diff --git a/Dockerfile b/Dockerfile
index c4e5b4e..cbe3c55 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,6 +26,18 @@ WORKDIR /app/server
 COPY server/package.json server/package-lock.json* ./
 RUN npm ci --omit=dev --ignore-scripts 2>/dev/null || npm install --omit=dev --ignore-scripts
 
+# better-sqlite3 is a native (C++) module — `--ignore-scripts` above
+# skips the postinstall hook that fetches its prebuilt binary for our
+# platform. Rebuild it explicitly so prebuild-install runs. python3 +
+# make + g++ are the fallback toolchain if no prebuilt matches (e.g.
+# on uncommon arches); on linux-x64/arm64 the prebuild downloads in
+# seconds and the compiler is never invoked. This stage is discarded
+# from the final image, so the install footprint doesn't matter.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      python3 make g++ \
+  && npm rebuild better-sqlite3 \
+  && rm -rf /var/lib/apt/lists/*
+
 # ── Stage 2: Final runtime image ───────────────────────────
 FROM node:20-slim AS runner
 
diff --git a/assets/qrcode.min.js b/assets/qrcode.min.js
new file mode 100644
index 0000000..76889b5
--- /dev/null
+++ b/assets/qrcode.min.js
@@ -0,0 +1,2297 @@
+//---------------------------------------------------------------------
+//
+// QR Code Generator for JavaScript
+//
+// Copyright (c) 2009 Kazuhiko Arase
+//
+// URL: http://www.d-project.com/
+//
+// Licensed under the MIT license:
+//  http://www.opensource.org/licenses/mit-license.php
+//
+// The word 'QR Code' is registered trademark of
+// DENSO WAVE INCORPORATED
+//  http://www.denso-wave.com/qrcode/faqpatent-e.html
+//
+//---------------------------------------------------------------------
+
+var qrcode = function() {
+
+  //---------------------------------------------------------------------
+  // qrcode
+  //---------------------------------------------------------------------
+
+  /**
+   * qrcode
+   * @param typeNumber 1 to 40
+   * @param errorCorrectionLevel 'L','M','Q','H'
+   */
+  var qrcode = function(typeNumber, errorCorrectionLevel) {
+
+    var PAD0 = 0xEC;
+    var PAD1 = 0x11;
+
+    var _typeNumber = typeNumber;
+    var _errorCorrectionLevel = QRErrorCorrectionLevel[errorCorrectionLevel];
+    var _modules = null;
+    var _moduleCount = 0;
+    var _dataCache = null;
+    var _dataList = [];
+
+    var _this = {};
+
+    var makeImpl = function(test, maskPattern) {
+
+      _moduleCount = _typeNumber * 4 + 17;
+      _modules = function(moduleCount) {
+        var modules = new Array(moduleCount);
+        for (var row = 0; row < moduleCount; row += 1) {
+          modules[row] = new Array(moduleCount);
+          for (var col = 0; col < moduleCount; col += 1) {
+            modules[row][col] = null;
+          }
+        }
+        return modules;
+      }(_moduleCount);
+
+      setupPositionProbePattern(0, 0);
+      setupPositionProbePattern(_moduleCount - 7, 0);
+      setupPositionProbePattern(0, _moduleCount - 7);
+      setupPositionAdjustPattern();
+      setupTimingPattern();
+      setupTypeInfo(test, maskPattern);
+
+      if (_typeNumber >= 7) {
+        setupTypeNumber(test);
+      }
+
+      if (_dataCache == null) {
+        _dataCache = createData(_typeNumber, _errorCorrectionLevel, _dataList);
+      }
+
+      mapData(_dataCache, maskPattern);
+    };
+
+    var setupPositionProbePattern = function(row, col) {
+
+      for (var r = -1; r <= 7; r += 1) {
+
+        if (row + r <= -1 || _moduleCount <= row + r) continue;
+
+        for (var c = -1; c <= 7; c += 1) {
+
+          if (col + c <= -1 || _moduleCount <= col + c) continue;
+
+          if ( (0 <= r && r <= 6 && (c == 0 || c == 6) )
+              || (0 <= c && c <= 6 && (r == 0 || r == 6) )
+              || (2 <= r && r <= 4 && 2 <= c && c <= 4) ) {
+            _modules[row + r][col + c] = true;
+          } else {
+            _modules[row + r][col + c] = false;
+          }
+        }
+      }
+    };
+
+    var getBestMaskPattern = function() {
+
+      var minLostPoint = 0;
+      var pattern = 0;
+
+      for (var i = 0; i < 8; i += 1) {
+
+        makeImpl(true, i);
+
+        var lostPoint = QRUtil.getLostPoint(_this);
+
+        if (i == 0 || minLostPoint > lostPoint) {
+          minLostPoint = lostPoint;
+          pattern = i;
+        }
+      }
+
+      return pattern;
+    };
+
+    var setupTimingPattern = function() {
+
+      for (var r = 8; r < _moduleCount - 8; r += 1) {
+        if (_modules[r][6] != null) {
+          continue;
+        }
+        _modules[r][6] = (r % 2 == 0);
+      }
+
+      for (var c = 8; c < _moduleCount - 8; c += 1) {
+        if (_modules[6][c] != null) {
+          continue;
+        }
+        _modules[6][c] = (c % 2 == 0);
+      }
+    };
+
+    var setupPositionAdjustPattern = function() {
+
+      var pos = QRUtil.getPatternPosition(_typeNumber);
+
+      for (var i = 0; i < pos.length; i += 1) {
+
+        for (var j = 0; j < pos.length; j += 1) {
+
+          var row = pos[i];
+          var col = pos[j];
+
+          if (_modules[row][col] != null) {
+            continue;
+          }
+
+          for (var r = -2; r <= 2; r += 1) {
+
+            for (var c = -2; c <= 2; c += 1) {
+
+              if (r == -2 || r == 2 || c == -2 || c == 2
+                  || (r == 0 && c == 0) ) {
+                _modules[row + r][col + c] = true;
+              } else {
+                _modules[row + r][col + c] = false;
+              }
+            }
+          }
+        }
+      }
+    };
+
+    var setupTypeNumber = function(test) {
+
+      var bits = QRUtil.getBCHTypeNumber(_typeNumber);
+
+      for (var i = 0; i < 18; i += 1) {
+        var mod = (!test && ( (bits >> i) & 1) == 1);
+        _modules[Math.floor(i / 3)][i % 3 + _moduleCount - 8 - 3] = mod;
+      }
+
+      for (var i = 0; i < 18; i += 1) {
+        var mod = (!test && ( (bits >> i) & 1) == 1);
+        _modules[i % 3 + _moduleCount - 8 - 3][Math.floor(i / 3)] = mod;
+      }
+    };
+
+    var setupTypeInfo = function(test, maskPattern) {
+
+      var data = (_errorCorrectionLevel << 3) | maskPattern;
+      var bits = QRUtil.getBCHTypeInfo(data);
+
+      // vertical
+      for (var i = 0; i < 15; i += 1) {
+
+        var mod = (!test && ( (bits >> i) & 1) == 1);
+
+        if (i < 6) {
+          _modules[i][8] = mod;
+        } else if (i < 8) {
+          _modules[i + 1][8] = mod;
+        } else {
+          _modules[_moduleCount - 15 + i][8] = mod;
+        }
+      }
+
+      // horizontal
+      for (var i = 0; i < 15; i += 1) {
+
+        var mod = (!test && ( (bits >> i) & 1) == 1);
+
+        if (i < 8) {
+          _modules[8][_moduleCount - i - 1] = mod;
+        } else if (i < 9) {
+          _modules[8][15 - i - 1 + 1] = mod;
+        } else {
+          _modules[8][15 - i - 1] = mod;
+        }
+      }
+
+      // fixed module
+      _modules[_moduleCount - 8][8] = (!test);
+    };
+
+    var mapData = function(data, maskPattern) {
+
+      var inc = -1;
+      var row = _moduleCount - 1;
+      var bitIndex = 7;
+      var byteIndex = 0;
+      var maskFunc = QRUtil.getMaskFunction(maskPattern);
+
+      for (var col = _moduleCount - 1; col > 0; col -= 2) {
+
+        if (col == 6) col -= 1;
+
+        while (true) {
+
+          for (var c = 0; c < 2; c += 1) {
+
+            if (_modules[row][col - c] == null) {
+
+              var dark = false;
+
+              if (byteIndex < data.length) {
+                dark = ( ( (data[byteIndex] >>> bitIndex) & 1) == 1);
+              }
+
+              var mask = maskFunc(row, col - c);
+
+              if (mask) {
+                dark = !dark;
+              }
+
+              _modules[row][col - c] = dark;
+              bitIndex -= 1;
+
+              if (bitIndex == -1) {
+                byteIndex += 1;
+                bitIndex = 7;
+              }
+            }
+          }
+
+          row += inc;
+
+          if (row < 0 || _moduleCount <= row) {
+            row -= inc;
+            inc = -inc;
+            break;
+          }
+        }
+      }
+    };
+
+    var createBytes = function(buffer, rsBlocks) {
+
+      var offset = 0;
+
+      var maxDcCount = 0;
+      var maxEcCount = 0;
+
+      var dcdata = new Array(rsBlocks.length);
+      var ecdata = new Array(rsBlocks.length);
+
+      for (var r = 0; r < rsBlocks.length; r += 1) {
+
+        var dcCount = rsBlocks[r].dataCount;
+        var ecCount = rsBlocks[r].totalCount - dcCount;
+
+        maxDcCount = Math.max(maxDcCount, dcCount);
+        maxEcCount = Math.max(maxEcCount, ecCount);
+
+        dcdata[r] = new Array(dcCount);
+
+        for (var i = 0; i < dcdata[r].length; i += 1) {
+          dcdata[r][i] = 0xff & buffer.getBuffer()[i + offset];
+        }
+        offset += dcCount;
+
+        var rsPoly = QRUtil.getErrorCorrectPolynomial(ecCount);
+        var rawPoly = qrPolynomial(dcdata[r], rsPoly.getLength() - 1);
+
+        var modPoly = rawPoly.mod(rsPoly);
+        ecdata[r] = new Array(rsPoly.getLength() - 1);
+        for (var i = 0; i < ecdata[r].length; i += 1) {
+          var modIndex = i + modPoly.getLength() - ecdata[r].length;
+          ecdata[r][i] = (modIndex >= 0)? modPoly.getAt(modIndex) : 0;
+        }
+      }
+
+      var totalCodeCount = 0;
+      for (var i = 0; i < rsBlocks.length; i += 1) {
+        totalCodeCount += rsBlocks[i].totalCount;
+      }
+
+      var data = new Array(totalCodeCount);
+      var index = 0;
+
+      for (var i = 0; i < maxDcCount; i += 1) {
+        for (var r = 0; r < rsBlocks.length; r += 1) {
+          if (i < dcdata[r].length) {
+            data[index] = dcdata[r][i];
+            index += 1;
+          }
+        }
+      }
+
+      for (var i = 0; i < maxEcCount; i += 1) {
+        for (var r = 0; r < rsBlocks.length; r += 1) {
+          if (i < ecdata[r].length) {
+            data[index] = ecdata[r][i];
+            index += 1;
+          }
+        }
+      }
+
+      return data;
+    };
+
+    var createData = function(typeNumber, errorCorrectionLevel, dataList) {
+
+      var rsBlocks = QRRSBlock.getRSBlocks(typeNumber, errorCorrectionLevel);
+
+      var buffer = qrBitBuffer();
+
+      for (var i = 0; i < dataList.length; i += 1) {
+        var data = dataList[i];
+        buffer.put(data.getMode(), 4);
+        buffer.put(data.getLength(), QRUtil.getLengthInBits(data.getMode(), typeNumber) );
+        data.write(buffer);
+      }
+
+      // calc num max data.
+      var totalDataCount = 0;
+      for (var i = 0; i < rsBlocks.length; i += 1) {
+        totalDataCount += rsBlocks[i].dataCount;
+      }
+
+      if (buffer.getLengthInBits() > totalDataCount * 8) {
+        throw 'code length overflow. ('
+          + buffer.getLengthInBits()
+          + '>'
+          + totalDataCount * 8
+          + ')';
+      }
+
+      // end code
+      if (buffer.getLengthInBits() + 4 <= totalDataCount * 8) {
+        buffer.put(0, 4);
+      }
+
+      // padding
+      while (buffer.getLengthInBits() % 8 != 0) {
+        buffer.putBit(false);
+      }
+
+      // padding
+      while (true) {
+
+        if (buffer.getLengthInBits() >= totalDataCount * 8) {
+          break;
+        }
+        buffer.put(PAD0, 8);
+
+        if (buffer.getLengthInBits() >= totalDataCount * 8) {
+          break;
+        }
+        buffer.put(PAD1, 8);
+      }
+
+      return createBytes(buffer, rsBlocks);
+    };
+
+    _this.addData = function(data, mode) {
+
+      mode = mode || 'Byte';
+
+      var newData = null;
+
+      switch(mode) {
+      case 'Numeric' :
+        newData = qrNumber(data);
+        break;
+      case 'Alphanumeric' :
+        newData = qrAlphaNum(data);
+        break;
+      case 'Byte' :
+        newData = qr8BitByte(data);
+        break;
+      case 'Kanji' :
+        newData = qrKanji(data);
+        break;
+      default :
+        throw 'mode:' + mode;
+      }
+
+      _dataList.push(newData);
+      _dataCache = null;
+    };
+
+    _this.isDark = function(row, col) {
+      if (row < 0 || _moduleCount <= row || col < 0 || _moduleCount <= col) {
+        throw row + ',' + col;
+      }
+      return _modules[row][col];
+    };
+
+    _this.getModuleCount = function() {
+      return _moduleCount;
+    };
+
+    _this.make = function() {
+      if (_typeNumber < 1) {
+        var typeNumber = 1;
+
+        for (; typeNumber < 40; typeNumber++) {
+          var rsBlocks = QRRSBlock.getRSBlocks(typeNumber, _errorCorrectionLevel);
+          var buffer = qrBitBuffer();
+
+          for (var i = 0; i < _dataList.length; i++) {
+            var data = _dataList[i];
+            buffer.put(data.getMode(), 4);
+            buffer.put(data.getLength(), QRUtil.getLengthInBits(data.getMode(), typeNumber) );
+            data.write(buffer);
+          }
+
+          var totalDataCount = 0;
+          for (var i = 0; i < rsBlocks.length; i++) {
+            totalDataCount += rsBlocks[i].dataCount;
+          }
+
+          if (buffer.getLengthInBits() <= totalDataCount * 8) {
+            break;
+          }
+        }
+
+        _typeNumber = typeNumber;
+      }
+
+      makeImpl(false, getBestMaskPattern() );
+    };
+
+    _this.createTableTag = function(cellSize, margin) {
+
+      cellSize = cellSize || 2;
+      margin = (typeof margin == 'undefined')? cellSize * 4 : margin;
+
+      var qrHtml = '';
+
+      qrHtml += '<table style="';
+      qrHtml += ' border-width: 0px; border-style: none;';
+      qrHtml += ' border-collapse: collapse;';
+      qrHtml += ' padding: 0px; margin: ' + margin + 'px;';
+      qrHtml += '">';
+      qrHtml += '<tbody>';
+
+      for (var r = 0; r < _this.getModuleCount(); r += 1) {
+
+        qrHtml += '<tr>';
+
+        for (var c = 0; c < _this.getModuleCount(); c += 1) {
+          qrHtml += '<td style="';
+          qrHtml += ' border-width: 0px; border-style: none;';
+          qrHtml += ' border-collapse: collapse;';
+          qrHtml += ' padding: 0px; margin: 0px;';
+          qrHtml += ' width: ' + cellSize + 'px;';
+          qrHtml += ' height: ' + cellSize + 'px;';
+          qrHtml += ' background-color: ';
+          qrHtml += _this.isDark(r, c)? '#000000' : '#ffffff';
+          qrHtml += ';';
+          qrHtml += '"/>';
+        }
+
+        qrHtml += '</tr>';
+      }
+
+      qrHtml += '</tbody>';
+      qrHtml += '</table>';
+
+      return qrHtml;
+    };
+
+    _this.createSvgTag = function(cellSize, margin, alt, title) {
+
+      var opts = {};
+      if (typeof arguments[0] == 'object') {
+        // Called by options.
+        opts = arguments[0];
+        // overwrite cellSize and margin.
+        cellSize = opts.cellSize;
+        margin = opts.margin;
+        alt = opts.alt;
+        title = opts.title;
+      }
+
+      cellSize = cellSize || 2;
+      margin = (typeof margin == 'undefined')? cellSize * 4 : margin;
+
+      // Compose alt property surrogate
+      alt = (typeof alt === 'string') ? {text: alt} : alt || {};
+      alt.text = alt.text || null;
+      alt.id = (alt.text) ? alt.id || 'qrcode-description' : null;
+
+      // Compose title property surrogate
+      title = (typeof title === 'string') ? {text: title} : title || {};
+      title.text = title.text || null;
+      title.id = (title.text) ? title.id || 'qrcode-title' : null;
+
+      var size = _this.getModuleCount() * cellSize + margin * 2;
+      var c, mc, r, mr, qrSvg='', rect;
+
+      rect = 'l' + cellSize + ',0 0,' + cellSize +
+        ' -' + cellSize + ',0 0,-' + cellSize + 'z ';
+
+      qrSvg += '<svg version="1.1" xmlns="http://www.w3.org/2000/svg"';
+      qrSvg += !opts.scalable ? ' width="' + size + 'px" height="' + size + 'px"' : '';
+      qrSvg += ' viewBox="0 0 ' + size + ' ' + size + '" ';
+      qrSvg += ' preserveAspectRatio="xMinYMin meet"';
+      qrSvg += (title.text || alt.text) ? ' role="img" aria-labelledby="' +
+          escapeXml([title.id, alt.id].join(' ').trim() ) + '"' : '';
+      qrSvg += '>';
+      qrSvg += (title.text) ? '<title id="' + escapeXml(title.id) + '">' +
+          escapeXml(title.text) + '</title>' : '';
+      qrSvg += (alt.text) ? '<description id="' + escapeXml(alt.id) + '">' +
+          escapeXml(alt.text) + '</description>' : '';
+      qrSvg += '<rect width="100%" height="100%" fill="white" cx="0" cy="0"/>';
+      qrSvg += '<path d="';
+
+      for (r = 0; r < _this.getModuleCount(); r += 1) {
+        mr = r * cellSize + margin;
+        for (c = 0; c < _this.getModuleCount(); c += 1) {
+          if (_this.isDark(r, c) ) {
+            mc = c*cellSize+margin;
+            qrSvg += 'M' + mc + ',' + mr + rect;
+          }
+        }
+      }
+
+      qrSvg += '" stroke="transparent" fill="black"/>';
+      qrSvg += '</svg>';
+
+      return qrSvg;
+    };
+
+    _this.createDataURL = function(cellSize, margin) {
+
+      cellSize = cellSize || 2;
+      margin = (typeof margin == 'undefined')? cellSize * 4 : margin;
+
+      var size = _this.getModuleCount() * cellSize + margin * 2;
+      var min = margin;
+      var max = size - margin;
+
+      return createDataURL(size, size, function(x, y) {
+        if (min <= x && x < max && min <= y && y < max) {
+          var c = Math.floor( (x - min) / cellSize);
+          var r = Math.floor( (y - min) / cellSize);
+          return _this.isDark(r, c)? 0 : 1;
+        } else {
+          return 1;
+        }
+      } );
+    };
+
+    _this.createImgTag = function(cellSize, margin, alt) {
+
+      cellSize = cellSize || 2;
+      margin = (typeof margin == 'undefined')? cellSize * 4 : margin;
+
+      var size = _this.getModuleCount() * cellSize + margin * 2;
+
+      var img = '';
+      img += '<img';
+      img += '\u0020src="';
+      img += _this.createDataURL(cellSize, margin);
+      img += '"';
+      img += '\u0020width="';
+      img += size;
+      img += '"';
+      img += '\u0020height="';
+      img += size;
+      img += '"';
+      if (alt) {
+        img += '\u0020alt="';
+        img += escapeXml(alt);
+        img += '"';
+      }
+      img += '/>';
+
+      return img;
+    };
+
+    var escapeXml = function(s) {
+      var escaped = '';
+      for (var i = 0; i < s.length; i += 1) {
+        var c = s.charAt(i);
+        switch(c) {
+        case '<': escaped += '&lt;'; break;
+        case '>': escaped += '&gt;'; break;
+        case '&': escaped += '&amp;'; break;
+        case '"': escaped += '&quot;'; break;
+        default : escaped += c; break;
+        }
+      }
+      return escaped;
+    };
+
+    var _createHalfASCII = function(margin) {
+      var cellSize = 1;
+      margin = (typeof margin == 'undefined')? cellSize * 2 : margin;
+
+      var size = _this.getModuleCount() * cellSize + margin * 2;
+      var min = margin;
+      var max = size - margin;
+
+      var y, x, r1, r2, p;
+
+      var blocks = {
+        '██': '█',
+        '█ ': '▀',
+        ' █': '▄',
+        '  ': ' '
+      };
+
+      var blocksLastLineNoMargin = {
+        '██': '▀',
+        '█ ': '▀',
+        ' █': ' ',
+        '  ': ' '
+      };
+
+      var ascii = '';
+      for (y = 0; y < size; y += 2) {
+        r1 = Math.floor((y - min) / cellSize);
+        r2 = Math.floor((y + 1 - min) / cellSize);
+        for (x = 0; x < size; x += 1) {
+          p = '█';
+
+          if (min <= x && x < max && min <= y && y < max && _this.isDark(r1, Math.floor((x - min) / cellSize))) {
+            p = ' ';
+          }
+
+          if (min <= x && x < max && min <= y+1 && y+1 < max && _this.isDark(r2, Math.floor((x - min) / cellSize))) {
+            p += ' ';
+          }
+          else {
+            p += '█';
+          }
+
+          // Output 2 characters per pixel, to create full square. 1 character per pixels gives only half width of square.
+          ascii += (margin < 1 && y+1 >= max) ? blocksLastLineNoMargin[p] : blocks[p];
+        }
+
+        ascii += '\n';
+      }
+
+      if (size % 2 && margin > 0) {
+        return ascii.substring(0, ascii.length - size - 1) + Array(size+1).join('▀');
+      }
+
+      return ascii.substring(0, ascii.length-1);
+    };
+
+    _this.createASCII = function(cellSize, margin) {
+      cellSize = cellSize || 1;
+
+      if (cellSize < 2) {
+        return _createHalfASCII(margin);
+      }
+
+      cellSize -= 1;
+      margin = (typeof margin == 'undefined')? cellSize * 2 : margin;
+
+      var size = _this.getModuleCount() * cellSize + margin * 2;
+      var min = margin;
+      var max = size - margin;
+
+      var y, x, r, p;
+
+      var white = Array(cellSize+1).join('██');
+      var black = Array(cellSize+1).join('  ');
+
+      var ascii = '';
+      var line = '';
+      for (y = 0; y < size; y += 1) {
+        r = Math.floor( (y - min) / cellSize);
+        line = '';
+        for (x = 0; x < size; x += 1) {
+          p = 1;
+
+          if (min <= x && x < max && min <= y && y < max && _this.isDark(r, Math.floor((x - min) / cellSize))) {
+            p = 0;
+          }
+
+          // Output 2 characters per pixel, to create full square. 1 character per pixels gives only half width of square.
+          line += p ? white : black;
+        }
+
+        for (r = 0; r < cellSize; r += 1) {
+          ascii += line + '\n';
+        }
+      }
+
+      return ascii.substring(0, ascii.length-1);
+    };
+
+    _this.renderTo2dContext = function(context, cellSize) {
+      cellSize = cellSize || 2;
+      var length = _this.getModuleCount();
+      for (var row = 0; row < length; row++) {
+        for (var col = 0; col < length; col++) {
+          context.fillStyle = _this.isDark(row, col) ? 'black' : 'white';
+          context.fillRect(row * cellSize, col * cellSize, cellSize, cellSize);
+        }
+      }
+    }
+
+    return _this;
+  };
+
+  //---------------------------------------------------------------------
+  // qrcode.stringToBytes
+  //---------------------------------------------------------------------
+
+  qrcode.stringToBytesFuncs = {
+    'default' : function(s) {
+      var bytes = [];
+      for (var i = 0; i < s.length; i += 1) {
+        var c = s.charCodeAt(i);
+        bytes.push(c & 0xff);
+      }
+      return bytes;
+    }
+  };
+
+  qrcode.stringToBytes = qrcode.stringToBytesFuncs['default'];
+
+  //---------------------------------------------------------------------
+  // qrcode.createStringToBytes
+  //---------------------------------------------------------------------
+
+  /**
+   * @param unicodeData base64 string of byte array.
+   * [16bit Unicode],[16bit Bytes], ...
+   * @param numChars
+   */
+  qrcode.createStringToBytes = function(unicodeData, numChars) {
+
+    // create conversion map.
+
+    var unicodeMap = function() {
+
+      var bin = base64DecodeInputStream(unicodeData);
+      var read = function() {
+        var b = bin.read();
+        if (b == -1) throw 'eof';
+        return b;
+      };
+
+      var count = 0;
+      var unicodeMap = {};
+      while (true) {
+        var b0 = bin.read();
+        if (b0 == -1) break;
+        var b1 = read();
+        var b2 = read();
+        var b3 = read();
+        var k = String.fromCharCode( (b0 << 8) | b1);
+        var v = (b2 << 8) | b3;
+        unicodeMap[k] = v;
+        count += 1;
+      }
+      if (count != numChars) {
+        throw count + ' != ' + numChars;
+      }
+
+      return unicodeMap;
+    }();
+
+    var unknownChar = '?'.charCodeAt(0);
+
+    return function(s) {
+      var bytes = [];
+      for (var i = 0; i < s.length; i += 1) {
+        var c = s.charCodeAt(i);
+        if (c < 128) {
+          bytes.push(c);
+        } else {
+          var b = unicodeMap[s.charAt(i)];
+          if (typeof b == 'number') {
+            if ( (b & 0xff) == b) {
+              // 1byte
+              bytes.push(b);
+            } else {
+              // 2bytes
+              bytes.push(b >>> 8);
+              bytes.push(b & 0xff);
+            }
+          } else {
+            bytes.push(unknownChar);
+          }
+        }
+      }
+      return bytes;
+    };
+  };
+
+  //---------------------------------------------------------------------
+  // QRMode
+  //---------------------------------------------------------------------
+
+  var QRMode = {
+    MODE_NUMBER :    1 << 0,
+    MODE_ALPHA_NUM : 1 << 1,
+    MODE_8BIT_BYTE : 1 << 2,
+    MODE_KANJI :     1 << 3
+  };
+
+  //---------------------------------------------------------------------
+  // QRErrorCorrectionLevel
+  //---------------------------------------------------------------------
+
+  var QRErrorCorrectionLevel = {
+    L : 1,
+    M : 0,
+    Q : 3,
+    H : 2
+  };
+
+  //---------------------------------------------------------------------
+  // QRMaskPattern
+  //---------------------------------------------------------------------
+
+  var QRMaskPattern = {
+    PATTERN000 : 0,
+    PATTERN001 : 1,
+    PATTERN010 : 2,
+    PATTERN011 : 3,
+    PATTERN100 : 4,
+    PATTERN101 : 5,
+    PATTERN110 : 6,
+    PATTERN111 : 7
+  };
+
+  //---------------------------------------------------------------------
+  // QRUtil
+  //---------------------------------------------------------------------
+
+  var QRUtil = function() {
+
+    var PATTERN_POSITION_TABLE = [
+      [],
+      [6, 18],
+      [6, 22],
+      [6, 26],
+      [6, 30],
+      [6, 34],
+      [6, 22, 38],
+      [6, 24, 42],
+      [6, 26, 46],
+      [6, 28, 50],
+      [6, 30, 54],
+      [6, 32, 58],
+      [6, 34, 62],
+      [6, 26, 46, 66],
+      [6, 26, 48, 70],
+      [6, 26, 50, 74],
+      [6, 30, 54, 78],
+      [6, 30, 56, 82],
+      [6, 30, 58, 86],
+      [6, 34, 62, 90],
+      [6, 28, 50, 72, 94],
+      [6, 26, 50, 74, 98],
+      [6, 30, 54, 78, 102],
+      [6, 28, 54, 80, 106],
+      [6, 32, 58, 84, 110],
+      [6, 30, 58, 86, 114],
+      [6, 34, 62, 90, 118],
+      [6, 26, 50, 74, 98, 122],
+      [6, 30, 54, 78, 102, 126],
+      [6, 26, 52, 78, 104, 130],
+      [6, 30, 56, 82, 108, 134],
+      [6, 34, 60, 86, 112, 138],
+      [6, 30, 58, 86, 114, 142],
+      [6, 34, 62, 90, 118, 146],
+      [6, 30, 54, 78, 102, 126, 150],
+      [6, 24, 50, 76, 102, 128, 154],
+      [6, 28, 54, 80, 106, 132, 158],
+      [6, 32, 58, 84, 110, 136, 162],
+      [6, 26, 54, 82, 110, 138, 166],
+      [6, 30, 58, 86, 114, 142, 170]
+    ];
+    var G15 = (1 << 10) | (1 << 8) | (1 << 5) | (1 << 4) | (1 << 2) | (1 << 1) | (1 << 0);
+    var G18 = (1 << 12) | (1 << 11) | (1 << 10) | (1 << 9) | (1 << 8) | (1 << 5) | (1 << 2) | (1 << 0);
+    var G15_MASK = (1 << 14) | (1 << 12) | (1 << 10) | (1 << 4) | (1 << 1);
+
+    var _this = {};
+
+    var getBCHDigit = function(data) {
+      var digit = 0;
+      while (data != 0) {
+        digit += 1;
+        data >>>= 1;
+      }
+      return digit;
+    };
+
+    _this.getBCHTypeInfo = function(data) {
+      var d = data << 10;
+      while (getBCHDigit(d) - getBCHDigit(G15) >= 0) {
+        d ^= (G15 << (getBCHDigit(d) - getBCHDigit(G15) ) );
+      }
+      return ( (data << 10) | d) ^ G15_MASK;
+    };
+
+    _this.getBCHTypeNumber = function(data) {
+      var d = data << 12;
+      while (getBCHDigit(d) - getBCHDigit(G18) >= 0) {
+        d ^= (G18 << (getBCHDigit(d) - getBCHDigit(G18) ) );
+      }
+      return (data << 12) | d;
+    };
+
+    _this.getPatternPosition = function(typeNumber) {
+      return PATTERN_POSITION_TABLE[typeNumber - 1];
+    };
+
+    _this.getMaskFunction = function(maskPattern) {
+
+      switch (maskPattern) {
+
+      case QRMaskPattern.PATTERN000 :
+        return function(i, j) { return (i + j) % 2 == 0; };
+      case QRMaskPattern.PATTERN001 :
+        return function(i, j) { return i % 2 == 0; };
+      case QRMaskPattern.PATTERN010 :
+        return function(i, j) { return j % 3 == 0; };
+      case QRMaskPattern.PATTERN011 :
+        return function(i, j) { return (i + j) % 3 == 0; };
+      case QRMaskPattern.PATTERN100 :
+        return function(i, j) { return (Math.floor(i / 2) + Math.floor(j / 3) ) % 2 == 0; };
+      case QRMaskPattern.PATTERN101 :
+        return function(i, j) { return (i * j) % 2 + (i * j) % 3 == 0; };
+      case QRMaskPattern.PATTERN110 :
+        return function(i, j) { return ( (i * j) % 2 + (i * j) % 3) % 2 == 0; };
+      case QRMaskPattern.PATTERN111 :
+        return function(i, j) { return ( (i * j) % 3 + (i + j) % 2) % 2 == 0; };
+
+      default :
+        throw 'bad maskPattern:' + maskPattern;
+      }
+    };
+
+    _this.getErrorCorrectPolynomial = function(errorCorrectLength) {
+      var a = qrPolynomial([1], 0);
+      for (var i = 0; i < errorCorrectLength; i += 1) {
+        a = a.multiply(qrPolynomial([1, QRMath.gexp(i)], 0) );
+      }
+      return a;
+    };
+
+    _this.getLengthInBits = function(mode, type) {
+
+      if (1 <= type && type < 10) {
+
+        // 1 - 9
+
+        switch(mode) {
+        case QRMode.MODE_NUMBER    : return 10;
+        case QRMode.MODE_ALPHA_NUM : return 9;
+        case QRMode.MODE_8BIT_BYTE : return 8;
+        case QRMode.MODE_KANJI     : return 8;
+        default :
+          throw 'mode:' + mode;
+        }
+
+      } else if (type < 27) {
+
+        // 10 - 26
+
+        switch(mode) {
+        case QRMode.MODE_NUMBER    : return 12;
+        case QRMode.MODE_ALPHA_NUM : return 11;
+        case QRMode.MODE_8BIT_BYTE : return 16;
+        case QRMode.MODE_KANJI     : return 10;
+        default :
+          throw 'mode:' + mode;
+        }
+
+      } else if (type < 41) {
+
+        // 27 - 40
+
+        switch(mode) {
+        case QRMode.MODE_NUMBER    : return 14;
+        case QRMode.MODE_ALPHA_NUM : return 13;
+        case QRMode.MODE_8BIT_BYTE : return 16;
+        case QRMode.MODE_KANJI     : return 12;
+        default :
+          throw 'mode:' + mode;
+        }
+
+      } else {
+        throw 'type:' + type;
+      }
+    };
+
+    _this.getLostPoint = function(qrcode) {
+
+      var moduleCount = qrcode.getModuleCount();
+
+      var lostPoint = 0;
+
+      // LEVEL1
+
+      for (var row = 0; row < moduleCount; row += 1) {
+        for (var col = 0; col < moduleCount; col += 1) {
+
+          var sameCount = 0;
+          var dark = qrcode.isDark(row, col);
+
+          for (var r = -1; r <= 1; r += 1) {
+
+            if (row + r < 0 || moduleCount <= row + r) {
+              continue;
+            }
+
+            for (var c = -1; c <= 1; c += 1) {
+
+              if (col + c < 0 || moduleCount <= col + c) {
+                continue;
+              }
+
+              if (r == 0 && c == 0) {
+                continue;
+              }
+
+              if (dark == qrcode.isDark(row + r, col + c) ) {
+                sameCount += 1;
+              }
+            }
+          }
+
+          if (sameCount > 5) {
+            lostPoint += (3 + sameCount - 5);
+          }
+        }
+      };
+
+      // LEVEL2
+
+      for (var row = 0; row < moduleCount - 1; row += 1) {
+        for (var col = 0; col < moduleCount - 1; col += 1) {
+          var count = 0;
+          if (qrcode.isDark(row, col) ) count += 1;
+          if (qrcode.isDark(row + 1, col) ) count += 1;
+          if (qrcode.isDark(row, col + 1) ) count += 1;
+          if (qrcode.isDark(row + 1, col + 1) ) count += 1;
+          if (count == 0 || count == 4) {
+            lostPoint += 3;
+          }
+        }
+      }
+
+      // LEVEL3
+
+      for (var row = 0; row < moduleCount; row += 1) {
+        for (var col = 0; col < moduleCount - 6; col += 1) {
+          if (qrcode.isDark(row, col)
+              && !qrcode.isDark(row, col + 1)
+              &&  qrcode.isDark(row, col + 2)
+              &&  qrcode.isDark(row, col + 3)
+              &&  qrcode.isDark(row, col + 4)
+              && !qrcode.isDark(row, col + 5)
+              &&  qrcode.isDark(row, col + 6) ) {
+            lostPoint += 40;
+          }
+        }
+      }
+
+      for (var col = 0; col < moduleCount; col += 1) {
+        for (var row = 0; row < moduleCount - 6; row += 1) {
+          if (qrcode.isDark(row, col)
+              && !qrcode.isDark(row + 1, col)
+              &&  qrcode.isDark(row + 2, col)
+              &&  qrcode.isDark(row + 3, col)
+              &&  qrcode.isDark(row + 4, col)
+              && !qrcode.isDark(row + 5, col)
+              &&  qrcode.isDark(row + 6, col) ) {
+            lostPoint += 40;
+          }
+        }
+      }
+
+      // LEVEL4
+
+      var darkCount = 0;
+
+      for (var col = 0; col < moduleCount; col += 1) {
+        for (var row = 0; row < moduleCount; row += 1) {
+          if (qrcode.isDark(row, col) ) {
+            darkCount += 1;
+          }
+        }
+      }
+
+      var ratio = Math.abs(100 * darkCount / moduleCount / moduleCount - 50) / 5;
+      lostPoint += ratio * 10;
+
+      return lostPoint;
+    };
+
+    return _this;
+  }();
+
+  //---------------------------------------------------------------------
+  // QRMath
+  //---------------------------------------------------------------------
+
+  var QRMath = function() {
+
+    var EXP_TABLE = new Array(256);
+    var LOG_TABLE = new Array(256);
+
+    // initialize tables
+    for (var i = 0; i < 8; i += 1) {
+      EXP_TABLE[i] = 1 << i;
+    }
+    for (var i = 8; i < 256; i += 1) {
+      EXP_TABLE[i] = EXP_TABLE[i - 4]
+        ^ EXP_TABLE[i - 5]
+        ^ EXP_TABLE[i - 6]
+        ^ EXP_TABLE[i - 8];
+    }
+    for (var i = 0; i < 255; i += 1) {
+      LOG_TABLE[EXP_TABLE[i] ] = i;
+    }
+
+    var _this = {};
+
+    _this.glog = function(n) {
+
+      if (n < 1) {
+        throw 'glog(' + n + ')';
+      }
+
+      return LOG_TABLE[n];
+    };
+
+    _this.gexp = function(n) {
+
+      while (n < 0) {
+        n += 255;
+      }
+
+      while (n >= 256) {
+        n -= 255;
+      }
+
+      return EXP_TABLE[n];
+    };
+
+    return _this;
+  }();
+
+  //---------------------------------------------------------------------
+  // qrPolynomial
+  //---------------------------------------------------------------------
+
+  function qrPolynomial(num, shift) {
+
+    if (typeof num.length == 'undefined') {
+      throw num.length + '/' + shift;
+    }
+
+    var _num = function() {
+      var offset = 0;
+      while (offset < num.length && num[offset] == 0) {
+        offset += 1;
+      }
+      var _num = new Array(num.length - offset + shift);
+      for (var i = 0; i < num.length - offset; i += 1) {
+        _num[i] = num[i + offset];
+      }
+      return _num;
+    }();
+
+    var _this = {};
+
+    _this.getAt = function(index) {
+      return _num[index];
+    };
+
+    _this.getLength = function() {
+      return _num.length;
+    };
+
+    _this.multiply = function(e) {
+
+      var num = new Array(_this.getLength() + e.getLength() - 1);
+
+      for (var i = 0; i < _this.getLength(); i += 1) {
+        for (var j = 0; j < e.getLength(); j += 1) {
+          num[i + j] ^= QRMath.gexp(QRMath.glog(_this.getAt(i) ) + QRMath.glog(e.getAt(j) ) );
+        }
+      }
+
+      return qrPolynomial(num, 0);
+    };
+
+    _this.mod = function(e) {
+
+      if (_this.getLength() - e.getLength() < 0) {
+        return _this;
+      }
+
+      var ratio = QRMath.glog(_this.getAt(0) ) - QRMath.glog(e.getAt(0) );
+
+      var num = new Array(_this.getLength() );
+      for (var i = 0; i < _this.getLength(); i += 1) {
+        num[i] = _this.getAt(i);
+      }
+
+      for (var i = 0; i < e.getLength(); i += 1) {
+        num[i] ^= QRMath.gexp(QRMath.glog(e.getAt(i) ) + ratio);
+      }
+
+      // recursive call
+      return qrPolynomial(num, 0).mod(e);
+    };
+
+    return _this;
+  };
+
+  //---------------------------------------------------------------------
+  // QRRSBlock
+  //---------------------------------------------------------------------
+
+  var QRRSBlock = function() {
+
+    var RS_BLOCK_TABLE = [
+
+      // L
+      // M
+      // Q
+      // H
+
+      // 1
+      [1, 26, 19],
+      [1, 26, 16],
+      [1, 26, 13],
+      [1, 26, 9],
+
+      // 2
+      [1, 44, 34],
+      [1, 44, 28],
+      [1, 44, 22],
+      [1, 44, 16],
+
+      // 3
+      [1, 70, 55],
+      [1, 70, 44],
+      [2, 35, 17],
+      [2, 35, 13],
+
+      // 4
+      [1, 100, 80],
+      [2, 50, 32],
+      [2, 50, 24],
+      [4, 25, 9],
+
+      // 5
+      [1, 134, 108],
+      [2, 67, 43],
+      [2, 33, 15, 2, 34, 16],
+      [2, 33, 11, 2, 34, 12],
+
+      // 6
+      [2, 86, 68],
+      [4, 43, 27],
+      [4, 43, 19],
+      [4, 43, 15],
+
+      // 7
+      [2, 98, 78],
+      [4, 49, 31],
+      [2, 32, 14, 4, 33, 15],
+      [4, 39, 13, 1, 40, 14],
+
+      // 8
+      [2, 121, 97],
+      [2, 60, 38, 2, 61, 39],
+      [4, 40, 18, 2, 41, 19],
+      [4, 40, 14, 2, 41, 15],
+
+      // 9
+      [2, 146, 116],
+      [3, 58, 36, 2, 59, 37],
+      [4, 36, 16, 4, 37, 17],
+      [4, 36, 12, 4, 37, 13],
+
+      // 10
+      [2, 86, 68, 2, 87, 69],
+      [4, 69, 43, 1, 70, 44],
+      [6, 43, 19, 2, 44, 20],
+      [6, 43, 15, 2, 44, 16],
+
+      // 11
+      [4, 101, 81],
+      [1, 80, 50, 4, 81, 51],
+      [4, 50, 22, 4, 51, 23],
+      [3, 36, 12, 8, 37, 13],
+
+      // 12
+      [2, 116, 92, 2, 117, 93],
+      [6, 58, 36, 2, 59, 37],
+      [4, 46, 20, 6, 47, 21],
+      [7, 42, 14, 4, 43, 15],
+
+      // 13
+      [4, 133, 107],
+      [8, 59, 37, 1, 60, 38],
+      [8, 44, 20, 4, 45, 21],
+      [12, 33, 11, 4, 34, 12],
+
+      // 14
+      [3, 145, 115, 1, 146, 116],
+      [4, 64, 40, 5, 65, 41],
+      [11, 36, 16, 5, 37, 17],
+      [11, 36, 12, 5, 37, 13],
+
+      // 15
+      [5, 109, 87, 1, 110, 88],
+      [5, 65, 41, 5, 66, 42],
+      [5, 54, 24, 7, 55, 25],
+      [11, 36, 12, 7, 37, 13],
+
+      // 16
+      [5, 122, 98, 1, 123, 99],
+      [7, 73, 45, 3, 74, 46],
+      [15, 43, 19, 2, 44, 20],
+      [3, 45, 15, 13, 46, 16],
+
+      // 17
+      [1, 135, 107, 5, 136, 108],
+      [10, 74, 46, 1, 75, 47],
+      [1, 50, 22, 15, 51, 23],
+      [2, 42, 14, 17, 43, 15],
+
+      // 18
+      [5, 150, 120, 1, 151, 121],
+      [9, 69, 43, 4, 70, 44],
+      [17, 50, 22, 1, 51, 23],
+      [2, 42, 14, 19, 43, 15],
+
+      // 19
+      [3, 141, 113, 4, 142, 114],
+      [3, 70, 44, 11, 71, 45],
+      [17, 47, 21, 4, 48, 22],
+      [9, 39, 13, 16, 40, 14],
+
+      // 20
+      [3, 135, 107, 5, 136, 108],
+      [3, 67, 41, 13, 68, 42],
+      [15, 54, 24, 5, 55, 25],
+      [15, 43, 15, 10, 44, 16],
+
+      // 21
+      [4, 144, 116, 4, 145, 117],
+      [17, 68, 42],
+      [17, 50, 22, 6, 51, 23],
+      [19, 46, 16, 6, 47, 17],
+
+      // 22
+      [2, 139, 111, 7, 140, 112],
+      [17, 74, 46],
+      [7, 54, 24, 16, 55, 25],
+      [34, 37, 13],
+
+      // 23
+      [4, 151, 121, 5, 152, 122],
+      [4, 75, 47, 14, 76, 48],
+      [11, 54, 24, 14, 55, 25],
+      [16, 45, 15, 14, 46, 16],
+
+      // 24
+      [6, 147, 117, 4, 148, 118],
+      [6, 73, 45, 14, 74, 46],
+      [11, 54, 24, 16, 55, 25],
+      [30, 46, 16, 2, 47, 17],
+
+      // 25
+      [8, 132, 106, 4, 133, 107],
+      [8, 75, 47, 13, 76, 48],
+      [7, 54, 24, 22, 55, 25],
+      [22, 45, 15, 13, 46, 16],
+
+      // 26
+      [10, 142, 114, 2, 143, 115],
+      [19, 74, 46, 4, 75, 47],
+      [28, 50, 22, 6, 51, 23],
+      [33, 46, 16, 4, 47, 17],
+
+      // 27
+      [8, 152, 122, 4, 153, 123],
+      [22, 73, 45, 3, 74, 46],
+      [8, 53, 23, 26, 54, 24],
+      [12, 45, 15, 28, 46, 16],
+
+      // 28
+      [3, 147, 117, 10, 148, 118],
+      [3, 73, 45, 23, 74, 46],
+      [4, 54, 24, 31, 55, 25],
+      [11, 45, 15, 31, 46, 16],
+
+      // 29
+      [7, 146, 116, 7, 147, 117],
+      [21, 73, 45, 7, 74, 46],
+      [1, 53, 23, 37, 54, 24],
+      [19, 45, 15, 26, 46, 16],
+
+      // 30
+      [5, 145, 115, 10, 146, 116],
+      [19, 75, 47, 10, 76, 48],
+      [15, 54, 24, 25, 55, 25],
+      [23, 45, 15, 25, 46, 16],
+
+      // 31
+      [13, 145, 115, 3, 146, 116],
+      [2, 74, 46, 29, 75, 47],
+      [42, 54, 24, 1, 55, 25],
+      [23, 45, 15, 28, 46, 16],
+
+      // 32
+      [17, 145, 115],
+      [10, 74, 46, 23, 75, 47],
+      [10, 54, 24, 35, 55, 25],
+      [19, 45, 15, 35, 46, 16],
+
+      // 33
+      [17, 145, 115, 1, 146, 116],
+      [14, 74, 46, 21, 75, 47],
+      [29, 54, 24, 19, 55, 25],
+      [11, 45, 15, 46, 46, 16],
+
+      // 34
+      [13, 145, 115, 6, 146, 116],
+      [14, 74, 46, 23, 75, 47],
+      [44, 54, 24, 7, 55, 25],
+      [59, 46, 16, 1, 47, 17],
+
+      // 35
+      [12, 151, 121, 7, 152, 122],
+      [12, 75, 47, 26, 76, 48],
+      [39, 54, 24, 14, 55, 25],
+      [22, 45, 15, 41, 46, 16],
+
+      // 36
+      [6, 151, 121, 14, 152, 122],
+      [6, 75, 47, 34, 76, 48],
+      [46, 54, 24, 10, 55, 25],
+      [2, 45, 15, 64, 46, 16],
+
+      // 37
+      [17, 152, 122, 4, 153, 123],
+      [29, 74, 46, 14, 75, 47],
+      [49, 54, 24, 10, 55, 25],
+      [24, 45, 15, 46, 46, 16],
+
+      // 38
+      [4, 152, 122, 18, 153, 123],
+      [13, 74, 46, 32, 75, 47],
+      [48, 54, 24, 14, 55, 25],
+      [42, 45, 15, 32, 46, 16],
+
+      // 39
+      [20, 147, 117, 4, 148, 118],
+      [40, 75, 47, 7, 76, 48],
+      [43, 54, 24, 22, 55, 25],
+      [10, 45, 15, 67, 46, 16],
+
+      // 40
+      [19, 148, 118, 6, 149, 119],
+      [18, 75, 47, 31, 76, 48],
+      [34, 54, 24, 34, 55, 25],
+      [20, 45, 15, 61, 46, 16]
+    ];
+
+    var qrRSBlock = function(totalCount, dataCount) {
+      var _this = {};
+      _this.totalCount = totalCount;
+      _this.dataCount = dataCount;
+      return _this;
+    };
+
+    var _this = {};
+
+    var getRsBlockTable = function(typeNumber, errorCorrectionLevel) {
+
+      switch(errorCorrectionLevel) {
+      case QRErrorCorrectionLevel.L :
+        return RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 0];
+      case QRErrorCorrectionLevel.M :
+        return RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 1];
+      case QRErrorCorrectionLevel.Q :
+        return RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 2];
+      case QRErrorCorrectionLevel.H :
+        return RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 3];
+      default :
+        return undefined;
+      }
+    };
+
+    _this.getRSBlocks = function(typeNumber, errorCorrectionLevel) {
+
+      var rsBlock = getRsBlockTable(typeNumber, errorCorrectionLevel);
+
+      if (typeof rsBlock == 'undefined') {
+        throw 'bad rs block @ typeNumber:' + typeNumber +
+            '/errorCorrectionLevel:' + errorCorrectionLevel;
+      }
+
+      var length = rsBlock.length / 3;
+
+      var list = [];
+
+      for (var i = 0; i < length; i += 1) {
+
+        var count = rsBlock[i * 3 + 0];
+        var totalCount = rsBlock[i * 3 + 1];
+        var dataCount = rsBlock[i * 3 + 2];
+
+        for (var j = 0; j < count; j += 1) {
+          list.push(qrRSBlock(totalCount, dataCount) );
+        }
+      }
+
+      return list;
+    };
+
+    return _this;
+  }();
+
+  //---------------------------------------------------------------------
+  // qrBitBuffer
+  //---------------------------------------------------------------------
+
+  var qrBitBuffer = function() {
+
+    var _buffer = [];
+    var _length = 0;
+
+    var _this = {};
+
+    _this.getBuffer = function() {
+      return _buffer;
+    };
+
+    _this.getAt = function(index) {
+      var bufIndex = Math.floor(index / 8);
+      return ( (_buffer[bufIndex] >>> (7 - index % 8) ) & 1) == 1;
+    };
+
+    _this.put = function(num, length) {
+      for (var i = 0; i < length; i += 1) {
+        _this.putBit( ( (num >>> (length - i - 1) ) & 1) == 1);
+      }
+    };
+
+    _this.getLengthInBits = function() {
+      return _length;
+    };
+
+    _this.putBit = function(bit) {
+
+      var bufIndex = Math.floor(_length / 8);
+      if (_buffer.length <= bufIndex) {
+        _buffer.push(0);
+      }
+
+      if (bit) {
+        _buffer[bufIndex] |= (0x80 >>> (_length % 8) );
+      }
+
+      _length += 1;
+    };
+
+    return _this;
+  };
+
+  //---------------------------------------------------------------------
+  // qrNumber
+  //---------------------------------------------------------------------
+
+  var qrNumber = function(data) {
+
+    var _mode = QRMode.MODE_NUMBER;
+    var _data = data;
+
+    var _this = {};
+
+    _this.getMode = function() {
+      return _mode;
+    };
+
+    _this.getLength = function(buffer) {
+      return _data.length;
+    };
+
+    _this.write = function(buffer) {
+
+      var data = _data;
+
+      var i = 0;
+
+      while (i + 2 < data.length) {
+        buffer.put(strToNum(data.substring(i, i + 3) ), 10);
+        i += 3;
+      }
+
+      if (i < data.length) {
+        if (data.length - i == 1) {
+          buffer.put(strToNum(data.substring(i, i + 1) ), 4);
+        } else if (data.length - i == 2) {
+          buffer.put(strToNum(data.substring(i, i + 2) ), 7);
+        }
+      }
+    };
+
+    var strToNum = function(s) {
+      var num = 0;
+      for (var i = 0; i < s.length; i += 1) {
+        num = num * 10 + chatToNum(s.charAt(i) );
+      }
+      return num;
+    };
+
+    var chatToNum = function(c) {
+      if ('0' <= c && c <= '9') {
+        return c.charCodeAt(0) - '0'.charCodeAt(0);
+      }
+      throw 'illegal char :' + c;
+    };
+
+    return _this;
+  };
+
+  //---------------------------------------------------------------------
+  // qrAlphaNum
+  //---------------------------------------------------------------------
+
+  var qrAlphaNum = function(data) {
+
+    var _mode = QRMode.MODE_ALPHA_NUM;
+    var _data = data;
+
+    var _this = {};
+
+    _this.getMode = function() {
+      return _mode;
+    };
+
+    _this.getLength = function(buffer) {
+      return _data.length;
+    };
+
+    _this.write = function(buffer) {
+
+      var s = _data;
+
+      var i = 0;
+
+      while (i + 1 < s.length) {
+        buffer.put(
+          getCode(s.charAt(i) ) * 45 +
+          getCode(s.charAt(i + 1) ), 11);
+        i += 2;
+      }
+
+      if (i < s.length) {
+        buffer.put(getCode(s.charAt(i) ), 6);
+      }
+    };
+
+    var getCode = function(c) {
+
+      if ('0' <= c && c <= '9') {
+        return c.charCodeAt(0) - '0'.charCodeAt(0);
+      } else if ('A' <= c && c <= 'Z') {
+        return c.charCodeAt(0) - 'A'.charCodeAt(0) + 10;
+      } else {
+        switch (c) {
+        case ' ' : return 36;
+        case '$' : return 37;
+        case '%' : return 38;
+        case '*' : return 39;
+        case '+' : return 40;
+        case '-' : return 41;
+        case '.' : return 42;
+        case '/' : return 43;
+        case ':' : return 44;
+        default :
+          throw 'illegal char :' + c;
+        }
+      }
+    };
+
+    return _this;
+  };
+
+  //---------------------------------------------------------------------
+  // qr8BitByte
+  //---------------------------------------------------------------------
+
+  var qr8BitByte = function(data) {
+
+    var _mode = QRMode.MODE_8BIT_BYTE;
+    var _data = data;
+    var _bytes = qrcode.stringToBytes(data);
+
+    var _this = {};
+
+    _this.getMode = function() {
+      return _mode;
+    };
+
+    _this.getLength = function(buffer) {
+      return _bytes.length;
+    };
+
+    _this.write = function(buffer) {
+      for (var i = 0; i < _bytes.length; i += 1) {
+        buffer.put(_bytes[i], 8);
+      }
+    };
+
+    return _this;
+  };
+
+  //---------------------------------------------------------------------
+  // qrKanji
+  //---------------------------------------------------------------------
+
+  var qrKanji = function(data) {
+
+    var _mode = QRMode.MODE_KANJI;
+    var _data = data;
+
+    var stringToBytes = qrcode.stringToBytesFuncs['SJIS'];
+    if (!stringToBytes) {
+      throw 'sjis not supported.';
+    }
+    !function(c, code) {
+      // self test for sjis support.
+      var test = stringToBytes(c);
+      if (test.length != 2 || ( (test[0] << 8) | test[1]) != code) {
+        throw 'sjis not supported.';
+      }
+    }('\u53cb', 0x9746);
+
+    var _bytes = stringToBytes(data);
+
+    var _this = {};
+
+    _this.getMode = function() {
+      return _mode;
+    };
+
+    _this.getLength = function(buffer) {
+      return ~~(_bytes.length / 2);
+    };
+
+    _this.write = function(buffer) {
+
+      var data = _bytes;
+
+      var i = 0;
+
+      while (i + 1 < data.length) {
+
+        var c = ( (0xff & data[i]) << 8) | (0xff & data[i + 1]);
+
+        if (0x8140 <= c && c <= 0x9FFC) {
+          c -= 0x8140;
+        } else if (0xE040 <= c && c <= 0xEBBF) {
+          c -= 0xC140;
+        } else {
+          throw 'illegal char at ' + (i + 1) + '/' + c;
+        }
+
+        c = ( (c >>> 8) & 0xff) * 0xC0 + (c & 0xff);
+
+        buffer.put(c, 13);
+
+        i += 2;
+      }
+
+      if (i < data.length) {
+        throw 'illegal char at ' + (i + 1);
+      }
+    };
+
+    return _this;
+  };
+
+  //=====================================================================
+  // GIF Support etc.
+  //
+
+  //---------------------------------------------------------------------
+  // byteArrayOutputStream
+  //---------------------------------------------------------------------
+
+  var byteArrayOutputStream = function() {
+
+    var _bytes = [];
+
+    var _this = {};
+
+    _this.writeByte = function(b) {
+      _bytes.push(b & 0xff);
+    };
+
+    _this.writeShort = function(i) {
+      _this.writeByte(i);
+      _this.writeByte(i >>> 8);
+    };
+
+    _this.writeBytes = function(b, off, len) {
+      off = off || 0;
+      len = len || b.length;
+      for (var i = 0; i < len; i += 1) {
+        _this.writeByte(b[i + off]);
+      }
+    };
+
+    _this.writeString = function(s) {
+      for (var i = 0; i < s.length; i += 1) {
+        _this.writeByte(s.charCodeAt(i) );
+      }
+    };
+
+    _this.toByteArray = function() {
+      return _bytes;
+    };
+
+    _this.toString = function() {
+      var s = '';
+      s += '[';
+      for (var i = 0; i < _bytes.length; i += 1) {
+        if (i > 0) {
+          s += ',';
+        }
+        s += _bytes[i];
+      }
+      s += ']';
+      return s;
+    };
+
+    return _this;
+  };
+
+  //---------------------------------------------------------------------
+  // base64EncodeOutputStream
+  //---------------------------------------------------------------------
+
+  var base64EncodeOutputStream = function() {
+
+    var _buffer = 0;
+    var _buflen = 0;
+    var _length = 0;
+    var _base64 = '';
+
+    var _this = {};
+
+    var writeEncoded = function(b) {
+      _base64 += String.fromCharCode(encode(b & 0x3f) );
+    };
+
+    var encode = function(n) {
+      if (n < 0) {
+        // error.
+      } else if (n < 26) {
+        return 0x41 + n;
+      } else if (n < 52) {
+        return 0x61 + (n - 26);
+      } else if (n < 62) {
+        return 0x30 + (n - 52);
+      } else if (n == 62) {
+        return 0x2b;
+      } else if (n == 63) {
+        return 0x2f;
+      }
+      throw 'n:' + n;
+    };
+
+    _this.writeByte = function(n) {
+
+      _buffer = (_buffer << 8) | (n & 0xff);
+      _buflen += 8;
+      _length += 1;
+
+      while (_buflen >= 6) {
+        writeEncoded(_buffer >>> (_buflen - 6) );
+        _buflen -= 6;
+      }
+    };
+
+    _this.flush = function() {
+
+      if (_buflen > 0) {
+        writeEncoded(_buffer << (6 - _buflen) );
+        _buffer = 0;
+        _buflen = 0;
+      }
+
+      if (_length % 3 != 0) {
+        // padding
+        var padlen = 3 - _length % 3;
+        for (var i = 0; i < padlen; i += 1) {
+          _base64 += '=';
+        }
+      }
+    };
+
+    _this.toString = function() {
+      return _base64;
+    };
+
+    return _this;
+  };
+
+  //---------------------------------------------------------------------
+  // base64DecodeInputStream
+  //---------------------------------------------------------------------
+
+  var base64DecodeInputStream = function(str) {
+
+    var _str = str;
+    var _pos = 0;
+    var _buffer = 0;
+    var _buflen = 0;
+
+    var _this = {};
+
+    _this.read = function() {
+
+      while (_buflen < 8) {
+
+        if (_pos >= _str.length) {
+          if (_buflen == 0) {
+            return -1;
+          }
+          throw 'unexpected end of file./' + _buflen;
+        }
+
+        var c = _str.charAt(_pos);
+        _pos += 1;
+
+        if (c == '=') {
+          _buflen = 0;
+          return -1;
+        } else if (c.match(/^\s$/) ) {
+          // ignore if whitespace.
+          continue;
+        }
+
+        _buffer = (_buffer << 6) | decode(c.charCodeAt(0) );
+        _buflen += 6;
+      }
+
+      var n = (_buffer >>> (_buflen - 8) ) & 0xff;
+      _buflen -= 8;
+      return n;
+    };
+
+    var decode = function(c) {
+      if (0x41 <= c && c <= 0x5a) {
+        return c - 0x41;
+      } else if (0x61 <= c && c <= 0x7a) {
+        return c - 0x61 + 26;
+      } else if (0x30 <= c && c <= 0x39) {
+        return c - 0x30 + 52;
+      } else if (c == 0x2b) {
+        return 62;
+      } else if (c == 0x2f) {
+        return 63;
+      } else {
+        throw 'c:' + c;
+      }
+    };
+
+    return _this;
+  };
+
+  //---------------------------------------------------------------------
+  // gifImage (B/W)
+  //---------------------------------------------------------------------
+
+  var gifImage = function(width, height) {
+
+    var _width = width;
+    var _height = height;
+    var _data = new Array(width * height);
+
+    var _this = {};
+
+    _this.setPixel = function(x, y, pixel) {
+      _data[y * _width + x] = pixel;
+    };
+
+    _this.write = function(out) {
+
+      //---------------------------------
+      // GIF Signature
+
+      out.writeString('GIF87a');
+
+      //---------------------------------
+      // Screen Descriptor
+
+      out.writeShort(_width);
+      out.writeShort(_height);
+
+      out.writeByte(0x80); // 2bit
+      out.writeByte(0);
+      out.writeByte(0);
+
+      //---------------------------------
+      // Global Color Map
+
+      // black
+      out.writeByte(0x00);
+      out.writeByte(0x00);
+      out.writeByte(0x00);
+
+      // white
+      out.writeByte(0xff);
+      out.writeByte(0xff);
+      out.writeByte(0xff);
+
+      //---------------------------------
+      // Image Descriptor
+
+      out.writeString(',');
+      out.writeShort(0);
+      out.writeShort(0);
+      out.writeShort(_width);
+      out.writeShort(_height);
+      out.writeByte(0);
+
+      //---------------------------------
+      // Local Color Map
+
+      //---------------------------------
+      // Raster Data
+
+      var lzwMinCodeSize = 2;
+      var raster = getLZWRaster(lzwMinCodeSize);
+
+      out.writeByte(lzwMinCodeSize);
+
+      var offset = 0;
+
+      while (raster.length - offset > 255) {
+        out.writeByte(255);
+        out.writeBytes(raster, offset, 255);
+        offset += 255;
+      }
+
+      out.writeByte(raster.length - offset);
+      out.writeBytes(raster, offset, raster.length - offset);
+      out.writeByte(0x00);
+
+      //---------------------------------
+      // GIF Terminator
+      out.writeString(';');
+    };
+
+    var bitOutputStream = function(out) {
+
+      var _out = out;
+      var _bitLength = 0;
+      var _bitBuffer = 0;
+
+      var _this = {};
+
+      _this.write = function(data, length) {
+
+        if ( (data >>> length) != 0) {
+          throw 'length over';
+        }
+
+        while (_bitLength + length >= 8) {
+          _out.writeByte(0xff & ( (data << _bitLength) | _bitBuffer) );
+          length -= (8 - _bitLength);
+          data >>>= (8 - _bitLength);
+          _bitBuffer = 0;
+          _bitLength = 0;
+        }
+
+        _bitBuffer = (data << _bitLength) | _bitBuffer;
+        _bitLength = _bitLength + length;
+      };
+
+      _this.flush = function() {
+        if (_bitLength > 0) {
+          _out.writeByte(_bitBuffer);
+        }
+      };
+
+      return _this;
+    };
+
+    var getLZWRaster = function(lzwMinCodeSize) {
+
+      var clearCode = 1 << lzwMinCodeSize;
+      var endCode = (1 << lzwMinCodeSize) + 1;
+      var bitLength = lzwMinCodeSize + 1;
+
+      // Setup LZWTable
+      var table = lzwTable();
+
+      for (var i = 0; i < clearCode; i += 1) {
+        table.add(String.fromCharCode(i) );
+      }
+      table.add(String.fromCharCode(clearCode) );
+      table.add(String.fromCharCode(endCode) );
+
+      var byteOut = byteArrayOutputStream();
+      var bitOut = bitOutputStream(byteOut);
+
+      // clear code
+      bitOut.write(clearCode, bitLength);
+
+      var dataIndex = 0;
+
+      var s = String.fromCharCode(_data[dataIndex]);
+      dataIndex += 1;
+
+      while (dataIndex < _data.length) {
+
+        var c = String.fromCharCode(_data[dataIndex]);
+        dataIndex += 1;
+
+        if (table.contains(s + c) ) {
+
+          s = s + c;
+
+        } else {
+
+          bitOut.write(table.indexOf(s), bitLength);
+
+          if (table.size() < 0xfff) {
+
+            if (table.size() == (1 << bitLength) ) {
+              bitLength += 1;
+            }
+
+            table.add(s + c);
+          }
+
+          s = c;
+        }
+      }
+
+      bitOut.write(table.indexOf(s), bitLength);
+
+      // end code
+      bitOut.write(endCode, bitLength);
+
+      bitOut.flush();
+
+      return byteOut.toByteArray();
+    };
+
+    var lzwTable = function() {
+
+      var _map = {};
+      var _size = 0;
+
+      var _this = {};
+
+      _this.add = function(key) {
+        if (_this.contains(key) ) {
+          throw 'dup key:' + key;
+        }
+        _map[key] = _size;
+        _size += 1;
+      };
+
+      _this.size = function() {
+        return _size;
+      };
+
+      _this.indexOf = function(key) {
+        return _map[key];
+      };
+
+      _this.contains = function(key) {
+        return typeof _map[key] != 'undefined';
+      };
+
+      return _this;
+    };
+
+    return _this;
+  };
+
+  var createDataURL = function(width, height, getPixel) {
+    var gif = gifImage(width, height);
+    for (var y = 0; y < height; y += 1) {
+      for (var x = 0; x < width; x += 1) {
+        gif.setPixel(x, y, getPixel(x, y) );
+      }
+    }
+
+    var b = byteArrayOutputStream();
+    gif.write(b);
+
+    var base64 = base64EncodeOutputStream();
+    var bytes = b.toByteArray();
+    for (var i = 0; i < bytes.length; i += 1) {
+      base64.writeByte(bytes[i]);
+    }
+    base64.flush();
+
+    return 'data:image/gif;base64,' + base64;
+  };
+
+  //---------------------------------------------------------------------
+  // returns qrcode function.
+
+  return qrcode;
+}();
+
+// multibyte support
+!function() {
+
+  qrcode.stringToBytesFuncs['UTF-8'] = function(s) {
+    // http://stackoverflow.com/questions/18729405/how-to-convert-utf8-string-to-byte-array
+    function toUTF8Array(str) {
+      var utf8 = [];
+      for (var i=0; i < str.length; i++) {
+        var charcode = str.charCodeAt(i);
+        if (charcode < 0x80) utf8.push(charcode);
+        else if (charcode < 0x800) {
+          utf8.push(0xc0 | (charcode >> 6),
+              0x80 | (charcode & 0x3f));
+        }
+        else if (charcode < 0xd800 || charcode >= 0xe000) {
+          utf8.push(0xe0 | (charcode >> 12),
+              0x80 | ((charcode>>6) & 0x3f),
+              0x80 | (charcode & 0x3f));
+        }
+        // surrogate pair
+        else {
+          i++;
+          // UTF-16 encodes 0x10000-0x10FFFF by
+          // subtracting 0x10000 and splitting the
+          // 20 bits of 0x0-0xFFFFF into two halves
+          charcode = 0x10000 + (((charcode & 0x3ff)<<10)
+            | (str.charCodeAt(i) & 0x3ff));
+          utf8.push(0xf0 | (charcode >>18),
+              0x80 | ((charcode>>12) & 0x3f),
+              0x80 | ((charcode>>6) & 0x3f),
+              0x80 | (charcode & 0x3f));
+        }
+      }
+      return utf8;
+    }
+    return toUTF8Array(s);
+  };
+
+}();
+
+(function (factory) {
+  if (typeof define === 'function' && define.amd) {
+      define([], factory);
+  } else if (typeof exports === 'object') {
+      module.exports = factory();
+  }
+}(function () {
+    return qrcode;
+}));
diff --git a/docs/architecture-simplification-plan.md b/docs/architecture-simplification-plan.md
new file mode 100644
index 0000000..210f3ab
--- /dev/null
+++ b/docs/architecture-simplification-plan.md
@@ -0,0 +1,261 @@
+# Recaps Architecture Simplification — Plan of Record
+
+**Status:** Agreed direction, 2026-05-19. Not yet implemented.
+
+## Why this exists
+
+The current Recaps architecture has the Keysat license doing too many jobs.
+For a cloud Pro/Max tenant, the license is acting as: (a) the entitlement
+check, (b) the relay credit-pool key, (c) the subscription-expiry source,
+AND (d) the take-it-home portability token. Only (d) actually requires a
+cryptographically-signed token. The other three are accidental — the
+license just happens to carry that data because Keysat was already minting
+license tokens during the MVP.
+
+This doc captures the agreed simplification so we can revisit later before
+implementation.
+
+---
+
+## The three products, cleanly separated
+
+**Recap Relay** — Backend compute service. AI provider routing
+(Gemini / Claude / Whisper / Ollama / etc.), credit ledger, BTCPay-backed
+top-ups. Runs on Grant's StartOS. Sold as a service (subscription gives
+monthly credit allotment + a la carte top-ups).
+
+**Recaps** — Frontend cloud SaaS for summarizing podcasts/videos. People
+sign up, pay a subscription, and use the relay for compute. Hosted at
+`recaps.cc`. Also freely available as a `.s9pk` for self-hosting.
+
+**Keysat** — Standalone licensing-as-a-service software, separately
+monetized as a B2B product. Recaps happens to use Keysat for the one
+specific case of minting a portable license token when a cloud user
+clicks "Take Recaps home." Otherwise unrelated to Recaps day-to-day.
+
+These are three products that happen to share an author. Tangling them is
+what made the current architecture confusing.
+
+---
+
+## What each layer owns after the simplification
+
+| Concern | Lives in | Why |
+|---|---|---|
+| Subscription tier + `expires_at` | **Recaps DB** (`users.tier`, `users.subscription_expires_at`) | Billing state belongs with the billing surface. Zaprite/BTCPay webhooks fire at Recaps and update one row. |
+| Credit balance (remaining/consumed) | **Relay's ledger** (`credits.json`) | Compute happens at the relay. The relay knows when N credits were actually spent on Gemini tokens. Race conditions get ugly if billing and consumption drift. |
+| Purchased credit top-ups (one-shot Lightning) | **Relay's ledger** | BTCPay webhook → relay → bump `purchased_balance` on the relevant pool. Unchanged from today. |
+| Monthly tier allotment | **Relay computes** from tier header passed by Recaps | Recaps sends `X-Recap-User-Tier: pro`; relay applies its quota config (`pro.monthly = 50`). |
+| Per-user identity at the relay | Keyed by `user:<recaps_user_id>` (cloud) or `lic:<fp>` (self-hosted) | Removes the license-as-credential coupling for cloud requests. License only matters for self-hosted. |
+
+### The header change
+
+```
+Cloud Recaps → Relay (today):
+  Authorization: Bearer <user's LIC1 token>
+
+Cloud Recaps → Relay (after simplification):
+  X-Recap-User-Id: <recaps_user_id>
+  X-Recap-User-Tier: pro
+  Authorization: Bearer <OPERATOR's LIC1>      ← proves THIS Recaps server is authorized
+```
+
+The operator's bearer token is still needed because the relay needs to
+verify that this is Grant's cloud Recaps server (vs. someone else trying
+to forge user-id headers). The per-user identity comes from the explicit
+headers.
+
+---
+
+## Cloud Recaps is paid-only
+
+**Decided:** cloud Recaps drops the "free signed-in" tier entirely. Self-
+hosted IS the free path.
+
+User states on cloud:
+- **Anon trial** — cookie-tracked, no account. Gets a small allowance of
+  credits to taste-test. After the trial runs out, must subscribe to
+  continue using the cloud service.
+- **Subscribed** — account exists, `users.tier ∈ {pro, max}`,
+  `subscription_expires_at` in the future.
+- **Expired subscription** — account preserves the library, can't
+  summarize new things until renewed. Renewal anytime restores access.
+
+What this means for the codebase: `tenant_credits` table's "free signed-in"
+codepath stops applying to cloud users. The table stays in the codebase
+because self-hosted multi-tenant operators (Alice running Recaps for her
+family) still need per-tenant accounting locally.
+
+---
+
+## Payment provider strategy
+
+**Pro/Max purchase page** has two paths:
+
+```
+┌─────────────────────────────────────────────┐
+│  Upgrade to Pro — $X/month                  │
+│                                             │
+│   • 50 Recap credits per month              │
+│   • Channel + podcast subscriptions         │
+│   • Auto-queue + priority processing        │
+│                                             │
+│      ┌──────────────────────────────────┐   │
+│      │  ⚡ Pay with Bitcoin             │   │  ← primary, inline BTCPay
+│      └──────────────────────────────────┘   │
+│                                             │
+│            Pay with card →                  │  ← link → Zaprite hosted
+│                                             │
+└─────────────────────────────────────────────┘
+```
+
+### Bitcoin path: monthly upfront, manual renewal
+
+- User pays one BTCPay invoice for 30 days of Pro
+- Inline Lightning QR + BOLT11 + copy button (same UX as credit packs)
+- On settle, Recaps sets `subscription_expires_at = now + 30 days`
+- No card on file, no autorenewal — Lightning doesn't have a clean
+  recurring-billing primitive
+
+### Renewal-link emails (NEW, needed for Bitcoin path)
+
+Recaps sends automated emails near expiry:
+- **7 days before expiry** — "Your Pro sub renews in 7 days. Tap to renew →"
+- **Day of expiry** — "Your Pro sub expired. Tap to renew →"
+- **7 days after expiry** — "We've paused your Pro features. Renew anytime →"
+- After 30 days post-expiry — stop emailing (avoid being a nag)
+
+Mechanism:
+- Email contains a tokenized URL: `https://recaps.cc/renew?token=<base64>`
+- Token encodes `{ user_id, action: "renew_pro" }`, short-lived (~14 days)
+- Click → Recaps mints fresh BTCPay invoice, renders inline Lightning UI
+- On settle, `subscription_expires_at += 30 days` (extends from whichever
+  is later: existing expiry, or current time — so a user who renews 5
+  days early doesn't lose those days)
+
+Card subscribers don't need this — Zaprite handles recurring billing
+natively via Stripe.
+
+### Card path: Zaprite handles everything
+
+- Click "Pay with card" → redirect to Zaprite hosted checkout
+- Zaprite collects card info, charges monthly, handles retries on failure
+- Zaprite webhook fires → Recaps updates `subscription_expires_at`
+- Cancel button in Settings → Plan calls Zaprite cancel API
+- **Card premium pricing handled inside Zaprite admin** (not in Recaps
+  code) — Grant configures the card-monthly price to be N% higher than
+  Bitcoin-monthly in Zaprite's product settings
+
+---
+
+## Self-hosted scenarios
+
+**Self-hosted Recaps is free + open source.** Run the `.s9pk` anywhere,
+no license check to run the software.
+
+| Scenario | Subscriber to Grant's relay? | How relay access works |
+|---|---|---|
+| Bob runs Recaps for himself, brings his own Gemini key | No | Bob pays Google directly. Default `.s9pk` has no relay configured — Bob enters his AI provider keys in Settings. |
+| Bob runs Recaps for himself + wants Grant's relay | Yes | Bob has a cloud Pro subscription. He clicks "Take Recaps home" in cloud settings → Recaps mints a fresh LIC1 token via Keysat with `expires_at = subscription_expires_at`. Bob pastes it into his self-hosted install. Self-hosted Recaps uses the token as `Authorization: Bearer LIC1-...` to the relay. |
+| Alice runs Recaps for family, brings own Gemini key | No | Alice's family is invisible to Grant. |
+| Alice runs Recaps for family + uses Grant's relay | Yes | Alice has a cloud subscription. Family-tenants on Alice's install all share Alice's relay-credit pool via Alice's pasted license. Alice manages per-family-member accounting locally via the existing `tenant_credits` + operator-grant flow. If Alice needs more credit headroom for her family, she upgrades her cloud sub to Max or buys credit packs. |
+
+### What the license is for, after the simplification
+
+**One job: the credential that authenticates a self-hosted Recaps install
+against Grant's relay.**
+
+Not "are you Pro on cloud" — Recaps DB knows that.
+Not "credit pool key" — `user:<recaps_user_id>` keys cloud requests, `lic:<fp>` keys self-hosted.
+Not "subscription expiry" — `users.subscription_expires_at` in Recaps DB is the source of truth.
+
+The license is a **deliverable artifact**, minted on demand only when a
+cloud Pro user explicitly clicks "Take Recaps home." Most cloud users
+never click it; they don't need a license. The license's `expires_at`
+mirrors the user's subscription expiry, so when their cloud sub lapses,
+the self-hosted install's relay access stops working naturally.
+
+### Grace period for self-hosted licenses
+
+**Decided:** Keysat handles this. When a cloud subscription lapses, Keysat
+can keep the license valid for a short grace period (e.g., 7 days) before
+revoking. Recaps doesn't manage this — it's a Keysat-internal policy.
+
+---
+
+## Migration order
+
+When ready to implement:
+
+1. **Decide self-hosted = free + open source** ← already decided. Removes
+   the "is this install licensed" check from the cloud path; keeps it
+   only as a guard on relay access.
+2. **Recaps schema additions:** `users.tier`, `users.subscription_expires_at`,
+   `users.zaprite_customer_id`, `users.zaprite_subscription_id`,
+   `users.bitcoin_renewal_token_hash` (single-use). Migrate existing users
+   by deriving tier + expires_at from their attached license at boot time.
+3. **Zaprite webhook handler:** Recaps endpoint accepting Zaprite's order
+   + subscription lifecycle events; updates user row accordingly.
+4. **Relay header migration:** Cloud Recaps sends `X-Recap-User-Id` +
+   `X-Recap-User-Tier`. Relay accepts BOTH old (license-keyed) and new
+   (user-id-keyed) headers for one release as a compat window.
+5. **Drop license attachment from cloud signup:** Pro/Max purchase via
+   Zaprite or BTCPay now updates `users.tier` + `users.subscription_expires_at`
+   directly. No LIC1 token attached at signup.
+6. **Renewal-email pipeline:** Scheduled job in Recaps that scans for
+   subscriptions approaching expiry, sends the renewal email with a
+   one-time-use renewal token. Token consumption flow on `/renew?token=…`.
+7. **Pro/Max purchase UX redesign:** Bitcoin primary + Card secondary
+   layout. Bitcoin path uses existing inline BTCPay flow. Card path
+   redirects to Zaprite hosted checkout.
+8. **"Take Recaps home" rework:** Becomes an explicit user-initiated
+   action that mints a fresh LIC1 token via Keysat at click time, not at
+   signup. UI shows the token with copy-to-clipboard + install
+   instructions.
+9. **Cancel-subscription button:** Settings → Plan → cancel. Hits Zaprite
+   cancel API for card subs; for Bitcoin subs there's nothing to cancel
+   (just let it lapse — they paid one month, they get one month).
+10. **Remove "free signed-in" path from cloud:** Anon trial credits stay
+    as taste-test; signup grant goes away. Self-hosted is the free path
+    going forward.
+
+Estimated effort: ~1 week of focused work end-to-end. Steps 2–5 are the
+core; the rest are polish on top.
+
+---
+
+## Decided open questions
+
+| Q | Decision |
+|---|---|
+| Annual or monthly Bitcoin subscription? | **Monthly upfront, manual renewal** with automated renewal-link emails |
+| Same price across paths, or premium/discount? | **Card premium configured inside Zaprite admin**, not in Recaps code |
+| Grace period on self-hosted licenses when cloud sub lapses? | **Keysat handles this** — Recaps doesn't manage |
+| Free tier on cloud? | **No — cloud is paid-only**, self-hosted is the free path |
+
+---
+
+## What stays (don't break)
+
+- Relay's credit ledger + tier-quota math
+- BTCPay webhook → relay-pool crediting (for one-shot Lightning credit packs)
+- Inline Lightning UX for credit packs (already shipped, working)
+- Anon trial mechanic (cookie-tracked taste-test)
+- The "Take Recaps home" feature itself (just changes when the token is minted)
+- The Keysat license-issuing pipeline (just changes who calls it and when)
+
+## What changes
+
+- Recaps stops attaching a license at every Pro/Max signup
+- Recaps gains its own subscription state (`users.tier` + `expires_at`)
+- Relay accepts `X-Recap-User-Id` for cloud requests (compat with old license-keyed for self-hosted)
+- Pro/Max purchase UX gets the two-option layout (Bitcoin primary, Card link)
+- New renewal-email pipeline for Bitcoin subscribers
+- Cancel-subscription button wired to Zaprite
+- Cloud loses the "free signed-in" tier; self-hosted IS the free path
+- "Take Recaps home" reshapes as on-demand mint, surfaced as an explicit
+  button in cloud settings
+
+## What's deleted
+
+- Nothing — only deprecated. Old license attachment code stays as a fallback for one release window. After migration is fully verified, can be cleaned up in a follow-up.
diff --git a/docs/core-decoupling-plan.md b/docs/core-decoupling-plan.md
new file mode 100644
index 0000000..68b3505
--- /dev/null
+++ b/docs/core-decoupling-plan.md
@@ -0,0 +1,175 @@
+# Core Decoupling — Implementation Plan (relay-owns)
+
+**Status:** ✅ **Implemented + build-ready, 2026-06-04.** Both sides code-
+complete, typecheck/syntax clean, unit tests green. Relay bumped to
+`0.2.119`, Recaps app to `0.2.143`. Not yet installed/configured on-device —
+see "Install + configure runbook" at the bottom.
+Scoped slice of `architecture-simplification-plan.md`, with the May plan's
+"Recaps-owns billing" reversed per Grant's decision.
+
+## Decisions locked (2026-06-03)
+
+1. **The Recap Relay owns the Pro/Max subscription**, keyed by the Recaps
+   **user-id** (not a Keysat license). Recaps reads each user's tier from
+   the relay to gate features.
+2. **No credit-pool migration** — no real customers yet; clean cutover.
+3. **Keysat leaves the cloud path entirely.** A cloud user has no license.
+   Keysat/licenses remain ONLY for the (future) self-hosted-operator case.
+4. **Server auth = a shared "operator key."** The `recaps.cc` server proves
+   itself to the relay with a shared secret; it then vouches for its users
+   via `X-Recap-User-Id`.
+5. **Self-serve subscription purchase is DEFERRED.** For this slice, tiers
+   are **operator-set** (Grant grants Pro/Max). Self-serve BTCPay/card
+   subscription buying + expiry + renewal = the later "payment" slice.
+
+## Goal (one sentence)
+
+Replace "every cloud relay request carries the user's Keysat license" with
+"the `recaps.cc` server authenticates once with an operator key and passes
+the user's account-id; the relay tracks that user's tier + credits."
+
+---
+
+## How it works after the change
+
+```
+Cloud user's browser
+   │  (logged-in Recaps session cookie)
+   ▼
+recaps.cc server  ──reads user's tier from relay, gates features──┐
+   │  POST /relay/<...>                                           │
+   │   X-Recap-User-Id: <recaps user id>                          │
+   │   X-Recap-Operator-Key: <shared secret>     ← proves it's    │
+   │   (NO per-user license bearer)                 Grant's server│
+   ▼                                                              │
+Recap Relay                                                       │
+   • validates operator key → trusts the user-id                  │
+   • credit pool keyed by  user:<id>                              │
+   • stores that user's TIER (+ optional expiry) on the pool ─────┘
+   • applies the tier's monthly credit quota
+```
+
+Self-hosted operators are unchanged: they send a license bearer and no
+`X-Recap-User-Id`, so they keep the existing `lic:`/`inst:` path.
+
+---
+
+## Relay changes (recap-relay/)
+
+1. **Identity resolver** (new helper used by every route in place of
+   `resolveLicense(auth)` + raw installId): if `X-Recap-User-Id` is present
+   AND `X-Recap-Operator-Key` matches config → identity =
+   `{ creditKey: "user:<id>", source: "cloud" }`. Else existing license/
+   install path (`credits.js` `getCreditKey` / `resolveLicense`).
+2. **Tier-of-record on the pool** (`credits.js` ledger row): make `tier`
+   (+ optional `subscription_expires_at`) an authoritative, persisted field
+   for `user:` pools, instead of reading tier from a license each request.
+   Quota math (`getTierQuotas`) keys off it as today.
+3. **Operator endpoint to set a user's tier** —
+   `POST /admin/users/:userId/tier { tier, expires_at? }` (admin-auth
+   gated). This is how tiers get set in this slice; the future self-serve
+   purchase flow writes the same field.
+4. **Report tier + balance for a user-id** — extend `/relay/balance` (and
+   the status surface) to answer for the `user:<id>` identity so Recaps can
+   read it.
+5. **Config:** `relay_cloud_operator_key` (+ a StartOS action to set it,
+   Phase 1.5).
+
+## Recaps changes (recap/)
+
+6. **Cloud relay identity** (`providers/index.js` `pickRelayIdentity` +
+   `providers/relay.js` `buildHeaders`): multi-mode cloud user → send
+   `X-Recap-User-Id` + `X-Recap-Operator-Key` (from server config), DROP the
+   user-license bearer. Single-mode / self-hosted unchanged.
+7. **Entitlement checks read the relay-reported tier**
+   (`license-middleware.js` multi-mode branch, `tts-routes.js`
+   `userHasTtsAccess`): derive tier from what the relay reports for this
+   user (cached on `req.user` / relay-status), not from a parsed license.
+   Single-mode keeps using the operator `LIC`.
+8. **Stop attaching a Keysat license at cloud signup**
+   (`license-purchase.js`): cloud accounts no longer get a license. (The
+   existing flow stays available for the self-hosted operator-license case
+   only.)
+9. **Config:** `recap_relay_operator_key` (server-side; never sent to the
+   browser).
+
+---
+
+## Explicitly deferred (later "payment" slice)
+
+Self-serve Pro/Max subscription purchase (monthly BTCPay/card, expiry,
+renewal emails, cancel) · removing the free signed-in tier · "Take Recaps
+home" rework. None of these block the decoupling; tiers are operator-set
+until then.
+
+## Testing / rollout
+
+1. Relay: identity resolver — cloud (valid key)→`user:` ; cloud (bad/no
+   key)→reject/fallback ; self-hosted→`lic:`/`inst:`.
+2. Relay: operator-set tier → `/relay/balance` reports it → metered call
+   decrements the `user:` pool at the right quota.
+3. Recaps: feature gates (clips, subscriptions, TTS) follow the relay tier.
+4. Ship relay first (accepts both old + new), then Recaps cutover. Verify a
+   self-hosted-style license request still works. Both via `make install` /
+   sideload — **no registry deploys.**
+
+## Effort
+
+~**2–3 focused days** (smaller than the migration-laden version): ~1 on the
+relay (resolver, tier-on-pool, operator endpoint, config), ~1 on Recaps
+(headers, tier-read, gate rewiring), ~0.5 testing.
+
+## Sequencing (resolved 2026-06-03)
+
+Core decoupling ships first with **operator-set tiers**; self-serve
+subscription purchase is the immediate next slice. Rationale: land the
+structural de-licensing on its own and verify it, then add money-handling
+code on a proven foundation rather than entangling a refactor with new
+payment flows. No real customers yet, so no cost to this ordering.
+
+---
+
+## What landed (2026-06-04)
+
+**Relay (`recap-relay/`, → 0.2.119):** `identity.js` resolver +
+`verifyOperatorKey`; `credits.js` `setUserTier`/`getUserCreditRow` +
+`creditKey` threading; `job-credits.js`/`envelope.js` `creditKey`;
+`routes/user-tier.js` (`POST`/`GET /relay/user-tier`, operator-key authed);
+balance/tts/transcribe/analyze/transcribe-url/summarize-url use
+`resolveIdentity`; `config.js` `relay_cloud_operator_key`; admin Settings
+expose it as a masked **"Cloud operator key"** field (dashboard +
+`PUT /admin/settings`).
+
+**Recaps (`recap/`, → 0.2.143):** `db.js` `users.tier` column +
+`migrateUsersTier`; `relay-state.js` `computeCreditKey` keys `user:<id>`;
+`providers/index.js` `pickRelayIdentity` emits the cloud identity for paid
+users; `providers/relay.js` sends `X-Recap-User-Id`+`X-Recap-Operator-Key`
+and adds `setRelayUserTier`/`getRelayUserTier`; `license.js` `viewForTier`;
+`license-middleware.js` `/api/license-status` derives the view from
+`req.user.tier`; `tts-routes.js` gate reads `req.user.tier`; **3 gates that
+keyed off `!keysat_license` now exclude paid-tier users** so they aren't
+misrouted to the free-tenant `tenant_credits` path
+(`/api/relay/status` display, `/api/process` gate+debit); `config.js` polls
+`recap_relay_operator_key` into a live binding; `relay-default.js`
+`getRelayOperatorKey` reads env→live-binding; StartOS **"Set Relay Operator
+Key"** action + config field; operator **Tenants panel** gets a per-row
+tier badge + **Tier** selector (`POST /api/admin/tenants/:id/tier`, which
+writes the relay first then caches `users.tier`).
+
+## Install + configure runbook
+
+1. `cd recap-relay && make x86 && make install` (relay 0.2.119). **Never**
+   `make deploy`/`redeploy` for the relay.
+2. Relay dashboard → Settings → Endpoints & credentials → **Cloud operator
+   key** → paste a fresh secret (`openssl rand -hex 32`). Save.
+3. `cd recap && make x86 && make install` (app 0.2.143).
+4. Recaps StartOS → Actions → **Set Relay Operator Key** → paste the **same**
+   secret. (Picked up within one config poll — no restart.)
+5. Sign in as operator → **Tenants** → open a user's row → **Tier** → **Max**
+   (or Pro). This writes the relay `user:<id>` tier, then caches `users.tier`.
+   A 502 here means the two operator keys don't match — fix + retry.
+6. As that user: confirm the **MAX/PRO badge**, the **Listen** (TTS) button,
+   that a summarize run is metered against the relay `user:<id>` pool (not
+   `tenant_credits`), and that `/api/relay/status` shows the relay balance.
+7. Regression: a self-hosted-style license request still works (license/
+   install path untouched — additive).
diff --git a/docs/path-2b-and-path-1-interweave.md b/docs/path-2b-and-path-1-interweave.md
new file mode 100644
index 0000000..0830fa9
--- /dev/null
+++ b/docs/path-2b-and-path-1-interweave.md
@@ -0,0 +1,282 @@
+# Path 2B + Path 1 Interweave Plan
+
+Companion doc to `architecture-simplification-plan.md` (Path 1) and the
+chat thread that proposed Path 2A (relay-only upload, ship first).
+
+This doc covers:
+
+1. **Path 2B** — bringing internal-meeting analysis into the Recaps
+   cloud frontend as a first-class feature alongside YouTube/podcast
+   summaries.
+2. **How Path 2B depends on Path 1** — what Path 1 unlocks vs. what
+   could be partially built without it.
+3. **Migration path** — how Path 2A's relay-only upload data flows
+   forward into Path 2B's cloud-side library.
+
+---
+
+## Context
+
+Recap Relay (the operator-side backend) is now generic enough to
+analyze ANY audio — not just YouTube/podcasts. The download step is
+the only YouTube-specific code; everything downstream (transcribe →
+diarize → cluster → analyze → polish) applies cleanly to arbitrary
+audio. Path 2A exposes this via a relay-admin-only upload UI so
+operator Grant can run internal meeting analysis on his own hardware
+TODAY without waiting on Recaps multi-tenant work.
+
+Path 2B is the longer arc: same capability surfaced in the cloud
+Recaps app, so signed-in users can submit private meeting audio,
+manage it alongside their other content, and (optionally) share with
+colleagues.
+
+---
+
+## Path 1 (recap) state
+
+`architecture-simplification-plan.md` defines:
+
+- One Recaps binary, two modes via `RECAP_MODE=single|multi` env var
+- Magic-link + optional password auth via StartOS SMTP
+- Per-user library at `/data/history/<userId>/<sessionId>.json`
+- Per-user keysat license (mintable via Keysat admin API)
+- BTCPay subscription + one-time credit-purchase flows
+- Lite-settings UI for non-operator cloud users
+- Self-hosted operator stays single-tenant by default; the .s9pk
+  ships free + open
+
+Status: written but not built. The relay-side work has continued in
+parallel (FIFO queue, clustering suppression, polish pass) which
+strengthens the case for Path 1 — the cloud user experience benefits
+from all of it, and the keysat-license layer is increasingly
+friction-without-value for cloud users who already have email-verified
+accounts.
+
+---
+
+## Path 2B — internal meetings in cloud Recaps
+
+### What it looks like
+
+A signed-in Recaps user gets a second submission affordance alongside
+the existing "Paste a YouTube/podcast link" input:
+
+```
+┌─────────────────────────────────────────────────────────┐
+│ Submit content                                          │
+│  ○ Paste a YouTube/podcast link                         │
+│  ○ Upload audio file (private)        [Choose file…]    │
+│                                                         │
+│  Title:        [_____________________________]          │
+│  Participants: [_____________________________]  (opt)   │
+│  Meeting type: [▼ default / 1:1 / all-hands / …]        │
+│                                                         │
+│             [ Summarize ]                               │
+└─────────────────────────────────────────────────────────┘
+```
+
+The submission flows the same way YouTube submissions do:
+Recaps-app → Relay (`/relay/v1/summarize-upload` for files,
+existing `/relay/v1/summarize-url` for URLs). The relay handles both
+via the same pipeline — only the input step differs (download vs.
+multipart receive).
+
+### Library + rendering
+
+Each saved session in the cloud user's library has a `type` field:
+
+- `"youtube"` — existing rendering (video player + topics + transcript chips)
+- `"podcast"` — existing podcast rendering (audio player + topics + transcript)
+- `"meeting"` — new rendering: no media player; topics + transcript chips
+  expandable below each topic card; PLUS a "Meeting analysis" block at
+  the top with Decisions / Action Items / Open Questions / Key Quotes
+  (the structured-extras pass from Phase 2 of Path 2A)
+
+Library list view shows a small icon distinguishing meeting items so
+the user can filter at a glance.
+
+### Privacy + sharing
+
+Meetings are PRIVATE by default — visible only to the submitting user.
+Two later features:
+
+- **Share with team** — a meeting can be optionally shared with N
+  named cloud-Recaps users (each looks up by email). Other users see
+  it in a "Shared with me" library section.
+- **Export to markdown / PDF** — already exists for YouTube content;
+  add the meeting-extras blocks to the export.
+
+### Audio handling
+
+- Uploaded audio goes from browser → Recaps-app (Node Express,
+  multipart middleware) → Recap Relay (forward as multipart to
+  `/relay/v1/summarize-upload`).
+- Recaps-app's tmp file is deleted immediately after the relay
+  acknowledges receipt.
+- Relay's tmp file is deleted after the pipeline completes.
+- NEITHER side keeps the audio. The TRANSCRIPT + analysis are saved.
+  If the user wants to re-process (different prompt set), they'd
+  re-upload the audio.
+- The transcript stays in the user's per-user library at
+  `/data/history/<userId>/<sessionId>.json`, scoped + isolated.
+
+---
+
+## Path 2B's hard prerequisite: Path 1
+
+Path 2B fundamentally requires multi-tenant auth in Recaps. Without
+Path 1:
+
+- No per-user library separation
+- No way to know whether the meeting audio is private to a user vs.
+  visible to everyone running this Recaps instance
+- No way to share with named other users
+- No way to bill upload-heavy users differently from URL-only users
+  (uploads might warrant a different price tier given the storage
+  cost)
+
+You COULD build a stripped-down Path 2B on single-tenant Recaps —
+operator uploads audio, it's saved to the operator's library, no
+sharing. But that's roughly equivalent to Path 2A with a fancier UI,
+just on the wrong side of the codebase split (Recaps-app vs. relay).
+Not worth the duplication.
+
+So: **ship Path 2A as the immediate beachhead, do Path 1 next, then
+Path 2B on top.**
+
+### What Path 1 unlocks (relevant to 2B)
+
+The Path 1 doc already covers most of what 2B needs:
+- Per-user library at `/data/history/<userId>/*.json`
+- Auth-aware request scoping (`req.userId`)
+- Per-user keysat license OR the simplified user-id + tier headers
+- BTCPay subscription tracking (for billing upload-heavy use)
+
+Path 1's "Lite-settings panel for cloud users" already imagines a
+post-auth Recaps UI without operator config noise. The submission
+input would extend in 2B to add the upload option.
+
+The relay-side header migration Path 1 proposes (`X-Recap-User-Id` +
+`X-Recap-User-Tier` replacing the bearer license token) is also
+beneficial for 2B — uploads from a single user with N concurrent
+browsers all carry the same user-id, so credit accounting is per-user
+not per-install.
+
+---
+
+## How Path 2A's data flows into Path 2B
+
+When Path 2A ships (relay-only upload, results saved to
+`/data/internal-meetings/<id>.json` on the relay), those summaries
+are tied to the OPERATOR (Grant) — there's no cloud-user concept yet.
+
+When Path 2B lands:
+
+1. **Migration script** — walks `/data/internal-meetings/*.json` and
+   re-homes each entry under the operator's cloud user account
+   (`/data/history/owner/*.json` initially, then `/data/history/
+   <operator-user-id>/*.json` after Path 1's owner→admin rename).
+2. **Same JSON shape** — Path 2A should save in a shape compatible
+   with Path 2B's expected library shape (chunks + entries + speakers
+   + meeting-extras). One way to guarantee this: design the Phase 1
+   save shape now to match what Recaps' `saveToHistory` produces for
+   `type=meeting`, even though no Recaps UI consumes it yet.
+3. **No re-processing needed** — transcripts and analysis transfer
+   verbatim. The user just sees them appear in their cloud library.
+
+The relay-side upload endpoint (`/relay/v1/summarize-upload`) is the
+same in both worlds. Path 2A calls it via the operator dashboard's
+admin auth; Path 2B calls it via Recaps-app server proxying a
+signed-in cloud user's POST.
+
+So the relay code path is built once and serves both.
+
+---
+
+## Operator-editable prompt sets (Phase 3 in 2A; carries to 2B)
+
+The "meeting type" dropdown is operator-editable. Each set has:
+- Name (e.g. "1:1 with direct report")
+- Topic-analysis prompt template (replaces the YouTube/podcast version)
+- Meeting-extras prompt template (Decisions / Action Items / ...)
+- Optional metadata schema overrides (e.g. "this meeting type always
+  expects 2 participants")
+
+Stored in `relay_meeting_prompt_sets_json` config field. Operator
+edits via the dashboard (similar to existing prompts panel). Cloud
+Recaps users pick a set at submission time; the relay applies it
+during analyze + polish.
+
+Default sets ship built-in:
+- `default` — neutral meeting prompt, all sections enabled
+- `1on1` — emphasizes Action Items + Open Questions; light on Decisions
+- `all-hands` — emphasizes Decisions + Key Quotes; less actionable
+- `customer-interview` — emphasizes Key Quotes + Open Questions; light
+  on Decisions
+- `standup` — short-form; Action Items + Open Questions only
+
+---
+
+## Suggested order of operations
+
+1. **Path 2A Phase 1** — relay-only upload, no extras, basic
+   topic+transcript rendering. ~2-3 days.
+2. **Path 2A Phase 2** — meeting-extras analysis pass (Decisions /
+   Action Items / Open Questions / Key Quotes). ~1-2 days.
+3. **Path 2A Phase 3** — prompt sets dropdown. ~1 day.
+4. (Use Path 2A in production for some weeks; gather feedback on
+   prompts, output quality, UX.)
+5. **Path 1** — multi-tenant Recaps. ~3-4 weeks per the existing
+   architecture-simplification doc, modulo amendments.
+6. **Path 2B** — surface internal meetings in cloud Recaps. ~1.5-2
+   weeks given Path 1 has shipped. Migrates the Path 2A artifacts
+   into the new per-user library.
+
+Total wall time: ~6-8 weeks for the full arc. Path 2A capability
+available to operator after step 1 (~2-3 days). Cloud users get
+meetings after step 6.
+
+---
+
+## Open questions
+
+These should be settled BEFORE Path 2B build starts:
+
+1. **Pricing for uploads.** Does an upload count the same as a URL
+   submission against a user's monthly credit cap? Or is it priced
+   differently to reflect the upload bandwidth + storage cost? My
+   default: same price (1 credit per submission) — bandwidth cost is
+   trivial, storage is just JSON.
+
+2. **Audio retention.** Default: never retain. Optional per-user
+   setting "keep audio for 7/30/90 days so I can re-process with a
+   different prompt set"? Adds operator storage cost; only worth it
+   if users actually want it.
+
+3. **Sharing model.** Path 2B Phase 1 = no sharing, private only.
+   Phase 2 = shared with N named users. Phase 3 = optional public
+   share URL. Each phase adds auth/permission complexity. Worth
+   designing the data model now (`{ ownerId, sharedWith: [userId] }`)
+   even if only ownerId is populated in Phase 1.
+
+4. **Speaker name persistence.** If a user identifies "Speaker_A" as
+   "Matt Hill" in one meeting, should that name auto-suggest in the
+   next meeting if a fingerprint match is found? Requires storing
+   fingerprints per-user across meetings. Big privacy + product
+   decision. My instinct: opt-in toggle in user settings, default
+   off.
+
+5. **Meeting type defaults.** Should Recaps' submission flow have a
+   default meeting type, or force the user to pick? My instinct:
+   default to "default" set; let users pick if they want.
+
+---
+
+## Decision points for Grant
+
+- Confirm the phasing above (2A → 1 → 2B) is the right order
+- Pre-commit to the "uploaded audio is never retained" default — it's
+  the privacy-safer choice and aligns with how YouTube downloads
+  already work
+- Pick a side on the open questions above before Path 2B starts, OR
+  defer them as Phase 2/3 of Path 2B
diff --git a/docs/per-tenant-subscriptions-plan.md b/docs/per-tenant-subscriptions-plan.md
new file mode 100644
index 0000000..b2f189b
--- /dev/null
+++ b/docs/per-tenant-subscriptions-plan.md
@@ -0,0 +1,131 @@
+# Per-Tenant Subscriptions — Implementation Plan
+
+**Status:** ✅ **ALL STEPS DONE (app 0.2.149, 2026-06-04).** Per-tenant
+subscriptions are live: every Pro/Max user gets their own subscriptions +
+auto-queue, processed under their own account. The gate is flipped to
+tier-based. Offline-verified (99 server tests incl. the ephemeral-session
+mechanism + both-mode boot smokes); the actual processing-as-owner run is
+the on-device test (see checklist below).
+
+**Step 4 (the hard part), as built:** the background processor now finds
+approved items across every scope (`listAutoQueueScopes`) and processes each
+AS its owner — `processItemInternally(item, scope)` mints a short-lived real
+session (`mintInternalSession` in auth-routes.js) for the owning user, sends
+it as the `recap_session` cookie on the loopback `/api/process` call, and
+deletes it on every exit path. No auth bypass — a bad/expired token just
+401s and the item is marked failed. Single mode sends no cookie (resolves to
+"owner"). `userIdForScope`: single→null; multi "owner"→admin; tenant→the
+user id. Bonus: this also fixes the operator's OWN multi-mode auto-processing,
+which previously ran the loopback with no identity.
+
+**Gate flip:** `PRO_FEATURE_GATES` subscriptions gate is now tier-based in
+multi mode (Pro/Max/admin pass, free → 402); frontend `canUseSubscriptions()
+= hasEntitlement("subscriptions")` (operator-only clauses reverted).
+
+## Landed in 0.2.147
+- `server/subscriptions.js` — scope-keyed storage for subscriptions / skip /
+  seen / auto-queue + file-locked `mutateAutoQueue` (atomic read-modify-write,
+  replacing the global in-memory `autoQueue`), `listSubscriptionScopes()`,
+  `migrateGlobalSubscriptionsToOwner()`, plus the dedup (`getProcessedVideoIds`,
+  `isKnownVideo`).
+- `index.js` — the check loop fans out over `listSubscriptionScopes()` into a
+  per-scope `checkScopeSubscriptions(scope)`; every endpoint resolves
+  `scope = subScope(req)` (= scopeForRequest, "owner" for the operator); the
+  processor + boot recovery use `mutateAutoQueue`; boot runs the migration +
+  per-scope library reconcile. Behind the gate every scope resolves to
+  "owner", so behaviour is unchanged for the operator — the plumbing is just
+  per-scope now.
+- `history.js` — `addToSkipList(scope, videoId)` is scope-keyed.
+
+---
+
+## Goal
+
+Each signed-in Pro/Max tenant manages their **own** channel/podcast
+subscriptions; discovered episodes land in **their** auto-queue; approving
+one summarizes it under **their** account (their credits, their library,
+their relay identity). The operator (admin) keeps theirs. No tenant sees or
+affects another's.
+
+## What already exists (foundation)
+
+- `server/subscriptions.js` — extracted, unit-tested. `getProcessedVideoIds(scope)`
+  (scope-aware library scan — the dedup fix) + `isKnownVideo()` (pure
+  predicate). Already takes a `scope`, so per-tenant dedup is free.
+- `history.js` — `scopeForRequest(req)` (→ "owner" for admin/single, else
+  `safeComponent(user.id)`), `getScopeHistoryDir(scope)`, `scopeDir`,
+  `renameScopeDir`. The whole per-scope filesystem layer is in place.
+- The interim isolation gate: `PRO_FEATURE_GATES[subscriptions].adminOnlyInMulti`
+  (server) + `canUseSubscriptions()` (frontend). Both get relaxed here.
+
+## The work
+
+### 1. Scope the storage (mechanical, testable)
+Move the four global files into `subscriptions.js`, each keyed by scope and
+rooted at `scopeDir(scope)` instead of the history root:
+`subscriptions.json`, `auto-queue.json`, `skip-list.json`, `seen-list.json`.
+Add `loadSubscriptions(scope)` / `saveSubscriptions(scope, …)` + the skip /
+seen / auto-queue equivalents. **Drop the global in-memory `autoQueue`** —
+load/save per scope per request (the in-memory cache is what makes the
+current code single-tenant). Unit-test the round-trips per scope.
+
+### 2. Rescope the endpoints (mechanical)
+All ~15 `/api/subscriptions*` + `/api/auto-queue*` handlers derive
+`scope = scopeForRequest(req)` and read/write that scope's files. Relax the
+gate: drop `adminOnlyInMulti`; gate on the `subscriptions` entitlement
+(tier) instead, so paid tenants get in. Update `canUseSubscriptions()` to
+`hasEntitlement("subscriptions")` (drop the `!isMulti||isAdmin` clause) and
+revert the operator-only frontend branches.
+
+### 3. Rescope the check loop (moderate)
+`_checkSubscriptionsInner()` becomes per-scope. Enumerate scopes that have a
+subscriptions file (readdir `history/`, keep subdirs whose `subscriptions.json`
+is non-empty; plus "owner"). For each: load that scope's subs, dedup via
+`getProcessedVideoIds(scope)` + the scope's skip/seen/queue, append to that
+scope's auto-queue. The boot + hourly timers iterate all scopes.
+
+### 4. Fix the processor identity (the risky bit — needs on-device test)
+`backgroundProcessor()` + `processItemInternally(item)` must process each
+item **as its owner**. The item already can carry `scope`/`ownerUserId`.
+
+**Recommended: ephemeral session.** Before the loopback request, mint a
+short-lived row in the existing `sessions` table for the owner, send its
+token as the `Cookie`, then delete the row in a `finally`. tenant-auth then
+resolves `req.user` = owner normally → correct scope, credits, relay
+identity. Reuses real auth (no new trust path). **Failure mode is safe:** a
+bad/missing session just makes the internal request 401 → the item is
+marked `failed`, never an auth hole. Single mode unchanged (no auth, scope
+already "owner").
+
+*Alternative:* extract the core of the `/api/process` handler into a
+function callable in-process with an explicit `{scope, identity}` (no HTTP,
+no cookie). Cleaner long-term but a large refactor of a big handler — more
+risk of behavioral drift. Prefer the ephemeral session first.
+
+The single global processor loop stays fine — it just pulls approved items
+across all scopes (each item knows its owner) and processes sequentially
+with the existing inter-item delay.
+
+### 5. Migration (one-time, on boot)
+Move the existing history-root files
+(`subscriptions.json`/`auto-queue.json`/`skip-list.json`/`seen-list.json`)
+into `history/owner/` (the admin's scope) once, if present and the target
+doesn't exist. Preserves the operator's current subscriptions under their
+own scope. Idempotent.
+
+## On-device test checklist (gates "done")
+1. Tenant A subscribes to a channel; tenant B sees **nothing** of A's.
+2. A's discovered episode appears only in A's queue; approving it
+   summarizes under **A** (A's credits decremented, saved to A's library,
+   A's relay `user:<id>` pool billed).
+3. Operator's own subscriptions still discover + auto-process.
+4. Per-scope dedup: a video already in A's library is not re-queued for A;
+   the same video can still be independently queued for B.
+5. Crash-recovery: items stuck `processing` resume under the right owner.
+6. Single mode unaffected.
+
+## Effort / risk
+Steps 1–3 + 5: ~half a day, low risk, unit-testable offline. Step 4: the
+real work — small code, but auth/billing-adjacent, so it carries the
+testing burden. Land 1–3 behind the existing operator-only gate first
+(no behavior change for tenants), verify, then flip the gate + ship 4.
diff --git a/docs/self-serve-purchase-plan.md b/docs/self-serve-purchase-plan.md
new file mode 100644
index 0000000..0a3e00c
--- /dev/null
+++ b/docs/self-serve-purchase-plan.md
@@ -0,0 +1,94 @@
+# Self-Serve Pro/Max Purchase — Implementation Plan
+
+**Status:** Phases 1–4 BUILT + INSTALLED + LIVE on immense-voyage.local
+(relay 0.2.121, app 0.2.153) as of 2026-06-08. Bitcoin rail end-to-end test
+pending; card rail awaits operator Zaprite config. Phase 5 (SMTP expiry
+reminders) remains. Follows the core decoupling (the relay owns tiers,
+keyed by user-id) — this lets users buy their own Pro/Max instead of the
+operator granting them by hand.
+
+**Phase 4 (cards via Zaprite) — DONE.** Symmetric with the Bitcoin rail
+(one-time prepaid checkout, NOT Zaprite recurring): relay `zaprite-client.js`
+(POST /v1/orders + GET /v1/orders/:id), `POST /relay/tier-zaprite-order`
+(operator-keyed), `POST /relay/zaprite/webhook` (re-fetch-to-verify — no
+signature needed; both rails land at extendUserTier). Config:
+`relay_zaprite_{api_key,base_url,currency}` + `relay_tier_prices_fiat_cents_json`
+(default $21/$42), set via the new "Set Zaprite Connection" StartOS action.
+`/api/billing/buy` gained `method:"card"`; tier-plans reports `card_available`
++ fiat prices; UI shows "Pay by card · $21" only when Zaprite is configured.
+Operator TODO: run "Set Zaprite Connection" (paste API key) + register the
+webhook at `https://<relay-host>/relay/zaprite/webhook` in Zaprite.
+
+## Decisions (from Grant)
+
+- **Prepaid periods, NOT auto-recurring.** A user pays for a fixed period
+  (default **30 days**) of Pro/Max. Near expiry they get an email reminder
+  and pay again to extend. At expiry, the tier drops to Core. No stored
+  payment method, no card-vault / dunning.
+- **Two payment rails:**
+  - **Bitcoin / Lightning via BTCPay** — the *preferred* path. Relay already
+    has `btcpay-client.js` (createInvoice + webhook HMAC) used for credit
+    purchases; extend it for tier purchases.
+  - **Cards via Zaprite** — secondary. Grant has a Zaprite org + API +
+    webhooks. New integration.
+- **UI:** the main pill button is **"Pay with Bitcoin"** (opens a BTCPay
+  invoice). Directly below it, a smaller **"Pay by card"** link (opens a
+  Zaprite checkout).
+- **Expiry reminders via email.** Set up SMTP (Amazon SES per the Start9
+  recommendation) and send an automated "your Pro/Max expires in N days"
+  email. Recaps already has an SMTP transport (magic-link emails).
+- **Prices:** from the relay's `relay_tier_prices_usd_json` (today Pro $5 /
+  Max $15 per period), USD-denominated, paid in sats for BTCPay.
+
+## Phases (each shippable on its own)
+
+### Phase 1 — Relay: prepaid tier model + expiry enforcement (foundation)
+Rail-agnostic. Everything else depends on it.
+- `setUserTier({userId, tier, periodDays})` → set tier, set
+  `subscription_expires_at`. **Extend from the current expiry** if the user
+  is already active (so paying early adds time, doesn't reset it).
+- **Enforce expiry:** when the relay resolves a user's tier (identityTier /
+  the metered-route gate), treat `subscription_expires_at < now` as Core.
+  Add a lazy check + a periodic sweep so expired users actually drop.
+- Keep the operator-grant path (`/relay/user-tier`) working — it's the comp
+  tool. A manual grant can set no-expiry (operator comp) vs a purchase sets
+  a dated period.
+
+### Phase 2 — Bitcoin/Lightning purchase (BTCPay)
+- Relay: `POST /relay/tier-invoice` (operator-key authed) — body
+  `{user_id, tier, period_days}` → `createInvoice` with metadata
+  `{kind:"tier_subscription", userId, tier, periodDays}` → returns the
+  checkout URL + invoice id.
+- Relay webhook: on a settled `tier_subscription` invoice → `setUserTier`
+  (extend by periodDays). (Mirrors the existing credit-purchase webhook
+  branch.)
+- Recaps: a `pending_purchases`-style record + the settle→poll→cache-tier
+  loop (reuse the credit-purchase machinery). On settle, refresh
+  `/api/license-status` so the badge flips to Pro/Max.
+
+### Phase 3 — Purchase UI
+- Tier picker (Pro / Max, price, "30 days") with the **"Pay with Bitcoin"**
+  pill + **"Pay by card"** link. Reuse / replace the existing buy modal.
+- Bitcoin → opens the BTCPay checkout (Phase 2). Card → opens Zaprite
+  (Phase 4).
+
+### Phase 4 — Cards via Zaprite
+- Relay (or Recaps): create a Zaprite checkout for the tier (Grant's org +
+  API), metadata carrying `{userId, tier, periodDays}`.
+- Zaprite webhook → verify signature → `setUserTier` (extend). Same landing
+  point as the BTCPay webhook.
+- Wire the "Pay by card" link to it.
+
+### Phase 5 — Expiry reminder emails
+- SMTP via SES (Grant sets up SES + StartOS System SMTP; Recaps' transport
+  already exists).
+- Periodic job: find users with `subscription_expires_at` in ~N days, email
+  a "renew" notice with a link back to the purchase UI. Idempotent (don't
+  double-send).
+
+## Notes / open defaults (sensible unless Grant says otherwise)
+- Period = 30 days. Grace = none beyond the advance email (downgrade on
+  expiry). Extend-from-current-expiry on early renewal.
+- Relay stays **`make install` only** (private — never registry-deploy).
+- The operator-key path authenticates Recaps→relay for invoice creation, the
+  same as the tier-grant flow.
diff --git a/public/auth.html b/public/auth.html
new file mode 100644
index 0000000..cc51205
--- /dev/null
+++ b/public/auth.html
@@ -0,0 +1,385 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
+  <title>Sign in to Recaps</title>
+
+  <!-- Match index.html's PWA setup so a user installed via the
+       Add-to-Home-Screen flow can land on /auth.html (signed-out)
+       without losing the standalone display + theme colors. -->
+  <link rel="manifest" href="/manifest.json">
+  <meta name="theme-color" content="#0a0e1a">
+  <link rel="apple-touch-icon" href="/assets/icon.png">
+  <meta name="apple-mobile-web-app-capable" content="yes">
+  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
+  <meta name="apple-mobile-web-app-title" content="Recaps">
+  <meta name="mobile-web-app-capable" content="yes">
+
+  <!-- Social preview tags — same as index.html so any shared
+       /auth.html link previews cleanly too. -->
+  <meta property="og:type" content="website">
+  <meta property="og:site_name" content="Recaps">
+  <meta property="og:title" content="Sign in to Recaps">
+  <meta property="og:description" content="Summarize any YouTube video or podcast episode into topic-level summaries with timestamps.">
+  <meta property="og:url" content="https://recaps.cc/auth.html">
+  <meta property="og:image" content="https://recaps.cc/assets/icon.png">
+  <meta name="twitter:card" content="summary">
+  <meta name="twitter:title" content="Sign in to Recaps">
+  <meta name="twitter:image" content="https://recaps.cc/assets/icon.png">
+
+  <link rel="icon" type="image/png" href="/assets/icon.png">
+  <style>
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+    html, body { height: 100%; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+      background: #0a0e1a;
+      color: #e2e8f0;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 24px;
+    }
+    .card {
+      width: 100%;
+      max-width: 420px;
+      background: #121828;
+      border: 1px solid #1f2942;
+      border-radius: 12px;
+      padding: 32px 28px;
+    }
+    .logo {
+      display: flex;
+      align-items: center;
+      gap: 12px;
+      margin-bottom: 28px;
+    }
+    .logo img { width: 32px; height: 32px; border-radius: 6px; }
+    .logo span { font-size: 18px; font-weight: 600; color: #f5f9ff; }
+    h1 {
+      font-size: 22px;
+      font-weight: 600;
+      color: #f5f9ff;
+      margin-bottom: 8px;
+    }
+    p.lede {
+      font-size: 14px;
+      line-height: 1.55;
+      color: #94a3b8;
+      margin-bottom: 24px;
+    }
+    label {
+      display: block;
+      font-size: 13px;
+      font-weight: 500;
+      color: #cbd5e1;
+      margin-bottom: 8px;
+    }
+    input[type=email],
+    input[type=password] {
+      width: 100%;
+      background: #0a0e1a;
+      border: 1px solid #1f2942;
+      border-radius: 8px;
+      padding: 12px 14px;
+      font-size: 15px;
+      color: #f5f9ff;
+      font-family: inherit;
+      outline: none;
+      transition: border-color 0.15s ease;
+      /* Browsers auto-fill password fields with their own bright
+         background; -webkit-text-fill-color + a long inset shadow
+         override that so the field stays on-brand. */
+      -webkit-text-fill-color: #f5f9ff;
+      -webkit-box-shadow: 0 0 0 1000px #0a0e1a inset;
+      caret-color: #f5f9ff;
+    }
+    input[type=email]:focus,
+    input[type=password]:focus { border-color: #3b82f6; }
+    input[type=email]::placeholder,
+    input[type=password]::placeholder { color: #475569; }
+    button {
+      width: 100%;
+      margin-top: 16px;
+      background: #3b82f6;
+      color: white;
+      border: none;
+      border-radius: 8px;
+      padding: 12px 14px;
+      font-size: 15px;
+      font-weight: 600;
+      cursor: pointer;
+      transition: background 0.15s ease;
+      font-family: inherit;
+    }
+    button:hover:not(:disabled) { background: #2563eb; }
+    button:disabled { background: #1e3a8a; cursor: not-allowed; opacity: 0.6; }
+    .feedback {
+      margin-top: 20px;
+      padding: 14px 16px;
+      border-radius: 8px;
+      font-size: 14px;
+      line-height: 1.5;
+      display: none;
+    }
+    .feedback.success {
+      background: rgba(16, 185, 129, 0.1);
+      border: 1px solid rgba(16, 185, 129, 0.3);
+      color: #6ee7b7;
+      display: block;
+    }
+    .feedback.error {
+      background: rgba(239, 68, 68, 0.1);
+      border: 1px solid rgba(239, 68, 68, 0.3);
+      color: #fca5a5;
+      display: block;
+    }
+    .footer {
+      margin-top: 28px;
+      font-size: 12px;
+      color: #64748b;
+      text-align: center;
+      line-height: 1.5;
+    }
+    .footer a { color: #94a3b8; text-decoration: none; }
+    .footer a:hover { color: #cbd5e1; }
+    /* Password group hidden by default — most users want the magic
+       link and the optional-password field cluttered the form. The
+       "Use password instead" link below the submit button reveals
+       this when needed. */
+    .password-group[hidden] { display: none; }
+    .toggle-pwd-row {
+      text-align: center;
+      margin-top: 14px;
+      font-size: 12px;
+      color: #64748b;
+    }
+    .toggle-pwd-row a {
+      color: #94a3b8;
+      text-decoration: underline;
+      cursor: pointer;
+    }
+    .toggle-pwd-row a:hover { color: #cbd5e1; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="logo">
+      <img src="/assets/icon.png" alt="Recaps" onerror="this.style.display='none'">
+      <span>Recaps</span>
+    </div>
+
+    <h1 id="auth-heading">Sign in</h1>
+    <p class="lede" id="auth-lede">
+      Enter your email — we'll send a sign-in link.
+    </p>
+
+    <form id="signin-form" autocomplete="on">
+      <label for="email">Email</label>
+      <input
+        type="email"
+        id="email"
+        name="email"
+        required
+        autocomplete="email"
+      />
+
+      <div class="password-group" id="password-group" hidden>
+        <label for="password" style="margin-top:12px;">Password</label>
+        <input
+          type="password"
+          id="password"
+          name="password"
+          autocomplete="current-password"
+          minlength="8"
+        />
+      </div>
+
+      <button type="submit" id="submit-btn">Send sign-in link</button>
+    </form>
+
+    <div class="toggle-pwd-row" id="toggle-pwd-row">
+      <a id="toggle-pwd" role="button" tabindex="0">Use password instead</a>
+    </div>
+
+    <div class="feedback" id="feedback"></div>
+
+    <div class="footer">
+      First time here? We'll create your account when you click the sign-in link.
+    </div>
+  </div>
+
+  <script>
+    const form = document.getElementById('signin-form');
+    const btn = document.getElementById('submit-btn');
+    const feedback = document.getElementById('feedback');
+    const emailInput = document.getElementById('email');
+    const passwordInput = document.getElementById('password');
+    const passwordGroup = document.getElementById('password-group');
+    const togglePwd = document.getElementById('toggle-pwd');
+    const togglePwdRow = document.getElementById('toggle-pwd-row');
+    const heading = document.getElementById('auth-heading');
+    const lede = document.getElementById('auth-lede');
+
+    // Reveal the password field on demand. Most users sign in via
+    // magic link so the password field is clutter by default; this
+    // toggle surfaces it when needed. Once revealed it stays open
+    // for the rest of the session — no "hide again" affordance
+    // because re-hiding after typing would lose state and confuse.
+    function revealPasswordField() {
+      passwordGroup.hidden = false;
+      togglePwdRow.style.display = 'none';
+      // Defer focus to give the browser a tick to lay out the field.
+      setTimeout(() => passwordInput.focus(), 0);
+      updateBtnLabel();
+    }
+    togglePwd.addEventListener('click', (e) => {
+      e.preventDefault();
+      revealPasswordField();
+    });
+    togglePwd.addEventListener('keydown', (e) => {
+      if (e.key === 'Enter' || e.key === ' ') {
+        e.preventDefault();
+        revealPasswordField();
+      }
+    });
+
+    // ?intent=signup vs ?intent=signin — same form, slightly different
+    // copy. Signup leans "we'll create your account when you click
+    // the link"; signin leans "welcome back". If neither param is
+    // present we default to the generic Sign in copy (current
+    // behavior).
+    (function tailorIntent() {
+      try {
+        const intent = new URLSearchParams(location.search).get('intent');
+        if (intent === 'signup') {
+          document.title = 'Create your Recaps account';
+          heading.textContent = 'Create your account';
+          lede.textContent = "Enter your email — we'll send a sign-in link and create your account when you click it. No password to set up.";
+        } else if (intent === 'signin') {
+          document.title = 'Sign in to Recaps';
+          heading.textContent = 'Sign in';
+          // lede stays as the default
+        }
+      } catch {}
+    })();
+
+    function setFeedback(msg, kind) {
+      feedback.textContent = msg;
+      feedback.className = 'feedback ' + kind;
+    }
+    function clearFeedback() {
+      feedback.textContent = '';
+      feedback.className = 'feedback';
+    }
+
+    // Submit button label tracks whether the password field is in
+    // play. Hidden + empty = "Send sign-in link" (the dominant case);
+    // revealed + filled = "Sign in"; revealed + empty falls back to
+    // "Send sign-in link" so the user can change their mind without
+    // re-toggling the field.
+    function updateBtnLabel() {
+      if (btn.disabled) return;
+      const usingPwd = !passwordGroup.hidden && passwordInput.value.length > 0;
+      btn.textContent = usingPwd ? 'Sign in' : 'Send sign-in link';
+    }
+    passwordInput.addEventListener('input', updateBtnLabel);
+    updateBtnLabel();
+
+    async function signInWithPassword(email, password) {
+      const res = await fetch('/auth/signin-password', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email, password }),
+      });
+      if (res.ok) {
+        // Cookie set server-side. Land on the main app.
+        window.location.href = '/';
+        return;
+      }
+      if (res.status === 429) {
+        const body = await res.json().catch(() => ({}));
+        setFeedback(body.message || 'Too many attempts. Try again later.', 'error');
+      } else if (res.status === 401) {
+        setFeedback('Email or password is wrong. Leave the password blank to receive a sign-in link instead.', 'error');
+      } else {
+        setFeedback('Something went wrong. Please try again.', 'error');
+      }
+    }
+
+    form.addEventListener('submit', async (e) => {
+      e.preventDefault();
+      clearFeedback();
+      const email = emailInput.value.trim();
+      // Only honor the password value if the user explicitly opened
+      // the password section. Otherwise a browser autofill into the
+      // hidden field would force the form into password-sign-in mode
+      // against the user's intent.
+      const password = passwordGroup.hidden ? '' : passwordInput.value;
+      if (!email) return;
+
+      btn.disabled = true;
+      const usingPassword = password.length > 0;
+      btn.textContent = usingPassword ? 'Signing in...' : 'Sending...';
+
+      if (usingPassword) {
+        try {
+          await signInWithPassword(email, password);
+        } catch (err) {
+          setFeedback('Network error. Check your connection and try again.', 'error');
+        } finally {
+          btn.disabled = false;
+          updateBtnLabel();
+        }
+        return;
+      }
+
+      // Silent retry on the first fetch — iOS Safari sometimes
+      // aborts the very first request from a cold tab with a generic
+      // "Load failed" TypeError. A single ~500ms retry hides the
+      // flake; server-side errors (4xx/5xx) are not retried because
+      // they're deliberate responses, not transport issues.
+      const reqInit = {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email }),
+      };
+      async function postWithRetry() {
+        try {
+          return await fetch('/auth/request-link', reqInit);
+        } catch (e) {
+          await new Promise((r) => setTimeout(r, 500));
+          return await fetch('/auth/request-link', reqInit);
+        }
+      }
+      try {
+        const res = await postWithRetry();
+        if (res.status === 429) {
+          const body = await res.json().catch(() => ({}));
+          setFeedback(body.message || 'Too many requests. Try again later.', 'error');
+        } else if (res.status === 503) {
+          const body = await res.json().catch(() => ({}));
+          setFeedback(
+            body.message || 'Sign-in is temporarily unavailable.',
+            'error',
+          );
+        } else if (!res.ok) {
+          setFeedback('Something went wrong. Please try again.', 'error');
+        } else {
+          setFeedback(
+            'Check your email — we sent a sign-in link to ' + email + '. It expires in 15 minutes.',
+            'success',
+          );
+          form.reset();
+        }
+      } catch (err) {
+        setFeedback('Network error. Check your connection and try again.', 'error');
+      } finally {
+        btn.disabled = false;
+        updateBtnLabel();
+      }
+    });
+  </script>
+</body>
+</html>
diff --git a/public/index.html b/public/index.html
index bddcdbe..06c106f 100644
--- a/public/index.html
+++ b/public/index.html
@@ -2,8 +2,44 @@
 <html lang="en">
 <head>
   <meta charset="UTF-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>Recap</title>
+  <!-- viewport-fit=cover so the app paints under iOS safe-areas
+       when installed as a PWA (status bar + home indicator). -->
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
+  <title>Recaps</title>
+
+  <!-- ── PWA / Add-to-Home-Screen ──────────────────────────────────────
+       manifest.json drives Chrome/Edge/Firefox install. The apple-*
+       meta tags are iOS-specific (Safari ignores manifest for
+       "Add to Home Screen" behavior). theme-color matches the body
+       background so the system chrome blends with the app. -->
+  <link rel="manifest" href="/manifest.json">
+  <meta name="theme-color" content="#0a0e1a">
+  <link rel="apple-touch-icon" href="/assets/icon.png">
+  <meta name="apple-mobile-web-app-capable" content="yes">
+  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
+  <meta name="apple-mobile-web-app-title" content="Recaps">
+  <meta name="mobile-web-app-capable" content="yes">
+
+  <!-- ── Social preview (Open Graph + Twitter Card) ──────────────────
+       Drives the link-preview card on iMessage, Twitter/X, LinkedIn,
+       Discord, Slack, etc. og:image must be an absolute URL — relative
+       paths get rejected by some scrapers. The 1024×1024 icon doubles
+       as the social image for now; replace with a 1200×630 social
+       card when we ship a real one. -->
+  <meta property="og:type" content="website">
+  <meta property="og:site_name" content="Recaps">
+  <meta property="og:title" content="Recaps — summarize any video or podcast">
+  <meta property="og:description" content="Paste a YouTube or podcast link, get topic-level summaries with timestamps. Free trial — no signup required.">
+  <meta property="og:url" content="https://recaps.cc/">
+  <meta property="og:image" content="https://recaps.cc/assets/icon.png">
+  <meta property="og:image:width" content="1024">
+  <meta property="og:image:height" content="1024">
+  <meta name="twitter:card" content="summary">
+  <meta name="twitter:title" content="Recaps — summarize any video or podcast">
+  <meta name="twitter:description" content="Paste a YouTube or podcast link, get topic-level summaries with timestamps. Free trial — no signup required.">
+  <meta name="twitter:image" content="https://recaps.cc/assets/icon.png">
+  <meta name="description" content="Summarize any YouTube video or podcast episode into topic-level summaries with timestamps. Paste a link, get a recap.">
+
   <link rel="icon" type="image/png" href="/assets/icon.png">
   <style>
     * { box-sizing: border-box; margin: 0; padding: 0; }
@@ -98,8 +134,10 @@
       .container.has-results { max-width: 100%; padding: 12px 12px; }
       .container.has-results .top-bar { margin-bottom: 12px; }
       .top-bar-input { margin: 0 6px; }
-      .top-bar-input .url-input { padding: 7px 10px; font-size: 12px; }
-      .top-bar-input .submit-btn { padding: 7px 12px; font-size: 12px; }
+      /* Same iOS auto-zoom guard as the <=600px block — keep input
+         at 16px so Safari doesn't viewport-zoom on focus. */
+      .top-bar-input .url-input { padding: 7px 10px; font-size: 16px; }
+      .top-bar-input .submit-btn { padding: 7px 12px; font-size: 13px; }
     }
 
     /* Landscape on mobile: video goes fullscreen-ish */
@@ -172,27 +210,83 @@
     @media (max-width: 600px) {
       .container { padding: 12px 10px; }
       .container.has-results { padding: 8px 8px; height: 100vh; height: 100dvh; }
+      /* Pin the top bar so it stays visible even if the body scrolls.
+         body has min-height: 100vh and no overflow lock, so a tall
+         result page (audio player + chunk list + topic detail) can
+         push the page taller than the viewport — without sticky,
+         the user scrolls down to see the result and can't get back
+         to the URL input + hamburger menu without scrolling all the
+         way up. position: sticky inside a flex column works fine in
+         every modern browser. Background opaque so chunks below
+         don't bleed through. */
       .top-bar {
         flex-wrap: nowrap; gap: 6px;
+        position: sticky;
+        top: 0;
+        z-index: 50;
+        background: #0a0e1a;
+        padding: 6px 0;
       }
-      /* Row 1: library btn + input + mobile menu */
-      .top-left-actions { order: 1; flex-shrink: 0; }
-      .top-left-actions .icon-btn { width: 36px; height: 36px; }
+      /* Library button stays visible on mobile (left of the URL input)
+         as a one-tap target. The same toggle is also available via the
+         hamburger menu's "Library" item — two paths to the same action
+         since this is the most-used control on the screen. Sized
+         smaller than the desktop 36px to leave more room for the URL
+         input + Summarize button + hamburger on a tight mobile row. */
+      .top-left-actions { order: 0; flex-shrink: 0; }
+      .top-left-actions .icon-btn { width: 40px; height: 40px; }
       .top-bar-input {
-        order: 2; flex: 1; min-width: 0; margin: 0; gap: 4px;
+        order: 1; flex: 1; min-width: 0; margin: 0; gap: 6px;
       }
-      .top-bar-input .url-input { padding: 8px 10px; font-size: 12px; }
-      .top-bar-input .submit-btn { padding: 8px 12px; font-size: 11px; white-space: nowrap; }
-      /* Hide the desktop icon row, show hamburger */
+      /* Hide the desktop info button (the "What can I paste?" popover
+         lives in the hamburger menu on mobile to keep the input bar
+         from getting crowded). */
+      .top-bar-input .info-btn { display: none; }
+      /* font-size MUST be >=16px on iOS or Safari auto-zooms the
+         viewport when the input takes focus — that's what cuts off
+         the Summarize button and visually shrinks the input. The
+         input renders the same physical size; only the digit-size
+         changes slightly. The button matches for visual balance. */
+      .top-bar-input .url-input { padding: 10px 12px; font-size: 16px; }
+      /* Submit button on mobile — drop the word "Summarize" (or Queue
+         / Subscribe) and show a right-arrow icon instead. Sized to
+         match the hamburger button on the right so the trio (library
+         icon, input, submit, hamburger) reads as a clean row of
+         equal-height controls instead of a fat purple pill overlapping
+         the hamburger. */
+      .top-bar-input .submit-btn {
+        padding: 0; width: 48px; height: 48px; flex-shrink: 0;
+        border-radius: 11px; font-weight: 600;
+        display: flex; align-items: center; justify-content: center;
+      }
+      .top-bar-input .submit-btn .submit-btn-text { display: none; }
+      .top-bar-input .submit-btn .submit-btn-icon { display: flex; }
+      /* Hide the desktop icon row + status pills (credits live in the
+         hamburger / Settings on mobile to keep the top bar uncluttered) */
       .top-actions { display: none !important; }
+      .top-bar-status { display: none !important; }
+      /* Hamburger menu button — large enough to be unmissable. iOS
+         minimum touch target is 44pt; we go 48 so it doesn't feel
+         cramped next to the input/Summarize cluster. */
       .mobile-menu-btn {
-        display: flex; order: 3; flex-shrink: 0;
-        width: 36px; height: 36px; border-radius: 9px; border: 1px solid #1e293b;
-        background: #111827; color: #64748b; font-size: 20px;
+        display: flex; order: 2; flex-shrink: 0;
+        width: 48px; height: 48px; border-radius: 11px; border: 1px solid #1e293b;
+        background: #111827; color: #94a3b8; font-size: 24px;
         cursor: pointer; align-items: center; justify-content: center;
         transition: all 0.15s; position: relative;
+        margin-left: 4px;
       }
-      .mobile-menu-btn:hover { background: #1e293b; color: #94a3b8; }
+      .mobile-menu-btn:hover { background: #1e293b; color: #e2e8f0; }
+      /* Mobile menu dropdown items — bigger touch targets too. */
+      .mobile-menu-dropdown {
+        min-width: 240px;
+        padding: 8px;
+      }
+      .mobile-menu-item {
+        padding: 14px 16px; font-size: 14px;
+        min-height: 48px;
+      }
+      .mobile-menu-item .menu-icon svg { width: 18px; height: 18px; }
       .mobile-menu-btn .dot {
         position: absolute; top: 5px; right: 5px; width: 7px; height: 7px;
         border-radius: 50%; background: #fbbf24;
@@ -227,6 +321,21 @@
       .video-embed { border-radius: 8px; }
       /* Results split adjustments */
       .results-split { height: calc(100vh - 70px); height: calc(100dvh - 70px); }
+      /* Side panels: full-width on phones so main content doesn't bleed
+         through the edge (was 85vw / 92vw which left a visible strip). */
+      .history-sidebar { width: 100vw; max-width: 100vw; }
+      .log-drawer { width: 100vw; max-width: 100vw; }
+      /* Minimize-video button is hover-gated on desktop, but touch
+         devices don't reliably fire :hover — leaving the button
+         invisible on phones. Pin it to fully visible at mobile width
+         so users can collapse the YouTube embed and see more of the
+         transcript. */
+      .minimize-toggle { opacity: 1 !important; }
+      /* De-dupe stats: results-left's .video-meta already lists topics /
+         segments / total, and .stats-bar in results-right repeats it.
+         On phones the two columns stack, so the line shows twice — hide
+         the redundant left-column copy. */
+      .results-left .video-meta { display: none; }
     }
 
     /* Top bar with title + settings gear */
@@ -246,6 +355,80 @@
     .top-bar-input .submit-btn {
       padding: 9px 18px; font-size: 13px; border-radius: 8px;
     }
+    /* Submit-button label/icon swap. Desktop shows the text label
+       ("Summarize" / "Queue" / "Subscribe"); the icon is hidden because
+       the button is wide enough for words. Mobile flips this: the
+       button becomes a square ~48px arrow that matches the hamburger
+       button next to it, freeing horizontal space for the URL input
+       and getting rid of the overlap Grant kept hitting. */
+    .submit-btn-icon { display: none; align-items: center; justify-content: center; }
+    .submit-btn-text { display: inline; }
+
+    /* "What can I paste?" info icon to the left of the URL input.
+       Same flat icon-button styling as the top toolbar buttons but
+       smaller so it sits flush with the input bar. */
+    .info-btn {
+      background: transparent;
+      border: 1px solid #1e293b;
+      color: #64748b;
+      width: 32px; height: 32px;
+      border-radius: 8px;
+      display: flex; align-items: center; justify-content: center;
+      cursor: pointer;
+      flex-shrink: 0;
+      transition: all 0.15s ease;
+      align-self: center;
+    }
+    .info-btn:hover { background: #1e293b; color: #cbd5e1; border-color: #334155; }
+    .info-btn:active { transform: scale(0.96); }
+
+    /* Brand-styled popover card anchored under the info icon. Same
+       dark-glass aesthetic as the settings modal — single source of
+       visual truth for "Recap surfaces this card-like thing as
+       information." Positioned absolutely against .top-bar-input;
+       use top: full-input-height + small gap so it never overlaps
+       the input itself. */
+    .formats-info-card {
+      position: absolute;
+      top: calc(100% + 8px);
+      left: 0;
+      width: min(420px, calc(100vw - 24px));
+      background: #121828;
+      border: 1px solid #1f2942;
+      border-radius: 12px;
+      padding: 16px 18px;
+      box-shadow: 0 10px 30px rgba(0,0,0,0.4);
+      z-index: 50;
+      font-size: 13px;
+      color: #cbd5e1;
+      line-height: 1.55;
+      animation: formatsInfoIn 0.14s ease-out;
+    }
+    @keyframes formatsInfoIn {
+      from { opacity: 0; transform: translateY(-4px); }
+      to   { opacity: 1; transform: translateY(0); }
+    }
+    .formats-info-card-header {
+      display: flex; justify-content: space-between; align-items: center;
+      margin-bottom: 10px;
+      color: #f5f9ff;
+      font-size: 14px;
+    }
+    .formats-info-close {
+      background: transparent; border: none; color: #64748b;
+      font-size: 22px; line-height: 1; cursor: pointer; padding: 0 6px;
+      transition: color 0.15s ease;
+    }
+    .formats-info-close:hover { color: #cbd5e1; }
+    .formats-info-list {
+      list-style: none; margin: 0; padding: 0;
+    }
+    .formats-info-list li {
+      padding: 8px 0;
+      border-bottom: 1px solid rgba(31, 41, 66, 0.6);
+    }
+    .formats-info-list li:last-child { border-bottom: none; }
+    .formats-info-list strong { color: #e2e8f0; font-weight: 600; }
 
     /* Inline status + upgrade slot between the URL input and the right
        icons. Wraps on narrow screens; hidden on mobile alongside
@@ -254,6 +437,50 @@
       display: flex; align-items: center; gap: 6px; margin-right: 8px;
       flex-wrap: wrap;
     }
+    /* Top-row pizza tracker — 4-stage breadcrumb shown while a job is
+       processing. Matches the relay operator dashboard's tracker style
+       (same colors, same active-stage pulse animation) so the visual
+       language carries across both apps. Hidden by default; the JSX
+       returns empty when state.streaming === false. Sits adjacent to
+       the toolbar pills (.top-bar-status) at the top of the page. */
+    .top-breadcrumb {
+      display: flex; align-items: center; gap: 0;
+      padding: 6px 12px;
+      background: rgba(30, 41, 59, 0.4);
+      border: 1px solid #1e293b;
+      border-radius: 8px;
+      margin-right: 8px;
+      white-space: nowrap;
+    }
+    @keyframes top-breadcrumb-pulse {
+      0%, 100% { opacity: 1; }
+      50%      { opacity: 0.4; }
+    }
+    /* The breadcrumb gets dual-rendered: an inline copy inside
+       .top-bar for desktop, and a hoisted-out copy as a sibling
+       below .top-bar for mobile (so iOS Safari's flex-wrap +
+       position:sticky combo can't hide it). Default hides the
+       mobile copy; tablet+phone widths flip which copy shows. */
+    .top-breadcrumb-mobile { display: none !important; }
+    @media (max-width: 880px) {
+      /* On tablet widths the inline-toolbar breadcrumb gets crowded
+         out. Hide it; the mobile copy below the toolbar takes over. */
+      .top-bar > .top-breadcrumb { display: none; }
+      .top-breadcrumb-mobile {
+        display: flex !important;
+        justify-content: center;
+        padding: 8px 12px;
+        margin: 0 0 10px;
+      }
+    }
+    @media (max-width: 600px) {
+      /* Phone-specific touch-ups for the mobile breadcrumb copy. */
+      .top-breadcrumb-mobile {
+        margin: 0 0 8px;
+        padding: 8px 10px;
+      }
+      .top-breadcrumb-mobile span { font-size: 11px !important; }
+    }
     .top-bar-status .status-pill {
       font-size: 11px; font-weight: 600; padding: 6px 10px;
       border-radius: 8px; border: 1px solid transparent;
@@ -273,6 +500,26 @@
       white-space: nowrap;
     }
     .top-bar-status .have-key-btn:hover { color: #cbd5e1; border-color: #475569; }
+    /* Tier badge — explicit visual confirmation of an active paid
+       license. Matches the Upgrade button's accent so users associate
+       the color (purple) with "premium tier"; MAX is brighter to
+       distinguish it from PRO. Compact, uppercase, slightly tracked
+       — reads as a status marker rather than a button. */
+    .top-bar-status .tier-badge {
+      display: inline-flex; align-items: center;
+      font-size: 10px; font-weight: 800;
+      letter-spacing: 0.08em; padding: 4px 9px;
+      border-radius: 6px; white-space: nowrap;
+      border: 1px solid;
+    }
+    .top-bar-status .tier-badge.tier-pro {
+      color: #c4b5fd; background: rgba(168, 85, 247, 0.14);
+      border-color: rgba(168, 85, 247, 0.45);
+    }
+    .top-bar-status .tier-badge.tier-max {
+      color: #fde68a; background: rgba(250, 204, 21, 0.16);
+      border-color: rgba(250, 204, 21, 0.50);
+    }
 
     /* Top-right icon buttons */
     .top-actions { display: flex; gap: 8px; justify-content: flex-end; }
@@ -324,6 +571,298 @@
     .close-btn:hover { background: #1e293b; color: #e2e8f0; }
     .settings-modal-body { padding: 20px 24px; }
 
