+        .as_ref()
+        .filter(|_| routes.memory_admin_enabled)
+    else {
+        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "memory disabled");
+    };
+    let (override_, explicit_override) =
+        match admin_memory_restart_override(headers, raw_query, body) {
+            Ok(value) => value,
+            Err(response) => return *response,
+        };
+    if explicit_override {
+        return admin_memory_restart_override_execute_response(routes, override_, id, run_now)
+            .await;
+    }
+    let mut retried_failed_runs = 0_i64;
+    let mut queued_runs = 0_i64;
+    let result = if run_now {
+        store
+            .ensure_hourly_runs(
+                OffsetDateTime::now_utc(),
+                routes.memory_retention,
+                routes.memory_retention,
+                routes.memory_enqueue_policy,
+            )
+            .await
+            .map(|queued| queued_runs = admin_u64_to_i64(queued))
+    } else if id > 0 {
+        store.retry_run(id).await.map(|()| retried_failed_runs = 1)
+    } else {
+        store
+            .retry_failed_runs()
+            .await
+            .map(|retried| retried_failed_runs = admin_u64_to_i64(retried))
+    };
+    if let Err(error) = result {
+        tracing::warn!(%error, id, run_now, "failed to restart admin memory runs");
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    }
+    let started = routes
+        .memory_restart_trigger
+        .as_ref()
+        .map(|trigger| {
+            trigger.notify_one();
+            true
+        })
+        .unwrap_or(false);
+    let provider = "aifarm".to_owned();
+    let model = admin_memory_restart_model(&routes.memory_consolidation_model);
+    admin_memory_restart_ok_response(
+        id,
+        retried_failed_runs,
+        queued_runs,
+        started,
+        explicit_override,
+        provider,
+        model,
+    )
+}
+
+pub(crate) async fn admin_memory_restart_override_execute_response(
+    routes: &MemoryHttpState,
+    override_: AdminMemoryOverride,
+    id: i64,
+    run_now: bool,
+) -> Response {
+    let Some(runtime) = routes.memory_override_runtime.clone() else {
+        tracing::warn!(
+            provider = override_.provider,
+            model = override_.model,
+            "admin memory override drain is unavailable"
+        );
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    let (provider, model) = match admin_memory_resolve_override(
+        &override_,
+        &runtime.config,
+        &routes.memory_consolidation_model,
+    ) {
+        Ok(value) => value,
+        Err(unsupported_provider) => {
+            tracing::warn!(
+                provider = unsupported_provider,
+                model = override_.model,
+                "admin memory override provider is unsupported"
+            );
+            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+        }
+    };
+    let extractor =
+        memory_runtime::RoutedMemoryExtractor::new(runtime.attempt_walker.clone(), &runtime.config);
+    let embedder = match memory_runtime::memory_write_embedder_from_config(
+        &runtime.config.memory,
+        &runtime.config.llm.discovery.base_url,
+    ) {
+        Ok(embedder) => embedder.map(|client| {
+            embedder::RoutedDiscoveryEmbedder::new(
+                runtime.attempt_walker.clone(),
+                client.config().clone(),
+            )
+        }),
+        Err(error) => {
+            tracing::warn!(%error, provider, model, "failed to build admin memory override embedder");
+            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+        }
+    };
+    let Ok(guard) = runtime.lock.clone().try_lock_owned() else {
+        return admin_memory_restart_ok_response(id, 0, 0, false, true, provider, model);
+    };
+    let mut retried_failed_runs = 0_i64;
+    let mut queued_runs = 0_i64;
+    let result = if run_now {
+        runtime
+            .store
+            .ensure_hourly_runs(
+                OffsetDateTime::now_utc(),
+                routes.memory_retention,
+                routes.memory_retention,
+                routes.memory_enqueue_policy,
+            )
+            .await
+            .map(|queued| queued_runs = admin_u64_to_i64(queued))
+    } else if id > 0 {
+        runtime
+            .store
+            .retry_run(id)
+            .await
+            .map(|()| retried_failed_runs = 1)
+    } else {
+        runtime
+            .store
+            .retry_failed_runs()
+            .await
+            .map(|retried| retried_failed_runs = admin_u64_to_i64(retried))
+    };
+    if let Err(error) = result {
+        tracing::warn!(
+            %error,
+            id,
+            run_now,
+            provider,
+            model,
+            "failed to restart admin memory runs with override"
+        );
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    }
+    let mut cfg =
+        memory_runtime::memory_service_worker_config_from_memory_config(&runtime.config.memory)
+            .process;
+    cfg.episode_model = model.clone();
+    tokio::spawn(admin_memory_override_drain(
+        runtime,
+        extractor,
+        embedder,
+        cfg,
+        model.clone(),
+        guard,
+    ));
+    admin_memory_restart_ok_response(
+        id,
+        retried_failed_runs,
+        queued_runs,
+        true,
+        true,
+        provider,
+        model,
+    )
+}
+
+pub(crate) async fn admin_memory_override_drain(
+    runtime: AdminMemoryOverrideRuntime,
+    extractor: memory_runtime::RoutedMemoryExtractor,
+    embedder: Option<embedder::RoutedDiscoveryEmbedder>,
+    cfg: memory_runtime::MemoryRunProcessConfig,
+    model: String,
+    _guard: tokio::sync::OwnedMutexGuard<()>,
+) {
+    let started_at = std::time::Instant::now();
+    let mut completed = 0_i64;
+    let mut failed = 0_i64;
+    let mut store_errors = 0_i64;
+    tracing::info!(model, workers = 1, "admin memory override drain started");
+    loop {
+        match memory_runtime::process_next_memory_run(
+            &extractor,
+            &runtime.store,
+            embedder.as_ref(),
+            cfg.clone(),
+        )
+        .await
+        {
+            Ok(report) if report.processed => {
+                completed += 1;
+                tracing::info!(?report, "admin memory override run processed");
+            }
+            Ok(_) => break,
+            Err(memory_runtime::MemoryRunProcessError::Process { run_id, source }) => {
+                failed += 1;
+                tracing::warn!(%source, run_id, "admin memory override run failed");
+            }
+            Err(memory_runtime::MemoryRunProcessError::Store { source }) => {
+                store_errors += 1;
+                tracing::warn!(%source, "admin memory override store operation failed");
+                break;
+            }
+        }
+    }
+    tracing::info!(
+        model,
+        completed,
+        failed,
+        store_errors,
+        duration = ?started_at.elapsed(),
+        "admin memory override drain finished"
+    );
+}
+
+pub(crate) fn admin_memory_resolve_override(
+    override_: &AdminMemoryOverride,
+    config: &AppConfig,
+    default_model: &str,
+) -> Result<(String, String), String> {
+    let provider = normalize_memory_restart_provider(&override_.provider);
+    let provider = if provider.is_empty() {
+        "aifarm".to_owned()
+    } else {
+        provider
+    };
+    match provider.as_str() {
+        "aifarm" => {
+            let model = if override_.model.trim().is_empty() {
+                admin_memory_restart_model(default_model)
+            } else {
+                override_.model.trim().to_owned()
+            };
+            Ok((provider, model))
+        }
+        "genkit" | "gemini" => {
+            let model =
+                memory_runtime::genkit_memory_extractor_model(config, Some(&override_.model));
+            Ok(("genkit".to_owned(), model))
+        }
+        _ => Err(provider),
+    }
+}
+
+pub(crate) fn admin_memory_restart_ok_response(
+    id: i64,
+    retried_failed_runs: i64,
+    queued_runs: i64,
+    started: bool,
+    override_: bool,
+    provider: String,
+    model: String,
+) -> Response {
+    let mut value = serde_json::Map::new();
+    value.insert("ok".to_owned(), serde_json::json!(true));
+    if id != 0 {
+        value.insert("run_id".to_owned(), serde_json::json!(id));
+    }
+    value.insert(
+        "retried_failed_runs".to_owned(),
+        serde_json::json!(retried_failed_runs),
+    );
+    value.insert("queued_runs".to_owned(), serde_json::json!(queued_runs));
+    value.insert("started".to_owned(), serde_json::json!(started));
+    value.insert("override".to_owned(), serde_json::json!(override_));
+    if !provider.is_empty() {
+        value.insert("provider".to_owned(), serde_json::json!(provider));
+    }
+    if !model.is_empty() {
+        value.insert("model".to_owned(), serde_json::json!(model));
+    }
+    admin_json_response(StatusCode::OK, serde_json::Value::Object(value))
+}
+
+pub(crate) fn admin_memory_card_filter(raw_query: Option<&str>) -> openplotva_memory::CardFilter {
+    let values = admin_auth_query_values(raw_query);
+    openplotva_memory::CardFilter {
+        chat_id: values
+            .get("chat_id")
+            .and_then(|value| value.trim().parse::<i64>().ok())
+            .unwrap_or_default(),
+        thread_id: values
+            .get("thread_id")
+            .map(String::as_str)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .and_then(|value| value.parse::<i32>().ok()),
+        user_id: values
+            .get("user_id")
+            .and_then(|value| value.trim().parse::<i64>().ok())
+            .unwrap_or_default(),
+        status: values
+            .get("status")
+            .map(|value| value.trim().to_owned())
+            .unwrap_or_default(),
+        card_type: values
+            .get("card_type")
+            .map(|value| value.trim().to_owned())
+            .unwrap_or_default(),
+        visibility: values
+            .get("visibility")
+            .map(|value| value.trim().to_owned())
+            .unwrap_or_default(),
+        as_of: values.get("as_of").and_then(|value| {
+            time::OffsetDateTime::parse(
+                value.trim(),
+                &time::format_description::well_known::Rfc3339,
+            )
+            .ok()
+        }),
+        limit: parse_memory_limit(values.get("limit").map(String::as_str)) as i32,
+    }
+}
+
+pub(crate) fn admin_memory_required_id(
+    raw_query: Option<&str>,
+    missing: &str,
+) -> Result<i64, Box<Response>> {
+    let values = admin_auth_query_values(raw_query);
+    let Some(raw) = values.get("id") else {
+        return Err(Box::new(admin_error_response(
+            StatusCode::BAD_REQUEST,
+            missing,
+        )));
+    };
+    let id = raw.trim().parse::<i64>().map_err(|_| {
+        Box::new(admin_error_response(
+            StatusCode::BAD_REQUEST,
+            if missing == "invalid id" {
+                "invalid id"
+            } else {
+                missing
+            },
+        ))
+    })?;
+    if id == 0 {
+        return Err(Box::new(admin_error_response(
+            StatusCode::BAD_REQUEST,
+            missing,
+        )));
+    }
+    Ok(id)
+}
+
+pub(crate) fn admin_memory_optional_restart_id(
+    raw_query: Option<&str>,
+) -> Result<i64, Box<Response>> {
+    let values = admin_auth_query_values(raw_query);
+    let Some(raw) = values.get("id").map(String::as_str).map(str::trim) else {
+        return Ok(0);
+    };
+    if raw.is_empty() {
+        return Ok(0);
+    }
+    let id = raw
+        .parse::<i64>()
+        .map_err(|_| Box::new(admin_error_response(StatusCode::BAD_REQUEST, "invalid id")))?;
+    if id <= 0 {
+        return Err(Box::new(admin_error_response(
+            StatusCode::BAD_REQUEST,
+            "invalid id",
+        )));
+    }
+    Ok(id)
+}
+
+pub(crate) fn admin_memory_restart_override(
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+    body: &[u8],
+) -> Result<(AdminMemoryOverride, bool), Box<Response>> {
+    let mut req = if admin_request_is_json(headers) {
+        if body.is_empty() {
+            AdminMemoryRestartRequest::default()
+        } else {
+            serde_json::from_slice::<AdminMemoryRestartRequest>(body).map_err(|_| {
+                Box::new(admin_error_response(
+                    StatusCode::BAD_REQUEST,
+                    "invalid override",
+                ))
+            })?
+        }
+    } else {
+        AdminMemoryRestartRequest::default()
+    };
+    let values = admin_auth_query_values(raw_query);
+    if let Some(raw) = values.get("override").map(String::as_str).map(str::trim)
+        && !raw.is_empty()
+        && let Some(value) = parse_go_bool(raw)
+    {
+        req.override_ = value;
+    }
+    if let Some(raw) = values.get("provider").map(String::as_str).map(str::trim)
+        && !raw.is_empty()
+    {
+        req.provider = raw.to_owned();
+    }
+    if let Some(raw) = values.get("model").map(String::as_str).map(str::trim)
+        && !raw.is_empty()
+    {
+        req.model = raw.to_owned();
+    }
+    let provider = req.provider.trim().to_lowercase();
+    if !matches!(provider.as_str(), "" | "aifarm" | "genkit" | "gemini") {
+        return Err(Box::new(admin_error_response(
+            StatusCode::BAD_REQUEST,
+            "invalid override",
+        )));
+    }
+    let model = req.model.trim().to_owned();
+    let explicit = req.override_ || !provider.is_empty() || !model.is_empty();
+    Ok((AdminMemoryOverride { provider, model }, explicit))
+}
+
+pub(crate) fn admin_memory_restart_model(model: &str) -> String {
+    let model = model.trim();
+    if model.is_empty() {
+        openplotva_memory::DEFAULT_MEMORY_CONSOLIDATION_MODEL.to_owned()
+    } else {
+        model.to_owned()
+    }
+}
+
+pub(crate) fn normalize_memory_restart_provider(provider: &str) -> String {
+    let provider = provider.trim();
+    if provider.eq_ignore_ascii_case("aifarm") {
+        "aifarm".to_owned()
+    } else if provider.eq_ignore_ascii_case("genkit") {
+        "genkit".to_owned()
+    } else if provider.eq_ignore_ascii_case("gemini") {
+        "gemini".to_owned()
+    } else {
+        provider.to_lowercase()
+    }
+}
+
+pub(crate) fn admin_u64_to_i64(value: u64) -> i64 {
+    i64::try_from(value).unwrap_or(i64::MAX)
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub(crate) struct AdminMemoryOverride {
+    pub(crate) provider: String,
+    pub(crate) model: String,
+}
+
+#[derive(Clone)]
+pub(crate) struct AdminMemoryOverrideRuntime {
+    pub(crate) config: Arc<AppConfig>,
+    pub(crate) store: PostgresMemoryStore,
+    pub(crate) lock: Arc<tokio::sync::Mutex<()>>,
+    pub(crate) attempt_walker: routed_attempts::RoutedAttemptWalker,
+}
+
+#[derive(Debug, Default, Deserialize)]
+pub(crate) struct AdminMemoryRestartRequest {
+    #[serde(default, rename = "override")]
+    pub(crate) override_: bool,
+    #[serde(default)]
+    pub(crate) provider: String,
+    #[serde(default)]
+    pub(crate) model: String,
+}
+#[derive(serde::Deserialize)]
+struct MemoryCardUpdate {
+    #[serde(default)]
+    id: i64,
+    #[serde(default)]
+    confidence: Option<f64>,
+    #[serde(default)]
+    salience: Option<f64>,
+    #[serde(default)]
+    portable: Option<bool>,
+    #[serde(default)]
+    status: Option<String>,
+}
diff --git a/crates/openplotva-app/src/http/mod.rs b/crates/openplotva-app/src/http/mod.rs
new file mode 100644
index 00000000..a970ec7c
--- /dev/null
+++ b/crates/openplotva-app/src/http/mod.rs
@@ -0,0 +1,75 @@
+//! HTTP state and feature-specific request adapters.
+
+pub(crate) mod assets;
+pub(crate) mod auth;
+pub(crate) mod common;
+pub(crate) mod entities;
+pub(crate) mod ingress;
+pub(crate) mod memory;
+pub(crate) mod observability;
+pub(crate) mod redis;
+pub(crate) mod routing;
+pub(crate) mod settings;
+pub(crate) mod shield;
+pub(crate) mod taskman;
+
+use crate::{
+    dialog_workers, memory_runtime, model_routing, openrouter_free_pool, payments, runtime_cache,
+    runtime_dispatcher, runtime_llm, runtime_llm_runs, runtime_routing, runtime_taskman,
+};
+use openplotva_storage::{
+    PostgresChatMemberStore, PostgresChatSettingsStore, PostgresMemoryStore, PostgresShieldStore,
+    PostgresVipStore, PostgresVirtualMessageStore,
+};
+use sqlx::PgPool;
+use std::{sync::Arc, time::Duration};
+
+#[derive(Clone)]
+pub(crate) struct HttpRouterState {
+    pub(crate) admin_ids: Arc<[i64]>,
+    pub(crate) bot_token: Arc<str>,
+    pub(crate) webapp_url: Arc<str>,
+    pub(crate) bot_username: Arc<str>,
+    pub(crate) bot_id: Option<i64>,
+    pub(crate) default_log_level: Arc<str>,
+    pub(crate) postgres: Option<PgPool>,
+    pub(crate) redis: Option<::redis::Client>,
+    pub(crate) log_buffer: Option<Arc<openplotva_observability::RuntimeLogBuffer>>,
+    pub(crate) telegram: Option<openplotva_telegram::TelegramClient>,
+    pub(crate) dispatcher_inspector: runtime_dispatcher::RuntimeDispatcherInspectorHandle,
+    pub(crate) cache_inspector: runtime_cache::RuntimeCacheInspectorHandle,
+    pub(crate) taskman_inspector: runtime_taskman::RuntimeTaskmanInspectorHandle,
+    pub(crate) llm_trace_buffer: Option<runtime_llm::RuntimeLlmTraceBuffer>,
+    pub(crate) llm_run_buffer: Option<runtime_llm_runs::RuntimeLlmRunBuffer>,
+    pub(crate) gradius_audit_reader: Option<Arc<dyn openplotva_server::RuntimeGradiusAuditReader>>,
+    pub(crate) routing_event_buffer: Option<runtime_routing::RoutingEventBuffer>,
+    pub(crate) routing_event_reporter: Option<runtime_routing::RoutingEventReporter>,
+    pub(crate) llm_discovery_base_url: Arc<str>,
+    pub(crate) llm_discovery_service_name: Arc<str>,
+    pub(crate) runtime_sql_timeout_ms: i32,
+    pub(crate) state_store: Option<PostgresVirtualMessageStore>,
+    pub(crate) settings_store: Option<PostgresChatSettingsStore>,
+    pub(crate) member_store: Option<PostgresChatMemberStore>,
+    pub(crate) vip_store: Option<PostgresVipStore>,
+    pub(crate) vip_status: Option<Arc<dyn payments::VipStatusChecker + Send + Sync>>,
+    pub(crate) memory_store: Option<PostgresMemoryStore>,
+    pub(crate) memory_admin_enabled: bool,
+    pub(crate) memory_retention: Duration,
+    pub(crate) memory_enqueue_policy: openplotva_memory::MemoryRunEnqueuePolicy,
+    pub(crate) memory_consolidation_model: Arc<str>,
+    pub(crate) memory_max_input_tokens: i32,
+    pub(crate) memory_max_messages_per_run: i32,
+    pub(crate) memory_token_estimator_source: Arc<str>,
+    pub(crate) memory_restart_trigger: Option<Arc<tokio::sync::Notify>>,
+    pub(crate) memory_override_runtime: Option<memory::AdminMemoryOverrideRuntime>,
+    pub(crate) shield_store: Option<PostgresShieldStore>,
+    pub(crate) shield_options: openplotva_shield::Options,
+    pub(crate) shield_embedder: Option<Arc<dyn memory_runtime::EmbeddingProvider>>,
+    pub(crate) router_handle: Option<Arc<openplotva_llm::router::RouterHandle>>,
+    pub(crate) router_breakers: Option<Arc<openplotva_llm::router::BreakerSet>>,
+    pub(crate) router_triggers: Option<Arc<openplotva_llm::router::TriggerState>>,
+    pub(crate) router_pools: Option<Arc<openplotva_llm::router::PoolRegistry>>,
+    pub(crate) openrouter_free_gate: Option<Arc<openrouter_free_pool::OpenRouterFreeQuotaGate>>,
+    pub(crate) router_runtime: Option<Arc<model_routing::RouterRuntime>>,
+    pub(crate) dialog_worker_gauge: Option<Arc<dialog_workers::WorkerGauge>>,
+}
diff --git a/crates/openplotva-app/src/http/observability.rs b/crates/openplotva-app/src/http/observability.rs
new file mode 100644
index 00000000..25e06def
--- /dev/null
+++ b/crates/openplotva-app/src/http/observability.rs
@@ -0,0 +1,1033 @@
+use super::HttpRouterState;
+use super::auth::{admin_auth_failure_response, require_admin_request};
+use super::common::{
+    admin_app_setting, admin_error_response, admin_json_no_cache_response, admin_json_response,
+    admin_upsert_app_setting, parse_admin_non_negative_i32, parse_admin_optional_bool,
+    parse_admin_positive_i32, query_values as admin_auth_query_values,
+};
+use crate::{
+    runtime_analytics_overview, runtime_gpu_arbiter, runtime_llm, runtime_llm_analytics,
+    runtime_llm_runs, runtime_safety,
+};
+use crate::{runtime_cache, runtime_dispatcher, runtime_taskman};
+use axum::{
+    body::Bytes,
+    extract::{RawQuery, State},
+    http::{HeaderMap, Method, StatusCode},
+    response::{
+        IntoResponse, Response,
+        sse::{Event, KeepAlive, Sse},
+    },
+};
+use futures_util::{Stream, stream};
+use serde::{Deserialize, Serialize};
+use sqlx::PgPool;
+use std::{collections::VecDeque, convert::Infallible, sync::Arc, time::Duration};
+use time::{OffsetDateTime, format_description::well_known::Rfc3339};
+use tokio::time::Interval;
+
+#[derive(Clone)]
+pub(crate) struct ObservabilityHttpState {
+    admin_ids: Arc<[i64]>,
+    bot_token: Arc<str>,
+    cache_inspector: runtime_cache::RuntimeCacheInspectorHandle,
+    default_log_level: Arc<str>,
+    dispatcher_inspector: runtime_dispatcher::RuntimeDispatcherInspectorHandle,
+    gradius_audit_reader: Option<Arc<dyn openplotva_server::RuntimeGradiusAuditReader>>,
+    llm_discovery_base_url: Arc<str>,
+    llm_discovery_service_name: Arc<str>,
+    llm_run_buffer: Option<runtime_llm_runs::RuntimeLlmRunBuffer>,
+    llm_trace_buffer: Option<runtime_llm::RuntimeLlmTraceBuffer>,
+    log_buffer: Option<Arc<openplotva_observability::RuntimeLogBuffer>>,
+    postgres: Option<PgPool>,
+    runtime_sql_timeout_ms: i32,
+    taskman_inspector: runtime_taskman::RuntimeTaskmanInspectorHandle,
+}
+
+impl axum::extract::FromRef<Arc<HttpRouterState>> for ObservabilityHttpState {
+    fn from_ref(routes: &Arc<HttpRouterState>) -> Self {
+        Self {
+            admin_ids: routes.admin_ids.clone(),
+            bot_token: routes.bot_token.clone(),
+            cache_inspector: routes.cache_inspector.clone(),
+            default_log_level: routes.default_log_level.clone(),
+            dispatcher_inspector: routes.dispatcher_inspector.clone(),
+            gradius_audit_reader: routes.gradius_audit_reader.clone(),
+            llm_discovery_base_url: routes.llm_discovery_base_url.clone(),
+            llm_discovery_service_name: routes.llm_discovery_service_name.clone(),
+            llm_run_buffer: routes.llm_run_buffer.clone(),
+            llm_trace_buffer: routes.llm_trace_buffer.clone(),
+            log_buffer: routes.log_buffer.clone(),
+            postgres: routes.postgres.clone(),
+            runtime_sql_timeout_ms: routes.runtime_sql_timeout_ms,
+            taskman_inspector: routes.taskman_inspector.clone(),
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn test_state(routes: &HttpRouterState) -> ObservabilityHttpState {
+    use axum::extract::FromRef as _;
+    ObservabilityHttpState::from_ref(&Arc::new(routes.clone()))
+}
+
+pub(crate) async fn admin_state(
+    headers: HeaderMap,
+    State(routes): State<ObservabilityHttpState>,
+) -> Response {
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    admin_state_response(&routes).await
+}
+
+pub(crate) async fn admin_loglevel(
+    method: Method,
+    headers: HeaderMap,
+    State(routes): State<ObservabilityHttpState>,
+    body: Bytes,
+) -> Response {
+    let headers = &headers;
+    let routes = &routes;
+    let body = body.as_ref();
+    if method != Method::POST && method != Method::PUT {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Ok(req) = serde_json::from_slice::<AdminLogLevelRequest>(body) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "bad request");
+    };
+    let level = req.level.trim().to_lowercase();
+    match level.as_str() {
+        "debug" | "info" | "warn" | "warning" | "error" => {}
+        _ => return admin_error_response(StatusCode::BAD_REQUEST, "invalid level"),
+    }
+    if let Err(error) = openplotva_observability::set_log_level(&level) {
+        tracing::warn!(%error, level, "failed to update runtime log level");
+    }
+    if let Err(error) =
+        admin_upsert_app_setting(routes.postgres.as_ref(), "log_level", &level).await
+    {
+        tracing::warn!(%error, level, "failed to persist admin log level");
+    }
+    admin_json_response(
+        StatusCode::OK,
+        serde_json::json!({ "ok": true, "level": level }),
+    )
+}
+
+pub(crate) async fn admin_logs_stream(
+    headers: HeaderMap,
+    State(routes): State<ObservabilityHttpState>,
+) -> Response {
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(buffer) = routes.log_buffer.clone() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    Sse::new(admin_logs_sse_stream(buffer))
+        .keep_alive(
+            KeepAlive::new()
+                .interval(Duration::from_secs(15))
+                .text("keep-alive"),
+        )
+        .into_response()
+}
+
+pub(crate) async fn admin_safety_checks(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<ObservabilityHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(pool) = routes.postgres.clone() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    let reader = runtime_safety::PostgresRuntimeSafetyCheckReader::new(pool);
+    match openplotva_server::RuntimeSafetyCheckReader::safety_checks(
+        &reader,
+        admin_safety_checks_filter(raw_query),
+    )
+    .await
+    {
+        Ok(connection) => {
+            let checks = connection
+                .items
+                .iter()
+                .map(admin_safety_check_json)
+                .collect::<Vec<_>>();
+            admin_json_no_cache_response(
+                StatusCode::OK,
+                serde_json::json!({
+                    "count": checks.len(),
+                    "checks": checks,
+                }),
+            )
+        }
+        Err(error) => {
+            tracing::warn!(%error, "failed to list admin safety checks");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_gradius_opportunities(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<ObservabilityHttpState>,
+) -> Response {
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(reader) = routes.gradius_audit_reader.as_deref() else {
+        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "Gradius audit unavailable");
+    };
+    let values = admin_auth_query_values(raw_query.as_deref());
+    let filter = match admin_gradius_opportunities_filter(&values) {
+        Ok(filter) => filter,
+        Err(error) => return admin_error_response(StatusCode::BAD_REQUEST, &error),
+    };
+    match reader.gradius_ad_opportunities(filter).await {
+        Ok(payload) => admin_json_response(StatusCode::OK, payload),
+        Err(error) => {
+            if error == "invalid Gradius range" {
+                admin_error_response(StatusCode::BAD_REQUEST, &error)
+            } else {
+                tracing::warn!(%error, "failed to read Gradius opportunities for admin");
+                admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+            }
+        }
+    }
+}
+
+pub(crate) async fn admin_gradius_summary(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<ObservabilityHttpState>,
+) -> Response {
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(reader) = routes.gradius_audit_reader.as_deref() else {
+        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "Gradius audit unavailable");
+    };
+    let values = admin_auth_query_values(raw_query.as_deref());
+    let list_filter = match admin_gradius_opportunities_filter(&values) {
+        Ok(filter) => filter,
+        Err(error) => return admin_error_response(StatusCode::BAD_REQUEST, &error),
+    };
+    let filter = openplotva_server::RuntimeGradiusSummaryFilter {
+        range: list_filter.range,
+        integration_kind: list_filter.integration_kind,
+        source: list_filter.source,
+        outcome: list_filter.outcome,
+        delivery_state: list_filter.delivery_state,
+        user_id: list_filter.user_id,
+        chat_id: list_filter.chat_id,
+        dialog_job_id: list_filter.dialog_job_id,
+        model: list_filter.model,
+        q: list_filter.q,
+    };
+    match reader.gradius_ad_summary(filter).await {
+        Ok(payload) => admin_json_response(StatusCode::OK, payload),
+        Err(error) => {
+            let status = if error == "invalid Gradius range" {
+                StatusCode::BAD_REQUEST
+            } else {
+                tracing::warn!(%error, "failed to read Gradius summary for admin");
+                StatusCode::INTERNAL_SERVER_ERROR
+            };
+            admin_error_response(status, &error)
+        }
+    }
+}
+
+pub(crate) fn admin_gradius_opportunities_filter(
+    values: &std::collections::BTreeMap<String, String>,
+) -> Result<openplotva_server::RuntimeGradiusOpportunitiesFilter, String> {
+    let parse_id = |key: &str| -> Result<Option<i64>, String> {
+        values
+            .get(key)
+            .filter(|value| !value.trim().is_empty())
+            .map(|value| {
+                value
+                    .parse::<i64>()
+                    .map_err(|_| format!("{key} must be an integer"))
+            })
+            .transpose()
+    };
+    let parse_page = |key: &str, default: i32| -> Result<i32, String> {
+        values.get(key).map_or(Ok(default), |value| {
+            value
+                .parse::<i32>()
+                .map_err(|_| format!("{key} must be an integer"))
+        })
+    };
+    Ok(openplotva_server::RuntimeGradiusOpportunitiesFilter {
+        range: values.get("range").cloned().unwrap_or_default(),
+        integration_kind: values.get("integration_kind").cloned().unwrap_or_default(),
+        source: values.get("source").cloned().unwrap_or_default(),
+        outcome: values.get("outcome").cloned().unwrap_or_default(),
+        delivery_state: values.get("delivery_state").cloned().unwrap_or_default(),
+        user_id: parse_id("user_id")?,
+        chat_id: parse_id("chat_id")?,
+        dialog_job_id: parse_id("dialog_job_id")?,
+        model: values.get("model").cloned().unwrap_or_default(),
+        q: values.get("q").cloned().unwrap_or_default(),
+        offset: parse_page("offset", 0)?.max(0),
+        limit: parse_page("limit", 100)?.clamp(1, 500),
+    })
+}
+
+pub(crate) async fn admin_llm_analytics_summary(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<ObservabilityHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(pool) = routes.postgres.clone() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    let taskman: Arc<dyn openplotva_server::RuntimeTaskmanInspector> =
+        Arc::new(routes.taskman_inspector.clone());
+    let reader = runtime_llm_analytics::PostgresRuntimeLlmAnalyticsReader::new(pool)
+        .with_discovery_capacity(
+            routes.llm_discovery_base_url.to_string(),
+            routes.llm_discovery_service_name.to_string(),
+        )
+        .with_sql_timeout_ms(routes.runtime_sql_timeout_ms)
+        .with_taskman(taskman);
+    let range = admin_auth_query_values(raw_query)
+        .remove("range")
+        .map(|value| value.trim().to_owned())
+        .unwrap_or_default();
+    match openplotva_server::RuntimeLlmAnalyticsReader::llm_analytics(&reader, &range).await {
+        Ok(summary) => {
+            let since = admin_llm_analytics_since_time(&summary);
+            let tool_calls = openplotva_dialog::tool_telemetry::snapshot_since(since, 50);
+            admin_json_no_cache_response(
+                StatusCode::OK,
+                admin_llm_analytics_summary_json(&summary, &tool_calls),
+            )
+        }
+        Err(error) => {
+            tracing::warn!(%error, "failed to build admin llm analytics summary");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_analytics_overview(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<ObservabilityHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(pool) = routes.postgres.clone() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    let range = admin_auth_query_values(raw_query)
+        .remove("range")
+        .map(|value| value.trim().to_owned())
+        .unwrap_or_default();
+    let reader = runtime_analytics_overview::AnalyticsOverviewReader::new(
+        pool,
+        routes.runtime_sql_timeout_ms,
+    );
+    match reader.overview(&range).await {
+        Ok(value) => admin_json_no_cache_response(StatusCode::OK, value),
+        Err(error) => {
+            tracing::warn!(%error, "failed to build admin analytics overview");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_gpu1_status(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<ObservabilityHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let range = admin_auth_query_values(raw_query)
+        .remove("range")
+        .map(|value| value.trim().to_owned())
+        .unwrap_or_default();
+    let reader = runtime_gpu_arbiter::GpuArbiterReader::new(
+        routes.llm_discovery_base_url.to_string(),
+        routes.postgres.clone(),
+        routes.runtime_sql_timeout_ms,
+    );
+    admin_json_no_cache_response(StatusCode::OK, reader.snapshot(&range).await)
+}
+
+pub(crate) async fn admin_llm_dialogs(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<ObservabilityHttpState>,
+) -> Response {
+    admin_llm_dialogs_response(&routes, method, &headers, raw_query.as_deref())
+}
+
+pub(crate) async fn admin_llm_dialogs_detail(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<ObservabilityHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let id = admin_auth_query_values(raw_query)
+        .remove("id")
+        .and_then(|value| value.trim().parse::<i64>().ok());
+    let Some(id) = id else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "id is required");
+    };
+    let record = routes
+        .llm_run_buffer
+        .as_ref()
+        .and_then(|buffer| buffer.get(id));
+    let Some(record) = record else {
+        return admin_json_no_cache_response(
+            StatusCode::OK,
+            serde_json::json!({ "run": serde_json::Value::Null }),
+        );
+    };
+    let mut run_json = record.detail_json();
+    let live_traces: Vec<Option<openplotva_server::RuntimeLlmRequestData>> = record
+        .rounds
+        .iter()
+        .map(|round| {
+            routes
+                .llm_trace_buffer
+                .as_ref()
+                .and_then(|traces| traces.get(round.trace_id))
+        })
+        .collect();
+    let mut persisted: std::collections::HashMap<
+        i32,
+        (Option<serde_json::Value>, Option<serde_json::Value>),
+    > = std::collections::HashMap::new();
+    if live_traces.iter().any(Option::is_none)
+        && let Some(pool) = routes.postgres.as_ref()
+    {
+        match runtime_llm::fetch_llm_raw_bodies_for_run(pool, &record.run_id).await {
+            Ok(bodies) => persisted = bodies,
+            Err(error) => {
+                tracing::warn!(%error, run_id = %record.run_id, "failed to load persisted llm raw bodies");
+            }
+        }
+    }
+    if let Some(rounds) = run_json["rounds"].as_array_mut() {
+        for (index, round_json) in rounds.iter_mut().enumerate() {
+            let Some(round) = record.rounds.get(index) else {
+                continue;
+            };
+            match live_traces.get(index).and_then(Option::as_ref) {
+                Some(trace) => {
+                    round_json["raw_source"] = serde_json::json!("live");
+                    round_json["raw_request"] =
+                        trace.raw_request.clone().unwrap_or(serde_json::Value::Null);
+                    round_json["raw_response"] = trace
+                        .raw_response
+                        .clone()
+                        .unwrap_or(serde_json::Value::Null);
+                    if let Some(usage) = trace.usage.clone() {
+                        round_json["usage"] = usage;
+                    }
+                    if let Some(timings) = trace.timings.clone() {
+                        round_json["timings"] = timings;
+                    }
+                    if let Some(params) = trace.inference_params.clone() {
+                        round_json["inference_params"] = params;
+                    }
+                }
+                None => match persisted.remove(&round.seq) {
+                    Some((request, response)) if request.is_some() || response.is_some() => {
+                        round_json["raw_source"] = serde_json::json!("db");
+                        round_json["raw_request"] = request.unwrap_or(serde_json::Value::Null);
+                        round_json["raw_response"] = response.unwrap_or(serde_json::Value::Null);
+                    }
+                    _ => {
+                        round_json["raw_source"] = serde_json::json!("rotated_out");
+                    }
+                },
+            }
+        }
+    }
+    admin_json_no_cache_response(StatusCode::OK, serde_json::json!({ "run": run_json }))
+}
+
+pub(crate) async fn admin_llm_dialogs_clear(
+    method: Method,
+    headers: HeaderMap,
+    State(routes): State<ObservabilityHttpState>,
+) -> Response {
+    admin_llm_dialogs_clear_response(&routes, method, &headers)
+}
+
+pub(crate) async fn admin_state_response(routes: &ObservabilityHttpState) -> Response {
+    let level = admin_app_setting(routes.postgres.as_ref(), "log_level")
+        .await
+        .filter(|value| !value.trim().is_empty())
+        .unwrap_or_else(|| routes.default_log_level.to_string());
+    let dispatcher_stats =
+        openplotva_server::RuntimeDispatcherInspector::stats(&routes.dispatcher_inspector);
+    let cache_stats = openplotva_server::RuntimeCacheInspector::stats(&routes.cache_inspector);
+    admin_json_response(
+        StatusCode::OK,
+        serde_json::json!({
+            "log_level": level,
+            "queue": {
+                "regularQueueSize": dispatcher_stats.regular_queue_size,
+                "immediateQueueSize": dispatcher_stats.immediate_queue_size,
+                "processedTotal": dispatcher_stats.processed_total,
+                "dedupedTotal": dispatcher_stats.deduped_total,
+            },
+            "cache": admin_cache_stats_json(cache_stats.cache),
+            "planner": admin_cache_stats_json(cache_stats.planner_cache),
+        }),
+    )
+}
+
+pub(crate) fn admin_cache_stats_json(
+    stats: openplotva_server::RuntimeCacheStatsData,
+) -> serde_json::Value {
+    serde_json::json!({
+        "Size": stats.size,
+        "Capacity": stats.capacity,
+        "Hits": stats.hits,
+        "Misses": stats.misses,
+        "MemSize": stats.mem_size,
+    })
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_loglevel_response(
+    routes: &ObservabilityHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    body: &[u8],
+) -> Response {
+    admin_loglevel(
+        method,
+        headers.clone(),
+        State(routes.clone()),
+        Bytes::copy_from_slice(body),
+    )
+    .await
+}
+
+pub(crate) fn admin_llm_dialogs_filter(raw_query: Option<&str>) -> runtime_llm_runs::RunListFilter {
+    let values = admin_auth_query_values(raw_query);
+    runtime_llm_runs::RunListFilter {
+        kind: values
+            .get("kind")
+            .map(|value| value.trim().to_owned())
+            .filter(|value| !value.is_empty() && value != "all"),
+        chat_id: values
+            .get("chat_id")
+            .and_then(|value| value.trim().parse::<i64>().ok()),
+        errors_only: parse_admin_optional_bool(values.get("errors_only").map(String::as_str))
+            .unwrap_or(false),
+        q: values
+            .get("q")
+            .map(|value| value.trim().to_owned())
+            .unwrap_or_default(),
+        limit: parse_admin_positive_i32(values.get("limit").map(String::as_str), 200, 1000)
+            as usize,
+    }
+}
+
+pub(crate) fn admin_llm_dialogs_response(
+    routes: &ObservabilityHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(buffer) = routes.llm_run_buffer.as_ref() else {
+        return admin_json_no_cache_response(
+            StatusCode::OK,
+            serde_json::json!({ "count": 0, "runs": [] }),
+        );
+    };
+    let filter = admin_llm_dialogs_filter(raw_query);
+    let runs = buffer
+        .list(&filter, OffsetDateTime::now_utc())
+        .iter()
+        .map(runtime_llm_runs::RunRecord::skeleton_json)
+        .collect::<Vec<_>>();
+    admin_json_no_cache_response(
+        StatusCode::OK,
+        serde_json::json!({ "count": runs.len(), "runs": runs }),
+    )
+}
+
+pub(crate) fn admin_llm_dialogs_clear_response(
+    routes: &ObservabilityHttpState,
+    method: Method,
+    headers: &HeaderMap,
+) -> Response {
+    if method != Method::POST {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    if let Some(buffer) = routes.llm_run_buffer.as_ref() {
+        buffer.clear();
+    }
+    admin_json_no_cache_response(StatusCode::OK, serde_json::json!({ "ok": true }))
+}
+
+pub(crate) fn admin_llm_analytics_since_time(
+    summary: &openplotva_server::RuntimeLlmAnalyticsData,
+) -> OffsetDateTime {
+    OffsetDateTime::parse(&summary.since, &Rfc3339).unwrap_or_else(|_| OffsetDateTime::now_utc())
+}
+
+pub(crate) fn admin_safety_checks_filter(
+    raw_query: Option<&str>,
+) -> openplotva_server::RuntimeSafetyChecksFilter {
+    let values = admin_auth_query_values(raw_query);
+    openplotva_server::RuntimeSafetyChecksFilter {
+        q: values
+            .get("q")
+            .map(|value| value.trim())
+            .unwrap_or("")
+            .to_owned(),
+        flagged: parse_admin_optional_bool(values.get("flagged").map(String::as_str)),
+        offset: parse_admin_non_negative_i32(values.get("offset").map(String::as_str), 0),
+        limit: parse_admin_positive_i32(values.get("limit").map(String::as_str), 200, 1000),
+    }
+}
+
+pub(crate) fn admin_safety_check_json(
+    check: &openplotva_server::RuntimeSafetyCheckData,
+) -> serde_json::Value {
+    let mut root = serde_json::Map::new();
+    admin_insert(&mut root, "id", check.id);
+    admin_insert(&mut root, "created_at", &check.created_at);
+    admin_insert(&mut root, "source", &check.source);
+    admin_insert_opt(&mut root, "flow", check.flow.as_deref());
+    admin_insert_opt(&mut root, "mode", check.mode.as_deref());
+    admin_insert_opt(&mut root, "chat_id", check.chat_id);
+    admin_insert_opt(&mut root, "thread_id", check.thread_id);
+    admin_insert_opt(&mut root, "message_id", check.message_id);
+    admin_insert_opt(&mut root, "user_id", check.user_id);
+    admin_insert(&mut root, "deployment_id", &check.deployment_id);
+    admin_insert_opt(
+        &mut root,
+        "external_session_id",
+        check.external_session_id.as_deref(),
+    );
+    admin_insert(
+        &mut root,
+        "request_messages",
+        check
+            .request_messages
+            .clone()
+            .unwrap_or(serde_json::Value::Null),
+    );
+    admin_insert_opt(&mut root, "flagged", check.flagged);
+    admin_insert_opt(
+        &mut root,
+        "internal_session_id",
+        check.internal_session_id.as_deref(),
+    );
+    admin_insert_opt_value(&mut root, "policies", check.policies.as_ref());
+    admin_insert_opt_value(&mut root, "response_json", check.response_json.as_ref());
+    admin_insert(&mut root, "duration_ms", check.duration_ms);
+    admin_insert_opt(&mut root, "error", check.error.as_deref());
+    serde_json::Value::Object(root)
+}
+
+pub(crate) fn admin_llm_analytics_summary_json(
+    summary: &openplotva_server::RuntimeLlmAnalyticsData,
+    tool_calls: &openplotva_dialog::tool_telemetry::ToolTelemetrySnapshot,
+) -> serde_json::Value {
+    let mut root = serde_json::Map::new();
+    admin_insert(&mut root, "range", &summary.range);
+    admin_insert(&mut root, "bucket", &summary.bucket);
+    admin_insert(&mut root, "since", &summary.since);
+    admin_insert(
+        &mut root,
+        "totals",
+        serde_json::json!({
+            "total_count": summary.totals.total_count,
+            "error_count": summary.totals.error_count,
+            "avg_duration_ms": summary.totals.avg_duration_ms,
+        }),
+    );
+    admin_insert(&mut root, "series", admin_llm_series_json(&summary.series));
+    admin_insert(
+        &mut root,
+        "model_series",
+        admin_llm_model_series_json(&summary.model_series),
+    );
+    admin_insert(
+        &mut root,
+        "top_chats",
+        admin_llm_top_chats_json(&summary.top_chats),
+    );
+    admin_insert(&mut root, "models", admin_llm_models_json(&summary.models));
+    admin_insert(
+        &mut root,
+        "providers",
+        admin_llm_providers_json(&summary.providers),
+    );
+    admin_insert(
+        &mut root,
+        "inference_params",
+        admin_llm_inference_params_json(&summary.inference_params),
+    );
+    admin_insert(
+        &mut root,
+        "stage_metrics",
+        admin_llm_stage_metrics_json(&summary.stage_metrics),
+    );
+    admin_insert(
+        &mut root,
+        "runtime_jobs",
+        admin_runtime_jobs_json(&summary.runtime_jobs),
+    );
+    admin_insert_opt(
+        &mut root,
+        "runtime_jobs_error",
+        summary.runtime_jobs_error.as_deref(),
+    );
+    admin_insert(&mut root, "tool_calls", tool_calls.to_json());
+    let ai_farm_capacity = summary
+        .ai_farm_capacity
+        .as_ref()
+        .map(admin_aifarm_capacity_json);
+    admin_insert_opt_value(&mut root, "aifarm_capacity", ai_farm_capacity.as_ref());
+    serde_json::Value::Object(root)
+}
+
+pub(crate) fn admin_llm_series_json(
+    series: &[openplotva_server::RuntimeLlmAnalyticsSeriesPointData],
+) -> Vec<serde_json::Value> {
+    series
+        .iter()
+        .map(|point| {
+            serde_json::json!({
+                "ts": point.ts,
+                "total_count": point.total_count,
+                "error_count": point.error_count,
+                "avg_duration_ms": point.avg_duration_ms,
+            })
+        })
+        .collect()
+}
+
+pub(crate) fn admin_llm_model_series_json(
+    series: &[openplotva_server::RuntimeLlmAnalyticsModelSeriesPointData],
+) -> Vec<serde_json::Value> {
+    series
+        .iter()
+        .map(|point| {
+            serde_json::json!({
+                "ts": point.ts,
+                "model": point.model,
+                "request_count": point.request_count,
+                "error_count": point.error_count,
+                "avg_duration_ms": point.avg_duration_ms,
+                "avg_generation_tps": point.avg_generation_tps,
+                "avg_effective_output_tps": point.avg_effective_output_tps,
+                "output_tokens": point.output_tokens,
+            })
+        })
+        .collect()
+}
+
+pub(crate) fn admin_llm_top_chats_json(
+    chats: &[openplotva_server::RuntimeLlmAnalyticsTopChatData],
+) -> Vec<serde_json::Value> {
+    chats
+        .iter()
+        .map(|chat| {
+            let mut root = serde_json::Map::new();
+            admin_insert(&mut root, "chat_id", chat.chat_id);
+            admin_insert_opt(&mut root, "title", chat.title.as_deref());
+            admin_insert_opt(&mut root, "username", chat.username.as_deref());
+            admin_insert(&mut root, "request_count", chat.request_count);
+            serde_json::Value::Object(root)
+        })
+        .collect()
+}
+
+pub(crate) fn admin_llm_models_json(
+    models: &[openplotva_server::RuntimeLlmAnalyticsModelStatData],
+) -> Vec<serde_json::Value> {
+    models
+        .iter()
+        .map(|model| {
+            serde_json::json!({
+                "model": model.model,
+                "request_count": model.request_count,
+                "error_count": model.error_count,
+                "avg_duration_ms": model.avg_duration_ms,
+                "p50_duration_ms": model.p50_duration_ms,
+                "p95_duration_ms": model.p95_duration_ms,
+                "input_tokens": model.input_tokens,
+                "output_tokens": model.output_tokens,
+                "total_tokens": model.total_tokens,
+                "avg_generation_tps": model.avg_generation_tps,
+                "avg_effective_output_tps": model.avg_effective_output_tps,
+                "p50_effective_output_tps": model.p50_effective_output_tps,
+                "p95_effective_output_tps": model.p95_effective_output_tps,
+            })
+        })
+        .collect()
+}
+
+pub(crate) fn admin_llm_providers_json(
+    providers: &[openplotva_server::RuntimeLlmAnalyticsProviderStatData],
+) -> Vec<serde_json::Value> {
+    providers
+        .iter()
+        .map(|provider| {
+            serde_json::json!({
+                "provider": provider.provider,
+                "source": provider.source,
+                "request_count": provider.request_count,
+                "error_count": provider.error_count,
+                "avg_duration_ms": provider.avg_duration_ms,
+                "p50_duration_ms": provider.p50_duration_ms,
+                "p95_duration_ms": provider.p95_duration_ms,
+                "input_tokens": provider.input_tokens,
+                "output_tokens": provider.output_tokens,
+                "total_tokens": provider.total_tokens,
+                "avg_generation_tps": provider.avg_generation_tps,
+                "avg_effective_output_tps": provider.avg_effective_output_tps,
+            })
+        })
+        .collect()
+}
+
+pub(crate) fn admin_llm_inference_params_json(
+    params: &[openplotva_server::RuntimeLlmAnalyticsInferenceParamStatData],
+) -> Vec<serde_json::Value> {
+    params
+        .iter()
+        .map(|param| {
+            let mut root = serde_json::Map::new();
+            admin_insert(&mut root, "provider", &param.provider);
+            admin_insert(&mut root, "source", &param.source);
+            admin_insert(&mut root, "model", &param.model);
+            admin_insert_opt(&mut root, "max_tokens", param.max_tokens);
+            admin_insert_opt(&mut root, "temperature", param.temperature);
+            admin_insert_opt(&mut root, "top_p", param.top_p);
+            admin_insert_opt(&mut root, "top_k", param.top_k);
+            admin_insert_opt(&mut root, "candidate_count", param.candidate_count);
+            admin_insert(&mut root, "tool_mode", &param.tool_mode);
+            admin_insert(&mut root, "response_format", &param.response_format);
+            admin_insert(&mut root, "request_count", param.request_count);
+            admin_insert(&mut root, "error_count", param.error_count);
+            admin_insert(&mut root, "avg_duration_ms", param.avg_duration_ms);
+            admin_insert(
+                &mut root,
+                "avg_effective_output_tps",
+                param.avg_effective_output_tps,
+            );
+            serde_json::Value::Object(root)
+        })
+        .collect()
+}
+
+pub(crate) fn admin_llm_stage_metrics_json(
+    metrics: &[openplotva_server::RuntimeLlmAnalyticsStageMetricData],
+) -> Vec<serde_json::Value> {
+    metrics
+        .iter()
+        .map(|metric| {
+            serde_json::json!({
+                "stage": metric.stage,
+                "source": metric.source,
+                "request_count": metric.request_count,
+                "error_count": metric.error_count,
+                "avg_duration_ms": metric.avg_duration_ms,
+                "p50_duration_ms": metric.p50_duration_ms,
+                "p95_duration_ms": metric.p95_duration_ms,
+                "avg_iteration": metric.avg_iteration,
+                "max_iteration": metric.max_iteration,
+            })
+        })
+        .collect()
+}
+
+pub(crate) fn admin_runtime_jobs_json(
+    jobs: &[openplotva_server::RuntimeJobAnalyticsStatData],
+) -> Vec<serde_json::Value> {
+    jobs.iter()
+        .map(|job| {
+            serde_json::json!({
+                "job_type": job.job_type,
+                "queue_name": job.queue_name,
+                "provider": job.provider,
+                "created_count": job.created_count,
+                "completed_count": job.completed_count,
+                "failed_count": job.failed_count,
+                "avg_wait_ms": job.avg_wait_ms,
+                "p95_wait_ms": job.p95_wait_ms,
+                "avg_processing_ms": job.avg_processing_ms,
+                "p95_processing_ms": job.p95_processing_ms,
+            })
+        })
+        .collect()
+}
+
+pub(crate) fn admin_aifarm_capacity_json(
+    capacity: &openplotva_server::RuntimeAifarmCapacitySnapshotData,
+) -> serde_json::Value {
+    let mut root = serde_json::Map::new();
+    admin_insert(&mut root, "service", &capacity.service);
+    admin_insert(
+        &mut root,
+        "max_concurrent_jobs",
+        capacity.max_concurrent_jobs,
+    );
+    admin_insert(&mut root, "running", capacity.running);
+    admin_insert(&mut root, "queued", capacity.queued);
+    admin_insert(&mut root, "available", capacity.available);
+    admin_insert(&mut root, "locked", capacity.locked);
+    admin_insert(&mut root, "ready", capacity.ready);
+    admin_insert(&mut root, "observed_at", &capacity.observed_at);
+    admin_insert_opt(&mut root, "error", capacity.error.as_deref());
+    serde_json::Value::Object(root)
+}
+
+pub(crate) fn admin_insert<T: Serialize>(
+    map: &mut serde_json::Map<String, serde_json::Value>,
+    key: &str,
+    value: T,
+) {
+    map.insert(key.to_owned(), serde_json::json!(value));
+}
+
+pub(crate) fn admin_insert_opt<T: Serialize>(
+    map: &mut serde_json::Map<String, serde_json::Value>,
+    key: &str,
+    value: Option<T>,
+) {
+    if let Some(value) = value {
+        admin_insert(map, key, value);
+    }
+}
+
+pub(crate) fn admin_insert_opt_value(
+    map: &mut serde_json::Map<String, serde_json::Value>,
+    key: &str,
+    value: Option<&serde_json::Value>,
+) {
+    if let Some(value) = value {
+        map.insert(key.to_owned(), value.clone());
+    }
+}
+
+pub(crate) fn admin_logs_sse_stream(
+    buffer: Arc<openplotva_observability::RuntimeLogBuffer>,
+) -> impl Stream<Item = Result<Event, Infallible>> {
+    let after_seq = buffer.latest_seq();
+    stream::unfold(
+        AdminLogStreamState {
+            buffer,
+            after_seq,
+            pending: VecDeque::new(),
+            interval: tokio::time::interval(Duration::from_secs(1)),
+        },
+        |mut state| async move {
+            loop {
+                if let Some(entry) = state.pending.pop_front() {
+                    state.after_seq = state.after_seq.max(entry.seq);
+                    let data = serde_json::json!({
+                        "seq": entry.seq,
+                        "time": entry.time,
+                        "level": entry.level,
+                        "message": entry.message,
+                        "attrs": entry.attrs,
+                    })
+                    .to_string();
+                    return Some((Ok(Event::default().data(data)), state));
+                }
+                state.interval.tick().await;
+                state.pending = VecDeque::from(state.buffer.logs(state.after_seq, 100, "", ""));
+            }
+        },
+    )
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct AdminLogLevelRequest {
+    pub(crate) level: String,
+}
+
+#[derive(Debug)]
+pub(crate) struct AdminLogStreamState {
+    pub(crate) buffer: Arc<openplotva_observability::RuntimeLogBuffer>,
+    pub(crate) after_seq: u64,
+    pub(crate) pending: VecDeque<openplotva_observability::RuntimeLogEntry>,
+    pub(crate) interval: Interval,
+}
diff --git a/crates/openplotva-app/src/http/redis.rs b/crates/openplotva-app/src/http/redis.rs
new file mode 100644
index 00000000..236da5cc
--- /dev/null
+++ b/crates/openplotva-app/src/http/redis.rs
@@ -0,0 +1,197 @@
+use super::{
+    HttpRouterState,
+    auth::{admin_auth_failure_response, require_admin_request},
+    common::{admin_error_response, admin_json_response, query_values as admin_auth_query_values},
+};
+use axum::{
+    extract::{RawQuery, State},
+    http::{HeaderMap, Method, StatusCode},
+    response::Response,
+};
+use openplotva_storage::redis_inspector::{
+    RedisInspectorStore, prefix_groups_from_keys as admin_redis_prefix_groups_from_keys,
+};
+use std::sync::Arc;
+#[derive(Clone)]
+pub(crate) struct RedisHttpState {
+    admin_ids: Arc<[i64]>,
+    bot_token: Arc<str>,
+    redis: Option<redis::Client>,
+}
+impl axum::extract::FromRef<Arc<HttpRouterState>> for RedisHttpState {
+    fn from_ref(routes: &Arc<HttpRouterState>) -> Self {
+        Self {
+            admin_ids: routes.admin_ids.clone(),
+            bot_token: routes.bot_token.clone(),
+            redis: routes.redis.clone(),
+        }
+    }
+}
+pub(crate) async fn admin_redis_list(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<RedisHttpState>,
+) -> Response {
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let pattern = admin_auth_query_values(raw_query.as_deref())
+        .remove("pattern")
+        .filter(|value| !value.is_empty())
+        .unwrap_or_else(|| "*".to_owned());
+    let Some(redis) = routes.redis.clone().map(RedisInspectorStore::new) else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    match redis.scan_keys(&pattern, None).await {
+        Ok(keys) => admin_json_response(StatusCode::OK, serde_json::json!({ "keys": keys })),
+        Err(error) => {
+            tracing::warn!(%error, pattern, "failed to list admin redis keys");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_redis_get(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<RedisHttpState>,
+) -> Response {
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query.as_deref());
+    let Some(key) = values.get("key").filter(|value| !value.is_empty()) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "key required");
+    };
+    let Some(redis) = routes.redis.clone().map(RedisInspectorStore::new) else {
+        return admin_error_response(StatusCode::NOT_FOUND, "not found");
+    };
+    match redis.value(key).await {
+        Ok(Some(value)) => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "key": key, "value": String::from_utf8_lossy(&value) }),
+        ),
+        Ok(None) => admin_error_response(StatusCode::NOT_FOUND, "not found"),
+        Err(error) => {
+            tracing::warn!(%error, key, "failed to get admin redis value");
+            admin_error_response(StatusCode::NOT_FOUND, "not found")
+        }
+    }
+}
+
+pub(crate) async fn admin_redis_delete_prefix(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<RedisHttpState>,
+) -> Response {
+    if method != Method::DELETE {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query.as_deref());
+    let Some(prefix) = values.get("prefix").filter(|value| !value.is_empty()) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "prefix required");
+    };
+    let Some(redis) = routes.redis.clone().map(RedisInspectorStore::new) else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    match redis.delete_by_prefix(prefix).await {
+        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
+        Err(error) => {
+            tracing::warn!(%error, prefix, "failed to delete admin redis prefix");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_redis_prefixes(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<RedisHttpState>,
+) -> Response {
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let prefix = admin_auth_query_values(raw_query.as_deref())
+        .remove("prefix")
+        .unwrap_or_default();
+    let Some(redis) = routes.redis.clone().map(RedisInspectorStore::new) else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    match redis.scan_keys(&format!("{prefix}*"), None).await {
+        Ok(keys) => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "groups": admin_redis_prefix_groups_from_keys(&prefix, keys) }),
+        ),
+        Err(error) => {
+            tracing::warn!(%error, prefix, "failed to list admin redis prefixes");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_redis_delete_key(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<RedisHttpState>,
+) -> Response {
+    if method != Method::DELETE {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query.as_deref());
+    let Some(key) = values.get("key").filter(|value| !value.is_empty()) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "key required");
+    };
+    let Some(redis) = routes.redis.clone().map(RedisInspectorStore::new) else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    match redis.delete_key(key).await {
+        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
+        Err(error) => {
+            tracing::warn!(%error, key, "failed to delete admin redis key");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_redis_flushdb(
+    method: Method,
+    headers: HeaderMap,
+    State(routes): State<RedisHttpState>,
+) -> Response {
+    if method != Method::POST {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(redis) = routes.redis.clone().map(RedisInspectorStore::new) else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    match redis.flushdb().await {
+        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
+        Err(error) => {
+            tracing::warn!(%error, "failed to flush admin redis db");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
diff --git a/crates/openplotva-app/src/http/routing.rs b/crates/openplotva-app/src/http/routing.rs
new file mode 100644
index 00000000..0459a8fd
--- /dev/null
+++ b/crates/openplotva-app/src/http/routing.rs
@@ -0,0 +1,1183 @@
+//! Provider configuration, routing controls, and routing journal.
+use super::{
+    HttpRouterState,
+    auth::{admin_auth_failure_response, require_admin_request},
+    common::{
+        admin_app_setting, admin_error_response, admin_json_no_cache_response, admin_json_response,
+        admin_upsert_app_setting, query_values as admin_auth_query_values,
+    },
+};
+use crate::{dialog_workers, model_routing, openrouter_free_pool, runtime_routing};
+use axum::{
+    body::Bytes,
+    extract::{RawQuery, State},
+    http::{HeaderMap, Method, StatusCode},
+    response::Response,
+};
+use serde_json::json;
+use sqlx::PgPool;
+use std::{sync::Arc, time::Duration};
+#[derive(Clone)]
+pub(crate) struct RoutingHttpState {
+    admin_ids: Arc<[i64]>,
+    bot_token: Arc<str>,
+    dialog_worker_gauge: Option<Arc<dialog_workers::WorkerGauge>>,
+    openrouter_free_gate: Option<Arc<openrouter_free_pool::OpenRouterFreeQuotaGate>>,
+    postgres: Option<PgPool>,
+    router_breakers: Option<Arc<openplotva_llm::router::BreakerSet>>,
+    router_handle: Option<Arc<openplotva_llm::router::RouterHandle>>,
+    router_pools: Option<Arc<openplotva_llm::router::PoolRegistry>>,
+    router_runtime: Option<Arc<model_routing::RouterRuntime>>,
+    router_triggers: Option<Arc<openplotva_llm::router::TriggerState>>,
+    routing_event_buffer: Option<runtime_routing::RoutingEventBuffer>,
+    routing_event_reporter: Option<runtime_routing::RoutingEventReporter>,
+}
+impl axum::extract::FromRef<Arc<HttpRouterState>> for RoutingHttpState {
+    fn from_ref(routes: &Arc<HttpRouterState>) -> Self {
+        Self {
+            admin_ids: routes.admin_ids.clone(),
+            bot_token: routes.bot_token.clone(),
+            dialog_worker_gauge: routes.dialog_worker_gauge.clone(),
+            openrouter_free_gate: routes.openrouter_free_gate.clone(),
+            postgres: routes.postgres.clone(),
+            router_breakers: routes.router_breakers.clone(),
+            router_handle: routes.router_handle.clone(),
+            router_pools: routes.router_pools.clone(),
+            router_runtime: routes.router_runtime.clone(),
+            router_triggers: routes.router_triggers.clone(),
+            routing_event_buffer: routes.routing_event_buffer.clone(),
+            routing_event_reporter: routes.routing_event_reporter.clone(),
+        }
+    }
+}
+pub(crate) fn routing_master_secret() -> String {
+    std::env::var("MASTER_KEY").unwrap_or_default()
+}
+
+pub(crate) fn routing_json_str(value: &serde_json::Value, key: &str) -> Option<String> {
+    value
+        .get(key)
+        .and_then(serde_json::Value::as_str)
+        .map(str::to_owned)
+}
+
+pub(crate) fn routing_json_i32(value: &serde_json::Value, key: &str) -> Option<i32> {
+    value
+        .get(key)
+        .and_then(serde_json::Value::as_i64)
+        .map(|n| n as i32)
+}
+
+pub(crate) fn routing_json_bool(value: &serde_json::Value, key: &str, default: bool) -> bool {
+    value
+        .get(key)
+        .and_then(serde_json::Value::as_bool)
+        .unwrap_or(default)
+}
+
+pub(crate) fn routing_json_required_bool(
+    value: &serde_json::Value,
+    key: &str,
+) -> Result<bool, String> {
+    value
+        .get(key)
+        .and_then(serde_json::Value::as_bool)
+        .ok_or_else(|| format!("{key} is required"))
+}
+
+pub(crate) fn routing_json_config_patch(
+    value: &serde_json::Value,
+) -> Result<serde_json::Value, String> {
+    let patch = value
+        .get("config")
+        .or_else(|| value.get("patch"))
+        .cloned()
+        .ok_or_else(|| "config patch is required".to_owned())?;
+    if !patch.is_object() {
+        return Err("config patch must be a JSON object".to_owned());
+    }
+    Ok(patch)
+}
+
+pub(crate) fn routing_capabilities(value: &serde_json::Value) -> Vec<String> {
+    value
+        .get("capabilities")
+        .and_then(serde_json::Value::as_array)
+        .map(|items| {
+            items
+                .iter()
+                .filter_map(serde_json::Value::as_str)
+                .map(str::to_owned)
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+pub(crate) fn provider_key_state(
+    provider: &openplotva_storage::llm_routing::ProviderRecord,
+) -> &'static str {
+    if provider.api_key_encrypted.is_some() {
+        "encrypted"
+    } else if provider.api_key_ref.is_some() {
+        "ref"
+    } else {
+        "unset"
+    }
+}
+
+/// Build a provider input from admin JSON, sealing a plaintext `api_key` under the
+/// master key. The plaintext is never persisted or echoed; only the ciphertext is
+/// stored, and `api_key_ref`/`api_key_encrypted` are mutually exclusive.
+pub(crate) fn provider_input_from_json(
+    value: &serde_json::Value,
+) -> Result<openplotva_storage::llm_routing::ProviderInput, String> {
+    let protocol = routing_json_str(value, "protocol");
+    if let Some(protocol) = protocol.as_deref() {
+        let Some(parsed) = openplotva_llm::provider_schema::Protocol::from_db(protocol) else {
+            return Err(format!("unknown protocol {protocol}"));
+        };
+        let config = value.get("config").cloned().unwrap_or_else(|| json!({}));
+        openplotva_llm::provider_schema::validate_provider_config(parsed, &config)
+            .map_err(|error| error.to_string())?;
+    }
+    let runtime_hint = routing_json_str(value, "runtime_hint");
+    if let Some(hint) = runtime_hint.as_deref()
+        && openplotva_llm::provider_schema::RuntimeHint::from_db(hint).is_none()
+    {
+        return Err(format!("unknown runtime_hint {hint}"));
+    }
+    let mut input = openplotva_storage::llm_routing::ProviderInput {
+        name: routing_json_str(value, "name").ok_or("name is required")?,
+        kind: routing_json_str(value, "kind").unwrap_or_else(|| "chat".to_owned()),
+        protocol,
+        runtime_hint,
+        endpoint: routing_json_str(value, "endpoint"),
+        discovery_service_name: routing_json_str(value, "discovery_service_name"),
+        discovery_endpoint_name: routing_json_str(value, "discovery_endpoint_name"),
+        api_key_ref: routing_json_str(value, "api_key_ref"),
+        api_key_encrypted: None,
+        enabled: routing_json_bool(value, "enabled", true),
+        config: value.get("config").cloned().unwrap_or_else(|| json!({})),
+    };
+    if let Some(plaintext) = routing_json_str(value, "api_key")
+        && !plaintext.trim().is_empty()
+    {
+        let sealed =
+            openplotva_storage::llm_routing::seal_key(&routing_master_secret(), &plaintext)
+                .map_err(|error| error.to_string())?;
+        input.api_key_encrypted = Some(sealed);
+        input.api_key_ref = None;
+    }
+    Ok(input)
+}
+
+pub(crate) fn model_input_from_json(
+    value: &serde_json::Value,
+) -> Result<openplotva_storage::llm_routing::ModelInput, String> {
+    if let Some(config) = value.get("config") {
+        openplotva_llm::provider_schema::validate_model_config(config)
+            .map_err(|error| error.to_string())?;
+    }
+    Ok(openplotva_storage::llm_routing::ModelInput {
+        provider_id: value
+            .get("provider_id")
+            .and_then(serde_json::Value::as_i64)
+            .ok_or("provider_id is required")?,
+        model_name: routing_json_str(value, "model_name").ok_or("model_name is required")?,
+        display_name: routing_json_str(value, "display_name"),
+        base_url: routing_json_str(value, "base_url"),
+        capabilities: routing_capabilities(value),
+        embedding_dim: routing_json_i32(value, "embedding_dim"),
+        pool_id: value.get("pool_id").and_then(serde_json::Value::as_i64),
+        enabled: routing_json_bool(value, "enabled", true),
+        config: value.get("config").cloned().unwrap_or_else(|| json!({})),
+    })
+}
+
+pub(crate) fn pool_input_from_json(
+    value: &serde_json::Value,
+) -> Result<openplotva_storage::llm_routing::PoolInput, String> {
+    let config = value.get("config").cloned().unwrap_or_else(|| json!({}));
+    if !config.is_object() {
+        return Err("config must be a JSON object".to_owned());
+    }
+    Ok(openplotva_storage::llm_routing::PoolInput {
+        name: routing_json_str(value, "name").ok_or("name is required")?,
+        max_concurrency: routing_json_i32(value, "max_concurrency"),
+        description: routing_json_str(value, "description"),
+        config,
+    })
+}
+
+pub(crate) fn assignment_input_from_json(
+    value: &serde_json::Value,
+) -> Result<openplotva_storage::llm_routing::AssignmentInput, String> {
+    Ok(openplotva_storage::llm_routing::AssignmentInput {
+        workflow_key: routing_json_str(value, "workflow_key").ok_or("workflow_key is required")?,
+        scope: routing_json_str(value, "scope").unwrap_or_else(|| "global".to_owned()),
+        role: routing_json_str(value, "role").unwrap_or_else(|| "primary".to_owned()),
+        provider_model_id: value
+            .get("provider_model_id")
+            .and_then(serde_json::Value::as_i64)
+            .ok_or("provider_model_id is required")?,
+        weight: routing_json_i32(value, "weight"),
+        fallback_order: routing_json_i32(value, "fallback_order"),
+        canary_percent: routing_json_i32(value, "canary_percent"),
+        enabled: routing_json_bool(value, "enabled", true),
+        inference_overrides: value
+            .get("inference_overrides")
+            .cloned()
+            .unwrap_or_else(|| json!({})),
+        cb_failure_threshold: routing_json_i32(value, "cb_failure_threshold").unwrap_or(5),
+        cb_cooldown_ms: routing_json_i32(value, "cb_cooldown_ms").unwrap_or(30_000),
+    })
+}
+
+pub(crate) fn trigger_input_from_json(
+    value: &serde_json::Value,
+) -> Result<openplotva_storage::llm_routing::TriggerInput, String> {
+    let mut input = trigger_input_from_json_without_engage(value)?;
+    input.engage_assignment_id = value
+        .get("engage_assignment_id")
+        .and_then(serde_json::Value::as_i64)
+        .ok_or("engage_assignment_id is required")?;
+    Ok(input)
+}
+
+/// Trigger fields without the engage target, for the atomic
+/// assignment-plus-trigger create where the target id does not exist yet.
+pub(crate) fn trigger_input_from_json_without_engage(
+    value: &serde_json::Value,
+) -> Result<openplotva_storage::llm_routing::TriggerInput, String> {
+    Ok(openplotva_storage::llm_routing::TriggerInput {
+        workflow_key: routing_json_str(value, "workflow_key").ok_or("workflow_key is required")?,
+        trigger_type: routing_json_str(value, "trigger_type").ok_or("trigger_type is required")?,
+        engage_assignment_id: 0,
+        enabled: routing_json_bool(value, "enabled", true),
+        queue_name: routing_json_str(value, "queue_name"),
+        high_watermark: routing_json_i32(value, "high_watermark"),
+        low_watermark: routing_json_i32(value, "low_watermark"),
+        params: value.get("params").cloned().unwrap_or_else(|| json!({})),
+    })
+}
+
+/// Server-side model-list fetch for the admin "Fetch models" flow: calls the
+/// provider's listing endpoint and returns a diff against its imported models
+/// (`new` / `existing` / `gone`). Read-only: import is a separate action.
+pub(crate) async fn admin_fetch_provider_models(
+    pool: &PgPool,
+    provider_id: i64,
+    body: &serde_json::Value,
+) -> Result<serde_json::Value, (StatusCode, String)> {
+    let bad = |error: String| (StatusCode::BAD_REQUEST, error);
+    let provider = openplotva_storage::llm_routing::get_provider(pool, provider_id)
+        .await
+        .map_err(|error| (StatusCode::INTERNAL_SERVER_ERROR, error.to_string()))?
+        .ok_or_else(|| bad(format!("unknown provider {provider_id}")))?;
+    let protocol = provider
+        .protocol
+        .as_deref()
+        .and_then(openplotva_llm::provider_schema::Protocol::from_db)
+        .ok_or_else(|| bad("provider has no protocol; set one first".to_owned()))?;
+    if !protocol.supports_model_listing() {
+        return Err(bad(format!(
+            "protocol {} has no model listing endpoint; add models manually",
+            protocol.as_str()
+        )));
+    }
+    let base_url = routing_json_str(body, "base_url")
+        .or_else(|| provider.endpoint.clone())
+        .filter(|url| !url.trim().is_empty())
+        .ok_or_else(|| bad("provider has no endpoint to list models from".to_owned()))?;
+    let api_key = provider
+        .api_key_ref
+        .as_deref()
+        .filter(|reference| !reference.trim().is_empty())
+        .and_then(|reference| std::env::var(reference.trim()).ok())
+        .or_else(|| {
+            provider.api_key_encrypted.as_deref().and_then(|sealed| {
+                openplotva_storage::llm_routing::open_key(&routing_master_secret(), sealed).ok()
+            })
+        });
+    let remote = openplotva_llm::model_listing::list_openai_compat_models(
+        &base_url,
+        api_key.as_deref(),
+        Duration::from_secs(10),
+    )
+    .await
+    .map_err(|error| (StatusCode::BAD_GATEWAY, error.to_string()))?;
+
+    let imported: Vec<(i64, String)> = openplotva_storage::llm_routing::list_models(pool)
+        .await
+        .map_err(|error| (StatusCode::INTERNAL_SERVER_ERROR, error.to_string()))?
+        .into_iter()
+        .filter(|model| model.provider_id == provider_id)
+        .map(|model| (model.id, model.model_name))
+        .collect();
+    let imported_names: std::collections::HashSet<&str> =
+        imported.iter().map(|(_, name)| name.as_str()).collect();
+    let remote_names: std::collections::HashSet<&str> =
+        remote.iter().map(|model| model.name.as_str()).collect();
+
+    let new: Vec<&str> = remote
+        .iter()
+        .map(|model| model.name.as_str())
+        .filter(|name| !imported_names.contains(name))
+        .collect();
+    let existing: Vec<serde_json::Value> = imported
+        .iter()
+        .filter(|(_, name)| remote_names.contains(name.as_str()))
+        .map(|(id, name)| json!({ "id": id, "model_name": name }))
+        .collect();
+    let gone: Vec<serde_json::Value> = imported
+        .iter()
+        .filter(|(_, name)| !remote_names.contains(name.as_str()))
+        .map(|(id, name)| json!({ "id": id, "model_name": name }))
+        .collect();
+    Ok(json!({
+        "ok": true,
+        "provider_id": provider_id,
+        "base_url": base_url,
+        "models": remote
+            .iter()
+            .map(|model| json!({ "model_name": model.name, "meta": model.raw }))
+            .collect::<Vec<_>>(),
+        "diff": { "new": new, "existing": existing, "gone": gone },
+    }))
+}
+
+pub(crate) async fn admin_routing_snapshot_json(
+    pool: &PgPool,
+) -> Result<serde_json::Value, String> {
+    let snapshot = openplotva_storage::llm_routing::load_snapshot(pool)
+        .await
+        .map_err(|error| error.to_string())?;
+    let providers: Vec<serde_json::Value> = snapshot
+        .providers
+        .iter()
+        .map(|provider| {
+            json!({
+                "id": provider.id,
+                "name": provider.name,
+                "kind": provider.kind,
+                "protocol": provider.protocol,
+                "runtime_hint": provider.runtime_hint,
+                "endpoint": provider.endpoint,
+                "discovery_service_name": provider.discovery_service_name,
+                "discovery_endpoint_name": provider.discovery_endpoint_name,
+                "key_state": provider_key_state(provider),
+                "api_key_ref": provider.api_key_ref,
+                "enabled": provider.enabled,
+                "config": provider.config,
+            })
+        })
+        .collect();
+    let models: Vec<serde_json::Value> = snapshot
+        .models
+        .iter()
+        .map(|model| {
+            json!({
+                "id": model.id,
+                "provider_id": model.provider_id,
+                "model_name": model.model_name,
+                "display_name": model.display_name,
+                "base_url": model.base_url,
+                "capabilities": model.capabilities,
+                "embedding_dim": model.embedding_dim,
+                "pool_id": model.pool_id,
+                "enabled": model.enabled,
+                "config": model.config,
+            })
+        })
+        .collect();
+    let workflows: Vec<serde_json::Value> = snapshot
+        .workflows
+        .iter()
+        .map(|workflow| {
+            json!({
+                "key": workflow.key,
+                "kind": workflow.kind,
+                "full_routing": workflow.full_routing,
+                "retry_max_hops": workflow.retry_max_hops,
+                "retry_wall_ms": workflow.retry_wall_ms,
+                "enabled": workflow.enabled,
+            })
+        })
+        .collect();
+    let assignments: Vec<serde_json::Value> = snapshot
+        .assignments
+        .iter()
+        .map(|assignment| {
+            json!({
+                "id": assignment.id,
+                "workflow_key": assignment.workflow_key,
+                "scope": assignment.scope,
+                "role": assignment.role,
+                "provider_model_id": assignment.provider_model_id,
+                "weight": assignment.weight,
+                "fallback_order": assignment.fallback_order,
+                "canary_percent": assignment.canary_percent,
+                "enabled": assignment.enabled,
+                "inference_overrides": assignment.inference_overrides,
+                "cb_failure_threshold": assignment.cb_failure_threshold,
+                "cb_cooldown_ms": assignment.cb_cooldown_ms,
+            })
+        })
+        .collect();
+    let triggers: Vec<serde_json::Value> = snapshot
+        .triggers
+        .iter()
+        .map(|trigger| {
+            json!({
+                "id": trigger.id,
+                "workflow_key": trigger.workflow_key,
+                "trigger_type": trigger.trigger_type,
+                "engage_assignment_id": trigger.engage_assignment_id,
+                "enabled": trigger.enabled,
+                "queue_name": trigger.queue_name,
+                "high_watermark": trigger.high_watermark,
+                "low_watermark": trigger.low_watermark,
+                "params": trigger.params,
+            })
+        })
+        .collect();
+    let pools: Vec<serde_json::Value> = snapshot
+        .pools
+        .iter()
+        .map(|pool| {
+            json!({
+                "id": pool.id,
+                "name": pool.name,
+                "max_concurrency": pool.max_concurrency,
+                "description": pool.description,
+                "config": pool.config,
+            })
+        })
+        .collect();
+    Ok(json!({
+        "providers": providers,
+        "models": models,
+        "workflows": workflows,
+        "assignments": assignments,
+        "triggers": triggers,
+        "pools": pools,
+        "param_descriptors": routing_param_descriptors(),
+    }))
+}
+
+/// Static parameter-form descriptors for every (protocol, runtime hint) pair,
+/// so the admin UI renders typed provider/model forms without hardcoding them.
+pub(crate) fn routing_param_descriptors() -> serde_json::Value {
+    use openplotva_llm::provider_schema::{Protocol, RuntimeHint, param_descriptor};
+    let mut descriptors = Vec::new();
+    for protocol in Protocol::all() {
+        descriptors.push(param_descriptor(*protocol, None));
+        if *protocol == Protocol::OpenAiCompat {
+            for hint in RuntimeHint::all() {
+                descriptors.push(param_descriptor(*protocol, Some(*hint)));
+            }
+        }
+    }
+    serde_json::Value::Array(descriptors)
+}
+
+pub(crate) async fn admin_routing_apply_action(
+    pool: &PgPool,
+    routes: &RoutingHttpState,
+    body: &serde_json::Value,
+) -> Result<serde_json::Value, (StatusCode, String)> {
+    let action = body
+        .get("action")
+        .and_then(serde_json::Value::as_str)
+        .ok_or((StatusCode::BAD_REQUEST, "action is required".to_owned()))?;
+    let bad = |error: String| (StatusCode::BAD_REQUEST, error);
+    let storage_err = |error: openplotva_storage::StorageError| {
+        (StatusCode::INTERNAL_SERVER_ERROR, error.to_string())
+    };
+    let id_of = |body: &serde_json::Value| body.get("id").and_then(serde_json::Value::as_i64);
+
+    use openplotva_storage::llm_routing as routing;
+    let result = match action {
+        "create_provider" => {
+            let input = provider_input_from_json(body).map_err(bad)?;
+            let id = routing::insert_provider(pool, &input)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true, "id": id })
+        }
+        "update_provider" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            let input = provider_input_from_json(body).map_err(bad)?;
+            routing::update_provider(pool, id, &input)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "set_provider_enabled" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            let enabled = routing_json_required_bool(body, "enabled").map_err(bad)?;
+            routing::set_provider_enabled(pool, id, enabled)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "patch_provider_config" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            let patch = routing_json_config_patch(body).map_err(bad)?;
+            routing::patch_provider_config(pool, id, &patch)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "delete_provider" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            routing::delete_provider(pool, id)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "create_model" => {
+            let input = model_input_from_json(body).map_err(bad)?;
+            let id = routing::insert_model(pool, &input)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true, "id": id })
+        }
+        "update_model" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            let input = model_input_from_json(body).map_err(bad)?;
+            routing::update_model(pool, id, &input)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "set_model_enabled" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            let enabled = routing_json_required_bool(body, "enabled").map_err(bad)?;
+            routing::set_model_enabled(pool, id, enabled)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "patch_model_config" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            let patch = routing_json_config_patch(body).map_err(bad)?;
+            routing::patch_model_config(pool, id, &patch)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "delete_model" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            routing::delete_model(pool, id).await.map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "create_assignment" => {
+            let input = assignment_input_from_json(body).map_err(bad)?;
+            let id = routing::insert_assignment(pool, &input)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true, "id": id })
+        }
+        "update_assignment" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            let input = assignment_input_from_json(body).map_err(bad)?;
+            routing::update_assignment(pool, id, &input)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "delete_assignment" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            routing::delete_assignment(pool, id)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "delete_assignments_for_scope" => {
+            let workflow = routing_json_str(body, "workflow_key")
+                .ok_or(bad("workflow_key is required".to_owned()))?;
+            let scope = routing_json_str(body, "scope").unwrap_or_else(|| "global".to_owned());
+            routing::delete_assignments_for_scope(pool, &workflow, &scope)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "create_trigger" => {
+            let input = trigger_input_from_json(body).map_err(bad)?;
+            let id = routing::insert_trigger(pool, &input)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true, "id": id })
+        }
+        "update_trigger" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            let input = trigger_input_from_json(body).map_err(bad)?;
+            routing::update_trigger(pool, id, &input)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "delete_trigger" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            routing::delete_trigger(pool, id)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "update_workflow" => {
+            let key = routing_json_str(body, "key").ok_or(bad("key is required".to_owned()))?;
+            routing::update_workflow(
+                pool,
+                &key,
+                routing_json_bool(body, "full_routing", true),
+                routing_json_i32(body, "retry_max_hops").unwrap_or(3),
+                routing_json_i32(body, "retry_wall_ms").unwrap_or(60_000),
+                routing_json_bool(body, "enabled", true),
+            )
+            .await
+            .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "set_workflow_enabled" => {
+            let key = routing_json_str(body, "key").ok_or(bad("key is required".to_owned()))?;
+            let enabled = routing_json_required_bool(body, "enabled").map_err(bad)?;
+            routing::set_workflow_enabled(pool, &key, enabled)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "create_pool" => {
+            let input = pool_input_from_json(body).map_err(bad)?;
+            if input.max_concurrency.is_some_and(|max| max < 1) {
+                return Err(bad("max_concurrency must be positive or null".to_owned()));
+            }
+            let id = routing::insert_pool(pool, &input)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true, "id": id })
+        }
+        "update_pool" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            let input = pool_input_from_json(body).map_err(bad)?;
+            if input.max_concurrency.is_some_and(|max| max < 1) {
+                return Err(bad("max_concurrency must be positive or null".to_owned()));
+            }
+            routing::update_pool(pool, id, &input)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "delete_pool" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            // FK is ON DELETE SET NULL: attached models degrade to unpooled.
+            routing::delete_pool(pool, id).await.map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "set_model_pool" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            let pool_id = body.get("pool_id").and_then(serde_json::Value::as_i64);
+            routing::set_model_pool(pool, id, pool_id)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true })
+        }
+        "set_primary_weights" => {
+            let weights = body
+                .get("weights")
+                .and_then(serde_json::Value::as_array)
+                .ok_or(bad("weights array is required".to_owned()))?
+                .iter()
+                .map(|entry| {
+                    let id = entry
+                        .get("id")
+                        .and_then(serde_json::Value::as_i64)
+                        .ok_or_else(|| "each weight entry needs an id".to_owned())?;
+                    let weight = routing_json_i32(entry, "weight");
+                    if weight.is_some_and(|weight| !(0..=100).contains(&weight)) {
+                        return Err(format!("weight for assignment {id} must be 0..=100"));
+                    }
+                    Ok((id, weight))
+                })
+                .collect::<Result<Vec<_>, String>>()
+                .map_err(bad)?;
+            routing::set_assignment_weights(pool, &weights)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true, "updated": weights.len() })
+        }
+        "set_fallback_order" => {
+            let ordered_ids = body
+                .get("ordered_ids")
+                .and_then(serde_json::Value::as_array)
+                .ok_or(bad("ordered_ids array is required".to_owned()))?
+                .iter()
+                .map(|entry| {
+                    entry
+                        .as_i64()
+                        .ok_or_else(|| "ordered_ids must be assignment ids".to_owned())
+                })
+                .collect::<Result<Vec<_>, String>>()
+                .map_err(bad)?;
+            routing::set_assignment_fallback_orders(pool, &ordered_ids)
+                .await
+                .map_err(storage_err)?;
+            json!({ "ok": true, "updated": ordered_ids.len() })
+        }
+        "create_trigger_with_assignment" => {
+            let mut assignment = assignment_input_from_json(body).map_err(bad)?;
+            assignment.role = "overflow".to_owned();
+            if assignment.weight.is_none() {
+                assignment.weight = Some(100);
+            }
+            let mut trigger = trigger_input_from_json_without_engage(body).map_err(bad)?;
+            trigger.workflow_key = assignment.workflow_key.clone();
+            let (assignment_id, trigger_id) =
+                routing::insert_trigger_with_assignment(pool, &assignment, &trigger)
+                    .await
+                    .map_err(storage_err)?;
+            json!({ "ok": true, "assignment_id": assignment_id, "trigger_id": trigger_id })
+        }
+        "fetch_provider_models" => {
+            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
+            return admin_fetch_provider_models(pool, id, body).await;
+        }
+        "import_models" => {
+            let provider_id = body
+                .get("provider_id")
+                .and_then(serde_json::Value::as_i64)
+                .ok_or(bad("provider_id is required".to_owned()))?;
+            let names: Vec<String> = body
+                .get("names")
+                .and_then(serde_json::Value::as_array)
+                .ok_or(bad("names array is required".to_owned()))?
+                .iter()
+                .filter_map(|name| name.as_str())
+                .map(str::to_owned)
+                .collect();
+            if names.is_empty() {
+                return Err(bad("names must contain at least one model name".to_owned()));
+            }
+            let defaults = body.get("defaults").cloned().unwrap_or_else(|| json!({}));
+            let capabilities = routing_capabilities(&defaults);
+            let capabilities = if capabilities.is_empty() {
+                vec!["chat".to_owned()]
+            } else {
+                capabilities
+            };
+            let pool_id = defaults.get("pool_id").and_then(serde_json::Value::as_i64);
+            let existing: std::collections::HashSet<String> = routing::list_models(pool)
+                .await
+                .map_err(storage_err)?
+                .into_iter()
+                .filter(|model| model.provider_id == provider_id)
+                .map(|model| model.model_name)
+                .collect();
+            let mut created = Vec::new();
+            for name in names {
+                if existing.contains(&name) {
+                    continue;
+                }
+                let id = routing::insert_model(
+                    pool,
+                    &openplotva_storage::llm_routing::ModelInput {
+                        provider_id,
+                        model_name: name,
+                        display_name: None,
+                        base_url: None,
+                        capabilities: capabilities.clone(),
+                        embedding_dim: None,
+                        pool_id,
+                        enabled: true,
+                        config: json!({}),
+                    },
+                )
+                .await
+                .map_err(storage_err)?;
+                created.push(id);
+            }
+            json!({ "ok": true, "created_ids": created })
+        }
+        "refresh_openrouter_free_pool" => {
+            if let Some(reporter) = routes.routing_event_reporter.as_ref() {
+                reporter.record(runtime_routing::RoutingEvent {
+                    severity: "info".to_owned(),
+                    event_type: "openrouter_free_refresh_started".to_owned(),
+                    workflow_key: "routing".to_owned(),
+                    provider_id: None,
+                    model_id: None,
+                    queue_name: None,
+                    job_id: None,
+                    chat_id: None,
+                    user_id: None,
+                    thread_id: None,
+                    message_id: None,
+                    dedupe_key: "openrouter_free_refresh_started:manual".to_owned(),
+                    summary: "OpenRouter Free refresh started".to_owned(),
+                    detail: json!({ "source": "admin" }),
+                });
+            }
+            let http = reqwest::Client::new();
+            match openrouter_free_pool::refresh_openrouter_free_pool(pool, &http).await {
+                Ok(report) => {
+                    if let Some(reporter) = routes.routing_event_reporter.as_ref() {
+                        reporter.record(runtime_routing::RoutingEvent {
+                            severity: "info".to_owned(),
+                            event_type: "openrouter_free_refresh_succeeded".to_owned(),
+                            workflow_key: "routing".to_owned(),
+                            provider_id: None,
+                            model_id: None,
+                            queue_name: None,
+                            job_id: None,
+                            chat_id: None,
+                            user_id: None,
+                            thread_id: None,
+                            message_id: None,
+                            dedupe_key: "openrouter_free_refresh_succeeded:manual".to_owned(),
+                            summary: "OpenRouter Free refresh succeeded".to_owned(),
+                            detail: json!({
+                                "active_models": report.active_models,
+                                "disabled_models": report.disabled_models,
+                                "assignments": report.assignments,
+                                "ranking_version": report.ranking_version,
+                                "source_updated_at": report.source_updated_at,
+                                "key_status_error": report.key_status_error.clone(),
+                            }),
+                        });
+                        if let Some(error) = report.key_status_error.as_deref() {
+                            runtime_routing::record_openrouter_free_key_status_failed(
+                                reporter, "manual", error,
+                            );
+                        }
+                    }
+                    json!({
+                        "ok": true,
+                        "refreshed": report.refreshed,
+                        "active_models": report.active_models,
+                        "disabled_models": report.disabled_models,
+                        "assignments": report.assignments,
+                        "ranking_version": report.ranking_version,
+                        "source_updated_at": report.source_updated_at,
+                        "key_status_error": report.key_status_error,
+                        "message": report.message,
+                    })
+                }
+                Err(error) => {
+                    if let Some(reporter) = routes.routing_event_reporter.as_ref() {
+                        reporter.record(runtime_routing::RoutingEvent {
+                            severity: "warn".to_owned(),
+                            event_type: "openrouter_free_refresh_failed".to_owned(),
+                            workflow_key: "routing".to_owned(),
+                            provider_id: None,
+                            model_id: None,
+                            queue_name: None,
+                            job_id: None,
+                            chat_id: None,
+                            user_id: None,
+                            thread_id: None,
+                            message_id: None,
+                            dedupe_key: "openrouter_free_refresh_failed:manual".to_owned(),
+                            summary: "OpenRouter Free refresh failed".to_owned(),
+                            detail: json!({ "error": error.to_string(), "source": "admin" }),
+                        });
+                    }
+                    return Err((StatusCode::BAD_GATEWAY, error.to_string()));
+                }
+            }
+        }
+        "reload" => json!({ "ok": true }),
+        other => return Err(bad(format!("unknown action {other}"))),
+    };
+
+    // Every mutating action bumps the revision and atomically reloads the router so
+    // the change takes effect without a restart.
+    if action != "reload" {
+        let revision = admin_app_setting(routes.postgres.as_ref(), "llm.routing.revision")
+            .await
+            .and_then(|value| value.parse::<i64>().ok())
+            .unwrap_or(0);
+        let _ = admin_upsert_app_setting(
+            routes.postgres.as_ref(),
+            "llm.routing.revision",
+            &(revision + 1).to_string(),
+        )
+        .await;
+    }
+    let reload_result = if let Some(runtime) = routes.router_runtime.as_ref() {
+        model_routing::reload_router_runtime(runtime, pool).await
+    } else if let Some(handle) = routes.router_handle.as_ref() {
+        let reloaded = model_routing::reload_router(handle, pool).await;
+        if reloaded.is_ok()
+            && let Some(pools) = routes.router_pools.as_ref()
+        {
+            pools.apply(&handle.snapshot().pool_specs());
+        }
+        reloaded
+    } else {
+        Ok(())
+    };
+    if let Err(error) = reload_result {
+        if let Some(reporter) = routes.routing_event_reporter.as_ref() {
+            reporter.record(runtime_routing::router_reload_failed_event(
+                "admin_routing_reload",
+                &error.to_string(),
+            ));
+        }
+        tracing::warn!(%error, "failed to reload router after admin routing change");
+    }
+    Ok(result)
+}
+
+pub(crate) async fn admin_routing(
+    method: Method,
+    headers: HeaderMap,
+    State(routes): State<RoutingHttpState>,
+    body: Bytes,
+) -> Response {
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(pool) = routes.postgres.clone() else {
+        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "database unavailable");
+    };
+
+    if method == Method::GET {
+        return match admin_routing_snapshot_json(&pool).await {
+            Ok(value) => admin_json_response(StatusCode::OK, value),
+            Err(error) => admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, &error),
+        };
+    }
+    if method != Method::POST && method != Method::PUT {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    let Ok(parsed) = serde_json::from_slice::<serde_json::Value>(&body) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "invalid json");
+    };
+    match admin_routing_apply_action(&pool, &routes, &parsed).await {
+        Ok(value) => admin_json_response(StatusCode::OK, value),
+        Err((status, error)) => admin_error_response(status, &error),
+    }
+}
+
+/// Cheap, poll-safe live view for the routing cockpit: pool occupancy,
+/// breaker states, trigger engagement, capacity cooldowns, worker scale, and
+/// the in-process event ring. No database round-trip.
+pub(crate) async fn admin_routing_status(
+    method: Method,
+    headers: HeaderMap,
+    State(routes): State<RoutingHttpState>,
+) -> Response {
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let now = std::time::Instant::now();
+    let table = routes
+        .router_handle
+        .as_ref()
+        .map(|handle| handle.snapshot());
+    let pools: Vec<serde_json::Value> = routes
+        .router_pools
+        .as_ref()
+        .map(|pools| pools.occupancy())
+        .unwrap_or_default()
+        .into_iter()
+        .map(|occupancy| {
+            json!({
+                "id": occupancy.id,
+                "name": table.as_ref().and_then(|table| table.pool_name(occupancy.id)),
+                "max_concurrency": occupancy.max_concurrency,
+                "in_flight": occupancy.in_flight,
+                "queued": {
+                    "interactive": occupancy.queued[0],
+                    "user_tool": occupancy.queued[1],
+                    "background": occupancy.queued[2],
+                },
+                "mean_hold_ms": occupancy.mean_hold_ms,
+                "wait_p50_ms": occupancy.wait_p50_ms,
+                "wait_p95_ms": occupancy.wait_p95_ms,
+            })
+        })
+        .collect();
+    let breakers: Vec<serde_json::Value> = routes
+        .router_breakers
+        .as_ref()
+        .map(|breakers| breakers.states_at(now))
+        .unwrap_or_default()
+        .into_iter()
+        .map(|state| {
+            json!({
+                "provider_id": state.provider,
+                "model_id": state.model,
+                "consecutive_failures": state.consecutive_failures,
+                "open": state.open,
+                "cooldown_remaining_ms": state
+                    .cooldown_remaining
+                    .map(|left| u64::try_from(left.as_millis()).unwrap_or(u64::MAX)),
+            })
+        })
+        .collect();
+    let engaged_triggers = routes
+        .router_triggers
+        .as_ref()
+        .map(|triggers| triggers.engaged_ids())
+        .unwrap_or_default();
+    let capacity_cooldowns: Vec<serde_json::Value> = routes
+        .router_triggers
+        .as_ref()
+        .map(|triggers| triggers.capacity_snapshot_at(now))
+        .unwrap_or_default()
+        .into_iter()
+        .map(|(provider, model, left)| {
+            json!({
+                "provider_id": provider,
+                "model_id": model,
+                "remaining_ms": u64::try_from(left.as_millis()).unwrap_or(u64::MAX),
+            })
+        })
+        .collect();
+    let workers = routes
+        .dialog_worker_gauge
+        .as_ref()
+        .map(|gauge| {
+            json!({
+                "dialog": { "desired": gauge.desired(), "running": gauge.running() }
+            })
+        })
+        .unwrap_or_else(|| json!({}));
+    let recent_events: Vec<serde_json::Value> = routes
+        .routing_event_buffer
+        .as_ref()
+        .map(|buffer| buffer.routing_events(20))
+        .unwrap_or_default()
+        .into_iter()
+        .map(|event| routing_event_data_json(&event))
+        .collect();
+    let revision = admin_app_setting(routes.postgres.as_ref(), "llm.routing.revision")
+        .await
+        .and_then(|value| value.parse::<i64>().ok())
+        .unwrap_or(0);
+    let mut openrouter_free = admin_app_setting(
+        routes.postgres.as_ref(),
+        "llm.routing.openrouter_free.status",
+    )
+    .await
+    .and_then(|value| serde_json::from_str::<serde_json::Value>(&value).ok());
+    if let Some(gate) = routes.openrouter_free_gate.as_ref() {
+        let quota = gate.status_snapshot().await;
+        let value = openrouter_free.get_or_insert_with(|| json!({}));
+        if let Some(object) = value.as_object_mut() {
+            object.insert("quota".to_owned(), quota);
+        }
+    }
+    admin_json_no_cache_response(
+        StatusCode::OK,
+        json!({
+            "revision": revision,
+            "pools": pools,
+            "breakers": breakers,
+            "engaged_triggers": engaged_triggers,
+            "capacity_cooldowns": capacity_cooldowns,
+            "workers": workers,
+            "recent_events": recent_events,
+            "openrouter_free": openrouter_free,
+        }),
+    )
+}
+
+/// Keyset-paginated journal over `llm_routing_events` with optional
+/// `workflow` / `severity` filters and a `before_id` cursor.
+pub(crate) async fn admin_routing_events(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<RoutingHttpState>,
+) -> Response {
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(pool) = routes.postgres.clone() else {
+        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "database unavailable");
+    };
+    let values = admin_auth_query_values(raw_query.as_deref());
+    let limit = values
+        .get("limit")
+        .and_then(|value| value.parse::<i64>().ok())
+        .unwrap_or(50);
+    let before_id = values
+        .get("before_id")
+        .and_then(|value| value.parse::<i64>().ok());
+    let workflow = values
+        .get("workflow")
+        .map(|value| value.trim().to_owned())
+        .filter(|value| !value.is_empty());
+    let severity = values
+        .get("severity")
+        .map(|value| value.trim().to_owned())
+        .filter(|value| !value.is_empty());
+    match openplotva_storage::llm_routing::list_routing_events_page(
+        &pool,
+        limit,
+        before_id,
+        workflow.as_deref(),
+        severity.as_deref(),
+    )
+    .await
+    {
+        Ok(events) => {
+            let next_before_id = events.last().map(|event| event.id);
+            let events: Vec<serde_json::Value> = events
+                .iter()
+                .map(|event| {
+                    json!({
+                        "id": event.id,
+                        "created_at": event
+                            .created_at
+                            .format(&time::format_description::well_known::Rfc3339)
+                            .unwrap_or_default(),
+                        "severity": event.severity,
+                        "event_type": event.event_type,
+                        "workflow_key": event.workflow_key,
+                        "provider_id": event.provider_id,
+                        "model_id": event.model_id,
+                        "queue_name": event.queue_name,
+                        "job_id": event.job_id,
+                        "chat_id": event.chat_id,
+                        "summary": event.summary,
+                        "detail": event.detail,
+                    })
+                })
+                .collect();
+            admin_json_no_cache_response(
+                StatusCode::OK,
+                json!({ "events": events, "next_before_id": next_before_id }),
+            )
+        }
+        Err(error) => {
+            tracing::warn!(%error, "failed to list routing events");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) fn routing_event_data_json(
+    event: &runtime_routing::RoutingEventData,
+) -> serde_json::Value {
+    json!({
+        "id": event.id,
+        "at_millis": event.at_millis,
+        "severity": event.severity,
+        "event_type": event.event_type,
+        "workflow_key": event.workflow_key,
+        "provider_id": event.provider_id,
+        "model_id": event.model_id,
+        "queue_name": event.queue_name,
+        "summary": event.summary,
+        "detail": event.detail,
+    })
+}
diff --git a/crates/openplotva-app/src/http/settings.rs b/crates/openplotva-app/src/http/settings.rs
new file mode 100644
index 00000000..b0840bd9
--- /dev/null
+++ b/crates/openplotva-app/src/http/settings.rs
@@ -0,0 +1,2107 @@
+//! Settings WebApp HTTP contract and its required dependencies.
+
+use super::{
+    HttpRouterState,
+    assets::{moved_permanently, static_web_asset_response},
+    common::{parse_memory_limit, query_values},
+};
+use crate::{payments, settings};
+use axum::{
+    body::Bytes,
+    extract::{Path, RawQuery, State},
+    http::{HeaderMap, HeaderValue, Method, StatusCode, header},
+    response::{IntoResponse, Response},
+};
+use openplotva_storage::{
+    PostgresChatMemberStore, PostgresChatSettingsStore, PostgresMemoryStore, PostgresVipStore,
+    PostgresVirtualMessageStore,
+};
+use serde::{Deserialize, Serialize};
+use std::{
+    collections::{BTreeMap, HashMap, HashSet},
+    sync::Arc,
+};
+use time::OffsetDateTime;
+
+#[derive(Clone)]
+pub(crate) struct SettingsHttpState {
+    pub(crate) admin_ids: Arc<[i64]>,
+    pub(crate) bot_id: Option<i64>,
+    pub(crate) bot_token: Arc<str>,
+    pub(crate) member_store: Option<PostgresChatMemberStore>,
+    pub(crate) memory_store: Option<PostgresMemoryStore>,
+    pub(crate) settings_store: Option<PostgresChatSettingsStore>,
+    pub(crate) state_store: Option<PostgresVirtualMessageStore>,
+    pub(crate) telegram: Option<openplotva_telegram::TelegramClient>,
+    pub(crate) vip_status: Option<Arc<dyn payments::VipStatusChecker + Send + Sync>>,
+    pub(crate) vip_store: Option<PostgresVipStore>,
+}
+
+impl axum::extract::FromRef<Arc<HttpRouterState>> for SettingsHttpState {
+    fn from_ref(routes: &Arc<HttpRouterState>) -> Self {
+        Self {
+            admin_ids: routes.admin_ids.clone(),
+            bot_id: routes.bot_id,
+            bot_token: routes.bot_token.clone(),
+            member_store: routes.member_store.clone(),
+            memory_store: routes.memory_store.clone(),
+            settings_store: routes.settings_store.clone(),
+            state_store: routes.state_store.clone(),
+            telegram: routes.telegram.clone(),
+            vip_status: routes.vip_status.clone(),
+            vip_store: routes.vip_store.clone(),
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn test_state(routes: &HttpRouterState) -> SettingsHttpState {
+    use axum::extract::FromRef as _;
+    SettingsHttpState::from_ref(&Arc::new(routes.clone()))
+}
+
+pub(crate) async fn settings_redirect() -> Response {
+    moved_permanently("/settings/")
+}
+
+pub(crate) async fn settings_index() -> Response {
+    static_web_asset_response(openplotva_web::StaticAssetGroup::Settings, "")
+}
+
+pub(crate) async fn settings_asset(Path(path): Path<String>) -> Response {
+    static_web_asset_response(openplotva_web::StaticAssetGroup::Settings, &path)
+}
+
+pub(crate) async fn settings_api(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<SettingsHttpState>,
+    body: Bytes,
+) -> Response {
+    let init_data = settings_init_data_header(&headers);
+    match method {
+        Method::OPTIONS => settings_options_response(),
+        Method::GET => settings_get_response(&routes, raw_query.as_deref(), init_data).await,
+        Method::POST | Method::PUT => settings_update_response(&routes, &body, init_data).await,
+        _ => settings_error_response(StatusCode::METHOD_NOT_ALLOWED, "Method not allowed"),
+    }
+}
+
+pub(crate) async fn settings_deputies_api(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(_raw_query): RawQuery,
+    State(routes): State<SettingsHttpState>,
+    body: Bytes,
+) -> Response {
+    let init_data = settings_init_data_header(&headers);
+    match method {
+        Method::OPTIONS => settings_side_options_response("GET, PUT, OPTIONS"),
+        Method::PUT => settings_deputies_update_response(&routes, &body, init_data).await,
+        _ => settings_side_error_response(
+            StatusCode::METHOD_NOT_ALLOWED,
+            "Method not allowed",
+            "GET, PUT, OPTIONS",
+        ),
+    }
+}
+
+pub(crate) async fn settings_deputy_candidates_api(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<SettingsHttpState>,
+) -> Response {
+    let init_data = settings_init_data_header(&headers);
+    match method {
+        Method::OPTIONS => settings_side_options_response("GET, PUT, OPTIONS"),
+        Method::GET => {
+            settings_deputy_candidates_response(&routes, raw_query.as_deref(), init_data).await
+        }
+        _ => settings_side_error_response(
+            StatusCode::METHOD_NOT_ALLOWED,
+            "Method not allowed",
+            "GET, PUT, OPTIONS",
+        ),
+    }
+}
+
+pub(crate) async fn settings_memory_api(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<SettingsHttpState>,
+) -> Response {
+    let init_data = settings_init_data_header(&headers);
+    match method {
+        Method::OPTIONS => settings_side_options_response("GET, DELETE, OPTIONS"),
+        Method::GET => settings_memory_get_response(&routes, raw_query.as_deref(), init_data).await,
+        Method::DELETE => {
+            settings_memory_delete_response(&routes, raw_query.as_deref(), init_data).await
+        }
+        _ => settings_side_error_response(
+            StatusCode::METHOD_NOT_ALLOWED,
+            "method not allowed",
+            "GET, DELETE, OPTIONS",
+        ),
+    }
+}
+
+pub(crate) async fn settings_chats_api(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<SettingsHttpState>,
+) -> Response {
+    if method != Method::GET {
+        return (StatusCode::METHOD_NOT_ALLOWED, "Method not allowed\n").into_response();
+    }
+    let init_data = settings_init_data_header(&headers);
+    settings_chats_response(&routes, raw_query.as_deref(), init_data).await
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct SettingsUpdateRequest {
+    pub(crate) chat_id: i64,
+    #[serde(default)]
+    pub(crate) user_id: i64,
+    pub(crate) mood_alignment: Option<String>,
+    pub(crate) custom_persona: Option<String>,
+    pub(crate) reactivity_percentage: Option<i32>,
+    pub(crate) proactivity_percentage: Option<i32>,
+    pub(crate) enable_obscenifier: Option<bool>,
+    pub(crate) enable_profanity: Option<bool>,
+    pub(crate) enable_greet_joiners: Option<bool>,
+    pub(crate) enable_global_text_reply: Option<bool>,
+    pub(crate) enable_global_draw_reply: Option<bool>,
+    pub(crate) signature: String,
+    pub(crate) enable_daily_game: Option<bool>,
+    pub(crate) daily_game_theme: Option<String>,
+    pub(crate) greeting_html: Option<String>,
+    pub(crate) disable_random_reactivity: Option<bool>,
+    pub(crate) hide_original_draw_prompt: Option<bool>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+pub(crate) struct SettingsDeputySummary {
+    pub(crate) id: i64,
+    pub(crate) first_name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) last_name: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) username: Option<String>,
+    pub(crate) status: String,
+    pub(crate) display_name: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+pub(crate) struct SettingsResponseBody {
+    pub(crate) chat_id: i64,
+    #[serde(skip_serializing_if = "String::is_empty")]
+    pub(crate) chat_title: String,
+    #[serde(skip_serializing_if = "String::is_empty")]
+    pub(crate) chat_type: String,
+    pub(crate) mood_alignment: Option<String>,
+    pub(crate) custom_persona: Option<String>,
+    pub(crate) reactivity_percentage: i32,
+    pub(crate) proactivity_percentage: i32,
+    pub(crate) enable_obscenifier: bool,
+    pub(crate) enable_profanity: bool,
+    pub(crate) enable_greet_joiners: bool,
+    pub(crate) enable_global_text_reply: bool,
+    pub(crate) enable_global_draw_reply: bool,
+    pub(crate) enable_daily_game: bool,
+    pub(crate) daily_game_theme: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) greeting_html: Option<String>,
+    pub(crate) is_vip: bool,
+    pub(crate) disable_random_reactivity: bool,
+    pub(crate) hide_original_draw_prompt: bool,
+    pub(crate) is_deputy: bool,
+    pub(crate) can_manage_deputies: bool,
+    pub(crate) deputies: Vec<SettingsDeputySummary>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) struct SettingsAccess {
+    pub(crate) chat_id: i64,
+    pub(crate) user_id: i64,
+    pub(crate) is_global_admin: bool,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum SettingsAccessError {
+    InvalidChatId,
+    MissingSignature,
+    InvalidSignature,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct DeputyUpdateRequest {
+    pub(crate) chat_id: i64,
+    pub(crate) user_id: i64,
+    pub(crate) signature: String,
+    #[serde(default)]
+    pub(crate) deputy_ids: Vec<i64>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+pub(crate) struct DeputyCandidatesResponse {
+    pub(crate) items: Vec<SettingsDeputySummary>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+pub(crate) struct DeputyUpdateResponse {
+    pub(crate) ok: bool,
+    pub(crate) deputies: Vec<SettingsDeputySummary>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) struct DeputyOwnerAccess {
+    pub(crate) chat_id: i64,
+    pub(crate) user_id: i64,
+    pub(crate) is_global_admin: bool,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+pub(crate) struct ChatListItem {
+    pub(crate) id: i64,
+    pub(crate) title: String,
+    #[serde(rename = "type")]
+    pub(crate) chat_type: String,
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub(crate) struct SettingsMemoryResponse {
+    pub(crate) chat_id: i64,
+    pub(crate) user_id: i64,
+    pub(crate) count: usize,
+    pub(crate) cards: Vec<openplotva_memory::Card>,
+}
+
+pub(crate) async fn settings_get_response(
+    routes: &SettingsHttpState,
+    raw_query: Option<&str>,
+    init_data: Option<&str>,
+) -> Response {
+    let Some(settings_store) = &routes.settings_store else {
+        return settings_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "settings store not configured",
+        );
+    };
+    let Some(member_store) = &routes.member_store else {
+        return settings_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "settings store not configured",
+        );
+    };
+
+    let values = query_values(raw_query);
+    let claimed_user_id = values
+        .get("user_id")
+        .and_then(|value| value.parse::<i64>().ok())
+        .unwrap_or(0);
+    if authenticate_settings_init_data(routes, init_data, claimed_user_id).is_err() {
+        return settings_error_response(StatusCode::UNAUTHORIZED, "Unauthorized");
+    }
+    let access = match parse_settings_get_access(&values, &routes.admin_ids) {
+        Ok(access) => access,
+        Err(error) => return settings_access_error_response(error),
+    };
+
+    if let Err(error) = ensure_settings_chat_available(routes, access.chat_id, access.user_id).await
+    {
+        return error;
+    }
+    if let Err(error) = authorize_settings_user(routes, access).await {
+        return error;
+    }
+
+    let mut settings = match settings_store.get_chat_settings(access.chat_id).await {
+        Ok(Some(settings)) => settings,
+        Ok(None) | Err(_) => openplotva_core::ChatSettings::defaults(access.chat_id),
+    };
+    settings.custom_persona =
+        openplotva_web::truncate_custom_persona(settings.custom_persona.take());
+
+    let (chat_title, chat_type) =
+        settings_chat_display_for_read(routes, access.chat_id, access.user_id).await;
+    let mut response = new_settings_response(&settings, chat_title, chat_type.clone());
+    apply_private_chat_response_defaults(&mut response, access.chat_id, access.user_id);
+    apply_user_settings_response(routes, &mut response, access.user_id).await;
+    apply_deputy_settings_response(
+        member_store,
+        &mut response,
+        access.chat_id,
+        access.user_id,
+        &chat_type,
+        access.is_global_admin,
+    )
+    .await;
+    settings_json_response(StatusCode::OK, &response)
+}
+
+pub(crate) async fn settings_update_response(
+    routes: &SettingsHttpState,
+    body: &[u8],
+    init_data: Option<&str>,
+) -> Response {
+    let Some(settings_store) = &routes.settings_store else {
+        return settings_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "settings store not configured",
+        );
+    };
+    let req = match parse_settings_update_request(body) {
+        Ok(req) => req,
+        Err(response) => return *response,
+    };
+    if authenticate_settings_init_data(routes, init_data, req.user_id).is_err() {
+        return settings_error_response(StatusCode::UNAUTHORIZED, "Unauthorized");
+    }
+    if let Err(error) = ensure_settings_chat_available(routes, req.chat_id, req.user_id).await {
+        return error;
+    }
+    let chat = match settings_update_chat(routes, req.chat_id, req.user_id).await {
+        Ok(chat) => chat,
+        Err(response) => return response,
+    };
+    let access = SettingsAccess {
+        chat_id: req.chat_id,
+        user_id: req.user_id,
+        is_global_admin: routes.admin_ids.contains(&req.user_id),
+    };
+    if let Err(error) = authorize_settings_user(routes, access).await {
+        return error;
+    }
+
+    let update = settings_update_from_request(settings_store, &req, &chat).await;
+    if let Err(error) = settings_store.upsert_chat_settings(&update).await {
+        tracing::error!(%error, chat_id = req.chat_id, "failed to update chat settings");
+        return settings_error_response(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "Failed to update settings",
+        );
+    }
+    update_user_settings_from_request(routes, &req).await;
+    settings_json_response(StatusCode::OK, &serde_json::json!({ "status": "success" }))
+}
+
+pub(crate) async fn settings_chats_response(
+    routes: &SettingsHttpState,
+    raw_query: Option<&str>,
+    init_data: Option<&str>,
+) -> Response {
+    let values = query_values(raw_query);
+    let Some(user_id_raw) = values.get("user_id") else {
+        return settings_json_raw_response(
+            StatusCode::BAD_REQUEST,
+            r#"{"error":"missing user_id"}"#,
+        );
+    };
+    let Ok(user_id) = user_id_raw.parse::<i64>() else {
+        return settings_json_raw_response(
+            StatusCode::BAD_REQUEST,
+            r#"{"error":"invalid user_id"}"#,
+        );
+    };
+    if authenticate_settings_init_data(routes, init_data, user_id).is_err() {
+        return settings_json_raw_response(StatusCode::UNAUTHORIZED, r#"{"error":"unauthorized"}"#);
+    }
+    let Some(signature) = values.get("signature").filter(|value| !value.is_empty()) else {
+        return settings_json_raw_response(
+            StatusCode::BAD_REQUEST,
+            r#"{"error":"missing signature"}"#,
+        );
+    };
+    if !openplotva_web::validate_settings_access_signature(user_id, 0, signature) {
+        return settings_json_raw_response(
+            StatusCode::FORBIDDEN,
+            r#"{"error":"invalid signature"}"#,
+        );
+    }
+    let Some(settings_store) = &routes.settings_store else {
+        return settings_json_response(StatusCode::OK, &Vec::<ChatListItem>::new());
+    };
+    let Some(member_store) = &routes.member_store else {
+        return settings_json_response(StatusCode::OK, &Vec::<ChatListItem>::new());
+    };
+    let chats = managed_chat_list_items(routes, settings_store, member_store, user_id).await;
+    settings_json_response(StatusCode::OK, &chats)
+}
+
+pub(crate) async fn settings_deputy_candidates_response(
+    routes: &SettingsHttpState,
+    raw_query: Option<&str>,
+    init_data: Option<&str>,
+) -> Response {
+    let access = match parse_deputy_owner_access(routes, raw_query, init_data).await {
+        Ok(access) => access,
+        Err(response) => return response,
+    };
+    if !access.is_global_admin
+        && let Err(response) =
+            ensure_deputy_management_permission(routes, access.chat_id, access.user_id).await
+    {
+        return response;
+    }
+    let query_values = query_values(raw_query);
+    let query = query_values
+        .get("query")
+        .or_else(|| query_values.get("q"))
+        .map(|value| value.trim())
+        .unwrap_or("");
+    let limit = parse_deputy_candidates_limit(query_values.get("limit").map(String::as_str));
+    let Some(member_store) = &routes.member_store else {
+        return settings_side_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "settings store not configured",
+            "GET, PUT, OPTIONS",
+        );
+    };
+    let rows = match member_store
+        .search_chat_member_candidates(access.chat_id, query, limit as i32)
+        .await
+    {
+        Ok(rows) => rows,
+        Err(error) => {
+            tracing::warn!(%error, chat_id = access.chat_id, user_id = access.user_id, "failed to search deputy candidates");
+            return settings_side_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "Failed to search deputy candidates",
+                "GET, PUT, OPTIONS",
+            );
+        }
+    };
+    let items = rows
+        .into_iter()
+        .filter(|row| row.id != 0 && row.id != access.user_id)
+        .map(|row| SettingsDeputySummary {
+            id: row.id,
+            display_name: build_deputy_display_name(
+                row.id,
+                &row.first_name,
+                row.last_name.as_deref(),
+                row.username.as_deref(),
+            ),
+            first_name: row.first_name,
+            last_name: row.last_name,
+            username: row.username,
+            status: row.status,
+        })
+        .collect::<Vec<_>>();
+    settings_side_json_response(
+        StatusCode::OK,
+        &DeputyCandidatesResponse { items },
+        "GET, PUT, OPTIONS",
+    )
+}
+
+pub(crate) async fn settings_deputies_update_response(
+    routes: &SettingsHttpState,
+    body: &[u8],
+    init_data: Option<&str>,
+) -> Response {
+    let req = match parse_deputy_update_request(body) {
+        Ok(req) => req,
+        Err(response) => return *response,
+    };
+    if authenticate_settings_init_data(routes, init_data, req.user_id).is_err() {
+        return settings_side_error_response(
+            StatusCode::UNAUTHORIZED,
+            "Unauthorized",
+            "GET, PUT, OPTIONS",
+        );
+    }
+    if let Err(error) = ensure_settings_chat_available(routes, req.chat_id, req.user_id).await {
+        return error;
+    }
+    if !routes.admin_ids.contains(&req.user_id)
+        && let Err(response) =
+            ensure_deputy_management_permission(routes, req.chat_id, req.user_id).await
+    {
+        return response;
+    }
+    let deputy_ids = normalize_deputy_ids(&req.deputy_ids, req.user_id);
+    if let Err(message) = validate_deputy_ids(routes, req.chat_id, &deputy_ids).await {
+        return settings_side_json_raw_response(
+            StatusCode::BAD_REQUEST,
+            &serde_json::json!({ "error": message }).to_string(),
+            "GET, PUT, OPTIONS",
+        );
+    }
+    let Some(member_store) = &routes.member_store else {
+        return settings_side_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "settings store not configured",
+            "GET, PUT, OPTIONS",
+        );
+    };
+    if let Err(error) = member_store
+        .replace_chat_deputies(req.chat_id, &deputy_ids)
+        .await
+    {
+        tracing::warn!(%error, chat_id = req.chat_id, user_id = req.user_id, "failed to replace chat deputies");
+        return settings_side_error_response(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "Failed to update deputies",
+            "GET, PUT, OPTIONS",
+        );
+    }
+    let deputies = list_deputy_summaries(routes, req.chat_id)
+        .await
+        .unwrap_or_default();
+    settings_side_json_response(
+        StatusCode::OK,
+        &DeputyUpdateResponse { ok: true, deputies },
+        "GET, PUT, OPTIONS",
+    )
+}
+
+pub(crate) async fn settings_memory_get_response(
+    routes: &SettingsHttpState,
+    raw_query: Option<&str>,
+    init_data: Option<&str>,
+) -> Response {
+    let (chat_id, user_id, scope) =
+        match parse_settings_memory_access(routes, raw_query, init_data).await {
+            Ok(access) => access,
+            Err(response) => return response,
+        };
+    let limit = parse_memory_limit(query_values(raw_query).get("limit").map(String::as_str));
+    let cards = match &routes.memory_store {
+        Some(store) => match store.list_visible_cards(&scope, limit as i32).await {
+            Ok(cards) => cards,
+            Err(error) => {
+                tracing::error!(%error, chat_id, user_id, "failed to list settings memory");
+                return settings_side_error_response(
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    "failed to list memory",
+                    "GET, DELETE, OPTIONS",
+                );
+            }
+        },
+        None => Vec::new(),
+    };
+    settings_side_json_response(
+        StatusCode::OK,
+        &SettingsMemoryResponse {
+            chat_id,
+            user_id,
+            count: cards.len(),
+            cards,
+        },
+        "GET, DELETE, OPTIONS",
+    )
+}
+
+pub(crate) async fn settings_memory_delete_response(
+    routes: &SettingsHttpState,
+    raw_query: Option<&str>,
+    init_data: Option<&str>,
+) -> Response {
+    let (_, user_id, scope) = match parse_settings_memory_access(routes, raw_query, init_data).await
+    {
+        Ok(access) => access,
+        Err(response) => return response,
+    };
+    let id = query_values(raw_query)
+        .get("id")
+        .and_then(|value| value.parse::<i64>().ok())
+        .filter(|id| *id != 0);
+    let Some(id) = id else {
+        return settings_side_error_response(
+            StatusCode::BAD_REQUEST,
+            "id required",
+            "GET, DELETE, OPTIONS",
+        );
+    };
+    let deleted = match &routes.memory_store {
+        Some(store) => match store.soft_delete_visible_card(id, user_id, &scope).await {
+            Ok(deleted) => deleted,
+            Err(error) => {
+                tracing::error!(%error, id, user_id, "failed to soft-delete settings memory card");
+                return settings_side_error_response(
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    "failed to delete memory",
+                    "GET, DELETE, OPTIONS",
+                );
+            }
+        },
+        None => {
+            return settings_side_json_response(
+                StatusCode::OK,
+                &serde_json::json!({ "ok": true }),
+                "GET, DELETE, OPTIONS",
+            );
+        }
+    };
+    if !deleted {
+        return settings_side_error_response(
+            StatusCode::NOT_FOUND,
+            "memory card not found",
+            "GET, DELETE, OPTIONS",
+        );
+    }
+    settings_side_json_response(
+        StatusCode::OK,
+        &serde_json::json!({ "ok": true }),
+        "GET, DELETE, OPTIONS",
+    )
+}
+
+/// Telegram WebApp `initData` freshness window (1 hour).
+const SETTINGS_INIT_DATA_MAX_AGE_SECONDS: u64 = 3_600;
+
+const SETTINGS_INIT_DATA_HEADER: &str = "x-telegram-init-data";
+
+pub(crate) fn settings_init_data_header(headers: &HeaderMap) -> Option<&str> {
+    headers
+        .get(SETTINGS_INIT_DATA_HEADER)
+        .and_then(|value| value.to_str().ok())
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+}
+
+/// Authenticate a settings WebApp request via Telegram `initData`.
+///
+/// `initData` is the authority for *who* the caller is; the existing per-target authorization
+/// (`authorize_settings_user`, admin/deputy membership) still governs *what* they may do.
+///
+/// `Err(())` signals the gate should answer `401 Unauthorized`; the gate owns the response shape.
+pub(crate) fn authenticate_settings_init_data(
+    routes: &SettingsHttpState,
+    init_data: Option<&str>,
+    claimed_user_id: i64,
+) -> Result<(), ()> {
+    if claimed_user_id <= 0 {
+        tracing::warn!(
+            claimed_user_id,
+            "settings request has no authenticated user ID"
+        );
+        return Err(());
+    }
+    let now_unix = current_unix_timestamp();
+    let Some(init_data) = init_data else {
+        tracing::warn!(
+            claimed_user_id,
+            "settings request rejected: initData absent"
+        );
+        return Err(());
+    };
+    let Some(user) = openplotva_web::validate_webapp_init_data(
+        init_data,
+        &routes.bot_token,
+        SETTINGS_INIT_DATA_MAX_AGE_SECONDS,
+        now_unix,
+    ) else {
+        tracing::warn!(claimed_user_id, "settings initData failed validation");
+        return Err(());
+    };
+    if user.id <= 0 || user.id != claimed_user_id {
+        tracing::warn!(
+            caller_user_id = user.id,
+            claimed_user_id,
+            "settings initData caller does not match requested user_id"
+        );
+        return Err(());
+    }
+    Ok(())
+}
+
+pub(crate) fn current_unix_timestamp() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|elapsed| elapsed.as_secs() as i64)
+        .unwrap_or(0)
+}
+
+pub(crate) fn parse_settings_get_access(
+    values: &BTreeMap<String, String>,
+    admin_ids: &[i64],
+) -> Result<SettingsAccess, SettingsAccessError> {
+    let chat_id = values
+        .get("chat_id")
+        .and_then(|value| value.parse::<i64>().ok())
+        .filter(|chat_id| *chat_id != 0)
+        .ok_or(SettingsAccessError::InvalidChatId)?;
+    let signature = values
+        .get("signature")
+        .filter(|value| !value.is_empty())
+        .ok_or(SettingsAccessError::MissingSignature)?;
+    let user_id = values
+        .get("user_id")
+        .and_then(|value| value.parse::<i64>().ok())
+        .unwrap_or(0);
+    if !openplotva_web::validate_settings_access_signature(chat_id, user_id, signature) {
+        return Err(SettingsAccessError::InvalidSignature);
+    }
+    Ok(SettingsAccess {
+        chat_id,
+        user_id,
+        is_global_admin: admin_ids.contains(&user_id),
+    })
+}
+
+pub(crate) fn settings_access_error_response(error: SettingsAccessError) -> Response {
+    match error {
+        SettingsAccessError::InvalidChatId => {
+            settings_error_response(StatusCode::BAD_REQUEST, "Invalid chat_id")
+        }
+        SettingsAccessError::MissingSignature => {
+            settings_error_response(StatusCode::BAD_REQUEST, "Missing signature")
+        }
+        SettingsAccessError::InvalidSignature => {
+            settings_error_response(StatusCode::FORBIDDEN, "Invalid signature")
+        }
+    }
+}
+
+pub(crate) fn parse_deputy_update_request(
+    body: &[u8],
+) -> Result<DeputyUpdateRequest, Box<Response>> {
+    let req = serde_json::from_slice::<DeputyUpdateRequest>(body).map_err(|_| {
+        Box::new(settings_side_error_response(
+            StatusCode::BAD_REQUEST,
+            "Invalid JSON in request body",
+            "GET, PUT, OPTIONS",
+        ))
+    })?;
+    if req.chat_id == 0 || req.user_id == 0 {
+        return Err(Box::new(settings_side_error_response(
+            StatusCode::BAD_REQUEST,
+            "chat_id and user_id are required",
+            "GET, PUT, OPTIONS",
+        )));
+    }
+    if req.signature.trim().is_empty() {
+        return Err(Box::new(settings_side_error_response(
+            StatusCode::BAD_REQUEST,
+            "Missing signature",
+            "GET, PUT, OPTIONS",
+        )));
+    }
+    if !openplotva_web::validate_settings_access_signature(req.chat_id, req.user_id, &req.signature)
+    {
+        return Err(Box::new(settings_side_error_response(
+            StatusCode::FORBIDDEN,
+            "Invalid signature",
+            "GET, PUT, OPTIONS",
+        )));
+    }
+    Ok(req)
+}
+
+pub(crate) async fn parse_deputy_owner_access(
+    routes: &SettingsHttpState,
+    raw_query: Option<&str>,
+    init_data: Option<&str>,
+) -> Result<DeputyOwnerAccess, Response> {
+    let values = query_values(raw_query);
+    let chat_id = values
+        .get("chat_id")
+        .and_then(|value| value.parse::<i64>().ok())
+        .filter(|value| *value != 0)
+        .ok_or_else(|| {
+            settings_side_error_response(
+                StatusCode::BAD_REQUEST,
+                "Invalid chat_id",
+                "GET, PUT, OPTIONS",
+            )
+        })?;
+    let user_id = values
+        .get("user_id")
+        .and_then(|value| value.parse::<i64>().ok())
+        .filter(|value| *value != 0)
+        .ok_or_else(|| {
+            settings_side_error_response(
+                StatusCode::BAD_REQUEST,
+                "Invalid user_id",
+                "GET, PUT, OPTIONS",
+            )
+        })?;
+    if authenticate_settings_init_data(routes, init_data, user_id).is_err() {
+        return Err(settings_side_error_response(
+            StatusCode::UNAUTHORIZED,
+            "Unauthorized",
+            "GET, PUT, OPTIONS",
+        ));
+    }
+    let signature = values
+        .get("signature")
+        .filter(|value| !value.trim().is_empty())
+        .ok_or_else(|| {
+            settings_side_error_response(
+                StatusCode::BAD_REQUEST,
+                "Missing signature",
+                "GET, PUT, OPTIONS",
+            )
+        })?;
+    if !openplotva_web::validate_settings_access_signature(chat_id, user_id, signature) {
+        return Err(settings_side_error_response(
+            StatusCode::FORBIDDEN,
+            "Invalid signature",
+            "GET, PUT, OPTIONS",
+        ));
+    }
+    if chat_id == user_id {
+        return Err(settings_side_error_response(
+            StatusCode::BAD_REQUEST,
+            "Deputies are available only for chats",
+            "GET, PUT, OPTIONS",
+        ));
+    }
+    ensure_settings_chat_available(routes, chat_id, user_id).await?;
+    let Some(settings_store) = &routes.settings_store else {
+        return Err(settings_side_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "settings store not configured",
+            "GET, PUT, OPTIONS",
+        ));
+    };
+    let chat = settings_store
+        .get_chat_state(chat_id)
+        .await
+        .map_err(|_| {
+            settings_side_error_response(
+                StatusCode::NOT_FOUND,
+                "Chat not found",
+                "GET, PUT, OPTIONS",
+            )
+        })?
+        .ok_or_else(|| {
+            settings_side_error_response(
+                StatusCode::NOT_FOUND,
+                "Chat not found",
+                "GET, PUT, OPTIONS",
+            )
+        })?;
+    if !chat_allows_deputies(&chat) {
+        return Err(settings_side_error_response(
+            StatusCode::BAD_REQUEST,
+            "Deputies are available only for chats",
+            "GET, PUT, OPTIONS",
+        ));
+    }
+    Ok(DeputyOwnerAccess {
+        chat_id,
+        user_id,
+        is_global_admin: routes.admin_ids.contains(&user_id),
+    })
+}
+
+pub(crate) async fn ensure_deputy_management_permission(
+    routes: &SettingsHttpState,
+    chat_id: i64,
+    user_id: i64,
+) -> Result<(), Response> {
+    let Some(member_store) = &routes.member_store else {
+        return Err(settings_side_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "settings store not configured",
+            "GET, PUT, OPTIONS",
+        ));
+    };
+    match member_store.get_chat_member(chat_id, user_id).await {
+        Ok(Some(member)) if member.status == openplotva_storage::CHAT_MEMBER_STATUS_CREATOR => {
+            return Ok(());
+        }
+        Ok(_) => {}
+        Err(error) => {
+            tracing::warn!(%error, chat_id, user_id, "deputy permission check failed");
+            return Err(settings_side_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "Permission check failed",
+                "GET, PUT, OPTIONS",
+            ));
+        }
+    }
+    if routes.telegram.is_some()
+        && let Ok(Some(member)) = refresh_chat_member_for_web(routes, chat_id, user_id).await
+        && member.status == openplotva_storage::CHAT_MEMBER_STATUS_CREATOR
+    {
+        return Ok(());
+    }
+    Err(settings_side_error_response(
+        StatusCode::FORBIDDEN,
+        "Unauthorized access",
+        "GET, PUT, OPTIONS",
+    ))
+}
+
+pub(crate) fn normalize_deputy_ids(values: &[i64], current_user_id: i64) -> Vec<i64> {
+    let mut seen = HashSet::with_capacity(values.len());
+    let mut result = Vec::with_capacity(values.len());
+    for value in values {
+        if *value <= 0 || *value == current_user_id || !seen.insert(*value) {
+            continue;
+        }
+        result.push(*value);
+    }
+    result.sort_unstable();
+    result
+}
+
+pub(crate) async fn validate_deputy_ids(
+    routes: &SettingsHttpState,
+    chat_id: i64,
+    deputy_ids: &[i64],
+) -> Result<(), String> {
+    if deputy_ids.is_empty() {
+        return Ok(());
+    }
+    let Some(member_store) = &routes.member_store else {
+        return Err(format!("invalid deputy {}", deputy_ids[0]));
+    };
+    let members = member_store
+        .list_chat_members_by_user_ids(chat_id, deputy_ids)
+        .await
+        .map_err(|_| format!("invalid deputy {}", deputy_ids[0]))?;
+    let mut by_id = members
+        .into_iter()
+        .map(|member| (member.user_id, member))
+        .collect::<HashMap<_, _>>();
+    for deputy_id in deputy_ids {
+        if routes.telegram.is_some()
+            && !by_id.get(deputy_id).is_some_and(|member| {
+                openplotva_storage::is_active_chat_member_status(&member.status)
+            })
+            && let Ok(Some(member)) = refresh_chat_member_for_web(routes, chat_id, *deputy_id).await
+        {
+            by_id.insert(*deputy_id, member);
+        }
+        let Some(member) = by_id.get(deputy_id) else {
+            return Err(format!("invalid deputy {deputy_id}"));
+        };
+        if !openplotva_storage::is_active_chat_member_status(&member.status) {
+            return Err(format!("invalid deputy {deputy_id}"));
+        }
+    }
+    Ok(())
+}
+
+pub(crate) async fn list_deputy_summaries(
+    routes: &SettingsHttpState,
+    chat_id: i64,
+) -> Result<Vec<SettingsDeputySummary>, String> {
+    let member_store = routes
+        .member_store
+        .as_ref()
+        .ok_or_else(|| "settings store not configured".to_owned())?;
+    list_deputy_summaries_from_store(member_store, chat_id).await
+}
+
+pub(crate) async fn list_deputy_summaries_from_store(
+    member_store: &PostgresChatMemberStore,
+    chat_id: i64,
+) -> Result<Vec<SettingsDeputySummary>, String> {
+    let deputy_ids = member_store
+        .list_chat_deputy_ids(chat_id)
+        .await
+        .map_err(|error| error.to_string())?;
+    if deputy_ids.is_empty() {
+        return Ok(Vec::new());
+    }
+    let members = member_store
+        .list_chat_members_by_user_ids(chat_id, &deputy_ids)
+        .await
+        .map_err(|error| error.to_string())?;
+    let users = member_store
+        .list_user_states_by_ids(&deputy_ids)
+        .await
+        .map_err(|error| error.to_string())?;
+    let members_by_id = members
+        .into_iter()
+        .map(|member| (member.user_id, member))
+        .collect::<HashMap<_, _>>();
+    let users_by_id = users
+        .into_iter()
+        .map(|user| (user.id, user))
+        .collect::<HashMap<_, _>>();
+    let mut deputies = Vec::with_capacity(deputy_ids.len());
+    for deputy_id in deputy_ids {
+        let Some(member) = members_by_id.get(&deputy_id) else {
+            continue;
+        };
+        if !openplotva_storage::is_active_chat_member_status(&member.status) {
+            continue;
+        }
+        let Some(user) = users_by_id.get(&deputy_id) else {
+            continue;
+        };
+        deputies.push(SettingsDeputySummary {
+            id: user.id,
+            first_name: user.first_name.clone(),
+            last_name: user.last_name.clone(),
+            username: user.username.clone(),
+            status: member.status.clone(),
+            display_name: build_deputy_display_name(
+                user.id,
+                &user.first_name,
+                user.last_name.as_deref(),
+                user.username.as_deref(),
+            ),
+        });
+    }
+    deputies.sort_by(|left, right| {
+        left.display_name
+            .cmp(&right.display_name)
+            .then_with(|| left.id.cmp(&right.id))
+    });
+    Ok(deputies)
+}
+
+pub(crate) fn build_deputy_display_name(
+    user_id: i64,
+    first_name: &str,
+    last_name: Option<&str>,
+    username: Option<&str>,
+) -> String {
+    let mut name = first_name.trim().to_owned();
+    if let Some(last_name) = last_name.map(str::trim).filter(|value| !value.is_empty()) {
+        if !name.is_empty() {
+            name.push(' ');
+        }
+        name.push_str(last_name);
+    }
+    if !name.is_empty() {
+        return name;
+    }
+    if let Some(username) = username.map(str::trim).filter(|value| !value.is_empty()) {
+        return format!("@{username}");
+    }
+    format!("User {user_id}")
+}
+
+pub(crate) fn parse_deputy_candidates_limit(value: Option<&str>) -> usize {
+    match value.and_then(|value| value.trim().parse::<usize>().ok()) {
+        Some(limit) if limit > 100 => 100,
+        Some(limit) if limit > 0 => limit,
+        _ => 50,
+    }
+}
+
+pub(crate) fn chat_allows_deputies(chat: &openplotva_core::ChatState) -> bool {
+    !chat.chat_type.trim().is_empty() && chat.chat_type != "private"
+}
+
+pub(crate) fn parse_settings_update_request(
+    body: &[u8],
+) -> Result<SettingsUpdateRequest, Box<Response>> {
+    let mut req = serde_json::from_slice::<SettingsUpdateRequest>(body).map_err(|error| {
+        tracing::error!(%error, "invalid JSON in settings update request");
+        Box::new(settings_error_response(
+            StatusCode::BAD_REQUEST,
+            "Invalid JSON in request body",
+        ))
+    })?;
+    if req.chat_id == 0 {
+        return Err(Box::new(settings_error_response(
+            StatusCode::BAD_REQUEST,
+            "Chat ID is required",
+        )));
+    }
+    if req.signature.is_empty() {
+        return Err(Box::new(settings_error_response(
+            StatusCode::BAD_REQUEST,
+            "Missing signature",
+        )));
+    }
+    if !openplotva_web::validate_settings_access_signature(req.chat_id, req.user_id, &req.signature)
+    {
+        return Err(Box::new(settings_error_response(
+            StatusCode::FORBIDDEN,
+            "Invalid signature",
+        )));
+    }
+    req.custom_persona = openplotva_web::truncate_custom_persona(req.custom_persona);
+    Ok(req)
+}
+
+pub(crate) async fn ensure_settings_chat_available(
+    routes: &SettingsHttpState,
+    chat_id: i64,
+    user_id: i64,
+) -> Result<(), Response> {
+    if chat_id == user_id {
+        return Ok(());
+    }
+    let Some(settings_store) = &routes.settings_store else {
+        return Err(settings_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "settings store not configured",
+        ));
+    };
+    match settings_store.get_chat_state(chat_id).await {
+        Ok(Some(_)) => ensure_settings_bot_membership(routes, chat_id).await,
+        Ok(None) => {
+            refresh_settings_chat_from_telegram(routes, chat_id).await?;
+            ensure_settings_bot_membership(routes, chat_id).await
+        }
+        Err(error) => {
+            tracing::warn!(%error, chat_id, "failed to validate chat availability");
+            Err(settings_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "Failed to validate chat availability",
+            ))
+        }
+    }
+}
+
+pub(crate) async fn refresh_settings_chat_from_telegram(
+    routes: &SettingsHttpState,
+    chat_id: i64,
+) -> Result<(), Response> {
+    let Some(telegram) = &routes.telegram else {
+        return Err(settings_error_response(
+            StatusCode::NOT_FOUND,
+            "Chat not found",
+        ));
+    };
+    let Some(state_store) = &routes.state_store else {
+        return Err(settings_error_response(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "Failed to validate chat availability",
+        ));
+    };
+    let chat = telegram
+        .execute(openplotva_telegram::build_get_chat_method(chat_id))
+        .await
+        .map_err(|error| {
+            tracing::debug!(%error, chat_id, "Telegram getChat failed for settings availability");
+            settings_error_response(StatusCode::NOT_FOUND, "Chat not found")
+        })?;
+    let chat_state = settings_chat_state_from_full_info(chat);
+    state_store
+        .upsert_chat_state(&chat_state)
+        .await
+        .map_err(|error| {
+            tracing::warn!(%error, chat_id, "failed to persist Telegram chat freshness for settings availability");
+            settings_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "Failed to validate chat availability",
+            )
+        })
+}
+
+pub(crate) async fn ensure_settings_bot_membership(
+    routes: &SettingsHttpState,
+    chat_id: i64,
+) -> Result<(), Response> {
+    let (Some(telegram), Some(bot_id)) = (&routes.telegram, routes.bot_id) else {
+        return Ok(());
+    };
+    let Some(member_store) = &routes.member_store else {
+        return Err(settings_error_response(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "Failed to validate chat availability",
+        ));
+    };
+    match member_store.get_chat_member(chat_id, bot_id).await {
+        Ok(Some(member)) if openplotva_storage::is_active_chat_member_status(&member.status) => {
+            return Ok(());
+        }
+        Ok(_) => {}
+        Err(error) => {
+            tracing::debug!(%error, chat_id, bot_id, "failed to load cached bot membership for settings availability");
+        }
+    }
+    let member = settings::GroupSettingsMemberApi::get_chat_member(telegram, chat_id, bot_id)
+        .await
+        .map_err(|error| {
+            tracing::warn!(%error, chat_id, bot_id, "Telegram bot membership check failed for settings availability");
+            settings_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "Failed to validate chat availability",
+            )
+        })?;
+    let upsert = settings::chat_member_upsert_from_telegram(chat_id, bot_id, &member);
+    if let Err(error) = member_store.upsert_chat_member(&upsert).await {
+        tracing::debug!(%error, chat_id, bot_id, "failed to persist Telegram bot membership freshness for settings availability");
+    }
+    let user_state = settings::user_state_from_telegram_user(member.get_user());
+    if let Err(error) = member_store.upsert_user_state(&user_state).await {
+        tracing::debug!(%error, chat_id, bot_id, "failed to persist Telegram bot user freshness for settings availability");
+    }
+    if openplotva_storage::is_active_chat_member_status(&upsert.status) {
+        Ok(())
+    } else {
+        Err(settings_error_response(
+            StatusCode::NOT_FOUND,
+            "Chat not found",
+        ))
+    }
+}
+
+pub(crate) fn settings_chat_state_from_full_info(
+    chat: openplotva_telegram::ChatFullInfo,
+) -> openplotva_core::ChatState {
+    openplotva_core::ChatState::new(
+        chat.id,
+        settings_chat_full_info_type_name(chat.chat_type),
+        chat.title,
+        chat.username,
+        chat.first_name,
+        chat.last_name,
+        chat.is_forum,
+    )
+}
+
+pub(crate) fn settings_chat_full_info_type_name(
+    chat_type: carapax::types::ChatFullInfoType,
+) -> &'static str {
+    match chat_type {
+        carapax::types::ChatFullInfoType::Channel => "channel",
+        carapax::types::ChatFullInfoType::Group => "group",
+        carapax::types::ChatFullInfoType::Private => "private",
+        carapax::types::ChatFullInfoType::Supergroup => "supergroup",
+    }
+}
+
+pub(crate) async fn authorize_settings_user(
+    routes: &SettingsHttpState,
+    access: SettingsAccess,
+) -> Result<(), Response> {
+    if access.user_id <= 0 {
+        return Err(settings_error_response(
+            StatusCode::UNAUTHORIZED,
+            "Unauthorized access",
+        ));
+    }
+    if access.is_global_admin {
+        return Ok(());
+    }
+    match settings_user_can_edit(routes, access.chat_id, access.user_id).await {
+        Ok(true) => Ok(()),
+        Ok(false) => Err(settings_error_response(
+            StatusCode::FORBIDDEN,
+            "Unauthorized access",
+        )),
+        Err(error) => {
+            tracing::warn!(%error, chat_id = access.chat_id, user_id = access.user_id, "settings permission check failed");
+            Err(settings_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "Permission check failed",
+            ))
+        }
+    }
+}
+
+pub(crate) async fn authorize_settings_memory_user(
+    routes: &SettingsHttpState,
+    access: SettingsAccess,
+) -> Result<(), Response> {
+    if access.user_id <= 0 {
+        return Err(settings_error_response(
+            StatusCode::UNAUTHORIZED,
+            "Unauthorized access",
+        ));
+    }
+    match settings_user_can_edit(routes, access.chat_id, access.user_id).await {
+        Ok(true) => Ok(()),
+        Ok(false) => Err(settings_error_response(
+            StatusCode::FORBIDDEN,
+            "Unauthorized access",
+        )),
+        Err(error) => {
+            tracing::warn!(%error, chat_id = access.chat_id, user_id = access.user_id, "settings memory permission check failed");
+            Err(settings_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "Permission check failed",
+            ))
+        }
+    }
+}
+
+pub(crate) async fn settings_user_can_edit(
+    routes: &SettingsHttpState,
+    chat_id: i64,
+    user_id: i64,
+) -> Result<bool, String> {
+    if user_id == 0 {
+        return Err("user ID is required".to_owned());
+    }
+    if chat_id == user_id {
+        return Ok(true);
+    }
+    let settings_store = routes
+        .settings_store
+        .as_ref()
+        .ok_or_else(|| "settings store not configured".to_owned())?;
+    let member_store = routes
+        .member_store
+        .as_ref()
+        .ok_or_else(|| "settings store not configured".to_owned())?;
+    let Some(chat) = settings_store
+        .get_chat_state(chat_id)
+        .await
+        .map_err(|error| error.to_string())?
+    else {
+        return Err("failed to get chat info".to_owned());
+    };
+    if chat.chat_type == "private" {
+        return Ok(false);
+    }
+    let mut member = member_store
+        .get_chat_member(chat_id, user_id)
+        .await
+        .map_err(|error| error.to_string())?;
+    if !stored_chat_member_is_fresh(member.as_ref(), OffsetDateTime::now_utc()) {
+        member = refresh_chat_member_for_web(routes, chat_id, user_id).await?;
+    }
+    if openplotva_storage::stored_member_can_open_group_settings(member.as_ref()) {
+        return Ok(true);
+    }
+    let Some(member) = member.as_ref() else {
+        return Ok(false);
+    };
+    if !openplotva_storage::is_active_chat_member_status(&member.status) {
+        return Ok(false);
+    }
+    let deputy_ids = member_store
+        .list_chat_deputy_ids(chat_id)
+        .await
+        .map_err(|error| error.to_string())?;
+    Ok(deputy_ids.contains(&user_id))
+}
+
+pub(crate) fn stored_chat_member_is_fresh(
+    member: Option<&openplotva_storage::ChatMemberRecord>,
+    now: OffsetDateTime,
+) -> bool {
+    const MAX_AGE_SECONDS: i64 = 5 * 60;
+
+    member
+        .and_then(|member| member.telegram_observed_at)
+        .is_some_and(|observed_at| {
+            observed_at <= now
+                && now
+                    .unix_timestamp()
+                    .saturating_sub(observed_at.unix_timestamp())
+                    <= MAX_AGE_SECONDS
+        })
+}
+
+pub(crate) async fn refresh_chat_member_for_web(
+    routes: &SettingsHttpState,
+    chat_id: i64,
+    user_id: i64,
+) -> Result<Option<openplotva_storage::ChatMemberRecord>, String> {
+    let member_store = routes
+        .member_store
+        .as_ref()
+        .ok_or_else(|| "settings store not configured".to_owned())?;
+    let telegram = routes
+        .telegram
+        .as_ref()
+        .ok_or_else(|| "Telegram membership check not configured".to_owned())?;
+    if chat_id == 0 || user_id == 0 {
+        return Ok(None);
+    }
+
+    match settings::GroupSettingsMemberApi::get_chat_member(telegram, chat_id, user_id).await {
+        Ok(member) => {
+            let upsert = settings::chat_member_upsert_from_telegram(chat_id, user_id, &member);
+            if let Err(error) = member_store.upsert_chat_member(&upsert).await {
+                tracing::debug!(%error, chat_id, user_id, "failed to persist Telegram member freshness for web route");
+                return Ok(Some(chat_member_record_from_upsert(&upsert)));
+            }
+            let user_state = settings::user_state_from_telegram_user(member.get_user());
+            if let Err(error) = member_store.upsert_user_state(&user_state).await {
+                tracing::debug!(%error, chat_id, user_id, "failed to persist Telegram user freshness for web route");
+            }
+            member_store
+                .get_chat_member(chat_id, user_id)
+                .await
+                .map(|stored| stored.or_else(|| Some(chat_member_record_from_upsert(&upsert))))
+                .map_err(|error| error.to_string())
+        }
+        Err(error) => {
+            tracing::warn!(%error, chat_id, user_id, "Telegram member freshness failed for web route");
+            Err("Telegram membership check failed".to_owned())
+        }
+    }
+}
+
+pub(crate) fn chat_member_record_from_upsert(
+    upsert: &openplotva_storage::ChatMemberUpsert,
+) -> openplotva_storage::ChatMemberRecord {
+    openplotva_storage::ChatMemberRecord {
+        chat_id: upsert.chat_id,
+        user_id: upsert.user_id,
+        status: upsert.status.clone(),
+        is_member: upsert.is_member,
+        is_anonymous: upsert.is_anonymous,
+        custom_title: upsert.custom_title.clone(),
+        can_be_edited: upsert.can_be_edited,
+        can_manage_chat: upsert.can_manage_chat,
+        can_delete_messages: upsert.can_delete_messages,
+        can_manage_video_chats: upsert.can_manage_video_chats,
+        can_restrict_members: upsert.can_restrict_members,
+        can_promote_members: upsert.can_promote_members,
+        can_change_info: upsert.can_change_info,
+        can_invite_users: upsert.can_invite_users,
+        can_post_messages: upsert.can_post_messages,
+        can_edit_messages: upsert.can_edit_messages,
+        can_pin_messages: upsert.can_pin_messages,
+        can_manage_topics: upsert.can_manage_topics,
+        can_send_messages: upsert.can_send_messages,
+        can_send_media_messages: upsert.can_send_media_messages,
+        can_send_polls: upsert.can_send_polls,
+        can_send_other_messages: upsert.can_send_other_messages,
+        can_add_web_page_previews: upsert.can_add_web_page_previews,
+        until_date: upsert.until_date,
+        telegram_observed_at: Some(OffsetDateTime::now_utc()),
+    }
+}
+
+pub(crate) async fn settings_update_chat(
+    routes: &SettingsHttpState,
+    chat_id: i64,
+    user_id: i64,
+) -> Result<openplotva_core::ChatState, Response> {
+    let Some(settings_store) = &routes.settings_store else {
+        return Err(settings_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "settings store not configured",
+        ));
+    };
+    match settings_store.get_chat_state(chat_id).await {
+        Ok(Some(chat)) => Ok(chat),
+        Ok(None) if chat_id == user_id && user_id != 0 => {
+            create_private_settings_chat(routes, chat_id).await
+        }
+        Ok(None) => Err(settings_error_response(
+            StatusCode::NOT_FOUND,
+            "Chat not found",
+        )),
+        Err(error) => {
+            tracing::error!(%error, chat_id, "chat not found for settings update");
+            Err(settings_error_response(
+                StatusCode::NOT_FOUND,
+                "Chat not found",
+            ))
+        }
+    }
+}
+
+pub(crate) async fn create_private_settings_chat(
+    routes: &SettingsHttpState,
+    chat_id: i64,
+) -> Result<openplotva_core::ChatState, Response> {
+    let chat = openplotva_core::ChatState::new(chat_id, "private", None, None, None, None, None);
+    if let Some(store) = &routes.state_store
+        && let Err(error) = store.upsert_chat_state(&chat).await
+    {
+        tracing::error!(%error, chat_id, "failed to create private chat record");
+        return Err(settings_error_response(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "Failed to initialize chat",
+        ));
+    }
+    Ok(chat)
+}
+
+pub(crate) async fn settings_chat_display_for_read(
+    routes: &SettingsHttpState,
+    chat_id: i64,
+    user_id: i64,
+) -> (String, String) {
+    let Some(settings_store) = &routes.settings_store else {
+        return (String::new(), String::new());
+    };
+    match settings_store.get_chat_state(chat_id).await {
+        Ok(Some(chat)) => settings_chat_display(&chat),
+        Ok(None) | Err(_) if chat_id == user_id && user_id != 0 => {
+            let _ = create_private_settings_chat(routes, chat_id).await;
+            (String::new(), "private".to_owned())
+        }
+        Ok(None) | Err(_) => (String::new(), String::new()),
+    }
+}
+
+pub(crate) fn settings_chat_display(chat: &openplotva_core::ChatState) -> (String, String) {
+    if let Some(title) = chat.title.as_ref().filter(|value| !value.is_empty()) {
+        return (title.clone(), chat.chat_type.clone());
+    }
+    let private_name = settings_chat_name(chat.first_name.as_deref(), chat.last_name.as_deref());
+    if !private_name.is_empty() {
+        return (private_name, chat.chat_type.clone());
+    }
+    if let Some(username) = chat.username.as_ref().filter(|value| !value.is_empty()) {
+        return (format!("@{username}"), chat.chat_type.clone());
+    }
+    (String::new(), chat.chat_type.clone())
+}
+
+pub(crate) fn settings_chat_name(first_name: Option<&str>, last_name: Option<&str>) -> String {
+    let Some(first_name) = first_name else {
+        return String::new();
+    };
+    let mut title = first_name.to_owned();
+    if let Some(last_name) = last_name.filter(|value| !value.is_empty()) {
+        title.push(' ');
+        title.push_str(last_name);
+    }
+    title
+}
+
+pub(crate) fn new_settings_response(
+    settings: &openplotva_core::ChatSettings,
+    chat_title: String,
+    chat_type: String,
+) -> SettingsResponseBody {
+    SettingsResponseBody {
+        chat_id: settings.chat_id,
+        chat_title,
+        chat_type,
+        mood_alignment: settings.mood_alignment.clone(),
+        custom_persona: settings.custom_persona.clone(),
+        reactivity_percentage: settings.reactivity_percentage,
+        proactivity_percentage: settings.proactivity_percentage,
+        enable_obscenifier: settings.enable_obscenifier,
+        enable_profanity: settings.enable_profanity,
+        enable_greet_joiners: settings.enable_greet_joiners,
+        enable_global_text_reply: settings.enable_global_text_reply,
+        enable_global_draw_reply: settings.enable_global_draw_reply,
+        enable_daily_game: settings.enable_daily_game.unwrap_or(true),
+        daily_game_theme: chat_setting_daily_game_theme(settings.daily_game_theme.as_deref()),
+        greeting_html: settings.greeting_html.clone(),
+        is_vip: false,
+        disable_random_reactivity: false,
+        hide_original_draw_prompt: false,
+        is_deputy: false,
+        can_manage_deputies: false,
+        deputies: Vec::new(),
+    }
+}
+
+pub(crate) fn chat_setting_daily_game_theme(theme: Option<&str>) -> String {
+    theme
+        .filter(|value| !value.is_empty())
+        .unwrap_or("auto")
+        .to_owned()
+}
+
+pub(crate) fn apply_private_chat_response_defaults(
+    response: &mut SettingsResponseBody,
+    chat_id: i64,
+    user_id: i64,
+) {
+    if chat_id == user_id && user_id != 0 {
+        response.enable_global_text_reply = true;
+        response.enable_global_draw_reply = true;
+    }
+}
+
+pub(crate) async fn apply_user_settings_response(
+    routes: &SettingsHttpState,
+    response: &mut SettingsResponseBody,
+    user_id: i64,
+) {
+    if user_id != 0 {
+        response.is_vip = settings_user_is_vip(routes, user_id).await;
+        if let Some(settings_store) = &routes.settings_store
+            && let Ok(Some(user_settings)) = settings_store.get_user_settings(user_id).await
+        {
+            response.disable_random_reactivity = user_settings.disable_random_reactivity;
+            if response.is_vip {
+                response.hide_original_draw_prompt = user_settings.hide_original_draw_prompt;
+            }
+        }
+    }
+    if !response.is_vip {
+        response.hide_original_draw_prompt = false;
+    }
+}
+
+pub(crate) async fn settings_user_is_vip(routes: &SettingsHttpState, user_id: i64) -> bool {
+    if user_id <= 0 {
+        return false;
+    }
+    if let Some(vip_status) = &routes.vip_status {
+        return vip_status
+            .is_vip_at(user_id, OffsetDateTime::now_utc())
+            .await;
+    }
+    let Some(vip_store) = &routes.vip_store else {
+        return false;
+    };
+    if let Ok(Some(summary)) = vip_store.get_vip_summary_by_user(user_id).await
+        && summary.is_active
+        && OffsetDateTime::now_utc() < summary.effective_expires_at
+    {
+        return true;
+    }
+    vip_store
+        .get_vip_cache(user_id)
+        .await
+        .ok()
+        .flatten()
+        .is_some_and(|cache| cache.is_vip && OffsetDateTime::now_utc() < cache.expires_at)
+}
+
+pub(crate) async fn apply_deputy_settings_response(
+    member_store: &PostgresChatMemberStore,
+    response: &mut SettingsResponseBody,
+    chat_id: i64,
+    user_id: i64,
+    chat_type: &str,
+    is_global_admin: bool,
+) {
+    if chat_id == user_id || chat_type == "private" {
+        return;
+    }
+    let deputy_ids = member_store
+        .list_chat_deputy_ids(chat_id)
+        .await
+        .unwrap_or_default();
+    let member = member_store
+        .get_chat_member(chat_id, user_id)
+        .await
+        .ok()
+        .flatten();
+    response.is_deputy = member
+        .as_ref()
+        .is_some_and(|member| openplotva_storage::is_active_chat_member_status(&member.status))
+        && deputy_ids.contains(&user_id);
+    response.can_manage_deputies = is_global_admin
+        || member
+            .as_ref()
+            .is_some_and(|member| member.status == openplotva_storage::CHAT_MEMBER_STATUS_CREATOR);
+    if response.can_manage_deputies {
+        response.deputies = list_deputy_summaries_from_store(member_store, chat_id)
+            .await
+            .unwrap_or_default();
+    }
+}
+
+pub(crate) async fn settings_update_from_request(
+    settings_store: &PostgresChatSettingsStore,
+    req: &SettingsUpdateRequest,
+    chat: &openplotva_core::ChatState,
+) -> openplotva_core::ChatSettingsUpdate {
+    let (enable_global_text_reply, enable_global_draw_reply) =
+        settings_reply_flags(&chat.chat_type, req);
+    let (enable_daily_game, daily_game_theme) =
+        daily_game_update(settings_store, req, is_group_chat_type(&chat.chat_type)).await;
+    openplotva_core::ChatSettingsUpdate {
+        chat_id: req.chat_id,
+        chat_type: chat.chat_type.clone(),
+        mood_alignment: req.mood_alignment.clone(),
+        custom_persona: req.custom_persona.clone(),
+        reactivity_percentage: req.reactivity_percentage.unwrap_or(50),
+        proactivity_percentage: req.proactivity_percentage.unwrap_or(50),
+        enable_global_text_reply,
+        enable_global_draw_reply,
+        enable_obscenifier: req.enable_obscenifier.unwrap_or(true),
+        enable_profanity: req.enable_profanity.unwrap_or(true),
+        enable_greet_joiners: req.enable_greet_joiners.unwrap_or(false),
+        enable_daily_game,
+        daily_game_theme: chat_setting_daily_game_theme(daily_game_theme.as_deref()),
+        greeting_html: req.greeting_html.clone(),
+    }
+}
+
+pub(crate) fn settings_reply_flags(chat_type: &str, req: &SettingsUpdateRequest) -> (bool, bool) {
+    let mut enable_global_text_reply = req.enable_global_text_reply.unwrap_or(true);
+    let mut enable_global_draw_reply = req.enable_global_draw_reply.unwrap_or(true);
+    if chat_type == "private" {
+        enable_global_text_reply = true;
+        enable_global_draw_reply = true;
+    }
+    (enable_global_text_reply, enable_global_draw_reply)
+}
+
+pub(crate) async fn daily_game_update(
+    settings_store: &PostgresChatSettingsStore,
+    req: &SettingsUpdateRequest,
+    is_group: bool,
+) -> (bool, Option<String>) {
+    let current = settings_store
+        .get_chat_settings(req.chat_id)
+        .await
+        .ok()
+        .flatten();
+    let mut daily_enabled = current
+        .as_ref()
+        .and_then(|settings| settings.enable_daily_game)
+        .unwrap_or(true);
+    let mut daily_theme = current.and_then(|settings| settings.daily_game_theme);
+    if is_group {
+        if let Some(enabled) = req.enable_daily_game {
+            daily_enabled = enabled;
+        }
+        if req.daily_game_theme.is_some() {
+            daily_theme = req.daily_game_theme.clone();
+        }
+    }
+    (daily_enabled, daily_theme)
+}
+
+pub(crate) fn is_group_chat_type(chat_type: &str) -> bool {
+    chat_type == "group" || chat_type == "supergroup"
+}
+
+pub(crate) async fn update_user_settings_from_request(
+    routes: &SettingsHttpState,
+    req: &SettingsUpdateRequest,
+) {
+    if req.user_id == 0
+        || (req.disable_random_reactivity.is_none() && req.hide_original_draw_prompt.is_none())
+    {
+        return;
+    }
+    let Some(settings_store) = &routes.settings_store else {
+        return;
+    };
+    let current = settings_store
+        .get_user_settings(req.user_id)
+        .await
+        .ok()
+        .flatten();
+    let disable_random_reactivity = req.disable_random_reactivity.unwrap_or_else(|| {
+        current
+            .as_ref()
+            .is_some_and(|settings| settings.disable_random_reactivity)
+    });
+    let mut hide_original_draw_prompt = current
+        .as_ref()
+        .is_some_and(|settings| settings.hide_original_draw_prompt);
+    if settings_user_is_vip(routes, req.user_id).await {
+        if let Some(hide) = req.hide_original_draw_prompt {
+            hide_original_draw_prompt = hide;
+        }
+    } else {
+        hide_original_draw_prompt = false;
+    }
+    if let Err(error) = settings_store
+        .upsert_user_settings(
+            req.user_id,
+            disable_random_reactivity,
+            hide_original_draw_prompt,
+        )
+        .await
+    {
+        tracing::warn!(%error, user_id = req.user_id, "failed to update user settings");
+    }
+}
+
+pub(crate) async fn managed_chat_list_items(
+    routes: &SettingsHttpState,
+    settings_store: &PostgresChatSettingsStore,
+    member_store: &PostgresChatMemberStore,
+    user_id: i64,
+) -> Vec<ChatListItem> {
+    let chats = match settings_store.list_user_chats(user_id).await {
+        Ok(chats) => chats,
+        Err(error) => {
+            tracing::debug!(%error, user_id, "failed to list user chats");
+            return Vec::new();
+        }
+    };
+    let memberships = member_store.list_user_chat_memberships(user_id).await;
+    let membership_fallback = memberships.is_err();
+    let members_by_chat_id = memberships
+        .unwrap_or_default()
+        .into_iter()
+        .map(|member| (member.chat_id, member))
+        .collect::<HashMap<_, _>>();
+    let deputy_chats = member_store.list_user_deputy_chat_ids(user_id).await;
+    let deputy_fallback = deputy_chats.is_err();
+    let deputy_chat_ids = deputy_chats
+        .unwrap_or_default()
+        .into_iter()
+        .collect::<HashSet<_>>();
+
+    let mut result = Vec::with_capacity(chats.len());
+    for chat in chats {
+        let mut member = if membership_fallback {
+            member_store
+                .get_chat_member(chat.id, user_id)
+                .await
+                .ok()
+                .flatten()
+        } else {
+            members_by_chat_id.get(&chat.id).cloned()
+        };
+        if routes.telegram.is_some()
+            && (!stored_chat_member_is_fresh(member.as_ref(), OffsetDateTime::now_utc())
+                || !member
+                    .as_ref()
+                    .is_some_and(|member| chat_member_can_manage_settings(member, false)))
+            && let Ok(fresh) = refresh_chat_member_for_web(routes, chat.id, user_id).await
+        {
+            member = fresh;
+        }
+        let Some(member) = member else {
+            continue;
+        };
+        let is_deputy = user_is_deputy_for_managed_chat(
+            member_store,
+            user_id,
+            chat.id,
+            &member,
+            &deputy_chat_ids,
+            deputy_fallback,
+        )
+        .await;
+        if !chat_member_can_manage_settings(&member, is_deputy) {
+            continue;
+        }
+        result.push(ChatListItem {
+            id: chat.id,
+            title: chat_list_title(&chat),
+            chat_type: chat.chat_type,
+        });
+    }
+    result
+}
+
+pub(crate) async fn user_is_deputy_for_managed_chat(
+    member_store: &PostgresChatMemberStore,
+    user_id: i64,
+    chat_id: i64,
+    member: &openplotva_storage::ChatMemberRecord,
+    deputy_chat_ids: &HashSet<i64>,
+    fallback: bool,
+) -> bool {
+    if chat_member_can_manage_settings(member, false)
+        || !openplotva_storage::is_active_chat_member_status(&member.status)
+    {
+        return false;
+    }
+    if !fallback {
+        return deputy_chat_ids.contains(&chat_id);
+    }
+    member_store
+        .list_chat_deputy_ids(chat_id)
+        .await
+        .is_ok_and(|ids| ids.contains(&user_id))
+}
+
+pub(crate) fn chat_member_can_manage_settings(
+    member: &openplotva_storage::ChatMemberRecord,
+    is_deputy: bool,
+) -> bool {
+    member.status == openplotva_storage::CHAT_MEMBER_STATUS_CREATOR
+        || is_deputy
+        || member.status == openplotva_storage::CHAT_MEMBER_STATUS_ADMINISTRATOR
+            && member.can_promote_members == Some(true)
+}
+
+pub(crate) fn chat_list_title(chat: &openplotva_core::ChatState) -> String {
+    let (title, _) = settings_chat_display(chat);
+    if title.is_empty() {
+        format!("Chat {}", chat.id)
+    } else {
+        title
+    }
+}
+
+pub(crate) async fn parse_settings_memory_access(
+    routes: &SettingsHttpState,
+    raw_query: Option<&str>,
+    init_data: Option<&str>,
+) -> Result<(i64, i64, openplotva_memory::RetrievalScope), Response> {
+    let values = query_values(raw_query);
+    let chat_id = values
+        .get("chat_id")
+        .and_then(|value| value.parse::<i64>().ok())
+        .filter(|value| *value != 0)
+        .ok_or_else(|| {
+            settings_side_error_response(
+                StatusCode::BAD_REQUEST,
+                "invalid chat_id",
+                "GET, DELETE, OPTIONS",
+            )
+        })?;
+    let signature = values
+        .get("signature")
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| {
+            settings_side_error_response(
+                StatusCode::BAD_REQUEST,
+                "missing signature",
+                "GET, DELETE, OPTIONS",
+            )
+        })?;
+    let user_id = values
+        .get("user_id")
+        .and_then(|value| value.parse::<i64>().ok())
+        .unwrap_or(0);
+    if authenticate_settings_init_data(routes, init_data, user_id).is_err() {
+        return Err(settings_side_error_response(
+            StatusCode::UNAUTHORIZED,
+            "unauthorized",
+            "GET, DELETE, OPTIONS",
+        ));
+    }
+    if !openplotva_web::validate_settings_access_signature(chat_id, user_id, signature) {
+        return Err(settings_side_error_response(
+            StatusCode::FORBIDDEN,
+            "invalid signature",
+            "GET, DELETE, OPTIONS",
+        ));
+    }
+    if let Err(error) = authorize_settings_memory_user(
+        routes,
+        SettingsAccess {
+            chat_id,
+            user_id,
+            is_global_admin: false,
+        },
+    )
+    .await
+    {
+        return Err(match error.status() {
+            StatusCode::FORBIDDEN => settings_side_error_response(
+                StatusCode::FORBIDDEN,
+                "unauthorized access",
+                "GET, DELETE, OPTIONS",
+            ),
+            _ => settings_side_error_response(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "permission check failed",
+                "GET, DELETE, OPTIONS",
+            ),
+        });
+    }
+    let thread_id = values
+        .get("thread_id")
+        .map(String::as_str)
+        .map(parse_optional_i32)
+        .unwrap_or(0);
+    let mut scope = openplotva_memory::RetrievalScope {
+        chat_id,
+        thread_id,
+        user_id,
+        ..openplotva_memory::RetrievalScope::default()
+    };
+    if let Some(settings_store) = &routes.settings_store
+        && let Ok(Some(meta)) = settings_store.get_dialog_memory_chat_meta(chat_id).await
+    {
+        scope.chat_type = meta.chat_type;
+        scope.username = meta.username;
+        scope.active_usernames = meta.active_usernames;
+    }
+    Ok((chat_id, user_id, scope))
+}
+
+pub(crate) fn parse_optional_i32(value: &str) -> i32 {
+    value
+        .trim()
+        .parse::<i32>()
+        .ok()
+        .filter(|value| *value >= 0)
+        .unwrap_or(0)
+}
+
+pub(crate) fn settings_options_response() -> Response {
+    let mut response = StatusCode::OK.into_response();
+    add_settings_api_headers(response.headers_mut());
+    response
+}
+
+pub(crate) fn settings_error_response(status: StatusCode, error: &str) -> Response {
+    settings_json_raw_response(status, &format!(r#"{{"error": "{error}"}}"#))
+}
+
+pub(crate) fn settings_json_response<T: Serialize>(status: StatusCode, value: &T) -> Response {
+    let body = match serde_json::to_string(value) {
+        Ok(body) => body,
+        Err(error) => {
+            tracing::error!(%error, "failed to encode settings response");
+            r#"{"error": "Failed to encode response"}"#.to_owned()
+        }
+    };
+    settings_json_raw_response(status, &body)
+}
+
+pub(crate) fn settings_json_raw_response(status: StatusCode, body: &str) -> Response {
+    let mut response = (
+        status,
+        [(header::CONTENT_TYPE, "application/json")],
+        format!("{body}\n"),
+    )
+        .into_response();
+    add_settings_api_headers(response.headers_mut());
+    response
+}
+
+pub(crate) fn settings_side_options_response(methods: &'static str) -> Response {
+    let mut response = StatusCode::OK.into_response();
+    add_settings_side_api_headers(response.headers_mut(), methods);
+    response
+}
+
+pub(crate) fn settings_side_error_response(
+    status: StatusCode,
+    error: &str,
+    methods: &'static str,
+) -> Response {
+    settings_side_json_raw_response(
+        status,
+        &serde_json::json!({ "error": error }).to_string(),
+        methods,
+    )
+}
+
+pub(crate) fn settings_side_json_response<T: Serialize>(
+    status: StatusCode,
+    value: &T,
+    methods: &'static str,
+) -> Response {
+    let body = serde_json::to_string(value).unwrap_or_else(|error| {
+        tracing::error!(%error, "failed to encode settings side response");
+        r#"{"error":"Failed to encode response"}"#.to_owned()
+    });
+    settings_side_json_raw_response(status, &body, methods)
+}
+
+pub(crate) fn settings_side_json_raw_response(
+    status: StatusCode,
+    body: &str,
+    methods: &'static str,
+) -> Response {
+    let mut response = (
+        status,
+        [(header::CONTENT_TYPE, "application/json")],
+        format!("{body}\n"),
+    )
+        .into_response();
+    add_settings_side_api_headers(response.headers_mut(), methods);
+    response
+}
+
+pub(crate) fn add_settings_api_headers(headers: &mut HeaderMap) {
+    headers.insert(
+        header::ACCESS_CONTROL_ALLOW_ORIGIN,
+        HeaderValue::from_static("*"),
+    );
+    headers.insert(
+        header::ACCESS_CONTROL_ALLOW_METHODS,
+        HeaderValue::from_static("GET, POST, PUT, OPTIONS"),
+    );
+    headers.insert(
+        header::ACCESS_CONTROL_ALLOW_HEADERS,
+        HeaderValue::from_static("Content-Type, Authorization"),
+    );
+}
+
+pub(crate) fn add_settings_side_api_headers(headers: &mut HeaderMap, methods: &'static str) {
+    headers.insert(
+        header::ACCESS_CONTROL_ALLOW_ORIGIN,
+        HeaderValue::from_static("*"),
+    );
+    headers.insert(
+        header::ACCESS_CONTROL_ALLOW_METHODS,
+        HeaderValue::from_static(methods),
+    );
+    headers.insert(
+        header::ACCESS_CONTROL_ALLOW_HEADERS,
+        HeaderValue::from_static("Content-Type, Authorization"),
+    );
+}
diff --git a/crates/openplotva-app/src/http/shield.rs b/crates/openplotva-app/src/http/shield.rs
new file mode 100644
index 00000000..57654baf
--- /dev/null
+++ b/crates/openplotva-app/src/http/shield.rs
@@ -0,0 +1,570 @@
+use super::HttpRouterState;
+use super::auth::{admin_auth_failure_response, require_admin_request};
+use super::common::{
+    admin_error_response, admin_json_response, admin_required_i64, admin_time_json,
+    parse_admin_optional_bool, parse_admin_positive_i32, query_values as admin_auth_query_values,
+};
+use crate::memory_runtime;
+use axum::{
+    body::Bytes,
+    extract::{RawQuery, State},
+    http::{HeaderMap, Method, StatusCode},
+    response::Response,
+};
+use openplotva_storage::PostgresShieldStore;
+use serde::Deserialize;
+use std::sync::Arc;
+
+#[derive(Clone)]
+pub(crate) struct ShieldHttpState {
+    admin_ids: Arc<[i64]>,
+    bot_token: Arc<str>,
+    shield_embedder: Option<Arc<dyn memory_runtime::EmbeddingProvider>>,
+    shield_options: openplotva_shield::Options,
+    shield_store: Option<PostgresShieldStore>,
+}
+
+impl axum::extract::FromRef<Arc<HttpRouterState>> for ShieldHttpState {
+    fn from_ref(routes: &Arc<HttpRouterState>) -> Self {
+        Self {
+            admin_ids: routes.admin_ids.clone(),
+            bot_token: routes.bot_token.clone(),
+            shield_embedder: routes.shield_embedder.clone(),
+            shield_options: routes.shield_options.clone(),
+            shield_store: routes.shield_store.clone(),
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn test_state(routes: &HttpRouterState) -> ShieldHttpState {
+    use axum::extract::FromRef as _;
+    ShieldHttpState::from_ref(&Arc::new(routes.clone()))
+}
+
+pub(crate) async fn admin_shield_documents(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<ShieldHttpState>,
+    body: Bytes,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    let body = body.as_ref();
+    match method {
+        Method::GET => admin_shield_documents_list_response(routes, headers, raw_query).await,
+        Method::POST => admin_shield_document_create_response(routes, headers, body).await,
+        Method::PUT => {
+            admin_shield_document_update_response(routes, headers, raw_query, body).await
+        }
+        Method::DELETE => admin_shield_document_delete_response(routes, headers, raw_query).await,
+        _ => admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed"),
+    }
+}
+
+pub(crate) async fn admin_shield_embeddings_rebuild(
+    method: Method,
+    headers: HeaderMap,
+    State(routes): State<ShieldHttpState>,
+) -> Response {
+    let headers = &headers;
+    let routes = &routes;
+    if method != Method::POST {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(store) = routes.shield_store.as_ref() else {
+        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "shield disabled");
+    };
+    let Some(embedder) = routes.shield_embedder.as_ref() else {
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    };
+    let documents = match store
+        .documents_without_embeddings(routes.shield_options.rebuild_batch_size)
+        .await
+    {
+        Ok(documents) => documents,
+        Err(error) => {
+            tracing::warn!(%error, "failed to list shield documents without embeddings");
+            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+        }
+    };
+    let mut processed = 0_i32;
+    let mut failed = 0_i32;
+    for document in documents {
+        processed += 1;
+        let embedding = match embedder
+            .embed_one(
+                document.title.trim(),
+                routes.shield_options.embedding_dim,
+                openplotva_shield::TITLE_EMBEDDING_TASK,
+            )
+            .await
+        {
+            Ok(embedding) => embedding,
+            Err(error) => {
+                failed += 1;
+                tracing::warn!(
+                    %error,
+                    document_id = document.id,
+                    "shield title embedding rebuild failed"
+                );
+                continue;
+            }
+        };
+        if let Err(error) = store
+            .update_embedding(document.id, embedding.as_ref())
+            .await
+        {
+            failed += 1;
+            tracing::warn!(
+                %error,
+                document_id = document.id,
+                "shield embedding update failed"
+            );
+        }
+    }
+    admin_json_response(
+        StatusCode::OK,
+        serde_json::json!({ "ok": true, "processed": processed, "failed": failed }),
+    )
+}
+
+pub(crate) async fn admin_shield_test(
+    method: Method,
+    headers: HeaderMap,
+    State(routes): State<ShieldHttpState>,
+    body: Bytes,
+) -> Response {
+    let headers = &headers;
+    let routes = &routes;
+    let body = body.as_ref();
+    if method != Method::POST {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(store) = routes.shield_store.as_ref() else {
+        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "shield disabled");
+    };
+    let Ok(req) = serde_json::from_slice::<AdminShieldTestRequest>(body) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "invalid json");
+    };
+    if req.query.trim().is_empty() {
+        return admin_error_response(StatusCode::BAD_REQUEST, "query required");
+    }
+    let request = openplotva_shield::SearchRequest {
+        query: req.query.clone(),
+        max_matches: req.max_matches,
+        include_candidates: req.debug,
+    };
+    let embedding = admin_shield_embed_query(routes, &req.query).await;
+    match store
+        .search_with_vector(&request, &routes.shield_options, embedding.as_ref())
+        .await
+    {
+        Ok(result) => admin_json_response(
+            StatusCode::OK,
+            admin_shield_test_json(&result, &req.expected_category),
+        ),
+        Err(error) => {
+            tracing::warn!(%error, "failed to test admin shield query");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_shield_documents_response(
+    routes: &ShieldHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+    body: &[u8],
+) -> Response {
+    admin_shield_documents(
+        method,
+        headers.clone(),
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+        Bytes::copy_from_slice(body),
+    )
+    .await
+}
+
+pub(crate) async fn admin_shield_documents_list_response(
+    routes: &ShieldHttpState,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(store) = routes.shield_store.as_ref() else {
+        return admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "count": 0, "documents": [] }),
+        );
+    };
+    let values = admin_auth_query_values(raw_query);
+    let filter = openplotva_shield::ListFilter {
+        query: values.get("q").cloned().unwrap_or_default(),
+        include_disabled: parse_admin_optional_bool(
+            values.get("include_disabled").map(String::as_str),
+        )
+        .unwrap_or(false),
+        limit: parse_shield_limit(values.get("limit").map(String::as_str)),
+        offset: 0,
+    };
+    match store.list_documents(&filter).await {
+        Ok(documents) => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({
+                "count": documents.len(),
+                "documents": documents.iter().map(admin_shield_document_json).collect::<Vec<_>>(),
+            }),
+        ),
+        Err(error) => {
+            tracing::warn!(%error, "failed to list admin shield documents");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_shield_document_create_response(
+    routes: &ShieldHttpState,
+    headers: &HeaderMap,
+    body: &[u8],
+) -> Response {
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(store) = routes.shield_store.as_ref() else {
+        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "shield disabled");
+    };
+    let Ok(req) = serde_json::from_slice::<AdminShieldDocumentRequest>(body) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "invalid json");
+    };
+    let input =
+        match openplotva_shield::normalize_document_input(admin_shield_document_input(req, true)) {
+            Ok(input) => input,
+            Err(error) => return admin_error_response(StatusCode::BAD_REQUEST, &error.to_string()),
+        };
+    let embedding = admin_shield_embed_title(routes, &input.title).await;
+    match store.create_document(input, embedding.as_ref()).await {
+        Ok(document) => admin_json_response(StatusCode::OK, admin_shield_document_json(&document)),
+        Err(error) => {
+            tracing::warn!(%error, "failed to create admin shield document");
+            admin_error_response(StatusCode::BAD_REQUEST, &error.to_string())
+        }
+    }
+}
+
+pub(crate) async fn admin_shield_document_update_response(
+    routes: &ShieldHttpState,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+    body: &[u8],
+) -> Response {
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let Some(store) = routes.shield_store.as_ref() else {
+        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "shield disabled");
+    };
+    let Ok(req) = serde_json::from_slice::<AdminShieldDocumentRequest>(body) else {
+        return admin_error_response(StatusCode::BAD_REQUEST, "invalid json");
+    };
+    let values = admin_auth_query_values(raw_query);
+    let mut id = req.id;
+    if let Some(raw_id) = values
+        .get("id")
+        .map(|value| value.trim())
+        .filter(|value| !value.is_empty())
+    {
+        let Ok(parsed) = raw_id.parse::<i64>() else {
+            return admin_error_response(StatusCode::BAD_REQUEST, "invalid id");
+        };
+        if parsed <= 0 {
+            return admin_error_response(StatusCode::BAD_REQUEST, "invalid id");
+        }
+        id = parsed;
+    }
+    if id <= 0 {
+        return admin_error_response(StatusCode::BAD_REQUEST, "id required");
+    }
+    let input = match openplotva_shield::normalize_document_input(admin_shield_document_input(
+        req, false,
+    )) {
+        Ok(input) => input,
+        Err(error) => return admin_error_response(StatusCode::BAD_REQUEST, &error.to_string()),
+    };
+    let embedding = admin_shield_embed_title(routes, &input.title).await;
+    match store.update_document(id, input, embedding.as_ref()).await {
+        Ok(document) => admin_json_response(StatusCode::OK, admin_shield_document_json(&document)),
+        Err(error) => {
+            tracing::warn!(%error, id, "failed to update admin shield document");
+            admin_error_response(StatusCode::BAD_REQUEST, &error.to_string())
+        }
+    }
+}
+
+pub(crate) async fn admin_shield_document_delete_response(
+    routes: &ShieldHttpState,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    let values = admin_auth_query_values(raw_query);
+    let id = match admin_required_i64(&values, "id", "id required", "id required") {
+        Ok(value) if value > 0 => value,
+        Ok(_) => return admin_error_response(StatusCode::BAD_REQUEST, "id required"),
+        Err(response) => return *response,
+    };
+    if let Some(store) = routes.shield_store.as_ref()
+        && let Err(error) = store.delete_document(id).await
+    {
+        tracing::warn!(%error, id, "failed to delete admin shield document");
+        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
+    }
+    admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true }))
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_shield_embeddings_rebuild_response(
+    routes: &ShieldHttpState,
+    method: Method,
+    headers: &HeaderMap,
+) -> Response {
+    admin_shield_embeddings_rebuild(method, headers.clone(), State(routes.clone())).await
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_shield_test_response(
+    routes: &ShieldHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    body: &[u8],
+) -> Response {
+    admin_shield_test(
+        method,
+        headers.clone(),
+        State(routes.clone()),
+        Bytes::copy_from_slice(body),
+    )
+    .await
+}
+
+pub(crate) fn admin_shield_document_input(
+    req: AdminShieldDocumentRequest,
+    default_enabled: bool,
+) -> openplotva_shield::DocumentInput {
+    openplotva_shield::DocumentInput {
+        slug: req.slug,
+        title: req.title,
+        body: req.body,
+        category: req.category,
+        enabled: req.enabled.unwrap_or(default_enabled),
+        priority: req.priority,
+    }
+}
+
+pub(crate) async fn admin_shield_embed_title(
+    routes: &ShieldHttpState,
+    title: &str,
+) -> Option<openplotva_storage::PgEmbeddingVector> {
+    let embedder = routes.shield_embedder.as_ref()?;
+    match embedder
+        .embed_one(
+            title.trim(),
+            routes.shield_options.embedding_dim,
+            openplotva_shield::TITLE_EMBEDDING_TASK,
+        )
+        .await
+    {
+        Ok(embedding) => embedding,
+        Err(error) => {
+            tracing::warn!(%error, "shield title embedding failed; storing lexical-only document");
+            None
+        }
+    }
+}
+
+pub(crate) async fn admin_shield_embed_query(
+    routes: &ShieldHttpState,
+    query: &str,
+) -> Option<openplotva_storage::PgEmbeddingVector> {
+    let embedder = routes.shield_embedder.as_ref()?;
+    match embedder
+        .embed_one(
+            query,
+            routes.shield_options.embedding_dim,
+            openplotva_shield::QUERY_EMBEDDING_TASK,
+        )
+        .await
+    {
+        Ok(embedding) => embedding,
+        Err(error) => {
+            tracing::warn!(%error, "shield embedding failed; using lexical-only retrieval");
+            None
+        }
+    }
+}
+
+pub(crate) fn parse_shield_limit(raw: Option<&str>) -> i32 {
+    parse_admin_positive_i32(raw, 100, 500)
+}
+
+pub(crate) fn admin_shield_category_matched(
+    matches: &[openplotva_shield::Match],
+    expected: &str,
+) -> bool {
+    let expected = expected.trim();
+    if expected.is_empty() {
+        return false;
+    }
+    matches
+        .iter()
+        .any(|item| item.document.category.trim().eq_ignore_ascii_case(expected))
+}
+
+pub(crate) fn admin_shield_document_json(
+    document: &openplotva_shield::Document,
+) -> serde_json::Value {
+    serde_json::json!({
+        "id": document.id,
+        "slug": document.slug,
+        "title": document.title,
+        "body": document.body,
+        "category": document.category,
+        "enabled": document.enabled,
+        "priority": document.priority,
+        "created_at": admin_time_json(document.created_at),
+        "updated_at": admin_time_json(document.updated_at),
+    })
+}
+
+pub(crate) fn admin_shield_scored_document_json(
+    item: &openplotva_shield::ScoredDocument,
+) -> serde_json::Value {
+    serde_json::json!({
+        "document": admin_shield_document_json(&item.document),
+        "lexical_score": item.lexical_score,
+        "vector_score": item.vector_score,
+    })
+}
+
+pub(crate) fn admin_shield_candidate_json(
+    candidate: &openplotva_shield::Candidate,
+) -> serde_json::Value {
+    let mut value = serde_json::Map::new();
+    value.insert(
+        "document".to_owned(),
+        admin_shield_document_json(&candidate.document),
+    );
+    value.insert(
+        "lexical_score".to_owned(),
+        serde_json::json!(candidate.lexical_score),
+    );
+    value.insert(
+        "vector_score".to_owned(),
+        serde_json::json!(candidate.vector_score),
+    );
+    value.insert("matched".to_owned(), serde_json::json!(candidate.matched));
+    if !candidate.signals.is_empty() {
+        value.insert("signals".to_owned(), serde_json::json!(candidate.signals));
+    }
+    serde_json::Value::Object(value)
+}
+
+pub(crate) fn admin_shield_test_json(
+    result: &openplotva_shield::SearchResult,
+    expected_category: &str,
+) -> serde_json::Value {
+    let mut value = serde_json::Map::new();
+    value.insert("query".to_owned(), serde_json::json!(result.query));
+    value.insert(
+        "matches".to_owned(),
+        serde_json::json!(
+            result
+                .matches
+                .iter()
+                .map(admin_shield_scored_document_json)
+                .collect::<Vec<_>>()
+        ),
+    );
+    value.insert("context".to_owned(), serde_json::json!(result.context));
+    value.insert(
+        "lexical_only".to_owned(),
+        serde_json::json!(result.lexical_only),
+    );
+    if !result.candidates.is_empty() {
+        value.insert(
+            "candidates".to_owned(),
+            serde_json::json!(
+                result
+                    .candidates
+                    .iter()
+                    .map(admin_shield_candidate_json)
+                    .collect::<Vec<_>>()
+            ),
+        );
+    }
+    if let Some(debug) = result.debug.as_ref() {
+        value.insert(
+            "debug".to_owned(),
+            serde_json::json!({
+                "max_matches": debug.max_matches,
+                "candidate_limit": debug.candidate_limit,
+                "lexical_min_score": debug.lexical_min_score,
+                "vector_min_score": debug.vector_min_score,
+            }),
+        );
+    }
+    let expected = expected_category.trim();
+    if !expected.is_empty() {
+        value.insert("expected_category".to_owned(), serde_json::json!(expected));
+        value.insert(
+            "category_matched".to_owned(),
+            serde_json::json!(admin_shield_category_matched(&result.matches, expected)),
+        );
+    }
+    serde_json::Value::Object(value)
+}
+
+#[derive(Debug, Default, Deserialize)]
+pub(crate) struct AdminShieldDocumentRequest {
+    #[serde(default)]
+    pub(crate) id: i64,
+    #[serde(default)]
+    pub(crate) slug: String,
+    #[serde(default)]
+    pub(crate) title: String,
+    #[serde(default)]
+    pub(crate) body: String,
+    #[serde(default)]
+    pub(crate) category: String,
+    #[serde(default)]
+    pub(crate) enabled: Option<bool>,
+    #[serde(default)]
+    pub(crate) priority: i32,
+}
+
+#[derive(Debug, Default, Deserialize)]
+pub(crate) struct AdminShieldTestRequest {
+    #[serde(default)]
+    pub(crate) query: String,
+    #[serde(default)]
+    pub(crate) expected_category: String,
+    #[serde(default)]
+    pub(crate) max_matches: i32,
+    #[serde(default)]
+    pub(crate) debug: bool,
+}
diff --git a/crates/openplotva-app/src/http/taskman.rs b/crates/openplotva-app/src/http/taskman.rs
new file mode 100644
index 00000000..128bbe14
--- /dev/null
+++ b/crates/openplotva-app/src/http/taskman.rs
@@ -0,0 +1,685 @@
+use super::HttpRouterState;
+use super::auth::{admin_auth_failure_response, require_admin_request};
+use super::common::{
+    admin_error_response, admin_format_time, admin_json_no_cache_response, admin_json_response,
+    query_values as admin_auth_query_values,
+};
+use crate::runtime_taskman;
+use axum::{
+    extract::{RawQuery, State},
+    http::{HeaderMap, Method, StatusCode},
+    response::Response,
+};
+use std::{collections::BTreeMap, sync::Arc};
+use time::{OffsetDateTime, format_description::well_known::Rfc3339};
+
+#[derive(Clone)]
+pub(crate) struct TaskmanHttpState {
+    admin_ids: Arc<[i64]>,
+    bot_token: Arc<str>,
+    taskman_inspector: runtime_taskman::RuntimeTaskmanInspectorHandle,
+}
+
+impl axum::extract::FromRef<Arc<HttpRouterState>> for TaskmanHttpState {
+    fn from_ref(routes: &Arc<HttpRouterState>) -> Self {
+        Self {
+            admin_ids: routes.admin_ids.clone(),
+            bot_token: routes.bot_token.clone(),
+            taskman_inspector: routes.taskman_inspector.clone(),
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn test_state(routes: &HttpRouterState) -> TaskmanHttpState {
+    use axum::extract::FromRef as _;
+    TaskmanHttpState::from_ref(&Arc::new(routes.clone()))
+}
+
+pub(crate) async fn admin_taskman_jobs(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<TaskmanHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    if !routes.taskman_inspector.is_configured() {
+        return admin_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "task manager not configured",
+        );
+    }
+    let filter = match admin_taskman_jobs_filter(raw_query) {
+        Ok(filter) => filter,
+        Err(response) => return *response,
+    };
+    match openplotva_server::RuntimeTaskmanInspector::list_jobs(&routes.taskman_inspector, filter)
+        .await
+    {
+        Ok(result) => {
+            admin_json_no_cache_response(StatusCode::OK, admin_taskman_list_json(&result))
+        }
+        Err(error) => {
+            tracing::warn!(%error, "failed to list admin taskman jobs");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_taskman_jobs_clear(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<TaskmanHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::POST && method != Method::DELETE {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    if !routes.taskman_inspector.is_configured() {
+        return admin_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "task manager not configured",
+        );
+    }
+    let mut filter = match admin_taskman_jobs_filter(raw_query) {
+        Ok(filter) => filter,
+        Err(response) => return *response,
+    };
+    filter.offset = 0;
+    filter.limit = 0;
+    match routes.taskman_inspector.delete_jobs(filter).await {
+        Ok(result) => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({
+                "ok": true,
+                "matched": result.matched,
+                "deleted": result.deleted,
+                "deleted_active": result.deleted_active,
+                "skipped_active": result.skipped_active,
+            }),
+        ),
+        Err(error) => {
+            tracing::warn!(%error, "failed to clear admin taskman jobs");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_taskman_job(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<TaskmanHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::GET {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    if !routes.taskman_inspector.is_configured() {
+        return admin_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "task manager not configured",
+        );
+    }
+    let job_id = match admin_taskman_job_id(raw_query) {
+        Ok(job_id) => job_id,
+        Err(response) => return *response,
+    };
+    match openplotva_server::RuntimeTaskmanInspector::job(&routes.taskman_inspector, job_id).await {
+        Ok(Some(details)) => {
+            admin_json_no_cache_response(StatusCode::OK, admin_taskman_details_json(&details))
+        }
+        Ok(None) => admin_error_response(StatusCode::NOT_FOUND, "not found"),
+        Err(error) => {
+            tracing::warn!(%error, job_id, "failed to load admin taskman job");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+pub(crate) async fn admin_taskman_job_cancel(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<TaskmanHttpState>,
+) -> Response {
+    admin_taskman_job_cancel_response(&routes, method, &headers, raw_query.as_deref())
+}
+
+pub(crate) async fn admin_taskman_job_restart(
+    method: Method,
+    headers: HeaderMap,
+    RawQuery(raw_query): RawQuery,
+    State(routes): State<TaskmanHttpState>,
+) -> Response {
+    let headers = &headers;
+    let raw_query = raw_query.as_deref();
+    let routes = &routes;
+    if method != Method::POST && method != Method::PUT {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    if !routes.taskman_inspector.is_configured() {
+        return admin_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "task manager not configured",
+        );
+    }
+    let job_id = match admin_taskman_job_id(raw_query) {
+        Ok(job_id) => job_id,
+        Err(response) => return *response,
+    };
+    match routes.taskman_inspector.restart_job(job_id).await {
+        Ok(new_job_id) => admin_json_response(
+            StatusCode::OK,
+            serde_json::json!({ "ok": true, "new_job_id": new_job_id }),
+        ),
+        Err(error) => {
+            tracing::warn!(%error, job_id, "failed to restart admin taskman job");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_taskman_jobs_response(
+    routes: &TaskmanHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    admin_taskman_jobs(
+        method,
+        headers.clone(),
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+    )
+    .await
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_taskman_jobs_clear_response(
+    routes: &TaskmanHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    admin_taskman_jobs_clear(
+        method,
+        headers.clone(),
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+    )
+    .await
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_taskman_job_response(
+    routes: &TaskmanHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    admin_taskman_job(
+        method,
+        headers.clone(),
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+    )
+    .await
+}
+
+pub(crate) fn admin_taskman_job_cancel_response(
+    routes: &TaskmanHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    if method != Method::POST && method != Method::PUT {
+        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
+    }
+    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
+        return admin_auth_failure_response(error);
+    }
+    if !routes.taskman_inspector.is_configured() {
+        return admin_error_response(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "task manager not configured",
+        );
+    }
+    let job_id = match admin_taskman_job_id(raw_query) {
+        Ok(job_id) => job_id,
+        Err(response) => return *response,
+    };
+    match routes.taskman_inspector.cancel_job(job_id) {
+        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
+        Err(error) => {
+            tracing::warn!(%error, job_id, "failed to cancel admin taskman job");
+            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) async fn admin_taskman_job_restart_response(
+    routes: &TaskmanHttpState,
+    method: Method,
+    headers: &HeaderMap,
+    raw_query: Option<&str>,
+) -> Response {
+    admin_taskman_job_restart(
+        method,
+        headers.clone(),
+        RawQuery(raw_query.map(str::to_owned)),
+        State(routes.clone()),
+    )
+    .await
+}
+
+pub(crate) fn admin_taskman_jobs_filter(
+    raw_query: Option<&str>,
+) -> Result<openplotva_server::RuntimeTaskmanJobsFilter, Box<Response>> {
+    let values = admin_auth_query_values(raw_query);
+    Ok(openplotva_server::RuntimeTaskmanJobsFilter {
+        q: values
+            .get("q")
+            .map(|value| value.trim().to_owned())
+            .unwrap_or_default(),
+        status: admin_taskman_csv_values(&values, "status")
+            .into_iter()
+            .map(|status| {
+                admin_taskman_valid_choice(
+                    &status,
+                    &["pending", "processing", "completed", "failed", "cancelled"],
+                    "invalid status",
+                )
+            })
+            .collect::<Result<Vec<_>, _>>()?,
+        queue: admin_taskman_csv_values(&values, "queue"),
+        user_id: admin_taskman_i64(&values, "user_id", "invalid user_id")?,
+        chat_id: admin_taskman_i64(&values, "chat_id", "invalid chat_id")?,
+        time_field: values
+            .get("time_field")
+            .map(|value| {
+                admin_taskman_optional_choice(
+                    value,
+                    &["created_at", "started_at", "completed_at"],
+                    "invalid time_field",
+                )
+            })
+            .transpose()?
+            .unwrap_or_default(),
+        from: values
+            .get("from")
+            .map(|value| admin_taskman_time(value, "invalid from"))
+            .transpose()?
+            .unwrap_or_default(),
+        to: values
+            .get("to")
+            .map(|value| admin_taskman_time(value, "invalid to"))
+            .transpose()?
+            .unwrap_or_default(),
+        sort_by: values
+            .get("sort_by")
+            .map(|value| {
+                admin_taskman_optional_choice(
+                    value,
+                    &["id", "priority", "created_at", "started_at", "completed_at"],
+                    "invalid sort_by",
+                )
+            })
+            .transpose()?
+            .unwrap_or_default(),
+        sort_dir: values
+            .get("sort_dir")
+            .map(|value| admin_taskman_optional_choice(value, &["asc", "desc"], "invalid sort_dir"))
+            .transpose()?
+            .unwrap_or_default(),
+        offset: admin_taskman_i32(&values, "offset", "invalid offset")?.unwrap_or_default(),
+        limit: admin_taskman_i32(&values, "limit", "invalid limit")?.unwrap_or_default(),
+    })
+}
+
+pub(crate) fn admin_taskman_job_id(raw_query: Option<&str>) -> Result<i64, Box<Response>> {
+    let values = admin_auth_query_values(raw_query);
+    let raw = values
+        .get("job_id")
+        .or_else(|| values.get("id"))
+        .map(|value| value.trim())
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| {
+            Box::new(admin_error_response(
+                StatusCode::BAD_REQUEST,
+                "job_id required",
+            ))
+        })?;
+    let id = raw.parse::<i64>().map_err(|_| {
+        Box::new(admin_error_response(
+            StatusCode::BAD_REQUEST,
+            "invalid job_id",
+        ))
+    })?;
+    if id <= 0 {
+        return Err(Box::new(admin_error_response(
+            StatusCode::BAD_REQUEST,
+            "invalid job_id",
+        )));
+    }
+    Ok(id)
+}
+
+pub(crate) fn admin_taskman_csv_values(
+    values: &BTreeMap<String, String>,
+    key: &str,
+) -> Vec<String> {
+    values
+        .get(key)
+        .map(|value| {
+            value
+                .split(',')
+                .map(str::trim)
+                .filter(|value| !value.is_empty())
+                .map(str::to_owned)
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+pub(crate) fn admin_taskman_i64(
+    values: &BTreeMap<String, String>,
+    key: &str,
+    invalid: &str,
+) -> Result<Option<i64>, Box<Response>> {
+    let Some(value) = values
+        .get(key)
+        .map(|value| value.trim())
+        .filter(|value| !value.is_empty())
+    else {
+        return Ok(None);
+    };
+    value
+        .parse::<i64>()
+        .map(Some)
+        .map_err(|_| Box::new(admin_error_response(StatusCode::BAD_REQUEST, invalid)))
+}
+
+pub(crate) fn admin_taskman_i32(
+    values: &BTreeMap<String, String>,
+    key: &str,
+    invalid: &str,
+) -> Result<Option<i32>, Box<Response>> {
+    let Some(value) = values
+        .get(key)
+        .map(|value| value.trim())
+        .filter(|value| !value.is_empty())
+    else {
+        return Ok(None);
+    };
+    value
+        .parse::<i32>()
+        .map(Some)
+        .map_err(|_| Box::new(admin_error_response(StatusCode::BAD_REQUEST, invalid)))
+}
+
+pub(crate) fn admin_taskman_optional_choice(
+    value: &str,
+    allowed: &[&str],
+    invalid: &str,
+) -> Result<String, Box<Response>> {
+    let value = value.trim();
+    if value.is_empty() {
+        return Ok(String::new());
+    }
+    admin_taskman_valid_choice(value, allowed, invalid)
+}
+
+pub(crate) fn admin_taskman_valid_choice(
+    value: &str,
+    allowed: &[&str],
+    invalid: &str,
+) -> Result<String, Box<Response>> {
+    if allowed.contains(&value) {
+        Ok(value.to_owned())
+    } else {
+        Err(Box::new(admin_error_response(
+            StatusCode::BAD_REQUEST,
+            invalid,
+        )))
+    }
+}
+
+pub(crate) fn admin_taskman_time(value: &str, invalid: &str) -> Result<String, Box<Response>> {
+    let value = value.trim();
+    if value.is_empty() {
+        return Ok(String::new());
+    }
+    if let Ok(parsed) = OffsetDateTime::parse(value, &Rfc3339) {
+        return Ok(admin_format_time(parsed));
+    }
+    if let Ok(timestamp) = value.parse::<i64>()
+        && let Ok(parsed) = OffsetDateTime::from_unix_timestamp(timestamp)
+    {
+        return Ok(admin_format_time(parsed));
+    }
+    Err(Box::new(admin_error_response(
+        StatusCode::BAD_REQUEST,
+        invalid,
+    )))
+}
+
+pub(crate) fn admin_taskman_list_json(
+    result: &openplotva_server::RuntimeTaskmanJobListResultData,
+) -> serde_json::Value {
+    serde_json::json!({
+        "total": result.total,
+        "offset": result.offset,
+        "limit": result.limit,
+        "summary": {
+            "by_status": result.summary.by_status,
+            "by_queue": result.summary.by_queue,
+        },
+        "items": result.items.iter().map(admin_taskman_list_entry_json).collect::<Vec<_>>(),
+    })
+}
+
+pub(crate) fn admin_taskman_list_entry_json(
+    item: &openplotva_server::RuntimeTaskmanJobListEntryData,
+) -> serde_json::Value {
+    let mut value = admin_taskman_job_base_json(
+        item.id,
+        &item.queue_name,
+        item.priority,
+        &item.title,
+        Some(serde_json::json!(item.job_type)),
+        &item.status,
+        item.user_id,
+        item.chat_id,
+        item.trigger_message_id,
+        item.thread_message_id,
+        item.progress_message_id,
+        item.result_message_id,
+        item.worker_id.as_deref(),
+        &item.created_at,
+        item.started_at.as_deref(),
+        item.completed_at.as_deref(),
+        item.error_message.as_deref(),
+        item.processing_timeout_seconds,
+        item.prompt_hash.as_deref(),
+        item.estimated_processing_time,
+        item.actual_processing_time,
+    );
+    if let Some(preview) = item.preview.as_deref().filter(|value| !value.is_empty()) {
+        value.insert("preview".to_owned(), serde_json::json!(preview));
+    }
+    serde_json::Value::Object(value)
+}
+
+pub(crate) fn admin_taskman_details_json(
+    details: &openplotva_server::RuntimeTaskmanJobDetailsData,
+) -> serde_json::Value {
+    let mut value = serde_json::Map::new();
+    value.insert("job".to_owned(), admin_taskman_job_json(&details.job));
+    value.insert(
+        "messages".to_owned(),
+        serde_json::json!(
+            details
+                .messages
+                .iter()
+                .map(admin_taskman_message_json)
+                .collect::<Vec<_>>()
+        ),
+    );
+    if let Some(events) = details.events.as_ref() {
+        value.insert("events".to_owned(), events.clone());
+    }
+    serde_json::Value::Object(value)
+}
+
+pub(crate) fn admin_taskman_job_json(
+    job: &openplotva_server::RuntimeTaskmanJobData,
+) -> serde_json::Value {
+    serde_json::Value::Object(admin_taskman_job_base_json(
+        job.id,
+        &job.queue_name,
+        job.priority,
+        &job.title,
+        job.payload.clone(),
+        &job.status,
+        job.user_id,
+        job.chat_id,
+        job.trigger_message_id,
+        job.thread_message_id,
+        job.progress_message_id,
+        job.result_message_id,
+        job.worker_id.as_deref(),
+        &job.created_at,
+        job.started_at.as_deref(),
+        job.completed_at.as_deref(),
+        job.error_message.as_deref(),
+        job.processing_timeout_seconds,
+        job.prompt_hash.as_deref(),
+        job.estimated_processing_time,
+        job.actual_processing_time,
+    ))
+}
+
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn admin_taskman_job_base_json(
+    id: i64,
+    queue_name: &str,
+    priority: i32,
+    title: &str,
+    payload_or_type: Option<serde_json::Value>,
+    status: &str,
+    user_id: i64,
+    chat_id: i64,
+    trigger_message_id: i32,
+    thread_message_id: Option<i32>,
+    progress_message_id: Option<i32>,
+    result_message_id: Option<i32>,
+    worker_id: Option<&str>,
+    created_at: &str,
+    started_at: Option<&str>,
+    completed_at: Option<&str>,
+    error_message: Option<&str>,
+    processing_timeout_seconds: i32,
+    prompt_hash: Option<&str>,
+    estimated_processing_time: Option<i32>,
+    actual_processing_time: Option<i32>,
+) -> serde_json::Map<String, serde_json::Value> {
+    let mut value = serde_json::Map::new();
+    value.insert("id".to_owned(), serde_json::json!(id));
+    value.insert("queue_name".to_owned(), serde_json::json!(queue_name));
+    value.insert("priority".to_owned(), serde_json::json!(priority));
+    value.insert("title".to_owned(), serde_json::json!(title));
+    if let Some(payload_or_type) = payload_or_type {
+        let key = if payload_or_type.is_string() {
+            "job_type"
+        } else {
+            "payload"
+        };
+        value.insert(key.to_owned(), payload_or_type);
+    }
+    value.insert("status".to_owned(), serde_json::json!(status));
+    value.insert("user_id".to_owned(), serde_json::json!(user_id));
+    value.insert("chat_id".to_owned(), serde_json::json!(chat_id));
+    value.insert(
+        "trigger_message_id".to_owned(),
+        serde_json::json!(trigger_message_id),
+    );
+    admin_insert_i32_option(&mut value, "thread_message_id", thread_message_id);
+    admin_insert_i32_option(&mut value, "progress_message_id", progress_message_id);
+    admin_insert_i32_option(&mut value, "result_message_id", result_message_id);
+    admin_insert_str_option(&mut value, "worker_id", worker_id);
+    value.insert("created_at".to_owned(), serde_json::json!(created_at));
+    admin_insert_str_option(&mut value, "started_at", started_at);
+    admin_insert_str_option(&mut value, "completed_at", completed_at);
+    admin_insert_str_option(&mut value, "error_message", error_message);
+    value.insert(
+        "processing_timeout_seconds".to_owned(),
+        serde_json::json!(processing_timeout_seconds),
+    );
+    admin_insert_str_option(&mut value, "prompt_hash", prompt_hash);
+    admin_insert_i32_option(
+        &mut value,
+        "estimated_processing_time",
+        estimated_processing_time,
+    );
+    admin_insert_i32_option(&mut value, "actual_processing_time", actual_processing_time);
+    value
+}
+
+pub(crate) fn admin_taskman_message_json(
+    message: &openplotva_server::RuntimeTaskmanJobMessageData,
+) -> serde_json::Value {
+    serde_json::json!({
+        "id": message.id,
+        "job_id": message.job_id,
+        "message_type": message.message_type,
+        "chat_id": message.chat_id,
+        "message_id": message.message_id,
+        "created_at": message.created_at,
+        "status": message.status,
+    })
+}
+
+pub(crate) fn admin_insert_i32_option(
+    value: &mut serde_json::Map<String, serde_json::Value>,
+    key: &str,
+    item: Option<i32>,
+) {
+    if let Some(item) = item {
+        value.insert(key.to_owned(), serde_json::json!(item));
+    }
+}
+
+pub(crate) fn admin_insert_str_option(
+    value: &mut serde_json::Map<String, serde_json::Value>,
+    key: &str,
+    item: Option<&str>,
+) {
+    if let Some(item) = item {
+        value.insert(key.to_owned(), serde_json::json!(item));
+    }
+}
diff --git a/crates/openplotva-app/src/image_jobs.rs b/crates/openplotva-app/src/image_jobs.rs
index 71c79aef..79f0e258 100644
--- a/crates/openplotva-app/src/image_jobs.rs
+++ b/crates/openplotva-app/src/image_jobs.rs
@@ -1819,17 +1819,11 @@ async fn generate_image_with_routed_attempt(
     request: ImageGenerationRequest,
     draw_api_config: AifarmDrawApiConfig,
 ) -> Result<ImageGenerationResult, ImageGenerationError> {
-    if routed_attempt_is_draw_api(&attempt) {
-        let generator = AifarmDrawApiImageGenerator::new(draw_api_config_for_attempt(
-            draw_api_config,
-            &attempt,
-        ));
-        return generator.generate_image(request).await;
-    }
-    Err(ImageGenerationError::Provider(format!(
-        "unsupported image provider {}",
-        attempt.provider_name
-    )))
+    let config = draw_api_config_for_attempt(draw_api_config, &attempt)
+        .map_err(ImageGenerationError::Provider)?;
+    AifarmDrawApiImageGenerator::new(config)
+        .generate_image(request)
+        .await
 }
 
