diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index c8052cb..063450c 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -108,7 +108,7 @@ jobs:
       TIGER_TEST_DB_PASS: root
       # The floor we enforce today (report-only warning above it). Bump this as coverage climbs so it
       # can only go UP — the ratchet that gets us to 90% without ever regressing.
-      MIN_COVERAGE: '18'
+      MIN_COVERAGE: '35'
     steps:
       - uses: actions/checkout@v4
 
diff --git a/library/Tiger/Db/Migrator.php b/library/Tiger/Db/Migrator.php
index 98b1411..29813b4 100644
--- a/library/Tiger/Db/Migrator.php
+++ b/library/Tiger/Db/Migrator.php
@@ -34,17 +34,26 @@ class Tiger_Db_Migrator
     /** @var string[] directories to scan for migration files, in precedence order */
     private $paths;
 
+    /** @var string ledger table recording applied versions (default `tiger_migration`) */
+    private $ledger;
+
     /**
      * Construct the migrator over a DB adapter and a set of migration directories.
      *
      * @param Zend_Db_Adapter_Abstract $db
-     * @param string[]                 $paths migration directories (existing ones; missing are ignored)
+     * @param string[]                 $paths       migration directories (existing ones; missing are ignored)
+     * @param string                   $ledgerTable the applied-versions ledger table. Defaults to the
+     *                                              canonical `tiger_migration`; override it to run a migrator
+     *                                              against an ISOLATED ledger (so a migration test's fixture
+     *                                              versions never collide with — or roll back — the real
+     *                                              schema's applied set).
      * @return void
      */
-    public function __construct(Zend_Db_Adapter_Abstract $db, array $paths)
+    public function __construct(Zend_Db_Adapter_Abstract $db, array $paths, $ledgerTable = 'tiger_migration')
     {
-        $this->db    = $db;
-        $this->paths = array_values(array_filter($paths, 'is_dir'));
+        $this->db     = $db;
+        $this->paths  = array_values(array_filter($paths, 'is_dir'));
+        $this->ledger = (string) $ledgerTable;
     }
 
     /**
@@ -68,7 +77,7 @@ public function migrate($log = null)
                 $this->run($stmt);
             }
             // Record only after every statement succeeded (see class caveat).
-            $this->db->insert('tiger_migration', [
+            $this->db->insert($this->ledger, [
                 'version'    => $version,
                 'name'       => $m['name'],
                 'applied_at' => date('Y-m-d H:i:s'),
@@ -106,7 +115,7 @@ public function rollback($steps = 1, $log = null)
             foreach ($m['down'] as $stmt) {
                 $this->run($stmt);
             }
-            $this->db->delete('tiger_migration', $this->db->quoteInto('version = ?', $version));
+            $this->db->delete($this->ledger, $this->db->quoteInto('version = ?', $version));
             $done[$version] = $m['name'];
         }
         return $done;
@@ -179,7 +188,7 @@ private function discover()
     /** @return array [version => true] of already-applied versions */
     private function appliedVersions()
     {
-        $rows = $this->db->fetchCol('SELECT version FROM tiger_migration');
+        $rows = $this->db->fetchCol('SELECT version FROM ' . $this->db->quoteIdentifier($this->ledger));
         return array_fill_keys($rows, true);
     }
 
@@ -187,12 +196,12 @@ private function appliedVersions()
     private function ensureTrackingTable()
     {
         $this->db->query(
-            "CREATE TABLE IF NOT EXISTS `tiger_migration` (
+            'CREATE TABLE IF NOT EXISTS ' . $this->db->quoteIdentifier($this->ledger) . ' (
                 `version`    VARCHAR(64)  NOT NULL,
                 `name`       VARCHAR(191) NOT NULL,
                 `applied_at` DATETIME     NOT NULL,
                 PRIMARY KEY (`version`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci"
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci'
         );
     }
 
diff --git a/tests/COVERAGE-PLAN.md b/tests/COVERAGE-PLAN.md
index f88d915..6177507 100644
--- a/tests/COVERAGE-PLAN.md
+++ b/tests/COVERAGE-PLAN.md
@@ -578,13 +578,30 @@ Then **4 parallel agents** (own worktree + own DB `tiger_test_w3a-d`, off `test/
   lines** (2863/14397) — the tested spine is ~100%, the drag is untested feature modules (blog/seo/media/
   profile/analytics/backup/identity/schedule at 0%) + the marketplace/install cluster. **Target: 90%.**
 
-### Next waves (priority order per §5/§8) — the drive to 90%
-- **Wave 4 — breadth over the zero-coverage core modules** (now unblocked by the savepoint mode): each is
-  small — media, profile, identity, blog, seo, analytics, backup, schedule, ally, search, agent — parallel
-  agents, one module (or a cluster) each, service + model + controller coverage. Biggest, fastest % gain.
-- **Wave 5 — finish the kernel install/marketplace cluster** (`Module_Installer`, `Vendor`, `Update_Checker`,
-  `Module_Github`, `Module_Dependency`) — the largest untested library chunk, security-adjacent.
-- **Wave 6 — satellite repos:** stand up a harness in each, then TigerShield WAF engines first.
+### Wave 4 — module breadth + install cluster (LANDED 2026-07-24) → coverage 20.5% → 37.9%
+6 parallel agents (own worktree + DB each), **+316 integration tests** (265 → 581 green) + install-cluster unit
+tests. Per-bucket line-%: **ally 100 · seo 88 · blog 83 · signup 87 · search 73 · access 69 · schedule 62 ·
+profile 56 · identity 45 · analytics 41 · media 34 · backup 31 · system 37**; the kernel install/marketplace
+cluster ~2–8×'d (`Dependency` 97 · `License_Authority` 94 · `Vendor` 80 · `Update_Checker` 79 · `Installer` 68 ·
+`Github` 66) lifting **library/Tiger 25 → 32%**. No product bugs found. CI floor `MIN_COVERAGE` 18 → 35.
+- **Real fix at collection:** `Tiger_Db_Migrator` gained an optional **ledger-table** arg (default
+  `tiger_migration`, prod unchanged); `MigratorTest` now uses an ISOLATED ledger. Root cause: `rollback()`
+  reverses the newest applied version GLOBALLY, and a module's timestamp-versioned migration (committed past
+  the per-test rollback — DDL auto-commits — by the install lifecycle test) sorted above the `9xxx` fixtures →
+  a cross-test flake. Hermetic ledger kills it.
+- **Recurring ceiling (not bugs):** `is_uploaded_file()` gates upload happy-paths (profile Avatar/OrgLogo,
+  media upload) → unreachable from CLI; render-only controllers + `exit;`-ending file/serve actions need a
+  full MVC/view boot the harness skips. These are functional/HTTP-test concerns — the % gaps below ~90 on
+  media/profile/backup are mostly these, not missing logic.
+
+### Next waves (priority order) — the drive to 90%
+- **Wave 5 — the library/Tiger KERNEL** (9,176 lines @ 32% = the dominant remaining gap, ~6,200 uncovered):
+  the CMS engine (`Cms_*`, `Menu`, `Page*` finders), `Mail`, `Log`, `Location` adapters, `Admin_*` registries,
+  `Form`/`Validate`/`Form_Element_*`, `Ajax_ServiceFactory` remainder, and the untested branches of the Model
+  + Service classes. This is what actually moves the overall number to the 80s. Parallel agents by sub-package.
+- **Wave 6 — the remaining modules:** `agent` (462 @ 5% — needs a provider-adapter stub), `cms` module (510 @
+  33%), `code` (238 @ 41%), and `core/controllers` (360 @ 0% — needs the controller-dispatch harness).
+- **Wave 7 — satellite repos:** stand up a harness in each, then TigerShield WAF engines first.
 