+    /* Buy / upgrade modal — same overlay pattern as settings but
+       wider to fit 2–3 tier cards side by side on desktop. Collapses
+       to a single column on narrow viewports. */
+    .buy-overlay {
+      position: fixed; inset: 0; background: rgba(0,0,0,0.65);
+      z-index: 1100; display: flex; align-items: center; justify-content: center;
+      backdrop-filter: blur(5px); animation: fadeIn 0.15s ease;
+      padding: 20px;
+    }
+    .buy-modal {
+      background: #0f172a; border: 1px solid #1e293b; border-radius: 16px;
+      width: 1000px; max-width: 100%; max-height: 90vh; overflow-y: auto;
+      box-shadow: 0 24px 64px rgba(0,0,0,0.6); animation: slideUp 0.2s ease;
+    }
+    .buy-header {
+      display: flex; justify-content: space-between; align-items: center;
+      padding: 20px 28px; border-bottom: 1px solid #1e293b;
+      position: sticky; top: 0; background: #0f172a; z-index: 1; border-radius: 16px 16px 0 0;
+    }
+    .buy-header h2 { font-size: 18px; font-weight: 700; color: #e2e8f0; margin: 0; }
+    .buy-body { padding: 28px; }
+    .buy-loading { text-align: center; color: #94a3b8; padding: 40px 20px; font-size: 14px; }
+    .buy-error {
+      padding: 20px; background: rgba(220,38,38,0.08);
+      border: 1px solid rgba(220,38,38,0.30); border-radius: 10px;
+      color: #fca5a5; text-align: center;
+    }
+    .buy-retry-btn {
+      margin-top: 12px; background: #1e293b; color: #cbd5e1;
+      border: 1px solid #334155; padding: 8px 18px; border-radius: 8px;
+      cursor: pointer; font-size: 12px; font-weight: 600;
+    }
+    /* ── Buy-credits success view ─────────────────────────────────
+       Centered confirmation that lands once the relay reports
+       status:"settled". The .buy-success-burst is a 96px square
+       holding the checkmark + a radial sparkle burst. Each sparkle
+       uses its own --ang custom property to translate outward at
+       a different angle; the keyframes scale + fade them out so
+       the result reads as a single quick burst.
+       Pure CSS, no library — feels celebratory but stays light. */
+    .buy-success {
+      text-align: center; padding: 8px 8px 4px;
+    }
+    .buy-success-burst {
+      position: relative;
+      width: 96px; height: 96px;
+      margin: 8px auto 18px;
+    }
+    .buy-success-check {
+      position: absolute; inset: 0;
+      display: flex; align-items: center; justify-content: center;
+      font-size: 56px; font-weight: 800; color: #4ade80;
+      background: rgba(74, 222, 128, 0.12);
+      border: 2px solid rgba(74, 222, 128, 0.40);
+      border-radius: 50%;
+      animation: buy-success-pop 600ms cubic-bezier(0.34, 1.56, 0.64, 1) forwards;
+      transform: scale(0);
+      z-index: 2;
+    }
+    .buy-sparkle {
+      position: absolute;
+      top: 50%; left: 50%;
+      font-size: 18px;
+      transform: translate(-50%, -50%);
+      opacity: 0;
+      animation: buy-sparkle-burst 900ms ease-out forwards;
+      animation-delay: 120ms;
+      pointer-events: none;
+    }
+    @keyframes buy-success-pop {
+      0%   { transform: scale(0)   rotate(-10deg); opacity: 0; }
+      60%  { transform: scale(1.1) rotate(0deg);   opacity: 1; }
+      100% { transform: scale(1)   rotate(0deg);   opacity: 1; }
+    }
+    @keyframes buy-sparkle-burst {
+      0%   { transform: translate(-50%, -50%) rotate(var(--ang)) translateY(0)   scale(0.4); opacity: 0; }
+      30%  { transform: translate(-50%, -50%) rotate(var(--ang)) translateY(-30px) scale(1.0); opacity: 1; }
+      100% { transform: translate(-50%, -50%) rotate(var(--ang)) translateY(-70px) scale(0.8); opacity: 0; }
+    }
+    .buy-success-title {
+      margin: 0 0 4px;
+      font-size: 18px; font-weight: 700;
+      color: #f5f9ff;
+    }
+    .buy-success-sub {
+      margin: 0;
+      font-size: 13px; line-height: 1.55;
+      color: #94a3b8;
+    }
+    .buy-tier-grid {
+      display: grid; gap: 16px;
+      grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
+    }
+    .buy-tier {
+      background: #111827; border: 1px solid #1e293b; border-radius: 12px;
+      padding: 24px; display: flex; flex-direction: column; gap: 12px;
+      position: relative; transition: border-color 0.15s, transform 0.15s;
+    }
+    .buy-tier:hover { border-color: #334155; transform: translateY(-2px); }
+    .buy-tier-highlighted {
+      border: 2px solid #a855f7;
+      background: linear-gradient(180deg, rgba(168,85,247,0.10), #111827);
+      box-shadow: 0 12px 40px rgba(168,85,247,0.25);
+      transform: translateY(-4px);
+    }
+    .buy-tier-highlighted:hover {
+      transform: translateY(-6px);
+    }
+    .buy-tier-top {
+      display: flex; justify-content: space-between; align-items: flex-start; gap: 10px;
+    }
+    .buy-tier-name {
+      font-size: 22px; font-weight: 700; color: #e2e8f0; letter-spacing: -0.01em;
+    }
+    .buy-tier-badges {
+      display: flex; flex-direction: column; gap: 6px; align-items: flex-end;
+    }
+    .buy-badge {
+      background: #a855f7; color: #fff;
+      padding: 4px 10px; border-radius: 999px; font-size: 10px; font-weight: 700;
+      text-transform: uppercase; letter-spacing: 0.04em; white-space: nowrap;
+    }
+    .buy-discount-badge {
+      background: #16a34a; color: #fff;
+      padding: 4px 10px; border-radius: 999px; font-size: 10px; font-weight: 700;
+      text-transform: uppercase; letter-spacing: 0.04em; white-space: nowrap;
+    }
+    .buy-tier-desc { font-size: 13px; color: #94a3b8; line-height: 1.5; }
+    .buy-price-row {
+      display: flex; align-items: baseline; gap: 10px; flex-wrap: wrap;
+      margin-top: 4px;
+    }
+    .buy-price-new { font-size: 28px; font-weight: 700; color: #e2e8f0; }
+    .buy-price-old {
+      font-size: 16px; color: #64748b; text-decoration: line-through;
+    }
+    .buy-price-unit { font-size: 13px; color: #94a3b8; font-weight: 500; }
+    .buy-trial {
+      font-size: 11px; color: #86efac; font-weight: 600;
+      background: rgba(134,239,172,0.08); border: 1px solid rgba(134,239,172,0.25);
+      padding: 4px 8px; border-radius: 6px; align-self: flex-start;
+    }
+    .buy-bullets {
+      list-style: none; padding: 0; margin: 8px 0 0; display: flex;
+      flex-direction: column; gap: 8px;
+    }
+    .buy-bullets li {
+      font-size: 13px; color: #cbd5e1; padding-left: 22px; position: relative;
+      line-height: 1.5;
+    }
+    .buy-bullets li::before {
+      content: "✓"; position: absolute; left: 0; top: 0;
+      color: #86efac; font-weight: 700;
+    }
+
+    /* Welcome modal bullets — same green-check style as .buy-bullets
+       but with a two-line layout (strong title + soft-color body
+       below it). Used only by renderWelcomeModal. */
+    .welcome-bullets {
+      list-style: none; padding: 0; margin: 0; display: flex;
+      flex-direction: column; gap: 14px;
+    }
+    .welcome-bullets li {
+      padding-left: 24px; position: relative; line-height: 1.5;
+    }
+    .welcome-bullets li::before {
+      content: "✓"; position: absolute; left: 0; top: 0;
+      color: #86efac; font-weight: 700; font-size: 14px;
+    }
+    .welcome-bullets li strong {
+      display: block; font-size: 14px; color: #e2e8f0; font-weight: 600;
+      margin-bottom: 2px;
+    }
+    .welcome-bullets li span {
+      display: block; font-size: 12.5px; color: #94a3b8; line-height: 1.5;
+    }
+    .buy-select-btn {
+      margin-top: auto; background: #1e293b; color: #e2e8f0;
+      border: 1px solid #334155; padding: 11px 16px; border-radius: 9px;
+      cursor: pointer; font-size: 14px; font-weight: 600; transition: all 0.15s;
+    }
+    .buy-select-btn:hover { background: #334155; border-color: #475569; }
+    .buy-select-btn-primary { background: #a855f7; border-color: #a855f7; color: #fff; }
+    .buy-select-btn-primary:hover { background: #c084fc; border-color: #c084fc; }
+
+    /* Self-serve subscription modal — "Pay with Bitcoin" primary pill
+       + a muted "Pay by card" link beneath it. */
+    /* The "Pay with Bitcoin" pill inherits the standard purple from
+       .buy-select-btn-primary (matching every other primary pill); we only
+       add the glyph layout here. */
+    .sub-pay-btc {
+      display: inline-flex; align-items: center; justify-content: center; gap: 7px;
+    }
+    .sub-pay-btc:disabled { opacity: 0.6; cursor: default; }
+    .sub-btc-glyph { font-weight: 800; font-size: 15px; line-height: 1; }
+    .sub-pay-card {
+      margin-top: 8px; background: transparent; border: none; color: #94a3b8;
+      font-size: 13px; font-weight: 500; cursor: pointer; padding: 6px 4px;
+      text-decoration: underline; text-underline-offset: 3px;
+      align-self: center;
+    }
+    .sub-pay-card:hover { color: #cbd5e1; }
+    .sub-pay-card:disabled { opacity: 0.5; cursor: default; }
+    .sub-card-note {
+      margin-top: 12px; font-size: 12.5px; color: #fcd34d;
+      background: rgba(252,211,77,0.08); border: 1px solid rgba(252,211,77,0.22);
+      padding: 8px 12px; border-radius: 8px; text-align: center;
+    }
+    .sub-busy {
+      margin-top: 12px; font-size: 13px; color: #a5b4fc; text-align: center;
+    }
+    .sub-foot-hint {
+      margin-top: 16px; font-size: 12px; color: #64748b; line-height: 1.55;
+      text-align: center;
+    }
+
+    .buy-polling {
+      text-align: center; padding: 40px 30px; max-width: 480px; margin: 0 auto;
+    }
+    .buy-polling-spinner { font-size: 40px; margin-bottom: 12px; }
+    .buy-polling h3 { font-size: 18px; font-weight: 700; color: #e2e8f0; margin: 0 0 12px; }
+    .buy-polling p { font-size: 13px; color: #94a3b8; line-height: 1.6; margin: 0 0 24px; }
+    .buy-polling-actions { display: flex; gap: 10px; justify-content: center; flex-wrap: wrap; }
+    .buy-secondary-btn {
+      background: #1e293b; color: #cbd5e1; border: 1px solid #334155;
+      padding: 8px 16px; border-radius: 8px; cursor: pointer;
+      font-size: 12px; font-weight: 600;
+    }
+    .buy-secondary-btn:hover { background: #334155; }
+    .buy-poll-error {
+      margin-top: 16px; padding: 10px 14px; font-size: 11px; color: #fca5a5;
+      background: rgba(220,38,38,0.08); border: 1px solid rgba(220,38,38,0.25);
+      border-radius: 8px;
+    }
+
+    /* Discount-code interim view */
+    .buy-discount {
+      max-width: 480px; margin: 0 auto;
+      display: flex; flex-direction: column; gap: 16px;
+    }
+    .buy-back-link {
+      align-self: flex-start; background: transparent; border: none;
+      color: #94a3b8; cursor: pointer; font-size: 12px; font-weight: 600;
+      padding: 4px 0;
+    }
+    .buy-back-link:hover { color: #cbd5e1; }
+    .buy-discount-tier {
+      background: #111827; border: 1px solid #1e293b; border-radius: 10px;
+      padding: 16px;
+    }
+    .buy-discount-tier-name {
+      font-size: 18px; font-weight: 700; color: #e2e8f0; margin-bottom: 4px;
+    }
+    .buy-discount-form { display: flex; flex-direction: column; gap: 6px; }
+    .buy-discount-label {
+      font-size: 11px; color: #94a3b8; font-weight: 600;
+      text-transform: uppercase; letter-spacing: 0.05em;
+    }
+    .buy-discount-input {
+      padding: 11px 14px; font-size: 14px; font-family: ui-monospace, monospace;
+      background: #0f172a; border: 1px solid #334155; border-radius: 9px;
+      color: #e2e8f0; text-transform: uppercase; letter-spacing: 0.05em;
+    }
+    .buy-discount-input:focus {
+      outline: none; border-color: #a855f7;
+      box-shadow: 0 0 0 3px rgba(168,85,247,0.15);
+    }
+    .buy-discount-input:disabled { opacity: 0.6; }
+    .buy-discount-actions {
+      display: flex; gap: 10px; flex-wrap: wrap; margin-top: 4px;
+    }
+    .buy-discount-actions .buy-select-btn { flex: 1; min-width: 200px; margin-top: 0; }
+    .buy-discount-actions .buy-secondary-btn { flex: 0 0 auto; }
+    .buy-discount-preview {
+      background: linear-gradient(180deg, rgba(134,239,172,0.08), #0f172a);
+      border: 1px solid rgba(134,239,172,0.30); border-radius: 10px;
+      padding: 14px 16px; display: flex; flex-direction: column; gap: 6px;
+    }
+    .buy-discount-row {
+      display: flex; justify-content: space-between; align-items: baseline;
+      font-size: 13px; color: #cbd5e1;
+    }
+    .buy-discount-old { color: #64748b; text-decoration: line-through; }
+    .buy-discount-save { color: #86efac; font-weight: 600; }
+    .buy-discount-total {
+      margin-top: 6px; padding-top: 10px; border-top: 1px solid rgba(134,239,172,0.25);
+      font-size: 16px; font-weight: 700; color: #e2e8f0;
+    }
+    .buy-discount-hint {
+      font-size: 11px; color: #64748b; line-height: 1.5; margin-top: 4px;
+    }
+
     /* Cards */
     .card {
       background: #111827;
@@ -504,6 +1043,61 @@
     .transcript-line.active-line .ts-badge { color: #a5b4fc; font-weight: 600; }
     .transcript-line.active-line .transcript-text { color: #f1f5f9; }
 
+    /* Speaker chip — small colored circle + letter shown beside each
+       transcript line that has a diarization-assigned speaker. The
+       chip color is determined by the speaker's index (Speaker_A =
+       chip-a, Speaker_B = chip-b, ...). Eight distinct colors cover
+       the realistic speaker-count range for podcasts/interviews; if
+       a video somehow has >8 speakers the extra ones cycle back. */
+    .speaker-chip {
+      display: inline-flex; align-items: center; justify-content: center;
+      min-width: 26px; height: 18px; padding: 0 6px;
+      font-size: 10px; font-weight: 700;
+      border-radius: 4px; flex-shrink: 0; margin-top: 1px;
+      letter-spacing: 0.02em; line-height: 1;
+      font-family: ui-monospace, Menlo, Consolas, monospace;
+    }
+    .speaker-chip.low-conf::after {
+      content: "?"; margin-left: 1px; opacity: 0.7; font-weight: 500;
+    }
+    .speaker-chip.chip-a { background: rgba(239,68,68,0.18); color: #fca5a5; border: 1px solid rgba(239,68,68,0.35); }
+    .speaker-chip.chip-b { background: rgba(59,130,246,0.18); color: #93c5fd; border: 1px solid rgba(59,130,246,0.35); }
+    .speaker-chip.chip-c { background: rgba(34,197,94,0.18); color: #86efac; border: 1px solid rgba(34,197,94,0.35); }
+    .speaker-chip.chip-d { background: rgba(245,158,11,0.18); color: #fcd34d; border: 1px solid rgba(245,158,11,0.35); }
+    .speaker-chip.chip-e { background: rgba(168,85,247,0.18); color: #d8b4fe; border: 1px solid rgba(168,85,247,0.35); }
+    .speaker-chip.chip-f { background: rgba(14,165,233,0.18); color: #7dd3fc; border: 1px solid rgba(14,165,233,0.35); }
+    .speaker-chip.chip-g { background: rgba(236,72,153,0.18); color: #f9a8d4; border: 1px solid rgba(236,72,153,0.35); }
+    .speaker-chip.chip-h { background: rgba(100,116,139,0.18); color: #cbd5e1; border: 1px solid rgba(100,116,139,0.35); }
+
+    /* Speaker legend — appears above the chunks list when diarization
+       has produced a speaker map. Each row: colored chip + speaker
+       name + stats (turns, total speaking time). Compact, never wraps
+       individual entries — wraps the whole row when narrow. */
+    .speakers-legend {
+      display: flex; flex-wrap: wrap; gap: 8px;
+      padding: 8px 12px; margin: 0 0 10px;
+      background: rgba(15,23,42,0.5);
+      border: 1px solid #1e293b; border-radius: 8px;
+      font-size: 11px; color: #cbd5e1;
+    }
+    .speakers-legend-title {
+      font-size: 10px; font-weight: 600; color: #64748b;
+      text-transform: uppercase; letter-spacing: 0.06em;
+      padding-top: 3px;
+      margin-right: 4px;
+    }
+    .speakers-legend-item {
+      display: inline-flex; align-items: center; gap: 6px;
+      padding: 3px 8px;
+      background: rgba(255,255,255,0.03);
+      border: 1px solid #1e293b; border-radius: 16px;
+      font-size: 11px;
+    }
+    .speakers-legend-item .legend-stats {
+      color: #64748b; font-size: 10px;
+      font-variant-numeric: tabular-nums;
+    }
+
     /* Clip collection buttons */
     .clip-line-btn {
       opacity: 0; font-size: 12px; cursor: pointer; flex-shrink: 0;
@@ -582,6 +1176,63 @@
     /* Now-playing indicator */
     .chunk.now-playing { border-color: #22c55e; }
 
+    /* ── Audio-first "Listen" player (Phase 3) ──────────────────────── */
+    .rp-overlay {
+      position: fixed; inset: 0; z-index: 1000;
+      background: rgba(5, 8, 16, 0.92); backdrop-filter: blur(6px);
+      display: flex; align-items: center; justify-content: center; padding: 20px;
+    }
+    .rp-overlay[hidden] { display: none; }
+    .rp-panel {
+      width: 100%; max-width: 460px; background: #0b1120;
+      border: 1px solid #1e293b; border-radius: 18px; padding: 20px;
+      box-shadow: 0 20px 60px rgba(0,0,0,0.5); display: flex; flex-direction: column; gap: 16px;
+    }
+    .rp-head { display: flex; align-items: center; gap: 10px; }
+    .rp-source-title { flex: 1; min-width: 0; font-size: 12px; color: #64748b;
+      white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+    .rp-close { background: transparent; border: none; color: #64748b; font-size: 20px;
+      cursor: pointer; line-height: 1; padding: 4px; }
+    .rp-close:hover { color: #e2e8f0; }
+    .rp-now { text-align: center; min-height: 150px; display: flex; flex-direction: column; gap: 8px; }
+    .rp-topic-counter { font-size: 12px; color: #818cf8; font-weight: 600; letter-spacing: 0.04em; }
+    .rp-topic-title { font-size: 20px; font-weight: 700; color: #f1f5f9; line-height: 1.25; }
+    .rp-status { font-size: 12px; color: #94a3b8; min-height: 14px; }
+    .rp-summary { font-size: 13px; color: #cbd5e1; line-height: 1.5; max-height: 160px;
+      overflow-y: auto; text-align: left; }
+    .rp-dots { display: flex; flex-wrap: wrap; gap: 6px; justify-content: center; }
+    .rp-dot { width: 9px; height: 9px; border-radius: 50%; background: #1e293b; transition: background 0.2s; }
+    .rp-dot.ready { background: #334155; }
+    .rp-dot.failed { background: #7f1d1d; }
+    .rp-dot.active { background: #22c55e; transform: scale(1.25); }
+    .rp-deeper {
+      width: 100%; padding: 12px; border-radius: 12px; border: 1px solid #6366f1;
+      background: #4f46e5; color: #fff; font-size: 14px; font-weight: 600; cursor: pointer;
+    }
+    .rp-deeper:hover { background: #4338ca; }
+    .rp-deeper.rp-resume { background: #0f172a; border-color: #334155; color: #e2e8f0; }
+    .rp-keep { display: flex; align-items: center; gap: 8px; font-size: 12px; color: #94a3b8; cursor: pointer; }
+    .rp-keep input { accent-color: #818cf8; }
+    .rp-controls { display: flex; align-items: center; justify-content: center; gap: 18px; }
+    .rp-ctrl {
+      width: 52px; height: 52px; border-radius: 50%; border: 1px solid #1e293b;
+      background: #0f172a; color: #e2e8f0; font-size: 18px; cursor: pointer;
+      display: flex; align-items: center; justify-content: center;
+    }
+    .rp-ctrl:hover { border-color: #334155; background: #1e293b; }
+    .rp-ctrl.rp-play { width: 64px; height: 64px; background: #22c55e; border-color: #22c55e; color: #04210f; font-size: 24px; }
+    .rp-ctrl.rp-play:hover { background: #16a34a; }
+    .rp-ctrl.rp-play svg { display: block; }
+    .rp-ctrl.rp-speed { width: 48px; height: 48px; font-size: 13px; font-weight: 700; }
+    .rp-listen-btn { color: #a5b4fc !important; border-color: #312e81 !important; }
+    /* Deep-dive source transcript (follow-along) */
+    .rp-transcript { max-height: 46vh; overflow-y: auto; display: flex; flex-direction: column; gap: 1px; text-align: left; padding: 2px 0; -webkit-overflow-scrolling: touch; }
+    .rp-transcript[hidden] { display: none; }
+    .rp-tline { display: block; width: 100%; text-align: left; background: transparent; border: none; color: #94a3b8; font-size: 12.5px; line-height: 1.5; padding: 6px 8px; border-radius: 6px; cursor: pointer; }
+    .rp-tline:hover { background: rgba(129,140,248,0.08); color: #cbd5e1; }
+    .rp-tline-active { background: rgba(34,197,94,0.14); color: #f1f5f9; }
+    .rp-tts { color: #64748b; font-variant-numeric: tabular-nums; margin-right: 6px; font-size: 11px; }
+
     /* History sidebar — persistent, pushes content */
     .history-sidebar {
       position: fixed; top: 0; left: 0; bottom: 0; width: 320px;
@@ -979,6 +1630,12 @@
   <!-- YouTube IFrame API -->
   <script src="https://unpkg.com/jspdf@2.5.1/dist/jspdf.umd.min.js"></script>
   <script src="https://www.youtube.com/iframe_api"></script>
+  <!-- QR encoder for inline Lightning invoice rendering. Vendored
+       locally so the inline-payment UI works without a network round
+       trip to a CDN (and works behind start-tunnel without external
+       internet). Used only on the buy-credits modal — null-checked
+       so a load failure degrades to text-only BOLT11 + copy. -->
+  <script src="/assets/qrcode.min.js"></script>
 
   <script>
     // ── YouTube Player API ──────────────────────────────────────────────────
@@ -1255,13 +1912,16 @@
         transcriptionModels: [
           "gemini-3-flash-preview",
           "gemini-2.5-flash",
-          "gemini-2.0-flash",
+          "gemini-3.1-flash-lite",
+          "gemini-2.5-pro",
+          "gemini-3.1-pro-preview",
         ],
         analysisModels: [
           "gemini-3.1-pro-preview",
-          "gemini-3-pro-preview",
+          "gemini-2.5-pro",
           "gemini-3-flash-preview",
           "gemini-2.5-flash",
+          "gemini-3.1-flash-lite",
         ],
         keyField: { key: "apiKey", label: "Gemini API Key", placeholder: "AIza...", masked: true, helpUrl: "https://aistudio.google.com/apikey" },
       },
@@ -1404,50 +2064,117 @@
       state.apiKey = gk;
     }
 
+    // Two-tier provider model: the user picks either
+    //   - "Recap Relay" → BOTH transcribe + analyze go through the
+    //     operator's relay. The whole pipeline (download, chunked TX,
+    //     chunked AN) runs server-side. One credit, one HTTP kickoff.
+    //   - "Custom Provider/Local" → BOTH steps go to non-relay
+    //     providers. User picks each step independently from Gemini,
+    //     Claude, OpenAI, local-OpenAI-compatible, Ollama, Whisper.
+    //     User pays their own API costs; credits not involved.
+    //
+    // This replaces an older model where each step could independently
+    // pick "relay" or any direct provider. The new constraint is that
+    // "relay" is all-or-nothing — relay credits aren't priced for
+    // single-step use and mixing-with-direct led to muddy accounting.
+    //
+    // Migration: legacy localStorage entries with BOTH set to "relay"
+    // land in providerMode="relay"; anything else lands in "custom"
+    // (and any per-step "relay" picks get bumped to the first non-relay
+    // option so the saved config remains valid in custom mode).
+    const NON_RELAY_TRANSCRIBE_PROVIDERS = TRANSCRIBE_PROVIDERS.filter((p) => p.id !== "relay");
+    const NON_RELAY_ANALYZE_PROVIDERS = ANALYZE_PROVIDERS.filter((p) => p.id !== "relay");
+
     function loadProviderSelection() {
       let sel = {};
       try {
         const raw = localStorage.getItem("recap-providers");
         if (raw) sel = JSON.parse(raw) || {};
       } catch {}
-      // For fresh installs with no saved preference, default to the
-      // relay provider — that's the "works out of the box with no
-      // setup" choice. Anyone who'd rather use their own API key or
-      // a self-hosted model just picks a different provider from the
-      // dropdown; the new pick gets saved to localStorage so it
-      // sticks across sessions.
+      const savedMode = sel.providerMode || null;
       const desiredTrans = sel.transcriptionProvider || "relay";
       const desiredAna = sel.analysisProvider || "relay";
+      // Derive providerMode: if not explicitly saved, infer from the
+      // saved per-step providers (legacy storage). Fresh installs land
+      // on "relay" — the comped-credits experience.
+      const inferredMode =
+        savedMode || (desiredTrans === "relay" && desiredAna === "relay" ? "relay" : "custom");
+      if (inferredMode === "relay") {
+        return {
+          providerMode: "relay",
+          transcriptionProvider: "relay",
+          transcriptionModel: "relay-default",
+          analysisProvider: "relay",
+          analysisModel: "relay-default",
+        };
+      }
+      // Custom mode — strip any stale per-step relay picks (relay is
+      // not available in custom mode) and fall back to the first
+      // non-relay provider when needed.
       const tp =
-        TRANSCRIBE_PROVIDERS.find((p) => p.id === desiredTrans) ||
-        TRANSCRIBE_PROVIDERS[0];
+        (desiredTrans !== "relay" &&
+          NON_RELAY_TRANSCRIBE_PROVIDERS.find((p) => p.id === desiredTrans)) ||
+        NON_RELAY_TRANSCRIBE_PROVIDERS[0];
       const ap =
-        ANALYZE_PROVIDERS.find((p) => p.id === desiredAna) ||
-        ANALYZE_PROVIDERS[0];
+        (desiredAna !== "relay" &&
+          NON_RELAY_ANALYZE_PROVIDERS.find((p) => p.id === desiredAna)) ||
+        NON_RELAY_ANALYZE_PROVIDERS[0];
       return {
+        providerMode: "custom",
         transcriptionProvider: tp.id,
-        transcriptionModel: sel.transcriptionModel || tp.transcriptionModels[0] || "",
+        transcriptionModel:
+          (desiredTrans === tp.id && sel.transcriptionModel) ||
+          tp.transcriptionModels[0] ||
+          "",
         analysisProvider: ap.id,
-        analysisModel: sel.analysisModel || ap.analysisModels[0] || ap.analysisModelDefault || "",
+        analysisModel:
+          (desiredAna === ap.id && sel.analysisModel) ||
+          ap.analysisModels[0] ||
+          ap.analysisModelDefault ||
+          "",
       };
     }
 
-    // Hard reset of the picker selection back to relay/relay. Useful
-    // when the user has stale selections from a previous session
-    // (e.g. they configured Whisper at home and now want comped
-    // credits) and wants a one-click way back to the defaults.
-    function resetProvidersToRelay() {
-      state.transcriptionProvider = "relay";
-      state.transcriptionModel = "relay-default";
-      state.analysisProvider = "relay";
-      state.analysisModel = "relay-default";
+    // Master-mode setter — invoked by the top-of-pane radio. Toggles
+    // between the relay-pipeline mode and the custom-providers mode.
+    // When switching to relay, force both per-step picks to "relay";
+    // when switching to custom, bump anything still on "relay" to a
+    // sane non-relay default so the saved config remains valid.
+    function setProviderMode(mode) {
+      if (mode !== "relay" && mode !== "custom") return;
+      state.providerMode = mode;
+      if (mode === "relay") {
+        state.transcriptionProvider = "relay";
+        state.transcriptionModel = "relay-default";
+        state.analysisProvider = "relay";
+        state.analysisModel = "relay-default";
+      } else {
+        if (state.transcriptionProvider === "relay") {
+          const tp = NON_RELAY_TRANSCRIBE_PROVIDERS[0];
+          state.transcriptionProvider = tp.id;
+          state.transcriptionModel = tp.transcriptionModels[0] || "";
+        }
+        if (state.analysisProvider === "relay") {
+          const ap = NON_RELAY_ANALYZE_PROVIDERS[0];
+          state.analysisProvider = ap.id;
+          state.analysisModel = ap.analysisModels[0] || ap.analysisModelDefault || "";
+        }
+      }
       saveProviderSelection();
       render();
     }
 
+    // Hard reset back to Recap Relay mode. Surfaced as a small link
+    // when the user has switched to custom — one click back to the
+    // out-of-the-box experience without manually re-picking providers.
+    function resetProvidersToRelay() {
+      setProviderMode("relay");
+    }
+
     function saveProviderSelection() {
       try {
         localStorage.setItem("recap-providers", JSON.stringify({
+          providerMode: state.providerMode,
           transcriptionProvider: state.transcriptionProvider,
           transcriptionModel: state.transcriptionModel,
           analysisProvider: state.analysisProvider,
@@ -1528,11 +2255,77 @@
       // Core lifetime cap via the relay's Adjust Tier Quotas action).
       // Shape: { configured: bool, tiers: {...} | null, core_total_credits, core_gemini_credits, error? }
       relayPolicy: { configured: false, tiers: null, core_total_credits: null, core_gemini_credits: null },
+      // Multi-tenant account state from /api/account/whoami. Drives
+      // the sign-in / sign-out UI and the operator-vs-tenant settings
+      // panel split. Default is multi-mode / anonymous / no user so
+      // the FIRST paint hides admin-only items (Activity Log, full
+      // Settings) for anonymous visitors who land on a multi-tenant
+      // Recap. The /api/account/whoami response either confirms that
+      // (state stays anonymous/trial) or flips to single-mode (which
+      // bumps isAdmin() back to true and reveals the operator UI).
+      // Single-mode operators briefly see the lite UI on first paint
+      // before loadAccount() resolves — typically <200ms, acceptable.
+      // Shape:
+      //   { loaded, recap_mode: "single"|"multi",
+      //     state: "signed_in"|"trial"|"anonymous",
+      //     user?: { id, email, is_admin, has_license, ... },
+      //     trial?: { credits_remaining, credits_total, credits_used } }
+      account: { loaded: false, recap_mode: "multi", state: "anonymous", user: null, trial: null },
       lanMode: null,       // null = unknown, true = home, false = traveling
       serverStatus: "connecting", // "connected" | "sleeping" | "disconnected" | "connecting"
       model: "gemini-3.1-pro-preview",
       showKey: false,
       settingsOpen: false,
+      // "What can I paste here?" popover anchored next to the URL
+      // input. Click-toggle, click-outside-to-close. State is
+      // intentionally per-tab (not persisted) — users only need to
+      // see the format list once or twice before it becomes obvious.
+      formatsInfoOpen: false,
+      // Operator panel state for multi-tenant admins — distinct from
+      // state.admin (which is the single-mode password-gate auth). ops
+      // is only populated when is_admin === 1 in multi mode. tenants
+      // is the full per-user table; activity is the recent-signups
+      // breakdown (IP/UA/hour aggregations). Loaded lazily when the
+      // operator opens the Settings modal to avoid hitting SQLite on
+      // every page load.
+      ops: {
+        tenants: null,        // null = not loaded, [] = loaded but empty
+        tenantsLoading: false,
+        tenantsError: null,
+        activity: null,       // { window_hours, signups_by_ip, ... }
+        activityLoading: false,
+        activityError: null,
+        activityHours: 24,    // user-selectable window
+        // Per-row "Grant credits" inline editor state. Keyed by user_id
+        // so the operator can expand any row and we keep the input
+        // value while they type. Only one row open at a time keeps
+        // the UI simple.
+        grantOpenFor: null,   // user_id of the currently-expanded row
+        grantAmount: "",
+        grantBusy: false,
+        // Per-row "Set tier" inline selector (Core / Pro / Max). Same
+        // one-row-at-a-time model as the credits editor above.
+        tierOpenFor: null,
+        tierBusy: false,
+        // Whether this server holds the relay operator key (set from the
+        // /api/admin/tenants response). Gates the per-row Tier control —
+        // false on a self-hosted operator with no matching key.
+        operatorKeyConfigured: false,
+      },
+      // User's own active sessions (lite-settings tenant view). Loaded
+      // on demand when the Settings modal opens.
+      mySessions: { rows: null, loading: false, error: null },
+      // "Take Recap home" — fetches the tenant's raw license key on
+      // demand. We don't load this in /api/account/whoami because the
+      // key is a bearer credential we'd rather not pass through the
+      // boot-time response. Loaded only when the tenant opens the
+      // take-home panel (one-click reveal + copy).
+      takeHome: { licenseKey: null, loading: false, error: null, revealed: false, copied: false },
+      // Password set/change editor state. Collapsed by default; opens
+      // when the tenant clicks "Set a password" / "Change password".
+      passwordOpen: false,
+      passwordInput: "",
+      passwordBusy: false,
       loading: false,
       currentStep: 0,
       status: "",
@@ -1551,7 +2344,12 @@
       // refreshes.
       collapsedLogGroups: new Set(),
       // history
-      historyOpen: true,
+      // Library sidebar default state. On wide screens the library is a
+      // useful at-a-glance always-on panel. On mobile it covers most of
+      // the screen — defaulting to closed so first-time visitors see
+      // the URL input + value prop instead of an empty library panel.
+      // window.matchMedia is available everywhere we care about.
+      historyOpen: !window.matchMedia("(max-width: 600px)").matches,
       historySessions: {},  // id → session summary
       historyMeta: { folders: [], uncategorized: [] },
       historyLoaded: false,
@@ -1578,6 +2376,12 @@
       currentType: "youtube", // "youtube" or "podcast"
       videoMinimized: false,
       currentSessionId: null,
+      // Audio-first ("walking mode") TTS, Phase 3. Populated from
+      // /api/tts/availability. ttsAvailable = relay offers TTS;
+      // ttsAllowed = AND this user may use it (Max in multi mode).
+      ttsAvailable: undefined,
+      ttsAllowed: false,
+      ttsVoice: null,
       // clip collection for selective sharing
       clipCollection: [], // { sessionId, chunkIndex, entryIndex (optional) }
       clipPanelOpen: false,
@@ -1605,7 +2409,109 @@
       // Free tier: once dismissed, the activation screen no longer
       // hard-gates the UI. Persisted so returning unlicensed users land
       // straight in the app.
-      activationSkipped: localStorage.getItem("recap-activation-skipped") === "1",
+      // Default to "skipped" on every boot — the app opens straight to
+      // the main page. Curious users can reach the activation screen via
+      // the "I have a key" button in the toolbar (which calls
+      // showActivationScreen()). Used to persist a "user has seen the
+      // activation screen" flag in localStorage; that's no longer
+      // meaningful since we never auto-show on boot anymore.
+      activationSkipped: true,
+      // In-app license-purchase modal state. Modal renders the live
+      // tier list from /api/license/policies (proxied to Keysat) using
+      // Recap's own typography + colors instead of redirecting buyers
+      // to Keysat's hosted /buy/<slug> page.
+      buyOpen: false,
+      buyLoading: false,
+      buyError: null,
+      buyPolicies: null, // { policies: [...] } once fetched
+      // Three-state view machine inside the modal:
+      //   "tiers"    — tier-card picker (default)
+      //   "discount" — interim discount-code entry for the chosen tier
+      //   "polling"  — waiting for BTCPay invoice to settle
+      buyView: "tiers",
+      // Tier the buyer picked (set when transitioning to "discount"):
+      //   { slug, name, basePriceSats, isRecurring, renewalPeriodDays }
+      buyDraft: null,
+      // Discount entry state inside the "discount" view:
+      //   { code, applying, error, finalSats, discountAppliedSats }
+      buyDiscount: null,
+      // After the buyer commits (with or without discount):
+      //   { invoiceId, checkoutUrl, amountSats, policySlug, policyName,
+      //     discountAppliedSats, basePriceSats }
+      buyInvoice: null,
+      // True while we're polling /api/license/poll/<invoiceId> waiting
+      // for the BTCPay invoice to settle and the license to be issued.
+      buyPolling: false,
+      buyPollError: null,
+      // ── Buy-credits modal (separate from the license modal above) ──
+      // Identical state machine pattern: "packages" → "polling" with
+      // loading / error spinners in between. Lives in its own state
+      // slice so a buyer can purchase credits without disrupting an
+      // in-flight license purchase (or vice versa).
+      buyCreditsOpen: false,
+      buyCreditsView: "packages",       // "packages" | "polling"
+      buyCreditsPackages: null,         // [{credits, sats}]
+      buyCreditsLoading: false,
+      buyCreditsError: null,
+      buyCreditsInvoice: null,          // { invoiceId, checkoutUrl, sats, credits }
+      buyCreditsPolling: false,
+      buyCreditsPollError: null,
+
+      // ── Self-serve subscription modal (cloud / multi-mode) ──────────
+      // A signed-in Core user buys their own prepaid Pro/Max period via
+      // the relay-owned tier (core-decoupling). Distinct from the
+      // Keysat license modal (single-mode "take it home" flow) and the
+      // buy-credits modal. View machine: "tiers" (pick Pro/Max, Pay with
+      // Bitcoin pill + Pay by card link) → "polling" (BTCPay invoice
+      // open, polling /api/billing/status) → "success" (tier flipped).
+      subscribeOpen: false,
+      subscribeView: "tiers",           // "tiers" | "polling" | "success"
+      subscribeLoading: false,
+      subscribeError: null,
+      subscribePlans: null,             // { period_days, plans:[{tier,sats}] }
+      subscribePreselect: null,         // "pro" | "max" | null
+      subscribeInvoice: null,           // { invoiceId, checkoutUrl, sats, tier, periodDays }
+      subscribeBaseline: null,          // { tier, expires_at } captured at buy time
+      subscribePolling: false,
+      subscribePollError: null,
+      subscribeCardNote: null,          // inline "card coming soon" note
+      subscribeSettledTier: null,       // tier shown on the success view
+
+      // ── First-visit welcome modal ───────────────────────────────────
+      // Shown ONCE to brand-new anon visitors on a multi-tenant
+      // Recap (no recap_welcome_seen cookie). Explains the product
+      // before they have to figure it out from the empty URL input.
+      // Dismissed by clicking "Get started" — sets a 1-year cookie so
+      // they never see it again on this browser. Single-mode operator
+      // installs never show this (they're not "new visitors" in the
+      // cloud sense — they installed the app deliberately).
+      welcomeOpen: !(
+        typeof document !== "undefined" &&
+        document.cookie
+          .split(";")
+          .some((c) => c.trim().startsWith("recap_welcome_seen="))
+      ),
+
+      // ── Anon "Sign up" 3-tier modal ─────────────────────────────────
+      // Opens when an anon visitor clicks the Sign up pill. Shows
+      // Free / Pro / Max cards. Free path = email + magic-link
+      // (no payment). Pro/Max path = email + BTCPay invoice + poll
+      // for settle. On settle the server creates the account, attaches
+      // the license, and sends a "your account is ready" magic-link
+      // email. Modal state tracks which view we're in: "cards" (pick
+      // a tier) → "free_email" (Free card → email input) → "free_sent"
+      // (confirmation) OR "polling" (Pro/Max → waiting on payment) →
+      // "purchase_sent" (settle complete, email on the way).
+      tierSignupOpen: false,
+      tierSignupView: "cards",
+      tierSignupPolicies: null,         // loaded from /api/license/policies
+      tierSignupLoading: false,
+      tierSignupError: null,
+      tierSignupEmail: "",
+      tierSignupSelectedTier: null,     // "free" | <policy slug>
+      tierSignupBusy: false,
+      tierSignupInvoice: null,          // { invoiceId, checkoutUrl, tierLabel }
+      tierSignupPollError: null,
       // Admin login gate (set via the StartOS "Set Admin Password" action).
       // When `enabled`, no API call works without a valid session cookie,
       // and the login screen takes priority over the activation screen.
@@ -1651,7 +2557,7 @@
       ...loadProviderSelection(),
     };
 
-    const MODELS = ["gemini-3.1-pro-preview", "gemini-3-pro-preview", "gemini-3-flash-preview"];
+    const MODELS = ["gemini-3.1-pro-preview", "gemini-2.5-pro", "gemini-3-flash-preview", "gemini-2.5-flash", "gemini-3.1-flash-lite"];
     // Auto-detect server origin so it works from other devices on the network
     const API_BASE = window.location.origin;
 
@@ -1672,6 +2578,8 @@
       state.videoTitle = "";
       state.url = "";
       state.chunks = [];
+      state.speakers = null;
+      state.speakerNames = null;
       state.error = null;
       state.expandedChunks = new Set();
       state.expandAll = false;
@@ -1681,6 +2589,9 @@
       state.status = "";
       state.videoMinimized = false;
       state.currentSessionId = null;
+      state.streaming = false;
+      state.streamWindowsDone = 0;
+      state.streamWindowsTotal = null;
       ytCurrentVideoId = null;
       render();
     }
@@ -1735,9 +2646,17 @@
     }
 
     function handleSubscribeClick() {
-      // Subscriptions / channel auto-queue is Pro-only.
+      // Subscriptions / channel auto-queue is Pro-only. Route non-Pro
+      // users into the upgrade flow instead of showing a passive
+      // toast that doesn't actually unblock them: anon visitors get
+      // the 3-tier signup modal (Pro is one of the cards), free
+      // signed-in users get the regular buy-license modal.
       if (!hasEntitlement("subscriptions")) {
-        showToast("Channel & podcast subscriptions are a Pro-tier feature.", "📡");
+        if (isMulti() && !state.account?.user) {
+          openTierSignupModal();
+        } else {
+          openBuyModal();
+        }
         return;
       }
       addSubscriptionFromInput();
@@ -1776,6 +2695,44 @@
       if (u.includes("feeds.megaphone") || u.includes("feeds.transistor") || u.includes("feeds.libsyn")) return true;
       if (u.includes("feeds.podcastmirror") || u.includes("feeds.acast") || u.includes("feeds.fireside")) return true;
       if (u.includes("rss.art19") || u.includes("podbean.com/feed")) return true;
+      // Apple Podcasts SHOW URL — no `?i=<id>` episode param. Format:
+      //   https://podcasts.apple.com/<country>/podcast/<slug>/id<num>
+      // The episode variant has `?i=<id>` appended. Use URL parsing
+      // instead of regex — the original regex's negative lookahead
+      // was positioned wrong and matched episode URLs too.
+      if (
+        /^https?:\/\/(?:www\.)?podcasts\.apple\.com\/[^/]+\/podcast\/[^/]+\/id\d+/i.test(
+          url.trim(),
+        )
+      ) {
+        try {
+          const parsed = new URL(url.trim());
+          // If there's no `i` query param, it's a SHOW page.
+          if (!parsed.searchParams.has("i")) return true;
+        } catch {
+          // Malformed URL, can't be a show — fall through to false.
+        }
+      }
+      // Spotify SHOW URL (open.spotify.com/show/<id>) — same idea:
+      // /show/ = the whole podcast, /episode/ = single episode.
+      if (/^https?:\/\/(?:open|play)\.spotify\.com\/show\//i.test(url.trim())) {
+        return true;
+      }
+      return false;
+    }
+
+    // Apple Podcasts + Spotify "share" URLs — server resolves them to
+    // direct audio enclosures before processing, but the UI needs to
+    // know not to extract a YouTube video ID and not to show the
+    // YouTube embed during processing.
+    function isShareEpisodeUrl(url) {
+      if (!url) return false;
+      const u = url.trim();
+      // Single-episode share URL: `?i=<id>` on Apple, `/episode/` on
+      // Spotify, `/episode/` on Fountain.
+      if (/^https?:\/\/(?:www\.)?podcasts\.apple\.com\/.*[?&]i=/i.test(u)) return true;
+      if (/^https?:\/\/(?:open|play)\.spotify\.com\/episode\//i.test(u)) return true;
+      if (/^https?:\/\/(?:www\.)?fountain\.fm\/episode\//i.test(u)) return true;
       return false;
     }
 
@@ -1784,6 +2741,36 @@
     }
 
     async function processUrl(url, opts = {}) {
+      // Pre-flight gate — refuse to start the optimistic flow when
+      // the visitor has 0 credits to spend, whether that's:
+      //   (a) anonymous + server-side cap reached / trials disabled
+      //   (state === "anonymous" && available_trial_credits === 0)
+      //   (b) trial cookie present but credits_remaining === 0
+      // Both cases lead to the same modal — sign up (fresh account
+      // with any unused credits transferred over) or buy credits a
+      // la carte. The reason field isn't surfaced to the user; we
+      // pass it through for analytics only.
+      const acct = state.account;
+      const isAnonExhausted =
+        acct && acct.state === "anonymous" &&
+        (acct.available_trial_credits || 0) === 0;
+      const isTrialExhausted =
+        acct && acct.state === "trial" &&
+        acct.trial &&
+        (acct.trial.credits_remaining || 0) === 0;
+      if (isAnonExhausted || isTrialExhausted) {
+        showTrialExhaustedModal({
+          reason: isTrialExhausted ? "no_credits" : (acct.trial_blocked_reason || "no_credits"),
+        });
+        return;
+      }
+      // Apple Podcasts / Spotify share URLs are resolved server-side to
+      // a direct audio enclosure URL. Mark them as podcast up-front so
+      // the UI suppresses the YouTube embed and doesn't try to derive
+      // a video ID.
+      if (!opts.type && isShareEpisodeUrl(url)) {
+        opts = { ...opts, type: "podcast" };
+      }
       // Extract video ID immediately so we can show the embed while processing
       const earlyVideoId = opts.type !== "podcast" ? extractVideoId(url) : null;
       if (earlyVideoId) {
@@ -1798,6 +2785,12 @@
       state.chunks = [];
       state.currentStep = 1;
       state.status = "Starting...";
+      // An explicit submit means the live stream owns the main view.
+      // Background/batch-queue items (opts.background) DON'T touch this —
+      // they inherit the user's current intent, so if they've stepped away
+      // to read a saved episode, the next queued item won't yank them back.
+      // Opening a saved episode flips this off (see loadSession).
+      if (!opts.background) state.followStream = true;
       // Pre-populate the in-flight banner client-side so the user
       // immediately sees what's running + the Cancel button. The server
       // ground-truth gets pulled in by the poll loop shortly after.
@@ -1855,6 +2848,16 @@
             state.currentJob = err.currentJob;
             render();
           }
+          // Trial-cap rejections — surface the same modal the pre-
+          // flight gate uses so the user gets a clear Sign up / Buy
+          // credits choice instead of a generic "Try again". Throw a
+          // tagged error so the catch block can clear the optimistic
+          // player + status before showing the modal.
+          if (err.error === "trial_unavailable" || err.error === "trial_exhausted") {
+            const e = new Error(err.message || err.error);
+            e.code = err.error;
+            throw e;
+          }
           // Prefer the server's human-readable `message` over the
           // short error code so users see "A summary is already being
           // processed (…)" rather than "processing_in_progress".
@@ -1891,14 +2894,92 @@
           }
         }
       } catch (err) {
-        state.error = err.message;
+        // Trial-cap server rejection (race past the pre-flight gate
+        // — e.g., another tab spent the last credit between whoami
+        // and submit). Clear the optimistic player + status, refresh
+        // account state so the toolbar pill updates to "Trial used
+        // up", and show the same modal the pre-flight gate uses.
+        if (err && (err.code === "trial_unavailable" || err.code === "trial_exhausted")) {
+          state.videoId = null;
+          state.videoTitle = "";
+          state.currentJob = null;
+          state.currentStep = 0;
+          state.status = "";
+          state.error = null;
+          // Refresh whoami so the toolbar pill flips to the cap-hit
+          // state (or "0 credits remaining" for the exhausted case)
+          // immediately, before we render() and show the modal.
+          try { await loadAccount(); } catch {}
+          render();
+          showTrialExhaustedModal({
+            reason: err.code === "trial_unavailable" ? "ip_cap_reached" : "no_credits",
+          });
+          state.loading = false;
+          state.streaming = false;
+          return;
+        }
+        // Distinguish "the stream dropped while the server was still
+        // working" from "the server rejected the request." iOS Safari
+        // is aggressive about killing fetches when you background the
+        // tab or your cellular signal blips — the EventSource dies
+        // with a generic "Load failed" / "network connection lost"
+        // error, but the server keeps processing in the background.
+        // Without this check the user sees a red error banner even
+        // though their summary will land in their library in 60s.
+        //
+        // Connection-drop signals we recognize across iOS / Android /
+        // desktop browsers — match-by-substring rather than exact
+        // because each browser uses a slightly different message.
+        const dropSignals = [
+          "Load failed",
+          "network connection was lost",
+          "Failed to fetch",
+          "NetworkError",
+          "ERR_INTERNET_DISCONNECTED",
+          "The Internet connection appears to be offline",
+        ];
+        const raw = err?.message || String(err);
+        const isDrop = dropSignals.some((s) =>
+          raw.toLowerCase().includes(s.toLowerCase()),
+        );
+        if (isDrop) {
+          // Confirm there's still a job running on the server before
+          // we show the friendly message. If the server has nothing
+          // in flight either, the error is real (probably a network
+          // failure before the request reached the server).
+          try {
+            await loadCurrentJob();
+            if (state.currentJob) {
+              state.error = null;
+              // Re-attach: the current-job poller will pick up the
+              // result when it lands and refresh history. We start the
+              // poll here in case it isn't already running.
+              startCurrentJobPoll();
+            } else {
+              state.error = "Connection dropped. Try again.";
+            }
+          } catch {
+            state.error = "Connection dropped. Try again.";
+          }
+        } else {
+          state.error = raw;
+        }
       } finally {
         state.loading = false;
         state.currentStep = 0;
+        // Streaming flag must be cleared even on abort/error so the
+        // "still analyzing…" indicator disappears with the spinner.
+        state.streaming = false;
         // The server-tracked current-job slot is released by the server
         // in its own finally; refresh our snapshot so the banner
         // disappears immediately rather than waiting for the poll.
-        loadCurrentJob().finally(() => render());
+        loadCurrentJob().finally(() => {
+          // Following the live job → normal re-render. Reading a saved
+          // episode → don't rebuild the view (preserves scroll); just
+          // surgically drop the now-finished in-flight banner.
+          if (state.followStream) render();
+          else document.getElementById("inflight-banner")?.remove();
+        });
         // Process next item in queue
         processQueue();
       }
@@ -1909,19 +2990,20 @@
       const next = state.queue.find(q => q.status === "queued");
       if (!next) return;
       next.status = "processing";
-      render();
+      if (state.followStream) render();
       await processUrl(next.url, {
         type: next.type || "youtube",
         title: next.title || "",
         uploadDate: next.uploadDate || "",
         episodeId: next.videoId || "",
+        background: true, // batch continuation — don't seize the view
       });
       // Mark as done (or error) after processUrl finishes
       next.status = state.error ? "error" : "done";
       next.error = state.error || null;
       // Remove completed items from queue
       state.queue = state.queue.filter(q => q.status === "queued");
-      render();
+      if (state.followStream) render();
     }
 
     function removeFromQueue(id) {
@@ -1988,14 +3070,101 @@
       } else if (event === "log") {
         pushLog({ elapsed: data.elapsed, message: data.message, detail: data.detail });
         renderLog();
+      } else if (event === "transcript_ready") {
+        // Server has finished STT and is about to start analyze (in
+        // pipelined mode this may arrive AFTER some sections_partial
+        // events — see relay v0.2.89+). Switch the UI from the
+        // loading screen to a results view; preserve any chunks
+        // already populated by sections_partial so we don't lose
+        // pipelined partial sections to a chunks=[] reset. Fresh
+        // submissions reset state.chunks separately via
+        // resetAndStartFresh, so we don't need to wipe here.
+        // Only seize the view if the user is following this live stream.
+        // If they've navigated to a saved episode, let it keep processing
+        // in the background without yanking the page over.
+        if (state.followStream) {
+          const videoChanged = state.videoId !== data.videoId;
+          state.videoId = data.videoId;
+          state.videoTitle = data.videoTitle || "";
+          state.currentType = data.type || "youtube";
+          // Only wipe chunks if this is a new video (resetAndStartFresh
+          // missed it, e.g. retry of a different URL). For same-video
+          // pipelined flow, keep the partials we've accumulated.
+          if (videoChanged) state.chunks = [];
+          state.streaming = true;
+          if (!state.streamWindowsDone) state.streamWindowsDone = 0;
+          state.streamWindowsTotal = data.willChunk ? (state.streamWindowsTotal || null) : 1;
+          state.videoMinimized = false;
+          state.expandedChunks = new Set();
+          state.expandAll = false;
+          if (videoChanged) ytCurrentVideoId = null;
+          render();
+        }
+      } else if (event === "sections_partial") {
+        // Merge an analyze window's body-owned sections into the
+        // running chunks list at their correct time positions. The
+        // server only sends sections that the stitcher will keep,
+        // so we never have to revise these once rendered.
+        // Skip when the user has navigated to a saved episode — mixing this
+        // stream's sections into their current view (or re-rendering it)
+        // would clobber what they're reading. The window still lands in the
+        // library when the job completes.
+        if (state.followStream) {
+          const incoming = data.chunks || [];
+          if (incoming.length > 0) {
+            state.chunks = [...state.chunks, ...incoming].sort(
+              (a, b) => (a.startTime || 0) - (b.startTime || 0)
+            );
+          }
+          state.streamWindowsDone = (state.streamWindowsDone || 0) + 1;
+          state.streamWindowsTotal = data.totalWindows || state.streamWindowsTotal;
+          // Surgical update: just regenerate the chunks-scroll innerHTML
+          // and the streaming indicator's window-count text. Do NOT call
+          // render() — a full re-render destroys the YouTube iframe div,
+          // forcing the YT IFrame API to reload, which produces a
+          // visible flicker every time a window completes. With this
+          // pathway the iframe (and any in-progress video playback)
+          // survives across per-window section deliveries.
+          applyStreamingChunksUpdate();
+        }
       } else if (event === "result") {
+        state.streaming = false;
+        if (!state.followStream) {
+          // User is reading a saved episode — don't yank the view to the
+          // finished job. Refresh the library + balance silently (no
+          // render, so their scroll position is preserved) and just tell
+          // them it's ready.
+          loadHistory().catch(() => {});
+          loadRelayStatus().catch(() => {});
+          showToast(
+            `"${(data.videoTitle || "Your recap").slice(0, 40)}" is ready in your library`,
+            "✓",
+            5000,
+          );
+          return;
+        }
         const videoChanged = state.videoId !== data.videoId;
         state.videoId = data.videoId;
         state.videoTitle = data.videoTitle || "";
         state.chunks = data.chunks || [];
+        // Phase 1E — speaker legend from the relay's diarization
+        // pipeline. Map keyed by global speaker ID (Speaker_A, ...)
+        // with stats per speaker. Null when the operator's relay
+        // didn't run diarization (off, missing, or version <0.2.88).
+        // Each entry inside chunks already carries `.speaker` and
+        // `.speaker_confidence` if diarization ran — set server-side
+        // by the time-matching pass in server/index.js's relay-mode
+        // branch.
+        state.speakers = data.speakers || null;
+        // Phase 2 — inferred speaker names from the relay's post-
+        // cluster polish pass. { Speaker_A: "Matt Hill" | null, ... }.
+        // Legend renderer prefers the inferred name when present;
+        // chips keep their letter (color identity stable).
+        state.speakerNames = data.speaker_names || null;
         state.currentType = data.type || "youtube";
         state.currentSessionId = data.historyId || null;
         state.videoMinimized = false;
+        state.streaming = false;
         if (videoChanged) ytCurrentVideoId = null;
         render();
         // Refresh history list and re-render when loaded
@@ -2006,9 +3175,15 @@
         // to reflect the new count.
         loadRelayStatus().then(() => render()).catch(() => {});
       } else if (event === "error") {
-        state.error = data.message;
+        state.streaming = false;
         pushLog({ elapsed: "---", message: "ERROR: " + data.message, error: true });
-        render();
+        if (state.followStream) {
+          state.error = data.message;
+          render();
+        } else {
+          // Don't paint a failed-job error over the episode they're reading.
+          showToast(`Recap failed: ${(data.message || "error").slice(0, 60)}`, "!", 5000);
+        }
       } else if (event === "cancelled") {
         // Server confirmed the cancellation went through. The fetch
         // reader's finally clause clears state.loading and the banner
@@ -2028,7 +3203,7 @@
       return `
         <div class="activation-screen">
           <div class="activation-card">
-            <h1>Recap</h1>
+            <h1>Recaps</h1>
             <p class="activation-sub">Sign in to continue.</p>
             <label class="activation-label">Username</label>
             <input class="activation-key" type="text" autocomplete="username"
@@ -2147,7 +3322,7 @@
       return `
         <div class="activation-screen">
           <div class="activation-card">
-            <h1>Recap</h1>
+            <h1>Recaps</h1>
             <p class="activation-sub">
               ${loading
                 ? "Checking license…"
@@ -2162,7 +3337,7 @@
                       typeof credits === "number" && credits > 0
                         ? `${credits} relay credit${credits === 1 ? "" : "s"}`
                         : "free relay credits";
-                    return `Activate a Recap license to unlock channel &amp; podcast subscriptions and auto-queue. Or skip to use free mode — ${creditsText} to process recaps of videos and podcasts on us, plus unlimited recaps when you bring your own AI provider keys or self-hosted model URL.`;
+                    return `Activate a Recaps license to unlock channel &amp; podcast subscriptions and auto-queue. Or skip to use free mode — ${creditsText} to process recaps of videos and podcasts on us, plus unlimited recaps when you bring your own AI provider keys or self-hosted model URL.`;
                   })()
               }
             </p>
@@ -2178,7 +3353,9 @@
                   onclick="activateLicense()">
                   ${state.licenseActivating ? "Activating…" : "Activate"}
                 </button>
-                <a class="activation-link" href="${escHtml(buyUrl)}" target="_blank" rel="noopener">Buy a key &rarr;</a>
+                <button class="activation-link"
+                  style="background:none;border:none;color:#a5b4fc;cursor:pointer;padding:0;font-size:13px;text-decoration:underline;"
+                  onclick="dismissActivation(); openBuyModal();">Buy a key &rarr;</button>
                 <button class="activation-link"
                   style="background:none;border:none;color:#94a3b8;cursor:pointer;padding:0;font-size:13px;"
                   onclick="dismissActivation()">
@@ -2197,7 +3374,6 @@
 
     function dismissActivation() {
       state.activationSkipped = true;
-      try { localStorage.setItem("recap-activation-skipped", "1"); } catch {}
       render();
     }
 
@@ -2217,11 +3393,15 @@
     function renderCurrentJobBanner() {
       if (!state.currentJob) return "";
       const job = state.currentJob;
-      const what = job.title || job.url || "a video";
+      const rawWhat = job.title || job.url || "a video";
+      // Long YouTube URLs with tracking params (?si=…) blow past the
+      // viewport on phones and push the Cancel button off-screen. Cap
+      // the display string; the full URL/title is still in state.
+      const what = rawWhat.length > 48 ? rawWhat.slice(0, 45) + "…" : rawWhat;
       const elapsedStr = formatInflightElapsed(job);
       const aborted = job.aborted || state.cancellingJob;
       return `
-        <div style="
+        <div id="inflight-banner" style="
           margin: 8px 0 12px;
           padding: 10px 14px;
           background: linear-gradient(90deg, rgba(59,130,246,0.12), rgba(99,102,241,0.10));
@@ -2234,14 +3414,14 @@
           color: #e2e8f0;
           font-size: 13px;
         ">
-          <span style="flex:1; min-width: 220px;">
+          <span style="flex:1; min-width: 0; overflow: hidden; text-overflow: ellipsis;">
             <strong style="color:#93c5fd;">${aborted ? "Cancelling…" : "Processing"}</strong>
-            &middot; ${escHtml(what)}
-            <span style="color:#94a3b8;">&middot; <span class="inflight-elapsed">${elapsedStr}</span> elapsed</span>
+            <span style="color:#cbd5e1;"> &middot; ${escHtml(what)}</span>
+            <span style="color:#94a3b8;"> &middot; <span class="inflight-elapsed">${elapsedStr}</span></span>
           </span>
           <button onclick="cancelCurrentJob()"
             ${aborted ? "disabled" : ""}
-            style="background:${aborted ? "#1e293b" : "#dc2626"};color:#fff;border:none;padding:6px 12px;border-radius:6px;cursor:${aborted ? "default" : "pointer"};font-size:12px;font-weight:600;${aborted ? "opacity:0.6;" : ""}">
+            style="flex-shrink:0;background:${aborted ? "#1e293b" : "#dc2626"};color:#fff;border:none;padding:6px 12px;border-radius:6px;cursor:${aborted ? "default" : "pointer"};font-size:12px;font-weight:600;${aborted ? "opacity:0.6;" : ""}">
             ${aborted ? "Cancelling" : "Cancel"}
           </button>
         </div>
@@ -2308,9 +3488,16 @@
     // whatever it cached from the most recent /relay/* call). UI polls
     // this on boot and after each successful summarize so the balance
     // banner stays in sync without an extra relay hit.
-    async function loadRelayStatus() {
+    // forceRefresh: when true, passes ?refresh=1 so the Recap server
+    // bypasses its 10-second relayState cache and pings the operator's
+    // relay /relay/balance right now. Use after a state-changing
+    // action (license activation, credit purchase) where the user
+    // expects to see updated tier + credits immediately rather than
+    // waiting for the next 60-second poll tick.
+    async function loadRelayStatus(forceRefresh = false) {
       try {
-        const res = await fetch(`${API_BASE}/api/relay/status`, { credentials: "same-origin" });
+        const url = `${API_BASE}/api/relay/status` + (forceRefresh ? "?refresh=1" : "");
+        const res = await fetch(url, { credentials: "same-origin" });
         if (!res.ok) return;
         const data = await res.json();
         state.relayStatus = {
@@ -2457,6 +3644,42 @@
     // Stops itself when the job disappears.
     let __currentJobPollTimer = null;
     let __inflightTickTimer = null;
+
+    // Background relay-status refresh. Catches out-of-band balance
+    // changes that don't go through any Recap-initiated flow —
+    // operator-side webhook delivery, rescans from the relay
+    // dashboard, manual ledger edits. 60s interval is short enough
+    // for the pill to reflect a Lightning purchase within a minute
+    // of payment landing, low enough to be free at scale.
+    // Pauses while the document is hidden (battery + bandwidth on
+    // mobile) and snaps once on visibility restore so coming back
+    // to a backgrounded tab shows fresh state.
+    let __relayStatusPollTimer = null;
+    function startRelayStatusPoll() {
+      if (__relayStatusPollTimer) return;
+      // Only re-render when a USER-VISIBLE field of the relay status
+      // changes (credits, tier, configured-flag, lastError). Compare
+      // a filtered fingerprint, NOT the whole status object — the
+      // server stamps lastUpdated on every response, so the naive
+      // "compare full object" check would always detect a diff and
+      // re-render on every poll, defeating the whole point.
+      const visibleFingerprint = (s) => {
+        if (!s) return "";
+        return [s.creditsRemaining, s.tier, s.configured, s.lastError].join("|");
+      };
+      const pollAndMaybeRender = async () => {
+        const prev = visibleFingerprint(state.relayStatus);
+        await loadRelayStatus().catch(() => {});
+        if (visibleFingerprint(state.relayStatus) !== prev) render();
+      };
+      __relayStatusPollTimer = setInterval(() => {
+        if (document.hidden) return;
+        pollAndMaybeRender();
+      }, 60_000);
+      document.addEventListener("visibilitychange", () => {
+        if (!document.hidden) pollAndMaybeRender();
+      });
+    }
     function startCurrentJobPoll() {
       if (!__currentJobPollTimer) {
         __currentJobPollTimer = setInterval(async () => {
@@ -2473,7 +3696,11 @@
           // intact between polls.
           const transitioned = prevHas !== has || prevAborted !== aborted;
           if (transitioned) {
-            render();
+            // Following the live job → re-render normally. Reading a saved
+            // episode → don't rebuild the view (preserve scroll); just drop
+            // the banner surgically when the job finishes.
+            if (state.followStream) render();
+            else if (!has) document.getElementById("inflight-banner")?.remove();
           } else if (has) {
             updateInflightElapsedDOM();
           }
@@ -2589,24 +3816,84 @@
       const rs = state.relayStatus || {};
       const credits = rs.creditsRemaining;
       const byo = hasAnyBYOConfigured();
-      const showUpgrade = !isProTier();
+      // "Upgrade to Pro" is a per-USER subscription — it only makes
+      // sense for someone who can OWN a Pro license. In multi-mode an
+      // anonymous visitor (no account yet) has no users.keysat_license
+      // row to attach a purchased license to, AND the /api/license/policies
+      // endpoint sits behind tenant-auth so the buy modal would just
+      // fail with auth_required (which is what Grant saw — broken UX).
+      // Hide the button until they sign in.
+      const showUpgrade = !isProTier() && !(isMulti() && !state.account?.user);
       const showIHaveKey = free;
       const buyUrl = upgradeToProUrl();
 
+      // Tier badge: explicit visual confirmation that the user has
+      // an active paid license. Prefers Max → Pro → none. Reads from
+      // entitlements (set on /api/license/activate response) rather
+      // than the relay's tier field — the license is authoritative
+      // and the relay's cache may briefly lag during refresh.
+      let tierBadge = "";
+      if (hasEntitlement("max")) {
+        tierBadge = `<span class="tier-badge tier-max" title="Active Max license">MAX</span>`;
+      } else if (hasEntitlement("pro")) {
+        tierBadge = `<span class="tier-badge tier-pro" title="Active Pro license">PRO</span>`;
+      }
+
       // Pick the pill. Relay-credit count beats BYO badge when relay
       // is configured — that's the actionable number the user cares
       // about. Falls back to BYO badge when relay isn't configured
       // (or returned an error) but the user has their own keys.
+      //
+      // Special case: anonymous visitors. /api/relay/status returns
+      // creditsRemaining: null with scope:"anonymous" before they've
+      // minted a trial cookie. But state.account.available_trial_credits
+      // (from /api/account/whoami) DOES tell us what they'll get when
+      // they hit Summarize. Show that as a forward-looking "N free
+      // credits ready" pill + the Buy more CTA, so the user can see
+      // what's available AND has a path to buy more before spending
+      // their trial.
       let pillHtml = "";
+      const anonAvailable =
+        isMulti() && !state.account?.user
+          ? state.account?.available_trial_credits || 0
+          : 0;
       if (rs.configured && credits != null) {
         if (credits < 0) {
-          pillHtml = `<span class="status-pill" style="color:#86efac;background:rgba(134,239,172,0.10);border-color:rgba(134,239,172,0.25);">Unlimited relay</span>`;
+          pillHtml = `<span class="status-pill have-key-btn" style="cursor:default;">Unlimited Recap credits</span>`;
         } else {
-          const color = credits === 0 ? "#fca5a5" : (credits <= 3 ? "#fbbf24" : "#a5b4fc");
-          const bg = credits === 0 ? "rgba(252,165,165,0.10)" : (credits <= 3 ? "rgba(251,191,36,0.10)" : "rgba(99,102,241,0.10)");
-          const border = credits === 0 ? "rgba(252,165,165,0.30)" : (credits <= 3 ? "rgba(251,191,36,0.30)" : "rgba(99,102,241,0.30)");
-          pillHtml = `<span class="status-pill" title="Relay credits remaining for this install" style="color:${color};background:${bg};border-color:${border};">${credits} relay credit${credits === 1 ? "" : "s"}</span>`;
+          // Both pills mirror the .have-key-btn neutral style —
+          // muted grey on transparent — so the purple "Upgrade"
+          // remains the only highlighted CTA in the top bar. Whole
+          // pills are clickable; "+ Buy more" labels the action so
+          // users know the count is interactive.
+          //
+          // As of v0.2.90, anon trial visitors can also buy credits
+          // (they're applied to their trial cookie, transfer to the
+          // user account on signup). The "+ Buy more" button is now
+          // shown to anon, signed-in, and operator users alike.
+          pillHtml =
+            `<span class="have-key-btn" style="cursor:default;">${credits} Recap credit${credits === 1 ? "" : "s"}</span>` +
+            `<button onclick="openBuyCreditsModal()" class="have-key-btn" title="Buy more Recap credits via Lightning">+ Buy more</button>`;
         }
+      } else if (anonAvailable > 0) {
+        // Anonymous visitor (no trial cookie yet) — surface the
+        // available trial credits + a Buy more CTA so they don't have
+        // to summarize anything before they see the pricing path.
+        pillHtml =
+          `<span class="have-key-btn" style="cursor:default;color:#a5b4fc;">${anonAvailable} free credit${anonAvailable === 1 ? "" : "s"} ready</span>` +
+          `<button onclick="openBuyCreditsModal()" class="have-key-btn" title="Buy more Recap credits — they'll attach to your trial and transfer to your account when you sign up">+ Buy more</button>`;
+      } else if (isMulti() && !state.account?.user && state.account?.trial_blocked_reason === "ip_cap_reached") {
+        // Anonymous visitor whose server-side IP cap is reached.
+        // Show a generic "Out of free credits" pill rather than
+        // anything network-flavored — the underlying mechanism is
+        // IP-bound but the user-facing message should never hint at
+        // that. Visitor sees the same copy whether they ran out of
+        // cookie credits or were refused a fresh cookie mint. Both
+        // pill buttons open paths that ACTUALLY work (sign up for
+        // a fresh account; buy credits a la carte without signup).
+        pillHtml =
+          `<button onclick="showTrialExhaustedModal({})" class="have-key-btn" title="Out of free credits — sign up or buy credits" style="color:#fcd34d;">Out of free credits</button>` +
+          `<button onclick="openBuyCreditsModal()" class="have-key-btn" title="Buy Recap credits a la carte">+ Buy credits</button>`;
       } else if (byo) {
         pillHtml = `<span class="status-pill" title="At least one AI provider key is configured" style="color:#86efac;background:rgba(134,239,172,0.10);border-color:rgba(134,239,172,0.25);">BYO AI keys configured</span>`;
       } else if (rs.configured && rs.lastError) {
@@ -2615,12 +3902,62 @@
         pillHtml = `<span class="status-pill" title="${escHtml(rs.lastError)}" style="color:#fca5a5;background:rgba(252,165,165,0.10);border-color:rgba(252,165,165,0.30);">Relay unreachable</span>`;
       }
 
-      if (!pillHtml && !showUpgrade && !showIHaveKey) return "";
+      // ── Multi-tenant signin widget ──────────────────────────────────
+      // In multi mode, append a Sign in / Sign out chip so the user
+      // always knows which account they're on (and how to switch).
+      // The "I have a key" button is hidden in multi mode — non-admin
+      // tenants don't activate their own keys via paste; their keys
+      // attach automatically through the purchase poll-settle handler.
+      let signinHtml = "";
+      let hideIHaveKey = false;
+      if (isMulti()) {
+        hideIHaveKey = !isAdmin();
+        const acct = state.account || {};
+        if (acct.user && acct.user.email) {
+          // Signed in: short email chip + sign-out icon. Truncate at
+          // 24 chars so a long email doesn't push the toolbar around.
+          const shortEmail =
+            acct.user.email.length > 24
+              ? acct.user.email.slice(0, 22) + "…"
+              : acct.user.email;
+          signinHtml = `
+            <span class="have-key-btn" title="Signed in as ${escHtml(acct.user.email)}"
+                  style="cursor:default;display:inline-flex;align-items:center;gap:6px;">
+              ${escHtml(shortEmail)}
+            </span>
+            <a href="/auth/signout" class="have-key-btn"
+               title="Sign out"
+               style="text-decoration:none;display:inline-block;">
+              Sign out
+            </a>`;
+        } else {
+          // Anonymous or active trial: show TWO buttons — primary
+          // "Sign up" (purple CTA, brings the new visitor to the
+          // create-account flow) and secondary "Sign in" (muted, for
+          // returning users). Both go to /auth.html which handles
+          // both flows from the same magic-link form; we pass
+          // ?intent=signup or ?intent=signin so the auth page can
+          // tailor the H1 copy ("Create your account" vs "Sign in
+          // to Recap"). The user can switch between intents on the
+          // page if they pick the wrong one.
+          signinHtml = `
+            <button onclick="openTierSignupModal()" class="upgrade-btn"
+              title="Create a Recaps account"
+              style="display:inline-block;">Sign up</button>
+            <a href="/auth.html?intent=signin" class="have-key-btn"
+              title="Sign in to your existing account"
+              style="text-decoration:none;display:inline-block;">Sign in</a>`;
+        }
+      }
+
+      if (!pillHtml && !showUpgrade && !showIHaveKey && !tierBadge && !signinHtml) return "";
       return `
         <div class="top-bar-status">
+          ${tierBadge}
           ${pillHtml}
-          ${showUpgrade ? `<a href="${escHtml(buyUrl)}" target="_blank" rel="noopener" class="upgrade-btn">Upgrade</a>` : ""}
-          ${showIHaveKey ? `<button onclick="showActivationScreen()" class="have-key-btn">I have a key</button>` : ""}
+          ${showUpgrade ? `<button onclick="openBuyModal()" class="upgrade-btn">Upgrade</button>` : ""}
+          ${showIHaveKey && !hideIHaveKey ? `<button onclick="showActivationScreen()" class="have-key-btn">I have a key</button>` : ""}
+          ${signinHtml}
         </div>
       `;
     }
@@ -2661,10 +3998,10 @@
             <strong style="color:#c4b5fd;">${label}</strong>
             &middot; ${descr}
           </span>
-          <a href="${escHtml(buyUrl)}" target="_blank" rel="noopener"
-             style="background:#a855f7;color:#fff;border:none;padding:6px 12px;border-radius:6px;text-decoration:none;font-size:12px;font-weight:600;">
+          <button onclick="openBuyModal()"
+             style="background:#a855f7;color:#fff;border:none;padding:6px 12px;border-radius:6px;text-decoration:none;font-size:12px;font-weight:600;cursor:pointer;">
             Upgrade
-          </a>
+          </button>
           ${free ? `
             <button onclick="showActivationScreen()"
                style="background:transparent;color:#94a3b8;border:1px solid #334155;padding:6px 10px;border-radius:6px;cursor:pointer;font-size:12px;">
@@ -2676,12 +4013,2331 @@
     }
 
     function showActivationScreen() {
-      // Take user back to the activation modal (e.g. from an upgrade banner).
+      // Take the user to the activation modal — triggered by the
+      // "I have a key" toolbar button. Activation is no longer
+      // auto-shown on boot; this is the only path that surfaces it.
       state.activationSkipped = false;
-      try { localStorage.removeItem("recap-activation-skipped"); } catch {}
       render();
     }
 
+    // ── In-app buy modal ────────────────────────────────────────────────────
+    // Replaces the previous "click Upgrade → window.location to
+    // keysat.xyz/buy/recap" flow. Modal fetches tiers from the
+    // /api/license/policies proxy on every open (so operator edits
+    // in Keysat admin show up without a Recap redeploy), renders
+    // them in Recap's own visual style, and drives checkout via
+    // /api/license/purchase. Once the BTCPay invoice settles, the
+    // server activates the issued license inline and we just refresh
+    // license-status to pick up the new entitlements.
+
+    function formatSats(n) {
+      if (typeof n !== "number" || !Number.isFinite(n)) return String(n);
+      return n.toLocaleString("en-US");
+    }
+
+    function cadenceSuffix(days) {
+      if (days === 7) return " / wk";
+      if (days === 30) return " / mo";
+      if (days === 90) return " / qtr";
+      if (days === 180) return " / 6mo";
+      if (days === 365) return " / yr";
+      if (typeof days === "number" && days > 0) return " / " + days + "d";
+      return "";
+    }
+
+    async function openBuyModal(preselectSlug = null) {
+      // Core-decoupling: cloud (multi-mode) users buy a RELAY-OWNED
+      // Pro/Max subscription, not a Keysat license. Route every upgrade
+      // entry point (toolbar, mobile menu, settings, banners) to the
+      // self-serve subscription modal. The Keysat license flow below is
+      // single-mode only — the operator buying a license for their own
+      // home server. (preselectSlug 'pro'/'max' maps straight to a tier.)
+      if (isMulti()) {
+        return openSubscribeModal(preselectSlug);
+      }
+      state.buyOpen = true;
+      state.buyLoading = true;
+      state.buyError = null;
+      state.buyPolicies = null;
+      state.buyView = "tiers";
+      state.buyDraft = null;
+      state.buyDiscount = null;
+      state.buyInvoice = null;
+      state.buyPolling = false;
+      state.buyPollError = null;
+      render();
+      await loadBuyPolicies();
+      // If the caller knows which tier the buyer is interested in
+      // (e.g., "Upgrade to Pro" entry in the mobile menu vs. the
+      // generic "Upgrade" button), skip the tier-picker step and
+      // jump straight to the discount-entry view for that policy.
+      // The tier cards stay reachable via the modal's "Back to
+      // tiers" affordance if they change their mind.
+      if (preselectSlug) {
+        const policy = (state.buyPolicies?.policies || []).find(
+          (p) => p.slug === preselectSlug,
+        );
+        if (policy) buyEnterDiscountStep(policy.slug);
+      }
+    }
+
+    function closeBuyModal() {
+      // Stop any in-flight polling and reset modal state.
+      if (__buyPollTimer) {
+        clearTimeout(__buyPollTimer);
+        __buyPollTimer = null;
+      }
+      state.buyOpen = false;
+      state.buyLoading = false;
+      state.buyError = null;
+      state.buyView = "tiers";
+      state.buyDraft = null;
+      state.buyDiscount = null;
+      state.buyInvoice = null;
+      state.buyPolling = false;
+      state.buyPollError = null;
+      // Keep state.buyPolicies cached in-memory in case the user
+      // re-opens the modal — saves a fetch round-trip. It'll be
+      // refreshed next open.
+      render();
+    }
+
+    // Click handler for a tier card's "Select" button. Captures the
+    // tier the buyer picked and transitions the modal into the
+    // discount-entry view. No invoice is created yet — that happens
+    // when they click Apply (with a code) or Continue (without).
+    function buyEnterDiscountStep(policySlug) {
+      const policy = (state.buyPolicies?.policies || []).find(
+        (p) => p.slug === policySlug
+      );
+      if (!policy) return;
+      state.buyView = "discount";
+      state.buyDraft = {
+        slug: policy.slug,
+        name: policy.name || policy.slug,
+        basePriceSats: policy.price_sats || 0,
+        isRecurring: !!policy.is_recurring,
+        renewalPeriodDays: policy.renewal_period_days || 0,
+        featuredDiscountCode: policy.featured_discount?.code || null,
+      };
+      state.buyDiscount = {
+        // Pre-fill with the featured-discount code (launch special)
+        // if one is active — the buyer can leave it or swap it.
+        code: policy.featured_discount?.code || "",
+        applying: false,
+        error: null,
+        finalSats: null,
+        discountAppliedSats: null,
+      };
+      state.buyError = null;
+      render();
+    }
+
+    function buyBackToTiers() {
+      state.buyView = "tiers";
+      state.buyDraft = null;
+      state.buyDiscount = null;
+      render();
+    }
+
+    // Helper: kick off a purchase with the chosen tier + optional
+    // code. Shared between "Apply discount" (which we want to PREVIEW
+    // before opening checkout) and "Continue without code" (which we
+    // commit to immediately). Returns the parsed envelope or throws.
+    async function buyCreateInvoice(policySlug, code) {
+      // Auto-fill buyerEmail from the signed-in cloud user. This is
+      // forwarded to Keysat as `buyer_email` on /v1/purchase so the
+      // issued license carries the buyer's email — which Keysat's
+      // admin UI surfaces for support + manual lookups. Single-mode
+      // operators don't have a user so this stays undefined and the
+      // purchase falls back to whatever Keysat's default is (email
+      // optional in single-mode by policy).
+      const buyerEmail = isMulti() && state.account?.user?.email
+        ? state.account.user.email
+        : undefined;
+      const res = await fetch(`${API_BASE}/api/license/purchase`, {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          policySlug,
+          code: code || undefined,
+          buyerEmail,
+        }),
+      });
+      const data = await res.json().catch(() => ({}));
+      if (!res.ok || !data.checkout_url) {
+        const err = new Error(
+          data.message || data.error || `HTTP ${res.status}`
+        );
+        err.status = res.status;
+        throw err;
+      }
+      return data;
+    }
+
+    // "Apply" button inside the discount view. Creates an invoice
+    // against Keysat with the entered code and shows the discount
+    // preview — does NOT open the checkout. Buyer can then click
+    // "Continue to checkout" or revise the code and click Apply
+    // again (the previous invoice expires on its own).
+    async function buyApplyDiscount() {
+      const draft = state.buyDraft;
+      const disc = state.buyDiscount;
+      if (!draft || !disc) return;
+      const code = (disc.code || "").trim();
+      if (!code) {
+        state.buyDiscount.error =
+          "Enter a code first, or click Continue to skip.";
+        render();
+        return;
+      }
+      state.buyDiscount.applying = true;
+      state.buyDiscount.error = null;
+      render();
+      try {
+        const data = await buyCreateInvoice(draft.slug, code);
+        // Keysat /v1/purchase returns the FINAL (post-discount) price
+        // as `amount_sats` (not `final_price_sats` — the
+        // developer-facing spec docs were wrong about that field
+        // name). `base_price_sats` is the pre-discount sticker price
+        // and `discount_applied_sats` is the absolute savings.
+        const finalSats = data.amount_sats ?? null;
+        const discountSats = data.discount_applied_sats ?? 0;
+        state.buyDiscount.applying = false;
+        state.buyDiscount.finalSats = finalSats;
+        state.buyDiscount.discountAppliedSats = discountSats;
+        // Stash the invoice so "Continue to checkout" can use it
+        // without creating a second one.
+        state.buyInvoice = {
+          invoiceId: data.invoice_id,
+          checkoutUrl: data.checkout_url,
+          amountSats: finalSats ?? draft.basePriceSats,
+          policySlug: draft.slug,
+          policyName: draft.name,
+          discountAppliedSats: discountSats,
+          basePriceSats: data.base_price_sats ?? draft.basePriceSats,
+        };
+        render();
+      } catch (err) {
+        state.buyDiscount.applying = false;
+        state.buyDiscount.error =
+          (err?.message || String(err)).slice(0, 200);
+        // If the code was rejected, discard any preview state so the
+        // UI doesn't show stale numbers.
+        state.buyDiscount.finalSats = null;
+        state.buyDiscount.discountAppliedSats = null;
+        state.buyInvoice = null;
+        render();
+      }
+    }
+
+    // "Continue without code" button — creates the invoice with no
+    // code applied, opens checkout, and starts polling. Same as the
+    // pre-discount-step flow.
+    async function buyContinueWithoutCode() {
+      const draft = state.buyDraft;
+      if (!draft) return;
+      let checkoutWin = null;
+      try { checkoutWin = window.open("about:blank", "_blank"); } catch {}
+      state.buyPolling = true;
+      state.buyPollError = null;
+      render();
+      try {
+        const data = await buyCreateInvoice(draft.slug, null);
+        state.buyInvoice = {
+          invoiceId: data.invoice_id,
+          checkoutUrl: data.checkout_url,
+          amountSats: data.amount_sats ?? draft.basePriceSats,
+          policySlug: draft.slug,
+          policyName: draft.name,
+          discountAppliedSats: 0,
+          basePriceSats: data.base_price_sats ?? draft.basePriceSats,
+        };
+        state.buyView = "polling";
+        if (checkoutWin && !checkoutWin.closed) {
+          checkoutWin.location.href = data.checkout_url;
+        } else {
+          window.location.href = data.checkout_url;
+          return;
+        }
+        startBuyPolling(data.invoice_id);
+      } catch (err) {
+        if (checkoutWin) { try { checkoutWin.close(); } catch {} }
+        state.buyPollError =
+          (err?.message || String(err)).slice(0, 200);
+        state.buyPolling = false;
+        render();
+      }
+    }
+
+    // After Apply has shown the discount preview, this commits: opens
+    // the (already-created) BTCPay checkout in a new tab and starts
+    // polling for the issued license. No new invoice gets created —
+    // we reuse state.buyInvoice's checkoutUrl + invoiceId.
+    function buyContinueToCheckout() {
+      const inv = state.buyInvoice;
+      if (!inv?.checkoutUrl) return;
+      let checkoutWin = null;
+      try { checkoutWin = window.open(inv.checkoutUrl, "_blank"); } catch {}
+      if (!checkoutWin || checkoutWin.closed) {
+        // Popup blocked — fall back to same-tab redirect.
+        window.location.href = inv.checkoutUrl;
+        return;
+      }
+      state.buyView = "polling";
+      state.buyPolling = true;
+      state.buyPollError = null;
+      render();
+      startBuyPolling(inv.invoiceId);
+    }
+
+    async function loadBuyPolicies() {
+      state.buyLoading = true;
+      state.buyError = null;
+      try {
+        const res = await fetch(`${API_BASE}/api/license/policies`, {
+          credentials: "same-origin",
+        });
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          state.buyError = data.message || data.error || `HTTP ${res.status}`;
+        } else {
+          state.buyPolicies = data;
+        }
+      } catch (err) {
+        state.buyError = err?.message || String(err);
+      } finally {
+        state.buyLoading = false;
+        render();
+      }
+    }
+
+    // (Old buySelectPolicy removed — replaced by the
+    // buyEnterDiscountStep → buyApplyDiscount / buyContinueWithoutCode
+    // → buyContinueToCheckout flow above so buyers can preview a
+    // discount code before BTCPay is opened.)
+
+    // Poll the purchase invoice every 4s until it settles or the user
+    // closes the modal. Settled responses trigger a license-status
+    // refresh; the server has already written the new license to
+    // disk by the time we see status:"settled".
+    let __buyPollTimer = null;
+    function startBuyPolling(invoiceId) {
+      if (!invoiceId) return;
+      state.buyPolling = true;
+      state.buyPollError = null;
+      render();
+      const tick = async () => {
+        try {
+          const res = await fetch(
+            `${API_BASE}/api/license/poll/${encodeURIComponent(invoiceId)}`,
+            { credentials: "same-origin" }
+          );
+          const data = await res.json().catch(() => ({}));
+          if (!res.ok) {
+            state.buyPollError =
+              data.message || data.error || `HTTP ${res.status}`;
+            render();
+          } else if (data.status === "settled" && data.licenseKey) {
+            // License was activated server-side. Pull the new state
+            // into the UI + close the modal.
+            await loadLicenseStatus();
+            state.buyPolling = false;
+            state.buyInvoice = null;
+            closeBuyModal();
+            showToast("License activated. Welcome aboard.", "✓", 6000);
+            return;
+          } else if (data.status === "expired" || data.status === "invalid") {
+            state.buyPollError =
+              `Invoice ${data.status}. You can close this and try again from the buy page.`;
+            state.buyPolling = false;
+            render();
+            return;
+          }
+        } catch (err) {
+          state.buyPollError = err?.message || String(err);
+          render();
+        }
+        // Schedule the next poll. 4s feels responsive without
+        // hammering the licensing server. Stops when the modal is
+        // closed (closeBuyModal clears the timer).
+        __buyPollTimer = setTimeout(tick, 4000);
+      };
+      // First tick after a short delay so the user has time to load
+      // the BTCPay checkout page.
+      __buyPollTimer = setTimeout(tick, 4000);
+    }
+
+    function reopenCheckout() {
+      const inv = state.buyInvoice;
+      if (!inv?.checkoutUrl) return;
+      window.open(inv.checkoutUrl, "_blank");
+    }
+
+    function renderBuyModal() {
+      if (!state.buyOpen) return "";
+      let inner;
+      if (state.buyView === "polling") {
+        inner = renderBuyPollingView();
+      } else if (state.buyView === "discount") {
+        inner = renderBuyDiscountView();
+      } else if (state.buyLoading) {
+        inner = renderBuyLoadingView();
+      } else if (state.buyError) {
+        inner = renderBuyErrorView();
+      } else {
+        inner = renderBuyTierCards();
+      }
+      return `
+        <div class="buy-overlay" onclick="if(event.target===this)closeBuyModal()">
+          <div class="buy-modal" role="dialog" aria-modal="true">
+            <div class="buy-header">
+              <h2>Upgrade Recaps</h2>
+              <button class="close-btn" onclick="closeBuyModal()" aria-label="Close">&times;</button>
+            </div>
+            <div class="buy-body">
+              ${inner}
+            </div>
+          </div>
+        </div>
+      `;
+    }
+
+    // Interim view shown after the buyer picks a tier but before the
+    // BTCPay checkout opens. Lets them optionally enter a discount
+    // code, see the discounted price, and only then commit to opening
+    // the invoice in BTCPay. Keeps everything in Recap's visual style
+    // — no Keysat-branded checkout-preview UI involved.
+    function renderBuyDiscountView() {
+      const draft = state.buyDraft || {};
+      const disc = state.buyDiscount || { code: "", applying: false };
+      const isRecurring = !!draft.isRecurring;
+      const cadence = isRecurring ? cadenceSuffix(draft.renewalPeriodDays || 30) : "";
+      const basePrice = draft.basePriceSats || 0;
+      const hasPreview =
+        disc.finalSats != null &&
+        typeof disc.discountAppliedSats === "number";
+      // Once the discount has been previewed AND applied (an invoice
+      // exists in state.buyInvoice), the primary CTA flips from
+      // "Apply" to "Continue to checkout".
+      const previewBlock = hasPreview
+        ? `
+          <div class="buy-discount-preview">
+            <div class="buy-discount-row">
+              <span>Base price</span>
+              <span class="buy-discount-old">${formatSats(basePrice)} sats${cadence}</span>
+            </div>
+            <div class="buy-discount-row">
+              <span>You save</span>
+              <span class="buy-discount-save">−${formatSats(disc.discountAppliedSats)} sats</span>
+            </div>
+            <div class="buy-discount-row buy-discount-total">
+              <span>You pay now</span>
+              <span>${formatSats(disc.finalSats)} sats${cadence}</span>
+            </div>
+          </div>
+          <div class="buy-discount-actions">
+            <button class="buy-secondary-btn" onclick="buyApplyDiscount()" ${disc.applying ? "disabled" : ""}>Try another code</button>
+            <button class="buy-select-btn buy-select-btn-primary" onclick="buyContinueToCheckout()">
+              Continue to checkout &rarr;
+            </button>
+          </div>
+        `
+        : `
+          <div class="buy-discount-actions">
+            <button class="buy-secondary-btn" onclick="buyApplyDiscount()" ${disc.applying ? "disabled" : ""}>
+              ${disc.applying ? "Applying…" : "Apply code"}
+            </button>
+            <button class="buy-select-btn buy-select-btn-primary" onclick="buyContinueWithoutCode()" ${disc.applying ? "disabled" : ""}>
+              Continue without code &rarr;
+            </button>
+          </div>
+        `;
+      const errBlock = disc.error
+        ? `<div class="buy-poll-error">${escHtml(disc.error)}</div>`
+        : "";
+      return `
+        <div class="buy-discount">
+          <button class="buy-back-link" onclick="buyBackToTiers()">&larr; Back to tiers</button>
+          <div class="buy-discount-tier">
+            <div class="buy-discount-tier-name">${escHtml(draft.name || "")}</div>
+            <div class="buy-price-row">
+              <span class="buy-price-new">${formatSats(basePrice)}<span class="buy-price-unit"> sats${cadence}</span></span>
+            </div>
+          </div>
+          <div class="buy-discount-form">
+            <label class="buy-discount-label">Discount code (optional)</label>
+            <input class="buy-discount-input" type="text"
+              placeholder="Enter a code, e.g. LAUNCH50"
+              value="${escAttr(disc.code || "")}"
+              oninput="state.buyDiscount.code = this.value; state.buyDiscount.error = null;"
+              onkeydown="if(event.key==='Enter'){event.preventDefault();buyApplyDiscount();}"
+              ${disc.applying ? "disabled" : ""}
+              autocomplete="off" spellcheck="false" />
+          </div>
+          ${previewBlock}
+          ${errBlock}
+          <div class="buy-discount-hint">
+            Don't have a code? Click <strong>Continue without code</strong> to pay the standard price.
+          </div>
+        </div>
+      `;
+    }
+
+    function renderBuyLoadingView() {
+      return `<div class="buy-loading">Loading tiers…</div>`;
+    }
+
+    function renderBuyErrorView() {
+      return `
+        <div class="buy-error">
+          <strong>Couldn't load tiers.</strong>
+          <div style="margin-top:6px;font-size:12px;color:#fca5a5;">${escHtml(state.buyError)}</div>
+          <button class="buy-retry-btn" onclick="loadBuyPolicies()">Try again</button>
+        </div>
+      `;
+    }
+
+    function renderBuyTierCards() {
+      const policies = state.buyPolicies?.policies || [];
+      if (policies.length === 0) {
+        return `<div class="buy-loading">No tiers are currently available. Check back later.</div>`;
+      }
+      const cards = policies.map(renderBuyTierCard).join("");
+      return `<div class="buy-tier-grid">${cards}</div>`;
+    }
+
+    function renderBuyTierCard(p) {
+      const isHighlighted = !!p.highlighted;
+      const isRecurring = !!p.is_recurring;
+      const cadence = isRecurring ? cadenceSuffix(p.renewal_period_days || 30) : "";
+      const featured = p.featured_discount;
+      const baseSats = typeof p.price_sats === "number" ? p.price_sats : 0;
+      const discountedSats =
+        featured && typeof featured.final_price_sats === "number"
+          ? featured.final_price_sats
+          : null;
+      const discountPct =
+        featured && typeof featured.percent_off === "number"
+          ? featured.percent_off
+          : null;
+      const priceMain = discountedSats != null ? discountedSats : baseSats;
+      const trialNote =
+        typeof p.trial_days === "number" && p.trial_days > 0
+          ? `<div class="buy-trial">${p.trial_days}-day free trial</div>`
+          : "";
+      const bullets =
+        Array.isArray(p.marketing_bullets) && p.marketing_bullets.length > 0
+          ? `<ul class="buy-bullets">${p.marketing_bullets
+              .map((b) => `<li>${escHtml(b)}</li>`)
+              .join("")}</ul>`
+          : "";
+      const badge = isHighlighted
+        ? `<span class="buy-badge">Most popular</span>`
+        : "";
+      const discountBadge =
+        discountPct != null
+          ? `<span class="buy-discount-badge">${discountPct}% OFF</span>`
+          : "";
+      const priceBlock =
+        discountedSats != null
+          ? `<div class="buy-price-row">
+              <span class="buy-price-old">${formatSats(baseSats)}</span>
+              <span class="buy-price-new">${formatSats(discountedSats)}<span class="buy-price-unit"> sats${cadence}</span></span>
+            </div>`
+          : `<div class="buy-price-row">
+              <span class="buy-price-new">${formatSats(priceMain)}<span class="buy-price-unit"> sats${cadence}</span></span>
+            </div>`;
+      return `
+        <div class="buy-tier ${isHighlighted ? "buy-tier-highlighted" : ""}">
+          <div class="buy-tier-top">
+            <div class="buy-tier-name">${escHtml(p.name || p.slug || "")}</div>
+            <div class="buy-tier-badges">${badge}${discountBadge}</div>
+          </div>
+          ${p.description ? `<div class="buy-tier-desc">${escHtml(p.description)}</div>` : ""}
+          ${priceBlock}
+          ${trialNote}
+          ${bullets}
+          <button class="buy-select-btn ${isHighlighted ? "buy-select-btn-primary" : ""}"
+            onclick="buyEnterDiscountStep('${escAttr(p.slug)}')">
+            Select &rarr;
+          </button>
+        </div>
+      `;
+    }
+
+    function renderBuyPollingView() {
+      const inv = state.buyInvoice;
+      const sats = inv?.amountSats != null ? formatSats(inv.amountSats) : "—";
+      const pollError = state.buyPollError
+        ? `<div class="buy-poll-error">${escHtml(state.buyPollError)}</div>`
+        : "";
+      return `
+        <div class="buy-polling">
+          <div class="buy-polling-spinner">⏳</div>
+          <h3>Waiting for payment…</h3>
+          <p>
+            Your <strong>${escHtml(inv?.policyName || "")}</strong> invoice for
+            <strong>${sats} sats</strong> is open in another tab.
+            Once you pay, this screen will activate your license automatically —
+            usually within 30 seconds of confirmation.
+          </p>
+          <div class="buy-polling-actions">
+            <button class="buy-secondary-btn" onclick="reopenCheckout()">Reopen checkout</button>
+            <button class="buy-secondary-btn" onclick="closeBuyModal()">Cancel &amp; close</button>
+          </div>
+          ${pollError}
+        </div>
+      `;
+    }
+
+    // ────────────────────────────────────────────────────────────────────
+    // Self-serve SUBSCRIPTION modal (cloud / multi-mode) — a signed-in
+    // Core user buys their own prepaid Pro/Max period. The relay owns the
+    // tier (core-decoupling); Recaps brokers via /api/billing/*. Primary
+    // rail is Bitcoin/Lightning (BTCPay invoice → poll → tier flips);
+    // "Pay by card" (Zaprite) is the secondary rail (Phase 4).
+    // ────────────────────────────────────────────────────────────────────
+    let subscribePollTimer = null;
+    let subscribeAutoCloseTimer = null;
+    let subscribePollDeadline = 0;
+
+    // Static per-tier presentation. Prices come from the relay
+    // (/api/billing/plans) so they stay sourced from operator config;
+    // only the human-facing label + feature bullets live here.
+    // The relay-credit bullet is NOT listed here — it's injected
+    // dynamically in renderSubscribeTierCard from the plan's live
+    // credits_per_period (sourced from the operator's Adjust-Tier-Quotas
+    // config), so the card always shows the real allotment.
+    const SUBSCRIBE_TIER_INFO = {
+      pro: {
+        label: "Pro",
+        blurb: "Subscriptions, auto-queue, and relay credits.",
+        bullets: [
+          "Subscribe to channels &amp; podcasts",
+          "Auto-queue new episodes for summary",
+          "Priority over the free queue",
+        ],
+        highlighted: false,
+      },
+      max: {
+        label: "Max",
+        blurb: "Everything in Pro, plus audio-first walking mode.",
+        bullets: [
+          "Everything in Pro",
+          "Audio-first &ldquo;walking mode&rdquo; playback",
+          "Speaker names &amp; diarization",
+        ],
+        highlighted: true,
+      },
+    };
+
+    async function openSubscribeModal(preselectTier = null) {
+      state.subscribeOpen = true;
+      state.subscribeView = "tiers";
+      state.subscribeLoading = true;
+      state.subscribeError = null;
+      state.subscribeInvoice = null;
+      state.subscribeBaseline = null;
+      state.subscribePolling = false;
+      state.subscribePollError = null;
+      state.subscribeCardNote = null;
+      state.subscribeSettledTier = null;
+      // preselectTier comes from the mobile-menu "Upgrade to Max" entry
+      // (passes 'max'); the generic Upgrade button passes null. We don't
+      // skip the picker (both tiers stay visible) but we can highlight
+      // the requested one.
+      state.subscribePreselect =
+        preselectTier === "pro" || preselectTier === "max"
+          ? preselectTier
+          : null;
+      render();
+      await loadSubscribePlans();
+    }
+
+    async function loadSubscribePlans() {
+      state.subscribeLoading = true;
+      state.subscribeError = null;
+      render();
+      try {
+        const r = await fetch(`${API_BASE}/api/billing/plans`, {
+          credentials: "same-origin",
+        });
+        const data = await r.json().catch(() => ({}));
+        if (!r.ok) {
+          throw new Error(data.message || data.error || `HTTP ${r.status}`);
+        }
+        state.subscribePlans = {
+          periodDays: data.period_days || 30,
+          plans: Array.isArray(data.plans) ? data.plans : [],
+          // Card (Zaprite) rail configured? Hide "Pay by card" if not.
+          cardAvailable: !!data.card_available,
+        };
+        if (!state.subscribePlans.plans.length) {
+          state.subscribeError = "No subscription plans are available right now.";
+        }
+      } catch (err) {
+        state.subscribeError = err.message || String(err);
+      } finally {
+        state.subscribeLoading = false;
+        render();
+      }
+    }
+
+    function closeSubscribeModal() {
+      state.subscribeOpen = false;
+      state.subscribeView = "tiers";
+      state.subscribeInvoice = null;
+      state.subscribeBaseline = null;
+      state.subscribePolling = false;
+      state.subscribePollError = null;
+      state.subscribeCardNote = null;
+      state.subscribeSettledTier = null;
+      if (subscribePollTimer) {
+        clearInterval(subscribePollTimer);
+        subscribePollTimer = null;
+      }
+      if (subscribeAutoCloseTimer) {
+        clearTimeout(subscribeAutoCloseTimer);
+        subscribeAutoCloseTimer = null;
+      }
+      render();
+    }
+
+    // "Pay with Bitcoin" — the primary rail. Asks Recaps to mint a BTCPay
+    // invoice for the chosen tier (via the relay), then polls
+    // /api/billing/status until the relay extends the tier. We snapshot the
+    // current tier + expiry FIRST so a renewal (same tier, later expiry) is
+    // detected even though the tier label doesn't change.
+    // method: "bitcoin" (BTCPay/Lightning, default) | "card" (Zaprite).
+    // Presentation differs by rail: bitcoin WITH a Lightning invoice renders
+    // an inline QR on THIS screen (no tab, no redirect); card — or bitcoin
+    // without a LN invoice — sends the buyer to a hosted checkout tab. Both
+    // webhooks land at extendUserTier, so the /api/billing/status poll is
+    // rail-agnostic.
+    async function subscribeBuy(tier, method = "bitcoin") {
+      if (tier !== "pro" && tier !== "max") return;
+      if (method !== "bitcoin" && method !== "card") method = "bitcoin";
+      // CARD goes to a hosted Zaprite checkout, so open the tab
+      // SYNCHRONOUSLY inside the click gesture (popup-blocker safe).
+      // BITCOIN renders an inline Lightning invoice on THIS screen — no
+      // tab, no redirect — so it opens nothing here.
+      let checkoutWin = null;
+      if (method === "card") {
+        try { checkoutWin = window.open("about:blank", "_blank"); } catch {}
+      }
+      state.subscribeLoading = true;
+      state.subscribeError = null;
+      state.subscribeCardNote = null;
+      render();
+      // Snapshot baseline (best-effort) so renewals are detectable.
+      let baseline = { tier: "core", expires_at: null };
+      try {
+        const sr = await fetch(`${API_BASE}/api/billing/status`, {
+          credentials: "same-origin",
+        });
+        if (sr.ok) {
+          const sd = await sr.json().catch(() => ({}));
+          baseline = {
+            tier: sd.tier || "core",
+            expires_at: sd.expires_at || null,
+          };
+        }
+      } catch {}
+      state.subscribeBaseline = baseline;
+      try {
+        const r = await fetch(`${API_BASE}/api/billing/buy`, {
+          method: "POST",
+          credentials: "same-origin",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ tier, method }),
+        });
+        const data = await r.json().catch(() => ({}));
+        // Usable if we got EITHER a hosted checkout URL OR an inline
+        // Lightning invoice. (BTCPay essentially always returns a
+        // checkoutLink, but the inline bitcoin path only needs bolt11.)
+        if (!r.ok || (!data.checkout_url && !data.bolt11)) {
+          throw new Error(data.message || data.error || `HTTP ${r.status}`);
+        }
+        state.subscribeInvoice = {
+          method: data.method || method,
+          invoiceId: data.invoice_id || null,
+          orderId: data.order_id || null,
+          checkoutUrl: data.checkout_url,
+          // Lightning BOLT11 for the inline QR (bitcoin rail). Null → fall
+          // back to opening the hosted checkout.
+          bolt11: data.bolt11 || null,
+          lightningPaymentLink: data.lightning_payment_link || null,
+          lightningExpiresAt: data.lightning_expires_at || null,
+          // Bitcoin rail carries sats; card rail carries a fiat
+          // amount (smallest unit) + currency.
+          sats: data.sats ?? null,
+          amount: data.amount ?? null,
+          currency: data.currency || null,
+          tier: data.tier || tier,
+          periodDays: data.period_days,
+        };
+        state.subscribeView = "polling";
+        // Bitcoin WITH a Lightning invoice → stay INLINE (render the QR on
+        // this screen; the poll on /api/billing/status drives the settle).
+        // Card, or bitcoin without LN → send the buyer to the hosted
+        // checkout (the ?billing=success redirect + boot sync flip the badge
+        // on return).
+        const goInline =
+          state.subscribeInvoice.method === "bitcoin" &&
+          !!state.subscribeInvoice.bolt11;
+        if (!goInline) {
+          if (checkoutWin && !checkoutWin.closed) {
+            checkoutWin.location.href = data.checkout_url;
+          } else {
+            try { checkoutWin = window.open(data.checkout_url, "_blank"); } catch {}
+            if (!checkoutWin) {
+              window.location.href = data.checkout_url;
+              return;
+            }
+          }
+        } else if (checkoutWin) {
+          // (bitcoin doesn't pre-open a tab, but be safe.)
+          try { checkoutWin.close(); } catch {}
+        }
+        startSubscribePoll(state.subscribeInvoice.tier);
+      } catch (err) {
+        if (checkoutWin) { try { checkoutWin.close(); } catch {} }
+        state.subscribeError = (err?.message || String(err)).slice(0, 200);
+        state.subscribeView = "tiers";
+      } finally {
+        state.subscribeLoading = false;
+        render();
+      }
+    }
+
+    const SUBSCRIBE_TIER_RANK = { core: 0, pro: 1, max: 2 };
+
+    function startSubscribePoll(purchasedTier) {
+      if (subscribePollTimer) clearInterval(subscribePollTimer);
+      state.subscribePolling = true;
+      state.subscribePollError = null;
+      // Stop hammering the relay after ~20 min; the webhook still lands
+      // server-side, and the ?billing=success redirect / next page load
+      // will reconcile. The modal just stops the live spinner.
+      subscribePollDeadline = Date.now() + 20 * 60 * 1000;
+      subscribePollTimer = setInterval(async () => {
+        if (Date.now() > subscribePollDeadline) {
+          clearInterval(subscribePollTimer);
+          subscribePollTimer = null;
+          state.subscribePolling = false;
+          state.subscribePollError =
+            "Still waiting on payment. You can close this — your plan will " +
+            "activate automatically once the payment confirms.";
+          render();
+          return;
+        }
+        try {
+          const r = await fetch(`${API_BASE}/api/billing/status`, {
+            credentials: "same-origin",
+          });
+          const data = await r.json().catch(() => ({}));
+          if (!r.ok) {
+            state.subscribePollError =
+              data.message || data.error || `HTTP ${r.status}`;
+            render();
+            return;
+          }
+          const base = state.subscribeBaseline || { tier: "core", expires_at: null };
+          const curTier = data.tier || "core";
+          const baseRank = SUBSCRIBE_TIER_RANK[base.tier] ?? 0;
+          const wantRank = SUBSCRIBE_TIER_RANK[purchasedTier] ?? 0;
+          const baseExp = base.expires_at ? Date.parse(base.expires_at) : 0;
+          const curExp = data.expires_at ? Date.parse(data.expires_at) : 0;
+          // Settled when the tier upgraded to what they bought, OR the
+          // expiry advanced (a same-tier renewal/extension).
+          const upgraded = curTier === purchasedTier && baseRank < wantRank;
+          const extended = curExp > baseExp + 1000;
+          if (upgraded || extended) {
+            clearInterval(subscribePollTimer);
+            subscribePollTimer = null;
+            state.subscribePolling = false;
+            state.subscribeSettledTier = curTier;
+            // Refresh every surface that reads tier/credits so the badge,
+            // pill, and gates all flip when the modal closes.
+            try {
+              await Promise.all([
+                loadLicenseStatus().catch(() => {}),
+                loadAccount().catch(() => {}),
+                loadRelayStatus(true).catch(() => {}),
+              ]);
+            } catch {}
+            state.subscribeView = "success";
+            render();
+            if (subscribeAutoCloseTimer) clearTimeout(subscribeAutoCloseTimer);
+            subscribeAutoCloseTimer = setTimeout(() => {
+              subscribeAutoCloseTimer = null;
+              if (state.subscribeOpen && state.subscribeView === "success") {
+                closeSubscribeModal();
+              }
+            }, 3200);
+          }
+        } catch (err) {
+          state.subscribePollError = err.message || String(err);
+          render();
+        }
+      }, 3000);
+    }
+
+    function reopenSubscribeCheckout() {
+      const inv = state.subscribeInvoice;
+      if (!inv?.checkoutUrl) return;
+      try { window.open(inv.checkoutUrl, "_blank"); } catch {}
+    }
+
+    // "Pay by card" — Zaprite rail. Same machine as Bitcoin, just a
+    // different `method`. Only shown when the relay reports the card rail
+    // is configured (state.subscribePlans.cardAvailable).
+    function subscribePayByCard(tier) {
+      subscribeBuy(tier, "card");
+    }
+
+    // Format a fiat amount given in the currency's smallest unit (cents
+    // for USD) as a human price, e.g. 2100 + "USD" → "$21". Drops the
+    // decimals when the amount is a whole unit.
+    function formatFiat(smallestUnit, currency) {
+      const cur = (currency || "USD").toUpperCase();
+      const n = Number(smallestUnit);
+      if (!Number.isFinite(n)) return "";
+      const major = n / 100;
+      try {
+        return new Intl.NumberFormat("en-US", {
+          style: "currency",
+          currency: cur,
+          minimumFractionDigits: Number.isInteger(major) ? 0 : 2,
+          maximumFractionDigits: 2,
+        }).format(major);
+      } catch {
+        // Unknown currency code — fall back to a plain number + code.
+        return `${major} ${cur}`;
+      }
+    }
+
+    // Boot-time reconcile after a BTCPay subscription checkout. When the
+    // buyer follows the "return to merchant" redirect they land on
+    // /?billing=success — even if the in-modal poller never ran (popup
+    // blocked → same-tab navigation away from the app). Sync the relay-
+    // owned tier into the local cache and refresh every tier-reading
+    // surface so the badge + gates flip. The settle webhook can land a
+    // beat after the redirect, so retry a few times until it shows.
+    async function handleBillingReturn() {
+      let params;
+      try {
+        params = new URLSearchParams(window.location.search);
+      } catch {
+        return;
+      }
+      if (params.get("billing") !== "success") return;
+      // Strip the marker so a manual refresh doesn't re-trigger this.
+      try {
+        params.delete("billing");
+        const qs = params.toString();
+        const url =
+          window.location.pathname +
+          (qs ? "?" + qs : "") +
+          window.location.hash;
+        window.history.replaceState({}, "", url);
+      } catch {}
+      if (!isMulti()) return;
+      for (let attempt = 1; attempt <= 4; attempt++) {
+        try {
+          // /api/billing/status syncs the cached users.tier from the
+          // relay as a side effect; then refresh the tier-reading state.
+          await fetch(`${API_BASE}/api/billing/status`, {
+            credentials: "same-origin",
+          }).catch(() => {});
+          await Promise.all([
+            loadLicenseStatus().catch(() => {}),
+            loadAccount().catch(() => {}),
+            loadRelayStatus(true).catch(() => {}),
+          ]);
+          render();
+          if (isProTier()) {
+            showToast("Your plan is active. Welcome aboard!", "✓", 6000);
+            return;
+          }
+        } catch {}
+        if (attempt < 4) {
+          await new Promise((r) => setTimeout(r, 2500));
+        }
+      }
+    }
+
+    // Boot-time handler for the expiry-reminder email's "Renew" link
+    // (/?renew=1). A signed-in account holder lands straight in the
+    // purchase modal; otherwise we nudge them to sign in first (their
+    // session may have lapsed or they opened it on another device).
+    function handleRenewLink() {
+      let params;
+      try {
+        params = new URLSearchParams(window.location.search);
+      } catch {
+        return;
+      }
+      if (params.get("renew") !== "1") return;
+      try {
+        params.delete("renew");
+        const qs = params.toString();
+        const url =
+          window.location.pathname +
+          (qs ? "?" + qs : "") +
+          window.location.hash;
+        window.history.replaceState({}, "", url);
+      } catch {}
+      if (!isMulti()) return;
+      if (state.account?.user) {
+        openSubscribeModal();
+      } else {
+        showToast("Sign in to renew your plan, then tap Upgrade.", "→", 6000);
+      }
+    }
+
+    function renderSubscribeModal() {
+      if (!state.subscribeOpen) return "";
+      let inner;
+      if (state.subscribeView === "polling") {
+        inner = renderSubscribePollingView();
+      } else if (state.subscribeView === "success") {
+        inner = renderSubscribeSuccessView();
+      } else if (state.subscribeLoading && !state.subscribePlans) {
+        inner = `<div class="buy-loading">Loading plans…</div>`;
+      } else if (state.subscribeError && !state.subscribePlans) {
+        inner = `
+          <div class="buy-error">
+            <strong>Couldn't load plans.</strong>
+            <div style="margin-top:6px;font-size:12px;color:#fca5a5;">${escHtml(state.subscribeError)}</div>
+            <button class="buy-retry-btn" onclick="loadSubscribePlans()">Try again</button>
+          </div>`;
+      } else {
+        inner = renderSubscribeTierCards();
+      }
+      // Collapse the wide multi-card modal to a tight single-column card for
+      // the inline Lightning invoice + success views, and swap the header —
+      // mirrors the buy-credits inline flow (.buy-modal is 1000px by default,
+      // sized for the side-by-side tier cards).
+      const inlinePay =
+        state.subscribeView === "polling" && !!state.subscribeInvoice?.bolt11;
+      const compact = inlinePay || state.subscribeView === "success";
+      const modalStyle = compact ? `style="width:420px;max-width:100%;"` : "";
+      let headerLabel = "Upgrade your plan";
+      if (inlinePay) headerLabel = "Pay with Lightning";
+      else if (state.subscribeView === "success") headerLabel = "Plan activated";
+      return `
+        <div class="buy-overlay" onclick="if(event.target===this)closeSubscribeModal()">
+          <div class="buy-modal" role="dialog" aria-modal="true" ${modalStyle}>
+            <div class="buy-header">
+              <h2>${headerLabel}</h2>
+              <button class="close-btn" onclick="closeSubscribeModal()" aria-label="Close">&times;</button>
+            </div>
+            <div class="buy-body">
+              ${inner}
+            </div>
+          </div>
+        </div>
+      `;
+    }
+
+    function renderSubscribeTierCards() {
+      const plans = state.subscribePlans?.plans || [];
+      const periodDays = state.subscribePlans?.periodDays || 30;
+      if (!plans.length) {
+        return `<div class="buy-loading">No plans available right now.</div>`;
+      }
+      const cadence = cadenceSuffix(periodDays);
+      const topErr = state.subscribeError
+        ? `<div class="buy-poll-error" style="margin-bottom:12px;">${escHtml(state.subscribeError)}</div>`
+        : "";
+      const cardNote = state.subscribeCardNote
+        ? `<div class="sub-card-note">${escHtml(state.subscribeCardNote)}</div>`
+        : "";
+      const cards = plans
+        .map((p) => renderSubscribeTierCard(p, cadence))
+        .join("");
+      const busy = state.subscribeLoading ? "Opening checkout…" : "";
+      return `
+        ${topErr}
+        <div class="buy-tier-grid">${cards}</div>
+        ${cardNote}
+        ${busy ? `<div class="sub-busy">${busy}</div>` : ""}
+        <div class="sub-foot-hint">
+          Prepaid for ${periodDays} days. We'll email you before it expires —
+          pay again to extend. No auto-charges.
+        </div>
+      `;
+    }
+
+    function renderSubscribeTierCard(plan, cadence) {
+      const info = SUBSCRIBE_TIER_INFO[plan.tier] || {
+        label: plan.tier,
+        blurb: "",
+        bullets: [],
+        highlighted: false,
+      };
+      const highlighted =
+        info.highlighted || state.subscribePreselect === plan.tier;
+      // Dynamic relay-credit bullet from the live operator quota config:
+      // a number → "N relay credits each period"; null → "Unlimited relay
+      // credits"; absent (relay-unreachable fallback) → generic copy.
+      const cpp = plan.credits_per_period;
+      let creditsBullet;
+      if (typeof cpp === "number") {
+        creditsBullet = `${cpp.toLocaleString("en-US")} relay credits each period`;
+      } else if (cpp === null) {
+        creditsBullet = "Unlimited relay credits";
+      } else {
+        creditsBullet = "Relay credits included each period";
+      }
+      const allBullets = [creditsBullet, ...info.bullets];
+      const bullets = allBullets.length
+        ? `<ul class="buy-bullets">${allBullets
+            .map((b) => `<li>${b}</li>`)
+            .join("")}</ul>`
+        : "";
+      const disabled = state.subscribeLoading ? "disabled" : "";
+      // Card rail: only offer it when the relay says Zaprite is configured.
+      // Show the fiat price on the link so the buyer knows the card amount
+      // (which may carry a small premium over the sat price) before they
+      // leave for the hosted checkout.
+      const cardAvailable = !!state.subscribePlans?.cardAvailable;
+      const cardPrice =
+        plan.fiat_amount != null
+          ? formatFiat(plan.fiat_amount, plan.fiat_currency)
+          : "";
+      const cardBtn = cardAvailable
+        ? `<button class="sub-pay-card" onclick="subscribePayByCard('${escAttr(plan.tier)}')" ${disabled}>
+            Pay by card${cardPrice ? ` · ${escHtml(cardPrice)}` : ""}
+          </button>`
+        : "";
+      return `
+        <div class="buy-tier ${highlighted ? "buy-tier-highlighted" : ""}">
+          <div class="buy-tier-top">
+            <div class="buy-tier-name">${escHtml(info.label)}</div>
+            <div class="buy-tier-badges">${highlighted ? `<span class="buy-badge">Most popular</span>` : ""}</div>
+          </div>
+          ${info.blurb ? `<div class="buy-tier-desc">${info.blurb}</div>` : ""}
+          <div class="buy-price-row">
+            <span class="buy-price-new">${formatSats(plan.sats)}<span class="buy-price-unit"> sats${cadence}</span></span>
+          </div>
+          ${bullets}
+          <button class="buy-select-btn buy-select-btn-primary sub-pay-btc"
+            onclick="subscribeBuy('${escAttr(plan.tier)}', 'bitcoin')" ${disabled}>
+            <span class="sub-btc-glyph">₿</span> Pay with Bitcoin
+          </button>
+          ${cardBtn}
+        </div>
+      `;
+    }
+
+    function renderSubscribePollingView() {
+      const inv = state.subscribeInvoice || {};
+      const info = SUBSCRIBE_TIER_INFO[inv.tier] || { label: inv.tier || "" };
+      const isCard = inv.method === "card";
+      const amountText = isCard
+        ? inv.amount != null
+          ? formatFiat(inv.amount, inv.currency)
+          : "—"
+        : inv.sats != null
+          ? `${formatSats(inv.sats)} sats`
+          : "—";
+      const spinner = isCard ? "💳" : "⚡";
+      const pollError = state.subscribePollError
+        ? `<div class="buy-poll-error">${escHtml(state.subscribePollError)}</div>`
+        : "";
+
+      // INLINE Lightning invoice (bitcoin rail with a BOLT11) — render the
+      // QR + invoice ON THIS screen, no new tab / no redirect. The poll on
+      // /api/billing/status flips to the success view when payment lands.
+      // The QR itself is painted post-render by mountSubscribeQr(), keyed
+      // off the #subscribe-qr-mount node below. Mirrors the buy-credits
+      // inline flow exactly.
+      if (inv.method === "bitcoin" && inv.bolt11) {
+        const lnUri = `lightning:${inv.bolt11}`;
+        const satsText = inv.sats != null ? formatSats(inv.sats) : "—";
+        return `
+          <div style="text-align:center;max-width:300px;margin:0 auto;">
+            <h3 style="margin:0 0 2px;font-size:18px;">Pay ${satsText} sats</h3>
+            <div style="font-size:11px;color:#94a3b8;margin-bottom:14px;">
+              ${escHtml(info.label)} · scan with any Lightning wallet
+            </div>
+            <div id="subscribe-qr-mount"
+                 style="background:#fff;padding:10px;border-radius:8px;display:inline-block;margin-bottom:12px;line-height:0;">
+              <div style="color:#94a3b8;font-size:11px;padding:80px 60px;line-height:1.4;">Generating QR…</div>
+            </div>
+            <div style="display:flex;gap:6px;align-items:center;margin-bottom:10px;">
+              <code style="flex:1;min-width:0;font-size:11px;color:#94a3b8;background:#0a0e1a;padding:7px 9px;border-radius:6px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;direction:ltr;text-align:left;">${escHtml(inv.bolt11)}</code>
+              <button class="buy-secondary-btn" onclick="copyInvoiceId('${escAttr(inv.bolt11)}', this)"
+                style="flex-shrink:0;padding:7px 12px;font-size:11px;font-weight:600;">Copy</button>
+            </div>
+            <a href="${escAttr(lnUri)}"
+               style="display:block;padding:10px 18px;font-size:13px;font-weight:600;background:#3b82f6;color:#fff;border-radius:8px;text-decoration:none;">
+              ⚡ Open in wallet
+            </a>
+            <div style="margin-top:10px;font-size:10px;color:#64748b;line-height:1.5;">
+              Your plan activates automatically when payment lands.
+            </div>
+            ${pollError}
+            <button onclick="closeSubscribeModal()"
+              style="margin-top:10px;background:transparent;color:#64748b;border:none;font-size:11px;text-decoration:underline;cursor:pointer;">
+              Cancel
+            </button>
+          </div>
+        `;
+      }
+
+      // Fallback (card, or bitcoin without a Lightning invoice) — waiting on
+      // a hosted checkout opened in another tab.
+      return `
+        <div class="buy-polling">
+          <div class="buy-polling-spinner"${isCard ? ' style="filter:none;"' : ""}>${spinner}</div>
+          <h3>Waiting for payment…</h3>
+          <p>
+            Your <strong>${escHtml(info.label)}</strong> checkout for
+            <strong>${escHtml(amountText)}</strong> is open in another tab.
+            Once you pay, your plan activates here automatically —
+            usually within a few seconds of confirmation.
+          </p>
+          <div class="buy-polling-actions">
+            <button class="buy-secondary-btn" onclick="reopenSubscribeCheckout()">Reopen checkout</button>
+            <button class="buy-secondary-btn" onclick="closeSubscribeModal()">Cancel &amp; close</button>
+          </div>
+          ${pollError}
+        </div>
+      `;
+    }
+
+    function renderSubscribeSuccessView() {
+      const tier = state.subscribeSettledTier || "pro";
+      const info = SUBSCRIBE_TIER_INFO[tier] || { label: tier };
+      return `
+        <div class="buy-polling">
+          <div class="buy-polling-spinner" style="filter:none;">✅</div>
+          <h3>You're on ${escHtml(info.label)}!</h3>
+          <p>Your plan is active. Enjoy ${escHtml(info.label)} — this window will close on its own.</p>
+          <div class="buy-polling-actions">
+            <button class="buy-secondary-btn" onclick="closeSubscribeModal()">Done</button>
+          </div>
+        </div>
+      `;
+    }
+
+    // ────────────────────────────────────────────────────────────────────
+    // Buy CREDITS modal — relay credit top-ups via the operator's BTCPay
+    // store. Same visual language as the license-purchase modal above
+    // (reuses .buy-overlay / .buy-modal / .buy-tier / .buy-select-btn
+    // classes) so the buyer experience stays consistent.
+    // ────────────────────────────────────────────────────────────────────
+    let buyCreditsPollTimer = null;
+    let buyCreditsAutoCloseTimer = null;
+
+    // ── Trial-exhausted modal ────────────────────────────────────────
+    // Shown when an anonymous visitor tries to summarize but their IP
+    // is at the operator's trials_per_ip_lifetime cap (or trials are
+    // configured off). Two CTAs: Sign up (fresh account, IP-
+    // independent, transfers any trial credits the visitor already
+    // has) and Buy credits (a la carte; no signup required for the
+    // anon path, attaches to the visitor's trial cookie even when
+    // the cookie can't be MINTED — credits-purchase.js force-mints
+    // a cookie with credits_total=0 for the purchase, then the
+    // bought credits go on top). Closes on outside click + Escape.
+    function showTrialExhaustedModal({ reason } = {}) {
+      // Idempotent — if it's already open, focus it.
+      const existing = document.getElementById("trial-exhausted-modal");
+      if (existing) return;
+
+      // Same headline + body for every reason. Earlier versions had
+      // a distinct "Free trial used up — from this device or network"
+      // copy for the IP-cap path, but that phrasing tells the
+      // determined visitor "swap your IP and you're back in"
+      // (the cap really IS IP-bound, but we don't need to broadcast
+      // the implementation). Generic "out of free credits" is
+      // honest, doesn't telegraph the bypass, and works whether the
+      // visitor used their cookie credits OR can't mint a new
+      // cookie — both cases are the same outcome for them.
+      const headline = "Out of free credits";
+      const body =
+        "Your free credits are used up. Sign up to keep going (any unused credits transfer to your account), or buy credits a la carte from this browser.";
+
+      const overlay = document.createElement("div");
+      overlay.id = "trial-exhausted-modal";
+      overlay.className = "settings-overlay";
+      overlay.style.zIndex = "2200";
+      overlay.innerHTML =
+        '<div class="settings-modal" style="max-width:460px;" onclick="event.stopPropagation()">' +
+          '<div class="settings-modal-header">' +
+            '<h2>' + headline + '</h2>' +
+            '<button class="close-btn" id="trial-exhausted-close">&times;</button>' +
+          '</div>' +
+          '<div class="settings-modal-body" style="font-size:14px; line-height:1.6; color:#cbd5e1;">' +
+            '<p style="margin-top:0;">' + body + '</p>' +
+            '<div style="display:flex; gap:10px; flex-wrap:wrap; margin-top:18px;">' +
+              '<button class="submit-btn" id="trial-exhausted-signup" style="flex:1; min-width:140px;">Sign up free</button>' +
+              '<button class="expand-btn" id="trial-exhausted-buy" style="flex:1; min-width:140px;">Buy credits</button>' +
+            '</div>' +
+            '<div style="margin-top:14px; font-size:12px; color:#94a3b8; line-height:1.5;">' +
+              'Already have an account? <a href="#" id="trial-exhausted-signin" style="color:#a5b4fc;">Sign in</a>' +
+            '</div>' +
+          '</div>' +
+        '</div>';
+      document.body.appendChild(overlay);
+
+      const close = () => overlay.remove();
+      document.getElementById("trial-exhausted-close").onclick = close;
+      overlay.onclick = close;
+      document.getElementById("trial-exhausted-signup").onclick = () => { close(); openTierSignupModal(); };
+      document.getElementById("trial-exhausted-buy").onclick = () => { close(); openBuyCreditsModal(); };
+      document.getElementById("trial-exhausted-signin").onclick = (ev) => {
+        ev.preventDefault();
+        close();
+        if (typeof openSigninModal === "function") openSigninModal();
+        else openTierSignupModal();
+      };
+      const onKey = (ev) => {
+        if (ev.key === "Escape") { ev.preventDefault(); close(); document.removeEventListener("keydown", onKey); }
+      };
+      document.addEventListener("keydown", onKey);
+    }
+    window.showTrialExhaustedModal = showTrialExhaustedModal;
+
+    async function openBuyCreditsModal() {
+      state.buyCreditsOpen = true;
+      state.buyCreditsView = "packages";
+      state.buyCreditsLoading = true;
+      state.buyCreditsError = null;
+      state.buyCreditsPackages = null;
+      state.buyCreditsInvoice = null;
+      state.buyCreditsPolling = false;
+      state.buyCreditsPollError = null;
+      render();
+      // Up to 2 attempts. Safari iOS sometimes silently aborts the
+      // very first fetch from a cold tab and surfaces it as a
+      // "Load failed" TypeError — second try works because the
+      // TCP/TLS state is warm. Short backoff between attempts so a
+      // genuinely-down endpoint surfaces quickly.
+      let lastErr = null;
+      for (let attempt = 1; attempt <= 2; attempt++) {
+        try {
+          const r = await fetch("/api/credits/packages");
+          if (!r.ok) {
+            const err = await r.json().catch(() => ({}));
+            throw new Error(err.message || err.error || `HTTP ${r.status}`);
+          }
+          const data = await r.json();
+          state.buyCreditsPackages = Array.isArray(data?.packages) ? data.packages : [];
+          if (state.buyCreditsPackages.length === 0) {
+            state.buyCreditsError = "No credit bundles are currently offered.";
+          }
+          lastErr = null;
+          break;
+        } catch (err) {
+          lastErr = err;
+          if (attempt < 2) {
+            await new Promise((r) => setTimeout(r, 600));
+          }
+        }
+      }
+      if (lastErr && !state.buyCreditsPackages) {
+        state.buyCreditsError = lastErr.message || String(lastErr);
+      }
+      state.buyCreditsLoading = false;
+      render();
+    }
+
+    function closeBuyCreditsModal() {
+      state.buyCreditsOpen = false;
+      state.buyCreditsView = "packages";
+      state.buyCreditsInvoice = null;
+      state.buyCreditsPolling = false;
+      state.buyCreditsPollError = null;
+      state.buyCreditsSettledCredits = null;
+      if (buyCreditsPollTimer) {
+        clearInterval(buyCreditsPollTimer);
+        buyCreditsPollTimer = null;
+      }
+      if (buyCreditsAutoCloseTimer) {
+        clearTimeout(buyCreditsAutoCloseTimer);
+        buyCreditsAutoCloseTimer = null;
+      }
+      render();
+    }
+
+    async function buyCreditsSelectPackage(credits) {
+      const n = Number(credits);
+      if (!Number.isFinite(n) || n <= 0) return;
+      state.buyCreditsLoading = true;
+      state.buyCreditsError = null;
+      render();
+      let checkoutWin = null;
+      try {
+        const r = await fetch("/api/credits/buy", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            credits: n,
+            // Where BTCPay should send the buyer's browser after
+            // successful payment. Lands them back on the exact
+            // Recap page they were on instead of stuck on BTCPay's
+            // "Paid" screen.
+            return_url: window.location.href,
+          }),
+        });
+        const data = await r.json().catch(() => ({}));
+        if (!r.ok) {
+          throw new Error(data.message || data.error || `HTTP ${r.status}`);
+        }
+        const result = data.result || {};
+        state.buyCreditsInvoice = {
+          invoiceId: result.invoice_id,
+          checkoutUrl: result.checkout_url,
+          sats: result.sats,
+          credits: result.credits,
+          // Phase 1 inline-payment fields. Present when the upstream
+          // relay surfaces the BOLT11 invoice in its response (new
+          // contract); absent when it returns the legacy shape. When
+          // present we render an inline QR + copy UI; when absent we
+          // fall back to opening BTCPay in a new tab.
+          bolt11: result.bolt11 || null,
+          lightningExpiresAt: result.lightning_expires_at || result.expires_at || null,
+          // Diagnostic captured by the relay when bolt11 came back
+          // null. Surfaced in the legacy-fallback view so operators
+          // can see WHY the inline path didn't light up — saves a
+          // round-trip through log tailing.
+          lnDebug: result._ln_debug || null,
+        };
+        if (state.buyCreditsInvoice.bolt11) {
+          // Inline path — stay on this page, render QR + invoice.
+          // Polling continues to drive the settle handoff.
+          state.buyCreditsView = "polling";
+          startBuyCreditsPoll(result.invoice_id);
+        } else {
+          // Legacy fallback: open BTCPay checkout in a new tab.
+          // Once the relay starts returning bolt11, this branch
+          // stops firing and the inline path takes over.
+          try {
+            checkoutWin = window.open(result.checkout_url, "_blank");
+          } catch {}
+          if (!checkoutWin) {
+            // Popup blocker. Same-tab navigation as a last resort.
+            window.location.href = result.checkout_url;
+          }
+          state.buyCreditsView = "polling";
+          startBuyCreditsPoll(result.invoice_id);
+        }
+      } catch (err) {
+        state.buyCreditsError = err.message || String(err);
+        state.buyCreditsView = "packages";
+      } finally {
+        state.buyCreditsLoading = false;
+        render();
+      }
+    }
+
+    function startBuyCreditsPoll(invoiceId) {
+      if (buyCreditsPollTimer) clearInterval(buyCreditsPollTimer);
+      state.buyCreditsPolling = true;
+      state.buyCreditsPollError = null;
+      buyCreditsPollTimer = setInterval(async () => {
+        try {
+          const r = await fetch("/api/credits/invoice/" + encodeURIComponent(invoiceId));
+          const data = await r.json().catch(() => ({}));
+          if (!r.ok) {
+            state.buyCreditsPollError = data.message || data.error || `HTTP ${r.status}`;
+            render();
+            return;
+          }
+          const status = data?.result?.status;
+          if (status === "settled") {
+            clearInterval(buyCreditsPollTimer);
+            buyCreditsPollTimer = null;
+            state.buyCreditsPolling = false;
+            const credits = data?.result?.credits || state.buyCreditsInvoice?.credits || 0;
+            // Refresh BOTH /api/relay/status AND /api/account/whoami so
+            // every code-path that reads credits (toolbar pill, mobile
+            // menu, settings panel) sees the new number when the modal
+            // auto-closes a few seconds from now.
+            try {
+              await Promise.all([
+                loadRelayStatus(true).catch(() => {}),
+                loadAccount().catch(() => {}),
+              ]);
+            } catch {}
+            // Transition the modal to an in-place success view
+            // instead of immediately closing + tossing a corner
+            // toast. The settle moment deserves a clear visual
+            // beat — buyer just paid real sats, they should see
+            // an unambiguous confirmation before the UI moves on.
+            // Auto-closes after 2.8s; the Done button closes
+            // sooner if they want.
+            state.buyCreditsView = "success";
+            state.buyCreditsSettledCredits = credits;
+            render();
+            if (buyCreditsAutoCloseTimer) clearTimeout(buyCreditsAutoCloseTimer);
+            buyCreditsAutoCloseTimer = setTimeout(() => {
+              buyCreditsAutoCloseTimer = null;
+              if (state.buyCreditsOpen && state.buyCreditsView === "success") {
+                closeBuyCreditsModal();
+              }
+            }, 2800);
+          } else if (status === "expired" || status === "invalid") {
+            clearInterval(buyCreditsPollTimer);
+            buyCreditsPollTimer = null;
+            state.buyCreditsPolling = false;
+            state.buyCreditsPollError =
+              status === "expired"
+                ? "Invoice expired before payment landed. Close this and try again."
+                : "Payment was marked invalid. Close this and try again.";
+            render();
+          }
+        } catch (err) {
+          state.buyCreditsPollError = err.message || String(err);
+          render();
+        }
+      }, 3000);
+    }
+
+    function reopenBuyCreditsCheckout() {
+      const inv = state.buyCreditsInvoice;
+      if (!inv?.checkoutUrl) return;
+      try { window.open(inv.checkoutUrl, "_blank"); } catch {}
+    }
+
+    function renderBuyCreditsModal() {
+      if (!state.buyCreditsOpen) return "";
+      let inner;
+      if (state.buyCreditsLoading && !state.buyCreditsInvoice) {
+        inner = `<div class="buy-loading">Loading bundles…</div>`;
+      } else if (state.buyCreditsError && state.buyCreditsView === "packages") {
+        inner = `
+          <div class="buy-error">
+            <strong>Couldn't open purchase.</strong>
+            <div style="margin-top:6px;font-size:12px;color:#fca5a5;">${escHtml(state.buyCreditsError)}</div>
+            <button class="buy-retry-btn" onclick="openBuyCreditsModal()">Try again</button>
+          </div>
+        `;
+      } else if (state.buyCreditsView === "polling") {
+        inner = renderBuyCreditsPollingView();
+      } else if (state.buyCreditsView === "success") {
+        inner = renderBuyCreditsSuccessView();
+      } else {
+        inner = renderBuyCreditsPackageCards();
+      }
+      // Modal width is state-aware: the tier picker needs ~1000px to
+      // show 3 credit packs side-by-side, but the inline-payment
+      // view (QR + invoice) and the success confirmation are
+      // centered content that should sit in a tight ~420px card.
+      const compact =
+        (state.buyCreditsView === "polling" &&
+          state.buyCreditsInvoice?.bolt11) ||
+        state.buyCreditsView === "success";
+      const inlinePay =
+        state.buyCreditsView === "polling" &&
+        state.buyCreditsInvoice?.bolt11;
+      const modalStyle = compact ? `style="width:420px;max-width:100%;"` : "";
+      // Header label switches to match each view's purpose.
+      let headerLabel = "Buy Recap credits";
+      if (inlinePay) headerLabel = "Pay with Lightning";
+      else if (state.buyCreditsView === "success") headerLabel = "Payment confirmed";
+      return `
+        <div class="buy-overlay" onclick="if(event.target===this)closeBuyCreditsModal()">
+          <div class="buy-modal" role="dialog" aria-modal="true" ${modalStyle}>
+            <div class="buy-header">
+              <h2>${headerLabel}</h2>
+              <button class="close-btn" onclick="closeBuyCreditsModal()" aria-label="Close">&times;</button>
+            </div>
+            <div class="buy-body">
+              ${inner}
+            </div>
+          </div>
+        </div>
+      `;
+    }
+
+    // ── Buy-credits success view ───────────────────────────────────
+    // Renders once the polling loop sees `status: "settled"`. Stays
+    // up for ~2.8s before auto-closing — long enough for the buyer
+    // to register that the payment landed, short enough that the
+    // app doesn't feel stuck. The bouncy checkmark + radiating
+    // sparkles is the BTCPay-inspired moment of "yes, it worked";
+    // pure CSS animations so no library needed.
+    function renderBuyCreditsSuccessView() {
+      const credits = state.buyCreditsSettledCredits || 0;
+      // 8 sparkles evenly spaced in a circle for the burst. Each
+      // gets a `--ang` custom property the CSS @keyframes uses to
+      // translate outward in that direction. Particle emoji are
+      // mixed so it doesn't look too repetitive.
+      const particleChars = ["✨", "⚡", "✨", "⭐", "✨", "⚡", "✨", "⭐"];
+      const particles = particleChars
+        .map((ch, i) => {
+          const angle = (360 / particleChars.length) * i;
+          return `<span class="buy-sparkle" style="--ang:${angle}deg;animation-delay:${i * 30}ms;">${ch}</span>`;
+        })
+        .join("");
+      return `
+        <div class="buy-success">
+          <div class="buy-success-burst">
+            ${particles}
+            <div class="buy-success-check">✓</div>
+          </div>
+          <h3 class="buy-success-title">Payment confirmed</h3>
+          <p class="buy-success-sub">
+            ${credits} Recap credit${credits === 1 ? "" : "s"} added to your balance
+          </p>
+          <button class="buy-secondary-btn" onclick="closeBuyCreditsModal()"
+            style="margin-top:16px;padding:8px 18px;font-size:12px;font-weight:600;">
+            Done
+          </button>
+        </div>
+      `;
+    }
+
+    function renderBuyCreditsPackageCards() {
+      const packages = state.buyCreditsPackages || [];
+      if (packages.length === 0) {
+        return `<div class="buy-loading">No bundles available.</div>`;
+      }
+      const cards = packages.map(renderBuyCreditsCard).join("");
+      // Anon-buyer warning: credits are tied to this browser cookie
+      // until they sign up. We promise the credits transfer on signup
+      // (handled server-side in anon-trial.js linkToUser) so the user
+      // doesn't have to lose them by creating an account — just makes
+      // them persistent across devices + clears the "if I clear
+      // cookies I lose this" risk.
+      const isAnon = isMulti() && !state.account?.user;
+      const anonWarning = isAnon
+        ? `<div style="margin-top:14px;padding:10px 12px;background:rgba(99,102,241,0.10);border:1px solid rgba(99,102,241,0.30);border-radius:8px;font-size:12px;color:#c7d2fe;line-height:1.55;">
+            <strong style="color:#e0e7ff;">Heads up:</strong> Credits you buy now are tied to this browser. <a href="/auth.html" style="color:#a5b4fc;text-decoration:underline;">Sign up for a free Recaps account</a> (30 seconds) to save them across devices and protect them if you clear cookies.
+          </div>`
+        : "";
+      return `
+        <div class="buy-tier-grid">${cards}</div>
+        ${anonWarning}
+      `;
+    }
+
+    function renderBuyCreditsCard(p) {
+      const credits = Number(p.credits);
+      const sats = Number(p.sats);
+      const perCredit = credits > 0 ? Math.round(sats / credits) : 0;
+      // Highlight the best per-credit value so the buyer's eye lands
+      // on it. Computed by sorting all packages by sats-per-credit
+      // ascending; first one wins.
+      const best = (state.buyCreditsPackages || [])
+        .slice()
+        .filter((x) => x.credits > 0)
+        .sort((a, b) => a.sats / a.credits - b.sats / b.credits)[0];
+      const isBest = !!best && best.credits === credits && best.sats === sats && (state.buyCreditsPackages || []).length > 1;
+      const badge = isBest ? `<span class="buy-badge">Best value</span>` : "";
+      return `
+        <div class="buy-tier ${isBest ? "buy-tier-highlighted" : ""}">
+          <div class="buy-tier-top">
+            <div class="buy-tier-name">${credits} credit${credits === 1 ? "" : "s"}</div>
+            <div class="buy-tier-badges">${badge}</div>
+          </div>
+          <div class="buy-price-row">
+            <span class="buy-price-new">${formatSats(sats)}<span class="buy-price-unit"> sats</span></span>
+          </div>
+          <div class="buy-tier-desc" style="margin-top:6px;">
+            ${formatSats(perCredit)} sats per credit
+          </div>
+          <button class="buy-select-btn ${isBest ? "buy-select-btn-primary" : ""}"
+            onclick="buyCreditsSelectPackage(${credits})"
+            ${state.buyCreditsLoading ? "disabled" : ""}>
+            ${state.buyCreditsLoading ? "Opening…" : "⚡ Pay with Lightning"}
+          </button>
+        </div>
+      `;
+    }
+
+    function renderBuyCreditsPollingView() {
+      const inv = state.buyCreditsInvoice;
+      const sats = inv?.sats != null ? formatSats(inv.sats) : "—";
+      const credits = inv?.credits != null ? inv.credits : "—";
+      const invoiceId = inv?.invoiceId || "";
+      const bolt11 = inv?.bolt11 || "";
+      const pollError = state.buyCreditsPollError
+        ? `<div class="buy-poll-error">${escHtml(state.buyCreditsPollError)}</div>`
+        : "";
+
+      // Anon-buyer recovery hint with invoice ID — same content as
+      // before but now appears below the QR (or below the legacy
+      // "Reopen checkout" buttons) instead of inline with payment.
+      const isAnon = isMulti() && !state.account?.user;
+      const invoiceIdBlock = invoiceId && isAnon
+        ? `
+          <div style="margin-top:16px;padding:12px;background:rgba(15,23,42,0.6);border:1px solid #1e293b;border-radius:8px;text-align:left;">
+            <div style="font-size:11px;font-weight:600;color:#94a3b8;text-transform:uppercase;letter-spacing:0.04em;margin-bottom:6px;">
+              Invoice ID
+            </div>
+            <div style="display:flex;gap:8px;align-items:center;">
+              <code style="flex:1;font-size:11px;color:#e2e8f0;background:#0f172a;padding:8px 10px;border-radius:6px;word-break:break-all;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;">${escHtml(invoiceId)}</code>
+              <button class="buy-secondary-btn" onclick="copyInvoiceId('${escAttr(invoiceId)}', this)"
+                style="flex-shrink:0;padding:8px 12px;font-size:11px;">Copy</button>
+            </div>
+            <div style="margin-top:8px;font-size:11px;color:#94a3b8;line-height:1.5;">
+              Save this if you plan to sign up later — paste it into <em>Settings → Claim a previous purchase</em> to move these credits to your account if they don't transfer automatically.
+            </div>
+          </div>`
+        : "";
+
+      // ── Inline Lightning UI (Phase 1) ──
+      // Compact layout: small QR (~220px), truncated single-line
+      // BOLT11 with copy button, primary "Open in wallet" CTA below.
+      // No background card around the QR — the modal IS the card.
+      if (bolt11) {
+        // Lightning URI deep link — mobile wallets (Phoenix, Muun,
+        // Wallet of Satoshi, Blue, etc.) register the lightning:
+        // scheme and launch into a "confirm payment" view when this
+        // URL is tapped. Desktop falls through to copy-paste path.
+        const lnUri = `lightning:${bolt11}`;
+        return `
+          <div style="text-align:center;max-width:280px;margin:0 auto;">
+            <h3 style="margin:0 0 2px;font-size:18px;">Pay ${sats} sats</h3>
+            <div style="font-size:11px;color:#94a3b8;margin-bottom:14px;">
+              ${credits} credit${credits === 1 ? "" : "s"} · scan with any Lightning wallet
+            </div>
+            <div id="buy-credits-qr-mount"
+                 style="background:#fff;padding:10px;border-radius:8px;display:inline-block;margin-bottom:12px;line-height:0;">
+              <div style="color:#94a3b8;font-size:11px;padding:80px 60px;line-height:1.4;">Generating QR…</div>
+            </div>
+            <div style="display:flex;gap:6px;align-items:center;margin-bottom:10px;">
+              <code style="flex:1;min-width:0;font-size:11px;color:#94a3b8;background:#0a0e1a;padding:7px 9px;border-radius:6px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;direction:ltr;text-align:left;">${escHtml(bolt11)}</code>
+              <button class="buy-secondary-btn" onclick="copyInvoiceId('${escAttr(bolt11)}', this)"
+                style="flex-shrink:0;padding:7px 12px;font-size:11px;font-weight:600;">Copy</button>
+            </div>
+            <a href="${escAttr(lnUri)}"
+               style="display:block;padding:10px 18px;font-size:13px;font-weight:600;background:#3b82f6;color:#fff;border-radius:8px;text-decoration:none;">
+              ⚡ Open in wallet
+            </a>
+            <div style="margin-top:10px;font-size:10px;color:#64748b;line-height:1.5;">
+              Updates automatically when payment lands.
+            </div>
+            ${pollError}
+            ${invoiceIdBlock}
+            <button onclick="closeBuyCreditsModal()"
+              style="margin-top:10px;background:transparent;color:#64748b;border:none;font-size:11px;text-decoration:underline;cursor:pointer;">
+              Cancel
+            </button>
+          </div>
+        `;
+      }
+
+      // ── Legacy external-tab fallback ──
+      // Fires when the relay hasn't been updated yet to surface
+      // bolt11 in the response. Pre-inline behavior preserved as
+      // a safety net for any store configuration where the LN
+      // destination isn't extractable via greenfield API (e.g.,
+      // LN not configured on the store, or a different BTCPay
+      // version with a yet-unseen response shape).
+      return `
+        <div class="buy-polling">
+          <div class="buy-polling-spinner">⏳</div>
+          <h3>Waiting for payment…</h3>
+          <p>
+            Your invoice for <strong>${credits} credit${credits === 1 ? "" : "s"}</strong> at
+            <strong>${sats} sats</strong> is open in another tab.
+            Once you pay over Lightning, this screen will add the credits
+            to your balance — usually within a few seconds.
+          </p>
+          ${invoiceIdBlock}
+          <div class="buy-polling-actions">
+            <button class="buy-secondary-btn" onclick="reopenBuyCreditsCheckout()">Reopen checkout</button>
+            <button class="buy-secondary-btn" onclick="closeBuyCreditsModal()">Cancel &amp; close</button>
+          </div>
+          ${pollError}
+        </div>
+      `;
+    }
+
+    // Post-render hook for the inline payment view — once the modal
+    // DOM is in place, paint the QR onto the placeholder. We can't
+    // do this inside the template string because qrcode-generator
+    // expects a real DOM node. Idempotent: if the QR is already
+    // there for the current invoice we no-op.
+    function mountBuyCreditsQr() {
+      const inv = state.buyCreditsInvoice;
+      if (!inv?.bolt11) return;
+      const mount = document.getElementById("buy-credits-qr-mount");
+      if (!mount) return;
+      if (mount.dataset.bolt11 === inv.bolt11) return; // already painted
+      if (typeof qrcode !== "function") {
+        // QR library failed to load (offline, blocked, etc.) — leave
+        // the placeholder text. BOLT11 + Open-in-wallet still work.
+        mount.innerHTML = `<div style="color:#64748b;font-size:12px;text-align:center;padding:24px 0;">QR unavailable — copy the invoice text below or tap "Open in wallet".</div>`;
+        return;
+      }
+      try {
+        // typeNumber: 0 = auto-detect minimum version needed.
+        // errorCorrectLevel: "L" = low (7% redundancy) — fine for a
+        // screen-displayed QR scanned from inches away. Higher levels
+        // bloat the matrix unnecessarily.
+        const qr = qrcode(0, "L");
+        // BOLT11 uses lowercase but wallets accept both. We uppercase
+        // to enable "alphanumeric" mode which packs ~37% more data per
+        // module — important so the QR stays scannable for longer
+        // invoices. Wallets normalize back to lowercase internally.
+        qr.addData(inv.bolt11.toUpperCase(), "Alphanumeric");
+        qr.make();
+        // Fixed-size SVG (scalable:false). At cellSize=3 a typical
+        // ~400-char BOLT11 lands around ~75 modules square → ~225px
+        // QR — fits cleanly on mobile + desktop without being huge.
+        // Explicit px dimensions mean we don't depend on the parent
+        // having a sized box (which collapsed our previous attempt).
+        // No outer wrapper — the parent mount element provides the
+        // white background + padding so the QR sits cleanly on it.
+        const svg = qr.createSvgTag({ cellSize: 3, margin: 2 });
+        mount.innerHTML = svg;
+        mount.dataset.bolt11 = inv.bolt11;
+      } catch (err) {
+        console.warn("[buy] QR render failed:", err);
+        mount.innerHTML = `<div style="color:#fca5a5;font-size:12px;text-align:center;padding:24px;background:transparent;">Couldn't render QR — copy the invoice below.</div>`;
+      }
+    }
+
+    // Paints the inline Lightning QR for the SUBSCRIBE modal's bitcoin
+    // invoice. Clone of mountBuyCreditsQr keyed to #subscribe-qr-mount and
+    // state.subscribeInvoice. Idempotent via mount.dataset.bolt11 so the
+    // 3s poll re-render doesn't repaint (or flicker) the QR.
+    function mountSubscribeQr() {
+      const inv = state.subscribeInvoice;
+      if (!inv?.bolt11) return;
+      const mount = document.getElementById("subscribe-qr-mount");
+      if (!mount) return;
+      if (mount.dataset.bolt11 === inv.bolt11) return; // already painted
+      if (typeof qrcode !== "function") {
+        mount.innerHTML = `<div style="color:#64748b;font-size:12px;text-align:center;padding:24px 0;">QR unavailable — copy the invoice text below or tap "Open in wallet".</div>`;
+        return;
+      }
+      try {
+        const qr = qrcode(0, "L");
+        qr.addData(inv.bolt11.toUpperCase(), "Alphanumeric");
+        qr.make();
+        const svg = qr.createSvgTag({ cellSize: 3, margin: 2 });
+        mount.innerHTML = svg;
+        mount.dataset.bolt11 = inv.bolt11;
+      } catch (err) {
+        console.warn("[subscribe] QR render failed:", err);
+        mount.innerHTML = `<div style="color:#fca5a5;font-size:12px;text-align:center;padding:24px;background:transparent;">Couldn't render QR — copy the invoice below.</div>`;
+      }
+    }
+
+    // Copy-to-clipboard for the invoice ID. Mutates the button label
+    // briefly so the user gets feedback without needing a toast (the
+    // toast layer is full of other purchase-related messages right
+    // now). Falls back to manual select if Clipboard API is blocked
+    // (rare on https, but Safari Private mode has been known to).
+    async function copyInvoiceId(invoiceId, btn) {
+      if (!invoiceId) return;
+      const original = btn ? btn.textContent : null;
+      try {
+        await navigator.clipboard.writeText(invoiceId);
+        if (btn) {
+          btn.textContent = "Copied ✓";
+          setTimeout(() => { if (btn) btn.textContent = original || "Copy"; }, 1500);
+        }
+      } catch (err) {
+        if (btn) {
+          btn.textContent = "Press & hold to copy";
+          setTimeout(() => { if (btn) btn.textContent = original || "Copy"; }, 2500);
+        }
+      }
+    }
+
+    // Same shape as escHtml but optimized for attribute values where
+    // we need to keep single quotes safe (inline onclick handlers).
+    function escAttr(s) {
+      if (!s) return "";
+      return String(s)
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+    }
+
+    // ────────────────────────────────────────────────────────────────────
+    // First-visit welcome modal. Brand-new anon visitors on a multi-
+    // tenant Recap see this ONCE, before they figure the URL input
+    // out from scratch. Cookie-based dismissal means it doesn't
+    // re-appear on subsequent visits from the same browser. Single
+    // mode never shows this — single-mode installs are operator-
+    // initiated and don't need a "what is this product" pitch.
+    // ────────────────────────────────────────────────────────────────────
+    function shouldShowWelcome() {
+      // Multi-mode anon ONLY. Skip if /api/account/whoami hasn't
+      // resolved yet to avoid flashing the modal at single-mode
+      // operators between page load and the account fetch.
+      if (!state.welcomeOpen) return false;
+      if (!state.account?.loaded) return false;
+      if (!isMulti()) return false;
+      if (state.account?.user) return false; // signed-in user — they've seen the app before
+      return true;
+    }
+
+    function dismissWelcome() {
+      state.welcomeOpen = false;
+      try {
+        // 1-year cookie so the same browser doesn't see the welcome
+        // again. SameSite=Lax + Secure (StartOS tunnel terminates
+        // HTTPS, so this is fine in production).
+        const oneYear = 60 * 60 * 24 * 365;
+        document.cookie =
+          "recap_welcome_seen=1; Max-Age=" +
+          oneYear +
+          "; Path=/; SameSite=Lax; Secure";
+      } catch {
+        // Cookies disabled — the modal just won't persist its
+        // dismissal across reloads. Acceptable degradation.
+      }
+      render();
+    }
+
+    function renderWelcomeModal() {
+      if (!shouldShowWelcome()) return "";
+      return `
+        <div class="buy-overlay" onclick="if(event.target===this)dismissWelcome()">
+          <div class="buy-modal" role="dialog" aria-modal="true"
+               style="max-width:560px;">
+            <div class="buy-header">
+              <h2>Welcome to Recaps</h2>
+              <button class="close-btn" onclick="dismissWelcome()" aria-label="Close">&times;</button>
+            </div>
+            <div class="buy-body">
+              <p style="font-size:14px;color:#cbd5e1;line-height:1.55;margin-bottom:18px;">
+                Recaps turns long videos and podcasts into scannable, timestamped summaries
+                so you only spend time on the parts that interest you.
+              </p>
+              <ul class="welcome-bullets">
+                <li>
+                  <strong>Paste any YouTube or podcast link</strong>
+                  <span>including Apple Podcasts, Spotify, Fountain, and RSS feeds.</span>
+                </li>
+                <li>
+                  <strong>AI-powered topic summaries with timestamps</strong>
+                  <span>tap any time to jump to that moment.</span>
+                </li>
+                <li>
+                  <strong>Full transcript on demand</strong>
+                  <span>expand any topic to read what was actually said.</span>
+                </li>
+                <li>
+                  <strong>Library, subscriptions, and auto-queue</strong>
+                  <span>track channels + podcasts and auto-process new episodes
+                  (Pro feature).</span>
+                </li>
+                <li>
+                  <strong>Pay your way</strong>
+                  <span>try without signup, top up with Bitcoin per credit,
+                  subscribe monthly, or self-host with your own LLM keys.</span>
+                </li>
+                <li>
+                  <strong>Find signal faster</strong>
+                  <span>Recaps helps you spot what's worth your time and skip the rest.</span>
+                </li>
+              </ul>
+              <div style="margin-top:24px;display:flex;justify-content:center;">
+                <button class="buy-select-btn buy-select-btn-primary"
+                        onclick="dismissWelcome()"
+                        style="min-width:220px;">
+                  Get started &rarr;
+                </button>
+              </div>
+            </div>
+          </div>
+        </div>
+      `;
+    }
+
+    // ────────────────────────────────────────────────────────────────────
+    // Tier signup modal — the "Sign up" pill's destination for anon
+    // visitors. Three cards: Free (magic-link signup, no payment),
+    // Pro/Max (buy + create-account-via-magic-link-after-settle).
+    // Pro/Max policies come from /api/license/policies which we made
+    // anon-accessible in v0.2.93. The Free card is a synthetic local
+    // card (Keysat doesn't have a "no license" policy).
+    // ────────────────────────────────────────────────────────────────────
+    let tierSignupPollTimer = null;
+
+    async function openTierSignupModal() {
+      state.tierSignupOpen = true;
+      state.tierSignupView = "cards";
+      state.tierSignupLoading = true;
+      state.tierSignupError = null;
+      state.tierSignupPolicies = null;
+      state.tierSignupEmail = "";
+      state.tierSignupSelectedTier = null;
+      state.tierSignupBusy = false;
+      state.tierSignupInvoice = null;
+      state.tierSignupPollError = null;
+      render();
+      try {
+        const res = await fetch(`${API_BASE}/api/license/policies`);
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        const data = await res.json();
+        state.tierSignupPolicies = data;
+        state.tierSignupLoading = false;
+        render();
+      } catch (e) {
+        state.tierSignupError = e.message || "Couldn't load tiers.";
+        state.tierSignupLoading = false;
+        render();
+      }
+    }
+
+    function closeTierSignupModal() {
+      state.tierSignupOpen = false;
+      if (tierSignupPollTimer) {
+        clearInterval(tierSignupPollTimer);
+        tierSignupPollTimer = null;
+      }
+      render();
+    }
+
+    // User picked a tier card. For Free, switch to email-collection
+    // view. For Pro/Max, also switch — same email-collection view
+    // but the submit handler does a license purchase instead.
+    function tierSignupSelect(slug) {
+      state.tierSignupSelectedTier = slug;
+      state.tierSignupView = "email";
+      state.tierSignupError = null;
+      render();
+    }
+
+    function tierSignupBack() {
+      if (tierSignupPollTimer) {
+        clearInterval(tierSignupPollTimer);
+        tierSignupPollTimer = null;
+      }
+      state.tierSignupView = "cards";
+      state.tierSignupSelectedTier = null;
+      state.tierSignupError = null;
+      state.tierSignupInvoice = null;
+      state.tierSignupPollError = null;
+      render();
+    }
+
+    // fetchWithRetry — wraps fetch with one silent retry on a network
+    // failure (TypeError). iOS Safari sometimes silently aborts the
+    // first fetch from a cold tab and surfaces it as "Load failed",
+    // which the user sees as a misleading error on flows where the
+    // server would have happily processed the request. Short backoff,
+    // single retry. Server errors (4xx/5xx) are NOT retried — those
+    // are deliberate responses, not transport flakes.
+    async function fetchWithRetry(input, init) {
+      try {
+        return await fetch(input, init);
+      } catch (err) {
+        // Wait ~500ms then try once more. The TCP/TLS state is warm
+        // by then and the second attempt nearly always succeeds.
+        await new Promise((r) => setTimeout(r, 500));
+        return await fetch(input, init);
+      }
+    }
+
+    async function tierSignupSubmit() {
+      const email = (state.tierSignupEmail || "").trim();
+      const slug = state.tierSignupSelectedTier;
+      if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+        state.tierSignupError = "Enter a valid email.";
+        render();
+        return;
+      }
+      state.tierSignupBusy = true;
+      state.tierSignupError = null;
+      render();
+      try {
+        if (slug === "free") {
+          // Free path: request-link is the standard magic-link flow.
+          const res = await fetchWithRetry(`${API_BASE}/auth/request-link`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ email }),
+          });
+          if (!res.ok) {
+            const body = await res.json().catch(() => ({}));
+            throw new Error(body.message || `HTTP ${res.status}`);
+          }
+          state.tierSignupView = "free_sent";
+        } else {
+          // Pro/Max path: license purchase. On settle the server
+          // creates the user + attaches the license + sends a
+          // magic-link with celebratory copy.
+          const res = await fetchWithRetry(`${API_BASE}/api/license/purchase`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ policySlug: slug, buyerEmail: email }),
+          });
+          const data = await res.json().catch(() => ({}));
+          if (!res.ok || !data.checkout_url) {
+            throw new Error(
+              data.message || data.error || `HTTP ${res.status}`,
+            );
+          }
+          const policy = (state.tierSignupPolicies?.policies || []).find(
+            (p) => p.slug === slug,
+          );
+          state.tierSignupInvoice = {
+            invoiceId: data.invoice_id,
+            checkoutUrl: data.checkout_url,
+            tierLabel: policy?.name || "Pro",
+          };
+          state.tierSignupView = "polling";
+          // Open BTCPay checkout in a new tab and start polling.
+          try { window.open(data.checkout_url, "_blank", "noopener"); } catch {}
+          startTierSignupPoll();
+        }
+      } catch (e) {
+        state.tierSignupError = e.message || "Something went wrong.";
+      } finally {
+        state.tierSignupBusy = false;
+        render();
+      }
+    }
+
+    function startTierSignupPoll() {
+      if (tierSignupPollTimer) clearInterval(tierSignupPollTimer);
+      tierSignupPollTimer = setInterval(pollTierSignupInvoice, 4000);
+      // Fire one immediate poll too, so a fast-pay buyer doesn't wait.
+      pollTierSignupInvoice();
+    }
+
+    async function pollTierSignupInvoice() {
+      const inv = state.tierSignupInvoice;
+      if (!inv?.invoiceId) return;
+      try {
+        const res = await fetch(
+          `${API_BASE}/api/license/poll/${encodeURIComponent(inv.invoiceId)}`,
+        );
+        const data = await res.json().catch(() => ({}));
+        if (data?.status === "settled") {
+          if (tierSignupPollTimer) {
+            clearInterval(tierSignupPollTimer);
+            tierSignupPollTimer = null;
+          }
+          state.tierSignupView = "purchase_sent";
+          render();
+        } else if (data?.status === "expired" || data?.status === "invalid") {
+          if (tierSignupPollTimer) {
+            clearInterval(tierSignupPollTimer);
+            tierSignupPollTimer = null;
+          }
+          state.tierSignupPollError =
+            "Invoice expired before payment. You can start again.";
+          render();
+        }
+      } catch (e) {
+        // Transient — keep polling; only surface a banner if the
+        // operator's relay or Keysat goes down for more than a few
+        // ticks.
+        state.tierSignupPollError = e.message || "Poll error";
+        render();
+      }
+    }
+
+    function reopenTierSignupCheckout() {
+      const url = state.tierSignupInvoice?.checkoutUrl;
+      if (url) {
+        try { window.open(url, "_blank", "noopener"); } catch {}
+      }
+    }
+
+    function renderTierSignupModal() {
+      if (!state.tierSignupOpen) return "";
+      let inner;
+      if (state.tierSignupLoading && !state.tierSignupPolicies) {
+        inner = `<div class="buy-loading">Loading tiers…</div>`;
+      } else if (state.tierSignupError && state.tierSignupView === "cards") {
+        inner = `
+          <div class="buy-error">
+            <strong>Couldn't load tiers.</strong>
+            <div style="margin-top:6px;font-size:12px;color:#fca5a5;">${escHtml(state.tierSignupError)}</div>
+            <button class="buy-retry-btn" onclick="openTierSignupModal()">Try again</button>
+          </div>`;
+      } else if (state.tierSignupView === "email") {
+        inner = renderTierSignupEmailView();
+      } else if (state.tierSignupView === "free_sent") {
+        inner = renderTierSignupSentView({ paid: false });
+      } else if (state.tierSignupView === "purchase_sent") {
+        inner = renderTierSignupSentView({ paid: true });
+      } else if (state.tierSignupView === "polling") {
+        inner = renderTierSignupPollingView();
+      } else {
+        inner = renderTierSignupCards();
+      }
+      return `
+        <div class="buy-overlay" onclick="if(event.target===this)closeTierSignupModal()">
+          <div class="buy-modal" role="dialog" aria-modal="true">
+            <div class="buy-header">
+              <h2>Create your Recaps account</h2>
+              <button class="close-btn" onclick="closeTierSignupModal()" aria-label="Close">&times;</button>
+            </div>
+            <div class="buy-body">
+              ${inner}
+            </div>
+          </div>
+        </div>
+      `;
+    }
+
+    function renderTierSignupCards() {
+      // Synthetic Free card prepended; Pro/Max pulled from policies.
+      // Copy depends on the operator's tenant_default_credits config:
+      //   - 0:  "Your trial credits transfer to your account." (no
+      //         signup bonus — operator's choice. Grant's setup.)
+      //   - N>0: "N credits added at signup + your trial credits
+      //          transfer." (signup is a credit boost.)
+      // Existing trial credits ALWAYS transfer via linkToUser, so we
+      // mention that in both cases.
+      const grant = state.account?.signup_grant_credits ?? 0;
+      const grantBullet =
+        grant > 0
+          ? `<li>${grant} extra credit${grant === 1 ? "" : "s"} added at signup, no payment required</li>`
+          : "";
+      // Phrase the transfer-over bullet to be friendly even when the
+      // visitor doesn't have a trial cookie yet (they will after they
+      // click Create Account → request-link round trip → first
+      // /api/process call).
+      const transferBullet = `<li>Any trial credits you've already earned transfer to your account</li>`;
+      return `
+        <div class="buy-tier-grid">
+          <div class="buy-tier">
+            <div class="buy-tier-top">
+              <div class="buy-tier-name">Free</div>
+            </div>
+            <div class="buy-tier-desc">No payment required — magic-link sign-in.</div>
+            <div class="buy-price-row">
+              <span class="buy-price-new">0<span class="buy-price-unit"> sats</span></span>
+            </div>
+            <ul class="buy-bullets">
+              ${grantBullet}
+              ${transferBullet}
+              <li>Library saved to your account</li>
+              <li>Sign in from any device via email</li>
+            </ul>
+            <button class="buy-select-btn" onclick="tierSignupSelect('free')">
+              Create free account &rarr;
+            </button>
+          </div>
+          ${(state.tierSignupPolicies?.policies || []).map(renderTierSignupCard).join("")}
+        </div>
+      `;
+    }
+
+    function renderTierSignupCard(p) {
+      const isHighlighted = !!p.highlighted;
+      const isRecurring = !!p.is_recurring;
+      const cadence = isRecurring ? cadenceSuffix(p.renewal_period_days || 30) : "";
+      const baseSats = typeof p.price_sats === "number" ? p.price_sats : 0;
+      const bullets =
+        Array.isArray(p.marketing_bullets) && p.marketing_bullets.length > 0
+          ? `<ul class="buy-bullets">${p.marketing_bullets
+              .map((b) => `<li>${escHtml(b)}</li>`)
+              .join("")}</ul>`
+          : "";
+      const badge = isHighlighted
+        ? `<span class="buy-badge">Most popular</span>`
+        : "";
+      return `
+        <div class="buy-tier ${isHighlighted ? "buy-tier-highlighted" : ""}">
+          <div class="buy-tier-top">
+            <div class="buy-tier-name">${escHtml(p.name || p.slug || "")}</div>
+            <div class="buy-tier-badges">${badge}</div>
+          </div>
+          ${p.description ? `<div class="buy-tier-desc">${escHtml(p.description)}</div>` : ""}
+          <div class="buy-price-row">
+            <span class="buy-price-new">${formatSats(baseSats)}<span class="buy-price-unit"> sats${cadence}</span></span>
+          </div>
+          ${bullets}
+          <button class="buy-select-btn ${isHighlighted ? "buy-select-btn-primary" : ""}"
+            onclick="tierSignupSelect('${escAttr(p.slug)}')">
+            Sign up + Pay &rarr;
+          </button>
+        </div>
+      `;
+    }
+
+    function renderTierSignupEmailView() {
+      const slug = state.tierSignupSelectedTier;
+      const isFree = slug === "free";
+      const policy = isFree
+        ? null
+        : (state.tierSignupPolicies?.policies || []).find((p) => p.slug === slug);
+      const tierName = isFree ? "Free" : policy?.name || "Pro";
+      const priceLine = isFree
+        ? "No payment — just enter your email and we'll send a sign-in link."
+        : `${formatSats(policy?.price_sats || 0)} sats${policy?.is_recurring ? cadenceSuffix(policy.renewal_period_days || 30) : ""}. We'll send a sign-in link to this email once payment lands.`;
+      const submitLabel = state.tierSignupBusy
+        ? isFree ? "Sending…" : "Opening checkout…"
+        : isFree ? "Send sign-in link" : "Continue to checkout →";
+      const errorBlock = state.tierSignupError
+        ? `<div class="buy-poll-error">${escHtml(state.tierSignupError)}</div>`
+        : "";
+      return `
+        <div style="padding:4px 2px;">
+          <button class="buy-back-link" onclick="tierSignupBack()">&larr; Back to tiers</button>
+          <h3 style="font-size:18px;font-weight:600;color:#f5f9ff;margin:14px 0 4px;">${escHtml(tierName)}</h3>
+          <p style="font-size:13px;color:#94a3b8;line-height:1.55;margin-bottom:18px;">${escHtml(priceLine)}</p>
+          <label style="display:block;font-size:12px;font-weight:600;color:#cbd5e1;margin-bottom:6px;">Email</label>
+          <input type="email"
+            value="${escAttr(state.tierSignupEmail || "")}"
+            oninput="state.tierSignupEmail=this.value"
+            onkeydown="if(event.key==='Enter')tierSignupSubmit()"
+            ${state.tierSignupBusy ? "disabled" : ""}
+            style="width:100%;padding:11px 14px;font-size:15px;background:#0a0e1a;color:#f5f9ff;border:1px solid #1f2942;border-radius:8px;outline:none;font-family:inherit;-webkit-text-fill-color:#f5f9ff;-webkit-box-shadow:0 0 0 1000px #0a0e1a inset;" />
+          <button class="buy-select-btn buy-select-btn-primary" onclick="tierSignupSubmit()"
+            ${state.tierSignupBusy ? "disabled" : ""}
+            style="margin-top:14px;width:100%;">
+            ${submitLabel}
+          </button>
+          ${errorBlock}
+        </div>
+      `;
+    }
+
+    function renderTierSignupPollingView() {
+      const inv = state.tierSignupInvoice;
+      const errorBlock = state.tierSignupPollError
+        ? `<div class="buy-poll-error">${escHtml(state.tierSignupPollError)}</div>`
+        : "";
+      return `
+        <div class="buy-polling">
+          <div class="buy-polling-spinner">⏳</div>
+          <h3>Waiting for payment…</h3>
+          <p>
+            Your <strong>${escHtml(inv?.tierLabel || "Pro")}</strong> invoice is open in another tab.
+            Once you pay, we'll create your account and send a sign-in link to
+            <strong>${escHtml(state.tierSignupEmail)}</strong>.
+          </p>
+          <div class="buy-polling-actions">
+            <button class="buy-secondary-btn" onclick="reopenTierSignupCheckout()">Reopen checkout</button>
+            <button class="buy-secondary-btn" onclick="closeTierSignupModal()">Cancel &amp; close</button>
+          </div>
+          ${errorBlock}
+        </div>
+      `;
+    }
+
+    function renderTierSignupSentView({ paid }) {
+      const verb = paid ? "Payment received" : "Check your email";
+      const detail = paid
+        ? `Your <strong>${escHtml(state.tierSignupInvoice?.tierLabel || "Pro")}</strong> account is being created. We've sent a sign-in link to <strong>${escHtml(state.tierSignupEmail)}</strong> — your license is already attached.`
+        : `We've sent a sign-in link to <strong>${escHtml(state.tierSignupEmail)}</strong>. Click the link to finish creating your account. Link expires in 15 minutes.`;
+      return `
+        <div class="buy-polling" style="text-align:center;">
+          <div class="buy-polling-spinner">${paid ? "✓" : "📬"}</div>
+          <h3>${verb}</h3>
+          <p style="line-height:1.55;">${detail}</p>
+          <div class="buy-polling-actions">
+            <button class="buy-secondary-btn" onclick="closeTierSignupModal()">Close</button>
+          </div>
+        </div>
+      `;
+    }
+
     function render() {
       // Admin login gate (set via the StartOS "Set Admin Password"
       // action) takes priority over everything: nobody — licensed or
@@ -2753,19 +6409,38 @@
               </svg>
             </button>
           </div>
-          <div class="top-bar-input">
+          <div class="top-bar-input" style="position:relative;">
+            <button class="info-btn" type="button" onclick="toggleFormatsInfo(event)"
+              title="What can I recap?"
+              aria-label="What can I recap?">
+              <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                <circle cx="12" cy="12" r="10"></circle>
+                <line x1="12" y1="16" x2="12" y2="12"></line>
+                <line x1="12" y1="8" x2="12.01" y2="8"></line>
+              </svg>
+            </button>
             <input type="text" class="url-input"
-              placeholder="${state.loading ? (free ? "Wait for the current video — free mode is one at a time" : "Paste another URL to queue it...") : "Paste a YouTube video, channel, or podcast RSS URL..."}"
+              placeholder="${state.loading ? (free ? "Wait — free mode is one at a time" : "Paste another link to queue…") : "YouTube or podcast link…"}"
               value="${escHtml(state.url)}"
               oninput="state.url=this.value; updateInputMode()"
               onkeydown="if(event.key==='Enter'){ isSubscribeUrl(state.url) ? handleSubscribeClick() : handleSubmit() }" />
             <button class="submit-btn"
               onclick="${isSubscribeUrl(state.url) ? "handleSubscribeClick()" : "handleSubmit()"}"
               ${submitDisabled ? "disabled" : ""}
+              aria-label="${isSubscribeUrl(state.url) ? "Subscribe" : (state.loading ? "Queue" : "Summarize")}"
+              title="${isSubscribeUrl(state.url) ? "Subscribe" : (state.loading ? "Queue" : "Summarize")}"
               style="${isSubscribeUrl(state.url) ? "background:#6366f1" : ""}">
-              ${isSubscribeUrl(state.url) ? (state.addingSubLoading ? "Subscribing..." : "Subscribe") : (state.loading ? "Queue" : "Summarize")}
+              <span class="submit-btn-text">${isSubscribeUrl(state.url) ? (state.addingSubLoading ? "Subscribing..." : "Subscribe") : (state.loading ? "Queue" : "Summarize")}</span>
+              <span class="submit-btn-icon" aria-hidden="true">
+                <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
+                  <line x1="5" y1="12" x2="19" y2="12"></line>
+                  <polyline points="12 5 19 12 12 19"></polyline>
+                </svg>
+              </span>
             </button>
+            ${state.formatsInfoOpen ? renderFormatsInfoCard() : ""}
           </div>
+          ${renderProcessingBreadcrumb()}
           ${renderToolbarStatus()}
           <div class="top-actions">
             ${state.clipCollection.length > 0 && hasEntitlement("clips") ? `
@@ -2781,11 +6456,11 @@
                 <line x1="18" y1="6" x2="6" y2="18"></line><line x1="6" y1="6" x2="18" y2="18"></line>
               </svg>
             </button>` : ""}
-            <button class="icon-btn ${state.logOpen ? "active" : ""}" onclick="toggleLog()" title="Activity Log">
+            ${isAdmin() ? `<button class="icon-btn ${state.logOpen ? "active" : ""}" onclick="toggleLog()" title="Activity Log">
               <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
                 <polyline points="4 17 10 11 4 5"></polyline><line x1="12" y1="19" x2="20" y2="19"></line>
               </svg>
-            </button>
+            </button>` : ""}
             <button class="icon-btn ${state.settingsOpen ? "active" : ""} ${state.ytdlpVersion === false || state.ytdlpUpdateAvailable ? "needs-attention" : ""}"
               onclick="toggleSettings()" title="Settings">
               <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
@@ -2804,6 +6479,34 @@
           </button>
           <div class="mobile-menu-overlay ${state.mobileMenuOpen ? "open" : ""}" onclick="closeMobileMenu()"></div>
           <div class="mobile-menu-dropdown ${state.mobileMenuOpen ? "open" : ""}">
+            ${renderMobileMenuAccountSection()}
+            <!-- Library — the always-visible clock icon next to the URL
+                 input is hidden on mobile to give the input + Summarize
+                 button room. Toggle the same sidebar from here. -->
+            <button class="mobile-menu-item ${state.historyOpen ? "active" : ""}" onclick="closeMobileMenu(); toggleHistory()">
+              <span class="menu-icon">
+                <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                  <circle cx="12" cy="12" r="10"></circle><polyline points="12 6 12 12 16 14"></polyline>
+                </svg>
+              </span> Library
+            </button>
+            <!-- "What can I recap?" — the desktop info icon next to
+                 the input bar is hidden on mobile; surface the same
+                 popover via the hamburger menu so visitors aren't
+                 left guessing what kinds of links work. The event arg
+                 to toggleFormatsInfo is CRITICAL — without it the
+                 click-outside doc handler immediately closes the
+                 popover that this very click just opened. -->
+            <button class="mobile-menu-item" onclick="event.stopPropagation(); closeMobileMenu(); toggleFormatsInfo(event)">
+              <span class="menu-icon">
+                <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                  <circle cx="12" cy="12" r="10"></circle>
+                  <line x1="12" y1="16" x2="12" y2="12"></line>
+                  <line x1="12" y1="8" x2="12.01" y2="8"></line>
+                </svg>
+              </span> What can I recap?
+            </button>
+            <div class="mobile-menu-sep"></div>
             ${state.clipCollection.length > 0 && hasEntitlement("clips") ? `
               <button class="mobile-menu-item" onclick="closeMobileMenu(); toggleClipPanel()">
                 <span class="menu-icon">📎</span> Clips
@@ -2815,13 +6518,13 @@
                 <span class="menu-icon">✕</span> Close Video
               </button>
             ` : ""}
-            <button class="mobile-menu-item ${state.logOpen ? "active" : ""}" onclick="closeMobileMenu(); toggleLog()">
+            ${isAdmin() ? `<button class="mobile-menu-item ${state.logOpen ? "active" : ""}" onclick="closeMobileMenu(); toggleLog()">
               <span class="menu-icon">
                 <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
                   <polyline points="4 17 10 11 4 5"></polyline><line x1="12" y1="19" x2="20" y2="19"></line>
                 </svg>
               </span> Activity Log
-            </button>
+            </button>` : ""}
             <button class="mobile-menu-item ${state.settingsOpen ? "active" : ""}" onclick="closeMobileMenu(); toggleSettings()">
               <span class="menu-icon">
                 <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
@@ -2833,8 +6536,22 @@
           </div>
         </div>
 