 async fn edit_image_with_routed_attempt<DataUrl>(
@@ -1842,77 +1836,33 @@ where
     DataUrl: TelegramVisionDataUrlProvider + Send + Sync,
     DataUrl::Error: fmt::Display,
 {
-    if !routed_attempt_is_draw_api(&attempt) {
-        return Err(ImageEditError::Provider(format!(
-            "unsupported image edit provider {}",
-            attempt.provider_name
-        )));
-    }
-    let editor = ResolvingImageEditor::new(
-        data_urls,
-        AifarmDrawApiImageGenerator::new(draw_api_config_for_attempt(draw_api_config, &attempt)),
-    );
+    let config =
+        draw_api_config_for_attempt(draw_api_config, &attempt).map_err(ImageEditError::Provider)?;
+    let editor = ResolvingImageEditor::new(data_urls, AifarmDrawApiImageGenerator::new(config));
     editor.edit_image(request).await
 }
 
-fn routed_attempt_is_draw_api(attempt: &RoutedAttempt) -> bool {
-    attempt.provider_name.eq_ignore_ascii_case("aifarm-draw")
-        || attempt.provider_name.eq_ignore_ascii_case("draw-api")
-        || attempt
-            .discovery_service_name
-            .as_deref()
-            .is_some_and(|value| value.eq_ignore_ascii_case(AIFARM_DRAW_API_SERVICE_NAME))
-}
-
 fn draw_api_config_for_attempt(
     mut config: AifarmDrawApiConfig,
     attempt: &RoutedAttempt,
-) -> AifarmDrawApiConfig {
-    if let Some(endpoint) = routed_endpoint(attempt) {
-        config.base_url = endpoint;
+) -> Result<AifarmDrawApiConfig, String> {
+    if attempt.protocol != Some(openplotva_llm::provider_schema::Protocol::DiscoveryDraw) {
+        return Err(format!(
+            "unsupported image protocol for provider {}",
+            attempt.provider_name
+        ));
     }
-    if let Some(service_name) = routed_config_value(attempt, "service_name")
-        .or_else(|| routed_discovery_value(attempt.discovery_service_name.as_deref()))
-    {
-        config.service_name = service_name;
+    if let Some(endpoint) = attempt.endpoint() {
+        config.base_url = endpoint.to_owned();
     }
-    if let Some(endpoint_name) = routed_config_value(attempt, "endpoint_name")
-        .or_else(|| routed_discovery_value(attempt.discovery_endpoint_name.as_deref()))
-    {
-        config.endpoint_name = endpoint_name;
+    let (service_name, endpoint_name) = attempt.discovery_names();
+    if let Some(service_name) = service_name {
+        config.service_name = service_name.to_owned();
     }
-    config.with_defaults()
-}
-
-fn routed_endpoint(attempt: &RoutedAttempt) -> Option<String> {
-    attempt
-        .model_base_url
-        .as_deref()
-        .or(attempt.provider_endpoint.as_deref())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .map(str::to_owned)
-}
-
-fn routed_config_value(attempt: &RoutedAttempt, key: &str) -> Option<String> {
-    attempt
-        .model_config
-        .get(key)
-        .and_then(serde_json::Value::as_str)
-        .or_else(|| {
-            attempt
-                .provider_config
-                .get(key)
-                .and_then(serde_json::Value::as_str)
-        })
-        .and_then(|value| routed_discovery_value(Some(value)))
-}
-
-fn routed_discovery_value(value: Option<&str>) -> Option<String> {
-    value
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .map(str::to_owned)
+    if let Some(endpoint_name) = endpoint_name {
+        config.endpoint_name = endpoint_name.to_owned();
+    }
+    Ok(config.with_defaults())
 }
 
 fn image_generation_retryable_reason(error: &ImageGenerationError) -> Option<FailureReason> {
@@ -9162,10 +9112,11 @@ mod tests {
 
     #[test]
     fn routed_draw_api_config_prefers_model_endpoint_over_provider_endpoint() {
-        let attempt = RoutedAttempt {
+        let mut attempt = RoutedAttempt {
+            protocol: Some(openplotva_llm::provider_schema::Protocol::DiscoveryDraw),
             provider_id: 1,
             model_id: 2,
-            provider_name: "aifarm-draw".to_owned(),
+            provider_name: "renamed-image-provider".to_owned(),
             model_name: "boogu-image-turbo-sdnq".to_owned(),
             provider_runtime_hint: None,
             provider_endpoint: None,
@@ -9187,10 +9138,26 @@ mod tests {
             variant: None,
         };
 
-        let cfg = draw_api_config_for_attempt(AifarmDrawApiConfig::default(), &attempt);
+        let cfg = draw_api_config_for_attempt(AifarmDrawApiConfig::default(), &attempt)
+            .expect("draw route");
 
         assert_eq!(cfg.service_name, AIFARM_DRAW_API_SERVICE_NAME);
         assert_eq!(cfg.endpoint_name, AIFARM_DRAW_API_BOOGU_TURBO_ENDPOINT_NAME);
+        attempt.model_base_url = Some(" ".into());
+        attempt.provider_endpoint = Some("http://draw.example.test".into());
+        attempt.model_config = json!({});
+        attempt.discovery_endpoint_name = Some("dedicated-endpoint".into());
+        let cfg = draw_api_config_for_attempt(AifarmDrawApiConfig::default(), &attempt)
+            .expect("dedicated route");
+        assert_eq!(cfg.base_url, "http://draw.example.test");
+        assert_eq!(cfg.endpoint_name, "dedicated-endpoint");
+        attempt.discovery_endpoint_name = Some(" ".into());
+        let cfg = draw_api_config_for_attempt(AifarmDrawApiConfig::default(), &attempt)
+            .expect("legacy config");
+        assert_eq!(cfg.endpoint_name, AIFARM_DRAW_API_ENDPOINT_NAME);
+        attempt.provider_name = "aifarm-draw".into();
+        attempt.protocol = Some(openplotva_llm::provider_schema::Protocol::Genkit);
+        assert!(draw_api_config_for_attempt(AifarmDrawApiConfig::default(), &attempt).is_err());
     }
 
     #[tokio::test]
diff --git a/crates/openplotva-app/src/lib.rs b/crates/openplotva-app/src/lib.rs
index 88d8e9a6..27bcb879 100644
--- a/crates/openplotva-app/src/lib.rs
+++ b/crates/openplotva-app/src/lib.rs
@@ -26,6 +26,16 @@ pub mod gradius_ads;
 pub mod gradius_utility_outbox;
 pub mod guest;
 pub mod help;
+mod http;
+use http::HttpRouterState;
+use http::ingress::TelegramWebhookRoute;
+pub use http::ingress::telegram_webhook_response;
+use http::memory::AdminMemoryOverrideRuntime;
+use runtime_dispatcher::{
+    DISPATCHER_MAX_QUEUE_SIZE, DispatcherWorkerGroupInputs, build_dispatcher_worker_group,
+    dispatcher_config,
+};
+use task_queue::{SharedTaskQueueMaintenanceConfig, build_shared_task_queue_maintenance_group};
 pub mod history_summary;
 pub mod image_edit_references;
 pub mod image_jobs;
@@ -38,12 +48,14 @@ pub mod media;
 pub mod members;
 pub mod memory_card_usage;
 pub mod memory_runtime;
+mod memory_workers;
 pub mod message_gate;
 pub mod model_routing;
 pub mod music_jobs;
 pub mod openrouter_free_pool;
 pub mod payments;
 pub mod permissions;
+mod provider_transport;
 pub mod python_sandbox;
 pub mod rate_limits;
 pub mod rates;
@@ -63,7 +75,9 @@ mod runtime_gradius;
 mod runtime_llm;
 mod runtime_llm_analytics;
 mod runtime_llm_runs;
+mod runtime_redis;
 mod runtime_retention;
+use runtime_redis::RedisRuntimeInspector;
 mod runtime_routing;
 mod runtime_safety;
 mod runtime_sql;
@@ -93,8 +107,7 @@ pub use runtime_dispatcher::{
 };
 
 use std::{
-    collections::{BTreeMap, HashMap, HashSet, VecDeque},
-    convert::Infallible,
+    collections::BTreeMap,
     fmt,
     future::Future,
     pin::Pin,
@@ -104,41 +117,29 @@ use std::{
 
 use anyhow::Context as _;
 use axum::{
-    body::Bytes,
-    extract::{DefaultBodyLimit, Extension, Path, RawQuery},
-    http::{HeaderMap, HeaderValue, Method, StatusCode, header},
-    response::{
-        IntoResponse, Response,
-        sse::{Event, KeepAlive, Sse},
-    },
+    extract::{DefaultBodyLimit, Extension},
     routing::{any, get},
 };
-use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
-use futures_util::{Stream, stream};
 use openplotva_config::AppConfig;
 use openplotva_server::{ReadinessCheck, ReadinessProbe, ReadinessResponse};
 use openplotva_storage::{
     PostgresChatMemberStore, PostgresChatSettingsStore, PostgresGeneratedSongStore,
     PostgresHistoryStore, PostgresMemoryStore, PostgresPaymentStore, PostgresRuntimeTokenStore,
     PostgresRuntimeVirtualDialogStore, PostgresShieldStore, PostgresTelegramFileStore,
-    PostgresVipStore, PostgresVirtualMessageStore, RedisBlockedChatStore,
-    RedisEphemeralMessageStore, RedisRateLimitStore, ServiceClients,
+    PostgresVipStore, PostgresVirtualMessageStore, ServiceClients,
 };
-use serde::{Deserialize, Serialize};
+use serde::Deserialize;
 use serde_json::json;
-use sqlx::{PgPool, Row, postgres::PgRow};
+use sqlx::PgPool;
 use thiserror::Error;
-use time::{OffsetDateTime, format_description::well_known::Rfc3339};
+use time::OffsetDateTime;
 use tokio::{
     sync::watch,
     task::JoinHandle,
-    time::{Instant, Interval, timeout, timeout_at},
+    time::{Instant, timeout, timeout_at},
 };
 
-const GO_DISPATCHER_MAX_QUEUE_SIZE: usize = 10_000;
-const GO_DISPATCHER_DEBOUNCE_WINDOW: Duration = Duration::from_secs(3);
-const GO_DISPATCHER_DEBOUNCE_CACHE_SIZE: usize = 1_000;
-const GO_WEBHOOK_DELETE_ON_STOP_TIMEOUT: Duration = Duration::from_secs(10);
+const WEBHOOK_DELETE_ON_STOP_TIMEOUT: Duration = Duration::from_secs(10);
 const RUNTIME_WORKER_SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(50);
 const RUNTIME_PROCESSOR_SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(10);
 const RUNTIME_PERSISTENCE_RESERVE: Duration = Duration::from_secs(8);
@@ -353,6 +354,7 @@ struct RuntimeWorkers {
     routing_event_buffer: Option<runtime_routing::RoutingEventBuffer>,
     routing_event_reporter: Option<runtime_routing::RoutingEventReporter>,
     runtime_api_tls_public_key_pin: Option<String>,
+    attempt_walker: Option<routed_attempts::RoutedAttemptWalker>,
     router_handle: Option<Arc<openplotva_llm::router::RouterHandle>>,
     router_breakers: Option<Arc<openplotva_llm::router::BreakerSet>>,
     router_triggers: Option<Arc<openplotva_llm::router::TriggerState>>,
@@ -611,83 +613,14 @@ pub enum WebhookShutdownCleanupReport {
     TimedOut,
 }
 
-#[derive(Clone)]
-struct TelegramWebhookRoute {
-    sender: openplotva_telegram::WebhookUpdateSender,
-    secret_token: Arc<str>,
-}
-
-#[derive(Clone)]
-struct StaticWebRoutes {
-    admin_ids: Arc<[i64]>,
-    bot_token: Arc<str>,
-    webapp_url: Arc<str>,
-    bot_username: Arc<str>,
-    bot_id: Option<i64>,
-    default_log_level: Arc<str>,
-    postgres: Option<PgPool>,
-    redis: Option<redis::Client>,
-    log_buffer: Option<Arc<openplotva_observability::RuntimeLogBuffer>>,
-    telegram: Option<openplotva_telegram::TelegramClient>,
-    dispatcher_inspector: runtime_dispatcher::RuntimeDispatcherInspectorHandle,
-    cache_inspector: runtime_cache::RuntimeCacheInspectorHandle,
-    taskman_inspector: runtime_taskman::RuntimeTaskmanInspectorHandle,
-    llm_trace_buffer: Option<runtime_llm::RuntimeLlmTraceBuffer>,
-    llm_run_buffer: Option<runtime_llm_runs::RuntimeLlmRunBuffer>,
-    gradius_audit_reader: Option<Arc<dyn openplotva_server::RuntimeGradiusAuditReader>>,
-    routing_event_buffer: Option<runtime_routing::RoutingEventBuffer>,
-    routing_event_reporter: Option<runtime_routing::RoutingEventReporter>,
-    llm_discovery_base_url: Arc<str>,
-    llm_discovery_service_name: Arc<str>,
-    runtime_sql_timeout_ms: i32,
-    state_store: Option<PostgresVirtualMessageStore>,
-    settings_store: Option<PostgresChatSettingsStore>,
-    member_store: Option<PostgresChatMemberStore>,
-    vip_store: Option<PostgresVipStore>,
-    vip_status: Option<Arc<dyn payments::VipStatusChecker + Send + Sync>>,
-    memory_store: Option<PostgresMemoryStore>,
-    memory_admin_enabled: bool,
-    memory_retention: Duration,
-    memory_enqueue_policy: openplotva_memory::MemoryRunEnqueuePolicy,
-    memory_consolidation_model: Arc<str>,
-    memory_max_input_tokens: i32,
-    memory_max_messages_per_run: i32,
-    memory_token_estimator_source: Arc<str>,
-    memory_restart_trigger: Option<Arc<tokio::sync::Notify>>,
-    memory_override_runtime: Option<AdminMemoryOverrideRuntime>,
-    shield_store: Option<PostgresShieldStore>,
-    shield_options: openplotva_shield::Options,
-    shield_embedder: Option<Arc<dyn memory_runtime::EmbeddingProvider>>,
-    router_handle: Option<Arc<openplotva_llm::router::RouterHandle>>,
-    router_breakers: Option<Arc<openplotva_llm::router::BreakerSet>>,
-    router_triggers: Option<Arc<openplotva_llm::router::TriggerState>>,
-    router_pools: Option<Arc<openplotva_llm::router::PoolRegistry>>,
-    openrouter_free_gate: Option<Arc<openrouter_free_pool::OpenRouterFreeQuotaGate>>,
-    router_runtime: Option<Arc<model_routing::RouterRuntime>>,
-    dialog_worker_gauge: Option<Arc<dialog_workers::WorkerGauge>>,
-}
-
-#[derive(Clone)]
-struct AdminMemoryOverrideRuntime {
-    config: Arc<AppConfig>,
-    store: PostgresMemoryStore,
-    lock: Arc<tokio::sync::Mutex<()>>,
-    router_handle: Arc<openplotva_llm::router::RouterHandle>,
-    router_breakers: Arc<openplotva_llm::router::BreakerSet>,
-    router_triggers: Arc<openplotva_llm::router::TriggerState>,
-    router_pools: Arc<openplotva_llm::router::PoolRegistry>,
-    openrouter_free_gate: Option<Arc<openrouter_free_pool::OpenRouterFreeQuotaGate>>,
-    routing_event_reporter: Option<runtime_routing::RoutingEventReporter>,
-}
-
 fn static_web_routes(
     admin_ids: Vec<i64>,
     bot_token: impl Into<String>,
     webapp_url: impl Into<String>,
     bot_username: impl Into<String>,
     state_store: Option<PostgresVirtualMessageStore>,
-) -> StaticWebRoutes {
-    StaticWebRoutes {
+) -> HttpRouterState {
+    HttpRouterState {
         admin_ids: Arc::from(admin_ids),
         bot_token: Arc::from(bot_token.into()),
         webapp_url: Arc::from(webapp_url.into()),
@@ -745,7 +678,7 @@ fn static_web_routes_from_config(
     bot_username: impl Into<String>,
     log_buffer: Arc<openplotva_observability::RuntimeLogBuffer>,
     runtime_workers: &RuntimeWorkers,
-) -> StaticWebRoutes {
+) -> HttpRouterState {
     let mut routes = static_web_routes(
         config.admins.admin_ids.clone(),
         config.bot.key.clone().unwrap_or_default(),
@@ -813,28 +746,13 @@ fn static_web_routes_from_config(
         }
         routes.memory_store = Some(memory_store.clone());
         if config.memory.enabled
-            && let (
-                Some(router_handle),
-                Some(router_breakers),
-                Some(router_triggers),
-                Some(router_pools),
-            ) = (
-                routes.router_handle.clone(),
-                routes.router_breakers.clone(),
-                routes.router_triggers.clone(),
-                routes.router_pools.clone(),
-            )
+            && let Some(attempt_walker) = runtime_workers.attempt_walker.clone()
         {
             routes.memory_override_runtime = Some(AdminMemoryOverrideRuntime {
                 config: Arc::new(config.clone()),
                 store: memory_store,
                 lock: Arc::new(tokio::sync::Mutex::new(())),
-                router_handle,
-                router_breakers,
-                router_triggers,
-                router_pools,
-                openrouter_free_gate: routes.openrouter_free_gate.clone(),
-                routing_event_reporter: routes.routing_event_reporter.clone(),
+                attempt_walker,
             });
         }
         if config.shield.enabled {
@@ -888,7 +806,7 @@ pub fn router_with_readiness_and_telegram_webhook(
 fn router_with_readiness_and_static_web(
     readiness: ReadinessResponse,
     readiness_probes: Vec<ReadinessProbe>,
-    static_web: StaticWebRoutes,
+    static_web: HttpRouterState,
 ) -> axum::Router {
     install_static_web_routes(
         openplotva_server::router_with_readiness_probes(readiness, readiness_probes),
@@ -899,126 +817,228 @@ fn router_with_readiness_and_static_web(
 fn router_with_readiness_static_web_and_telegram_webhook_route(
     readiness: ReadinessResponse,
     readiness_probes: Vec<ReadinessProbe>,
-    static_web: StaticWebRoutes,
+    static_web: HttpRouterState,
     route: TelegramWebhookRoute,
 ) -> axum::Router {
     router_with_readiness_and_static_web(readiness, readiness_probes, static_web)
         .route(
             openplotva_telegram::TELEGRAM_WEBHOOK_PATH,
-            any(telegram_webhook).layer(DefaultBodyLimit::max(TELEGRAM_WEBHOOK_BODY_LIMIT_BYTES)),
+            any(http::ingress::telegram_webhook)
+                .layer(DefaultBodyLimit::max(TELEGRAM_WEBHOOK_BODY_LIMIT_BYTES)),
         )
         .layer(Extension(route))
 }
 
-fn install_static_web_routes(router: axum::Router, static_web: StaticWebRoutes) -> axum::Router {
-    router
-        .route("/settings", get(settings_redirect))
-        .route("/settings/", get(settings_index))
-        .route("/settings/{*path}", get(settings_asset))
-        .route("/api/settings", any(settings_api))
-        .route("/api/settings/", any(settings_api))
-        .route("/api/settings/deputies", any(settings_deputies_api))
-        .route("/api/settings/deputies/", any(settings_deputies_api))
+fn install_static_web_routes(router: axum::Router, static_web: HttpRouterState) -> axum::Router {
+    let state = Arc::new(static_web);
+    let web = axum::Router::<Arc<HttpRouterState>>::new()
+        .route("/settings", get(http::settings::settings_redirect))
+        .route("/settings/", get(http::settings::settings_index))
+        .route("/settings/{*path}", get(http::settings::settings_asset))
+        .route("/api/settings", any(http::settings::settings_api))
+        .route("/api/settings/", any(http::settings::settings_api))
+        .route(
+            "/api/settings/deputies",
+            any(http::settings::settings_deputies_api),
+        )
+        .route(
+            "/api/settings/deputies/",
+            any(http::settings::settings_deputies_api),
+        )
         .route(
             "/api/settings/deputies/candidates",
-            any(settings_deputy_candidates_api),
+            any(http::settings::settings_deputy_candidates_api),
         )
         .route(
             "/api/settings/deputies/candidates/",
-            any(settings_deputy_candidates_api),
+            any(http::settings::settings_deputy_candidates_api),
+        )
+        .route(
+            "/api/settings/memory",
+            any(http::settings::settings_memory_api),
+        )
+        .route(
+            "/api/settings/memory/",
+            any(http::settings::settings_memory_api),
+        )
+        .route("/api/chats", any(http::settings::settings_chats_api))
+        .route("/admin/api/auth", any(http::auth::admin_auth))
+        .route("/admin/api/auth_check", get(http::auth::admin_auth_check))
+        .route("/admin/api/state", any(http::observability::admin_state))
+        .route(
+            "/admin/api/loglevel",
+            any(http::observability::admin_loglevel),
+        )
+        .route("/admin/api/routing", any(http::routing::admin_routing))
+        .route(
+            "/admin/api/routing/status",
+            any(http::routing::admin_routing_status),
+        )
+        .route(
+            "/admin/api/routing/events",
+            any(http::routing::admin_routing_events),
+        )
+        .route(
+            "/admin/api/logs/stream",
+            any(http::observability::admin_logs_stream),
+        )
+        .route("/admin/api/bootstrap", get(http::auth::admin_bootstrap))
+        .route("/admin/api/metrics", any(http::observability::admin_state))
+        .route(
+            "/admin/api/safety/checks",
+            any(http::observability::admin_safety_checks),
         )
-        .route("/api/settings/memory", any(settings_memory_api))
-        .route("/api/settings/memory/", any(settings_memory_api))
-        .route("/api/chats", any(settings_chats_api))
-        .route("/admin/api/auth", any(admin_auth))
-        .route("/admin/api/auth_check", get(admin_auth_check))
-        .route("/admin/api/state", any(admin_state))
-        .route("/admin/api/loglevel", any(admin_loglevel))
-        .route("/admin/api/routing", any(admin_routing))
-        .route("/admin/api/routing/status", any(admin_routing_status))
-        .route("/admin/api/routing/events", any(admin_routing_events))
-        .route("/admin/api/logs/stream", any(admin_logs_stream))
-        .route("/admin/api/bootstrap", get(admin_bootstrap))
-        .route("/admin/api/metrics", any(admin_state))
-        .route("/admin/api/safety/checks", any(admin_safety_checks))
         .route(
             "/admin/api/gradius/opportunities",
-            any(admin_gradius_opportunities),
+            any(http::observability::admin_gradius_opportunities),
+        )
+        .route(
+            "/admin/api/gradius/summary",
+            any(http::observability::admin_gradius_summary),
         )
-        .route("/admin/api/gradius/summary", any(admin_gradius_summary))
         .route(
             "/admin/api/analytics/llm/summary",
-            any(admin_llm_analytics_summary),
+            any(http::observability::admin_llm_analytics_summary),
         )
         .route(
             "/admin/api/analytics/overview",
-            any(admin_analytics_overview),
+            any(http::observability::admin_analytics_overview),
+        )
+        .route(
+            "/admin/api/gpu1/status",
+            any(http::observability::admin_gpu1_status),
+        )
+        .route(
+            "/admin/api/llm/dialogs",
+            any(http::observability::admin_llm_dialogs),
         )
-        .route("/admin/api/gpu1/status", any(admin_gpu1_status))
-        .route("/admin/api/llm/dialogs", any(admin_llm_dialogs))
         .route(
             "/admin/api/llm/dialogs/detail",
-            any(admin_llm_dialogs_detail),
+            any(http::observability::admin_llm_dialogs_detail),
+        )
+        .route(
+            "/admin/api/llm/dialogs/clear",
+            any(http::observability::admin_llm_dialogs_clear),
+        )
+        .route(
+            "/admin/api/memory/cards",
+            any(http::memory::admin_memory_cards),
+        )
+        .route(
+            "/admin/api/memory/runs",
+            any(http::memory::admin_memory_runs),
+        )
+        .route(
+            "/admin/api/memory/restart",
+            any(http::memory::admin_memory_restart),
+        )
+        .route(
+            "/admin/api/memory/card",
+            any(http::memory::admin_memory_card),
+        )
+        .route(
+            "/admin/api/memory/overview",
+            any(http::memory::admin_memory_overview),
+        )
+        .route(
+            "/admin/api/shield/documents",
+            any(http::shield::admin_shield_documents),
         )
-        .route("/admin/api/llm/dialogs/clear", any(admin_llm_dialogs_clear))
-        .route("/admin/api/memory/cards", any(admin_memory_cards))
-        .route("/admin/api/memory/runs", any(admin_memory_runs))
-        .route("/admin/api/memory/restart", any(admin_memory_restart))
-        .route("/admin/api/memory/card", any(admin_memory_card))
-        .route("/admin/api/memory/overview", any(admin_memory_overview))
-        .route("/admin/api/shield/documents", any(admin_shield_documents))
         .route(
             "/admin/api/shield/embeddings/rebuild",
-            any(admin_shield_embeddings_rebuild),
+            any(http::shield::admin_shield_embeddings_rebuild),
+        )
+        .route(
+            "/admin/api/shield/test",
+            any(http::shield::admin_shield_test),
         )
-        .route("/admin/api/shield/test", any(admin_shield_test))
-        .route("/admin/api/redis/list", any(admin_redis_list))
-        .route("/admin/api/redis/get", any(admin_redis_get))
+        .route("/admin/api/redis/list", any(http::redis::admin_redis_list))
+        .route("/admin/api/redis/get", any(http::redis::admin_redis_get))
         .route(
             "/admin/api/redis/delete_prefix",
-            any(admin_redis_delete_prefix),
+            any(http::redis::admin_redis_delete_prefix),
+        )
+        .route(
+            "/admin/api/redis/prefixes",
+            any(http::redis::admin_redis_prefixes),
+        )
+        .route(
+            "/admin/api/redis/delete_key",
+            any(http::redis::admin_redis_delete_key),
+        )
+        .route(
+            "/admin/api/redis/flushdb",
+            any(http::redis::admin_redis_flushdb),
+        )
+        .route("/admin/api/chat", any(http::entities::admin_chat_get))
+        .route(
+            "/admin/api/chat/settings",
+            any(http::entities::admin_chat_settings),
+        )
+        .route(
+            "/admin/api/chat/block",
+            any(http::entities::admin_chat_block),
+        )
+        .route(
+            "/admin/api/chat/unblock",
+            any(http::entities::admin_chat_unblock),
+        )
+        .route(
+            "/admin/api/chat/members",
+            any(http::entities::admin_chat_members),
         )
-        .route("/admin/api/redis/prefixes", any(admin_redis_prefixes))
-        .route("/admin/api/redis/delete_key", any(admin_redis_delete_key))
-        .route("/admin/api/redis/flushdb", any(admin_redis_flushdb))
-        .route("/admin/api/chat", any(admin_chat_get))
-        .route("/admin/api/chat/settings", any(admin_chat_settings))
-        .route("/admin/api/chat/block", any(admin_chat_block))
-        .route("/admin/api/chat/unblock", any(admin_chat_unblock))
-        .route("/admin/api/chat/members", any(admin_chat_members))
-        .route("/admin/api/chats", any(admin_chats_list))
+        .route("/admin/api/chats", any(http::entities::admin_chats_list))
         .route(
             "/admin/api/chats/search_by_member",
-            any(admin_chats_search_by_member),
+            any(http::entities::admin_chats_search_by_member),
+        )
+        .route("/admin/api/users", any(http::entities::admin_users_list))
+        .route(
+            "/admin/api/vip/users",
+            any(http::entities::admin_vip_users_list),
+        )
+        .route("/admin/api/user", any(http::entities::admin_user_get))
+        .route(
+            "/admin/api/user/grant_vip",
+            any(http::entities::admin_user_grant_vip),
+        )
+        .route(
+            "/admin/api/user/revoke_vip",
+            any(http::entities::admin_user_revoke_vip),
+        )
+        .route(
+            "/admin/api/user/delete",
+            any(http::entities::admin_user_delete),
+        )
+        .route(
+            "/admin/api/taskman/jobs",
+            any(http::taskman::admin_taskman_jobs),
         )
-        .route("/admin/api/users", any(admin_users_list))
-        .route("/admin/api/vip/users", any(admin_vip_users_list))
-        .route("/admin/api/user", any(admin_user_get))
-        .route("/admin/api/user/grant_vip", any(admin_user_grant_vip))
-        .route("/admin/api/user/revoke_vip", any(admin_user_revoke_vip))
-        .route("/admin/api/user/delete", any(admin_user_delete))
-        .route("/admin/api/taskman/jobs", any(admin_taskman_jobs))
         .route(
             "/admin/api/taskman/jobs/clear",
-            any(admin_taskman_jobs_clear),
+            any(http::taskman::admin_taskman_jobs_clear),
+        )
+        .route(
+            "/admin/api/taskman/job",
+            any(http::taskman::admin_taskman_job),
         )
-        .route("/admin/api/taskman/job", any(admin_taskman_job))
         .route(
             "/admin/api/taskman/job/cancel",
-            any(admin_taskman_job_cancel),
+            any(http::taskman::admin_taskman_job_cancel),
         )
         .route(
             "/admin/api/taskman/job/restart",
-            any(admin_taskman_job_restart),
+            any(http::taskman::admin_taskman_job_restart),
         )
-        .route("/admin", get(admin_redirect))
-        .route("/admin/", get(admin_index))
-        .route("/admin/{*path}", get(admin_asset))
-        .layer(Extension(static_web))
+        .route("/admin", get(http::auth::admin_redirect))
+        .route("/admin/", get(http::auth::admin_index))
+        .route("/admin/{*path}", get(http::auth::admin_asset))
+        .with_state(state);
+    router.merge(web)
 }
 
 #[cfg(test)]
-const GO_ADMIN_API_ROUTE_PATTERNS: &[&str] = &[
+const ADMIN_API_ROUTE_PATTERNS: &[&str] = &[
     "/admin/api/auth",
     "/admin/api/auth_check",
     "/admin/api/state",
@@ -1068,8220 +1088,151 @@ const GO_ADMIN_API_ROUTE_PATTERNS: &[&str] = &[
     "/admin/api/taskman/job/restart",
 ];
 
-async fn settings_redirect() -> Response {
-    moved_permanently("/settings/")
-}
-
-async fn admin_redirect() -> Response {
-    moved_permanently("/admin/")
-}
-
-async fn settings_index() -> Response {
-    static_web_asset_response(openplotva_web::StaticAssetGroup::Settings, "")
-}
-
-async fn settings_asset(Path(path): Path<String>) -> Response {
-    static_web_asset_response(openplotva_web::StaticAssetGroup::Settings, &path)
+/// Render a fatal error like the report of a `Result` returned from `main`, with
+/// secrets masked. That report goes straight to stderr, past the redacting log
+/// writer, and Telegram client errors carry the bot token in the request URL.
+#[must_use]
+pub fn fatal_error_report(error: &anyhow::Error) -> String {
+    format!(
+        "Error: {}",
+        openplotva_observability::secrets::redact(&format!("{error:?}"))
+    )
 }
 
-async fn settings_api(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-    body: Bytes,
-) -> Response {
-    let init_data = settings_init_data_header(&headers);
-    match method {
-        Method::OPTIONS => settings_options_response(),
-        Method::GET => settings_get_response(&routes, raw_query.as_deref(), init_data).await,
-        Method::POST | Method::PUT => settings_update_response(&routes, &body, init_data).await,
-        _ => settings_error_response(StatusCode::METHOD_NOT_ALLOWED, "Method not allowed"),
+/// Run the current OpenPlotva app shell.
+pub async fn run() -> anyhow::Result<()> {
+    let config = AppConfig::from_env().context("load configuration")?;
+    let prompt_store =
+        Arc::new(openplotva_prompts::PromptStore::load().context("compile prompt registry")?);
+    let log_buffer = openplotva_observability::init_with_log_buffer_capacity(
+        &config.observability,
+        config.runtime_api.log_buffer_size,
+    );
+    if let Some(token) = config.bot.key.as_deref() {
+        openplotva_observability::secrets::register_secret(token);
     }
-}
+    openplotva_observability::secrets::register_secret(&config.google_ai.key);
 
-async fn settings_deputies_api(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(_raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-    body: Bytes,
-) -> Response {
-    let init_data = settings_init_data_header(&headers);
-    match method {
-        Method::OPTIONS => settings_side_options_response("GET, PUT, OPTIONS"),
-        Method::PUT => settings_deputies_update_response(&routes, &body, init_data).await,
-        _ => settings_side_error_response(
-            StatusCode::METHOD_NOT_ALLOWED,
-            "Method not allowed",
-            "GET, PUT, OPTIONS",
-        ),
-    }
-}
+    let mut readiness_checks = Vec::new();
+    let service_clients = connect_services(&config, &mut readiness_checks).await?;
+    record_dialog_tool_mode_readiness(&config, &mut readiness_checks);
+    let runtime_workers = start_runtime_workers(
+        &config,
+        service_clients.as_ref(),
+        &mut readiness_checks,
+        Arc::clone(&log_buffer),
+        prompt_store,
+    )
+    .await?;
 
-async fn settings_deputy_candidates_api(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    let init_data = settings_init_data_header(&headers);
-    match method {
-        Method::OPTIONS => settings_side_options_response("GET, PUT, OPTIONS"),
-        Method::GET => {
-            settings_deputy_candidates_response(&routes, raw_query.as_deref(), init_data).await
-        }
-        _ => settings_side_error_response(
-            StatusCode::METHOD_NOT_ALLOWED,
-            "Method not allowed",
-            "GET, PUT, OPTIONS",
-        ),
-    }
-}
+    let listener = tokio::net::TcpListener::bind(&config.server.bind_addr)
+        .await
+        .with_context(|| format!("bind HTTP listener to {}", config.server.bind_addr))?;
+    let local_addr = listener
+        .local_addr()
+        .context("read HTTP listener address")?;
 
-async fn settings_memory_api(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    let init_data = settings_init_data_header(&headers);
-    match method {
-        Method::OPTIONS => settings_side_options_response("GET, DELETE, OPTIONS"),
-        Method::GET => settings_memory_get_response(&routes, raw_query.as_deref(), init_data).await,
-        Method::DELETE => {
-            settings_memory_delete_response(&routes, raw_query.as_deref(), init_data).await
-        }
-        _ => settings_side_error_response(
-            StatusCode::METHOD_NOT_ALLOWED,
-            "method not allowed",
-            "GET, DELETE, OPTIONS",
-        ),
-    }
-}
+    tracing::info!(address = %local_addr, "openplotva listening");
 
-async fn settings_chats_api(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::GET {
-        return (StatusCode::METHOD_NOT_ALLOWED, "Method not allowed\n").into_response();
-    }
-    let init_data = settings_init_data_header(&headers);
-    settings_chats_response(&routes, raw_query.as_deref(), init_data).await
-}
+    let readiness = ReadinessResponse::ready(readiness_checks);
+    let bot_username = runtime_workers
+        .bot_username
+        .clone()
+        .unwrap_or_else(|| std::env::var("BOT_USERNAME").unwrap_or_default());
+    let static_web = static_web_routes_from_config(
+        &config,
+        service_clients.as_ref(),
+        bot_username,
+        log_buffer,
+        &runtime_workers,
+    );
+    let app = if let Some(webhook_route) = runtime_workers.webhook_route.clone() {
+        router_with_readiness_static_web_and_telegram_webhook_route(
+            readiness,
+            runtime_workers.readiness_probes.clone(),
+            static_web,
+            webhook_route,
+        )
+    } else {
+        router_with_readiness_and_static_web(
+            readiness,
+            runtime_workers.readiness_probes.clone(),
+            static_web,
+        )
+    };
 
-async fn admin_auth(
-    method: Method,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_auth_response(&routes, method, raw_query.as_deref()).await
+    let serve_result = axum::serve(listener, app)
+        .with_graceful_shutdown(shutdown_signal())
+        .await
+        .context("serve HTTP app");
+
+    shutdown_runtime_workers(runtime_workers).await;
+    serve_result?;
+    drop(service_clients);
+    Ok(())
 }
 
-async fn admin_auth_check(
-    Extension(routes): Extension<StaticWebRoutes>,
-    headers: HeaderMap,
-) -> Response {
-    let authenticated_user_id = admin_session_user_id(&headers, &routes.bot_token)
-        .filter(|user_id| routes.admin_ids.contains(user_id));
-    match authenticated_user_id {
-        Some(user_id) => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({
-                "authenticated": true,
-                "user_id": user_id,
-            }),
-        ),
-        None => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "authenticated": false }),
-        ),
+async fn connect_services(
+    config: &AppConfig,
+    readiness_checks: &mut Vec<ReadinessCheck>,
+) -> anyhow::Result<Option<openplotva_storage::ServiceClients>> {
+    if !config.service_probe.connect_services {
+        readiness_checks.push(ReadinessCheck::skipped(
+            "postgres",
+            "OPENPLOTVA_CONNECT_SERVICES=false",
+        ));
+        readiness_checks.push(ReadinessCheck::skipped(
+            "redis",
+            "OPENPLOTVA_CONNECT_SERVICES=false",
+        ));
+        return Ok(None);
     }
-}
 
-async fn admin_bootstrap(Extension(routes): Extension<StaticWebRoutes>) -> Response {
-    admin_json_response(
-        StatusCode::OK,
-        serde_json::json!({
-            "webapp_url": routes.webapp_url.as_ref(),
-            "bot_username": routes.bot_username.as_ref(),
-        }),
+    let clients = openplotva_storage::connect_service_clients(
+        &config.database.postgres,
+        &config.redis,
+        config.service_probe.run_migrations,
     )
-}
-
-async fn admin_state(
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
+    .await
+    .context("connect Postgres and Redis")?;
+    readiness_checks.push(ReadinessCheck::ok(
+        "postgres",
+        format!(
+            "startup connections established; {} general and {} critical slots",
+            openplotva_storage::POSTGRES_GENERAL_MAX_CONNECTIONS,
+            openplotva_storage::POSTGRES_CRITICAL_MAX_CONNECTIONS,
+        ),
+    ));
+    if clients.migrations_applied {
+        readiness_checks.push(ReadinessCheck::ok(
+            "migrations",
+            "pending SQLx migrations applied",
+        ));
+    } else {
+        readiness_checks.push(ReadinessCheck::skipped(
+            "migrations",
+            "OPENPLOTVA_RUN_MIGRATIONS=false",
+        ));
     }
-    admin_state_response(&routes).await
-}
-
-async fn admin_loglevel(
-    method: Method,
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-    body: Bytes,
-) -> Response {
-    admin_loglevel_response(&routes, method, &headers, &body).await
+    readiness_checks.push(ReadinessCheck::ok("redis", "startup ping succeeded"));
+    Ok(Some(clients))
 }
 
-async fn admin_logs_stream(
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(buffer) = routes.log_buffer.clone() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    Sse::new(admin_logs_sse_stream(buffer))
-        .keep_alive(
-            KeepAlive::new()
-                .interval(Duration::from_secs(15))
-                .text("keep-alive"),
-        )
-        .into_response()
+fn postgres_capacity_is_exhausted(size: u32, max_connections: u32, idle: usize) -> bool {
+    size >= max_connections && idle == 0
 }
 
-async fn admin_safety_checks(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_safety_checks_response(&routes, method, &headers, raw_query.as_deref()).await
+fn postgres_pool_is_exhausted(pool: &PgPool) -> bool {
+    postgres_capacity_is_exhausted(
+        pool.size(),
+        pool.options().get_max_connections(),
+        pool.num_idle(),
+    )
 }
 