 ---
 *Manifest generated 2026-07-18 by 6 parallel read-only scans; graduated into `tests/COVERAGE-PLAN.md` +
diff --git a/tests/Integration/Ally/BootstrapTest.php b/tests/Integration/Ally/BootstrapTest.php
new file mode 100644
index 0000000..c145507
--- /dev/null
+++ b/tests/Integration/Ally/BootstrapTest.php
@@ -0,0 +1,66 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Ally;
+
+use Ally_Bootstrap;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use ReflectionMethod;
+use ReflectionProperty;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Admin_Nav;
+
+/**
+ * Ally_Bootstrap — registers the top-level "Accessibility" admin sidebar item. The hook touches only
+ * the process-wide Tiger_Admin_Nav registry (no $this state), so it's invoked on a constructor-less
+ * instance via reflection and the registration effect asserted.
+ */
+#[CoversClass(Ally_Bootstrap::class)]
+final class BootstrapTest extends IntegrationTestCase
+{
+    public static function setUpBeforeClass(): void
+    {
+        // The bare `Ally_Bootstrap` isn't a typed module class (the harness autoloader only resolves
+        // controllers/services/forms/models/plugins), so require it directly.
+        if (!class_exists(Ally_Bootstrap::class, false)) {
+            require_once TIGER_CORE_PATH . '/modules/ally/Bootstrap.php';
+        }
+    }
+
+    protected function tearDown(): void
+    {
+        Tiger_Admin_Nav::clear();
+        parent::tearDown();
+    }
+
+    /** The registered nav items keyed by 'key', read straight from the registry (no ACL filtering). */
+    private function registered(): array
+    {
+        $p = new ReflectionProperty(Tiger_Admin_Nav::class, '_items');
+        $p->setAccessible(true);
+        $items = [];
+        foreach ((array) $p->getValue() as $item) {
+            $items[$item['key'] ?? ''] = $item;
+        }
+        return $items;
+    }
+
+    #[Test]
+    public function it_registers_the_accessibility_sidebar_item(): void
+    {
+        Tiger_Admin_Nav::clear();
+
+        $bootstrap = (new \ReflectionClass(Ally_Bootstrap::class))->newInstanceWithoutConstructor();
+        $m = new ReflectionMethod(Ally_Bootstrap::class, '_initAdminNav');
+        $m->setAccessible(true);
+        $m->invoke($bootstrap);
+
+        $items = $this->registered();
+        $this->assertArrayHasKey('ally', $items, 'the Accessibility nav item is registered');
+        $this->assertSame('Accessibility', $items['ally']['label']);
+        $this->assertSame('/ally', $items['ally']['href']);
+        $this->assertSame('Ally_IndexController', $items['ally']['resource'], 'ACL-gated to the controller');
+    }
+}
diff --git a/tests/Integration/Ally/IndexControllerTest.php b/tests/Integration/Ally/IndexControllerTest.php
new file mode 100644
index 0000000..d16b691
--- /dev/null
+++ b/tests/Integration/Ally/IndexControllerTest.php
@@ -0,0 +1,73 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Ally;
+
+use Ally_IndexController;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Zend_Controller_Front;
+use Zend_Controller_Request_Http;
+use Zend_Controller_Response_Http;
+use Zend_Layout;
+use Zend_Registry;
+use Zend_Session;
+use Zend_View;
+
+/**
+ * Ally_IndexController — the (thin) admin screen for the accessibility inspector. It renders the tool;
+ * every scan is an /api call. init() sets the admin layout + the flash messenger; indexAction just
+ * seeds the page title.
+ *
+ * The test stands up the minimal admin-controller context (front controller module dir + Zend_Layout +
+ * an array-backed session for the FlashMessenger) so the real init() runs, then asserts the action.
+ */
+#[CoversClass(Ally_IndexController::class)]
+final class IndexControllerTest extends IntegrationTestCase
+{
+    private bool $priorUnitTestMode;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->priorUnitTestMode = Zend_Session::$_unitTestEnabled;
+        Zend_Session::$_unitTestEnabled = true;   // array-backed session so FlashMessenger runs under CLI
+        $_SESSION = [];
+
+        Zend_Registry::set('Zend_View', new Zend_View());
+        Zend_Controller_Front::getInstance()->addControllerDirectory(TIGER_CORE_PATH . '/modules/ally/controllers', 'ally');
+        Zend_Layout::startMvc();
+    }
+
+    protected function tearDown(): void
+    {
+        Zend_Layout::resetMvcInstance();
+        Zend_Controller_Front::getInstance()->resetInstance();
+        $_SESSION = [];
+        Zend_Session::$_unitTestEnabled = $this->priorUnitTestMode;
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('Zend_View')) { $reg->offsetUnset('Zend_View'); }
+        parent::tearDown();
+    }
+
+    #[Test]
+    public function index_action_sets_the_page_title(): void
+    {
+        $req = new Zend_Controller_Request_Http();
+        $req->setModuleName('ally')->setControllerName('index')->setActionName('index');
+        $res = new Zend_Controller_Response_Http();
+
+        $ctrl = new Ally_IndexController($req, $res);
+        // Touch the ViewRenderer so it initializes the controller's view (a real dispatch does this
+        // before the action runs); indexAction seeds $this->view->title.
+        $ctrl->getHelper('viewRenderer');
+        $ctrl->indexAction();
+
+        $this->assertStringContainsString('Accessibility', (string) $ctrl->view->title);
+        // init() set the admin layout for the shell.
+        $this->assertSame('admin', $ctrl->getHelper('layout')->getLayout());
+    }
+}
diff --git a/tests/Integration/Ally/ScanServiceTest.php b/tests/Integration/Ally/ScanServiceTest.php
new file mode 100644
index 0000000..73eb71a
--- /dev/null
+++ b/tests/Integration/Ally/ScanServiceTest.php
@@ -0,0 +1,259 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Ally;
+
+use Ally_Service_Scan;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Page;
+
+/**
+ * Ally_Service_Scan — the /api behind the TigerAlly accessibility inspector. READ-ONLY, admin-gated.
+ *
+ * Coverage: the ACL gate (admin+, deny-by-default), `scan` over a pasted HTML blob and over a rendered
+ * CMS page (by id), the empty/not-found guards, `pages` (the picker list), `scanAll` (per-page roll-up),
+ * and `scanModule` (view-template scan attributing findings to a file). The scan engine itself
+ * (Tiger_Ally) is covered by its own unit test; here we prove the service wiring, gating, and shape.
+ */
+#[CoversClass(Ally_Service_Scan::class)]
+final class ScanServiceTest extends IntegrationTestCase
+{
+    public static function setUpBeforeClass(): void
+    {
+        // scanModule needs MODULES_PATH; its natural production value is the modules root. Defining it
+        // here (guarded) lets the module-scan path run against the real ally module's views.
+        if (!defined('MODULES_PATH')) {
+            define('MODULES_PATH', TIGER_CORE_PATH . '/modules');
+        }
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Ally_Service_Scan(['action' => $action] + $params))->getResponse();
+    }
+
+    /** Seed a CMS page (html format) directly; returns its id. Stays inside the harness txn. */
+    private function seedPage(array $overrides): string
+    {
+        return (new Tiger_Model_Page())->insert(array_merge([
+            'org_id' => '',
+            'type'   => Tiger_Model_Page::TYPE_PAGE,
+            'locale' => 'en',
+            'status' => Tiger_Model_Page::STATUS_PUBLISHED,
+            'title'  => 'Seed',
+            'slug'   => 'seed',
+            'format' => Tiger_Model_Page::FORMAT_HTML,
+            'body'   => '<p>ok</p>',
+            'meta'   => '{}',
+        ], $overrides));
+    }
+
+    // ----- ACL gate -----------------------------------------------------------------------------
+
+    #[Test]
+    public function guest_and_plain_user_are_denied_every_action(): void
+    {
+        foreach (['scan', 'pages', 'scanAll', 'scanModule'] as $action) {
+            $this->login('anon', 'org-test', 'guest');
+            $res = $this->call($action, ['html' => '<p>x</p>', 'module' => 'ally']);
+            $this->assertSame(0, (int) $res->result, "guest denied on $action");
+            $this->assertStringContainsString('not_allowed', json_encode($res->messages), "ACL denial on $action");
+
+            $this->loginAs('user');
+            $res = $this->call($action, ['html' => '<p>x</p>', 'module' => 'ally']);
+            $this->assertSame(0, (int) $res->result, "plain user denied on $action");
+        }
+    }
+
+    // ----- scan (pasted HTML) -------------------------------------------------------------------
+
+    #[Test]
+    public function scan_reports_an_image_without_alt_from_pasted_html(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('scan', ['html' => '<div><img src="/logo.png"></div>']);
+
+        $this->assertSame(1, (int) $res->result);
+        $this->assertFalse($res->data['passed'], 'a missing alt is an error → not passed');
+        $this->assertGreaterThanOrEqual(1, $res->data['summary']['error']);
+        $rules = array_column($res->data['findings'], 'rule');
+        $this->assertContains('img-alt', $rules);
+        $this->assertNull($res->data['source'], 'pasted HTML has no page source');
+    }
+
+    #[Test]
+    public function clean_html_passes(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('scan', ['html' => '<p>Just text, nothing to flag.</p>']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertTrue($res->data['passed']);
+        $this->assertSame(0, $res->data['summary']['error']);
+    }
+
+    #[Test]
+    public function scan_rejects_empty_html(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('scan', ['html' => '   ']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('ally.scan.empty', json_encode($res->messages));
+    }
+
+    // ----- scan (a CMS page by id) --------------------------------------------------------------
+
+    #[Test]
+    public function scan_renders_a_cms_page_by_id_and_attaches_the_source(): void
+    {
+        $this->loginAs('admin');
+        $id = $this->seedPage(['title' => 'Landing', 'slug' => 'landing', 'body' => '<img src="/hero.jpg">']);
+
+        $res = $this->call('scan', ['page_id' => $id]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertIsArray($res->data['source']);
+        $this->assertSame($id, $res->data['source']['page_id']);
+        $this->assertSame('Landing', $res->data['source']['title']);
+        $rules = array_column($res->data['findings'], 'rule');
+        $this->assertContains('img-alt', $rules, 'the rendered page body is inspected');
+    }
+
+    #[Test]
+    public function scan_errors_on_an_unknown_page_id(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('scan', ['page_id' => 'does-not-exist']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('ally.scan.page_not_found', json_encode($res->messages));
+    }
+
+    // ----- pages (the picker list) --------------------------------------------------------------
+
+    #[Test]
+    public function pages_lists_the_scannable_cms_pages(): void
+    {
+        $this->loginAs('admin');
+        $this->seedPage(['title' => 'Alpha', 'slug' => 'alpha']);
+        $this->seedPage(['title' => 'Beta',  'slug' => 'beta']);
+
+        $res = $this->call('pages');
+        $this->assertSame(1, (int) $res->result);
+        $slugs = array_column($res->data['pages'], 'slug');
+        $this->assertContains('alpha', $slugs);
+        $this->assertContains('beta', $slugs);
+    }
+
+    // ----- scanAll (per-page roll-up) -----------------------------------------------------------
+
+    #[Test]
+    public function scan_all_rolls_up_pass_fail_across_pages(): void
+    {
+        $this->loginAs('admin');
+        $this->seedPage(['title' => 'Good', 'slug' => 'good', 'body' => '<p>fine</p>']);
+        $this->seedPage(['title' => 'Bad',  'slug' => 'bad',  'body' => '<img src="/x.png">']);
+
+        $res = $this->call('scanAll');
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame(2, $res->data['totals']['pages']);
+        $this->assertGreaterThanOrEqual(1, $res->data['totals']['passed'], 'the clean page passes');
+        $this->assertGreaterThanOrEqual(1, $res->data['totals']['error'], 'the img-alt page contributes an error');
+        $this->assertCount(2, $res->data['results']);
+    }
+
+    // ----- scanModule (view-template scan) ------------------------------------------------------
+
+    #[Test]
+    public function scan_module_scans_a_modules_view_templates(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('scanModule', ['module' => 'ally']);
+
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('ally', $res->data['module']);
+        $this->assertGreaterThanOrEqual(1, $res->data['totals']['scanned'], 'at least the index.phtml was scanned');
+        $this->assertArrayHasKey('files', $res->data);
+    }
+
+    #[Test]
+    public function scan_module_attributes_findings_to_files_when_a_view_has_gaps(): void
+    {
+        // The blog module ships view templates with nominal a11y gaps — a good fixture for the
+        // per-file attribution path (the files[] roll-up branch).
+        $this->loginAs('admin');
+        $res = $this->call('scanModule', ['module' => 'blog']);
+
+        $this->assertSame(1, (int) $res->result);
+        $this->assertGreaterThanOrEqual(1, $res->data['totals']['files_with_issues']);
+        $this->assertNotEmpty($res->data['files'], 'offending files are listed');
+        $first = $res->data['files'][0];
+        $this->assertStringStartsWith('application/modules/blog/views', $first['file'], 'finding attributed to its source file');
+        $this->assertArrayHasKey('findings', $first);
+    }
+
+    // ----- render-failure branches --------------------------------------------------------------
+
+    #[Test]
+    public function scan_reports_a_render_failure_for_a_broken_page(): void
+    {
+        $this->loginAs('admin');
+        // A phtml page whose body throws at render time → the service's render_failed guard.
+        $id = $this->seedPage([
+            'title'  => 'Broken',
+            'slug'   => 'broken',
+            'format' => Tiger_Model_Page::FORMAT_PHTML,
+            'body'   => '<?php throw new \\RuntimeException("boom"); ?>',
+        ]);
+        // The service logs the render failure to a stream sink (php://stdout, which bypasses PHP output
+        // buffering) — swap Tiger_Log's logger for a null writer so the diagnostic line doesn't count as
+        // unexpected test output under strict mode. Restored after.
+        $logProp = new \ReflectionProperty(\Tiger_Log::class, '_log');
+        $logProp->setAccessible(true);
+        $prior = $logProp->getValue();
+        $logProp->setValue(null, (new \Zend_Log())->addWriter(new \Zend_Log_Writer_Null()));
+        try {
+            $res = $this->call('scan', ['page_id' => $id]);
+        } finally {
+            $logProp->setValue(null, $prior);
+        }
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('ally.scan.render_failed', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function scan_all_marks_a_page_that_fails_to_render_as_skipped(): void
+    {
+        $this->loginAs('admin');
+        $this->seedPage(['title' => 'OK', 'slug' => 'ok-page', 'body' => '<p>fine</p>']);
+        $this->seedPage([
+            'title'  => 'Broken',
+            'slug'   => 'broken-page',
+            'format' => Tiger_Model_Page::FORMAT_PHTML,
+            'body'   => '<?php throw new \\RuntimeException("boom"); ?>',
+        ]);
+
+        $res = $this->call('scanAll');
+        $this->assertSame(1, (int) $res->result);
+        $skipped = array_filter($res->data['results'], static fn ($r) => !empty($r['skipped']));
+        $this->assertNotEmpty($skipped, 'the un-renderable page is flagged skipped, not fatal');
+    }
+
+    #[Test]
+    public function scan_module_errors_on_an_unknown_module(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('scanModule', ['module' => 'no-such-module-xyz']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('ally.scan.module_not_found', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function scan_module_rejects_a_blank_module(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('scanModule', ['module' => '']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('ally.scan.module_not_found', json_encode($res->messages));
+    }
+}
diff --git a/tests/Integration/Analytics/AnalyticsServiceTest.php b/tests/Integration/Analytics/AnalyticsServiceTest.php
new file mode 100644
index 0000000..2d5302d
--- /dev/null
+++ b/tests/Integration/Analytics/AnalyticsServiceTest.php
@@ -0,0 +1,139 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Analytics;
+
+use Analytics_Service_Analytics;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Config;
+use Zend_Registry;
+
+/**
+ * Analytics_Service_Analytics — the /api service behind the Google Analytics settings screen. It
+ * validates the GA4 Measurement ID, then writes the analytics config (enabled + id + exclude-signed-in,
+ * plus the reporting/OAuth connect fields) to the GLOBAL config tier inside a transaction. Wave-4
+ * coverage: the ACL gate, the validate-and-persist happy path (each key lands in `config`), the
+ * invalid-id reject (form errors, nothing written), and the boolean switches (enabled / exclude).
+ */
+#[CoversClass(Analytics_Service_Analytics::class)]
+final class AnalyticsServiceTest extends IntegrationTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function call(array $params = []): object
+    {
+        return (new Analytics_Service_Analytics(['action' => 'save'] + $params))->getResponse();
+    }
+
+    private function cfg(string $key): ?string
+    {
+        return (new Tiger_Model_Config())->get(Tiger_Model_Config::SCOPE_GLOBAL, '', $key);
+    }
+
+    // ----- ACL ----------------------------------------------------------------------------------
+
+    #[Test]
+    public function guest_is_denied(): void
+    {
+        $this->login('anon', 'org-test', 'guest');
+        $res = $this->call(['ga4_measurement_id' => 'G-ABC123', 'enabled' => '1']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function a_plain_user_is_denied(): void
+    {
+        $this->loginAs('user');
+        $res = $this->call(['ga4_measurement_id' => 'G-ABC123']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    // ----- save ---------------------------------------------------------------------------------
+
+    #[Test]
+    public function save_persists_the_measurement_id_and_switches(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call([
+            'ga4_measurement_id' => 'G-ABC123XYZ',
+            'enabled'            => '1',
+            'exclude_signed_in'  => '1',
+        ]);
+
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('1', $this->cfg('tiger.analytics.enabled'));
+        $this->assertSame('G-ABC123XYZ', $this->cfg('tiger.analytics.ga4.measurement_id'));
+        $this->assertSame('1', $this->cfg('tiger.analytics.exclude_signed_in'));
+        // The reporting bridge (Tiger_Google_Analytics) writes the connect mode too.
+        $this->assertNotNull($this->cfg('tiger.analytics.oauth.mode'));
+    }
+
+    #[Test]
+    public function save_records_disabled_and_included_when_switches_are_off(): void
+    {
+        $this->loginAs('admin');
+        // No `enabled`/`exclude_signed_in` keys → both persist as '0'.
+        $res = $this->call(['ga4_measurement_id' => 'G-ONLYID9']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('0', $this->cfg('tiger.analytics.enabled'));
+        $this->assertSame('0', $this->cfg('tiger.analytics.exclude_signed_in'));
+    }
+
+    #[Test]
+    public function save_accepts_an_empty_measurement_id(): void
+    {
+        // The id is optional (a site may enable later); an empty value validates and stores ''.
+        $this->loginAs('admin');
+        $res = $this->call(['ga4_measurement_id' => '', 'enabled' => '0']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('', $this->cfg('tiger.analytics.ga4.measurement_id'));
+    }
+
+    #[Test]
+    public function save_persists_the_byo_oauth_connect_fields(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call([
+            'ga4_measurement_id' => 'G-CONNECT1',
+            'enabled'            => '1',
+            'oauth_mode'         => 'byo',
+            'oauth_client_id'    => 'client-abc.apps.googleusercontent.com',
+            'property_id'        => '123456789',
+        ]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('byo', $this->cfg('tiger.analytics.oauth.mode'));
+        $this->assertSame('client-abc.apps.googleusercontent.com', $this->cfg('tiger.analytics.oauth.client_id'));
+        $this->assertSame('123456789', $this->cfg('tiger.analytics.property_id'), 'digits-only property id stored');
+    }
+
+    #[Test]
+    public function an_invalid_measurement_id_returns_form_errors_and_writes_nothing(): void
+    {
+        $this->loginAs('admin');
+        $before = (int) $this->db->fetchOne('SELECT COUNT(*) FROM config');
+
+        // 'UA-12345-6' is a Universal Analytics id, not a GA4 `G-XXXX` — the regex rejects it.
+        $res = $this->call(['ga4_measurement_id' => 'UA-12345-6', 'enabled' => '1']);
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertNotNull($res->form);
+        $this->assertArrayHasKey('ga4_measurement_id', $res->form);
+        $this->assertSame($before, (int) $this->db->fetchOne('SELECT COUNT(*) FROM config'), 'nothing written on a reject');
+    }
+}
diff --git a/tests/Integration/Analytics/ReportsServiceTest.php b/tests/Integration/Analytics/ReportsServiceTest.php
new file mode 100644
index 0000000..7f0d66e
--- /dev/null
+++ b/tests/Integration/Analytics/ReportsServiceTest.php
@@ -0,0 +1,123 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Analytics;
+
+use Analytics_Service_Reports;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Crypto;
+use Zend_Config;
+use Zend_Registry;
+
+/**
+ * Analytics_Service_Reports — the /api service the analytics dashboard + widget fetch from. Admin-only,
+ * read-only. Wave-4 coverage of the reachable surface: the ACL gate on both actions, `summary`'s
+ * not-connected short-circuit, and `test`'s diagnosis envelope (a not-connected install still returns a
+ * successful CALL with `data.test.ok=false` + a `not_connected` code — that's the Troubleshooting seam).
+ *
+ * The connected/live-GA4 paths need a real signed refresh token + an HTTP round-trip to Google, so
+ * they're out of scope for a hermetic integration test — see WAVE4-FINDINGS-mediaan.md.
+ */
+#[CoversClass(Analytics_Service_Reports::class)]
+final class ReportsServiceTest extends IntegrationTestCase
+{
+    private const PROPERTY_ID = '123456789';
+    private ?string $cacheFile = null;
+
+    protected function tearDown(): void
+    {
+        if ($this->cacheFile !== null && is_file($this->cacheFile)) { @unlink($this->cacheFile); }
+        parent::tearDown();
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Analytics_Service_Reports(['action' => $action] + $params))->getResponse();
+    }
+
+    #[Test]
+    public function guest_is_denied_on_summary_and_test(): void
+    {
+        $this->login('anon', 'org-test', 'guest');
+        foreach (['summary', 'test'] as $action) {
+            $res = $this->call($action);
+            $this->assertSame(0, (int) $res->result, "guest denied on {$action}");
+            $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+        }
+    }
+
+    #[Test]
+    public function a_plain_user_is_denied(): void
+    {
+        $this->loginAs('user');
+        $res = $this->call('summary');
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function summary_reports_not_connected_when_ga_is_unconfigured(): void
+    {
+        // No GA config anywhere → Tiger_Google_Analytics::isConnected() is false → the guard fires.
+        $this->loginAs('admin');
+        $res = $this->call('summary', ['days' => 28]);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('analytics.reports.not_connected', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function test_returns_a_not_connected_diagnosis_as_a_successful_call(): void
+    {
+        // The self-test is a successful CALL even when the connection is down — the client reads
+        // data.test.ok to render the message/hint. Unconfigured → ok=false, code=not_connected.
+        $this->loginAs('admin');
+        $res = $this->call('test');
+        $this->assertSame(1, (int) $res->result, 'the call itself succeeds');
+        $this->assertIsArray($res->data['test']);
+        $this->assertFalse($res->data['test']['ok']);
+        $this->assertSame('not_connected', $res->data['test']['code']);
+    }
+
+    #[Test]
+    public function summary_returns_the_cached_ga_data_when_connected(): void
+    {
+        // Connect GA (crypto key + property + decryptable refresh token) and pre-seed the report cache
+        // so summary() serves it WITHOUT any network round-trip to Google — covers the connected path.
+        $this->connectGa();
+        $expected = ['range' => ['days' => 28], 'totals' => [10, 5, 42], 'series' => [['users' => 3]]];
+        $this->seedCache(28, $expected);
+
+        $this->loginAs('admin');
+        $res = $this->call('summary', ['days' => 28]);
+
+        $this->assertSame(1, (int) $res->result, 'connected + cached → success');
+        $this->assertSame($expected, $res->data['summary'], 'the cached summary is returned verbatim');
+    }
+
+    /** Make Tiger_Google_Analytics::isConnected() true (broker mode: crypto key + property + refresh token). */
+    private function connectGa(): void
+    {
+        $key = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';   // 32 zero bytes, base64
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => ['crypto' => ['key' => $key]]], true));
+        $enc = Tiger_Crypto::encrypt('fake-refresh-token');
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => [
+            'crypto'    => ['key' => $key],
+            'analytics' => [
+                'property_id' => self::PROPERTY_ID,
+                'oauth'       => ['mode' => 'broker', 'refresh_token_enc' => $enc],
+            ],
+        ]], true));
+    }
+
+    /** Write a fresh report-cache file at the path Tiger_Google_Analytics::_cacheFile() computes. */
+    private function seedCache(int $days, array $data): void
+    {
+        $base = (defined('APPLICATION_PATH') ? dirname(APPLICATION_PATH) : sys_get_temp_dir()) . '/var/cache/analytics';
+        if (!is_dir($base)) { @mkdir($base, 0775, true); }
+        $this->cacheFile = $base . '/ga-' . substr(md5(self::PROPERTY_ID), 0, 10) . '-' . $days . 'd.json';
+        file_put_contents($this->cacheFile, json_encode($data));
+    }
+}
diff --git a/tests/Integration/Analytics/TagPluginTest.php b/tests/Integration/Analytics/TagPluginTest.php
new file mode 100644
index 0000000..9544cee
--- /dev/null
+++ b/tests/Integration/Analytics/TagPluginTest.php
@@ -0,0 +1,146 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Analytics;
+
+use Analytics_Plugin_Tag;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use ReflectionProperty;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Zend_Config;
+use Zend_Controller_Request_Simple;
+use Zend_Registry;
+use Zend_View;
+
+/**
+ * Analytics_Plugin_Tag — emits the GA4 gtag.js snippet into the `tigerTracking` head placeholder on
+ * public pages, only when GA is enabled with a valid `G-XXXX` id AND consent allows AND the visitor
+ * isn't excluded signed-in staff. Wave-4 coverage: `measurementId()`/`isConfigured()` gating (disabled,
+ * invalid id, valid id), and `preDispatch()` emission — the happy path appends the snippet, and the
+ * staff-exclusion path stays silent for a signed-in admin.
+ *
+ * The plugin has a process-wide emit-once latch (`$_done`); each test resets it via reflection.
+ */
+#[CoversClass(Analytics_Plugin_Tag::class)]
+final class TagPluginTest extends IntegrationTestCase
+{
+    private Zend_View $view;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        // A fresh view the plugin will reach for the placeholder helper (shared via the registry).
+        $this->view = new Zend_View();
+        Zend_Registry::set('Zend_View', $this->view);
+        // Placeholder containers are a process-wide singleton — clear the one this plugin writes so
+        // an emission from a prior test can't bleed into this one.
+        $this->view->placeholder('tigerTracking')->exchangeArray([]);
+        $this->resetLatch();
+    }
+
+    protected function tearDown(): void
+    {
+        $this->resetLatch();
+        parent::tearDown();
+    }
+
+    /** Reset the plugin's emit-once static so each test starts clean. */
+    private function resetLatch(): void
+    {
+        $p = new ReflectionProperty(Analytics_Plugin_Tag::class, '_done');
+        $p->setValue(null, false);
+    }
+
+    private function config(array $analytics): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => ['analytics' => $analytics]], true));
+    }
+
+    private function tracking(): string
+    {
+        return (string) $this->view->placeholder('tigerTracking');
+    }
+
+    // ----- measurementId / isConfigured ---------------------------------------------------------
+
+    #[Test]
+    public function measurement_id_is_empty_when_disabled(): void
+    {
+        $this->config(['enabled' => '0', 'ga4' => ['measurement_id' => 'G-VALID123']]);
+        $this->assertSame('', Analytics_Plugin_Tag::measurementId(), 'disabled → no id, even with one set');
+        $this->assertFalse(Analytics_Plugin_Tag::isConfigured());
+    }
+
+    #[Test]
+    public function measurement_id_is_empty_for_an_invalid_id(): void
+    {
+        $this->config(['enabled' => '1', 'ga4' => ['measurement_id' => 'not-a-ga4-id']]);
+        $this->assertSame('', Analytics_Plugin_Tag::measurementId(), 'a non G-XXXX id is rejected');
+        $this->assertFalse(Analytics_Plugin_Tag::isConfigured());
+    }
+
+    #[Test]
+    public function measurement_id_returns_a_valid_enabled_id(): void
+    {
+        $this->config(['enabled' => '1', 'ga4' => ['measurement_id' => 'G-VALID123']]);
+        $this->assertSame('G-VALID123', Analytics_Plugin_Tag::measurementId());
+        $this->assertTrue(Analytics_Plugin_Tag::isConfigured());
+    }
+
+    // ----- preDispatch emission -----------------------------------------------------------------
+
+    #[Test]
+    public function predispatch_appends_the_snippet_when_configured_for_a_guest(): void
+    {
+        // Guest (no identity) → not staff; consent allows by default; enabled + valid id → emit.
+        $this->config(['enabled' => '1', 'ga4' => ['measurement_id' => 'G-EMIT4567']]);
+
+        (new Analytics_Plugin_Tag())->preDispatch(new Zend_Controller_Request_Simple());
+
+        $out = $this->tracking();
+        $this->assertStringContainsString('googletagmanager.com/gtag/js?id=G-EMIT4567', $out, 'gtag script emitted');
+        $this->assertStringContainsString("gtag('config','G-EMIT4567')", $out, 'config call emitted');
+    }
+
+    #[Test]
+    public function predispatch_emits_nothing_when_unconfigured(): void
+    {
+        $this->config(['enabled' => '0', 'ga4' => ['measurement_id' => 'G-EMIT4567']]);
+        (new Analytics_Plugin_Tag())->preDispatch(new Zend_Controller_Request_Simple());
+        $this->assertSame('', $this->tracking(), 'disabled → nothing in the placeholder');
+    }
+
+    #[Test]
+    public function predispatch_skips_signed_in_staff_when_exclusion_is_on(): void
+    {
+        // exclude_signed_in on (default) + a signed-in admin (staff) → the tag is withheld.
+        $this->config(['enabled' => '1', 'exclude_signed_in' => '1', 'ga4' => ['measurement_id' => 'G-STAFF999']]);
+        $this->loginAs('admin');
+
+        (new Analytics_Plugin_Tag())->preDispatch(new Zend_Controller_Request_Simple());
+        $this->assertSame('', $this->tracking(), 'staff traffic is not tagged');
+    }
+
+    #[Test]
+    public function predispatch_tags_signed_in_staff_when_exclusion_is_off(): void
+    {
+        // With exclusion turned off, even a signed-in admin gets tagged.
+        $this->config(['enabled' => '1', 'exclude_signed_in' => '0', 'ga4' => ['measurement_id' => 'G-ALLSTAFF']]);
+        $this->loginAs('admin');
+
+        (new Analytics_Plugin_Tag())->preDispatch(new Zend_Controller_Request_Simple());
+        $this->assertStringContainsString('G-ALLSTAFF', $this->tracking(), 'exclusion off → staff tagged');
+    }
+
+    #[Test]
+    public function the_emit_once_latch_prevents_a_second_append(): void
+    {
+        $this->config(['enabled' => '1', 'ga4' => ['measurement_id' => 'G-ONCE1234']]);
+        $plugin = new Analytics_Plugin_Tag();
+        $plugin->preDispatch(new Zend_Controller_Request_Simple());
+        $plugin->preDispatch(new Zend_Controller_Request_Simple());   // second dispatch/forward
+        $this->assertSame(1, substr_count($this->tracking(), 'gtag/js?id='), 'the snippet is appended exactly once');
+    }
+}
diff --git a/tests/Integration/Analytics/WidgetTest.php b/tests/Integration/Analytics/WidgetTest.php
new file mode 100644
index 0000000..1df7ac1
--- /dev/null
+++ b/tests/Integration/Analytics/WidgetTest.php
@@ -0,0 +1,71 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Analytics;
+
+use Analytics_Widget_Ga;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Crypto;
+use Zend_Config;
+use Zend_Registry;
+
+/**
+ * Analytics_Widget_Ga — the admin-dashboard "Traffic" widget. Wave-4 coverage of the reachable branch:
+ * with Google Analytics not connected, `render()` returns the "Connect Google Analytics" prompt card
+ * (a set-up CTA to /analytics/admin) rather than the live sparkline shell.
+ *
+ * The connected branch renders a chart shell whose data arrives over /api and is drawn by Chart.js in
+ * the browser; standing up a live GA connection (a signed refresh token + a Google round-trip) is out
+ * of scope for a hermetic test — see WAVE4-FINDINGS-mediaan.md.
+ */
+#[CoversClass(Analytics_Widget_Ga::class)]
+final class WidgetTest extends IntegrationTestCase
+{
+    #[Test]
+    public function render_shows_the_connect_prompt_when_not_connected(): void
+    {
+        // No GA config → Tiger_Google_Analytics::isConnected() is false → the prompt branch.
+        $html = (new Analytics_Widget_Ga())->render();
+
+        $this->assertStringContainsString('Connect Google Analytics', $html, 'the set-up prompt is shown');
+        $this->assertStringContainsString('/analytics/admin', $html, 'links to the settings screen');
+        $this->assertStringContainsString('btn', $html, 'renders a CTA button');
+        $this->assertStringNotContainsString('<canvas', $html, 'no live chart shell when disconnected');
+    }
+
+    #[Test]
+    public function render_shows_the_live_chart_shell_when_connected(): void
+    {
+        $this->connectGa();
+
+        $html = (new Analytics_Widget_Ga())->render();
+
+        // Connected → the sparkline shell (its data arrives client-side over /api), not the prompt.
+        $this->assertStringContainsString('<canvas', $html, 'the chart canvas shell is rendered');
+        $this->assertStringContainsString('active users', $html);
+        $this->assertStringContainsString('/analytics/admin/dashboard', $html, 'links to the full dashboard');
+        $this->assertStringNotContainsString('Connect Google Analytics', $html, 'no set-up prompt when connected');
+    }
+
+    /**
+     * Make Tiger_Google_Analytics::isConnected() true: a crypto key + a property id + a decryptable
+     * refresh token (broker mode needs only those two). All read from the eager Zend_Config tier.
+     */
+    private function connectGa(): void
+    {
+        $key = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';   // 32 zero bytes, base64 (as CryptoTest)
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => ['crypto' => ['key' => $key]]], true));
+        $enc = Tiger_Crypto::encrypt('fake-refresh-token');
+
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => [
+            'crypto'    => ['key' => $key],
+            'analytics' => [
+                'property_id' => '123456789',
+                'oauth'       => ['mode' => 'broker', 'refresh_token_enc' => $enc],
+            ],
+        ]], true));
+    }
+}
diff --git a/tests/Integration/Backup/BackupServiceTest.php b/tests/Integration/Backup/BackupServiceTest.php
new file mode 100644
index 0000000..1ba8d1f
--- /dev/null
+++ b/tests/Integration/Backup/BackupServiceTest.php
@@ -0,0 +1,252 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Backup;
+
+use Backup_Service_Backup;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Backup;
+use Tiger_Log;
+use Tiger_Model_Backup;
+use Tiger_Model_Config;
+use Zend_Config;
+use Zend_Registry;
+
+// `Backup_Service_Backup` resolves via the harness module autoloader (tests/bootstrap.php).
+
+/**
+ * Backup_Service_Backup — the /api behind the Backup screen. Admin+ per modules/backup/configs/acl.ini.
+ * `run` creates a backup now; `remove` deletes one; `restore` restores (guarded by a typed confirm);
+ * `saveSettings` writes the tiger.backup.* config tier.
+ *
+ * These tests characterize:
+ *   - the ACL gate + input validation guards (bad component / bad disk / not-found / restore confirm),
+ *     which never touch the destructive path;
+ *   - a REAL end-to-end database-only backup (SQL dump → zip → local disk → catalog row) and its
+ *     removal, confined to the DATABASE component so no app files are collected;
+ *   - the destructive-restore GUARD logic (confirm !== 'RESTORE', a missing/failed backup) WITHOUT ever
+ *     running a real restore (which would overwrite the live DB + files).
+ *
+ * The catalog row rides the per-test transaction (rolled back for isolation); the physical zip on the
+ * local disk is cleaned up explicitly in tearDown.
+ */
+#[CoversClass(Backup_Service_Backup::class)]
+#[CoversClass(Tiger_Backup::class)]
+final class BackupServiceTest extends IntegrationTestCase
+{
+    /** Absolute paths of any archive bytes a real backup wrote — removed in tearDown. */
+    private array $artifacts = [];
+    private ?Zend_Config $priorConfig = null;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->priorConfig = Zend_Registry::isRegistered('Zend_Config') ? Zend_Registry::get('Zend_Config') : null;
+        // A null log sink — Tiger_Backup logs on some paths, which the strict output check would flag.
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => ['log' => ['writer' => 'null']]]));
+        Tiger_Log::reset();
+    }
+
+    protected function tearDown(): void
+    {
+        foreach ($this->artifacts as $f) { @unlink($f); }
+        $this->artifacts = [];
+        if ($this->priorConfig !== null) {
+            Zend_Registry::set('Zend_Config', $this->priorConfig);
+        } elseif (Zend_Registry::isRegistered('Zend_Config')) {
+            Zend_Registry::set('Zend_Config', new Zend_Config([]));
+        }
+        Tiger_Log::reset();
+        parent::tearDown();
+    }
+
+    private function dispatch(array $msg): object
+    {
+        return (new Backup_Service_Backup($msg))->getResponse();
+    }
+
+    private function messages(object $res): string
+    {
+        return json_encode($res->messages ?? []);
+    }
+
+    /** The local backups dir where Tiger_Backup stores archives (under APPLICATION_ROOT). */
+    private function localBackupDir(): string
+    {
+        return APPLICATION_ROOT . '/storage/backups';
+    }
+
+    // ---- ACL -------------------------------------------------------------------------------------
+
+    #[Test]
+    public function the_shipped_acl_gates_backup_to_admin_and_up(): void
+    {
+        $this->loginAs('admin');
+        $acl = Zend_Registry::get('Zend_Acl');
+
+        $this->assertTrue($acl->has('Backup_Service_Backup'), 'the acl.ini resource loaded');
+        $this->assertTrue($acl->isAllowed('admin', 'Backup_Service_Backup'));
+        $this->assertFalse($acl->isAllowed('user', 'Backup_Service_Backup'), 'a plain user is denied');
+        $this->assertFalse($acl->isAllowed('guest', 'Backup_Service_Backup'));
+    }
+
+    #[Test]
+    public function a_guest_is_denied_every_backup_verb(): void
+    {
+        $this->login('anon', 'o-1', 'guest');
+        foreach (['run', 'remove', 'restore', 'saveSettings'] as $action) {
+            $res = $this->dispatch(['action' => $action]);
+            $this->assertSame(0, (int) $res->result, "$action denied to a guest");
+            $this->assertStringContainsString('not_allowed', $this->messages($res));
+        }
+    }
+
+    // ---- run: input guards -----------------------------------------------------------------------
+
+    #[Test]
+    public function run_rejects_an_empty_or_unknown_component_set(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatch(['action' => 'run', 'components' => 'bogus,alsobad', 'disk' => 'local']);
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('bad_component', $this->messages($res));
+    }
+
+    #[Test]
+    public function run_rejects_an_unknown_disk(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatch(['action' => 'run', 'components' => 'database', 'disk' => 's3-nowhere']);
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('bad_disk', $this->messages($res));
+    }
+
+    // ---- run + remove: the real, database-only round trip ----------------------------------------
+
+    #[Test]
+    public function run_creates_a_database_backup_and_remove_deletes_it(): void
+    {
+        $this->loginAs('admin');
+
+        $res = $this->dispatch(['action' => 'run', 'components' => 'database', 'disk' => 'local', 'include_secrets' => '0']);
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $backupId = $res->data['backup_id'];
+        $filename = $res->data['filename'];
+        $this->assertNotEmpty($backupId);
+        $this->assertStringStartsWith('TigerBackup-', $filename);
+
+        // The archive bytes exist on the local disk...
+        $archive = $this->localBackupDir() . '/' . $filename;
+        $this->artifacts[] = $archive;   // ensure cleanup even if an assertion fails
+        $this->assertFileExists($archive, 'the zip was written to the local disk');
+
+        // ...and the catalog row is present + marked ok (it rides the per-test transaction).
+        $row = (new Tiger_Model_Backup())->findById($backupId);
+        $this->assertNotNull($row);
+        $this->assertSame('ok', $row['outcome']);
+        $this->assertSame('manual', $row['source']);
+
+        // remove() deletes the bytes and soft-deletes the row.
+        $del = $this->dispatch(['action' => 'remove', 'backup_id' => $backupId]);
+        $this->assertSame(1, (int) $del->result, $this->messages($del));
+        $this->assertFileDoesNotExist($archive, 'remove() deleted the archive bytes');
+    }
+
+    // ---- remove: not-found -----------------------------------------------------------------------
+
+    #[Test]
+    public function remove_reports_not_found_for_a_missing_backup(): void
+    {
+        $this->loginAs('admin');
+
+        $empty = $this->dispatch(['action' => 'remove', 'backup_id' => '']);
+        $this->assertSame(0, (int) $empty->result);
+        $this->assertStringContainsString('not_found', $this->messages($empty));
+
+        $unknown = $this->dispatch(['action' => 'remove', 'backup_id' => 'no-such-id']);
+        $this->assertSame(0, (int) $unknown->result);
+        $this->assertStringContainsString('not_found', $this->messages($unknown));
+    }
+
+    // ---- restore: the destructive guard (no real restore ever runs) ------------------------------
+
+    #[Test]
+    public function restore_requires_the_typed_confirmation(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatch(['action' => 'restore', 'backup_id' => 'anything', 'confirm' => 'yes please']);
+
+        $this->assertSame(0, (int) $res->result, 'a wrong confirm string is refused BEFORE any restore work');
+        $this->assertStringContainsString('restore.confirm', $this->messages($res));
+    }
+
+    #[Test]
+    public function restore_reports_not_found_for_an_unknown_backup_even_when_confirmed(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatch(['action' => 'restore', 'backup_id' => 'no-such-id', 'confirm' => 'RESTORE']);
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_found', $this->messages($res));
+    }
+
+    #[Test]
+    public function restore_refuses_a_backup_that_did_not_finish_ok(): void
+    {
+        $this->loginAs('admin');
+        // A catalog row still 'running' (never finished) must not be restorable — guarded before any
+        // destructive action. We insert the row directly (rides the per-test transaction).
+        $id = (new Tiger_Model_Backup())->begin('TigerBackup-unfinished.zip', 'local', ['database'], 'manual');
+
+        $res = $this->dispatch(['action' => 'restore', 'backup_id' => $id, 'confirm' => 'RESTORE']);
+        $this->assertSame(0, (int) $res->result, 'a non-ok backup is refused');
+        $this->assertStringContainsString('not_found', $this->messages($res));
+    }
+
+    // ---- saveSettings ----------------------------------------------------------------------------
+
+    #[Test]
+    public function save_settings_writes_the_backup_config_tier(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatch([
+            'action'          => 'saveSettings',
+            'components'      => 'database,media',
+            'disk'           => 'local',
+            'include_secrets' => '1',
+            'retention_max'  => '5',
+            'notify_enabled' => '1',
+            'notify_email'   => 'ops@example.com',
+        ]);
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $cfg = new Tiger_Model_Config();
+        $g   = Tiger_Model_Config::SCOPE_GLOBAL;
+        $this->assertSame('database,media', $cfg->get($g, '', 'tiger.backup.components'));
+        $this->assertSame('local', $cfg->get($g, '', 'tiger.backup.disk'));
+        $this->assertSame('1', $cfg->get($g, '', 'tiger.backup.include_secrets'));
+        $this->assertSame('5', $cfg->get($g, '', 'tiger.backup.retention.max'));
+        $this->assertSame('1', $cfg->get($g, '', 'tiger.backup.notify.enabled'));
+        $this->assertSame('ops@example.com', $cfg->get($g, '', 'tiger.backup.notify.email'));
+    }
+
+    #[Test]
+    public function save_settings_rejects_a_bad_disk_and_a_bad_email(): void
+    {
+        $this->loginAs('admin');
+
+        $badDisk = $this->dispatch(['action' => 'saveSettings', 'components' => 'database', 'disk' => 'nope']);
+        $this->assertSame(0, (int) $badDisk->result);
+        $this->assertStringContainsString('bad_disk', $this->messages($badDisk));
+
+        $badEmail = $this->dispatch(['action' => 'saveSettings', 'components' => 'database', 'disk' => 'local', 'notify_email' => 'not-an-email']);
+        $this->assertSame(0, (int) $badEmail->result);
+        $this->assertStringContainsString('bad_email', $this->messages($badEmail));
+    }
+}
diff --git a/tests/Integration/Blog/BlogBootstrapTest.php b/tests/Integration/Blog/BlogBootstrapTest.php
new file mode 100644
index 0000000..b6907fc
--- /dev/null
+++ b/tests/Integration/Blog/BlogBootstrapTest.php
@@ -0,0 +1,105 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Blog;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use ReflectionMethod;
+use ReflectionProperty;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Page;
+use Tiger_Search;
+use Tiger_Sitemap;
+use Zend_Controller_Front;
+
+/**
+ * Blog_Bootstrap — the module's wiring: public /blog routes, the "articles" search-provider tap-in
+ * (the reference Tiger_Search demo), and the sitemap/llms provider.
+ *
+ * Each _init* is invoked directly (the harness doesn't boot module bootstraps) and its effect is
+ * asserted against the real registries: the router has the blog routes, Tiger_Search has the
+ * articles provider whose closure resolves seeded articles, and Tiger_Sitemap::collect() runs the
+ * blog provider closure over published articles (excerpt/desc unpacked from page.meta).
+ */
+#[CoversClass(\Blog_Bootstrap::class)]
+final class BlogBootstrapTest extends IntegrationTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        require_once TIGER_CORE_PATH . '/modules/blog/Bootstrap.php';
+        $this->login('blogger', 'org-test', 'admin');
+    }
+
+    protected function tearDown(): void
+    {
+        // Clear the static registries so a leaked provider can't touch a later test.
+        Tiger_Search::reset();
+        (new ReflectionProperty(Tiger_Sitemap::class, '_providers'))->setValue(null, []);
+        parent::tearDown();
+    }
+
+    private function invoke(string $method): void
+    {
+        $inst = (new \ReflectionClass('Blog_Bootstrap'))->newInstanceWithoutConstructor();
+        (new ReflectionMethod('Blog_Bootstrap', $method))->invoke($inst);
+    }
+
+    private function seedArticle(array $overrides): string
+    {
+        return (new Tiger_Model_Page())->insert(array_merge([
+            'type'         => 'article',
+            'org_id'       => 'org-test',
+            'locale'       => 'en',
+            'title'        => 'Sitemap Post',
+            'body'         => '<p>body</p>',
+            'format'       => 'html',
+            'status'       => 'published',
+            'published_at' => '2023-01-01 00:00:00',
+            'meta'         => json_encode(['excerpt' => 'The excerpt line']),
+        ], $overrides));
+    }
+
+    #[Test]
+    public function it_registers_the_public_blog_routes(): void
+    {
+        $this->invoke('_initBlogRoutes');
+        $router = Zend_Controller_Front::getInstance()->getRouter();
+
+        foreach (['blog_single', 'blog_category', 'blog_tag', 'blog_feed', 'blog_admin'] as $name) {
+            $this->assertTrue($router->hasRoute($name), "route $name registered");
+        }
+    }
+
+    #[Test]
+    public function it_registers_the_articles_search_provider_that_resolves_articles(): void
+    {
+        Tiger_Search::reset();
+        $this->invoke('_initSearchProvider');
+
+        $provider = Tiger_Search::get('articles');
+        $this->assertNotNull($provider, 'the articles provider is registered');
+        $this->assertSame('Articles', $provider['label']);
+
+        $this->seedArticle(['title' => 'Searchable Encyclopedia Article', 'slug' => 'enc-art', 'page_key' => 'enc-art', 'body' => 'encyclopedia entry text']);
+        $res = Tiger_Search::query('encyclopedia', ['role' => 'guest', 'orgId' => 'org-test', 'locale' => 'en', 'only' => ['articles']]);
+
+        $urls = array_column($res['results'], 'url');
+        $this->assertContains('/blog/enc-art', $urls, 'the provider closure resolved the article to a /blog URL');
+    }
+
+    #[Test]
+    public function it_registers_the_sitemap_provider_over_published_articles(): void
+    {
+        (new ReflectionProperty(Tiger_Sitemap::class, '_providers'))->setValue(null, []);
+        $this->invoke('_initBlogSitemap');
+
+        $this->seedArticle(['title' => 'In The Map', 'slug' => 'in-the-map', 'page_key' => 'in-the-map']);
+        $urls = Tiger_Sitemap::collect(['locale' => 'en', 'orgId' => 'org-test']);
+
+        $locs = array_column($urls, 'loc');
+        $this->assertContains('/blog/in-the-map', $locs, 'the published article is contributed to the sitemap');
+    }
+}
diff --git a/tests/Integration/Blog/PostModelTest.php b/tests/Integration/Blog/PostModelTest.php
new file mode 100644
index 0000000..2db040e
--- /dev/null
+++ b/tests/Integration/Blog/PostModelTest.php
@@ -0,0 +1,275 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Blog;
+
+use Blog_Model_Post;
+use Blog_Model_Taxonomy;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Media;
+use Tiger_Model_Page;
+use Tiger_Model_PageVersion;
+use Tiger_Model_User;
+
+/**
+ * Blog_Model_Post — an article is a `page` row (type='article') layered with the page.meta JSON
+ * convention, reading-time derivation, article-scoped listing/resolution, the presentation
+ * projection (author + feature media), and the admin DataTables query.
+ *
+ * Coverage: packMeta/unpackMeta round-trip (defaults, SEO nesting, unknown-key ignore), readingTime
+ * (floor of 1), saveArticle (defers to the transactional Tiger_Model_Page::save → version snapshot),
+ * resolveArticle (published-gated by slug), present() (both the bare row and the author/feature
+ * branches), published() (schedule gate + pageIds scoping + empty short-circuit), and
+ * articleDatatable (total/filtered/search/status/order/paging).
+ */
+#[CoversClass(Blog_Model_Post::class)]
+final class PostModelTest extends IntegrationTestCase
+{
+    private Blog_Model_Post $posts;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        // Stamp org so saved rows land in 'org-test' and the org-scoped reads resolve deterministically.
+        $this->login('author-1', 'org-test', 'admin');
+        $this->posts = new Blog_Model_Post();
+    }
+
+    /** Save an article via the model and return its page_id (nests inside the harness txn). */
+    private function makeArticle(array $fields = []): string
+    {
+        return $this->posts->saveArticle(array_merge([
+            'page_key' => 'a-' . uniqid(),
+            'slug'     => 's-' . uniqid(),
+            'locale'   => 'en',
+            'title'    => 'An Article',
+            'body'     => '<p>Body text here</p>',
+            'status'   => Blog_Model_Post::STATUS_PUBLISHED,
+        ], $fields));
+    }
+
+    // ----- meta packing --------------------------------------------------------------------------
+
+    #[Test]
+    public function pack_meta_maps_fields_derives_reading_time_and_nests_seo(): void
+    {
+        $meta = $this->posts->packMeta([
+            'kicker'   => 'Kick',
+            'subtitle' => 'Sub',
+            'preamble' => 'Pre',
+            'excerpt'  => 'Ex',
+            'author_id'      => 'u-9',
+            'feature_media_id' => 'm-3',
+            'body'     => str_repeat('word ', 400),   // 400 words → 2 minutes
+            'allow_comments'  => '1',
+            'seo_title'       => 'SEO T',
+            'seo_description' => 'SEO D',
+            'og_image_id'     => 'og-1',
+            'canonical'       => 'https://x/y',
+            'ignored_key'     => 'nope',
+        ]);
+
+        $this->assertSame('Kick', $meta['kicker']);
+        $this->assertSame('u-9', $meta['author_id']);
+        $this->assertSame(2, $meta['reading_time'], '400 words / 200 wpm = 2');
+        $this->assertTrue($meta['allow_comments']);
+        $this->assertSame('SEO T', $meta['seo']['title']);
+        $this->assertSame('og-1', $meta['seo']['og_image_id']);
+        $this->assertArrayNotHasKey('ignored_key', $meta, 'unknown editor keys are dropped');
+    }
+
+    #[Test]
+    public function pack_meta_defaults_when_fields_absent(): void
+    {
+        $meta = $this->posts->packMeta([]);
+        $this->assertSame('', $meta['kicker']);
+        $this->assertFalse($meta['allow_comments'], 'absent checkbox → false');
+        $this->assertSame(1, $meta['reading_time'], 'empty body still floors at 1');
+        $this->assertSame(['title' => '', 'description' => '', 'og_image_id' => '', 'canonical' => ''], $meta['seo']);
+    }
+
+    #[Test]
+    public function unpack_meta_accepts_json_or_array_and_fills_defaults(): void
+    {
+        $json = json_encode(['kicker' => 'K', 'seo' => ['title' => 'T']]);
+        $fromJson  = $this->posts->unpackMeta($json);
+        $fromArray = $this->posts->unpackMeta(['kicker' => 'K', 'seo' => ['title' => 'T']]);
+
+        $this->assertSame('K', $fromJson['kicker']);
+        $this->assertSame('T', $fromJson['seo']['title']);
+        $this->assertSame('', $fromJson['seo']['description'], 'missing seo keys keep defaults');
+        $this->assertSame($fromJson, $fromArray, 'string and array inputs decode identically');
+    }
+
+    #[Test]
+    public function reading_time_floors_at_one_minute(): void
+    {
+        $this->assertSame(1, $this->posts->readingTime(''));
+        $this->assertSame(1, $this->posts->readingTime('<p>just a few words</p>'));
+        $this->assertSame(3, $this->posts->readingTime(str_repeat('w ', 500)), '500 words → ceil(2.5) = 3');
+    }
+
+    // ----- saveArticle ---------------------------------------------------------------------------
+
+    #[Test]
+    public function save_article_writes_a_page_row_typed_article_and_snapshots_a_version(): void
+    {
+        $id = $this->makeArticle(['title' => 'Saved One', 'body' => 'hello world words']);
+
+        $row = (new Tiger_Model_Page())->findById($id);
+        $this->assertSame(Blog_Model_Post::TYPE_ARTICLE, $row->type, 'stored as an article page');
+        $this->assertSame('Saved One', $row->title);
+        $this->assertSame(Blog_Model_Post::FORMAT_HTML, $row->format);
+        $this->assertSame('org-test', $row->org_id, 'org-scoped from the acting tenant');
+
+        $meta = json_decode($row->meta, true);
+        $this->assertArrayHasKey('reading_time', $meta, 'meta packed onto the row');
+
+        $this->assertCount(1, (new Tiger_Model_PageVersion())->recentForPage($id, 10), 'one version snapshot');
+    }
+
+    #[Test]
+    public function save_article_updates_in_place_and_adds_a_version(): void
+    {
+        $id = $this->makeArticle(['slug' => 'stable-slug', 'page_key' => 'stable-slug', 'title' => 'V1']);
+        $again = $this->posts->saveArticle([
+            'page_key' => 'stable-slug', 'slug' => 'stable-slug', 'locale' => 'en',
+            'title' => 'V2', 'body' => 'more', 'status' => 'published',
+        ], $id);
+
+        $this->assertSame($id, $again, 'same page_id → an update');
+        $this->assertSame('V2', (new Tiger_Model_Page())->findById($id)->title);
+        $this->assertCount(2, (new Tiger_Model_PageVersion())->recentForPage($id, 10));
+    }
+
+    #[Test]
+    public function save_article_defaults_status_and_null_published_at(): void
+    {
+        $id = $this->posts->saveArticle([
+            'page_key' => 'defaulted', 'slug' => 'defaulted', 'locale' => 'en',
+            'title' => 'Defaulted', 'body' => 'x',   // no status, no published_at
+        ]);
+        $row = (new Tiger_Model_Page())->findById($id);
+        $this->assertSame(Blog_Model_Post::STATUS_DRAFT, $row->status, 'status defaults to draft');
+        $this->assertNull($row->published_at, 'empty published_at stored as NULL');
+    }
+
+    // ----- resolveArticle ------------------------------------------------------------------------
+
+    #[Test]
+    public function resolve_article_returns_a_published_article_by_slug(): void
+    {
+        $this->makeArticle(['slug' => 'find-me', 'page_key' => 'find-me', 'status' => 'published']);
+        $found = $this->posts->resolveArticle('find-me', 'en', 'org-test');
+        $this->assertNotNull($found);
+        $this->assertSame('find-me', $found->slug);
+    }
+
+    #[Test]
+    public function resolve_article_does_not_surface_a_draft(): void
+    {
+        $this->makeArticle(['slug' => 'hidden', 'page_key' => 'hidden', 'status' => 'draft']);
+        $this->assertNull($this->posts->resolveArticle('hidden', 'en', 'org-test'), 'drafts are not resolvable');
+    }
+
+    // ----- present -------------------------------------------------------------------------------
+
+    #[Test]
+    public function present_projects_a_bare_row_with_no_author_or_feature(): void
+    {
+        $id  = $this->makeArticle(['title' => 'Bare', 'slug' => 'bare', 'page_key' => 'bare', 'kicker' => 'Kick', 'subtitle' => 'Sub']);
+        $row = (new Tiger_Model_Page())->findById($id);
+
+        $data = $this->posts->present($row);
+        $this->assertSame('Bare', $data['title']);
+        $this->assertSame('/blog/bare', $data['url']);
+        $this->assertSame('Kick', $data['kicker']);
+        $this->assertSame('Sub', $data['excerpt'], 'excerpt falls back to subtitle when unset');
+        $this->assertSame('', $data['author']['name'], 'no author id → empty name');
+        $this->assertNull($data['feature'], 'no feature id → null feature');
+    }
+
+    #[Test]
+    public function present_resolves_the_author_name_and_feature_media(): void
+    {
+        $uid = (new Tiger_Model_User())->insert(['email' => 'byline@example.com', 'username' => 'byline']);
+        $mid = (new Tiger_Model_Media())->insert([
+            'org_id' => 'org-test', 'filename' => 'hero.jpg', 'mime_type' => 'image/jpeg',
+            'storage_key' => 'k/hero.jpg', 'disk' => 'local', 'kind' => 'image',
+        ]);
+
+        $id  = $this->makeArticle(['title' => 'Rich', 'slug' => 'rich', 'page_key' => 'rich', 'author_id' => $uid, 'feature_media_id' => $mid]);
+        $row = (new Tiger_Model_Page())->findById($id);
+
+        $data = $this->posts->present($row);
+        $this->assertSame($uid, $data['author']['id']);
+        $this->assertSame('byline', $data['author']['name'], 'author name resolved from the user row');
+        $this->assertIsArray($data['feature']);
+        $this->assertSame($mid, $data['feature']['id']);
+        $this->assertArrayHasKey('url', $data['feature']);
+    }
+
+    // ----- published listing ---------------------------------------------------------------------
+
+    #[Test]
+    public function published_lists_live_articles_newest_first_and_skips_future_and_drafts(): void
+    {
+        $this->makeArticle(['title' => 'Old', 'slug' => 'old', 'page_key' => 'old', 'status' => 'published', 'published_at' => '2020-01-01 00:00:00']);
+        $this->makeArticle(['title' => 'New', 'slug' => 'new', 'page_key' => 'new', 'status' => 'published', 'published_at' => '2024-01-01 00:00:00']);
+        $this->makeArticle(['title' => 'Draft', 'slug' => 'draft', 'page_key' => 'draft', 'status' => 'draft']);
+        $this->makeArticle(['title' => 'Future', 'slug' => 'future', 'page_key' => 'future', 'status' => 'published', 'published_at' => date('Y-m-d H:i:s', time() + 86400)]);
+
+        $rows = [];
+        foreach ($this->posts->published(['locale' => 'en', 'orgId' => 'org-test', 'limit' => 20]) as $r) { $rows[] = $r->title; }
+
+        $this->assertContains('New', $rows);
+        $this->assertContains('Old', $rows);
+        $this->assertNotContains('Draft', $rows, 'drafts excluded');
+        $this->assertNotContains('Future', $rows, 'scheduled-future excluded');
+        $this->assertSame('New', $rows[0], 'newest published_at first');
+    }
+
+    #[Test]
+    public function published_scopes_to_page_ids_and_short_circuits_on_empty(): void
+    {
+        $keep = $this->makeArticle(['title' => 'Keep', 'slug' => 'keep', 'page_key' => 'keep', 'status' => 'published', 'published_at' => '2023-01-01 00:00:00']);
+        $this->makeArticle(['title' => 'Skip', 'slug' => 'skip', 'page_key' => 'skip', 'status' => 'published', 'published_at' => '2023-01-01 00:00:00']);
+
+        $scoped = [];
+        foreach ($this->posts->published(['locale' => 'en', 'orgId' => 'org-test', 'pageIds' => [$keep]]) as $r) { $scoped[] = $r->title; }
+        $this->assertSame(['Keep'], $scoped, 'only the linked page id');
+
+        $empty = $this->posts->published(['locale' => 'en', 'orgId' => 'org-test', 'pageIds' => []]);
+        $this->assertSame([], $empty, 'no page ids → empty result, no query');