+        <!-- Mobile pizza tracker — lives as a sibling of .top-bar
+             (NOT inside it). The desktop copy is rendered inline in
+             .top-bar via renderProcessingBreadcrumb() above; iOS
+             Safari's flex-wrap + position:sticky combo was leaving it
+             invisible on phones. Hoisting the mobile copy out of the
+             flex container sidesteps the bug entirely. CSS swaps
+             which copy is visible per viewport. -->
+        ${renderProcessingBreadcrumb("mobile")}
+
         <!-- Settings modal -->
         ${state.settingsOpen ? renderSettingsModal() : ""}
+        ${renderBuyModal()}
+        ${renderSubscribeModal()}
+        ${renderBuyCreditsModal()}
+        ${renderTierSignupModal()}
+        ${renderWelcomeModal()}
 
         ${renderCurrentJobBanner()}
         <!-- renderUpgradeBanner moved inline into the top toolbar via
@@ -2847,10 +6564,10 @@
 
         ${state.error ? `<div class="error-box">${escHtml(state.error)}</div>` : ""}
 
-        ${state.loading && (state.videoId || state.currentType === "podcast") ? renderLoadingSplit() : ""}
+        ${state.loading && (state.videoId || state.currentType === "podcast") && !state.streaming ? renderLoadingSplit() : ""}
         ${state.loading && !state.videoId && state.currentType !== "podcast" ? renderLoading() : ""}
 
-        ${state.chunks.length > 0 && !state.loading ? renderResults() : ""}
+        ${(state.chunks.length > 0 && !state.loading) || state.streaming ? renderResults() : ""}
 
         ${!state.loading && state.error && state.videoId && state.chunks.length === 0 && state.currentType !== "podcast" ? renderErroredVideoPlaceholder() : ""}
 
@@ -2859,7 +6576,23 @@
         ${state.historyOpen ? renderHistorySidebar() : ""}
         ${state.clipPanelOpen ? renderClipPanel() : ""}
       `;
+        // Preserve the settings modal's scroll position AND suppress its
+        // slide-up animation across re-renders. A full render() rebuilds the
+        // modal DOM, which would otherwise jump it back to the top and
+        // replay the "flash" on every edit (e.g. setting a tenant's tier
+        // deep in the list). First open — when no modal existed yet —
+        // animates normally.
+        const __settingsEl = document.querySelector(".settings-modal");
+        const __settingsWasOpen = !!__settingsEl;
+        const __settingsScroll = __settingsEl ? __settingsEl.scrollTop : 0;
         app.innerHTML = __renderedHtml;
+        if (__settingsWasOpen) {
+          const __m = document.querySelector(".settings-modal");
+          if (__m) {
+            __m.style.animation = "none";
+            __m.scrollTop = __settingsScroll;
+          }
+        }
       } catch (renderErr) {
         // A thrown exception inside any ${...} expression silently aborts
         // the innerHTML assignment, leaving the previous DOM in place — so
@@ -2874,14 +6607,33 @@
         </div>`;
         return;
       }
-      // Re-init player if the yt-player div exists
-      if (state.videoId && ytReady && document.getElementById("yt-player")) {
+      // Re-init player if the yt-player div exists AND is empty
+      // (i.e. either freshly created by this render or had its
+      // iframe destroyed). If the div already has an iframe child,
+      // the player is still mounted and rebuilding it just causes a
+      // black-iframe flicker — which was the symptom seen after
+      // Cancel mid-stream, where the render path swapped from
+      // renderLoadingSplit (mounted player) to renderResults (fresh
+      // empty div) and the destroy/recreate raced.
+      const ytDiv = document.getElementById("yt-player");
+      const needsMount = state.videoId && ytReady && ytDiv && !ytDiv.querySelector("iframe");
+      if (needsMount) {
         setTimeout(() => initPlayer(state.videoId), 50);
       }
       // Init podcast audio player if present
       if (document.getElementById("podcast-audio")) {
         setTimeout(initPodcastPlayer, 50);
       }
+      // Paint the inline Lightning QR if the buy-credits modal is in
+      // polling view with a bolt11 invoice. Deferred so the mount
+      // node is definitely in the DOM by the time we look it up.
+      if (state.buyCreditsOpen && state.buyCreditsView === "polling" && state.buyCreditsInvoice?.bolt11) {
+        setTimeout(mountBuyCreditsQr, 0);
+      }
+      // Same for the subscribe modal's inline bitcoin invoice.
+      if (state.subscribeOpen && state.subscribeView === "polling" && state.subscribeInvoice?.bolt11) {
+        setTimeout(mountSubscribeQr, 0);
+      }
       // Restore lastSeekTarget so toggle-play still works after render
       lastSeekTarget = savedLastSeekTarget;
       // Restore library sidebar scroll position so deleting/editing items
@@ -2933,7 +6685,7 @@
               <div>Entitlements: ${(lic.entitlements || []).map(e => escHtml(e)).join(", ") || "none"}</div>
             </div>
             <div class="lic-actions">
-              ${!isProTier() ? `<a class="lic-btn" href="${escHtml(upgradeToProUrl())}" target="_blank" rel="noopener" style="background:#a855f7;color:#fff;border-color:#a855f7;">Upgrade to Pro</a>` : ""}
+              ${!isProTier() ? `<button class="lic-btn" onclick="openBuyModal()" style="background:#a855f7;color:#fff;border-color:#a855f7;cursor:pointer;">Upgrade to Pro</button>` : ""}
               <button class="lic-btn danger" onclick="deactivateLicense()">Deactivate</button>
             </div>
           ` : `
@@ -2964,12 +6716,28 @@
       const errorBadge = rs.lastError
         ? `<span style="color:#f87171;font-size:10px;">&middot; ${escHtml(rs.lastError.slice(0, 80))}</span>`
         : "";
+      // "Buy more" button — opens the credit-purchase modal. Hidden
+      // on the unlimited / unknown-balance branches (no scarcity to
+      // upsell). Anon trial visitors can also click this as of
+      // v0.2.90 — credits go on their cookie, transfer to their
+      // account on signup.
+      const buyMoreBtn =
+        credits != null && credits !== Infinity && credits >= 0
+          ? `<button onclick="openBuyCreditsModal()"
+              title="Top up your Recap credits with Lightning"
+              style="background:rgba(99,102,241,0.20);color:#a5b4fc;border:1px solid rgba(99,102,241,0.45);padding:3px 10px;border-radius:6px;cursor:pointer;font-size:10px;font-weight:600;margin-left:auto;"
+              onmouseover="this.style.background='rgba(99,102,241,0.30)'"
+              onmouseout="this.style.background='rgba(99,102,241,0.20)'">
+              Buy more &rarr;
+            </button>`
+          : "";
       return `
         <div style="display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin:6px 0 8px;padding:6px 10px;background:rgba(99,102,241,0.10);border:1px solid rgba(99,102,241,0.30);border-radius:8px;font-size:11px;color:#cbd5e1;">
           <span style="font-weight:600;color:#a5b4fc;">Relay</span>
           <span>&middot; Tier: <strong style="color:#e2e8f0;">${tierLabel}</strong></span>
           <span>&middot; ${creditLabel}</span>
           ${errorBadge}
+          ${buyMoreBtn}
         </div>
       `;
     }
@@ -2977,30 +6745,33 @@
     function renderProvidersBlock() {
       const tp = PROVIDER_BY_ID[state.transcriptionProvider] || PROVIDERS[0];
       const ap = PROVIDER_BY_ID[state.analysisProvider] || PROVIDERS[0];
-      // Show the "Use comped credits" reset link when the user has
-      // strayed from the relay defaults. One-click way back to the
-      // out-of-the-box state without having to manually click both
-      // dropdowns.
-      const onRelayDefaults =
-        state.transcriptionProvider === "relay" &&
-        state.analysisProvider === "relay";
-      const resetLink = onRelayDefaults
+      // Two-tier picker: master mode at the top (Recap Relay vs Custom
+      // Provider/Local), with per-step pickers shown ONLY in custom
+      // mode. In relay mode the per-step pickers are hidden because
+      // "relay" is all-or-nothing — the relay's chunked-pipeline
+      // endpoint does TX and AN together server-side, so there's
+      // nothing to configure per step.
+      const isRelayMode = state.providerMode === "relay";
+      const modeButton = (mode, label, sublabel) => {
+        const active = state.providerMode === mode;
+        return `
+          <button type="button" onclick="setProviderMode('${mode}')"
+            style="flex:1 1 0;padding:10px 12px;border-radius:8px;cursor:pointer;text-align:left;
+              background:${active ? "rgba(99,102,241,0.18)" : "rgba(30,41,59,0.4)"};
+              border:1px solid ${active ? "rgba(99,102,241,0.55)" : "#334155"};
+              color:${active ? "#e0e7ff" : "#cbd5e1"};">
+            <div style="font-size:12px;font-weight:600;">${escHtml(label)}</div>
+            <div style="font-size:10px;color:${active ? "#a5b4fc" : "#64748b"};margin-top:2px;">${escHtml(sublabel)}</div>
+          </button>
+        `;
+      };
+      const customPickers = isRelayMode
         ? ""
-        : `<button onclick="resetProvidersToRelay()" title="Reset both pickers to use the operator's relay (comped credits) — your saved keys for other providers are kept, just unselected."
-            style="background:transparent;color:#a5b4fc;border:1px solid rgba(99,102,241,0.35);padding:4px 10px;border-radius:6px;cursor:pointer;font-size:10px;font-weight:600;margin-top:4px;align-self:flex-start;"
-            onmouseover="this.style.background='rgba(99,102,241,0.10)'"
-            onmouseout="this.style.background='transparent'">
-            ↺ Use comped credits (reset to relay)
-          </button>`;
-      return `
-        <label class="field-label" style="margin-top:14px;">AI Providers</label>
-        ${renderRelayStatusPill()}
-        <div style="display:flex;flex-direction:column;gap:10px;border:1px solid #334155;background:rgba(30,41,59,0.3);border-radius:8px;padding:12px;">
-          ${resetLink}
+        : `
           <div style="display:flex;flex-direction:column;gap:4px;">
             <span style="font-size:11px;color:#94a3b8;font-weight:600;">Transcription</span>
             <div style="display:flex;gap:6px;flex-wrap:wrap;">
-              ${renderProviderSelect("transcription", TRANSCRIBE_PROVIDERS, state.transcriptionProvider)}
+              ${renderProviderSelect("transcription", NON_RELAY_TRANSCRIBE_PROVIDERS, state.transcriptionProvider)}
               <span data-model-slot="transcription" style="display:flex;flex:1 1 160px;min-width:140px;">${renderModelInput("transcription", tp, state.transcriptionModel)}</span>
             </div>
             <span style="font-size:10px;color:#64748b;">${escHtml(tp.canTranscribe ? "Audio → text" : "(provider does not support audio — pick gemini or openai)")}</span>
@@ -3008,11 +6779,31 @@
           <div style="display:flex;flex-direction:column;gap:4px;">
             <span style="font-size:11px;color:#94a3b8;font-weight:600;">Analysis</span>
             <div style="display:flex;gap:6px;flex-wrap:wrap;">
-              ${renderProviderSelect("analysis", ANALYZE_PROVIDERS, state.analysisProvider)}
+              ${renderProviderSelect("analysis", NON_RELAY_ANALYZE_PROVIDERS, state.analysisProvider)}
               <span data-model-slot="analysis" style="display:flex;flex:1 1 160px;min-width:140px;">${renderModelInput("analysis", ap, state.analysisModel)}</span>
             </div>
             <span style="font-size:10px;color:#64748b;">Topic structuring (text → JSON) &middot; falls back through remaining models if your chosen one fails</span>
           </div>
+        `;
+      const relayModeBlurb = isRelayMode
+        ? `
+          <div style="padding:8px 12px;background:rgba(99,102,241,0.08);border:1px dashed rgba(99,102,241,0.30);border-radius:6px;font-size:11px;color:#cbd5e1;line-height:1.5;">
+            The operator's relay handles both transcription and analysis end-to-end.
+            One credit per summary. Chunking + concurrency are tuned by the operator
+            in their relay dashboard — you don't need to configure anything.
+          </div>
+        `
+        : "";
+      return `
+        <label class="field-label" style="margin-top:14px;">AI Providers</label>
+        ${renderRelayStatusPill()}
+        <div style="display:flex;flex-direction:column;gap:10px;border:1px solid #334155;background:rgba(30,41,59,0.3);border-radius:8px;padding:12px;">
+          <div style="display:flex;gap:8px;flex-wrap:wrap;">
+            ${modeButton("relay", "Recaps Relay", "Operator's pipeline, comped credits")}
+            ${modeButton("custom", "Custom Provider / Local", "Bring your own API keys or run locally")}
+          </div>
+          ${relayModeBlurb}
+          ${customPickers}
           <label style="display:flex;align-items:center;gap:8px;font-size:11px;color:#cbd5e1;cursor:pointer;padding-top:6px;border-top:1px solid #1e293b;">
             <input type="checkbox" ${state.useYouTubeCaptions ? "checked" : ""} onchange="setUseYouTubeCaptions(this.checked)" style="margin:0;" />
             <span>
@@ -3442,12 +7233,41 @@
         <div class="pro-upsell">
           <div class="pro-title">${escHtml(featureName)} &middot; Pro feature</div>
           <div class="pro-desc">${escHtml(description)}</div>
-          <a class="pro-cta" href="${escHtml(upgradeToProUrl())}" target="_blank" rel="noopener">Upgrade to Pro &rarr;</a>
+          <button class="pro-cta" onclick="openBuyModal()" style="cursor:pointer;border:none;">Upgrade to Pro &rarr;</button>
         </div>
       `;
     }
 
     function renderSettingsModal() {
+      // ── Multi-tenant tenant view (non-admin signed-in or trial) ──────
+      // Operator-only blocks (provider keys, yt-dlp status, cookies,
+      // server-side license activation) get hidden. Tenants only see
+      // their account info, their credits/library status, and a Sign
+      // out button. The operator's view (is_admin=1) falls through to
+      // the full panel below.
+      if (isMulti() && !isAdmin()) {
+        return `
+          <div class="settings-overlay" onclick="if(event.target===this)toggleSettings()">
+            <div class="settings-modal">
+              <div class="settings-modal-header">
+                <h2>Account</h2>
+                <button class="close-btn" onclick="toggleSettings()">&times;</button>
+              </div>
+              <div class="settings-modal-body">
+                ${renderTenantAccountBlock()}
+                ${renderTenantSubscriptionBlock()}
+                ${state.account?.user ? renderClaimPurchaseBlock() : ""}
+                ${state.account?.user ? renderPasswordBlock() : ""}
+                ${state.account?.user ? renderMySessionsBlock() : ""}
+                ${renderLibraryTransfer()}
+                ${state.account?.user ? renderTenantDangerZone() : ""}
+              </div>
+            </div>
+          </div>
+        `;
+      }
+
+      // ── Operator / single-mode view (existing behavior) ─────────────
       return `
         <div class="settings-overlay" onclick="if(event.target===this)toggleSettings()">
           <div class="settings-modal">
@@ -3464,12 +7284,15 @@
 
               ${renderCookieStatus()}
 
-              ${hasEntitlement("subscriptions")
+              ${canUseSubscriptions()
                 ? renderSubscriptions()
                 : `<label class="field-label">Subscriptions</label>${renderProUpsell("Channel subscriptions", "Subscribe to YouTube channels and podcast feeds, then auto-process new uploads on a schedule. Available on the Pro tier.")}`}
 
               ${renderLibraryTransfer()}
 
+              ${isMulti() && isAdmin() ? renderAdminTenantsBlock() : ""}
+              ${isMulti() && isAdmin() ? renderAdminActivityBlock() : ""}
+
               ${state.admin.enabled && state.admin.authed ? `
                 <label class="field-label" style="margin-top:12px;">Admin Session</label>
                 <div class="ytdlp-status" style="flex-direction:column;align-items:flex-start;gap:8px;border-color:#334155;background:rgba(30,41,59,0.3);">
@@ -3486,6 +7309,755 @@
       `;
     }
 
+    // Mobile-menu account section. Surfaces credits + signin/out on
+    // small screens where the desktop top-bar status pills are hidden.
+    // For single-mode installs this returns "" (no account ui needed
+    // — they're always the operator) so the menu stays tight.
+    function renderMobileMenuAccountSection() {
+      if (!isMulti()) return "";
+      const acct = state.account || {};
+      const rs = state.relayStatus || {};
+      const credits = rs.creditsRemaining;
+      // Credit display copy mirrors the desktop pill. Mobile users see
+      // the same "N Recap credits" string they'd see in the top bar.
+      let creditLine = "";
+      if (credits != null && credits >= 0) {
+        // Show the count + a Buy more item so the user can top up
+        // straight from the menu (matches the desktop "+ Buy more"
+        // affordance on the toolbar pill).
+        creditLine = `
+          <div class="mobile-menu-item" style="cursor:default;color:#cbd5e1;">
+            <span class="menu-icon">⚡</span>
+            ${credits} Recap credit${credits === 1 ? "" : "s"}
+          </div>
+          <button class="mobile-menu-item" onclick="closeMobileMenu(); openBuyCreditsModal()" style="color:#cbd5e1;">
+            <span class="menu-icon">＋</span>
+            Buy more credits
+          </button>`;
+      } else if (credits != null && credits < 0) {
+        creditLine = `<div class="mobile-menu-item" style="cursor:default;color:#cbd5e1;">
+          <span class="menu-icon">⚡</span> Unlimited Recap credits
+        </div>`;
+      } else if (acct.state === "anonymous" && (acct.available_trial_credits || 0) > 0) {
+        // Anonymous visitor with no trial cookie yet — surface the
+        // operator-configured trial allowance so they know what's
+        // available before they hit Summarize. Stacked with a Buy
+        // more menu item so they can also pre-purchase credits
+        // before spending their trial (per Grant's feedback in 0.2.94:
+        // "Buy more should be visible whenever there's a credit count").
+        const n = acct.available_trial_credits;
+        creditLine = `
+          <div class="mobile-menu-item" style="cursor:default;color:#a5b4fc;">
+            <span class="menu-icon">⚡</span>
+            ${n} free Recap credit${n === 1 ? "" : "s"} ready
+          </div>
+          <button class="mobile-menu-item" onclick="closeMobileMenu(); openBuyCreditsModal()" style="color:#cbd5e1;">
+            <span class="menu-icon">＋</span>
+            Buy more credits
+          </button>`;
+      }
+
+      // Identity row. Signed-in users see their email + Sign out.
+      // Anonymous / trial users see a Sign in CTA.
+      let identityRow = "";
+      if (acct.user && acct.user.email) {
+        const shortEmail = acct.user.email.length > 30
+          ? acct.user.email.slice(0, 28) + "…"
+          : acct.user.email;
+        identityRow = `
+          <div class="mobile-menu-item" style="cursor:default;color:#cbd5e1;flex-direction:column;align-items:flex-start;gap:2px;">
+            <span style="font-size:11px;color:#64748b;">Signed in as</span>
+            <span style="font-size:13px;color:#e2e8f0;font-weight:500;">${escHtml(shortEmail)}</span>
+          </div>
+          <a href="/auth/signout" class="mobile-menu-item" style="text-decoration:none;color:#94a3b8;">
+            <span class="menu-icon">
+              <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"></path>
+                <polyline points="16 17 21 12 16 7"></polyline>
+                <line x1="21" y1="12" x2="9" y2="12"></line>
+              </svg>
+            </span> Sign out
+          </a>`;
+      } else {
+        // Anonymous / trial visitor — two entries that mirror the
+        // desktop toolbar: primary "Sign up" opens the 3-tier
+        // (Free / Pro / Max) modal, secondary "Sign in" jumps to the
+        // magic-link form for returning users. Mobile previously only
+        // exposed "Sign in", which left new visitors without an
+        // obvious path to create an account.
+        identityRow = `
+          <button class="mobile-menu-item" onclick="closeMobileMenu(); openTierSignupModal()" style="color:#a5b4fc;font-weight:600;">
+            <span class="menu-icon">
+              <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                <circle cx="9" cy="7" r="4"></circle>
+                <path d="M3 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2"></path>
+                <line x1="19" y1="8" x2="19" y2="14"></line>
+                <line x1="22" y1="11" x2="16" y2="11"></line>
+              </svg>
+            </span> Sign up
+          </button>
+          <a href="/auth.html?intent=signin" class="mobile-menu-item" style="text-decoration:none;color:#94a3b8;">
+            <span class="menu-icon">
+              <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                <path d="M15 3h4a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2h-4"></path>
+                <polyline points="10 17 15 12 10 7"></polyline>
+                <line x1="15" y1="12" x2="3" y2="12"></line>
+              </svg>
+            </span> Sign in
+          </a>`;
+      }
+
+      // Upgrade entry for signed-in non-admin tenants. Three states:
+      //   - Free  → single "Upgrade" entry opens the buy modal at the
+      //             tier picker so the user can compare Pro vs Max
+      //             side-by-side (they may not know the difference
+      //             yet — forcing them to pick blind from the menu
+      //             would be a worse UX).
+      //   - Pro   → single "Upgrade to Max" entry opens the modal
+      //             pre-selected on Max (Pro is the only thing to
+      //             upgrade FROM, so the destination is unambiguous).
+      //   - Max   → no entry (already at top tier).
+      // Anon/trial users get the sign-up flow instead, handled in
+      // the identity row below.
+      let upgradeRows = "";
+      if (acct.user && !acct.user.is_admin) {
+        if (hasEntitlement("max")) {
+          // already top tier — nothing to upgrade
+        } else if (hasEntitlement("pro")) {
+          upgradeRows = `
+            <button class="mobile-menu-item" onclick="closeMobileMenu(); openBuyModal('max')" style="color:#fde68a;font-weight:600;">
+              <span class="menu-icon">★</span>
+              Upgrade to Max
+            </button>`;
+        } else {
+          upgradeRows = `
+            <button class="mobile-menu-item" onclick="closeMobileMenu(); openBuyModal()" style="color:#c4b5fd;font-weight:600;">
+              <span class="menu-icon">★</span>
+              Upgrade
+            </button>`;
+        }
+      }
+
+      return `
+        ${creditLine}
+        ${upgradeRows}
+        ${identityRow}
+        <div class="mobile-menu-sep"></div>
+      `;
+    }
+
+    // ── Admin: Tenants list block ─────────────────────────────────────
+    // Operator-only. Lists every signed-up user with their balance,
+    // license status, and inline "+ N credits" / "Revoke sessions"
+    // actions. Lazy-loaded — only fetched when the settings modal
+    // opens AND the operator is multi-mode admin.
+    function renderAdminTenantsBlock() {
+      const ops = state.ops;
+      const tenants = ops.tenants;
+      let body = "";
+      if (ops.tenantsLoading && tenants == null) {
+        body = `<div style="font-size:12px;color:#94a3b8;padding:6px 0;">Loading tenants…</div>`;
+      } else if (ops.tenantsError) {
+        body = `<div style="font-size:12px;color:#fca5a5;padding:6px 0;">Couldn't load tenants: ${escHtml(ops.tenantsError)}</div>`;
+      } else if (Array.isArray(tenants) && tenants.length === 0) {
+        body = `<div style="font-size:12px;color:#94a3b8;padding:6px 0;">No tenants yet. The first email to sign up becomes the operator account (already you).</div>`;
+      } else if (Array.isArray(tenants)) {
+        body = tenants.map((t) => renderTenantRow(t)).join("");
+      } else {
+        body = `<div style="font-size:12px;color:#94a3b8;padding:6px 0;">Tap Refresh to load.</div>`;
+      }
+      return `
+        <label class="field-label" style="margin-top:14px;display:flex;align-items:center;justify-content:space-between;">
+          <span>Tenants${Array.isArray(tenants) ? ` (${tenants.length})` : ""}</span>
+          <button onclick="loadAdminTenants()"
+            style="font-size:11px;font-weight:600;padding:4px 10px;background:#1e293b;color:#94a3b8;border:1px solid #334155;border-radius:6px;cursor:pointer;">
+            ${ops.tenantsLoading ? "Loading…" : "Refresh"}
+          </button>
+        </label>
+        <div class="tenants-list" style="border:1px solid #1e293b;background:rgba(15,23,42,0.4);border-radius:8px;padding:6px;display:flex;flex-direction:column;gap:4px;max-height:340px;overflow:auto;">
+          ${body}
+        </div>
+      `;
+    }
+
+    function renderTenantRow(t) {
+      const balance = typeof t.balance === "number" ? t.balance : 0;
+      // Subscription tier (relay-owned; cached on the Recaps account). The
+      // primary status indicator now that the Keysat license is decoupled.
+      const tierVal = (t.tier || "core").toLowerCase();
+      const tierStyles = {
+        max: "background:rgba(234,179,8,0.15);color:#fde68a;border:1px solid rgba(234,179,8,0.4);",
+        pro: "background:rgba(168,85,247,0.15);color:#d8b4fe;border:1px solid rgba(168,85,247,0.4);",
+        core: "background:rgba(100,116,139,0.12);color:#94a3b8;border:1px solid rgba(100,116,139,0.35);",
+      };
+      const tierBadge = `<span style="font-size:9px;font-weight:700;padding:2px 6px;border-radius:4px;${tierStyles[tierVal] || tierStyles.core}">${tierVal.toUpperCase()}</span>`;
+      // (Removed the "LIC" badge — a leftover pre-decoupling Keysat license
+      // is ignored entirely now that tier is the sole source of paid status,
+      // so surfacing it was just confusing noise.)
+      const adminBadge = t.is_admin
+        ? `<span style="font-size:9px;font-weight:700;padding:2px 6px;background:rgba(99,102,241,0.15);color:#a5b4fc;border:1px solid rgba(99,102,241,0.4);border-radius:4px;">ADMIN</span>`
+        : "";
+      const created = t.created_at
+        ? new Date(t.created_at).toLocaleDateString()
+        : "—";
+      const lastSeen = t.last_signin_at
+        ? new Date(t.last_signin_at).toLocaleDateString()
+        : "never";
+      const ipLine = t.signup_ip
+        ? `<span style="color:#475569;">· ${escHtml(t.signup_ip)}</span>`
+        : "";
+      const sessions = t.session_count || 0;
+      const grantOpen = state.ops.grantOpenFor === t.id;
+      const grantForm = grantOpen
+        ? `
+        <div style="display:flex;gap:6px;align-items:center;padding:6px 8px;background:rgba(99,102,241,0.06);border-top:1px solid rgba(99,102,241,0.2);">
+          <input type="number" min="1" max="100000" placeholder="Amount"
+            value="${escHtml(state.ops.grantAmount)}"
+            oninput="state.ops.grantAmount=this.value"
+            onkeydown="if(event.key==='Enter')submitGrantCredits('${escHtml(t.id)}')"
+            style="flex:1;padding:6px 10px;font-size:12px;background:#0a0e1a;color:#e2e8f0;border:1px solid #334155;border-radius:6px;outline:none;" />
+          <button onclick="submitGrantCredits('${escHtml(t.id)}')"
+            ${state.ops.grantBusy ? "disabled" : ""}
+            style="padding:6px 12px;font-size:11px;font-weight:600;background:#3b82f6;color:#fff;border:none;border-radius:6px;cursor:pointer;${state.ops.grantBusy ? "opacity:0.5;cursor:not-allowed;" : ""}">
+            ${state.ops.grantBusy ? "..." : "Grant"}
+          </button>
+          <button onclick="toggleGrantCreditsRow('${escHtml(t.id)}')"
+            style="padding:6px 10px;font-size:11px;background:#1e293b;color:#94a3b8;border:1px solid #334155;border-radius:6px;cursor:pointer;">
+            Cancel
+          </button>
+        </div>`
+        : "";
+      // Inline tier selector — three buttons, current tier highlighted.
+      // Writes the relay-owned subscription tier (and the local cache) via
+      // POST /api/admin/tenants/:id/tier. The operator's own admin row has
+      // no selector (admins are the operator, not a subscription).
+      const tierOpen = state.ops.tierOpenFor === t.id;
+      const tierChoice = (val, label, color) =>
+        `<button onclick="setTenantTier('${escHtml(t.id)}','${val}')"
+          ${state.ops.tierBusy ? "disabled" : ""}
+          style="flex:1;padding:6px 10px;font-size:11px;font-weight:600;background:${tierVal === val ? color : "#1e293b"};color:${tierVal === val ? "#fff" : "#cbd5e1"};border:1px solid #334155;border-radius:6px;cursor:${state.ops.tierBusy ? "not-allowed" : "pointer"};${state.ops.tierBusy ? "opacity:0.5;" : ""}">${label}</button>`;
+      const tierForm = tierOpen
+        ? `
+        <div style="display:flex;gap:6px;align-items:center;padding:6px 8px;background:rgba(168,85,247,0.06);border-top:1px solid rgba(168,85,247,0.2);">
+          ${tierChoice("core", "Core", "#64748b")}
+          ${tierChoice("pro", "Pro", "#a855f7")}
+          ${tierChoice("max", "Max", "#eab308")}
+        </div>`
+        : "";
+      return `
+        <div class="tenant-row" style="background:#0f172a;border:1px solid #1e293b;border-radius:6px;overflow:hidden;flex-shrink:0;">
+          <div style="padding:10px 12px;">
+            <div style="font-size:13px;color:#e2e8f0;font-weight:500;display:flex;align-items:center;gap:6px;flex-wrap:wrap;min-width:0;">
+              <span style="word-break:break-all;min-width:0;">${escHtml(t.email || "(no email)")}</span>
+              ${adminBadge}
+              ${t.is_admin ? "" : tierBadge}
+            </div>
+            <div style="font-size:10.5px;color:#64748b;margin-top:4px;line-height:1.5;">
+              ${balance} credit${balance === 1 ? "" : "s"} · ${sessions} session${sessions === 1 ? "" : "s"} · joined ${created} · last seen ${lastSeen} ${ipLine}
+            </div>
+            <div style="display:flex;gap:6px;margin-top:10px;flex-wrap:wrap;justify-content:flex-end;">
+              <button onclick="toggleGrantCreditsRow('${escHtml(t.id)}')"
+                title="Grant additional credits to this user"
+                style="padding:6px 10px;font-size:11px;font-weight:600;background:${grantOpen ? "#334155" : "#1e293b"};color:#cbd5e1;border:1px solid #334155;border-radius:6px;cursor:pointer;">
+                ${grantOpen ? "Close" : "+ Credits"}
+              </button>
+              ${!t.is_admin && state.ops.operatorKeyConfigured ? `<button onclick="toggleTierRow('${escHtml(t.id)}')"
+                title="Set this user's subscription tier (Core / Pro / Max)"
+                style="padding:6px 10px;font-size:11px;font-weight:600;background:${tierOpen ? "#334155" : "#1e293b"};color:#cbd5e1;border:1px solid #334155;border-radius:6px;cursor:pointer;">
+                ${tierOpen ? "Close" : "Tier"}
+              </button>` : ""}
+              ${sessions > 0 ? `<button onclick="revokeAllSessionsForTenant('${escHtml(t.id)}', '${escHtml((t.email || "").replace(/'/g, "\\'"))}')"
+                title="Sign this user out of every active session"
+                style="padding:6px 10px;font-size:11px;font-weight:600;background:#1e293b;color:#fca5a5;border:1px solid #334155;border-radius:6px;cursor:pointer;">
+                Sign out
+              </button>` : ""}
+              ${!t.is_admin ? `<button onclick="adminDeleteTenant('${escHtml(t.id)}', '${escHtml((t.email || "").replace(/'/g, "\\'"))}')"
+                title="Delete this user and their library"
+                style="padding:6px 10px;font-size:11px;font-weight:600;background:#1e293b;color:#fca5a5;border:1px solid #334155;border-radius:6px;cursor:pointer;">
+                Delete
+              </button>` : ""}
+            </div>
+          </div>
+          ${grantForm}
+          ${tierForm}
+        </div>
+      `;
+    }
+
+    // ── Admin: Recent Activity block ─────────────────────────────────
+    // Surfaces the IP/UA/hour aggregations from /api/admin/recent-signups.
+    // The window selector (24h / 7d / 14d) refetches; everything else is
+    // a passive read-only summary the operator skims for anomalies.
+    function renderAdminActivityBlock() {
+      const ops = state.ops;
+      const a = ops.activity;
+      const hoursOptions = [
+        { v: 24, label: "24h" },
+        { v: 24 * 7, label: "7d" },
+        { v: 24 * 14, label: "14d" },
+      ];
+      const windowSelector = hoursOptions
+        .map(
+          (o) => `<button onclick="loadAdminActivity(${o.v})"
+            style="padding:4px 10px;font-size:11px;font-weight:600;border:1px solid #334155;border-radius:6px;cursor:pointer;background:${ops.activityHours === o.v ? "#3b82f6" : "#1e293b"};color:${ops.activityHours === o.v ? "#fff" : "#94a3b8"};">${o.label}</button>`,
+        )
+        .join("");
+      let body = "";
+      if (ops.activityLoading && a == null) {
+        body = `<div style="font-size:12px;color:#94a3b8;padding:6px 0;">Loading activity…</div>`;
+      } else if (ops.activityError) {
+        body = `<div style="font-size:12px;color:#fca5a5;padding:6px 0;">Couldn't load activity: ${escHtml(ops.activityError)}</div>`;
+      } else if (a) {
+        const total = a.totals || {};
+        const ipRows = (a.signups_by_ip || []).slice(0, 10);
+        const linkIpRows = (a.magic_links_by_ip || []).slice(0, 10);
+        const renderIpList = (rows, kind) =>
+          rows.length === 0
+            ? `<div style="font-size:11px;color:#64748b;padding:6px 0;">No ${kind} in this window.</div>`
+            : rows
+                .map(
+                  (r) => `<div style="display:flex;justify-content:space-between;align-items:center;padding:6px 8px;background:#0f172a;border:1px solid #1e293b;border-radius:6px;margin-bottom:4px;font-size:11px;">
+                    <span style="color:#e2e8f0;font-family:ui-monospace,monospace;">${escHtml(r.ip || "—")}</span>
+                    <span style="color:#94a3b8;">${r.count} ${kind === "magic-link requests" ? `· ${r.distinct_emails || 0} emails` : ""}</span>
+                  </div>`,
+                )
+                .join("");
+        body = `
+          <div style="display:flex;gap:12px;padding:10px 12px;background:#0f172a;border:1px solid #1e293b;border-radius:8px;margin-bottom:10px;flex-wrap:wrap;">
+            <div style="flex:1;min-width:100px;">
+              <div style="font-size:10px;color:#64748b;text-transform:uppercase;letter-spacing:0.5px;">Signups</div>
+              <div style="font-size:22px;color:#e2e8f0;font-weight:600;">${total.signups || 0}</div>
+            </div>
+            <div style="flex:1;min-width:100px;">
+              <div style="font-size:10px;color:#64748b;text-transform:uppercase;letter-spacing:0.5px;">Magic-link requests</div>
+              <div style="font-size:22px;color:#e2e8f0;font-weight:600;">${total.magic_link_requests || 0}</div>
+            </div>
+          </div>
+          <div style="margin-bottom:8px;">
+            <div style="font-size:11px;color:#94a3b8;font-weight:600;margin-bottom:6px;">Signups by IP (top 10)</div>
+            ${renderIpList(ipRows, "signups")}
+          </div>
+          <div>
+            <div style="font-size:11px;color:#94a3b8;font-weight:600;margin-bottom:6px;">Magic-link requests by IP (top 10) — high counts with few signups are sus</div>
+            ${renderIpList(linkIpRows, "magic-link requests")}
+          </div>
+        `;
+      } else {
+        body = `<div style="font-size:12px;color:#94a3b8;padding:6px 0;">Tap a window above to load.</div>`;
+      }
+      return `
+        <label class="field-label" style="margin-top:14px;display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:8px;">
+          <span>Recent Activity</span>
+          <div style="display:flex;gap:4px;">${windowSelector}</div>
+        </label>
+        <div style="border:1px solid #1e293b;background:rgba(15,23,42,0.4);border-radius:8px;padding:10px;">
+          ${body}
+        </div>
+      `;
+    }
+
+    // ── Tenant: Claim a previous purchase ────────────────────────────
+    // Self-service recovery for the cookie-jar edge case. If an anon
+    // visitor bought credits in Safari Private mode (or any browser
+    // where the magic-link click lands in a different cookie jar than
+    // the purchase tab), their anon trial cookie is lost when they
+    // sign up — so linkToUser has nothing to transfer. The BTCPay
+    // invoice ID is the user's proof-of-purchase: paste it here and
+    // the server verifies settled status with the relay and credits
+    // their account. Only shown to signed-in users.
+    function renderClaimPurchaseBlock() {
+      if (!state.account?.user) return "";
+      const cp = state.claimPurchase || {};
+      const submitting = !!cp.submitting;
+      const resultBlock = cp.success
+        ? `<div style="margin-top:8px;padding:8px 10px;background:rgba(74,222,128,0.10);border:1px solid rgba(74,222,128,0.30);border-radius:6px;font-size:12px;color:#bbf7d0;">✓ Added ${cp.success} credit${cp.success === 1 ? "" : "s"} to your account.</div>`
+        : cp.error
+        ? `<div style="margin-top:8px;padding:8px 10px;background:rgba(252,165,165,0.10);border:1px solid rgba(252,165,165,0.30);border-radius:6px;font-size:12px;color:#fecaca;">${escHtml(cp.error)}</div>`
+        : "";
+      return `
+        <label class="field-label" style="margin-top:14px;">Claim a previous purchase</label>
+        <div style="font-size:11px;color:#94a3b8;line-height:1.55;margin-bottom:8px;">
+          Bought credits anonymously and they didn't transfer to your account?
+          Paste the invoice ID from your purchase (shown after payment or in your BTCPay receipt email).
+        </div>
+        <div style="display:flex;gap:6px;align-items:stretch;">
+          <input id="claim-purchase-input" type="text" placeholder="invoice ID"
+            autocomplete="off" autocapitalize="off" spellcheck="false"
+            style="flex:1;min-width:0;padding:8px 10px;background:#0f172a;border:1px solid #334155;border-radius:6px;color:#e2e8f0;font-size:12px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;outline:none;" />
+          <button onclick="submitClaimPurchase()" ${submitting ? "disabled" : ""}
+            style="padding:8px 14px;background:#6366f1;color:#fff;border:none;border-radius:6px;font-size:12px;font-weight:600;cursor:${submitting ? "wait" : "pointer"};white-space:nowrap;">
+            ${submitting ? "Claiming…" : "Claim"}
+          </button>
+        </div>
+        ${resultBlock}
+      `;
+    }
+
+    async function submitClaimPurchase() {
+      const input = document.getElementById("claim-purchase-input");
+      const invoiceId = (input?.value || "").trim();
+      if (!invoiceId) return;
+      state.claimPurchase = { submitting: true };
+      render();
+      try {
+        const r = await fetch("/api/credits/claim", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ invoice_id: invoiceId }),
+        });
+        const data = await r.json().catch(() => ({}));
+        if (!r.ok) {
+          state.claimPurchase = {
+            submitting: false,
+            error: data.message || data.error || `HTTP ${r.status}`,
+          };
+        } else {
+          state.claimPurchase = {
+            submitting: false,
+            success: data.credits || 0,
+          };
+          // Refresh balance everywhere so the user immediately sees
+          // the new credit count without closing settings.
+          try {
+            await Promise.all([
+              loadRelayStatus(true).catch(() => {}),
+              loadAccount().catch(() => {}),
+            ]);
+          } catch {}
+        }
+      } catch (err) {
+        state.claimPurchase = {
+          submitting: false,
+          error: err.message || String(err),
+        };
+      }
+      render();
+    }
+
+    // ── Tenant: My Sessions block ────────────────────────────────────
+    // Lite-settings view for non-admin signed-in users — see their own
+    // active sessions and revoke any but the current one. Trial users
+    // get nothing here (they have no sessions row in SQLite).
+    function renderMySessionsBlock() {
+      if (!state.account?.user) return "";
+      const ms = state.mySessions;
+      let body = "";
+      if (ms.loading && ms.rows == null) {
+        body = `<div style="font-size:12px;color:#94a3b8;padding:6px 0;">Loading…</div>`;
+      } else if (ms.error) {
+        body = `<div style="font-size:12px;color:#fca5a5;padding:6px 0;">Couldn't load sessions.</div>`;
+      } else if (Array.isArray(ms.rows) && ms.rows.length === 0) {
+        body = `<div style="font-size:12px;color:#94a3b8;padding:6px 0;">No active sessions.</div>`;
+      } else if (Array.isArray(ms.rows)) {
+        body = ms.rows
+          .map((s) => {
+            const isCurrent = s.id === ms.currentId;
+            const ua = s.user_agent || "Unknown device";
+            const shortUa = ua.length > 60 ? ua.slice(0, 58) + "…" : ua;
+            const last = s.last_used_at
+              ? new Date(s.last_used_at).toLocaleString()
+              : "—";
+            return `<div style="display:flex;justify-content:space-between;align-items:center;padding:8px 10px;background:#0f172a;border:1px solid #1e293b;border-radius:6px;margin-bottom:4px;gap:8px;">
+              <div style="flex:1;min-width:0;">
+                <div style="font-size:12px;color:#e2e8f0;">${escHtml(shortUa)} ${isCurrent ? '<span style="font-size:10px;font-weight:700;color:#86efac;margin-left:6px;">CURRENT</span>' : ''}</div>
+                <div style="font-size:10.5px;color:#64748b;">${s.ip_address ? escHtml(s.ip_address) + ' · ' : ''}last used ${last}</div>
+              </div>
+              ${!isCurrent ? `<button onclick="revokeMySession('${escHtml(s.id)}')" style="padding:5px 10px;font-size:11px;font-weight:600;background:#1e293b;color:#fca5a5;border:1px solid #334155;border-radius:6px;cursor:pointer;">Revoke</button>` : ''}
+            </div>`;
+          })
+          .join("");
+      } else {
+        body = `<div style="font-size:12px;color:#94a3b8;padding:6px 0;">Tap Refresh to load.</div>`;
+      }
+      const otherCount = Array.isArray(ms.rows)
+        ? ms.rows.filter((s) => s.id !== ms.currentId).length
+        : 0;
+      return `
+        <label class="field-label" style="margin-top:14px;display:flex;align-items:center;justify-content:space-between;gap:8px;">
+          <span>Active Sessions</span>
+          <button onclick="loadMySessions()"
+            style="font-size:11px;font-weight:600;padding:4px 10px;background:#1e293b;color:#94a3b8;border:1px solid #334155;border-radius:6px;cursor:pointer;">
+            ${ms.loading ? "Loading…" : "Refresh"}
+          </button>
+        </label>
+        <div style="border:1px solid #1e293b;background:rgba(15,23,42,0.4);border-radius:8px;padding:8px;">
+          ${body}
+          ${otherCount > 0 ? `<button onclick="revokeOtherSessions()"
+            style="margin-top:8px;width:100%;padding:8px 12px;font-size:12px;font-weight:600;background:#1e293b;color:#fca5a5;border:1px solid #334155;border-radius:6px;cursor:pointer;">
+            Sign out of all other devices (${otherCount})
+          </button>` : ''}
+        </div>
+      `;
+    }
+
+    // Danger Zone — sits at the very bottom of the tenant lite-settings
+    // modal. One action for now (Delete Account); future destructive
+    // self-actions land here. Visually muted by default to avoid being
+    // a target for accidental clicks; the confirm-then-type-DELETE flow
+    // catches the rest.
+    function renderTenantDangerZone() {
+      return `
+        <label class="field-label" style="margin-top:14px;color:#fca5a5;">Danger Zone</label>
+        <div style="border:1px solid rgba(248,113,113,0.30);background:rgba(127,29,29,0.10);border-radius:8px;padding:14px;">
+          <div style="font-size:12px;color:#cbd5e1;line-height:1.55;margin-bottom:10px;">
+            Delete your Recaps account, library, and active sessions. Your relay-side credit pool (if you're a paying customer) stays intact at the relay — let your license expire naturally or contact support.
+          </div>
+          <button onclick="deleteMyAccount()"
+            style="padding:8px 14px;font-size:12px;font-weight:600;background:transparent;color:#fca5a5;border:1px solid rgba(248,113,113,0.45);border-radius:6px;cursor:pointer;">
+            Delete account
+          </button>
+        </div>
+      `;
+    }
+
+    // ── Tenant: Subscription / Plan block ────────────────────────────
+    // Replaces renderLicenseBlock() in the tenant view of the lite
+    // settings panel. Shows:
+    //   - Plan badge (Pro / Max / Free)
+    //   - Expires date + days remaining with renewal urgency
+    //   - "Renew" CTA (always visible for licensed users; emphasized
+    //     when expiry is < 14 days)
+    //   - "Take Recap home" subsection for licensed tenants — fetches
+    //     and reveals the raw LIC1- key with copy-to-clipboard
+    //
+    // We keep renderLicenseBlock() for the operator/single-mode view
+    // because it surfaces the right actions (Activate / Deactivate) for
+    // the install-wide /data/license.txt. Tenants don't have that file
+    // — their license lives on users.keysat_license in SQLite and
+    // attaches/detaches automatically via the buy flow.
+    function renderTenantSubscriptionBlock() {
+      const lic = state.license || {};
+      const licensed = isLicensed();
+      const trial = !!state.account?.trial;
+      const tier = !licensed
+        ? trial ? { label: "Trial", cls: "core" } : { label: "Free", cls: "core" }
+        : (state.account?.user?.has_license || lic.entitlements?.includes("max")) && lic.entitlements?.includes("max")
+          ? { label: "Max", cls: "pro" }
+          : { label: "Pro", cls: "pro" };
+
+      // Days-until-expiry computation. Negative means already expired
+      // (the user is still seeing the licensed view because the relay
+      // hasn't re-checked yet — rare race, but defensive).
+      let daysLeft = null;
+      let expiringSoon = false;
+      let expired = false;
+      if (lic.expiresAt) {
+        const ms = new Date(lic.expiresAt).getTime() - Date.now();
+        daysLeft = Math.ceil(ms / (24 * 60 * 60 * 1000));
+        expiringSoon = daysLeft <= 14 && daysLeft > 0;
+        expired = daysLeft <= 0;
+      }
+
+      const expiresLine = (() => {
+        if (!licensed) return "";
+        if (!lic.expiresAt) return "Never expires.";
+        const date = new Date(lic.expiresAt).toLocaleDateString();
+        if (expired) {
+          return `<span style="color:#fca5a5;">Expired ${date}</span>`;
+        }
+        if (expiringSoon) {
+          return `<span style="color:#fbbf24;">Renews ${date} · ${daysLeft} day${daysLeft === 1 ? "" : "s"} left</span>`;
+        }
+        return `Renews ${date} · ${daysLeft} day${daysLeft === 1 ? "" : "s"} left`;
+      })();
+
+      // CTA copy. Pre-paid users see "Upgrade" — clicking opens the
+      // buy modal which shows BOTH Pro and Max side-by-side, so
+      // labeling the pill "Upgrade to Pro" would have been misleading
+      // (you're not committing to Pro by clicking, you're opening a
+      // comparison). Pro users (not Max) see "Upgrade to Max" since
+      // the destination is unambiguous. Paid users always see
+      // "Renew" — purple/emphasized when close to expiry.
+      let ctaLabel;
+      let ctaPreselect = null;
+      if (licensed) {
+        ctaLabel = "Renew";
+      } else if (hasEntitlement("pro") && !hasEntitlement("max")) {
+        ctaLabel = "Upgrade to Max";
+        ctaPreselect = "max";
+      } else {
+        ctaLabel = "Upgrade";
+      }
+      const ctaStyle = !licensed || expiringSoon || expired
+        ? "background:#a855f7;color:#fff;border-color:#a855f7;"
+        : "background:#1e293b;color:#a5b4fc;border-color:#334155;";
+
+      return `
+        <label class="field-label">Plan</label>
+        <div class="ytdlp-status" style="flex-direction:column;align-items:stretch;gap:10px;border-color:#334155;background:rgba(30,41,59,0.3);padding:14px;">
+          <div style="display:flex;align-items:center;justify-content:space-between;gap:8px;flex-wrap:wrap;">
+            <div>
+              <div style="font-size:11px;color:#64748b;text-transform:uppercase;letter-spacing:0.5px;margin-bottom:3px;">Tier</div>
+              <div style="display:flex;align-items:center;gap:8px;">
+                <span class="lic-tier ${tier.cls}" style="font-size:12px;">${tier.label}</span>
+                ${expiresLine ? `<span style="font-size:12px;color:#94a3b8;">${expiresLine}</span>` : ""}
+              </div>
+            </div>
+            <button onclick="openBuyModal(${ctaPreselect ? `'${ctaPreselect}'` : ""})"
+              style="padding:8px 16px;font-size:12px;font-weight:600;border-radius:8px;border:1px solid;cursor:pointer;${ctaStyle}">
+              ${ctaLabel}
+            </button>
+          </div>
+          ${licensed ? renderTakeHomePanel() : ""}
+        </div>
+      `;
+    }
+
+    // ── Take Recap home — license-key reveal + copy ──────────────────
+    // Collapsed by default; one-click reveal calls /api/account/license-key
+    // and shows the LIC1- string with a copy button. Hidden for unlicensed
+    // tenants (no key to share). Lives inside renderTenantSubscriptionBlock.
+    function renderTakeHomePanel() {
+      const th = state.takeHome || {};
+      let inner = "";
+      if (!th.revealed) {
+        inner = `
+          <div style="font-size:12px;color:#cbd5e1;line-height:1.55;margin-bottom:10px;">
+            Run Recaps on your own StartOS server with the same license. Your subscription stays active on both your cloud account and your install.
+          </div>
+          <button onclick="revealLicenseKey()"
+            style="padding:8px 14px;font-size:12px;font-weight:600;background:#1e293b;color:#a5b4fc;border:1px solid #334155;border-radius:8px;cursor:pointer;">
+            Get my license key
+          </button>`;
+      } else if (th.loading) {
+        inner = `<div style="font-size:12px;color:#94a3b8;padding:6px 0;">Loading…</div>`;
+      } else if (th.error) {
+        inner = `<div style="font-size:12px;color:#fca5a5;padding:6px 0;">${escHtml(th.error)}</div>
+          <button onclick="state.takeHome.revealed=false;state.takeHome.error=null;render();"
+            style="margin-top:6px;padding:6px 12px;font-size:11px;background:#1e293b;color:#94a3b8;border:1px solid #334155;border-radius:6px;cursor:pointer;">Close</button>`;
+      } else if (th.licenseKey) {
+        inner = `
+          <div style="font-size:12px;color:#cbd5e1;line-height:1.55;margin-bottom:8px;">
+            Paste this on your self-hosted Recaps (Settings → I have a key):
+          </div>
+          <div style="font-family:ui-monospace,monospace;font-size:11.5px;color:#e2e8f0;background:#0a0e1a;border:1px solid #334155;border-radius:8px;padding:10px 12px;word-break:break-all;margin-bottom:8px;">
+            ${escHtml(th.licenseKey)}
+          </div>
+          <div style="display:flex;gap:6px;flex-wrap:wrap;">
+            <button onclick="copyLicenseKey()"
+              style="padding:6px 14px;font-size:12px;font-weight:600;background:#3b82f6;color:#fff;border:none;border-radius:6px;cursor:pointer;">
+              ${th.copied ? "Copied ✓" : "Copy key"}
+            </button>
+            <button onclick="state.takeHome.revealed=false;state.takeHome.copied=false;render();"
+              style="padding:6px 14px;font-size:12px;background:#1e293b;color:#94a3b8;border:1px solid #334155;border-radius:6px;cursor:pointer;">
+              Hide
+            </button>
+          </div>
+          <div style="font-size:11px;color:#64748b;margin-top:10px;line-height:1.5;">
+            Treat this like a password — anyone with the key can use your subscription's credit pool until it expires.
+          </div>`;
+      }
+      return `
+        <div style="border-top:1px solid #334155;padding-top:12px;margin-top:6px;">
+          <div style="font-size:11px;color:#64748b;text-transform:uppercase;letter-spacing:0.5px;margin-bottom:8px;">
+            Take Recaps Home
+          </div>
+          ${inner}
+        </div>
+      `;
+    }
+
+    async function revealLicenseKey() {
+      state.takeHome.revealed = true;
+      state.takeHome.loading = true;
+      state.takeHome.error = null;
+      render();
+      try {
+        const res = await fetch(`${API_BASE}/api/account/license-key`);
+        if (res.status === 404) throw new Error("No active license yet.");
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        const data = await res.json();
+        state.takeHome.licenseKey = data.license_key;
+      } catch (e) {
+        state.takeHome.error = e.message || "Couldn't load license key.";
+      } finally {
+        state.takeHome.loading = false;
+        render();
+      }
+    }
+
+    async function copyLicenseKey() {
+      const key = state.takeHome?.licenseKey;
+      if (!key) return;
+      try {
+        await navigator.clipboard.writeText(key);
+        state.takeHome.copied = true;
+        render();
+        setTimeout(() => {
+          state.takeHome.copied = false;
+          render();
+        }, 1800);
+      } catch {
+        showToast("Couldn't copy — select and copy manually", "!", 3000);
+      }
+    }
+
+    // Tenant-view account block — replaces the full operator settings
+    // panel for non-admin signed-in users (and trial visitors) on a
+    // multi-tenant Recap. Shows email + remaining credits + sign-out.
+    function renderTenantAccountBlock() {
+      const acct = state.account || {};
+      const user = acct.user || null;
+      const trial = acct.trial || null;
+      let bodyHtml = "";
+      if (user) {
+        const emailLine = user.email
+          ? `<div style="font-size:13px;color:#e2e8f0;font-weight:500;">${escHtml(user.email)}</div>`
+          : "";
+        bodyHtml = `
+          ${emailLine}
+          <div style="font-size:11px;color:#94a3b8;margin-top:4px;">
+            ${user.has_license ? "Pro account" : "Free account"}
+          </div>
+          <div style="display:flex;gap:8px;margin-top:12px;flex-wrap:wrap;">
+            <a href="/auth/signout"
+               style="padding:6px 14px;font-size:12px;font-weight:600;background:#1e293b;color:#94a3b8;border:1px solid #334155;border-radius:6px;cursor:pointer;text-decoration:none;display:inline-block;"
+               onmouseover="this.style.background='#334155';this.style.color='#e2e8f0'"
+               onmouseout="this.style.background='#1e293b';this.style.color='#94a3b8'">Sign out</a>
+          </div>`;
+      } else if (trial) {
+        const remaining = trial.credits_remaining ?? 0;
+        // Sign up routes through the 3-tier modal (Free / Pro / Max)
+        // — same affordance as the toolbar Sign up pill — so the
+        // trial visitor sees the full pricing menu instead of being
+        // dropped on the magic-link form (which only handles the
+        // Free path). closeSettings runs first so the modal swap
+        // is clean (no double overlay flash).
+        bodyHtml = `
+          <div style="font-size:13px;color:#e2e8f0;font-weight:500;">Free trial</div>
+          <div style="font-size:11px;color:#94a3b8;margin-top:4px;">
+            ${remaining} of ${trial.credits_total} trial credit${trial.credits_total === 1 ? "" : "s"} remaining
+          </div>
+          <div style="font-size:11px;color:#cbd5e1;margin-top:8px;line-height:1.5;">
+            Sign up free to get more credits and save your summaries to a library.
+          </div>
+          <div style="display:flex;gap:8px;margin-top:12px;flex-wrap:wrap;">
+            <button onclick="toggleSettings(); openTierSignupModal()"
+               style="padding:6px 14px;font-size:12px;font-weight:600;background:#3b82f6;color:#fff;border:none;border-radius:6px;cursor:pointer;">Sign up</button>
+            <a href="/auth.html?intent=signin"
+               style="padding:6px 14px;font-size:12px;font-weight:600;background:#1e293b;color:#94a3b8;border:1px solid #334155;border-radius:6px;cursor:pointer;text-decoration:none;display:inline-block;">Sign in</a>
+          </div>`;
+      } else {
+        // Not-signed-in, no trial cookie. Same dual CTA as the trial
+        // branch — Sign up opens the 3-tier modal so the visitor
+        // sees pricing options before committing.
+        bodyHtml = `
+          <div style="font-size:13px;color:#e2e8f0;font-weight:500;">Not signed in</div>
+          <div style="display:flex;gap:8px;margin-top:12px;flex-wrap:wrap;">
+            <button onclick="toggleSettings(); openTierSignupModal()"
+               style="padding:6px 14px;font-size:12px;font-weight:600;background:#3b82f6;color:#fff;border:none;border-radius:6px;cursor:pointer;">Sign up</button>
+            <a href="/auth.html?intent=signin"
+               style="padding:6px 14px;font-size:12px;font-weight:600;background:#1e293b;color:#94a3b8;border:1px solid #334155;border-radius:6px;cursor:pointer;text-decoration:none;display:inline-block;">Sign in</a>
+          </div>`;
+      }
+      return `
+        <label class="field-label">Account</label>
+        <div class="ytdlp-status" style="flex-direction:column;align-items:flex-start;gap:4px;border-color:#334155;background:rgba(30,41,59,0.3);padding:14px;">
+          ${bodyHtml}
+        </div>
+      `;
+    }
+
     // ── Library Transfer ──────────────────────────────────────────────────
 
     function renderLibraryTransfer() {
@@ -3589,6 +8161,38 @@
 
     function renderSubscribePrompt() {
       const todayStr = new Date().toISOString().slice(0, 10);
+      // Subscriptions are a Pro-tier entitlement. Anon visitors and
+      // free signed-in users see the "channel detected" banner but
+      // with an upgrade nudge instead of the controls — clicking
+      // Subscribe used to 401/403 with a raw error string. The
+      // /api/subscriptions POST stays auth-gated on the server; this
+      // is purely UX.
+      const canSub = hasEntitlement("subscriptions");
+      if (!canSub) {
+        // Different CTA depending on signed-in vs anon. Anon: open
+        // the tier signup modal (Pro is one of the cards). Signed-in
+        // free: open the buy-license modal (existing renderBuyModal).
+        const isAnon = isMulti() && !state.account?.user;
+        const ctaLabel = isAnon ? "Sign up for Pro" : "Upgrade to Pro";
+        const ctaHandler = isAnon ? "openTierSignupModal()" : "openBuyModal()";
+        return `
+          <div style="display:flex; flex-wrap:wrap; align-items:center; gap:8px 12px; margin-top:8px; padding:10px 12px;
+            background:rgba(139,92,246,0.06); border:1px solid rgba(139,92,246,0.15);
+            border-radius:10px;">
+            <span style="font-size:16px">📡</span>
+            <span style="font-size:12px; color:#a78bfa; font-weight:500; flex:1; min-width:160px;">
+              Channel detected — Pro account required to subscribe + auto-process new episodes
+            </span>
+            <button onclick="${ctaHandler}"
+              style="padding:6px 12px; font-size:11px; font-weight:600;
+                background:#a855f7; color:#fff; border:none; border-radius:6px; cursor:pointer; white-space:nowrap;"
+              onmouseover="this.style.background='#9333ea'"
+              onmouseout="this.style.background='#a855f7'">
+              ${ctaLabel} &rarr;
+            </button>
+          </div>
+        `;
+      }
       return `
         <div style="display:flex; flex-wrap:wrap; align-items:center; gap:8px 12px; margin-top:8px; padding:10px 12px;
           background:rgba(139,92,246,0.06); border:1px solid rgba(139,92,246,0.15);
@@ -3662,6 +8266,9 @@
       bgPollRunning = true;
       setInterval(async () => {
         try {
+          // Operator-managed in multi mode — non-admin tenants neither poll
+          // nor display the subscription queue (server 403s them anyway).
+          if (!canUseSubscriptions()) return;
           const oldSubs = JSON.stringify(state.subscriptions);
           const oldQueueLen = state.queue.length;
           await loadSubscriptions();
@@ -4021,17 +8628,6 @@
                 <div style="font-size:14px; font-weight:600; color:#e2e8f0; white-space:nowrap; overflow:hidden; text-overflow:ellipsis;">${escHtml(state.videoTitle || "Podcast Episode")}</div>
                 <div style="font-size:11px; color:#64748b;">Processing podcast audio...</div>
               </div>
-              <div class="loading-status-bar" style="flex:0 0 auto; background:none; padding:0; border:none;">
-                <div class="spinner-sm"></div>
-                <span class="status-msg" style="font-size:11px;">${escHtml(state.status || "Processing...")}</span>
-                <div style="display:flex;gap:4px; margin-left:8px;">
-                  ${steps.map(s => `
-                    <span style="width:8px;height:8px;border-radius:50%;
-                      background:${state.currentStep > s.num ? "#4ade80" : state.currentStep === s.num ? "#60a5fa" : "#1e293b"};
-                      transition:background 0.3s;" title="${s.label}"></span>
-                  `).join("")}
-                </div>
-              </div>
             </div>
             <div class="chunks-scroll" style="max-height: calc(100vh - 200px);">
               ${[1,2,3,4,5,6].map(i => `
@@ -4054,18 +8650,6 @@
             ${renderWatchOnYouTubeLink()}
           </div>
           <div class="results-right">
-            <div class="loading-status-bar">
-              <div class="spinner-sm"></div>
-              <span class="status-msg">${escHtml(state.status || "Processing...")}</span>
-              <div style="flex:1"></div>
-              <div style="display:flex;gap:4px">
-                ${steps.map(s => `
-                  <span style="width:8px;height:8px;border-radius:50%;
-                    background:${state.currentStep > s.num ? "#4ade80" : state.currentStep === s.num ? "#60a5fa" : "#1e293b"};
-                    transition:background 0.3s;" title="${s.label}"></span>
-                `).join("")}
-              </div>
-            </div>
             <div class="chunks-scroll">
               ${[1,2,3,4,5,6].map(i => `
                 <div class="skeleton-chunk" style="animation-delay:${i * 0.1}s">
@@ -4081,34 +8665,178 @@
     }
 
     function renderLoading() {
-      const steps = [
-        { num: 1, label: "Download audio", icon: "\u2B07" },
-        { num: 2, label: "Transcribe", icon: "\uD83C\uDFA4" },
-        { num: 3, label: "Analyze topics", icon: "\uD83E\uDDE0" },
-      ];
+      // Pre-results loading state \u2014 shown while we don't yet have a
+      // video id or podcast type set (resolver still running, or
+      // YouTube URL we haven't extracted the id from yet). Pizza
+      // tracker at the top of the page handles staging; we only need
+      // the spinner + status text here. The old in-line pipeline
+      // pills duplicated the same info and were removed in 0.2.88.
       return `
         <div class="loading">
-          <div class="pipeline">
-            ${steps.map((s, i) => `
-              ${i > 0 ? '<span class="step-arrow">\u2192</span>' : ""}
-              <div class="step ${state.currentStep === s.num ? "active" : ""} ${state.currentStep > s.num ? "done" : ""}">
-                <span class="step-icon">${state.currentStep > s.num ? "\u2713" : s.icon}</span>
-                ${s.label}
-              </div>
-            `).join("")}
-          </div>
           <div class="spinner"></div>
           <p class="status-text">${escHtml(state.status || "Processing...")}</p>
         </div>
       `;
     }
 
-    function renderResults() {
+    // Surgical update of the chunks-scroll DOM content (called from
+    // the sections_partial SSE handler). Skips the full render() so
+    // the YouTube iframe outside this container isn't destroyed +
+    // re-mounted on every window completion — which was the
+    // root cause of the per-window video-embed flicker the operator
+    // reported. Also updates the "(N / M windows complete)" indicator
+    // text without rebuilding its parent container.
+    //
+    // Layout invariant: only ONE .chunks-scroll exists in the DOM at
+    // any time (the renderer picks ONE branch in renderResults). We
+    // query for the first match and ignore the rest.
+    function applyStreamingChunksUpdate() {
+      const scroll = document.querySelector(".chunks-scroll");
+      if (!scroll) {
+        // Chunks container hasn't rendered yet — fall back to full
+        // render() so renderResults() can mount it.
+        render();
+        return;
+      }
+      const stillAnalyzing = state.streaming && state.chunks.length === 0;
+      // Streaming indicator below the topics list. Tiny + dim so
+      // it reads as subtle metadata, not a banner. 10px / muted
+      // slate / 70% opacity. Inline so no CSS rule can override.
+      // Browser cache caveat: if it ever shows up larger than this,
+      // hard-refresh — the spec-side renderer is locked at 10px.
+      const streamingIndicator = state.streaming
+        ? `<div class="streaming-indicator" style="padding:7px 14px; text-align:center; color:#94a3b8; font-size:12px !important; line-height:1.4; opacity:0.95; letter-spacing:0.02em;">⟳ Analyzing window ${state.streamWindowsDone}${state.streamWindowsTotal ? " / " + state.streamWindowsTotal : ""}…</div>`
+        : "";
+      const chunksHtml = state.chunks.map((chunk, i) => renderChunk(chunk, i)).join("");
+      const placeholder = state.chunks.length === 0 && stillAnalyzing
+        ? `<div style="padding:24px 14px; text-align:center; color:#64748b; font-size:12px;">Topics will appear here as the model analyzes each section…</div>`
+        : "";
+      // Preserve scroll position across the innerHTML swap so the
+      // operator's "I was reading the third section" view doesn't
+      // jump back to the top each time a new section streams in.
+      const prevScrollTop = scroll.scrollTop;
+      scroll.innerHTML = chunksHtml + placeholder + streamingIndicator;
+      scroll.scrollTop = prevScrollTop;
+      // Also update the segments/topics counter line in the results
+      // header (if present) — non-critical, ignored if not in DOM.
+      updateResultsHeaderCounts();
+      // And update the top-bar pizza tracker if it's visible.
+      updateProcessingBreadcrumb();
+    }
+
+    // Update the "topics · segments · total" header counts in the
+    // results pane. Read by applyStreamingChunksUpdate after the
+    // chunks-scroll innerHTML swap. Best-effort — silently skips
+    // when the header isn't in the DOM (e.g. mobile-collapsed view).
+    function updateResultsHeaderCounts() {
+      const headerEl = document.querySelector("[data-results-header-counts]");
+      if (!headerEl) return;
       const totalEntries = state.chunks.reduce((sum, c) => sum + c.entries.length, 0);
       const lastChunk = state.chunks[state.chunks.length - 1];
-      const lastEntry = lastChunk.entries[lastChunk.entries.length - 1];
+      const lastEntry = lastChunk ? lastChunk.entries[lastChunk.entries.length - 1] : null;
+      const totalDuration = lastEntry ? lastEntry.offset : 0;
+      headerEl.textContent =
+        state.chunks.length + " topics · " +
+        formatTime(totalDuration) + " total";
+    }
+
+    // ── Top-bar processing breadcrumb (pizza tracker) ─────────────
+    // 4-stage indicator mirroring the relay dashboard's renderBreadcrumb
+    // style. Shows the current pipeline stage of an in-flight job in
+    // the top row alongside the toolbar pills. Only visible when
+    // state.streaming === true; hidden otherwise. Stage is derived
+    // from state.currentStep + state.status text:
+    //   - currentStep 1 = Downloading (relay/own download)
+    //   - currentStep 2 = Transcribing (relay or local STT)
+    //   - currentStep 3 = Analyzing (chunks streaming in)
+    //   - currentStep complete (state.streaming false + chunks exist) = Done
+    function getProcessingStage() {
+      if (state.error) return -1;
+      if (!state.streaming && !state.loading) {
+        return state.chunks.length > 0 ? 4 : 0;
+      }
+      const step = state.currentStep || 0;
+      if (step <= 1) return 1; // Downloading
+      if (step === 2) return 2; // Transcribing
+      if (step >= 3) return 3; // Analyzing
+      return 1;
+    }
+    function renderProcessingBreadcrumb(variant) {
+      if (!state.streaming && !state.loading) return "";
+      const stage = getProcessingStage();
+      const isError = stage === -1;
+      const labels = ["Downloading", "Transcribing", "Analyzing", "Done"];
+      const cells = labels.map((label, i) => {
+        const id = i + 1;
+        let dotColor = "#64748b";
+        let textColor = "#64748b";
+        let pulse = "";
+        if (isError && i === 0) {
+          dotColor = "#f87171"; textColor = "#f87171";
+        } else if (!isError && id < stage) {
+          dotColor = "#4ade80"; textColor = "#94a3b8";
+        } else if (!isError && id === stage) {
+          dotColor = stage === 4 ? "#4ade80" : "#818cf8";
+          textColor = "#e2e8f0";
+          if (stage !== 4) pulse = "animation: top-breadcrumb-pulse 1.2s infinite;";
+        }
+        const dot = `<span style="color:${dotColor};font-size:11px;${pulse}">●</span>`;
+        const text = `<span style="color:${textColor};font-size:10.5px;font-weight:600;">${escHtml(label)}</span>`;
+        const arrow = i < labels.length - 1
+          ? ` <span style="margin:0 5px; color:#475569;">→</span> `
+          : "";
+        return dot + " " + text + arrow;
+      }).join("");
+      // Two copies: the inline-toolbar one (desktop) lives inside
+      // .top-bar and is hidden on phones; the mobile copy lives as a
+      // sibling below .top-bar so it doesn't have to fight the flex-
+      // wrap / position:sticky interaction that was leaving it
+      // invisible on iOS Safari. Same cells, distinct ids for the
+      // in-place updater.
+      const id = variant === "mobile" ? "top-breadcrumb-mobile" : "top-breadcrumb";
+      const cls = variant === "mobile" ? "top-breadcrumb top-breadcrumb-mobile" : "top-breadcrumb";
+      return `<div class="${cls}" id="${id}">${cells}</div>`;
+    }
+    // Called by applyStreamingChunksUpdate to refresh the breadcrumb
+    // without a full render(). Replaces the inner content of BOTH the
+    // desktop and mobile copies (whichever happen to be in the DOM).
+    function updateProcessingBreadcrumb() {
+      ["top-breadcrumb", "top-breadcrumb-mobile"].forEach((targetId) => {
+        const el = document.getElementById(targetId);
+        if (!el) return;
+        const variant = targetId === "top-breadcrumb-mobile" ? "mobile" : undefined;
+        const newHtml = renderProcessingBreadcrumb(variant);
+        if (!newHtml) {
+          el.style.display = "none";
+          return;
+        }
+        const tmp = document.createElement("div");
+        tmp.innerHTML = newHtml;
+        const fresh = tmp.firstElementChild;
+        if (fresh) {
+          el.innerHTML = fresh.innerHTML;
+          el.style.display = "";
+        }
+      });
+    }
+
+    function renderResults() {
+      ensureTtsAvailability(); // one-shot fetch of /api/tts/availability
+      const totalEntries = state.chunks.reduce((sum, c) => sum + c.entries.length, 0);
+      const lastChunk = state.chunks[state.chunks.length - 1];
+      const lastEntry = lastChunk ? lastChunk.entries[lastChunk.entries.length - 1] : null;
       const totalDuration = lastEntry ? lastEntry.offset : 0;
       const isPod = state.currentType === "podcast";
+      // Streaming indicator HTML — shown below the sections list while
+      // analyze windows are still landing. Goes away when the final
+      // result event arrives and clears state.streaming.
+      const stillAnalyzing = state.streaming;
+      const streamingIndicator = stillAnalyzing
+        ? `<div class="streaming-indicator" style="padding:9px 14px; text-align:center; color:#94a3b8; font-size:12px !important; line-height:1.4; opacity:0.95; letter-spacing:0.02em; border-top:1px dashed #1e293b; margin-top:8px;">
+             <span class="streaming-dot" style="display:inline-block; width:6px; height:6px; border-radius:50%; background:#818cf8; margin-right:7px; animation:pulse 1.2s ease-in-out infinite;"></span>
+             Analyzing topics… ${state.streamWindowsDone || 0}${state.streamWindowsTotal ? "/" + state.streamWindowsTotal : ""} windows ready
+           </div>`
+        : "";
 
       if (isPod) {
         return `
@@ -4117,11 +8845,12 @@
               <span style="font-size:20px;">🎙</span>
               <div style="flex:1; min-width:0;">
                 <div style="font-size:14px; font-weight:600; color:#e2e8f0; white-space:nowrap; overflow:hidden; text-overflow:ellipsis;">${escHtml(state.videoTitle || "Podcast Episode")}</div>
-                <div style="font-size:11px; color:#64748b;">${state.chunks.length} topics &middot; ${totalEntries} segments &middot; ${formatTime(totalDuration)} total</div>
+                <div style="font-size:11px; color:#64748b;">${stillAnalyzing ? "" : `${state.chunks.length} topics &middot; ${formatTime(totalDuration)} total`}</div>
               </div>
               <button class="expand-btn" onclick="toggleVideoMinimize()" title="${state.videoMinimized ? "Show player" : "Hide player"}" style="margin-right:4px;">
                 ${state.videoMinimized ? "Show Player" : "Hide Player"}
               </button>
+              ${state.ttsAllowed && state.currentSessionId ? `<button class="expand-btn rp-listen-btn" onclick="openRecapPlayer()" title="Listen to the recap as audio">🎧 Listen</button>` : ""}
               <button class="expand-btn" onclick="toggleExpandAll()">
                 ${state.expandAll ? "Collapse All" : "Expand All"}
               </button>
@@ -4131,8 +8860,11 @@
                 controls src="${escHtml(state.url)}"></audio>
             ` : ""}
             <div style="border-top:1px solid #1e293b; padding-top:12px;"></div>
+            ${renderSpeakersLegend()}
             <div class="chunks-scroll" style="max-height: calc(100vh - ${state.videoMinimized ? "200" : "260"}px);">
               ${state.chunks.map((chunk, i) => renderChunk(chunk, i)).join("")}
+              ${state.chunks.length === 0 && stillAnalyzing ? `<div style="padding:24px 14px; text-align:center; color:#64748b; font-size:12px;">Topics will appear here as the model analyzes each section…</div>` : ""}
+              ${streamingIndicator}
             </div>
           </div>
         `;
@@ -4161,28 +8893,31 @@
                 <div id="yt-player"></div>
               </div>
               ${state.videoTitle ? `<div class="video-title">${escHtml(state.videoTitle)}</div>` : ""}
-              <div class="video-meta">${state.chunks.length} topics &middot; ${totalEntries} segments &middot; ${formatTime(totalDuration)} total</div>
+              <div class="video-meta">${stillAnalyzing ? "" : `${state.chunks.length} topics &middot; ${formatTime(totalDuration)} total`}</div>
               ${renderWatchOnYouTubeLink()}
             ` : ""}
           </div>
           <div class="results-right">
             <div class="stats-bar">
               <div class="stats">
-                <span><strong>${state.chunks.length}</strong> topics</span>
-                <span><strong>${totalEntries}</strong> segments</span>
-                <span><strong>${formatTime(totalDuration)}</strong> total</span>
+                ${stillAnalyzing ? "" : `<span><strong>${state.chunks.length}</strong> topics</span>
+                <span><strong>${formatTime(totalDuration)}</strong> total</span>`}
               </div>
               <div style="display:flex; gap:6px;">
-                <button class="expand-btn" onclick="exportCurrentPDF()" title="Export PDF">
-                  📄 Export PDF
+                ${state.ttsAllowed && state.currentSessionId ? `<button class="expand-btn rp-listen-btn" onclick="openRecapPlayer()" title="Listen to the recap as audio">🎧 Listen</button>` : ""}
+                <button class="expand-btn" onclick="event.stopPropagation(); showExportMenu(this, 'current')" title="Export — PDF, Markdown, or JSON">
+                  Export ▾
                 </button>
                 <button class="expand-btn" onclick="toggleExpandAll()">
                   ${state.expandAll ? "Collapse All" : "Expand All"}
                 </button>
               </div>
             </div>
+            ${renderSpeakersLegend()}
             <div class="chunks-scroll">
               ${state.chunks.map((chunk, i) => renderChunk(chunk, i)).join("")}
+              ${state.chunks.length === 0 && stillAnalyzing ? `<div style="padding:24px 14px; text-align:center; color:#64748b; font-size:12px;">Topics will appear here as the model analyzes each section…</div>` : ""}
+              ${streamingIndicator}
             </div>
           </div>
         </div>
@@ -4211,6 +8946,147 @@
       `;
     }
 
+    // ── Phase 1E speaker chip helpers ──────────────────────────────
+    // Map a global speaker ID ("Speaker_A", "Speaker_B", ..., or
+    // "Speaker_AA" for very chatty recordings) to one of 8 cycling
+    // CSS chip classes. Stable per label across the page so the same
+    // speaker always gets the same color in the legend AND each line.
+    function speakerChipClass(speakerLabel) {
+      if (!speakerLabel) return "";
+      // Speaker_Unknown is the pseudo-speaker the relay's post-
+      // cluster suppression pass assigns to brief utterances that
+      // didn't confidently match any anchor. Always rendered with
+      // the neutral slate "chip-h" color so it doesn't get mistaken
+      // for a real speaker.
+      if (speakerLabel === "Speaker_Unknown") return "chip-h";
+      const m = String(speakerLabel).match(/^Speaker_([A-Z]+)$/);
+      if (!m) return "chip-a";
+      const letters = m[1];
+      // Letter "A" = 0, "B" = 1, ... "Z" = 25, "AA" = 26, etc.
+      let n = 0;
+      for (const c of letters) {
+        n = n * 26 + (c.charCodeAt(0) - 64);
+      }
+      n -= 1; // back to 0-indexed
+      const cycle = "abcdefgh"[n % 8];
+      return "chip-" + cycle;
+    }
+    function speakerChipLetter(speakerLabel) {
+      if (speakerLabel === "Speaker_Unknown") return "?";
+      const m = String(speakerLabel || "").match(/^Speaker_([A-Z]+)$/);
+      return m ? m[1] : "?";
+    }
+    // Compute the chip display label. When the post-cluster polish
+    // identified a real name for this speaker, show its initials
+    // (e.g. "Matt Hill" → "MH", "Brandon Carpalis" → "BC", "Alice"
+    // → "A"). Otherwise fall back to the cluster letter ("A"/"B"/"C")
+    // so unidentified speakers stay legible. Tooltip on each chip
+    // still shows the full name for hover-disambiguation.
+    function speakerChipDisplay(speakerLabel) {
+      const names = state.speakerNames || {};
+      const name = typeof names[speakerLabel] === "string" && names[speakerLabel].trim()
+        ? names[speakerLabel].trim()
+        : null;
+      if (!name) return speakerChipLetter(speakerLabel);
+      const parts = name.split(/\s+/).filter(Boolean);
+      if (parts.length === 0) return speakerChipLetter(speakerLabel);
+      if (parts.length === 1) return parts[0][0].toUpperCase();
+      // First initial + last initial. Skips middle names so "Matt
+      // Andrew Hill" → "MH" rather than "MAH" (keeps chip width
+      // tight against the 28px container).
+      return (parts[0][0] + parts[parts.length - 1][0]).toUpperCase();
+    }
+    // Inline chip rendered next to each transcript line. Empty
+    // string when no speaker is assigned (line falls outside any
+    // diarized segment OR diarization wasn't available for this
+    // session). Confidence < 0.5 marks the chip with a trailing "?"
+    // so the user knows the assignment is shaky.
+    function renderSpeakerChip(speaker, confidence, uncertain) {
+      if (!speaker) return "";
+      const cls = speakerChipClass(speaker);
+      // Use INITIALS when polish gave us a real name ("MH" for Matt
+      // Hill), fall back to cluster LETTER when unknown ("A").
+      const display = speakerChipDisplay(speaker);
+      // "?" suffix on the chip when either:
+      // (a) the diarize endpoint returned low per-segment confidence
+      //     (< 0.5), or
+      // (b) the post-cluster suppression pass reassigned this
+      //     segment's source cluster to an anchor as best-guess
+      //     attribution (uncertain === true).
+      const showQuestion =
+        uncertain ||
+        (typeof confidence === "number" && confidence < 0.5);
+      const lowConf = showQuestion ? " low-conf" : "";
+      const names = state.speakerNames || {};
+      const inferredName = typeof names[speaker] === "string" && names[speaker].trim()
+        ? names[speaker].trim()
+        : null;
+      let tooltipLabel;
+      if (speaker === "Speaker_Unknown") {
+        tooltipLabel = "Unknown speaker (brief utterance below the recognition threshold)";
+      } else {
+        tooltipLabel = inferredName
+          ? `${inferredName} (${speaker})`
+          : speaker;
+      }
+      if (uncertain) tooltipLabel += " · best-guess attribution";
+      return `<span class="speaker-chip ${cls}${lowConf}" title="${escHtml(tooltipLabel)}${typeof confidence === "number" ? ` · conf ${(confidence * 100).toFixed(0)}%` : ""}">${escHtml(display)}</span>`;
+    }
+    // Legend block above the topic list. Returns "" when state.speakers
+    // is null/empty.
+    function renderSpeakersLegend() {
+      const speakers = state.speakers;
+      if (!speakers || typeof speakers !== "object") return "";
+      const entries = Object.entries(speakers);
+      if (entries.length === 0) return "";
+      // Sort by speaker label so Speaker_A is always first. The
+      // Speaker_Unknown pseudo-cluster (brief utterances that didn't
+      // match any anchor in the post-cluster suppression pass) always
+      // sorts to the end so the real speakers lead the legend.
+      entries.sort((a, b) => {
+        if (a[0] === "Speaker_Unknown") return 1;
+        if (b[0] === "Speaker_Unknown") return -1;
+        return a[0].localeCompare(b[0]);
+      });
+      // Phase 2 — prefer the inferred speaker name when available.
+      // state.speakerNames is a map { Speaker_A: "Matt Hill" | null,
+      // ... }. Null values mean polish couldn't confidently name
+      // that speaker; we fall back to "Speaker A".
+      const names = state.speakerNames || {};
+      const items = entries.map(([label, stats]) => {
+        const cls = speakerChipClass(label);
+        const letter = speakerChipLetter(label);
+        // Legend chip uses the same display as the per-line chips
+        // so the visual reference between legend and transcript is
+        // direct ("MH" in legend = "MH" on each line).
+        const chipDisplay = speakerChipDisplay(label);
+        const secs = Math.round(stats.total_speaking_seconds || 0);
+        const mins = Math.floor(secs / 60);
+        const rem = secs % 60;
+        const timeStr = mins > 0
+          ? `${mins}:${String(rem).padStart(2, "0")}`
+          : `${rem}s`;
+        const inferredName = typeof names[label] === "string" && names[label].trim()
+          ? names[label].trim()
+          : null;
+        let displayName;
+        if (label === "Speaker_Unknown") {
+          displayName = "Unknown";
+        } else {
+          displayName = inferredName || ("Speaker " + letter);
+        }
+        return `<span class="speakers-legend-item" title="${escHtml(label)}${inferredName ? ` — inferred name "${escHtml(inferredName)}"` : ""}">
+          <span class="speaker-chip ${cls}">${escHtml(chipDisplay)}</span>
+          <span>${escHtml(displayName)}</span>
+          <span class="legend-stats">· ${timeStr}</span>
+        </span>`;
+      }).join("");
+      return `<div class="speakers-legend">
+        <span class="speakers-legend-title">Speakers</span>
+        ${items}
+      </div>`;
+    }
+
     function renderChunk(chunk, index) {
       const isExpanded = state.expandAll || state.expandedChunks.has(index);
       const startSec = Math.floor(chunk.startTime);
@@ -4239,6 +9115,7 @@
                 <button class="transcript-line" data-offset="${entry.offset}" onclick="seekTo(${Math.floor(entry.offset)})"
                   title="Play from ${formatTime(entry.offset)}">
                   <span class="ts-badge">\u25B6 ${formatTime(entry.offset)}</span>
+                  ${renderSpeakerChip(entry.speaker, entry.speaker_confidence, entry.speaker_uncertain)}
                   <span class="transcript-text">${escHtml(entry.text)}</span>
                   ${state.currentSessionId && hasEntitlement("clips") ? `<span class="clip-line-btn" onclick="event.stopPropagation(); addToClipCollection('${state.currentSessionId}', ${index}, ${ei})" title="Add this line to clips">📎</span>` : ""}
                 </button>
@@ -4255,6 +9132,589 @@
       if (el) el.classList.add("now-playing");
     }
 
+    // ── Audio-first "Listen" mode (Phase 3) ──────────────────────────
+    // A podcast-style player for the per-topic summary clips: plays them
+    // back-to-back, and "Listen to this part" drops into the real source
+    // audio/video at that topic's timestamp. Managed imperatively (its own
+    // DOM under <body>, outside the render()'d #app) so playback survives
+    // the app's re-render cycle. Backed by the Phase 2 /api/tts routes.
+
+    let ttsAvailabilityFetched = false;
+    async function ensureTtsAvailability() {
+      if (ttsAvailabilityFetched) return;
+      ttsAvailabilityFetched = true;
+      try {
+        const r = await fetch(`${API_BASE}/api/tts/availability`, { credentials: "same-origin" });
+        if (!r.ok) return;
+        const d = await r.json();
+        state.ttsAvailable = !!d.has_tts;
+        state.ttsAllowed = !!d.allowed;
+        state.ttsVoice = d.default_voice || null;
+        if (state.ttsAllowed) render(); // reveal the 🎧 Listen button
+      } catch {}
+    }
+
+    // SVG icons (crisper + more reliable than emoji glyphs, which can
+    // render identically for ▶/⏸ on some platforms).
+    const RP_ICON_PLAY = '<svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor"><polygon points="6,4 20,12 6,20"></polygon></svg>';
+    const RP_ICON_PAUSE = '<svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor"><rect x="6" y="4" width="4" height="16" rx="1"></rect><rect x="14" y="4" width="4" height="16" rx="1"></rect></svg>';
+    // Playback-speed steps the speed button cycles through. Values match
+    // YouTube's allowed setPlaybackRate values so the deep-dive source can
+    // use the same rate.
+    const RP_SPEEDS = [1, 1.25, 1.5, 1.75, 2];
+
+    const recapPlayer = {
+      sessionId: null, index: 0, total: 0,
+      ready: new Set(),         // topics with a cached, playable clip
+      empty: new Set(),         // topics with no summary text (no audio possible)
+      genInflight: new Map(),   // index → in-flight generate promise (dedup)
+      waitingFor: null, keepPlaying: false, paused: false,
+      deepDive: false, deepEnd: Infinity,
+      speed: 1, watchdog: null, bgGen: false, retryTimer: null,
+      audio: null, uiTimer: null,
+      activeLine: null, userScrolledAt: 0,
+    };
+
+    function openRecapPlayer() {
+      if (!state.currentSessionId) { showToast("Save this recap first to listen.", "!"); return; }
+      pauseSource();
+      if (typeof stopTranscriptSync === "function") stopTranscriptSync();
+      Object.assign(recapPlayer, {
+        sessionId: state.currentSessionId, index: 0, total: state.chunks.length,
+        ready: new Set(), empty: new Set(), genInflight: new Map(), waitingFor: null,
+        keepPlaying: false, paused: false, deepDive: false, deepEnd: Infinity,
+        activeLine: null, userScrolledAt: 0,
+      });
+      buildPlayerOverlay();
+      rpSetTranscriptVisible(false); // transcript renders per-section on deep-dive
+      document.getElementById("recap-player-overlay").hidden = false;
+      const keep = document.getElementById("rp-keep");
+      if (keep) keep.checked = false;
+      setupMediaSession();
+      updatePlayerUI();
+      updateProgressDots();
+      updateSpeedBtn();
+      // Low-frequency UI sync so the play/pause icon ALWAYS reflects the
+      // real playback state, regardless of which media event fired (mobile
+      // autoplay/gesture quirks otherwise leave it stale).
+      if (recapPlayer.uiTimer) clearInterval(recapPlayer.uiTimer);
+      recapPlayer.uiTimer = setInterval(updatePlayPauseBtn, 400);
+      playTopic(0);                 // generates topic 0 on demand, then plays
+      startBackgroundGeneration();  // pre-generate the rest, in order
+    }
+
+    function closeRecapPlayer() {
+      recapPlayer.bgGen = false; // stop the background pre-generation loop
+      if (recapPlayer.retryTimer) { clearTimeout(recapPlayer.retryTimer); recapPlayer.retryTimer = null; }
+      stopWatchdog();
+      if (recapPlayer.uiTimer) { clearInterval(recapPlayer.uiTimer); recapPlayer.uiTimer = null; }
+      if (recapPlayer.audio) { try { recapPlayer.audio.pause(); } catch {} }
+      pauseSource();
+      const ov = document.getElementById("recap-player-overlay");
+      if (ov) ov.hidden = true;
+      if ("mediaSession" in navigator) { try { navigator.mediaSession.metadata = null; } catch {} }
+    }
+
+    function buildPlayerOverlay() {
+      if (document.getElementById("recap-player-overlay")) return;
+      const ov = document.createElement("div");
+      ov.id = "recap-player-overlay";
+      ov.className = "rp-overlay";
+      ov.hidden = true;
+      ov.innerHTML = `
+        <div class="rp-panel" role="dialog" aria-label="Audio recap player">
+          <div class="rp-head">
+            <div class="rp-source-title" id="rp-source-title"></div>
+            <button class="rp-close" onclick="closeRecapPlayer()" aria-label="Close">✕</button>
+          </div>
+          <div class="rp-now">
+            <div class="rp-topic-counter" id="rp-counter"></div>
+            <div class="rp-topic-title" id="rp-title"></div>
+            <div class="rp-status" id="rp-status"></div>
+            <div class="rp-summary" id="rp-summary"></div>
+            <div class="rp-transcript" id="rp-transcript" hidden></div>
+          </div>
+          <div class="rp-dots" id="rp-dots"></div>
+          <button class="rp-deeper" id="rp-deeper" onclick="onDeeperClick()">▶ Listen to this part</button>
+          <label class="rp-keep"><input type="checkbox" id="rp-keep" onchange="toggleKeepPlaying()"> Keep playing the original after this part</label>
+          <div class="rp-controls">
+            <button class="rp-ctrl rp-speed" id="rp-speed" onclick="cyclePlaybackSpeed()" aria-label="Playback speed" title="Playback speed">1&times;</button>
+            <button class="rp-ctrl" onclick="prevTopic()" aria-label="Previous topic">⏮</button>
+            <button class="rp-ctrl rp-play" id="rp-play" onclick="togglePlayerPlay()" aria-label="Play or pause">${RP_ICON_PLAY}</button>
+            <button class="rp-ctrl" onclick="nextTopic()" aria-label="Next topic">⏭</button>
+          </div>
+        </div>`;
+      ov.addEventListener("click", (e) => { if (e.target === ov) closeRecapPlayer(); });
+      document.body.appendChild(ov);
+      document.addEventListener("keydown", (e) => {
+        const o = document.getElementById("recap-player-overlay");
+        if (e.key === "Escape" && o && !o.hidden) closeRecapPlayer();
+      });
+
+      // Swipe left/right anywhere on the card → next / previous topic.
+      // Requires a mostly-horizontal drag so it doesn't fight the summary's
+      // vertical scroll or register button taps.
+      const panel = ov.querySelector(".rp-panel");
+      let touchX = null, touchY = null;
+      panel.addEventListener("touchstart", (e) => {
+        const t = e.changedTouches[0]; touchX = t.clientX; touchY = t.clientY;
+      }, { passive: true });
+      panel.addEventListener("touchend", (e) => {
+        if (touchX === null) return;
+        const t = e.changedTouches[0];
+        const dx = t.clientX - touchX, dy = t.clientY - touchY;
+        touchX = touchY = null;
+        if (Math.abs(dx) > 45 && Math.abs(dx) > Math.abs(dy) * 1.5) {
+          dx < 0 ? nextTopic() : prevTopic();
+        }
+      }, { passive: true });
+
+      const a = document.createElement("audio");
+      a.id = "recap-audio";
+      a.preload = "auto";
+      a.addEventListener("ended", onRecapClipEnded);
+      ["play", "playing", "pause", "waiting", "loadeddata"].forEach((ev) =>
+        a.addEventListener(ev, updatePlayPauseBtn)
+      );
+      a.addEventListener("error", onRecapAudioError);
+      document.body.appendChild(a);
+      recapPlayer.audio = a;
+
+      // While the user is scrolling the transcript, hold off auto-scroll so
+      // we don't yank them back to the playing line.
+      const tc = document.getElementById("rp-transcript");
+      if (tc) tc.addEventListener("scroll", () => { recapPlayer.userScrolledAt = Date.now(); }, { passive: true });
+    }
+
+    // Render the follow-along transcript for ONE section (the topic you're
+    // deep-diving) — not the whole recap — so you see just this part's words
+    // and can't scroll off into unrelated future sections. Each line seeks
+    // the source to its timestamp on tap (like the main app).
+    function rpRenderSection(ci) {
+      const c = document.getElementById("rp-transcript");
+      if (!c) return;
+      const ch = (state.chunks || [])[ci];
+      const entries = ch && Array.isArray(ch.entries) ? ch.entries : [];
+      c.innerHTML = entries.map((e) => {
+        const off = Math.floor(e.offset || 0);
+        return `<button class="rp-tline" data-offset="${off}" onclick="rpTranscriptSeek(${off}, ${ci})">` +
+          `<span class="rp-tts">${formatTime(e.offset || 0)}</span>` +
+          `<span>${escHtml(e.text || "")}</span></button>`;
+      }).join("");
+      recapPlayer.activeLine = null;
+      c.scrollTop = 0;
+    }
+
+    // Which section (chunk index) the source playhead at time `t` falls in.
+    function rpCurrentChunkForTime(t) {
+      const chunks = state.chunks || [];
+      let ci = 0;
+      for (let k = 0; k < chunks.length; k++) {
+        if (t >= (chunks[k].startTime || 0)) ci = k; else break;
+      }
+      return ci;
+    }
+
+    function rpSetTranscriptVisible(show) {
+      const t = document.getElementById("rp-transcript");
+      const s = document.getElementById("rp-summary");
+      if (t) t.hidden = !show;
+      if (s) s.style.display = show ? "none" : "";
+    }
+
+    // Highlight + auto-scroll the transcript line for source time `t`.
+    function rpSyncTranscript(t) {
+      const c = document.getElementById("rp-transcript");
+      if (!c || c.hidden) return;
+      // Re-scope to whichever section the playhead is in. With "keep playing"
+      // on, this advances the transcript (and the topic header) into the next
+      // section as the source rolls past the boundary.
+      const ci = rpCurrentChunkForTime(t);
+      if (ci !== recapPlayer.index) {
+        recapPlayer.index = ci;
+        const next = state.chunks[ci + 1];
+        recapPlayer.deepEnd = next ? Math.floor(next.startTime) : Infinity;
+        rpRenderSection(ci);
+        updatePlayerUI();
+        updateProgressDots();
+        updateMediaSessionMetadata();
+      }
+      const lines = c.querySelectorAll(".rp-tline");
+      let active = null;
+      for (const ln of lines) {
+        if (parseFloat(ln.dataset.offset) <= t) active = ln; else break;
+      }
+      if (active && active !== recapPlayer.activeLine) {
+        if (recapPlayer.activeLine) recapPlayer.activeLine.classList.remove("rp-tline-active");
+        active.classList.add("rp-tline-active");
+        recapPlayer.activeLine = active;
+        if (!recapPlayer.userScrolledAt || Date.now() - recapPlayer.userScrolledAt > 4000) {
+          active.scrollIntoView({ block: "center", behavior: "smooth" });
+        }
+      }
+    }
+
+    // Tap a transcript line → seek the source there and re-anchor the topic.
+    function rpTranscriptSeek(offset, chunkIndex) {
+      lastSeekTarget = null;
+      recapPlayer.paused = false;
+      seekTo(offset);
+      if (typeof chunkIndex === "number" && state.chunks[chunkIndex]) {
+        if (chunkIndex !== recapPlayer.index) rpRenderSection(chunkIndex);
+        recapPlayer.index = chunkIndex;
+        const next = state.chunks[chunkIndex + 1];
+        recapPlayer.deepEnd = next ? Math.floor(next.startTime) : Infinity;
+        updatePlayerUI();
+        updateProgressDots();
+        updateMediaSessionMetadata();
+      }
+      applyPlaybackSpeed();
+      setTimeout(applyPlaybackSpeed, 300);
+      if (!recapPlayer.watchdog) startWatchdog();
+    }
+
+    // Deep-dive topic navigation: seek the source to an adjacent topic.
+    function rpSeekTopic(idx) {
+      idx = Math.max(0, Math.min(recapPlayer.total - 1, idx));
+      const ch = state.chunks[idx];
+      if (ch) rpTranscriptSeek(Math.floor(ch.startTime), idx);
+    }
+
+    // ── On-demand clip generation ──
+    // Each clip is generated when the player reaches it (and prefetched one
+    // ahead), and RETRIED until it succeeds — we never skip a topic. A
+    // background pass pre-generates the rest in order so they're usually
+    // ready before you arrive.
+
+    // Generate (or confirm cached) the clip for topic i. Deduped so the
+    // background pass and on-demand playback don't double-request. Resolves
+    // { ok } | { ok:false, empty:true } | { ok:false, error }.
+    function ensureClip(i) {
+      if (recapPlayer.ready.has(i)) return Promise.resolve({ ok: true });
+      if (recapPlayer.empty.has(i)) return Promise.resolve({ ok: false, empty: true });
+      if (recapPlayer.genInflight.has(i)) return recapPlayer.genInflight.get(i);
+      const p = fetch(
+        `${API_BASE}/api/tts/generate/${encodeURIComponent(recapPlayer.sessionId)}/${i}`,
+        { method: "POST", credentials: "same-origin" }
+      )
+        .then(async (res) => {
+          let d = {};
+          try { d = await res.json(); } catch {}
+          if (res.ok && d.ok) { recapPlayer.ready.add(i); updateProgressDots(); return { ok: true }; }
+          if (d && d.empty) { recapPlayer.empty.add(i); updateProgressDots(); return { ok: false, empty: true }; }
+          return { ok: false, error: (d && d.error) || ("HTTP " + res.status) };
+        })
+        .catch((e) => ({ ok: false, error: e?.message || "network error" }))
+        .finally(() => { recapPlayer.genInflight.delete(i); });
+      recapPlayer.genInflight.set(i, p);
+      return p;
+    }
+
+    // Pre-generate every clip in order, in the background, so they're ready
+    // before playback reaches them. Resilient — any failure here is retried
+    // on demand when the user actually reaches that topic.
+    async function startBackgroundGeneration() {
+      recapPlayer.bgGen = true;
+      for (let i = 0; i < recapPlayer.total; i++) {
+        if (!recapPlayer.bgGen) return; // player closed
+        if (recapPlayer.ready.has(i) || recapPlayer.empty.has(i)) continue;
+        try { await ensureClip(i); } catch {}
+      }
+    }
+
+    function prefetch(i) {
+      if (i < 0 || i >= recapPlayer.total) return;
+      if (recapPlayer.ready.has(i) || recapPlayer.empty.has(i)) return;
+      ensureClip(i); // fire-and-forget
+    }
+
+    function playClip(i) {
+      const a = recapPlayer.audio;
+      a.src = `${API_BASE}/api/tts/audio/${encodeURIComponent(recapPlayer.sessionId)}/${i}`;
+      try { a.playbackRate = recapPlayer.speed; } catch {}
+      // Honor the paused intent across topic navigation: load the clip but
+      // only start it if the listener hasn't paused.
+      if (!recapPlayer.paused) a.play().catch(() => {});
+      updatePlayPauseBtn();
+    }
+
+    function playTopic(i) {
+      if (i < 0 || i >= recapPlayer.total) return;
+      if (recapPlayer.retryTimer) { clearTimeout(recapPlayer.retryTimer); recapPlayer.retryTimer = null; }
+      recapPlayer.index = i;
+      exitDeepDive(true); // leaving deep-dive → stop the real source
+      updatePlayerUI();
+      updateProgressDots();
+      updateMediaSessionMetadata();
+
+      if (recapPlayer.empty.has(i)) {
+        recapPlayer.waitingFor = null;
+        setNowPlayingStatus("This topic has no summary to read aloud.");
+        return; // don't auto-skip — the listener can move on with next / swipe
+      }
+      if (recapPlayer.ready.has(i)) {
+        recapPlayer.waitingFor = null;
+        setNowPlayingStatus("");
+        playClip(i);
+        prefetch(i + 1);
+        return;
+      }
+      // Not ready yet — generate it now, WAIT, keep the listener informed,
+      // and retry on failure. Never abandon the topic.
+      recapPlayer.waitingFor = i;
+      try { recapPlayer.audio.pause(); } catch {}
+      setNowPlayingStatus("Preparing the audio for this topic…");
+      updatePlayPauseBtn();
+      ensureClip(i).then((r) => {
+        if (recapPlayer.index !== i || recapPlayer.deepDive) return; // listener moved on
+        if (r.ok) {
+          recapPlayer.waitingFor = null;
+          setNowPlayingStatus("");
+          playClip(i);
+          prefetch(i + 1);
+        } else if (r.empty) {
+          recapPlayer.empty.add(i);
+          recapPlayer.waitingFor = null;
+          updateProgressDots();
+          setNowPlayingStatus("This topic has no summary to read aloud.");
+        } else {
+          // Transient failure — keep trying, keep the listener informed.
+          setNowPlayingStatus("This clip isn't ready yet — still generating…");
+          recapPlayer.retryTimer = setTimeout(() => {
+            if (recapPlayer.index === i && !recapPlayer.deepDive && !recapPlayer.ready.has(i)) playTopic(i);
+          }, 3000);
+        }
+      });
+    }
+
+    function onRecapClipEnded() {
+      if (recapPlayer.deepDive) return;
+      nextTopic();
+    }
+
+    function nextTopic() {
+      if (recapPlayer.deepDive) { rpSeekTopic(recapPlayer.index + 1); return; }
+      if (recapPlayer.index + 1 < recapPlayer.total) {
+        playTopic(recapPlayer.index + 1);
+      } else {
+        exitDeepDive(true);
+        try { recapPlayer.audio.pause(); } catch {}
+        setNowPlayingStatus("End of recap ✓");
+        updatePlayPauseBtn();
+      }
+    }
+
+    function prevTopic() {
+      if (recapPlayer.deepDive) { rpSeekTopic(recapPlayer.index - 1); return; }
+      playTopic(Math.max(0, recapPlayer.index - 1));
+    }
+
+    function togglePlayerPlay() {
+      if (recapPlayer.deepDive) {
+        if (sourceIsPlaying()) { recapPlayer.paused = true; pauseSource(); }
+        else { recapPlayer.paused = false; resumeSource(); }
+        setTimeout(updatePlayPauseBtn, 50);
+        return;
+      }
+      const a = recapPlayer.audio;
+      if (!a) return;
+      const i = recapPlayer.index;
+      if (!a.paused) { recapPlayer.paused = true; a.pause(); updatePlayPauseBtn(); return; }
+      // Paused → resume; if the current clip isn't loaded/ready yet, route
+      // through playTopic so it generates + waits rather than no-op.
+      recapPlayer.paused = false;
+      if (recapPlayer.ready.has(i) && a.src) a.play().catch(() => {});
+      else playTopic(i);
+    }
+
+    // ── "Go deeper": play the real source for this topic ──
+    function onDeeperClick() { recapPlayer.deepDive ? resumeRecap() : goDeeper(); }
+
+    function goDeeper() {
+      const chunk = state.chunks[recapPlayer.index];
+      if (!chunk) return;
+      recapPlayer.deepDive = true;
+      recapPlayer.paused = false;
+      recapPlayer.activeLine = null;
+      try { recapPlayer.audio.pause(); } catch {}
+      const next = state.chunks[recapPlayer.index + 1];
+      recapPlayer.deepEnd = next ? Math.floor(next.startTime) : Infinity;
+      lastSeekTarget = null; // force a fresh seek + play
+      seekTo(Math.floor(chunk.startTime));
+      highlightChunk(recapPlayer.index);
+      // Carry the chosen speed into the source. Delayed because seekTo may
+      // re-render to un-minimize the player before the element/iframe exists.
+      applyPlaybackSpeed();
+      setTimeout(applyPlaybackSpeed, 400);
+      rpRenderSection(recapPlayer.index); // this section's transcript only
+      rpSetTranscriptVisible(true);        // show the follow-along transcript
+      startWatchdog();
+      setNowPlayingStatus("Playing the original — follow along below");
+      updatePlayerUI();
+    }
+
+    function resumeRecap() {
+      const i = recapPlayer.index;
+      exitDeepDive(true);
+      playTopic(i); // back to THIS topic's summary
+    }
+
+    function exitDeepDive(pauseTheSource) {
+      if (!recapPlayer.deepDive) return;
+      recapPlayer.deepDive = false;
+      stopWatchdog();
+      rpSetTranscriptVisible(false);
+      if (pauseTheSource) pauseSource();
+      updatePlayerUI();
+    }
+
+    function toggleKeepPlaying() {
+      const cb = document.getElementById("rp-keep");
+      recapPlayer.keepPlaying = !!(cb && cb.checked);
+      // The watchdog always runs while deep-diving (it also drives transcript
+      // sync); keepPlaying just gates the auto-return inside it.
+      if (recapPlayer.deepDive && !recapPlayer.watchdog) startWatchdog();
+    }
+
+    // While deep-diving: sync the follow-along transcript to the source's
+    // clock every tick, and — unless "keep playing" — pop back to the next
+    // summary when this topic's segment ends.
+    function startWatchdog() {
+      stopWatchdog();
+      recapPlayer.watchdog = setInterval(() => {
+        const t = sourceCurrentTime();
+        if (t == null) return;
+        // Auto-return at the section boundary FIRST (before the transcript
+        // re-scopes deepEnd to the next section) — unless "keep playing".
+        if (!recapPlayer.keepPlaying && recapPlayer.deepEnd !== Infinity && t >= recapPlayer.deepEnd) {
+          exitDeepDive(true);
+          nextTopic();
+          return;
+        }
+        rpSyncTranscript(t);
+      }, 400);
+    }
+    function stopWatchdog() {
+      if (recapPlayer.watchdog) { clearInterval(recapPlayer.watchdog); recapPlayer.watchdog = null; }
+    }
+
+    function sourceCurrentTime() {
+      if (state.currentType === "podcast") { const a = document.getElementById("podcast-audio"); return a ? a.currentTime : null; }
+      if (ytPlayer && ytPlayer.getCurrentTime) { try { return ytPlayer.getCurrentTime(); } catch { return null; } }
+      return null;
+    }
+    function sourceIsPlaying() {
+      if (state.currentType === "podcast") { const a = document.getElementById("podcast-audio"); return a ? !a.paused : false; }
+      if (ytPlayer && ytPlayer.getPlayerState) { try { return ytPlayer.getPlayerState() === YT.PlayerState.PLAYING; } catch { return false; } }
+      return false;
+    }
+    function pauseSource() {
+      try {
+        if (state.currentType === "podcast") { const a = document.getElementById("podcast-audio"); if (a) a.pause(); }
+        else if (ytPlayer && ytPlayer.pauseVideo) ytPlayer.pauseVideo();
+      } catch {}
+    }
+    function resumeSource() {
+      try {
+        if (state.currentType === "podcast") { const a = document.getElementById("podcast-audio"); if (a) a.play().catch(() => {}); }
+        else if (ytPlayer && ytPlayer.playVideo) ytPlayer.playVideo();
+      } catch {}
+    }
+
+    function updatePlayerUI() {
+      const chunk = state.chunks[recapPlayer.index] || {};
+      const set = (id, txt) => { const el = document.getElementById(id); if (el) el.textContent = txt; };
+      set("rp-counter", recapPlayer.total ? `Topic ${recapPlayer.index + 1} of ${recapPlayer.total}` : "");
+      set("rp-title", chunk.title || "");
+      set("rp-summary", chunk.summary || "");
+      set("rp-source-title", state.videoTitle || "");
+      const deeper = document.getElementById("rp-deeper");
+      if (deeper) {
+        if (recapPlayer.deepDive) { deeper.textContent = "← Back to the summary"; deeper.classList.add("rp-resume"); }
+        else { deeper.textContent = "▶ Listen to this part"; deeper.classList.remove("rp-resume"); }
+      }
+      updatePlayPauseBtn();
+    }
+    function setNowPlayingStatus(txt) {
+      const s = document.getElementById("rp-status");
+      if (s) s.textContent = txt || "";
+    }
+    function updatePlayPauseBtn() {
+      const btn = document.getElementById("rp-play");
+      const playing = recapPlayer.deepDive ? sourceIsPlaying() : !!(recapPlayer.audio && !recapPlayer.audio.paused);
+      if (btn) btn.innerHTML = playing ? RP_ICON_PAUSE : RP_ICON_PLAY;
+      if ("mediaSession" in navigator) { try { navigator.mediaSession.playbackState = playing ? "playing" : "paused"; } catch {} }
+    }
+
+    // ── Playback speed (segment clips AND the deep-dive source) ──
+    function cyclePlaybackSpeed() {
+      const i = RP_SPEEDS.indexOf(recapPlayer.speed);
+      recapPlayer.speed = RP_SPEEDS[(i + 1) % RP_SPEEDS.length];
+      updateSpeedBtn();
+      applyPlaybackSpeed();
+    }
+    function updateSpeedBtn() {
+      const btn = document.getElementById("rp-speed");
+      if (btn) btn.innerHTML = `${recapPlayer.speed}&times;`;
+    }
+    function applyPlaybackSpeed() {
+      const s = recapPlayer.speed;
+      if (recapPlayer.audio) { try { recapPlayer.audio.playbackRate = s; } catch {} }
+      const pa = document.getElementById("podcast-audio");
+      if (pa) { try { pa.playbackRate = s; } catch {} }
+      if (ytPlayer && ytPlayer.setPlaybackRate) { try { ytPlayer.setPlaybackRate(s); } catch {} }
+    }
+
+    // The current clip's <audio> failed to load (transient network error, or
+    // a cached file that went missing). Don't skip — drop it from the ready
+    // cache so we re-confirm/re-generate, and retry the same topic.
+    function onRecapAudioError() {
+      if (recapPlayer.deepDive) return;
+      const i = recapPlayer.index;
+      recapPlayer.ready.delete(i);
+      recapPlayer.genInflight.delete(i);
+      updateProgressDots();
+      setNowPlayingStatus("Trouble loading this clip — retrying…");
+      if (recapPlayer.retryTimer) clearTimeout(recapPlayer.retryTimer);
+      recapPlayer.retryTimer = setTimeout(() => {
+        if (recapPlayer.index === i && !recapPlayer.deepDive) playTopic(i);
+      }, 1200);
+    }
+    function updateProgressDots() {
+      const wrap = document.getElementById("rp-dots");
+      if (!wrap) return;
+      let html = "";
+      for (let i = 0; i < recapPlayer.total; i++) {
+        let cls = "rp-dot";
+        if (i === recapPlayer.index) cls += " active";
+        else if (recapPlayer.empty.has(i)) cls += " failed"; // no summary → dim
+        else if (recapPlayer.ready.has(i)) cls += " ready";
+        html += `<span class="${cls}" title="Topic ${i + 1}" style="cursor:pointer" onclick="playTopic(${i})"></span>`;
+      }
+      wrap.innerHTML = html;
+    }
+
+    function setupMediaSession() {
+      if (!("mediaSession" in navigator)) return;
+      try {
+        navigator.mediaSession.setActionHandler("play", () => togglePlayerPlay());
+        navigator.mediaSession.setActionHandler("pause", () => togglePlayerPlay());
+        navigator.mediaSession.setActionHandler("nexttrack", () => nextTopic());
+        navigator.mediaSession.setActionHandler("previoustrack", () => prevTopic());
+      } catch {}
+    }
+    function updateMediaSessionMetadata() {
+      if (!("mediaSession" in navigator) || typeof MediaMetadata === "undefined") return;
+      const chunk = state.chunks[recapPlayer.index] || {};
+      try {
+        navigator.mediaSession.metadata = new MediaMetadata({
+          title: chunk.title || "Recap",
+          artist: state.videoTitle || "Recap",
+          album: recapPlayer.total ? `Topic ${recapPlayer.index + 1} of ${recapPlayer.total}` : "",
+        });
+      } catch {}
+    }
+
     // ── Actions ──────────────────────────────────────────────────────────────
 
     function renderYtdlpStatus() {
@@ -4512,12 +9972,32 @@
     }
 
     function toggleLogGroup(idx) {
-      if (state.collapsedLogGroups.has(idx)) {
+      const wasCollapsed = state.collapsedLogGroups.has(idx);
+      if (wasCollapsed) {
         state.collapsedLogGroups.delete(idx);
       } else {
         state.collapsedLogGroups.add(idx);
       }
-      render();
+      // Surgical DOM update: toggle the body display + chevron icon
+      // without calling render(). A full render() rebuilds the entire
+      // app DOM — wipes the YouTube iframe, resets scroll position in
+      // the activity log + results view. Painful UX for what should
+      // be a 1-element flip.
+      const body = document.querySelector(`.log-group-body[data-group="${idx}"]`);
+      if (body) {
+        body.style.display = wasCollapsed ? "" : "none";
+      }
+      // Find the matching header by attribute selector; flip the
+      // chevron text. The first <span> inside the header is the
+      // chevron (per renderLog markup).
+      const headers = document.querySelectorAll(".log-group-header");
+      for (const h of headers) {
+        if (h.getAttribute("onclick") === `toggleLogGroup(${idx})`) {
+          const chev = h.querySelector("span");
+          if (chev) chev.textContent = wasCollapsed ? "▾" : "▸";
+          break;
+        }
+      }
     }
 
     function renderLog() {
@@ -4608,6 +10088,76 @@
     }
 
     function toggleLog() { state.logOpen = !state.logOpen; render(); }
+
+    // "What links can I paste?" popover toggle. The event arg lets us
+    // stopPropagation so the click-outside handler doesn't immediately
+    // close the popover we just opened.
+    function toggleFormatsInfo(e) {
+      if (e) e.stopPropagation();
+      state.formatsInfoOpen = !state.formatsInfoOpen;
+      render();
+    }
+    function closeFormatsInfo() {
+      if (state.formatsInfoOpen) {
+        state.formatsInfoOpen = false;
+        render();
+      }
+    }
+    // Global click handler: when the popover is open, any click that
+    // isn't on the info button or inside the popover closes it. Mounted
+    // once at boot; cheap (no-op when popover is closed).
+    document.addEventListener("click", (e) => {
+      if (!state.formatsInfoOpen) return;
+      const card = e.target.closest(".formats-info-card");
+      const btn = e.target.closest(".info-btn");
+      if (card || btn) return;
+      closeFormatsInfo();
+    });
+
+    // Brand-styled "what can I paste?" card. Rendered as a popover
+    // anchored under the info button on the input bar. Content is
+    // intentionally compact — a list of supported source formats with
+    // one line of value-prop, plus a teaser for the paid subscriptions
+    // feature so trial / free users see a reason to upgrade later.
+    function renderFormatsInfoCard() {
+      // Paid users see the "Subscribe to feeds" item as an active
+      // capability. Free / trial users see it as a soft upsell line.
+      const hasSubs = hasEntitlement("subscriptions");
+      const subsItem = hasSubs
+        ? `<li><strong>Subscribe to channels and podcasts</strong> — Recaps auto-summarizes new episodes as they're published. Find the Subscribe button by pasting a channel or feed URL.</li>`
+        : `<li style="opacity:0.75;"><strong>Subscribe to channels and podcasts</strong> <span style="color:#a5b4fc;font-size:11px;font-weight:600;">&middot; Pro</span> — auto-summarize new episodes as they're published.</li>`;
+      // Free-credits hint shown ONLY to anonymous visitors who haven't
+      // yet minted a trial cookie. After their first summarize the
+      // trial counter takes over and this line goes away. Hidden for
+      // signed-in users (who see their tenant_credits balance instead)
+      // and for trial holders who've already started using credits.
+      const showAnonCreditsHint =
+        isMulti() &&
+        state.account?.state === "anonymous" &&
+        (state.account?.available_trial_credits || 0) > 0;
+      const anonCreditsLine = showAnonCreditsHint
+        ? `<div style="margin-bottom:12px;padding:10px 12px;background:rgba(99,102,241,0.10);border:1px solid rgba(99,102,241,0.30);border-radius:8px;font-size:12px;color:#a5b4fc;">
+            <strong style="color:#c7d2fe;">${state.account.available_trial_credits} free credit${state.account.available_trial_credits === 1 ? "" : "s"}</strong> — paste a link to claim ${state.account.available_trial_credits === 1 ? "it" : "them"}. Sign up after for more.
+          </div>`
+        : "";
+      return `
+        <div class="formats-info-card" onclick="event.stopPropagation()">
+          <div class="formats-info-card-header">
+            <strong>What can I recap?</strong>
+            <button class="formats-info-close" type="button" onclick="closeFormatsInfo()" aria-label="Close">&times;</button>
+          </div>
+          ${anonCreditsLine}
+          <ul class="formats-info-list">
+            <li><strong>YouTube videos</strong> — paste any youtube.com or youtu.be link.</li>
+            <li><strong>Podcast RSS feeds</strong> — paste a feed URL and Recaps will summarize the latest episode.</li>
+            <li><strong>Apple Podcasts</strong> — share an episode link from the Podcasts app. Recaps resolves it to the underlying audio.</li>
+            <li><strong>Spotify podcasts</strong> — share an episode link from Spotify. Recaps resolves it the same way.</li>
+            <li><strong>Fountain</strong> — paste a fountain.fm episode link; we pull the audio directly from Fountain's CDN.</li>
+            ${subsItem}
+          </ul>
+        </div>
+      `;
+    }
     function toggleMobileMenu(e) {
       e && e.stopPropagation();
       state.mobileMenuOpen = !state.mobileMenuOpen;
@@ -4618,7 +10168,20 @@
     }
     function toggleSettings() {
       state.settingsOpen = !state.settingsOpen;
-      if (state.settingsOpen && !state.subsLoaded) loadSubscriptions();
+      if (state.settingsOpen && !state.subsLoaded && canUseSubscriptions()) loadSubscriptions();
+      // Lazy-load multi-tenant admin/account data when the modal opens.
+      // Admins get the tenant list + activity feed; tenants get their
+      // own sessions. Idempotent (loaders check state before fetching),
+      // but we deliberately re-fetch on every open so a returning
+      // operator sees fresh data.
+      if (state.settingsOpen && isMulti()) {
+        if (isAdmin()) {
+          loadAdminTenants();
+          loadAdminActivity(state.ops.activityHours || 24);
+        } else if (state.account?.user) {
+          loadMySessions();
+        }
+      }
       render();
     }
 