-async fn admin_gradius_opportunities(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(reader) = routes.gradius_audit_reader.as_deref() else {
-        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "Gradius audit unavailable");
-    };
-    let values = admin_auth_query_values(raw_query.as_deref());
-    let filter = match admin_gradius_opportunities_filter(&values) {
-        Ok(filter) => filter,
-        Err(error) => return admin_error_response(StatusCode::BAD_REQUEST, &error),
-    };
-    match reader.gradius_ad_opportunities(filter).await {
-        Ok(payload) => admin_json_response(StatusCode::OK, payload),
-        Err(error) => {
-            if error == "invalid Gradius range" {
-                admin_error_response(StatusCode::BAD_REQUEST, &error)
-            } else {
-                tracing::warn!(%error, "failed to read Gradius opportunities for admin");
-                admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-            }
-        }
-    }
-}
-
-async fn admin_gradius_summary(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(reader) = routes.gradius_audit_reader.as_deref() else {
-        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "Gradius audit unavailable");
-    };
-    let values = admin_auth_query_values(raw_query.as_deref());
-    let list_filter = match admin_gradius_opportunities_filter(&values) {
-        Ok(filter) => filter,
-        Err(error) => return admin_error_response(StatusCode::BAD_REQUEST, &error),
-    };
-    let filter = openplotva_server::RuntimeGradiusSummaryFilter {
-        range: list_filter.range,
-        integration_kind: list_filter.integration_kind,
-        source: list_filter.source,
-        outcome: list_filter.outcome,
-        delivery_state: list_filter.delivery_state,
-        user_id: list_filter.user_id,
-        chat_id: list_filter.chat_id,
-        dialog_job_id: list_filter.dialog_job_id,
-        model: list_filter.model,
-        q: list_filter.q,
-    };
-    match reader.gradius_ad_summary(filter).await {
-        Ok(payload) => admin_json_response(StatusCode::OK, payload),
-        Err(error) => {
-            let status = if error == "invalid Gradius range" {
-                StatusCode::BAD_REQUEST
-            } else {
-                tracing::warn!(%error, "failed to read Gradius summary for admin");
-                StatusCode::INTERNAL_SERVER_ERROR
-            };
-            admin_error_response(status, &error)
-        }
-    }
-}
-
-fn admin_gradius_opportunities_filter(
-    values: &std::collections::BTreeMap<String, String>,
-) -> Result<openplotva_server::RuntimeGradiusOpportunitiesFilter, String> {
-    let parse_id = |key: &str| -> Result<Option<i64>, String> {
-        values
-            .get(key)
-            .filter(|value| !value.trim().is_empty())
-            .map(|value| {
-                value
-                    .parse::<i64>()
-                    .map_err(|_| format!("{key} must be an integer"))
-            })
-            .transpose()
-    };
-    let parse_page = |key: &str, default: i32| -> Result<i32, String> {
-        values.get(key).map_or(Ok(default), |value| {
-            value
-                .parse::<i32>()
-                .map_err(|_| format!("{key} must be an integer"))
-        })
-    };
-    Ok(openplotva_server::RuntimeGradiusOpportunitiesFilter {
-        range: values.get("range").cloned().unwrap_or_default(),
-        integration_kind: values.get("integration_kind").cloned().unwrap_or_default(),
-        source: values.get("source").cloned().unwrap_or_default(),
-        outcome: values.get("outcome").cloned().unwrap_or_default(),
-        delivery_state: values.get("delivery_state").cloned().unwrap_or_default(),
-        user_id: parse_id("user_id")?,
-        chat_id: parse_id("chat_id")?,
-        dialog_job_id: parse_id("dialog_job_id")?,
-        model: values.get("model").cloned().unwrap_or_default(),
-        q: values.get("q").cloned().unwrap_or_default(),
-        offset: parse_page("offset", 0)?.max(0),
-        limit: parse_page("limit", 100)?.clamp(1, 500),
-    })
-}
-
-async fn admin_llm_analytics_summary(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_llm_analytics_summary_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_analytics_overview(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_analytics_overview_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_gpu1_status(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_gpu1_status_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_gpu1_status_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let range = admin_auth_query_values(raw_query)
-        .remove("range")
-        .map(|value| value.trim().to_owned())
-        .unwrap_or_default();
-    let reader = runtime_gpu_arbiter::GpuArbiterReader::new(
-        routes.llm_discovery_base_url.to_string(),
-        routes.postgres.clone(),
-        routes.runtime_sql_timeout_ms,
-    );
-    admin_json_no_cache_response(StatusCode::OK, reader.snapshot(&range).await)
-}
-
-async fn admin_llm_dialogs(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_llm_dialogs_response(&routes, method, &headers, raw_query.as_deref())
-}
-
-async fn admin_llm_dialogs_detail(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_llm_dialogs_detail_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_llm_dialogs_clear(
-    method: Method,
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_llm_dialogs_clear_response(&routes, method, &headers)
-}
-
-async fn admin_memory_cards(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_memory_cards_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_memory_card(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-    body: Bytes,
-) -> Response {
-    admin_memory_card_response(&routes, method, &headers, raw_query.as_deref(), &body).await
-}
-
-async fn admin_memory_overview(
-    method: Method,
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    admin_memory_overview_response(&routes, &headers).await
-}
-
-async fn admin_memory_runs(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-    body: Bytes,
-) -> Response {
-    admin_memory_runs_response(&routes, method, &headers, raw_query.as_deref(), &body).await
-}
-
-async fn admin_memory_restart(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-    body: Bytes,
-) -> Response {
-    admin_memory_restart_response(&routes, method, &headers, raw_query.as_deref(), &body).await
-}
-
-async fn admin_shield_documents(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-    body: Bytes,
-) -> Response {
-    admin_shield_documents_response(&routes, method, &headers, raw_query.as_deref(), &body).await
-}
-
-async fn admin_shield_embeddings_rebuild(
-    method: Method,
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_shield_embeddings_rebuild_response(&routes, method, &headers).await
-}
-
-async fn admin_shield_test(
-    method: Method,
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-    body: Bytes,
-) -> Response {
-    admin_shield_test_response(&routes, method, &headers, &body).await
-}
-
-async fn admin_taskman_jobs(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_taskman_jobs_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_taskman_jobs_clear(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_taskman_jobs_clear_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_taskman_job(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_taskman_job_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_taskman_job_cancel(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_taskman_job_cancel_response(&routes, method, &headers, raw_query.as_deref())
-}
-
-async fn admin_taskman_job_restart(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_taskman_job_restart_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_redis_list(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let pattern = admin_auth_query_values(raw_query.as_deref())
-        .remove("pattern")
-        .filter(|value| !value.is_empty())
-        .unwrap_or_else(|| "*".to_owned());
-    let Some(redis) = routes.redis_inspector() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    match redis.scan_all_keys(&pattern).await {
-        Ok(keys) => admin_json_response(StatusCode::OK, serde_json::json!({ "keys": keys })),
-        Err(error) => {
-            tracing::warn!(%error, pattern, "failed to list admin redis keys");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_redis_get(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query.as_deref());
-    let Some(key) = values.get("key").filter(|value| !value.is_empty()) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "key required");
-    };
-    let Some(redis) = routes.redis_inspector() else {
-        return admin_error_response(StatusCode::NOT_FOUND, "not found");
-    };
-    match redis.raw_value(key).await {
-        Ok(Some(value)) => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "key": key, "value": value }),
-        ),
-        Ok(None) => admin_error_response(StatusCode::NOT_FOUND, "not found"),
-        Err(error) => {
-            tracing::warn!(%error, key, "failed to get admin redis value");
-            admin_error_response(StatusCode::NOT_FOUND, "not found")
-        }
-    }
-}
-
-async fn admin_redis_delete_prefix(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::DELETE {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query.as_deref());
-    let Some(prefix) = values.get("prefix").filter(|value| !value.is_empty()) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "prefix required");
-    };
-    let Some(redis) = routes.redis_inspector() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    match redis.delete_by_prefix(prefix).await {
-        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
-        Err(error) => {
-            tracing::warn!(%error, prefix, "failed to delete admin redis prefix");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_redis_prefixes(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let prefix = admin_auth_query_values(raw_query.as_deref())
-        .remove("prefix")
-        .unwrap_or_default();
-    let Some(redis) = routes.redis_inspector() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    match redis.scan_all_keys(&format!("{prefix}*")).await {
-        Ok(keys) => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "groups": admin_redis_prefix_groups_from_keys(&prefix, keys) }),
-        ),
-        Err(error) => {
-            tracing::warn!(%error, prefix, "failed to list admin redis prefixes");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_redis_delete_key(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::DELETE {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query.as_deref());
-    let Some(key) = values.get("key").filter(|value| !value.is_empty()) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "key required");
-    };
-    let Some(redis) = routes.redis_inspector() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    match redis.delete_key(key).await {
-        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
-        Err(error) => {
-            tracing::warn!(%error, key, "failed to delete admin redis key");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_redis_flushdb(
-    method: Method,
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::POST {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(redis) = routes.redis_inspector() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    match redis.flushdb().await {
-        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
-        Err(error) => {
-            tracing::warn!(%error, "failed to flush admin redis db");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_chat_get(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_chat_get_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_chat_settings(
-    method: Method,
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-    body: Bytes,
-) -> Response {
-    admin_chat_settings_response(&routes, method, &headers, &body).await
-}
-
-async fn admin_chat_block(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_chat_block_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_chat_unblock(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_chat_unblock_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_chat_members(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_chat_members_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_chats_list(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_chats_list_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_chats_search_by_member(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_chats_search_by_member_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_users_list(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_users_list_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_vip_users_list(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_vip_users_list_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_user_get(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_user_get_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_user_grant_vip(
-    method: Method,
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-    body: Bytes,
-) -> Response {
-    admin_user_grant_vip_response(&routes, method, &headers, &body).await
-}
-
-async fn admin_user_revoke_vip(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_user_revoke_vip_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_user_delete(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    admin_user_delete_response(&routes, method, &headers, raw_query.as_deref()).await
-}
-
-async fn admin_index(
-    Extension(routes): Extension<StaticWebRoutes>,
-    headers: HeaderMap,
-) -> Response {
-    admin_web_asset_response(&routes, &headers, "")
-}
-
-async fn admin_asset(
-    Path(path): Path<String>,
-    Extension(routes): Extension<StaticWebRoutes>,
-    headers: HeaderMap,
-) -> Response {
-    admin_web_asset_response(&routes, &headers, &path)
-}
-
-fn admin_web_asset_response(routes: &StaticWebRoutes, headers: &HeaderMap, path: &str) -> Response {
-    if admin_static_asset_requires_auth(path)
-        && !admin_session_is_authorized(headers, &routes.admin_ids, &routes.bot_token)
-    {
-        return found("/admin/login.html");
-    }
-    static_web_asset_response(openplotva_web::StaticAssetGroup::Admin, path)
-}
-
-fn static_web_asset_response(group: openplotva_web::StaticAssetGroup, path: &str) -> Response {
-    let Some(asset) = openplotva_web::static_asset(group, path) else {
-        return StatusCode::NOT_FOUND.into_response();
-    };
-    (
-        StatusCode::OK,
-        [
-            (header::CONTENT_TYPE, asset.content_type),
-            (header::CACHE_CONTROL, "no-cache"),
-        ],
-        asset.bytes,
-    )
-        .into_response()
-}
-
-fn moved_permanently(location: &'static str) -> Response {
-    (
-        StatusCode::MOVED_PERMANENTLY,
-        [(header::LOCATION, location)],
-    )
-        .into_response()
-}
-
-fn found(location: &'static str) -> Response {
-    (StatusCode::FOUND, [(header::LOCATION, location)]).into_response()
-}
-
-#[derive(Debug, Deserialize)]
-struct SettingsUpdateRequest {
-    chat_id: i64,
-    #[serde(default)]
-    user_id: i64,
-    mood_alignment: Option<String>,
-    custom_persona: Option<String>,
-    reactivity_percentage: Option<i32>,
-    proactivity_percentage: Option<i32>,
-    enable_obscenifier: Option<bool>,
-    enable_profanity: Option<bool>,
-    enable_greet_joiners: Option<bool>,
-    enable_global_text_reply: Option<bool>,
-    enable_global_draw_reply: Option<bool>,
-    signature: String,
-    enable_daily_game: Option<bool>,
-    daily_game_theme: Option<String>,
-    greeting_html: Option<String>,
-    disable_random_reactivity: Option<bool>,
-    hide_original_draw_prompt: Option<bool>,
-}
-
-#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
-struct SettingsDeputySummary {
-    id: i64,
-    first_name: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    last_name: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    username: Option<String>,
-    status: String,
-    display_name: String,
-}
-
-#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
-struct SettingsResponseBody {
-    chat_id: i64,
-    #[serde(skip_serializing_if = "String::is_empty")]
-    chat_title: String,
-    #[serde(skip_serializing_if = "String::is_empty")]
-    chat_type: String,
-    mood_alignment: Option<String>,
-    custom_persona: Option<String>,
-    reactivity_percentage: i32,
-    proactivity_percentage: i32,
-    enable_obscenifier: bool,
-    enable_profanity: bool,
-    enable_greet_joiners: bool,
-    enable_global_text_reply: bool,
-    enable_global_draw_reply: bool,
-    enable_daily_game: bool,
-    daily_game_theme: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    greeting_html: Option<String>,
-    is_vip: bool,
-    disable_random_reactivity: bool,
-    hide_original_draw_prompt: bool,
-    is_deputy: bool,
-    can_manage_deputies: bool,
-    deputies: Vec<SettingsDeputySummary>,
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-struct SettingsAccess {
-    chat_id: i64,
-    user_id: i64,
-    is_global_admin: bool,
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-enum SettingsAccessError {
-    InvalidChatId,
-    MissingSignature,
-    InvalidSignature,
-}
-
-#[derive(Debug, Deserialize)]
-struct DeputyUpdateRequest {
-    chat_id: i64,
-    user_id: i64,
-    signature: String,
-    #[serde(default)]
-    deputy_ids: Vec<i64>,
-}
-
-#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
-struct DeputyCandidatesResponse {
-    items: Vec<SettingsDeputySummary>,
-}
-
-#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
-struct DeputyUpdateResponse {
-    ok: bool,
-    deputies: Vec<SettingsDeputySummary>,
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-struct DeputyOwnerAccess {
-    chat_id: i64,
-    user_id: i64,
-    is_global_admin: bool,
-}
-
-#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
-struct ChatListItem {
-    id: i64,
-    title: String,
-    #[serde(rename = "type")]
-    chat_type: String,
-}
-
-#[derive(Clone, Debug, Serialize)]
-struct SettingsMemoryResponse {
-    chat_id: i64,
-    user_id: i64,
-    count: usize,
-    cards: Vec<openplotva_memory::Card>,
-}
-
-async fn settings_get_response(
-    routes: &StaticWebRoutes,
-    raw_query: Option<&str>,
-    init_data: Option<&str>,
-) -> Response {
-    let Some(settings_store) = &routes.settings_store else {
-        return settings_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "settings store not configured",
-        );
-    };
-    let Some(member_store) = &routes.member_store else {
-        return settings_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "settings store not configured",
-        );
-    };
-
-    let values = admin_auth_query_values(raw_query);
-    let claimed_user_id = values
-        .get("user_id")
-        .and_then(|value| value.parse::<i64>().ok())
-        .unwrap_or(0);
-    if authenticate_settings_init_data(routes, init_data, claimed_user_id).is_err() {
-        return settings_error_response(StatusCode::UNAUTHORIZED, "Unauthorized");
-    }
-    let access = match parse_settings_get_access(&values, &routes.admin_ids) {
-        Ok(access) => access,
-        Err(error) => return settings_access_error_response(error),
-    };
-
-    if let Err(error) = ensure_settings_chat_available(routes, access.chat_id, access.user_id).await
-    {
-        return error;
-    }
-    if let Err(error) = authorize_settings_user(routes, access).await {
-        return error;
-    }
-
-    let mut settings = match settings_store.get_chat_settings(access.chat_id).await {
-        Ok(Some(settings)) => settings,
-        Ok(None) | Err(_) => openplotva_core::ChatSettings::defaults(access.chat_id),
-    };
-    settings.custom_persona =
-        openplotva_web::truncate_custom_persona(settings.custom_persona.take());
-
-    let (chat_title, chat_type) =
-        settings_chat_display_for_read(routes, access.chat_id, access.user_id).await;
-    let mut response = new_settings_response(&settings, chat_title, chat_type.clone());
-    apply_private_chat_response_defaults(&mut response, access.chat_id, access.user_id);
-    apply_user_settings_response(routes, &mut response, access.user_id).await;
-    apply_deputy_settings_response(
-        member_store,
-        &mut response,
-        access.chat_id,
-        access.user_id,
-        &chat_type,
-        access.is_global_admin,
-    )
-    .await;
-    settings_json_response(StatusCode::OK, &response)
-}
-
-async fn settings_update_response(
-    routes: &StaticWebRoutes,
-    body: &[u8],
-    init_data: Option<&str>,
-) -> Response {
-    let Some(settings_store) = &routes.settings_store else {
-        return settings_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "settings store not configured",
-        );
-    };
-    let req = match parse_settings_update_request(body) {
-        Ok(req) => req,
-        Err(response) => return *response,
-    };
-    if authenticate_settings_init_data(routes, init_data, req.user_id).is_err() {
-        return settings_error_response(StatusCode::UNAUTHORIZED, "Unauthorized");
-    }
-    if let Err(error) = ensure_settings_chat_available(routes, req.chat_id, req.user_id).await {
-        return error;
-    }
-    let chat = match settings_update_chat(routes, req.chat_id, req.user_id).await {
-        Ok(chat) => chat,
-        Err(response) => return response,
-    };
-    let access = SettingsAccess {
-        chat_id: req.chat_id,
-        user_id: req.user_id,
-        is_global_admin: routes.admin_ids.contains(&req.user_id),
-    };
-    if let Err(error) = authorize_settings_user(routes, access).await {
-        return error;
-    }
-
-    let update = settings_update_from_request(settings_store, &req, &chat).await;
-    if let Err(error) = settings_store.upsert_chat_settings(&update).await {
-        tracing::error!(%error, chat_id = req.chat_id, "failed to update chat settings");
-        return settings_error_response(
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "Failed to update settings",
-        );
-    }
-    update_user_settings_from_request(routes, &req).await;
-    settings_json_response(StatusCode::OK, &serde_json::json!({ "status": "success" }))
-}
-
-async fn settings_chats_response(
-    routes: &StaticWebRoutes,
-    raw_query: Option<&str>,
-    init_data: Option<&str>,
-) -> Response {
-    let values = admin_auth_query_values(raw_query);
-    let Some(user_id_raw) = values.get("user_id") else {
-        return settings_json_raw_response(
-            StatusCode::BAD_REQUEST,
-            r#"{"error":"missing user_id"}"#,
-        );
-    };
-    let Ok(user_id) = user_id_raw.parse::<i64>() else {
-        return settings_json_raw_response(
-            StatusCode::BAD_REQUEST,
-            r#"{"error":"invalid user_id"}"#,
-        );
-    };
-    if authenticate_settings_init_data(routes, init_data, user_id).is_err() {
-        return settings_json_raw_response(StatusCode::UNAUTHORIZED, r#"{"error":"unauthorized"}"#);
-    }
-    let Some(signature) = values.get("signature").filter(|value| !value.is_empty()) else {
-        return settings_json_raw_response(
-            StatusCode::BAD_REQUEST,
-            r#"{"error":"missing signature"}"#,
-        );
-    };
-    if !openplotva_web::validate_settings_access_signature(user_id, 0, signature) {
-        return settings_json_raw_response(
-            StatusCode::FORBIDDEN,
-            r#"{"error":"invalid signature"}"#,
-        );
-    }
-    let Some(settings_store) = &routes.settings_store else {
-        return settings_json_response(StatusCode::OK, &Vec::<ChatListItem>::new());
-    };
-    let Some(member_store) = &routes.member_store else {
-        return settings_json_response(StatusCode::OK, &Vec::<ChatListItem>::new());
-    };
-    let chats = managed_chat_list_items(routes, settings_store, member_store, user_id).await;
-    settings_json_response(StatusCode::OK, &chats)
-}
-
-async fn settings_deputy_candidates_response(
-    routes: &StaticWebRoutes,
-    raw_query: Option<&str>,
-    init_data: Option<&str>,
-) -> Response {
-    let access = match parse_deputy_owner_access(routes, raw_query, init_data).await {
-        Ok(access) => access,
-        Err(response) => return response,
-    };
-    if !access.is_global_admin
-        && let Err(response) =
-            ensure_deputy_management_permission(routes, access.chat_id, access.user_id).await
-    {
-        return response;
-    }
-    let query_values = admin_auth_query_values(raw_query);
-    let query = query_values
-        .get("query")
-        .or_else(|| query_values.get("q"))
-        .map(|value| value.trim())
-        .unwrap_or("");
-    let limit = parse_deputy_candidates_limit(query_values.get("limit").map(String::as_str));
-    let Some(member_store) = &routes.member_store else {
-        return settings_side_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "settings store not configured",
-            "GET, PUT, OPTIONS",
-        );
-    };
-    let rows = match member_store
-        .search_chat_member_candidates(access.chat_id, query, limit as i32)
-        .await
-    {
-        Ok(rows) => rows,
-        Err(error) => {
-            tracing::warn!(%error, chat_id = access.chat_id, user_id = access.user_id, "failed to search deputy candidates");
-            return settings_side_error_response(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "Failed to search deputy candidates",
-                "GET, PUT, OPTIONS",
-            );
-        }
-    };
-    let items = rows
-        .into_iter()
-        .filter(|row| row.id != 0 && row.id != access.user_id)
-        .map(|row| SettingsDeputySummary {
-            id: row.id,
-            display_name: build_deputy_display_name(
-                row.id,
-                &row.first_name,
-                row.last_name.as_deref(),
-                row.username.as_deref(),
-            ),
-            first_name: row.first_name,
-            last_name: row.last_name,
-            username: row.username,
-            status: row.status,
-        })
-        .collect::<Vec<_>>();
-    settings_side_json_response(
-        StatusCode::OK,
-        &DeputyCandidatesResponse { items },
-        "GET, PUT, OPTIONS",
-    )
-}
-
-async fn settings_deputies_update_response(
-    routes: &StaticWebRoutes,
-    body: &[u8],
-    init_data: Option<&str>,
-) -> Response {
-    let req = match parse_deputy_update_request(body) {
-        Ok(req) => req,
-        Err(response) => return *response,
-    };
-    if authenticate_settings_init_data(routes, init_data, req.user_id).is_err() {
-        return settings_side_error_response(
-            StatusCode::UNAUTHORIZED,
-            "Unauthorized",
-            "GET, PUT, OPTIONS",
-        );
-    }
-    if let Err(error) = ensure_settings_chat_available(routes, req.chat_id, req.user_id).await {
-        return error;
-    }
-    if !routes.admin_ids.contains(&req.user_id)
-        && let Err(response) =
-            ensure_deputy_management_permission(routes, req.chat_id, req.user_id).await
-    {
-        return response;
-    }
-    let deputy_ids = normalize_deputy_ids(&req.deputy_ids, req.user_id);
-    if let Err(message) = validate_deputy_ids(routes, req.chat_id, &deputy_ids).await {
-        return settings_side_json_raw_response(
-            StatusCode::BAD_REQUEST,
-            &serde_json::json!({ "error": message }).to_string(),
-            "GET, PUT, OPTIONS",
-        );
-    }
-    let Some(member_store) = &routes.member_store else {
-        return settings_side_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "settings store not configured",
-            "GET, PUT, OPTIONS",
-        );
-    };
-    if let Err(error) = member_store
-        .replace_chat_deputies(req.chat_id, &deputy_ids)
-        .await
-    {
-        tracing::warn!(%error, chat_id = req.chat_id, user_id = req.user_id, "failed to replace chat deputies");
-        return settings_side_error_response(
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "Failed to update deputies",
-            "GET, PUT, OPTIONS",
-        );
-    }
-    let deputies = list_deputy_summaries(routes, req.chat_id)
-        .await
-        .unwrap_or_default();
-    settings_side_json_response(
-        StatusCode::OK,
-        &DeputyUpdateResponse { ok: true, deputies },
-        "GET, PUT, OPTIONS",
-    )
-}
-
-async fn settings_memory_get_response(
-    routes: &StaticWebRoutes,
-    raw_query: Option<&str>,
-    init_data: Option<&str>,
-) -> Response {
-    let (chat_id, user_id, scope) =
-        match parse_settings_memory_access(routes, raw_query, init_data).await {
-            Ok(access) => access,
-            Err(response) => return response,
-        };
-    let limit = parse_memory_limit(
-        admin_auth_query_values(raw_query)
-            .get("limit")
-            .map(String::as_str),
-    );
-    let cards = match &routes.memory_store {
-        Some(store) => match store.list_visible_cards(&scope, limit as i32).await {
-            Ok(cards) => cards,
-            Err(error) => {
-                tracing::error!(%error, chat_id, user_id, "failed to list settings memory");
-                return settings_side_error_response(
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    "failed to list memory",
-                    "GET, DELETE, OPTIONS",
-                );
-            }
-        },
-        None => Vec::new(),
-    };
-    settings_side_json_response(
-        StatusCode::OK,
-        &SettingsMemoryResponse {
-            chat_id,
-            user_id,
-            count: cards.len(),
-            cards,
-        },
-        "GET, DELETE, OPTIONS",
-    )
-}
-
-async fn settings_memory_delete_response(
-    routes: &StaticWebRoutes,
-    raw_query: Option<&str>,
-    init_data: Option<&str>,
-) -> Response {
-    let (_, user_id, scope) = match parse_settings_memory_access(routes, raw_query, init_data).await
-    {
-        Ok(access) => access,
-        Err(response) => return response,
-    };
-    let id = admin_auth_query_values(raw_query)
-        .get("id")
-        .and_then(|value| value.parse::<i64>().ok())
-        .filter(|id| *id != 0);
-    let Some(id) = id else {
-        return settings_side_error_response(
-            StatusCode::BAD_REQUEST,
-            "id required",
-            "GET, DELETE, OPTIONS",
-        );
-    };
-    let deleted = match &routes.memory_store {
-        Some(store) => match store.soft_delete_visible_card(id, user_id, &scope).await {
-            Ok(deleted) => deleted,
-            Err(error) => {
-                tracing::error!(%error, id, user_id, "failed to soft-delete settings memory card");
-                return settings_side_error_response(
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    "failed to delete memory",
-                    "GET, DELETE, OPTIONS",
-                );
-            }
-        },
-        None => {
-            return settings_side_json_response(
-                StatusCode::OK,
-                &serde_json::json!({ "ok": true }),
-                "GET, DELETE, OPTIONS",
-            );
-        }
-    };
-    if !deleted {
-        return settings_side_error_response(
-            StatusCode::NOT_FOUND,
-            "memory card not found",
-            "GET, DELETE, OPTIONS",
-        );
-    }
-    settings_side_json_response(
-        StatusCode::OK,
-        &serde_json::json!({ "ok": true }),
-        "GET, DELETE, OPTIONS",
-    )
-}
-
-/// Telegram WebApp `initData` freshness window (1 hour).
-const SETTINGS_INIT_DATA_MAX_AGE_SECONDS: u64 = 3_600;
-
-const SETTINGS_INIT_DATA_HEADER: &str = "x-telegram-init-data";
-
-fn settings_init_data_header(headers: &HeaderMap) -> Option<&str> {
-    headers
-        .get(SETTINGS_INIT_DATA_HEADER)
-        .and_then(|value| value.to_str().ok())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-}
-
-/// Authenticate a settings WebApp request via Telegram `initData`.
-///
-/// `initData` is the authority for *who* the caller is; the existing per-target authorization
-/// (`authorize_settings_user`, admin/deputy membership) still governs *what* they may do.
-///
-/// `Err(())` signals the gate should answer `401 Unauthorized`; the gate owns the response shape.
-fn authenticate_settings_init_data(
-    routes: &StaticWebRoutes,
-    init_data: Option<&str>,
-    claimed_user_id: i64,
-) -> Result<(), ()> {
-    if claimed_user_id <= 0 {
-        tracing::warn!(
-            claimed_user_id,
-            "settings request has no authenticated user ID"
-        );
-        return Err(());
-    }
-    let now_unix = current_unix_timestamp();
-    let Some(init_data) = init_data else {
-        tracing::warn!(
-            claimed_user_id,
-            "settings request rejected: initData absent"
-        );
-        return Err(());
-    };
-    let Some(user) = openplotva_web::validate_webapp_init_data(
-        init_data,
-        &routes.bot_token,
-        SETTINGS_INIT_DATA_MAX_AGE_SECONDS,
-        now_unix,
-    ) else {
-        tracing::warn!(claimed_user_id, "settings initData failed validation");
-        return Err(());
-    };
-    if user.id <= 0 || user.id != claimed_user_id {
-        tracing::warn!(
-            caller_user_id = user.id,
-            claimed_user_id,
-            "settings initData caller does not match requested user_id"
-        );
-        return Err(());
-    }
-    Ok(())
-}
-
-fn current_unix_timestamp() -> i64 {
-    std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|elapsed| elapsed.as_secs() as i64)
-        .unwrap_or(0)
-}
-
-fn parse_settings_get_access(
-    values: &BTreeMap<String, String>,
-    admin_ids: &[i64],
-) -> Result<SettingsAccess, SettingsAccessError> {
-    let chat_id = values
-        .get("chat_id")
-        .and_then(|value| value.parse::<i64>().ok())
-        .filter(|chat_id| *chat_id != 0)
-        .ok_or(SettingsAccessError::InvalidChatId)?;
-    let signature = values
-        .get("signature")
-        .filter(|value| !value.is_empty())
-        .ok_or(SettingsAccessError::MissingSignature)?;
-    let user_id = values
-        .get("user_id")
-        .and_then(|value| value.parse::<i64>().ok())
-        .unwrap_or(0);
-    if !openplotva_web::validate_settings_access_signature(chat_id, user_id, signature) {
-        return Err(SettingsAccessError::InvalidSignature);
-    }
-    Ok(SettingsAccess {
-        chat_id,
-        user_id,
-        is_global_admin: admin_ids.contains(&user_id),
-    })
-}
-
-fn settings_access_error_response(error: SettingsAccessError) -> Response {
-    match error {
-        SettingsAccessError::InvalidChatId => {
-            settings_error_response(StatusCode::BAD_REQUEST, "Invalid chat_id")
-        }
-        SettingsAccessError::MissingSignature => {
-            settings_error_response(StatusCode::BAD_REQUEST, "Missing signature")
-        }
-        SettingsAccessError::InvalidSignature => {
-            settings_error_response(StatusCode::FORBIDDEN, "Invalid signature")
-        }
-    }
-}
-
-fn parse_deputy_update_request(body: &[u8]) -> Result<DeputyUpdateRequest, Box<Response>> {
-    let req = serde_json::from_slice::<DeputyUpdateRequest>(body).map_err(|_| {
-        Box::new(settings_side_error_response(
-            StatusCode::BAD_REQUEST,
-            "Invalid JSON in request body",
-            "GET, PUT, OPTIONS",
-        ))
-    })?;
-    if req.chat_id == 0 || req.user_id == 0 {
-        return Err(Box::new(settings_side_error_response(
-            StatusCode::BAD_REQUEST,
-            "chat_id and user_id are required",
-            "GET, PUT, OPTIONS",
-        )));
-    }
-    if req.signature.trim().is_empty() {
-        return Err(Box::new(settings_side_error_response(
-            StatusCode::BAD_REQUEST,
-            "Missing signature",
-            "GET, PUT, OPTIONS",
-        )));
-    }
-    if !openplotva_web::validate_settings_access_signature(req.chat_id, req.user_id, &req.signature)
-    {
-        return Err(Box::new(settings_side_error_response(
-            StatusCode::FORBIDDEN,
-            "Invalid signature",
-            "GET, PUT, OPTIONS",
-        )));
-    }
-    Ok(req)
-}
-
-async fn parse_deputy_owner_access(
-    routes: &StaticWebRoutes,
-    raw_query: Option<&str>,
-    init_data: Option<&str>,
-) -> Result<DeputyOwnerAccess, Response> {
-    let values = admin_auth_query_values(raw_query);
-    let chat_id = values
-        .get("chat_id")
-        .and_then(|value| value.parse::<i64>().ok())
-        .filter(|value| *value != 0)
-        .ok_or_else(|| {
-            settings_side_error_response(
-                StatusCode::BAD_REQUEST,
-                "Invalid chat_id",
-                "GET, PUT, OPTIONS",
-            )
-        })?;
-    let user_id = values
-        .get("user_id")
-        .and_then(|value| value.parse::<i64>().ok())
-        .filter(|value| *value != 0)
-        .ok_or_else(|| {
-            settings_side_error_response(
-                StatusCode::BAD_REQUEST,
-                "Invalid user_id",
-                "GET, PUT, OPTIONS",
-            )
-        })?;
-    if authenticate_settings_init_data(routes, init_data, user_id).is_err() {
-        return Err(settings_side_error_response(
-            StatusCode::UNAUTHORIZED,
-            "Unauthorized",
-            "GET, PUT, OPTIONS",
-        ));
-    }
-    let signature = values
-        .get("signature")
-        .filter(|value| !value.trim().is_empty())
-        .ok_or_else(|| {
-            settings_side_error_response(
-                StatusCode::BAD_REQUEST,
-                "Missing signature",
-                "GET, PUT, OPTIONS",
-            )
-        })?;
-    if !openplotva_web::validate_settings_access_signature(chat_id, user_id, signature) {
-        return Err(settings_side_error_response(
-            StatusCode::FORBIDDEN,
-            "Invalid signature",
-            "GET, PUT, OPTIONS",
-        ));
-    }
-    if chat_id == user_id {
-        return Err(settings_side_error_response(
-            StatusCode::BAD_REQUEST,
-            "Deputies are available only for chats",
-            "GET, PUT, OPTIONS",
-        ));
-    }
-    ensure_settings_chat_available(routes, chat_id, user_id).await?;
-    let Some(settings_store) = &routes.settings_store else {
-        return Err(settings_side_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "settings store not configured",
-            "GET, PUT, OPTIONS",
-        ));
-    };
-    let chat = settings_store
-        .get_chat_state(chat_id)
-        .await
-        .map_err(|_| {
-            settings_side_error_response(
-                StatusCode::NOT_FOUND,
-                "Chat not found",
-                "GET, PUT, OPTIONS",
-            )
-        })?
-        .ok_or_else(|| {
-            settings_side_error_response(
-                StatusCode::NOT_FOUND,
-                "Chat not found",
-                "GET, PUT, OPTIONS",
-            )
-        })?;
-    if !chat_allows_deputies(&chat) {
-        return Err(settings_side_error_response(
-            StatusCode::BAD_REQUEST,
-            "Deputies are available only for chats",
-            "GET, PUT, OPTIONS",
-        ));
-    }
-    Ok(DeputyOwnerAccess {
-        chat_id,
-        user_id,
-        is_global_admin: routes.admin_ids.contains(&user_id),
-    })
-}
-
-async fn ensure_deputy_management_permission(
-    routes: &StaticWebRoutes,
-    chat_id: i64,
-    user_id: i64,
-) -> Result<(), Response> {
-    let Some(member_store) = &routes.member_store else {
-        return Err(settings_side_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "settings store not configured",
-            "GET, PUT, OPTIONS",
-        ));
-    };
-    match member_store.get_chat_member(chat_id, user_id).await {
-        Ok(Some(member)) if member.status == openplotva_storage::CHAT_MEMBER_STATUS_CREATOR => {
-            return Ok(());
-        }
-        Ok(_) => {}
-        Err(error) => {
-            tracing::warn!(%error, chat_id, user_id, "deputy permission check failed");
-            return Err(settings_side_error_response(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "Permission check failed",
-                "GET, PUT, OPTIONS",
-            ));
-        }
-    }
-    if routes.telegram.is_some()
-        && let Ok(Some(member)) = refresh_chat_member_for_web(routes, chat_id, user_id).await
-        && member.status == openplotva_storage::CHAT_MEMBER_STATUS_CREATOR
-    {
-        return Ok(());
-    }
-    Err(settings_side_error_response(
-        StatusCode::FORBIDDEN,
-        "Unauthorized access",
-        "GET, PUT, OPTIONS",
-    ))
-}
-
-fn normalize_deputy_ids(values: &[i64], current_user_id: i64) -> Vec<i64> {
-    let mut seen = HashSet::with_capacity(values.len());
-    let mut result = Vec::with_capacity(values.len());
-    for value in values {
-        if *value <= 0 || *value == current_user_id || !seen.insert(*value) {
-            continue;
-        }
-        result.push(*value);
-    }
-    result.sort_unstable();
-    result
-}
-
-async fn validate_deputy_ids(
-    routes: &StaticWebRoutes,
-    chat_id: i64,
-    deputy_ids: &[i64],
-) -> Result<(), String> {
-    if deputy_ids.is_empty() {
-        return Ok(());
-    }
-    let Some(member_store) = &routes.member_store else {
-        return Err(format!("invalid deputy {}", deputy_ids[0]));
-    };
-    let members = member_store
-        .list_chat_members_by_user_ids(chat_id, deputy_ids)
-        .await
-        .map_err(|_| format!("invalid deputy {}", deputy_ids[0]))?;
-    let mut by_id = members
-        .into_iter()
-        .map(|member| (member.user_id, member))
-        .collect::<HashMap<_, _>>();
-    for deputy_id in deputy_ids {
-        if routes.telegram.is_some()
-            && !by_id.get(deputy_id).is_some_and(|member| {
-                openplotva_storage::is_active_chat_member_status(&member.status)
-            })
-            && let Ok(Some(member)) = refresh_chat_member_for_web(routes, chat_id, *deputy_id).await
-        {
-            by_id.insert(*deputy_id, member);
-        }
-        let Some(member) = by_id.get(deputy_id) else {
-            return Err(format!("invalid deputy {deputy_id}"));
-        };
-        if !openplotva_storage::is_active_chat_member_status(&member.status) {
-            return Err(format!("invalid deputy {deputy_id}"));
-        }
-    }
-    Ok(())
-}
-
-async fn list_deputy_summaries(
-    routes: &StaticWebRoutes,
-    chat_id: i64,
-) -> Result<Vec<SettingsDeputySummary>, String> {
-    let member_store = routes
-        .member_store
-        .as_ref()
-        .ok_or_else(|| "settings store not configured".to_owned())?;
-    list_deputy_summaries_from_store(member_store, chat_id).await
-}
-
-async fn list_deputy_summaries_from_store(
-    member_store: &PostgresChatMemberStore,
-    chat_id: i64,
-) -> Result<Vec<SettingsDeputySummary>, String> {
-    let deputy_ids = member_store
-        .list_chat_deputy_ids(chat_id)
-        .await
-        .map_err(|error| error.to_string())?;
-    if deputy_ids.is_empty() {
-        return Ok(Vec::new());
-    }
-    let members = member_store
-        .list_chat_members_by_user_ids(chat_id, &deputy_ids)
-        .await
-        .map_err(|error| error.to_string())?;
-    let users = member_store
-        .list_user_states_by_ids(&deputy_ids)
-        .await
-        .map_err(|error| error.to_string())?;
-    let members_by_id = members
-        .into_iter()
-        .map(|member| (member.user_id, member))
-        .collect::<HashMap<_, _>>();
-    let users_by_id = users
-        .into_iter()
-        .map(|user| (user.id, user))
-        .collect::<HashMap<_, _>>();
-    let mut deputies = Vec::with_capacity(deputy_ids.len());
-    for deputy_id in deputy_ids {
-        let Some(member) = members_by_id.get(&deputy_id) else {
-            continue;
-        };
-        if !openplotva_storage::is_active_chat_member_status(&member.status) {
-            continue;
-        }
-        let Some(user) = users_by_id.get(&deputy_id) else {
-            continue;
-        };
-        deputies.push(SettingsDeputySummary {
-            id: user.id,
-            first_name: user.first_name.clone(),
-            last_name: user.last_name.clone(),
-            username: user.username.clone(),
-            status: member.status.clone(),
-            display_name: build_deputy_display_name(
-                user.id,
-                &user.first_name,
-                user.last_name.as_deref(),
-                user.username.as_deref(),
-            ),
-        });
-    }
-    deputies.sort_by(|left, right| {
-        left.display_name
-            .cmp(&right.display_name)
-            .then_with(|| left.id.cmp(&right.id))
-    });
-    Ok(deputies)
-}
-
-fn build_deputy_display_name(
-    user_id: i64,
-    first_name: &str,
-    last_name: Option<&str>,
-    username: Option<&str>,
-) -> String {
-    let mut name = first_name.trim().to_owned();
-    if let Some(last_name) = last_name.map(str::trim).filter(|value| !value.is_empty()) {
-        if !name.is_empty() {
-            name.push(' ');
-        }
-        name.push_str(last_name);
-    }
-    if !name.is_empty() {
-        return name;
-    }
-    if let Some(username) = username.map(str::trim).filter(|value| !value.is_empty()) {
-        return format!("@{username}");
-    }
-    format!("User {user_id}")
-}
-
-fn parse_deputy_candidates_limit(value: Option<&str>) -> usize {
-    match value.and_then(|value| value.trim().parse::<usize>().ok()) {
-        Some(limit) if limit > 100 => 100,
-        Some(limit) if limit > 0 => limit,
-        _ => 50,
-    }
-}
-
-fn chat_allows_deputies(chat: &openplotva_core::ChatState) -> bool {
-    !chat.chat_type.trim().is_empty() && chat.chat_type != "private"
-}
-
-fn parse_settings_update_request(body: &[u8]) -> Result<SettingsUpdateRequest, Box<Response>> {
-    let mut req = serde_json::from_slice::<SettingsUpdateRequest>(body).map_err(|error| {
-        tracing::error!(%error, "invalid JSON in settings update request");
-        Box::new(settings_error_response(
-            StatusCode::BAD_REQUEST,
-            "Invalid JSON in request body",
-        ))
-    })?;
-    if req.chat_id == 0 {
-        return Err(Box::new(settings_error_response(
-            StatusCode::BAD_REQUEST,
-            "Chat ID is required",
-        )));
-    }
-    if req.signature.is_empty() {
-        return Err(Box::new(settings_error_response(
-            StatusCode::BAD_REQUEST,
-            "Missing signature",
-        )));
-    }
-    if !openplotva_web::validate_settings_access_signature(req.chat_id, req.user_id, &req.signature)
-    {
-        return Err(Box::new(settings_error_response(
-            StatusCode::FORBIDDEN,
-            "Invalid signature",
-        )));
-    }
-    req.custom_persona = openplotva_web::truncate_custom_persona(req.custom_persona);
-    Ok(req)
-}
-
-async fn ensure_settings_chat_available(
-    routes: &StaticWebRoutes,
-    chat_id: i64,
-    user_id: i64,
-) -> Result<(), Response> {
-    if chat_id == user_id {
-        return Ok(());
-    }
-    let Some(settings_store) = &routes.settings_store else {
-        return Err(settings_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "settings store not configured",
-        ));
-    };
-    match settings_store.get_chat_state(chat_id).await {
-        Ok(Some(_)) => ensure_settings_bot_membership(routes, chat_id).await,
-        Ok(None) => {
-            refresh_settings_chat_from_telegram(routes, chat_id).await?;
-            ensure_settings_bot_membership(routes, chat_id).await
-        }
-        Err(error) => {
-            tracing::warn!(%error, chat_id, "failed to validate chat availability");
-            Err(settings_error_response(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "Failed to validate chat availability",
-            ))
-        }
-    }
-}
-
-async fn refresh_settings_chat_from_telegram(
-    routes: &StaticWebRoutes,
-    chat_id: i64,
-) -> Result<(), Response> {
-    let Some(telegram) = &routes.telegram else {
-        return Err(settings_error_response(
-            StatusCode::NOT_FOUND,
-            "Chat not found",
-        ));
-    };
-    let Some(state_store) = &routes.state_store else {
-        return Err(settings_error_response(
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "Failed to validate chat availability",
-        ));
-    };
-    let chat = telegram
-        .execute(openplotva_telegram::build_get_chat_method(chat_id))
-        .await
-        .map_err(|error| {
-            tracing::debug!(%error, chat_id, "Telegram getChat failed for settings availability");
-            settings_error_response(StatusCode::NOT_FOUND, "Chat not found")
-        })?;
-    let chat_state = settings_chat_state_from_full_info(chat);
-    state_store
-        .upsert_chat_state(&chat_state)
-        .await
-        .map_err(|error| {
-            tracing::warn!(%error, chat_id, "failed to persist Telegram chat freshness for settings availability");
-            settings_error_response(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "Failed to validate chat availability",
-            )
-        })
-}
-
-async fn ensure_settings_bot_membership(
-    routes: &StaticWebRoutes,
-    chat_id: i64,
-) -> Result<(), Response> {
-    let (Some(telegram), Some(bot_id)) = (&routes.telegram, routes.bot_id) else {
-        return Ok(());
-    };
-    let Some(member_store) = &routes.member_store else {
-        return Err(settings_error_response(
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "Failed to validate chat availability",
-        ));
-    };
-    match member_store.get_chat_member(chat_id, bot_id).await {
-        Ok(Some(member)) if openplotva_storage::is_active_chat_member_status(&member.status) => {
-            return Ok(());
-        }
-        Ok(_) => {}
-        Err(error) => {
-            tracing::debug!(%error, chat_id, bot_id, "failed to load cached bot membership for settings availability");
-        }
-    }
-    let member = settings::GroupSettingsMemberApi::get_chat_member(telegram, chat_id, bot_id)
-        .await
-        .map_err(|error| {
-            tracing::warn!(%error, chat_id, bot_id, "Telegram bot membership check failed for settings availability");
-            settings_error_response(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "Failed to validate chat availability",
-            )
-        })?;
-    let upsert = settings::chat_member_upsert_from_telegram(chat_id, bot_id, &member);
-    if let Err(error) = member_store.upsert_chat_member(&upsert).await {
-        tracing::debug!(%error, chat_id, bot_id, "failed to persist Telegram bot membership freshness for settings availability");
-    }
-    let user_state = settings::user_state_from_telegram_user(member.get_user());
-    if let Err(error) = member_store.upsert_user_state(&user_state).await {
-        tracing::debug!(%error, chat_id, bot_id, "failed to persist Telegram bot user freshness for settings availability");
-    }
-    if openplotva_storage::is_active_chat_member_status(&upsert.status) {
-        Ok(())
-    } else {
-        Err(settings_error_response(
-            StatusCode::NOT_FOUND,
-            "Chat not found",
-        ))
-    }
-}
-
-fn settings_chat_state_from_full_info(
-    chat: openplotva_telegram::ChatFullInfo,
-) -> openplotva_core::ChatState {
-    openplotva_core::ChatState::new(
-        chat.id,
-        settings_chat_full_info_type_name(chat.chat_type),
-        chat.title,
-        chat.username,
-        chat.first_name,
-        chat.last_name,
-        chat.is_forum,
-    )
-}
-
-fn settings_chat_full_info_type_name(chat_type: carapax::types::ChatFullInfoType) -> &'static str {
-    match chat_type {
-        carapax::types::ChatFullInfoType::Channel => "channel",
-        carapax::types::ChatFullInfoType::Group => "group",
-        carapax::types::ChatFullInfoType::Private => "private",
-        carapax::types::ChatFullInfoType::Supergroup => "supergroup",
-    }
-}
-
-async fn authorize_settings_user(
-    routes: &StaticWebRoutes,
-    access: SettingsAccess,
-) -> Result<(), Response> {
-    if access.user_id <= 0 {
-        return Err(settings_error_response(
-            StatusCode::UNAUTHORIZED,
-            "Unauthorized access",
-        ));
-    }
-    if access.is_global_admin {
-        return Ok(());
-    }
-    match settings_user_can_edit(routes, access.chat_id, access.user_id).await {
-        Ok(true) => Ok(()),
-        Ok(false) => Err(settings_error_response(
-            StatusCode::FORBIDDEN,
-            "Unauthorized access",
-        )),
-        Err(error) => {
-            tracing::warn!(%error, chat_id = access.chat_id, user_id = access.user_id, "settings permission check failed");
-            Err(settings_error_response(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "Permission check failed",
-            ))
-        }
-    }
-}
-
-async fn authorize_settings_memory_user(
-    routes: &StaticWebRoutes,
-    access: SettingsAccess,
-) -> Result<(), Response> {
-    if access.user_id <= 0 {
-        return Err(settings_error_response(
-            StatusCode::UNAUTHORIZED,
-            "Unauthorized access",
-        ));
-    }
-    match settings_user_can_edit(routes, access.chat_id, access.user_id).await {
-        Ok(true) => Ok(()),
-        Ok(false) => Err(settings_error_response(
-            StatusCode::FORBIDDEN,
-            "Unauthorized access",
-        )),
-        Err(error) => {
-            tracing::warn!(%error, chat_id = access.chat_id, user_id = access.user_id, "settings memory permission check failed");
-            Err(settings_error_response(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "Permission check failed",
-            ))
-        }
-    }
-}
-
-async fn settings_user_can_edit(
-    routes: &StaticWebRoutes,
-    chat_id: i64,
-    user_id: i64,
-) -> Result<bool, String> {
-    if user_id == 0 {
-        return Err("user ID is required".to_owned());
-    }
-    if chat_id == user_id {
-        return Ok(true);
-    }
-    let settings_store = routes
-        .settings_store
-        .as_ref()
-        .ok_or_else(|| "settings store not configured".to_owned())?;
-    let member_store = routes
-        .member_store
-        .as_ref()
-        .ok_or_else(|| "settings store not configured".to_owned())?;
-    let Some(chat) = settings_store
-        .get_chat_state(chat_id)
-        .await
-        .map_err(|error| error.to_string())?
-    else {
-        return Err("failed to get chat info".to_owned());
-    };
-    if chat.chat_type == "private" {
-        return Ok(false);
-    }
-    let mut member = member_store
-        .get_chat_member(chat_id, user_id)
-        .await
-        .map_err(|error| error.to_string())?;
-    if !stored_chat_member_is_fresh(member.as_ref(), OffsetDateTime::now_utc()) {
-        member = refresh_chat_member_for_web(routes, chat_id, user_id).await?;
-    }
-    if openplotva_storage::stored_member_can_open_group_settings(member.as_ref()) {
-        return Ok(true);
-    }
-    let Some(member) = member.as_ref() else {
-        return Ok(false);
-    };
-    if !openplotva_storage::is_active_chat_member_status(&member.status) {
-        return Ok(false);
-    }
-    let deputy_ids = member_store
-        .list_chat_deputy_ids(chat_id)
-        .await
-        .map_err(|error| error.to_string())?;
-    Ok(deputy_ids.contains(&user_id))
-}
-
-fn stored_chat_member_is_fresh(
-    member: Option<&openplotva_storage::ChatMemberRecord>,
-    now: OffsetDateTime,
-) -> bool {
-    const MAX_AGE_SECONDS: i64 = 5 * 60;
-
-    member
-        .and_then(|member| member.telegram_observed_at)
-        .is_some_and(|observed_at| {
-            observed_at <= now
-                && now
-                    .unix_timestamp()
-                    .saturating_sub(observed_at.unix_timestamp())
-                    <= MAX_AGE_SECONDS
-        })
-}
-
-async fn refresh_chat_member_for_web(
-    routes: &StaticWebRoutes,
-    chat_id: i64,
-    user_id: i64,
-) -> Result<Option<openplotva_storage::ChatMemberRecord>, String> {
-    let member_store = routes
-        .member_store
-        .as_ref()
-        .ok_or_else(|| "settings store not configured".to_owned())?;
-    let telegram = routes
-        .telegram
-        .as_ref()
-        .ok_or_else(|| "Telegram membership check not configured".to_owned())?;
-    if chat_id == 0 || user_id == 0 {
-        return Ok(None);
-    }
-
-    match settings::GroupSettingsMemberApi::get_chat_member(telegram, chat_id, user_id).await {
-        Ok(member) => {
-            let upsert = settings::chat_member_upsert_from_telegram(chat_id, user_id, &member);
-            if let Err(error) = member_store.upsert_chat_member(&upsert).await {
-                tracing::debug!(%error, chat_id, user_id, "failed to persist Telegram member freshness for web route");
-                return Ok(Some(chat_member_record_from_upsert(&upsert)));
-            }
-            let user_state = settings::user_state_from_telegram_user(member.get_user());
-            if let Err(error) = member_store.upsert_user_state(&user_state).await {
-                tracing::debug!(%error, chat_id, user_id, "failed to persist Telegram user freshness for web route");
-            }
-            member_store
-                .get_chat_member(chat_id, user_id)
-                .await
-                .map(|stored| stored.or_else(|| Some(chat_member_record_from_upsert(&upsert))))
-                .map_err(|error| error.to_string())
-        }
-        Err(error) => {
-            tracing::warn!(%error, chat_id, user_id, "Telegram member freshness failed for web route");
-            Err("Telegram membership check failed".to_owned())
-        }
-    }
-}
-
-fn chat_member_record_from_upsert(
-    upsert: &openplotva_storage::ChatMemberUpsert,
-) -> openplotva_storage::ChatMemberRecord {
-    openplotva_storage::ChatMemberRecord {
-        chat_id: upsert.chat_id,
-        user_id: upsert.user_id,
-        status: upsert.status.clone(),
-        is_member: upsert.is_member,
-        is_anonymous: upsert.is_anonymous,
-        custom_title: upsert.custom_title.clone(),
-        can_be_edited: upsert.can_be_edited,
-        can_manage_chat: upsert.can_manage_chat,
-        can_delete_messages: upsert.can_delete_messages,
-        can_manage_video_chats: upsert.can_manage_video_chats,
-        can_restrict_members: upsert.can_restrict_members,
-        can_promote_members: upsert.can_promote_members,
-        can_change_info: upsert.can_change_info,
-        can_invite_users: upsert.can_invite_users,
-        can_post_messages: upsert.can_post_messages,
-        can_edit_messages: upsert.can_edit_messages,
-        can_pin_messages: upsert.can_pin_messages,
-        can_manage_topics: upsert.can_manage_topics,
-        can_send_messages: upsert.can_send_messages,
-        can_send_media_messages: upsert.can_send_media_messages,
-        can_send_polls: upsert.can_send_polls,
-        can_send_other_messages: upsert.can_send_other_messages,
-        can_add_web_page_previews: upsert.can_add_web_page_previews,
-        until_date: upsert.until_date,
-        telegram_observed_at: Some(OffsetDateTime::now_utc()),
-    }
-}
-
-async fn settings_update_chat(
-    routes: &StaticWebRoutes,
-    chat_id: i64,
-    user_id: i64,
-) -> Result<openplotva_core::ChatState, Response> {
-    let Some(settings_store) = &routes.settings_store else {
-        return Err(settings_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "settings store not configured",
-        ));
-    };
-    match settings_store.get_chat_state(chat_id).await {
-        Ok(Some(chat)) => Ok(chat),
-        Ok(None) if chat_id == user_id && user_id != 0 => {
-            create_private_settings_chat(routes, chat_id).await
-        }
-        Ok(None) => Err(settings_error_response(
-            StatusCode::NOT_FOUND,
-            "Chat not found",
-        )),
-        Err(error) => {
-            tracing::error!(%error, chat_id, "chat not found for settings update");
-            Err(settings_error_response(
-                StatusCode::NOT_FOUND,
-                "Chat not found",
-            ))
-        }
-    }
-}
-
-async fn create_private_settings_chat(
-    routes: &StaticWebRoutes,
-    chat_id: i64,
-) -> Result<openplotva_core::ChatState, Response> {
-    let chat = openplotva_core::ChatState::new(chat_id, "private", None, None, None, None, None);
-    if let Some(store) = &routes.state_store
-        && let Err(error) = store.upsert_chat_state(&chat).await
-    {
-        tracing::error!(%error, chat_id, "failed to create private chat record");
-        return Err(settings_error_response(
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "Failed to initialize chat",
-        ));
-    }
-    Ok(chat)
-}
-
-async fn settings_chat_display_for_read(
-    routes: &StaticWebRoutes,
-    chat_id: i64,
-    user_id: i64,
-) -> (String, String) {
-    let Some(settings_store) = &routes.settings_store else {
-        return (String::new(), String::new());
-    };
-    match settings_store.get_chat_state(chat_id).await {
-        Ok(Some(chat)) => settings_chat_display(&chat),
-        Ok(None) | Err(_) if chat_id == user_id && user_id != 0 => {
-            let _ = create_private_settings_chat(routes, chat_id).await;
-            (String::new(), "private".to_owned())
-        }
-        Ok(None) | Err(_) => (String::new(), String::new()),
-    }
-}
-
-fn settings_chat_display(chat: &openplotva_core::ChatState) -> (String, String) {
-    if let Some(title) = chat.title.as_ref().filter(|value| !value.is_empty()) {
-        return (title.clone(), chat.chat_type.clone());
-    }
-    let private_name = settings_chat_name(chat.first_name.as_deref(), chat.last_name.as_deref());
-    if !private_name.is_empty() {
-        return (private_name, chat.chat_type.clone());
-    }
-    if let Some(username) = chat.username.as_ref().filter(|value| !value.is_empty()) {
-        return (format!("@{username}"), chat.chat_type.clone());
-    }
-    (String::new(), chat.chat_type.clone())
-}
-
-fn settings_chat_name(first_name: Option<&str>, last_name: Option<&str>) -> String {
-    let Some(first_name) = first_name else {
-        return String::new();
-    };
-    let mut title = first_name.to_owned();
-    if let Some(last_name) = last_name.filter(|value| !value.is_empty()) {
-        title.push(' ');
-        title.push_str(last_name);
-    }
-    title
-}
-
-fn new_settings_response(
-    settings: &openplotva_core::ChatSettings,
-    chat_title: String,
-    chat_type: String,
-) -> SettingsResponseBody {
-    SettingsResponseBody {
-        chat_id: settings.chat_id,
-        chat_title,
-        chat_type,
-        mood_alignment: settings.mood_alignment.clone(),
-        custom_persona: settings.custom_persona.clone(),
-        reactivity_percentage: settings.reactivity_percentage,
-        proactivity_percentage: settings.proactivity_percentage,
-        enable_obscenifier: settings.enable_obscenifier,
-        enable_profanity: settings.enable_profanity,
-        enable_greet_joiners: settings.enable_greet_joiners,
-        enable_global_text_reply: settings.enable_global_text_reply,
-        enable_global_draw_reply: settings.enable_global_draw_reply,
-        enable_daily_game: settings.enable_daily_game.unwrap_or(true),
-        daily_game_theme: chat_setting_daily_game_theme(settings.daily_game_theme.as_deref()),
-        greeting_html: settings.greeting_html.clone(),
-        is_vip: false,
-        disable_random_reactivity: false,
-        hide_original_draw_prompt: false,
-        is_deputy: false,
-        can_manage_deputies: false,
-        deputies: Vec::new(),
-    }
-}
-
-fn chat_setting_daily_game_theme(theme: Option<&str>) -> String {
-    theme
-        .filter(|value| !value.is_empty())
-        .unwrap_or("auto")
-        .to_owned()
-}
-
-fn apply_private_chat_response_defaults(
-    response: &mut SettingsResponseBody,
-    chat_id: i64,
-    user_id: i64,
-) {
-    if chat_id == user_id && user_id != 0 {
-        response.enable_global_text_reply = true;
-        response.enable_global_draw_reply = true;
-    }
-}
-
-async fn apply_user_settings_response(
-    routes: &StaticWebRoutes,
-    response: &mut SettingsResponseBody,
-    user_id: i64,
-) {
-    if user_id != 0 {
-        response.is_vip = settings_user_is_vip(routes, user_id).await;
-        if let Some(settings_store) = &routes.settings_store
-            && let Ok(Some(user_settings)) = settings_store.get_user_settings(user_id).await
-        {
-            response.disable_random_reactivity = user_settings.disable_random_reactivity;
-            if response.is_vip {
-                response.hide_original_draw_prompt = user_settings.hide_original_draw_prompt;
-            }
-        }
-    }
-    if !response.is_vip {
-        response.hide_original_draw_prompt = false;
-    }
-}
-
-async fn settings_user_is_vip(routes: &StaticWebRoutes, user_id: i64) -> bool {
-    if user_id <= 0 {
-        return false;
-    }
-    if let Some(vip_status) = &routes.vip_status {
-        return vip_status
-            .is_vip_at(user_id, OffsetDateTime::now_utc())
-            .await;
-    }
-    let Some(vip_store) = &routes.vip_store else {
-        return false;
-    };
-    if let Ok(Some(summary)) = vip_store.get_vip_summary_by_user(user_id).await
-        && summary.is_active
-        && OffsetDateTime::now_utc() < summary.effective_expires_at
-    {
-        return true;
-    }
-    vip_store
-        .get_vip_cache(user_id)
-        .await
-        .ok()
-        .flatten()
-        .is_some_and(|cache| cache.is_vip && OffsetDateTime::now_utc() < cache.expires_at)
-}
-
-async fn apply_deputy_settings_response(
-    member_store: &PostgresChatMemberStore,
-    response: &mut SettingsResponseBody,
-    chat_id: i64,
-    user_id: i64,
-    chat_type: &str,
-    is_global_admin: bool,
-) {
-    if chat_id == user_id || chat_type == "private" {
-        return;
-    }
-    let deputy_ids = member_store
-        .list_chat_deputy_ids(chat_id)
-        .await
-        .unwrap_or_default();
-    let member = member_store
-        .get_chat_member(chat_id, user_id)
-        .await
-        .ok()
-        .flatten();
-    response.is_deputy = member
-        .as_ref()
-        .is_some_and(|member| openplotva_storage::is_active_chat_member_status(&member.status))
-        && deputy_ids.contains(&user_id);
-    response.can_manage_deputies = is_global_admin
-        || member
-            .as_ref()
-            .is_some_and(|member| member.status == openplotva_storage::CHAT_MEMBER_STATUS_CREATOR);
-    if response.can_manage_deputies {
-        response.deputies = list_deputy_summaries_from_store(member_store, chat_id)
-            .await
-            .unwrap_or_default();
-    }
-}
-
-async fn settings_update_from_request(
-    settings_store: &PostgresChatSettingsStore,
-    req: &SettingsUpdateRequest,
-    chat: &openplotva_core::ChatState,
-) -> openplotva_core::ChatSettingsUpdate {
-    let (enable_global_text_reply, enable_global_draw_reply) =
-        settings_reply_flags(&chat.chat_type, req);
-    let (enable_daily_game, daily_game_theme) =
-        daily_game_update(settings_store, req, is_group_chat_type(&chat.chat_type)).await;
-    openplotva_core::ChatSettingsUpdate {
-        chat_id: req.chat_id,
-        chat_type: chat.chat_type.clone(),
-        mood_alignment: req.mood_alignment.clone(),
-        custom_persona: req.custom_persona.clone(),
-        reactivity_percentage: req.reactivity_percentage.unwrap_or(50),
-        proactivity_percentage: req.proactivity_percentage.unwrap_or(50),
-        enable_global_text_reply,
-        enable_global_draw_reply,
-        enable_obscenifier: req.enable_obscenifier.unwrap_or(true),
-        enable_profanity: req.enable_profanity.unwrap_or(true),
-        enable_greet_joiners: req.enable_greet_joiners.unwrap_or(false),
-        enable_daily_game,
-        daily_game_theme: chat_setting_daily_game_theme(daily_game_theme.as_deref()),
-        greeting_html: req.greeting_html.clone(),
-    }
-}
-
-fn settings_reply_flags(chat_type: &str, req: &SettingsUpdateRequest) -> (bool, bool) {
-    let mut enable_global_text_reply = req.enable_global_text_reply.unwrap_or(true);
-    let mut enable_global_draw_reply = req.enable_global_draw_reply.unwrap_or(true);
-    if chat_type == "private" {
-        enable_global_text_reply = true;
-        enable_global_draw_reply = true;
-    }
-    (enable_global_text_reply, enable_global_draw_reply)
-}
-
-async fn daily_game_update(
-    settings_store: &PostgresChatSettingsStore,
-    req: &SettingsUpdateRequest,
-    is_group: bool,
-) -> (bool, Option<String>) {
-    let current = settings_store
-        .get_chat_settings(req.chat_id)
-        .await
-        .ok()
-        .flatten();
-    let mut daily_enabled = current
-        .as_ref()
-        .and_then(|settings| settings.enable_daily_game)
-        .unwrap_or(true);
-    let mut daily_theme = current.and_then(|settings| settings.daily_game_theme);
-    if is_group {
-        if let Some(enabled) = req.enable_daily_game {
-            daily_enabled = enabled;
-        }
-        if req.daily_game_theme.is_some() {
-            daily_theme = req.daily_game_theme.clone();
-        }
-    }
-    (daily_enabled, daily_theme)
-}
-
-fn is_group_chat_type(chat_type: &str) -> bool {
-    chat_type == "group" || chat_type == "supergroup"
-}
-
-async fn update_user_settings_from_request(routes: &StaticWebRoutes, req: &SettingsUpdateRequest) {
-    if req.user_id == 0
-        || (req.disable_random_reactivity.is_none() && req.hide_original_draw_prompt.is_none())
-    {
-        return;
-    }
-    let Some(settings_store) = &routes.settings_store else {
-        return;
-    };
-    let current = settings_store
-        .get_user_settings(req.user_id)
-        .await
-        .ok()
-        .flatten();
-    let disable_random_reactivity = req.disable_random_reactivity.unwrap_or_else(|| {
-        current
-            .as_ref()
-            .is_some_and(|settings| settings.disable_random_reactivity)
-    });
-    let mut hide_original_draw_prompt = current
-        .as_ref()
-        .is_some_and(|settings| settings.hide_original_draw_prompt);
-    if settings_user_is_vip(routes, req.user_id).await {
-        if let Some(hide) = req.hide_original_draw_prompt {
-            hide_original_draw_prompt = hide;
-        }
-    } else {
-        hide_original_draw_prompt = false;
-    }
-    if let Err(error) = settings_store
-        .upsert_user_settings(
-            req.user_id,
-            disable_random_reactivity,
-            hide_original_draw_prompt,
-        )
-        .await
-    {
-        tracing::warn!(%error, user_id = req.user_id, "failed to update user settings");
-    }
-}
-
-async fn managed_chat_list_items(
-    routes: &StaticWebRoutes,
-    settings_store: &PostgresChatSettingsStore,
-    member_store: &PostgresChatMemberStore,
-    user_id: i64,
-) -> Vec<ChatListItem> {
-    let chats = match settings_store.list_user_chats(user_id).await {
-        Ok(chats) => chats,
-        Err(error) => {
-            tracing::debug!(%error, user_id, "failed to list user chats");
-            return Vec::new();
-        }
-    };
-    let memberships = member_store.list_user_chat_memberships(user_id).await;
-    let membership_fallback = memberships.is_err();
-    let members_by_chat_id = memberships
-        .unwrap_or_default()
-        .into_iter()
-        .map(|member| (member.chat_id, member))
-        .collect::<HashMap<_, _>>();
-    let deputy_chats = member_store.list_user_deputy_chat_ids(user_id).await;
-    let deputy_fallback = deputy_chats.is_err();
-    let deputy_chat_ids = deputy_chats
-        .unwrap_or_default()
-        .into_iter()
-        .collect::<HashSet<_>>();
-
-    let mut result = Vec::with_capacity(chats.len());
-    for chat in chats {
-        let mut member = if membership_fallback {
-            member_store
-                .get_chat_member(chat.id, user_id)
-                .await
-                .ok()
-                .flatten()
-        } else {
-            members_by_chat_id.get(&chat.id).cloned()
-        };
-        if routes.telegram.is_some()
-            && (!stored_chat_member_is_fresh(member.as_ref(), OffsetDateTime::now_utc())
-                || !member
-                    .as_ref()
-                    .is_some_and(|member| chat_member_can_manage_settings(member, false)))
-            && let Ok(fresh) = refresh_chat_member_for_web(routes, chat.id, user_id).await
-        {
-            member = fresh;
-        }
-        let Some(member) = member else {
-            continue;
-        };
-        let is_deputy = user_is_deputy_for_managed_chat(
-            member_store,
-            user_id,
-            chat.id,
-            &member,
-            &deputy_chat_ids,
-            deputy_fallback,
-        )
-        .await;
-        if !chat_member_can_manage_settings(&member, is_deputy) {
-            continue;
-        }
-        result.push(ChatListItem {
-            id: chat.id,
-            title: chat_list_title(&chat),
-            chat_type: chat.chat_type,
-        });
-    }
-    result
-}
-
-async fn user_is_deputy_for_managed_chat(
-    member_store: &PostgresChatMemberStore,
-    user_id: i64,
-    chat_id: i64,
-    member: &openplotva_storage::ChatMemberRecord,
-    deputy_chat_ids: &HashSet<i64>,
-    fallback: bool,
-) -> bool {
-    if chat_member_can_manage_settings(member, false)
-        || !openplotva_storage::is_active_chat_member_status(&member.status)
-    {
-        return false;
-    }
-    if !fallback {
-        return deputy_chat_ids.contains(&chat_id);
-    }
-    member_store
-        .list_chat_deputy_ids(chat_id)
-        .await
-        .is_ok_and(|ids| ids.contains(&user_id))
-}
-
-fn chat_member_can_manage_settings(
-    member: &openplotva_storage::ChatMemberRecord,
-    is_deputy: bool,
-) -> bool {
-    member.status == openplotva_storage::CHAT_MEMBER_STATUS_CREATOR
-        || is_deputy
-        || member.status == openplotva_storage::CHAT_MEMBER_STATUS_ADMINISTRATOR
-            && member.can_promote_members == Some(true)
-}
-
-fn chat_list_title(chat: &openplotva_core::ChatState) -> String {
-    let (title, _) = settings_chat_display(chat);
-    if title.is_empty() {
-        format!("Chat {}", chat.id)
-    } else {
-        title
-    }
-}
-
-async fn parse_settings_memory_access(
-    routes: &StaticWebRoutes,
-    raw_query: Option<&str>,
-    init_data: Option<&str>,
-) -> Result<(i64, i64, openplotva_memory::RetrievalScope), Response> {
-    let values = admin_auth_query_values(raw_query);
-    let chat_id = values
-        .get("chat_id")
-        .and_then(|value| value.parse::<i64>().ok())
-        .filter(|value| *value != 0)
-        .ok_or_else(|| {
-            settings_side_error_response(
-                StatusCode::BAD_REQUEST,
-                "invalid chat_id",
-                "GET, DELETE, OPTIONS",
-            )
-        })?;
-    let signature = values
-        .get("signature")
-        .filter(|value| !value.is_empty())
-        .ok_or_else(|| {
-            settings_side_error_response(
-                StatusCode::BAD_REQUEST,
-                "missing signature",
-                "GET, DELETE, OPTIONS",
-            )
-        })?;
-    let user_id = values
-        .get("user_id")
-        .and_then(|value| value.parse::<i64>().ok())
-        .unwrap_or(0);
-    if authenticate_settings_init_data(routes, init_data, user_id).is_err() {
-        return Err(settings_side_error_response(
-            StatusCode::UNAUTHORIZED,
-            "unauthorized",
-            "GET, DELETE, OPTIONS",
-        ));
-    }
-    if !openplotva_web::validate_settings_access_signature(chat_id, user_id, signature) {
-        return Err(settings_side_error_response(
-            StatusCode::FORBIDDEN,
-            "invalid signature",
-            "GET, DELETE, OPTIONS",
-        ));
-    }
-    if let Err(error) = authorize_settings_memory_user(
-        routes,
-        SettingsAccess {
-            chat_id,
-            user_id,
-            is_global_admin: false,
-        },
-    )
-    .await
-    {
-        return Err(match error.status() {
-            StatusCode::FORBIDDEN => settings_side_error_response(
-                StatusCode::FORBIDDEN,
-                "unauthorized access",
-                "GET, DELETE, OPTIONS",
-            ),
-            _ => settings_side_error_response(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "permission check failed",
-                "GET, DELETE, OPTIONS",
-            ),
-        });
-    }
-    let thread_id = values
-        .get("thread_id")
-        .map(String::as_str)
-        .map(parse_optional_i32)
-        .unwrap_or(0);
-    let mut scope = openplotva_memory::RetrievalScope {
-        chat_id,
-        thread_id,
-        user_id,
-        ..openplotva_memory::RetrievalScope::default()
-    };
-    if let Some(settings_store) = &routes.settings_store
-        && let Ok(Some(meta)) = settings_store.get_dialog_memory_chat_meta(chat_id).await
-    {
-        scope.chat_type = meta.chat_type;
-        scope.username = meta.username;
-        scope.active_usernames = meta.active_usernames;
-    }
-    Ok((chat_id, user_id, scope))
-}
-
-fn parse_memory_limit(value: Option<&str>) -> usize {
-    match value.and_then(|value| value.trim().parse::<usize>().ok()) {
-        Some(limit) if limit > 500 => 500,
-        Some(limit) if limit > 0 => limit,
-        _ => 100,
-    }
-}
-
-fn parse_optional_i32(value: &str) -> i32 {
-    value
-        .trim()
-        .parse::<i32>()
-        .ok()
-        .filter(|value| *value >= 0)
-        .unwrap_or(0)
-}
-
-fn settings_options_response() -> Response {
-    let mut response = StatusCode::OK.into_response();
-    add_settings_api_headers(response.headers_mut());
-    response
-}
-
-fn settings_error_response(status: StatusCode, error: &str) -> Response {
-    settings_json_raw_response(status, &format!(r#"{{"error": "{error}"}}"#))
-}
-
-fn settings_json_response<T: Serialize>(status: StatusCode, value: &T) -> Response {
-    let body = match serde_json::to_string(value) {
-        Ok(body) => body,
-        Err(error) => {
-            tracing::error!(%error, "failed to encode settings response");
-            r#"{"error": "Failed to encode response"}"#.to_owned()
-        }
-    };
-    settings_json_raw_response(status, &body)
-}
-
-fn settings_json_raw_response(status: StatusCode, body: &str) -> Response {
-    let mut response = (
-        status,
-        [(header::CONTENT_TYPE, "application/json")],
-        format!("{body}\n"),
-    )
-        .into_response();
-    add_settings_api_headers(response.headers_mut());
-    response
-}
-
-fn settings_side_options_response(methods: &'static str) -> Response {
-    let mut response = StatusCode::OK.into_response();
-    add_settings_side_api_headers(response.headers_mut(), methods);
-    response
-}
-
-fn settings_side_error_response(
-    status: StatusCode,
-    error: &str,
-    methods: &'static str,
-) -> Response {
-    settings_side_json_raw_response(
-        status,
-        &serde_json::json!({ "error": error }).to_string(),
-        methods,
-    )
-}
-
-fn settings_side_json_response<T: Serialize>(
-    status: StatusCode,
-    value: &T,
-    methods: &'static str,
-) -> Response {
-    let body = serde_json::to_string(value).unwrap_or_else(|error| {
-        tracing::error!(%error, "failed to encode settings side response");
-        r#"{"error":"Failed to encode response"}"#.to_owned()
-    });
-    settings_side_json_raw_response(status, &body, methods)
-}
-
-fn settings_side_json_raw_response(
-    status: StatusCode,
-    body: &str,
-    methods: &'static str,
-) -> Response {
-    let mut response = (
-        status,
-        [(header::CONTENT_TYPE, "application/json")],
-        format!("{body}\n"),
-    )
-        .into_response();
-    add_settings_side_api_headers(response.headers_mut(), methods);
-    response
-}
-
-fn add_settings_api_headers(headers: &mut HeaderMap) {
-    headers.insert(
-        header::ACCESS_CONTROL_ALLOW_ORIGIN,
-        HeaderValue::from_static("*"),
-    );
-    headers.insert(
-        header::ACCESS_CONTROL_ALLOW_METHODS,
-        HeaderValue::from_static("GET, POST, PUT, OPTIONS"),
-    );
-    headers.insert(
-        header::ACCESS_CONTROL_ALLOW_HEADERS,
-        HeaderValue::from_static("Content-Type, Authorization"),
-    );
-}
-
-fn add_settings_side_api_headers(headers: &mut HeaderMap, methods: &'static str) {
-    headers.insert(
-        header::ACCESS_CONTROL_ALLOW_ORIGIN,
-        HeaderValue::from_static("*"),
-    );
-    headers.insert(
-        header::ACCESS_CONTROL_ALLOW_METHODS,
-        HeaderValue::from_static(methods),
-    );
-    headers.insert(
-        header::ACCESS_CONTROL_ALLOW_HEADERS,
-        HeaderValue::from_static("Content-Type, Authorization"),
-    );
-}
-
-/// Maximum age of a Telegram Login `auth_date` accepted for admin authentication.
-const ADMIN_AUTH_MAX_AGE_SECONDS: i64 = 86_400; // 24h; tighten later if desired
-/// Small tolerance for clock skew on `auth_date` values slightly in the future.
-const ADMIN_AUTH_FUTURE_SKEW_SECONDS: i64 = 60;
-
-/// Returns true if `auth_date` (unix seconds) is within the accepted freshness window
-/// relative to `now`. Missing/unparseable dates and far-future dates are rejected.
-fn admin_auth_date_is_fresh(values: &BTreeMap<String, String>, now: OffsetDateTime) -> bool {
-    let Some(auth_date) = values
-        .get("auth_date")
-        .and_then(|v| v.trim().parse::<i64>().ok())
-    else {
-        return false;
-    };
-    let now_unix = now.unix_timestamp();
-    let age = now_unix - auth_date;
-    (-ADMIN_AUTH_FUTURE_SKEW_SECONDS..=ADMIN_AUTH_MAX_AGE_SECONDS).contains(&age)
-}
-
-async fn admin_auth_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET && method != Method::POST {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-
-    let values = admin_auth_query_values(raw_query);
-    let Some(user_id_raw) = values.get("id").filter(|value| !value.is_empty()) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "missing parameters");
-    };
-    let Some(hash) = values.get("hash").filter(|value| !value.is_empty()) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "missing parameters");
-    };
-    let Ok(user_id) = user_id_raw.parse::<i64>() else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "invalid user id");
-    };
-    if routes.bot_token.is_empty() {
-        return admin_error_response(StatusCode::BAD_REQUEST, "bot token not configured");
-    }
-
-    let pairs = values
-        .iter()
-        .map(|(key, value)| (key.as_str(), value.as_str()));
-    if !openplotva_web::validate_telegram_auth(pairs, &routes.bot_token, hash) {
-        tracing::error!("invalid admin auth signature");
-        return admin_error_response(StatusCode::FORBIDDEN, "invalid auth");
-    }
-
-    if !admin_auth_date_is_fresh(&values, OffsetDateTime::now_utc()) {
-        tracing::error!("admin auth rejected: stale or missing auth_date");
-        return admin_error_response(StatusCode::FORBIDDEN, "auth expired");
-    }
-
-    if !routes.admin_ids.contains(&user_id) {
-        tracing::error!(user_id, "authenticated Telegram user is not an admin");
-        return admin_error_response(StatusCode::FORBIDDEN, "forbidden");
-    }
-
-    persist_admin_session_user(routes, &values, user_id).await;
-    (
-        StatusCode::FOUND,
-        [
-            (header::LOCATION, "/admin/".to_owned()),
-            (
-                header::SET_COOKIE,
-                openplotva_web::admin_session_cookie(user_id, &routes.bot_token),
-            ),
-        ],
-    )
-        .into_response()
-}
-
-fn admin_auth_query_values(raw_query: Option<&str>) -> BTreeMap<String, String> {
-    let mut values = BTreeMap::new();
-    let Some(raw_query) = raw_query else {
-        return values;
-    };
-    for (key, value) in url::form_urlencoded::parse(raw_query.as_bytes()) {
-        values
-            .entry(key.into_owned())
-            .or_insert_with(|| value.into_owned());
-    }
-    values
-}
-
-async fn persist_admin_session_user(
-    routes: &StaticWebRoutes,
-    values: &BTreeMap<String, String>,
-    user_id: i64,
-) {
-    let Some(store) = &routes.state_store else {
-        return;
-    };
-    let user = admin_auth_user_state(values, user_id);
-    if let Err(error) = store.upsert_user_state(&user).await {
-        tracing::warn!(%error, user_id, "failed to persist admin session user");
-    }
-}
-
-fn admin_auth_user_state(
-    values: &BTreeMap<String, String>,
-    user_id: i64,
-) -> openplotva_core::UserState {
-    openplotva_core::UserState::new(
-        user_id,
-        trimmed_auth_value(values, "first_name").unwrap_or_else(|| "Telegram Admin".to_owned()),
-        trimmed_auth_value(values, "last_name"),
-        trimmed_auth_value(values, "username"),
-        trimmed_auth_value(values, "language_code"),
-        None,
-    )
-}
-
-fn trimmed_auth_value(values: &BTreeMap<String, String>, key: &str) -> Option<String> {
-    values
-        .get(key)
-        .map(|value| value.trim())
-        .filter(|value| !value.is_empty())
-        .map(str::to_owned)
-}
-
-fn admin_error_response(status: StatusCode, error: &str) -> Response {
-    (
-        status,
-        [(header::CONTENT_TYPE, "text/plain; charset=utf-8")],
-        format!(r#"{{"error":"{error}"}}"#) + "\n",
-    )
-        .into_response()
-}
-
-fn admin_json_response(status: StatusCode, value: serde_json::Value) -> Response {
-    (
-        status,
-        [(header::CONTENT_TYPE, "application/json")],
-        format!("{value}\n"),
-    )
-        .into_response()
-}
-
-fn admin_json_no_cache_response(status: StatusCode, value: serde_json::Value) -> Response {
-    (
-        status,
-        [
-            (header::CONTENT_TYPE, "application/json"),
-            (header::CACHE_CONTROL, "no-cache"),
-        ],
-        format!("{value}\n"),
-    )
-        .into_response()
-}
-
-const ADMIN_PAGE_LIMIT: i64 = 1000;
-const SQL_ADMIN_LIST_USERS_FILTERED: &str = "SELECT * FROM telegram_users_effective WHERE ($1::text IS NULL OR username ILIKE '%' || $1::text || '%' OR first_name ILIKE '%' || $1::text || '%' OR last_name ILIKE '%' || $1::text || '%') ORDER BY id LIMIT $2 OFFSET $3";
-const SQL_ADMIN_GET_USER: &str = "SELECT * FROM telegram_users_effective WHERE id = $1";
-const SQL_ADMIN_GET_USER_BY_USERNAME: &str =
-    "SELECT * FROM telegram_users_effective WHERE username = $1 LIMIT 1";
-const SQL_ADMIN_ENSURE_USER: &str = "INSERT INTO users (id, first_name, is_premium, is_vip) VALUES ($1, $2, FALSE, FALSE) ON CONFLICT (id) DO NOTHING";
-const SQL_ADMIN_LIST_VIP_USERS: &str = "WITH latest_vip AS (SELECT DISTINCT ON (user_id) id, user_id, event_type, delta_seconds, effective_expires_at, reason, created_at FROM vip_events ORDER BY user_id, id DESC), subscription_stats AS (SELECT user_id, COUNT(*)::bigint AS subscriptions_count, MAX(expires_at) AS latest_subscription_expires_at FROM subscriptions GROUP BY user_id) SELECT u.*, latest_vip.id AS latest_event_id, latest_vip.event_type AS latest_event_type, latest_vip.delta_seconds AS latest_delta_seconds, latest_vip.effective_expires_at AS vip_expires_at, latest_vip.reason AS latest_reason, latest_vip.created_at AS latest_created_at, (latest_vip.effective_expires_at > CURRENT_TIMESTAMP) AS vip_active, CASE WHEN latest_vip.effective_expires_at > CURRENT_TIMESTAMP THEN FLOOR(EXTRACT(EPOCH FROM (latest_vip.effective_expires_at - CURRENT_TIMESTAMP)))::bigint ELSE 0::bigint END AS remaining_seconds, COALESCE(subscription_stats.subscriptions_count, 0)::bigint AS subscriptions_count, subscription_stats.latest_subscription_expires_at AS latest_subscription_expires_at FROM latest_vip JOIN telegram_users_effective u ON u.id = latest_vip.user_id LEFT JOIN subscription_stats ON subscription_stats.user_id = u.id WHERE ($1::text = 'all' OR ($1::text = 'active' AND latest_vip.effective_expires_at > CURRENT_TIMESTAMP) OR ($1::text = 'expired' AND latest_vip.effective_expires_at <= CURRENT_TIMESTAMP)) AND ($2::text IS NULL OR CAST(u.id AS text) LIKE '%' || $2::text || '%' OR u.username ILIKE '%' || $2::text || '%' OR u.first_name ILIKE '%' || $2::text || '%' OR u.last_name ILIKE '%' || $2::text || '%') ORDER BY latest_vip.effective_expires_at DESC, latest_vip.id DESC LIMIT $3 OFFSET $4";
-const SQL_ADMIN_SAFE_DELETE_USER: &str = "WITH deleted_user_stage AS (DELETE FROM telegram_users_stage WHERE user_id = $1 RETURNING user_id), deleted_member_stage AS (DELETE FROM telegram_chat_members_stage WHERE user_id = $1 RETURNING user_id), deleted_activity_stage AS (DELETE FROM telegram_activity_stage WHERE user_id = $1 RETURNING user_id), deleted_memberships AS (DELETE FROM chat_members WHERE user_id = $1 RETURNING user_id), deleted_vip AS (DELETE FROM vip_cache WHERE user_id = $1 RETURNING user_id) DELETE FROM users WHERE id = $1";
-const SQL_ADMIN_LIST_CHATS: &str =
-    "SELECT * FROM telegram_chats_effective ORDER BY id LIMIT $1 OFFSET $2";
-const SQL_ADMIN_LIST_CHATS_FILTERED: &str = "SELECT * FROM telegram_chats_effective WHERE ($1::text IS NULL OR CAST(id AS text) LIKE '%' || $1::text || '%' OR title ILIKE '%' || $1::text || '%' OR username ILIKE '%' || $1::text || '%' OR first_name ILIKE '%' || $1::text || '%' OR last_name ILIKE '%' || $1::text || '%') ORDER BY id LIMIT $2 OFFSET $3";
-const SQL_ADMIN_SEARCH_CHATS_BY_MEMBER: &str = "SELECT DISTINCT c.* FROM telegram_chats_effective c JOIN telegram_chat_members_effective cm ON c.id = cm.chat_id JOIN telegram_users_effective u ON cm.user_id = u.id WHERE ($1::text IS NULL OR LOWER(u.username) = LOWER($1::text)) AND ($2::bigint IS NULL OR u.id = $2::bigint) ORDER BY c.id LIMIT $3";
-const SQL_ADMIN_GET_CHAT: &str = "SELECT * FROM telegram_chats_effective WHERE id = $1";
-const SQL_ADMIN_GET_CHAT_TYPE: &str = "SELECT type FROM telegram_chats_effective WHERE id = $1";
-const SQL_ADMIN_GET_CHAT_SETTINGS: &str = "SELECT * FROM chat_settings WHERE chat_id = $1";
-const SQL_ADMIN_GET_CHAT_PERMISSIONS: &str =
-    "SELECT * FROM chat_permissions WHERE chat_id = $1 LIMIT 1";
-const SQL_ADMIN_COUNT_CHAT_MEMBERS: &str =
-    "SELECT COUNT(*)::bigint AS count FROM telegram_chat_members_effective WHERE chat_id = $1";
-const SQL_ADMIN_LIST_CHAT_MEMBERS_WITH_USERS: &str = "SELECT cm.chat_id AS member_chat_id, cm.user_id AS member_user_id, cm.status AS member_status, cm.is_anonymous AS member_is_anonymous, cm.custom_title AS member_custom_title, cm.can_be_edited AS member_can_be_edited, cm.can_manage_chat AS member_can_manage_chat, cm.can_delete_messages AS member_can_delete_messages, cm.can_manage_video_chats AS member_can_manage_video_chats, cm.can_restrict_members AS member_can_restrict_members, cm.can_promote_members AS member_can_promote_members, cm.can_change_info AS member_can_change_info, cm.can_invite_users AS member_can_invite_users, cm.can_post_messages AS member_can_post_messages, cm.can_edit_messages AS member_can_edit_messages, cm.can_pin_messages AS member_can_pin_messages, cm.can_manage_topics AS member_can_manage_topics, cm.can_send_messages AS member_can_send_messages, cm.can_send_media_messages AS member_can_send_media_messages, cm.can_send_polls AS member_can_send_polls, cm.can_send_other_messages AS member_can_send_other_messages, cm.can_add_web_page_previews AS member_can_add_web_page_previews, cm.until_date AS member_until_date, cm.created_at AS member_created_at, cm.updated_at AS member_updated_at, cm.last_message_at AS member_last_message_at, u.id AS user_id, u.is_premium AS user_is_premium, u.first_name AS user_first_name, u.last_name AS user_last_name, u.username AS user_username, u.language_code AS user_language_code, u.is_vip AS user_is_vip, u.settings AS user_settings, u.discovered AS user_discovered, u.updated AS user_updated FROM telegram_chat_members_effective cm LEFT JOIN telegram_users_effective u ON u.id = cm.user_id WHERE cm.chat_id = $1";
-
-#[derive(Debug, Deserialize)]
-struct AdminChatSettingsUpdateRequest {
-    chat_id: i64,
-    mood_alignment: Option<String>,
-    custom_persona: Option<String>,
-    reactivity_percentage: Option<i32>,
-    proactivity_percentage: Option<i32>,
-    enable_obscenifier: Option<bool>,
-    enable_profanity: Option<bool>,
-    enable_greet_joiners: Option<bool>,
-    enable_global_text_reply: Option<bool>,
-    enable_global_draw_reply: Option<bool>,
-    enable_daily_game: Option<bool>,
-    daily_game_theme: Option<String>,
-    greeting_html: Option<String>,
-}
-
-#[derive(Debug, Deserialize)]
-struct AdminVipGrantRequest {
-    user_id: serde_json::Value,
-    days: i64,
-    #[serde(default)]
-    reason: String,
-}
-
-#[derive(Debug, Default, Deserialize)]
-struct AdminMemoryRestartRequest {
-    #[serde(default, rename = "override")]
-    override_: bool,
-    #[serde(default)]
-    provider: String,
-    #[serde(default)]
-    model: String,
-}
-
-#[derive(Clone, Debug, Default, Eq, PartialEq)]
-struct AdminMemoryOverride {
-    provider: String,
-    model: String,
-}
-
-#[derive(Debug, Default, Deserialize)]
-struct AdminShieldDocumentRequest {
-    #[serde(default)]
-    id: i64,
-    #[serde(default)]
-    slug: String,
-    #[serde(default)]
-    title: String,
-    #[serde(default)]
-    body: String,
-    #[serde(default)]
-    category: String,
-    #[serde(default)]
-    enabled: Option<bool>,
-    #[serde(default)]
-    priority: i32,
-}
-
-#[derive(Debug, Default, Deserialize)]
-struct AdminShieldTestRequest {
-    #[serde(default)]
-    query: String,
-    #[serde(default)]
-    expected_category: String,
-    #[serde(default)]
-    max_matches: i32,
-    #[serde(default)]
-    debug: bool,
-}
-
-async fn admin_memory_cards_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    match method {
-        Method::GET => admin_memory_cards_list_response(routes, headers, raw_query).await,
-        Method::DELETE => admin_memory_card_delete_response(routes, headers, raw_query).await,
-        _ => admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed"),
-    }
-}
-
-async fn admin_memory_card_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-    body: &[u8],
-) -> Response {
-    match method {
-        Method::GET => admin_memory_card_detail_response(routes, headers, raw_query).await,
-        Method::PATCH => admin_memory_card_update_response(routes, headers, body).await,
-        _ => admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed"),
-    }
-}
-
-#[derive(serde::Deserialize)]
-struct MemoryCardUpdate {
-    #[serde(default)]
-    id: i64,
-    #[serde(default)]
-    confidence: Option<f64>,
-    #[serde(default)]
-    salience: Option<f64>,
-    #[serde(default)]
-    portable: Option<bool>,
-    #[serde(default)]
-    status: Option<String>,
-}
-
-async fn admin_memory_card_update_response(
-    routes: &StaticWebRoutes,
-    headers: &HeaderMap,
-    body: &[u8],
-) -> Response {
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let req: MemoryCardUpdate = match serde_json::from_slice(body) {
-        Ok(req) => req,
-        Err(_) => return admin_error_response(StatusCode::BAD_REQUEST, "invalid body"),
-    };
-    if req.id == 0 {
-        return admin_error_response(StatusCode::BAD_REQUEST, "id required");
-    }
-    let Some(store) = routes
-        .memory_store
-        .as_ref()
-        .filter(|_| routes.memory_admin_enabled)
-    else {
-        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "memory disabled");
-    };
-    let confidence = req.confidence.map(|v| v.clamp(0.0, 1.0));
-    let salience = req.salience.map(|v| v.clamp(0.0, 1.0));
-    if (confidence.is_some() || salience.is_some() || req.portable.is_some())
-        && let Err(error) = store
-            .update_card_fields(req.id, confidence, salience, req.portable)
-            .await
-    {
-        tracing::warn!(%error, id = req.id, "failed to update memory card fields");
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    }
-    if let Some(status) = req.status.as_deref() {
-        let result = match status {
-            "deleted" => {
-                store
-                    .soft_delete_card(req.id, current_admin_user_id(headers, &routes.bot_token))
-                    .await
-            }
-            "active" => store.restore_card(req.id).await,
-            _ => Ok(()),
-        };
-        if let Err(error) = result {
-            tracing::warn!(%error, id = req.id, "failed to change memory card status");
-            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-        }
-    }
-    admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true }))
-}
-
-async fn admin_memory_card_detail_response(
-    routes: &StaticWebRoutes,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let id = match admin_memory_required_id(raw_query, "id required") {
-        Ok(id) => id,
-        Err(response) => return *response,
-    };
-    let Some(store) = routes
-        .memory_store
-        .as_ref()
-        .filter(|_| routes.memory_admin_enabled)
-    else {
-        return admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "card": serde_json::Value::Null, "links": [] }),
-        );
-    };
-    let card = match store.get_card(id).await {
-        Ok(Some(card)) => card,
-        Ok(None) => return admin_error_response(StatusCode::NOT_FOUND, "not found"),
-        Err(error) => {
-            tracing::warn!(%error, id, "failed to load admin memory card");
-            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-        }
-    };
-    let links = store.list_card_links(id).await.unwrap_or_default();
-    admin_json_response(
-        StatusCode::OK,
-        serde_json::json!({ "card": card, "links": links }),
-    )
-}
-
-async fn admin_memory_overview_response(routes: &StaticWebRoutes, headers: &HeaderMap) -> Response {
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(store) = routes
-        .memory_store
-        .as_ref()
-        .filter(|_| routes.memory_admin_enabled)
-    else {
-        return admin_json_response(StatusCode::OK, serde_json::json!({}));
-    };
-    match store.memory_overview().await {
-        Ok(overview) => admin_json_response(
-            StatusCode::OK,
-            serde_json::to_value(&overview).unwrap_or(serde_json::Value::Null),
-        ),
-        Err(error) => {
-            tracing::warn!(%error, "failed to load admin memory overview");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_memory_cards_list_response(
-    routes: &StaticWebRoutes,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(store) = routes
-        .memory_store
-        .as_ref()
-        .filter(|_| routes.memory_admin_enabled)
-    else {
-        return admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "count": 0, "cards": serde_json::Value::Null }),
-        );
-    };
-    let filter = admin_memory_card_filter(raw_query);
-    match store.list_cards(&filter).await {
-        Ok(cards) => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({
-                "count": cards.len(),
-                "cards": cards,
-            }),
-        ),
-        Err(error) => {
-            tracing::warn!(%error, "failed to list admin memory cards");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_memory_card_delete_response(
-    routes: &StaticWebRoutes,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let id = match admin_memory_required_id(raw_query, "id required") {
-        Ok(id) => id,
-        Err(response) => return *response,
-    };
-    if let Some(store) = routes
-        .memory_store
-        .as_ref()
-        .filter(|_| routes.memory_admin_enabled)
-        && let Err(error) = store
-            .soft_delete_card(id, current_admin_user_id(headers, &routes.bot_token))
-            .await
-    {
-        tracing::warn!(%error, id, "failed to delete admin memory card");
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    }
-    admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true }))
-}
-
-async fn admin_memory_runs_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-    body: &[u8],
-) -> Response {
-    match method {
-        Method::GET => admin_memory_runs_list_response(routes, headers, raw_query).await,
-        Method::POST => admin_memory_run_retry_response(routes, headers, raw_query, body).await,
-        _ => admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed"),
-    }
-}
-
-async fn admin_memory_runs_list_response(
-    routes: &StaticWebRoutes,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(store) = routes
-        .memory_store
-        .as_ref()
-        .filter(|_| routes.memory_admin_enabled)
-    else {
-        return admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({
-                "count": 0,
-                "runs": serde_json::Value::Null,
-                "policy": admin_memory_policy_json(routes),
-                "enqueue_rollups": serde_json::Value::Null,
-            }),
-        );
-    };
-    let limit = parse_memory_limit(
-        admin_auth_query_values(raw_query)
-            .get("limit")
-            .map(String::as_str),
-    );
-    let runs = match store.list_runs(limit as i32).await {
-        Ok(runs) => runs,
-        Err(error) => {
-            tracing::warn!(%error, "failed to list admin memory runs");
-            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-        }
-    };
-    let enqueue_rollups = match store.list_enqueue_rollups(24).await {
-        Ok(rollups) => rollups,
-        Err(error) => {
-            tracing::warn!(%error, "failed to list admin memory enqueue rollups");
-            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-        }
-    };
-    admin_json_response(
-        StatusCode::OK,
-        serde_json::json!({
-            "count": runs.len(),
-            "runs": runs,
-            "policy": admin_memory_policy_json(routes),
-            "enqueue_rollups": enqueue_rollups,
-        }),
-    )
-}
-
-fn admin_memory_policy_json(routes: &StaticWebRoutes) -> serde_json::Value {
-    serde_json::json!({
-        "min_messages_per_run": routes.memory_enqueue_policy.min_messages_per_run,
-        "max_queued_runs": null,
-        "max_messages_per_run": routes.memory_max_messages_per_run,
-        "max_input_tokens": routes.memory_max_input_tokens,
-        "token_estimator": routes.memory_token_estimator_source.as_ref(),
-        "consolidation_model": routes.memory_consolidation_model.as_ref(),
-    })
-}
-
-async fn admin_memory_run_retry_response(
-    routes: &StaticWebRoutes,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-    body: &[u8],
-) -> Response {
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let id = match admin_memory_required_id(raw_query, "id required") {
-        Ok(id) => id,
-        Err(response) => return *response,
-    };
-    admin_memory_restart_execute_response(routes, headers, raw_query, body, id, false).await
-}
-
-async fn admin_memory_restart_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-    body: &[u8],
-) -> Response {
-    if method != Method::POST {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let id = match admin_memory_optional_restart_id(raw_query) {
-        Ok(id) => id,
-        Err(response) => return *response,
-    };
-    let run_now = admin_auth_query_values(raw_query)
-        .get("run_now")
-        .and_then(|value| parse_go_bool(value))
-        .unwrap_or(false);
-    admin_memory_restart_execute_response(routes, headers, raw_query, body, id, run_now).await
-}
-
-async fn admin_memory_restart_execute_response(
-    routes: &StaticWebRoutes,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-    body: &[u8],
-    id: i64,
-    run_now: bool,
-) -> Response {
-    let Some(store) = routes
-        .memory_store
-        .as_ref()
-        .filter(|_| routes.memory_admin_enabled)
-    else {
-        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "memory disabled");
-    };
-    let (override_, explicit_override) =
-        match admin_memory_restart_override(headers, raw_query, body) {
-            Ok(value) => value,
-            Err(response) => return *response,
-        };
-    if explicit_override {
-        return admin_memory_restart_override_execute_response(routes, override_, id, run_now)
-            .await;
-    }
-    let mut retried_failed_runs = 0_i64;
-    let mut queued_runs = 0_i64;
-    let result = if run_now {
-        store
-            .ensure_hourly_runs(
-                OffsetDateTime::now_utc(),
-                routes.memory_retention,
-                routes.memory_retention,
-                routes.memory_enqueue_policy,
-            )
-            .await
-            .map(|queued| queued_runs = admin_u64_to_i64(queued))
-    } else if id > 0 {
-        store.retry_run(id).await.map(|()| retried_failed_runs = 1)
-    } else {
-        store
-            .retry_failed_runs()
-            .await
-            .map(|retried| retried_failed_runs = admin_u64_to_i64(retried))
-    };
-    if let Err(error) = result {
-        tracing::warn!(%error, id, run_now, "failed to restart admin memory runs");
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    }
-    let started = routes
-        .memory_restart_trigger
-        .as_ref()
-        .map(|trigger| {
-            trigger.notify_one();
-            true
-        })
-        .unwrap_or(false);
-    let provider = if explicit_override && !override_.provider.trim().is_empty() {
-        normalize_memory_restart_provider(&override_.provider)
-    } else {
-        "aifarm".to_owned()
-    };
-    let model = if explicit_override && !override_.model.trim().is_empty() {
-        override_.model.trim().to_owned()
-    } else {
-        admin_memory_restart_model(&routes.memory_consolidation_model)
-    };
-    admin_memory_restart_ok_response(
-        id,
-        retried_failed_runs,
-        queued_runs,
-        started,
-        explicit_override,
-        provider,
-        model,
-    )
-}
-
-async fn admin_memory_restart_override_execute_response(
-    routes: &StaticWebRoutes,
-    override_: AdminMemoryOverride,
-    id: i64,
-    run_now: bool,
-) -> Response {
-    let Some(runtime) = routes.memory_override_runtime.clone() else {
-        tracing::warn!(
-            provider = override_.provider,
-            model = override_.model,
-            "admin memory override drain is unavailable"
-        );
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    let (provider, model) = match admin_memory_resolve_override(
-        &override_,
-        &runtime.config,
-        &routes.memory_consolidation_model,
-    ) {
-        Ok(value) => value,
-        Err(unsupported_provider) => {
-            tracing::warn!(
-                provider = unsupported_provider,
-                model = override_.model,
-                "admin memory override provider is unsupported"
-            );
-            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-        }
-    };
-    let extractor = memory_runtime::routed_memory_extractor_from_app_config(
-        &runtime.config,
-        routed_attempts::RoutedAttemptWalker::new(
-            Arc::clone(&runtime.router_handle),
-            Arc::clone(&runtime.router_breakers),
-            Arc::clone(&runtime.router_triggers),
-            Arc::clone(&runtime.router_pools),
-        )
-        .with_openrouter_free_gate_opt(runtime.openrouter_free_gate.clone())
-        .with_reporter_opt(runtime.routing_event_reporter.clone()),
-    );
-    let embedder = match memory_runtime::memory_write_embedder_from_config(
-        &runtime.config.memory,
-        &runtime.config.llm.discovery.base_url,
-    ) {
-        Ok(embedder) => embedder.map(|client| {
-            embedder::RoutedDiscoveryEmbedder::new(
-                routed_attempts::RoutedAttemptWalker::new(
-                    Arc::clone(&runtime.router_handle),
-                    Arc::clone(&runtime.router_breakers),
-                    Arc::clone(&runtime.router_triggers),
-                    Arc::clone(&runtime.router_pools),
-                )
-                .with_openrouter_free_gate_opt(runtime.openrouter_free_gate.clone())
-                .with_reporter_opt(runtime.routing_event_reporter.clone()),
-                client.config().clone(),
-            )
-        }),
-        Err(error) => {
-            tracing::warn!(%error, provider, model, "failed to build admin memory override embedder");
-            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-        }
-    };
-    let Ok(guard) = runtime.lock.clone().try_lock_owned() else {
-        return admin_memory_restart_ok_response(id, 0, 0, false, true, provider, model);
-    };
-    let mut retried_failed_runs = 0_i64;
-    let mut queued_runs = 0_i64;
-    let result = if run_now {
-        runtime
-            .store
-            .ensure_hourly_runs(
-                OffsetDateTime::now_utc(),
-                routes.memory_retention,
-                routes.memory_retention,
-                routes.memory_enqueue_policy,
-            )
-            .await
-            .map(|queued| queued_runs = admin_u64_to_i64(queued))
-    } else if id > 0 {
-        runtime
-            .store
-            .retry_run(id)
-            .await
-            .map(|()| retried_failed_runs = 1)
-    } else {
-        runtime
-            .store
-            .retry_failed_runs()
-            .await
-            .map(|retried| retried_failed_runs = admin_u64_to_i64(retried))
-    };
-    if let Err(error) = result {
-        tracing::warn!(
-            %error,
-            id,
-            run_now,
-            provider,
-            model,
-            "failed to restart admin memory runs with override"
-        );
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    }
-    let mut cfg =
-        memory_runtime::memory_service_worker_config_from_memory_config(&runtime.config.memory)
-            .process;
-    cfg.episode_model = model.clone();
-    tokio::spawn(admin_memory_override_drain(
-        runtime,
-        extractor,
-        embedder,
-        cfg,
-        model.clone(),
-        guard,
-    ));
-    admin_memory_restart_ok_response(
-        id,
-        retried_failed_runs,
-        queued_runs,
-        true,
-        true,
-        provider,
-        model,
-    )
-}
-
-async fn admin_memory_override_drain(
-    runtime: AdminMemoryOverrideRuntime,
-    extractor: memory_runtime::RoutedMemoryExtractor,
-    embedder: Option<embedder::RoutedDiscoveryEmbedder>,
-    cfg: memory_runtime::MemoryRunProcessConfig,
-    model: String,
-    _guard: tokio::sync::OwnedMutexGuard<()>,
-) {
-    let started_at = std::time::Instant::now();
-    let mut completed = 0_i64;
-    let mut failed = 0_i64;
-    let mut store_errors = 0_i64;
-    tracing::info!(model, workers = 1, "admin memory override drain started");
-    loop {
-        match memory_runtime::process_next_memory_run(
-            &extractor,
-            &runtime.store,
-            embedder.as_ref(),
-            cfg.clone(),
-        )
-        .await
-        {
-            Ok(report) if report.processed => {
-                completed += 1;
-                tracing::info!(?report, "admin memory override run processed");
-            }
-            Ok(_) => break,
-            Err(memory_runtime::MemoryRunProcessError::Process { run_id, source }) => {
-                failed += 1;
-                tracing::warn!(%source, run_id, "admin memory override run failed");
-            }
-            Err(memory_runtime::MemoryRunProcessError::Store { source }) => {
-                store_errors += 1;
-                tracing::warn!(%source, "admin memory override store operation failed");
-                break;
-            }
-        }
-    }
-    tracing::info!(
-        model,
-        completed,
-        failed,
-        store_errors,
-        duration = ?started_at.elapsed(),
-        "admin memory override drain finished"
-    );
-}
-
-fn admin_memory_resolve_override(
-    override_: &AdminMemoryOverride,
-    config: &AppConfig,
-    default_model: &str,
-) -> Result<(String, String), String> {
-    let provider = normalize_memory_restart_provider(&override_.provider);
-    let provider = if provider.is_empty() {
-        "aifarm".to_owned()
-    } else {
-        provider
-    };
-    match provider.as_str() {
-        "aifarm" => {
-            let model = if override_.model.trim().is_empty() {
-                admin_memory_restart_model(default_model)
-            } else {
-                override_.model.trim().to_owned()
-            };
-            Ok((provider, model))
-        }
-        "genkit" | "gemini" => {
-            let model =
-                memory_runtime::genkit_memory_extractor_model(config, Some(&override_.model));
-            Ok(("genkit".to_owned(), model))
-        }
-        _ => Err(provider),
-    }
-}
-
-fn admin_memory_restart_ok_response(
-    id: i64,
-    retried_failed_runs: i64,
-    queued_runs: i64,
-    started: bool,
-    override_: bool,
-    provider: String,
-    model: String,
-) -> Response {
-    let mut value = serde_json::Map::new();
-    value.insert("ok".to_owned(), serde_json::json!(true));
-    if id != 0 {
-        value.insert("run_id".to_owned(), serde_json::json!(id));
-    }
-    value.insert(
-        "retried_failed_runs".to_owned(),
-        serde_json::json!(retried_failed_runs),
-    );
-    value.insert("queued_runs".to_owned(), serde_json::json!(queued_runs));
-    value.insert("started".to_owned(), serde_json::json!(started));
-    value.insert("override".to_owned(), serde_json::json!(override_));
-    if !provider.is_empty() {
-        value.insert("provider".to_owned(), serde_json::json!(provider));
-    }
-    if !model.is_empty() {
-        value.insert("model".to_owned(), serde_json::json!(model));
-    }
-    admin_json_response(StatusCode::OK, serde_json::Value::Object(value))
-}
-
-fn admin_memory_card_filter(raw_query: Option<&str>) -> openplotva_memory::CardFilter {
-    let values = admin_auth_query_values(raw_query);
-    openplotva_memory::CardFilter {
-        chat_id: values
-            .get("chat_id")
-            .and_then(|value| value.trim().parse::<i64>().ok())
-            .unwrap_or_default(),
-        thread_id: values
-            .get("thread_id")
-            .map(String::as_str)
-            .map(str::trim)
-            .filter(|value| !value.is_empty())
-            .and_then(|value| value.parse::<i32>().ok()),
-        user_id: values
-            .get("user_id")
-            .and_then(|value| value.trim().parse::<i64>().ok())
-            .unwrap_or_default(),
-        status: values
-            .get("status")
-            .map(|value| value.trim().to_owned())
-            .unwrap_or_default(),
-        card_type: values
-            .get("card_type")
-            .map(|value| value.trim().to_owned())
-            .unwrap_or_default(),
-        visibility: values
-            .get("visibility")
-            .map(|value| value.trim().to_owned())
-            .unwrap_or_default(),
-        as_of: values.get("as_of").and_then(|value| {
-            time::OffsetDateTime::parse(
-                value.trim(),
-                &time::format_description::well_known::Rfc3339,
-            )
-            .ok()
-        }),
-        limit: parse_memory_limit(values.get("limit").map(String::as_str)) as i32,
-    }
-}
-
-fn admin_memory_required_id(raw_query: Option<&str>, missing: &str) -> Result<i64, Box<Response>> {
-    let values = admin_auth_query_values(raw_query);
-    let Some(raw) = values.get("id") else {
-        return Err(Box::new(admin_error_response(
-            StatusCode::BAD_REQUEST,
-            missing,
-        )));
-    };
-    let id = raw.trim().parse::<i64>().map_err(|_| {
-        Box::new(admin_error_response(
-            StatusCode::BAD_REQUEST,
-            if missing == "invalid id" {
-                "invalid id"
-            } else {
-                missing
-            },
-        ))
-    })?;
-    if id == 0 {
-        return Err(Box::new(admin_error_response(
-            StatusCode::BAD_REQUEST,
-            missing,
-        )));
-    }
-    Ok(id)
-}
-
-fn admin_memory_optional_restart_id(raw_query: Option<&str>) -> Result<i64, Box<Response>> {
-    let values = admin_auth_query_values(raw_query);
-    let Some(raw) = values.get("id").map(String::as_str).map(str::trim) else {
-        return Ok(0);
-    };
-    if raw.is_empty() {
-        return Ok(0);
-    }
-    let id = raw
-        .parse::<i64>()
-        .map_err(|_| Box::new(admin_error_response(StatusCode::BAD_REQUEST, "invalid id")))?;
-    if id <= 0 {
-        return Err(Box::new(admin_error_response(
-            StatusCode::BAD_REQUEST,
-            "invalid id",
-        )));
-    }
-    Ok(id)
-}
-
-fn admin_memory_restart_override(
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-    body: &[u8],
-) -> Result<(AdminMemoryOverride, bool), Box<Response>> {
-    let mut req = if admin_request_is_json(headers) {
-        if body.is_empty() {
-            AdminMemoryRestartRequest::default()
-        } else {
-            serde_json::from_slice::<AdminMemoryRestartRequest>(body).map_err(|_| {
-                Box::new(admin_error_response(
-                    StatusCode::BAD_REQUEST,
-                    "invalid override",
-                ))
-            })?
-        }
-    } else {
-        AdminMemoryRestartRequest::default()
-    };
-    let values = admin_auth_query_values(raw_query);
-    if let Some(raw) = values.get("override").map(String::as_str).map(str::trim)
-        && !raw.is_empty()
-        && let Some(value) = parse_go_bool(raw)
-    {
-        req.override_ = value;
-    }
-    if let Some(raw) = values.get("provider").map(String::as_str).map(str::trim)
-        && !raw.is_empty()
-    {
-        req.provider = raw.to_owned();
-    }
-    if let Some(raw) = values.get("model").map(String::as_str).map(str::trim)
-        && !raw.is_empty()
-    {
-        req.model = raw.to_owned();
-    }
-    let provider = req.provider.trim().to_lowercase();
-    if !matches!(provider.as_str(), "" | "aifarm" | "genkit" | "gemini") {
-        return Err(Box::new(admin_error_response(
-            StatusCode::BAD_REQUEST,
-            "invalid override",
-        )));
-    }
-    let model = req.model.trim().to_owned();
-    let explicit = req.override_ || !provider.is_empty() || !model.is_empty();
-    Ok((AdminMemoryOverride { provider, model }, explicit))
-}
-
-fn admin_request_is_json(headers: &HeaderMap) -> bool {
-    headers
-        .get(header::CONTENT_TYPE)
-        .and_then(|value| value.to_str().ok())
-        .is_some_and(|value| contains_ascii_fold(value, "application/json"))
-}
-
-fn contains_ascii_fold(haystack: &str, needle: &str) -> bool {
-    if needle.is_empty() {
-        return true;
-    }
-    haystack.as_bytes().windows(needle.len()).any(|window| {
-        std::str::from_utf8(window).is_ok_and(|part| part.eq_ignore_ascii_case(needle))
-    })
-}
-
-fn parse_go_bool(value: &str) -> Option<bool> {
-    match value.trim() {
-        "1" => Some(true),
-        "0" => Some(false),
-        value if value.eq_ignore_ascii_case("t") => Some(true),
-        value if value.eq_ignore_ascii_case("true") => Some(true),
-        value if value.eq_ignore_ascii_case("f") => Some(false),
-        value if value.eq_ignore_ascii_case("false") => Some(false),
-        _ => None,
-    }
-}
-
-fn admin_memory_restart_model(model: &str) -> String {
-    let model = model.trim();
-    if model.is_empty() {
-        openplotva_memory::DEFAULT_MEMORY_CONSOLIDATION_MODEL.to_owned()
-    } else {
-        model.to_owned()
-    }
-}
-
-fn normalize_memory_restart_provider(provider: &str) -> String {
-    let provider = provider.trim();
-    if provider.eq_ignore_ascii_case("aifarm") {
-        "aifarm".to_owned()
-    } else if provider.eq_ignore_ascii_case("genkit") {
-        "genkit".to_owned()
-    } else if provider.eq_ignore_ascii_case("gemini") {
-        "gemini".to_owned()
-    } else {
-        provider.to_lowercase()
-    }
-}
-
-fn admin_u64_to_i64(value: u64) -> i64 {
-    i64::try_from(value).unwrap_or(i64::MAX)
-}
-
-async fn admin_shield_documents_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-    body: &[u8],
-) -> Response {
-    match method {
-        Method::GET => admin_shield_documents_list_response(routes, headers, raw_query).await,
-        Method::POST => admin_shield_document_create_response(routes, headers, body).await,
-        Method::PUT => {
-            admin_shield_document_update_response(routes, headers, raw_query, body).await
-        }
-        Method::DELETE => admin_shield_document_delete_response(routes, headers, raw_query).await,
-        _ => admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed"),
-    }
-}
-
-async fn admin_shield_documents_list_response(
-    routes: &StaticWebRoutes,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(store) = routes.shield_store.as_ref() else {
-        return admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "count": 0, "documents": [] }),
-        );
-    };
-    let values = admin_auth_query_values(raw_query);
-    let filter = openplotva_shield::ListFilter {
-        query: values.get("q").cloned().unwrap_or_default(),
-        include_disabled: parse_admin_optional_bool(
-            values.get("include_disabled").map(String::as_str),
-        )
-        .unwrap_or(false),
-        limit: parse_shield_limit(values.get("limit").map(String::as_str)),
-        offset: 0,
-    };
-    match store.list_documents(&filter).await {
-        Ok(documents) => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({
-                "count": documents.len(),
-                "documents": documents.iter().map(admin_shield_document_json).collect::<Vec<_>>(),
-            }),
-        ),
-        Err(error) => {
-            tracing::warn!(%error, "failed to list admin shield documents");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_shield_document_create_response(
-    routes: &StaticWebRoutes,
-    headers: &HeaderMap,
-    body: &[u8],
-) -> Response {
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(store) = routes.shield_store.as_ref() else {
-        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "shield disabled");
-    };
-    let Ok(req) = serde_json::from_slice::<AdminShieldDocumentRequest>(body) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "invalid json");
-    };
-    let input =
-        match openplotva_shield::normalize_document_input(admin_shield_document_input(req, true)) {
-            Ok(input) => input,
-            Err(error) => return admin_error_response(StatusCode::BAD_REQUEST, &error.to_string()),
-        };
-    let embedding = admin_shield_embed_title(routes, &input.title).await;
-    match store.create_document(input, embedding.as_ref()).await {
-        Ok(document) => admin_json_response(StatusCode::OK, admin_shield_document_json(&document)),
-        Err(error) => {
-            tracing::warn!(%error, "failed to create admin shield document");
-            admin_error_response(StatusCode::BAD_REQUEST, &error.to_string())
-        }
-    }
-}
-
-async fn admin_shield_document_update_response(
-    routes: &StaticWebRoutes,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-    body: &[u8],
-) -> Response {
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(store) = routes.shield_store.as_ref() else {
-        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "shield disabled");
-    };
-    let Ok(req) = serde_json::from_slice::<AdminShieldDocumentRequest>(body) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "invalid json");
-    };
-    let values = admin_auth_query_values(raw_query);
-    let mut id = req.id;
-    if let Some(raw_id) = values
-        .get("id")
-        .map(|value| value.trim())
-        .filter(|value| !value.is_empty())
-    {
-        let Ok(parsed) = raw_id.parse::<i64>() else {
-            return admin_error_response(StatusCode::BAD_REQUEST, "invalid id");
-        };
-        if parsed <= 0 {
-            return admin_error_response(StatusCode::BAD_REQUEST, "invalid id");
-        }
-        id = parsed;
-    }
-    if id <= 0 {
-        return admin_error_response(StatusCode::BAD_REQUEST, "id required");
-    }
-    let input = match openplotva_shield::normalize_document_input(admin_shield_document_input(
-        req, false,
-    )) {
-        Ok(input) => input,
-        Err(error) => return admin_error_response(StatusCode::BAD_REQUEST, &error.to_string()),
-    };
-    let embedding = admin_shield_embed_title(routes, &input.title).await;
-    match store.update_document(id, input, embedding.as_ref()).await {
-        Ok(document) => admin_json_response(StatusCode::OK, admin_shield_document_json(&document)),
-        Err(error) => {
-            tracing::warn!(%error, id, "failed to update admin shield document");
-            admin_error_response(StatusCode::BAD_REQUEST, &error.to_string())
-        }
-    }
-}
-
-async fn admin_shield_document_delete_response(
-    routes: &StaticWebRoutes,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query);
-    let id = match admin_required_i64(&values, "id", "id required", "id required") {
-        Ok(value) if value > 0 => value,
-        Ok(_) => return admin_error_response(StatusCode::BAD_REQUEST, "id required"),
-        Err(response) => return *response,
-    };
-    if let Some(store) = routes.shield_store.as_ref()
-        && let Err(error) = store.delete_document(id).await
-    {
-        tracing::warn!(%error, id, "failed to delete admin shield document");
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    }
-    admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true }))
-}
-
-async fn admin_shield_embeddings_rebuild_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-) -> Response {
-    if method != Method::POST {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(store) = routes.shield_store.as_ref() else {
-        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "shield disabled");
-    };
-    let Some(embedder) = routes.shield_embedder.as_ref() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    let documents = match store
-        .documents_without_embeddings(routes.shield_options.rebuild_batch_size)
-        .await
-    {
-        Ok(documents) => documents,
-        Err(error) => {
-            tracing::warn!(%error, "failed to list shield documents without embeddings");
-            return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-        }
-    };
-    let mut processed = 0_i32;
-    let mut failed = 0_i32;
-    for document in documents {
-        processed += 1;
-        let embedding = match embedder
-            .embed_one(
-                document.title.trim(),
-                routes.shield_options.embedding_dim,
-                openplotva_shield::TITLE_EMBEDDING_TASK,
-            )
-            .await
-        {
-            Ok(embedding) => embedding,
-            Err(error) => {
-                failed += 1;
-                tracing::warn!(
-                    %error,
-                    document_id = document.id,
-                    "shield title embedding rebuild failed"
-                );
-                continue;
-            }
-        };
-        if let Err(error) = store
-            .update_embedding(document.id, embedding.as_ref())
-            .await
-        {
-            failed += 1;
-            tracing::warn!(
-                %error,
-                document_id = document.id,
-                "shield embedding update failed"
-            );
-        }
-    }
-    admin_json_response(
-        StatusCode::OK,
-        serde_json::json!({ "ok": true, "processed": processed, "failed": failed }),
-    )
-}
-
-async fn admin_shield_test_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    body: &[u8],
-) -> Response {
-    if method != Method::POST {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(store) = routes.shield_store.as_ref() else {
-        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "shield disabled");
-    };
-    let Ok(req) = serde_json::from_slice::<AdminShieldTestRequest>(body) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "invalid json");
-    };
-    if req.query.trim().is_empty() {
-        return admin_error_response(StatusCode::BAD_REQUEST, "query required");
-    }
-    let request = openplotva_shield::SearchRequest {
-        query: req.query.clone(),
-        max_matches: req.max_matches,
-        include_candidates: req.debug,
-    };
-    let embedding = admin_shield_embed_query(routes, &req.query).await;
-    match store
-        .search_with_vector(&request, &routes.shield_options, embedding.as_ref())
-        .await
-    {
-        Ok(result) => admin_json_response(
-            StatusCode::OK,
-            admin_shield_test_json(&result, &req.expected_category),
-        ),
-        Err(error) => {
-            tracing::warn!(%error, "failed to test admin shield query");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-fn admin_shield_document_input(
-    req: AdminShieldDocumentRequest,
-    default_enabled: bool,
-) -> openplotva_shield::DocumentInput {
-    openplotva_shield::DocumentInput {
-        slug: req.slug,
-        title: req.title,
-        body: req.body,
-        category: req.category,
-        enabled: req.enabled.unwrap_or(default_enabled),
-        priority: req.priority,
-    }
-}
-
-async fn admin_shield_embed_title(
-    routes: &StaticWebRoutes,
-    title: &str,
-) -> Option<openplotva_storage::PgEmbeddingVector> {
-    let embedder = routes.shield_embedder.as_ref()?;
-    match embedder
-        .embed_one(
-            title.trim(),
-            routes.shield_options.embedding_dim,
-            openplotva_shield::TITLE_EMBEDDING_TASK,
-        )
-        .await
-    {
-        Ok(embedding) => embedding,
-        Err(error) => {
-            tracing::warn!(%error, "shield title embedding failed; storing lexical-only document");
-            None
-        }
-    }
-}
-
-async fn admin_shield_embed_query(
-    routes: &StaticWebRoutes,
-    query: &str,
-) -> Option<openplotva_storage::PgEmbeddingVector> {
-    let embedder = routes.shield_embedder.as_ref()?;
-    match embedder
-        .embed_one(
-            query,
-            routes.shield_options.embedding_dim,
-            openplotva_shield::QUERY_EMBEDDING_TASK,
-        )
-        .await
-    {
-        Ok(embedding) => embedding,
-        Err(error) => {
-            tracing::warn!(%error, "shield embedding failed; using lexical-only retrieval");
-            None
-        }
-    }
-}
-
-fn parse_shield_limit(raw: Option<&str>) -> i32 {
-    parse_admin_positive_i32(raw, 100, 500)
-}
-
-fn admin_shield_category_matched(matches: &[openplotva_shield::Match], expected: &str) -> bool {
-    let expected = expected.trim();
-    if expected.is_empty() {
-        return false;
-    }
-    matches
-        .iter()
-        .any(|item| item.document.category.trim().eq_ignore_ascii_case(expected))
-}
-
-fn admin_shield_document_json(document: &openplotva_shield::Document) -> serde_json::Value {
-    serde_json::json!({
-        "id": document.id,
-        "slug": document.slug,
-        "title": document.title,
-        "body": document.body,
-        "category": document.category,
-        "enabled": document.enabled,
-        "priority": document.priority,
-        "created_at": admin_time_json(document.created_at),
-        "updated_at": admin_time_json(document.updated_at),
-    })
-}
-
-fn admin_shield_scored_document_json(
-    item: &openplotva_shield::ScoredDocument,
-) -> serde_json::Value {
-    serde_json::json!({
-        "document": admin_shield_document_json(&item.document),
-        "lexical_score": item.lexical_score,
-        "vector_score": item.vector_score,
-    })
-}
-
-fn admin_shield_candidate_json(candidate: &openplotva_shield::Candidate) -> serde_json::Value {
-    let mut value = serde_json::Map::new();
-    value.insert(
-        "document".to_owned(),
-        admin_shield_document_json(&candidate.document),
-    );
-    value.insert(
-        "lexical_score".to_owned(),
-        serde_json::json!(candidate.lexical_score),
-    );
-    value.insert(
-        "vector_score".to_owned(),
-        serde_json::json!(candidate.vector_score),
-    );
-    value.insert("matched".to_owned(), serde_json::json!(candidate.matched));
-    if !candidate.signals.is_empty() {
-        value.insert("signals".to_owned(), serde_json::json!(candidate.signals));
-    }
-    serde_json::Value::Object(value)
-}
-
-fn admin_shield_test_json(
-    result: &openplotva_shield::SearchResult,
-    expected_category: &str,
-) -> serde_json::Value {
-    let mut value = serde_json::Map::new();
-    value.insert("query".to_owned(), serde_json::json!(result.query));
-    value.insert(
-        "matches".to_owned(),
-        serde_json::json!(
-            result
-                .matches
-                .iter()
-                .map(admin_shield_scored_document_json)
-                .collect::<Vec<_>>()
-        ),
-    );
-    value.insert("context".to_owned(), serde_json::json!(result.context));
-    value.insert(
-        "lexical_only".to_owned(),
-        serde_json::json!(result.lexical_only),
-    );
-    if !result.candidates.is_empty() {
-        value.insert(
-            "candidates".to_owned(),
-            serde_json::json!(
-                result
-                    .candidates
-                    .iter()
-                    .map(admin_shield_candidate_json)
-                    .collect::<Vec<_>>()
-            ),
-        );
-    }
-    if let Some(debug) = result.debug.as_ref() {
-        value.insert(
-            "debug".to_owned(),
-            serde_json::json!({
-                "max_matches": debug.max_matches,
-                "candidate_limit": debug.candidate_limit,
-                "lexical_min_score": debug.lexical_min_score,
-                "vector_min_score": debug.vector_min_score,
-            }),
-        );
-    }
-    let expected = expected_category.trim();
-    if !expected.is_empty() {
-        value.insert("expected_category".to_owned(), serde_json::json!(expected));
-        value.insert(
-            "category_matched".to_owned(),
-            serde_json::json!(admin_shield_category_matched(&result.matches, expected)),
-        );
-    }
-    serde_json::Value::Object(value)
-}
-
-async fn admin_taskman_jobs_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    if !routes.taskman_inspector.is_configured() {
-        return admin_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "task manager not configured",
-        );
-    }
-    let filter = match admin_taskman_jobs_filter(raw_query) {
-        Ok(filter) => filter,
-        Err(response) => return *response,
-    };
-    match openplotva_server::RuntimeTaskmanInspector::list_jobs(&routes.taskman_inspector, filter)
-        .await
-    {
-        Ok(result) => {
-            admin_json_no_cache_response(StatusCode::OK, admin_taskman_list_json(&result))
-        }
-        Err(error) => {
-            tracing::warn!(%error, "failed to list admin taskman jobs");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_taskman_jobs_clear_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::POST && method != Method::DELETE {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    if !routes.taskman_inspector.is_configured() {
-        return admin_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "task manager not configured",
-        );
-    }
-    let mut filter = match admin_taskman_jobs_filter(raw_query) {
-        Ok(filter) => filter,
-        Err(response) => return *response,
-    };
-    filter.offset = 0;
-    filter.limit = 0;
-    match routes.taskman_inspector.delete_jobs(filter).await {
-        Ok(result) => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({
-                "ok": true,
-                "matched": result.matched,
-                "deleted": result.deleted,
-                "deleted_active": result.deleted_active,
-                "skipped_active": result.skipped_active,
-            }),
-        ),
-        Err(error) => {
-            tracing::warn!(%error, "failed to clear admin taskman jobs");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_taskman_job_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    if !routes.taskman_inspector.is_configured() {
-        return admin_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "task manager not configured",
-        );
-    }
-    let job_id = match admin_taskman_job_id(raw_query) {
-        Ok(job_id) => job_id,
-        Err(response) => return *response,
-    };
-    match openplotva_server::RuntimeTaskmanInspector::job(&routes.taskman_inspector, job_id).await {
-        Ok(Some(details)) => {
-            admin_json_no_cache_response(StatusCode::OK, admin_taskman_details_json(&details))
-        }
-        Ok(None) => admin_error_response(StatusCode::NOT_FOUND, "not found"),
-        Err(error) => {
-            tracing::warn!(%error, job_id, "failed to load admin taskman job");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-fn admin_taskman_job_cancel_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::POST && method != Method::PUT {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    if !routes.taskman_inspector.is_configured() {
-        return admin_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "task manager not configured",
-        );
-    }
-    let job_id = match admin_taskman_job_id(raw_query) {
-        Ok(job_id) => job_id,
-        Err(response) => return *response,
-    };
-    match routes.taskman_inspector.cancel_job(job_id) {
-        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
-        Err(error) => {
-            tracing::warn!(%error, job_id, "failed to cancel admin taskman job");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_taskman_job_restart_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::POST && method != Method::PUT {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    if !routes.taskman_inspector.is_configured() {
-        return admin_error_response(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "task manager not configured",
-        );
-    }
-    let job_id = match admin_taskman_job_id(raw_query) {
-        Ok(job_id) => job_id,
-        Err(response) => return *response,
-    };
-    match routes.taskman_inspector.restart_job(job_id).await {
-        Ok(new_job_id) => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "ok": true, "new_job_id": new_job_id }),
-        ),
-        Err(error) => {
-            tracing::warn!(%error, job_id, "failed to restart admin taskman job");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-fn admin_taskman_jobs_filter(
-    raw_query: Option<&str>,
-) -> Result<openplotva_server::RuntimeTaskmanJobsFilter, Box<Response>> {
-    let values = admin_auth_query_values(raw_query);
-    Ok(openplotva_server::RuntimeTaskmanJobsFilter {
-        q: values
-            .get("q")
-            .map(|value| value.trim().to_owned())
-            .unwrap_or_default(),
-        status: admin_taskman_csv_values(&values, "status")
-            .into_iter()
-            .map(|status| {
-                admin_taskman_valid_choice(
-                    &status,
-                    &["pending", "processing", "completed", "failed", "cancelled"],
-                    "invalid status",
-                )
-            })
-            .collect::<Result<Vec<_>, _>>()?,
-        queue: admin_taskman_csv_values(&values, "queue"),
-        user_id: admin_taskman_i64(&values, "user_id", "invalid user_id")?,
-        chat_id: admin_taskman_i64(&values, "chat_id", "invalid chat_id")?,
-        time_field: values
-            .get("time_field")
-            .map(|value| {
-                admin_taskman_optional_choice(
-                    value,
-                    &["created_at", "started_at", "completed_at"],
-                    "invalid time_field",
-                )
-            })
-            .transpose()?
-            .unwrap_or_default(),
-        from: values
-            .get("from")
-            .map(|value| admin_taskman_time(value, "invalid from"))
-            .transpose()?
-            .unwrap_or_default(),
-        to: values
-            .get("to")
-            .map(|value| admin_taskman_time(value, "invalid to"))
-            .transpose()?
-            .unwrap_or_default(),
-        sort_by: values
-            .get("sort_by")
-            .map(|value| {
-                admin_taskman_optional_choice(
-                    value,
-                    &["id", "priority", "created_at", "started_at", "completed_at"],
-                    "invalid sort_by",
-                )
-            })
-            .transpose()?
-            .unwrap_or_default(),
-        sort_dir: values
-            .get("sort_dir")
-            .map(|value| admin_taskman_optional_choice(value, &["asc", "desc"], "invalid sort_dir"))
-            .transpose()?
-            .unwrap_or_default(),
-        offset: admin_taskman_i32(&values, "offset", "invalid offset")?.unwrap_or_default(),
-        limit: admin_taskman_i32(&values, "limit", "invalid limit")?.unwrap_or_default(),
-    })
-}
-
-fn admin_taskman_job_id(raw_query: Option<&str>) -> Result<i64, Box<Response>> {
-    let values = admin_auth_query_values(raw_query);
-    let raw = values
-        .get("job_id")
-        .or_else(|| values.get("id"))
-        .map(|value| value.trim())
-        .filter(|value| !value.is_empty())
-        .ok_or_else(|| {
-            Box::new(admin_error_response(
-                StatusCode::BAD_REQUEST,
-                "job_id required",
-            ))
-        })?;
-    let id = raw.parse::<i64>().map_err(|_| {
-        Box::new(admin_error_response(
-            StatusCode::BAD_REQUEST,
-            "invalid job_id",
-        ))
-    })?;
-    if id <= 0 {
-        return Err(Box::new(admin_error_response(
-            StatusCode::BAD_REQUEST,
-            "invalid job_id",
-        )));
-    }
-    Ok(id)
-}
-
-fn admin_taskman_csv_values(values: &BTreeMap<String, String>, key: &str) -> Vec<String> {
-    values
-        .get(key)
-        .map(|value| {
-            value
-                .split(',')
-                .map(str::trim)
-                .filter(|value| !value.is_empty())
-                .map(str::to_owned)
-                .collect()
-        })
-        .unwrap_or_default()
-}
-
-fn admin_taskman_i64(
-    values: &BTreeMap<String, String>,
-    key: &str,
-    invalid: &str,
-) -> Result<Option<i64>, Box<Response>> {
-    let Some(value) = values
-        .get(key)
-        .map(|value| value.trim())
-        .filter(|value| !value.is_empty())
-    else {
-        return Ok(None);
-    };
-    value
-        .parse::<i64>()
-        .map(Some)
-        .map_err(|_| Box::new(admin_error_response(StatusCode::BAD_REQUEST, invalid)))
-}
-
-fn admin_taskman_i32(
-    values: &BTreeMap<String, String>,
-    key: &str,
-    invalid: &str,
-) -> Result<Option<i32>, Box<Response>> {
-    let Some(value) = values
-        .get(key)
-        .map(|value| value.trim())
-        .filter(|value| !value.is_empty())
-    else {
-        return Ok(None);
-    };
-    value
-        .parse::<i32>()
-        .map(Some)
-        .map_err(|_| Box::new(admin_error_response(StatusCode::BAD_REQUEST, invalid)))
-}
-
-fn admin_taskman_optional_choice(
-    value: &str,
-    allowed: &[&str],
-    invalid: &str,
-) -> Result<String, Box<Response>> {
-    let value = value.trim();
-    if value.is_empty() {
-        return Ok(String::new());
-    }
-    admin_taskman_valid_choice(value, allowed, invalid)
-}
-
-fn admin_taskman_valid_choice(
-    value: &str,
-    allowed: &[&str],
-    invalid: &str,
-) -> Result<String, Box<Response>> {
-    if allowed.contains(&value) {
-        Ok(value.to_owned())
-    } else {
-        Err(Box::new(admin_error_response(
-            StatusCode::BAD_REQUEST,
-            invalid,
-        )))
-    }
-}
-
-fn admin_taskman_time(value: &str, invalid: &str) -> Result<String, Box<Response>> {
-    let value = value.trim();
-    if value.is_empty() {
-        return Ok(String::new());
-    }
-    if let Ok(parsed) = OffsetDateTime::parse(value, &Rfc3339) {
-        return Ok(admin_format_time(parsed));
-    }
-    if let Ok(timestamp) = value.parse::<i64>()
-        && let Ok(parsed) = OffsetDateTime::from_unix_timestamp(timestamp)
-    {
-        return Ok(admin_format_time(parsed));
-    }
-    Err(Box::new(admin_error_response(
-        StatusCode::BAD_REQUEST,
-        invalid,
-    )))
-}
-
-fn admin_taskman_list_json(
-    result: &openplotva_server::RuntimeTaskmanJobListResultData,
-) -> serde_json::Value {
-    serde_json::json!({
-        "total": result.total,
-        "offset": result.offset,
-        "limit": result.limit,
-        "summary": {
-            "by_status": result.summary.by_status,
-            "by_queue": result.summary.by_queue,
-        },
-        "items": result.items.iter().map(admin_taskman_list_entry_json).collect::<Vec<_>>(),
-    })
-}
-
-fn admin_taskman_list_entry_json(
-    item: &openplotva_server::RuntimeTaskmanJobListEntryData,
-) -> serde_json::Value {
-    let mut value = admin_taskman_job_base_json(
-        item.id,
-        &item.queue_name,
-        item.priority,
-        &item.title,
-        Some(serde_json::json!(item.job_type)),
-        &item.status,
-        item.user_id,
-        item.chat_id,
-        item.trigger_message_id,
-        item.thread_message_id,
-        item.progress_message_id,
-        item.result_message_id,
-        item.worker_id.as_deref(),
-        &item.created_at,
-        item.started_at.as_deref(),
-        item.completed_at.as_deref(),
-        item.error_message.as_deref(),
-        item.processing_timeout_seconds,
-        item.prompt_hash.as_deref(),
-        item.estimated_processing_time,
-        item.actual_processing_time,
-    );
-    if let Some(preview) = item.preview.as_deref().filter(|value| !value.is_empty()) {
-        value.insert("preview".to_owned(), serde_json::json!(preview));
-    }
-    serde_json::Value::Object(value)
-}
-
-fn admin_taskman_details_json(
-    details: &openplotva_server::RuntimeTaskmanJobDetailsData,
-) -> serde_json::Value {
-    let mut value = serde_json::Map::new();
-    value.insert("job".to_owned(), admin_taskman_job_json(&details.job));
-    value.insert(
-        "messages".to_owned(),
-        serde_json::json!(
-            details
-                .messages
-                .iter()
-                .map(admin_taskman_message_json)
-                .collect::<Vec<_>>()
-        ),
-    );
-    if let Some(events) = details.events.as_ref() {
-        value.insert("events".to_owned(), events.clone());
-    }
-    serde_json::Value::Object(value)
-}
-
-fn admin_taskman_job_json(job: &openplotva_server::RuntimeTaskmanJobData) -> serde_json::Value {
-    serde_json::Value::Object(admin_taskman_job_base_json(
-        job.id,
-        &job.queue_name,
-        job.priority,
-        &job.title,
-        job.payload.clone(),
-        &job.status,
-        job.user_id,
-        job.chat_id,
-        job.trigger_message_id,
-        job.thread_message_id,
-        job.progress_message_id,
-        job.result_message_id,
-        job.worker_id.as_deref(),
-        &job.created_at,
-        job.started_at.as_deref(),
-        job.completed_at.as_deref(),
-        job.error_message.as_deref(),
-        job.processing_timeout_seconds,
-        job.prompt_hash.as_deref(),
-        job.estimated_processing_time,
-        job.actual_processing_time,
-    ))
-}
-
-#[allow(clippy::too_many_arguments)]
-fn admin_taskman_job_base_json(
-    id: i64,
-    queue_name: &str,
-    priority: i32,
-    title: &str,
-    payload_or_type: Option<serde_json::Value>,
-    status: &str,
-    user_id: i64,
-    chat_id: i64,
-    trigger_message_id: i32,
-    thread_message_id: Option<i32>,
-    progress_message_id: Option<i32>,
-    result_message_id: Option<i32>,
-    worker_id: Option<&str>,
-    created_at: &str,
-    started_at: Option<&str>,
-    completed_at: Option<&str>,
-    error_message: Option<&str>,
-    processing_timeout_seconds: i32,
-    prompt_hash: Option<&str>,
-    estimated_processing_time: Option<i32>,
-    actual_processing_time: Option<i32>,
-) -> serde_json::Map<String, serde_json::Value> {
-    let mut value = serde_json::Map::new();
-    value.insert("id".to_owned(), serde_json::json!(id));
-    value.insert("queue_name".to_owned(), serde_json::json!(queue_name));
-    value.insert("priority".to_owned(), serde_json::json!(priority));
-    value.insert("title".to_owned(), serde_json::json!(title));
-    if let Some(payload_or_type) = payload_or_type {
-        let key = if payload_or_type.is_string() {
-            "job_type"
-        } else {
-            "payload"
-        };
-        value.insert(key.to_owned(), payload_or_type);
-    }
-    value.insert("status".to_owned(), serde_json::json!(status));
-    value.insert("user_id".to_owned(), serde_json::json!(user_id));
-    value.insert("chat_id".to_owned(), serde_json::json!(chat_id));
-    value.insert(
-        "trigger_message_id".to_owned(),
-        serde_json::json!(trigger_message_id),
-    );
-    admin_insert_i32_option(&mut value, "thread_message_id", thread_message_id);
-    admin_insert_i32_option(&mut value, "progress_message_id", progress_message_id);
-    admin_insert_i32_option(&mut value, "result_message_id", result_message_id);
-    admin_insert_str_option(&mut value, "worker_id", worker_id);
-    value.insert("created_at".to_owned(), serde_json::json!(created_at));
-    admin_insert_str_option(&mut value, "started_at", started_at);
-    admin_insert_str_option(&mut value, "completed_at", completed_at);
-    admin_insert_str_option(&mut value, "error_message", error_message);
-    value.insert(
-        "processing_timeout_seconds".to_owned(),
-        serde_json::json!(processing_timeout_seconds),
-    );
-    admin_insert_str_option(&mut value, "prompt_hash", prompt_hash);
-    admin_insert_i32_option(
-        &mut value,
-        "estimated_processing_time",
-        estimated_processing_time,
-    );
-    admin_insert_i32_option(&mut value, "actual_processing_time", actual_processing_time);
-    value
-}
-
-fn admin_taskman_message_json(
-    message: &openplotva_server::RuntimeTaskmanJobMessageData,
-) -> serde_json::Value {
-    serde_json::json!({
-        "id": message.id,
-        "job_id": message.job_id,
-        "message_type": message.message_type,
-        "chat_id": message.chat_id,
-        "message_id": message.message_id,
-        "created_at": message.created_at,
-        "status": message.status,
-    })
-}
-
-fn admin_insert_i32_option(
-    value: &mut serde_json::Map<String, serde_json::Value>,
-    key: &str,
-    item: Option<i32>,
-) {
-    if let Some(item) = item {
-        value.insert(key.to_owned(), serde_json::json!(item));
-    }
-}
-
-fn admin_insert_str_option(
-    value: &mut serde_json::Map<String, serde_json::Value>,
-    key: &str,
-    item: Option<&str>,
-) {
-    if let Some(item) = item {
-        value.insert(key.to_owned(), serde_json::json!(item));
-    }
-}
-
-async fn admin_chat_get_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query);
-    let chat_id =
-        match admin_required_i64(&values, "chat_id", "chat_id required", "invalid chat_id") {
-            Ok(value) => value,
-            Err(response) => return *response,
-        };
-    let Some(pool) = routes.postgres.as_ref() else {
-        return admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({
-                "info": null,
-                "settings": null,
-                "permissions": null,
-                "members_count": 0,
-                "blocked": false,
-            }),
-        );
-    };
-    sync_admin_members_for_web(routes, chat_id).await;
-    let info = admin_fetch_optional_json(pool, SQL_ADMIN_GET_CHAT, chat_id, admin_chat_json).await;
-    let settings = admin_fetch_optional_json(
-        pool,
-        SQL_ADMIN_GET_CHAT_SETTINGS,
-        chat_id,
-        admin_settings_json,
-    )
-    .await;
-    let permissions = admin_fetch_optional_json(
-        pool,
-        SQL_ADMIN_GET_CHAT_PERMISSIONS,
-        chat_id,
-        admin_permissions_json,
-    )
-    .await;
-    let members_count = sqlx::query_scalar::<_, i64>(SQL_ADMIN_COUNT_CHAT_MEMBERS)
-        .bind(chat_id)
-        .fetch_optional(pool)
-        .await
-        .ok()
-        .flatten()
-        .unwrap_or(0);
-    let blocked = match routes.redis.clone() {
-        Some(redis) => RedisBlockedChatStore::new(redis)
-            .blocked_until(chat_id)
-            .await
-            .ok()
-            .flatten()
-            .is_some(),
-        None => false,
-    };
-    admin_json_response(
-        StatusCode::OK,
-        serde_json::json!({
-            "info": info,
-            "settings": settings,
-            "permissions": permissions,
-            "members_count": members_count,
-            "blocked": blocked,
-        }),
-    )
-}
-
-async fn admin_chat_settings_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    body: &[u8],
-) -> Response {
-    if method != Method::POST && method != Method::PUT {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Ok(mut req) = serde_json::from_slice::<AdminChatSettingsUpdateRequest>(body) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "bad request");
-    };
-    if req.chat_id == 0 {
-        return admin_error_response(StatusCode::BAD_REQUEST, "chat_id required");
-    }
-    req.custom_persona = openplotva_web::truncate_custom_persona(req.custom_persona.take());
-    let Some(settings_store) = routes.settings_store.as_ref() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    let cur = settings_store
-        .get_chat_settings(req.chat_id)
-        .await
-        .ok()
-        .flatten()
-        .unwrap_or_else(|| openplotva_core::ChatSettings::defaults(req.chat_id));
-    let chat_type = admin_chat_type(routes, req.chat_id).await;
-    let update = openplotva_core::ChatSettingsUpdate {
-        chat_id: req.chat_id,
-        chat_type,
-        mood_alignment: req.mood_alignment,
-        custom_persona: req.custom_persona,
-        reactivity_percentage: req
-            .reactivity_percentage
-            .unwrap_or(cur.reactivity_percentage),
-        proactivity_percentage: req
-            .proactivity_percentage
-            .unwrap_or(cur.proactivity_percentage),
-        enable_global_text_reply: req
-            .enable_global_text_reply
-            .unwrap_or(cur.enable_global_text_reply),
-        enable_global_draw_reply: req
-            .enable_global_draw_reply
-            .unwrap_or(cur.enable_global_draw_reply),
-        enable_obscenifier: req.enable_obscenifier.unwrap_or(cur.enable_obscenifier),
-        enable_profanity: req.enable_profanity.unwrap_or(cur.enable_profanity),
-        enable_greet_joiners: req.enable_greet_joiners.unwrap_or(cur.enable_greet_joiners),
-        enable_daily_game: req
-            .enable_daily_game
-            .unwrap_or_else(|| cur.enable_daily_game.unwrap_or(true)),
-        daily_game_theme: req
-            .daily_game_theme
-            .unwrap_or_else(|| cur.daily_game_theme.unwrap_or_default()),
-        greeting_html: req.greeting_html,
-    };
-    match settings_store.upsert_chat_settings(&update).await {
-        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
-        Err(error) => {
-            tracing::warn!(%error, chat_id = req.chat_id, "failed to update admin chat settings");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_chat_block_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::POST {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query);
-    let chat_id =
-        match admin_required_i64(&values, "chat_id", "chat_id required", "invalid chat_id") {
-            Ok(value) => value,
-            Err(response) => return *response,
-        };
-    let minutes = values
-        .get("minutes")
-        .and_then(|value| value.parse::<i64>().ok())
-        .filter(|value| *value > 0)
-        .unwrap_or(10);
-    let until = OffsetDateTime::now_utc() + time::Duration::minutes(minutes);
-    let Some(redis) = routes.redis.clone() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    let ttl = Duration::from_secs((minutes as u64).saturating_mul(60));
-    match RedisBlockedChatStore::new(redis)
-        .block_chat_until_with_ttl(chat_id, until, ttl)
-        .await
-    {
-        Ok(()) => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "ok": true, "until": admin_format_time(until) }),
-        ),
-        Err(error) => {
-            tracing::warn!(%error, chat_id, "failed to block chat from admin web");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_chat_unblock_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::DELETE {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query);
-    let chat_id =
-        match admin_required_i64(&values, "chat_id", "chat_id required", "invalid chat_id") {
-            Ok(value) => value,
-            Err(response) => return *response,
-        };
-    let Some(redis) = routes.redis_inspector() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    let Some(redis_client) = routes.redis.clone() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    let key = RedisBlockedChatStore::new(redis_client).key_for_chat(chat_id);
-    match redis.delete_key(&key).await {
-        Ok(()) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
-        Err(error) => {
-            tracing::warn!(%error, chat_id, "failed to unblock chat from admin web");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_chat_members_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query);
-    let chat_id =
-        match admin_required_i64(&values, "chat_id", "chat_id required", "invalid chat_id") {
-            Ok(value) => value,
-            Err(response) => return *response,
-        };
-    let Some(pool) = routes.postgres.as_ref() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed to load members");
-    };
-    sync_admin_members_for_web(routes, chat_id).await;
-    match sqlx::query(SQL_ADMIN_LIST_CHAT_MEMBERS_WITH_USERS)
-        .bind(chat_id)
-        .fetch_all(pool)
-        .await
-    {
-        Ok(rows) => {
-            let members = rows
-                .into_iter()
-                .map(|row| {
-                    serde_json::json!({
-                        "member": admin_chat_member_prefixed_json(&row),
-                        "user": admin_user_prefixed_json(&row),
-                    })
-                })
-                .collect::<Vec<_>>();
-            admin_json_response(StatusCode::OK, serde_json::json!({ "members": members }))
-        }
-        Err(error) => {
-            tracing::warn!(%error, chat_id, "failed to list admin chat members");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed to load members")
-        }
-    }
-}
-
-async fn sync_admin_members_for_web(routes: &StaticWebRoutes, chat_id: i64) {
-    let (Some(member_store), Some(telegram)) = (&routes.member_store, &routes.telegram) else {
-        return;
-    };
-    match settings::sync_chat_admins_with_sources(member_store, telegram, chat_id).await {
-        Ok(report) => tracing::debug!(
-            chat_id,
-            source = ?report.source,
-            admin_count = report.admin_count,
-            member_upsert_errors = report.member_upsert_errors,
-            user_upsert_errors = report.user_upsert_errors,
-            cache_errors = report.cache_errors,
-            "refreshed admin members for web route"
-        ),
-        Err(error) => {
-            tracing::debug!(%error, chat_id, "Telegram admin freshness failed for web route");
-        }
-    }
-}
-
-async fn admin_chats_list_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(pool) = routes.postgres.as_ref() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    let q = admin_auth_query_values(raw_query)
-        .remove("q")
-        .map(|value| value.trim().to_lowercase())
-        .filter(|value| !value.is_empty());
-    let rows = match q.as_deref() {
-        Some(search) => {
-            sqlx::query(SQL_ADMIN_LIST_CHATS_FILTERED)
-                .bind(search)
-                .bind(ADMIN_PAGE_LIMIT)
-                .bind(0_i64)
-                .fetch_all(pool)
-                .await
-        }
-        None => {
-            sqlx::query(SQL_ADMIN_LIST_CHATS)
-                .bind(ADMIN_PAGE_LIMIT)
-                .bind(0_i64)
-                .fetch_all(pool)
-                .await
-        }
-    };
-    match rows {
-        Ok(rows) => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "chats": rows.iter().map(admin_chat_json).collect::<Vec<_>>() }),
-        ),
-        Err(error) => {
-            tracing::warn!(%error, "failed to list admin chats");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_chats_search_by_member_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query);
-    let username = values
-        .get("username")
-        .map(|value| value.trim().to_owned())
-        .filter(|value| !value.is_empty());
-    let user_id = values
-        .get("user_id")
-        .and_then(|value| value.parse::<i64>().ok());
-    if username.is_none() && user_id.is_none() {
-        return admin_error_response(StatusCode::BAD_REQUEST, "username or user_id required");
-    }
-    let Some(pool) = routes.postgres.as_ref() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error");
-    };
-    match sqlx::query(SQL_ADMIN_SEARCH_CHATS_BY_MEMBER)
-        .bind(username.as_deref())
-        .bind(user_id)
-        .bind(ADMIN_PAGE_LIMIT)
-        .fetch_all(pool)
-        .await
-    {
-        Ok(rows) => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "chats": rows.iter().map(admin_chat_json).collect::<Vec<_>>() }),
-        ),
-        Err(error) => {
-            tracing::warn!(%error, "failed to search admin chats by member");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error")
-        }
-    }
-}
-
-async fn admin_users_list_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(pool) = routes.postgres.as_ref() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error");
-    };
-    let q = admin_auth_query_values(raw_query)
-        .remove("q")
-        .map(|value| value.trim().to_lowercase())
-        .filter(|value| !value.is_empty());
-    match sqlx::query(SQL_ADMIN_LIST_USERS_FILTERED)
-        .bind(q.as_deref())
-        .bind(ADMIN_PAGE_LIMIT)
-        .bind(0_i64)
-        .fetch_all(pool)
-        .await
-    {
-        Ok(rows) => (
-            StatusCode::OK,
-            [
-                (header::CONTENT_TYPE, "application/json"),
-                (header::CACHE_CONTROL, "no-cache"),
-            ],
-            format!(
-                "{}\n",
-                serde_json::json!({ "users": rows.iter().map(admin_user_json).collect::<Vec<_>>() })
-            ),
-        )
-            .into_response(),
-        Err(error) => {
-            tracing::warn!(%error, "failed to list admin users");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error")
-        }
-    }
-}
-
-async fn admin_vip_users_list_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(pool) = routes.postgres.as_ref() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error");
-    };
-    let values = admin_auth_query_values(raw_query);
-    let status = values
-        .get("status")
-        .map(|value| value.trim().to_lowercase())
-        .filter(|value| matches!(value.as_str(), "active" | "expired" | "all"))
-        .unwrap_or_else(|| "active".to_owned());
-    let q = values
-        .get("q")
-        .map(|value| value.trim().to_owned())
-        .filter(|value| !value.is_empty());
-    match sqlx::query(SQL_ADMIN_LIST_VIP_USERS)
-        .bind(status)
-        .bind(q.as_deref())
-        .bind(ADMIN_PAGE_LIMIT)
-        .bind(0_i64)
-        .fetch_all(pool)
-        .await
-    {
-        Ok(rows) => admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "users": rows.iter().map(admin_vip_user_json).collect::<Vec<_>>() }),
-        ),
-        Err(error) => {
-            tracing::warn!(%error, "failed to list admin vip users");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "database error")
-        }
-    }
-}
-
-async fn admin_user_get_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query);
-    let Some(pool) = routes.postgres.as_ref() else {
-        return admin_error_response(StatusCode::NOT_FOUND, "not found");
-    };
-    let user_row = if let Some(id_raw) = values.get("id").filter(|value| !value.is_empty()) {
-        let Ok(id) = id_raw.parse::<i64>() else {
-            return admin_error_response(StatusCode::BAD_REQUEST, "invalid id");
-        };
-        sqlx::query(SQL_ADMIN_GET_USER)
-            .bind(id)
-            .fetch_optional(pool)
-            .await
-    } else if let Some(username) = values.get("username").filter(|value| !value.is_empty()) {
-        sqlx::query(SQL_ADMIN_GET_USER_BY_USERNAME)
-            .bind(username)
-            .fetch_optional(pool)
-            .await
-    } else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "id or username required");
-    };
-    let user_row = match user_row {
-        Ok(Some(row)) => row,
-        Ok(None) | Err(_) => return admin_error_response(StatusCode::NOT_FOUND, "not found"),
-    };
-    let user_id = user_row.try_get::<i64, _>("id").unwrap_or_default();
-    let payment_store = PostgresPaymentStore::new(pool.clone());
-    let vip_store = routes
-        .vip_store
-        .clone()
-        .unwrap_or_else(|| PostgresVipStore::new(pool.clone()));
-    let subscription = payment_store
-        .get_active_subscription(user_id)
-        .await
-        .ok()
-        .flatten()
-        .map(admin_subscription_json);
-    let vip_cache = vip_store
-        .get_vip_cache(user_id)
-        .await
-        .ok()
-        .flatten()
-        .map(admin_vip_cache_json);
-    let vip_summary = match vip_store.get_vip_summary_by_user(user_id).await {
-        Ok(summary) => admin_vip_summary_json(summary.as_ref()),
-        Err(_) => admin_vip_summary_json(None),
-    };
-    let vip_events = match vip_store.list_vip_events_by_user(user_id).await {
-        Ok(events) => events.iter().map(admin_vip_event_json).collect::<Vec<_>>(),
-        Err(error) => {
-            tracing::warn!(%error, user_id, "failed to load admin vip events");
-            return admin_error_response(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "failed to load vip events",
-            );
-        }
-    };
-    let subscriptions = match payment_store.list_subscriptions_by_user(user_id).await {
-        Ok(items) => items
-            .iter()
-            .map(admin_subscription_artifact_json)
-            .collect::<Vec<_>>(),
-        Err(error) => {
-            tracing::warn!(%error, user_id, "failed to load admin subscriptions");
-            return admin_error_response(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "failed to load subscriptions",
-            );
-        }
-    };
-    admin_json_response(
-        StatusCode::OK,
-        serde_json::json!({
-            "user": admin_user_json(&user_row),
-            "subscription": subscription,
-            "vip": vip_cache,
-            "vip_summary": vip_summary,
-            "vip_events": vip_events,
-            "subscriptions": subscriptions,
-        }),
-    )
-}
-
-async fn admin_user_grant_vip_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    body: &[u8],
-) -> Response {
-    if method != Method::POST && method != Method::PUT {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Ok(req) = serde_json::from_slice::<AdminVipGrantRequest>(body) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "bad request");
-    };
-    let Some(user_id) = admin_i64_from_json(&req.user_id) else {
-        return admin_error_response(
-            StatusCode::BAD_REQUEST,
-            "user_id and non-zero signed days required",
-        );
-    };
-    if user_id == 0 || req.days == 0 {
-        return admin_error_response(
-            StatusCode::BAD_REQUEST,
-            "user_id and non-zero signed days required",
-        );
-    }
-    let Some(pool) = routes.postgres.as_ref() else {
-        return admin_error_response(StatusCode::NOT_FOUND, "user not found");
-    };
-    let placeholder_name = format!("Telegram user {user_id}");
-    if let Err(error) = sqlx::query(SQL_ADMIN_ENSURE_USER)
-        .bind(user_id)
-        .bind(&placeholder_name)
-        .execute(pool)
-        .await
-    {
-        tracing::warn!(%error, user_id, "failed to ensure admin vip user");
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "user not found");
-    }
-    let admin_id = current_admin_user_id(headers, &routes.bot_token);
-    let reason = admin_non_empty_string(&req.reason)
-        .unwrap_or_else(|| format!("web admin adjustment by {admin_id}"));
-    let actor_user_id = admin_existing_user_id(pool, admin_id).await;
-    let vip_store = routes
-        .vip_store
-        .clone()
-        .unwrap_or_else(|| PostgresVipStore::new(pool.clone()));
-    match vip_store
-        .create_vip_event(openplotva_storage::VipEventCreate {
-            user_id,
-            event_type: openplotva_core::VIP_EVENT_TYPE_ADMIN_ADJUSTMENT,
-            delta_seconds: openplotva_core::vip_days_to_seconds(req.days),
-            subscription_id: None,
-            actor_user_id,
-            reason: Some(&reason),
-        })
-        .await
-    {
-        Ok(event) => {
-            let cache_invalidated = match vip_store.delete_vip_cache(user_id).await {
-                Ok(()) => true,
-                Err(error) => {
-                    tracing::warn!(%error, user_id, "failed to invalidate admin vip cache");
-                    false
-                }
-            };
-            admin_json_response(
-                StatusCode::OK,
-                serde_json::json!({
-                    "ok": true,
-                    "event_id": event.id,
-                    "expires_at": admin_format_time(event.effective_expires_at),
-                    "cache_invalidated": cache_invalidated,
-                }),
-            )
-        }
-        Err(error) => {
-            tracing::warn!(%error, user_id, "failed to grant admin vip");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_user_revoke_vip_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::DELETE {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query);
-    let user_id =
-        match admin_required_i64(&values, "user_id", "user_id required", "invalid user_id") {
-            Ok(value) => value,
-            Err(response) => return *response,
-        };
-    let Some(pool) = routes.postgres.as_ref() else {
-        return admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({ "ok": true, "revoked": false }),
-        );
-    };
-    let vip_store = routes
-        .vip_store
-        .clone()
-        .unwrap_or_else(|| PostgresVipStore::new(pool.clone()));
-    let summary = vip_store
-        .get_vip_summary_by_user(user_id)
-        .await
-        .ok()
-        .flatten();
-    if !admin_vip_summary_can_be_revoked(summary.as_ref()) {
-        let cache_invalidated = match vip_store.delete_vip_cache(user_id).await {
-            Ok(()) => true,
-            Err(error) => {
-                tracing::warn!(%error, user_id, "failed to invalidate inactive admin vip cache");
-                false
-            }
-        };
-        return admin_json_response(
-            StatusCode::OK,
-            serde_json::json!({
-                "ok": true,
-                "revoked": false,
-                "cache_invalidated": cache_invalidated,
-            }),
-        );
-    }
-    let summary = summary.expect("checked");
-    let admin_id = current_admin_user_id(headers, &routes.bot_token);
-    let reason = values
-        .get("reason")
-        .and_then(|value| admin_non_empty_string(value))
-        .unwrap_or_else(|| format!("web admin revoke by {admin_id}"));
-    let actor_user_id = admin_existing_user_id(pool, admin_id).await;
-    match vip_store
-        .create_vip_event(openplotva_storage::VipEventCreate {
-            user_id,
-            event_type: openplotva_core::VIP_EVENT_TYPE_ADMIN_REVOKE,
-            delta_seconds: -summary.remaining_seconds,
-            subscription_id: None,
-            actor_user_id,
-            reason: Some(&reason),
-        })
-        .await
-    {
-        Ok(_) => {
-            let cache_invalidated = match vip_store.delete_vip_cache(user_id).await {
-                Ok(()) => true,
-                Err(error) => {
-                    tracing::warn!(%error, user_id, "failed to invalidate revoked admin vip cache");
-                    false
-                }
-            };
-            admin_json_response(
-                StatusCode::OK,
-                serde_json::json!({
-                    "ok": true,
-                    "revoked": true,
-                    "cache_invalidated": cache_invalidated,
-                }),
-            )
-        }
-        Err(error) => {
-            tracing::warn!(%error, user_id, "failed to revoke admin vip");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_user_delete_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::DELETE {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let values = admin_auth_query_values(raw_query);
-    let user_id = match admin_required_i64(&values, "id", "id required", "invalid id") {
-        Ok(value) => value,
-        Err(response) => return *response,
-    };
-    let Some(pool) = routes.postgres.as_ref() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    match sqlx::query(SQL_ADMIN_SAFE_DELETE_USER)
-        .bind(user_id)
-        .execute(pool)
-        .await
-    {
-        Ok(_) => admin_json_response(StatusCode::OK, serde_json::json!({ "ok": true })),
-        Err(error) => {
-            tracing::warn!(%error, user_id, "failed to delete admin user");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_chat_type(routes: &StaticWebRoutes, chat_id: i64) -> String {
-    let Some(pool) = routes.postgres.as_ref() else {
-        return "private".to_owned();
-    };
-    sqlx::query_scalar::<_, String>(SQL_ADMIN_GET_CHAT_TYPE)
-        .bind(chat_id)
-        .fetch_optional(pool)
-        .await
-        .ok()
-        .flatten()
-        .map(|value| value.trim().to_owned())
-        .filter(|value| !value.is_empty())
-        .unwrap_or_else(|| "private".to_owned())
-}
-
-async fn admin_fetch_optional_json(
-    pool: &PgPool,
-    query: &'static str,
-    id: i64,
-    mapper: fn(&PgRow) -> serde_json::Value,
-) -> Option<serde_json::Value> {
-    sqlx::query(query)
-        .bind(id)
-        .fetch_optional(pool)
-        .await
-        .ok()
-        .flatten()
-        .as_ref()
-        .map(mapper)
-}
-
-fn admin_required_i64(
-    values: &BTreeMap<String, String>,
-    key: &str,
-    missing: &str,
-    invalid: &str,
-) -> Result<i64, Box<Response>> {
-    let Some(value) = values.get(key).filter(|value| !value.is_empty()) else {
-        return Err(Box::new(admin_error_response(
-            StatusCode::BAD_REQUEST,
-            missing,
-        )));
-    };
-    value
-        .parse::<i64>()
-        .map_err(|_| Box::new(admin_error_response(StatusCode::BAD_REQUEST, invalid)))
-}
-
-fn current_admin_user_id(headers: &HeaderMap, secret: &str) -> i64 {
-    admin_session_user_id(headers, secret).unwrap_or(0)
-}
-
-async fn admin_existing_user_id(pool: &PgPool, user_id: i64) -> Option<i64> {
-    if user_id <= 0 {
-        return None;
-    }
-    sqlx::query(SQL_ADMIN_GET_USER)
-        .bind(user_id)
-        .fetch_optional(pool)
-        .await
-        .ok()
-        .flatten()
-        .map(|_| user_id)
-}
-
-fn admin_non_empty_string(value: &str) -> Option<String> {
-    let normalized = value.trim().to_owned();
-    (!normalized.is_empty()).then_some(normalized)
-}
-
-fn admin_i64_from_json(value: &serde_json::Value) -> Option<i64> {
-    value.as_i64().or_else(|| {
-        value
-            .as_str()
-            .and_then(|value| value.trim().parse::<i64>().ok())
-    })
-}
-
-fn admin_format_time(value: OffsetDateTime) -> String {
-    value
-        .format(&Rfc3339)
-        .unwrap_or_else(|_| value.unix_timestamp().to_string())
-}
-
-fn admin_time_json(value: Option<OffsetDateTime>) -> serde_json::Value {
-    value
-        .map(admin_format_time)
-        .map(serde_json::Value::String)
-        .unwrap_or(serde_json::Value::Null)
-}
-
-fn admin_row_time(row: &PgRow, key: &str) -> serde_json::Value {
-    admin_time_json(row.try_get::<Option<OffsetDateTime>, _>(key).ok().flatten())
-}
-
-fn admin_jsonb_base64(row: &PgRow, key: &str) -> serde_json::Value {
-    row.try_get::<Option<serde_json::Value>, _>(key)
-        .ok()
-        .flatten()
-        .and_then(|value| serde_json::to_vec(&value).ok())
-        .map(|bytes| BASE64_STANDARD.encode(bytes))
-        .map(serde_json::Value::String)
-        .unwrap_or(serde_json::Value::Null)
-}
-
-fn admin_i64_json(row: &PgRow, key: &str) -> serde_json::Value {
-    row.try_get::<Option<i64>, _>(key)
-        .ok()
-        .flatten()
-        .map(serde_json::Value::from)
-        .unwrap_or(serde_json::Value::Null)
-}
-
-fn admin_bool_json(row: &PgRow, key: &str) -> serde_json::Value {
-    row.try_get::<Option<bool>, _>(key)
-        .ok()
-        .flatten()
-        .map(serde_json::Value::from)
-        .unwrap_or(serde_json::Value::Null)
-}
-
-fn admin_string_json(row: &PgRow, key: &str) -> serde_json::Value {
-    row.try_get::<Option<String>, _>(key)
-        .ok()
-        .flatten()
-        .map(serde_json::Value::from)
-        .unwrap_or(serde_json::Value::Null)
-}
-
-fn admin_chat_json(row: &PgRow) -> serde_json::Value {
-    serde_json::json!({
-        "id": row.try_get::<i64, _>("id").unwrap_or_default(),
-        "type": row.try_get::<String, _>("type").unwrap_or_default(),
-        "title": admin_string_json(row, "title"),
-        "username": admin_string_json(row, "username"),
-        "first_name": admin_string_json(row, "first_name"),
-        "last_name": admin_string_json(row, "last_name"),
-        "is_forum": admin_bool_json(row, "is_forum"),
-        "active_usernames": admin_jsonb_base64(row, "active_usernames"),
-        "available_reactions": admin_jsonb_base64(row, "available_reactions"),
-        "bio": admin_string_json(row, "bio"),
-        "has_private_forwards": admin_bool_json(row, "has_private_forwards"),
-        "has_restricted_voice_and_video_messages": admin_bool_json(row, "has_restricted_voice_and_video_messages"),
-        "join_to_send_messages": admin_bool_json(row, "join_to_send_messages"),
-        "join_by_request": admin_bool_json(row, "join_by_request"),
-        "description": admin_string_json(row, "description"),
-        "invite_link": admin_string_json(row, "invite_link"),
-        "pinned_message": admin_jsonb_base64(row, "pinned_message"),
-        "permissions": admin_jsonb_base64(row, "permissions"),
-        "slow_mode_delay": admin_i64_json(row, "slow_mode_delay"),
-        "message_auto_delete_time": admin_i64_json(row, "message_auto_delete_time"),
-        "has_aggressive_anti_spam_enabled": admin_bool_json(row, "has_aggressive_anti_spam_enabled"),
-        "has_hidden_members": admin_bool_json(row, "has_hidden_members"),
-        "has_protected_content": admin_bool_json(row, "has_protected_content"),
-        "has_visible_history": admin_bool_json(row, "has_visible_history"),
-        "sticker_set_name": admin_string_json(row, "sticker_set_name"),
-        "can_set_sticker_set": admin_bool_json(row, "can_set_sticker_set"),
-        "linked_chat_id": admin_i64_json(row, "linked_chat_id"),
-        "location": admin_jsonb_base64(row, "location"),
-        "discovered": admin_row_time(row, "discovered"),
-        "updated": admin_row_time(row, "updated"),
-    })
-}
-
-fn admin_user_json(row: &PgRow) -> serde_json::Value {
-    serde_json::json!({
-        "id": row.try_get::<i64, _>("id").unwrap_or_default(),
-        "is_premium": admin_bool_json(row, "is_premium"),
-        "first_name": row.try_get::<String, _>("first_name").unwrap_or_default(),
-        "last_name": admin_string_json(row, "last_name"),
-        "username": admin_string_json(row, "username"),
-        "language_code": admin_string_json(row, "language_code"),
-        "is_vip": admin_bool_json(row, "is_vip"),
-        "settings": admin_jsonb_base64(row, "settings"),
-        "discovered": admin_row_time(row, "discovered"),
-        "updated": admin_row_time(row, "updated"),
-    })
-}
-
-fn admin_vip_user_json(row: &PgRow) -> serde_json::Value {
-    let remaining_seconds = row
-        .try_get::<Option<i64>, _>("remaining_seconds")
-        .ok()
-        .flatten()
-        .unwrap_or_default();
-    let remaining_days = ((remaining_seconds as f64 / openplotva_core::VIP_SECONDS_PER_DAY as f64)
-        .ceil() as i64)
-        .max(0);
-    serde_json::json!({
-        "user": admin_user_json(row),
-        "vip_summary": {
-            "active": row.try_get::<Option<bool>, _>("vip_active").ok().flatten().unwrap_or(false),
-            "has_history": true,
-            "expires_at": admin_row_time(row, "vip_expires_at"),
-            "remaining_seconds": remaining_seconds,
-            "remaining_days": remaining_days,
-            "latest_event_id": row.try_get::<Option<i64>, _>("latest_event_id").ok().flatten(),
-            "latest_event_type": admin_string_json(row, "latest_event_type"),
-            "latest_delta_seconds": row.try_get::<Option<i64>, _>("latest_delta_seconds").ok().flatten().unwrap_or_default(),
-            "latest_reason": admin_string_json(row, "latest_reason"),
-            "latest_created_at": admin_row_time(row, "latest_created_at"),
-        },
-        "subscriptions_count": row.try_get::<Option<i64>, _>("subscriptions_count").ok().flatten().unwrap_or_default(),
-        "latest_subscription_expires_at": admin_row_time(row, "latest_subscription_expires_at"),
-    })
-}
-
-fn admin_settings_json(row: &PgRow) -> serde_json::Value {
-    serde_json::json!({
-        "chat_id": row.try_get::<i64, _>("chat_id").unwrap_or_default(),
-        "mood_alignment": admin_string_json(row, "mood_alignment"),
-        "custom_persona": admin_string_json(row, "custom_persona"),
-        "updated": admin_row_time(row, "updated"),
-        "reactivity_percentage": row.try_get::<i32, _>("reactivity_percentage").unwrap_or_default(),
-        "proactivity_percentage": row.try_get::<i32, _>("proactivity_percentage").unwrap_or_default(),
-        "enable_global_text_reply": row.try_get::<bool, _>("enable_global_text_reply").unwrap_or(false),
-        "enable_global_draw_reply": row.try_get::<bool, _>("enable_global_draw_reply").unwrap_or(false),
-        "enable_obscenifier": row.try_get::<bool, _>("enable_obscenifier").unwrap_or(false),
-        "enable_profanity": row.try_get::<bool, _>("enable_profanity").unwrap_or(false),
-        "enable_greet_joiners": row.try_get::<bool, _>("enable_greet_joiners").unwrap_or(false),
-        "enable_daily_game": admin_bool_json(row, "enable_daily_game"),
-        "daily_game_theme": admin_string_json(row, "daily_game_theme"),
-        "greeting_html": admin_string_json(row, "greeting_html"),
-    })
-}
-
-fn admin_permissions_json(row: &PgRow) -> serde_json::Value {
-    serde_json::json!({
-        "chat_id": row.try_get::<i64, _>("chat_id").unwrap_or_default(),
-        "status": row.try_get::<String, _>("status").unwrap_or_default(),
-        "can_manage_chat": admin_bool_json(row, "can_manage_chat"),
-        "can_delete_messages": admin_bool_json(row, "can_delete_messages"),
-        "can_manage_video_chats": admin_bool_json(row, "can_manage_video_chats"),
-        "can_restrict_members": admin_bool_json(row, "can_restrict_members"),
-        "can_promote_members": admin_bool_json(row, "can_promote_members"),
-        "can_change_info": admin_bool_json(row, "can_change_info"),
-        "can_invite_users": admin_bool_json(row, "can_invite_users"),
-        "can_post_messages": admin_bool_json(row, "can_post_messages"),
-        "can_edit_messages": admin_bool_json(row, "can_edit_messages"),
-        "can_pin_messages": admin_bool_json(row, "can_pin_messages"),
-        "can_manage_topics": admin_bool_json(row, "can_manage_topics"),
-        "can_send_messages": admin_bool_json(row, "can_send_messages"),
-        "can_send_media_messages": admin_bool_json(row, "can_send_media_messages"),
-        "can_send_polls": admin_bool_json(row, "can_send_polls"),
-        "can_send_other_messages": admin_bool_json(row, "can_send_other_messages"),
-        "can_add_web_page_previews": admin_bool_json(row, "can_add_web_page_previews"),
-        "last_checked_at": admin_row_time(row, "last_checked_at"),
-        "last_error_at": admin_row_time(row, "last_error_at"),
-        "error_count": row.try_get::<Option<i32>, _>("error_count").ok().flatten(),
-        "error_message": admin_string_json(row, "error_message"),
-        "created_at": admin_row_time(row, "created_at"),
-        "updated_at": admin_row_time(row, "updated_at"),
-    })
-}
-
-fn admin_chat_member_prefixed_json(row: &PgRow) -> serde_json::Value {
-    serde_json::json!({
-        "chat_id": row.try_get::<i64, _>("member_chat_id").unwrap_or_default(),
-        "user_id": row.try_get::<i64, _>("member_user_id").unwrap_or_default(),
-        "status": row.try_get::<String, _>("member_status").unwrap_or_default(),
-        "is_anonymous": admin_bool_json(row, "member_is_anonymous"),
-        "custom_title": admin_string_json(row, "member_custom_title"),
-        "can_be_edited": admin_bool_json(row, "member_can_be_edited"),
-        "can_manage_chat": admin_bool_json(row, "member_can_manage_chat"),
-        "can_delete_messages": admin_bool_json(row, "member_can_delete_messages"),
-        "can_manage_video_chats": admin_bool_json(row, "member_can_manage_video_chats"),
-        "can_restrict_members": admin_bool_json(row, "member_can_restrict_members"),
-        "can_promote_members": admin_bool_json(row, "member_can_promote_members"),
-        "can_change_info": admin_bool_json(row, "member_can_change_info"),
-        "can_invite_users": admin_bool_json(row, "member_can_invite_users"),
-        "can_post_messages": admin_bool_json(row, "member_can_post_messages"),
-        "can_edit_messages": admin_bool_json(row, "member_can_edit_messages"),
-        "can_pin_messages": admin_bool_json(row, "member_can_pin_messages"),
-        "can_manage_topics": admin_bool_json(row, "member_can_manage_topics"),
-        "can_send_messages": admin_bool_json(row, "member_can_send_messages"),
-        "can_send_media_messages": admin_bool_json(row, "member_can_send_media_messages"),
-        "can_send_polls": admin_bool_json(row, "member_can_send_polls"),
-        "can_send_other_messages": admin_bool_json(row, "member_can_send_other_messages"),
-        "can_add_web_page_previews": admin_bool_json(row, "member_can_add_web_page_previews"),
-        "until_date": admin_row_time(row, "member_until_date"),
-        "created_at": admin_row_time(row, "member_created_at"),
-        "updated_at": admin_row_time(row, "member_updated_at"),
-        "last_message_at": admin_row_time(row, "member_last_message_at"),
-    })
-}
-
-fn admin_user_prefixed_json(row: &PgRow) -> serde_json::Value {
-    if row
-        .try_get::<Option<i64>, _>("user_id")
-        .ok()
-        .flatten()
-        .is_none()
-    {
-        return serde_json::Value::Null;
-    }
-    serde_json::json!({
-        "id": row.try_get::<i64, _>("user_id").unwrap_or_default(),
-        "is_premium": admin_bool_json(row, "user_is_premium"),
-        "first_name": row.try_get::<String, _>("user_first_name").unwrap_or_default(),
-        "last_name": admin_string_json(row, "user_last_name"),
-        "username": admin_string_json(row, "user_username"),
-        "language_code": admin_string_json(row, "user_language_code"),
-        "is_vip": admin_bool_json(row, "user_is_vip"),
-        "settings": admin_jsonb_base64(row, "user_settings"),
-        "discovered": admin_row_time(row, "user_discovered"),
-        "updated": admin_row_time(row, "user_updated"),
-    })
-}
-
-fn admin_subscription_json(item: openplotva_storage::SubscriptionRecord) -> serde_json::Value {
-    serde_json::json!({
-        "id": item.id,
-        "user_id": item.user_id,
-        "telegram_payment_charge_id": item.telegram_payment_charge_id,
-        "provider_payment_charge_id": item.provider_payment_charge_id,
-        "expires_at": admin_format_time(item.expires_at),
-        "created_at": admin_format_time(item.created_at),
-        "updated_at": admin_format_time(item.updated_at),
-        "canceled_at": admin_time_json(item.canceled_at),
-        "refunded_at": admin_time_json(item.refunded_at),
-    })
-}
-
-fn admin_subscription_artifact_json(
-    item: &openplotva_storage::SubscriptionRecord,
-) -> serde_json::Value {
-    serde_json::json!({
-        "id": item.id,
-        "telegram_payment_charge_id": item.telegram_payment_charge_id,
-        "provider_payment_charge_id": item.provider_payment_charge_id,
-        "expires_at": admin_format_time(item.expires_at),
-        "created_at": admin_format_time(item.created_at),
-        "updated_at": admin_format_time(item.updated_at),
-        "canceled_at": admin_time_json(item.canceled_at),
-        "refunded_at": admin_time_json(item.refunded_at),
-        "status": admin_subscription_status(item.expires_at, item.canceled_at, item.refunded_at),
-    })
-}
-
-fn admin_vip_cache_json(item: openplotva_storage::VipCacheRecord) -> serde_json::Value {
-    serde_json::json!({
-        "user_id": item.user_id,
-        "is_vip": item.is_vip,
-        "expires_at": admin_format_time(item.expires_at),
-        "created_at": admin_format_time(item.created_at),
-        "updated_at": admin_format_time(item.updated_at),
-    })
-}
-
-fn admin_vip_summary_json(
-    summary: Option<&openplotva_storage::VipSummaryRecord>,
-) -> serde_json::Value {
-    let Some(summary) = summary else {
-        return serde_json::json!({
-            "active": false,
-            "has_history": false,
-            "remaining_seconds": 0,
-            "remaining_days": 0,
-        });
-    };
-    let active = summary.is_active && OffsetDateTime::now_utc() < summary.effective_expires_at;
-    let remaining_days = if active {
-        let seconds = (summary.effective_expires_at - OffsetDateTime::now_utc()).whole_seconds();
-        ((seconds as f64 / openplotva_core::VIP_SECONDS_PER_DAY as f64).round() as i64).max(0)
-    } else {
-        0
-    };
-    serde_json::json!({
-        "active": active,
-        "has_history": true,
-        "expires_at": admin_format_time(summary.effective_expires_at),
-        "remaining_seconds": summary.remaining_seconds,
-        "remaining_days": remaining_days.max(0),
-        "latest_event_id": summary.latest_event_id,
-        "latest_event_type": summary.latest_event_type,
-        "latest_reason": summary.latest_reason,
-        "latest_created_at": admin_format_time(summary.latest_created_at),
-    })
-}
-
-fn admin_vip_event_json(item: &openplotva_storage::VipEventListRecord) -> serde_json::Value {
-    let actor_label = item
-        .actor_username
-        .as_ref()
-        .filter(|value| !value.is_empty())
-        .map(|value| format!("@{value}"))
-        .or_else(|| {
-            item.actor_first_name
-                .clone()
-                .filter(|value| !value.is_empty())
-        })
-        .or_else(|| item.actor_user_id.map(|value| value.to_string()))
-        .unwrap_or_default();
-    let subscription_status = if item.subscription_id.is_some() {
-        admin_subscription_status(
-            item.subscription_expires_at
-                .unwrap_or(item.effective_expires_at),
-            item.subscription_canceled_at,
-            item.subscription_refunded_at,
-        )
-    } else {
-        String::new()
-    };
-    serde_json::json!({
-        "id": item.id,
-        "event_type": item.event_type,
-        "delta_seconds": item.delta_seconds,
-        "delta_days": item.delta_seconds as f64 / openplotva_core::VIP_SECONDS_PER_DAY as f64,
-        "effective_expires_at": admin_format_time(item.effective_expires_at),
-        "actor_user_id": item.actor_user_id,
-        "actor_label": actor_label,
-        "reason": item.reason,
-        "created_at": admin_format_time(item.created_at),
-        "subscription_id": item.subscription_id,
-        "telegram_payment_charge_id": item.telegram_payment_charge_id,
-        "provider_payment_charge_id": item.provider_payment_charge_id,
-        "subscription_status": subscription_status,
-    })
-}
-
-fn admin_subscription_status(
-    expires_at: OffsetDateTime,
-    canceled_at: Option<OffsetDateTime>,
-    refunded_at: Option<OffsetDateTime>,
-) -> String {
-    if refunded_at.is_some() {
-        "refunded".to_owned()
-    } else if canceled_at.is_some() {
-        "canceled".to_owned()
-    } else if OffsetDateTime::now_utc() < expires_at {
-        "active".to_owned()
-    } else {
-        "expired".to_owned()
-    }
-}
-
-fn admin_vip_summary_can_be_revoked(
-    summary: Option<&openplotva_storage::VipSummaryRecord>,
-) -> bool {
-    summary
-        .map(|summary| {
-            summary.is_active && OffsetDateTime::now_utc() < summary.effective_expires_at
-        })
-        .unwrap_or(false)
-}
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-enum AdminAuthFailure {
-    Unauthorized,
-    Forbidden,
-}
-
-fn admin_auth_failure_response(error: AdminAuthFailure) -> Response {
-    match error {
-        AdminAuthFailure::Unauthorized => {
-            admin_error_response(StatusCode::FORBIDDEN, "unauthorized")
-        }
-        AdminAuthFailure::Forbidden => admin_error_response(StatusCode::FORBIDDEN, "forbidden"),
-    }
-}
-
-fn require_admin_request(
-    headers: &HeaderMap,
-    admin_ids: &[i64],
-    secret: &str,
-) -> Result<(), AdminAuthFailure> {
-    let Some(user_id) = admin_session_user_id(headers, secret) else {
-        return Err(AdminAuthFailure::Unauthorized);
-    };
-    if !admin_ids.contains(&user_id) {
-        return Err(AdminAuthFailure::Forbidden);
-    }
-    Ok(())
-}
-
-#[derive(Debug, Deserialize)]
-struct AdminLogLevelRequest {
-    level: String,
-}
-
-async fn admin_state_response(routes: &StaticWebRoutes) -> Response {
-    let level = admin_app_setting(routes, "log_level")
-        .await
-        .filter(|value| !value.trim().is_empty())
-        .unwrap_or_else(|| routes.default_log_level.to_string());
-    let dispatcher_stats =
-        openplotva_server::RuntimeDispatcherInspector::stats(&routes.dispatcher_inspector);
-    let cache_stats = openplotva_server::RuntimeCacheInspector::stats(&routes.cache_inspector);
-    admin_json_response(
-        StatusCode::OK,
-        serde_json::json!({
-            "log_level": level,
-            "queue": {
-                "regularQueueSize": dispatcher_stats.regular_queue_size,
-                "immediateQueueSize": dispatcher_stats.immediate_queue_size,
-                "processedTotal": dispatcher_stats.processed_total,
-                "dedupedTotal": dispatcher_stats.deduped_total,
-            },
-            "cache": admin_cache_stats_json(cache_stats.cache),
-            "planner": admin_cache_stats_json(cache_stats.planner_cache),
-        }),
-    )
-}
-
-fn admin_cache_stats_json(stats: openplotva_server::RuntimeCacheStatsData) -> serde_json::Value {
-    serde_json::json!({
-        "Size": stats.size,
-        "Capacity": stats.capacity,
-        "Hits": stats.hits,
-        "Misses": stats.misses,
-        "MemSize": stats.mem_size,
-    })
-}
-
-async fn admin_loglevel_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    body: &[u8],
-) -> Response {
-    if method != Method::POST && method != Method::PUT {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Ok(req) = serde_json::from_slice::<AdminLogLevelRequest>(body) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "bad request");
-    };
-    let level = req.level.trim().to_lowercase();
-    match level.as_str() {
-        "debug" | "info" | "warn" | "warning" | "error" => {}
-        _ => return admin_error_response(StatusCode::BAD_REQUEST, "invalid level"),
-    }
-    if let Err(error) = openplotva_observability::set_log_level(&level) {
-        tracing::warn!(%error, level, "failed to update runtime log level");
-    }
-    if let Err(error) = admin_upsert_app_setting(routes, "log_level", &level).await {
-        tracing::warn!(%error, level, "failed to persist admin log level");
-    }
-    admin_json_response(
-        StatusCode::OK,
-        serde_json::json!({ "ok": true, "level": level }),
-    )
-}
-
-async fn admin_safety_checks_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(pool) = routes.postgres.clone() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    let reader = runtime_safety::PostgresRuntimeSafetyCheckReader::new(pool);
-    match openplotva_server::RuntimeSafetyCheckReader::safety_checks(
-        &reader,
-        admin_safety_checks_filter(raw_query),
-    )
-    .await
-    {
-        Ok(connection) => {
-            let checks = connection
-                .items
-                .iter()
-                .map(admin_safety_check_json)
-                .collect::<Vec<_>>();
-            admin_json_no_cache_response(
-                StatusCode::OK,
-                serde_json::json!({
-                    "count": checks.len(),
-                    "checks": checks,
-                }),
-            )
-        }
-        Err(error) => {
-            tracing::warn!(%error, "failed to list admin safety checks");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-async fn admin_llm_analytics_summary_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(pool) = routes.postgres.clone() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    let taskman: Arc<dyn openplotva_server::RuntimeTaskmanInspector> =
-        Arc::new(routes.taskman_inspector.clone());
-    let reader = runtime_llm_analytics::PostgresRuntimeLlmAnalyticsReader::new(pool)
-        .with_discovery_capacity(
-            routes.llm_discovery_base_url.to_string(),
-            routes.llm_discovery_service_name.to_string(),
-        )
-        .with_sql_timeout_ms(routes.runtime_sql_timeout_ms)
-        .with_taskman(taskman);
-    let range = admin_auth_query_values(raw_query)
-        .remove("range")
-        .map(|value| value.trim().to_owned())
-        .unwrap_or_default();
-    match openplotva_server::RuntimeLlmAnalyticsReader::llm_analytics(&reader, &range).await {
-        Ok(summary) => {
-            let since = admin_llm_analytics_since_time(&summary);
-            let tool_calls = openplotva_dialog::tool_telemetry::snapshot_since(since, 50);
-            admin_json_no_cache_response(
-                StatusCode::OK,
-                admin_llm_analytics_summary_json(&summary, &tool_calls),
-            )
-        }
-        Err(error) => {
-            tracing::warn!(%error, "failed to build admin llm analytics summary");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-fn admin_llm_dialogs_filter(raw_query: Option<&str>) -> runtime_llm_runs::RunListFilter {
-    let values = admin_auth_query_values(raw_query);
-    runtime_llm_runs::RunListFilter {
-        kind: values
-            .get("kind")
-            .map(|value| value.trim().to_owned())
-            .filter(|value| !value.is_empty() && value != "all"),
-        chat_id: values
-            .get("chat_id")
-            .and_then(|value| value.trim().parse::<i64>().ok()),
-        errors_only: parse_admin_optional_bool(values.get("errors_only").map(String::as_str))
-            .unwrap_or(false),
-        q: values
-            .get("q")
-            .map(|value| value.trim().to_owned())
-            .unwrap_or_default(),
-        limit: parse_admin_positive_i32(values.get("limit").map(String::as_str), 200, 1000)
-            as usize,
-    }
-}
-
-fn admin_llm_dialogs_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(buffer) = routes.llm_run_buffer.as_ref() else {
-        return admin_json_no_cache_response(
-            StatusCode::OK,
-            serde_json::json!({ "count": 0, "runs": [] }),
-        );
-    };
-    let filter = admin_llm_dialogs_filter(raw_query);
-    let runs = buffer
-        .list(&filter, OffsetDateTime::now_utc())
-        .iter()
-        .map(runtime_llm_runs::RunRecord::skeleton_json)
-        .collect::<Vec<_>>();
-    admin_json_no_cache_response(
-        StatusCode::OK,
-        serde_json::json!({ "count": runs.len(), "runs": runs }),
-    )
-}
-
-async fn admin_llm_dialogs_detail_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let id = admin_auth_query_values(raw_query)
-        .remove("id")
-        .and_then(|value| value.trim().parse::<i64>().ok());
-    let Some(id) = id else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "id is required");
-    };
-    let record = routes
-        .llm_run_buffer
-        .as_ref()
-        .and_then(|buffer| buffer.get(id));
-    let Some(record) = record else {
-        return admin_json_no_cache_response(
-            StatusCode::OK,
-            serde_json::json!({ "run": serde_json::Value::Null }),
-        );
-    };
-    let mut run_json = record.detail_json();
-    let live_traces: Vec<Option<openplotva_server::RuntimeLlmRequestData>> = record
-        .rounds
-        .iter()
-        .map(|round| {
-            routes
-                .llm_trace_buffer
-                .as_ref()
-                .and_then(|traces| traces.get(round.trace_id))
-        })
-        .collect();
-    let mut persisted: std::collections::HashMap<
-        i32,
-        (Option<serde_json::Value>, Option<serde_json::Value>),
-    > = std::collections::HashMap::new();
-    if live_traces.iter().any(Option::is_none)
-        && let Some(pool) = routes.postgres.as_ref()
-    {
-        match runtime_llm::fetch_llm_raw_bodies_for_run(pool, &record.run_id).await {
-            Ok(bodies) => persisted = bodies,
-            Err(error) => {
-                tracing::warn!(%error, run_id = %record.run_id, "failed to load persisted llm raw bodies");
-            }
-        }
-    }
-    if let Some(rounds) = run_json["rounds"].as_array_mut() {
-        for (index, round_json) in rounds.iter_mut().enumerate() {
-            let Some(round) = record.rounds.get(index) else {
-                continue;
-            };
-            match live_traces.get(index).and_then(Option::as_ref) {
-                Some(trace) => {
-                    round_json["raw_source"] = serde_json::json!("live");
-                    round_json["raw_request"] =
-                        trace.raw_request.clone().unwrap_or(serde_json::Value::Null);
-                    round_json["raw_response"] = trace
-                        .raw_response
-                        .clone()
-                        .unwrap_or(serde_json::Value::Null);
-                    if let Some(usage) = trace.usage.clone() {
-                        round_json["usage"] = usage;
-                    }
-                    if let Some(timings) = trace.timings.clone() {
-                        round_json["timings"] = timings;
-                    }
-                    if let Some(params) = trace.inference_params.clone() {
-                        round_json["inference_params"] = params;
-                    }
-                }
-                None => match persisted.remove(&round.seq) {
-                    Some((request, response)) if request.is_some() || response.is_some() => {
-                        round_json["raw_source"] = serde_json::json!("db");
-                        round_json["raw_request"] = request.unwrap_or(serde_json::Value::Null);
-                        round_json["raw_response"] = response.unwrap_or(serde_json::Value::Null);
-                    }
-                    _ => {
-                        round_json["raw_source"] = serde_json::json!("rotated_out");
-                    }
-                },
-            }
-        }
-    }
-    admin_json_no_cache_response(StatusCode::OK, serde_json::json!({ "run": run_json }))
-}
-
-fn admin_llm_dialogs_clear_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-) -> Response {
-    if method != Method::POST {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    if let Some(buffer) = routes.llm_run_buffer.as_ref() {
-        buffer.clear();
-    }
-    admin_json_no_cache_response(StatusCode::OK, serde_json::json!({ "ok": true }))
-}
-
-async fn admin_analytics_overview_response(
-    routes: &StaticWebRoutes,
-    method: Method,
-    headers: &HeaderMap,
-    raw_query: Option<&str>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(pool) = routes.postgres.clone() else {
-        return admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed");
-    };
-    let range = admin_auth_query_values(raw_query)
-        .remove("range")
-        .map(|value| value.trim().to_owned())
-        .unwrap_or_default();
-    let reader = runtime_analytics_overview::AnalyticsOverviewReader::new(
-        pool,
-        routes.runtime_sql_timeout_ms,
-    );
-    match reader.overview(&range).await {
-        Ok(value) => admin_json_no_cache_response(StatusCode::OK, value),
-        Err(error) => {
-            tracing::warn!(%error, "failed to build admin analytics overview");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-fn admin_llm_analytics_since_time(
-    summary: &openplotva_server::RuntimeLlmAnalyticsData,
-) -> OffsetDateTime {
-    OffsetDateTime::parse(&summary.since, &Rfc3339).unwrap_or_else(|_| OffsetDateTime::now_utc())
-}
-
-fn admin_safety_checks_filter(
-    raw_query: Option<&str>,
-) -> openplotva_server::RuntimeSafetyChecksFilter {
-    let values = admin_auth_query_values(raw_query);
-    openplotva_server::RuntimeSafetyChecksFilter {
-        q: values
-            .get("q")
-            .map(|value| value.trim())
-            .unwrap_or("")
-            .to_owned(),
-        flagged: parse_admin_optional_bool(values.get("flagged").map(String::as_str)),
-        offset: parse_admin_non_negative_i32(values.get("offset").map(String::as_str), 0),
-        limit: parse_admin_positive_i32(values.get("limit").map(String::as_str), 200, 1000),
-    }
-}
-
-fn parse_admin_positive_i32(value: Option<&str>, default_value: i32, max_value: i32) -> i32 {
-    match value
-        .map(str::trim)
-        .and_then(|value| value.parse::<i32>().ok())
-    {
-        Some(parsed) if parsed > 0 => parsed.min(max_value),
-        _ => default_value,
-    }
-}
-
-fn parse_admin_non_negative_i32(value: Option<&str>, default_value: i32) -> i32 {
-    match value
-        .map(str::trim)
-        .and_then(|value| value.parse::<i32>().ok())
-    {
-        Some(parsed) if parsed >= 0 => parsed,
-        _ => default_value,
-    }
-}
-
-fn parse_admin_optional_bool(value: Option<&str>) -> Option<bool> {
-    match value.map(str::trim).map(str::to_lowercase).as_deref() {
-        Some("true" | "1" | "yes") => Some(true),
-        Some("false" | "0" | "no") => Some(false),
-        _ => None,
-    }
-}
-
-fn admin_safety_check_json(check: &openplotva_server::RuntimeSafetyCheckData) -> serde_json::Value {
-    let mut root = serde_json::Map::new();
-    admin_insert(&mut root, "id", check.id);
-    admin_insert(&mut root, "created_at", &check.created_at);
-    admin_insert(&mut root, "source", &check.source);
-    admin_insert_opt(&mut root, "flow", check.flow.as_deref());
-    admin_insert_opt(&mut root, "mode", check.mode.as_deref());
-    admin_insert_opt(&mut root, "chat_id", check.chat_id);
-    admin_insert_opt(&mut root, "thread_id", check.thread_id);
-    admin_insert_opt(&mut root, "message_id", check.message_id);
-    admin_insert_opt(&mut root, "user_id", check.user_id);
-    admin_insert(&mut root, "deployment_id", &check.deployment_id);
-    admin_insert_opt(
-        &mut root,
-        "external_session_id",
-        check.external_session_id.as_deref(),
-    );
-    admin_insert(
-        &mut root,
-        "request_messages",
-        check
-            .request_messages
-            .clone()
-            .unwrap_or(serde_json::Value::Null),
-    );
-    admin_insert_opt(&mut root, "flagged", check.flagged);
-    admin_insert_opt(
-        &mut root,
-        "internal_session_id",
-        check.internal_session_id.as_deref(),
-    );
-    admin_insert_opt_value(&mut root, "policies", check.policies.as_ref());
-    admin_insert_opt_value(&mut root, "response_json", check.response_json.as_ref());
-    admin_insert(&mut root, "duration_ms", check.duration_ms);
-    admin_insert_opt(&mut root, "error", check.error.as_deref());
-    serde_json::Value::Object(root)
-}
-
-fn admin_llm_analytics_summary_json(
-    summary: &openplotva_server::RuntimeLlmAnalyticsData,
-    tool_calls: &openplotva_dialog::tool_telemetry::ToolTelemetrySnapshot,
-) -> serde_json::Value {
-    let mut root = serde_json::Map::new();
-    admin_insert(&mut root, "range", &summary.range);
-    admin_insert(&mut root, "bucket", &summary.bucket);
-    admin_insert(&mut root, "since", &summary.since);
-    admin_insert(
-        &mut root,
-        "totals",
-        serde_json::json!({
-            "total_count": summary.totals.total_count,
-            "error_count": summary.totals.error_count,
-            "avg_duration_ms": summary.totals.avg_duration_ms,
-        }),
-    );
-    admin_insert(&mut root, "series", admin_llm_series_json(&summary.series));
-    admin_insert(
-        &mut root,
-        "model_series",
-        admin_llm_model_series_json(&summary.model_series),
-    );
-    admin_insert(
-        &mut root,
-        "top_chats",
-        admin_llm_top_chats_json(&summary.top_chats),
-    );
-    admin_insert(&mut root, "models", admin_llm_models_json(&summary.models));
-    admin_insert(
-        &mut root,
-        "providers",
-        admin_llm_providers_json(&summary.providers),
-    );
-    admin_insert(
-        &mut root,
-        "inference_params",
-        admin_llm_inference_params_json(&summary.inference_params),
-    );
-    admin_insert(
-        &mut root,
-        "stage_metrics",
-        admin_llm_stage_metrics_json(&summary.stage_metrics),
-    );
-    admin_insert(
-        &mut root,
-        "runtime_jobs",
-        admin_runtime_jobs_json(&summary.runtime_jobs),
-    );
-    admin_insert_opt(
-        &mut root,
-        "runtime_jobs_error",
-        summary.runtime_jobs_error.as_deref(),
-    );
-    admin_insert(&mut root, "tool_calls", tool_calls.to_json());
-    let ai_farm_capacity = summary
-        .ai_farm_capacity
-        .as_ref()
-        .map(admin_aifarm_capacity_json);
-    admin_insert_opt_value(&mut root, "aifarm_capacity", ai_farm_capacity.as_ref());
-    serde_json::Value::Object(root)
-}
-
-fn admin_llm_series_json(
-    series: &[openplotva_server::RuntimeLlmAnalyticsSeriesPointData],
-) -> Vec<serde_json::Value> {
-    series
-        .iter()
-        .map(|point| {
-            serde_json::json!({
-                "ts": point.ts,
-                "total_count": point.total_count,
-                "error_count": point.error_count,
-                "avg_duration_ms": point.avg_duration_ms,
-            })
-        })
-        .collect()
-}
-
-fn admin_llm_model_series_json(
-    series: &[openplotva_server::RuntimeLlmAnalyticsModelSeriesPointData],
-) -> Vec<serde_json::Value> {
-    series
-        .iter()
-        .map(|point| {
-            serde_json::json!({
-                "ts": point.ts,
-                "model": point.model,
-                "request_count": point.request_count,
-                "error_count": point.error_count,
-                "avg_duration_ms": point.avg_duration_ms,
-                "avg_generation_tps": point.avg_generation_tps,
-                "avg_effective_output_tps": point.avg_effective_output_tps,
-                "output_tokens": point.output_tokens,
-            })
-        })
-        .collect()
-}
-
-fn admin_llm_top_chats_json(
-    chats: &[openplotva_server::RuntimeLlmAnalyticsTopChatData],
-) -> Vec<serde_json::Value> {
-    chats
-        .iter()
-        .map(|chat| {
-            let mut root = serde_json::Map::new();
-            admin_insert(&mut root, "chat_id", chat.chat_id);
-            admin_insert_opt(&mut root, "title", chat.title.as_deref());
-            admin_insert_opt(&mut root, "username", chat.username.as_deref());
-            admin_insert(&mut root, "request_count", chat.request_count);
-            serde_json::Value::Object(root)
-        })
-        .collect()
-}
-
-fn admin_llm_models_json(
-    models: &[openplotva_server::RuntimeLlmAnalyticsModelStatData],
-) -> Vec<serde_json::Value> {
-    models
-        .iter()
-        .map(|model| {
-            serde_json::json!({
-                "model": model.model,
-                "request_count": model.request_count,
-                "error_count": model.error_count,
-                "avg_duration_ms": model.avg_duration_ms,
-                "p50_duration_ms": model.p50_duration_ms,
-                "p95_duration_ms": model.p95_duration_ms,
-                "input_tokens": model.input_tokens,
-                "output_tokens": model.output_tokens,
-                "total_tokens": model.total_tokens,
-                "avg_generation_tps": model.avg_generation_tps,
-                "avg_effective_output_tps": model.avg_effective_output_tps,
-                "p50_effective_output_tps": model.p50_effective_output_tps,
-                "p95_effective_output_tps": model.p95_effective_output_tps,
-            })
-        })
-        .collect()
-}
-
-fn admin_llm_providers_json(
-    providers: &[openplotva_server::RuntimeLlmAnalyticsProviderStatData],
-) -> Vec<serde_json::Value> {
-    providers
-        .iter()
-        .map(|provider| {
-            serde_json::json!({
-                "provider": provider.provider,
-                "source": provider.source,
-                "request_count": provider.request_count,
-                "error_count": provider.error_count,
-                "avg_duration_ms": provider.avg_duration_ms,
-                "p50_duration_ms": provider.p50_duration_ms,
-                "p95_duration_ms": provider.p95_duration_ms,
-                "input_tokens": provider.input_tokens,
-                "output_tokens": provider.output_tokens,
-                "total_tokens": provider.total_tokens,
-                "avg_generation_tps": provider.avg_generation_tps,
-                "avg_effective_output_tps": provider.avg_effective_output_tps,
-            })
-        })
-        .collect()
-}
-
-fn admin_llm_inference_params_json(
-    params: &[openplotva_server::RuntimeLlmAnalyticsInferenceParamStatData],
-) -> Vec<serde_json::Value> {
-    params
-        .iter()
-        .map(|param| {
-            let mut root = serde_json::Map::new();
-            admin_insert(&mut root, "provider", &param.provider);
-            admin_insert(&mut root, "source", &param.source);
-            admin_insert(&mut root, "model", &param.model);
-            admin_insert_opt(&mut root, "max_tokens", param.max_tokens);
-            admin_insert_opt(&mut root, "temperature", param.temperature);
-            admin_insert_opt(&mut root, "top_p", param.top_p);
-            admin_insert_opt(&mut root, "top_k", param.top_k);
-            admin_insert_opt(&mut root, "candidate_count", param.candidate_count);
-            admin_insert(&mut root, "tool_mode", &param.tool_mode);
-            admin_insert(&mut root, "response_format", &param.response_format);
-            admin_insert(&mut root, "request_count", param.request_count);
-            admin_insert(&mut root, "error_count", param.error_count);
-            admin_insert(&mut root, "avg_duration_ms", param.avg_duration_ms);
-            admin_insert(
-                &mut root,
-                "avg_effective_output_tps",
-                param.avg_effective_output_tps,
-            );
-            serde_json::Value::Object(root)
-        })
-        .collect()
-}
-
-fn admin_llm_stage_metrics_json(
-    metrics: &[openplotva_server::RuntimeLlmAnalyticsStageMetricData],
-) -> Vec<serde_json::Value> {
-    metrics
-        .iter()
-        .map(|metric| {
-            serde_json::json!({
-                "stage": metric.stage,
-                "source": metric.source,
-                "request_count": metric.request_count,
-                "error_count": metric.error_count,
-                "avg_duration_ms": metric.avg_duration_ms,
-                "p50_duration_ms": metric.p50_duration_ms,
-                "p95_duration_ms": metric.p95_duration_ms,
-                "avg_iteration": metric.avg_iteration,
-                "max_iteration": metric.max_iteration,
-            })
-        })
-        .collect()
-}
-
-fn admin_runtime_jobs_json(
-    jobs: &[openplotva_server::RuntimeJobAnalyticsStatData],
-) -> Vec<serde_json::Value> {
-    jobs.iter()
-        .map(|job| {
-            serde_json::json!({
-                "job_type": job.job_type,
-                "queue_name": job.queue_name,
-                "provider": job.provider,
-                "created_count": job.created_count,
-                "completed_count": job.completed_count,
-                "failed_count": job.failed_count,
-                "avg_wait_ms": job.avg_wait_ms,
-                "p95_wait_ms": job.p95_wait_ms,
-                "avg_processing_ms": job.avg_processing_ms,
-                "p95_processing_ms": job.p95_processing_ms,
-            })
-        })
-        .collect()
-}
-
-fn admin_aifarm_capacity_json(
-    capacity: &openplotva_server::RuntimeAifarmCapacitySnapshotData,
-) -> serde_json::Value {
-    let mut root = serde_json::Map::new();
-    admin_insert(&mut root, "service", &capacity.service);
-    admin_insert(
-        &mut root,
-        "max_concurrent_jobs",
-        capacity.max_concurrent_jobs,
-    );
-    admin_insert(&mut root, "running", capacity.running);
-    admin_insert(&mut root, "queued", capacity.queued);
-    admin_insert(&mut root, "available", capacity.available);
-    admin_insert(&mut root, "locked", capacity.locked);
-    admin_insert(&mut root, "ready", capacity.ready);
-    admin_insert(&mut root, "observed_at", &capacity.observed_at);
-    admin_insert_opt(&mut root, "error", capacity.error.as_deref());
-    serde_json::Value::Object(root)
-}
-
-fn admin_insert<T: Serialize>(
-    map: &mut serde_json::Map<String, serde_json::Value>,
-    key: &str,
-    value: T,
-) {
-    map.insert(key.to_owned(), serde_json::json!(value));
-}
-
-fn admin_insert_opt<T: Serialize>(
-    map: &mut serde_json::Map<String, serde_json::Value>,
-    key: &str,
-    value: Option<T>,
-) {
-    if let Some(value) = value {
-        admin_insert(map, key, value);
-    }
-}
-
-fn admin_insert_opt_value(
-    map: &mut serde_json::Map<String, serde_json::Value>,
-    key: &str,
-    value: Option<&serde_json::Value>,
-) {
-    if let Some(value) = value {
-        map.insert(key.to_owned(), value.clone());
-    }
-}
-
-async fn admin_app_setting(routes: &StaticWebRoutes, key: &str) -> Option<String> {
-    let pool = routes.postgres.as_ref()?;
-    sqlx::query_scalar::<_, String>("SELECT value FROM app_settings WHERE key = $1")
-        .bind(key)
-        .fetch_optional(pool)
-        .await
-        .ok()
-        .flatten()
-}
-
-async fn admin_upsert_app_setting(
-    routes: &StaticWebRoutes,
-    key: &str,
-    value: &str,
-) -> Result<(), sqlx::Error> {
-    let Some(pool) = routes.postgres.as_ref() else {
-        return Ok(());
-    };
-    sqlx::query(
-        "INSERT INTO app_settings (key, value, updated_at) \
-         VALUES ($1, $2, NOW()) \
-         ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()",
-    )
-    .bind(key)
-    .bind(value)
-    .execute(pool)
-    .await?;
-    Ok(())
-}
-
-fn routing_master_secret() -> String {
-    std::env::var("MASTER_KEY").unwrap_or_default()
-}
-
-fn routing_json_str(value: &serde_json::Value, key: &str) -> Option<String> {
-    value
-        .get(key)
-        .and_then(serde_json::Value::as_str)
-        .map(str::to_owned)
-}
-
-fn routing_json_i32(value: &serde_json::Value, key: &str) -> Option<i32> {
-    value
-        .get(key)
-        .and_then(serde_json::Value::as_i64)
-        .map(|n| n as i32)
-}
-
-fn routing_json_bool(value: &serde_json::Value, key: &str, default: bool) -> bool {
-    value
-        .get(key)
-        .and_then(serde_json::Value::as_bool)
-        .unwrap_or(default)
-}
-
-fn routing_json_required_bool(value: &serde_json::Value, key: &str) -> Result<bool, String> {
-    value
-        .get(key)
-        .and_then(serde_json::Value::as_bool)
-        .ok_or_else(|| format!("{key} is required"))
-}
-
-fn routing_json_config_patch(value: &serde_json::Value) -> Result<serde_json::Value, String> {
-    let patch = value
-        .get("config")
-        .or_else(|| value.get("patch"))
-        .cloned()
-        .ok_or_else(|| "config patch is required".to_owned())?;
-    if !patch.is_object() {
-        return Err("config patch must be a JSON object".to_owned());
-    }
-    Ok(patch)
-}
-
-fn routing_capabilities(value: &serde_json::Value) -> Vec<String> {
-    value
-        .get("capabilities")
-        .and_then(serde_json::Value::as_array)
-        .map(|items| {
-            items
-                .iter()
-                .filter_map(serde_json::Value::as_str)
-                .map(str::to_owned)
-                .collect()
-        })
-        .unwrap_or_default()
-}
-
-fn provider_key_state(provider: &openplotva_storage::llm_routing::ProviderRecord) -> &'static str {
-    if provider.api_key_encrypted.is_some() {
-        "encrypted"
-    } else if provider.api_key_ref.is_some() {
-        "ref"
-    } else {
-        "unset"
-    }
-}
-
-/// Build a provider input from admin JSON, sealing a plaintext `api_key` under the
-/// master key. The plaintext is never persisted or echoed; only the ciphertext is
-/// stored, and `api_key_ref`/`api_key_encrypted` are mutually exclusive.
-fn provider_input_from_json(
-    value: &serde_json::Value,
-) -> Result<openplotva_storage::llm_routing::ProviderInput, String> {
-    let protocol = routing_json_str(value, "protocol");
-    if let Some(protocol) = protocol.as_deref() {
-        let Some(parsed) = openplotva_llm::provider_schema::Protocol::from_db(protocol) else {
-            return Err(format!("unknown protocol {protocol}"));
-        };
-        let config = value.get("config").cloned().unwrap_or_else(|| json!({}));
-        openplotva_llm::provider_schema::validate_provider_config(parsed, &config)
-            .map_err(|error| error.to_string())?;
-    }
-    let runtime_hint = routing_json_str(value, "runtime_hint");
-    if let Some(hint) = runtime_hint.as_deref()
-        && openplotva_llm::provider_schema::RuntimeHint::from_db(hint).is_none()
-    {
-        return Err(format!("unknown runtime_hint {hint}"));
-    }
-    let mut input = openplotva_storage::llm_routing::ProviderInput {
-        name: routing_json_str(value, "name").ok_or("name is required")?,
-        kind: routing_json_str(value, "kind").unwrap_or_else(|| "chat".to_owned()),
-        protocol,
-        runtime_hint,
-        endpoint: routing_json_str(value, "endpoint"),
-        discovery_service_name: routing_json_str(value, "discovery_service_name"),
-        discovery_endpoint_name: routing_json_str(value, "discovery_endpoint_name"),
-        api_key_ref: routing_json_str(value, "api_key_ref"),
-        api_key_encrypted: None,
-        enabled: routing_json_bool(value, "enabled", true),
-        config: value.get("config").cloned().unwrap_or_else(|| json!({})),
-    };
-    if let Some(plaintext) = routing_json_str(value, "api_key")
-        && !plaintext.trim().is_empty()
-    {
-        let sealed =
-            openplotva_storage::llm_routing::seal_key(&routing_master_secret(), &plaintext)
-                .map_err(|error| error.to_string())?;
-        input.api_key_encrypted = Some(sealed);
-        input.api_key_ref = None;
-    }
-    Ok(input)
-}
-
-fn model_input_from_json(
-    value: &serde_json::Value,
-) -> Result<openplotva_storage::llm_routing::ModelInput, String> {
-    if let Some(config) = value.get("config") {
-        openplotva_llm::provider_schema::validate_model_config(config)
-            .map_err(|error| error.to_string())?;
-    }
-    Ok(openplotva_storage::llm_routing::ModelInput {
-        provider_id: value
-            .get("provider_id")
-            .and_then(serde_json::Value::as_i64)
-            .ok_or("provider_id is required")?,
-        model_name: routing_json_str(value, "model_name").ok_or("model_name is required")?,
-        display_name: routing_json_str(value, "display_name"),
-        base_url: routing_json_str(value, "base_url"),
-        capabilities: routing_capabilities(value),
-        embedding_dim: routing_json_i32(value, "embedding_dim"),
-        pool_id: value.get("pool_id").and_then(serde_json::Value::as_i64),
-        enabled: routing_json_bool(value, "enabled", true),
-        config: value.get("config").cloned().unwrap_or_else(|| json!({})),
-    })
-}
-
-fn pool_input_from_json(
-    value: &serde_json::Value,
-) -> Result<openplotva_storage::llm_routing::PoolInput, String> {
-    let config = value.get("config").cloned().unwrap_or_else(|| json!({}));
-    if !config.is_object() {
-        return Err("config must be a JSON object".to_owned());
-    }
-    Ok(openplotva_storage::llm_routing::PoolInput {
-        name: routing_json_str(value, "name").ok_or("name is required")?,
-        max_concurrency: routing_json_i32(value, "max_concurrency"),
-        description: routing_json_str(value, "description"),
-        config,
-    })
-}
-
-fn record_openrouter_free_key_status_failed(
-    reporter: &runtime_routing::RoutingEventReporter,
-    source: &str,
-    error: &str,
-) {
-    reporter.record(runtime_routing::RoutingEvent {
-        severity: "warn".to_owned(),
-        event_type: "openrouter_free_key_status_failed".to_owned(),
-        workflow_key: "routing".to_owned(),
-        provider_id: None,
-        model_id: None,
-        queue_name: None,
-        job_id: None,
-        chat_id: None,
-        user_id: None,
-        thread_id: None,
-        message_id: None,
-        dedupe_key: format!("openrouter_free_key_status_failed:{source}"),
-        summary: "OpenRouter Free key status check failed".to_owned(),
-        detail: json!({ "error": error, "source": source }),
-    });
-}
-
-fn assignment_input_from_json(
-    value: &serde_json::Value,
-) -> Result<openplotva_storage::llm_routing::AssignmentInput, String> {
-    Ok(openplotva_storage::llm_routing::AssignmentInput {
-        workflow_key: routing_json_str(value, "workflow_key").ok_or("workflow_key is required")?,
-        scope: routing_json_str(value, "scope").unwrap_or_else(|| "global".to_owned()),
-        role: routing_json_str(value, "role").unwrap_or_else(|| "primary".to_owned()),
-        provider_model_id: value
-            .get("provider_model_id")
-            .and_then(serde_json::Value::as_i64)
-            .ok_or("provider_model_id is required")?,
-        weight: routing_json_i32(value, "weight"),
-        fallback_order: routing_json_i32(value, "fallback_order"),
-        canary_percent: routing_json_i32(value, "canary_percent"),
-        enabled: routing_json_bool(value, "enabled", true),
-        inference_overrides: value
-            .get("inference_overrides")
-            .cloned()
-            .unwrap_or_else(|| json!({})),
-        cb_failure_threshold: routing_json_i32(value, "cb_failure_threshold").unwrap_or(5),
-        cb_cooldown_ms: routing_json_i32(value, "cb_cooldown_ms").unwrap_or(30_000),
-    })
-}
-
-fn trigger_input_from_json(
-    value: &serde_json::Value,
-) -> Result<openplotva_storage::llm_routing::TriggerInput, String> {
-    let mut input = trigger_input_from_json_without_engage(value)?;
-    input.engage_assignment_id = value
-        .get("engage_assignment_id")
-        .and_then(serde_json::Value::as_i64)
-        .ok_or("engage_assignment_id is required")?;
-    Ok(input)
-}
-
-/// Trigger fields without the engage target, for the atomic
-/// assignment-plus-trigger create where the target id does not exist yet.
-fn trigger_input_from_json_without_engage(
-    value: &serde_json::Value,
-) -> Result<openplotva_storage::llm_routing::TriggerInput, String> {
-    Ok(openplotva_storage::llm_routing::TriggerInput {
-        workflow_key: routing_json_str(value, "workflow_key").ok_or("workflow_key is required")?,
-        trigger_type: routing_json_str(value, "trigger_type").ok_or("trigger_type is required")?,
-        engage_assignment_id: 0,
-        enabled: routing_json_bool(value, "enabled", true),
-        queue_name: routing_json_str(value, "queue_name"),
-        high_watermark: routing_json_i32(value, "high_watermark"),
-        low_watermark: routing_json_i32(value, "low_watermark"),
-        params: value.get("params").cloned().unwrap_or_else(|| json!({})),
-    })
-}
-
-/// Server-side model-list fetch for the admin "Fetch models" flow: calls the
-/// provider's listing endpoint and returns a diff against its imported models
-/// (`new` / `existing` / `gone`). Read-only: import is a separate action.
-async fn admin_fetch_provider_models(
-    pool: &PgPool,
-    provider_id: i64,
-    body: &serde_json::Value,
-) -> Result<serde_json::Value, (StatusCode, String)> {
-    let bad = |error: String| (StatusCode::BAD_REQUEST, error);
-    let provider = openplotva_storage::llm_routing::get_provider(pool, provider_id)
-        .await
-        .map_err(|error| (StatusCode::INTERNAL_SERVER_ERROR, error.to_string()))?
-        .ok_or_else(|| bad(format!("unknown provider {provider_id}")))?;
-    let protocol = provider
-        .protocol
-        .as_deref()
-        .and_then(openplotva_llm::provider_schema::Protocol::from_db)
-        .ok_or_else(|| bad("provider has no protocol; set one first".to_owned()))?;
-    if !protocol.supports_model_listing() {
-        return Err(bad(format!(
-            "protocol {} has no model listing endpoint; add models manually",
-            protocol.as_str()
-        )));
-    }
-    let base_url = routing_json_str(body, "base_url")
-        .or_else(|| provider.endpoint.clone())
-        .filter(|url| !url.trim().is_empty())
-        .ok_or_else(|| bad("provider has no endpoint to list models from".to_owned()))?;
-    let api_key = provider
-        .api_key_ref
-        .as_deref()
-        .filter(|reference| !reference.trim().is_empty())
-        .and_then(|reference| std::env::var(reference.trim()).ok())
-        .or_else(|| {
-            provider.api_key_encrypted.as_deref().and_then(|sealed| {
-                openplotva_storage::llm_routing::open_key(&routing_master_secret(), sealed).ok()
-            })
-        });
-    let remote = openplotva_llm::model_listing::list_openai_compat_models(
-        &base_url,
-        api_key.as_deref(),
-        Duration::from_secs(10),
-    )
-    .await
-    .map_err(|error| (StatusCode::BAD_GATEWAY, error.to_string()))?;
-
-    let imported: Vec<(i64, String)> = openplotva_storage::llm_routing::list_models(pool)
-        .await
-        .map_err(|error| (StatusCode::INTERNAL_SERVER_ERROR, error.to_string()))?
-        .into_iter()
-        .filter(|model| model.provider_id == provider_id)
-        .map(|model| (model.id, model.model_name))
-        .collect();
-    let imported_names: std::collections::HashSet<&str> =
-        imported.iter().map(|(_, name)| name.as_str()).collect();
-    let remote_names: std::collections::HashSet<&str> =
-        remote.iter().map(|model| model.name.as_str()).collect();
-
-    let new: Vec<&str> = remote
-        .iter()
-        .map(|model| model.name.as_str())
-        .filter(|name| !imported_names.contains(name))
-        .collect();
-    let existing: Vec<serde_json::Value> = imported
-        .iter()
-        .filter(|(_, name)| remote_names.contains(name.as_str()))
-        .map(|(id, name)| json!({ "id": id, "model_name": name }))
-        .collect();
-    let gone: Vec<serde_json::Value> = imported
-        .iter()
-        .filter(|(_, name)| !remote_names.contains(name.as_str()))
-        .map(|(id, name)| json!({ "id": id, "model_name": name }))
-        .collect();
-    Ok(json!({
-        "ok": true,
-        "provider_id": provider_id,
-        "base_url": base_url,
-        "models": remote
-            .iter()
-            .map(|model| json!({ "model_name": model.name, "meta": model.raw }))
-            .collect::<Vec<_>>(),
-        "diff": { "new": new, "existing": existing, "gone": gone },
-    }))
-}
-
-async fn admin_routing_snapshot_json(pool: &PgPool) -> Result<serde_json::Value, String> {
-    let snapshot = openplotva_storage::llm_routing::load_snapshot(pool)
-        .await
-        .map_err(|error| error.to_string())?;
-    let providers: Vec<serde_json::Value> = snapshot
-        .providers
-        .iter()
-        .map(|provider| {
-            json!({
-                "id": provider.id,
-                "name": provider.name,
-                "kind": provider.kind,
-                "protocol": provider.protocol,
-                "runtime_hint": provider.runtime_hint,
-                "endpoint": provider.endpoint,
-                "discovery_service_name": provider.discovery_service_name,
-                "discovery_endpoint_name": provider.discovery_endpoint_name,
-                "key_state": provider_key_state(provider),
-                "api_key_ref": provider.api_key_ref,
-                "enabled": provider.enabled,
-                "config": provider.config,
-            })
-        })
-        .collect();
-    let models: Vec<serde_json::Value> = snapshot
-        .models
-        .iter()
-        .map(|model| {
-            json!({
-                "id": model.id,
-                "provider_id": model.provider_id,
-                "model_name": model.model_name,
-                "display_name": model.display_name,
-                "base_url": model.base_url,
-                "capabilities": model.capabilities,
-                "embedding_dim": model.embedding_dim,
-                "pool_id": model.pool_id,
-                "enabled": model.enabled,
-                "config": model.config,
-            })
-        })
-        .collect();
-    let workflows: Vec<serde_json::Value> = snapshot
-        .workflows
-        .iter()
-        .map(|workflow| {
-            json!({
-                "key": workflow.key,
-                "kind": workflow.kind,
-                "full_routing": workflow.full_routing,
-                "retry_max_hops": workflow.retry_max_hops,
-                "retry_wall_ms": workflow.retry_wall_ms,
-                "enabled": workflow.enabled,
-            })
-        })
-        .collect();
-    let assignments: Vec<serde_json::Value> = snapshot
-        .assignments
-        .iter()
-        .map(|assignment| {
-            json!({
-                "id": assignment.id,
-                "workflow_key": assignment.workflow_key,
-                "scope": assignment.scope,
-                "role": assignment.role,
-                "provider_model_id": assignment.provider_model_id,
-                "weight": assignment.weight,
-                "fallback_order": assignment.fallback_order,
-                "canary_percent": assignment.canary_percent,
-                "enabled": assignment.enabled,
-                "inference_overrides": assignment.inference_overrides,
-                "cb_failure_threshold": assignment.cb_failure_threshold,
-                "cb_cooldown_ms": assignment.cb_cooldown_ms,
-            })
-        })
-        .collect();
-    let triggers: Vec<serde_json::Value> = snapshot
-        .triggers
-        .iter()
-        .map(|trigger| {
-            json!({
-                "id": trigger.id,
-                "workflow_key": trigger.workflow_key,
-                "trigger_type": trigger.trigger_type,
-                "engage_assignment_id": trigger.engage_assignment_id,
-                "enabled": trigger.enabled,
-                "queue_name": trigger.queue_name,
-                "high_watermark": trigger.high_watermark,
-                "low_watermark": trigger.low_watermark,
-                "params": trigger.params,
-            })
-        })
-        .collect();
-    let pools: Vec<serde_json::Value> = snapshot
-        .pools
-        .iter()
-        .map(|pool| {
-            json!({
-                "id": pool.id,
-                "name": pool.name,
-                "max_concurrency": pool.max_concurrency,
-                "description": pool.description,
-                "config": pool.config,
-            })
-        })
-        .collect();
-    Ok(json!({
-        "providers": providers,
-        "models": models,
-        "workflows": workflows,
-        "assignments": assignments,
-        "triggers": triggers,
-        "pools": pools,
-        "param_descriptors": routing_param_descriptors(),
-    }))
-}
-
-/// Static parameter-form descriptors for every (protocol, runtime hint) pair,
-/// so the admin UI renders typed provider/model forms without hardcoding them.
-fn routing_param_descriptors() -> serde_json::Value {
-    use openplotva_llm::provider_schema::{Protocol, RuntimeHint, param_descriptor};
-    let mut descriptors = Vec::new();
-    for protocol in Protocol::all() {
-        descriptors.push(param_descriptor(*protocol, None));
-        if *protocol == Protocol::OpenAiCompat {
-            for hint in RuntimeHint::all() {
-                descriptors.push(param_descriptor(*protocol, Some(*hint)));
-            }
-        }
-    }
-    serde_json::Value::Array(descriptors)
-}
-
-async fn admin_routing_apply_action(
-    pool: &PgPool,
-    routes: &StaticWebRoutes,
-    body: &serde_json::Value,
-) -> Result<serde_json::Value, (StatusCode, String)> {
-    let action = body
-        .get("action")
-        .and_then(serde_json::Value::as_str)
-        .ok_or((StatusCode::BAD_REQUEST, "action is required".to_owned()))?;
-    let bad = |error: String| (StatusCode::BAD_REQUEST, error);
-    let storage_err = |error: openplotva_storage::StorageError| {
-        (StatusCode::INTERNAL_SERVER_ERROR, error.to_string())
-    };
-    let id_of = |body: &serde_json::Value| body.get("id").and_then(serde_json::Value::as_i64);
-
-    use openplotva_storage::llm_routing as routing;
-    let result = match action {
-        "create_provider" => {
-            let input = provider_input_from_json(body).map_err(bad)?;
-            let id = routing::insert_provider(pool, &input)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true, "id": id })
-        }
-        "update_provider" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            let input = provider_input_from_json(body).map_err(bad)?;
-            routing::update_provider(pool, id, &input)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "set_provider_enabled" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            let enabled = routing_json_required_bool(body, "enabled").map_err(bad)?;
-            routing::set_provider_enabled(pool, id, enabled)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "patch_provider_config" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            let patch = routing_json_config_patch(body).map_err(bad)?;
-            routing::patch_provider_config(pool, id, &patch)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "delete_provider" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            routing::delete_provider(pool, id)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "create_model" => {
-            let input = model_input_from_json(body).map_err(bad)?;
-            let id = routing::insert_model(pool, &input)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true, "id": id })
-        }
-        "update_model" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            let input = model_input_from_json(body).map_err(bad)?;
-            routing::update_model(pool, id, &input)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "set_model_enabled" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            let enabled = routing_json_required_bool(body, "enabled").map_err(bad)?;
-            routing::set_model_enabled(pool, id, enabled)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "patch_model_config" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            let patch = routing_json_config_patch(body).map_err(bad)?;
-            routing::patch_model_config(pool, id, &patch)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "delete_model" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            routing::delete_model(pool, id).await.map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "create_assignment" => {
-            let input = assignment_input_from_json(body).map_err(bad)?;
-            let id = routing::insert_assignment(pool, &input)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true, "id": id })
-        }
-        "update_assignment" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            let input = assignment_input_from_json(body).map_err(bad)?;
-            routing::update_assignment(pool, id, &input)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "delete_assignment" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            routing::delete_assignment(pool, id)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "delete_assignments_for_scope" => {
-            let workflow = routing_json_str(body, "workflow_key")
-                .ok_or(bad("workflow_key is required".to_owned()))?;
-            let scope = routing_json_str(body, "scope").unwrap_or_else(|| "global".to_owned());
-            routing::delete_assignments_for_scope(pool, &workflow, &scope)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "create_trigger" => {
-            let input = trigger_input_from_json(body).map_err(bad)?;
-            let id = routing::insert_trigger(pool, &input)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true, "id": id })
-        }
-        "update_trigger" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            let input = trigger_input_from_json(body).map_err(bad)?;
-            routing::update_trigger(pool, id, &input)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "delete_trigger" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            routing::delete_trigger(pool, id)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "update_workflow" => {
-            let key = routing_json_str(body, "key").ok_or(bad("key is required".to_owned()))?;
-            routing::update_workflow(
-                pool,
-                &key,
-                routing_json_bool(body, "full_routing", true),
-                routing_json_i32(body, "retry_max_hops").unwrap_or(3),
-                routing_json_i32(body, "retry_wall_ms").unwrap_or(60_000),
-                routing_json_bool(body, "enabled", true),
-            )
-            .await
-            .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "set_workflow_enabled" => {
-            let key = routing_json_str(body, "key").ok_or(bad("key is required".to_owned()))?;
-            let enabled = routing_json_required_bool(body, "enabled").map_err(bad)?;
-            routing::set_workflow_enabled(pool, &key, enabled)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "create_pool" => {
-            let input = pool_input_from_json(body).map_err(bad)?;
-            if input.max_concurrency.is_some_and(|max| max < 1) {
-                return Err(bad("max_concurrency must be positive or null".to_owned()));
-            }
-            let id = routing::insert_pool(pool, &input)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true, "id": id })
-        }
-        "update_pool" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            let input = pool_input_from_json(body).map_err(bad)?;
-            if input.max_concurrency.is_some_and(|max| max < 1) {
-                return Err(bad("max_concurrency must be positive or null".to_owned()));
-            }
-            routing::update_pool(pool, id, &input)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "delete_pool" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            // FK is ON DELETE SET NULL: attached models degrade to unpooled.
-            routing::delete_pool(pool, id).await.map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "set_model_pool" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            let pool_id = body.get("pool_id").and_then(serde_json::Value::as_i64);
-            routing::set_model_pool(pool, id, pool_id)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true })
-        }
-        "set_primary_weights" => {
-            let weights = body
-                .get("weights")
-                .and_then(serde_json::Value::as_array)
-                .ok_or(bad("weights array is required".to_owned()))?
-                .iter()
-                .map(|entry| {
-                    let id = entry
-                        .get("id")
-                        .and_then(serde_json::Value::as_i64)
-                        .ok_or_else(|| "each weight entry needs an id".to_owned())?;
-                    let weight = routing_json_i32(entry, "weight");
-                    if weight.is_some_and(|weight| !(0..=100).contains(&weight)) {
-                        return Err(format!("weight for assignment {id} must be 0..=100"));
-                    }
-                    Ok((id, weight))
-                })
-                .collect::<Result<Vec<_>, String>>()
-                .map_err(bad)?;
-            routing::set_assignment_weights(pool, &weights)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true, "updated": weights.len() })
-        }
-        "set_fallback_order" => {
-            let ordered_ids = body
-                .get("ordered_ids")
-                .and_then(serde_json::Value::as_array)
-                .ok_or(bad("ordered_ids array is required".to_owned()))?
-                .iter()
-                .map(|entry| {
-                    entry
-                        .as_i64()
-                        .ok_or_else(|| "ordered_ids must be assignment ids".to_owned())
-                })
-                .collect::<Result<Vec<_>, String>>()
-                .map_err(bad)?;
-            routing::set_assignment_fallback_orders(pool, &ordered_ids)
-                .await
-                .map_err(storage_err)?;
-            json!({ "ok": true, "updated": ordered_ids.len() })
-        }
-        "create_trigger_with_assignment" => {
-            let mut assignment = assignment_input_from_json(body).map_err(bad)?;
-            assignment.role = "overflow".to_owned();
-            if assignment.weight.is_none() {
-                assignment.weight = Some(100);
-            }
-            let mut trigger = trigger_input_from_json_without_engage(body).map_err(bad)?;
-            trigger.workflow_key = assignment.workflow_key.clone();
-            let (assignment_id, trigger_id) =
-                routing::insert_trigger_with_assignment(pool, &assignment, &trigger)
-                    .await
-                    .map_err(storage_err)?;
-            json!({ "ok": true, "assignment_id": assignment_id, "trigger_id": trigger_id })
-        }
-        "fetch_provider_models" => {
-            let id = id_of(body).ok_or(bad("id is required".to_owned()))?;
-            return admin_fetch_provider_models(pool, id, body).await;
-        }
-        "import_models" => {
-            let provider_id = body
-                .get("provider_id")
-                .and_then(serde_json::Value::as_i64)
-                .ok_or(bad("provider_id is required".to_owned()))?;
-            let names: Vec<String> = body
-                .get("names")
-                .and_then(serde_json::Value::as_array)
-                .ok_or(bad("names array is required".to_owned()))?
-                .iter()
-                .filter_map(|name| name.as_str())
-                .map(str::to_owned)
-                .collect();
-            if names.is_empty() {
-                return Err(bad("names must contain at least one model name".to_owned()));
-            }
-            let defaults = body.get("defaults").cloned().unwrap_or_else(|| json!({}));
-            let capabilities = routing_capabilities(&defaults);
-            let capabilities = if capabilities.is_empty() {
-                vec!["chat".to_owned()]
-            } else {
-                capabilities
-            };
-            let pool_id = defaults.get("pool_id").and_then(serde_json::Value::as_i64);
-            let existing: std::collections::HashSet<String> = routing::list_models(pool)
-                .await
-                .map_err(storage_err)?
-                .into_iter()
-                .filter(|model| model.provider_id == provider_id)
-                .map(|model| model.model_name)
-                .collect();
-            let mut created = Vec::new();
-            for name in names {
-                if existing.contains(&name) {
-                    continue;
-                }
-                let id = routing::insert_model(
-                    pool,
-                    &openplotva_storage::llm_routing::ModelInput {
-                        provider_id,
-                        model_name: name,
-                        display_name: None,
-                        base_url: None,
-                        capabilities: capabilities.clone(),
-                        embedding_dim: None,
-                        pool_id,
-                        enabled: true,
-                        config: json!({}),
-                    },
-                )
-                .await
-                .map_err(storage_err)?;
-                created.push(id);
-            }
-            json!({ "ok": true, "created_ids": created })
-        }
-        "refresh_openrouter_free_pool" => {
-            if let Some(reporter) = routes.routing_event_reporter.as_ref() {
-                reporter.record(runtime_routing::RoutingEvent {
-                    severity: "info".to_owned(),
-                    event_type: "openrouter_free_refresh_started".to_owned(),
-                    workflow_key: "routing".to_owned(),
-                    provider_id: None,
-                    model_id: None,
-                    queue_name: None,
-                    job_id: None,
-                    chat_id: None,
-                    user_id: None,
-                    thread_id: None,
-                    message_id: None,
-                    dedupe_key: "openrouter_free_refresh_started:manual".to_owned(),
-                    summary: "OpenRouter Free refresh started".to_owned(),
-                    detail: json!({ "source": "admin" }),
-                });
-            }
-            let http = reqwest::Client::new();
-            match openrouter_free_pool::refresh_openrouter_free_pool(pool, &http).await {
-                Ok(report) => {
-                    if let Some(reporter) = routes.routing_event_reporter.as_ref() {
-                        reporter.record(runtime_routing::RoutingEvent {
-                            severity: "info".to_owned(),
-                            event_type: "openrouter_free_refresh_succeeded".to_owned(),
-                            workflow_key: "routing".to_owned(),
-                            provider_id: None,
-                            model_id: None,
-                            queue_name: None,
-                            job_id: None,
-                            chat_id: None,
-                            user_id: None,
-                            thread_id: None,
-                            message_id: None,
-                            dedupe_key: "openrouter_free_refresh_succeeded:manual".to_owned(),
-                            summary: "OpenRouter Free refresh succeeded".to_owned(),
-                            detail: json!({
-                                "active_models": report.active_models,
-                                "disabled_models": report.disabled_models,
-                                "assignments": report.assignments,
-                                "ranking_version": report.ranking_version,
-                                "source_updated_at": report.source_updated_at,
-                                "key_status_error": report.key_status_error.clone(),
-                            }),
-                        });
-                        if let Some(error) = report.key_status_error.as_deref() {
-                            record_openrouter_free_key_status_failed(reporter, "manual", error);
-                        }
-                    }
-                    json!({
-                        "ok": true,
-                        "refreshed": report.refreshed,
-                        "active_models": report.active_models,
-                        "disabled_models": report.disabled_models,
-                        "assignments": report.assignments,
-                        "ranking_version": report.ranking_version,
-                        "source_updated_at": report.source_updated_at,
-                        "key_status_error": report.key_status_error,
-                        "message": report.message,
-                    })
-                }
-                Err(error) => {
-                    if let Some(reporter) = routes.routing_event_reporter.as_ref() {
-                        reporter.record(runtime_routing::RoutingEvent {
-                            severity: "warn".to_owned(),
-                            event_type: "openrouter_free_refresh_failed".to_owned(),
-                            workflow_key: "routing".to_owned(),
-                            provider_id: None,
-                            model_id: None,
-                            queue_name: None,
-                            job_id: None,
-                            chat_id: None,
-                            user_id: None,
-                            thread_id: None,
-                            message_id: None,
-                            dedupe_key: "openrouter_free_refresh_failed:manual".to_owned(),
-                            summary: "OpenRouter Free refresh failed".to_owned(),
-                            detail: json!({ "error": error.to_string(), "source": "admin" }),
-                        });
-                    }
-                    return Err((StatusCode::BAD_GATEWAY, error.to_string()));
-                }
-            }
-        }
-        "reload" => json!({ "ok": true }),
-        other => return Err(bad(format!("unknown action {other}"))),
-    };
-
-    // Every mutating action bumps the revision and atomically reloads the router so
-    // the change takes effect without a restart.
-    if action != "reload" {
-        let revision = admin_app_setting(routes, "llm.routing.revision")
-            .await
-            .and_then(|value| value.parse::<i64>().ok())
-            .unwrap_or(0);
-        let _ =
-            admin_upsert_app_setting(routes, "llm.routing.revision", &(revision + 1).to_string())
-                .await;
-    }
-    let reload_result = if let Some(runtime) = routes.router_runtime.as_ref() {
-        model_routing::reload_router_runtime(runtime, pool).await
-    } else if let Some(handle) = routes.router_handle.as_ref() {
-        let reloaded = model_routing::reload_router(handle, pool).await;
-        if reloaded.is_ok()
-            && let Some(pools) = routes.router_pools.as_ref()
-        {
-            pools.apply(&handle.snapshot().pool_specs());
-        }
-        reloaded
-    } else {
-        Ok(())
-    };
-    if let Err(error) = reload_result {
-        if let Some(reporter) = routes.routing_event_reporter.as_ref() {
-            reporter.record(runtime_routing::router_reload_failed_event(
-                "admin_routing_reload",
-                &error.to_string(),
-            ));
-        }
-        tracing::warn!(%error, "failed to reload router after admin routing change");
-    }
-    Ok(result)
-}
-
-async fn admin_routing(
-    method: Method,
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-    body: Bytes,
-) -> Response {
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(pool) = routes.postgres.clone() else {
-        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "database unavailable");
-    };
-
-    if method == Method::GET {
-        return match admin_routing_snapshot_json(&pool).await {
-            Ok(value) => admin_json_response(StatusCode::OK, value),
-            Err(error) => admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, &error),
-        };
-    }
-    if method != Method::POST && method != Method::PUT {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    let Ok(parsed) = serde_json::from_slice::<serde_json::Value>(&body) else {
-        return admin_error_response(StatusCode::BAD_REQUEST, "invalid json");
-    };
-    match admin_routing_apply_action(&pool, &routes, &parsed).await {
-        Ok(value) => admin_json_response(StatusCode::OK, value),
-        Err((status, error)) => admin_error_response(status, &error),
-    }
-}
-
-/// Cheap, poll-safe live view for the routing cockpit: pool occupancy,
-/// breaker states, trigger engagement, capacity cooldowns, worker scale, and
-/// the in-process event ring. No database round-trip.
-async fn admin_routing_status(
-    method: Method,
-    headers: HeaderMap,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let now = std::time::Instant::now();
-    let table = routes
-        .router_handle
-        .as_ref()
-        .map(|handle| handle.snapshot());
-    let pools: Vec<serde_json::Value> = routes
-        .router_pools
-        .as_ref()
-        .map(|pools| pools.occupancy())
-        .unwrap_or_default()
-        .into_iter()
-        .map(|occupancy| {
-            json!({
-                "id": occupancy.id,
-                "name": table.as_ref().and_then(|table| table.pool_name(occupancy.id)),
-                "max_concurrency": occupancy.max_concurrency,
-                "in_flight": occupancy.in_flight,
-                "queued": {
-                    "interactive": occupancy.queued[0],
-                    "user_tool": occupancy.queued[1],
-                    "background": occupancy.queued[2],
-                },
-                "mean_hold_ms": occupancy.mean_hold_ms,
-                "wait_p50_ms": occupancy.wait_p50_ms,
-                "wait_p95_ms": occupancy.wait_p95_ms,
-            })
-        })
-        .collect();
-    let breakers: Vec<serde_json::Value> = routes
-        .router_breakers
-        .as_ref()
-        .map(|breakers| breakers.states_at(now))
-        .unwrap_or_default()
-        .into_iter()
-        .map(|state| {
-            json!({
-                "provider_id": state.provider,
-                "model_id": state.model,
-                "consecutive_failures": state.consecutive_failures,
-                "open": state.open,
-                "cooldown_remaining_ms": state
-                    .cooldown_remaining
-                    .map(|left| u64::try_from(left.as_millis()).unwrap_or(u64::MAX)),
-            })
-        })
-        .collect();
-    let engaged_triggers = routes
-        .router_triggers
-        .as_ref()
-        .map(|triggers| triggers.engaged_ids())
-        .unwrap_or_default();
-    let capacity_cooldowns: Vec<serde_json::Value> = routes
-        .router_triggers
-        .as_ref()
-        .map(|triggers| triggers.capacity_snapshot_at(now))
-        .unwrap_or_default()
-        .into_iter()
-        .map(|(provider, model, left)| {
-            json!({
-                "provider_id": provider,
-                "model_id": model,
-                "remaining_ms": u64::try_from(left.as_millis()).unwrap_or(u64::MAX),
-            })
-        })
-        .collect();
-    let workers = routes
-        .dialog_worker_gauge
-        .as_ref()
-        .map(|gauge| {
-            json!({
-                "dialog": { "desired": gauge.desired(), "running": gauge.running() }
-            })
-        })
-        .unwrap_or_else(|| json!({}));
-    let recent_events: Vec<serde_json::Value> = routes
-        .routing_event_buffer
-        .as_ref()
-        .map(|buffer| buffer.routing_events(20))
-        .unwrap_or_default()
-        .into_iter()
-        .map(|event| routing_event_data_json(&event))
-        .collect();
-    let revision = admin_app_setting(&routes, "llm.routing.revision")
-        .await
-        .and_then(|value| value.parse::<i64>().ok())
-        .unwrap_or(0);
-    let mut openrouter_free = admin_app_setting(&routes, "llm.routing.openrouter_free.status")
-        .await
-        .and_then(|value| serde_json::from_str::<serde_json::Value>(&value).ok());
-    if let Some(gate) = routes.openrouter_free_gate.as_ref() {
-        let quota = gate.status_snapshot().await;
-        let value = openrouter_free.get_or_insert_with(|| json!({}));
-        if let Some(object) = value.as_object_mut() {
-            object.insert("quota".to_owned(), quota);
-        }
-    }
-    admin_json_no_cache_response(
-        StatusCode::OK,
-        json!({
-            "revision": revision,
-            "pools": pools,
-            "breakers": breakers,
-            "engaged_triggers": engaged_triggers,
-            "capacity_cooldowns": capacity_cooldowns,
-            "workers": workers,
-            "recent_events": recent_events,
-            "openrouter_free": openrouter_free,
-        }),
-    )
-}
-
-/// Keyset-paginated journal over `llm_routing_events` with optional
-/// `workflow` / `severity` filters and a `before_id` cursor.
-async fn admin_routing_events(
-    method: Method,
-    headers: HeaderMap,
-    RawQuery(raw_query): RawQuery,
-    Extension(routes): Extension<StaticWebRoutes>,
-) -> Response {
-    if method != Method::GET {
-        return admin_error_response(StatusCode::METHOD_NOT_ALLOWED, "method not allowed");
-    }
-    if let Err(error) = require_admin_request(&headers, &routes.admin_ids, &routes.bot_token) {
-        return admin_auth_failure_response(error);
-    }
-    let Some(pool) = routes.postgres.clone() else {
-        return admin_error_response(StatusCode::SERVICE_UNAVAILABLE, "database unavailable");
-    };
-    let values = admin_auth_query_values(raw_query.as_deref());
-    let limit = values
-        .get("limit")
-        .and_then(|value| value.parse::<i64>().ok())
-        .unwrap_or(50);
-    let before_id = values
-        .get("before_id")
-        .and_then(|value| value.parse::<i64>().ok());
-    let workflow = values
-        .get("workflow")
-        .map(|value| value.trim().to_owned())
-        .filter(|value| !value.is_empty());
-    let severity = values
-        .get("severity")
-        .map(|value| value.trim().to_owned())
-        .filter(|value| !value.is_empty());
-    match openplotva_storage::llm_routing::list_routing_events_page(
-        &pool,
-        limit,
-        before_id,
-        workflow.as_deref(),
-        severity.as_deref(),
-    )
-    .await
-    {
-        Ok(events) => {
-            let next_before_id = events.last().map(|event| event.id);
-            let events: Vec<serde_json::Value> = events
-                .iter()
-                .map(|event| {
-                    json!({
-                        "id": event.id,
-                        "created_at": event
-                            .created_at
-                            .format(&time::format_description::well_known::Rfc3339)
-                            .unwrap_or_default(),
-                        "severity": event.severity,
-                        "event_type": event.event_type,
-                        "workflow_key": event.workflow_key,
-                        "provider_id": event.provider_id,
-                        "model_id": event.model_id,
-                        "queue_name": event.queue_name,
-                        "job_id": event.job_id,
-                        "chat_id": event.chat_id,
-                        "summary": event.summary,
-                        "detail": event.detail,
-                    })
-                })
-                .collect();
-            admin_json_no_cache_response(
-                StatusCode::OK,
-                json!({ "events": events, "next_before_id": next_before_id }),
-            )
-        }
-        Err(error) => {
-            tracing::warn!(%error, "failed to list routing events");
-            admin_error_response(StatusCode::INTERNAL_SERVER_ERROR, "failed")
-        }
-    }
-}
-
-fn routing_event_data_json(event: &runtime_routing::RoutingEventData) -> serde_json::Value {
-    json!({
-        "id": event.id,
-        "at_millis": event.at_millis,
-        "severity": event.severity,
-        "event_type": event.event_type,
-        "workflow_key": event.workflow_key,
-        "provider_id": event.provider_id,
-        "model_id": event.model_id,
-        "queue_name": event.queue_name,
-        "summary": event.summary,
-        "detail": event.detail,
-    })
-}
-
-#[derive(Debug)]
-struct AdminLogStreamState {
-    buffer: Arc<openplotva_observability::RuntimeLogBuffer>,
-    after_seq: u64,
-    pending: VecDeque<openplotva_observability::RuntimeLogEntry>,
-    interval: Interval,
-}
-
-fn admin_logs_sse_stream(
-    buffer: Arc<openplotva_observability::RuntimeLogBuffer>,
-) -> impl Stream<Item = Result<Event, Infallible>> {
-    let after_seq = buffer.latest_seq();
-    stream::unfold(
-        AdminLogStreamState {
-            buffer,
-            after_seq,
-            pending: VecDeque::new(),
-            interval: tokio::time::interval(Duration::from_secs(1)),
-        },
-        |mut state| async move {
-            loop {
-                if let Some(entry) = state.pending.pop_front() {
-                    state.after_seq = state.after_seq.max(entry.seq);
-                    let data = serde_json::json!({
-                        "seq": entry.seq,
-                        "time": entry.time,
-                        "level": entry.level,
-                        "message": entry.message,
-                        "attrs": entry.attrs,
-                    })
-                    .to_string();
-                    return Some((Ok(Event::default().data(data)), state));
-                }
-                state.interval.tick().await;
-                state.pending = VecDeque::from(state.buffer.logs(state.after_seq, 100, "", ""));
-            }
-        },
-    )
-}
-
-fn admin_static_asset_requires_auth(path: &str) -> bool {
-    let path = path.trim_matches('/');
-    path.is_empty() || path == "index.html"
-}
-
-impl StaticWebRoutes {
-    fn redis_inspector(&self) -> Option<RedisRuntimeInspector> {
-        self.redis.clone().map(RedisRuntimeInspector::new)
-    }
-}
-
-fn admin_session_is_authorized(headers: &HeaderMap, admin_ids: &[i64], secret: &str) -> bool {
-    admin_session_user_ids(headers, secret)
-        .into_iter()
-        .any(|user_id| admin_ids.contains(&user_id))
-}
-
-fn admin_session_user_id(headers: &HeaderMap, secret: &str) -> Option<i64> {
-    admin_session_user_ids(headers, secret).into_iter().next()
-}
-
-fn admin_session_user_ids(headers: &HeaderMap, secret: &str) -> Vec<i64> {
-    let Some(cookie) = headers
-        .get(header::COOKIE)
-        .and_then(|value| value.to_str().ok())
-    else {
-        return Vec::new();
-    };
-    cookie
-        .split(';')
-        .filter_map(|part| {
-            part.trim()
-                .strip_prefix(openplotva_web::ADMIN_SESSION_COOKIE_NAME)
-                .and_then(|value| value.strip_prefix('='))
-        })
-        .filter_map(|value| openplotva_web::verify_admin_session_value(value, secret))
-        .collect()
-}
-
-/// Render a fatal error like the report of a `Result` returned from `main`, with
-/// secrets masked. That report goes straight to stderr, past the redacting log
-/// writer, and Telegram client errors carry the bot token in the request URL.
-#[must_use]
-pub fn fatal_error_report(error: &anyhow::Error) -> String {
-    format!(
-        "Error: {}",
-        openplotva_observability::secrets::redact(&format!("{error:?}"))
-    )
-}
-
-/// Run the current OpenPlotva app shell.
-pub async fn run() -> anyhow::Result<()> {
-    let config = AppConfig::from_env().context("load configuration")?;
-    let prompt_store =
-        Arc::new(openplotva_prompts::PromptStore::load().context("compile prompt registry")?);
-    let log_buffer = openplotva_observability::init_with_log_buffer_capacity(
-        &config.observability,
-        config.runtime_api.log_buffer_size,
-    );
-    if let Some(token) = config.bot.key.as_deref() {
-        openplotva_observability::secrets::register_secret(token);
-    }
-    openplotva_observability::secrets::register_secret(&config.google_ai.key);
-
-    let mut readiness_checks = Vec::new();
-    let service_clients = connect_services(&config, &mut readiness_checks).await?;
-    record_dialog_tool_mode_readiness(&config, &mut readiness_checks);
-    let runtime_workers = start_runtime_workers(
-        &config,
-        service_clients.as_ref(),
-        &mut readiness_checks,
-        Arc::clone(&log_buffer),
-        prompt_store,
-    )
-    .await?;
-
-    let listener = tokio::net::TcpListener::bind(&config.server.bind_addr)
-        .await
-        .with_context(|| format!("bind HTTP listener to {}", config.server.bind_addr))?;
-    let local_addr = listener
-        .local_addr()
-        .context("read HTTP listener address")?;
-
-    tracing::info!(address = %local_addr, "openplotva listening");
-
-    let readiness = ReadinessResponse::ready(readiness_checks);
-    let bot_username = runtime_workers
-        .bot_username
-        .clone()
-        .unwrap_or_else(|| std::env::var("BOT_USERNAME").unwrap_or_default());
-    let static_web = static_web_routes_from_config(
-        &config,
-        service_clients.as_ref(),
-        bot_username,
-        log_buffer,
-        &runtime_workers,
-    );
-    let app = if let Some(webhook_route) = runtime_workers.webhook_route.clone() {
-        router_with_readiness_static_web_and_telegram_webhook_route(
-            readiness,
-            runtime_workers.readiness_probes.clone(),
-            static_web,
-            webhook_route,
-        )
-    } else {
-        router_with_readiness_and_static_web(
-            readiness,
-            runtime_workers.readiness_probes.clone(),
-            static_web,
-        )
-    };
-
-    let serve_result = axum::serve(listener, app)
-        .with_graceful_shutdown(shutdown_signal())
-        .await
-        .context("serve HTTP app");
-
-    shutdown_runtime_workers(runtime_workers).await;
-    serve_result?;
-    drop(service_clients);
-    Ok(())
-}
-
-async fn connect_services(
-    config: &AppConfig,
-    readiness_checks: &mut Vec<ReadinessCheck>,
-) -> anyhow::Result<Option<openplotva_storage::ServiceClients>> {
-    if !config.service_probe.connect_services {
-        readiness_checks.push(ReadinessCheck::skipped(
-            "postgres",
-            "OPENPLOTVA_CONNECT_SERVICES=false",
-        ));
-        readiness_checks.push(ReadinessCheck::skipped(
-            "redis",
-            "OPENPLOTVA_CONNECT_SERVICES=false",
-        ));
-        return Ok(None);
-    }
-
-    let clients = openplotva_storage::connect_service_clients(
-        &config.database.postgres,
-        &config.redis,
-        config.service_probe.run_migrations,
-    )
-    .await
-    .context("connect Postgres and Redis")?;
-    readiness_checks.push(ReadinessCheck::ok(
-        "postgres",
-        format!(
-            "startup connections established; {} general and {} critical slots",
-            openplotva_storage::POSTGRES_GENERAL_MAX_CONNECTIONS,
-            openplotva_storage::POSTGRES_CRITICAL_MAX_CONNECTIONS,
-        ),
-    ));
-    if clients.migrations_applied {
-        readiness_checks.push(ReadinessCheck::ok(
-            "migrations",
-            "pending SQLx migrations applied",
-        ));
-    } else {
-        readiness_checks.push(ReadinessCheck::skipped(
-            "migrations",
-            "OPENPLOTVA_RUN_MIGRATIONS=false",
-        ));
-    }
-    readiness_checks.push(ReadinessCheck::ok("redis", "startup ping succeeded"));
-    Ok(Some(clients))
-}
-
-fn postgres_capacity_is_exhausted(size: u32, max_connections: u32, idle: usize) -> bool {
-    size >= max_connections && idle == 0
-}
-
-fn postgres_pool_is_exhausted(pool: &PgPool) -> bool {
-    postgres_capacity_is_exhausted(
-        pool.size(),
-        pool.options().get_max_connections(),
-        pool.num_idle(),
-    )
-}
-
-fn postgres_pool_readiness(general: &PgPool, critical: &PgPool) -> ReadinessCheck {
-    if general.is_closed() || critical.is_closed() {
-        return ReadinessCheck::error("postgres_pools_live", "a Postgres pool is closed");
+fn postgres_pool_readiness(general: &PgPool, critical: &PgPool) -> ReadinessCheck {
+    if general.is_closed() || critical.is_closed() {
+        return ReadinessCheck::error("postgres_pools_live", "a Postgres pool is closed");
     }
     let general_exhausted = postgres_pool_is_exhausted(general);
     let critical_exhausted = postgres_pool_is_exhausted(critical);
@@ -9396,7 +1347,7 @@ where
         return WebhookShutdownCleanupReport::SkippedDisabled;
     }
 