+    }
+
+    // ----- articleDatatable ----------------------------------------------------------------------
+
+    #[Test]
+    public function article_datatable_counts_searches_filters_and_paginates(): void
+    {
+        $this->makeArticle(['title' => 'Alpha Report', 'slug' => 'alpha', 'page_key' => 'alpha', 'status' => 'published']);
+        $this->makeArticle(['title' => 'Beta Report', 'slug' => 'beta', 'page_key' => 'beta', 'status' => 'draft']);
+
+        $all = $this->posts->articleDatatable(['limit' => 25, 'offset' => 0]);
+        $this->assertSame(2, $all['total']);
+        $this->assertSame(2, $all['filtered']);
+
+        $searched = $this->posts->articleDatatable(['search' => 'Alpha', 'limit' => 25]);
+        $this->assertSame(2, $searched['total'], 'total ignores search');
+        $this->assertSame(1, $searched['filtered'], 'filtered honors search');
+        $this->assertSame('Alpha Report', $searched['rows'][0]['title']);
+
+        $draftsOnly = $this->posts->articleDatatable(['status' => 'draft', 'limit' => 25]);
+        $this->assertSame(1, $draftsOnly['total'], 'status scopes the working set');
+
+        $ordered = $this->posts->articleDatatable(['orderCol' => 0, 'orderDir' => 'ASC', 'limit' => 25]);
+        $this->assertSame('Alpha Report', $ordered['rows'][0]['title'], 'title ASC order applied');
+
+        $paged = $this->posts->articleDatatable(['limit' => 1, 'offset' => 0, 'orderCol' => 0, 'orderDir' => 'ASC']);
+        $this->assertCount(1, $paged['rows'], 'limit paginates');
+    }
+}
diff --git a/tests/Integration/Blog/PostServiceTest.php b/tests/Integration/Blog/PostServiceTest.php
new file mode 100644
index 0000000..1c62d6e
--- /dev/null
+++ b/tests/Integration/Blog/PostServiceTest.php
@@ -0,0 +1,300 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Blog;
+
+use Blog_Form_Post;
+use Blog_Model_Post;
+use Blog_Model_Taxonomy;
+use Blog_Service_Post;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Page;
+use Tiger_Model_PageVersion;
+use Zend_Registry;
+
+/**
+ * Blog_Service_Post — the /api authoring service for articles (datatable / save / delete / restore).
+ *
+ * Coverage: the ACL gate (admin+, deny-by-default), the DataTables envelope with server-computed
+ * per-row flags + status filter + the computed `scheduled` flag, save() (slug derivation from
+ * title, reserved-slug + blank-slug refusal, form-validation, taxonomy sync creating + linking
+ * terms, update-in-place), soft-delete + its clean-error edge, and restore (+ its bad-version edge).
+ *
+ * Blog_Form_Post carries CSRF, so the request is flagged STATELESS (Tiger_Form's token-request skip).
+ * Blog_Model_Post::saveArticle opens its own transaction, which nests under the harness txn via the
+ * SavepointAdapter — happy paths dispatch inline and the per-test rollback isolates.
+ */
+#[CoversClass(Blog_Service_Post::class)]
+#[CoversClass(Blog_Form_Post::class)]
+final class PostServiceTest extends IntegrationTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    /** Dispatch the service (constructor runs the action) and return the response object. */
+    private function call(string $action, array $params = []): object
+    {
+        return (new Blog_Service_Post(['action' => $action] + $params))->getResponse();
+    }
+
+    /** Seed an article row directly (stays in the harness txn — for read/datatable tests). */
+    private function seedArticle(array $overrides): string
+    {
+        return (new Tiger_Model_Page())->insert(array_merge([
+            'type'     => Blog_Model_Post::TYPE_ARTICLE,
+            'org_id'   => 'org-test',
+            'locale'   => 'en',
+            'title'    => 'Seed Article',
+            'body'     => '',
+            'format'   => Tiger_Model_Page::FORMAT_HTML,
+            'status'   => Blog_Model_Post::STATUS_DRAFT,
+            'meta'     => json_encode(Blog_Model_Post::META_DEFAULTS),
+        ], $overrides));
+    }
+
+    // ----- ACL gate ------------------------------------------------------------------------------
+
+    #[Test]
+    public function guest_and_plain_user_are_denied_admin_clears(): void
+    {
+        $this->login('anon', 'org-test', 'guest');
+        $this->assertStringContainsString('not_allowed', json_encode($this->call('datatable')->messages), 'guest denied');
+
+        $this->loginAs('user');
+        $this->assertSame(0, (int) $this->call('datatable')->result, 'plain user denied');
+
+        $this->loginAs('admin');
+        $this->assertSame(1, (int) $this->call('datatable', ['draw' => 1])->result, 'admin allowed');
+    }
+
+    // ----- datatable -----------------------------------------------------------------------------
+
+    #[Test]
+    public function datatable_returns_the_envelope_with_flags_and_handle(): void
+    {
+        $this->loginAs('admin');
+        $this->seedArticle(['title' => 'Grid Article', 'slug' => 'grid-article', 'page_key' => 'grid-article']);
+
+        $data = $this->call('datatable', ['draw' => 7, 'start' => 0, 'length' => 25, 'search' => 'Grid Article'])->data;
+        $this->assertSame(7, $data['draw']);
+        $this->assertSame(1, $data['recordsFiltered']);
+        $row = $data['data'][0];
+        $this->assertSame('Grid Article', $row['title']);
+        $this->assertSame('/blog/grid-article', $row['handle'], 'handle is /blog/<slug>');
+        $this->assertTrue($row['can_edit']);
+        $this->assertArrayHasKey('can_delete', $row);
+    }
+
+    #[Test]
+    public function datatable_status_filter_scopes_and_untitled_falls_back(): void
+    {
+        $this->loginAs('admin');
+        $this->seedArticle(['title' => 'A Draft', 'slug' => 'a-draft', 'page_key' => 'a-draft', 'status' => 'draft']);
+        $this->seedArticle(['title' => '', 'slug' => '', 'page_key' => 'pub-untitled', 'status' => 'published']);
+
+        $drafts = $this->call('datatable', ['draw' => 1, 'start' => 0, 'length' => 25, 'status' => 'draft'])->data;
+        $this->assertSame(1, $drafts['recordsTotal'], 'status filter scopes the working set');
+
+        $all = $this->call('datatable', ['draw' => 1, 'start' => 0, 'length' => 25])->data;
+        $titles = array_column($all['data'], 'title');
+        $this->assertContains('(untitled)', $titles, 'a blank title renders as (untitled)');
+        // the untitled published row has an empty handle (no slug).
+        foreach ($all['data'] as $r) {
+            if ($r['title'] === '(untitled)') { $this->assertSame('', $r['handle'], 'no slug → empty handle'); }
+        }
+    }
+
+    #[Test]
+    public function datatable_flags_a_future_published_article_as_scheduled(): void
+    {
+        $this->loginAs('admin');
+        $future = date('Y-m-d H:i:s', time() + 86400);
+        $this->seedArticle(['title' => 'Sched Article', 'slug' => 'sched-article', 'page_key' => 'sched-article', 'status' => 'published', 'published_at' => $future]);
+
+        $data = $this->call('datatable', ['draw' => 1, 'start' => 0, 'length' => 25, 'search' => 'Sched Article'])->data;
+        $this->assertTrue($data['data'][0]['scheduled'], 'published + future published_at = scheduled');
+    }
+
+    // ----- save ----------------------------------------------------------------------------------
+
+    #[Test]
+    public function save_creates_an_article_derives_slug_and_syncs_taxonomy(): void
+    {
+        $this->login('blog-admin', 'org-test', 'admin');
+
+        $res = $this->call('save', [
+            'title'      => 'My First Post',   // slug derived from this
+            'body'       => '<p>Content body words here</p>',
+            'status'     => 'published',
+            'locale'     => 'en',
+            'categories' => 'Tech, News',
+            'tags'       => 'php, tiger',
+        ]);
+        $this->assertSame(1, (int) $res->result, json_encode($res->messages));
+        $this->assertSame('/blog/post', $res->redirect, 'redirects to the article list');
+        $id = $res->data['page_id'];
+
+        $row = (new Tiger_Model_Page())->findById($id);
+        $this->assertSame('My First Post', $row->title);
+        $this->assertSame('my-first-post', $row->slug, 'slug derived from the title');
+        $this->assertSame('org-test', $row->org_id, 'org-scoped');
+
+        // taxonomy: two categories + two tags were minted and linked (4 terms).
+        $tax   = new Blog_Model_Taxonomy();
+        $names = array_map(fn($r) => $r['name'], $tax->forPage($id));
+        $this->assertContains('Tech', $names);
+        $this->assertContains('php', $names);
+        $this->assertCount(4, $names, 'all four typed terms linked');
+
+        $this->assertCount(1, (new Tiger_Model_PageVersion())->recentForPage($id, 10), 'one version snapshot');
+    }
+
+    #[Test]
+    public function save_honors_an_explicit_slug(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('save', ['title' => 'Title Here', 'slug' => 'Custom Slug!', 'status' => 'draft', 'locale' => 'en']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('custom-slug', (new Tiger_Model_Page())->findById($res->data['page_id'])->slug, 'explicit slug is slugified');
+    }
+
+    #[Test]
+    public function save_refuses_a_reserved_slug(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('save', ['title' => 'Feed', 'slug' => 'feed', 'status' => 'draft', 'locale' => 'en']);
+        $this->assertSame(0, (int) $res->result, 'a reserved path is refused');
+        $this->assertStringContainsString('slug_reserved', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function save_refuses_when_the_slug_resolves_empty(): void
+    {
+        $this->loginAs('admin');
+        // A title of only punctuation slugifies to '' (and no explicit slug given).
+        $res = $this->call('save', ['title' => '!!!', 'status' => 'draft', 'locale' => 'en']);
+        $this->assertSame(0, (int) $res->result, 'an empty derived slug is refused');
+        $this->assertStringContainsString('blog.error.slug', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function save_returns_a_form_error_for_a_blank_title(): void
+    {
+        $this->loginAs('admin');
+        $before = (int) $this->db->fetchOne('SELECT COUNT(*) FROM page');
+
+        $res = $this->call('save', ['title' => '', 'status' => 'draft', 'locale' => 'en']);
+        $this->assertSame(0, (int) $res->result, 'title is required');
+        $this->assertNotNull($res->form);
+        $this->assertArrayHasKey('title', $res->form);
+        $this->assertSame($before, (int) $this->db->fetchOne('SELECT COUNT(*) FROM page'), 'nothing inserted');
+    }
+
+    #[Test]
+    public function save_updates_in_place_and_rewrites_taxonomy(): void
+    {
+        $this->login('blog-admin', 'org-test', 'admin');
+        $create = $this->call('save', ['title' => 'Editable', 'slug' => 'editable', 'status' => 'draft', 'locale' => 'en', 'categories' => 'One']);
+        $id = $create->data['page_id'];
+
+        $update = $this->call('save', ['post_id' => $id, 'title' => 'Editable v2', 'slug' => 'editable', 'status' => 'published', 'locale' => 'en', 'categories' => 'Two']);
+        $this->assertSame(1, (int) $update->result);
+        $this->assertSame($id, $update->data['page_id'], 'same id — an update');
+
+        $this->assertSame('Editable v2', (new Tiger_Model_Page())->findById($id)->title);
+        $names = array_map(fn($r) => $r['name'], (new Blog_Model_Taxonomy())->forPage($id));
+        $this->assertSame(['Two'], $names, 'taxonomy rewritten to the new set');
+        $this->assertCount(2, (new Tiger_Model_PageVersion())->recentForPage($id, 10), 'each save snapshots a version');
+    }
+
+    #[Test]
+    public function save_turns_a_duplicate_slug_into_a_clean_error(): void
+    {
+        $this->login('blog-admin', 'org-test', 'admin');
+        $first = $this->call('save', ['title' => 'Unique One', 'slug' => 'dupe-slug', 'status' => 'draft', 'locale' => 'en']);
+        $this->assertSame(1, (int) $first->result);
+
+        // A second NEW article with the same slug violates the (org_id, slug, locale) unique key →
+        // saveArticle throws → the service catch turns it into result=0, not a fatal.
+        $dup = $this->call('save', ['title' => 'Unique Two', 'slug' => 'dupe-slug', 'status' => 'draft', 'locale' => 'en']);
+        $this->assertSame(0, (int) $dup->result, 'a duplicate slug is a clean error');
+        $this->assertNotEmpty($dup->messages);
+    }
+
+    // ----- delete --------------------------------------------------------------------------------
+
+    #[Test]
+    public function delete_soft_deletes_and_reads_exclude_it(): void
+    {
+        $this->loginAs('admin');
+        $model = new Blog_Model_Post();
+        $id = $this->seedArticle(['title' => 'Doomed', 'slug' => 'doomed', 'page_key' => 'doomed']);
+
+        $res = $this->call('delete', ['post_id' => $id]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('/blog/post', $res->redirect);
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT deleted FROM page WHERE page_id = ?', [$id]));
+        $this->assertNull($model->findById($id), 'a deleted article is excluded from reads');
+    }
+
+    #[Test]
+    public function delete_with_no_id_is_a_clean_error(): void
+    {
+        $this->loginAs('admin');
+        $this->assertSame(0, (int) $this->call('delete', ['post_id' => ''])->result, 'a missing id is refused, not fatal');
+    }
+
+    // ----- restore -------------------------------------------------------------------------------
+
+    #[Test]
+    public function restore_reverts_the_article_to_a_prior_version(): void
+    {
+        $this->login('blog-admin', 'org-test', 'admin');
+        $create = $this->call('save', ['title' => 'Original Title', 'slug' => 'restorable', 'status' => 'draft', 'locale' => 'en', 'body' => 'first']);
+        $id = $create->data['page_id'];   // version 1
+        $this->call('save', ['post_id' => $id, 'title' => 'Edited Title', 'slug' => 'restorable', 'status' => 'draft', 'locale' => 'en', 'body' => 'second']);   // version 2
+
+        $res = $this->call('restore', ['post_id' => $id, 'version' => 1]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('/blog/post/edit/id/' . $id, $res->redirect);
+
+        $row = (new Tiger_Model_Page())->findById($id);
+        $this->assertSame('Original Title', $row->title, 'reverted to version 1');
+        $this->assertSame('first', $row->body);
+        $this->assertCount(3, (new Tiger_Model_PageVersion())->recentForPage($id, 10), 'the restore itself snapshots a version');
+    }
+
+    #[Test]
+    public function restore_with_a_bad_version_is_a_clean_error(): void
+    {
+        $this->loginAs('admin');
+        $this->assertSame(0, (int) $this->call('restore', ['post_id' => 'x', 'version' => 0])->result, 'version < 1 refused up front');
+        $this->assertSame(0, (int) $this->call('restore', ['post_id' => '', 'version' => 2])->result, 'a missing id is refused');
+    }
+
+    #[Test]
+    public function restore_of_a_nonexistent_version_is_a_clean_error(): void
+    {
+        $this->login('blog-admin', 'org-test', 'admin');
+        $create = $this->call('save', ['title' => 'Only V1', 'slug' => 'only-v1', 'status' => 'draft', 'locale' => 'en']);
+        $id = $create->data['page_id'];
+
+        // Version 99 doesn't exist → restoreVersion throws → the service catch → result=0 (not fatal).
+        $res = $this->call('restore', ['post_id' => $id, 'version' => 99]);
+        $this->assertSame(0, (int) $res->result, 'a missing version is a clean error');
+        $this->assertNotEmpty($res->messages);
+    }
+}
diff --git a/tests/Integration/Blog/TaxonomyModelTest.php b/tests/Integration/Blog/TaxonomyModelTest.php
new file mode 100644
index 0000000..992d116
--- /dev/null
+++ b/tests/Integration/Blog/TaxonomyModelTest.php
@@ -0,0 +1,179 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Blog;
+
+use Blog_Model_Taxonomy;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+
+/**
+ * Blog_Model_Taxonomy — categories, tags, and the page↔term join (`page_taxonomy`).
+ *
+ * Coverage: findOrCreate (mint-on-first-use, slug-collapse match, empty→null), listVocabulary
+ * (vocab/locale/org scope + ordering), resolveTermBySlug (tenant-over-global), the join maintenance
+ * (syncPage full-rewrite ignoring blanks, forPage in author order + vocab filter, pageIdsForTerm),
+ * counts (published-only per-term counts), and slugify.
+ */
+#[CoversClass(Blog_Model_Taxonomy::class)]
+final class TaxonomyModelTest extends IntegrationTestCase
+{
+    private Blog_Model_Taxonomy $tax;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->login('editor-1', 'org-test', 'admin');
+        $this->tax = new Blog_Model_Taxonomy();
+    }
+
+    // ----- findOrCreate --------------------------------------------------------------------------
+
+    #[Test]
+    public function find_or_create_mints_a_term_then_reuses_it_by_slug(): void
+    {
+        $first = $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'Web Dev', 'en', 'org-test');
+        $this->assertNotNull($first);
+
+        // "web-dev" collapses to the same slug → same term id, no duplicate.
+        $again = $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'web-dev', 'en', 'org-test');
+        $this->assertSame($first, $again, 'a matching slug resolves the existing term');
+
+        $row = $this->tax->findById($first);
+        $this->assertSame('web-dev', $row->slug);
+        $this->assertSame('Web Dev', $row->name, 'the first-seen display name is kept');
+        $this->assertSame('active', $row->status);
+    }
+
+    #[Test]
+    public function find_or_create_returns_null_for_a_blank_name(): void
+    {
+        $this->assertNull($this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_TAG, '   ', 'en', 'org-test'));
+    }
+
+    #[Test]
+    public function find_or_create_separates_vocabularies(): void
+    {
+        $cat = $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'News', 'en', 'org-test');
+        $tag = $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_TAG, 'News', 'en', 'org-test');
+        $this->assertNotSame($cat, $tag, 'the same name in two vocabularies is two terms');
+    }
+
+    // ----- listVocabulary ------------------------------------------------------------------------
+
+    #[Test]
+    public function list_vocabulary_returns_only_the_matching_vocab_ordered(): void
+    {
+        $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'Zeta', 'en', 'org-test');
+        $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'Alpha', 'en', 'org-test');
+        $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_TAG, 'ignored-tag', 'en', 'org-test');
+
+        $names = [];
+        foreach ($this->tax->listVocabulary(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'en', 'org-test') as $t) { $names[] = $t->name; }
+
+        $this->assertContains('Alpha', $names);
+        $this->assertContains('Zeta', $names);
+        $this->assertNotContains('ignored-tag', $names, 'tags excluded from the category list');
+        // equal sort_order → name ASC
+        $this->assertLessThan(array_search('Zeta', $names, true), array_search('Alpha', $names, true), 'name-ASC tiebreak');
+    }
+
+    // ----- resolveTermBySlug ---------------------------------------------------------------------
+
+    #[Test]
+    public function resolve_term_by_slug_finds_the_term(): void
+    {
+        $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_TAG, 'PHP', 'en', 'org-test');
+        $row = $this->tax->resolveTermBySlug(Blog_Model_Taxonomy::VOCAB_TAG, 'php', 'en', 'org-test');
+        $this->assertNotNull($row);
+        $this->assertSame('PHP', $row->name);
+
+        $this->assertNull($this->tax->resolveTermBySlug(Blog_Model_Taxonomy::VOCAB_TAG, 'nope', 'en', 'org-test'));
+    }
+
+    #[Test]
+    public function resolve_term_by_slug_prefers_a_tenant_term_over_global(): void
+    {
+        // Global term (org '') and a tenant term share the slug; tenant should win (org_id DESC).
+        $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'Shared', 'en', '');
+        $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'Shared', 'en', 'org-test');
+
+        $row = $this->tax->resolveTermBySlug(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'shared', 'en', 'org-test');
+        $this->assertSame('org-test', $row->org_id, 'the tenant row shadows the global one');
+    }
+
+    // ----- syncPage / forPage / pageIdsForTerm ---------------------------------------------------
+
+    #[Test]
+    public function sync_page_rewrites_links_preserving_order_and_ignoring_blanks(): void
+    {
+        $a = $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'First', 'en', 'org-test');
+        $b = $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'Second', 'en', 'org-test');
+        $c = $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_TAG, 'Third', 'en', 'org-test');
+        $pageId = 'page-xyz';
+
+        // include a blank id — it must be skipped, not linked.
+        $this->tax->syncPage($pageId, [$a, '', $b]);
+
+        $ids = $this->tax->pageIdsForTerm($a);
+        $this->assertSame([$pageId], $ids, 'the page is linked to term A');
+
+        $names = array_map(fn($r) => $r['name'], $this->tax->forPage($pageId));
+        $this->assertSame(['First', 'Second'], $names, 'links returned in author (sort) order, blank skipped');
+
+        // Re-sync replaces the whole set (full rewrite): now only C.
+        $this->tax->syncPage($pageId, [$c]);
+        $after = array_map(fn($r) => $r['name'], $this->tax->forPage($pageId));
+        $this->assertSame(['Third'], $after, 'a re-sync replaces the previous link set');
+        $this->assertSame([], $this->tax->pageIdsForTerm($a), 'the old link is gone');
+    }
+
+    #[Test]
+    public function for_page_can_filter_to_one_vocabulary(): void
+    {
+        $cat = $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'CatOnly', 'en', 'org-test');
+        $tag = $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_TAG, 'TagOnly', 'en', 'org-test');
+        $pageId = 'page-filter';
+        $this->tax->syncPage($pageId, [$cat, $tag]);
+
+        $cats = array_map(fn($r) => $r['name'], $this->tax->forPage($pageId, Blog_Model_Taxonomy::VOCAB_CATEGORY));
+        $this->assertSame(['CatOnly'], $cats, 'vocabulary filter narrows to categories');
+    }
+
+    // ----- counts --------------------------------------------------------------------------------
+
+    #[Test]
+    public function counts_returns_terms_with_a_link_count(): void
+    {
+        // NOTE: characterizes CURRENT behavior. The docblock says "published only", but the query
+        // sums COUNT(pt.page_id) (the LINK), so a draft-linked page still counts — see the LEFT-join
+        // finding in WAVE4-FINDINGS-blog.md. A term with two links (one published, one draft) counts 2.
+        $tid   = $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'Counted', 'en', 'org-test');
+        $empty = $this->tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'Empty', 'en', 'org-test');
+
+        $pub   = (new \Tiger_Model_Page())->insert(['type' => 'article', 'org_id' => 'org-test', 'locale' => 'en', 'title' => 'P', 'body' => '', 'format' => 'html', 'status' => 'published', 'page_key' => 'p', 'slug' => 'p']);
+        $draft = (new \Tiger_Model_Page())->insert(['type' => 'article', 'org_id' => 'org-test', 'locale' => 'en', 'title' => 'D', 'body' => '', 'format' => 'html', 'status' => 'draft', 'page_key' => 'd', 'slug' => 'd']);
+        $this->tax->syncPage($pub, [$tid]);
+        $this->tax->syncPage($draft, [$tid]);
+
+        $counts = [];
+        foreach ($this->tax->counts(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'en', 'org-test') as $r) { $counts[$r['name']] = (int) $r['n']; }
+
+        $this->assertSame(2, $counts['Counted'], 'CURRENT behavior: counts links, not just published posts (bug)');
+        $this->assertSame(0, $counts['Empty'], 'a term with no links counts zero');
+        // Ordering: the busier term sorts ahead of the empty one (n DESC).
+        $this->assertSame('Counted', array_key_first($counts), 'ordered by count DESC');
+    }
+
+    // ----- slugify -------------------------------------------------------------------------------
+
+    #[Test]
+    public function slugify_lowercases_and_hyphenates(): void
+    {
+        $this->assertSame('hello-world', $this->tax->slugify('  Hello, World!  '));
+        $this->assertSame('a-b-c', $this->tax->slugify('a__b--c'));
+        $this->assertSame('', $this->tax->slugify('!!!'));
+    }
+}
diff --git a/tests/Integration/Blog/TaxonomyServiceTest.php b/tests/Integration/Blog/TaxonomyServiceTest.php
new file mode 100644
index 0000000..fa906ef
--- /dev/null
+++ b/tests/Integration/Blog/TaxonomyServiceTest.php
@@ -0,0 +1,67 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Blog;
+
+use Blog_Model_Taxonomy;
+use Blog_Service_Taxonomy;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+
+/**
+ * Blog_Service_Taxonomy — the read-only /api the article editor calls to populate its category/tag
+ * pickers. Coverage: the ACL gate (admin+), the vocabulary resolution (defaults to tag when the
+ * requested vocab isn't 'category'), and the {id,name,slug} projection.
+ */
+#[CoversClass(Blog_Service_Taxonomy::class)]
+final class TaxonomyServiceTest extends IntegrationTestCase
+{
+    /** Dispatch the service and return the response object. */
+    private function call(string $action, array $params = []): object
+    {
+        return (new Blog_Service_Taxonomy(['action' => $action] + $params))->getResponse();
+    }
+
+    #[Test]
+    public function guest_and_plain_user_are_denied_admin_clears(): void
+    {
+        $this->login('anon', 'org-test', 'guest');
+        $this->assertStringContainsString('not_allowed', json_encode($this->call('listTerms')->messages), 'guest denied');
+
+        $this->loginAs('user');
+        $this->assertSame(0, (int) $this->call('listTerms')->result, 'plain user denied');
+
+        $this->loginAs('admin');
+        $this->assertSame(1, (int) $this->call('listTerms', ['vocabulary' => 'tag'])->result, 'admin allowed');
+    }
+
+    #[Test]
+    public function list_terms_projects_id_name_slug_for_the_requested_vocabulary(): void
+    {
+        $this->login('editor', 'org-test', 'admin');
+        $tax = new Blog_Model_Taxonomy();
+        $tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'Tutorials', 'en', 'org-test');
+        $tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_TAG, 'beginner', 'en', 'org-test');
+
+        $cats = $this->call('listTerms', ['vocabulary' => 'category', 'locale' => 'en'])->data['terms'];
+        $this->assertCount(1, $cats);
+        $this->assertSame('Tutorials', $cats[0]['name']);
+        $this->assertSame('tutorials', $cats[0]['slug']);
+        $this->assertArrayHasKey('id', $cats[0]);
+    }
+
+    #[Test]
+    public function list_terms_defaults_to_the_tag_vocabulary_when_unrecognized(): void
+    {
+        $this->login('editor', 'org-test', 'admin');
+        $tax = new Blog_Model_Taxonomy();
+        $tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_CATEGORY, 'ACategory', 'en', 'org-test');
+        $tax->findOrCreate(Blog_Model_Taxonomy::VOCAB_TAG, 'ATag', 'en', 'org-test');
+
+        // An unrecognized vocabulary collapses to 'tag' (the else branch).
+        $names = array_column($this->call('listTerms', ['vocabulary' => 'nonsense'])->data['terms'], 'name');
+        $this->assertSame(['ATag'], $names, 'unknown vocabulary → tags');
+    }
+}
diff --git a/tests/Integration/Identity/FaviconPluginTest.php b/tests/Integration/Identity/FaviconPluginTest.php
new file mode 100644
index 0000000..782b6f0
--- /dev/null
+++ b/tests/Integration/Identity/FaviconPluginTest.php
@@ -0,0 +1,128 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Identity;
+
+use Identity_Plugin_Favicon;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use ReflectionProperty;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Media;
+use Zend_Config;
+use Zend_Controller_Request_Simple;
+use Zend_Registry;
+use Zend_View;
+
+/**
+ * Identity_Plugin_Favicon — contributes the site favicon (config `tiger.site.favicon`, a media id) to
+ * the head via TigerZF's `headLink` registry, as both `rel=icon` and `rel=apple-touch-icon`. Fail-open:
+ * an unset or unresolvable favicon emits nothing. Wave-4 coverage: no config → silent, an unresolvable
+ * id → silent, and a real media id → two head links pointing at the resolved media URL.
+ *
+ * The plugin has a process-wide emit-once latch (`$_done`); each test resets it via reflection.
+ */
+#[CoversClass(Identity_Plugin_Favicon::class)]
+final class FaviconPluginTest extends IntegrationTestCase
+{
+    private Zend_View $view;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->view = new Zend_View();
+        Zend_Registry::set('Zend_View', $this->view);
+        // headLink is a process-wide singleton container — clear it so links from a prior test don't leak.
+        $this->view->headLink()->exchangeArray([]);
+        $this->resetLatch();
+    }
+
+    protected function tearDown(): void
+    {
+        $this->resetLatch();
+        parent::tearDown();
+    }
+
+    private function resetLatch(): void
+    {
+        $p = new ReflectionProperty(Identity_Plugin_Favicon::class, '_done');
+        $p->setValue(null, false);
+    }
+
+    private function faviconConfig(string $id): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => ['site' => ['favicon' => $id]]], true));
+    }
+
+    private function headLinks(): string
+    {
+        return (string) $this->view->headLink();
+    }
+
+    private function dispatch(): void
+    {
+        (new Identity_Plugin_Favicon())->preDispatch(new Zend_Controller_Request_Simple());
+    }
+
+    #[Test]
+    public function emits_nothing_when_no_favicon_is_configured(): void
+    {
+        $this->faviconConfig('');
+        $this->dispatch();
+        $this->assertSame('', trim($this->headLinks()), 'no config → no head links');
+    }
+
+    #[Test]
+    public function emits_nothing_for_an_unresolvable_media_id(): void
+    {
+        $this->faviconConfig('deadbeef-0000-7000-8000-000000000000');   // no such media row
+        $this->dispatch();
+        $this->assertSame('', trim($this->headLinks()), 'unresolvable id → fail-open, nothing emitted');
+    }
+
+    #[Test]
+    public function emits_icon_and_apple_touch_icon_for_a_real_media_id(): void
+    {
+        $id = (new Tiger_Model_Media())->insert([
+            'org_id'      => '',
+            'disk'        => 'local',
+            'storage_key' => 'favicon/site-icon.png',
+            'visibility'  => Tiger_Model_Media::VISIBILITY_PUBLIC,
+            'kind'        => Tiger_Model_Media::KIND_IMAGE,
+            'mime_type'   => 'image/png',
+            'extension'   => 'png',
+            'filename'    => 'icon.png',
+        ]);
+        $this->faviconConfig($id);
+
+        $this->dispatch();
+        $out = $this->headLinks();
+
+        $this->assertStringContainsString('rel="icon"', $out, 'browser icon link emitted');
+        $this->assertStringContainsString('rel="apple-touch-icon"', $out, 'iOS touch icon emitted');
+        // With no storage disk configured, url() falls back to the ACL-checked stream route for the id.
+        $this->assertStringContainsString($id, $out, 'the link points at the resolved media URL');
+    }
+
+    #[Test]
+    public function the_emit_once_latch_prevents_duplicate_links(): void
+    {
+        $id = (new Tiger_Model_Media())->insert([
+            'org_id'      => '',
+            'disk'        => 'local',
+            'storage_key' => 'favicon/icon2.png',
+            'visibility'  => Tiger_Model_Media::VISIBILITY_PUBLIC,
+            'kind'        => Tiger_Model_Media::KIND_IMAGE,
+            'mime_type'   => 'image/png',
+            'extension'   => 'png',
+            'filename'    => 'icon2.png',
+        ]);
+        $this->faviconConfig($id);
+
+        $plugin = new Identity_Plugin_Favicon();
+        $plugin->preDispatch(new Zend_Controller_Request_Simple());
+        $plugin->preDispatch(new Zend_Controller_Request_Simple());   // second dispatch/forward
+        $this->assertSame(1, substr_count($this->headLinks(), 'rel="icon"'), 'the icon link is added exactly once');
+    }
+}
diff --git a/tests/Integration/Identity/IdentityServiceTest.php b/tests/Integration/Identity/IdentityServiceTest.php
new file mode 100644
index 0000000..f871cb5
--- /dev/null
+++ b/tests/Integration/Identity/IdentityServiceTest.php
@@ -0,0 +1,142 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Identity;
+
+use Identity_Service_Identity;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Config;
+use Zend_Registry;
+
+/**
+ * Identity_Service_Identity — the /api service behind the Site Identity screen. It validates the form,
+ * then writes the site name/tagline, the logo + favicon media references, and the social URLs to the
+ * GLOBAL config tier inside a transaction. Wave-4 coverage: the ACL gate, the validate-and-persist happy
+ * path (every KEYS entry + logo/favicon land in `config`), the media-id sanitizer (a UUID is kept, junk
+ * clears to ''), and the reject paths (missing required name, malformed social URL) that write nothing.
+ */
+#[CoversClass(Identity_Service_Identity::class)]
+final class IdentityServiceTest extends IntegrationTestCase
+{
+    private const UUID = '0191aabb-ccdd-7eff-8899-aabbccddeeff';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function call(array $params = []): object
+    {
+        return (new Identity_Service_Identity(['action' => 'save'] + $params))->getResponse();
+    }
+
+    private function cfg(string $key): ?string
+    {
+        return (new Tiger_Model_Config())->get(Tiger_Model_Config::SCOPE_GLOBAL, '', $key);
+    }
+
+    // ----- ACL ----------------------------------------------------------------------------------
+
+    #[Test]
+    public function guest_is_denied(): void
+    {
+        $this->login('anon', 'org-test', 'guest');
+        $res = $this->call(['site_name' => 'Acme']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function a_plain_user_is_denied(): void
+    {
+        $this->loginAs('user');
+        $res = $this->call(['site_name' => 'Acme']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    // ----- save ---------------------------------------------------------------------------------
+
+    #[Test]
+    public function save_persists_name_tagline_and_social_urls(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call([
+            'site_name'       => '  Acme Books  ',
+            'tagline'         => 'We publish',
+            'social_twitter'  => 'https://twitter.com/acme',
+            'social_github'   => 'https://github.com/acme',
+        ]);
+
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('Acme Books', $this->cfg('tiger.site.name'), 'trimmed on save');
+        $this->assertSame('We publish', $this->cfg('tiger.site.tagline'));
+        $this->assertSame('https://twitter.com/acme', $this->cfg('tiger.seo.social.twitter'));
+        $this->assertSame('https://github.com/acme', $this->cfg('tiger.seo.social.github'));
+        // Unset social keys still get written (as '') — every KEYS entry is persisted.
+        $this->assertSame('', $this->cfg('tiger.seo.social.facebook'));
+    }
+
+    #[Test]
+    public function save_keeps_a_valid_media_uuid_and_clears_junk(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call([
+            'site_name'        => 'Acme',
+            'logo_media_id'    => self::UUID,
+            'favicon_media_id' => 'not-a-uuid',
+        ]);
+
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame(self::UUID, $this->cfg('tiger.site.logo'), 'a valid UUID is kept');
+        $this->assertSame('', $this->cfg('tiger.site.favicon'), 'a non-UUID clears the reference');
+    }
+
+    #[Test]
+    public function save_defaults_media_references_to_empty(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call(['site_name' => 'Acme']);   // no media ids posted
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('', $this->cfg('tiger.site.logo'));
+        $this->assertSame('', $this->cfg('tiger.site.favicon'));
+    }
+
+    // ----- rejects ------------------------------------------------------------------------------
+
+    #[Test]
+    public function a_missing_site_name_returns_form_errors_and_writes_nothing(): void
+    {
+        $this->loginAs('admin');
+        $before = (int) $this->db->fetchOne('SELECT COUNT(*) FROM config');
+
+        $res = $this->call(['site_name' => '', 'tagline' => 'x']);   // name is required
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertNotNull($res->form);
+        $this->assertArrayHasKey('site_name', $res->form);
+        $this->assertSame($before, (int) $this->db->fetchOne('SELECT COUNT(*) FROM config'), 'nothing written');
+    }
+
+    #[Test]
+    public function a_malformed_social_url_is_rejected(): void
+    {
+        $this->loginAs('admin');
+        // Present but not http(s):// → the lenient URL regex rejects it.
+        $res = $this->call(['site_name' => 'Acme', 'social_twitter' => 'ftp://nope']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertNotNull($res->form);
+        $this->assertArrayHasKey('social_twitter', $res->form);
+    }
+}
diff --git a/tests/Integration/Media/MediaHelpersTest.php b/tests/Integration/Media/MediaHelpersTest.php
new file mode 100644
index 0000000..6c0dff8
--- /dev/null
+++ b/tests/Integration/Media/MediaHelpersTest.php
@@ -0,0 +1,145 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Media;
+
+use Media_Service_Media;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Zend_Config;
+use Zend_Registry;
+
+/**
+ * A subclass exposing Media_Service_Media's protected helpers for direct testing. Constructing with no
+ * `action` dispatches nothing (the base returns early on an empty action), so this is a clean seam onto
+ * the pure config/derivation helpers that otherwise only run inside the `upload()` pipeline — which is
+ * unreachable from CLI because PHP's `is_uploaded_file()` refuses a synthesized upload (see below).
+ */
+final class ExposedMediaService extends Media_Service_Media
+{
+    public function callVariantKey($key, $preset, $ext) { return $this->_variantKey($key, $preset, $ext); }
+    public function callPresets() { return $this->_presets(); }
+    public function callQuality() { return $this->_quality(); }
+    public function callServerEnabled() { return $this->_serverEnabled(); }
+    public function callMime($tmp, $ext) { return $this->_mime($tmp, $ext); }
+    public function callCfgInt($key, $default) { return $this->_cfgInt($key, $default); }
+    public function callPresent($row) { return $this->_present($row); }
+}
+
+/**
+ * Media_Service_Media — the pure helper seam (variant key derivation, config-backed variant presets /
+ * quality / server-GD toggle, MIME sniffing, and the config-int reader). These run only inside the
+ * `upload()` byte pipeline in production, so a subclass exposes them for direct coverage without a real
+ * multipart upload. The upload pipeline itself is covered (ACL + no-file) in MediaServiceTest.
+ */
+#[CoversClass(Media_Service_Media::class)]
+final class MediaHelpersTest extends IntegrationTestCase
+{
+    private function service(array $variants = []): ExposedMediaService
+    {
+        $media = ['default_disk' => 'local'];
+        if ($variants) { $media['variants'] = $variants; }
+        Zend_Registry::set('Zend_Config', new Zend_Config(['media' => $media], true));
+        return new ExposedMediaService([]);   // no action → constructs without dispatching
+    }
+
+    #[Test]
+    public function variant_key_inserts_the_preset_alongside_the_original(): void
+    {
+        $svc = $this->service();
+        $this->assertSame('org/image/base.thumbnail.png', $svc->callVariantKey('org/image/base.png', 'thumbnail', 'png'));
+        $this->assertSame('org/image/base.small.jpg', $svc->callVariantKey('org/image/base.webp', 'small', 'JPG'));
+        // No extension on the key → the preset is appended and a default ext used.
+        $this->assertSame('org/image/base.large.img', $svc->callVariantKey('org/image/base', 'large', ''));
+    }
+
+    #[Test]
+    public function presets_returns_only_the_positive_configured_sizes(): void
+    {
+        $svc = $this->service(['thumbnail' => 200, 'small' => 480, 'medium' => 0, 'large' => -5]);
+        $this->assertSame(['thumbnail' => 200, 'small' => 480], $svc->callPresets(), 'zero/negative sizes are dropped');
+    }
+
+    #[Test]
+    public function presets_is_empty_without_a_variants_config(): void
+    {
+        $this->assertSame([], $this->service()->callPresets());
+    }
+
+    #[Test]
+    public function quality_defaults_to_ninety_and_honors_a_positive_override(): void
+    {
+        $this->assertSame(90, $this->service()->callQuality(), 'default JPEG/WebP quality');
+        $this->assertSame(70, $this->service(['quality' => 70])->callQuality());
+        $this->assertSame(90, $this->service(['quality' => 0])->callQuality(), 'a non-positive override falls back');
+    }
+
+    #[Test]
+    public function server_enabled_defaults_on_and_is_disabled_by_zero(): void
+    {
+        $this->assertTrue($this->service()->callServerEnabled(), 'GD server variants default on');
+        $this->assertTrue($this->service(['server' => 1])->callServerEnabled());
+        $this->assertFalse($this->service(['server' => 0])->callServerEnabled(), 'server=0 disables GD variants');
+    }
+
+    #[Test]
+    public function cfg_int_reads_media_config_with_a_default(): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config(['media' => ['max_upload' => 1048576]], true));
+        $svc = new ExposedMediaService([]);
+        $this->assertSame(1048576, $svc->callCfgInt('max_upload', 52428800), 'configured value wins');
+        $this->assertSame(999, $svc->callCfgInt('not_set', 999), 'default when unset');
+    }
+
+    #[Test]
+    public function mime_sniffs_a_real_file(): void
+    {
+        $svc = $this->service();
+
+        $png = tempnam(sys_get_temp_dir(), 'w4mime');
+        // A real 1x1 PNG (header + IHDR + IDAT + IEND) so finfo reports image/png.
+        file_put_contents($png, base64_decode(
+            'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=='
+        ));
+        try {
+            $this->assertSame('image/png', $svc->callMime($png, 'png'), 'finfo sniffs the real bytes');
+        } finally {
+            @unlink($png);
+        }
+        // (The octet-stream fallback fires only when finfo can't read the file — a filesystem edge
+        // noted in WAVE4-FINDINGS-mediaan.md; exercising it emits a PHP warning, so it's left uncovered.)
+    }
+
+    #[Test]
+    public function present_shapes_a_row_with_urls_and_hides_storage_internals(): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config(['media' => ['default_disk' => 'local']], true));
+        $svc = new ExposedMediaService([]);
+
+        $shaped = $svc->callPresent([
+            'media_id'    => 'abc-123',
+            'kind'        => 'image',
+            'mime_type'   => 'image/png',
+            'extension'   => 'png',
+            'file_size'   => 2048,
+            'filename'    => 'pic.png',
+            'title'       => 'Pic',
+            'visibility'  => 'public',
+            'width'       => 800,
+            'height'      => 600,
+            'storage_key' => 'org/image/pic.png',
+            'disk'        => 'local',
+        ]);
+
+        $this->assertSame('abc-123', $shaped['media_id']);
+        $this->assertSame(2048, $shaped['file_size'], 'cast to int');
+        $this->assertSame(800, $shaped['width']);
+        $this->assertArrayHasKey('url', $shaped);
+        $this->assertArrayHasKey('thumb', $shaped);
+        $this->assertArrayHasKey('large', $shaped, 'per-size sources present');
+        $this->assertArrayNotHasKey('storage_key', $shaped, 'storage internals are not exposed');
+        $this->assertArrayNotHasKey('disk', $shaped);
+    }
+}
diff --git a/tests/Integration/Media/MediaServiceTest.php b/tests/Integration/Media/MediaServiceTest.php
new file mode 100644
index 0000000..0174db7
--- /dev/null
+++ b/tests/Integration/Media/MediaServiceTest.php
@@ -0,0 +1,349 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Media;
+
+use Media_Service_Media;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Media_Storage;
+use Tiger_Model_Media;
+use Zend_Config;
+use Zend_Registry;
+
+/**
+ * Media_Service_Media — the /api service behind the admin Media Library (upload / datatable / update /
+ * delete). Wave-4 coverage of the reachable surface: the deny-by-default ACL gate, the DataTables
+ * envelope (search / kind filter / paging + the server-computed `can_delete` flag), the editorial
+ * `update` (fields + visibility normalization, invalid-id + empty-payload rejects), and the soft-delete
+ * (row flagged + stored bytes AND variant bytes removed from the disk).
+ *
+ * The `upload()` HAPPY path is NOT reachable from CLI: PHP's `is_uploaded_file()` only trusts a file
+ * that arrived over a real multipart POST, so a synthesized `$_FILES` entry is always refused. We cover
+ * its two reachable branches (ACL deny + the no-file error) and note the rest in WAVE4-FINDINGS-mediaan.md.
+ */
+#[CoversClass(Media_Service_Media::class)]
+final class MediaServiceTest extends IntegrationTestCase
+{
+    private string $publicRoot;
+    private string $privateRoot;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+
+        $this->publicRoot  = sys_get_temp_dir() . '/tiger-w4-media/pub-' . uniqid();
+        $this->privateRoot = sys_get_temp_dir() . '/tiger-w4-media/priv-' . uniqid();
+        @mkdir($this->publicRoot, 0777, true);
+        @mkdir($this->privateRoot, 0777, true);
+
+        Zend_Registry::set('Zend_Config', new Zend_Config([
+            'media' => [
+                'default_disk' => 'local',
+                'max_upload'   => 52428800,
+                'disks'        => [
+                    'local' => [
+                        'adapter'      => 'filesystem',
+                        'public_root'  => $this->publicRoot,
+                        'private_root' => $this->privateRoot,
+                        'public_url'   => '/_media',
+                    ],
+                ],
+            ],
+        ], true));
+        Tiger_Media_Storage::reset();
+    }
+
+    protected function tearDown(): void
+    {
+        Tiger_Media_Storage::reset();
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    /** Dispatch the service with an action + payload and hand back the response. */
+    private function call(string $action, array $params = []): object
+    {
+        return (new Media_Service_Media(['action' => $action] + $params))->getResponse();
+    }
+
+    /** Insert a media row directly (the storage/upload seam is exercised via the disk adapter). */
+    private function seed(array $overrides = []): string
+    {
+        return (new Tiger_Model_Media())->insert($overrides + [
+            'org_id'      => 'org-test',
+            'disk'        => 'local',
+            'storage_key' => 'org-test/documents/' . uniqid() . '.txt',
+            'visibility'  => Tiger_Model_Media::VISIBILITY_PUBLIC,
+            'kind'        => Tiger_Model_Media::KIND_DOCUMENT,
+            'mime_type'   => 'text/plain',
+            'extension'   => 'txt',
+            'file_size'   => 12,
+            'filename'    => 'seed.txt',
+            'title'       => 'Seed',
+        ]);
+    }
+
+    // ----- ACL gate -----------------------------------------------------------------------------
+
+    #[Test]
+    public function guest_is_denied_every_action(): void
+    {
+        $this->login('anon', 'org-test', 'guest');
+        foreach (['upload', 'datatable', 'update', 'delete'] as $action) {
+            $res = $this->call($action);
+            $this->assertSame(0, (int) $res->result, "guest denied on {$action}");
+            $this->assertStringContainsString('not_allowed', json_encode($res->messages), "ACL denial on {$action}");
+        }
+    }
+
+    #[Test]
+    public function a_plain_user_is_denied(): void
+    {
+        $this->loginAs('user');
+        $res = $this->call('datatable', ['draw' => 1]);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    // ----- datatable ----------------------------------------------------------------------------
+
+    #[Test]
+    public function datatable_returns_the_envelope_with_a_delete_flag(): void
+    {
+        $this->loginAs('admin');
+        $this->seed(['filename' => 'grid-one.txt', 'title' => 'Grid One']);
+
+        $res  = $this->call('datatable', ['draw' => 5, 'start' => 0, 'length' => 25]);
+        $this->assertSame(1, (int) $res->result);
+        $data = $res->data;
+
+        $this->assertSame(5, $data['draw']);
+        $this->assertArrayHasKey('recordsTotal', $data);
+        $this->assertArrayHasKey('recordsFiltered', $data);
+        $this->assertGreaterThanOrEqual(1, $data['recordsTotal']);
+        $this->assertNotEmpty($data['data']);
+
+        $row = $data['data'][0];
+        $this->assertArrayHasKey('media_id', $row);
+        $this->assertArrayHasKey('can_delete', $row);
+        $this->assertArrayHasKey('url', $row, 'the presenter adds a URL');
+        $this->assertArrayHasKey('thumb', $row);
+        $this->assertTrue($row['can_delete'], 'admin has the delete privilege on the resource');
+    }
+
+    #[Test]
+    public function datatable_search_narrows_the_filtered_count(): void
+    {
+        $this->loginAs('admin');
+        $this->seed(['filename' => 'needle-unique-doc.txt', 'title' => 'Needle']);
+        $this->seed(['filename' => 'haystack-a.txt']);
+        $this->seed(['filename' => 'haystack-b.txt']);
+
+        $res  = $this->call('datatable', ['draw' => 1, 'start' => 0, 'length' => 25, 'search' => 'needle-unique-doc']);
+        $data = $res->data;
+
+        $this->assertSame(1, $data['recordsFiltered'], 'search narrows to the one match');
+        $this->assertGreaterThanOrEqual(3, $data['recordsTotal'], 'total is the unfiltered set');
+        $this->assertSame('needle-unique-doc.txt', $data['data'][0]['filename']);
+    }
+
+    #[Test]
+    public function datatable_kind_filter_limits_to_the_requested_kind(): void
+    {
+        $this->loginAs('admin');
+        $this->seed(['kind' => Tiger_Model_Media::KIND_IMAGE, 'filename' => 'pic.png', 'extension' => 'png', 'mime_type' => 'image/png']);
+        $this->seed(['kind' => Tiger_Model_Media::KIND_DOCUMENT, 'filename' => 'doc.txt']);
+
+        $res  = $this->call('datatable', ['draw' => 1, 'start' => 0, 'length' => 100, 'kind' => Tiger_Model_Media::KIND_IMAGE]);
+        foreach ($res->data['data'] as $row) {
+            $this->assertSame(Tiger_Model_Media::KIND_IMAGE, $row['kind'], 'only images pass the kind filter');
+        }
+        $this->assertGreaterThanOrEqual(1, count($res->data['data']));
+    }
+
+    #[Test]
+    public function datatable_paging_limits_rows_without_shrinking_total(): void
+    {
+        $this->loginAs('admin');
+        for ($i = 0; $i < 3; $i++) { $this->seed(['filename' => "page{$i}.txt"]); }
+
+        $res  = $this->call('datatable', ['draw' => 1, 'start' => 0, 'length' => 1]);
+        $this->assertCount(1, $res->data['data'], 'length=1 returns a single row');
+        $this->assertGreaterThanOrEqual(3, $res->data['recordsTotal']);
+    }
+
+    #[Test]
+    public function datatable_ignores_an_unknown_kind_filter(): void
+    {
+        $this->loginAs('admin');
+        $this->seed(['filename' => 'anything.txt']);
+        // 'bogus' isn't a real kind, so the service drops the filter and returns the unfiltered set.
+        $res = $this->call('datatable', ['draw' => 1, 'start' => 0, 'length' => 100, 'kind' => 'bogus']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertGreaterThanOrEqual(1, $res->data['recordsTotal']);
+    }
+
+    // ----- update -------------------------------------------------------------------------------
+
+    #[Test]
+    public function update_edits_editorial_fields(): void
+    {
+        $this->loginAs('admin');
+        $id = $this->seed();
+
+        $res = $this->call('update', [
+            'media_id' => $id,
+            'title'    => '  New Title  ',
+            'caption'  => 'A caption',
+            'alt_text' => 'alt words',
+        ]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('New Title', $res->data['media']['title'], 'trimmed on save');
+
+        $row = (new Tiger_Model_Media())->findById($id);
+        $this->assertSame('New Title', $row->title);
+        $this->assertSame('A caption', $row->caption);
+        $this->assertSame('alt words', $row->alt_text);
+    }
+
+    #[Test]
+    public function update_normalizes_visibility_to_the_allowed_pair(): void
+    {
+        $this->loginAs('admin');
+        $id = $this->seed(['visibility' => Tiger_Model_Media::VISIBILITY_PUBLIC]);
+
+        $res = $this->call('update', ['media_id' => $id, 'visibility' => 'nonsense']);
+        $this->assertSame(1, (int) $res->result);
+        // Anything that isn't the private sentinel collapses to public.
+        $this->assertSame(Tiger_Model_Media::VISIBILITY_PUBLIC, (new Tiger_Model_Media())->findById($id)->visibility);
+
+        $res2 = $this->call('update', ['media_id' => $id, 'visibility' => Tiger_Model_Media::VISIBILITY_PRIVATE]);
+        $this->assertSame(1, (int) $res2->result);
+        $this->assertSame(Tiger_Model_Media::VISIBILITY_PRIVATE, (new Tiger_Model_Media())->findById($id)->visibility);
+    }
+
+    #[Test]
+    public function update_with_no_editable_fields_is_an_error(): void
+    {
+        $this->loginAs('admin');
+        $id = $this->seed();
+        $res = $this->call('update', ['media_id' => $id]);   // nothing to change
+        $this->assertSame(0, (int) $res->result, 'an empty edit payload is rejected');
+    }
+
+    #[Test]
+    public function update_rejects_a_missing_or_unknown_id(): void
+    {
+        $this->loginAs('admin');
+        $this->assertSame(0, (int) $this->call('update', ['title' => 'x'])->result, 'no media_id');
+        $this->assertSame(0, (int) $this->call('update', ['media_id' => 'does-not-exist', 'title' => 'x'])->result);
+    }
+
+    // ----- delete (soft-delete + byte removal) --------------------------------------------------
+
+    #[Test]
+    public function delete_soft_deletes_the_row_and_removes_the_bytes(): void
+    {
+        $this->loginAs('admin');
+        $key = 'org-test/documents/del-' . uniqid() . '.txt';
+        $id  = $this->seed(['storage_key' => $key]);
+
+        // Lay down real bytes on the disk so the delete has something to remove.
+        $disk = Tiger_Media_Storage::disk('local');
+        $disk->write($key, 'the bytes', Tiger_Model_Media::VISIBILITY_PUBLIC);
+        $this->assertTrue($disk->exists($key, Tiger_Model_Media::VISIBILITY_PUBLIC), 'file present before delete');
+
+        $res = $this->call('delete', ['media_id' => $id]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame($id, $res->data['media_id']);
+
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT deleted FROM media WHERE media_id = ?', [$id]), 'row soft-deleted');
+        $this->assertNull((new Tiger_Model_Media())->findById($id), 'findById excludes the soft-deleted row');
+        $this->assertFalse($disk->exists($key, Tiger_Model_Media::VISIBILITY_PUBLIC), 'stored bytes removed');
+    }
+
+    #[Test]
+    public function delete_also_removes_variant_bytes(): void
+    {
+        $this->loginAs('admin');
+        $key   = 'org-test/image/orig-' . uniqid() . '.png';
+        $vKey  = 'org-test/image/orig.thumbnail.png';
+        $id = $this->seed([
+            'storage_key' => $key,
+            'kind'        => Tiger_Model_Media::KIND_IMAGE,
+            'extension'   => 'png',
+            'mime_type'   => 'image/png',
+            'variants'    => json_encode(['thumbnail' => ['key' => $vKey, 'w' => 50, 'h' => 50]]),
+        ]);
+
+        $disk = Tiger_Media_Storage::disk('local');
+        $disk->write($key,  'orig', Tiger_Model_Media::VISIBILITY_PUBLIC);
+        $disk->write($vKey, 'thumb', Tiger_Model_Media::VISIBILITY_PUBLIC);
+
+        $this->assertSame(1, (int) $this->call('delete', ['media_id' => $id])->result);
+        $this->assertFalse($disk->exists($key,  Tiger_Model_Media::VISIBILITY_PUBLIC), 'original removed');
+        $this->assertFalse($disk->exists($vKey, Tiger_Model_Media::VISIBILITY_PUBLIC), 'variant removed');
+    }
+
+    #[Test]
+    public function delete_still_soft_deletes_when_the_bytes_are_already_gone(): void
+    {
+        $this->loginAs('admin');
+        $id = $this->seed();   // no bytes written — the disk delete is a no-op, the row still flips
+        $this->assertSame(1, (int) $this->call('delete', ['media_id' => $id])->result);
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT deleted FROM media WHERE media_id = ?', [$id]));
+    }
+
+    #[Test]
+    public function delete_rejects_a_missing_or_unknown_id(): void
+    {
+        $this->loginAs('admin');
+        $this->assertSame(0, (int) $this->call('delete', [])->result, 'no media_id');
+        $this->assertSame(0, (int) $this->call('delete', ['media_id' => 'nope'])->result);
+    }
+
+    // ----- upload (only the CLI-reachable branches) ---------------------------------------------
+
+    #[Test]
+    public function upload_is_denied_for_a_guest(): void
+    {
+        $this->login('anon', 'org-test', 'guest');
+        $res = $this->call('upload');
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function upload_errors_when_no_file_is_present(): void
+    {
+        $this->loginAs('admin');
+        unset($_FILES['file']);
+        $res = $this->call('upload');
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('media.error.upload', json_encode($res->messages), 'no $_FILES → upload error');
+    }
+
+    #[Test]
+    public function upload_errors_on_a_non_uploaded_tmp_file(): void
+    {
+        $this->loginAs('admin');
+        // A synthesized $_FILES entry: is_uploaded_file() refuses it (not a real POST upload), so the
+        // service returns the same upload error — proving the guard. See the findings note.
+        $tmp = tempnam(sys_get_temp_dir(), 'w4up');
+        file_put_contents($tmp, 'bytes');
+        $_FILES['file'] = ['name' => 'x.txt', 'tmp_name' => $tmp, 'size' => 5, 'error' => UPLOAD_ERR_OK];
+        try {
+            $res = $this->call('upload');
+            $this->assertSame(0, (int) $res->result);
+            $this->assertStringContainsString('media.error.upload', json_encode($res->messages));
+        } finally {
+            unset($_FILES['file']);
+            @unlink($tmp);
+        }
+    }
+}
diff --git a/tests/Integration/Media/SettingsServiceTest.php b/tests/Integration/Media/SettingsServiceTest.php
new file mode 100644
index 0000000..24e8671
--- /dev/null
+++ b/tests/Integration/Media/SettingsServiceTest.php
@@ -0,0 +1,103 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Media;
+
+use Media_Service_Settings;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Config;
+use Tiger_Model_Media;
+use Zend_Registry;
+
+/**
+ * Media_Service_Settings — the /api service behind the Media Library settings screen. It validates the
+ * two obfuscation selects and writes them (per visibility) to the `config` table, org-scoped. Wave-4
+ * coverage: the ACL gate, the validate-and-persist happy path (both flags land in `config` at the
+ * resolved scope), and the invalid-payload reject (a bad select value returns form errors, writes nothing).
+ */
+#[CoversClass(Media_Service_Settings::class)]
+final class SettingsServiceTest extends IntegrationTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function call(array $params = []): object
+    {
+        return (new Media_Service_Settings(['action' => 'save'] + $params))->getResponse();
+    }
+
+    #[Test]
+    public function guest_is_denied(): void
+    {
+        $this->login('anon', 'org-test', 'guest');
+        $res = $this->call(['obfuscate_public' => '1', 'obfuscate_private' => '1']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function a_plain_user_is_denied(): void
+    {
+        $this->loginAs('user');
+        $res = $this->call(['obfuscate_public' => '0', 'obfuscate_private' => '0']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function save_persists_both_flags_to_config(): void
+    {
+        $this->login('u-admin', '', 'admin');   // empty org → GLOBAL scope
+        $res = $this->call(['obfuscate_public' => '1', 'obfuscate_private' => '0']);
+
+        $this->assertSame(1, (int) $res->result, 'valid selects saved');
+        $this->assertSame('/media/admin/settings', $res->redirect, 'redirect echoed');
+
+        [$scope, $sid] = Tiger_Model_Media::settingScope('');
+        $cfg = new Tiger_Model_Config();
+        $this->assertSame('1', $cfg->get($scope, $sid, Tiger_Model_Media::CFG_OBFUSCATE . 'public'));
+        $this->assertSame('0', $cfg->get($scope, $sid, Tiger_Model_Media::CFG_OBFUSCATE . 'private'));
+    }
+
+    #[Test]
+    public function save_coerces_any_truthy_non_one_to_zero(): void
+    {
+        $this->login('u-admin', '', 'admin');
+        // The service stores '1' only for an exact '1'; the select still validates the value, so pass
+        // the allowed pair but flip which is on.
+        $this->call(['obfuscate_public' => '0', 'obfuscate_private' => '1']);
+
+        [$scope, $sid] = Tiger_Model_Media::settingScope('');
+        $cfg = new Tiger_Model_Config();
+        $this->assertSame('0', $cfg->get($scope, $sid, Tiger_Model_Media::CFG_OBFUSCATE . 'public'));
+        $this->assertSame('1', $cfg->get($scope, $sid, Tiger_Model_Media::CFG_OBFUSCATE . 'private'));
+    }
+
+    #[Test]
+    public function an_invalid_select_value_returns_form_errors_and_writes_nothing(): void
+    {
+        $this->loginAs('admin');
+        $before = (int) $this->db->fetchOne('SELECT COUNT(*) FROM config');
+
+        // '7' is not one of the select's multiOptions → Zend_Form's InArray validator rejects it.
+        $res = $this->call(['obfuscate_public' => '7', 'obfuscate_private' => '0']);
+
+        $this->assertSame(0, (int) $res->result, 'invalid select rejected');
+        $this->assertNotNull($res->form, 'field errors returned');
+        $this->assertArrayHasKey('obfuscate_public', $res->form);
+        $this->assertSame($before, (int) $this->db->fetchOne('SELECT COUNT(*) FROM config'), 'nothing written');
+    }
+}
diff --git a/tests/Integration/MigratorTest.php b/tests/Integration/MigratorTest.php
index 1bb5e67..09551c5 100644
--- a/tests/Integration/MigratorTest.php
+++ b/tests/Integration/MigratorTest.php
@@ -30,9 +30,17 @@
 #[CoversClass(Tiger_Db_Migrator::class)]
 final class MigratorTest extends IntegrationTestCase
 {
-    /** Fixture versions this test may create — purged from the shared ledger in tearDown. */
+    /** Fixture versions this test may create — purged from the ISOLATED ledger in tearDown. */
     private const FIXTURE_VERSIONS = ['9001', '9002', '9003', '9101', '9102', '9201'];
 