@@ -4658,16 +10221,29 @@
       try {
         const res = await fetch(`${API_BASE}/api/history/${id}`);
         const data = await res.json();
+        // Reading a saved episode — stop following any in-flight stream so
+        // its analysis windows don't override this view (the job keeps
+        // running in the background and lands in the library when done).
+        state.followStream = false;
         state.currentSessionId = id;
         state.videoId = data.videoId;
         state.videoTitle = data.title || "";
         state.url = data.url || "";
         state.chunks = data.chunks || [];
+        // Speaker legend persisted alongside chunks in v0.2.121+
+        // (Phase 1E). Older sessions don't have this field — leaves
+        // null, frontend renders without speaker chips.
+        state.speakers = data.speakers || null;
+        // Phase 2 — saved-session speaker names from the relay's
+        // post-cluster polish pass. Older saved sessions don't have
+        // this field — null is fine, legend falls back to letters.
+        state.speakerNames = data.speakerNames || null;
         state.logs = data.logs || [];
         state.currentType = data.type || "youtube";
         state.expandedChunks = new Set();
         state.expandAll = false;
         state.loading = false;
+        state.streaming = false; // viewing a completed saved episode
         state.error = null;
         state.videoMinimized = false;
         // On mobile, close sidebar after selection; on desktop, keep it open
@@ -4992,7 +10568,7 @@
             }
             <div class="history-meta">${h.uploadDate ? formatUploadDate(h.uploadDate) : timeAgo(h.createdAt)} &middot; ${h.topicCount} topics</div>
           </div>
-          <button class="history-action-small" onclick="event.stopPropagation(); exportSessionPDF('${h.id}')" title="Export PDF">
+          <button class="history-action-small" onclick="event.stopPropagation(); showExportMenu(this, '${h.id}')" title="Export — PDF, Markdown, or JSON">
             <svg width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"></path><polyline points="14 2 14 8 20 8"></polyline></svg>
           </button>
           <button class="history-delete" onclick="deleteSession('${h.id}', event)" title="Delete">
@@ -5094,14 +10670,18 @@
     }
     function toggleChunk(i) {
       const wasExpanded = state.expandedChunks.has(i);
+      // Capture the current scroll offset BEFORE the re-render so we can
+      // restore it on collapse — render() rebuilds .chunks-scroll and would
+      // otherwise snap the list back to the top, losing the user's place.
+      const prevScroll = document.querySelector(".chunks-scroll")?.scrollTop || 0;
       // Collapse all others (accordion behavior)
       state.expandedChunks.clear();
       state.expandAll = false;
       // Toggle the clicked one
       if (!wasExpanded) state.expandedChunks.add(i);
       render();
-      // Scroll the expanded chunk to the top of the scroll area
       if (!wasExpanded) {
+        // Expanding: bring the now-open chunk to the top of the scroll area.
         setTimeout(() => {
           const chunkEl = document.getElementById("chunk-" + i);
           const scrollEl = document.querySelector(".chunks-scroll");
@@ -5109,6 +10689,12 @@
             chunkEl.scrollIntoView({ behavior: "smooth", block: "start" });
           }
         }, 60);
+      } else {
+        // Collapsing: keep the scroll position the user was already at (the
+        // chunks above the one they collapsed are unchanged, so the same
+        // offset lands them right back on the segment they were reading).
+        const scrollEl = document.querySelector(".chunks-scroll");
+        if (scrollEl) scrollEl.scrollTop = prevScroll;
       }
     }
     function toggleClipPanel() {
@@ -5188,7 +10774,14 @@
         const res = await fetch(`${API_BASE}/api/history/${sessionId}`);
         const data = await res.json();
         if (!data.chunks || data.chunks.length === 0) { showToast("No data to export", "⚠", 3000); return; }
-        buildPDF(data.title || "Untitled", data.videoId, data.chunks, data.type || "youtube");
+        buildPDF(
+          data.title || "Untitled",
+          data.videoId,
+          data.chunks,
+          data.type || "youtube",
+          data.speakerNames || null,
+          data.speakers || null,
+        );
       } catch (e) {
         showToast("Export failed: " + e.message, "✕", 4000);
       }
@@ -5196,7 +10789,349 @@
 
     function exportCurrentPDF() {
       if (!state.chunks.length) return;
-      buildPDF(state.videoTitle || "Untitled", state.videoId, state.chunks, state.currentType);
+      buildPDF(
+        state.videoTitle || "Untitled",
+        state.videoId,
+        state.chunks,
+        state.currentType,
+        state.speakerNames || null,
+        state.speakers || null,
+      );
+    }
+
+    // ── Markdown + JSON export helpers ────────────────────────────────
+    // Both Markdown and JSON exports treat the loaded session as the
+    // source of truth — same input shape as buildPDF. JSON is the raw
+    // record (everything saveToHistory persists); Markdown is a
+    // human-readable serialization with speaker-prefixed transcript
+    // lines + YouTube deeplinks where applicable. Both honor the
+    // speakerNames map so the operator's polish-pass-confirmed names
+    // appear in the export, not the raw Speaker_X cluster IDs.
+
+    function chunksToMarkdown(title, videoId, chunks, type, speakerNames, speakers, uploadDate) {
+      const _names = speakerNames && typeof speakerNames === "object" ? speakerNames : {};
+      const _speakers = speakers && typeof speakers === "object" ? speakers : null;
+      const lines = [];
+      lines.push(`# ${title || "Untitled"}`);
+      lines.push("");
+      lines.push(`**Topics:** ${chunks.length} · **Generated:** ${new Date().toLocaleString()}`);
+      if (uploadDate) lines.push(`**Source date:** ${uploadDate}`);
+      if (type === "youtube" && videoId) {
+        lines.push(`**Source:** https://youtube.com/watch?v=${videoId}`);
+      }
+      lines.push("");
+
+      // Speakers legend
+      if (_speakers && Object.keys(_speakers).length) {
+        lines.push("## Speakers");
+        lines.push("");
+        const ids = Object.keys(_speakers).sort((a, b) => {
+          if (a === "Speaker_Unknown") return 1;
+          if (b === "Speaker_Unknown") return -1;
+          return a.localeCompare(b);
+        });
+        for (const sid of ids) {
+          const display = pdfChipFullName(sid, _names);
+          const stats = _speakers[sid] || {};
+          const secs = Math.round(stats.total_speaking_seconds || 0);
+          const mins = Math.floor(secs / 60);
+          const tsec = secs % 60;
+          const timeStr = mins > 0 ? `${mins}m ${tsec}s` : `${tsec}s`;
+          const turns = stats.turns || 0;
+          lines.push(`- **${display}** — ${timeStr} speaking, ${turns} turn${turns !== 1 ? "s" : ""}`);
+        }
+        lines.push("");
+      }
+
+      // Topics
+      lines.push("## Topics");
+      lines.push("");
+      chunks.forEach((chunk, i) => {
+        const startSec = Math.floor(chunk.startTime || 0);
+        const startStr = formatTime(chunk.startTime || 0);
+        const next = chunks[i + 1];
+        const endStr = next
+          ? formatTime(next.startTime || 0)
+          : (chunk.entries && chunk.entries.length
+              ? formatTime(chunk.entries[chunk.entries.length - 1].offset || 0)
+              : startStr);
+        const ytLink = (type === "youtube" && videoId)
+          ? ` [↗](https://youtube.com/watch?v=${videoId}&t=${startSec})`
+          : "";
+        lines.push(`### ${i + 1}. ${chunk.title || "(untitled)"} (${startStr} — ${endStr})${ytLink}`);
+        lines.push("");
+        if (chunk.summary) lines.push(chunk.summary);
+        if (Array.isArray(chunk.entries) && chunk.entries.length) {
+          lines.push("");
+          lines.push("<details><summary>Transcript</summary>");
+          lines.push("");
+          for (const entry of chunk.entries) {
+            const ts = formatTime(entry.offset || 0);
+            const sp = entry.speaker_override || entry.speaker || null;
+            const who = sp ? pdfChipFullName(sp, _names) : null;
+            const tag = who ? ` **${who}:**` : "";
+            const tsec = Math.floor(entry.offset || 0);
+            const entryLink = (type === "youtube" && videoId)
+              ? `[\\[${ts}\\]](https://youtube.com/watch?v=${videoId}&t=${tsec})`
+              : `\\[${ts}\\]`;
+            lines.push(`- ${entryLink}${tag} ${entry.text || ""}`);
+          }
+          lines.push("");
+          lines.push("</details>");
+        }
+        lines.push("");
+      });
+      return lines.join("\n");
+    }
+
+    function downloadTextFile(filename, mimeType, content) {
+      const blob = new Blob([content], { type: mimeType });
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement("a");
+      a.href = url;
+      a.download = filename;
+      document.body.appendChild(a);
+      a.click();
+      setTimeout(() => {
+        a.remove();
+        URL.revokeObjectURL(url);
+      }, 0);
+    }
+
+    function safeExportFilename(title) {
+      return (title || "transcript")
+        .replace(/[^a-zA-Z0-9_\- ]/g, "")
+        .trim()
+        .substring(0, 60) || "transcript";
+    }
+
+    function exportCurrentMarkdown() {
+      if (!state.chunks.length) return;
+      const md = chunksToMarkdown(
+        state.videoTitle || "Untitled",
+        state.videoId,
+        state.chunks,
+        state.currentType,
+        state.speakerNames || null,
+        state.speakers || null,
+        state.videoUploadDate || null,
+      );
+      downloadTextFile(safeExportFilename(state.videoTitle) + ".md", "text/markdown;charset=utf-8", md);
+      showToast("Markdown exported", "📝");
+    }
+    function exportCurrentJSON() {
+      if (!state.chunks.length) return;
+      const rec = {
+        title: state.videoTitle || "Untitled",
+        videoId: state.videoId,
+        type: state.currentType,
+        uploadDate: state.videoUploadDate || null,
+        topicCount: state.chunks.length,
+        segmentCount: Array.isArray(state.entries) ? state.entries.length : null,
+        chunks: state.chunks,
+        speakers: state.speakers || null,
+        speakerNames: state.speakerNames || null,
+        exportedAt: new Date().toISOString(),
+      };
+      downloadTextFile(
+        safeExportFilename(state.videoTitle) + ".json",
+        "application/json;charset=utf-8",
+        JSON.stringify(rec, null, 2),
+      );
+      showToast("JSON exported", "{ }");
+    }
+
+    async function exportSessionMarkdown(sessionId) {
+      try {
+        const res = await fetch(`${API_BASE}/api/history/${sessionId}`);
+        const data = await res.json();
+        if (!data.chunks || data.chunks.length === 0) { showToast("No data to export", "⚠", 3000); return; }
+        const md = chunksToMarkdown(
+          data.title || "Untitled",
+          data.videoId,
+          data.chunks,
+          data.type || "youtube",
+          data.speakerNames || null,
+          data.speakers || null,
+          data.uploadDate || null,
+        );
+        downloadTextFile(safeExportFilename(data.title) + ".md", "text/markdown;charset=utf-8", md);
+        showToast("Markdown exported", "📝");
+      } catch (e) {
+        showToast("Export failed: " + e.message, "✕", 4000);
+      }
+    }
+    async function exportSessionJSON(sessionId) {
+      try {
+        const res = await fetch(`${API_BASE}/api/history/${sessionId}`);
+        const data = await res.json();
+        downloadTextFile(
+          safeExportFilename(data.title) + ".json",
+          "application/json;charset=utf-8",
+          JSON.stringify(data, null, 2),
+        );
+        showToast("JSON exported", "{ }");
+      } catch (e) {
+        showToast("Export failed: " + e.message, "✕", 4000);
+      }
+    }
+
+    // ── Export menu popover ──────────────────────────────────────────
+    // Shared 3-option menu (PDF / Markdown / JSON) used by the main
+    // view's Export button AND the per-row export button in the
+    // history sidebar. `scope` is "current" to use the loaded session
+    // OR a sessionId string to fetch a specific saved record. Closes
+    // on outside click or Escape. Positions itself below the anchor,
+    // clamped to viewport so it stays visible on mobile.
+    let _exportMenuCleanup = null;
+    function closeExportMenu() {
+      const ex = document.getElementById("export-menu-popover");
+      if (ex) ex.remove();
+      if (_exportMenuCleanup) { _exportMenuCleanup(); _exportMenuCleanup = null; }
+    }
+    function showExportMenu(anchorEl, scope) {
+      closeExportMenu();
+      const popover = document.createElement("div");
+      popover.id = "export-menu-popover";
+      popover.style.cssText =
+        "position:absolute; z-index:5000; background:#0f172a; border:1px solid #334155; " +
+        "border-radius:8px; padding:4px; box-shadow:0 8px 24px rgba(0,0,0,0.6); " +
+        "min-width:170px;";
+      const opts = [
+        { icon: "📄", label: "Export PDF",       run: () => scope === "current" ? exportCurrentPDF()       : exportSessionPDF(scope) },
+        { icon: "📝", label: "Export Markdown",  run: () => scope === "current" ? exportCurrentMarkdown()  : exportSessionMarkdown(scope) },
+        { icon: "{ }", label: "Export JSON",     run: () => scope === "current" ? exportCurrentJSON()      : exportSessionJSON(scope) },
+      ];
+      for (const opt of opts) {
+        const btn = document.createElement("button");
+        btn.type = "button";
+        btn.style.cssText =
+          "display:flex; align-items:center; gap:10px; width:100%; padding:9px 12px; " +
+          "background:transparent; border:none; color:#e2e8f0; font-size:13px; cursor:pointer; " +
+          "border-radius:5px; text-align:left; min-height:36px;";
+        btn.onmouseover = () => { btn.style.background = "rgba(255,255,255,0.06)"; };
+        btn.onmouseout = () => { btn.style.background = "transparent"; };
+        btn.innerHTML =
+          '<span style="display:inline-block; width:22px; text-align:center; font-family:ui-monospace,Menlo,Consolas,monospace; font-size:12px;">' + opt.icon + '</span>' +
+          '<span>' + opt.label + '</span>';
+        btn.onclick = (ev) => {
+          ev.stopPropagation();
+          closeExportMenu();
+          opt.run();
+        };
+        popover.appendChild(btn);
+      }
+      document.body.appendChild(popover);
+      // Position below the anchor, clamped to viewport. Mobile: if
+      // the popover would extend below the visible window, flip
+      // ABOVE the anchor instead.
+      const rect = anchorEl.getBoundingClientRect();
+      const popW = popover.offsetWidth;
+      const popH = popover.offsetHeight;
+      let left = rect.right - popW + window.scrollX;
+      if (left < 8) left = 8;
+      if (left + popW > window.innerWidth - 8) left = window.innerWidth - popW - 8;
+      let top = rect.bottom + window.scrollY + 4;
+      if (rect.bottom + popH + 4 > window.innerHeight && rect.top - popH - 4 > 0) {
+        top = rect.top + window.scrollY - popH - 4;
+      }
+      popover.style.left = left + "px";
+      popover.style.top = top + "px";
+
+      const onDocClick = (ev) => { if (!popover.contains(ev.target) && ev.target !== anchorEl) closeExportMenu(); };
+      const onKey = (ev) => { if (ev.key === "Escape") { ev.preventDefault(); closeExportMenu(); } };
+      setTimeout(() => {
+        document.addEventListener("click", onDocClick);
+        document.addEventListener("keydown", onKey);
+      }, 0);
+      _exportMenuCleanup = () => {
+        document.removeEventListener("click", onDocClick);
+        document.removeEventListener("keydown", onKey);
+      };
+    }
+    window.showExportMenu = showExportMenu;
+
+    // ── Speaker chip palette for PDF ───────────────────────────────
+    // Print-friendly versions of the on-screen chip palette
+    // (.speaker-chip.chip-a .. .chip-h in the stylesheet above). The
+    // on-screen palette uses semi-transparent backgrounds against a
+    // dark page which look great in a browser but wash out to
+    // unreadable pastels when rendered on white PDF paper. These
+    // versions use opaque backgrounds + a more saturated foreground
+    // so the letter inside the chip stays legible on a printed page.
+    // Order matches the CSS cycle ("abcdefgh"), so the same
+    // speaker gets the same color in the dashboard AND the PDF.
+    const PDF_CHIP_PALETTE = [
+      { bg: [254, 226, 226], fg: [185,  28,  28], border: [248, 113, 113] }, // a — red
+      { bg: [219, 234, 254], fg: [ 29,  78, 216], border: [ 96, 165, 250] }, // b — blue
+      { bg: [220, 252, 231], fg: [ 21, 128,  61], border: [ 74, 222, 128] }, // c — green
+      { bg: [254, 243, 199], fg: [180,  83,   9], border: [251, 191,  36] }, // d — amber
+      { bg: [243, 232, 255], fg: [109,  40, 217], border: [192, 132, 252] }, // e — purple
+      { bg: [224, 242, 254], fg: [  3, 105, 161], border: [ 56, 189, 248] }, // f — sky
+      { bg: [252, 231, 243], fg: [190,  24,  93], border: [244, 114, 182] }, // g — pink
+      { bg: [241, 245, 249], fg: [ 71,  85, 105], border: [148, 163, 184] }, // h / Unknown — slate
+    ];
+    function pdfChipColors(speakerLabel) {
+      if (speakerLabel === "Speaker_Unknown") return PDF_CHIP_PALETTE[7];
+      const m = String(speakerLabel || "").match(/^Speaker_([A-Z]+)$/);
+      if (!m) return PDF_CHIP_PALETTE[0];
+      let n = 0;
+      for (const c of m[1]) n = n * 26 + (c.charCodeAt(0) - 64);
+      n -= 1;
+      return PDF_CHIP_PALETTE[((n % 8) + 8) % 8];
+    }
+    // PDF version of speakerChipDisplay() — uses an explicit
+    // speakerNames map (passed from the loaded record) instead of
+    // state.speakerNames, so exports from the history sidebar use
+    // the names saved with that session and not whatever's loaded
+    // in the current view.
+    function pdfChipText(speakerLabel, speakerNames) {
+      if (speakerLabel === "Speaker_Unknown") return "?";
+      const m = String(speakerLabel || "").match(/^Speaker_([A-Z]+)$/);
+      const letter = m ? m[1] : "?";
+      const name = speakerNames && typeof speakerNames[speakerLabel] === "string" && speakerNames[speakerLabel].trim()
+        ? speakerNames[speakerLabel].trim()
+        : null;
+      if (!name) return letter;
+      const parts = name.split(/\s+/).filter(Boolean);
+      if (parts.length === 0) return letter;
+      if (parts.length === 1) return parts[0][0].toUpperCase();
+      return (parts[0][0] + parts[parts.length - 1][0]).toUpperCase();
+    }
+    function pdfChipFullName(speakerLabel, speakerNames) {
+      if (speakerLabel === "Speaker_Unknown") return "Unknown";
+      const name = speakerNames && typeof speakerNames[speakerLabel] === "string" && speakerNames[speakerLabel].trim()
+        ? speakerNames[speakerLabel].trim()
+        : null;
+      if (name) return name;
+      const m = String(speakerLabel || "").match(/^Speaker_([A-Z]+)$/);
+      return m ? "Speaker " + m[1] : speakerLabel;
+    }
+    // Renders a single rounded chip and returns its width (so callers
+    // can advance x for the next element). chipText is the short
+    // letter/initials shown inside; speakerLabel drives the color.
+    // `chipText` may be empty — then nothing is drawn (returns 0).
+    function drawPDFChip(doc, speakerLabel, chipText, x, baselineY) {
+      if (!chipText) return 0;
+      const colors = pdfChipColors(speakerLabel);
+      // Approximate the on-screen chip: 6mm wide minimum, 4mm tall.
+      // Add extra width for 2-character chips (initials like "MH").
+      const chipH = 4.2;
+      const padX = 1.3;
+      doc.setFont("helvetica", "bold"); doc.setFontSize(7.5);
+      const textW = doc.getTextWidth(chipText);
+      const chipW = Math.max(5.5, textW + padX * 2);
+      // Position chip so its TOP sits ~1.3mm above the text baseline
+      // (visually centers the chip on text of fontSize 8-9).
+      const top = baselineY - chipH + 1.0;
+      doc.setFillColor(...colors.bg);
+      doc.setDrawColor(...colors.border);
+      doc.setLineWidth(0.2);
+      doc.roundedRect(x, top, chipW, chipH, 0.8, 0.8, "FD");
+      doc.setTextColor(...colors.fg);
+      // Center the text inside the chip.
+      doc.text(chipText, x + chipW / 2, top + chipH - 1.1, { align: "center" });
+      return chipW;
     }
 
     // ── Shared PDF helpers ──────────────────────────────────────────────
@@ -5281,11 +11216,14 @@
       return { doc, pw, ph, margin, maxW, C, checkPage, addFooter, drawLink, drawNoteBox, getY: () => y, setY: (v) => { y = v; }, addY: (v) => { y += v; } };
     }
 
-    function buildPDF(title, videoId, chunks, type) {
+    function buildPDF(title, videoId, chunks, type, speakerNames, speakers) {
       if (!window.jspdf) {
         showToast("PDF library not loaded yet — please try again in a moment", "⚠", 4000);
         return;
       }
+      // Normalize speakerNames (callers may pass undefined / null).
+      const _speakerNames = speakerNames && typeof speakerNames === "object" ? speakerNames : {};
+      const _speakers = speakers && typeof speakers === "object" ? speakers : null;
       try {
         const p = createPDFDoc();
         const { doc, pw, margin, maxW, C, checkPage, addFooter, drawLink } = p;
@@ -5304,6 +11242,53 @@
         doc.setDrawColor(...C.accent); doc.setLineWidth(0.6);
         doc.line(margin, p.getY(), margin + 40, p.getY()); p.addY(8);
 
+        // ── Speakers legend ──
+        // When the saved record carries diarization metadata, render
+        // a compact "SPEAKERS" row above the topics so the reader has
+        // a key for the chips that appear on each transcript line.
+        // Skips entirely when no diarization ran (older sessions /
+        // diarization disabled / no fingerprints collected).
+        if (_speakers && Object.keys(_speakers).length > 0) {
+          const speakerIds = Object.keys(_speakers).sort((a, b) => {
+            if (a === "Speaker_Unknown") return 1;
+            if (b === "Speaker_Unknown") return -1;
+            return a.localeCompare(b);
+          });
+          doc.setFont("helvetica", "bold"); doc.setFontSize(8); doc.setTextColor(...C.accent);
+          doc.text("SPEAKERS", margin, p.getY()); p.addY(5);
+          let lx = margin;
+          const gap = 4;
+          for (const sid of speakerIds) {
+            const chipText = pdfChipText(sid, _speakerNames);
+            const fullName = pdfChipFullName(sid, _speakerNames);
+            const stats = _speakers[sid] || {};
+            const secs = Math.round(stats.total_speaking_seconds || 0);
+            const mins = Math.floor(secs / 60);
+            const tsec = secs % 60;
+            const timeStr = mins > 0 ? mins + "m " + tsec + "s" : tsec + "s";
+            const label = "  " + fullName + " · " + timeStr;
+            doc.setFont("helvetica", "normal"); doc.setFontSize(8.5); doc.setTextColor(...C.body);
+            const labelW = doc.getTextWidth(label);
+            // 6mm reserved for the chip itself (matches drawPDFChip's
+            // min width). Wrap to next line if we'd run off the page.
+            const entryW = 6.5 + labelW + gap;
+            if (lx + entryW > pw - margin) {
+              p.addY(6);
+              checkPage(6);
+              lx = margin;
+            }
+            const baselineY = p.getY() + 3;
+            const chipW = drawPDFChip(doc, sid, chipText, lx, baselineY);
+            doc.setFont("helvetica", "normal"); doc.setFontSize(8.5); doc.setTextColor(...C.body);
+            doc.text(label, lx + chipW, baselineY);
+            lx += chipW + labelW + gap;
+          }
+          p.addY(7);
+          // Light divider between legend and topics
+          doc.setDrawColor(...C.divider); doc.setLineWidth(0.15);
+          doc.line(margin, p.getY(), pw - margin, p.getY()); p.addY(5);
+        }
+
         // ── Chunks ──
         chunks.forEach((chunk, ci) => {
           checkPage(22);
@@ -5349,26 +11334,54 @@
             const sec = Math.floor(entry.offset);
             const entryUrl = (type === "youtube" && videoId) ? "https://youtube.com/watch?v=" + videoId + "&t=" + sec : null;
 
+            // Speaker chip (drawn first; advances x-cursor by chipW
+            // for the timestamp + text). Skipped when no speaker
+            // attribution exists on this entry (older sessions /
+            // diarization off / unassigned line).
+            const speaker = entry.speaker_override || entry.speaker || null;
+            const chipText = speaker ? pdfChipText(speaker, _speakerNames) : "";
+            const baselineY = p.getY();
+            let cursorX = margin + 2;
+            if (chipText) {
+              const chipW = drawPDFChip(doc, speaker, chipText, cursorX, baselineY);
+              cursorX += chipW + 1.5;
+            }
             // Timestamp
             if (entryUrl) {
               doc.setFont("helvetica", "bold"); doc.setFontSize(8);
-              drawLink("[" + ets + "]", margin + 2, p.getY(), entryUrl);
+              drawLink("[" + ets + "]", cursorX, baselineY, entryUrl);
+              const tsW = doc.getTextWidth("[" + ets + "]");
               doc.setFont("helvetica", "normal"); doc.setFontSize(8.5); doc.setTextColor(...C.body);
-              // Text after timestamp
-              const textLines = doc.splitTextToSize(entry.text, maxW - 20);
+              const textStartX = cursorX + tsW + 2;
+              // Text after timestamp — wrap budget shrinks by the
+              // additional left indent (chip + ts widths).
+              const textLines = doc.splitTextToSize(entry.text, maxW - (textStartX - margin) - 2);
               textLines.forEach((line, li) => {
                 if (li === 0) {
-                  doc.text(line, margin + 18, p.getY());
+                  doc.text(line, textStartX, p.getY());
                 } else {
                   checkPage(3.8);
-                  doc.text(line, margin + 18, p.getY());
+                  doc.text(line, textStartX, p.getY());
                 }
                 p.addY(3.6);
               });
             } else {
-              const entryText = "[" + ets + "]  " + entry.text;
-              const entryLines = doc.splitTextToSize(entryText, maxW - 4);
-              entryLines.forEach(line => { checkPage(3.8); doc.text(line, margin + 2, p.getY()); p.addY(3.6); });
+              // No clickable timestamp — render chip + "[ts] text" inline.
+              const tsText = "[" + ets + "]  ";
+              doc.setFont("helvetica", "normal"); doc.setFontSize(8.5); doc.setTextColor(...C.body);
+              const tsW = doc.getTextWidth(tsText);
+              const textStartX = cursorX + tsW;
+              doc.text(tsText, cursorX, baselineY);
+              const textLines = doc.splitTextToSize(entry.text, maxW - (textStartX - margin) - 2);
+              textLines.forEach((line, li) => {
+                if (li === 0) {
+                  doc.text(line, textStartX, p.getY());
+                } else {
+                  checkPage(3.8);
+                  doc.text(line, textStartX, p.getY());
+                }
+                p.addY(3.6);
+              });
             }
           });
           p.addY(4);
@@ -5701,6 +11714,455 @@
     function isProTier() {
       return isLicensed() && hasEntitlement("subscriptions");
     }
+    // Subscriptions + auto-queue are now per-tenant: any user whose tier
+    // carries the "subscriptions" entitlement (Pro/Max, or the operator)
+    // gets their own. Gates every subscription affordance (button, queue
+    // panel, poll, settings section).
+    function canUseSubscriptions() {
+      return hasEntitlement("subscriptions");
+    }
+    // Multi-tenant account state. Cheap call, hits SQLite, returns
+    // current user / trial / anonymous + recap_mode flag. Frontend
+    // uses recap_mode to decide whether to show signin/signout UI
+    // and whether to gate operator-only settings sections.
+    async function loadAccount() {
+      try {
+        const res = await fetch(`${API_BASE}/api/account/whoami`);
+        const data = await res.json();
+        state.account = {
+          loaded: true,
+          recap_mode: data.recap_mode || "single",
+          state: data.state || "anonymous",
+          user: data.user || null,
+          trial: data.trial || null,
+          // Operator's configured trial allowance — populated when
+          // state=anonymous so the UI can show "N free credits
+          // available" before the visitor has even hit Summarize.
+          // 0 means trials are disabled (visitor must sign up to use
+          // the app).
+          available_trial_credits: data.available_trial_credits ?? 0,
+          // Operator's post-signup grant — drives the Free-tier card
+          // copy on the tier signup modal. 0 means "trial credits
+          // transfer but you don't get a signup bonus."
+          signup_grant_credits: data.signup_grant_credits ?? 0,
+          // Server-set when the visitor's IP can't mint a new trial
+          // cookie (operator's trials_per_ip_lifetime cap reached).
+          // Server has already forced available_trial_credits to 0;
+          // this field tells the UI WHY so it can show honest copy
+          // ("trial used up — sign up / buy") instead of a generic
+          // "0 free credits" pill that reads like a config error.
+          trial_blocked_reason: data.trial_blocked_reason || null,
+        };
+      } catch {
+        // On failure, leave state.account at its defaults so the
+        // UI behaves like single-mode (no surprises). The next
+        // render() will still try to fetch on demand for actions
+        // that need an updated state.
+      }
+    }
+    // ── Admin panel data loaders + actions ───────────────────────────────
+    // All gated server-side on req.user.is_admin (403 otherwise). The
+    // frontend gates UI visibility on isAdmin() so non-admins never see
+    // the buttons; the server is the source of truth.
+
+    async function loadAdminTenants() {
+      state.ops.tenantsLoading = true;
+      state.ops.tenantsError = null;
+      render();
+      try {
+        const res = await fetch(`${API_BASE}/api/admin/tenants`);
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        const data = await res.json();
+        state.ops.tenants = data.tenants || [];
+        // Whether this server can set relay-owned tiers (has the operator
+        // key). Drives whether the per-row "Tier" control is shown.
+        state.ops.operatorKeyConfigured = !!data.relay_operator_key_configured;
+      } catch (e) {
+        state.ops.tenantsError = e.message || "failed_to_load";
+      } finally {
+        state.ops.tenantsLoading = false;
+        render();
+      }
+    }
+
+    async function loadAdminActivity(hours) {
+      if (typeof hours === "number") state.ops.activityHours = hours;
+      state.ops.activityLoading = true;
+      state.ops.activityError = null;
+      render();
+      try {
+        const res = await fetch(
+          `${API_BASE}/api/admin/recent-signups?hours=${state.ops.activityHours}`,
+        );
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        state.ops.activity = await res.json();
+      } catch (e) {
+        state.ops.activityError = e.message || "failed_to_load";
+      } finally {
+        state.ops.activityLoading = false;
+        render();
+      }
+    }
+
+    // Open / close the per-row "+ N credits" inline form. Toggling
+    // the same row collapses it; opening a different row replaces.
+    function toggleGrantCreditsRow(userId) {
+      if (state.ops.grantOpenFor === userId) {
+        state.ops.grantOpenFor = null;
+        state.ops.grantAmount = "";
+      } else {
+        state.ops.grantOpenFor = userId;
+        state.ops.grantAmount = "";
+      }
+      render();
+    }
+
+    async function submitGrantCredits(userId) {
+      const amount = parseInt(state.ops.grantAmount, 10);
+      if (!Number.isFinite(amount) || amount <= 0) {
+        showToast("Enter a positive number of credits", "!", 3000);
+        return;
+      }
+      state.ops.grantBusy = true;
+      render();
+      try {
+        const res = await fetch(
+          `${API_BASE}/api/admin/tenants/${encodeURIComponent(userId)}/grant`,
+          {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ amount }),
+          },
+        );
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.message || data.error || "failed");
+        showToast(`Granted ${amount} credits — balance ${data.balance}`, "✓");
+        state.ops.grantOpenFor = null;
+        state.ops.grantAmount = "";
+        // Refresh the tenant list so the row's balance updates inline.
+        await loadAdminTenants();
+      } catch (e) {
+        showToast("Grant failed: " + (e.message || "unknown"), "!", 4000);
+      } finally {
+        state.ops.grantBusy = false;
+        render();
+      }
+    }
+
+    // Open / close the per-row tier selector. Mutually exclusive with the
+    // credits form so two inline panels don't stack on one row.
+    function toggleTierRow(userId) {
+      if (state.ops.tierOpenFor === userId) {
+        state.ops.tierOpenFor = null;
+      } else {
+        state.ops.tierOpenFor = userId;
+        state.ops.grantOpenFor = null;
+      }
+      render();
+    }
+
+    // Set a tenant's subscription tier. The server writes the relay-owned
+    // tier first (authoritative) then caches it locally, so a 502 here
+    // means the relay/operator-key needs attention — surface it verbatim.
+    async function setTenantTier(userId, tier) {
+      state.ops.tierBusy = true;
+      render();
+      try {
+        const res = await fetch(
+          `${API_BASE}/api/admin/tenants/${encodeURIComponent(userId)}/tier`,
+          {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ tier }),
+          },
+        );
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.message || data.error || "failed");
+        showToast(`Tier set to ${String(tier).toUpperCase()}`, "✓");
+        state.ops.tierOpenFor = null;
+        // Refresh so the badge updates inline.
+        await loadAdminTenants();
+      } catch (e) {
+        showToast("Set tier failed: " + (e.message || "unknown"), "!", 5000);
+      } finally {
+        state.ops.tierBusy = false;
+        render();
+      }
+    }
+
+    async function revokeAllSessionsForTenant(userId, email) {
+      const ok = confirm(
+        `Sign ${email || "this user"} out of every active session?\n\nThey can sign back in via magic link.`,
+      );
+      if (!ok) return;
+      try {
+        const res = await fetch(
+          `${API_BASE}/api/admin/tenants/${encodeURIComponent(userId)}/sessions`,
+          { method: "DELETE" },
+        );
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.message || data.error || "failed");
+        showToast(`Revoked ${data.revoked || 0} session(s)`, "✓");
+        await loadAdminTenants();
+      } catch (e) {
+        showToast("Revoke failed: " + (e.message || "unknown"), "!", 4000);
+      }
+    }
+
+    // ── My-sessions (tenant-side) ────────────────────────────────────────
+    async function loadMySessions() {
+      state.mySessions.loading = true;
+      state.mySessions.error = null;
+      render();
+      try {
+        const res = await fetch(`${API_BASE}/api/account/sessions`);
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        const data = await res.json();
+        state.mySessions.rows = data.sessions || [];
+        state.mySessions.currentId = data.current_session_id || null;
+      } catch (e) {
+        state.mySessions.error = e.message || "failed_to_load";
+      } finally {
+        state.mySessions.loading = false;
+        render();
+      }
+    }
+
+    async function revokeMySession(sessionId) {
+      try {
+        const res = await fetch(
+          `${API_BASE}/api/account/sessions/${encodeURIComponent(sessionId)}`,
+          { method: "DELETE" },
+        );
+        if (!res.ok) throw new Error("failed");
+        showToast("Session revoked", "✓");
+        await loadMySessions();
+      } catch (e) {
+        showToast("Revoke failed", "!");
+      }
+    }
+
+    async function revokeOtherSessions() {
+      const ok = confirm(
+        "Sign out from every other device (keeping this one signed in)?",
+      );
+      if (!ok) return;
+      try {
+        const res = await fetch(
+          `${API_BASE}/api/account/sessions/revoke-others`,
+          { method: "POST" },
+        );
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.message || "failed");
+        showToast(`Signed out ${data.revoked || 0} other session(s)`, "✓");
+        await loadMySessions();
+      } catch (e) {
+        showToast("Revoke failed: " + (e.message || "unknown"), "!", 4000);
+      }
+    }
+
+    // ── Password set / change / clear (tenant lite settings) ────────────
+    // Magic-link is primary auth; password is an optional faster-signin
+    // add-on. We show different copy based on whether the user already
+    // has one set (state.account.user.has_password).
+    async function setPassword(plain) {
+      const res = await fetch(`${API_BASE}/api/account/password`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ password: plain }),
+      });
+      const data = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        throw new Error(data.message || data.error || `HTTP ${res.status}`);
+      }
+      return data;
+    }
+
+    async function clearPassword() {
+      const res = await fetch(`${API_BASE}/api/account/password`, {
+        method: "DELETE",
+      });
+      const data = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        throw new Error(data.message || data.error || `HTTP ${res.status}`);
+      }
+      return data;
+    }
+
+    async function submitPasswordSet() {
+      const pwd = (state.passwordInput || "").trim();
+      if (pwd.length < 8) {
+        showToast("Use at least 8 characters.", "!", 3000);
+        return;
+      }
+      state.passwordBusy = true;
+      render();
+      try {
+        await setPassword(pwd);
+        // Refresh whoami so has_password flips to true and the UI
+        // switches from "Set password" to "Change / Clear".
+        await loadAccount();
+        state.passwordInput = "";
+        state.passwordOpen = false;
+        showToast("Password set", "✓");
+      } catch (e) {
+        showToast(e.message || "Couldn't set password", "!", 4000);
+      } finally {
+        state.passwordBusy = false;
+        render();
+      }
+    }
+
+    async function submitPasswordClear() {
+      if (
+        !confirm(
+          "Remove your password? You'll still be able to sign in via magic link.",
+        )
+      ) {
+        return;
+      }
+      state.passwordBusy = true;
+      render();
+      try {
+        await clearPassword();
+        await loadAccount();
+        showToast("Password removed", "✓");
+      } catch (e) {
+        showToast(e.message || "Couldn't clear password", "!", 4000);
+      } finally {
+        state.passwordBusy = false;
+        render();
+      }
+    }
+
+    function togglePasswordEditor() {
+      state.passwordOpen = !state.passwordOpen;
+      state.passwordInput = "";
+      render();
+    }
+
+    function renderPasswordBlock() {
+      if (!state.account?.user) return "";
+      const hasPwd = !!state.account.user.has_password;
+      const open = !!state.passwordOpen;
+      const inputBlock = open
+        ? `
+        <div style="display:flex;flex-direction:column;gap:8px;margin-top:10px;">
+          <input type="password" placeholder="At least 8 characters" minlength="8"
+            value="${escHtml(state.passwordInput || "")}"
+            oninput="state.passwordInput=this.value"
+            onkeydown="if(event.key==='Enter')submitPasswordSet()"
+            style="padding:9px 12px;font-size:13px;background:#0a0e1a;color:#e2e8f0;border:1px solid #334155;border-radius:8px;outline:none;" />
+          <div style="display:flex;gap:6px;flex-wrap:wrap;">
+            <button onclick="submitPasswordSet()" ${state.passwordBusy ? "disabled" : ""}
+              style="padding:8px 16px;font-size:12px;font-weight:600;background:#3b82f6;color:#fff;border:none;border-radius:6px;cursor:pointer;${state.passwordBusy ? "opacity:0.5;cursor:not-allowed;" : ""}">
+              ${state.passwordBusy ? "Saving..." : hasPwd ? "Update" : "Set password"}
+            </button>
+            <button onclick="togglePasswordEditor()"
+              style="padding:8px 14px;font-size:12px;background:#1e293b;color:#94a3b8;border:1px solid #334155;border-radius:6px;cursor:pointer;">
+              Cancel
+            </button>
+          </div>
+        </div>`
+        : "";
+      const description = hasPwd
+        ? "You can sign in with email + password OR with a magic link."
+        : "Set a password for faster sign-ins. You can still use the magic link any time.";
+      const ctaLabel = hasPwd
+        ? open ? "Close" : "Change password"
+        : open ? "Close" : "Set a password";
+      return `
+        <label class="field-label" style="margin-top:14px;">Password</label>
+        <div class="ytdlp-status" style="flex-direction:column;align-items:stretch;gap:6px;border-color:#334155;background:rgba(30,41,59,0.3);padding:14px;">
+          <div style="font-size:12px;color:#cbd5e1;line-height:1.55;">${description}</div>
+          <div style="display:flex;gap:6px;flex-wrap:wrap;">
+            <button onclick="togglePasswordEditor()"
+              style="padding:7px 14px;font-size:12px;font-weight:600;background:#1e293b;color:#cbd5e1;border:1px solid #334155;border-radius:6px;cursor:pointer;">
+              ${ctaLabel}
+            </button>
+            ${hasPwd ? `<button onclick="submitPasswordClear()" ${state.passwordBusy ? "disabled" : ""}
+              style="padding:7px 14px;font-size:12px;background:transparent;color:#fca5a5;border:1px solid rgba(248,113,113,0.40);border-radius:6px;cursor:pointer;${state.passwordBusy ? "opacity:0.5;cursor:not-allowed;" : ""}">
+              Remove
+            </button>` : ""}
+          </div>
+          ${inputBlock}
+        </div>
+      `;
+    }
+
+    // ── Self-delete (tenant lite settings) ───────────────────────────────
+    async function deleteMyAccount() {
+      const email = state.account?.user?.email || "your account";
+      // Two-step confirm so a stray click can't take an account down:
+      // first a yes/no, then a "type DELETE" check.
+      if (
+        !confirm(
+          `Delete ${email}?\n\nYour library, sessions, and license attachment will be erased. This cannot be undone.`,
+        )
+      ) {
+        return;
+      }
+      const typed = prompt(`Type DELETE in all caps to confirm.`);
+      if (typed !== "DELETE") {
+        showToast("Cancelled — your account is safe.", "");
+        return;
+      }
+      try {
+        const res = await fetch(`${API_BASE}/api/account`, {
+          method: "DELETE",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ confirm: "DELETE" }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          throw new Error(data.message || data.error || `HTTP ${res.status}`);
+        }
+        // Cookie already cleared server-side. Reload to the anonymous
+        // landing page; the page itself will pick up the cookie-less
+        // state via /api/account/whoami.
+        window.location.href = "/";
+      } catch (e) {
+        showToast("Delete failed: " + (e.message || "unknown"), "!", 5000);
+      }
+    }
+
+    // ── Admin: delete tenant ─────────────────────────────────────────────
+    async function adminDeleteTenant(userId, email) {
+      const safeEmail = email || "(no email)";
+      if (
+        !confirm(
+          `Permanently delete ${safeEmail}?\n\nTheir library, sessions, and license attachment will be erased. The relay's per-license credit pool (if any) stays intact at the relay.\n\nThis can't be undone.`,
+        )
+      ) {
+        return;
+      }
+      try {
+        const res = await fetch(
+          `${API_BASE}/api/admin/tenants/${encodeURIComponent(userId)}`,
+          { method: "DELETE" },
+        );
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          throw new Error(data.message || data.error || `HTTP ${res.status}`);
+        }
+        showToast(`Deleted ${safeEmail}`, "✓");
+        await loadAdminTenants();
+      } catch (e) {
+        showToast("Delete failed: " + (e.message || "unknown"), "!", 5000);
+      }
+    }
+
+    function isMulti() {
+      return state.account?.recap_mode === "multi";
+    }
+    function isAdmin() {
+      // Default to TRUE so single-mode + early-load (account not
+      // fetched yet) keep showing the full settings UI. Only flip
+      // to false once we've confirmed we're in multi-mode AND the
+      // current user is NOT an admin.
+      if (!isMulti()) return true;
+      return !!state.account?.user?.is_admin;
+    }
     async function loadLicenseStatus() {
       try {
         const res = await fetch(`${API_BASE}/api/license-status`);
@@ -5787,10 +12249,20 @@
       // Lightweight version of init's secondary loads. Only fetches what
       // the current entitlements actually permit.
       await loadHistory().catch(() => {});
-      if (hasEntitlement("subscriptions")) {
+      if (canUseSubscriptions()) {
         await loadSubscriptions().catch(() => {});
         try { await pollAutoQueue(); } catch {}
       }
+      // Force-refresh the relay snapshot so the toolbar pill flips
+      // from "6 relay credits · core" to the new tier's quota
+      // immediately. Without this, the operator's Recap UI would
+      // stay on the cached core-tier values for up to 60s (next
+      // poll tick) and the relay-side tier validation wouldn't
+      // even happen until then. Forced refresh bypasses Recap's
+      // 10s relayState cache; the relay's keysat-client validates
+      // the newly-saved license proof on its end.
+      await loadRelayStatus(true).catch(() => {});
+      render();
     }
     function upgradeToProUrl() {
       const base = state.license.keysatBaseUrl || "https://licensing.keysat.xyz";
@@ -5837,10 +12309,15 @@
     // successful login.
     async function initAfterAdminAuth() {
       try {
-        const [_, health, net, _job, _discover] = await Promise.all([
+        const [_, health, net, _account, _job, _discover] = await Promise.all([
           loadLicenseStatus(),
           fetch(`${API_BASE}/api/health`).then(r => r.json()),
           fetch(`${API_BASE}/api/network-mode`).then(r => r.json()).catch(() => null),
+          // Multi-tenant account state. Lightweight (SQLite read +
+          // cookie check). Runs alongside the rest of boot so the
+          // first render branches on the right mode without a flash
+          // of single-mode UI.
+          loadAccount(),
           // Survives browser refresh: if the server has a free-tier job
           // running, the banner renders with what's processing + Cancel,
           // and the activity log is repopulated from the server's
@@ -5865,6 +12342,7 @@
           loadRelayPolicy(),
         ]);
         if (state.currentJob) startCurrentJobPoll();
+        startRelayStatusPoll();
         state.hasServerKey = !!health.hasServerKey;
         state.installId = health.installId || null;
         if (!health.installed) {
@@ -5885,7 +12363,7 @@
 
         // Library is free for everyone — load on every boot.
         await loadHistory().catch(() => {});
-        if (isLicensed() && hasEntitlement("subscriptions")) {
+        if (isLicensed() && canUseSubscriptions()) {
           await loadSubscriptions().catch(() => {});
           try {
             const added = await pollAutoQueue();
@@ -5894,6 +12372,12 @@
           startBgPoll();
         }
         render();
+        // Reconcile a returning BTCPay subscription checkout
+        // (/?billing=success) after the first paint — fire-and-forget so
+        // it never blocks boot.
+        handleBillingReturn();
+        // Expiry-reminder email "Renew" deep-link (/?renew=1).
+        handleRenewLink();
       } catch {
         state.serverStatus = "disconnected";
         state.error = "Cannot connect to backend at localhost:3001.\nMake sure the server is running: cd server && npm install && npm start";
@@ -5935,12 +12419,97 @@
 
     // Send heartbeat on page visibility change (coming back from another tab)
     document.addEventListener("visibilitychange", () => {
-      if (document.visibilityState === "visible") {
-        sendHeartbeat();
+      if (document.visibilityState !== "visible") return;
+      sendHeartbeat();
+      // Connection-drop recovery: if we're returning to the tab AND
+      // the page is showing a "Connection dropped" error (which means
+      // the SSE stream died while backgrounded), re-check the server.
+      // Three outcomes:
+      //   1. A current job is still running → clear error, attach poller
+      //   2. A library entry was created very recently → the job
+      //      finished while we were away; auto-load it so the user
+      //      sees their summary instead of a red banner
+      //   3. Nothing in flight or recent → leave the error alone
+      if (state.error && /connection dropped/i.test(state.error)) {
+        (async () => {
+          try {
+            await loadCurrentJob();
+            if (state.currentJob) {
+              state.error = null;
+              startCurrentJobPoll();
+              render();
+              return;
+            }
+            // No current job. Check for a brand-new library entry —
+            // if one landed within the last 5 minutes it's almost
+            // certainly the job we just lost the stream for.
+            const res = await fetch(`${API_BASE}/api/history`);
+            const data = await res.json();
+            const sessions = Object.values(data.sessions || {});
+            sessions.sort(
+              (a, b) =>
+                new Date(b.createdAt).getTime() -
+                new Date(a.createdAt).getTime(),
+            );
+            const newest = sessions[0];
+            if (
+              newest &&
+              Date.now() - new Date(newest.createdAt).getTime() <
+                5 * 60 * 1000
+            ) {
+              state.error = null;
+              await loadSession(newest.id);
+              await loadHistory().catch(() => {});
+              render();
+            }
+          } catch {
+            // Best-effort; if any of the recovery fetches fail we
+            // leave the error message intact and the user can retry.
+          }
+        })();
       }
     });
 
     render();
+
+    // ── iOS Safari: prevent zoom-on-input-focus ──────────────────────
+    // Even with font-size: 16px on the input, iOS Safari occasionally
+    // still auto-zooms on focus — especially when the focused field
+    // overflows (e.g. a long pasted URL). The official escape hatch
+    // is to set maximum-scale=1 on the viewport meta, but doing so
+    // unconditionally also disables pinch-to-zoom on the rest of the
+    // page (accessibility-hostile). We toggle it ONLY while an input
+    // or textarea is focused: zoom is locked during typing, unlocked
+    // everywhere else. focusin/focusout bubble through any element
+    // so a single document-level listener covers every input on the
+    // page (URL input, settings forms, auth.html, etc.).
+    (function setupNoZoomOnInputFocus() {
+      const m = document.querySelector("meta[name=viewport]");
+      if (!m) return;
+      const normalContent = "width=device-width, initial-scale=1.0, viewport-fit=cover";
+      const noZoomContent = "width=device-width, initial-scale=1, maximum-scale=1, viewport-fit=cover";
+      m.setAttribute("content", normalContent);
+      document.addEventListener("focusin", (e) => {
+        const t = e.target;
+        if (!t || !t.tagName) return;
+        const tag = t.tagName;
+        if (tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT") {
+          m.setAttribute("content", noZoomContent);
+        }
+      });
+      document.addEventListener("focusout", () => {
+        // Slight delay so the next focusin (chained focus moves)
+        // doesn't briefly flip to normalContent and back.
+        setTimeout(() => {
+          if (!document.activeElement ||
+              !["INPUT", "TEXTAREA", "SELECT"].includes(
+                document.activeElement.tagName,
+              )) {
+            m.setAttribute("content", normalContent);
+          }
+        }, 0);
+      });
+    })();
   </script>
 </body>
 </html>
diff --git a/public/manifest.json b/public/manifest.json
new file mode 100644
index 0000000..24a4565
--- /dev/null
+++ b/public/manifest.json
@@ -0,0 +1,32 @@
+{
+  "name": "Recap",
+  "short_name": "Recap",
+  "description": "Summarize YouTube videos and podcasts. Paste a link, get topic-level summaries with timestamps.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "orientation": "any",
+  "background_color": "#0a0e1a",
+  "theme_color": "#0a0e1a",
+  "icons": [
+    {
+      "src": "/assets/icon.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/assets/icon.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/assets/icon.png",
+      "sizes": "1024x1024",
+      "type": "image/png",
+      "purpose": "any maskable"
+    }
+  ],
+  "categories": ["productivity", "utilities"]
+}
diff --git a/server/account-routes.js b/server/account-routes.js
new file mode 100644
index 0000000..5c5e3ab
--- /dev/null
+++ b/server/account-routes.js
@@ -0,0 +1,282 @@
+// Per-user "my account" endpoints for multi-tenant Recap. Distinct
+// from admin-routes.js — these are scoped to the currently signed-in
+// user (req.user), not to whichever tenant id you pass in the URL.
+// Used by the lite settings panel to render "Active sessions" and
+// "Sign out everywhere" actions for a tenant managing their own
+// account.
+//
+// Endpoints:
+//   GET    /api/account/sessions             — my active sessions
+//   DELETE /api/account/sessions/:sessionId  — revoke a specific session of mine
+//   POST   /api/account/sessions/revoke-others — revoke everything BUT the current session
+//
+// Multi-mode only. Single mode never mounts these — the synthetic
+// "owner" user has no session table to manage.
+
+import { getDb } from "./db.js";
+import { requireUser } from "./tenant-auth.js";
+import { hashPassword, validatePasswordPolicy } from "./auth-routes.js";
+import fs from "fs/promises";
+import path from "path";
+import { getHistoryDir } from "./history.js";
+
+export function setupAccountRoutes(app) {
+  // ── My license key (for the "Take Recap home" flow) ────────────────
+  // The Pro/Max license is a bearer credential — anyone with the LIC1-
+  // string can present it to the relay. We only return the CALLING
+  // user's own key (gated by req.user.id), never anyone else's. The key
+  // is stored on users.keysat_license; the parsed entitlement state
+  // already comes via /api/license-status. This endpoint is the one
+  // place the raw string is exposed — used by the lite settings panel
+  // to show a copy-to-clipboard "Take Recap home" block for paid
+  // tenants who want to also run Recap on their own StartOS server.
+  app.get("/api/account/license-key", requireUser, (req, res) => {
+    if (!req.user || !req.user.id) {
+      return res.status(403).json({ error: "no_user" });
+    }
+    try {
+      const row = getDb()
+        .prepare("SELECT keysat_license FROM users WHERE id = ?")
+        .get(req.user.id);
+      const key = (row?.keysat_license || "").trim();
+      if (!key) {
+        return res.status(404).json({ error: "no_license" });
+      }
+      res.json({ license_key: key });
+    } catch (err) {
+      console.error("[account] license-key lookup failed:", err);
+      res.status(500).json({ error: "internal_error" });
+    }
+  });
+
+
+  // List MY active sessions (the device list).
+  app.get("/api/account/sessions", requireUser, (req, res) => {
+    // Trial users (req.userId starts with "anon:") don't have a row in
+    // the sessions table — they're tracked via anon_trials. Bail with
+    // an empty list so the UI doesn't error.
+    if (!req.user || !req.user.id) {
+      return res.json({ sessions: [], current_session_id: null });
+    }
+    try {
+      const rows = getDb()
+        .prepare(
+          `SELECT id, created_at, expires_at, last_used_at, user_agent, ip_address
+           FROM sessions
+           WHERE user_id = ? AND expires_at > ?
+           ORDER BY last_used_at DESC, created_at DESC`,
+        )
+        .all(req.user.id, Date.now());
+      res.json({
+        sessions: rows,
+        // Tell the UI which row is the CURRENT session so it can
+        // disable the "Revoke" button for that one (sign out instead).
+        current_session_id: req.session?.id || null,
+      });
+    } catch (err) {
+      console.error("[account] sessions list failed:", err);
+      res.status(500).json({ error: "internal_error" });
+    }
+  });
+
+  // Revoke a single session of mine. The session id MUST belong to me
+  // (we WHERE clause both id AND user_id). Otherwise a tenant could
+  // delete someone else's session by guessing the id.
+  app.delete(
+    "/api/account/sessions/:sessionId",
+    requireUser,
+    (req, res) => {
+      if (!req.user || !req.user.id) {
+        return res.status(400).json({ error: "trial_has_no_sessions" });
+      }
+      const sessionId = req.params.sessionId;
+      try {
+        const result = getDb()
+          .prepare("DELETE FROM sessions WHERE id = ? AND user_id = ?")
+          .run(sessionId, req.user.id);
+        if (result.changes === 0) {
+          return res.status(404).json({ error: "session_not_found" });
+        }
+        res.json({ ok: true });
+      } catch (err) {
+        console.error("[account] revoke session failed:", err);
+        res.status(500).json({ error: "internal_error" });
+      }
+    },
+  );
+
+  // ── Set / clear my password ────────────────────────────────────────
+  // Magic-link is the primary auth. Setting a password is optional —
+  // makes returning sign-in faster. Set and "change" use the same
+  // endpoint (overwrite); the reset flow is "sign in via magic link,
+  // then call this endpoint with the new password."
+  //
+  // POST /api/account/password   { password }   — set or overwrite
+  // DELETE /api/account/password                — clear / revert to
+  //                                              magic-link-only
+  //
+  // Lives in /api/account/* (not /auth/*) because both require an
+  // active session and need the tenant-auth middleware to attach
+  // req.user — /auth/* is the public-path namespace bypassed by the
+  // middleware so unauthenticated visitors can request links / verify.
+  app.post("/api/account/password", requireUser, (req, res) => {
+    if (!req.user || !req.user.id) {
+      return res.status(401).json({ error: "auth_required" });
+    }
+    const password = req.body?.password;
+    const policyErr = validatePasswordPolicy(password);
+    if (policyErr) {
+      return res.status(400).json({
+        error: policyErr,
+        message:
+          policyErr === "password_too_short"
+            ? "Use at least 8 characters."
+            : policyErr === "password_too_long"
+            ? "256 characters max."
+            : "Pick a password.",
+      });
+    }
+    try {
+      const hash = hashPassword(password);
+      getDb()
+        .prepare("UPDATE users SET password_hash = ? WHERE id = ?")
+        .run(hash, req.user.id);
+      console.log(`[account] password set for user ${req.user.id}`);
+      res.json({ ok: true });
+    } catch (err) {
+      console.error("[account] set-password failed:", err);
+      res.status(500).json({ error: "internal_error" });
+    }
+  });
+
+  app.delete("/api/account/password", requireUser, (req, res) => {
+    if (!req.user || !req.user.id) {
+      return res.status(401).json({ error: "auth_required" });
+    }
+    try {
+      getDb()
+        .prepare("UPDATE users SET password_hash = NULL WHERE id = ?")
+        .run(req.user.id);
+      console.log(`[account] password cleared for user ${req.user.id}`);
+      res.json({ ok: true });
+    } catch (err) {
+      console.error("[account] clear-password failed:", err);
+      res.status(500).json({ error: "internal_error" });
+    }
+  });
+
+  // ── Delete my account ──────────────────────────────────────────────
+  // GDPR-style hard delete of the calling user. Confirms via a body
+  // sentinel ({confirm: "DELETE"}) so a stray DELETE request can't
+  // wipe an account by accident. After deletion the session cookie is
+  // cleared; the user lands back on the anonymous landing page.
+  //
+  // Cascades (via the schema's ON DELETE CASCADE) handle:
+  //   - sessions (drop everywhere)
+  //   - tenant_credits (drop balance row)
+  //   - library_meta (drop the index entries)
+  //   - subscriptions (drop billing history)
+  //   - magic_link_tokens stay (they have no FK to users — they're
+  //     keyed by email, harmless to leave)
+  //   - anon_trials.converted_to_user_id SET NULL (analytics row stays)
+  //
+  // The filesystem-side history folder /data/history/<user_id>/ is
+  // removed separately — SQLite cascades don't reach the FS. We do
+  // this AFTER the DB delete so partial failures don't leave dangling
+  // metadata.
+  //
+  // Admin users CANNOT delete themselves via this endpoint — that
+  // would leave the multi-tenant Recap orphaned with no admin. They
+  // can downgrade themselves first via SQL if they really mean it.
+  app.delete("/api/account", requireUser, async (req, res) => {
+    if (!req.user || !req.user.id) {
+      return res.status(403).json({ error: "no_user" });
+    }
+    if (req.user.is_admin) {
+      return res.status(400).json({
+        error: "cannot_self_delete_admin",
+        message:
+          "Operator account can't be self-deleted (no admin would be left). Demote yourself first.",
+      });
+    }
+    if (req.body?.confirm !== "DELETE") {
+      return res.status(400).json({
+        error: "confirmation_required",
+        message: "Send {confirm: \"DELETE\"} in the body to confirm.",
+      });
+    }
+    const userId = req.user.id;
+    try {
+      // FK cascade handles sessions, tenant_credits, library_meta,
+      // subscriptions. Run inside a transaction so a crash mid-delete
+      // doesn't leave the user partially intact.
+      const db = getDb();
+      const result = db
+        .transaction(() => {
+          return db
+            .prepare("DELETE FROM users WHERE id = ?")
+            .run(userId);
+        })();
+      if (result.changes === 0) {
+        return res.status(404).json({ error: "user_not_found" });
+      }
+    } catch (err) {
+      console.error("[account] delete user DB op failed:", err);
+      return res.status(500).json({ error: "internal_error" });
+    }
+    // FS cleanup. Best-effort — failures here don't roll the user
+    // back into existence. Worst case is an orphan folder that the
+    // operator can sweep manually.
+    try {
+      const userDir = path.join(getHistoryDir(), userId);
+      await fs.rm(userDir, { recursive: true, force: true });
+    } catch (err) {
+      console.warn(
+        `[account] history dir cleanup failed for ${userId} (DB delete succeeded):`,
+        err,
+      );
+    }
+    // Clear the session cookie so the next request from this browser
+    // is anonymous, not "stale-session-401-prompted-to-sign-in".
+    res.setHeader(
+      "Set-Cookie",
+      "recap_session=; Max-Age=0; Path=/; HttpOnly; SameSite=Lax; Secure",
+    );
+    console.log(`[account] user ${userId} deleted their account`);
+    res.json({ ok: true });
+  });
+
+  // "Sign out everywhere except this device" — useful after a
+  // suspicious-login email or just for hygiene. Deletes every session
+  // for this user EXCEPT the one carrying the request.
+  app.post(
+    "/api/account/sessions/revoke-others",
+    requireUser,
+    (req, res) => {
+      if (!req.user || !req.user.id) {
+        return res.status(400).json({ error: "trial_has_no_sessions" });
+      }
+      const currentSessionId = req.session?.id;
+      try {
+        let result;
+        if (currentSessionId) {
+          result = getDb()
+            .prepare(
+              "DELETE FROM sessions WHERE user_id = ? AND id != ?",
+            )
+            .run(req.user.id, currentSessionId);
+        } else {
+          // No current session detected (shouldn't happen if requireUser
+          // passed, but defensively): treat as "revoke all of mine."
+          result = getDb()
+            .prepare("DELETE FROM sessions WHERE user_id = ?")
+            .run(req.user.id);
+        }
+        res.json({ ok: true, revoked: result.changes });
+      } catch (err) {
+        console.error("[account] revoke-others failed:", err);
+        res.status(500).json({ error: "internal_error" });
+      }
+    },
+  );
+}
diff --git a/server/admin-routes.js b/server/admin-routes.js
new file mode 100644
index 0000000..405f6cf
--- /dev/null
+++ b/server/admin-routes.js
@@ -0,0 +1,484 @@
+// Operator (is_admin = 1) endpoints for multi-tenant Recap. Every
+// route here is gated by requireOperator from tenant-auth.js — non-
+// admin users get 403. Single-mode never mounts these.
+//
+// What's exposed:
+//   GET    /api/admin/tenants                 — list all users + credits + license status
+//   POST   /api/admin/tenants/:id/grant       — add credits to a user's local balance
+//   POST   /api/admin/tenants/:id/tier        — set a user's subscription tier (relay-owned)
+//   GET    /api/admin/tenants/:id/sessions    — list a user's active sessions
+//   DELETE /api/admin/tenants/:id/sessions    — revoke ALL of a user's sessions
+//   DELETE /api/admin/sessions/:sessionId     — revoke a specific session
+//   GET    /api/admin/recent-signups          — signups grouped by IP/UA in the last N hours
+//
+// All responses are JSON. Tenant rows shape:
+//   { id, email, display_name, is_admin, tier, has_license, balance,
+//     lifetime_granted, lifetime_consumed, created_at, last_signin_at,
+//     signup_ip, signup_user_agent, session_count }
+//
+// Volume notes: SQLite, ~100s of tenants tops for an alpha cohort.
+// No pagination yet — caps at LIMIT 500 to be defensive.
+
+import { getDb } from "./db.js";
+import { requireOperator } from "./tenant-auth.js";
+import fs from "fs/promises";
+import path from "path";
+import { getHistoryDir } from "./history.js";
+import { getRelayOperatorKey } from "./relay-default.js";
+
+const MAX_TENANT_ROWS = 500;
+const RECENT_SIGNUPS_MAX_HOURS = 24 * 14; // 2 weeks
+
+export function setupAdminRoutes(app) {
+  // ── Run / test the subscription expiry-reminder scan ───────────────────
+  // Operator-only. With { test_email } it sends a SAMPLE reminder to that
+  // address — verifies the recaps.cc SMTP + the email rendering without
+  // needing a real near-expiry subscription. Without it, forces an
+  // immediate scan of real expiring subscriptions and returns the summary
+  // ({ sent, skipped } or a { skipped: <reason> } if a precondition fails).
+  app.post("/api/admin/reminders/run", requireOperator, async (req, res) => {
+    try {
+      const testEmail =
+        typeof req.body?.test_email === "string" ? req.body.test_email.trim() : "";
+      if (testEmail) {
+        const { isSmtpReady, sendMail } = await import("./smtp.js");
+        if (!isSmtpReady()) {
+          return res.status(503).json({
+            error: "smtp_not_ready",
+            message: "Configure StartOS System SMTP first.",
+          });
+        }
+        const { renderSubscriptionReminderEmail } = await import(
+          "./email-template.js"
+        );
+        const { getConfigSnapshot } = await import("./config.js");
+        const snap = await getConfigSnapshot();
+        const publicUrl = (snap.recap_public_url || "")
+          .trim()
+          .replace(/\/$/, "");
+        const msg = renderSubscriptionReminderEmail({
+          brandName: "Recaps",
+          tier: "pro",
+          expiresAt: new Date(Date.now() + 7 * 86_400_000).toISOString(),
+          daysLeft: 7,
+          kind: "upcoming_7d",
+          manageUrl: `${publicUrl}/?renew=1`,
+        });
+        await sendMail({
+          to: testEmail,
+          subject: msg.subject,
+          text: msg.text,
+          html: msg.html,
+        });
+        return res.json({ ok: true, test_email_sent_to: testEmail });
+      }
+      const { runReminderScan } = await import("./subscription-reminders.js");
+      const result = await runReminderScan({ force: true });
+      res.json({ ok: true, ...result });
+    } catch (err) {
+      console.error("[admin] reminder run failed:", err?.message || err);
+      res.status(500).json({
+        error: "reminder_run_failed",
+        message: err?.message || String(err),
+      });
+    }
+  });
+
+  // ── List all tenants ───────────────────────────────────────────────────
+  app.get("/api/admin/tenants", requireOperator, (req, res) => {
+    try {
+      const rows = getDb()
+        .prepare(
+          `SELECT
+             u.id, u.email, u.display_name, u.is_admin, u.tier,
+             u.created_at, u.last_signin_at,
+             u.signup_ip, u.signup_user_agent,
+             CASE WHEN u.keysat_license IS NOT NULL AND length(u.keysat_license) > 0 THEN 1 ELSE 0 END AS has_license,
+             COALESCE(tc.purchased_balance, 0)  AS purchased_balance,
+             COALESCE(tc.replenish_balance, 0)  AS replenish_balance,
+             COALESCE(tc.purchased_balance, 0) + COALESCE(tc.replenish_balance, 0) AS balance,
+             COALESCE(tc.lifetime_granted, 0)   AS lifetime_granted,
+             COALESCE(tc.lifetime_consumed, 0)  AS lifetime_consumed,
+             (SELECT COUNT(*) FROM sessions s
+              WHERE s.user_id = u.id AND s.expires_at > ?) AS session_count
+           FROM users u
+           LEFT JOIN tenant_credits tc ON tc.user_id = u.id
+           ORDER BY u.created_at DESC
+           LIMIT ?`,
+        )
+        .all(Date.now(), MAX_TENANT_ROWS);
+      // The relay-owned tier can only be set when this server holds the
+      // matching operator key (otherwise the grant just 502s). The UI hides
+      // the per-row "Tier" control when this is false, so a self-hosted
+      // operator — who has no matching key for the canonical relay — doesn't
+      // see a button that can't work.
+      res.json({
+        tenants: rows,
+        relay_operator_key_configured: !!getRelayOperatorKey(),
+      });
+    } catch (err) {
+      console.error("[admin] /tenants failed:", err);
+      res.status(500).json({ error: "internal_error" });
+    }
+  });
+
+  // ── Grant credits to a tenant ──────────────────────────────────────────
+  // Body: { amount }. Positive integer.
+  //
+  // Upserts tenant_credits and increments balance + lifetime_granted.
+  // Records the operator's id + a timestamp so we have an audit trail
+  // when /api/admin/audit lands later (currently the grant is implicit
+  // via lifetime_granted; the trail can be reconstructed by diffing).
+  app.post(
+    "/api/admin/tenants/:id/grant",
+    requireOperator,
+    async (req, res) => {
+      const userId = req.params.id;
+      const amount = parseInt(req.body?.amount, 10);
+      if (!Number.isFinite(amount) || amount <= 0 || amount > 100000) {
+        return res
+          .status(400)
+          .json({ error: "bad_amount", message: "amount must be 1..100000" });
+      }
+      try {
+        const db = getDb();
+        // Ensure the user exists before we upsert credits.
+        const user = db
+          .prepare("SELECT id, email FROM users WHERE id = ?")
+          .get(userId);
+        if (!user) {
+          return res.status(404).json({ error: "user_not_found" });
+        }
+        // Admin grants go into the PURCHASED bucket — they're explicit
+        // operator-initiated credits and shouldn't get wiped by the
+        // next replenishment cycle. Helper handles upsert + lifetime_granted.
+        const { addPurchased } = await import("./tenant-credits.js");
+        const row = addPurchased(userId, amount);
+        const total =
+          (row?.purchased_balance || 0) + (row?.replenish_balance || 0);
+        console.log(
+          `[admin] granted ${amount} credits to ${user.email} (by ${req.user.email}) — total balance ${total}`,
+        );
+        res.json({
+          ok: true,
+          user_id: userId,
+          balance: total,
+          purchased_balance: row?.purchased_balance || 0,
+          replenish_balance: row?.replenish_balance || 0,
+          granted: amount,
+        });
+      } catch (err) {
+        console.error("[admin] grant failed:", err);
+        res.status(500).json({ error: "internal_error" });
+      }
+    },
+  );
+
+  // ── Set a tenant's subscription tier ───────────────────────────────────
+  // Body: { tier }. One of "core" | "pro" | "max".
+  //
+  // Core-decoupling: the RELAY owns the subscription (keyed by Recaps
+  // user-id), NOT a per-user Keysat license. This route writes the
+  // relay-side tier FIRST (the authoritative owner), and only on success
+  // caches it on the local users row. That ordering keeps the two from
+  // drifting — we never show a user as Pro in the UI while the relay still
+  // rejects their cloud calls. The cached users.tier is what the per-user
+  // feature gates (tts-routes, license-status) and the providers'
+  // cloud-identity selection read on each request.
+  app.post(
+    "/api/admin/tenants/:id/tier",
+    requireOperator,
+    async (req, res) => {
+      const userId = req.params.id;
+      const tier = String(req.body?.tier || "").trim().toLowerCase();
+      if (!["core", "pro", "max"].includes(tier)) {
+        return res.status(400).json({
+          error: "bad_tier",
+          message: 'tier must be "core", "pro", or "max"',
+        });
+      }
+      try {
+        const db = getDb();
+        const user = db
+          .prepare("SELECT id, email FROM users WHERE id = ?")
+          .get(userId);
+        if (!user) {
+          return res.status(404).json({ error: "user_not_found" });
+        }
+        // 1) Authoritative write to the relay (the subscription owner).
+        //    Throws if the operator key / relay base URL isn't configured,
+        //    or if the relay rejects the call — in which case we DON'T
+        //    touch the local cache.
+        const { setRelayUserTier } = await import("./providers/relay.js");
+        try {
+          await setRelayUserTier({ userId, tier });
+        } catch (err) {
+          console.error(
+            "[admin] relay tier push failed:",
+            err?.message || err,
+          );
+          return res.status(502).json({
+            error: "relay_tier_failed",
+            message:
+              "Couldn't set the tier on the relay (the subscription owner). " +
+              "Check the relay operator key + base URL, then retry. " +
+              (err?.message || ""),
+          });
+        }
+        // 2) Cache locally so feature gates + the badge see it immediately.
+        db.prepare("UPDATE users SET tier = ? WHERE id = ?").run(tier, userId);
+        console.log(
+          `[admin] set tier=${tier} for ${user.email} (by ${req.user.email})`,
+        );
+        res.json({ ok: true, user_id: userId, tier });
+      } catch (err) {
+        console.error("[admin] set tier failed:", err);
+        res.status(500).json({ error: "internal_error" });
+      }
+    },
+  );
+
+  // ── List a tenant's active sessions ────────────────────────────────────
+  app.get(
+    "/api/admin/tenants/:id/sessions",
+    requireOperator,
+    (req, res) => {
+      const userId = req.params.id;
+      try {
+        const rows = getDb()
+          .prepare(
+            `SELECT id, created_at, expires_at, last_used_at, user_agent, ip_address
+             FROM sessions
+             WHERE user_id = ? AND expires_at > ?
+             ORDER BY last_used_at DESC, created_at DESC`,
+          )
+          .all(userId, Date.now());
+        res.json({ sessions: rows });
+      } catch (err) {
+        console.error("[admin] sessions list failed:", err);
+        res.status(500).json({ error: "internal_error" });
+      }
+    },
+  );
+
+  // ── Revoke ALL sessions for a tenant ───────────────────────────────────
+  // Operator-side "sign this user out everywhere" button. Useful when
+  // a tenant flags account theft, or for ban-hammer scenarios. The
+  // user can sign back in via magic link unless the operator also
+  // disables their email (future feature).
+  app.delete(
+    "/api/admin/tenants/:id/sessions",
+    requireOperator,
+    (req, res) => {
+      const userId = req.params.id;
+      try {
+        const result = getDb()
+          .prepare("DELETE FROM sessions WHERE user_id = ?")
+          .run(userId);
+        console.log(
+          `[admin] revoked ${result.changes} session(s) for user ${userId} (by ${req.user.email})`,
+        );
+        res.json({ ok: true, revoked: result.changes });
+      } catch (err) {
+        console.error("[admin] revoke all sessions failed:", err);
+        res.status(500).json({ error: "internal_error" });
+      }
+    },
+  );
+
+  // ── Revoke a single session by id ──────────────────────────────────────
+  app.delete(
+    "/api/admin/sessions/:sessionId",
+    requireOperator,
+    (req, res) => {
+      const sessionId = req.params.sessionId;
+      try {
+        const result = getDb()
+          .prepare("DELETE FROM sessions WHERE id = ?")
+          .run(sessionId);
+        res.json({ ok: true, revoked: result.changes });
+      } catch (err) {
+        console.error("[admin] revoke session failed:", err);
+        res.status(500).json({ error: "internal_error" });
+      }
+    },
+  );
+
+  // ── Delete a tenant (admin ban-hammer) ─────────────────────────────────
+  // Operator removes a tenant — abuse response, account cleanup, etc.
+  // Mirrors the user-side /api/account DELETE but operator-scoped:
+  //   - Refuses to delete another admin (admins protect each other)
+  //   - Refuses to delete the calling operator (use the user-side
+  //     endpoint or SQL if you really need that)
+  //   - Cascades sessions, tenant_credits, library_meta via FK ON DELETE
+  //   - FS cleanup of /data/history/<user_id>/ is best-effort
+  app.delete(
+    "/api/admin/tenants/:id",
+    requireOperator,
+    async (req, res) => {
+      const userId = req.params.id;
+      if (userId === req.user.id) {
+        return res.status(400).json({
+          error: "cannot_delete_self",
+          message:
+            "Use the user-side endpoint to delete your own account, or demote first.",
+        });
+      }
+      try {
+        const db = getDb();
+        const target = db
+          .prepare("SELECT id, email, is_admin FROM users WHERE id = ?")
+          .get(userId);
+        if (!target) {
+          return res.status(404).json({ error: "user_not_found" });
+        }
+        if (target.is_admin) {
+          return res.status(400).json({
+            error: "cannot_delete_admin",
+            message:
+              "Demote this user from admin first if you really want to delete them.",
+          });
+        }
+        db.prepare("DELETE FROM users WHERE id = ?").run(userId);
+        console.log(
+          `[admin] deleted tenant ${target.email} (id ${userId}) (by ${req.user.email})`,
+        );
+        // FS cleanup, best-effort.
+        try {
+          const userDir = path.join(getHistoryDir(), userId);
+          await fs.rm(userDir, { recursive: true, force: true });
+        } catch (err) {
+          console.warn(
+            `[admin] history-dir cleanup failed for ${userId}:`,
+            err?.message || err,
+          );
+        }
+        res.json({ ok: true });
+      } catch (err) {
+        console.error("[admin] delete tenant failed:", err);
+        res.status(500).json({ error: "internal_error" });
+      }
+    },
+  );
+
+  // ── Recent signups (forensic / abuse detection) ────────────────────────
+  // Query: ?hours=N (default 24, clamped to RECENT_SIGNUPS_MAX_HOURS).
+  // Returns:
+  //   {
+  //     window_hours: 24,
+  //     by_ip:        [{ ip, count, emails[], first_seen, last_seen }],
+  //     by_ua:        [{ ua, count, ... }],
+  //     by_hour:      [{ hour, count }],
+  //     totals:       { signups, magic_link_requests }
+  //   }
+  app.get("/api/admin/recent-signups", requireOperator, (req, res) => {
+    const hoursReq = parseInt(req.query?.hours, 10) || 24;
+    const hours = Math.min(
+      Math.max(1, hoursReq),
+      RECENT_SIGNUPS_MAX_HOURS,
+    );
+    const cutoff = Date.now() - hours * 60 * 60 * 1000;
+    try {
+      const db = getDb();
+
+      // Tracked sources:
+      //   - users.signup_* — confirmed signups (someone clicked magic link)
+      //   - magic_link_tokens.request_* — link requests, includes unconverted
+      //
+      // Top-line metrics show both so the operator can spot patterns
+      // like "10000 link requests, 2 actual signups" → scripted abuse.
+
+      // Signups by IP
+      const byIp = db
+        .prepare(
+          `SELECT signup_ip AS ip, COUNT(*) AS count,
+                  MIN(created_at) AS first_seen,
+                  MAX(created_at) AS last_seen,
+                  GROUP_CONCAT(email, '|') AS emails_joined
+           FROM users
+           WHERE created_at > ? AND signup_ip IS NOT NULL AND signup_ip != ''
+           GROUP BY signup_ip
+           ORDER BY count DESC, last_seen DESC
+           LIMIT 50`,
+        )
+        .all(cutoff)
+        .map((r) => ({
+          ip: r.ip,
+          count: r.count,
+          first_seen: r.first_seen,
+          last_seen: r.last_seen,
+          emails: (r.emails_joined || "").split("|").filter(Boolean),
+        }));
+
+      // Signups by UA (truncated for readability — group on the first
+      // 80 chars so "Mozilla/5.0 ... Chrome/120" rows collapse into
+      // one even if patch versions differ slightly).
+      const byUa = db
+        .prepare(
+          `SELECT substr(signup_user_agent, 1, 80) AS ua, COUNT(*) AS count,
+                  MIN(created_at) AS first_seen,
+                  MAX(created_at) AS last_seen
+           FROM users
+           WHERE created_at > ? AND signup_user_agent IS NOT NULL AND signup_user_agent != ''
+           GROUP BY substr(signup_user_agent, 1, 80)
+           ORDER BY count DESC, last_seen DESC
+           LIMIT 50`,
+        )
+        .all(cutoff);
+
+      // Signups per hour (for a sparkline; small array).
+      const byHour = db
+        .prepare(
+          `SELECT (created_at / 3600000) * 3600000 AS hour, COUNT(*) AS count
+           FROM users
+           WHERE created_at > ?
+           GROUP BY hour
+           ORDER BY hour ASC`,
+        )
+        .all(cutoff);
+
+      const signupCount = db
+        .prepare("SELECT COUNT(*) AS n FROM users WHERE created_at > ?")
+        .get(cutoff).n;
+      const magicLinkCount = db
+        .prepare(
+          "SELECT COUNT(*) AS n FROM magic_link_tokens WHERE created_at > ?",
+        )
+        .get(cutoff).n;
+
+      // Magic-link request distribution by IP (catches "lots of
+      // requests, no signups" abuse — abusers who keep requesting
+      // links but never click them, or who can't because the email
+      // isn't real). Truncate emails-joined to first 5 to keep
+      // payload reasonable.
+      const linkByIp = db
+        .prepare(
+          `SELECT request_ip AS ip, COUNT(*) AS count,
+                  MIN(created_at) AS first_seen,
+                  MAX(created_at) AS last_seen,
+                  COUNT(DISTINCT email) AS distinct_emails
+           FROM magic_link_tokens
+           WHERE created_at > ? AND request_ip IS NOT NULL AND request_ip != ''
+           GROUP BY request_ip
+           ORDER BY count DESC, last_seen DESC
+           LIMIT 50`,
+        )
+        .all(cutoff);
+
+      res.json({
+        window_hours: hours,
+        totals: {
+          signups: signupCount,
+          magic_link_requests: magicLinkCount,
+        },
+        signups_by_ip: byIp,
+        signups_by_ua: byUa,
+        signups_by_hour: byHour,
+        magic_links_by_ip: linkByIp,
+      });
+    } catch (err) {
+      console.error("[admin] recent-signups failed:", err);
+      res.status(500).json({ error: "internal_error" });
+    }
+  });
+}
diff --git a/server/anon-trial.js b/server/anon-trial.js
new file mode 100644
index 0000000..ce53f9c
--- /dev/null
+++ b/server/anon-trial.js
@@ -0,0 +1,390 @@
+// Cookie-gated "taste before sign-up" trial for unauthenticated
+// visitors on a multi-tenant Recap. First time a visitor POSTs to
+// /api/process without a session cookie, we issue a recap_anon_trial
+// cookie (32-byte random), insert an anon_trials row with N credits,
+// and let them summarize without signing up. After credits_used >=
+// credits_total, the UI nudges them to create an account.
+//
+// Trial summaries forward the OPERATOR's install_id + license to the
+// relay — they're paid for out of the operator's credit pool, gated
+// solely by the anon_trials.credits_total field. tenant_credits is
+// irrelevant for trials (no user row exists yet).
+//
+// Multi-mode only. Single-mode never imports this module.
+
+import { randomBytes } from "crypto";
+import { getDb } from "./db.js";
+import { getConfigSnapshot } from "./config.js";
+
+export const TRIAL_COOKIE = "recap_anon_trial";
+const TRIAL_COOKIE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+
+// Returns the trial config from the StartOS config snapshot. Cached
+// per-call by getConfigSnapshot (already polled by config.js), so
+// reading per-request is cheap.
+async function getTrialConfig() {
+  const snap = await getConfigSnapshot();
+  // Prefer the new `trials_per_ip_lifetime` field; fall back to the
+  // legacy `trials_per_ip_per_day` so a config that hasn't been
+  // re-saved under the new name keeps working with its existing value.
+  // (Semantics is now lifetime in BOTH cases — the rename is mostly
+  // cosmetic for the operator-facing knob.)
+  const ipCap =
+    snap.trials_per_ip_lifetime ??
+    snap.trials_per_ip_per_day ??
+    5;
+  return {
+    creditsPerVisitor: Math.max(
+      0,
+      parseInt(snap.trial_credits_per_visitor ?? 1, 10) || 0,
+    ),
+    perIpLifetime: Math.max(1, parseInt(ipCap, 10) || 5),
+  };
+}
+
+// Crude IPv4-or-IPv6 string extraction. Trusts the X-Forwarded-For
+// header's first hop because Recap sits behind StartOS's tunnel — the
+// header is set by the operator's infrastructure, not by clients
+// directly. If you ever expose the server without a trusted proxy,
+// revisit this.
+export function getClientIp(req) {
+  const xff = req.headers?.["x-forwarded-for"];
+  if (xff) {
+    const first = String(xff).split(",")[0].trim();
+    if (first) return first;
+  }
+  return (req.socket?.remoteAddress || "").replace(/^::ffff:/, "");
+}
+
+// Expand an IPv6 string to its full 8-group :-separated form with
+// each group lowercased + zero-padded to 4 hex chars. Returns null
+// if the input doesn't look like a valid IPv6 string. Used by
+// ipCapKey() below — we need a stable canonical form before we can
+// extract the /64 prefix for cap counting.
+function expandIpv6(addr) {
+  if (!addr || typeof addr !== "string") return null;
+  // Strip any IPv4-mapped suffix (e.g. ::ffff:1.2.3.4) — those are
+  // really IPv4 addresses tunneled through an IPv6 envelope; the
+  // caller has already stripped ::ffff: in getClientIp, but
+  // defensively handle the bare form.
+  if (/\d+\.\d+\.\d+\.\d+$/.test(addr)) return null;
+  if (!addr.includes(":")) return null;
+  const dblIdx = addr.indexOf("::");
+  let groups;
+  if (dblIdx === -1) {
+    // No ::, must be 8 groups.
+    groups = addr.split(":");
+    if (groups.length !== 8) return null;
+  } else {
+    // :: shorthand — split into left and right halves, fill with 0s.
+    if (addr.indexOf("::", dblIdx + 2) !== -1) return null; // two :: → invalid
+    const left = addr.slice(0, dblIdx);
+    const right = addr.slice(dblIdx + 2);
+    const leftGroups = left ? left.split(":") : [];
+    const rightGroups = right ? right.split(":") : [];
+    const missing = 8 - leftGroups.length - rightGroups.length;
+    if (missing < 0) return null;
+    groups = [...leftGroups, ...Array(missing).fill("0"), ...rightGroups];
+  }
+  // Validate + normalize each group.
+  const out = [];
+  for (const g of groups) {
+    if (!/^[0-9a-fA-F]{1,4}$/.test(g)) return null;
+    out.push(g.toLowerCase().padStart(4, "0"));
+  }
+  return out.join(":");
+}
+
+// Cap-counting key for an IP. IPv4 returns the address unchanged
+// (whole-address caps work fine — only one device can claim a
+// public-routable IPv4). IPv6 returns the /64 prefix because RFC
+// 4941 privacy extensions rotate the lower 64 bits of the address
+// per-device, per-session, often hourly — counting by full IPv6
+// address means a single laptop can mint a fresh trial cookie
+// every time its OS picks a new temporary address. /64 is the
+// smallest network unit an ISP delegates to a subscriber, so it's
+// the correct boundary for "this household / this network" caps.
+// Returns null when the input isn't usable; callers treat null as
+// "no cap" (same fallback behavior as before).
+//
+// Trade-off: a /64 might be shared by multiple unrelated subscribers
+// in some carrier configurations, so legitimate visitors could
+// (rarely) get capped together. Operator can tune
+// trials_per_ip_lifetime higher if they're seeing real complaints.
+export function ipCapKey(ip) {
+  if (!ip) return null;
+  // IPv4: whole address.
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(ip)) return ip;
+  // IPv6: /64 prefix. Expand to full form, take first 4 groups,
+  // append `:` so the SQL LIKE match doesn't accidentally match
+  // unrelated prefixes that happen to share a textual leading
+  // substring (e.g. "2600:17" prefix-matching "2600:171…").
+  const expanded = expandIpv6(ip);
+  if (!expanded) return null;
+  const groups = expanded.split(":");
+  if (groups.length < 4) return null;
+  return groups.slice(0, 4).join(":") + ":";
+}
+
+// Truncate UA so a pathological 8KB header doesn't bloat the DB. 256
+// chars covers every legit browser UA string with room to spare.
+function clipUA(ua) {
+  if (!ua) return "";
+  return String(ua).slice(0, 256);
+}
+
+// Count ALL trial cookies ever issued from this IP. Switched from
+// rolling-24h to lifetime in 0.2.84 — a user who clears cookies can no
+// longer just wait a day and replay the trial. The trade-off: a
+// shared-NAT household whose router IP got 5 different family
+// members' trials over a year will eventually be capped. The
+// operator can tune `trials_per_ip_lifetime` higher if that's a
+// real concern, or grant credits manually from the admin panel.
+export function ipTrialsLifetime(ip) {
+  const key = ipCapKey(ip);
+  if (!key) return 0;
+  // IPv4 → exact match. IPv6 → prefix LIKE match (key ends with ":",
+  // so the SQL LIKE 'key%' walks every full IPv6 in that /64 prefix).
+  // Both are index-friendly when ip_address is indexed.
+  if (key.includes(":")) {
+    const row = getDb()
+      .prepare("SELECT COUNT(*) AS n FROM anon_trials WHERE ip_address LIKE ?")
+      .get(key + "%");
+    return row?.n || 0;
+  }
+  const row = getDb()
+    .prepare("SELECT COUNT(*) AS n FROM anon_trials WHERE ip_address = ?")
+    .get(key);
+  return row?.n || 0;
+}
+
+// Insert a new trial row and return it. Caller is responsible for
+// setting the Set-Cookie header on the response.
+function createTrial({ ip, ua, creditsTotal }) {
+  const cookieId = randomBytes(32).toString("base64url");
+  const now = Date.now();
+  getDb()
+    .prepare(
+      `INSERT INTO anon_trials
+        (cookie_id, ip_address, user_agent, created_at, credits_total, credits_used)
+       VALUES (?, ?, ?, ?, ?, 0)`,
+    )
+    .run(cookieId, ip || null, clipUA(ua), now, creditsTotal);
+  return {
+    cookie_id: cookieId,
+    ip_address: ip || null,
+    user_agent: clipUA(ua),
+    created_at: now,
+    credits_total: creditsTotal,
+    credits_used: 0,
+    last_used_at: null,
+    converted_to_user_id: null,
+  };
+}
+
+// lookupTrial(cookieId) — returns the row or null. Doesn't check
+// credit balance; that's the caller's job.
+export function lookupTrial(cookieId) {
+  if (!cookieId) return null;
+  return (
+    getDb()
+      .prepare("SELECT * FROM anon_trials WHERE cookie_id = ?")
+      .get(cookieId) || null
+  );
+}
+
+// hasTrialBudget(trial) — true iff the trial row exists and has
+// unused credits. Centralized so the policy is one place.
+export function hasTrialBudget(trial) {
+  if (!trial) return false;
+  return trial.credits_used < trial.credits_total;
+}
+
+// issueIfEligible({ req, res, forceMint }) — atomic "do we issue a
+// trial cookie to this request?" decision. Called by the auth
+// middleware when no session cookie is present AND the request is
+// hitting a path that counts as "actually using the product" (e.g.
+// POST /api/process).
+//
+// Returns the trial row on success, or null if:
+//   - trial_credits_per_visitor is 0 (trials disabled) AND
+//     forceMint is false
+//   - the IP has already exhausted its lifetime mint quota AND
+//     forceMint is false
+//   - a DB error occurred (logged, fail-closed to "no trial")
+//
+// forceMint: caller asserts this isn't a free-trial-abuse scenario
+// (e.g., the visitor is paying for credits — they need a tracking
+// cookie regardless of trial policy). When set:
+//   - IP lifetime cap is bypassed
+//   - Trials-disabled config is bypassed, but the minted cookie
+//     gets credits_total = 0 (no free bonus on a trials-off install)
+// Normal /api/process traffic should NEVER set this; only paid-flow
+// callers (/api/credits/buy) where "no cookie → can't credit the
+// settle" is a worse failure than enforcing the free-trial cap.
+//
+// On success, also writes the Set-Cookie header so the browser
+// carries the trial id on subsequent requests.
+export async function issueIfEligible({ req, res, forceMint = false }) {
+  let cfg;
+  try {
+    cfg = await getTrialConfig();
+  } catch (err) {
+    console.warn("[anon-trial] config read failed:", err);
+    return null;
+  }
+  // Decide the credits_total this trial row starts with. Paying
+  // buyers on a trials-off install still get a cookie — credits_total
+  // is just 0 — so /api/credits/buy has somewhere to land the purchase.
+  const creditsTotal = forceMint
+    ? Math.max(0, cfg.creditsPerVisitor)
+    : cfg.creditsPerVisitor;
+  if (!forceMint && creditsTotal <= 0) return null; // trials disabled
+
+  const ip = getClientIp(req);
+  if (!forceMint && ip && ipTrialsLifetime(ip) >= cfg.perIpLifetime) {
+    // Over the lifetime IP cap. Don't issue; visitor sees the same
+    // "sign up" nudge a returning trial-exhausted user sees. The
+    // operator can grep magic_link_tokens + anon_trials by ip_address
+    // if a pattern emerges, or manually grant credits to specific
+    // tenants from the admin panel.
+    return null;
+  }
+
+  let trial;
+  try {
+    trial = createTrial({
+      ip,
+      ua: req.headers?.["user-agent"] || "",
+      creditsTotal,
+    });
+  } catch (err) {
+    console.warn("[anon-trial] createTrial failed:", err);
+    return null;
+  }
+  // Diagnostic: log the resolved IP + the cap-counting key so an
+  // operator can grep mint events to verify the IP detector is
+  // working (a flood of mints with ip=null or ip=127.0.0.1 means
+  // the reverse-proxy isn't passing X-Forwarded-For). Cap key
+  // shows the bucket this mint counted under — for IPv6 this is
+  // the /64 prefix the mint will share with future addresses on
+  // the same network.
+  console.log(
+    `[anon-trial] minted cookie for ip=${ip || "(unknown)"} cap_key=${ipCapKey(ip) || "(none)"} credits=${creditsTotal}`,
+  );
+
+  // Set-Cookie. HttpOnly so browser-side JS can't read or replay it;
+  // SameSite=Lax is enough since we never need cross-site trial
+  // posts. Secure is on in production (StartOS terminates HTTPS at
+  // the tunnel) but harmless on localhost dev.
+  const maxAgeSeconds = Math.floor(TRIAL_COOKIE_MAX_AGE_MS / 1000);
+  res.setHeader?.(
+    "Set-Cookie",
+    [
+      `${TRIAL_COOKIE}=${trial.cookie_id}`,
+      `Max-Age=${maxAgeSeconds}`,
+      "Path=/",
+      "HttpOnly",
+      "SameSite=Lax",
+      "Secure",
+    ].join("; "),
+  );
+  return trial;
+}
+
+// debitOne(cookieId) — atomic +1 to credits_used. Returns the new
+// row. Caller (the /api/process handler in multi-mode) calls this
+// AFTER the relay accepts the request, so a failed relay call
+// doesn't burn a trial credit.
+export function debitOne(cookieId) {
+  const now = Date.now();
+  getDb()
+    .prepare(
+      "UPDATE anon_trials SET credits_used = credits_used + 1, last_used_at = ? WHERE cookie_id = ?",
+    )
+    .run(now, cookieId);
+  return lookupTrial(cookieId);
+}
+
+// linkToUser(cookieId, userId) — called by /auth/verify when a trial
+// holder completes signup. Records the conversion for analytics AND
+// transfers any unused credits on the trial to the user's
+// tenant_credits balance. This is the user-facing promise: "your free
+// trial credits + any credits you bought during the trial transfer
+// to your account when you sign up."
+//
+// "Unused" = credits_total - credits_used. The default trial allowance
+// (e.g. 1 free) plus any credits the visitor purchased anonymously
+// minus whatever they've already spent.
+//
+// Returns the number of credits transferred (0 if none).
+//
+// Async because we opportunistically sweep any settled-but-unapplied
+// pending purchases for this anon cookie FIRST, so a la carte credits
+// the visitor bought right before signup (and where the BTCPay
+// redirect killed the frontend poller) get rolled into credits_total
+// before we compute the transfer. Without this sweep, a buy-then-
+// immediately-sign-up flow drops the just-purchased credits on the
+// floor.
+export async function linkToUser(cookieId, userId) {
+  if (!cookieId || !userId) return 0;
+  try {
+    const { sweepUnappliedPurchases } = await import("./credits-purchase.js");
+    await sweepUnappliedPurchases({ buyerType: "anon", buyerId: cookieId });
+  } catch (err) {
+    console.warn(
+      `[anon-trial] pre-link sweep failed for ${cookieId}: ${err?.message || err}`,
+    );
+  }
+  const db = getDb();
+  const trial = db
+    .prepare(
+      "SELECT credits_total, credits_used FROM anon_trials WHERE cookie_id = ?",
+    )
+    .get(cookieId);
+  const remaining = trial
+    ? Math.max(
+        0,
+        (trial.credits_total || 0) - (trial.credits_used || 0),
+      )
+    : 0;
+
+  // Carry-over credits go into the PURCHASED bucket — they're a mix
+  // of "leftover free trial allowance" + "credits the anon bought a
+  // la carte". Treating all of them as purchased (permanent) is the
+  // safe interpretation; the user paid for some of these and the
+  // others were earned by clicking through a signup. We don't want
+  // the next replenishment cycle wiping them.
+  const tx = db.transaction(() => {
+    db.prepare(
+      "UPDATE anon_trials SET converted_to_user_id = ? WHERE cookie_id = ?",
+    ).run(userId, cookieId);
+    if (remaining > 0) {
+      const existing = db
+        .prepare("SELECT user_id FROM tenant_credits WHERE user_id = ?")
+        .get(userId);
+      if (existing) {
+        db.prepare(
+          `UPDATE tenant_credits
+           SET purchased_balance = purchased_balance + ?,
+               lifetime_granted = lifetime_granted + ?
+           WHERE user_id = ?`,
+        ).run(remaining, remaining, userId);
+      } else {
+        db.prepare(
+          `INSERT INTO tenant_credits
+             (user_id, purchased_balance, replenish_balance, last_replenish_at,
+              lifetime_granted, lifetime_consumed)
+           VALUES (?, ?, 0, ?, ?, 0)`,
+        ).run(userId, remaining, Date.now(), remaining);
+      }
+    }
+  });
+  tx();
+  if (remaining > 0) {
+    console.log(
+      `[anon-trial] transferred ${remaining} unused credits from ${cookieId} → user ${userId}`,
+    );
+  }
+  return remaining;
+}
diff --git a/server/audio.js b/server/audio.js
index 1a98d49..ed64ba9 100644
--- a/server/audio.js
+++ b/server/audio.js
@@ -53,7 +53,18 @@ export async function splitAudioFile(inputPath, outputDir, chunkSeconds = 2700)
       "-acodec", "copy",
       chunkPath,
     ], { timeout: 120000 });
-    chunks.push({ path: chunkPath, startOffset: startSec, index: i });
+    chunks.push({
+      path: chunkPath,
+      startOffset: startSec,
+      // Actual seconds in THIS chunk (the last chunk is usually
+      // shorter than chunkSeconds). Carried downstream so the
+      // transcribe-stitching code can sanity-cap timestamps each
+      // chunk's model emits — some models hallucinate offsets
+      // way past the chunk's audio (observed: gemini-3.1-flash-lite
+      // emitting [10:12:44] on a 45-min chunk).
+      durationSec: segLen,
+      index: i,
+    });
     startSec += chunkSeconds;
     i++;
   }
diff --git a/server/auth-routes.js b/server/auth-routes.js
new file mode 100644
index 0000000..3725407
--- /dev/null
+++ b/server/auth-routes.js
@@ -0,0 +1,814 @@
+// Magic-link auth endpoints for multi-tenant cloud mode.
+//
+// Flow:
+//   1. POST /auth/request-link  { email }
+//        - Normalize, rate-limit, generate token, hash, store hash
+//        - Send email with verifyUrl containing the plaintext token
+//        - Always returns { ok: true } — never leaks whether email exists
+//
+//   2. GET /auth/verify?token=<plaintext>
+//        - Hash, look up, validate (unused + unexpired)
+//        - Mark used; upsert user; issue session cookie
+//        - If first user ever, mark is_admin = 1 (operator bootstrap)
+//        - If request carries a recap_anon_trial cookie, link the trial
+//          row to the new user_id so their trial summary lands in their
+//          library and the conversion gets recorded
+//        - 302 redirect to /
+//
+//   3. POST /auth/signout
+//        - Delete session row, clear cookie, redirect to / (or 204 if API)
+//
+// Multi-mode only. The route registration helper itself returns early
+// in single mode so single-mode boot doesn't initialize SMTP / DB
+// codepaths.
+
+import {
+  randomBytes,
+  createHash,
+  scryptSync,
+  timingSafeEqual,
+} from "crypto";
+import * as cookie from "cookie";
+import { getDb } from "./db.js";
+import { sendMail, isSmtpReady } from "./smtp.js";
+import { renderMagicLinkEmail } from "./email-template.js";
+import { getConfigSnapshot } from "./config.js";
+import { getClientIp, TRIAL_COOKIE, linkToUser } from "./anon-trial.js";
+import { renameScopeDir } from "./history.js";
+import { requireUser } from "./tenant-auth.js";
+
+export const SESSION_COOKIE = "recap_session";
+const SESSION_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+const MAGIC_LINK_TTL_MS = 15 * 60 * 1000; // 15 minutes
+
+// ── Password hashing ─────────────────────────────────────────────────
+// scrypt with a per-password 16-byte salt, stored as
+// "scrypt$<saltHex>$<hashHex>" in users.password_hash. Same primitive
+// admin-auth.js uses for the single-mode operator password, so the
+// crypto surface area stays consistent across the codebase. N=2^15
+// (KDF cost) is what the Node docs suggest for interactive logins —
+// ~50ms on commodity hardware, slow enough to deter brute force,
+// fast enough to not feel laggy.
+const SCRYPT_KEYLEN = 64;
+const SCRYPT_OPTS = { N: 1 << 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
+const SCRYPT_PREFIX = "scrypt$";
+
+export function hashPassword(plain) {
+  const salt = randomBytes(16);
+  const derived = scryptSync(plain, salt, SCRYPT_KEYLEN, SCRYPT_OPTS);
+  return `${SCRYPT_PREFIX}${salt.toString("hex")}$${derived.toString("hex")}`;
+}
+
+function verifyPassword(plain, stored) {
+  if (!stored || !stored.startsWith(SCRYPT_PREFIX)) return false;
+  const [, saltHex, hashHex] = stored.split("$");
+  if (!saltHex || !hashHex) return false;
+  let salt, expected;
+  try {
+    salt = Buffer.from(saltHex, "hex");
+    expected = Buffer.from(hashHex, "hex");
+  } catch {
+    return false;
+  }
+  if (expected.length !== SCRYPT_KEYLEN) return false;
+  let actual;
+  try {
+    actual = scryptSync(plain, salt, SCRYPT_KEYLEN, SCRYPT_OPTS);
+  } catch {
+    return false;
+  }
+  // timingSafeEqual requires equal length, which we just enforced above.
+  return timingSafeEqual(actual, expected);
+}
+
+// Mild policy — 8 char minimum, 256 max. We deliberately don't enforce
+// "one uppercase + one digit + ..." style rules; the consensus modern
+// view (NIST 800-63B) is that length matters far more than composition,
+// and rules that demand specific shapes just push users toward
+// predictable substitutions ("Password1!"). Min 8 catches the worst
+// cases without alienating people using passphrases.
+export function validatePasswordPolicy(plain) {
+  if (typeof plain !== "string") return "password_required";
+  if (plain.length < 8) return "password_too_short";
+  if (plain.length > 256) return "password_too_long";
+  return null;
+}
+
+// ── Rate limits ────────────────────────────────────────────────────────
+// Both buckets are in-memory: not durable across restarts, but the worst
+// case is one extra link request per email/IP per restart, which is fine.
+// For abuse on the scale where in-memory limits are insufficient, the
+// operator's IP/UA logs + manual deny-list are the next layer.
+const MAX_LINKS_PER_EMAIL_PER_HOUR = 5;
+const MAX_LINKS_PER_IP_PER_HOUR = 10;
+const ONE_HOUR_MS = 60 * 60 * 1000;
+
+const emailBuckets = new Map(); // email → [timestamp, ...]
+const ipBuckets = new Map(); // ip → [timestamp, ...]
+
+function pushBucket(map, key, now) {
+  const arr = map.get(key) || [];
+  const fresh = arr.filter((t) => now - t < ONE_HOUR_MS);
+  fresh.push(now);
+  map.set(key, fresh);
+  return fresh.length;
+}
+
+function bucketCount(map, key, now) {
+  const arr = map.get(key) || [];
+  const fresh = arr.filter((t) => now - t < ONE_HOUR_MS);
+  if (fresh.length !== arr.length) map.set(key, fresh);
+  return fresh.length;
+}
+
+// Periodically prune old bucket entries so the maps don't grow
+// unbounded under heavy traffic. Fire-and-forget; the filter above
+// also self-prunes per access.
+const BUCKET_GC_MS = 5 * 60 * 1000;
+setInterval(() => {
+  const cutoff = Date.now() - ONE_HOUR_MS;
+  for (const map of [emailBuckets, ipBuckets]) {
+    for (const [key, arr] of map.entries()) {
+      const fresh = arr.filter((t) => t > cutoff);
+      if (fresh.length === 0) map.delete(key);
+      else if (fresh.length !== arr.length) map.set(key, fresh);
+    }
+  }
+}, BUCKET_GC_MS).unref?.();
+
+function normalizeEmail(raw) {
+  if (typeof raw !== "string") return "";
+  return raw.trim().toLowerCase();
+}
+
+function isPlausibleEmail(s) {
+  // Deliberately permissive — the user's mail server is the source of
+  // truth for whether an address works (they either receive the link or
+  // they don't). Just sanity-check that we have something with @ and a
+  // dot in the domain.
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s) && s.length <= 254;
+}
+
+function sha256(s) {
+  return createHash("sha256").update(s).digest("hex");
+}
+
+function uuid() {
+  // 16 random bytes formatted as a UUIDv4-ish hex with hyphens. Doesn't
+  // need to be RFC-compliant — uniqueness is the only requirement.
+  return randomBytes(16).toString("hex");
+}
+
+function clipUA(ua) {
+  return String(ua || "").slice(0, 256);
+}
+
+// ── Public URL plumbing ────────────────────────────────────────────────
+// The verify URL in the email needs the operator's ClearNet URL set via
+// the "Set Recap Public URL" StartOS action. We refuse to send magic
+// links if it's empty — otherwise the email would link to localhost or
+// an internal hostname.
+async function getPublicUrl() {
+  const snap = await getConfigSnapshot();
+  const url = (snap.recap_public_url || "").trim();
+  return url.replace(/\/$/, "");
+}
+
+// ── Route handlers ─────────────────────────────────────────────────────
+
+async function handleRequestLink(req, res) {
+  const email = normalizeEmail(req.body?.email);
+  if (!email || !isPlausibleEmail(email)) {
+    // Deliberately vague — don't help enumerate valid emails. Just say
+    // "ok" even on bad input so the response shape is the same.
+    return res.json({ ok: true });
+  }
+
+  const publicUrl = await getPublicUrl();
+  if (!publicUrl) {
+    console.error(
+      "[auth] /auth/request-link blocked: recap_public_url not set. Run the 'Set Recap Public URL' StartOS action first.",
+    );
+    return res.status(503).json({
+      error: "public_url_not_set",
+      message:
+        "This Recap instance hasn't been fully configured yet. Ask the operator to set the public URL.",
+    });
+  }
+  if (!isSmtpReady()) {
+    console.error(
+      "[auth] /auth/request-link blocked: SMTP not ready. Configure StartOS System SMTP.",
+    );
+    return res.status(503).json({
+      error: "smtp_not_ready",
+      message:
+        "This Recap instance can't send email yet. Ask the operator to configure SMTP.",
+    });
+  }
+
+  const ip = getClientIp(req);
+  const now = Date.now();
+
+  // Rate limits. Two buckets — email and IP. Either trips → 429 with a
+  // generic message that doesn't leak which limit was hit.
+  if (bucketCount(emailBuckets, email, now) >= MAX_LINKS_PER_EMAIL_PER_HOUR) {
+    return res.status(429).json({
+      error: "rate_limited",
+      message: "Too many sign-in requests for this email. Try again in an hour.",
+    });
+  }
+  if (ip && bucketCount(ipBuckets, ip, now) >= MAX_LINKS_PER_IP_PER_HOUR) {
+    return res.status(429).json({
+      error: "rate_limited",
+      message: "Too many sign-in requests from this network. Try again in an hour.",
+    });
+  }
+
+  pushBucket(emailBuckets, email, now);
+  if (ip) pushBucket(ipBuckets, ip, now);
+
+  // Determine intent: signin (existing user) vs signup (new email).
+  // Both flows are identical to the server — the field is just for
+  // analytics. We don't leak intent in the response.
+  const existing = getDb()
+    .prepare("SELECT id FROM users WHERE email = ?")
+    .get(email);
+  const intent = existing ? "signin" : "signup";
+
+  // Capture the trial cookie at request-link time and store it
+  // server-side alongside the token. At /auth/verify we'll use it
+  // to link the trial → user even when the magic-link click lands
+  // in a different browser / cookie jar than the one that requested
+  // the link (the iOS Private mode + in-app email webview case).
+  // We read it directly from req.headers.cookie because the trial
+  // cookie middleware may or may not have populated req.trial
+  // depending on path matching — being explicit here is safer.
+  let trialCookieId = null;
+  try {
+    const parsed = cookie.parse(req.headers?.cookie || "");
+    if (parsed[TRIAL_COOKIE]) trialCookieId = parsed[TRIAL_COOKIE];
+  } catch {
+    // cookie parse failures are non-fatal; fall through with null
+  }
+
+  // Issue + send via the shared helper. We deliberately don't
+  // surface send failures back to the user — the standard advice for
+  // magic-link auth is "always pretend we sent it" so attackers can't
+  // probe which emails are configured. Operator sees the error in
+  // logs and can investigate (usually SMTP creds wrong or Gmail
+  // rate-limited).
+  await sendSignInLink({
+    email,
+    intent,
+    ip,
+    userAgent: req.headers?.["user-agent"],
+    trialCookieId,
+  });
+
+  res.json({ ok: true });
+}
+
+async function handleVerify(req, res) {
+  const plaintext = String(req.query?.token || "").trim();
+  if (!plaintext) {
+    return res.status(400).send(renderErrorPage("Missing token."));
+  }
+
+  const tokenHash = sha256(plaintext);
+  const now = Date.now();
+
+  const tx = getDb().transaction(() => {
+    const row = getDb()
+      .prepare(
+        "SELECT * FROM magic_link_tokens WHERE token_hash = ? AND used_at IS NULL AND expires_at > ?",
+      )
+      .get(tokenHash, now);
+    if (!row) return { error: "invalid_or_expired" };
+    getDb()
+      .prepare("UPDATE magic_link_tokens SET used_at = ? WHERE token_hash = ?")
+      .run(now, tokenHash);
+    return { row };
+  });
+
+  let result;
+  try {
+    result = tx();
+  } catch (err) {
+    console.error("[auth] verify tx failed:", err);
+    return res.status(500).send(renderErrorPage("Internal error."));
+  }
+  if (result.error) {
+    return res
+      .status(400)
+      .send(
+        renderErrorPage(
+          "This sign-in link has expired or already been used. Request a fresh one.",
+        ),
+      );
+  }
+
+  const email = result.row.email;
+  const ip = getClientIp(req);
+  const ua = clipUA(req.headers?.["user-agent"]);
+
+  // Upsert user row.
+  let user = getDb()
+    .prepare("SELECT * FROM users WHERE email = ?")
+    .get(email);
+  if (!user) {
+    const id = uuid();
+    const syntheticInstallId = uuid();
+    // First user ever = operator bootstrap. We could also gate this on
+    // "is the install fresh (no users at all)" — which is what this
+    // check does. Once at least one user exists, subsequent signups
+    // are regular tenants with is_admin = 0.
+    const userCountRow = getDb()
+      .prepare("SELECT COUNT(*) AS n FROM users")
+      .get();
+    const isAdmin = (userCountRow?.n || 0) === 0 ? 1 : 0;
+    getDb()
+      .prepare(
+        `INSERT INTO users
+          (id, email, created_at, last_signin_at, synthetic_install_id, is_admin, signup_ip, signup_user_agent)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(id, email, now, now, syntheticInstallId, isAdmin, ip || null, ua);
+    user = getDb().prepare("SELECT * FROM users WHERE id = ?").get(id);
+
+    // Seed tenant_credits for new NON-ADMIN users with the operator's
+    // configured default. Goes into the REPLENISHABLE bucket so
+    // setReplenishPeriod=daily/weekly/monthly refills it on schedule.
+    // Admin users skip this entirely — their relay calls bill the
+    // operator pool (via /data/license.txt), not a local balance.
+    //
+    // Pro/Max users (license attached at creation, e.g. via the
+    // anon-signup-with-purchase flow) ALSO skip this — they spend
+    // from their license-keyed relay pool, so a tenant_credits row
+    // would just sit unused and confuse the admin Tenants view.
+    if (!isAdmin && !user.keysat_license) {
+      try {
+        const { seedSignup } = await import("./tenant-credits.js");
+        await seedSignup(id);
+      } catch (err) {
+        console.warn("[auth] tenant_credits seed failed:", err);
+      }
+    }
+
+    if (isAdmin) {
+      console.log(
+        `[auth] First user signed up — ${email} bootstrapped as operator (is_admin=1)`,
+      );
+      // Legacy library at /data/history/owner/ stays where it is —
+      // admin's scopeForRequest() returns "owner" regardless of mode,
+      // so single-mode and multi-mode admin both read the same path.
+      // No rename. Switching back to single mode keeps the operator's
+      // library accessible at /data/history/owner/.
+    }
+  } else {
+    getDb()
+      .prepare("UPDATE users SET last_signin_at = ? WHERE id = ?")
+      .run(now, user.id);
+  }
+
+  // Resolve which anon trial cookie to link. Two sources:
+  //   1. result.row.trial_cookie_id — captured server-side at
+  //      /auth/request-link time. Survives cross-browser / in-app-
+  //      webview magic-link clicks because it doesn't depend on the
+  //      verify request carrying the cookie.
+  //   2. req.cookies[TRIAL_COOKIE] — the legacy path, used when the
+  //      magic-link click lands in the SAME browser that did the
+  //      anon activity (typical desktop / non-private-mode flow).
+  //
+  // Priority: token-row wins. It represents the explicit intent
+  // captured at signup-request time and is the more reliable
+  // signal. The req cookie is a fallback for old token rows from
+  // before the trial_cookie_id column existed, and for any
+  // edge-case where the request-link path didn't capture it.
+  //
+  // We also rename the trial's history folder (anon/<cookie_id>/) to
+  // the user's id so the summary they ran before signing up shows
+  // up in their library. Skipped for returning users (existing
+  // account) — they already have a library and we can't safely
+  // merge filesystem-side. The trial row still gets linked; the
+  // anon/<cookie_id>/ folder just stays as an orphan.
+  try {
+    let trialCookieId = result.row.trial_cookie_id || null;
+    if (!trialCookieId) {
+      const cookies = cookie.parse(req.headers?.cookie || "");
+      trialCookieId = cookies[TRIAL_COOKIE] || null;
+    }
+    if (trialCookieId) {
+      await linkToUser(trialCookieId, user.id);
+      if (user.created_at === user.last_signin_at) {
+        try {
+          await renameScopeDir(`anon/${trialCookieId}`, user.id);
+        } catch (err) {
+          console.warn(
+            "[auth] trial→user scope rename failed:",
+            err?.message || err,
+          );
+        }
+      }
+    }
+  } catch {
+    // best-effort; trial linking isn't on the critical signin path
+  }
+
+  // Issue session — shared with /auth/signin-password so cookie shape
+  // + sessions-row format stay identical regardless of which auth
+  // method got the user here.
+  issueSession({ userId: user.id, req, res });
+  res.redirect(302, "/");
+}
+
+// Shared session-issuance helper. Used by both /auth/verify (magic-link
+// success path) and /auth/signin-password (password success path) so
+// the cookie shape + sessions-row format stay identical.
+function issueSession({ userId, req, res }) {
+  const sessionId = randomBytes(32).toString("base64url");
+  const now = Date.now();
+  const expiresAt = now + SESSION_MAX_AGE_MS;
+  const ua = clipUA(req.headers?.["user-agent"]);
+  const ip = getClientIp(req);
+  getDb()
+    .prepare(
+      `INSERT INTO sessions
+        (id, user_id, created_at, expires_at, last_used_at, user_agent, ip_address)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+    )
+    .run(sessionId, userId, now, expiresAt, now, ua, ip || null);
+  const maxAgeSeconds = Math.floor(SESSION_MAX_AGE_MS / 1000);
+  res.setHeader(
+    "Set-Cookie",
+    [
+      `${SESSION_COOKIE}=${sessionId}`,
+      `Max-Age=${maxAgeSeconds}`,
+      "Path=/",
+      "HttpOnly",
+      "SameSite=Lax",
+      "Secure",
+    ].join("; "),
+  );
+  return sessionId;
+}
+
+// ── Internal sessions for the subscription background processor ──────────────
+// Per-tenant subscriptions: the processor summarizes an approved auto-queue
+// item by calling /api/process over loopback, which in multi mode is
+// authenticated. So it mints a SHORT-LIVED real session for the item's
+// owning user, sends it as the recap_session cookie, and deletes it right
+// after. This reuses the real auth path — NOT a bypass: a bad/expired token
+// just 401s and the item is marked failed, never an auth hole.
+export function mintInternalSession(userId) {
+  const sessionId = randomBytes(32).toString("base64url");
+  const now = Date.now();
+  getDb()
+    .prepare(
+      `INSERT INTO sessions
+        (id, user_id, created_at, expires_at, last_used_at, user_agent, ip_address)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+    )
+    .run(
+      sessionId,
+      userId,
+      now,
+      now + 30 * 60 * 1000, // 30 min is plenty for one summarize run
+      now,
+      "subscription-processor",
+      "127.0.0.1",
+    );
+  return sessionId;
+}
+
+export function deleteInternalSession(sessionId) {
+  if (!sessionId) return;
+  try {
+    getDb().prepare("DELETE FROM sessions WHERE id = ?").run(sessionId);
+  } catch {}
+}
+
+// The operator/admin owns the "owner" scope in multi mode — resolve their
+// user id so the processor can run owner-scoped items as the operator.
+export function adminUserId() {
+  try {
+    const row = getDb()
+      .prepare("SELECT id FROM users WHERE is_admin = 1 ORDER BY created_at LIMIT 1")
+      .get();
+    return row?.id || null;
+  } catch {
+    return null;
+  }
+}
+
+// /auth/signin-password — accept { email, password }, verify, issue a
+// session cookie. Used by the auth.html form when the user opts to
+// type a password (faster than waiting on an email).
+//
+// We DELIBERATELY don't differentiate "no such email" vs "wrong
+// password" in the error response — both return 401 with a generic
+// message. This stops credential-stuffing tools from using us as an
+// email-existence oracle.
+//
+// Rate limits: same email + IP buckets as /auth/request-link, so the
+// password endpoint can't be brute-forced any faster than someone
+// could spam magic-link emails.
+async function handleSignInPassword(req, res) {
+  const email = normalizeEmail(req.body?.email);
+  const password = req.body?.password;
+  if (!email || !isPlausibleEmail(email) || typeof password !== "string") {
+    return res.status(401).json({
+      error: "bad_credentials",
+      message: "Email or password is wrong.",
+    });
+  }
+  const ip = getClientIp(req);
+  const now = Date.now();
+  if (bucketCount(emailBuckets, email, now) >= MAX_LINKS_PER_EMAIL_PER_HOUR) {
+    return res
+      .status(429)
+      .json({ error: "rate_limited", message: "Too many sign-in attempts." });
+  }
+  if (ip && bucketCount(ipBuckets, ip, now) >= MAX_LINKS_PER_IP_PER_HOUR) {
+    return res
+      .status(429)
+      .json({ error: "rate_limited", message: "Too many sign-in attempts." });
+  }
+  pushBucket(emailBuckets, email, now);
+  if (ip) pushBucket(ipBuckets, ip, now);
+
+  let user;
+  try {
+    user = getDb()
+      .prepare("SELECT * FROM users WHERE email = ?")
+      .get(email);
+  } catch (err) {
+    console.error("[auth] signin-password lookup failed:", err);
+    return res.status(500).json({ error: "internal_error" });
+  }
+  // Run scrypt even when the user doesn't exist so timing doesn't
+  // betray which emails are registered. The dummy verify spends the
+  // same ~50ms scrypt-or-so as the real path.
+  const stored = user?.password_hash || `${SCRYPT_PREFIX}0000$0000`;
+  const ok = verifyPassword(password, stored);
+  if (!user || !user.password_hash || !ok) {
+    return res
+      .status(401)
+      .json({ error: "bad_credentials", message: "Email or password is wrong." });
+  }
+  // Authenticated. Update last_signin_at and issue a session.
+  getDb()
+    .prepare("UPDATE users SET last_signin_at = ? WHERE id = ?")
+    .run(now, user.id);
+  issueSession({ userId: user.id, req, res });
+  res.json({ ok: true });
+}
+
+async function handleSignout(req, res) {
+  try {
+    const cookies = cookie.parse(req.headers?.cookie || "");
+    const sessionId = cookies[SESSION_COOKIE];
+    if (sessionId) {
+      getDb()
+        .prepare("DELETE FROM sessions WHERE id = ?")
+        .run(sessionId);
+    }
+  } catch {}
+  // Expire the cookie immediately.
+  res.setHeader(
+    "Set-Cookie",
+    `${SESSION_COOKIE}=; Max-Age=0; Path=/; HttpOnly; SameSite=Lax; Secure`,
+  );
+  // Honor JSON callers (UI fetch) vs link callers (form submit).
+  if (req.accepts?.("json") && !req.accepts?.("html")) {
+    return res.status(204).end();
+  }
+  res.redirect(302, "/");
+}
+
+// Self-contained branded error page used when /auth/verify fails.
+// Doesn't pull in the full app shell so it works even if the static
+// bundle is broken or partially served. Visual style matches /auth.html
+// (same dark-glass card, same primary-button accent) so the user feels
+// they're still in the same product flow.
+function renderErrorPage(message) {
+  const safe = String(message)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
+  <title>Sign-in failed · Recaps</title>
+  <link rel="icon" type="image/png" href="/assets/icon.png">
+  <meta name="theme-color" content="#0a0e1a">
+  <style>
+    *{box-sizing:border-box;margin:0;padding:0}
+    html,body{height:100%}
+    body{
+      font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;
+      background:#0a0e1a;color:#e2e8f0;
+      display:flex;align-items:center;justify-content:center;padding:24px;
+    }
+    .card{
+      width:100%;max-width:420px;background:#121828;
+      border:1px solid #1f2942;border-radius:12px;padding:32px 28px;
+    }
+    .logo{display:flex;align-items:center;gap:12px;margin-bottom:24px}
+    .logo img{width:32px;height:32px;border-radius:6px}
+    .logo span{font-size:18px;font-weight:600;color:#f5f9ff}
+    h1{font-size:20px;font-weight:600;color:#f5f9ff;margin-bottom:10px}
+    p.msg{font-size:14px;line-height:1.55;color:#cbd5e1;margin-bottom:22px}
+    .btn-row{display:flex;gap:8px;flex-wrap:wrap}
+    a.btn-primary{
+      display:inline-block;background:#3b82f6;color:#fff;text-decoration:none;
+      font-size:14px;font-weight:600;padding:10px 18px;border-radius:8px;
+    }
+    a.btn-primary:hover{background:#2563eb}
+    a.btn-secondary{
+      display:inline-block;background:transparent;color:#94a3b8;text-decoration:none;
+      font-size:14px;font-weight:500;padding:10px 14px;border-radius:8px;border:1px solid #334155;
+    }
+    a.btn-secondary:hover{color:#cbd5e1;border-color:#475569}
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="logo">
+      <img src="/assets/icon.png" alt="Recaps" onerror="this.style.display='none'">
+      <span>Recaps</span>
+    </div>
+    <h1>Sign-in didn't work</h1>
+    <p class="msg">${safe}</p>
+    <div class="btn-row">
+      <a href="/auth.html" class="btn-primary">Get a new sign-in link</a>
+      <a href="/" class="btn-secondary">Back to Recaps</a>
+    </div>
+  </div>
+</body>
+</html>`;
+}
+
+// sendSignInLink({ email, intent, ip?, userAgent?, emailBody? }) —
+// reusable magic-link issuance + email send. Used by:
+//   • /auth/request-link              — visitor-initiated sign-in
+//   • license-purchase poll-settle    — system-initiated post-purchase
+//                                       "your account is ready" send
+//
+// Generates a 32-byte token, hashes it, stores the hash in
+// magic_link_tokens, builds a verifyUrl, sends the email with either
+// the default magic-link body OR a caller-supplied (subject, text,
+// html) tuple for custom flows. Returns { ok: true, expires_at } on
+// success; { ok: false, error, message? } on failure.
+//
+// Doesn't enforce rate limits — that's the caller's job. /auth/request-link
+// has the per-email + per-IP buckets; the post-purchase path is
+// inherently rate-limited by the actual payment, so no extra bucket
+// needed.
+export async function sendSignInLink({
+  email,
+  intent = "signin",
+  ip = null,
+  userAgent = "",
+  emailBody = null,
+  trialCookieId = null,
+}) {
+  if (!email || !isPlausibleEmail(email)) {
+    return { ok: false, error: "bad_email" };
+  }
+  const publicUrl = await getPublicUrl();
+  if (!publicUrl) {
+    return { ok: false, error: "public_url_not_set" };
+  }
+  if (!isSmtpReady()) {
+    return { ok: false, error: "smtp_not_ready" };
+  }
+  const now = Date.now();
+  const plaintext = randomBytes(32).toString("base64url");
+  const tokenHash = sha256(plaintext);
+  const expiresAt = now + MAGIC_LINK_TTL_MS;
+  try {
+    getDb()
+      .prepare(
+        `INSERT INTO magic_link_tokens
+          (token_hash, email, created_at, expires_at, intent, request_ip, request_ua, trial_cookie_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(
+        tokenHash,
+        email,
+        now,
+        expiresAt,
+        intent,
+        ip || null,
+        clipUA(userAgent),
+        trialCookieId || null,
+      );
+  } catch (err) {
+    console.error("[auth] sendSignInLink insert failed:", err);
+    return { ok: false, error: "internal_error" };
+  }
+  const verifyUrl = `${publicUrl}/auth/verify?token=${encodeURIComponent(plaintext)}`;
+  // Default to the standard sign-in email body; callers can override
+  // either with a pre-built {subject,text,html} object OR a function
+  // that receives the verifyUrl and returns that shape. The function
+  // form is what license-purchase uses to inject the celebratory
+  // "your Pro account is ready" copy with the verifyUrl pre-rendered
+  // into the body.
+  let message;
+  if (typeof emailBody === "function") {
+    message = emailBody(verifyUrl);
+  } else if (emailBody && typeof emailBody === "object") {
+    message = emailBody;
+  } else {
+    message = renderMagicLinkEmail({
+      verifyUrl,
+      brandName: "Recaps",
+      expiresInMinutes: 15,
+    });
+  }
+  try {
+    await sendMail({
+      to: email,
+      subject: message.subject,
+      text: message.text,
+      html: message.html,
+    });
+  } catch (err) {
+    console.error(
+      "[auth] sendSignInLink sendMail failed for",
+      email,
+      ":",
+      err?.message || err,
+    );
+    // The token is already inserted; if the operator's SMTP is flaky
+    // the user can re-request a link. Return error so the caller can
+    // decide whether to surface it or swallow.
+    return { ok: false, error: "send_failed" };
+  }
+  return { ok: true, expires_at: expiresAt };
+}
+
+// setupAuthRoutes(app) — registers /auth/* endpoints. Multi-mode only;
+// wired in server/index.js behind the RECAP_MODE === 'multi' branch.
+//
+// Magic-link is the primary auth surface:
+//   POST /auth/request-link         — issue a magic link by email
+//   GET  /auth/verify?token=...     — consume the link, issue session
+//   POST /auth/signout              — drop the session
+//   GET  /auth/signout              — same (link-click convenience)
+//
+// Password endpoints are the optional faster-signin add-on:
+//   POST /auth/set-password         — set OR overwrite my password
+//   POST /auth/clear-password       — remove my password (magic-link only)
+//   POST /auth/signin-password      — sign in with email + password
+//
+// Note there is no /auth/reset-password endpoint by design — reset is
+// implemented as "request a magic link, sign in, then call
+// /auth/set-password with the new one." Adding a dedicated reset
+// endpoint would duplicate the magic-link flow without adding any
+// security or UX.
+export function setupAuthRoutes(app) {
+  app.post("/auth/request-link", (req, res) => {
+    handleRequestLink(req, res).catch((err) => {
+      console.error("[auth] /auth/request-link unhandled:", err);
+      res.status(500).json({ error: "internal_error" });
+    });
+  });
+
+  app.get("/auth/verify", (req, res) => {
+    handleVerify(req, res).catch((err) => {
+      console.error("[auth] /auth/verify unhandled:", err);
+      res.status(500).send(renderErrorPage("Internal error."));
+    });
+  });
+
+  app.post("/auth/signin-password", (req, res) => {
+    handleSignInPassword(req, res).catch((err) => {
+      console.error("[auth] /auth/signin-password unhandled:", err);
+      res.status(500).json({ error: "internal_error" });
+    });
+  });
+
+  // Note: /api/account/password (set + clear) is registered by
+  // account-routes.js, not here — those endpoints REQUIRE an existing
+  // session, so they live outside the /auth/* public-path namespace
+  // (which is allowed through the tenant-auth middleware unauthenticated).
+
+  app.post("/auth/signout", (req, res) => {
+    handleSignout(req, res).catch((err) => {
+      console.error("[auth] /auth/signout unhandled:", err);
+      res.status(500).json({ error: "internal_error" });
+    });
+  });
+
+  // Convenience GET version for plain link clicks ("Sign out") from
+  // the UI without needing a form POST.
+  app.get("/auth/signout", (req, res) => {
+    handleSignout(req, res).catch((err) => {
+      console.error("[auth] /auth/signout unhandled:", err);
+      res.status(500).send(renderErrorPage("Internal error."));
+    });
+  });
+}
diff --git a/server/billing-routes.js b/server/billing-routes.js
new file mode 100644
index 0000000..12c58c0
--- /dev/null
+++ b/server/billing-routes.js
@@ -0,0 +1,252 @@
+// Self-serve subscription purchase (multi-mode / cloud only).
+//
+// Lets a signed-in cloud user buy their OWN prepaid Pro/Max period
+// instead of waiting for the operator to grant it by hand. The relay
+// owns the subscription (keyed by Recaps user-id, per the core-
+// decoupling); Recaps just brokers the purchase:
+//
+//   POST /api/billing/buy     → ask the relay to mint a BTCPay invoice
+//                               for {tier}; return the checkout URL the
+//                               frontend opens. On settlement the relay's
+//                               webhook extends the user's tier.
+//   GET  /api/billing/status  → pull the user's current (expiry-enforced)
+//                               tier from the relay and refresh the local
+//                               users.tier cache so the badge flips the
+//                               moment payment lands. The frontend polls
+//                               this after opening checkout.
+//
+// Auth: both routes require a real signed-in user (req.user.id). Anon /
+// trial visitors (req.userId = "anon:<cookie>") are refused — a tier is
+// keyed to a durable user-id, which a trial cookie isn't.
+//
+// These live under /api/billing (NOT /api/subscriptions — that prefix is
+// the channel-subscriptions feature, which is itself Pro-gated; a free
+// user must be able to reach the buy flow). The prefix is added to the
+// license middleware's open list so the activation gate lets Core users
+// through to purchase.
+
+import { getDb } from "./db.js";
+import { requireUser } from "./tenant-auth.js";
+import {
+  createRelayTierInvoice,
+  createRelayZapriteOrder,
+  getRelayUserTier,
+  getRelayTierPlans,
+} from "./providers/relay.js";
+
+const BUYABLE_TIERS = new Set(["pro", "max"]);
+const PAYMENT_METHODS = new Set(["bitcoin", "card"]);
+
+// Fallback prices (sats / 30-day period) used only when the relay is
+// unreachable while rendering the picker — matches the relay config
+// defaults so the UI never shows a blank price. The actual charge is
+// always computed relay-side at invoice time.
+const FALLBACK_PLANS = {
+  period_days: 30,
+  plans: [
+    { tier: "pro", sats: 21000 },
+    { tier: "max", sats: 42000 },
+  ],
+};
+
+// Pull the user's effective (expiry-enforced) tier from the relay — the
+// authoritative subscription owner — and update the cached users.tier if
+// it drifted. Returns { tier, expires_at, synced } or { synced:false }
+// when the relay is unreachable / unconfigured (caller falls back to the
+// cached value rather than erroring the request).
+export async function syncUserTierFromRelay(userId) {
+  if (!userId) return { synced: false };
+  let report;
+  try {
+    report = await getRelayUserTier({ userId });
+  } catch (err) {
+    console.warn(
+      `[billing] relay tier read failed for ${userId}: ${err?.message || err}`,
+    );
+    return { synced: false };
+  }
+  // getRelayUserTier swallows errors and returns null when the relay
+  // base URL / operator key isn't configured. Treat that as "can't
+  // sync" rather than "downgrade to core".
+  if (!report || typeof report.tier !== "string") {
+    return { synced: false };
+  }
+  const tier = report.tier; // already expiry-enforced by the relay
+  const expiresAt = report.subscription_expires_at || null;
+  try {
+    const db = getDb();
+    const row = db.prepare("SELECT tier FROM users WHERE id = ?").get(userId);
+    if (row && row.tier !== tier) {
+      db.prepare("UPDATE users SET tier = ? WHERE id = ?").run(tier, userId);
+      console.log(
+        `[billing] synced ${userId} tier ${row.tier || "core"} → ${tier} from relay`,
+      );
+    }
+  } catch (err) {
+    console.warn(
+      `[billing] tier cache update failed for ${userId}: ${err?.message || err}`,
+    );
+  }
+  return {
+    tier,
+    expires_at: expiresAt,
+    tier_snapshot: report.tier_snapshot || tier,
+    subscription_expired: !!report.subscription_expired,
+    synced: true,
+  };
+}
+
+// Build the buyer-facing origin so the BTCPay checkout can redirect back
+// to the app after settlement. Honors the reverse-proxy forwarding
+// headers StartOS sets in front of the service.
+function originFor(req) {
+  const proto =
+    (req.headers["x-forwarded-proto"] || "").split(",")[0].trim() ||
+    req.protocol ||
+    "https";
+  const host = req.headers["x-forwarded-host"] || req.headers.host || "";
+  return host ? `${proto}://${host}` : "";
+}
+
+export function setupBillingRoutes(app) {
+  // GET /api/billing/plans → { period_days, plans: [{tier, sats}] }
+  // Powers the purchase picker. Prices come from the relay (the pricing
+  // source of truth); falls back to the config defaults if the relay is
+  // briefly unreachable so the modal still renders.
+  app.get("/api/billing/plans", requireUser, async (req, res) => {
+    if (!req.user || !req.user.id) {
+      return res.status(403).json({ error: "must_be_signed_in" });
+    }
+    try {
+      const data = await getRelayTierPlans();
+      if (data && Array.isArray(data.plans) && data.plans.length) {
+        return res.json({
+          period_days: data.period_days || FALLBACK_PLANS.period_days,
+          plans: data.plans,
+          // Whether the card (Zaprite) rail is configured — the UI hides
+          // the "Pay by card" link when false so it never offers a rail
+          // that 503s. Bitcoin is always available (the BTCPay rail).
+          card_available: !!data.card_available,
+          source: "relay",
+        });
+      }
+    } catch (err) {
+      console.warn(`[billing] plans read failed: ${err?.message || err}`);
+    }
+    return res.json({ ...FALLBACK_PLANS, card_available: false, source: "fallback" });
+  });
+
+  // POST /api/billing/buy  body: { tier: "pro" | "max", method?: "bitcoin" | "card" }
+  // Bitcoin (default) → BTCPay invoice; card → Zaprite hosted checkout.
+  // Returns { ok, method, checkout_url, tier, period_days, ... }.
+  app.post("/api/billing/buy", requireUser, async (req, res) => {
+    // Must be a real signed-in user — a tier is keyed to a durable
+    // user-id, not an anon trial cookie.
+    if (!req.user || !req.user.id) {
+      return res.status(403).json({
+        error: "must_be_signed_in",
+        message: "Sign in to buy a subscription.",
+      });
+    }
+    const tier = String(req.body?.tier || "").trim().toLowerCase();
+    if (!BUYABLE_TIERS.has(tier)) {
+      return res.status(400).json({
+        error: "bad_tier",
+        message: 'tier must be "pro" or "max"',
+      });
+    }
+    const method = String(req.body?.method || "bitcoin").trim().toLowerCase();
+    if (!PAYMENT_METHODS.has(method)) {
+      return res.status(400).json({
+        error: "bad_method",
+        message: 'method must be "bitcoin" or "card"',
+      });
+    }
+    const origin = originFor(req);
+    // Land back on the app with a marker the frontend uses to kick an
+    // immediate status sync (the modal also polls, so this is a courtesy
+    // for buyers who follow the checkout redirect).
+    const returnUrl = origin ? `${origin}/?billing=success` : null;
+    try {
+      if (method === "card") {
+        const order = await createRelayZapriteOrder({
+          userId: req.user.id,
+          tier,
+          returnUrl,
+        });
+        return res.json({
+          ok: true,
+          method: "card",
+          checkout_url: order.checkout_url || null,
+          order_id: order.order_id || null,
+          amount: order.amount ?? null,
+          currency: order.currency || null,
+          tier: order.tier || tier,
+          period_days: order.period_days ?? null,
+        });
+      }
+      // Bitcoin (default) — BTCPay invoice.
+      const invoice = await createRelayTierInvoice({
+        userId: req.user.id,
+        tier,
+        returnUrl,
+      });
+      res.json({
+        ok: true,
+        method: "bitcoin",
+        checkout_url: invoice.checkout_url || null,
+        invoice_id: invoice.invoice_id || null,
+        sats: invoice.sats ?? null,
+        tier: invoice.tier || tier,
+        period_days: invoice.period_days ?? null,
+        // Lightning BOLT11 for the inline QR (no redirect). Null → the app
+        // falls back to opening the hosted checkout_url.
+        bolt11: invoice.bolt11 || null,
+        lightning_payment_link: invoice.lightning_payment_link || null,
+        lightning_expires_at: invoice.lightning_expires_at || null,
+      });
+    } catch (err) {
+      const status = err?.status || 502;
+      console.error(
+        `[billing] buy failed for ${req.user.id} (${tier}/${method}): ${err?.message || err}`,
+      );
+      // 503 from the relay = that rail isn't configured; surface a hint.
+      const notConfigured =
+        status === 503 || /not[_ ]configured/i.test(err?.message || "");
+      const rail = method === "card" ? "Card" : "Bitcoin";
+      const tool = method === "card" ? "Zaprite" : "BTCPay";
+      res.status(notConfigured ? 503 : 502).json({
+        error: notConfigured ? "payments_unavailable" : "checkout_failed",
+        message: notConfigured
+          ? `${rail} payments aren't set up on this server yet. Ask the operator to configure ${tool}.`
+          : "Couldn't start the payment. Please try again in a moment.",
+      });
+    }
+  });
+
+  // GET /api/billing/status
+  // Returns { tier, expires_at, synced } — the user's current relay-owned
+  // tier, with the local cache refreshed as a side effect.
+  app.get("/api/billing/status", requireUser, async (req, res) => {
+    if (!req.user || !req.user.id) {
+      return res.status(403).json({ error: "must_be_signed_in" });
+    }
+    const synced = await syncUserTierFromRelay(req.user.id);
+    if (synced.synced) {
+      return res.json({
+        tier: synced.tier,
+        expires_at: synced.expires_at,
+        tier_snapshot: synced.tier_snapshot,
+        subscription_expired: synced.subscription_expired,
+        synced: true,
+      });
+    }
+    // Relay unreachable / unconfigured — fall back to the cached tier so
+    // the UI still renders a sane badge instead of erroring.
+    return res.json({
+      tier: req.user.tier || "core",
+      expires_at: null,
+      synced: false,
+    });
+  });
+}
diff --git a/server/chunked-analyze.js b/server/chunked-analyze.js
new file mode 100644
index 0000000..301b9b1
--- /dev/null
+++ b/server/chunked-analyze.js
@@ -0,0 +1,487 @@
+// Chunked topic-analysis: split a long transcript into overlapping
+// time-windowed slices, analyze each slice in parallel, stitch the
+// returned sections back into one coherent list.
+//
+// Why: a single-shot analyze call against a 2-hour transcript spends
+// most of its wall-time on prefill (typically 25K+ tokens). Splitting
+// into 18-min slices gives the model a much smaller prompt per call,
+// and firing the slices concurrently lets the backend (relay/vLLM or
+// Gemini) batch them. End-to-end wall-time drops from minutes to
+// tens of seconds for long content, with no quality regression as
+// long as the slice boundaries are chosen with overlap and the
+// stitcher trusts the second slice for the overlap region.
+//
+// Public entry point: runChunkedAnalysis().
+
+import { buildAnalysisPrompt } from "./gemini-helpers.js";
+
+// ── Tunables ────────────────────────────────────────────────────────────────
+// Window body: the part of a chunk that "owns" its topic boundaries.
+// Overlap: a tail appended to each window so a topic spanning a
+// boundary still gets seen in full by at least one window.
+// Stride = body. Windows advance by `body` seconds; each window
+// covers `body + overlap` seconds of audio.
+const WINDOW_BODY_SECONDS = 18 * 60;     // 18 min
+const WINDOW_OVERLAP_SECONDS = 2 * 60;   // 2 min
+// Don't chunk below this duration. A single analyze call against
+// <25 min is fast on its own and avoids the stitching complexity
+// for the common short-content case.
+// Exported so the orchestrator can mirror the decision when picking
+// whether to coalesce: above this duration the chunker handles
+// granularity per-window, so the pre-chunk coalesce is unnecessary
+// and would hurt section-boundary precision.
+export const CHUNKING_CUTOFF_SECONDS = 25 * 60; // 25 min
+// Max concurrent analyze calls in flight. Gemini paid Tier 1 allows
+// ~1000 RPM for flash and ~150 RPM for pro — 12 in-flight is well
+// under either ceiling and saturates most operator workloads
+// without queueing. Operator hardware (vLLM on a single Spark) caps
+// out around 8-12 concurrent for our prompt size, so 12 is a
+// reasonable cross-backend default.
+const DEFAULT_CONCURRENCY = 12;
+
+// ── Window planning ─────────────────────────────────────────────────────────
+// Plans a set of overlapping windows over the entries array. Each
+// window has:
+//   - startIdx, endIdx:  inclusive bounds into the entries array
+//   - bodyStartIdx:      index where this window's "body" begins
+//                        (i.e., everything before this index is the
+//                        overlap with the previous window's tail)
+// The first window has bodyStartIdx === startIdx. Windows after the
+// first have bodyStartIdx > startIdx by ~overlap seconds.
+//
+// The stitcher uses bodyStartIdx of window N+1 to decide whether a
+// section from window N falls in the contested overlap region.
+export function planAnalysisWindows(entries, opts = {}) {
+  const bodySec = opts.bodySeconds ?? WINDOW_BODY_SECONDS;
+  const overlapSec = opts.overlapSeconds ?? WINDOW_OVERLAP_SECONDS;
+  const totalSec = (entries[entries.length - 1].offset || 0) +
+                   (entries[entries.length - 1].duration || 0);
+  const cutoffSec = opts.cutoffSeconds ?? CHUNKING_CUTOFF_SECONDS;
+  if (totalSec <= cutoffSec) {
+    return [{ startIdx: 0, endIdx: entries.length - 1, bodyStartIdx: 0 }];
+  }
+
+  const windows = [];
+  let bodyStartSec = 0;
+  while (bodyStartSec < totalSec) {
+    // The window's covered span (body + tail overlap):
+    const windowEndSec = bodyStartSec + bodySec + overlapSec;
+    // Body start in entry-index space: first entry with offset >= bodyStartSec.
+    const bodyStartIdx = firstEntryAtOrAfter(entries, bodyStartSec);
+    // If there are NO entries at or after bodyStartSec, we've consumed
+    // all entries. Stop the loop.
+    if (bodyStartIdx >= entries.length) break;
+    // GAP HANDLING: if the next entry after bodyStartSec is far in
+    // the future (past this window's body + overlap), there's a gap
+    // in the transcript timeline. This commonly happens when the
+    // transcribe step truncated a middle chunk — the timeline has
+    // valid entries at, e.g., 0-31 min and 90-94 min but nothing in
+    // between. Without this fix, the old loop would BREAK at the gap
+    // (because endIdx < bodyStartIdx triggered the "sparse trailing
+    // window" exit), silently dropping the entries past the gap from
+    // analysis entirely. Now we jump bodyStartSec forward to the
+    // next entry's offset (rounded down to a body-stride boundary
+    // so subsequent window alignment stays sensible) and continue.
+    const nextEntryOffset = entries[bodyStartIdx].offset || 0;
+    if (nextEntryOffset >= windowEndSec) {
+      bodyStartSec = Math.max(
+        bodyStartSec + bodySec,
+        Math.floor(nextEntryOffset / bodySec) * bodySec
+      );
+      continue;
+    }
+    // Window's entry range: from the start of overlap-with-prior
+    // (i.e., bodyStartSec - overlapSec, clamped at 0) through windowEndSec.
+    const overlapWithPriorSec = Math.max(0, bodyStartSec - overlapSec);
+    const startIdx = firstEntryAtOrAfter(entries, overlapWithPriorSec);
+    const endIdx = lastEntryBefore(entries, windowEndSec);
+    if (endIdx < bodyStartIdx) {
+      // Defensive: shouldn't happen with the gap-handling above, but
+      // if it does, advance the body cursor rather than break so we
+      // don't get stuck.
+      bodyStartSec += bodySec;
+      continue;
+    }
+    windows.push({ startIdx, endIdx, bodyStartIdx });
+    // Stop if this window already covers the last entry.
+    if (endIdx >= entries.length - 1) break;
+    bodyStartSec += bodySec;
+  }
+  return windows;
+}
+
+function firstEntryAtOrAfter(entries, sec) {
+  // Linear scan; entries are sorted by offset.
+  for (let i = 0; i < entries.length; i++) {
+    if ((entries[i].offset || 0) >= sec) return i;
+  }
+  return entries.length;
+}
+
+function lastEntryBefore(entries, sec) {
+  // Largest i s.t. entries[i].offset < sec.
+  let ans = -1;
+  for (let i = 0; i < entries.length; i++) {
+    if ((entries[i].offset || 0) < sec) ans = i;
+    else break;
+  }
+  // If no entry has offset < sec, return -1 → caller treats as empty.
+  // If the whole array fits, return entries.length - 1.
+  return ans === -1 ? -1 : ans;
+}
+
+// ── Parallel analyzer ───────────────────────────────────────────────────────
+// Fires N analyze calls concurrently with a bounded in-flight count.
+// Each call gets its own slice of entries plus a freshly-built prompt.
+// Returns array of { window, ok, sections | error, cost, model }.
+//
+// Errors are isolated per window — a single-window failure doesn't
+// fail the whole batch. The stitcher gets to decide what to do
+// about gaps.
+async function analyzeWindowsInParallel({
+  entries,
+  windows,
+  analyzer,
+  fallbackModels,
+  concurrency,
+  onProgress,
+  onWindowComplete,
+  signal,
+  jobId,
+  // Total audio duration in seconds — passed through to
+  // buildAnalysisPrompt so the section-count target scales with the
+  // full video length (not just per-window). Recap-relay does the
+  // same; matching here keeps segmentation density consistent
+  // across both pipelines. When omitted, buildAnalysisPrompt falls
+  // back to deriving from the entries themselves.
+  totalAudioSec = 0,
+}) {
+  const results = new Array(windows.length);
+  let next = 0;
+  let completed = 0;
+
+  async function worker() {
+    while (true) {
+      if (signal?.aborted) return;
+      const my = next++;
+      if (my >= windows.length) return;
+      const w = windows[my];
+      const windowEntries = entries.slice(w.startIdx, w.endIdx + 1);
+      const prompt = buildAnalysisPrompt(windowEntries, { totalAudioSec });
+      // Try the configured model first, then walk fallbacks.
+      let lastErr = null;
+      let result = null;
+      let usedModel = null;
+      for (const tryModel of fallbackModels) {
+        try {
+          result = await analyzer.analyzeText({
+            prompt,
+            model: tryModel,
+            onProgress: () => {}, // suppress per-chunk progress noise
+            signal,
+            jobId,
+          });
+          usedModel = tryModel;
+          break;
+        } catch (err) {
+          if (signal?.aborted) return;
+          lastErr = err;
+        }
+      }
+      if (!result) {
+        results[my] = { window: w, ok: false, error: lastErr };
+        completed++;
+        onProgress?.(`Window ${my + 1}/${windows.length} failed: ${lastErr?.message?.slice(0, 100) || "unknown"}`);
+        continue;
+      }
+      const parsed = safeParseSections(result.text);
+      if (!parsed) {
+        results[my] = { window: w, ok: false, error: new Error("invalid JSON") };
+        completed++;
+        onProgress?.(`Window ${my + 1}/${windows.length} returned invalid JSON`);
+        continue;
+      }
+      results[my] = {
+        window: w,
+        ok: true,
+        sections: parsed.sections,
+        model: usedModel,
+        cost: result.cost,
+      };
+      completed++;
+      onProgress?.(`Window ${my + 1}/${windows.length} done (${parsed.sections.length} topics)`);
+
+      // Fire the streaming callback with this window's BODY-OWNED
+      // sections — the ones the final stitcher will keep from this
+      // window. Computed deterministically per-window so the UI can
+      // render incrementally as windows arrive (even out of order),
+      // without later having to "undo" any displayed sections.
+      //
+      // Rule: window N owns sections whose globalStart falls before
+      // window(N+1).bodyStartIdx. Sections starting at or after the
+      // next window's body are deferred — window N+1 will produce an
+      // authoritative version of them with more downstream context.
+      if (onWindowComplete) {
+        const nextBody = my + 1 < windows.length
+          ? windows[my + 1].bodyStartIdx
+          : Infinity;
+        const offset = w.startIdx;
+        const owned = [];
+        for (const s of parsed.sections) {
+          const globalStart = offset + (s.startIndex ?? 0);
+          const globalEnd = offset + (s.endIndex ?? 0);
+          if (globalStart >= nextBody) continue;
+          owned.push({
+            startIndex: globalStart,
+            endIndex: globalEnd,
+            title: s.title,
+            summary: s.summary,
+          });
+        }
+        try {
+          await onWindowComplete({
+            windowIdx: my,
+            totalWindows: windows.length,
+            ownedSections: owned,
+          });
+        } catch (cbErr) {
+          // Callback errors must not derail the analyze loop —
+          // streaming is best-effort and the canonical result still
+          // ships at the end.
+          console.warn(
+            `[chunked-analyze] onWindowComplete callback failed: ${cbErr?.message || cbErr}`
+          );
+        }
+      }
+    }
+  }
+
+  const workers = Array.from({ length: Math.min(concurrency, windows.length) }, worker);
+  await Promise.all(workers);
+  return results;
+}
+
+function safeParseSections(text) {
+  if (!text) return null;
+  let jsonStr = text.trim();
+  const cb = jsonStr.match(/```(?:json)?\s*([\s\S]*?)```/);
+  if (cb) jsonStr = cb[1].trim();
+  try {
+    const parsed = JSON.parse(jsonStr);
+    if (!parsed || !Array.isArray(parsed.sections)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+// ── Stitcher ────────────────────────────────────────────────────────────────
+// Merges per-window section lists into a single ordered list of
+// non-overlapping sections referencing entries by their position in
+// the FULL (un-chunked) entries array.
+//
+// The rule: each window N owns sections whose globalStart falls in
+// its body (i.e., globalStart < window(N+1).bodyStartIdx). Any
+// section starting at or after the next window's body boundary is
+// dropped because the next window will have produced a better
+// version of that same section with more downstream context. The
+// last window has no successor, so all its sections are kept.
+//
+// After collection, sections are sorted and any residual overlap
+// (which shouldn't happen if windows are well-formed but might
+// arise from model index errors) is repaired by clamping endIndex
+// to the next section's startIndex - 1.
+export function stitchAnalysisResults(results) {
+  const out = [];
+  for (let i = 0; i < results.length; i++) {
+    const r = results[i];
+    if (!r || !r.ok) continue;
+    const next = results[i + 1];
+    const nextBody = next && next.window
+      ? next.window.bodyStartIdx
+      : Infinity;
+    const offset = r.window.startIdx;
+    for (const s of r.sections) {
+      const globalStart = offset + (s.startIndex ?? 0);
+      const globalEnd = offset + (s.endIndex ?? 0);
+      // Drop sections that begin in the next window's body — the
+      // next window's analysis is authoritative for that range.
+      if (globalStart >= nextBody) continue;
+      out.push({
+        startIndex: globalStart,
+        endIndex: globalEnd,
+        title: s.title,
+        summary: s.summary,
+      });
+    }
+  }
+  // Order + repair overlaps (defensive — shouldn't trigger with
+  // well-behaved model output, but the existing single-shot path
+  // doesn't either and this matches its robustness).
+  out.sort((a, b) => a.startIndex - b.startIndex);
+  for (let i = 0; i < out.length - 1; i++) {
+    if (out[i].endIndex >= out[i + 1].startIndex) {
+      out[i].endIndex = out[i + 1].startIndex - 1;
+    }
+  }
+  return out.filter((s) => s.endIndex >= s.startIndex);
+}
+
+// ── Public entry point ──────────────────────────────────────────────────────
+// Runs chunked analysis end-to-end. Returns the same envelope shape
+// callers expect from a single-shot analyzer.analyzeText() call:
+//   {
+//     text: "<JSON string with .sections>",  // for prompt/result parity
+//     model: "<which model served the most windows>",
+//     cost: { total cost across all windows, summed },
+//     usage: null,                            // no aggregate usage
+//     attempts: { windows: N, failed: K }     // diagnostic
+//   }
+// The caller parses .text the same way it parses a single-shot
+// response — no changes to the downstream chunk-building code.
+//
+// Falls back to single-shot if planning produces just one window
+// (i.e., content is below the chunking cutoff). If all windows fail,
+// throws so the caller's existing fallback (try next model) kicks in.
+export async function runChunkedAnalysis({
+  entries,
+  analyzer,
+  fallbackModels,
+  concurrency = DEFAULT_CONCURRENCY,
+  onProgress = () => {},
+  onWindowComplete = null,
+  signal,
+  jobId,
+}) {
+  const windows = planAnalysisWindows(entries);
+  if (windows.length === 1) {
+    // Single-shot path — same as the legacy code does, but routed
+    // through here so callers have one entry point. Log message
+    // distinguishes the two reasons we end up here:
+    //   (a) totalSec ≤ cutoff — short content, intentionally not chunked
+    //   (b) entries are too sparse for multi-window planning — the loop
+    //       broke after one window. Surfaces an awkward state that's
+    //       usually a sign of bad upstream data (e.g. transcribe emitted
+    //       bogus far-future timestamps that the sanity-cap dropped).
+    const lastEntry = entries[entries.length - 1];
+    const totalSec = (lastEntry?.offset || 0) + (lastEntry?.duration || 0);
+    if (totalSec <= CHUNKING_CUTOFF_SECONDS) {
+      onProgress(
+        `Content ≤${Math.round(CHUNKING_CUTOFF_SECONDS / 60)} min — running single-shot analysis`
+      );
+    } else {
+      onProgress(
+        `Single window planned over ${entries.length} entries (last @ ${Math.round(totalSec / 60)} min) — running single-shot analysis`
+      );
+    }
+    return await runSingleShot({
+      entries,
+      analyzer,
+      fallbackModels,
+      onProgress,
+      signal,
+      jobId,
+    });
+  }
+  onProgress(
+    `Chunked analysis: ${windows.length} windows of ~18 min each, up to ${concurrency} in parallel`
+  );
+  // Compute total audio duration from the last entry's offset so the
+  // section-count target (in buildAnalysisPrompt) scales with the
+  // FULL video length, not just per-window. Matches recap-relay's
+  // per-video-duration target methodology for consistent segmentation
+  // density across both pipelines.
+  const totalAudioSec = entries.length > 0
+    ? (entries[entries.length - 1].offset || 0) + (entries[entries.length - 1].duration || 0)
+    : 0;
+  const results = await analyzeWindowsInParallel({
+    entries,
+    windows,
+    analyzer,
+    fallbackModels,
+    concurrency,
+    onProgress,
+    onWindowComplete,
+    signal,
+    jobId,
+    totalAudioSec,
+  });
+  // If the caller aborted mid-flight, some result slots may be empty.
+  // Surface cancellation cleanly to the outer pipeline.
+  if (signal?.aborted) {
+    const e = new Error("aborted");
+    e.name = "AbortError";
+    throw e;
+  }
+  const completed = results.filter(Boolean);
+  const failures = completed.filter((r) => !r.ok);
+  if (completed.length === 0 || failures.length === completed.length) {
+    throw new Error(
+      `All ${results.length} analyze windows failed. First error: ${
+        failures[0]?.error?.message || "unknown"
+      }`
+    );
+  }
+  const stitched = stitchAnalysisResults(results);
+  // Aggregate model attribution: pick the most-used successful model.
+  const modelTally = new Map();
+  let totalCost = 0;
+  for (const r of results) {
+    if (!r.ok) continue;
+    modelTally.set(r.model, (modelTally.get(r.model) || 0) + 1);
+    const c = typeof r.cost?.totalCost === "string"
+      ? parseFloat(r.cost.totalCost)
+      : r.cost?.totalCost || 0;
+    if (Number.isFinite(c)) totalCost += c;
+  }
+  const dominantModel = [...modelTally.entries()].sort((a, b) => b[1] - a[1])[0]?.[0] || null;
+  onProgress(
+    `Chunked analysis complete — ${results.length - failures.length}/${results.length} windows succeeded, ${stitched.length} topics`
+  );
+  return {
+    text: JSON.stringify({ sections: stitched }),
+    model: dominantModel,
+    cost: {
+      totalCost: totalCost.toFixed(6),
+      totalCostDisplay: totalCost < 0.01
+        ? `$${(totalCost * 100).toFixed(3)}¢`
+        : `$${totalCost.toFixed(4)}`,
+    },
+    usage: null,
+    attempts: { windows: results.length, failed: failures.length },
+  };
+}
+
+async function runSingleShot({
+  entries,
+  analyzer,
+  fallbackModels,
+  onProgress,
+  signal,
+  jobId,
+}) {
+  // Single-shot path: the whole transcript IS the "window". Compute
+  // totalAudioSec from the entries so the section-count target picker
+  // chooses the right bucket (<30 min → 6 sections, 30-60 → 8, etc.).
+  const totalAudioSec = entries.length > 0
+    ? (entries[entries.length - 1].offset || 0) + (entries[entries.length - 1].duration || 0)
+    : 0;
+  const prompt = buildAnalysisPrompt(entries, { totalAudioSec });
+  let lastErr = null;
+  for (const tryModel of fallbackModels) {
+    try {
+      const result = await analyzer.analyzeText({
+        prompt,
+        model: tryModel,
+        onProgress,
+        signal,
+        jobId,
+      });
+      return result;
+    } catch (err) {
+      if (signal?.aborted) throw err;
+      lastErr = err;
+    }
+  }
+  throw lastErr || new Error("All analysis models failed");
+}
diff --git a/server/config.js b/server/config.js
index 9e87f17..0185fc7 100644
--- a/server/config.js
+++ b/server/config.js
@@ -25,6 +25,14 @@ let startosConfigPath = null;
 
 export let serverApiKey = "";
 