-    match timeout(GO_WEBHOOK_DELETE_ON_STOP_TIMEOUT, startup.delete_webhook()).await {
+    match timeout(WEBHOOK_DELETE_ON_STOP_TIMEOUT, startup.delete_webhook()).await {
         Ok(Ok(())) => WebhookShutdownCleanupReport::Deleted,
         Ok(Err(error)) => WebhookShutdownCleanupReport::Failed {
             error: error.to_string(),
@@ -9444,39 +1395,6 @@ where
     Ok(report)
 }
 
-async fn telegram_webhook(
-    Extension(route): Extension<TelegramWebhookRoute>,
-    method: Method,
-    headers: HeaderMap,
-    body: Bytes,
-) -> Response {
-    telegram_webhook_response(&route.sender, method, headers, &route.secret_token, body).await
-}
-
-pub async fn telegram_webhook_response(
-    sender: &openplotva_telegram::WebhookUpdateSender,
-    method: Method,
-    headers: HeaderMap,
-    secret_token: &str,
-    body: Bytes,
-) -> Response {
-    let provided_secret = headers
-        .get(openplotva_telegram::TELEGRAM_WEBHOOK_SECRET_HEADER)
-        .and_then(|value| value.to_str().ok());
-
-    match sender
-        .handle_webhook_request(method.as_str(), provided_secret, secret_token, &body)
-        .await
-    {
-        Ok(()) => StatusCode::OK.into_response(),
-        Err(error) => {
-            let status = StatusCode::from_u16(error.http_status())
-                .unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
-            status.into_response()
-        }
-    }
-}
-
 pub fn webhook_setup_from_config(
     config: &openplotva_config::BotWebhookConfig,
 ) -> std::io::Result<openplotva_telegram::WebhookSetup> {
@@ -9655,279 +1573,21 @@ fn runtime_api_graphql_snapshot(
             .filter(|value| !value.trim().is_empty()),
         persistent_queue_enabled: config.persistent_queue.enabled,
         active_draw_providers: runtime_active_draw_providers(config),
-        sql_timeout_ms: config.runtime_api.sql_timeout_ms,
-        sql_row_limit: config.runtime_api.sql_row_limit,
-        sql_result_bytes_limit: config.runtime_api.sql_result_bytes_limit,
-        db_status: "ok".to_owned(),
-        redis_status: "ok".to_owned(),
-    }
-}
-
-fn runtime_active_draw_providers(config: &AppConfig) -> Vec<String> {
-    let mut providers = Vec::new();
-    if !config.llm.discovery.base_url.trim().is_empty() {
-        providers.push("drawapi".to_owned());
-    }
-    providers.sort();
-    providers
-}
-
-#[derive(Clone)]
-struct RedisRuntimeInspector {
-    client: redis::Client,
-}
-
-impl RedisRuntimeInspector {
-    fn new(client: redis::Client) -> Self {
-        Self { client }
-    }
-
-    async fn scan_all_keys(&self, pattern: &str) -> Result<Vec<String>, redis::RedisError> {
-        let mut connection = self.client.get_multiplexed_async_connection().await?;
-        let mut cursor = 0_u64;
-        let mut keys = Vec::new();
-
-        loop {
-            let (next_cursor, batch): (u64, Vec<String>) = redis::cmd("SCAN")
-                .arg(cursor)
-                .arg("MATCH")
-                .arg(pattern)
-                .arg("COUNT")
-                .arg(1000)
-                .query_async(&mut connection)
-                .await?;
-            keys.extend(batch);
-            if next_cursor == 0 {
-                break;
-            }
-            cursor = next_cursor;
-        }
-
-        Ok(keys)
-    }
-
-    async fn scan_keys(
-        &self,
-        pattern: &str,
-        limit: usize,
-    ) -> Result<Vec<String>, redis::RedisError> {
-        if limit == 0 {
-            return Ok(Vec::new());
-        }
-
-        let mut connection = self.client.get_multiplexed_async_connection().await?;
-        let mut cursor = 0_u64;
-        let mut keys = Vec::new();
-
-        loop {
-            let remaining = limit.saturating_sub(keys.len());
-            if remaining == 0 {
-                break;
-            }
-            let (next_cursor, batch): (u64, Vec<String>) = redis::cmd("SCAN")
-                .arg(cursor)
-                .arg("MATCH")
-                .arg(pattern)
-                .arg("COUNT")
-                .arg(remaining.min(100))
-                .query_async(&mut connection)
-                .await?;
-
-            keys.extend(batch.into_iter().take(remaining));
-            if next_cursor == 0 {
-                break;
-            }
-            cursor = next_cursor;
-        }
-
-        Ok(keys)
-    }
-
-    async fn prefix_groups(
-        &self,
-        prefix: &str,
-        limit: usize,
-    ) -> Result<Vec<openplotva_server::RuntimeRedisPrefixGroup>, redis::RedisError> {
-        let keys = self.scan_keys(&format!("{prefix}*"), limit).await?;
-        Ok(runtime_redis_prefix_groups_from_keys(prefix, keys))
-    }
-
-    async fn value(
-        &self,
-        key: &str,
-        max_bytes: usize,
-    ) -> Result<Option<openplotva_server::RuntimeRedisValue>, redis::RedisError> {
-        let mut connection = self.client.get_multiplexed_async_connection().await?;
-        let value: Option<Vec<u8>> = redis::cmd("GET")
-            .arg(key)
-            .query_async(&mut connection)
-            .await?;
-        Ok(value.map(|bytes| runtime_redis_value_from_bytes(key, &bytes, max_bytes)))
-    }
-
-    async fn raw_value(&self, key: &str) -> Result<Option<String>, redis::RedisError> {
-        let mut connection = self.client.get_multiplexed_async_connection().await?;
-        let value: Option<Vec<u8>> = redis::cmd("GET")
-            .arg(key)
-            .query_async(&mut connection)
-            .await?;
-        Ok(value.map(|bytes| String::from_utf8_lossy(&bytes).into_owned()))
-    }
-
-    async fn delete_key(&self, key: &str) -> Result<(), redis::RedisError> {
-        let mut connection = self.client.get_multiplexed_async_connection().await?;
-        let _: () = redis::cmd("DEL")
-            .arg(key)
-            .query_async(&mut connection)
-            .await?;
-        Ok(())
-    }
-
-    async fn delete_by_prefix(&self, prefix: &str) -> Result<(), redis::RedisError> {
-        let pattern = format!("{prefix}*");
-        let mut connection = self.client.get_multiplexed_async_connection().await?;
-        let mut cursor = 0_u64;
-
-        loop {
-            let (next_cursor, batch): (u64, Vec<String>) = redis::cmd("SCAN")
-                .arg(cursor)
-                .arg("MATCH")
-                .arg(&pattern)
-                .arg("COUNT")
-                .arg(1000)
-                .query_async(&mut connection)
-                .await?;
-            if !batch.is_empty() {
-                let _: () = redis::cmd("DEL")
-                    .arg(batch)
-                    .query_async(&mut connection)
-                    .await?;
-            }
-            if next_cursor == 0 {
-                break;
-            }
-            cursor = next_cursor;
-        }
-
-        Ok(())
-    }
-
-    async fn flushdb(&self) -> Result<(), redis::RedisError> {
-        let mut connection = self.client.get_multiplexed_async_connection().await?;
-        redis::cmd("FLUSHDB").query_async(&mut connection).await
-    }
-}
-
-fn runtime_redis_prefix_groups_from_keys(
-    prefix: &str,
-    keys: impl IntoIterator<Item = String>,
-) -> Vec<openplotva_server::RuntimeRedisPrefixGroup> {
-    let mut groups = HashMap::<String, i32>::new();
-    for key in keys {
-        let Some(rest) = key.strip_prefix(prefix) else {
-            continue;
-        };
-        if rest.is_empty() {
-            continue;
-        }
-        let segment = match rest.find(':') {
-            Some(index) => &rest[..=index],
-            None => rest,
-        };
-        *groups.entry(format!("{prefix}{segment}")).or_default() += 1;
-    }
-
-    let mut keys = groups.keys().cloned().collect::<Vec<_>>();
-    keys.sort();
-    keys.into_iter()
-        .map(|prefix| openplotva_server::RuntimeRedisPrefixGroup {
-            count: groups[&prefix],
-            prefix,
-        })
-        .collect()
-}
-
-fn admin_redis_prefix_groups_from_keys(
-    prefix: &str,
-    keys: impl IntoIterator<Item = String>,
-) -> HashMap<String, i32> {
-    let mut groups = HashMap::<String, i32>::new();
-    for key in keys {
-        let Some(rest) = key.strip_prefix(prefix) else {
-            continue;
-        };
-        if rest.is_empty() {
-            continue;
-        };
-        let segment = match rest.find(':') {
-            Some(index) => &rest[..=index],
-            None => rest,
-        };
-        *groups.entry(format!("{prefix}{segment}")).or_default() += 1;
-    }
-    groups
-}
-
-fn runtime_redis_value_from_bytes(
-    key: &str,
-    bytes: &[u8],
-    max_bytes: usize,
-) -> openplotva_server::RuntimeRedisValue {
-    let truncated = max_bytes > 0 && bytes.len() > max_bytes;
-    let bytes = if truncated {
-        &bytes[..max_bytes]
-    } else {
-        bytes
-    };
-    openplotva_server::RuntimeRedisValue {
-        key: key.to_owned(),
-        value: String::from_utf8_lossy(bytes).into_owned(),
-        truncated,
+        sql_timeout_ms: config.runtime_api.sql_timeout_ms,
+        sql_row_limit: config.runtime_api.sql_row_limit,
+        sql_result_bytes_limit: config.runtime_api.sql_result_bytes_limit,
+        db_status: "ok".to_owned(),
+        redis_status: "ok".to_owned(),
     }
 }
 
-impl openplotva_server::RuntimeRedisInspector for RedisRuntimeInspector {
-    fn prefix_groups<'a>(
-        &'a self,
-        prefix: &'a str,
-        limit: usize,
-    ) -> openplotva_server::RuntimeRedisInspectorFuture<
-        'a,
-        Vec<openplotva_server::RuntimeRedisPrefixGroup>,
-    > {
-        Box::pin(async move {
-            self.prefix_groups(prefix, limit)
-                .await
-                .map_err(|error| error.to_string())
-        })
-    }
-
-    fn keys<'a>(
-        &'a self,
-        pattern: &'a str,
-        limit: usize,
-    ) -> openplotva_server::RuntimeRedisInspectorFuture<'a, Vec<String>> {
-        Box::pin(async move {
-            self.scan_keys(pattern, limit)
-                .await
-                .map_err(|error| error.to_string())
-        })
-    }
-
-    fn value<'a>(
-        &'a self,
-        key: &'a str,
-        max_bytes: usize,
-    ) -> openplotva_server::RuntimeRedisInspectorFuture<
-        'a,
-        Option<openplotva_server::RuntimeRedisValue>,
-    > {
-        Box::pin(async move {
-            self.value(key, max_bytes)
-                .await
-                .map_err(|error| error.to_string())
-        })
+fn runtime_active_draw_providers(config: &AppConfig) -> Vec<String> {
+    let mut providers = Vec::new();
+    if !config.llm.discovery.base_url.trim().is_empty() {
+        providers.push("drawapi".to_owned());
     }
+    providers.sort();
+    providers
 }
 
 #[derive(Clone)]
@@ -10145,299 +1805,6 @@ async fn start_runtime_api_worker(
     Ok((worker, local_addr, tls_public_key_pin))
 }
 
-struct DispatcherWorkerGroupInputs {
-    history: PostgresHistoryStore,
-    telegram: openplotva_telegram::TelegramClient,
-    rich: openplotva_telegram::RichApiClient,
-    ephemeral: RedisEphemeralMessageStore,
-    rate_limits: Arc<rate_limits::ChatRateLimitPolicy<RedisRateLimitStore>>,
-    permissions: Arc<permissions::ChatPermissionPolicy<PostgresChatSettingsStore>>,
-    queue: Arc<openplotva_telegram::DispatcherQueue>,
-    limiters: Arc<openplotva_telegram::ChatLimiters>,
-    failure_ring: Arc<DispatchFailureRing>,
-    routing_admin_reports: openplotva_storage::llm_routing::PostgresRoutingAdminReportStore,
-}
-
-fn build_dispatcher_worker_group(
-    inputs: DispatcherWorkerGroupInputs,
-    stops: &RuntimeWorkerStops,
-) -> RuntimeWorkerGroup {
-    let DispatcherWorkerGroupInputs {
-        history,
-        telegram,
-        rich,
-        ephemeral,
-        rate_limits,
-        permissions,
-        queue,
-        limiters,
-        failure_ring,
-        routing_admin_reports,
-    } = inputs;
-    let mut workers = RuntimeWorkerGroup::new(RuntimeWorkerPhase::Outbound);
-
-    let immediate_history = history.clone();
-    let immediate_telegram = telegram.clone();
-    let immediate_rich = rich.clone();
-    let immediate_ephemeral = ephemeral.clone();
-    let immediate_rate_limits = Arc::clone(&rate_limits);
-    let immediate_permissions = Arc::clone(&permissions);
-    let immediate_queue = Arc::clone(&queue);
-    let immediate_failure_ring = Arc::clone(&failure_ring);
-    let immediate_routing_admin_reports = routing_admin_reports.clone();
-    let immediate_stop = stops.subscribe(RuntimeWorkerPhase::Outbound);
-    workers.register(
-        "dispatcher-immediate",
-        tokio::spawn(async move {
-            let outcome = immediate_queue
-                .run_immediate_worker_until(wait_for_runtime_stop(immediate_stop), |item| {
-                    send_dispatcher_work_item(
-                        immediate_history.clone(),
-                        immediate_telegram.clone(),
-                        immediate_rich.clone(),
-                        immediate_ephemeral.clone(),
-                        Arc::clone(&immediate_rate_limits),
-                        Arc::clone(&immediate_permissions),
-                        Some(Arc::clone(&immediate_failure_ring)),
-                        Some(immediate_routing_admin_reports.clone()),
-                        item,
-                    )
-                })
-                .await;
-
-            tracing::info!(?outcome, "outbound immediate dispatcher worker stopped");
-        }),
-    );
-
-    let regular_queue = queue;
-    let regular_limiters = Arc::clone(&limiters);
-    let regular_stop = stops.subscribe(RuntimeWorkerPhase::Outbound);
-    workers.register(
-        "dispatcher-regular",
-        tokio::spawn(async move {
-            let outcome = regular_queue
-                .run_regular_worker_until(
-                    &regular_limiters,
-                    wait_for_runtime_stop(regular_stop),
-                    |item| {
-                        send_dispatcher_work_item(
-                            history.clone(),
-                            telegram.clone(),
-                            rich.clone(),
-                            ephemeral.clone(),
-                            Arc::clone(&rate_limits),
-                            Arc::clone(&permissions),
-                            Some(Arc::clone(&failure_ring)),
-                            Some(routing_admin_reports.clone()),
-                            item,
-                        )
-                    },
-                )
-                .await;
-
-            tracing::info!(?outcome, "outbound regular dispatcher worker stopped");
-        }),
-    );
-
-    let cleanup_stop = stops.subscribe(RuntimeWorkerPhase::Outbound);
-    workers.register(
-        "dispatcher-limiter-cleanup",
-        tokio::spawn(async move {
-            let outcome = openplotva_telegram::run_limiter_cleanup_until(
-                &limiters,
-                openplotva_telegram::DispatcherRuntimeConfig::default(),
-                wait_for_runtime_stop(cleanup_stop),
-            )
-            .await;
-
-            tracing::info!(
-                ?outcome,
-                "outbound dispatcher limiter cleanup worker stopped"
-            );
-        }),
-    );
-
-    workers
-}
-
-struct SharedTaskQueueMaintenanceConfig {
-    recovery_interval: Duration,
-    cleanup_interval: Duration,
-    completed_retention: time::Duration,
-    placeholder_cleanup_interval: Duration,
-    placeholder_max_age: Duration,
-}
-
-fn build_shared_task_queue_maintenance_group(
-    runtime: &task_queue::SharedTaskQueueRuntime,
-    purge_store: openplotva_storage::PostgresTaskQueueStore,
-    placeholder_effects: openplotva_telegram::TelegramClient,
-    config: SharedTaskQueueMaintenanceConfig,
-    stops: &RuntimeWorkerStops,
-) -> (RuntimeWorkerGroup, Vec<ReadinessCheck>) {
-    let SharedTaskQueueMaintenanceConfig {
-        recovery_interval,
-        cleanup_interval,
-        completed_retention,
-        placeholder_cleanup_interval,
-        placeholder_max_age,
-    } = config;
-    let mut workers = RuntimeWorkerGroup::new(RuntimeWorkerPhase::Processor);
-    let mut readiness = Vec::with_capacity(6);
-
-    let db_journal = runtime
-        .db_journal()
-        .expect("Postgres taskman runtime should have a DB journal");
-    let db_sync_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
-    workers.register(
-        "shared-task-queue-db-sync",
-        tokio::spawn(async move {
-            let report = task_queue::run_task_queue_db_sync_worker_until(
-                db_journal,
-                wait_for_runtime_stop(db_sync_stop),
-            )
-            .await;
-
-            tracing::info!(?report, "shared taskman Postgres sync worker stopped");
-        }),
-    );
-    readiness.push(ReadinessCheck::ok(
-        "shared_task_queue_postgres_sync",
-        format!(
-            "Postgres sync after {}s dirty window or {} mutations",
-            task_queue::TASK_QUEUE_DB_SYNC_INTERVAL.as_secs(),
-            task_queue::TASK_QUEUE_DB_SYNC_MUTATION_THRESHOLD
-        ),
-    ));
-
-    let recovery_runtime = runtime.clone();
-    let recovery_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
-    workers.register(
-        "shared-task-queue-recovery",
-        tokio::spawn(async move {
-            let report = task_queue::run_shared_task_queue_recovery_worker_until(
-                recovery_runtime,
-                recovery_interval,
-                wait_for_runtime_stop(recovery_stop),
-            )
-            .await;
-
-            tracing::info!(?report, "shared taskman recovery worker stopped");
-        }),
-    );
-    readiness.push(ReadinessCheck::ok(
-        "shared_task_queue_recovery",
-        format!(
-            "stale processing recovery every {}s",
-            recovery_interval.as_secs()
-        ),
-    ));
-
-    let cleanup_runtime = runtime.clone();
-    let cleanup_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
-    workers.register(
-        "shared-task-queue-terminal-cleanup",
-        tokio::spawn(async move {
-            let report = task_queue::run_shared_task_queue_terminal_cleanup_worker_until(
-                cleanup_runtime,
-                cleanup_interval,
-                task_queue::FINISHED_JOB_MEMORY_RETENTION,
-                wait_for_runtime_stop(cleanup_stop),
-            )
-            .await;
-
-            tracing::info!(?report, "shared taskman terminal cleanup worker stopped");
-        }),
-    );
-    readiness.push(ReadinessCheck::ok(
-        "shared_task_queue_terminal_cleanup",
-        format!(
-            "finished-job eviction from memory every {}s, kept {}m",
-            cleanup_interval.as_secs(),
-            task_queue::FINISHED_JOB_MEMORY_RETENTION.whole_minutes()
-        ),
-    ));
-
-    let purge_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
-    workers.register(
-        "shared-task-queue-postgres-purge",
-        tokio::spawn(async move {
-            let report = task_queue::run_shared_task_queue_db_purge_worker_until(
-                purge_store,
-                cleanup_interval,
-                completed_retention,
-                wait_for_runtime_stop(purge_stop),
-            )
-            .await;
-
-            tracing::info!(?report, "shared taskman Postgres purge worker stopped");
-        }),
-    );
-    readiness.push(ReadinessCheck::ok(
-        "shared_task_queue_postgres_purge",
-        format!(
-            "Postgres purge every {}s, finished jobs kept {}d, deleted jobs {}d",
-            cleanup_interval.as_secs(),
-            completed_retention.whole_days() * 2,
-            completed_retention.whole_days()
-        ),
-    ));
-
-    let stuck_runtime = runtime.clone();
-    let stuck_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
-    workers.register(
-        "shared-task-queue-stuck-cleanup",
-        tokio::spawn(async move {
-            let report = task_queue::run_shared_task_queue_stuck_cleanup_worker_until(
-                stuck_runtime,
-                task_queue::SHARED_TASK_QUEUE_STUCK_SCAN_INTERVAL,
-                task_queue::SHARED_TASK_QUEUE_STUCK_DURATION,
-                wait_for_runtime_stop(stuck_stop),
-            )
-            .await;
-
-            tracing::info!(?report, "shared taskman stuck-job cleanup worker stopped");
-        }),
-    );
-    readiness.push(ReadinessCheck::ok(
-        "shared_task_queue_stuck_cleanup",
-        format!(
-            "stuck-job cleanup every {}s, stuck after {}s",
-            task_queue::SHARED_TASK_QUEUE_STUCK_SCAN_INTERVAL.as_secs(),
-            task_queue::SHARED_TASK_QUEUE_STUCK_DURATION.as_secs()
-        ),
-    ));
-
-    let placeholder_runtime = runtime.clone();
-    let placeholder_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
-    workers.register(
-        "shared-task-queue-placeholder-cleanup",
-        tokio::spawn(async move {
-            let report = task_queue::run_shared_task_queue_placeholder_cleanup_worker_until(
-                placeholder_runtime,
-                placeholder_effects,
-                placeholder_cleanup_interval,
-                placeholder_max_age,
-                Duration::from_secs(1),
-                wait_for_runtime_stop(placeholder_stop),
-            )
-            .await;
-
-            tracing::info!(?report, "shared taskman placeholder cleanup worker stopped");
-        }),
-    );
-    readiness.push(ReadinessCheck::ok(
-        "shared_task_queue_placeholder_cleanup",
-        format!(
-            "placeholder cleanup every {}s, max age {}s",
-            placeholder_cleanup_interval.as_secs(),
-            placeholder_max_age.as_secs()
-        ),
-    ));
-
-    (workers, readiness)
-}
-
 async fn start_runtime_workers(
     config: &AppConfig,
     service_clients: Option<&ServiceClients>,
@@ -10542,6 +1909,7 @@ async fn start_runtime_workers(
         routing_event_buffer: None,
         routing_event_reporter: None,
         runtime_api_tls_public_key_pin: None,
+        attempt_walker: None,
         router_handle: None,
         router_breakers: None,
         router_triggers: None,
@@ -10623,7 +1991,7 @@ async fn start_runtime_workers(
             .await
     {
         routing_event_reporter.record(runtime_routing::routing_backfill_failed_event(
-            "backfill_dialog_qwen_fallback",
+            "backfill_dialog_local_reasoner_fallback",
             &error.to_string(),
         ));
         tracing::warn!(%error, "failed to backfill dialog GPU local-reasoner fallback");
@@ -10735,7 +2103,7 @@ async fn start_runtime_workers(
                         }),
                     });
                     if let Some(error) = report.key_status_error.as_deref() {
-                        record_openrouter_free_key_status_failed(
+                        runtime_routing::record_openrouter_free_key_status_failed(
                             &routing_event_reporter,
                             "startup",
                             error,
@@ -10788,6 +2156,15 @@ async fn start_runtime_workers(
             )
         }
     };
+    let attempt_walker = routed_attempts::RoutedAttemptWalker::new(
+        Arc::clone(&router_handle),
+        Arc::clone(&router_breakers),
+        Arc::clone(&router_triggers),
+        Arc::clone(&router_pools),
+    )
+    .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
+    .with_reporter(routing_event_reporter.clone());
+    workers.attempt_walker = Some(attempt_walker.clone());
     workers.router_handle = Some(Arc::clone(&router_handle));
     workers.router_breakers = Some(Arc::clone(&router_breakers));
     workers.router_triggers = Some(Arc::clone(&router_triggers));
@@ -10875,7 +2252,7 @@ async fn start_runtime_workers(
                                     }),
                                 });
                                 if let Some(error) = report.key_status_error.as_deref() {
-                                    record_openrouter_free_key_status_failed(
+                                    runtime_routing::record_openrouter_free_key_status_failed(
                                         &reporter,
                                         "daily",
                                         error,
@@ -11426,14 +2803,7 @@ async fn start_runtime_workers(
     if config.memory.enabled && config.bot.key.is_none() {
         let memory_write_embedder = Some(
             embedder::RoutedDiscoveryEmbedder::new(
-                routed_attempts::RoutedAttemptWalker::new(
-                    Arc::clone(&router_handle),
-                    Arc::clone(&router_breakers),
-                    Arc::clone(&router_triggers),
-                    Arc::clone(&router_pools),
-                )
-                .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-                .with_reporter(routing_event_reporter.clone()),
+                attempt_walker.clone(),
                 embedder::DiscoveryEmbedderConfig {
                     base_url: config.llm.discovery.base_url.clone(),
                     service_name: config.memory.embedder_service_name.clone(),
@@ -11446,17 +2816,8 @@ async fn start_runtime_workers(
             )
             .with_lane_priority(openplotva_llm::router::LanePriority::Background),
         );
-        let memory_extractor = memory_runtime::routed_memory_extractor_from_app_config(
-            config,
-            routed_attempts::RoutedAttemptWalker::new(
-                Arc::clone(&router_handle),
-                Arc::clone(&router_breakers),
-                Arc::clone(&router_triggers),
-                Arc::clone(&router_pools),
-            )
-            .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-            .with_reporter(routing_event_reporter.clone()),
-        );
+        let memory_extractor =
+            memory_runtime::RoutedMemoryExtractor::new(attempt_walker.clone(), config);
         let memory_worker_store = memory_store.clone();
         let memory_worker_config =
             memory_runtime::memory_service_worker_config_from_memory_config(&config.memory);
@@ -11493,78 +2854,14 @@ async fn start_runtime_workers(
     }
 
     if config.memory.enabled {
-        let archival_store = memory_store.clone();
-        let archival_stop = worker_stops.subscribe(RuntimeWorkerPhase::Ancillary);
-        let worker = tokio::spawn(async move {
-            let report = memory_runtime::run_memory_card_archival_worker_until(
-                archival_store,
-                memory_runtime::MEMORY_CARD_ARCHIVAL_INTERVAL,
-                memory_runtime::MEMORY_CARD_ARCHIVAL_BATCH,
-                wait_for_runtime_stop(archival_stop),
-            )
-            .await;
-            tracing::info!(?report, "memory card archival worker stopped");
-        });
-        readiness_checks.push(ReadinessCheck::ok(
-            "memory_card_archival",
-            "Expired memory cards archived hourly (durability-based forgetting)",
-        ));
-        worker_registry.register(
-            "memory-card-archival",
-            RuntimeWorkerPhase::Ancillary,
-            worker,
-        );
-
-        let decay_store = memory_store.clone();
-        let decay_stop = worker_stops.subscribe(RuntimeWorkerPhase::Ancillary);
-        let decay_worker = tokio::spawn(async move {
-            let report = memory_runtime::run_memory_card_decay_worker_until(
-                decay_store,
-                memory_runtime::MEMORY_CARD_DECAY_INTERVAL,
-                memory_runtime::MEMORY_CARD_DECAY_BATCH,
-                memory_runtime::MEMORY_CARD_DECAY_GRACE_DAYS,
-                memory_runtime::MEMORY_CARD_DECAY_SALIENCE_MAX,
-                memory_runtime::MEMORY_CARD_DECAY_COLD_DAYS,
-                wait_for_runtime_stop(decay_stop),
-            )
-            .await;
-            tracing::info!(?report, "memory card decay worker stopped");
-        });
-        readiness_checks.push(ReadinessCheck::ok(
-            "memory_card_decay",
-            "Cold never-expiring cards given a grace TTL (bounded forgetting)",
-        ));
-        worker_registry.register(
-            "memory-card-decay",
-            RuntimeWorkerPhase::Ancillary,
-            decay_worker,
-        );
-
-        let collapse_store = memory_store.clone();
-        let collapse_stop = worker_stops.subscribe(RuntimeWorkerPhase::Ancillary);
-        let collapse_worker = tokio::spawn(async move {
-            let report = memory_runtime::run_memory_duplicate_collapse_worker_until(
-                collapse_store,
-                memory_runtime::MEMORY_DUP_COLLAPSE_INTERVAL,
-                memory_runtime::MEMORY_DUP_COLLAPSE_GROUP_LIMIT,
-                wait_for_runtime_stop(collapse_stop),
-            )
-            .await;
-            tracing::info!(?report, "memory duplicate collapse worker stopped");
-        });
-        readiness_checks.push(ReadinessCheck::ok(
-            "memory_dup_collapse",
-            "Exact-duplicate memory cards collapsed every 6h (off-hours backlog cleanup)",
-        ));
-        worker_registry.register(
-            "memory-duplicate-collapse",
-            RuntimeWorkerPhase::Ancillary,
-            collapse_worker,
-        );
+        let (group, checks) =
+            memory_runtime::build_memory_retention_worker_group(&memory_store, &worker_stops);
+        readiness_checks.extend(checks);
+        worker_registry.install(group);
     }
 
     let dispatcher_queue = Arc::new(openplotva_telegram::DispatcherQueue::new(
-        go_dispatcher_config(),
+        dispatcher_config(),
     ));
     if config.maintenance.enabled {
         let (server, capture) = maintenance_api::start(
@@ -11652,19 +2949,14 @@ async fn start_runtime_workers(
         &config.bot.api_base_url,
     )
     .context("create rich-message API client")?;
-    let rich_sender: Arc<dyn rich::RichSender> = Arc::new(rich::RichMessenger::new(
-        rich_api.clone(),
-        openplotva_media::uploader::UploaderClient::new(
-            openplotva_media::uploader::UploaderConfig {
-                base_url: config.uploader.base_url.clone(),
-                secret: config.uploader.secret.clone(),
-                timeout: std::time::Duration::from_secs(
-                    config.uploader.timeout_seconds.max(0) as u64
-                ),
-            },
-        )
-        .context("create media uploader client")?,
-    ));
+    let media_uploader = openplotva_media::uploader::UploaderClient::new(
+        openplotva_media::uploader::UploaderConfig {
+            base_url: config.uploader.base_url.clone(),
+            secret: config.uploader.secret.clone(),
+            timeout: std::time::Duration::from_secs(config.uploader.timeout_seconds.max(0) as u64),
+        },
+    )
+    .context("create media uploader client")?;
     let bot_identity = telegram
         .execute(openplotva_telegram::build_get_bot_method())
         .await
@@ -11681,19 +2973,10 @@ async fn start_runtime_workers(
     workers.telegram = Some(telegram.clone());
     workers.delete_webhook_on_shutdown = config.bot.webhook.enabled;
     let update_stream = {
-        let schema_ready = sqlx::query_scalar::<_, bool>(
-            "SELECT to_regclass('public.telegram_update_inbox') IS NOT NULL \
-                AND to_regclass('public.telegram_update_quarantine') IS NOT NULL \
-                AND to_regclass('public.telegram_update_attempts') IS NOT NULL \
-                AND to_regclass('public.telegram_update_lanes') IS NOT NULL \
-                AND to_regclass('public.telegram_update_startup_jobs') IS NOT NULL \
-                AND to_regclass('public.telegram_outbox') IS NOT NULL \
-                AND to_regclass('public.telegram_outbox_attempts') IS NOT NULL \
-                AND to_regclass('public.telegram_outbox_blobs') IS NOT NULL",
-        )
-        .fetch_one(&service_clients.postgres)
-        .await
-        .context("check Telegram delivery durability schema")?;
+        let schema_ready =
+            openplotva_storage::telegram_delivery::delivery_schema_ready(&service_clients.postgres)
+                .await
+                .context("check Telegram delivery durability schema")?;
         if !schema_ready {
             anyhow::bail!(
                 "UPDATE_QUEUE_BACKEND=stream requires Telegram inbox, quarantine, attempts, and outbox migrations"
@@ -11818,7 +3101,7 @@ async fn start_runtime_workers(
     let dispatcher_persistence = openplotva_telegram::RedisDispatcherQueueStore::new(
         service_clients.redis.client().clone(),
         openplotva_telegram::DEFAULT_DISPATCHER_QUEUE_KEY,
-        GO_DISPATCHER_MAX_QUEUE_SIZE,
+        DISPATCHER_MAX_QUEUE_SIZE,
     );
     let routing_admin_report_store =
         openplotva_storage::llm_routing::PostgresRoutingAdminReportStore::new(
@@ -11984,18 +3267,8 @@ async fn start_runtime_workers(
     }
     let taskman_ids = openplotva_taskman::TaskQueueIdAllocator::new();
     let translation_cache = service_clients.redis.translation_cache_store();
-    let translator = llm_translate::runtime_llm_translator(
-        config,
-        translation_cache,
-        routed_attempts::RoutedAttemptWalker::new(
-            Arc::clone(&router_handle),
-            Arc::clone(&router_breakers),
-            Arc::clone(&router_triggers),
-            Arc::clone(&router_pools),
-        )
-        .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-        .with_reporter(routing_event_reporter.clone()),
-    );
+    let translator =
+        llm_translate::runtime_llm_translator(config, translation_cache, attempt_walker.clone());
     let translate_effects =
         translate::TranslateDispatcherEffects::new(Arc::clone(&dispatcher_queue));
     let admin_cache_store = service_clients.redis.chat_admin_cache_store();
@@ -12026,7 +3299,6 @@ async fn start_runtime_workers(
     let member_effects = members::MemberStateRuntimeEffects::new(
         chat_member_store.clone(),
         telegram.clone(),
-        telegram.clone(),
         admin_cache_store,
     );
     let checkin_game_store = checkin::PostgresCheckinGameStore::new(
@@ -12089,12 +3361,20 @@ async fn start_runtime_workers(
         &config.gradius.generation_api_key,
         "gradius_generation",
     );
+    let telegram_outbox_store = openplotva_storage::PostgresTelegramOutboxStore::new(
+        service_clients.critical_postgres.clone(),
+    );
+    let rich_outbox = Arc::new(rich::RichOutbox::new(
+        telegram_outbox_store.clone(),
+        bot_identity.id,
+    ));
     let mut checkin_effects = checkin::CheckinGameRuntimeEffects::new(
         checkin_game_store.clone(),
         checkin::TelegramCheckinGameSender::new(
             ephemeral_store.clone(),
             telegram.clone(),
             rich_api.clone(),
+            rich_outbox.clone(),
         ),
         Arc::clone(&permission_policy),
         bot_identity.id,
@@ -12108,7 +3388,7 @@ async fn start_runtime_workers(
     let telegram_effects = Arc::new(telegram.clone());
     let payment_rich_effects = Arc::new(payments::RichPaymentEffects::new(
         telegram.clone(),
-        Arc::clone(&rich_sender),
+        Arc::clone(&rich_outbox),
     ));
     let payment_runtime_effects = Arc::new(payment_effects.clone());
     let shared_task_queue_recovery_interval =
@@ -12145,7 +3425,7 @@ async fn start_runtime_workers(
     let task_enqueue_rate_limit = Arc::new(rate_limits::TaskEnqueueRateLimitPolicy::new(
         service_clients.redis.task_enqueue_rate_limit_store(),
     ));
-    let control_queue = payments::PersistentPaymentControlJobQueue::from_task_queue(
+    let control_queue = control_jobs::PersistentControlJobQueue::from_task_queue(
         task_queue_for_updates.as_ref().clone(),
     )
     .with_task_enqueue_rate_limit(task_enqueue_rate_limit.clone())
@@ -12178,17 +3458,20 @@ async fn start_runtime_workers(
     worker_registry.install(shared_task_queue_workers);
     readiness_checks.extend(shared_task_queue_checks);
     workers.shared_task_queue = Some(shared_task_queue.clone());
-    let telegram_outbox_store = openplotva_storage::PostgresTelegramOutboxStore::new(
-        service_clients.critical_postgres.clone(),
-    );
     let telegram_outbox_transport =
         telegram_outbox::TelegramApiOutboxTransport::new(telegram.clone(), rich_api.clone());
+    // One shared reaction signaler feeds the tool adapter, image/music
+    // workers, and the obligations watcher.
+    let generation_reactions: reactions::GenerationReactions =
+        Arc::new(reactions::GenerationReactionSignaler::new(telegram.clone()));
     let telegram_outbox_jobs = telegram_outbox::RunAwareTelegramOutboxJobResolver::new(
         shared_task_queue.clone(),
         llm_run_buffer.clone(),
         openplotva_storage::gradius_ads::PostgresGradiusAdStore::new(
             service_clients.postgres.clone(),
         ),
+        telegram_outbox_store.clone(),
+        Some(Arc::clone(&generation_reactions)),
     );
     let telegram_outbox_worker_id =
         format!("telegram-outbox-{}-{}", bot_identity.id, std::process::id());
@@ -12230,14 +3513,7 @@ async fn start_runtime_workers(
     if config.memory.enabled {
         let memory_write_embedder = Some(
             embedder::RoutedDiscoveryEmbedder::new(
-                routed_attempts::RoutedAttemptWalker::new(
-                    Arc::clone(&router_handle),
-                    Arc::clone(&router_breakers),
-                    Arc::clone(&router_triggers),
-                    Arc::clone(&router_pools),
-                )
-                .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-                .with_reporter(routing_event_reporter.clone()),
+                attempt_walker.clone(),
                 embedder::DiscoveryEmbedderConfig {
                     base_url: config.llm.discovery.base_url.clone(),
                     service_name: config.memory.embedder_service_name.clone(),
@@ -12250,183 +3526,47 @@ async fn start_runtime_workers(
             )
             .with_lane_priority(openplotva_llm::router::LanePriority::Background),
         );
-        let memory_scheduler_store = memory_store.clone();
-        let memory_scheduler_queue = Arc::clone(&task_queue_for_updates);
-        let memory_scheduler_config =
-            memory_runtime::memory_service_worker_config_from_memory_config(&config.memory);
-        let memory_scheduler_trigger = Arc::clone(&memory_restart_trigger);
-        let memory_scheduler_stop = worker_stops.subscribe(RuntimeWorkerPhase::Ingress);
-        let memory_scheduler = tokio::spawn(async move {
-            let report =
-                memory_runtime::run_memory_consolidation_taskman_scheduler_with_trigger_until(
-                    &memory_scheduler_store,
-                    memory_scheduler_queue.as_ref(),
-                    memory_scheduler_config,
-                    memory_scheduler_trigger,
-                    wait_for_runtime_stop(memory_scheduler_stop),
-                )
-                .await;
-
-            tracing::info!(?report, "memory-consolidation taskman scheduler stopped");
+        let merger = config.memory.subject_merge_enabled.then(|| {
+            (
+                memory_runtime::RoutedSubjectMerger::new(attempt_walker.clone(), config),
+                memory_runtime::MemorySubjectMergeConfig {
+                    interval: std::time::Duration::from_secs(
+                        u64::try_from(config.memory.subject_merge_interval_seconds.max(1))
+                            .unwrap_or(45),
+                    ),
+                    cooldown_hours: config.memory.subject_merge_cooldown_hours,
+                    min_cards: i64::from(config.memory.subject_merge_min_cards),
+                    embedding_dimension: config.memory.embedding_dim,
+                    ..memory_runtime::MemorySubjectMergeConfig::default()
+                },
+            )
         });
-        worker_registry.register(
-            "memory-consolidation-scheduler",
-            RuntimeWorkerPhase::Ingress,
-            memory_scheduler,
-        );
-
-        // Memory workers follow the memory primary's lanes; the configured
-        // count is the floor and `0` disables them.
-        let configured_memory_worker_count =
-            u32::try_from(config.persistent_queue.memory_consolidation_workers.max(0)).unwrap_or(0);
-        let memory_worker_count = if configured_memory_worker_count == 0 {
-            0
-        } else {
-            let (scale, desired) = tokio::sync::watch::channel(configured_memory_worker_count);
-            let lanes = model_routing::LaneWorkerScale {
-                workflow_key: memory_runtime::MEMORY_EXTRACTION_WORKFLOW_KEY,
-                per_lane: u32::try_from(config.persistent_queue.memory_workers_per_lane.max(1))
-                    .unwrap_or(1),
-                floor: configured_memory_worker_count,
-                cap: u32::try_from(config.persistent_queue.memory_workers_cap.max(1)).unwrap_or(1),
-                scale,
-            };
-            let initial = lanes
-                .desired(&router_handle.snapshot())
-                .unwrap_or(configured_memory_worker_count);
-            let _ = lanes.scale.send(initial);
-            tracing::info!(
-                configured_workers = configured_memory_worker_count,
-                initial_workers = initial,
-                cap = lanes.cap,
-                "memory-consolidation worker scale derived from lane pools"
-            );
-            memory_worker_scale = Some(lanes);
-
-            let memory_worker_spawner = {
-                let extractor = memory_runtime::routed_memory_extractor_from_app_config(
+        let group = memory_workers::build_taskman_workers(
+            memory_workers::MemoryTaskmanWorkerInputs {
+                store: memory_store.clone(),
+                queue: Arc::clone(&task_queue_for_updates),
+                config: memory_runtime::memory_service_worker_config_from_memory_config(
+                    &config.memory,
+                ),
+                trigger: Arc::clone(&memory_restart_trigger),
+                extractor: memory_runtime::RoutedMemoryExtractor::new(
+                    attempt_walker.clone(),
                     config,
-                    routed_attempts::RoutedAttemptWalker::new(
-                        Arc::clone(&router_handle),
-                        Arc::clone(&router_breakers),
-                        Arc::clone(&router_triggers),
-                        Arc::clone(&router_pools),
-                    )
-                    .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-                    .with_reporter(routing_event_reporter.clone()),
-                );
-                let store = memory_store.clone();
-                let embedder = memory_write_embedder.clone();
-                let queue = Arc::clone(&task_queue_for_updates);
-                let process =
-                    memory_runtime::memory_service_worker_config_from_memory_config(&config.memory)
-                        .process;
-                let desired = desired.clone();
-                let stop_rx = worker_stops.subscribe(RuntimeWorkerPhase::Processor);
-                move |index: usize, retire: tokio::sync::oneshot::Receiver<()>| {
-                    let worker_extractor = extractor.clone();
-                    let worker_store = store.clone();
-                    let worker_embedder = embedder.clone();
-                    let worker_queue = Arc::clone(&queue);
-                    let worker_id = format!(
-                        "{}-{index}",
-                        memory_runtime::MEMORY_CONSOLIDATION_JOB_WORKER_PREFIX
-                    );
-                    let worker_config = memory_runtime::MemoryConsolidationQueueWorkerConfig {
-                        process: process.clone(),
-                        worker_id: worker_id.clone(),
-                        interval: memory_runtime::MEMORY_CONSOLIDATION_JOB_POLL_INTERVAL,
-                        pipeline_target: usize::try_from(*desired.borrow()).unwrap_or(1),
-                    };
-                    let worker_stop = stop_rx.clone();
-                    tokio::spawn(async move {
-                        // A retired worker finishes its current run and exits
-                        // at the next loop tick, exactly like a runtime stop.
-                        let stop_future = async move {
-                            tokio::select! {
-                                () = wait_for_runtime_stop(worker_stop) => {}
-                                _ = retire => {}
-                            }
-                        };
-                        let report = memory_runtime::run_memory_consolidation_taskman_worker_until(
-                            worker_queue.as_ref(),
-                            &worker_extractor,
-                            &worker_store,
-                            worker_embedder.as_ref(),
-                            worker_config,
-                            stop_future,
-                        )
-                        .await;
-
-                        tracing::info!(?report, %worker_id, "memory-consolidation taskman worker stopped");
-                    })
-                }
-            };
-            let memory_supervisor = dialog_workers::spawn_worker_supervisor(
-                Arc::new(memory_worker_spawner),
-                desired,
-                Arc::new(dialog_workers::WorkerGauge::new()),
-                worker_stops.subscribe(RuntimeWorkerPhase::Processor),
-            );
-            worker_registry.register(
-                "memory-consolidation-worker-supervisor",
-                RuntimeWorkerPhase::Processor,
-                memory_supervisor,
-            );
-            initial
-        };
-        if config.memory.subject_merge_enabled {
-            let merge_merger = memory_runtime::routed_subject_merger_from_app_config(
-                config,
-                routed_attempts::RoutedAttemptWalker::new(
-                    Arc::clone(&router_handle),
-                    Arc::clone(&router_breakers),
-                    Arc::clone(&router_triggers),
-                    Arc::clone(&router_pools),
-                )
-                .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-                .with_reporter(routing_event_reporter.clone()),
-            );
-            let merge_store = memory_store.clone();
-            let merge_embedder = memory_write_embedder.clone();
-            let merge_cfg = memory_runtime::MemorySubjectMergeConfig {
-                interval: std::time::Duration::from_secs(
-                    u64::try_from(config.memory.subject_merge_interval_seconds.max(1))
-                        .unwrap_or(45),
                 ),
-                cooldown_hours: config.memory.subject_merge_cooldown_hours,
-                min_cards: i64::from(config.memory.subject_merge_min_cards),
-                embedding_dimension: config.memory.embedding_dim,
-                ..memory_runtime::MemorySubjectMergeConfig::default()
-            };
-            let merge_stop = worker_stops.subscribe(RuntimeWorkerPhase::Processor);
-            let merge_worker = tokio::spawn(async move {
-                let report = memory_runtime::run_memory_subject_merge_worker_until(
-                    &merge_merger,
-                    merge_store,
-                    merge_embedder.as_ref(),
-                    merge_cfg,
-                    wait_for_runtime_stop(merge_stop),
-                )
-                .await;
-                tracing::info!(?report, "memory subject merge-pass worker stopped");
-            });
-            readiness_checks.push(ReadinessCheck::ok(
-                "memory_subject_merge",
-                "Backlog over-extracted (scope,subject) card groups consolidated 24/7 via the LLM merge-pass",
-            ));
-            worker_registry.register(
-                "memory-subject-merge",
-                RuntimeWorkerPhase::Processor,
-                merge_worker,
-            );
-        }
-        readiness_checks.push(ReadinessCheck::ok(
-            "memory_service",
-            format!(
-                "Memory service schedules memory-consolidation taskman jobs and starts {memory_worker_count} routed workers over SQLx persistence"
-            ),
-        ));
+                embedder: memory_write_embedder,
+                merger,
+                worker_floor: config.persistent_queue.memory_consolidation_workers,
+                workers_per_lane: config.persistent_queue.memory_workers_per_lane,
+                worker_cap: config.persistent_queue.memory_workers_cap,
+            },
+            &worker_stops,
+            &router_handle.snapshot(),
+        );
+        let memory_worker_count = group.count;
+        memory_worker_scale = group.scale;
+        readiness_checks.extend(group.readiness);
+        worker_registry.install(group.ingress);
+        worker_registry.install(group.processors);
         workers.memory_restart_trigger = Some(Arc::clone(&memory_restart_trigger));
         shared_taskman_worker_counts.insert(
             openplotva_taskman::MEMORY_CONSOLIDATION_QUEUE_NAME.to_owned(),
@@ -12490,10 +3630,6 @@ async fn start_runtime_workers(
     let delivery_obligation_store = Arc::new(
         openplotva_storage::PostgresDeliveryObligationStore::new(service_clients.postgres.clone()),
     );
-    // One shared reaction signaler feeds the tool adapter, image/music
-    // workers, and the obligations watcher.
-    let generation_reactions: reactions::GenerationReactions =
-        Arc::new(reactions::GenerationReactionSignaler::new(telegram.clone()));
     let dialog_tool_adapter =
         dialog_tools::TaskmanDialogToolAdapter::new(Arc::clone(&task_queue_for_updates))
             .with_durability_barrier(Arc::new(shared_task_queue.clone()))
@@ -12603,15 +3739,8 @@ async fn start_runtime_workers(
         vision::TelegramVisionDescriber::new(
             PostgresTelegramFileStore::new(service_clients.postgres.clone()),
             vision::RoutedVisionCaptioner::new(
-                routed_attempts::RoutedAttemptWalker::new(
-                    Arc::clone(&router_handle),
-                    Arc::clone(&router_breakers),
-                    Arc::clone(&router_triggers),
-                    Arc::clone(&router_pools),
-                )
-                .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-                .with_reporter(routing_event_reporter.clone()),
-                vision::aifarm_vision_captioner_config_from_app_config(config),
+                attempt_walker.clone(),
+                config,
                 vision_caption_data_urls.clone(),
             ),
         )
@@ -12622,15 +3751,8 @@ async fn start_runtime_workers(
         vision::TelegramVisionDescriber::new(
             PostgresTelegramFileStore::new(service_clients.postgres.clone()),
             vision::RoutedVisionCaptioner::new(
-                routed_attempts::RoutedAttemptWalker::new(
-                    Arc::clone(&router_handle),
-                    Arc::clone(&router_breakers),
-                    Arc::clone(&router_triggers),
-                    Arc::clone(&router_pools),
-                )
-                .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-                .with_reporter(routing_event_reporter.clone()),
-                vision::aifarm_vision_captioner_config_from_app_config(config),
+                attempt_walker.clone(),
+                config,
                 vision_caption_data_urls,
             ),
         )
@@ -12701,60 +3823,37 @@ async fn start_runtime_workers(
         rates::MarketRatesClient::from_config(&config.market_rates)
             .context("failed to initialize market rates provider")?,
     );
-    let rates_tool_dispatcher =
-        Arc::new(rates::RatesToolRichEffects::new(Arc::clone(&rich_sender)));
+    let rates_tool_dispatcher = Arc::new(rates::RatesDelivery::new(Arc::clone(&rich_outbox)));
     let history_summarizer = Some(Arc::new(
         history_summary::routed_history_summary_service_from_app_config(
             config,
             Arc::new(history_store.clone()),
-            routed_attempts::RoutedAttemptWalker::new(
-                Arc::clone(&router_handle),
-                Arc::clone(&router_breakers),
-                Arc::clone(&router_triggers),
-                Arc::clone(&router_pools),
-            )
-            .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-            .with_reporter(routing_event_reporter.clone()),
+            attempt_walker.clone(),
         ),
     ) as Arc<dyn dialog_tools::ChatHistorySummarizer>);
     readiness_checks.push(ReadinessCheck::ok(
         "history_summary",
         "Chat history summary dialog tool wired to Postgres history store and routed provider",
     ));
-    let youtube_summarizer = match youtube::RuntimeYouTubeSummarizer::routed_from_app_config(
-        config,
-        routed_attempts::RoutedAttemptWalker::new(
-            Arc::clone(&router_handle),
-            Arc::clone(&router_breakers),
-            Arc::clone(&router_triggers),
-            Arc::clone(&router_pools),
-        )
-        .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-        .with_reporter(routing_event_reporter.clone()),
-    ) {
-        Ok(Some(summarizer)) => {
-            let provider = summarizer.provider_label();
+    let youtube_summarizer = match youtube::GeminiYouTubeSummarizer::from_app_config(config) {
+        Some(transcript) => {
             readiness_checks.push(ReadinessCheck::ok(
                 "youtube_summary",
-                format!("YouTube transcript fetcher and {provider} summary tool wired"),
+                "YouTube transcript fetcher and routed provider summary tool wired",
             ));
-            Some(Arc::new(summarizer) as Arc<dyn dialog_tools::YouTubeSummarizer>)
+            Some(Arc::new(youtube::RoutedYouTubeSummarizer::new(
+                transcript,
+                attempt_walker.clone(),
+                config,
+            )) as Arc<dyn dialog_tools::YouTubeSummarizer>)
         }
-        Ok(None) => {
+        None => {
             readiness_checks.push(ReadinessCheck::skipped(
                 "youtube_summary",
                 "YouTube summary dialog tool unavailable: Google AI key is not configured",
             ));
             None
         }
-        Err(error) => {
-            tracing::warn!(%error, "YouTube summary dialog tool unavailable");
-            readiness_checks.push(ReadinessCheck::skipped(
-                "youtube_summary",
-                format!("YouTube summary dialog tool unavailable: {error}"),
-            ));
-            None
-        }
     };
     let serper_client = match serper::SerperClient::from_app_config(config) {
         Ok(Some(client)) => {
@@ -12986,14 +4085,7 @@ async fn start_runtime_workers(
             max_draws: config.llm.dialog.session_max_draws,
             max_songs: config.llm.dialog.session_max_songs,
         });
-    let embedding_attempt_walker = routed_attempts::RoutedAttemptWalker::new(
-        Arc::clone(&router_handle),
-        Arc::clone(&router_breakers),
-        Arc::clone(&router_triggers),
-        Arc::clone(&router_pools),
-    )
-    .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-    .with_reporter(routing_event_reporter.clone());
+    let embedding_attempt_walker = attempt_walker.clone();
     let memory_query_embedder = if dialog_memory_context_enabled(config) {
         Some(Arc::new(embedder::RoutedDiscoveryEmbedder::new(
             embedding_attempt_walker.clone(),
@@ -13052,198 +4144,184 @@ async fn start_runtime_workers(
             }),
         );
     }
-    let genkit_fallback = dialog_runtime::genkit_dialog_provider_from_app_config_with_prompt_store(
-        config,
-        Arc::clone(&prompt_store),
-    );
-    let mut dialog_provider_for_updates: Option<openplotva_llm::ChatProviderHandle> = None;
-    match Ok::<_, dialog_runtime::DialogProviderBuildError>(dialog_runtime::router_dialog_provider(
-        config,
-        Arc::clone(&dialog_toolbox),
-        Arc::clone(&router_handle),
-        Arc::clone(&router_breakers),
-        Arc::clone(&router_triggers),
-        Arc::clone(&router_pools),
-        genkit_fallback,
-        Some(routing_event_reporter.clone()),
-        Arc::clone(&prompt_store),
-    )) {
-        Ok(mut dialog_provider) => {
-            // One shared check-event recorder serves both the REAL and the
-            // SAFE (virtual-dialog) WhiteCircle wraps.
-            let white_circle_recorder: Option<
-                Arc<dyn openplotva_llm::whitecircle::WhiteCircleCheckEventRecorder>,
-            > = if dialog_runtime::white_circle_effective_enabled(config) {
-                let (recorder, recorder_worker) =
-                    runtime_safety::PostgresWhiteCircleCheckEventRecorder::spawn(
-                        service_clients.postgres.clone(),
-                        worker_stops.subscribe(RuntimeWorkerPhase::Ancillary),
-                    );
-                worker_registry.register(
-                    "white-circle-event-recorder",
-                    RuntimeWorkerPhase::Ancillary,
-                    recorder_worker,
+    let dialog_provider_for_updates = {
+        let mut dialog_provider = dialog_runtime::router_dialog_provider(
+            config,
+            Arc::clone(&router_handle),
+            Arc::clone(&router_breakers),
+            Arc::clone(&router_triggers),
+            Arc::clone(&router_pools),
+            Some(routing_event_reporter.clone()),
+            Arc::clone(&prompt_store),
+        );
+        // One shared check-event recorder serves both the REAL and the
+        // SAFE (virtual-dialog) WhiteCircle wraps.
+        let white_circle_recorder: Option<
+            Arc<dyn openplotva_llm::whitecircle::WhiteCircleCheckEventRecorder>,
+        > = if dialog_runtime::white_circle_effective_enabled(config) {
+            let (recorder, recorder_worker) =
+                runtime_safety::PostgresWhiteCircleCheckEventRecorder::spawn(
+                    service_clients.postgres.clone(),
+                    worker_stops.subscribe(RuntimeWorkerPhase::Ancillary),
                 );
-                Some(Arc::new(recorder))
-            } else {
-                None
-            };
-            if let Some(recorder) = white_circle_recorder.clone() {
-                dialog_provider =
-                    wrap_dialog_provider_with_white_circle(dialog_provider, config, recorder);
+            worker_registry.register(
+                "white-circle-event-recorder",
+                RuntimeWorkerPhase::Ancillary,
+                recorder_worker,
+            );
+            Some(Arc::new(recorder))
+        } else {
+            None
+        };
+        if let Some(recorder) = white_circle_recorder.clone() {
+            dialog_provider =
+                wrap_dialog_provider_with_white_circle(dialog_provider, config, recorder);
+        }
+        let dialog_provider: openplotva_llm::ChatProviderHandle = dialog_provider;
+        let dialog_provider_for_updates = Some(Arc::clone(&dialog_provider));
+        let dialog_effects =
+            dialog_jobs::DialogDispatcherEffects::new(Arc::clone(&dispatcher_queue))
+                .with_durability_barrier(Arc::new(shared_task_queue.clone()))
+                .with_durable_outbox(
+                    openplotva_storage::PostgresTelegramOutboxStore::new(
+                        service_clients.critical_postgres.clone(),
+                    ),
+                    bot_identity.id,
+                );
+        let dialog_terminal_signal = dialog_turn::DispatcherTerminalUserSignal::new(
+            telegram.clone(),
+            Arc::clone(&dispatcher_queue),
+        );
+        let mut dialog_materializer = dialog_jobs::PostgresDialogInputMaterializer::new(
+            chat_settings_store.clone(),
+            store.clone(),
+            history_store.clone(),
+            dialog_jobs::DialogBotIdentity::new(bot_identity.id, bot_identity.first_name.clone()),
+        );
+        if dialog_memory_context_enabled(config) {
+            dialog_materializer = dialog_materializer
+                .with_memory_store(memory_store.clone(), memory_card_usage.clone());
+            if let Some(embedder) = memory_query_embedder.clone() {
+                dialog_materializer =
+                    dialog_materializer.with_memory_embedder(embedder, config.memory.embedding_dim);
             }
-            // Trace rows are now emitted at the low-level model clients via the registered
-            // RuntimeLlmObserver; the dialog provider is used directly (no tracing wrap).
-            let dialog_provider: openplotva_llm::ChatProviderHandle = dialog_provider;
-            dialog_provider_for_updates = Some(Arc::clone(&dialog_provider));
-            let dialog_effects =
-                dialog_jobs::DialogDispatcherEffects::new(Arc::clone(&dispatcher_queue))
-                    .with_durability_barrier(Arc::new(shared_task_queue.clone()))
-                    .with_durable_outbox(
-                        openplotva_storage::PostgresTelegramOutboxStore::new(
-                            service_clients.critical_postgres.clone(),
-                        ),
-                        bot_identity.id,
-                    );
-            let dialog_terminal_signal = dialog_turn::DispatcherTerminalUserSignal::new(
-                telegram.clone(),
-                Arc::clone(&dispatcher_queue),
+        }
+        if config.shield.enabled {
+            dialog_materializer = dialog_materializer.with_shield_store(
+                PostgresShieldStore::new(service_clients.postgres.clone()),
+                shield_options_from_config(&config.shield),
+                shield_history_tail_messages_from_config(&config.shield),
             );
-            let mut dialog_materializer = dialog_jobs::PostgresDialogInputMaterializer::new(
-                chat_settings_store.clone(),
+            if let Some(embedder) = shield_query_embedder.clone() {
+                dialog_materializer = dialog_materializer.with_shield_embedder(embedder);
+            }
+        }
+        dialog_materializer =
+            dialog_materializer.with_asr_materializer(Arc::clone(&dialog_context_asr));
+        dialog_materializer = dialog_materializer.with_vision_materializer(dialog_context_vision);
+        let _ = media_failure_explainer.set(agent_tools::MediaFailureExplainer {
+            provider: Arc::clone(&dialog_provider),
+            materializer: dialog_materializer.clone(),
+            history: history_store.clone(),
+        });
+        let safe_dialog_toolbox: Arc<dyn openplotva_dialog::DialogToolbox> = Arc::new(
+            runtime_virtual_dialog::RuntimeVirtualSafeToolbox::new(Arc::clone(&dialog_toolbox)),
+        );
+        let console_safe_toolbox = Arc::clone(&safe_dialog_toolbox);
+        virtual_dialog_manager.set_executor(Arc::new(
+            runtime_virtual_dialog::RuntimeVirtualDialogExecutor::new(
+                virtual_dialog_store.clone(),
                 store.clone(),
                 history_store.clone(),
+                dialog_materializer.clone(),
+                Arc::clone(&dialog_provider),
+                console_safe_toolbox,
+                Arc::clone(&dialog_toolbox),
+                taskman_inspector.clone(),
+                llm_trace_buffer.clone(),
                 dialog_jobs::DialogBotIdentity::new(
                     bot_identity.id,
                     bot_identity.first_name.clone(),
                 ),
-            );
-            if dialog_memory_context_enabled(config) {
-                dialog_materializer = dialog_materializer
-                    .with_memory_store(memory_store.clone(), memory_card_usage.clone());
-                if let Some(embedder) = memory_query_embedder.clone() {
-                    dialog_materializer = dialog_materializer
-                        .with_memory_embedder(embedder, config.memory.embedding_dim);
-                }
-            }
-            if config.shield.enabled {
-                dialog_materializer = dialog_materializer.with_shield_store(
-                    PostgresShieldStore::new(service_clients.postgres.clone()),
-                    shield_options_from_config(&config.shield),
-                    shield_history_tail_messages_from_config(&config.shield),
-                );
-                if let Some(embedder) = shield_query_embedder.clone() {
-                    dialog_materializer = dialog_materializer.with_shield_embedder(embedder);
-                }
-            }
-            dialog_materializer =
-                dialog_materializer.with_asr_materializer(Arc::clone(&dialog_context_asr));
-            dialog_materializer =
-                dialog_materializer.with_vision_materializer(dialog_context_vision);
-            let _ = media_failure_explainer.set(agent_tools::MediaFailureExplainer {
-                provider: Arc::clone(&dialog_provider),
-                materializer: dialog_materializer.clone(),
-                history: history_store.clone(),
-            });
-            let safe_dialog_toolbox: Arc<dyn openplotva_dialog::DialogToolbox> = Arc::new(
-                runtime_virtual_dialog::RuntimeVirtualSafeToolbox::new(Arc::clone(&dialog_toolbox)),
-            );
-            let console_safe_toolbox = Arc::clone(&safe_dialog_toolbox);
-            virtual_dialog_manager.set_executor(Arc::new(
-                runtime_virtual_dialog::RuntimeVirtualDialogExecutor::new(
-                    virtual_dialog_store.clone(),
-                    store.clone(),
-                    history_store.clone(),
-                    dialog_materializer.clone(),
-                    Arc::clone(&dialog_provider),
-                    console_safe_toolbox,
-                    Arc::clone(&dialog_toolbox),
-                    taskman_inspector.clone(),
-                    llm_trace_buffer.clone(),
-                    dialog_jobs::DialogBotIdentity::new(
-                        bot_identity.id,
-                        bot_identity.first_name.clone(),
-                    ),
-                )
-                .with_run_buffer(llm_run_buffer.clone()),
-            ));
-            readiness_checks.push(ReadinessCheck::ok(
+            )
+            .with_run_buffer(llm_run_buffer.clone()),
+        ));
+        readiness_checks.push(ReadinessCheck::ok(
                 "runtime_virtual_dialogs",
                 "Runtime virtual dialogs wired to routed dialog provider, storage history, and SAFE/REAL tool modes",
             ));
-            let dialog_tool_history = history_store.clone();
-            let dialog_max_llm_job_attempts = config.persistent_queue.llm_job_max_attempts;
-            let dialog_turn_budget_secs = config.llm.dialog.turn_budget_secs;
-            let dialog_turn_max_queue_age_secs = config.llm.dialog.turn_max_queue_age_secs;
-            let dialog_turn_max_regenerations = config.llm.dialog.turn_max_regenerations;
-            let dialog_terminal_reaction_emoji = config.llm.dialog.terminal_reaction_emoji.clone();
-            let dialog_terminal_signal_max_age_secs =
-                config.llm.dialog.terminal_signal_max_age_secs;
-            // The dialog worker count follows the dialog primary's lanes; the
-            // lane queues in the walker are the real limit, so extra workers
-            // wait in the primary's queue during their model rounds and run
-            // their non-model phases meanwhile. The env knob is only the
-            // fallback when the primary has no lane pool.
-            let dialog_worker_fallback =
-                u32::try_from(config.persistent_queue.dialog_aifarm_workers.max(0)).unwrap_or(0);
-            let dialog_workers_cap =
-                u32::try_from(config.persistent_queue.dialog_workers_cap.max(1)).unwrap_or(1);
-            let (dialog_scale_tx, dialog_scale_rx) =
-                tokio::sync::watch::channel(dialog_worker_fallback);
-            let dialog_lanes = model_routing::LaneWorkerScale {
-                workflow_key: "dialog",
-                per_lane: u32::try_from(config.persistent_queue.dialog_workers_per_lane.max(1))
-                    .unwrap_or(1),
-                floor: 0,
-                cap: dialog_workers_cap,
-                scale: dialog_scale_tx,
-            };
-            let initial_dialog_workers = dialog_lanes
-                .desired(&router_handle.snapshot())
-                .unwrap_or(dialog_worker_fallback);
-            let _ = dialog_lanes.scale.send(initial_dialog_workers);
-            let dialog_worker_gauge = Arc::new(dialog_workers::WorkerGauge::new());
-
-            let dialog_worker_spawner = {
-                let queue = Arc::clone(&task_queue_for_updates);
-                let provider = Arc::clone(&dialog_provider);
-                let effects = dialog_effects.clone();
-                let materializer = dialog_materializer.clone();
-                let tool_history = dialog_tool_history.clone();
-                let routing_events = routing_event_reporter.clone();
-                let turn_outcomes = turn_outcome_observer.clone();
-                let terminal_signal = dialog_terminal_signal.clone();
-                let reaction_emoji = dialog_terminal_reaction_emoji.clone();
-                let obligations = Arc::clone(&delivery_obligation_store);
-                let session_wiring = dialog_session_wiring.clone();
-                let llm_runs = llm_run_buffer.clone();
-                let activity_pulse = Arc::clone(&telegram_activity_pulse);
-                let stop_rx = worker_stops.subscribe(RuntimeWorkerPhase::Processor);
-                move |index: usize, retire: tokio::sync::oneshot::Receiver<()>| {
-                    let worker_queue = Arc::clone(&queue);
-                    let worker_provider = Arc::clone(&provider);
-                    let worker_effects = effects.clone();
-                    let worker_materializer = materializer.clone();
-                    let worker_tool_history = tool_history.clone();
-                    let worker_routing_events = routing_events.clone();
-                    let worker_turn_outcomes = turn_outcomes.clone();
-                    let worker_terminal_signal = terminal_signal.clone();
-                    let worker_reaction_emoji = reaction_emoji.clone();
-                    let worker_obligations = Arc::clone(&obligations);
-                    let worker_session = session_wiring.clone();
-                    let worker_llm_runs = llm_runs.clone();
-                    let worker_activity_pulse = Arc::clone(&activity_pulse);
-                    let worker_stop = stop_rx.clone();
-                    tokio::spawn(async move {
-                        // A retired worker finishes its current job and exits
-                        // at the next loop tick, exactly like a runtime stop.
-                        let stop_future = async move {
-                            tokio::select! {
-                                () = wait_for_runtime_stop(worker_stop) => {}
-                                _ = retire => {}
-                            }
-                        };
-                        let report =
+        let dialog_tool_history = history_store.clone();
+        let dialog_max_llm_job_attempts = config.persistent_queue.llm_job_max_attempts;
+        let dialog_turn_budget_secs = config.llm.dialog.turn_budget_secs;
+        let dialog_turn_max_queue_age_secs = config.llm.dialog.turn_max_queue_age_secs;
+        let dialog_turn_max_regenerations = config.llm.dialog.turn_max_regenerations;
+        let dialog_terminal_reaction_emoji = config.llm.dialog.terminal_reaction_emoji.clone();
+        let dialog_terminal_signal_max_age_secs = config.llm.dialog.terminal_signal_max_age_secs;
+        // The dialog worker count follows the dialog primary's lanes; the
+        // lane queues in the walker are the real limit, so extra workers
+        // wait in the primary's queue during their model rounds and run
+        // their non-model phases meanwhile. The env knob is only the
+        // fallback when the primary has no lane pool.
+        let dialog_worker_fallback =
+            u32::try_from(config.persistent_queue.dialog_aifarm_workers.max(0)).unwrap_or(0);
+        let dialog_workers_cap =
+            u32::try_from(config.persistent_queue.dialog_workers_cap.max(1)).unwrap_or(1);
+        let (dialog_scale_tx, dialog_scale_rx) =
+            tokio::sync::watch::channel(dialog_worker_fallback);
+        let dialog_lanes = model_routing::LaneWorkerScale {
+            workflow_key: "dialog",
+            per_lane: u32::try_from(config.persistent_queue.dialog_workers_per_lane.max(1))
+                .unwrap_or(1),
+            floor: 0,
+            cap: dialog_workers_cap,
+            scale: dialog_scale_tx,
+        };
+        let initial_dialog_workers = dialog_lanes
+            .desired(&router_handle.snapshot())
+            .unwrap_or(dialog_worker_fallback);
+        let _ = dialog_lanes.scale.send(initial_dialog_workers);
+        let dialog_worker_gauge = Arc::new(dialog_workers::WorkerGauge::new());
+
+        let dialog_worker_spawner = {
+            let queue = Arc::clone(&task_queue_for_updates);
+            let provider = Arc::clone(&dialog_provider);
+            let effects = dialog_effects.clone();
+            let materializer = dialog_materializer.clone();
+            let tool_history = dialog_tool_history.clone();
+            let routing_events = routing_event_reporter.clone();
+            let turn_outcomes = turn_outcome_observer.clone();
+            let terminal_signal = dialog_terminal_signal.clone();
+            let reaction_emoji = dialog_terminal_reaction_emoji.clone();
+            let obligations = Arc::clone(&delivery_obligation_store);
+            let session_wiring = dialog_session_wiring.clone();
+            let llm_runs = llm_run_buffer.clone();
+            let activity_pulse = Arc::clone(&telegram_activity_pulse);
+            let stop_rx = worker_stops.subscribe(RuntimeWorkerPhase::Processor);
+            move |index: usize, retire: tokio::sync::oneshot::Receiver<()>| {
+                let worker_queue = Arc::clone(&queue);
+                let worker_provider = Arc::clone(&provider);
+                let worker_effects = effects.clone();
+                let worker_materializer = materializer.clone();
+                let worker_tool_history = tool_history.clone();
+                let worker_routing_events = routing_events.clone();
+                let worker_turn_outcomes = turn_outcomes.clone();
+                let worker_terminal_signal = terminal_signal.clone();
+                let worker_reaction_emoji = reaction_emoji.clone();
+                let worker_obligations = Arc::clone(&obligations);
+                let worker_session = session_wiring.clone();
+                let worker_llm_runs = llm_runs.clone();
+                let worker_activity_pulse = Arc::clone(&activity_pulse);
+                let worker_stop = stop_rx.clone();
+                tokio::spawn(async move {
+                    // A retired worker finishes its current job and exits
+                    // at the next loop tick, exactly like a runtime stop.
+                    let stop_future = async move {
+                        tokio::select! {
+                            () = wait_for_runtime_stop(worker_stop) => {}
+                            _ = retire => {}
+                        }
+                    };
+                    let report =
                             dialog_jobs::run_dialog_job_worker_with_materializer_and_history_every_until(
                                 worker_queue.as_ref(),
                                 worker_provider.as_ref(),
@@ -13273,75 +4351,57 @@ async fn start_runtime_workers(
                             )
                             .await;
 
-                        tracing::info!(?report, index, "dialog taskman worker stopped");
-                    })
-                }
-            };
-            let dialog_supervisor = dialog_workers::spawn_worker_supervisor(
-                Arc::new(dialog_worker_spawner),
-                dialog_scale_rx,
-                Arc::clone(&dialog_worker_gauge),
-                worker_stops.subscribe(RuntimeWorkerPhase::Processor),
-            );
-            worker_registry.register(
-                "dialog-worker-supervisor",
-                RuntimeWorkerPhase::Processor,
-                dialog_supervisor,
-            );
-            workers.dialog_worker_gauge = Some(Arc::clone(&dialog_worker_gauge));
-            workers.router_runtime = Some(Arc::new(model_routing::RouterRuntime {
-                handle: Arc::clone(&router_handle),
-                pools: Arc::clone(&router_pools),
-                dialog_workers: Some(dialog_lanes),
-                memory_workers: memory_worker_scale.take(),
-                lane_check: Some(lane_check.clone()),
-            }));
-            tracing::info!(
-                initial_dialog_workers,
-                cap = dialog_workers_cap,
-                fallback = dialog_worker_fallback,
-                "dialog worker scale derived from lane pools"
-            );
-            readiness_checks.push(ReadinessCheck::ok(
+                    tracing::info!(?report, index, "dialog taskman worker stopped");
+                })
+            }
+        };
+        let dialog_supervisor = dialog_workers::spawn_worker_supervisor(
+            Arc::new(dialog_worker_spawner),
+            dialog_scale_rx,
+            Arc::clone(&dialog_worker_gauge),
+            worker_stops.subscribe(RuntimeWorkerPhase::Processor),
+        );
+        worker_registry.register(
+            "dialog-worker-supervisor",
+            RuntimeWorkerPhase::Processor,
+            dialog_supervisor,
+        );
+        workers.dialog_worker_gauge = Some(Arc::clone(&dialog_worker_gauge));
+        workers.router_runtime = Some(Arc::new(model_routing::RouterRuntime {
+            handle: Arc::clone(&router_handle),
+            pools: Arc::clone(&router_pools),
+            dialog_workers: Some(dialog_lanes),
+            memory_workers: memory_worker_scale.take(),
+            lane_check: Some(lane_check.clone()),
+        }));
+        tracing::info!(
+            initial_dialog_workers,
+            cap = dialog_workers_cap,
+            fallback = dialog_worker_fallback,
+            "dialog worker scale derived from lane pools"
+        );
+        readiness_checks.push(ReadinessCheck::ok(
                 "dialog_jobs",
                 format!(
                     "Started dialog worker supervisor with {initial_dialog_workers} lane-derived workers (cap {dialog_workers_cap})"
                 ),
             ));
-            if initial_dialog_workers > 0 {
-                shared_taskman_worker_counts.insert(
-                    openplotva_taskman::TEXT_QUEUE_NAME.to_owned(),
-                    initial_dialog_workers as i32,
-                );
-                shared_taskman_worker_counts.insert(
-                    openplotva_taskman::DIALOG_AIFARM_QUEUE_NAME.to_owned(),
-                    initial_dialog_workers as i32,
-                );
-            }
-        }
-        Err(error) => {
-            tracing::warn!(%error, "dialog provider unavailable for dialog taskman worker");
-            readiness_checks.push(ReadinessCheck::skipped(
-                "dialog_jobs",
-                format!("dialog provider unavailable: {error}"),
-            ));
-            readiness_checks.push(ReadinessCheck::skipped(
-                "runtime_virtual_dialogs",
-                format!("dialog provider unavailable: {error}"),
-            ));
+        if initial_dialog_workers > 0 {
+            shared_taskman_worker_counts.insert(
+                openplotva_taskman::TEXT_QUEUE_NAME.to_owned(),
+                initial_dialog_workers as i32,
+            );
+            shared_taskman_worker_counts.insert(
+                openplotva_taskman::DIALOG_AIFARM_QUEUE_NAME.to_owned(),
+                initial_dialog_workers as i32,
+            );
         }
-    }
+        dialog_provider_for_updates
+    };
 
     let media_prompt_optimizer = media::MediaPromptOptimizerService::new(Some(Arc::new(
         media::RoutedMediaPromptOptimizer::new(
-            routed_attempts::RoutedAttemptWalker::new(
-                Arc::clone(&router_handle),
-                Arc::clone(&router_breakers),
-                Arc::clone(&router_triggers),
-                Arc::clone(&router_pools),
-            )
-            .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-            .with_reporter(routing_event_reporter.clone()),
+            attempt_walker.clone(),
             config,
             Arc::clone(&prompt_store),
         ),
@@ -13360,14 +4420,7 @@ async fn start_runtime_workers(
         )),
     ));
     let vip_image_queue = Arc::clone(&task_queue_for_updates);
-    let image_attempt_walker = routed_attempts::RoutedAttemptWalker::new(
-        Arc::clone(&router_handle),
-        Arc::clone(&router_breakers),
-        Arc::clone(&router_triggers),
-        Arc::clone(&router_pools),
-    )
-    .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-    .with_reporter(routing_event_reporter.clone());
+    let image_attempt_walker = attempt_walker.clone();
     let vip_slot = |workflow_key: &str| {
         image_jobs::RoutedImageGenerator::new(
             image_attempt_walker.clone(),
@@ -13541,14 +4594,7 @@ async fn start_runtime_workers(
         let music_queue = Arc::clone(&task_queue_for_updates);
         let music_song_prompt_generator: Arc<dyn music_jobs::SongPromptGenerator + Send + Sync> =
             Arc::new(music_jobs::RoutedSongPromptGenerator::new(
-                routed_attempts::RoutedAttemptWalker::new(
-                    Arc::clone(&router_handle),
-                    Arc::clone(&router_breakers),
-                    Arc::clone(&router_triggers),
-                    Arc::clone(&router_pools),
-                )
-                .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-                .with_reporter(routing_event_reporter.clone()),
+                attempt_walker.clone(),
                 config,
                 Arc::clone(&prompt_store),
             ));
@@ -13558,14 +4604,7 @@ async fn start_runtime_workers(
             PostgresVirtualMessageStore::new(service_clients.postgres.clone()),
         )
         .with_context_provider(song_context);
-        let music_attempt_walker = routed_attempts::RoutedAttemptWalker::new(
-            Arc::clone(&router_handle),
-            Arc::clone(&router_breakers),
-            Arc::clone(&router_triggers),
-            Arc::clone(&router_pools),
-        )
-        .with_openrouter_free_gate(Arc::clone(&openrouter_free_gate))
-        .with_reporter(routing_event_reporter.clone());
+        let music_attempt_walker = attempt_walker.clone();
         let music_generator = music_jobs::RoutedMusicGenerator::new(
             music_attempt_walker,
             music_jobs::acestep_config_from_app_config(config),
@@ -13574,11 +4613,10 @@ async fn start_runtime_workers(
             Arc::clone(&permission_policy),
             PostgresTelegramFileStore::new(service_clients.postgres.clone()),
             telegram.clone(),
-            Arc::clone(&rich_sender),
-        )
-        .with_song_store(Arc::new(PostgresGeneratedSongStore::new(
-            service_clients.postgres.clone(),
-        )));
+            media_uploader.clone(),
+            Arc::clone(&rich_outbox),
+            PostgresGeneratedSongStore::new(service_clients.critical_postgres.clone()),
+        );
         {
             let reactions = &generation_reactions;
             music_effects = music_effects.with_reaction_ux(Arc::clone(reactions));
@@ -13872,7 +4910,7 @@ async fn start_runtime_workers(
             dialog_messages::TaskmanDialogMessageScheduler::new(
                 Arc::clone(&task_queue_for_updates),
                 Arc::clone(&dialog_debounce),
-                dialog_debounce::GO_DIALOG_DEBOUNCE_INTERVAL,
+                dialog_debounce::DIALOG_DEBOUNCE_INTERVAL,
                 Arc::new(shared_task_queue.clone()),
             )
             .with_typing_effects(Arc::new(
@@ -13984,7 +5022,7 @@ async fn start_runtime_workers(
                 )),
                 reset_handler,
             ));
-        let mut rates_effects = rates::RatesUtilityEffects::new(Arc::clone(&rich_sender));
+        let mut rates_effects = rates::RatesDelivery::new(Arc::clone(&rich_outbox));
         if config.gradius.utility_rates_enabled
             && let Some((ads, outbox)) = &gradius_utility
         {
@@ -14004,9 +5042,9 @@ async fn start_runtime_workers(
             Arc::clone(&control_queue_for_updates),
             checkin_game_store_for_updates,
             Arc::clone(&permission_policy),
-            Arc::new(checkin::CheckinCommandDispatcherEffects::new(
+            Arc::new(checkin::CheckinCommandDelivery::new(
                 Arc::clone(&dispatcher_queue_for_updates),
-                Arc::clone(&rich_sender),
+                Arc::clone(&rich_outbox),
             )),
             bot_identity.username.clone(),
             rates_command,
@@ -14172,7 +5210,7 @@ async fn start_runtime_workers(
             Arc::new(help::HelpDispatcherEffects::new(
                 telegram.clone(),
                 Arc::clone(&payment_handler),
-                Arc::clone(&rich_sender),
+                Arc::clone(&rich_outbox),
             )),
             diagnostics_handler,
         ));
@@ -14295,6 +5333,7 @@ async fn shutdown_runtime_workers(workers: RuntimeWorkers) {
         routing_event_buffer: _,
         routing_event_reporter: _,
         runtime_api_tls_public_key_pin: _,
+        attempt_walker: _,
         router_handle: _,
         router_breakers: _,
         router_triggers: _,
@@ -14529,381 +5568,9 @@ async fn wait_for_runtime_stop(mut stop: watch::Receiver<bool>) {
         if *stop.borrow() {
             return;
         }
-        if stop.changed().await.is_err() {
-            return;
-        }
-    }
-}
-
-#[allow(clippy::too_many_arguments)]
-async fn send_dispatcher_work_item(
-    history: PostgresHistoryStore,
-    telegram: openplotva_telegram::TelegramClient,
-    rich: openplotva_telegram::RichApiClient,
-    ephemeral: RedisEphemeralMessageStore,
-    rate_limits: Arc<rate_limits::ChatRateLimitPolicy<RedisRateLimitStore>>,
-    permissions: Arc<permissions::ChatPermissionPolicy<PostgresChatSettingsStore>>,
-    failure_ring: Option<Arc<DispatchFailureRing>>,
-    routing_admin_reports: Option<openplotva_storage::llm_routing::PostgresRoutingAdminReportStore>,
-    item: openplotva_telegram::DispatcherWorkItem,
-) -> openplotva_telegram::DispatcherSendStatus {
-    send_dispatcher_work_item_with_transport_and_history(
-        history,
-        ephemeral,
-        rate_limits,
-        permissions,
-        failure_ring,
-        routing_admin_reports,
-        item,
-        |method| {
-            let telegram = telegram.clone();
-            let rich = rich.clone();
-            async move {
-                openplotva_telegram::execute_telegram_method_with_rich(&telegram, &rich, method)
-                    .await
-            }
-        },
-    )
-    .await
-}
-
-#[cfg(test)]
-async fn send_dispatcher_work_item_with_transport<R, P, SendFn, SendFuture>(
-    rate_limits: Arc<rate_limits::ChatRateLimitPolicy<R>>,
-    permissions: Arc<permissions::ChatPermissionPolicy<P>>,
-    item: openplotva_telegram::DispatcherWorkItem,
-    send: SendFn,
-) -> openplotva_telegram::DispatcherSendStatus
-where
-    R: rate_limits::RateLimitStore + Send + Sync,
-    P: permissions::ChatPermissionStore + Send + Sync,
-    SendFn: Fn(openplotva_telegram::TelegramOutboundMethod) -> SendFuture,
-    SendFuture: Future<
-        Output = Result<
-            openplotva_telegram::TelegramOutboundResponse,
-            openplotva_telegram::TelegramOutboundExecuteError,
-        >,
-    >,
-{
-    send_dispatcher_work_item_with_transport_and_history(
-        virtual_messages::NoopEditHistorySink,
-        virtual_messages::NoopEphemeralMessageTracker,
-        rate_limits,
-        permissions,
-        None,
-        None,
-        item,
-        send,
-    )
-    .await
-}
-
-#[allow(clippy::too_many_arguments)]
-async fn send_dispatcher_work_item_with_transport_and_history<H, E, R, P, SendFn, SendFuture>(
-    history: H,
-    ephemeral: E,
-    rate_limits: Arc<rate_limits::ChatRateLimitPolicy<R>>,
-    permissions: Arc<permissions::ChatPermissionPolicy<P>>,
-    failure_ring: Option<Arc<DispatchFailureRing>>,
-    routing_admin_reports: Option<openplotva_storage::llm_routing::PostgresRoutingAdminReportStore>,
-    item: openplotva_telegram::DispatcherWorkItem,
-    send: SendFn,
-) -> openplotva_telegram::DispatcherSendStatus
-where
-    H: virtual_messages::EditHistorySink,
-    E: virtual_messages::EphemeralMessageTracker + Sync,
-    R: rate_limits::RateLimitStore + Send + Sync,
-    P: permissions::ChatPermissionStore + Send + Sync,
-    SendFn: Fn(openplotva_telegram::TelegramOutboundMethod) -> SendFuture,
-    SendFuture: Future<
-        Output = Result<
-            openplotva_telegram::TelegramOutboundResponse,
-            openplotva_telegram::TelegramOutboundExecuteError,
-        >,
-    >,
-{
-    let chat_id = item.metadata().chat_id;
-    let bypass_chat_restrictions = item.bypasses_chat_restrictions();
-    let virtual_id = item.metadata().virtual_id.clone();
-    let protected = item.metadata().protected;
-    if virtual_id.starts_with(openplotva_storage::maintenance_notifications::NOTIFICATION_PREFIX) {
-        let Some(store) = routing_admin_reports.as_ref() else {
-            return openplotva_telegram::DispatcherSendStatus::Failed;
-        };
-        match maintenance_api::begin_notification(store.pool(), &virtual_id).await {
-            Ok(true) => {}
-            Ok(false) => return openplotva_telegram::DispatcherSendStatus::Sent,
-            Err(error) => {
-                tracing::warn!(%error, "failed to claim maintenance notification send");
-                return openplotva_telegram::DispatcherSendStatus::Failed;
-            }
-        }
-    }
-    let reply_to_message_id =
-        reply_message_id_from_fingerprint_key(&item.metadata().fingerprint_key);
-    let method_kind_label = item
-        .method_kind()
-        .map(|kind| format!("{kind:?}"))
-        .unwrap_or_else(|| "none".to_owned());
-    let record_failure = |error: String, class: &'static str| {
-        if let Some(ring) = failure_ring.as_deref() {
-            ring.record(DispatchFailureRecord {
-                at: OffsetDateTime::now_utc(),
-                virtual_id: virtual_id.clone(),
-                chat_id,
-                method_kind: method_kind_label.clone(),
-                error,
-                class,
-                protected,
-                reply_to_message_id,
-            });
-        }
-    };
-    if chat_id != 0 {
-        let check = rate_limits
-            .is_rate_limited_at(chat_id, OffsetDateTime::now_utc())
-            .await;
-        if let Some(load_error) = check.load_error.as_deref() {
-            tracing::debug!(
-                chat_id,
-                %load_error,
-                "failed to load persisted Telegram rate-limit state"
-            );
-        }
-        if check.rate_limited {
-            tracing::debug!(chat_id, "skipping Telegram send for rate-limited chat");
-            record_failure(
-                "skipped send for rate-limited chat".to_owned(),
-                DISPATCH_FAILURE_CLASS_CHAT_RATE_LIMITED,
-            );
-            if let Some(store) = routing_admin_reports.as_ref()
-                && let Err(error) = maintenance_api::finish_notification(
-                    store.pool(),
-                    &virtual_id,
-                    None,
-                    true,
-                    false,
-                )
-                .await
-            {
-                tracing::warn!(%error, "failed to defer rate-limited maintenance notification");
-            }
-            if let Some(store) = routing_admin_reports.as_ref()
-                && let Err(error) = routing_admin_reports::record_routing_admin_dispatch_failure(
-                    store,
-                    &virtual_id,
-                    DISPATCH_FAILURE_CLASS_CHAT_RATE_LIMITED,
-                    OffsetDateTime::now_utc(),
-                )
-                .await
-            {
-                tracing::warn!(%error, %virtual_id, "failed to record rate-limited LLM admin report");
-            }
-            return openplotva_telegram::DispatcherSendStatus::Failed;
-        }
-    }
-    if chat_id != 0
-        && !bypass_chat_restrictions
-        && let Some(method_kind) = item.method_kind()
-    {
-        for action in permissions::dispatcher_required_actions(method_kind) {
-            let report = permissions
-                .can_perform_action_at(chat_id, None, action, OffsetDateTime::now_utc())
-                .await;
-            if let Some(load_error) = report.load_error.as_deref() {
-                tracing::debug!(
-                    chat_id,
-                    action,
-                    %load_error,
-                    "failed to load Telegram permission state"
-                );
-            }
-            if !report.allowed {
-                tracing::debug!(
-                    chat_id,
-                    action,
-                    "skipping Telegram send for chat permission settings"
-                );
-                record_failure(
-                    format!("skipped send: chat permission settings deny {action}"),
-                    openplotva_telegram::OutboundSendErrorClass::TerminalPermission.as_str(),
-                );
-                if let Some(store) = routing_admin_reports.as_ref()
-                    && let Err(error) = maintenance_api::finish_notification(
-                        store.pool(),
-                        &virtual_id,
-                        None,
-                        true,
-                        true,
-                    )
-                    .await
-                {
-                    tracing::warn!(%error, "failed to defer denied maintenance notification");
-                }
-                if let Some(store) = routing_admin_reports.as_ref()
-                    && let Err(error) =
-                        routing_admin_reports::record_routing_admin_dispatch_failure(
-                            store,
-                            &virtual_id,
-                            openplotva_telegram::OutboundSendErrorClass::TerminalPermission
-                                .as_str(),
-                            OffsetDateTime::now_utc(),
-                        )
-                        .await
-                {
-                    tracing::warn!(%error, %virtual_id, "failed to record denied LLM admin report");
-                }
-                return openplotva_telegram::DispatcherSendStatus::Failed;
-            }
-        }
-    }
-
-    let retry_virtual_id = virtual_id.clone();
-    let report = virtual_messages::send_work_item_with_history_and_ephemeral(
-        &history,
-        &ephemeral,
-        item,
-        OffsetDateTime::now_utc(),
-        |method| {
-            let rate_limits = Arc::clone(&rate_limits);
-            let permissions = Arc::clone(&permissions);
-            async move {
-                let method_kind = method.kind();
-                let reply_missing_fallback =
-                    openplotva_telegram::replay_outbound_method_without_reply(&method);
-                match openplotva_telegram::send_outbound_method_with_bounded_retry(
-                    &send,
-                    method,
-                    &retry_virtual_id,
-                    chat_id,
-                )
-                .await
-                {
-                    Ok(response) => Ok(response),
-                    Err(mut error) => {
-                        if matches!(
-                            method_kind,
-                            openplotva_telegram::TelegramOutboundMethodKind::SendMessage
-                                | openplotva_telegram::TelegramOutboundMethodKind::SendRichMessage
-                        ) && error.is_reply_missing()
-                        {
-                            tracing::warn!(
-                                chat_id,
-                                "reply target missing; retrying Telegram send without reply parameters"
-                            );
-                            if let Some(fallback) = reply_missing_fallback {
-                                match openplotva_telegram::send_outbound_method_with_bounded_retry(
-                                    &send,
-                                    fallback,
-                                    &retry_virtual_id,
-                                    chat_id,
-                                )
-                                .await
-                                {
-                                    Ok(response) => return Ok(response),
-                                    Err(fallback_error) => error = fallback_error,
-                                }
-                            }
-                        }
-                        if let Some(retry_after) =
-                            rate_limits::telegram_retry_after_from_outbound_error(&error)
-                        {
-                            let report = rate_limits
-                                .set_rate_limit_at(chat_id, retry_after, OffsetDateTime::now_utc())
-                                .await;
-                            if let Some(save_error) = report.save_error.as_deref() {
-                                tracing::warn!(
-                                    chat_id,
-                                    retry_after_seconds = retry_after.as_secs(),
-                                    %save_error,
-                                    "failed to persist Telegram rate-limit state"
-                                );
-                            }
-                        }
-                        if chat_id != 0
-                            && error.is_permission_error()
-                        {
-                            let report = permissions
-                                .record_send_permission_error(chat_id, method_kind)
-                                .await;
-                            if let Some(load_error) = report.load_error.as_deref() {
-                                tracing::warn!(
-                                    chat_id,
-                                    method = ?method_kind,
-                                    %load_error,
-                                    "failed to load chat permission state after Telegram permission error"
-                                );
-                            }
-                            if let Some(save_error) = report.save_error.as_deref() {
-                                tracing::warn!(
-                                    chat_id,
-                                    method = ?method_kind,
-                                    %save_error,
-                                    "failed to persist chat permission state after Telegram permission error"
-                                );
-                            }
-                        }
-                        Err(error)
-                    }
-                }
-            }
-        },
-    )
-    .await;
-    if report.ephemeral_track_error.is_some() {
-        tracing::warn!(
-            virtual_id = report.virtual_id,
-            real_message_id = ?report.sent_message_id,
-            ephemeral_track_error = ?report.ephemeral_track_error,
-            "failed to track outbound ephemeral message"
-        );
-    }
-    if let Some(store) = routing_admin_reports.as_ref()
-        && let Err(error) = maintenance_api::record_dispatch(store.pool(), &report).await
-    {
-        tracing::warn!(%error, "failed to record maintenance notification delivery receipt");
-    }
-    if matches!(
-        report.status,
-        openplotva_telegram::DispatcherSendStatus::Failed
-    ) {
-        let error_class = report
-            .error_class
-            .unwrap_or(DISPATCH_FAILURE_CLASS_MISSING_METHOD);
-        let send_error = report.send_error.clone().unwrap_or_default();
-        tracing::warn!(
-            virtual_id = report.virtual_id,
-            chat_id,
-            error_class,
-            send_error,
-            method_kind = method_kind_label,
-            "outbound dispatcher send failed"
-        );
-        record_failure(send_error, error_class);
-    }
-    if let Some(store) = routing_admin_reports.as_ref()
-        && let Err(error) = routing_admin_reports::record_routing_admin_dispatch_result(
-            store,
-            &report,
-            OffsetDateTime::now_utc(),
-        )
-        .await
-    {
-        tracing::warn!(%error, virtual_id = report.virtual_id, "failed to record LLM admin report delivery");
-    }
-    report.status
-}
-
-fn go_dispatcher_config() -> openplotva_telegram::DispatcherConfig {
-    openplotva_telegram::DispatcherConfig {
-        max_queue_size: GO_DISPATCHER_MAX_QUEUE_SIZE,
-        dedupe_config: openplotva_telegram::DebouncerConfig {
-            enabled: true,
-            default_window: GO_DISPATCHER_DEBOUNCE_WINDOW,
-            max_cache_size: GO_DISPATCHER_DEBOUNCE_CACHE_SIZE,
-            per_chat_settings: Default::default(),
-        },
-        ..openplotva_telegram::DispatcherConfig::default()
+        if stop.changed().await.is_err() {
+            return;
+        }
     }
 }
 
@@ -14996,6 +5663,24 @@ async fn shutdown_signal() {
 mod test_bot_api;
 #[cfg(test)]
 mod tests {
+    use crate::http::assets::{found, static_web_asset_response};
+    use crate::http::auth::{
+        admin_auth_check, admin_auth_date_is_fresh, admin_auth_response, admin_auth_user_state,
+        admin_bootstrap, admin_session_is_authorized, admin_static_asset_requires_auth,
+    };
+
+    use crate::http::common::parse_memory_limit;
+    use crate::http::settings::{
+        apply_private_chat_response_defaults, authenticate_settings_init_data,
+        build_deputy_display_name, chat_list_title, chat_member_can_manage_settings,
+        chat_member_record_from_upsert, current_unix_timestamp, new_settings_response,
+        normalize_deputy_ids, parse_deputy_candidates_limit, parse_deputy_update_request,
+        parse_optional_i32, parse_settings_get_access, parse_settings_memory_access,
+        parse_settings_update_request, settings_chat_display, settings_chat_full_info_type_name,
+        settings_chat_state_from_full_info, settings_get_response, settings_reply_flags,
+        stored_chat_member_is_fresh,
+    };
+
     use std::{
         collections::BTreeMap,
         error::Error,
@@ -15302,9 +5987,8 @@ mod tests {
         .execute(&pool)
         .await?;
 
-        sqlx::query(super::SQL_ADMIN_SAFE_DELETE_USER)
-            .bind(user_id)
-            .execute(&pool)
+        openplotva_storage::entities::PostgresEntityStore::new(pool.clone())
+            .delete_user(user_id)
             .await?;
 
         let remaining: (i64, i64, i64) = sqlx::query_as(
@@ -15350,7 +6034,7 @@ mod tests {
     mod routing_admin_inputs {
         use serde_json::json;
 
-        use crate::{
+        use crate::http::routing::{
             model_input_from_json, pool_input_from_json, provider_input_from_json,
             routing_param_descriptors,
         };
@@ -15449,15 +6133,24 @@ mod tests {
         }
     }
 
+    use crate::http::common::{
+        admin_i64_from_json, admin_non_empty_string, parse_admin_non_negative_i32,
+        parse_admin_optional_bool, parse_admin_positive_i32,
+        query_values as admin_auth_query_values,
+    };
+    use crate::http::routing::routing_json_config_patch;
+    use crate::runtime_redis::{
+        runtime_redis_prefix_groups_from_keys, runtime_redis_value_from_bytes,
+    };
     use axum::{
         body::{Bytes, to_bytes},
-        extract::Extension,
         http::{HeaderMap, Method, StatusCode, header},
     };
     use carapax::types::{
         InputFile, ReplyParameters, SendMessage, SendPhoto, Update as TelegramUpdate,
     };
     use openplotva_core::{ChatSettings, ChatSettingsUpdate};
+    use openplotva_storage::redis_inspector::prefix_groups_from_keys as admin_redis_prefix_groups_from_keys;
     use openplotva_telegram::{
         DispatcherConfig, DispatcherMessage, DispatcherQueue, DispatcherSendStatus,
         DispatcherWorkItem, MessageFingerprint, TelegramMessage, TelegramOutboundExecuteError,
@@ -15467,40 +6160,44 @@ mod tests {
     use time::{OffsetDateTime, format_description::well_known::Rfc3339};
 
     use super::{
-        AdminMemoryOverride, DispatchFailureRing, GO_ADMIN_API_ROUTE_PATTERNS,
-        GO_DISPATCHER_DEBOUNCE_CACHE_SIZE, GO_DISPATCHER_DEBOUNCE_WINDOW,
-        GO_DISPATCHER_MAX_QUEUE_SIZE, RuntimeUnhandledUpdateHandler, WebhookShutdownCleanupReport,
-        admin_auth_check, admin_auth_date_is_fresh, admin_auth_query_values, admin_auth_response,
-        admin_auth_user_state, admin_bootstrap, admin_chat_get_response,
-        admin_chats_search_by_member_response, admin_gradius_opportunities_filter,
-        admin_i64_from_json, admin_llm_analytics_summary_json, admin_loglevel_response,
-        admin_memory_cards_response, admin_memory_resolve_override, admin_memory_restart_override,
-        admin_memory_restart_response, admin_memory_runs_response, admin_non_empty_string,
-        admin_redis_prefix_groups_from_keys, admin_safety_check_json, admin_safety_checks_filter,
-        admin_session_is_authorized, admin_shield_category_matched, admin_shield_document_input,
-        admin_shield_document_json, admin_shield_documents_response,
-        admin_shield_embeddings_rebuild_response, admin_shield_test_json,
-        admin_shield_test_response, admin_state, admin_state_response,
-        admin_static_asset_requires_auth, admin_taskman_job_cancel_response,
-        admin_taskman_job_response, admin_taskman_job_restart_response,
-        admin_taskman_jobs_clear_response, admin_taskman_jobs_filter, admin_taskman_jobs_response,
+        ADMIN_API_ROUTE_PATTERNS, DispatchFailureRing, RuntimeUnhandledUpdateHandler,
+        WebhookShutdownCleanupReport, configure_telegram_bot_commands,
+        delete_webhook_on_shutdown_if_enabled, dialog_memory_context_enabled,
+        runtime_api_graphql_snapshot, shield_history_tail_messages_from_config,
+        shield_options_from_config, static_web_routes, telegram_webhook_response, virtual_messages,
+    };
+    use crate::runtime_dispatcher::{
+        DISPATCHER_DEBOUNCE_CACHE_SIZE, DISPATCHER_DEBOUNCE_WINDOW, DISPATCHER_MAX_QUEUE_SIZE,
+        dispatcher_config, send_dispatcher_work_item_with_transport,
+        send_dispatcher_work_item_with_transport_and_history,
+    };
+
+    use crate::http::observability::{
+        admin_gradius_opportunities_filter, admin_llm_analytics_summary_json,
+        admin_loglevel_response, admin_safety_check_json, admin_safety_checks_filter, admin_state,
+        admin_state_response,
+    };
+
+    use crate::http::taskman::{
+        admin_taskman_job_cancel_response, admin_taskman_job_response,
+        admin_taskman_job_restart_response, admin_taskman_jobs_clear_response,
+        admin_taskman_jobs_filter, admin_taskman_jobs_response,
+    };
+
+    use crate::http::shield::{
+        admin_shield_category_matched, admin_shield_document_input, admin_shield_document_json,
+        admin_shield_documents_response, admin_shield_embeddings_rebuild_response,
+        admin_shield_test_json, admin_shield_test_response, parse_shield_limit,
+    };
+
+    use crate::http::memory::{
+        AdminMemoryOverride, admin_memory_cards_response, admin_memory_resolve_override,
+        admin_memory_restart_override, admin_memory_restart_response, admin_memory_runs_response,
+    };
+
+    use crate::http::entities::{
+        admin_chat_get_response, admin_chats_search_by_member_response,
         admin_user_grant_vip_response, admin_vip_summary_json,
-        apply_private_chat_response_defaults, authenticate_settings_init_data,
-        build_deputy_display_name, chat_list_title, chat_member_can_manage_settings,
-        chat_member_record_from_upsert, configure_telegram_bot_commands, current_unix_timestamp,
-        delete_webhook_on_shutdown_if_enabled, dialog_memory_context_enabled, found,
-        go_dispatcher_config, new_settings_response, normalize_deputy_ids,
-        parse_admin_non_negative_i32, parse_admin_optional_bool, parse_admin_positive_i32,
-        parse_deputy_candidates_limit, parse_deputy_update_request, parse_memory_limit,
-        parse_optional_i32, parse_settings_get_access, parse_settings_memory_access,
-        parse_settings_update_request, parse_shield_limit, routing_json_config_patch,
-        runtime_api_graphql_snapshot, runtime_redis_prefix_groups_from_keys,
-        runtime_redis_value_from_bytes, send_dispatcher_work_item_with_transport,
-        send_dispatcher_work_item_with_transport_and_history, settings_chat_display,
-        settings_chat_full_info_type_name, settings_chat_state_from_full_info,
-        settings_get_response, settings_reply_flags, shield_history_tail_messages_from_config,
-        shield_options_from_config, static_web_asset_response, static_web_routes,
-        stored_chat_member_is_fresh, telegram_webhook_response, virtual_messages,
     };
     use crate::permissions::{
         ChatPermissionContext, ChatPermissionPolicy, ChatPermissionStore, ChatPermissionStoreFuture,
@@ -15509,18 +6206,18 @@ mod tests {
     use crate::updates::UpdateHandler;
 
     #[test]
-    fn go_dispatcher_config_matches_server_runtime_defaults() {
-        let config = go_dispatcher_config();
+    fn dispatcher_config_matches_server_runtime_defaults() {
+        let config = dispatcher_config();
 
-        assert_eq!(config.max_queue_size, GO_DISPATCHER_MAX_QUEUE_SIZE);
+        assert_eq!(config.max_queue_size, DISPATCHER_MAX_QUEUE_SIZE);
         assert!(config.dedupe_config.enabled);
         assert_eq!(
             config.dedupe_config.default_window,
-            GO_DISPATCHER_DEBOUNCE_WINDOW
+            DISPATCHER_DEBOUNCE_WINDOW
         );
         assert_eq!(
             config.dedupe_config.max_cache_size,
-            GO_DISPATCHER_DEBOUNCE_CACHE_SIZE
+            DISPATCHER_DEBOUNCE_CACHE_SIZE
         );
     }
 
@@ -16210,7 +6907,12 @@ mod tests {
         let valid_query =
             format!("id=7&first_name=Ada&auth_date={auth_date}&username=ada&hash={hash}");
 
-        let response = admin_auth_response(&routes, Method::GET, Some(valid_query.as_str())).await;
+        let response = admin_auth_response(
+            &crate::http::auth::test_state(&routes),
+            Method::GET,
+            Some(valid_query.as_str()),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::FOUND);
         assert_eq!(
             response.headers().get(header::LOCATION),
@@ -16225,19 +6927,34 @@ mod tests {
             Some(true)
         );
 
-        let response = admin_auth_response(&routes, Method::PUT, Some(valid_query.as_str())).await;
+        let response = admin_auth_response(
+            &crate::http::auth::test_state(&routes),
+            Method::PUT,
+            Some(valid_query.as_str()),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::METHOD_NOT_ALLOWED);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"error\":\"method not allowed\"}\n");
 
-        let response = admin_auth_response(&routes, Method::GET, Some("id=7")).await;
+        let response = admin_auth_response(
+            &crate::http::auth::test_state(&routes),
+            Method::GET,
+            Some("id=7"),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::BAD_REQUEST);
 
-        let response = admin_auth_response(&routes, Method::GET, Some("id=nope&hash=x")).await;
+        let response = admin_auth_response(
+            &crate::http::auth::test_state(&routes),
+            Method::GET,
+            Some("id=nope&hash=x"),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::BAD_REQUEST);
 
         let response = admin_auth_response(
-            &routes,
+            &crate::http::auth::test_state(&routes),
             Method::GET,
             Some("id=7&auth_date=1700000000&hash=bad"),
         )
@@ -16245,13 +6962,21 @@ mod tests {
         assert_eq!(response.status(), StatusCode::FORBIDDEN);
 
         let non_admin_routes = static_web_routes(vec![9], "123:ABC", "", "", None);
-        let response =
-            admin_auth_response(&non_admin_routes, Method::GET, Some(valid_query.as_str())).await;
+        let response = admin_auth_response(
+            &crate::http::auth::test_state(&non_admin_routes),
+            Method::GET,
+            Some(valid_query.as_str()),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::FORBIDDEN);
 
         let no_token_routes = static_web_routes(vec![7], "", "", "", None);
-        let response =
-            admin_auth_response(&no_token_routes, Method::GET, Some(valid_query.as_str())).await;
+        let response = admin_auth_response(
+            &crate::http::auth::test_state(&no_token_routes),
+            Method::GET,
+            Some(valid_query.as_str()),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::BAD_REQUEST);
         Ok(())
     }
@@ -16293,7 +7018,11 @@ mod tests {
             None,
         );
 
-        let response = admin_auth_check(Extension(routes.clone()), HeaderMap::new()).await;
+        let response = admin_auth_check(
+            axum::extract::State(crate::http::auth::test_state(&routes)),
+            HeaderMap::new(),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::OK);
         assert_eq!(
             response.headers().get(header::CONTENT_TYPE),
@@ -16306,11 +7035,16 @@ mod tests {
         let signed = openplotva_web::admin_session_cookie(7, "123:ABC");
         let value = signed.split(';').next().expect("cookie pair");
         headers.insert(header::COOKIE, value.parse()?);
-        let response = admin_auth_check(Extension(routes.clone()), headers).await;
+        let response = admin_auth_check(
+            axum::extract::State(crate::http::auth::test_state(&routes)),
+            headers,
+        )
+        .await;
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"authenticated\":true,\"user_id\":7}\n");
 
-        let response = admin_bootstrap(Extension(routes)).await;
+        let response =
+            admin_bootstrap(axum::extract::State(crate::http::auth::test_state(&routes))).await;
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(
             &body[..],
@@ -16323,7 +7057,7 @@ mod tests {
     async fn admin_state_matches_go_json_shape_without_live_services() -> Result<(), Box<dyn Error>>
     {
         let routes = static_web_routes(vec![7], "123:ABC", "https://plotva.example", "", None);
-        let response = admin_state_response(&routes).await;
+        let response = admin_state_response(&crate::http::observability::test_state(&routes)).await;
 
         assert_eq!(response.status(), StatusCode::OK);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
@@ -16342,7 +7076,11 @@ mod tests {
     async fn admin_state_requires_signed_admin_session() -> Result<(), Box<dyn Error>> {
         let routes = static_web_routes(vec![7], "123:ABC", "", "", None);
 
-        let denied = admin_state(HeaderMap::new(), Extension(routes.clone())).await;
+        let denied = admin_state(
+            HeaderMap::new(),
+            axum::extract::State(crate::http::observability::test_state(&routes)),
+        )
+        .await;
         assert_eq!(denied.status(), StatusCode::FORBIDDEN);
 
         let mut headers = HeaderMap::new();
@@ -16351,7 +7089,11 @@ mod tests {
             header::COOKIE,
             cookie.split(';').next().expect("cookie pair").parse()?,
         );
-        let allowed = admin_state(headers, Extension(routes)).await;
+        let allowed = admin_state(
+            headers,
+            axum::extract::State(crate::http::observability::test_state(&routes)),
+        )
+        .await;
         assert_eq!(allowed.status(), StatusCode::OK);
         Ok(())
     }
@@ -16367,21 +7109,30 @@ mod tests {
             headers.insert(header::COOKIE, value.parse()?);
         }
 
-        let response =
-            admin_loglevel_response(&routes, Method::POST, &headers, br#"{"level":" warning "}"#)
-                .await;
+        let response = admin_loglevel_response(
+            &crate::http::observability::test_state(&routes),
+            Method::POST,
+            &headers,
+            br#"{"level":" warning "}"#,
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::OK);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         let value: serde_json::Value = serde_json::from_slice(&body)?;
         assert_eq!(value, json!({ "ok": true, "level": "warning" }));
         assert_eq!(body.last(), Some(&b'\n'));
 
-        let response =
-            admin_loglevel_response(&routes, Method::GET, &headers, br#"{"level":"debug"}"#).await;
+        let response = admin_loglevel_response(
+            &crate::http::observability::test_state(&routes),
+            Method::GET,
+            &headers,
+            br#"{"level":"debug"}"#,
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::METHOD_NOT_ALLOWED);
 
         let response = admin_loglevel_response(
-            &routes,
+            &crate::http::observability::test_state(&routes),
             Method::POST,
             &HeaderMap::new(),
             br#"{"level":"debug"}"#,
@@ -16395,7 +7146,7 @@ mod tests {
         let mut non_admin_headers = HeaderMap::new();
         non_admin_headers.insert("X-Telegram-User-ID", "8".parse()?);
         let response = admin_loglevel_response(
-            &routes,
+            &crate::http::observability::test_state(&routes),
             Method::POST,
             &non_admin_headers,
             br#"{"level":"debug"}"#,
@@ -16406,7 +7157,7 @@ mod tests {
         let mut spoofed_admin_headers = HeaderMap::new();
         spoofed_admin_headers.insert("X-Telegram-User-ID", "7".parse()?);
         let response = admin_loglevel_response(
-            &routes,
+            &crate::http::observability::test_state(&routes),
             Method::POST,
             &spoofed_admin_headers,
             br#"{"level":"debug"}"#,
@@ -16417,8 +7168,13 @@ mod tests {
         assert_eq!(&body[..], b"{\"error\":\"unauthorized\"}\n");
         assert_eq!(body.last(), Some(&b'\n'));
 
-        let response =
-            admin_loglevel_response(&routes, Method::POST, &headers, br#"{"level":"trace"}"#).await;
+        let response = admin_loglevel_response(
+            &crate::http::observability::test_state(&routes),
+            Method::POST,
+            &headers,
+            br#"{"level":"trace"}"#,
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::BAD_REQUEST);
         Ok(())
     }
@@ -16573,7 +7329,7 @@ mod tests {
         }
 
         let response = admin_shield_documents_response(
-            &routes,
+            &crate::http::shield::test_state(&routes),
             Method::GET,
             &headers,
             Some("limit=999&include_disabled=yes&q=risk"),
@@ -16585,7 +7341,7 @@ mod tests {
         assert_eq!(&body[..], b"{\"count\":0,\"documents\":[]}\n");
 
         let response = admin_shield_documents_response(
-            &routes,
+            &crate::http::shield::test_state(&routes),
             Method::POST,
             &headers,
             None,
@@ -16596,27 +7352,54 @@ mod tests {
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"error\":\"shield disabled\"}\n");
 
-        let response =
-            admin_shield_documents_response(&routes, Method::DELETE, &headers, None, &[]).await;
+        let response = admin_shield_documents_response(
+            &crate::http::shield::test_state(&routes),
+            Method::DELETE,
+            &headers,
+            None,
+            &[],
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::BAD_REQUEST);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"error\":\"id required\"}\n");
 
-        let response =
-            admin_shield_documents_response(&routes, Method::DELETE, &headers, Some("id=5"), &[])
-                .await;
+        let response = admin_shield_documents_response(
+            &crate::http::shield::test_state(&routes),
+            Method::DELETE,
+            &headers,
+            Some("id=5"),
+            &[],
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::OK);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"ok\":true}\n");
 
-        let response =
-            admin_shield_embeddings_rebuild_response(&routes, Method::POST, &headers).await;
+        let response = admin_shield_embeddings_rebuild_response(
+            &crate::http::shield::test_state(&routes),
+            Method::POST,
+            &headers,
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
 
-        let response = admin_shield_test_response(&routes, Method::GET, &headers, br#"{}"#).await;
+        let response = admin_shield_test_response(
+            &crate::http::shield::test_state(&routes),
+            Method::GET,
+            &headers,
+            br#"{}"#,
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::METHOD_NOT_ALLOWED);
 
-        let response = admin_shield_test_response(&routes, Method::POST, &headers, br#"{}"#).await;
+        let response = admin_shield_test_response(
+            &crate::http::shield::test_state(&routes),
+            Method::POST,
+            &headers,
+            br#"{}"#,
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
         Ok(())
     }
@@ -16628,10 +7411,10 @@ mod tests {
         assert_eq!(parse_shield_limit(Some("999")), 500);
 
         let input = admin_shield_document_input(
-            super::AdminShieldDocumentRequest {
+            crate::http::shield::AdminShieldDocumentRequest {
                 title: " Risk Title ".to_owned(),
                 body: " Body ".to_owned(),
-                ..super::AdminShieldDocumentRequest::default()
+                ..crate::http::shield::AdminShieldDocumentRequest::default()
             },
             true,
         );
@@ -16722,7 +7505,7 @@ mod tests {
         }
 
         let response = admin_taskman_jobs_response(
-            &routes,
+            &crate::http::taskman::test_state(&routes),
             Method::GET,
             &headers,
             Some("status=pending&queue=image-vip"),
@@ -16741,7 +7524,7 @@ mod tests {
         assert_eq!(value["items"][0]["thread_message_id"], 10);
 
         let response = admin_taskman_job_response(
-            &routes,
+            &crate::http::taskman::test_state(&routes),
             Method::GET,
             &headers,
             Some(&format!("id={diagnostic_id}")),
@@ -16754,7 +7537,7 @@ mod tests {
         assert_eq!(value["messages"], json!([]));
 
         let response = admin_taskman_job_cancel_response(
-            &routes,
+            &crate::http::taskman::test_state(&routes),
             Method::POST,
             &headers,
             Some(&format!("job_id={diagnostic_id}")),
@@ -16766,7 +7549,7 @@ mod tests {
         );
 
         let response = admin_taskman_job_restart_response(
-            &routes,
+            &crate::http::taskman::test_state(&routes),
             Method::PUT,
             &headers,
             Some(&format!("job_id={diagnostic_id}")),
@@ -16778,7 +7561,7 @@ mod tests {
         assert!(value["new_job_id"].as_i64().unwrap_or_default() > diagnostic_id);
 
         let response = admin_taskman_jobs_clear_response(
-            &routes,
+            &crate::http::taskman::test_state(&routes),
             Method::DELETE,
             &headers,
             Some("status=cancelled"),
@@ -16804,21 +7587,38 @@ mod tests {
             headers.insert(header::COOKIE, value.parse()?);
         }
 
-        let response =
-            admin_memory_cards_response(&routes, Method::GET, &headers, Some("limit=999")).await;
+        let response = admin_memory_cards_response(
+            &crate::http::memory::test_state(&routes),
+            Method::GET,
+            &headers,
+            Some("limit=999"),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::OK);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         let value: serde_json::Value = serde_json::from_slice(&body)?;
         assert_eq!(value["count"], 0);
         assert!(value["cards"].is_null());
 
-        let response =
-            admin_memory_cards_response(&routes, Method::DELETE, &headers, Some("id=42")).await;
+        let response = admin_memory_cards_response(
+            &crate::http::memory::test_state(&routes),
+            Method::DELETE,
+            &headers,
+            Some("id=42"),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::OK);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"ok\":true}\n");
 
-        let response = admin_memory_runs_response(&routes, Method::GET, &headers, None, &[]).await;
+        let response = admin_memory_runs_response(
+            &crate::http::memory::test_state(&routes),
+            Method::GET,
+            &headers,
+            None,
+            &[],
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::OK);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         let value: serde_json::Value = serde_json::from_slice(&body)?;
@@ -16833,21 +7633,38 @@ mod tests {
         assert_eq!(value["policy"]["token_estimator"], "heuristic");
         assert!(value["enqueue_rollups"].is_null());
 
-        let response =
-            admin_memory_runs_response(&routes, Method::POST, &headers, Some("id=42"), &[]).await;
+        let response = admin_memory_runs_response(
+            &crate::http::memory::test_state(&routes),
+            Method::POST,
+            &headers,
+            Some("id=42"),
+            &[],
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"error\":\"memory disabled\"}\n");
 
-        let response =
-            admin_memory_restart_response(&routes, Method::POST, &headers, Some("id=bad"), &[])
-                .await;
+        let response = admin_memory_restart_response(
+            &crate::http::memory::test_state(&routes),
+            Method::POST,
+            &headers,
+            Some("id=bad"),
+            &[],
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::BAD_REQUEST);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"error\":\"invalid id\"}\n");
 
-        let response =
-            admin_memory_restart_response(&routes, Method::GET, &headers, None, &[]).await;
+        let response = admin_memory_restart_response(
+            &crate::http::memory::test_state(&routes),
+            Method::GET,
+            &headers,
+            None,
+            &[],
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::METHOD_NOT_ALLOWED);
         Ok(())
     }
@@ -16960,20 +7777,122 @@ mod tests {
             let value = signed.split(';').next().expect("cookie pair");
             headers.insert(header::COOKIE, value.parse()?);
         }
-        let response = admin_taskman_jobs_response(&routes, Method::GET, &headers, None).await;
+        let response = admin_taskman_jobs_response(
+            &crate::http::taskman::test_state(&routes),
+            Method::GET,
+            &headers,
+            None,
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"error\":\"task manager not configured\"}\n");
 
-        let response = admin_taskman_job_response(&routes, Method::GET, &headers, None).await;
+        let response = admin_taskman_job_response(
+            &crate::http::taskman::test_state(&routes),
+            Method::GET,
+            &headers,
+            None,
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
-        let response =
-            admin_taskman_jobs_response(&routes, Method::POST, &headers, Some("status=pending"))
-                .await;
+        let response = admin_taskman_jobs_response(
+            &crate::http::taskman::test_state(&routes),
+            Method::POST,
+            &headers,
+            Some("status=pending"),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::METHOD_NOT_ALLOWED);
         Ok(())
     }
 
+    #[tokio::test]
+    async fn postgres_admin_entity_json_preserves_nulls_base64_and_permissions()
+    -> Result<(), Box<dyn Error>> {
+        let Ok(dsn) = std::env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
+            return Ok(());
+        };
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(4)
+            .connect(&dsn)
+            .await?;
+        openplotva_storage::run_migrations_on(&pool).await?;
+        let user_id = OffsetDateTime::now_utc().unix_timestamp_nanos() as i64;
+        let chat_id = -user_id;
+        sqlx::query("INSERT INTO users (id,first_name,is_premium,is_vip,settings,discovered,updated) VALUES ($1,'Alice',TRUE,FALSE,$2,'2026-01-02T03:04:05Z','2026-01-02T03:04:05Z')")
+            .bind(user_id).bind(json!({"language":"pl"})).execute(&pool).await?;
+        sqlx::query("INSERT INTO chats (id,type,title) VALUES ($1,'supergroup','Group')")
+            .bind(chat_id)
+            .execute(&pool)
+            .await?;
+        sqlx::query("INSERT INTO chat_settings (chat_id,mood_alignment,reactivity_percentage,enable_global_text_reply) VALUES ($1,NULL,0,FALSE)").bind(chat_id).execute(&pool).await?;
+        sqlx::query("INSERT INTO chat_permissions (chat_id,status,last_checked_at,can_delete_messages) VALUES ($1,'member',now(),TRUE)").bind(chat_id).execute(&pool).await?;
+        let mut routes = static_web_routes(vec![7], "123:ABC", "https://plotva.example", "", None);
+        routes.postgres = Some(pool.clone());
+        let mut headers = HeaderMap::new();
+        let signed = openplotva_web::admin_session_cookie(7, "123:ABC");
+        headers.insert(
+            header::COOKIE,
+            signed.split(';').next().expect("cookie").parse()?,
+        );
+        let query = format!("id={user_id}");
+        let response = crate::http::entities::admin_user_get_response(
+            &crate::http::entities::test_state(&routes),
+            Method::GET,
+            &headers,
+            Some(&query),
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::OK);
+        let body: serde_json::Value =
+            serde_json::from_slice(&to_bytes(response.into_body(), usize::MAX).await?)?;
+        assert_eq!(
+            body["user"],
+            json!({
+                "id":user_id,"first_name":"Alice","last_name":null,"username":null,
+                "language_code":null,"is_premium":true,"is_vip":false,
+                "settings":base64::Engine::encode(&base64::engine::general_purpose::STANDARD, br#"{"language":"pl"}"#),
+                "discovered":"2026-01-02T03:04:05Z","updated":"2026-01-02T03:04:05Z"
+            })
+        );
+        let query = format!("chat_id={chat_id}");
+        let response = admin_chat_get_response(
+            &crate::http::entities::test_state(&routes),
+            Method::GET,
+            &headers,
+            Some(&query),
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::OK);
+        let body: serde_json::Value =
+            serde_json::from_slice(&to_bytes(response.into_body(), usize::MAX).await?)?;
+        assert_eq!(body["info"]["title"], "Group");
+        assert_eq!(body["settings"]["mood_alignment"], serde_json::Value::Null);
+        assert_eq!(body["settings"]["reactivity_percentage"], 0);
+        assert_eq!(body["settings"]["enable_global_text_reply"], false);
+        assert_eq!(body["permissions"]["can_delete_messages"], true);
+        assert_eq!(body["members_count"], 0);
+        assert_eq!(body["blocked"], false);
+        sqlx::query("DELETE FROM chat_permissions WHERE chat_id = $1")
+            .bind(chat_id)
+            .execute(&pool)
+            .await?;
+        sqlx::query("DELETE FROM chat_settings WHERE chat_id = $1")
+            .bind(chat_id)
+            .execute(&pool)
+            .await?;
+        sqlx::query("DELETE FROM chats WHERE id = $1")
+            .bind(chat_id)
+            .execute(&pool)
+            .await?;
+        sqlx::query("DELETE FROM users WHERE id = $1")
+            .bind(user_id)
+            .execute(&pool)
+            .await?;
+        Ok(())
+    }
+
     #[tokio::test]
     async fn admin_chat_and_user_routes_keep_go_auth_method_and_param_errors()
     -> Result<(), Box<dyn Error>> {
@@ -16985,32 +7904,52 @@ mod tests {
             headers.insert(header::COOKIE, value.parse()?);
         }
 
-        let response =
-            admin_chat_get_response(&routes, Method::POST, &headers, Some("chat_id=1")).await;
+        let response = admin_chat_get_response(
+            &crate::http::entities::test_state(&routes),
+            Method::POST,
+            &headers,
+            Some("chat_id=1"),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::METHOD_NOT_ALLOWED);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"error\":\"method not allowed\"}\n");
 
-        let response =
-            admin_chat_get_response(&routes, Method::GET, &HeaderMap::new(), Some("chat_id=1"))
-                .await;
+        let response = admin_chat_get_response(
+            &crate::http::entities::test_state(&routes),
+            Method::GET,
+            &HeaderMap::new(),
+            Some("chat_id=1"),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::FORBIDDEN);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"error\":\"unauthorized\"}\n");
 
-        let response = admin_chat_get_response(&routes, Method::GET, &headers, None).await;
+        let response = admin_chat_get_response(
+            &crate::http::entities::test_state(&routes),
+            Method::GET,
+            &headers,
+            None,
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::BAD_REQUEST);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"error\":\"chat_id required\"}\n");
 
-        let response =
-            admin_chat_get_response(&routes, Method::GET, &headers, Some("chat_id=nope")).await;
+        let response = admin_chat_get_response(
+            &crate::http::entities::test_state(&routes),
+            Method::GET,
+            &headers,
+            Some("chat_id=nope"),
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::BAD_REQUEST);
         let body = to_bytes(response.into_body(), usize::MAX).await?;
         assert_eq!(&body[..], b"{\"error\":\"invalid chat_id\"}\n");
 
         let response = admin_chats_search_by_member_response(
-            &routes,
+            &crate::http::entities::test_state(&routes),
             Method::GET,
             &headers,
             Some("user_id=nope"),
@@ -17021,7 +7960,7 @@ mod tests {
         assert_eq!(&body[..], b"{\"error\":\"username or user_id required\"}\n");
 
         let response = admin_user_grant_vip_response(
-            &routes,
+            &crate::http::entities::test_state(&routes),
             Method::POST,
             &headers,
             br#"{"user_id":"bad","days":1}"#,
@@ -17119,8 +8058,12 @@ mod tests {
     async fn settings_api_without_services_fails_loud_with_go_cors_headers()
     -> Result<(), Box<dyn Error>> {
         let routes = static_web_routes(Vec::new(), "", "", "", None);
-        let response =
-            settings_get_response(&routes, Some("chat_id=42&signature=780e28cf"), None).await;
+        let response = settings_get_response(
+            &crate::http::settings::test_state(&routes),
+            Some("chat_id=42&signature=780e28cf"),
+            None,
+        )
+        .await;
         assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
         assert_eq!(
             response.headers().get(header::ACCESS_CONTROL_ALLOW_ORIGIN),
@@ -17171,7 +8114,7 @@ mod tests {
         let init_data = fresh_settings_init_data(42);
 
         let response = match parse_settings_memory_access(
-            &routes,
+            &crate::http::settings::test_state(&routes),
             Some("chat_id=-1001234567890&user_id=42&signature=780e28cf"),
             Some(&init_data),
         )
@@ -17239,34 +8182,65 @@ mod tests {
     fn settings_init_data_authenticates_matching_caller() {
         let routes = static_web_routes(Vec::new(), SETTINGS_GATE_TOKEN, "", "", None);
         let init_data = fresh_settings_init_data(42);
-        assert!(authenticate_settings_init_data(&routes, Some(&init_data), 42).is_ok());
+        assert!(
+            authenticate_settings_init_data(
+                &crate::http::settings::test_state(&routes),
+                Some(&init_data),
+                42
+            )
+            .is_ok()
+        );
     }
 
     #[test]
     fn settings_init_data_rejects_caller_user_id_mismatch() {
         let routes = static_web_routes(Vec::new(), SETTINGS_GATE_TOKEN, "", "", None);
         let init_data = fresh_settings_init_data(42);
-        assert!(authenticate_settings_init_data(&routes, Some(&init_data), 99).is_err());
+        assert!(
+            authenticate_settings_init_data(
+                &crate::http::settings::test_state(&routes),
+                Some(&init_data),
+                99
+            )
+            .is_err()
+        );
     }
 
     #[test]
     fn settings_init_data_rejects_forged_header() {
         let routes = static_web_routes(Vec::new(), SETTINGS_GATE_TOKEN, "", "", None);
         let forged = "auth_date=1700000000&user=%7B%22id%22%3A42%7D&hash=deadbeef";
-        assert!(authenticate_settings_init_data(&routes, Some(forged), 42).is_err());
+        assert!(
+            authenticate_settings_init_data(
+                &crate::http::settings::test_state(&routes),
+                Some(forged),
+                42
+            )
+            .is_err()
+        );
     }
 
     #[test]
     fn settings_init_data_rejects_zero_claimed_user_id() {
         let routes = static_web_routes(Vec::new(), SETTINGS_GATE_TOKEN, "", "", None);
         let init_data = fresh_settings_init_data(42);
-        assert!(authenticate_settings_init_data(&routes, Some(&init_data), 0).is_err());
+        assert!(
+            authenticate_settings_init_data(
+                &crate::http::settings::test_state(&routes),
+                Some(&init_data),
+                0
+            )
+            .is_err()
+        );
     }
 
     #[test]
     fn settings_init_data_absent_rejects() {
         let routes = static_web_routes(Vec::new(), SETTINGS_GATE_TOKEN, "", "", None);
-        assert!(authenticate_settings_init_data(&routes, None, 42).is_err());
+        assert!(
+            authenticate_settings_init_data(&crate::http::settings::test_state(&routes), None, 42)
+                .is_err()
+        );
     }
 
     #[test]
@@ -17481,7 +8455,7 @@ mod tests {
 
     #[test]
     fn admin_llm_dialogs_filter_parses_query_params() {
-        use crate::admin_llm_dialogs_filter;
+        use crate::http::observability::admin_llm_dialogs_filter;
         let filter = admin_llm_dialogs_filter(Some(
             "kind=dialog&chat_id=-100500&errors_only=true&q=%D0%BF%D1%80%D0%B8%D0%B2%D0%B5%D1%82&limit=50",
         ));
@@ -17501,7 +8475,7 @@ mod tests {
     #[test]
     fn app_router_builds_with_admin_api_routes_before_static_wildcard() {
         assert_eq!(
-            GO_ADMIN_API_ROUTE_PATTERNS,
+            ADMIN_API_ROUTE_PATTERNS,
             [
                 "/admin/api/auth",
                 "/admin/api/auth_check",
diff --git a/crates/openplotva-app/src/llm_translate.rs b/crates/openplotva-app/src/llm_translate.rs
index 928f59a1..742e4a34 100644
--- a/crates/openplotva-app/src/llm_translate.rs
+++ b/crates/openplotva-app/src/llm_translate.rs
@@ -13,10 +13,7 @@ use serde::Deserialize;
 use serde_json::{Value, json};
 use thiserror::Error;
 
-use crate::media::{
-    aifarm_structured_json_config_for_attempt, gateway_structured_json_config_for_attempt,
-    routed_attempt_is_genkit,
-};
+use crate::media::aifarm_structured_json_config_for_attempt;
 use crate::routed_attempts::{
     RoutedAttempt, RoutedAttemptRunError, RoutedAttemptWalker, RoutedRequestContext,
 };
@@ -179,12 +176,8 @@ async fn translate_with_attempt(
     attempt: &RoutedAttempt,
     request: AifarmStructuredJsonRequest,
 ) -> Result<String, LlmTranslationError> {
-    let cfg = if routed_attempt_is_genkit(attempt) {
-        gateway_structured_json_config_for_attempt(config, attempt)
-            .ok_or_else(|| LlmTranslationError::Unavailable(attempt.provider_name.clone()))?
-    } else {
-        aifarm_structured_json_config_for_attempt(config, attempt)
-    };
+    let cfg = aifarm_structured_json_config_for_attempt(config, attempt)
+        .map_err(|error| LlmTranslationError::Routing(error.to_string()))?;
     let content = AifarmStructuredJsonGenerator::new(cfg)
         .generate_json(request, &mut |_| {})
         .await?;
diff --git a/crates/openplotva-app/src/media.rs b/crates/openplotva-app/src/media.rs
index befed855..99016cf2 100644
--- a/crates/openplotva-app/src/media.rs
+++ b/crates/openplotva-app/src/media.rs
@@ -6,7 +6,7 @@ use openplotva_config::AppConfig;
 use openplotva_dialog::{PROVIDER_AIFARM, PROVIDER_NVIDIA, PROVIDER_VMLX};
 use openplotva_llm::aifarm::{
     AifarmClientConfig, AifarmDialogConfig, AifarmHttpTransport, AifarmStructuredJsonConfig,
-    AifarmStructuredJsonGenerator, GatewayRequestFields, ReqwestAifarmTransport, StatusUpdate,
+    AifarmStructuredJsonGenerator, StatusUpdate,
 };
 use openplotva_llm::gemini::{GeminiMediaPromptOptimizer, GeminiMediaPromptOptimizerConfig};
 use openplotva_llm::retry::{FailureReason, retryable_reason_from_message};
@@ -16,10 +16,6 @@ use thiserror::Error;
 use crate::routed_attempts::{
     RoutedAttempt, RoutedAttemptRunError, RoutedAttemptWalker, RoutedRequestContext,
 };
-use crate::runtime_gemini_cache::resolve_google_ai_key;
-
-const OPENROUTER_MODEL_PREFIX: &str = "openrouter/";
-const OPENROUTER_CHAT_COMPLETIONS_URL: &str = "https://openrouter.ai/api/v1/chat/completions";
 
 /// Boxed image-prompt optimizer future.
 pub type ImagePromptOptimizeFuture<'a> =
@@ -60,16 +56,6 @@ pub struct MediaPromptOptimizerService<Optimizer> {
     optimizer: Option<Optimizer>,
 }
 
-#[derive(Clone, Debug)]
-pub struct FallbackMediaPromptOptimizer<Primary, Fallback> {
-    primary: Primary,
-    fallback: Fallback,
-    image_primary_label: String,
-    image_fallback_label: String,
-    edit_primary_label: String,
-    edit_fallback_label: String,
-}
-
 pub type AppMediaPromptOptimizer = Arc<dyn MediaPromptOptimizer>;
 
 /// Error returned by app-level media optimizer service helpers.
@@ -88,106 +74,6 @@ impl<Optimizer> MediaPromptOptimizerService<Optimizer> {
     }
 }
 
-impl<Primary, Fallback> FallbackMediaPromptOptimizer<Primary, Fallback> {
-    /// Build a fallback optimizer with shared labels for image and edit errors.
-    #[must_use]
-    pub fn new(
-        primary: Primary,
-        fallback: Fallback,
-        primary_label: impl Into<String>,
-        fallback_label: impl Into<String>,
-    ) -> Self {
-        let primary_label = primary_label.into();
-        let fallback_label = fallback_label.into();
-        Self {
-            primary,
-            fallback,
-            image_primary_label: primary_label.clone(),
-            image_fallback_label: fallback_label.clone(),
-            edit_primary_label: primary_label,
-            edit_fallback_label: fallback_label,
-        }
-    }
-
-    #[must_use]
-    pub fn with_flow_labels(
-        primary: Primary,
-        fallback: Fallback,
-        image_primary_label: impl Into<String>,
-        image_fallback_label: impl Into<String>,
-        edit_primary_label: impl Into<String>,
-        edit_fallback_label: impl Into<String>,
-    ) -> Self {
-        Self {
-            primary,
-            fallback,
-            image_primary_label: image_primary_label.into(),
-            image_fallback_label: image_fallback_label.into(),
-            edit_primary_label: edit_primary_label.into(),
-            edit_fallback_label: edit_fallback_label.into(),
-        }
-    }
-}
-
-impl<Primary, Fallback> MediaPromptOptimizer for FallbackMediaPromptOptimizer<Primary, Fallback>
-where
-    Primary: MediaPromptOptimizer,
-    Fallback: MediaPromptOptimizer,
-{
-    fn optimize_image_prompt<'a>(
-        &'a self,
-        text: &'a str,
-        options: OptimizePromptOptions,
-    ) -> ImagePromptOptimizeFuture<'a> {
-        Box::pin(async move {
-            match self.primary.optimize_image_prompt(text, options).await {
-                Ok(value) => Ok(value),
-                Err(primary_error) => self
-                    .fallback
-                    .optimize_image_prompt(text, options)
-                    .await
-                    .map_err(|fallback_error| {
-                        combined_optimizer_error(
-                            &self.image_primary_label,
-                            &primary_error,
-                            &self.image_fallback_label,
-                            &fallback_error,
-                        )
-                    }),
-            }
-        })
-    }
-
-    fn optimize_image_edit_prompt<'a>(
-        &'a self,
-        text: &'a str,
-        images: &'a [String],
-        options: OptimizePromptOptions,
-    ) -> ImageEditPromptOptimizeFuture<'a> {
-        Box::pin(async move {
-            match self
-                .primary
-                .optimize_image_edit_prompt(text, images, options)
-                .await
-            {
-                Ok(value) => Ok(value),
-                Err(primary_error) => self
-                    .fallback
-                    .optimize_image_edit_prompt(text, images, options)
-                    .await
-                    .map_err(|fallback_error| {
-                        combined_optimizer_error(
-                            &self.edit_primary_label,
-                            &primary_error,
-                            &self.edit_fallback_label,
-                            &fallback_error,
-                        )
-                    }),
-            }
-        })
-    }
-}
-
 #[derive(Clone)]
 pub struct RoutedMediaPromptOptimizer {
     walker: RoutedAttemptWalker,
@@ -309,107 +195,42 @@ fn media_optimizer_for_attempt_with_prompt_store(
     attempt: &RoutedAttempt,
     prompt_store: &Arc<openplotva_prompts::PromptStore>,
 ) -> Result<AppMediaPromptOptimizer, MediaPromptOptimizerError> {
-    if routed_attempt_is_genkit(attempt) {
-        let model = genkit_model_for_attempt(attempt);
-        if let Some(cfg) = gateway_structured_json_config_for_attempt(config, attempt) {
-            let optimizer =
-                AifarmStructuredJsonGenerator::new(cfg).with_prompt_store(Arc::clone(prompt_store));
-            return Ok(Arc::new(optimizer) as AppMediaPromptOptimizer);
-        }
-        return gemini_media_prompt_optimizer_from_app_config_with_model(config, &model)
-            .map(|optimizer| optimizer.with_prompt_store(Arc::clone(prompt_store)))
-            .map(|optimizer| Arc::new(optimizer) as AppMediaPromptOptimizer)
-            .ok_or_else(|| {
-                MediaPromptOptimizerError::Provider(format!(
-                    "media prompt provider {} is unavailable",
-                    attempt.provider_name
-                ))
-            });
+    if attempt.protocol == Some(openplotva_llm::provider_schema::Protocol::Genkit) {
+        let (api_key, base_url) =
+            crate::provider_transport::gemini_endpoint_for_attempt(config, attempt)
+                .map_err(|error| MediaPromptOptimizerError::Provider(error.to_string()))?;
+        let optimizer = GeminiMediaPromptOptimizer::new(GeminiMediaPromptOptimizerConfig {
+            api_key,
+            base_url,
+            model: attempt.model_name.clone(),
+            request_timeout: Duration::from_secs(
+                config.llm.dialog.request_timeout_seconds.max(1) as u64
+            ),
+        })
+        .with_prompt_store(Arc::clone(prompt_store));
+        return Ok(Arc::new(optimizer));
     }
 
-    let cfg = aifarm_structured_json_config_for_attempt(config, attempt);
+    let cfg = aifarm_structured_json_config_for_attempt(config, attempt)?;
     let optimizer =
         AifarmStructuredJsonGenerator::new(cfg).with_prompt_store(Arc::clone(prompt_store));
     Ok(Arc::new(optimizer) as AppMediaPromptOptimizer)
 }
 
-pub(crate) fn routed_attempt_is_genkit(attempt: &RoutedAttempt) -> bool {
-    attempt.provider_name.eq_ignore_ascii_case("genkit")
-        || attempt.provider_name.eq_ignore_ascii_case("gemini")
-        || attempt.provider_name.eq_ignore_ascii_case("openrouter")
-}
-
-pub(crate) fn genkit_model_for_attempt(attempt: &RoutedAttempt) -> String {
-    if attempt.provider_name.eq_ignore_ascii_case("openrouter")
-        && !attempt
-            .model_name
-            .get(..OPENROUTER_MODEL_PREFIX.len())
-            .is_some_and(|head| head.eq_ignore_ascii_case(OPENROUTER_MODEL_PREFIX))
-    {
-        format!("{OPENROUTER_MODEL_PREFIX}{}", attempt.model_name.trim())
-    } else {
-        attempt.model_name.clone()
-    }
-}
-
-/// Structured-JSON config for a genkit-family attempt served by an
-/// OpenAI-compatible gateway (OpenRouter), carrying the routed model's gateway
-/// fields. `None` when the attempt's model is not a gateway model.
-pub(crate) fn gateway_structured_json_config_for_attempt(
-    config: &AppConfig,
-    attempt: &RoutedAttempt,
-) -> Option<AifarmStructuredJsonConfig> {
-    let model = genkit_model_for_attempt(attempt);
-    let (mut cfg, _) =
-        genkit_openai_compatible_media_prompt_optimizer_config_from_app_config(config, &model)?;
-    cfg.client.gateway_fields = GatewayRequestFields::from_overrides(&attempt.overrides.extra);
-    Some(cfg)
-}
-
 pub(crate) fn aifarm_structured_json_config_for_attempt(
     config: &AppConfig,
     attempt: &RoutedAttempt,
-) -> AifarmStructuredJsonConfig {
+) -> Result<AifarmStructuredJsonConfig, MediaPromptOptimizerError> {
     let mut cfg = aifarm_structured_json_config_from_app_config(config);
-    cfg.model = attempt.model_name.clone();
-    cfg.client.default_model = attempt.model_name.clone();
-    cfg.client.direct_url.clear();
-    if let Some(endpoint) = attempt
-        .model_base_url
-        .as_deref()
-        .or(attempt.provider_endpoint.as_deref())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
-        if attempt.discovery_service_name.is_some() || attempt.discovery_endpoint_name.is_some() {
-            cfg.client.base_url = endpoint.to_owned();
-        } else {
-            cfg.client.direct_url =
-                openplotva_llm::aifarm::normalize_chat_completions_url(endpoint);
-            if attempt
-                .provider_name
-                .eq_ignore_ascii_case(crate::dialog_runtime::VRAM_CLOUD_PROVIDER_NAME)
-            {
-                cfg.client.api_key = config.llm.dialog.aifarm_pool_api_key.clone();
-            }
-        }
-    }
-    if let Some(service) = attempt.discovery_service_name.as_deref() {
-        cfg.client.service_name = service.to_owned();
-    }
-    cfg.client.runtime_hint = attempt.provider_runtime_hint.clone().unwrap_or_default();
-    cfg.client.supports_message_name = attempt.supports_message_name();
-    cfg.client.supports_cache_control = attempt.supports_cache_control();
-    cfg.client.gateway_fields = GatewayRequestFields::from_overrides(&attempt.overrides.extra);
-    if let Some(endpoint) = attempt.discovery_endpoint_name.as_deref() {
-        cfg.client.endpoint_name = endpoint.to_owned();
-    }
+    cfg.client = crate::provider_transport::openai_client_for_attempt(config, attempt, cfg.client)
+        .map_err(|error| MediaPromptOptimizerError::Provider(error.to_string()))?;
+    cfg.model.clone_from(&cfg.client.default_model);
     if let Some(max_tokens) = attempt.overrides.max_tokens
         && max_tokens > 0
     {
         cfg.max_tokens = max_tokens;
     }
-    cfg.with_defaults()
+    Ok(cfg.with_defaults())
 }
 
 fn media_optimizer_retryable_reason(error: &MediaPromptOptimizerError) -> Option<FailureReason> {
@@ -441,17 +262,6 @@ where
     }
 }
 
-fn combined_optimizer_error(
-    primary_label: &str,
-    primary_error: &MediaPromptOptimizerError,
-    fallback_label: &str,
-    fallback_error: &MediaPromptOptimizerError,
-) -> MediaPromptOptimizerError {
-    MediaPromptOptimizerError::Provider(format!(
-        "{primary_label} failed: {primary_error}; {fallback_label} failed: {fallback_error}"
-    ))
-}
-
 impl<Optimizer> MediaPromptOptimizerService<Optimizer>
 where
     Optimizer: MediaPromptOptimizer,
@@ -683,119 +493,6 @@ pub fn aifarm_structured_json_config_from_app_config(
     .with_defaults()
 }
 
-/// Build the reqwest-backed AIFarm media prompt optimizer.
-#[must_use]
-pub fn aifarm_media_prompt_optimizer_from_app_config(
-    config: &AppConfig,
-) -> AifarmStructuredJsonGenerator<ReqwestAifarmTransport> {
-    AifarmStructuredJsonGenerator::new(aifarm_structured_json_config_from_app_config(config))
-}
-
-/// Build the reqwest-backed Gemini media prompt optimizer when a Google AI key is configured.
-#[must_use]
-pub fn gemini_media_prompt_optimizer_from_app_config(
-    config: &AppConfig,
-) -> Option<GeminiMediaPromptOptimizer<ReqwestAifarmTransport>> {
-    let model = crate::memory_runtime::genkit_runtime_default_model(config);
-    gemini_media_prompt_optimizer_from_app_config_with_model(config, &model)
-}
-
-pub(crate) fn gemini_media_prompt_optimizer_from_app_config_with_model(
-    config: &AppConfig,
-    model: &str,
-) -> Option<GeminiMediaPromptOptimizer<ReqwestAifarmTransport>> {
-    let api_key = resolve_google_ai_key(&config.google_ai);
-    if api_key.trim().is_empty() || model.trim().is_empty() {
-        return None;
-    }
-    Some(GeminiMediaPromptOptimizer::new(
-        GeminiMediaPromptOptimizerConfig {
-            api_key,
-            model: model.to_owned(),
-            request_timeout: Duration::from_secs(
-                config.llm.dialog.request_timeout_seconds.max(1) as u64
-            ),
-            ..GeminiMediaPromptOptimizerConfig::default()
-        },
-    ))
-}
-
-fn genkit_media_prompt_optimizer_from_app_config(
-    config: &AppConfig,
-) -> Option<(AppMediaPromptOptimizer, String)> {
-    let api_key = resolve_google_ai_key(&config.google_ai);
-    if api_key.trim().is_empty() {
-        return None;
-    }
-    let model = crate::memory_runtime::genkit_runtime_default_model(config);
-    if let Some((cfg, provider)) =
-        genkit_openai_compatible_media_prompt_optimizer_config_from_app_config(config, &model)
-    {
-        return Some((
-            Arc::new(AifarmStructuredJsonGenerator::new(cfg)) as AppMediaPromptOptimizer,
-            provider.to_owned(),
-        ));
-    }
-    gemini_media_prompt_optimizer_from_app_config(config).map(|optimizer| {
-        (
-            Arc::new(optimizer) as AppMediaPromptOptimizer,
-            "gemini".to_owned(),
-        )
-    })
-}
-
-pub(crate) fn genkit_openai_compatible_media_prompt_optimizer_config_from_app_config(
-    config: &AppConfig,
-    model: &str,
-) -> Option<(AifarmStructuredJsonConfig, &'static str)> {
-    let model = model.trim();
-    let model = strip_provider_prefix_fold(model, OPENROUTER_MODEL_PREFIX)?;
-    let (direct_url, api_key, model, request_timeout_seconds, provider) = (
-        OPENROUTER_CHAT_COMPLETIONS_URL,
-        config.open_router.key.trim().to_owned(),
-        model.trim().to_owned(),
-        config.open_router.request_timeout_seconds,
-        "openrouter",
-    );
-    if model.is_empty() || api_key.trim().is_empty() {
-        return None;
-    }
-    let mut client = discovery_client_config_from_app_config(config, &model);
-    client.direct_url = direct_url.to_owned();
-    client.api_key = api_key;
-    client.default_model = model.clone();
-    client.request_timeout = positive_seconds(request_timeout_seconds);
-    Some((
-        AifarmStructuredJsonConfig {
-            client,
-            model,
-            max_tokens: 4096,
-        }
-        .with_defaults(),
-        provider,
-    ))
-}
-
-#[must_use]
-pub fn media_prompt_optimizer_from_app_config(
-    config: &AppConfig,
-) -> Option<AppMediaPromptOptimizer> {
-    let primary = aifarm_media_prompt_optimizer_from_app_config(config);
-    Some(
-        match genkit_media_prompt_optimizer_from_app_config(config) {
-            Some((fallback, provider)) => Arc::new(FallbackMediaPromptOptimizer::with_flow_labels(
-                primary,
-                fallback,
-                "aifarm image prompt optimizer",
-                format!("{provider} image prompt optimizer"),
-                "aifarm edit prompt optimizer",
-                format!("{provider} edit prompt optimizer"),
-            )) as AppMediaPromptOptimizer,
-            None => Arc::new(primary) as AppMediaPromptOptimizer,
-        },
-    )
-}
-
 fn dialog_client_config_from_app_config(
     config: &AppConfig,
     direct_url: &str,
@@ -883,15 +580,10 @@ fn positive_seconds(seconds: i32) -> Duration {
     }
 }
 
-fn strip_provider_prefix_fold<'a>(value: &'a str, prefix: &str) -> Option<&'a str> {
-    value
-        .get(..prefix.len())
-        .is_some_and(|head| head.eq_ignore_ascii_case(prefix))
-        .then(|| &value[prefix.len()..])
-}
-
 #[cfg(test)]
 mod tests {
+    const OPENROUTER_CHAT_COMPLETIONS_URL: &str = "https://openrouter.ai/api/v1/chat/completions";
+
     use std::sync::{Arc, Mutex};
 
     use super::*;
@@ -1101,38 +793,9 @@ mod tests {
         assert_eq!(cfg.include_reasoning, Some(true));
     }
 
-    #[test]
-    fn provider_media_genkit_fallback_routes_openrouter_default_model() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            googleai_key: Some("google-key".to_owned()),
-            genkit_default_model: Some(" openrouter/openai/gpt-4.1-mini ".to_owned()),
-            openrouter_key: Some(" openrouter-key ".to_owned()),
-            openrouter_request_timeout_seconds: Some("333".to_owned()),
-            dialog_discovery_service_name: Some("svc".to_owned()),
-            dialog_discovery_endpoint_name: Some("endpoint".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        let (cfg, provider) =
-            genkit_openai_compatible_media_prompt_optimizer_config_from_app_config(
-                &config,
-                "openrouter/openai/gpt-4.1-mini",
-            )
-            .expect("openrouter config");
-
-        assert_eq!(provider, "openrouter");
-        assert_eq!(cfg.model, "openai/gpt-4.1-mini");
-        assert_eq!(cfg.client.direct_url, OPENROUTER_CHAT_COMPLETIONS_URL);
-        assert_eq!(cfg.client.api_key, "openrouter-key");
-        assert_eq!(cfg.client.default_model, "openai/gpt-4.1-mini");
-        assert_eq!(cfg.client.request_timeout, Duration::from_secs(333));
-        assert_eq!(cfg.client.service_name, "svc");
-        assert_eq!(cfg.client.endpoint_name, "endpoint");
-    }
-
     fn openrouter_attempt(overrides: serde_json::Value) -> RoutedAttempt {
         RoutedAttempt {
+            protocol: Some(openplotva_llm::provider_schema::Protocol::OpenAiCompat),
             provider_id: 3,
             model_id: 5,
             provider_name: "openrouter".to_owned(),
@@ -1169,7 +832,7 @@ mod tests {
         }));
 
         let cfg =
-            gateway_structured_json_config_for_attempt(&config, &attempt).expect("gateway config");
+            aifarm_structured_json_config_for_attempt(&config, &attempt).expect("gateway config");
 
         assert_eq!(cfg.model, "vendor/model-flash");
         assert_eq!(cfg.client.direct_url, OPENROUTER_CHAT_COMPLETIONS_URL);
@@ -1182,12 +845,15 @@ mod tests {
             Some(serde_json::json!({"enabled": false}))
         );
 
-        let plain = gateway_structured_json_config_for_attempt(
+        let plain = aifarm_structured_json_config_for_attempt(
             &config,
             &openrouter_attempt(serde_json::json!({})),
         )
         .expect("gateway config");
-        assert_eq!(plain.client.gateway_fields, GatewayRequestFields::default());
+        assert_eq!(
+            plain.client.gateway_fields,
+            openplotva_llm::aifarm::GatewayRequestFields::default()
+        );
     }
 
     fn options(variant_count: usize) -> OptimizePromptOptions {
@@ -1252,82 +918,4 @@ mod tests {
             }
         );
     }
-
-    #[tokio::test]
-    async fn fallback_media_prompt_optimizer_uses_secondary_after_primary_failure() {
-        let primary = FakeOptimizer::default();
-        *primary.image_result.lock().expect("primary image result") = Some(Err(
-            MediaPromptOptimizerError::Provider("aifarm unavailable".to_owned()),
-        ));
-        let secondary = FakeOptimizer::default();
-        *secondary
-            .image_result
-            .lock()
-            .expect("secondary image result") = Some(Ok(ImageOptimize {
-            input: "cat".to_owned(),
-            outputs: vec!["gemini cat".to_owned()],
-            aspect_ratio: "1:1".to_owned(),
-            nsfw_result: openplotva_media::NsfwResult::Safe,
-            ..ImageOptimize::default()
-        }));
-        let optimizer = FallbackMediaPromptOptimizer::new(
-            primary,
-            secondary,
-            "aifarm image prompt optimizer",
-            "gemini image prompt optimizer",
-        );
-
-        let got = optimizer
-            .optimize_image_prompt(
-                "cat",
-                OptimizePromptOptions {
-                    variant_count: 1,
-                    ..OptimizePromptOptions::default()
-                },
-            )
-            .await
-            .expect("secondary result");
-
-        assert_eq!(got.outputs, vec!["gemini cat"]);
-        assert_eq!(got.nsfw_result, openplotva_media::NsfwResult::Safe);
-    }
-
-    #[tokio::test]
-    async fn fallback_media_prompt_optimizer_uses_secondary_for_edit_after_primary_failure() {
-        let primary = FakeOptimizer::default();
-        *primary.edit_result.lock().expect("primary edit result") = Some(Err(
-            MediaPromptOptimizerError::Provider("aifarm unavailable".to_owned()),
-        ));
-        let secondary = FakeOptimizer::default();
-        *secondary.edit_result.lock().expect("secondary edit result") =
-            Some(Ok(ImageEditOptimize {
-                input: "make it day".to_owned(),
-                outputs: vec!["gemini edit".to_owned()],
-                nsfw_result: openplotva_media::NsfwResult::Safe,
-                fibo_caption: None,
-            }));
-        let optimizer = FallbackMediaPromptOptimizer::with_flow_labels(
-            primary,
-            secondary,
-            "aifarm image prompt optimizer",
-            "gemini image prompt optimizer",
-            "aifarm edit prompt optimizer",
-            "gemini edit prompt optimizer",
-        );
-
-        let got = optimizer
-            .optimize_image_edit_prompt(
-                "make it day",
-                &[],
-                OptimizePromptOptions {
-                    variant_count: 1,
-                    ..OptimizePromptOptions::default()
-                },
-            )
-            .await
-            .expect("secondary edit result");
-
-        assert_eq!(got.outputs, vec!["gemini edit"]);
-        assert_eq!(got.nsfw_result, openplotva_media::NsfwResult::Safe);
-    }
 }
diff --git a/crates/openplotva-app/src/members.rs b/crates/openplotva-app/src/members.rs
index 7fb33a4a..2fdb00cf 100644
--- a/crates/openplotva-app/src/members.rs
+++ b/crates/openplotva-app/src/members.rs
@@ -10,13 +10,14 @@ use carapax::types::{
 use openplotva_core::{ChatSettings, ChatSettingsUpdate, UserState};
 use openplotva_storage::ChatMemberUpsert;
 use openplotva_taskman::{
-    CONTROL_QUEUE_NAME, ControlJobData, ControlJobParams, ControlKind, HIGH_PRIORITY, JobType,
-    StatelessJobItem, TaskQueueSchedule, control_job_params_from_stateless_job, new_control_job_at,
+    CONTROL_QUEUE_NAME, ControlJobData, ControlJobParams, ControlKind, HIGH_PRIORITY,
+    StatelessJobItem, TaskQueueSchedule, new_control_job_at,
 };
 use thiserror::Error;
 use time::OffsetDateTime;
 
 use crate::{
+    control_jobs::ControlJobQueue,
     permissions::{ChatPermissionContext, ChatPermissionStore},
     updates::UpdateHandler,
 };
@@ -25,14 +26,6 @@ use crate::{
 pub type ChatCommunicationFuture<'a, T, E> =
     Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>;
 