+    /**
+     * An ISOLATED ledger table so this test's fixtures never share the real `tiger_migration` set.
+     * rollback() reverses the newest applied version GLOBALLY, so if a real (or another test's)
+     * timestamp-versioned migration is committed to the shared ledger it would sort above the 9xxx
+     * fixtures and be picked instead — a cross-test flake. A dedicated ledger makes rollback hermetic.
+     */
+    private const LEDGER = 'tiger_migration_test';
+
     /** Throwaway tables the fixtures may create — dropped in tearDown. */
     private const THROWAWAY_TABLES = [
         'zzz_mig_a', 'zzz_mig_b', 'zzz_mig_c', 'zzz_mig_p1', 'zzz_mig_p2', 'zzz_mig_r',
@@ -48,7 +56,7 @@ protected function tearDown(): void
             try { $this->db->query("DROP TABLE IF EXISTS `$t`"); } catch (\Throwable $e) {}
         }
         foreach (self::FIXTURE_VERSIONS as $v) {
-            try { $this->db->delete('tiger_migration', $this->db->quoteInto('version = ?', $v)); } catch (\Throwable $e) {}
+            try { $this->db->delete(self::LEDGER, $this->db->quoteInto('version = ?', $v)); } catch (\Throwable $e) {}
         }
         foreach ($this->tmpDirs as $dir) {
             foreach (glob($dir . '/*') ?: [] as $f) { @unlink($f); }
@@ -77,7 +85,7 @@ private static function createDropMigration(string $table): string
 