+// Core-decoupling shared "operator key" — read live from the StartOS
+// config sidecar the same way serverApiKey is, so the operator can set it
+// via the "Set Relay Operator Key" action without a service restart.
+// `RECAP_RELAY_OPERATOR_KEY` env pins the value (local dev). Consumed by
+// relay-default.js's getRelayOperatorKey(); see that for the semantics.
+let envRelayOperatorKey = "";
+export let relayOperatorKey = "";
+
 // ── Init ────────────────────────────────────────────────────────────────────
 // Call once at boot. Sets up paths, reads the initial value, kicks off the
 // poll loop. Idempotent if you really want to call it twice (the interval
@@ -35,13 +43,17 @@ export async function initConfig({ dataDir }) {
   startosConfigPath = path.join(configDir, "startos-config.json");
   envApiKey = process.env.GEMINI_API_KEY || "";
   serverApiKey = envApiKey;
+  envRelayOperatorKey = (process.env.RECAP_RELAY_OPERATOR_KEY || "").trim();
+  relayOperatorKey = envRelayOperatorKey;
 
   await fs.mkdir(configDir, { recursive: true }).catch(() => {});
   await refreshServerApiKey("startup");
+  await refreshRelayOperatorKey("startup");
 
   const pollMs = parseInt(process.env.RECAP_CONFIG_POLL_MS || "3000", 10);
   setInterval(() => {
     refreshServerApiKey("config poll").catch(() => {});
+    refreshRelayOperatorKey("config poll").catch(() => {});
   }, pollMs);
 }
 
@@ -75,6 +87,27 @@ async function refreshServerApiKey(reason) {
   }
 }
 
+async function readRelayOperatorKeyFromConfig() {
+  try {
+    const content = await fs.readFile(startosConfigPath, "utf-8");
+    const config = JSON.parse(content);
+    return (config.recap_relay_operator_key || "").trim();
+  } catch {
+    return "";
+  }
+}
+
+async function refreshRelayOperatorKey(reason) {
+  if (envRelayOperatorKey) return; // env var pins the value
+  const next = await readRelayOperatorKeyFromConfig();
+  if (next !== relayOperatorKey) {
+    relayOperatorKey = next;
+    console.log(
+      `[config] relay operator key ${next ? "loaded" : "cleared"} (${reason})`,
+    );
+  }
+}
+
 // ── Public helpers ──────────────────────────────────────────────────────────
 // Resolves the per-request key — either the client's own (BYO) or the
 // server's stored key (when the client signals USE_SERVER_KEY or sends
@@ -132,4 +165,7 @@ export async function mergeConfig(patch) {
   if (Object.prototype.hasOwnProperty.call(patch, "gemini_api_key")) {
     await refreshServerApiKey("merge config");
   }
+  if (Object.prototype.hasOwnProperty.call(patch, "recap_relay_operator_key")) {
+    await refreshRelayOperatorKey("merge config");
+  }
 }
diff --git a/server/credits-purchase.js b/server/credits-purchase.js
new file mode 100644
index 0000000..a8232a6
--- /dev/null
+++ b/server/credits-purchase.js
@@ -0,0 +1,671 @@
+// Recap-side proxy to the relay's credit-purchase endpoints.
+//
+// Architecture is identical to license-purchase.js: Recap doesn't
+// hold the BTCPay credentials, the relay does. Recap just forwards
+// the buyer's pick to the relay and proxies the polling. The relay
+// returns the BTCPay checkout URL which the Recap UI displays in a
+// modal styled to match the license-purchase modal.
+//
+// Endpoints:
+//   GET  /api/credits/packages          → relay GET /relay/credits/packages
+//   POST /api/credits/buy               → relay POST /relay/credits/buy
+//   GET  /api/credits/invoice/:id       → relay GET /relay/credits/invoice/:id
+//
+// Auth headers (X-Recap-Install-Id + Authorization Bearer LIC1-...)
+// are added by this proxy, not by the buyer-side JS — keeping the
+// install identity + license key out of any client-side code.
+
+import { getRelayBaseURL } from "./relay-default.js";
+import { getInstallId } from "./install-id.js";
+import { getRawLicenseKey } from "./license.js";
+
+// Multi-mode toggle. In multi mode every credit purchase is recorded
+// in pending_purchases so we know WHO (signed-in user vs. anon trial
+// cookie) to credit locally when the invoice settles. Single mode is
+// the legacy "operator-pool only" flow — no local accounting layer,
+// the relay's credits.json IS the source of truth.
+const RECAP_MODE = process.env.RECAP_MODE === "multi" ? "multi" : "single";
+
+function relayHeaders({ json = false, req = null } = {}) {
+  const h = {};
+  // Identity routing for the credit-purchase + credit-poll flow:
+  //
+  //   Pro/Max signed-in tenant (req.user.keysat_license set)
+  //     → use THEIR install ID + license. The buy invoice gets
+  //       stashed with THEIR license_fingerprint so the BTCPay
+  //       settle-webhook credits THEIR license-keyed pool — the
+  //       same pool /api/relay/status reads when displaying their
+  //       balance. Without this, credits land on the operator's
+  //       pool and the buyer sees their balance unchanged after
+  //       paying (the bug Grant hit on 2026-05-18).
+  //
+  //   Anon visitor (trial cookie only) / free signed-in tenant
+  //   (no license) / single-mode operator
+  //     → fall back to operator identity. The operator's pool is
+  //       what's being topped up; Recaps' own accounting layer
+  //       (anon_trials / tenant_credits) handles the per-user
+  //       attribution locally via pending_purchases.
+  let installId = null;
+  let licenseKey = null;
+  if (req?.user?.keysat_license && req.user.synthetic_install_id) {
+    installId = req.user.synthetic_install_id;
+    licenseKey = req.user.keysat_license;
+  }
+  if (!installId) {
+    try {
+      const id = getInstallId();
+      if (id) installId = id;
+    } catch {}
+  }
+  if (!licenseKey) {
+    try {
+      const key = getRawLicenseKey();
+      if (key) licenseKey = key;
+    } catch {}
+  }
+  if (installId) h["X-Recap-Install-Id"] = installId;
+  if (licenseKey) h["Authorization"] = `Bearer ${licenseKey}`;
+  if (json) h["Content-Type"] = "application/json";
+  return h;
+}
+
+export function setupCreditsPurchaseRoutes(app) {
+  // List bundles the operator has configured. Cheap, no auth gating —
+  // the buyer needs the price menu before they decide whether to pay.
+  app.get("/api/credits/packages", async (_req, res) => {
+    const base = getRelayBaseURL();
+    if (!base) {
+      return res.status(503).json({
+        error: "relay_not_configured",
+        message: "Relay base URL not set on this Recaps install.",
+      });
+    }
+    try {
+      // 10s timeout — was 5s, but a cold relay request from mobile
+      // cellular can take 6-8s, and Safari iOS surfaces the abort as
+      // a generic "Load failed" with no other info, so the buyer
+      // sees an error and has to manually retry. 10s is still snappy
+      // enough that a legit failure doesn't hang the UI for long.
+      const r = await fetch(`${base.replace(/\/$/, "")}/relay/credits/packages`, {
+        signal: AbortSignal.timeout(10000),
+      });
+      const text = await r.text();
+      let body = null;
+      try {
+        body = text ? JSON.parse(text) : null;
+      } catch {}
+      if (!r.ok) {
+        return res.status(r.status).json(body || { error: "relay_packages_failed" });
+      }
+      res.json(body || { packages: [] });
+    } catch (err) {
+      console.error(`[credits/packages] failed: ${err?.message || err}`);
+      res.status(502).json({
+        error: "packages_fetch_failed",
+        message: (err?.message || String(err)).slice(0, 300),
+      });
+    }
+  });
+
+  // Initiate a purchase. Body: { credits: 1|5|10|20 }. Returns the
+  // raw relay envelope (so the UI sees credits_remaining + tier +
+  // result.checkout_url + result.invoice_id).
+  //
+  // Multi-mode: identifies the buyer (signed-in user or anon trial
+  // cookie), records a pending_purchases row keyed by the invoice_id
+  // the relay returns. The settle-handler (in /api/credits/invoice/:id
+  // below) uses that row to know WHERE to apply the credits locally.
+  //
+  // Single-mode: skips the pending_purchases bookkeeping entirely;
+  // the operator IS the buyer and the relay's credits.json directly
+  // tracks their pool.
+  app.post("/api/credits/buy", async (req, res) => {
+    const base = getRelayBaseURL();
+    if (!base) {
+      return res
+        .status(503)
+        .json({ error: "relay_not_configured" });
+    }
+    const credits = Number(req.body?.credits);
+    const returnUrl =
+      typeof req.body?.return_url === "string" && req.body.return_url.startsWith("http")
+        ? req.body.return_url
+        : null;
+    if (!Number.isFinite(credits) || credits <= 0) {
+      return res
+        .status(400)
+        .json({ error: "credits_required" });
+    }
+
+    // Identify the buyer for multi-mode. Either a signed-in user OR
+    // an anon trial cookie. If neither, attempt to auto-mint a trial
+    // cookie — anon visitors who click "Buy more" from the toolbar
+    // (before they've spent their pre-trial allowance) shouldn't be
+    // dead-ended into a sign-in nag. Same auto-mint pattern as
+    // /api/process for pre-trial visitors. Only refuse if trials are
+    // disabled or the IP is over its lifetime cap.
+    let buyerType = null;
+    let buyerId = null;
+    if (RECAP_MODE === "multi") {
+      if (req.user && req.user.id) {
+        buyerType = "user";
+        buyerId = req.user.id;
+      } else if (req.trial && req.trial.cookie_id) {
+        buyerType = "anon";
+        buyerId = req.trial.cookie_id;
+      } else {
+        // Try to mint a fresh trial cookie so the purchase has
+        // somewhere to land. forceMint=true bypasses the lifetime
+        // IP cap and the trials-disabled config — a paying buyer is
+        // by definition not abusing a free quota, and without a
+        // tracking cookie the settle handler has nowhere to credit
+        // the purchase locally (the relay still credits the operator
+        // pool; we just lose the visibility to apply it to this
+        // specific buyer).
+        try {
+          const { issueIfEligible } = await import("./anon-trial.js");
+          const trial = await issueIfEligible({ req, res, forceMint: true });
+          if (trial) {
+            buyerType = "anon";
+            buyerId = trial.cookie_id;
+            // Stash on req for downstream code paths
+            req.trial = trial;
+          }
+        } catch (err) {
+          console.warn(
+            "[credits/buy] anon-trial mint failed:",
+            err?.message || err,
+          );
+        }
+        if (!buyerId) {
+          return res.status(401).json({
+            error: "buyer_unknown",
+            message:
+              "Couldn't create a buyer record for this purchase. Sign up for a free account so we have somewhere to credit it.",
+          });
+        }
+      }
+    }
+
+    try {
+      const r = await fetch(`${base.replace(/\/$/, "")}/relay/credits/buy`, {
+        method: "POST",
+        headers: relayHeaders({ json: true, req }),
+        body: JSON.stringify({ credits, return_url: returnUrl || undefined }),
+        signal: AbortSignal.timeout(15_000),
+      });
+      const text = await r.text();
+      let body = null;
+      try {
+        body = text ? JSON.parse(text) : null;
+      } catch {}
+      if (!r.ok) {
+        return res
+          .status(r.status)
+          .json(body || { error: "relay_buy_failed" });
+      }
+
+      // Record the pending purchase BEFORE we respond, so even if the
+      // browser refreshes / crashes between buy + settle, the next
+      // poll for this invoice id will still know who to credit.
+      // Invoice id lives under result.invoice_id per the relay's
+      // envelope contract (same shape license-purchase uses).
+      const invoiceId =
+        body?.result?.invoice_id ||
+        body?.invoice_id ||
+        body?.btcpay_invoice_id ||
+        null;
+      if (RECAP_MODE === "multi") {
+        if (!invoiceId) {
+          // Loud warning — without an invoice id we can't reconcile
+          // on settle. Surface the response shape so we can see what
+          // the relay actually returned and fix the field-name
+          // assumption if this fires.
+          console.warn(
+            `[credits/buy] NO invoice_id in relay response — skipping pending_purchases. Top-level keys: ${Object.keys(body || {}).join(", ")} | result keys: ${Object.keys(body?.result || {}).join(", ")}`,
+          );
+        } else if (!buyerType || !buyerId) {
+          console.warn(
+            `[credits/buy] invoice ${invoiceId}: buyer identity missing — won't auto-apply on settle.`,
+          );
+        } else {
+          try {
+            const { getDb } = await import("./db.js");
+            const result = getDb()
+              .prepare(
+                `INSERT OR IGNORE INTO pending_purchases
+                   (invoice_id, buyer_type, buyer_id, credits, created_at)
+                 VALUES (?, ?, ?, ?, ?)`,
+              )
+              .run(invoiceId, buyerType, buyerId, credits, Date.now());
+            console.log(
+              `[credits/buy] tracked pending purchase invoice=${invoiceId} buyer=${buyerType}:${buyerId} credits=${credits} rowsInserted=${result.changes}`,
+            );
+          } catch (err) {
+            console.error(
+              `[credits/buy] failed to record pending purchase ${invoiceId}: ${err?.message || err}`,
+            );
+          }
+        }
+      }
+
+      res.json(body || {});
+    } catch (err) {
+      console.error(`[credits/buy] failed: ${err?.message || err}`);
+      res.status(502).json({
+        error: "purchase_failed",
+        message: (err?.message || String(err)).slice(0, 300),
+      });
+    }
+  });
+
+  // Poll an invoice's status. Returns the relay envelope; the UI
+  // reads `result.status` ("new" | "processing" | "settled" |
+  // "expired" | "invalid") and refreshes when settled.
+  //
+  // Multi-mode side effect: when the relay reports settled, we look
+  // up the matching pending_purchases row and apply the credits to
+  // the right local balance. Idempotent via applied_at — if the same
+  // invoice is polled multiple times after settle, only the first
+  // application takes effect.
+  app.get("/api/credits/invoice/:id", async (req, res) => {
+    const base = getRelayBaseURL();
+    if (!base) {
+      return res.status(503).json({ error: "relay_not_configured" });
+    }
+    const id = (req.params.id || "").trim();
+    if (!id) {
+      return res.status(400).json({ error: "missing_invoice_id" });
+    }
+    try {
+      const r = await fetch(
+        `${base.replace(/\/$/, "")}/relay/credits/invoice/${encodeURIComponent(id)}`,
+        {
+          headers: relayHeaders({ req }),
+          signal: AbortSignal.timeout(10_000),
+        }
+      );
+      const text = await r.text();
+      let body = null;
+      try {
+        body = text ? JSON.parse(text) : null;
+      } catch {}
+      if (!r.ok) {
+        return res
+          .status(r.status)
+          .json(body || { error: "relay_poll_failed" });
+      }
+
+      // Multi-mode: settle-and-apply. Status path mirrors the
+      // license-purchase poll-settle handler.
+      const status =
+        body?.result?.status || body?.status || null;
+      if (RECAP_MODE === "multi" && status === "settled") {
+        try {
+          await applyPendingPurchase(id);
+        } catch (err) {
+          console.error(
+            `[credits/invoice] apply failed for ${id}: ${err?.message || err}`,
+          );
+          // Don't fail the response — the relay reported settled and
+          // the operator pool has the credits. Local apply can be
+          // retried by hitting this endpoint again, or by a future
+          // reconciliation tool.
+        }
+      }
+
+      res.json(body || {});
+    } catch (err) {
+      console.error(`[credits/invoice] failed: ${err?.message || err}`);
+      res.status(502).json({
+        error: "poll_failed",
+        message: (err?.message || String(err)).slice(0, 300),
+      });
+    }
+  });
+
+  // POST /api/credits/claim { invoice_id }
+  // Manual self-service recovery: a signed-in user pastes the BTCPay
+  // invoice ID of a purchase they made anonymously (e.g., Safari
+  // Private mode where the trial cookie didn't survive the magic-
+  // link click). We verify the invoice is settled at the relay AND
+  // the pending_purchases row is anon-buyer + unapplied, then credit
+  // their account.
+  //
+  // Safety:
+  //   - Requires authenticated user (req.user.id must be set)
+  //   - Only claims buyer_type='anon' rows (no user-to-user takeover)
+  //   - applied_at idempotency guard prevents double-credit
+  //   - BTCPay invoice IDs are 30+ char random — not enumerable
+  //   - User-buyer rows are never claimable here, regardless of
+  //     ownership — those are the cookie sweep's job
+  app.post("/api/credits/claim", async (req, res) => {
+    if (RECAP_MODE !== "multi") {
+      return res.status(404).json({ error: "not_available" });
+    }
+    if (!req.user || !req.user.id) {
+      return res.status(401).json({
+        error: "auth_required",
+        message: "Sign in first to claim a purchase to your account.",
+      });
+    }
+    const invoiceId = String(req.body?.invoice_id || "").trim();
+    if (!invoiceId) {
+      return res.status(400).json({
+        error: "missing_invoice_id",
+        message: "Paste the invoice ID from your purchase email.",
+      });
+    }
+
+    const { getDb } = await import("./db.js");
+    const db = getDb();
+    const row = db
+      .prepare(
+        `SELECT invoice_id, buyer_type, buyer_id, credits, applied_at
+         FROM pending_purchases WHERE invoice_id = ?`,
+      )
+      .get(invoiceId);
+
+    if (!row) {
+      return res.status(404).json({
+        error: "invoice_not_found",
+        message:
+          "We don't have a record of that invoice ID. Double-check it — the ID is shown in your BTCPay payment confirmation.",
+      });
+    }
+    if (row.buyer_type !== "anon") {
+      // user-buyer rows are claimable only by their original buyer
+      // (cookie sweep) — refusing this avoids user-to-user takeover.
+      return res.status(403).json({
+        error: "not_anon_purchase",
+        message:
+          "This invoice was bought from a signed-in account and can only be claimed by that account.",
+      });
+    }
+    if (row.applied_at) {
+      return res.status(409).json({
+        error: "already_applied",
+        message:
+          "Those credits were already applied. Check your balance — they may have transferred automatically.",
+      });
+    }
+
+    // Verify settled at the relay before crediting. We do NOT trust
+    // the local row alone — the buyer could have initiated the
+    // invoice and never paid; without this check, anyone could
+    // claim N credits just by knowing an invoice ID.
+    const base = getRelayBaseURL();
+    if (!base) {
+      return res.status(503).json({ error: "relay_not_configured" });
+    }
+    let status = null;
+    try {
+      const r = await fetch(
+        `${base.replace(/\/$/, "")}/relay/credits/invoice/${encodeURIComponent(invoiceId)}`,
+        { headers: relayHeaders({ req }), signal: AbortSignal.timeout(10_000) },
+      );
+      if (r.ok) {
+        const body = await r.json().catch(() => ({}));
+        status = body?.result?.status || body?.status || null;
+      }
+    } catch (err) {
+      console.warn(
+        `[credits/claim] relay status check failed for ${invoiceId}: ${err?.message || err}`,
+      );
+      return res.status(502).json({
+        error: "relay_unreachable",
+        message:
+          "Couldn't verify the invoice with the payment server. Try again in a minute.",
+      });
+    }
+    if (status !== "settled") {
+      return res.status(409).json({
+        error: "not_settled",
+        message: `That invoice is not settled (status: ${status || "unknown"}). If you just paid, wait a minute and try again.`,
+      });
+    }
+
+    try {
+      await applyPendingPurchase(invoiceId, { forceUserId: req.user.id });
+    } catch (err) {
+      console.error(
+        `[credits/claim] apply failed for ${invoiceId}: ${err?.message || err}`,
+      );
+      return res.status(500).json({
+        error: "apply_failed",
+        message: "Something went wrong applying the credits. Try again.",
+      });
+    }
+    console.log(
+      `[credits/claim] user ${req.user.id} claimed invoice ${invoiceId} (${row.credits} credits)`,
+    );
+    res.json({ ok: true, credits: row.credits });
+  });
+}
+
+// applyPendingPurchase(invoiceId, opts?) — credit the buyer's local
+// balance for a settled invoice. Idempotent: bails if the row is
+// already marked applied. If the buyer was an anon trial that has
+// since been converted to a real user, credits route to the user
+// instead.
+//
+// opts.forceUserId (optional) — route credits to this user instead
+// of the row's recorded buyer. Used by the manual-claim endpoint:
+// when a signed-in user pastes a BTCPay invoice ID for an anon
+// purchase whose trial cookie was lost (e.g., Safari Private mode
+// where the magic-link click landed in a different cookie jar), we
+// trust the invoice ID as proof-of-ownership and direct the credits
+// to their tenant_credits.
+//
+// Exported so the sweep helper below — and any future server-side
+// flow that wants to reconcile a known-settled invoice — can call it
+// without going through the /api/credits/invoice/:id route.
+export async function applyPendingPurchase(invoiceId, opts = {}) {
+  const { getDb } = await import("./db.js");
+  const db = getDb();
+  const row = db
+    .prepare(
+      `SELECT invoice_id, buyer_type, buyer_id, credits, applied_at
+       FROM pending_purchases WHERE invoice_id = ?`,
+    )
+    .get(invoiceId);
+  if (!row) {
+    // Either the buy came from a different Recap instance, or the
+    // bookkeeping insert in /api/credits/buy failed earlier. Nothing
+    // to do; the operator pool still has the credits from BTCPay.
+    // Log so operator can reconcile manually if this fires.
+    console.warn(
+      `[credits/invoice] settled invoice ${invoiceId} has NO matching pending_purchases row — local balance NOT auto-applied. The credits ARE in the operator pool at the relay; operator should grant manually to the buyer.`,
+    );
+    return;
+  }
+  if (row.applied_at) {
+    return; // already applied, idempotent no-op
+  }
+
+  // Resolve buyer → target user_id (for tenant_credits) or trial
+  // cookie_id (for anon_trials.credits_total). Anon-buyers who have
+  // since converted to a real user get their credits routed to the
+  // user's tenant_credits — that's the cleaner outcome and matches
+  // the "credits transfer on signup" semantics the design promises.
+  let targetUserId = null;
+  let targetCookieId = null;
+  if (opts.forceUserId) {
+    targetUserId = opts.forceUserId;
+  } else if (row.buyer_type === "user") {
+    targetUserId = row.buyer_id;
+  } else if (row.buyer_type === "anon") {
+    const trial = db
+      .prepare(
+        "SELECT cookie_id, converted_to_user_id FROM anon_trials WHERE cookie_id = ?",
+      )
+      .get(row.buyer_id);
+    if (trial?.converted_to_user_id) {
+      targetUserId = trial.converted_to_user_id;
+    } else {
+      targetCookieId = row.buyer_id;
+    }
+  }
+
+  // Apply + mark applied in one transaction so a crash mid-way
+  // doesn't leave a half-credited buyer. Purchased credits land in
+  // the PERMANENT bucket (purchased_balance) so they're not wiped on
+  // the next replenishment refresh.
+  const tx = db.transaction(() => {
+    if (targetUserId) {
+      const existing = db
+        .prepare("SELECT user_id FROM tenant_credits WHERE user_id = ?")
+        .get(targetUserId);
+      if (existing) {
+        db.prepare(
+          `UPDATE tenant_credits
+           SET purchased_balance = purchased_balance + ?,
+               lifetime_granted = lifetime_granted + ?
+           WHERE user_id = ?`,
+        ).run(row.credits, row.credits, targetUserId);
+      } else {
+        db.prepare(
+          `INSERT INTO tenant_credits
+             (user_id, purchased_balance, replenish_balance, last_replenish_at,
+              lifetime_granted, lifetime_consumed)
+           VALUES (?, ?, 0, ?, ?, 0)`,
+        ).run(targetUserId, row.credits, Date.now(), row.credits);
+      }
+    } else if (targetCookieId) {
+      // Anon trial: credits go into the trial's credits_total (single
+      // bucket — anons don't have the purchased/replenish split).
+      // They'll move to purchased_balance on signup via linkToUser.
+      db.prepare(
+        `UPDATE anon_trials
+         SET credits_total = credits_total + ?
+         WHERE cookie_id = ?`,
+      ).run(row.credits, targetCookieId);
+    }
+    db.prepare(
+      "UPDATE pending_purchases SET applied_at = ? WHERE invoice_id = ?",
+    ).run(Date.now(), invoiceId);
+  });
+  tx();
+  console.log(
+    `[credits/invoice] applied ${row.credits} credits for ${row.buyer_type}:${row.buyer_id} → ${
+      targetUserId ? "user " + targetUserId : "anon " + targetCookieId
+    }`,
+  );
+}
+
+// sweepUnappliedPurchases({ buyerType, buyerId, cookieIds }) — catch
+// up on settled-but-unapplied purchases for a buyer.
+//
+// Why this exists: the buy → BTCPay → settle → apply pipeline depends
+// on the buyer's browser tab polling /api/credits/invoice/:id after
+// BTCPay redirects back. But BTCPay redirects in the SAME tab (the
+// poll loop dies before it gets a chance to see "settled"), and even
+// when the redirect lands back on Recap the buyer might close it
+// before the next poll tick. Result: the relay knows the invoice is
+// settled and the operator pool has the credits, but the LOCAL
+// pending_purchases row never flips to applied — so the buyer's
+// balance stays stale until they manually re-poll, which they have no
+// way to do.
+//
+// Fix: opportunistically sweep on every /api/account/whoami and
+// /api/relay/status. Cheap (small bounded query + a few relay HTTP
+// calls), idempotent (applyPendingPurchase no-ops on already-applied
+// rows), and self-healing.
+//
+// Also called from anon-trial.js linkToUser BEFORE the transfer, so
+// any anon-bought credits that hadn't yet been applied locally are
+// rolled into anon_trials.credits_total before we copy them over to
+// the new user's tenant_credits.
+//
+// Scope: only sweeps the buyer's OWN pending rows. cookieIds is an
+// optional list of additional anon cookie_ids the caller wants
+// swept on this buyer's behalf (used by /whoami for the new-signup
+// case where the just-converted cookie may still have unapplied
+// purchases). Cap at 5 invoices per sweep + 30-minute lookback so a
+// degenerate case can't fan out into hundreds of relay calls per
+// request.
+export async function sweepUnappliedPurchases({
+  buyerType,
+  buyerId,
+  cookieIds = [],
+  req = null,
+} = {}) {
+  if (RECAP_MODE !== "multi") return;
+  if (!buyerType && (!cookieIds || cookieIds.length === 0)) return;
+  const base = getRelayBaseURL();
+  if (!base) return; // no relay configured, nothing to sweep against
+
+  const { getDb } = await import("./db.js");
+  const db = getDb();
+
+  // 30-minute lookback. Older unapplied purchases probably failed for
+  // a reason we don't want to keep retrying every page-load (relay
+  // unreachable, invoice expired, etc.). Operator can reconcile
+  // manually if they fire.
+  const since = Date.now() - 30 * 60 * 1000;
+
+  // Build the WHERE clause. Always include the primary buyer; OR in
+  // any extra cookieIds the caller passed.
+  const conditions = [];
+  const params = [];
+  if (buyerType && buyerId) {
+    conditions.push("(buyer_type = ? AND buyer_id = ?)");
+    params.push(buyerType, buyerId);
+  }
+  for (const cid of cookieIds) {
+    if (typeof cid === "string" && cid) {
+      conditions.push("(buyer_type = 'anon' AND buyer_id = ?)");
+      params.push(cid);
+    }
+  }
+  if (conditions.length === 0) return;
+  params.push(since);
+
+  let rows = [];
+  try {
+    rows = db
+      .prepare(
+        `SELECT invoice_id FROM pending_purchases
+         WHERE (${conditions.join(" OR ")})
+           AND applied_at IS NULL
+           AND created_at >= ?
+         ORDER BY created_at DESC
+         LIMIT 5`,
+      )
+      .all(...params);
+  } catch (err) {
+    console.warn(
+      `[credits/sweep] query failed: ${err?.message || err}`,
+    );
+    return;
+  }
+  if (rows.length === 0) return;
+
+  for (const { invoice_id: invoiceId } of rows) {
+    try {
+      const r = await fetch(
+        `${base.replace(/\/$/, "")}/relay/credits/invoice/${encodeURIComponent(invoiceId)}`,
+        {
+          headers: relayHeaders({ req }),
+          signal: AbortSignal.timeout(5_000),
+        },
+      );
+      if (!r.ok) continue;
+      const text = await r.text();
+      let body = null;
+      try {
+        body = text ? JSON.parse(text) : null;
+      } catch {}
+      const status = body?.result?.status || body?.status || null;
+      if (status === "settled") {
+        await applyPendingPurchase(invoiceId);
+      }
+    } catch (err) {
+      // Best-effort; swallow per-invoice errors so one bad invoice
+      // doesn't block the others (or the page-load).
+      console.warn(
+        `[credits/sweep] invoice ${invoiceId} check failed: ${err?.message || err}`,
+      );
+    }
+  }
+}
diff --git a/server/db.js b/server/db.js
new file mode 100644
index 0000000..9a09835
--- /dev/null
+++ b/server/db.js
@@ -0,0 +1,400 @@
+// Multi-tenant SQLite store — single source of truth for users,
+// sessions, magic-link tokens, subscriptions, tenant credits, and
+// the library_meta index over /data/history/<userId>/*.json files.
+//
+// Created only when RECAP_MODE === 'multi'. In single mode this module
+// is never imported — `getDb()` would crash trying to require
+// better-sqlite3 anyway, but the auth-middleware short-circuits before
+// reaching it. Keep all SQLite access funneled through `getDb()` so
+// single-mode boots don't touch the native binding at all.
+//
+// Forward-only schema. No migration framework — every release is one
+// `db.exec(SCHEMA_SQL)` at boot. New columns get `ALTER TABLE …`
+// statements appended below the original CREATEs and guarded with an
+// existence check; new tables just go in fresh. Rollback is
+// "checkpoint your /data dir before upgrading."
+
+import path from "path";
+
+let dbInstance = null;
+
+const SCHEMA_SQL = `
+-- ── users ──────────────────────────────────────────────────────────────
+-- One row per authenticated end-user. The operator-owner is also a row
+-- here (is_admin = 1) so per-user library scoping works uniformly.
+CREATE TABLE IF NOT EXISTS users (
+  id                    TEXT PRIMARY KEY,
+  email                 TEXT NOT NULL UNIQUE,
+  password_hash         TEXT,
+  created_at            INTEGER NOT NULL,
+  last_signin_at        INTEGER,
+  synthetic_install_id  TEXT NOT NULL UNIQUE,
+  keysat_license        TEXT,
+  display_name          TEXT,
+  is_admin              INTEGER NOT NULL DEFAULT 0,
+  -- Core-decoupling: the user's subscription tier ("core" | "pro" | "max").
+  -- The Recap Relay is the source of truth (keyed by user-id); this is the
+  -- Recaps-side cache used for feature gating, kept in sync by the operator
+  -- grant flow (which writes here AND POSTs the relay's /relay/user-tier).
+  tier                  TEXT NOT NULL DEFAULT 'core',
+  -- Captured at first signup for forensic / abuse-investigation use.
+  -- NOT used for auth decisions — just data for the operator to grep
+  -- when an abuse pattern shows up in the admin dashboard.
+  signup_ip             TEXT,
+  signup_user_agent     TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_users_email     ON users(email);
+CREATE INDEX IF NOT EXISTS idx_users_signup_ip ON users(signup_ip);
+
+-- ── sessions ───────────────────────────────────────────────────────────
+-- Server-side session store so we can revoke individual sessions from
+-- the dashboard. Cookies carry only the random session id.
+CREATE TABLE IF NOT EXISTS sessions (
+  id            TEXT PRIMARY KEY,
+  user_id       TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  created_at    INTEGER NOT NULL,
+  expires_at    INTEGER NOT NULL,
+  last_used_at  INTEGER,
+  user_agent    TEXT,
+  ip_address    TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id);
+CREATE INDEX IF NOT EXISTS idx_sessions_expires ON sessions(expires_at);
+
+-- ── magic_link_tokens ──────────────────────────────────────────────────
+-- Plaintext token only ever exists in the outbound email and the
+-- inbound verify URL — what we persist is the SHA-256 hash. Tokens are
+-- single-use (used_at NOT NULL = spent) and short-lived (15 min).
+CREATE TABLE IF NOT EXISTS magic_link_tokens (
+  token_hash  TEXT PRIMARY KEY,
+  email       TEXT NOT NULL,
+  created_at  INTEGER NOT NULL,
+  expires_at  INTEGER NOT NULL,
+  used_at     INTEGER,
+  intent      TEXT NOT NULL,
+  -- Request context for abuse investigation. Captured at /auth/request-link
+  -- time, never used for auth decisions — just for the recent-signups admin
+  -- view to surface scripted abuse patterns.
+  request_ip  TEXT,
+  request_ua  TEXT,
+  -- Anon trial cookie that was present at /auth/request-link time.
+  -- Stored server-side (NOT in the magic-link URL itself — that would
+  -- leak it to anyone who saw the email) so that at /auth/verify we
+  -- can link the trial → user even when the magic-link click lands
+  -- in a different browser / cookie jar than the one that initiated
+  -- the request (Safari Private mode + email-app in-app browser is
+  -- the canonical case). Server-side binding means the cookie ID
+  -- can't be spoofed: an attacker who intercepts the magic link
+  -- still can't change which trial gets linked.
+  trial_cookie_id TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_magic_email ON magic_link_tokens(email);
+CREATE INDEX IF NOT EXISTS idx_magic_ip    ON magic_link_tokens(request_ip, created_at);
+
+-- ── subscriptions ──────────────────────────────────────────────────────
+-- One row per paid period. Multiple rows accumulate as a user renews.
+-- We don't try to model "the active subscription" — joins to MAX(started_at)
+-- with status='active' do the job and stay honest about history.
+CREATE TABLE IF NOT EXISTS subscriptions (
+  id                TEXT PRIMARY KEY,
+  user_id           TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  tier              TEXT NOT NULL,
+  started_at        INTEGER NOT NULL,
+  expires_at        INTEGER NOT NULL,
+  cancelled_at      INTEGER,
+  btcpay_invoice_id TEXT,
+  amount_sats       INTEGER,
+  status            TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_subs_user ON subscriptions(user_id);
+
+-- ── tenant_credits ─────────────────────────────────────────────────────
+-- Per-tenant local credit ledger. Cloud users with their OWN keysat
+-- license bill the relay directly (via the license-keyed pool); this
+-- table is the source of truth for everyone else — signed-in users on
+-- the free / cloud-default tier, and family-share tenants on a self-
+-- hosted multi-tenant Recap.
+--
+-- Two buckets per user:
+--   purchased_balance  — a la carte purchases + admin grants + carry-over
+--                        from anon trial conversions. PERMANENT — never
+--                        wiped or refilled.
+--   replenish_balance  — initial signup allowance + periodic refills.
+--                        REFILLED to tenant_default_credits on each
+--                        anniversary period boundary (period set via
+--                        the tenant_credit_replenish_period config).
+--                        Leftover replenish credits at the end of a
+--                        period are FORFEIT (use-it-or-lose-it).
+--
+-- Spend order: debit replenish_balance first (it'll refresh anyway),
+-- then purchased_balance only when the refillable bucket is empty.
+-- last_replenish_at: epoch-ms of the most recent refill, used to compute
+-- the next anniversary boundary.
+CREATE TABLE IF NOT EXISTS tenant_credits (
+  user_id            TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+  purchased_balance  INTEGER NOT NULL DEFAULT 0,
+  replenish_balance  INTEGER NOT NULL DEFAULT 0,
+  last_replenish_at  INTEGER,
+  lifetime_granted   INTEGER NOT NULL DEFAULT 0,
+  lifetime_consumed  INTEGER NOT NULL DEFAULT 0
+);
+
+-- ── anon_trials ────────────────────────────────────────────────────────
+-- Cookie-gated "taste before sign-up" trial. The first time an
+-- unauthenticated visitor hits /api/process, we issue a recap_anon_trial
+-- cookie (32-byte random), insert a row here with N credits (set by
+-- the trial_credits_per_visitor operator config), and let them
+-- summarize without signing up. After credits_used >= credits_total,
+-- the UI nudges them to sign up for more.
+--
+-- Trial requests forward the OPERATOR's install_id + license to the
+-- relay, so the operator's credit pool is what actually pays for the
+-- Gemini call. tenant_credits.balance is irrelevant for trials —
+-- the credits_total field on this row is the only gate.
+--
+-- ip_address rate-limits trial-cookie issuance: trials_per_ip_per_day
+-- caps how many fresh trial cookies one IP can mint in 24h. Doesn't
+-- stop sophisticated abuse (IP rotation), but raises the floor for
+-- scripted laptop attacks and gives the operator a column to grep on.
+--
+-- converted_to_user_id is set when the trial holder signs up — links
+-- the trial summary into their library and lets the operator measure
+-- the trial → signup conversion rate.
+CREATE TABLE IF NOT EXISTS anon_trials (
+  cookie_id             TEXT PRIMARY KEY,
+  ip_address            TEXT,
+  user_agent            TEXT,
+  created_at            INTEGER NOT NULL,
+  credits_total         INTEGER NOT NULL,
+  credits_used          INTEGER NOT NULL DEFAULT 0,
+  last_used_at          INTEGER,
+  converted_to_user_id  TEXT REFERENCES users(id) ON DELETE SET NULL
+);
+CREATE INDEX IF NOT EXISTS idx_anon_trials_ip      ON anon_trials(ip_address, created_at);
+CREATE INDEX IF NOT EXISTS idx_anon_trials_created ON anon_trials(created_at);
+
+-- ── pending_purchases ──────────────────────────────────────────────────
+-- Tracks every credit-purchase invoice initiated through Recap so that
+-- when the invoice settles (via BTCPay webhook → relay → poll round-
+-- trip back to us) we know WHO to credit locally.
+--
+-- The BTCPay invoice on the relay side credits the OPERATOR's pool —
+-- the operator paid for the underlying Gemini/etc capacity at the
+-- relay. Recap's local accounting layer (tenant_credits for signed-in
+-- users, anon_trials.credits_total for trial cookies) is what gates
+-- the actual buyer's spend, so we mark this row applied once the
+-- relevant local balance is incremented. applied_at being non-null is
+-- the idempotency guard — a poll firing twice doesn't double-credit.
+--
+-- buyer_type values:
+--   "user"  → buyer_id is users.id; credits land in tenant_credits
+--   "anon"  → buyer_id is anon_trials.cookie_id; credits land in
+--             anon_trials.credits_total. If the cookie has since been
+--             converted to a user (anon_trials.converted_to_user_id),
+--             credits route to that user's tenant_credits instead.
+CREATE TABLE IF NOT EXISTS pending_purchases (
+  invoice_id   TEXT PRIMARY KEY,
+  buyer_type   TEXT NOT NULL,
+  buyer_id     TEXT NOT NULL,
+  credits      INTEGER NOT NULL,
+  created_at   INTEGER NOT NULL,
+  applied_at   INTEGER
+);
+CREATE INDEX IF NOT EXISTS idx_pending_purchases_buyer ON pending_purchases(buyer_type, buyer_id);
+CREATE INDEX IF NOT EXISTS idx_pending_purchases_unapplied ON pending_purchases(applied_at) WHERE applied_at IS NULL;
+
+-- ── pending_signups ────────────────────────────────────────────────────
+-- Buyer-creates-account flow: when an anon visitor picks Pro / Max
+-- from the tier signup modal, they enter an email and pay BTCPay
+-- BEFORE any user account exists. We record the (invoice_id, email,
+-- policy_slug) here so the poll-settle handler can create the user +
+-- attach the issued license + send a magic-link email once payment
+-- lands. applied_at is the idempotency guard — multiple polls after
+-- settle don't double-create the user.
+--
+-- Distinct from pending_purchases (credit-pack buys) because the
+-- settle effects are completely different: pending_signups creates
+-- a USER and sends an email; pending_purchases just credits an
+-- existing buyer's local balance.
+CREATE TABLE IF NOT EXISTS pending_signups (
+  invoice_id   TEXT PRIMARY KEY,
+  email        TEXT NOT NULL,
+  policy_slug  TEXT NOT NULL,
+  created_at   INTEGER NOT NULL,
+  applied_at   INTEGER
+);
+CREATE INDEX IF NOT EXISTS idx_pending_signups_email ON pending_signups(email);
+CREATE INDEX IF NOT EXISTS idx_pending_signups_unapplied ON pending_signups(applied_at) WHERE applied_at IS NULL;
+
+-- ── subscription_reminders ─────────────────────────────────────────────
+-- Dedup ledger for the self-serve expiry-reminder emails. The relay owns
+-- the subscription expiry; a daily Recaps scan asks it who's expiring and
+-- emails them. This table guarantees each (user, period, kind) email goes
+-- out at most once. period_expires_at is the ISO expiry instant the
+-- reminder is for — when the user renews, expiry changes, so a fresh set
+-- of reminders re-arms for the new period without re-sending old ones.
+-- kind is one of 'upcoming_7d', 'upcoming_1d', or 'lapsed'.
+CREATE TABLE IF NOT EXISTS subscription_reminders (
+  user_id           TEXT NOT NULL,
+  period_expires_at TEXT NOT NULL,
+  kind              TEXT NOT NULL,
+  sent_at           INTEGER NOT NULL,
+  PRIMARY KEY (user_id, period_expires_at, kind)
+);
+
+-- ── library_meta ───────────────────────────────────────────────────────
+-- Index over /data/history/<userId>/<sessionId>.json. The summary
+-- content stays on disk; this table is just for fast listing without
+-- scanning the filesystem.
+CREATE TABLE IF NOT EXISTS library_meta (
+  session_id     TEXT PRIMARY KEY,
+  user_id        TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  video_id       TEXT,
+  url            TEXT,
+  title          TEXT,
+  type           TEXT,
+  topic_count    INTEGER,
+  segment_count  INTEGER,
+  created_at     INTEGER NOT NULL,
+  upload_date    TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_library_user ON library_meta(user_id, created_at DESC);
+`;
+
+// initDb({ dataDir })
+// Idempotent. Opens /data/recap.db, applies the schema, returns the
+// connection. Safe to call multiple times — repeat calls return the
+// existing handle.
+export async function initDb({ dataDir }) {
+  if (dbInstance) return dbInstance;
+
+  // Lazy import so single-mode never loads the native binding.
+  const { default: Database } = await import("better-sqlite3");
+
+  const dbPath = path.join(dataDir, "recap.db");
+  const db = new Database(dbPath);
+
+  // WAL mode for the obvious reasons: concurrent reads while a write
+  // is in flight, and durable enough for our small write volume
+  // (signups, sessions, library inserts). `synchronous = NORMAL` is
+  // the standard pairing — fsync on checkpoint, not every commit.
+  db.pragma("journal_mode = WAL");
+  db.pragma("synchronous = NORMAL");
+  db.pragma("foreign_keys = ON");
+
+  db.exec(SCHEMA_SQL);
+
+  // ── In-place schema migrations ──────────────────────────────────────
+  // SCHEMA_SQL above is the FRESH-INSTALL schema. Existing installs
+  // may have an older shape (e.g. tenant_credits with the legacy
+  // `balance` column). We bring them up to current by introspecting
+  // PRAGMA table_info and ALTER-ing only where needed. Each migration
+  // is idempotent — running boot multiple times is safe.
+  migrateTenantCreditsSchema(db);
+  migrateMagicLinkTokensTrialCookie(db);
+  migrateUsersTier(db);
+
+  dbInstance = db;
+  console.log(`[db] opened ${dbPath} (multi-tenant store)`);
+  return db;
+}
+
+// Core-decoupling — add users.tier to existing DBs (fresh installs get it
+// from SCHEMA_SQL). Idempotent: ALTERs only when the column is missing.
+function migrateUsersTier(db) {
+  let cols;
+  try {
+    cols = db.prepare("PRAGMA table_info(users)").all();
+  } catch {
+    return;
+  }
+  if (!cols.some((c) => c.name === "tier")) {
+    db.exec("ALTER TABLE users ADD COLUMN tier TEXT NOT NULL DEFAULT 'core'");
+    console.log("[db] added users.tier column (core-decoupling)");
+  }
+}
+
+// v0.2.92 — split the single tenant_credits.balance into two buckets
+// (purchased + replenish) so we can refill the latter periodically
+// without wiping the former.
+function migrateTenantCreditsSchema(db) {
+  let cols;
+  try {
+    cols = db.prepare("PRAGMA table_info(tenant_credits)").all();
+  } catch {
+    return; // table doesn't exist yet (shouldn't happen post-SCHEMA_SQL)
+  }
+  const colNames = new Set(cols.map((c) => c.name));
+
+  // 1. Rename legacy `balance` → `purchased_balance`. Existing balances
+  //    were a mix of signup-grant + admin-grant + purchase; treating
+  //    them all as "purchased" (permanent) is the safe interpretation
+  //    — we'd rather over-preserve than wipe credits on upgrade.
+  if (colNames.has("balance") && !colNames.has("purchased_balance")) {
+    db.exec(
+      "ALTER TABLE tenant_credits RENAME COLUMN balance TO purchased_balance",
+    );
+    console.log(
+      "[db] migrated tenant_credits.balance → tenant_credits.purchased_balance",
+    );
+    colNames.delete("balance");
+    colNames.add("purchased_balance");
+  }
+
+  if (!colNames.has("replenish_balance")) {
+    db.exec(
+      "ALTER TABLE tenant_credits ADD COLUMN replenish_balance INTEGER NOT NULL DEFAULT 0",
+    );
+    console.log("[db] added tenant_credits.replenish_balance");
+  }
+  if (!colNames.has("last_replenish_at")) {
+    db.exec(
+      "ALTER TABLE tenant_credits ADD COLUMN last_replenish_at INTEGER",
+    );
+    console.log("[db] added tenant_credits.last_replenish_at");
+  }
+}
+
+// v0.2.104 — add trial_cookie_id to magic_link_tokens so cross-cookie-
+// jar magic-link clicks (Safari Private → Gmail webview, etc.) still
+// link the anon trial to the new user at /auth/verify time. Existing
+// installs get the column added in-place; pre-existing rows just keep
+// trial_cookie_id = NULL (no linking via the new path, falls back to
+// the legacy req.cookies path).
+function migrateMagicLinkTokensTrialCookie(db) {
+  let cols;
+  try {
+    cols = db.prepare("PRAGMA table_info(magic_link_tokens)").all();
+  } catch {
+    return;
+  }
+  const colNames = new Set(cols.map((c) => c.name));
+  if (!colNames.has("trial_cookie_id")) {
+    db.exec(
+      "ALTER TABLE magic_link_tokens ADD COLUMN trial_cookie_id TEXT",
+    );
+    console.log("[db] added magic_link_tokens.trial_cookie_id");
+  }
+}
+
+
+// Returns the open handle. Throws if initDb hasn't run — that's a
+// programming error (some single-mode caller reached a multi-mode
+// codepath). Callers in multi-mode should assume the handle exists.
+export function getDb() {
+  if (!dbInstance) {
+    throw new Error(
+      "[db] getDb() called before initDb(); check RECAP_MODE wiring",
+    );
+  }
+  return dbInstance;
+}
+
+// Test/teardown helper. Closes the connection so the next initDb()
+// call reopens fresh. Not used in production.
+export function closeDb() {
+  if (dbInstance) {
+    dbInstance.close();
+    dbInstance = null;
+  }
+}
diff --git a/server/email-template.js b/server/email-template.js
new file mode 100644
index 0000000..8abf586
--- /dev/null
+++ b/server/email-template.js
@@ -0,0 +1,181 @@
+// Magic-link email body builder. Returns { subject, text, html } for
+// nodemailer. Keeps the HTML and text in sync — both carry the same
+// verifyUrl and the same expiry copy.
+//
+// Style is deliberately minimal: one paragraph, one button, no images,
+// no fancy CSS. Spam filters like simple emails; users skim them and
+// click the link. Anything fancier risks the email landing in spam,
+// which is fatal to a magic-link auth flow.
+
+// renderMagicLinkEmail({ verifyUrl, brandName, expiresInMinutes })
+// → { subject, text, html }
+export function renderMagicLinkEmail({
+  verifyUrl,
+  brandName = "Recaps",
+  expiresInMinutes = 15,
+}) {
+  const subject = `Sign in to ${brandName}`;
+
+  const text = [
+    `Sign in to ${brandName} by opening this link:`,
+    "",
+    verifyUrl,
+    "",
+    `This link expires in ${expiresInMinutes} minutes and can only be used once.`,
+    "",
+    `If you didn't request this, you can safely ignore this email — no one else can use this link without access to your inbox.`,
+  ].join("\n");
+
+  // Inline-styled HTML. Most email clients strip <style> blocks, so
+  // everything that needs to look right has to be inline.
+  const html = `<!doctype html>
+<html>
+  <body style="margin:0;padding:0;background:#fafafa;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;">
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#fafafa;padding:32px 0;">
+      <tr>
+        <td align="center">
+          <table role="presentation" width="480" cellpadding="0" cellspacing="0" style="background:#ffffff;border-radius:8px;padding:32px;max-width:90%;">
+            <tr>
+              <td style="font-size:18px;font-weight:600;color:#111;padding-bottom:16px;">
+                Sign in to ${escapeHtml(brandName)}
+              </td>
+            </tr>
+            <tr>
+              <td style="font-size:15px;line-height:1.5;color:#444;padding-bottom:24px;">
+                Click the button below to sign in. This link expires in ${expiresInMinutes} minutes and can only be used once.
+              </td>
+            </tr>
+            <tr>
+              <td align="center" style="padding-bottom:24px;">
+                <a href="${escapeAttr(verifyUrl)}" style="display:inline-block;background:#111;color:#fff;text-decoration:none;font-size:15px;font-weight:500;padding:12px 24px;border-radius:6px;">Sign in</a>
+              </td>
+            </tr>
+            <tr>
+              <td style="font-size:13px;line-height:1.5;color:#888;padding-bottom:8px;">
+                Or copy and paste this URL into your browser:
+              </td>
+            </tr>
+            <tr>
+              <td style="font-size:12px;color:#888;word-break:break-all;padding-bottom:24px;">
+                ${escapeHtml(verifyUrl)}
+              </td>
+            </tr>
+            <tr>
+              <td style="font-size:12px;line-height:1.5;color:#888;border-top:1px solid #eee;padding-top:16px;">
+                If you didn't request this, you can safely ignore this email — no one can use this link without access to your inbox.
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>`;
+
+  return { subject, text, html };
+}
+
+// renderSubscriptionReminderEmail({ brandName, tier, expiresAt, daysLeft,
+//   kind, manageUrl }) → { subject, text, html }
+// kind: 'upcoming_7d' | 'upcoming_1d' | 'lapsed'. Same minimal,
+// spam-filter-friendly style as the magic-link email: one message, one
+// button. `expiresAt` is an ISO string or Date; `daysLeft` is a number
+// (<= 0 means already expired).
+export function renderSubscriptionReminderEmail({
+  brandName = "Recaps",
+  tier = "pro",
+  expiresAt,
+  daysLeft = 0,
+  kind = "upcoming_7d",
+  manageUrl,
+}) {
+  const tierLabel = tier === "max" ? "Max" : "Pro";
+  const lapsed = kind === "lapsed";
+  let when;
+  if (lapsed) when = "has expired";
+  else if (daysLeft <= 1) when = "expires tomorrow";
+  else when = `expires in ${daysLeft} days`;
+
+  let expiryDateStr = "";
+  try {
+    const d = expiresAt instanceof Date ? expiresAt : new Date(expiresAt);
+    if (!Number.isNaN(d.getTime())) {
+      expiryDateStr = d.toLocaleDateString("en-US", {
+        year: "numeric",
+        month: "long",
+        day: "numeric",
+      });
+    }
+  } catch {}
+
+  const subject = lapsed
+    ? `Your ${brandName} ${tierLabel} plan has expired`
+    : `Your ${brandName} ${tierLabel} plan ${when}`;
+
+  const lead = lapsed
+    ? `Your ${brandName} ${tierLabel} plan has expired${expiryDateStr ? ` (${expiryDateStr})` : ""}, so your account is back on the free Core tier. Renew anytime to restore ${tierLabel} — it's a one-time payment, no auto-charges.`
+    : `Your ${brandName} ${tierLabel} plan ${when}${expiryDateStr ? ` (${expiryDateStr})` : ""}. Renew to keep your ${tierLabel} features — it's a one-time payment for another period, no auto-charges.`;
+
+  const cta = lapsed ? `Renew ${tierLabel}` : `Renew now`;
+
+  const text = [
+    lapsed
+      ? `Your ${brandName} ${tierLabel} plan has expired.`
+      : `Your ${brandName} ${tierLabel} plan ${when}.`,
+    "",
+    lead,
+    "",
+    `${cta}: ${manageUrl}`,
+    "",
+    `You're receiving this because you have a ${brandName} account. Prepaid plans never auto-renew — you're only charged when you choose to.`,
+  ].join("\n");
+
+  const html = `<!doctype html>
+<html>
+  <body style="margin:0;padding:0;background:#fafafa;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;">
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#fafafa;padding:32px 0;">
+      <tr>
+        <td align="center">
+          <table role="presentation" width="480" cellpadding="0" cellspacing="0" style="background:#ffffff;border-radius:8px;padding:32px;max-width:90%;">
+            <tr>
+              <td style="font-size:18px;font-weight:600;color:#111;padding-bottom:16px;">
+                Your ${escapeHtml(brandName)} ${escapeHtml(tierLabel)} plan ${escapeHtml(lapsed ? "has expired" : when)}
+              </td>
+            </tr>
+            <tr>
+              <td style="font-size:15px;line-height:1.5;color:#444;padding-bottom:24px;">
+                ${escapeHtml(lead)}
+              </td>
+            </tr>
+            <tr>
+              <td align="center" style="padding-bottom:24px;">
+                <a href="${escapeAttr(manageUrl)}" style="display:inline-block;background:#111;color:#fff;text-decoration:none;font-size:15px;font-weight:500;padding:12px 24px;border-radius:6px;">${escapeHtml(cta)}</a>
+              </td>
+            </tr>
+            <tr>
+              <td style="font-size:12px;line-height:1.5;color:#888;border-top:1px solid #eee;padding-top:16px;">
+                You're receiving this because you have a ${escapeHtml(brandName)} account. Prepaid plans never auto-renew — you're only charged when you choose to.
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>`;
+
+  return { subject, text, html };
+}
+
+function escapeHtml(s) {
+  return String(s)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+function escapeAttr(s) {
+  return escapeHtml(s);
+}
diff --git a/server/gemini-helpers.js b/server/gemini-helpers.js
index def1aac..c90cb06 100644
--- a/server/gemini-helpers.js
+++ b/server/gemini-helpers.js
@@ -9,12 +9,15 @@ import { formatTime } from "./util.js";
 // numbers are operational data, not configuration. Update when Google
 // changes published rates.
 export const PRICING = {
-  "gemini-3-flash-preview":    { input: 0.50, output: 3.00, thinking: 3.00 },
-  "gemini-3-pro-preview":      { input: 2.00, output: 12.00, thinking: 12.00 },
+  // The five Gemini models we support. Verified against Google's
+  // official docs on 2026-05-12. Retired/never-existed IDs omitted.
   "gemini-3.1-pro-preview":    { input: 2.00, output: 12.00, thinking: 12.00 },
-  "gemini-2.5-flash":          { input: 0.15, output: 0.60, thinking: 0.60 },
+  "gemini-2.5-pro":            { input: 1.25, output: 10.00, thinking: 10.00 },
+  "gemini-3-flash-preview":    { input: 0.50, output: 3.00,  thinking: 3.00 },
+  "gemini-2.5-flash":          { input: 0.15, output: 0.60,  thinking: 0.60 },
+  "gemini-3.1-flash-lite":     { input: 0.10, output: 0.40,  thinking: 0.40 },
   // Fallback for unknown / future models — better an estimate than nothing.
-  "default":                   { input: 1.00, output: 5.00, thinking: 5.00 },
+  "default":                   { input: 1.00, output: 5.00,  thinking: 5.00 },
 };
 
 // ── Cost calculation ────────────────────────────────────────────────────────
@@ -46,16 +49,67 @@ export function calcCost(modelName, usage) {
   };
 }
 
+// ── Section-count target by VIDEO duration ─────────────────────────────────
+// Mirrors recap-relay's computePerWindowTarget() (server/chunked-analyze.js).
+// Operator-tunable on the relay; baked into code defaults here on the
+// Recap-app direct path. The defaults match the relay's defaults so
+// segmentation density is consistent across both pipelines.
+//
+// Buckets are TOTAL video duration in minutes:
+//   <30 → 6 sections / 30-60 → 8 / 60-90 → 9 / 90-120 → 10
+//   120-150 → 11 / 150-180 → 12 / >=180 → 12
+// Per-window target = total_target × window_sec / total_audio_sec
+// (clamped to ≥1 for single-shot runs).
+function pickTotalSectionsTarget(totalAudioSec) {
+  const m = (totalAudioSec || 0) / 60;
+  if (m < 30) return 6;
+  if (m < 60) return 8;
+  if (m < 90) return 9;
+  if (m < 120) return 10;
+  if (m < 150) return 11;
+  if (m < 180) return 12;
+  return 12;
+}
+function formatTargetSectionsLabel(avg) {
+  if (avg <= 1.2) return "1 section";
+  const lo = Math.max(1, Math.floor(avg));
+  const hi = Math.max(lo, Math.ceil(avg));
+  if (lo === hi) return "around " + lo + " sections";
+  return lo + "–" + hi + " sections";
+}
+
 // ── Topic-analysis prompt builder ───────────────────────────────────────────
-// Takes the parsed transcript entries and builds the JSON-output prompt
-// fed to the analysis model. Indices in the response are positional into
-// the same `entries` array — the caller relies on that contract.
-export function buildAnalysisPrompt(entries) {
+// Takes the parsed transcript entries for a WINDOW and builds the
+// JSON-output prompt fed to the analysis model. Indices in the response
+// are positional into the same window-entries array — the caller relies
+// on that contract.
+//
+// `opts.totalAudioSec` is the FULL audio duration (not just this window),
+// used to scale the section-count target via the per-video-duration table
+// above. When omitted, falls back to deriving from the windowEntries
+// themselves (legacy callers / unit tests / single-shot path).
+export function buildAnalysisPrompt(entries, opts = {}) {
   const numbered = entries
     .map((e, i) => `[${i}] (${formatTime(e.offset)}) ${e.text}`)
     .join("\n");
 
-  return `You are analyzing a video transcript. Your job is to identify natural topic boundaries and group the transcript into discussion-based sections.
+  // Window length in minutes (this window's own transcript span).
+  const windowSec = entries.length > 1
+    ? (entries[entries.length - 1].offset || 0) - (entries[0].offset || 0)
+    : 0;
+  const windowMin = Math.max(1, Math.round(windowSec / 60));
+  const maxIndex = Math.max(0, entries.length - 1);
+
+  // Total audio duration drives the per-video-duration target picker.
+  // If the caller didn't supply it, assume this is a single-shot run
+  // and the window IS the whole audio.
+  const totalAudioSec = opts.totalAudioSec || windowSec || 60;
+  const totalTarget = pickTotalSectionsTarget(totalAudioSec);
+  const numWindows = Math.max(1, totalAudioSec / Math.max(60, windowSec || 60));
+  const avgPerWindow = totalTarget / numWindows;
+  const targetSections = formatTargetSectionsLabel(avgPerWindow);
+
+  return `You are analyzing a ~${windowMin}-minute section of a longer transcript. Your job is to identify natural topic boundaries and group the transcript into discussion-based sections — aim for ${targetSections}.
 
 TRANSCRIPT (each line is numbered with a timestamp):
 ${numbered}
@@ -67,13 +121,13 @@ INSTRUCTIONS:
 4. For each section, write:
    - A short, specific topic title (3-8 words)
    - A 1-3 sentence summary of what's discussed
-   - The start and end segment indices (inclusive)
+   - The start and end segment indices (inclusive), counted as the bracketed [N] number at the start of each transcript line above.
 
 IMPORTANT:
 - Sections must be chronological and non-overlapping.
-- Every segment index from 0 to ${entries.length - 1} must belong to exactly one section.
+- Every segment index from 0 to ${maxIndex} must belong to exactly one section.
 - startIndex of section N+1 must equal endIndex of section N plus 1.
-- Create as many or as few sections as the content naturally requires.
+- Create as many or as few sections as the content naturally requires — but lean toward broad, substantive topics rather than minute-by-minute breakdowns. A natural topic that spans several minutes of dialogue should be one section, not several.
 - Titles should be descriptive and specific, not generic like "Introduction" unless it truly is one.
 
 Respond with ONLY valid JSON in this exact format, no other text:
diff --git a/server/history.js b/server/history.js
index 8bea81e..d005d9c 100644
--- a/server/history.js
+++ b/server/history.js
@@ -1,35 +1,138 @@
-// History storage + routes. Sessions are written as one JSON file per
-// summary in /data/history/<id>.json. Folder structure / ordering lives
-// in a sidecar `_meta.json`.
+// History storage + routes. Per-user-scoped under /data/history/<scope>/.
 //
-// Module-private state: just the historyDir path, set by initHistory().
-// The DELETE route needs to add the deleted videoId to the skip list
-// (so subscriptions don't re-queue it) — that's a cross-module concern,
-// so it's injected as a callback by setupHistoryRoutes.
+// "Scope" is:
+//   - single mode:                "owner" (always)
+//   - multi mode signed-in user:  "<user_id>"
+//   - multi mode anonymous trial: "anon/<trial_cookie_id>"
+//
+// Each scope has its own folder with one *.json file per summary and a
+// `_meta.json` for the folder/ordering UI. Scope isolation is enforced
+// here at the path level — handlers in this file refuse to read across
+// scopes, period. The auth middleware populates req.userId; we derive
+// the scope via scopeForRequest(req) and never trust raw URL input.
+//
+// On a brand-new install nothing exists. Single-mode installs created
+// before 0.2.77 wrote files flat to /data/history/*.json; the migration
+// hook (see migrateLegacyLibrary below) moves those into the "owner"
+// scope on first multi-mode boot.
+//
+// Module-private state: historyDir (the root path). All per-scope
+// paths are derived per-call so adding a new user doesn't need a
+// re-init.
 
 import fs from "fs/promises";
 import path from "path";
 
 let historyDir = null;
-let metaPath = null;
 
 // ── Initialization ──────────────────────────────────────────────────────────
-// Call once at boot. Creates the directory and stores the path. Idempotent.
-export async function initHistory({ dataDir }) {
+// Call once at boot. Creates the root directory and stores the path.
+// In single mode also ensures /data/history/owner exists so the
+// owner-scope writes don't race on first-summary mkdir.
+export async function initHistory({ dataDir, mode = "single" }) {
   historyDir = path.join(dataDir, "history");
-  metaPath = path.join(historyDir, "_meta.json");
   await fs.mkdir(historyDir, { recursive: true }).catch(() => {});
+  if (mode === "single") {
+    await fs.mkdir(ownerScopeDir(), { recursive: true }).catch(() => {});
+  }
+}
+
+// ── Scope helpers ───────────────────────────────────────────────────────────
+
+// Files that live at the root of /data/history/ (not inside a per-user
+// scope) — subscription state, skip lists, etc. Filtered out when
+// listing sessions so they don't appear as phantom library items.
+// Files that live inside a scope dir but are NOT session records:
+// the folder/order meta + the per-scope subscription state (moved here by
+// the 0.2.147 migration). They must be filtered out of every place that
+// lists `.json` files as sessions, or they show up as phantom "Invalid
+// Date · undefined topics" library entries.
+export const ROOT_SIDECARS = new Set([
+  "_meta.json",
+  "subscriptions.json",
+  "skip-list.json",
+  "seen-list.json",
+  "auto-queue.json",
+]);
+
+// Sanitize a user-supplied scope component so it can't escape the
+// history root via path traversal. Allows the alphabet that user_ids
+// and trial cookie_ids use (base64url + hex chars + the literal "anon"
+// and "owner" prefixes). Anything else → throw.
+function safeComponent(s) {
+  if (typeof s !== "string" || !s) throw new Error("invalid_scope_component");
+  if (!/^[A-Za-z0-9_-]+$/.test(s)) throw new Error("invalid_scope_component");
+  return s;
+}
+
+// scopeForRequest(req) — single string identifying the writer/reader
+// of a library. Used as a subpath under /data/history/. Throws if the
+// request has no usable identity (caller should 401 in that case).
+//
+// Returned strings:
+//   "owner"             — single mode, OR the multi-mode admin (so
+//                         a multi→single mode flip preserves the
+//                         operator's library at the same path)
+//   "<user_id>"         — multi mode non-admin signed-in user
+//   "anon/<cookie_id>"  — multi mode anonymous-trial cookie
+//
+// Why admin → "owner": before v0.2.91 we renamed /data/history/owner/
+// → /data/history/<admin_user_id>/ on first multi-mode signup, which
+// made switching back to single mode hide the operator's library
+// (single mode reads "owner"). Keeping admin's scope at "owner"
+// regardless of mode makes mode-switching lossless.
+export function scopeForRequest(req) {
+  if (req.recapMode !== "multi") return "owner";
+  if (req.user && req.user.is_admin) return "owner";
+  if (req.user && req.user.id) return safeComponent(req.user.id);
+  if (typeof req.userId === "string" && req.userId.startsWith("anon:")) {
+    return `anon/${safeComponent(req.userId.slice(5))}`;
+  }
+  if (req.userId === "owner") return "owner"; // pre-multi-mode legacy shim
+  throw new Error("no_scope");
+}
+
+function scopeDir(scope) {
+  // `scope` may contain a slash for the "anon/<id>" case — split into
+  // segments so path.join doesn't treat it as one component (and so
+  // safeComponent enforcement covers each piece).
+  const parts = scope.split("/").map(safeComponent);
+  return path.join(historyDir, ...parts);
+}
+
+function ownerScopeDir() {
+  return path.join(historyDir, "owner");
+}
+
+function metaPathFor(scope) {
+  return path.join(scopeDir(scope), "_meta.json");
 }
 
 // ── Storage ─────────────────────────────────────────────────────────────────
 // saveToHistory persists a completed summary. Returns the generated id.
-// Used by /api/process. The id encodes the timestamp + a content hint
-// (videoId for YouTube, base64-truncated guid/url for podcasts) so files
-// sort chronologically by name.
-export async function saveToHistory(videoId, url, title, chunks, entries, logs, uploadDate, type) {
-  const idSuffix = type === "podcast"
-    ? Buffer.from(videoId).toString("base64url").slice(0, 16)
-    : videoId;
+// Caller (the /api/process handler) is responsible for passing the
+// right scope — derived via scopeForRequest(req) up the call stack.
+//
+// The id encodes the timestamp + a content hint (videoId for YouTube,
+// base64-truncated guid/url for podcasts) so files sort chronologically
+// by name.
+export async function saveToHistory(
+  scope,
+  videoId,
+  url,
+  title,
+  chunks,
+  entries,
+  logs,
+  uploadDate,
+  type,
+  speakers = null,
+  speakerNames = null,
+) {
+  const idSuffix =
+    type === "podcast"
+      ? Buffer.from(videoId).toString("base64url").slice(0, 16)
+      : videoId;
   const id = `${Date.now()}-${idSuffix}`;
   const record = {
     id,
@@ -44,101 +147,352 @@ export async function saveToHistory(videoId, url, title, chunks, entries, logs,
     chunks,
     entries,
     logs,
+    // Phase 1E — speaker legend summary keyed by global speaker ID
+    // (Speaker_A, Speaker_B, ...). Each chunk's entries also carry
+    // `.speaker` and `.speaker_confidence` fields inline. Null when
+    // diarization wasn't available (older relay, off, or no
+    // fingerprints collected). Persisting at the record level lets
+    // the library card show "2 speakers" without scanning entries.
+    speakers: speakers || null,
+    // Phase 2 — inferred speaker names from the relay's post-cluster
+    // polish pass. Map { Speaker_A: "Matt Hill", ... } with null
+    // values for unidentified speakers. Reopening a saved session
+    // restores names alongside the cluster IDs.
+    speakerNames: speakerNames || null,
   };
-  await fs.writeFile(path.join(historyDir, `${id}.json`), JSON.stringify(record));
+  const dir = scopeDir(scope);
+  await fs.mkdir(dir, { recursive: true }).catch(() => {});
+  await fs.writeFile(path.join(dir, `${id}.json`), JSON.stringify(record));
   return id;
 }
 
 // ── Meta ────────────────────────────────────────────────────────────────────
-// `_meta.json` shape: { folders: [{ id, name, order, collapsed,
-// items: [sessionId, ...] }], uncategorized: [sessionId, ...] }
-export async function loadMeta() {
+// Each scope has its own `_meta.json` for folder/ordering UI state.
+// New scope = empty meta on read (no file yet).
+export async function loadMeta(scope) {
   try {
-    return JSON.parse(await fs.readFile(metaPath, "utf-8"));
+    return JSON.parse(await fs.readFile(metaPathFor(scope), "utf-8"));
   } catch {
     return { folders: [], uncategorized: [] };
   }
 }
 
-export async function saveMeta(meta) {
-  await fs.writeFile(metaPath, JSON.stringify(meta, null, 2));
+export async function saveMeta(scope, meta) {
+  const dir = scopeDir(scope);
+  await fs.mkdir(dir, { recursive: true }).catch(() => {});
+  await fs.writeFile(metaPathFor(scope), JSON.stringify(meta, null, 2));
 }
 
+// getHistoryDir() — root /data/history/. Some callers (subscriptions,
+// skip-list, etc.) write sidecar files here that aren't scoped.
 export function getHistoryDir() {
   return historyDir;
 }
 
-// ── Routes ──────────────────────────────────────────────────────────────────
-// Pass `addToSkipList` so the DELETE route can suppress re-queueing of
-// videos the user has explicitly removed. Decoupled from subscriptions
-// to keep this module standalone.
-export function setupHistoryRoutes(app, { addToSkipList } = {}) {
-  // Get all history: sessions + folder structure
-  app.get("/api/history", async (req, res) => {
+// getScopeHistoryDir(scope) — the per-scope directory. Used by handlers
+// that need raw filesystem access (e.g. delete).
+export function getScopeHistoryDir(scope) {
+  return scopeDir(scope);
+}
+
+// ── Audio-first ("walking mode") TTS cache helpers ──────────────────────────
+// Per-topic synthesized summary clips live alongside the session JSON in
+// a sibling folder: /data/history/<scope>/<id>-audio/topic-<i>.mp3. Same
+// scope-isolation guarantees as the session record (safeFilename guards
+// the id; scopeDir guards the scope).
+
+// Directory holding a session's cached summary-audio clips.
+export function sessionAudioDir(scope, id) {
+  return path.join(scopeDir(scope), `${safeFilename(id)}-audio`);
+}
+
+// Load a full session record by id within a scope. Returns null if it
+// doesn't exist (or can't be parsed) — callers 404 on null.
+export async function loadSession(scope, id) {
+  try {
+    const raw = await fs.readFile(
+      path.join(scopeDir(scope), `${safeFilename(id)}.json`),
+      "utf-8",
+    );
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+// Shallow-merge `patch` into a session record on disk (e.g. to stamp
+// `summaryAudio` availability). No-op-safe: returns null if the record
+// is missing rather than throwing.
+export async function patchSession(scope, id, patch) {
+  const file = path.join(scopeDir(scope), `${safeFilename(id)}.json`);
+  let rec;
+  try {
+    rec = JSON.parse(await fs.readFile(file, "utf-8"));
+  } catch {
+    return null;
+  }
+  const merged = { ...rec, ...patch };
+  await fs.writeFile(file, JSON.stringify(merged));
+  return merged;
+}
+
+// ── Legacy library migration (single → multi) ───────────────────────────────
+// Pre-0.2.77 single-mode installs wrote summaries flat to
+// /data/history/*.json with a single _meta.json. On first boot in
+// multi mode we move all of that into /data/history/owner/ so the
+// operator's library is accessible under the "owner" scope. After the
+// first real user signs up (is_admin=1), auth-routes.js renames that
+// folder to the user's actual id so they own their original library.
+//
+// Idempotent — writes a sentinel after the first migration. Safe to
+// call on every boot; no-op if there's nothing flat to move.
+export async function migrateLegacyLibrary() {
+  const sentinel = path.join(historyDir, ".migrated_to_multi");
+  try {
+    await fs.access(sentinel);
+    return { migrated: 0, skipped: "already_migrated" };
+  } catch {}
+
+  let entries = [];
+  try {
+    entries = await fs.readdir(historyDir);
+  } catch {
+    return { migrated: 0, skipped: "no_history_dir" };
+  }
+
+  const flatFiles = entries.filter(
+    (f) => f.endsWith(".json") && !ROOT_SIDECARS.has(f),
+  );
+  if (flatFiles.length === 0 && !entries.includes("_meta.json")) {
+    // Truly empty. Write the sentinel so future boots don't keep
+    // checking, but flag this as a non-migration.
+    await fs.writeFile(sentinel, new Date().toISOString());
+    return { migrated: 0, skipped: "empty_legacy_library" };
+  }
+
+  const target = ownerScopeDir();
+  await fs.mkdir(target, { recursive: true }).catch(() => {});
+
+  let moved = 0;
+  for (const f of flatFiles) {
     try {
-      const files = await fs.readdir(historyDir);
+      await fs.rename(
+        path.join(historyDir, f),
+        path.join(target, f),
+      );
+      moved += 1;
+    } catch (err) {
+      console.warn(`[history] failed to migrate ${f}:`, err?.message || err);
+    }
+  }
+
+  // Move _meta.json too if it exists at the root. Folder/ordering state
+  // belongs to the same library.
+  try {
+    await fs.rename(
+      path.join(historyDir, "_meta.json"),
+      path.join(target, "_meta.json"),
+    );
+  } catch {} // no _meta.json is fine
+
+  await fs.writeFile(sentinel, new Date().toISOString());
+  console.log(
+    `[history] migrated ${moved} legacy session(s) to /data/history/owner/`,
+  );
+  return { migrated: moved };
+}
+
+// reclaimAdminLibraryToOwner({ db }) — one-time fixup for installs
+// upgraded from <0.2.91 where the first admin's library got renamed
+// from /data/history/owner/ → /data/history/<admin_user_id>/ on their
+// signup. With the new admin-scope-is-always-owner rule (above), we
+// need that library back under "owner" so multi-mode admin reads it
+// AND a future single-mode flip can still find it. Idempotent — runs
+// the rename only if BOTH (a) an admin user exists in SQLite AND
+// (b) /data/history/<admin_user_id>/ exists AND (c) /data/history/owner/
+// does NOT already exist. Otherwise no-op.
+//
+// Pass in the better-sqlite3 db handle from db.js — we don't import
+// here to avoid a dep cycle (db.js is multi-mode only, history.js is
+// loaded in single mode too).
+export async function reclaimAdminLibraryToOwner({ db }) {
+  if (!db) return { reclaimed: false, reason: "no_db" };
+  let admin;
+  try {
+    admin = db
+      .prepare(
+        "SELECT id, email FROM users WHERE is_admin = 1 ORDER BY created_at ASC LIMIT 1",
+      )
+      .get();
+  } catch {
+    return { reclaimed: false, reason: "no_users_table" };
+  }
+  if (!admin) return { reclaimed: false, reason: "no_admin" };
+
+  const ownerDir = path.join(historyDir, "owner");
+  const adminDir = path.join(historyDir, safeComponent(admin.id));
+  try {
+    await fs.access(ownerDir);
+    // /data/history/owner/ already exists → either a fresh install or
+    // the fixup already ran. Either way, do nothing.
+    return { reclaimed: false, reason: "owner_already_exists" };
+  } catch {}
+  try {
+    await fs.access(adminDir);
+  } catch {
+    return { reclaimed: false, reason: "admin_dir_missing" };
+  }
+  await fs.rename(adminDir, ownerDir);
+  console.log(
+    `[history] reclaimed admin library: /data/history/${admin.id}/ → /data/history/owner/`,
+  );
+  return { reclaimed: true, admin_id: admin.id, email: admin.email };
+}
+
+// renameScopeDir(fromScope, toScope) — atomic rename of a per-scope
+// folder. Used when:
+//   - the first multi-mode signup claims the "owner" legacy library
+//     (auth-routes.js calls this with fromScope="owner", toScope=user.id)
+//   - an anonymous trial converts to a real user (auth-routes.js,
+//     fromScope="anon/<cookie_id>", toScope=user.id)
+//
+// If `fromScope` doesn't exist, no-op (returns false). If `toScope`
+// already exists, we don't clobber — the caller has to merge manually
+// (which currently only matters in edge cases, since fresh user ids
+// are uuids that won't collide). Returns true on actual rename.
+export async function renameScopeDir(fromScope, toScope) {
+  const from = scopeDir(fromScope);
+  const to = scopeDir(toScope);
+  try {
+    await fs.access(from);
+  } catch {
+    return false;
+  }
+  try {
+    await fs.access(to);
+    console.warn(
+      `[history] renameScopeDir: ${toScope} already exists; refusing to clobber. Leaving ${fromScope} in place for manual reconciliation.`,
+    );
+    return false;
+  } catch {}
+  // Ensure parent of `to` exists (for the "anon/<id>" case the parent
+  // is /data/history/anon/, which won't be there in fresh installs).
+  await fs.mkdir(path.dirname(to), { recursive: true }).catch(() => {});
+  await fs.rename(from, to);
+  console.log(`[history] renamed scope ${fromScope} → ${toScope}`);
+  return true;
+}
+
+// ── Routes ──────────────────────────────────────────────────────────────────
+// All routes are scoped to req — they read scopeForRequest(req) and
+// refuse to operate outside that scope. No request body or URL param
+// can reference another user's library.
+//
+// `addToSkipList(scope, videoId)` is injected so the DELETE route can
+// suppress re-queueing of a subscription video the user explicitly removed.
+// It's scope-keyed (./subscriptions.js): the skip applies to the same
+// scope's subscription store.
+export function setupHistoryRoutes(app, { addToSkipList } = {}) {
+  function requireScope(req, res) {
+    try {
+      return scopeForRequest(req);
+    } catch {
+      res.status(401).json({ error: "auth_required" });
+      return null;
+    }
+  }
+
+  // Get all history: sessions + folder structure for THIS user.
+  app.get("/api/history", async (req, res) => {
+    const scope = requireScope(req, res);
+    if (!scope) return;
+    try {
+      const dir = scopeDir(scope);
+      let files = [];
+      try {
+        files = await fs.readdir(dir);
+      } catch {
+        files = []; // no library yet — render an empty state
+      }
       const sessionsMap = {};
-      // Skip the meta + state files; everything else is a session.
-      for (const file of files.filter(f =>
-        f.endsWith(".json") &&
-        !f.startsWith("_") &&
-        f !== "subscriptions.json" &&
-        f !== "skip-list.json" &&
-        f !== "seen-list.json" &&
-        f !== "auto-queue.json"
+      for (const file of files.filter(
+        (f) =>
+          f.endsWith(".json") && !f.startsWith("_") && !ROOT_SIDECARS.has(f),
       )) {
         try {
-          const raw = await fs.readFile(path.join(historyDir, file), "utf-8");
+          const raw = await fs.readFile(path.join(dir, file), "utf-8");
           const data = JSON.parse(raw);
           sessionsMap[data.id] = {
-            id: data.id, videoId: data.videoId, url: data.url,
-            title: data.title, topicCount: data.topicCount,
+            id: data.id,
+            videoId: data.videoId,
+            url: data.url,
+            title: data.title,
+            topicCount: data.topicCount,
             type: data.type || "youtube",
-            segmentCount: data.segmentCount, createdAt: data.createdAt,
+            segmentCount: data.segmentCount,
+            createdAt: data.createdAt,
             uploadDate: data.uploadDate || "",
           };
         } catch {}
       }
 
-      const meta = await loadMeta();
+      const meta = await loadMeta(scope);
 
       // Clean up: remove references to deleted sessions
       for (const folder of meta.folders) {
-        folder.items = folder.items.filter(id => sessionsMap[id]);
+        folder.items = folder.items.filter((id) => sessionsMap[id]);
       }
-      meta.uncategorized = meta.uncategorized.filter(id => sessionsMap[id]);
+      meta.uncategorized = meta.uncategorized.filter((id) => sessionsMap[id]);
 
       // Add any sessions not in meta (newly created)
       const allReferenced = new Set([
         ...meta.uncategorized,
-        ...meta.folders.flatMap(f => f.items),
+        ...meta.folders.flatMap((f) => f.items),
       ]);
       const allIds = Object.keys(sessionsMap);
-      const orphans = allIds.filter(id => !allReferenced.has(id))
-        .sort((a, b) => new Date(sessionsMap[b].createdAt) - new Date(sessionsMap[a].createdAt));
+      const orphans = allIds
+        .filter((id) => !allReferenced.has(id))
+        .sort(
+          (a, b) =>
+            new Date(sessionsMap[b].createdAt) -
+            new Date(sessionsMap[a].createdAt),
+        );
       meta.uncategorized = [...orphans, ...meta.uncategorized];
 
-      await saveMeta(meta);
+      await saveMeta(scope, meta);
       res.json({ sessions: sessionsMap, meta });
     } catch (err) {
-      res.json({ sessions: {}, meta: { folders: [], uncategorized: [] } });
+      res.json({
+        sessions: {},
+        meta: { folders: [], uncategorized: [] },
+      });
     }
   });
 
-  // Get a single session (full data)
+  // Get a single session (full data) — scoped to current user.
   app.get("/api/history/:id", async (req, res) => {
+    const scope = requireScope(req, res);
+    if (!scope) return;
     try {
-      const raw = await fs.readFile(path.join(historyDir, `${req.params.id}.json`), "utf-8");
+      const raw = await fs.readFile(
+        path.join(scopeDir(scope), `${safeFilename(req.params.id)}.json`),
+        "utf-8",
+      );
       res.json(JSON.parse(raw));
     } catch {
       res.status(404).json({ error: "Session not found" });
     }
   });
 
-  // Rename a session title
+  // Rename a session title — scoped.
   app.put("/api/history/:id/title", async (req, res) => {
+    const scope = requireScope(req, res);
+    if (!scope) return;
     try {
-      const filePath = path.join(historyDir, `${req.params.id}.json`);
+      const filePath = path.join(
+        scopeDir(scope),
+        `${safeFilename(req.params.id)}.json`,
+      );
       const raw = await fs.readFile(filePath, "utf-8");
       const data = JSON.parse(raw);
       data.title = req.body.title || data.title;
@@ -149,11 +503,16 @@ export function setupHistoryRoutes(app, { addToSkipList } = {}) {
     }
   });
 
-  // Delete a session — also adds the videoId to the skip list so any
-  // subscriptions don't re-queue it.
+  // Delete a session — scoped. Also adds the videoId to the (global)
+  // skip list so subscriptions don't re-queue it.
   app.delete("/api/history/:id", async (req, res) => {
+    const scope = requireScope(req, res);
+    if (!scope) return;
     try {
-      const filePath = path.join(historyDir, `${req.params.id}.json`);
+      const filePath = path.join(
+        scopeDir(scope),
+        `${safeFilename(req.params.id)}.json`,
+      );
       let videoId = null;
       try {
         const raw = await fs.readFile(filePath, "utf-8");
@@ -163,26 +522,30 @@ export function setupHistoryRoutes(app, { addToSkipList } = {}) {
       await fs.unlink(filePath);
 
       if (videoId && typeof addToSkipList === "function") {
-        await addToSkipList(videoId);
+        await addToSkipList(scope, videoId);
       }
 
-      const meta = await loadMeta();
-      meta.uncategorized = meta.uncategorized.filter(id => id !== req.params.id);
+      const meta = await loadMeta(scope);
+      meta.uncategorized = meta.uncategorized.filter(
+        (id) => id !== req.params.id,
+      );
       for (const folder of meta.folders) {
-        folder.items = folder.items.filter(id => id !== req.params.id);
+        folder.items = folder.items.filter((id) => id !== req.params.id);
       }
-      await saveMeta(meta);
+      await saveMeta(scope, meta);
       res.json({ ok: true });
     } catch {
       res.status(404).json({ error: "Session not found" });
     }
   });
 
-  // Update meta (folders, ordering) — the frontend sends the full structure
+  // Update meta (folders, ordering) — scoped.
   app.put("/api/history/meta", async (req, res) => {
+    const scope = requireScope(req, res);
+    if (!scope) return;
     try {
       const meta = req.body;
-      await saveMeta(meta);
+      await saveMeta(scope, meta);
       res.json({ ok: true });
     } catch (err) {
       res.status(500).json({ error: err.message });
@@ -190,11 +553,18 @@ export function setupHistoryRoutes(app, { addToSkipList } = {}) {
   });
 
   app.post("/api/history/folders", async (req, res) => {
+    const scope = requireScope(req, res);
+    if (!scope) return;
     try {
-      const meta = await loadMeta();
-      const folder = { id: `folder-${Date.now()}`, name: req.body.name || "New Folder", collapsed: false, items: [] };
+      const meta = await loadMeta(scope);
+      const folder = {
+        id: `folder-${Date.now()}`,
+        name: req.body.name || "New Folder",
+        collapsed: false,
+        items: [],
+      };
       meta.folders.push(folder);
-      await saveMeta(meta);
+      await saveMeta(scope, meta);
       res.json(folder);
     } catch (err) {
       res.status(500).json({ error: err.message });
@@ -202,12 +572,14 @@ export function setupHistoryRoutes(app, { addToSkipList } = {}) {
   });
 
   app.put("/api/history/folders/:id", async (req, res) => {
+    const scope = requireScope(req, res);
+    if (!scope) return;
     try {
-      const meta = await loadMeta();
-      const folder = meta.folders.find(f => f.id === req.params.id);
+      const meta = await loadMeta(scope);
+      const folder = meta.folders.find((f) => f.id === req.params.id);
       if (!folder) return res.status(404).json({ error: "Folder not found" });
       folder.name = req.body.name || folder.name;
-      await saveMeta(meta);
+      await saveMeta(scope, meta);
       res.json(folder);
     } catch (err) {
       res.status(500).json({ error: err.message });
@@ -215,48 +587,52 @@ export function setupHistoryRoutes(app, { addToSkipList } = {}) {
   });
 
   app.put("/api/history/folders/:id/collapsed", async (req, res) => {
+    const scope = requireScope(req, res);
+    if (!scope) return;
     try {
-      const meta = await loadMeta();
-      const folder = meta.folders.find(f => f.id === req.params.id);
+      const meta = await loadMeta(scope);
+      const folder = meta.folders.find((f) => f.id === req.params.id);
       if (!folder) return res.status(404).json({ error: "Folder not found" });
       folder.collapsed = !!req.body.collapsed;
-      await saveMeta(meta);
+      await saveMeta(scope, meta);
       res.json({ ok: true, collapsed: folder.collapsed });
     } catch (err) {
       res.status(500).json({ error: err.message });
     }
   });
 
-  // Delete a folder — items move back to uncategorized
+  // Delete a folder — items move back to uncategorized.
   app.delete("/api/history/folders/:id", async (req, res) => {
+    const scope = requireScope(req, res);
+    if (!scope) return;
     try {
-      const meta = await loadMeta();
-      const idx = meta.folders.findIndex(f => f.id === req.params.id);
+      const meta = await loadMeta(scope);
+      const idx = meta.folders.findIndex((f) => f.id === req.params.id);
       if (idx === -1) return res.status(404).json({ error: "Folder not found" });
       const [folder] = meta.folders.splice(idx, 1);
       meta.uncategorized = [...folder.items, ...meta.uncategorized];
-      await saveMeta(meta);
+      await saveMeta(scope, meta);
       res.json({ ok: true });
     } catch (err) {
       res.status(500).json({ error: err.message });
     }
   });
 
-  // Move a session to a folder (or uncategorized if folderId is null)
+  // Move a session to a folder (or uncategorized if folderId is null).
   app.put("/api/history/move", async (req, res) => {
+    const scope = requireScope(req, res);
+    if (!scope) return;
     try {
       const { sessionId, folderId, index } = req.body;
-      const meta = await loadMeta();
+      const meta = await loadMeta(scope);
 
-      // Remove from current location
-      meta.uncategorized = meta.uncategorized.filter(id => id !== sessionId);
+      meta.uncategorized = meta.uncategorized.filter((id) => id !== sessionId);
       for (const folder of meta.folders) {
-        folder.items = folder.items.filter(id => id !== sessionId);
+        folder.items = folder.items.filter((id) => id !== sessionId);
       }
 
-      // Add to new location
       if (folderId) {
-        const folder = meta.folders.find(f => f.id === folderId);
+        const folder = meta.folders.find((f) => f.id === folderId);
         if (folder) {
           const i = typeof index === "number" ? index : folder.items.length;
           folder.items.splice(i, 0, sessionId);
@@ -266,10 +642,20 @@ export function setupHistoryRoutes(app, { addToSkipList } = {}) {
         meta.uncategorized.splice(i, 0, sessionId);
       }
 
-      await saveMeta(meta);
+      await saveMeta(scope, meta);
       res.json({ ok: true });
     } catch (err) {
       res.status(500).json({ error: err.message });
     }
   });
 }
+
+// Allow the same character set as scope components for session ids.
+// Belt-and-suspenders against ../../ in :id; ids generated by
+// saveToHistory always match.
+function safeFilename(s) {
+  if (typeof s !== "string" || !/^[A-Za-z0-9_-]+$/.test(s)) {
+    throw new Error("invalid_session_id");
+  }
+  return s;
+}
diff --git a/server/index.js b/server/index.js
index 5a9b855..e9d4e27 100644
--- a/server/index.js
+++ b/server/index.js
@@ -21,6 +21,7 @@ import {
   fetchUrl,
 } from "./util.js";
 import { buildAnalysisPrompt } from "./gemini-helpers.js";
+import { runChunkedAnalysis, CHUNKING_CUTOFF_SECONDS } from "./chunked-analyze.js";
 import { getProvider, resolveProviderOpts, PROVIDER_NAMES } from "./providers/index.js";
 import {
   getAudioDuration,
@@ -40,8 +41,25 @@ import * as config from "./config.js";
 import { initInstallId, getInstallId } from "./install-id.js";
 import * as relayState from "./relay-state.js";
 import * as relayDefault from "./relay-default.js";
+import {
+  startRelayCapabilitiesRefresh,
+  getRelayCapabilities,
+  refreshRelayCapabilities,
+} from "./relay-capabilities.js";
+import {
+  isResolvableShareUrl,
+  isApplePodcastUrl,
+  isSpotifyUrl,
+  resolveShareUrl,
+  URLResolveError,
+} from "./url-resolver.js";
 import { resolveApiKey, getConfigSnapshot } from "./config.js";
 import * as licenseMW from "./license-middleware.js";
+import { setupLicensePurchaseRoutes } from "./license-purchase.js";
+import {
+  setupCreditsPurchaseRoutes,
+  sweepUnappliedPurchases,
+} from "./credits-purchase.js";
 import {
   setupLicenseMiddleware,
   setupLicenseRoutes,
@@ -62,18 +80,55 @@ import {
   saveMeta,
   setupHistoryRoutes,
   getHistoryDir,
+  scopeForRequest,
+  migrateLegacyLibrary,
 } from "./history.js";
+import {
+  getProcessedVideoIds,
+  isKnownVideo,
+  loadSubscriptions,
+  saveSubscriptions,
+  loadSkipList,
+  addToSkipList,
+  loadSeenList,
+  addToSeenList,
+  loadAutoQueue,
+  saveAutoQueue,
+  mutateAutoQueue,
+  listSubscriptionScopes,
+  listAutoQueueScopes,
+  migrateGlobalSubscriptionsToOwner,
+} from "./subscriptions.js";
+import {
+  mintInternalSession,
+  deleteInternalSession,
+  adminUserId,
+  SESSION_COOKIE,
+} from "./auth-routes.js";
 import { setupLibraryRoutes } from "./library.js";
+import { setupTtsRoutes } from "./tts-routes.js";
 import {
   initAdminAuth,
   setupAdminAuthMiddleware,
   setupAdminAuthRoutes,
 } from "./admin-auth.js";
+import { buildTenantAuthMiddleware } from "./tenant-auth.js";
 
 const execFileAsync = promisify(execFile);
 const app = express();
 const PORT = process.env.PORT || 3001;
 
+// ── Multi-tenant mode toggle ────────────────────────────────────────────
+// RECAP_MODE is set by startos/main.ts based on the recap_mode field of
+// the config. "single" (default) preserves the original self-hosted
+// behavior; "multi" enables email + magic-link auth, per-user libraries,
+// per-user keysat licenses, and BTCPay subscriptions.
+//
+// Anything outside "multi" is treated as single — defensive parsing so
+// a stray env value can't accidentally enable multi-tenant routing.
+const RECAP_MODE = process.env.RECAP_MODE === "multi" ? "multi" : "single";
+console.log(`[boot] RECAP_MODE=${RECAP_MODE}`);
+
 // ── Data directory (configurable for StartOS or local dev) ────────────────
 // On StartOS: DATA_DIR=/data (persistent volume)
 // On local dev: defaults to project root (parent of server/)
@@ -84,7 +139,7 @@ const configDir = path.join(DATA_DIR, "config");
 await fs.mkdir(historyDir, { recursive: true }).catch(() => {});
 await fs.mkdir(configDir, { recursive: true }).catch(() => {});
 
-await initHistory({ dataDir: DATA_DIR });
+await initHistory({ dataDir: DATA_DIR, mode: RECAP_MODE });
 
 // Per-install identity for the upcoming relay backend. Generated once
 // on first boot, persisted in DATA_DIR. Surfaced via /api/health and
@@ -102,21 +157,258 @@ await initCookies({ dataDir: DATA_DIR, envPath });
 // from /data/config/startos-config.json (set via the "Set Admin
 // Password" StartOS action) and refreshes on the same poll cadence as
 // config.js. When no hash is set, the gate is a no-op.
-await initAdminAuth({ dataDir: DATA_DIR });
+//
+// Single-mode only. In multi-tenant mode the operator authenticates as
+// a regular user (is_admin = 1) via magic-link, so the legacy admin
+// gate is bypassed entirely.
+if (RECAP_MODE === "single") {
+  await initAdminAuth({ dataDir: DATA_DIR });
+}
+
+// ── Multi-tenant store + outbound mail ─────────────────────────────────
+// Only initialized when RECAP_MODE === 'multi'. Lazy-imported so the
+// single-mode boot never touches the native better-sqlite3 binding or
+// loads nodemailer.
+if (RECAP_MODE === "multi") {
+  const { initDb } = await import("./db.js");
+  const { initSmtp } = await import("./smtp.js");
+  await initDb({ dataDir: DATA_DIR });
+  initSmtp();
+  // One-time migration: pre-0.2.77 single-mode installs wrote
+  // /data/history/*.json flat. Move them into /data/history/owner/ so
+  // they're addressable under a scope. Idempotent (sentinel-guarded).
+  try {
+    await migrateLegacyLibrary();
+  } catch (err) {
+    console.warn("[boot] migrateLegacyLibrary failed:", err);
+  }
+
+  // Fixup for installs upgraded from <0.2.91: the first admin signup
+  // used to rename /data/history/owner/ → /data/history/<admin_user_id>/.
+  // The new convention is admin → always "owner" so multi↔single mode
+  // switching is reversible. If the legacy rename happened, reverse it
+  // here. Idempotent — runs only when the data layout requires it.
+  try {
+    const { reclaimAdminLibraryToOwner } = await import("./history.js");
+    const { getDb } = await import("./db.js");
+    await reclaimAdminLibraryToOwner({ db: getDb() });
+  } catch (err) {
+    console.warn("[boot] reclaimAdminLibraryToOwner failed:", err);
+  }
+}
 
 // resolveApiKey moved to ./config.js
 
 app.use(cors());
 app.use(express.json({ limit: "100mb" }));
 
-// ── Admin login gate ───────────────────────────────────────────────────────
+// ── Tenant auth (multi-mode) / synthetic owner (single-mode) ───────────
+// MUST run before every other /api/* middleware so downstream handlers
+// can rely on req.userId being populated. In single mode the middleware
+// is a no-op shim that stamps req.userId="owner". In multi mode it
+// validates the recap_session cookie and 401s non-public paths.
+app.use(buildTenantAuthMiddleware({ mode: RECAP_MODE }));
+
+// Single-mode whoami stub. Lets the frontend probe what mode it's
+// running in WITHOUT branching on a separate config endpoint. In
+// single mode every "user" is the operator, so always state:signed_in
+// with is_admin:true — the existing settings UI is the right thing to
+// render for them.
+if (RECAP_MODE === "single") {
+  app.get("/api/account/whoami", (req, res) => {
+    res.json({
+      recap_mode: "single",
+      state: "signed_in",
+      user: { id: "owner", is_admin: true, has_license: true },
+    });
+  });
+}
+
+// ── Magic-link auth + whoami (multi mode only) ──────────────────────────
+// /auth/request-link, /auth/verify, /auth/signout, /api/account/whoami.
+// These have to be registered AFTER the tenant-auth middleware (so the
+// public-path bypass routes them past the 401 gate) but BEFORE any
+// /api/* route that assumes req.userId is set.
+if (RECAP_MODE === "multi") {
+  const { setupAuthRoutes } = await import("./auth-routes.js");
+  const { setupAdminRoutes } = await import("./admin-routes.js");
+  const { setupAccountRoutes } = await import("./account-routes.js");
+  const { setupBillingRoutes } = await import("./billing-routes.js");
+  setupAuthRoutes(app);
+  // Account routes (per-user session management). Mount before admin
+  // routes so request-handler order is predictable; both use different
+  // paths so no conflict.
+  setupAccountRoutes(app);
+  // Admin routes (tenant list, grant credits, recent-signups). Every
+  // route inside is wrapped in requireOperator — non-admins hit 403.
+  setupAdminRoutes(app);
+  // Self-serve purchase: POST /api/billing/buy + GET /api/billing/status.
+  // A signed-in Core user buys their own Pro/Max period via the relay's
+  // BTCPay invoice. Multi-mode only (single-mode operators carry a
+  // license, not a relay-owned cloud tier).
+  setupBillingRoutes(app);
+  // Expiry-reminder emails: a daily scan asks the relay who's expiring and
+  // emails them via the recaps.cc SMTP transport. Self-gates on SMTP +
+  // public URL + relay being configured, so it's a safe no-op until then.
+  const { startReminderScheduler } = await import("./subscription-reminders.js");
+  startReminderScheduler();
+
+  // /api/account/whoami — frontend hits this on every page load to
+  // determine which UI state to render:
+  //   - signed-in user        → full app
+  //   - active trial w/budget → app + "N trials left" badge
+  //   - trial exhausted       → sign-up screen
+  //   - no cookies            → landing page (paste-and-try)
+  app.get("/api/account/whoami", async (req, res) => {
+    const base = { recap_mode: "multi" };
+    if (req.user) {
+      // Self-healing sweep: if the user paid for credits but the
+      // BTCPay redirect killed the frontend poller before /api/credits/
+      // invoice/:id could fire, the pending_purchases row stays
+      // unapplied. Catch it up here so the very next whoami call
+      // (every page load) reflects the correct balance.
+      try {
+        await sweepUnappliedPurchases({
+          buyerType: "user",
+          buyerId: req.user.id,
+          req,
+        });
+      } catch (err) {
+        console.warn(
+          `[whoami] purchase sweep failed for user ${req.user.id}: ${err?.message || err}`,
+        );
+      }
+      return res.json({
+        ...base,
+        state: "signed_in",
+        user: {
+          id: req.user.id,
+          email: req.user.email,
+          display_name: req.user.display_name,
+          is_admin: !!req.user.is_admin,
+          has_license: !!req.user.keysat_license,
+          has_password: !!req.user.password_hash,
+          created_at: req.user.created_at,
+        },
+      });
+    }
+    if (req.trial) {
+      // Same sweep for anon visitors who bought a credit pack — apply
+      // any settled invoices to anon_trials.credits_total before we
+      // compute credits_remaining for the response.
+      try {
+        await sweepUnappliedPurchases({
+          buyerType: "anon",
+          buyerId: req.trial.cookie_id,
+          req,
+        });
+        // Re-read the trial row so the response reflects any credits
+        // just applied by the sweep.
+        const { lookupTrial } = await import("./anon-trial.js");
+        const refreshed = lookupTrial(req.trial.cookie_id);
+        if (refreshed) req.trial = refreshed;
+      } catch (err) {
+        console.warn(
+          `[whoami] purchase sweep failed for trial ${req.trial.cookie_id}: ${err?.message || err}`,
+        );
+      }
+      return res.json({
+        ...base,
+        state: "trial",
+        trial: {
+          credits_total: req.trial.credits_total,
+          credits_used: req.trial.credits_used,
+          credits_remaining:
+            req.trial.credits_total - req.trial.credits_used,
+        },
+      });
+    }
+    // Anonymous — include the operator-configured trial allowance AND
+    // the post-signup grant so the UI can compose dynamic copy on the
+    // tier signup modal ("3 trial credits, +5 more on signup" vs
+    // "your trial credits transfer over"). Without exposing both, the
+    // Free card has to hardcode a number that goes stale the moment
+    // an operator tunes their config.
+    //
+    // ALSO check whether this visitor's IP is at the lifetime
+    // trials_per_ip_lifetime cap. If yes, force available_trial_credits
+    // to 0 and stamp a trial_blocked_reason so the UI can swap the
+    // misleading "N free credits ready" pill for "you've used your
+    // free trial — sign up or buy credits" copy. Without this gate
+    // the pill advertises credits the visitor literally cannot mint
+    // (anon-trial.js's issueIfEligible() will refuse), the user
+    // submits a video, the relay rejects, and they see a confusing
+    // "Processing failed" with the player half-loaded.
+    let availableTrialCredits = 0;
+    let signupGrantCredits = 0;
+    let trialBlockedReason = null;
+    try {
+      const snap = await getConfigSnapshot();
+      availableTrialCredits = Math.max(
+        0,
+        parseInt(snap?.trial_credits_per_visitor ?? 1, 10) || 0,
+      );
+      signupGrantCredits = Math.max(
+        0,
+        parseInt(snap?.tenant_default_credits ?? 0, 10) || 0,
+      );
+      // IP cap check — only meaningful in multi mode where the
+      // anon-trial system exists. Lazy-import so single-mode doesn't
+      // pull the trial DB in unnecessarily.
+      if (availableTrialCredits > 0 && RECAP_MODE === "multi") {
+        try {
+          const { getClientIp, ipTrialsLifetime } =
+            await import("./anon-trial.js");
+          const ip = getClientIp(req);
+          const perIpLifetime = Math.max(
+            1,
+            parseInt(
+              snap?.trials_per_ip_lifetime ?? snap?.trials_per_ip_per_day ?? 5,
+              10,
+            ) || 5,
+          );
+          if (ip && ipTrialsLifetime(ip) >= perIpLifetime) {
+            availableTrialCredits = 0;
+            trialBlockedReason = "ip_cap_reached";
+          }
+        } catch (err) {
+          // best-effort — if the cap check fails we don't want to
+          // suddenly downgrade a legitimate visitor's pill to zero.
+          // Leave the configured value and log for diagnosis.
+          console.warn(
+            `[whoami] IP cap check failed: ${err?.message || err}`,
+          );
+        }
+      }
+    } catch {
+      // best-effort; fall through with 0 so UI degrades to "Sign in"
+      // CTA rather than a misleading "N free credits" badge.
+    }
+    res.json({
+      ...base,
+      state: "anonymous",
+      available_trial_credits: availableTrialCredits,
+      signup_grant_credits: signupGrantCredits,
+      // Set only when the visitor's IP can't mint a new trial cookie.
+      // The frontend uses this to swap the "N free credits ready"
+      // pill for an honest "trial used up — sign up / buy" CTA AND
+      // to refuse the optimistic submit-flow (no video player
+      // render, no fake processing status).
+      trial_blocked_reason: trialBlockedReason,
+    });
+  });
+}
+
+// ── Admin login gate (single mode only) ─────────────────────────────────
 // MUST run before the license middleware: if an admin password is set,
 // nobody (licensed or not) reaches the activation flow without first
 // passing the login. Endpoints needed by the login UI itself
 // (/api/admin/status, /api/admin/login, /api/admin/logout) and
 // /api/health stay open.
-setupAdminAuthMiddleware(app);
-setupAdminAuthRoutes(app);
+if (RECAP_MODE === "single") {
+  setupAdminAuthMiddleware(app);
+  setupAdminAuthRoutes(app);
+}
 
 // ── Keysat licensing ────────────────────────────────────────────────────────
 // All license-aware request handling (gate, Pro feature gates, /api/license
@@ -125,12 +417,36 @@ setupAdminAuthRoutes(app);
 // licenseMW.LIC (a live binding).
 setupLicenseMiddleware(app);
 setupLicenseRoutes(app);
+// In-app purchase flow: proxies Keysat's public policies + purchase
+// + poll endpoints so the buy page renders in Recap's own visual
+// style instead of being redirected to Keysat's hosted /buy/<slug>
+// page. On a settled invoice the issued license is written to disk
+// and licenseMW.refreshLicenseOnline picks it up immediately.
+setupLicensePurchaseRoutes(app, {
+  onLicenseActivated: () => licenseMW.refreshLicenseOnline("post-purchase"),
+});
+// Credit-purchase proxy: lets the buyer top-up relay credits via the
+// operator's BTCPay store. All BTCPay credentials live on the relay
+// — Recap just forwards the buyer's pick and proxies the polling.
+setupCreditsPurchaseRoutes(app);
 startLicenseRefresh();
 
+// Boot-time fetch of the relay's /relay/capabilities so the chunking
+// decision in /api/process can honor the operator's current backend
+// preference. Refreshes hourly. Safe defaults are used until the
+// first successful fetch lands.
+startRelayCapabilitiesRefresh();
+
 // History storage + routes moved to ./history.js
 // (saveToHistory, loadMeta, saveMeta are imported above)
-// Late-bound addToSkipList — defined later in this file for now.
-setupHistoryRoutes(app, { addToSkipList: (id) => addToSkipList(id) });
+// addToSkipList is scope-keyed (./subscriptions.js): deleting a session
+// suppresses re-queueing that video in the SAME scope's subscriptions.
+setupHistoryRoutes(app, { addToSkipList: (scope, id) => addToSkipList(scope, id) });
+
+// Audio-first ("walking mode") TTS routes — synthesize + cache + serve
+// per-topic summary clips. Self-gates access (Max in multi mode); the
+// /api/tts prefix is license-exempt so the route's own gate decides.
+setupTtsRoutes(app);
 
 // Serve the frontend from ../public
 app.use(express.static(path.join(__dirname, "..", "public")));
@@ -223,16 +539,163 @@ app.get("/api/relay/policy", async (_req, res) => {
 // operator-controlled at build time, never user-configurable.
 app.get("/api/relay/status", async (req, res) => {
   const configured = !!relayDefault.getRelayBaseURL();
-  let snapshot = relayState.getRelayState();
+
+  // ── Multi-mode: return per-user credit view ────────────────────────────
+  // Each user role sees a different "credits remaining" number:
+  //   - trial:      trial.credits_total - trial.credits_used (local)
+  //   - free tenant: tenant_credits.balance (local, set by operator)
+  //   - paid user:  their relay-pool balance (relay-side, license-keyed)
+  //   - admin:      the operator's relay pool (current single-mode behavior)
+  //   - anonymous:  no credits to show; configured + null balance
+  //
+  // The frontend reads `creditsRemaining` and `tier` and renders a
+  // single badge. We construct the right shape for the requester here.
+  if (RECAP_MODE === "multi" && !(req.user && req.user.is_admin)) {
+    // Anonymous + no trial cookie at all.
+    if (!req.user && !req.trial) {
+      return res.json({
+        configured,
+        creditsRemaining: null,
+        tier: null,
+        scope: "anonymous",
+        lastUpdated: Date.now(),
+        lastError: null,
+      });
+    }
+    // Self-healing sweep — catch any settled-but-unapplied credit
+    // purchases for this buyer before we report their balance. Without
+    // it, an anon or signed-in user who pays via BTCPay but loses the
+    // poll loop on redirect sees a stale balance until they manually
+    // re-trigger the apply (which there's no UI for). Cheap: bounded
+    // query (5 invoices, 30-min lookback) + short-timeout relay calls.
+    try {
+      if (req.user) {
+        await sweepUnappliedPurchases({
+          buyerType: "user",
+          buyerId: req.user.id,
+          req,
+        });
+      } else if (req.trial) {
+        await sweepUnappliedPurchases({
+          buyerType: "anon",
+          buyerId: req.trial.cookie_id,
+          req,
+        });
+        // Re-read trial row so the response uses post-sweep credits.
+        const { lookupTrial } = await import("./anon-trial.js");
+        const refreshed = lookupTrial(req.trial.cookie_id);
+        if (refreshed) req.trial = refreshed;
+      }
+    } catch (err) {
+      console.warn(
+        `[relay/status] purchase sweep failed: ${err?.message || err}`,
+      );
+    }
+    // Trial visitor.
+    if (req.trial) {
+      const remaining = Math.max(
+        0,
+        (req.trial.credits_total || 0) - (req.trial.credits_used || 0),
+      );
+      return res.json({
+        configured,
+        creditsRemaining: remaining,
+        tier: "trial",
+        scope: "trial",
+        lastUpdated: Date.now(),
+        lastError: null,
+      });
+    }
+    // Core-decoupling: a user's paid status is their relay-owned tier
+    // (req.user.tier), NOT any leftover Keysat license. A PAID cloud user
+    // (tier pro/max) falls through to the real relay ping below, which
+    // pickRelayIdentity routes to their cloud user:<id> pool. Everyone
+    // else signed in is a free tenant on the operator pool — regardless of
+    // whether they still carry a legacy license (which is now ignored).
+    const isPaidCloudUser =
+      req.user && (req.user.tier === "pro" || req.user.tier === "max");
+    // Free tenant. Lazy replenish-check happens inside getOrInit, so the
+    // displayed balance reflects any due refill.
+    if (req.user && !isPaidCloudUser) {
+      try {
+        const { getOrInit } = await import("./tenant-credits.js");
+        const credits = await getOrInit(req.user.id);
+        return res.json({
+          configured,
+          creditsRemaining: credits?.total ?? 0,
+          // Surface the bucket split so the UI can show "5 free + 10
+          // purchased = 15 total" if it wants. Frontend currently
+          // just reads creditsRemaining; the extra fields are
+          // additive.
+          purchasedBalance: credits?.purchased ?? 0,
+          replenishBalance: credits?.replenish ?? 0,
+          replenishPeriod: credits?.period ?? "off",
+          tier: "free",
+          scope: "free_tenant",
+          lastUpdated: Date.now(),
+          lastError: null,
+        });
+      } catch (err) {
+        console.warn("[relay/status] tenant_credits lookup failed:", err);
+        return res.json({
+          configured,
+          creditsRemaining: null,
+          tier: "free",
+          scope: "free_tenant",
+          lastUpdated: Date.now(),
+          lastError: "balance_unknown",
+        });
+      }
+    }
+    // Paid cloud user (tier pro/max) — fall through to the real relay
+    // ping. pickRelayIdentity routes it to their cloud user:<id> identity
+    // (or the operator pool if the operator key isn't configured), so the
+    // response reflects the pool their calls actually bill.
+  }
+
+  // Determine which credit-key this request would use against the relay.
+  // The relay-state cache is keyed by the same value so each (operator
+  // / paid user) gets its own snapshot — no more clobbering when an
+  // admin and a tenant hit the endpoint in the same Node process.
+  // Constructs a temporary provider just to inherit its creditKey
+  // logic; cheap (no network).
+  const identityCfg = await getConfigSnapshot();
+  const probeOpts = resolveProviderOpts("relay", {
+    config: identityCfg,
+    clientOpts: {},
+    req,
+  });
+  const requestCreditKey = relayState.computeCreditKey({
+    // Cloud (core-decoupling) identity keys by userId; license/install
+    // identities key by their respective fields. probeOpts carries
+    // exactly one of these shapes depending on pickRelayIdentity, so
+    // pass all three — computeCreditKey picks userId → license → install
+    // in priority order, matching what the provider records under.
+    installId: probeOpts.installId,
+    licenseKey: probeOpts.licenseKey,
+    userId: probeOpts.userId,
+  });
+
+  let snapshot = relayState.getRelayState(requestCreditKey);
   const wantsRefresh = req.query.refresh === "1" || req.query.refresh === "true";
   const cacheEmpty = snapshot.creditsRemaining === null && snapshot.tier === null;
-  if (configured && (cacheEmpty || wantsRefresh)) {
+  // Auto-refresh stale cache. Without this, /api/relay/status returns
+  // whatever was last cached forever, missing balance changes that
+  // happen outside Recap's request flow — e.g. an operator-side
+  // BTCPay webhook crediting purchased invoices, or the rescan tool
+  // in the relay dashboard. 10-second TTL is short enough that
+  // out-of-band changes show up promptly while still avoiding a
+  // ping on every dashboard render burst.
+  const STALE_THRESHOLD_MS = 10_000;
+  const cacheStale =
+    !cacheEmpty &&
+    typeof snapshot.lastUpdated === "number" &&
+    Date.now() - snapshot.lastUpdated > STALE_THRESHOLD_MS;
+  if (configured && (cacheEmpty || wantsRefresh || cacheStale)) {
     try {
-      const cfg = await getConfigSnapshot();
-      const opts = resolveProviderOpts("relay", { config: cfg, clientOpts: {} });
-      const provider = getProvider("relay", opts);
+      const provider = getProvider("relay", probeOpts);
       await provider.pingBalance({ timeoutMs: 5000 });
-      snapshot = relayState.getRelayState();
+      snapshot = relayState.getRelayState(requestCreditKey);
     } catch (err) {
       // Log + record so the UI shows a real error instead of a silent
       // "balance unknown". The provider call itself records when the
@@ -242,8 +705,8 @@ app.get("/api/relay/status", async (req, res) => {
       console.error(
         `[relay/status] ping failed: ${err?.message || err} (stack: ${err?.stack || "n/a"})`
       );
-      relayState.recordRelayError(err?.message || String(err));
-      snapshot = relayState.getRelayState();
+      relayState.recordRelayError(err?.message || String(err), requestCreditKey);
+      snapshot = relayState.getRelayState(requestCreditKey);
     }
   }
   res.json({ ...snapshot, configured });
@@ -286,19 +749,10 @@ setupLibraryRoutes(app);
 
 
 // ── Subscriptions ─────────────────────────────────────────────────────────
-
-const subsPath = path.join(historyDir, "subscriptions.json");
-
-async function loadSubscriptions() {
-  try {
-    return JSON.parse(await fs.readFile(subsPath, "utf-8")).subscriptions || [];
-  } catch {
-    return [];
-  }
-}
-async function saveSubscriptions(subs) {
-  await fs.writeFile(subsPath, JSON.stringify({ subscriptions: subs }, null, 2));
-}
+// Storage (subscriptions / skip / seen / auto-queue) + dedup live in
+// ./subscriptions.js, keyed by scope. Endpoints pass scopeForRequest(req);
+// the check loop + processor operate on SUBSCRIPTIONS_SCOPE ("owner") while
+// the feature is operator-only in multi mode.
 