-/// Boxed future returned by member-state control-job queues.
-pub type MemberStateControlJobQueueFuture<'a, E> =
-    Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
-
-/// Boxed future returned by member-state control-job worker queues.
-pub type MemberStateControlJobWorkerFuture<'a, T, E> =
-    Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>;
-
 /// Boxed future returned by member-state sync side effects.
 pub type MemberStateControlJobFuture<'a> = Pin<Box<dyn Future<Output = ()> + Send + 'a>>;
 
@@ -65,116 +58,8 @@ impl StaleInactiveMemberCleanupStore for openplotva_storage::PostgresChatMemberS
     }
 }
 
-pub trait MemberStateControlJobQueue {
-    /// Queue error type.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    fn assign_member_state_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-    ) -> MemberStateControlJobQueueFuture<'a, Self::Error>;
-}
-
-impl<T> MemberStateControlJobQueue for T
-where
-    T: crate::payments::PaymentControlJobQueue + Sync,
-{
-    type Error = T::Error;
-
-    fn assign_member_state_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-    ) -> MemberStateControlJobQueueFuture<'a, Self::Error> {
-        let debounce_key = control_job_params_from_stateless_job(&job)
-            .ok()
-            .filter(|params| params.data.kind == ControlKind::ChatMemberSync)
-            .map(|params| format!("chat-member-sync:{}:{}", params.chat_id, params.user_id));
-        self.schedule_payment_control_job(
-            queue_name,
-            job,
-            TaskQueueSchedule {
-                debounce_key,
-                ..TaskQueueSchedule::default()
-            },
-        )
-    }
-}
-
-/// Queue/status boundary for member-state taskman control-job workers.
-pub trait MemberStateControlJobWorkerQueue {
-    /// Queue error type.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    fn dequeue_member_state_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-    ) -> MemberStateControlJobWorkerFuture<
-        'a,
-        Option<crate::payments::PaymentControlJobWorkItem>,
-        Self::Error,
-    >;
-
-    /// Mark one member-state control job completed.
-    fn complete_member_state_control_job<'a>(
-        &'a self,
-        job_id: i64,
-    ) -> MemberStateControlJobWorkerFuture<'a, (), Self::Error>;
-
-    /// Mark one member-state control job failed.
-    fn fail_member_state_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> MemberStateControlJobWorkerFuture<'a, (), Self::Error>;
-}
-
-impl<T> MemberStateControlJobWorkerQueue for T
-where
-    T: crate::payments::SharedControlJobWorkerQueue + Sync,
-{
-    type Error = T::Error;
-
-    fn dequeue_member_state_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-    ) -> MemberStateControlJobWorkerFuture<
-        'a,
-        Option<crate::payments::PaymentControlJobWorkItem>,
-        Self::Error,
-    > {
-        self.dequeue_shared_control_job_matching(
-            queue_name,
-            "member-state-control",
-            is_member_state_control_job,
-        )
-    }
-
-    fn complete_member_state_control_job<'a>(
-        &'a self,
-        job_id: i64,
-    ) -> MemberStateControlJobWorkerFuture<'a, (), Self::Error> {
-        self.complete_shared_control_job(job_id)
-    }
-
-    fn fail_member_state_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> MemberStateControlJobWorkerFuture<'a, (), Self::Error> {
-        self.fail_shared_control_job(job_id, error)
-    }
-}
-
 pub trait MemberStateControlJobEffects {
     fn sync_chat_admins<'a>(&'a self, chat_id: i64) -> MemberStateControlJobFuture<'a>;
-
-    fn sync_chat_member<'a>(
-        &'a self,
-        chat_id: i64,
-        user_id: i64,
-    ) -> MemberStateControlJobFuture<'a>;
 }
 
 pub trait ChatCommunicationEffects {
@@ -194,60 +79,29 @@ pub trait ChatCommunicationEffects {
     ) -> ChatCommunicationFuture<'a, (), Self::Error>;
 }
 
-#[derive(Clone, Debug, Default, Eq, PartialEq)]
-pub struct MemberStateSyncMemberReport {
-    /// Telegram API returned a member.
-    pub fetched: bool,
-    /// User row persisted successfully.
-    pub user_upserted: bool,
-    /// Chat-member row persisted successfully.
-    pub member_upserted: bool,
-    /// Best-effort user upsert failure.
-    pub user_upsert_error: Option<String>,
-    /// Best-effort chat-member upsert failure.
-    pub member_upsert_error: Option<String>,
-}
-
-#[derive(Clone, Debug, Eq, Error, PartialEq)]
-pub enum MemberStateSyncMemberError {
-    /// Telegram `getChatMember` failed before storage writes.
-    #[error("{0}")]
-    Telegram(String),
-}
-
 /// Runtime member-state control-job effects backed by Telegram, Postgres, and optional Redis cache.
 #[derive(Clone, Debug)]
-pub struct MemberStateRuntimeEffects<Store, MemberApi, AdminApi, AdminCache> {
+pub struct MemberStateRuntimeEffects<Store, AdminApi, AdminCache> {
     store: Store,
-    member_api: MemberApi,
     admin_api: AdminApi,
     admin_cache: AdminCache,
 }
 
-impl<Store, MemberApi, AdminApi, AdminCache>
-    MemberStateRuntimeEffects<Store, MemberApi, AdminApi, AdminCache>
-{
+impl<Store, AdminApi, AdminCache> MemberStateRuntimeEffects<Store, AdminApi, AdminCache> {
     #[must_use]
-    pub fn new(
-        store: Store,
-        member_api: MemberApi,
-        admin_api: AdminApi,
-        admin_cache: AdminCache,
-    ) -> Self {
+    pub fn new(store: Store, admin_api: AdminApi, admin_cache: AdminCache) -> Self {
         Self {
             store,
-            member_api,
             admin_api,
             admin_cache,
         }
     }
 }
 
-impl<Store, MemberApi, AdminApi, AdminCache> MemberStateControlJobEffects
-    for MemberStateRuntimeEffects<Store, MemberApi, AdminApi, AdminCache>
+impl<Store, AdminApi, AdminCache> MemberStateControlJobEffects
+    for MemberStateRuntimeEffects<Store, AdminApi, AdminCache>
 where
     Store: crate::settings::GroupSettingsAdminSyncStore + Send + Sync,
-    MemberApi: crate::settings::GroupSettingsMemberApi + Send + Sync,
     AdminApi: crate::settings::GroupSettingsAdminsApi + Send + Sync,
     AdminCache: crate::settings::GroupSettingsAdminCache + Send + Sync,
 {
@@ -269,65 +123,6 @@ where
             }
         })
     }
-
-    fn sync_chat_member<'a>(
-        &'a self,
-        chat_id: i64,
-        user_id: i64,
-    ) -> MemberStateControlJobFuture<'a> {
-        Box::pin(async move {
-            if let Err(error) =
-                sync_chat_member_with_sources(&self.store, &self.member_api, chat_id, user_id).await
-            {
-                tracing::warn!(
-                    %error,
-                    chat_id,
-                    user_id,
-                    "failed to sync chat member for member-state control job"
-                );
-            }
-        })
-    }
-}
-
-pub async fn sync_chat_member_with_sources<Store, Api>(
-    store: &Store,
-    telegram: &Api,
-    chat_id: i64,
-    user_id: i64,
-) -> Result<MemberStateSyncMemberReport, MemberStateSyncMemberError>
-where
-    Store: crate::settings::GroupSettingsAdminSyncStore + Sync,
-    Api: crate::settings::GroupSettingsMemberApi + Sync,
-{
-    let member = telegram
-        .get_chat_member(chat_id, user_id)
-        .await
-        .map_err(|error| MemberStateSyncMemberError::Telegram(error.to_string()))?;
-    let mut report = MemberStateSyncMemberReport {
-        fetched: true,
-        ..MemberStateSyncMemberReport::default()
-    };
-
-    if let Err(error) = store
-        .upsert_user_state(user_state_from_telegram_user(member.get_user()))
-        .await
-    {
-        report.user_upsert_error = Some(error.to_string());
-    } else {
-        report.user_upserted = true;
-    }
-
-    let upsert = chat_member_state_upsert_from_telegram(chat_id, user_id, &member);
-    if let Err(error) =
-        crate::settings::GroupSettingsAdminSyncStore::upsert_chat_member(store, upsert).await
-    {
-        report.member_upsert_error = Some(error.to_string());
-    } else {
-        report.member_upserted = true;
-    }
-
-    Ok(report)
 }
 
 #[derive(Clone, Debug)]
@@ -409,32 +204,9 @@ pub struct ChatMemberStateOutcome {
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub enum MemberStateControlJobExecution {
     ChatAdminsSync,
-    ChatMemberSync,
     SupersededByProjectionMaterializer,
 }
 
-/// Result of one member-state taskman worker tick.
-#[derive(Clone, Debug, Default, Eq, PartialEq)]
-pub struct MemberStateControlJobWorkerReport {
-    /// Whether a job was dequeued.
-    pub dequeued: bool,
-    /// Dequeued taskman job ID.
-    pub job_id: Option<i64>,
-    /// Member-state executor result, when payload decoding succeeded.
-    pub execution: Option<MemberStateControlJobExecution>,
-    /// The job was finalized as completed.
-    pub completed: bool,
-    /// The job was finalized as failed.
-    pub failed: bool,
-    /// Queue dequeue failed.
-    pub dequeue_error: Option<String>,
-    pub decode_error: Option<String>,
-    /// Unsupported decoded control kind.
-    pub execution_error: Option<String>,
-    /// Completion/failure status write failed.
-    pub status_error: Option<String>,
-}
-
 /// Result of the stale inactive member cleanup worker.
 #[derive(Clone, Debug, Default, Eq, PartialEq)]
 pub struct StaleInactiveMemberCleanupWorkerReport {
@@ -543,7 +315,7 @@ where
 
 impl<Queue, Effects, Next> UpdateHandler for ChatMemberStateUpdateHandler<Queue, Effects, Next>
 where
-    Queue: MemberStateControlJobQueue + Send + Sync,
+    Queue: ControlJobQueue + Send + Sync,
     Effects: ChatCommunicationEffects + Send + Sync,
     Next: UpdateHandler + Send + Sync,
 {
@@ -603,7 +375,7 @@ pub async fn handle_chat_member_state_update_or_else_at<
     handle_other: HandleFn,
 ) -> Result<ChatMemberStateUpdateRoute, ChatMemberStateUpdateError>
 where
-    Queue: MemberStateControlJobQueue + Sync,
+    Queue: ControlJobQueue + Sync,
     Effects: ChatCommunicationEffects + Sync,
     HandleFn: FnOnce(TelegramUpdate) -> HandleFuture,
     HandleFuture: Future<Output = Result<(), HandleError>>,
@@ -630,7 +402,7 @@ async fn chat_member_state_outcome<Queue, Effects>(
     created: OffsetDateTime,
 ) -> Option<ChatMemberStateOutcome>
 where
-    Queue: MemberStateControlJobQueue + Sync,
+    Queue: ControlJobQueue + Sync,
     Effects: ChatCommunicationEffects + Sync,
 {
     let member_update = chat_member_updated(update)?;
@@ -656,7 +428,7 @@ where
     {
         outcome.queued_job = Some(kind);
         if let Err(error) = queue
-            .assign_member_state_control_job(CONTROL_QUEUE_NAME, job)
+            .schedule_control_job(CONTROL_QUEUE_NAME, job, TaskQueueSchedule::default())
             .await
         {
             let message = error.to_string();
@@ -758,95 +530,6 @@ where
     report
 }
 
-/// Process one member-state control job, if available.
-pub async fn process_member_state_control_job_once_at<Queue, Effects>(
-    queue: &Queue,
-    effects: &Effects,
-) -> MemberStateControlJobWorkerReport
-where
-    Queue: MemberStateControlJobWorkerQueue + Sync,
-    Effects: MemberStateControlJobEffects + Sync,
-{
-    let mut report = MemberStateControlJobWorkerReport::default();
-    let item = match queue
-        .dequeue_member_state_control_job(CONTROL_QUEUE_NAME)
-        .await
-    {
-        Ok(item) => item,
-        Err(error) => {
-            report.dequeue_error = Some(error.to_string());
-            return report;
-        }
-    };
-
-    let Some(item) = item else {
-        return report;
-    };
-    report.dequeued = true;
-    report.job_id = Some(item.id);
-
-    let params = match control_job_params_from_stateless_job(&item.job) {
-        Ok(params) => params,
-        Err(error) => {
-            let error = error.to_string();
-            report.decode_error = Some(error.clone());
-            mark_member_state_control_job_failed(queue, item.id, &error, &mut report).await;
-            return report;
-        }
-    };
-
-    report.execution = match params.data.kind {
-        ControlKind::ChatAdminsSync => {
-            effects.sync_chat_admins(params.chat_id).await;
-            Some(MemberStateControlJobExecution::ChatAdminsSync)
-        }
-        ControlKind::ChatMemberSync => {
-            tracing::info!(
-                job_id = item.id,
-                chat_id = params.chat_id,
-                user_id = params.user_id,
-                outcome = "superseded_by_projection_materializer",
-                "completed legacy chat-member sync without a Telegram API call"
-            );
-            Some(MemberStateControlJobExecution::SupersededByProjectionMaterializer)
-        }
-        kind => {
-            let error = format!("unsupported member-state control job kind: {kind:?}");
-            report.execution_error = Some(error.clone());
-            mark_member_state_control_job_failed(queue, item.id, &error, &mut report).await;
-            return report;
-        }
-    };
-
-    match queue.complete_member_state_control_job(item.id).await {
-        Ok(()) => report.completed = true,
-        Err(error) => report.status_error = Some(error.to_string()),
-    }
-    report
-}
-
-async fn mark_member_state_control_job_failed<Queue>(
-    queue: &Queue,
-    job_id: i64,
-    error: &str,
-    report: &mut MemberStateControlJobWorkerReport,
-) where
-    Queue: MemberStateControlJobWorkerQueue + Sync,
-{
-    match queue.fail_member_state_control_job(job_id, error).await {
-        Ok(()) => report.failed = true,
-        Err(error) => report.status_error = Some(error.to_string()),
-    }
-}
-
-fn is_member_state_control_job(job: &StatelessJobItem) -> bool {
-    job.data.job_type == JobType::Control
-        && matches!(
-            job.data.control_data.as_ref().map(|data| data.kind),
-            Some(ControlKind::ChatAdminsSync | ControlKind::ChatMemberSync)
-        )
-}
-
 fn chat_member_updated(update: &TelegramUpdate) -> Option<&TelegramChatMemberUpdated> {
     match &update.update_type {
         UpdateType::BotStatus(update) | UpdateType::UserStatus(update) => Some(update.as_ref()),
@@ -1119,12 +802,12 @@ mod tests {
     use openplotva_storage::{ChatMemberRecord, ChatMemberUpsert};
     use openplotva_taskman::{
         CONTROL_QUEUE_NAME, ControlJobData, ControlJobParams, ControlKind,
-        DIALOG_AIFARM_QUEUE_NAME, StatelessJobItem, new_control_job_at,
+        DIALOG_AIFARM_QUEUE_NAME, StatelessJobItem, TaskQueueSchedule, new_control_job_at,
     };
     use serde_json::json;
     use time::OffsetDateTime;
 
-    use crate::payments::{InMemoryPaymentControlJobQueue, InMemoryPaymentControlJobStatus};
+    use crate::control_jobs::{ControlJobQueue, InMemoryControlJobQueue};
     use crate::{
         dialog_messages::{
             DialogMessageFuture, DialogMessageSchedule, DialogMessageScheduleReport,
@@ -1144,19 +827,17 @@ mod tests {
     use super::{
         ChatCommunicationEffects, ChatCommunicationFuture, ChatMemberStateUpdateHandler,
         ChatMemberStateUpdateRoute, ChatSettingsCommunicationEffects, LeftChatMemberUpdateHandler,
-        LeftChatMemberUpdateRoute, MemberStateControlJobEffects, MemberStateControlJobExecution,
-        MemberStateControlJobQueue, MemberStateControlJobQueueFuture,
+        LeftChatMemberUpdateRoute, MemberStateControlJobEffects,
         STALE_INACTIVE_MEMBER_CLEANUP_INTERVAL, STALE_INACTIVE_MEMBER_MAX_AGE,
         StaleInactiveMemberCleanupFuture, StaleInactiveMemberCleanupStore,
         handle_chat_member_state_update_or_else_at, handle_left_chat_member_update_or_else,
-        process_member_state_control_job_once_at,
-        run_stale_inactive_member_cleanup_worker_at_until, sync_chat_member_with_sources,
+        run_stale_inactive_member_cleanup_worker_at_until,
     };
 
     #[tokio::test]
     async fn member_state_control_jobs_can_use_shared_persistent_control_queue()
     -> Result<(), Box<dyn Error>> {
-        let queue = InMemoryPaymentControlJobQueue::new();
+        let queue = InMemoryControlJobQueue::new();
         let job = new_control_job_at(
             ControlJobParams {
                 chat_id: -10042,
@@ -1165,7 +846,7 @@ mod tests {
                 user_full_name: "Owner".to_owned(),
                 thread_id: None,
                 data: ControlJobData {
-                    kind: ControlKind::ChatMemberSync,
+                    kind: ControlKind::ChatAdminsSync,
                     ..ControlJobData::default()
                 },
             },
@@ -1173,7 +854,11 @@ mod tests {
         );
 
         queue
-            .assign_member_state_control_job(CONTROL_QUEUE_NAME, job.clone())
+            .schedule_control_job(
+                CONTROL_QUEUE_NAME,
+                job.clone(),
+                TaskQueueSchedule::default(),
+            )
             .await?;
 
         let snapshot = queue.snapshot();
@@ -1187,37 +872,8 @@ mod tests {
                 .control_data
                 .as_ref()
                 .map(|data| data.kind),
-            Some(ControlKind::ChatMemberSync)
-        );
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn identical_pending_chat_member_sync_jobs_are_coalesced() -> Result<(), Box<dyn Error>> {
-        let queue = InMemoryPaymentControlJobQueue::new();
-        let job = new_control_job_at(
-            ControlJobParams {
-                chat_id: -10042,
-                message_id: 77,
-                user_id: 42,
-                user_full_name: "Owner".to_owned(),
-                thread_id: None,
-                data: ControlJobData {
-                    kind: ControlKind::ChatMemberSync,
-                    ..ControlJobData::default()
-                },
-            },
-            OffsetDateTime::UNIX_EPOCH,
+            Some(ControlKind::ChatAdminsSync)
         );
-
-        queue
-            .assign_member_state_control_job(CONTROL_QUEUE_NAME, job.clone())
-            .await?;
-        queue
-            .assign_member_state_control_job(CONTROL_QUEUE_NAME, job)
-            .await?;
-
-        assert_eq!(queue.snapshot().len(), 1);
         Ok(())
     }
 
@@ -1251,101 +907,14 @@ mod tests {
         Ok(())
     }
 
-    #[tokio::test]
-    async fn member_state_control_worker_skips_other_jobs_and_supersedes_legacy_member_sync()
-    -> Result<(), Box<dyn Error>> {
-        let queue = InMemoryPaymentControlJobQueue::new();
-        let effects = MemberStateSyncEffectsStub::default();
-        let translate_job = member_state_test_control_job(ControlKind::Translate, "translate");
-        let admins_job =
-            member_state_test_control_job(ControlKind::ChatAdminsSync, "chat admins sync");
-        let member_job =
-            member_state_test_control_job(ControlKind::ChatMemberSync, "chat member sync");
-        queue
-            .assign_member_state_control_job(CONTROL_QUEUE_NAME, translate_job)
-            .await?;
-        queue
-            .assign_member_state_control_job(CONTROL_QUEUE_NAME, admins_job.clone())
-            .await?;
-        queue
-            .assign_member_state_control_job(CONTROL_QUEUE_NAME, member_job.clone())
-            .await?;
-
-        let admins_report = process_member_state_control_job_once_at(&queue, &effects).await;
-        let member_report = process_member_state_control_job_once_at(&queue, &effects).await;
-
-        assert_eq!(admins_report.job_id, Some(2));
-        assert!(admins_report.completed);
-        assert_eq!(member_report.job_id, Some(3));
-        assert!(member_report.completed);
-        assert_eq!(
-            member_report.execution,
-            Some(MemberStateControlJobExecution::SupersededByProjectionMaterializer)
-        );
-        assert_eq!(effects.admin_syncs(), vec![-10042]);
-        assert!(effects.member_syncs().is_empty());
-        let snapshot = queue.snapshot();
-        assert_eq!(snapshot[0].status, InMemoryPaymentControlJobStatus::Pending);
-        assert_eq!(
-            snapshot[1].status,
-            InMemoryPaymentControlJobStatus::Completed
-        );
-        assert_eq!(
-            snapshot[2].status,
-            InMemoryPaymentControlJobStatus::Completed
-        );
-        assert_eq!(snapshot[1].job, admins_job);
-        assert_eq!(snapshot[2].job, member_job);
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn sync_chat_member_with_sources_fetches_user_and_member_like_go()
-    -> Result<(), Box<dyn Error>> {
-        let store = MemberStoreStub::default();
-        let api = MemberApiStub::with_member(telegram_admin_member(7)?);
-
-        let report = sync_chat_member_with_sources(&store, &api, -10042, 7).await?;
-
-        assert_eq!(
-            report,
-            super::MemberStateSyncMemberReport {
-                fetched: true,
-                user_upserted: true,
-                member_upserted: true,
-                user_upsert_error: None,
-                member_upsert_error: None,
-            }
-        );
-        assert_eq!(api.calls(), vec![(-10042, 7)]);
-        assert_eq!(
-            store.users(),
-            vec![UserState::new(
-                7,
-                "Tracked".to_owned(),
-                Some("Member".to_owned()),
-                Some("tracked".to_owned()),
-                Some("ru".to_owned()),
-                Some(true),
-            )]
-        );
-        assert_eq!(store.upserted(), vec![admin_member_state_upsert(-10042, 7)]);
-        Ok(())
-    }
-
     #[tokio::test]
     async fn member_state_runtime_effects_runs_admin_sync_through_existing_port()
     -> Result<(), Box<dyn Error>> {
         let store = MemberStoreStub::default();
-        let member_api = MemberApiStub::default();
         let admin_api = AdminApiStub::with_admins(vec![telegram_admin_member(11)?]);
         let cache = AdminCacheStub::default();
-        let effects = super::MemberStateRuntimeEffects::new(
-            store.clone(),
-            member_api,
-            admin_api.clone(),
-            cache.clone(),
-        );
+        let effects =
+            super::MemberStateRuntimeEffects::new(store.clone(), admin_api.clone(), cache.clone());
 
         effects.sync_chat_admins(-10042).await;
 
@@ -2028,48 +1597,6 @@ mod tests {
         }
     }
 
-    #[derive(Clone, Default)]
-    struct MemberApiStub {
-        member: Arc<Mutex<Option<TelegramChatMember>>>,
-        calls: Arc<Mutex<Vec<(i64, i64)>>>,
-    }
-
-    impl MemberApiStub {
-        fn with_member(member: TelegramChatMember) -> Self {
-            Self {
-                member: Arc::new(Mutex::new(Some(member))),
-                calls: Arc::new(Mutex::new(Vec::new())),
-            }
-        }
-
-        fn calls(&self) -> Vec<(i64, i64)> {
-            self.calls.lock().expect("member api").clone()
-        }
-    }
-
-    impl crate::settings::GroupSettingsMemberApi for MemberApiStub {
-        type Error = StubError;
-
-        fn get_chat_member<'a>(
-            &'a self,
-            chat_id: i64,
-            user_id: i64,
-        ) -> crate::settings::GroupSettingsMemberFuture<'a, TelegramChatMember, Self::Error>
-        {
-            Box::pin(async move {
-                self.calls
-                    .lock()
-                    .expect("member api")
-                    .push((chat_id, user_id));
-                self.member
-                    .lock()
-                    .expect("member api")
-                    .clone()
-                    .ok_or(StubError)
-            })
-        }
-    }
-
     #[derive(Clone, Default)]
     struct AdminApiStub {
         admins: Arc<Mutex<Vec<TelegramChatMember>>>,
@@ -2147,33 +1674,14 @@ mod tests {
         }
     }
 
-    fn member_state_test_control_job(kind: ControlKind, title: &str) -> StatelessJobItem {
-        new_control_job_at(
-            ControlJobParams {
-                chat_id: -10042,
-                message_id: 0,
-                user_id: 42,
-                user_full_name: "Admin Actor".to_owned(),
-                thread_id: None,
-                data: ControlJobData {
-                    kind,
-                    chat_type: "supergroup".to_owned(),
-                    ..ControlJobData::default()
-                },
-            },
-            OffsetDateTime::UNIX_EPOCH,
-        )
-        .with_name(title)
-    }
-
-    impl MemberStateControlJobQueue for MemberStateControlJobQueueStub {
+    impl ControlJobQueue for MemberStateControlJobQueueStub {
         type Error = StubError;
 
-        fn assign_member_state_control_job<'a>(
+        fn assign_control_job<'a>(
             &'a self,
             _queue_name: &'static str,
             job: StatelessJobItem,
-        ) -> MemberStateControlJobQueueFuture<'a, Self::Error> {
+        ) -> crate::control_jobs::ControlJobEnqueueFuture<'a, Self::Error> {
             Box::pin(async move {
                 self.jobs.lock().expect("member queue").push(job);
                 Ok(())
@@ -2181,43 +1689,6 @@ mod tests {
         }
     }
 
-    #[derive(Clone, Default)]
-    struct MemberStateSyncEffectsStub {
-        admin_syncs: Arc<Mutex<Vec<i64>>>,
-        member_syncs: Arc<Mutex<Vec<(i64, i64)>>>,
-    }
-
-    impl MemberStateSyncEffectsStub {
-        fn admin_syncs(&self) -> Vec<i64> {
-            self.admin_syncs.lock().expect("admin syncs").clone()
-        }
-
-        fn member_syncs(&self) -> Vec<(i64, i64)> {
-            self.member_syncs.lock().expect("member syncs").clone()
-        }
-    }
-
-    impl super::MemberStateControlJobEffects for MemberStateSyncEffectsStub {
-        fn sync_chat_admins<'a>(&'a self, chat_id: i64) -> super::MemberStateControlJobFuture<'a> {
-            Box::pin(async move {
-                self.admin_syncs.lock().expect("admin syncs").push(chat_id);
-            })
-        }
-
-        fn sync_chat_member<'a>(
-            &'a self,
-            chat_id: i64,
-            user_id: i64,
-        ) -> super::MemberStateControlJobFuture<'a> {
-            Box::pin(async move {
-                self.member_syncs
-                    .lock()
-                    .expect("member syncs")
-                    .push((chat_id, user_id));
-            })
-        }
-    }
-
     #[derive(Clone, Default)]
     struct CommunicationEffectsStub {
         disabled: Arc<Mutex<Vec<i64>>>,
diff --git a/crates/openplotva-app/src/memory_runtime.rs b/crates/openplotva-app/src/memory_runtime.rs
index 633103e0..4b8d79bc 100644
--- a/crates/openplotva-app/src/memory_runtime.rs
+++ b/crates/openplotva-app/src/memory_runtime.rs
@@ -3,12 +3,14 @@
 use std::{error::Error as StdError, future::Future, pin::Pin, sync::Arc, time::Duration};
 
 use openplotva_config::{AppConfig, MemoryConfig, ShieldConfig};
+use openplotva_llm::redaction::{
+    DiscoveryRedactor, DiscoveryRedactorConfig, DiscoveryRedactorError,
+};
 use openplotva_llm::{
     aifarm::{
         AifarmClientConfig, AifarmMemoryExtractor, AifarmMemoryExtractorConfig,
         AifarmMemoryExtractorError, GenkitOpenAiCompatibleMemoryExtractor,
         GenkitOpenAiCompatibleMemoryExtractorConfig, GenkitOpenAiCompatibleMemoryExtractorError,
-        ReqwestAifarmTransport, normalize_chat_completions_url,
     },
     gemini::{
         GeminiMemoryExtractor, GeminiMemoryExtractorConfig, GeminiMemoryExtractorError,
@@ -17,10 +19,9 @@ use openplotva_llm::{
     retry::{FailureReason, retryable_reason, retryable_reason_from_message},
 };
 use openplotva_memory::{
-    Card, CardInput, DiscoveryRedactor, DiscoveryRedactorConfig, DiscoveryRedactorError, Episode,
-    ExtractInput, ExtractOutput, FallbackMemoryExtractor, FallbackMemoryExtractorError, LinkInput,
-    MemoryExtractor, MemoryExtractorFuture, RedactingMemoryExtractor, RunStats, TextRedactor,
-    TextRedactorFuture, redact_extract_output_with_async,
+    Card, CardInput, Episode, ExtractInput, ExtractOutput, LinkInput, MemoryExtractor,
+    MemoryExtractorFuture, RunStats, TextRedactor, TextRedactorFuture,
+    redact_extract_output_with_async,
 };
 use openplotva_storage::{
     DialogMemoryChatMeta, PgEmbeddingVector, PostgresMemoryStore, StorageError,
@@ -61,21 +62,6 @@ const EXISTING_USER_CARDS_LIMIT: i32 = 20;
 const EXISTING_PARTICIPANT_CARDS_MAX_USER: usize = 20;
 const RELATED_CARDS_LIMIT: i32 = 24;
 const RELATED_QUERY_MAX_CHARS: usize = 320;
-const OPENROUTER_MODEL_PREFIX: &str = "openrouter/";
-const OPENROUTER_CHAT_COMPLETIONS_URL: &str = "https://openrouter.ai/api/v1/chat/completions";
-
-type AifarmGenkitMemoryExtractor = FallbackMemoryExtractor<
-    AifarmMemoryExtractor<ReqwestAifarmTransport>,
-    AppGenkitMemoryExtractor,
-    fn(&AifarmMemoryExtractorError) -> bool,
->;
-
-type RedactingAifarmGenkitMemoryExtractor =
-    RedactingMemoryExtractor<AifarmGenkitMemoryExtractor, DiscoveryRedactor>;
-
-type RedactingAifarmRouteMemoryExtractor =
-    RedactingMemoryExtractor<AifarmRouteMemoryExtractor, DiscoveryRedactor>;
-
 /// Boxed future returned by embedding providers.
 pub type EmbeddingProviderFuture<'a> = Pin<
     Box<dyn Future<Output = Result<Option<PgEmbeddingVector>, EmbedderClientError>> + Send + 'a>,
@@ -3796,198 +3782,6 @@ pub fn aifarm_memory_extractor_config_from_app_config_with_model(
     .with_defaults()
 }
 
-/// Build the reqwest-backed AIFarm memory extractor.
-#[must_use]
-pub fn aifarm_memory_extractor_from_app_config(
-    config: &AppConfig,
-) -> AifarmMemoryExtractor<ReqwestAifarmTransport> {
-    AifarmMemoryExtractor::new(aifarm_memory_extractor_config_from_app_config(config))
-}
-
-/// Build the reqwest-backed AIFarm memory extractor with an override model.
-#[must_use]
-pub fn aifarm_memory_extractor_from_app_config_with_model(
-    config: &AppConfig,
-    model_override: Option<&str>,
-) -> AifarmMemoryExtractor<ReqwestAifarmTransport> {
-    AifarmMemoryExtractor::new(aifarm_memory_extractor_config_from_app_config_with_model(
-        config,
-        model_override,
-    ))
-}
-
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub struct AifarmMemoryRouteBackendPlan {
-    pub label: String,
-    pub model: String,
-    pub service_name: String,
-    pub direct_url: String,
-}
-
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub struct AifarmMemoryRoutePlan {
-    pub backends: Vec<AifarmMemoryRouteBackendPlan>,
-}
-
-struct AifarmRouteMemoryBackend {
-    plan: AifarmMemoryRouteBackendPlan,
-    extractor: AifarmMemoryExtractor<ReqwestAifarmTransport>,
-}
-
-pub struct AifarmRouteMemoryExtractor {
-    backends: Vec<AifarmRouteMemoryBackend>,
-}
-
-#[derive(Debug, Error)]
-pub enum AifarmRouteMemoryExtractorError {
-    #[error("memory extractor route has no available backends")]
-    NoBackends,
-    #[error("memory extractor backend {backend} failed: {source}")]
-    Backend {
-        backend: String,
-        #[source]
-        source: AifarmMemoryExtractorError,
-    },
-    #[error("memory extractor route exhausted retryable backends: {0}")]
-    Exhausted(String),
-}
-
-impl MemoryExtractor for AifarmRouteMemoryExtractor {
-    type Error = AifarmRouteMemoryExtractorError;
-
-    fn extract<'a>(&'a self, input: &'a ExtractInput) -> MemoryExtractorFuture<'a, Self::Error> {
-        Box::pin(async move {
-            let mut retryable_errors = Vec::new();
-            let mut attempted = false;
-            for backend in &self.backends {
-                attempted = true;
-                match MemoryExtractor::extract(&backend.extractor, input).await {
-                    Ok(output) => return Ok(output),
-                    Err(source) if retryable_reason(&source).is_some() => {
-                        retryable_errors.push(format!("{}: {source}", backend.plan.label));
-                    }
-                    Err(source) => {
-                        return Err(AifarmRouteMemoryExtractorError::Backend {
-                            backend: backend.plan.label.clone(),
-                            source,
-                        });
-                    }
-                }
-            }
-            if !attempted {
-                return Err(AifarmRouteMemoryExtractorError::NoBackends);
-            }
-            Err(AifarmRouteMemoryExtractorError::Exhausted(
-                retryable_errors.join("\n"),
-            ))
-        })
-    }
-}
-
-#[must_use]
-pub fn aifarm_memory_route_plan_from_app_config(config: &AppConfig) -> AifarmMemoryRoutePlan {
-    AifarmMemoryRoutePlan {
-        backends: aifarm_memory_route_backend_configs_from_app_config(config, None)
-            .into_iter()
-            .map(|(plan, _)| plan)
-            .collect(),
-    }
-}
-
-fn aifarm_route_memory_extractor_from_app_config_with_model(
-    config: &AppConfig,
-    model_override: Option<&str>,
-) -> AifarmRouteMemoryExtractor {
-    AifarmRouteMemoryExtractor {
-        backends: aifarm_memory_route_backend_configs_from_app_config(config, model_override)
-            .into_iter()
-            .map(|(plan, cfg)| AifarmRouteMemoryBackend {
-                plan,
-                extractor: AifarmMemoryExtractor::new(cfg),
-            })
-            .collect(),
-    }
-}
-
-fn aifarm_memory_route_backend_configs_from_app_config(
-    config: &AppConfig,
-    model_override: Option<&str>,
-) -> Vec<(AifarmMemoryRouteBackendPlan, AifarmMemoryExtractorConfig)> {
-    let primary = aifarm_memory_extractor_config_from_app_config_with_model(config, model_override);
-    vec![(
-        aifarm_memory_route_backend_plan("primary", &primary),
-        primary,
-    )]
-}
-
-fn aifarm_memory_route_backend_plan(
-    label: impl Into<String>,
-    cfg: &AifarmMemoryExtractorConfig,
-) -> AifarmMemoryRouteBackendPlan {
-    AifarmMemoryRouteBackendPlan {
-        label: label.into(),
-        model: cfg.model.clone(),
-        service_name: cfg.client.service_name.clone(),
-        direct_url: cfg.client.direct_url.clone(),
-    }
-}
-
-/// App-owned GenKit memory extractor branch.
-pub enum AppGenkitMemoryExtractor {
-    /// Direct Gemini implementation.
-    Gemini(GeminiMemoryExtractor<ReqwestAifarmTransport>),
-    OpenAiCompatible(Box<GenkitOpenAiCompatibleMemoryExtractor<ReqwestAifarmTransport>>),
-}
-
-/// App-owned GenKit memory extractor error.
-#[derive(Debug, Error)]
-pub enum AppGenkitMemoryExtractorError {
-    /// Direct Gemini implementation failed.
-    #[error(transparent)]
-    Gemini(#[from] GeminiMemoryExtractorError),
-    /// OpenAI-compatible plugin implementation failed.
-    #[error(transparent)]
-    OpenAiCompatible(#[from] GenkitOpenAiCompatibleMemoryExtractorError),
-}
-
-impl MemoryExtractor for AppGenkitMemoryExtractor {
-    type Error = AppGenkitMemoryExtractorError;
-
-    fn extract<'a>(
-        &'a self,
-        input: &'a openplotva_memory::ExtractInput,
-    ) -> MemoryExtractorFuture<'a, Self::Error> {
-        Box::pin(async move {
-            match self {
-                Self::Gemini(extractor) => MemoryExtractor::extract(extractor, input)
-                    .await
-                    .map_err(Into::into),
-                Self::OpenAiCompatible(extractor) => {
-                    MemoryExtractor::extract(extractor.as_ref(), input)
-                        .await
-                        .map_err(Into::into)
-                }
-            }
-        })
-    }
-}
-
-/// App-owned memory extractor composition.
-pub enum AppMemoryExtractor {
-    /// Plain AIFarm extractor without redaction.
-    Plain(AifarmMemoryExtractor<ReqwestAifarmTransport>),
-    Redacting(
-        RedactingMemoryExtractor<AifarmMemoryExtractor<ReqwestAifarmTransport>, DiscoveryRedactor>,
-    ),
-    AifarmFallback(AifarmGenkitMemoryExtractor),
-    RedactingAifarmFallback(RedactingAifarmGenkitMemoryExtractor),
-    AifarmRoute(AifarmRouteMemoryExtractor),
-    RedactingAifarmRoute(RedactingAifarmRouteMemoryExtractor),
-    /// Plain Gemini/GenKit extractor without redaction.
-    GeminiPlain(AppGenkitMemoryExtractor),
-    GeminiRedacting(RedactingMemoryExtractor<AppGenkitMemoryExtractor, DiscoveryRedactor>),
-}
-
 #[derive(Clone)]
 pub struct RoutedMemoryExtractor {
     walker: RoutedAttemptWalker,
@@ -4055,7 +3849,7 @@ impl RoutedDiscoveryRedactor {
 #[derive(Debug, Error)]
 pub enum RoutedDiscoveryRedactorError {
     #[error(transparent)]
-    Build(#[from] reqwest::Error),
+    Transport(#[from] openplotva_llm::retry::ProviderError),
     #[error(transparent)]
     Redactor(#[from] DiscoveryRedactorError),
     #[error(transparent)]
@@ -4104,12 +3898,12 @@ impl TextRedactor for RoutedDiscoveryRedactor {
 
 #[derive(Debug, Error)]
 pub enum RoutedMemoryExtractorError {
-    #[error(transparent)]
-    Build(#[from] AppMemoryExtractorBuildError),
     #[error(transparent)]
     Aifarm(#[from] AifarmMemoryExtractorError),
     #[error(transparent)]
-    Genkit(#[from] AppGenkitMemoryExtractorError),
+    Gemini(#[from] GeminiMemoryExtractorError),
+    #[error(transparent)]
+    OpenAiCompatible(#[from] GenkitOpenAiCompatibleMemoryExtractorError),
     #[error(transparent)]
     Routing(#[from] RoutedRoutingError),
 }
@@ -4269,25 +4063,17 @@ async fn redact_text_with_routed_attempt(
     attempt: RoutedAttempt,
     text: &str,
 ) -> Result<String, RoutedDiscoveryRedactorError> {
-    let Some(mut cfg) = discovery_redactor_config_from_app_config(config) else {
+    let Some(cfg) = discovery_redactor_config_from_app_config(config) else {
         return Ok(text.to_owned());
     };
-    if let Some(endpoint) = routed_attempt_endpoint(&attempt) {
-        cfg.base_url = endpoint;
-    }
-    if let Some(service) = attempt.discovery_service_name.as_deref() {
-        cfg.service_name = service.to_owned();
-    }
-    if let Some(endpoint) = attempt.discovery_endpoint_name.as_deref() {
-        cfg.endpoint_name = endpoint.to_owned();
-    }
+    let cfg = crate::provider_transport::redactor_config_for_attempt(&attempt, cfg)?;
     let redactor = DiscoveryRedactor::with_client(cfg, http);
     redactor.redact_text(text).await.map_err(Into::into)
 }
 
 fn routed_redactor_retryable_reason(error: &RoutedDiscoveryRedactorError) -> Option<FailureReason> {
     match error {
-        RoutedDiscoveryRedactorError::Build(_) => Some(FailureReason::ProviderUnavailable),
+        RoutedDiscoveryRedactorError::Transport(error) => Some(error.reason()),
         RoutedDiscoveryRedactorError::Redactor(error) => {
             retryable_reason_from_message(&error.to_string())
         }
@@ -4300,15 +4086,44 @@ async fn extract_memory_with_routed_attempt(
     attempt: RoutedAttempt,
     input: &ExtractInput,
 ) -> Result<ExtractOutput, RoutedMemoryExtractorError> {
-    if routed_attempt_is_genkit(&attempt) {
-        let model = genkit_model_for_attempt(&attempt);
-        let extractor = genkit_memory_extractor_from_app_config_with_model(config, Some(&model))?;
-        return MemoryExtractor::extract(&extractor, input)
-            .await
-            .map_err(Into::into);
+    if attempt.protocol == Some(openplotva_llm::provider_schema::Protocol::Genkit) {
+        let (api_key, base_url) = crate::provider_transport::gemini_endpoint_for_attempt(
+            config, &attempt,
+        )
+        .map_err(|source| AifarmMemoryExtractorError::Completion {
+            source: Box::new(source),
+        })?;
+        let extractor = GeminiMemoryExtractor::new(GeminiMemoryExtractorConfig {
+            api_key,
+            base_url,
+            model: attempt.model_name.clone(),
+            request_timeout: positive_seconds(config.memory.consolidation_timeout_seconds),
+            ..GeminiMemoryExtractorConfig::default()
+        });
+        return extractor.extract(input).await.map_err(Into::into);
+    }
+    if crate::provider_transport::is_openrouter(&attempt) {
+        let client = crate::provider_transport::openai_client_for_attempt(
+            config,
+            &attempt,
+            AifarmClientConfig::default(),
+        )
+        .map_err(|source| AifarmMemoryExtractorError::Completion {
+            source: Box::new(source),
+        })?;
+        let extractor = GenkitOpenAiCompatibleMemoryExtractor::new(
+            GenkitOpenAiCompatibleMemoryExtractorConfig {
+                direct_url: client.direct_url,
+                api_key: client.api_key,
+                model: client.default_model,
+                request_timeout: client.request_timeout,
+                ..GenkitOpenAiCompatibleMemoryExtractorConfig::default()
+            },
+        );
+        return extractor.extract(input).await.map_err(Into::into);
     }
 
-    let extractor = AifarmMemoryExtractor::new(aifarm_memory_config_for_attempt(config, &attempt));
+    let extractor = AifarmMemoryExtractor::new(aifarm_memory_config_for_attempt(config, &attempt)?);
     MemoryExtractor::extract(&extractor, input)
         .await
         .map_err(Into::into)
@@ -4319,10 +4134,12 @@ async fn resolve_candidates_with_routed_attempt(
     attempt: RoutedAttempt,
     input: &openplotva_memory::ResolutionInput,
 ) -> Result<Option<openplotva_memory::ResolutionPlan>, RoutedMemoryExtractorError> {
-    if routed_attempt_is_genkit(&attempt) {
+    if attempt.protocol == Some(openplotva_llm::provider_schema::Protocol::Genkit)
+        || crate::provider_transport::is_openrouter(&attempt)
+    {
         return Ok(None);
     }
-    let extractor = AifarmMemoryExtractor::new(aifarm_memory_config_for_attempt(config, &attempt));
+    let extractor = AifarmMemoryExtractor::new(aifarm_memory_config_for_attempt(config, &attempt)?);
     MemoryExtractor::resolve(&extractor, input)
         .await
         .map_err(Into::into)
@@ -4333,12 +4150,14 @@ async fn merge_subject_with_routed_attempt(
     attempt: RoutedAttempt,
     input: &openplotva_memory::SubjectMergeInput,
 ) -> Result<openplotva_memory::SubjectMergePlan, RoutedSubjectMergerAttemptError> {
-    if routed_attempt_is_genkit(&attempt) {
+    if attempt.protocol == Some(openplotva_llm::provider_schema::Protocol::Genkit)
+        || crate::provider_transport::is_openrouter(&attempt)
+    {
         return Err(RoutedSubjectMergerAttemptError::UnsupportedProvider(
             attempt.provider_name,
         ));
     }
-    let extractor = AifarmMemoryExtractor::new(aifarm_memory_config_for_attempt(config, &attempt));
+    let extractor = AifarmMemoryExtractor::new(aifarm_memory_config_for_attempt(config, &attempt)?);
     openplotva_memory::SubjectMerger::merge_subject(&extractor, input)
         .await
         .map_err(Into::into)
@@ -4353,62 +4172,19 @@ fn routed_subject_merger_retryable_reason(
     }
 }
 
-fn routed_attempt_is_genkit(attempt: &RoutedAttempt) -> bool {
-    attempt.provider_name.eq_ignore_ascii_case("genkit")
-        || attempt.provider_name.eq_ignore_ascii_case("gemini")
-        || attempt.provider_name.eq_ignore_ascii_case("openrouter")
-}
-
-fn genkit_model_for_attempt(attempt: &RoutedAttempt) -> String {
-    if attempt.provider_name.eq_ignore_ascii_case("openrouter")
-        && !attempt
-            .model_name
-            .get(..OPENROUTER_MODEL_PREFIX.len())
-            .is_some_and(|head| head.eq_ignore_ascii_case(OPENROUTER_MODEL_PREFIX))
-    {
-        format!("{OPENROUTER_MODEL_PREFIX}{}", attempt.model_name.trim())
-    } else {
-        attempt.model_name.clone()
-    }
-}
-
 fn aifarm_memory_config_for_attempt(
     config: &AppConfig,
     attempt: &RoutedAttempt,
-) -> AifarmMemoryExtractorConfig {
+) -> Result<AifarmMemoryExtractorConfig, AifarmMemoryExtractorError> {
     let mut cfg = aifarm_memory_extractor_config_from_app_config_with_model(
         config,
         Some(attempt.model_name.trim()),
     );
-    cfg.client.default_model = attempt.model_name.clone();
-    cfg.client.api_key = crate::dialog_runtime::resolve_provider_api_key(
-        attempt.provider_api_key_ref.as_deref(),
-        attempt.provider_api_key_encrypted.as_deref(),
-    )
-    .unwrap_or_default();
-
-    if let Some(endpoint) = routed_attempt_endpoint(attempt) {
-        if attempt.discovery_service_name.is_some() || attempt.discovery_endpoint_name.is_some() {
-            cfg.client.base_url = endpoint;
-        } else {
-            cfg.client.direct_url = normalize_chat_completions_url(&endpoint);
-            if attempt
-                .provider_name
-                .eq_ignore_ascii_case(crate::dialog_runtime::VRAM_CLOUD_PROVIDER_NAME)
-            {
-                cfg.client.api_key = config.llm.dialog.aifarm_pool_api_key.clone();
-            }
-        }
-    }
-    if let Some(service) = attempt.discovery_service_name.as_deref() {
-        cfg.client.service_name = service.to_owned();
-    }
-    cfg.client.runtime_hint = attempt.provider_runtime_hint.clone().unwrap_or_default();
-    cfg.client.supports_message_name = attempt.supports_message_name();
-    cfg.client.supports_cache_control = attempt.supports_cache_control();
-    if let Some(endpoint) = attempt.discovery_endpoint_name.as_deref() {
-        cfg.client.endpoint_name = endpoint.to_owned();
-    }
+    cfg.client = crate::provider_transport::openai_client_for_attempt(config, attempt, cfg.client)
+        .map_err(|source| AifarmMemoryExtractorError::Completion {
+            source: Box::new(source),
+        })?;
+    cfg.model.clone_from(&cfg.client.default_model);
     if let Some(max_tokens) = attempt.overrides.max_tokens
         && max_tokens > 0
     {
@@ -4435,17 +4211,7 @@ fn aifarm_memory_config_for_attempt(
     if let Some(include_reasoning) = routed_bool_override(attempt, "include_reasoning") {
         cfg.include_reasoning = Some(include_reasoning);
     }
-    cfg.with_defaults()
-}
-
-fn routed_attempt_endpoint(attempt: &RoutedAttempt) -> Option<String> {
-    attempt
-        .model_base_url
-        .as_deref()
-        .or(attempt.provider_endpoint.as_deref())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .map(str::to_owned)
+    Ok(cfg.with_defaults())
 }
 
 fn routed_bool_override(attempt: &RoutedAttempt, key: &str) -> Option<bool> {
@@ -4456,190 +4222,6 @@ fn routed_f64_override(attempt: &RoutedAttempt, key: &str) -> Option<f64> {
     attempt.overrides.extra.get(key).and_then(Value::as_f64)
 }
 
-/// App memory extractor build error.
-#[derive(Debug, Error)]
-pub enum AppMemoryExtractorBuildError {
-    /// HTTP client construction failed.
-    #[error(transparent)]
-    Http(#[from] reqwest::Error),
-    #[error("unsupported memory consolidation provider {0:?}")]
-    UnsupportedProvider(String),
-    /// Gemini/GenKit provider was requested without an active Google AI key.
-    #[error("google ai key is required for genkit memory extractor")]
-    GoogleAiKeyRequired,
-    /// GenKit OpenAI-compatible provider was requested without its API key.
-    #[error("{provider} api key is required for genkit memory extractor")]
-    ProviderApiKeyRequired {
-        /// Provider name.
-        provider: &'static str,
-    },
-}
-
-/// App memory extractor runtime error.
-#[derive(Debug, Error)]
-pub enum AppMemoryExtractorError {
-    /// AIFarm extraction failed.
-    #[error(transparent)]
-    Aifarm(#[from] openplotva_llm::aifarm::AifarmMemoryExtractorError),
-    /// Gemini/GenKit extraction failed.
-    #[error(transparent)]
-    Gemini(#[from] AppGenkitMemoryExtractorError),
-    /// AIFarm primary failed retryably and Gemini/GenKit fallback failed too, or AIFarm failed terminally.
-    #[error(transparent)]
-    AifarmFallback(
-        #[from]
-        FallbackMemoryExtractorError<AifarmMemoryExtractorError, AppGenkitMemoryExtractorError>,
-    ),
-    #[error(transparent)]
-    AifarmRoute(#[from] AifarmRouteMemoryExtractorError),
-}
-
-impl MemoryExtractor for AppMemoryExtractor {
-    type Error = AppMemoryExtractorError;
-
-    fn extract<'a>(
-        &'a self,
-        input: &'a openplotva_memory::ExtractInput,
-    ) -> MemoryExtractorFuture<'a, Self::Error> {
-        Box::pin(async move {
-            match self {
-                Self::Plain(extractor) => MemoryExtractor::extract(extractor, input)
-                    .await
-                    .map_err(Into::into),
-                Self::Redacting(extractor) => MemoryExtractor::extract(extractor, input)
-                    .await
-                    .map_err(Into::into),
-                Self::AifarmFallback(extractor) => MemoryExtractor::extract(extractor, input)
-                    .await
-                    .map_err(Into::into),
-                Self::RedactingAifarmFallback(extractor) => {
-                    MemoryExtractor::extract(extractor, input)
-                        .await
-                        .map_err(Into::into)
-                }
-                Self::AifarmRoute(extractor) => MemoryExtractor::extract(extractor, input)
-                    .await
-                    .map_err(Into::into),
-                Self::RedactingAifarmRoute(extractor) => MemoryExtractor::extract(extractor, input)
-                    .await
-                    .map_err(Into::into),
-                Self::GeminiPlain(extractor) => MemoryExtractor::extract(extractor, input)
-                    .await
-                    .map_err(Into::into),
-                Self::GeminiRedacting(extractor) => MemoryExtractor::extract(extractor, input)
-                    .await
-                    .map_err(Into::into),
-            }
-        })
-    }
-}
-
-pub fn memory_extractor_from_app_config(
-    config: &AppConfig,
-) -> Result<AppMemoryExtractor, AppMemoryExtractorBuildError> {
-    memory_extractor_from_app_config_with_override(config, None, None)
-}
-
-#[must_use]
-pub fn routed_memory_extractor_from_app_config(
-    config: &AppConfig,
-    walker: RoutedAttemptWalker,
-) -> RoutedMemoryExtractor {
-    RoutedMemoryExtractor::new(walker, config)
-}
-
-#[must_use]
-pub fn routed_subject_merger_from_app_config(
-    config: &AppConfig,
-    walker: RoutedAttemptWalker,
-) -> RoutedSubjectMerger {
-    RoutedSubjectMerger::new(walker, config)
-}
-
-pub fn memory_extractor_from_app_config_with_model(
-    config: &AppConfig,
-    model_override: Option<&str>,
-) -> Result<AppMemoryExtractor, AppMemoryExtractorBuildError> {
-    memory_extractor_from_app_config_with_override(config, None, model_override)
-}
-
-/// Build app memory extractor with optional provider/model override and optional redaction.
-pub fn memory_extractor_from_app_config_with_override(
-    config: &AppConfig,
-    provider_override: Option<&str>,
-    model_override: Option<&str>,
-) -> Result<AppMemoryExtractor, AppMemoryExtractorBuildError> {
-    let provider = memory_extractor_provider(config, provider_override);
-    match provider.as_str() {
-        "aifarm" => {
-            let extractor =
-                aifarm_route_memory_extractor_from_app_config_with_model(config, model_override);
-            let redactor = discovery_redactor_from_app_config(config)?;
-            if let Some(redactor) = redactor {
-                Ok(AppMemoryExtractor::RedactingAifarmRoute(
-                    RedactingMemoryExtractor::new(extractor, redactor),
-                ))
-            } else {
-                Ok(AppMemoryExtractor::AifarmRoute(extractor))
-            }
-        }
-        "genkit" | "gemini" => {
-            let extractor =
-                genkit_memory_extractor_from_app_config_with_model(config, model_override)?;
-            if let Some(redactor) = discovery_redactor_from_app_config(config)? {
-                Ok(AppMemoryExtractor::GeminiRedacting(
-                    RedactingMemoryExtractor::new(extractor, redactor),
-                ))
-            } else {
-                Ok(AppMemoryExtractor::GeminiPlain(extractor))
-            }
-        }
-        other => Err(AppMemoryExtractorBuildError::UnsupportedProvider(
-            other.to_owned(),
-        )),
-    }
-}
-
-fn memory_extractor_provider(config: &AppConfig, provider_override: Option<&str>) -> String {
-    let provider = provider_override
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .unwrap_or_else(|| config.memory.consolidation_provider.trim())
-        .to_ascii_lowercase();
-    if provider.is_empty() {
-        "aifarm".to_owned()
-    } else {
-        provider
-    }
-}
-
-/// Build the reqwest-backed Gemini/GenKit memory extractor with an optional override model.
-pub fn genkit_memory_extractor_from_app_config_with_model(
-    config: &AppConfig,
-    model_override: Option<&str>,
-) -> Result<AppGenkitMemoryExtractor, AppMemoryExtractorBuildError> {
-    let model = genkit_memory_extractor_model(config, model_override);
-    if let Some(cfg) =
-        genkit_openai_compatible_memory_extractor_config_from_app_config(config, &model)?
-    {
-        return Ok(AppGenkitMemoryExtractor::OpenAiCompatible(Box::new(
-            GenkitOpenAiCompatibleMemoryExtractor::new(cfg),
-        )));
-    }
-    let api_key = resolve_google_ai_key(&config.google_ai);
-    if api_key.trim().is_empty() {
-        return Err(AppMemoryExtractorBuildError::GoogleAiKeyRequired);
-    }
-    Ok(AppGenkitMemoryExtractor::Gemini(
-        GeminiMemoryExtractor::new(GeminiMemoryExtractorConfig {
-            api_key,
-            model,
-            request_timeout: positive_seconds(config.memory.consolidation_timeout_seconds),
-            ..GeminiMemoryExtractorConfig::default()
-        }),
-    ))
-}
-
 #[must_use]
 pub fn genkit_memory_extractor_model(config: &AppConfig, model_override: Option<&str>) -> String {
     if let Some(model) = model_override
@@ -4664,45 +4246,6 @@ pub fn genkit_runtime_default_model(config: &AppConfig) -> String {
     }
 }
 
-fn genkit_openai_compatible_memory_extractor_config_from_app_config(
-    config: &AppConfig,
-    model: &str,
-) -> Result<Option<GenkitOpenAiCompatibleMemoryExtractorConfig>, AppMemoryExtractorBuildError> {
-    let model = model.trim();
-    let (direct_url, api_key, model, request_timeout_seconds, provider) =
-        if let Some(model) = strip_provider_prefix_fold(model, OPENROUTER_MODEL_PREFIX) {
-            (
-                OPENROUTER_CHAT_COMPLETIONS_URL,
-                config.open_router.key.trim().to_owned(),
-                model.trim().to_owned(),
-                config.open_router.request_timeout_seconds,
-                "openrouter",
-            )
-        } else {
-            return Ok(None);
-        };
-    if model.is_empty() {
-        return Ok(None);
-    }
-    if api_key.trim().is_empty() {
-        return Err(AppMemoryExtractorBuildError::ProviderApiKeyRequired { provider });
-    }
-    Ok(Some(GenkitOpenAiCompatibleMemoryExtractorConfig {
-        direct_url: direct_url.to_owned(),
-        api_key,
-        model,
-        request_timeout: positive_seconds(request_timeout_seconds),
-        ..GenkitOpenAiCompatibleMemoryExtractorConfig::default()
-    }))
-}
-
-fn strip_provider_prefix_fold<'a>(value: &'a str, prefix: &str) -> Option<&'a str> {
-    value
-        .get(..prefix.len())
-        .is_some_and(|head| head.eq_ignore_ascii_case(prefix))
-        .then(|| &value[prefix.len()..])
-}
-
 #[must_use]
 pub fn memory_service_worker_config_from_memory_config(
     config: &MemoryConfig,
@@ -4750,15 +4293,6 @@ pub fn discovery_redactor_config_from_app_config(
     )
 }
 
-/// Build the reqwest-backed Discovery privacy-filter redactor.
-pub fn discovery_redactor_from_app_config(
-    config: &AppConfig,
-) -> Result<Option<DiscoveryRedactor>, reqwest::Error> {
-    discovery_redactor_config_from_app_config(config)
-        .map(DiscoveryRedactor::new)
-        .transpose()
-}
-
 #[must_use]
 pub fn aifarm_memory_extractor_model(
     memory: &MemoryConfig,
@@ -4809,6 +4343,77 @@ fn runtime_memory_restart_model(model: &str) -> String {
     }
 }
 
+pub(crate) fn build_memory_retention_worker_group(
+    store: &PostgresMemoryStore,
+    stops: &crate::RuntimeWorkerStops,
+) -> (
+    crate::RuntimeWorkerGroup,
+    Vec<openplotva_server::ReadinessCheck>,
+) {
+    use crate::{RuntimeWorkerGroup, RuntimeWorkerPhase, wait_for_runtime_stop};
+    use openplotva_server::ReadinessCheck;
+    let mut group = RuntimeWorkerGroup::new(RuntimeWorkerPhase::Ancillary);
+    let mut readiness = Vec::with_capacity(3);
+
+    let archival_store = store.clone();
+    let archival_stop = stops.subscribe(RuntimeWorkerPhase::Ancillary);
+    let worker = tokio::spawn(async move {
+        let report = run_memory_card_archival_worker_until(
+            archival_store,
+            MEMORY_CARD_ARCHIVAL_INTERVAL,
+            MEMORY_CARD_ARCHIVAL_BATCH,
+            wait_for_runtime_stop(archival_stop),
+        )
+        .await;
+        tracing::info!(?report, "memory card archival worker stopped");
+    });
+    readiness.push(ReadinessCheck::ok(
+        "memory_card_archival",
+        "Expired memory cards archived hourly (durability-based forgetting)",
+    ));
+    group.register("memory-card-archival", worker);
+
+    let decay_store = store.clone();
+    let decay_stop = stops.subscribe(RuntimeWorkerPhase::Ancillary);
+    let decay_worker = tokio::spawn(async move {
+        let report = run_memory_card_decay_worker_until(
+            decay_store,
+            MEMORY_CARD_DECAY_INTERVAL,
+            MEMORY_CARD_DECAY_BATCH,
+            MEMORY_CARD_DECAY_GRACE_DAYS,
+            MEMORY_CARD_DECAY_SALIENCE_MAX,
+            MEMORY_CARD_DECAY_COLD_DAYS,
+            wait_for_runtime_stop(decay_stop),
+        )
+        .await;
+        tracing::info!(?report, "memory card decay worker stopped");
+    });
+    readiness.push(ReadinessCheck::ok(
+        "memory_card_decay",
+        "Cold never-expiring cards given a grace TTL (bounded forgetting)",
+    ));
+    group.register("memory-card-decay", decay_worker);
+
+    let collapse_store = store.clone();
+    let collapse_stop = stops.subscribe(RuntimeWorkerPhase::Ancillary);
+    let collapse_worker = tokio::spawn(async move {
+        let report = run_memory_duplicate_collapse_worker_until(
+            collapse_store,
+            MEMORY_DUP_COLLAPSE_INTERVAL,
+            MEMORY_DUP_COLLAPSE_GROUP_LIMIT,
+            wait_for_runtime_stop(collapse_stop),
+        )
+        .await;
+        tracing::info!(?report, "memory duplicate collapse worker stopped");
+    });
+    readiness.push(ReadinessCheck::ok(
+        "memory_dup_collapse",
+        "Exact-duplicate memory cards collapsed every 6h (off-hours backlog cleanup)",
+    ));
+    group.register("memory-duplicate-collapse", collapse_worker);
+    (group, readiness)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -4827,6 +4432,7 @@ mod tests {
         let path = std::env::var("PATH").expect("test process PATH");
         let config = AppConfig::from_raw(openplotva_config::RawConfig::default()).expect("config");
         let attempt = RoutedAttempt {
+            protocol: Some(openplotva_llm::provider_schema::Protocol::OpenAiCompat),
             provider_id: 7,
             model_id: 11,
             provider_name: "aifarm-ninfer-gpu2".to_owned(),
@@ -4845,7 +4451,7 @@ mod tests {
             variant: None,
         };
 
-        let routed = aifarm_memory_config_for_attempt(&config, &attempt);
+        let routed = aifarm_memory_config_for_attempt(&config, &attempt).expect("config");
 
         assert_eq!(routed.client.api_key, path);
     }
@@ -5759,36 +5365,6 @@ mod tests {
         assert_eq!(cfg.enqueue_policy.min_messages_per_run, 21);
     }
 
-    #[test]
-    fn aifarm_memory_route_plan_ignores_hidden_pool_backends() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            dialog_aifarm_pool_models: Some("pool-a,pool-b".to_owned()),
-            dialog_aifarm_pool_base_urls: Some(
-                "https://pool-a.test/v1,https://pool-b.test/v1/chat/completions".to_owned(),
-            ),
-            dialog_aifarm_pool_api_key: Some("pool-key".to_owned()),
-            llm_provider_names: Some("qwen-reasoner".to_owned()),
-            llm_provider_kinds: Some("aifarm".to_owned()),
-            llm_provider_discovery_service_names: Some("custom-qwen".to_owned()),
-            llm_provider_models: Some("custom-qwen-model".to_owned()),
-            memory_consolidation_model: Some("primary-memory".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        let plan = aifarm_memory_route_plan_from_app_config(&config);
-
-        assert_eq!(
-            plan.backends
-                .iter()
-                .map(|backend| backend.label.as_str())
-                .collect::<Vec<_>>(),
-            vec!["primary"]
-        );
-        assert_eq!(plan.backends[0].service_name, "llm-openai");
-        assert_eq!(plan.backends[0].model, "primary-memory");
-    }
-
     #[tokio::test]
     async fn runtime_memory_restarter_retries_specific_run_and_triggers_worker() {
         let trigger = Arc::new(tokio::sync::Notify::new());
@@ -5887,7 +5463,7 @@ mod tests {
         assert_eq!(cfg.poll_interval, Duration::from_secs(2));
         assert_eq!(
             cfg.capacity_wait,
-            openplotva_memory::DEFAULT_MEMORY_REDACTION_CAPACITY_WAIT
+            openplotva_llm::redaction::DEFAULT_MEMORY_REDACTION_CAPACITY_WAIT
         );
         assert_eq!(cfg.capacity_poll_interval, Duration::from_secs(3));
         assert_eq!(cfg.categories, vec!["private_email", "secret"]);
@@ -5904,139 +5480,6 @@ mod tests {
         assert!(discovery_redactor_config_from_app_config(&config).is_none());
     }
 
-    #[test]
-    fn app_memory_extractor_composes_fail_open_redaction_when_enabled() {
-        let redacting = AppConfig::from_raw(openplotva_config::RawConfig {
-            memory_redaction_enabled: Some("true".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("redacting config");
-        let plain = AppConfig::from_raw(openplotva_config::RawConfig {
-            memory_redaction_enabled: Some("false".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("plain config");
-
-        assert!(matches!(
-            memory_extractor_from_app_config(&redacting).expect("redacting extractor"),
-            AppMemoryExtractor::RedactingAifarmRoute(_)
-        ));
-        assert!(matches!(
-            memory_extractor_from_app_config(&plain).expect("plain extractor"),
-            AppMemoryExtractor::AifarmRoute(_)
-        ));
-    }
-
-    #[test]
-    fn app_memory_extractor_keeps_aifarm_route_when_google_key_resolves() {
-        let plain = AppConfig::from_raw(openplotva_config::RawConfig {
-            googleai_key: Some(" google-key ".to_owned()),
-            memory_redaction_enabled: Some("false".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("plain config");
-        let redacting = AppConfig::from_raw(openplotva_config::RawConfig {
-            googleai_key: Some(" google-key ".to_owned()),
-            memory_redaction_enabled: Some("true".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("redacting config");
-
-        assert!(matches!(
-            memory_extractor_from_app_config(&plain).expect("route extractor"),
-            AppMemoryExtractor::AifarmRoute(_)
-        ));
-        assert!(matches!(
-            memory_extractor_from_app_config_with_override(
-                &redacting,
-                Some("aifarm"),
-                Some(" override-model ")
-            )
-            .expect("redacting route extractor"),
-            AppMemoryExtractor::RedactingAifarmRoute(_)
-        ));
-    }
-
-    #[test]
-    fn app_memory_extractor_builds_genkit_gemini_when_configured() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            memory_consolidation_provider: Some(" genkit ".to_owned()),
-            memory_redaction_enabled: Some("false".to_owned()),
-            googleai_key: Some(" google-key ".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        assert!(matches!(
-            memory_extractor_from_app_config(&config).expect("gemini extractor"),
-            AppMemoryExtractor::GeminiPlain(_)
-        ));
-        assert_eq!(
-            genkit_memory_extractor_model(&config, None),
-            MODEL_GEMINI_FLASH_LITE
-        );
-        assert_eq!(
-            genkit_memory_extractor_model(&config, Some(" custom-model ")),
-            "custom-model"
-        );
-    }
-
-    #[test]
-    fn app_memory_extractor_builds_genkit_openai_compatible_models() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            memory_consolidation_provider: Some(" genkit ".to_owned()),
-            memory_redaction_enabled: Some("false".to_owned()),
-            genkit_default_model: Some(" openrouter/provider-model ".to_owned()),
-            openrouter_key: Some(" openrouter-key ".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        assert!(matches!(
-            memory_extractor_from_app_config(&config).expect("openrouter extractor"),
-            AppMemoryExtractor::GeminiPlain(AppGenkitMemoryExtractor::OpenAiCompatible(_))
-        ));
-        assert_eq!(
-            genkit_memory_extractor_model(&config, None),
-            "openrouter/provider-model"
-        );
-    }
-
-    #[test]
-    fn app_memory_extractor_requires_google_key_for_genkit() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            memory_consolidation_provider: Some("gemini".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        assert!(matches!(
-            memory_extractor_from_app_config(&config),
-            Err(AppMemoryExtractorBuildError::GoogleAiKeyRequired)
-        ));
-        assert_eq!(
-            genkit_memory_extractor_model(&config, None),
-            MODEL_GEMINI_FLASH_FALLBACK
-        );
-    }
-
-    #[test]
-    fn app_memory_extractor_requires_plugin_key_for_genkit_openai_compatible_models() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            memory_consolidation_provider: Some("genkit".to_owned()),
-            genkit_default_model: Some("openrouter/provider-model".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        assert!(matches!(
-            memory_extractor_from_app_config(&config),
-            Err(AppMemoryExtractorBuildError::ProviderApiKeyRequired {
-                provider: "openrouter"
-            })
-        ));
-    }
-
     #[test]
     fn memory_embedder_builds_discovery_client_with_defaults() {
         let memory = AppConfig::from_raw(openplotva_config::RawConfig::default())
diff --git a/crates/openplotva-app/src/memory_workers.rs b/crates/openplotva-app/src/memory_workers.rs
new file mode 100644
index 00000000..d2e1b04d
--- /dev/null
+++ b/crates/openplotva-app/src/memory_workers.rs
@@ -0,0 +1,194 @@
+//! Scheduler, scaling, and worker lifetimes for memory consolidation.
+use crate::{
+    RuntimeWorkerGroup, RuntimeWorkerPhase, RuntimeWorkerStops, dialog_workers,
+    embedder::RoutedDiscoveryEmbedder,
+    memory_runtime::{
+        self, MemoryServiceWorkerConfig, MemorySubjectMergeConfig, RoutedMemoryExtractor,
+        RoutedSubjectMerger,
+    },
+    model_routing::LaneWorkerScale,
+    wait_for_runtime_stop,
+};
+use openplotva_server::ReadinessCheck;
+use openplotva_storage::PostgresMemoryStore;
+use openplotva_taskman::InMemoryTaskQueue;
+use std::sync::Arc;
+
+pub(crate) struct MemoryTaskmanWorkerInputs {
+    pub(crate) store: PostgresMemoryStore,
+    pub(crate) queue: Arc<InMemoryTaskQueue>,
+    pub(crate) config: MemoryServiceWorkerConfig,
+    pub(crate) trigger: Arc<tokio::sync::Notify>,
+    pub(crate) extractor: RoutedMemoryExtractor,
+    pub(crate) embedder: Option<RoutedDiscoveryEmbedder>,
+    pub(crate) merger: Option<(RoutedSubjectMerger, MemorySubjectMergeConfig)>,
+    pub(crate) worker_floor: i32,
+    pub(crate) workers_per_lane: i32,
+    pub(crate) worker_cap: i32,
+}
+
+pub(crate) struct MemoryTaskmanWorkers {
+    pub(crate) ingress: RuntimeWorkerGroup,
+    pub(crate) processors: RuntimeWorkerGroup,
+    pub(crate) scale: Option<LaneWorkerScale>,
+    pub(crate) count: u32,
+    pub(crate) readiness: Vec<ReadinessCheck>,
+}
+
+pub(crate) fn build_taskman_workers(
+    inputs: MemoryTaskmanWorkerInputs,
+    stops: &RuntimeWorkerStops,
+    table: &openplotva_llm::router::RoutingTable,
+) -> MemoryTaskmanWorkers {
+    let MemoryTaskmanWorkerInputs {
+        store,
+        queue,
+        config,
+        trigger,
+        extractor,
+        embedder,
+        merger,
+        worker_floor,
+        workers_per_lane,
+        worker_cap,
+    } = inputs;
+    let mut ingress = RuntimeWorkerGroup::new(RuntimeWorkerPhase::Ingress);
+    let mut processors = RuntimeWorkerGroup::new(RuntimeWorkerPhase::Processor);
+    let mut readiness = Vec::with_capacity(2);
+    let mut worker_scale = None;
+    let memory_scheduler_store = store.clone();
+    let memory_scheduler_queue = Arc::clone(&queue);
+    let memory_scheduler_config = config.clone();
+    let memory_scheduler_trigger = Arc::clone(&trigger);
+    let memory_scheduler_stop = stops.subscribe(RuntimeWorkerPhase::Ingress);
+    let memory_scheduler = tokio::spawn(async move {
+        let report = memory_runtime::run_memory_consolidation_taskman_scheduler_with_trigger_until(
+            &memory_scheduler_store,
+            memory_scheduler_queue.as_ref(),
+            memory_scheduler_config,
+            memory_scheduler_trigger,
+            wait_for_runtime_stop(memory_scheduler_stop),
+        )
+        .await;
+
+        tracing::info!(?report, "memory-consolidation taskman scheduler stopped");
+    });
+    ingress.register("memory-consolidation-scheduler", memory_scheduler);
+
+    // Memory workers follow the memory primary's lanes; the configured
+    // count is the floor and `0` disables them.
+    let configured_memory_worker_count = u32::try_from(worker_floor.max(0)).unwrap_or(0);
+    let worker_count = if configured_memory_worker_count == 0 {
+        0
+    } else {
+        let (scale, desired) = tokio::sync::watch::channel(configured_memory_worker_count);
+        let lanes = LaneWorkerScale {
+            workflow_key: memory_runtime::MEMORY_EXTRACTION_WORKFLOW_KEY,
+            per_lane: u32::try_from(workers_per_lane.max(1)).unwrap_or(1),
+            floor: configured_memory_worker_count,
+            cap: u32::try_from(worker_cap.max(1)).unwrap_or(1),
+            scale,
+        };
+        let initial = lanes
+            .desired(table)
+            .unwrap_or(configured_memory_worker_count);
+        let _ = lanes.scale.send(initial);
+        tracing::info!(
+            configured_workers = configured_memory_worker_count,
+            initial_workers = initial,
+            cap = lanes.cap,
+            "memory-consolidation worker scale derived from lane pools"
+        );
+        worker_scale = Some(lanes);
+
+        let memory_worker_spawner = {
+            let extractor = extractor.clone();
+            let store = store.clone();
+            let embedder = embedder.clone();
+            let queue = Arc::clone(&queue);
+            let process = config.clone().process;
+            let desired = desired.clone();
+            let stop_rx = stops.subscribe(RuntimeWorkerPhase::Processor);
+            move |index: usize, retire: tokio::sync::oneshot::Receiver<()>| {
+                let worker_extractor = extractor.clone();
+                let worker_store = store.clone();
+                let worker_embedder = embedder.clone();
+                let worker_queue = Arc::clone(&queue);
+                let worker_id = format!(
+                    "{}-{index}",
+                    memory_runtime::MEMORY_CONSOLIDATION_JOB_WORKER_PREFIX
+                );
+                let worker_config = memory_runtime::MemoryConsolidationQueueWorkerConfig {
+                    process: process.clone(),
+                    worker_id: worker_id.clone(),
+                    interval: memory_runtime::MEMORY_CONSOLIDATION_JOB_POLL_INTERVAL,
+                    pipeline_target: usize::try_from(*desired.borrow()).unwrap_or(1),
+                };
+                let worker_stop = stop_rx.clone();
+                tokio::spawn(async move {
+                    // A retired worker finishes its current run and exits
+                    // at the next loop tick, exactly like a runtime stop.
+                    let stop_future = async move {
+                        tokio::select! {
+                            () = wait_for_runtime_stop(worker_stop) => {}
+                            _ = retire => {}
+                        }
+                    };
+                    let report = memory_runtime::run_memory_consolidation_taskman_worker_until(
+                        worker_queue.as_ref(),
+                        &worker_extractor,
+                        &worker_store,
+                        worker_embedder.as_ref(),
+                        worker_config,
+                        stop_future,
+                    )
+                    .await;
+
+                    tracing::info!(?report, %worker_id, "memory-consolidation taskman worker stopped");
+                })
+            }
+        };
+        let memory_supervisor = dialog_workers::spawn_worker_supervisor(
+            Arc::new(memory_worker_spawner),
+            desired,
+            Arc::new(dialog_workers::WorkerGauge::new()),
+            stops.subscribe(RuntimeWorkerPhase::Processor),
+        );
+        processors.register("memory-consolidation-worker-supervisor", memory_supervisor);
+        initial
+    };
+    if let Some((merge_merger, merge_cfg)) = merger {
+        let merge_store = store.clone();
+        let merge_embedder = embedder.clone();
+        let merge_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
+        let merge_worker = tokio::spawn(async move {
+            let report = memory_runtime::run_memory_subject_merge_worker_until(
+                &merge_merger,
+                merge_store,
+                merge_embedder.as_ref(),
+                merge_cfg,
+                wait_for_runtime_stop(merge_stop),
+            )
+            .await;
+            tracing::info!(?report, "memory subject merge-pass worker stopped");
+        });
+        readiness.push(ReadinessCheck::ok(
+                "memory_subject_merge",
+                "Backlog over-extracted (scope,subject) card groups consolidated 24/7 via the LLM merge-pass",
+            ));
+        processors.register("memory-subject-merge", merge_worker);
+    }
+    readiness.push(ReadinessCheck::ok(
+            "memory_service",
+            format!(
+                "Memory service schedules memory-consolidation taskman jobs and starts {worker_count} routed workers over SQLx persistence"
+            ),
+        ));
+    MemoryTaskmanWorkers {
+        ingress,
+        processors,
+        scale: worker_scale,
+        count: worker_count,
+        readiness,
+    }
+}
diff --git a/crates/openplotva-app/src/model_routing.rs b/crates/openplotva-app/src/model_routing.rs
index 1fb1d234..37fe4e07 100644
--- a/crates/openplotva-app/src/model_routing.rs
+++ b/crates/openplotva-app/src/model_routing.rs
@@ -17,6 +17,8 @@ use openplotva_llm::router::{
     ProviderRow, RetryBudget, RouterHandle, RoutingTable, Scope, WorkflowRoute,
 };
 use openplotva_storage::StorageError;
+use openplotva_storage::app_settings::{app_setting_present, upsert_app_setting};
+use openplotva_storage::llm_routing::begin_bootstrap_update;
 use openplotva_storage::llm_routing::{
     AssignmentInput, AssignmentRecord, ModelInput, ModelRecord, ProviderInput, ProviderRecord,
     RoutingSnapshot, TriggerInput, TriggerRecord, WorkflowRecord, insert_assignment, insert_model,
@@ -25,7 +27,7 @@ use openplotva_storage::llm_routing::{
     update_provider,
 };
 use serde_json::{Value, json};
-use sqlx::PgPool;
+use sqlx::{PgConnection, PgPool};
 
 /// Read the snapshot and build a routing table in one step.
 pub async fn load_routing_table(pool: &PgPool) -> Result<RoutingTable, StorageError> {
@@ -53,43 +55,16 @@ pub const PROTOCOL_DISCOVERY_DRAW: &str = "discovery_draw";
 pub const PROTOCOL_DISCOVERY_ASR: &str = "discovery_asr";
 pub const PROTOCOL_PRIVACY_FILTER: &str = "privacy_filter";
 
-async fn app_setting_present(pool: &PgPool, key: &str) -> Result<bool, StorageError> {
-    let row = sqlx::query("SELECT value FROM app_settings WHERE key = $1")
-        .bind(key)
-        .fetch_optional(pool)
-        .await?;
-    Ok(row.is_some())
-}
-
-async fn mark_app_setting(pool: &PgPool, key: &str) -> Result<(), StorageError> {
-    sqlx::query(
-        "INSERT INTO app_settings (key, value, updated_at) VALUES ($1, '1', NOW()) \
-         ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()",
-    )
-    .bind(key)
-    .execute(pool)
-    .await?;
-    Ok(())
-}
-
-async fn already_seeded(pool: &PgPool) -> Result<bool, StorageError> {
-    app_setting_present(pool, SEEDED_KEY).await
-}
-
-async fn mark_seeded(pool: &PgPool) -> Result<(), StorageError> {
-    mark_app_setting(pool, SEEDED_KEY).await
-}
-
 /// Insert one provider plus one model and return their ids.
 async fn seed_provider_model(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     provider: ProviderInput,
     model_name: &str,
     base_url: Option<&str>,
     capabilities: &[&str],
     embedding_dim: Option<i32>,
 ) -> Result<i64, StorageError> {
-    let provider_id = insert_provider(pool, &provider).await?;
+    let provider_id = insert_provider(&mut *pool, &provider).await?;
     let model = ModelInput {
         provider_id,
         model_name: model_name.to_owned(),
@@ -101,7 +76,7 @@ async fn seed_provider_model(
         enabled: true,
         config: json!({}),
     };
-    insert_model(pool, &model).await
+    insert_model(&mut *pool, &model).await
 }
 
 fn chat_provider(
@@ -134,13 +109,13 @@ fn chat_provider(
 }
 
 async fn seed_primary(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     workflow: &str,
     model_id: i64,
     weight: Option<i32>,
 ) -> Result<i64, StorageError> {
     insert_assignment(
-        pool,
+        &mut *pool,
         &AssignmentInput {
             workflow_key: workflow.to_owned(),
             scope: "global".to_owned(),
@@ -171,7 +146,10 @@ pub async fn seed_routing_from_env(
     pool: &PgPool,
     config: &AppConfig,
 ) -> Result<bool, StorageError> {
-    if already_seeded(pool).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+
+    if app_setting_present(&mut *pool, SEEDED_KEY).await? {
         return Ok(false);
     }
 
@@ -321,7 +299,7 @@ pub async fn seed_routing_from_env(
     // --- dialog: weighted primary + ordered fallback + queue-depth overflow ---
     seed_primary(pool, "dialog", aifarm_model, Some(100)).await?;
     insert_assignment(
-        pool,
+        &mut *pool,
         &AssignmentInput {
             workflow_key: "dialog".to_owned(),
             scope: "global".to_owned(),
@@ -338,7 +316,7 @@ pub async fn seed_routing_from_env(
     )
     .await?;
     let overflow_assignment = insert_assignment(
-        pool,
+        &mut *pool,
         &AssignmentInput {
             workflow_key: "dialog".to_owned(),
             scope: "global".to_owned(),
@@ -355,7 +333,7 @@ pub async fn seed_routing_from_env(
     )
     .await?;
     insert_trigger(
-        pool,
+        &mut *pool,
         &TriggerInput {
             workflow_key: "dialog".to_owned(),
             trigger_type: "queue_depth".to_owned(),
@@ -389,7 +367,8 @@ pub async fn seed_routing_from_env(
         seed_primary(pool, workflow, aifarm_model, None).await?;
     }
 
-    mark_seeded(pool).await?;
+    upsert_app_setting(&mut *pool, SEEDED_KEY, "1").await?;
+    transaction.commit().await?;
     tracing::info!("seeded LLM routing tables from env configuration");
     Ok(true)
 }
@@ -422,7 +401,9 @@ pub async fn backfill_vram_cloud_from_env(
     if dialog.aifarm_pool_models.is_empty() {
         return Ok(false);
     }
-    if list_providers(pool)
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+    if list_providers(&mut *pool)
         .await?
         .iter()
         .any(|p| p.name == VRAM_CLOUD_PROVIDER)
@@ -431,7 +412,7 @@ pub async fn backfill_vram_cloud_from_env(
     }
 
     let provider_id = insert_provider(
-        pool,
+        &mut *pool,
         &ProviderInput {
             name: VRAM_CLOUD_PROVIDER.to_owned(),
             kind: "chat".to_owned(),
@@ -455,7 +436,7 @@ pub async fn backfill_vram_cloud_from_env(
             .or_else(|| dialog.aifarm_pool_base_urls.first())
             .cloned();
         let model_id = insert_model(
-            pool,
+            &mut *pool,
             &ModelInput {
                 provider_id,
                 model_name: model_name.clone(),
@@ -472,6 +453,7 @@ pub async fn backfill_vram_cloud_from_env(
         seed_primary(pool, "dialog", model_id, Some(33)).await?;
     }
 
+    transaction.commit().await?;
     tracing::info!(
         models = dialog.aifarm_pool_models.len(),
         "backfilled VRAM Cloud models into routing tables"
@@ -483,10 +465,13 @@ pub async fn backfill_vram_cloud_from_env(
 /// smokes confirm image/video input, and add them behind the existing vision
 /// primary. The existence checks keep operator-defined assignments intact.
 pub async fn backfill_vram_cloud_vision_fallback(pool: &PgPool) -> Result<bool, StorageError> {
-    if app_setting_present(pool, VRAM_CLOUD_VISION_BACKFILL_KEY).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+
+    if app_setting_present(&mut *pool, VRAM_CLOUD_VISION_BACKFILL_KEY).await? {
         return Ok(false);
     }
-    let Some(provider_id) = list_providers(pool)
+    let Some(provider_id) = list_providers(&mut *pool)
         .await?
         .iter()
         .find(|provider| provider.name == VRAM_CLOUD_PROVIDER)
@@ -494,7 +479,7 @@ pub async fn backfill_vram_cloud_vision_fallback(pool: &PgPool) -> Result<bool,
     else {
         return Ok(false);
     };
-    let mut models = list_models(pool).await?;
+    let mut models = list_models(&mut *pool).await?;
     let mut targets = Vec::new();
     for model_name in VRAM_CLOUD_VISION_MODELS {
         let Some(index) = models.iter().position(|model| {
@@ -509,7 +494,7 @@ pub async fn backfill_vram_cloud_vision_fallback(pool: &PgPool) -> Result<bool,
         {
             let mut input = model_input_from_record(&models[index], model_name.to_owned());
             input.capabilities.push("vision".to_owned());
-            update_model(pool, models[index].id, &input).await?;
+            update_model(&mut *pool, models[index].id, &input).await?;
             models[index].capabilities = input.capabilities;
         }
         targets.push(models[index].id);
@@ -518,7 +503,7 @@ pub async fn backfill_vram_cloud_vision_fallback(pool: &PgPool) -> Result<bool,
         return Ok(false);
     }
 
-    let mut assignments = list_assignments(pool).await?;
+    let mut assignments = list_assignments(&mut *pool).await?;
     let mut fallback_order = assignments
         .iter()
         .filter(|assignment| {
@@ -555,7 +540,8 @@ pub async fn backfill_vram_cloud_vision_fallback(pool: &PgPool) -> Result<bool,
         fallback_order += 1;
         added += 1;
     }
-    mark_app_setting(pool, VRAM_CLOUD_VISION_BACKFILL_KEY).await?;
+    upsert_app_setting(&mut *pool, VRAM_CLOUD_VISION_BACKFILL_KEY, "1").await?;
+    transaction.commit().await?;
     tracing::info!(added, "backfilled VRAM Cloud image/video vision fallbacks");
     Ok(true)
 }
@@ -625,7 +611,10 @@ fn assignment_input_from_record(
 /// right workflows. Values are read from config, so it
 /// adapts to whatever each flow is configured to use.
 pub async fn backfill_gpu_models(pool: &PgPool, config: &AppConfig) -> Result<bool, StorageError> {
-    if app_setting_present(pool, GPU_BACKFILL_KEY).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+
+    if app_setting_present(&mut *pool, GPU_BACKFILL_KEY).await? {
         return Ok(false);
     }
 
@@ -652,17 +641,17 @@ pub async fn backfill_gpu_models(pool: &PgPool, config: &AppConfig) -> Result<bo
         return Ok(false);
     }
 
-    let mut provider_ids: std::collections::HashMap<String, i64> = list_providers(pool)
+    let mut provider_ids: std::collections::HashMap<String, i64> = list_providers(&mut *pool)
         .await?
         .into_iter()
         .map(|p| (p.name, p.id))
         .collect();
-    let mut model_ids: std::collections::HashMap<(i64, String), i64> = list_models(pool)
+    let mut model_ids: std::collections::HashMap<(i64, String), i64> = list_models(&mut *pool)
         .await?
         .into_iter()
         .map(|m| ((m.provider_id, m.model_name), m.id))
         .collect();
-    let assignments = list_assignments(pool).await?;
+    let assignments = list_assignments(&mut *pool).await?;
 
     for (workflow, service, endpoint, model) in &targets {
         let provider_name = gpu_provider_name(service, config);
@@ -670,7 +659,7 @@ pub async fn backfill_gpu_models(pool: &PgPool, config: &AppConfig) -> Result<bo
             Some(id) => *id,
             None => {
                 let id = insert_provider(
-                    pool,
+                    &mut *pool,
                     &ProviderInput {
                         name: provider_name.clone(),
                         kind: "chat".to_owned(),
@@ -696,7 +685,7 @@ pub async fn backfill_gpu_models(pool: &PgPool, config: &AppConfig) -> Result<bo
             Some(id) => *id,
             None => {
                 let id = insert_model(
-                    pool,
+                    &mut *pool,
                     &ModelInput {
                         provider_id,
                         model_name: model.clone(),
@@ -721,7 +710,7 @@ pub async fn backfill_gpu_models(pool: &PgPool, config: &AppConfig) -> Result<bo
             && assignment.provider_model_id != model_id
         {
             update_assignment(
-                pool,
+                &mut *pool,
                 assignment.id,
                 &assignment_input_from_record(assignment, model_id),
             )
@@ -729,7 +718,8 @@ pub async fn backfill_gpu_models(pool: &PgPool, config: &AppConfig) -> Result<bo
         }
     }
 
-    mark_app_setting(pool, GPU_BACKFILL_KEY).await?;
+    upsert_app_setting(&mut *pool, GPU_BACKFILL_KEY, "1").await?;
+    transaction.commit().await?;
     tracing::info!("backfilled GPU llama.cpp models and repointed config-only workflows");
     Ok(true)
 }
@@ -740,7 +730,10 @@ pub async fn backfill_dialog_local_reasoner_fallback(
     pool: &PgPool,
     config: &AppConfig,
 ) -> Result<bool, StorageError> {
-    if app_setting_present(pool, DIALOG_QWEN_FALLBACK_KEY).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+
+    if app_setting_present(&mut *pool, DIALOG_QWEN_FALLBACK_KEY).await? {
         return Ok(false);
     }
 
@@ -749,9 +742,9 @@ pub async fn backfill_dialog_local_reasoner_fallback(
         return Ok(false);
     }
 
-    let mut providers = list_providers(pool).await?;
-    let mut models = list_models(pool).await?;
-    let mut assignments = list_assignments(pool).await?;
+    let mut providers = list_providers(&mut *pool).await?;
+    let mut models = list_models(&mut *pool).await?;
+    let mut assignments = list_assignments(&mut *pool).await?;
     let provider_name = gpu_provider_name(&reasoner.discovery_service_name, config);
     if provider_name == "aifarm" {
         return Ok(false);
@@ -810,20 +803,12 @@ pub async fn backfill_dialog_local_reasoner_fallback(
     )
     .await?;
 
-    mark_app_setting(pool, DIALOG_QWEN_FALLBACK_KEY).await?;
+    upsert_app_setting(&mut *pool, DIALOG_QWEN_FALLBACK_KEY, "1").await?;
+    transaction.commit().await?;
     tracing::info!("backfilled dialog GPU local-reasoner fallback");
     Ok(true)
 }
 
-/// Legacy Rust API alias; the persisted setting key remains unchanged.
-#[deprecated(note = "use backfill_dialog_local_reasoner_fallback")]
-pub async fn backfill_dialog_qwen_fallback(
-    pool: &PgPool,
-    config: &AppConfig,
-) -> Result<bool, StorageError> {
-    backfill_dialog_local_reasoner_fallback(pool, config).await
-}
-
 const GENKIT_FLASH_FIX_KEY: &str = "llm.routing.genkit_flash_fixed";
 const DECLARATIVE_V2_KEY: &str = "llm.routing.declarative_v2";
 const IMAGE_DRAW_API_PRIMARY_KEY: &str = "llm.routing.image_draw_api_primary";
@@ -865,25 +850,28 @@ pub async fn backfill_genkit_flash_model(
     pool: &PgPool,
     config: &AppConfig,
 ) -> Result<bool, StorageError> {
-    if app_setting_present(pool, GENKIT_FLASH_FIX_KEY).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+
+    if app_setting_present(&mut *pool, GENKIT_FLASH_FIX_KEY).await? {
         return Ok(false);
     }
     let canonical = crate::memory_runtime::genkit_runtime_default_model(config);
     if canonical.trim().is_empty() || canonical == STALE_GENKIT_FLASH_MODEL {
         return Ok(false);
     }
-    let provider_ids: std::collections::HashSet<i64> = list_providers(pool)
+    let provider_ids: std::collections::HashSet<i64> = list_providers(&mut *pool)
         .await?
         .into_iter()
         .filter(|p| p.name == "genkit" || p.name == "gemini")
         .map(|p| p.id)
         .collect();
     let mut fixed = 0usize;
-    for model in list_models(pool).await? {
+    for model in list_models(&mut *pool).await? {
         if provider_ids.contains(&model.provider_id) && model.model_name == STALE_GENKIT_FLASH_MODEL
         {
             update_model(
-                pool,
+                &mut *pool,
                 model.id,
                 &model_input_from_record(&model, canonical.clone()),
             )
@@ -891,7 +879,8 @@ pub async fn backfill_genkit_flash_model(
             fixed += 1;
         }
     }
-    mark_app_setting(pool, GENKIT_FLASH_FIX_KEY).await?;
+    upsert_app_setting(&mut *pool, GENKIT_FLASH_FIX_KEY, "1").await?;
+    transaction.commit().await?;
     tracing::info!(
         fixed,
         canonical = %canonical,
@@ -929,14 +918,14 @@ fn assignment_exists(
 }
 
 async fn ensure_provider(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     providers: &mut Vec<ProviderRecord>,
     input: ProviderInput,
 ) -> Result<i64, StorageError> {
     if let Some(id) = existing_provider_id(providers, &input.name) {
         return Ok(id);
     }
-    let id = insert_provider(pool, &input).await?;
+    let id = insert_provider(&mut *pool, &input).await?;
     providers.push(ProviderRecord {
         id,
         name: input.name,
@@ -955,14 +944,14 @@ async fn ensure_provider(
 }
 
 async fn ensure_model(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     models: &mut Vec<ModelRecord>,
     input: ModelInput,
 ) -> Result<i64, StorageError> {
     if let Some(id) = existing_model_id(models, input.provider_id, &input.model_name) {
         return Ok(id);
     }
-    let id = insert_model(pool, &input).await?;
+    let id = insert_model(&mut *pool, &input).await?;
     models.push(ModelRecord {
         id,
         provider_id: input.provider_id,
@@ -979,7 +968,7 @@ async fn ensure_model(
 }
 
 async fn ensure_assignment(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     assignments: &mut Vec<AssignmentRecord>,
     input: AssignmentInput,
 ) -> Result<i64, StorageError> {
@@ -991,7 +980,7 @@ async fn ensure_assignment(
     }) {
         return Ok(existing.id);
     }
-    let id = insert_assignment(pool, &input).await?;
+    let id = insert_assignment(&mut *pool, &input).await?;
     assignments.push(AssignmentRecord {
         id,
         workflow_key: input.workflow_key,
@@ -1010,7 +999,7 @@ async fn ensure_assignment(
 }
 
 async fn ensure_primary_assignment(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     assignments: &mut Vec<AssignmentRecord>,
     workflow: &str,
     model_id: i64,
@@ -1037,7 +1026,7 @@ async fn ensure_primary_assignment(
 }
 
 async fn ensure_draw_api_provider(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     providers: &mut Vec<ProviderRecord>,
     config: &AppConfig,
 ) -> Result<i64, StorageError> {
@@ -1058,7 +1047,7 @@ async fn ensure_draw_api_provider(
         }),
     };
     let draw_provider_id = ensure_provider(pool, providers, provider_input.clone()).await?;
-    update_provider(pool, draw_provider_id, &provider_input).await?;
+    update_provider(&mut *pool, draw_provider_id, &provider_input).await?;
     if let Some(provider) = providers
         .iter_mut()
         .find(|provider| provider.id == draw_provider_id)
@@ -1079,7 +1068,7 @@ async fn ensure_draw_api_provider(
 }
 
 async fn ensure_draw_api_model(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     providers: &mut Vec<ProviderRecord>,
     models: &mut Vec<ModelRecord>,
     config: &AppConfig,
@@ -1092,7 +1081,7 @@ async fn ensure_draw_api_model(
         crate::image_jobs::AIFARM_DRAW_API_ENDPOINT_NAME,
     );
     let draw_model_id = ensure_model(pool, models, model_input.clone()).await?;
-    update_model(pool, draw_model_id, &model_input).await?;
+    update_model(&mut *pool, draw_model_id, &model_input).await?;
     if let Some(model) = models.iter_mut().find(|model| model.id == draw_model_id) {
         model.provider_id = model_input.provider_id;
         model.model_name = model_input.model_name;
@@ -1130,7 +1119,7 @@ fn draw_api_model_input(
 }
 
 async fn ensure_draw_api_endpoint_model(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     models: &mut Vec<ModelRecord>,
     provider_id: i64,
     model_name: &str,
@@ -1139,7 +1128,7 @@ async fn ensure_draw_api_endpoint_model(
 ) -> Result<i64, StorageError> {
     let model_input = draw_api_model_input(provider_id, model_name, display_name, endpoint_name);
     let model_id = ensure_model(pool, models, model_input.clone()).await?;
-    update_model(pool, model_id, &model_input).await?;
+    update_model(&mut *pool, model_id, &model_input).await?;
     if let Some(model) = models.iter_mut().find(|model| model.id == model_id) {
         model.provider_id = model_input.provider_id;
         model.model_name = model_input.model_name;
@@ -1154,7 +1143,7 @@ async fn ensure_draw_api_endpoint_model(
 }
 
 async fn ensure_image_generation_draw_api_primary_assignment(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     assignments: &mut Vec<AssignmentRecord>,
     draw_model_id: i64,
 ) -> Result<(), StorageError> {
@@ -1181,7 +1170,7 @@ async fn ensure_image_generation_draw_api_primary_assignment(
         if should_enable {
             input.weight = Some(100);
         }
-        update_assignment(pool, assignment.id, &input).await?;
+        update_assignment(&mut *pool, assignment.id, &input).await?;
         assignment.enabled = input.enabled;
         assignment.weight = input.weight;
     }
@@ -1208,16 +1197,28 @@ pub async fn backfill_declarative_v2(
     pool: &PgPool,
     config: &AppConfig,
 ) -> Result<bool, StorageError> {
-    if app_setting_present(pool, DECLARATIVE_V2_KEY).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+
+    if app_setting_present(&mut *pool, DECLARATIVE_V2_KEY).await? {
         return Ok(false);
     }
 
-    insert_workflow_if_missing(pool, IMAGE_EDIT_WORKFLOW, "image", true, 3, 60_000, true).await?;
+    insert_workflow_if_missing(
+        &mut *pool,
+        IMAGE_EDIT_WORKFLOW,
+        "image",
+        true,
+        3,
+        60_000,
+        true,
+    )
+    .await?;
 
-    let mut providers = list_providers(pool).await?;
-    let mut models = list_models(pool).await?;
-    let mut assignments = list_assignments(pool).await?;
-    let triggers = openplotva_storage::llm_routing::list_triggers(pool).await?;
+    let mut providers = list_providers(&mut *pool).await?;
+    let mut models = list_models(&mut *pool).await?;
+    let mut assignments = list_assignments(&mut *pool).await?;
+    let triggers = openplotva_storage::llm_routing::list_triggers(&mut *pool).await?;
 
     let draw_model_id = ensure_draw_api_model(pool, &mut providers, &mut models, config).await?;
     ensure_primary_assignment(
@@ -1359,7 +1360,7 @@ pub async fn backfill_declarative_v2(
                 });
                 if !trigger_exists(&triggers, "dialog", "provider_capacity", &params) {
                     insert_trigger(
-                        pool,
+                        &mut *pool,
                         &TriggerInput {
                             workflow_key: "dialog".to_owned(),
                             trigger_type: "provider_capacity".to_owned(),
@@ -1377,7 +1378,8 @@ pub async fn backfill_declarative_v2(
         }
     }
 
-    mark_app_setting(pool, DECLARATIVE_V2_KEY).await?;
+    upsert_app_setting(&mut *pool, DECLARATIVE_V2_KEY, "1").await?;
+    transaction.commit().await?;
     tracing::info!("backfilled declarative routing v2 rows");
     Ok(true)
 }
@@ -1386,19 +1388,32 @@ pub async fn backfill_image_generation_draw_api_primary(
     pool: &PgPool,
     config: &AppConfig,
 ) -> Result<bool, StorageError> {
-    if app_setting_present(pool, IMAGE_DRAW_API_PRIMARY_KEY).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+
+    if app_setting_present(&mut *pool, IMAGE_DRAW_API_PRIMARY_KEY).await? {
         return Ok(false);
     }
 
-    insert_workflow_if_missing(pool, "image_generation", "image", true, 3, 60_000, true).await?;
-    let mut providers = list_providers(pool).await?;
-    let mut models = list_models(pool).await?;
-    let mut assignments = list_assignments(pool).await?;
+    insert_workflow_if_missing(
+        &mut *pool,
+        "image_generation",
+        "image",
+        true,
+        3,
+        60_000,
+        true,
+    )
+    .await?;
+    let mut providers = list_providers(&mut *pool).await?;
+    let mut models = list_models(&mut *pool).await?;
+    let mut assignments = list_assignments(&mut *pool).await?;
     let draw_model_id = ensure_draw_api_model(pool, &mut providers, &mut models, config).await?;
     ensure_image_generation_draw_api_primary_assignment(pool, &mut assignments, draw_model_id)
         .await?;
 
-    mark_app_setting(pool, IMAGE_DRAW_API_PRIMARY_KEY).await?;
+    upsert_app_setting(&mut *pool, IMAGE_DRAW_API_PRIMARY_KEY, "1").await?;
+    transaction.commit().await?;
     tracing::info!("backfilled image_generation primary to draw-api");
     Ok(true)
 }
@@ -1407,7 +1422,10 @@ pub async fn backfill_boogu_image_slots(
     pool: &PgPool,
     config: &AppConfig,
 ) -> Result<bool, StorageError> {
-    if app_setting_present(pool, BOOGU_IMAGE_SLOTS_KEY).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+
+    if app_setting_present(&mut *pool, BOOGU_IMAGE_SLOTS_KEY).await? {
         return Ok(false);
     }
 
@@ -1417,12 +1435,12 @@ pub async fn backfill_boogu_image_slots(
         crate::image_jobs::IMAGE_EDIT_FLUX_WORKFLOW_KEY,
         crate::image_jobs::IMAGE_EDIT_BOOGU_TURBO_WORKFLOW_KEY,
     ] {
-        insert_workflow_if_missing(pool, workflow, "image", true, 3, 60_000, true).await?;
+        insert_workflow_if_missing(&mut *pool, workflow, "image", true, 3, 60_000, true).await?;
     }
 
-    let mut providers = list_providers(pool).await?;
-    let mut models = list_models(pool).await?;
-    let mut assignments = list_assignments(pool).await?;
+    let mut providers = list_providers(&mut *pool).await?;
+    let mut models = list_models(&mut *pool).await?;
+    let mut assignments = list_assignments(&mut *pool).await?;
     let draw_model_id = ensure_draw_api_model(pool, &mut providers, &mut models, config).await?;
     let draw_provider_id = ensure_draw_api_provider(pool, &mut providers, config).await?;
     let boogu_turbo_model_id = ensure_draw_api_endpoint_model(
@@ -1477,13 +1495,14 @@ pub async fn backfill_boogu_image_slots(
     )
     .await?;
 
-    mark_app_setting(pool, BOOGU_IMAGE_SLOTS_KEY).await?;
+    upsert_app_setting(&mut *pool, BOOGU_IMAGE_SLOTS_KEY, "1").await?;
+    transaction.commit().await?;
     tracing::info!("backfilled Boogu image slot workflows");
     Ok(true)
 }
 
 async fn ensure_asr_model(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     providers: &mut Vec<ProviderRecord>,
     models: &mut Vec<ModelRecord>,
     config: &AppConfig,
@@ -1505,7 +1524,7 @@ async fn ensure_asr_model(
         }),
     };
     let provider_id = ensure_provider(pool, providers, provider_input.clone()).await?;
-    update_provider(pool, provider_id, &provider_input).await?;
+    update_provider(&mut *pool, provider_id, &provider_input).await?;
     if let Some(provider) = providers
         .iter_mut()
         .find(|provider| provider.id == provider_id)
@@ -1538,7 +1557,7 @@ async fn ensure_asr_model(
         }),
     };
     let model_id = ensure_model(pool, models, model_input.clone()).await?;
-    update_model(pool, model_id, &model_input).await?;
+    update_model(&mut *pool, model_id, &model_input).await?;
     if let Some(model) = models.iter_mut().find(|model| model.id == model_id) {
         model.provider_id = model_input.provider_id;
         model.model_name = model_input.model_name;
@@ -1554,11 +1573,11 @@ async fn ensure_asr_model(
 }
 
 async fn ensure_draw_gpu_pool_with_unpooled_asr(
-    pool: &PgPool,
+    pool: &mut PgConnection,
     providers: &[ProviderRecord],
     models: &[ModelRecord],
 ) -> Result<i64, StorageError> {
-    let existing_pools = list_pools(pool).await?;
+    let existing_pools = list_pools(&mut *pool).await?;
     let existing_pool_id =
         preferred_provider_pool_id(providers, models, DRAW_API_PROVIDER, DRAW_API_MODEL);
     let existing_pool = existing_pool_id.and_then(|pool_id| {
@@ -1578,9 +1597,11 @@ async fn ensure_draw_gpu_pool_with_unpooled_asr(
     };
     let pool_id = match existing_pool_id {
         Some(pool_id) => pool_id,
-        None => openplotva_storage::llm_routing::insert_pool_if_missing(pool, &pool_input).await?,
+        None => {
+            openplotva_storage::llm_routing::insert_pool_if_missing(&mut *pool, &pool_input).await?
+        }
     };
-    openplotva_storage::llm_routing::update_pool(pool, pool_id, &pool_input).await?;
+    openplotva_storage::llm_routing::update_pool(&mut *pool, pool_id, &pool_input).await?;
     let mut draw_attached = 0_u64;
     let mut asr_detached = 0_u64;
     for provider_name in [DRAW_API_PROVIDER, ASR_PROVIDER] {
@@ -1593,7 +1614,7 @@ async fn ensure_draw_gpu_pool_with_unpooled_asr(
             .filter(|model| model.provider_id == provider_id)
         {
             if model.pool_id != target_pool_id {
-                set_model_pool(pool, model.id, target_pool_id).await?;
+                set_model_pool(&mut *pool, model.id, target_pool_id).await?;
                 if target_pool_id.is_some() {
                     draw_attached += 1;
                 } else {
@@ -1646,27 +1667,32 @@ fn draw_and_asr_models_ready(providers: &[ProviderRecord], models: &[ModelRecord
     })
 }
 
-async fn repair_draw_gpu_pool_for_asr_priority(pool: &PgPool) -> Result<bool, StorageError> {
-    if app_setting_present(pool, ASR_TASKMAN_PRIORITY_KEY).await? {
+async fn repair_draw_gpu_pool_for_asr_priority(
+    pool: &mut PgConnection,
+) -> Result<bool, StorageError> {
+    if app_setting_present(&mut *pool, ASR_TASKMAN_PRIORITY_KEY).await? {
         return Ok(false);
     }
-    let providers = list_providers(pool).await?;
-    let models = list_models(pool).await?;
+    let providers = list_providers(&mut *pool).await?;
+    let models = list_models(&mut *pool).await?;
     if !draw_and_asr_models_ready(&providers, &models) {
         tracing::warn!("ASR priority repair deferred until draw and ASR providers have models");
         return Ok(false);
     }
     ensure_draw_gpu_pool_with_unpooled_asr(pool, &providers, &models).await?;
-    mark_app_setting(pool, ASR_TASKMAN_PRIORITY_KEY).await?;
+    upsert_app_setting(&mut *pool, ASR_TASKMAN_PRIORITY_KEY, "1").await?;
     Ok(true)
 }
 
 pub async fn backfill_asr_routing(pool: &PgPool, config: &AppConfig) -> Result<bool, StorageError> {
-    let seeded = if app_setting_present(pool, ASR_ROUTING_KEY).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+
+    let seeded = if app_setting_present(&mut *pool, ASR_ROUTING_KEY).await? {
         false
     } else {
         insert_workflow_if_missing(
-            pool,
+            &mut *pool,
             crate::asr::ASR_WORKFLOW_KEY,
             "asr",
             false,
@@ -1675,9 +1701,9 @@ pub async fn backfill_asr_routing(pool: &PgPool, config: &AppConfig) -> Result<b
             true,
         )
         .await?;
-        let mut providers = list_providers(pool).await?;
-        let mut models = list_models(pool).await?;
-        let mut assignments = list_assignments(pool).await?;
+        let mut providers = list_providers(&mut *pool).await?;
+        let mut models = list_models(&mut *pool).await?;
+        let mut assignments = list_assignments(&mut *pool).await?;
         let asr_model_id = ensure_asr_model(pool, &mut providers, &mut models, config).await?;
         ensure_primary_assignment(
             pool,
@@ -1688,11 +1714,14 @@ pub async fn backfill_asr_routing(pool: &PgPool, config: &AppConfig) -> Result<b
         )
         .await?;
 
-        mark_app_setting(pool, ASR_ROUTING_KEY).await?;
-        tracing::info!("backfilled ASR routing rows");
+        upsert_app_setting(&mut *pool, ASR_ROUTING_KEY, "1").await?;
         true
     };
     repair_draw_gpu_pool_for_asr_priority(pool).await?;
+    transaction.commit().await?;
+    if seeded {
+        tracing::info!("backfilled ASR routing rows");
+    }
     Ok(seeded)
 }
 
@@ -1707,51 +1736,36 @@ const DEFAULT_DRAW_GPU_POOL: &str = "boogu-gpu";
 const DRAW_GPU_POOL_DESCRIPTION: &str =
     "Draw GPU capacity; ASR uses Taskman priority and CPU fallback while draw is active";
 
-/// Classify a provider row's wire protocol from its seeded shape. Pure so it
-/// is table-testable; used only to fill NULL protocols, never to overwrite an
-/// operator-set value.
-fn derive_protocol(kind: &str, name: &str, has_discovery: bool) -> &'static str {
-    match kind {
-        "embedding" => PROTOCOL_DISCOVERY_JOBS,
-        "image" => PROTOCOL_DISCOVERY_DRAW,
-        "asr" => PROTOCOL_DISCOVERY_ASR,
-        "music" => PROTOCOL_ACESTEP,
-        "privacy_filter" => PROTOCOL_PRIVACY_FILTER,
-        // chat / vision: genkit-family providers speak the Google AI API;
-        // everything else (aifarm and friends via discovery, vram-cloud,
-        // openrouter, nvidia, vmlx direct) is OpenAI-compatible.
-        _ => {
-            if !has_discovery && matches!(name, "genkit" | "gemini") {
-                PROTOCOL_GENKIT
-            } else {
-                PROTOCOL_OPENAI_COMPAT
-            }
-        }
-    }
-}
-
 /// Fill NULL provider protocols from the classifier. Guarded, idempotent, and
 /// never overwrites an operator-set protocol (SQL is `WHERE protocol IS NULL`).
 pub async fn backfill_provider_protocols(pool: &PgPool) -> Result<bool, StorageError> {
-    if app_setting_present(pool, PROVIDER_PROTOCOL_KEY).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+
+    if app_setting_present(&mut *pool, PROVIDER_PROTOCOL_KEY).await? {
         return Ok(false);
     }
-    let providers = list_providers(pool).await?;
+    let providers = list_providers(&mut *pool).await?;
     let mut filled = 0usize;
     for provider in &providers {
         if provider.protocol.is_some() {
             continue;
         }
-        let protocol = derive_protocol(
-            &provider.kind,
+        let protocol = openplotva_llm::router::table::legacy_provider_protocol(
+            Kind::from_db(&provider.kind).unwrap_or(Kind::Chat),
             &provider.name,
             provider.discovery_service_name.is_some(),
         );
-        openplotva_storage::llm_routing::set_provider_protocol_if_null(pool, provider.id, protocol)
-            .await?;
+        openplotva_storage::llm_routing::set_provider_protocol_if_null(
+            &mut *pool,
+            provider.id,
+            protocol.as_str(),
+        )
+        .await?;
         filled += 1;
     }
-    mark_app_setting(pool, PROVIDER_PROTOCOL_KEY).await?;
+    upsert_app_setting(&mut *pool, PROVIDER_PROTOCOL_KEY, "1").await?;
+    transaction.commit().await?;
     tracing::info!(filled, "backfilled provider protocols");
     Ok(true)
 }
@@ -1766,10 +1780,13 @@ pub async fn backfill_capacity_pools(
     pool: &PgPool,
     config: &AppConfig,
 ) -> Result<bool, StorageError> {
-    if app_setting_present(pool, CAPACITY_POOLS_KEY).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+
+    if app_setting_present(&mut *pool, CAPACITY_POOLS_KEY).await? {
         return Ok(false);
     }
-    let providers = list_providers(pool).await?;
+    let providers = list_providers(&mut *pool).await?;
     let targets = [
         (
             "aifarm-dialog",
@@ -1795,17 +1812,19 @@ pub async fn backfill_capacity_pools(
             config: serde_json::json!({}),
         };
         let pool_id =
-            openplotva_storage::llm_routing::insert_pool_if_missing(pool, &pool_input).await?;
-        openplotva_storage::llm_routing::update_pool(pool, pool_id, &pool_input).await?;
+            openplotva_storage::llm_routing::insert_pool_if_missing(&mut *pool, &pool_input)
+                .await?;
+        openplotva_storage::llm_routing::update_pool(&mut *pool, pool_id, &pool_input).await?;
         let attached = openplotva_storage::llm_routing::attach_provider_models_to_pool_if_unpooled(
-            pool,
+            &mut *pool,
             provider_id,
             pool_id,
         )
         .await?;
         tracing::info!(pool = pool_name, slots, attached, "seeded capacity pool");
     }
-    mark_app_setting(pool, CAPACITY_POOLS_KEY).await?;
+    upsert_app_setting(&mut *pool, CAPACITY_POOLS_KEY, "1").await?;
+    transaction.commit().await?;
     Ok(true)
 }
 
@@ -1931,20 +1950,23 @@ fn dialog_cascade_ready(
 /// upgraded database; this guarded pass makes a brand-new database converge
 /// after its models are seeded during the first startup.
 pub async fn backfill_memory_routing_cascades(pool: &PgPool) -> Result<bool, StorageError> {
-    let providers = list_providers(pool).await?;
-    let models = list_models(pool).await?;
-    let assignments = list_assignments(pool).await?;
-    let extraction = if app_setting_present(pool, MEMORY_EXTRACTION_CASCADE_KEY).await? {
+    let mut transaction = begin_bootstrap_update(pool).await?;
+    let pool = &mut *transaction;
+    let providers = list_providers(&mut *pool).await?;
+    let models = list_models(&mut *pool).await?;
+    let assignments = list_assignments(&mut *pool).await?;
+    let extraction = if app_setting_present(&mut *pool, MEMORY_EXTRACTION_CASCADE_KEY).await? {
         None
     } else {
         resolved_memory_workflow_targets(MEMORY_EXTRACTION_WORKFLOW, &providers, &models)
     };
-    let subject_merge = if app_setting_present(pool, MEMORY_SUBJECT_MERGE_CASCADE_KEY).await? {
+    let subject_merge = if app_setting_present(&mut *pool, MEMORY_SUBJECT_MERGE_CASCADE_KEY).await?
+    {
         None
     } else {
         resolved_memory_workflow_targets(MEMORY_SUBJECT_MERGE_WORKFLOW, &providers, &models)
     };
-    let normalize_dialog = !app_setting_present(pool, DIALOG_FALLBACK_CASCADE_KEY).await?
+    let normalize_dialog = !app_setting_present(&mut *pool, DIALOG_FALLBACK_CASCADE_KEY).await?
         && dialog_cascade_ready(&providers, &models, &assignments);
     if extraction.is_none() && subject_merge.is_none() && !normalize_dialog {
         return Ok(false);
@@ -1953,7 +1975,6 @@ pub async fn backfill_memory_routing_cascades(pool: &PgPool) -> Result<bool, Sto
     // Keep the route replacement, shared-pool reconciliation, overflow disable,
     // and their guards atomic. The runtime loads the routing snapshot only after
     // this transaction commits, so it can never publish a half-replaced chain.
-    let mut transaction = pool.begin().await?;
 
     if let Some(targets) = subject_merge.as_ref() {
         sqlx::query(
@@ -2015,7 +2036,7 @@ pub async fn backfill_memory_routing_cascades(pool: &PgPool) -> Result<bool, Sto
             targets,
         )
         .await?;
-        mark_app_setting_in_transaction(&mut transaction, MEMORY_SUBJECT_MERGE_CASCADE_KEY).await?;
+        upsert_app_setting(&mut *transaction, MEMORY_SUBJECT_MERGE_CASCADE_KEY, "1").await?;
     }
 
     if let Some(targets) = extraction.as_ref() {
@@ -2034,7 +2055,7 @@ pub async fn backfill_memory_routing_cascades(pool: &PgPool) -> Result<bool, Sto
         .await?;
         replace_memory_workflow_assignments(&mut transaction, MEMORY_EXTRACTION_WORKFLOW, targets)
             .await?;
-        mark_app_setting_in_transaction(&mut transaction, MEMORY_EXTRACTION_CASCADE_KEY).await?;
+        upsert_app_setting(&mut *transaction, MEMORY_EXTRACTION_CASCADE_KEY, "1").await?;
     }
 
     if normalize_dialog {
@@ -2082,7 +2103,7 @@ pub async fn backfill_memory_routing_cascades(pool: &PgPool) -> Result<bool, Sto
         )
         .execute(&mut *transaction)
         .await?;
-        mark_app_setting_in_transaction(&mut transaction, DIALOG_FALLBACK_CASCADE_KEY).await?;
+        upsert_app_setting(&mut *transaction, DIALOG_FALLBACK_CASCADE_KEY, "1").await?;
     }
 
     transaction.commit().await?;
@@ -2124,20 +2145,6 @@ async fn replace_memory_workflow_assignments(
     Ok(())
 }
 
-async fn mark_app_setting_in_transaction(
-    transaction: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-    key: &str,
-) -> Result<(), StorageError> {
-    sqlx::query(
-        "INSERT INTO app_settings (key, value, updated_at) VALUES ($1, '1', NOW()) \
-         ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()",
-    )
-    .bind(key)
-    .execute(&mut **transaction)
-    .await?;
-    Ok(())
-}
-
 /// A worker fleet whose size follows its workflow's primary lane pool.
 pub struct LaneWorkerScale {
     pub workflow_key: &'static str,
@@ -2926,40 +2933,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn derive_protocol_classifies_every_seeded_provider() {
-        // (kind, name, has_discovery) -> protocol, over the exact seeded rows.
-        let cases = [
-            ("chat", "aifarm", true, PROTOCOL_OPENAI_COMPAT),
-            ("chat", "genkit", false, PROTOCOL_GENKIT),
-            ("chat", "gemini", false, PROTOCOL_GENKIT),
-            ("chat", "vram-cloud", false, PROTOCOL_OPENAI_COMPAT),
-            ("chat", "openrouter", false, PROTOCOL_OPENAI_COMPAT),
-            ("chat", "nvidia", false, PROTOCOL_OPENAI_COMPAT),
-            ("chat", "vmlx", false, PROTOCOL_OPENAI_COMPAT),
-            ("chat", "aifarm-llamacpp-gpu2", true, PROTOCOL_OPENAI_COMPAT),
-            ("chat", "aifarm-maple", true, PROTOCOL_OPENAI_COMPAT),
-            ("vision", "aifarm-vision", true, PROTOCOL_OPENAI_COMPAT),
-            ("embedding", "aifarm-embed", true, PROTOCOL_DISCOVERY_JOBS),
-            ("image", "aifarm-draw", true, PROTOCOL_DISCOVERY_DRAW),
-            ("music", "acestep", false, PROTOCOL_ACESTEP),
-            (
-                "privacy_filter",
-                "privacy-filter",
-                true,
-                PROTOCOL_PRIVACY_FILTER,
-            ),
-            ("asr", "aifarm-asr", true, PROTOCOL_DISCOVERY_ASR),
-        ];
-        for (kind, name, has_discovery, expected) in cases {
-            assert_eq!(
-                derive_protocol(kind, name, has_discovery),
-                expected,
-                "provider {name} (kind {kind})"
-            );
-        }
-    }
-
     #[test]
     fn asr_models_match_only_asr_capability() {
         let mut model = model(10, 1, "gigaam-v3-vosk-fallback");
@@ -3128,6 +3101,86 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn live_bootstrap_rolls_back_failed_markers_and_serializes_replay()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let Ok(dsn) = std::env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
+            return Ok(());
+        };
+        let admin = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(1)
+            .connect(&dsn)
+            .await?;
+        let suffix = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)?
+            .as_nanos();
+        let schema = format!("routing_bootstrap_{suffix}");
+        sqlx::raw_sql(sqlx::AssertSqlSafe(format!("CREATE SCHEMA {schema}")))
+            .execute(&admin)
+            .await?;
+        let search_path = format!("{schema},public");
+        let options = dsn
+            .parse::<sqlx::postgres::PgConnectOptions>()?
+            .options([("search_path", search_path.as_str())]);
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(2)
+            .connect_with(options)
+            .await?;
+        let result: Result<(), Box<dyn std::error::Error>> = async {
+            openplotva_storage::run_migrations_on(&pool).await?;
+            let tables: i64 = sqlx::query_scalar("SELECT count(*) FROM pg_class AS c JOIN pg_namespace AS n ON c.relnamespace=n.oid WHERE n.nspname=$1 AND c.relname=ANY($2)")
+                .bind(&schema).bind(vec!["app_settings", "llm_providers", "provider_models", "workflows", "workflow_assignments", "workflow_triggers", "llm_capacity_pools"])
+                .fetch_one(&pool).await?;
+            assert_eq!(tables, 7, "fixtures must own all modified tables");
+            sqlx::raw_sql("TRUNCATE workflow_triggers, workflow_assignments, provider_models, llm_providers, llm_capacity_pools RESTART IDENTITY CASCADE; DELETE FROM app_settings WHERE key LIKE 'llm.routing.%'; ALTER TABLE app_settings ADD CONSTRAINT reject_seed_marker CHECK (key <> 'llm.routing.seeded')")
+                .execute(&pool).await?;
+            let config = AppConfig::from_raw(openplotva_config::RawConfig::default())?;
+            let error = seed_routing_from_env(&pool, &config).await.expect_err("marker must fail");
+            assert!(error.to_string().contains("reject_seed_marker"), "{error}");
+            let counts: (i64,i64,i64,i64) = sqlx::query_as("SELECT (SELECT count(*) FROM llm_providers), (SELECT count(*) FROM provider_models), (SELECT count(*) FROM workflow_assignments), (SELECT count(*) FROM app_settings WHERE key='llm.routing.seeded')")
+                .fetch_one(&pool).await?;
+            assert_eq!(counts, (0,0,0,0));
+            sqlx::query("ALTER TABLE app_settings DROP CONSTRAINT reject_seed_marker").execute(&pool).await?;
+            let (left,right) = tokio::join!(seed_routing_from_env(&pool,&config), seed_routing_from_env(&pool,&config));
+            assert_ne!(left?, right?, "one concurrent startup seeds, the other sees its marker");
+            assert_eq!(openplotva_storage::app_settings::app_setting(&pool, SEEDED_KEY).await?.as_deref(), Some("1"));
+            sqlx::query("UPDATE llm_providers SET endpoint='https://operator.invalid/kept' WHERE name='aifarm'").execute(&pool).await?;
+            assert!(!seed_routing_from_env(&pool, &config).await?);
+            let endpoint: Option<String> = sqlx::query_scalar("SELECT endpoint FROM llm_providers WHERE name='aifarm'").fetch_one(&pool).await?;
+            assert_eq!(endpoint.as_deref(), Some("https://operator.invalid/kept"));
+
+            sqlx::query("UPDATE provider_models SET model_name=$1 WHERE provider_id IN (SELECT id FROM llm_providers WHERE name='genkit')")
+                .bind(STALE_GENKIT_FLASH_MODEL).execute(&pool).await?;
+            sqlx::query("ALTER TABLE app_settings ADD CONSTRAINT reject_genkit_marker CHECK (key <> 'llm.routing.genkit_flash_fixed')").execute(&pool).await?;
+            let error = backfill_genkit_flash_model(&pool, &config).await.expect_err("marker must fail");
+            assert!(error.to_string().contains("reject_genkit_marker"), "{error}");
+            let model: String = sqlx::query_scalar("SELECT model_name FROM provider_models WHERE provider_id IN (SELECT id FROM llm_providers WHERE name='genkit') LIMIT 1").fetch_one(&pool).await?;
+            assert_eq!(model, STALE_GENKIT_FLASH_MODEL, "marker failure must roll back its preceding update");
+            sqlx::query("ALTER TABLE app_settings DROP CONSTRAINT reject_genkit_marker").execute(&pool).await?;
+            assert!(backfill_genkit_flash_model(&pool, &config).await?);
+            assert!(!backfill_genkit_flash_model(&pool, &config).await?);
+
+            backfill_vram_cloud_from_env(&pool,&config).await?;
+            backfill_vram_cloud_vision_fallback(&pool).await?;
+            backfill_gpu_models(&pool,&config).await?;
+            backfill_dialog_local_reasoner_fallback(&pool,&config).await?;
+            backfill_declarative_v2(&pool,&config).await?;
+            backfill_image_generation_draw_api_primary(&pool,&config).await?;
+            backfill_boogu_image_slots(&pool,&config).await?;
+            backfill_asr_routing(&pool,&config).await?;
+            backfill_provider_protocols(&pool).await?;
+            backfill_capacity_pools(&pool,&config).await?;
+            backfill_memory_routing_cascades(&pool).await?;
+            Ok(())
+        }.await;
+        pool.close().await;
+        sqlx::raw_sql(sqlx::AssertSqlSafe(format!("DROP SCHEMA {schema} CASCADE")))
+            .execute(&admin)
+            .await?;
+        admin.close().await;
+        result
+    }
+
     #[tokio::test]
     async fn live_memory_backfill_is_atomic_and_subject_merge_does_not_wait_for_vram()
     -> Result<(), Box<dyn std::error::Error>> {
diff --git a/crates/openplotva-app/src/music_jobs.rs b/crates/openplotva-app/src/music_jobs.rs
index 0e12a5b3..9320d244 100644
--- a/crates/openplotva-app/src/music_jobs.rs
+++ b/crates/openplotva-app/src/music_jobs.rs
@@ -26,10 +26,7 @@ use openplotva_taskman::{
     LLM_JOB_RETRY_STAGE, MUSIC_VIP_QUEUE_NAME, MusicGenJobParams, TaskQueueError,
     TaskQueueJobEvent, TaskQueueWorkItem, music_gen_job_params_from_stateless_job,
 };
-use openplotva_telegram::{
-    TelegramOutboundMethod, TelegramOutboundResponse, ensure_telegram_safe_text,
-    escape_telegram_html_text, execute_telegram_method,
-};
+use openplotva_telegram::{ensure_telegram_safe_text, escape_telegram_html_text};
 use rand::RngExt;
 use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
@@ -49,7 +46,7 @@ pub const MUSIC_JOB_WORKER_QUEUES: [&str; 1] = [MUSIC_VIP_QUEUE_NAME];
 pub const MUSIC_WORKFLOW_KEY: &str = "music";
 /// Key of the song block inside `MusicGenJobParams::meta`.
 pub const SONG_JOB_META_KEY: &str = "song";
-pub const GO_MUSIC_GENERATION_TIMEOUT: StdDuration = StdDuration::from_secs(360);
+pub const MUSIC_GENERATION_TIMEOUT: StdDuration = StdDuration::from_secs(360);
 pub const SUPPORT_ME_URL: &str = "https://t.me/PlotvoBot?start=donate";
 pub const VIP_URL: &str = "https://t.me/PlotvoBot?start=vip";
 
@@ -209,20 +206,43 @@ pub struct GeneratedSongAudio {
     pub duration_seconds: Option<f64>,
 }
 
-/// One send-song plan.
+/// Material and audio for one variant, before transport preparation.
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct GeneratedSongSendPlan {
-    pub chat_id: i64,
-    pub message_id: i32,
-    pub user_id: i64,
-    pub user_full_name: String,
-    pub thread_id: Option<i32>,
-    pub topic: String,
+    pub song: NewGeneratedSong,
     pub material: SongMaterial,
     pub generated: GeneratedSongAudio,
-    pub is_vip: bool,
-    /// Persisted song row, linked to the delivered message after the send.
-    pub song_id: Option<i64>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, thiserror::Error)]
+#[error("{message}")]
+pub struct MusicJobError {
+    pub message: String,
+    pub retry_reason: Option<FailureReason>,
+}
+
+impl From<String> for MusicJobError {
+    fn from(message: String) -> Self {
+        Self {
+            retry_reason: retryable_reason_from_message(&message),
+            message,
+        }
+    }
+}
+
+impl MusicJobError {
+    fn storage(error: openplotva_storage::StorageError) -> Self {
+        let retry_reason = match &error {
+            openplotva_storage::StorageError::Postgres {
+                source: sqlx::Error::PoolTimedOut | sqlx::Error::Io(_) | sqlx::Error::PoolClosed,
+            } => Some(FailureReason::ProviderUnavailable),
+            _ => None,
+        };
+        Self {
+            message: error.to_string(),
+            retry_reason,
+        }
+    }
 }
 
 /// Errors from generation-side work.
@@ -439,26 +459,26 @@ async fn build_song_prompt_with_attempt_and_prompt_store(
     request: SongPromptRequest,
     prompt_store: &Arc<openplotva_prompts::PromptStore>,
 ) -> Result<SongPromptResult, MusicGenerationError> {
-    if media::routed_attempt_is_genkit(&attempt) {
-        let model = media::genkit_model_for_attempt(&attempt);
-        if let Some(cfg) = media::gateway_structured_json_config_for_attempt(config, &attempt) {
-            let generator =
-                AifarmStructuredJsonGenerator::new(cfg).with_prompt_store(Arc::clone(prompt_store));
-            return generator.build_song_prompt(request).await;
-        }
-        let Some(gemini) =
-            media::gemini_media_prompt_optimizer_from_app_config_with_model(config, &model)
-        else {
-            return Err(MusicGenerationError::Material(format!(
-                "song reprompt provider {} is unavailable",
-                attempt.provider_name
-            )));
-        };
-        let gemini = gemini.with_prompt_store(Arc::clone(prompt_store));
+    if attempt.protocol == Some(openplotva_llm::provider_schema::Protocol::Genkit) {
+        let (api_key, base_url) =
+            crate::provider_transport::gemini_endpoint_for_attempt(config, &attempt)
+                .map_err(|error| MusicGenerationError::Material(error.to_string()))?;
+        let gemini = openplotva_llm::gemini::GeminiMediaPromptOptimizer::new(
+            openplotva_llm::gemini::GeminiMediaPromptOptimizerConfig {
+                api_key,
+                base_url,
+                model: attempt.model_name.clone(),
+                request_timeout: std::time::Duration::from_secs(
+                    config.llm.dialog.request_timeout_seconds.max(1) as u64,
+                ),
+            },
+        )
+        .with_prompt_store(Arc::clone(prompt_store));
         return gemini.build_song_prompt(request).await;
     }
 
-    let cfg = media::aifarm_structured_json_config_for_attempt(config, &attempt);
+    let cfg = media::aifarm_structured_json_config_for_attempt(config, &attempt)
+        .map_err(|error| MusicGenerationError::Material(error.to_string()))?;
     let generator =
         AifarmStructuredJsonGenerator::new(cfg).with_prompt_store(Arc::clone(prompt_store));
     generator.build_song_prompt(request).await
@@ -669,10 +689,6 @@ fn completion_voice(material: SongMaterial) -> (String, String) {
     }
 }
 
-/// Every song request is answered with this many independent takes of the same
-/// material (the service draws a fresh seed per call), each in its own message.
-pub const SONG_TAKES_PER_REQUEST: usize = 1;
-
 impl MusicGenerator for AceStepMusicGenerator {
     fn generate_song<'a>(&'a self, request: MusicGenerationRequest) -> MusicGenerationFuture<'a> {
         Box::pin(async move {
@@ -780,19 +796,7 @@ async fn generate_song_with_routed_attempt(
     request: MusicGenerationRequest,
     base_config: AceStepConfig,
 ) -> Result<GeneratedSongAudio, MusicGenerationError> {
-    if !attempt.provider_name.eq_ignore_ascii_case("acestep")
-        && !attempt
-            .provider_config
-            .get("provider")
-            .and_then(serde_json::Value::as_str)
-            .is_some_and(|value| value.eq_ignore_ascii_case("acestep"))
-    {
-        return Err(MusicGenerationError::Provider(format!(
-            "unsupported music provider {}",
-            attempt.provider_name
-        )));
-    }
-    let config = acestep_config_for_attempt(base_config, &attempt);
+    let config = acestep_config_for_attempt(base_config, &attempt)?;
     let audio_format = config.audio_format.clone();
     let client = AceStepClient::new(config)?;
     AceStepMusicGenerator::new(client, audio_format)
@@ -800,28 +804,31 @@ async fn generate_song_with_routed_attempt(
         .await
 }
 
-fn acestep_config_for_attempt(mut config: AceStepConfig, attempt: &RoutedAttempt) -> AceStepConfig {
-    if let Some(endpoint) = attempt
-        .model_base_url
-        .as_deref()
-        .or(attempt.provider_endpoint.as_deref())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
+fn acestep_config_for_attempt(
+    mut config: AceStepConfig,
+    attempt: &RoutedAttempt,
+) -> Result<AceStepConfig, MusicGenerationError> {
+    if attempt.protocol != Some(openplotva_llm::provider_schema::Protocol::AceStep) {
+        return Err(MusicGenerationError::Provider(format!(
+            "unsupported music protocol for provider {}",
+            attempt.provider_name
+        )));
+    }
+    if let Some(endpoint) = attempt.endpoint() {
         config.base_url = endpoint.to_owned();
     }
     if !attempt.model_name.trim().is_empty() {
         config.model = attempt.model_name.clone();
     }
     if let Some(mode) = attempt
-        .provider_config
+        .model_config
         .get("api_mode")
-        .or_else(|| attempt.model_config.get("api_mode"))
+        .or_else(|| attempt.provider_config.get("api_mode"))
         .and_then(serde_json::Value::as_str)
     {
         config.api_mode = AceStepApiMode::from_go(mode);
     }
-    config.with_defaults()
+    Ok(config.with_defaults())
 }
 
 fn music_retryable_reason(error: &MusicGenerationError) -> Option<FailureReason> {
@@ -844,20 +851,6 @@ pub trait MusicJobEffects {
         Box::pin(async {})
     }
 
-    /// Best-effort: remove the lifecycle reaction from the trigger message.
-    /// Called only on the success path so a late clear can never erase the
-    /// obligations watcher's failure signal.
-    fn clear_song_signal<'a>(
-        &'a self,
-        _chat_id: i64,
-        _trigger_message_id: i32,
-    ) -> MusicJobEffectFuture<'a, ()>
-    where
-        Self: Sync,
-    {
-        Box::pin(async {})
-    }
-
     /// Return whether audio may be sent to this chat.
     fn can_send_audio<'a>(&'a self, chat_id: i64) -> MusicJobEffectFuture<'a, bool>;
 
@@ -867,45 +860,33 @@ pub trait MusicJobEffects {
         params: &'a MusicGenJobParams,
     ) -> MusicJobEffectFuture<'a, Option<MusicReferenceAudio>>;
 
-    /// Persist the material of a generated song before it is sent; the returned
-    /// row id is linked to the delivered message afterwards.
-    fn persist_generated_song<'a>(
+    fn queued_song_job<'a>(
         &'a self,
-        _song: NewGeneratedSong,
-    ) -> MusicJobEffectFuture<'a, Option<i64>>
-    where
-        Self: Sync,
-    {
-        Box::pin(async { None })
-    }
+        job_id: i64,
+    ) -> MusicJobEffectFuture<
+        'a,
+        Result<Option<crate::telegram_outbox::QueuedBatchReceipt>, MusicJobError>,
+    >;
 
-    /// Link the delivered message to the persisted song.
-    fn mark_generated_song_sent<'a>(
+    fn prepared_song<'a>(
         &'a self,
-        _song_id: i64,
-        _message_id: i32,
-    ) -> MusicJobEffectFuture<'a, ()>
-    where
-        Self: Sync,
-    {
-        Box::pin(async {})
-    }
+        job_id: i64,
+    ) -> MusicJobEffectFuture<'a, Result<Option<openplotva_telegram::SendRichMessage>, MusicJobError>>;
 
-    /// Send the generated song as one rich message (audio + styles + lyrics + author).
-    fn send_generated_song<'a>(
+    fn prepare_song<'a>(
         &'a self,
         plan: GeneratedSongSendPlan,
-    ) -> MusicJobEffectFuture<'a, Result<Option<i32>, String>>;
+    ) -> MusicJobEffectFuture<'a, Result<openplotva_telegram::SendRichMessage, MusicJobError>>;
+
+    fn enqueue_song<'a>(
+        &'a self,
+        job_id: i64,
+        song: openplotva_telegram::SendRichMessage,
+    ) -> MusicJobEffectFuture<'a, Result<crate::telegram_outbox::QueuedBatchReceipt, MusicJobError>>;
 }
 
 /// Telegram download boundary for reference audio.
 pub trait MusicTelegramSender {
-    /// Execute a Telegram method.
-    fn send_music_method<'a>(
-        &'a self,
-        method: TelegramOutboundMethod,
-    ) -> MusicJobEffectFuture<'a, Result<TelegramOutboundResponse, String>>;
-
     /// Download Telegram file bytes by `file_id`.
     fn download_music_file<'a>(
         &'a self,
@@ -914,17 +895,6 @@ pub trait MusicTelegramSender {
 }
 
 impl MusicTelegramSender for openplotva_telegram::TelegramClient {
-    fn send_music_method<'a>(
-        &'a self,
-        method: TelegramOutboundMethod,
-    ) -> MusicJobEffectFuture<'a, Result<TelegramOutboundResponse, String>> {
-        Box::pin(async move {
-            execute_telegram_method(self, method)
-                .await
-                .map_err(|error| error.to_string())
-        })
-    }
-
     fn download_music_file<'a>(
         &'a self,
         file_id: &'a str,
@@ -983,9 +953,10 @@ pub struct TelegramMusicJobEffects<Permissions, Files, Sender> {
     permissions: Arc<Permissions>,
     files: Files,
     telegram: Sender,
-    rich: Arc<dyn crate::rich::RichSender>,
+    uploader: openplotva_media::uploader::UploaderClient,
+    delivery: Arc<crate::rich::RichOutbox>,
     reactions: Option<crate::reactions::GenerationReactions>,
-    songs: Option<Arc<PostgresGeneratedSongStore>>,
+    songs: PostgresGeneratedSongStore,
 }
 
 impl<Permissions, Files, Sender> TelegramMusicJobEffects<Permissions, Files, Sender> {
@@ -995,15 +966,18 @@ impl<Permissions, Files, Sender> TelegramMusicJobEffects<Permissions, Files, Sen
         permissions: Arc<Permissions>,
         files: Files,
         telegram: Sender,
-        rich: Arc<dyn crate::rich::RichSender>,
+        uploader: openplotva_media::uploader::UploaderClient,
+        delivery: Arc<crate::rich::RichOutbox>,
+        songs: PostgresGeneratedSongStore,
     ) -> Self {
         Self {
             permissions,
             files,
             telegram,
-            rich,
+            uploader,
+            delivery,
             reactions: None,
-            songs: None,
+            songs,
         }
     }
 
@@ -1013,13 +987,6 @@ impl<Permissions, Files, Sender> TelegramMusicJobEffects<Permissions, Files, Sen
         self.reactions = Some(reactions);
         self
     }
-
-    /// Persist generated songs (material, seed, duration) for tracing.
-    #[must_use]
-    pub fn with_song_store(mut self, songs: Arc<PostgresGeneratedSongStore>) -> Self {
-        self.songs = Some(songs);
-        self
-    }
 }
 
 impl<Store, Files, Sender> MusicJobEffects
@@ -1046,23 +1013,6 @@ where
         })
     }
 
-    fn clear_song_signal<'a>(
-        &'a self,
-        chat_id: i64,
-        trigger_message_id: i32,
-    ) -> MusicJobEffectFuture<'a, ()> {
-        Box::pin(async move {
-            if let Some(reactions) = self.reactions.as_deref() {
-                reactions
-                    .clear(crate::reactions::GenerationReactionTarget {
-                        chat_id,
-                        message_id: trigger_message_id,
-                    })
-                    .await;
-            }
-        })
-    }
-
     fn can_send_audio<'a>(&'a self, chat_id: i64) -> MusicJobEffectFuture<'a, bool> {
         Box::pin(async move {
             self.permissions
@@ -1102,52 +1052,58 @@ where
         })
     }
 
-    fn persist_generated_song<'a>(
+    fn queued_song_job<'a>(
         &'a self,
-        song: NewGeneratedSong,
-    ) -> MusicJobEffectFuture<'a, Option<i64>> {
+        job_id: i64,
+    ) -> MusicJobEffectFuture<
+        'a,
+        Result<Option<crate::telegram_outbox::QueuedBatchReceipt>, MusicJobError>,
+    > {
         Box::pin(async move {
-            let songs = self.songs.as_ref()?;
-            match songs.insert(&song).await {
-                Ok(id) => Some(id),
-                Err(error) => {
-                    tracing::warn!(%error, chat_id = song.chat_id, "failed to persist generated song");
-                    None
-                }
-            }
+            self.delivery
+                .queued(&music_delivery_source(job_id), Some(job_id))
+                .await
+                .map_err(MusicJobError::storage)
         })
     }
 
-    fn mark_generated_song_sent<'a>(
+    fn prepared_song<'a>(
         &'a self,
-        song_id: i64,
-        message_id: i32,
-    ) -> MusicJobEffectFuture<'a, ()> {
+        job_id: i64,
+    ) -> MusicJobEffectFuture<'a, Result<Option<openplotva_telegram::SendRichMessage>, MusicJobError>>
+    {
         Box::pin(async move {
-            if let Some(songs) = self.songs.as_ref()
-                && let Err(error) = songs.set_result_message(song_id, message_id).await
-            {
-                tracing::warn!(%error, song_id, "failed to link generated song to its message");
-            }
+            self.songs
+                .prepared_for_job(job_id)
+                .await
+                .map_err(MusicJobError::storage)?
+                .map(|value| {
+                    serde_json::from_value(value)
+                        .map_err(|error| MusicJobError::from(error.to_string()))
+                })
+                .transpose()
         })
     }
 
-    fn send_generated_song<'a>(
+    fn prepare_song<'a>(
         &'a self,
         plan: GeneratedSongSendPlan,
-    ) -> MusicJobEffectFuture<'a, Result<Option<i32>, String>> {
+    ) -> MusicJobEffectFuture<'a, Result<openplotva_telegram::SendRichMessage, MusicJobError>> {
         Box::pin(async move {
             let extension = song_file_extension(&plan.generated.file_name);
-            let title = song_file_title(&plan.material.title, &plan.topic);
-            let pretty_name = build_song_file_name(&plan.user_full_name, &title, &extension);
-            let mime = song_audio_mime(&extension);
+            let title = song_file_title(&plan.material.title, &plan.song.topic);
+            let pretty_name = build_song_file_name(&plan.song.user_full_name, &title, &extension);
             let audio_url = self
-                .rich
-                .upload_bytes(plan.generated.data.clone(), mime, Some(&pretty_name))
+                .uploader
+                .upload_bytes(
+                    plan.generated.data,
+                    song_audio_mime(&extension),
+                    Some(&pretty_name),
+                )
                 .await
-                .map_err(|error| error.to_string())?;
+                .map_err(|error| MusicJobError::from(error.to_string()))?;
             let footer_html =
-                build_song_footer_html(&plan.user_full_name, plan.is_vip, random_support_phrase());
+                build_song_footer_html(&plan.song.user_full_name, true, random_support_phrase());
             let html = crate::rich::compose_song_message(&crate::rich::SongMessage {
                 title: &title,
                 styles: &plan.material.raw_style,
@@ -1155,28 +1111,53 @@ where
                 lyrics: &plan.material.lyrics,
                 footer_html: &footer_html,
             });
-            let options = openplotva_telegram::RichSendOptions {
-                direct_messages_topic_id: None,
-                message_thread_id: plan.thread_id.map(i64::from),
-                reply_to_message_id: Some(i64::from(plan.message_id)),
-                allow_sending_without_reply: true,
-                disable_notification: false,
-                reply_markup: None,
+            let prepared = openplotva_telegram::SendRichMessage {
+                chat_id: plan.song.chat_id,
+                html,
+                options: openplotva_telegram::RichSendOptions {
+                    message_thread_id: plan.song.thread_id.map(i64::from),
+                    reply_to_message_id: Some(i64::from(plan.song.trigger_message_id)),
+                    allow_sending_without_reply: true,
+                    ..Default::default()
+                },
             };
-            let message_id = self
-                .rich
-                .send_rich(plan.chat_id, &html, &options)
+            let value = serde_json::to_value(&prepared)
+                .map_err(|error| MusicJobError::from(error.to_string()))?;
+            let saved = self
+                .songs
+                .save_prepared(&plan.song, &value)
                 .await
-                .map_err(|error| error.to_string())?;
-            Ok(Some(message_id as i32))
+                .map_err(MusicJobError::storage)?;
+            serde_json::from_value(saved).map_err(|error| MusicJobError::from(error.to_string()))
+        })
+    }
+
+    fn enqueue_song<'a>(
+        &'a self,
+        job_id: i64,
+        song: openplotva_telegram::SendRichMessage,
+    ) -> MusicJobEffectFuture<'a, Result<crate::telegram_outbox::QueuedBatchReceipt, MusicJobError>>
+    {
+        Box::pin(async move {
+            self.delivery
+                .enqueue(
+                    &music_delivery_source(job_id),
+                    song.options.message_thread_id,
+                    song,
+                    Some(job_id),
+                )
+                .await
+                .map_err(|error| match error {
+                    crate::rich::RichOutboxError::Storage(error) => MusicJobError::storage(error),
+                    error => MusicJobError::from(error.to_string()),
+                })
         })
     }
 }
 
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[derive(Clone, Debug, Eq, PartialEq)]
 pub enum MusicJobExecutionOutcome {
-    /// Job completed.
-    Completed,
+    Queued(crate::telegram_outbox::QueuedBatchReceipt),
     SkippedPermission,
     /// Job failed.
     Failed,
@@ -1187,14 +1168,14 @@ pub enum MusicJobExecutionOutcome {
 pub struct MusicJobExecutionReport {
     pub outcome: MusicJobExecutionOutcome,
     pub topic: String,
-    pub error: Option<String>,
-    pub result_message_id: Option<i32>,
+    pub error: Option<MusicJobError>,
 }
 
 /// Result from one queue poll.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum MusicQueuePollOutcome {
     Idle,
+    WaitingDelivery,
     Completed,
     SkippedPermission,
     RetryRequeued,
@@ -1219,6 +1200,7 @@ pub struct MusicWorkerRunReport {
     pub ticks: u64,
     pub dequeued: u64,
     pub completed: u64,
+    pub waiting_delivery: u64,
     pub skipped_permission: u64,
     pub retry_requeued: u64,
     pub retry_exhausted: u64,
@@ -1275,6 +1257,7 @@ impl MusicWorkerRunReport {
         }
         match report.outcome {
             MusicQueuePollOutcome::Idle => self.idle += 1,
+            MusicQueuePollOutcome::WaitingDelivery => self.waiting_delivery += 1,
             MusicQueuePollOutcome::Completed => self.completed += 1,
             MusicQueuePollOutcome::SkippedPermission => self.skipped_permission += 1,
             MusicQueuePollOutcome::RetryRequeued => self.retry_requeued += 1,
@@ -1296,138 +1279,73 @@ pub async fn execute_music_gen_job<MaterialProvider, Generator, Effects>(
     generator: &Generator,
     effects: &Effects,
     params: MusicGenJobParams,
-    job_id: Option<i64>,
+    job_id: i64,
 ) -> MusicJobExecutionReport
 where
     MaterialProvider: SongMaterialProvider + Sync,
     Generator: MusicGenerator + Sync,
     Effects: MusicJobEffects + Sync,
 {
-    if !effects.can_send_audio(params.chat_id).await {
-        return MusicJobExecutionReport {
-            outcome: MusicJobExecutionOutcome::SkippedPermission,
-            topic: String::new(),
-            error: None,
-            result_message_id: None,
-        };
-    }
     let topic = music_job_topic(&params);
-    if topic.is_empty() {
-        return MusicJobExecutionReport {
-            outcome: MusicJobExecutionOutcome::Failed,
-            topic,
-            error: Some("music topic is empty".to_owned()),
-            result_message_id: None,
-        };
-    }
-    effects
-        .signal_song_progress(params.chat_id, params.message_id)
-        .await;
-    let material = match material_provider.build_song_material(&params, &topic).await {
-        Ok(material) => material,
-        Err(error) => {
-            return MusicJobExecutionReport {
-                outcome: MusicJobExecutionOutcome::Failed,
-                topic,
-                error: Some(error.message()),
-                result_message_id: None,
-            };
+    let run = async {
+        if let Some(receipt) = effects.queued_song_job(job_id).await? {
+            return Ok(MusicJobExecutionOutcome::Queued(receipt));
         }
-    };
-    let reference_audio = effects.reference_audio(&params).await;
-    let mut first_message_id = None;
-    for take in 1..=SONG_TAKES_PER_REQUEST {
-        let generated = match generator
-            .generate_song(MusicGenerationRequest {
-                topic: topic.clone(),
-                material: material.clone(),
-                reference_audio: reference_audio.clone(),
-            })
-            .await
-        {
-            Ok(generated) => generated,
-            Err(error) if take == 1 => {
-                return MusicJobExecutionReport {
-                    outcome: MusicJobExecutionOutcome::Failed,
-                    topic,
-                    error: Some(error.message()),
-                    result_message_id: None,
-                };
-            }
-            Err(error) => {
-                tracing::warn!(error = %error.message(), take, "extra song take failed");
-                break;
+        if !effects.can_send_audio(params.chat_id).await {
+            return Ok(MusicJobExecutionOutcome::SkippedPermission);
+        }
+        if topic.is_empty() {
+            return Err(MusicJobError::from("music topic is empty".to_owned()));
+        }
+        let prepared = match effects.prepared_song(job_id).await? {
+            Some(prepared) => prepared,
+            None => {
+                effects
+                    .signal_song_progress(params.chat_id, params.message_id)
+                    .await;
+                let material = material_provider
+                    .build_song_material(&params, &topic)
+                    .await
+                    .map_err(|error| MusicJobError::from(error.message()))?;
+                let reference_audio = effects.reference_audio(&params).await;
+                let generated = generator
+                    .generate_song(MusicGenerationRequest {
+                        topic: topic.clone(),
+                        material: material.clone(),
+                        reference_audio,
+                    })
+                    .await
+                    .map_err(|error| MusicJobError::from(error.message()))?;
+                let song = new_generated_song(&params, Some(job_id), &topic, &material, &generated);
+                effects
+                    .prepare_song(GeneratedSongSendPlan {
+                        song,
+                        material,
+                        generated,
+                    })
+                    .await?
             }
         };
-        let take_material = song_take_material(&material, &topic, take);
-        let song_id = effects
-            .persist_generated_song(new_generated_song(
-                &params,
-                job_id,
-                &topic,
-                &take_material,
-                &generated,
-            ))
-            .await;
-        match effects
-            .send_generated_song(GeneratedSongSendPlan {
-                chat_id: params.chat_id,
-                message_id: params.message_id,
-                user_id: params.user_id,
-                user_full_name: params.user_full_name.clone(),
-                thread_id: params.thread_id,
-                topic: topic.clone(),
-                material: take_material,
-                generated,
-                is_vip: true,
-                song_id,
-            })
-            .await
-        {
-            Ok(Some(audio_message_id)) => {
-                if let Some(song_id) = song_id {
-                    effects
-                        .mark_generated_song_sent(song_id, audio_message_id)
-                        .await;
-                }
-                first_message_id = first_message_id.or(Some(audio_message_id));
-            }
-            Ok(None) => {}
-            Err(error) if take == 1 => {
-                return MusicJobExecutionReport {
-                    outcome: MusicJobExecutionOutcome::Failed,
-                    topic,
-                    error: Some(error),
-                    result_message_id: None,
-                };
-            }
-            Err(error) => {
-                tracing::warn!(%error, take, "extra song take was not delivered");
-                break;
-            }
-        }
+        let receipt = effects.enqueue_song(job_id, prepared).await?;
+        Ok(MusicJobExecutionOutcome::Queued(receipt))
     }
-    effects
-        .clear_song_signal(params.chat_id, params.message_id)
-        .await;
-    MusicJobExecutionReport {
-        outcome: MusicJobExecutionOutcome::Completed,
-        topic,
-        error: None,
-        result_message_id: first_message_id,
+    .await;
+    match run {
+        Ok(outcome) => MusicJobExecutionReport {
+            outcome,
+            topic,
+            error: None,
+        },
+        Err(error) => MusicJobExecutionReport {
+            outcome: MusicJobExecutionOutcome::Failed,
+            topic,
+            error: Some(error),
+        },
     }
 }
 
-/// Later takes carry their number in the title so the two messages and files
-/// are told apart.
-fn song_take_material(material: &SongMaterial, topic: &str, take: usize) -> SongMaterial {
-    if take <= 1 {
-        return material.clone();
-    }
-    SongMaterial {
-        title: format!("{} ({take})", song_file_title(&material.title, topic)),
-        ..material.clone()
-    }
+pub(crate) fn music_delivery_source(job_id: i64) -> String {
+    format!("music-job:{job_id}:take:1")
 }
 
 /// Dequeue and process one music-generation job from a queue.
@@ -1505,23 +1423,32 @@ where
         )
     });
     let execution =
-        execute_music_gen_job(material_provider, generator, effects, params, Some(work.id)).await;
+        execute_music_gen_job(material_provider, generator, effects, params, work.id).await;
     let activity = activity_guard
         .as_ref()
         .map_or_else(TelegramActivitySnapshot::default, |guard| guard.snapshot());
     drop(activity_guard);
     let finished_at = OffsetDateTime::now_utc();
     match execution.outcome {
-        MusicJobExecutionOutcome::Completed => {
-            let _ = queue.update_job_result_message(work.id, execution.result_message_id);
-            finalize_music_completed(
-                queue,
+        MusicJobExecutionOutcome::Queued(receipt) => {
+            let _ = queue.upsert_job_event(
                 work.id,
-                queue_name,
-                MusicQueuePollOutcome::Completed,
-                activity,
+                TaskQueueJobEvent {
+                    stage: "music_delivery_queued".into(),
+                    message: "music committed to Telegram outbox".into(),
+                    data: BTreeMap::from([("batch_id".into(), receipt.batch_id)]),
+                    ..Default::default()
+                },
                 finished_at,
-            )
+            );
+            let _ = queue.wait_for_delivery(work.id);
+            MusicQueuePollReport {
+                queue_name: queue_name.to_owned(),
+                job_id: Some(work.id),
+                outcome: MusicQueuePollOutcome::WaitingDelivery,
+                error: None,
+                activity,
+            }
         }
         MusicJobExecutionOutcome::SkippedPermission => finalize_music_completed(
             queue,
@@ -1532,20 +1459,21 @@ where
             finished_at,
         ),
         MusicJobExecutionOutcome::Failed => {
-            let error = execution
+            let failure = execution
                 .error
-                .unwrap_or_else(|| "music generation failed".to_owned());
+                .unwrap_or_else(|| MusicJobError::from("music generation failed".to_owned()));
             if let Some(report) = retry_or_exhaust_music_job(
                 queue,
                 &work,
                 queue_name,
-                &error,
+                &failure,
                 options.max_llm_job_attempts,
                 activity.clone(),
                 finished_at,
             ) {
                 return report;
             }
+            let error = failure.message;
             let _ = queue.fail(work.id, error.clone(), finished_at);
             MusicQueuePollReport {
                 queue_name: queue_name.to_owned(),
@@ -1562,12 +1490,13 @@ fn retry_or_exhaust_music_job(
     queue: &InMemoryTaskQueue,
     work: &TaskQueueWorkItem,
     queue_name: &str,
-    error: &str,
+    failure: &MusicJobError,
     max_llm_job_attempts: i32,
     activity: TelegramActivitySnapshot,
     now: OffsetDateTime,
 ) -> Option<MusicQueuePollReport> {
-    let reason = openplotva_llm::retry::retryable_reason_from_message(error)?;
+    let reason = failure.retry_reason?;
+    let error = failure.message.as_str();
     let attempt = next_music_llm_job_attempt(&work.events);
     let max_attempts = max_llm_job_attempts.max(1);
     let target_queue = retryable_music_job_target_queue(queue_name);
@@ -2081,6 +2010,7 @@ fn song_prompt_error_leaf(error: &MusicGenerationError) -> String {
 
 #[cfg(test)]
 mod tests {
+    use std::collections::BTreeMap;
     use std::{
         collections::VecDeque,
         error::Error,
@@ -2359,7 +2289,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn music_executor_persists_the_song_and_links_the_message() {
+    async fn music_executor_persists_the_song_and_queues_delivery() {
         let material_provider = HeuristicSongMaterialProvider;
         let generator = GeneratorStub::new(Ok(GeneratedSongAudio {
             data: b"MP3".to_vec(),
@@ -2367,7 +2297,7 @@ mod tests {
             seed: Some(4242),
             duration_seconds: Some(180.5),
         }));
-        let effects = EffectsStub::allowed().with_song_ids(vec![Some(7)]);
+        let effects = EffectsStub::allowed();
         let mut meta = json!({});
         super::SongJobMeta {
             request_text: "!song ночной город".to_owned(),
@@ -2388,11 +2318,14 @@ mod tests {
                 meta,
                 ..MusicGenJobParams::default()
             },
-            Some(555),
+            555,
         )
         .await;
 
-        assert_eq!(report.outcome, MusicJobExecutionOutcome::Completed);
+        assert!(matches!(
+            report.outcome,
+            MusicJobExecutionOutcome::Queued(_)
+        ));
         let persisted = effects.persisted();
         assert_eq!(persisted.len(), 1);
         assert_eq!(persisted[0].job_id, Some(555));
@@ -2405,9 +2338,61 @@ mod tests {
         assert_eq!(persisted[0].audio_seconds, Some(180.5));
         assert!(!persisted[0].lyrics.is_empty());
         assert_eq!(persisted[0].tags, persisted[0].style_summary);
-        let sent = effects.sent();
-        assert_eq!(sent[0].song_id, Some(7));
-        assert_eq!(effects.marked(), vec![(7, 100)]);
+        let sent = effects.preparations();
+        assert_eq!(sent[0].song.job_id, Some(555));
+        assert!(lock(&effects.queued).contains_key(&555));
+    }
+
+    #[tokio::test]
+    async fn music_replay_reuses_prepared_media_after_enqueue_failure() {
+        let generator = GeneratorStub::new(Ok(GeneratedSongAudio {
+            data: b"MP3".to_vec(),
+            file_name: "song.mp3".into(),
+            ..Default::default()
+        }));
+        let effects = EffectsStub::allowed();
+        effects
+            .fail_enqueue
+            .store(true, std::sync::atomic::Ordering::SeqCst);
+        let params = MusicGenJobParams {
+            topic: "rain".into(),
+            chat_id: 42,
+            ..Default::default()
+        };
+        let first = execute_music_gen_job(
+            &HeuristicSongMaterialProvider,
+            &generator,
+            &effects,
+            params.clone(),
+            555,
+        )
+        .await;
+        assert!(matches!(first.outcome, MusicJobExecutionOutcome::Failed));
+        assert!(first.error.expect("enqueue failure").retry_reason.is_some());
+        let replay = execute_music_gen_job(
+            &HeuristicSongMaterialProvider,
+            &generator,
+            &effects,
+            params.clone(),
+            555,
+        )
+        .await;
+        assert!(matches!(
+            replay.outcome,
+            MusicJobExecutionOutcome::Queued(_)
+        ));
+        let repeated = execute_music_gen_job(
+            &HeuristicSongMaterialProvider,
+            &generator,
+            &effects,
+            params,
+            555,
+        )
+        .await;
+        assert_eq!(replay.outcome, repeated.outcome);
+        assert_eq!(generator.requests().len(), 1);
+        assert_eq!(effects.preparations().len(), 1);
+        assert_eq!(effects.persisted().len(), 1);
     }
 
     #[tokio::test]
@@ -2491,15 +2476,18 @@ mod tests {
                 thread_id: Some(77),
                 ..MusicGenJobParams::default()
             },
-            None,
+            555,
         )
         .await;
 
-        assert_eq!(report.outcome, MusicJobExecutionOutcome::Completed);
-        let sent = effects.sent();
+        assert!(matches!(
+            report.outcome,
+            MusicJobExecutionOutcome::Queued(_)
+        ));
+        let sent = effects.preparations();
         assert_eq!(sent.len(), 1);
-        assert_eq!(sent[0].chat_id, 42);
-        assert_eq!(sent[0].thread_id, Some(77));
+        assert_eq!(sent[0].song.chat_id, 42);
+        assert_eq!(sent[0].song.thread_id, Some(77));
         assert_eq!(generator.requests().len(), 1);
         assert_eq!(generator.requests()[0].topic, "ночной город");
         assert_eq!(
@@ -2535,7 +2523,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn music_lifecycle_reactions_mark_progress_and_clear_on_success() {
+    async fn music_lifecycle_reaction_stays_until_delivery_receipt() {
         let material_provider = HeuristicSongMaterialProvider;
         let generator = GeneratorStub::new(Ok(GeneratedSongAudio {
             data: b"MP3".to_vec(),
@@ -2555,15 +2543,15 @@ mod tests {
                 topic: "ночной город".to_owned(),
                 ..MusicGenJobParams::default()
             },
-            None,
+            555,
         )
         .await;
 
-        assert_eq!(report.outcome, MusicJobExecutionOutcome::Completed);
-        assert_eq!(
-            effects.reactions(),
-            vec![("progress", 42, 9), ("clear", 42, 9)]
-        );
+        assert!(matches!(
+            report.outcome,
+            MusicJobExecutionOutcome::Queued(_)
+        ));
+        assert_eq!(effects.reactions(), vec![("progress", 42, 9)]);
     }
 
     #[tokio::test]
@@ -2585,7 +2573,7 @@ mod tests {
                 topic: "ночной город".to_owned(),
                 ..MusicGenJobParams::default()
             },
-            None,
+            555,
         )
         .await;
 
@@ -2633,8 +2621,8 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn music_queue_once_records_result_message_id_when_completed()
-    -> Result<(), Box<dyn Error>> {
+    async fn music_queue_once_waits_without_a_fake_result_message_id() -> Result<(), Box<dyn Error>>
+    {
         let queue = openplotva_taskman::InMemoryTaskQueue::new();
         let now = OffsetDateTime::from_unix_timestamp(1_779_193_800).expect("time");
         let job_id = queue.assign(
@@ -2669,16 +2657,13 @@ mod tests {
         )
         .await;
 