     private function ledgerHas(string $version): bool
     {
-        return (int) $this->db->fetchOne('SELECT COUNT(*) FROM tiger_migration WHERE version = ?', [$version]) > 0;
+        return (int) $this->db->fetchOne('SELECT COUNT(*) FROM ' . self::LEDGER . ' WHERE version = ?', [$version]) > 0;
     }
 
     #[Test]
@@ -88,7 +96,7 @@ public function migrate_applies_pending_versions_in_ascending_order_and_records_
             '9002_create_b.php' => self::createDropMigration('zzz_mig_b'),
             '9001_create_a.php' => self::createDropMigration('zzz_mig_a'),
         ]);
-        $migrator = new Tiger_Db_Migrator($this->db, [$dir]);
+        $migrator = new Tiger_Db_Migrator($this->db, [$dir], self::LEDGER);
 
         $applied = $migrator->migrate();
 
@@ -105,7 +113,7 @@ public function migrate_applies_pending_versions_in_ascending_order_and_records_
     public function migrate_is_idempotent_a_second_run_applies_nothing(): void
     {
         $dir = $this->fixtureDir(['9001_create_a.php' => self::createDropMigration('zzz_mig_a')]);
-        $migrator = new Tiger_Db_Migrator($this->db, [$dir]);
+        $migrator = new Tiger_Db_Migrator($this->db, [$dir], self::LEDGER);
 
         $this->assertSame(['9001' => 'create_a'], $migrator->migrate(), 'first run applies it');
         $this->assertSame([], $migrator->migrate(), 'a second run skips the already-applied version');
@@ -118,11 +126,11 @@ public function status_reports_applied_versus_pending(): void
             '9001_create_a.php' => self::createDropMigration('zzz_mig_a'),
             '9002_create_b.php' => self::createDropMigration('zzz_mig_b'),
         ]);
-        $migrator = new Tiger_Db_Migrator($this->db, [$dir]);
+        $migrator = new Tiger_Db_Migrator($this->db, [$dir], self::LEDGER);
 
         // Apply only 9001 by hand-recording it, then let status() classify both.
         $migrator->migrate();                                  // applies both
-        $this->db->delete('tiger_migration', $this->db->quoteInto('version = ?', '9002')); // pretend 9002 pending
+        $this->db->delete(self::LEDGER, $this->db->quoteInto('version = ?', '9002')); // pretend 9002 pending
 
         $status = $migrator->status();
         $this->assertTrue($status['9001']['applied'], '9001 is applied');
@@ -142,7 +150,7 @@ public function a_migration_that_fails_midway_is_left_unrecorded_and_stays_pendi
                 . "\"THIS IS NOT VALID SQL\""
                 . "], 'down' => [\"DROP TABLE IF EXISTS `zzz_mig_p2`\"]];",
         ]);
-        $migrator = new Tiger_Db_Migrator($this->db, [$dir]);
+        $migrator = new Tiger_Db_Migrator($this->db, [$dir], self::LEDGER);
 
         $threw = false;
         try {
@@ -164,7 +172,7 @@ public function a_migration_that_fails_midway_is_left_unrecorded_and_stays_pendi
     public function rollback_runs_down_statements_and_deletes_the_ledger_row(): void
     {
         $dir = $this->fixtureDir(['9201_create_r.php' => self::createDropMigration('zzz_mig_r')]);
-        $migrator = new Tiger_Db_Migrator($this->db, [$dir]);
+        $migrator = new Tiger_Db_Migrator($this->db, [$dir], self::LEDGER);
 