 // List recent videos from a channel/playlist via yt-dlp (no download)
 // Uses --flat-playlist for speed; returns id + title (no upload_date in flat mode)
@@ -425,6 +879,58 @@ function isPodcastFeedUrl(url) {
   return false;
 }
 
+// Apple Podcasts SHOW URL — the whole-podcast page, no `?i=<id>`
+// episode parameter. Format:
+//   https://podcasts.apple.com/<country>/podcast/<slug>/id<num>
+// We do prefix-match via regex, then USE URL PARSING to confirm no
+// `i` query param (the episode discriminator). The earlier all-regex
+// version had a misplaced negative lookahead that matched episode
+// URLs too, sending episode links into the subscribe flow by mistake.
+const APPLE_PODCAST_PREFIX_RE =
+  /^https?:\/\/(?:www\.)?podcasts\.apple\.com\/[^/]+\/podcast\/[^/]+\/id(\d+)/i;
+
+function isAppleShowUrl(url) {
+  if (!url) return false;
+  const trimmed = url.trim();
+  if (!APPLE_PODCAST_PREFIX_RE.test(trimmed)) return false;
+  try {
+    const parsed = new URL(trimmed);
+    // Episode URLs have `?i=<id>` (or `&i=<id>`). Anything else is
+    // the show landing page.
+    return !parsed.searchParams.has("i");
+  } catch {
+    return false;
+  }
+}
+
+// Legacy alias — the regex's first capture group is still used to
+// pull the podcast id in resolveAppleShowToFeed below. Keep it named
+// to avoid splitting that helper into two regex+parse blocks.
+const APPLE_SHOW_URL_RE = APPLE_PODCAST_PREFIX_RE;
+
+// Resolve an Apple Podcasts show URL to its RSS feed URL via the
+// public iTunes Lookup API. No auth required. Returns the feedUrl
+// string or null if Apple doesn't have a usable RSS URL on file
+// (rare — shows distributed only via Apple-exclusive feeds, mostly
+// Apple Podcast Subscriptions paid content).
+async function resolveAppleShowToFeed(url) {
+  const m = url.match(APPLE_SHOW_URL_RE);
+  if (!m) return null;
+  const podcastId = m[1];
+  try {
+    const raw = await fetchUrl(
+      `https://itunes.apple.com/lookup?id=${encodeURIComponent(podcastId)}`,
+    );
+    const parsed = JSON.parse(raw);
+    const show = (parsed?.results || []).find(
+      (r) => r && r.wrapperType === "track" && r.kind === "podcast",
+    );
+    return show?.feedUrl || null;
+  } catch {
+    return null;
+  }
+}
+
 // Fetch and parse a podcast RSS feed → returns { title, episodes: [{ id, title, date, audioUrl, duration }] }
 async function parsePodcastRSS(feedUrl, limit = 200) {
   const xml = await fetchUrl(feedUrl);
@@ -519,98 +1025,46 @@ async function fetchChannelName(url) {
   return "Unknown Channel";
 }
 
-// ── In-process write serialization ────────────────────────────────────────
-// Per-file promise chain to prevent lost-update races on read-modify-write
-// state files (skip-list, seen-list). Without this, two concurrent DELETE
-// handlers can each load the same snapshot, add their own id, and the
-// second write overwrites the first — silently dropping entries.
-const _fileLocks = new Map();
-function withFileLock(key, fn) {
-  const prev = _fileLocks.get(key) || Promise.resolve();
-  const next = prev.then(fn, fn); // run fn whether prev resolved or rejected
-  // Keep the chain alive but don't leak errors to the next caller
-  _fileLocks.set(key, next.catch(() => {}));
-  return next;
-}
+// Subscription storage (subscriptions / skip / seen / auto-queue), the
+// dedup, scope enumeration, and the file-locking that serializes
+// read-modify-writes all live in ./subscriptions.js now — scope-keyed and
+// unit-tested. getProcessedVideoIds(scope) + isKnownVideo() are the dedup
+// that keeps the auto-queue from re-offering already-handled videos.
+//
+// While subscriptions are operator-only in multi mode, the check loop +
+// background processor operate on this scope. Endpoints use
+// scopeForRequest(req) (= "owner" for the operator). Per-tenant flips these
+// to each user's scope — see docs/per-tenant-subscriptions-plan.md.
+const SUBSCRIPTIONS_SCOPE = "owner";
 
-// Skip list — videos deleted from history that subscriptions should not re-add
-const skipPath = path.join(historyDir, "skip-list.json");
-
-async function loadSkipList() {
-  try {
-    return new Set(JSON.parse(await fs.readFile(skipPath, "utf-8")).videoIds || []);
-  } catch {
-    return new Set();
-  }
-}
-
-async function addToSkipList(videoId) {
-  return withFileLock(skipPath, async () => {
-    const skipIds = await loadSkipList();
-    skipIds.add(videoId);
-    await fs.writeFile(skipPath, JSON.stringify({ videoIds: [...skipIds] }));
+// Prune auto-queue items that have since been summarized (e.g. cleared from
+// the queue then re-discovered by a check). Runs per scope at boot, after
+// the migration. The scope-aware getProcessedVideoIds is what makes this
+// work — it used to scan the wrong directory and prune nothing.
+async function reconcileAutoQueueWithLibrary(scope) {
+  const processed = await getProcessedVideoIds(scope);
+  let removed = 0;
+  await mutateAutoQueue(scope, (items) => {
+    const before = items.length;
+    const kept = items.filter((q) => !processed.has(q.videoId));
+    removed = before - kept.length;
+    return kept;
   });
-}
-
-// Seen list — videos already offered for approval (persists across restarts)
-const seenPath = path.join(historyDir, "seen-list.json");
-
-async function loadSeenList() {
-  try {
-    return new Set(JSON.parse(await fs.readFile(seenPath, "utf-8")).videoIds || []);
-  } catch {
-    return new Set();
+  if (removed > 0) {
+    console.log(
+      `  Auto-queue (${scope}): removed ${removed} already-processed item(s)`,
+    );
   }
 }
 
-async function addToSeenList(videoIds) {
-  return withFileLock(seenPath, async () => {
-    const seen = await loadSeenList();
-    for (const id of videoIds) seen.add(id);
-    await fs.writeFile(seenPath, JSON.stringify({ videoIds: [...seen] }));
-  });
-}
-
-// Get all videoIds already processed in history
-async function getProcessedVideoIds() {
-  const ids = new Set();
-  try {
-    const files = await fs.readdir(historyDir);
-    for (const file of files.filter(f => f.endsWith(".json") && f !== "_meta.json" && f !== "subscriptions.json" && f !== "skip-list.json" && f !== "seen-list.json" && f !== "auto-queue.json")) {
-      try {
-        const raw = await fs.readFile(path.join(historyDir, file), "utf-8");
-        const data = JSON.parse(raw);
-        if (data.videoId) ids.add(data.videoId);
-      } catch {}
-    }
-  } catch {}
-  return ids;
-}
-
-// Server-side auto-queue for subscription-discovered videos (persisted to disk)
-const autoQueuePath = path.join(historyDir, "auto-queue.json");
-let autoQueue = [];
-
-async function loadAutoQueue() {
-  try {
-    const data = JSON.parse(await fs.readFile(autoQueuePath, "utf-8"));
-    return data.items || [];
-  } catch { return []; }
-}
-async function saveAutoQueue() {
-  await fs.writeFile(autoQueuePath, JSON.stringify({ items: autoQueue }, null, 2));
-}
-
-// Load persisted queue on startup, filtering out already-processed items
-autoQueue = await loadAutoQueue();
-{
-  const processed = await getProcessedVideoIds();
-  const before = autoQueue.length;
-  autoQueue = autoQueue.filter(q => !processed.has(q.videoId));
-  if (autoQueue.length < before) {
-    console.log(`  Auto-queue: removed ${before - autoQueue.length} already-processed item(s)`);
-    await saveAutoQueue();
-  }
+// Which user's identity the processor assumes to run a scope's items over
+// the authenticated loopback /api/process call. Single mode → null (no auth;
+// the loopback resolves to "owner"). Multi mode: "owner" → the operator;
+// a tenant scope IS that user's id.
+function userIdForScope(scope) {
+  if (RECAP_MODE !== "multi") return null;
+  if (scope === "owner") return adminUserId();
+  return scope;
 }
 
 // ── Background processing queue ──────────────────────────────────────────
@@ -647,6 +1101,18 @@ async function saveProcessingConfig() {
 }
 await loadProcessingConfig();
 
+// Find the next approved item across every scope's auto-queue. Returns
+// { scope, item } (owner scope first, then tenants) or null when none.
+async function findNextApprovedItem() {
+  const scopes = await listAutoQueueScopes();
+  for (const scope of scopes) {
+    const queue = await loadAutoQueue(scope);
+    const item = queue.find((q) => q.status === "approved");
+    if (item) return { scope, item };
+  }
+  return null;
+}
+
 // The background processor: picks "approved" items, processes via internal HTTP,
 // waits the configured delay, then picks the next one. Runs continuously.
 async function backgroundProcessor() {
@@ -655,14 +1121,17 @@ async function backgroundProcessor() {
   procLog("Background processor started");
 
   while (true) {
-    // Find next approved item
-    const item = autoQueue.find(q => q.status === "approved");
-    if (!item) {
-      procLog("No approved items in queue — processor sleeping");
+    // Find the next approved item across every owner's queue (a scope can
+    // hold queued items even with no current subscriptions). Each item is
+    // processed AS its owner — see processItemInternally(item, scope).
+    const next = await findNextApprovedItem();
+    if (!next) {
+      procLog("No approved items in any queue — processor sleeping");
       processingState.running = false;
       processingState.currentItem = null;
       return;
     }
+    const { scope, item } = next;
 
     if (!processingConfig.enabled) {
       procLog("Processing is paused — processor sleeping");
@@ -679,64 +1148,138 @@ async function backgroundProcessor() {
     }
     processingState.rush = false;
 
-    // Re-check the item hasn't been removed/changed while we waited
-    const freshItem = autoQueue.find(q => q.id === item.id);
-    if (!freshItem || freshItem.status !== "approved") {
+    // Atomically claim the item: re-check it's still approved (it may have
+    // been removed/changed while we waited) and flip it to "processing".
+    let claimed = null;
+    await mutateAutoQueue(scope, (items) => {
+      const it = items.find((q) => q.id === item.id);
+      if (it && it.status === "approved") {
+        it.status = "processing";
+        claimed = { ...it };
+      }
+    });
+    if (!claimed) {
       procLog(`Item ${item.id} was removed or status changed — skipping`);
       continue;
     }
+    processingState.currentItem = claimed;
+    procLog(`Processing: ${claimed.title} (${claimed.url})`);
 
-    // Mark as processing
-    freshItem.status = "processing";
-    processingState.currentItem = freshItem;
-    await saveAutoQueue();
-    procLog(`Processing: ${freshItem.title} (${freshItem.url})`);
-
+    let result = null;
+    let errMsg = null;
     try {
-      // Call the existing /api/process endpoint via internal HTTP request
-      const result = await processItemInternally(freshItem);
-      freshItem.status = "completed";
-      freshItem.completedAt = new Date().toISOString();
-      freshItem.historyId = result.historyId || null;
+      // Call /api/process via loopback, AS the scope's owner.
+      result = await processItemInternally(claimed, scope);
       processingState.lastCompleted = new Date().toISOString();
-      procLog(`✓ Completed: ${freshItem.title}`);
+      procLog(`✓ Completed: ${claimed.title}`);
     } catch (err) {
-      freshItem.status = "failed";
-      freshItem.error = err.message || String(err);
-      freshItem.failedAt = new Date().toISOString();
-      procLog(`✗ Failed: ${freshItem.title} — ${freshItem.error.slice(0, 200)}`);
+      errMsg = err.message || String(err);
+      procLog(`✗ Failed: ${claimed.title} — ${errMsg.slice(0, 200)}`);
     }
 
+    // Write the terminal status back atomically.
+    await mutateAutoQueue(scope, (items) => {
+      const it = items.find((q) => q.id === item.id);
+      if (!it) return;
+      if (errMsg) {
+        it.status = "failed";
+        it.error = errMsg;
+        it.failedAt = new Date().toISOString();
+      } else {
+        it.status = "completed";
+        it.completedAt = new Date().toISOString();
+        it.historyId = (result && result.historyId) || null;
+      }
+    });
     processingState.currentItem = null;
-    await saveAutoQueue();
   }
 }
 
 // Internal HTTP request to /api/process — consumes the SSE stream and
 // waits for the "result" or "error" event. This reuses the entire existing
 // pipeline without any code duplication.
-function processItemInternally(item) {
+function processItemInternally(item, scope) {
   return new Promise((resolve, reject) => {
-    const apiKey = resolveApiKey(null); // Use server's stored key
-    if (!apiKey) {
-      return reject(new Error("No API key configured. Set your Gemini API key in Settings."));
+    // Pick a provider for the auto-queue run. Historically this
+    // function hard-required a server-side Gemini API key (legacy
+    // pre-relay-as-provider design), so a user with the relay set
+    // up but no Gemini key would silently fail here — the request
+    // never even reached /api/process and the failure only landed
+    // in the in-memory processingState.log, invisible to the
+    // dashboard. That broke subscription auto-processing for every
+    // relay-only user.
+    //
+    // New behavior: prefer the relay (the modern default for fresh
+    // installs and the most common config), fall back to Gemini
+    // when only a local key is configured, and fail with a clear,
+    // user-visible error when neither is set. The frontend stores
+    // the user's actual preference in localStorage which the server
+    // can't read — picking based on what's CONFIGURED here mirrors
+    // the practical reality (the relay is the only modern option
+    // that doesn't require a key) and matches the interactive
+    // experience for relay users.
+    const relayConfigured = !!relayDefault.getRelayBaseURL();
+    const geminiKey = resolveApiKey(null);
+    let transcriptionProvider, analysisProvider;
+    if (relayConfigured) {
+      transcriptionProvider = "relay";
+      analysisProvider = "relay";
+    } else if (geminiKey) {
+      transcriptionProvider = "gemini";
+      analysisProvider = "gemini";
+    } else {
+      return reject(
+        new Error(
+          "No transcribe/analyze provider is configured. Set the Recap Relay URL in Settings, or paste a Gemini API key.",
+        ),
+      );
     }
 
     const body = JSON.stringify({
       url: item.url,
+      // Only used by the Gemini provider; harmless for the relay
+      // path (relay provider ignores this field).
       apiKey: "USE_SERVER_KEY",
       type: item.type || undefined,
       title: item.title || undefined,
       uploadDate: item.uploadDate || undefined,
       episodeId: item.videoId || undefined,
+      transcriptionProvider,
+      transcriptionModel:
+        transcriptionProvider === "relay" ? "relay-default" : undefined,
+      analysisProvider,
+      analysisModel:
+        analysisProvider === "relay" ? "relay-default" : undefined,
     });
 
+    // Per-tenant: assume the owning user's identity for this loopback call
+    // so /api/process gates, bills, and saves to the right account. Single
+    // mode needs no cookie (the loopback resolves to "owner"). A short-lived
+    // real session is minted here and deleted on every exit path below.
+    const headers = {
+      "Content-Type": "application/json",
+      "Content-Length": Buffer.byteLength(body),
+    };
+    let internalSession = null;
+    const ownerUserId = userIdForScope(scope);
+    if (ownerUserId) {
+      try {
+        internalSession = mintInternalSession(ownerUserId);
+        headers["Cookie"] = `${SESSION_COOKIE}=${internalSession}`;
+      } catch (err) {
+        return reject(
+          new Error(`Could not establish processing identity: ${err?.message || err}`),
+        );
+      }
+    }
+    const cleanup = () => deleteInternalSession(internalSession);
+
     const req = http.request({
       hostname: "127.0.0.1",
       port: PORT,
       path: "/api/process",
       method: "POST",
-      headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) },
+      headers,
       timeout: 1800000, // 30 minutes max for very long videos
     }, (res) => {
       let buffer = "";
@@ -771,6 +1314,7 @@ function processItemInternally(item) {
       });
 
       res.on("end", () => {
+        cleanup();
         if (lastError) {
           reject(new Error(lastError.message || "Processing failed"));
         } else if (lastResult) {
@@ -780,12 +1324,19 @@ function processItemInternally(item) {
         }
       });
 
-      res.on("error", reject);
+      res.on("error", (err) => {
+        cleanup();
+        reject(err);
+      });
     });
 
-    req.on("error", reject);
+    req.on("error", (err) => {
+      cleanup();
+      reject(err);
+    });
     req.on("timeout", () => {
       req.destroy();
+      cleanup();
       reject(new Error("Processing timed out after 30 minutes"));
     });
 
@@ -796,11 +1347,10 @@ function processItemInternally(item) {
 
 // Wake up the processor whenever there are approved items
 function kickProcessor() {
+  // Just start the loop if idle — it loads the queue itself and sleeps
+  // immediately if there's nothing approved, so no pre-check needed.
   if (!processingState.running && processingConfig.enabled) {
-    const hasApproved = autoQueue.some(q => q.status === "approved");
-    if (hasApproved) {
-      backgroundProcessor().catch(err => procLog(`Processor error: ${err.message}`));
-    }
+    backgroundProcessor().catch((err) => procLog(`Processor error: ${err.message}`));
   }
 }
 
@@ -832,22 +1382,52 @@ async function _checkSubscriptionsInner() {
     return;
   }
   subCheckLog = []; // Clear logs for fresh check
-  const subs = await loadSubscriptions();
-  if (subs.length === 0) { subLog("No subscriptions found"); return; }
+  // Operator-only in multi mode, so this resolves to ["owner"]. When
+  // per-tenant subscriptions ship it fans out to every subscribing tenant.
+  const scopes = await listSubscriptionScopes();
+  for (const scope of scopes) {
+    try {
+      await checkScopeSubscriptions(scope);
+    } catch (err) {
+      subLog(`⚠ Subscription check failed for scope ${scope}: ${err.message}`);
+    }
+  }
+}
 
-  const processedIds = await getProcessedVideoIds();
-  const skippedIds = await loadSkipList();
-  const seenIds = await loadSeenList();
-  const queuedIds = new Set(autoQueue.map(q => {
+// Discover + queue new videos for ONE scope's subscriptions. New items are
+// collected locally and appended to the scope's auto-queue atomically at the
+// end (mutateAutoQueue) so a concurrent endpoint mutation can't be lost.
+async function checkScopeSubscriptions(scope) {
+  const subs = await loadSubscriptions(scope);
+  if (subs.length === 0) { return; }
+
+  const processedIds = await getProcessedVideoIds(scope);
+  const skippedIds = await loadSkipList(scope);
+  const seenIds = await loadSeenList(scope);
+  const queue = await loadAutoQueue(scope);
+  // Dedup also against items already in the queue. queuedIds grows as we add
+  // within this run so the same video isn't queued twice across subs.
+  const queuedIds = new Set(queue.map(q => {
     // For YouTube: extract video ID from URL; for podcasts: use stored videoId (GUID)
     if (q.videoId) return q.videoId;
     const m = q.url.match(/[?&]v=([a-zA-Z0-9_-]{11})/);
     return m ? m[1] : null;
   }).filter(Boolean));
 
-  subLog(`${processedIds.size} in library, ${skippedIds.size} skipped, ${seenIds.size} seen, ${queuedIds.size} in queue`);
+  // Split queue counts into active (pending/approved/processing — what the
+  // UI shows) vs done (completed/failed — terminal, hidden by default). All
+  // four buckets feed dedup against newly discovered videos below.
+  const qActive = queue.filter(q => ["pending", "approved", "processing"].includes(q.status)).length;
+  const qCompleted = queue.filter(q => q.status === "completed").length;
+  const qFailed = queue.filter(q => q.status === "failed").length;
+  const qDone = qCompleted + qFailed;
+  subLog(`[${scope}] ${processedIds.size} in library, ${skippedIds.size} skipped, ${seenIds.size} seen — queue: ${qActive} active, ${qDone} done (${qCompleted} completed, ${qFailed} failed)`);
+  if (qFailed > 0) {
+    subLog(`  (queue has ${qFailed} failed item${qFailed === 1 ? "" : "s"} — open the Queue panel and toggle "Show all" to view + retry)`);
+  }
 
   let changed = false;
+  const newItems = []; // appended to the scope's queue atomically at the end
 
   for (const sub of subs) {
     if (sub.paused) { subLog(`⏸ ${sub.name} — paused, skipping`); continue; }
@@ -869,14 +1449,9 @@ async function _checkSubscriptionsInner() {
           continue;
         }
 
-        // Filter out already-known episodes
-        const unknowns = episodes.filter(ep => {
-          if (processedIds.has(ep.id)) return false;
-          if (queuedIds.has(ep.id)) return false;
-          if (skippedIds.has(ep.id)) return false;
-          if (seenIds.has(ep.id)) return false;
-          return true;
-        });
+        // Filter out already-known episodes (in library / queue / skip / seen)
+        const dedupSets = { processedIds, queuedIds, skippedIds, seenIds };
+        const unknowns = episodes.filter((ep) => !isKnownVideo(ep.id, dedupSets));
         const filtered = episodes.length - unknowns.length;
         subLog(`  ${unknowns.length} to check, ${filtered} already known`);
 
@@ -899,7 +1474,7 @@ async function _checkSubscriptionsInner() {
           subLog(`  ✅ ${ep.date} — ${ep.title.slice(0, 60)}`);
 
           const itemStatus = sub.autoDownload ? "approved" : "pending";
-          autoQueue.push({
+          newItems.push({
             id: `auto-${Date.now()}-${Buffer.from(ep.id).toString("base64url").slice(0, 16)}`,
             videoId: ep.id, // episode GUID
             url: ep.audioUrl,
@@ -915,7 +1490,7 @@ async function _checkSubscriptionsInner() {
           newCount++;
         }
 
-        if (seenNow.length > 0) await addToSeenList(seenNow);
+        if (seenNow.length > 0) await addToSeenList(scope, seenNow);
 
         sub.lastChecked = new Date().toISOString();
         subLog(`  → ${newCount} episode(s) queued for approval from ${sub.name}`);
@@ -940,13 +1515,9 @@ async function _checkSubscriptionsInner() {
           continue;
         }
 
-        const unknowns = candidates.filter(v => {
-          if (processedIds.has(v.id)) return false;
-          if (queuedIds.has(v.id)) return false;
-          if (skippedIds.has(v.id)) return false;
-          if (seenIds.has(v.id)) return false;
-          return true;
-        });
+        const unknowns = candidates.filter(
+          (v) => !isKnownVideo(v.id, { processedIds, queuedIds, skippedIds, seenIds }),
+        );
         const filtered = candidates.length - unknowns.length;
         subLog(`  ${unknowns.length} to check, ${filtered} already known`);
 
@@ -1022,7 +1593,7 @@ async function _checkSubscriptionsInner() {
           subLog(`  ✅ ${video.id}${uploadDate ? ` (${uploadDate})` : ""} — ${video.title.slice(0,50)}`);
 
           const ytItemStatus = sub.autoDownload ? "approved" : "pending";
-          autoQueue.push({
+          newItems.push({
             id: `auto-${Date.now()}-${video.id}`,
             videoId: video.id,
             url: `https://www.youtube.com/watch?v=${video.id}`,
@@ -1044,7 +1615,7 @@ async function _checkSubscriptionsInner() {
           if (d && d.length === 8 && d >= cutoffDate) return false;
           return earlyTermination;
         }).map(v => v.id);
-        if (seenNow.length > 0) await addToSeenList(seenNow);
+        if (seenNow.length > 0) await addToSeenList(scope, seenNow);
 
         sub.lastChecked = new Date().toISOString();
         subLog(`  → ${newCount} video(s) queued for approval from ${sub.name}`);
@@ -1055,22 +1626,43 @@ async function _checkSubscriptionsInner() {
     }
   }
 
-  const pendingCount = autoQueue.filter(q => q.status === "pending").length;
-  const approvedCount = autoQueue.filter(q => q.status === "approved").length;
-  subLog(`Done. ${pendingCount} pending, ${approvedCount} approved in auto-queue.`);
-  if (changed) await saveSubscriptions(subs);
-  await saveAutoQueue();
+  if (changed) await saveSubscriptions(scope, subs);
+  // Append everything discovered this run in one atomic mutation.
+  if (newItems.length > 0) {
+    await mutateAutoQueue(scope, (items) => {
+      items.push(...newItems);
+    });
+  }
 
-  // Wake up the background processor if there are approved items
+  const finalQueue = await loadAutoQueue(scope);
+  const pendingCount = finalQueue.filter(q => q.status === "pending").length;
+  const approvedCount = finalQueue.filter(q => q.status === "approved").length;
+  subLog(`[${scope}] Done. ${pendingCount} pending, ${approvedCount} approved in auto-queue.`);
+
+  // Wake up the background processor if there are approved items. (Behind
+  // the operator-only gate the processor works the "owner" queue, which is
+  // the only scope that reaches here.)
   if (approvedCount > 0) {
     subLog(`Kicking background processor for ${approvedCount} approved item(s)...`);
     kickProcessor();
   }
 }
 
+// Scope for a subscription / auto-queue request. Behind the operator-only
+// gate (license-middleware) this is always "owner" (admin in multi mode, or
+// single mode). Forward-compatible with per-tenant — it's just the signed-in
+// user's scope. Falls back to "owner" if scope resolution somehow fails.
+function subScope(req) {
+  try {
+    return scopeForRequest(req);
+  } catch {
+    return SUBSCRIPTIONS_SCOPE;
+  }
+}
+
 // CRUD endpoints
 app.get("/api/subscriptions", async (req, res) => {
-  const subs = await loadSubscriptions();
+  const subs = await loadSubscriptions(subScope(req));
   res.json({ subscriptions: subs });
 });
 
@@ -1098,12 +1690,39 @@ function channelKeyFromUrl(url) {
 }
 
 app.post("/api/subscriptions", async (req, res) => {
-  const { url, since, type, autoDownload } = req.body;
+  let { url, since, type, autoDownload } = req.body;
   if (!url) return res.status(400).json({ error: "Missing url" });
 
+  // Apple Podcasts SHOW URLs (`/podcast/<slug>/id<num>` with NO
+  // `?i=<id>` episode param) get resolved to the show's RSS feed
+  // before we persist the subscription. The feed URL is what the
+  // poll loop fetches to discover new episodes, so storing the
+  // landing-page URL would be a dead end.
+  if (isAppleShowUrl(url)) {
+    try {
+      const feed = await resolveAppleShowToFeed(url);
+      if (!feed) {
+        return res.status(400).json({
+          error: "apple_show_no_feed",
+          message:
+            "Apple doesn't list an RSS feed for that show — it may be an Apple Podcasts Subscriptions exclusive. Paste the show's direct RSS URL instead.",
+        });
+      }
+      console.log(`[subscribe] Apple show → resolved feed: ${feed}`);
+      url = feed;
+      type = "podcast";
+    } catch (err) {
+      return res.status(502).json({
+        error: "apple_show_lookup_failed",
+        message: `Couldn't reach Apple to resolve that show URL: ${err?.message || err}`,
+      });
+    }
+  }
+
   const isPodcast = type === "podcast" || isPodcastFeedUrl(url);
 
-  const subs = await loadSubscriptions();
+  const scope = subScope(req);
+  const subs = await loadSubscriptions(scope);
 
   // Prevent duplicates
   if (isPodcast) {
@@ -1132,7 +1751,7 @@ app.post("/api/subscriptions", async (req, res) => {
     autoDownload: autoDownload === true,
   };
   subs.push(sub);
-  await saveSubscriptions(subs);
+  await saveSubscriptions(scope, subs);
 
   // Respond immediately so the UI isn't blocked
   res.json(sub);
@@ -1143,11 +1762,11 @@ app.post("/api/subscriptions", async (req, res) => {
       if (isPodcast) {
         // Fetch podcast title from RSS feed
         const { title } = await parsePodcastRSS(url, 1);
-        const freshSubs = await loadSubscriptions();
+        const freshSubs = await loadSubscriptions(scope);
         const s = freshSubs.find(x => x.id === sub.id);
         if (s) {
           s.name = title || url;
-          await saveSubscriptions(freshSubs);
+          await saveSubscriptions(scope, freshSubs);
         }
         console.log(`  🎙  New podcast subscription: ${title} — checking for episodes...`);
       } else {
@@ -1155,12 +1774,12 @@ app.post("/api/subscriptions", async (req, res) => {
           fetchChannelName(url),
           getChannelId(url),
         ]);
-        const freshSubs = await loadSubscriptions();
+        const freshSubs = await loadSubscriptions(scope);
         const s = freshSubs.find(x => x.id === sub.id);
         if (s) {
           s.name = name;
           if (channelId) s.channelId = channelId;
-          await saveSubscriptions(freshSubs);
+          await saveSubscriptions(scope, freshSubs);
         }
         console.log(`  📡  New subscription: ${name} — checking for recent videos...`);
       }
@@ -1172,83 +1791,102 @@ app.post("/api/subscriptions", async (req, res) => {
 });
 
 app.delete("/api/subscriptions/:id", async (req, res) => {
-  let subs = await loadSubscriptions();
+  const scope = subScope(req);
+  let subs = await loadSubscriptions(scope);
   subs = subs.filter(s => s.id !== req.params.id);
-  await saveSubscriptions(subs);
-  // Also remove any pending auto-queue items from this subscription
-  autoQueue = autoQueue.filter(q => q.subscriptionId !== req.params.id);
-  await saveAutoQueue();
+  await saveSubscriptions(scope, subs);
+  // Also remove any auto-queue items from this subscription.
+  await mutateAutoQueue(scope, (items) =>
+    items.filter((q) => q.subscriptionId !== req.params.id),
+  );
   res.json({ ok: true });
 });
 
 app.put("/api/subscriptions/:id/pause", async (req, res) => {
-  const subs = await loadSubscriptions();
+  const scope = subScope(req);
+  const subs = await loadSubscriptions(scope);
   const sub = subs.find(s => s.id === req.params.id);
   if (!sub) return res.status(404).json({ error: "Subscription not found" });
   sub.paused = !sub.paused;
-  await saveSubscriptions(subs);
+  await saveSubscriptions(scope, subs);
   res.json(sub);
 });
 
 app.put("/api/subscriptions/:id/since", async (req, res) => {
   const { since } = req.body;
   if (!since) return res.status(400).json({ error: "Missing 'since' date" });
-  const subs = await loadSubscriptions();
+  const scope = subScope(req);
+  const subs = await loadSubscriptions(scope);
   const sub = subs.find(s => s.id === req.params.id);
   if (!sub) return res.status(404).json({ error: "Subscription not found" });
   sub.createdAt = new Date(since).toISOString();
-  await saveSubscriptions(subs);
+  await saveSubscriptions(scope, subs);
   res.json(sub);
 });
 
 // Debug: subscription check logs (viewable in-app)
-app.get("/api/sub-check-log", (req, res) => {
-  res.json({ log: subCheckLog, autoQueueCount: autoQueue.length, autoQueue: autoQueue.map(q => ({ id: q.id, videoId: q.videoId, title: q.title, status: q.status, sub: q.subscriptionName })) });
+app.get("/api/sub-check-log", async (req, res) => {
+  const q = await loadAutoQueue(subScope(req));
+  res.json({
+    log: subCheckLog,
+    autoQueueCount: q.length,
+    autoQueue: q.map((x) => ({ id: x.id, videoId: x.videoId, title: x.title, status: x.status, sub: x.subscriptionName })),
+  });
 });
 
 // Auto-queue endpoints (frontend polls these)
-app.get("/api/auto-queue", (req, res) => {
+app.get("/api/auto-queue", async (req, res) => {
+  const queue = await loadAutoQueue(subScope(req));
   // Return all items grouped by status for the frontend
   const showAll = req.query.all === "true";
   const items = showAll
-    ? autoQueue
-    : autoQueue.filter(q => ["pending", "approved", "processing"].includes(q.status));
+    ? queue
+    : queue.filter(q => ["pending", "approved", "processing"].includes(q.status));
   res.json({
     items,
     checkRunning: subCheckRunning,
     counts: {
-      pending: autoQueue.filter(q => q.status === "pending").length,
-      approved: autoQueue.filter(q => q.status === "approved").length,
-      processing: autoQueue.filter(q => q.status === "processing").length,
-      completed: autoQueue.filter(q => q.status === "completed").length,
-      failed: autoQueue.filter(q => q.status === "failed").length,
+      pending: queue.filter(q => q.status === "pending").length,
+      approved: queue.filter(q => q.status === "approved").length,
+      processing: queue.filter(q => q.status === "processing").length,
+      completed: queue.filter(q => q.status === "completed").length,
+      failed: queue.filter(q => q.status === "failed").length,
     },
   });
 });
 
 app.delete("/api/auto-queue/:id", async (req, res) => {
-  autoQueue = autoQueue.filter(q => q.id !== req.params.id);
-  await saveAutoQueue();
+  await mutateAutoQueue(subScope(req), (items) =>
+    items.filter((q) => q.id !== req.params.id),
+  );
   res.json({ ok: true });
 });
 
 app.post("/api/auto-queue/:id/skip", async (req, res) => {
-  const item = autoQueue.find(q => q.id === req.params.id);
-  if (item && item.videoId) {
-    await addToSkipList(item.videoId);
-  }
-  autoQueue = autoQueue.filter(q => q.id !== req.params.id);
-  await saveAutoQueue();
+  const scope = subScope(req);
+  let videoId = null;
+  await mutateAutoQueue(scope, (items) => {
+    const it = items.find((q) => q.id === req.params.id);
+    if (it && it.videoId) videoId = it.videoId;
+    return items.filter((q) => q.id !== req.params.id);
+  });
+  if (videoId) await addToSkipList(scope, videoId);
   res.json({ ok: true });
 });
 
 // Approve a single auto-queue item for background processing
 app.post("/api/auto-queue/:id/approve", async (req, res) => {
-  const item = autoQueue.find(q => q.id === req.params.id);
+  let item = null;
+  let badStatus = null;
+  await mutateAutoQueue(subScope(req), (items) => {
+    const it = items.find((q) => q.id === req.params.id);
+    if (!it) return;
+    if (it.status !== "pending") { badStatus = it.status; return; }
+    it.status = "approved";
+    item = { ...it };
+  });
+  if (badStatus) return res.status(400).json({ error: `Cannot approve item with status '${badStatus}'` });
   if (!item) return res.status(404).json({ error: "Item not found" });
-  if (item.status !== "pending") return res.status(400).json({ error: `Cannot approve item with status '${item.status}'` });
-  item.status = "approved";
-  await saveAutoQueue();
   kickProcessor();
   res.json({ ok: true, item });
 });
@@ -1256,38 +1894,43 @@ app.post("/api/auto-queue/:id/approve", async (req, res) => {
 // Approve all pending items at once
 app.post("/api/auto-queue/approve-all", async (req, res) => {
   let count = 0;
-  for (const item of autoQueue) {
-    if (item.status === "pending") {
-      item.status = "approved";
-      count++;
+  await mutateAutoQueue(subScope(req), (items) => {
+    for (const it of items) {
+      if (it.status === "pending") { it.status = "approved"; count++; }
     }
-  }
-  if (count > 0) {
-    await saveAutoQueue();
-    kickProcessor();
-  }
+  });
+  if (count > 0) kickProcessor();
   res.json({ ok: true, approved: count });
 });
 
 // Retry a failed item
 app.post("/api/auto-queue/:id/retry", async (req, res) => {
-  const item = autoQueue.find(q => q.id === req.params.id);
+  let item = null;
+  let badStatus = null;
+  await mutateAutoQueue(subScope(req), (items) => {
+    const it = items.find((q) => q.id === req.params.id);
+    if (!it) return;
+    if (it.status !== "failed") { badStatus = it.status; return; }
+    it.status = "approved";
+    it.error = undefined;
+    it.failedAt = undefined;
+    item = { ...it };
+  });
+  if (badStatus) return res.status(400).json({ error: `Cannot retry item with status '${badStatus}'` });
   if (!item) return res.status(404).json({ error: "Item not found" });
-  if (item.status !== "failed") return res.status(400).json({ error: `Cannot retry item with status '${item.status}'` });
-  item.status = "approved";
-  item.error = undefined;
-  item.failedAt = undefined;
-  await saveAutoQueue();
   kickProcessor();
   res.json({ ok: true, item });
 });
 
 // Clear completed and failed items from the queue
 app.post("/api/auto-queue/clear-finished", async (req, res) => {
-  const before = autoQueue.length;
-  autoQueue = autoQueue.filter(q => !["completed", "failed"].includes(q.status));
-  const removed = before - autoQueue.length;
-  if (removed > 0) await saveAutoQueue();
+  let removed = 0;
+  await mutateAutoQueue(subScope(req), (items) => {
+    const before = items.length;
+    const kept = items.filter((q) => !["completed", "failed"].includes(q.status));
+    removed = before - kept.length;
+    return kept;
+  });
   res.json({ ok: true, removed });
 });
 
@@ -1299,18 +1942,20 @@ app.post("/api/subscriptions/check-now", async (req, res) => {
 
 // ── Auto-download toggle per subscription ──────────────────────────────────
 app.put("/api/subscriptions/:id/auto-download", async (req, res) => {
-  const subs = await loadSubscriptions();
+  const scope = subScope(req);
+  const subs = await loadSubscriptions(scope);
   const sub = subs.find(s => s.id === req.params.id);
   if (!sub) return res.status(404).json({ error: "Subscription not found" });
   sub.autoDownload = req.body.enabled === true;
-  await saveSubscriptions(subs);
+  await saveSubscriptions(scope, subs);
   res.json({ ok: true, subscription: sub });
 });
 
 // ── Background processing status & configuration ───────────────────────────
 
 // Get current processing status (what's running, queue depth, config)
-app.get("/api/processing/status", (req, res) => {
+app.get("/api/processing/status", async (req, res) => {
+  const queue = await loadAutoQueue(subScope(req));
   res.json({
     running: processingState.running,
     currentItem: processingState.currentItem
@@ -1319,9 +1964,9 @@ app.get("/api/processing/status", (req, res) => {
     lastCompleted: processingState.lastCompleted,
     config: processingConfig,
     counts: {
-      approved: autoQueue.filter(q => q.status === "approved").length,
-      processing: autoQueue.filter(q => q.status === "processing").length,
-      pending: autoQueue.filter(q => q.status === "pending").length,
+      approved: queue.filter(q => q.status === "approved").length,
+      processing: queue.filter(q => q.status === "processing").length,
+      pending: queue.filter(q => q.status === "pending").length,
     },
     log: processingState.log.slice(-20),
   });
@@ -1425,13 +2070,38 @@ async function tryFetchYouTubeCaptions(videoId, tmpDir, opts, log) {
   }
 
   // yt-dlp names the file like `captions.en.json3` or `captions.en-US.json3`.
+  // Some videos report subtitles as "available" via the metadata API but
+  // yt-dlp can't actually pull a usable JSON3 file (age-gate, members-only,
+  // wrong language match against our `en.*,en` pattern, etc.). Surface
+  // exactly which failure mode hit so the operator can decide whether
+  // to disable captions toggle for this video or pursue a workaround.
   let captionPath = null;
+  let availableFiles = [];
   try {
-    const files = await fs.readdir(tmpDir);
-    const match = files.find((f) => f.startsWith("captions.") && f.endsWith(".json3"));
+    availableFiles = await fs.readdir(tmpDir);
+    const match = availableFiles.find(
+      (f) => f.startsWith("captions.") && f.endsWith(".json3")
+    );
     if (match) captionPath = path.join(tmpDir, match);
-  } catch {}
-  if (!captionPath) return null;
+  } catch (err) {
+    log(1, `⚠ Captions tmpDir read failed: ${(err.message || "").slice(0, 200)}`);
+  }
+  if (!captionPath) {
+    // Did yt-dlp produce ANY caption file in another format?
+    const otherCaps = availableFiles.filter((f) => f.startsWith("captions."));
+    if (otherCaps.length > 0) {
+      log(
+        1,
+        `⚠ Captions: yt-dlp wrote ${otherCaps.join(", ")} but not the expected .json3 — likely subtitle-language mismatch (we asked for en.*,en). Video may only have captions in another language.`
+      );
+    } else {
+      log(
+        1,
+        `⚠ Captions: yt-dlp produced no caption file despite metadata reporting them available. Possibly age-gated, members-only, or yt-dlp couldn't decrypt them.`
+      );
+    }
+    return null;
+  }
 
   let parsed;
   try {
@@ -1457,7 +2127,13 @@ async function tryFetchYouTubeCaptions(videoId, tmpDir, opts, log) {
       duration: (evt.dDurationMs || 0) / 1000,
     });
   }
-  if (entries.length < 5) return null;
+  if (entries.length < 5) {
+    log(
+      1,
+      `⚠ Captions parsed but only ${entries.length} non-empty entries (raw events: ${rawEvents.length}). Captions look empty/malformed — falling back.`
+    );
+    return null;
+  }
   return { entries, source: hasManual ? "manual" : "auto" };
 }
 
@@ -1668,6 +2344,7 @@ app.post("/api/providers/test", async (req, res) => {
     const resolvedOpts = resolveProviderOpts(providerId, {
       config: cfg,
       clientOpts: (clientOpts && typeof clientOpts === "object") ? clientOpts : {},
+      req,
     });
     provider = getProvider(providerId, resolvedOpts);
   } catch (err) {
@@ -1784,7 +2461,96 @@ app.post("/api/providers/:id/clear", async (req, res) => {
 });
 
 app.post("/api/process", async (req, res) => {
-  const {
+  // ── Multi-mode credit gate ───────────────────────────────────────────────
+  // Four reachable states arriving here in multi-mode:
+  //   (a) req.user is admin    → no local gate (operator pool)
+  //   (b) req.user with license → license tier handles the gate (license-mw)
+  //   (b2) paid cloud user     → relay-side user:<id> quota gates it; NO
+  //                              local tenant_credits gate (core-decoupling)
+  //   (c) req.user free tenant → tenant_credits.balance gate + debit
+  //   (d) req.trial holder     → trial cookie gate + debit
+  //   (e) anonymous, no trial  → try issueIfEligible, then re-check
+  //
+  // The signed-in-free-tenant case (c) was unhandled pre-0.2.92: their
+  // tenant_credits.balance was DISPLAYED but never gated or debited,
+  // so they could summarize indefinitely. Now we check + debit
+  // alongside the trial flow.
+  //
+  // Core-decoupling: paid status is the relay-owned tier (pro/max), NOT a
+  // Keysat license. Paid cloud users are metered by the relay's user:<id>
+  // monthly quota (its own 402 envelope), so they skip this local gate.
+  // Everyone else signed in (tier core) is a free tenant gated on
+  // tenant_credits — including accounts that still carry a now-ignored
+  // legacy license.
+  const isPaidCloudUser =
+    req.user && (req.user.tier === "pro" || req.user.tier === "max");
+  if (
+    RECAP_MODE === "multi" &&
+    req.user &&
+    !req.user.is_admin &&
+    !isPaidCloudUser
+  ) {
+    // Free signed-in tenant — gate on tenant_credits.balance. We
+    // CHECK here at request start; the actual debit happens after
+    // saveToHistory succeeds (so a failed pipeline doesn't burn a
+    // credit). Same pattern as the trial flow below.
+    try {
+      const { getOrInit } = await import("./tenant-credits.js");
+      const credits = await getOrInit(req.user.id);
+      if (!credits || credits.total <= 0) {
+        return res.status(402).json({
+          error: "credits_exhausted",
+          message:
+            "You're out of credits. Buy more or wait for your free credits to refresh.",
+        });
+      }
+      // Stash for the post-save debit step
+      req.creditsToDebit = "tenant";
+    } catch (err) {
+      console.error("[/api/process] tenant_credits gate failed:", err);
+      return res.status(500).json({ error: "internal_error" });
+    }
+  }
+
+  if (RECAP_MODE === "multi" && !req.user) {
+    if (!req.trial && typeof req.userId === "undefined") {
+      // Pre-trial visitor on their first POST. Try to mint a cookie.
+      try {
+        const { issueIfEligible } = await import("./anon-trial.js");
+        const trial = await issueIfEligible({ req, res });
+        if (trial) {
+          req.userId = `anon:${trial.cookie_id}`;
+          req.trial = trial;
+        }
+      } catch (err) {
+        console.warn("[/api/process] anon-trial mint failed:", err);
+      }
+    }
+    if (!req.trial) {
+      // No session, no trial — either trials disabled, IP-capped, or
+      // their previous trial is exhausted (middleware fell through).
+      return res.status(401).json({
+        error: "trial_unavailable",
+        message:
+          "Sign in to keep using Recaps. New here? Create an account in a minute — no payment required.",
+      });
+    }
+    // Verify trial still has budget at request time. Cheap to check,
+    // catches the case where a parallel request just spent the last
+    // credit between middleware lookup and this handler firing.
+    const { lookupTrial, hasTrialBudget } = await import("./anon-trial.js");
+    const fresh = lookupTrial(req.trial.cookie_id);
+    if (!fresh || !hasTrialBudget(fresh)) {
+      return res.status(402).json({
+        error: "trial_exhausted",
+        message:
+          "You've used all your free trials. Sign up for an account to keep going.",
+      });
+    }
+    req.trial = fresh;
+  }
+
+  let {
     url, apiKey: clientKey, model, type: itemType, title: itemTitle, uploadDate: itemUploadDate, episodeId,
     transcriptionProvider: reqTransProvider,
     transcriptionModel: reqTransModel,
@@ -1793,6 +2559,22 @@ app.post("/api/process", async (req, res) => {
     providerOpts: reqProviderOpts,
     useYouTubeCaptions: reqUseYTCaptions,
   } = req.body;
+  // Defensive: a stale browser cache or older client might submit
+  // the literal string "Untitled" as the title (a sentinel that
+  // earlier Recap versions used as a falsy placeholder but which is
+  // actually truthy and pollutes every downstream gate — see relay
+  // 0.2.57's same normalization). Strip it here at the request
+  // boundary so all subsequent code can rely on "itemTitle is either
+  // a real title or empty". Also trim whitespace + drop "untitled"
+  // case-insensitively in case some other client variant emits it.
+  if (typeof itemTitle === "string") {
+    const trimmed = itemTitle.trim();
+    if (trimmed === "" || trimmed.toLowerCase() === "untitled") {
+      itemTitle = "";
+    } else {
+      itemTitle = trimmed;
+    }
+  }
   // Default: use captions when available (huge speed/cost win). The
   // picker-UI toggle lets users force a full transcription pass when
   // they want speaker labels (captions don't have them) or when the
@@ -1881,10 +2663,12 @@ app.post("/api/process", async (req, res) => {
   const transcriptionOpts = resolveProviderOpts(transcriptionProvider, {
     config: cfg,
     clientOpts: clientOptsFor(transcriptionProvider),
+    req,
   });
   const analysisOpts = resolveProviderOpts(analysisProvider, {
     config: cfg,
     clientOpts: clientOptsFor(analysisProvider),
+    req,
   });
 
   let transcriber;
@@ -1925,6 +2709,40 @@ app.post("/api/process", async (req, res) => {
     });
   }
 
+  // ── Resolve Apple Podcasts / Spotify share URLs ──
+  // Most users paste apple/spotify share links rather than RSS feeds.
+  // Resolve those to a direct audio enclosure URL up-front so the rest
+  // of the handler runs the existing podcast pipeline unchanged. On
+  // resolver failure we surface a clear error rather than letting the
+  // downstream code stumble on a URL it can't process.
+  let resolvedFrom = null; // "apple" | "spotify" | null — for the result event
+  if (isResolvableShareUrl(url)) {
+    try {
+      const resolved = await resolveShareUrl(url, {
+        podcastIndexKey: cfg.podcastindex_api_key,
+        podcastIndexSecret: cfg.podcastindex_api_secret,
+      });
+      if (resolved) {
+        console.log(
+          `  [url-resolver] ${resolved.source} → ${resolved.audioUrl.slice(0, 80)} ("${resolved.title}")`
+        );
+        url = resolved.audioUrl;
+        if (!itemTitle) itemTitle = resolved.title;
+        if (!itemUploadDate) itemUploadDate = resolved.uploadDate;
+        if (!episodeId) episodeId = resolved.episodeId;
+        itemType = "podcast";
+        resolvedFrom = resolved.source;
+      }
+    } catch (err) {
+      if (isFree) releaseFreeSlot();
+      const code = err instanceof URLResolveError ? err.code : "resolve_failed";
+      return res.status(400).json({
+        error: code,
+        message: err?.message || "Failed to resolve share URL",
+      });
+    }
+  }
+
   // Determine if this is a podcast episode or YouTube video
   const isPodcast = itemType === "podcast" || /\.(mp3|m4a|ogg|opus|wav|aac)(\?|$)/i.test(url);
   const videoId = isPodcast ? (episodeId || url) : extractVideoId(url);
@@ -1981,6 +2799,400 @@ app.post("/api/process", async (req, res) => {
       }
     }
 
+    // ── Recap Relay mode (unified pipeline) ──────────────────────
+    // When the user picks "Recap Relay" in the picker, both providers
+    // are set to "relay". The relay's /relay/summarize-url endpoint
+    // does the WHOLE pipeline (download + transcribe + chunked-analyze)
+    // server-side and streams per-window section results back to us
+    // over SSE. We forward those events to the browser as the existing
+    // event types (transcript_ready / sections_partial / result) so
+    // the front-end's incremental rendering keeps working unchanged.
+    //
+    // Why this branch exists instead of just letting the per-step
+    // pickers route to relay independently:
+    //   1. Latency — saves 12+ round-trips (one per analyze window)
+    //      and the bandwidth of sending the full transcript back
+    //      to Recap just for Recap to ship it back as 12 prompts.
+    //   2. Settings respect — the operator's Settings-tab knobs
+    //      (window body, overlap, concurrency, etc.) only take
+    //      effect when the relay drives the analyze loop. Per-step
+    //      relay use would leave Recap's hardcoded constants in
+    //      charge of windowing.
+    //   3. Credits clarity — one summarize = one credit, charged
+    //      atomically on the relay side. No "what if transcribe
+    //      succeeded but analyze fell back to Anthropic" accounting.
+    const relayMode =
+      transcriptionProvider === "relay" && analysisProvider === "relay";
+    if (relayMode) {
+      // Title surrogate — used for the activity log display + as a
+      // fallback if the relay doesn't echo a real title back (older
+      // relay, or a podcast/non-YouTube URL where yt-dlp metadata
+      // isn't available). Defaults to "Untitled" so log messages
+      // remain readable.
+      const titleSurrogate = itemTitle || "Untitled";
+      // titleHint sent to the relay — must NOT be the surrogate.
+      // Passing "Untitled" as a hint causes a subtle bug: the relay's
+      // download step uses `if (!title && audio.title) title = audio.title;`
+      // which treats any truthy operator-supplied title (including
+      // "Untitled") as a real hint and skips the yt-dlp-extracted
+      // title fallback. Net effect: the library entry stays
+      // "Untitled" forever even though yt-dlp got the real title.
+      // Pass only the actual operator/subscription-supplied title (or
+      // empty string, which the provider serializes as omitted JSON).
+      const titleHintRaw = itemTitle ? String(itemTitle).trim() : "";
+
+      // For YouTube URLs, fetch the metadata block (channel, description,
+      // chapters) BEFORE handing off to the relay. The relay can extract
+      // these fields itself via yt-dlp (relay 0.2.63+ does so) but
+      // fetching here gives the relay a head-start AND lets older relays
+      // that don't yet do their own extraction still get the speaker-ID
+      // metadata. The fetch costs ~1-2 seconds — small relative to the
+      // 1-3 minute pipeline. Defense-in-depth: belt-and-suspenders with
+      // the relay-side fallback.
+      //
+      // For podcasts, skip — fetchYouTubeMetadata is YouTube-specific
+      // and would return null anyway. The podcast resolver above
+      // already populated itemTitle when relevant; channel/description/
+      // chapters aren't available for podcast feeds.
+      let relayChannelHint = "";
+      let relayDescriptionHint = "";
+      let relayChaptersHint = [];
+      if (!isPodcast && videoId) {
+        try {
+          const meta = await fetchYouTubeMetadata(videoId);
+          if (meta) {
+            relayChannelHint = meta.channel || "";
+            relayDescriptionHint = meta.description || "";
+            relayChaptersHint = Array.isArray(meta.chapters) ? meta.chapters : [];
+            log(
+              1,
+              `YouTube metadata fetched: channel="${relayChannelHint.slice(0, 60)}", ${relayChaptersHint.length} chapter(s), description ${relayDescriptionHint.length} chars`
+            );
+          }
+        } catch (err) {
+          // Non-fatal — the relay's own yt-dlp extraction will fill these
+          // fields when our request body sends them as empty strings.
+          log(1, `YouTube metadata fetch failed: ${err?.message || err} — relay will extract via its own yt-dlp`);
+        }
+      }
+
+      log(1, `Recap Relay mode — full pipeline on operator's relay`);
+      // Cache of parsed transcript entries — populated by the
+      // onTranscribeComplete provider callback below as soon as the
+      // relay finishes the transcribe phase. Used by the per-window
+      // streaming callback to build full { title, summary, entries,
+      // startTime } chunk objects, which is the shape the browser's
+      // sections_partial handler reads via `data.chunks`. Without
+      // this cache, per-window streaming sent just titles + summaries
+      // and the browser had no entries to render under each section.
+      let streamedRelayEntries = [];
+      let relayResult;
+      // Track whether we've emitted the early transcript_ready event
+      // yet. In sequential mode this fires from onTranscribeComplete
+      // (when relay's transcribe finishes); in pipelined mode it can
+      // fire even earlier from the FIRST onWindowComplete (when an
+      // early window's sections arrive before transcribe is done).
+      // Either way: we want the browser to flip from loading view to
+      // results view ASAP so it can render the streaming sections.
+      let earlyTranscriptReadyEmitted = false;
+      const emitEarlyTranscriptReady = (extra = {}) => {
+        if (earlyTranscriptReadyEmitted) return;
+        earlyTranscriptReadyEmitted = true;
+        sendEvent(res, "transcript_ready", {
+          videoId,
+          // Best-known title at this point — the surrogate from the
+          // user-supplied title hint or "Untitled". The final result
+          // event also carries videoTitle and the browser updates
+          // it then, so any final title mismatch self-heals.
+          videoTitle: titleSurrogate,
+          videoChannel: relayChannelHint || "",
+          videoChapters: relayChaptersHint || [],
+          videoUploadDate: itemUploadDate || "",
+          videoDescription: relayDescriptionHint || "",
+          entries: streamedRelayEntries || [],
+          type: isPodcast ? "podcast" : "youtube",
+          willChunk: true, // pessimistic; corrected at result time
+          ...extra,
+        });
+      };
+      try {
+        relayResult = await transcriber.summarizeUrl({
+          mediaUrl: url,
+          mediaType: isPodcast ? "podcast" : "youtube",
+          mimeType: undefined,
+          titleHint: titleHintRaw,
+          channelHint: relayChannelHint,
+          descriptionHint: relayDescriptionHint,
+          chaptersHint: relayChaptersHint,
+          onProgress: (msg) => log(2, msg),
+          // Capture transcript entries the moment the relay finishes
+          // transcribing. Analyze runs serially AFTER transcribe in
+          // the relay's pipeline — so by the time the FIRST
+          // onWindowComplete fires, this callback has already populated
+          // the entries cache below. That lets the onWindowComplete
+          // callback build proper { title, summary, entries, startTime }
+          // chunk objects (the shape the browser's sections_partial
+          // handler expects under .chunks) rather than the raw
+          // ownedSections-without-entries we sent pre-v0.2.75.
+          onTranscribeComplete: ({ transcript }) => {
+            streamedRelayEntries = parseTimestampedTranscript(transcript || "");
+            log(2, `Relay transcript parsed — ${streamedRelayEntries.length} segments cached for streaming`);
+            // Sequential-mode UI flip: emit transcript_ready as soon
+            // as transcribe is done so the browser switches from
+            // loading view to results view BEFORE the analyze
+            // sections start streaming in. Pipelined mode beats us to
+            // this from onWindowComplete (the first window may
+            // complete before transcribe is fully done) — either way
+            // the emitter is idempotent.
+            emitEarlyTranscriptReady();
+          },
+          // Per-window streaming: forward each window's owned sections
+          // to the browser as sections_partial events with the chunk
+          // SHAPE the browser handler expects (.chunks not
+          // .partialSections). Without this, the browser's
+          // `data.chunks || []` read at the sections_partial handler
+          // resolved to an empty array and the operator saw zero
+          // sections appear during the analyze phase — they only
+          // landed when the terminal "result" event arrived at the
+          // very end of the pipeline.
+          onWindowComplete: ({ windowIdx, totalWindows, ownedSections, windowEntries }) => {
+            // Pipelined-mode UI flip: if the first window completes
+            // before transcribe-done (very possible — first window
+            // only needs ~20min of audio fully transcribed), emit
+            // transcript_ready NOW so the browser flips to results
+            // view in time for these partial sections to render.
+            emitEarlyTranscriptReady();
+            // Pipelined mode (relay v0.2.89+): each window arrives
+            // with its OWN entries embedded, before transcribe has
+            // fully completed. Section indices are LOCAL to those
+            // window entries, so we slice them directly.
+            //
+            // Sequential mode (older relays, or Gemini-transcribe
+            // path): windowEntries is null. The relay's transcribe
+            // phase has already finished by the time these arrive,
+            // so streamedRelayEntries (populated by
+            // onTranscribeComplete) is non-empty and section
+            // indices are global into it.
+            const entries = Array.isArray(windowEntries) && windowEntries.length > 0
+              ? windowEntries
+              : (streamedRelayEntries || []);
+            const partialChunks = (ownedSections || []).map((s) => {
+              const start = Math.max(0, s.startIndex ?? 0);
+              const end = entries.length > 0
+                ? Math.min(entries.length - 1, s.endIndex ?? start)
+                : (s.endIndex ?? start);
+              const slice = entries.length > 0 ? entries.slice(start, end + 1) : [];
+              return {
+                title: s.title,
+                summary: s.summary,
+                entries: slice,
+                startTime: slice[0]?.offset || 0,
+              };
+            }).filter((c) => c.entries.length > 0 || !entries.length);
+            sendEvent(res, "sections_partial", {
+              windowIdx,
+              totalWindows,
+              chunks: partialChunks,
+            });
+          },
+          signal: abortController.signal,
+          jobId,
+        });
+      } catch (err) {
+        if (abortController.signal.aborted) throw new Error(CANCELLED_MARK);
+        sendEvent(res, "error", { message: err?.message || String(err) });
+        sendEvent(res, "result", { videoId, entries: [], chunks: [], rawTranscript: "" });
+        if (isFree) releaseFreeSlot();
+        res.end();
+        return;
+      }
+      checkCancelled();
+
+      // Backfill the real title now that the relay has finished. The
+      // relay extracts it via yt-dlp during the download step (or
+      // echoes back the client-supplied hint) and returns it in the
+      // result envelope's `title` field — see relay 0.2.53+. For older
+      // relays the field is null, so we keep the original surrogate.
+      // Trim + drop empty strings to avoid storing whitespace-only
+      // titles that would render as a blank row in the library list.
+      const relayTitle = typeof relayResult.title === "string"
+        ? relayResult.title.trim()
+        : "";
+      const resolvedTitle = relayTitle || titleSurrogate;
+
+      // Parse the bracketed transcript into the entries array shape
+      // Recap's UI / history layer expects.
+      const relayEntries = parseTimestampedTranscript(relayResult.transcript || "");
+
+      // Phase 1E — attach speaker labels to each parsed entry by
+      // time-matching against the raw per-segment diarization data
+      // the relay returned. The relay's `transcript_segments` are the
+      // fine-grained Parakeet segments (often 1-3s each) with a
+      // `speaker` field per segment. Recap's `relayEntries` are the
+      // MERGED readable lines (sortAndDedupeTranscript + mergeShort-
+      // Entries collapsed multiple Parakeet segments into one
+      // sentence-sized thought). To attach speakers to merged
+      // entries: for each entry, find the raw segment whose [start,
+      // end] contains the entry's offset (start time). The merged
+      // entry's start time always corresponds to the start of one of
+      // the underlying segments — that segment's speaker is the
+      // entry's speaker. Speaker stays null when:
+      //   - relay version < 0.2.88 (no transcript_segments field)
+      //   - diarization was off on the operator's relay
+      //   - relay couldn't match the entry's time to any segment
+      const relaySegments = Array.isArray(relayResult.transcript_segments)
+        ? relayResult.transcript_segments
+        : null;
+      if (relaySegments && relaySegments.length > 0) {
+        // Build a sorted-by-start list for an O(N log N + M log N) match.
+        // Linear scan would be O(N*M) which is fine for typical sizes
+        // but the sorted form also makes the data debuggable.
+        const sortedSegs = relaySegments
+          .slice()
+          .sort((a, b) => (a.start || 0) - (b.start || 0));
+        for (const entry of relayEntries) {
+          const t = entry.offset || 0;
+          // Find the segment whose [start, end] contains t. Use
+          // binary search for efficiency on long transcripts.
+          let lo = 0;
+          let hi = sortedSegs.length - 1;
+          let found = null;
+          while (lo <= hi) {
+            const mid = (lo + hi) >> 1;
+            const seg = sortedSegs[mid];
+            if (t < (seg.start || 0)) {
+              hi = mid - 1;
+            } else if (t > (seg.end || 0)) {
+              lo = mid + 1;
+            } else {
+              found = seg;
+              break;
+            }
+          }
+          // If no segment contains t (gaps in diarization output),
+          // fall back to the segment that starts CLOSEST to t.
+          if (!found && sortedSegs.length > 0) {
+            const idx = Math.min(Math.max(lo, 0), sortedSegs.length - 1);
+            const candidates = [
+              sortedSegs[idx],
+              sortedSegs[idx - 1],
+              sortedSegs[idx + 1],
+            ].filter(Boolean);
+            let bestDist = Infinity;
+            for (const seg of candidates) {
+              const segMid = ((seg.start || 0) + (seg.end || 0)) / 2;
+              const d = Math.abs(segMid - t);
+              if (d < bestDist) {
+                bestDist = d;
+                found = seg;
+              }
+            }
+            // Cap the fallback at 5s — beyond that the assignment is
+            // probably bogus, leave it null so the UI can render
+            // "(speaker unknown)" or just drop the chip.
+            if (bestDist > 5) found = null;
+          }
+          if (found && found.speaker) {
+            entry.speaker = found.speaker;
+            entry.speaker_confidence =
+              typeof found.speaker_confidence === "number"
+                ? found.speaker_confidence
+                : null;
+            // Phase 2 — surface the suppression-pass uncertainty
+            // flag so the chip renders with a "?" suffix for
+            // best-guess attribution. Absent on older relays.
+            entry.speaker_uncertain = !!found.speaker_uncertain;
+          }
+        }
+      }
+
+      const contentType = isPodcast ? "podcast" : "youtube";
+      // Note: transcript_ready was emitted EARLIER by
+      // emitEarlyTranscriptReady() — either from the first
+      // onWindowComplete (pipelined mode) or from
+      // onTranscribeComplete (sequential mode). Re-emitting here
+      // would either (a) be a no-op since the browser handler is
+      // already in results view, or (b) double-trigger the chunk
+      // wipe / streamWindowsTotal reset. The real title arrives
+      // via the result event below — browser's result handler
+      // updates state.videoTitle on receipt — so dropping the
+      // duplicate emit is safe.
+
+      // Build chunks from the relay's stitched analysis sections.
+      const sections = Array.isArray(relayResult.analysis?.sections)
+        ? relayResult.analysis.sections
+        : [];
+      const chunks = sections
+        .map((s) => {
+          const start = Math.max(0, s.startIndex ?? 0);
+          const end = Math.min(relayEntries.length - 1, s.endIndex ?? start);
+          const slice = relayEntries.slice(start, end + 1);
+          return {
+            title: s.title,
+            summary: s.summary,
+            entries: slice,
+            startTime: slice[0]?.offset || 0,
+          };
+        })
+        .filter((c) => c.entries.length > 0);
+
+      const historyId = await saveToHistory(
+        scopeForRequest(req),
+        videoId,
+        url,
+        resolvedTitle,
+        chunks,
+        relayEntries,
+        logHistory,
+        itemUploadDate || "",
+        contentType,
+        relayResult.speakers || null,
+        relayResult.speaker_names || null,
+      ).catch(() => null);
+      // Debit local credit on success — trial cookie OR free signed-in
+      // tenant, depending on who's making the request. AFTER
+      // saveToHistory rather than at request-start so a failed pipeline
+      // doesn't burn a credit.
+      if (RECAP_MODE === "multi" && req.trial) {
+        try {
+          const { debitOne } = await import("./anon-trial.js");
+          debitOne(req.trial.cookie_id);
+        } catch (err) {
+          console.warn("[/api/process] trial debit failed:", err);
+        }
+      } else if (RECAP_MODE === "multi" && req.creditsToDebit === "tenant") {
+        try {
+          const { gateAndDebit } = await import("./tenant-credits.js");
+          await gateAndDebit(req.user.id);
+        } catch (err) {
+          console.warn("[/api/process] tenant_credits debit failed:", err);
+        }
+      }
+      sendEvent(res, "result", {
+        videoId,
+        videoTitle: resolvedTitle,
+        entries: relayEntries,
+        chunks,
+        historyId,
+        type: contentType,
+        // Phase 1E — speaker legend + per-segment confidence summary.
+        // Null when diarization wasn't available (older relay, or
+        // operator disabled it). Frontend renders a colored chip per
+        // speaker above the topic list; each transcript line uses
+        // the entry.speaker field (already attached above) to pick
+        // the matching chip color.
+        speakers: relayResult.speakers || null,
+        // Phase 2 — inferred speaker names from the relay's post-
+        // cluster polish pass. Map { Speaker_A: "Matt Hill", ... }
+        // with null values for speakers the LLM couldn't confidently
+        // name. Recap legend prefers the inferred name when present.
+        speaker_names: relayResult.speaker_names || null,
+      });
+      if (isFree) releaseFreeSlot();
+      res.end();
+      return;
+    }
+
     let videoTitle = itemTitle || "Untitled";
     let videoUploadDate = itemUploadDate || "";
     // Rich metadata used to ground the transcription prompt (speaker
@@ -1998,6 +3210,11 @@ app.post("/api/process", async (req, res) => {
     let captionSource = null; // "manual" | "auto" | null
     let transcriptText = "";
     let txCost = { inputTokens: 0, outputTokens: 0, thinkingTokens: 0, totalTokens: 0, totalCost: "0", totalCostDisplay: "$0.00" };
+    // Populated from YouTube metadata or (later) Apple/Spotify resolution.
+    // Used by the relay-URL fast-path to decide if the audio fits the
+    // relay's reported capability. null = unknown → fast-path attempts
+    // anyway and lets the relay reject if the file is over its cap.
+    let knownDuration = null;
     // Hoisted out of the audio-path block so Step 3 (analysis) can
     // reference analysisModel even when the captions fast-path skips
     // the entire audio + transcription block. transcriptionModel is
@@ -2015,6 +3232,15 @@ app.post("/api/process", async (req, res) => {
       analyzer.listAnalysisModels()[0] ||
       "gemini-3.1-pro-preview";
 
+    if (resolvedFrom) {
+      log(
+        0,
+        `Resolved ${
+          resolvedFrom === "apple" ? "Apple Podcasts" : "Spotify"
+        } share URL → ${url.slice(0, 80)}${url.length > 80 ? "…" : ""}`
+      );
+    }
+
     // ── Step 0 (YouTube only): metadata + captions fast path ──
     if (!isPodcast && videoId) {
       log(1, "Fetching video metadata...");
@@ -2025,6 +3251,9 @@ app.post("/api/process", async (req, res) => {
         videoChannel = meta.channel;
         videoDescription = meta.description;
         videoChapters = meta.chapters;
+        if (typeof meta.duration === "number" && meta.duration > 0) {
+          knownDuration = meta.duration;
+        }
         log(1, `Video title: ${videoTitle}${videoChannel ? ` (${videoChannel})` : ""}`);
         if ((meta.hasManualCaptions || meta.hasAutoCaptions) && !useYouTubeCaptions) {
           log(1, `YouTube captions available but the user has the captions fast-path disabled — will transcribe audio directly.`);
@@ -2061,6 +3290,162 @@ app.post("/api/process", async (req, res) => {
 
     checkCancelled();
 
+    // ── Step 0.5: Relay-URL fast-path ──
+    // When transcription routes through the operator's relay AND we
+    // have a public source URL (YouTube watch URL, or direct podcast
+    // .mp3/.m4a enclosure), hand the URL off to /relay/transcribe-url
+    // so the relay does the download itself. This saves the buyer's
+    // home upload bandwidth — often the slowest leg of the pipeline,
+    // since residential connections rarely match the relay's symmetric
+    // datacenter link. Only fires if:
+    //   1. captions fast-path didn't already populate entries
+    //   2. caller asked to use the relay for transcription
+    //   3. duration (when known) fits the relay's reported capability
+    // On any failure we fall through to the legacy local-download
+    // path, which has its own retry/fallback machinery.
+    if (!entries && transcriptionProvider === "relay") {
+      // Fresh fetch so the fast-path decision matches the routing
+      // decision the relay will make for THIS install — same
+      // rationale as the Step 2 refresh below.
+      await refreshRelayCapabilities().catch(() => {});
+      const caps = getRelayCapabilities();
+      const withinCapability =
+        typeof caps.max_audio_minutes !== "number" ||
+        knownDuration === null ||
+        knownDuration <= caps.max_audio_minutes * 60;
+      if (!withinCapability) {
+        log(
+          1,
+          `Relay-URL fast-path skipped — known duration ${(knownDuration / 60).toFixed(1)}min exceeds relay capability ${caps.max_audio_minutes}min`
+        );
+      } else {
+        const mediaType = isPodcast ? "podcast" : "youtube";
+        const handoffUrl = isPodcast
+          ? url
+          : `https://www.youtube.com/watch?v=${videoId}`;
+        log(
+          1,
+          `Relay-URL fast-path: handing ${mediaType} URL to relay (saves your upload bandwidth)…`
+        );
+        try {
+          const relayResult = await transcriber.transcribeUrl({
+            mediaUrl: handoffUrl,
+            mediaType,
+            mimeType,
+            titleHint: videoTitle,
+            channelHint: videoChannel,
+            descriptionHint: videoDescription,
+            chaptersHint: videoChapters,
+            onProgress: (msg) => log(2, msg),
+            signal: abortController.signal,
+            jobId,
+          });
+          if (relayResult && relayResult.text) {
+            transcriptText = relayResult.text;
+            const parsed = parseTimestampedTranscript(transcriptText);
+            if (parsed.length === 0) {
+              log(
+                1,
+                `⚠ Relay-URL transcript parsed to zero segments — falling back to local download`
+              );
+              transcriptText = "";
+              entries = null;
+            } else {
+              entries = parsed;
+            }
+            if (!entries) {
+              // fall through to local-download flow
+            } else {
+            // Single-segment expansion — same as the local path below.
+            // Parakeet-style backends return one big text blob; spread
+            // it into per-sentence entries with interpolated timestamps
+            // so the analyzer sees more than one section's worth of
+            // structure.
+            if (
+              entries.length === 1 &&
+              knownDuration &&
+              knownDuration > 30 &&
+              (entries[0].text || "").length > 100
+            ) {
+              const synthesized = synthesizeEntriesFromText(
+                entries[0].text,
+                knownDuration
+              );
+              if (synthesized.length > 1) {
+                log(
+                  2,
+                  `Single-segment relay transcript expanded into ${synthesized.length} synthetic entries`
+                );
+                entries = synthesized;
+              }
+            }
+            txCost = relayResult.cost || txCost;
+            log(
+              2,
+              `Relay-URL transcription complete — ${entries.length} segments, skipping local download`
+            );
+            }
+          } else {
+            log(
+              1,
+              `⚠ Relay-URL returned empty — falling back to local download`
+            );
+          }
+        } catch (err) {
+          if (err?.message === CANCELLED_MARK || abortController.signal.aborted) {
+            throw err;
+          }
+          const msg = err?.message || String(err);
+          // Surface err.cause too — Node's fetch() wraps low-level
+          // failures (DNS, TLS, dead-socket) in a bare "fetch failed"
+          // message and stashes the real reason in .cause. Without it
+          // the activity log is uninformative on transport errors.
+          const cause = err?.cause?.message || err?.cause?.code || err?.cause;
+          const detail = cause ? ` (cause: ${String(cause).slice(0, 200)})` : "";
+          // Did the relay accept the request and then fail at its
+          // backend (Parakeet/Gemma/Gemini), or did we fail before
+          // the relay even processed it (network blip, TLS issue,
+          // relay unreachable)?
+          //
+          //   Backend failures → DON'T fall back to local download.
+          //   The relay's /relay/transcribe endpoint would route to
+          //   the same broken backend, costing 60+ seconds of audio
+          //   upload bandwidth for the same error.
+          //
+          //   Transport failures → DO fall back. The relay may be
+          //   intermittently unreachable; upload-path might catch a
+          //   moment when it works.
+          const isBackendFailure =
+            /CUDA error|Resource exhausted|Parakeet transcribe|Gemma analyze|model does not exist|model.*not found|backend_error|all attempts failed|HTTP 5\d\d/i.test(
+              msg
+            );
+          if (isBackendFailure) {
+            log(
+              1,
+              `⚠ Relay-URL fast-path failed: ${msg.slice(0, 300)}${detail}`
+            );
+            log(
+              1,
+              `Skipping local-download fallback — same relay backend would just fail again. ` +
+                `Operator hardware (or Gemini quota) needs attention.`
+            );
+            sendEvent(res, "error", {
+              message: msg.slice(0, 500),
+            });
+            res.end();
+            if (isFree) releaseFreeSlot();
+            return;
+          }
+          log(
+            1,
+            `⚠ Relay-URL fast-path failed: ${msg.slice(0, 200)}${detail} — falling back to local download (transport-level error, relay may be intermittent)`
+          );
+        }
+      }
+    }
+
+    checkCancelled();
+
     // ── Step 1: Download audio (skipped when captions populated entries) ──
    if (!entries) {
     const dlStart = Date.now();
@@ -2273,18 +3658,63 @@ app.post("/api/process", async (req, res) => {
     log(2, `Audio duration: ${audioDuration ? formatTime(Math.floor(audioDuration)) : "unknown"} (${audioDurMin} min)`);
 
     // Strategy:
-    //   < 60 min AND < 30 MB  → Flash on full file (fast, cheap, reliable)
-    //   ≥ 60 min OR ≥ 30 MB   → go straight to chunked transcription with Flash (45-min chunks)
+    //   < threshold       → full file (fast, cheap, reliable on capable backends)
+    //   ≥ threshold       → chunked transcription
     //   If full-file transcription is truncated or empty → fall back to chunks
-    const CHUNK_TIME_THRESHOLD = 60 * 60; // 60 minutes
-    const CHUNK_SIZE_THRESHOLD = 30 * 1024 * 1024; // 30 MB
+    //
+    // Thresholds are provider-aware. For the relay provider, we ask
+    // the relay (via /relay/capabilities) what limits it can accept —
+    // if the operator has routed transcription to their own Parakeet
+    // hardware (which handles 2+ hour podcasts in one shot), the
+    // relay reports very large limits and we skip chunking entirely.
+    // For other providers, we use the legacy Gemini-safe defaults.
+    let chunkTimeThresholdSec = 60 * 60; // 60 min
+    let chunkSizeThresholdBytes = 30 * 1024 * 1024; // 30 MB
+    let preferredChunkSeconds = 2700; // 45 min
+    if (transcriptionProvider === "relay") {
+      // Force a fresh fetch so the chunking decision matches the
+      // routing decision the relay will make for THIS install RIGHT
+      // NOW. The hourly background refresh is a fallback for when
+      // this inline fetch fails (relay unreachable, etc.).
+      await refreshRelayCapabilities().catch(() => {});
+      const caps = getRelayCapabilities();
+      if (typeof caps.max_audio_minutes === "number") {
+        chunkTimeThresholdSec = caps.max_audio_minutes * 60;
+      }
+      if (typeof caps.max_audio_mb === "number") {
+        chunkSizeThresholdBytes = caps.max_audio_mb * 1024 * 1024;
+      }
+      if (caps.preferred_chunk_seconds === null) {
+        // Hardware-capable: never chunk. Set both thresholds to
+        // Infinity so the needsChunking check stays simple.
+        chunkTimeThresholdSec = Infinity;
+        chunkSizeThresholdBytes = Infinity;
+        preferredChunkSeconds = null;
+      } else if (typeof caps.preferred_chunk_seconds === "number") {
+        preferredChunkSeconds = caps.preferred_chunk_seconds;
+      }
+      // Plain-language line for the activity log. The full caps
+      // payload (tier, backend pref, chunking thresholds) is verbose
+      // and internal — surface only what a non-developer reader
+      // benefits from: the max audio length the relay will accept,
+      // since that's what dictates the chunking behavior they see.
+      if (caps.max_audio_minutes) {
+        log(2, `Relay will transcribe up to ${caps.max_audio_minutes} minutes per upload.`);
+      } else {
+        log(2, `Relay ready to transcribe.`);
+      }
+    }
     let audioFileSize = 0;
     try { audioFileSize = (await fs.stat(audioPath)).size; } catch {}
     const audioSizeMB = (audioFileSize / (1024 * 1024)).toFixed(1);
-    const needsChunking = (audioDuration && audioDuration >= CHUNK_TIME_THRESHOLD) || (audioFileSize >= CHUNK_SIZE_THRESHOLD);
+    const needsChunking =
+      (audioDuration && audioDuration >= chunkTimeThresholdSec) ||
+      audioFileSize >= chunkSizeThresholdBytes;
     if (needsChunking) {
-      const reason = audioDuration >= CHUNK_TIME_THRESHOLD ? `${audioDurMin} min` : `${audioSizeMB} MB`;
+      const reason = audioDuration >= chunkTimeThresholdSec ? `${audioDurMin} min` : `${audioSizeMB} MB`;
       log(2, `Large audio (${reason}) — will use chunked transcription with ${transcriber.name}/${transcriptionModel}`);
+    } else if (transcriptionProvider === "relay" && preferredChunkSeconds === null) {
+      log(2, `Sending full file to relay (relay will chunk server-side if needed for its backend)`);
     }
 
     // Transcription model fallback chain: user's chosen model first,
@@ -2350,49 +3780,127 @@ app.post("/api/process", async (req, res) => {
       await fs.mkdir(chunkDir, { recursive: true });
 
       try {
-        const audioChunks = await splitAudioFile(srcPath, chunkDir, 2700); // 45 min chunks
+        // Honor the provider's preferred chunk size (relay reports
+        // this via /relay/capabilities; legacy defaults to 45 min).
+        const chunkSec = preferredChunkSeconds || 2700;
+        const audioChunks = await splitAudioFile(srcPath, chunkDir, chunkSec);
         if (!audioChunks || audioChunks.length <= 1) return null; // splitting not needed
 
-        logFn(`Split audio into ${audioChunks.length} chunks for transcription`);
-        const allEntries = [];
+        logFn(`Split audio into ${audioChunks.length} chunks for transcription (parallel, up to ${Math.min(audioChunks.length, 6)} in flight)`);
         let totalIn = 0, totalOut = 0;
+        const perChunkEntries = new Array(audioChunks.length).fill(null);
 
-        for (const chunk of audioChunks) {
-          logFn(`Transcribing chunk ${chunk.index + 1}/${audioChunks.length} (starts at ${formatTime(chunk.startOffset)})...`);
-          const chunkResult = await transcribeSingleFile(
-            chunk.path, "audio/mpeg", title,
-            modelName,
-            chunk.startOffset
-          );
-
-          // Provider's normalized result: text + usage + cost.
-          totalIn += chunkResult.cost.inputTokens;
-          totalOut += chunkResult.cost.outputTokens;
-
-          const chunkText = chunkResult.text;
-          if (!chunkText) {
-            logFn(`⚠ Chunk ${chunk.index + 1} returned empty response — skipping`);
-            continue;
-          }
-          const chunkEntries = parseTimestampedTranscript(chunkText);
-
-          // Programmatically adjust timestamps: the model transcribes from 0:00 relative
-          // to the chunk, so add the chunk's startOffset to get real video timestamps
-          if (chunk.startOffset > 0) {
-            // Check if the model already adjusted (first entry near the startOffset)
-            const firstOffset = chunkEntries.length > 0 ? chunkEntries[0].offset : 0;
-            const alreadyAdjusted = firstOffset >= chunk.startOffset * 0.8;
-            if (!alreadyAdjusted) {
-              for (const e of chunkEntries) {
-                e.offset += chunk.startOffset;
+        // Fire chunks in parallel with a bounded in-flight count.
+        // 6 is well under Gemini's paid-tier RPM (1k for flash, 150
+        // for pro) and stays comfortable on the relay (which serves
+        // each upload independently). Out-of-order completion is
+        // fine — we sort by chunk index before merging at the end.
+        const CHUNK_CONCURRENCY = 6;
+        let nextChunkIdx = 0;
+        const transcribeOne = async () => {
+          while (true) {
+            const my = nextChunkIdx++;
+            if (my >= audioChunks.length) return;
+            const chunk = audioChunks[my];
+            logFn(`Transcribing chunk ${chunk.index + 1}/${audioChunks.length} (starts at ${formatTime(chunk.startOffset)})...`);
+            try {
+              const chunkResult = await transcribeSingleFile(
+                chunk.path, "audio/mpeg", title,
+                modelName,
+                chunk.startOffset
+              );
+              totalIn += chunkResult.cost.inputTokens;
+              totalOut += chunkResult.cost.outputTokens;
+              const chunkText = chunkResult.text;
+              if (!chunkText) {
+                logFn(`⚠ Chunk ${chunk.index + 1} returned empty response — skipping`);
+                perChunkEntries[my] = [];
+                continue;
               }
-              logFn(`Adjusted chunk ${chunk.index + 1} timestamps by +${formatTime(chunk.startOffset)}`);
+              const chunkEntries = parseTimestampedTranscript(chunkText);
+              if (chunk.startOffset > 0) {
+                const firstOffset = chunkEntries.length > 0 ? chunkEntries[0].offset : 0;
+                const alreadyAdjusted = firstOffset >= chunk.startOffset * 0.8;
+                if (!alreadyAdjusted) {
+                  for (const e of chunkEntries) {
+                    e.offset += chunk.startOffset;
+                  }
+                  logFn(`Adjusted chunk ${chunk.index + 1} timestamps by +${formatTime(chunk.startOffset)}`);
+                }
+              }
+              // Sanity cap: drop any entries whose absolute offset
+              // exceeds the chunk's true time window. Observed bug
+              // (May 2026): gemini-3.1-flash-lite emitted timestamps
+              // like [10:12:44] on a 45-min chunk, which then survived
+              // the merge step and caused the stitched transcript to
+              // claim 10:12:44 total length AND wiped out subsequent
+              // chunks' entries (the merge dedupe rule dropped anything
+              // <= the running max offset). Small tolerance (10s) for
+              // models that mark the END of a phrase rather than the
+              // start, where the actual emission can slightly exceed
+              // the chunk boundary.
+              const chunkEndAbsolute = chunk.startOffset + chunk.durationSec;
+              const TOLERANCE_SEC = 10;
+              const validUpper = chunkEndAbsolute + TOLERANCE_SEC;
+              const filtered = chunkEntries.filter((e) => e.offset <= validUpper);
+              const dropped = chunkEntries.length - filtered.length;
+              if (dropped > 0) {
+                const worstOffset = Math.max(...chunkEntries.map((e) => e.offset || 0));
+                logFn(
+                  `⚠ Chunk ${chunk.index + 1}: dropped ${dropped} segment(s) with bogus timestamps past chunk end ${formatTime(chunkEndAbsolute)} (worst: ${formatTime(worstOffset)}). Model: ${modelName}`
+                );
+              }
+              // Sort by offset before handing off to the merge step.
+              // Some models emit segments out of chronological order
+              // (observed on noisy transcribe outputs); the merge step
+              // relies on monotonically-increasing offsets to dedupe
+              // boundary overlaps. Sorting here guarantees that
+              // invariant per chunk.
+              filtered.sort((a, b) => (a.offset || 0) - (b.offset || 0));
+              // Detect truncated transcripts. If the last entry's
+              // absolute offset is significantly less than the chunk's
+              // expected end, the model probably hit its output-token
+              // cap mid-transcript and lost the tail. Surface as a
+              // loud warning so the operator knows which chunk + model
+              // misbehaved and can switch to a model with bigger
+              // output capacity. We keep the partial entries because
+              // they're better than nothing, but the operator should
+              // know they're looking at incomplete content.
+              const lastAbsolute = filtered.length > 0
+                ? filtered[filtered.length - 1].offset
+                : chunk.startOffset;
+              const expectedEnd = chunk.startOffset + chunk.durationSec;
+              const coverageRatio = chunk.durationSec > 0
+                ? (lastAbsolute - chunk.startOffset) / chunk.durationSec
+                : 1;
+              if (coverageRatio < 0.8 && chunk.durationSec > 60) {
+                const missingSec = expectedEnd - lastAbsolute;
+                logFn(
+                  `⚠ Chunk ${chunk.index + 1}: transcript appears TRUNCATED — last entry at ${formatTime(lastAbsolute)} but chunk ends at ${formatTime(expectedEnd)} (missing ${formatTime(missingSec)} of speech). Model: ${modelName}. Likely cause: model hit maxOutputTokens. Consider a model with larger output capacity, or shrink chunk size.`
+                );
+              }
+              logFn(`Chunk ${chunk.index + 1}: ${filtered.length} segments, last timestamp ${filtered.length > 0 ? formatTime(filtered[filtered.length - 1].offset) : "N/A"} (coverage ${(coverageRatio * 100).toFixed(0)}%)`);
+              perChunkEntries[my] = filtered;
+            } catch (err) {
+              logFn(`⚠ Chunk ${chunk.index + 1} failed: ${err?.message?.slice(0, 120) || err}`);
+              perChunkEntries[my] = [];
             }
           }
+        };
+        const workers = Array.from(
+          { length: Math.min(audioChunks.length, CHUNK_CONCURRENCY) },
+          transcribeOne
+        );
+        await Promise.all(workers);
 
-          logFn(`Chunk ${chunk.index + 1}: ${chunkEntries.length} segments, last timestamp ${chunkEntries.length > 0 ? formatTime(chunkEntries[chunkEntries.length - 1].offset) : "N/A"}`);
-
-          // Merge: skip entries that overlap with already-transcribed content
+        // Merge chunks in chronological order. Per-chunk timestamps
+        // are absolute (we adjusted by startOffset above), so merging
+        // in index order is the same as in time order. The overlap-
+        // skip rule preserves the original behavior: any entry whose
+        // offset has already been covered by a prior chunk is dropped.
+        const allEntries = [];
+        for (const chunkEntries of perChunkEntries) {
+          if (!chunkEntries) continue;
           const lastExistingTime = allEntries.length > 0 ? allEntries[allEntries.length - 1].offset : -1;
           for (const e of chunkEntries) {
             if (e.offset > lastExistingTime) allEntries.push(e);
@@ -2528,55 +4036,118 @@ app.post("/api/process", async (req, res) => {
       ...providerModels.filter((m) => m !== analysisModel),
     ];
 
-    // ── Auto-coalesce input for the analysis LLM ──
-    // Long videos with fine-grained transcripts (Parakeet ~5s / segment
-    // on a 2-hour podcast = ~1400 entries) easily exceed local-model
-    // context windows (typical Gemma/Llama deployments are 16k–32k
-    // tokens). Cap the analyzer's view at ~400 segments; the displayed
-    // transcript keeps its full granularity because we translate the
-    // returned section indices back through indexMap before building
-    // the final chunks. FLAGGED TO WATCH — may impact section-boundary
-    // precision on borderline content.
+    // ── Auto-coalesce input for the analysis LLM (single-shot path only) ──
+    // Long content uses the chunked path (each ~18-min window only sees
+    // a small slice of entries, so context isn't a concern) — coalescing
+    // there would just degrade section-boundary precision unnecessarily.
+    // Short content still goes through a single analyze call; for tiny
+    // local models with 8-16K context windows, a dense Parakeet
+    // transcript at full granularity can still overflow, so we keep
+    // the safety-net coalesce for that path.
+    const lastEntry = entries[entries.length - 1];
+    const totalSec = (lastEntry?.offset || 0) + (lastEntry?.duration || 0);
+    const willChunkAnalysis = totalSec > CHUNKING_CUTOFF_SECONDS;
     const { coalesced: analysisEntries, indexMap: analysisIndexMap } =
-      coalesceForAnalysis(entries, 400);
+      willChunkAnalysis
+        ? { coalesced: entries, indexMap: null }
+        : coalesceForAnalysis(entries, 400);
     if (analysisEntries !== entries) {
       log(
         3,
-        `⚠ AUTO-COALESCED ANALYSIS INPUT: ${entries.length} → ${analysisEntries.length} segments (large prompts can exceed local-model context limits). Transcript display keeps full granularity.`
+        `⚠ Single-shot path: coalesced ${entries.length} → ${analysisEntries.length} segments for analyzer (transcript display keeps full granularity).`
+      );
+    } else if (willChunkAnalysis) {
+      log(
+        3,
+        `Chunked path: keeping full segment granularity (${entries.length} entries) — chunker handles per-window context.`
       );
     }
 
-    const analysisPrompt = buildAnalysisPrompt(analysisEntries);
+    // Helper: convert sections (in analysisEntries index space) into
+    // Recap "chunks" (full UI shape with entries slice + startTime).
+    // Used by both the per-window streaming callback AND the final
+    // assembly below — keeps the two paths in lockstep so what
+    // streams matches what gets saved.
+    const sectionsToChunks = (sections) =>
+      sections
+        .map((section) => {
+          let start = Math.max(0, section.startIndex);
+          let end = section.endIndex;
+          if (analysisIndexMap) {
+            const mappedStart = analysisIndexMap[Math.max(0, Math.min(start, analysisIndexMap.length - 1))];
+            const mappedEnd = analysisIndexMap[Math.max(0, Math.min(end, analysisIndexMap.length - 1))];
+            start = mappedStart ? mappedStart.startOrig : 0;
+            end = mappedEnd ? mappedEnd.endOrig : entries.length - 1;
+          }
+          start = Math.max(0, start);
+          end = Math.min(entries.length - 1, end);
+          const sectionEntries = entries.slice(start, end + 1);
+          return {
+            title: section.title,
+            summary: section.summary,
+            entries: sectionEntries,
+            startTime: sectionEntries[0]?.offset || 0,
+          };
+        })
+        .filter((c) => c.entries.length > 0);
+
+    // Emit transcript_ready so the browser can switch from the
+    // loading screen to the results view immediately — transcript
+    // pane populated, sections pane in "analyzing…" state. Sections
+    // then stream in via sections_partial events as analyze windows
+    // complete (only the chunked path streams; short content gets
+    // its sections in the final result event).
+    const contentType = isPodcast ? "podcast" : "youtube";
+    sendEvent(res, "transcript_ready", {
+      videoId,
+      videoTitle,
+      videoChannel,
+      videoChapters,
+      videoUploadDate,
+      videoDescription,
+      entries,
+      type: contentType,
+      willChunk: willChunkAnalysis,
+    });
+
+    // Single entry point: runChunkedAnalysis decides per-content
+    // whether to single-shot (≤25 min) or window-and-stitch (>25 min).
+    // Per-window concurrency is bounded inside; model fallback walks
+    // the analysisFallbacks list within each window independently.
     let analysisResult = null;
     let usedAnalysisModel = analysisModel;
     const anaStart = Date.now();
-
-    for (const tryModel of analysisFallbacks) {
-      try {
-        log(3, `Analyzing topics across ${analysisEntries.length} segments with ${analyzer.name}/${tryModel}...`);
-        analysisResult = await analyzer.analyzeText({
-          prompt: analysisPrompt,
-          model: tryModel,
-          onProgress: (msg) => log(3, msg),
-          signal: abortController.signal,
-          jobId,
-        });
-        usedAnalysisModel = tryModel;
-        break;
-      } catch (fallbackErr) {
-        // If the user hit Cancel mid-analysis, do not walk to the
-        // next model — the signal is shared across attempts and would
-        // just re-fail. Bubble the cancellation up to the request
-        // handler's catch.
-        if (abortController.signal.aborted || fallbackErr?.name === "AbortError") {
-          throw new Error(CANCELLED_MARK);
-        }
-        const msg = fallbackErr?.message || String(fallbackErr);
-        log(3, `⚠ ${tryModel} failed: ${msg.slice(0, 150)}`);
-        if (tryModel !== analysisFallbacks[analysisFallbacks.length - 1]) {
-          log(3, `Falling back to next model...`);
-        }
+    log(3, `Analyzing topics across ${analysisEntries.length} segments with ${analyzer.name}...`);
+    try {
+      analysisResult = await runChunkedAnalysis({
+        entries: analysisEntries,
+        analyzer,
+        fallbackModels: analysisFallbacks,
+        onProgress: (msg) => log(3, msg),
+        onWindowComplete: ({ windowIdx, totalWindows, ownedSections }) => {
+          // Convert this window's owned sections into the final
+          // chunk shape and stream them to the browser. The stitcher's
+          // "trust the next window for the overlap region" rule was
+          // applied per-window inside runChunkedAnalysis, so what we
+          // emit here is final — the UI won't have to revise it.
+          const partialChunks = sectionsToChunks(ownedSections);
+          if (partialChunks.length > 0) {
+            sendEvent(res, "sections_partial", {
+              windowIdx,
+              totalWindows,
+              chunks: partialChunks,
+            });
+          }
+        },
+        signal: abortController.signal,
+        jobId,
+      });
+      usedAnalysisModel = analysisResult.model || analysisModel;
+    } catch (err) {
+      if (abortController.signal.aborted || err?.name === "AbortError") {
+        throw new Error(CANCELLED_MARK);
       }
+      throw err;
     }
 
     if (!analysisResult) {
@@ -2605,31 +4176,11 @@ app.post("/api/process", async (req, res) => {
       return;
     }
 
-    // Build final chunks. When the analyzer saw a coalesced view of the
-    // transcript (analysisIndexMap is set), translate its section
-    // indices back to the original-entry index space so the rendered
-    // transcript keeps full granularity. Without translation, the
-    // section slice would walk over a much shorter array and miss
-    // 70%+ of the spoken content for very long videos.
-    const chunks = analysisJson.sections.map((section) => {
-      let start = Math.max(0, section.startIndex);
-      let end = section.endIndex;
-      if (analysisIndexMap) {
-        const mappedStart = analysisIndexMap[Math.max(0, Math.min(start, analysisIndexMap.length - 1))];
-        const mappedEnd = analysisIndexMap[Math.max(0, Math.min(end, analysisIndexMap.length - 1))];
-        start = mappedStart ? mappedStart.startOrig : 0;
-        end = mappedEnd ? mappedEnd.endOrig : entries.length - 1;
-      }
-      start = Math.max(0, start);
-      end = Math.min(entries.length - 1, end);
-      const sectionEntries = entries.slice(start, end + 1);
-      return {
-        title: section.title,
-        summary: section.summary,
-        entries: sectionEntries,
-        startTime: sectionEntries[0]?.offset || 0,
-      };
-    }).filter((c) => c.entries.length > 0);
+    // Build final chunks via the same helper used for streaming —
+    // guarantees what the browser accumulated from sections_partial
+    // events matches what gets saved to history and sent in the
+    // canonical result event.
+    const chunks = sectionsToChunks(analysisJson.sections);
 
     const totalTime = ((Date.now() - pipelineStart) / 1000).toFixed(1);
     log(3, `Topic analysis complete in ${anaTime}s — found ${chunks.length} topics`);
@@ -2638,8 +4189,24 @@ app.post("/api/process", async (req, res) => {
     // Save to history. As of the library-for-everyone change, free
     // users save too — the app feels broken otherwise (summarize a
     // video, never find it again).
-    const contentType = isPodcast ? "podcast" : "youtube";
-    const historyId = await saveToHistory(videoId, url, videoTitle, chunks, entries, logHistory, videoUploadDate, contentType).catch(() => null);
+    const historyId = await saveToHistory(scopeForRequest(req), videoId, url, videoTitle, chunks, entries, logHistory, videoUploadDate, contentType).catch(() => null);
+
+    // Debit local credit on success — trial cookie OR free signed-in tenant.
+    if (RECAP_MODE === "multi" && req.trial) {
+      try {
+        const { debitOne } = await import("./anon-trial.js");
+        debitOne(req.trial.cookie_id);
+      } catch (err) {
+        console.warn("[/api/process] trial debit failed:", err);
+      }
+    } else if (RECAP_MODE === "multi" && req.creditsToDebit === "tenant") {
+      try {
+        const { gateAndDebit } = await import("./tenant-credits.js");
+        await gateAndDebit(req.user.id);
+      } catch (err) {
+        console.warn("[/api/process] tenant_credits debit failed:", err);
+      }
+    }
 
     sendEvent(res, "result", { videoId, videoTitle, entries, chunks, historyId, type: contentType });
     res.end();
@@ -2714,6 +4281,7 @@ app.get("/api/network-mode", (req, res) => {
 app.listen(PORT, BIND_HOST, async () => {
   console.log(`\n  Recap API running on http://${BIND_HOST}:${PORT}`);
   console.log(`  Data directory: ${DATA_DIR}`);
+  console.log(`  Recap mode:    ${RECAP_MODE}`);
   console.log(`  Checking yt-dlp...`);
 
   const info = await checkYtdlp();
@@ -2734,29 +4302,41 @@ app.listen(PORT, BIND_HOST, async () => {
     console.log(`  ✓  yt-dlp ${info.version} (up to date)\n`);
   }
 
-  // Check subscriptions on startup
-  const subs = await loadSubscriptions();
-  if (subs.length > 0) {
-    console.log(`  📡  Checking ${subs.length} subscription(s) for new videos...`);
-    await checkSubscriptions().catch(err => console.error("  ⚠  Subscription check error:", err.message));
-    const pending = autoQueue.filter(q => q.status === "pending").length;
-    const approved = autoQueue.filter(q => q.status === "approved").length;
-    if (pending > 0) console.log(`  ✚  ${pending} new video(s) queued from subscriptions`);
-    if (approved > 0) console.log(`  ⏳  ${approved} approved video(s) ready for processing`);
-    if (pending === 0 && approved === 0) console.log(`  ✓  No new videos from subscriptions`);
+  // One-time, idempotent: migrate any legacy install-wide subscription
+  // files into the operator's own scope so storage is uniformly per-scope.
+  try {
+    const moved = await migrateGlobalSubscriptionsToOwner();
+    if (moved > 0) {
+      console.log(`  📦  Migrated ${moved} subscription file(s) into the operator scope`);
+    }
+  } catch (err) {
+    console.warn("  ⚠  Subscription migration skipped:", err.message);
+  }
+  // Prune queued items that have since been summarized, across every scope
+  // that has a queue (owner + each subscribing tenant).
+  for (const s of await listAutoQueueScopes()) {
+    await reconcileAutoQueueWithLibrary(s).catch(() => {});
   }
 
-  // Resume processing any approved items from a previous session
-  const resumeApproved = autoQueue.filter(q => q.status === "approved").length;
-  // Also recover any items stuck in "processing" state from a crash
-  for (const item of autoQueue) {
-    if (item.status === "processing") {
-      console.log(`  ⚠  Recovering stuck item: ${item.title}`);
-      item.status = "approved"; // Re-queue for processing
-    }
+  // Check subscriptions on startup (fans out over all subscribing scopes).
+  console.log(`  📡  Checking subscriptions for new videos...`);
+  await checkSubscriptions().catch(err => console.error("  ⚠  Subscription check error:", err.message));
+
+  // Recover items stuck in "processing" from a crash → re-queue as approved
+  // (across all scopes), then start the processor if anything is ready.
+  let anyApproved = false;
+  for (const s of await listAutoQueueScopes()) {
+    await mutateAutoQueue(s, (items) => {
+      for (const item of items) {
+        if (item.status === "processing") {
+          console.log(`  ⚠  Recovering stuck item (${s}): ${item.title}`);
+          item.status = "approved";
+        }
+      }
+      if (items.some((q) => q.status === "approved")) anyApproved = true;
+    });
   }
-  if (autoQueue.some(q => q.status === "approved")) {
-    await saveAutoQueue();
+  if (anyApproved) {
     console.log(`  🔄  Starting background processor...`);
     // Delay slightly so the server is fully ready before internal HTTP calls
     setTimeout(() => kickProcessor(), 2000);
diff --git a/server/library.js b/server/library.js
index 61bb6d7..5002b11 100644
--- a/server/library.js
+++ b/server/library.js
@@ -4,45 +4,88 @@
 // directly because library import predates the subscriptions module
 // having a public 'merge' helper (and the merge logic is library-
 // specific anyway).
+//
+// As of 0.2.77 (multi-tenant): all reads/writes are scoped to the
+// requesting user via scopeForRequest(req). In single mode the scope
+// is always "owner" — preserved single-user behavior. In multi mode
+// each tenant exports/imports their own library; the operator's
+// admin status doesn't grant cross-user export (a separate operator-
+// only "export everyone's library" endpoint can be added later if
+// the operator ever needs it).
+//
+// Subscriptions remain global (one /data/history/subscriptions.json
+// per install) for now. Per-user subscriptions are a Phase 1D/2 task.
 
 import fs from "fs/promises";
 import path from "path";
 import express from "express";
-import { getHistoryDir, loadMeta, saveMeta } from "./history.js";
+import {
+  getHistoryDir,
+  getScopeHistoryDir,
+  loadMeta,
+  saveMeta,
+  scopeForRequest,
+  ROOT_SIDECARS,
+} from "./history.js";
 
 // ── Routes ──────────────────────────────────────────────────────────────────
 // Both routes are gated by the Pro 'library' entitlement (the gate runs
 // upstream in license-middleware.js). They assume initHistory() has
 // already been called.
 export function setupLibraryRoutes(app) {
+  function requireScope(req, res) {
+    try {
+      return scopeForRequest(req);
+    } catch {
+      res.status(401).json({ error: "auth_required" });
+      return null;
+    }
+  }
+
   // Bulk export everything: meta, sessions, subscriptions.
   app.get("/api/library/export", async (req, res) => {
+    const scope = requireScope(req, res);
+    if (!scope) return;
     try {
-      const historyDir = getHistoryDir();
-      const meta = await loadMeta();
-      const files = await fs.readdir(historyDir);
+      const scopeDir = getScopeHistoryDir(scope);
+      const meta = await loadMeta(scope);
+      let files = [];
+      try {
+        files = await fs.readdir(scopeDir);
+      } catch {
+        files = [];
+      }
       const sessions = {};
       for (const file of files) {
-        if (
-          !file.endsWith(".json") ||
-          file === "_meta.json" ||
-          file === "subscriptions.json" ||
-          file === "auto-queue.json" ||
-          file === "skip-list.json" ||
-          file === "seen-list.json"
-        ) continue;
+        // Skip non-sessions: meta + the subscription sidecar files that now
+        // live inside the scope dir (else they'd export as phantom sessions).
+        if (!file.endsWith(".json") || ROOT_SIDECARS.has(file)) continue;
         try {
-          const raw = await fs.readFile(path.join(historyDir, file), "utf-8");
+          const raw = await fs.readFile(path.join(scopeDir, file), "utf-8");
           const id = file.replace(".json", "");
           sessions[id] = JSON.parse(raw);
         } catch {}
       }
+      // Subscriptions live at the install-wide history root and are
+      // operator-owned (single global store). Only the operator exports
+      // them — in single mode (the operator owns the box) or, in multi
+      // mode, the admin. A non-admin tenant's export must NOT leak the
+      // operator's subscription list. Future per-user subscriptions move
+      // this into the scope dir.
       let subscriptions = [];
-      try {
-        subscriptions = JSON.parse(
-          await fs.readFile(path.join(historyDir, "subscriptions.json"), "utf-8")
-        ).subscriptions || [];
-      } catch {}
+      const ownsSubscriptions =
+        req.recapMode !== "multi" || !!(req.user && req.user.is_admin);
+      if (ownsSubscriptions) {
+        try {
+          subscriptions =
+            JSON.parse(
+              await fs.readFile(
+                path.join(getHistoryDir(), "subscriptions.json"),
+                "utf-8",
+              ),
+            ).subscriptions || [];
+        } catch {}
+      }
 
       const exportData = {
         version: 1,
@@ -54,7 +97,7 @@ export function setupLibraryRoutes(app) {
       res.setHeader("Content-Type", "application/json");
       res.setHeader(
         "Content-Disposition",
-        'attachment; filename="recap-library.json"'
+        'attachment; filename="recap-library.json"',
       );
       res.json(exportData);
     } catch (err) {
@@ -68,6 +111,8 @@ export function setupLibraryRoutes(app) {
     "/api/library/import",
     express.json({ limit: "200mb" }),
     async (req, res) => {
+      const scope = requireScope(req, res);
+      if (!scope) return;
       try {
         const data = req.body;
         if (!data || !data.sessions) {
@@ -76,13 +121,15 @@ export function setupLibraryRoutes(app) {
             .json({ error: "Invalid library file — missing sessions data" });
         }
 
-        const historyDir = getHistoryDir();
+        const scopeDir = getScopeHistoryDir(scope);
+        await fs.mkdir(scopeDir, { recursive: true }).catch(() => {});
+
         let imported = 0;
         let skipped = 0;
 
         // Sessions — skip if already present.
         for (const [id, session] of Object.entries(data.sessions)) {
-          const filePath = path.join(historyDir, `${id}.json`);
+          const filePath = path.join(scopeDir, `${id}.json`);
           try {
             await fs.access(filePath);
             skipped++;
@@ -94,20 +141,20 @@ export function setupLibraryRoutes(app) {
 
         // Meta — merge folders + add new uncategorized at the top.
         if (data.meta) {
-          const existingMeta = await loadMeta();
+          const existingMeta = await loadMeta(scope);
           const allExistingIds = new Set([
             ...existingMeta.uncategorized,
-            ...existingMeta.folders.flatMap(f => f.items),
+            ...existingMeta.folders.flatMap((f) => f.items),
           ]);
 
           if (data.meta.folders) {
             for (const folder of data.meta.folders) {
               const existingFolder = existingMeta.folders.find(
-                f => f.id === folder.id
+                (f) => f.id === folder.id,
               );
               if (!existingFolder) {
                 existingMeta.folders.push(folder);
-                folder.items.forEach(id => allExistingIds.add(id));
+                folder.items.forEach((id) => allExistingIds.add(id));
               }
             }
           }
@@ -120,29 +167,31 @@ export function setupLibraryRoutes(app) {
             }
           }
 
-          await saveMeta(existingMeta);
+          await saveMeta(scope, existingMeta);
         }
 
-        // Subscriptions — merge, dedupe by URL.
-        if (data.subscriptions && data.subscriptions.length > 0) {
+        // Subscriptions — install-wide + operator-owned. Only the operator
+        // (single mode, or multi-mode admin) may import them; otherwise a
+        // tenant's import would inject into the operator's global list.
+        const ownsSubscriptions =
+          req.recapMode !== "multi" || !!(req.user && req.user.is_admin);
+        if (ownsSubscriptions && data.subscriptions && data.subscriptions.length > 0) {
+          const subsPath = path.join(getHistoryDir(), "subscriptions.json");
           let existingSubs = [];
           try {
-            existingSubs = JSON.parse(
-              await fs.readFile(
-                path.join(historyDir, "subscriptions.json"),
-                "utf-8"
-              )
-            ).subscriptions || [];
+            existingSubs =
+              JSON.parse(await fs.readFile(subsPath, "utf-8"))
+                .subscriptions || [];
           } catch {}
-          const existingUrls = new Set(existingSubs.map(s => s.url));
+          const existingUrls = new Set(existingSubs.map((s) => s.url));
           for (const sub of data.subscriptions) {
             if (!existingUrls.has(sub.url)) {
               existingSubs.push(sub);
             }
           }
           await fs.writeFile(
-            path.join(historyDir, "subscriptions.json"),
-            JSON.stringify({ subscriptions: existingSubs })
+            subsPath,
+            JSON.stringify({ subscriptions: existingSubs }),
           );
         }
 
@@ -155,6 +204,6 @@ export function setupLibraryRoutes(app) {
       } catch (err) {
         res.status(500).json({ error: err.message });
       }
-    }
+    },
   );
 }
diff --git a/server/license-middleware.js b/server/license-middleware.js
index 2e10470..ee15818 100644
--- a/server/license-middleware.js
+++ b/server/license-middleware.js
@@ -247,6 +247,30 @@ const LICENSE_OPEN_PREFIXES = [
   "/api/library",
   "/api/providers",
   "/api/process",
+  // Audio-first ("walking mode") TTS. The /api/tts routes self-gate
+  // access (Max entitlement in multi mode; operator-only otherwise), so
+  // the blanket license middleware must let them through to that gate
+  // rather than 402-ing single-mode operators or Max users here.
+  "/api/tts",
+  // In-app purchase flow: GET /api/license/policies, POST
+  // /api/license/purchase, GET /api/license/poll/<invoiceId>. Buyers
+  // are unlicensed by definition — they must reach these before any
+  // license exists.
+  "/api/license/policies",
+  "/api/license/purchase",
+  "/api/license/poll",
+  // Relay credit top-up purchases: GET /api/credits/packages, POST
+  // /api/credits/buy, GET /api/credits/invoice/<id>. Buying credits
+  // doesn't require a license — Core (free) users should be able to
+  // top up just as easily as Pro/Max. The relay itself enforces
+  // billing via BTCPay; we just proxy.
+  "/api/credits",
+  // Self-serve subscription purchase: POST /api/billing/buy, GET
+  // /api/billing/status. A Core (free) user buying their way UP to
+  // Pro/Max is unlicensed by definition, so the activation gate must
+  // let them reach the buy + poll routes. The routes self-gate to a
+  // real signed-in user (req.user.id).
+  "/api/billing",
 ];
 
 // ── Pro-tier feature gates ──────────────────────────────────────────────────
@@ -264,7 +288,7 @@ const PRO_FEATURE_GATES = [
     entitlement: "subscriptions",
     feature: "subscriptions",
     message:
-      "Channel subscriptions and auto-queue require a paid license. Upgrade to unlock.",
+      "Channel subscriptions and auto-queue require a Pro or Max plan. Upgrade to unlock.",
   },
 ];
 
@@ -286,7 +310,7 @@ export function setupLicenseMiddleware(app) {
       message:
         LIC.state === "licensed"
           ? "Your license is missing the 'pro' or 'max' entitlement. Contact the seller."
-          : "This feature requires a Recap license. Upgrade to unlock.",
+          : "This feature requires a Recaps license. Upgrade to unlock.",
       state: LIC.state,
       reason: LIC.reason,
       activate_url: "/#activate",
@@ -299,6 +323,25 @@ export function setupLicenseMiddleware(app) {
   app.use((req, res, next) => {
     for (const gate of PRO_FEATURE_GATES) {
       if (gate.prefixes.some((p) => req.path.startsWith(p))) {
+        // Multi mode (cloud): per-tenant — the user's relay-owned tier
+        // decides. Pro/Max (or the admin/operator) get in; free tenants get
+        // a clear 402. This is the per-tenant subscriptions gate.
+        if (req.recapMode === "multi") {
+          const tier = req.user?.tier;
+          if (
+            (req.user && req.user.is_admin) ||
+            tier === "pro" ||
+            tier === "max"
+          ) {
+            return next();
+          }
+          return res.status(402).json({
+            error: "feature_not_in_tier",
+            feature: gate.feature,
+            message: gate.message,
+          });
+        }
+        // Single mode: the operator's own license carries the entitlement.
         if (LIC.entitlements.has(gate.entitlement)) return next();
         return res.status(402).json({
           error: "feature_not_in_tier",
@@ -317,7 +360,44 @@ export function setupLicenseMiddleware(app) {
 // Open by virtue of being in LICENSE_OPEN_PATHS — the gate lets them
 // through unauthenticated.
 export function setupLicenseRoutes(app) {
-  app.get("/api/license-status", (_req, res) => {
+  app.get("/api/license-status", (req, res) => {
+    // ── Multi-mode: return per-user view ────────────────────────────────
+    // The OPERATOR's license at /data/license.txt is "the install" — the
+    // pool that pays for free + trial users. Each signed-in cloud user
+    // has their own state:
+    //   - paid user (users.tier = pro|max) → synthesize a license view
+    //     from their relay-owned tier (core-decoupling: no Keysat license)
+    //   - free tenant (signed in, Core tier) → unlicensed view (they're
+    //     not Pro; their balance comes from tenant_credits via /relay/status)
+    //   - anonymous/trial → unlicensed view (the badge should show trial
+    //     credits, NOT the operator's PRO tier)
+    //   - admin (is_admin = 1) → the operator's LIC (they ARE the
+    //     operator; same UX as single mode)
+    if (req.recapMode === "multi") {
+      if (req.user && req.user.is_admin) {
+        // Operator viewing their own server: full operator license view.
+        return res.json(license.publicView(LIC));
+      }
+      // Paid cloud user — the tier is the relay-owned subscription tier,
+      // cached on the Recaps account (req.user.tier) and kept in sync by
+      // the operator grant flow. Synthesize a license view from it so the
+      // badge + per-user gates match a license-bearing user. Core-
+      // decoupling: this is the SOLE source of paid status in multi mode —
+      // a leftover per-user keysat_license is deliberately NOT consulted
+      // (licenses are moot in the cloud path), so the badge always agrees
+      // with the relay-owned tier shown in the operator's Tenants panel.
+      const tier = req.user?.tier;
+      if (req.user && (tier === "pro" || tier === "max")) {
+        return res.json(license.viewForTier(tier));
+      }
+      // Free tenant (tier core), trial, or fully anonymous — return an
+      // unlicensed view. Frontend uses this to hide the PRO badge / "manage
+      // license" affordances. Balance display comes from /api/relay/status
+      // (which is also multi-mode-aware).
+      return res.json(license.publicView(license.parseLicenseKey("")));
+    }
+
+    // ── Single-mode (the existing path) ─────────────────────────────────
     // Opportunistic refresh: if the cached state is more than
     // OPPORTUNISTIC_REFRESH_THRESHOLD_MS old, fire a validateOnline in
     // the background. Doesn't block the response — the next status hit
diff --git a/server/license-purchase.js b/server/license-purchase.js
new file mode 100644
index 0000000..99c5812
--- /dev/null
+++ b/server/license-purchase.js
@@ -0,0 +1,425 @@
+// In-app buy flow. Proxies the Keysat public API (policies + purchase
+// + poll) through Recap so the frontend renders tier cards in Recap's
+// own visual style instead of being redirected to Keysat's hosted
+// `/buy/<slug>` page.
+//
+// API shape implemented here matches the Keysat spec exactly:
+//   GET  /api/license/policies         → listPublicPolicies(PRODUCT_SLUG)
+//   POST /api/license/purchase         → startPurchase(PRODUCT_SLUG, opts)
+//   GET  /api/license/poll/:invoiceId  → pollPurchase(invoiceId); on a
+//                                        settled invoice this also
+//                                        ACTIVATES the issued license
+//                                        on this Recap install so the
+//                                        next license-status refresh
+//                                        sees the new entitlements.
+//
+// All three routes are open to unlicensed users — buyers need to reach
+// them before they have a license, by definition.
+
+import { Client } from "@keysat/licensing-client";
+import * as license from "./license.js";
+
+const KEYSAT_BASE_URL = license.KEYSAT_BASE_URL;
+const PRODUCT_SLUG = license.PRODUCT_SLUG;
+
+// Multi-mode toggle. In single mode (the default), an activated license
+// is written to /data/license.txt — operator-install-wide. In multi
+// mode, the buyer is a logged-in user and the license attaches to
+// THEIR users row instead. Set at module load; the file is re-imported
+// by tests so module-level state isn't an issue.
+const RECAP_MODE = process.env.RECAP_MODE === "multi" ? "multi" : "single";
+
+// Lazy-init the SDK client so a missing import doesn't crash boot.
+let _client = null;
+function getClient() {
+  if (!_client) _client = new Client(KEYSAT_BASE_URL);
+  return _client;
+}
+
+// Tiny in-memory cache for the policies response. Keysat's admin can
+// change tiers any time so don't cache long — 30s strikes the balance
+// between "operator edit takes effect quickly" and "don't hammer the
+// licensing server on every browser-side modal mount". Pair this
+// with using ?refresh=1 on the client if you need to invalidate
+// faster than the TTL.
+const POLICIES_TTL_MS = 30 * 1000;
+let _policiesCache = { at: 0, body: null };
+
+export function setupLicensePurchaseRoutes(app, { onLicenseActivated } = {}) {
+  // ── List tiers ────────────────────────────────────────────────────────────
+  // We deliberately bypass the SDK's listPublicPolicies() here because
+  // it strips fields we need to render the buy page: marketing_bullets,
+  // marketing_bullets_position, hidden_entitlements, and
+  // featured_discount. Hitting the public HTTP endpoint directly gives
+  // us the full snake_case JSON with everything the Keysat hosted /buy
+  // page renders, so we can match its data parity in Recap's own
+  // visual style.
+  app.get("/api/license/policies", async (_req, res) => {
+    if (_policiesCache.body && Date.now() - _policiesCache.at < POLICIES_TTL_MS) {
+      return res.json({
+        keysat_base_url: KEYSAT_BASE_URL,
+        product_slug: PRODUCT_SLUG,
+        ..._policiesCache.body,
+      });
+    }
+    try {
+      const url = `${KEYSAT_BASE_URL.replace(/\/$/, "")}/v1/products/${encodeURIComponent(PRODUCT_SLUG)}/policies`;
+      const r = await fetch(url, {
+        signal: AbortSignal.timeout(8000),
+      });
+      if (!r.ok) {
+        const body = await r.text().catch(() => "");
+        throw new Error(`HTTP ${r.status}: ${body.slice(0, 200)}`);
+      }
+      const data = await r.json();
+      _policiesCache = { at: Date.now(), body: data };
+      res.json({
+        keysat_base_url: KEYSAT_BASE_URL,
+        product_slug: PRODUCT_SLUG,
+        ...data,
+      });
+    } catch (err) {
+      console.error(`[license/policies] failed: ${err?.message || err}`);
+      res.status(502).json({
+        error: "policies_fetch_failed",
+        message: (err?.message || String(err)).slice(0, 300),
+      });
+    }
+  });
+
+  // ── Start purchase ────────────────────────────────────────────────────────
+  // Body: { policySlug: string, buyerEmail?: string, code?: string,
+  //         redirectUrl?: string, buyerNote?: string }
+  // Returns the FULL raw Keysat /v1/purchase response, including
+  // discount fields: { invoice_id, checkout_url, final_price_sats,
+  // discount_applied_sats, amount_sats, btcpay_invoice_id, poll_url }.
+  // We bypass the SDK (which strips final_price_sats /
+  // discount_applied_sats from PurchaseSession) so the UI can show
+  // "you saved N sats" before sending the buyer to BTCPay.
+  //
+  // Multi-mode anon-signup flow: if there's no signed-in user AND a
+  // buyer_email is supplied, we treat this as a "create-account-via-
+  // purchase" flow. We record a pending_signups row keyed by the
+  // invoice id so the poll-settle handler can create the user + send
+  // the license-ready magic-link email once payment lands.
+  app.post("/api/license/purchase", async (req, res) => {
+    const {
+      policySlug,
+      buyerEmail,
+      code,
+      redirectUrl,
+      buyerNote,
+    } = req.body || {};
+    if (!policySlug || typeof policySlug !== "string") {
+      return res.status(400).json({
+        error: "missing_policy_slug",
+        message:
+          "policySlug is required — get it from /api/license/policies, never hardcode.",
+      });
+    }
+    // Anon-signup gate: in multi-mode, if no signed-in user, an email
+    // is REQUIRED — that's how the settle handler knows who to send
+    // the "your account is ready" link to. Signed-in users in multi
+    // mode have their email implicit via req.user.email (still passed
+    // via buyerEmail prefill from the frontend), so this only blocks
+    // the truly-anon-no-email edge case.
+    const isAnonSignup =
+      RECAP_MODE === "multi" && !req.user && !!buyerEmail;
+    if (RECAP_MODE === "multi" && !req.user && !buyerEmail) {
+      return res.status(400).json({
+        error: "email_required",
+        message:
+          "Enter your email — we'll send a sign-in link once your payment confirms.",
+      });
+    }
+    try {
+      const url = `${KEYSAT_BASE_URL.replace(/\/$/, "")}/v1/purchase`;
+      const r = await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          // Keysat's /v1/purchase expects `product` (NOT `product_slug`,
+          // despite what its own developer-facing instructions show).
+          // The SDK confirms this — see vendor/keysat-licensing-client
+          // dist/index.js, startPurchase POST body.
+          product: PRODUCT_SLUG,
+          policy_slug: policySlug,
+          buyer_email: buyerEmail || undefined,
+          code: code || undefined,
+          redirect_url: redirectUrl || undefined,
+          buyer_note: buyerNote || undefined,
+        }),
+        signal: AbortSignal.timeout(15000),
+      });
+      const text = await r.text();
+      let body = null;
+      try { body = text ? JSON.parse(text) : null; } catch {}
+      if (!r.ok) {
+        return res.status(r.status === 400 ? 400 : 502).json({
+          error:
+            (body && (body.error || body.code)) || "purchase_failed",
+          message:
+            (body && (body.message || body.detail)) ||
+            text?.slice(0, 300) ||
+            `HTTP ${r.status}`,
+        });
+      }
+      // Stash pending_signups row BEFORE responding so a browser
+      // crash between buy + settle doesn't lose the buyer's email.
+      // Keysat's response shape: invoice_id at the root.
+      const invoiceId = body?.invoice_id || null;
+      if (isAnonSignup && invoiceId) {
+        try {
+          const { getDb } = await import("./db.js");
+          getDb()
+            .prepare(
+              `INSERT OR IGNORE INTO pending_signups
+                 (invoice_id, email, policy_slug, created_at)
+               VALUES (?, ?, ?, ?)`,
+            )
+            .run(
+              invoiceId,
+              buyerEmail.trim().toLowerCase(),
+              policySlug,
+              Date.now(),
+            );
+          console.log(
+            `[license/purchase] tracked pending signup ${invoiceId} → ${buyerEmail} (${policySlug})`,
+          );
+        } catch (err) {
+          // Non-fatal — the BTCPay invoice still goes through. If we
+          // can't apply on settle, the operator can manually look up
+          // the Keysat invoice + activate the license + email the
+          // buyer.
+          console.error(
+            `[license/purchase] failed to record pending signup ${invoiceId}: ${err?.message || err}`,
+          );
+        }
+      }
+      // Pass the raw response straight through — the frontend reads
+      // final_price_sats + discount_applied_sats off it to render the
+      // discount preview before opening the checkout.
+      res.json(body || {});
+    } catch (err) {
+      console.error(`[license/purchase] failed: ${err?.message || err}`);
+      res.status(502).json({
+        error: "purchase_failed",
+        message: (err?.message || String(err)).slice(0, 300),
+      });
+    }
+  });
+
+  // ── Poll for license issuance ─────────────────────────────────────────────
+  // While the BTCPay invoice is pending, status="pending" and no
+  // licenseKey. Once paid + signed, status="settled" and the response
+  // carries the LIC1-... key. On settle, we ACTIVATE the key on this
+  // install (writes to /data/license.txt, refreshes module-scoped LIC
+  // state) so the next license-status fetch reflects the new
+  // entitlements. The frontend just calls /api/license-status after
+  // this returns settled.
+  app.get("/api/license/poll/:invoiceId", async (req, res) => {
+    const invoiceId = (req.params.invoiceId || "").trim();
+    if (!invoiceId) {
+      return res.status(400).json({ error: "missing_invoice_id" });
+    }
+    try {
+      const poll = await getClient().pollPurchase(invoiceId);
+      if (
+        poll.status === "settled" &&
+        typeof poll.licenseKey === "string" &&
+        poll.licenseKey.startsWith("LIC1-")
+      ) {
+        // Settle path forks on mode + buyer identity:
+        //   - single mode: write the key to /data/license.txt so the
+        //     OPERATOR install is now licensed (existing behavior).
+        //   - multi mode + signed-in buyer: attach the key to the
+        //     buyer's user row (users.keysat_license). The next
+        //     resolveProviderOpts() call for that user picks up the
+        //     new license automatically (req.user is re-read
+        //     per-request, so the change is immediate after the
+        //     next signed-in request hits the server).
+        //   - multi mode + anon buyer with pending_signups row:
+        //     create-or-match a user by buyer_email, attach the
+        //     license, send a magic-link email so they can sign in.
+        //     Idempotent via pending_signups.applied_at.
+        //   - multi mode + anon buyer with NO pending row: fall back
+        //     to the single-mode path (write to /data/license.txt).
+        //     This is defensive — shouldn't happen in normal flow.
+        try {
+          let routedToUser = false;
+          if (RECAP_MODE === "multi" && req?.user?.id) {
+            const { getDb } = await import("./db.js");
+            getDb()
+              .prepare("UPDATE users SET keysat_license = ? WHERE id = ?")
+              .run(poll.licenseKey, req.user.id);
+            // Mutate the in-memory req.user so subsequent calls in
+            // the same request see the new license. (next request
+            // re-reads from DB so this is belt-and-suspenders.)
+            req.user.keysat_license = poll.licenseKey;
+            routedToUser = true;
+            console.log(
+              `[license/poll] attached license to user ${req.user.id}`,
+            );
+          } else if (RECAP_MODE === "multi") {
+            const applied = await maybeApplyPendingSignup(
+              invoiceId,
+              poll.licenseKey,
+              req,
+            );
+            if (applied) routedToUser = true;
+          }
+          if (!routedToUser) {
+            license.activate(poll.licenseKey);
+            if (typeof onLicenseActivated === "function") {
+              await onLicenseActivated();
+            }
+          }
+        } catch (e) {
+          console.error(
+            `[license/poll] activate-on-settle failed: ${e?.message || e}`
+          );
+          // Don't fail the response — the buyer's checkout succeeded,
+          // they shouldn't see a 500. They can hit "I have a key" and
+          // paste the key manually as a fallback (or, in multi mode,
+          // operator can run an admin SQL update).
+        }
+      }
+      res.json(poll);
+    } catch (err) {
+      console.error(`[license/poll] failed: ${err?.message || err}`);
+      res.status(502).json({
+        error: "poll_failed",
+        message: (err?.message || String(err)).slice(0, 300),
+      });
+    }
+  });
+}
+
+// maybeApplyPendingSignup(invoiceId, licenseKey, req) — multi-mode
+// anon-signup settle path. Looks up the pending_signups row for this
+// invoice and, if not already applied:
+//   1. Create or match a user by buyer email (lowercased)
+//   2. Attach the issued license to users.keysat_license
+//   3. Send a "your Recap [Pro|Max] account is ready" magic-link email
+//   4. Mark applied_at = now
+// Returns true if applied, false if no pending row or already applied.
+//
+// Idempotent: a duplicate poll after settle is a no-op because
+// applied_at is the guard.
+async function maybeApplyPendingSignup(invoiceId, licenseKey, req) {
+  const { getDb } = await import("./db.js");
+  const db = getDb();
+  const pending = db
+    .prepare(
+      `SELECT invoice_id, email, policy_slug, applied_at
+       FROM pending_signups WHERE invoice_id = ?`,
+    )
+    .get(invoiceId);
+  if (!pending) return false;
+  if (pending.applied_at) return true; // already applied
+
+  const email = pending.email;
+  const policySlug = pending.policy_slug;
+
+  // Parse the license to derive the tier label (for the email copy).
+  // Falls back to "Pro" if parsing fails — same default as the UI.
+  let tierLabel = "Pro";
+  try {
+    const { parseLicenseKey } = await import("./license.js");
+    const parsed = parseLicenseKey(licenseKey);
+    if (parsed && parsed.entitlements) {
+      if (parsed.entitlements.has("max")) tierLabel = "Max";
+      else if (parsed.entitlements.has("pro")) tierLabel = "Pro";
+    }
+  } catch {}
+
+  // Create-or-match user. If a user with this email already exists,
+  // attach the license to their account (case 'a' from the design
+  // doc: "friendliest — handles the 'I forgot I had an account' case").
+  // Otherwise insert a new stub user.
+  let user = db
+    .prepare("SELECT id, email, keysat_license FROM users WHERE email = ?")
+    .get(email);
+
+  const now = Date.now();
+  const tx = db.transaction(() => {
+    let userId;
+    if (user) {
+      userId = user.id;
+      db.prepare(
+        "UPDATE users SET keysat_license = ?, last_signin_at = ? WHERE id = ?",
+      ).run(licenseKey, now, userId);
+    } else {
+      userId = randomUuid();
+      const syntheticInstallId = randomUuid();
+      db.prepare(
+        `INSERT INTO users
+          (id, email, created_at, last_signin_at, synthetic_install_id,
+           keysat_license, is_admin)
+         VALUES (?, ?, ?, ?, ?, ?, 0)`,
+      ).run(userId, email, now, now, syntheticInstallId, licenseKey);
+      console.log(
+        `[license/poll] anon-signup created user ${userId} <${email}> with ${tierLabel} license`,
+      );
+    }
+    db.prepare(
+      "UPDATE pending_signups SET applied_at = ? WHERE invoice_id = ?",
+    ).run(now, invoiceId);
+    return userId;
+  });
+  const userId = tx();
+
+  // Send the "your account is ready" magic-link email. Best-effort —
+  // if SMTP fails, the user can hit /auth.html and request a regular
+  // sign-in link (their account now exists with the license attached).
+  try {
+    const { sendSignInLink } = await import("./auth-routes.js");
+    const { renderLicenseReadyEmail } = await import(
+      "./license-ready-email.js"
+    );
+    // Build the email body using the verifyUrl that sendSignInLink
+    // will produce. We pass emailBody to override the default sign-in
+    // copy with the celebratory purchase-confirmation framing.
+    // sendSignInLink generates verifyUrl internally and the body uses
+    // a placeholder we string-substitute below — but actually
+    // sendSignInLink already accepts emailBody. We need to construct
+    // it with the verifyUrl already inserted. So we'll pre-render
+    // emailBody with verifyUrl set to a token-placeholder string,
+    // BUT sendSignInLink doesn't expose verifyUrl... Use a small
+    // bridge: render emailBody after sendSignInLink runs by passing
+    // a callback. Simplest: just send the link via auth-routes'
+    // existing helper which has the right copy via emailBody override.
+    //
+    // Actually sendSignInLink computes verifyUrl after the token is
+    // generated. To inject custom copy, the helper needs verifyUrl
+    // in scope. We pass emailBody as a FUNCTION that receives the
+    // verifyUrl and returns the {subject,text,html} tuple — but the
+    // current signature accepts an object. Refactor in v0.2.94 if
+    // needed. For now the helper accepts either object or function.
+    await sendSignInLink({
+      email,
+      intent: "license_purchase",
+      emailBody: (verifyUrl) =>
+        renderLicenseReadyEmail({
+          verifyUrl,
+          tierLabel,
+          brandName: "Recaps",
+          expiresInMinutes: 15,
+        }),
+    });
+  } catch (err) {
+    console.error(
+      `[license/poll] license-ready email send failed for ${email}: ${err?.message || err}`,
+    );
+  }
+  return true;
+}
+
+// Local UUID helper — same shape we use in auth-routes for new users.
+// Avoids a hard import dep just for this one call.
+function randomUuid() {
+  // Same crypto.randomBytes(16).toString("hex") pattern used elsewhere.
+  // eslint-disable-next-line global-require
+  const { randomBytes } = require("crypto");
+  return randomBytes(16).toString("hex");
+}
diff --git a/server/license-ready-email.js b/server/license-ready-email.js
new file mode 100644
index 0000000..3e76448
--- /dev/null
+++ b/server/license-ready-email.js
@@ -0,0 +1,93 @@
+// "Your Recap [Pro|Max] account is ready" email — sent after an
+// anon buyer's BTCPay invoice settles. Distinct from the standard
+// sign-in magic-link email because the framing is celebratory ("your
+// purchase is confirmed, click here to access") rather than the
+// transactional "click here to sign in." Both share the underlying
+// magic-link mechanism — only the copy and subject differ.
+//
+// Returns { subject, text, html } in the nodemailer shape.
+
+export function renderLicenseReadyEmail({
+  verifyUrl,
+  tierLabel = "Pro",
+  brandName = "Recaps",
+  expiresInMinutes = 15,
+}) {
+  const subject = `Your ${brandName} ${tierLabel} account is ready`;
+
+  const text = [
+    `Thanks for upgrading to ${brandName} ${tierLabel} — your payment is confirmed.`,
+    "",
+    `Click the link below to sign in to your new account. ${tierLabel} is already active and your license is attached.`,
+    "",
+    verifyUrl,
+    "",
+    `This link expires in ${expiresInMinutes} minutes and can only be used once. If it expires, just go back to ${brandName} and request a fresh sign-in link from the same email.`,
+    "",
+    "Welcome aboard.",
+  ].join("\n");
+
+  const html = `<!doctype html>
+<html>
+  <body style="margin:0;padding:0;background:#fafafa;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;">
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#fafafa;padding:32px 0;">
+      <tr>
+        <td align="center">
+          <table role="presentation" width="480" cellpadding="0" cellspacing="0" style="background:#ffffff;border-radius:8px;padding:32px;max-width:90%;">
+            <tr>
+              <td style="font-size:18px;font-weight:600;color:#111;padding-bottom:8px;">
+                Your ${escapeHtml(brandName)} ${escapeHtml(tierLabel)} account is ready
+              </td>
+            </tr>
+            <tr>
+              <td style="font-size:14px;line-height:1.55;color:#444;padding-bottom:8px;">
+                Thanks for upgrading — your payment is confirmed and your <strong>${escapeHtml(tierLabel)}</strong> license is attached to your new account.
+              </td>
+            </tr>
+            <tr>
+              <td style="font-size:14px;line-height:1.55;color:#444;padding-bottom:24px;">
+                Click the button below to sign in. The link expires in ${expiresInMinutes} minutes.
+              </td>
+            </tr>
+            <tr>
+              <td align="center" style="padding-bottom:24px;">
+                <a href="${escapeAttr(verifyUrl)}" style="display:inline-block;background:#3b82f6;color:#fff;text-decoration:none;font-size:15px;font-weight:600;padding:12px 24px;border-radius:6px;">Sign in to ${escapeHtml(brandName)}</a>
+              </td>
+            </tr>
+            <tr>
+              <td style="font-size:13px;line-height:1.5;color:#888;padding-bottom:8px;">
+                Or copy and paste this URL into your browser:
+              </td>
+            </tr>
+            <tr>
+              <td style="font-size:12px;color:#888;word-break:break-all;padding-bottom:24px;">
+                ${escapeHtml(verifyUrl)}
+              </td>
+            </tr>
+            <tr>
+              <td style="font-size:12px;line-height:1.5;color:#888;border-top:1px solid #eee;padding-top:16px;">
+                If the link expires before you click it, you can request a fresh sign-in link from ${escapeHtml(brandName)} using this same email. Your ${escapeHtml(tierLabel)} license will already be on the account when you sign in.
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>`;
+
+  return { subject, text, html };
+}
+
+function escapeHtml(s) {
+  return String(s)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+function escapeAttr(s) {
+  return escapeHtml(s);
+}
diff --git a/server/license.js b/server/license.js
index d85b338..f896f64 100644
--- a/server/license.js
+++ b/server/license.js
@@ -230,6 +230,42 @@ export function checkLicense() {
   return base;
 }
 
+// parseLicenseKey(rawKey) — verify an arbitrary LIC1- string without
+// touching disk or persisted state. Used in multi-tenant mode to build
+// a publicView for a license stored on a user's row (users.keysat_license)
+// rather than the operator's /data/license.txt. Returns the same state
+// shape as checkLicense() so publicView(state) works uniformly.
+//
+// Differences from checkLicense:
+//   - Doesn't read /data/license.txt (rawKey is passed in)
+//   - Doesn't layer persisted online state (each user's license has
+//     its own online status; we'd need per-user state files to track
+//     that — out of scope for MVP, accept "offline-verified but
+//     online-unknown" as good enough)
+export function parseLicenseKey(rawKey) {
+  if (verifierError) {
+    return emptyState({ state: "invalid", reason: `bad embedded key: ${verifierError}` });
+  }
+  const raw = (rawKey || "").trim();
+  if (!raw || !raw.startsWith("LIC1-")) return emptyState();
+  try {
+    const ok = verifier.verify(raw);
+    const payload = ok.payload || {};
+    if (payload.productSlug && payload.productSlug !== PRODUCT_SLUG) {
+      return emptyState({ state: "invalid", reason: "product_mismatch" });
+    }
+    return emptyState({
+      state: "licensed",
+      licenseId: payload.licenseUuid || null,
+      entitlements: new Set(payload.entitlements || []),
+      expiresAt: payload.expiresAt ? new Date(payload.expiresAt * 1000) : null,
+      isTrial: !!(payload.flags & 1),
+    });
+  } catch (e) {
+    return emptyState({ state: "invalid", reason: e?.message || "verify_failed" });
+  }
+}
+
 // activate(rawKey) — write a pasted key to disk, then re-check.
 // Returns the new license state. Throws on bad input format only;
 // signature failures surface as state: 'invalid' with a reason.
@@ -401,6 +437,40 @@ export function publicView(state) {
   };
 }
 
+// viewForTier(tier, opts) — a publicView-shaped object synthesized from a
+// relay-owned subscription tier ("pro" | "max"), for core-decoupling cloud
+// users who have NO Keysat license. The entitlement sets mirror the Pro/Max
+// license keys documented at the top of this file, so the frontend badge AND
+// the per-user feature gates behave identically to a license-bearing user.
+// Anything other than "pro"/"max" yields an unlicensed view (no paid
+// entitlements). `expiresAt` is an optional ISO string (the relay owns the
+// authoritative expiry; Recaps caches only the tier, so this is usually null).
+export function viewForTier(tier, { expiresAt = null } = {}) {
+  const t = (tier || "").toLowerCase();
+  let entitlements;
+  if (t === "max") {
+    entitlements = ["max", "subscriptions", "relay_max"];
+  } else if (t === "pro") {
+    entitlements = ["pro", "subscriptions", "relay_pro"];
+  } else {
+    entitlements = [];
+  }
+  return {
+    state: entitlements.length ? "licensed" : "unlicensed",
+    reason: null,
+    licenseId: null,
+    entitlements: entitlements.sort(),
+    expiresAt: expiresAt || null,
+    isTrial: false,
+    productSlug: PRODUCT_SLUG,
+    keysatBaseUrl: KEYSAT_BASE_URL,
+    licensePath: LICENSE_PATH,
+    lastValidatedAt: null,
+    serverStatus: null,
+    graceUntil: null,
+  };
+}
+
 // has(state, entitlement) — convenience wrapper for feature gates.
 export function has(state, entitlement) {
   return state && state.entitlements && state.entitlements.has(entitlement);
diff --git a/server/package-lock.json b/server/package-lock.json
index 0b34c42..f178f3b 100644
--- a/server/package-lock.json
+++ b/server/package-lock.json
@@ -11,8 +11,11 @@
         "@anthropic-ai/sdk": "^0.95.0",
         "@google/genai": "^1.41.0",
         "@keysat/licensing-client": "file:../vendor/keysat-licensing-client",
+        "better-sqlite3": "^11.5.0",
+        "cookie": "^1.0.1",
         "cors": "^2.8.5",
         "express": "^4.21.0",
+        "nodemailer": "^6.9.16",
         "openai": "^6.37.0"
       }
     },
@@ -220,6 +223,17 @@
       ],
       "license": "MIT"
     },
+    "node_modules/better-sqlite3": {
+      "version": "11.10.0",
+      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-11.10.0.tgz",
+      "integrity": "sha512-EwhOpyXiOEL/lKzHz9AW1msWFNzGc/z+LzeB3/jnFJpxu+th2yqvzsSWas1v9jgs9+xiXJcD5A8CJxAG2TaghQ==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "bindings": "^1.5.0",
+        "prebuild-install": "^7.1.1"
+      }
+    },
     "node_modules/bignumber.js": {
       "version": "9.3.1",
       "resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-9.3.1.tgz",
@@ -229,6 +243,26 @@
         "node": "*"
       }
     },
+    "node_modules/bindings": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
+      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+      "license": "MIT",
+      "dependencies": {
+        "file-uri-to-path": "1.0.0"
+      }
+    },
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      }
+    },
     "node_modules/body-parser": {
       "version": "1.20.5",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
@@ -268,6 +302,30 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
     "node_modules/buffer-equal-constant-time": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
@@ -312,6 +370,12 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "license": "ISC"
+    },
     "node_modules/content-disposition": {
       "version": "0.5.4",
       "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
@@ -334,12 +398,16 @@
       }
     },
     "node_modules/cookie": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
       "license": "MIT",
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/cookie-signature": {
@@ -383,6 +451,30 @@
         "ms": "2.0.0"
       }
     },
+    "node_modules/decompress-response": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "mimic-response": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
     "node_modules/depd": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
@@ -402,6 +494,15 @@
         "npm": "1.2.8000 || >= 1.4.16"
       }
     },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
@@ -440,6 +541,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/end-of-stream": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
+      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
+      "license": "MIT",
+      "dependencies": {
+        "once": "^1.4.0"
+      }
+    },
     "node_modules/es-define-property": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
@@ -485,6 +595,15 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "license": "(MIT OR WTFPL)",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/express": {
       "version": "4.22.1",
       "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
@@ -531,6 +650,15 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/express/node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/extend": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
@@ -566,6 +694,12 @@
         "node": "^12.20 || >= 14.13"
       }
     },
+    "node_modules/file-uri-to-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
+      "license": "MIT"
+    },
     "node_modules/finalhandler": {
       "version": "1.3.2",
       "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
@@ -614,6 +748,12 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "license": "MIT"
+    },
     "node_modules/function-bind": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
@@ -688,6 +828,12 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
+      "license": "MIT"
+    },
     "node_modules/google-auth-library": {
       "version": "10.6.2",
       "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-10.6.2.tgz",
@@ -818,12 +964,38 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/inherits": {
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "license": "ISC"
+    },
     "node_modules/ipaddr.js": {
       "version": "1.9.1",
       "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
@@ -951,12 +1123,45 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/mimic-response": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/mkdirp-classic": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
+      "license": "MIT"
+    },
     "node_modules/ms": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "license": "MIT"
     },
+    "node_modules/napi-build-utils": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
+      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
+      "license": "MIT"
+    },
     "node_modules/negotiator": {
       "version": "0.6.3",
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
@@ -966,6 +1171,18 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/node-abi": {
+      "version": "3.92.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.92.0.tgz",
+      "integrity": "sha512-KdHvFWZjEKDf0cakgFjebl371GPsISX2oZHcuyKqM7DtogIsHrqKeLTo8wBHxaXRAQlY2PsPlZmfo+9ZCxEREQ==",
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/node-domexception": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
@@ -1004,6 +1221,15 @@
         "url": "https://opencollective.com/node-fetch"
       }
     },
+    "node_modules/nodemailer": {
+      "version": "6.10.1",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.10.1.tgz",
+      "integrity": "sha512-Z+iLaBGVaSjbIzQ4pX6XV41HrooLsQ10ZWPUehGmuantvzWoDVBnmsdUcOIDM1t+yPor5pDhVlDESgOMEGxhHA==",
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
     "node_modules/object-assign": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
@@ -1037,6 +1263,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
     "node_modules/openai": {
       "version": "6.37.0",
       "resolved": "https://registry.npmjs.org/openai/-/openai-6.37.0.tgz",
@@ -1086,6 +1321,33 @@
       "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
       "license": "MIT"
     },
+    "node_modules/prebuild-install": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
+      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
+      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^2.0.0",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.3",
+        "mkdirp-classic": "^0.5.3",
+        "napi-build-utils": "^2.0.0",
+        "node-abi": "^3.3.0",
+        "pump": "^3.0.0",
+        "rc": "^1.2.7",
+        "simple-get": "^4.0.0",
+        "tar-fs": "^2.0.0",
+        "tunnel-agent": "^0.6.0"
+      },
+      "bin": {
+        "prebuild-install": "bin.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/protobufjs": {
       "version": "7.5.6",
       "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.6.tgz",
@@ -1123,6 +1385,16 @@
         "node": ">= 0.10"
       }
     },
+    "node_modules/pump": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
+      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
+      "license": "MIT",
+      "dependencies": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
     "node_modules/qs": {
       "version": "6.14.2",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
@@ -1162,6 +1434,35 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+      "dependencies": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "bin": {
+        "rc": "cli.js"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/retry": {
       "version": "0.13.1",
       "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
@@ -1197,6 +1498,18 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
       "license": "MIT"
     },
+    "node_modules/semver": {
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/send": {
       "version": "0.19.2",
       "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
@@ -1320,6 +1633,51 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/simple-concat": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/simple-get": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
+      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decompress-response": "^6.0.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
+    },
     "node_modules/standardwebhooks": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/standardwebhooks/-/standardwebhooks-1.0.0.tgz",
@@ -1339,6 +1697,52 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/tar-fs": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
+      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
+      }
+    },
+    "node_modules/tar-stream": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
+      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "bl": "^4.0.3",
+        "end-of-stream": "^1.4.1",
+        "fs-constants": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/toidentifier": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
@@ -1354,6 +1758,18 @@
       "integrity": "sha512-FPAhNPFMrkwz76P7cdjdmiShwMynZYN6SgOujD1urY4oNm80Ou9oMdmbR45LotcKOXoy7wSmHkRFE6Mxbrhefw==",
       "license": "MIT"
     },
+    "node_modules/tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/type-is": {
       "version": "1.6.18",
       "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
@@ -1382,6 +1798,12 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
     "node_modules/utils-merge": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
@@ -1409,6 +1831,12 @@
         "node": ">= 8"
       }
     },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
+    },
     "node_modules/ws": {
       "version": "8.20.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
diff --git a/server/package.json b/server/package.json
index b0b2ae3..eddea7c 100644
--- a/server/package.json
+++ b/server/package.json
@@ -11,8 +11,11 @@
     "@anthropic-ai/sdk": "^0.95.0",
     "@google/genai": "^1.41.0",
     "@keysat/licensing-client": "file:../vendor/keysat-licensing-client",
+    "better-sqlite3": "^11.5.0",
     "cors": "^2.8.5",
+    "cookie": "^1.0.1",
     "express": "^4.21.0",
+    "nodemailer": "^6.9.16",
     "openai": "^6.37.0"
   }
 }
diff --git a/server/providers/gemini.js b/server/providers/gemini.js
index fcd7862..6883b9f 100644
--- a/server/providers/gemini.js
+++ b/server/providers/gemini.js
@@ -24,22 +24,27 @@ import { calcCost } from "../gemini-helpers.js";
 
 // Models exposed to the analysis fallback chain. Order matters — first
 // is the preferred default, the rest are tried in order if it fails.
+// The five Gemini models we expose. Verified valid against
+// ai.google.dev/gemini-api/docs/models — older IDs (gemini-3-pro-preview
+// shut down 2026-03-09, gemini-2.0-flash deprecated, gemini-3.1-flash*
+// never existed) are intentionally not in either list.
 export const GEMINI_ANALYSIS_MODELS = [
   "gemini-3.1-pro-preview",
-  "gemini-3-pro-preview",
+  "gemini-2.5-pro",
   "gemini-3-flash-preview",
   "gemini-2.5-flash",
+  "gemini-3.1-flash-lite",
 ];
 
-// Transcription models, in fallback order. Flash is best speed/cost
-// for audio → text; 2.5 Flash is the stable previous-gen multimodal
-// model and works well as a fallback when Gemini 3 Flash returns 503
-// (capacity / overload). The orchestration layer in server/index.js
-// iterates this list, retrying with the next model when one fails.
+// Transcription fallback order: Flash first (Flash is Google's
+// natural audio fit), Pro only as last-resort because Pro on audio
+// is significantly more expensive than Flash.
 export const GEMINI_TRANSCRIPTION_MODELS = [
   "gemini-3-flash-preview",
   "gemini-2.5-flash",
-  "gemini-2.0-flash",
+  "gemini-3.1-flash-lite",
+  "gemini-2.5-pro",
+  "gemini-3.1-pro-preview",
 ];
 
 // Empty-response retries: when the SDK returns 200 with no text (which
@@ -178,9 +183,15 @@ export function createGeminiProvider({ apiKey, timeoutMs = 900_000 } = {}) {
         chapters: chaptersHint,
       });
 
-      // thinkingLevel: "minimal" is only valid for Flash. Pro models
-      // reject it. Match prior behavior precisely.
-      const txConfig = model.includes("flash")
+      // thinkingLevel is a Gemini 3.x param — Gemini 2.5 models use
+      // a different shape (`thinkingBudget`, integer) and 400 on
+      // `thinkingLevel`. Pro models reject thinking config entirely
+      // for the transcribe pipeline. Only send for Gemini 3.x flash
+      // variants where it's a valid latency/cost knob.
+      const isGemini3Flash =
+        model.includes("flash") &&
+        (model.startsWith("gemini-3-") || model.startsWith("gemini-3.") || model.startsWith("gemini-3."));
+      const txConfig = isGemini3Flash
         ? { thinkingConfig: { thinkingLevel: "minimal" } }
         : {};
 
@@ -199,6 +210,20 @@ export function createGeminiProvider({ apiKey, timeoutMs = 900_000 } = {}) {
                 config: {
                   ...txConfig,
                   safetySettings: TRANSCRIPTION_SAFETY,
+                  // Transcripts of long audio are output-token-bound.
+                  // Gemini's default is small (commonly 8192) which is
+                  // enough for ~10-15 min of dense speech but truncates
+                  // 30-45 min chunks mid-transcript with no warning.
+                  // Observed (May 2026): a 45-min chunk transcribed by
+                  // gemini-3.1-flash-lite ended at local 31:05, losing
+                  // 14 minutes of speech silently; another chunk lost
+                  // 43 of 45 minutes after the model output 5 segments
+                  // and stopped. Setting this high gives the model room
+                  // to emit the full transcript; models that don't
+                  // support values this large will clamp internally to
+                  // their max. 65,536 is the upper bound for Gemini 3.x
+                  // flash variants per Google's docs.
+                  maxOutputTokens: 65536,
                 },
                 contents: [
                   {
@@ -272,8 +297,13 @@ export function createGeminiProvider({ apiKey, timeoutMs = 900_000 } = {}) {
       // UX: fail fast on a single model and let the outer fallback
       // chain in server/index.js walk to the next model (Pro → Pro
       // older → Flash → Flash 2.5) immediately. Caller can override
-      // with retries: 2 if they want the old behavior.
-      retries = 1,
+      // Bumped 1 → 2 in 0.2.76 alongside the responseMimeType:json
+      // change. Analyze is by far the cheapest pipeline phase
+      // (~few seconds per call), so a third total attempt (1 initial
+      // + 2 retries on caught error) is essentially free in wall time
+      // but materially reduces "lost window" failures on transient
+      // 503/429 blips. Callers can override.
+      retries = 2,
       signal,
     }) {
       const result = await retryGemini(
@@ -281,6 +311,19 @@ export function createGeminiProvider({ apiKey, timeoutMs = 900_000 } = {}) {
           withAbort(
             aiAnalyze.models.generateContent({
               model,
+              config: {
+                // JSON mode — Gemini guarantees the response body is
+                // valid JSON when this is set. Eliminates the entire
+                // class of "invalid JSON in window response" failures
+                // that came from the model occasionally wrapping its
+                // sections array in a prose preamble, a ```json```
+                // markdown fence, or truncating the closing brace.
+                // The prompt already asks for JSON; this turns that
+                // into a hard server-enforced constraint on the
+                // model\'s decoder. Mirrors recap-relay 0.2.69\'s
+                // change for the relay-mode analyze path.
+                responseMimeType: "application/json",
+              },
               contents: [
                 {
                   role: "user",
@@ -356,7 +399,7 @@ Format each line as:
 Rules:
 - Transcribe EVERY word spoken, do not skip or summarize anything.
 - Use [MM:SS] or [H:MM:SS] timestamp format at the start of each line.
-- Start a new timestamped line every 15-30 seconds or at natural speech pauses.
+- Start a new timestamped line every 15-30 seconds or at natural speech pauses or speaker changes.
 - Include filler words (um, uh, you know) for accuracy.
 - Speaker identification: FIRST consult the metadata above — descriptions and chapter titles usually name the host(s) and guest(s) explicitly, and the channel name is often the host's name. Match those names to the voices in the audio (introductions, "I'm Dax", "this is Will", first-person references) and use them as speaker labels. Format as: [MM:SS] Name: text. Only fall back to "Host"/"Guest" if no names appear in the metadata AND nobody is introduced by name in the audio.
 
diff --git a/server/providers/index.js b/server/providers/index.js
index 585d86d..717f8d6 100644
--- a/server/providers/index.js
+++ b/server/providers/index.js
@@ -26,7 +26,7 @@ import { createWhisperProvider } from "./whisper.js";
 import { createRelayProvider } from "./relay.js";
 import { getInstallId } from "../install-id.js";
 import { getRawLicenseKey } from "../license.js";
-import { getRelayBaseURL } from "../relay-default.js";
+import { getRelayBaseURL, getRelayOperatorKey } from "../relay-default.js";
 
 export const PROVIDER_NAMES = [
   "gemini",
@@ -94,10 +94,14 @@ export function getProvider(name, opts = {}) {
 // `config` is the parsed startos-config.json snapshot.
 // `clientOpts` is { apiKey?, baseURL? } for THIS provider only —
 //   typically a value out of req.body.providerOpts[name].
+// `req` is the Express request — only used for the relay provider in
+//   multi-tenant mode, where the relay's install_id + license depend
+//   on WHICH user is making the call. Pass it through whenever a
+//   request is in scope. Single-mode + non-relay providers ignore it.
 //
 // Resolution priority for each field: client opt → config opt.
 // Returns { apiKey?, baseURL? } as appropriate for the provider.
-export function resolveProviderOpts(name, { config = {}, clientOpts = {} } = {}) {
+export function resolveProviderOpts(name, { config = {}, clientOpts = {}, req = null } = {}) {
   const fields = PROVIDER_KEY_FIELDS[name];
   if (!fields) {
     throw new Error(`Unknown provider: ${name}`);
@@ -141,14 +145,66 @@ export function resolveProviderOpts(name, { config = {}, clientOpts = {} } = {})
     }
   }
   // Relay-specific injections: baseURL (hardcoded constant or env
-  // override) + install-id (always) + license key (when present).
-  // None of these come from clientOpts — relay identity + endpoint
-  // must not be spoofable from a request body.
+  // override) + install-id + license key. None of these come from
+  // clientOpts — relay identity + endpoint must not be spoofable from
+  // a request body.
+  //
+  // Identity rules:
+  //   - single mode: always the operator install + operator license
+  //   - multi mode + signed-in user WITH their own keysat_license:
+  //       user's synthetic_install_id + user's license. The relay's
+  //       license-keyed credit ledger (Path 3) routes consumption to
+  //       the right user-pool.
+  //   - multi mode + free / trial / Core user OR signed-in user with
+  //     no license: operator's install + license. Their relay calls
+  //     are paid out of the operator's credit pool (tenant_credits
+  //     gates them locally to control fan-out).
   if (name === "relay") {
     opts.baseURL = getRelayBaseURL();
-    opts.installId = getInstallId();
-    const rawKey = getRawLicenseKey();
-    if (rawKey) opts.licenseKey = rawKey;
+    const ident = pickRelayIdentity(req);
+    if (ident.cloud) {
+      // Core-decoupling cloud identity: authenticate the server with the
+      // operator key + name the user; no per-user Keysat license.
+      opts.cloud = true;
+      opts.userId = ident.userId;
+      opts.operatorKey = ident.operatorKey;
+    } else {
+      opts.installId = ident.installId;
+      if (ident.licenseKey) opts.licenseKey = ident.licenseKey;
+    }
   }
   return opts;
 }
+
+// pickRelayIdentity(req) — single source of truth for "which (install_id,
+// license) do we present to the relay for THIS request". Centralized so
+// the rule doesn't drift across the four resolveProviderOpts callsites.
+function pickRelayIdentity(req) {
+  // Single mode (or no request in scope, e.g. boot-time relay capability
+  // probe): operator identity, period.
+  if (!req || req.recapMode !== "multi") {
+    return { installId: getInstallId(), licenseKey: getRawLicenseKey() || null };
+  }
+  // Multi mode + PAID cloud user (core-decoupling): cloud identity —
+  // authenticate the server with the operator key and name the user by
+  // their Recaps account id. NO Keysat license; the relay owns the
+  // tier, keyed by user-id. `req.user.tier` is the Recaps-side cache of
+  // that relay tier (kept in sync by the operator grant flow). Falls
+  // back to the operator pool when the operator key isn't configured.
+  const tier = req.user?.tier;
+  if (
+    req.user &&
+    req.user.id &&
+    !req.user.is_admin &&
+    (tier === "pro" || tier === "max")
+  ) {
+    const operatorKey = getRelayOperatorKey();
+    if (operatorKey) {
+      return { cloud: true, userId: req.user.id, operatorKey };
+    }
+  }
+  // Multi mode + everyone else (admin, anon trial, signed-in free user,
+  // family-share tenant on a self-hosted multi-tenant operator's box):
+  // pay out of the operator's pool.
+  return { installId: getInstallId(), licenseKey: getRawLicenseKey() || null };
+}
diff --git a/server/providers/relay.js b/server/providers/relay.js
index cb52afd..dec8a57 100644
--- a/server/providers/relay.js
+++ b/server/providers/relay.js
@@ -32,7 +32,12 @@
 import { createReadStream } from "fs";
 import { retryAPI, formatTime } from "../util.js";
 import { zeroCost } from "./cost.js";
-import { updateRelayState, recordRelayError } from "../relay-state.js";
+import {
+  updateRelayState,
+  recordRelayError,
+  computeCreditKey,
+} from "../relay-state.js";
+import { getRelayBaseURL, getRelayOperatorKey } from "../relay-default.js";
 
 // Provider name shown in logs + chunk pagination labels. "relay" rather
 // than e.g. "keysat-relay" because operators may run their own relay
@@ -49,6 +54,12 @@ export function createRelayProvider({
   baseURL,
   installId,
   licenseKey,
+  // Core-decoupling cloud identity: when `cloud` is set, the relay call
+  // authenticates the SERVER with `operatorKey` and names the user via
+  // `userId` (X-Recap-User-Id) instead of carrying a per-user license.
+  cloud = false,
+  userId = null,
+  operatorKey = null,
   timeoutMs = 900_000,
 } = {}) {
   if (!baseURL) {
@@ -56,23 +67,44 @@ export function createRelayProvider({
       "createRelayProvider: baseURL is required (e.g. https://relay.keysat.xyz)"
     );
   }
-  if (!installId) {
+  if (cloud) {
+    if (!userId || !operatorKey) {
+      throw new Error(
+        "createRelayProvider: cloud identity requires userId + operatorKey"
+      );
+    }
+  } else if (!installId) {
     throw new Error(
       "createRelayProvider: installId is required (boot must initInstallId first)"
     );
   }
   const base = baseURL.replace(/\/$/, "");
 
+  // Per-identity credit-key for the relay-state cache. Computed once
+  // here because (installId, licenseKey) are fixed for this provider
+  // instance — every subsequent updateRelayState/recordRelayError on
+  // this instance routes to the same cache slot. Multi-mode creates a
+  // fresh provider per request (resolveProviderOpts injects per-user
+  // identity), so each user's relay state stays isolated.
+  const creditKey = computeCreditKey({
+    installId,
+    licenseKey,
+    userId: cloud ? userId : null,
+  });
+
   // Build the auth/identity headers attached to every relay call.
   // job_id is optional but the orchestration layer should always pass
   // one — without it the relay can't bundle the transcribe + analyze
   // pair into a single credit charge.
   function buildHeaders({ extra = {}, jobId } = {}) {
-    const h = {
-      "X-Recap-Install-Id": installId,
-      ...extra,
-    };
-    if (licenseKey) h["Authorization"] = `Bearer ${licenseKey}`;
+    const h = { ...extra };
+    if (cloud) {
+      h["X-Recap-User-Id"] = userId;
+      h["X-Recap-Operator-Key"] = operatorKey;
+    } else {
+      h["X-Recap-Install-Id"] = installId;
+      if (licenseKey) h["Authorization"] = `Bearer ${licenseKey}`;
+    }
     if (jobId) h["X-Recap-Job-Id"] = jobId;
     return h;
   }
@@ -81,6 +113,39 @@ export function createRelayProvider({
   // response (success or failure) carries the standard envelope so
   // Recap can keep its balance display accurate even on errors. We
   // try to parse error bodies to harvest that.
+  // GET wrapper mirroring postRelay's envelope-aware error handling.
+  // Used by the transcribe-url poll loop to fetch job status.
+  async function getRelay({ path, headers, signal }) {
+    let res;
+    try {
+      res = await fetch(`${base}${path}`, { method: "GET", headers, signal });
+    } catch (err) {
+      recordRelayError(err?.message || String(err), creditKey);
+      throw err;
+    }
+    const text = await res.text();
+    let parsed = null;
+    try {
+      parsed = text ? JSON.parse(text) : null;
+    } catch {}
+    if (parsed && (typeof parsed.credits_remaining === "number" || parsed.tier)) {
+      updateRelayState(parsed, creditKey);
+    }
+    if (!res.ok) {
+      const msg =
+        parsed?.error ||
+        parsed?.message ||
+        text?.slice(0, 300) ||
+        `HTTP ${res.status}`;
+      const err = new Error(`Relay GET ${path} ${res.status}: ${msg}`);
+      err.status = res.status;
+      err.envelope = parsed;
+      if (!parsed) recordRelayError(msg, creditKey);
+      throw err;
+    }
+    return parsed;
+  }
+
   async function postRelay({ path, body, headers, signal }) {
     let res;
     try {
@@ -91,7 +156,7 @@ export function createRelayProvider({
         signal,
       });
     } catch (err) {
-      recordRelayError(err?.message || String(err));
+      recordRelayError(err?.message || String(err), creditKey);
       throw err;
     }
     const text = await res.text();
@@ -100,7 +165,7 @@ export function createRelayProvider({
       parsed = text ? JSON.parse(text) : null;
     } catch {}
     if (parsed && (typeof parsed.credits_remaining === "number" || parsed.tier)) {
-      updateRelayState(parsed);
+      updateRelayState(parsed, creditKey);
     }
     if (!res.ok) {
       const msg =
@@ -111,7 +176,7 @@ export function createRelayProvider({
       const err = new Error(`Relay ${path} ${res.status}: ${msg}`);
       err.status = res.status;
       err.envelope = parsed;
-      if (!parsed) recordRelayError(msg);
+      if (!parsed) recordRelayError(msg, creditKey);
       throw err;
     }
     return parsed;
@@ -136,6 +201,524 @@ export function createRelayProvider({
       return [...RELAY_TRANSCRIPTION_MODELS];
     },
 