-        assert_eq!(report.outcome, MusicQueuePollOutcome::Completed);
+        assert_eq!(report.outcome, MusicQueuePollOutcome::WaitingDelivery);
         let record = queue.record(job_id).expect("music job");
-        assert_eq!(record.status, JobStatus::Completed);
-        assert_eq!(record.result_message_id, Some(100));
+        assert_eq!(record.status, JobStatus::WaitingDelivery);
+        assert_eq!(record.result_message_id, None);
         assert_eq!(record.started_at, Some(now));
         assert_eq!(record.execution_started_at, Some(now));
-        assert!(
-            record.completed_at > Some(now),
-            "completed_at should reflect the end of generation, not the dequeue time"
-        );
+        assert_eq!(record.completed_at, None);
         Ok(())
     }
 
@@ -2751,7 +2736,7 @@ mod tests {
         let report = poll.await;
 
         assert_eq!(report.job_id, Some(job_id));
-        assert_eq!(report.outcome, MusicQueuePollOutcome::Completed);
+        assert_eq!(report.outcome, MusicQueuePollOutcome::WaitingDelivery);
         assert!(
             report.activity.sent >= 1,
             "active music generation must report a file-upload pulse"
@@ -2766,7 +2751,7 @@ mod tests {
         );
         assert_eq!(
             queue.records()[0].status,
-            openplotva_taskman::JobStatus::Completed
+            openplotva_taskman::JobStatus::WaitingDelivery
         );
         assert_eq!(generator.requests().len(), 1);
         Ok(())
@@ -3028,40 +3013,33 @@ mod tests {
     #[derive(Clone, Debug)]
     struct EffectsStub {
         can_send: bool,
-        sent: Arc<Mutex<Vec<GeneratedSongSendPlan>>>,
+        preparation_calls: Arc<Mutex<Vec<GeneratedSongSendPlan>>>,
+        prepared: Arc<Mutex<BTreeMap<i64, openplotva_telegram::SendRichMessage>>>,
+        queued: Arc<Mutex<BTreeMap<i64, crate::telegram_outbox::QueuedBatchReceipt>>>,
+        fail_enqueue: Arc<std::sync::atomic::AtomicBool>,
         refs: Arc<Mutex<VecDeque<Option<MusicReferenceAudio>>>>,
         reactions: RecordedReactions,
-        song_ids: Arc<Mutex<VecDeque<Option<i64>>>>,
         persisted: Arc<Mutex<Vec<openplotva_storage::NewGeneratedSong>>>,
-        marked: Arc<Mutex<Vec<(i64, i32)>>>,
     }
 
     impl EffectsStub {
         fn allowed() -> Self {
             Self {
                 can_send: true,
-                sent: Arc::new(Mutex::new(Vec::new())),
+                preparation_calls: Default::default(),
+                prepared: Default::default(),
+                queued: Default::default(),
+                fail_enqueue: Default::default(),
                 refs: Arc::new(Mutex::new(VecDeque::new())),
                 reactions: Arc::new(Mutex::new(Vec::new())),
-                song_ids: Arc::new(Mutex::new(VecDeque::new())),
                 persisted: Arc::new(Mutex::new(Vec::new())),
-                marked: Arc::new(Mutex::new(Vec::new())),
             }
         }
 
-        fn with_song_ids(self, song_ids: Vec<Option<i64>>) -> Self {
-            *lock(&self.song_ids) = song_ids.into();
-            self
-        }
-
         fn persisted(&self) -> Vec<openplotva_storage::NewGeneratedSong> {
             lock(&self.persisted).clone()
         }
 
-        fn marked(&self) -> Vec<(i64, i32)> {
-            lock(&self.marked).clone()
-        }
-
         fn denied() -> Self {
             Self {
                 can_send: false,
@@ -3069,8 +3047,8 @@ mod tests {
             }
         }
 
-        fn sent(&self) -> Vec<GeneratedSongSendPlan> {
-            lock(&self.sent).clone()
+        fn preparations(&self) -> Vec<GeneratedSongSendPlan> {
+            lock(&self.preparation_calls).clone()
         }
 
         fn reactions(&self) -> Vec<(&'static str, i64, i32)> {
@@ -3088,15 +3066,6 @@ mod tests {
             Box::pin(async {})
         }
 
-        fn clear_song_signal<'a>(
-            &'a self,
-            chat_id: i64,
-            trigger_message_id: i32,
-        ) -> MusicJobEffectFuture<'a, ()> {
-            lock(&self.reactions).push(("clear", chat_id, trigger_message_id));
-            Box::pin(async {})
-        }
-
         fn can_send_audio<'a>(&'a self, _chat_id: i64) -> MusicJobEffectFuture<'a, bool> {
             Box::pin(async move { self.can_send })
         }
@@ -3108,31 +3077,75 @@ mod tests {
             Box::pin(async move { lock(&self.refs).pop_front().flatten() })
         }
 
-        fn persist_generated_song<'a>(
+        fn queued_song_job<'a>(
             &'a self,
-            song: openplotva_storage::NewGeneratedSong,
-        ) -> MusicJobEffectFuture<'a, Option<i64>> {
-            lock(&self.persisted).push(song);
-            let id = lock(&self.song_ids).pop_front().flatten();
-            Box::pin(async move { id })
+            job_id: i64,
+        ) -> MusicJobEffectFuture<
+            'a,
+            Result<Option<crate::telegram_outbox::QueuedBatchReceipt>, super::MusicJobError>,
+        > {
+            Box::pin(async move { Ok(lock(&self.queued).get(&job_id).cloned()) })
         }
-
-        fn mark_generated_song_sent<'a>(
+        fn prepared_song<'a>(
             &'a self,
-            song_id: i64,
-            message_id: i32,
-        ) -> MusicJobEffectFuture<'a, ()> {
-            lock(&self.marked).push((song_id, message_id));
-            Box::pin(async {})
+            job_id: i64,
+        ) -> MusicJobEffectFuture<
+            'a,
+            Result<Option<openplotva_telegram::SendRichMessage>, super::MusicJobError>,
+        > {
+            Box::pin(async move { Ok(lock(&self.prepared).get(&job_id).cloned()) })
         }
-
-        fn send_generated_song<'a>(
+        fn prepare_song<'a>(
             &'a self,
             plan: GeneratedSongSendPlan,
-        ) -> MusicJobEffectFuture<'a, Result<Option<i32>, String>> {
+        ) -> MusicJobEffectFuture<
+            'a,
+            Result<openplotva_telegram::SendRichMessage, super::MusicJobError>,
+        > {
             Box::pin(async move {
-                lock(&self.sent).push(plan);
-                Ok(Some(100))
+                lock(&self.persisted).push(plan.song.clone());
+                let job_id = plan.song.job_id.expect("job identity");
+                let prepared = openplotva_telegram::SendRichMessage {
+                    chat_id: plan.song.chat_id,
+                    html: "prepared song".into(),
+                    options: openplotva_telegram::RichSendOptions {
+                        message_thread_id: plan.song.thread_id.map(i64::from),
+                        reply_to_message_id: Some(i64::from(plan.song.trigger_message_id)),
+                        ..Default::default()
+                    },
+                };
+                lock(&self.preparation_calls).push(plan);
+                lock(&self.prepared).insert(job_id, prepared.clone());
+                Ok(prepared)
+            })
+        }
+        fn enqueue_song<'a>(
+            &'a self,
+            job_id: i64,
+            _song: openplotva_telegram::SendRichMessage,
+        ) -> MusicJobEffectFuture<
+            'a,
+            Result<crate::telegram_outbox::QueuedBatchReceipt, super::MusicJobError>,
+        > {
+            Box::pin(async move {
+                if self
+                    .fail_enqueue
+                    .swap(false, std::sync::atomic::Ordering::SeqCst)
+                {
+                    return Err(super::MusicJobError {
+                        message: "database temporarily unavailable".into(),
+                        retry_reason: Some(
+                            openplotva_llm::retry::FailureReason::ProviderUnavailable,
+                        ),
+                    });
+                }
+                let receipt = crate::telegram_outbox::QueuedBatchReceipt::durable_outbox(
+                    format!("music:{job_id}"),
+                    vec![format!("operation:{job_id}")],
+                    false,
+                );
+                lock(&self.queued).insert(job_id, receipt.clone());
+                Ok(receipt)
             })
         }
     }
diff --git a/crates/openplotva-app/src/openrouter_free_pool.rs b/crates/openplotva-app/src/openrouter_free_pool.rs
index 8304ed20..8e16646c 100644
--- a/crates/openplotva-app/src/openrouter_free_pool.rs
+++ b/crates/openplotva-app/src/openrouter_free_pool.rs
@@ -621,10 +621,13 @@ async fn openrouter_key_status_error(
     http: &reqwest::Client,
     context: &OpenRouterFreeContext,
 ) -> Option<String> {
-    let api_key = resolve_provider_api_key(
+    let api_key = match crate::provider_transport::resolve_provider_api_key(
         context.provider_api_key_ref.as_deref(),
         context.provider_api_key_encrypted.as_deref(),
-    )?;
+    ) {
+        Ok(key) => key?,
+        Err(error) => return Some(error.to_string()),
+    };
     let url = context
         .provider_config
         .get("key_status_url")
@@ -638,18 +641,6 @@ async fn openrouter_key_status_error(
     }
 }
 
-fn resolve_provider_api_key(
-    api_key_ref: Option<&str>,
-    api_key_encrypted: Option<&[u8]>,
-) -> Option<String> {
-    if let Some(reference) = api_key_ref.filter(|reference| !reference.trim().is_empty()) {
-        return std::env::var(reference.trim()).ok();
-    }
-    let sealed = api_key_encrypted?;
-    let master = std::env::var("MASTER_KEY").unwrap_or_default();
-    openplotva_storage::llm_routing::open_key(&master, sealed).ok()
-}
-
 fn json_string(value: &Value, key: &str) -> Option<String> {
     value
         .get(key)
diff --git a/crates/openplotva-app/src/payments.rs b/crates/openplotva-app/src/payments.rs
index cf7cf98b..259b0ebe 100644
--- a/crates/openplotva-app/src/payments.rs
+++ b/crates/openplotva-app/src/payments.rs
@@ -1,14 +1,7 @@
-use std::{
-    collections::HashMap,
-    fmt,
-    future::Future,
-    pin::Pin,
-    sync::{Arc, Mutex},
-    time::Duration,
-};
+use crate::control_jobs::ControlJobQueue;
+use std::{fmt, future::Future, pin::Pin, sync::Arc, time::Duration};
 
 use crate::{
-    rate_limits::TaskEnqueueRateLimit,
     updates::UpdateHandler,
     virtual_messages::{
         QueueTextRequest, VirtualIdFactory, monotonic_virtual_id_factory, queue_text_message_parts,
@@ -33,9 +26,7 @@ use openplotva_storage::{
 };
 use openplotva_taskman::{
     CONTROL_QUEUE_NAME, ControlJobData, ControlJobParams, ControlKind, ControlPayment,
-    InMemoryTaskQueue, JobStatus, JobType, StatelessJobItem, TRANSACTION_PRIORITY,
-    TaskQueueIdAllocator, TaskQueueRecord, TaskQueueSchedule,
-    control_job_params_from_stateless_job, new_control_job_at,
+    StatelessJobItem, TRANSACTION_PRIORITY, new_control_job_at,
 };
 use openplotva_updates::parse_leading_bot_command;
 use serde::{Deserialize, Serialize};
@@ -99,14 +90,6 @@ pub type PreCheckoutFuture<'a, E> = Pin<Box<dyn Future<Output = Result<(), E>> +
 pub type PaymentInvoiceLinkFuture<'a, E> =
     Pin<Box<dyn Future<Output = Result<String, E>> + Send + 'a>>;
 
-/// Boxed future returned by taskman control-job assignment calls.
-pub type PaymentControlJobQueueFuture<'a, E> =
-    Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
-
-/// Boxed future returned by payment taskman worker queue calls.
-pub type PaymentControlJobWorkerFuture<'a, T, E> =
-    Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>;
-
 /// Boxed future returned by VIP status checks.
 pub type VipStatusCheckFuture<'a> = Pin<Box<dyn Future<Output = bool> + Send + 'a>>;
 
@@ -493,51 +476,6 @@ pub struct PaymentControlJobReport {
     pub error: Option<String>,
 }
 
-/// A concrete taskman row ready for the payment-owned control-job worker.
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub struct PaymentControlJobWorkItem {
-    /// Taskman job ID used for completion/failure writes.
-    pub id: i64,
-    pub job: StatelessJobItem,
-}
-
-/// Result of one payment-owned taskman worker tick.
-#[derive(Clone, Debug, Default, Eq, PartialEq)]
-pub struct PaymentControlJobWorkerReport {
-    /// Whether a job was dequeued.
-    pub dequeued: bool,
-    /// Dequeued taskman job ID.
-    pub job_id: Option<i64>,
-    /// Payment dispatcher execution report, when payload decoding succeeded.
-    pub execution: Option<PaymentControlJobReport>,
-    /// The job was finalized as completed.
-    pub completed: bool,
-    /// The job was finalized as failed.
-    pub failed: bool,
-    /// Queue dequeue failed.
-    pub dequeue_error: Option<String>,
-    pub decode_error: Option<String>,
-    /// Completion/failure status write failed.
-    pub status_error: Option<String>,
-}
-
-/// Aggregate report for a long-running payment-owned taskman worker.
-#[derive(Clone, Debug, Default, Eq, PartialEq)]
-pub struct PaymentControlJobWorkerRunReport {
-    /// Number of poll ticks.
-    pub ticks: u64,
-    /// Number of ticks that dequeued a job.
-    pub dequeued: u64,
-    /// Number of jobs completed.
-    pub completed: u64,
-    /// Number of jobs failed.
-    pub failed: u64,
-    /// Number of queue dequeue errors.
-    pub dequeue_errors: u64,
-    /// Number of completion/failure write errors.
-    pub status_errors: u64,
-}
-
 /// Concrete Telegram invoice-effect failure.
 #[derive(Debug, Error)]
 pub enum TelegramPaymentInvoiceEffectError {
@@ -675,27 +613,6 @@ impl PaymentControlJobReport {
     }
 }
 
-impl PaymentControlJobWorkerRunReport {
-    fn record_tick(&mut self, tick: &PaymentControlJobWorkerReport) {
-        self.ticks += 1;
-        if tick.dequeued {
-            self.dequeued += 1;
-        }
-        if tick.completed {
-            self.completed += 1;
-        }
-        if tick.failed {
-            self.failed += 1;
-        }
-        if tick.dequeue_error.is_some() {
-            self.dequeue_errors += 1;
-        }
-        if tick.status_error.is_some() {
-            self.status_errors += 1;
-        }
-    }
-}
-
 pub trait SuccessfulPaymentStore {
     /// Error returned by the concrete storage implementation.
     type Error: fmt::Display + Send + Sync + 'static;
@@ -1204,701 +1121,6 @@ pub trait PaymentInvoiceEffects {
     ) -> PaymentEffectsFuture<'a, Self::Error>;
 }
 
-pub trait PaymentControlJobQueue {
-    /// Error returned by the concrete queue implementation.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    /// Assign a control job to a named taskman queue.
-    fn assign_payment_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-    ) -> PaymentControlJobQueueFuture<'a, Self::Error>;
-
-    /// Assign or replace a pending control job under a stable debounce key.
-    fn schedule_payment_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-        schedule: TaskQueueSchedule,
-    ) -> PaymentControlJobQueueFuture<'a, Self::Error> {
-        drop(schedule);
-        self.assign_payment_control_job(queue_name, job)
-    }
-}
-
-/// Queue/status boundary for the payment-owned taskman worker.
-pub trait PaymentControlJobWorkerQueue {
-    /// Error returned by the concrete queue implementation.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    /// Dequeue the next pending payment control job from a named taskman queue.
-    fn dequeue_payment_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-    ) -> PaymentControlJobWorkerFuture<'a, Option<PaymentControlJobWorkItem>, Self::Error>;
-
-    /// Finalize a payment control job as completed.
-    fn complete_payment_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        report: &'a PaymentControlJobReport,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error>;
-
-    /// Finalize a payment control job as failed.
-    fn fail_payment_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error>;
-}
-
-pub trait SharedControlJobWorkerQueue {
-    /// Error returned by the concrete queue implementation.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    /// Dequeue the next pending control job owned by one executor family.
-    fn dequeue_shared_control_job_matching<'a>(
-        &'a self,
-        queue_name: &'static str,
-        worker_id: &'static str,
-        predicate: fn(&StatelessJobItem) -> bool,
-    ) -> PaymentControlJobWorkerFuture<'a, Option<PaymentControlJobWorkItem>, Self::Error>;
-
-    /// Mark one shared control job completed.
-    fn complete_shared_control_job<'a>(
-        &'a self,
-        job_id: i64,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error>;
-
-    /// Mark one shared control job failed.
-    fn fail_shared_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error>;
-}
-
-/// Rust-native in-memory control-job queue for the current payment vertical slice.
-///
-/// old `job_queue` tables. This adapter gives runtime wiring a concrete queue with the same
-/// priority ordering for payment-owned control jobs.
-#[derive(Clone, Debug)]
-pub struct InMemoryPaymentControlJobQueue {
-    queue: InMemoryTaskQueue,
-    completed_reports: Arc<Mutex<HashMap<i64, PaymentControlJobReport>>>,
-}
-
-/// In-memory taskman status used by the current payment queue adapter.
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
-pub enum InMemoryPaymentControlJobStatus {
-    /// Job is pending worker execution.
-    Pending,
-    /// Job has been dequeued by a worker.
-    Processing,
-    /// Job completed without a payment-worker failure.
-    Completed,
-    /// Job failed and carries an error string.
-    Failed,
-}
-
-/// Snapshot row for the in-memory payment taskman adapter.
-#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
-pub struct InMemoryPaymentControlJobRecord {
-    /// Taskman job ID.
-    pub id: i64,
-    pub queue_name: String,
-    /// Current in-memory status.
-    pub status: InMemoryPaymentControlJobStatus,
-    pub job: StatelessJobItem,
-    /// Completion report recorded by the payment worker.
-    pub completed_report: Option<PaymentControlJobReport>,
-    /// Failure string recorded by the payment worker.
-    pub error: Option<String>,
-}
-
-/// Error returned by the in-memory payment taskman adapter.
-#[derive(Clone, Debug, Error, Eq, PartialEq)]
-pub enum InMemoryPaymentControlJobQueueError {
-    /// A status update targeted a job ID this queue has never assigned.
-    #[error("payment control job {0} not found")]
-    JobNotFound(i64),
-    /// The shared taskman queue core rejected an operation unexpectedly.
-    #[error("payment control job queue: {0}")]
-    Taskman(String),
-}
-
-impl InMemoryPaymentControlJobQueue {
-    /// Build an empty in-memory payment control-job queue.
-    #[must_use]
-    pub fn new() -> Self {
-        Self {
-            queue: InMemoryTaskQueue::new(),
-            completed_reports: Arc::new(Mutex::new(HashMap::new())),
-        }
-    }
-
-    /// Build an empty in-memory payment control-job queue with shared taskman IDs.
-    #[must_use]
-    pub fn new_with_id_allocator(ids: TaskQueueIdAllocator) -> Self {
-        Self {
-            queue: InMemoryTaskQueue::new_with_id_allocator(ids),
-            completed_reports: Arc::new(Mutex::new(HashMap::new())),
-        }
-    }
-
-    #[must_use]
-    pub fn from_task_queue(queue: InMemoryTaskQueue) -> Self {
-        Self {
-            queue,
-            completed_reports: Arc::new(Mutex::new(HashMap::new())),
-        }
-    }
-
-    /// Return a stable ID-ordered snapshot of the queue state.
-    #[must_use]
-    pub fn snapshot(&self) -> Vec<InMemoryPaymentControlJobRecord> {
-        let records = self.queue.records();
-        let completed_reports = self.completed_reports();
-        payment_records_from_taskman(&records, &completed_reports)
-    }
-
-    /// Return raw taskman records with worker IDs and timestamps for runtime diagnostics.
-    #[must_use]
-    pub fn taskman_records(&self) -> Vec<TaskQueueRecord> {
-        self.queue.records()
-    }
-
-    /// Cancel one raw taskman control job for admin/runtime control surfaces.
-    pub fn cancel_taskman_job(
-        &self,
-        job_id: i64,
-    ) -> Result<(), InMemoryPaymentControlJobQueueError> {
-        self.queue
-            .cancel(job_id, "cancelled by admin", OffsetDateTime::now_utc())
-            .map_err(in_memory_payment_queue_error)?;
-        self.completed_reports().remove(&job_id);
-        Ok(())
-    }
-
-    /// Delete one raw taskman control job for admin/runtime control surfaces.
-    pub fn delete_taskman_job(
-        &self,
-        job_id: i64,
-    ) -> Result<TaskQueueRecord, InMemoryPaymentControlJobQueueError> {
-        let record = self
-            .queue
-            .delete(job_id)
-            .map_err(in_memory_payment_queue_error)?;
-        self.completed_reports().remove(&job_id);
-        Ok(record)
-    }
-
-    /// Restart one raw taskman control job for admin/runtime control surfaces.
-    pub fn restart_taskman_job(
-        &self,
-        job_id: i64,
-    ) -> Result<i64, InMemoryPaymentControlJobQueueError> {
-        self.queue
-            .restart(job_id, OffsetDateTime::now_utc())
-            .map_err(in_memory_payment_queue_error)
-    }
-
-    fn completed_reports(
-        &self,
-    ) -> std::sync::MutexGuard<'_, HashMap<i64, PaymentControlJobReport>> {
-        self.completed_reports
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-    }
-}
-
-/// Error returned by the persistent payment taskman adapter.
-#[derive(Debug, Error)]
-pub enum PersistentPaymentControlJobQueueError {
-    /// The inner queue operation failed.
-    #[error(transparent)]
-    Queue(#[from] InMemoryPaymentControlJobQueueError),
-    /// User/chat-originated control job creation was rejected by the task enqueue limiter.
-    #[error("task enqueue rate limited")]
-    TaskEnqueueRateLimited,
-}
-
-/// Payment control-job queue backed by the shared taskman queue.
-#[derive(Clone)]
-pub struct PersistentPaymentControlJobQueue {
-    queue: InMemoryPaymentControlJobQueue,
-    task_enqueue_rate_limit: Option<Arc<dyn TaskEnqueueRateLimit>>,
-    db_journal: Option<
-        crate::task_queue::BufferedTaskQueueJournal<openplotva_storage::PostgresTaskQueueStore>,
-    >,
-}
-
-impl PersistentPaymentControlJobQueue {
-    #[must_use]
-    pub fn from_task_queue(queue: InMemoryTaskQueue) -> Self {
-        Self {
-            queue: InMemoryPaymentControlJobQueue::from_task_queue(queue),
-            task_enqueue_rate_limit: None,
-            db_journal: None,
-        }
-    }
-
-    #[must_use]
-    pub fn with_task_enqueue_rate_limit(
-        mut self,
-        rate_limit: Arc<dyn TaskEnqueueRateLimit>,
-    ) -> Self {
-        self.task_enqueue_rate_limit = Some(rate_limit);
-        self
-    }
-
-    /// Attach the shared Postgres journal so control/payment enqueues are flushed
-    /// to Postgres synchronously. Payment jobs (e.g. SuccessfulPayment) must be
-    /// durable before the update is acked: a lost enqueue would silently drop money.
-    #[must_use]
-    pub fn with_db_journal(
-        mut self,
-        journal: crate::task_queue::BufferedTaskQueueJournal<
-            openplotva_storage::PostgresTaskQueueStore,
-        >,
-    ) -> Self {
-        self.db_journal = Some(journal);
-        self
-    }
-
-    /// Return a stable ID-ordered snapshot of the queue state.
-    #[must_use]
-    pub fn snapshot(&self) -> Vec<InMemoryPaymentControlJobRecord> {
-        self.queue.snapshot()
-    }
-
-    /// Return raw taskman records with worker IDs and timestamps for runtime diagnostics.
-    #[must_use]
-    pub fn taskman_records(&self) -> Vec<TaskQueueRecord> {
-        self.queue.taskman_records()
-    }
-
-    /// Cancel one raw taskman control job and persist the queue snapshot.
-    pub fn cancel_taskman_job(
-        &self,
-        job_id: i64,
-    ) -> Result<(), PersistentPaymentControlJobQueueError> {
-        self.queue.cancel_taskman_job(job_id)?;
-        Ok(())
-    }
-
-    /// Delete one raw taskman control job and persist the queue snapshot.
-    pub fn delete_taskman_job(
-        &self,
-        job_id: i64,
-    ) -> Result<TaskQueueRecord, PersistentPaymentControlJobQueueError> {
-        let record = self.queue.delete_taskman_job(job_id)?;
-        Ok(record)
-    }
-
-    /// Restart one raw taskman control job and persist the queue snapshot.
-    pub fn restart_taskman_job(
-        &self,
-        job_id: i64,
-    ) -> Result<i64, PersistentPaymentControlJobQueueError> {
-        let new_id = self.queue.restart_taskman_job(job_id)?;
-        Ok(new_id)
-    }
-}
-
-/// Synchronous-flush retry budget for payment-flow control jobs before falling back
-/// to the background sync worker.
-const PAYMENT_CONTROL_FLUSH_ATTEMPTS: u32 = 3;
-const PAYMENT_CONTROL_FLUSH_RETRY_DELAY: std::time::Duration = std::time::Duration::from_millis(50);
-
-/// Control kinds that must never be dropped by enqueue rate limiting.
-const fn control_kind_skips_task_enqueue_rate_limit(kind: ControlKind) -> bool {
-    matches!(
-        kind,
-        ControlKind::SuccessfulPayment
-            | ControlKind::VipInvoice
-            | ControlKind::DonateInvoice
-            | ControlKind::ChatAdminsSync
-            | ControlKind::ChatMemberSync
-    )
-}
-
-impl PersistentPaymentControlJobQueue {
-    async fn assign_payment_control_job_with_schedule(
-        &self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-        schedule: Option<TaskQueueSchedule>,
-    ) -> Result<(), PersistentPaymentControlJobQueueError> {
-        let params = control_job_params_from_stateless_job(&job)
-            .map_err(|error| InMemoryPaymentControlJobQueueError::Taskman(error.to_string()))?;
-        let chat_id = params.chat_id;
-        let user_id = params.user_id;
-        let control_kind = params.data.kind;
-        // Payment and member-state control jobs are exempt from enqueue throttling:
-        // dropping them would silently lose durable payment intent or Telegram state.
-        // They are rare control-plane events, not the dialog burst the limiter targets.
-        let rate_limit = if control_kind_skips_task_enqueue_rate_limit(control_kind) {
-            None
-        } else {
-            self.task_enqueue_rate_limit.as_ref()
-        };
-        if let Some(rate_limit) = rate_limit {
-            let now = OffsetDateTime::now_utc();
-            let report = rate_limit
-                .check_task_enqueue_rate_limit(chat_id, user_id, now)
-                .await;
-            if report.limited {
-                tracing::warn!(
-                    queue_name,
-                    chat_id,
-                    user_id,
-                    control_kind = ?control_kind,
-                    rate_limit_scope = ?report.scope,
-                    rate_limit_error = ?report.error,
-                    "task enqueue rate limit rejected control job"
-                );
-                return Err(PersistentPaymentControlJobQueueError::TaskEnqueueRateLimited);
-            }
-            if let Some(error) = report.error {
-                tracing::warn!(
-                    queue_name,
-                    chat_id,
-                    user_id,
-                    control_kind = ?control_kind,
-                    error,
-                    "task enqueue rate limit store check failed before control job assignment"
-                );
-            }
-        }
-        if let Some(schedule) = schedule {
-            self.queue
-                .schedule_payment_control_job(queue_name, job, schedule)
-                .await?;
-        } else {
-            self.queue
-                .assign_payment_control_job(queue_name, job)
-                .await?;
-        }
-        // Best-effort synchronous durability for the payment-flow job: retry the
-        // flush a few times to ride out a transient Postgres blip so the job is
-        // durable before the update is acked. If every attempt fails, the 1s
-        // background sync worker remains the durability backstop (a crash inside
-        // that residual window would re-deliver the update, which is idempotent).
-        if let Some(journal) = &self.db_journal {
-            let mut last_error = None;
-            for attempt in 0..PAYMENT_CONTROL_FLUSH_ATTEMPTS {
-                match journal.flush_dirty().await {
-                    Ok(_) => {
-                        last_error = None;
-                        break;
-                    }
-                    Err(error) => {
-                        last_error = Some(error);
-                        if attempt + 1 < PAYMENT_CONTROL_FLUSH_ATTEMPTS {
-                            tokio::time::sleep(PAYMENT_CONTROL_FLUSH_RETRY_DELAY).await;
-                        }
-                    }
-                }
-            }
-            if let Some(error) = last_error {
-                tracing::error!(
-                    queue_name,
-                    control_kind = ?control_kind,
-                    %error,
-                    "control job not durably flushed after retries; relying on background sync worker"
-                );
-            }
-        }
-        if let Some(rate_limit) = rate_limit {
-            let report = rate_limit
-                .grow_task_enqueue_rate_limit(chat_id, user_id, OffsetDateTime::now_utc())
-                .await;
-            for error in report.save_errors {
-                tracing::warn!(
-                    queue_name,
-                    chat_id,
-                    user_id,
-                    control_kind = ?control_kind,
-                    error,
-                    "task enqueue rate limit store save failed after control job assignment"
-                );
-            }
-        }
-        Ok(())
-    }
-}
-
-impl PaymentControlJobQueue for PersistentPaymentControlJobQueue {
-    type Error = PersistentPaymentControlJobQueueError;
-
-    fn assign_payment_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-    ) -> PaymentControlJobQueueFuture<'a, Self::Error> {
-        Box::pin(self.assign_payment_control_job_with_schedule(queue_name, job, None))
-    }
-
-    fn schedule_payment_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-        schedule: TaskQueueSchedule,
-    ) -> PaymentControlJobQueueFuture<'a, Self::Error> {
-        Box::pin(self.assign_payment_control_job_with_schedule(queue_name, job, Some(schedule)))
-    }
-}
-
-impl PaymentControlJobWorkerQueue for PersistentPaymentControlJobQueue {
-    type Error = PersistentPaymentControlJobQueueError;
-
-    fn dequeue_payment_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-    ) -> PaymentControlJobWorkerFuture<'a, Option<PaymentControlJobWorkItem>, Self::Error> {
-        self.dequeue_shared_control_job_matching(
-            queue_name,
-            "payment-control",
-            is_payment_control_job,
-        )
-    }
-
-    fn complete_payment_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        report: &'a PaymentControlJobReport,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error> {
-        Box::pin(async move {
-            self.queue
-                .complete_payment_control_job(job_id, report)
-                .await?;
-            Ok(())
-        })
-    }
-
-    fn fail_payment_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error> {
-        self.fail_shared_control_job(job_id, error)
-    }
-}
-
-impl SharedControlJobWorkerQueue for PersistentPaymentControlJobQueue {
-    type Error = PersistentPaymentControlJobQueueError;
-
-    fn dequeue_shared_control_job_matching<'a>(
-        &'a self,
-        queue_name: &'static str,
-        worker_id: &'static str,
-        predicate: fn(&StatelessJobItem) -> bool,
-    ) -> PaymentControlJobWorkerFuture<'a, Option<PaymentControlJobWorkItem>, Self::Error> {
-        Box::pin(async move {
-            self.queue
-                .dequeue_shared_control_job_matching(queue_name, worker_id, predicate)
-                .await
-                .map_err(Into::into)
-        })
-    }
-
-    fn complete_shared_control_job<'a>(
-        &'a self,
-        job_id: i64,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error> {
-        Box::pin(async move {
-            self.queue.complete_shared_control_job(job_id).await?;
-            Ok(())
-        })
-    }
-
-    fn fail_shared_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error> {
-        Box::pin(async move {
-            self.queue.fail_shared_control_job(job_id, error).await?;
-            Ok(())
-        })
-    }
-}
-
-impl Default for InMemoryPaymentControlJobQueue {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl PaymentControlJobQueue for InMemoryPaymentControlJobQueue {
-    type Error = InMemoryPaymentControlJobQueueError;
-
-    fn assign_payment_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-    ) -> PaymentControlJobQueueFuture<'a, Self::Error> {
-        Box::pin(async move {
-            self.queue.assign(queue_name, job);
-            Ok(())
-        })
-    }
-
-    fn schedule_payment_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-        schedule: TaskQueueSchedule,
-    ) -> PaymentControlJobQueueFuture<'a, Self::Error> {
-        Box::pin(async move {
-            self.queue.schedule_or_replace(queue_name, job, schedule);
-            Ok(())
-        })
-    }
-}
-
-impl PaymentControlJobWorkerQueue for InMemoryPaymentControlJobQueue {
-    type Error = InMemoryPaymentControlJobQueueError;
-
-    fn dequeue_payment_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-    ) -> PaymentControlJobWorkerFuture<'a, Option<PaymentControlJobWorkItem>, Self::Error> {
-        self.dequeue_shared_control_job_matching(
-            queue_name,
-            "payment-control",
-            is_payment_control_job,
-        )
-    }
-
-    fn complete_payment_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        report: &'a PaymentControlJobReport,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error> {
-        Box::pin(async move {
-            self.queue
-                .complete(job_id, OffsetDateTime::now_utc())
-                .map_err(in_memory_payment_queue_error)?;
-            self.completed_reports().insert(job_id, report.clone());
-            Ok(())
-        })
-    }
-
-    fn fail_payment_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error> {
-        Box::pin(async move {
-            self.queue
-                .fail(job_id, error, OffsetDateTime::now_utc())
-                .map_err(in_memory_payment_queue_error)?;
-            self.completed_reports().remove(&job_id);
-            Ok(())
-        })
-    }
-}
-
-impl SharedControlJobWorkerQueue for InMemoryPaymentControlJobQueue {
-    type Error = InMemoryPaymentControlJobQueueError;
-
-    fn dequeue_shared_control_job_matching<'a>(
-        &'a self,
-        queue_name: &'static str,
-        worker_id: &'static str,
-        predicate: fn(&StatelessJobItem) -> bool,
-    ) -> PaymentControlJobWorkerFuture<'a, Option<PaymentControlJobWorkItem>, Self::Error> {
-        Box::pin(async move {
-            Ok(self
-                .queue
-                .dequeue_matching(queue_name, worker_id, OffsetDateTime::now_utc(), predicate)
-                .map(|item| PaymentControlJobWorkItem {
-                    id: item.id,
-                    job: item.job,
-                }))
-        })
-    }
-
-    fn complete_shared_control_job<'a>(
-        &'a self,
-        job_id: i64,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error> {
-        Box::pin(async move {
-            self.queue
-                .complete(job_id, OffsetDateTime::now_utc())
-                .map_err(in_memory_payment_queue_error)?;
-            self.completed_reports().remove(&job_id);
-            Ok(())
-        })
-    }
-
-    fn fail_shared_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error> {
-        Box::pin(async move {
-            self.queue
-                .fail(job_id, error, OffsetDateTime::now_utc())
-                .map_err(in_memory_payment_queue_error)?;
-            self.completed_reports().remove(&job_id);
-            Ok(())
-        })
-    }
-}
-
-fn in_memory_payment_queue_error(
-    error: openplotva_taskman::TaskQueueError,
-) -> InMemoryPaymentControlJobQueueError {
-    match error {
-        openplotva_taskman::TaskQueueError::JobNotFound(job_id) => {
-            InMemoryPaymentControlJobQueueError::JobNotFound(job_id)
-        }
-        error => InMemoryPaymentControlJobQueueError::Taskman(error.to_string()),
-    }
-}
-
-fn is_payment_control_job(job: &StatelessJobItem) -> bool {
-    if job.data.job_type != JobType::Control {
-        return false;
-    }
-    matches!(
-        job.data.control_data.as_ref().map(|data| data.kind),
-        Some(ControlKind::VipInvoice | ControlKind::DonateInvoice | ControlKind::SuccessfulPayment)
-    )
-}
-
-fn payment_records_from_taskman(
-    records: &[TaskQueueRecord],
-    completed_reports: &HashMap<i64, PaymentControlJobReport>,
-) -> Vec<InMemoryPaymentControlJobRecord> {
-    records
-        .iter()
-        .map(|record| InMemoryPaymentControlJobRecord {
-            id: record.id,
-            queue_name: record.queue_name.clone(),
-            status: payment_status_from_taskman(record.status),
-            job: record.job.clone(),
-            completed_report: completed_reports.get(&record.id).cloned(),
-            error: record.error.clone(),
-        })
-        .collect()
-}
-
-fn payment_status_from_taskman(status: JobStatus) -> InMemoryPaymentControlJobStatus {
-    match status {
-        JobStatus::Pending => InMemoryPaymentControlJobStatus::Pending,
-        JobStatus::Processing | JobStatus::WaitingDelivery => {
-            InMemoryPaymentControlJobStatus::Processing
-        }
-        JobStatus::Completed => InMemoryPaymentControlJobStatus::Completed,
-        JobStatus::Failed | JobStatus::Cancelled => InMemoryPaymentControlJobStatus::Failed,
-    }
-}
-
 impl PreCheckoutPaymentEffects for openplotva_telegram::TelegramClient {
     type Error = carapax::api::ExecuteError;
 
@@ -2605,15 +1827,15 @@ fn non_private_payment_command_targets_other_bot(
 /// pre-checkout answers and payment-redirect sends to the classic Telegram client.
 pub struct RichPaymentEffects {
     inner: openplotva_telegram::TelegramClient,
-    rich: Arc<dyn crate::rich::RichSender>,
+    delivery: Arc<crate::rich::RichOutbox>,
 }
 
 impl RichPaymentEffects {
     pub fn new(
         inner: openplotva_telegram::TelegramClient,
-        rich: Arc<dyn crate::rich::RichSender>,
+        delivery: Arc<crate::rich::RichOutbox>,
     ) -> Self {
-        Self { inner, rich }
+        Self { inner, delivery }
     }
 }
 
@@ -2675,8 +1897,20 @@ impl VipStatusEffects for RichPaymentEffects {
                 reply_markup,
             };
             let html = vip_status_rich_html(&message.text);
-            self.rich
-                .send_rich(message.chat_id, &html, &options)
+            self.delivery
+                .enqueue(
+                    &format!(
+                        "vip-status:{}:{}",
+                        message.chat_id, message.reply_to_message_id
+                    ),
+                    options.message_thread_id,
+                    openplotva_telegram::SendRichMessage {
+                        chat_id: message.chat_id,
+                        html,
+                        options,
+                    },
+                    None,
+                )
                 .await
                 .map_err(|error| error.to_string())?;
             Ok(())
@@ -4078,7 +3312,7 @@ pub async fn enqueue_successful_payment_update_or_else_at<
     handle_other: HandleFn,
 ) -> Result<SuccessfulPaymentControlJobUpdateRoute, HandleError>
 where
-    Queue: PaymentControlJobQueue + Sync,
+    Queue: ControlJobQueue + Sync,
     HandleFn: FnOnce(TelegramUpdate) -> HandleFuture,
     HandleFuture: Future<Output = Result<(), HandleError>>,
 {
@@ -4087,10 +3321,7 @@ where
         return Ok(SuccessfulPaymentControlJobUpdateRoute::Delegated);
     };
 
-    match queue
-        .assign_payment_control_job(CONTROL_QUEUE_NAME, job)
-        .await
-    {
+    match queue.assign_control_job(CONTROL_QUEUE_NAME, job).await {
         Ok(()) => Ok(SuccessfulPaymentControlJobUpdateRoute::Queued),
         Err(error) => {
             tracing::warn!(%error, "failed to assign successful-payment control job");
@@ -4189,21 +3420,20 @@ pub async fn enqueue_payment_invoice_command_update_or_else_at<
     handle_other: HandleFn,
 ) -> Result<PaymentInvoiceCommandUpdateRoute, HandleError>
 where
-    Queue: PaymentControlJobQueue + Sync,
+    Queue: ControlJobQueue + Sync,
     HandleFn: FnOnce(TelegramUpdate) -> HandleFuture,
     HandleFuture: Future<Output = Result<(), HandleError>>,
 {
     match payment_invoice_control_job_from_update_at(&update, created) {
-        PaymentInvoiceControlJobBuild::Job(job) => match queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, *job)
-            .await
-        {
-            Ok(()) => Ok(PaymentInvoiceCommandUpdateRoute::Queued),
-            Err(error) => {
-                tracing::warn!(%error, "failed to assign payment invoice control job");
-                Ok(PaymentInvoiceCommandUpdateRoute::QueueError)
+        PaymentInvoiceControlJobBuild::Job(job) => {
+            match queue.assign_control_job(CONTROL_QUEUE_NAME, *job).await {
+                Ok(()) => Ok(PaymentInvoiceCommandUpdateRoute::Queued),
+                Err(error) => {
+                    tracing::warn!(%error, "failed to assign payment invoice control job");
+                    Ok(PaymentInvoiceCommandUpdateRoute::QueueError)
+                }
             }
-        },
+        }
         PaymentInvoiceControlJobBuild::NotPaymentCommand => {
             handle_other(update).await?;
             Ok(PaymentInvoiceCommandUpdateRoute::Delegated)
@@ -4237,7 +3467,7 @@ pub async fn enqueue_payment_invoice_command_update_with_vip_status_or_else_at<
     handle_other: HandleFn,
 ) -> Result<PaymentInvoiceCommandUpdateRoute, HandleError>
 where
-    Queue: PaymentControlJobQueue + Sync,
+    Queue: ControlJobQueue + Sync,
     Vip: VipStatusChecker + VipStatusStore + Sync,
     Effects: VipStatusEffects + Sync,
     HandleFn: FnOnce(TelegramUpdate) -> HandleFuture,
@@ -4291,16 +3521,15 @@ where
     }
 
     match payment_invoice_control_job_from_message_at(message, created) {
-        PaymentInvoiceControlJobBuild::Job(job) => match queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, *job)
-            .await
-        {
-            Ok(()) => Ok(PaymentInvoiceCommandUpdateRoute::Queued),
-            Err(error) => {
-                tracing::warn!(%error, "failed to assign payment invoice control job");
-                Ok(PaymentInvoiceCommandUpdateRoute::QueueError)
+        PaymentInvoiceControlJobBuild::Job(job) => {
+            match queue.assign_control_job(CONTROL_QUEUE_NAME, *job).await {
+                Ok(()) => Ok(PaymentInvoiceCommandUpdateRoute::Queued),
+                Err(error) => {
+                    tracing::warn!(%error, "failed to assign payment invoice control job");
+                    Ok(PaymentInvoiceCommandUpdateRoute::QueueError)
+                }
             }
-        },
+        }
         PaymentInvoiceControlJobBuild::MissingUser => {
             Ok(PaymentInvoiceCommandUpdateRoute::MissingUser)
         }
@@ -4421,7 +3650,7 @@ impl<Queue, Vip, Effects, Next> PaymentUpdateHandler<Queue, Vip, Effects, Next>
 
 impl<Queue, Vip, Effects, Next> UpdateHandler for PaymentUpdateHandler<Queue, Vip, Effects, Next>
 where
-    Queue: PaymentControlJobQueue + Send + Sync,
+    Queue: ControlJobQueue + Send + Sync,
     Vip: VipStatusChecker + VipStatusStore + Send + Sync,
     Effects: PreCheckoutPaymentEffects + VipStatusEffects + PaymentRedirectEffects + Send + Sync,
     Next: UpdateHandler + Send + Sync,
@@ -4716,7 +3945,7 @@ pub async fn handle_payment_update_or_else_at<
     handle_other: HandleFn,
 ) -> Result<PaymentUpdateRoute, HandleError>
 where
-    Queue: PaymentControlJobQueue + Sync,
+    Queue: ControlJobQueue + Sync,
     Vip: VipStatusChecker + VipStatusStore + Sync,
     Effects: PreCheckoutPaymentEffects + VipStatusEffects + Sync,
     HandleFn: FnOnce(TelegramUpdate) -> HandleFuture,
@@ -4760,10 +3989,7 @@ where
     }
 
     if let Some(job) = successful_payment_control_job_from_update_at(&update, created) {
-        let route = match queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, job)
-            .await
-        {
+        let route = match queue.assign_control_job(CONTROL_QUEUE_NAME, job).await {
             Ok(()) => SuccessfulPaymentControlJobUpdateRoute::Queued,
             Err(error) => {
                 tracing::warn!(%error, "failed to assign successful-payment control job");
@@ -6030,143 +5256,20 @@ where
             }
             if params.user_id <= 0 {
                 return PaymentControlJobReport::with_error(
-                    PaymentControlJobOutcome::MissingSuccessfulPaymentUser,
-                    "successful payment control job user is required",
-                );
-            }
-            let Some(message) = successful_payment_message_from_control_job(params) else {
-                return PaymentControlJobReport::with_error(
-                    PaymentControlJobOutcome::MissingSuccessfulPayment,
-                    "successful payment control job could not be reconstructed",
-                );
-            };
-            let report = process_successful_payment_at(store, effects, &message, now).await;
-            PaymentControlJobReport::from_successful_payment(report)
-        }
-        _ => PaymentControlJobReport::new(PaymentControlJobOutcome::NotPaymentControlJob),
-    }
-}
-
-pub const PAYMENT_CONTROL_JOB_POLL_INTERVAL: Duration = Duration::from_secs(1);
-
-/// Process one payment-owned taskman control job, if available.
-pub async fn process_payment_control_job_once_at<Queue, Store, Effects>(
-    queue: &Queue,
-    store: &Store,
-    effects: &Effects,
-    now: OffsetDateTime,
-) -> PaymentControlJobWorkerReport
-where
-    Queue: PaymentControlJobWorkerQueue + Sync,
-    Store: SuccessfulPaymentStore + Sync,
-    Effects: PaymentInvoiceEffects + SuccessfulPaymentEffects + Sync,
-{
-    let mut report = PaymentControlJobWorkerReport::default();
-    let item = match queue.dequeue_payment_control_job(CONTROL_QUEUE_NAME).await {
-        Ok(item) => item,
-        Err(error) => {
-            report.dequeue_error = Some(error.to_string());
-            return report;
-        }
-    };
-
-    let Some(item) = item else {
-        return report;
-    };
-    report.dequeued = true;
-    report.job_id = Some(item.id);
-
-    let params = match control_job_params_from_stateless_job(&item.job) {
-        Ok(params) => params,
-        Err(error) => {
-            let error = error.to_string();
-            report.decode_error = Some(error.clone());
-            mark_payment_control_job_failed(queue, item.id, &error, &mut report).await;
-            return report;
-        }
-    };
-
-    let execution = execute_payment_control_job_at(store, effects, &params, now).await;
-    if let Some(error) = payment_control_job_failure_message(&execution) {
-        mark_payment_control_job_failed(queue, item.id, &error, &mut report).await;
-    } else {
-        match queue
-            .complete_payment_control_job(item.id, &execution)
-            .await
-        {
-            Ok(()) => report.completed = true,
-            Err(error) => report.status_error = Some(error.to_string()),
-        }
-    }
-    report.execution = Some(execution);
-    report
-}
-
-/// Run the payment-owned taskman control-job worker until the stop future resolves.
-pub async fn run_payment_control_job_worker_until<Queue, Store, Effects, Stop>(
-    queue: &Queue,
-    store: &Store,
-    effects: &Effects,
-    stop: Stop,
-) -> PaymentControlJobWorkerRunReport
-where
-    Queue: PaymentControlJobWorkerQueue + Sync,
-    Store: SuccessfulPaymentStore + Sync,
-    Effects: PaymentInvoiceEffects + SuccessfulPaymentEffects + Sync,
-    Stop: Future<Output = ()>,
-{
-    run_payment_control_job_worker_every_until(
-        queue,
-        store,
-        effects,
-        PAYMENT_CONTROL_JOB_POLL_INTERVAL,
-        stop,
-    )
-    .await
-}
-
-/// Run the payment-owned taskman control-job worker with an injected interval.
-pub async fn run_payment_control_job_worker_every_until<Queue, Store, Effects, Stop>(
-    queue: &Queue,
-    store: &Store,
-    effects: &Effects,
-    interval: Duration,
-    stop: Stop,
-) -> PaymentControlJobWorkerRunReport
-where
-    Queue: PaymentControlJobWorkerQueue + Sync,
-    Store: SuccessfulPaymentStore + Sync,
-    Effects: PaymentInvoiceEffects + SuccessfulPaymentEffects + Sync,
-    Stop: Future<Output = ()>,
-{
-    let mut report = PaymentControlJobWorkerRunReport::default();
-    let mut stop = std::pin::pin!(stop);
-
-    loop {
-        tokio::select! {
-            () = &mut stop => break,
-            () = tokio::time::sleep(interval) => {
-                let tick = process_payment_control_job_once_at(queue, store, effects, OffsetDateTime::now_utc()).await;
-                trace_payment_control_job_tick(&tick);
-                report.record_tick(&tick);
+                    PaymentControlJobOutcome::MissingSuccessfulPaymentUser,
+                    "successful payment control job user is required",
+                );
             }
+            let Some(message) = successful_payment_message_from_control_job(params) else {
+                return PaymentControlJobReport::with_error(
+                    PaymentControlJobOutcome::MissingSuccessfulPayment,
+                    "successful payment control job could not be reconstructed",
+                );
+            };
+            let report = process_successful_payment_at(store, effects, &message, now).await;
+            PaymentControlJobReport::from_successful_payment(report)
         }
-    }
-
-    report
-}
-
-async fn mark_payment_control_job_failed<Queue>(
-    queue: &Queue,
-    job_id: i64,
-    error: &str,
-    report: &mut PaymentControlJobWorkerReport,
-) where
-    Queue: PaymentControlJobWorkerQueue + Sync,
-{
-    match queue.fail_payment_control_job(job_id, error).await {
-        Ok(()) => report.failed = true,
-        Err(error) => report.status_error = Some(error.to_string()),
+        _ => PaymentControlJobReport::new(PaymentControlJobOutcome::NotPaymentControlJob),
     }
 }
 
@@ -6227,24 +5330,6 @@ pub(crate) fn payment_control_job_failure_message(
     }
 }
 
-fn trace_payment_control_job_tick(tick: &PaymentControlJobWorkerReport) {
-    if !tick.dequeued && tick.dequeue_error.is_none() {
-        return;
-    }
-
-    tracing::debug!(
-        dequeued = tick.dequeued,
-        job_id = tick.job_id,
-        completed = tick.completed,
-        failed = tick.failed,
-        outcome = ?tick.execution.as_ref().map(|report| &report.outcome),
-        dequeue_error = tick.dequeue_error.as_deref(),
-        decode_error = tick.decode_error.as_deref(),
-        status_error = tick.status_error.as_deref(),
-        "processed payment control job"
-    );
-}
-
 #[must_use]
 pub fn successful_payment_message_from_control_job(
     params: &ControlJobParams,
@@ -6966,10 +6051,7 @@ mod tests {
             CallbackQueryEffects, CallbackQueryFuture, CallbackQueryUpdateRoute,
             CallbackRateLimitFuture, CallbackRateLimitPolicy, handle_callback_query_update_or_else,
         },
-        control_jobs::{
-            ControlJobExecution, ControlJobExecutionResult, ControlJobExecutorFuture,
-            ControlJobExecutorRegistry, process_control_job_once_at,
-        },
+        control_jobs::{ControlJobExecution, process_control_job_once_at},
         help::{HelpBotIdentity, HelpCommandUpdateHandler, HelpDispatcherEffects},
         updates::{
             TelegramFileMetadataStoreFuture, UpdateHandler, UpdateStateStore,
@@ -6989,7 +6071,7 @@ mod tests {
     };
     use openplotva_taskman::{
         CONTROL_QUEUE_NAME, ControlJobData, ControlJobParams, ControlKind, ControlPayment,
-        DEFAULT_PRIORITY, HIGH_PRIORITY, InMemoryTaskQueue, JobPayload, JobType, StatelessJobItem,
+        DEFAULT_PRIORITY, HIGH_PRIORITY, InMemoryTaskQueue, JobType, StatelessJobItem,
         TRANSACTION_PRIORITY, new_control_job_at,
     };
     use openplotva_updates::{UpdateConsumerConfig, UpdateStageOutcome};
@@ -6998,15 +6080,13 @@ mod tests {
 
     use super::{
         AdminVipCommandUpdateHandler, AdminVipCommandUpdateOutcome, AdminVipCommandUpdateRuntime,
-        CRYPTO_DONATION_ADDRESSES, InMemoryPaymentControlJobQueue, InMemoryPaymentControlJobStatus,
-        InvoiceButtonMessage, InvoiceControlJobOutcome, InvoiceControlJobReport,
-        PaymentControlJobOutcome, PaymentControlJobQueue, PaymentControlJobQueueFuture,
-        PaymentControlJobReport, PaymentControlJobWorkItem, PaymentControlJobWorkerFuture,
-        PaymentControlJobWorkerQueue, PaymentEffectsFuture, PaymentInvoiceCommandUpdateRoute,
-        PaymentInvoiceControlJobBuild, PaymentInvoiceEffects, PaymentInvoiceLinkFuture,
-        PaymentRedirectMessage, PaymentRuntimeEffects, PaymentStoreFuture, PaymentTextMessage,
-        PaymentUpdateHandler, PaymentUpdateRoute, PreCheckoutOutcome, PreCheckoutPaymentEffects,
-        PreCheckoutUpdateRoute, SuccessfulPayment, SuccessfulPaymentControlJobUpdateRoute,
+        CRYPTO_DONATION_ADDRESSES, ControlJobQueue, InvoiceButtonMessage, InvoiceControlJobOutcome,
+        InvoiceControlJobReport, PaymentControlJobOutcome, PaymentControlJobReport,
+        PaymentEffectsFuture, PaymentInvoiceCommandUpdateRoute, PaymentInvoiceControlJobBuild,
+        PaymentInvoiceEffects, PaymentInvoiceLinkFuture, PaymentRedirectMessage,
+        PaymentRuntimeEffects, PaymentStoreFuture, PaymentTextMessage, PaymentUpdateHandler,
+        PaymentUpdateRoute, PreCheckoutOutcome, PreCheckoutPaymentEffects, PreCheckoutUpdateRoute,
+        SuccessfulPayment, SuccessfulPaymentControlJobUpdateRoute,
         SuccessfulPaymentDispatcherEffects, SuccessfulPaymentEffects, SuccessfulPaymentMessage,
         SuccessfulPaymentOutcome, SuccessfulPaymentStore, SuccessfulPaymentUpdateRoute,
         VipCancellationCallbackOutcome, VipCancellationEffectFuture, VipCancellationEffects,
@@ -7019,12 +6099,15 @@ mod tests {
         handle_admin_vip_command_update_or_else_at, handle_payment_update_or_else_at,
         handle_pre_checkout_update_or_else, handle_successful_payment_update_or_else_at,
         handle_vip_cancellation_callback_update_or_else_at, invoice_button_send_message_method,
-        payment_control_job_failure_message, payment_invoice_control_job_from_update_at,
-        process_payment_control_job_once_at, process_successful_payment_at,
+        payment_invoice_control_job_from_update_at, process_successful_payment_at,
         subscription_invoice_message_text, subscription_success_text,
         successful_payment_control_job_from_update_at, successful_payment_message_from_control_job,
         successful_payment_message_from_update,
     };
+    use crate::control_jobs::{
+        ControlJobEnqueueFuture, InMemoryControlJobQueue, InMemoryControlJobStatus,
+        SharedControlJobWorkerQueue,
+    };
 
     #[tokio::test]
     async fn subscription_payment_writes_user_subscription_vip_event_and_success_side_effects()
@@ -11120,7 +10203,7 @@ mod tests {
         let help_effects = Arc::new(HelpDispatcherEffects::new(
             telegram,
             Arc::clone(&payment_handler),
-            Arc::new(crate::rich::MockRichSender::default()),
+            crate::rich::unreachable_outbox(),
         ));
         let help_handler = HelpCommandUpdateHandler::new(
             HelpBotIdentity {
@@ -11596,7 +10679,7 @@ mod tests {
         let _: i64 = redis::cmd("DEL").arg(&key).query_async(&mut redis).await?;
 
         let state_store = UpdateStateStoreStub::default();
-        let queue = Arc::new(InMemoryPaymentControlJobQueue::new());
+        let queue = Arc::new(InMemoryControlJobQueue::new());
         let vip = Arc::new(VipStatusStoreStub::new().with_is_vip(false));
         let effects = Arc::new(EffectsStub::default().with_next_invoice_url("https://t.me/donate"));
         let next = Arc::new(UpdateHandlerStub::default());
@@ -11641,15 +10724,12 @@ mod tests {
         assert_eq!(queue.snapshot()[0].job.title, "donate invoice");
         assert_eq!(
             queue.snapshot()[0].status,
-            InMemoryPaymentControlJobStatus::Pending
+            InMemoryControlJobStatus::Pending
         );
 
         let store = StoreStub::new();
-        let registry = PaymentOnlyControlJobRegistry {
-            store: &store,
-            effects: effects.as_ref(),
-        };
-        let worker = process_control_job_once_at(queue.as_ref(), &registry, now).await;
+        let worker =
+            run_payment_on_shared_worker(queue.as_ref(), &store, effects.as_ref(), now).await;
 
         assert!(worker.dequeued);
         assert_eq!(worker.kind, Some(ControlKind::DonateInvoice));
@@ -11681,7 +10761,7 @@ mod tests {
         );
         assert_eq!(
             queue.snapshot()[0].status,
-            InMemoryPaymentControlJobStatus::Completed
+            InMemoryControlJobStatus::Completed
         );
         assert_eq!(update_queue.len().await?, 0);
 
@@ -12086,179 +11166,11 @@ mod tests {
         Ok(())
     }
 
-    #[tokio::test]
-    async fn payment_control_job_worker_dequeues_executes_and_completes_invoice_job()
-    -> Result<(), Box<dyn Error>> {
-        let now = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
-        let queue = PaymentControlJobWorkerQueueStub::default().with_next_job(sample_work_item(
-            7,
-            sample_invoice_job(ControlKind::VipInvoice),
-            now,
-        ));
-        let store = StoreStub::new();
-        let effects = EffectsStub::default().with_next_invoice_url("https://t.me/invoice-vip");
-
-        let report = process_payment_control_job_once_at(&queue, &store, &effects, now).await;
-
-        assert!(report.dequeued);
-        assert_eq!(report.job_id, Some(7));
-        assert!(report.completed);
-        assert!(!report.failed);
-        assert_eq!(
-            report.execution.as_ref().map(|report| &report.outcome),
-            Some(&PaymentControlJobOutcome::VipInvoice(
-                InvoiceControlJobOutcome::InvoiceSent
-            ))
-        );
-        assert_eq!(queue.completed_ids(), vec![7]);
-        assert!(queue.failed().is_empty());
-        assert_eq!(
-            effects.subscription_invoice_requests(),
-            vec![openplotva_telegram::SubscriptionInvoiceLinkRequest {
-                user_id: 42,
-                user_name: "alice".to_owned(),
-                amount_stars: 300,
-            }]
-        );
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn payment_control_job_worker_marks_invoice_executor_errors_failed()
-    -> Result<(), Box<dyn Error>> {
-        let now = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
-        let queue = PaymentControlJobWorkerQueueStub::default().with_next_job(sample_work_item(
-            7,
-            sample_invoice_job(ControlKind::DonateInvoice),
-            now,
-        ));
-        let store = StoreStub::new();
-        let effects = EffectsStub::default().with_next_invoice_url("   ");
-
-        let report = process_payment_control_job_once_at(&queue, &store, &effects, now).await;
-
-        assert!(report.failed);
-        assert!(!report.completed);
-        assert_eq!(
-            report.execution.as_ref().map(|report| &report.outcome),
-            Some(&PaymentControlJobOutcome::DonateInvoice(
-                InvoiceControlJobOutcome::EmptyInvoiceLink
-            ))
-        );
-        assert_eq!(
-            queue.failed(),
-            vec![(7, "failed to parse donation invoice link".to_owned())]
-        );
-        assert!(queue.completed_ids().is_empty());
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn payment_control_job_worker_marks_rejected_successful_payment_failed()
-    -> Result<(), Box<dyn Error>> {
-        let now = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
-        let mut params = sample_successful_payment_control_job();
-        params
-            .data
-            .payment
-            .as_mut()
-            .expect("sample payment")
-            .invoice_payload = "unsupported".to_owned();
-        let queue = PaymentControlJobWorkerQueueStub::default()
-            .with_next_job(sample_work_item(7, params, now));
-        let store = StoreStub::new();
-        let effects = EffectsStub::default();
-
-        let report = process_payment_control_job_once_at(&queue, &store, &effects, now).await;
-
-        assert!(report.failed);
-        assert!(!report.completed);
-        assert_eq!(
-            report.execution.as_ref().map(|report| &report.outcome),
-            Some(&PaymentControlJobOutcome::SuccessfulPayment(
-                SuccessfulPaymentOutcome::UnknownPayload
-            ))
-        );
-        assert_eq!(
-            queue.failed(),
-            vec![(
-                7,
-                "successful payment has an unknown invoice payload".to_owned()
-            )]
-        );
-        assert!(queue.completed_ids().is_empty());
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn payment_control_job_worker_fails_unsupported_control_kind()
-    -> Result<(), Box<dyn Error>> {
-        let now = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
-        let queue = PaymentControlJobWorkerQueueStub::default().with_next_job(sample_work_item(
-            7,
-            sample_invoice_job(ControlKind::Translate),
-            now,
-        ));
-        let store = StoreStub::new();
-        let effects = EffectsStub::default().with_next_invoice_url("https://t.me/unused");
-
-        let report = process_payment_control_job_once_at(&queue, &store, &effects, now).await;
-
-        assert!(report.failed);
-        assert!(!report.completed);
-        assert_eq!(
-            report.execution.as_ref().map(|report| &report.outcome),
-            Some(&PaymentControlJobOutcome::NotPaymentControlJob)
-        );
-        assert_eq!(
-            queue.failed(),
-            vec![(7, "unsupported payment control job kind".to_owned())]
-        );
-        assert!(effects.subscription_invoice_requests().is_empty());
-        assert!(effects.donation_invoice_requests().is_empty());
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn payment_control_job_worker_fails_malformed_control_payload_without_execution()
-    -> Result<(), Box<dyn Error>> {
-        let now = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
-        let mut item = sample_work_item(7, sample_invoice_job(ControlKind::VipInvoice), now);
-        item.job.data = JobPayload {
-            job_type: JobType::Control,
-            telegram_data: item.job.data.telegram_data.take(),
-            image_data: None,
-            music_data: None,
-            dialog_data: None,
-            asr_data: None,
-            control_data: None,
-            agent_data: None,
-        };
-        let queue = PaymentControlJobWorkerQueueStub::default().with_next_job(item);
-        let store = StoreStub::new();
-        let effects = EffectsStub::default().with_next_invoice_url("https://t.me/unused");
-
-        let report = process_payment_control_job_once_at(&queue, &store, &effects, now).await;
-
-        assert!(report.failed);
-        assert!(report.execution.is_none());
-        assert_eq!(
-            report.decode_error.as_deref(),
-            Some("missing control data for control job")
-        );
-        assert_eq!(
-            queue.failed(),
-            vec![(7, "missing control data for control job".to_owned())]
-        );
-        assert!(effects.subscription_invoice_requests().is_empty());
-        Ok(())
-    }
-
     #[tokio::test]
     async fn in_memory_payment_control_job_queue_dequeues_go_priority_then_fifo_order()
     -> Result<(), Box<dyn Error>> {
         let created = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
-        let queue = super::InMemoryPaymentControlJobQueue::new();
+        let queue = crate::control_jobs::InMemoryControlJobQueue::new();
         let low_old = new_control_job_at(sample_invoice_job(ControlKind::DonateInvoice), created)
             .with_name("low old")
             .with_priority(DEFAULT_PRIORITY);
@@ -12276,25 +11188,37 @@ mod tests {
         .with_priority(HIGH_PRIORITY);
 
         queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, low_old)
+            .assign_control_job(CONTROL_QUEUE_NAME, low_old)
             .await?;
         queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, high_new)
+            .assign_control_job(CONTROL_QUEUE_NAME, high_new)
             .await?;
         queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, high_old)
+            .assign_control_job(CONTROL_QUEUE_NAME, high_old)
             .await?;
 
         let first = queue
-            .dequeue_payment_control_job(CONTROL_QUEUE_NAME)
+            .dequeue_shared_control_job_matching(
+                CONTROL_QUEUE_NAME,
+                "control-job-dispatcher",
+                |_| true,
+            )
             .await?
             .expect("first job");
         let second = queue
-            .dequeue_payment_control_job(CONTROL_QUEUE_NAME)
+            .dequeue_shared_control_job_matching(
+                CONTROL_QUEUE_NAME,
+                "control-job-dispatcher",
+                |_| true,
+            )
             .await?
             .expect("second job");
         let third = queue
-            .dequeue_payment_control_job(CONTROL_QUEUE_NAME)
+            .dequeue_shared_control_job_matching(
+                CONTROL_QUEUE_NAME,
+                "control-job-dispatcher",
+                |_| true,
+            )
             .await?
             .expect("third job");
 
@@ -12303,59 +11227,22 @@ mod tests {
         assert_eq!(third.job.title, "low old");
         assert!(
             queue
-                .dequeue_payment_control_job(CONTROL_QUEUE_NAME)
+                .dequeue_shared_control_job_matching(
+                    CONTROL_QUEUE_NAME,
+                    "control-job-dispatcher",
+                    |_| true
+                )
                 .await?
                 .is_none()
         );
         Ok(())
     }
 
-    #[tokio::test]
-    async fn in_memory_payment_control_job_queue_skips_non_payment_control_jobs()
-    -> Result<(), Box<dyn Error>> {
-        let created = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
-        let queue = super::InMemoryPaymentControlJobQueue::new();
-        let translate = new_control_job_at(sample_invoice_job(ControlKind::Translate), created)
-            .with_name("translate")
-            .with_priority(HIGH_PRIORITY);
-        let donate = new_control_job_at(
-            sample_invoice_job(ControlKind::DonateInvoice),
-            created + time::Duration::seconds(1),
-        )
-        .with_name("donate")
-        .with_priority(DEFAULT_PRIORITY);
-
-        queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, translate)
-            .await?;
-        queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, donate)
-            .await?;
-
-        let item = queue
-            .dequeue_payment_control_job(CONTROL_QUEUE_NAME)
-            .await?
-            .expect("payment item");
-        assert_eq!(item.job.title, "donate");
-        let snapshot = queue.snapshot();
-        assert_eq!(snapshot[0].job.title, "translate");
-        assert_eq!(
-            snapshot[0].status,
-            super::InMemoryPaymentControlJobStatus::Pending
-        );
-        assert_eq!(snapshot[1].job.title, "donate");
-        assert_eq!(
-            snapshot[1].status,
-            super::InMemoryPaymentControlJobStatus::Processing
-        );
-        Ok(())
-    }
-
     #[tokio::test]
     async fn in_memory_payment_control_job_queue_records_completion_and_failure_status()
     -> Result<(), Box<dyn Error>> {
         let created = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
-        let queue = super::InMemoryPaymentControlJobQueue::new();
+        let queue = crate::control_jobs::InMemoryControlJobQueue::new();
         let complete_job = new_control_job_at(sample_invoice_job(ControlKind::VipInvoice), created)
             .with_name("complete")
             .with_priority(HIGH_PRIORITY);
@@ -12367,44 +11254,44 @@ mod tests {
         .with_priority(HIGH_PRIORITY);
 
         queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, complete_job)
+            .assign_control_job(CONTROL_QUEUE_NAME, complete_job)
             .await?;
         queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, fail_job)
+            .assign_control_job(CONTROL_QUEUE_NAME, fail_job)
             .await?;
 
         let complete_item = queue
-            .dequeue_payment_control_job(CONTROL_QUEUE_NAME)
+            .dequeue_shared_control_job_matching(
+                CONTROL_QUEUE_NAME,
+                "control-job-dispatcher",
+                |_| true,
+            )
             .await?
             .expect("complete item");
         let fail_item = queue
-            .dequeue_payment_control_job(CONTROL_QUEUE_NAME)
+            .dequeue_shared_control_job_matching(
+                CONTROL_QUEUE_NAME,
+                "control-job-dispatcher",
+                |_| true,
+            )
             .await?
             .expect("fail item");
-        let report = PaymentControlJobReport::new(PaymentControlJobOutcome::VipInvoice(
-            InvoiceControlJobOutcome::InvoiceSent,
-        ));
-
+        queue.complete_shared_control_job(complete_item.id).await?;
         queue
-            .complete_payment_control_job(complete_item.id, &report)
-            .await?;
-        queue
-            .fail_payment_control_job(fail_item.id, "invoice failed")
+            .fail_shared_control_job(fail_item.id, "invoice failed")
             .await?;
 
         let snapshot = queue.snapshot();
         assert_eq!(snapshot.len(), 2);
         assert_eq!(
             snapshot[0].status,
-            super::InMemoryPaymentControlJobStatus::Completed
+            crate::control_jobs::InMemoryControlJobStatus::Completed
         );
-        assert_eq!(snapshot[0].completed_report, Some(report));
         assert_eq!(snapshot[0].error, None);
         assert_eq!(
             snapshot[1].status,
-            super::InMemoryPaymentControlJobStatus::Failed
+            crate::control_jobs::InMemoryControlJobStatus::Failed
         );
-        assert_eq!(snapshot[1].completed_report, None);
         assert_eq!(snapshot[1].error.as_deref(), Some("invoice failed"));
         Ok(())
     }
@@ -12413,22 +11300,23 @@ mod tests {
     async fn persistent_control_queue_task_enqueue_limit_blocks_before_assignment()
     -> Result<(), Box<dyn Error>> {
         let limiter = Arc::new(TaskEnqueueRateLimitStub::limited());
-        let queue =
-            super::PersistentPaymentControlJobQueue::from_task_queue(InMemoryTaskQueue::new())
-                .with_task_enqueue_rate_limit(limiter.clone());
+        let queue = crate::control_jobs::PersistentControlJobQueue::from_task_queue(
+            InMemoryTaskQueue::new(),
+        )
+        .with_task_enqueue_rate_limit(limiter.clone());
         let created = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
         let job = new_control_job_at(sample_invoice_job(ControlKind::Translate), created)
             .with_name("translate")
             .with_priority(HIGH_PRIORITY);
 
         let error = queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, job)
+            .assign_control_job(CONTROL_QUEUE_NAME, job)
             .await
             .expect_err("task enqueue limit should block assignment");
 
         assert!(matches!(
             error,
-            super::PersistentPaymentControlJobQueueError::TaskEnqueueRateLimited
+            crate::control_jobs::PersistentControlJobQueueError::TaskEnqueueRateLimited
         ));
         assert!(queue.snapshot().is_empty());
         assert_eq!(limiter.check_calls(), vec![(1000, 42)]);
@@ -12440,17 +11328,16 @@ mod tests {
     async fn persistent_control_queue_grows_task_enqueue_limit_after_assignment()
     -> Result<(), Box<dyn Error>> {
         let limiter = Arc::new(TaskEnqueueRateLimitStub::default());
-        let queue =
-            super::PersistentPaymentControlJobQueue::from_task_queue(InMemoryTaskQueue::new())
-                .with_task_enqueue_rate_limit(limiter.clone());
+        let queue = crate::control_jobs::PersistentControlJobQueue::from_task_queue(
+            InMemoryTaskQueue::new(),
+        )
+        .with_task_enqueue_rate_limit(limiter.clone());
         let created = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
         let job = new_control_job_at(sample_invoice_job(ControlKind::Translate), created)
             .with_name("translate")
             .with_priority(HIGH_PRIORITY);
 
-        queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, job)
-            .await?;
+        queue.assign_control_job(CONTROL_QUEUE_NAME, job).await?;
 
         assert_eq!(queue.snapshot().len(), 1);
         assert_eq!(limiter.check_calls(), vec![(1000, 42)]);
@@ -12464,17 +11351,16 @@ mod tests {
         // Payment-intent commands (/vip, /donate) must never be dropped by the limiter.
         for kind in [ControlKind::VipInvoice, ControlKind::DonateInvoice] {
             let limiter = Arc::new(TaskEnqueueRateLimitStub::limited());
-            let queue =
-                super::PersistentPaymentControlJobQueue::from_task_queue(InMemoryTaskQueue::new())
-                    .with_task_enqueue_rate_limit(limiter.clone());
+            let queue = crate::control_jobs::PersistentControlJobQueue::from_task_queue(
+                InMemoryTaskQueue::new(),
+            )
+            .with_task_enqueue_rate_limit(limiter.clone());
             let created = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
             let job = new_control_job_at(sample_invoice_job(kind), created)
                 .with_name("payment invoice")
                 .with_priority(HIGH_PRIORITY);
 
-            queue
-                .assign_payment_control_job(CONTROL_QUEUE_NAME, job)
-                .await?;
+            queue.assign_control_job(CONTROL_QUEUE_NAME, job).await?;
 
             assert_eq!(queue.snapshot().len(), 1, "{kind:?} must be queued");
             assert!(
@@ -12490,17 +11376,16 @@ mod tests {
     async fn persistent_control_queue_does_not_rate_limit_successful_payment()
     -> Result<(), Box<dyn Error>> {
         let limiter = Arc::new(TaskEnqueueRateLimitStub::limited());
-        let queue =
-            super::PersistentPaymentControlJobQueue::from_task_queue(InMemoryTaskQueue::new())
-                .with_task_enqueue_rate_limit(limiter.clone());
+        let queue = crate::control_jobs::PersistentControlJobQueue::from_task_queue(
+            InMemoryTaskQueue::new(),
+        )
+        .with_task_enqueue_rate_limit(limiter.clone());
         let created = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
         let job = new_control_job_at(sample_invoice_job(ControlKind::SuccessfulPayment), created)
             .with_name("successful payment")
             .with_priority(HIGH_PRIORITY);
 
-        queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, job)
-            .await?;
+        queue.assign_control_job(CONTROL_QUEUE_NAME, job).await?;
 
         assert_eq!(queue.snapshot().len(), 1);
         assert!(limiter.check_calls().is_empty());
@@ -12513,17 +11398,16 @@ mod tests {
     -> Result<(), Box<dyn Error>> {
         for kind in [ControlKind::ChatAdminsSync, ControlKind::ChatMemberSync] {
             let limiter = Arc::new(TaskEnqueueRateLimitStub::limited());
-            let queue =
-                super::PersistentPaymentControlJobQueue::from_task_queue(InMemoryTaskQueue::new())
-                    .with_task_enqueue_rate_limit(limiter.clone());
+            let queue = crate::control_jobs::PersistentControlJobQueue::from_task_queue(
+                InMemoryTaskQueue::new(),
+            )
+            .with_task_enqueue_rate_limit(limiter.clone());
             let created = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
             let job = new_control_job_at(sample_invoice_job(kind), created)
                 .with_name("member state sync")
                 .with_priority(HIGH_PRIORITY);
 
-            queue
-                .assign_payment_control_job(CONTROL_QUEUE_NAME, job)
-                .await?;
+            queue.assign_control_job(CONTROL_QUEUE_NAME, job).await?;
 
             assert_eq!(queue.snapshot().len(), 1, "{kind:?} must be queued");
             assert!(
@@ -12704,42 +11588,117 @@ mod tests {
         params
     }
 
-    fn sample_work_item(
-        id: i64,
-        params: ControlJobParams,
-        created: OffsetDateTime,
-    ) -> PaymentControlJobWorkItem {
-        PaymentControlJobWorkItem {
-            id,
-            job: new_control_job_at(params, created),
-        }
-    }
+    use crate::control_jobs::test_support::UnusedControlPorts;
 
-    struct PaymentOnlyControlJobRegistry<'a> {
-        store: &'a StoreStub,
-        effects: &'a EffectsStub,
+    async fn run_payment_on_shared_worker(
+        queue: &InMemoryControlJobQueue,
+        store: &StoreStub,
+        effects: &EffectsStub,
+        now: OffsetDateTime,
+    ) -> crate::control_jobs::ControlJobWorkerReport {
+        let dispatcher = openplotva_telegram::DispatcherQueue::new(Default::default());
+        let ports = UnusedControlPorts;
+        let next_id = || "unused-payment-id".to_owned();
+        let registry = crate::control_jobs::AppControlJobExecutors {
+            payment_store: store,
+            payment_effects: effects,
+            dispatcher_queue: &dispatcher,
+            group_settings_effects: &ports,
+            new_members_effects: &ports,
+            bot_username: "plotva_test",
+            next_virtual_id: &next_id,
+            translator: &ports,
+            translation_effects: &ports,
+            member_effects: &ports,
+            checkin_effects: &ports,
+        };
+        process_control_job_once_at(queue, &registry, now).await
     }
 
-    impl ControlJobExecutorRegistry for PaymentOnlyControlJobRegistry<'_> {
-        fn execute_control_job<'a>(
-            &'a self,
-            params: &'a ControlJobParams,
-            now: OffsetDateTime,
-        ) -> ControlJobExecutorFuture<'a> {
-            Box::pin(async move {
-                let report =
-                    execute_payment_control_job_at(self.store, self.effects, params, now).await;
-                let execution = ControlJobExecution::Payment(report.clone());
-                if let Some(error) = payment_control_job_failure_message(&report) {
-                    ControlJobExecutionResult::Failed {
-                        execution: Some(execution),
-                        error,
-                    }
+    #[tokio::test]
+    async fn shared_worker_preserves_invoice_payload_and_payment_failures()
+    -> Result<(), Box<dyn Error>> {
+        let now = OffsetDateTime::from_unix_timestamp(1_779_193_800)?;
+        for scenario in 0..3 {
+            let queue = InMemoryControlJobQueue::new();
+            let store = StoreStub::new();
+            let effects = EffectsStub::default().with_next_invoice_url(if scenario == 1 {
+                "   "
+            } else {
+                "https://t.me/invoice-vip"
+            });
+            let mut params = if scenario == 2 {
+                sample_successful_payment_control_job()
+            } else {
+                sample_invoice_job(if scenario == 0 {
+                    ControlKind::VipInvoice
+                } else {
+                    ControlKind::DonateInvoice
+                })
+            };
+            if scenario == 2 {
+                params
+                    .data
+                    .payment
+                    .as_mut()
+                    .expect("payment")
+                    .invoice_payload = "unsupported".to_owned();
+            }
+            queue
+                .assign_control_job(CONTROL_QUEUE_NAME, new_control_job_at(params, now))
+                .await?;
+            let report = run_payment_on_shared_worker(&queue, &store, &effects, now).await;
+            assert!(report.dequeued);
+            assert_eq!(report.completed, scenario == 0);
+            assert_eq!(report.failed, scenario != 0);
+            let Some(ControlJobExecution::Payment(execution)) = report.execution else {
+                panic!("missing payment execution")
+            };
+            assert_eq!(
+                execution.outcome,
+                match scenario {
+                    0 =>
+                        PaymentControlJobOutcome::VipInvoice(InvoiceControlJobOutcome::InvoiceSent),
+                    1 => PaymentControlJobOutcome::DonateInvoice(
+                        InvoiceControlJobOutcome::EmptyInvoiceLink
+                    ),
+                    _ => PaymentControlJobOutcome::SuccessfulPayment(
+                        SuccessfulPaymentOutcome::UnknownPayload
+                    ),
+                }
+            );
+            assert_eq!(
+                queue.snapshot()[0].status,
+                if scenario == 0 {
+                    InMemoryControlJobStatus::Completed
                 } else {
-                    ControlJobExecutionResult::Completed(execution)
+                    InMemoryControlJobStatus::Failed
                 }
-            })
+            );
+            if scenario == 0 {
+                assert_eq!(
+                    effects.subscription_invoice_requests(),
+                    vec![openplotva_telegram::SubscriptionInvoiceLinkRequest {
+                        user_id: 42,
+                        user_name: "alice".to_owned(),
+                        amount_stars: 300
+                    }]
+                );
+                assert_eq!(effects.invoice_messages().len(), 1);
+            } else if scenario == 1 {
+                assert_eq!(
+                    queue.snapshot()[0].error.as_deref(),
+                    Some("failed to parse donation invoice link")
+                );
+            } else {
+                assert_eq!(
+                    queue.snapshot()[0].error.as_deref(),
+                    Some("successful payment has an unknown invoice payload")
+                );
+                assert!(store.users().is_empty());
+            }
         }
+        Ok(())
     }
 
     fn expected_subscription_invoice_message_text() -> String {
@@ -14255,14 +13214,14 @@ mod tests {
         }
     }
 
-    impl PaymentControlJobQueue for PaymentControlJobQueueStub {
+    impl ControlJobQueue for PaymentControlJobQueueStub {
         type Error = StubError;
 
-        fn assign_payment_control_job<'a>(
+        fn assign_control_job<'a>(
             &'a self,
             queue_name: &'static str,
             job: StatelessJobItem,
-        ) -> PaymentControlJobQueueFuture<'a, Self::Error> {
+        ) -> ControlJobEnqueueFuture<'a, Self::Error> {
             Box::pin(async move {
                 let mut state = self.lock();
                 state.assigned.push((queue_name, job));
@@ -14297,93 +13256,6 @@ mod tests {
         }
     }
 
-    #[derive(Clone, Default)]
-    struct PaymentControlJobWorkerQueueStub {
-        state: Arc<Mutex<PaymentControlJobWorkerQueueState>>,
-    }
-
-    #[derive(Default)]
-    struct PaymentControlJobWorkerQueueState {
-        jobs: VecDeque<PaymentControlJobWorkItem>,
-        completed: Vec<(i64, PaymentControlJobReport)>,
-        failed: Vec<(i64, String)>,
-        dequeue_error: Option<StubError>,
-        status_error: Option<StubError>,
-    }
-
-    impl PaymentControlJobWorkerQueueStub {
-        fn with_next_job(self, job: PaymentControlJobWorkItem) -> Self {
-            self.lock().jobs.push_back(job);
-            self
-        }
-
-        fn completed_ids(&self) -> Vec<i64> {
-            self.lock()
-                .completed
-                .iter()
-                .map(|(id, _report)| *id)
-                .collect()
-        }
-
-        fn failed(&self) -> Vec<(i64, String)> {
-            self.lock().failed.clone()
-        }
-
-        fn lock(&self) -> MutexGuard<'_, PaymentControlJobWorkerQueueState> {
-            self.state
-                .lock()
-                .unwrap_or_else(|poisoned| poisoned.into_inner())
-        }
-    }
-
-    impl PaymentControlJobWorkerQueue for PaymentControlJobWorkerQueueStub {
-        type Error = StubError;
-
-        fn dequeue_payment_control_job<'a>(
-            &'a self,
-            _queue_name: &'static str,
-        ) -> PaymentControlJobWorkerFuture<'a, Option<PaymentControlJobWorkItem>, Self::Error>
-        {
-            Box::pin(async move {
-                let mut state = self.lock();
-                if let Some(error) = state.dequeue_error.take() {
-                    return Err(error);
-                }
-                Ok(state.jobs.pop_front())
-            })
-        }
-
-        fn complete_payment_control_job<'a>(
-            &'a self,
-            job_id: i64,
-            report: &'a PaymentControlJobReport,
-        ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error> {
-            Box::pin(async move {
-                let mut state = self.lock();
-                if let Some(error) = state.status_error.take() {
-                    return Err(error);
-                }
-                state.completed.push((job_id, report.clone()));
-                Ok(())
-            })
-        }
-
-        fn fail_payment_control_job<'a>(
-            &'a self,
-            job_id: i64,
-            error: &'a str,
-        ) -> PaymentControlJobWorkerFuture<'a, (), Self::Error> {
-            Box::pin(async move {
-                let mut state = self.lock();
-                if let Some(status_error) = state.status_error.take() {
-                    return Err(status_error);
-                }
-                state.failed.push((job_id, error.to_owned()));
-                Ok(())
-            })
-        }
-    }
-
     #[derive(Clone, Debug)]
     enum StubError {
         Duplicate,
diff --git a/crates/openplotva-app/src/permissions.rs b/crates/openplotva-app/src/permissions.rs
index 70ad1db6..5c688270 100644
--- a/crates/openplotva-app/src/permissions.rs
+++ b/crates/openplotva-app/src/permissions.rs
@@ -18,7 +18,7 @@ use openplotva_server::{
 use openplotva_telegram::{TelegramOutboundMethodKind, classify_telegram_send_error};
 use time::OffsetDateTime;
 
-pub const GO_PERMISSION_CACHE_TTL: time::Duration = time::Duration::minutes(30);
+pub const PERMISSION_CACHE_TTL: time::Duration = time::Duration::minutes(30);
 
 /// Boxed future returned by permission persistence stores.
 pub type ChatPermissionStoreFuture<'a, T> = Pin<Box<dyn Future<Output = T> + Send + 'a>>;
@@ -272,7 +272,7 @@ where
             key,
             CachedPermission {
                 allowed,
-                cached_until: now + GO_PERMISSION_CACHE_TTL,
+                cached_until: now + PERMISSION_CACHE_TTL,
             },
         );
     }
diff --git a/crates/openplotva-app/src/provider_transport.rs b/crates/openplotva-app/src/provider_transport.rs
new file mode 100644
index 00000000..73f376f2
--- /dev/null
+++ b/crates/openplotva-app/src/provider_transport.rs
@@ -0,0 +1,400 @@
+//! Resolves persisted provider credentials before constructing a transport.
+
+use openplotva_storage::{StorageError, llm_routing::open_key};
+
+pub(crate) fn resolve_provider_api_key(
+    api_key_ref: Option<&str>,
+    api_key_encrypted: Option<&[u8]>,
+) -> Result<Option<String>, StorageError> {
+    let env_key = api_key_ref
+        .map(str::trim)
+        .filter(|name| !name.is_empty())
+        .and_then(|name| std::env::var(name).ok());
+    select_api_key(env_key, api_key_encrypted, || {
+        std::env::var("MASTER_KEY").unwrap_or_default()
+    })
+}
+
+fn select_api_key(
+    env_key: Option<String>,
+    sealed: Option<&[u8]>,
+    master_key: impl FnOnce() -> String,
+) -> Result<Option<String>, StorageError> {
+    if let Some(key) = env_key.filter(|key| !key.trim().is_empty()) {
+        return Ok(Some(key));
+    }
+    sealed
+        .map(|sealed| open_key(&master_key(), sealed))
+        .transpose()
+        .map(|key| key.filter(|key| !key.trim().is_empty()))
+}
+
+use crate::routed_attempts::RoutedAttempt;
+use openplotva_config::AppConfig;
+use openplotva_llm::{
+    aifarm::{AifarmClientConfig, GatewayRequestFields, normalize_chat_completions_url},
+    provider_schema::Protocol,
+    retry::{FailureReason, ProviderError},
+};
+
+pub(crate) fn openai_client_for_attempt(
+    config: &AppConfig,
+    attempt: &RoutedAttempt,
+    mut client: AifarmClientConfig,
+) -> Result<AifarmClientConfig, ProviderError> {
+    if attempt.protocol != Some(Protocol::OpenAiCompat) {
+        return Err(ProviderError::new(
+            &attempt.provider_name,
+            FailureReason::ProviderUnavailable,
+            "selected protocol does not support OpenAI chat completions",
+        ));
+    }
+    client.api_key = resolve_provider_api_key(
+        attempt.provider_api_key_ref.as_deref(),
+        attempt.provider_api_key_encrypted.as_deref(),
+    )
+    .map_err(|error| {
+        ProviderError::wrap(
+            &attempt.provider_name,
+            FailureReason::ProviderUnavailable,
+            error,
+        )
+    })?
+    .unwrap_or_else(|| builtin_api_key(config, &attempt.provider_name));
+    client.default_model = transport_model_for_attempt(attempt);
+    if is_openrouter(attempt) {
+        client.request_timeout = std::time::Duration::from_secs(
+            config.open_router.request_timeout_seconds.max(1) as u64,
+        );
+    }
+    client.direct_url.clear();
+    let (service_name, endpoint_name) = attempt.discovery_names();
+    if let Some(endpoint) = attempt.endpoint() {
+        if service_name.is_some() || endpoint_name.is_some() {
+            client.base_url = endpoint.to_owned();
+        } else {
+            client.direct_url = normalize_chat_completions_url(endpoint);
+        }
+    } else if is_openrouter(attempt) {
+        client.direct_url = "https://openrouter.ai/api/v1/chat/completions".to_owned();
+    } else if service_name.is_none()
+        && endpoint_name.is_none()
+        && !attempt.provider_name.eq_ignore_ascii_case("aifarm")
+    {
+        return Err(ProviderError::new(
+            &attempt.provider_name,
+            FailureReason::ProviderUnavailable,
+            "provider has neither an endpoint nor a discovery service",
+        ));
+    }
+    if let Some(service) = service_name {
+        client.service_name = service.to_owned();
+    }
+    if let Some(endpoint) = endpoint_name {
+        client.endpoint_name = endpoint.to_owned();
+    }
+    client.runtime_hint = attempt.provider_runtime_hint.clone().unwrap_or_default();
+    client.supports_message_name = attempt.supports_message_name();
+    client.supports_cache_control = attempt.supports_cache_control();
+    client.gateway_fields = GatewayRequestFields::from_overrides(&attempt.overrides.extra);
+    if let Some(timeout) = attempt
+        .provider_config
+        .get("timeout_ms")
+        .and_then(serde_json::Value::as_u64)
+        .filter(|timeout| *timeout > 0)
+    {
+        client.request_timeout = std::time::Duration::from_millis(timeout);
+    }
+    Ok(client)
+}
+
+pub(crate) fn gemini_endpoint_for_attempt(
+    config: &AppConfig,
+    attempt: &RoutedAttempt,
+) -> Result<(String, String), ProviderError> {
+    if attempt.protocol != Some(Protocol::Genkit) {
+        return Err(ProviderError::new(
+            &attempt.provider_name,
+            FailureReason::ProviderUnavailable,
+            "selected protocol does not support Gemini requests",
+        ));
+    }
+    let key = resolve_provider_api_key(
+        attempt.provider_api_key_ref.as_deref(),
+        attempt.provider_api_key_encrypted.as_deref(),
+    )
+    .map_err(|error| {
+        ProviderError::wrap(
+            &attempt.provider_name,
+            FailureReason::ProviderUnavailable,
+            error,
+        )
+    })?
+    .unwrap_or_else(|| builtin_api_key(config, &attempt.provider_name));
+    if key.trim().is_empty() {
+        return Err(ProviderError::new(
+            &attempt.provider_name,
+            FailureReason::ProviderUnavailable,
+            "provider API key is not configured",
+        ));
+    }
+    let endpoint = attempt
+        .endpoint()
+        .map(str::to_owned)
+        .unwrap_or_else(|| openplotva_llm::gemini::GeminiDialogConfig::default().base_url);
+    Ok((key, endpoint))
+}
+
+pub(crate) fn aifarm_discovery_provider_name(service: &str, config: &AppConfig) -> String {
+    let service = service.trim();
+    if service.is_empty() || service == config.llm.dialog.discovery_service_name {
+        return "aifarm".to_owned();
+    }
+    if service.eq_ignore_ascii_case(crate::agent_runtime::DEFAULT_LOCAL_REASONER_SERVICE_NAME) {
+        return crate::agent_runtime::LOCAL_REASONER_PROVIDER_NAME.to_owned();
+    }
+    if service.eq_ignore_ascii_case(crate::agent_runtime::VIBETHINKER_SERVICE_NAME) {
+        return crate::agent_runtime::VIBETHINKER_PROVIDER_NAME.to_owned();
+    }
+    format!(
+        "aifarm-{}",
+        service
+            .trim_start_matches("llm-openai-")
+            .trim_start_matches("llm-")
+    )
+}
+
+fn builtin_api_key(config: &AppConfig, provider: &str) -> String {
+    let dialog = &config.llm.dialog;
+    match provider.to_ascii_lowercase().as_str() {
+        "aifarm" => dialog.api_key.clone(),
+        "openrouter" | "openrouter-free" => config.open_router.key.clone(),
+        "genkit" | "gemini" => {
+            crate::runtime_gemini_cache::resolve_google_ai_key(&config.google_ai)
+        }
+        "vram-cloud" => dialog.aifarm_pool_api_key.clone(),
+        "vmlx" => dialog.vmlx_api_key.clone(),
+        "nvidia" => dialog.nvidia_api_key.clone(),
+        _ => {
+            let local = crate::agent_runtime::local_reasoner_named_provider_config(config);
+            let spec = config
+                .llm
+                .providers
+                .iter()
+                .find(|entry| {
+                    entry.name.eq_ignore_ascii_case(provider)
+                        || aifarm_discovery_provider_name(&entry.discovery_service_name, config)
+                            .eq_ignore_ascii_case(provider)
+                })
+                .or_else(|| {
+                    (aifarm_discovery_provider_name(&local.discovery_service_name, config)
+                        .eq_ignore_ascii_case(provider))
+                    .then_some(&local)
+                });
+            spec.map(|spec| {
+                if spec.api_key.trim().is_empty() {
+                    dialog.api_key.clone()
+                } else {
+                    spec.api_key.clone()
+                }
+            })
+            .unwrap_or_default()
+        }
+    }
+}
+
+pub(crate) fn transport_model_for_attempt(attempt: &RoutedAttempt) -> String {
+    let name = attempt.model_name.trim();
+    if is_openrouter(attempt) {
+        strip_provider_prefix(name, "openrouter/")
+            .unwrap_or(name)
+            .to_owned()
+    } else {
+        name.to_owned()
+    }
+}
+
+pub(crate) fn is_openrouter(attempt: &RoutedAttempt) -> bool {
+    attempt.protocol == Some(Protocol::OpenAiCompat)
+        && (attempt.provider_name.eq_ignore_ascii_case("openrouter")
+            || attempt
+                .provider_name
+                .eq_ignore_ascii_case("openrouter-free")
+            || attempt
+                .endpoint()
+                .and_then(|endpoint| url::Url::parse(endpoint).ok())
+                .is_some_and(|url| url.host_str() == Some("openrouter.ai")))
+}
+
+pub(crate) fn strip_provider_prefix<'a>(value: &'a str, prefix: &str) -> Option<&'a str> {
+    value
+        .get(..prefix.len())
+        .is_some_and(|head| head.eq_ignore_ascii_case(prefix))
+        .then(|| &value[prefix.len()..])
+}
+
+pub(crate) fn redactor_config_for_attempt(
+    attempt: &RoutedAttempt,
+    mut config: openplotva_llm::redaction::DiscoveryRedactorConfig,
+) -> Result<openplotva_llm::redaction::DiscoveryRedactorConfig, ProviderError> {
+    if attempt.protocol != Some(Protocol::PrivacyFilter) {
+        return Err(ProviderError::new(
+            &attempt.provider_name,
+            FailureReason::ProviderUnavailable,
+            "selected protocol does not support privacy filtering",
+        ));
+    }
+    if let Some(endpoint) = attempt.endpoint() {
+        config.base_url = endpoint.to_owned();
+    }
+    let (service, endpoint) = attempt.discovery_names();
+    if let Some(service) = service {
+        config.service_name = service.to_owned();
+    }
+    if let Some(endpoint) = endpoint {
+        config.endpoint_name = endpoint.to_owned();
+    }
+    Ok(config)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use openplotva_storage::llm_routing::seal_key;
+
+    fn attempt() -> RoutedAttempt {
+        RoutedAttempt {
+            protocol: Some(Protocol::OpenAiCompat),
+            provider_id: 1,
+            model_id: 2,
+            provider_name: "custom".into(),
+            model_name: "model".into(),
+            provider_runtime_hint: None,
+            provider_endpoint: Some("https://provider.test/v1".into()),
+            discovery_service_name: None,
+            discovery_endpoint_name: None,
+            provider_api_key_ref: None,
+            provider_api_key_encrypted: None,
+            model_base_url: None,
+            embedding_dim: None,
+            provider_config: serde_json::json!({}),
+            model_config: serde_json::json!({}),
+            overrides: Default::default(),
+            variant: None,
+        }
+    }
+
+    #[test]
+    fn redaction_uses_the_selected_protocol_and_shared_discovery_overrides() {
+        use openplotva_llm::redaction::DiscoveryRedactorConfig;
+        let mut route = attempt();
+        assert_eq!(
+            redactor_config_for_attempt(&route, DiscoveryRedactorConfig::default())
+                .expect_err("wrong protocol")
+                .reason(),
+            FailureReason::ProviderUnavailable
+        );
+        route.protocol = Some(Protocol::PrivacyFilter);
+        route.provider_name = "renamed-privacy-provider".into();
+        route.model_base_url = Some("  ".into());
+        route.discovery_service_name = Some("dedicated".into());
+        route.provider_config =
+            serde_json::json!({"service_name":"legacy", "endpoint_name":"legacy-redact"});
+        route.model_config =
+            serde_json::json!({"service_name":"model-service", "endpoint_name":"model-redact"});
+        let config = redactor_config_for_attempt(&route, DiscoveryRedactorConfig::default())
+            .expect("config");
+        assert_eq!(config.base_url, "https://provider.test/v1");
+        assert_eq!(config.service_name, "model-service");
+        assert_eq!(config.endpoint_name, "model-redact");
+        route.model_base_url = Some("https://model.test".into());
+        route.model_config = serde_json::json!({"service_name":" ", "endpoint_name":""});
+        let config = redactor_config_for_attempt(&route, DiscoveryRedactorConfig::default())
+            .expect("fallback config");
+        assert_eq!(config.base_url, "https://model.test");
+        assert_eq!(config.service_name, "dedicated");
+        assert_eq!(config.endpoint_name, "legacy-redact");
+    }
+
+    #[test]
+    fn resolved_route_carries_endpoint_capabilities_and_gateway_overrides() {
+        let config = AppConfig::from_raw(Default::default()).expect("config");
+        let mut route = attempt();
+        route.model_base_url = Some("https://override.test/v1".into());
+        route.provider_config = serde_json::json!({"supports_cache_control": false, "supports_message_name": false, "timeout_ms": 1234});
+        route.overrides.extra = serde_json::json!({"reasoning": {"enabled": false}});
+        let client =
+            openai_client_for_attempt(&config, &route, Default::default()).expect("client");
+        assert_eq!(
+            client.direct_url,
+            "https://override.test/v1/chat/completions"
+        );
+        assert_eq!(client.request_timeout.as_millis(), 1234);
+        assert!(!client.supports_cache_control);
+        assert!(!client.supports_message_name);
+        assert_eq!(
+            client.gateway_fields.reasoning,
+            Some(serde_json::json!({"enabled": false}))
+        );
+        route.model_base_url = Some("   ".into());
+        assert_eq!(
+            openai_client_for_attempt(&config, &route, Default::default())
+                .expect("fallback endpoint")
+                .direct_url,
+            "https://provider.test/v1/chat/completions"
+        );
+    }
+
+    #[test]
+    fn an_incomplete_custom_route_cannot_inherit_an_unrelated_discovery_service() {
+        let config = AppConfig::from_raw(Default::default()).expect("config");
+        let mut route = attempt();
+        route.provider_endpoint = None;
+        assert!(openai_client_for_attempt(&config, &route, Default::default()).is_err());
+    }
+
+    #[test]
+    fn corrupt_saved_key_never_uses_the_builtin_account() {
+        let config = AppConfig::from_raw(openplotva_config::RawConfig {
+            openrouter_key: Some("builtin-account".into()),
+            ..Default::default()
+        })
+        .expect("config");
+        let mut route = attempt();
+        route.provider_name = "openrouter".into();
+        route.provider_api_key_encrypted = Some(b"corrupt".to_vec());
+        assert!(openai_client_for_attempt(&config, &route, Default::default()).is_err());
+    }
+
+    #[test]
+    fn nonempty_environment_key_wins_without_opening_ciphertext() {
+        let key = select_api_key(Some("env-key".into()), Some(b"invalid"), || {
+            panic!("unused master")
+        });
+        assert_eq!(key.expect("key").as_deref(), Some("env-key"));
+    }
+
+    #[test]
+    fn missing_or_empty_environment_uses_the_encrypted_key() {
+        let sealed = seal_key("test-master", "stored-key").expect("seal");
+        for env in [None, Some(String::new()), Some("  ".into())] {
+            assert_eq!(
+                select_api_key(env, Some(&sealed), || "test-master".into())
+                    .expect("open")
+                    .as_deref(),
+                Some("stored-key")
+            );
+        }
+    }
+
+    #[test]
+    fn corrupt_or_wrong_account_ciphertext_is_an_error() {
+        let sealed = seal_key("test-master", "stored-key").expect("seal");
+        assert!(select_api_key(None, Some(b"invalid"), || "test-master".into()).is_err());
+        assert!(select_api_key(None, Some(&sealed), || "other-master".into()).is_err());
+        assert_eq!(
+            select_api_key(None, None, || panic!("unused master")).expect("absent"),
+            None
+        );
+    }
+}
diff --git a/crates/openplotva-app/src/python_sandbox.rs b/crates/openplotva-app/src/python_sandbox.rs
index cc1710b1..c1c3a0d3 100644
--- a/crates/openplotva-app/src/python_sandbox.rs
+++ b/crates/openplotva-app/src/python_sandbox.rs
@@ -1066,6 +1066,7 @@ mod tests {
 
     fn context() -> ToolContext {
         ToolContext {
+            invocation_id: None,
             chat_id: -10_042,
             thread_id: Some(7),
             message_id: 11,
diff --git a/crates/openplotva-app/src/rate_limits.rs b/crates/openplotva-app/src/rate_limits.rs
index fd389a31..588fd9ba 100644
--- a/crates/openplotva-app/src/rate_limits.rs
+++ b/crates/openplotva-app/src/rate_limits.rs
@@ -12,7 +12,7 @@ use std::{
 
 use time::OffsetDateTime;
 
-pub const GO_RATE_LIMIT_CACHE_TTL: time::Duration = time::Duration::minutes(30);
+pub const RATE_LIMIT_CACHE_TTL: time::Duration = time::Duration::minutes(30);
 pub const TASK_ENQUEUE_WINDOW: Duration = Duration::from_secs(60);
 pub const TASK_ENQUEUE_TTL: Duration = Duration::from_secs(10 * 60);
 pub const TASK_ENQUEUE_USER_CHAT_LIMIT: usize = 30;
@@ -398,7 +398,7 @@ where
             chat_id,
             CachedRateLimit {
                 expiry,
-                cached_until: now + GO_RATE_LIMIT_CACHE_TTL,
+                cached_until: now + RATE_LIMIT_CACHE_TTL,
             },
         );
     }
diff --git a/crates/openplotva-app/src/rates.rs b/crates/openplotva-app/src/rates.rs
index a26b89d6..3c3214ed 100644
--- a/crates/openplotva-app/src/rates.rs
+++ b/crates/openplotva-app/src/rates.rs
@@ -18,10 +18,7 @@ use openplotva_dialog::{
     TOOL_RESULT_STATUS_OK, TOOL_RESULT_STATUS_QUEUED, ToolContext, ToolError, ToolResult,
     ToolSideEffect,
 };
-use openplotva_telegram::{
-    ChatRef, DispatcherQueue, OutboundBuildError, ReplyMessageRef, TELEGRAM_PARSE_MODE_HTML,
-    TextMessageRequest,
-};
+use openplotva_telegram::{ChatRef, ReplyMessageRef, TELEGRAM_PARSE_MODE_HTML, TextMessageRequest};
 use rand::RngExt;
 use reqwest::header::USER_AGENT;
 use serde::Deserialize;
@@ -31,15 +28,11 @@ use time::format_description::well_known::Rfc3339;
 use tokio::sync::{Mutex as AsyncMutex, RwLock as AsyncRwLock};
 
 use crate::updates::UpdateHandler;
-use crate::virtual_messages::{
-    QueueTextRequest, VirtualIdFactory, monotonic_virtual_id_factory, queue_text_message_parts,
-};
 
 const RATES_UNAVAILABLE_TEXT: &str = "❌ Сервис курсов временно недоступен";
 const RATES_FETCH_ERRORS_PREFIX: &str = "❌ Ошибки получения курсов:\n";
 pub const RATES_MESSAGE_KIND: &str = "rates_message";
 const RATES_TOOL_MODE_MULTI_TURN: &str = "multi_turn";
-const RATES_TOOL_MODE_LEGACY: &str = "legacy";
 const MARKET_RATES_YAHOO_TTL: Duration = Duration::from_secs(5 * 60);
 const MARKET_RATES_DAILY_TTL: Duration = Duration::from_secs(6 * 60 * 60);
 const MARKET_RATES_DEFAULT_TIMEOUT: Duration = Duration::from_secs(15);
@@ -1150,32 +1143,23 @@ pub trait RatesEffects {
     fn send_rates_text<'a>(&'a self, plan: RatesTextPlan) -> RatesEffectFuture<'a, Self::Error>;
 }
 
-/// Generator for virtual-message IDs used by rates command sends.
-pub type RatesVirtualIdFactory = VirtualIdFactory;
-
-/// Rich-message-backed rates command side effects.
-#[derive(Clone)]
-pub struct RatesRichEffects {
-    rich: Arc<dyn crate::rich::RichSender>,
-}
-
+/// Durable delivery for rates commands and tool invocations.
 #[derive(Clone)]
-pub struct RatesUtilityEffects {
-    rich: RatesRichEffects,
+pub struct RatesDelivery {
+    delivery: Arc<crate::rich::RichOutbox>,
     ads: Option<Arc<crate::gradius_ads::GradiusUtilityAdService>>,
-    outbox: Option<Arc<crate::gradius_utility_outbox::GradiusUtilityOutbox>>,
+    ad_outbox: Option<Arc<crate::gradius_utility_outbox::GradiusUtilityOutbox>>,
 }
 
-impl RatesUtilityEffects {
+impl RatesDelivery {
     #[must_use]
-    pub fn new(rich: Arc<dyn crate::rich::RichSender>) -> Self {
+    pub fn new(delivery: Arc<crate::rich::RichOutbox>) -> Self {
         Self {
-            rich: RatesRichEffects::new(rich),
+            delivery,
             ads: None,
-            outbox: None,
+            ad_outbox: None,
         }
     }
-
     #[must_use]
     pub fn with_utility_ads(
         mut self,
@@ -1183,29 +1167,62 @@ impl RatesUtilityEffects {
         outbox: Arc<crate::gradius_utility_outbox::GradiusUtilityOutbox>,
     ) -> Self {
         self.ads = Some(ads);
-        self.outbox = Some(outbox);
+        self.ad_outbox = Some(outbox);
         self
     }
 }
 
-impl RatesEffects for RatesUtilityEffects {
+impl RatesEffects for RatesDelivery {
     type Error = RatesRichEffectError;
 
     fn send_rates_text<'a>(&'a self, plan: RatesTextPlan) -> RatesEffectFuture<'a, Self::Error> {
         Box::pin(async move {
             let chat_id = plan.reply_to.chat.id;
+            let source = format!("rates-command:{chat_id}:{}", plan.reply_to.message_id);
+            let message = rates_rich_message(&plan);
+            if self
+                .delivery
+                .queued(&source, None)
+                .await
+                .map_err(|error| RatesRichEffectError::Send(error.to_string()))?
+                .is_some()
+            {
+                return Ok(());
+            }
             let (Some(user_id), Some(plain_html), Some(ads), Some(outbox)) = (
                 plan.initiator_id,
                 plan.plain_html.as_deref(),
                 self.ads.as_ref(),
-                self.outbox.as_ref(),
+                self.ad_outbox.as_ref(),
             ) else {
-                return self.rich.send_rates_text(plan).await;
+                return self
+                    .delivery
+                    .enqueue(
+                        &source,
+                        message.options.message_thread_id,
+                        message.clone(),
+                        None,
+                    )
+                    .await
+                    .map(|_| ())
+                    .map_err(|error| RatesRichEffectError::Send(error.to_string()));
             };
             let thread_id = if plan.reply_to.is_topic_message {
                 match i32::try_from(plan.reply_to.message_thread_id) {
                     Ok(thread_id) => Some(thread_id),
-                    Err(_) => return self.rich.send_rates_text(plan).await,
+                    Err(_) => {
+                        return self
+                            .delivery
+                            .enqueue(
+                                &source,
+                                message.options.message_thread_id,
+                                message.clone(),
+                                None,
+                            )
+                            .await
+                            .map(|_| ())
+                            .map_err(|error| RatesRichEffectError::Send(error.to_string()));
+                    }
                 }
             } else {
                 None
@@ -1217,10 +1234,7 @@ impl RatesEffects for RatesUtilityEffects {
                     surface: crate::gradius_ads::GradiusUtilitySurface::Rates,
                     include_vip_appendix: false,
                     source_id: source_id.clone(),
-                    attempt_key: format!(
-                        "rates-command:{source_id}:{}",
-                        time::OffsetDateTime::now_utc().unix_timestamp_nanos()
-                    ),
+                    attempt_key: format!("rates-command:{source_id}"),
                     user_id,
                     chat_id,
                     thread_id,
@@ -1267,52 +1281,44 @@ impl RatesEffects for RatesUtilityEffects {
                     )
                 }
             }
-            self.rich.send_rates_text(plan).await
+            self.delivery
+                .enqueue(
+                    &source,
+                    message.options.message_thread_id,
+                    message.clone(),
+                    None,
+                )
+                .await
+                .map(|_| ())
+                .map_err(|error| RatesRichEffectError::Send(error.to_string()))
         })
     }
 }
 
-impl RatesRichEffects {
-    /// Build rates effects that reply with a rich message.
-    #[must_use]
-    pub fn new(rich: Arc<dyn crate::rich::RichSender>) -> Self {
-        Self { rich }
-    }
-}
-
-impl RatesEffects for RatesRichEffects {
-    type Error = RatesRichEffectError;
-
-    fn send_rates_text<'a>(&'a self, plan: RatesTextPlan) -> RatesEffectFuture<'a, Self::Error> {
-        Box::pin(async move {
-            let chat_id = plan
-                .message
-                .chat
-                .as_ref()
-                .map_or(plan.reply_to.chat.id, |chat| chat.id);
-            let options = openplotva_telegram::RichSendOptions {
-                direct_messages_topic_id: None,
-                message_thread_id: if plan.message.message_thread_id != 0 {
-                    Some(plan.message.message_thread_id)
-                } else if plan.reply_to.is_topic_message {
-                    Some(plan.reply_to.message_thread_id)
-                } else {
-                    None
-                },
-                reply_to_message_id: Some(plan.reply_to.message_id),
-                allow_sending_without_reply: plan
-                    .message
-                    .allow_sending_without_reply
-                    .unwrap_or(false),
-                disable_notification: plan.message.disable_notification,
-                reply_markup: None,
-            };
-            self.rich
-                .send_rich(chat_id, &plan.message.text, &options)
-                .await
-                .map_err(|err| RatesRichEffectError::Send(err.to_string()))?;
-            Ok(())
-        })
+fn rates_rich_message(plan: &RatesTextPlan) -> openplotva_telegram::SendRichMessage {
+    let chat_id = plan
+        .message
+        .chat
+        .as_ref()
+        .map_or(plan.reply_to.chat.id, |chat| chat.id);
+    let options = openplotva_telegram::RichSendOptions {
+        direct_messages_topic_id: None,
+        message_thread_id: if plan.message.message_thread_id != 0 {
+            Some(plan.message.message_thread_id)
+        } else if plan.reply_to.is_topic_message {
+            Some(plan.reply_to.message_thread_id)
+        } else {
+            None
+        },
+        reply_to_message_id: Some(plan.reply_to.message_id),
+        allow_sending_without_reply: plan.message.allow_sending_without_reply.unwrap_or(false),
+        disable_notification: plan.message.disable_notification,
+        reply_markup: None,
+    };
+    openplotva_telegram::SendRichMessage {
+        chat_id,
+        html: plan.message.text.clone(),
+        options,
     }
 }
 
@@ -1323,21 +1329,7 @@ pub enum RatesRichEffectError {
     Send(String),
 }
 
-/// Rich-message-backed dialog-tool rates side effects.
-#[derive(Clone)]
-pub struct RatesToolRichEffects {
-    rich: Arc<dyn crate::rich::RichSender>,
-}
-
-impl RatesToolRichEffects {
-    /// Build dialog rates effects that send the rich rates table directly.
-    #[must_use]
-    pub fn new(rich: Arc<dyn crate::rich::RichSender>) -> Self {
-        Self { rich }
-    }
-}
-
-impl RatesSideEffectDispatcher for RatesToolRichEffects {
+impl RatesSideEffectDispatcher for RatesDelivery {
     type Error = RatesRichEffectError;
 
     fn dispatch_rates<'a>(
@@ -1363,146 +1355,46 @@ impl RatesSideEffectDispatcher for RatesToolRichEffects {
                 disable_notification: false,
                 reply_markup: None,
             };
-            let sent_message_id = self
-                .rich
-                .send_rich(meta.chat_id, &trimmed, &options)
+            let invocation = meta
+                .invocation_id
+                .as_deref()
+                .filter(|value| !value.is_empty())
+                .ok_or_else(|| {
+                    RatesRichEffectError::Send(
+                        "rates tool invocation has no stable identity".into(),
+                    )
+                })?;
+            let source = format!("rates-tool:{}:{invocation}", meta.chat_id);
+            let receipt = self
+                .delivery
+                .enqueue(
+                    &source,
+                    options.message_thread_id,
+                    openplotva_telegram::SendRichMessage {
+                        chat_id: meta.chat_id,
+                        html: trimmed,
+                        options,
+                    },
+                    None,
+                )
                 .await
-                .map_err(|err| RatesRichEffectError::Send(err.to_string()))?;
+                .map_err(|error| RatesRichEffectError::Send(error.to_string()))?;
 
             Ok(RatesSideEffectDispatchResult {
                 kind: RATES_MESSAGE_KIND.to_owned(),
-                ticket_id: sent_message_id.to_string(),
+                ticket_id: receipt.batch_id.clone(),
                 eta: String::new(),
-                state: "executed".to_owned(),
-            })
-        })
-    }
-}
-
-/// Generator for async rates side-effect ticket IDs.
-pub type RatesTicketFactory = Arc<dyn Fn() -> String + Send + Sync>;
-
-/// Dispatcher-backed dialog-tool rates side effects.
-#[derive(Clone)]
-pub struct RatesToolDispatcherEffects {
-    queue: Arc<DispatcherQueue>,
-    next_virtual_id: RatesVirtualIdFactory,
-    next_ticket_id: RatesTicketFactory,
-}
-
-impl RatesToolDispatcherEffects {
-    /// Build dialog rates effects backed by the normal outbound dispatcher.
-    #[must_use]
-    pub fn new(queue: Arc<DispatcherQueue>) -> Self {
-        Self {
-            queue,
-            next_virtual_id: monotonic_virtual_id_factory("rates-tool-vmsg"),
-            next_ticket_id: Arc::new(|| {
-                time::OffsetDateTime::now_utc()
-                    .unix_timestamp_nanos()
-                    .to_string()
-            }),
-        }
-    }
-
-    /// Override ID generation for deterministic tests.
-    #[must_use]
-    pub fn with_id_factories(
-        mut self,
-        next_virtual_id: RatesVirtualIdFactory,
-        next_ticket_id: RatesTicketFactory,
-    ) -> Self {
-        self.next_virtual_id = next_virtual_id;
-        self.next_ticket_id = next_ticket_id;
-        self
-    }
-}
-
-impl fmt::Debug for RatesToolDispatcherEffects {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("RatesToolDispatcherEffects")
-            .finish_non_exhaustive()
-    }
-}
-
-impl RatesSideEffectDispatcher for RatesToolDispatcherEffects {
-    type Error = RatesToolDispatchEffectError;
-
-    fn dispatch_rates<'a>(
-        &'a self,
-        meta: RatesToolInvocationContext,
-        text: String,
-    ) -> RatesDispatchFuture<'a, Self::Error> {
-        Box::pin(async move {
-            let trimmed = text.trim().to_owned();
-            if trimmed.is_empty() {
-                return Ok(RatesSideEffectDispatchResult {
-                    kind: RATES_MESSAGE_KIND.to_owned(),
-                    state: "noop".to_owned(),
-                    ..RatesSideEffectDispatchResult::default()
-                });
-            }
-
-            let chat = ChatRef {
-                direct_messages_topic_id: None,
-                id: meta.chat_id,
-                is_forum: meta.thread_id.is_some(),
-            };
-            let message = TextMessageRequest {
-                chat: Some(chat),
-                message_thread_id: meta.thread_id.map_or(0, i64::from),
-                disable_notification: false,
-                allow_sending_without_reply: None,
-                text: trimmed,
-                render_as: TELEGRAM_PARSE_MODE_HTML.to_owned(),
-                reply_markup: None,
-            };
-            let reply_to = ReplyMessageRef {
-                message_id: i64::from(meta.message_id),
-                chat,
-                is_topic_message: meta.thread_id.is_some(),
-                message_thread_id: i64::from(meta.thread_id.unwrap_or_default()),
-            };
-            queue_text_message_parts(
-                &self.queue,
-                QueueTextRequest {
-                    protected: false,
-                    debounce_key: None,
-                    message: &message,
-                    reply_to: Some(&reply_to),
-                    immediate_first: false,
-                    bypass_chat_restrictions: false,
-                    ephemeral_delete_after: None,
-                },
-                || (self.next_virtual_id)(),
-            )
-            .await?;
-
-            let is_legacy = meta
-                .mode
-                .trim()
-                .eq_ignore_ascii_case(RATES_TOOL_MODE_LEGACY);
-            Ok(RatesSideEffectDispatchResult {
-                kind: RATES_MESSAGE_KIND.to_owned(),
-                ticket_id: if is_legacy {
-                    String::new()
+                state: if receipt.delivery_complete() {
+                    "executed"
                 } else {
-                    (self.next_ticket_id)()
-                },
-                eta: String::new(),
-                state: if is_legacy { "executed" } else { "queued" }.to_owned(),
+                    "queued"
+                }
+                .to_owned(),
             })
         })
     }
 }
 
-/// Recoverable errors from dispatcher-backed dialog rates side effects.
-#[derive(Debug, Error, Eq, PartialEq)]
-pub enum RatesToolDispatchEffectError {
-    #[error("failed to queue rates side effect: {0}")]
-    Queue(#[from] OutboundBuildError),
-}
-
 pub trait RatesSideEffectDispatcher {
     /// Error returned by the dispatcher.
     type Error: fmt::Display + Send + Sync + 'static;
@@ -1532,6 +1424,7 @@ pub struct RatesTextPlan {
 
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct RatesToolInvocationContext {
+    pub invocation_id: Option<String>,
     /// Telegram chat ID.
     pub chat_id: i64,
     /// Forum topic ID, when present.
@@ -1917,6 +1810,7 @@ pub fn format_dialog_rates_message(rates: &RatesSnapshot) -> String {
 #[must_use]
 pub fn dialog_rates_tool_context(meta: &ToolContext) -> RatesToolInvocationContext {
     RatesToolInvocationContext {
+        invocation_id: meta.invocation_id.clone(),
         chat_id: meta.chat_id,
         thread_id: meta.thread_id,
         message_id: meta.message_id,
@@ -2178,14 +2072,16 @@ mod tests {
     #[tokio::test]
     async fn rates_update_handler_sends_rich_message_payload()
     -> Result<(), Box<dyn std::error::Error>> {
-        let mock = Arc::new(crate::rich::MockRichSender::default());
+        let Some((delivery, pool, bot_id)) = live_rates_delivery().await? else {
+            return Ok(());
+        };
         let next = Arc::new(NextStub::default());
         let handler = RatesCommandUpdateHandler::new(
             bot_identity()?,
             Arc::new(PermissionStub::allowed()),
             Some(Arc::new(RatesFetcherStub::successful())),
             Arc::new(HeaderStub),
-            Arc::new(RatesRichEffects::new(mock.clone())),
+            Arc::new(RatesDelivery::new(delivery)),
             Arc::clone(&next),
         );
 
@@ -2194,22 +2090,44 @@ mod tests {
             .await?;
 
         assert!(next.calls().is_empty());
-        let sent = mock
-            .sent
-            .lock()
-            .expect("rates rich effects sent mutex should not be poisoned");
+        let sent: Vec<serde_json::Value> = sqlx::query_scalar(
+            "SELECT payload FROM telegram_outbox WHERE bot_id = $1 ORDER BY part_index",
+        )
+        .bind(bot_id)
+        .fetch_all(&pool)
+        .await?;
         assert_eq!(sent.len(), 1);
-        assert_eq!(sent[0].chat_id, -10042);
-        assert_eq!(sent[0].message_thread_id, Some(9));
-        assert_eq!(sent[0].reply_to_message_id, Some(82));
+        assert_eq!(sent[0]["chat_id"], -10042);
+        assert_eq!(sent[0]["options"]["message_thread_id"], 9);
+        assert_eq!(sent[0]["options"]["reply_to_message_id"], 82);
         assert!(
-            sent[0]
-                .html
-                .starts_with("<p>Header for Ada Lovelace</p><table")
+            sent[0]["html"]
+                .as_str()
+                .expect("rich html")
+                .starts_with("<p>Header for Ada Lovelace</p>\n\n<table")
+        );
+        assert!(
+            sent[0]["html"]
+                .as_str()
+                .expect("rich html")
+                .contains("<td>💵 USD/RUB</td>")
         );
-        assert!(sent[0].html.contains("<td>💵 USD/RUB</td>"));
-        assert!(sent[0].html.contains("90.00 ₽"));
-        assert!(sent[0].html.contains("₿ BTC/USD"));
+        assert!(
+            sent[0]["html"]
+                .as_str()
+                .expect("rich html")
+                .contains("90.00 ₽")
+        );
+        assert!(
+            sent[0]["html"]
+                .as_str()
+                .expect("rich html")
+                .contains("₿ BTC/USD")
+        );
+        sqlx::query("DELETE FROM telegram_outbox WHERE bot_id = $1")
+            .bind(bot_id)
+            .execute(&pool)
+            .await?;
         Ok(())
     }
 
@@ -2560,80 +2478,65 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn rates_tool_dispatcher_queues_trimmed_html_side_effect()
+    async fn rates_tool_rich_dispatcher_sends_trimmed_rich_side_effect()
     -> Result<(), Box<dyn std::error::Error>> {
-        let queue = Arc::new(DispatcherQueue::new(Default::default()));
-        let dispatcher = RatesToolDispatcherEffects::new(Arc::clone(&queue)).with_id_factories(
-            Arc::new(|| "rates-vmsg-1".to_owned()),
-            Arc::new(|| "123456789".to_owned()),
-        );
+        let Some((delivery, pool, bot_id)) = live_rates_delivery().await? else {
+            return Ok(());
+        };
+        let dispatcher = RatesDelivery::new(delivery);
 
         let result = dispatcher
             .dispatch_rates(
                 dialog_rates_tool_context(&tool_context()),
-                "  <b>rates</b>  ".to_owned(),
+                "  <h3>Rates</h3><table><tr><td>USD/PLN</td></tr></table>  ".to_owned(),
             )
             .await?;
 
-        assert_eq!(
-            result,
-            RatesSideEffectDispatchResult {
-                kind: RATES_MESSAGE_KIND.to_owned(),
-                ticket_id: "123456789".to_owned(),
-                eta: String::new(),
-                state: "queued".to_owned(),
-            }
-        );
-        let snapshot = queue.snapshot();
-        assert_eq!(snapshot.regular.len(), 1);
-        assert_eq!(snapshot.regular[0].virtual_id, "rates-vmsg-1");
-        assert!(snapshot.immediate.is_empty());
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn rates_tool_rich_dispatcher_sends_trimmed_rich_side_effect()
-    -> Result<(), Box<dyn std::error::Error>> {
-        let mock = Arc::new(crate::rich::MockRichSender::default());
-        let dispatcher = RatesToolRichEffects::new(mock.clone());
-
-        let result = dispatcher
+        assert_eq!(result.state, "queued");
+        assert!(result.ticket_id.contains("rates-tool:"));
+        let replay = dispatcher
             .dispatch_rates(
                 dialog_rates_tool_context(&tool_context()),
-                "  <h3>Rates</h3><table><tr><td>USD/PLN</td></tr></table>  ".to_owned(),
+                "a changed table".into(),
             )
             .await?;
-
-        assert_eq!(
-            result,
-            RatesSideEffectDispatchResult {
-                kind: RATES_MESSAGE_KIND.to_owned(),
-                ticket_id: "1001".to_owned(),
-                eta: String::new(),
-                state: "executed".to_owned(),
-            }
-        );
-        let sent = mock
-            .sent
-            .lock()
-            .expect("rates rich effects sent mutex should not be poisoned");
+        assert_eq!(replay.ticket_id, result.ticket_id);
+        let sent: Vec<serde_json::Value> =
+            sqlx::query_scalar("SELECT payload FROM telegram_outbox WHERE bot_id = $1")
+                .bind(bot_id)
+                .fetch_all(&pool)
+                .await?;
         assert_eq!(sent.len(), 1);
-        assert_eq!(sent[0].chat_id, -10042);
-        assert_eq!(sent[0].message_thread_id, Some(9));
-        assert_eq!(sent[0].reply_to_message_id, Some(77));
-        assert!(sent[0].allow_sending_without_reply);
+        assert_eq!(sent[0]["chat_id"], -10042);
+        assert_eq!(sent[0]["options"]["message_thread_id"], 9);
+        assert_eq!(sent[0]["options"]["reply_to_message_id"], 77);
+        assert_eq!(sent[0]["options"]["allow_sending_without_reply"], true);
         assert_eq!(
-            sent[0].html,
-            "<h3>Rates</h3><table><tr><td>USD/PLN</td></tr></table>"
+            sent[0]["html"],
+            "<h3>Rates</h3>\n\n<table><tr><td>USD/PLN</td></tr></table>"
         );
+        let mut distinct = dialog_rates_tool_context(&tool_context());
+        distinct.invocation_id = Some("another-call".into());
+        let distinct = dispatcher
+            .dispatch_rates(distinct, "a new table".into())
+            .await?;
+        assert_ne!(distinct.ticket_id, result.ticket_id);
+        sqlx::query("DELETE FROM telegram_outbox WHERE bot_id = $1")
+            .bind(bot_id)
+            .execute(&pool)
+            .await?;
         Ok(())
     }
 
     #[tokio::test]
     async fn rates_tool_dispatcher_empty_text_is_go_noop() -> Result<(), Box<dyn std::error::Error>>
     {
-        let dispatcher =
-            RatesToolDispatcherEffects::new(Arc::new(DispatcherQueue::new(Default::default())));
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .connect_lazy("postgres://test:test@127.0.0.1:1/test")?;
+        let dispatcher = RatesDelivery::new(Arc::new(crate::rich::RichOutbox::new(
+            openplotva_storage::PostgresTelegramOutboxStore::new(pool),
+            7,
+        )));
 
         let result = dispatcher
             .dispatch_rates(
@@ -2720,8 +2623,31 @@ mod tests {
         serde_json::from_value(value)
     }
 
+    async fn live_rates_delivery()
+    -> Result<Option<(Arc<crate::rich::RichOutbox>, sqlx::PgPool, i64)>, Box<dyn std::error::Error>>
+    {
+        let Ok(dsn) = std::env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
+            return Ok(None);
+        };
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(2)
+            .connect(&dsn)
+            .await?;
+        openplotva_storage::run_migrations_on(&pool).await?;
+        let bot_id = time::OffsetDateTime::now_utc().unix_timestamp_nanos() as i64;
+        Ok(Some((
+            Arc::new(crate::rich::RichOutbox::new(
+                openplotva_storage::PostgresTelegramOutboxStore::new(pool.clone()),
+                bot_id,
+            )),
+            pool,
+            bot_id,
+        )))
+    }
+
     fn tool_context() -> ToolContext {
         ToolContext {
+            invocation_id: Some("dialog-job:42:tool:call-1".into()),
             chat_id: -10042,
             thread_id: Some(9),
             message_id: 77,
diff --git a/crates/openplotva-app/src/rich.rs b/crates/openplotva-app/src/rich.rs
index fb2f23da..adf95907 100644
--- a/crates/openplotva-app/src/rich.rs
+++ b/crates/openplotva-app/src/rich.rs
@@ -1,275 +1,151 @@
-//! Rich-message composition and sending for OpenPlotva.
-//!
-//! [`RichMessenger`] is the single send facade for Telegram Rich Messages: it sanitizes
-//! HTML at the boundary and delegates to the raw rich Bot API client, the streaming-draft
-//! path (private chats), and the media uploader. The free `compose_*` functions build the
-//! approved rich layouts (currency table, song, leaderboard) as sanitized rich HTML; they
-//! are pure and unit-tested so the visual contract is pinned independently of the send
-//! path.
+//! Rich layouts, durable final delivery, and temporary draft transport.
 
-use std::future::Future;
-use std::pin::Pin;
+use openplotva_telegram::{escape_telegram_html_text as esc, format_rich_html, sanitize_rich_html};
 
-use openplotva_media::uploader::{UploaderClient, UploaderError};
-use openplotva_telegram::{
-    RichApiClient, RichApiError, RichMessage, RichSendOptions, escape_telegram_html_text,
-    format_rich_html, sanitize_rich_html,
-};
-use serde_json::Value;
-
-/// Send facade for rich messages.
+/// Persists final rich messages through the existing Telegram outbox.
 #[derive(Clone, Debug)]
-pub struct RichMessenger {
-    rich: RichApiClient,
-    uploader: UploaderClient,
+pub struct RichOutbox {
+    store: openplotva_storage::PostgresTelegramOutboxStore,
+    bot_id: i64,
 }
 
-impl RichMessenger {
+impl RichOutbox {
     #[must_use]
-    pub fn new(rich: RichApiClient, uploader: UploaderClient) -> Self {
-        Self { rich, uploader }
+    pub fn new(store: openplotva_storage::PostgresTelegramOutboxStore, bot_id: i64) -> Self {
+        Self { store, bot_id }
     }
 
-    /// Access the media uploader (to publish generated bytes/URLs before composing media).
-    #[must_use]
-    pub fn uploader(&self) -> &UploaderClient {
-        &self.uploader
-    }
-
-    /// Send a rich message, sanitizing the HTML at the boundary.
-    pub async fn send(
-        &self,
-        chat_id: i64,
-        html: &str,
-        options: &RichSendOptions,
-    ) -> Result<RichMessage, RichApiError> {
-        self.rich
-            .send_rich_message(chat_id, &format_rich_html(html), options)
-            .await
+    // Retain persisted utility keys so replay finds previously queued ad deliveries.
+    fn batch_id(&self, source: &str) -> String {
+        format!("gradius-utility:v1:{}:{source}", self.bot_id)
     }
 
-    /// Replace a message's content with new rich HTML in place (group pseudo-streaming).
-    pub async fn edit(
+    pub async fn queued(
         &self,
-        chat_id: i64,
-        message_id: i64,
-        html: &str,
-        reply_markup: Option<Value>,
-    ) -> Result<(), RichApiError> {
-        self.rich
-            .edit_message_text_rich(chat_id, message_id, &format_rich_html(html), reply_markup)
-            .await
+        source: &str,
+        job_id: Option<i64>,
+    ) -> Result<Option<crate::telegram_outbox::QueuedBatchReceipt>, openplotva_storage::StorageError>
+    {
+        Ok(self
+            .store
+            .queued_batch(self.bot_id, &self.batch_id(source), job_id)
+            .await?
+            .map(rich_outbox_receipt))
     }
 
-    /// Stream a partial rich message into an animated draft (private chats only).
-    pub async fn draft(
+    pub async fn enqueue(
         &self,
-        chat_id: i64,
-        draft_id: i64,
-        html: &str,
-        message_thread_id: Option<i64>,
-    ) -> Result<(), RichApiError> {
-        self.rich
-            .send_rich_message_draft(
-                chat_id,
-                draft_id,
-                &format_rich_html(html),
-                message_thread_id,
-            )
-            .await
-    }
-}
-
-/// Boxed future returned by [`RichSender`] send/edit/draft methods.
-pub type RichSendFuture<'a, T> = Pin<Box<dyn Future<Output = Result<T, RichApiError>> + Send + 'a>>;
-/// Boxed future returned by [`RichSender`] upload methods.
-pub type RichUploadFuture<'a> =
-    Pin<Box<dyn Future<Output = Result<String, UploaderError>> + Send + 'a>>;
-
-/// Abstraction over rich sending so handlers/workers can be unit-tested with a mock
-/// instead of issuing real Bot API / uploader HTTP calls.
-pub trait RichSender: Send + Sync + std::fmt::Debug {
-    /// Send a rich message; resolves to the sent message id.
-    fn send_rich<'a>(
-        &'a self,
-        chat_id: i64,
-        html: &'a str,
-        options: &'a RichSendOptions,
-    ) -> RichSendFuture<'a, i64>;
-    /// Replace a message's rich content in place.
-    fn edit_rich<'a>(
-        &'a self,
-        chat_id: i64,
-        message_id: i64,
-        html: &'a str,
-        reply_markup: Option<Value>,
-    ) -> RichSendFuture<'a, ()>;
-    /// Stream a partial rich draft (private chats only).
-    fn draft_rich<'a>(
-        &'a self,
-        chat_id: i64,
-        draft_id: i64,
-        html: &'a str,
-        message_thread_id: Option<i64>,
-    ) -> RichSendFuture<'a, ()>;
-    /// Publish bytes to the media host; resolves to a public HTTPS URL.
-    fn upload_bytes<'a>(
-        &'a self,
-        bytes: Vec<u8>,
-        content_type: &'a str,
-        explicit_name: Option<&'a str>,
-    ) -> RichUploadFuture<'a>;
-    /// Hand a remote URL to the media host; resolves to a public HTTPS URL.
-    fn upload_url<'a>(
-        &'a self,
-        source_url: &'a str,
-        explicit_name: Option<&'a str>,
-    ) -> RichUploadFuture<'a>;
-}
-
-impl RichSender for RichMessenger {
-    fn send_rich<'a>(
-        &'a self,
-        chat_id: i64,
-        html: &'a str,
-        options: &'a RichSendOptions,
-    ) -> RichSendFuture<'a, i64> {
-        Box::pin(async move { Ok(self.send(chat_id, html, options).await?.id) })
-    }
-
-    fn edit_rich<'a>(
-        &'a self,
-        chat_id: i64,
-        message_id: i64,
-        html: &'a str,
-        reply_markup: Option<Value>,
-    ) -> RichSendFuture<'a, ()> {
-        Box::pin(async move { self.edit(chat_id, message_id, html, reply_markup).await })
-    }
-
-    fn draft_rich<'a>(
-        &'a self,
-        chat_id: i64,
-        draft_id: i64,
-        html: &'a str,
-        message_thread_id: Option<i64>,
-    ) -> RichSendFuture<'a, ()> {
-        Box::pin(async move { self.draft(chat_id, draft_id, html, message_thread_id).await })
-    }
-
-    fn upload_bytes<'a>(
-        &'a self,
-        bytes: Vec<u8>,
-        content_type: &'a str,
-        explicit_name: Option<&'a str>,
-    ) -> RichUploadFuture<'a> {
-        Box::pin(async move {
-            self.uploader
-                .upload_bytes(bytes, content_type, explicit_name)
-                .await
-        })
-    }
-
-    fn upload_url<'a>(
-        &'a self,
-        source_url: &'a str,
-        explicit_name: Option<&'a str>,
-    ) -> RichUploadFuture<'a> {
-        Box::pin(async move { self.uploader.upload_url(source_url, explicit_name).await })
+        source: &str,
+        thread_id: Option<i64>,
+        method: impl Into<openplotva_telegram::TelegramOutboundMethod>,
+        job_id: Option<i64>,
+    ) -> Result<crate::telegram_outbox::QueuedBatchReceipt, RichOutboxError> {
+        use openplotva_storage::{
+            TelegramDeliveryPolicy, TelegramOutboxBatchInput, TelegramOutboxContentPolicy,
+            TelegramOutboxPartInput,
+        };
+        use openplotva_telegram::OutboundCommand;
+        use openplotva_telegram::TelegramOutboundMethod;
+        let mut method = method.into();
+        let (chat_id, trigger_message_id, delivery_policy) = match &mut method {
+            TelegramOutboundMethod::SendRichMessage(message) => {
+                if message.options.message_thread_id != thread_id {
+                    return Err(RichOutboxError::InvalidThread);
+                }
+                message.html = format_rich_html(&message.html);
+                (
+                    message.chat_id,
+                    message.options.reply_to_message_id,
+                    TelegramDeliveryPolicy::Create,
+                )
+            }
+            TelegramOutboundMethod::EditRichMessage(message) => {
+                message.html = format_rich_html(&message.html);
+                (
+                    message.chat_id,
+                    Some(message.message_id),
+                    TelegramDeliveryPolicy::TargetIdempotent,
+                )
+            }
+            _ => return Err(RichOutboxError::UnsupportedMethod),
+        };
+        let thread_id = thread_id
+            .map(i32::try_from)
+            .transpose()
+            .map_err(|_| RichOutboxError::InvalidThread)?;
+        let command = OutboundCommand::try_from_method(method)?;
+        let (kind, version, payload) = command.into_storage_parts()?;
+        let parts = vec![TelegramOutboxPartInput {
+            method_kind: kind.to_owned(),
+            payload_version: version,
+            payload,
+            blob: None,
+            available_at: time::OffsetDateTime::now_utc(),
+            expires_at: None,
+        }];
+        let queued = self
+            .store
+            .enqueue_batch(&TelegramOutboxBatchInput {
+                content_policy: TelegramOutboxContentPolicy::ReusePrepared,
+                batch_id: self.batch_id(source),
+                bot_id: self.bot_id,
+                chat_id: Some(chat_id),
+                thread_id,
+                ordering_key: crate::telegram_outbox::telegram_outbox_ordering_key(
+                    self.bot_id,
+                    chat_id,
+                    thread_id,
+                ),
+                causation_update_id: None,
+                dialog_job_id: job_id,
+                trigger_message_id,
+                delivery_policy,
+                protected: true,
+                priority: openplotva_taskman::DEFAULT_PRIORITY,
+                parts,
+            })
+            .await?;
+        Ok(rich_outbox_receipt(queued))
     }
 }
 
-/// A captured [`RichSender::send_rich`] call, for assertions in handler tests.
-#[cfg(test)]
-#[derive(Debug, Clone, PartialEq)]
-pub(crate) struct RichSendCall {
-    pub chat_id: i64,
-    pub html: String,
-    pub reply_to_message_id: Option<i64>,
-    pub allow_sending_without_reply: bool,
-    pub message_thread_id: Option<i64>,
+fn rich_outbox_receipt(
+    queued: openplotva_storage::QueuedTelegramOutboxBatch,
+) -> crate::telegram_outbox::QueuedBatchReceipt {
+    let delivered = queued.parts.iter().all(|part| part.state == "delivered");
+    crate::telegram_outbox::QueuedBatchReceipt::durable_outbox(
+        queued.batch_id,
+        queued
+            .parts
+            .into_iter()
+            .map(|part| part.operation_id)
+            .collect(),
+        delivered,
+    )
 }
 
-/// Test double capturing rich sends/edits/drafts/uploads without any HTTP. Shared
-/// across scenario handler tests so they assert composed HTML + reply options.
-#[cfg(test)]
-#[derive(Debug, Default)]
-pub(crate) struct MockRichSender {
-    pub sent: std::sync::Mutex<Vec<RichSendCall>>,
-    pub edited: std::sync::Mutex<Vec<(i64, i64, String)>>,
-    pub drafts: std::sync::Mutex<Vec<(i64, i64, String)>>,
+#[derive(Debug, thiserror::Error)]
+pub enum RichOutboxError {
+    #[error("final rich delivery requires a rich send or edit command")]
+    UnsupportedMethod,
+    #[error(transparent)]
+    Storage(#[from] openplotva_storage::StorageError),
+    #[error(transparent)]
+    Codec(#[from] openplotva_telegram::OutboundCommandCodecError),
+    #[error("rich message topic ID is outside the supported range")]
+    InvalidThread,
 }
 
 #[cfg(test)]
-impl RichSender for MockRichSender {
-    fn send_rich<'a>(
-        &'a self,
-        chat_id: i64,
-        html: &'a str,
-        options: &'a RichSendOptions,
-    ) -> RichSendFuture<'a, i64> {
-        self.sent
-            .lock()
-            .expect("mock rich sender sent mutex should not be poisoned")
-            .push(RichSendCall {
-                chat_id,
-                html: html.to_owned(),
-                reply_to_message_id: options.reply_to_message_id,
-                allow_sending_without_reply: options.allow_sending_without_reply,
-                message_thread_id: options.message_thread_id,
-            });
-        Box::pin(async { Ok(1001) })
-    }
-
-    fn edit_rich<'a>(
-        &'a self,
-        chat_id: i64,
-        message_id: i64,
-        html: &'a str,
-        _reply_markup: Option<Value>,
-    ) -> RichSendFuture<'a, ()> {
-        self.edited
-            .lock()
-            .expect("mock rich sender edited mutex should not be poisoned")
-            .push((chat_id, message_id, html.to_owned()));
-        Box::pin(async { Ok(()) })
-    }
-
-    fn draft_rich<'a>(
-        &'a self,
-        chat_id: i64,
-        draft_id: i64,
-        html: &'a str,
-        _message_thread_id: Option<i64>,
-    ) -> RichSendFuture<'a, ()> {
-        self.drafts
-            .lock()
-            .expect("mock rich sender drafts mutex should not be poisoned")
-            .push((chat_id, draft_id, html.to_owned()));
-        Box::pin(async { Ok(()) })
-    }
-
-    fn upload_bytes<'a>(
-        &'a self,
-        _bytes: Vec<u8>,
-        _content_type: &'a str,
-        _explicit_name: Option<&'a str>,
-    ) -> RichUploadFuture<'a> {
-        Box::pin(async { Ok("https://uploader.example.com/media/mock.bin".to_owned()) })
-    }
-
-    fn upload_url<'a>(
-        &'a self,
-        source_url: &'a str,
-        _explicit_name: Option<&'a str>,
-    ) -> RichUploadFuture<'a> {
-        let url = source_url.to_owned();
-        Box::pin(async move { Ok(url) })
-    }
-}
-
-fn esc(value: &str) -> String {
-    escape_telegram_html_text(value)
+pub(crate) fn unreachable_outbox() -> std::sync::Arc<RichOutbox> {
+    let pool = sqlx::postgres::PgPoolOptions::new()
+        .acquire_timeout(std::time::Duration::from_millis(100))
+        .connect_lazy("postgres://test:test@127.0.0.1:1/test")
+        .expect("fixed test DSN");
+    std::sync::Arc::new(RichOutbox::new(
+        openplotva_storage::PostgresTelegramOutboxStore::new(pool),
+        7,
+    ))
 }
 
 /// Escape text and turn newlines into `<br>` for use inside a rich block.
@@ -379,40 +255,6 @@ pub fn compose_leaderboard(theme: &str, rows: &[LeaderboardRow]) -> String {
 mod tests {
     use super::*;
 
-    #[tokio::test]
-    async fn mock_rich_sender_captures_send_and_edit() {
-        let mock = MockRichSender::default();
-        let options = RichSendOptions {
-            reply_to_message_id: Some(99),
-            allow_sending_without_reply: true,
-            ..RichSendOptions::default()
-        };
-        let id = mock
-            .send_rich(7, "<b>x</b>", &options)
-            .await
-            .expect("mock rich send should succeed");
-        assert_eq!(id, 1001);
-        mock.edit_rich(7, id, "<i>y</i>", None)
-            .await
-            .expect("mock rich edit should succeed");
-        let sent = mock
-            .sent
-            .lock()
-            .expect("mock rich sender sent mutex should not be poisoned");
-        assert_eq!(sent.len(), 1);
-        assert_eq!(sent[0].chat_id, 7);
-        assert_eq!(sent[0].html, "<b>x</b>");
-        assert_eq!(sent[0].reply_to_message_id, Some(99));
-        assert!(sent[0].allow_sending_without_reply);
-        assert_eq!(
-            mock.edited
-                .lock()
-                .expect("mock rich sender edited mutex should not be poisoned")
-                .as_slice(),
-            &[(7, 1001, "<i>y</i>".to_owned())]
-        );
-    }
-
     #[test]
     fn rates_table_renders_joke_as_plain_text() {
         let rows = vec![
diff --git a/crates/openplotva-app/src/routed_attempts.rs b/crates/openplotva-app/src/routed_attempts.rs
index 862b0d03..2291d72f 100644
--- a/crates/openplotva-app/src/routed_attempts.rs
+++ b/crates/openplotva-app/src/routed_attempts.rs
@@ -425,7 +425,8 @@ impl RoutedAttemptWalker {
                             }
                         }
                     }
-                    let routed = RoutedAttempt {
+                    let mut routed = RoutedAttempt {
+                        protocol: provider.and_then(|row| row.resolved_protocol()),
                         provider_id: attempt.provider,
                         model_id: attempt.model,
                         provider_name: provider.map(|row| row.name.clone()).unwrap_or_default(),
@@ -457,6 +458,8 @@ impl RoutedAttemptWalker {
                             .unwrap_or_else(|| attempt.overrides.clone()),
                         variant: attempt.variant.clone(),
                     };
+                    routed.model_name =
+                        crate::provider_transport::transport_model_for_attempt(&routed);
                     attempted_targets.insert((routed.provider_id, routed.model_id));
                     last_provider_model = Some((routed.provider_id, routed.model_id));
                     if first_execution {
@@ -770,6 +773,7 @@ pub struct RoutedRequestContext {
 
 #[derive(Clone, Debug, PartialEq)]
 pub struct RoutedAttempt {
+    pub protocol: Option<openplotva_llm::provider_schema::Protocol>,
     pub provider_id: i64,
     pub model_id: i64,
     pub provider_name: String,
@@ -789,6 +793,38 @@ pub struct RoutedAttempt {
 }
 
 impl RoutedAttempt {
+    pub(crate) fn endpoint(&self) -> Option<&str> {
+        self.model_base_url
+            .as_deref()
+            .filter(|value| !value.trim().is_empty())
+            .or(self.provider_endpoint.as_deref())
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+    }
+
+    pub(crate) fn discovery_names(&self) -> (Option<&str>, Option<&str>) {
+        let names = [
+            ("service_name", self.discovery_service_name.as_deref()),
+            ("endpoint_name", self.discovery_endpoint_name.as_deref()),
+        ]
+        .map(|(key, configured)| {
+            let nonempty = |value: &str| !value.trim().is_empty();
+            self.model_config
+                .get(key)
+                .and_then(Value::as_str)
+                .filter(|value| nonempty(value))
+                .or(configured.filter(|value| nonempty(value)))
+                .or_else(|| {
+                    self.provider_config
+                        .get(key)
+                        .and_then(Value::as_str)
+                        .filter(|value| nonempty(value))
+                })
+                .map(str::trim)
+        });
+        (names[0], names[1])
+    }
+
     #[must_use]
     pub fn supports_message_name(&self) -> bool {
         self.provider_config
diff --git a/crates/openplotva-app/src/runtime_cache.rs b/crates/openplotva-app/src/runtime_cache.rs
index e3e32ce8..231c96c7 100644
--- a/crates/openplotva-app/src/runtime_cache.rs
+++ b/crates/openplotva-app/src/runtime_cache.rs
@@ -5,8 +5,8 @@ use openplotva_storage::{PostgresChatSettingsStore, RedisRateLimitStore};
 
 use crate::{permissions::ChatPermissionPolicy, rate_limits::ChatRateLimitPolicy};
 
-const GO_SERVER_CACHE_CAPACITY: i32 = 10_000;
-const GO_PLANNER_CACHE_CAPACITY: i32 = 10_000;
+const SERVER_CACHE_CAPACITY: i32 = 10_000;
+const PLANNER_CACHE_CAPACITY: i32 = 10_000;
 
 #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 pub(crate) struct PolicyCacheStats {
@@ -79,13 +79,13 @@ fn runtime_cache_snapshot_from_policy_stats(
     RuntimeCacheSnapshotData {
         cache: RuntimeCacheStatsData {
             size: policy_stats.size.min(i32::MAX as usize) as i32,
-            capacity: GO_SERVER_CACHE_CAPACITY,
+            capacity: SERVER_CACHE_CAPACITY,
             hits: policy_stats.hits,
             misses: policy_stats.misses,
             mem_size: policy_stats.mem_size,
         },
         planner_cache: RuntimeCacheStatsData {
-            capacity: GO_PLANNER_CACHE_CAPACITY,
+            capacity: PLANNER_CACHE_CAPACITY,
             ..RuntimeCacheStatsData::default()
         },
     }
@@ -105,12 +105,12 @@ mod tests {
         });
 
         assert_eq!(snapshot.cache.size, 12);
-        assert_eq!(snapshot.cache.capacity, GO_SERVER_CACHE_CAPACITY);
+        assert_eq!(snapshot.cache.capacity, SERVER_CACHE_CAPACITY);
         assert_eq!(snapshot.cache.hits, 34);
         assert_eq!(snapshot.cache.misses, 56);
         assert_eq!(snapshot.cache.mem_size, 78);
         assert_eq!(snapshot.planner_cache.size, 0);
-        assert_eq!(snapshot.planner_cache.capacity, GO_PLANNER_CACHE_CAPACITY);
+        assert_eq!(snapshot.planner_cache.capacity, PLANNER_CACHE_CAPACITY);
         assert_eq!(snapshot.planner_cache.hits, 0);
         assert_eq!(snapshot.planner_cache.misses, 0);
         assert_eq!(snapshot.planner_cache.mem_size, 0);
diff --git a/crates/openplotva-app/src/runtime_dispatcher.rs b/crates/openplotva-app/src/runtime_dispatcher.rs
index 4e650aac..d2f8f263 100644
--- a/crates/openplotva-app/src/runtime_dispatcher.rs
+++ b/crates/openplotva-app/src/runtime_dispatcher.rs
@@ -1,7 +1,16 @@
+use crate::{
+    RuntimeWorkerGroup, RuntimeWorkerPhase, RuntimeWorkerStops, maintenance_api, permissions,
+    rate_limits, routing_admin_reports, virtual_messages, wait_for_runtime_stop,
+};
+use openplotva_storage::{
+    PostgresChatSettingsStore, PostgresHistoryStore, RedisEphemeralMessageStore,
+    RedisRateLimitStore,
+};
 use std::{
     collections::VecDeque,
     sync::{Arc, Mutex},
 };
+use std::{future::Future, time::Duration};
 
 use openplotva_server::{
     RuntimeDispatchFailureData, RuntimeDispatcherFailureInspector, RuntimeDispatcherInspector,
@@ -163,6 +172,504 @@ pub fn reply_message_id_from_fingerprint_key(fingerprint_key: &str) -> Option<i6
     debounce_key.strip_prefix('r')?.parse().ok()
 }
 
+pub(crate) fn build_dispatcher_worker_group(
+    inputs: DispatcherWorkerGroupInputs,
+    stops: &RuntimeWorkerStops,
+) -> RuntimeWorkerGroup {
+    let DispatcherWorkerGroupInputs {
+        history,
+        telegram,
+        rich,
+        ephemeral,
+        rate_limits,
+        permissions,
+        queue,
+        limiters,
+        failure_ring,
+        routing_admin_reports,
+    } = inputs;
+    let mut workers = RuntimeWorkerGroup::new(RuntimeWorkerPhase::Outbound);
+
+    let immediate_history = history.clone();
+    let immediate_telegram = telegram.clone();
+    let immediate_rich = rich.clone();
+    let immediate_ephemeral = ephemeral.clone();
+    let immediate_rate_limits = Arc::clone(&rate_limits);
+    let immediate_permissions = Arc::clone(&permissions);
+    let immediate_queue = Arc::clone(&queue);
+    let immediate_failure_ring = Arc::clone(&failure_ring);
+    let immediate_routing_admin_reports = routing_admin_reports.clone();
+    let immediate_stop = stops.subscribe(RuntimeWorkerPhase::Outbound);
+    workers.register(
+        "dispatcher-immediate",
+        tokio::spawn(async move {
+            let outcome = immediate_queue
+                .run_immediate_worker_until(wait_for_runtime_stop(immediate_stop), |item| {
+                    send_dispatcher_work_item(
+                        immediate_history.clone(),
+                        immediate_telegram.clone(),
+                        immediate_rich.clone(),
+                        immediate_ephemeral.clone(),
+                        Arc::clone(&immediate_rate_limits),
+                        Arc::clone(&immediate_permissions),
+                        Some(Arc::clone(&immediate_failure_ring)),
+                        Some(immediate_routing_admin_reports.clone()),
+                        item,
+                    )
+                })
+                .await;
+
+            tracing::info!(?outcome, "outbound immediate dispatcher worker stopped");
+        }),
+    );
+
+    let regular_queue = queue;
+    let regular_limiters = Arc::clone(&limiters);
+    let regular_stop = stops.subscribe(RuntimeWorkerPhase::Outbound);
+    workers.register(
+        "dispatcher-regular",
+        tokio::spawn(async move {
+            let outcome = regular_queue
+                .run_regular_worker_until(
+                    &regular_limiters,
+                    wait_for_runtime_stop(regular_stop),
+                    |item| {
+                        send_dispatcher_work_item(
+                            history.clone(),
+                            telegram.clone(),
+                            rich.clone(),
+                            ephemeral.clone(),
+                            Arc::clone(&rate_limits),
+                            Arc::clone(&permissions),
+                            Some(Arc::clone(&failure_ring)),
+                            Some(routing_admin_reports.clone()),
+                            item,
+                        )
+                    },
+                )
+                .await;
+
+            tracing::info!(?outcome, "outbound regular dispatcher worker stopped");
+        }),
+    );
+
+    let cleanup_stop = stops.subscribe(RuntimeWorkerPhase::Outbound);
+    workers.register(
+        "dispatcher-limiter-cleanup",
+        tokio::spawn(async move {
+            let outcome = openplotva_telegram::run_limiter_cleanup_until(
+                &limiters,
+                openplotva_telegram::DispatcherRuntimeConfig::default(),
+                wait_for_runtime_stop(cleanup_stop),
+            )
+            .await;
+
+            tracing::info!(
+                ?outcome,
+                "outbound dispatcher limiter cleanup worker stopped"
+            );
+        }),
+    );
+
+    workers
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn send_dispatcher_work_item(
+    history: PostgresHistoryStore,
+    telegram: openplotva_telegram::TelegramClient,
+    rich: openplotva_telegram::RichApiClient,
+    ephemeral: RedisEphemeralMessageStore,
+    rate_limits: Arc<rate_limits::ChatRateLimitPolicy<RedisRateLimitStore>>,
+    permissions: Arc<permissions::ChatPermissionPolicy<PostgresChatSettingsStore>>,
+    failure_ring: Option<Arc<DispatchFailureRing>>,
+    routing_admin_reports: Option<openplotva_storage::llm_routing::PostgresRoutingAdminReportStore>,
+    item: openplotva_telegram::DispatcherWorkItem,
+) -> openplotva_telegram::DispatcherSendStatus {
+    send_dispatcher_work_item_with_transport_and_history(
+        history,
+        ephemeral,
+        rate_limits,
+        permissions,
+        failure_ring,
+        routing_admin_reports,
+        item,
+        |method| {
+            let telegram = telegram.clone();
+            let rich = rich.clone();
+            async move {
+                openplotva_telegram::execute_telegram_method_with_rich(&telegram, &rich, method)
+                    .await
+            }
+        },
+    )
+    .await
+}
+
+#[cfg(test)]
+pub(crate) async fn send_dispatcher_work_item_with_transport<R, P, SendFn, SendFuture>(
+    rate_limits: Arc<rate_limits::ChatRateLimitPolicy<R>>,
+    permissions: Arc<permissions::ChatPermissionPolicy<P>>,
+    item: openplotva_telegram::DispatcherWorkItem,
+    send: SendFn,
+) -> openplotva_telegram::DispatcherSendStatus
+where
+    R: rate_limits::RateLimitStore + Send + Sync,
+    P: permissions::ChatPermissionStore + Send + Sync,
+    SendFn: Fn(openplotva_telegram::TelegramOutboundMethod) -> SendFuture,
+    SendFuture: Future<
+        Output = Result<
+            openplotva_telegram::TelegramOutboundResponse,
+            openplotva_telegram::TelegramOutboundExecuteError,
+        >,
+    >,
+{
+    send_dispatcher_work_item_with_transport_and_history(
+        virtual_messages::NoopEditHistorySink,
+        virtual_messages::NoopEphemeralMessageTracker,
+        rate_limits,
+        permissions,
+        None,
+        None,
+        item,
+        send,
+    )
+    .await
+}
+
+#[allow(clippy::too_many_arguments)]
+pub(crate) async fn send_dispatcher_work_item_with_transport_and_history<
+    H,
+    E,
+    R,
+    P,
+    SendFn,
+    SendFuture,
+>(
+    history: H,
+    ephemeral: E,
+    rate_limits: Arc<rate_limits::ChatRateLimitPolicy<R>>,
+    permissions: Arc<permissions::ChatPermissionPolicy<P>>,
+    failure_ring: Option<Arc<DispatchFailureRing>>,
+    routing_admin_reports: Option<openplotva_storage::llm_routing::PostgresRoutingAdminReportStore>,
+    item: openplotva_telegram::DispatcherWorkItem,
+    send: SendFn,
+) -> openplotva_telegram::DispatcherSendStatus
+where
+    H: virtual_messages::EditHistorySink,
+    E: virtual_messages::EphemeralMessageTracker + Sync,
+    R: rate_limits::RateLimitStore + Send + Sync,
+    P: permissions::ChatPermissionStore + Send + Sync,
+    SendFn: Fn(openplotva_telegram::TelegramOutboundMethod) -> SendFuture,
+    SendFuture: Future<
+        Output = Result<
+            openplotva_telegram::TelegramOutboundResponse,
+            openplotva_telegram::TelegramOutboundExecuteError,
+        >,
+    >,
+{
+    let chat_id = item.metadata().chat_id;
+    let bypass_chat_restrictions = item.bypasses_chat_restrictions();
+    let virtual_id = item.metadata().virtual_id.clone();
+    let protected = item.metadata().protected;
+    if virtual_id.starts_with(openplotva_storage::maintenance_notifications::NOTIFICATION_PREFIX) {
+        let Some(store) = routing_admin_reports.as_ref() else {
+            return openplotva_telegram::DispatcherSendStatus::Failed;
+        };
+        match maintenance_api::begin_notification(store.pool(), &virtual_id).await {
+            Ok(true) => {}
+            Ok(false) => return openplotva_telegram::DispatcherSendStatus::Sent,
+            Err(error) => {
+                tracing::warn!(%error, "failed to claim maintenance notification send");
+                return openplotva_telegram::DispatcherSendStatus::Failed;
+            }
+        }
+    }
+    let reply_to_message_id =
+        reply_message_id_from_fingerprint_key(&item.metadata().fingerprint_key);
+    let method_kind_label = item
+        .method_kind()
+        .map(|kind| format!("{kind:?}"))
+        .unwrap_or_else(|| "none".to_owned());
+    let record_failure = |error: String, class: &'static str| {
+        if let Some(ring) = failure_ring.as_deref() {
+            ring.record(DispatchFailureRecord {
+                at: OffsetDateTime::now_utc(),
+                virtual_id: virtual_id.clone(),
+                chat_id,
+                method_kind: method_kind_label.clone(),
+                error,
+                class,
+                protected,
+                reply_to_message_id,
+            });
+        }
+    };
+    if chat_id != 0 {
+        let check = rate_limits
+            .is_rate_limited_at(chat_id, OffsetDateTime::now_utc())
+            .await;
+        if let Some(load_error) = check.load_error.as_deref() {
+            tracing::debug!(
+                chat_id,
+                %load_error,
+                "failed to load persisted Telegram rate-limit state"
+            );
+        }
+        if check.rate_limited {
+            tracing::debug!(chat_id, "skipping Telegram send for rate-limited chat");
+            record_failure(
+                "skipped send for rate-limited chat".to_owned(),
+                DISPATCH_FAILURE_CLASS_CHAT_RATE_LIMITED,
+            );
+            if let Some(store) = routing_admin_reports.as_ref()
+                && let Err(error) = maintenance_api::finish_notification(
+                    store.pool(),
+                    &virtual_id,
+                    None,
+                    true,
+                    false,
+                )
+                .await
+            {
+                tracing::warn!(%error, "failed to defer rate-limited maintenance notification");
+            }
+            if let Some(store) = routing_admin_reports.as_ref()
+                && let Err(error) = routing_admin_reports::record_routing_admin_dispatch_failure(
+                    store,
+                    &virtual_id,
+                    DISPATCH_FAILURE_CLASS_CHAT_RATE_LIMITED,
+                    OffsetDateTime::now_utc(),
+                )
+                .await
+            {
+                tracing::warn!(%error, %virtual_id, "failed to record rate-limited LLM admin report");
+            }
+            return openplotva_telegram::DispatcherSendStatus::Failed;
+        }
+    }
+    if chat_id != 0
+        && !bypass_chat_restrictions
+        && let Some(method_kind) = item.method_kind()
+    {
+        for action in permissions::dispatcher_required_actions(method_kind) {
+            let report = permissions
+                .can_perform_action_at(chat_id, None, action, OffsetDateTime::now_utc())
+                .await;
+            if let Some(load_error) = report.load_error.as_deref() {
+                tracing::debug!(
+                    chat_id,
+                    action,
+                    %load_error,
+                    "failed to load Telegram permission state"
+                );
+            }
+            if !report.allowed {
+                tracing::debug!(
+                    chat_id,
+                    action,
+                    "skipping Telegram send for chat permission settings"
+                );
+                record_failure(
+                    format!("skipped send: chat permission settings deny {action}"),
+                    openplotva_telegram::OutboundSendErrorClass::TerminalPermission.as_str(),
+                );
+                if let Some(store) = routing_admin_reports.as_ref()
+                    && let Err(error) = maintenance_api::finish_notification(
+                        store.pool(),
+                        &virtual_id,
+                        None,
+                        true,
+                        true,
+                    )
+                    .await
+                {
+                    tracing::warn!(%error, "failed to defer denied maintenance notification");
+                }
+                if let Some(store) = routing_admin_reports.as_ref()
+                    && let Err(error) =
+                        routing_admin_reports::record_routing_admin_dispatch_failure(
+                            store,
+                            &virtual_id,
+                            openplotva_telegram::OutboundSendErrorClass::TerminalPermission
+                                .as_str(),
+                            OffsetDateTime::now_utc(),
+                        )
+                        .await
+                {
+                    tracing::warn!(%error, %virtual_id, "failed to record denied LLM admin report");
+                }
+                return openplotva_telegram::DispatcherSendStatus::Failed;
+            }
+        }
+    }
+
+    let retry_virtual_id = virtual_id.clone();
+    let report = virtual_messages::send_work_item_with_history_and_ephemeral(
+        &history,
+        &ephemeral,
+        item,
+        OffsetDateTime::now_utc(),
+        |method| {
+            let rate_limits = Arc::clone(&rate_limits);
+            let permissions = Arc::clone(&permissions);
+            async move {
+                let method_kind = method.kind();
+                let reply_missing_fallback =
+                    openplotva_telegram::replay_outbound_method_without_reply(&method);
+                match openplotva_telegram::send_outbound_method_with_bounded_retry(
+                    &send,
+                    method,
+                    &retry_virtual_id,
+                    chat_id,
+                )
+                .await
+                {
+                    Ok(response) => Ok(response),
+                    Err(mut error) => {
+                        if matches!(
+                            method_kind,
+                            openplotva_telegram::TelegramOutboundMethodKind::SendMessage
+                                | openplotva_telegram::TelegramOutboundMethodKind::SendRichMessage
+                        ) && error.is_reply_missing()
+                        {
+                            tracing::warn!(
+                                chat_id,
+                                "reply target missing; retrying Telegram send without reply parameters"
+                            );
+                            if let Some(fallback) = reply_missing_fallback {
+                                match openplotva_telegram::send_outbound_method_with_bounded_retry(
+                                    &send,
+                                    fallback,
+                                    &retry_virtual_id,
+                                    chat_id,
+                                )
+                                .await
+                                {
+                                    Ok(response) => return Ok(response),
+                                    Err(fallback_error) => error = fallback_error,
+                                }
+                            }
+                        }
+                        if let Some(retry_after) =
+                            rate_limits::telegram_retry_after_from_outbound_error(&error)
+                        {
+                            let report = rate_limits
+                                .set_rate_limit_at(chat_id, retry_after, OffsetDateTime::now_utc())
+                                .await;
+                            if let Some(save_error) = report.save_error.as_deref() {
+                                tracing::warn!(
+                                    chat_id,
+                                    retry_after_seconds = retry_after.as_secs(),
+                                    %save_error,
+                                    "failed to persist Telegram rate-limit state"
+                                );
+                            }
+                        }
+                        if chat_id != 0
+                            && error.is_permission_error()
+                        {
+                            let report = permissions
+                                .record_send_permission_error(chat_id, method_kind)
+                                .await;
+                            if let Some(load_error) = report.load_error.as_deref() {
+                                tracing::warn!(
+                                    chat_id,
+                                    method = ?method_kind,
+                                    %load_error,
+                                    "failed to load chat permission state after Telegram permission error"
+                                );
+                            }
+                            if let Some(save_error) = report.save_error.as_deref() {
+                                tracing::warn!(
+                                    chat_id,
+                                    method = ?method_kind,
+                                    %save_error,
+                                    "failed to persist chat permission state after Telegram permission error"
+                                );
+                            }
+                        }
+                        Err(error)
+                    }
+                }
+            }
+        },
+    )
+    .await;
+    if report.ephemeral_track_error.is_some() {
+        tracing::warn!(
+            virtual_id = report.virtual_id,
+            real_message_id = ?report.sent_message_id,
+            ephemeral_track_error = ?report.ephemeral_track_error,
+            "failed to track outbound ephemeral message"
+        );
+    }
+    if let Some(store) = routing_admin_reports.as_ref()
+        && let Err(error) = maintenance_api::record_dispatch(store.pool(), &report).await
+    {
+        tracing::warn!(%error, "failed to record maintenance notification delivery receipt");
+    }
+    if matches!(
+        report.status,
+        openplotva_telegram::DispatcherSendStatus::Failed
+    ) {
+        let error_class = report
+            .error_class
+            .unwrap_or(DISPATCH_FAILURE_CLASS_MISSING_METHOD);
+        let send_error = report.send_error.clone().unwrap_or_default();
+        tracing::warn!(
+            virtual_id = report.virtual_id,
+            chat_id,
+            error_class,
+            send_error,
+            method_kind = method_kind_label,
+            "outbound dispatcher send failed"
+        );
+        record_failure(send_error, error_class);
+    }
+    if let Some(store) = routing_admin_reports.as_ref()
+        && let Err(error) = routing_admin_reports::record_routing_admin_dispatch_result(
+            store,
+            &report,
+            OffsetDateTime::now_utc(),
+        )
+        .await
+    {
+        tracing::warn!(%error, virtual_id = report.virtual_id, "failed to record LLM admin report delivery");
+    }
+    report.status
+}
+
+pub(crate) fn dispatcher_config() -> openplotva_telegram::DispatcherConfig {
+    openplotva_telegram::DispatcherConfig {
+        max_queue_size: DISPATCHER_MAX_QUEUE_SIZE,
+        dedupe_config: openplotva_telegram::DebouncerConfig {
+            enabled: true,
+            default_window: DISPATCHER_DEBOUNCE_WINDOW,
+            max_cache_size: DISPATCHER_DEBOUNCE_CACHE_SIZE,
+            per_chat_settings: Default::default(),
+        },
+        ..openplotva_telegram::DispatcherConfig::default()
+    }
+}
+
+pub(crate) struct DispatcherWorkerGroupInputs {
+    pub(crate) history: PostgresHistoryStore,
+    pub(crate) telegram: openplotva_telegram::TelegramClient,
+    pub(crate) rich: openplotva_telegram::RichApiClient,
+    pub(crate) ephemeral: RedisEphemeralMessageStore,
+    pub(crate) rate_limits: Arc<rate_limits::ChatRateLimitPolicy<RedisRateLimitStore>>,
+    pub(crate) permissions: Arc<permissions::ChatPermissionPolicy<PostgresChatSettingsStore>>,
+    pub(crate) queue: Arc<openplotva_telegram::DispatcherQueue>,
+    pub(crate) limiters: Arc<openplotva_telegram::ChatLimiters>,
+    pub(crate) failure_ring: Arc<DispatchFailureRing>,
+    pub(crate) routing_admin_reports:
+        openplotva_storage::llm_routing::PostgresRoutingAdminReportStore,
+}
+
+pub(crate) const DISPATCHER_MAX_QUEUE_SIZE: usize = 10_000;
+pub(crate) const DISPATCHER_DEBOUNCE_WINDOW: Duration = Duration::from_secs(3);
+pub(crate) const DISPATCHER_DEBOUNCE_CACHE_SIZE: usize = 1_000;
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/openplotva-app/src/runtime_entities.rs b/crates/openplotva-app/src/runtime_entities.rs
index 78adec31..157c26a5 100644
--- a/crates/openplotva-app/src/runtime_entities.rs
+++ b/crates/openplotva-app/src/runtime_entities.rs
@@ -1,7 +1,5 @@
 //! Runtime API entity readers backed by Postgres.
 