         $migrator->migrate();
         $this->assertTrue($this->tableExists('zzz_mig_r'), 'precondition: up created the table');
diff --git a/tests/Integration/Module/InstallerLifecycleTest.php b/tests/Integration/Module/InstallerLifecycleTest.php
new file mode 100644
index 0000000..2d4395b
--- /dev/null
+++ b/tests/Integration/Module/InstallerLifecycleTest.php
@@ -0,0 +1,355 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Module;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use RuntimeException;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Crypto_Signature;
+use Tiger_License_Authority;
+use Tiger_Model_Module;
+use Tiger_Module_Installer;
+
+/**
+ * Tiger_Module_Installer — the install/update/remove LIFECYCLE end to end, against a real DB + filesystem.
+ * The extract guard, manifest/slug gatekeepers, and the signature-material verifier are pinned by the unit
+ * suite (InstallerExtractTest / InstallerManifestTest / InstallerSignatureTest); this drives the parts that
+ * need the `module` table and the on-disk placement:
+ *
+ *   - installFromTarball / installFromUpload: extract → place into modules/ → migrate → record; the
+ *     already-installed guard and the force-update path; the licensed-must-be-signed gate (a real Ed25519
+ *     keypair signs a real fixture tarball → the happy path installs; the SAME manifest UNSIGNED is refused);
+ *     the PHP hard-requires gate.
+ *   - remove(): deletes files + the row, and refuses a non-installer-managed slug.
+ *   - migrateModule() / publishAssets() / unpublishAssets(): the activate-time capability hooks.
+ *   - installFromAuthority(): the guard + the two reachable failure branches (authority refuses; the signed
+ *     download URL is unreachable), driven through the injected authority transport with NO real network.
+ *
+ * Everything the DB writes rolls back with the per-test transaction; the physical module dirs + published
+ * symlinks are NOT transactional, so each test cleans up the slugs + links it created.
+ */
+#[CoversClass(Tiger_Module_Installer::class)]
+final class InstallerLifecycleTest extends IntegrationTestCase
+{
+    private string $tmp = '';
+    /** Slugs whose modules/<slug> dir + public/_modules/<slug> link must be removed after the test. */
+    private array $installed = [];
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->tmp = sys_get_temp_dir() . '/tiger_instlife_' . getmypid() . '_' . bin2hex(random_bytes(4));
+        @mkdir($this->tmp, 0775, true);
+    }
+
+    protected function tearDown(): void
+    {
+        foreach ($this->installed as $slug) {
+            $this->rrmdir(APPLICATION_PATH . '/modules/' . $slug);
+            $link = APPLICATION_ROOT . '/public/_modules/' . $slug;
+            if (is_link($link)) { @unlink($link); } elseif (is_dir($link)) { $this->rrmdir($link); }
+        }
+        // Prune fixture scaffolding if now empty.
+        @rmdir(APPLICATION_PATH . '/modules');
+        @rmdir(APPLICATION_ROOT . '/public/_modules');
+        $this->rrmdir($this->tmp);
+        Tiger_License_Authority::_reset();
+        parent::tearDown();
+    }
+
+    // ---- installFromTarball / installFromUpload --------------------------------
+
+    #[Test]
+    public function installsAFreeModuleFromATarballAndRecordsIt(): void
+    {
+        $tar = $this->makeModulePackage('w4free', ['name' => 'W4 Free', 'version' => '1.0.0']);
+
+        $r = Tiger_Module_Installer::installFromUpload($tar);
+        $this->installed[] = 'w4free';
+
+        $this->assertSame('w4free', $r['slug']);
+        $this->assertSame('W4 Free', $r['name']);
+        $this->assertSame('1.0.0', $r['version']);
+        $this->assertDirectoryExists(APPLICATION_PATH . '/modules/w4free');
+        $this->assertFileExists(APPLICATION_PATH . '/modules/w4free/module.json');
+
+        $row = (new Tiger_Model_Module())->bySlug('w4free');
+        $this->assertNotNull($row, 'the install is recorded in the module table');
+        $this->assertSame('1.0.0', (string) $row->version);
+        $this->assertSame(1, (int) $row->active);
+        $this->assertSame(Tiger_Model_Module::SOURCE_UPLOAD, $row->source);
+    }
+
+    #[Test]
+    public function reinstallingWithoutForceIsRefusedButForceUpdatesInPlace(): void
+    {
+        $this->installFixture('w4force', ['version' => '1.0.0']);
+
+        // Same slug again, no force → the already-installed guard fires.
+        $tar = $this->makeModulePackage('w4force', ['version' => '1.1.0']);
+        try {
+            Tiger_Module_Installer::installFromUpload($tar);
+            $this->fail('a second install without force should throw');
+        } catch (RuntimeException $e) {
+            $this->assertStringContainsString('already installed', $e->getMessage());
+        }
+
+        // With force → the update lands and the recorded version moves.
+        $r = Tiger_Module_Installer::installFromUpload($this->makeModulePackage('w4force', ['version' => '1.1.0']), ['force' => true]);
+        $this->assertSame('1.1.0', $r['version']);
+        $this->assertSame('1.1.0', (string) (new Tiger_Model_Module())->bySlug('w4force')->version);
+    }
+
+    #[Test]
+    public function aLicensedModuleInstallsWhenSignedAndIsRefusedWhenUnsigned(): void
+    {
+        $manifest = [
+            'name'    => 'W4 Licensed',
+            'version' => '2.0.0',
+            'pricing' => ['model' => 'licensed', 'authority' => 'https://store.example/authority', 'vendor' => 'acme/TigerVendor'],
+        ];
+
+        // UNSIGNED → refused up front (a licensed artifact MUST arrive signed).
+        $unsignedTar = $this->makeModulePackage('w4lic', $manifest);
+        try {
+            Tiger_Module_Installer::installFromUpload($unsignedTar);
+            $this->fail('an unsigned licensed module must be refused');
+        } catch (RuntimeException $e) {
+            $this->assertStringContainsString('unsigned', $e->getMessage());
+        }
+        $this->assertDirectoryDoesNotExist(APPLICATION_PATH . '/modules/w4lic', 'nothing was placed');
+
+        // SIGNED with a real Ed25519 keypair over the tarball bytes → the signature verifies and it installs.
+        $signedTar = $this->makeModulePackage('w4lic', $manifest);
+        $keys      = Tiger_Crypto_Signature::generateKeypair();
+        $signature = Tiger_Crypto_Signature::signFile($signedTar, $keys['secret_key']);
+        $sha256    = Tiger_Crypto_Signature::sha256File($signedTar);
+
+        $r = Tiger_Module_Installer::installFromTarball($signedTar, ['source' => Tiger_Model_Module::SOURCE_URL], [
+            'signature' => [
+                'algo'       => Tiger_Crypto_Signature::ALGO,
+                'public_key' => $keys['public_key'],
+                'signature'  => $signature,
+                'sha256'     => $sha256,
+            ],
+        ]);
+        $this->installed[] = 'w4lic';
+        $this->assertSame('w4lic', $r['slug']);
+        $this->assertDirectoryExists(APPLICATION_PATH . '/modules/w4lic');
+    }
+
+    #[Test]
+    public function aTamperedSignedArtifactIsRefusedBeforePlacement(): void
+    {
+        $tar  = $this->makeModulePackage('w4tamper', ['version' => '1.0.0']);
+        $keys = Tiger_Crypto_Signature::generateKeypair();
+        $sig  = Tiger_Crypto_Signature::signFile($tar, $keys['secret_key']);
+
+        // Flip a byte AFTER signing → the artifact no longer matches the signature.
+        $bytes = file_get_contents($tar);
+        $bytes[strlen($bytes) >> 1] = ($bytes[strlen($bytes) >> 1] === "\x00") ? "\x01" : "\x00";
+        file_put_contents($tar, $bytes);
+
+        try {
+            Tiger_Module_Installer::installFromTarball($tar, [], ['signature' => [
+                'algo' => Tiger_Crypto_Signature::ALGO, 'public_key' => $keys['public_key'], 'signature' => $sig,
+            ]]);
+            $this->fail('a tampered artifact must be refused');
+        } catch (RuntimeException $e) {
+            $this->assertStringContainsString('signature verification FAILED', $e->getMessage());
+        }
+        $this->assertDirectoryDoesNotExist(APPLICATION_PATH . '/modules/w4tamper');
+    }
+
+    #[Test]
+    public function aPhpRequirementBeyondThisServerIsAHardBlock(): void
+    {
+        // PHP is the one HARD gate in _checkRequires (Tiger compat is advisory; PHP is not).
+        $tar = $this->makeModulePackage('w4php', ['requires' => ['php' => '>=99.0']]);
+        try {
+            Tiger_Module_Installer::installFromUpload($tar);
+            $this->fail('an impossible PHP requirement must block the install');
+        } catch (RuntimeException $e) {
+            $this->assertStringContainsString('requires PHP', $e->getMessage());
+        }
+        $this->assertDirectoryDoesNotExist(APPLICATION_PATH . '/modules/w4php');
+    }
+
+    // ---- remove() --------------------------------------------------------------
+
+    #[Test]
+    public function removeDeletesTheFilesAndTheRow(): void
+    {
+        $this->installFixture('w4rm', ['version' => '1.0.0']);
+        $this->assertDirectoryExists(APPLICATION_PATH . '/modules/w4rm');
+
+        $this->assertTrue(Tiger_Module_Installer::remove('w4rm'));
+        $this->assertDirectoryDoesNotExist(APPLICATION_PATH . '/modules/w4rm');
+        $this->assertNull((new Tiger_Model_Module())->bySlug('w4rm'), 'the row is dropped');
+    }
+
+    #[Test]
+    public function removeRefusesAModuleItDoesNotManage(): void
+    {
+        // A discovered (not installer-managed) module row → remove() must refuse it.
+        (new Tiger_Model_Module())->setActive('w4discovered', true, ['source' => Tiger_Model_Module::SOURCE_DISCOVERED, 'name' => 'Discovered']);
+        try {
+            Tiger_Module_Installer::remove('w4discovered');
+            $this->fail('remove() must refuse a non-installer-managed module');
+        } catch (RuntimeException $e) {
+            $this->assertStringContainsString("isn't an installer-managed module", $e->getMessage());
+        }
+    }
+
+    // ---- migrateModule / publishAssets / unpublishAssets -----------------------
+
+    #[Test]
+    public function migrateModuleRunsAModulesOwnMigrationsAndIsANoOpWithout(): void
+    {
+        // No migrations/ dir → false (the no-op branch).
+        $this->plantModule('w4nomig', ['module.json' => json_encode(['slug' => 'w4nomig'])]);
+        $this->assertFalse(Tiger_Module_Installer::migrateModule('w4nomig'));
+        $this->rrmdir(APPLICATION_PATH . '/modules/w4nomig');
+
+        // With a migrations/ dir → true, and the schema is applied.
+        $this->plantModule('w4mig', [
+            'module.json'               => json_encode(['slug' => 'w4mig']),
+            'migrations/9001_w4.php'    => "<?php\nreturn ['up' => ['CREATE TABLE `w4_migtest` (`id` INT NOT NULL, PRIMARY KEY(`id`))'], 'down' => ['DROP TABLE `w4_migtest`']];\n",
+        ]);
+        try {
+            $this->assertTrue(Tiger_Module_Installer::migrateModule('w4mig'));
+            $this->assertTrue($this->tableExists('w4_migtest'), 'the module migration created its table');
+        } finally {
+            try { $this->db->query('DROP TABLE IF EXISTS `w4_migtest`'); } catch (\Throwable $e) {}
+            try { $this->db->query("DELETE FROM `tiger_migration` WHERE version = '9001'"); } catch (\Throwable $e) {}
+            $this->rrmdir(APPLICATION_PATH . '/modules/w4mig');
+        }
+    }
+
+    #[Test]
+    public function publishAndUnpublishAssetsManageThePublicLink(): void
+    {
+        $this->plantModule('w4assets', [
+            'module.json'      => json_encode(['slug' => 'w4assets']),
+            'assets/app.css'   => "body{}\n",
+        ]);
+        $this->installed[] = 'w4assets';   // ensure the link is cleaned even if an assert fails
+
+        Tiger_Module_Installer::publishAssets('w4assets');
+        $link = APPLICATION_ROOT . '/public/_modules/w4assets';
+        $this->assertTrue(is_link($link) || is_dir($link), 'assets are published to public/_modules');
+        $this->assertFileExists($link . '/app.css');
+
+        Tiger_Module_Installer::unpublishAssets('w4assets');
+        $this->assertFalse(is_link($link) || is_dir($link), 'unpublish removes the public link');
+
+        $this->rrmdir(APPLICATION_PATH . '/modules/w4assets');
+    }
+
+    // ---- installFromAuthority : guard + reachable failure branches -------------
+
+    #[Test]
+    public function installFromAuthorityRejectsIncompleteMeta(): void
+    {
+        try {
+            Tiger_Module_Installer::installFromAuthority('https://store.example/authority', 'LIC-1', ['product' => 'w4x']);
+            $this->fail('a licensed install needs authority + key + product + public_key');
+        } catch (RuntimeException $e) {
+            $this->assertStringContainsString('public key', $e->getMessage());
+        }
+    }
+
+    #[Test]
+    public function installFromAuthorityThrowsWhenTheAuthorityRefuses(): void
+    {
+        Tiger_License_Authority::setTransport(static fn(string $url, array $payload): ?array => null);   // refused/unreachable
+        try {
+            Tiger_Module_Installer::installFromAuthority('https://store.example/authority', 'LIC-1', [
+                'product' => 'w4x', 'public_key' => str_repeat('a', 44),
+            ]);
+            $this->fail('a refused authority must abort the install');
+        } catch (RuntimeException $e) {
+            $this->assertStringContainsString('did not authorize', $e->getMessage());
+        }
+    }
+
+    #[Test]
+    public function installFromAuthorityThrowsWhenTheSignedDownloadIsUnreachable(): void
+    {
+        // The authority authorizes + returns a (dead) signed URL → the download step fails, no network hit.
+        Tiger_License_Authority::setTransport(static fn(string $url, array $payload): ?array => [
+            'url'       => 'http://127.0.0.1:9/licensed.zip',
+            'signature' => base64_encode(str_repeat("\x01", 64)),
+            'sha256'    => str_repeat('0', 64),
+            'version'   => '1.0.0',
+        ]);
+        try {
+            Tiger_Module_Installer::installFromAuthority('https://store.example/authority', 'LIC-1', [
+                'product' => 'w4x', 'public_key' => str_repeat('a', 44),
+            ]);
+            $this->fail('an unreachable signed download must abort the install');
+        } catch (RuntimeException $e) {
+            $this->assertStringContainsString('Failed to download', $e->getMessage());
+        }
+    }
+
+    // ---- helpers ---------------------------------------------------------------
+
+    /** Install a free fixture module and register it for cleanup. */
+    private function installFixture(string $slug, array $manifest): array
+    {
+        $r = Tiger_Module_Installer::installFromUpload($this->makeModulePackage($slug, $manifest));
+        $this->installed[] = $slug;
+        return $r;
+    }
+
+    /**
+     * Build a real package archive containing a single top dir <slug>/ with a module.json — the shape a
+     * GitHub/upload archive has (the installer unwraps the single top dir).
+     *
+     * We use a ZIP (ZipArchive), not a PharData tar.gz: the installer extracts a zip via the universally
+     * available `zip` extension (detected by the "PK" magic, so the extensionless path is irrelevant),
+     * whereas PharData tar.gz round-tripping is not portable across every PHP build/CI runner. The
+     * installer, the signature gate, and the single-top-dir unwrap are all archive-format-agnostic.
+     */
+    private function makeModulePackage(string $slug, array $manifest): string
+    {
+        $manifest += ['slug' => $slug, 'name' => ucfirst($slug)];
+        $manifest['slug'] = $slug;
+        $path = $this->tmp . '/' . $slug . '_' . bin2hex(random_bytes(3)) . '.zip';
+        $zip  = new \ZipArchive();
+        if ($zip->open($path, \ZipArchive::CREATE | \ZipArchive::OVERWRITE) !== true) {
+            $this->fail('could not create the fixture zip at ' . $path);
+        }
+        $zip->addFromString($slug . '/module.json', json_encode($manifest));
+        $zip->addFromString($slug . '/README.md', "# {$slug}\n");
+        $zip->close();
+        return $path;
+    }
+
+    /** Plant a module dir directly under the app modules root (for the activate-time hooks). */
+    private function plantModule(string $slug, array $files): void
+    {
+        $dir = APPLICATION_PATH . '/modules/' . $slug;
+        @mkdir($dir, 0775, true);
+        foreach ($files as $rel => $contents) {
+            $full = $dir . '/' . $rel;
+            @mkdir(dirname($full), 0775, true);
+            file_put_contents($full, $contents);
+        }
+    }
+
+    private function rrmdir(string $dir): void
+    {
+        if (!is_dir($dir)) { return; }
+        foreach (scandir($dir) ?: [] as $item) {
+            if ($item === '.' || $item === '..') { continue; }
+            $p = $dir . '/' . $item;
+            (is_dir($p) && !is_link($p)) ? $this->rrmdir($p) : @unlink($p);
+        }
+        @rmdir($dir);
+    }
+}
diff --git a/tests/Integration/Profile/AddressServiceTest.php b/tests/Integration/Profile/AddressServiceTest.php
new file mode 100644
index 0000000..7170074
--- /dev/null
+++ b/tests/Integration/Profile/AddressServiceTest.php
@@ -0,0 +1,221 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Profile;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Profile_Service_Address;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_User;
+use Tiger_Model_UserAddress;
+use Zend_Registry;
+
+/**
+ * Profile_Service_Address — the self-service Addresses tab (/api).
+ *
+ * Wave-4 coverage of the collection CRUD: the self-scope gate, create (a shared `address` row + a
+ * `user_address` link carrying label + is_primary), edit-in-place (by link_id, ownership enforced),
+ * the type/country membership guards, the single-primary rule (setting one clears the others), the
+ * coordinate range-normalizer, delete (unlink + soft-delete the location, ownership enforced), and
+ * the success envelope (the refreshed list + a rotated CSRF token). Extends Profile_Service_Base, so
+ * these also cover _soloPrimary / _freshToken / _validCsrf.
+ */
+#[CoversClass(Profile_Service_Address::class)]
+final class AddressServiceTest extends IntegrationTestCase
+{
+    private string $userId;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+        $this->userId = (new Tiger_Model_User())->insert(['email' => 'addr@w4test.com', 'status' => 'active']);
+        $this->login($this->userId, 'org-test', 'user');
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Profile_Service_Address(['action' => $action] + $params))->getResponse();
+    }
+
+    private function validAddress(array $over = []): array
+    {
+        return $over + [
+            'type'    => 'home',
+            'country' => 'US',
+            'line1'   => '123 Main St',
+            'city'    => 'Springfield',
+            'region'  => 'IL',
+            'postal'  => '62704',
+        ];
+    }
+
+    // ----- gate ---------------------------------------------------------------------------------
+
+    #[Test]
+    public function a_guest_is_refused_on_save_and_delete(): void
+    {
+        $this->logout();
+        $this->assertSame(0, (int) $this->call('save', $this->validAddress())->result);
+        $this->assertSame(0, (int) $this->call('delete', ['link_id' => 'x'])->result);
+    }
+
+    // ----- create / envelope --------------------------------------------------------------------
+
+    #[Test]
+    public function create_inserts_the_location_and_link_and_returns_the_refreshed_list(): void
+    {
+        $res = $this->call('save', $this->validAddress(['is_primary' => 1]));
+        $this->assertSame(1, (int) $res->result, 'a valid address saves');
+        $this->assertStringContainsString('address.saved', json_encode($res->messages));
+
+        // The success envelope carries the refreshed list + a rotated token key.
+        $this->assertArrayHasKey('addresses', $res->data);
+        $this->assertArrayHasKey('_csrf', $res->data);
+        $this->assertCount(1, $res->data['addresses']);
+
+        $row = $res->data['addresses'][0];
+        $this->assertSame('home', $row['label'], 'the type is stored on the link label');
+        $this->assertSame('123 Main St', $row['line1']);
+        $this->assertSame('US', $row['country']);
+        $this->assertSame(1, (int) $row['is_primary']);
+    }
+
+    #[Test]
+    public function edit_updates_the_existing_link_and_location_in_place(): void
+    {
+        $created = $this->call('save', $this->validAddress());
+        $linkId  = $created->data['addresses'][0]['link_id'];
+
+        $res = $this->call('save', $this->validAddress([
+            'link_id' => $linkId,
+            'type'    => 'office',
+            'line1'   => '999 New Ave',
+        ]));
+        $this->assertSame(1, (int) $res->result);
+        $this->assertCount(1, $res->data['addresses'], 'an edit updates in place, no new row');
+        $this->assertSame('office', $res->data['addresses'][0]['label']);
+        $this->assertSame('999 New Ave', $res->data['addresses'][0]['line1']);
+    }
+
+    // ----- validation guards --------------------------------------------------------------------
+
+    #[Test]
+    public function an_unknown_type_is_refused(): void
+    {
+        $res = $this->call('save', $this->validAddress(['type' => 'moonbase']));
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('bad_type', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function an_unknown_country_is_refused(): void
+    {
+        $res = $this->call('save', $this->validAddress(['country' => 'QQ']));   // QQ is not an ISO-3166 code
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('bad_country', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function a_missing_required_line1_returns_form_errors(): void
+    {
+        $params = $this->validAddress();
+        unset($params['line1']);
+        $res = $this->call('save', $params);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertNotNull($res->form);
+        $this->assertArrayHasKey('line1', $res->form);
+    }
+
+    // ----- coordinate normalization -------------------------------------------------------------
+
+    #[Test]
+    public function an_in_range_geocode_is_stored_and_an_out_of_range_one_is_nulled(): void
+    {
+        $ok = $this->call('save', $this->validAddress(['latitude' => '39.78', 'longitude' => '-89.65']));
+        $addrId = $this->db->fetchOne('SELECT address_id FROM user_address WHERE user_address_id = ?', [$ok->data['addresses'][0]['link_id']]);
+        $stored = $this->db->fetchRow('SELECT latitude, longitude FROM address WHERE address_id = ?', [$addrId]);
+        $this->assertEqualsWithDelta(39.78, (float) $stored['latitude'], 0.001, 'a valid latitude is stored');
+        $this->assertEqualsWithDelta(-89.65, (float) $stored['longitude'], 0.001);
+
+        $bad = $this->call('save', $this->validAddress(['latitude' => '999', 'longitude' => 'not-a-number']));
+        // No primary set, so the list is ordered oldest-first — the row we just added is LAST.
+        $badLink = end($bad->data['addresses'])['link_id'];
+        $addrId2 = $this->db->fetchOne('SELECT address_id FROM user_address WHERE user_address_id = ?', [$badLink]);
+        $stored2 = $this->db->fetchRow('SELECT latitude, longitude FROM address WHERE address_id = ?', [$addrId2]);
+        $this->assertNull($stored2['latitude'], 'an out-of-range latitude stores NULL');
+        $this->assertNull($stored2['longitude'], 'a non-numeric longitude stores NULL');
+    }
+
+    // ----- single-primary rule ------------------------------------------------------------------
+
+    #[Test]
+    public function setting_a_new_primary_clears_the_previous_primary(): void
+    {
+        $first  = $this->call('save', $this->validAddress(['type' => 'home', 'is_primary' => 1]));
+        $firstId = $first->data['addresses'][0]['link_id'];
+
+        $second = $this->call('save', $this->validAddress(['type' => 'office', 'line1' => '2 Office Rd', 'is_primary' => 1]));
+
+        // The freshly-saved primary is the office one; the old home link must no longer be primary.
+        $byLink = [];
+        foreach ($second->data['addresses'] as $r) { $byLink[$r['link_id']] = (int) $r['is_primary']; }
+        $this->assertSame(0, $byLink[$firstId], 'the former primary was cleared');
+        $primaries = array_sum($byLink);
+        $this->assertSame(1, $primaries, 'exactly one primary remains');
+    }
+
+    // ----- delete -------------------------------------------------------------------------------
+
+    #[Test]
+    public function delete_unlinks_and_soft_deletes_the_location(): void
+    {
+        $created = $this->call('save', $this->validAddress());
+        $linkId  = $created->data['addresses'][0]['link_id'];
+        $addrId  = $this->db->fetchOne('SELECT address_id FROM user_address WHERE user_address_id = ?', [$linkId]);
+
+        $res = $this->call('delete', ['link_id' => $linkId]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertStringContainsString('address.deleted', json_encode($res->messages));
+        $this->assertEmpty($res->data['addresses'], 'the list is empty after the delete');
+
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT deleted FROM user_address WHERE user_address_id = ?', [$linkId]), 'link soft-deleted');
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT deleted FROM address WHERE address_id = ?', [$addrId]), 'location soft-deleted');
+    }
+
+    #[Test]
+    public function you_cannot_edit_an_address_that_is_not_yours(): void
+    {
+        // Another user's address.
+        $otherId = (new Tiger_Model_User())->insert(['email' => 'other@w4test.com', 'status' => 'active']);
+        $this->login($otherId, 'org-test', 'user');
+        $foreign = $this->call('save', $this->validAddress())->data['addresses'][0]['link_id'];
+
+        // Back to me: try to edit their link.
+        $this->login($this->userId, 'org-test', 'user');
+        $res = $this->call('save', $this->validAddress(['link_id' => $foreign, 'line1' => 'hijack']));
+        $this->assertSame(0, (int) $res->result, 'editing a foreign address is refused');
+    }
+
+    #[Test]
+    public function you_cannot_delete_an_address_that_is_not_yours(): void
+    {
+        $otherId = (new Tiger_Model_User())->insert(['email' => 'other2@w4test.com', 'status' => 'active']);
+        $this->login($otherId, 'org-test', 'user');
+        $foreign = $this->call('save', $this->validAddress())->data['addresses'][0]['link_id'];
+
+        $this->login($this->userId, 'org-test', 'user');
+        $res = $this->call('delete', ['link_id' => $foreign]);
+        $this->assertSame(0, (int) $res->result, 'deleting a foreign address is refused');
+        $this->assertSame(0, (int) $this->db->fetchOne('SELECT deleted FROM user_address WHERE user_address_id = ?', [$foreign]), 'the foreign link is untouched');
+    }
+}
diff --git a/tests/Integration/Profile/AvatarServiceTest.php b/tests/Integration/Profile/AvatarServiceTest.php
new file mode 100644
index 0000000..97c88a7
--- /dev/null
+++ b/tests/Integration/Profile/AvatarServiceTest.php
@@ -0,0 +1,95 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Profile;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Profile_Service_Avatar;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Option;
+use Tiger_Model_User;
+use Zend_Registry;
+
+/**
+ * Profile_Service_Avatar — self-service avatar upload/clear (/api).
+ *
+ * Wave-4 coverage of the reachable surface: the self-scope gate (a guest is refused on both actions),
+ * the upload-guard rejections (no file present → error_upload), and remove() which forgets the
+ * per-user `tiger.user.avatar` option (leaving the media row in place).
+ *
+ * NOTE: the upload HAPPY path is gated by is_uploaded_file() (a real multipart upload), which cannot
+ * be satisfied from CLI/PHPUnit — see WAVE4-FINDINGS-profile.md. So the store→media→option-link body
+ * is exercised in the browser, not here.
+ */
+#[CoversClass(Profile_Service_Avatar::class)]
+final class AvatarServiceTest extends IntegrationTestCase
+{
+    private string $userId;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+        $this->userId = (new Tiger_Model_User())->insert(['email' => 'avatar@w4test.com', 'status' => 'active']);
+        $this->login($this->userId, 'org-test', 'user');
+    }
+
+    protected function tearDown(): void
+    {
+        unset($_FILES['file']);
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Profile_Service_Avatar(['action' => $action] + $params))->getResponse();
+    }
+
+    #[Test]
+    public function a_guest_is_refused_on_upload_and_remove(): void
+    {
+        $this->logout();
+        $this->assertStringContainsString('not_allowed', json_encode($this->call('upload')->messages));
+        $this->assertStringContainsString('not_allowed', json_encode($this->call('remove')->messages));
+    }
+
+    #[Test]
+    public function an_upload_with_no_file_is_rejected(): void
+    {
+        unset($_FILES['file']);
+        $res = $this->call('upload');
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('avatar.error_upload', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function an_upload_with_a_non_uploaded_tmp_file_is_rejected(): void
+    {
+        // A tmp_name that isn't a genuine multipart upload → is_uploaded_file() fails → error_upload.
+        $_FILES['file'] = ['name' => 'a.png', 'type' => 'image/png', 'tmp_name' => '/tmp/not-an-upload', 'error' => UPLOAD_ERR_OK, 'size' => 10];
+        $res = $this->call('upload');
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('avatar.error_upload', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function remove_forgets_the_avatar_option(): void
+    {
+        // Seed an avatar option, then clear it.
+        $opt = new Tiger_Model_Option();
+        $opt->set(Tiger_Model_Option::SCOPE_USER, $this->userId, Profile_Service_Avatar::OPTION_KEY, 'media-xyz');
+        $this->assertSame('media-xyz', $opt->get(Tiger_Model_Option::SCOPE_USER, $this->userId, Profile_Service_Avatar::OPTION_KEY));
+
+        $res = $this->call('remove');
+        $this->assertSame(1, (int) $res->result);
+        $this->assertStringContainsString('avatar.removed', json_encode($res->messages));
+        $this->assertNull(
+            $opt->get(Tiger_Model_Option::SCOPE_USER, $this->userId, Profile_Service_Avatar::OPTION_KEY),
+            'the avatar option is forgotten'
+        );
+    }
+}
diff --git a/tests/Integration/Profile/ContactServiceTest.php b/tests/Integration/Profile/ContactServiceTest.php
new file mode 100644
index 0000000..051a280
--- /dev/null
+++ b/tests/Integration/Profile/ContactServiceTest.php
@@ -0,0 +1,173 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Profile;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Profile_Service_Contact;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_User;
+use Zend_Registry;
+
+/**
+ * Profile_Service_Contact — the self-service Contacts tab (/api).
+ *
+ * Wave-4 coverage: the self-scope gate, create (a shared `contact` channel + a `user_contact` link),
+ * edit-in-place (by link_id, ownership enforced), the type membership guard, the phone E.164 shape
+ * guard (+ the ISO-country stashed on contact.type), the single-primary rule, delete (unlink +
+ * soft-delete, ownership enforced), and the refreshed-list + rotated-token envelope.
+ */
+#[CoversClass(Profile_Service_Contact::class)]
+final class ContactServiceTest extends IntegrationTestCase
+{
+    private string $userId;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+        $this->userId = (new Tiger_Model_User())->insert(['email' => 'contact@w4test.com', 'status' => 'active']);
+        $this->login($this->userId, 'org-test', 'user');
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Profile_Service_Contact(['action' => $action] + $params))->getResponse();
+    }
+
+    // ----- gate ---------------------------------------------------------------------------------
+
+    #[Test]
+    public function a_guest_is_refused_on_save_and_delete(): void
+    {
+        $this->logout();
+        $this->assertSame(0, (int) $this->call('save', ['type' => 'email', 'value' => 'a@b.com'])->result);
+        $this->assertSame(0, (int) $this->call('delete', ['link_id' => 'x'])->result);
+    }
+
+    // ----- create / edit --------------------------------------------------------------------------
+
+    #[Test]
+    public function create_inserts_the_channel_and_link_and_returns_the_refreshed_list(): void
+    {
+        $res = $this->call('save', ['type' => 'email', 'value' => 'me@example.com', 'is_primary' => 1]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertStringContainsString('contact.saved', json_encode($res->messages));
+        $this->assertArrayHasKey('contacts', $res->data);
+        $this->assertArrayHasKey('_csrf', $res->data);
+        $this->assertCount(1, $res->data['contacts']);
+        $this->assertSame('me@example.com', $res->data['contacts'][0]['value']);
+        $this->assertSame(1, (int) $res->data['contacts'][0]['is_primary']);
+    }
+
+    #[Test]
+    public function edit_updates_the_existing_contact_in_place(): void
+    {
+        $created = $this->call('save', ['type' => 'email', 'value' => 'old@example.com']);
+        $linkId  = $created->data['contacts'][0]['link_id'];
+
+        $res = $this->call('save', ['link_id' => $linkId, 'type' => 'email', 'value' => 'new@example.com']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertCount(1, $res->data['contacts'], 'an edit does not add a row');
+        $this->assertSame('new@example.com', $res->data['contacts'][0]['value']);
+    }
+
+    // ----- validation ----------------------------------------------------------------------------
+
+    #[Test]
+    public function an_unknown_type_is_refused(): void
+    {
+        $res = $this->call('save', ['type' => 'telepathy', 'value' => 'x']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('bad_type', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function a_missing_required_value_returns_form_errors(): void
+    {
+        $res = $this->call('save', ['type' => 'email']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertNotNull($res->form);
+        $this->assertArrayHasKey('value', $res->form);
+    }
+
+    // ----- phone --------------------------------------------------------------------------------
+
+    #[Test]
+    public function a_malformed_phone_e164_is_refused(): void
+    {
+        $res = $this->call('save', ['type' => 'phone', 'value' => '555-1234', 'phone_country' => 'US']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('bad_phone', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function a_valid_phone_stores_the_number_and_stashes_the_iso_country(): void
+    {
+        $res = $this->call('save', ['type' => 'phone', 'value' => '+15551234567', 'phone_country' => 'us']);
+        $this->assertSame(1, (int) $res->result, 'a canonical E.164 number is accepted');
+
+        $link = $res->data['contacts'][0]['link_id'];
+        $contactId = $this->db->fetchOne('SELECT contact_id FROM user_contact WHERE user_contact_id = ?', [$link]);
+        $row = $this->db->fetchRow('SELECT kind, type, value FROM contact WHERE contact_id = ?', [$contactId]);
+        $this->assertSame('phone', $row['kind']);
+        $this->assertSame('US', $row['type'], 'the picked ISO-3166 country is stashed on contact.type');
+        $this->assertSame('+15551234567', $row['value']);
+    }
+
+    // ----- single-primary -----------------------------------------------------------------------
+
+    #[Test]
+    public function setting_a_new_primary_clears_the_previous_primary(): void
+    {
+        $first   = $this->call('save', ['type' => 'email', 'value' => 'first@example.com', 'is_primary' => 1]);
+        $firstId = $first->data['contacts'][0]['link_id'];
+
+        $second = $this->call('save', ['type' => 'email', 'value' => 'second@example.com', 'is_primary' => 1]);
+
+        $byLink = [];
+        foreach ($second->data['contacts'] as $r) { $byLink[$r['link_id']] = (int) $r['is_primary']; }
+        $this->assertSame(0, $byLink[$firstId], 'the former primary was cleared');
+        $this->assertSame(1, array_sum($byLink), 'exactly one primary remains');
+    }
+
+    // ----- delete -------------------------------------------------------------------------------
+
+    #[Test]
+    public function delete_unlinks_and_soft_deletes_the_channel(): void
+    {
+        $created = $this->call('save', ['type' => 'email', 'value' => 'gone@example.com']);
+        $linkId  = $created->data['contacts'][0]['link_id'];
+        $contactId = $this->db->fetchOne('SELECT contact_id FROM user_contact WHERE user_contact_id = ?', [$linkId]);
+
+        $res = $this->call('delete', ['link_id' => $linkId]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertStringContainsString('contact.deleted', json_encode($res->messages));
+        $this->assertEmpty($res->data['contacts']);
+
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT deleted FROM user_contact WHERE user_contact_id = ?', [$linkId]));
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT deleted FROM contact WHERE contact_id = ?', [$contactId]));
+    }
+
+    #[Test]
+    public function you_cannot_edit_or_delete_a_contact_that_is_not_yours(): void
+    {
+        $otherId = (new Tiger_Model_User())->insert(['email' => 'other@w4test.com', 'status' => 'active']);
+        $this->login($otherId, 'org-test', 'user');
+        $foreign = $this->call('save', ['type' => 'email', 'value' => 'theirs@example.com'])->data['contacts'][0]['link_id'];
+
+        $this->login($this->userId, 'org-test', 'user');
+        $this->assertSame(0, (int) $this->call('save', ['link_id' => $foreign, 'type' => 'email', 'value' => 'hijack@example.com'])->result);
+        $this->assertSame(0, (int) $this->call('delete', ['link_id' => $foreign])->result);
+        $this->assertSame(0, (int) $this->db->fetchOne('SELECT deleted FROM user_contact WHERE user_contact_id = ?', [$foreign]), 'the foreign link is untouched');
+    }
+}
diff --git a/tests/Integration/Profile/OrgAddressServiceTest.php b/tests/Integration/Profile/OrgAddressServiceTest.php
new file mode 100644
index 0000000..3900ad2
--- /dev/null
+++ b/tests/Integration/Profile/OrgAddressServiceTest.php
@@ -0,0 +1,147 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Profile;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Profile_Service_OrgAddress;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Zend_Registry;
+
+/**
+ * Profile_Service_OrgAddress — the admin-gated ORG Addresses tab (/api).
+ *
+ * The org twin of Profile_Service_Address: identical CRUD, but admin-gated and scoped to the CURRENT
+ * org ($this->_org_id). Wave-4 coverage: the admin gate (guest + plain user refused), create/edit,
+ * the type/country guards, the single-primary rule, the coordinate normalizer, delete, and the
+ * cross-org ownership guard (an admin in org B can't touch org A's link).
+ */
+#[CoversClass(Profile_Service_OrgAddress::class)]
+final class OrgAddressServiceTest extends IntegrationTestCase
+{
+    private string $orgId = 'org-w4-addr';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+        $this->login('admin-actor', $this->orgId, 'admin');
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Profile_Service_OrgAddress(['action' => $action] + $params))->getResponse();
+    }
+
+    private function validAddress(array $over = []): array
+    {
+        return $over + [
+            'type'    => 'office',
+            'country' => 'US',
+            'line1'   => '1 Corporate Way',
+            'city'    => 'Metropolis',
+            'region'  => 'NY',
+            'postal'  => '10001',
+        ];
+    }
+
+    // ----- gate ---------------------------------------------------------------------------------
+
+    #[Test]
+    public function guest_and_plain_user_are_denied(): void
+    {
+        $this->login('anon', $this->orgId, 'guest');
+        $this->assertSame(0, (int) $this->call('save', $this->validAddress())->result);
+        $this->assertStringContainsString('not_allowed', json_encode($this->call('delete', ['link_id' => 'x'])->messages));
+
+        $this->loginAs('user');
+        $this->assertSame(0, (int) $this->call('save', $this->validAddress())->result, 'a plain user is not an org admin');
+    }
+
+    // ----- create / edit ------------------------------------------------------------------------
+
+    #[Test]
+    public function admin_creates_and_edits_an_org_address(): void
+    {
+        $created = $this->call('save', $this->validAddress(['is_primary' => 1]));
+        $this->assertSame(1, (int) $created->result);
+        $this->assertCount(1, $created->data['addresses']);
+        $this->assertArrayHasKey('_csrf', $created->data);
+        $linkId = $created->data['addresses'][0]['link_id'];
+
+        $edited = $this->call('save', $this->validAddress(['link_id' => $linkId, 'type' => 'mailing', 'line1' => 'PO Box 9']));
+        $this->assertSame(1, (int) $edited->result);
+        $this->assertCount(1, $edited->data['addresses'], 'edit is in place');
+        $this->assertSame('mailing', $edited->data['addresses'][0]['label']);
+        $this->assertSame('PO Box 9', $edited->data['addresses'][0]['line1']);
+    }
+
+    #[Test]
+    public function type_and_country_guards_fire(): void
+    {
+        $this->assertStringContainsString('bad_type', json_encode($this->call('save', $this->validAddress(['type' => 'nope']))->messages));
+        $this->assertStringContainsString('bad_country', json_encode($this->call('save', $this->validAddress(['country' => 'QQ']))->messages));
+    }
+
+    #[Test]
+    public function the_coordinate_normalizer_nulls_out_of_range_values(): void
+    {
+        $res    = $this->call('save', $this->validAddress(['latitude' => '999', 'longitude' => '12.34']));
+        $link   = end($res->data['addresses'])['link_id'];
+        $addrId = $this->db->fetchOne('SELECT address_id FROM org_address WHERE org_address_id = ?', [$link]);
+        $stored = $this->db->fetchRow('SELECT latitude, longitude FROM address WHERE address_id = ?', [$addrId]);
+        $this->assertNull($stored['latitude'], 'an out-of-range latitude stores NULL');
+        $this->assertEqualsWithDelta(12.34, (float) $stored['longitude'], 0.001, 'an in-range longitude is kept');
+    }
+
+    #[Test]
+    public function setting_a_new_primary_clears_the_previous_one(): void
+    {
+        $first   = $this->call('save', $this->validAddress(['is_primary' => 1]));
+        $firstId = $first->data['addresses'][0]['link_id'];
+        $second  = $this->call('save', $this->validAddress(['type' => 'mailing', 'line1' => '2 Second St', 'is_primary' => 1]));
+
+        $byLink = [];
+        foreach ($second->data['addresses'] as $r) { $byLink[$r['link_id']] = (int) $r['is_primary']; }
+        $this->assertSame(0, $byLink[$firstId]);
+        $this->assertSame(1, array_sum($byLink));
+    }
+
+    // ----- delete + cross-org -------------------------------------------------------------------
+
+    #[Test]
+    public function delete_unlinks_and_soft_deletes(): void
+    {
+        $link   = $this->call('save', $this->validAddress())->data['addresses'][0]['link_id'];
+        $addrId = $this->db->fetchOne('SELECT address_id FROM org_address WHERE org_address_id = ?', [$link]);
+
+        $res = $this->call('delete', ['link_id' => $link]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertEmpty($res->data['addresses']);
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT deleted FROM org_address WHERE org_address_id = ?', [$link]));
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT deleted FROM address WHERE address_id = ?', [$addrId]));
+    }
+
+    #[Test]
+    public function an_admin_cannot_touch_another_orgs_address(): void
+    {
+        // org A owns a link.
+        $this->login('admin-a', 'org-A', 'admin');
+        $foreign = $this->call('save', $this->validAddress())->data['addresses'][0]['link_id'];
+
+        // admin in org B tries to edit + delete it.
+        $this->login('admin-b', 'org-B', 'admin');
+        $this->assertSame(0, (int) $this->call('save', $this->validAddress(['link_id' => $foreign, 'line1' => 'hijack']))->result);
+        $this->assertSame(0, (int) $this->call('delete', ['link_id' => $foreign])->result);
+        $this->assertSame(0, (int) $this->db->fetchOne('SELECT deleted FROM org_address WHERE org_address_id = ?', [$foreign]), 'the other org link is untouched');
+    }
+}
diff --git a/tests/Integration/Profile/OrgContactServiceTest.php b/tests/Integration/Profile/OrgContactServiceTest.php
new file mode 100644
index 0000000..8324407
--- /dev/null
+++ b/tests/Integration/Profile/OrgContactServiceTest.php
@@ -0,0 +1,133 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Profile;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Profile_Service_OrgContact;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Zend_Registry;
+
+/**
+ * Profile_Service_OrgContact — the admin-gated ORG Contacts tab (/api).
+ *
+ * The org twin of Profile_Service_Contact: admin-gated + scoped to the CURRENT org. Wave-4 coverage:
+ * the admin gate, create/edit, the type + phone-E.164 guards (ISO country stashed on contact.type),
+ * the single-primary rule, delete, and the cross-org ownership guard.
+ */
+#[CoversClass(Profile_Service_OrgContact::class)]
+final class OrgContactServiceTest extends IntegrationTestCase
+{
+    private string $orgId = 'org-w4-contact';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+        $this->login('admin-actor', $this->orgId, 'admin');
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Profile_Service_OrgContact(['action' => $action] + $params))->getResponse();
+    }
+
+    // ----- gate ---------------------------------------------------------------------------------
+
+    #[Test]
+    public function guest_and_plain_user_are_denied(): void
+    {
+        $this->login('anon', $this->orgId, 'guest');
+        $this->assertStringContainsString('not_allowed', json_encode($this->call('save', ['type' => 'email', 'value' => 'a@b.com'])->messages));
+        $this->assertStringContainsString('not_allowed', json_encode($this->call('delete', ['link_id' => 'x'])->messages));
+
+        $this->loginAs('user');
+        $this->assertSame(0, (int) $this->call('save', ['type' => 'email', 'value' => 'a@b.com'])->result);
+    }
+
+    // ----- create / edit ------------------------------------------------------------------------
+
+    #[Test]
+    public function admin_creates_and_edits_an_org_contact(): void
+    {
+        $created = $this->call('save', ['type' => 'email', 'value' => 'info@acme.com', 'is_primary' => 1]);
+        $this->assertSame(1, (int) $created->result);
+        $this->assertCount(1, $created->data['contacts']);
+        $this->assertArrayHasKey('_csrf', $created->data);
+        $linkId = $created->data['contacts'][0]['link_id'];
+
+        $edited = $this->call('save', ['link_id' => $linkId, 'type' => 'website', 'value' => 'https://acme.com']);
+        $this->assertSame(1, (int) $edited->result);
+        $this->assertCount(1, $edited->data['contacts'], 'edit is in place');
+        $this->assertSame('https://acme.com', $edited->data['contacts'][0]['value']);
+    }
+
+    // ----- validation ---------------------------------------------------------------------------
+
+    #[Test]
+    public function an_unknown_type_is_refused(): void
+    {
+        $this->assertStringContainsString('bad_type', json_encode($this->call('save', ['type' => 'smoke-signal', 'value' => 'x'])->messages));
+    }
+
+    #[Test]
+    public function a_malformed_phone_is_refused_and_a_valid_one_stashes_the_country(): void
+    {
+        $this->assertStringContainsString('bad_phone', json_encode($this->call('save', ['type' => 'phone', 'value' => '01234', 'phone_country' => 'GB'])->messages));
+
+        $ok   = $this->call('save', ['type' => 'phone', 'value' => '+442071234567', 'phone_country' => 'gb']);
+        $this->assertSame(1, (int) $ok->result);
+        $link = $ok->data['contacts'][0]['link_id'];
+        $contactId = $this->db->fetchOne('SELECT contact_id FROM org_contact WHERE org_contact_id = ?', [$link]);
+        $this->assertSame('GB', $this->db->fetchOne('SELECT type FROM contact WHERE contact_id = ?', [$contactId]));
+    }
+
+    // ----- single-primary + delete + cross-org --------------------------------------------------
+
+    #[Test]
+    public function setting_a_new_primary_clears_the_previous_one(): void
+    {
+        $first   = $this->call('save', ['type' => 'email', 'value' => 'a@acme.com', 'is_primary' => 1]);
+        $firstId = $first->data['contacts'][0]['link_id'];
+        $second  = $this->call('save', ['type' => 'email', 'value' => 'b@acme.com', 'is_primary' => 1]);
+
+        $byLink = [];
+        foreach ($second->data['contacts'] as $r) { $byLink[$r['link_id']] = (int) $r['is_primary']; }
+        $this->assertSame(0, $byLink[$firstId]);
+        $this->assertSame(1, array_sum($byLink));
+    }
+
+    #[Test]
+    public function delete_unlinks_and_soft_deletes(): void
+    {
+        $link      = $this->call('save', ['type' => 'email', 'value' => 'bye@acme.com'])->data['contacts'][0]['link_id'];
+        $contactId = $this->db->fetchOne('SELECT contact_id FROM org_contact WHERE org_contact_id = ?', [$link]);
+
+        $res = $this->call('delete', ['link_id' => $link]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertEmpty($res->data['contacts']);
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT deleted FROM org_contact WHERE org_contact_id = ?', [$link]));
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT deleted FROM contact WHERE contact_id = ?', [$contactId]));
+    }
+
+    #[Test]
+    public function an_admin_cannot_touch_another_orgs_contact(): void
+    {
+        $this->login('admin-a', 'org-CA', 'admin');
+        $foreign = $this->call('save', ['type' => 'email', 'value' => 'theirs@acme.com'])->data['contacts'][0]['link_id'];
+
+        $this->login('admin-b', 'org-CB', 'admin');
+        $this->assertSame(0, (int) $this->call('save', ['link_id' => $foreign, 'type' => 'email', 'value' => 'hijack@acme.com'])->result);
+        $this->assertSame(0, (int) $this->call('delete', ['link_id' => $foreign])->result);
+        $this->assertSame(0, (int) $this->db->fetchOne('SELECT deleted FROM org_contact WHERE org_contact_id = ?', [$foreign]));
+    }
+}
diff --git a/tests/Integration/Profile/OrgLogoServiceTest.php b/tests/Integration/Profile/OrgLogoServiceTest.php
new file mode 100644
index 0000000..d198354
--- /dev/null
+++ b/tests/Integration/Profile/OrgLogoServiceTest.php
@@ -0,0 +1,94 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Profile;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Profile_Service_OrgLogo;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Option;
+use Zend_Registry;
+
+/**
+ * Profile_Service_OrgLogo — admin-gated org logo upload/clear (/api).
+ *
+ * The org twin of Profile_Service_Avatar. Wave-4 coverage of the reachable surface: the admin gate
+ * (guest + plain user refused on both actions), the upload-guard rejection (no file → error_upload),
+ * and remove() which forgets the per-org `tiger.org.logo` option.
+ *
+ * NOTE: the upload HAPPY path is gated by is_uploaded_file() and is not reachable from CLI/PHPUnit —
+ * see WAVE4-FINDINGS-profile.md.
+ */
+#[CoversClass(Profile_Service_OrgLogo::class)]
+final class OrgLogoServiceTest extends IntegrationTestCase
+{
+    private string $orgId = 'org-w4-logo';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+        $this->login('admin-actor', $this->orgId, 'admin');
+    }
+
+    protected function tearDown(): void
+    {
+        unset($_FILES['file']);
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Profile_Service_OrgLogo(['action' => $action] + $params))->getResponse();
+    }
+
+    #[Test]
+    public function guest_and_plain_user_are_denied_on_upload_and_remove(): void
+    {
+        $this->login('anon', $this->orgId, 'guest');
+        $this->assertStringContainsString('not_allowed', json_encode($this->call('upload')->messages));
+        $this->assertStringContainsString('not_allowed', json_encode($this->call('remove')->messages));
+
+        $this->loginAs('user');
+        $this->assertSame(0, (int) $this->call('upload')->result, 'a plain user is not an org admin');
+        $this->assertSame(0, (int) $this->call('remove')->result);
+    }
+
+    #[Test]
+    public function an_upload_with_no_file_is_rejected(): void
+    {
+        unset($_FILES['file']);
+        $res = $this->call('upload');
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('logo.error_upload', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function an_upload_with_a_non_uploaded_tmp_file_is_rejected(): void
+    {
+        $_FILES['file'] = ['name' => 'l.png', 'type' => 'image/png', 'tmp_name' => '/tmp/not-an-upload', 'error' => UPLOAD_ERR_OK, 'size' => 10];
+        $res = $this->call('upload');
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('logo.error_upload', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function remove_forgets_the_logo_option(): void
+    {
+        $opt = new Tiger_Model_Option();
+        $opt->set(Tiger_Model_Option::SCOPE_ORG, $this->orgId, Profile_Service_OrgLogo::OPTION_KEY, 'media-logo-1');
+        $this->assertSame('media-logo-1', $opt->get(Tiger_Model_Option::SCOPE_ORG, $this->orgId, Profile_Service_OrgLogo::OPTION_KEY));
+
+        $res = $this->call('remove');
+        $this->assertSame(1, (int) $res->result);
+        $this->assertStringContainsString('logo.removed', json_encode($res->messages));
+        $this->assertNull(
+            $opt->get(Tiger_Model_Option::SCOPE_ORG, $this->orgId, Profile_Service_OrgLogo::OPTION_KEY),
+            'the logo option is forgotten'
+        );
+    }
+}
diff --git a/tests/Integration/Profile/OrgServiceTest.php b/tests/Integration/Profile/OrgServiceTest.php
new file mode 100644
index 0000000..5f91755
--- /dev/null
+++ b/tests/Integration/Profile/OrgServiceTest.php
@@ -0,0 +1,140 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Profile;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Profile_Service_Org;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Org;
+use Zend_Registry;
+
+/**
+ * Profile_Service_Org — the admin-gated org Basic tab (/api).
+ *
+ * Wave-4 coverage: the deny-by-default admin gate (guest + plain user refused, admin cleared), a
+ * strictly-current-org save (never an org_id from the payload) that writes name + a slugified,
+ * uniqueness-checked slug, the slug-required guard (blank name AND slug), and the slug-taken guard
+ * (another org already owns the slug). The slug is derived by the service's own slugify rule.
+ */
+#[CoversClass(Profile_Service_Org::class)]
+final class OrgServiceTest extends IntegrationTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Profile_Service_Org(['action' => $action] + $params))->getResponse();
+    }
+
+    /** Seed an org and act as an admin signed into it. */
+    private function loginIntoNewOrg(array $orgData = []): string
+    {
+        $orgId = (new Tiger_Model_Org())->insert(['name' => 'Seed Org', 'slug' => 'seed-org-' . bin2hex(random_bytes(3))] + $orgData);
+        $this->login('admin-actor', $orgId, 'admin');
+        return $orgId;
+    }
+
+    // ----- ACL gate -----------------------------------------------------------------------------
+
+    #[Test]
+    public function guest_is_denied(): void
+    {
+        $this->login('anon', 'org-test', 'guest');
+        $res = $this->call('save', ['name' => 'X']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function a_plain_user_is_denied(): void
+    {
+        $this->loginAs('user');
+        $res = $this->call('save', ['name' => 'X']);
+        $this->assertSame(0, (int) $res->result, 'the org profile is admin-only');
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    // ----- save ---------------------------------------------------------------------------------
+
+    #[Test]
+    public function admin_saves_name_and_derives_the_slug_from_the_name(): void
+    {
+        $orgId = $this->loginIntoNewOrg();
+
+        $res = $this->call('save', ['name' => 'Acme Widgets, Inc.', 'slug' => '']);
+        $this->assertSame(1, (int) $res->result, 'a valid admin save succeeds');
+        $this->assertSame('acme-widgets-inc', $res->data['slug'], 'the slug is derived + slugified from the name');
+
+        $row = (new Tiger_Model_Org())->findById($orgId);
+        $this->assertSame('Acme Widgets, Inc.', $row->name);
+        $this->assertSame('acme-widgets-inc', $row->slug);
+    }
+
+    #[Test]
+    public function admin_saves_an_explicit_slug_slugified(): void
+    {
+        $orgId = $this->loginIntoNewOrg();
+        $res = $this->call('save', ['name' => 'Whatever', 'slug' => 'My Custom Slug!']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('my-custom-slug', $res->data['slug'], 'an explicit slug is slugified too');
+    }
+
+    #[Test]
+    public function a_name_and_slug_that_slugify_to_nothing_is_refused(): void
+    {
+        $orgId = $this->loginIntoNewOrg();
+        // name is required by the form, so give a symbol-only name that slugifies to '' with no slug.
+        $res = $this->call('save', ['name' => '!!!', 'slug' => '']);
+        $this->assertSame(0, (int) $res->result, 'an empty slug is refused');
+        $this->assertStringContainsString('slug_required', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function a_slug_owned_by_another_org_is_refused(): void
+    {
+        (new Tiger_Model_Org())->insert(['name' => 'Rival', 'slug' => 'contested']);
+        $orgId = $this->loginIntoNewOrg();
+
+        $res = $this->call('save', ['name' => 'Contested', 'slug' => 'contested']);
+        $this->assertSame(0, (int) $res->result, 'a slug taken by another org is refused');
+        $this->assertStringContainsString('slug_taken', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function an_org_may_keep_its_own_slug_on_re_save(): void
+    {
+        $orgId = (new Tiger_Model_Org())->insert(['name' => 'Keeper', 'slug' => 'keeper-co']);
+        $this->login('admin-actor', $orgId, 'admin');
+
+        // Re-saving the same slug excludes self from the uniqueness check → allowed.
+        $res = $this->call('save', ['name' => 'Keeper Renamed', 'slug' => 'keeper-co']);
+        $this->assertSame(1, (int) $res->result, 'an org keeps its own slug');
+        $row = (new Tiger_Model_Org())->findById($orgId);
+        $this->assertSame('Keeper Renamed', $row->name);
+        $this->assertSame('keeper-co', $row->slug);
+    }
+
+    #[Test]
+    public function an_empty_name_returns_form_errors(): void
+    {
+        $this->loginIntoNewOrg();
+        $res = $this->call('save', ['name' => '']);   // name is required
+        $this->assertSame(0, (int) $res->result);
+        $this->assertNotNull($res->form);
+        $this->assertArrayHasKey('name', $res->form);
+    }
+}
diff --git a/tests/Integration/Profile/SecurityServiceTest.php b/tests/Integration/Profile/SecurityServiceTest.php
new file mode 100644
index 0000000..2b18c5a
--- /dev/null
+++ b/tests/Integration/Profile/SecurityServiceTest.php
@@ -0,0 +1,108 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Profile;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Profile_Service_Security;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_User;
+use Tiger_Model_UserCredential;
+use Zend_Registry;
+
+/**
+ * Profile_Service_Security — the self-service change-password tab (/api).
+ *
+ * Wave-4 coverage: the self-scope gate (a guest with no identity is refused), the happy path (a
+ * logged-in user sets a new password with NO current-password step — the session is the authority —
+ * creating a `password` credential row), and the form guards (confirm must match; the policy
+ * validator rejects a weak password). History archival lives in Tiger_Model_UserCredential.
+ */
+#[CoversClass(Profile_Service_Security::class)]
+final class SecurityServiceTest extends IntegrationTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Profile_Service_Security(['action' => $action] + $params))->getResponse();
+    }
+
+    #[Test]
+    public function a_guest_with_no_identity_is_refused(): void
+    {
+        $res = $this->call('changePassword', ['new_password' => 'S3cure-P@ssw0rd-9x', 'confirm_password' => 'S3cure-P@ssw0rd-9x']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function a_logged_in_user_sets_a_new_password_creating_a_credential_row(): void
+    {
+        $id = (new Tiger_Model_User())->insert(['email' => 'pw@w4test.com', 'status' => 'active']);
+        $this->login($id, 'org-test', 'user');
+
+        $res = $this->call('changePassword', [
+            'new_password'     => 'S3cure-P@ssw0rd-9x',