+    // POST /relay/transcribe-url — like transcribeAudio but the
+    // relay fetches the audio from the URL itself (yt-dlp for YouTube,
+    // direct HTTP for podcast RSS audio). Saves the buyer's upload
+    // bandwidth, which is often the slowest leg of the pipeline.
+    //
+    // The relay processes this asynchronously: the POST returns
+    // immediately with a job_id, then we poll GET /relay/jobs/{id}
+    // until status flips to "complete" or "failed". Async pattern is
+    // required because no proxy / load balancer in the path can be
+    // trusted to keep a multi-minute HTTP request alive — short poll
+    // requests, by contrast, are bulletproof.
+    async transcribeUrl({
+      mediaUrl,
+      mediaType, // "youtube" | "podcast" (optional; relay sniffs URL shape)
+      mimeType,
+      titleHint,
+      channelHint = "",
+      descriptionHint = "",
+      chaptersHint = [],
+      onProgress = () => {},
+      signal,
+      jobId,
+    }) {
+      onProgress(`Asking relay to fetch + transcribe ${mediaUrl.slice(0, 80)}...`);
+      const start = Date.now();
+
+      // Step 1: kick off the job. retryAPI handles transient transport
+      // errors on this short request.
+      const initEnvelope = await retryAPI(
+        () =>
+          postRelay({
+            path: "/relay/transcribe-url",
+            body: JSON.stringify({
+              media_url: mediaUrl,
+              type: mediaType || undefined,
+              mime_type: mimeType || undefined,
+              title: titleHint || undefined,
+              channel: channelHint || undefined,
+              description: descriptionHint || undefined,
+              chapters:
+                Array.isArray(chaptersHint) && chaptersHint.length > 0
+                  ? chaptersHint
+                  : undefined,
+            }),
+            headers: buildHeaders({
+              extra: { "Content-Type": "application/json" },
+              jobId,
+            }),
+            signal,
+          }),
+        {
+          retries: 2,
+          delayMs: 5000,
+          label: "Relay transcribe-url (kickoff)",
+          log: (msg) => onProgress(msg),
+        }
+      );
+
+      const kickoffResult = initEnvelope.result || {};
+      const backgroundJobId = kickoffResult.job_id;
+      if (!backgroundJobId) {
+        throw new Error(
+          "Relay transcribe-url didn't return a job_id — old relay version? Re-install relay 0.2.14 or newer."
+        );
+      }
+      onProgress(
+        `Relay accepted job ${backgroundJobId.slice(0, 8)}… processing in background`
+      );
+
+      // Step 2: poll GET /relay/jobs/{id} until complete or failed.
+      // Generous max-wait — relay transcribes for long audio can run
+      // several minutes; we want to wait through that, not give up
+      // prematurely. The poll requests themselves are cheap, so the
+      // cost of a long wait is just time-on-the-clock, not bandwidth.
+      const POLL_INTERVAL_MS = 5_000;
+      const MAX_WAIT_MS = 30 * 60 * 1000; // 30 min
+      const deadline = Date.now() + MAX_WAIT_MS;
+      let lastProgress = null;
+      let pollFailuresInARow = 0;
+      const MAX_CONSECUTIVE_POLL_FAILURES = 6; // ~30s of poll outage
+      let envelope = null;
+
+      while (true) {
+        if (signal?.aborted) {
+          throw new Error("Relay job polling aborted");
+        }
+        if (Date.now() > deadline) {
+          throw new Error(
+            `Relay transcribe-url did not complete within ${Math.round(
+              MAX_WAIT_MS / 60_000
+            )} minutes — giving up`
+          );
+        }
+        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+        try {
+          envelope = await getRelay({
+            path: `/relay/jobs/${encodeURIComponent(backgroundJobId)}`,
+            headers: buildHeaders({ jobId }),
+            signal,
+          });
+          pollFailuresInARow = 0;
+        } catch (err) {
+          // A 404 specifically means the relay no longer knows about
+          // this job. That's not a network blip — the relay almost
+          // certainly restarted (operator update, crash, manual
+          // restart) and lost in-memory job state. Surface
+          // immediately rather than burning 6 retries; the orchestrator's
+          // fallback logic decides whether to retry from scratch.
+          const status = err?.status || 0;
+          const msg = err?.message || String(err);
+          if (status === 404 || /job_not_found/.test(msg)) {
+            throw new Error(
+              `Relay lost the job (probably restarted) — start over to retry`
+            );
+          }
+          // Other failures (network, TLS, timeout) are transient.
+          // Retry up to MAX_CONSECUTIVE_POLL_FAILURES before giving up.
+          pollFailuresInARow += 1;
+          if (pollFailuresInARow >= MAX_CONSECUTIVE_POLL_FAILURES) {
+            throw new Error(
+              `Relay polling lost — ${pollFailuresInARow} consecutive failures: ${msg}`
+            );
+          }
+          onProgress(
+            `Relay poll glitch (${pollFailuresInARow}/${MAX_CONSECUTIVE_POLL_FAILURES}): ${msg.slice(0, 100)}`
+          );
+          continue;
+        }
+        const jobRes = envelope.result || {};
+        if (jobRes.progress && jobRes.progress !== lastProgress) {
+          lastProgress = jobRes.progress;
+          onProgress(`Relay: ${jobRes.progress}`);
+        }
+        if (jobRes.status === "complete") break;
+        if (jobRes.status === "failed") {
+          throw new Error(
+            jobRes.error || "Relay transcribe-url job failed (no detail)"
+          );
+        }
+        // "queued" / "running" → keep polling
+      }
+
+      const elapsed = ((Date.now() - start) / 1000).toFixed(1);
+      const remaining =
+        typeof envelope.credits_remaining === "number"
+          ? `, ${envelope.credits_remaining} credits left`
+          : "";
+      onProgress(`Relay transcribe-url complete in ${elapsed}s${remaining}`);
+
+      // The job's result field carries the transcribe backend's
+      // output verbatim — same shape as the (sync) transcribeAudio
+      // result. Walk segments → bracketed text the same way.
+      const innerResult = envelope.result?.result || {};
+      const segments = Array.isArray(innerResult.segments)
+        ? innerResult.segments
+        : [];
+      const lines = segments.length
+        ? segments.map(
+            (s) => `[${formatTime(s.start || 0)}] ${(s.text || "").trim()}`
+          )
+        : [`[0:00] ${(innerResult.text || "").trim()}`];
+      const text = lines.join("\n");
+      const cost = zeroCost({
+        inputTokens: 0,
+        outputTokens: 0,
+        thinkingTokens: 0,
+      });
+      return {
+        text,
+        usage: { inputTokens: 0, outputTokens: 0, thinkingTokens: 0, totalTokens: 0 },
+        cost,
+        finishReason: null,
+        blockReason: "none",
+        raw: envelope,
+      };
+    },
+
+    // POST /relay/summarize-url — combined transcribe+analyze pipeline
+    // that streams per-window section results back over SSE. Used in
+    // "Recap Relay" mode where the user has chosen the operator's
+    // relay for the WHOLE pipeline (not per-step). Replaces the
+    // old transcribeUrl + per-window analyzeText fan-out with a single
+    // server-side pipeline, saving ~12 round-trips per long video and
+    // letting the operator's Settings-tab chunking knobs actually
+    // drive production behavior (instead of just benchmarks).
+    //
+    // Flow:
+    //   1. POST /relay/summarize-url → returns job_id immediately
+    //   2. GET  /relay/summarize-url/:jobId/events (SSE) → stream
+    //      transcribe_complete + window_complete + done events
+    //   3. onProgress / onWindowComplete callbacks fire as events
+    //      arrive (mirrors the recap-app's chunked-analyze.js shape
+    //      so the existing UI rendering code keeps working)
+    //   4. Returns the final { transcript, sections } envelope when
+    //      "done" arrives. Throws on "error" or stream close before
+    //      done.
+    //
+    // Falls back to one-shot poll-based completion if SSE never
+    // connects (e.g. operator's reverse proxy strips text/event-stream
+    // — observed with overly-aggressive content-type filters).
+    async summarizeUrl({
+      mediaUrl,
+      mediaType,
+      mimeType,
+      titleHint,
+      channelHint = "",
+      descriptionHint = "",
+      chaptersHint = [],
+      onProgress = () => {},
+      onWindowComplete = null,
+      // Fires when the relay's SSE stream emits transcribe_complete.
+      // The full transcript text is available BEFORE any analyze
+      // window completes (analyze runs after transcribe finishes),
+      // so subscribing here lets the caller parse the transcript
+      // into entries and have them ready in time for the FIRST
+      // window_complete callback. Used by Recap-app's relay-mode
+      // branch to stream per-window section chunks to the browser
+      // incrementally — without parsed entries the chunks can\'t be
+      // assembled, so this callback is the dependency that unblocks
+      // streaming.
+      onTranscribeComplete = null,
+      signal,
+      jobId,
+    }) {
+      onProgress(`Asking relay to summarize ${mediaUrl.slice(0, 80)}...`);
+      const start = Date.now();
+
+      // Step 1: kick off the job.
+      const initEnvelope = await retryAPI(
+        () =>
+          postRelay({
+            path: "/relay/summarize-url",
+            body: JSON.stringify({
+              media_url: mediaUrl,
+              type: mediaType || undefined,
+              mime_type: mimeType || undefined,
+              title: titleHint || undefined,
+              channel: channelHint || undefined,
+              description: descriptionHint || undefined,
+              chapters:
+                Array.isArray(chaptersHint) && chaptersHint.length > 0
+                  ? chaptersHint
+                  : undefined,
+            }),
+            headers: buildHeaders({
+              extra: { "Content-Type": "application/json" },
+              jobId,
+            }),
+            signal,
+          }),
+        {
+          retries: 2,
+          delayMs: 5000,
+          label: "Relay summarize-url (kickoff)",
+          log: (msg) => onProgress(msg),
+        }
+      );
+      const kickoffResult = initEnvelope.result || {};
+      const backgroundJobId = kickoffResult.job_id;
+      if (!backgroundJobId) {
+        throw new Error(
+          "Relay summarize-url didn't return a job_id — old relay version? Re-install relay 0.2.33 or newer."
+        );
+      }
+      onProgress(
+        `Relay accepted job ${backgroundJobId.slice(0, 8)}… streaming`
+      );
+
+      // Step 2: open SSE stream for live events.
+      // We use fetch + manual SSE parsing rather than EventSource
+      // because (a) Node's global EventSource is recent (24+), (b)
+      // we need custom auth headers which EventSource doesn't support.
+      let sseRes;
+      try {
+        sseRes = await fetch(
+          `${base}/relay/summarize-url/${encodeURIComponent(backgroundJobId)}/events`,
+          {
+            method: "GET",
+            headers: buildHeaders({
+              extra: { Accept: "text/event-stream" },
+              jobId,
+            }),
+            signal,
+          }
+        );
+      } catch (err) {
+        recordRelayError(err?.message || String(err), creditKey);
+        throw new Error(
+          `Relay summarize-url SSE connect failed: ${err?.message || err}`
+        );
+      }
+      if (!sseRes.ok || !sseRes.body) {
+        throw new Error(
+          `Relay summarize-url SSE returned ${sseRes.status} ${sseRes.statusText || ""}`.trim()
+        );
+      }
+      // Verify the server actually returned an event stream. Some
+      // reverse proxies silently rewrite the content-type which
+      // breaks SSE without raising an HTTP error.
+      const ct = sseRes.headers.get("content-type") || "";
+      if (!ct.includes("text/event-stream")) {
+        throw new Error(
+          `Relay summarize-url SSE expected text/event-stream, got "${ct}" — check your reverse proxy config`
+        );
+      }
+
+      // Step 3: parse SSE frames as they arrive, dispatch to callbacks.
+      // SSE frame syntax: blocks separated by \n\n, each block is a
+      // sequence of "field: value" lines. We collect event/data/id
+      // pairs and fire on each completed frame.
+      const reader = sseRes.body.getReader();
+      const decoder = new TextDecoder("utf-8");
+      let buffer = "";
+      let finalResult = null;
+      let finalError = null;
+      let transcriptText = null;
+      const sectionsByWindow = new Map(); // windowIdx → owned sections
+      let totalWindows = 0;
+      let windowsDone = 0;
+
+      const handleFrame = (frame) => {
+        if (!frame || !frame.trim()) return;
+        let eventType = "message";
+        let dataStr = "";
+        for (const rawLine of frame.split(/\r?\n/)) {
+          if (!rawLine || rawLine.startsWith(":")) continue;
+          const colon = rawLine.indexOf(":");
+          if (colon < 0) continue;
+          const field = rawLine.slice(0, colon).trim();
+          const value = rawLine.slice(colon + 1).replace(/^ /, "");
+          if (field === "event") eventType = value;
+          else if (field === "data") dataStr += (dataStr ? "\n" : "") + value;
+        }
+        if (!dataStr) return;
+        let data;
+        try { data = JSON.parse(dataStr); }
+        catch { return; }
+
+        if (eventType === "progress") {
+          if (data.message) onProgress(`Relay: ${data.message}`);
+        } else if (eventType === "transcribe_complete") {
+          transcriptText = data.transcript || "";
+          onProgress(
+            `Relay transcribe done — ${data.chunk_count ?? "?"} chunks, ${Math.round((data.audio_seconds || 0) / 60)} min audio`
+          );
+          if (onTranscribeComplete) {
+            try {
+              onTranscribeComplete({
+                transcript: transcriptText,
+                chunk_count: data.chunk_count ?? null,
+                audio_seconds: data.audio_seconds ?? null,
+                model: data.model || null,
+              });
+            } catch (cbErr) {
+              onProgress(`transcribe_complete callback error: ${cbErr?.message || cbErr}`);
+            }
+          }
+        } else if (eventType === "window_complete") {
+          totalWindows = data.totalWindows || totalWindows;
+          sectionsByWindow.set(data.windowIdx, data.ownedSections || []);
+          windowsDone += 1;
+          if (onWindowComplete) {
+            try {
+              onWindowComplete({
+                windowIdx: data.windowIdx,
+                totalWindows: data.totalWindows,
+                ownedSections: data.ownedSections || [],
+                // Pipelined mode (relay v0.2.89+) attaches the
+                // window's own entries here. Sequential mode (older
+                // relays OR Gemini-transcribe path) omits the field,
+                // which signals to the caller to fall back to the
+                // global streamedRelayEntries cache populated by
+                // onTranscribeComplete.
+                windowEntries: Array.isArray(data.windowEntries)
+                  ? data.windowEntries
+                  : null,
+              });
+            } catch (cbErr) {
+              // Surface to caller log but don't kill the stream.
+              onProgress(`window_complete callback error: ${cbErr?.message || cbErr}`);
+            }
+          }
+          onProgress(`Relay analyze: ${windowsDone}/${data.totalWindows} windows complete`);
+        } else if (eventType === "done") {
+          // Relay versions <= 0.2.59 emitted the SSE done event with a
+          // double-nested shape — markComplete put the whole envelope
+          // (`{result: {inner}, credit_charged, tier}`) into the event,
+          // so `data.result` was the envelope and the actual fields
+          // (title, transcript, analyze_model) lived at
+          // `data.result.result.*`. Relay 0.2.60+ unwraps before
+          // emitting, so `data.result.title` is correct directly.
+          // Detect the old shape by checking if `data.result.result`
+          // exists and looks like the inner object (has the keys we
+          // expect to find at the top of `data.result`). Unwrap once
+          // when present. Backwards-compatible — works against any
+          // relay version.
+          const raw = data.result || {};
+          if (
+            raw && typeof raw === "object" &&
+            raw.result && typeof raw.result === "object" &&
+            ("transcript" in raw.result ||
+              "analysis" in raw.result ||
+              "title" in raw.result)
+          ) {
+            finalResult = raw.result;
+          } else {
+            finalResult = raw;
+          }
+        } else if (eventType === "error") {
+          finalError = new Error(data.error || "relay summarize-url failed");
+        }
+      };
+
+      try {
+        while (true) {
+          if (signal?.aborted) {
+            try { reader.cancel(); } catch {}
+            throw new Error("Relay summarize-url aborted");
+          }
+          const { done, value } = await reader.read();
+          if (done) break;
+          buffer += decoder.decode(value, { stream: true });
+          // Frames are separated by blank lines.
+          let idx;
+          while ((idx = buffer.indexOf("\n\n")) >= 0) {
+            const frame = buffer.slice(0, idx);
+            buffer = buffer.slice(idx + 2);
+            handleFrame(frame);
+          }
+          if (finalResult || finalError) {
+            try { reader.cancel(); } catch {}
+            break;
+          }
+        }
+      } finally {
+        try { reader.releaseLock(); } catch {}
+      }
+
+      if (finalError) throw finalError;
+      if (!finalResult) {
+        throw new Error(
+          "Relay summarize-url SSE closed before 'done' event — connection dropped mid-flight"
+        );
+      }
+
+      // The "done" event carries the final stitched analysis result.
+      // Stitch our own ordered sections list from sectionsByWindow as
+      // a defensive fallback — but trust finalResult.analysis.sections
+      // when present (it's the relay's authoritative stitch).
+      const stitchedAnalysis =
+        (finalResult.analysis && Array.isArray(finalResult.analysis.sections))
+          ? finalResult.analysis
+          : {
+              sections: [...sectionsByWindow.keys()]
+                .sort((a, b) => a - b)
+                .flatMap((k) => sectionsByWindow.get(k) || []),
+            };
+
+      // Also refresh the relay state with the final envelope's
+      // credit balance so the picker's "credits remaining" pill
+      // updates without a separate /api/relay/status round-trip.
+      // (initEnvelope already had a current snapshot; final state
+      // applies after the job completed.)
+      if (typeof initEnvelope.credits_remaining === "number") {
+        updateRelayState(initEnvelope, creditKey);
+      }
+
+      const elapsed = ((Date.now() - start) / 1000).toFixed(1);
+      onProgress(`Relay summarize-url complete in ${elapsed}s`);
+
+      return {
+        // Transcript in bracketed [MM:SS] form (same shape as
+        // transcribeUrl returns), for downstream code paths that
+        // still parse text into entries.
+        transcript: transcriptText || finalResult.transcript || "",
+        // Final stitched analysis as JSON { sections: [...] } with
+        // GLOBAL startIndex / endIndex into the transcript entries.
+        analysis: stitchedAnalysis,
+        // Resolved media title — either the operator-supplied hint or
+        // the title yt-dlp extracted from YouTube during download.
+        // Older relays (< 0.2.53) don't include this field; the
+        // caller falls back to its own titleSurrogate when it's null.
+        title: finalResult.title || null,
+        // Model attribution + timing diagnostics.
+        transcribe_model: finalResult.transcribe_model || null,
+        analyze_model: finalResult.analyze_model || null,
+        audio_seconds: finalResult.audio_seconds || null,
+        audio_bytes: finalResult.audio_bytes || null,
+        wall_time_ms: finalResult.wall_time_ms || null,
+        chunk_count: finalResult.chunk_count || null,
+        analyze_windows: finalResult.analyze_windows || totalWindows,
+        analyze_windows_failed: finalResult.analyze_windows_failed || 0,
+        // Phase 1D — speaker diarization output from operator
+        // hardware. Both null on relays < 0.2.88 OR when diarization
+        // was off OR when no fingerprints could be collected. When
+        // present:
+        //   speakers           — map { Speaker_A: { turns, total_speaking_seconds,
+        //                       mean_confidence, chunks_appeared_in,
+        //                       fingerprint_count }, ... }
+        //   transcript_segments — array of { start, end, text, speaker,
+        //                       speaker_confidence } at the RAW Parakeet
+        //                       segment granularity (finer than the
+        //                       readable `transcript` text). Recap's
+        //                       UI matches these by time against the
+        //                       merged entries to color each line.
+        speakers: finalResult.speakers || null,
+        transcript_segments: Array.isArray(finalResult.transcript_segments)
+          ? finalResult.transcript_segments
+          : null,
+        // Phase 2 — speaker name map from the relay's post-cluster
+        // polish pass. Null when polish was skipped or all names
+        // returned null. Recap renders these inline with the
+        // speakers legend (showing "Matt Hill · 24:42" instead of
+        // "Speaker A · 24:42").
+        speaker_names: finalResult.speaker_names || null,
+      };
+    },
+
     async transcribeAudio({
       filePath,
       mimeType,
@@ -248,7 +831,7 @@ export function createRelayProvider({
           parsed = text ? JSON.parse(text) : null;
         } catch {}
         if (parsed && (typeof parsed.credits_remaining === "number" || parsed.tier)) {
-          updateRelayState(parsed);
+          updateRelayState(parsed, creditKey);
         }
         if (!res.ok) {
           const msg =
@@ -256,7 +839,7 @@ export function createRelayProvider({
             parsed?.message ||
             text?.slice(0, 300) ||
             `HTTP ${res.status}`;
-          recordRelayError(msg);
+          recordRelayError(msg, creditKey);
           const err = new Error(`Relay /balance ${res.status}: ${msg}`);
           err.status = res.status;
           throw err;
@@ -264,9 +847,9 @@ export function createRelayProvider({
         return parsed;
       } catch (err) {
         if (err?.name === "AbortError") {
-          recordRelayError(`balance ping timed out after ${timeoutMs}ms`);
+          recordRelayError(`balance ping timed out after ${timeoutMs}ms`, creditKey);
         } else if (!err.status) {
-          recordRelayError(err?.message || String(err));
+          recordRelayError(err?.message || String(err), creditKey);
         }
         throw err;
       } finally {
@@ -326,9 +909,233 @@ export function createRelayProvider({
         raw: envelope,
       };
     },
+
+    // Text-to-speech for the audio-first ("walking mode") player. Unlike
+    // the other methods this returns BINARY audio (mp3 by default), with
+    // credit/balance metadata in response HEADERS rather than a JSON
+    // envelope — so it can't reuse postRelay. Mirrors postRelay's
+    // error-envelope harvesting + relay-state update on the JSON error
+    // path. The caller passes ONE jobId for a whole recap so the relay
+    // charges at most 1 credit for synthesizing all its topics.
+    async tts({ text, voice, format = "mp3", jobId, signal } = {}) {
+      const headers = buildHeaders({
+        extra: { "Content-Type": "application/json" },
+        jobId,
+      });
+      let res;
+      try {
+        // Per-clip timeout so one hung synth (e.g. Spark Control busy
+        // transcribing the subscription queue) can't stall the whole
+        // sequential prepare loop — the caller catches and moves on to the
+        // next topic. 90s comfortably exceeds the relay's own ~60s Kokoro
+        // timeout, so the relay's clean error wins when it's the slow one.
+        res = await fetch(`${base}/relay/tts`, {
+          method: "POST",
+          headers,
+          body: JSON.stringify({ text, voice, format }),
+          signal: signal || AbortSignal.timeout(90_000),
+        });
+      } catch (err) {
+        recordRelayError(err?.message || String(err), creditKey);
+        throw err;
+      }
+      if (!res.ok) {
+        // Errors carry the standard JSON envelope — harvest balance + msg.
+        const errText = await res.text().catch(() => "");
+        let parsed = null;
+        try {
+          parsed = errText ? JSON.parse(errText) : null;
+        } catch {}
+        if (parsed && (typeof parsed.credits_remaining === "number" || parsed.tier)) {
+          updateRelayState(parsed, creditKey);
+        }
+        const msg =
+          parsed?.error || parsed?.message || errText?.slice(0, 300) || `HTTP ${res.status}`;
+        const err = new Error(`Relay /relay/tts ${res.status}: ${msg}`);
+        err.status = res.status;
+        err.envelope = parsed;
+        if (!parsed) recordRelayError(msg, creditKey);
+        throw err;
+      }
+      const audio = Buffer.from(await res.arrayBuffer());
+      // Success path: credit state lives in headers. "unlimited" (Max) →
+      // null, matching the JSON envelope's null credits_remaining.
+      const creditsHdr = res.headers.get("X-Recap-Credits-Remaining");
+      const tier = res.headers.get("X-Recap-Tier");
+      const creditCharged = Number(res.headers.get("X-Recap-Credit-Charged") || 0);
+      const creditsRemaining =
+        creditsHdr == null ? null : creditsHdr === "unlimited" ? null : Number(creditsHdr);
+      if (tier || typeof creditsRemaining === "number") {
+        updateRelayState(
+          { credits_remaining: creditsRemaining, tier, credit_charged: creditCharged },
+          creditKey,
+        );
+      }
+      const durHdr = res.headers.get("X-Recap-Audio-Duration");
+      return {
+        audio,
+        contentType: res.headers.get("Content-Type") || "audio/mpeg",
+        voice: res.headers.get("X-Recap-Tts-Voice") || voice || null,
+        backend: res.headers.get("X-Recap-Tts-Backend") || null,
+        creditCharged,
+        durationSeconds: durHdr ? Number(durHdr) : null,
+      };
+    },
   };
 }
 
+// ── Operator → relay: set / read a cloud user's tier (core-decoupling) ──
+// The relay is the source of truth for cloud Pro/Max tiers. The operator
+// grant flow calls these server-to-server, authenticated by the shared
+// operator key — no per-user license involved.
+export async function setRelayUserTier({ userId, tier, expiresAt = null, timeoutMs = 10000 }) {
+  const base = getRelayBaseURL();
+  const operatorKey = getRelayOperatorKey();
+  if (!base) throw new Error("relay base URL not configured");
+  if (!operatorKey) {
+    throw new Error("operator key not configured (set RECAP_RELAY_OPERATOR_KEY)");
+  }
+  const res = await fetch(`${base.replace(/\/$/, "")}/relay/user-tier`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-Recap-Operator-Key": operatorKey },
+    body: JSON.stringify({ user_id: userId, tier, expires_at: expiresAt || undefined }),
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const err = new Error(data?.error || `relay user-tier ${res.status}`);
+    err.status = res.status;
+    throw err;
+  }
+  return data;
+}
+
+export async function getRelayUserTier({ userId, timeoutMs = 8000 }) {
+  const base = getRelayBaseURL();
+  const operatorKey = getRelayOperatorKey();
+  if (!base || !operatorKey) return null;
+  try {
+    const res = await fetch(
+      `${base.replace(/\/$/, "")}/relay/user-tier/${encodeURIComponent(userId)}`,
+      { headers: { "X-Recap-Operator-Key": operatorKey }, signal: AbortSignal.timeout(timeoutMs) }
+    );
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+// Ask the relay to create a BTCPay invoice for a prepaid Pro/Max period for
+// `userId`. Operator-key authed (server-to-server). Returns
+// { invoice_id, checkout_url, sats, tier, period_days } or throws.
+export async function createRelayTierInvoice({
+  userId,
+  tier,
+  returnUrl = null,
+  timeoutMs = 12000,
+}) {
+  const base = getRelayBaseURL();
+  const operatorKey = getRelayOperatorKey();
+  if (!base) throw new Error("relay base URL not configured");
+  if (!operatorKey) {
+    throw new Error("operator key not configured (set RECAP_RELAY_OPERATOR_KEY)");
+  }
+  const res = await fetch(`${base.replace(/\/$/, "")}/relay/tier-invoice`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-Recap-Operator-Key": operatorKey },
+    body: JSON.stringify({ user_id: userId, tier, return_url: returnUrl || undefined }),
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const err = new Error(data?.error || `relay tier-invoice ${res.status}`);
+    err.status = res.status;
+    throw err;
+  }
+  return data;
+}
+
+// Ask the relay to create a Zaprite (card) hosted-checkout order for a
+// prepaid Pro/Max period for `userId`. Operator-key authed (server-to-
+// server), mirroring createRelayTierInvoice but for the card rail. Returns
+// { order_id, checkout_url, amount, currency, tier, period_days } or throws.
+export async function createRelayZapriteOrder({
+  userId,
+  tier,
+  returnUrl = null,
+  timeoutMs = 12000,
+}) {
+  const base = getRelayBaseURL();
+  const operatorKey = getRelayOperatorKey();
+  if (!base) throw new Error("relay base URL not configured");
+  if (!operatorKey) {
+    throw new Error("operator key not configured (set RECAP_RELAY_OPERATOR_KEY)");
+  }
+  const res = await fetch(`${base.replace(/\/$/, "")}/relay/tier-zaprite-order`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-Recap-Operator-Key": operatorKey },
+    body: JSON.stringify({ user_id: userId, tier, return_url: returnUrl || undefined }),
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const err = new Error(data?.error || `relay tier-zaprite-order ${res.status}`);
+    err.status = res.status;
+    throw err;
+  }
+  return data;
+}
+
+// Read the buyable subscription plans + sats prices from the relay (the
+// pricing source of truth). Operator-key authed. Returns
+// { period_days, plans: [{tier, sats}] } or null when the relay is
+// unreachable / unconfigured (caller falls back to a sane default).
+export async function getRelayTierPlans({ timeoutMs = 8000 } = {}) {
+  const base = getRelayBaseURL();
+  const operatorKey = getRelayOperatorKey();
+  if (!base || !operatorKey) return null;
+  try {
+    const res = await fetch(`${base.replace(/\/$/, "")}/relay/tier-plans`, {
+      headers: { "X-Recap-Operator-Key": operatorKey },
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+// List cloud users whose prepaid Pro/Max period expires within
+// `withinDays` (future) or lapsed within the last `lapsedDays`. Operator-
+// key authed. The relay owns subscription expiry; Recaps calls this to
+// decide who to email expiry reminders to. Returns the parsed
+// { subscriptions: [{user_id, tier, expires_at, expired, days_left}] }
+// or null when the relay is unreachable / unconfigured.
+export async function getRelayExpiringSubscriptions({
+  withinDays = 7,
+  lapsedDays = 3,
+  timeoutMs = 10000,
+} = {}) {
+  const base = getRelayBaseURL();
+  const operatorKey = getRelayOperatorKey();
+  if (!base || !operatorKey) return null;
+  try {
+    const url = new URL(`${base.replace(/\/$/, "")}/relay/expiring-subscriptions`);
+    url.searchParams.set("within_days", String(withinDays));
+    url.searchParams.set("lapsed_days", String(lapsedDays));
+    const res = await fetch(url, {
+      headers: { "X-Recap-Operator-Key": operatorKey },
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
 // Streams a file off disk into a Blob with the given MIME type for
 // FormData upload. Node's global Blob/File don't accept a stream
 // directly the way browser File objects do, so we read into a Buffer
diff --git a/server/relay-capabilities.js b/server/relay-capabilities.js
new file mode 100644
index 0000000..0592d1b
--- /dev/null
+++ b/server/relay-capabilities.js
@@ -0,0 +1,115 @@
+// Recap-side cache of the relay's GET /relay/capabilities response.
+// The relay tells us how large an audio file it can comfortably accept
+// FOR THIS SPECIFIC INSTALL given the relay's current routing config
+// AND this install's tier + Gemini-cap state. The same operator config
+// will route a fresh install through Gemini (chunk at 60min/30MB) and
+// a cap-exhausted install through hardware (no chunking) — so the
+// capabilities answer is per-install, not per-operator.
+//
+// Recap calls this in three places:
+//   - on boot (warm the cache with safe defaults)
+//   - hourly background refresh (catches operator config edits)
+//   - inline before every relay-backed transcribe (so the chunking
+//     decision matches the routing decision the relay will actually
+//     make for this install RIGHT NOW)
+//
+// When the relay is unreachable, we fall back to Gemini-safe defaults
+// so chunking happens defensively for long audio.
+
+import { getRelayBaseURL } from "./relay-default.js";
+import { getInstallId } from "./install-id.js";
+import { getRawLicenseKey } from "./license.js";
+
+const REFRESH_INTERVAL_MS = 60 * 60 * 1000; // hourly
+const FETCH_TIMEOUT_MS = 5000;
+
+// Safe defaults: chunk like we have been. Used until /relay/capabilities
+// successfully populates the cache, OR if the relay is unreachable.
+const DEFAULTS = Object.freeze({
+  max_audio_mb: 30,
+  max_audio_minutes: 60,
+  preferred_chunk_seconds: 2700,
+  // Audio-first ("walking mode") TTS availability. The relay advertises
+  // whether ANY TTS backend (Kokoro on operator hardware, or ElevenLabs)
+  // can serve a /relay/tts call. The frontend uses has_tts to decide
+  // whether to show the "Listen" affordance; the prepare route checks it
+  // before attempting synthesis. Conservative default: off until a fetch
+  // confirms it.
+  has_tts: false,
+  tts_backend: null, // "kokoro" | "elevenlabs" | null
+  tts_default_voice: null,
+  reason: "default (relay unreachable or not yet fetched)",
+  fetched_at: 0,
+});
+
+let cached = { ...DEFAULTS };
+let refreshTimer = null;
+
+export async function refreshRelayCapabilities() {
+  const base = getRelayBaseURL();
+  if (!base) return cached;
+  const url = `${base.replace(/\/$/, "")}/relay/capabilities`;
+  // Send install-id + license so the relay can run the per-install
+  // routing decision. Both are optional from the relay's perspective —
+  // missing install-id falls back to operator-wide capabilities, which
+  // is still safer than nothing.
+  const headers = {};
+  try {
+    const installId = getInstallId();
+    if (installId) headers["X-Recap-Install-Id"] = installId;
+  } catch {}
+  try {
+    const licenseKey = getRawLicenseKey();
+    if (licenseKey) headers["Authorization"] = `Bearer ${licenseKey}`;
+  } catch {}
+  try {
+    const r = await fetch(url, {
+      headers,
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!r.ok) {
+      console.warn(`[relay-capabilities] ${url} returned HTTP ${r.status}`);
+      return cached;
+    }
+    const data = await r.json();
+    cached = {
+      max_audio_mb:
+        typeof data.max_audio_mb === "number" ? data.max_audio_mb : DEFAULTS.max_audio_mb,
+      max_audio_minutes:
+        typeof data.max_audio_minutes === "number"
+          ? data.max_audio_minutes
+          : DEFAULTS.max_audio_minutes,
+      preferred_chunk_seconds:
+        data.preferred_chunk_seconds === null
+          ? null
+          : typeof data.preferred_chunk_seconds === "number"
+          ? data.preferred_chunk_seconds
+          : DEFAULTS.preferred_chunk_seconds,
+      has_tts: !!data.has_tts,
+      tts_backend: typeof data.tts_backend === "string" ? data.tts_backend : null,
+      tts_default_voice:
+        typeof data.tts_default_voice === "string" ? data.tts_default_voice : null,
+      reason: typeof data.reason === "string" ? data.reason : null,
+      fetched_at: Date.now(),
+    };
+    console.log(
+      `[relay-capabilities] refreshed: ${cached.max_audio_mb}MB / ${cached.max_audio_minutes}min / chunk=${cached.preferred_chunk_seconds}s (${cached.reason})`
+    );
+  } catch (err) {
+    console.warn(`[relay-capabilities] fetch failed: ${err?.message || err}`);
+  }
+  return cached;
+}
+
+export function startRelayCapabilitiesRefresh() {
+  // Fire-and-forget first refresh on boot; schedule hourly thereafter.
+  refreshRelayCapabilities().catch(() => {});
+  if (refreshTimer) clearInterval(refreshTimer);
+  refreshTimer = setInterval(() => {
+    refreshRelayCapabilities().catch(() => {});
+  }, REFRESH_INTERVAL_MS);
+}
+
+export function getRelayCapabilities() {
+  return cached;
+}
diff --git a/server/relay-default.js b/server/relay-default.js
index 60514c7..b11f734 100644
--- a/server/relay-default.js
+++ b/server/relay-default.js
@@ -10,9 +10,28 @@
 // Override at runtime via the RECAP_RELAY_BASE_URL env var for local
 // dev testing only — there's no StartOS action exposed for this, so
 // production installs always use the hardcoded value.
-const DEFAULT_RELAY_BASE_URL = "https://relay.keysat.xyz";
+import { relayOperatorKey } from "./config.js";
+
+const DEFAULT_RELAY_BASE_URL = "https://relay.recaps.cc";
 
 export function getRelayBaseURL() {
   const fromEnv = (process.env.RECAP_RELAY_BASE_URL || "").trim();
   return fromEnv || DEFAULT_RELAY_BASE_URL;
 }
+
+// Shared "operator key" (core-decoupling): the secret that authenticates
+// THIS cloud Recaps server to the relay so it can vouch for its signed-in
+// users by account-id (X-Recap-User-Id) instead of attaching a per-user
+// Keysat license. Set the SAME value in the relay's relay_cloud_operator_key.
+// Empty = cloud user-id identity is disabled; paid users fall back to the
+// operator pool. Server-side only — never sent to the browser.
+//
+// Resolution: the RECAP_RELAY_OPERATOR_KEY env var pins it (local dev);
+// otherwise the value comes from the StartOS config sidecar via config.js's
+// polled `relayOperatorKey` live binding (set by the "Set Relay Operator
+// Key" action, picked up within one poll — no restart needed).
+export function getRelayOperatorKey() {
+  const fromEnv = (process.env.RECAP_RELAY_OPERATOR_KEY || "").trim();
+  if (fromEnv) return fromEnv;
+  return (relayOperatorKey || "").trim();
+}
diff --git a/server/relay-state.js b/server/relay-state.js
index 108d875..52938b3 100644
--- a/server/relay-state.js
+++ b/server/relay-state.js
@@ -1,52 +1,117 @@
-// In-memory cache of the most recent relay-reported credit balance + tier.
-// Updated every time a relay provider call lands (success or 4xx error
-// that includes the standard envelope). Exposed via /api/relay/status
-// so the UI can render the "N credits remaining · Tier: X" banner
-// without re-hitting the relay just for status.
+// In-memory cache of the most recent relay-reported credit balance + tier,
+// keyed by credit-key so each distinct (installId, license) pair has its
+// own snapshot. Multi-mode introduces multiple identities in one Recap
+// process (operator's pool + each paid user's license), and a single
+// global snapshot would let one user's relay ping clobber another's
+// cached view.
 //
-// Not persisted to disk — the relay is the source of truth. We just cache
-// the last response so the UI doesn't have to wait for the next request
-// to refresh the display. On a fresh boot the cache is empty until the
-// first /api/relay/status call, which can optionally probe the relay.
+// Credit-key shape mirrors the relay's own keying (Path 3 license-keyed
+// credits): `lic:<sha256(licenseKey).slice(0, 16)>` for paid licenses,
+// `inst:<installId>` for unlicensed / Core. Stable per identity, doesn't
+// require parsing the license payload — we hash the raw LIC1 string,
+// which works as a local cache key independent of the relay's exact
+// fingerprint formula.
+//
+// Not persisted to disk — relay is the source of truth. On a fresh boot
+// the map is empty until each request triggers its first probe.
 
-let lastSnapshot = {
-  creditsRemaining: null,   // number | null
-  tier: null,               // "core" | "pro" | "max" | null
-  lastUpdated: null,        // ms-epoch | null
-  lastError: null,          // string | null
-};
+import { createHash } from "crypto";
 
-// Called by the relay provider on every response (including error
-// responses that the relay annotated with the standard envelope).
-// `envelope` is the parsed JSON shape: { credits_remaining, tier, ... }.
-export function updateRelayState(envelope) {
+// Map<creditKey, snapshot>. snapshot shape:
+//   { creditsRemaining, tier, lastUpdated, lastError }
+const snapshots = new Map();
+
+// LRU-ish defensive cap so a worst-case (e.g. a buggy probe spinning up
+// thousands of distinct identities) can't grow the map unbounded. In
+// normal use we expect on the order of (1 operator + N paid users)
+// rows, well under this ceiling.
+const MAX_SNAPSHOTS = 5000;
+
+const EMPTY_SNAPSHOT = Object.freeze({
+  creditsRemaining: null,
+  tier: null,
+  lastUpdated: null,
+  lastError: null,
+});
+
+// computeCreditKey({ installId, licenseKey, userId }) — derives the stable
+// per-identity key used by both the provider (when recording responses)
+// and the /api/relay/status handler (when looking up the right snapshot
+// for the request). Priority: cloud userId (core-decoupling `user:<id>`)
+// → license (hashed raw key) → install_id. Returns null if all three are
+// missing (caller should treat as "no cache, never hit" and skip the
+// lookup).
+export function computeCreditKey({ installId, licenseKey, userId } = {}) {
+  // Cloud (core-decoupling) identity: keyed by the Recaps account id, to
+  // mirror the relay's `user:<id>` pool.
+  const uid = (userId || "").trim();
+  if (uid) return "user:" + uid;
+  const lic = (licenseKey || "").trim();
+  if (lic) {
+    return "lic:" + createHash("sha256").update(lic).digest("hex").slice(0, 16);
+  }
+  const id = (installId || "").trim();
+  if (id) return "inst:" + id;
+  return null;
+}
+
+function getOrCreate(creditKey) {
+  let s = snapshots.get(creditKey);
+  if (!s) {
+    if (snapshots.size >= MAX_SNAPSHOTS) {
+      // Evict the oldest entry (Map iteration is insertion-ordered).
+      const oldest = snapshots.keys().next().value;
+      if (oldest != null) snapshots.delete(oldest);
+    }
+    s = { creditsRemaining: null, tier: null, lastUpdated: null, lastError: null };
+    snapshots.set(creditKey, s);
+  }
+  return s;
+}
+
+// Called by the relay provider on every response (including 4xx with the
+// standard envelope). `envelope` is the parsed JSON shape:
+//   { credits_remaining, tier, ... }
+// `creditKey` is the per-identity key from computeCreditKey(); required
+// in multi-mode, optional in single-mode (falls through to a synthetic
+// "operator" bucket — see fallback below).
+export function updateRelayState(envelope, creditKey) {
   if (!envelope || typeof envelope !== "object") return;
+  const key = creditKey || "operator";
+  const s = getOrCreate(key);
   if (typeof envelope.credits_remaining === "number") {
-    lastSnapshot.creditsRemaining = envelope.credits_remaining;
+    s.creditsRemaining = envelope.credits_remaining;
   }
   if (typeof envelope.tier === "string") {
-    lastSnapshot.tier = envelope.tier;
+    s.tier = envelope.tier;
   }
-  lastSnapshot.lastUpdated = Date.now();
-  lastSnapshot.lastError = null;
+  s.lastUpdated = Date.now();
+  s.lastError = null;
 }
 
-// Record a relay error (network failure, 5xx with no envelope, etc.).
-// Surfaced in the UI status so the user knows the balance display is stale.
-export function recordRelayError(message) {
-  lastSnapshot.lastError = (message || "Unknown relay error").slice(0, 300);
-  lastSnapshot.lastUpdated = Date.now();
+// Record a relay error (network failure, 5xx without envelope, etc.).
+// Same keying as updateRelayState — the error sticks to the identity
+// that hit it, so an admin's tile doesn't flash "relay unreachable"
+// because a tenant's probe failed.
+export function recordRelayError(message, creditKey) {
+  const key = creditKey || "operator";
+  const s = getOrCreate(key);
+  s.lastError = (message || "Unknown relay error").slice(0, 300);
+  s.lastUpdated = Date.now();
 }
 
-export function getRelayState() {
-  return { ...lastSnapshot };
+// getRelayState(creditKey) — fetch the snapshot for an identity. Returns
+// the EMPTY_SNAPSHOT (with nulls) if the identity has never recorded
+// anything yet. Caller can branch on creditsRemaining === null vs
+// numeric to decide whether to probe.
+export function getRelayState(creditKey) {
+  const key = creditKey || "operator";
+  const s = snapshots.get(key);
+  return s ? { ...s } : { ...EMPTY_SNAPSHOT };
 }
 
+// Test/teardown helper. Clears every cached snapshot. Used by tests + a
+// debugging admin endpoint if we ever need one. Not used in production.
 export function resetRelayState() {
-  lastSnapshot = {
-    creditsRemaining: null,
-    tier: null,
-    lastUpdated: null,
-    lastError: null,
-  };
+  snapshots.clear();
 }
diff --git a/server/smtp.js b/server/smtp.js
new file mode 100644
index 0000000..8e103e1
--- /dev/null
+++ b/server/smtp.js
@@ -0,0 +1,116 @@
+// SMTP transport for outbound mail (currently: magic-link sign-in
+// links). Credentials come from /data/config/startos-config.json,
+// which startos/main.ts keeps in sync with the StartOS System SMTP
+// config via effects.getSystemSmtp({callback}).
+//
+// We poll the same JSON the rest of the server reads (via
+// getConfigSnapshot()) and rebuild the nodemailer transport whenever
+// the credentials change. Rebuilds are cheap — nodemailer's
+// createTransport is synchronous and just stashes options. The actual
+// SMTP connection is opened per-send (or pooled), not at transport
+// creation.
+//
+// Only used in multi-tenant mode. Single mode never imports this.
+
+import nodemailer from "nodemailer";
+import { getConfigSnapshot } from "./config.js";
+
+let cachedTransport = null;
+let cachedFingerprint = ""; // last seen credentials as a stable string
+let cachedFrom = "";
+
+const POLL_MS = 3000;
+
+// initSmtp(): kicks off the credentials-watch loop. Idempotent in
+// effect (later calls are harmless), but you only need it once per
+// process lifetime.
+export function initSmtp() {
+  refreshTransport().catch((err) => {
+    console.warn("[smtp] initial refresh failed:", err);
+  });
+  setInterval(() => {
+    refreshTransport().catch(() => {});
+  }, POLL_MS);
+}
+
+async function refreshTransport() {
+  const snap = await getConfigSnapshot();
+  const host = snap.smtp_host || "";
+  const port = parseInt(snap.smtp_port || 0, 10) || 0;
+  const security = snap.smtp_security || "tls";
+  const username = snap.smtp_username || "";
+  const password = snap.smtp_password || "";
+  const from = snap.smtp_from || "";
+
+  // Fingerprint covers every field that affects the transport. If
+  // nothing changed, leave the existing transport in place — avoids
+  // tearing down a pooled connection on every poll tick.
+  const fingerprint = [host, port, security, username, password, from].join(
+    "\x1f",
+  );
+  if (fingerprint === cachedFingerprint) return;
+
+  cachedFingerprint = fingerprint;
+  cachedFrom = from;
+
+  if (!host || !port) {
+    if (cachedTransport) {
+      cachedTransport.close?.();
+      cachedTransport = null;
+      console.log("[smtp] credentials cleared, transport closed");
+    }
+    return;
+  }
+
+  // security mapping:
+  //   - "tls"     → implicit TLS (SMTPS, typically port 465). secure=true.
+  //   - "starttls" → cleartext then STARTTLS (typically port 587). secure=false,
+  //                  requireTLS=true so we refuse to silently fall back to plain.
+  const isImplicitTls = security === "tls";
+  const transportOpts = {
+    host,
+    port,
+    secure: isImplicitTls,
+    requireTLS: !isImplicitTls, // forces STARTTLS when secure=false
+    auth: username ? { user: username, pass: password } : undefined,
+  };
+
+  try {
+    const next = nodemailer.createTransport(transportOpts);
+    if (cachedTransport) cachedTransport.close?.();
+    cachedTransport = next;
+    console.log(
+      `[smtp] transport built host=${host} port=${port} security=${security} user=${username || "(none)"}`,
+    );
+  } catch (err) {
+    console.warn("[smtp] createTransport failed:", err);
+    cachedTransport = null;
+  }
+}
+
+// sendMail({to, subject, text, html})
+// Returns nodemailer's info object on success. Throws if the
+// transport isn't configured — callers should treat that as "SMTP
+// not set up yet, ask the operator to configure StartOS System SMTP."
+export async function sendMail({ to, subject, text, html }) {
+  if (!cachedTransport) {
+    throw new Error("smtp_not_configured");
+  }
+  if (!cachedFrom) {
+    throw new Error("smtp_from_not_set");
+  }
+  return await cachedTransport.sendMail({
+    from: cachedFrom,
+    to,
+    subject,
+    text,
+    html,
+  });
+}
+
+// True iff the transport is built and ready to send. The auth handlers
+// use this to gate magic-link requests with a useful error rather than
+// letting nodemailer's "no transport" leak through.
+export function isSmtpReady() {
+  return cachedTransport !== null && cachedFrom !== "";
+}
diff --git a/server/subscription-reminders.js b/server/subscription-reminders.js
new file mode 100644
index 0000000..feb847d
--- /dev/null
+++ b/server/subscription-reminders.js
@@ -0,0 +1,173 @@
+// Self-serve subscription expiry reminders (multi-mode / cloud only).
+//
+// The relay owns each user's prepaid-period expiry (subscription source of
+// truth); Recaps owns the email address + the recaps.cc SMTP transport. So
+// a daily scan here asks the relay who's expiring (or just lapsed), maps
+// user_id → users.email, and sends a reminder via the same sendMail() the
+// magic-link flow uses. The subscription_reminders table dedups so each
+// (user, period, kind) email goes out at most once; a renewal changes the
+// expiry instant, which re-arms a fresh set of reminders for the new period.
+//
+// Self-gating: no-ops unless SMTP is configured, the public URL is set, and
+// the relay is reachable. Safe to start unconditionally in multi mode.
+
+import { getDb } from "./db.js";
+import { sendMail, isSmtpReady } from "./smtp.js";
+import { renderSubscriptionReminderEmail } from "./email-template.js";
+import { getRelayExpiringSubscriptions } from "./providers/relay.js";
+import { getConfigSnapshot } from "./config.js";
+
+// Reminder thresholds, in days before expiry. Each maps to a distinct
+// `kind` so a user gets one heads-up at each crossing (deduped by kind).
+const UPCOMING_THRESHOLDS = [
+  { days: 7, kind: "upcoming_7d" },
+  { days: 1, kind: "upcoming_1d" },
+];
+const LAPSED_KIND = "lapsed";
+// Only email recently-lapsed users; after this they age out of the relay
+// window (and we never re-send the same period's lapsed notice anyway).
+const LAPSED_WINDOW_DAYS = 3;
+
+const SCAN_INTERVAL_MS = 12 * 60 * 60 * 1000; // twice a day
+const BOOT_DELAY_MS = 90 * 1000; // first scan ~90s after boot
+
+let scanning = false;
+let scheduled = false;
+
+// Decide which single reminder kind (if any) applies to a subscription
+// right now. Pure — exported for testing. `sub` is a relay row:
+// { tier, expires_at, expired, days_left }.
+export function reminderKindFor(
+  sub,
+  { upcoming = UPCOMING_THRESHOLDS, lapsedWindowDays = LAPSED_WINDOW_DAYS } = {},
+) {
+  if (!sub || typeof sub.days_left !== "number") return null;
+  const daysLeft = sub.days_left;
+  if (sub.expired) {
+    // Recently lapsed → a single lapsed notice (days_left is <= 0).
+    return daysLeft >= -lapsedWindowDays ? LAPSED_KIND : null;
+  }
+  // Upcoming: smallest threshold the sub has crossed wins, so daysLeft=1
+  // sends 'upcoming_1d' while daysLeft in (1, 7] sends 'upcoming_7d'.
+  const sorted = [...upcoming].sort((a, b) => a.days - b.days);
+  for (const t of sorted) {
+    if (daysLeft <= t.days) return t.kind;
+  }
+  return null;
+}
+
+function alreadySent(db, userId, periodIso, kind) {
+  return !!db
+    .prepare(
+      "SELECT 1 FROM subscription_reminders WHERE user_id=? AND period_expires_at=? AND kind=?",
+    )
+    .get(userId, periodIso, kind);
+}
+
+function recordSent(db, userId, periodIso, kind) {
+  db.prepare(
+    "INSERT OR IGNORE INTO subscription_reminders (user_id, period_expires_at, kind, sent_at) VALUES (?,?,?,?)",
+  ).run(userId, periodIso, kind, Date.now());
+}
+
+function maskEmail(email) {
+  return String(email).replace(/^(.).*(@.*)$/, "$1***$2");
+}
+
+// One scan pass. Returns a small summary object; never throws (logs +
+// returns a {skipped} reason instead) so the scheduler stays alive.
+export async function runReminderScan({ force = false } = {}) {
+  if (scanning && !force) return { skipped: "already_running" };
+  scanning = true;
+  try {
+    if (!isSmtpReady()) return { skipped: "smtp_not_ready" };
+    const snap = await getConfigSnapshot();
+    const publicUrl = (snap.recap_public_url || "").trim().replace(/\/$/, "");
+    if (!publicUrl) return { skipped: "public_url_not_set" };
+
+    const maxDays = Math.max(1, ...UPCOMING_THRESHOLDS.map((t) => t.days));
+    const report = await getRelayExpiringSubscriptions({
+      withinDays: maxDays,
+      lapsedDays: LAPSED_WINDOW_DAYS,
+    });
+    if (!report || !Array.isArray(report.subscriptions)) {
+      return { skipped: "relay_unavailable" };
+    }
+
+    const db = getDb();
+    const manageUrl = `${publicUrl}/?renew=1`;
+    let sent = 0;
+    let skipped = 0;
+    for (const sub of report.subscriptions) {
+      const kind = reminderKindFor(sub);
+      if (!kind) {
+        skipped++;
+        continue;
+      }
+      const periodIso = sub.expires_at;
+      if (!periodIso || alreadySent(db, sub.user_id, periodIso, kind)) {
+        skipped++;
+        continue;
+      }
+      const u = db
+        .prepare("SELECT email FROM users WHERE id=?")
+        .get(sub.user_id);
+      const email = (u?.email || "").trim();
+      if (!email) {
+        // No local user for this id (e.g. another instance's tenant) — skip.
+        skipped++;
+        continue;
+      }
+      const message = renderSubscriptionReminderEmail({
+        brandName: "Recaps",
+        tier: sub.tier,
+        expiresAt: sub.expires_at,
+        daysLeft: sub.days_left,
+        kind,
+        manageUrl,
+      });
+      try {
+        await sendMail({
+          to: email,
+          subject: message.subject,
+          text: message.text,
+          html: message.html,
+        });
+        recordSent(db, sub.user_id, periodIso, kind);
+        sent++;
+        console.log(
+          `[reminders] sent ${kind} to ${maskEmail(email)} (${sub.tier}, ${sub.days_left}d)`,
+        );
+      } catch (err) {
+        // Don't record on failure → retried next scan.
+        console.warn(
+          `[reminders] sendMail failed for ${sub.user_id}: ${err?.message || err}`,
+        );
+        skipped++;
+      }
+    }
+    if (sent) {
+      console.log(`[reminders] scan complete: ${sent} sent, ${skipped} skipped`);
+    }
+    return { sent, skipped };
+  } catch (err) {
+    console.warn(`[reminders] scan error: ${err?.message || err}`);
+    return { skipped: "error", error: err?.message || String(err) };
+  } finally {
+    scanning = false;
+  }
+}
+
+// Start the daily-ish scan loop. Idempotent. Self-gates inside the scan,
+// so it's safe to call whenever multi mode boots.
+export function startReminderScheduler() {
+  if (scheduled) return;
+  scheduled = true;
+  setTimeout(() => {
+    runReminderScan().catch(() => {});
+  }, BOOT_DELAY_MS);
+  setInterval(() => {
+    runReminderScan().catch(() => {});
+  }, SCAN_INTERVAL_MS);
+  console.log("[reminders] expiry-reminder scheduler started");
+}
diff --git a/server/subscriptions.js b/server/subscriptions.js
new file mode 100644
index 0000000..9d249de
--- /dev/null
+++ b/server/subscriptions.js
@@ -0,0 +1,285 @@
+// Subscription storage + discovery helpers, keyed by scope.
+//
+// Today the subscription feature is operator-only in multi mode (gated in
+// license-middleware), so the only active scope is "owner". But the storage,
+// dedup, check-enumeration, and migration here are all scope-parameterized,
+// so flipping the gate to per-tenant (see docs/per-tenant-subscriptions-plan.md)
+// is a matter of passing each user's scope instead of "owner" — no storage
+// rework. Step 4 of that plan (the background processor acting as each
+// owning user) is the only remaining piece and needs on-device testing.
+//
+// Each scope's state lives under scopeDir(scope) = history/<scope>/:
+//   subscriptions.json  — the user's channel/podcast subscriptions
+//   auto-queue.json     — discovered videos awaiting approval / processing
+//   skip-list.json      — videoIds the user declined (never re-offer)
+//   seen-list.json      — videoIds already offered (don't re-surface)
+
+import fs from "fs/promises";
+import path from "path";
+import { getScopeHistoryDir, getHistoryDir, ROOT_SIDECARS } from "./history.js";
+
+// ── Per-scope file paths ─────────────────────────────────────────────────
+function subsPath(scope) {
+  return path.join(getScopeHistoryDir(scope), "subscriptions.json");
+}
+function skipPath(scope) {
+  return path.join(getScopeHistoryDir(scope), "skip-list.json");
+}
+function seenPath(scope) {
+  return path.join(getScopeHistoryDir(scope), "seen-list.json");
+}
+function autoQueuePath(scope) {
+  return path.join(getScopeHistoryDir(scope), "auto-queue.json");
+}
+
+async function ensureScopeDir(scope) {
+  await fs.mkdir(getScopeHistoryDir(scope), { recursive: true }).catch(() => {});
+}
+
+// Serialize read-modify-write on a given file path so two concurrent
+// handlers can't each load the same snapshot, mutate, and have the second
+// write clobber the first. Keyed by absolute path → naturally per-scope.
+const _fileLocks = new Map();
+function withFileLock(key, fn) {
+  const prev = _fileLocks.get(key) || Promise.resolve();
+  const next = prev.then(fn, fn); // run fn whether prev resolved or rejected
+  _fileLocks.set(
+    key,
+    next.catch(() => {}),
+  );
+  return next;
+}
+
+// ── Subscriptions ────────────────────────────────────────────────────────
+export async function loadSubscriptions(scope) {
+  try {
+    return (
+      JSON.parse(await fs.readFile(subsPath(scope), "utf-8")).subscriptions || []
+    );
+  } catch {
+    return [];
+  }
+}
+export async function saveSubscriptions(scope, subs) {
+  return withFileLock(subsPath(scope), async () => {
+    await ensureScopeDir(scope);
+    await fs.writeFile(
+      subsPath(scope),
+      JSON.stringify({ subscriptions: subs }, null, 2),
+    );
+  });
+}
+
+// ── Skip list (declined videos — never re-add) ───────────────────────────
+export async function loadSkipList(scope) {
+  try {
+    return new Set(
+      JSON.parse(await fs.readFile(skipPath(scope), "utf-8")).videoIds || [],
+    );
+  } catch {
+    return new Set();
+  }
+}
+export async function addToSkipList(scope, videoId) {
+  return withFileLock(skipPath(scope), async () => {
+    const ids = await loadSkipList(scope);
+    ids.add(videoId);
+    await ensureScopeDir(scope);
+    await fs.writeFile(skipPath(scope), JSON.stringify({ videoIds: [...ids] }));
+  });
+}
+
+// ── Seen list (already offered — don't re-surface) ───────────────────────
+export async function loadSeenList(scope) {
+  try {
+    return new Set(
+      JSON.parse(await fs.readFile(seenPath(scope), "utf-8")).videoIds || [],
+    );
+  } catch {
+    return new Set();
+  }
+}
+export async function addToSeenList(scope, videoIds) {
+  return withFileLock(seenPath(scope), async () => {
+    const seen = await loadSeenList(scope);
+    for (const id of videoIds) seen.add(id);
+    await ensureScopeDir(scope);
+    await fs.writeFile(seenPath(scope), JSON.stringify({ videoIds: [...seen] }));
+  });
+}
+
+// ── Auto-queue ───────────────────────────────────────────────────────────
+// Read-only load. For mutations use mutateAutoQueue so the read-modify-write
+// is atomic per scope (the old in-memory global array gave this implicitly).
+export async function loadAutoQueue(scope) {
+  try {
+    return JSON.parse(await fs.readFile(autoQueuePath(scope), "utf-8")).items || [];
+  } catch {
+    return [];
+  }
+}
+export async function saveAutoQueue(scope, items) {
+  return withFileLock(autoQueuePath(scope), async () => {
+    await ensureScopeDir(scope);
+    await fs.writeFile(
+      autoQueuePath(scope),
+      JSON.stringify({ items }, null, 2),
+    );
+  });
+}
+// Atomic read-modify-write. `fn(items)` may mutate `items` in place and/or
+// return a replacement array. Returns the saved array. Use for every
+// status change / add / remove so concurrent handlers don't lose updates.
+export async function mutateAutoQueue(scope, fn) {
+  return withFileLock(autoQueuePath(scope), async () => {
+    let items = [];
+    try {
+      items =
+        JSON.parse(await fs.readFile(autoQueuePath(scope), "utf-8")).items || [];
+    } catch {}
+    const result = await fn(items);
+    const toSave = Array.isArray(result) ? result : items;
+    await ensureScopeDir(scope);
+    await fs.writeFile(
+      autoQueuePath(scope),
+      JSON.stringify({ items: toSave }, null, 2),
+    );
+    return toSave;
+  });
+}
+
+// ── Dedup ────────────────────────────────────────────────────────────────
+// All videoIds already summarized in a scope's library.
+//
+// CRITICAL: summaries live under scopeDir(scope) = history/<scope>/, NOT the
+// top-level history dir. Scanning the top level (the historical bug) found
+// zero processed videos, so the subscription check never deduped against the
+// library and re-queued already-summarized videos every run.
+export async function getProcessedVideoIds(scope = "owner") {
+  const ids = new Set();
+  const dir = getScopeHistoryDir(scope);
+  try {
+    const files = await fs.readdir(dir);
+    for (const file of files.filter(
+      (f) => f.endsWith(".json") && !ROOT_SIDECARS.has(f),
+    )) {
+      try {
+        const raw = await fs.readFile(path.join(dir, file), "utf-8");
+        const data = JSON.parse(raw);
+        if (data.videoId) ids.add(data.videoId);
+      } catch {}
+    }
+  } catch {}
+  return ids;
+}
+
+// Pure dedup predicate: is this discovered video already accounted for?
+// Known = in the library (processed), already queued, declined (skip), or
+// offered before (seen). Used identically by the podcast + YouTube branches.
+export function isKnownVideo(
+  id,
+  { processedIds, queuedIds, skippedIds, seenIds } = {},
+) {
+  return !!(
+    (processedIds && processedIds.has(id)) ||
+    (queuedIds && queuedIds.has(id)) ||
+    (skippedIds && skippedIds.has(id)) ||
+    (seenIds && seenIds.has(id))
+  );
+}
+
+// ── Scope enumeration (for the periodic check loop) ──────────────────────
+// Scopes that have at least one subscription. Always includes "owner" (the
+// operator). Behind the operator-only gate this returns just ["owner"]; when
+// per-tenant subscriptions ship it picks up each tenant scope automatically.
+export async function listSubscriptionScopes() {
+  const root = getHistoryDir();
+  const scopes = new Set(["owner"]);
+  try {
+    const entries = await fs.readdir(root, { withFileTypes: true });
+    for (const e of entries) {
+      if (!e.isDirectory() || e.name === "owner") continue;
+      try {
+        const subs =
+          JSON.parse(
+            await fs.readFile(
+              path.join(root, e.name, "subscriptions.json"),
+              "utf-8",
+            ),
+          ).subscriptions || [];
+        if (subs.length > 0) scopes.add(e.name);
+      } catch {}
+    }
+  } catch {}
+  return [...scopes];
+}
+
+// Scopes that have a non-empty auto-queue. The background processor walks
+// these to find approved items across all owners (a scope can have queued
+// items even after its subscriptions were deleted, so this is a superset of
+// listSubscriptionScopes for processing purposes).
+export async function listAutoQueueScopes() {
+  const root = getHistoryDir();
+  const scopes = new Set(["owner"]);
+  try {
+    const entries = await fs.readdir(root, { withFileTypes: true });
+    for (const e of entries) {
+      if (!e.isDirectory() || e.name === "owner") continue;
+      try {
+        const items =
+          JSON.parse(
+            await fs.readFile(
+              path.join(root, e.name, "auto-queue.json"),
+              "utf-8",
+            ),
+          ).items || [];
+        if (items.length > 0) scopes.add(e.name);
+      } catch {}
+    }
+  } catch {}
+  return [...scopes];
+}
+
+// ── Migration: history-root globals → owner scope (one-time, idempotent) ──
+// The pre-0.2.147 layout kept subscription state at the history root (one
+// install-wide store). Move it under the operator's own scope so the
+// storage is uniformly per-scope. Only moves a file if the source exists
+// and the destination doesn't (never clobbers).
+const SUB_FILES = [
+  "subscriptions.json",
+  "auto-queue.json",
+  "skip-list.json",
+  "seen-list.json",
+];
+export async function migrateGlobalSubscriptionsToOwner() {
+  const root = getHistoryDir();
+  const ownerDir = getScopeHistoryDir("owner");
+  let moved = 0;
+  for (const f of SUB_FILES) {
+    const from = path.join(root, f);
+    const to = path.join(ownerDir, f);
+    try {
+      await fs.access(from);
+    } catch {
+      continue; // source missing → nothing to move
+    }
+    try {
+      await fs.access(to);
+      continue; // dest already exists → don't clobber
+    } catch {}
+    try {
+      await fs.mkdir(ownerDir, { recursive: true });
+      await fs.rename(from, to);
+      moved++;
+    } catch {
+      // rename can fail across devices — fall back to copy + unlink.
+      try {
+        await fs.mkdir(ownerDir, { recursive: true });
+        await fs.copyFile(from, to);
+        await fs.unlink(from);
+        moved++;
+      } catch {}
+    }
+  }
+  return moved;
+}
diff --git a/server/tenant-auth.js b/server/tenant-auth.js
new file mode 100644
index 0000000..c6da17c
--- /dev/null
+++ b/server/tenant-auth.js
@@ -0,0 +1,292 @@
+// Tenant (multi-user) auth middleware.
+//
+// Two modes:
+//   - single (the original self-hosted experience): no-op. Sets
+//     req.userId = "owner" so downstream code can scope everything
+//     uniformly to a single synthetic user.
+//   - multi (cloud / family-share): validates the recap_session cookie
+//     against the sessions table, looks up the user, attaches both to
+//     req. Non-public paths without a valid session get a 401.
+//
+// This is layered AFTER the admin-auth middleware (which gates /api/*
+// behind the operator's password in single mode). The two are
+// orthogonal:
+//   - admin-auth: "is the OPERATOR allowed in?" (single mode only)
+//   - tenant-auth: "which user is this request from?" (multi mode only)
+// In multi mode the admin-auth gate is disabled — tenant accounts
+// authenticate themselves directly.
+
+import { getDb } from "./db.js";
+import {
+  TRIAL_COOKIE,
+  lookupTrial,
+  hasTrialBudget,
+} from "./anon-trial.js";
+
+const SESSION_COOKIE = "recap_session";
+
+// Endpoints that must remain reachable WITHOUT a session — the auth
+// flow itself, health check, static assets, the BTCPay webhook. The
+// frontend's static files are served outside the /api/* tree so they
+// bypass this middleware entirely; this list only matters for /api/*
+// and /auth/* paths.
+const PUBLIC_PATH_PREFIXES = [
+  "/auth/", // /auth/request-link, /auth/verify, /auth/signout
+  "/api/health",
+  "/api/auth/", // future client-facing auth shims (CSRF token issue, etc.)
+  "/api/btcpay/webhook", // BTCPay needs to reach this without a session
+  "/api/network-mode", // returns lan-vs-local; safe to expose
+  "/api/relay/status", // public relay capabilities — pre-trial visibility
+  "/api/account/whoami", // returns state — anonymous visitors must call this
+  // License-status family — anonymous visitors must call these on page
+  // load to render the right header/badge. Multi-mode handlers branch
+  // on req.user/req.trial to return per-user views.
+  "/api/license-status",
+  "/api/install-id",
+  // Credit-purchase family — accepts both signed-in users AND anon
+  // trial cookies (the buy handler routes credits to the right local
+  // balance based on which identity made the call). Each handler
+  // validates buyer presence inline, so leaving these "public" is
+  // safe — it just defers the auth check from the middleware to the
+  // handler where buyer-type-specific logic lives anyway.
+  "/api/credits/",
+  // License purchase + poll — the 3-tier signup modal lets anon
+  // visitors buy a Pro/Max license at the same moment they create
+  // their account. /policies is a passthrough to Keysat's public
+  // /v1/products/.../policies (no auth needed there). /purchase
+  // accepts an anon buyer_email and records a pending_signups row
+  // so the poll-settle handler can create the user + attach the
+  // license + send a magic-link email. /poll just reads invoice
+  // status from Keysat — same trust model as the credit flow.
+  //
+  // Note: /api/license/activate and /api/license/deactivate are
+  // NOT in this prefix (they're operator-only single-mode endpoints
+  // that write /data/license.txt; tenants shouldn't reach them).
+  "/api/license/policies",
+  "/api/license/purchase",
+  "/api/license/poll/",
+];
+
+// Paths where an unauthenticated visitor is allowed to obtain (or use)
+// an anonymous-trial cookie. Restricting trials to the actual
+// "use the product" endpoint keeps bots that scrape the homepage from
+// minting trial rows just by visiting /.
+const TRIAL_ELIGIBLE_PATHS = new Set(["/api/process"]);
+
+function isTrialEligiblePath(reqPath, method) {
+  if (method !== "POST") return false;
+  return TRIAL_ELIGIBLE_PATHS.has(reqPath);
+}
+
+function isPublicPath(reqPath) {
+  for (const p of PUBLIC_PATH_PREFIXES) {
+    if (reqPath === p || reqPath.startsWith(p)) return true;
+  }
+  return false;
+}
+
+// We only gate /api/* paths. Static assets (/, /auth.html, /assets/*)
+// and the auth-flow routes (/auth/*) are ALWAYS reachable so anonymous
+// visitors can see the landing page and the sign-in form. The handlers
+// behind /api/* are where actual access decisions need to happen.
+function isGatedPath(reqPath) {
+  return reqPath.startsWith("/api/");
+}
+
+// Lightweight cookie parser — same dep (`cookie` v1) the rest of the
+// project uses. Keeps us from pulling in cookie-parser middleware just
+// for one header.
+import * as cookie from "cookie";
+
+function parseCookies(req) {
+  const header = req.headers?.cookie;
+  if (!header) return {};
+  try {
+    return cookie.parse(header);
+  } catch {
+    return {};
+  }
+}
+
+// Factory — returns the middleware closure. `mode` is the RECAP_MODE
+// env value ("single" | "multi"). Captured at boot so we don't branch
+// on a hot path on every request.
+export function buildTenantAuthMiddleware({ mode }) {
+  if (mode !== "multi") {
+    // Single-mode shim: stamp every request with the synthetic owner
+    // userId so user-scoped handlers (history reads, library inserts,
+    // etc.) keep working without per-call branching.
+    return function singleModeAuth(req, _res, next) {
+      req.userId = "owner";
+      req.user = null;
+      req.recapMode = "single";
+      next();
+    };
+  }
+
+  // Multi-mode: validate session on every request. Cache one prepared
+  // statement per query in module scope (better-sqlite3 idiom — `.prepare`
+  // returns a reusable handle).
+  let sessionLookupStmt = null;
+  let userLookupStmt = null;
+  let sessionTouchStmt = null;
+
+  function stmts() {
+    const db = getDb();
+    if (!sessionLookupStmt) {
+      sessionLookupStmt = db.prepare(
+        "SELECT * FROM sessions WHERE id = ? AND expires_at > ?",
+      );
+      userLookupStmt = db.prepare("SELECT * FROM users WHERE id = ?");
+      sessionTouchStmt = db.prepare(
+        "UPDATE sessions SET last_used_at = ? WHERE id = ?",
+      );
+    }
+    return { sessionLookupStmt, userLookupStmt, sessionTouchStmt };
+  }
+
+  // Touch debounce — every authenticated request would otherwise issue
+  // an UPDATE for last_used_at. We coalesce per-session: at most one
+  // touch per LAST_USED_DEBOUNCE_MS window.
+  const LAST_USED_DEBOUNCE_MS = 60_000;
+  const lastTouchedAt = new Map();
+
+  function maybeTouch(sessionId) {
+    const now = Date.now();
+    const prev = lastTouchedAt.get(sessionId) || 0;
+    if (now - prev < LAST_USED_DEBOUNCE_MS) return;
+    lastTouchedAt.set(sessionId, now);
+    try {
+      stmts().sessionTouchStmt.run(now, sessionId);
+    } catch {
+      // Touch is best-effort; a write contention here shouldn't fail
+      // the request.
+    }
+  }
+
+  return function multiModeAuth(req, res, next) {
+    req.recapMode = "multi";
+
+    // Static assets and the auth-flow pages aren't gated at all — they
+    // need to be reachable for any visitor to see the landing page or
+    // sign-in form. Just pass through without attaching anything.
+    if (!isGatedPath(req.path)) {
+      return next();
+    }
+
+    const cookies = parseCookies(req);
+    const sessionId = cookies[SESSION_COOKIE];
+
+    if (!sessionId) {
+      // Look up the trial cookie FIRST (regardless of path) so handlers
+      // like /api/account/whoami can see req.trial even on public paths.
+      // We separate "trial is present" from "trial gates access" —
+      // attachment is unconditional, gating is path-dependent below.
+      let trial = null;
+      const trialCookieId = cookies[TRIAL_COOKIE];
+      if (trialCookieId) {
+        try {
+          trial = lookupTrial(trialCookieId);
+        } catch (err) {
+          console.warn("[tenant-auth] trial lookup failed:", err);
+        }
+        if (trial) {
+          req.trial = trial;
+        }
+      }
+
+      // Public paths (auth flow, health, whoami, etc.) pass through.
+      // Handlers should treat req.userId === undefined as "anonymous"
+      // and inspect req.trial separately to render appropriate UI.
+      if (isPublicPath(req.path)) {
+        req.user = null;
+        return next();
+      }
+
+      // Second lane: anonymous trial cookie with remaining budget.
+      // Attach a synthetic userId so /api/process and other gated
+      // endpoints can run. If the cookie exists but is exhausted,
+      // fall through to 401 — the UI's "sign up for more" nudge
+      // takes it from here.
+      if (trial && hasTrialBudget(trial)) {
+        req.userId = `anon:${trial.cookie_id}`;
+        req.user = null;
+        return next();
+      }
+
+      // No session, no usable trial. The /api/process handler is the
+      // one place where a fresh trial cookie CAN still be minted on
+      // first POST — let it through with no user attached so it can
+      // call issueIfEligible() and either issue + proceed or 401.
+      if (isTrialEligiblePath(req.path, req.method)) {
+        req.userId = undefined; // signal: "pre-trial, mint if eligible"
+        req.user = null;
+        return next();
+      }
+
+      return res.status(401).json({ error: "auth_required" });
+    }
+
+    let session;
+    try {
+      session = stmts().sessionLookupStmt.get(sessionId, Date.now());
+    } catch (err) {
+      console.warn("[tenant-auth] session lookup failed:", err);
+      if (isPublicPath(req.path)) return next();
+      return res.status(500).json({ error: "auth_lookup_failed" });
+    }
+
+    if (!session) {
+      // Stale or expired cookie. Clear it so the browser stops sending
+      // a dead token on every request.
+      res.clearCookie?.(SESSION_COOKIE);
+      if (isPublicPath(req.path)) return next();
+      return res.status(401).json({ error: "session_expired" });
+    }
+
+    let user;
+    try {
+      user = stmts().userLookupStmt.get(session.user_id);
+    } catch (err) {
+      console.warn("[tenant-auth] user lookup failed:", err);
+      if (isPublicPath(req.path)) return next();
+      return res.status(500).json({ error: "user_lookup_failed" });
+    }
+
+    if (!user) {
+      // User row was deleted but the session row survived — shouldn't
+      // happen under ON DELETE CASCADE, but defend in depth.
+      res.clearCookie?.(SESSION_COOKIE);
+      if (isPublicPath(req.path)) return next();
+      return res.status(401).json({ error: "user_gone" });
+    }
+
+    req.userId = user.id;
+    req.user = user;
+    req.session = session;
+    maybeTouch(sessionId);
+    next();
+  };
+}
+
+// Convenience: a guard middleware to chain after auth, for endpoints
+// that MUST have a user (where the single-mode synthetic "owner"
+// won't do, e.g. /api/account/*). Single-mode falls through because
+// req.userId === "owner" is truthy.
+export function requireUser(req, res, next) {
+  if (!req.userId) {
+    return res.status(401).json({ error: "auth_required" });
+  }
+  next();
+}
+
+// Operator-only guard: passes through in single mode (the operator
+// IS the only user), in multi mode requires req.user.is_admin === 1.
+// Used to gate the full settings panel (provider keys, prompts, etc.).
+export function requireOperator(req, res, next) {
+  if (req.recapMode !== "multi") return next();
+  if (!req.user || !req.user.is_admin) {
+    return res.status(403).json({ error: "operator_only" });
+  }
+  next();
+}
diff --git a/server/tenant-credits.js b/server/tenant-credits.js
new file mode 100644
index 0000000..08d9d50
--- /dev/null
+++ b/server/tenant-credits.js
@@ -0,0 +1,255 @@
+// Per-tenant credit ledger — operations on the tenant_credits SQLite
+// table. Two buckets per user:
+//   purchased_balance — permanent (a la carte purchases + admin grants
+//                       + anon-trial carry-over on signup). Never
+//                       wiped or refilled.
+//   replenish_balance — refillable (initial signup grant + periodic
+//                       anniversary refill to tenant_default_credits).
+//                       Leftovers at the end of a period are FORFEIT.
+//
+// Spend order: replenish first, then purchased — refillable bucket
+// is "use it or lose it" so it makes sense to burn first.
+//
+// Multi-mode only. Single-mode doesn't use this table at all.
+
+import { getDb } from "./db.js";
+import { getConfigSnapshot } from "./config.js";
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+// addMonthClamped(date) — calendar-month add for monthly replenishment.
+// Mirrors the relay's same-named helper: Jan 31 → Feb 28/29 (clamped),
+// Feb 28 → Mar 28 (preserve day-of-month). Returns a Date.
+function addMonthClamped(date) {
+  const d = new Date(date.getTime());
+  const year = d.getUTCFullYear();
+  const month = d.getUTCMonth();
+  const day = d.getUTCDate();
+  const lastDayOfTargetMonth = new Date(
+    Date.UTC(year, month + 2, 0),
+  ).getUTCDate();
+  const targetDay = Math.min(day, lastDayOfTargetMonth);
+  return new Date(
+    Date.UTC(
+      year,
+      month + 1,
+      targetDay,
+      d.getUTCHours(),
+      d.getUTCMinutes(),
+      d.getUTCSeconds(),
+      d.getUTCMilliseconds(),
+    ),
+  );
+}
+
+// Resolve the next anniversary boundary after `last` for the configured
+// period. Returns null if period is "off" (no replenishment).
+function nextReplenishAt(lastEpochMs, period) {
+  if (period === "off" || !lastEpochMs) return null;
+  if (period === "daily") return lastEpochMs + DAY_MS;
+  if (period === "weekly") return lastEpochMs + 7 * DAY_MS;
+  if (period === "monthly") {
+    return addMonthClamped(new Date(lastEpochMs)).getTime();
+  }
+  return null;
+}
+
+// Read the current operator config relevant to credits. Cached per-
+// request by getConfigSnapshot (which polls config.js's snapshot).
+async function readCreditConfig() {
+  const snap = await getConfigSnapshot();
+  const period =
+    snap?.tenant_credit_replenish_period &&
+    ["off", "daily", "weekly", "monthly"].includes(
+      snap.tenant_credit_replenish_period,
+    )
+      ? snap.tenant_credit_replenish_period
+      : "off";
+  const defaultCredits = Math.max(
+    0,
+    parseInt(snap?.tenant_default_credits ?? 5, 10) || 0,
+  );
+  return { period, defaultCredits };
+}
+
+// Internal: ensure a tenant_credits row exists for this user. New users
+// (just signed up but no row yet — shouldn't happen post-auth-routes-fix
+// but defensive) get a row with replenish_balance = current default.
+function ensureRow(userId, defaultCredits) {
+  const db = getDb();
+  const existing = db
+    .prepare("SELECT * FROM tenant_credits WHERE user_id = ?")
+    .get(userId);
+  if (existing) return existing;
+  const now = Date.now();
+  db.prepare(
+    `INSERT INTO tenant_credits
+       (user_id, purchased_balance, replenish_balance, last_replenish_at,
+        lifetime_granted, lifetime_consumed)
+     VALUES (?, 0, ?, ?, ?, 0)`,
+  ).run(userId, defaultCredits, now, defaultCredits);
+  return db
+    .prepare("SELECT * FROM tenant_credits WHERE user_id = ?")
+    .get(userId);
+}
+
+// Apply periodic refill if due. Returns the (possibly updated) row.
+// Anniversary semantics: if last_replenish_at + period_ms <= now, the
+// replenish bucket is RESET to defaultCredits (any leftover is
+// forfeit), and last_replenish_at is advanced. Idempotent if called
+// multiple times in the same period (no-op).
+//
+// "Multi-period catch-up" rule: if a user has been idle for several
+// periods, only ONE refill is applied (we don't stack refills from
+// missed periods). They effectively lost the credits for the missed
+// days — same as a per-day allowance in any other SaaS.
+function maybeReplenish(row, period, defaultCredits) {
+  if (period === "off") return row;
+  const due = nextReplenishAt(row.last_replenish_at, period);
+  if (due === null) return row;
+  const now = Date.now();
+  if (now < due) return row;
+  const db = getDb();
+  db.prepare(
+    `UPDATE tenant_credits
+     SET replenish_balance = ?, last_replenish_at = ?
+     WHERE user_id = ?`,
+  ).run(defaultCredits, now, row.user_id);
+  return {
+    ...row,
+    replenish_balance: defaultCredits,
+    last_replenish_at: now,
+  };
+}
+
+// ── Public API ──────────────────────────────────────────────────────────
+
+// getOrInit(userId) — fetch the tenant_credits row, lazily refilling if
+// the period boundary has passed. Returns the canonical shape for
+// callers that just want to display + compute totals.
+export async function getOrInit(userId) {
+  if (!userId) return null;
+  const { period, defaultCredits } = await readCreditConfig();
+  let row = ensureRow(userId, defaultCredits);
+  row = maybeReplenish(row, period, defaultCredits);
+  return {
+    user_id: row.user_id,
+    purchased: row.purchased_balance,
+    replenish: row.replenish_balance,
+    total: row.purchased_balance + row.replenish_balance,
+    last_replenish_at: row.last_replenish_at,
+    lifetime_granted: row.lifetime_granted,
+    lifetime_consumed: row.lifetime_consumed,
+    period, // surfaces config in returned shape for UI hints
+  };
+}
+
+// gateAndDebit(userId) — atomic: refill if due, check total > 0, debit
+// one credit (replenish first, then purchased). Returns
+// { ok: true, total, source: "replenish"|"purchased" } on success,
+// { ok: false, reason: "no_credits", total: 0 } if nothing available.
+export async function gateAndDebit(userId) {
+  if (!userId) return { ok: false, reason: "no_user_id" };
+  const state = await getOrInit(userId);
+  if (!state) return { ok: false, reason: "no_user_id" };
+  if (state.total <= 0) {
+    return { ok: false, reason: "no_credits", total: 0 };
+  }
+  const db = getDb();
+  const tx = db.transaction(() => {
+    if (state.replenish > 0) {
+      db.prepare(
+        `UPDATE tenant_credits
+         SET replenish_balance = replenish_balance - 1,
+             lifetime_consumed = lifetime_consumed + 1
+         WHERE user_id = ?`,
+      ).run(userId);
+      return "replenish";
+    }
+    db.prepare(
+      `UPDATE tenant_credits
+       SET purchased_balance = purchased_balance - 1,
+           lifetime_consumed = lifetime_consumed + 1
+       WHERE user_id = ?`,
+    ).run(userId);
+    return "purchased";
+  });
+  const source = tx();
+  // Re-read for the new total. Cheap — same row, no replenish-check
+  // needed since we just touched it.
+  const fresh = db
+    .prepare(
+      "SELECT purchased_balance, replenish_balance FROM tenant_credits WHERE user_id = ?",
+    )
+    .get(userId);
+  return {
+    ok: true,
+    total: (fresh.purchased_balance || 0) + (fresh.replenish_balance || 0),
+    source,
+  };
+}
+
+// addPurchased(userId, amount) — increment the permanent bucket. Used
+// by admin grants AND a la carte purchase apply AND anon-trial
+// carry-over on signup. Increments lifetime_granted too.
+//
+// We don't replenish-check here — adding to the permanent bucket
+// shouldn't trigger a refill side-effect. The refill happens lazily
+// on the next getOrInit() call.
+export function addPurchased(userId, amount) {
+  if (!userId || !Number.isFinite(amount) || amount <= 0) return null;
+  const db = getDb();
+  const existing = db
+    .prepare("SELECT user_id FROM tenant_credits WHERE user_id = ?")
+    .get(userId);
+  if (existing) {
+    db.prepare(
+      `UPDATE tenant_credits
+       SET purchased_balance = purchased_balance + ?,
+           lifetime_granted = lifetime_granted + ?
+       WHERE user_id = ?`,
+    ).run(amount, amount, userId);
+  } else {
+    // Row didn't exist — initialize WITHOUT a replenishable seed
+    // (this user hasn't been through the signup flow on this Recap;
+    // probably an admin granting credits before they sign in).
+    const now = Date.now();
+    db.prepare(
+      `INSERT INTO tenant_credits
+         (user_id, purchased_balance, replenish_balance, last_replenish_at,
+          lifetime_granted, lifetime_consumed)
+       VALUES (?, ?, 0, ?, ?, 0)`,
+    ).run(userId, amount, now, amount);
+  }
+  return db
+    .prepare("SELECT * FROM tenant_credits WHERE user_id = ?")
+    .get(userId);
+}
+
+// seedSignup(userId, amount?) — initialize a tenant_credits row at
+// signup. Seeds replenish_balance with the configured default
+// (overridable for testing), sets last_replenish_at = now so the
+// first refill boundary is computed correctly.
+export async function seedSignup(userId, amountOverride) {
+  if (!userId) return null;
+  const { defaultCredits } = await readCreditConfig();
+  const amount =
+    typeof amountOverride === "number" && amountOverride >= 0
+      ? amountOverride
+      : defaultCredits;
+  const db = getDb();
+  const existing = db
+    .prepare("SELECT user_id FROM tenant_credits WHERE user_id = ?")
+    .get(userId);
+  if (existing) return existing; // don't re-seed
+  const now = Date.now();
+  db.prepare(
+    `INSERT INTO tenant_credits
+       (user_id, purchased_balance, replenish_balance, last_replenish_at,
+        lifetime_granted, lifetime_consumed)
+     VALUES (?, 0, ?, ?, ?, 0)`,
+  ).run(userId, amount, now, amount);
+  return db
+    .prepare("SELECT * FROM tenant_credits WHERE user_id = ?")
+    .get(userId);
+}
diff --git a/server/test/gemini-helpers.test.js b/server/test/gemini-helpers.test.js
index e834b4a..5fcbb3c 100644
--- a/server/test/gemini-helpers.test.js
+++ b/server/test/gemini-helpers.test.js
@@ -4,10 +4,11 @@ import { PRICING, calcCost, buildAnalysisPrompt } from "../gemini-helpers.js";
 
 describe("PRICING table", () => {
   test("includes all current production model slugs", () => {
-    assert.ok(PRICING["gemini-3-flash-preview"]);
-    assert.ok(PRICING["gemini-3-pro-preview"]);
     assert.ok(PRICING["gemini-3.1-pro-preview"]);
+    assert.ok(PRICING["gemini-2.5-pro"]);
+    assert.ok(PRICING["gemini-3-flash-preview"]);
     assert.ok(PRICING["gemini-2.5-flash"]);
+    assert.ok(PRICING["gemini-3.1-flash-lite"]);
   });
 
   test("has a 'default' fallback row", () => {
@@ -66,7 +67,7 @@ describe("calcCost", () => {
   });
 
   test("formats >$0.01 totals as $X.XXXX", () => {
-    const cost = calcCost("gemini-3-pro-preview", {
+    const cost = calcCost("gemini-3.1-pro-preview", {
       promptTokenCount: 1_000_000,
       candidatesTokenCount: 0,
       thoughtsTokenCount: 0,
diff --git a/server/test/history.test.js b/server/test/history.test.js
index 4e502c5..a2cdd57 100644
--- a/server/test/history.test.js
+++ b/server/test/history.test.js
@@ -43,8 +43,14 @@ describe("initHistory + getHistoryDir", () => {
 });
 
 describe("saveToHistory", () => {
+  // saveToHistory is scope-aware: it takes a `scope` first and writes under
+  // history/<scope>/. Tests use the "owner" scope (single-mode / operator).
+  const SCOPE = "owner";
+  const scopeFile = (id) => path.join(historyDir, SCOPE, `${id}.json`);
+
   test("returns an id and writes a file with the expected shape", async () => {
     const id = await history.saveToHistory(
+      SCOPE,
       "videoId123",
       "https://youtu.be/videoId123",
       "My title",
@@ -56,7 +62,7 @@ describe("saveToHistory", () => {
     );
     assert.match(id, /^\d+-videoId123$/);
 
-    const raw = await fs.readFile(path.join(historyDir, `${id}.json`), "utf-8");
+    const raw = await fs.readFile(scopeFile(id), "utf-8");
     const record = JSON.parse(raw);
     assert.equal(record.id, id);
     assert.equal(record.videoId, "videoId123");
@@ -74,6 +80,7 @@ describe("saveToHistory", () => {
 
   test("falls back to 'Untitled' when title is empty", async () => {
     const id = await history.saveToHistory(
+      SCOPE,
       "noTitleX",
       "url",
       "",
@@ -83,20 +90,20 @@ describe("saveToHistory", () => {
       "",
       "youtube"
     );
-    const raw = await fs.readFile(path.join(historyDir, `${id}.json`), "utf-8");
+    const raw = await fs.readFile(scopeFile(id), "utf-8");
     const record = JSON.parse(raw);
     assert.equal(record.title, "Untitled");
   });
 
   test("defaults type to 'youtube' when not specified", async () => {
-    const id = await history.saveToHistory("vid", "url", "t", [], [], [], "", null);
-    const raw = await fs.readFile(path.join(historyDir, `${id}.json`), "utf-8");
+    const id = await history.saveToHistory(SCOPE, "vid", "url", "t", [], [], [], "", null);
+    const raw = await fs.readFile(scopeFile(id), "utf-8");
     assert.equal(JSON.parse(raw).type, "youtube");
   });
 
   test("encodes long podcast guids into a base64-truncated id suffix", async () => {
     const longGuid = "https://example.com/podcasts/feed.xml#episode-uuid-very-long-string";
-    const id = await history.saveToHistory(longGuid, longGuid, "ep", [], [], [], "", "podcast");
+    const id = await history.saveToHistory(SCOPE, longGuid, longGuid, "ep", [], [], [], "", "podcast");
     // suffix should be 16 base64 chars, not the raw URL
     assert.ok(!id.includes("https"));
     assert.match(id, /^\d+-[A-Za-z0-9_-]{16}$/);
@@ -104,9 +111,10 @@ describe("saveToHistory", () => {
 });
 
 describe("loadMeta + saveMeta", () => {
+  // loadMeta/saveMeta are scope-aware (history/<scope>/_meta.json).
   test("loadMeta returns default empty shape when file missing", async () => {
-    // Use a fresh sub-history to ensure no prior _meta.json
-    const meta = await history.loadMeta();
+    // A scope that has never been written → default shape.
+    const meta = await history.loadMeta("never-written-scope");
     assert.ok(Array.isArray(meta.folders));
     assert.ok(Array.isArray(meta.uncategorized));
   });
@@ -116,14 +124,16 @@ describe("loadMeta + saveMeta", () => {
       folders: [{ id: "f1", name: "Bitcoin podcasts", collapsed: false, items: ["s1", "s2"] }],
       uncategorized: ["s3"],
     };
-    await history.saveMeta(original);
-    const loaded = await history.loadMeta();
+    await history.saveMeta("owner", original);
+    const loaded = await history.loadMeta("owner");
     assert.deepEqual(loaded, original);
   });
 
   test("loadMeta returns default when _meta.json is corrupt", async () => {
-    await fs.writeFile(path.join(historyDir, "_meta.json"), "{ this is not json");
-    const loaded = await history.loadMeta();
+    const dir = path.join(historyDir, "corrupt-scope");
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(path.join(dir, "_meta.json"), "{ this is not json");
+    const loaded = await history.loadMeta("corrupt-scope");
     assert.deepEqual(loaded.folders, []);
     assert.deepEqual(loaded.uncategorized, []);
   });
diff --git a/server/test/internal-sessions.test.js b/server/test/internal-sessions.test.js
new file mode 100644
index 0000000..bd4acaf
--- /dev/null
+++ b/server/test/internal-sessions.test.js
@@ -0,0 +1,79 @@
+// Tests for the ephemeral sessions the subscription background processor
+// mints to run /api/process AS each item's owner (per-tenant subscriptions,
+// step 4). The mechanism reuses the real sessions table, so verifying the
+// row it writes is valid + non-expired (and gets cleaned up) is enough to
+// trust the existing cookie → tenant-auth → req.user chain.
+
+import { test, describe, before, after } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { initDb, getDb, closeDb } from "../db.js";
+import {
+  mintInternalSession,
+  deleteInternalSession,
+  adminUserId,
+} from "../auth-routes.js";
+
+let dataDir;
+
+function makeUser({ id, email, isAdmin = 0 }) {
+  getDb()
+    .prepare(
+      `INSERT INTO users (id, email, created_at, synthetic_install_id, is_admin)
+       VALUES (?, ?, ?, ?, ?)`,
+    )
+    .run(id, email, Date.now(), `inst-${id}`, isAdmin);
+}
+
+before(async () => {
+  dataDir = mkdtempSync(path.join(tmpdir(), "recap-sess-"));
+  await initDb({ dataDir });
+});
+
+after(() => {
+  closeDb();
+  rmSync(dataDir, { recursive: true, force: true });
+});
+
+describe("mintInternalSession / deleteInternalSession", () => {
+  test("creates a valid, non-expired session row for the user", () => {
+    makeUser({ id: "u-tenant", email: "tenant@example.com" });
+    const token = mintInternalSession("u-tenant");
+    assert.ok(typeof token === "string" && token.length > 20);
+
+    // Looks up exactly like tenant-auth does: by id, must be unexpired.
+    const row = getDb()
+      .prepare("SELECT * FROM sessions WHERE id = ? AND expires_at > ?")
+      .get(token, Date.now());
+    assert.ok(row, "session row exists and is not expired");
+    assert.equal(row.user_id, "u-tenant");
+    assert.ok(row.expires_at > Date.now(), "expires in the future");
+  });
+
+  test("deleteInternalSession removes the row (no lingering identity)", () => {
+    makeUser({ id: "u-temp", email: "temp@example.com" });
+    const token = mintInternalSession("u-temp");
+    assert.ok(getDb().prepare("SELECT 1 FROM sessions WHERE id = ?").get(token));
+    deleteInternalSession(token);
+    assert.equal(
+      getDb().prepare("SELECT 1 FROM sessions WHERE id = ?").get(token),
+      undefined,
+    );
+  });
+
+  test("deleteInternalSession tolerates null / unknown tokens", () => {
+    // Should not throw.
+    deleteInternalSession(null);
+    deleteInternalSession("does-not-exist");
+  });
+});
+
+describe("adminUserId", () => {
+  test("returns the operator (is_admin = 1) user id", () => {
+    makeUser({ id: "u-admin", email: "admin@example.com", isAdmin: 1 });
+    assert.equal(adminUserId(), "u-admin");
+  });
+});
diff --git a/server/test/subscription-reminders.test.js b/server/test/subscription-reminders.test.js
new file mode 100644
index 0000000..81315ae
--- /dev/null
+++ b/server/test/subscription-reminders.test.js
@@ -0,0 +1,51 @@
+// Pure-logic tests for the expiry-reminder cadence: which reminder kind
+// (if any) applies to a relay subscription row right now. The send/dedup
+// path hits SQLite + SMTP and isn't unit-tested here; this nails the
+// decision that drives it.
+
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+
+import { reminderKindFor } from "../subscription-reminders.js";
+
+const sub = (days_left, expired = false) => ({
+  tier: "pro",
+  expires_at: "2026-07-01T00:00:00.000Z",
+  expired,
+  days_left,
+});
+
+describe("reminderKindFor", () => {
+  test("upcoming: smallest crossed threshold wins", () => {
+    assert.equal(reminderKindFor(sub(8)), null); // beyond 7d
+    assert.equal(reminderKindFor(sub(7)), "upcoming_7d");
+    assert.equal(reminderKindFor(sub(5)), "upcoming_7d");
+    assert.equal(reminderKindFor(sub(2)), "upcoming_7d");
+    assert.equal(reminderKindFor(sub(1)), "upcoming_1d");
+    assert.equal(reminderKindFor(sub(0)), "upcoming_1d"); // expires today, not yet lapsed
+  });
+
+  test("lapsed: only within the lapsed window", () => {
+    assert.equal(reminderKindFor(sub(0, true)), "lapsed");
+    assert.equal(reminderKindFor(sub(-1, true)), "lapsed");
+    assert.equal(reminderKindFor(sub(-3, true)), "lapsed");
+    assert.equal(reminderKindFor(sub(-4, true)), null); // aged out (window=3)
+  });
+
+  test("null-safe / malformed input", () => {
+    assert.equal(reminderKindFor(null), null);
+    assert.equal(reminderKindFor({}), null);
+    assert.equal(reminderKindFor({ expired: false }), null); // no days_left
+    assert.equal(reminderKindFor({ days_left: "soon" }), null);
+  });
+
+  test("respects custom thresholds", () => {
+    const upcoming = [
+      { days: 14, kind: "upcoming_14d" },
+      { days: 3, kind: "upcoming_3d" },
+    ];
+    assert.equal(reminderKindFor(sub(14), { upcoming }), "upcoming_14d");
+    assert.equal(reminderKindFor(sub(3), { upcoming }), "upcoming_3d");
+    assert.equal(reminderKindFor(sub(15), { upcoming }), null);
+  });
+});
diff --git a/server/test/subscriptions.test.js b/server/test/subscriptions.test.js
new file mode 100644
index 0000000..b21e033
--- /dev/null
+++ b/server/test/subscriptions.test.js
@@ -0,0 +1,343 @@
+import { test, describe } from "node:test";
+import { strict as assert } from "node:assert";
+import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { readFileSync, existsSync } from "node:fs";
+import { initHistory, getScopeHistoryDir, getHistoryDir } from "../history.js";
+import {
+  getProcessedVideoIds,
+  isKnownVideo,
+  loadSubscriptions,
+  saveSubscriptions,
+  loadSkipList,
+  addToSkipList,
+  loadSeenList,
+  addToSeenList,
+  loadAutoQueue,
+  saveAutoQueue,
+  mutateAutoQueue,
+  listSubscriptionScopes,
+  migrateGlobalSubscriptionsToOwner,
+} from "../subscriptions.js";
+
+// ── isKnownVideo (pure dedup predicate) ──────────────────────────────────
+describe("isKnownVideo", () => {
+  const sets = {
+    processedIds: new Set(["P1"]),
+    queuedIds: new Set(["Q1"]),
+    skippedIds: new Set(["S1"]),
+    seenIds: new Set(["N1"]),
+  };
+
+  test("true when the id is in the library (processed)", () => {
+    assert.equal(isKnownVideo("P1", sets), true);
+  });
+  test("true when the id is already queued", () => {
+    assert.equal(isKnownVideo("Q1", sets), true);
+  });
+  test("true when the id was declined (skip list)", () => {
+    assert.equal(isKnownVideo("S1", sets), true);
+  });
+  test("true when the id was offered before (seen list)", () => {
+    assert.equal(isKnownVideo("N1", sets), true);
+  });
+  test("false for a genuinely new id", () => {
+    assert.equal(isKnownVideo("NEW", sets), false);
+  });
+  test("returns a real boolean, not a Set/undefined", () => {
+    assert.equal(typeof isKnownVideo("NEW", sets), "boolean");
+    assert.equal(typeof isKnownVideo("P1", sets), "boolean");
+  });
+  test("tolerates missing/partial set bags", () => {
+    assert.equal(isKnownVideo("X", {}), false);
+    assert.equal(isKnownVideo("X", undefined), false);
+    assert.equal(isKnownVideo("X", { processedIds: new Set(["X"]) }), true);
+  });
+});
+
+// ── getProcessedVideoIds (scope-aware library scan) ──────────────────────
+// This is the function whose wrong-directory bug caused the auto-queue to
+// re-offer already-summarized videos: it must scan history/<scope>/, NOT
+// the top-level history dir, and must not leak ids across scopes.
+describe("getProcessedVideoIds", () => {
+  function freshDataDir() {
+    const dataDir = mkdtempSync(path.join(tmpdir(), "recap-subs-"));
+    return dataDir;
+  }
+
+  test("scans the scope's library dir and collects videoIds", async () => {
+    const dataDir = freshDataDir();
+    await initHistory({ dataDir, mode: "multi" });
+    const ownerDir = getScopeHistoryDir("owner");
+    mkdirSync(ownerDir, { recursive: true });
+    writeFileSync(path.join(ownerDir, "a.json"), JSON.stringify({ videoId: "VID_A" }));
+    writeFileSync(path.join(ownerDir, "b.json"), JSON.stringify({ videoId: "VID_B" }));
+
+    const ids = await getProcessedVideoIds("owner");
+    assert.equal(ids.size, 2);
+    assert.ok(ids.has("VID_A"));
+    assert.ok(ids.has("VID_B"));
+  });
+
+  test("does NOT leak ids across scopes (per-tenant isolation)", async () => {
+    const dataDir = freshDataDir();
+    await initHistory({ dataDir, mode: "multi" });
+    const ownerDir = getScopeHistoryDir("owner");
+    const tenantDir = getScopeHistoryDir("tenant123");
+    mkdirSync(ownerDir, { recursive: true });
+    mkdirSync(tenantDir, { recursive: true });
+    writeFileSync(path.join(ownerDir, "a.json"), JSON.stringify({ videoId: "OWNER_VID" }));
+    writeFileSync(path.join(tenantDir, "c.json"), JSON.stringify({ videoId: "TENANT_VID" }));
+
+    const ownerIds = await getProcessedVideoIds("owner");
+    assert.ok(ownerIds.has("OWNER_VID"));
+    assert.equal(ownerIds.has("TENANT_VID"), false);
+  });
+
+  test("ignores _meta.json and non-JSON / malformed files", async () => {
+    const dataDir = freshDataDir();
+    await initHistory({ dataDir, mode: "multi" });
+    const ownerDir = getScopeHistoryDir("owner");
+    mkdirSync(ownerDir, { recursive: true });
+    writeFileSync(path.join(ownerDir, "good.json"), JSON.stringify({ videoId: "GOOD" }));
+    writeFileSync(path.join(ownerDir, "_meta.json"), JSON.stringify({ folders: [], uncategorized: [] }));
+    writeFileSync(path.join(ownerDir, "notes.txt"), "videoId: NOPE");
+    writeFileSync(path.join(ownerDir, "broken.json"), "{ not valid json");
+    writeFileSync(path.join(ownerDir, "nofield.json"), JSON.stringify({ title: "no videoId here" }));
+
+    const ids = await getProcessedVideoIds("owner");
+    assert.deepEqual([...ids], ["GOOD"]);
+  });
+
+  test("returns an empty set for a scope with no library yet", async () => {
+    const dataDir = freshDataDir();
+    await initHistory({ dataDir, mode: "multi" });
+    const ids = await getProcessedVideoIds("never-summarized");
+    assert.equal(ids.size, 0);
+  });
+
+  test("defaults to the owner scope when none is passed", async () => {
+    const dataDir = freshDataDir();
+    await initHistory({ dataDir, mode: "single" });
+    const ownerDir = getScopeHistoryDir("owner");
+    mkdirSync(ownerDir, { recursive: true });
+    writeFileSync(path.join(ownerDir, "a.json"), JSON.stringify({ videoId: "DEFAULT_OWNER" }));
+
+    const ids = await getProcessedVideoIds(); // no arg → "owner"
+    assert.ok(ids.has("DEFAULT_OWNER"));
+  });
+
+  // Regression: after the 0.2.147 migration the subscription sidecar files
+  // live inside the scope dir. They must NOT be treated as session records
+  // (that produced the phantom "Invalid Date · undefined topics" library
+  // entry). Verify the ROOT_SIDECARS filter skips them even if one happens
+  // to carry a top-level videoId.
+  test("skips subscription sidecar files when scanning the library", async () => {
+    const dataDir = freshDataDir();
+    await initHistory({ dataDir, mode: "multi" });
+    const ownerDir = getScopeHistoryDir("owner");
+    mkdirSync(ownerDir, { recursive: true });
+    writeFileSync(path.join(ownerDir, "real.json"), JSON.stringify({ videoId: "REAL" }));
+    for (const f of ["subscriptions.json", "auto-queue.json", "skip-list.json", "seen-list.json"]) {
+      // Even with a (bogus) top-level videoId, a sidecar must be ignored.
+      writeFileSync(path.join(ownerDir, f), JSON.stringify({ videoId: "SIDECAR_" + f, items: [] }));
+    }
+    const ids = await getProcessedVideoIds("owner");
+    assert.deepEqual([...ids], ["REAL"]);
+  });
+});
+
+// ── Per-scope storage (subscriptions / skip / seen / auto-queue) ─────────
+describe("per-scope storage", () => {
+  function fresh() {
+    return mkdtempSync(path.join(tmpdir(), "recap-store-"));
+  }
+
+  test("subscriptions round-trip and stay isolated per scope", async () => {
+    await initHistory({ dataDir: fresh(), mode: "multi" });
+    assert.deepEqual(await loadSubscriptions("owner"), []); // empty default
+    await saveSubscriptions("owner", [{ id: "s1", url: "u1" }]);
+    await saveSubscriptions("tenantA", [{ id: "s2", url: "u2" }]);
+    assert.equal((await loadSubscriptions("owner")).length, 1);
+    assert.equal((await loadSubscriptions("owner"))[0].id, "s1");
+    assert.equal((await loadSubscriptions("tenantA"))[0].id, "s2");
+  });
+
+  test("skip + seen lists are per-scope Sets", async () => {
+    await initHistory({ dataDir: fresh(), mode: "multi" });
+    await addToSkipList("owner", "VID1");
+    await addToSkipList("owner", "VID2");
+    await addToSeenList("owner", ["S1", "S2"]);
+    const skip = await loadSkipList("owner");
+    const seen = await loadSeenList("owner");
+    assert.ok(skip.has("VID1") && skip.has("VID2"));
+    assert.ok(seen.has("S1") && seen.has("S2"));
+    assert.equal((await loadSkipList("tenantA")).size, 0); // isolated
+  });
+
+  test("auto-queue save/load round-trips", async () => {
+    await initHistory({ dataDir: fresh(), mode: "multi" });
+    await saveAutoQueue("owner", [{ id: "a", status: "pending" }]);
+    const q = await loadAutoQueue("owner");
+    assert.equal(q.length, 1);
+    assert.equal(q[0].status, "pending");
+  });
+
+  test("mutateAutoQueue serializes concurrent read-modify-writes (no lost updates)", async () => {
+    await initHistory({ dataDir: fresh(), mode: "multi" });
+    await saveAutoQueue("owner", []);
+    // Fire 20 concurrent appends. Under a naive load→mutate→save these would
+    // clobber each other; mutateAutoQueue must serialize them.
+    await Promise.all(
+      Array.from({ length: 20 }, (_, i) =>
+        mutateAutoQueue("owner", (items) => {
+          items.push({ id: `item-${i}` });
+        }),
+      ),
+    );
+    const q = await loadAutoQueue("owner");
+    assert.equal(q.length, 20, "all 20 concurrent appends survived");
+    assert.equal(new Set(q.map((x) => x.id)).size, 20, "no duplicates/drops");
+  });
+
+  test("mutateAutoQueue can replace the array (filter/remove)", async () => {
+    await initHistory({ dataDir: fresh(), mode: "multi" });
+    await saveAutoQueue("owner", [{ id: "keep" }, { id: "drop" }]);
+    await mutateAutoQueue("owner", (items) => items.filter((x) => x.id !== "drop"));
+    const q = await loadAutoQueue("owner");
+    assert.deepEqual(q.map((x) => x.id), ["keep"]);
+  });
+});
+
+// ── Auto-queue endpoint mutation patterns ────────────────────────────────
+// The /api/auto-queue/* handlers run these exact callbacks through
+// mutateAutoQueue. Verify the logic directly (the HTTP layer just adds the
+// license gate + scope resolution, covered elsewhere).
+describe("auto-queue endpoint mutation logic", () => {
+  async function seed(items) {
+    await initHistory({ dataDir: mkdtempSync(path.join(tmpdir(), "recap-ep-")), mode: "multi" });
+    await saveAutoQueue("owner", items);
+  }
+
+  test("approve: pending → approved; rejects non-pending", async () => {
+    await seed([{ id: "x", status: "pending" }, { id: "y", status: "completed" }]);
+    // approve x
+    let item = null, badStatus = null;
+    await mutateAutoQueue("owner", (items) => {
+      const it = items.find((q) => q.id === "x");
+      if (!it) return;
+      if (it.status !== "pending") { badStatus = it.status; return; }
+      it.status = "approved";
+      item = { ...it };
+    });
+    assert.equal(badStatus, null);
+    assert.equal(item.status, "approved");
+    assert.equal((await loadAutoQueue("owner")).find((q) => q.id === "x").status, "approved");
+    // approving y (completed) is rejected
+    badStatus = null;
+    await mutateAutoQueue("owner", (items) => {
+      const it = items.find((q) => q.id === "y");
+      if (it && it.status !== "pending") badStatus = it.status;
+    });
+    assert.equal(badStatus, "completed");
+  });
+
+  test("skip: captures videoId then removes the item", async () => {
+    await seed([{ id: "x", videoId: "VID_X", status: "pending" }, { id: "z", status: "pending" }]);
+    let videoId = null;
+    await mutateAutoQueue("owner", (items) => {
+      const it = items.find((q) => q.id === "x");
+      if (it && it.videoId) videoId = it.videoId;
+      return items.filter((q) => q.id !== "x");
+    });
+    assert.equal(videoId, "VID_X");
+    const q = await loadAutoQueue("owner");
+    assert.deepEqual(q.map((i) => i.id), ["z"]);
+  });
+
+  test("clear-finished: drops completed + failed, keeps active", async () => {
+    await seed([
+      { id: "a", status: "pending" },
+      { id: "b", status: "completed" },
+      { id: "c", status: "failed" },
+      { id: "d", status: "approved" },
+    ]);
+    let removed = 0;
+    await mutateAutoQueue("owner", (items) => {
+      const before = items.length;
+      const kept = items.filter((q) => !["completed", "failed"].includes(q.status));
+      removed = before - kept.length;
+      return kept;
+    });
+    assert.equal(removed, 2);
+    assert.deepEqual((await loadAutoQueue("owner")).map((i) => i.id).sort(), ["a", "d"]);
+  });
+
+  test("delete-by-subscription: removes that sub's items only", async () => {
+    await seed([
+      { id: "a", subscriptionId: "sub1", status: "pending" },
+      { id: "b", subscriptionId: "sub2", status: "pending" },
+      { id: "c", subscriptionId: "sub1", status: "approved" },
+    ]);
+    await mutateAutoQueue("owner", (items) => items.filter((q) => q.subscriptionId !== "sub1"));
+    assert.deepEqual((await loadAutoQueue("owner")).map((i) => i.id), ["b"]);
+  });
+});
+
+// ── Scope enumeration ────────────────────────────────────────────────────
+describe("listSubscriptionScopes", () => {
+  test("always includes owner; adds scopes with non-empty subscriptions", async () => {
+    await initHistory({ dataDir: mkdtempSync(path.join(tmpdir(), "recap-enum-")), mode: "multi" });
+    await saveSubscriptions("tenantA", [{ id: "s", url: "u" }]);
+    await saveSubscriptions("tenantB", []); // empty → excluded
+    const scopes = await listSubscriptionScopes();
+    assert.ok(scopes.includes("owner"));
+    assert.ok(scopes.includes("tenantA"));
+    assert.ok(!scopes.includes("tenantB"));
+  });
+
+  test("returns just owner when nobody has subscriptions", async () => {
+    await initHistory({ dataDir: mkdtempSync(path.join(tmpdir(), "recap-enum2-")), mode: "multi" });
+    const scopes = await listSubscriptionScopes();
+    assert.deepEqual(scopes, ["owner"]);
+  });
+});
+
+// ── Migration: history-root globals → owner scope ────────────────────────
+describe("migrateGlobalSubscriptionsToOwner", () => {
+  test("moves root files into owner/, idempotently, without clobbering", async () => {
+    const dataDir = mkdtempSync(path.join(tmpdir(), "recap-mig-"));
+    await initHistory({ dataDir, mode: "multi" });
+    const root = getHistoryDir();
+    mkdirSync(root, { recursive: true });
+    // Legacy global files at the history root.
+    writeFileSync(path.join(root, "subscriptions.json"), JSON.stringify({ subscriptions: [{ id: "s1" }] }));
+    writeFileSync(path.join(root, "auto-queue.json"), JSON.stringify({ items: [{ id: "q1" }] }));
+
+    const moved = await migrateGlobalSubscriptionsToOwner();
+    assert.equal(moved, 2);
+    // Now readable via the owner scope.
+    assert.equal((await loadSubscriptions("owner"))[0].id, "s1");
+    assert.equal((await loadAutoQueue("owner"))[0].id, "q1");
+    // Source files gone.
+    assert.equal(existsSync(path.join(root, "subscriptions.json")), false);
+    // Re-running is a no-op (nothing left to move).
+    assert.equal(await migrateGlobalSubscriptionsToOwner(), 0);
+  });
+
+  test("does not clobber an existing owner-scope file", async () => {
+    const dataDir = mkdtempSync(path.join(tmpdir(), "recap-mig2-"));
+    await initHistory({ dataDir, mode: "multi" });
+    const root = getHistoryDir();
+    const ownerDir = getScopeHistoryDir("owner");
+    mkdirSync(ownerDir, { recursive: true });
+    // Owner already has subscriptions; a stale root file must NOT overwrite.
+    writeFileSync(path.join(ownerDir, "subscriptions.json"), JSON.stringify({ subscriptions: [{ id: "KEEP" }] }));
+    writeFileSync(path.join(root, "subscriptions.json"), JSON.stringify({ subscriptions: [{ id: "STALE" }] }));
+
+    await migrateGlobalSubscriptionsToOwner();
+    assert.equal((await loadSubscriptions("owner"))[0].id, "KEEP");
+  });
+});
diff --git a/server/test/util.test.js b/server/test/util.test.js
index c416793..cb85d75 100644
--- a/server/test/util.test.js
+++ b/server/test/util.test.js
@@ -207,7 +207,11 @@ describe("retryGemini", () => {
       },
       { retries: 2, delayMs: 1, label: "test", log: (msg) => logs.push(msg) }
     ).catch(() => {});
-    assert.equal(logs.length, 1);
+    // retries: 2 → the loop logs twice: the "failed, retrying in …s" notice
+    // before attempt 2's wait, then "Retrying… (attempt 2/2)" at the top of
+    // attempt 2. (The test previously expected 1, written before the
+    // top-of-attempt retry line existed.)
+    assert.equal(logs.length, 2);
     assert.match(logs[0], /test/);
     assert.match(logs[0], /retrying/);
   });
diff --git a/server/tts-routes.js b/server/tts-routes.js
new file mode 100644
index 0000000..d92ec3e
--- /dev/null
+++ b/server/tts-routes.js
@@ -0,0 +1,258 @@
+// Audio-first ("walking mode") TTS routes. Turns a saved recap's per-topic
+// summaries into spoken MP3 clips (via the relay's /relay/tts → Kokoro),
+// caches them next to the session JSON, and serves them to the player.
+//
+// Endpoints (all scope-isolated to the requesting user's library):
+//   GET  /api/tts/availability         — { has_tts, allowed, default_voice }
+//   POST /api/tts/generate/:id/:index  — synthesize + cache ONE topic clip
+//                                        (idempotent, retried, deduped by job
+//                                        id). The player calls this on demand
+//                                        as it reaches each topic + prefetches
+//                                        the next, so clips are generated when
+//                                        needed and retried until they succeed
+//                                        rather than skipped.
+//   GET  /api/tts/status/:id           — { total, ready:[idx...], done }
+//   GET  /api/tts/audio/:id/:index     — serve a cached topic clip (mp3)
+//
+// Access policy (the "Max gate"):
+//   - single mode: the operator owns the box AND the TTS hardware, so no
+//     tier gate — TTS is available whenever the relay advertises has_tts.
+//   - multi mode admin: the operator; allowed.
+//   - multi-tenant cloud users: any paid subscription (Pro or Max). The
+//     operator can tighten this to Max-only here if shared TTS hardware
+//     throughput becomes a constraint.
+//
+// Billing: all of a recap's topics share ONE relay job id (`tts:<id>`), so
+// the relay charges at most 1 credit to voice an entire recap.
+
+import fs from "fs/promises";
+import path from "path";
+
+import {
+  scopeForRequest,
+  sessionAudioDir,
+  loadSession,
+  patchSession,
+} from "./history.js";
+import { getProvider, resolveProviderOpts } from "./providers/index.js";
+import { getRelayCapabilities } from "./relay-capabilities.js";
+
+const CLIP_FORMAT = "mp3";
+const CLIP_EXT = "mp3";
+
+// Whether THIS request's user may generate TTS. See the policy note above.
+export function userHasTtsAccess(req) {
+  // Single mode (or no request context): operator owns the hardware.
+  if (!req || req.recapMode !== "multi") return true;
+  // Multi-mode admin = the operator.
+  if (req.user && req.user.is_admin) return true;
+  // Multi-tenant cloud user: Pro or Max. Core-decoupling — the tier is the
+  // relay-owned subscription tier, cached on the Recaps account
+  // (req.user.tier), kept in sync by the operator grant flow.
+  const tier = req.user?.tier;
+  return tier === "pro" || tier === "max";
+}
+
+// The text we speak for a topic: its title as a lead-in, then the summary,
+// so an eyes-free listener hears what the topic is before its recap.
+export function chunkSpeechText(chunk) {
+  const title = (chunk?.title || "").trim();
+  const summary = (chunk?.summary || "").trim();
+  if (title && summary) return `${title}. ${summary}`;
+  return summary || title || "";
+}
+
+function clipFileName(index) {
+  return `topic-${index}.${CLIP_EXT}`;
+}
+
+// Server-side retries per clip on a transient (5xx/network) relay failure,
+// on top of any retry the relay itself does.
+const GEN_RETRIES = 2;
+
+// Generate + cache ONE topic clip. Idempotent: returns {cached:true} if the
+// file already exists. Retries transient failures; a 4xx (e.g. bad voice) or
+// empty summary is permanent (no retry). Returns
+// { ok, cached?, empty?, error?, voice? }.
+async function generateClip({ scope, id, index, chunk, provider, jobId, voice }) {
+  const dir = sessionAudioDir(scope, id);
+  const file = path.join(dir, clipFileName(index));
+  try {
+    await fs.access(file);
+    return { ok: true, cached: true };
+  } catch {}
+  const text = chunkSpeechText(chunk);
+  if (!text) return { ok: false, empty: true, error: "empty_summary" };
+  await fs.mkdir(dir, { recursive: true }).catch(() => {});
+  let lastErr = null;
+  for (let attempt = 1; attempt <= GEN_RETRIES + 1; attempt++) {
+    try {
+      const r = await provider.tts({ text, voice, format: CLIP_FORMAT, jobId });
+      await fs.writeFile(file, r.audio);
+      return { ok: true, voice: r.voice, backend: r.backend };
+    } catch (err) {
+      lastErr = err;
+      const status = err?.status || 0;
+      console.warn(
+        `[tts] clip ${index} attempt ${attempt}/${GEN_RETRIES + 1} failed (${status || "net"}): ${err?.message || err}`,
+      );
+      if (status >= 400 && status < 500) break; // client error → permanent
+      if (attempt <= GEN_RETRIES) await new Promise((r2) => setTimeout(r2, 600));
+    }
+  }
+  return { ok: false, error: (lastErr?.message || "tts_failed").slice(0, 200) };
+}
+
+function resolveScope(req, res) {
+  try {
+    return scopeForRequest(req);
+  } catch {
+    res.status(401).json({ error: "no_scope" });
+    return null;
+  }
+}
+
+export function setupTtsRoutes(app) {
+  // Lightweight probe for the frontend: should it show the "Listen"
+  // affordance, and what's the default voice?
+  app.get("/api/tts/availability", (req, res) => {
+    const caps = getRelayCapabilities();
+    res.json({
+      has_tts: !!caps.has_tts,
+      tts_backend: caps.tts_backend || null,
+      default_voice: caps.tts_default_voice || null,
+      allowed: userHasTtsAccess(req) && !!caps.has_tts,
+    });
+  });
+
+  // Generate (or return cached) the audio for ONE topic. The player calls
+  // this on demand as it reaches each topic — and prefetches the next — so a
+  // clip is generated when needed and RETRIED until it succeeds, rather than
+  // skipped. Idempotent + deduped by the shared job id (≤1 credit/recap).
+  //
+  // Responses:
+  //   200 { ok:true, index, cached }   — clip is ready to play
+  //   200 { ok:false, empty:true }     — topic has no summary text (permanent;
+  //                                      client should not retry)
+  //   502 { ok:false, error }          — transient failure; client retries
+  app.post("/api/tts/generate/:id/:index", async (req, res) => {
+    const scope = resolveScope(req, res);
+    if (!scope) return;
+    if (!userHasTtsAccess(req)) {
+      return res.status(403).json({
+        error: "tts_requires_subscription",
+        message: "Audio recaps are available to Pro and Max subscribers.",
+      });
+    }
+    const caps = getRelayCapabilities();
+    if (!caps.has_tts) {
+      return res.status(503).json({
+        error: "tts_unavailable",
+        message: "Text-to-speech isn't available on this relay right now.",
+      });
+    }
+    const id = req.params.id;
+    const index = parseInt(req.params.index, 10);
+    const session = await loadSession(scope, id);
+    if (!session) return res.status(404).json({ error: "session_not_found" });
+    const chunks = Array.isArray(session.chunks) ? session.chunks : [];
+    if (!Number.isInteger(index) || index < 0 || index >= chunks.length) {
+      return res.status(400).json({ error: "bad_index" });
+    }
+    let provider;
+    try {
+      provider = getProvider("relay", resolveProviderOpts("relay", { req }));
+    } catch (err) {
+      return res.status(503).json({
+        error: "relay_unavailable",
+        message: err?.message || "Relay is not configured.",
+      });
+    }
+    const voice =
+      typeof req.query.voice === "string" && req.query.voice.trim()
+        ? req.query.voice.trim()
+        : undefined;
+    const result = await generateClip({
+      scope,
+      id,
+      index,
+      chunk: chunks[index],
+      provider,
+      jobId: `tts:${id}`, // one credit for the whole recap
+      voice,
+    });
+    if (result.ok) {
+      patchSession(scope, id, {
+        summaryAudio: {
+          ready: true,
+          total: chunks.length,
+          voice: result.voice || caps.tts_default_voice || null,
+          format: CLIP_FORMAT,
+          updatedAt: new Date().toISOString(),
+        },
+      }).catch(() => {});
+      return res.json({ ok: true, index, cached: !!result.cached, voice: result.voice || null });
+    }
+    if (result.empty) {
+      return res.json({ ok: false, index, empty: true, error: "empty_summary" });
+    }
+    return res.status(502).json({ ok: false, index, error: result.error || "tts_failed" });
+  });
+
+  // Which topics are already synthesized for a recap.
+  app.get("/api/tts/status/:id", async (req, res) => {
+    const scope = resolveScope(req, res);
+    if (!scope) return;
+    const session = await loadSession(scope, req.params.id);
+    if (!session) return res.status(404).json({ error: "session_not_found" });
+    const total = Array.isArray(session.chunks) ? session.chunks.length : 0;
+    const dir = sessionAudioDir(scope, req.params.id);
+    let files = [];
+    try {
+      files = await fs.readdir(dir);
+    } catch {}
+    const ready = files
+      .map((f) => {
+        const m = new RegExp(`^topic-(\\d+)\\.${CLIP_EXT}$`).exec(f);
+        return m ? Number(m[1]) : null;
+      })
+      .filter((n) => n !== null)
+      .sort((a, b) => a - b);
+    const caps = getRelayCapabilities();
+    res.json({
+      total,
+      ready,
+      done: total > 0 && ready.length >= total,
+      allowed: userHasTtsAccess(req) && !!caps.has_tts,
+      voice: session.summaryAudio?.voice || caps.tts_default_voice || null,
+    });
+  });
+
+  // Serve one cached topic clip. sendFile handles Range requests (so the
+  // <audio> element can seek) and 404s cleanly when the clip isn't ready.
+  app.get("/api/tts/audio/:id/:index", async (req, res) => {
+    const scope = resolveScope(req, res);
+    if (!scope) return;
+    const idx = parseInt(req.params.index, 10);
+    if (!Number.isInteger(idx) || idx < 0) {
+      return res.status(400).json({ error: "bad_index" });
+    }
+    const file = path.join(sessionAudioDir(scope, req.params.id), clipFileName(idx));
+    res.sendFile(
+      file,
+      {
+        headers: {
+          "Content-Type": "audio/mpeg",
+          // Content is immutable for a given (session, topic) — safe to
+          // cache hard, which also primes the Phase 4 offline service worker.
+          "Cache-Control": "private, max-age=31536000, immutable",
+        },
+      },
+      (err) => {
+        if (err && !res.headersSent) {
+          res.status(404).json({ error: "clip_not_ready" });
+        }
+      }
+    );
+  });
+}
diff --git a/server/url-resolver.js b/server/url-resolver.js
new file mode 100644
index 0000000..7ae3d0a
--- /dev/null
+++ b/server/url-resolver.js
@@ -0,0 +1,475 @@
+// Resolves "share URLs" from Apple Podcasts and Spotify into something
+// Recap's existing podcast pipeline can swallow. Most users share these
+// links rather than the underlying RSS feed (which they rarely know
+// exists), so transparent resolution turns the most common podcast
+// share path into "paste link, hit summarize, done".
+//
+// Apple Podcasts URLs resolve directly via the public iTunes Lookup API:
+// the episode result includes `episodeUrl` (the audio enclosure) and
+// the show's `feedUrl`. No API key required, no auth.
+//
+// Spotify URLs are harder: Spotify-hosted audio is DRM-wrapped and not
+// served via a public stream URL. We use the unauthenticated oEmbed
+// endpoint to get the episode + show titles, then ask PodcastIndex to
+// find the same episode in its RSS-indexed catalog. Spotify Originals
+// (Joe Rogan, Anchor exclusives, …) have no RSS counterpart and fail
+// the lookup — we surface a clear error in that case so the user
+// understands and can paste the RSS link manually.
+//
+// Returns a normalized shape that maps cleanly onto Recap's existing
+// podcast pipeline:
+//   {
+//     source:        "apple" | "spotify",
+//     audioUrl:      string,   // direct audio URL (.mp3/.m4a) — feeds the existing podcast path
+//     episodeId:     string,   // stable GUID used by history dedup
+//     title:         string,
+//     podcastTitle:  string,
+//     uploadDate:    string,   // "YYYYMMDD"
+//     durationSec:   number?,  // null when unknown
+//     feedUrl:       string?,  // for context; not required downstream
+//   }
+//
+// Throws `URLResolveError` with a `.code` field for things the UI may
+// want to format specifically:
+//   - "spotify_no_rss"     → episode is Spotify-exclusive
+//   - "episode_not_found"  → looked up but couldn't match
+//   - "apple_lookup_failed"
+//   - "podcastindex_unconfigured"
+//   - "podcastindex_not_implemented" → caller didn't pass keys
+
+import crypto from "crypto";
+import { fetchUrl } from "./util.js";
+
+export class URLResolveError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "URLResolveError";
+    this.code = code;
+  }
+}
+
+const APPLE_EPISODE_URL_RE =
+  /^https?:\/\/(?:www\.)?podcasts\.apple\.com\/[^/]+\/podcast\/[^/]+\/id(\d+)(?:\?|.*[?&])i=(\d+)/i;
+
+// Detection only — no I/O.
+export function isApplePodcastUrl(url) {
+  if (!url) return false;
+  return /^https?:\/\/(?:www\.)?podcasts\.apple\.com\//i.test(url);
+}
+
+export function isSpotifyUrl(url) {
+  if (!url) return false;
+  return /^https?:\/\/(?:open|play)\.spotify\.com\/(?:episode|show)\//i.test(url);
+}
+
+// Fountain (https://fountain.fm) is a Bitcoin-Lightning podcast app
+// that hosts a Podcasting 2.0-native catalog. Episode pages are at
+// /episode/<short-id>; the underlying media is served from
+// feeds.fountain.fm and exposed via standard Open Graph tags
+// (og:audio, og:image, og:title) on the public episode HTML — no API
+// key required to resolve. Show pages (/show/<id>) aren't supported
+// for now; users should paste a specific episode link.
+export function isFountainUrl(url) {
+  if (!url) return false;
+  return /^https?:\/\/(?:www\.)?fountain\.fm\/episode\//i.test(url);
+}
+
+// True if the URL is one of the "share link" forms we know how to turn
+// into a podcast audio URL. Callers should only invoke the network-
+// touching resolvers when this returns true.
+export function isResolvableShareUrl(url) {
+  return isApplePodcastUrl(url) || isSpotifyUrl(url) || isFountainUrl(url);
+}
+
+// ── Apple Podcasts ─────────────────────────────────────────────────────
+// Strategy: parse the podcast ID + episode track ID out of the URL,
+// hit iTunes Lookup, find the matching episode by trackId. Apple
+// returns the episode's actual audio enclosure URL — same URL the
+// Apple Podcasts app streams from — so the existing podcast download
+// pipeline (audio.downloadPodcastAudio) can swallow it unchanged.
+export async function resolveApplePodcastUrl(url) {
+  const m = url.match(APPLE_EPISODE_URL_RE);
+  if (!m) {
+    throw new URLResolveError(
+      "apple_lookup_failed",
+      "Apple Podcasts URL is missing podcast ID or episode ID (?i= param)"
+    );
+  }
+  const podcastId = m[1];
+  const episodeTrackId = m[2];
+
+  // The lookup endpoint returns the show metadata as result[0] and the
+  // most-recent N episodes as result[1..]. Apple silently caps at 200
+  // even if you ask for more.
+  const lookupUrl = `https://itunes.apple.com/lookup?id=${encodeURIComponent(
+    podcastId
+  )}&entity=podcastEpisode&limit=200`;
+  let parsed;
+  try {
+    const raw = await fetchUrl(lookupUrl);
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new URLResolveError(
+      "apple_lookup_failed",
+      `iTunes lookup failed: ${err?.message || err}`
+    );
+  }
+  const results = Array.isArray(parsed?.results) ? parsed.results : [];
+  const show = results.find((r) => r.wrapperType === "track" || r.kind === "podcast") || {};
+  const episode = results.find(
+    (r) =>
+      r.wrapperType === "podcastEpisode" &&
+      String(r.trackId) === String(episodeTrackId)
+  );
+  if (!episode || !episode.episodeUrl) {
+    throw new URLResolveError(
+      "episode_not_found",
+      `Apple returned ${results.length} results for podcast ${podcastId} but episode ${episodeTrackId} was not among them. The episode may be older than Apple's 200-episode lookup cap.`
+    );
+  }
+
+  // releaseDate is ISO 8601; collapse to YYYYMMDD to match the rest of
+  // the pipeline's date convention.
+  let uploadDate = "";
+  if (episode.releaseDate) {
+    try {
+      const d = new Date(episode.releaseDate);
+      if (!isNaN(d.getTime())) {
+        uploadDate = d.toISOString().slice(0, 10).replace(/-/g, "");
+      }
+    } catch {}
+  }
+
+  const durationSec =
+    typeof episode.trackTimeMillis === "number"
+      ? Math.round(episode.trackTimeMillis / 1000)
+      : null;
+
+  return {
+    source: "apple",
+    audioUrl: episode.episodeUrl,
+    episodeId: episode.episodeGuid || `apple-${episodeTrackId}`,
+    title: episode.trackName || show.collectionName || "Untitled episode",
+    podcastTitle: show.collectionName || episode.collectionName || "Unknown podcast",
+    uploadDate,
+    durationSec,
+    feedUrl: show.feedUrl || null,
+  };
+}
+
+// ── Spotify ────────────────────────────────────────────────────────────
+// Strategy: oEmbed for title/show, then PodcastIndex search to map
+// title+show → RSS feed → episode → audio enclosure. Spotify-exclusive
+// content has no RSS counterpart and fails the lookup with a clear
+// `spotify_no_rss` error.
+//
+// PodcastIndex auth (https://podcastindex.org/api/dev) requires:
+//   - `User-Agent` header (PodcastIndex blocks anonymous UAs)
+//   - `X-Auth-Key`: API key (free, signup at api.podcastindex.org)
+//   - `X-Auth-Date`: unix timestamp (current time)
+//   - `Authorization`: sha1(apiKey + apiSecret + apiDate)
+export async function resolveSpotifyUrl(url, { podcastIndexKey, podcastIndexSecret } = {}) {
+  if (!podcastIndexKey || !podcastIndexSecret) {
+    throw new URLResolveError(
+      "podcastindex_unconfigured",
+      'Spotify needs both a free PodcastIndex API Key AND API Secret. Sign up at api.podcastindex.org — your account page shows both credentials side-by-side. Paste them in Recaps → Settings → API Keys → PodcastIndex. (Apple Podcasts and Fountain links work without any API key — try those for the same episode if it\'s also distributed there.)'
+    );
+  }
+
+  // oEmbed gives us episode title + show name with no auth.
+  let episodeTitle = "";
+  let showName = "";
+  try {
+    const oemRaw = await fetchUrl(
+      `https://open.spotify.com/oembed?url=${encodeURIComponent(url)}`
+    );
+    const oem = JSON.parse(oemRaw);
+    episodeTitle = (oem?.title || "").trim();
+    // oEmbed's "title" includes the show name in some Spotify variants
+    // (e.g. "<episode> · <show>"). Split if we see the delimiter.
+    const sep = episodeTitle.lastIndexOf(" · ");
+    if (sep > 0) {
+      showName = episodeTitle.slice(sep + 3).trim();
+      episodeTitle = episodeTitle.slice(0, sep).trim();
+    }
+  } catch (err) {
+    throw new URLResolveError(
+      "episode_not_found",
+      `Could not fetch Spotify episode metadata: ${err?.message || err}`
+    );
+  }
+  if (!episodeTitle) {
+    throw new URLResolveError(
+      "episode_not_found",
+      "Spotify oEmbed returned no episode title"
+    );
+  }
+
+  // Authoritative PodcastIndex search uses byperson/bypath/byterm. The
+  // episode-search endpoint accepts a free-text query and returns
+  // candidate episodes across the index.
+  const q = encodeURIComponent(
+    showName ? `${episodeTitle} ${showName}` : episodeTitle
+  );
+  const searchUrl = `https://api.podcastindex.org/api/1.0/search/byterm?q=${q}&max=5`;
+
+  let candidate = null;
+  try {
+    const headers = buildPodcastIndexHeaders({ podcastIndexKey, podcastIndexSecret });
+    const r = await fetch(searchUrl, { headers });
+    const data = await r.json();
+    const feeds = Array.isArray(data?.feeds) ? data.feeds : [];
+    // Best-match heuristic: prefer a feed whose title fuzzy-matches the
+    // show name, fall back to the first result.
+    const norm = (s) => (s || "").toLowerCase().replace(/[^a-z0-9]/g, "");
+    const showKey = norm(showName);
+    candidate =
+      (showKey && feeds.find((f) => norm(f.title).includes(showKey))) ||
+      feeds[0] ||
+      null;
+  } catch (err) {
+    throw new URLResolveError(
+      "episode_not_found",
+      `PodcastIndex feed search failed: ${err?.message || err}`
+    );
+  }
+  if (!candidate || !candidate.id) {
+    throw new URLResolveError(
+      "spotify_no_rss",
+      `This Spotify episode "${episodeTitle}" doesn't appear in PodcastIndex. It may be a Spotify exclusive (Spotify Originals, Anchor-only shows). Paste the show's RSS feed URL instead, or use the YouTube version if available.`
+    );
+  }
+
+  // Pull the episode list for the matched feed and find the closest
+  // title match.
+  let episodes = [];
+  try {
+    const headers = buildPodcastIndexHeaders({ podcastIndexKey, podcastIndexSecret });
+    const r = await fetch(
+      `https://api.podcastindex.org/api/1.0/episodes/byfeedid?id=${candidate.id}&max=200`,
+      { headers }
+    );
+    const data = await r.json();
+    episodes = Array.isArray(data?.items) ? data.items : [];
+  } catch (err) {
+    throw new URLResolveError(
+      "episode_not_found",
+      `PodcastIndex episode lookup failed: ${err?.message || err}`
+    );
+  }
+  const norm = (s) => (s || "").toLowerCase().replace(/[^a-z0-9]/g, "");
+  const targetKey = norm(episodeTitle);
+  const episode =
+    episodes.find((e) => norm(e.title) === targetKey) ||
+    episodes.find((e) => norm(e.title).includes(targetKey)) ||
+    episodes.find((e) => targetKey.includes(norm(e.title))) ||
+    null;
+  if (!episode || !episode.enclosureUrl) {
+    throw new URLResolveError(
+      "episode_not_found",
+      `Matched "${candidate.title}" in PodcastIndex but couldn't find an episode titled "${episodeTitle}". Episode may be too new for PodcastIndex's snapshot, or only available on Spotify.`
+    );
+  }
+
+  let uploadDate = "";
+  if (episode.datePublished) {
+    try {
+      const d = new Date(episode.datePublished * 1000);
+      if (!isNaN(d.getTime())) {
+        uploadDate = d.toISOString().slice(0, 10).replace(/-/g, "");
+      }
+    } catch {}
+  }
+
+  return {
+    source: "spotify",
+    audioUrl: episode.enclosureUrl,
+    episodeId: episode.guid || `spotify-${episode.id}`,
+    title: episode.title || episodeTitle,
+    podcastTitle: candidate.title || showName || "Unknown podcast",
+    uploadDate,
+    durationSec:
+      typeof episode.duration === "number" ? episode.duration : null,
+    feedUrl: candidate.url || null,
+  };
+}
+
+// ── Fountain ───────────────────────────────────────────────────────────
+// Strategy: fetch the episode HTML, parse Open Graph + JSON-LD tags
+// for the audio URL, title, podcast name, and upload date. Fountain
+// serves the actual MP3 enclosure URL on og:audio so we don't need
+// any PodcastIndex lookup or API key. Same shape as the Apple
+// resolver returns so the downstream podcast pipeline doesn't have
+// to branch.
+//
+// The og:title format is "Show • Episode title • Watch on Fountain".
+// We split on " • " to separate show + episode; the trailing "Watch
+// on Fountain" branding gets dropped.
+//
+// Fountain URLs encode the episode in a short opaque id at the URL
+// path; we use that as our episodeId for history dedup.
+export async function resolveFountainUrl(url) {
+  const m = url.match(/\/episode\/([A-Za-z0-9_-]+)/);
+  if (!m) {
+    throw new URLResolveError(
+      "fountain_lookup_failed",
+      "Fountain URL is missing the /episode/<id> path",
+    );
+  }
+  const shortId = m[1];
+
+  // Use global fetch directly (Node 18+) so we can send a UA header.
+  // fetchUrl() in util.js doesn't take options; we don't want to
+  // expand its signature just for this one caller. Fountain's SSR
+  // response includes the og:audio tag we need for ANY UA, but mimic
+  // a modern Safari to stay on the well-tested response path.
+  let html;
+  try {
+    const res = await fetch(url, {
+      headers: {
+        "User-Agent":
+          "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15",
+      },
+      // Aggressive timeout — Fountain's page is small (~120KB) and
+      // we shouldn't hold up the summarize pipeline if their server
+      // hangs. AbortSignal.timeout is Node 18+, same baseline.
+      signal: AbortSignal.timeout(8000),
+    });
+    if (!res.ok) {
+      throw new URLResolveError(
+        "fountain_lookup_failed",
+        `Fountain returned HTTP ${res.status}`,
+      );
+    }
+    html = await res.text();
+  } catch (err) {
+    if (err instanceof URLResolveError) throw err;
+    throw new URLResolveError(
+      "fountain_lookup_failed",
+      `Couldn't reach Fountain: ${err?.message || err}`,
+    );
+  }
+  if (!html || typeof html !== "string") {
+    throw new URLResolveError(
+      "fountain_lookup_failed",
+      "Empty response from Fountain",
+    );
+  }
+
+  // Extract a meta tag's content by either property= or name=.
+  // Fountain uses property= for OG and name= for Twitter — we match
+  // both since users might paste links Twitter has re-fetched.
+  function metaContent(key) {
+    const re = new RegExp(
+      `<meta\\s+(?:property|name)="${key}"\\s+content="([^"]+)"`,
+      "i",
+    );
+    const found = html.match(re);
+    return found ? decodeHtmlEntities(found[1]) : null;
+  }
+
+  const audioUrl = metaContent("og:audio");
+  if (!audioUrl) {
+    throw new URLResolveError(
+      "fountain_lookup_failed",
+      "Fountain episode has no og:audio tag — the page may have changed format or the episode is video-only.",
+    );
+  }
+
+  const ogTitleRaw = metaContent("og:title") || "";
+  // og:title format: "Show • Episode • Watch on Fountain". Strip the
+  // trailing brand and split.
+  const titlePieces = ogTitleRaw
+    .replace(/\s*•\s*Watch on Fountain\s*$/i, "")
+    .split(/\s*•\s*/);
+  const podcastTitle = titlePieces[0] || "Podcast";
+  const episodeTitle = titlePieces.slice(1).join(" • ") || podcastTitle;
+
+  // JSON-LD on the page carries an ISO uploadDate. We don't parse
+  // the full JSON; a targeted regex is enough.
+  const uploadDateMatch = html.match(/"uploadDate":"([^"]+)"/);
+  const uploadDateRaw = uploadDateMatch ? uploadDateMatch[1] : "";
+  const uploadDate = isoToYYYYMMDD(uploadDateRaw);
+
+  // ISO-8601 duration (e.g. "PT2H7M27S") → seconds. Optional —
+  // returns null if absent.
+  const durationMatch = html.match(/"duration":"(PT[0-9HMS]+)"/);
+  const durationSec = durationMatch
+    ? iso8601DurationToSeconds(durationMatch[1])
+    : null;
+
+  return {
+    source: "fountain",
+    audioUrl,
+    episodeId: `fountain:${shortId}`,
+    title: episodeTitle,
+    podcastTitle,
+    uploadDate,
+    durationSec,
+    feedUrl: null, // Fountain doesn't always expose the source RSS URL
+  };
+}
+
+// "2026-05-07T20:53:13.003Z" → "20260507". Returns empty string on
+// unparseable input so the downstream pipeline treats it as unknown.
+function isoToYYYYMMDD(iso) {
+  if (!iso) return "";
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return "";
+  const y = d.getUTCFullYear();
+  const m = String(d.getUTCMonth() + 1).padStart(2, "0");
+  const day = String(d.getUTCDate()).padStart(2, "0");
+  return `${y}${m}${day}`;
+}
+
+// "PT2H7M27S" → 7647 seconds. Handles the subset of ISO-8601 that
+// podcasts actually use (no fractional, no days).
+function iso8601DurationToSeconds(s) {
+  if (typeof s !== "string") return null;
+  const m = s.match(/^PT(?:(\d+)H)?(?:(\d+)M)?(?:(\d+)S)?$/);
+  if (!m) return null;
+  const h = parseInt(m[1] || "0", 10);
+  const min = parseInt(m[2] || "0", 10);
+  const sec = parseInt(m[3] || "0", 10);
+  return h * 3600 + min * 60 + sec;
+}
+
+function decodeHtmlEntities(s) {
+  return String(s)
+    .replace(/&amp;/g, "&")
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'");
+}
+
+function buildPodcastIndexHeaders({ podcastIndexKey, podcastIndexSecret }) {
+  const date = Math.floor(Date.now() / 1000).toString();
+  const sig = crypto
+    .createHash("sha1")
+    .update(podcastIndexKey + podcastIndexSecret + date)
+    .digest("hex");
+  return {
+    "User-Agent": "Recap/1.0 (+https://github.com/keysat-xyz/recap)",
+    "X-Auth-Key": podcastIndexKey,
+    "X-Auth-Date": date,
+    Authorization: sig,
+  };
+}
+
+// Single entry point: takes any URL and a config object, returns
+// either the normalized resolved shape (for apple/spotify) or null
+// (for URLs we don't recognize as share links — caller passes those
+// through to the existing youtube / rss path unchanged).
+export async function resolveShareUrl(url, opts = {}) {
+  if (isApplePodcastUrl(url)) {
+    return resolveApplePodcastUrl(url);
+  }
+  if (isSpotifyUrl(url)) {
+    return resolveSpotifyUrl(url, opts);
+  }
+  if (isFountainUrl(url)) {
+    return resolveFountainUrl(url);
+  }
+  return null;
+}
diff --git a/startos/actions/enableMultiTenantMode.ts b/startos/actions/enableMultiTenantMode.ts
new file mode 100644
index 0000000..0c89516
--- /dev/null
+++ b/startos/actions/enableMultiTenantMode.ts
@@ -0,0 +1,64 @@
+import { sdk } from '../sdk'
+import { configFile } from '../file-models/config.json'
+
+const { InputSpec, Value } = sdk
+
+// Multi-tenant mode (a.k.a. cloud mode) turns the self-hosted Recaps
+// into a multi-user app served over the web. Adds email + magic-link
+// auth, per-user libraries, per-user keysat licenses, and BTCPay-based
+// subscriptions. The .s9pk defaults to single-mode (one operator, no
+// auth) so installing Recaps doesn't surprise anyone — multi is the
+// deliberate opt-in for operators who want to host the app for others.
+//
+// Prerequisites before enabling:
+//   1. StartOS System SMTP must be configured + tested. Magic-link
+//      emails fail otherwise.
+//   2. "Set Recaps public URL" action must be run with the ClearNet URL
+//      where your Recaps will live (e.g. https://recap.example.com),
+//      so the sign-in emails contain a working link.
+//   3. A keysat issuer the relay trusts must be reachable, since each
+//      cloud user gets a keysat-minted license at signup.
+//
+// Switching back to single mode is non-destructive — multi-tenant data
+// (the user DB at /data/recap.db) stays on disk and is restored if you
+// flip back to multi later. The operator-owner's library lives under
+// /data/history/owner/ in either mode.
+const inputSpec = InputSpec.of({
+  mode: Value.select({
+    name: 'Mode',
+    description:
+      'Single = original self-hosted experience (one operator, no auth). Multi = cloud mode (email/magic-link auth, multi-user, BTCPay subscriptions). Switching takes effect on next service restart.',
+    default: 'single',
+    values: {
+      single: 'Single (self-hosted, no accounts)',
+      multi: 'Multi (cloud, email auth + subscriptions)',
+    },
+  }),
+})
+
+export const enableMultiTenantMode = sdk.Action.withInput(
+  'enable-multi-tenant-mode',
+
+  async ({ effects }) => ({
+    name: 'Enable Multi-Tenant Mode',
+    description:
+      'Switch Recaps between single-user (self-hosted) and multi-tenant (cloud) modes. Multi mode adds email-based sign-in, per-user libraries, and BTCPay subscriptions. Configure SMTP and the public URL before enabling.',
+    warning:
+      'Switching to multi mode requires StartOS SMTP to be configured and the Recaps public URL set. The service restarts on save.',
+    allowedStatuses: 'any',
+    group: 'Multi-Tenant',
+    visibility: 'enabled',
+  }),
+
+  inputSpec,
+
+  async ({ effects }) => {
+    const config = await configFile.read().once()
+    return { mode: (config?.recap_mode as 'single' | 'multi') || 'single' }
+  },
+
+  async ({ effects, input }) => {
+    await configFile.merge(effects, { recap_mode: input.mode })
+    return null
+  },
+)
diff --git a/startos/actions/index.ts b/startos/actions/index.ts
index 2e1fbab..89ee769 100644
--- a/startos/actions/index.ts
+++ b/startos/actions/index.ts
@@ -7,10 +7,22 @@ import { setOpenAIApiKey } from './setOpenAIApiKey'
 import { setOpenAICompatible } from './setOpenAICompatible'
 import { setOllamaUrl } from './setOllamaUrl'
 import { setWhisperEndpoint } from './setWhisperEndpoint'
+import { setPodcastIndex } from './setPodcastIndex'
+import { enableMultiTenantMode } from './enableMultiTenantMode'
+import { setRecapPublicUrl } from './setRecapPublicUrl'
+import { setTenantDefaultCredits } from './setTenantDefaultCredits'
+import { setTrialCreditsPerVisitor } from './setTrialCreditsPerVisitor'
+import { setTrialsPerIpPerDay } from './setTrialsPerIpPerDay'
+import { setReplenishPeriod } from './setReplenishPeriod'
+import { setRelayOperatorKey } from './setRelayOperatorKey'
 