-use std::collections::HashMap;
-
 use openplotva_server::{
     RuntimeChatConnectionData, RuntimeChatData, RuntimeChatMemberData,
     RuntimeChatMemberWithUserData, RuntimeChatsFilter, RuntimeEntityReader,
@@ -9,94 +7,20 @@ use openplotva_server::{
     RuntimeUserDetailsData, RuntimeUserLookup, RuntimeUsersFilter, RuntimeVipCacheData,
     RuntimeVipEventData, RuntimeVipSummaryData,
 };
+use openplotva_storage::entities::{
+    ChatMemberProfile, PostgresEntityStore, TelegramChatProfile, TelegramUserProfile,
+};
 use openplotva_storage::{
     PostgresPaymentStore, PostgresVipStore, SubscriptionRecord, VipCacheRecord, VipEventListRecord,
     VipSummaryRecord,
 };
-use sqlx::{PgPool, Row};
+use sqlx::PgPool;
 use time::{OffsetDateTime, format_description::well_known::Rfc3339};
 
-const SQL_COUNT_USERS_FILTERED: &str = r#"
-SELECT COUNT(*)::int
-FROM telegram_users_effective
-WHERE (
-    $1::text IS NULL
-    OR username ILIKE '%' || $1::text || '%'
-    OR first_name ILIKE '%' || $1::text || '%'
-    OR last_name ILIKE '%' || $1::text || '%'
-)"#;
-
-const SQL_LIST_USERS_FILTERED: &str = r#"
-SELECT *
-FROM telegram_users_effective
-WHERE (
-    $1::text IS NULL
-    OR username ILIKE '%' || $1::text || '%'
-    OR first_name ILIKE '%' || $1::text || '%'
-    OR last_name ILIKE '%' || $1::text || '%'
-)
-ORDER BY id
-LIMIT $2
-OFFSET $3"#;
-
-const SQL_GET_RUNTIME_USER: &str = "SELECT * FROM telegram_users_effective WHERE id = $1";
-const SQL_GET_RUNTIME_USER_BY_USERNAME: &str =
-    "SELECT * FROM telegram_users_effective WHERE username = $1 LIMIT 1";
-const SQL_GET_RUNTIME_USER_ID_BY_USERNAME: &str =
-    "SELECT id FROM telegram_users_effective WHERE lower(username) = lower($1) LIMIT 1";
-const SQL_LIST_RUNTIME_USERS_BY_IDS: &str =
-    "SELECT * FROM telegram_users_effective WHERE id = ANY($1::bigint[])";
-
-const SQL_COUNT_CHATS_FILTERED: &str = r#"
-SELECT COUNT(*)::int
-FROM telegram_chats_effective
-WHERE (
-    $1::text IS NULL
-    OR CAST(id AS text) LIKE '%' || $1::text || '%'
-    OR title ILIKE '%' || $1::text || '%'
-    OR username ILIKE '%' || $1::text || '%'
-    OR first_name ILIKE '%' || $1::text || '%'
-    OR last_name ILIKE '%' || $1::text || '%'
-)"#;
-
-const SQL_LIST_CHATS_FILTERED: &str = r#"
-SELECT *
-FROM telegram_chats_effective
-WHERE (
-    $1::text IS NULL
-    OR CAST(id AS text) LIKE '%' || $1::text || '%'
-    OR title ILIKE '%' || $1::text || '%'
-    OR username ILIKE '%' || $1::text || '%'
-    OR first_name ILIKE '%' || $1::text || '%'
-    OR last_name ILIKE '%' || $1::text || '%'
-)
-ORDER BY id
-LIMIT $2
-OFFSET $3"#;
-
-const SQL_COUNT_CHATS_BY_MEMBER: &str = r#"
-SELECT COUNT(DISTINCT c.id)::int
-FROM telegram_chats_effective c
-JOIN telegram_chat_members_effective cm ON c.id = cm.chat_id
-WHERE cm.user_id = $1"#;
-
-const SQL_LIST_CHATS_BY_MEMBER: &str = r#"
-SELECT DISTINCT c.*
-FROM telegram_chats_effective c
-JOIN telegram_chat_members_effective cm ON c.id = cm.chat_id
-WHERE cm.user_id = $1
-ORDER BY c.id
-LIMIT $2
-OFFSET $3"#;
-
-const SQL_GET_RUNTIME_CHAT: &str = "SELECT * FROM telegram_chats_effective WHERE id = $1";
-const SQL_LIST_RUNTIME_CHAT_MEMBERS: &str =
-    "SELECT * FROM telegram_chat_members_effective WHERE chat_id = $1";
-
 /// SQLx-backed runtime API core entity reader.
 #[derive(Clone, Debug)]
 pub struct PostgresRuntimeEntityReader {
-    pool: PgPool,
+    entities: PostgresEntityStore,
     payments: PostgresPaymentStore,
     vip: PostgresVipStore,
 }
@@ -105,9 +29,9 @@ impl PostgresRuntimeEntityReader {
     /// Build a reader over an existing Postgres pool.
     pub fn new(pool: PgPool) -> Self {
         Self {
+            entities: PostgresEntityStore::new(pool.clone()),
             payments: PostgresPaymentStore::new(pool.clone()),
             vip: PostgresVipStore::new(pool.clone()),
-            pool,
         }
     }
 }
@@ -150,51 +74,39 @@ impl PostgresRuntimeEntityReader {
     async fn list_users(
         &self,
         filter: RuntimeUsersFilter,
-    ) -> Result<RuntimeUserConnectionData, sqlx::Error> {
+    ) -> Result<RuntimeUserConnectionData, openplotva_storage::StorageError> {
         let search = optional_search(&filter.q);
-        let count = sqlx::query_scalar::<_, i32>(SQL_COUNT_USERS_FILTERED)
-            .bind(search.as_deref())
-            .fetch_one(&self.pool)
-            .await?;
-        let rows = sqlx::query(SQL_LIST_USERS_FILTERED)
-            .bind(search.as_deref())
-            .bind(filter.limit)
-            .bind(filter.offset)
-            .fetch_all(&self.pool)
+        let count = self.entities.count_users(search.as_deref()).await?;
+        let rows = self
+            .entities
+            .users(
+                search.as_deref(),
+                i64::from(filter.limit),
+                i64::from(filter.offset),
+            )
             .await?;
         Ok(RuntimeUserConnectionData {
             count,
             offset: filter.offset,
             limit: filter.limit,
-            items: rows
-                .into_iter()
-                .map(runtime_user_from_row)
-                .collect::<Result<Vec<_>, _>>()?,
+            items: rows.into_iter().map(runtime_user_from_record).collect(),
         })
     }
 
     async fn get_user_details(
         &self,
         lookup: RuntimeUserLookup,
-    ) -> Result<Option<RuntimeUserDetailsData>, sqlx::Error> {
+    ) -> Result<Option<RuntimeUserDetailsData>, openplotva_storage::StorageError> {
         let row = match lookup {
-            RuntimeUserLookup::Id(id) => {
-                sqlx::query(SQL_GET_RUNTIME_USER)
-                    .bind(id)
-                    .fetch_optional(&self.pool)
-                    .await?
-            }
+            RuntimeUserLookup::Id(id) => self.entities.user(id).await?,
             RuntimeUserLookup::Username(username) => {
-                sqlx::query(SQL_GET_RUNTIME_USER_BY_USERNAME)
-                    .bind(username)
-                    .fetch_optional(&self.pool)
-                    .await?
+                self.entities.user_by_username(&username).await?
             }
         };
         let Some(row) = row else {
             return Ok(None);
         };
-        let user = runtime_user_from_row(row)?;
+        let user = runtime_user_from_record(row);
         let subscription = self
             .payments
             .get_active_subscription(user.id)
@@ -245,36 +157,32 @@ impl PostgresRuntimeEntityReader {
     async fn list_chats(
         &self,
         filter: RuntimeChatsFilter,
-    ) -> Result<RuntimeChatConnectionData, sqlx::Error> {
+    ) -> Result<RuntimeChatConnectionData, openplotva_storage::StorageError> {
         if filter.member_username.is_some() || filter.member_user_id.is_some() {
             return self.list_chats_by_member(filter).await;
         }
         let search = optional_search(&filter.q);
-        let count = sqlx::query_scalar::<_, i32>(SQL_COUNT_CHATS_FILTERED)
-            .bind(search.as_deref())
-            .fetch_one(&self.pool)
-            .await?;
-        let rows = sqlx::query(SQL_LIST_CHATS_FILTERED)
-            .bind(search.as_deref())
-            .bind(filter.limit)
-            .bind(filter.offset)
-            .fetch_all(&self.pool)
+        let count = self.entities.count_chats(search.as_deref()).await?;
+        let rows = self
+            .entities
+            .chats(
+                search.as_deref(),
+                i64::from(filter.limit),
+                i64::from(filter.offset),
+            )
             .await?;
         Ok(RuntimeChatConnectionData {
             count,
             offset: filter.offset,
             limit: filter.limit,
-            items: rows
-                .into_iter()
-                .map(runtime_chat_from_row)
-                .collect::<Result<Vec<_>, _>>()?,
+            items: rows.into_iter().map(runtime_chat_from_record).collect(),
         })
     }
 
     async fn list_chats_by_member(
         &self,
         filter: RuntimeChatsFilter,
-    ) -> Result<RuntimeChatConnectionData, sqlx::Error> {
+    ) -> Result<RuntimeChatConnectionData, openplotva_storage::StorageError> {
         let Some(member_user_id) = self.chat_member_filter_user_id(&filter).await? else {
             return Ok(RuntimeChatConnectionData {
                 count: 0,
@@ -283,31 +191,27 @@ impl PostgresRuntimeEntityReader {
                 items: Vec::new(),
             });
         };
-        let count = sqlx::query_scalar::<_, i32>(SQL_COUNT_CHATS_BY_MEMBER)
-            .bind(member_user_id)
-            .fetch_one(&self.pool)
-            .await?;
-        let rows = sqlx::query(SQL_LIST_CHATS_BY_MEMBER)
-            .bind(member_user_id)
-            .bind(filter.limit)
-            .bind(filter.offset)
-            .fetch_all(&self.pool)
+        let count = self.entities.count_chats_by_member(member_user_id).await?;
+        let rows = self
+            .entities
+            .chats_by_member(
+                member_user_id,
+                i64::from(filter.limit),
+                i64::from(filter.offset),
+            )
             .await?;
         Ok(RuntimeChatConnectionData {
             count,
             offset: filter.offset,
             limit: filter.limit,
-            items: rows
-                .into_iter()
-                .map(runtime_chat_from_row)
-                .collect::<Result<Vec<_>, _>>()?,
+            items: rows.into_iter().map(runtime_chat_from_record).collect(),
         })
     }
 
     async fn chat_member_filter_user_id(
         &self,
         filter: &RuntimeChatsFilter,
-    ) -> Result<Option<i64>, sqlx::Error> {
+    ) -> Result<Option<i64>, openplotva_storage::StorageError> {
         let username = filter
             .member_username
             .as_deref()
@@ -315,12 +219,7 @@ impl PostgresRuntimeEntityReader {
             .filter(|value| !value.is_empty());
         let username_was_requested = username.is_some();
         let username_user_id = match username {
-            Some(username) => {
-                sqlx::query_scalar::<_, i64>(SQL_GET_RUNTIME_USER_ID_BY_USERNAME)
-                    .bind(username)
-                    .fetch_optional(&self.pool)
-                    .await?
-            }
+            Some(username) => self.entities.user_id_by_username(username).await?,
             None => None,
         };
         match (filter.member_user_id, username_user_id) {
@@ -337,115 +236,83 @@ impl PostgresRuntimeEntityReader {
         }
     }
 
-    async fn get_chat(&self, id: i64) -> Result<Option<RuntimeChatData>, sqlx::Error> {
-        let row = sqlx::query(SQL_GET_RUNTIME_CHAT)
-            .bind(id)
-            .fetch_optional(&self.pool)
-            .await?;
-        row.map(runtime_chat_from_row).transpose()
+    async fn get_chat(
+        &self,
+        id: i64,
+    ) -> Result<Option<RuntimeChatData>, openplotva_storage::StorageError> {
+        Ok(self.entities.chat(id).await?.map(runtime_chat_from_record))
     }
 
     async fn list_chat_members(
         &self,
         chat_id: i64,
-    ) -> Result<Vec<RuntimeChatMemberWithUserData>, sqlx::Error> {
-        let rows = sqlx::query(SQL_LIST_RUNTIME_CHAT_MEMBERS)
-            .bind(chat_id)
-            .fetch_all(&self.pool)
-            .await?;
-        let members = rows
+    ) -> Result<Vec<RuntimeChatMemberWithUserData>, openplotva_storage::StorageError> {
+        Ok(self
+            .entities
+            .members_with_users(chat_id)
+            .await?
             .into_iter()
-            .map(runtime_chat_member_from_row)
-            .collect::<Result<Vec<_>, _>>()?;
-        let users = self.users_by_id(&members).await?;
-        Ok(members
-            .into_iter()
-            .map(|member| {
-                let user = users.get(&member.user_id).cloned();
-                RuntimeChatMemberWithUserData { member, user }
+            .map(|(member, user)| RuntimeChatMemberWithUserData {
+                member: runtime_chat_member_from_record(member),
+                user: user.map(runtime_user_from_record),
             })
             .collect())
     }
-
-    async fn users_by_id(
-        &self,
-        members: &[RuntimeChatMemberData],
-    ) -> Result<HashMap<i64, RuntimeUserData>, sqlx::Error> {
-        let mut ids = members
-            .iter()
-            .map(|member| member.user_id)
-            .collect::<Vec<_>>();
-        ids.sort_unstable();
-        ids.dedup();
-        if ids.is_empty() {
-            return Ok(HashMap::new());
-        }
-        let rows = sqlx::query(SQL_LIST_RUNTIME_USERS_BY_IDS)
-            .bind(&ids)
-            .fetch_all(&self.pool)
-            .await?;
-        rows.into_iter()
-            .map(runtime_user_from_row)
-            .map(|result| result.map(|user| (user.id, user)))
-            .collect()
-    }
 }
 
-fn runtime_user_from_row(row: sqlx::postgres::PgRow) -> Result<RuntimeUserData, sqlx::Error> {
-    Ok(RuntimeUserData {
-        id: row.try_get("id")?,
-        is_premium: row.try_get("is_premium")?,
-        first_name: row.try_get("first_name")?,
-        last_name: row.try_get("last_name")?,
-        username: row.try_get("username")?,
-        language_code: row.try_get("language_code")?,
-        is_vip: row.try_get("is_vip")?,
-        discovered_at: format_ts(row.try_get("discovered")?),
-        updated_at: format_ts(row.try_get("updated")?),
-    })
+fn runtime_user_from_record(record: TelegramUserProfile) -> RuntimeUserData {
+    RuntimeUserData {
+        id: record.id,
+        is_premium: record.is_premium,
+        first_name: record.first_name,
+        last_name: record.last_name,
+        username: record.username,
+        language_code: record.language_code,
+        is_vip: record.is_vip,
+        discovered_at: format_ts(record.discovered),
+        updated_at: format_ts(record.updated),
+    }
 }
 
-fn runtime_chat_from_row(row: sqlx::postgres::PgRow) -> Result<RuntimeChatData, sqlx::Error> {
-    Ok(RuntimeChatData {
-        id: row.try_get("id")?,
-        chat_type: row.try_get("type")?,
-        title: row.try_get("title")?,
-        username: row.try_get("username")?,
-        first_name: row.try_get("first_name")?,
-        last_name: row.try_get("last_name")?,
-        is_forum: row.try_get("is_forum")?,
-        description: row.try_get("description")?,
-        invite_link: row.try_get("invite_link")?,
-        discovered_at: format_ts(row.try_get("discovered")?),
-        updated_at: format_ts(row.try_get("updated")?),
-    })
+fn runtime_chat_from_record(record: TelegramChatProfile) -> RuntimeChatData {
+    RuntimeChatData {
+        id: record.id,
+        chat_type: record.chat_type,
+        title: record.title,
+        username: record.username,
+        first_name: record.first_name,
+        last_name: record.last_name,
+        is_forum: record.is_forum,
+        description: record.description,
+        invite_link: record.invite_link,
+        discovered_at: format_ts(record.discovered),
+        updated_at: format_ts(record.updated),
+    }
 }
 
-fn runtime_chat_member_from_row(
-    row: sqlx::postgres::PgRow,
-) -> Result<RuntimeChatMemberData, sqlx::Error> {
-    Ok(RuntimeChatMemberData {
-        chat_id: row.try_get("chat_id")?,
-        user_id: row.try_get("user_id")?,
-        status: row.try_get("status")?,
-        is_anonymous: row.try_get("is_anonymous")?,
-        custom_title: row.try_get("custom_title")?,
-        can_be_edited: row.try_get("can_be_edited")?,
-        can_manage_chat: row.try_get("can_manage_chat")?,
-        can_delete_messages: row.try_get("can_delete_messages")?,
-        can_manage_video_chats: row.try_get("can_manage_video_chats")?,
-        can_restrict_members: row.try_get("can_restrict_members")?,
-        can_promote_members: row.try_get("can_promote_members")?,
-        can_change_info: row.try_get("can_change_info")?,
-        can_invite_users: row.try_get("can_invite_users")?,
-        can_post_messages: row.try_get("can_post_messages")?,
-        can_edit_messages: row.try_get("can_edit_messages")?,
-        can_pin_messages: row.try_get("can_pin_messages")?,
-        can_manage_topics: row.try_get("can_manage_topics")?,
-        created_at: format_ts(row.try_get("created_at")?),
-        updated_at: format_ts(row.try_get("updated_at")?),
-        last_message_at: format_ts(row.try_get("last_message_at")?),
-    })
+fn runtime_chat_member_from_record(record: ChatMemberProfile) -> RuntimeChatMemberData {
+    RuntimeChatMemberData {
+        chat_id: record.membership.chat_id,
+        user_id: record.membership.user_id,
+        status: record.membership.status,
+        is_anonymous: record.membership.is_anonymous,
+        custom_title: record.membership.custom_title,
+        can_be_edited: record.membership.can_be_edited,
+        can_manage_chat: record.membership.can_manage_chat,
+        can_delete_messages: record.membership.can_delete_messages,
+        can_manage_video_chats: record.membership.can_manage_video_chats,
+        can_restrict_members: record.membership.can_restrict_members,
+        can_promote_members: record.membership.can_promote_members,
+        can_change_info: record.membership.can_change_info,
+        can_invite_users: record.membership.can_invite_users,
+        can_post_messages: record.membership.can_post_messages,
+        can_edit_messages: record.membership.can_edit_messages,
+        can_pin_messages: record.membership.can_pin_messages,
+        can_manage_topics: record.membership.can_manage_topics,
+        created_at: format_ts(record.created_at),
+        updated_at: format_ts(record.updated_at),
+        last_message_at: format_ts(record.last_message_at),
+    }
 }
 
 fn runtime_subscription_from_record(subscription: SubscriptionRecord) -> RuntimeSubscriptionData {
@@ -582,8 +449,11 @@ fn vip_display_days_left_at(expires_at: OffsetDateTime, now: OffsetDateTime) ->
         .max(0.0) as i32
 }
 
-fn error_text(error: impl std::fmt::Display) -> String {
-    error.to_string()
+fn error_text(error: openplotva_storage::StorageError) -> String {
+    match error {
+        openplotva_storage::StorageError::Postgres { source } => source.to_string(),
+        error => error.to_string(),
+    }
 }
 
 #[cfg(test)]
@@ -639,11 +509,96 @@ mod tests {
         assert_eq!(runtime_actor_label(&event).as_deref(), Some("42"));
     }
 
-    #[test]
-    fn chat_member_filter_sql_uses_resolved_user_id_path() {
-        assert!(SQL_COUNT_CHATS_BY_MEMBER.contains("cm.user_id = $1"));
-        assert!(SQL_LIST_CHATS_BY_MEMBER.contains("cm.user_id = $1"));
-        assert!(!SQL_COUNT_CHATS_BY_MEMBER.contains("LOWER(u.username)"));
-        assert!(!SQL_LIST_CHATS_BY_MEMBER.contains("LOWER(u.username)"));
+    #[tokio::test]
+    async fn postgres_entity_profiles_preserve_member_filters_and_username_lookup()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let Ok(dsn) = std::env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
+            return Ok(());
+        };
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(4)
+            .connect(&dsn)
+            .await?;
+        openplotva_storage::run_migrations_on(&pool).await?;
+        let first = OffsetDateTime::now_utc().unix_timestamp_nanos() as i64;
+        let second = first + 1;
+        let username = format!("Lookup{first}");
+        sqlx::query("INSERT INTO users (id,first_name,username,is_premium) VALUES ($1,'Alice',$2,TRUE),($3,'Bob',NULL,FALSE)")
+            .bind(first).bind(&username).bind(second).execute(&pool).await?;
+        sqlx::query("INSERT INTO chats (id,type,title,is_forum) VALUES ($1,'supergroup','A',TRUE),($2,'group','B',FALSE)")
+            .bind(-first).bind(-second).execute(&pool).await?;
+        sqlx::query("INSERT INTO chat_members (chat_id,user_id,status) VALUES ($1,$2,'member'),($3,$4,'member')")
+            .bind(-first).bind(first).bind(-second).bind(second).execute(&pool).await?;
+        let reader = PostgresRuntimeEntityReader::new(pool.clone());
+        let by_id = reader
+            .chats(RuntimeChatsFilter {
+                member_user_id: Some(second),
+                limit: 20,
+                ..Default::default()
+            })
+            .await?;
+        assert_eq!(by_id.count, 1);
+        assert_eq!(by_id.items[0].id, -second);
+        let by_name = reader
+            .chats(RuntimeChatsFilter {
+                member_username: Some(username.to_uppercase()),
+                limit: 20,
+                ..Default::default()
+            })
+            .await?;
+        assert_eq!(by_name.count, 1);
+        assert_eq!(by_name.items[0].id, -first);
+        let mismatch = reader
+            .chats(RuntimeChatsFilter {
+                member_user_id: Some(second),
+                member_username: Some(username.clone()),
+                limit: 20,
+                ..Default::default()
+            })
+            .await?;
+        assert_eq!(mismatch.count, 0);
+        assert!(mismatch.items.is_empty());
+        let exact = reader
+            .user(RuntimeUserLookup::Username(username.clone()))
+            .await?
+            .expect("exact username");
+        assert_eq!(exact.user.id, first);
+        assert_eq!(exact.user.is_premium, Some(true));
+        assert!(
+            reader
+                .user(RuntimeUserLookup::Username(username.to_uppercase()))
+                .await?
+                .is_none()
+        );
+        let users = reader
+            .users(RuntimeUsersFilter {
+                q: username.to_lowercase(),
+                limit: 20,
+                ..Default::default()
+            })
+            .await?;
+        assert_eq!(users.count, 1);
+        assert_eq!(users.items[0].id, first);
+        assert_eq!(
+            reader.chat(-first).await?.expect("chat").is_forum,
+            Some(true)
+        );
+        let members = reader.chat_members(-first).await?;
+        assert_eq!(members.len(), 1);
+        assert_eq!(members[0].member.user_id, first);
+        assert_eq!(members[0].user.as_ref().expect("member profile").id, first);
+        sqlx::query("DELETE FROM chat_members WHERE user_id = ANY($1)")
+            .bind(vec![first, second])
+            .execute(&pool)
+            .await?;
+        sqlx::query("DELETE FROM users WHERE id = ANY($1)")
+            .bind(vec![first, second])
+            .execute(&pool)
+            .await?;
+        sqlx::query("DELETE FROM chats WHERE id = ANY($1)")
+            .bind(vec![-first, -second])
+            .execute(&pool)
+            .await?;
+        Ok(())
     }
 }
diff --git a/crates/openplotva-app/src/runtime_llm.rs b/crates/openplotva-app/src/runtime_llm.rs
index 73e1f56e..e13d0963 100644
--- a/crates/openplotva-app/src/runtime_llm.rs
+++ b/crates/openplotva-app/src/runtime_llm.rs
@@ -22,8 +22,8 @@ use tokio::{
     task::JoinHandle,
 };
 
-const GO_LLM_TRACE_BUFFER_CAPACITY: usize = 1_000;
-const GO_RESPONSE_PREVIEW_SIZE: usize = 500;
+const LLM_TRACE_BUFFER_CAPACITY: usize = 1_000;
+const RESPONSE_PREVIEW_SIZE: usize = 500;
 const LLM_EVENT_WRITER_CHANNEL_CAPACITY: usize = 10_000;
 const LLM_EVENT_WRITER_BATCH_SIZE: usize = 100;
 const LLM_EVENT_WRITER_FLUSH_INTERVAL: Duration = Duration::from_secs(5);
@@ -296,14 +296,14 @@ pub struct RuntimeLlmRequestEventCleanupReport {
 
 impl Default for RuntimeLlmTraceBuffer {
     fn default() -> Self {
-        Self::new(GO_LLM_TRACE_BUFFER_CAPACITY)
+        Self::new(LLM_TRACE_BUFFER_CAPACITY)
     }
 }
 
 impl RuntimeLlmTraceBuffer {
     pub fn new(capacity: usize) -> Self {
         let capacity = if capacity == 0 {
-            GO_LLM_TRACE_BUFFER_CAPACITY
+            LLM_TRACE_BUFFER_CAPACITY
         } else {
             capacity
         };
@@ -665,7 +665,7 @@ fn trace_from_record(
         .raw_response
         .as_ref()
         .and_then(trace_response_text)
-        .map(|text| compact_preview(&text, GO_RESPONSE_PREVIEW_SIZE))
+        .map(|text| compact_preview(&text, RESPONSE_PREVIEW_SIZE))
         .and_then(|text| non_empty(&text));
     trace.result = RuntimeLlmRequestResultData {
         duration_ms,
@@ -708,7 +708,7 @@ impl RuntimeLlmTraceInspector for RuntimeLlmTraceBuffer {
         filter: RuntimeLlmRequestsFilter,
     ) -> Result<Vec<RuntimeLlmRequestData>, String> {
         let limit = filter.limit.max(1) as usize;
-        let mut out = Vec::with_capacity(limit.min(GO_LLM_TRACE_BUFFER_CAPACITY));
+        let mut out = Vec::with_capacity(limit.min(LLM_TRACE_BUFFER_CAPACITY));
         for trace in self.list() {
             if llm_trace_matches_filter(&trace, &filter) {
                 out.push(trace);
diff --git a/crates/openplotva-app/src/runtime_redis.rs b/crates/openplotva-app/src/runtime_redis.rs
new file mode 100644
index 00000000..15649240
--- /dev/null
+++ b/crates/openplotva-app/src/runtime_redis.rs
@@ -0,0 +1,94 @@
+use openplotva_storage::redis_inspector::{RedisInspectorStore, prefix_groups_from_keys};
+
+#[derive(Clone)]
+pub(crate) struct RedisRuntimeInspector {
+    store: RedisInspectorStore,
+}
+impl RedisRuntimeInspector {
+    pub(crate) fn new(client: redis::Client) -> Self {
+        Self {
+            store: RedisInspectorStore::new(client),
+        }
+    }
+}
+
+pub(crate) fn runtime_redis_prefix_groups_from_keys(
+    prefix: &str,
+    keys: impl IntoIterator<Item = String>,
+) -> Vec<openplotva_server::RuntimeRedisPrefixGroup> {
+    let groups = prefix_groups_from_keys(prefix, keys);
+    let mut groups = groups
+        .into_iter()
+        .map(|(prefix, count)| openplotva_server::RuntimeRedisPrefixGroup { prefix, count })
+        .collect::<Vec<_>>();
+    groups.sort_by(|a, b| a.prefix.cmp(&b.prefix));
+    groups
+}
+
+pub(crate) fn runtime_redis_value_from_bytes(
+    key: &str,
+    bytes: &[u8],
+    max_bytes: usize,
+) -> openplotva_server::RuntimeRedisValue {
+    let truncated = max_bytes > 0 && bytes.len() > max_bytes;
+    let bytes = if truncated {
+        &bytes[..max_bytes]
+    } else {
+        bytes
+    };
+    openplotva_server::RuntimeRedisValue {
+        key: key.to_owned(),
+        value: String::from_utf8_lossy(bytes).into_owned(),
+        truncated,
+    }
+}
+
+impl openplotva_server::RuntimeRedisInspector for RedisRuntimeInspector {
+    fn prefix_groups<'a>(
+        &'a self,
+        prefix: &'a str,
+        limit: usize,
+    ) -> openplotva_server::RuntimeRedisInspectorFuture<
+        'a,
+        Vec<openplotva_server::RuntimeRedisPrefixGroup>,
+    > {
+        Box::pin(async move {
+            let keys = self
+                .store
+                .scan_keys(&format!("{prefix}*"), Some(limit))
+                .await
+                .map_err(|error| error.to_string())?;
+            Ok(runtime_redis_prefix_groups_from_keys(prefix, keys))
+        })
+    }
+    fn keys<'a>(
+        &'a self,
+        pattern: &'a str,
+        limit: usize,
+    ) -> openplotva_server::RuntimeRedisInspectorFuture<'a, Vec<String>> {
+        Box::pin(async move {
+            self.store
+                .scan_keys(pattern, Some(limit))
+                .await
+                .map_err(|error| error.to_string())
+        })
+    }
+    fn value<'a>(
+        &'a self,
+        key: &'a str,
+        max_bytes: usize,
+    ) -> openplotva_server::RuntimeRedisInspectorFuture<
+        'a,
+        Option<openplotva_server::RuntimeRedisValue>,
+    > {
+        Box::pin(async move {
+            self.store
+                .value(key)
+                .await
+                .map(|value| {
+                    value.map(|bytes| runtime_redis_value_from_bytes(key, &bytes, max_bytes))
+                })
+                .map_err(|error| error.to_string())
+        })
+    }
+}
diff --git a/crates/openplotva-app/src/runtime_routing.rs b/crates/openplotva-app/src/runtime_routing.rs
index d2d82afe..7408b6ec 100644
--- a/crates/openplotva-app/src/runtime_routing.rs
+++ b/crates/openplotva-app/src/runtime_routing.rs
@@ -603,6 +603,28 @@ where
     report
 }
 
+pub(crate) fn record_openrouter_free_key_status_failed(
+    reporter: &RoutingEventReporter,
+    source: &str,
+    error: &str,
+) {
+    reporter.record(RoutingEvent {
+        severity: "warn".to_owned(),
+        event_type: "openrouter_free_key_status_failed".to_owned(),
+        workflow_key: "routing".to_owned(),
+        provider_id: None,
+        model_id: None,
+        queue_name: None,
+        job_id: None,
+        chat_id: None,
+        user_id: None,
+        thread_id: None,
+        message_id: None,
+        dedupe_key: format!("openrouter_free_key_status_failed:{source}"),
+        summary: "OpenRouter Free key status check failed".to_owned(),
+        detail: serde_json::json!({ "error": error, "source": source }),
+    });
+}
 #[cfg(test)]
 mod tests {
     use std::sync::Arc;
diff --git a/crates/openplotva-app/src/runtime_taskman.rs b/crates/openplotva-app/src/runtime_taskman.rs
index 4bdfcb87..74c416ed 100644
--- a/crates/openplotva-app/src/runtime_taskman.rs
+++ b/crates/openplotva-app/src/runtime_taskman.rs
@@ -929,7 +929,8 @@ fn count_processing(records: &[&TaskQueueRecord], queue_name: &str) -> i32 {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::payments::{PaymentControlJobQueue, PersistentPaymentControlJobQueue};
+
+    use crate::control_jobs::{ControlJobQueue, PersistentControlJobQueue};
     use openplotva_taskman::{
         CONTROL_QUEUE_NAME, ControlJobData, ControlJobParams, ControlKind, DialogJobParams,
         HIGH_PRIORITY, IMAGE_REGULAR_QUEUE_NAME, ImageGenJobParams, InMemoryTaskQueue,
@@ -962,7 +963,7 @@ mod tests {
     #[tokio::test]
     async fn runtime_taskman_inspector_lists_live_persistent_control_queue() {
         let shared = Arc::new(InMemoryTaskQueue::new());
-        let queue = PersistentPaymentControlJobQueue::from_task_queue((*shared).clone());
+        let queue = PersistentControlJobQueue::from_task_queue((*shared).clone());
         let created = OffsetDateTime::parse("2026-05-21T10:00:00Z", &Rfc3339).expect("created");
         let job = new_control_job_at(
             ControlJobParams {
@@ -981,7 +982,7 @@ mod tests {
         .with_name("vip invoice")
         .with_priority(HIGH_PRIORITY);
         queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, job)
+            .assign_control_job(CONTROL_QUEUE_NAME, job)
             .await
             .expect("assign job");
 
@@ -1207,8 +1208,7 @@ mod tests {
     #[tokio::test]
     async fn runtime_taskman_inspector_uses_one_manager_id_namespace() {
         let shared_queue = Arc::new(InMemoryTaskQueue::new());
-        let control_queue =
-            PersistentPaymentControlJobQueue::from_task_queue((*shared_queue).clone());
+        let control_queue = PersistentControlJobQueue::from_task_queue((*shared_queue).clone());
         let created = OffsetDateTime::parse("2026-05-21T10:00:00Z", &Rfc3339).expect("created");
         let control_job = new_control_job_at(
             ControlJobParams {
@@ -1225,7 +1225,7 @@ mod tests {
             created,
         );
         control_queue
-            .assign_payment_control_job(CONTROL_QUEUE_NAME, control_job)
+            .assign_control_job(CONTROL_QUEUE_NAME, control_job)
             .await
             .expect("assign control job");
 
diff --git a/crates/openplotva-app/src/runtime_virtual_dialog.rs b/crates/openplotva-app/src/runtime_virtual_dialog.rs
index 5b00e213..9cabeb43 100644
--- a/crates/openplotva-app/src/runtime_virtual_dialog.rs
+++ b/crates/openplotva-app/src/runtime_virtual_dialog.rs
@@ -1029,6 +1029,7 @@ mod tests {
         let result = toolbox
             .draw_image(DrawRequest {
                 context: openplotva_dialog::ToolContext {
+                    invocation_id: None,
                     chat_id: -91,
                     message_id: 7,
                     ..openplotva_dialog::ToolContext::default()
@@ -1057,6 +1058,7 @@ mod tests {
     async fn safe_memory_returns_mutation_ids_and_enforces_scope() {
         let toolbox = RuntimeVirtualSafeToolbox::new(Arc::new(ToolboxStub));
         let context = openplotva_dialog::ToolContext {
+            invocation_id: None,
             chat_id: -91,
             user_id: -92,
             ..Default::default()
diff --git a/crates/openplotva-app/src/settings.rs b/crates/openplotva-app/src/settings.rs
index 5736fbad..ef9e8ce3 100644
--- a/crates/openplotva-app/src/settings.rs
+++ b/crates/openplotva-app/src/settings.rs
@@ -67,10 +67,6 @@ const GROUP_SETTINGS_MEMBERSHIP_MAX_AGE_SECONDS: i64 = 5 * 60;
 pub type SettingsControlJobQueueFuture<'a, E> =
     Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
 
-/// Boxed future returned by settings taskman worker queue calls.
-pub type SettingsControlJobWorkerFuture<'a, T, E> =
-    Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>;
-
 /// Boxed future returned by group settings executor permission checks.
 pub type GroupSettingsControlJobFuture<'a, T, E> =
     Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>;
@@ -110,7 +106,7 @@ pub trait SettingsControlJobQueue {
 
 impl<T> SettingsControlJobQueue for T
 where
-    T: crate::payments::PaymentControlJobQueue + Sync,
+    T: crate::control_jobs::ControlJobQueue + Sync,
 {
     type Error = T::Error;
 
@@ -119,7 +115,7 @@ where
         queue_name: &'static str,
         job: StatelessJobItem,
     ) -> SettingsControlJobQueueFuture<'a, Self::Error> {
-        self.assign_payment_control_job(queue_name, job)
+        self.assign_control_job(queue_name, job)
     }
 }
 
@@ -169,71 +165,6 @@ where
     }
 }
 
-/// Queue/status boundary for settings-owned taskman control-job workers.
-pub trait SettingsControlJobWorkerQueue {
-    /// Error returned by the concrete queue implementation.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    fn dequeue_settings_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-    ) -> SettingsControlJobWorkerFuture<
-        'a,
-        Option<crate::payments::PaymentControlJobWorkItem>,
-        Self::Error,
-    >;
-
-    /// Finalize one settings-owned control job as completed.
-    fn complete_settings_control_job<'a>(
-        &'a self,
-        job_id: i64,
-    ) -> SettingsControlJobWorkerFuture<'a, (), Self::Error>;
-
-    /// Finalize one settings-owned control job as failed.
-    fn fail_settings_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> SettingsControlJobWorkerFuture<'a, (), Self::Error>;
-}
-
-impl<T> SettingsControlJobWorkerQueue for T
-where
-    T: crate::payments::SharedControlJobWorkerQueue + Sync,
-{
-    type Error = T::Error;
-
-    fn dequeue_settings_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-    ) -> SettingsControlJobWorkerFuture<
-        'a,
-        Option<crate::payments::PaymentControlJobWorkItem>,
-        Self::Error,
-    > {
-        self.dequeue_shared_control_job_matching(
-            queue_name,
-            "settings-control",
-            is_settings_control_job,
-        )
-    }
-
-    fn complete_settings_control_job<'a>(
-        &'a self,
-        job_id: i64,
-    ) -> SettingsControlJobWorkerFuture<'a, (), Self::Error> {
-        self.complete_shared_control_job(job_id)
-    }
-
-    fn fail_settings_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> SettingsControlJobWorkerFuture<'a, (), Self::Error> {
-        self.fail_shared_control_job(job_id, error)
-    }
-}
-
 pub trait GroupSettingsControlJobEffects {
     /// Error returned by permission checks.
     type Error: fmt::Display + Send + Sync + 'static;
@@ -1285,28 +1216,6 @@ pub enum SettingsControlJobExecution {
     NewMembersFollowup(NewMembersFollowupControlJobOutcome),
 }
 
-/// Result of one settings-owned taskman worker tick.
-#[derive(Clone, Debug, Default, Eq, PartialEq)]
-pub struct SettingsControlJobWorkerReport {
-    /// Whether a job was dequeued.
-    pub dequeued: bool,
-    /// Dequeued taskman job ID.
-    pub job_id: Option<i64>,
-    /// Settings executor result, when payload decoding succeeded.
-    pub execution: Option<SettingsControlJobExecution>,
-    /// The job was finalized as completed.
-    pub completed: bool,
-    /// The job was finalized as failed.
-    pub failed: bool,
-    /// Queue dequeue failed.
-    pub dequeue_error: Option<String>,
-    pub decode_error: Option<String>,
-    /// Executor returned a direct runtime error.
-    pub execution_error: Option<String>,
-    /// Completion/failure status write failed.
-    pub status_error: Option<String>,
-}
-
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub enum AdminChatSettingsCommandOutcome {
     NotAdminChatSettingsCommand,
@@ -1777,106 +1686,6 @@ where
     })
 }
 
-/// Process one settings-owned taskman control job, if available.
-pub async fn process_settings_control_job_once_at<Queue, GroupEffects, NewEffects, NextId>(
-    queue: &Queue,
-    dispatcher_queue: &DispatcherQueue,
-    group_effects: &GroupEffects,
-    new_members_effects: &NewEffects,
-    bot_username: &str,
-    mut next_virtual_id: NextId,
-) -> SettingsControlJobWorkerReport
-where
-    Queue: SettingsControlJobWorkerQueue + Sync,
-    GroupEffects: GroupSettingsControlJobEffects + Sync,
-    NewEffects: NewMembersFollowupControlJobEffects + Sync,
-    NextId: FnMut() -> String,
-{
-    let mut report = SettingsControlJobWorkerReport::default();
-    let item = match queue.dequeue_settings_control_job(CONTROL_QUEUE_NAME).await {
-        Ok(item) => item,
-        Err(error) => {
-            report.dequeue_error = Some(error.to_string());
-            return report;
-        }
-    };
-
-    let Some(item) = item else {
-        return report;
-    };
-    report.dequeued = true;
-    report.job_id = Some(item.id);
-
-    let params = match control_job_params_from_stateless_job(&item.job) {
-        Ok(params) => params,
-        Err(error) => {
-            let error = error.to_string();
-            report.decode_error = Some(error.clone());
-            mark_settings_control_job_failed(queue, item.id, &error, &mut report).await;
-            return report;
-        }
-    };
-
-    let execution = match params.data.kind {
-        ControlKind::GroupSettings => execute_group_settings_control_job_at(
-            dispatcher_queue,
-            group_effects,
-            &params,
-            bot_username,
-            &mut next_virtual_id,
-        )
-        .await
-        .map(SettingsControlJobExecution::GroupSettings),
-        ControlKind::NewMembersFollowup => execute_new_members_followup_control_job_at(
-            dispatcher_queue,
-            new_members_effects,
-            &params,
-            bot_username,
-            &mut next_virtual_id,
-        )
-        .await
-        .map(SettingsControlJobExecution::NewMembersFollowup),
-        kind => Ok(SettingsControlJobExecution::GroupSettings(
-            GroupSettingsControlJobOutcome::UnsupportedKind(kind),
-        )),
-    };
-
-    let execution = match execution {
-        Ok(execution) => execution,
-        Err(error) => {
-            let error = error.to_string();
-            report.execution_error = Some(error.clone());
-            mark_settings_control_job_failed(queue, item.id, &error, &mut report).await;
-            return report;
-        }
-    };
-
-    if let Some(error) = settings_control_job_failure_message(&execution) {
-        mark_settings_control_job_failed(queue, item.id, &error, &mut report).await;
-    } else {
-        match queue.complete_settings_control_job(item.id).await {
-            Ok(()) => report.completed = true,
-            Err(error) => report.status_error = Some(error.to_string()),
-        }
-    }
-    report.execution = Some(execution);
-    report
-}
-
-async fn mark_settings_control_job_failed<Queue>(
-    queue: &Queue,
-    job_id: i64,
-    error: &str,
-    report: &mut SettingsControlJobWorkerReport,
-) where
-    Queue: SettingsControlJobWorkerQueue + Sync,
-{
-    match queue.fail_settings_control_job(job_id, error).await {
-        Ok(()) => report.failed = true,
-        Err(error) => report.status_error = Some(error.to_string()),
-    }
-}
-
 pub(crate) fn settings_control_job_failure_message(
     execution: &SettingsControlJobExecution,
 ) -> Option<String> {
@@ -1903,14 +1712,6 @@ pub(crate) fn settings_control_job_failure_message(
     }
 }
 
-fn is_settings_control_job(job: &StatelessJobItem) -> bool {
-    job.data.job_type == openplotva_taskman::JobType::Control
-        && matches!(
-            job.data.control_data.as_ref().map(|data| data.kind),
-            Some(ControlKind::GroupSettings | ControlKind::NewMembersFollowup)
-        )
-}
-
 #[must_use]
 pub fn group_settings_control_job_from_update_at(
     update: &TelegramUpdate,
@@ -3552,6 +3353,41 @@ fn user_full_name(user: &TelegramUser) -> String {
 
 #[cfg(test)]
 mod tests {
+    async fn run_settings_on_shared_worker<
+        Group: GroupSettingsControlJobEffects + Sync,
+        New: super::NewMembersFollowupControlJobEffects + Sync,
+        Id: Fn() -> String + Sync,
+    >(
+        queue: &crate::control_jobs::InMemoryControlJobQueue,
+        dispatcher: &DispatcherQueue,
+        group: &Group,
+        new: &New,
+        bot_username: &str,
+        next_id: Id,
+    ) -> crate::control_jobs::ControlJobWorkerReport {
+        use crate::control_jobs::test_support::UnusedControlPorts;
+        let ports = UnusedControlPorts;
+        let registry = crate::control_jobs::AppControlJobExecutors {
+            payment_store: &ports,
+            payment_effects: &ports,
+            dispatcher_queue: dispatcher,
+            group_settings_effects: group,
+            new_members_effects: new,
+            bot_username,
+            next_virtual_id: &next_id,
+            translator: &ports,
+            translation_effects: &ports,
+            member_effects: &ports,
+            checkin_effects: &ports,
+        };
+        crate::control_jobs::process_control_job_once_at(
+            queue,
+            &registry,
+            OffsetDateTime::now_utc(),
+        )
+        .await
+    }
+
     use std::{
         env,
         error::Error,
@@ -3583,7 +3419,8 @@ mod tests {
         RandomDialogRng, RandomDialogSettingsStore, RandomObscenifiedTextPlan,
     };
     use crate::help::{HelpBotIdentity, HelpCommandUpdateHandler, HelpDispatcherEffects};
-    use crate::payments::{InMemoryPaymentControlJobQueue, InMemoryPaymentControlJobStatus};
+
+    use crate::control_jobs::{InMemoryControlJobQueue, InMemoryControlJobStatus};
     use crate::updates::{
         TelegramFileMetadataStoreFuture, UpdateHandler, UpdateStateStore, UpdateStateStoreFuture,
         process_update_with_state_store_at,
@@ -3605,14 +3442,14 @@ mod tests {
         handle_admin_chat_settings_command_update_or_else_at,
         handle_group_settings_command_update_at, handle_new_members_followup_update_at,
         handle_private_settings_command_update, handle_settings_update_or_else_at,
-        new_members_followup_control_job_from_update_at, process_settings_control_job_once_at,
-        sync_chat_admins_with_cache, sync_chat_admins_with_sources,
+        new_members_followup_control_job_from_update_at, sync_chat_admins_with_cache,
+        sync_chat_admins_with_sources,
     };
 
     #[tokio::test]
     async fn settings_control_jobs_can_use_shared_persistent_control_queue()
     -> Result<(), Box<dyn Error>> {
-        let queue = InMemoryPaymentControlJobQueue::new();
+        let queue = InMemoryControlJobQueue::new();
         let job = new_control_job_at(
             ControlJobParams {
                 chat_id: -10042,
@@ -3649,22 +3486,17 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn settings_control_worker_skips_payment_job_and_completes_group_settings_job()
-    -> Result<(), Box<dyn Error>> {
-        let queue = InMemoryPaymentControlJobQueue::new();
+    async fn shared_control_worker_completes_group_settings_job() -> Result<(), Box<dyn Error>> {
+        let queue = InMemoryControlJobQueue::new();
         let dispatcher_queue = DispatcherQueue::new(DispatcherConfig::default());
         let group_effects = GroupSettingsEffectsStub::allowing();
         let new_members_effects = NewMembersFollowupEffectsStub::blocked();
-        let payment_job = settings_test_control_job(ControlKind::VipInvoice, "vip invoice");
         let settings_job = settings_test_control_job(ControlKind::GroupSettings, "group settings");
-        queue
-            .assign_settings_control_job(CONTROL_QUEUE_NAME, payment_job)
-            .await?;
         queue
             .assign_settings_control_job(CONTROL_QUEUE_NAME, settings_job.clone())
             .await?;
 
-        let report = process_settings_control_job_once_at(
+        let report = run_settings_on_shared_worker(
             &queue,
             &dispatcher_queue,
             &group_effects,
@@ -3675,22 +3507,20 @@ mod tests {
         .await;
 
         assert!(report.dequeued);
-        assert_eq!(report.job_id, Some(2));
+        assert_eq!(report.job_id, Some(1));
         assert_eq!(
             report.execution,
-            Some(SettingsControlJobExecution::GroupSettings(
-                super::GroupSettingsControlJobOutcome::SentLink
+            Some(crate::control_jobs::ControlJobExecution::Settings(
+                SettingsControlJobExecution::GroupSettings(
+                    super::GroupSettingsControlJobOutcome::SentLink
+                )
             ))
         );
         assert!(report.completed);
         assert!(!report.failed);
         let snapshot = queue.snapshot();
-        assert_eq!(snapshot[0].status, InMemoryPaymentControlJobStatus::Pending);
-        assert_eq!(
-            snapshot[1].status,
-            InMemoryPaymentControlJobStatus::Completed
-        );
-        assert_eq!(snapshot[1].job, settings_job);
+        assert_eq!(snapshot[0].status, InMemoryControlJobStatus::Completed);
+        assert_eq!(snapshot[0].job, settings_job);
         assert_eq!(group_effects.synced_admin_chats(), vec![-10042]);
         let item = dispatcher_queue
             .dequeue_immediate()
@@ -3702,7 +3532,7 @@ mod tests {
     #[tokio::test]
     async fn settings_control_worker_completes_new_members_followup_job()
     -> Result<(), Box<dyn Error>> {
-        let queue = InMemoryPaymentControlJobQueue::new();
+        let queue = InMemoryControlJobQueue::new();
         let dispatcher_queue = DispatcherQueue::new(DispatcherConfig::default());
         let group_effects = GroupSettingsEffectsStub::allowing();
         let new_members_effects = NewMembersFollowupEffectsStub::blocked();
@@ -3716,7 +3546,7 @@ mod tests {
             .assign_settings_control_job(CONTROL_QUEUE_NAME, job.clone())
             .await?;
 
-        let report = process_settings_control_job_once_at(
+        let report = run_settings_on_shared_worker(
             &queue,
             &dispatcher_queue,
             &group_effects,
@@ -3729,18 +3559,17 @@ mod tests {
         assert_eq!(report.job_id, Some(1));
         assert_eq!(
             report.execution,
-            Some(SettingsControlJobExecution::NewMembersFollowup(
-                super::NewMembersFollowupControlJobOutcome::Completed {
-                    unblock_notice_queued: true
-                }
+            Some(crate::control_jobs::ControlJobExecution::Settings(
+                SettingsControlJobExecution::NewMembersFollowup(
+                    super::NewMembersFollowupControlJobOutcome::Completed {
+                        unblock_notice_queued: true
+                    }
+                )
             ))
         );
         assert!(report.completed);
         let snapshot = queue.snapshot();
-        assert_eq!(
-            snapshot[0].status,
-            InMemoryPaymentControlJobStatus::Completed
-        );
+        assert_eq!(snapshot[0].status, InMemoryControlJobStatus::Completed);
         assert_eq!(snapshot[0].job, job);
         assert_eq!(new_members_effects.enabled_chats(), vec![-10042]);
         let item = dispatcher_queue
@@ -5069,7 +4898,7 @@ mod tests {
 
         let settings_dispatcher = Arc::new(DispatcherQueue::new(DispatcherConfig::default()));
         let help_dispatcher = Arc::new(DispatcherQueue::new(DispatcherConfig::default()));
-        let control_queue = Arc::new(InMemoryPaymentControlJobQueue::new());
+        let control_queue = Arc::new(InMemoryControlJobQueue::new());
         let terminal = Arc::new(UpdateHandlerStub::default());
         let dialog_terminal = Arc::new(DialogMessageUpdateHandler::new(
             Arc::new(SettingsDialogSchedulerStub),
@@ -5093,7 +4922,7 @@ mod tests {
         let help_effects = Arc::new(HelpDispatcherEffects::new(
             telegram,
             Arc::clone(&settings_handler),
-            Arc::new(crate::rich::MockRichSender::default()),
+            crate::rich::unreachable_outbox(),
         ));
         let help_handler = HelpCommandUpdateHandler::new(
             HelpBotIdentity {
@@ -5190,7 +5019,7 @@ mod tests {
         assert_eq!(update_queue.len().await?, 3);
 
         let dispatcher = Arc::new(DispatcherQueue::new(DispatcherConfig::default()));
-        let control_queue = Arc::new(InMemoryPaymentControlJobQueue::new());
+        let control_queue = Arc::new(InMemoryControlJobQueue::new());
         let terminal = Arc::new(UpdateHandlerStub::default());
         let dialog_terminal = Arc::new(DialogMessageUpdateHandler::new(
             Arc::new(SettingsDialogSchedulerStub),
diff --git a/crates/openplotva-app/src/task_queue.rs b/crates/openplotva-app/src/task_queue.rs
index ba5272dc..432bc118 100644
--- a/crates/openplotva-app/src/task_queue.rs
+++ b/crates/openplotva-app/src/task_queue.rs
@@ -1,4 +1,6 @@
 //! App-owned durable task queue runtime for non-control taskman work.
+use crate::{RuntimeWorkerGroup, RuntimeWorkerPhase, RuntimeWorkerStops, wait_for_runtime_stop};
+use openplotva_server::ReadinessCheck;
 
 use std::{
     collections::BTreeMap,
@@ -891,6 +893,184 @@ where
     report
 }
 
+pub(crate) struct SharedTaskQueueMaintenanceConfig {
+    pub(crate) recovery_interval: Duration,
+    pub(crate) cleanup_interval: Duration,
+    pub(crate) completed_retention: time::Duration,
+    pub(crate) placeholder_cleanup_interval: Duration,
+    pub(crate) placeholder_max_age: Duration,
+}
+
+pub(crate) fn build_shared_task_queue_maintenance_group(
+    runtime: &SharedTaskQueueRuntime,
+    purge_store: openplotva_storage::PostgresTaskQueueStore,
+    placeholder_effects: openplotva_telegram::TelegramClient,
+    config: SharedTaskQueueMaintenanceConfig,
+    stops: &RuntimeWorkerStops,
+) -> (RuntimeWorkerGroup, Vec<ReadinessCheck>) {
+    let SharedTaskQueueMaintenanceConfig {
+        recovery_interval,
+        cleanup_interval,
+        completed_retention,
+        placeholder_cleanup_interval,
+        placeholder_max_age,
+    } = config;
+    let mut workers = RuntimeWorkerGroup::new(RuntimeWorkerPhase::Processor);
+    let mut readiness = Vec::with_capacity(6);
+
+    let db_journal = runtime
+        .db_journal()
+        .expect("Postgres taskman runtime should have a DB journal");
+    let db_sync_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
+    workers.register(
+        "shared-task-queue-db-sync",
+        tokio::spawn(async move {
+            let report = run_task_queue_db_sync_worker_until(
+                db_journal,
+                wait_for_runtime_stop(db_sync_stop),
+            )
+            .await;
+
+            tracing::info!(?report, "shared taskman Postgres sync worker stopped");
+        }),
+    );
+    readiness.push(ReadinessCheck::ok(
+        "shared_task_queue_postgres_sync",
+        format!(
+            "Postgres sync after {}s dirty window or {} mutations",
+            TASK_QUEUE_DB_SYNC_INTERVAL.as_secs(),
+            TASK_QUEUE_DB_SYNC_MUTATION_THRESHOLD
+        ),
+    ));
+
+    let recovery_runtime = runtime.clone();
+    let recovery_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
+    workers.register(
+        "shared-task-queue-recovery",
+        tokio::spawn(async move {
+            let report = run_shared_task_queue_recovery_worker_until(
+                recovery_runtime,
+                recovery_interval,
+                wait_for_runtime_stop(recovery_stop),
+            )
+            .await;
+
+            tracing::info!(?report, "shared taskman recovery worker stopped");
+        }),
+    );
+    readiness.push(ReadinessCheck::ok(
+        "shared_task_queue_recovery",
+        format!(
+            "stale processing recovery every {}s",
+            recovery_interval.as_secs()
+        ),
+    ));
+
+    let cleanup_runtime = runtime.clone();
+    let cleanup_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
+    workers.register(
+        "shared-task-queue-terminal-cleanup",
+        tokio::spawn(async move {
+            let report = run_shared_task_queue_terminal_cleanup_worker_until(
+                cleanup_runtime,
+                cleanup_interval,
+                FINISHED_JOB_MEMORY_RETENTION,
+                wait_for_runtime_stop(cleanup_stop),
+            )
+            .await;
+
+            tracing::info!(?report, "shared taskman terminal cleanup worker stopped");
+        }),
+    );
+    readiness.push(ReadinessCheck::ok(
+        "shared_task_queue_terminal_cleanup",
+        format!(
+            "finished-job eviction from memory every {}s, kept {}m",
+            cleanup_interval.as_secs(),
+            FINISHED_JOB_MEMORY_RETENTION.whole_minutes()
+        ),
+    ));
+
+    let purge_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
+    workers.register(
+        "shared-task-queue-postgres-purge",
+        tokio::spawn(async move {
+            let report = run_shared_task_queue_db_purge_worker_until(
+                purge_store,
+                cleanup_interval,
+                completed_retention,
+                wait_for_runtime_stop(purge_stop),
+            )
+            .await;
+
+            tracing::info!(?report, "shared taskman Postgres purge worker stopped");
+        }),
+    );
+    readiness.push(ReadinessCheck::ok(
+        "shared_task_queue_postgres_purge",
+        format!(
+            "Postgres purge every {}s, finished jobs kept {}d, deleted jobs {}d",
+            cleanup_interval.as_secs(),
+            completed_retention.whole_days() * 2,
+            completed_retention.whole_days()
+        ),
+    ));
+
+    let stuck_runtime = runtime.clone();
+    let stuck_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
+    workers.register(
+        "shared-task-queue-stuck-cleanup",
+        tokio::spawn(async move {
+            let report = run_shared_task_queue_stuck_cleanup_worker_until(
+                stuck_runtime,
+                SHARED_TASK_QUEUE_STUCK_SCAN_INTERVAL,
+                SHARED_TASK_QUEUE_STUCK_DURATION,
+                wait_for_runtime_stop(stuck_stop),
+            )
+            .await;
+
+            tracing::info!(?report, "shared taskman stuck-job cleanup worker stopped");
+        }),
+    );
+    readiness.push(ReadinessCheck::ok(
+        "shared_task_queue_stuck_cleanup",
+        format!(
+            "stuck-job cleanup every {}s, stuck after {}s",
+            SHARED_TASK_QUEUE_STUCK_SCAN_INTERVAL.as_secs(),
+            SHARED_TASK_QUEUE_STUCK_DURATION.as_secs()
+        ),
+    ));
+
+    let placeholder_runtime = runtime.clone();
+    let placeholder_stop = stops.subscribe(RuntimeWorkerPhase::Processor);
+    workers.register(
+        "shared-task-queue-placeholder-cleanup",
+        tokio::spawn(async move {
+            let report = run_shared_task_queue_placeholder_cleanup_worker_until(
+                placeholder_runtime,
+                placeholder_effects,
+                placeholder_cleanup_interval,
+                placeholder_max_age,
+                Duration::from_secs(1),
+                wait_for_runtime_stop(placeholder_stop),
+            )
+            .await;
+
+            tracing::info!(?report, "shared taskman placeholder cleanup worker stopped");
+        }),
+    );
+    readiness.push(ReadinessCheck::ok(
+        "shared_task_queue_placeholder_cleanup",
+        format!(
+            "placeholder cleanup every {}s, max age {}s",
+            placeholder_cleanup_interval.as_secs(),
+            placeholder_max_age.as_secs()
+        ),
+    ));
+
+    (workers, readiness)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/openplotva-app/src/telegram_outbox.rs b/crates/openplotva-app/src/telegram_outbox.rs
index da7ae453..aeb4fb1b 100644
--- a/crates/openplotva-app/src/telegram_outbox.rs
+++ b/crates/openplotva-app/src/telegram_outbox.rs
@@ -5,6 +5,68 @@
 //! never replayed automatically: lease recovery moves it to `ambiguous` and an
 //! idempotent terminal reaction is queued instead.
 
+/// Identity returned after all outbound parts were accepted by one queue.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct QueuedBatchReceipt {
+    pub batch_id: String,
+    pub operation_ids: Vec<String>,
+    delivery: QueuedDelivery,
+    delivery_complete: bool,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum QueuedDelivery {
+    Dispatcher,
+    DurableOutbox,
+}
+
+impl QueuedBatchReceipt {
+    pub(crate) fn dispatcher(batch_id: String, operation_ids: Vec<String>) -> Self {
+        Self {
+            batch_id,
+            operation_ids,
+            delivery: QueuedDelivery::Dispatcher,
+            delivery_complete: false,
+        }
+    }
+
+    pub(crate) fn durable_outbox(
+        batch_id: String,
+        operation_ids: Vec<String>,
+        delivery_complete: bool,
+    ) -> Self {
+        Self {
+            batch_id,
+            operation_ids,
+            delivery: QueuedDelivery::DurableOutbox,
+            delivery_complete,
+        }
+    }
+
+    /// Whether taskman must wait for real Telegram receipts before completion.
+    #[must_use]
+    pub fn requires_delivery_wait(&self) -> bool {
+        self.delivery == QueuedDelivery::DurableOutbox
+    }
+
+    /// Whether every durable part already has a real Telegram receipt.
+    #[must_use]
+    pub fn delivery_complete(&self) -> bool {
+        self.requires_delivery_wait() && self.delivery_complete
+    }
+}
+
+pub(crate) fn telegram_outbox_ordering_key(
+    bot_id: i64,
+    chat_id: i64,
+    thread_id: Option<i32>,
+) -> String {
+    format!(
+        "dialog:{bot_id}:{chat_id}:{}",
+        thread_id.unwrap_or_default()
+    )
+}
+
 use std::{
     convert::Infallible,
     fmt,
@@ -159,6 +221,9 @@ pub struct RunAwareTelegramOutboxJobResolver {
     jobs: SharedTaskQueueRuntime,
     runs: crate::runtime_llm_runs::RuntimeLlmRunBuffer,
     gradius: PostgresGradiusAdStore,
+    songs: openplotva_storage::PostgresGeneratedSongStore,
+    outbox: PostgresTelegramOutboxStore,
+    reactions: Option<crate::reactions::GenerationReactions>,
 }
 
 impl RunAwareTelegramOutboxJobResolver {
@@ -167,11 +232,16 @@ impl RunAwareTelegramOutboxJobResolver {
         jobs: SharedTaskQueueRuntime,
         runs: crate::runtime_llm_runs::RuntimeLlmRunBuffer,
         gradius: PostgresGradiusAdStore,
+        outbox: PostgresTelegramOutboxStore,
+        reactions: Option<crate::reactions::GenerationReactions>,
     ) -> Self {
         Self {
             jobs,
             runs,
             gradius,
+            songs: openplotva_storage::PostgresGeneratedSongStore::new(outbox.pool().clone()),
+            outbox,
+            reactions,
         }
     }
 }
@@ -196,7 +266,56 @@ impl TelegramOutboxJobResolver for RunAwareTelegramOutboxJobResolver {
                     .await
             }
             .map_err(|error| error.to_string())?;
+            let music = batch_id.ends_with(&format!(
+                ":{}",
+                crate::music_jobs::music_delivery_source(job_id)
+            ));
+            if music {
+                let message_id = self
+                    .songs
+                    .link_delivery_receipts(job_id, batch_id)
+                    .await
+                    .map_err(|error| error.to_string())?;
+                self.jobs
+                    .queue()
+                    .update_job_result_message(job_id, Some(message_id))
+                    .map_err(|error| error.to_string())?;
+            }
+            if batch_id.ends_with(&format!(
+                ":{}",
+                crate::checkin::checkin_delivery_source(job_id)
+            )) {
+                let message_id = self
+                    .outbox
+                    .confirmed_message_id(batch_id, job_id)
+                    .await
+                    .map_err(|error| error.to_string())?
+                    .and_then(|id| i32::try_from(id).ok())
+                    .ok_or_else(|| "check-in delivery has no confirmed message ID".to_owned())?;
+                self.jobs
+                    .queue()
+                    .update_job_result_message(job_id, Some(message_id))
+                    .map_err(|error| error.to_string())?;
+            }
             self.jobs.complete_job(job_id, batch_id).await?;
+            if music && let Some(reactions) = &self.reactions {
+                let target = self.jobs.queue().inspect_records(|records| {
+                    records
+                        .iter()
+                        .find(|record| record.id == job_id)
+                        .and_then(|record| {
+                            openplotva_taskman::music_gen_job_params_from_stateless_job(&record.job)
+                                .ok()
+                        })
+                        .map(|params| crate::reactions::GenerationReactionTarget {
+                            chat_id: params.chat_id,
+                            message_id: params.message_id,
+                        })
+                });
+                if let Some(target) = target {
+                    reactions.clear(target).await;
+                }
+            }
             self.runs.mark_job_delivered(job_id);
             if gradius_delivered {
                 tracing::info!(
@@ -1298,6 +1417,7 @@ async fn enqueue_ambiguity_reaction_fields(
     let batch_id = format!("{AMBIGUITY_REACTION_BATCH_PREFIX}{source_operation_id}");
     let queued = store
         .enqueue_batch(&TelegramOutboxBatchInput {
+            content_policy: openplotva_storage::TelegramOutboxContentPolicy::Immutable,
             batch_id,
             bot_id,
             chat_id: Some(chat_id),
@@ -1877,6 +1997,8 @@ mod tests {
             queue,
             crate::runtime_llm_runs::RuntimeLlmRunBuffer::new(4),
             ledger.clone(),
+            store.clone(),
+            None,
         );
         for (already_edited, reply_missing, generation_group, ephemeral) in [
             (false, false, false, false),
@@ -1941,6 +2063,47 @@ mod tests {
                     },
                 )
                 .await?;
+            let checkin_job_id = if already_edited {
+                let queue = resolver.jobs.queue();
+                let job_id = queue.assign(
+                    openplotva_taskman::CONTROL_QUEUE_NAME,
+                    openplotva_taskman::new_control_job_at(
+                        openplotva_taskman::ControlJobParams {
+                            chat_id,
+                            message_id: 76,
+                            user_id: 9_820_825_960,
+                            data: openplotva_taskman::ControlJobData {
+                                kind: openplotva_taskman::ControlKind::Checkin,
+                                ..Default::default()
+                            },
+                            user_full_name: "Test".into(),
+                            thread_id: None,
+                        },
+                        now,
+                    ),
+                );
+                queue
+                    .dequeue_matching(
+                        openplotva_taskman::CONTROL_QUEUE_NAME,
+                        "checkin-test",
+                        now,
+                        |_| true,
+                    )
+                    .expect("control job");
+                queue.wait_for_delivery(job_id)?;
+                resolver.jobs.durability_barrier(job_id).await?;
+                Some(job_id)
+            } else {
+                None
+            };
+            let batch_id = if let Some(job_id) = checkin_job_id {
+                format!(
+                    "gradius-utility:v1:7:{}",
+                    crate::checkin::checkin_delivery_source(job_id)
+                )
+            } else {
+                batch_id
+            };
             let method = if already_edited {
                 TelegramOutboundMethod::from(openplotva_telegram::EditRichMessage {
                     chat_id,
@@ -1968,13 +2131,14 @@ mod tests {
                 .enqueue_utility_ad(
                     opportunity_id,
                     &TelegramOutboxBatchInput {
+                        content_policy: openplotva_storage::TelegramOutboxContentPolicy::Immutable,
                         batch_id: batch_id.clone(),
                         bot_id: 7,
                         chat_id: Some(chat_id),
                         thread_id: None,
                         ordering_key: batch_id.clone(),
                         causation_update_id: None,
-                        dialog_job_id: None,
+                        dialog_job_id: checkin_job_id,
                         trigger_message_id: Some(77),
                         delivery_policy: if already_edited {
                             TelegramDeliveryPolicy::TargetIdempotent
@@ -2067,6 +2231,15 @@ mod tests {
                     .await?;
                 continue;
             }
+            if let Some(job_id) = checkin_job_id {
+                let records = resolver.jobs.queue().records();
+                let record = records
+                    .iter()
+                    .find(|record| record.id == job_id)
+                    .expect("checkin");
+                assert_eq!(record.status, openplotva_taskman::JobStatus::Completed);
+                assert_eq!(record.result_message_id, Some(77));
+            }
             assert!(shown.is_some());
             resolver.complete_unlinked_batch(&batch_id).await?;
             let repeated: Option<OffsetDateTime> =
@@ -2089,6 +2262,12 @@ mod tests {
                 .bind(chat_id)
                 .execute(&pool)
                 .await?;
+            if let Some(job_id) = checkin_job_id {
+                sqlx::query("DELETE FROM taskman_jobs WHERE id = $1")
+                    .bind(job_id)
+                    .execute(&pool)
+                    .await?;
+            }
         }
         Ok(())
     }
diff --git a/crates/openplotva-app/src/translate.rs b/crates/openplotva-app/src/translate.rs
index 77f160e2..1e0dd49e 100644
--- a/crates/openplotva-app/src/translate.rs
+++ b/crates/openplotva-app/src/translate.rs
@@ -1,5 +1,8 @@
 //! App-level fetcher translation command and control-job behavior.
 
+#[cfg(test)]
+use crate::control_jobs::ControlJobEnqueueFuture;
+use crate::control_jobs::ControlJobQueue;
 use std::{convert::Infallible, fmt, future::Future, pin::Pin, sync::Arc, time::Duration};
 
 use carapax::types::{
@@ -8,8 +11,8 @@ use carapax::types::{
     User as TelegramUser,
 };
 use openplotva_taskman::{
-    CONTROL_QUEUE_NAME, ControlJobData, ControlJobParams, ControlKind, HIGH_PRIORITY, JobType,
-    StatelessJobItem, control_job_params_from_stateless_job, new_control_job_at,
+    CONTROL_QUEUE_NAME, ControlJobData, ControlJobParams, ControlKind, HIGH_PRIORITY,
+    StatelessJobItem, new_control_job_at,
 };
 use openplotva_telegram::{
     ChatRef, DispatcherQueue, OutboundBuildError, ReplyMessageRef, RichMessageRequest,
@@ -31,14 +34,6 @@ const UNKNOWN_LANGUAGE_NOTICE_DELETE_AFTER: Duration = Duration::from_secs(120);
 const QUEUE_ERROR_NOTICE_DELETE_AFTER: Duration = Duration::from_secs(60);
 const QUEUE_ERROR_TEXT: &str = "❌ Не удалось поставить задачу в очередь.";
 
-/// Boxed future returned by translation control-job queue calls.
-pub type TranslateControlJobQueueFuture<'a, E> =
-    Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
-
-/// Boxed future returned by translation control-job worker queue calls.
-pub type TranslateControlJobWorkerFuture<'a, T, E> =
-    Pin<Box<dyn Future<Output = Result<T, E>> + Send + 'a>>;
-
 /// Boxed future returned by translation side effects.
 pub type TranslateEffectFuture<'a, E> = Pin<Box<dyn Future<Output = Result<(), E>> + Send + 'a>>;
 
@@ -56,97 +51,6 @@ pub trait TranslateSendPermission {
     fn can_send_translate_text(&self, chat: &TelegramChat) -> bool;
 }
 
-pub trait TranslateControlJobQueue {
-    /// Error returned by the concrete queue implementation.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    fn assign_translate_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-    ) -> TranslateControlJobQueueFuture<'a, Self::Error>;
-}
-
-impl<T> TranslateControlJobQueue for T
-where
-    T: crate::payments::PaymentControlJobQueue + Sync,
-{
-    type Error = T::Error;
-
-    fn assign_translate_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-        job: StatelessJobItem,
-    ) -> TranslateControlJobQueueFuture<'a, Self::Error> {
-        self.assign_payment_control_job(queue_name, job)
-    }
-}
-
-/// Queue/status boundary for translation-owned taskman control-job workers.
-pub trait TranslateControlJobWorkerQueue {
-    /// Error returned by the concrete queue implementation.
-    type Error: fmt::Display + Send + Sync + 'static;
-
-    fn dequeue_translate_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-    ) -> TranslateControlJobWorkerFuture<
-        'a,
-        Option<crate::payments::PaymentControlJobWorkItem>,
-        Self::Error,
-    >;
-
-    /// Finalize one translation control job as completed.
-    fn complete_translate_control_job<'a>(
-        &'a self,
-        job_id: i64,
-    ) -> TranslateControlJobWorkerFuture<'a, (), Self::Error>;
-
-    /// Finalize one translation control job as failed.
-    fn fail_translate_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> TranslateControlJobWorkerFuture<'a, (), Self::Error>;
-}
-
-impl<T> TranslateControlJobWorkerQueue for T
-where
-    T: crate::payments::SharedControlJobWorkerQueue + Sync,
-{
-    type Error = T::Error;
-
-    fn dequeue_translate_control_job<'a>(
-        &'a self,
-        queue_name: &'static str,
-    ) -> TranslateControlJobWorkerFuture<
-        'a,
-        Option<crate::payments::PaymentControlJobWorkItem>,
-        Self::Error,
-    > {
-        self.dequeue_shared_control_job_matching(
-            queue_name,
-            "translate-control",
-            is_translate_control_job,
-        )
-    }
-
-    fn complete_translate_control_job<'a>(
-        &'a self,
-        job_id: i64,
-    ) -> TranslateControlJobWorkerFuture<'a, (), Self::Error> {
-        self.complete_shared_control_job(job_id)
-    }
-
-    fn fail_translate_control_job<'a>(
-        &'a self,
-        job_id: i64,
-        error: &'a str,
-    ) -> TranslateControlJobWorkerFuture<'a, (), Self::Error> {
-        self.fail_shared_control_job(job_id, error)
-    }
-}
-
 pub trait TranslateEffects {
     /// Error returned by the concrete side-effect implementation.
     type Error: fmt::Display + Send + Sync + 'static;
@@ -930,28 +834,6 @@ pub enum TranslateControlJobOutcome {
     },
 }
 
-/// Result of one translation-owned taskman worker tick.
-#[derive(Clone, Debug, Default, Eq, PartialEq)]
-pub struct TranslateControlJobWorkerReport {
-    /// Whether a job was dequeued.
-    pub dequeued: bool,
-    /// Dequeued taskman job ID.
-    pub job_id: Option<i64>,
-    /// Translation executor result, when payload decoding succeeded.
-    pub execution: Option<TranslateControlJobOutcome>,
-    /// The job was finalized as completed.
-    pub completed: bool,
-    /// The job was finalized as failed.
-    pub failed: bool,
-    /// Queue dequeue failed.
-    pub dequeue_error: Option<String>,
-    pub decode_error: Option<String>,
-    /// Translation provider or executor error.
-    pub execution_error: Option<String>,
-    /// Completion/failure status write failed.
-    pub status_error: Option<String>,
-}
-
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct TranslationResult {
     /// Trimmed source text.
@@ -1019,7 +901,7 @@ impl<Permission, Queue, Effects, Next> UpdateHandler
     for TranslateCommandUpdateHandler<Permission, Queue, Effects, Next>
 where
     Permission: TranslateSendPermission + Send + Sync,
-    Queue: TranslateControlJobQueue + Send + Sync,
+    Queue: ControlJobQueue + Send + Sync,
     Effects: TranslateEffects + Send + Sync,
     Next: UpdateHandler + Send + Sync,
 {
@@ -1058,7 +940,7 @@ pub async fn handle_translate_command_update_or_else_at<
 ) -> Result<TranslateCommandOutcome, TranslateCommandError>
 where
     Permission: TranslateSendPermission + Sync,
-    Queue: TranslateControlJobQueue + Sync,
+    Queue: ControlJobQueue + Sync,
     Effects: TranslateEffects + Sync,
     HandleFn: FnOnce(TelegramUpdate) -> HandleFuture,
     HandleFuture: Future<Output = Result<(), HandleError>>,
@@ -1111,10 +993,7 @@ where
         }
     };
 
-    if let Err(error) = queue
-        .assign_translate_control_job(CONTROL_QUEUE_NAME, job)
-        .await
-    {
+    if let Err(error) = queue.assign_control_job(CONTROL_QUEUE_NAME, job).await {
         tracing::warn!(message = %error, "failed to assign translation control job");
         try_send_translate_notice(
             effects,
@@ -1221,94 +1100,6 @@ where
     }
 }
 
-/// Process one translation-owned taskman control job, if available.
-pub async fn process_translate_control_job_once_at<Queue, Translator, Effects>(
-    queue: &Queue,
-    translator: &Translator,
-    effects: &Effects,
-) -> TranslateControlJobWorkerReport
-where
-    Queue: TranslateControlJobWorkerQueue + Sync,
-    Translator: TextTranslator + Sync,
-    Effects: TranslateEffects + Sync,
-{
-    let mut report = TranslateControlJobWorkerReport::default();
-    let item = match queue
-        .dequeue_translate_control_job(CONTROL_QUEUE_NAME)
-        .await
-    {
-        Ok(item) => item,
-        Err(error) => {
-            report.dequeue_error = Some(error.to_string());
-            return report;
-        }
-    };
-
-    let Some(item) = item else {
-        return report;
-    };
-    report.dequeued = true;
-    report.job_id = Some(item.id);
-
-    let params = match control_job_params_from_stateless_job(&item.job) {
-        Ok(params) => params,
-        Err(error) => {
-            let error = error.to_string();
-            report.decode_error = Some(error.clone());
-            mark_translate_control_job_failed(queue, item.id, &error, &mut report).await;
-            return report;
-        }
-    };
-
-    if params.data.kind != ControlKind::Translate {
-        let error = format!(
-            "unsupported translate control job kind: {:?}",
-            params.data.kind
-        );
-        report.execution_error = Some(error.clone());
-        mark_translate_control_job_failed(queue, item.id, &error, &mut report).await;
-        return report;
-    }
-
-    match execute_translate_control_job(translator, effects, &params).await {
-        Ok(execution) => {
-            match queue.complete_translate_control_job(item.id).await {
-                Ok(()) => report.completed = true,
-                Err(error) => report.status_error = Some(error.to_string()),
-            }
-            report.execution = Some(execution);
-        }
-        Err(error) => {
-            let error = error.to_string();
-            report.execution_error = Some(error.clone());
-            mark_translate_control_job_failed(queue, item.id, &error, &mut report).await;
-        }
-    }
-    report
-}
-
-async fn mark_translate_control_job_failed<Queue>(
-    queue: &Queue,
-    job_id: i64,
-    error: &str,
-    report: &mut TranslateControlJobWorkerReport,
-) where
-    Queue: TranslateControlJobWorkerQueue + Sync,
-{
-    match queue.fail_translate_control_job(job_id, error).await {
-        Ok(()) => report.failed = true,
-        Err(error) => report.status_error = Some(error.to_string()),
-    }
-}
-
-fn is_translate_control_job(job: &StatelessJobItem) -> bool {
-    job.data.job_type == JobType::Control
-        && matches!(
-            job.data.control_data.as_ref().map(|data| data.kind),
-            Some(ControlKind::Translate)
-        )
-}
-
 #[must_use]
 pub fn translate_result_plan_from_control_job(
     params: &ControlJobParams,
@@ -1552,8 +1343,42 @@ async fn try_send_translate_notice<Effects>(
 
 #[cfg(test)]
 mod tests {
+    async fn run_translation_on_shared_worker<
+        Translator: TextTranslator + Sync,
+        Effects: TranslateEffects + Sync,
+    >(
+        queue: &crate::control_jobs::InMemoryControlJobQueue,
+        translator: &Translator,
+        effects: &Effects,
+    ) -> crate::control_jobs::ControlJobWorkerReport {
+        use crate::control_jobs::test_support::UnusedControlPorts;
+        let ports = UnusedControlPorts;
+        let dispatcher = openplotva_telegram::DispatcherQueue::new(Default::default());
+        let next_id = || "unused-translation-id".to_owned();
+        let registry = crate::control_jobs::AppControlJobExecutors {
+            payment_store: &ports,
+            payment_effects: &ports,
+            dispatcher_queue: &dispatcher,
+            group_settings_effects: &ports,
+            new_members_effects: &ports,
+            bot_username: "PlotvaBot",
+            next_virtual_id: &next_id,
+            translator,
+            translation_effects: effects,
+            member_effects: &ports,
+            checkin_effects: &ports,
+        };
+        crate::control_jobs::process_control_job_once_at(
+            queue,
+            &registry,
+            OffsetDateTime::now_utc(),
+        )
+        .await
+    }
+
     use super::*;
-    use crate::payments::{InMemoryPaymentControlJobQueue, InMemoryPaymentControlJobStatus};
+
+    use crate::control_jobs::{InMemoryControlJobQueue, InMemoryControlJobStatus};
     use crate::updates::{
         TelegramFileMetadataStoreFuture, UpdateHandler, UpdateStateStore, UpdateStateStoreFuture,
         process_update_with_state_store_at,
@@ -1838,26 +1663,26 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn translate_control_worker_skips_settings_job_and_completes_translate_job()
+    async fn shared_control_worker_completes_translate_job()
     -> Result<(), Box<dyn std::error::Error>> {
-        let queue = InMemoryPaymentControlJobQueue::new();
+        let queue = InMemoryControlJobQueue::new();
         let effects = EffectsStub::default();
         let translator = TranslatorStub::default();
-        let settings_job =
-            translate_test_control_job(ControlKind::GroupSettings, "group settings")?;
         let translate_job = sample_translate_job()?;
         queue
-            .assign_translate_control_job(CONTROL_QUEUE_NAME, settings_job)
-            .await?;
-        queue
-            .assign_translate_control_job(CONTROL_QUEUE_NAME, translate_job.clone())
+            .assign_control_job(CONTROL_QUEUE_NAME, translate_job.clone())
             .await?;
 
-        let report = process_translate_control_job_once_at(&queue, &translator, &effects).await;
+        let report = run_translation_on_shared_worker(&queue, &translator, &effects).await;
 
         assert!(report.dequeued);
-        assert_eq!(report.job_id, Some(2));
-        assert_eq!(report.execution, Some(TranslateControlJobOutcome::Sent));
+        assert_eq!(report.job_id, Some(1));
+        assert_eq!(
+            report.execution,
+            Some(crate::control_jobs::ControlJobExecution::Translate(
+                TranslateControlJobOutcome::Sent
+            ))
+        );
         assert!(report.completed);
         assert!(!report.failed);
         assert_eq!(
@@ -1866,12 +1691,8 @@ mod tests {
         );
         assert_eq!(effects.results().len(), 1);
         let snapshot = queue.snapshot();
-        assert_eq!(snapshot[0].status, InMemoryPaymentControlJobStatus::Pending);
-        assert_eq!(
-            snapshot[1].status,
-            InMemoryPaymentControlJobStatus::Completed
-        );
-        assert_eq!(snapshot[1].job, translate_job);
+        assert_eq!(snapshot[0].status, InMemoryControlJobStatus::Completed);
+        assert_eq!(snapshot[0].job, translate_job);
         Ok(())
     }
 
@@ -1890,7 +1711,7 @@ mod tests {
         let _: i64 = redis::cmd("DEL").arg(&key).query_async(&mut redis).await?;
 
         let state_store = UpdateStateStoreStub::default();
-        let control_queue = Arc::new(InMemoryPaymentControlJobQueue::new());
+        let control_queue = Arc::new(InMemoryControlJobQueue::new());
         let dispatcher_queue = Arc::new(DispatcherQueue::new(DispatcherConfig::default()));
         let effects = TranslateDispatcherEffects::new(Arc::clone(&dispatcher_queue))
             .with_virtual_id_factory(Arc::new(|| "translate-live-redis-vmsg-1".to_owned()));
@@ -1958,17 +1779,16 @@ mod tests {
         assert_eq!(data.target_lang, "en");
 
         let translator = TranslatorStub::default();
-        let worker_report = process_translate_control_job_once_at(
-            control_queue.as_ref(),
-            &translator,
-            effects.as_ref(),
-        )
-        .await;
+        let worker_report =
+            run_translation_on_shared_worker(control_queue.as_ref(), &translator, effects.as_ref())
+                .await;
         assert!(worker_report.dequeued);
         assert_eq!(worker_report.job_id, Some(1));
         assert_eq!(
             worker_report.execution,
-            Some(TranslateControlJobOutcome::Sent)
+            Some(crate::control_jobs::ControlJobExecution::Translate(
+                TranslateControlJobOutcome::Sent
+            ))
         );
         assert!(worker_report.completed);
         assert!(!worker_report.failed);
@@ -1978,7 +1798,7 @@ mod tests {
         );
         assert_eq!(
             control_queue.snapshot()[0].status,
-            InMemoryPaymentControlJobStatus::Completed
+            InMemoryControlJobStatus::Completed
         );
         let item = dispatcher_queue
             .dequeue_regular()
@@ -2412,18 +2232,6 @@ mod tests {
         Ok(*job)
     }
 
-    fn translate_test_control_job(
-        kind: ControlKind,
-        title: &str,
-    ) -> Result<StatelessJobItem, serde_json::Error> {
-        let mut job = sample_translate_job()?;
-        job.title = title.to_owned();
-        if let Some(data) = job.data.control_data.as_mut() {
-            data.kind = kind;
-        }
-        Ok(job)
-    }
-
     #[derive(Clone, Copy)]
     struct PermissionStub {
         allowed: bool,
@@ -2540,14 +2348,14 @@ mod tests {
         }
     }
 
-    impl TranslateControlJobQueue for QueueStub {
+    impl ControlJobQueue for QueueStub {
         type Error = io::Error;
 
-        fn assign_translate_control_job<'a>(
+        fn assign_control_job<'a>(
             &'a self,
             queue_name: &'static str,
             job: StatelessJobItem,
-        ) -> TranslateControlJobQueueFuture<'a, Self::Error> {
+        ) -> ControlJobEnqueueFuture<'a, Self::Error> {
             Box::pin(async move {
                 let mut state = self.lock();
                 state.assigned.push((queue_name, job));
diff --git a/crates/openplotva-app/src/vision.rs b/crates/openplotva-app/src/vision.rs
index 459b931b..797ddc10 100644
--- a/crates/openplotva-app/src/vision.rs
+++ b/crates/openplotva-app/src/vision.rs
@@ -370,6 +370,7 @@ where
 
 #[derive(Clone)]
 pub struct RoutedVisionCaptioner<DataUrl> {
+    config: AppConfig,
     walker: RoutedAttemptWalker,
     base_config: AifarmVisionCaptionerConfig,
     data_url: DataUrl,
@@ -386,14 +387,11 @@ impl<DataUrl> fmt::Debug for RoutedVisionCaptioner<DataUrl> {
 
 impl<DataUrl> RoutedVisionCaptioner<DataUrl> {
     #[must_use]
-    pub fn new(
-        walker: RoutedAttemptWalker,
-        base_config: AifarmVisionCaptionerConfig,
-        data_url: DataUrl,
-    ) -> Self {
+    pub fn new(walker: RoutedAttemptWalker, config: &AppConfig, data_url: DataUrl) -> Self {
         Self {
             walker,
-            base_config: base_config.with_defaults(),
+            config: config.clone(),
+            base_config: aifarm_vision_captioner_config_from_app_config(config),
             data_url,
         }
     }
@@ -412,6 +410,7 @@ where
         Box::pin(async move {
             let request_for_attempts = request.clone();
             let base_config = self.base_config.clone();
+            let config = self.config.clone();
             let data_url = self.data_url.clone();
             let result = self
                 .walker
@@ -423,10 +422,11 @@ where
                     move |attempt| {
                         let request = request_for_attempts.clone();
                         let base_config = base_config.clone();
+                        let config = config.clone();
                         let data_url = data_url.clone();
                         async move {
                             let captioner = AifarmVisionCaptioner::new(
-                                vision_config_for_attempt(base_config, &attempt),
+                                vision_config_for_attempt(&config, base_config, &attempt)?,
                                 data_url,
                             );
                             captioner.caption_telegram_file(request).await
@@ -447,37 +447,14 @@ where
 }
 
 fn vision_config_for_attempt(
+    app_config: &AppConfig,
     mut config: AifarmVisionCaptionerConfig,
     attempt: &RoutedAttempt,
-) -> AifarmVisionCaptionerConfig {
-    config.model = attempt.model_name.clone();
-    config.client.default_model = attempt.model_name.clone();
-    config.client.api_key = crate::dialog_runtime::resolve_provider_api_key(
-        attempt.provider_api_key_ref.as_deref(),
-        attempt.provider_api_key_encrypted.as_deref(),
-    )
-    .unwrap_or_default();
-    if let Some(endpoint) = attempt
-        .model_base_url
-        .as_deref()
-        .or(attempt.provider_endpoint.as_deref())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
-        if attempt.discovery_service_name.is_some() || attempt.discovery_endpoint_name.is_some() {
-            config.client.base_url = endpoint.to_owned();
-        } else {
-            config.client.direct_url =
-                openplotva_llm::aifarm::normalize_chat_completions_url(endpoint);
-        }
-    }
-    if let Some(service) = attempt.discovery_service_name.as_deref() {
-        config.client.service_name = service.to_owned();
-    }
-    if let Some(endpoint) = attempt.discovery_endpoint_name.as_deref() {
-        config.client.endpoint_name = endpoint.to_owned();
-    }
-    config.client.supports_cache_control = attempt.supports_cache_control();
+) -> Result<AifarmVisionCaptionerConfig, AifarmVisionCaptionerError> {
+    config.client =
+        crate::provider_transport::openai_client_for_attempt(app_config, attempt, config.client)
+            .map_err(|error| AifarmVisionCaptionerError::Provider(error.to_string()))?;
+    config.model.clone_from(&config.client.default_model);
     if let Some(max_tokens) = attempt.overrides.max_tokens
         && max_tokens > 0
     {
@@ -491,7 +468,7 @@ fn vision_config_for_attempt(
         .extra
         .get("enable_thinking")
         .and_then(serde_json::Value::as_bool);
-    config.with_defaults()
+    Ok(config.with_defaults())
 }
 
 fn vision_call_trace(is_video: bool) -> openplotva_llm::LlmCallTrace {
@@ -2130,6 +2107,7 @@ mod tests {
     fn routed_vision_attempt_resolves_direct_endpoint_key_and_thinking_override() {
         let path = std::env::var("PATH").expect("test process PATH");
         let attempt = RoutedAttempt {
+            protocol: Some(openplotva_llm::provider_schema::Protocol::OpenAiCompat),
             provider_id: 7,
             model_id: 11,
             provider_name: "vram-cloud".to_owned(),
@@ -2151,7 +2129,12 @@ mod tests {
             variant: None,
         };
 
-        let config = vision_config_for_attempt(AifarmVisionCaptionerConfig::default(), &attempt);
+        let config = vision_config_for_attempt(
+            &AppConfig::from_raw(openplotva_config::RawConfig::default()).expect("app config"),
+            AifarmVisionCaptionerConfig::default(),
+            &attempt,
+        )
+        .expect("config");
 
         assert_eq!(config.model, "vram.cloud/qwen3.6-35b-a3b");
         assert_eq!(
diff --git a/crates/openplotva-app/src/youtube.rs b/crates/openplotva-app/src/youtube.rs
index 4927e592..b8faca83 100644
--- a/crates/openplotva-app/src/youtube.rs
+++ b/crates/openplotva-app/src/youtube.rs
@@ -37,8 +37,6 @@ const INNERTUBE_PLAYER_URL: &str = "https://www.youtube.com/youtubei/v1/player";
 const INNERTUBE_CLIENT_NAME: &str = "ANDROID";
 const INNERTUBE_CLIENT_VERSION: &str = "20.10.38";
 const GEMINI_API_BASE_URL: &str = "https://generativelanguage.googleapis.com/v1beta";
-const OPENROUTER_MODEL_PREFIX: &str = "openrouter/";
-const OPENROUTER_CHAT_COMPLETIONS_URL: &str = "https://openrouter.ai/api/v1/chat/completions";
 const YOUTUBE_SUMMARY_TEMPERATURE: f64 = 0.3;
 const YOUTUBE_TRANSCRIPT_TIMEOUT: Duration = Duration::from_secs(45);
 
@@ -69,16 +67,6 @@ pub enum YouTubeSummaryError {
     Decode(String),
 }
 
-/// Error returned while building the runtime YouTube summarizer.
-#[derive(Debug, Error)]
-pub enum YouTubeSummaryBuildError {
-    #[error("{provider} API key is required")]
-    ProviderApiKeyRequired {
-        /// Provider that needs credentials.
-        provider: &'static str,
-    },
-}
-
 /// Runtime config for YouTube summary.
 #[derive(Clone, Debug, PartialEq)]
 pub struct YouTubeSummaryConfig {
@@ -125,102 +113,6 @@ impl YouTubeSummaryConfig {
     }
 }
 
-#[derive(Clone, Debug, PartialEq)]
-pub struct OpenAiCompatibleYouTubeSummaryConfig {
-    /// Provider API key.
-    pub api_key: String,
-    /// Provider model after the GenKit provider prefix.
-    pub model: String,
-    /// Chat completions endpoint.
-    pub direct_url: String,
-    /// Request timeout.
-    pub request_timeout: Duration,
-}
-
-impl OpenAiCompatibleYouTubeSummaryConfig {
-    fn with_defaults(mut self) -> Self {
-        if self.request_timeout.is_zero() {
-            self.request_timeout = Duration::from_secs(600);
-        }
-        self
-    }
-}
-
-#[derive(Clone)]
-pub enum RuntimeYouTubeSummarizer {
-    /// DB-routed summary generation with the existing transcript fetcher.
-    Routed(RoutedYouTubeSummarizer),
-    /// Direct Gemini/GoogleAI route.
-    Gemini(GeminiYouTubeSummarizer),
-    /// GenKit OpenAI-compatible plugin route.
-    OpenAiCompatible(OpenAiCompatibleYouTubeSummarizer),
-}
-
-impl RuntimeYouTubeSummarizer {
-    pub fn from_app_config(config: &AppConfig) -> Result<Option<Self>, YouTubeSummaryBuildError> {
-        let api_key = resolve_google_ai_key(&config.google_ai);
-        if api_key.trim().is_empty() {
-            return Ok(None);
-        }
-        let model = crate::memory_runtime::genkit_runtime_default_model(config);
-        let transcript = GeminiYouTubeSummarizer::new(YouTubeSummaryConfig {
-            api_key: api_key.clone(),
-            model: model.clone(),
-            request_timeout: Duration::from_secs(
-                config.llm.dialog.request_timeout_seconds.max(1) as u64
-            ),
-            ..YouTubeSummaryConfig::default()
-        });
-        if let Some(cfg) = openai_compatible_youtube_config_from_app_config(config, &model)? {
-            return Ok(Some(Self::OpenAiCompatible(
-                OpenAiCompatibleYouTubeSummarizer::new(transcript, cfg),
-            )));
-        }
-        Ok(Some(Self::Gemini(transcript)))
-    }
-
-    pub fn routed_from_app_config(
-        config: &AppConfig,
-        walker: RoutedAttemptWalker,
-    ) -> Result<Option<Self>, YouTubeSummaryBuildError> {
-        let api_key = resolve_google_ai_key(&config.google_ai);
-        if api_key.trim().is_empty() {
-            return Ok(None);
-        }
-        let transcript = GeminiYouTubeSummarizer::new(YouTubeSummaryConfig {
-            api_key,
-            model: crate::memory_runtime::genkit_runtime_default_model(config),
-            request_timeout: Duration::from_secs(
-                config.llm.dialog.request_timeout_seconds.max(1) as u64
-            ),
-            ..YouTubeSummaryConfig::default()
-        });
-        Ok(Some(Self::Routed(RoutedYouTubeSummarizer::new(
-            transcript, walker, config,
-        ))))
-    }
-
-    /// Human-readable provider label for readiness diagnostics.
-    #[must_use]
-    pub fn provider_label(&self) -> &'static str {
-        match self {
-            Self::Routed(_) => "routed provider",
-            Self::Gemini(_) => "direct Gemini",
-            Self::OpenAiCompatible(summarizer) => summarizer.provider,
-        }
-    }
-}
-
-impl YouTubeSummarizer for RuntimeYouTubeSummarizer {
-    fn summarize<'a>(&'a self, video: &'a str) -> YouTubeSummaryFuture<'a> {
-        match self {
-            Self::Routed(summarizer) => summarizer.summarize(video),
-            Self::Gemini(summarizer) => summarizer.summarize(video),
-            Self::OpenAiCompatible(summarizer) => summarizer.summarize(video),
-        }
-    }
-}
-
 #[derive(Clone)]
 pub struct RoutedYouTubeSummarizer {
     transcript: GeminiYouTubeSummarizer,
@@ -326,11 +218,6 @@ impl GeminiYouTubeSummarizer {
         Self { cfg, http }
     }
 
-    async fn run(&self, video: &str) -> Result<YouTubeSummaryResult, YouTubeSummaryError> {
-        let fetched = self.transcript_for_video(video).await?;
-        summary_result(self, fetched).await
-    }
-
     async fn transcript_for_video(
         &self,
         video: &str,
@@ -467,6 +354,7 @@ impl GeminiYouTubeSummarizer {
         &self,
         stage: YouTubeStage,
         payload: &str,
+        provider: &str,
     ) -> Result<String, YouTubeSummaryError> {
         let system = openplotva_prompts::read(stage.prompt_name())?;
         let request = youtube_summary_gemini_request(&system, payload, stage);
@@ -474,8 +362,8 @@ impl GeminiYouTubeSummarizer {
         let url = gemini_generate_url(&self.cfg.base_url, &model)?;
         let trace = YouTubeCallTrace::begin(
             YouTubeTraceTags {
-                provider: "genkit",
-                source: "youtube_gemini",
+                provider,
+                source: "youtube_routed",
                 request_kind: "gemini.generateContent",
             },
             &model,
@@ -501,128 +389,48 @@ impl GeminiYouTubeSummarizer {
     }
 }
 
-impl YouTubeSummaryModel for GeminiYouTubeSummarizer {
-    fn complete<'a>(&'a self, stage: YouTubeStage, payload: &'a str) -> YouTubeModelFuture<'a> {
-        Box::pin(self.generate(stage, payload))
-    }
-}
-
-impl YouTubeSummarizer for GeminiYouTubeSummarizer {
-    fn summarize<'a>(&'a self, video: &'a str) -> YouTubeSummaryFuture<'a> {
-        Box::pin(async move {
-            self.run(video)
-                .await
-                .map_err(|error| Box::new(error) as BoxedError)
-        })
-    }
-}
-
-#[derive(Clone)]
-pub struct OpenAiCompatibleYouTubeSummarizer {
-    transcript: GeminiYouTubeSummarizer,
-    cfg: OpenAiCompatibleYouTubeSummaryConfig,
-    provider: &'static str,
-    http: reqwest::Client,
-}
-
-impl OpenAiCompatibleYouTubeSummarizer {
-    /// Build with explicit transcript fetcher and OpenAI-compatible config.
-    #[must_use]
-    pub fn new(
-        transcript: GeminiYouTubeSummarizer,
-        cfg: OpenAiCompatibleYouTubeSummaryConfig,
-    ) -> Self {
-        let cfg = cfg.with_defaults();
-        let http = reqwest::Client::builder()
-            .redirect(reqwest::redirect::Policy::none())
-            .timeout(cfg.request_timeout)
-            .build()
-            .expect("OpenAI-compatible YouTube reqwest client configuration is valid");
-        let provider = if cfg.direct_url.contains("openrouter.ai") {
-            "openrouter"
-        } else {
-            "openai-compatible"
-        };
-        Self {
-            transcript,
-            cfg,
-            provider,
-            http,
-        }
-    }
-
-    async fn run(&self, video: &str) -> Result<YouTubeSummaryResult, YouTubeSummaryError> {
-        let fetched = self.transcript.transcript_for_video(video).await?;
-        summary_result(self, fetched).await
-    }
-
-    async fn generate(
-        &self,
-        stage: YouTubeStage,
-        payload: &str,
-    ) -> Result<String, YouTubeSummaryError> {
-        let system = openplotva_prompts::read(stage.prompt_name())?;
-        let request =
-            youtube_summary_openai_request(&self.cfg.model, &system, payload, stage, true);
-        let trace = YouTubeCallTrace::begin(
-            YouTubeTraceTags {
-                provider: self.provider,
-                source: "youtube_openai_compatible",
-                request_kind: "openai.chat.completions",
-            },
-            &self.cfg.model,
-            &request,
-        );
-        let sent = self
-            .http
-            .post(self.cfg.direct_url.trim())
-            .bearer_auth(self.cfg.api_key.trim())
-            .header(reqwest::header::CONTENT_TYPE, "application/json")
-            .json(&request)
-            .send()
-            .await;
-        let (status, body) = trace.read_response(sent).await?;
-        if !status.is_success() {
-            return Err(YouTubeSummaryError::Http(format!(
-                "HTTP {}: {}",
-                status.as_u16(),
-                String::from_utf8_lossy(&body).trim()
-            )));
-        }
-        decode_openai_text(&body)
-    }
-}
-
-impl YouTubeSummaryModel for OpenAiCompatibleYouTubeSummarizer {
-    fn complete<'a>(&'a self, stage: YouTubeStage, payload: &'a str) -> YouTubeModelFuture<'a> {
-        Box::pin(self.generate(stage, payload))
-    }
-}
-
-impl YouTubeSummarizer for OpenAiCompatibleYouTubeSummarizer {
-    fn summarize<'a>(&'a self, video: &'a str) -> YouTubeSummaryFuture<'a> {
-        Box::pin(async move {
-            self.run(video)
-                .await
-                .map_err(|error| Box::new(error) as BoxedError)
-        })
-    }
-}
-
 async fn generate_youtube_summary_with_attempt(
     config: &AppConfig,
     attempt: RoutedAttempt,
     stage: YouTubeStage,
     payload: &str,
 ) -> Result<String, YouTubeSummaryError> {
+    if attempt.protocol == Some(openplotva_llm::provider_schema::Protocol::Genkit) {
+        let (api_key, base_url) =
+            crate::provider_transport::gemini_endpoint_for_attempt(config, &attempt)
+                .map_err(|error| YouTubeSummaryError::Http(error.to_string()))?;
+        let summarizer = GeminiYouTubeSummarizer::new(YouTubeSummaryConfig {
+            api_key,
+            base_url,
+            model: attempt.model_name.clone(),
+            request_timeout: Duration::from_secs(
+                config.llm.dialog.request_timeout_seconds.max(1) as u64
+            ),
+            ..YouTubeSummaryConfig::default()
+        });
+        return summarizer
+            .generate(stage, payload, &attempt.provider_name)
+            .await;
+    }
     if routed_attempt_uses_discovery(&attempt) {
-        let client = AifarmHttpClient::new(youtube_farm_client_config(config, &attempt));
+        let client = AifarmHttpClient::new(youtube_farm_client_config(config, &attempt)?);
         return complete_youtube_stage_through_discovery(&client, &attempt, stage, payload).await;
     }
+    let client_config = crate::provider_transport::openai_client_for_attempt(
+        config,
+        &attempt,
+        AifarmClientConfig {
+            request_timeout: Duration::from_secs(
+                config.open_router.request_timeout_seconds.max(1) as u64
+            ),
+            ..AifarmClientConfig::default()
+        },
+    )
+    .map_err(|error| YouTubeSummaryError::Http(error.to_string()))?;
     let system = openplotva_prompts::read(stage.prompt_name())?;
-    let model = attempt.model_name.trim().to_owned();
+    let model = &client_config.default_model;
     let mut request = youtube_summary_openai_request(
-        &model,
+        model,
         &system,
         payload,
         stage,
@@ -631,16 +439,14 @@ async fn generate_youtube_summary_with_attempt(
     let gateway = GatewayRequestFields::from_overrides(&attempt.overrides.extra);
     request.provider = gateway.provider;
     request.reasoning = gateway.reasoning;
-    let endpoint = routed_attempt_endpoint(&attempt).ok_or_else(|| {
-        YouTubeSummaryError::Http("routed provider has no chat completions endpoint".to_owned())
-    })?;
-    let api_key = routed_attempt_api_key(config, &attempt).ok_or_else(|| {
-        YouTubeSummaryError::Http(format!(
-            "provider {} API key is not configured",
-            attempt.provider_name
-        ))
-    })?;
-    let timeout = routed_attempt_timeout(config, &attempt);
+    if client_config.direct_url.is_empty() {
+        return Err(YouTubeSummaryError::Http(
+            "routed provider has no chat completions endpoint".into(),
+        ));
+    }
+    let endpoint = &client_config.direct_url;
+    let api_key = &client_config.api_key;
+    let timeout = client_config.request_timeout;
     let http = reqwest::Client::builder()
         .redirect(reqwest::redirect::Policy::none())
         .timeout(timeout)
@@ -673,7 +479,7 @@ async fn generate_youtube_summary_with_attempt(
             source: "youtube_routed",
             request_kind: "openai.chat.completions",
         },
-        &model,
+        model,
         &request,
     );
     let sent = builder.send().await;
@@ -701,7 +507,9 @@ async fn generate_youtube_summary_with_attempt(
 }
 
 fn routed_attempt_uses_discovery(attempt: &RoutedAttempt) -> bool {
-    attempt.discovery_service_name.is_some() || attempt.discovery_endpoint_name.is_some()
+    let (service, endpoint) = attempt.discovery_names();
+    attempt.protocol == Some(openplotva_llm::provider_schema::Protocol::OpenAiCompat)
+        && (service.is_some() || endpoint.is_some())
 }
 
 /// Farm models answer through Discovery jobs, not a chat completions URL.
@@ -726,38 +534,29 @@ async fn complete_youtube_stage_through_discovery<T: AifarmHttpTransport>(
     decode_openai_text(&body)
 }
 
-fn youtube_farm_client_config(config: &AppConfig, attempt: &RoutedAttempt) -> AifarmClientConfig {
+fn youtube_farm_client_config(
+    config: &AppConfig,
+    attempt: &RoutedAttempt,
+) -> Result<AifarmClientConfig, YouTubeSummaryError> {
     let dialog = &config.llm.dialog;
     let seconds = |value: i32| Duration::from_secs(u64::try_from(value).unwrap_or(0));
-    AifarmClientConfig {
-        base_url: attempt
-            .model_base_url
-            .as_deref()
-            .or(attempt.provider_endpoint.as_deref())
-            .map(str::trim)
-            .filter(|endpoint| !endpoint.is_empty())
-            .map_or_else(|| config.llm.discovery.base_url.clone(), str::to_owned),
-        service_name: attempt
-            .discovery_service_name
-            .clone()
-            .unwrap_or_else(|| dialog.discovery_service_name.clone()),
-        endpoint_name: attempt
-            .discovery_endpoint_name
-            .clone()
-            .unwrap_or_else(|| dialog.discovery_endpoint_name.clone()),
-        api_key: routed_attempt_api_key(config, attempt).unwrap_or_default(),
-        request_timeout: seconds(dialog.request_timeout_seconds),
-        poll_interval: seconds(dialog.poll_interval_seconds),
-        task_timeout: seconds(dialog.task_timeout_seconds),
-        capacity_wait: seconds(dialog.aifarm_capacity_wait_seconds),
-        capacity_poll_interval: seconds(dialog.aifarm_capacity_poll_seconds),
-        default_model: attempt.model_name.trim().to_owned(),
-        runtime_hint: attempt.provider_runtime_hint.clone().unwrap_or_default(),
-        supports_message_name: attempt.supports_message_name(),
-        supports_cache_control: attempt.supports_cache_control(),
-        workload: AIFARM_WORKLOAD_SUMMARY.to_owned(),
-        ..AifarmClientConfig::default()
-    }
+    crate::provider_transport::openai_client_for_attempt(
+        config,
+        attempt,
+        AifarmClientConfig {
+            base_url: config.llm.discovery.base_url.clone(),
+            service_name: dialog.discovery_service_name.clone(),
+            endpoint_name: dialog.discovery_endpoint_name.clone(),
+            request_timeout: seconds(dialog.request_timeout_seconds),
+            poll_interval: seconds(dialog.poll_interval_seconds),
+            task_timeout: seconds(dialog.task_timeout_seconds),
+            capacity_wait: seconds(dialog.aifarm_capacity_wait_seconds),
+            capacity_poll_interval: seconds(dialog.aifarm_capacity_poll_seconds),
+            workload: AIFARM_WORKLOAD_SUMMARY.to_owned(),
+            ..AifarmClientConfig::default()
+        },
+    )
+    .map_err(|error| YouTubeSummaryError::Http(error.to_string()))
 }
 
 fn youtube_summary_farm_request(
@@ -941,66 +740,6 @@ fn youtube_trace_usage(response: &serde_json::Value) -> Option<DialogTraceUsage>
     })
 }
 
-fn routed_attempt_is_openrouter(attempt: &RoutedAttempt) -> bool {
-    attempt.provider_name.eq_ignore_ascii_case("openrouter")
-        || attempt
-            .provider_name
-            .eq_ignore_ascii_case("openrouter-free")
-        || attempt
-            .provider_endpoint
-            .as_deref()
-            .is_some_and(|endpoint| endpoint.contains("openrouter.ai"))
-        || attempt
-            .model_base_url
-            .as_deref()
-            .is_some_and(|endpoint| endpoint.contains("openrouter.ai"))
-}
-
-fn routed_attempt_endpoint(attempt: &RoutedAttempt) -> Option<String> {
-    attempt
-        .model_base_url
-        .as_deref()
-        .or(attempt.provider_endpoint.as_deref())
-        .filter(|endpoint| !endpoint.trim().is_empty())
-        .map(openplotva_llm::aifarm::normalize_chat_completions_url)
-}
-
-fn routed_attempt_api_key(config: &AppConfig, attempt: &RoutedAttempt) -> Option<String> {
-    if let Some(reference) = attempt
-        .provider_api_key_ref
-        .as_deref()
-        .filter(|reference| !reference.trim().is_empty())
-        && let Ok(value) = std::env::var(reference.trim())
-        && !value.trim().is_empty()
-    {
-        return Some(value);
-    }
-    if let Some(sealed) = attempt.provider_api_key_encrypted.as_deref() {
-        let master = std::env::var("MASTER_KEY").unwrap_or_default();
-        if let Ok(value) = openplotva_storage::llm_routing::open_key(&master, sealed)
-            && !value.trim().is_empty()
-        {
-            return Some(value);
-        }
-    }
-    if routed_attempt_is_openrouter(attempt) && !config.open_router.key.trim().is_empty() {
-        return Some(config.open_router.key.trim().to_owned());
-    }
-    None
-}
-
-fn routed_attempt_timeout(config: &AppConfig, attempt: &RoutedAttempt) -> Duration {
-    attempt
-        .provider_config
-        .get("timeout_ms")
-        .and_then(serde_json::Value::as_u64)
-        .map(Duration::from_millis)
-        .filter(|duration| !duration.is_zero())
-        .unwrap_or_else(|| {
-            Duration::from_secs(config.open_router.request_timeout_seconds.max(1) as u64)
-        })
-}
-
 fn youtube_summary_retryable(error: &YouTubeSummaryError) -> Option<FailureReason> {
     match error {
         YouTubeSummaryError::Http(message) => retryable_reason_from_message(message),
@@ -1008,37 +747,6 @@ fn youtube_summary_retryable(error: &YouTubeSummaryError) -> Option<FailureReaso
     }
 }
 
-fn openai_compatible_youtube_config_from_app_config(
-    config: &AppConfig,
-    model: &str,
-) -> Result<Option<OpenAiCompatibleYouTubeSummaryConfig>, YouTubeSummaryBuildError> {
-    let model = model.trim();
-    let (direct_url, api_key, model, request_timeout_seconds, provider) =
-        if let Some(model) = strip_prefix_fold(model, OPENROUTER_MODEL_PREFIX) {
-            (
-                OPENROUTER_CHAT_COMPLETIONS_URL,
-                config.open_router.key.trim().to_owned(),
-                model.trim().to_owned(),
-                config.open_router.request_timeout_seconds,
-                "openrouter",
-            )
-        } else {
-            return Ok(None);
-        };
-    if model.is_empty() {
-        return Ok(None);
-    }
-    if api_key.trim().is_empty() {
-        return Err(YouTubeSummaryBuildError::ProviderApiKeyRequired { provider });
-    }
-    Ok(Some(OpenAiCompatibleYouTubeSummaryConfig {
-        api_key,
-        model,
-        direct_url: direct_url.to_owned(),
-        request_timeout: Duration::from_secs(request_timeout_seconds.max(1) as u64),
-    }))
-}
-
 #[must_use]
 pub fn parse_youtube_video_id(input: &str) -> Option<String> {
     let value = input.trim();
@@ -2311,31 +2019,6 @@ mod tests {
         assert_eq!(summarizer.cfg.model, "googleai/gemini-2.5-flash");
     }
 
-    #[test]
-    fn provider_youtube_config_routes_openrouter_default_model() {
-        let config = AppConfig::from_raw(openplotva_config::RawConfig {
-            googleai_key: Some("google-key".to_owned()),
-            genkit_default_model: Some(" openrouter/openai/gpt-4.1-mini ".to_owned()),
-            openrouter_key: Some(" openrouter-key ".to_owned()),
-            openrouter_request_timeout_seconds: Some("333".to_owned()),
-            ..openplotva_config::RawConfig::default()
-        })
-        .expect("config");
-
-        let summarizer = RuntimeYouTubeSummarizer::from_app_config(&config)
-            .expect("build")
-            .expect("summary");
-
-        let RuntimeYouTubeSummarizer::OpenAiCompatible(summarizer) = summarizer else {
-            panic!("expected OpenAI-compatible route");
-        };
-        assert_eq!(summarizer.provider, "openrouter");
-        assert_eq!(summarizer.cfg.model, "openai/gpt-4.1-mini");
-        assert_eq!(summarizer.cfg.api_key, "openrouter-key");
-        assert_eq!(summarizer.cfg.direct_url, OPENROUTER_CHAT_COMPLETIONS_URL);
-        assert_eq!(summarizer.cfg.request_timeout, Duration::from_secs(333));
-    }
-
     #[test]
     fn youtube_trace_artifact_reads_openai_usage_and_http_errors() {
         let trace = YouTubeCallTrace::begin(
@@ -2421,6 +2104,7 @@ mod tests {
 
     fn farm_attempt() -> RoutedAttempt {
         RoutedAttempt {
+            protocol: Some(openplotva_llm::provider_schema::Protocol::OpenAiCompat),
             provider_id: 17,
             model_id: 502,
             provider_name: "farm-qwen".to_owned(),
@@ -2446,7 +2130,7 @@ mod tests {
         let attempt = farm_attempt();
         assert!(routed_attempt_uses_discovery(&attempt));
 
-        let client = youtube_farm_client_config(&config, &attempt);
+        let client = youtube_farm_client_config(&config, &attempt).expect("config");
 
         assert_eq!(client.base_url, config.llm.discovery.base_url);
         assert_eq!(client.service_name, "llm-qwen");
@@ -2462,7 +2146,9 @@ mod tests {
             ..farm_attempt()
         };
         assert_eq!(
-            youtube_farm_client_config(&config, &with_endpoint).base_url,
+            youtube_farm_client_config(&config, &with_endpoint)
+                .expect("config")
+                .base_url,
             "https://discovery.example.test"
         );
 
@@ -2471,7 +2157,9 @@ mod tests {
             ..farm_attempt()
         };
         assert!(
-            !youtube_farm_client_config(&config, &without_cache_control).supports_cache_control
+            !youtube_farm_client_config(&config, &without_cache_control)
+                .expect("config")
+                .supports_cache_control
         );
     }
 
@@ -2581,7 +2269,7 @@ mod tests {
             AifarmClientConfig {
                 base_url: "https://discovery.example.test".to_owned(),
                 poll_interval: Duration::from_millis(1),
-                ..youtube_farm_client_config(&config, &attempt)
+                ..youtube_farm_client_config(&config, &attempt).expect("config")
             },
             transport,
         );
@@ -2614,6 +2302,66 @@ mod tests {
         assert!(sent.get("chat_template_kwargs").is_none(), "{sent}");
     }
 
+    #[tokio::test]
+    async fn explicit_genkit_route_uses_gemini_with_selected_credentials_and_endpoint() {
+        use axum::{Json, Router, extract::State, http::HeaderMap, routing::post};
+        type Seen = Arc<std::sync::Mutex<Vec<(HeaderMap, serde_json::Value)>>>;
+        let seen: Seen = Arc::default();
+        let app = Router::new().route("/custom-gemini/models/gemini-fixture:generateContent", post(
+            |State(seen): State<Seen>, headers: HeaderMap, Json(body): Json<serde_json::Value>| async move {
+                seen.lock().expect("seen").push((headers, body));
+                Json(json!({"candidates":[{"content":{"parts":[{"text":"{\"summary\":\"ok\"}"}]}}]}))
+            }
+        )).with_state(Arc::clone(&seen));
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind");
+        let address = listener.local_addr().expect("address");
+        let server = tokio::spawn(async move {
+            axum::serve(listener, app).await.expect("serve");
+        });
+        let config = AppConfig::from_raw(Default::default()).expect("config");
+        let mut attempt = farm_attempt();
+        attempt.protocol = Some(openplotva_llm::provider_schema::Protocol::Genkit);
+        attempt.provider_name = "renamed-gemini-provider".into();
+        attempt.model_name = "googleai/gemini-fixture".into();
+        attempt.provider_endpoint = Some(format!("http://{address}/custom-gemini"));
+        attempt.provider_api_key_ref = Some("PATH".into());
+        assert!(!routed_attempt_uses_discovery(&attempt));
+        let result = generate_youtube_summary_with_attempt(
+            &config,
+            attempt,
+            YouTubeStage::Summary,
+            "0.5: hello",
+        )
+        .await;
+        server.abort();
+        assert_eq!(result.expect("Gemini summary"), "{\"summary\":\"ok\"}");
+        let seen = seen.lock().expect("seen");
+        assert_eq!(seen.len(), 1);
+        assert_eq!(
+            seen[0]
+                .0
+                .get("x-goog-api-key")
+                .expect("key")
+                .to_str()
+                .expect("key text"),
+            std::env::var("PATH").expect("PATH")
+        );
+        assert_eq!(seen[0].1["contents"][0]["parts"][0]["text"], "0.5: hello");
+    }
+
+    #[test]
+    fn discovery_selection_uses_model_overrides_and_ignores_blank_names() {
+        let mut attempt = farm_attempt();
+        attempt.discovery_service_name = None;
+        attempt.discovery_endpoint_name = None;
+        attempt.model_config = json!({"service_name":"from-model"});
+        assert!(routed_attempt_uses_discovery(&attempt));
+        attempt.model_config = json!({"service_name":"  ", "endpoint_name":""});
+        assert!(!routed_attempt_uses_discovery(&attempt));
+    }
+
     #[tokio::test]
     async fn openrouter_route_sends_the_model_id_as_stored() {
         use axum::{Json, Router, extract::State, routing::post};
diff --git a/crates/openplotva-config/src/lib.rs b/crates/openplotva-config/src/lib.rs
index 78116e92..465b25f9 100644
--- a/crates/openplotva-config/src/lib.rs
+++ b/crates/openplotva-config/src/lib.rs
@@ -380,8 +380,6 @@ pub const DEFAULT_HISTORY_SUMMARY_PROVIDER: &str = "aifarm";
 
 pub const DEFAULT_HISTORY_SUMMARY_TIMEOUT_SECONDS: i32 = 600;
 
-pub const DEFAULT_MEMORY_CONSOLIDATION_PROVIDER: &str = "aifarm";
-
 pub const DEFAULT_MEMORY_CONSOLIDATION_MODEL: &str = "Gemma 4 26B Heretic";
 
 pub const DEFAULT_MEMORY_MIN_MESSAGES_PER_RUN: i32 = 20;
@@ -1072,7 +1070,6 @@ pub struct AceStepConfig {
 pub struct MemoryConfig {
     pub enabled: bool,
     pub retention_hours: i32,
-    pub consolidation_provider: String,
     pub consolidation_model: String,
     pub consolidation_timeout_seconds: i32,
     pub worker_concurrency: i32,
@@ -1603,8 +1600,6 @@ pub struct RawConfig {
     pub memory_enabled: Option<String>,
     /// `MEMORY_RETENTION_HOURS`.
     pub memory_retention_hours: Option<String>,
-    /// `MEMORY_CONSOLIDATION_PROVIDER`.
-    pub memory_consolidation_provider: Option<String>,
     /// `MEMORY_CONSOLIDATION_MODEL`.
     pub memory_consolidation_model: Option<String>,
     /// `MEMORY_CONSOLIDATION_TIMEOUT_SECONDS`.
@@ -2948,9 +2943,6 @@ impl AppConfig {
                     raw.memory_retention_hours,
                     168,
                 )?,
-                consolidation_provider: raw
-                    .memory_consolidation_provider
-                    .unwrap_or_else(|| DEFAULT_MEMORY_CONSOLIDATION_PROVIDER.to_owned()),
                 consolidation_model: raw
                     .memory_consolidation_model
                     .unwrap_or_else(|| DEFAULT_MEMORY_CONSOLIDATION_MODEL.to_owned()),
@@ -3468,7 +3460,6 @@ impl RawConfig {
             acestep_model: env("ACESTEP_MODEL"),
             memory_enabled: env("MEMORY_ENABLED"),
             memory_retention_hours: env("MEMORY_RETENTION_HOURS"),
-            memory_consolidation_provider: env("MEMORY_CONSOLIDATION_PROVIDER"),
             memory_consolidation_model: env("MEMORY_CONSOLIDATION_MODEL"),
             memory_consolidation_timeout_seconds: env("MEMORY_CONSOLIDATION_TIMEOUT_SECONDS"),
             memory_worker_concurrency: env("MEMORY_WORKER_CONCURRENCY"),
@@ -4276,7 +4267,6 @@ mod tests {
         assert_eq!(config.llm.history_summary.chat_history_retention_days, 8);
         assert_eq!(config.vision.telegram_files_retention_days, 7);
         assert_eq!(config.white_circle.whitecircle_checks_retention_days, 30);
-        assert_eq!(config.memory.consolidation_provider, "aifarm");
         assert_eq!(
             config.memory.consolidation_model,
             DEFAULT_MEMORY_CONSOLIDATION_MODEL
@@ -5029,7 +5019,6 @@ mod tests {
         let config = AppConfig::from_raw(RawConfig {
             memory_enabled: Some("false".to_owned()),
             memory_retention_hours: Some("240".to_owned()),
-            memory_consolidation_provider: Some("genkit".to_owned()),
             memory_consolidation_model: Some("memory-model".to_owned()),
             memory_consolidation_timeout_seconds: Some("777".to_owned()),
             memory_worker_concurrency: Some("2".to_owned()),
@@ -5065,7 +5054,6 @@ mod tests {
 
         assert!(!config.memory.enabled);
         assert_eq!(config.memory.retention_hours, 240);
-        assert_eq!(config.memory.consolidation_provider, "genkit");
         assert_eq!(config.memory.consolidation_model, "memory-model");
         assert_eq!(config.memory.consolidation_timeout_seconds, 777);
         assert_eq!(config.memory.worker_concurrency, 2);
diff --git a/crates/openplotva-dialog/src/lib.rs b/crates/openplotva-dialog/src/lib.rs
index d2e1a52f..836fff85 100644
--- a/crates/openplotva-dialog/src/lib.rs
+++ b/crates/openplotva-dialog/src/lib.rs
@@ -98,6 +98,9 @@ impl Error for DialogTraceError {
 
 #[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
 pub struct ToolContext {
+    /// Stable operation identity assigned by the tool execution owner.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub invocation_id: Option<String>,
     /// Telegram chat ID.
     #[serde(default)]
     pub chat_id: i64,
diff --git a/crates/openplotva-dialog/src/transcript.rs b/crates/openplotva-dialog/src/transcript.rs
index 9643a539..6e5dcef8 100644
--- a/crates/openplotva-dialog/src/transcript.rs
+++ b/crates/openplotva-dialog/src/transcript.rs
@@ -17,6 +17,7 @@ use crate::{DialogInput, DialogTraceArtifacts, ToolContext, ToolStep};
 #[must_use]
 pub fn dialog_tool_context(input: &DialogInput) -> ToolContext {
     ToolContext {
+        invocation_id: None,
         chat_id: input.context.chat_id,
         thread_id: input.context.thread_id,
         message_id: input.message.id,
diff --git a/crates/openplotva-llm/src/aifarm.rs b/crates/openplotva-llm/src/aifarm.rs
index 09f1a137..0bd21f27 100644
--- a/crates/openplotva-llm/src/aifarm.rs
+++ b/crates/openplotva-llm/src/aifarm.rs
@@ -7158,12 +7158,14 @@ mod tests {
     }
 
     fn prompt_store_with(files: &[(&str, &str)]) -> Arc<openplotva_prompts::PromptStore> {
+        static NEXT_DIRECTORY: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+        let directory_id = NEXT_DIRECTORY.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
         let nonce = SystemTime::now()
             .duration_since(SystemTime::UNIX_EPOCH)
             .expect("system time")
             .as_nanos();
         let root = std::env::temp_dir().join(format!(
-            "openplotva-aifarm-prompts-{}-{nonce}",
+            "openplotva-aifarm-prompts-{}-{nonce}-{directory_id}",
             std::process::id()
         ));
         fs::create_dir_all(&root).expect("create prompt root");
diff --git a/crates/openplotva-llm/src/gemini.rs b/crates/openplotva-llm/src/gemini.rs
index 82550675..17315989 100644
--- a/crates/openplotva-llm/src/gemini.rs
+++ b/crates/openplotva-llm/src/gemini.rs
@@ -3250,12 +3250,14 @@ mod tests {
     }
 
     fn prompt_store_with(files: &[(&str, &str)]) -> Arc<openplotva_prompts::PromptStore> {
+        static NEXT_DIRECTORY: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+        let directory_id = NEXT_DIRECTORY.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
         let nonce = SystemTime::now()
             .duration_since(SystemTime::UNIX_EPOCH)
             .expect("system time")
             .as_nanos();
         let root = std::env::temp_dir().join(format!(
-            "openplotva-gemini-prompts-{}-{nonce}",
+            "openplotva-gemini-prompts-{}-{nonce}-{directory_id}",
             std::process::id()
         ));
         fs::create_dir_all(&root).expect("create prompt root");
diff --git a/crates/openplotva-llm/src/gradius.rs b/crates/openplotva-llm/src/gradius.rs
index 1ace2e17..ab6db5f7 100644
--- a/crates/openplotva-llm/src/gradius.rs
+++ b/crates/openplotva-llm/src/gradius.rs
@@ -7,7 +7,7 @@ use std::{
     time::{Duration, Instant},
 };
 
-use openplotva_memory::{
+use crate::redaction::{
     DiscoveryRedactor, DiscoveryRedactorConfig, DiscoveryRedactorError, RedactionReplacementMode,
 };
 use reqwest::header::{ACCEPT, CONTENT_TYPE};
@@ -1911,7 +1911,7 @@ mod tests {
         );
         assert_eq!(
             GradiusPrivacyRedactor::replacement_mode(),
-            openplotva_memory::RedactionReplacementMode::TypedPlaceholders
+            crate::redaction::RedactionReplacementMode::TypedPlaceholders
         );
     }
 
@@ -1958,7 +1958,7 @@ mod tests {
 
     #[tokio::test]
     async fn privacy_redactor_returns_errors_instead_of_unredacted_text() {
-        let config = openplotva_memory::DiscoveryRedactorConfig {
+        let config = crate::redaction::DiscoveryRedactorConfig {
             base_url: "not a url".to_owned(),
             ..Default::default()
         };
diff --git a/crates/openplotva-llm/src/lib.rs b/crates/openplotva-llm/src/lib.rs
index 43c99b19..51682ae5 100644
--- a/crates/openplotva-llm/src/lib.rs
+++ b/crates/openplotva-llm/src/lib.rs
@@ -10,6 +10,7 @@ pub mod gradius;
 mod gradius_vip_hints;
 pub mod model_listing;
 pub mod provider_schema;
+pub mod redaction;
 pub mod retry;
 pub mod router;
 pub mod trace;
diff --git a/crates/openplotva-llm/src/provider_schema.rs b/crates/openplotva-llm/src/provider_schema.rs
index 4ab561b7..f694f95b 100644
--- a/crates/openplotva-llm/src/provider_schema.rs
+++ b/crates/openplotva-llm/src/provider_schema.rs
@@ -13,7 +13,7 @@ use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value, json};
 
 /// Wire-payload protocol of a provider endpoint.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub enum Protocol {
     /// OpenAI-compatible `/v1/chat/completions` (direct or discovery-resolved).
     OpenAiCompat,
@@ -23,6 +23,8 @@ pub enum Protocol {
     AceStep,
     /// Discovery blocking-jobs API (`/v1/jobs/blocking` + poll), e.g. embedder.
     DiscoveryJobs,
+    /// Discovery speech recognition API.
+    DiscoveryAsr,
     /// Discovery draw API (image generation/editing job queue).
     DiscoveryDraw,
     /// Non-LLM privacy/redaction discovery service.
@@ -37,6 +39,7 @@ impl Protocol {
             "genkit" => Some(Self::Genkit),
             "acestep" => Some(Self::AceStep),
             "discovery_jobs" => Some(Self::DiscoveryJobs),
+            "discovery_asr" => Some(Self::DiscoveryAsr),
             "discovery_draw" => Some(Self::DiscoveryDraw),
             "privacy_filter" => Some(Self::PrivacyFilter),
             _ => None,
@@ -50,6 +53,7 @@ impl Protocol {
             Self::Genkit => "genkit",
             Self::AceStep => "acestep",
             Self::DiscoveryJobs => "discovery_jobs",
+            Self::DiscoveryAsr => "discovery_asr",
             Self::DiscoveryDraw => "discovery_draw",
             Self::PrivacyFilter => "privacy_filter",
         }
@@ -68,6 +72,7 @@ impl Protocol {
             Self::Genkit,
             Self::AceStep,
             Self::DiscoveryJobs,
+            Self::DiscoveryAsr,
             Self::DiscoveryDraw,
             Self::PrivacyFilter,
         ]
@@ -245,7 +250,10 @@ pub fn param_descriptor(protocol: Protocol, hint: Option<RuntimeHint>) -> Value
             { "key": "timeout_ms", "kind": "int", "label": "Request timeout (ms)" },
             { "key": "connect_timeout_ms", "kind": "int", "label": "Connect timeout (ms)" },
         ]),
-        Protocol::DiscoveryJobs | Protocol::DiscoveryDraw | Protocol::PrivacyFilter => json!([
+        Protocol::DiscoveryAsr
+        | Protocol::DiscoveryJobs
+        | Protocol::DiscoveryDraw
+        | Protocol::PrivacyFilter => json!([
             { "key": "timeout_ms", "kind": "int", "label": "Job timeout (ms)" },
         ]),
     };
@@ -258,6 +266,7 @@ pub fn param_descriptor(protocol: Protocol, hint: Option<RuntimeHint>) -> Value
         ]),
         Protocol::AceStep
         | Protocol::DiscoveryJobs
+        | Protocol::DiscoveryAsr
         | Protocol::DiscoveryDraw
         | Protocol::PrivacyFilter => json!([]),
     };
diff --git a/crates/openplotva-llm/src/redaction.rs b/crates/openplotva-llm/src/redaction.rs
new file mode 100644
index 00000000..02736cba
--- /dev/null
+++ b/crates/openplotva-llm/src/redaction.rs
@@ -0,0 +1,1191 @@
+//! Discovery transport for privacy-filter redaction.
+
+use crate::aifarm::DISCOVERY_PRIORITY_MEMORY;
+use base64::{Engine as _, engine::general_purpose};
+use openplotva_memory::{TextRedactor, TextRedactorFuture, default_memory_redaction_categories};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::{
+    collections::HashMap,
+    time::{Duration as StdDuration, Instant, SystemTime, UNIX_EPOCH},
+};
+use thiserror::Error;
+use url::Url;
+
+pub const DEFAULT_DISCOVERY_BASE_URL: &str = "http://127.0.0.1:50051";
+pub const DEFAULT_MEMORY_REDACTION_SERVICE_NAME: &str = "privacy-filter";
+pub const DEFAULT_MEMORY_REDACTION_ENDPOINT_NAME: &str = "redact";
+pub const DEFAULT_MEMORY_REDACTION_TIMEOUT: StdDuration = StdDuration::from_secs(35);
+pub const DEFAULT_MEMORY_REDACTION_POLL_INTERVAL: StdDuration = StdDuration::from_secs(1);
+pub const DEFAULT_MEMORY_REDACTION_CAPACITY_WAIT: StdDuration = StdDuration::from_secs(30);
+/// Discovery caps `/v1/jobs/sync` and long-poll result waits at two minutes.
+const DISCOVERY_MAX_RESULT_WAIT: StdDuration = StdDuration::from_secs(120);
+/// A long-poll answer faster than this means the server ignored `wait_ms`.
+const DISCOVERY_LONG_POLL_MIN_HOLD: StdDuration = StdDuration::from_millis(50);
+
+/// Memory redaction transport error.
+#[derive(Debug, Error)]
+pub enum DiscoveryRedactorError {
+    /// Request body JSON serialization failed.
+    #[error("marshal memory redaction request: {0}")]
+    RequestBody(serde_json::Error),
+    /// Job body JSON serialization failed.
+    #[error("marshal memory redaction job: {0}")]
+    JobBody(serde_json::Error),
+    /// HTTP request failed.
+    #[error("{phase} memory redaction job: {source}")]
+    Request {
+        /// Request phase.
+        phase: &'static str,
+        /// Source error.
+        #[source]
+        source: reqwest::Error,
+    },
+    /// Discovery returned non-2xx.
+    #[error("{phase} memory redaction job: status {status}: {body}")]
+    Status {
+        /// Request phase.
+        phase: &'static str,
+        /// HTTP status.
+        status: u16,
+        /// Trimmed response body.
+        body: String,
+    },
+    /// Discovery response JSON decode failed.
+    #[error("decode memory redaction {phase} response: {source}")]
+    DecodeEnvelope {
+        /// Request phase.
+        phase: &'static str,
+        /// Decode error.
+        #[source]
+        source: reqwest::Error,
+    },
+    /// Waiting timed out.
+    #[error("waiting for memory redaction job {job_id}: task timeout")]
+    Timeout {
+        /// Job ID.
+        job_id: String,
+    },
+    /// Job failed.
+    #[error("memory redaction job failed: {0}")]
+    JobFailed(String),
+    /// Job failed without message.
+    #[error("memory redaction job failed with status {0:?}")]
+    JobFailedStatus(String),
+    /// Unknown terminal status.
+    #[error("unknown memory redaction job status {0:?}")]
+    UnknownStatus(String),
+    /// Success lacked a response.
+    #[error("memory redaction job succeeded without response")]
+    MissingResponse,
+    /// Upstream redactor returned non-2xx.
+    #[error("memory redaction upstream returned status {0}")]
+    UpstreamStatus(u16),
+    /// Redaction payload JSON decode failed.
+    #[error("decode memory redaction payload: {0}")]
+    DecodePayload(serde_json::Error),
+    /// Upstream did not return redacted text.
+    #[error("memory redaction response has no redacted_text")]
+    EmptyRedactedText,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct DiscoveryRedactorConfig {
+    /// Discovery base URL.
+    pub base_url: String,
+    /// Discovery service name.
+    pub service_name: String,
+    /// Discovery endpoint name.
+    pub endpoint_name: String,
+    /// HTTP timeout.
+    pub timeout: StdDuration,
+    /// Discovery task timeout.
+    pub task_timeout: StdDuration,
+    /// Poll interval.
+    pub poll_interval: StdDuration,
+    /// Capacity wait.
+    pub capacity_wait: StdDuration,
+    /// Capacity poll interval.
+    pub capacity_poll_interval: StdDuration,
+    /// Redaction categories.
+    pub categories: Vec<String>,
+}
+
+impl Default for DiscoveryRedactorConfig {
+    fn default() -> Self {
+        Self {
+            base_url: DEFAULT_DISCOVERY_BASE_URL.to_owned(),
+            service_name: DEFAULT_MEMORY_REDACTION_SERVICE_NAME.to_owned(),
+            endpoint_name: DEFAULT_MEMORY_REDACTION_ENDPOINT_NAME.to_owned(),
+            timeout: DEFAULT_MEMORY_REDACTION_TIMEOUT,
+            task_timeout: DEFAULT_MEMORY_REDACTION_TIMEOUT,
+            poll_interval: DEFAULT_MEMORY_REDACTION_POLL_INTERVAL,
+            capacity_wait: DEFAULT_MEMORY_REDACTION_CAPACITY_WAIT,
+            capacity_poll_interval: DEFAULT_MEMORY_REDACTION_POLL_INTERVAL,
+            categories: default_memory_redaction_categories(),
+        }
+    }
+}
+
+impl DiscoveryRedactorConfig {
+    #[must_use]
+    pub fn with_defaults(mut self) -> Self {
+        self.base_url = default_trimmed_string(&self.base_url, DEFAULT_DISCOVERY_BASE_URL);
+        self.service_name =
+            default_trimmed_string(&self.service_name, DEFAULT_MEMORY_REDACTION_SERVICE_NAME);
+        self.endpoint_name =
+            default_trimmed_string(&self.endpoint_name, DEFAULT_MEMORY_REDACTION_ENDPOINT_NAME);
+        self.timeout = default_duration(self.timeout, DEFAULT_MEMORY_REDACTION_TIMEOUT);
+        self.task_timeout = default_duration(self.task_timeout, DEFAULT_MEMORY_REDACTION_TIMEOUT);
+        self.poll_interval =
+            default_duration(self.poll_interval, DEFAULT_MEMORY_REDACTION_POLL_INTERVAL);
+        self.capacity_wait =
+            default_duration(self.capacity_wait, DEFAULT_MEMORY_REDACTION_CAPACITY_WAIT);
+        self.capacity_poll_interval = default_duration(
+            self.capacity_poll_interval,
+            DEFAULT_MEMORY_REDACTION_POLL_INTERVAL,
+        );
+        if self.categories.is_empty() {
+            self.categories = default_memory_redaction_categories();
+        }
+        self
+    }
+}
+
+#[derive(Debug)]
+pub struct DiscoveryRedactor {
+    base_url: String,
+    service_name: String,
+    endpoint_name: String,
+    task_timeout: StdDuration,
+    poll_interval: StdDuration,
+    capacity_wait: StdDuration,
+    capacity_poll_interval: StdDuration,
+    timeout: StdDuration,
+    categories: Vec<String>,
+    client: reqwest::Client,
+}
+
+impl DiscoveryRedactor {
+    /// Build a reqwest-backed Discovery redactor.
+    pub fn new(cfg: DiscoveryRedactorConfig) -> Result<Self, reqwest::Error> {
+        let client = reqwest::Client::builder().build()?;
+        Ok(Self::with_client(cfg, client))
+    }
+
+    /// Build a redactor on a shared HTTP client so consecutive calls reuse
+    /// pooled keep-alive connections instead of paying a new handshake each.
+    #[must_use]
+    pub fn with_client(cfg: DiscoveryRedactorConfig, client: reqwest::Client) -> Self {
+        let cfg = cfg.with_defaults();
+        Self {
+            base_url: cfg.base_url.trim().trim_end_matches('/').to_owned(),
+            service_name: cfg.service_name.trim().to_owned(),
+            endpoint_name: cfg.endpoint_name.trim().to_owned(),
+            task_timeout: cfg.task_timeout,
+            poll_interval: cfg.poll_interval,
+            capacity_wait: cfg.capacity_wait,
+            capacity_poll_interval: cfg.capacity_poll_interval,
+            timeout: cfg.timeout,
+            categories: cfg.categories,
+            client,
+        }
+    }
+
+    pub async fn redact_text(&self, text: &str) -> Result<String, DiscoveryRedactorError> {
+        self.redact_text_with_optional_mode(text, None).await
+    }
+
+    pub async fn redact_text_with_mode(
+        &self,
+        text: &str,
+        replacement_mode: RedactionReplacementMode,
+    ) -> Result<String, DiscoveryRedactorError> {
+        self.redact_text_with_optional_mode(text, Some(replacement_mode))
+            .await
+    }
+
+    async fn redact_text_with_optional_mode(
+        &self,
+        text: &str,
+        replacement_mode: Option<RedactionReplacementMode>,
+    ) -> Result<String, DiscoveryRedactorError> {
+        let request_id = memory_redact_id();
+        let job_id = memory_redact_id();
+        let (body, mut job_id) = self.redaction_job_body_with_ids_and_optional_mode(
+            text,
+            &request_id,
+            &job_id,
+            replacement_mode,
+        )?;
+        let envelope = self.submit_redaction_job(body).await?;
+        if let Some(resolved) = envelope.resolved_job_id() {
+            job_id = resolved;
+        }
+        match redaction_result_from_envelope(&envelope, false)? {
+            RedactionEnvelopeResult::Done(result) => Ok(result),
+            RedactionEnvelopeResult::Pending => self.poll_result(&job_id).await,
+        }
+    }
+
+    pub fn redaction_job_body(
+        &self,
+        text: &str,
+    ) -> Result<(Vec<u8>, String), DiscoveryRedactorError> {
+        let request_id = memory_redact_id();
+        let job_id = memory_redact_id();
+        self.redaction_job_body_with_ids(text, &request_id, &job_id)
+    }
+
+    pub fn redaction_job_body_with_ids(
+        &self,
+        text: &str,
+        request_id: &str,
+        job_id: &str,
+    ) -> Result<(Vec<u8>, String), DiscoveryRedactorError> {
+        self.redaction_job_body_with_ids_and_optional_mode(text, request_id, job_id, None)
+    }
+
+    pub fn redaction_job_body_with_ids_and_mode(
+        &self,
+        text: &str,
+        request_id: &str,
+        job_id: &str,
+        replacement_mode: RedactionReplacementMode,
+    ) -> Result<(Vec<u8>, String), DiscoveryRedactorError> {
+        self.redaction_job_body_with_ids_and_optional_mode(
+            text,
+            request_id,
+            job_id,
+            Some(replacement_mode),
+        )
+    }
+
+    fn redaction_job_body_with_ids_and_optional_mode(
+        &self,
+        text: &str,
+        request_id: &str,
+        job_id: &str,
+        replacement_mode: Option<RedactionReplacementMode>,
+    ) -> Result<(Vec<u8>, String), DiscoveryRedactorError> {
+        let payload = serde_json::to_vec(&RedactionRequest {
+            request_id: request_id.to_owned(),
+            text: text.to_owned(),
+            categories: self.categories.clone(),
+            replacement_mode,
+        })
+        .map_err(DiscoveryRedactorError::RequestBody)?;
+
+        let job_id = job_id.to_owned();
+        let job_req = DiscoveryRedactionJobRequest {
+            invocation: DiscoveryRedactionInvocation {
+                service_name: self.service_name.clone(),
+                endpoint_name: self.endpoint_name.clone(),
+                body: general_purpose::STANDARD.encode(payload),
+                content_type: "application/json".to_owned(),
+                timeout_ms: duration_ms(self.task_timeout),
+                ..DiscoveryRedactionInvocation::default()
+            },
+            idempotency_key: job_id.clone(),
+            priority: DISCOVERY_PRIORITY_MEMORY,
+            wait_for_capacity_ms: duration_ms(self.capacity_wait),
+            capacity_poll_ms: duration_ms(self.capacity_poll_interval),
+            wait_for_result_ms: duration_ms(self.result_wait()),
+        };
+        let body = serde_json::to_vec(&job_req).map_err(DiscoveryRedactorError::JobBody)?;
+        Ok((body, job_id))
+    }
+
+    async fn submit_redaction_job(
+        &self,
+        body: Vec<u8>,
+    ) -> Result<DiscoveryRedactionEnvelope, DiscoveryRedactorError> {
+        let response = self
+            .client
+            .post(self.endpoint("/v1/jobs/sync"))
+            .header("Content-Type", "application/json")
+            .timeout(
+                self.capacity_wait
+                    .saturating_add(self.result_wait())
+                    .saturating_add(self.timeout),
+            )
+            .body(body)
+            .send()
+            .await
+            .map_err(|source| DiscoveryRedactorError::Request {
+                phase: "submit",
+                source,
+            })?;
+        decode_redaction_envelope_response(response, "submit").await
+    }
+
+    async fn poll_result(&self, job_id: &str) -> Result<String, DiscoveryRedactorError> {
+        let deadline = Instant::now() + self.task_timeout;
+        loop {
+            if Instant::now() >= deadline {
+                return Err(DiscoveryRedactorError::Timeout {
+                    job_id: job_id.to_owned(),
+                });
+            }
+            let wait = deadline
+                .saturating_duration_since(Instant::now())
+                .min(DISCOVERY_MAX_RESULT_WAIT);
+            let asked = Instant::now();
+            let envelope = self.fetch_job(job_id, wait).await?;
+            match redaction_result_from_envelope(&envelope, true)? {
+                RedactionEnvelopeResult::Done(result) => return Ok(result),
+                RedactionEnvelopeResult::Pending => {
+                    if asked.elapsed() < DISCOVERY_LONG_POLL_MIN_HOLD {
+                        // An older Discovery ignores `wait_ms`; fall back to interval polling.
+                        tokio::time::sleep(self.poll_interval).await;
+                    }
+                }
+            }
+        }
+    }
+
+    fn result_wait(&self) -> StdDuration {
+        self.task_timeout.min(DISCOVERY_MAX_RESULT_WAIT)
+    }
+
+    async fn fetch_job(
+        &self,
+        job_id: &str,
+        wait: StdDuration,
+    ) -> Result<DiscoveryRedactionEnvelope, DiscoveryRedactorError> {
+        let response = self
+            .client
+            .get(self.endpoint(&format!(
+                "/v1/jobs/{}?wait_ms={}",
+                job_id.trim(),
+                wait.as_millis()
+            )))
+            .timeout(wait.saturating_add(self.timeout))
+            .send()
+            .await
+            .map_err(|source| DiscoveryRedactorError::Request {
+                phase: "check",
+                source,
+            })?;
+        decode_redaction_envelope_response(response, "check").await
+    }
+
+    fn endpoint(&self, path: &str) -> String {
+        endpoint_join(&self.base_url, path)
+    }
+}
+
+impl TextRedactor for DiscoveryRedactor {
+    type Error = DiscoveryRedactorError;
+
+    fn redact_text<'a>(&'a self, text: String) -> TextRedactorFuture<'a, Self::Error> {
+        Box::pin(async move { DiscoveryRedactor::redact_text(self, &text).await })
+    }
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct RedactionRequest {
+    /// Request ID.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub request_id: String,
+    /// Text to redact.
+    pub text: String,
+    /// Redaction categories.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub categories: Vec<String>,
+    /// Redaction replacement style. Omitted requests preserve the legacy ellipsis output.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub replacement_mode: Option<RedactionReplacementMode>,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RedactionReplacementMode {
+    Ellipsis,
+    TypedPlaceholders,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct RedactionResponse {
+    /// Redacted text.
+    pub redacted_text: String,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct DiscoveryRedactionJobRequest {
+    /// Discovery invocation.
+    pub invocation: DiscoveryRedactionInvocation,
+    /// Idempotency key.
+    pub idempotency_key: String,
+    /// Priority.
+    pub priority: i32,
+    /// Wait-for-capacity milliseconds.
+    #[serde(default, skip_serializing_if = "is_zero_i32")]
+    pub wait_for_capacity_ms: i32,
+    /// Capacity-poll milliseconds.
+    #[serde(default, skip_serializing_if = "is_zero_i32")]
+    pub capacity_poll_ms: i32,
+    /// How long `/v1/jobs/sync` holds the submit open for the result.
+    #[serde(default, skip_serializing_if = "is_zero_i32")]
+    pub wait_for_result_ms: i32,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct DiscoveryRedactionInvocation {
+    /// Discovery service name.
+    pub service_name: String,
+    /// Discovery endpoint name.
+    pub endpoint_name: String,
+    /// Headers.
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
+    pub headers: HashMap<String, String>,
+    /// Query values.
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
+    pub query: HashMap<String, String>,
+    /// Base64 body.
+    pub body: String,
+    /// Content type.
+    pub content_type: String,
+    /// Timeout milliseconds.
+    pub timeout_ms: i32,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
+pub struct DiscoveryRedactionEnvelope {
+    /// Nested job payload.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub job: Option<DiscoveryRedactionJob>,
+    /// Top-level ID.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub id: String,
+    /// Top-level job ID.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub job_id: String,
+    /// Top-level status.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub status: String,
+    /// Top-level state.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub state: String,
+    /// Top-level error.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<Value>,
+    /// Top-level result.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub result: Option<DiscoveryRedactionResult>,
+}
+
+impl DiscoveryRedactionEnvelope {
+    fn normalized(self) -> Self {
+        if let Some(job) = &self.job {
+            Self {
+                id: job.id.clone(),
+                job_id: job.job_id.clone(),
+                status: job.status.clone(),
+                state: job.state.clone(),
+                error: job.error.clone(),
+                result: job.result.clone(),
+                job: self.job.clone(),
+            }
+        } else {
+            self
+        }
+    }
+
+    fn resolved_job_id(&self) -> Option<String> {
+        if let Some(job) = &self.job {
+            let job_id = job.job_id.trim();
+            if !job_id.is_empty() {
+                return Some(job_id.to_owned());
+            }
+            let id = job.id.trim();
+            return (!id.is_empty()).then(|| id.to_owned());
+        }
+        let job_id = self.job_id.trim();
+        if !job_id.is_empty() {
+            return Some(job_id.to_owned());
+        }
+        let id = self.id.trim();
+        (!id.is_empty()).then(|| id.to_owned())
+    }
+
+    fn resolved_status(&self) -> String {
+        if let Some(job) = &self.job {
+            let state = job.state.trim();
+            if !state.is_empty() {
+                return state.to_owned();
+            }
+            return job.status.trim().to_owned();
+        }
+        let state = self.state.trim();
+        if !state.is_empty() {
+            return state.to_owned();
+        }
+        self.status.trim().to_owned()
+    }
+
+    fn error_message(&self) -> String {
+        if let Some(result) = &self.result
+            && let Some(error) = &result.error
+        {
+            return error.message.clone();
+        }
+        let raw = self
+            .job
+            .as_ref()
+            .and_then(|job| job.error.as_ref())
+            .or(self.error.as_ref());
+        let Some(raw) = raw else {
+            return String::new();
+        };
+        let parsed = serde_json::from_value::<DiscoveryRedactionErrorPayload>(raw.clone());
+        if let Ok(payload) = parsed {
+            return [payload.message, payload.detail, payload.error]
+                .join(" ")
+                .trim()
+                .to_owned();
+        }
+        raw.to_string()
+    }
+}
+
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
+pub struct DiscoveryRedactionJob {
+    /// Job ID.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub id: String,
+    /// Job ID alias.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub job_id: String,
+    /// Status.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub status: String,
+    /// State.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub state: String,
+    /// Error payload.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<Value>,
+    /// Result.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub result: Option<DiscoveryRedactionResult>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct DiscoveryRedactionResult {
+    /// HTTP response.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub response: Option<DiscoveryRedactionHttpResponse>,
+    /// Discovery error.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<DiscoveryRedactionResultError>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct DiscoveryRedactionHttpResponse {
+    /// Status code.
+    #[serde(default, skip_serializing_if = "is_zero_u16")]
+    pub status_code: u16,
+    /// Body.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub body: String,
+    /// Content type.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub content_type: String,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct DiscoveryRedactionResultError {
+    /// Error code.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub code: String,
+    /// Error message.
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub message: String,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq)]
+struct DiscoveryRedactionErrorPayload {
+    #[serde(default)]
+    message: String,
+    #[serde(default)]
+    detail: String,
+    #[serde(default)]
+    error: String,
+}
+
+enum RedactionEnvelopeResult {
+    Pending,
+    Done(String),
+}
+
+async fn decode_redaction_envelope_response(
+    response: reqwest::Response,
+    phase: &'static str,
+) -> Result<DiscoveryRedactionEnvelope, DiscoveryRedactorError> {
+    let status = response.status();
+    if !status.is_success() {
+        let status_code = status.as_u16();
+        let body = response.text().await.unwrap_or_default().trim().to_owned();
+        return Err(DiscoveryRedactorError::Status {
+            phase,
+            status: status_code,
+            body,
+        });
+    }
+    response
+        .json::<DiscoveryRedactionEnvelope>()
+        .await
+        .map(DiscoveryRedactionEnvelope::normalized)
+        .map_err(|source| DiscoveryRedactorError::DecodeEnvelope { phase, source })
+}
+
+fn redaction_result_from_envelope(
+    envelope: &DiscoveryRedactionEnvelope,
+    unknown_is_error: bool,
+) -> Result<RedactionEnvelopeResult, DiscoveryRedactorError> {
+    match normalize_discovery_status(&envelope.resolved_status()).as_str() {
+        "queued" | "running" => return Ok(RedactionEnvelopeResult::Pending),
+        "succeeded" => {
+            return decode_redaction_result(envelope.result.as_ref())
+                .map(RedactionEnvelopeResult::Done);
+        }
+        "failed" | "canceled" | "cancelled" => return Err(redaction_job_failed_error(envelope)),
+        _ => {}
+    }
+    if envelope
+        .result
+        .as_ref()
+        .and_then(|result| result.response.as_ref())
+        .is_some()
+    {
+        return decode_redaction_result(envelope.result.as_ref())
+            .map(RedactionEnvelopeResult::Done);
+    }
+    if unknown_is_error {
+        return Err(DiscoveryRedactorError::UnknownStatus(
+            envelope.resolved_status(),
+        ));
+    }
+    Ok(RedactionEnvelopeResult::Pending)
+}
+
+fn redaction_job_failed_error(envelope: &DiscoveryRedactionEnvelope) -> DiscoveryRedactorError {
+    let message = envelope.error_message();
+    if message.trim().is_empty() {
+        DiscoveryRedactorError::JobFailedStatus(envelope.resolved_status())
+    } else {
+        DiscoveryRedactorError::JobFailed(message)
+    }
+}
+
+fn decode_redaction_result(
+    result: Option<&DiscoveryRedactionResult>,
+) -> Result<String, DiscoveryRedactorError> {
+    let response = result
+        .and_then(|result| result.response.as_ref())
+        .ok_or(DiscoveryRedactorError::MissingResponse)?;
+    if !(200..300).contains(&response.status_code) {
+        return Err(DiscoveryRedactorError::UpstreamStatus(response.status_code));
+    }
+    let body = decode_discovery_body(&response.body);
+    let parsed = serde_json::from_slice::<RedactionResponse>(&body)
+        .map_err(DiscoveryRedactorError::DecodePayload)?;
+    if parsed.redacted_text.is_empty() {
+        return Err(DiscoveryRedactorError::EmptyRedactedText);
+    }
+    Ok(parsed.redacted_text)
+}
+
+fn decode_discovery_body(value: &str) -> Vec<u8> {
+    let value = value.trim();
+    if value.is_empty() {
+        return Vec::new();
+    }
+    if value.starts_with('{') || value.starts_with('[') {
+        return value.as_bytes().to_vec();
+    }
+    for encoding in [
+        &general_purpose::STANDARD,
+        &general_purpose::STANDARD_NO_PAD,
+        &general_purpose::URL_SAFE,
+        &general_purpose::URL_SAFE_NO_PAD,
+    ] {
+        if let Ok(decoded) = encoding.decode(value) {
+            return decoded;
+        }
+    }
+    value.as_bytes().to_vec()
+}
+
+fn normalize_discovery_status(value: &str) -> String {
+    let mut value = value.trim();
+    if value.len() >= "job_state_".len()
+        && value[.."job_state_".len()].eq_ignore_ascii_case("job_state_")
+    {
+        value = &value["job_state_".len()..];
+    }
+    for known in [
+        "queued",
+        "running",
+        "succeeded",
+        "failed",
+        "canceled",
+        "cancelled",
+    ] {
+        if value.eq_ignore_ascii_case(known) {
+            return known.to_owned();
+        }
+    }
+    value.to_lowercase()
+}
+
+fn endpoint_join(base_url: &str, path: &str) -> String {
+    let path = clean_url_path(path);
+    let Ok(mut base) = Url::parse(base_url) else {
+        return format!("{}{}", base_url.trim_end_matches('/'), path);
+    };
+    let joined_path = join_url_paths(base.path(), &path);
+    base.set_path(&joined_path);
+    base.to_string()
+}
+
+fn join_url_paths(base_path: &str, path: &str) -> String {
+    let mut parts = Vec::new();
+    for part in base_path.split('/').chain(path.split('/')) {
+        match part {
+            "" | "." => {}
+            ".." => {
+                let _ = parts.pop();
+            }
+            value => parts.push(value),
+        }
+    }
+    if parts.is_empty() {
+        "/".to_owned()
+    } else {
+        format!("/{}", parts.join("/"))
+    }
+}
+
+fn clean_url_path(path: &str) -> String {
+    if path.starts_with('/') {
+        path.to_owned()
+    } else {
+        format!("/{path}")
+    }
+}
+
+fn default_duration(value: StdDuration, fallback: StdDuration) -> StdDuration {
+    if value.is_zero() { fallback } else { value }
+}
+
+fn default_trimmed_string(value: &str, fallback: &str) -> String {
+    if value.trim().is_empty() {
+        fallback.to_owned()
+    } else {
+        value.to_owned()
+    }
+}
+
+fn duration_ms(value: StdDuration) -> i32 {
+    if value.is_zero() {
+        0
+    } else {
+        i32::try_from(value.as_millis()).unwrap_or(i32::MAX)
+    }
+}
+
+fn memory_redact_id() -> String {
+    let nanos = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|duration| duration.as_nanos())
+        .unwrap_or(0);
+    format!("memory-redact-{nanos}")
+}
+
+const fn is_zero_i32(value: &i32) -> bool {
+    *value == 0
+}
+const fn is_zero_u16(value: &u16) -> bool {
+    *value == 0
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[derive(Debug)]
+    struct RecordedRequest {
+        line: String,
+        body: Value,
+    }
+
+    async fn run_redactor_fixture(
+        replies: Vec<(u16, Value)>,
+    ) -> (Result<String, DiscoveryRedactorError>, Vec<RecordedRequest>) {
+        use std::io::{BufRead as _, Read as _, Write as _};
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("fixture listener");
+        listener
+            .set_nonblocking(true)
+            .expect("nonblocking listener");
+        let address = listener.local_addr().expect("fixture address");
+        let server = std::thread::spawn(move || -> Result<Vec<RecordedRequest>, String> {
+            let deadline = Instant::now() + StdDuration::from_secs(10);
+            let mut seen = Vec::new();
+            for (status, body) in replies {
+                let mut stream = loop {
+                    match listener.accept() {
+                        Ok((stream, _)) => break stream,
+                        Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
+                            if Instant::now() >= deadline {
+                                return Err("fixture request did not arrive".into());
+                            }
+                            std::thread::sleep(StdDuration::from_millis(1));
+                        }
+                        Err(error) => return Err(error.to_string()),
+                    }
+                };
+                stream
+                    .set_nonblocking(false)
+                    .map_err(|error| error.to_string())?;
+                stream
+                    .set_read_timeout(Some(StdDuration::from_secs(2)))
+                    .map_err(|error| error.to_string())?;
+                stream
+                    .set_write_timeout(Some(StdDuration::from_secs(2)))
+                    .map_err(|error| error.to_string())?;
+                let mut reader = std::io::BufReader::new(&mut stream);
+                let mut line = String::new();
+                reader
+                    .read_line(&mut line)
+                    .map_err(|error| error.to_string())?;
+                let mut length = 0_usize;
+                loop {
+                    let mut header = String::new();
+                    if reader
+                        .read_line(&mut header)
+                        .map_err(|error| error.to_string())?
+                        == 0
+                    {
+                        return Err("request headers ended early".into());
+                    }
+                    if header == "\r\n" {
+                        break;
+                    }
+                    if let Some((name, value)) = header.split_once(':')
+                        && name.eq_ignore_ascii_case("content-length")
+                    {
+                        length = value
+                            .trim()
+                            .parse::<usize>()
+                            .map_err(|error| error.to_string())?;
+                    }
+                }
+                let mut bytes = vec![0; length];
+                reader
+                    .read_exact(&mut bytes)
+                    .map_err(|error| error.to_string())?;
+                drop(reader);
+                seen.push(RecordedRequest {
+                    line: line.trim().to_owned(),
+                    body: if bytes.is_empty() {
+                        Value::Null
+                    } else {
+                        serde_json::from_slice(&bytes).map_err(|error| error.to_string())?
+                    },
+                });
+                let body = body.to_string();
+                write!(stream, "HTTP/1.1 {status} Fixture\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}", body.len()).map_err(|error| error.to_string())?;
+                stream.flush().map_err(|error| error.to_string())?;
+            }
+            Ok(seen)
+        });
+        let redactor = DiscoveryRedactor::new(DiscoveryRedactorConfig {
+            base_url: format!("http://{address}/root"),
+            timeout: StdDuration::from_secs(2),
+            task_timeout: StdDuration::from_secs(2),
+            poll_interval: StdDuration::from_millis(1),
+            ..Default::default()
+        })
+        .expect("redactor");
+        let result = redactor.redact_text("alice@example.test").await;
+        let seen = server
+            .join()
+            .expect("fixture thread")
+            .expect("fixture requests");
+        (result, seen)
+    }
+
+    fn redaction_success() -> Value {
+        serde_json::json!({"job":{"job_id":"server-job", "state":"JOB_STATE_SUCCEEDED", "result":{"response":{"status_code":200,"body":general_purpose::STANDARD.encode(r#"{"redacted_text":"[redacted]"}"#)}}}})
+    }
+
+    #[tokio::test]
+    async fn sync_success_completes_without_polling() {
+        let (result, seen) = run_redactor_fixture(vec![(200, redaction_success())]).await;
+        assert_eq!(result.expect("redacted text"), "[redacted]");
+        assert_eq!(seen.len(), 1);
+        assert_eq!(seen[0].line, "POST /root/v1/jobs/sync HTTP/1.1");
+        assert_eq!(
+            seen[0].body["invocation"]["service_name"],
+            DEFAULT_MEMORY_REDACTION_SERVICE_NAME
+        );
+        assert!(
+            !seen[0].body["idempotency_key"]
+                .as_str()
+                .expect("job key")
+                .is_empty()
+        );
+        let payload = general_purpose::STANDARD
+            .decode(seen[0].body["invocation"]["body"].as_str().expect("body"))
+            .expect("payload");
+        let payload: Value = serde_json::from_slice(&payload).expect("request");
+        assert_eq!(payload["text"], "alice@example.test");
+    }
+
+    #[tokio::test]
+    async fn queued_and_running_poll_the_resolved_job_without_resubmission() {
+        let (result, seen) = run_redactor_fixture(vec![
+            (
+                200,
+                serde_json::json!({"job":{"job_id":"server-job", "state":"JOB_STATE_QUEUED"}}),
+            ),
+            (
+                200,
+                serde_json::json!({"job":{"job_id":"server-job", "state":"JOB_STATE_RUNNING"}}),
+            ),
+            (200, redaction_success()),
+        ])
+        .await;
+        assert_eq!(result.expect("redacted text"), "[redacted]");
+        assert_eq!(seen.len(), 3);
+        assert_eq!(
+            seen.iter()
+                .filter(|request| request.line.starts_with("POST "))
+                .count(),
+            1
+        );
+        for request in &seen[1..] {
+            assert!(
+                request.line.starts_with("GET /root/v1/jobs/server-job"),
+                "{}",
+                request.line
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn polling_surfaces_terminal_job_failure_without_resubmission() {
+        let (result, seen) = run_redactor_fixture(vec![
+            (
+                200,
+                serde_json::json!({"job_id":"server-job", "state":"queued"}),
+            ),
+            (
+                200,
+                serde_json::json!({"state":"failed", "error":{"message":"cannot redact"}}),
+            ),
+        ])
+        .await;
+        assert!(
+            matches!(result, Err(DiscoveryRedactorError::JobFailed(message)) if message == "cannot redact")
+        );
+        assert_eq!(seen.len(), 2);
+    }
+
+    #[tokio::test]
+    async fn submission_and_poll_rate_limits_keep_their_error_phase() {
+        for (replies, phase, request_count) in [
+            (
+                vec![(429, serde_json::json!({"error":"busy"}))],
+                "submit",
+                1,
+            ),
+            (
+                vec![
+                    (
+                        200,
+                        serde_json::json!({"job_id":"server-job", "state":"queued"}),
+                    ),
+                    (429, serde_json::json!({"error":"busy"})),
+                ],
+                "check",
+                2,
+            ),
+        ] {
+            let (result, seen) = run_redactor_fixture(replies).await;
+            assert!(
+                matches!(result, Err(DiscoveryRedactorError::Status {phase: actual, status: 429, body}) if actual == phase && body.contains("busy"))
+            );
+            assert_eq!(seen.len(), request_count);
+        }
+    }
+
+    #[test]
+    fn discovery_redactor_defaults_match_go_privacy_filter_config() {
+        let cfg = DiscoveryRedactorConfig {
+            base_url: "  ".to_owned(),
+            service_name: String::new(),
+            endpoint_name: String::new(),
+            timeout: StdDuration::ZERO,
+            task_timeout: StdDuration::ZERO,
+            poll_interval: StdDuration::ZERO,
+            capacity_wait: StdDuration::ZERO,
+            capacity_poll_interval: StdDuration::ZERO,
+            categories: Vec::new(),
+        }
+        .with_defaults();
+
+        assert_eq!(cfg.base_url, DEFAULT_DISCOVERY_BASE_URL);
+        assert_eq!(cfg.service_name, DEFAULT_MEMORY_REDACTION_SERVICE_NAME);
+        assert_eq!(cfg.endpoint_name, DEFAULT_MEMORY_REDACTION_ENDPOINT_NAME);
+        assert_eq!(cfg.timeout, DEFAULT_MEMORY_REDACTION_TIMEOUT);
+        assert_eq!(cfg.task_timeout, DEFAULT_MEMORY_REDACTION_TIMEOUT);
+        assert_eq!(cfg.poll_interval, DEFAULT_MEMORY_REDACTION_POLL_INTERVAL);
+        assert_eq!(cfg.capacity_wait, DEFAULT_MEMORY_REDACTION_CAPACITY_WAIT);
+        assert_eq!(
+            cfg.capacity_poll_interval,
+            DEFAULT_MEMORY_REDACTION_POLL_INTERVAL
+        );
+        assert_eq!(cfg.categories, default_memory_redaction_categories());
+    }
+
+    #[test]
+    fn discovery_redactor_job_body_matches_go_discovery_shape() {
+        let redactor = DiscoveryRedactor::new(DiscoveryRedactorConfig {
+            base_url: "http://discovery.test/root/".to_owned(),
+            service_name: "privacy-filter".to_owned(),
+            endpoint_name: "redact".to_owned(),
+            timeout: StdDuration::from_secs(5),
+            task_timeout: StdDuration::from_secs(35),
+            poll_interval: StdDuration::from_secs(1),
+            capacity_wait: StdDuration::from_secs(30),
+            capacity_poll_interval: StdDuration::from_secs(1),
+            categories: vec!["private_email".to_owned(), "secret".to_owned()],
+        })
+        .expect("redactor");
+
+        let (body, job_id) = redactor
+            .redaction_job_body_with_ids(
+                "email alice@example.com",
+                "memory-redact-111",
+                "memory-redact-222",
+            )
+            .expect("body");
+        let submitted =
+            serde_json::from_slice::<DiscoveryRedactionJobRequest>(&body).expect("job request");
+        let payload_bytes = general_purpose::STANDARD
+            .decode(&submitted.invocation.body)
+            .expect("payload b64");
+        let payload = serde_json::from_slice::<RedactionRequest>(&payload_bytes).expect("payload");
+
+        assert_eq!(job_id, "memory-redact-222");
+        assert_eq!(submitted.idempotency_key, "memory-redact-222");
+        assert_eq!(submitted.priority, DISCOVERY_PRIORITY_MEMORY);
+        assert_eq!(submitted.wait_for_capacity_ms, 30_000);
+        assert_eq!(submitted.capacity_poll_ms, 1_000);
+        assert_eq!(submitted.invocation.service_name, "privacy-filter");
+        assert_eq!(submitted.invocation.endpoint_name, "redact");
+        assert_eq!(submitted.invocation.content_type, "application/json");
+        assert_eq!(submitted.invocation.timeout_ms, 35_000);
+        assert_eq!(payload.request_id, "memory-redact-111");
+        assert_eq!(payload.text, "email alice@example.com");
+        assert_eq!(payload.categories, vec!["private_email", "secret"]);
+        assert_eq!(payload.replacement_mode, None);
+        assert_eq!(
+            redactor.endpoint("/v1/jobs/blocking"),
+            "http://discovery.test/root/v1/jobs/blocking"
+        );
+    }
+
+    #[test]
+    fn discovery_redactor_job_body_supports_typed_placeholders() {
+        let redactor =
+            DiscoveryRedactor::new(DiscoveryRedactorConfig::default()).expect("redactor");
+
+        let (body, _) = redactor
+            .redaction_job_body_with_ids_and_mode(
+                "email alice@example.com",
+                "gradius-redact-111",
+                "gradius-redact-222",
+                RedactionReplacementMode::TypedPlaceholders,
+            )
+            .expect("body");
+        let submitted =
+            serde_json::from_slice::<DiscoveryRedactionJobRequest>(&body).expect("job request");
+        let payload_bytes = general_purpose::STANDARD
+            .decode(&submitted.invocation.body)
+            .expect("payload b64");
+        let payload = serde_json::from_slice::<RedactionRequest>(&payload_bytes).expect("payload");
+
+        assert_eq!(
+            payload.replacement_mode,
+            Some(RedactionReplacementMode::TypedPlaceholders)
+        );
+    }
+
+    #[test]
+    fn discovery_redactor_result_decodes_status_body_and_errors_like_go() {
+        let plain = DiscoveryRedactionEnvelope {
+            status: "JOB_STATE_SUCCEEDED".to_owned(),
+            result: Some(DiscoveryRedactionResult {
+                response: Some(DiscoveryRedactionHttpResponse {
+                    status_code: 200,
+                    body: serde_json::json!({"redacted_text": "[redacted]"}).to_string(),
+                    ..DiscoveryRedactionHttpResponse::default()
+                }),
+                ..DiscoveryRedactionResult::default()
+            }),
+            ..DiscoveryRedactionEnvelope::default()
+        };
+        let b64 = DiscoveryRedactionEnvelope {
+            state: "succeeded".to_owned(),
+            result: Some(DiscoveryRedactionResult {
+                response: Some(DiscoveryRedactionHttpResponse {
+                    status_code: 200,
+                    body: general_purpose::URL_SAFE_NO_PAD.encode(r#"{"redacted_text":"ok"}"#),
+                    ..DiscoveryRedactionHttpResponse::default()
+                }),
+                ..DiscoveryRedactionResult::default()
+            }),
+            ..DiscoveryRedactionEnvelope::default()
+        };
+        let nested = DiscoveryRedactionEnvelope {
+            job: Some(DiscoveryRedactionJob {
+                id: "id-1".to_owned(),
+                job_id: "job-1".to_owned(),
+                state: "running".to_owned(),
+                ..DiscoveryRedactionJob::default()
+            }),
+            ..DiscoveryRedactionEnvelope::default()
+        }
+        .normalized();
+        let failed = DiscoveryRedactionEnvelope {
+            status: "failed".to_owned(),
+            error: Some(serde_json::json!({"message":"bad","detail":"input"})),
+            ..DiscoveryRedactionEnvelope::default()
+        };
+
+        match redaction_result_from_envelope(&plain, true).expect("plain") {
+            RedactionEnvelopeResult::Done(value) => assert_eq!(value, "[redacted]"),
+            RedactionEnvelopeResult::Pending => panic!("plain should be done"),
+        }
+        match redaction_result_from_envelope(&b64, true).expect("b64") {
+            RedactionEnvelopeResult::Done(value) => assert_eq!(value, "ok"),
+            RedactionEnvelopeResult::Pending => panic!("b64 should be done"),
+        }
+        assert!(matches!(
+            redaction_result_from_envelope(&nested, true).expect("nested"),
+            RedactionEnvelopeResult::Pending
+        ));
+        assert_eq!(nested.resolved_job_id().as_deref(), Some("job-1"));
+        assert!(matches!(
+            redaction_result_from_envelope(&failed, true),
+            Err(DiscoveryRedactorError::JobFailed(message)) if message == "bad input"
+        ));
+        assert!(matches!(
+            redaction_result_from_envelope(&DiscoveryRedactionEnvelope::default(), true),
+            Err(DiscoveryRedactorError::UnknownStatus(status)) if status.is_empty()
+        ));
+    }
+}
diff --git a/crates/openplotva-llm/src/router/table.rs b/crates/openplotva-llm/src/router/table.rs
index 7766c6df..af2008d6 100644
--- a/crates/openplotva-llm/src/router/table.rs
+++ b/crates/openplotva-llm/src/router/table.rs
@@ -51,10 +51,106 @@ impl Kind {
     }
 }
 