+            'confirm_password' => 'S3cure-P@ssw0rd-9x',
+        ]);
+        $this->assertSame(1, (int) $res->result, 'a valid new password is accepted');
+        $this->assertStringContainsString('password_changed', json_encode($res->messages));
+
+        $count = (int) $this->db->fetchOne(
+            "SELECT COUNT(*) FROM user_credential WHERE user_id = ? AND type = 'password' AND deleted = 0",
+            [$id]
+        );
+        $this->assertSame(1, $count, 'a password credential row exists');
+
+        // And the stored hash verifies the plaintext (round-trip through the model).
+        $cred = new Tiger_Model_UserCredential();
+        $this->assertTrue($cred->verifyPassword($id, 'S3cure-P@ssw0rd-9x'), 'the new password verifies');
+    }
+
+    #[Test]
+    public function a_mismatched_confirmation_returns_form_errors(): void
+    {
+        $id = (new Tiger_Model_User())->insert(['email' => 'mm@w4test.com', 'status' => 'active']);
+        $this->login($id, 'org-test', 'user');
+
+        $res = $this->call('changePassword', [
+            'new_password'     => 'S3cure-P@ssw0rd-9x',
+            'confirm_password' => 'Different-P@ss-1234',
+        ]);
+        $this->assertSame(0, (int) $res->result, 'a mismatch is rejected');
+        $this->assertNotNull($res->form);
+        $this->assertArrayHasKey('confirm_password', $res->form);
+
+        $count = (int) $this->db->fetchOne(
+            "SELECT COUNT(*) FROM user_credential WHERE user_id = ? AND type = 'password'",
+            [$id]
+        );
+        $this->assertSame(0, $count, 'no credential written on a form error');
+    }
+
+    #[Test]
+    public function a_weak_password_is_rejected_by_the_policy_validator(): void
+    {
+        $id = (new Tiger_Model_User())->insert(['email' => 'weak@w4test.com', 'status' => 'active']);
+        $this->login($id, 'org-test', 'user');
+
+        $res = $this->call('changePassword', ['new_password' => 'abc', 'confirm_password' => 'abc']);
+        $this->assertSame(0, (int) $res->result, 'a weak password is rejected');
+        $this->assertNotNull($res->form);
+        $this->assertArrayHasKey('new_password', $res->form);
+    }
+}
diff --git a/tests/Integration/Profile/UserServiceTest.php b/tests/Integration/Profile/UserServiceTest.php
new file mode 100644
index 0000000..2f8de9d
--- /dev/null
+++ b/tests/Integration/Profile/UserServiceTest.php
@@ -0,0 +1,167 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Profile;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Profile_Service_User;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Option;
+use Tiger_Model_User;
+use Zend_Config;
+use Zend_Registry;
+
+/**
+ * Profile_Service_User — the self-service Basic-info tab (/api).
+ *
+ * Wave-4 coverage of the strictly-self-scoped identity save: it only ever writes the CURRENT
+ * identity ($this->_user_id) — a guest (no identity) is refused, a signed-in user writes `username`
+ * (unique, checked in the service), the two i18n primitives `locale`/`timezone` (membership-validated
+ * against config + IANA), and a friendly `display_name` in the per-user option tier (blank clears it).
+ * The savepoint-aware harness lets the service's own `_transaction()` nest, so the save is dispatched
+ * inline and the base rollback isolates it.
+ */
+#[CoversClass(Profile_Service_User::class)]
+final class UserServiceTest extends IntegrationTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);   // CSRF-immune API path (no session in CLI)
+        // The service resolves supported languages from config (tiger.i18n.locales); the base harness
+        // seeds no Zend_Config, so provide a minimal one (mirrors the Access UserServiceTest).
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => ['i18n' => ['locales' => 'en,es']]], true));
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    /** Dispatch the service with an action + payload and hand back the response object. */
+    private function call(string $action, array $params = []): object
+    {
+        return (new Profile_Service_User(['action' => $action] + $params))->getResponse();
+    }
+
+    // ----- self-scope gate ----------------------------------------------------------------------
+
+    #[Test]
+    public function a_guest_with_no_identity_is_refused(): void
+    {
+        // No login → no identity → _user_id is empty → not_allowed.
+        $res = $this->call('save', ['username' => 'nope']);
+        $this->assertSame(0, (int) $res->result, 'a guest cannot save a profile');
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    // ----- save (validate -> transaction) -------------------------------------------------------
+
+    #[Test]
+    public function save_writes_username_locale_and_timezone_to_the_identity_row(): void
+    {
+        $id = (new Tiger_Model_User())->insert(['email' => 'basic@w4test.com', 'status' => 'active']);
+        $this->login($id, 'org-test', 'user');
+
+        $res = $this->call('save', [
+            'username' => 'thundarr',
+            'locale'   => 'es',
+            'timezone' => 'America/New_York',
+        ]);
+
+        $this->assertSame(1, (int) $res->result, 'a valid self-save succeeds');
+        $this->assertSame('es', $res->data['locale'], 'the resolved locale is returned');
+
+        $row = (new Tiger_Model_User())->findById($id);
+        $this->assertSame('thundarr', $row->username);
+        $this->assertSame('es', $row->locale);
+        $this->assertSame('America/New_York', $row->timezone);
+    }
+
+    #[Test]
+    public function save_nulls_an_unsupported_locale_and_a_bogus_timezone(): void
+    {
+        $id = (new Tiger_Model_User())->insert(['email' => 'bogus@w4test.com', 'status' => 'active']);
+        $this->login($id, 'org-test', 'user');
+
+        $res = $this->call('save', [
+            'username' => 'ariel',
+            'locale'   => 'zz',                 // not in tiger.i18n.locales
+            'timezone' => 'Mars/Phobos',        // not an IANA identifier
+        ]);
+
+        $this->assertSame(1, (int) $res->result);
+        $this->assertNull($res->data['locale'], 'an unsupported locale resolves to null');
+
+        $row = (new Tiger_Model_User())->findById($id);
+        $this->assertNull($row->locale, 'the bogus locale is stored as NULL');
+        $this->assertNull($row->timezone, 'the bogus timezone is stored as NULL');
+    }
+
+    #[Test]
+    public function save_stores_and_clears_the_display_name_in_the_option_tier(): void
+    {
+        $id = (new Tiger_Model_User())->insert(['email' => 'dn@w4test.com', 'status' => 'active']);
+        $this->login($id, 'org-test', 'user');
+        $opt = new Tiger_Model_Option();
+
+        $this->call('save', ['username' => 'ookla', 'display_name' => 'Ookla the Mok']);
+        $this->assertSame(
+            'Ookla the Mok',
+            $opt->get(Tiger_Model_Option::SCOPE_USER, $id, Profile_Service_User::OPTION_DISPLAY_NAME),
+            'the display name is written to the per-user option tier'
+        );
+
+        // A blank display_name on a later save clears the option (UI falls back to email).
+        $res = $this->call('save', ['username' => 'ookla', 'display_name' => '']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('', $res->data['display_name']);
+        $this->assertNull(
+            $opt->get(Tiger_Model_Option::SCOPE_USER, $id, Profile_Service_User::OPTION_DISPLAY_NAME),
+            'a blank display name forgets the option'
+        );
+    }
+
+    #[Test]
+    public function save_clears_username_when_blank(): void
+    {
+        $id = (new Tiger_Model_User())->insert(['email' => 'clr@w4test.com', 'username' => 'oldname', 'status' => 'active']);
+        $this->login($id, 'org-test', 'user');
+
+        $res = $this->call('save', ['username' => '']);
+        $this->assertSame(1, (int) $res->result);
+        $row = (new Tiger_Model_User())->findById($id);
+        $this->assertNull($row->username, 'a blank username clears the column');
+    }
+
+    #[Test]
+    public function save_rejects_a_username_already_taken_by_another_user(): void
+    {
+        (new Tiger_Model_User())->insert(['email' => 'owner@w4test.com', 'username' => 'takenname', 'status' => 'active']);
+        $mine = (new Tiger_Model_User())->insert(['email' => 'me@w4test.com', 'status' => 'active']);
+        $this->login($mine, 'org-test', 'user');
+
+        $res = $this->call('save', ['username' => 'takenname']);
+        $this->assertSame(0, (int) $res->result, 'a duplicate username is refused');
+        $this->assertStringContainsString('username_taken', json_encode($res->messages));
+
+        $row = (new Tiger_Model_User())->findById($mine);
+        $this->assertNull($row->username, 'nothing was written on the taken-username path');
+    }
+
+    #[Test]
+    public function save_returns_form_errors_for_an_over_long_username(): void
+    {
+        $id = (new Tiger_Model_User())->insert(['email' => 'long@w4test.com', 'status' => 'active']);
+        $this->login($id, 'org-test', 'user');
+
+        $res = $this->call('save', ['username' => str_repeat('a', 65)]);   // > 64 char StringLength cap
+        $this->assertSame(0, (int) $res->result);
+        $this->assertNotNull($res->form, 'field errors returned');
+        $this->assertArrayHasKey('username', $res->form);
+    }
+}
diff --git a/tests/Integration/Schedule/ScheduleServiceTest.php b/tests/Integration/Schedule/ScheduleServiceTest.php
new file mode 100644
index 0000000..df2b154
--- /dev/null
+++ b/tests/Integration/Schedule/ScheduleServiceTest.php
@@ -0,0 +1,335 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Schedule;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use ReflectionClass;
+use Schedule_Service_Schedule;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Log;
+use Tiger_Model_ScheduleRun;
+use Tiger_Schedule;
+use Zend_Config;
+use Zend_Registry;
+
+// `Schedule_Service_Schedule` resolves via the harness module autoloader (tests/bootstrap.php).
+
+/**
+ * Tiger_Schedule (the reusable job scheduler + pseudo-cron) and Schedule_Service_Schedule (its /api).
+ *
+ * Two halves, both deterministic:
+ *   1. The DUE-CALCULATION engine — clock-anchored slots for every frequency, driven by FIXED
+ *      timestamps (the platform forbids Date.now-style nondeterminism), plus the config-override
+ *      `effective()`/`enabled()` merge. Pure logic, no wall clock.
+ *   2. The /api service — ACL (admin+, deny-by-default per modules/schedule/configs/acl.ini) plus
+ *      `jobs` (list + cron status), `setSchedule` (writes the config-tier overrides + validates
+ *      frequency/time), and `runNow` (fires a job, records a schedule_run row, surfaces failures).
+ *
+ * The Tiger_Schedule registry is process-static, so setUp resets it and marks discovery done (no
+ * module `schedule.ini` bleeds in) — each test registers exactly the jobs it asserts on.
+ */
+#[CoversClass(Schedule_Service_Schedule::class)]
+#[CoversClass(Tiger_Schedule::class)]
+final class ScheduleServiceTest extends IntegrationTestCase
+{
+    /** whatever Zend_Config was registered before this test (restored in tearDown). */
+    private ?Zend_Config $priorConfig = null;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        date_default_timezone_set('UTC');
+        $this->priorConfig = Zend_Registry::isRegistered('Zend_Config') ? Zend_Registry::get('Zend_Config') : null;
+        // Silence the log sink: the service logs schedule.rescheduled/ran/failed, which the strict
+        // output check would otherwise flag as printed output. A null writer keeps it quiet.
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => ['log' => ['writer' => 'null']]]));
+        Tiger_Log::reset();
+        $this->resetScheduleRegistry();
+    }
+
+    protected function tearDown(): void
+    {
+        $this->resetScheduleRegistry();
+        if ($this->priorConfig !== null) {
+            Zend_Registry::set('Zend_Config', $this->priorConfig);
+        } elseif (Zend_Registry::isRegistered('Zend_Config')) {
+            Zend_Registry::set('Zend_Config', new Zend_Config([]));
+        }
+        Tiger_Log::reset();
+        parent::tearDown();
+    }
+
+    /** Empty the static job registry and short-circuit discover() so only our jobs exist. */
+    private function resetScheduleRegistry(): void
+    {
+        // (PHP 8.1+ reflection ignores visibility, so no setAccessible() needed — and it's deprecated in 8.5.)
+        $ref = new ReflectionClass(Tiger_Schedule::class);
+        $ref->getProperty('_jobs')->setValue(null, []);
+        $ref->getProperty('_discovered')->setValue(null, true);   // pretend module schedule.ini scan already ran (none in the harness)
+    }
+
+    private function dispatch(array $msg): object
+    {
+        return (new Schedule_Service_Schedule($msg))->getResponse();
+    }
+
+    private function messages(object $res): string
+    {
+        return json_encode($res->messages ?? []);
+    }
+
+    private function job(array $over = []): array
+    {
+        return $over + ['key' => 'k', 'every' => 'daily', 'at' => '00:00', 'dow' => 1, 'dom' => 1];
+    }
+
+    // ---- due calculation (clock-anchored, fixed times) -------------------------------------------
+
+    #[Test]
+    public function sub_daily_slots_align_to_their_interval_and_are_at_or_before_now(): void
+    {
+        $now = strtotime('2026-07-15 14:37:20 UTC');
+
+        $this->assertSame(0, Tiger_Schedule::dueSlot($this->job(['every' => 'every_minute']), $now) % 60);
+        $this->assertSame(0, Tiger_Schedule::dueSlot($this->job(['every' => 'every_5_min']), $now) % 300);
+        $this->assertSame(0, Tiger_Schedule::dueSlot($this->job(['every' => 'every_15_min']), $now) % 900);
+
+        $hourly = Tiger_Schedule::dueSlot($this->job(['every' => 'hourly']), $now);
+        $this->assertSame('14:00:00', date('H:i:s', $hourly));
+
+        foreach (['every_minute', 'every_5_min', 'every_15_min', 'hourly'] as $f) {
+            $slot = Tiger_Schedule::dueSlot($this->job(['every' => $f]), $now);
+            $this->assertLessThanOrEqual($now, $slot, "$f slot is at or before now");
+        }
+    }
+
+    #[Test]
+    public function a_daily_slot_is_today_when_the_time_has_passed_and_yesterday_when_it_has_not(): void
+    {
+        $now = strtotime('2026-07-15 14:37:20 UTC');
+
+        // 02:30 already passed today → today's slot.
+        $passed = Tiger_Schedule::dueSlot($this->job(['every' => 'daily', 'at' => '02:30']), $now);
+        $this->assertSame('02:30', date('H:i', $passed));
+        $this->assertSame(date('Y-m-d', $now), date('Y-m-d', $passed));
+
+        // 20:00 not yet today → yesterday's slot (the most recent one at/before now).
+        $future = Tiger_Schedule::dueSlot($this->job(['every' => 'daily', 'at' => '20:00']), $now);
+        $this->assertSame('20:00', date('H:i', $future));
+        $this->assertSame(date('Y-m-d', $now - 86400), date('Y-m-d', $future));
+        $this->assertLessThan($now, $future);
+    }
+
+    #[Test]
+    public function weekly_and_monthly_slots_land_on_the_configured_dow_dom(): void
+    {
+        $now = strtotime('2026-07-15 14:37:20 UTC');   // a Wednesday (w=3)
+
+        $weekly = Tiger_Schedule::dueSlot($this->job(['every' => 'weekly', 'at' => '00:00', 'dow' => 1]), $now);
+        $this->assertSame('1', date('w', $weekly), 'lands on Monday (dow=1)');
+        $this->assertLessThanOrEqual($now, $weekly);
+
+        $monthly = Tiger_Schedule::dueSlot($this->job(['every' => 'monthly', 'at' => '00:00', 'dom' => 1]), $now);
+        $this->assertSame('01', date('d', $monthly), 'lands on the 1st (dom=1)');
+        $this->assertSame(date('Y-m', $now), date('Y-m', $monthly));
+    }
+
+    #[Test]
+    public function next_run_is_one_interval_after_the_due_slot_and_never_in_the_past(): void
+    {
+        $now = strtotime('2026-07-15 14:37:20 UTC');
+
+        foreach (['every_5_min', 'hourly', 'daily', 'weekly', 'monthly'] as $f) {
+            $job  = $this->job(['every' => $f, 'at' => '02:30']);
+            $slot = Tiger_Schedule::dueSlot($job, $now);
+            $next = Tiger_Schedule::nextRun($job, $now);
+            $this->assertGreaterThanOrEqual($now, $next, "$f next run is at/after now");
+            $this->assertGreaterThanOrEqual($slot, $next, "$f next run is at/after the due slot");
+        }
+    }
+
+    #[Test]
+    public function an_unknown_frequency_yields_no_slot(): void
+    {
+        $now = strtotime('2026-07-15 14:37:20 UTC');
+        $this->assertNull(Tiger_Schedule::dueSlot($this->job(['every' => 'nope']), $now));
+        $this->assertNull(Tiger_Schedule::nextRun($this->job(['every' => 'nope']), $now));
+    }
+
+    // ---- effective schedule + enabled (config-override merge) -------------------------------------
+
+    #[Test]
+    public function effective_merges_live_config_overrides_over_the_registered_defaults(): void
+    {
+        // A dotless key so the dot-notation config lookup (tiger.schedule.<key>.<field>) nests cleanly.
+        Tiger_Schedule::register(['key' => 'demojob', 'label' => 'Demo', 'run' => 'strlen', 'every' => 'daily', 'at' => '00:00']);
+        Zend_Registry::set('Zend_Config', new Zend_Config([
+            'tiger' => ['schedule' => ['demojob' => ['every' => 'weekly', 'at' => '05:45', 'dow' => 4]]],
+        ]));
+
+        $eff = Tiger_Schedule::effective(Tiger_Schedule::get('demojob'));
+        $this->assertSame('weekly', $eff['every']);
+        $this->assertSame('05:45', $eff['at']);
+        $this->assertSame(4, $eff['dow']);
+    }
+
+    #[Test]
+    public function enabled_defaults_to_the_registration_and_a_config_row_can_switch_it_off(): void
+    {
+        Tiger_Schedule::register(['key' => 'demojob', 'label' => 'Demo', 'run' => 'strlen', 'enabled' => true]);
+
+        Zend_Registry::set('Zend_Config', new Zend_Config([]));
+        $this->assertTrue(Tiger_Schedule::enabled('demojob'), 'the registered default (true) wins with no override');
+
+        Zend_Registry::set('Zend_Config', new Zend_Config([
+            'tiger' => ['schedule' => ['demojob' => ['enabled' => '0']]],
+        ]));
+        $this->assertFalse(Tiger_Schedule::enabled('demojob'), 'the config override switches it off');
+        $this->assertFalse(Tiger_Schedule::enabled('no.such.job'), 'an unknown job is not enabled');
+    }
+
+    // ---- ACL: admin+, deny-by-default ------------------------------------------------------------
+
+    #[Test]
+    public function the_shipped_acl_gates_the_scheduler_to_admin_and_up(): void
+    {
+        $this->loginAs('admin');
+        $acl = Zend_Registry::get('Zend_Acl');
+
+        $this->assertTrue($acl->has('Schedule_Service_Schedule'), 'the module acl.ini resource loaded');
+        $this->assertTrue($acl->isAllowed('admin', 'Schedule_Service_Schedule'));
+        $this->assertFalse($acl->isAllowed('user', 'Schedule_Service_Schedule'), 'a plain user is denied');
+        $this->assertFalse($acl->isAllowed('guest', 'Schedule_Service_Schedule'), 'a guest is denied');
+    }
+
+    #[Test]
+    public function a_guest_is_denied_every_scheduler_verb(): void
+    {
+        $this->login('anon', 'o-1', 'guest');
+        foreach (['jobs', 'setSchedule', 'runNow'] as $action) {
+            $res = $this->dispatch(['action' => $action, 'key' => 'x']);
+            $this->assertSame(0, (int) $res->result, "$action is denied to a guest");
+            $this->assertStringContainsString('not_allowed', $this->messages($res), "the ACL denial fired for $action");
+        }
+    }
+
+    // ---- jobs (list + cron status) ---------------------------------------------------------------
+
+    #[Test]
+    public function jobs_lists_every_registered_job_with_its_schedule_and_cron_status(): void
+    {
+        Tiger_Schedule::register(['key' => 'demo.job', 'label' => 'Demo Job', 'run' => 'strlen', 'every' => 'daily', 'at' => '01:15']);
+        $this->loginAs('admin');
+
+        $res = $this->dispatch(['action' => 'jobs']);
+        $this->assertSame(1, (int) $res->result);
+
+        $keys = array_column($res->data['jobs'], 'key');
+        $this->assertContains('demo.job', $keys);
+        $mine = $res->data['jobs'][array_search('demo.job', $keys, true)];
+        $this->assertSame('Demo Job', $mine['label']);
+        $this->assertSame('daily', $mine['every']);
+        $this->assertSame('01:15', $mine['at']);
+        $this->assertTrue($mine['enabled']);
+        $this->assertNull($mine['last'], 'a never-run job has no last-run record');
+        $this->assertIsInt($mine['next_run']);
+
+        $this->assertSame(Tiger_Schedule::FREQUENCIES, $res->data['frequencies']);
+        $this->assertArrayHasKey('pseudo_cron', $res->data);
+        $this->assertStringContainsString('schedule:run', $res->data['cron_command']);
+    }
+
+    // ---- setSchedule (the reusable "schedule this" writer + validation) --------------------------
+
+    #[Test]
+    public function set_schedule_writes_the_config_tier_overrides_for_one_job(): void
+    {
+        Tiger_Schedule::register(['key' => 'demo.job', 'label' => 'Demo', 'run' => 'strlen']);
+        $this->loginAs('admin');
+
+        $res = $this->dispatch([
+            'action' => 'setSchedule', 'key' => 'demo.job',
+            'every' => 'weekly', 'at' => '03:15', 'dow' => 5, 'dom' => 12, 'enabled' => 1,
+        ]);
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $cfg = new \Tiger_Model_Config();
+        $g   = \Tiger_Model_Config::SCOPE_GLOBAL;
+        $this->assertSame('weekly', $cfg->get($g, '', 'tiger.schedule.demo.job.every'));
+        $this->assertSame('03:15', $cfg->get($g, '', 'tiger.schedule.demo.job.at'));
+        $this->assertSame('5', $cfg->get($g, '', 'tiger.schedule.demo.job.dow'));
+        $this->assertSame('12', $cfg->get($g, '', 'tiger.schedule.demo.job.dom'));
+        $this->assertSame('1', $cfg->get($g, '', 'tiger.schedule.demo.job.enabled'));
+    }
+
+    #[Test]
+    public function set_schedule_rejects_an_unknown_job_and_bad_frequency_or_time(): void
+    {
+        Tiger_Schedule::register(['key' => 'demo.job', 'label' => 'Demo', 'run' => 'strlen']);
+        $this->loginAs('admin');
+
+        $unknown = $this->dispatch(['action' => 'setSchedule', 'key' => 'no.such.job', 'every' => 'daily']);
+        $this->assertSame(0, (int) $unknown->result);
+        $this->assertStringContainsString('unknown_job', $this->messages($unknown));
+
+        $badFreq = $this->dispatch(['action' => 'setSchedule', 'key' => 'demo.job', 'every' => 'fortnightly']);
+        $this->assertSame(0, (int) $badFreq->result);
+        $this->assertStringContainsString('bad_frequency', $this->messages($badFreq));
+
+        $badTime = $this->dispatch(['action' => 'setSchedule', 'key' => 'demo.job', 'at' => '99:99']);
+        $this->assertSame(0, (int) $badTime->result);
+        $this->assertStringContainsString('bad_time', $this->messages($badTime));
+    }
+
+    // ---- runNow (fire a job on demand) -----------------------------------------------------------
+
+    #[Test]
+    public function run_now_executes_the_job_and_records_a_schedule_run(): void
+    {
+        $GLOBALS['__tiger_test_ran'] = false;
+        Tiger_Schedule::register([
+            'key' => 'demo.job', 'label' => 'Demo', 'run' => function () { $GLOBALS['__tiger_test_ran'] = true; },
+        ]);
+        $this->loginAs('admin');
+
+        $res = $this->dispatch(['action' => 'runNow', 'key' => 'demo.job']);
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertTrue($GLOBALS['__tiger_test_ran'], 'the job callable actually ran');
+        $this->assertArrayHasKey('ms', (array) $res->data);
+
+        $last = (new Tiger_Model_ScheduleRun())->latestPerJob()['demo.job'] ?? null;
+        $this->assertNotNull($last, 'a schedule_run row was recorded');
+        $this->assertSame('ok', $last['outcome']);
+        unset($GLOBALS['__tiger_test_ran']);
+    }
+
+    #[Test]
+    public function run_now_reports_a_failing_job_as_an_error(): void
+    {
+        Tiger_Schedule::register([
+            'key' => 'demo.job', 'label' => 'Demo', 'run' => function () { throw new \RuntimeException('boom'); },
+        ]);
+        $this->loginAs('admin');
+
+        $res = $this->dispatch(['action' => 'runNow', 'key' => 'demo.job']);
+        $this->assertSame(0, (int) $res->result);
+        // non-production surfaces the reason; the run is still recorded as an error.
+        $this->assertStringContainsString('boom', $this->messages($res));
+
+        $last = (new Tiger_Model_ScheduleRun())->latestPerJob()['demo.job'] ?? null;
+        $this->assertNotNull($last);
+        $this->assertSame('error', $last['outcome']);
+    }
+
+    #[Test]
+    public function run_now_rejects_an_unknown_job(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatch(['action' => 'runNow', 'key' => 'no.such.job']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('unknown_job', $this->messages($res));
+    }
+}
diff --git a/tests/Integration/Search/SearchBootstrapTest.php b/tests/Integration/Search/SearchBootstrapTest.php
new file mode 100644
index 0000000..3834f5d
--- /dev/null
+++ b/tests/Integration/Search/SearchBootstrapTest.php
@@ -0,0 +1,55 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Search;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use ReflectionMethod;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Page;
+use Tiger_Search;
+
+/**
+ * Search_Bootstrap — registers the built-in "pages" search provider (CMS pages, so search works out
+ * of the box). Invoked directly (the harness doesn't boot module bootstraps); the provider closure
+ * is then run end-to-end through Tiger_Search::query() against a seeded published page.
+ */
+#[CoversClass(\Search_Bootstrap::class)]
+final class SearchBootstrapTest extends IntegrationTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        require_once TIGER_CORE_PATH . '/modules/search/Bootstrap.php';
+        Tiger_Search::reset();
+    }
+
+    protected function tearDown(): void
+    {
+        Tiger_Search::reset();
+        parent::tearDown();
+    }
+
+    #[Test]
+    public function it_registers_the_pages_provider_that_resolves_published_pages(): void
+    {
+        $inst = (new \ReflectionClass('Search_Bootstrap'))->newInstanceWithoutConstructor();
+        (new ReflectionMethod('Search_Bootstrap', '_initSearchProviders'))->invoke($inst);
+
+        $provider = Tiger_Search::get('pages');
+        $this->assertNotNull($provider, 'the pages provider is registered');
+        $this->assertSame('Pages', $provider['label']);
+
+        (new Tiger_Model_Page())->insert([
+            'type' => 'page', 'org_id' => '', 'locale' => 'en', 'title' => 'Encyclopedia Home',
+            'slug' => 'enc-home', 'page_key' => 'enc-home', 'body' => 'welcome to the encyclopedia',
+            'format' => 'html', 'status' => 'published', 'published_at' => '2023-01-01 00:00:00',
+        ]);
+
+        $res  = Tiger_Search::query('encyclopedia', ['role' => 'guest', 'orgId' => '', 'locale' => 'en', 'only' => ['pages']]);
+        $urls = array_column($res['results'], 'url');
+        $this->assertContains('/enc-home', $urls, 'the pages provider closure resolved the page to a /<slug> URL');
+    }
+}
diff --git a/tests/Integration/Search/SearchServiceTest.php b/tests/Integration/Search/SearchServiceTest.php
new file mode 100644
index 0000000..78bb4b0
--- /dev/null
+++ b/tests/Integration/Search/SearchServiceTest.php
@@ -0,0 +1,170 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Search;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use ReflectionMethod;
+use Search_Service_Search;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Page;
+use Tiger_Search;
+
+/**
+ * Search_Service_Search — the public /api behind the ⌘K launcher + /search, a thin guest-allowed
+ * wrapper over Tiger_Search::query() that fans out across registered providers.
+ *
+ * This also drives the two reference providers END TO END: it registers the built-in "pages"
+ * provider (Search_Bootstrap) and the blog "articles" provider (Blog_Bootstrap) through their REAL
+ * bootstrap methods, so the provider closures — each calling Tiger_Model_Page::search() — run for
+ * real against seeded content. Coverage spans: the empty-term short-circuit, grouped + flat-ranked
+ * fan-out, the `only[]` provider restriction, per-provider limit, that a guest only sees published
+ * in-scope content (drafts excluded), and the LIKE fallback for a short term FULLTEXT can't index.
+ */
+#[CoversClass(Search_Service_Search::class)]
+final class SearchServiceTest extends IntegrationTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Tiger_Search::reset();
+        $this->registerRealProviders();
+    }
+
+    protected function tearDown(): void
+    {
+        Tiger_Search::reset();
+        parent::tearDown();
+    }
+
+    /** Invoke the shipped bootstrap methods that register the pages + articles providers. */
+    private function registerRealProviders(): void
+    {
+        // The harness module autoloader resolves *_Service/*_Model/controllers, not *_Bootstrap — load them by path.
+        require_once TIGER_CORE_PATH . '/modules/search/Bootstrap.php';
+        require_once TIGER_CORE_PATH . '/modules/blog/Bootstrap.php';
+
+        foreach ([['Search_Bootstrap', '_initSearchProviders'], ['Blog_Bootstrap', '_initSearchProvider']] as [$class, $method]) {
+            $ref  = new \ReflectionClass($class);
+            $inst = $ref->newInstanceWithoutConstructor();
+            (new ReflectionMethod($class, $method))->invoke($inst);   // protected is invokable directly on PHP 8.1+
+        }
+    }
+
+    /** Dispatch the service and return the response object. */
+    private function call(array $params): object
+    {
+        return (new Search_Service_Search(['action' => 'query'] + $params))->getResponse();
+    }
+
+    private function seedPage(string $type, array $overrides): string
+    {
+        return (new Tiger_Model_Page())->insert(array_merge([
+            'type'         => $type,
+            'org_id'       => '',
+            'locale'       => 'en',
+            'title'        => 'Untitled',
+            'body'         => '',
+            'format'       => Tiger_Model_Page::FORMAT_HTML,
+            'status'       => Tiger_Model_Page::STATUS_PUBLISHED,
+            'published_at' => '2023-01-01 00:00:00',
+        ], $overrides));
+    }
+
+    // ----- the service ---------------------------------------------------------------------------
+
+    #[Test]
+    public function an_empty_term_short_circuits_to_zero_results(): void
+    {
+        $res = $this->call(['q' => '   ']);
+        $this->assertSame(1, (int) $res->result, 'guest-allowed, always a success envelope');
+        $this->assertSame(0, $res->data['total']);
+        $this->assertSame([], $res->data['groups']);
+        $this->assertSame([], $res->data['results']);
+    }
+
+    #[Test]
+    public function the_service_is_guest_allowed(): void
+    {
+        // No login → guest. A public search must still run (never a not_allowed refusal).
+        $res = $this->call(['q' => 'anything']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertStringNotContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function query_fans_out_across_pages_and_articles_grouped_and_flat(): void
+    {
+        $this->seedPage('page', ['title' => 'Encyclopedia Britannica', 'slug' => 'enc', 'page_key' => 'enc', 'body' => 'a reference work about encyclopedia topics']);
+        $this->seedPage('article', ['title' => 'My Encyclopedia Journey', 'slug' => 'journey', 'page_key' => 'journey', 'body' => 'writing an encyclopedia by hand']);
+
+        $res = $this->call(['q' => 'encyclopedia', 'limit' => 6]);
+        $data = $res->data;
+
+        $this->assertGreaterThanOrEqual(2, $data['total'], 'both a page and an article match');
+        $sources = array_column($data['groups'], 'key');
+        $this->assertContains('pages', $sources, 'the pages provider contributed');
+        $this->assertContains('articles', $sources, 'the articles provider contributed');
+
+        // flat results carry provider metadata + a blog url form for the article hit.
+        $urls = array_column($data['results'], 'url');
+        $this->assertContains('/blog/journey', $urls, 'article urls are /blog/<slug>');
+        $this->assertContains('/enc', $urls, 'page urls are /<slug>');
+    }
+
+    #[Test]
+    public function the_only_filter_restricts_to_a_single_provider(): void
+    {
+        $this->seedPage('page', ['title' => 'Widget Guide', 'slug' => 'wg', 'page_key' => 'wg', 'body' => 'all about the widget']);
+        $this->seedPage('article', ['title' => 'Widget News', 'slug' => 'wn', 'page_key' => 'wn', 'body' => 'the latest widget updates']);
+
+        $res = $this->call(['q' => 'widget', 'only' => ['articles']]);
+        $sources = array_column($res->data['groups'], 'key');
+        $this->assertSame(['articles'], $sources, 'only the articles provider ran');
+    }
+
+    #[Test]
+    public function a_guest_never_sees_a_draft(): void
+    {
+        $this->seedPage('article', ['title' => 'Secret Draft Memo', 'slug' => 'secret', 'page_key' => 'secret', 'body' => 'confidential memo text', 'status' => 'draft']);
+        $this->seedPage('article', ['title' => 'Public Memo', 'slug' => 'public', 'page_key' => 'public', 'body' => 'a published memo everyone can read']);
+
+        $titles = array_column($this->call(['q' => 'memo'])->data['results'], 'title');
+        $this->assertContains('Public Memo', $titles);
+        $this->assertNotContains('Secret Draft Memo', $titles, 'drafts are not surfaced to a guest');
+    }
+
+    #[Test]
+    public function a_short_term_uses_the_like_fallback(): void
+    {
+        // "cat" is below innodb_ft_min_token_size (4) so FULLTEXT indexes nothing → the LIKE branch runs.
+        $this->seedPage('page', ['title' => 'cat', 'slug' => 'cat', 'page_key' => 'cat', 'body' => 'a short word page']);
+
+        $titles = array_column($this->call(['q' => 'cat'])->data['results'], 'title');
+        $this->assertContains('cat', $titles, 'the LIKE fallback finds a short-term match FULLTEXT misses');
+    }
+
+    #[Test]
+    public function an_authenticated_requester_role_flows_to_the_providers(): void
+    {
+        // Signing in exercises _role()'s identity branch (vs the guest fallback). Content is public,
+        // so a user sees it too — the assertion is that the authenticated path runs without error.
+        $this->login('reader-1', 'org-test', 'user');
+        $this->seedPage('page', ['title' => 'Members Handbook', 'slug' => 'handbook', 'page_key' => 'handbook', 'body' => 'the members handbook content']);
+
+        $res = $this->call(['q' => 'handbook']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertGreaterThanOrEqual(1, $res->data['total'], 'the query ran under the authenticated role');
+    }
+
+    #[Test]
+    public function the_term_alias_field_is_accepted(): void
+    {
+        $this->seedPage('page', ['title' => 'Alias Term Page', 'slug' => 'alias', 'page_key' => 'alias', 'body' => 'searchable aliasterm content']);
+        // The service accepts `term` as an alias for `q`.
+        $res = $this->call(['term' => 'aliasterm']);
+        $this->assertGreaterThanOrEqual(1, $res->data['total'], 'the `term` alias drives the query');
+    }
+}
diff --git a/tests/Integration/Seo/BootstrapTest.php b/tests/Integration/Seo/BootstrapTest.php
new file mode 100644
index 0000000..2b554f2
--- /dev/null
+++ b/tests/Integration/Seo/BootstrapTest.php
@@ -0,0 +1,136 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Seo;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use ReflectionMethod;
+use ReflectionProperty;
+use Seo_Bootstrap;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Page;
+use Tiger_Routing_Overrides;
+use Tiger_Sitemap;
+use Zend_Controller_Front;
+
+/**
+ * Seo_Bootstrap — the module's boot hooks: register the head plugin, declare the public sitemap/robots/
+ * llms route overrides, and contribute the CMS pages provider to Tiger_Sitemap.
+ *
+ * The hooks touch only process-wide static registries (no $this state), so the tests invoke them on a
+ * constructor-less instance via reflection and assert the registration effects — including running the
+ * seeded `pages` provider closure against real page rows.
+ */
+#[CoversClass(Seo_Bootstrap::class)]
+final class BootstrapTest extends IntegrationTestCase
+{
+    public static function setUpBeforeClass(): void
+    {
+        // The bare `Seo_Bootstrap` isn't a typed module class, so the harness module autoloader (which
+        // only resolves controllers/services/forms/models/plugins) can't find it — require it directly.
+        if (!class_exists(Seo_Bootstrap::class, false)) {
+            require_once TIGER_CORE_PATH . '/modules/seo/Bootstrap.php';
+        }
+    }
+
+    private function bootstrap(): Seo_Bootstrap
+    {
+        // Skip Zend_Application_Module_Bootstrap's ctor (needs a parent app); the hooks don't use $this.
+        return (new \ReflectionClass(Seo_Bootstrap::class))->newInstanceWithoutConstructor();
+    }
+
+    private function invoke(string $method): void
+    {
+        $m = new ReflectionMethod(Seo_Bootstrap::class, $method);
+        $m->setAccessible(true);
+        $m->invoke($this->bootstrap());
+    }
+
+    private function resetProviders(): void
+    {
+        $p = new ReflectionProperty(Tiger_Sitemap::class, '_providers');
+        $p->setAccessible(true);
+        $p->setValue(null, []);
+    }
+
+    protected function tearDown(): void
+    {
+        $this->resetProviders();
+        Tiger_Routing_Overrides::clear();
+        Zend_Controller_Front::getInstance()->resetInstance();
+        parent::tearDown();
+    }
+
+    #[Test]
+    public function it_declares_the_three_public_route_overrides(): void
+    {
+        Tiger_Routing_Overrides::clear();
+        $this->invoke('_initSeoRoutes');
+
+        $all = Tiger_Routing_Overrides::all();
+        $patterns = array_map(static fn ($o) => $o['pattern'] ?? '', $all);
+        $this->assertContains('sitemap.xml', $patterns);
+        $this->assertContains('robots.txt', $patterns);
+        $this->assertContains('llms.txt', $patterns);
+    }
+
+    #[Test]
+    public function it_registers_the_head_front_controller_plugin(): void
+    {
+        $front = Zend_Controller_Front::getInstance();
+        $front->resetInstance();
+        $this->invoke('_initSeoHead');
+        $this->assertTrue($front->hasPlugin(\Seo_Plugin_Head::class), 'the head plugin is registered');
+    }
+
+    #[Test]
+    public function it_registers_a_pages_sitemap_provider(): void
+    {
+        $this->resetProviders();
+        $this->invoke('_initSeoSitemap');
+        $this->assertArrayHasKey('pages', Tiger_Sitemap::providers());
+    }
+
+    #[Test]
+    public function the_pages_provider_returns_published_cms_pages_with_titles_and_descriptions(): void
+    {
+        $this->loginAs('admin');
+        $page = new Tiger_Model_Page();
+        $page->insert([
+            'org_id'       => '',
+            'type'         => Tiger_Model_Page::TYPE_PAGE,
+            'locale'       => 'en',
+            'status'       => Tiger_Model_Page::STATUS_PUBLISHED,
+            'title'        => 'About Us',
+            'slug'         => 'about',
+            'body'         => '<p>hi</p>',
+            'meta'         => json_encode(['seo' => ['description' => 'All about us.']]),
+            'published_at' => null,
+        ]);
+        // A homepage (empty slug) must be skipped by the provider — the controller adds '/' itself.
+        $page->insert([
+            'org_id' => '',
+            'type'   => Tiger_Model_Page::TYPE_PAGE,
+            'locale' => 'en',
+            'status' => Tiger_Model_Page::STATUS_PUBLISHED,
+            'title'  => 'Home',
+            'slug'   => '',
+            'body'   => '',
+            'meta'   => '{}',
+        ]);
+
+        $this->resetProviders();
+        $this->invoke('_initSeoSitemap');
+        $provider = Tiger_Sitemap::providers()['pages'];
+        $urls = $provider(['locale' => 'en', 'orgId' => '']);
+
+        $byLoc = [];
+        foreach ($urls as $u) { $byLoc[$u['loc']] = $u; }
+        $this->assertArrayHasKey('/about', $byLoc, 'the published page is listed');
+        $this->assertSame('About Us', $byLoc['/about']['title']);
+        $this->assertSame('All about us.', $byLoc['/about']['desc'], 'desc pulled from meta.seo.description');
+        $this->assertArrayNotHasKey('/', $byLoc, 'the empty-slug homepage is skipped');
+    }
+}
diff --git a/tests/Integration/Seo/ControllersTest.php b/tests/Integration/Seo/ControllersTest.php
new file mode 100644
index 0000000..e6d2ce2
--- /dev/null
+++ b/tests/Integration/Seo/ControllersTest.php
@@ -0,0 +1,222 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Seo;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use ReflectionProperty;
+use Seo_LlmsController;
+use Seo_RobotsController;
+use Seo_SitemapController;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Sitemap;
+use Zend_Config;
+use Zend_Controller_Front;
+use Zend_Controller_Request_Http;
+use Zend_Controller_Response_Http;
+use Zend_Layout;
+use Zend_Registry;
+use Zend_View;
+
+/**
+ * The three PUBLIC TigerSEO controllers — /sitemap.xml, /robots.txt, /llms.txt — served as ROUTES (not
+ * docroot files). Each disables layout/render in init() and writes a plain-text/XML body.
+ *
+ * The tests stand up a minimal front-controller context (register the seo module's controller dir for
+ * the `default` module + Zend_Layout::startMvc()) so the real init() runs (layout + viewRenderer action
+ * helpers resolve), then call the action and read the response body. Sitemap/Llms read the shared
+ * `Tiger_Sitemap` provider registry, which the tests seed directly and reset per test.
+ */
+#[CoversClass(Seo_RobotsController::class)]
+#[CoversClass(Seo_SitemapController::class)]
+#[CoversClass(Seo_LlmsController::class)]
+final class ControllersTest extends IntegrationTestCase
+{
+    private bool $hadConfig = false;
+    private $priorConfig = null;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $view = new Zend_View();
+        $view->doctype('HTML5');
+        Zend_Registry::set('Zend_View', $view);
+
+        $front = Zend_Controller_Front::getInstance();
+        $front->addControllerDirectory(TIGER_CORE_PATH . '/modules/seo/controllers', 'default');
+        Zend_Layout::startMvc();
+
+        $this->hadConfig   = Zend_Registry::isRegistered('Zend_Config');
+        $this->priorConfig = $this->hadConfig ? Zend_Registry::get('Zend_Config') : null;
+
+        $this->resetProviders();
+        $this->resetSiteOrg();
+    }
+
+    protected function tearDown(): void
+    {
+        $this->resetProviders();
+        $this->resetSiteOrg();
+
+        Zend_Layout::resetMvcInstance();
+        Zend_Controller_Front::getInstance()->resetInstance();
+
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('Zend_View')) { $reg->offsetUnset('Zend_View'); }
+        if ($this->hadConfig) {
+            Zend_Registry::set('Zend_Config', $this->priorConfig);
+        } elseif ($reg->offsetExists('Zend_Config')) {
+            $reg->offsetUnset('Zend_Config');
+        }
+        parent::tearDown();
+    }
+
+    private function resetProviders(): void
+    {
+        $p = new ReflectionProperty(Tiger_Sitemap::class, '_providers');
+        $p->setAccessible(true);
+        $p->setValue(null, []);
+    }
+
+    private function resetSiteOrg(): void
+    {
+        $p = new ReflectionProperty(\Tiger_Model_Org::class, '_siteOrgId');
+        $p->setAccessible(true);
+        $p->setValue(null, null);
+    }
+
+    private function config(array $tiger): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => $tiger]));
+    }
+
+    private function request(string $uri = '/'): Zend_Controller_Request_Http
+    {
+        $_SERVER['HTTP_HOST'] = 'example.test';
+        $_SERVER['HTTPS']     = 'on';
+        $r = new Zend_Controller_Request_Http();
+        $r->setRequestUri($uri);
+        $r->setPathInfo($uri);
+        $r->setModuleName('default');
+        return $r;
+    }
+
+    private function dispatch(string $class, string $action): Zend_Controller_Response_Http
+    {
+        $res = new Zend_Controller_Response_Http();
+        $ctrl = new $class($this->request(), $res);
+        $ctrl->$action();
+        return $res;
+    }
+
+    // ----- robots.txt ---------------------------------------------------------------------------
+
+    #[Test]
+    public function robots_emits_the_default_disallow_list_and_the_sitemap_pointer(): void
+    {
+        $body = $this->dispatch(Seo_RobotsController::class, 'txtAction')->getBody();
+        $this->assertStringContainsString('User-agent: *', $body);
+        $this->assertStringContainsString('Disallow: /admin', $body);
+        $this->assertStringContainsString('Disallow: /api', $body);
+        $this->assertStringContainsString('Sitemap: https://example.test/sitemap.xml', $body);
+    }
+
+    #[Test]
+    public function robots_honors_a_configured_array_disallow_list(): void
+    {
+        $this->config(['seo' => ['robots' => ['disallow' => ['/private', '/secret']]]]);
+        $body = $this->dispatch(Seo_RobotsController::class, 'txtAction')->getBody();
+        $this->assertStringContainsString('Disallow: /private', $body);
+        $this->assertStringContainsString('Disallow: /secret', $body);
+        $this->assertStringNotContainsString('Disallow: /admin', $body, 'config overrides the defaults');
+    }
+
+    #[Test]
+    public function robots_honors_a_scalar_disallow_value(): void
+    {
+        $this->config(['seo' => ['robots' => ['disallow' => '/nope']]]);
+        $body = $this->dispatch(Seo_RobotsController::class, 'txtAction')->getBody();
+        $this->assertStringContainsString('Disallow: /nope', $body);
+    }
+
+    // ----- sitemap.xml --------------------------------------------------------------------------
+
+    #[Test]
+    public function sitemap_always_includes_the_homepage(): void
+    {
+        $body = $this->dispatch(Seo_SitemapController::class, 'xmlAction')->getBody();
+        $this->assertStringContainsString('<?xml version="1.0"', $body);
+        $this->assertStringContainsString('<urlset', $body);
+        $this->assertStringContainsString('<loc>https://example.test/</loc>', $body);
+    }
+
+    #[Test]
+    public function sitemap_absolutizes_provider_urls_and_emits_lastmod_and_priority(): void
+    {
+        Tiger_Sitemap::register('pages', static function () {
+            return [
+                ['loc' => '/about', 'lastmod' => '2026-05-06 07:08:09', 'priority' => 0.8],
+                ['loc' => '/contact', 'lastmod' => null, 'changefreq' => 'weekly'],
+            ];
+        });
+        $body = $this->dispatch(Seo_SitemapController::class, 'xmlAction')->getBody();
+        $this->assertStringContainsString('<loc>https://example.test/about</loc>', $body);
+        $this->assertStringContainsString('<lastmod>2026-05-06', $body);
+        $this->assertStringContainsString('<priority>0.8</priority>', $body);
+        $this->assertStringContainsString('<changefreq>weekly</changefreq>', $body);
+        $this->assertStringContainsString('<loc>https://example.test/contact</loc>', $body);
+    }
+
+    #[Test]
+    public function sitemap_keeps_an_already_absolute_loc_as_is(): void
+    {
+        Tiger_Sitemap::register('ext', static function () {
+            return [['loc' => 'https://cdn.example.test/page', 'lastmod' => null]];
+        });
+        $body = $this->dispatch(Seo_SitemapController::class, 'xmlAction')->getBody();
+        $this->assertStringContainsString('<loc>https://cdn.example.test/page</loc>', $body);
+    }
+
+    // ----- llms.txt -----------------------------------------------------------------------------
+
+    #[Test]
+    public function llms_emits_a_markdown_map_with_a_section_per_provider(): void
+    {
+        $this->config(['site' => ['name' => 'Acme Books', 'tagline' => 'We publish.']]);
+        Tiger_Sitemap::register('blog', static function () {
+            return [
+                ['loc' => '/blog/hello', 'title' => 'Hello World', 'desc' => 'A first post'],
+                ['loc' => '/blog/again', 'title' => 'Again', 'desc' => ''],
+            ];
+        });
+        $body = $this->dispatch(Seo_LlmsController::class, 'txtAction')->getBody();
+        $this->assertStringContainsString('# Acme Books', $body);
+        $this->assertStringContainsString('> We publish.', $body);
+        $this->assertStringContainsString('## Blog', $body, 'provider key humanized into a section heading');
+        $this->assertStringContainsString('[Hello World](https://example.test/blog/hello): A first post', $body);
+        $this->assertStringContainsString('[Again](https://example.test/blog/again)', $body);
+    }
+
+    #[Test]
+    public function llms_surfaces_a_configured_featured_doc(): void
+    {
+        $this->config([
+            'site' => ['name' => 'Acme'],
+            'seo'  => ['llms' => ['doc_url' => 'https://acme.test/why', 'doc_label' => 'Why Acme', 'doc_desc' => 'The pitch']],
+        ]);
+        $body = $this->dispatch(Seo_LlmsController::class, 'txtAction')->getBody();
+        $this->assertStringContainsString('## For AI agents', $body);
+        $this->assertStringContainsString('[Why Acme](https://acme.test/why): The pitch', $body);
+    }
+
+    #[Test]
+    public function llms_returns_404_when_disabled(): void
+    {
+        $this->config(['seo' => ['llms' => ['enabled' => '0']]]);
+        $this->expectException(\Zend_Controller_Action_Exception::class);
+        $this->dispatch(Seo_LlmsController::class, 'txtAction');
+    }
+}
diff --git a/tests/Integration/Seo/HeadServiceTest.php b/tests/Integration/Seo/HeadServiceTest.php
new file mode 100644
index 0000000..67e507c
--- /dev/null
+++ b/tests/Integration/Seo/HeadServiceTest.php
@@ -0,0 +1,286 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Seo;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Seo_Service_Head;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Media;
+use Zend_Config;
+use Zend_Controller_Request_Http;
+use Zend_Registry;
+use Zend_View;
+
+/**
+ * Seo_Service_Head — the resolver that maps a page row's `meta.seo` onto the shared head registry
+ * (TigerZF's headTitle/headMeta/headLink placeholders the layout renders).
+ *
+ * It never renders markup — it appends typed entries to the process-wide Zend_View. So the tests seed
+ * a Zend_View (HTML5 doctype, so `og:` property meta is valid — the same doctype the live layout sets)
+ * into the registry, call forRow(page, request, overrides), then read the head helpers back as strings
+ * and assert the emitted tags. Coverage: title override, description, robots (index/follow → noindex/
+ * nofollow), canonical (explicit + self-referencing), Open Graph + Twitter, og:image by absolute URL
+ * and by media id (real dimensions), article times, and the overrides-fill-blanks-only rule.
+ */
+#[CoversClass(Seo_Service_Head::class)]
+final class HeadServiceTest extends IntegrationTestCase
+{
+    private ?Zend_View $view = null;
+    private bool $hadConfig = false;
+    private $priorConfig = null;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // A fresh view with an HTML5 doctype (og:* property meta is invalid otherwise — the live layout
+        // sets HTML5). Any Zend_View instance shares the process-wide placeholder registry, so this IS
+        // the container the service writes into.
+        $this->view = new Zend_View();
+        $this->view->doctype('HTML5');
+        Zend_Registry::set('Zend_View', $this->view);
+
+        // Head/placeholder containers are process-wide (shared across view instances) — clear them so a
+        // prior test's tags don't bleed into this one.
+        $this->view->headTitle()->getContainer()->exchangeArray([]);
+        $this->view->headMeta()->getContainer()->exchangeArray([]);
+        $this->view->headLink()->getContainer()->exchangeArray([]);
+
+        $this->hadConfig   = Zend_Registry::isRegistered('Zend_Config');
+        $this->priorConfig = $this->hadConfig ? Zend_Registry::get('Zend_Config') : null;
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('Zend_View'))   { $reg->offsetUnset('Zend_View'); }
+        if ($this->hadConfig) {
+            Zend_Registry::set('Zend_Config', $this->priorConfig);
+        } elseif ($reg->offsetExists('Zend_Config')) {
+            $reg->offsetUnset('Zend_Config');
+        }
+        parent::tearDown();
+    }
+
+    /** Register the runtime config the service reads (tiger.*). */
+    private function config(array $tiger): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => $tiger]));
+    }
+
+    /** A page row as a plain object carrying a JSON `meta` (what a Zend_Db_Table_Row looks like to the service). */
+    private function page(array $seo, array $extra = []): object
+    {
+        $meta = $seo ? ['seo' => $seo] : [];
+        return (object) array_merge(['meta' => json_encode($meta), 'title' => 'Row Title', 'type' => 'page'], $extra);
+    }
+
+    /** A request whose scheme/host/uri drive the self-referencing canonical + og:url. */
+    private function request(string $uri = '/hello'): Zend_Controller_Request_Http
+    {
+        $_SERVER['HTTP_HOST'] = 'example.test';
+        $_SERVER['HTTPS']     = 'on';
+        $r = new Zend_Controller_Request_Http();
+        $r->setRequestUri($uri);
+        return $r;
+    }
+
+    private function head(): string
+    {
+        return $this->view->headTitle()->toString() . "\n"
+             . $this->view->headMeta()->toString() . "\n"
+             . $this->view->headLink()->toString();
+    }
+
+    // ----- null / empty guards ------------------------------------------------------------------
+
+    #[Test]
+    public function a_null_page_emits_nothing(): void
+    {
+        Seo_Service_Head::forRow(null);
+        $this->assertSame('', trim($this->view->headMeta()->toString()));
+    }
+
+    #[Test]
+    public function a_page_with_no_seo_still_emits_og_type_and_twitter_card(): void
+    {
+        $this->config(['site' => ['name' => 'Acme']]);
+        Seo_Service_Head::forRow($this->page([]), $this->request());
+        $head = $this->head();
+        $this->assertStringContainsString('og:type', $head);
+        $this->assertStringContainsString('website', $head);
+        $this->assertStringContainsString('twitter:card', $head);
+        $this->assertStringContainsString('summary', $head, 'no image → plain summary card');
+        $this->assertStringContainsString('og:site_name', $head, 'site name from config');
+        $this->assertStringContainsString('Acme', $head);
+    }
+
+    // ----- title / description / robots ---------------------------------------------------------
+
+    #[Test]
+    public function an_seo_title_overrides_the_page_title(): void
+    {
+        Seo_Service_Head::forRow($this->page(['title' => 'Custom SEO Title']), $this->request());
+        $this->assertStringContainsString('Custom SEO Title', $this->view->headTitle()->toString());
+        $this->assertStringContainsString('og:title', $this->view->headMeta()->toString());
+    }
+
+    #[Test]
+    public function a_description_emits_meta_description_and_og_description(): void
+    {
+        Seo_Service_Head::forRow($this->page(['description' => 'A fine page.']), $this->request());
+        $meta = $this->view->headMeta()->toString();
+        $this->assertStringContainsString('name="description"', $meta);
+        $this->assertStringContainsString('A fine page.', $meta);
+        $this->assertStringContainsString('og:description', $meta);
+    }
+
+    #[Test]
+    public function robots_directive_is_emitted_only_when_restricted(): void
+    {
+        // index+follow (the default) → NO robots tag.
+        Seo_Service_Head::forRow($this->page(['robots' => ['index' => true, 'follow' => true]]), $this->request());
+        $this->assertStringNotContainsString('name="robots"', $this->view->headMeta()->toString());
+    }
+
+    #[Test]
+    public function noindex_nofollow_emit_a_robots_tag(): void
+    {
+        Seo_Service_Head::forRow($this->page(['robots' => ['index' => false, 'follow' => false]]), $this->request());
+        $meta = $this->view->headMeta()->toString();
+        $this->assertStringContainsString('name="robots"', $meta);
+        $this->assertStringContainsString('noindex', $meta);
+        $this->assertStringContainsString('nofollow', $meta);
+    }
+
+    // ----- canonical ----------------------------------------------------------------------------
+
+    #[Test]
+    public function an_explicit_canonical_wins(): void
+    {
+        Seo_Service_Head::forRow($this->page(['canonical' => 'https://canonical.test/page']), $this->request('/other'));
+        $link = $this->view->headLink()->toString();
+        $this->assertStringContainsString('rel="canonical"', $link);
+        $this->assertStringContainsString('https://canonical.test/page', $link);
+    }
+
+    #[Test]
+    public function a_missing_canonical_self_references_the_request_path(): void
+    {
+        Seo_Service_Head::forRow($this->page([]), $this->request('/blog/hello?utm=x'));
+        $link = $this->view->headLink()->toString();
+        $this->assertStringContainsString('https://example.test/blog/hello', $link, 'path only, query dropped');
+        $this->assertStringNotContainsString('utm=x', $link);
+    }
+
+    // ----- Open Graph + article -----------------------------------------------------------------
+
+    #[Test]
+    public function an_article_page_emits_og_type_article_and_times(): void
+    {
+        $page = $this->page(
+            ['title' => 'My Article'],
+            ['type' => 'article', 'published_at' => '2026-01-02 03:04:05', 'updated_at' => '2026-02-03 04:05:06']
+        );
+        Seo_Service_Head::forRow($page, $this->request('/blog/my-article'));
+        $meta = $this->view->headMeta()->toString();
+        $this->assertStringContainsString('article', $meta);
+        $this->assertStringContainsString('article:published_time', $meta);
+        $this->assertStringContainsString('article:modified_time', $meta);
+        $this->assertStringContainsString('2026', $meta);
+    }
+
+    // ----- og:image -----------------------------------------------------------------------------
+
+    #[Test]
+    public function an_absolute_og_image_url_is_used_and_earns_the_large_card(): void
+    {
+        Seo_Service_Head::forRow(
+            $this->page(['og_image_id' => 'https://cdn.test/share.png']),
+            $this->request()
+        );
+        $meta = $this->view->headMeta()->toString();
+        $this->assertStringContainsString('og:image', $meta);
+        $this->assertStringContainsString('https://cdn.test/share.png', $meta);
+        $this->assertStringContainsString('summary_large_image', $meta, 'a resolved image → large card');
+    }
+
+    #[Test]
+    public function the_site_wide_fallback_og_image_is_used_when_the_page_has_none(): void
+    {
+        $this->config(['seo' => ['og_image' => 'https://cdn.test/default.png']]);
+        Seo_Service_Head::forRow($this->page([]), $this->request());
+        $this->assertStringContainsString('https://cdn.test/default.png', $this->view->headMeta()->toString());
+    }
+
+    #[Test]
+    public function an_og_image_by_media_id_resolves_dimensions_and_mime(): void
+    {
+        $this->loginAs('admin');   // so the media insert carries an actor/org
+        $mediaId = (new Tiger_Model_Media())->insert([
+            'org_id'      => 'org-test',
+            'filename'    => 'hero.jpg',
+            'mime_type'   => 'image/jpeg',
+            'storage_key' => 'seo/hero.jpg',
+            'disk'        => 'local',
+            'kind'        => 'image',
+            'width'       => 1200,
+            'height'      => 630,
+            'alt_text'    => 'A hero image',
+        ]);
+
+        Seo_Service_Head::forRow($this->page(['og_image_id' => $mediaId]), $this->request());
+        $meta = $this->view->headMeta()->toString();
+        $this->assertStringContainsString('og:image', $meta);
+        $this->assertStringContainsString('og:image:width', $meta);
+        $this->assertStringContainsString('1200', $meta);
+        $this->assertStringContainsString('og:image:height', $meta);
+        $this->assertStringContainsString('630', $meta);
+        $this->assertStringContainsString('og:image:type', $meta);
+        $this->assertStringContainsString('image/jpeg', $meta);
+        $this->assertStringContainsString('A hero image', $meta, 'alt from the media row');
+        // A relative storage URL is absolutized against the request host.
+        $this->assertStringContainsString('example.test', $meta);
+    }
+
+    #[Test]
+    public function an_unresolvable_media_og_image_is_omitted(): void