 // NOTE: setRelayUrl was removed in 0.2.34. The relay base URL is now
 // hardcoded in server/relay-default.js and updated via Recap version
 // releases — end users should never see or configure it.
+//
+// Multi-tenant cloud-mode actions (added 0.2.77) — these only matter
+// when recap_mode === 'multi'. In single mode they're inert: the
+// fields they manipulate exist in the config but nothing reads them.
 export const actions = sdk.Actions.of()
   .addAction(setApiKey)
   .addAction(setAnthropicApiKey)
@@ -18,5 +30,13 @@ export const actions = sdk.Actions.of()
   .addAction(setOpenAICompatible)
   .addAction(setOllamaUrl)
   .addAction(setWhisperEndpoint)
+  .addAction(setPodcastIndex)
   .addAction(setLicense)
   .addAction(setAdminPassword)
+  .addAction(enableMultiTenantMode)
+  .addAction(setRecapPublicUrl)
+  .addAction(setTenantDefaultCredits)
+  .addAction(setTrialCreditsPerVisitor)
+  .addAction(setTrialsPerIpPerDay)
+  .addAction(setReplenishPeriod)
+  .addAction(setRelayOperatorKey)
diff --git a/startos/actions/setAdminPassword.ts b/startos/actions/setAdminPassword.ts
index be068a6..ce1f451 100644
--- a/startos/actions/setAdminPassword.ts
+++ b/startos/actions/setAdminPassword.ts
@@ -43,7 +43,7 @@ export const setAdminPassword = sdk.Action.withInput(
   async ({ effects }) => ({
     name: 'Set Admin Password',
     description:
-      'Set a username and password that gate the Recap web UI. Anyone visiting the site (LAN or clearnet) must log in before reaching the activation screen. Leave the password blank to disable the gate.',
+      'Set a username and password that gate the Recaps web UI. Anyone visiting the site (LAN or clearnet) must log in before reaching the activation screen. Leave the password blank to disable the gate.',
     warning: null,
     allowedStatuses: 'any',
     group: 'Setup',
diff --git a/startos/actions/setLicense.ts b/startos/actions/setLicense.ts
index ca3d9e0..af783b7 100644
--- a/startos/actions/setLicense.ts
+++ b/startos/actions/setLicense.ts
@@ -5,9 +5,9 @@ const { InputSpec, Value } = sdk
 
 const inputSpec = InputSpec.of({
   recap_license_key: Value.text({
-    name: 'Recap License Key',
+    name: 'Recaps License Key',
     description:
-      'Paste your Recap license key here. Keys start with "LIC1-..." — get one from your Recap seller. (Keys are also accepted via the web UI activation screen.)',
+      'Paste your Recaps license key here. Keys start with "LIC1-..." — get one from your Recaps seller. (Keys are also accepted via the web UI activation screen.)',
     required: true,
     default: null,
     masked: true,
@@ -26,9 +26,9 @@ export const setLicense = sdk.Action.withInput(
   'set-license',
 
   async ({ effects }) => ({
-    name: 'Set Recap License',
+    name: 'Set Recaps License',
     description:
-      'Activate a Recap license to unlock paid features (channel & podcast subscriptions, auto-queue, and a monthly allotment of relay credits).',
+      'Activate a Recaps license to unlock paid features (channel & podcast subscriptions, auto-queue, and a monthly allotment of relay credits).',
     warning: null,
     allowedStatuses: 'any',
     group: 'Setup',
diff --git a/startos/actions/setOpenAICompatible.ts b/startos/actions/setOpenAICompatible.ts
index 2c7a0c6..386d5d1 100644
--- a/startos/actions/setOpenAICompatible.ts
+++ b/startos/actions/setOpenAICompatible.ts
@@ -37,7 +37,7 @@ export const setOpenAICompatible = sdk.Action.withInput(
   async ({ effects }) => ({
     name: 'Set OpenAI-Compatible Backend',
     description:
-      'Point Recap at any OpenAI-compatible chat-completions API: DeepSeek, Together, Groq, Fireworks, self-hosted vLLM, etc. Used for topic analysis only — does not transcribe audio.',
+      'Point Recaps at any OpenAI-compatible chat-completions API: DeepSeek, Together, Groq, Fireworks, self-hosted vLLM, etc. Used for topic analysis only — does not transcribe audio.',
     warning: null,
     allowedStatuses: 'any',
     group: 'AI Providers',
diff --git a/startos/actions/setPodcastIndex.ts b/startos/actions/setPodcastIndex.ts
new file mode 100644
index 0000000..7cdd6bd
--- /dev/null
+++ b/startos/actions/setPodcastIndex.ts
@@ -0,0 +1,59 @@
+import { sdk } from '../sdk'
+import { configFile } from '../file-models/config.json'
+
+const { InputSpec, Value } = sdk
+
+const inputSpec = InputSpec.of({
+  podcastindex_api_key: Value.text({
+    name: 'PodcastIndex API Key',
+    description:
+      'First of the two credentials shown on your PodcastIndex account page after free signup at api.podcastindex.org. Both Key AND Secret are required for Spotify link resolution — paste the SECRET in the field below. Apple Podcasts and Fountain links work without any PodcastIndex auth.',
+    required: false,
+    default: null,
+    masked: true,
+    minLength: 0,
+    maxLength: 256,
+  }),
+  podcastindex_api_secret: Value.text({
+    name: 'PodcastIndex API Secret',
+    description:
+      'Second of the two credentials shown on your PodcastIndex account page (right next to the API Key — sometimes labeled "API Secret" or "auth secret"). REQUIRED alongside the API Key for the Spotify lookup to work — leaving this blank is the most common reason Spotify URLs fail with "PodcastIndex unconfigured."',
+    required: false,
+    default: null,
+    masked: true,
+    minLength: 0,
+    maxLength: 256,
+  }),
+})
+
+export const setPodcastIndex = sdk.Action.withInput(
+  'set-podcastindex',
+
+  async ({ effects }) => ({
+    name: 'Set PodcastIndex Credentials',
+    description:
+      'Configure PodcastIndex API credentials so Recaps can resolve Spotify episode links. Optional — Apple Podcasts links work without this. Sign up free at api.podcastindex.org.',
+    warning: null,
+    allowedStatuses: 'any',
+    group: 'External Services',
+    visibility: 'enabled',
+  }),
+
+  inputSpec,
+
+  async ({ effects }) => {
+    const config = await configFile.read().once()
+    return {
+      podcastindex_api_key: config?.podcastindex_api_key || undefined,
+      podcastindex_api_secret: config?.podcastindex_api_secret || undefined,
+    }
+  },
+
+  async ({ effects, input }) => {
+    await configFile.merge(effects, {
+      podcastindex_api_key: input.podcastindex_api_key || '',
+      podcastindex_api_secret: input.podcastindex_api_secret || '',
+    })
+    return null
+  },
+)
diff --git a/startos/actions/setRecapPublicUrl.ts b/startos/actions/setRecapPublicUrl.ts
new file mode 100644
index 0000000..799ddf8
--- /dev/null
+++ b/startos/actions/setRecapPublicUrl.ts
@@ -0,0 +1,59 @@
+import { sdk } from '../sdk'
+import { configFile } from '../file-models/config.json'
+
+const { InputSpec, Value } = sdk
+
+// The Recaps public URL is the ClearNet URL where users access the app
+// — typically a domain you've pointed at Start Tunnel. Magic-link
+// sign-in emails interpolate this URL into the verification link:
+//
+//   Click here to sign in: https://recap.example.com/auth/verify?token=...
+//
+// Without this set, magic-link emails contain a link to localhost or
+// to the StartOS internal hostname, neither of which work for a user
+// reading the email on a different device.
+//
+// Only meaningful when recap_mode === 'multi'. In single mode the
+// value is ignored — there's no magic-link flow.
+const inputSpec = InputSpec.of({
+  public_url: Value.text({
+    name: 'Public URL',
+    description:
+      'Full URL where users reach your Recaps (e.g. https://recapapp.xyz). Include the https:// prefix. Used to build sign-in links in magic-link emails. Must be reachable from the public internet for users to receive a working link.',
+    required: true,
+    default: null,
+    placeholder: 'https://recapapp.xyz',
+    masked: false,
+    minLength: 8,
+    maxLength: 256,
+  }),
+})
+
+export const setRecapPublicUrl = sdk.Action.withInput(
+  'set-recap-public-url',
+
+  async ({ effects }) => ({
+    name: 'Set Recaps Public URL',
+    description:
+      'Set the ClearNet URL where users will access your Recaps. Used in magic-link sign-in emails. Required for multi-tenant mode.',
+    warning: null,
+    allowedStatuses: 'any',
+    group: 'Multi-Tenant',
+    visibility: 'enabled',
+  }),
+
+  inputSpec,
+
+  async ({ effects }) => {
+    const config = await configFile.read().once()
+    return { public_url: config?.recap_public_url || undefined }
+  },
+
+  async ({ effects, input }) => {
+    // Strip trailing slash for canonical form — the auth-link builder
+    // concatenates "/auth/verify?token=..." without checking.
+    const url = (input.public_url || '').trim().replace(/\/$/, '')
+    await configFile.merge(effects, { recap_public_url: url })
+    return null
+  },
+)
diff --git a/startos/actions/setRelayOperatorKey.ts b/startos/actions/setRelayOperatorKey.ts
new file mode 100644
index 0000000..0431b7d
--- /dev/null
+++ b/startos/actions/setRelayOperatorKey.ts
@@ -0,0 +1,59 @@
+import { sdk } from '../sdk'
+import { configFile } from '../file-models/config.json'
+
+const { InputSpec, Value } = sdk
+
+// The "operator key" is the shared secret that authenticates THIS Recaps
+// server to the Recap Relay for the core-decoupling cloud path. With it
+// set, the server vouches for its signed-in Pro/Max users by their Recaps
+// account-id (X-Recap-User-Id) — the relay owns their subscription tier,
+// keyed by that id, with NO per-user Keysat license involved.
+//
+// It MUST exactly match the value set on the relay (its
+// relay_cloud_operator_key, via the relay's own "Set Cloud Operator Key"
+// action). If the two don't match, the relay rejects the cloud calls and
+// paid users silently fall back to the operator's shared relay pool.
+//
+// Only meaningful when recap_mode === 'multi' (the cloud deployment). In
+// single mode there are no per-user accounts to vouch for, so the value
+// is ignored.
+const inputSpec = InputSpec.of({
+  operator_key: Value.text({
+    name: 'Relay Operator Key',
+    description:
+      'Shared secret that authenticates this Recaps server to the Recap Relay. Must EXACTLY match the relay\'s "Cloud Operator Key". Generate a long random string (e.g. `openssl rand -hex 32`) and set the same value on both. Server-side only — never shown to users.',
+    required: true,
+    default: null,
+    placeholder: 'paste the same key set on the relay',
+    masked: true,
+    minLength: 16,
+    maxLength: 256,
+  }),
+})
+
+export const setRelayOperatorKey = sdk.Action.withInput(
+  'set-relay-operator-key',
+
+  async ({ effects }) => ({
+    name: 'Set Relay Operator Key',
+    description:
+      'Set the shared operator key that lets this Recaps server vouch for its Pro/Max users to the Recap Relay by account-id (core-decoupling). Must match the key set on the relay. Multi-tenant mode only.',
+    warning: null,
+    allowedStatuses: 'any',
+    group: 'Multi-Tenant',
+    visibility: 'enabled',
+  }),
+
+  inputSpec,
+
+  async ({ effects }) => {
+    const config = await configFile.read().once()
+    return { operator_key: config?.recap_relay_operator_key || undefined }
+  },
+
+  async ({ effects, input }) => {
+    const key = (input.operator_key || '').trim()
+    await configFile.merge(effects, { recap_relay_operator_key: key })
+    return null
+  },
+)
diff --git a/startos/actions/setReplenishPeriod.ts b/startos/actions/setReplenishPeriod.ts
new file mode 100644
index 0000000..a2c9f71
--- /dev/null
+++ b/startos/actions/setReplenishPeriod.ts
@@ -0,0 +1,73 @@
+import { sdk } from '../sdk'
+import { configFile } from '../file-models/config.json'
+
+const { InputSpec, Value } = sdk
+
+// How often to refresh tenants' replenishable credit bucket. The
+// bucket size itself is set via "Set Default Tenant Credits" — this
+// action just controls WHEN it gets refilled.
+//
+// Refresh semantics: replenish_balance is RESET to
+// tenant_default_credits at each anniversary boundary. Any leftover
+// from the previous period is forfeit (use-it-or-lose-it). Purchased
+// credits + admin grants live in a SEPARATE bucket
+// (tenant_credits.purchased_balance) that's never wiped by refills.
+//
+// Spend order is replenish first, then purchased — so a tenant
+// burns through the refillable bucket each period before touching
+// their permanent balance.
+//
+// Anniversary alignment: refills are anchored to each tenant's
+// individual last_replenish_at timestamp (set when they signed up,
+// or when the operator first switched this action on). A user who
+// signed up at 3:17pm gets their daily refresh at 3:17pm each day,
+// not at calendar midnight.
+const inputSpec = InputSpec.of({
+  period: Value.select({
+    name: 'Replenishment period',
+    description:
+      'How often each tenant\'s replenishable credit bucket gets refilled to the configured default. Set to "off" for a one-time signup grant (Grant\'s use case — tenants are paying customers and don\'t get free daily refills). Set to daily/weekly/monthly for a free-tier-with-daily-allowance model.',
+    default: 'off',
+    values: {
+      off: "Off (one-time signup grant only)",
+      daily: 'Daily (every 24 hours)',
+      weekly: 'Weekly (every 7 days)',
+      monthly: 'Monthly (calendar month)',
+    },
+  }),
+})
+
+export const setReplenishPeriod = sdk.Action.withInput(
+  'set-replenish-period',
+
+  async ({ effects }) => ({
+    name: 'Set Tenant Credit Replenishment',
+    description:
+      "How often a tenant's free credit bucket refills (uses Set Default Tenant Credits as the refill amount). Off = no replenishment; their initial signup grant is one-time. Daily/Weekly/Monthly = anniversary-aligned refill of the replenishable bucket. Purchased credits never expire.",
+    warning: null,
+    allowedStatuses: 'any',
+    group: 'Multi-Tenant',
+    visibility: 'enabled',
+  }),
+
+  inputSpec,
+
+  async ({ effects }) => {
+    const config = await configFile.read().once()
+    return {
+      period:
+        (config?.tenant_credit_replenish_period as
+          | 'off'
+          | 'daily'
+          | 'weekly'
+          | 'monthly') || 'off',
+    }
+  },
+
+  async ({ effects, input }) => {
+    await configFile.merge(effects, {
+      tenant_credit_replenish_period: input.period,
+    })
+    return null
+  },
+)
diff --git a/startos/actions/setTenantDefaultCredits.ts b/startos/actions/setTenantDefaultCredits.ts
new file mode 100644
index 0000000..7c7a616
--- /dev/null
+++ b/startos/actions/setTenantDefaultCredits.ts
@@ -0,0 +1,56 @@
+import { sdk } from '../sdk'
+import { configFile } from '../file-models/config.json'
+
+const { InputSpec, Value } = sdk
+
+// When a self-hosted Recaps is running in multi-tenant mode, the
+// operator can invite family members / guests to sign up on their
+// domain. New tenants start with this many credits drawn from the
+// operator's relay credit pool (i.e., the operator pays for them).
+//
+// Default 5 is generous enough to try, tight enough that running a
+// public sign-up doesn't immediately drain the operator. Set to 0 to
+// disable auto-allocation (operator must explicitly grant credits to
+// each tenant before they can summarize).
+//
+// Doesn't apply to Grant's canonical cloud Recaps — cloud users have
+// their own keysat licenses + relay-side credit pools, so the relay's
+// per-tier quotas handle their initial credit allowance directly.
+const inputSpec = InputSpec.of({
+  credits: Value.number({
+    name: 'Default credits per new tenant',
+    description:
+      'When a new user signs up on this multi-tenant Recaps, they start with this many credits. Charged against your relay credit pool when they summarize. Set to 0 to require manual approval before any tenant can summarize.',
+    required: true,
+    default: 5,
+    integer: true,
+    min: 0,
+    max: 1000,
+  }),
+})
+
+export const setTenantDefaultCredits = sdk.Action.withInput(
+  'set-tenant-default-credits',
+
+  async ({ effects }) => ({
+    name: 'Set Default Tenant Credits',
+    description:
+      "How many credits new sign-ups get for free on your multi-tenant Recaps. Charged against your relay credit pool. Default: 5.",
+    warning: null,
+    allowedStatuses: 'any',
+    group: 'Multi-Tenant',
+    visibility: 'enabled',
+  }),
+
+  inputSpec,
+
+  async ({ effects }) => {
+    const config = await configFile.read().once()
+    return { credits: config?.tenant_default_credits ?? 5 }
+  },
+
+  async ({ effects, input }) => {
+    await configFile.merge(effects, { tenant_default_credits: input.credits })
+    return null
+  },
+)
diff --git a/startos/actions/setTrialCreditsPerVisitor.ts b/startos/actions/setTrialCreditsPerVisitor.ts
new file mode 100644
index 0000000..20f4e21
--- /dev/null
+++ b/startos/actions/setTrialCreditsPerVisitor.ts
@@ -0,0 +1,60 @@
+import { sdk } from '../sdk'
+import { configFile } from '../file-models/config.json'
+
+const { InputSpec, Value } = sdk
+
+// Anonymous-trial allowance per first-time visitor. Multi-tenant mode
+// only. When a visitor lands on the public Recaps URL without a session
+// cookie and submits a YouTube URL, the server issues them a
+// recap_anon_trial cookie with this many free summaries — no email,
+// no signup, no friction. After they're spent, the UI nudges them to
+// create an account for more credits.
+//
+// Trial summaries draw from the OPERATOR's relay credit pool, so this
+// number times the visitor volume sets the floor on your sample-cost
+// exposure. Tune downward if you see abuse, upward if you want a more
+// generous activation funnel. Set to 0 to disable trials entirely
+// (visitors immediately hit the sign-up gate).
+//
+// Defaults to 1 — enough to demo the value prop, tight enough that
+// scripted-signup abuse doesn't drain the pool fast.
+const inputSpec = InputSpec.of({
+  credits: Value.number({
+    name: 'Trial credits per anonymous visitor',
+    description:
+      'How many free summaries an unauthenticated visitor gets before being asked to sign up. Charged against your relay credit pool. Set to 0 to disable trials (immediate sign-up gate).',
+    required: true,
+    default: 1,
+    integer: true,
+    min: 0,
+    max: 5,
+  }),
+})
+
+export const setTrialCreditsPerVisitor = sdk.Action.withInput(
+  'set-trial-credits-per-visitor',
+
+  async ({ effects }) => ({
+    name: 'Set Trial Credits per Visitor',
+    description:
+      "How many free summaries anonymous visitors get on your multi-tenant Recaps before being prompted to sign up. Default: 1. Charged against your relay credit pool.",
+    warning: null,
+    allowedStatuses: 'any',
+    group: 'Multi-Tenant',
+    visibility: 'enabled',
+  }),
+
+  inputSpec,
+
+  async ({ effects }) => {
+    const config = await configFile.read().once()
+    return { credits: config?.trial_credits_per_visitor ?? 1 }
+  },
+
+  async ({ effects, input }) => {
+    await configFile.merge(effects, {
+      trial_credits_per_visitor: input.credits,
+    })
+    return null
+  },
+)
diff --git a/startos/actions/setTrialsPerIpPerDay.ts b/startos/actions/setTrialsPerIpPerDay.ts
new file mode 100644
index 0000000..9783701
--- /dev/null
+++ b/startos/actions/setTrialsPerIpPerDay.ts
@@ -0,0 +1,79 @@
+import { sdk } from '../sdk'
+import { configFile } from '../file-models/config.json'
+
+const { InputSpec, Value } = sdk
+
+// Lifetime cap on how many distinct anonymous trial cookies one IP
+// address can mint, FOR THE LIFETIME OF THE INSTALL — not a rolling
+// daily window. Was previously per-day; switched in 0.2.84 so a user
+// who clears cookies can't simply wait 24h and replay the trial.
+//
+// Anti-abuse model:
+//   - Each minted cookie carries trial_credits_per_visitor credits
+//   - Each IP can mint at most `trials_per_ip_lifetime` cookies, ever
+//   - Combined effect: an IP's total free credits =
+//       trial_credits_per_visitor × trials_per_ip_lifetime
+//   - Once spent, the visitor must sign up (which grants
+//     tenant_default_credits) or pay for more
+//
+// IP rotation via VPN / proxy pool defeats this, same as before. The
+// goal isn't to be unbypassable — it's to raise the floor for casual
+// scripted abuse and give the operator forensic data (IP + UA logged
+// on every trial) to manually ban any sophisticated abuser.
+//
+// Defaults to 5 — generous enough that a family on one NAT all get
+// trials, tight enough that 50 trials/IP from one address looks like
+// scripted abuse in the admin dashboard.
+//
+// Legacy field name `trials_per_ip_per_day` is preserved on the
+// config schema as a read-only alias so installs upgrading from
+// 0.2.77–0.2.83 don't lose their existing setting.
+const inputSpec = InputSpec.of({
+  limit: Value.number({
+    name: 'Max trial cookies per IP (lifetime)',
+    description:
+      'How many anonymous trial cookies can be issued from a single IP, FOR THE LIFE OF THIS INSTALL. Not a rolling daily window — once the IP hits this cap, no more trial cookies from that address ever. Higher = friendlier to shared networks (offices, families). Lower = tighter against scripted abuse + cookie-clearing replay.',
+    required: true,
+    default: 5,
+    integer: true,
+    min: 1,
+    max: 50,
+  }),
+})
+
+export const setTrialsPerIpPerDay = sdk.Action.withInput(
+  'set-trials-per-ip-per-day',
+
+  async ({ effects }) => ({
+    name: 'Set Trial Cookies per IP (Lifetime)',
+    description:
+      'Anti-abuse cap on how many trial cookies a single IP can mint over the life of this install. Default: 5. Was per-day in 0.2.77–0.2.83 and is now lifetime — see release notes for 0.2.84.',
+    warning: null,
+    allowedStatuses: 'any',
+    group: 'Multi-Tenant',
+    visibility: 'enabled',
+  }),
+
+  inputSpec,
+
+  async ({ effects }) => {
+    const config = await configFile.read().once()
+    // Prefer the new field; fall back to the legacy per_day key for
+    // operators whose StartOS-managed config still has the old name.
+    const current =
+      config?.trials_per_ip_lifetime ??
+      config?.trials_per_ip_per_day ??
+      5
+    return { limit: current }
+  },
+
+  async ({ effects, input }) => {
+    // Write to BOTH keys so any code path still reading the legacy name
+    // gets a sane value too. anon-trial.js prefers the new key.
+    await configFile.merge(effects, {
+      trials_per_ip_lifetime: input.limit,
+      trials_per_ip_per_day: input.limit,
+    })
+    return null
+  },
+)
diff --git a/startos/actions/setWhisperEndpoint.ts b/startos/actions/setWhisperEndpoint.ts
index 060c9fb..6b24843 100644
--- a/startos/actions/setWhisperEndpoint.ts
+++ b/startos/actions/setWhisperEndpoint.ts
@@ -37,7 +37,7 @@ export const setWhisperEndpoint = sdk.Action.withInput(
   async ({ effects }) => ({
     name: 'Set Whisper Endpoint',
     description:
-      'Point Recap at a self-hosted or third-party Whisper transcription server (whisper.cpp, faster-whisper-server, Groq, etc.). Free alternative to OpenAI Whisper API or Gemini multimodal transcription.',
+      'Point Recaps at a self-hosted or third-party Whisper transcription server (whisper.cpp, faster-whisper-server, Groq, etc.). Free alternative to OpenAI Whisper API or Gemini multimodal transcription.',
     warning: null,
     allowedStatuses: 'any',
     group: 'AI Providers',
diff --git a/startos/file-models/config.json.ts b/startos/file-models/config.json.ts
index c02da51..e314bd3 100644
--- a/startos/file-models/config.json.ts
+++ b/startos/file-models/config.json.ts
@@ -26,5 +26,85 @@ export const configFile = FileHelper.json(
     recap_admin_password_hash: z.string().default(''),
     recap_admin_password_salt: z.string().default(''),
     recap_admin_session_secret: z.string().default(''),
+    // PodcastIndex credentials — used to resolve Spotify share URLs to
+    // their underlying RSS audio enclosure. Free tier signup at
+    // api.podcastindex.org. Apple Podcasts URLs resolve without auth.
+    podcastindex_api_key: z.string().default(''),
+    podcastindex_api_secret: z.string().default(''),
+    // ── Multi-tenant cloud-mode fields (added 0.2.77) ──
+    // recap_mode: "single" → existing self-hosted, one operator, no auth
+    //             "multi"  → cloud mode with email + magic-link auth,
+    //                        per-user library, BTCPay subscriptions
+    // The .s9pk defaults to single. Operators flip to multi via the
+    // "Enable multi-tenant mode" StartOS action.
+    recap_mode: z.enum(['single', 'multi']).default('single'),
+    // Public URL used in magic-link sign-in emails. Must be the
+    // ClearNet URL pointing at the Recap UI (typically a domain
+    // routed through Start Tunnel). Without this set, magic-link
+    // emails won't have a working sign-in link.
+    recap_public_url: z.string().default(''),
+    // Shared "operator key" for the core-decoupling cloud path. The secret
+    // that authenticates THIS Recap server to the Recap Relay so it can
+    // vouch for its signed-in users by account-id (X-Recap-User-Id) instead
+    // of attaching a per-user Keysat license. Must EXACTLY match the relay's
+    // own relay_cloud_operator_key. Empty = the cloud user-id path is
+    // disabled and paid users fall back to the operator's relay pool.
+    // Set via the "Set Relay Operator Key" StartOS action. Server-side
+    // only — never sent to the browser. Picked up live by the config poll
+    // (no restart needed), same as the provider API keys.
+    recap_relay_operator_key: z.string().default(''),
+    // Per-tenant default credit allowance — only used when running in
+    // multi mode on a self-hosted operator's StartOS server. New
+    // tenants (family members who sign up on the operator's domain)
+    // start with this many credits. The operator's relay-credit pool
+    // is debited as their tenants summarize. Doesn't apply to the
+    // canonical cloud deployment because cloud users have their own
+    // keysat licenses + relay-side credit pools.
+    tenant_default_credits: z.number().int().nonnegative().default(5),
+    // How often a tenant's "replenishable" credit bucket is refilled
+    // to tenant_default_credits.
+    //   "off"     — no refill; the signup-grant is one-time
+    //   "daily"   — anniversary-aligned 24h
+    //   "weekly"  — anniversary-aligned 7d
+    //   "monthly" — anniversary-aligned calendar month
+    // Anniversary-aligned = anchored to each tenant's last_replenish_at
+    // (set when they signed up or when the operator first turned the
+    // period on). Purchased credits + admin grants are persisted in
+    // tenant_credits.purchased_balance and NEVER affected by refills —
+    // only the replenish_balance bucket gets reset to the configured N.
+    tenant_credit_replenish_period: z
+      .enum(["off", "daily", "weekly", "monthly"])
+      .default("off"),
+    // Anonymous-trial knobs (multi-mode only). Visitors who land on
+    // recapapp.xyz without an account get N free summaries gated by a
+    // browser cookie before being prompted to sign up. Set
+    // trial_credits_per_visitor=0 to disable trials (return to an
+    // auth-wall landing). trials_per_ip_per_day caps how many distinct
+    // trial cookies one IP can mint in 24h — anti-script-abuse floor.
+    trial_credits_per_visitor: z.number().int().nonnegative().default(1),
+    // Lifetime cap on the number of distinct trial cookies one IP can
+    // mint. Was previously rolling-24h; switched to lifetime so a user
+    // who clears cookies can't replay the trial every day. The legacy
+    // field name `trials_per_ip_per_day` is preserved below as a
+    // read-only alias so installs that already have it set don't lose
+    // their value during the rename — anon-trial.js prefers
+    // _lifetime if set, falls back to _per_day if not.
+    trials_per_ip_lifetime: z.number().int().positive().default(5),
+    // Legacy alias — read for backward compatibility with v0.2.77–0.2.83
+    // installs that wrote the per-day variant. Will be removed once
+    // all known installs have re-saved their config under the new key.
+    trials_per_ip_per_day: z.number().int().positive().default(5),
+    // ── SMTP — synced from StartOS System SMTP via the SDK ──
+    // main.ts subscribes to effects.getSystemSmtp() and writes these
+    // fields here whenever the operator changes the system SMTP. The
+    // server reads them through the same file-poll as everything else
+    // and (re)builds its nodemailer transport. NEVER edit these
+    // fields directly — they get overwritten on the next sync.
+    smtp_host: z.string().default(''),
+    smtp_port: z.number().int().default(0),
+    smtp_security: z.enum(['starttls', 'tls']).default('tls'),
+    smtp_username: z.string().default(''),
+    smtp_password: z.string().default(''),
+    smtp_from: z.string().default(''),
   }),
 )
diff --git a/startos/main.ts b/startos/main.ts
index 4e3764e..5719cea 100644
--- a/startos/main.ts
+++ b/startos/main.ts
@@ -1,10 +1,74 @@
 import { i18n } from './i18n'
 import { sdk } from './sdk'
 import { uiPort } from './utils'
+import { configFile } from './file-models/config.json'
+
+// ── System SMTP → config.json sync ───────────────────────────────────────
+// The StartOS SDK exposes shared SMTP credentials via effects.getSystemSmtp.
+// Passing a callback subscribes us — StartOS re-invokes the callback when
+// the operator changes their System → SMTP settings. We mirror the values
+// into our own config.json so the server (which polls the JSON via
+// server/config.js) can pick them up without needing direct SDK access.
+//
+// `password` can be null in the StartOS payload — coerce to empty string
+// so the Zod schema (z.string()) accepts it. The server treats "" the
+// same as "auth disabled".
+//
+// Only meaningful in multi-tenant cloud mode (recap_mode === 'multi'),
+// where the server sends magic-link sign-in emails. In single mode the
+// fields exist in config.json but nothing reads them.
+async function syncSystemSmtpToConfig(effects: any) {
+  try {
+    const smtp = await effects.getSystemSmtp({
+      callback: () => {
+        // Re-fire ourselves on change. Effects callbacks fire on every
+        // mutation of the underlying value, so this stays in sync.
+        syncSystemSmtpToConfig(effects).catch((err) => {
+          console.warn('[smtp] sync callback failed:', err)
+        })
+      },
+    })
+    if (!smtp) {
+      // No System SMTP configured — clear stale values so the server
+      // doesn't try to send mail through a transport we no longer have
+      // credentials for.
+      await configFile.merge(effects, {
+        smtp_host: '',
+        smtp_port: 0,
+        smtp_security: 'tls',
+        smtp_username: '',
+        smtp_password: '',
+        smtp_from: '',
+      })
+      return
+    }
+    await configFile.merge(effects, {
+      smtp_host: smtp.host || '',
+      smtp_port: smtp.port || 0,
+      smtp_security: smtp.security || 'tls',
+      smtp_username: smtp.username || '',
+      smtp_password: smtp.password || '',
+      smtp_from: smtp.from || '',
+    })
+  } catch (err) {
+    console.warn('[smtp] initial sync failed:', err)
+  }
+}
 
 export const main = sdk.setupMain(async ({ effects }) => {
   console.info(i18n('Starting Recap...'))
 
+  // Subscribe to System SMTP changes before the daemon starts so the
+  // server boots with credentials already in config.json (no race where
+  // a magic-link request arrives before the first sync).
+  await syncSystemSmtpToConfig(effects)
+
+  // Read current config to determine which mode to boot in. The
+  // RECAP_MODE env var is passed to the container so the Node server
+  // can branch on it without re-reading the config file at startup.
+  const cfg = await configFile.read().once()
+  const recapMode = cfg?.recap_mode === 'multi' ? 'multi' : 'single'
+
   return sdk.Daemons.of(effects).addDaemon('primary', {
     subcontainer: await sdk.SubContainer.of(
       effects,
@@ -23,6 +87,9 @@ export const main = sdk.setupMain(async ({ effects }) => {
         '--',
         '/usr/local/bin/docker_entrypoint.sh',
       ],
+      env: {
+        RECAP_MODE: recapMode,
+      },
     },
     ready: {
       display: i18n('Web Interface'),
diff --git a/startos/manifest/i18n.ts b/startos/manifest/i18n.ts
index 07ebfda..f633af0 100644
--- a/startos/manifest/i18n.ts
+++ b/startos/manifest/i18n.ts
@@ -5,7 +5,7 @@ export const short = {
 
 export const long = {
   en_US:
-    'Recap downloads audio from YouTube videos and podcast RSS feeds, transcribes them, ' +
+    'Recaps downloads audio from YouTube videos and podcast RSS feeds, transcribes them, ' +
     'and produces structured topic-by-topic summaries with clickable timestamps. ' +
     'Pluggable AI provider system: pair any supported transcription provider with any ' +
     'analysis provider per request. Supported: Google Gemini (multimodal — transcription + ' +
@@ -25,7 +25,7 @@ export const alertInstall = {
   en_US:
     'After installing, the fastest path is to skip the activation screen and use your free ' +
     'relay credits to summarize a few videos. ' +
-    'For unlimited use: either activate a Recap license (paid features + monthly relay ' +
+    'For unlimited use: either activate a Recaps license (paid features + monthly relay ' +
     'credits), or paste your own AI provider API key in Settings → API Keys & Endpoints. ' +
     'Set an admin password via the "Set Admin Password" action if you want to gate access. ' +
     'Note: The embedded YouTube player will not work if you are connected to a VPN.',
diff --git a/startos/manifest/index.ts b/startos/manifest/index.ts
index feb25e3..eb253ef 100644
--- a/startos/manifest/index.ts
+++ b/startos/manifest/index.ts
@@ -3,7 +3,7 @@ import { alertInstall, long, short } from './i18n'
 
 export const manifest = setupManifest({
   id: 'recap',
-  title: 'Recap',
+  title: 'Recaps',
   license: 'Proprietary',
   packageRepo: 'https://ten31.xyz',
   upstreamRepo: 'https://ten31.xyz',
@@ -39,7 +39,7 @@ export const manifest = setupManifest({
     // (cloud providers stay available).
     ollama: {
       description:
-        'Run local LLMs (Llama, Mistral, etc.) for topic analysis without a cloud API. Recap auto-detects the install and pre-fills its connection URL.',
+        'Run local LLMs (Llama, Mistral, etc.) for topic analysis without a cloud API. Recaps auto-detects the install and pre-fills its connection URL.',
       optional: true,
       s9pk: null,
     },
diff --git a/startos/versions/index.ts b/startos/versions/index.ts
index 8240228..9afbcf2 100644
--- a/startos/versions/index.ts
+++ b/startos/versions/index.ts
@@ -66,8 +66,116 @@ import { v_0_2_44 } from './v0.2.44'
 import { v_0_2_45 } from './v0.2.45'
 import { v_0_2_46 } from './v0.2.46'
 import { v_0_2_47 } from './v0.2.47'
+import { v_0_2_48 } from './v0.2.48'
+import { v_0_2_49 } from './v0.2.49'
+import { v_0_2_50 } from './v0.2.50'
+import { v_0_2_51 } from './v0.2.51'
+import { v_0_2_52 } from './v0.2.52'
+import { v_0_2_53 } from './v0.2.53'
+import { v_0_2_54 } from './v0.2.54'
+import { v_0_2_55 } from './v0.2.55'
+import { v_0_2_56 } from './v0.2.56'
+import { v_0_2_57 } from './v0.2.57'
+import { v_0_2_58 } from './v0.2.58'
+import { v_0_2_59 } from './v0.2.59'
+import { v_0_2_60 } from './v0.2.60'
+import { v_0_2_61 } from './v0.2.61'
+import { v_0_2_62 } from './v0.2.62'
+import { v_0_2_63 } from './v0.2.63'
+import { v_0_2_64 } from './v0.2.64'
+import { v_0_2_65 } from './v0.2.65'
+import { v_0_2_66 } from './v0.2.66'
+import { v_0_2_67 } from './v0.2.67'
+import { v_0_2_68 } from './v0.2.68'
+import { v_0_2_69 } from './v0.2.69'
+import { v_0_2_70 } from './v0.2.70'
+import { v_0_2_71 } from './v0.2.71'
+import { v_0_2_72 } from './v0.2.72'
+import { v_0_2_73 } from './v0.2.73'
+import { v_0_2_74 } from './v0.2.74'
+import { v_0_2_75 } from './v0.2.75'
+import { v_0_2_76 } from './v0.2.76'
+import { v_0_2_77 } from './v0.2.77'
+import { v_0_2_78 } from './v0.2.78'
+import { v_0_2_79 } from './v0.2.79'
+import { v_0_2_80 } from './v0.2.80'
+import { v_0_2_81 } from './v0.2.81'
+import { v_0_2_82 } from './v0.2.82'
+import { v_0_2_83 } from './v0.2.83'
+import { v_0_2_84 } from './v0.2.84'
+import { v_0_2_85 } from './v0.2.85'
+import { v_0_2_86 } from './v0.2.86'
+import { v_0_2_87 } from './v0.2.87'
+import { v_0_2_88 } from './v0.2.88'
+import { v_0_2_89 } from './v0.2.89'
+import { v_0_2_90 } from './v0.2.90'
+import { v_0_2_91 } from './v0.2.91'
+import { v_0_2_92 } from './v0.2.92'
+import { v_0_2_93 } from './v0.2.93'
+import { v_0_2_94 } from './v0.2.94'
+import { v_0_2_95 } from './v0.2.95'
+import { v_0_2_96 } from './v0.2.96'
+import { v_0_2_97 } from './v0.2.97'
+import { v_0_2_98 } from './v0.2.98'
+import { v_0_2_99 } from './v0.2.99'
+import { v_0_2_100 } from './v0.2.100'
+import { v_0_2_101 } from './v0.2.101'
+import { v_0_2_102 } from './v0.2.102'
+import { v_0_2_103 } from './v0.2.103'
+import { v_0_2_104 } from './v0.2.104'
+import { v_0_2_105 } from './v0.2.105'
+import { v_0_2_106 } from './v0.2.106'
+import { v_0_2_107 } from './v0.2.107'
+import { v_0_2_108 } from './v0.2.108'
+import { v_0_2_109 } from './v0.2.109'
+import { v_0_2_110 } from './v0.2.110'
+import { v_0_2_111 } from './v0.2.111'
+import { v_0_2_112 } from './v0.2.112'
+import { v_0_2_113 } from './v0.2.113'
+import { v_0_2_114 } from './v0.2.114'
+import { v_0_2_115 } from './v0.2.115'
+import { v_0_2_116 } from './v0.2.116'
+import { v_0_2_117 } from './v0.2.117'
+import { v_0_2_118 } from './v0.2.118'
+import { v_0_2_119 } from './v0.2.119'
+import { v_0_2_120 } from './v0.2.120'
+import { v_0_2_121 } from './v0.2.121'
+import { v_0_2_122 } from './v0.2.122'
+import { v_0_2_123 } from './v0.2.123'
+import { v_0_2_124 } from './v0.2.124'
+import { v_0_2_125 } from './v0.2.125'
+import { v_0_2_126 } from './v0.2.126'
+import { v_0_2_127 } from './v0.2.127'
+import { v_0_2_128 } from './v0.2.128'
+import { v_0_2_129 } from './v0.2.129'
+import { v_0_2_130 } from './v0.2.130'
+import { v_0_2_131 } from './v0.2.131'
+import { v_0_2_132 } from './v0.2.132'
+import { v_0_2_133 } from './v0.2.133'
+import { v_0_2_134 } from './v0.2.134'
+import { v_0_2_135 } from './v0.2.135'
+import { v_0_2_136 } from './v0.2.136'
+import { v_0_2_137 } from './v0.2.137'
+import { v_0_2_138 } from './v0.2.138'
+import { v_0_2_139 } from './v0.2.139'
+import { v_0_2_140 } from './v0.2.140'
+import { v_0_2_141 } from './v0.2.141'
+import { v_0_2_142 } from './v0.2.142'
+import { v_0_2_143 } from './v0.2.143'
+import { v_0_2_144 } from './v0.2.144'
+import { v_0_2_145 } from './v0.2.145'
+import { v_0_2_146 } from './v0.2.146'
+import { v_0_2_147 } from './v0.2.147'
+import { v_0_2_148 } from './v0.2.148'
+import { v_0_2_149 } from './v0.2.149'
+import { v_0_2_150 } from './v0.2.150'
+import { v_0_2_151 } from './v0.2.151'
+import { v_0_2_152 } from './v0.2.152'
+import { v_0_2_153 } from './v0.2.153'
+import { v_0_2_154 } from './v0.2.154'
+import { v_0_2_155 } from './v0.2.155'
 
 export const versionGraph = VersionGraph.of({
-  current: v_0_2_47,
-  other: [v_0_2_46, v_0_2_45, v_0_2_44, v_0_2_43, v_0_2_42, v_0_2_41, v_0_2_40, v_0_2_39, v_0_2_38, v_0_2_37, v_0_2_36, v_0_2_35, v_0_2_34, v_0_2_33, v_0_2_32, v_0_2_31, v_0_2_30, v_0_2_29, v_0_2_28, v_0_2_27, v_0_2_26, v_0_2_25, v_0_2_24, v_0_2_23, v_0_2_22, v_0_2_21, v_0_2_20, v_0_2_19, v_0_2_18, v_0_2_17, v_0_2_16, v_0_2_15, v_0_2_14, v_0_2_13, v_0_2_12, v_0_2_11, v_0_2_10, v_0_2_9, v_0_2_8, v_0_2_7, v_0_2_6, v_0_2_5, v_0_2_4, v_0_2_3, v_0_2_2, v_0_2_1, v_0_2_0, v_0_1_18, v_0_1_17, v_0_1_16, v_0_1_15, v_0_1_14, v_0_1_13, v_0_1_12, v_0_1_11, v_0_1_10, v_0_1_9, v_0_1_8, v_0_1_7, v_0_1_6, v_0_1_5, v_0_1_4, v_0_1_3, v_0_1_2, v_0_1_1, v_0_1_0],
+  current: v_0_2_155,
+  other: [v_0_2_154, v_0_2_153, v_0_2_152, v_0_2_151, v_0_2_150, v_0_2_149, v_0_2_148, v_0_2_147, v_0_2_146, v_0_2_145, v_0_2_144, v_0_2_143, v_0_2_142, v_0_2_141, v_0_2_140, v_0_2_139, v_0_2_138, v_0_2_137, v_0_2_136, v_0_2_135, v_0_2_134, v_0_2_133, v_0_2_132, v_0_2_131, v_0_2_130, v_0_2_129, v_0_2_128, v_0_2_127, v_0_2_126, v_0_2_125, v_0_2_124, v_0_2_123, v_0_2_122, v_0_2_121, v_0_2_120, v_0_2_119, v_0_2_118, v_0_2_117, v_0_2_116, v_0_2_115, v_0_2_114, v_0_2_113, v_0_2_112, v_0_2_111, v_0_2_110, v_0_2_109, v_0_2_108, v_0_2_107, v_0_2_106, v_0_2_105, v_0_2_104, v_0_2_103, v_0_2_102, v_0_2_101, v_0_2_100, v_0_2_99, v_0_2_98, v_0_2_97, v_0_2_96, v_0_2_95, v_0_2_94, v_0_2_93, v_0_2_92, v_0_2_91, v_0_2_90, v_0_2_89, v_0_2_88, v_0_2_87, v_0_2_86, v_0_2_85, v_0_2_84, v_0_2_83, v_0_2_82, v_0_2_81, v_0_2_80, v_0_2_79, v_0_2_78, v_0_2_77, v_0_2_76, v_0_2_75, v_0_2_74, v_0_2_73, v_0_2_72, v_0_2_71, v_0_2_70, v_0_2_69, v_0_2_68, v_0_2_67, v_0_2_66, v_0_2_65, v_0_2_64, v_0_2_63, v_0_2_62, v_0_2_61, v_0_2_60, v_0_2_59, v_0_2_58, v_0_2_57, v_0_2_56, v_0_2_55, v_0_2_54, v_0_2_53, v_0_2_52, v_0_2_51, v_0_2_50, v_0_2_49, v_0_2_48, v_0_2_47, v_0_2_46, v_0_2_45, v_0_2_44, v_0_2_43, v_0_2_42, v_0_2_41, v_0_2_40, v_0_2_39, v_0_2_38, v_0_2_37, v_0_2_36, v_0_2_35, v_0_2_34, v_0_2_33, v_0_2_32, v_0_2_31, v_0_2_30, v_0_2_29, v_0_2_28, v_0_2_27, v_0_2_26, v_0_2_25, v_0_2_24, v_0_2_23, v_0_2_22, v_0_2_21, v_0_2_20, v_0_2_19, v_0_2_18, v_0_2_17, v_0_2_16, v_0_2_15, v_0_2_14, v_0_2_13, v_0_2_12, v_0_2_11, v_0_2_10, v_0_2_9, v_0_2_8, v_0_2_7, v_0_2_6, v_0_2_5, v_0_2_4, v_0_2_3, v_0_2_2, v_0_2_1, v_0_2_0, v_0_1_18, v_0_1_17, v_0_1_16, v_0_1_15, v_0_1_14, v_0_1_13, v_0_1_12, v_0_1_11, v_0_1_10, v_0_1_9, v_0_1_8, v_0_1_7, v_0_1_6, v_0_1_5, v_0_1_4, v_0_1_3, v_0_1_2, v_0_1_1, v_0_1_0],
 })
diff --git a/startos/versions/v0.2.100.ts b/startos/versions/v0.2.100.ts
new file mode 100644
index 0000000..d0a3082
--- /dev/null
+++ b/startos/versions/v0.2.100.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_100 = VersionInfo.of({
+  version: '0.2.100:0',
+  releaseNotes: {
+    en_US:
+      "Revert the anon-buyer recovery-email field added in v0.2.99. Asking an anon visitor for an email at the credit-purchase step defeats the value-prop of anon credit purchase. The mobile-menu Sign up entry (also added in v0.2.99) stays in place. The cross-cookie-jar edge case (e.g., Superhuman opening the magic link in DuckDuckGo while the credits were bought in Safari) is now a documented known limitation — sign up first if you want credits portable across browsers.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.101.ts b/startos/versions/v0.2.101.ts
new file mode 100644
index 0000000..a2c8225
--- /dev/null
+++ b/startos/versions/v0.2.101.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_101 = VersionInfo.of({
+  version: '0.2.101:0',
+  releaseNotes: {
+    en_US:
+      "Mobile top-bar fixes. (1) The Summarize / Queue / Subscribe pill is now a square right-arrow icon button on phones — same size as the hamburger menu next to it — instead of a wide purple pill that overlapped the menu. Desktop keeps the labeled pill. (2) Fix the pizza-tracker progress breadcrumb (Downloading → Transcribing → Analyzing → Done) not appearing on mobile Safari: it was nested inside the flex-wrap + position:sticky .top-bar where iOS Safari was eating it. The mobile copy now renders as a sibling below .top-bar, completely outside the flex container, so it shows up reliably during summarization. Desktop is unchanged.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.102.ts b/startos/versions/v0.2.102.ts
new file mode 100644
index 0000000..f82ba22
--- /dev/null
+++ b/startos/versions/v0.2.102.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_102 = VersionInfo.of({
+  version: '0.2.102:0',
+  releaseNotes: {
+    en_US:
+      "Two iOS Safari buy-credits fixes. (1) The 'Couldn't open purchase. Load failed' error on first modal open: iOS Safari sometimes silently aborts the initial fetch from a cold tab. The buy-credits modal now silently retries once with a 600ms backoff before surfacing the error, hiding the flake. The relay /packages timeout also bumped from 5s to 10s so a slow cold relay request from cellular doesn't trip the abort. (2) The 'Sign up for a free account first — we need to know where to credit your purchase' error when an anon buyer clicks a package: this fired whenever the visitor's IP had hit the lifetime trial-cookie cap (default 5). The cap exists to prevent abuse of FREE credits — a paying buyer is not abuse. /api/credits/buy now forces a fresh trial cookie mint regardless of the IP cap and regardless of whether trials are disabled, so a paying buyer always has a buyer_id to credit the settle to.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.103.ts b/startos/versions/v0.2.103.ts
new file mode 100644
index 0000000..12412ed
--- /dev/null
+++ b/startos/versions/v0.2.103.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_103 = VersionInfo.of({
+  version: '0.2.103:0',
+  releaseNotes: {
+    en_US:
+      "Self-service recovery for anon credit purchases that didn't transfer at signup. When a Safari Private mode visitor buys credits, the trial cookie tracking the purchase often doesn't survive the magic-link click (the email may open in a different browser context — non-private tab, in-app webview, or a different private window — each with its own cookie jar). linkToUser then runs blind and the credits stay orphaned in anon_trials. New: (1) the buy-credits modal now surfaces the BTCPay invoice ID prominently for anon buyers with a one-tap copy button and a note explaining when they'd need it. (2) Account settings has a new 'Claim a previous purchase' section: paste the invoice ID, the server verifies the invoice is settled at the relay AND was an anon-buyer purchase that's still unapplied, then credits the signed-in user. Idempotent. Only anon-buyer rows are claimable so signed-in user purchases can't be hijacked.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.104.ts b/startos/versions/v0.2.104.ts
new file mode 100644
index 0000000..b96080f
--- /dev/null
+++ b/startos/versions/v0.2.104.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_104 = VersionInfo.of({
+  version: '0.2.104:0',
+  releaseNotes: {
+    en_US:
+      "Magic-link signup now reliably transfers anon credits even across cookie jars. The anon trial cookie is now captured server-side at /auth/request-link time and stored alongside the magic-link token in a new magic_link_tokens.trial_cookie_id column (added in-place on existing installs via migration). At /auth/verify the linker reads the trial cookie ID directly from the token row instead of from the verify request's cookies — so it doesn't matter if the magic-link click lands in Safari Private mode, an in-app email webview, or a different browser entirely. The cookie ID is never put in the URL (would leak to anyone who saw the email); only the random token is. The req.cookies path is kept as a fallback for old tokens from before this column existed and for any edge case where request-link didn't capture it. The manual 'Claim a previous purchase' UI from v0.2.103 stays as a belt-and-suspenders for users who clear cookies between request-link and verify, or whose purchase predates their signup intent entirely.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.105.ts b/startos/versions/v0.2.105.ts
new file mode 100644
index 0000000..efecbcc
--- /dev/null
+++ b/startos/versions/v0.2.105.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_105 = VersionInfo.of({
+  version: '0.2.105:0',
+  releaseNotes: {
+    en_US:
+      "Two mobile polish items. (1) Silent retry on the magic-link send button. iOS Safari sometimes aborts the very first fetch from a cold tab with a generic 'Load failed' TypeError; the user previously had to manually click again. The Free signup path in the tier modal, the Pro/Max license-purchase path, and the standalone /auth.html magic-link form all now retry once silently with a ~500ms backoff. Server errors (4xx/5xx) are NOT retried — those are deliberate responses, not transport flakes. (2) Pro / Max upgrade entries in the mobile hamburger menu for signed-in free users. Previously the menu only exposed 'Buy more credits' which made plan upgrades a multi-tap drilldown through settings. Now signed-in users who aren't already on Pro or Max see 'Upgrade to Pro' and 'Upgrade to Max' below their credit line. Each entry opens the in-app license purchase modal with the relevant tier pre-selected, jumping straight to the discount-entry step.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.106.ts b/startos/versions/v0.2.106.ts
new file mode 100644
index 0000000..f51ddb3
--- /dev/null
+++ b/startos/versions/v0.2.106.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_106 = VersionInfo.of({
+  version: '0.2.106:0',
+  releaseNotes: {
+    en_US:
+      "Tighten the mobile menu upgrade UX. v0.2.105 added two upgrade entries (Pro + Max) which forced free users to pick between tiers without seeing the comparison. Now Free signed-in users see a single 'Upgrade' entry that opens the buy modal at the tier picker so they can compare Pro vs Max side-by-side. Pro users see a single 'Upgrade to Max' entry that opens the modal pre-selected on Max. Max users see no upgrade entry. Anon/trial visitors continue through the existing Sign up → 3-tier modal flow.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.107.ts b/startos/versions/v0.2.107.ts
new file mode 100644
index 0000000..e15da46
--- /dev/null
+++ b/startos/versions/v0.2.107.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_107 = VersionInfo.of({
+  version: '0.2.107:0',
+  releaseNotes: {
+    en_US:
+      "Cleaner sign-in form. Removed the 'you@example.com' placeholder from the email field on both /auth.html and the in-app tier signup modal (it was clutter that some users read as a real suggested value). Removed the 'Leave blank to receive a sign-in link' placeholder from the password field on /auth.html — the same guidance already appears in the helper paragraph below the submit button, so the placeholder was duplicative.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.108.ts b/startos/versions/v0.2.108.ts
new file mode 100644
index 0000000..7de2891
--- /dev/null
+++ b/startos/versions/v0.2.108.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_108 = VersionInfo.of({
+  version: '0.2.108:0',
+  releaseNotes: {
+    en_US:
+      "Settings panel CTA fixes for tenants. (1) The 'Upgrade to Pro' pill on the Plan section now reads 'Upgrade' for free signed-in users and trial visitors — clicking opens the buy modal showing Pro and Max side-by-side, so labeling the pill 'Upgrade to Pro' was misleading (you're not committing to Pro by clicking, you're opening a comparison). Pro users (not Max) see 'Upgrade to Max' since the destination is unambiguous — clicking pre-selects the Max tier in the buy modal. (2) The 'Sign up' button on the Account section (anon trial + not-signed-in states) now opens the 3-tier signup modal (Free / Pro / Max) instead of dropping the visitor on the magic-link form. Same modal as the toolbar 'Sign up' pill — visitors get the full pricing menu before committing to a tier. Both fixes apply on mobile and web (the settings panel renders the same on both)."
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.109.ts b/startos/versions/v0.2.109.ts
new file mode 100644
index 0000000..7ceb500
--- /dev/null
+++ b/startos/versions/v0.2.109.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_109 = VersionInfo.of({
+  version: '0.2.109:0',
+  releaseNotes: {
+    en_US:
+      "Rebrand the public-facing name from 'Recap' to 'Recaps' (matching the new recaps.cc domain). Updated: the StartOS package title, manifest short/long descriptions and install alert; every web UI heading, modal title, and body string that referred to the brand; every StartOS action display name and description; the magic-link sign-in email and the post-purchase 'your account is ready' email subjects + bodies; the auth error page; the 503-when-misconfigured server error messages. Kept as-is on purpose: (1) 'Recap credits' as the credit-unit terminology — 'a recap' is the unit, 'Recaps' is the brand. (2) All internal identifiers: StartOS package id (recap), config field names (recap_license_key), env vars (RECAP_MODE), cookie names (recap_session, recap_anon_trial), database file names, X-Recap-Install-Id / X-Recap-Job-Id wire headers, and the recap-relay backend project name. Changing any of those would break existing installs' upgrade path or the relay protocol.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.110.ts b/startos/versions/v0.2.110.ts
new file mode 100644
index 0000000..e58341f
--- /dev/null
+++ b/startos/versions/v0.2.110.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_110 = VersionInfo.of({
+  version: '0.2.110:0',
+  releaseNotes: {
+    en_US:
+      "Phase 1 of the inline-payment migration plus several UX cleanups. (1) Sign-in form: the optional password field is now hidden by default; a 'Use password instead' link below the submit button reveals it on demand. Magic-link signup is the dominant path and the field was just clutter. The form auto-detects the field state so a browser autofill into the hidden field can't accidentally force password mode. (2) Default relay base URL updated from relay.keysat.xyz to relay.recaps.cc. Update your StartOS network config (recap_public_url etc.) accordingly if needed. (3) Buy-credits modal: removed the 'Purchased credits never expire' explanatory paragraph (already covered by the anon-buyer recovery message). Buy button now reads '⚡ Pay with Lightning' instead of 'Buy →'. OG/Twitter URLs in the HTML head updated from recapapp.xyz to recaps.cc. (4) Inline Lightning invoice UI: when the relay's /relay/credits/buy response includes a bolt11 field, Recaps now renders an inline QR + copyable BOLT11 + 'Open in wallet' deep link instead of opening BTCPay in a new tab. Polling continues to drive the settle handoff. Falls back cleanly to the legacy external-tab flow if bolt11 isn't present, so existing relay versions keep working. QR encoder is vendored locally (/assets/qrcode.min.js) so it renders behind start-tunnel without external internet. Next: the relay needs to surface bolt11 + lightning_expires_at in its buy response envelope to activate the inline path.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.111.ts b/startos/versions/v0.2.111.ts
new file mode 100644
index 0000000..882a132
--- /dev/null
+++ b/startos/versions/v0.2.111.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_111 = VersionInfo.of({
+  version: '0.2.111:0',
+  releaseNotes: {
+    en_US:
+      "Phase 1 diagnostics. Adds two visibility aids to help confirm the inline-Lightning path is active end-to-end. (1) Console.log on every /api/credits/buy response — prints the raw envelope plus a one-line 'bolt11 present: yes/NO' marker so you can confirm at a glance whether the relay is surfacing the new field. (2) Admin-only diagnostic line on the legacy-fallback polling view that explicitly says 'Inline payment unavailable — relay didn't return a BOLT11' with the version requirement (relay v0.2.71+). Both are admin/operator-only — regular tenants don't see the diagnostic line. Will be removed once we've confirmed the inline path works for every BTCPay store configuration.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.112.ts b/startos/versions/v0.2.112.ts
new file mode 100644
index 0000000..89043f0
--- /dev/null
+++ b/startos/versions/v0.2.112.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_112 = VersionInfo.of({
+  version: '0.2.112:0',
+  releaseNotes: {
+    en_US:
+      "Make the Phase 1 'inline payment unavailable' diagnostic visible to all viewers (not just admin) while we trace why the new bolt11 path isn't lighting up on Grant's test rig. Tiny italic gray line at the bottom of the legacy-fallback polling view, says what needs to be fixed (relay version OR BTCPay API key scope). Will be removed once inline rendering is confirmed working everywhere.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.113.ts b/startos/versions/v0.2.113.ts
new file mode 100644
index 0000000..be318a8
--- /dev/null
+++ b/startos/versions/v0.2.113.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_113 = VersionInfo.of({
+  version: '0.2.113:0',
+  releaseNotes: {
+    en_US:
+      "Surface the relay's new `_ln_debug` field in the buy-credits modal's diagnostic line so operators can see exactly why the inline-Lightning path isn't lighting up (no Lightning method on BTCPay response vs fetch failed with HTTP status) without tailing relay logs. Requires relay v0.2.72+ for the diagnostic to be populated; falls through to a friendly 'relay didn't return BOLT11' message on older relays.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.114.ts b/startos/versions/v0.2.114.ts
new file mode 100644
index 0000000..d8fa91a
--- /dev/null
+++ b/startos/versions/v0.2.114.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_114 = VersionInfo.of({
+  version: '0.2.114:0',
+  releaseNotes: {
+    en_US:
+      "Inline Lightning UI polish. (1) Fix the missing QR render: the previous attempt used scalable:true which strips the SVG's intrinsic dimensions, and the parent inline-block had no fixed size, so the SVG collapsed to 0×0. Switched to a fixed-size SVG at cellSize:3 — a typical BOLT11 lands around 225px square, predictable across browsers and zoom levels. (2) Tightened the inline-payment layout: cap modal width to 420px in the polling state (was 1000px — the tier picker still uses the wide layout), header label flips to 'Pay with Lightning', BOLT11 invoice renders on a single truncated line with ellipsis instead of multi-line wrap, smaller QR + padding, more compact button + helper text.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.115.ts b/startos/versions/v0.2.115.ts
new file mode 100644
index 0000000..fcb883d
--- /dev/null
+++ b/startos/versions/v0.2.115.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_115 = VersionInfo.of({
+  version: '0.2.115:0',
+  releaseNotes: {
+    en_US:
+      "Better payment-confirmed moment for credit purchases. Instead of immediately closing the buy modal and tossing a 'credits added' toast in the corner, the modal now transitions to a centered success view: a green pop-in checkmark, a brief radial sparkle burst (✨ ⚡ ⭐ pure CSS, no library), 'Payment confirmed' headline, and 'N Recap credits added to your balance' subtext. Auto-closes after 2.8s; Done button closes sooner. Gives the buyer a clear visual beat that the payment actually landed before the UI moves on.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.116.ts b/startos/versions/v0.2.116.ts
new file mode 100644
index 0000000..11b4314
--- /dev/null
+++ b/startos/versions/v0.2.116.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_116 = VersionInfo.of({
+  version: '0.2.116:0',
+  releaseNotes: {
+    en_US:
+      "Phase 1 housekeeping: remove the dev-time 'Inline payment unavailable' diagnostic line + the buy-response console.log now that the inline-Lightning path is verified working end-to-end. The legacy external-tab fallback (used when the relay can't extract a BOLT11 from BTCPay) stays in place as a quiet safety net — it just no longer announces itself as a debug breadcrumb.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.117.ts b/startos/versions/v0.2.117.ts
new file mode 100644
index 0000000..d1f4661
--- /dev/null
+++ b/startos/versions/v0.2.117.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_117 = VersionInfo.of({
+  version: '0.2.117:0',
+  releaseNotes: {
+    en_US:
+      "Fix credits-purchased-by-Pro-tenant going to the wrong pool. The relayHeaders() helper used by /api/credits/buy and the credit poll/sweep paths was unconditionally sending the operator's install ID + license key, regardless of whether the buyer was a Pro/Max signed-in tenant with their own license. Result: a Pro tenant's BTCPay invoice got stashed with the operator's license_fingerprint, the relay's BTCPay webhook credited the operator's license-keyed pool, and the tenant's own balance never moved. Now relayHeaders() routes by per-request identity: signed-in user with a license → use THEIR install ID + license; anon / free / single-mode → fall back to operator identity (unchanged behavior for those cases). Threaded `req` through every relay caller in credits-purchase.js including the sweepUnappliedPurchases helper.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.118.ts b/startos/versions/v0.2.118.ts
new file mode 100644
index 0000000..b3a3ff3
--- /dev/null
+++ b/startos/versions/v0.2.118.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_118 = VersionInfo.of({
+  version: '0.2.118:0',
+  releaseNotes: {
+    en_US:
+      "Phase-1-bugfix diagnostic. v0.2.117's relayHeaders() fix should have routed credit purchases to a Pro tenant's own license-keyed pool, but Grant's first test still showed the balance stuck. Two visibility aids ship in this version: (1) /api/credits/buy now logs the outbound identity (install ID + license prefix/suffix + which branch fired — per_user vs operator_fallback) so it's obvious from a single relay-log line whether the fix engaged. (2) New GET /api/credits/diagnose endpoint (signed-in only) reports the exact identity Recaps would send to the relay for this user, the user's recent pending_purchases rows, and the relay's response when polling the latest invoice — lets us figure out fingerprint vs webhook vs pool-keying problems in one round-trip without log tailing.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.119.ts b/startos/versions/v0.2.119.ts
new file mode 100644
index 0000000..2789c5d
--- /dev/null
+++ b/startos/versions/v0.2.119.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_119 = VersionInfo.of({
+  version: '0.2.119:0',
+  releaseNotes: {
+    en_US:
+      "Remove Phase-1-bugfix diagnostics now that buy → BTCPay → webhook → relay pool → display flow is verified end-to-end. Drops the /api/credits/diagnose endpoint and the outbound-identity log line from /api/credits/buy. The actual fix from v0.2.117 (per-user identity routing in relayHeaders) stays; this is just cleanup. Root cause of the Pro-tenant credit-not-incrementing bug turned out to be two-part: (1) Recaps was sending the operator's identity instead of the tenant's — fixed in v0.2.117; (2) the BTCPay webhook URL was still pointed at the old relay tunnel (relay.keysat.xyz) instead of the new one (relay.recaps.cc) — operator fixed via the relay's Set BTCPay Connection action.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.120.ts b/startos/versions/v0.2.120.ts
new file mode 100644
index 0000000..aef6a78
--- /dev/null
+++ b/startos/versions/v0.2.120.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_120 = VersionInfo.of({
+  version: '0.2.120:0',
+  releaseNotes: {
+    en_US:
+      "Fix the admin Tenants list overflow in Settings → Tenants. Each row's email + metadata + action buttons were all sharing a single flex row that didn't fit cleanly inside the 480px settings modal — the +Credits / Sign out / Delete buttons got clipped at the right edge. Buttons now stack on their own row below the metadata, right-aligned and wrap-friendly so they're readable at any modal width. Same fix applies on mobile.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.121.ts b/startos/versions/v0.2.121.ts
new file mode 100644
index 0000000..60ec239
--- /dev/null
+++ b/startos/versions/v0.2.121.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_121 = VersionInfo.of({
+  version: '0.2.121:0',
+  releaseNotes: {
+    en_US:
+      "Remove the 'N segments' counter from the results header, stats bar, video metadata line, and podcast metadata line. The raw transcript-segment count (often 600+) was a noisy implementation detail that didn't tell viewers anything useful — knowing a 90-minute video has 637 segments doesn't help anyone decide whether to read it. The header now reads simply 'N topics · M:SS total' across all variants (video, podcast, and the live-streaming header counter). Topic count and total duration are the actual viewer-facing numbers worth surfacing.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.122.ts b/startos/versions/v0.2.122.ts
new file mode 100644
index 0000000..bd17d3f
--- /dev/null
+++ b/startos/versions/v0.2.122.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_122 = VersionInfo.of({
+  version: '0.2.122:0',
+  releaseNotes: {
+    en_US:
+      "Phase 1E: speaker diarization rendering. When the operator's relay is on v0.2.88+ AND has diarization enabled, summarized videos now show a 'Speakers' legend above the topic list and a colored chip beside each transcript line — Speaker A in red, B in blue, C in green, D in yellow, etc. (8 distinct colors cycle for >8 speakers, which is rare in interview/podcast content). Chip color is stable per global speaker ID so the same voice always gets the same chip throughout the transcript. Confidence < 50% adds a trailing '?' to the chip so you know the assignment is uncertain. Legend shows total turns + total speaking time per speaker. Per-entry speakers are attached server-side via time-matching: the relay's fine-grained Parakeet segments (with diarization labels) are joined to Recap's merged readable lines by start-time intersection. Backwards-compatible: older relays without transcript_segments simply skip the rendering — UI looks identical to v0.2.121 for those sessions. Persisted in history alongside the existing transcript/analysis JSON so reopening a saved session restores the speaker labels.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.123.ts b/startos/versions/v0.2.123.ts
new file mode 100644
index 0000000..7a7c5b1
--- /dev/null
+++ b/startos/versions/v0.2.123.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_123 = VersionInfo.of({
+  version: '0.2.123:0',
+  releaseNotes: {
+    en_US:
+      "Drop the per-speaker turn count from the Speakers legend. A 90-min interview with 1000+ turns per speaker was emitting numbers too big to mean anything to viewers; speaking time (24:42, 65:37, 3s) is the actually-useful per-speaker fact and lets a glance distinguish 'main host' from 'brief interlude'. Same legend layout, just the noisy field removed.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.124.ts b/startos/versions/v0.2.124.ts
new file mode 100644
index 0000000..877c0ac
--- /dev/null
+++ b/startos/versions/v0.2.124.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_124 = VersionInfo.of({
+  version: '0.2.124:0',
+  releaseNotes: {
+    en_US:
+      "Frontend half of the pipelined-analyze work that ships in relay v0.2.89. Browser handler for transcript_ready no longer wipes state.chunks unless the videoId changed — this preserves partial sections that arrived earlier via sections_partial in pipelined mode. The relay-mode branch in server/index.js now emits transcript_ready EARLY (from the first onWindowComplete or from onTranscribeComplete, whichever fires first) so the browser flips from loading view to results view in time to render the streaming partial sections. SDK provider/relay.js forwards a new `windowEntries` field on the window_complete callback — in pipelined mode each window arrives with its own bracketed entries embedded; sequential mode keeps falling back to the global streamedRelayEntries cache. Net effect: when summarizing a 94-min video through a v0.2.89+ relay, the first topics now render at T~80s instead of T~160s — the loading-screen → results-view transition + first chunks landing happen DURING transcribe instead of after it. Older relays keep working — pipelined fields are absent and the existing sequential code path takes over.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.125.ts b/startos/versions/v0.2.125.ts
new file mode 100644
index 0000000..3b868e4
--- /dev/null
+++ b/startos/versions/v0.2.125.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_125 = VersionInfo.of({
+  version: '0.2.125:0',
+  releaseNotes: {
+    en_US:
+      "Tiny copy fix: the streaming-indicator below the topic list said 'N/M sections ready' which read confusingly against the 'topics · segments' nomenclature elsewhere in the UI ('sections' could be misread as 'segments'). Now says 'N/M windows ready' — matches the relay's internal name for analyze windows.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.126.ts b/startos/versions/v0.2.126.ts
new file mode 100644
index 0000000..03cc449
--- /dev/null
+++ b/startos/versions/v0.2.126.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_126 = VersionInfo.of({
+  version: '0.2.126:0',
+  releaseNotes: {
+    en_US:
+      "Tone down the streaming-indicator below the topics list. The 'Analyzing window N / M…' line was rendering with NO style — it inherited the browser default font-size which read way bigger and more prominent than the surrounding sidebar text. Now styled to match the dimmer treatment the podcast-variant indicator already uses: 11px italic, slate-grey at 85% opacity, smaller pulsing dot. Reads as subtle progress metadata instead of a big call-out.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.127.ts b/startos/versions/v0.2.127.ts
new file mode 100644
index 0000000..8dadf34
--- /dev/null
+++ b/startos/versions/v0.2.127.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_127 = VersionInfo.of({
+  version: '0.2.127:0',
+  releaseNotes: {
+    en_US:
+      "Aggressive tone-down of the streaming 'Analyzing window N / M…' indicator that was still reading too prominently after v0.2.126. Drops to 10px (down from 11px) at 70% opacity, muted slate color, tighter padding, !important to defeat any cached or inherited CSS. Matching treatment on the podcast-variant indicator below the topic list. Hard-refresh after install if it still looks the same size — that means the browser is rendering the old cached script.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.128.ts b/startos/versions/v0.2.128.ts
new file mode 100644
index 0000000..1cae6eb
--- /dev/null
+++ b/startos/versions/v0.2.128.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_128 = VersionInfo.of({
+  version: '0.2.128:0',
+  releaseNotes: {
+    en_US:
+      "Frontend half of the Phase 2 post-cluster polish work that ships in relay v0.2.95. The speakers legend now shows the inferred real name when the relay's polish pass identified one: '[A] Matt Hill · 24:42' instead of '[A] Speaker A · 24:42'. Chip letters and colors stay the same (so the visual identity is stable as you scroll the transcript). When the LLM couldn't confidently name a speaker, the legend falls back to the cluster ID. Per-line chip tooltips also show the inferred name ('Matt Hill (Speaker_A) · conf 87%'). Topic summaries arrive already polished from the relay — they attribute statements to specific speakers ('Matt Hill explains why self-hosting matters' instead of 'the discussion centers around self-hosting'). SDK provider/relay.js forwards the new speaker_names field; recap-server saves it to history alongside speakers, so reopening saved sessions restores names.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.129.ts b/startos/versions/v0.2.129.ts
new file mode 100644
index 0000000..0cfec22
--- /dev/null
+++ b/startos/versions/v0.2.129.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_129 = VersionInfo.of({
+  version: '0.2.129:0',
+  releaseNotes: {
+    en_US:
+      "Speaker chips on transcript lines now show INITIALS when the relay's post-cluster polish has identified a real name: 'Matt Hill' → 'MH', 'Brandon Carpalis' → 'BC', single-name 'Alice' → 'A'. Unidentified speakers (polish returned null) keep their cluster letter ('A'/'B'/'C') so the chip stays legible either way. Tooltip on hover still shows the full name. Chip min-width nudged from 22px to 26px so 2-letter initials breathe. Same initials show in the Speakers legend so it matches the chips throughout the transcript. Also brightened the 'Analyzing window N/M' streaming indicator — was 10px at 70% opacity in muted slate (per Grant's feedback, barely visible); now 12px at 95% opacity in #94a3b8 grey, more comfortable to read but still subordinate to the topic content.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.130.ts b/startos/versions/v0.2.130.ts
new file mode 100644
index 0000000..5d97c21
--- /dev/null
+++ b/startos/versions/v0.2.130.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_130 = VersionInfo.of({
+  version: '0.2.130:0',
+  releaseNotes: {
+    en_US:
+      "Hide '0 topics, 0:00 total' header counts during streaming. Three placements (podcast meta line, video meta line, stats-bar in the results-right pane) all now show the counts only AFTER the result event fires and state.streaming flips false — so the user no longer sees a placeholder '0 topics' display while analyze windows are still landing. No backend change; pure render-gating. Browser cache note: if Recap shows the old behavior after install, hard-refresh (Cmd+Shift+R) to force a fresh fetch of the static HTML.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.131.ts b/startos/versions/v0.2.131.ts
new file mode 100644
index 0000000..48580ec
--- /dev/null
+++ b/startos/versions/v0.2.131.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_131 = VersionInfo.of({
+  version: '0.2.131:0',
+  releaseNotes: {
+    en_US:
+      "Frontend half of relay v0.2.100's small-cluster suppression. Two new chip states: (1) UNCERTAIN — the post-cluster suppression pass reassigned a small cluster to one of the main anchor speakers as best-guess attribution. Chip renders with a '?' suffix (e.g. 'MH?') and the tooltip notes 'best-guess attribution'. (2) UNKNOWN — the special Speaker_Unknown pseudo-speaker grouping brief utterances that didn't confidently match any main anchor. Chip is grey ('?'), legend reads 'Unknown', and it sorts to the end of the legend after named speakers. The chip color and class for any given speaker stays stable as before — visual identity is preserved across the transcript. Existing low-confidence rendering (per-segment diarize confidence < 0.5) continues to work; uncertain + low-conf now BOTH trigger the '?' suffix.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.132.ts b/startos/versions/v0.2.132.ts
new file mode 100644
index 0000000..cf41aa7
--- /dev/null
+++ b/startos/versions/v0.2.132.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_132 = VersionInfo.of({
+  version: '0.2.132:0',
+  releaseNotes: {
+    en_US:
+      "Export — three changes. (1) PDF export now includes speaker chips. Each transcript line is prefixed with a small colored rounded-rectangle chip showing the speaker's initials (or cluster letter when no name was inferred), matching the on-screen palette so the same person is the same color in the dashboard, on screen, and in the printed PDF. The PDF also gets a 'SPEAKERS' legend row above the topics list with each speaker's chip + full name + total speaking time, so a reader looking at the PDF cold has a key. Skips entirely when the session had no diarization (older saves, diarization disabled, etc.) so non-diarized PDFs render exactly as before. (2) New Markdown export. Renders a human-readable .md doc with the title, topic count, source link (YouTube), a Speakers section, and per-topic ## headings (with timestamps and YouTube deeplinks) followed by speaker-attributed transcript lines inside an expandable <details> block — the same format the relay's internal-meetings markdown export uses, so a meeting recap and a Recaps export read the same in a markdown viewer. (3) New JSON export. Downloads the raw saved session record verbatim — chunks + entries + speakers + speakerNames + logs — useful for piping into other tools, archiving outside the app, or feeding into an LLM as context. (4) The single 'Export PDF' button on the main view and the per-row icon in the history sidebar now open an 'Export ▾' menu with all three options (PDF / Markdown / JSON). Same component on desktop and mobile — taps to the same 36px-min-height rows that fit a thumb. Closes on outside click or Escape.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.133.ts b/startos/versions/v0.2.133.ts
new file mode 100644
index 0000000..095983d
--- /dev/null
+++ b/startos/versions/v0.2.133.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_133 = VersionInfo.of({
+  version: '0.2.133:0',
+  releaseNotes: {
+    en_US:
+      "Anonymous-trial UX fix. Before: an anonymous visitor on a multi-tenant Recap whose server-side trial allowance had been spent (whether by depleted cookie credits OR by hitting the operator's per-IP cookie-mint cap) would still see 'N free credits ready' in the toolbar — the pill came from the static operator config rather than a real eligibility check. They'd paste a URL, the player + 'Processing…' status would render optimistically, and only AFTER the request hit the server would a generic 'Processing failed — Try again' banner appear (with the player still showing). Three changes. (1) /api/account/whoami now actually checks whether the visitor's server-side identifier (matched on the implementation side) can issue a fresh trial cookie; when the answer is no, returns available_trial_credits: 0 so the toolbar pill flips to a clickable 'Out of free credits' chip + 'Buy credits' button. (2) processUrl() pre-flight gate refuses to start the optimistic flow when the visitor has 0 credits to spend — applies to BOTH anonymous-and-blocked and trial-cookie-with-zero-balance — no player render, no 'Processing…' status, just a clean modal with Sign up / Buy credits / Sign in CTAs. (3) Race fallback: if the trial budget is exhausted BETWEEN the whoami poll and the submit (parallel tabs, etc.), the server's trial_unavailable / trial_exhausted response is now caught explicitly — optimistic state cleared, account state refreshed, same modal shown. The modal copy is deliberately generic ('Out of free credits — sign up to keep going or buy credits a la carte') and doesn't telegraph what specifically is blocking the visitor, so a curious user can't trivially infer a bypass from the error wording. Signing up (fresh account, balance carries over) and buying credits a la carte (no signup, attaches to current browser) are the two paths past the block.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.134.ts b/startos/versions/v0.2.134.ts
new file mode 100644
index 0000000..cf231e0
--- /dev/null
+++ b/startos/versions/v0.2.134.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_134 = VersionInfo.of({
+  version: '0.2.134:0',
+  releaseNotes: {
+    en_US:
+      "Trial-cap IPv6 bypass fix. Discovered while investigating an operator report that a single residential network kept minting fresh trial cookies despite a strict cap. Root cause: most modern dual-stack home networks get both an IPv4 and an IPv6 prefix from their ISP, and browsers/OS routinely rotate the lower 64 bits of their IPv6 source address (RFC 4941 privacy extensions). The cap was counting trials per FULL address, so every IPv6 rotation looked like a new IP to the server and granted a fresh trial-cookie quota — meaning one laptop on one home network could mint a new cookie every hour or so. IPv4 addresses didn't have this problem (your public IPv4 is stable for the life of your ISP lease). Fix: cap counting now keys on the /64 prefix for IPv6 (the smallest network unit an ISP delegates to a subscriber, so it's the correct 'this household / this network' boundary) and the whole address for IPv4 (unchanged). The /64 prefix is the half of the IPv6 address that DOESN'T rotate, so a single device cycling through 1000 different IPv6 addresses still counts as 1 trial cookie under the cap. The DB still stores the full IP for forensics; only the count query uses the prefix. Also added a [anon-trial] minted cookie for ip=X cap_key=Y log line at every mint so operators can grep their relay logs to verify the IP detector is working (a flood of mints with ip=null means the StartOS tunnel isn't passing X-Forwarded-For). Side-effect: operators who had pre-fix mints in their DB will see their per-IPv6 row counts collapse to per-/64 totals on the next request, which may push some networks immediately over a tight cap.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.135.ts b/startos/versions/v0.2.135.ts
new file mode 100644
index 0000000..4667dee
--- /dev/null
+++ b/startos/versions/v0.2.135.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_135 = VersionInfo.of({
+  version: '0.2.135:0',
+  releaseNotes: {
+    en_US:
+      "Subscription auto-processor — fixed a relay-only-user dead-end. Symptom: a subscription check would find a new video, queue it for approval, and log 'Kicking background processor for N approved item(s)…' — and then nothing would happen. No output in the UI, no job submitted to the relay, no error surfaced. Root cause: processItemInternally (the function the background processor uses to internally POST to /api/process) hard-required a local Gemini API key as a pre-flight gate, a legacy check from before the relay-as-provider model. Users with the relay configured but no local Gemini key would fail this check immediately, get caught by the processor's catch block, and silently land their error in the in-memory processingState.log — invisible from the dashboard. /api/process itself was never called. Fix: drop the Gemini-only gate. Auto-queue now prefers the relay when a relay URL is configured (the modern default for fresh installs and the most common setup), falls back to Gemini when only a local key is configured, and fails with a clear, user-visible error when neither is set. Sets transcriptionProvider + analysisProvider + matching model fields on the internal /api/process POST so the request reaches the right backend instead of falling through to the default 'gemini' provider that has no key. Existing Gemini-only setups keep working; existing relay-only setups now actually process subscription-discovered videos.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.136.ts b/startos/versions/v0.2.136.ts
new file mode 100644
index 0000000..00d748f
--- /dev/null
+++ b/startos/versions/v0.2.136.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_136 = VersionInfo.of({
+  version: '0.2.136:0',
+  releaseNotes: {
+    en_US:
+      "Subscription auto-queue log clarity. The 'N in queue' counter on the subscription-check status line was counting EVERY item in the autoQueue file regardless of status — pending, approved, processing, AND completed + failed. Since the queue UI hides completed and failed items by default, operators kept asking 'why does it say 29 in queue when the queue panel is empty?' — the answer being 'because 29 includes everything ever queued, most of which is already done or failed.' Now the line splits the number into active vs done so the dashboard semantics match what the UI shows: 'X in library, Y skipped, Z seen — queue: A active, B done (C completed, D failed)'. When any failed items exist, the sub-check log also surfaces a one-liner pointing the operator at the Queue panel's 'Show all' toggle so they can view + retry. (All four counters — library, skipped, seen, and the FULL queue set including done — are still used for new-video dedup; the change is purely presentational so operators stop misreading the active load.)",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.137.ts b/startos/versions/v0.2.137.ts
new file mode 100644
index 0000000..2f9ddc0
--- /dev/null
+++ b/startos/versions/v0.2.137.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_137 = VersionInfo.of({
+  version: '0.2.137:0',
+  releaseNotes: {
+    en_US:
+      "Audio-first \"Listen\" mode (walking mode). Recaps can now be listened to like a podcast: a new 🎧 Listen button on any saved recap opens a full-screen player that reads each topic summary aloud, back to back, using text-to-speech on the operator's relay (Kokoro via Spark Control, with ElevenLabs as a swappable cloud alternative). The summaries play sequentially — and the moment one sounds interesting, \"Listen to this part\" drops you into the real podcast/video at that exact timestamp; when that segment ends it pops back to the next summary, or you can flip \"Keep playing the original\" to let the source roll on. Lock-screen and headphone controls (play/pause, skip topic) work via the Media Session API, so it's usable hands-free with the phone in your pocket. Clips are synthesized once and cached per recap (one relay credit for the whole recap), and stream in progressively so the first topic starts within about a second while the rest generate. Available to Max users in multi-tenant mode; operators get it on their own hardware. Requires Spark Control v0.14.0+ for the Kokoro TTS backend.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.138.ts b/startos/versions/v0.2.138.ts
new file mode 100644
index 0000000..8a289a3
--- /dev/null
+++ b/startos/versions/v0.2.138.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_138 = VersionInfo.of({
+  version: '0.2.138:0',
+  releaseNotes: {
+    en_US:
+      "Audio-first \"Listen\" mode is now available to Pro subscribers too (previously Max-only). Any paid tier — Pro or Max — can voice a recap and listen to it like a podcast; operators still get it on their own hardware. No other changes.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.139.ts b/startos/versions/v0.2.139.ts
new file mode 100644
index 0000000..85781f3
--- /dev/null
+++ b/startos/versions/v0.2.139.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_139 = VersionInfo.of({
+  version: '0.2.139:0',
+  releaseNotes: {
+    en_US:
+      "Audio-first \"Listen\" player polish: the play button now shows a pause icon while audio is playing (and vice-versa); swipe left/right on the card to move between topic summaries; a speed button cycles 1×–2× playback for both the summaries and the deep-dive source audio. Also made clip generation resilient — if a topic's audio stalls or fails, playback now skips ahead to the next ready topic instead of getting stuck, and a per-clip request timeout keeps one slow synth from blocking the rest.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.140.ts b/startos/versions/v0.2.140.ts
new file mode 100644
index 0000000..6810cd0
--- /dev/null
+++ b/startos/versions/v0.2.140.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_140 = VersionInfo.of({
+  version: '0.2.140:0',
+  releaseNotes: {
+    en_US:
+      "Audio player reliability: clips are now generated on demand as you reach each topic (and the next one is pre-fetched), and the player WAITS and keeps retrying for a topic's audio instead of skipping it. If a clip isn't ready, you'll see a clear \"Preparing the audio for this topic…\" status rather than silence. A background pass still pre-generates the whole recap in order so clips are usually ready before you arrive, and a per-clip timeout keeps one slow synthesis from blocking the rest.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.141.ts b/startos/versions/v0.2.141.ts
new file mode 100644
index 0000000..94555f5
--- /dev/null
+++ b/startos/versions/v0.2.141.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_141 = VersionInfo.of({
+  version: '0.2.141:0',
+  releaseNotes: {
+    en_US:
+      "Audio player: (1) Pausing now sticks — moving to the next/previous topic summary while paused keeps it paused instead of auto-restarting. (2) Follow-along transcript: when you tap \"Listen to this part\" to hear the original source, the word-for-word transcript now appears and scrolls/highlights as it plays. Scroll it freely and tap any line to jump the source audio to that exact moment (just like the main app), then tap \"Back to the summary\" to return to the recap.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.142.ts b/startos/versions/v0.2.142.ts
new file mode 100644
index 0000000..3e9f9ca
--- /dev/null
+++ b/startos/versions/v0.2.142.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_142 = VersionInfo.of({
+  version: '0.2.142:0',
+  releaseNotes: {
+    en_US:
+      "Audio player follow-along transcript now shows just the section you're listening to, rather than the whole recap's transcript — so you can't scroll off into unrelated future sections. If you turn on \"Keep playing the original,\" the transcript automatically advances to the next section as playback crosses into it.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.143.ts b/startos/versions/v0.2.143.ts
new file mode 100644
index 0000000..fda0836
--- /dev/null
+++ b/startos/versions/v0.2.143.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_143 = VersionInfo.of({
+  version: '0.2.143:0',
+  releaseNotes: {
+    en_US:
+      'Decouples your Recaps Pro/Max subscription from the Keysat license. Paid plans are now owned by the Recap Relay and keyed to your Recaps account — no per-user license required. Operators can set a tenant\'s tier right from the Tenants panel, and a new "Set Relay Operator Key" action links this server to the relay so it can vouch for its paid users by account-id.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.144.ts b/startos/versions/v0.2.144.ts
new file mode 100644
index 0000000..7090615
--- /dev/null
+++ b/startos/versions/v0.2.144.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_144 = VersionInfo.of({
+  version: '0.2.144:0',
+  releaseNotes: {
+    en_US:
+      'Core-decoupling fixes. The operator Tenants panel no longer clips the per-row action buttons, so the Core/Pro/Max tier selector is reachable. The Pro/Max badge a signed-in user sees now follows their relay-owned tier (set from the Tenants panel) instead of any leftover Keysat license, so the badge always matches what the operator panel shows. Free-tenant credit gating + balance display likewise key off tier, not the legacy license.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.145.ts b/startos/versions/v0.2.145.ts
new file mode 100644
index 0000000..e7b678e
--- /dev/null
+++ b/startos/versions/v0.2.145.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_145 = VersionInfo.of({
+  version: '0.2.145:0',
+  releaseNotes: {
+    en_US:
+      'Subscription fixes. (1) The auto-queue no longer re-adds videos you\'ve already summarized or declined — the duplicate-detection now scans your real library (it was scanning the wrong directory and finding nothing, so cleared/processed items kept reappearing). (2) In multi-tenant mode, channel/podcast subscriptions and the auto-queue are now operator-managed: signed-in tenants no longer see the operator\'s subscription queue. (Per-tenant subscriptions remain a future enhancement.)',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.146.ts b/startos/versions/v0.2.146.ts
new file mode 100644
index 0000000..fea5104
--- /dev/null
+++ b/startos/versions/v0.2.146.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_146 = VersionInfo.of({
+  version: '0.2.146:0',
+  releaseNotes: {
+    en_US:
+      'Completes the subscription isolation in multi-tenant mode: library export/import no longer includes the operator\'s channel/podcast subscriptions for signed-in tenants (only the operator round-trips subscription state). Builds on 0.2.145, which fixed the auto-queue re-adding already-summarized videos and made subscriptions operator-managed so tenants stop seeing the operator\'s queue.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.147.ts b/startos/versions/v0.2.147.ts
new file mode 100644
index 0000000..e10b697
--- /dev/null
+++ b/startos/versions/v0.2.147.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_147 = VersionInfo.of({
+  version: '0.2.147:0',
+  releaseNotes: {
+    en_US:
+      'Internal: subscription storage (subscriptions, auto-queue, skip/seen lists) is now per-scope and serialized against concurrent edits, with a one-time migration that moves the operator\'s existing subscription state into its own scope. No change to how subscriptions work for you today — this is the foundation for per-tenant subscriptions, leaving only the background-processor identity step (which needs on-device testing) before paid tenants can run their own.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.148.ts b/startos/versions/v0.2.148.ts
new file mode 100644
index 0000000..3aaa2c7
--- /dev/null
+++ b/startos/versions/v0.2.148.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_148 = VersionInfo.of({
+  version: '0.2.148:0',
+  releaseNotes: {
+    en_US:
+      'Fixes + polish. (1) Removes a phantom "Invalid Date · undefined topics" library entry introduced by the 0.2.147 subscription migration — the migrated subscription state files were being listed as if they were recaps; they\'re now correctly excluded from the library (and from library export). Your real recaps were never affected. (2) The operator Tenants panel hides the per-user "Tier" control on instances that don\'t hold the relay operator key, since setting a relay-owned tier only works on the operator\'s own instance. (3) The Settings panel no longer jumps back to the top or flashes when you edit a tenant (e.g. set a tier).',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.149.ts b/startos/versions/v0.2.149.ts
new file mode 100644
index 0000000..a6a112d
--- /dev/null
+++ b/startos/versions/v0.2.149.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_149 = VersionInfo.of({
+  version: '0.2.149:0',
+  releaseNotes: {
+    en_US:
+      'Per-tenant subscriptions. Every Pro/Max user now gets their OWN channel & podcast subscriptions and auto-queue, and approved episodes are summarized under their own account — their credits, their library, their relay pool. The background processor runs each item as its owner via a short-lived internal session (no auth bypass: a bad token just fails the item). This also fixes the operator\'s own subscription auto-processing in multi-tenant mode, which previously had no identity on its internal call. Single-mode installs are unchanged.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.150.ts b/startos/versions/v0.2.150.ts
new file mode 100644
index 0000000..65717e0
--- /dev/null
+++ b/startos/versions/v0.2.150.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_150 = VersionInfo.of({
+  version: '0.2.150:0',
+  releaseNotes: {
+    en_US:
+      "Reading stays put. If you open a saved episode while another video is still processing, the live analysis windows no longer yank the page over to the new video — you keep your place. The job keeps running in the background, lands in your library when it's done, and you get a small \"ready\" notification instead. Batch-queue items follow the same rule, so a queue churning in the background won't pull you off what you're reading.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.151.ts b/startos/versions/v0.2.151.ts
new file mode 100644
index 0000000..a0f0c0d
--- /dev/null
+++ b/startos/versions/v0.2.151.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_151 = VersionInfo.of({
+  version: '0.2.151:0',
+  releaseNotes: {
+    en_US:
+      'Collapsing an expanded segment transcript now keeps your scroll position instead of snapping the analysis window back to the top — so you land right back on the segment you were reading.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.152.ts b/startos/versions/v0.2.152.ts
new file mode 100644
index 0000000..07a1668
--- /dev/null
+++ b/startos/versions/v0.2.152.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_152 = VersionInfo.of({
+  version: '0.2.152:0',
+  releaseNotes: {
+    en_US: 'Self-serve subscription purchase: signed-in users can buy Pro or Max with Bitcoin (Lightning) — pick a plan, pay, and your tier activates automatically. Pay-by-card coming soon.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.153.ts b/startos/versions/v0.2.153.ts
new file mode 100644
index 0000000..737f752
--- /dev/null
+++ b/startos/versions/v0.2.153.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_153 = VersionInfo.of({
+  version: '0.2.153:0',
+  releaseNotes: {
+    en_US: 'Pay by card: buy Pro or Max with a card via Zaprite, alongside Pay with Bitcoin. The card option appears once the operator configures Zaprite on the relay.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.154.ts b/startos/versions/v0.2.154.ts
new file mode 100644
index 0000000..4bc15f5
--- /dev/null
+++ b/startos/versions/v0.2.154.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_154 = VersionInfo.of({
+  version: '0.2.154:0',
+  releaseNotes: {
+    en_US: 'Subscription expiry reminders: a daily scan emails users a 7-day and 1-day heads-up before their prepaid Pro/Max period ends, plus a lapsed notice, via the recaps.cc SMTP. Adds a Renew deep-link and an operator test trigger.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.155.ts b/startos/versions/v0.2.155.ts
new file mode 100644
index 0000000..5c44f56
--- /dev/null
+++ b/startos/versions/v0.2.155.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_155 = VersionInfo.of({
+  version: '0.2.155:0',
+  releaseNotes: {
+    en_US: 'Pay with Bitcoin now shows an inline Lightning QR on the same screen (no redirect), matching the buy-credits flow. The pill matches the standard purple, and tier cards show each plan\'s real relay-credit allotment from the operator quota config.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.48.ts b/startos/versions/v0.2.48.ts
new file mode 100644
index 0000000..f8e5a91
--- /dev/null
+++ b/startos/versions/v0.2.48.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_48 = VersionInfo.of({
+  version: '0.2.48:0',
+  releaseNotes: {
+    en_US: 'Recap now opens straight to the main page instead of the activation screen. Anyone curious about upgrading clicks the highlighted Upgrade pill in the toolbar; the "I have a key" button (also in the toolbar) is the path for users who already have a license. The activation modal still works the same way — just not auto-shown on first launch.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.49.ts b/startos/versions/v0.2.49.ts
new file mode 100644
index 0000000..d0d55f4
--- /dev/null
+++ b/startos/versions/v0.2.49.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_49 = VersionInfo.of({
+  version: '0.2.49:0',
+  releaseNotes: {
+    en_US: 'In-app buy page: clicking Upgrade now opens a Recap-styled tier-picker modal instead of redirecting to Keysat\'s hosted /buy/recap page. Tiers are pulled live from Keysat\'s policies API (so operator edits in Keysat admin show up without a Recap redeploy), rendered with marketing bullets + price + cadence suffix + featured-discount badges, and checkout opens in a new tab. After payment, the modal polls /api/license/poll/<invoiceId> every 4s and activates the issued license server-side once BTCPay settles. All five Upgrade buttons (toolbar, activation screen, license block, Pro upsell, etc.) point at the new modal.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.50.ts b/startos/versions/v0.2.50.ts
new file mode 100644
index 0000000..4dd1b58
--- /dev/null
+++ b/startos/versions/v0.2.50.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_50 = VersionInfo.of({
+  version: '0.2.50:0',
+  releaseNotes: {
+    en_US: 'Fix: buy modal now shows correct prices and marketing bullets. The Keysat SDK\'s listPublicPolicies() helper strips marketing_bullets, featured_discount, hidden_entitlements, and uses camelCase field names — incompatible with what the modal renders. Switched /api/license/policies to call the underlying public HTTP endpoint directly so the full snake_case shape (price_sats, marketing_bullets, is_recurring, etc.) reaches the frontend intact.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.51.ts b/startos/versions/v0.2.51.ts
new file mode 100644
index 0000000..3d6a9a3
--- /dev/null
+++ b/startos/versions/v0.2.51.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_51 = VersionInfo.of({
+  version: '0.2.51:0',
+  releaseNotes: {
+    en_US: 'Highlighted tier card now renders with a brighter purple border, an upward shift, and a stronger glow — much harder to miss than the previous subtle treatment. Policies cache shortened from 60s to 30s so operator edits in Keysat admin show up in the buy modal within ~30 seconds. (Note: to actually see the highlight, mark the policy as "Most popular" / Highlighted in Keysat admin first.)',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.52.ts b/startos/versions/v0.2.52.ts
new file mode 100644
index 0000000..f0bd2b0
--- /dev/null
+++ b/startos/versions/v0.2.52.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_52 = VersionInfo.of({
+  version: '0.2.52:0',
+  releaseNotes: {
+    en_US: 'Buy modal gains a discount-code interim step. Clicking Select on a tier now opens a small form (in Recap colors): "Discount code (optional)" + Apply / Continue without code / ← Back. Apply previews the adjusted price (base, savings, final) before the buyer is sent to BTCPay; Continue without code skips straight to checkout at the standard price. Highlighted tier badge + border now have a stronger purple visual (lifted card, 2px border, glow). Policies cache shortened from 60s to 30s so operator edits in Keysat admin (e.g. flipping "Most popular" on Pro) propagate within ~30 seconds.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.53.ts b/startos/versions/v0.2.53.ts
new file mode 100644
index 0000000..92b6ae7
--- /dev/null
+++ b/startos/versions/v0.2.53.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_53 = VersionInfo.of({
+  version: '0.2.53:0',
+  releaseNotes: {
+    en_US: 'Fix: discount-code apply was failing with "missing field `product`". The Keysat /v1/purchase endpoint expects `product` as the body field name, not `product_slug` as the developer-facing spec implied — the SDK source confirms `product`. Swapped the field name; Apply code now actually creates the invoice with the discount applied.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.54.ts b/startos/versions/v0.2.54.ts
new file mode 100644
index 0000000..08a4184
--- /dev/null
+++ b/startos/versions/v0.2.54.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_54 = VersionInfo.of({
+  version: '0.2.54:0',
+  releaseNotes: {
+    en_US: 'Fix: discount-code Apply did nothing visible (screen flashed, no preview rendered). The Keysat /v1/purchase response returns the post-discount price as `amount_sats` (and `base_price_sats` for the original sticker price), not `final_price_sats` as the developer-facing spec implied. Frontend now reads the correct field names, so the green preview panel ("Base price → You save → You pay now") renders with the real numbers after Apply.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.55.ts b/startos/versions/v0.2.55.ts
new file mode 100644
index 0000000..f126cc7
--- /dev/null
+++ b/startos/versions/v0.2.55.ts
@@ -0,0 +1,17 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_55 = VersionInfo.of({
+  version: '0.2.55:4',
+  releaseNotes: {
+    en_US:
+      'Three flagship features for the relay + share-URL pipeline:\n\n' +
+      '• Apple Podcasts share URLs (podcasts.apple.com/...?i=...) are now resolved automatically — paste the share link and Recap turns it into the underlying audio enclosure via iTunes Lookup. No more digging up the RSS feed.\n\n' +
+      '• Spotify episode share URLs (open.spotify.com/episode/...) are resolved via PodcastIndex when the operator configures a free PodcastIndex API key under StartOS → Recap → Actions → "Set PodcastIndex Credentials". Spotify Originals/exclusives that have no public RSS get a clear, actionable error.\n\n' +
+      '• Relay-URL fast-path: when transcription routes through the operator\'s relay AND we have a public source URL, Recap hands the URL directly to the relay so it can download the audio over its symmetric datacenter pipe instead of asking the buyer to upload 100MB of MP3 from a home connection. Often shaves the slowest leg off the whole pipeline. Falls back to the local-download path transparently if the relay rejects or fails.\n\n' +
+      'Also: when the relay reports hardware-capable backends via /relay/capabilities (operator routing prefers Parakeet), Recap skips audio chunking entirely — full file goes through in one shot.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.56.ts b/startos/versions/v0.2.56.ts
new file mode 100644
index 0000000..9d5faf5
--- /dev/null
+++ b/startos/versions/v0.2.56.ts
@@ -0,0 +1,17 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_56 = VersionInfo.of({
+  version: '0.2.56:0',
+  releaseNotes: {
+    en_US:
+      'Buy relay credits in-app via Lightning.\n\n' +
+      '• New "Buy more →" button next to the credit-balance pill in the AI Providers settings block. Opens a modal styled to match the existing license-purchase flow.\n\n' +
+      '• Pick a bundle (1, 5, 10, or 20 credits — pricing operator-set on the relay side), modal opens the BTCPay checkout in a new tab. Once the invoice settles, the modal updates the balance pill and shows a confirmation toast — usually within a few seconds for Lightning payments.\n\n' +
+      '• Purchased credits never expire. They\'re consumed only after your tier\'s comped allotment runs out, so monthly comped credits keep coming as usual.\n\n' +
+      '• Requires the operator to wire BTCPay on the relay side (v0.2.14+ of the relay). When BTCPay isn\'t configured the "Buy more →" still appears but the modal surfaces a "contact the operator" message.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.57.ts b/startos/versions/v0.2.57.ts
new file mode 100644
index 0000000..1d8b4a4
--- /dev/null
+++ b/startos/versions/v0.2.57.ts
@@ -0,0 +1,16 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_57 = VersionInfo.of({
+  version: '0.2.57:10',
+  releaseNotes: {
+    en_US:
+      'Relay transcribe-url now uses async job polling.\n\n' +
+      'The relay-URL fast-path used to hold one HTTP connection open for the entire transcribe duration — minutes to tens of minutes for long audio. That broke when any proxy or load balancer in the network path silently dropped the long-running connection mid-flight, with the symptom "fetch failed (other side closed)".\n\n' +
+      'Recap now POSTs to the relay, gets back a job_id immediately, and polls GET /relay/jobs/:id every 5 seconds until the job lands as "complete" or "failed". Poll requests are short and cheap so no proxy in the path can drop them. The relay surfaces incremental progress messages ("downloading…", "transcribing 105 min audio…") via the poll response so the activity log keeps moving while the background work runs.\n\n' +
+      'Requires Recap Relay 0.2.15 or newer (which serves the async job endpoint). Older relay versions return the old sync response shape; Recap detects this and surfaces a clear "old relay version" error rather than spinning.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.58.ts b/startos/versions/v0.2.58.ts
new file mode 100644
index 0000000..79e5881
--- /dev/null
+++ b/startos/versions/v0.2.58.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_58 = VersionInfo.of({
+  version: '0.2.58:0',
+  releaseNotes: {
+    en_US: 'Mobile rendering pass. Three CSS fixes for phone-width screens: (1) Credits pill + Buy-more button no longer overlap the URL input — they were wrapping into the search row at narrow widths. The pills now hide on phones and the same info remains accessible from Settings. (2) Library and Activity Log side panels now cover the full viewport width on phones (was 85-92vw, which left a strip of main content visible behind them). (3) The topics/segments/total stats line no longer renders twice when the results view stacks vertically — the duplicate copy in the left column is hidden on mobile. Tablet and desktop layouts unchanged.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.59.ts b/startos/versions/v0.2.59.ts
new file mode 100644
index 0000000..001516f
--- /dev/null
+++ b/startos/versions/v0.2.59.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_59 = VersionInfo.of({
+  version: '0.2.59:0',
+  releaseNotes: {
+    en_US: 'Topic analysis is now chunked-and-parallel on long content. Previously, a 2-hour transcript meant one giant analyze call against ~25K tokens of prompt — long prefill, single point of failure, and minutes of wall-time even on fast backends. Now, content longer than 25 minutes is split into overlapping 18-minute windows (with a 2-minute overlap on each side to handle topic boundaries that span windows) and the windows are analyzed in parallel (up to 4 concurrent calls). Results are stitched back into a single ordered list of sections with no overlap, using a "trust the second window for the overlap region" rule that prevents boundary fragmentation. Short content (≤25 min) still single-shots as before — no overhead for the common case. End-to-end speedup is typically 3-5x on 1+ hour content, and even larger when paired with the relay\'s recent JSON-mode/thinking-off change (relay 0.2.16). Works across all backends (relay, direct Gemini, OpenAI, Anthropic, Ollama) since chunking happens at the orchestrator level.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.60.ts b/startos/versions/v0.2.60.ts
new file mode 100644
index 0000000..013240b
--- /dev/null
+++ b/startos/versions/v0.2.60.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_60 = VersionInfo.of({
+  version: '0.2.60:0',
+  releaseNotes: {
+    en_US: 'Section-boundary precision improvement on long content. The pre-analyze coalesce step (which merged adjacent transcript entries down to ~400 max so a single huge analyze prompt would fit in a local LLM\'s context window) was a holdover from before chunking existed. With the chunked-analyze path shipped in 0.2.59, each 18-minute window only sees ~216 entries at 5-second Parakeet segments — well under any reasonable model\'s context. Coalescing first was unnecessary AND was hurting precision: section starts could only land on ~18-second boundaries because that\'s how coarsely the LLM saw the transcript. Now: content >25 min skips the coalesce entirely and feeds full-granularity entries to the chunker; content ≤25 min still coalesces (safety net for tiny-context local models on the single-shot path). Net effect on long content: section boundaries can now land within ~5 seconds of the actual topic shift instead of being rounded to ~18-second buckets. No change to transcript display granularity (always full).',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.61.ts b/startos/versions/v0.2.61.ts
new file mode 100644
index 0000000..51c3a6e
--- /dev/null
+++ b/startos/versions/v0.2.61.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_61 = VersionInfo.of({
+  version: '0.2.61:0',
+  releaseNotes: {
+    en_US: 'Topics now stream into the UI as they\'re ready — no more waiting through a blank loading screen for long content. As soon as transcription completes, the results view appears with the video and an empty topics list; each topic section then pops into the list at its correct time position as the model finishes analyzing it. A small "Analyzing topics… X/Y sections ready" indicator at the bottom of the list shows the running count and disappears when all windows finish. Works in concert with the chunked-analyze (0.2.59) and skip-coalesce (0.2.60) changes: on a 2-hour video that previously sat on a spinner for 90+ seconds, you now see the first topic appear about 10-15 seconds after transcription completes, and the full set fills in over the next ~30 seconds. Short content (≤25 min, single-shot analyze) is unchanged — single call, single result render, same as before.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.62.ts b/startos/versions/v0.2.62.ts
new file mode 100644
index 0000000..c0ea763
--- /dev/null
+++ b/startos/versions/v0.2.62.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_62 = VersionInfo.of({
+  version: '0.2.62:0',
+  releaseNotes: {
+    en_US: 'Mobile UX cleanup pass plus Gemini model fixes. (1) iOS Safari no longer auto-zooms the page when you tap into the URL input on mobile — the input\'s font-size is now 16px (Safari\'s anti-zoom threshold) at every mobile breakpoint, which keeps the Summarize button from getting pushed off the right edge on focus. (2) URL input placeholder shortened from "Paste a YouTube video, channel, or podcast RSS URL…" to "YouTube or podcast URL…" so it doesn\'t truncate mid-word on phone widths. (3) The "Processing" banner that appears while a video is in flight now truncates long YouTube URLs (with tracking params) at 45 chars + … and makes the Cancel button non-shrinkable, so it can\'t get cut off on narrow screens. (4) Activity log line "Relay capabilities: max 60 min / 30 MB / chunk=2700 (routing this install to Gemini (pref=gemini_first, tier=core))" replaced with plain-language "Relay will transcribe up to 60 minutes per upload." — internal routing tiers / preferences are no longer surfaced to end users. (5) Gemini Flash model identifiers dropped the "-preview" suffix (3.1-flash-preview → 3.1-flash, 3-flash-preview → 3-flash) since Google has retired the preview-named endpoints. Pro variants are unchanged for now; if those also start 404\'ing we\'ll do the same rename pass. The transcription model dropdown now prefers gemini-3.1-flash as the default since it\'s the newest stable Flash.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.63.ts b/startos/versions/v0.2.63.ts
new file mode 100644
index 0000000..1528496
--- /dev/null
+++ b/startos/versions/v0.2.63.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_63 = VersionInfo.of({
+  version: '0.2.63:0',
+  releaseNotes: {
+    en_US: 'Gemini model list cleanup. The Settings → API Keys → Gemini dropdowns now show exactly 5 currently-valid models, verified against Google\'s official docs (ai.google.dev/gemini-api/docs/models): gemini-3.1-pro-preview, gemini-3-flash-preview, gemini-3.1-flash-lite, gemini-2.5-pro, and gemini-2.5-flash. Removed the never-existed gemini-3.1-flash entries from the prior release (Google never had that model — was the source of the 404 errors), the gemini-3-pro-preview entries (Google shut it down 2026-03-09), and gemini-2.0-flash (deprecated). Transcription default is now gemini-3-flash-preview (the actual "Gemini 3 Flash" — Pro-class quality at Flash pricing); analysis default remains gemini-3.1-pro-preview. Fallback chain order: Flash-first for transcription, Pro-first for analysis. Plus: minimize-video button is now visible on mobile (previously hover-only, which never fired on touch devices).',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.64.ts b/startos/versions/v0.2.64.ts
new file mode 100644
index 0000000..4bd39d0
--- /dev/null
+++ b/startos/versions/v0.2.64.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_64 = VersionInfo.of({
+  version: '0.2.64:0',
+  releaseNotes: {
+    en_US: 'Speed + UI fixes for long content. (1) Client-side audio chunking now runs in parallel (up to 6 chunks in flight) instead of serially. Previously, a 90-min video split into 2 chunks would transcribe them one after the other; now they overlap, halving wall-time on the multi-chunk path. Out-of-order completion is handled correctly via index-based merge after all chunks return. (2) Topic-analysis concurrency bumped from 4 to 12 in-flight windows. Stays well under Gemini paid Tier 1 RPM caps (1000 RPM for flash, 150 RPM for pro) and saturates a single Spark for the operator-hardware path. (3) Periodic relay-status poll no longer triggers a full re-render every 60 seconds. The poll now compares previous vs new relay state and only re-renders if something actually changed — eliminates the full-screen flicker and scroll-jump that was happening on every minute mark. (4) Clicking the chevron on an activity-log group header now toggles only that group\'s body display + chevron icon instead of rebuilding the entire app DOM. No more flash-and-scroll-to-top when collapsing a log section. (5) YouTube embed no longer flickers / goes black after Cancel mid-stream. The render-time mount logic now checks whether the yt-player div already has an iframe child; if so, the existing player is left in place instead of destroyed and recreated.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.65.ts b/startos/versions/v0.2.65.ts
new file mode 100644
index 0000000..2cb0479
--- /dev/null
+++ b/startos/versions/v0.2.65.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_65 = VersionInfo.of({
+  version: '0.2.65:0',
+  releaseNotes: {
+    en_US: 'Per-minute flicker actually fixed this time. The earlier fix in 0.2.64 compared the full relay-status object before vs after each 60s poll and re-rendered if anything differed — but the server stamps a lastUpdated timestamp on every response, so the comparison always saw a diff and the full re-render fired every minute anyway. Now compares only the user-visible fields (credits remaining, tier, configured flag, last error). Render only fires when something on screen actually changed.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.66.ts b/startos/versions/v0.2.66.ts
new file mode 100644
index 0000000..1f5c9f3
--- /dev/null
+++ b/startos/versions/v0.2.66.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_66 = VersionInfo.of({
+  version: '0.2.66:0',
+  releaseNotes: {
+    en_US:
+      'Recap Relay mode: unified single-call pipeline + UI consolidation. (1) Provider picker collapsed into a two-mode chooser at the top: [Recap Relay] vs [Custom Provider / Local]. Picking Recap Relay means the operator\'s relay does the WHOLE pipeline (download + transcribe + analyze) server-side — one credit per summary, no per-step configuration needed. Picking Custom unlocks two independent per-step pickers (Gemini, Claude, OpenAI, local OpenAI-compatible, Ollama, Whisper); the relay is intentionally no longer offered for individual steps because mixing relay-for-one-step with direct-for-the-other left credit accounting in a muddy state. (2) Relay mode now calls the new POST /relay/summarize-url endpoint (requires Recap Relay v0.2.33+) instead of the old transcribeUrl + N-times-analyze fan-out. The browser receives the same SSE events (transcript_ready, sections_partial, result) it always has, so incremental rendering is unchanged from the user\'s POV — but under the hood the transcript never has to leave the relay just for Recap to slice it into 12 prompts and ship them back. Saves ~12 round-trips per long video and lets the operator\'s Settings-tab chunking knobs actually drive production behavior. (3) Migration: existing localStorage entries with both pickers set to relay → land in the new "Recap Relay" mode automatically. Anything else → "Custom Provider" mode, with any stale per-step "relay" picks bumped to the first non-relay alternative so the saved config remains valid. No data loss; no user action required after upgrade. (4) Operators running an older relay (<0.2.33) will see relay-mode jobs fail with a clear "old relay version — re-install relay 0.2.33 or newer" error message rather than a generic 404 — switch to Custom mode while you wait for the operator to upgrade.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.67.ts b/startos/versions/v0.2.67.ts
new file mode 100644
index 0000000..a3794e4
--- /dev/null
+++ b/startos/versions/v0.2.67.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_67 = VersionInfo.of({
+  version: '0.2.67:0',
+  releaseNotes: {
+    en_US:
+      'Chunked-transcribe robustness fixes triggered by a real-world failure on a 94-min YouTube podcast: gemini-3.1-flash-lite (the fallback model the chain walked to after gemini-2.5-flash kept 400ing on "Thinking level not supported") emitted absurd timestamps like [10:12:44] on a 45-min chunk. Those bogus offsets then poisoned the chunk-merge step (which uses a running-max comparison to dedupe boundary overlaps) — every subsequent chunk\'s entries were silently dropped because their valid offsets were "earlier" than chunk 1\'s 10-hour-claimed last entry. UI ended up showing the 94-min video as a 10:12:44 transcript with section timestamps wildly mismatched. Fixes: (1) Each audio chunk now carries its true durationSec (different from the configured chunkSeconds when it\'s the trailing chunk) so the merge step has a real time-window upper bound to validate against. (2) After parsing a chunk\'s transcribe output, drop any entry whose offset exceeds the chunk\'s end + 10s tolerance. A warning logs the count of dropped segments and the worst offset so the operator can see which model misbehaved. (3) Sort each chunk\'s entries by offset before merging — defends against models that emit segments out of chronological order (which broke the merge\'s monotonic-greater-than dedupe rule). (4) Only send thinkingConfig: {thinkingLevel: "minimal"} to Gemini 3.x flash models. Gemini 2.5 flash uses a different param shape (thinkingBudget integer) and 400s on thinkingLevel — was causing the noisy fallback spam every chunk on 2.5-flash. (5) Clearer log message for the single-shot analyze path: distinguishes "content fits in single shot (≤25 min)" from "only one analyze window planned (sparse entries — usually a sign of bad upstream transcribe data)". Net effect on the failing 94-min episode going forward: the bogus [10:12:44] entries get dropped before they poison the merge, chunk 2 + chunk 3 entries land in the final transcript, the UI shows the correct ~94-min duration, and section timestamps line up with where things actually happened in the audio.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.68.ts b/startos/versions/v0.2.68.ts
new file mode 100644
index 0000000..35dfca5
--- /dev/null
+++ b/startos/versions/v0.2.68.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_68 = VersionInfo.of({
+  version: '0.2.68:0',
+  releaseNotes: {
+    en_US:
+      'Two transcribe/analyze bugs surfaced by a 94-min YouTube run with gemini-3.1-flash-lite. (1) maxOutputTokens raised to 65,536 on Gemini transcribe calls. Default Gemini cap (~8,192) was silently truncating long-chunk transcripts mid-stream — observed a 45-min chunk that returned only 31:05 worth of speech (14 min missing) and another chunk that returned 2:05 of 45:00 (43 min missing). With the explicit limit, flash-lite has room to emit the full transcript; models with smaller native caps clamp internally. (2) Truncation detection: the chunk-transcribe loop now computes coverage = (last_entry_offset − chunk_start) / chunk_duration. When coverage drops below 80% on chunks longer than a minute, a loud warning logs the missing-seconds count, the model name, and a suggestion to swap to a model with bigger output capacity or shrink chunk size. Coverage % also shown on the normal per-chunk completion log so the operator can spot near-misses. (3) Gap-handling in planAnalysisWindows. When TX produces a hole in the timeline (e.g., chunk 2 truncated → entries jump from 31:05 to 1:30:00), the old planner BROKE at the gap because the next entry sat past the window\'s end. Anything after the gap (a perfectly fine chunk 3 with full content) silently never got analyzed. New behavior: when a gap is detected, advance the body cursor forward to the next entry\'s body-stride boundary and keep planning windows instead of stopping. End result on the failing 94-min run: even if TX still truncates middle chunks (less likely after fix #1, but possible), the analyze pipeline will at least cover all entries that DID make it into the transcript instead of silently dropping the post-gap tail.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.69.ts b/startos/versions/v0.2.69.ts
new file mode 100644
index 0000000..10c0e16
--- /dev/null
+++ b/startos/versions/v0.2.69.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_69 = VersionInfo.of({
+  version: '0.2.69:0',
+  releaseNotes: {
+    en_US:
+      'Post-license-activation UX fixes. (1) Top-bar tier badge: explicit "PRO" (purple) or "MAX" (gold) pill appears next to the relay-credits count the moment a paid license activates, so the operator gets immediate visual confirmation instead of having to infer it from the Upgrade button disappearing. Reads from license entitlements directly (authoritative source) rather than the relay-side tier field (which can briefly lag during cache refresh). (2) Relay-credits pill now refreshes immediately after license activation instead of waiting for the next 60-second poll tick. loadAfterLicensed() — which runs after a successful /api/license/activate — now also calls loadRelayStatus(forceRefresh=true) which passes ?refresh=1 so the Recap server bypasses its 10-second relayState cache and pings the operator\'s relay /relay/balance right now. The relay\'s keysat-client validates the newly-saved license proof on its end and returns the new tier + monthly credit quota. Net effect: paid a BTCPay invoice for a Pro license → click "I have a key" + paste → see PRO badge + 50 (or whatever Pro\'s monthly cap is) relay credits within ~1 second, instead of seeing stale "core · 6 credits" for up to a minute. (3) Render call added after the forced refresh so the new badge + credit count surface without a page reload.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.70.ts b/startos/versions/v0.2.70.ts
new file mode 100644
index 0000000..b73311c
--- /dev/null
+++ b/startos/versions/v0.2.70.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_70 = VersionInfo.of({
+  version: '0.2.70:0',
+  releaseNotes: {
+    en_US:
+      'Library entries now carry the real video / podcast title for relay-mode submissions instead of falling back to "Untitled". Root cause: when both transcribe-provider and analyze-provider are set to "Recap Relay", Recap takes a fast-path branch (server/index.js ~line 2118) that delegates the whole pipeline to the relay\'s /relay/summarize-url endpoint — meaning Recap itself never runs yt-dlp to fetch YouTube metadata, never invokes the podcast resolver, and so has no title to save with the history record. The relay DID extract the title internally (via yt-dlp during the download step) but didn\'t echo it back. Fix is split across the two packages: relay 0.2.53 adds `title` to the markComplete result envelope; this Recap release reads `relayResult.title` from the provider client return value (server/providers/relay.js), trims it, and uses it for the saveToHistory call AND the transcript_ready + result SSE events the browser consumes. Net effect: paste a YouTube URL with both providers set to relay, see "Sovereignty & Purpose in the Information Era w/ Matt Hill" (or whatever the actual YouTube title is) in the library sidebar — not "Untitled". Backwards compatible with older relays: when finalResult.title is null (relay < 0.2.53), the old titleSurrogate fallback path still applies.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.71.ts b/startos/versions/v0.2.71.ts
new file mode 100644
index 0000000..9f9954d
--- /dev/null
+++ b/startos/versions/v0.2.71.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_71 = VersionInfo.of({
+  version: '0.2.71:0',
+  releaseNotes: {
+    en_US:
+      'Real fix for the "Untitled" library entry bug, after v0.2.70\'s round-trip-the-title fix turned out to be incomplete. Root cause traced: server/index.js\'s relay-mode branch was passing `titleHint: titleSurrogate` to the relay, where `titleSurrogate = itemTitle || "Untitled"`. So when the operator pasted a fresh URL with no client-supplied title, Recap shipped the literal string `"Untitled"` to the relay as the title hint. The relay\'s yt-dlp-fallback gate is `if (!title && audio.title) title = audio.title` — and `!"Untitled"` is FALSE (the string is truthy), so the yt-dlp-extracted title was never used. The relay then echoed `"Untitled"` back in its completion envelope, Recap read it as authoritative, and the library entry persisted as "Untitled" forever — despite yt-dlp having successfully fetched the real video title in the background. Fixed by passing `titleHintRaw = itemTitle ? String(itemTitle).trim() : ""` (raw operator/subscription title only, NOT the surrogate). The provider\'s `title: titleHint || undefined` then correctly omits the field from the JSON body when there\'s no real title, and the relay\'s yt-dlp fallback fires as designed. `titleSurrogate` is still kept around as the display fallback for activity-log messages and for the (rare) case where the relay also can\'t determine a title. Paired with relay 0.2.57\'s defensive normalization (treats both empty string AND literal "Untitled" as "no title supplied") so older Recap clients running pre-0.2.71 also benefit once the relay is upgraded.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.72.ts b/startos/versions/v0.2.72.ts
new file mode 100644
index 0000000..620b2d9
--- /dev/null
+++ b/startos/versions/v0.2.72.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_72 = VersionInfo.of({
+  version: '0.2.72:0',
+  releaseNotes: {
+    en_US:
+      'Server-side defensive title sanitization at the /api/process boundary. v0.2.71 fixed the title flow by changing the BROWSER code to send empty string when itemTitle is empty (instead of the "Untitled" sentinel). But a stale browser cache — or a future client variant — might still submit the literal string "Untitled" as the title, which would defeat the whole title-resolution chain (relay\'s yt-dlp fallback gate is `if (!title && audio.title)` which treats "Untitled" as truthy). Now: the moment `req.body.title` arrives at the Recap server, we trim whitespace and strip the value to empty if it equals "" OR (case-insensitively) "untitled". All downstream code (titleSurrogate, titleHintRaw passed to the relay, the saveToHistory fallback) can rely on "itemTitle is either a real title or empty" without checking for sentinel values. Net effect: even a browser running outdated SPA code submits "Untitled" → the server normalizes it to "" → the relay receives no title field → yt-dlp fallback fires → library entry gets the real title. Belt-and-suspenders for the existing v0.2.71 + relay 0.2.57 fix.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.73.ts b/startos/versions/v0.2.73.ts
new file mode 100644
index 0000000..502d8de
--- /dev/null
+++ b/startos/versions/v0.2.73.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_73 = VersionInfo.of({
+  version: '0.2.73:0',
+  releaseNotes: {
+    en_US:
+      'Defensive unwrap of the relay SSE "done" event so the title fix actually works against pre-0.2.60 relays too. Backstory: relay 0.2.60 finally fixes the real root cause of the "Untitled" library bug — markComplete was double-nesting the SSE done event so `data.result.title` was undefined and the actual title lived at `data.result.result.title`. This Recap release detects BOTH shapes: if the incoming SSE event has `data.result.result` with one of the expected inner keys (transcript / analysis / title), Recap unwraps once. Otherwise it uses `data.result` as-is (the new flat shape from relay 0.2.60+). Backwards-compatible with any relay version. Net effect: a Recap install upgraded to this version reads titles correctly regardless of which relay version is running on the operator side.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.74.ts b/startos/versions/v0.2.74.ts
new file mode 100644
index 0000000..e005697
--- /dev/null
+++ b/startos/versions/v0.2.74.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_74 = VersionInfo.of({
+  version: '0.2.74:0',
+  releaseNotes: {
+    en_US:
+      'Recap-app side of the relay-mode speaker-identification fix (paired with relay 0.2.63). When /api/process is invoked in relay-mode (both transcribe-provider and analyze-provider set to "Recap Relay"), Recap-app now fetches YouTube metadata via fetchYouTubeMetadata() BEFORE handing the URL off to the relay — channel, description (capped at 2000 chars), and chapters — and passes all three through to /relay/summarize-url\'s request body as channel / description / chapters fields. Previously this branch sent `channelHint: ""`, `descriptionHint: ""`, `chaptersHint: []` even though the same metadata fetcher was available in scope — the relay was running blind on every Recap submission. The fetch costs ~1-2 seconds (negligible relative to the 1-3 minute summarize pipeline) and is gated on `!isPodcast && videoId` so podcast submissions skip it (fetchYouTubeMetadata is YouTube-specific). Combined with relay 0.2.63\'s own yt-dlp metadata extraction (which fills in any fields the client sends empty), every Recap → Relay submission of a YouTube URL now produces transcripts with proper speaker labels — "Brandon Karpeles:" and "Matt Hill:" rather than unlabeled dialogue. Both packages can be upgraded independently: an older relay paired with this Recap version still gets the speaker labels (Recap fills them in); a new relay paired with an older Recap version also gets them (relay\'s yt-dlp extraction fills them in).',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.75.ts b/startos/versions/v0.2.75.ts
new file mode 100644
index 0000000..d6aa828
--- /dev/null
+++ b/startos/versions/v0.2.75.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_75 = VersionInfo.of({
+  version: '0.2.75:0',
+  releaseNotes: {
+    en_US:
+      'Three coordinated changes to the relay-mode summarize UX, all operator-visible. (1) Per-window sections now actually STREAM into the topics pane as each analyze window completes — previously the relay-mode branch sent sections_partial SSE events with a `partialSections` payload but the browser handler read `data.chunks`, so streaming silently no-op\'d and the operator saw zero topics until the very end. Root cause was that the server didn\'t have the parsed transcript entries available at the moment window_complete fired (analyze starts after transcribe but the entries hadn\'t been parsed yet on the Recap side). Fixed by adding an onTranscribeComplete callback to providers/relay.js — fires the instant the relay\'s transcribe_complete SSE event arrives, gives the Recap server the transcript text, which gets parsed into entries and cached BEFORE any window_complete callback fires. onWindowComplete then builds full { title, summary, entries, startTime } chunk objects and emits them under `data.chunks` matching the browser\'s expectation. Net effect: topics now appear in the right pane one-by-one as the model finishes each analyze window, exactly like the non-relay-mode path. (2) Video iframe no longer flickers when sections stream in. Pre-0.2.75 the sections_partial handler called render() which rebuilt root.innerHTML — destroying the YouTube #yt-player div and forcing the YT IFrame API to re-mount the player on every window completion, producing a visible flash. Replaced with a surgical applyStreamingChunksUpdate() function that finds the existing .chunks-scroll container, regenerates JUST its innerHTML from state.chunks, and updates the streaming-counter text. Iframe outside the container is untouched. Scroll position inside the container is preserved across the swap so the "I was reading the third section" view doesn\'t jump to top on each window. (3) New 4-stage pizza-tracker breadcrumb in the top row, matching the relay operator dashboard\'s style. Compact "Downloading → Transcribing → Analyzing → Done" indicator with a pulsing active-stage dot. Stage derived from state.currentStep + state.streaming so it advances automatically through the pipeline. Visible only while state.streaming || state.loading; hidden when idle or after job completion. Hidden on narrow viewports (<880px) where the toolbar already crowds the row. The breadcrumb updates surgically via updateProcessingBreadcrumb() called from applyStreamingChunksUpdate so the per-window section streaming also nudges the breadcrumb forward without a full re-render.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.76.ts b/startos/versions/v0.2.76.ts
new file mode 100644
index 0000000..c94976f
--- /dev/null
+++ b/startos/versions/v0.2.76.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_76 = VersionInfo.of({
+  version: '0.2.76:0',
+  releaseNotes: {
+    en_US:
+      'Recap-app direct-to-Gemini path catches up to recap-relay\'s analyze improvements. Four coupled changes: (1) Gemini analyze calls now pass `responseMimeType: "application/json"` in the generateContent config. Documented Gemini feature that tells the decoder to emit ONLY valid JSON for the response body — eliminates the entire class of "invalid JSON in window response" failures that came from the model wrapping its sections array in a prose preamble, a ```json``` markdown fence, or truncating the closing brace. Mirrors recap-relay 0.2.69. (2) Default analyze retry count bumped 1 → 2 (caller can still override). Analyze is by far the cheapest pipeline phase, so a third total attempt is essentially free in wall time but materially reduces "lost window" failures on transient 503/429 blips. (3) Updated TX and AN prompts to the latest relay-tuned versions. TX prompt now also breaks on "speaker changes" (rule 3) — natural place to start a new line that the recap-relay\'s prompt added during testing. AN prompt switched to the new completeness-aware shape: explicit "every segment index from 0 to N must belong to exactly one section" + "startIndex of section N+1 must equal endIndex of section N plus 1" + "lean toward broad, substantive topics rather than minute-by-minute breakdowns" guidance. The {{windowMin}} and {{targetSections}} concepts that exist on the relay are now baked into the Recap-app code (not exposed as Settings since Recap-app doesn\'t have an operator Settings UI). (4) Per-video-duration section-count target — buildAnalysisPrompt now picks the target total sections based on FULL video duration (under_30 → 6 / 30-60 → 8 / 60-90 → 9 / 90-120 → 10 / 120-150 → 11 / 150-180 → 12 / >=180 → 12) and divides by the effective number of windows to get the per-window target. Splices the resulting "around N sections" / "N–M sections" label into the prompt. Matches recap-relay\'s methodology exactly so segmentation density is consistent across both pipelines. (5) Removed the redundant "Processing… ⬤⬤⬤" status bar that used to sit above the segment-overview pane during transcribe/analyze. The new pizza-tracker breadcrumb in the top row already shows the current stage; the secondary status bar was duplicating signal.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.77.ts b/startos/versions/v0.2.77.ts
new file mode 100644
index 0000000..6187d7d
--- /dev/null
+++ b/startos/versions/v0.2.77.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_77 = VersionInfo.of({
+  version: '0.2.77:0',
+  releaseNotes: {
+    en_US: 'Multi-tenant cloud mode (opt-in via the "Enable Multi-Tenant Mode" StartOS action): magic-link sign-in via StartOS System SMTP, per-user libraries, anonymous trial summaries before signup, per-user Keysat licenses. Lite settings panel + sign-in / sign-out chip for tenants; full operator UX preserved for admins. New PWA support — Add to Home Screen on iOS / Android installs Recap as a standalone app. Mobile polish: bigger touch targets, library sidebar closed by default, "What can I paste?" info popover with brand card. Single-mode installs are unchanged behaviorally; only label tweaks ("Recap credits" instead of "relay credits", "link" instead of "URL") apply.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.78.ts b/startos/versions/v0.2.78.ts
new file mode 100644
index 0000000..2fda6a3
--- /dev/null
+++ b/startos/versions/v0.2.78.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_78 = VersionInfo.of({
+  version: '0.2.78:0',
+  releaseNotes: {
+    en_US: 'Mobile + multi-tenant polish: library moves into hamburger menu so Summarize button no longer overlaps. Bigger touch targets (48px). Fixed "What can I recap?" popover not opening from the mobile menu. Anonymous visitors now see "N free credits ready" in the menu and popover before signing up. Renamed "What can I paste?" to "What can I recap?". Backend exposes available_trial_credits via /api/account/whoami.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.79.ts b/startos/versions/v0.2.79.ts
new file mode 100644
index 0000000..1d62fac
--- /dev/null
+++ b/startos/versions/v0.2.79.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_79 = VersionInfo.of({
+  version: '0.2.79:0',
+  releaseNotes: {
+    en_US: 'Mobile: render the pizza tracker (4-stage processing breadcrumb) on its own row directly below the top bar so the in-progress state is visible at a glance instead of hidden away.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.80.ts b/startos/versions/v0.2.80.ts
new file mode 100644
index 0000000..a80ff53
--- /dev/null
+++ b/startos/versions/v0.2.80.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_80 = VersionInfo.of({
+  version: '0.2.80:0',
+  releaseNotes: {
+    en_US: 'Operator admin panel (multi-mode): the Settings modal for admins now includes a Tenants list (every signed-up user with their credit balance, license status, last seen IP, session count) with inline "+ Credits" and "Sign out" buttons per row, plus a Recent Activity block showing signups + magic-link requests grouped by IP for 24h / 7d / 14d windows for abuse detection. Tenants get a new Active Sessions block in their lite settings showing their own devices with per-session Revoke buttons and a "Sign out of all other devices" shortcut.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.81.ts b/startos/versions/v0.2.81.ts
new file mode 100644
index 0000000..9b25162
--- /dev/null
+++ b/startos/versions/v0.2.81.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_81 = VersionInfo.of({
+  version: '0.2.81:0',
+  releaseNotes: {
+    en_US: 'Pro buy flow polish for cloud tenants. The lite settings modal now has a Plan section showing tier (Pro/Max) + renewal date + days remaining, with the date highlighted yellow when expiry is within 14 days. Always-visible Renew button (purple/emphasized for unlicensed users or near-expiry users; muted otherwise). New "Take Recap Home" panel for licensed tenants — click "Get my license key" to reveal and copy your LIC1 string for use on a self-hosted Recap install. License key is fetched on demand via a new /api/account/license-key endpoint scoped to the calling user. Buy modal now auto-fills buyer_email from the signed-in user so the issued license carries it (helps Keysat admin lookups + support).',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.82.ts b/startos/versions/v0.2.82.ts
new file mode 100644
index 0000000..4c5a92c
--- /dev/null
+++ b/startos/versions/v0.2.82.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_82 = VersionInfo.of({
+  version: '0.2.82:0',
+  releaseNotes: {
+    en_US: 'Per-user relay-state cache (Phase 1F): the in-memory snapshot of the relay\'s credits balance is now keyed by per-identity credit-key so an admin and a tenant hitting /api/relay/status in the same process can\'t clobber each other\'s view. Plus account deletion (Phase 1G): tenants get a Danger Zone "Delete account" action in their lite settings (two-step confirm); admins get a per-row Delete button in the Tenants list (refuses to delete other admins or self). Cascades sessions, tenant_credits, library_meta, and removes the per-user /data/history/<id>/ folder. Polished sign-in error page with brand-styled card + "Get a new sign-in link" CTA.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.83.ts b/startos/versions/v0.2.83.ts
new file mode 100644
index 0000000..a5b4d22
--- /dev/null
+++ b/startos/versions/v0.2.83.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_83 = VersionInfo.of({
+  version: '0.2.83:0',
+  releaseNotes: {
+    en_US: 'Optional password sign-in for multi-tenant tenants. Magic-link stays primary auth — visitors can keep using passwordless sign-in unchanged. Tenants who want a faster repeat sign-in can set a password in their lite settings (Account → Password) and then sign in with email + password from /auth.html. New endpoints: POST/DELETE /api/account/password (set / clear), POST /auth/signin-password (verify + issue session). scrypt hashes with per-password 16-byte salts; the timing-equalized verify path runs scrypt even on unknown emails so we don\'t leak existence. Minimum 8 chars, no composition rules. /api/account/whoami now reports has_password so the UI can branch on "Set" vs "Change / Remove" copy. Smoke-tested end-to-end before shipping.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.84.ts b/startos/versions/v0.2.84.ts
new file mode 100644
index 0000000..0929b02
--- /dev/null
+++ b/startos/versions/v0.2.84.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_84 = VersionInfo.of({
+  version: '0.2.84:0',
+  releaseNotes: {
+    en_US: 'Trial credits are now LIFETIME per IP, not per-day. A visitor who clears cookies can no longer reset their trial allowance by waiting 24 hours — the operator-set cap applies once and forever per IP. Existing operator config preserved: the legacy field name keeps working as a read-only alias. Operator can tune via "Set Trial Cookies per IP (Lifetime)" StartOS action. Also: admin users no longer get a stray tenant_credits row seeded at signup (they bill the operator pool directly, not a local balance). Polished password input styling on /auth.html so it matches the email field. Added Open Graph + Twitter Card meta tags so iMessage / Twitter / LinkedIn / Discord link previews render a Recap branded card when the URL is shared.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.85.ts b/startos/versions/v0.2.85.ts
new file mode 100644
index 0000000..21f5db7
--- /dev/null
+++ b/startos/versions/v0.2.85.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_85 = VersionInfo.of({
+  version: '0.2.85:0',
+  releaseNotes: {
+    en_US: 'Three mobile fixes: (1) iOS Safari no longer auto-zooms when you tap or paste into the URL input — we toggle the viewport meta on input focus to disable zoom during typing, restoring pinch-to-zoom everywhere else. (2) When the SSE stream drops mid-job (Safari backgrounding, flaky cellular), the UI no longer shows "Load failed" — it now checks /api/process/current and shows "Connection dropped" only if the server has nothing in flight; if the job is still running it silently reattaches via the current-job poll so your summary still lands in your library. (3) Top bar is now position: sticky on mobile when viewing a result, so it stays visible at the top of the page no matter how far down you scroll into a long podcast / episode chunk list. The hamburger menu is always reachable.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.86.ts b/startos/versions/v0.2.86.ts
new file mode 100644
index 0000000..b2eec57
--- /dev/null
+++ b/startos/versions/v0.2.86.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_86 = VersionInfo.of({
+  version: '0.2.86:0',
+  releaseNotes: {
+    en_US: 'Fountain (fountain.fm) podcast links now work. Paste any fountain.fm/episode/<id> link and Recap fetches the page\'s Open Graph metadata to pull the direct MP3 URL, podcast + episode title, upload date, and duration — no API key, no PodcastIndex lookup needed. Title parsing splits the podcast name from the episode name on Fountain\'s "Show • Episode • Watch on Fountain" format. Smoke-tested against the Rabbit Hole Recap #408 episode. Added Fountain to the "What can I recap?" popover so visitors know it\'s supported.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.87.ts b/startos/versions/v0.2.87.ts
new file mode 100644
index 0000000..f90796b
--- /dev/null
+++ b/startos/versions/v0.2.87.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_87 = VersionInfo.of({
+  version: '0.2.87:0',
+  releaseNotes: {
+    en_US: 'Clearer copy on the PodcastIndex credentials flow. Both the StartOS "Set PodcastIndex Credentials" action AND the in-app error when a Spotify URL fails now explicitly tell the operator that BOTH an API Key AND an API Secret are required (the most common reason Spotify resolution fails is leaving the Secret blank). Both credentials appear side-by-side on the api.podcastindex.org account page after free signup. The error message also reminds users that Apple Podcasts and Fountain links work without any PodcastIndex auth as a workaround.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.88.ts b/startos/versions/v0.2.88.ts
new file mode 100644
index 0000000..f160c8f
--- /dev/null
+++ b/startos/versions/v0.2.88.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_88 = VersionInfo.of({
+  version: '0.2.88:0',
+  releaseNotes: {
+    en_US: 'Mobile + subscription polish. Dropped the duplicate "Download audio / Transcribe / Analyze topics" pill cards under the pizza tracker — they were redundant with the always-visible 4-stage tracker at the top. Library/clock icon is back on the mobile top bar (left of the URL input) AND still available via the hamburger menu. When the tab returns from background and we\'d otherwise show "Connection dropped," we now also check the library for a brand-new session (last 5 min) and auto-load it if found — so a job that finished while the SSE stream was suspended doesn\'t surface as a red error. Apple Podcasts SHOW URLs (the whole-podcast landing page, no ?i= episode param) are now recognized as subscribe-able for Pro users — paste https://podcasts.apple.com/us/podcast/<slug>/id<num> and hit Subscribe; the server resolves the show\'s RSS feed via Apple\'s free iTunes Lookup API and stores that for auto-processing. Spotify SHOW URLs (open.spotify.com/show/<id>) are also flagged as subscribe-able in the UI (server-side resolution still needs PodcastIndex, same as Spotify episode resolution).',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.89.ts b/startos/versions/v0.2.89.ts
new file mode 100644
index 0000000..67639d5
--- /dev/null
+++ b/startos/versions/v0.2.89.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_89 = VersionInfo.of({
+  version: '0.2.89:0',
+  releaseNotes: {
+    en_US: 'Hide broken "Upgrade" and "Buy more" buttons for anonymous visitors. Both call endpoints behind tenant-auth and 401 when there\'s no session; surfacing them was misleading. Now: anon users see their trial credits + a Sign in CTA only. Once they sign in, both CTAs appear normally. Anon-side credit purchase (without account) is planned as a follow-up — see your message thread for context.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.90.ts b/startos/versions/v0.2.90.ts
new file mode 100644
index 0000000..5939e10
--- /dev/null
+++ b/startos/versions/v0.2.90.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_90 = VersionInfo.of({
+  version: '0.2.90:0',
+  releaseNotes: {
+    en_US: 'Anonymous credit purchase. Anon visitors can now buy more credits without signing up — the credits attach to their browser\'s trial cookie and transfer to their account if/when they sign up. New SQLite table pending_purchases tracks {invoice_id, buyer_type, buyer_id, credits} so the settle handler in /api/credits/invoice/:id knows where to apply the credits locally (anon_trials.credits_total for trial cookies, tenant_credits.balance for signed-in users). Idempotent via applied_at — duplicate polls don\'t double-credit. linkToUser (called from /auth/verify on magic-link signin) now transfers any unused trial credits into the new user\'s tenant_credits.balance. The buy modal for anon shows a callout reminding them to sign up to save credits across devices. Smoke-tested end-to-end: anon with 1 trial credit + 10 purchased → spends 3 → signs up → ends with 8 credits in their new tenant_credits.balance.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.91.ts b/startos/versions/v0.2.91.ts
new file mode 100644
index 0000000..e1367c7
--- /dev/null
+++ b/startos/versions/v0.2.91.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_91 = VersionInfo.of({
+  version: '0.2.91:0',
+  releaseNotes: {
+    en_US: 'Reversible mode-switching + Sign up button for anon. Fixed a bug where switching multi→single mode would hide the operator\'s library: pre-0.2.91 the first multi-mode signup renamed /data/history/owner/ → /data/history/<admin_user_id>/, so single-mode (which always reads "owner") couldn\'t find it after the flip. Now admin\'s library scope is always "owner" regardless of mode, and a one-time boot fixup renames the legacy admin folder back to owner/ on upgraded installs. Mode switching is now fully reversible — admin keeps their library either way; other tenants\' libraries persist on disk while multi-mode is off and reappear when it\'s flipped back on. Anon visitors now see TWO pills in the header — "Sign up" (purple CTA) and "Sign in" (muted) — both going to /auth.html with an intent= query param so the page H1 reads "Create your account" or "Sign in" appropriately.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.92.ts b/startos/versions/v0.2.92.ts
new file mode 100644
index 0000000..cbf1558
--- /dev/null
+++ b/startos/versions/v0.2.92.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_92 = VersionInfo.of({
+  version: '0.2.92:0',
+  releaseNotes: {
+    en_US: 'Two-bucket tenant credit ledger + anniversary-aligned replenishment. tenant_credits.balance is split into purchased_balance (permanent — a la carte purchases + admin grants + anon-trial carry-over on signup) and replenish_balance (refillable — initial signup grant + periodic refresh to tenant_default_credits). Spend debits replenish first, then purchased, so the refillable bucket is use-it-or-lose-it each period. Anniversary-aligned refill anchored to each tenant\'s last_replenish_at: daily = 24h, weekly = 7d, monthly = calendar-month with day-of-month clamping. New StartOS action "Set Tenant Credit Replenishment" (off / daily / weekly / monthly). Default: off (Grant\'s use case — tenants are paying customers, signup grant is one-time). Existing tenant_credits.balance is renamed to purchased_balance on upgrade — treats all existing credits as permanent so nothing gets wiped. Also fixed a bug where signed-in free users could summarize indefinitely without their tenant_credits getting gated/debited (was display-only); now /api/process gates on total > 0 and debits one credit after successful saveToHistory. Smoke-tested end-to-end with daily replenish + spend + refill + mixed bucket behavior.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.93.ts b/startos/versions/v0.2.93.ts
new file mode 100644
index 0000000..f41e7a3
--- /dev/null
+++ b/startos/versions/v0.2.93.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_93 = VersionInfo.of({
+  version: '0.2.93:0',
+  releaseNotes: {
+    en_US: '3-tier signup modal for anonymous visitors. The "Sign up" pill now opens a new in-app modal with three cards — Free / Pro / Max — rendered in the same brand-styled card layout as the existing buy-license modal. Free path: enter email → magic-link sign-up (existing flow, no payment). Pro/Max path: enter email → BTCPay invoice opens → server polls Keysat for settlement → on settle, server creates the user (or matches existing email), attaches the issued license, and sends a celebratory "your Recap [Pro|Max] account is ready" magic-link email distinct from the standard sign-in template. User clicks the email link to land signed in with their license already active. Server-side: new pending_signups SQLite table tracks {invoice_id, email, policy_slug} so the settle handler is browser-crash-resilient (applied_at idempotency guard). New /api/license/* endpoints (policies, purchase, poll/) accept anon traffic. Refactored sendSignInLink in auth-routes into a reusable helper so the post-purchase email reuses the same token + send infrastructure. Skipped tenant_credits seeding when a license is attached at user creation (Pro/Max users spend from their license-keyed relay pool, not a local balance). If buyer email matches an existing account, attach to that account instead of creating a duplicate.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.94.ts b/startos/versions/v0.2.94.ts
new file mode 100644
index 0000000..1672e1e
--- /dev/null
+++ b/startos/versions/v0.2.94.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_94 = VersionInfo.of({
+  version: '0.2.94:0',
+  releaseNotes: {
+    en_US: 'Three Apple-Podcast + anon UX bug fixes. (1) Apple Podcast EPISODE URLs (with ?i=<id>) no longer get mis-flagged as subscribe-able shows — the regex\'s negative lookahead was positioned wrong, matching both show AND episode URLs. Replaced with URL.searchParams parsing on both frontend and server. (2) The Subscribe button for non-Pro users no longer 401s with a raw "auth_required" — the banner now reads "Channel detected — Pro account required" with an upgrade CTA that opens the 3-tier signup modal (anon) or the buy-license modal (free signed-in). (3) "Buy more credits" is now visible to anonymous visitors who see their pre-trial credit allowance. Desktop toolbar gets a new branch in renderToolbarStatus that surfaces "N free credits ready" + the "+ Buy more" button using state.account.available_trial_credits; mobile hamburger menu gets a parallel "Buy more credits" item below the credit count line.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.95.ts b/startos/versions/v0.2.95.ts
new file mode 100644
index 0000000..9713966
--- /dev/null
+++ b/startos/versions/v0.2.95.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_95 = VersionInfo.of({
+  version: '0.2.95:0',
+  releaseNotes: {
+    en_US: 'Two anon-buyer fixes. Renamed the "Buy relay credits" modal title to "Buy Recap credits" (consistent with the v0.2.84 toolbar-pill rename that we missed in the modal header). Fixed the "Couldn\'t open purchase — sign in or start a free trial first" dead-end that anon visitors hit when clicking "+ Buy more" before they\'d ever pasted a link: the buy handler now auto-mints a trial cookie if there\'s no signed-in user AND no existing cookie, same pattern /api/process uses. Trials disabled or IP over lifetime cap still returns the friendly "Sign up for a free account first" message.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.96.ts b/startos/versions/v0.2.96.ts
new file mode 100644
index 0000000..0676739
--- /dev/null
+++ b/startos/versions/v0.2.96.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_96 = VersionInfo.of({
+  version: '0.2.96:0',
+  releaseNotes: {
+    en_US: 'Dynamic Free-tier signup card + post-settle balance refresh + better credit-purchase logging. The signup modal\'s Free card was hardcoded to display "N credits at signup" using the relay\'s Core-tier policy as a stand-in — now it uses the operator\'s actual tenant_default_credits config exposed via /api/account/whoami. Copy is dynamic: when tenant_default_credits is 0 (Grant\'s setup — tenants are paying customers, no signup bonus), the card says "Any trial credits you\'ve already earned transfer to your account." When > 0, it adds an "N extra credits at signup, no payment required" bullet on top. Post-settle on credit purchase, the toolbar now reliably refreshes — we call both loadRelayStatus + loadAccount in parallel AND force a render() so every code path that reads credits (toolbar pill, mobile menu, settings) shows the new balance. Added loud warning logging in /api/credits/buy and applyPendingPurchase for the failure modes Grant hit (missing invoice_id in relay response, missing pending_purchases row at settle time) so the next purchase will produce diagnosable server logs.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.97.ts b/startos/versions/v0.2.97.ts
new file mode 100644
index 0000000..89f13e1
--- /dev/null
+++ b/startos/versions/v0.2.97.ts
@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_97 = VersionInfo.of({
+  version: '0.2.97:0',
+  releaseNotes: {
+    en_US: 'First-visit welcome modal. Brand-new anon visitors on a multi-tenant Recap (no recap_welcome_seen cookie) now see a one-time welcome card explaining what Recap is before they have to figure out the URL input from scratch. Six bullets: paste any link, AI topic summaries with timestamps, full transcript on demand, library + subscriptions, pay-your-way (anon / Bitcoin / Pro subscription / self-host with BYO keys), and the value-prop summary. Single "Get started" CTA dismisses with a 1-year cookie so the same browser never sees it again. Single-mode installs and signed-in users never see this — it\'s strictly the first-impression intro for fresh cloud visitors.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.98.ts b/startos/versions/v0.2.98.ts
new file mode 100644
index 0000000..82df254
--- /dev/null
+++ b/startos/versions/v0.2.98.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_98 = VersionInfo.of({
+  version: '0.2.98:0',
+  releaseNotes: {
+    en_US:
+      "Self-healing credit-purchase apply on multi-tenant cloud. When a buyer pays for credits via BTCPay, the relay's webhook credits the operator pool — but the buyer-side polling tab dies on the BTCPay → Recap redirect, so the local pending_purchases row never gets marked applied and the visible balance stays stale. Now every /api/account/whoami and /api/relay/status hit triggers a bounded sweep (max 5 invoices, 30-min lookback) that asks the relay for each unapplied invoice's status and runs apply for any that report settled. Idempotent via the existing applied_at column. Same sweep runs inside linkToUser BEFORE the anon-trial→user credit transfer, so a buy-then-immediately-sign-up flow rolls the just-purchased credits into the new user's balance instead of dropping them on the floor.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})
diff --git a/startos/versions/v0.2.99.ts b/startos/versions/v0.2.99.ts
new file mode 100644
index 0000000..ff73e71
--- /dev/null
+++ b/startos/versions/v0.2.99.ts
@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_99 = VersionInfo.of({
+  version: '0.2.99:0',
+  releaseNotes: {
+    en_US:
+      "Mobile sign-up parity + email-recovery for anon credit purchases. (1) The hamburger menu now exposes the Sign up button (opens the Free / Pro / Max tier modal) alongside the existing Sign in entry, matching the desktop toolbar — previously mobile-only visitors had no path to the 3-tier signup. (2) The buy-credits modal now shows an optional 'recovery email' field for anon buyers. When the email is set, the server stashes it on the pending_purchases row, and at signup the new claim-by-email path walks any settled-but-unapplied purchases that match the new user's email and credits them. Fixes the case where the magic-link click lands in a different browser / in-app webview (Gmail iOS, Outlook) than the one that bought the credits — the trial cookie doesn't travel across cookie jars but the email does. 24-hour lookback, anon-buyer rows only, idempotent.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})