+/// Interpret rows written before explicit protocols. Discovery-backed chat uses OpenAI payloads.
+#[must_use]
+pub fn legacy_provider_protocol(
+    kind: Kind,
+    name: &str,
+    has_discovery: bool,
+) -> crate::provider_schema::Protocol {
+    use crate::provider_schema::Protocol;
+    match kind {
+        Kind::Chat | Kind::Vision
+            if !has_discovery
+                && (name.eq_ignore_ascii_case("genkit") || name.eq_ignore_ascii_case("gemini")) =>
+        {
+            Protocol::Genkit
+        }
+        Kind::Chat | Kind::Vision => Protocol::OpenAiCompat,
+        Kind::Embedding => Protocol::DiscoveryJobs,
+        Kind::Image => Protocol::DiscoveryDraw,
+        Kind::Music => Protocol::AceStep,
+        Kind::PrivacyFilter => Protocol::PrivacyFilter,
+        Kind::Asr => Protocol::DiscoveryAsr,
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::Kind;
 
+    #[test]
+    fn explicit_protocol_wins_over_provider_names_and_unknown_values_fail_closed() {
+        use super::ProviderRow;
+        use crate::provider_schema::Protocol;
+        let mut row = ProviderRow {
+            id: 1,
+            name: "genkit".into(),
+            kind: Kind::Chat,
+            protocol: None,
+            runtime_hint: None,
+            endpoint: None,
+            discovery_service_name: None,
+            discovery_endpoint_name: None,
+            api_key_ref: None,
+            api_key_encrypted: None,
+            enabled: true,
+            config: serde_json::json!({}),
+        };
+        assert_eq!(row.resolved_protocol(), Some(Protocol::Genkit));
+        row.protocol = Some("openai_compat".into());
+        assert_eq!(row.resolved_protocol(), Some(Protocol::OpenAiCompat));
+        row.name = "renamed-provider".into();
+        row.protocol = Some("genkit".into());
+        assert_eq!(row.resolved_protocol(), Some(Protocol::Genkit));
+        row.discovery_service_name = Some("llm-openai".into());
+        assert_eq!(row.resolved_protocol(), Some(Protocol::Genkit));
+        row.protocol = None;
+        assert_eq!(row.resolved_protocol(), Some(Protocol::OpenAiCompat));
+        row.protocol = Some("unknown".into());
+        assert_eq!(row.resolved_protocol(), None);
+        row.protocol = None;
+        row.kind = Kind::Asr;
+        assert_eq!(row.resolved_protocol(), Some(Protocol::DiscoveryAsr));
+    }
+
+    #[test]
+    fn legacy_protocol_classifies_seeded_providers() {
+        // (kind, name, has_discovery) -> protocol, over the exact seeded rows.
+        let cases = [
+            ("chat", "aifarm", true, "openai_compat"),
+            ("chat", "genkit", false, "genkit"),
+            ("chat", "GENKIT", false, "genkit"),
+            ("chat", "genkit", true, "openai_compat"),
+            ("vision", "gemini", true, "openai_compat"),
+            ("chat", "gemini", false, "genkit"),
+            ("chat", "vram-cloud", false, "openai_compat"),
+            ("chat", "openrouter", false, "openai_compat"),
+            ("chat", "nvidia", false, "openai_compat"),
+            ("chat", "vmlx", false, "openai_compat"),
+            ("chat", "aifarm-llamacpp-gpu2", true, "openai_compat"),
+            ("chat", "aifarm-maple", true, "openai_compat"),
+            ("vision", "aifarm-vision", true, "openai_compat"),
+            ("embedding", "aifarm-embed", true, "discovery_jobs"),
+            ("image", "aifarm-draw", true, "discovery_draw"),
+            ("music", "acestep", false, "acestep"),
+            ("privacy_filter", "privacy-filter", true, "privacy_filter"),
+            ("asr", "aifarm-asr", true, "discovery_asr"),
+        ];
+        for (kind, name, has_discovery, expected) in cases {
+            assert_eq!(
+                super::legacy_provider_protocol(
+                    Kind::from_db(kind).expect("kind"),
+                    name,
+                    has_discovery
+                )
+                .as_str(),
+                expected,
+                "provider {name} (kind {kind})"
+            );
+        }
+    }
+
     #[test]
     fn parses_asr_kind_from_database_value() {
         assert_eq!(Kind::from_db("asr"), Some(Kind::Asr));
@@ -171,6 +267,22 @@ pub struct ProviderRow {
     pub config: Value,
 }
 
+impl ProviderRow {
+    /// Explicit protocols win. Name inference exists only for rows written before protocols.
+    #[must_use]
+    pub fn resolved_protocol(&self) -> Option<crate::provider_schema::Protocol> {
+        use crate::provider_schema::Protocol;
+        if let Some(protocol) = &self.protocol {
+            return Protocol::from_db(protocol);
+        }
+        Some(legacy_provider_protocol(
+            self.kind,
+            &self.name,
+            self.discovery_service_name.is_some(),
+        ))
+    }
+}
+
 /// A model offered by a provider, with its (possibly per-endpoint) base url.
 #[derive(Clone, Debug)]
 pub struct ModelRow {
diff --git a/crates/openplotva-memory/Cargo.toml b/crates/openplotva-memory/Cargo.toml
index e27ecf0e..20b33a9f 100644
--- a/crates/openplotva-memory/Cargo.toml
+++ b/crates/openplotva-memory/Cargo.toml
@@ -11,15 +11,11 @@ publish = false
 workspace = true
 
 [dependencies]
-base64.workspace = true
 futures-util.workspace = true
-reqwest.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
 thiserror.workspace = true
 time = { workspace = true, features = ["formatting", "parsing", "serde"] }
-tokio = { workspace = true, features = ["time"] }
-url.workspace = true
 
 [dev-dependencies]
-tokio = { workspace = true, features = ["macros", "rt"] }
+tokio = { workspace = true, features = ["macros", "rt", "time"] }
diff --git a/crates/openplotva-memory/src/lib.rs b/crates/openplotva-memory/src/lib.rs
index 5fde5395..f8505a83 100644
--- a/crates/openplotva-memory/src/lib.rs
+++ b/crates/openplotva-memory/src/lib.rs
@@ -4,41 +4,26 @@ use std::collections::{HashMap, HashSet};
 use std::error::Error as StdError;
 use std::future::Future;
 use std::pin::Pin;
-use std::time::{Duration as StdDuration, Instant, SystemTime, UNIX_EPOCH};
 
-use base64::{Engine as _, engine::general_purpose};
 use futures_util::{StreamExt as _, TryStreamExt as _, stream};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use thiserror::Error;
 use time::{Date, Month, OffsetDateTime, Time};
-use url::Url;
 
 /// Human-readable crate purpose used by scaffold tests and docs.
 pub const PURPOSE: &str = "memory";
 
 pub const DEFAULT_MEMORY_MAX_OUTPUT_TOKENS: i32 = 4000;
 pub const DEFAULT_MEMORY_MIN_MESSAGES_PER_RUN: i32 = 20;
-pub const DISCOVERY_PRIORITY_MEMORY: i32 = 10;
 pub const DEFAULT_MEMORY_CONSOLIDATION_MODEL: &str = "Gemma 4 26B Heretic";
 pub const PROMPT_VERSION: &str = "chat_memory_daily_v7";
-pub const DEFAULT_DISCOVERY_BASE_URL: &str = "http://127.0.0.1:50051";
-pub const DEFAULT_MEMORY_REDACTION_SERVICE_NAME: &str = "privacy-filter";
-pub const DEFAULT_MEMORY_REDACTION_ENDPOINT_NAME: &str = "redact";
 pub const EXTRACTION_PROMPT_OVERHEAD_TOKENS: i32 = 256;
 pub const MEMORY_TOKEN_ESTIMATOR_SOURCE: &str = "heuristic";
 pub const MAX_FACT_TEXT_LEN: usize = 700;
-pub const DEFAULT_MEMORY_REDACTION_TIMEOUT: StdDuration = StdDuration::from_secs(35);
-pub const DEFAULT_MEMORY_REDACTION_POLL_INTERVAL: StdDuration = StdDuration::from_secs(1);
 /// Redaction calls one extraction may keep in flight; matches the privacy-filter
 /// slots Discovery grants (`max_concurrent_jobs`).
 pub const DEFAULT_MEMORY_REDACTION_CONCURRENCY: usize = 4;
-/// Discovery caps `/v1/jobs/sync` and long-poll result waits at two minutes.
-const DISCOVERY_MAX_RESULT_WAIT: StdDuration = StdDuration::from_secs(120);
-/// A long-poll answer faster than this means the server ignored `wait_ms`.
-const DISCOVERY_LONG_POLL_MIN_HOLD: StdDuration = StdDuration::from_millis(50);
-pub const DEFAULT_MEMORY_REDACTION_CAPACITY_WAIT: StdDuration = StdDuration::from_secs(30);
-
 pub type Visibility = String;
 pub type CardKind = String;
 pub type CardType = String;
@@ -1488,72 +1473,6 @@ pub enum DecodeExtractionError {
     Decode,
 }
 
-/// Memory redaction transport error.
-#[derive(Debug, Error)]
-pub enum DiscoveryRedactorError {
-    /// Request body JSON serialization failed.
-    #[error("marshal memory redaction request: {0}")]
-    RequestBody(serde_json::Error),
-    /// Job body JSON serialization failed.
-    #[error("marshal memory redaction job: {0}")]
-    JobBody(serde_json::Error),
-    /// HTTP request failed.
-    #[error("{phase} memory redaction job: {source}")]
-    Request {
-        /// Request phase.
-        phase: &'static str,
-        /// Source error.
-        #[source]
-        source: reqwest::Error,
-    },
-    /// Discovery returned non-2xx.
-    #[error("{phase} memory redaction job: status {status}: {body}")]
-    Status {
-        /// Request phase.
-        phase: &'static str,
-        /// HTTP status.
-        status: u16,
-        /// Trimmed response body.
-        body: String,
-    },
-    /// Discovery response JSON decode failed.
-    #[error("decode memory redaction {phase} response: {source}")]
-    DecodeEnvelope {
-        /// Request phase.
-        phase: &'static str,
-        /// Decode error.
-        #[source]
-        source: reqwest::Error,
-    },
-    /// Waiting timed out.
-    #[error("waiting for memory redaction job {job_id}: task timeout")]
-    Timeout {
-        /// Job ID.
-        job_id: String,
-    },
-    /// Job failed.
-    #[error("memory redaction job failed: {0}")]
-    JobFailed(String),
-    /// Job failed without message.
-    #[error("memory redaction job failed with status {0:?}")]
-    JobFailedStatus(String),
-    /// Unknown terminal status.
-    #[error("unknown memory redaction job status {0:?}")]
-    UnknownStatus(String),
-    /// Success lacked a response.
-    #[error("memory redaction job succeeded without response")]
-    MissingResponse,
-    /// Upstream redactor returned non-2xx.
-    #[error("memory redaction upstream returned status {0}")]
-    UpstreamStatus(u16),
-    /// Redaction payload JSON decode failed.
-    #[error("decode memory redaction payload: {0}")]
-    DecodePayload(serde_json::Error),
-    /// Upstream did not return redacted text.
-    #[error("memory redaction response has no redacted_text")]
-    EmptyRedactedText,
-}
-
 #[derive(Clone, Debug, Error, Eq, PartialEq)]
 #[error("memory extractor is unavailable")]
 pub struct MemoryExtractorUnavailableError;
@@ -1711,69 +1630,6 @@ where
     }
 }
 
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub struct DiscoveryRedactorConfig {
-    /// Discovery base URL.
-    pub base_url: String,
-    /// Discovery service name.
-    pub service_name: String,
-    /// Discovery endpoint name.
-    pub endpoint_name: String,
-    /// HTTP timeout.
-    pub timeout: StdDuration,
-    /// Discovery task timeout.
-    pub task_timeout: StdDuration,
-    /// Poll interval.
-    pub poll_interval: StdDuration,
-    /// Capacity wait.
-    pub capacity_wait: StdDuration,
-    /// Capacity poll interval.
-    pub capacity_poll_interval: StdDuration,
-    /// Redaction categories.
-    pub categories: Vec<String>,
-}
-
-impl Default for DiscoveryRedactorConfig {
-    fn default() -> Self {
-        Self {
-            base_url: DEFAULT_DISCOVERY_BASE_URL.to_owned(),
-            service_name: DEFAULT_MEMORY_REDACTION_SERVICE_NAME.to_owned(),
-            endpoint_name: DEFAULT_MEMORY_REDACTION_ENDPOINT_NAME.to_owned(),
-            timeout: DEFAULT_MEMORY_REDACTION_TIMEOUT,
-            task_timeout: DEFAULT_MEMORY_REDACTION_TIMEOUT,
-            poll_interval: DEFAULT_MEMORY_REDACTION_POLL_INTERVAL,
-            capacity_wait: DEFAULT_MEMORY_REDACTION_CAPACITY_WAIT,
-            capacity_poll_interval: DEFAULT_MEMORY_REDACTION_POLL_INTERVAL,
-            categories: default_memory_redaction_categories(),
-        }
-    }
-}
-
-impl DiscoveryRedactorConfig {
-    #[must_use]
-    pub fn with_defaults(mut self) -> Self {
-        self.base_url = default_trimmed_string(&self.base_url, DEFAULT_DISCOVERY_BASE_URL);
-        self.service_name =
-            default_trimmed_string(&self.service_name, DEFAULT_MEMORY_REDACTION_SERVICE_NAME);
-        self.endpoint_name =
-            default_trimmed_string(&self.endpoint_name, DEFAULT_MEMORY_REDACTION_ENDPOINT_NAME);
-        self.timeout = default_duration(self.timeout, DEFAULT_MEMORY_REDACTION_TIMEOUT);
-        self.task_timeout = default_duration(self.task_timeout, DEFAULT_MEMORY_REDACTION_TIMEOUT);
-        self.poll_interval =
-            default_duration(self.poll_interval, DEFAULT_MEMORY_REDACTION_POLL_INTERVAL);
-        self.capacity_wait =
-            default_duration(self.capacity_wait, DEFAULT_MEMORY_REDACTION_CAPACITY_WAIT);
-        self.capacity_poll_interval = default_duration(
-            self.capacity_poll_interval,
-            DEFAULT_MEMORY_REDACTION_POLL_INTERVAL,
-        );
-        if self.categories.is_empty() {
-            self.categories = default_memory_redaction_categories();
-        }
-        self
-    }
-}
-
 #[must_use]
 pub fn default_memory_redaction_categories() -> Vec<String> {
     DEFAULT_MEMORY_REDACTION_CATEGORIES
@@ -1782,237 +1638,6 @@ pub fn default_memory_redaction_categories() -> Vec<String> {
         .collect()
 }
 
-#[derive(Debug)]
-pub struct DiscoveryRedactor {
-    base_url: String,
-    service_name: String,
-    endpoint_name: String,
-    task_timeout: StdDuration,
-    poll_interval: StdDuration,
-    capacity_wait: StdDuration,
-    capacity_poll_interval: StdDuration,
-    timeout: StdDuration,
-    categories: Vec<String>,
-    client: reqwest::Client,
-}
-
-impl DiscoveryRedactor {
-    /// Build a reqwest-backed Discovery redactor.
-    pub fn new(cfg: DiscoveryRedactorConfig) -> Result<Self, reqwest::Error> {
-        let client = reqwest::Client::builder().build()?;
-        Ok(Self::with_client(cfg, client))
-    }
-
-    /// Build a redactor on a shared HTTP client so consecutive calls reuse
-    /// pooled keep-alive connections instead of paying a new handshake each.
-    #[must_use]
-    pub fn with_client(cfg: DiscoveryRedactorConfig, client: reqwest::Client) -> Self {
-        let cfg = cfg.with_defaults();
-        Self {
-            base_url: cfg.base_url.trim().trim_end_matches('/').to_owned(),
-            service_name: cfg.service_name.trim().to_owned(),
-            endpoint_name: cfg.endpoint_name.trim().to_owned(),
-            task_timeout: cfg.task_timeout,
-            poll_interval: cfg.poll_interval,
-            capacity_wait: cfg.capacity_wait,
-            capacity_poll_interval: cfg.capacity_poll_interval,
-            timeout: cfg.timeout,
-            categories: cfg.categories,
-            client,
-        }
-    }
-
-    pub async fn redact_text(&self, text: &str) -> Result<String, DiscoveryRedactorError> {
-        self.redact_text_with_optional_mode(text, None).await
-    }
-
-    pub async fn redact_text_with_mode(
-        &self,
-        text: &str,
-        replacement_mode: RedactionReplacementMode,
-    ) -> Result<String, DiscoveryRedactorError> {
-        self.redact_text_with_optional_mode(text, Some(replacement_mode))
-            .await
-    }
-
-    async fn redact_text_with_optional_mode(
-        &self,
-        text: &str,
-        replacement_mode: Option<RedactionReplacementMode>,
-    ) -> Result<String, DiscoveryRedactorError> {
-        let request_id = memory_redact_id();
-        let job_id = memory_redact_id();
-        let (body, mut job_id) = self.redaction_job_body_with_ids_and_optional_mode(
-            text,
-            &request_id,
-            &job_id,
-            replacement_mode,
-        )?;
-        let envelope = self.submit_redaction_job(body).await?;
-        if let Some(resolved) = envelope.resolved_job_id() {
-            job_id = resolved;
-        }
-        match redaction_result_from_envelope(&envelope, false)? {
-            RedactionEnvelopeResult::Done(result) => Ok(result),
-            RedactionEnvelopeResult::Pending => self.poll_result(&job_id).await,
-        }
-    }
-
-    pub fn redaction_job_body(
-        &self,
-        text: &str,
-    ) -> Result<(Vec<u8>, String), DiscoveryRedactorError> {
-        let request_id = memory_redact_id();
-        let job_id = memory_redact_id();
-        self.redaction_job_body_with_ids(text, &request_id, &job_id)
-    }
-
-    pub fn redaction_job_body_with_ids(
-        &self,
-        text: &str,
-        request_id: &str,
-        job_id: &str,
-    ) -> Result<(Vec<u8>, String), DiscoveryRedactorError> {
-        self.redaction_job_body_with_ids_and_optional_mode(text, request_id, job_id, None)
-    }
-
-    pub fn redaction_job_body_with_ids_and_mode(
-        &self,
-        text: &str,
-        request_id: &str,
-        job_id: &str,
-        replacement_mode: RedactionReplacementMode,
-    ) -> Result<(Vec<u8>, String), DiscoveryRedactorError> {
-        self.redaction_job_body_with_ids_and_optional_mode(
-            text,
-            request_id,
-            job_id,
-            Some(replacement_mode),
-        )
-    }
-
-    fn redaction_job_body_with_ids_and_optional_mode(
-        &self,
-        text: &str,
-        request_id: &str,
-        job_id: &str,
-        replacement_mode: Option<RedactionReplacementMode>,
-    ) -> Result<(Vec<u8>, String), DiscoveryRedactorError> {
-        let payload = serde_json::to_vec(&RedactionRequest {
-            request_id: request_id.to_owned(),
-            text: text.to_owned(),
-            categories: self.categories.clone(),
-            replacement_mode,
-        })
-        .map_err(DiscoveryRedactorError::RequestBody)?;
-
-        let job_id = job_id.to_owned();
-        let job_req = DiscoveryRedactionJobRequest {
-            invocation: DiscoveryRedactionInvocation {
-                service_name: self.service_name.clone(),
-                endpoint_name: self.endpoint_name.clone(),
-                body: general_purpose::STANDARD.encode(payload),
-                content_type: "application/json".to_owned(),
-                timeout_ms: duration_ms(self.task_timeout),
-                ..DiscoveryRedactionInvocation::default()
-            },
-            idempotency_key: job_id.clone(),
-            priority: DISCOVERY_PRIORITY_MEMORY,
-            wait_for_capacity_ms: duration_ms(self.capacity_wait),
-            capacity_poll_ms: duration_ms(self.capacity_poll_interval),
-            wait_for_result_ms: duration_ms(self.result_wait()),
-        };
-        let body = serde_json::to_vec(&job_req).map_err(DiscoveryRedactorError::JobBody)?;
-        Ok((body, job_id))
-    }
-
-    async fn submit_redaction_job(
-        &self,
-        body: Vec<u8>,
-    ) -> Result<DiscoveryRedactionEnvelope, DiscoveryRedactorError> {
-        let response = self
-            .client
-            .post(self.endpoint("/v1/jobs/sync"))
-            .header("Content-Type", "application/json")
-            .timeout(
-                self.capacity_wait
-                    .saturating_add(self.result_wait())
-                    .saturating_add(self.timeout),
-            )
-            .body(body)
-            .send()
-            .await
-            .map_err(|source| DiscoveryRedactorError::Request {
-                phase: "submit",
-                source,
-            })?;
-        decode_redaction_envelope_response(response, "submit").await
-    }
-
-    async fn poll_result(&self, job_id: &str) -> Result<String, DiscoveryRedactorError> {
-        let deadline = Instant::now() + self.task_timeout;
-        loop {
-            if Instant::now() >= deadline {
-                return Err(DiscoveryRedactorError::Timeout {
-                    job_id: job_id.to_owned(),
-                });
-            }
-            let wait = deadline
-                .saturating_duration_since(Instant::now())
-                .min(DISCOVERY_MAX_RESULT_WAIT);
-            let asked = Instant::now();
-            let envelope = self.fetch_job(job_id, wait).await?;
-            match redaction_result_from_envelope(&envelope, true)? {
-                RedactionEnvelopeResult::Done(result) => return Ok(result),
-                RedactionEnvelopeResult::Pending => {
-                    if asked.elapsed() < DISCOVERY_LONG_POLL_MIN_HOLD {
-                        // An older Discovery ignores `wait_ms`; fall back to interval polling.
-                        tokio::time::sleep(self.poll_interval).await;
-                    }
-                }
-            }
-        }
-    }
-
-    fn result_wait(&self) -> StdDuration {
-        self.task_timeout.min(DISCOVERY_MAX_RESULT_WAIT)
-    }
-
-    async fn fetch_job(
-        &self,
-        job_id: &str,
-        wait: StdDuration,
-    ) -> Result<DiscoveryRedactionEnvelope, DiscoveryRedactorError> {
-        let response = self
-            .client
-            .get(self.endpoint(&format!(
-                "/v1/jobs/{}?wait_ms={}",
-                job_id.trim(),
-                wait.as_millis()
-            )))
-            .timeout(wait.saturating_add(self.timeout))
-            .send()
-            .await
-            .map_err(|source| DiscoveryRedactorError::Request {
-                phase: "check",
-                source,
-            })?;
-        decode_redaction_envelope_response(response, "check").await
-    }
-
-    fn endpoint(&self, path: &str) -> String {
-        endpoint_join(&self.base_url, path)
-    }
-}
-
-impl TextRedactor for DiscoveryRedactor {
-    type Error = DiscoveryRedactorError;
-
-    fn redact_text<'a>(&'a self, text: String) -> TextRedactorFuture<'a, Self::Error> {
-        Box::pin(async move { DiscoveryRedactor::redact_text(self, &text).await })
-    }
-}
-
 /// Longest evidence quote kept from an extraction. The response schema states no
 /// `maxLength`, which slows structured-output grammars, so the bound applies here.
 pub const EVIDENCE_QUOTE_MAX_CHARS: usize = 200;
@@ -3624,242 +3249,6 @@ where
     Ok(())
 }
 
-#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
-pub struct RedactionRequest {
-    /// Request ID.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub request_id: String,
-    /// Text to redact.
-    pub text: String,
-    /// Redaction categories.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub categories: Vec<String>,
-    /// Redaction replacement style. Omitted requests preserve the legacy ellipsis output.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub replacement_mode: Option<RedactionReplacementMode>,
-}
-
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum RedactionReplacementMode {
-    Ellipsis,
-    TypedPlaceholders,
-}
-
-#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
-pub struct RedactionResponse {
-    /// Redacted text.
-    pub redacted_text: String,
-}
-
-#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
-pub struct DiscoveryRedactionJobRequest {
-    /// Discovery invocation.
-    pub invocation: DiscoveryRedactionInvocation,
-    /// Idempotency key.
-    pub idempotency_key: String,
-    /// Priority.
-    pub priority: i32,
-    /// Wait-for-capacity milliseconds.
-    #[serde(default, skip_serializing_if = "is_zero_i32")]
-    pub wait_for_capacity_ms: i32,
-    /// Capacity-poll milliseconds.
-    #[serde(default, skip_serializing_if = "is_zero_i32")]
-    pub capacity_poll_ms: i32,
-    /// How long `/v1/jobs/sync` holds the submit open for the result.
-    #[serde(default, skip_serializing_if = "is_zero_i32")]
-    pub wait_for_result_ms: i32,
-}
-
-#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
-pub struct DiscoveryRedactionInvocation {
-    /// Discovery service name.
-    pub service_name: String,
-    /// Discovery endpoint name.
-    pub endpoint_name: String,
-    /// Headers.
-    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
-    pub headers: HashMap<String, String>,
-    /// Query values.
-    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
-    pub query: HashMap<String, String>,
-    /// Base64 body.
-    pub body: String,
-    /// Content type.
-    pub content_type: String,
-    /// Timeout milliseconds.
-    pub timeout_ms: i32,
-}
-
-#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
-pub struct DiscoveryRedactionEnvelope {
-    /// Nested job payload.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub job: Option<DiscoveryRedactionJob>,
-    /// Top-level ID.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub id: String,
-    /// Top-level job ID.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub job_id: String,
-    /// Top-level status.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub status: String,
-    /// Top-level state.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub state: String,
-    /// Top-level error.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub error: Option<Value>,
-    /// Top-level result.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub result: Option<DiscoveryRedactionResult>,
-}
-
-impl DiscoveryRedactionEnvelope {
-    fn normalized(self) -> Self {
-        if let Some(job) = &self.job {
-            Self {
-                id: job.id.clone(),
-                job_id: job.job_id.clone(),
-                status: job.status.clone(),
-                state: job.state.clone(),
-                error: job.error.clone(),
-                result: job.result.clone(),
-                job: self.job.clone(),
-            }
-        } else {
-            self
-        }
-    }
-
-    fn resolved_job_id(&self) -> Option<String> {
-        if let Some(job) = &self.job {
-            let job_id = job.job_id.trim();
-            if !job_id.is_empty() {
-                return Some(job_id.to_owned());
-            }
-            let id = job.id.trim();
-            return (!id.is_empty()).then(|| id.to_owned());
-        }
-        let job_id = self.job_id.trim();
-        if !job_id.is_empty() {
-            return Some(job_id.to_owned());
-        }
-        let id = self.id.trim();
-        (!id.is_empty()).then(|| id.to_owned())
-    }
-
-    fn resolved_status(&self) -> String {
-        if let Some(job) = &self.job {
-            let state = job.state.trim();
-            if !state.is_empty() {
-                return state.to_owned();
-            }
-            return job.status.trim().to_owned();
-        }
-        let state = self.state.trim();
-        if !state.is_empty() {
-            return state.to_owned();
-        }
-        self.status.trim().to_owned()
-    }
-
-    fn error_message(&self) -> String {
-        if let Some(result) = &self.result
-            && let Some(error) = &result.error
-        {
-            return error.message.clone();
-        }
-        let raw = self
-            .job
-            .as_ref()
-            .and_then(|job| job.error.as_ref())
-            .or(self.error.as_ref());
-        let Some(raw) = raw else {
-            return String::new();
-        };
-        let parsed = serde_json::from_value::<DiscoveryRedactionErrorPayload>(raw.clone());
-        if let Ok(payload) = parsed {
-            return [payload.message, payload.detail, payload.error]
-                .join(" ")
-                .trim()
-                .to_owned();
-        }
-        raw.to_string()
-    }
-}
-
-#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
-pub struct DiscoveryRedactionJob {
-    /// Job ID.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub id: String,
-    /// Job ID alias.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub job_id: String,
-    /// Status.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub status: String,
-    /// State.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub state: String,
-    /// Error payload.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub error: Option<Value>,
-    /// Result.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub result: Option<DiscoveryRedactionResult>,
-}
-
-#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
-pub struct DiscoveryRedactionResult {
-    /// HTTP response.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub response: Option<DiscoveryRedactionHttpResponse>,
-    /// Discovery error.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub error: Option<DiscoveryRedactionResultError>,
-}
-
-#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
-pub struct DiscoveryRedactionHttpResponse {
-    /// Status code.
-    #[serde(default, skip_serializing_if = "is_zero_u16")]
-    pub status_code: u16,
-    /// Body.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub body: String,
-    /// Content type.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub content_type: String,
-}
-
-#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
-pub struct DiscoveryRedactionResultError {
-    /// Error code.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub code: String,
-    /// Error message.
-    #[serde(default, skip_serializing_if = "String::is_empty")]
-    pub message: String,
-}
-
-#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq)]
-struct DiscoveryRedactionErrorPayload {
-    #[serde(default)]
-    message: String,
-    #[serde(default)]
-    detail: String,
-    #[serde(default)]
-    error: String,
-}
-
-enum RedactionEnvelopeResult {
-    Pending,
-    Done(String),
-}
-
 #[must_use]
 pub fn format_context(memory: &RetrievedMemory) -> String {
     if memory.cards.is_empty() && memory.episodes.is_empty() {
@@ -4169,10 +3558,6 @@ const fn is_zero_i64(value: &i64) -> bool {
     *value == 0
 }
 
-const fn is_zero_u16(value: &u16) -> bool {
-    *value == 0
-}
-
 fn go_zero_time() -> OffsetDateTime {
     Date::from_calendar_date(1, Month::January, 1)
         .expect("zero date is valid")
@@ -4476,191 +3861,6 @@ fn contains_ascii_fold(value: &str, needle: &str) -> bool {
         .any(|index| value[index..index + needle.len()].eq_ignore_ascii_case(needle))
 }
 
-async fn decode_redaction_envelope_response(
-    response: reqwest::Response,
-    phase: &'static str,
-) -> Result<DiscoveryRedactionEnvelope, DiscoveryRedactorError> {
-    let status = response.status();
-    if !status.is_success() {
-        let status_code = status.as_u16();
-        let body = response.text().await.unwrap_or_default().trim().to_owned();
-        return Err(DiscoveryRedactorError::Status {
-            phase,
-            status: status_code,
-            body,
-        });
-    }
-    response
-        .json::<DiscoveryRedactionEnvelope>()
-        .await
-        .map(DiscoveryRedactionEnvelope::normalized)
-        .map_err(|source| DiscoveryRedactorError::DecodeEnvelope { phase, source })
-}
-
-fn redaction_result_from_envelope(
-    envelope: &DiscoveryRedactionEnvelope,
-    unknown_is_error: bool,
-) -> Result<RedactionEnvelopeResult, DiscoveryRedactorError> {
-    match normalize_discovery_status(&envelope.resolved_status()).as_str() {
-        "queued" | "running" => return Ok(RedactionEnvelopeResult::Pending),
-        "succeeded" => {
-            return decode_redaction_result(envelope.result.as_ref())
-                .map(RedactionEnvelopeResult::Done);
-        }
-        "failed" | "canceled" | "cancelled" => return Err(redaction_job_failed_error(envelope)),
-        _ => {}
-    }
-    if envelope
-        .result
-        .as_ref()
-        .and_then(|result| result.response.as_ref())
-        .is_some()
-    {
-        return decode_redaction_result(envelope.result.as_ref())
-            .map(RedactionEnvelopeResult::Done);
-    }
-    if unknown_is_error {
-        return Err(DiscoveryRedactorError::UnknownStatus(
-            envelope.resolved_status(),
-        ));
-    }
-    Ok(RedactionEnvelopeResult::Pending)
-}
-
-fn redaction_job_failed_error(envelope: &DiscoveryRedactionEnvelope) -> DiscoveryRedactorError {
-    let message = envelope.error_message();
-    if message.trim().is_empty() {
-        DiscoveryRedactorError::JobFailedStatus(envelope.resolved_status())
-    } else {
-        DiscoveryRedactorError::JobFailed(message)
-    }
-}
-
-fn decode_redaction_result(
-    result: Option<&DiscoveryRedactionResult>,
-) -> Result<String, DiscoveryRedactorError> {
-    let response = result
-        .and_then(|result| result.response.as_ref())
-        .ok_or(DiscoveryRedactorError::MissingResponse)?;
-    if !(200..300).contains(&response.status_code) {
-        return Err(DiscoveryRedactorError::UpstreamStatus(response.status_code));
-    }
-    let body = decode_discovery_body(&response.body);
-    let parsed = serde_json::from_slice::<RedactionResponse>(&body)
-        .map_err(DiscoveryRedactorError::DecodePayload)?;
-    if parsed.redacted_text.is_empty() {
-        return Err(DiscoveryRedactorError::EmptyRedactedText);
-    }
-    Ok(parsed.redacted_text)
-}
-
-fn decode_discovery_body(value: &str) -> Vec<u8> {
-    let value = value.trim();
-    if value.is_empty() {
-        return Vec::new();
-    }
-    if value.starts_with('{') || value.starts_with('[') {
-        return value.as_bytes().to_vec();
-    }
-    for encoding in [
-        &general_purpose::STANDARD,
-        &general_purpose::STANDARD_NO_PAD,
-        &general_purpose::URL_SAFE,
-        &general_purpose::URL_SAFE_NO_PAD,
-    ] {
-        if let Ok(decoded) = encoding.decode(value) {
-            return decoded;
-        }
-    }
-    value.as_bytes().to_vec()
-}
-
-fn normalize_discovery_status(value: &str) -> String {
-    let mut value = value.trim();
-    if value.len() >= "job_state_".len()
-        && value[.."job_state_".len()].eq_ignore_ascii_case("job_state_")
-    {
-        value = &value["job_state_".len()..];
-    }
-    for known in [
-        "queued",
-        "running",
-        "succeeded",
-        "failed",
-        "canceled",
-        "cancelled",
-    ] {
-        if value.eq_ignore_ascii_case(known) {
-            return known.to_owned();
-        }
-    }
-    value.to_lowercase()
-}
-
-fn endpoint_join(base_url: &str, path: &str) -> String {
-    let path = clean_url_path(path);
-    let Ok(mut base) = Url::parse(base_url) else {
-        return format!("{}{}", base_url.trim_end_matches('/'), path);
-    };
-    let joined_path = join_url_paths(base.path(), &path);
-    base.set_path(&joined_path);
-    base.to_string()
-}
-
-fn join_url_paths(base_path: &str, path: &str) -> String {
-    let mut parts = Vec::new();
-    for part in base_path.split('/').chain(path.split('/')) {
-        match part {
-            "" | "." => {}
-            ".." => {
-                let _ = parts.pop();
-            }
-            value => parts.push(value),
-        }
-    }
-    if parts.is_empty() {
-        "/".to_owned()
-    } else {
-        format!("/{}", parts.join("/"))
-    }
-}
-
-fn clean_url_path(path: &str) -> String {
-    if path.starts_with('/') {
-        path.to_owned()
-    } else {
-        format!("/{path}")
-    }
-}
-
-fn default_duration(value: StdDuration, fallback: StdDuration) -> StdDuration {
-    if value.is_zero() { fallback } else { value }
-}
-
-fn default_trimmed_string(value: &str, fallback: &str) -> String {
-    if value.trim().is_empty() {
-        fallback.to_owned()
-    } else {
-        value.to_owned()
-    }
-}
-
-fn duration_ms(value: StdDuration) -> i32 {
-    if value.is_zero() {
-        0
-    } else {
-        i32::try_from(value.as_millis()).unwrap_or(i32::MAX)
-    }
-}
-
-fn memory_redact_id() -> String {
-    let nanos = SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|duration| duration.as_nanos())
-        .unwrap_or(0);
-    format!("memory-redact-{nanos}")
-}
-
 struct CachedRedactor<F> {
     redact: F,
     cache: HashMap<String, String>,
@@ -4814,6 +4014,7 @@ mod tests {
     use super::*;
     use std::fmt;
     use std::sync::{Arc, Mutex as StdMutex};
+    use std::time::Duration as StdDuration;
 
     #[tokio::test]
     async fn redacts_each_distinct_value_once_with_bounded_parallelism() {
@@ -6067,174 +5268,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn discovery_redactor_defaults_match_go_privacy_filter_config() {
-        let cfg = DiscoveryRedactorConfig {
-            base_url: "  ".to_owned(),
-            service_name: String::new(),
-            endpoint_name: String::new(),
-            timeout: StdDuration::ZERO,
-            task_timeout: StdDuration::ZERO,
-            poll_interval: StdDuration::ZERO,
-            capacity_wait: StdDuration::ZERO,
-            capacity_poll_interval: StdDuration::ZERO,
-            categories: Vec::new(),
-        }
-        .with_defaults();
-
-        assert_eq!(cfg.base_url, DEFAULT_DISCOVERY_BASE_URL);
-        assert_eq!(cfg.service_name, DEFAULT_MEMORY_REDACTION_SERVICE_NAME);
-        assert_eq!(cfg.endpoint_name, DEFAULT_MEMORY_REDACTION_ENDPOINT_NAME);
-        assert_eq!(cfg.timeout, DEFAULT_MEMORY_REDACTION_TIMEOUT);
-        assert_eq!(cfg.task_timeout, DEFAULT_MEMORY_REDACTION_TIMEOUT);
-        assert_eq!(cfg.poll_interval, DEFAULT_MEMORY_REDACTION_POLL_INTERVAL);
-        assert_eq!(cfg.capacity_wait, DEFAULT_MEMORY_REDACTION_CAPACITY_WAIT);
-        assert_eq!(
-            cfg.capacity_poll_interval,
-            DEFAULT_MEMORY_REDACTION_POLL_INTERVAL
-        );
-        assert_eq!(cfg.categories, default_memory_redaction_categories());
-    }
-
-    #[test]
-    fn discovery_redactor_job_body_matches_go_discovery_shape() {
-        let redactor = DiscoveryRedactor::new(DiscoveryRedactorConfig {
-            base_url: "http://discovery.test/root/".to_owned(),
-            service_name: "privacy-filter".to_owned(),
-            endpoint_name: "redact".to_owned(),
-            timeout: StdDuration::from_secs(5),
-            task_timeout: StdDuration::from_secs(35),
-            poll_interval: StdDuration::from_secs(1),
-            capacity_wait: StdDuration::from_secs(30),
-            capacity_poll_interval: StdDuration::from_secs(1),
-            categories: vec!["private_email".to_owned(), "secret".to_owned()],
-        })
-        .expect("redactor");
-
-        let (body, job_id) = redactor
-            .redaction_job_body_with_ids(
-                "email alice@example.com",
-                "memory-redact-111",
-                "memory-redact-222",
-            )
-            .expect("body");
-        let submitted =
-            serde_json::from_slice::<DiscoveryRedactionJobRequest>(&body).expect("job request");
-        let payload_bytes = general_purpose::STANDARD
-            .decode(&submitted.invocation.body)
-            .expect("payload b64");
-        let payload = serde_json::from_slice::<RedactionRequest>(&payload_bytes).expect("payload");
-
-        assert_eq!(job_id, "memory-redact-222");
-        assert_eq!(submitted.idempotency_key, "memory-redact-222");
-        assert_eq!(submitted.priority, DISCOVERY_PRIORITY_MEMORY);
-        assert_eq!(submitted.wait_for_capacity_ms, 30_000);
-        assert_eq!(submitted.capacity_poll_ms, 1_000);
-        assert_eq!(submitted.invocation.service_name, "privacy-filter");
-        assert_eq!(submitted.invocation.endpoint_name, "redact");
-        assert_eq!(submitted.invocation.content_type, "application/json");
-        assert_eq!(submitted.invocation.timeout_ms, 35_000);
-        assert_eq!(payload.request_id, "memory-redact-111");
-        assert_eq!(payload.text, "email alice@example.com");
-        assert_eq!(payload.categories, vec!["private_email", "secret"]);
-        assert_eq!(payload.replacement_mode, None);
-        assert_eq!(
-            redactor.endpoint("/v1/jobs/blocking"),
-            "http://discovery.test/root/v1/jobs/blocking"
-        );
-    }
-
-    #[test]
-    fn discovery_redactor_job_body_supports_typed_placeholders() {
-        let redactor =
-            DiscoveryRedactor::new(DiscoveryRedactorConfig::default()).expect("redactor");
-
-        let (body, _) = redactor
-            .redaction_job_body_with_ids_and_mode(
-                "email alice@example.com",
-                "gradius-redact-111",
-                "gradius-redact-222",
-                RedactionReplacementMode::TypedPlaceholders,
-            )
-            .expect("body");
-        let submitted =
-            serde_json::from_slice::<DiscoveryRedactionJobRequest>(&body).expect("job request");
-        let payload_bytes = general_purpose::STANDARD
-            .decode(&submitted.invocation.body)
-            .expect("payload b64");
-        let payload = serde_json::from_slice::<RedactionRequest>(&payload_bytes).expect("payload");
-
-        assert_eq!(
-            payload.replacement_mode,
-            Some(RedactionReplacementMode::TypedPlaceholders)
-        );
-    }
-
-    #[test]
-    fn discovery_redactor_result_decodes_status_body_and_errors_like_go() {
-        let plain = DiscoveryRedactionEnvelope {
-            status: "JOB_STATE_SUCCEEDED".to_owned(),
-            result: Some(DiscoveryRedactionResult {
-                response: Some(DiscoveryRedactionHttpResponse {
-                    status_code: 200,
-                    body: serde_json::json!({"redacted_text": "[redacted]"}).to_string(),
-                    ..DiscoveryRedactionHttpResponse::default()
-                }),
-                ..DiscoveryRedactionResult::default()
-            }),
-            ..DiscoveryRedactionEnvelope::default()
-        };
-        let b64 = DiscoveryRedactionEnvelope {
-            state: "succeeded".to_owned(),
-            result: Some(DiscoveryRedactionResult {
-                response: Some(DiscoveryRedactionHttpResponse {
-                    status_code: 200,
-                    body: general_purpose::URL_SAFE_NO_PAD.encode(r#"{"redacted_text":"ok"}"#),
-                    ..DiscoveryRedactionHttpResponse::default()
-                }),
-                ..DiscoveryRedactionResult::default()
-            }),
-            ..DiscoveryRedactionEnvelope::default()
-        };
-        let nested = DiscoveryRedactionEnvelope {
-            job: Some(DiscoveryRedactionJob {
-                id: "id-1".to_owned(),
-                job_id: "job-1".to_owned(),
-                state: "running".to_owned(),
-                ..DiscoveryRedactionJob::default()
-            }),
-            ..DiscoveryRedactionEnvelope::default()
-        }
-        .normalized();
-        let failed = DiscoveryRedactionEnvelope {
-            status: "failed".to_owned(),
-            error: Some(serde_json::json!({"message":"bad","detail":"input"})),
-            ..DiscoveryRedactionEnvelope::default()
-        };
-
-        match redaction_result_from_envelope(&plain, true).expect("plain") {
-            RedactionEnvelopeResult::Done(value) => assert_eq!(value, "[redacted]"),
-            RedactionEnvelopeResult::Pending => panic!("plain should be done"),
-        }
-        match redaction_result_from_envelope(&b64, true).expect("b64") {
-            RedactionEnvelopeResult::Done(value) => assert_eq!(value, "ok"),
-            RedactionEnvelopeResult::Pending => panic!("b64 should be done"),
-        }
-        assert!(matches!(
-            redaction_result_from_envelope(&nested, true).expect("nested"),
-            RedactionEnvelopeResult::Pending
-        ));
-        assert_eq!(nested.resolved_job_id().as_deref(), Some("job-1"));
-        assert!(matches!(
-            redaction_result_from_envelope(&failed, true),
-            Err(DiscoveryRedactorError::JobFailed(message)) if message == "bad input"
-        ));
-        assert!(matches!(
-            redaction_result_from_envelope(&DiscoveryRedactionEnvelope::default(), true),
-            Err(DiscoveryRedactorError::UnknownStatus(status)) if status.is_empty()
-        ));
-    }
-
     #[tokio::test]
     async fn redacting_memory_extractor_redacts_output_and_caches_values() {
         let output = ExtractOutput {
diff --git a/crates/openplotva-prompts/src/lib.rs b/crates/openplotva-prompts/src/lib.rs
index 60a73abb..3bbd8801 100644
--- a/crates/openplotva-prompts/src/lib.rs
+++ b/crates/openplotva-prompts/src/lib.rs
@@ -541,9 +541,14 @@ mod tests {
 
     impl TestPromptRoot {
         fn new() -> Result<Self, Box<dyn std::error::Error>> {
+            static NEXT_DIRECTORY: std::sync::atomic::AtomicU64 =
+                std::sync::atomic::AtomicU64::new(0);
+            let directory_id = NEXT_DIRECTORY.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
             let nonce = SystemTime::now().duration_since(UNIX_EPOCH)?.as_nanos();
-            let root = std::env::temp_dir()
-                .join(format!("openplotva-prompts-{}-{nonce}", std::process::id()));
+            let root = std::env::temp_dir().join(format!(
+                "openplotva-prompts-{}-{nonce}-{directory_id}",
+                std::process::id()
+            ));
             fs::create_dir_all(&root)?;
             Ok(Self(root))
         }
diff --git a/crates/openplotva-server/Cargo.toml b/crates/openplotva-server/Cargo.toml
index 9d47d00a..3400feb6 100644
--- a/crates/openplotva-server/Cargo.toml
+++ b/crates/openplotva-server/Cargo.toml
@@ -26,6 +26,7 @@ tracing.workspace = true
 x509-parser = "0.18.1"
 
 [dev-dependencies]
+tower = { version = "0.5.3", features = ["util"] }
 hex.workspace = true
 tokio = { workspace = true, features = ["macros", "rt"] }
 
diff --git a/crates/openplotva-server/src/lib.rs b/crates/openplotva-server/src/lib.rs
index 2052183c..151bc96c 100644
--- a/crates/openplotva-server/src/lib.rs
+++ b/crates/openplotva-server/src/lib.rs
@@ -2,19 +2,12 @@
 
 mod runtime_graphql;
 
-use std::{
-    env,
-    future::Future,
-    net::SocketAddr,
-    pin::Pin,
-    sync::{Arc, LazyLock},
-    time::Instant as StdInstant,
-};
+use std::{future::Future, net::SocketAddr, pin::Pin, sync::Arc};
 
 use axum::{
     Json, Router,
     body::Bytes,
-    extract::{Path, State},
+    extract::State,
     http::{HeaderMap, Method, StatusCode, header},
     response::{IntoResponse, Response},
     routing::{any, get},
@@ -124,31 +117,6 @@ pub const RUNTIME_API_TOKEN_ID_BYTES: usize = 8;
 
 pub const RUNTIME_API_TOKEN_SECRET_SIZE: usize = 32;
 
-pub const RUNTIME_API_PPROF_PROFILES: [&str; 9] = [
-    "allocs",
-    "block",
-    "cmdline",
-    "goroutine",
-    "heap",
-    "mutex",
-    "profile",
-    "symbol",
-    "trace",
-];
-
-pub const RUNTIME_API_PPROF_SUBTREE_PROFILES: [&str; 10] = [
-    "allocs",
-    "block",
-    "cmdline",
-    "goroutine",
-    "heap",
-    "mutex",
-    "profile",
-    "symbol",
-    "threadcreate",
-    "trace",
-];
-
 pub const ACTION_SEND_TEXT: &str = "send_text";
 pub const ACTION_SEND_IMAGE: &str = "send_image";
 pub const ACTION_SEND_STICKER: &str = "send_sticker";
@@ -283,8 +251,6 @@ struct RuntimeApiState<Validator> {
     graphql: RuntimeApiSchema,
 }
 
-static RUNTIME_API_DIAGNOSTICS_STARTED: LazyLock<StdInstant> = LazyLock::new(StdInstant::now);
-
 pub fn runtime_api_tls_acceptor_from_pem(
     cert_pem: &[u8],
     key_pem: &[u8],
@@ -498,11 +464,6 @@ where
     });
     Router::new()
         .route("/graphql", any(runtime_api_graphql::<Validator>))
-        .route("/debug/pprof/", any(runtime_api_pprof_index::<Validator>))
-        .route(
-            "/debug/pprof/{*path}",
-            any(runtime_api_pprof_path::<Validator>),
-        )
         .fallback(runtime_api_not_found::<Validator>)
         .with_state(state)
 }
@@ -535,33 +496,6 @@ where
     Json(state.graphql.execute(request).await).into_response()
 }
 
-async fn runtime_api_pprof_index<Validator>(
-    State(state): State<Arc<RuntimeApiState<Validator>>>,
-    headers: HeaderMap,
-) -> Response
-where
-    Validator: RuntimeTokenValidator + Send + Sync,
-{
-    if !runtime_api_is_authorized(state.as_ref(), &headers).await {
-        return runtime_api_unauthorized_response();
-    }
-    runtime_api_pprof_response("")
-}
-
-async fn runtime_api_pprof_path<Validator>(
-    State(state): State<Arc<RuntimeApiState<Validator>>>,
-    Path(path): Path<String>,
-    headers: HeaderMap,
-) -> Response
-where
-    Validator: RuntimeTokenValidator + Send + Sync,
-{
-    if !runtime_api_is_authorized(state.as_ref(), &headers).await {
-        return runtime_api_unauthorized_response();
-    }
-    runtime_api_pprof_response(&path)
-}
-
 async fn runtime_api_not_found<Validator>(
     State(state): State<Arc<RuntimeApiState<Validator>>>,
     headers: HeaderMap,
@@ -611,123 +545,6 @@ pub fn runtime_api_method_not_allowed_response() -> Response {
         .into_response()
 }
 
-#[must_use]
-pub fn runtime_api_pprof_response(path: &str) -> Response {
-    let profile = path.trim_matches('/');
-    if profile.is_empty() {
-        return runtime_api_pprof_index_response();
-    }
-    match profile {
-        "cmdline" => runtime_api_pprof_cmdline_response(),
-        "profile" => runtime_api_pprof_cpu_profile_response(),
-        "trace" => runtime_api_pprof_text_response(
-            "trace",
-            "scheduler tracing is not collected by the Rust runtime shell yet",
-        ),
-        "symbol" => (
-            StatusCode::OK,
-            [(header::CONTENT_TYPE, "text/plain; charset=utf-8")],
-            "num_symbols: 0\n",
-        )
-            .into_response(),
-        "goroutine" => runtime_api_pprof_text_response(
-            "goroutine",
-            "Rust exposes OS threads/tasks differently; current process/thread metadata follows",
-        ),
-        "heap" | "allocs" => runtime_api_pprof_text_response(
-            profile,
-            "allocator profile capture is not enabled; process metadata follows",
-        ),
-        "mutex" | "block" => runtime_api_pprof_text_response(
-            profile,
-            "contention profile capture is not enabled; process metadata follows",
-        ),
-        "threadcreate" => runtime_api_pprof_text_response(
-            "threadcreate",
-            "Rust thread creation profiling is not enabled; process metadata follows",
-        ),
-        _ => (
-            StatusCode::NOT_FOUND,
-            [(header::CONTENT_TYPE, "text/plain; charset=utf-8")],
-            format!("unknown profile: {profile}\n"),
-        )
-            .into_response(),
-    }
-}
-
-fn runtime_api_pprof_index_response() -> Response {
-    let links = RUNTIME_API_PPROF_SUBTREE_PROFILES
-        .iter()
-        .map(|profile| format!("<li><a href=\"{profile}\">{profile}</a></li>"))
-        .collect::<Vec<_>>()
-        .join("\n");
-    (
-        StatusCode::OK,
-        [(header::CONTENT_TYPE, "text/html; charset=utf-8")],
-        format!(
-            "<html><head><title>/debug/pprof/</title></head><body>\
-             <h1>OpenPlotva runtime diagnostics</h1>\
-             <p>Runtime process diagnostics endpoint.</p>\
-             <ul>{links}</ul>\
-             </body></html>\n"
-        ),
-    )
-        .into_response()
-}
-
-fn runtime_api_pprof_cmdline_response() -> Response {
-    let mut body = env::args().collect::<Vec<_>>().join("\0");
-    body.push('\0');
-    (
-        StatusCode::OK,
-        [(header::CONTENT_TYPE, "text/plain; charset=utf-8")],
-        body,
-    )
-        .into_response()
-}
-
-fn runtime_api_pprof_cpu_profile_response() -> Response {
-    runtime_api_pprof_text_response(
-        "profile",
-        "CPU profile capture is intentionally unavailable; process metadata follows",
-    )
-}
-
-fn runtime_api_pprof_text_response(profile: &str, note: &str) -> Response {
-    (
-        StatusCode::OK,
-        [(header::CONTENT_TYPE, "text/plain; charset=utf-8")],
-        runtime_api_pprof_text(profile, note),
-    )
-        .into_response()
-}
-
-fn runtime_api_pprof_text(profile: &str, note: &str) -> String {
-    let uptime = RUNTIME_API_DIAGNOSTICS_STARTED.elapsed();
-    let parallelism = std::thread::available_parallelism().map_or(0, usize::from);
-    let executable = env::current_exe()
-        .map(|path| path.display().to_string())
-        .unwrap_or_else(|_| "<unknown>".to_owned());
-    let current_dir = env::current_dir()
-        .map(|path| path.display().to_string())
-        .unwrap_or_else(|_| "<unknown>".to_owned());
-    format!(
-        "openplotva runtime profile analogue\n\
-         profile: {profile}\n\
-         note: {note}\n\
-         pid: {}\n\
-         uptime_seconds: {}\n\
-         available_parallelism: {parallelism}\n\
-         executable: {executable}\n\
-         current_dir: {current_dir}\n\
-         target: {}-{}\n",
-        std::process::id(),
-        uptime.as_secs(),
-        env::consts::OS,
-        env::consts::ARCH
-    )
-}
-
 #[derive(Clone)]
 struct AppState {
     readiness: ReadinessResponse,
@@ -961,9 +778,9 @@ mod tests {
         rate_limit_key, rate_limited_chat_key, runtime_api_graphql_schema,
         runtime_api_graphql_schema_with_diagnostics,
         runtime_api_graphql_schema_with_live_diagnostics, runtime_api_graphql_schema_with_redis,
-        runtime_api_method_not_allowed_response, runtime_api_pprof_response,
-        runtime_api_tls_config_from_pem, runtime_api_unauthorized_response,
-        runtime_token_expired_at, runtime_token_secret_hash_matches, vip_cache_key,
+        runtime_api_method_not_allowed_response, runtime_api_tls_config_from_pem,
+        runtime_api_unauthorized_response, runtime_token_expired_at,
+        runtime_token_secret_hash_matches, vip_cache_key,
     };
     use axum::{body::to_bytes, http::header};
     use std::sync::Arc;
@@ -3200,72 +3017,68 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn runtime_api_pprof_routes_return_rust_diagnostic_analogues() {
-        let index = runtime_api_pprof_response("");
-        assert_eq!(index.status(), axum::http::StatusCode::OK);
-        let body = to_bytes(index.into_body(), 4096)
-            .await
-            .unwrap_or_else(|error| panic!("read pprof index body: {error}"));
-        let body = String::from_utf8(body.to_vec())
-            .unwrap_or_else(|error| panic!("pprof index utf8: {error}"));
-        for profile in super::RUNTIME_API_PPROF_SUBTREE_PROFILES {
-            assert!(body.contains(&format!("href=\"{profile}\"")));
-        }
+    async fn removed_profiles_use_authenticated_not_found_fallback() {
+        use axum::{
+            body::Body,
+            http::{Request, StatusCode},
+        };
+        use tower::ServiceExt;
 
-        let cmdline = runtime_api_pprof_response("cmdline");
-        assert_eq!(cmdline.status(), axum::http::StatusCode::OK);
-        let body = to_bytes(cmdline.into_body(), 16 * 1024)
-            .await
-            .unwrap_or_else(|error| panic!("read cmdline body: {error}"));
-        assert!(body.ends_with(b"\0"));
-
-        let profile = runtime_api_pprof_response("profile");
-        assert_eq!(profile.status(), axum::http::StatusCode::OK);
-        let content_type = profile
-            .headers()
-            .get(axum::http::header::CONTENT_TYPE)
-            .and_then(|value| value.to_str().ok())
-            .unwrap_or_default()
-            .to_owned();
-        assert!(content_type.starts_with("text/plain"));
-        let body = to_bytes(profile.into_body(), 1024 * 1024)
-            .await
-            .unwrap_or_else(|error| panic!("read profile body: {error}"));
-        let body = String::from_utf8(body.to_vec())
-            .unwrap_or_else(|error| panic!("profile fallback utf8: {error}"));
-        assert!(body.contains("profile: profile"));
-        assert!(body.contains("intentionally unavailable"));
-
-        let heap = runtime_api_pprof_response("heap");
-        assert_eq!(heap.status(), axum::http::StatusCode::OK);
-        let body = to_bytes(heap.into_body(), 4096)
-            .await
-            .unwrap_or_else(|error| panic!("read heap body: {error}"));
-        let body =
-            String::from_utf8(body.to_vec()).unwrap_or_else(|error| panic!("heap utf8: {error}"));
-        assert!(body.contains("profile: heap"));
-        assert!(body.contains("pid:"));
-        assert!(body.contains("target:"));
-
-        let threadcreate = runtime_api_pprof_response("threadcreate");
-        assert_eq!(threadcreate.status(), axum::http::StatusCode::OK);
-        let body = to_bytes(threadcreate.into_body(), 4096)
+        struct Validator;
+        impl super::RuntimeTokenValidator for Validator {
+            fn validate_runtime_token<'a>(
+                &'a self,
+                token: &'a str,
+            ) -> super::RuntimeTokenValidationFuture<'a> {
+                Box::pin(async move { token == "test-token" })
+            }
+        }
+        let router = super::runtime_api_router_with_graphql_live_diagnostics(
+            Validator,
+            Default::default(),
+            Default::default(),
+        );
+        for path in [
+            "/debug/pprof/",
+            "/debug/pprof/heap",
+            "/debug/pprof/profile",
+            "/missing",
+        ] {
+            for (token, expected) in [
+                ("test-token", StatusCode::NOT_FOUND),
+                ("invalid", StatusCode::UNAUTHORIZED),
+            ] {
+                let response = router
+                    .clone()
+                    .oneshot(
+                        Request::builder()
+                            .uri(path)
+                            .header(header::AUTHORIZATION, format!("Bearer {token}"))
+                            .body(Body::empty())
+                            .expect("request"),
+                    )
+                    .await
+                    .expect("response");
+                assert_eq!(response.status(), expected, "{path}");
+            }
+        }
+        let response = router
+            .oneshot(
+                Request::builder()
+                    .uri("/graphql")
+                    .method("POST")
+                    .header(header::AUTHORIZATION, "Bearer test-token")
+                    .body(Body::from(r#"{"query":"{ __typename }"}"#))
+                    .expect("request"),
+            )
             .await
-            .unwrap_or_else(|error| panic!("read threadcreate body: {error}"));
-        let body = String::from_utf8(body.to_vec())
-            .unwrap_or_else(|error| panic!("threadcreate utf8: {error}"));
-        assert!(body.contains("profile: threadcreate"));
-
-        let symbol = runtime_api_pprof_response("symbol");
-        let body = to_bytes(symbol.into_body(), 1024)
+            .expect("graphql response");
+        assert_eq!(response.status(), StatusCode::OK);
+        let body = to_bytes(response.into_body(), 4096)
             .await
-            .unwrap_or_else(|error| panic!("read symbol body: {error}"));
-        assert_eq!(&body[..], b"num_symbols: 0\n");
-
-        assert_eq!(
-            runtime_api_pprof_response("unknown").status(),
-            axum::http::StatusCode::NOT_FOUND
-        );
+            .expect("graphql body");
+        let value: serde_json::Value = serde_json::from_slice(&body).expect("graphql json");
+        assert!(value.get("errors").is_none(), "{value}");
     }
 
     #[test]
diff --git a/crates/openplotva-storage/src/app_settings.rs b/crates/openplotva-storage/src/app_settings.rs
new file mode 100644
index 00000000..fd207c91
--- /dev/null
+++ b/crates/openplotva-storage/src/app_settings.rs
@@ -0,0 +1,38 @@
+//! Persisted application settings, usable in an existing transaction.
+
+use crate::StorageError;
+use sqlx::{Executor, Postgres};
+
+pub async fn app_setting<'a>(
+    executor: impl Executor<'a, Database = Postgres>,
+    key: &'a str,
+) -> Result<Option<String>, StorageError> {
+    Ok(
+        sqlx::query_scalar("SELECT value FROM app_settings WHERE key = $1")
+            .bind(key)
+            .fetch_optional(executor)
+            .await?,
+    )
+}
+
+pub async fn upsert_app_setting<'a>(
+    executor: impl Executor<'a, Database = Postgres>,
+    key: &'a str,
+    value: &'a str,
+) -> Result<(), StorageError> {
+    sqlx::query("INSERT INTO app_settings (key, value, updated_at) VALUES ($1, $2, NOW()) ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()")
+        .bind(key).bind(value).execute(executor).await?;
+    Ok(())
+}
+
+pub async fn app_setting_present<'a>(
+    executor: impl Executor<'a, Database = Postgres>,
+    key: &'a str,
+) -> Result<bool, StorageError> {
+    Ok(
+        sqlx::query_scalar("SELECT EXISTS(SELECT 1 FROM app_settings WHERE key = $1)")
+            .bind(key)
+            .fetch_one(executor)
+            .await?,
+    )
+}
diff --git a/crates/openplotva-storage/src/entities.rs b/crates/openplotva-storage/src/entities.rs
new file mode 100644
index 00000000..47acf8f1
--- /dev/null
+++ b/crates/openplotva-storage/src/entities.rs
@@ -0,0 +1,423 @@
+//! Stored Telegram entity profiles shared by HTTP and runtime API adapters.
+
+use crate::StorageError;
+use sqlx::{FromRow, PgPool, Row};
+use time::OffsetDateTime;
+
+#[derive(Clone, Debug, serde::Deserialize, sqlx::FromRow)]
+pub struct TelegramUserProfile {
+    pub id: i64,
+    pub is_premium: Option<bool>,
+    pub first_name: String,
+    pub last_name: Option<String>,
+    pub username: Option<String>,
+    pub language_code: Option<String>,
+    pub is_vip: Option<bool>,
+    pub settings: Option<serde_json::Value>,
+    #[serde(with = "time::serde::rfc3339::option")]
+    pub discovered: Option<OffsetDateTime>,
+    #[serde(with = "time::serde::rfc3339::option")]
+    pub updated: Option<OffsetDateTime>,
+}
+
+#[derive(Clone, Debug, sqlx::FromRow)]
+pub struct TelegramChatProfile {
+    pub id: i64,
+    #[sqlx(rename = "type")]
+    pub chat_type: String,
+    pub title: Option<String>,
+    pub username: Option<String>,
+    pub first_name: Option<String>,
+    pub last_name: Option<String>,
+    pub is_forum: Option<bool>,
+    pub active_usernames: Option<serde_json::Value>,
+    pub available_reactions: Option<serde_json::Value>,
+    pub bio: Option<String>,
+    pub has_private_forwards: Option<bool>,
+    pub has_restricted_voice_and_video_messages: Option<bool>,
+    pub join_to_send_messages: Option<bool>,
+    pub join_by_request: Option<bool>,
+    pub description: Option<String>,
+    pub invite_link: Option<String>,
+    pub pinned_message: Option<serde_json::Value>,
+    pub permissions: Option<serde_json::Value>,
+    pub slow_mode_delay: Option<i64>,
+    pub message_auto_delete_time: Option<i64>,
+    pub has_aggressive_anti_spam_enabled: Option<bool>,
+    pub has_hidden_members: Option<bool>,
+    pub has_protected_content: Option<bool>,
+    pub has_visible_history: Option<bool>,
+    pub sticker_set_name: Option<String>,
+    pub can_set_sticker_set: Option<bool>,
+    pub linked_chat_id: Option<i64>,
+    pub location: Option<serde_json::Value>,
+    pub discovered: Option<OffsetDateTime>,
+    pub updated: Option<OffsetDateTime>,
+}
+
+const SQL_COUNT_USERS_FILTERED: &str = r#"
+SELECT COUNT(*)::int
+FROM telegram_users_effective
+WHERE (
+    $1::text IS NULL
+    OR username ILIKE '%' || $1::text || '%'
+    OR first_name ILIKE '%' || $1::text || '%'
+    OR last_name ILIKE '%' || $1::text || '%'
+)"#;
+
+const SQL_LIST_USERS_FILTERED: &str = r#"
+SELECT *
+FROM telegram_users_effective
+WHERE (
+    $1::text IS NULL
+    OR username ILIKE '%' || $1::text || '%'
+    OR first_name ILIKE '%' || $1::text || '%'
+    OR last_name ILIKE '%' || $1::text || '%'
+)
+ORDER BY id
+LIMIT $2
+OFFSET $3"#;
+
+const SQL_GET_RUNTIME_USER: &str = "SELECT * FROM telegram_users_effective WHERE id = $1";
+const SQL_GET_RUNTIME_USER_BY_USERNAME: &str =
+    "SELECT * FROM telegram_users_effective WHERE username = $1 LIMIT 1";
+const SQL_GET_RUNTIME_USER_ID_BY_USERNAME: &str =
+    "SELECT id FROM telegram_users_effective WHERE lower(username) = lower($1) LIMIT 1";
+
+const SQL_COUNT_CHATS_FILTERED: &str = r#"
+SELECT COUNT(*)::int
+FROM telegram_chats_effective
+WHERE (
+    $1::text IS NULL
+    OR CAST(id AS text) LIKE '%' || $1::text || '%'
+    OR title ILIKE '%' || $1::text || '%'
+    OR username ILIKE '%' || $1::text || '%'
+    OR first_name ILIKE '%' || $1::text || '%'
+    OR last_name ILIKE '%' || $1::text || '%'
+)"#;
+
+const SQL_LIST_CHATS_FILTERED: &str = r#"
+SELECT *
+FROM telegram_chats_effective
+WHERE (
+    $1::text IS NULL
+    OR CAST(id AS text) LIKE '%' || $1::text || '%'
+    OR title ILIKE '%' || $1::text || '%'
+    OR username ILIKE '%' || $1::text || '%'
+    OR first_name ILIKE '%' || $1::text || '%'
+    OR last_name ILIKE '%' || $1::text || '%'
+)
+ORDER BY id
+LIMIT $2
+OFFSET $3"#;
+
+const SQL_COUNT_CHATS_BY_MEMBER: &str = r#"
+SELECT COUNT(DISTINCT c.id)::int
+FROM telegram_chats_effective c
+JOIN telegram_chat_members_effective cm ON c.id = cm.chat_id
+WHERE cm.user_id = $1"#;
+
+const SQL_LIST_CHATS_BY_MEMBER: &str = r#"
+SELECT DISTINCT c.*
+FROM telegram_chats_effective c
+JOIN telegram_chat_members_effective cm ON c.id = cm.chat_id
+WHERE cm.user_id = $1
+ORDER BY c.id
+LIMIT $2
+OFFSET $3"#;
+
+const SQL_GET_RUNTIME_CHAT: &str = "SELECT * FROM telegram_chats_effective WHERE id = $1";
+#[derive(Clone, Debug)]
+pub struct PostgresEntityStore {
+    pool: PgPool,
+}
+
+impl PostgresEntityStore {
+    pub fn new(pool: PgPool) -> Self {
+        Self { pool }
+    }
+
+    pub async fn user(&self, id: i64) -> Result<Option<TelegramUserProfile>, StorageError> {
+        Ok(sqlx::query_as(SQL_GET_RUNTIME_USER)
+            .bind(id)
+            .fetch_optional(&self.pool)
+            .await?)
+    }
+
+    pub async fn user_by_username(
+        &self,
+        username: &str,
+    ) -> Result<Option<TelegramUserProfile>, StorageError> {
+        Ok(sqlx::query_as(SQL_GET_RUNTIME_USER_BY_USERNAME)
+            .bind(username)
+            .fetch_optional(&self.pool)
+            .await?)
+    }
+
+    pub async fn user_id_by_username(&self, username: &str) -> Result<Option<i64>, StorageError> {
+        Ok(sqlx::query_scalar(SQL_GET_RUNTIME_USER_ID_BY_USERNAME)
+            .bind(username)
+            .fetch_optional(&self.pool)
+            .await?)
+    }
+
+    pub async fn users(
+        &self,
+        search: Option<&str>,
+        limit: i64,
+        offset: i64,
+    ) -> Result<Vec<TelegramUserProfile>, StorageError> {
+        Ok(sqlx::query_as(SQL_LIST_USERS_FILTERED)
+            .bind(search)
+            .bind(limit)
+            .bind(offset)
+            .fetch_all(&self.pool)
+            .await?)
+    }
+
+    pub async fn count_users(&self, search: Option<&str>) -> Result<i32, StorageError> {
+        Ok(sqlx::query_scalar(SQL_COUNT_USERS_FILTERED)
+            .bind(search)
+            .fetch_one(&self.pool)
+            .await?)
+    }
+
+    pub async fn chat(&self, id: i64) -> Result<Option<TelegramChatProfile>, StorageError> {
+        Ok(sqlx::query_as(SQL_GET_RUNTIME_CHAT)
+            .bind(id)
+            .fetch_optional(&self.pool)
+            .await?)
+    }
+
+    pub async fn chats(
+        &self,
+        search: Option<&str>,
+        limit: i64,
+        offset: i64,
+    ) -> Result<Vec<TelegramChatProfile>, StorageError> {
+        Ok(sqlx::query_as(SQL_LIST_CHATS_FILTERED)
+            .bind(search)
+            .bind(limit)
+            .bind(offset)
+            .fetch_all(&self.pool)
+            .await?)
+    }
+
+    pub async fn count_chats(&self, search: Option<&str>) -> Result<i32, StorageError> {
+        Ok(sqlx::query_scalar(SQL_COUNT_CHATS_FILTERED)
+            .bind(search)
+            .fetch_one(&self.pool)
+            .await?)
+    }
+
+    pub async fn chats_by_member(
+        &self,
+        user_id: i64,
+        limit: i64,
+        offset: i64,
+    ) -> Result<Vec<TelegramChatProfile>, StorageError> {
+        Ok(sqlx::query_as(SQL_LIST_CHATS_BY_MEMBER)
+            .bind(user_id)
+            .bind(limit)
+            .bind(offset)
+            .fetch_all(&self.pool)
+            .await?)
+    }
+
+    pub async fn count_chats_by_member(&self, user_id: i64) -> Result<i32, StorageError> {
+        Ok(sqlx::query_scalar(SQL_COUNT_CHATS_BY_MEMBER)
+            .bind(user_id)
+            .fetch_one(&self.pool)
+            .await?)
+    }
+}
+
+const SQL_ADMIN_LIST_VIP_USERS: &str = "WITH latest_vip AS (SELECT DISTINCT ON (user_id) id, user_id, event_type, delta_seconds, effective_expires_at, reason, created_at FROM vip_events ORDER BY user_id, id DESC), subscription_stats AS (SELECT user_id, COUNT(*)::bigint AS subscriptions_count, MAX(expires_at) AS latest_subscription_expires_at FROM subscriptions GROUP BY user_id) SELECT u.*, latest_vip.id AS latest_event_id, latest_vip.event_type AS latest_event_type, latest_vip.delta_seconds AS latest_delta_seconds, latest_vip.effective_expires_at AS vip_expires_at, latest_vip.reason AS latest_reason, latest_vip.created_at AS latest_created_at, (latest_vip.effective_expires_at > CURRENT_TIMESTAMP) AS vip_active, CASE WHEN latest_vip.effective_expires_at > CURRENT_TIMESTAMP THEN FLOOR(EXTRACT(EPOCH FROM (latest_vip.effective_expires_at - CURRENT_TIMESTAMP)))::bigint ELSE 0::bigint END AS remaining_seconds, COALESCE(subscription_stats.subscriptions_count, 0)::bigint AS subscriptions_count, subscription_stats.latest_subscription_expires_at AS latest_subscription_expires_at FROM latest_vip JOIN telegram_users_effective u ON u.id = latest_vip.user_id LEFT JOIN subscription_stats ON subscription_stats.user_id = u.id WHERE ($1::text = 'all' OR ($1::text = 'active' AND latest_vip.effective_expires_at > CURRENT_TIMESTAMP) OR ($1::text = 'expired' AND latest_vip.effective_expires_at <= CURRENT_TIMESTAMP)) AND ($2::text IS NULL OR CAST(u.id AS text) LIKE '%' || $2::text || '%' OR u.username ILIKE '%' || $2::text || '%' OR u.first_name ILIKE '%' || $2::text || '%' OR u.last_name ILIKE '%' || $2::text || '%') ORDER BY latest_vip.effective_expires_at DESC, latest_vip.id DESC LIMIT $3 OFFSET $4";
+
+const SQL_ADMIN_SEARCH_CHATS_BY_MEMBER: &str = "SELECT DISTINCT c.* FROM telegram_chats_effective c JOIN telegram_chat_members_effective cm ON c.id = cm.chat_id JOIN telegram_users_effective u ON cm.user_id = u.id WHERE ($1::text IS NULL OR LOWER(u.username) = LOWER($1::text)) AND ($2::bigint IS NULL OR u.id = $2::bigint) ORDER BY c.id LIMIT $3";
+
+#[derive(Clone, Debug, sqlx::FromRow)]
+pub struct VipUserProfile {
+    #[sqlx(flatten)]
+    pub user: TelegramUserProfile,
+    pub remaining_seconds: Option<i64>,
+    pub vip_active: Option<bool>,
+    pub vip_expires_at: Option<OffsetDateTime>,
+    pub latest_event_id: Option<i64>,
+    pub latest_event_type: Option<String>,
+    pub latest_delta_seconds: Option<i64>,
+    pub latest_reason: Option<String>,
+    pub latest_created_at: Option<OffsetDateTime>,
+    pub subscriptions_count: Option<i64>,
+    pub latest_subscription_expires_at: Option<OffsetDateTime>,
+}
+
+impl PostgresEntityStore {
+    pub async fn vip_users(
+        &self,
+        status: &str,
+        search: Option<&str>,
+        limit: i64,
+        offset: i64,
+    ) -> Result<Vec<VipUserProfile>, StorageError> {
+        Ok(sqlx::query_as(SQL_ADMIN_LIST_VIP_USERS)
+            .bind(status)
+            .bind(search)
+            .bind(limit)
+            .bind(offset)
+            .fetch_all(&self.pool)
+            .await?)
+    }
+    pub async fn search_chats_by_member(
+        &self,
+        username: Option<&str>,
+        user_id: Option<i64>,
+        limit: i64,
+    ) -> Result<Vec<TelegramChatProfile>, StorageError> {
+        Ok(sqlx::query_as(SQL_ADMIN_SEARCH_CHATS_BY_MEMBER)
+            .bind(username)
+            .bind(user_id)
+            .bind(limit)
+            .fetch_all(&self.pool)
+            .await?)
+    }
+}
+
+#[derive(Clone, Debug, sqlx::FromRow)]
+pub struct ChatMemberProfile {
+    #[sqlx(flatten)]
+    pub membership: crate::ChatMemberRecord,
+    pub created_at: Option<OffsetDateTime>,
+    pub updated_at: Option<OffsetDateTime>,
+    pub last_message_at: Option<OffsetDateTime>,
+}
+
+impl PostgresEntityStore {
+    pub async fn members_with_users(
+        &self,
+        chat_id: i64,
+    ) -> Result<Vec<(ChatMemberProfile, Option<TelegramUserProfile>)>, StorageError> {
+        let rows = sqlx::query("SELECT member.*, CASE WHEN profile.id IS NOT NULL THEN to_jsonb(profile) END AS user_profile FROM telegram_chat_members_effective AS member LEFT JOIN telegram_users_effective AS profile ON profile.id = member.user_id WHERE member.chat_id = $1")
+            .bind(chat_id).fetch_all(&self.pool).await?;
+        rows.iter()
+            .map(|row| {
+                let member = ChatMemberProfile::from_row(row)?;
+                let user = row
+                    .try_get::<Option<sqlx::types::Json<TelegramUserProfile>>, _>("user_profile")?
+                    .map(|user| user.0);
+                Ok((member, user))
+            })
+            .collect()
+    }
+}
+
+const SQL_ADMIN_ENSURE_USER: &str = "INSERT INTO users (id, first_name, is_premium, is_vip) VALUES ($1, $2, FALSE, FALSE) ON CONFLICT (id) DO NOTHING";
+
+const SQL_ADMIN_SAFE_DELETE_USER: &str = "WITH deleted_user_stage AS (DELETE FROM telegram_users_stage WHERE user_id = $1 RETURNING user_id), deleted_member_stage AS (DELETE FROM telegram_chat_members_stage WHERE user_id = $1 RETURNING user_id), deleted_activity_stage AS (DELETE FROM telegram_activity_stage WHERE user_id = $1 RETURNING user_id), deleted_memberships AS (DELETE FROM chat_members WHERE user_id = $1 RETURNING user_id), deleted_vip AS (DELETE FROM vip_cache WHERE user_id = $1 RETURNING user_id) DELETE FROM users WHERE id = $1";
+
+const SQL_ADMIN_GET_CHAT_TYPE: &str = "SELECT type FROM telegram_chats_effective WHERE id = $1";
+
+impl PostgresEntityStore {
+    pub async fn ensure_user(&self, user_id: i64, first_name: &str) -> Result<(), StorageError> {
+        sqlx::query(SQL_ADMIN_ENSURE_USER)
+            .bind(user_id)
+            .bind(first_name)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+    pub async fn delete_user(&self, user_id: i64) -> Result<u64, StorageError> {
+        Ok(sqlx::query(SQL_ADMIN_SAFE_DELETE_USER)
+            .bind(user_id)
+            .execute(&self.pool)
+            .await?
+            .rows_affected())
+    }
+    pub async fn chat_type(&self, chat_id: i64) -> Result<Option<String>, StorageError> {
+        Ok(sqlx::query_scalar(SQL_ADMIN_GET_CHAT_TYPE)
+            .bind(chat_id)
+            .fetch_optional(&self.pool)
+            .await?)
+    }
+}
+
+#[derive(Clone, Debug, sqlx::FromRow)]
+pub struct StoredChatSettings {
+    pub chat_id: i64,
+    pub mood_alignment: Option<String>,
+    pub custom_persona: Option<String>,
+    pub updated: Option<OffsetDateTime>,
+    pub reactivity_percentage: i32,
+    pub proactivity_percentage: i32,
+    pub enable_global_text_reply: bool,
+    pub enable_global_draw_reply: bool,
+    pub enable_obscenifier: bool,
+    pub enable_profanity: bool,
+    pub enable_greet_joiners: bool,
+    pub enable_daily_game: Option<bool>,
+    pub daily_game_theme: Option<String>,
+    pub greeting_html: Option<String>,
+}
+
+#[derive(Clone, Debug, sqlx::FromRow)]
+pub struct StoredChatPermissions {
+    pub chat_id: i64,
+    pub status: Option<String>,
+    pub can_manage_chat: Option<bool>,
+    pub can_delete_messages: Option<bool>,
+    pub can_manage_video_chats: Option<bool>,
+    pub can_restrict_members: Option<bool>,
+    pub can_promote_members: Option<bool>,
+    pub can_change_info: Option<bool>,
+    pub can_invite_users: Option<bool>,
+    pub can_post_messages: Option<bool>,
+    pub can_edit_messages: Option<bool>,
+    pub can_pin_messages: Option<bool>,
+    pub can_manage_topics: Option<bool>,
+    pub can_send_messages: Option<bool>,
+    pub can_send_media_messages: Option<bool>,
+    pub can_send_polls: Option<bool>,
+    pub can_send_other_messages: Option<bool>,
+    pub can_add_web_page_previews: Option<bool>,
+    pub last_checked_at: Option<OffsetDateTime>,
+    pub last_error_at: Option<OffsetDateTime>,
+    pub error_message: Option<String>,
+    pub created_at: Option<OffsetDateTime>,
+    pub updated_at: Option<OffsetDateTime>,
+    pub error_count: Option<i32>,
+}
+
+const SQL_ADMIN_GET_CHAT_SETTINGS: &str = "SELECT * FROM chat_settings WHERE chat_id = $1";
+
+const SQL_ADMIN_GET_CHAT_PERMISSIONS: &str =
+    "SELECT * FROM chat_permissions WHERE chat_id = $1 LIMIT 1";
+
+const SQL_ADMIN_COUNT_CHAT_MEMBERS: &str =
+    "SELECT COUNT(*)::bigint AS count FROM telegram_chat_members_effective WHERE chat_id = $1";
+
+impl PostgresEntityStore {
+    pub async fn chat_settings(
+        &self,
+        chat_id: i64,
+    ) -> Result<Option<StoredChatSettings>, StorageError> {
+        Ok(sqlx::query_as(SQL_ADMIN_GET_CHAT_SETTINGS)
+            .bind(chat_id)
+            .fetch_optional(&self.pool)
+            .await?)
+    }
+    pub async fn chat_permissions(
+        &self,
+        chat_id: i64,
+    ) -> Result<Option<StoredChatPermissions>, StorageError> {
+        Ok(sqlx::query_as(SQL_ADMIN_GET_CHAT_PERMISSIONS)
+            .bind(chat_id)
+            .fetch_optional(&self.pool)
+            .await?)
+    }
+    pub async fn member_count(&self, chat_id: i64) -> Result<i64, StorageError> {
+        Ok(sqlx::query_scalar(SQL_ADMIN_COUNT_CHAT_MEMBERS)
+            .bind(chat_id)
+            .fetch_one(&self.pool)
+            .await?)
+    }
+}
diff --git a/crates/openplotva-storage/src/gradius_ads.rs b/crates/openplotva-storage/src/gradius_ads.rs
index 84c1e6e8..58a3aa0d 100644
--- a/crates/openplotva-storage/src/gradius_ads.rs
+++ b/crates/openplotva-storage/src/gradius_ads.rs
@@ -828,10 +828,17 @@ impl PostgresGradiusAdStore {
         if batch.chat_id != Some(chat_id)
             || batch.thread_id.unwrap_or_default() != identity.get::<i32, _>("thread_id")
             || batch.parts.len() != 1
-            || batch.dialog_job_id.is_some()
         {
             return Err(invalid());
         }
+        if let Some(job_id) = batch.dialog_job_id {
+            let owned_checkin = identity.get::<String, _>("source_kind") == "checkin-final"
+                && sqlx::query_scalar::<_, bool>("SELECT EXISTS(SELECT 1 FROM taskman_jobs WHERE id = $1 AND chat_id = $2 AND user_id = $3 AND job_type = 'control')")
+                    .bind(job_id).bind(chat_id).bind(user_id).fetch_one(&self.pool).await?;
+            if !owned_checkin {
+                return Err(invalid());
+            }
+        }
         let mut tx = self.pool.begin().await?;
         sqlx::query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))")
             .bind(source.lock_key("native_utility", user_id, chat_id))
@@ -1674,6 +1681,7 @@ mod tests {
             Ok((
                 opportunity_id,
                 TelegramOutboxBatchInput {
+                    content_policy: crate::TelegramOutboxContentPolicy::Immutable,
                     batch_id: format!("public-image-group-test:{sequence}"),
                     bot_id: 7,
                     chat_id: Some(chat_id),
@@ -2088,6 +2096,7 @@ mod tests {
             ));
             store.finish_ad(current.opportunity_id(), 1, ad()).await?;
             let mut batch = crate::TelegramOutboxBatchInput {
+                content_policy: crate::TelegramOutboxContentPolicy::Immutable,
                 batch_id: batch_id.clone(),
                 bot_id: 9820825950,
                 chat_id: Some(chat_id),
@@ -2700,6 +2709,10 @@ mod tests {
             .connect(&dsn)
             .await?;
         crate::run_migrations_on(&pool).await?;
+        sqlx::query("SELECT ensure_daily_partition('telegram_outbox', $1::date)")
+            .bind(at(20_906).date())
+            .execute(&pool)
+            .await?;
         let user_id = 9_820_825_501_i64;
         sqlx::query("DELETE FROM gradius_ad_opportunities WHERE user_id = $1")
             .bind(user_id)
@@ -3101,6 +3114,7 @@ mod tests {
         );
 
         let batch = |chat_id: i64| TelegramOutboxBatchInput {
+            content_policy: crate::TelegramOutboxContentPolicy::Immutable,
             batch_id: banner_batch_id.clone(),
             bot_id: 7,
             chat_id: Some(chat_id),
diff --git a/crates/openplotva-storage/src/lib.rs b/crates/openplotva-storage/src/lib.rs
index a7d21174..ac46bd61 100644
--- a/crates/openplotva-storage/src/lib.rs
+++ b/crates/openplotva-storage/src/lib.rs
@@ -1,6 +1,11 @@
 //! Storage boundary for Postgres, pgvector, SQLx, Redis, and Dragonfly.
 
 mod agent_tools;
+pub mod app_settings;
+pub mod entities;
+pub mod redis_inspector;
+pub mod songs;
+pub use songs::{GeneratedSongRecord, NewGeneratedSong, PostgresGeneratedSongStore};
 
 use std::{
     collections::{HashMap, HashSet},
@@ -66,9 +71,9 @@ pub use telegram_outbox::{
     ClaimedTelegramOutboxBlob, ClaimedTelegramOutboxOperation, OUTBOX_LEASE_SECONDS,
     OUTBOX_OPERATION_BINDS_PER_ROW, PostgresTelegramOutboxStore, QueuedTelegramOutboxBatch,
     QueuedTelegramOutboxPart, TelegramDeliveryPolicy, TelegramOutboxAttempt,
-    TelegramOutboxBatchInput, TelegramOutboxBlobInput, TelegramOutboxItem, TelegramOutboxPartInput,
-    TelegramOutboxRecoveryReport, TelegramOutboxStats, TelegramReceiptHistoryEntry,
-    deterministic_telegram_operation_id, enqueue_telegram_outbox_batch,
+    TelegramOutboxBatchInput, TelegramOutboxBlobInput, TelegramOutboxContentPolicy,
+    TelegramOutboxItem, TelegramOutboxPartInput, TelegramOutboxRecoveryReport, TelegramOutboxStats,
+    TelegramReceiptHistoryEntry, deterministic_telegram_operation_id,
 };
 pub use telegram_projection::{
     PostgresTelegramProjectionStore, TelegramActivityProjection, TelegramChatMemberProjection,
@@ -2836,6 +2841,20 @@ impl RedisBlockedChatStore {
         format!("{}{chat_id}", self.key_prefix)
     }
 
+    pub async fn unblock_chat(&self, chat_id: i64) -> Result<(), StorageError> {
+        let mut connection = self
+            .connections
+            .connection()
+            .await
+            .map_err(|source| StorageError::Redis { source })?;
+        let _: () = redis::cmd("DEL")
+            .arg(self.key_for_chat(chat_id))
+            .query_async(&mut connection)
+            .await
+            .map_err(|source| StorageError::Redis { source })?;
+        Ok(())
+    }
+
     pub async fn block_chat_until(
         &self,
         chat_id: i64,
@@ -3582,7 +3601,7 @@ pub struct PostgresChatMemberStore {
     pool: PgPool,
 }
 
-#[derive(Clone, Debug, Default, Eq, PartialEq)]
+#[derive(Clone, Debug, Default, Eq, PartialEq, sqlx::FromRow)]
 pub struct ChatMemberRecord {
     /// Telegram chat ID.
     pub chat_id: i64,
@@ -3631,7 +3650,8 @@ pub struct ChatMemberRecord {
     pub can_add_web_page_previews: Option<bool>,
     /// Optional restricted/kicked expiration.
     pub until_date: Option<OffsetDateTime>,
-    /// Time at which Telegram last supplied this membership state.
+    /// Time at which Telegram last supplied this membership state; absent on effective snapshots.
+    #[sqlx(default)]
     pub telegram_observed_at: Option<OffsetDateTime>,
 }
 
@@ -4130,147 +4150,6 @@ fn chat_user_pair_arrays(pairs: &[(i64, i64)]) -> (Vec<i64>, Vec<i64>) {
     (chat_ids, user_ids)
 }
 
-/// One generated song's material, persisted for tracing.
-#[derive(Clone, Debug, PartialEq)]
-pub struct GeneratedSongRecord {
-    pub id: i64,
-    pub job_id: Option<i64>,
-    pub chat_id: i64,
-    pub thread_id: Option<i32>,
-    pub user_id: i64,
-    pub user_full_name: String,
-    pub trigger_message_id: i32,
-    pub result_message_id: Option<i32>,
-    pub request_text: String,
-    pub topic: String,
-    pub title: String,
-    pub vocal_language: String,
-    pub vocals: String,
-    pub tags: String,
-    pub style_summary: String,
-    pub lyrics: String,
-    pub duration_seconds: i32,
-    pub brief: serde_json::Value,
-    pub seed: Option<i64>,
-    pub audio_seconds: Option<f32>,
-    pub created_at: OffsetDateTime,
-}
-
-/// Insert payload for [`PostgresGeneratedSongStore::insert`].
-#[derive(Clone, Debug, Default, PartialEq)]
-pub struct NewGeneratedSong {
-    pub job_id: Option<i64>,
-    pub chat_id: i64,
-    pub thread_id: Option<i32>,
-    pub user_id: i64,
-    pub user_full_name: String,
-    pub trigger_message_id: i32,
-    pub request_text: String,
-    pub topic: String,
-    pub title: String,
-    pub vocal_language: String,
-    pub vocals: String,
-    pub tags: String,
-    pub style_summary: String,
-    pub lyrics: String,
-    pub duration_seconds: i32,
-    pub brief: serde_json::Value,
-    pub seed: Option<i64>,
-    pub audio_seconds: Option<f32>,
-}
-
-const SQL_INSERT_GENERATED_SONG: &str = "INSERT INTO generated_songs (job_id, chat_id, thread_id, user_id, user_full_name, trigger_message_id, request_text, topic, title, vocal_language, vocals, tags, style_summary, lyrics, duration_seconds, brief, seed, audio_seconds) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18) RETURNING id";
-
-const SQL_GET_GENERATED_SONG: &str = "SELECT id, job_id, chat_id, thread_id, user_id, user_full_name, trigger_message_id, result_message_id, request_text, topic, title, vocal_language, vocals, tags, style_summary, lyrics, duration_seconds, brief, seed, audio_seconds, created_at FROM generated_songs WHERE id = $1";
-
-const SQL_SET_GENERATED_SONG_RESULT_MESSAGE: &str =
-    "UPDATE generated_songs SET result_message_id = $2 WHERE id = $1";
-
-/// Postgres store for generated song material.
-#[derive(Clone, Debug)]
-pub struct PostgresGeneratedSongStore {
-    pool: PgPool,
-}
-
-impl PostgresGeneratedSongStore {
-    #[must_use]
-    pub fn new(pool: PgPool) -> Self {
-        Self { pool }
-    }
-
-    pub async fn insert(&self, song: &NewGeneratedSong) -> Result<i64, StorageError> {
-        let row = sqlx::query(SQL_INSERT_GENERATED_SONG)
-            .bind(song.job_id)
-            .bind(song.chat_id)
-            .bind(song.thread_id)
-            .bind(song.user_id)
-            .bind(&song.user_full_name)
-            .bind(song.trigger_message_id)
-            .bind(&song.request_text)
-            .bind(&song.topic)
-            .bind(&song.title)
-            .bind(&song.vocal_language)
-            .bind(&song.vocals)
-            .bind(&song.tags)
-            .bind(&song.style_summary)
-            .bind(&song.lyrics)
-            .bind(song.duration_seconds)
-            .bind(&song.brief)
-            .bind(song.seed)
-            .bind(song.audio_seconds)
-            .fetch_one(&self.pool)
-            .await?;
-        Ok(row.try_get("id")?)
-    }
-
-    pub async fn get(&self, id: i64) -> Result<Option<GeneratedSongRecord>, StorageError> {
-        let row = sqlx::query(SQL_GET_GENERATED_SONG)
-            .bind(id)
-            .fetch_optional(&self.pool)
-            .await?;
-        row.map(generated_song_from_row).transpose()
-    }
-
-    pub async fn set_result_message(
-        &self,
-        id: i64,
-        result_message_id: i32,
-    ) -> Result<(), StorageError> {
-        sqlx::query(SQL_SET_GENERATED_SONG_RESULT_MESSAGE)
-            .bind(id)
-            .bind(result_message_id)
-            .execute(&self.pool)
-            .await?;
-        Ok(())
-    }
-}
-
-fn generated_song_from_row(row: PgRow) -> Result<GeneratedSongRecord, StorageError> {
-    Ok(GeneratedSongRecord {
-        id: row.try_get("id")?,
-        job_id: row.try_get("job_id")?,
-        chat_id: row.try_get("chat_id")?,
-        thread_id: row.try_get("thread_id")?,
-        user_id: row.try_get("user_id")?,
-        user_full_name: row.try_get("user_full_name")?,
-        trigger_message_id: row.try_get("trigger_message_id")?,
-        result_message_id: row.try_get("result_message_id")?,
-        request_text: row.try_get("request_text")?,
-        topic: row.try_get("topic")?,
-        title: row.try_get("title")?,
-        vocal_language: row.try_get("vocal_language")?,
-        vocals: row.try_get("vocals")?,
-        tags: row.try_get("tags")?,
-        style_summary: row.try_get("style_summary")?,
-        lyrics: row.try_get("lyrics")?,
-        duration_seconds: row.try_get("duration_seconds")?,
-        brief: row.try_get("brief")?,
-        seed: row.try_get("seed")?,
-        audio_seconds: row.try_get("audio_seconds")?,
-        created_at: row.try_get("created_at")?,
-    })
-}
-
 #[derive(Clone, Debug)]
 pub struct PostgresTelegramFileStore {
     pool: PgPool,
@@ -7796,6 +7675,8 @@ pub enum StorageError {
     /// A deterministic operation ID was reused with a different immutable payload.
     #[error("Telegram outbox operation idempotency conflict in batch {batch_id}")]
     TelegramOutboxIdempotencyConflict { batch_id: String },
+    #[error("generated song delivery for job {job_id}: {reason}")]
+    GeneratedSongDelivery { job_id: i64, reason: &'static str },
     /// Retrying an ambiguous create may duplicate a Telegram message.
     #[error(
         "retrying ambiguous Telegram operation {operation_id} requires duplicate-risk acceptance"
@@ -15158,6 +15039,33 @@ mod tests {
         result
     }
 
+    #[tokio::test]
+    async fn live_redis_blocked_chat_unblock_preserves_other_chats() -> Result<(), Box<dyn Error>> {
+        let Ok(url) = env::var("OPENPLOTVA_TEST_REDIS_URL") else {
+            return Ok(());
+        };
+        let client = redis::Client::open(url)?;
+        let suffix = SystemTime::now().duration_since(UNIX_EPOCH)?.as_nanos();
+        let store = super::RedisBlockedChatStore::with_key_prefix(
+            client,
+            format!("openplotva:test:blocked:{suffix}:"),
+        );
+        let until = time::OffsetDateTime::now_utc() + time::Duration::minutes(10);
+        let result: Result<(), Box<dyn Error>> = async {
+            store.block_chat_until(1, until).await?;
+            store.block_chat_until(2, until).await?;
+            store.unblock_chat(1).await?;
+            store.unblock_chat(1).await?;
+            assert_eq!(store.blocked_until(1).await?, None);
+            assert_eq!(store.blocked_until(2).await?, Some(until));
+            Ok(())
+        }
+        .await;
+        store.unblock_chat(1).await?;
+        store.unblock_chat(2).await?;
+        result
+    }
+
     #[tokio::test]
     async fn live_redis_rate_limit_store_round_trips_when_url_is_set() -> Result<(), Box<dyn Error>>
     {
diff --git a/crates/openplotva-storage/src/llm_routing.rs b/crates/openplotva-storage/src/llm_routing.rs
index 125a452d..3c8da032 100644
--- a/crates/openplotva-storage/src/llm_routing.rs
+++ b/crates/openplotva-storage/src/llm_routing.rs
@@ -976,9 +976,20 @@ fn routing_admin_report_state_from_row(
     })
 }
 
-/// Read the whole routing configuration in one REPEATABLE READ transaction so the
-/// five tables are seen at a single consistent snapshot, even while an admin write
-/// is committing concurrently.
+/// Serialize startup routing updates and keep their data and marker atomic.
+pub async fn begin_bootstrap_update(
+    pool: &PgPool,
+) -> Result<sqlx::Transaction<'_, Postgres>, StorageError> {
+    let mut transaction = pool.begin().await?;
+    sqlx::query(
+        "SELECT pg_advisory_xact_lock(hashtextextended('openplotva:llm-routing-bootstrap', 0))",
+    )
+    .execute(&mut *transaction)
+    .await?;
+    Ok(transaction)
+}
+
+/// Read routing tables from one REPEATABLE READ snapshot during concurrent admin writes.
 pub async fn load_snapshot(pool: &PgPool) -> Result<RoutingSnapshot, StorageError> {
     let mut tx = pool.begin().await?;
     sqlx::query("SET TRANSACTION ISOLATION LEVEL REPEATABLE READ")
@@ -1037,7 +1048,9 @@ fn json_text(value: &Value) -> String {
     value.to_string()
 }
 
-pub async fn list_providers(pool: &PgPool) -> Result<Vec<ProviderRecord>, StorageError> {
+pub async fn list_providers(
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
+) -> Result<Vec<ProviderRecord>, StorageError> {
     sqlx::query(SQL_LIST_PROVIDERS)
         .fetch_all(pool)
         .await?
@@ -1055,7 +1068,10 @@ pub async fn get_provider(pool: &PgPool, id: i64) -> Result<Option<ProviderRecor
         .transpose()
 }
 
-pub async fn insert_provider(pool: &PgPool, input: &ProviderInput) -> Result<i64, StorageError> {
+pub async fn insert_provider(
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
+    input: &ProviderInput,
+) -> Result<i64, StorageError> {
     let row = sqlx::query(SQL_INSERT_PROVIDER)
         .bind(&input.name)
         .bind(&input.kind)
@@ -1074,7 +1090,7 @@ pub async fn insert_provider(pool: &PgPool, input: &ProviderInput) -> Result<i64
 }
 
 pub async fn update_provider(
-    pool: &PgPool,
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
     id: i64,
     input: &ProviderInput,
 ) -> Result<(), StorageError> {
@@ -1130,7 +1146,9 @@ pub async fn delete_provider(pool: &PgPool, id: i64) -> Result<(), StorageError>
     Ok(())
 }
 
-pub async fn list_models(pool: &PgPool) -> Result<Vec<ModelRecord>, StorageError> {
+pub async fn list_models(
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
+) -> Result<Vec<ModelRecord>, StorageError> {
     sqlx::query(SQL_LIST_MODELS)
         .fetch_all(pool)
         .await?
@@ -1139,7 +1157,10 @@ pub async fn list_models(pool: &PgPool) -> Result<Vec<ModelRecord>, StorageError
         .collect()
 }
 
-pub async fn insert_model(pool: &PgPool, input: &ModelInput) -> Result<i64, StorageError> {
+pub async fn insert_model(
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
+    input: &ModelInput,
+) -> Result<i64, StorageError> {
     let row = sqlx::query(SQL_INSERT_MODEL)
         .bind(input.provider_id)
         .bind(&input.model_name)
@@ -1155,7 +1176,11 @@ pub async fn insert_model(pool: &PgPool, input: &ModelInput) -> Result<i64, Stor
     Ok(row.try_get::<i64, _>("id")?)
 }
 
-pub async fn update_model(pool: &PgPool, id: i64, input: &ModelInput) -> Result<(), StorageError> {
+pub async fn update_model(
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
+    id: i64,
+    input: &ModelInput,
+) -> Result<(), StorageError> {
     sqlx::query(SQL_UPDATE_MODEL)
         .bind(id)
         .bind(input.provider_id)
@@ -1173,7 +1198,7 @@ pub async fn update_model(pool: &PgPool, id: i64, input: &ModelInput) -> Result<
 }
 
 pub async fn set_model_pool(
-    pool: &PgPool,
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
     id: i64,
     pool_id: Option<i64>,
 ) -> Result<(), StorageError> {
@@ -1188,7 +1213,7 @@ pub async fn set_model_pool(
 /// Attach every still-unpooled model of a provider to a pool. Backfill helper:
 /// never overwrites an operator-set pool.
 pub async fn attach_provider_models_to_pool_if_unpooled(
-    pool: &PgPool,
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
     provider_id: i64,
     pool_id: i64,
 ) -> Result<u64, StorageError> {
@@ -1203,7 +1228,7 @@ pub async fn attach_provider_models_to_pool_if_unpooled(
 /// Fill a provider's protocol only when unset. Backfill helper: never
 /// overwrites an operator-set protocol.
 pub async fn set_provider_protocol_if_null(
-    pool: &PgPool,
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
     id: i64,
     protocol: &str,
 ) -> Result<(), StorageError> {
@@ -1215,7 +1240,9 @@ pub async fn set_provider_protocol_if_null(
     Ok(())
 }
 
-pub async fn list_pools(pool: &PgPool) -> Result<Vec<PoolRecord>, StorageError> {
+pub async fn list_pools(
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
+) -> Result<Vec<PoolRecord>, StorageError> {
     sqlx::query(SQL_LIST_POOLS)
         .fetch_all(pool)
         .await?
@@ -1237,22 +1264,30 @@ pub async fn insert_pool(pool: &PgPool, input: &PoolInput) -> Result<i64, Storag
 
 /// Idempotent pool creation for seeds/backfills; returns the pool id whether it
 /// was just created or already existed.
-pub async fn insert_pool_if_missing(pool: &PgPool, input: &PoolInput) -> Result<i64, StorageError> {
+pub async fn insert_pool_if_missing<'a>(
+    pool: impl sqlx::Acquire<'a, Database = Postgres>,
+    input: &PoolInput,
+) -> Result<i64, StorageError> {
+    let mut connection = pool.acquire().await?;
     sqlx::query(SQL_INSERT_POOL_IF_MISSING)
         .bind(&input.name)
         .bind(input.max_concurrency)
         .bind(input.description.as_deref())
         .bind(input.config.to_string())
-        .execute(pool)
+        .execute(&mut *connection)
         .await?;
     let row = sqlx::query(SQL_GET_POOL_BY_NAME)
         .bind(&input.name)
-        .fetch_one(pool)
+        .fetch_one(&mut *connection)
         .await?;
     Ok(row.try_get::<i64, _>("id")?)
 }
 
-pub async fn update_pool(pool: &PgPool, id: i64, input: &PoolInput) -> Result<(), StorageError> {
+pub async fn update_pool(
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
+    id: i64,
+    input: &PoolInput,
+) -> Result<(), StorageError> {
     sqlx::query(SQL_UPDATE_POOL)
         .bind(id)
         .bind(&input.name)
@@ -1302,7 +1337,7 @@ pub async fn list_workflows(pool: &PgPool) -> Result<Vec<WorkflowRecord>, Storag
 }
 
 pub async fn insert_workflow_if_missing(
-    pool: &PgPool,
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
     key: &str,
     kind: &str,
     full_routing: bool,
@@ -1354,7 +1389,9 @@ pub async fn set_workflow_enabled(
     Ok(())
 }
 
-pub async fn list_assignments(pool: &PgPool) -> Result<Vec<AssignmentRecord>, StorageError> {
+pub async fn list_assignments(
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
+) -> Result<Vec<AssignmentRecord>, StorageError> {
     sqlx::query(SQL_LIST_ASSIGNMENTS)
         .fetch_all(pool)
         .await?
@@ -1364,7 +1401,7 @@ pub async fn list_assignments(pool: &PgPool) -> Result<Vec<AssignmentRecord>, St
 }
 
 pub async fn insert_assignment(
-    pool: &PgPool,
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
     input: &AssignmentInput,
 ) -> Result<i64, StorageError> {
     let row = sqlx::query(SQL_INSERT_ASSIGNMENT)
@@ -1385,7 +1422,7 @@ pub async fn insert_assignment(
 }
 
 pub async fn update_assignment(
-    pool: &PgPool,
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
     id: i64,
     input: &AssignmentInput,
 ) -> Result<(), StorageError> {
@@ -1503,7 +1540,9 @@ pub async fn insert_trigger_with_assignment(
     Ok((assignment_id, trigger_id))
 }
 
-pub async fn list_triggers(pool: &PgPool) -> Result<Vec<TriggerRecord>, StorageError> {
+pub async fn list_triggers(
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
+) -> Result<Vec<TriggerRecord>, StorageError> {
     sqlx::query(SQL_LIST_TRIGGERS)
         .fetch_all(pool)
         .await?
@@ -1512,7 +1551,10 @@ pub async fn list_triggers(pool: &PgPool) -> Result<Vec<TriggerRecord>, StorageE
         .collect()
 }
 
-pub async fn insert_trigger(pool: &PgPool, input: &TriggerInput) -> Result<i64, StorageError> {
+pub async fn insert_trigger(
+    pool: impl sqlx::Executor<'_, Database = Postgres>,
+    input: &TriggerInput,
+) -> Result<i64, StorageError> {
     let row = sqlx::query(SQL_INSERT_TRIGGER)
         .bind(&input.workflow_key)
         .bind(&input.trigger_type)
diff --git a/crates/openplotva-storage/src/redis_inspector.rs b/crates/openplotva-storage/src/redis_inspector.rs
new file mode 100644
index 00000000..082f247b
--- /dev/null
+++ b/crates/openplotva-storage/src/redis_inspector.rs
@@ -0,0 +1,175 @@
+//! Redis inspection and maintenance operations shared by HTTP and runtime APIs.
+use std::collections::HashMap;
+
+#[derive(Clone)]
+pub struct RedisInspectorStore {
+    client: redis::Client,
+}
+
+impl RedisInspectorStore {
+    pub fn new(client: redis::Client) -> Self {
+        Self { client }
+    }
+
+    pub async fn scan_keys(
+        &self,
+        pattern: &str,
+        limit: Option<usize>,
+    ) -> Result<Vec<String>, redis::RedisError> {
+        if limit == Some(0) {
+            return Ok(Vec::new());
+        }
+        let mut connection = self.client.get_multiplexed_async_connection().await?;
+        let mut cursor = 0_u64;
+        let mut keys = Vec::new();
+        loop {
+            let remaining = limit.map(|limit| limit.saturating_sub(keys.len()));
+            if remaining == Some(0) {
+                break;
+            }
+            let (next_cursor, batch): (u64, Vec<String>) = redis::cmd("SCAN")
+                .arg(cursor)
+                .arg("MATCH")
+                .arg(pattern)
+                .arg("COUNT")
+                .arg(remaining.map(|n| n.min(100)).unwrap_or(1000))
+                .query_async(&mut connection)
+                .await?;
+            keys.extend(batch.into_iter().take(remaining.unwrap_or(usize::MAX)));
+            if next_cursor == 0 {
+                break;
+            }
+            cursor = next_cursor;
+        }
+        Ok(keys)
+    }
+
+    pub async fn value(&self, key: &str) -> Result<Option<Vec<u8>>, redis::RedisError> {
+        let mut connection = self.client.get_multiplexed_async_connection().await?;
+        redis::cmd("GET")
+            .arg(key)
+            .query_async(&mut connection)
+            .await
+    }
+    pub async fn delete_key(&self, key: &str) -> Result<(), redis::RedisError> {
+        let mut connection = self.client.get_multiplexed_async_connection().await?;
+        let _: () = redis::cmd("DEL")
+            .arg(key)
+            .query_async(&mut connection)
+            .await?;
+        Ok(())
+    }
+
+    pub async fn delete_by_prefix(&self, prefix: &str) -> Result<(), redis::RedisError> {
+        let pattern = format!("{prefix}*");
+        let mut connection = self.client.get_multiplexed_async_connection().await?;
+        let mut cursor = 0_u64;
+
+        loop {
+            let (next_cursor, batch): (u64, Vec<String>) = redis::cmd("SCAN")
+                .arg(cursor)
+                .arg("MATCH")
+                .arg(&pattern)
+                .arg("COUNT")
+                .arg(1000)
+                .query_async(&mut connection)
+                .await?;
+            if !batch.is_empty() {
+                let _: () = redis::cmd("DEL")
+                    .arg(batch)
+                    .query_async(&mut connection)
+                    .await?;
+            }
+            if next_cursor == 0 {
+                break;
+            }
+            cursor = next_cursor;
+        }
+
+        Ok(())
+    }
+
+    pub async fn flushdb(&self) -> Result<(), redis::RedisError> {
+        let mut connection = self.client.get_multiplexed_async_connection().await?;
+        redis::cmd("FLUSHDB").query_async(&mut connection).await
+    }
+}
+
+pub fn prefix_groups_from_keys(
+    prefix: &str,
+    keys: impl IntoIterator<Item = String>,
+) -> HashMap<String, i32> {
+    let mut groups = HashMap::<String, i32>::new();
+    for key in keys {
+        let Some(rest) = key.strip_prefix(prefix) else {
+            continue;
+        };
+        if rest.is_empty() {
+            continue;
+        };
+        let segment = match rest.find(':') {
+            Some(index) => &rest[..=index],
+            None => rest,
+        };
+        *groups.entry(format!("{prefix}{segment}")).or_default() += 1;
+    }
+    groups
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn live_redis_inspection_preserves_bytes_limits_and_prefix_scope()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let Ok(url) = std::env::var("OPENPLOTVA_TEST_REDIS_URL") else {
+            return Ok(());
+        };
+        let client = redis::Client::open(url)?;
+        let store = RedisInspectorStore::new(client.clone());
+        let suffix = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)?
+            .as_nanos();
+        let prefix = format!("openplotva:test:inspection:{suffix}:");
+        let one = format!("{prefix}a:1");
+        let two = format!("{prefix}a:2");
+        let other = format!("{prefix}b:1");
+        let mut connection = client.get_multiplexed_async_connection().await?;
+        let result: Result<(), Box<dyn std::error::Error>> = async {
+            let _: () = redis::cmd("MSET")
+                .arg(&one)
+                .arg([0xff_u8, b'a'].as_slice())
+                .arg(&two)
+                .arg("second")
+                .arg(&other)
+                .arg("other")
+                .query_async(&mut connection)
+                .await?;
+            assert_eq!(store.value(&one).await?, Some(vec![0xff, b'a']));
+            assert_eq!(
+                store.scan_keys(&format!("{prefix}*"), Some(0)).await?,
+                Vec::<String>::new()
+            );
+            assert_eq!(
+                store.scan_keys(&format!("{prefix}*"), Some(1)).await?.len(),
+                1
+            );
+            let keys = store.scan_keys(&format!("{prefix}*"), None).await?;
+            assert_eq!(keys.len(), 3);
+            assert_eq!(
+                prefix_groups_from_keys(&prefix, keys),
+                HashMap::from([(format!("{prefix}a:"), 2), (format!("{prefix}b:"), 1)])
+            );
+            store.delete_key(&one).await?;
+            store.delete_key(&one).await?;
+            assert_eq!(store.value(&one).await?, None);
+            store.delete_by_prefix(&format!("{prefix}a:")).await?;
+            assert_eq!(store.value(&two).await?, None);
+            assert_eq!(store.value(&other).await?, Some(b"other".to_vec()));
+            Ok(())
+        }
+        .await;
+        store.delete_by_prefix(&prefix).await?;
+        result
+    }
+}
diff --git a/crates/openplotva-storage/src/songs.rs b/crates/openplotva-storage/src/songs.rs
new file mode 100644
index 00000000..3f3b6531
--- /dev/null
+++ b/crates/openplotva-storage/src/songs.rs
@@ -0,0 +1,260 @@
+//! Generated song material, prepared payloads, and confirmed delivery links.
+
+use crate::StorageError;
+use sqlx::{PgPool, Row, postgres::PgRow};
+use time::OffsetDateTime;
+
+/// One generated song's material, persisted for tracing.
+#[derive(Clone, Debug, PartialEq)]
+pub struct GeneratedSongRecord {
+    pub prepared_delivery: Option<serde_json::Value>,
+    pub id: i64,
+    pub job_id: Option<i64>,
+    pub chat_id: i64,
+    pub thread_id: Option<i32>,
+    pub user_id: i64,
+    pub user_full_name: String,
+    pub trigger_message_id: i32,
+    pub result_message_id: Option<i32>,
+    pub request_text: String,
+    pub topic: String,
+    pub title: String,
+    pub vocal_language: String,
+    pub vocals: String,
+    pub tags: String,
+    pub style_summary: String,
+    pub lyrics: String,
+    pub duration_seconds: i32,
+    pub brief: serde_json::Value,
+    pub seed: Option<i64>,
+    pub audio_seconds: Option<f32>,
+    pub created_at: OffsetDateTime,
+}
+
+/// Insert payload for [`PostgresGeneratedSongStore::save_prepared`].
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct NewGeneratedSong {
+    pub job_id: Option<i64>,
+    pub chat_id: i64,
+    pub thread_id: Option<i32>,
+    pub user_id: i64,
+    pub user_full_name: String,
+    pub trigger_message_id: i32,
+    pub request_text: String,
+    pub topic: String,
+    pub title: String,
+    pub vocal_language: String,
+    pub vocals: String,
+    pub tags: String,
+    pub style_summary: String,
+    pub lyrics: String,
+    pub duration_seconds: i32,
+    pub brief: serde_json::Value,
+    pub seed: Option<i64>,
+    pub audio_seconds: Option<f32>,
+}
+
+const SQL_INSERT_GENERATED_SONG: &str = "INSERT INTO generated_songs (job_id, chat_id, thread_id, user_id, user_full_name, trigger_message_id, request_text, topic, title, vocal_language, vocals, tags, style_summary, lyrics, duration_seconds, brief, seed, audio_seconds, prepared_delivery) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19) ON CONFLICT (job_id) WHERE job_id IS NOT NULL AND prepared_delivery IS NOT NULL DO UPDATE SET job_id = EXCLUDED.job_id WHERE generated_songs.chat_id = EXCLUDED.chat_id AND generated_songs.thread_id IS NOT DISTINCT FROM EXCLUDED.thread_id AND generated_songs.user_id = EXCLUDED.user_id AND generated_songs.trigger_message_id = EXCLUDED.trigger_message_id RETURNING prepared_delivery";
+
+const SQL_GET_GENERATED_SONG: &str = "SELECT id, prepared_delivery, job_id, chat_id, thread_id, user_id, user_full_name, trigger_message_id, result_message_id, request_text, topic, title, vocal_language, vocals, tags, style_summary, lyrics, duration_seconds, brief, seed, audio_seconds, created_at FROM generated_songs WHERE id = $1";
+
+const SQL_SET_GENERATED_SONG_RESULT_MESSAGE: &str =
+    "UPDATE generated_songs SET result_message_id = $2 WHERE id = $1";
+
+/// Postgres store for generated song material.
+#[derive(Clone, Debug)]
+pub struct PostgresGeneratedSongStore {
+    pool: PgPool,
+}
+
+impl PostgresGeneratedSongStore {
+    #[must_use]
+    pub fn new(pool: PgPool) -> Self {
+        Self { pool }
+    }
+
+    /// Save material and its prepared payload together; a replay keeps the first preparation.
+    pub async fn save_prepared(
+        &self,
+        song: &NewGeneratedSong,
+        payload: &serde_json::Value,
+    ) -> Result<serde_json::Value, StorageError> {
+        if song.job_id.is_none() {
+            return Err(StorageError::GeneratedSongDelivery {
+                job_id: 0,
+                reason: "preparation requires a job identity",
+            });
+        }
+        let row = sqlx::query(SQL_INSERT_GENERATED_SONG)
+            .bind(song.job_id)
+            .bind(song.chat_id)
+            .bind(song.thread_id)
+            .bind(song.user_id)
+            .bind(&song.user_full_name)
+            .bind(song.trigger_message_id)
+            .bind(&song.request_text)
+            .bind(&song.topic)
+            .bind(&song.title)
+            .bind(&song.vocal_language)
+            .bind(&song.vocals)
+            .bind(&song.tags)
+            .bind(&song.style_summary)
+            .bind(&song.lyrics)
+            .bind(song.duration_seconds)
+            .bind(&song.brief)
+            .bind(song.seed)
+            .bind(song.audio_seconds)
+            .bind(payload)
+            .fetch_one(&self.pool)
+            .await?;
+        Ok(row.try_get("prepared_delivery")?)
+    }
+
+    pub async fn prepared_for_job(
+        &self,
+        job_id: i64,
+    ) -> Result<Option<serde_json::Value>, StorageError> {
+        Ok(sqlx::query_scalar("SELECT prepared_delivery FROM generated_songs WHERE job_id = $1 AND prepared_delivery IS NOT NULL")
+            .bind(job_id).fetch_optional(&self.pool).await?)
+    }
+
+    /// Commit real Telegram IDs before taskman can report successful music delivery.
+    pub async fn link_delivery_receipts(
+        &self,
+        job_id: i64,
+        batch_id: &str,
+    ) -> Result<i32, StorageError> {
+        let mut tx = self.pool.begin().await?;
+        let rows = sqlx::query("SELECT song.id, operation.state, operation.telegram_message_ids[1] AS message_id FROM telegram_outbox AS operation LEFT JOIN generated_songs AS song ON song.job_id = operation.dialog_job_id AND song.prepared_delivery IS NOT NULL WHERE operation.batch_id = $1 AND operation.dialog_job_id = $2 ORDER BY operation.part_index")
+            .bind(batch_id).bind(job_id).fetch_all(&mut *tx).await?;
+        if rows.len() != 1 {
+            return Err(StorageError::GeneratedSongDelivery {
+                job_id,
+                reason: "music delivery must contain one prepared variant",
+            });
+        }
+        let row = &rows[0];
+        let id: Option<i64> = row.try_get("id")?;
+        let message_id: Option<i64> = row.try_get("message_id")?;
+        let state: String = row.try_get("state")?;
+        let Some((id, message_id)) = id.zip(
+            message_id
+                .and_then(|id| i32::try_from(id).ok())
+                .filter(|id| *id > 0),
+        ) else {
+            return Err(StorageError::GeneratedSongDelivery {
+                job_id,
+                reason: "delivery has no song or real message receipt",
+            });
+        };
+        if state != "delivered" {
+            return Err(StorageError::GeneratedSongDelivery {
+                job_id,
+                reason: "delivery is not confirmed",
+            });
+        }
+        sqlx::query(SQL_SET_GENERATED_SONG_RESULT_MESSAGE)
+            .bind(id)
+            .bind(message_id)
+            .execute(&mut *tx)
+            .await?;
+        tx.commit().await?;
+        Ok(message_id)
+    }
+
+    pub async fn get(&self, id: i64) -> Result<Option<GeneratedSongRecord>, StorageError> {
+        let row = sqlx::query(SQL_GET_GENERATED_SONG)
+            .bind(id)
+            .fetch_optional(&self.pool)
+            .await?;
+        row.map(generated_song_from_row).transpose()
+    }
+}
+
+fn generated_song_from_row(row: PgRow) -> Result<GeneratedSongRecord, StorageError> {
+    Ok(GeneratedSongRecord {
+        prepared_delivery: row.try_get("prepared_delivery")?,
+        id: row.try_get("id")?,
+        job_id: row.try_get("job_id")?,
+        chat_id: row.try_get("chat_id")?,
+        thread_id: row.try_get("thread_id")?,
+        user_id: row.try_get("user_id")?,
+        user_full_name: row.try_get("user_full_name")?,
+        trigger_message_id: row.try_get("trigger_message_id")?,
+        result_message_id: row.try_get("result_message_id")?,
+        request_text: row.try_get("request_text")?,
+        topic: row.try_get("topic")?,
+        title: row.try_get("title")?,
+        vocal_language: row.try_get("vocal_language")?,
+        vocals: row.try_get("vocals")?,
+        tags: row.try_get("tags")?,
+        style_summary: row.try_get("style_summary")?,
+        lyrics: row.try_get("lyrics")?,
+        duration_seconds: row.try_get("duration_seconds")?,
+        brief: row.try_get("brief")?,
+        seed: row.try_get("seed")?,
+        audio_seconds: row.try_get("audio_seconds")?,
+        created_at: row.try_get("created_at")?,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[tokio::test]
+    async fn postgres_prepared_song_replay_preserves_payload_metadata_and_legacy_rows()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let Ok(dsn) = std::env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
+            return Ok(());
+        };
+        let pool = sqlx::postgres::PgPoolOptions::new()
+            .max_connections(4)
+            .connect(&dsn)
+            .await?;
+        crate::run_migrations_on(&pool).await?;
+        let job_id = OffsetDateTime::now_utc().unix_timestamp_nanos() as i64;
+        let legacy_id: i64 = sqlx::query_scalar("INSERT INTO generated_songs (job_id, chat_id, user_id, result_message_id) VALUES ($1, 42, 7, 55) RETURNING id")
+            .bind(job_id).fetch_one(&pool).await?;
+        let store = PostgresGeneratedSongStore::new(pool.clone());
+        assert_eq!(store.prepared_for_job(job_id).await?, None);
+        let mut song = NewGeneratedSong {
+            job_id: Some(job_id),
+            chat_id: 42,
+            user_id: 7,
+            title: "Original".into(),
+            seed: Some(123),
+            ..Default::default()
+        };
+        let original = json!({"html":"<audio src=\"https://example.test/original.mp3\"></audio>","chat_id":42});
+        assert_eq!(store.save_prepared(&song, &original).await?, original);
+        song.title = "Regenerated".into();
+        song.seed = Some(456);
+        assert_eq!(
+            store
+                .save_prepared(&song, &json!({"html":"changed"}))
+                .await?,
+            original
+        );
+        let saved: (String, Option<i64>, Option<i32>) = sqlx::query_as("SELECT title, seed, result_message_id FROM generated_songs WHERE job_id = $1 AND prepared_delivery IS NOT NULL")
+            .bind(job_id).fetch_one(&pool).await?;
+        assert_eq!(saved, ("Original".into(), Some(123), None));
+        song.chat_id = 99;
+        assert!(store.save_prepared(&song, &original).await.is_err());
+        assert!(
+            store
+                .link_delivery_receipts(job_id, "missing-batch")
+                .await
+                .is_err()
+        );
+        let legacy = store.get(legacy_id).await?.expect("legacy song");
+        assert_eq!(legacy.prepared_delivery, None);
+        assert_eq!(legacy.result_message_id, Some(55));
+        sqlx::query("DELETE FROM generated_songs WHERE job_id = $1")
+            .bind(job_id)
+            .execute(&pool)
+            .await?;
+        Ok(())
+    }
+}
diff --git a/crates/openplotva-storage/src/telegram_delivery.rs b/crates/openplotva-storage/src/telegram_delivery.rs
index f2499443..0f1f64a0 100644
--- a/crates/openplotva-storage/src/telegram_delivery.rs
+++ b/crates/openplotva-storage/src/telegram_delivery.rs
@@ -15,6 +15,21 @@ use crate::{
     telegram_projection::apply_projection_batch_in_transaction,
 };
 
+pub async fn delivery_schema_ready(pool: &PgPool) -> Result<bool, StorageError> {
+    Ok(sqlx::query_scalar::<_, bool>(
+        "SELECT to_regclass('public.telegram_update_inbox') IS NOT NULL \
+                AND to_regclass('public.telegram_update_quarantine') IS NOT NULL \
+                AND to_regclass('public.telegram_update_attempts') IS NOT NULL \
+                AND to_regclass('public.telegram_update_lanes') IS NOT NULL \
+                AND to_regclass('public.telegram_update_startup_jobs') IS NOT NULL \
+                AND to_regclass('public.telegram_outbox') IS NOT NULL \
+                AND to_regclass('public.telegram_outbox_attempts') IS NOT NULL \
+                AND to_regclass('public.telegram_outbox_blobs') IS NOT NULL",
+    )
+    .fetch_one(pool)
+    .await?)
+}
+
 /// Conservative bind budget below PostgreSQL's protocol limit.
 pub const POSTGRES_MATERIALIZATION_BIND_BUDGET: usize = 60_000;
 /// Number of parameters emitted for one inbox row.
diff --git a/crates/openplotva-storage/src/telegram_outbox.rs b/crates/openplotva-storage/src/telegram_outbox.rs
index 7ec10904..0ee0d039 100644
--- a/crates/openplotva-storage/src/telegram_outbox.rs
+++ b/crates/openplotva-storage/src/telegram_outbox.rs
@@ -213,9 +213,17 @@ pub struct PendingTelegramHistoryReceipt {
     pub receipt: Value,
 }
 
+/// Whether a replay must match content or reuse the first prepared payload.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum TelegramOutboxContentPolicy {
+    Immutable,
+    ReusePrepared,
+}
+
 /// Immutable batch metadata plus ordered parts.
 #[derive(Clone, Debug, PartialEq)]
 pub struct TelegramOutboxBatchInput {
+    pub content_policy: TelegramOutboxContentPolicy,
     pub batch_id: String,
     pub bot_id: i64,
     pub chat_id: Option<i64>,
@@ -342,7 +350,14 @@ impl PostgresTelegramOutboxStore {
     ) -> Result<QueuedTelegramOutboxBatch, StorageError> {
         let mut retry_delays = ENQUEUE_POOL_TIMEOUT_RETRY_DELAYS.into_iter();
         loop {
-            match enqueue_telegram_outbox_batch(&self.pool, batch).await {
+            let result = async {
+                let mut tx = self.pool.begin().await?;
+                let queued = enqueue_telegram_outbox_batch_in_transaction(&mut tx, batch).await?;
+                tx.commit().await?;
+                Ok(queued)
+            }
+            .await;
+            match result {
                 Err(StorageError::Postgres {
                     source: sqlx::Error::PoolTimedOut,
                 }) => {
@@ -361,6 +376,21 @@ impl PostgresTelegramOutboxStore {
         }
     }
 
+    /// Look up an already committed delivery before preparing content again.
+    pub async fn queued_batch(
+        &self,
+        bot_id: i64,
+        batch_id: &str,
+        job_id: Option<i64>,
+    ) -> Result<Option<QueuedTelegramOutboxBatch>, StorageError> {
+        let rows = sqlx::query("SELECT id, operation_id, part_index, state, FALSE AS inserted FROM telegram_outbox WHERE bot_id = $1 AND batch_id = $2 AND dialog_job_id IS NOT DISTINCT FROM $3 ORDER BY part_index")
+            .bind(bot_id).bind(batch_id).bind(job_id).fetch_all(&self.pool).await?;
+        if rows.is_empty() {
+            return Ok(None);
+        }
+        Ok(Some(queued_batch_from_rows(batch_id, rows)?))
+    }
+
     /// Claim at most one currently-sendable operation per ordering key.
     pub async fn claim_operations(
         &self,
@@ -377,17 +407,6 @@ impl PostgresTelegramOutboxStore {
     }
 }
 
-/// Atomically enqueue one immutable outbound batch.
-pub async fn enqueue_telegram_outbox_batch(
-    pool: &PgPool,
-    batch: &TelegramOutboxBatchInput,
-) -> Result<QueuedTelegramOutboxBatch, StorageError> {
-    let mut tx = pool.begin().await?;
-    let queued = enqueue_telegram_outbox_batch_in_transaction(&mut tx, batch).await?;
-    tx.commit().await?;
-    Ok(queued)
-}
-
 pub(crate) async fn enqueue_telegram_outbox_batch_in_transaction(
     tx: &mut sqlx::Transaction<'_, Postgres>,
     batch: &TelegramOutboxBatchInput,
@@ -411,6 +430,41 @@ pub(crate) async fn enqueue_telegram_outbox_batch_in_transaction(
         });
     }
 
+    sqlx::query(SQL_LOCK_OUTBOX_BATCH)
+        .bind(&batch.batch_id)
+        .execute(&mut **tx)
+        .await?;
+    if batch.content_policy == TelegramOutboxContentPolicy::ReusePrepared {
+        let rows = sqlx::query("SELECT *, FALSE AS inserted FROM telegram_outbox WHERE batch_id = $1 ORDER BY part_index")
+            .bind(&batch.batch_id).fetch_all(&mut **tx).await?;
+        if !rows.is_empty() {
+            let mut matches = rows.len() == batch.parts.len();
+            for (row, part) in rows.iter().zip(&batch.parts) {
+                matches &= row.try_get::<i64, _>("bot_id")? == batch.bot_id
+                    && row.try_get::<Option<i64>, _>("chat_id")? == batch.chat_id
+                    && row.try_get::<Option<i32>, _>("thread_id")? == batch.thread_id
+                    && row.try_get::<String, _>("ordering_key")? == batch.ordering_key
+                    && row.try_get::<Option<i64>, _>("causation_update_id")?
+                        == batch.causation_update_id
+                    && row.try_get::<Option<i64>, _>("dialog_job_id")? == batch.dialog_job_id
+                    && row.try_get::<Option<i64>, _>("trigger_message_id")?
+                        == batch.trigger_message_id
+                    && row.try_get::<String, _>("method_kind")? == part.method_kind
+                    && row.try_get::<String, _>("delivery_policy")?
+                        == batch.delivery_policy.as_str()
+                    && row.try_get::<bool, _>("protected")? == batch.protected
+                    && row.try_get::<i32, _>("priority")? == batch.priority
+                    && row.try_get::<Option<OffsetDateTime>, _>("expires_at")? == part.expires_at;
+            }
+            if !matches {
+                return Err(StorageError::TelegramOutboxIdempotencyConflict {
+                    batch_id: batch.batch_id.clone(),
+                });
+            }
+            return queued_batch_from_rows(&batch.batch_id, rows);
+        }
+    }
+
     let mut blob_ids = HashMap::with_capacity(blobs.len());
     if !blobs.is_empty() {
         let mut builder = outbox_blob_insert_builder(&blobs);
@@ -427,10 +481,6 @@ pub(crate) async fn enqueue_telegram_outbox_batch_in_transaction(
     }
 
     let parts = prepare_parts(batch, &blob_ids)?;
-    sqlx::query(SQL_LOCK_OUTBOX_BATCH)
-        .bind(&batch.batch_id)
-        .execute(&mut **tx)
-        .await?;
     let mut builder = outbox_operation_insert_builder(batch, &parts);
     let rows = builder.build().fetch_all(&mut **tx).await?;
     if rows.len() != parts.len() {
@@ -438,6 +488,13 @@ pub(crate) async fn enqueue_telegram_outbox_batch_in_transaction(
             batch_id: batch.batch_id.clone(),
         });
     }
+    queued_batch_from_rows(&batch.batch_id, rows)
+}
+
+fn queued_batch_from_rows(
+    batch_id: &str,
+    rows: Vec<PgRow>,
+) -> Result<QueuedTelegramOutboxBatch, StorageError> {
     let mut queued = rows
         .into_iter()
         .map(|row| {
@@ -452,7 +509,7 @@ pub(crate) async fn enqueue_telegram_outbox_batch_in_transaction(
         .collect::<Result<Vec<_>, sqlx::Error>>()?;
     queued.sort_by_key(|part| part.part_index);
     Ok(QueuedTelegramOutboxBatch {
-        batch_id: batch.batch_id.clone(),
+        batch_id: batch_id.to_owned(),
         parts: queued,
     })
 }
@@ -893,6 +950,17 @@ impl PostgresTelegramOutboxStore {
         Ok(true)
     }
 
+    /// Read a real send receipt or the confirmed target of an idempotent edit.
+    pub async fn confirmed_message_id(
+        &self,
+        batch_id: &str,
+        job_id: i64,
+    ) -> Result<Option<i64>, StorageError> {
+        let id: Option<i64> = sqlx::query_scalar("SELECT COALESCE(telegram_message_ids[1], CASE WHEN delivery_policy = 'target_idempotent' THEN (payload->>'message_id')::bigint END) FROM telegram_outbox WHERE batch_id = $1 AND dialog_job_id = $2 AND part_index = 0 AND state = 'delivered'")
+            .bind(batch_id).bind(job_id).fetch_optional(&self.pool).await?.flatten();
+        Ok(id.filter(|id| *id > 0))
+    }
+
     pub async fn pending_history_receipts(
         &self,
         limit: usize,
@@ -1597,6 +1665,7 @@ mod tests {
             serde_json::json!({"test": true}),
         );
         TelegramOutboxBatchInput {
+            content_policy: crate::TelegramOutboxContentPolicy::Immutable,
             batch_id: batch_id.to_owned(),
             bot_id: 77,
             chat_id: Some(42),
@@ -1840,6 +1909,85 @@ mod tests {
         Ok(())
     }
 
+    #[tokio::test]
+    async fn live_prepared_outbox_reuses_content_and_rejects_changed_ownership()
+    -> Result<(), Box<dyn Error>> {
+        let Ok(dsn) = env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
+            return Ok(());
+        };
+        let pool = PgPoolOptions::new()
+            .max_connections(4)
+            .connect(&dsn)
+            .await?;
+        crate::run_migrations_on(&pool).await?;
+        let suffix = SystemTime::now()
+            .duration_since(SystemTime::UNIX_EPOCH)?
+            .as_nanos();
+        let mut input = batch(&format!("prepared:{suffix}"), 1);
+        input.content_policy = TelegramOutboxContentPolicy::ReusePrepared;
+        let store = PostgresTelegramOutboxStore::new(pool.clone());
+        let mut changed = input.clone();
+        changed.parts[0].payload = serde_json::json!({"text":"a newer market snapshot"});
+        let (first, second) =
+            tokio::join!(store.enqueue_batch(&input), store.enqueue_batch(&changed));
+        let first = first?;
+        let second = second?;
+        assert_eq!(first.parts[0].operation_id, second.parts[0].operation_id);
+        assert_ne!(first.parts[0].inserted, second.parts[0].inserted);
+        let persisted: serde_json::Value =
+            sqlx::query_scalar("SELECT original_payload FROM telegram_outbox WHERE batch_id = $1")
+                .bind(&input.batch_id)
+                .fetch_one(&pool)
+                .await?;
+        let expected = if first.parts[0].inserted {
+            &input.parts[0].payload
+        } else {
+            &changed.parts[0].payload
+        };
+        assert_eq!(&persisted, expected);
+        let replay = store
+            .queued_batch(input.bot_id, &input.batch_id, input.dialog_job_id)
+            .await?
+            .expect("committed batch");
+        assert_eq!(replay.parts[0].id, first.parts[0].id);
+        assert!(
+            store
+                .queued_batch(input.bot_id + 1, &input.batch_id, input.dialog_job_id)
+                .await?
+                .is_none()
+        );
+        assert!(
+            store
+                .queued_batch(input.bot_id, &input.batch_id, None)
+                .await?
+                .is_none()
+        );
+        sqlx::query("UPDATE telegram_outbox SET state = 'ambiguous' WHERE batch_id = $1")
+            .bind(&input.batch_id)
+            .execute(&pool)
+            .await?;
+        let uncertain = store.enqueue_batch(&input).await?;
+        assert_eq!(uncertain.parts[0].state, "ambiguous");
+        assert!(!uncertain.parts[0].inserted);
+        changed.chat_id = Some(999);
+        assert!(matches!(
+            store.enqueue_batch(&changed).await,
+            Err(StorageError::TelegramOutboxIdempotencyConflict { .. })
+        ));
+        changed = input.clone();
+        changed.content_policy = TelegramOutboxContentPolicy::Immutable;
+        changed.parts[0].payload = serde_json::json!({"text":"different strict payload"});
+        assert!(matches!(
+            store.enqueue_batch(&changed).await,
+            Err(StorageError::TelegramOutboxIdempotencyConflict { .. })
+        ));
+        sqlx::query("DELETE FROM telegram_outbox WHERE batch_id = $1")
+            .bind(&input.batch_id)
+            .execute(&pool)
+            .await?;
+        Ok(())
+    }
+
     #[tokio::test]
     async fn outbox_roundtrip_is_idempotent_ordered_and_fenced() -> Result<(), Box<dyn Error>> {
         let Ok(dsn) = env::var("OPENPLOTVA_TEST_POSTGRES_DSN") else {
diff --git a/crates/openplotva-telegram/src/lib.rs b/crates/openplotva-telegram/src/lib.rs
index 74702105..a36bd4b0 100644
--- a/crates/openplotva-telegram/src/lib.rs
+++ b/crates/openplotva-telegram/src/lib.rs
@@ -128,7 +128,7 @@ pub use transport::{
     telegram_execute_error_is_reply_missing,
 };
 pub use update_startup::{
-    GO_LONG_POLL_RETRY_DELAY, GO_LONG_POLL_TIMEOUT, GetUpdatesExecutor, GetUpdatesFuture,
+    GetUpdatesExecutor, GetUpdatesFuture, LONG_POLL_RETRY_DELAY, LONG_POLL_TIMEOUT,
     LongPollStreamRunReport, LongPollUpdateSource, TELEGRAM_WEBHOOK_PATH,
     TELEGRAM_WEBHOOK_SECRET_HEADER, WEBHOOK_STREAM_APPEND_TIMEOUT, WebhookCertificate,
     WebhookIngressSnapshot, WebhookSetup, WebhookUpdateRequestError, WebhookUpdateSendError,
@@ -273,7 +273,7 @@ pub fn empty_context() -> CarapaxContext {
 }
 
 /// Total per-request bound for Bot API HTTP calls. Must stay above the 60s
-/// `getUpdates` long-poll hold (`GO_LONG_POLL_TIMEOUT`) plus network slack;
+/// `getUpdates` long-poll hold (`LONG_POLL_TIMEOUT`) plus network slack;
 /// without it a half-open socket stalls outbound sends indefinitely.
 const TELEGRAM_HTTP_REQUEST_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(90);
 
diff --git a/crates/openplotva-telegram/src/update_startup.rs b/crates/openplotva-telegram/src/update_startup.rs
index 5f99586c..ed0e9f4f 100644
--- a/crates/openplotva-telegram/src/update_startup.rs
+++ b/crates/openplotva-telegram/src/update_startup.rs
@@ -25,9 +25,9 @@ use tokio::{
     time::{sleep, timeout},
 };
 
-pub const GO_LONG_POLL_TIMEOUT: Duration = Duration::from_secs(60);
+pub const LONG_POLL_TIMEOUT: Duration = Duration::from_secs(60);
 
-pub const GO_LONG_POLL_RETRY_DELAY: Duration = Duration::from_secs(3);
+pub const LONG_POLL_RETRY_DELAY: Duration = Duration::from_secs(3);
 
 pub const TELEGRAM_WEBHOOK_PATH: &str = "/telegram/webhook";
 
@@ -75,7 +75,7 @@ impl<C> LongPollUpdateSource<C> {
     pub fn new(client: C) -> Self {
         Self {
             client,
-            retry_delay: GO_LONG_POLL_RETRY_DELAY,
+            retry_delay: LONG_POLL_RETRY_DELAY,
             state: Mutex::new(LongPollState::default()),
         }
     }
@@ -213,7 +213,7 @@ where
                     record_limited_error(&mut report.append_errors, error.to_string());
                     tokio::select! {
                         _ = &mut stop => return report,
-                        () = sleep(GO_LONG_POLL_RETRY_DELAY) => {}
+                        () = sleep(LONG_POLL_RETRY_DELAY) => {}
                     }
                 }
             }
@@ -231,7 +231,7 @@ where
                 record_limited_error(&mut report.poll_errors, error.to_string());
                 tokio::select! {
                     _ = &mut stop => break,
-                    () = sleep(GO_LONG_POLL_RETRY_DELAY) => {}
+                    () = sleep(LONG_POLL_RETRY_DELAY) => {}
                 }
                 continue;
             }
@@ -300,7 +300,7 @@ where
         if serialization_failed {
             tokio::select! {
                 _ = &mut stop => break,
-                () = sleep(GO_LONG_POLL_RETRY_DELAY) => {}
+                () = sleep(LONG_POLL_RETRY_DELAY) => {}
             }
             continue;
         }
@@ -320,7 +320,7 @@ where
                     record_limited_error(&mut report.append_errors, error.to_string());
                     tokio::select! {
                         _ = &mut stop => return report,
-                        () = sleep(GO_LONG_POLL_RETRY_DELAY) => {}
+                        () = sleep(LONG_POLL_RETRY_DELAY) => {}
                     }
                 }
             }
@@ -678,7 +678,7 @@ pub fn build_get_updates_method() -> GetUpdates {
 pub fn build_get_updates_method_with_offset(offset: i64) -> GetUpdates {
     GetUpdates::default()
         .with_offset(offset)
-        .with_timeout(GO_LONG_POLL_TIMEOUT)
+        .with_timeout(LONG_POLL_TIMEOUT)
         .with_allowed_updates(product_allowed_update_set())
 }
 
@@ -716,7 +716,7 @@ mod tests {
     use serde_json::{Value, json};
 
     use super::{
-        GO_LONG_POLL_TIMEOUT, LongPollUpdateSource, TELEGRAM_WEBHOOK_PATH,
+        LONG_POLL_TIMEOUT, LongPollUpdateSource, TELEGRAM_WEBHOOK_PATH,
         TELEGRAM_WEBHOOK_SECRET_HEADER, WebhookSetup, WebhookUpdateRequestError,
         build_delete_webhook_method, build_get_updates_method, build_set_webhook_method,
     };
@@ -735,7 +735,7 @@ mod tests {
             payload.get("limit").is_none(),
             "Zero update limit stays unset"
         );
-        assert_eq!(GO_LONG_POLL_TIMEOUT.as_secs(), 60);
+        assert_eq!(LONG_POLL_TIMEOUT.as_secs(), 60);
     }
 
     #[test]
diff --git a/docs/CODEBASE_MAP.md b/docs/CODEBASE_MAP.md
index 5e6c63fe..a0c9bb89 100644
--- a/docs/CODEBASE_MAP.md
+++ b/docs/CODEBASE_MAP.md
@@ -1,13 +1,72 @@
 ---
-last_mapped: 2026-07-06T11:56:22Z
-total_files: 432
-total_tokens: 1563741
+last_mapped: 2026-11-07
+baseline_revision: 39ad37049b5bcc1a6c6462b535d4b2bdb5b2f0a2
+mapping_scope: runtime ownership and traced feature paths
 ---
 
 # OpenPlotva Codebase Map
 
-> Auto-generated by Cartographer. Last mapped: 2026-07-06.
-> Update 2026-07-06: merged deltas for centralized reply finalization (PR #17, deployed) and memory enrichment / consolidation op-set (PR #15, merged to main, not yet deployed). See "Recent Changes" below.
+> Ownership and execution-path update: 2026-11-07, local refactor against `39ad370`.
+> Earlier dated change and deployment notes below are historical records.
+
+## Current operation owners
+
+| Operation | Owner and source |
+| --- | --- |
+| Provider selection, fallback, request budget and capacity | `app/routed_attempts.rs`, `llm/router` |
+| Selected protocol, endpoint, credentials and wire model | `app/provider_transport.rs`; `RoutedAttempt` carries the selected protocol and overrides |
+| Dialog adapter construction | `app/dialog_runtime.rs::ChatClientFactory`; uses the captured attempt without another routing-table lookup |
+| Vendor request/response and polling | Existing adapters in `llm` and `media`; Discovery redaction is now `llm/redaction.rs` |
+| HTTP behavior and request state | `app/http/{auth,entities,settings,memory,shield,taskman,routing,observability,redis,ingress}.rs` |
+| HTTP entity/settings/Redis persistence | `storage/{entities,app_settings,redis_inspector}.rs`; GraphQL adapters project those same records |
+| Final rich delivery | `app/rich.rs::RichOutbox` prepares the existing Postgres outbox; `app/telegram_outbox.rs` sends and resolves actual receipts |
+| Song preparation and receipt metadata | `storage/songs.rs`; migrations 213/214 add nullable preparation and stable job identity without rewriting legacy rows |
+| Control jobs | `app/control_jobs.rs::PersistentControlJobQueue` calls shared taskman directly; one typed worker dispatches feature executors |
+| Worker assembly and lifecycle | Root creates dependencies and combines existing `RuntimeWorkerGroup`s; dispatcher, queue maintenance and memory groups own their actual inputs |
+| One-time routing updates | Existing startup order and persisted markers, with shared advisory-locked transactions in `storage/llm_routing.rs` |
+
+```mermaid
+flowchart LR
+  F[Feature handler] --> W[Shared routed attempt walker]
+  W --> T[Selected protocol and transport configuration]
+  T --> A[Concrete adapter]
+  A --> P[Provider]
+  R[Feature result] --> C[Prepared Telegram command]
+  C --> O[Existing Postgres outbox]
+  O --> X[Telegram transport]
+  X --> I[Actual receipt]
+  I --> J[Linked job completion]
+```
+
+The root assembles HTTP routes and dependencies. It no longer owns HTTP handlers
+or their runtime SQL. Thirty-one endpoint-to-response forwarding calls were
+removed. One shared routed walker supplies the feature adapters; ASR retains its
+intentional quota-free walker.
+
+Music, rates, check-in, help and VIP status reuse cause-based delivery identities.
+A replay looks up existing delivery before preparing content again. Prepared
+payloads and uploaded media references survive restart. Music/check-in tasks wait
+for delivery and save real Telegram message IDs after confirmation. Temporary
+streaming drafts and game progress remain transient. An uncertain Telegram send
+remains a distinct outcome; this design does not promise exactly-once delivery.
+
+Persisted `ChatMemberSync` values still decode and drain in one compatibility
+branch. Fresh membership uses projections and admin sync. Startup marker keys,
+persisted queue/checkpoint formats, shutdown phases, deadlines and draining remain.
+The fake pprof routes are removed. The Rust qwen backfill alias is removed while
+its persisted setting key remains. The unused `MEMORY_CONSOLIDATION_PROVIDER`
+selector is removed because the routing table owns that choice.
+
+The provider smoke uses the actual selected-route client factory. Adding a
+provider that speaks an existing protocol requires routing/provider data, rather
+than provider-name branches in each feature. Adding a wire protocol still requires
+its concrete adapter and typed protocol handling.
+
+The HTML before/after report is a separate task artifact. Its file edges are
+static change-impact references, not a compiler-resolved call graph. Moving code
+can increase those file edges; the measured improvements are removed rules,
+forwarding calls and runtime paths, plus fewer production code lines.
+
 
 OpenPlotva is a Telegram bot + web service runtime written in Rust (~20-crate
 workspace), migrated from a Go original (`go-plotva`). It provides an agentic
@@ -18,8 +77,8 @@ GraphQL "runtime API" for live diagnostics over pinned TLS.
 
 The system runs as a single process backed by Postgres 17 + pgvector and
 Dragonfly (= Redis). Producers/consumers of Telegram updates can be toggled
-independently; all outbound sends flow through a persisted, debounced, deduped
-dispatcher queue.
+independently. Final sends use the existing persisted dispatcher/outbox paths;
+streaming drafts and temporary progress use their explicit transient transport.
 
 ---
 
@@ -214,7 +273,7 @@ openplotva/
 │   ├── openplotva-telegram/       # Bot API boundary: dispatcher, transport, rich API, dedup, rate limit, Stars
 │   ├── openplotva-storage/        # SQLx Postgres + Redis stores, embedded migrations, AES-GCM key sealing
 │   ├── openplotva-taskman/        # Durable in-memory job queue core with WAL/snapshot codecs
-│   ├── openplotva-server/         # Axum runtime API: Bearer auth, GraphQL, TLS, pprof stubs, token mechanics
+│   ├── openplotva-server/         # Axum runtime API: Bearer auth, GraphQL, TLS, token mechanics
 │   ├── openplotva-web/            # Web asset registry + sha256 guards + Telegram signature/cookie primitives
 │   ├── openplotva-memory/         # Memory extraction pipeline: cards, episodes, links, bitemporal retrieval
 │   ├── openplotva-history/        # Chat-history summary cascade (token fitting, coverage-cursor merge)
@@ -496,7 +555,7 @@ Public health router + protected Runtime API (Axum). Bearer `prt_<id>.<secret>`
 tokens (SHA-256 secret, constant-time, 24h TTL). GraphQL schema (~30 queries,
 5 mutations) over a pluggable `RuntimeApiLiveDiagnostics` inspector lattice —
 any inspector left `None` degrades gracefully. Self-signed TLS via `rcgen`
-with browser-style HPKP pin. pprof endpoints intentionally stub Go profiles.
+with browser-style HPKP pin. Removed pprof paths use the authenticated 404 fallback.
 
 #### `openplotva-web`
 Web security boundary: two Telegram KDFs (Login Widget vs WebApp `initData` —
diff --git a/migrations/213_prepared_song_delivery.down.sql b/migrations/213_prepared_song_delivery.down.sql
new file mode 100644
index 00000000..44abe7a3
--- /dev/null
+++ b/migrations/213_prepared_song_delivery.down.sql
@@ -0,0 +1,2 @@
+-- Prepared payloads cannot be reconstructed after rollback. Drain music delivery before rollback.
+ALTER TABLE generated_songs DROP COLUMN prepared_delivery;
diff --git a/migrations/213_prepared_song_delivery.up.sql b/migrations/213_prepared_song_delivery.up.sql
new file mode 100644
index 00000000..4d6fb8e8
--- /dev/null
+++ b/migrations/213_prepared_song_delivery.up.sql
@@ -0,0 +1,2 @@
+-- Existing songs retain NULL preparation data and remain readable.
+ALTER TABLE generated_songs ADD COLUMN prepared_delivery jsonb;
diff --git a/migrations/214_prepared_song_delivery_identity.down.sql b/migrations/214_prepared_song_delivery_identity.down.sql
new file mode 100644
index 00000000..ac076940
--- /dev/null
+++ b/migrations/214_prepared_song_delivery_identity.down.sql
@@ -0,0 +1,2 @@
+-- no-transaction
+DROP INDEX CONCURRENTLY IF EXISTS generated_songs_job_prepared_idx;
diff --git a/migrations/214_prepared_song_delivery_identity.up.sql b/migrations/214_prepared_song_delivery_identity.up.sql
new file mode 100644
index 00000000..ac4336fc
--- /dev/null
+++ b/migrations/214_prepared_song_delivery_identity.up.sql
@@ -0,0 +1,4 @@
+-- no-transaction
+CREATE UNIQUE INDEX CONCURRENTLY generated_songs_job_prepared_idx
+    ON generated_songs (job_id)
+    WHERE job_id IS NOT NULL AND prepared_delivery IS NOT NULL;
diff --git a/tools/provider-smoke.sh b/tools/provider-smoke.sh
index 08a61031..7b7a9e25 100755
--- a/tools/provider-smoke.sh
+++ b/tools/provider-smoke.sh
@@ -26,7 +26,7 @@ Optional env:
   OPENPLOTVA_PROVIDER_SMOKE_LOOPBACK          auto, 1, or 0; default auto runs selected live-shaped fake provider smokes when live inputs are absent
   SERPER_API_KEY                               Serper API key for live smoke
   GOOGLEAI_KEY                                 Gemini direct/provider smoke key
-  OPENROUTER_KEY                               OpenRouter GenKit-compatible dialog smoke key
+  OPENROUTER_KEY                               OpenRouter dialog smoke key
   OPENPLOTVA_SERPER_SMOKE_QUERY               live Serper search query
   OPENPLOTVA_PROVIDER_SMOKE_TELEGRAM          run Telegram getMe smoke when BOT_KEY is set, default 1
   OPENPLOTVA_PROVIDER_SMOKE_TELEGRAM_MEMBERSHIP
@@ -90,10 +90,6 @@ provider_loopback_enabled() {
   esac
 }
 
-google_ai_key_source_present() {
-  [[ -n "${GOOGLEAI_KEY:-}" || -n "${GOOGLEAI_KEY_STATS_FILE:-}" ]]
-}
-
 validate_auto_mode() {
   local name="$1"
   local value="$2"
@@ -296,12 +292,11 @@ run_llm_provider_contract_smoke() {
 }
 
 run_genkit_openai_compatible_contract_smoke() {
-  echo "+ offline GenKit OpenRouter compatibility smokes"
-  cargo test -p openplotva-app genkit_openai_compatible -- --nocapture
-  cargo test -p openplotva-app genkit_dialog_provider_factory_builds_openrouter_plugin_route -- --nocapture
-  cargo test -p openplotva-app genkit_dialog_provider_factory_preserves_go_google_key_requirement_for_plugin_routes -- --nocapture
-  cargo test -p openplotva-app provider_media_genkit_fallback_routes -- --nocapture
-  cargo test -p openplotva-app provider_youtube_config_routes -- --nocapture
+  echo "+ offline provider routing contracts"
+  cargo test -p openplotva-app provider_transport::tests:: -- --nocapture
+  cargo test -p openplotva-app factory_respects_explicit_openai_protocol_on_a_google_named_provider -- --nocapture
+  cargo test -p openplotva-app media::tests:: -- --nocapture
+  cargo test -p openplotva-app youtube::tests:: -- --nocapture
 }
 
 run_gemini_live_smoke() {
@@ -339,15 +334,7 @@ run_openrouter_live_smoke() {
     echo "+ skip OpenRouter live smoke: OPENROUTER_KEY not set"
     return
   fi
-  if ! google_ai_key_source_present; then
-    if [[ "$mode" == "1" ]]; then
-      echo "GOOGLEAI_KEY or GOOGLEAI_KEY_STATS_FILE is required by the configured GenKit plugin route" >&2
-      exit 1
-    fi
-    echo "+ skip OpenRouter live smoke: Google AI key source not set"
-    return
-  fi
-  echo "+ live OpenRouter GenKit-compatible dialog smoke"
+  echo "+ live OpenRouter routed dialog smoke"
   cargo test -p openplotva-app live_genkit_openrouter_dialog_smoke_completes_minimal_prompt \
     -- --ignored --nocapture
 }