+    {
+        // A media id that doesn't resolve → no og:image, and the plain (not large) twitter card.
+        Seo_Service_Head::forRow($this->page(['og_image_id' => 'no-such-media-id']), $this->request());
+        $meta = $this->view->headMeta()->toString();
+        $this->assertStringNotContainsString('og:image', $meta);
+        $this->assertStringContainsString('summary', $meta);
+        $this->assertStringNotContainsString('summary_large_image', $meta);
+    }
+
+    #[Test]
+    public function without_a_request_no_canonical_or_og_url_is_emitted(): void
+    {
+        Seo_Service_Head::forRow($this->page(['title' => 'No Request']));
+        $this->assertStringNotContainsString('rel="canonical"', $this->view->headLink()->toString());
+        $this->assertStringNotContainsString('og:url', $this->view->headMeta()->toString());
+        $this->assertStringContainsString('og:title', $this->view->headMeta()->toString(), 'the rest still emits');
+    }
+
+    // ----- overrides fill blanks only -----------------------------------------------------------
+
+    #[Test]
+    public function overrides_fill_only_blank_seo_fields(): void
+    {
+        // Author set a description; the caller override (an excerpt) must NOT replace it.
+        Seo_Service_Head::forRow(
+            $this->page(['description' => 'Author description']),
+            $this->request(),
+            ['description' => 'Excerpt fallback', 'title' => 'Fallback Title']
+        );
+        $meta  = $this->view->headMeta()->toString();
+        $title = $this->view->headTitle()->toString();
+        $this->assertStringContainsString('Author description', $meta, 'author value kept');
+        $this->assertStringNotContainsString('Excerpt fallback', $meta, 'override did not overwrite a set value');
+        $this->assertStringContainsString('Fallback Title', $title, 'override filled the blank title');
+    }
+}
diff --git a/tests/Integration/Seo/SchemaServiceTest.php b/tests/Integration/Seo/SchemaServiceTest.php
new file mode 100644
index 0000000..d7acb9c
--- /dev/null
+++ b/tests/Integration/Seo/SchemaServiceTest.php
@@ -0,0 +1,320 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Seo;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use ReflectionProperty;
+use Seo_Service_Schema;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Menu;
+use Zend_Config;
+use Zend_Controller_Request_Http;
+use Zend_Registry;
+use Zend_View;
+
+/**
+ * Seo_Service_Schema — the JSON-LD (schema.org) contributor. Where Seo_Service_Head describes ONE page,
+ * this describes the SITE as an entity (Organization + WebSite + SiteNavigationElement) plus per-page
+ * BreadcrumbList and per-article BlogPosting nodes. It appends a `<script type="application/ld+json">`
+ * to the process-wide `tigerJsonLd` placeholder.
+ *
+ * The tests read that placeholder back, extract the JSON from the <script>, decode the `@graph`, and
+ * assert node shapes. The emit-once latch ($_emitted) is reset per test via reflection.
+ */
+#[CoversClass(Seo_Service_Schema::class)]
+final class SchemaServiceTest extends IntegrationTestCase
+{
+    private ?Zend_View $view = null;
+    private bool $hadConfig = false;
+    private $priorConfig = null;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->view = new Zend_View();
+        $this->view->doctype('HTML5');
+        Zend_Registry::set('Zend_View', $this->view);
+
+        // Placeholder containers are process-wide (shared across view instances) — clear the JSON-LD
+        // container so a prior test's nodes don't bleed into this one.
+        $this->view->placeholder('tigerJsonLd')->exchangeArray([]);
+
+        $this->hadConfig   = Zend_Registry::isRegistered('Zend_Config');
+        $this->priorConfig = $this->hadConfig ? Zend_Registry::get('Zend_Config') : null;
+
+        $this->resetLatch();
+    }
+
+    protected function tearDown(): void
+    {
+        $this->resetLatch();
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('Zend_View')) { $reg->offsetUnset('Zend_View'); }
+        if ($this->hadConfig) {
+            Zend_Registry::set('Zend_Config', $this->priorConfig);
+        } elseif ($reg->offsetExists('Zend_Config')) {
+            $reg->offsetUnset('Zend_Config');
+        }
+        parent::tearDown();
+    }
+
+    private function resetLatch(): void
+    {
+        $p = new ReflectionProperty(Seo_Service_Schema::class, '_emitted');
+        $p->setAccessible(true);
+        $p->setValue(null, false);
+    }
+
+    private function config(array $tiger): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => $tiger]));
+    }
+
+    private function request(string $uri = '/'): Zend_Controller_Request_Http
+    {
+        $_SERVER['HTTP_HOST'] = 'example.test';
+        $_SERVER['HTTPS']     = 'on';
+        $r = new Zend_Controller_Request_Http();
+        $r->setRequestUri($uri);
+        $r->setPathInfo($uri);
+        return $r;
+    }
+
+    /** All decoded @graph nodes appended so far (across every emitted <script>). */
+    private function nodes(): array
+    {
+        $raw = (string) $this->view->placeholder('tigerJsonLd');
+        $out = [];
+        if (preg_match_all('#<script[^>]*>(.*?)</script>#s', $raw, $m)) {
+            foreach ($m[1] as $json) {
+                $data = json_decode($json, true);
+                if (isset($data['@graph'])) {
+                    foreach ($data['@graph'] as $n) { $out[] = $n; }
+                }
+            }
+        }
+        return $out;
+    }
+
+    private function nodeOfType(string $type): ?array
+    {
+        foreach ($this->nodes() as $n) {
+            if (($n['@type'] ?? '') === $type) { return $n; }
+        }
+        return null;
+    }
+
+    // ----- emitSite -----------------------------------------------------------------------------
+
+    #[Test]
+    public function emit_site_builds_organization_and_website_nodes(): void
+    {
+        $this->config(['site' => ['name' => 'Acme Books', 'description' => 'We publish.']]);
+        Seo_Service_Schema::emitSite($this->request('/'));
+
+        $org = $this->nodeOfType('Organization');
+        $this->assertNotNull($org, 'Organization node emitted');
+        $this->assertSame('Acme Books', $org['name']);
+        $this->assertSame('https://example.test/#organization', $org['@id']);
+        $this->assertSame('We publish.', $org['description']);
+
+        $site = $this->nodeOfType('WebSite');
+        $this->assertNotNull($site, 'WebSite node emitted');
+        $this->assertSame('https://example.test/#website', $site['@id']);
+        $this->assertSame(['@id' => 'https://example.test/#organization'], $site['publisher']);
+    }
+
+    #[Test]
+    public function emit_site_is_latched_to_once_per_request(): void
+    {
+        $this->config(['site' => ['name' => 'Acme']]);
+        Seo_Service_Schema::emitSite($this->request('/'));
+        Seo_Service_Schema::emitSite($this->request('/'));   // second call is a no-op
+
+        $orgs = array_filter($this->nodes(), static fn ($n) => ($n['@type'] ?? '') === 'Organization');
+        $this->assertCount(1, $orgs, 'the site graph renders a single time');
+    }
+
+    #[Test]
+    public function organization_carries_sameas_social_links_from_config(): void
+    {
+        $this->config([
+            'site' => ['name' => 'Acme'],
+            'seo'  => ['social' => ['twitter' => 'https://x.com/acme', 'github' => 'https://github.com/acme']],
+        ]);
+        Seo_Service_Schema::emitSite($this->request('/'));
+        $org = $this->nodeOfType('Organization');
+        $this->assertContains('https://x.com/acme', $org['sameAs']);
+        $this->assertContains('https://github.com/acme', $org['sameAs']);
+    }
+
+    #[Test]
+    public function website_gets_a_search_action_when_a_search_url_is_configured(): void
+    {
+        $this->config([
+            'site' => ['name' => 'Acme'],
+            'seo'  => ['schema' => ['search_url' => '/search?q={search_term_string}']],
+        ]);
+        Seo_Service_Schema::emitSite($this->request('/'));
+        $site = $this->nodeOfType('WebSite');
+        $this->assertArrayHasKey('potentialAction', $site);
+        $this->assertSame('SearchAction', $site['potentialAction']['@type']);
+        $this->assertStringContainsString('https://example.test/search?q={search_term_string}', $site['potentialAction']['target']['urlTemplate']);
+    }
+
+    #[Test]
+    public function organization_carries_a_logo_when_configured(): void
+    {
+        $this->config(['site' => ['name' => 'Acme', 'logo' => 'https://cdn.test/logo.png']]);
+        Seo_Service_Schema::emitSite($this->request('/'));
+        $org = $this->nodeOfType('Organization');
+        $this->assertArrayHasKey('logo', $org);
+        $this->assertSame('ImageObject', $org['logo']['@type']);
+        $this->assertSame('https://cdn.test/logo.png', $org['logo']['url']);
+    }
+
+    #[Test]
+    public function nav_skips_heading_and_placeholder_items(): void
+    {
+        $menu = new Tiger_Model_Menu();
+        // A real link, a heading (no url), and a dead placeholder (#) — only the real link survives.
+        $menu->insert(['org_id' => '', 'menu_key' => 'primary', 'parent_id' => null, 'sort_order' => 0, 'label' => 'Docs',    'url' => '/docs', 'status' => Tiger_Model_Menu::STATUS_PUBLISHED]);
+        $menu->insert(['org_id' => '', 'menu_key' => 'primary', 'parent_id' => null, 'sort_order' => 1, 'label' => 'Heading', 'url' => '',      'status' => Tiger_Model_Menu::STATUS_PUBLISHED]);
+        $menu->insert(['org_id' => '', 'menu_key' => 'primary', 'parent_id' => null, 'sort_order' => 2, 'label' => 'Dead',    'url' => '#',     'status' => Tiger_Model_Menu::STATUS_PUBLISHED]);
+
+        $this->config(['site' => ['name' => 'Acme']]);
+        Seo_Service_Schema::emitSite($this->request('/'));
+
+        $nav = $this->nodeOfType('SiteNavigationElement');
+        $this->assertSame(['Docs'], $nav['name'], 'only the real link is a nav element');
+    }
+
+    #[Test]
+    public function emit_site_uses_the_configured_base_url_when_there_is_no_request(): void
+    {
+        $this->config(['site' => ['name' => 'Acme', 'url' => 'https://configured.test/']]);
+        Seo_Service_Schema::emitSite(null);   // no request → base derives from tiger.site.url
+        $org = $this->nodeOfType('Organization');
+        $this->assertSame('https://configured.test/#organization', $org['@id']);
+    }
+
+    #[Test]
+    public function emit_article_resolves_a_feature_image(): void
+    {
+        $this->config(['site' => ['name' => 'Acme']]);
+        Seo_Service_Schema::emitArticle(
+            (object) ['updated_at' => '2026-06-01 00:00:00'],
+            [
+                'title'        => 'Illustrated',
+                'slug'         => 'illustrated',
+                'excerpt'      => 'With a picture.',
+                'published_at' => '2026-05-20 00:00:00',
+                'feature'      => ['id' => 'https://cdn.test/feature.png'],
+            ],
+            $this->request('/blog/illustrated')
+        );
+        $post = $this->nodeOfType('BlogPosting');
+        $this->assertArrayHasKey('image', $post);
+        $this->assertSame('https://cdn.test/feature.png', $post['image']['url']);
+    }
+
+    #[Test]
+    public function a_default_site_name_is_used_when_config_is_absent(): void
+    {
+        // No config registered → the neutral 'Tiger' fallback keeps the brand node from being nameless.
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('Zend_Config')) { $reg->offsetUnset('Zend_Config'); }
+        Seo_Service_Schema::emitSite($this->request('/'));
+        $this->assertSame('Tiger', $this->nodeOfType('Organization')['name']);
+    }
+
+    #[Test]
+    public function the_primary_menu_becomes_a_site_navigation_element(): void
+    {
+        // Seed two global top-level nav items; the site-org fallback picks up global rows.
+        $menu = new Tiger_Model_Menu();
+        $menu->insert(['org_id' => '', 'menu_key' => 'primary', 'parent_id' => null, 'sort_order' => 0, 'label' => 'Home',  'url' => '/',      'status' => Tiger_Model_Menu::STATUS_PUBLISHED]);
+        $menu->insert(['org_id' => '', 'menu_key' => 'primary', 'parent_id' => null, 'sort_order' => 1, 'label' => 'About', 'url' => '/about', 'status' => Tiger_Model_Menu::STATUS_PUBLISHED]);
+
+        $this->config(['site' => ['name' => 'Acme']]);
+        Seo_Service_Schema::emitSite($this->request('/'));
+
+        $nav = $this->nodeOfType('SiteNavigationElement');
+        $this->assertNotNull($nav, 'nav element emitted from the primary menu');
+        $this->assertContains('Home', $nav['name']);
+        $this->assertContains('About', $nav['name']);
+        $this->assertContains('https://example.test/about', $nav['url']);
+    }
+
+    // ----- emitPageBreadcrumb -------------------------------------------------------------------
+
+    #[Test]
+    public function a_deep_page_emits_a_breadcrumb_list_with_the_leaf_title(): void
+    {
+        Seo_Service_Schema::emitPageBreadcrumb($this->request('/guides/getting-started'), 'Getting Started');
+        $bc = $this->nodeOfType('BreadcrumbList');
+        $this->assertNotNull($bc);
+        $items = $bc['itemListElement'];
+        $this->assertSame('Home', $items[0]['name']);
+        $this->assertSame('Guides', $items[1]['name'], 'intermediate segment humanized');
+        $this->assertSame('Getting Started', $items[2]['name'], 'leaf uses the real page title');
+        $this->assertSame(1, $items[0]['position']);
+        $this->assertSame(3, $items[2]['position']);
+    }
+
+    #[Test]
+    public function the_homepage_emits_no_breadcrumb(): void
+    {
+        Seo_Service_Schema::emitPageBreadcrumb($this->request('/'), 'Home');
+        $this->assertNull($this->nodeOfType('BreadcrumbList'), 'just Home → nothing worth emitting');
+    }
+
+    // ----- emitArticle --------------------------------------------------------------------------
+
+    #[Test]
+    public function emit_article_builds_a_blog_posting_and_its_breadcrumb(): void
+    {
+        $this->config(['site' => ['name' => 'Acme']]);
+        $row     = (object) ['updated_at' => '2026-03-04 05:06:07'];
+        $article = [
+            'title'        => 'Hello World',
+            'slug'         => 'hello-world',
+            'excerpt'      => 'A first post.',
+            'published_at' => '2026-03-01 00:00:00',
+            'author'       => ['name' => 'Jane Author'],
+        ];
+        Seo_Service_Schema::emitArticle($row, $article, $this->request('/blog/hello-world'));
+
+        $post = $this->nodeOfType('BlogPosting');
+        $this->assertNotNull($post, 'BlogPosting node emitted');
+        $this->assertSame('Hello World', $post['headline']);
+        $this->assertSame('https://example.test/blog/hello-world', $post['url']);
+        $this->assertSame('A first post.', $post['description']);
+        $this->assertSame(['@id' => 'https://example.test/#website'], $post['isPartOf']);
+        $this->assertSame(['@id' => 'https://example.test/#organization'], $post['publisher']);
+        $this->assertSame('Person', $post['author']['@type']);
+        $this->assertSame('Jane Author', $post['author']['name']);
+        $this->assertArrayHasKey('datePublished', $post);
+        $this->assertArrayHasKey('dateModified', $post);
+
+        $bc = $this->nodeOfType('BreadcrumbList');
+        $this->assertNotNull($bc, 'the article breadcrumb rides along');
+    }
+
+    #[Test]
+    public function an_authorless_article_attributes_authorship_to_the_organization(): void
+    {
+        $this->config(['site' => ['name' => 'Acme']]);
+        Seo_Service_Schema::emitArticle(
+            (object) ['updated_at' => ''],
+            ['title' => 'No Author', 'slug' => 'no-author', 'published_at' => '2026-04-01 00:00:00'],
+            $this->request('/blog/no-author')
+        );
+        $post = $this->nodeOfType('BlogPosting');
+        $this->assertSame(['@id' => 'https://example.test/#organization'], $post['author'], 'falls back to the Organization');
+    }
+}
diff --git a/tests/Integration/System/AclServiceTest.php b/tests/Integration/System/AclServiceTest.php
new file mode 100644
index 0000000..29c84e2
--- /dev/null
+++ b/tests/Integration/System/AclServiceTest.php
@@ -0,0 +1,123 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\System;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use System_Service_Acl;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Zend_Registry;
+
+// `System_Service_Acl` resolves via the harness module autoloader (tests/bootstrap.php).
+
+/**
+ * System_Service_Acl — the read-only ACL Simulator ("would role X reach resource Y·Z, and WHY?").
+ * `simulate()` runs the live Tiger_Acl_Acl::explain(); `catalog()` feeds the role/resource pickers.
+ * Superadmin+ per modules/system/configs/acl.ini (ACL introspection can reveal the policy shape), so a
+ * plain admin is denied. These tests characterize the gate plus the explain envelope for both an
+ * ALLOW and a deny-by-default DENY, against the REAL shipped policy.
+ */
+#[CoversClass(System_Service_Acl::class)]
+final class AclServiceTest extends IntegrationTestCase
+{
+    private function dispatch(array $msg): object
+    {
+        return (new System_Service_Acl($msg))->getResponse();
+    }
+
+    private function messages(object $res): string
+    {
+        return json_encode($res->messages ?? []);
+    }
+
+    // ---- ACL: superadmin+, deny-by-default -------------------------------------------------------
+
+    #[Test]
+    public function the_shipped_acl_gates_the_simulator_to_superadmin_and_up(): void
+    {
+        $this->loginAs('superadmin');
+        $acl = Zend_Registry::get('Zend_Acl');
+
+        $this->assertTrue($acl->has('System_Service_Acl'), 'the acl.ini resource loaded');
+        $this->assertTrue($acl->isAllowed('superadmin', 'System_Service_Acl'));
+        $this->assertTrue($acl->isAllowed('developer', 'System_Service_Acl'), 'the god developer role inherits it');
+        $this->assertFalse($acl->isAllowed('admin', 'System_Service_Acl'), 'a plain admin cannot use the simulator');
+        $this->assertFalse($acl->isAllowed('guest', 'System_Service_Acl'));
+    }
+
+    #[Test]
+    public function a_plain_admin_is_denied_the_simulator(): void
+    {
+        $this->loginAs('admin');
+        foreach (['simulate', 'catalog'] as $action) {
+            $res = $this->dispatch(['action' => $action]);
+            $this->assertSame(0, (int) $res->result, "$action is superadmin+, not admin");
+            $this->assertStringContainsString('not_allowed', $this->messages($res));
+        }
+    }
+
+    // ---- simulate --------------------------------------------------------------------------------
+
+    #[Test]
+    public function simulate_explains_an_allow_decision_against_the_real_policy(): void
+    {
+        $this->loginAs('superadmin');
+        // superadmin genuinely may manage modules → an ALLOW with the explanatory envelope.
+        $res = $this->dispatch(['action' => 'simulate', 'role' => 'superadmin', 'resource' => 'System_Service_Modules']);
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $explain = $res->data['explain'];
+        $this->assertTrue($explain['allowed']);
+        $this->assertTrue($explain['roleKnown']);
+        $this->assertTrue($explain['resourceKnown']);
+        $this->assertContains('superadmin', $explain['roleChain']);
+        $this->assertNotEmpty($explain['reason']);
+    }
+
+    #[Test]
+    public function simulate_explains_a_deny_by_default_decision(): void
+    {
+        $this->loginAs('superadmin');
+        // a plain admin may NOT manage modules → a DENY, and the reason names deny-by-default.
+        $res = $this->dispatch(['action' => 'simulate', 'role' => 'admin', 'resource' => 'System_Service_Modules']);
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $explain = $res->data['explain'];
+        $this->assertFalse($explain['allowed']);
+        $this->assertTrue($explain['roleKnown']);
+        $this->assertStringContainsStringIgnoringCase('deny', $explain['reason']);
+    }
+
+    #[Test]
+    public function simulate_flags_an_unknown_role(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatch(['action' => 'simulate', 'role' => 'wizard', 'resource' => 'System_Service_Modules']);
+        $this->assertSame(1, (int) $res->result);
+
+        $explain = $res->data['explain'];
+        $this->assertFalse($explain['allowed']);
+        $this->assertFalse($explain['roleKnown'], 'an unknown role is flagged');
+    }
+
+    // ---- catalog ---------------------------------------------------------------------------------
+
+    #[Test]
+    public function catalog_returns_the_known_roles_and_sorted_resources(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatch(['action' => 'catalog']);
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $this->assertContains('superadmin', $res->data['roles']);
+        $this->assertContains('guest', $res->data['roles']);
+        $this->assertContains('System_Service_Modules', $res->data['resources'], 'a shipped resource is listed');
+
+        $resources = $res->data['resources'];
+        $sorted = $resources;
+        sort($sorted);
+        $this->assertSame($sorted, $resources, 'resources come back sorted');
+    }
+}
diff --git a/tests/Integration/System/DashboardServiceTest.php b/tests/Integration/System/DashboardServiceTest.php
new file mode 100644
index 0000000..645e854
--- /dev/null
+++ b/tests/Integration/System/DashboardServiceTest.php
@@ -0,0 +1,171 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\System;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use System_Service_Dashboard;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Acl_Acl;
+use Tiger_Dashboard;
+use Tiger_Model_Option;
+use Zend_Auth;
+use Zend_Auth_Storage_NonPersistent;
+use Zend_Registry;
+
+// `System_Service_Dashboard` resolves via the harness module autoloader (tests/bootstrap.php).
+
+/** A trivial dashboard widget so widgetBody() has a real class with render() to instantiate. */
+final class FakeDashboardWidget
+{
+    public function render(): string { return '<div class="fake">hello</div>'; }
+}
+
+/**
+ * System_Service_Dashboard — persists a user's dashboard widget layout + visibility to the LAZY
+ * option tier (scope=user), and renders a single allowed widget's body on demand. Admin+, and
+ * fail-soft (an unparseable/oversized payload is an ignored success — layout is convenience state).
+ *
+ * These tests characterize the ACL gate, the hygiene filter (only KNOWN widget ids are stored,
+ * unknowns dropped), the JSON round-trip into the `option` table, every fail-soft branch, and
+ * widgetBody's ACL-scoped render (an allowed widget renders; an unknown id is refused).
+ */
+#[CoversClass(System_Service_Dashboard::class)]
+final class DashboardServiceTest extends IntegrationTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Tiger_Dashboard::clear();
+        // One known widget (no ACL resource → visible to any admin) the tests order/hide/render.
+        Tiger_Dashboard::registerWidget([
+            'id'     => 'test.widget',
+            'module' => 'test',
+            'title'  => 'Test Widget',
+            'widget' => FakeDashboardWidget::class,
+        ]);
+    }
+
+    protected function tearDown(): void
+    {
+        Tiger_Dashboard::clear();
+        parent::tearDown();
+    }
+
+    private function dispatch(array $msg): object
+    {
+        return (new System_Service_Dashboard($msg))->getResponse();
+    }
+
+    private function messages(object $res): string
+    {
+        return json_encode($res->messages ?? []);
+    }
+
+    // ---- ACL -------------------------------------------------------------------------------------
+
+    #[Test]
+    public function a_guest_is_denied_every_dashboard_verb(): void
+    {
+        $this->login('anon', 'o-1', 'guest');
+        foreach (['saveLayout', 'saveWidgetPrefs', 'widgetBody'] as $action) {
+            $res = $this->dispatch(['action' => $action]);
+            $this->assertSame(0, (int) $res->result, "$action denied to a guest");
+            $this->assertStringContainsString('not_allowed', $this->messages($res));
+        }
+    }
+
+    #[Test]
+    public function an_admin_identity_with_no_user_id_cannot_save_a_layout(): void
+    {
+        // An authenticated admin with no user_id clears the ACL gate but has no user to scope state to →
+        // the empty-uid guard refuses (there's no per-user option owner).
+        $auth = Zend_Auth::getInstance();
+        $auth->setStorage(new Zend_Auth_Storage_NonPersistent());
+        $auth->getStorage()->write((object) ['user_id' => '', 'org_id' => 'org-test', 'role' => 'admin']);
+        Zend_Registry::set('Zend_Acl', new Tiger_Acl_Acl());
+
+        $res = $this->dispatch(['action' => 'saveLayout', 'layout' => '{"order":["test.widget"]}']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', $this->messages($res));
+    }
+
+    // ---- saveLayout ------------------------------------------------------------------------------
+
+    #[Test]
+    public function save_layout_stores_only_known_widget_ids_in_order_and_collapsed_map(): void
+    {
+        $this->login('u-dash', 'org-test', 'admin');
+        $layout = json_encode([
+            'order'     => ['test.widget', 'ghost.widget', 'test.widget'],   // unknown + duplicate dropped
+            'collapsed' => ['test.widget' => true, 'ghost.widget' => true, 'other' => false],
+        ]);
+        $res = $this->dispatch(['action' => 'saveLayout', 'layout' => $layout]);
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $stored = (new Tiger_Model_Option())->getJson(Tiger_Model_Option::SCOPE_USER, 'u-dash', 'tiger.dashboard.layout');
+        $this->assertSame(['test.widget'], $stored['order'], 'unknown + duplicate ids filtered out');
+        $this->assertSame(['test.widget' => true], $stored['collapsed'], 'only known + truthy collapsed kept');
+    }
+
+    #[Test]
+    public function save_layout_is_fail_soft_for_empty_oversized_or_non_array_payloads(): void
+    {
+        $this->login('u-dash', 'org-test', 'admin');
+
+        foreach (['', str_repeat('x', 20001), '"a string"', '12345'] as $bad) {
+            $res = $this->dispatch(['action' => 'saveLayout', 'layout' => $bad]);
+            $this->assertSame(1, (int) $res->result, 'fail-soft success for a junk payload');
+        }
+        // Nothing was persisted from any of those.
+        $this->assertNull((new Tiger_Model_Option())->getJson(Tiger_Model_Option::SCOPE_USER, 'u-dash', 'tiger.dashboard.layout'));
+    }
+
+    // ---- saveWidgetPrefs -------------------------------------------------------------------------
+
+    #[Test]
+    public function save_widget_prefs_stores_only_known_hidden_ids(): void
+    {
+        $this->login('u-dash', 'org-test', 'admin');
+        $res = $this->dispatch(['action' => 'saveWidgetPrefs', 'hidden' => json_encode(['test.widget', 'ghost.widget', 'test.widget'])]);
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $stored = (new Tiger_Model_Option())->getJson(Tiger_Model_Option::SCOPE_USER, 'u-dash', 'tiger.dashboard.prefs');
+        $this->assertSame(['hidden' => ['test.widget']], $stored, 'unknown + duplicate hidden ids filtered');
+    }
+
+    #[Test]
+    public function save_widget_prefs_treats_an_empty_list_as_show_all(): void
+    {
+        $this->login('u-dash', 'org-test', 'admin');
+        $res = $this->dispatch(['action' => 'saveWidgetPrefs', 'hidden' => '']);
+        $this->assertSame(1, (int) $res->result);
+
+        $stored = (new Tiger_Model_Option())->getJson(Tiger_Model_Option::SCOPE_USER, 'u-dash', 'tiger.dashboard.prefs');
+        $this->assertSame(['hidden' => []], $stored, 'an empty list persists as "show all"');
+    }
+
+    // ---- widgetBody ------------------------------------------------------------------------------
+
+    #[Test]
+    public function widget_body_renders_an_allowed_widget(): void
+    {
+        $this->login('u-dash', 'org-test', 'admin');
+        $res = $this->dispatch(['action' => 'widgetBody', 'id' => 'test.widget']);
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertStringContainsString('hello', $res->data['html'], 'the widget class render() output is returned');
+    }
+
+    #[Test]
+    public function widget_body_refuses_an_unknown_widget_id(): void
+    {
+        $this->login('u-dash', 'org-test', 'admin');
+        $res = $this->dispatch(['action' => 'widgetBody', 'id' => 'ghost.widget']);
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', $this->messages($res));
+    }
+}
diff --git a/tests/Integration/System/LogsServiceTest.php b/tests/Integration/System/LogsServiceTest.php
new file mode 100644
index 0000000..cc8704e
--- /dev/null
+++ b/tests/Integration/System/LogsServiceTest.php
@@ -0,0 +1,185 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\System;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use System_Service_Logs;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Zend_Config;
+use Zend_Registry;
+
+// `System_Service_Logs` resolves via the harness module autoloader (tests/bootstrap.php).
+
+/**
+ * System_Service_Logs — read-only application-log viewer (the read side of the write-only Tiger_Log).
+ * Superadmin+ per modules/system/configs/acl.ini (log context can carry error detail / PII). When the
+ * sink is a file/stream it tails the file, parses the JSON-per-line records, filters by minimum level
+ * + free text, and returns the newest first (bounded); on a non-file sink it reports where the logs go.
+ *
+ * These tests drive `search` against a controlled Zend_Config: a non-file sink (available=false) and a
+ * real temp log file (available=true) exercising the level filter, the free-text filter, newest-first
+ * ordering, and the result limit — plus the superadmin-only ACL gate.
+ */
+#[CoversClass(System_Service_Logs::class)]
+final class LogsServiceTest extends IntegrationTestCase
+{
+    private ?Zend_Config $priorConfig = null;
+    private array $tmpFiles = [];
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->priorConfig = Zend_Registry::isRegistered('Zend_Config') ? Zend_Registry::get('Zend_Config') : null;
+    }
+
+    protected function tearDown(): void
+    {
+        foreach ($this->tmpFiles as $f) { @unlink($f); }
+        $this->tmpFiles = [];
+        if ($this->priorConfig !== null) {
+            Zend_Registry::set('Zend_Config', $this->priorConfig);
+        } elseif (Zend_Registry::isRegistered('Zend_Config')) {
+            Zend_Registry::set('Zend_Config', new Zend_Config([]));
+        }
+        parent::tearDown();
+    }
+
+    private function setLogConfig(array $log): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => ['log' => $log]]));
+    }
+
+    /** Write JSON-per-line log records to a temp file and point the stream sink at it. */
+    private function seedLogFile(array $lines): string
+    {
+        $path = tempnam(sys_get_temp_dir(), 'tigerlog') . '.log';
+        file_put_contents($path, implode("\n", $lines) . "\n");
+        $this->tmpFiles[] = $path;
+        $this->setLogConfig(['writer' => 'stream', 'stream' => ['path' => $path]]);
+        return $path;
+    }
+
+    private function dispatch(array $msg): object
+    {
+        return (new System_Service_Logs($msg))->getResponse();
+    }
+
+    private function messages(object $res): string
+    {
+        return json_encode($res->messages ?? []);
+    }
+
+    // ---- ACL: superadmin+ ------------------------------------------------------------------------
+
+    #[Test]
+    public function the_shipped_acl_gates_the_log_viewer_to_superadmin_and_up(): void
+    {
+        $this->loginAs('superadmin');
+        $acl = Zend_Registry::get('Zend_Acl');
+
+        $this->assertTrue($acl->has('System_Service_Logs'), 'the acl.ini resource loaded');
+        $this->assertTrue($acl->isAllowed('superadmin', 'System_Service_Logs'));
+        $this->assertFalse($acl->isAllowed('admin', 'System_Service_Logs'), 'a plain admin cannot read logs');
+        $this->assertFalse($acl->isAllowed('guest', 'System_Service_Logs'));
+    }
+
+    #[Test]
+    public function a_plain_admin_is_denied_reading_logs(): void
+    {
+        $this->loginAs('admin');
+        $this->setLogConfig(['writer' => 'errorlog']);
+        $res = $this->dispatch(['action' => 'search']);
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', $this->messages($res));
+    }
+
+    // ---- non-file sink: report where the logs go -------------------------------------------------
+
+    #[Test]
+    public function search_on_a_non_file_sink_reports_the_sink_and_no_entries(): void
+    {
+        $this->loginAs('superadmin');
+        $this->setLogConfig(['writer' => 'errorlog']);
+        $res = $this->dispatch(['action' => 'search']);
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertFalse($res->data['available'], 'a non-file sink is not tailable');
+        $this->assertSame('errorlog', $res->data['sink']);
+        $this->assertSame([], $res->data['entries']);
+        $this->assertNotEmpty($res->data['levels']);
+    }
+
+    // ---- file sink: tail + filter ----------------------------------------------------------------
+
+    #[Test]
+    public function search_tails_a_file_sink_newest_first(): void
+    {
+        $this->loginAs('superadmin');
+        $this->seedLogFile([
+            json_encode(['ts' => '2026-07-24T10:00:00Z', 'level' => 'INFO', 'msg' => 'first']),
+            json_encode(['ts' => '2026-07-24T10:01:00Z', 'level' => 'WARN', 'msg' => 'second']),
+            'not-a-json-marker-line',
+            json_encode(['ts' => '2026-07-24T10:02:00Z', 'level' => 'ERR', 'msg' => 'third']),
+        ]);
+        $res = $this->dispatch(['action' => 'search']);
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertTrue($res->data['available']);
+        $this->assertSame('stream', $res->data['sink']);
+
+        $msgs = array_column($res->data['entries'], 'msg');
+        $this->assertSame(['third', 'second', 'first'], $msgs, 'newest first, non-JSON lines skipped');
+    }
+
+    #[Test]
+    public function search_filters_by_minimum_level(): void
+    {
+        $this->loginAs('superadmin');
+        $this->seedLogFile([
+            json_encode(['ts' => '1', 'level' => 'DEBUG', 'msg' => 'd']),
+            json_encode(['ts' => '2', 'level' => 'INFO', 'msg' => 'i']),
+            json_encode(['ts' => '3', 'level' => 'WARN', 'msg' => 'w']),
+            json_encode(['ts' => '4', 'level' => 'ERR', 'msg' => 'e']),
+        ]);
+        $res = $this->dispatch(['action' => 'search', 'level' => 'WARN']);
+
+        $msgs = array_column($res->data['entries'], 'msg');
+        $this->assertSame(['e', 'w'], $msgs, 'only WARN and above, newest first');
+    }
+
+    #[Test]
+    public function search_filters_by_free_text_across_message_and_context(): void
+    {
+        $this->loginAs('superadmin');
+        $this->seedLogFile([
+            json_encode(['ts' => '1', 'level' => 'ERR', 'msg' => 'database exploded', 'context' => []]),
+            json_encode(['ts' => '2', 'level' => 'ERR', 'msg' => 'all good', 'context' => ['note' => 'database ok']]),
+            json_encode(['ts' => '3', 'level' => 'ERR', 'msg' => 'unrelated', 'context' => []]),
+        ]);
+        $res = $this->dispatch(['action' => 'search', 'q' => 'database']);
+
+        $msgs = array_column($res->data['entries'], 'msg');
+        $this->assertSame(['all good', 'database exploded'], $msgs, 'matches msg OR context, newest first');
+    }
+
+    #[Test]
+    public function search_honors_the_result_limit(): void
+    {
+        $this->loginAs('superadmin');
+        $lines = [];
+        for ($i = 1; $i <= 10; $i++) {
+            $lines[] = json_encode(['ts' => (string) $i, 'level' => 'INFO', 'msg' => 'line' . $i]);
+        }
+        $this->seedLogFile($lines);
+        $res = $this->dispatch(['action' => 'search', 'limit' => 3]);
+
+        $this->assertSame(1, (int) $res->result);
+        $this->assertCount(3, $res->data['entries'], 'capped at the requested limit');
+        $this->assertSame(3, $res->data['count']);
+        $this->assertSame('line10', $res->data['entries'][0]['msg'], 'newest kept when limited');
+    }
+}
diff --git a/tests/Integration/System/NavServiceTest.php b/tests/Integration/System/NavServiceTest.php
new file mode 100644
index 0000000..2cebbe4
--- /dev/null
+++ b/tests/Integration/System/NavServiceTest.php
@@ -0,0 +1,148 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\System;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use System_Service_Nav;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Acl_Acl;
+use Tiger_Model_Config;
+use Zend_Auth;
+use Zend_Auth_Storage_NonPersistent;
+use Zend_Registry;
+
+// `System_Service_Nav` resolves via the harness module autoloader (tests/bootstrap.php).
+
+/**
+ * System_Service_Nav — persists a user's admin-menu sort order. A drag posts the new order of a
+ * group's item keys; the service writes one `tiger.nav.<group>.<key>.sort` config row per item at
+ * USER scope (inside a real `_transaction`, which nests via the harness savepoint adapter). Admin+,
+ * and deliberately FAIL-SOFT: a malformed/oversized payload is a no-op success, never an error.
+ *
+ * These tests characterize the ACL gate, the config rows written (per-item index order at user
+ * scope), the key/group sanitization, and every fail-soft branch.
+ */
+#[CoversClass(System_Service_Nav::class)]
+final class NavServiceTest extends IntegrationTestCase
+{
+    private function dispatch(array $msg): object
+    {
+        return (new System_Service_Nav($msg))->getResponse();
+    }
+
+    private function messages(object $res): string
+    {
+        return json_encode($res->messages ?? []);
+    }
+
+    // ---- ACL -------------------------------------------------------------------------------------
+
+    #[Test]
+    public function the_shipped_acl_gates_nav_sort_to_admin_and_up(): void
+    {
+        $this->loginAs('admin');
+        $acl = Zend_Registry::get('Zend_Acl');
+
+        $this->assertTrue($acl->has('System_Service_Nav'), 'the acl.ini resource loaded');
+        $this->assertTrue($acl->isAllowed('admin', 'System_Service_Nav'));
+        $this->assertFalse($acl->isAllowed('user', 'System_Service_Nav'), 'a plain user is denied');
+        $this->assertFalse($acl->isAllowed('guest', 'System_Service_Nav'));
+    }
+
+    #[Test]
+    public function a_guest_is_denied(): void
+    {
+        $this->login('anon', 'o-1', 'guest');
+        $res = $this->dispatch(['action' => 'sort', 'group' => 'root', 'keys' => '["a","b"]']);
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', $this->messages($res));
+    }
+
+    // ---- the write path --------------------------------------------------------------------------
+
+    #[Test]
+    public function sort_writes_one_index_ordered_config_row_per_item_at_user_scope(): void
+    {
+        $this->login('u-nav', 'org-test', 'admin');
+        $res = $this->dispatch(['action' => 'sort', 'group' => 'root', 'keys' => '["dashboard","content","users"]']);
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $cfg = new Tiger_Model_Config();
+        $u   = Tiger_Model_Config::SCOPE_USER;
+        $this->assertSame('0', $cfg->get($u, 'u-nav', 'tiger.nav.root.dashboard.sort'));
+        $this->assertSame('1', $cfg->get($u, 'u-nav', 'tiger.nav.root.content.sort'));
+        $this->assertSame('2', $cfg->get($u, 'u-nav', 'tiger.nav.root.users.sort'));
+        // Global scope is untouched — this is a private per-user override.
+        $this->assertNull($cfg->get(Tiger_Model_Config::SCOPE_GLOBAL, '', 'tiger.nav.root.dashboard.sort'));
+    }
+
+    #[Test]
+    public function sort_sanitizes_the_group_and_item_keys_and_skips_empty_ones(): void
+    {
+        $this->login('u-nav', 'org-test', 'admin');
+        // Group with junk chars → stripped to 'settings'; a key with junk → stripped; an all-junk key skipped.
+        $res = $this->dispatch(['action' => 'sort', 'group' => 'set/tings!', 'keys' => '["me!!nu","@@@","tools"]']);
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $cfg = new Tiger_Model_Config();
+        $u   = Tiger_Model_Config::SCOPE_USER;
+        // 'me!!nu' → 'menu' at index 0; '@@@' stripped to '' → skipped (does NOT consume an index);
+        // 'tools' → index 1.
+        $this->assertSame('0', $cfg->get($u, 'u-nav', 'tiger.nav.settings.menu.sort'));
+        $this->assertSame('1', $cfg->get($u, 'u-nav', 'tiger.nav.settings.tools.sort'));
+    }
+
+    // ---- fail-soft branches ----------------------------------------------------------------------
+
+    #[Test]
+    public function a_malformed_keys_payload_is_a_no_op_success(): void
+    {
+        $this->login('u-nav', 'org-test', 'admin');
+        // `keys` isn't a JSON array → fail-soft: success with nothing written.
+        $res = $this->dispatch(['action' => 'sort', 'group' => 'root', 'keys' => 'not-json']);
+
+        $this->assertSame(1, (int) $res->result, 'fail-soft returns success');
+        $this->assertStringNotContainsString('error', strtolower($this->messages($res)));
+        $this->assertNull((new Tiger_Model_Config())->get(Tiger_Model_Config::SCOPE_USER, 'u-nav', 'tiger.nav.root.x.sort'));
+    }
+
+    #[Test]
+    public function an_empty_group_is_a_no_op_success(): void
+    {
+        $this->login('u-nav', 'org-test', 'admin');
+        $res = $this->dispatch(['action' => 'sort', 'group' => '', 'keys' => '["a"]']);
+        $this->assertSame(1, (int) $res->result, 'an empty group after sanitization is fail-soft');
+    }
+
+    #[Test]
+    public function an_admin_identity_with_no_user_id_is_told_login_is_required(): void
+    {
+        // An authenticated admin whose identity carries no user_id clears the ACL gate but can't own a
+        // per-user override → the login_required branch (there's no user to scope the rows to).
+        $auth = Zend_Auth::getInstance();
+        $auth->setStorage(new Zend_Auth_Storage_NonPersistent());
+        $auth->getStorage()->write((object) ['user_id' => '', 'org_id' => 'org-test', 'role' => 'admin']);
+        Zend_Registry::set('Zend_Acl', new Tiger_Acl_Acl());
+
+        $res = $this->dispatch(['action' => 'sort', 'group' => 'root', 'keys' => '["a"]']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('login_required', $this->messages($res));
+    }
+
+    #[Test]
+    public function an_oversized_key_list_is_a_no_op_success(): void
+    {
+        $this->login('u-nav', 'org-test', 'admin');
+        // More than MAX_KEYS (60) items → fail-soft no-op.
+        $keys = json_encode(array_map(fn($i) => 'k' . $i, range(1, System_Service_Nav::MAX_KEYS + 5)));
+        $res  = $this->dispatch(['action' => 'sort', 'group' => 'root', 'keys' => $keys]);
+
+        $this->assertSame(1, (int) $res->result);
+        $this->assertNull((new Tiger_Model_Config())->get(Tiger_Model_Config::SCOPE_USER, 'u-nav', 'tiger.nav.root.k1.sort'));
+    }
+}
diff --git a/tests/Integration/System/SettingsServiceTest.php b/tests/Integration/System/SettingsServiceTest.php
new file mode 100644
index 0000000..c37a9d5
--- /dev/null
+++ b/tests/Integration/System/SettingsServiceTest.php
@@ -0,0 +1,214 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\System;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use System_Service_Settings;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Config;
+use Zend_Registry;
+
+// `System_Service_Settings` (+ its Form) resolve via the harness module autoloader (tests/bootstrap.php).
+
+/**
+ * System_Service_Settings — the /api behind the core Settings screen (session lifetime + auto-logout +
+ * reCAPTCHA), admin+ per modules/system/configs/acl.ini. The happy path validates System_Form_Settings
+ * then writes to the `config` DB tier (scope=global) — the live-override pattern, no deploy. These
+ * tests characterize: the ACL gate (guest denied), a form-validation refusal that writes NOTHING, and a
+ * valid save landing every value in the config table (session TTL floored, auto-logout toggle/window/
+ * action, reCAPTCHA fields; a blank secret is left untouched).
+ *
+ * `/api` calls carry a CSRF token a CLI test doesn't have; we set the documented `tiger.auth.stateless`
+ * flag (Tiger_Form skips CSRF for stateless bearer callers) so the form's REAL field validators run —
+ * exactly as the Signup service tests do.
+ */
+#[CoversClass(System_Service_Settings::class)]
+final class SettingsServiceTest extends IntegrationTestCase
+{
+    protected function tearDown(): void
+    {
+        Zend_Registry::set('tiger.auth.stateless', false);
+        parent::tearDown();
+    }
+
+    private function dispatch(array $msg): object
+    {
+        Zend_Registry::set('tiger.auth.stateless', true);
+        return (new System_Service_Settings($msg))->getResponse();
+    }
+
+    private function messages(object $res): string
+    {
+        return json_encode($res->messages ?? []);
+    }
+
+    /** A complete, valid settings payload; $over replaces any field. */
+    private function validParams(array $over = []): array
+    {
+        return array_merge([
+            'action'             => 'save',
+            'session_ttl'        => '3600',
+            'autologout_enabled' => '1',
+            'autologout_seconds' => '900',
+            'autologout_action'  => 'lock',
+        ], $over);
+    }
+
+    // ---- ACL -------------------------------------------------------------------------------------
+
+    #[Test]
+    public function the_shipped_acl_gates_settings_to_admin_and_up(): void
+    {
+        $this->loginAs('admin');
+        $acl = Zend_Registry::get('Zend_Acl');
+
+        $this->assertTrue($acl->has('System_Service_Settings'), 'the acl.ini resource loaded');
+        $this->assertTrue($acl->isAllowed('admin', 'System_Service_Settings'));
+        $this->assertFalse($acl->isAllowed('user', 'System_Service_Settings'), 'a plain user is denied');
+        $this->assertFalse($acl->isAllowed('guest', 'System_Service_Settings'));
+    }
+
+    #[Test]
+    public function a_guest_is_denied_saving_settings(): void
+    {
+        $this->login('anon', 'o-1', 'guest');
+        $res = $this->dispatch($this->validParams());
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', $this->messages($res), 'the ACL denial fired');
+    }
+
+    // ---- validation refuses + writes nothing -----------------------------------------------------
+
+    #[Test]
+    public function an_invalid_form_returns_field_errors_and_writes_no_config(): void
+    {
+        $this->loginAs('admin');
+        // session_ttl below the floor (>59) and a non-numeric autologout window both fail validation.
+        $res = $this->dispatch($this->validParams(['session_ttl' => '10', 'autologout_seconds' => 'abc']));
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertNotNull($res->form, 'field errors are returned');
+        $this->assertStringContainsString('core.api.error.form', $this->messages($res));
+
+        $cfg = new Tiger_Model_Config();
+        $this->assertNull($cfg->get(Tiger_Model_Config::SCOPE_GLOBAL, '', 'tiger.session.ttl.authed'), 'nothing was written');
+    }
+
+    // ---- the happy path lands every value in the config tier -------------------------------------
+
+    #[Test]
+    public function a_valid_save_writes_session_and_autologout_values_to_the_config_table(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatch($this->validParams());
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertSame('/system/settings', $res->redirect, 'the success redirect is returned');
+
+        $cfg = new Tiger_Model_Config();
+        $g   = Tiger_Model_Config::SCOPE_GLOBAL;
+        $this->assertSame('3600', $cfg->get($g, '', 'tiger.session.ttl.authed'));
+        $this->assertSame('1', $cfg->get($g, '', 'tiger.session.autologout.enabled'));
+        $this->assertSame('900', $cfg->get($g, '', 'tiger.session.autologout.seconds'));
+        $this->assertSame('lock', $cfg->get($g, '', 'tiger.session.autologout.action'));
+    }
+
+    #[Test]
+    public function the_session_ttl_is_floored_and_the_autologout_action_normalizes(): void
+    {
+        $this->loginAs('admin');
+        // session_ttl '60' is the minimum the form accepts (>59); the service floors at max(60, ttl).
+        // An unrecognized action string normalizes to 'logout' (only 'lock' is special-cased).
+        $res = $this->dispatch($this->validParams([
+            'session_ttl' => '60', 'autologout_enabled' => '0', 'autologout_action' => 'logout',
+        ]));
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $cfg = new Tiger_Model_Config();
+        $g   = Tiger_Model_Config::SCOPE_GLOBAL;
+        $this->assertSame('60', $cfg->get($g, '', 'tiger.session.ttl.authed'));
+        $this->assertSame('0', $cfg->get($g, '', 'tiger.session.autologout.enabled'), 'the toggle stored off');
+        $this->assertSame('logout', $cfg->get($g, '', 'tiger.session.autologout.action'));
+    }
+
+    #[Test]
+    public function a_valid_save_also_writes_the_recaptcha_settings(): void
+    {
+        $this->loginAs('admin');
+        // A blank secret leaves the stored secret untouched (no crypto needed) — the documented behavior.
+        $res = $this->dispatch($this->validParams([
+            'recaptcha_enabled'    => '1',
+            'recaptcha_version'    => 'v3',
+            'recaptcha_site_key'   => 'test-site-key',
+            'recaptcha_secret_key' => '',
+            'recaptcha_min_score'  => '0.7',
+            'recaptcha_fail_open'  => '1',
+        ]));
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $cfg = new Tiger_Model_Config();
+        $g   = Tiger_Model_Config::SCOPE_GLOBAL;
+        $this->assertSame('1', $cfg->get($g, '', 'tiger.recaptcha.enabled'));
+        $this->assertSame('v3', $cfg->get($g, '', 'tiger.recaptcha.version'));
+        $this->assertSame('test-site-key', $cfg->get($g, '', 'tiger.recaptcha.site_key'));
+        $this->assertSame('0.7', $cfg->get($g, '', 'tiger.recaptcha.min_score'));
+        $this->assertNull($cfg->get($g, '', 'tiger.recaptcha.secret_key'), 'a blank secret writes nothing');
+    }
+
+    #[Test]
+    public function a_valid_save_also_writes_the_consent_location_and_signup_tabs(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatch($this->validParams([
+            // Cookies (GDPR consent) tab — rides on $params via the Tiger_Consent shared writer.
+            'consent_mode'         => 'auto',
+            'consent_message'      => 'We use cookies.',
+            'consent_accept_label' => 'OK',
+            // Location tab — provider selection (the adapter fields ride on $params too).
+            'location_ip_provider'      => 'nominatim',
+            'location_address_provider' => 'nominatim',
+            'location_cache_ttl'        => '3600',
+            // Signup tab — the public-signup kill switch (lands in the lazy `option` tier).
+            'signup_settings' => '1',
+            'signup_disabled' => '1',
+        ]));
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+
+        $cfg = new Tiger_Model_Config();
+        $g   = Tiger_Model_Config::SCOPE_GLOBAL;
+        $this->assertSame('auto', $cfg->get($g, '', 'tiger.consent.mode'));
+        $this->assertSame('nominatim', $cfg->get($g, '', 'tiger.location.ip.provider'));
+
+        $opt = new \Tiger_Model_Option();
+        $this->assertSame('1', $opt->get(\Tiger_Model_Option::SCOPE_GLOBAL, '', 'signup.public_disabled'), 'the signup kill switch persisted');
+    }
+
+    // ---- locationTest ----------------------------------------------------------------------------
+
+    #[Test]
+    public function location_test_is_denied_to_a_guest(): void
+    {
+        $this->login('anon', 'o-1', 'guest');
+        $res = $this->dispatch(['action' => 'locationTest', 'ip' => '8.8.8.8', 'provider' => 'nominatim']);
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', $this->messages($res));
+    }
+
+    #[Test]
+    public function location_test_returns_a_result_for_an_admin(): void
+    {
+        $this->loginAs('admin');
+        // An invalid IP short-circuits inside Tiger_Location::test (no network) → a clean ok=false result,
+        // exercising the admin path + the /api envelope without any live provider call.
+        $res = $this->dispatch(['action' => 'locationTest', 'ip' => 'not-an-ip', 'provider' => 'nominatim']);
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertFalse($res->data['ok'], 'an invalid IP is reported, not looked up');
+        $this->assertArrayHasKey('error', $res->data);
+    }
+}
diff --git a/tests/Integration/Update/CheckerTest.php b/tests/Integration/Update/CheckerTest.php
new file mode 100644
index 0000000..969d4b0
--- /dev/null
+++ b/tests/Integration/Update/CheckerTest.php
@@ -0,0 +1,96 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Update;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Module;
+use Tiger_Update_Checker;
+
+/**
+ * Tiger_Update_Checker::modules() — the per-module update diff, which the unit CheckerTest can't reach
+ * (it needs the `module` table to enumerate installer-managed modules). This seeds real module rows and
+ * PRE-SEEDS the per-module remote cache (the "latest ref" GitHub lookup) so the diff runs offline:
+ *
+ *   - an installer-managed row (repository + version) whose cached latest is NEWER → flagged as an update,
+ *     with a licensed manifest on disk driving the license annotation (Tiger_License_Checker::status);
+ *   - a discovered/local row (no repository) → skipped (nothing authoritative to diff against).
+ */
+#[CoversClass(Tiger_Update_Checker::class)]
+final class CheckerTest extends IntegrationTestCase
+{
+    /** @var string[] planted module dirs to remove. */
+    private array $planted = [];
+    /** @var string[] cache files to remove. */
+    private array $wrote = [];
+
+    protected function tearDown(): void
+    {
+        foreach ($this->planted as $d) { $this->rrmdir($d); }
+        foreach ($this->wrote as $f) { @unlink($f); }
+        @rmdir(APPLICATION_PATH . '/modules');
+        parent::tearDown();
+    }
+
+    private function primeCache(string $key, $value): void
+    {
+        $dir = dirname(APPLICATION_PATH) . '/var/cache/updates';
+        @mkdir($dir, 0775, true);
+        $file = $dir . '/' . preg_replace('/[^a-z0-9._-]/i', '_', $key) . '.json';
+        file_put_contents($file, json_encode(['v' => $value]));
+        $this->wrote[] = $file;
+    }
+
+    private function plantModule(string $slug, array $manifest): void
+    {
+        $dir = APPLICATION_PATH . '/modules/' . $slug;
+        @mkdir($dir, 0775, true);
+        file_put_contents($dir . '/module.json', json_encode($manifest + ['slug' => $slug]));
+        $this->planted[] = $dir;
+    }
+
+    #[Test]
+    public function modulesDiffsInstallerManagedRowsAndSkipsLocalOnes(): void
+    {
+        $mod = new Tiger_Model_Module();
+
+        // An installer-managed, licensed module at 1.0.0, with a newer cached "latest".
+        $mod->install('w4upd', [
+            'name' => 'W4 Upd', 'version' => '1.0.0',
+            'repository' => 'https://github.com/WebTigers/W4Upd', 'ref' => 'v1.0.0', 'source' => Tiger_Model_Module::SOURCE_URL,
+        ]);
+        $this->plantModule('w4upd', [
+            'name' => 'W4 Upd', 'version' => '1.0.0',
+            'pricing' => ['model' => 'licensed', 'authority' => 'https://store.example/authority', 'vendor' => 'acme/TigerVendor'],
+        ]);
+        $this->primeCache('mod-w4upd', 'v2.0.0');   // GitHub says the latest tag is v2.0.0
+
+        // A discovered/local module — no repository → nothing to diff, must be skipped.
+        $mod->setActive('w4local', true, ['source' => Tiger_Model_Module::SOURCE_DISCOVERED, 'name' => 'W4 Local', 'version' => '9.9.9']);
+
+        $rows = Tiger_Update_Checker::modules();
+        $byslug = [];
+        foreach ($rows as $r) { $byslug[$r['slug']] = $r; }
+
+        $this->assertArrayHasKey('w4upd', $byslug, 'the installer-managed module is diffed');
+        $this->assertTrue($byslug['w4upd']['update'], '1.0.0 < 2.0.0 → an update is available');
+        $this->assertSame('2.0.0', $byslug['w4upd']['latest']);
+        $this->assertArrayHasKey('license', $byslug['w4upd'], 'a licensed module carries its license verdict');
+
+        $this->assertArrayNotHasKey('w4local', $byslug, 'a module with no repository is skipped');
+    }
+
+    private function rrmdir(string $dir): void
+    {
+        if (!is_dir($dir)) { return; }
+        foreach (scandir($dir) ?: [] as $item) {
+            if ($item === '.' || $item === '..') { continue; }
+            $p = $dir . '/' . $item;
+            (is_dir($p) && !is_link($p)) ? $this->rrmdir($p) : @unlink($p);
+        }
+        @rmdir($dir);
+    }
+}
diff --git a/tests/Unit/License/AuthorityHttpTest.php b/tests/Unit/License/AuthorityHttpTest.php
new file mode 100644
index 0000000..c66b2d1
--- /dev/null
+++ b/tests/Unit/License/AuthorityHttpTest.php
@@ -0,0 +1,34 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Unit\License;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\UnitTestCase;
+use Tiger_License_Authority;
+
+/**
+ * Tiger_License_Authority — the REAL transport (`_post`) error path. AuthorityTest exercises download()
+ * through the injected transport seam; this one leaves the transport at its default so the actual
+ * stream-context POST runs, against a dead local endpoint (connection refused — no real network), and
+ * asserts the documented fail-soft: an unreachable authority yields a null descriptor, never an exception.
+ */
+#[CoversClass(Tiger_License_Authority::class)]
+final class AuthorityHttpTest extends UnitTestCase
+{
+    protected function tearDown(): void
+    {
+        Tiger_License_Authority::_reset();
+        parent::tearDown();
+    }
+
+    #[Test]
+    public function anUnreachableAuthorityOverRealHttpYieldsNull(): void
+    {
+        Tiger_License_Authority::_reset();   // no injected transport → the real _post runs
+        $desc = Tiger_License_Authority::download('http://127.0.0.1:9/authority', 'LIC-1', 'widget', 'example.test');
+        $this->assertNull($desc, 'an unreachable authority download is null, not a thrown error');
+    }
+}
diff --git a/tests/Unit/Module/DependencyTest.php b/tests/Unit/Module/DependencyTest.php
new file mode 100644
index 0000000..556fec1
--- /dev/null
+++ b/tests/Unit/Module/DependencyTest.php
@@ -0,0 +1,199 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Unit\Module;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\UnitTestCase;
+use Tiger_Module_Dependency;
+
+/**
+ * Tiger_Module_Dependency — the lazy inter-module dependency alerts (the PUBLIC surface, which
+ * DependencyParseTest's _readRequirements probe doesn't reach): requires(), requirements(), missing(),
+ * missingReport(), and dependents(). These are the alerts an admin sees on activate/deactivate — never
+ * a hard block, so their job is to correctly classify a requirement as absent / out-of-version / present,
+ * and to name the active modules that still depend on something.
+ *
+ * Driven against real fixture module dirs planted under APPLICATION_PATH's modules/ (the bootstrap points
+ * APPLICATION_PATH at an otherwise-empty fixture app, so our fixtures are the only APP modules present),
+ * exactly like DiscoveryTest. No DB is booted, so Tiger_Module_Dependency::_inactiveSlugs() catches its
+ * failed query and degrades to "nothing inactive" — the documented fail-soft path — which these tests also
+ * pin (an absent requirement, not a false "inactive").
+ */
+#[CoversClass(Tiger_Module_Dependency::class)]
+final class DependencyTest extends UnitTestCase
+{
+    /** @var string[] fixture module dirs created under APPLICATION_PATH/modules (removed in tearDown). */
+    private array $created = [];
+
+    protected function tearDown(): void
+    {
+        foreach ($this->created as $dir) { $this->rrmdir($dir); }
+        // Prune fixture scaffolding if now empty (never touches a real app dir).
+        @rmdir(APPLICATION_PATH . '/modules');
+        @rmdir(APPLICATION_PATH);
+        @rmdir(dirname(APPLICATION_PATH));
+        parent::tearDown();
+    }
+
+    /** Plant a fixture module dir under the app modules root and register it for cleanup. */
+    private function plantAppModule(string $slug, array $files): string
+    {
+        $dir = APPLICATION_PATH . '/modules/' . $slug;
+        @mkdir($dir, 0775, true);
+        foreach ($files as $rel => $contents) {
+            $full = $dir . '/' . $rel;
+            @mkdir(dirname($full), 0775, true);
+            file_put_contents($full, $contents);
+        }
+        $this->created[] = $dir;
+        return $dir;
+    }
+
+    // ---- requires() / requirements() -------------------------------------------
+
+    #[Test]
+    public function requiresReturnsTheDeclaredSlugsAndRequirementsCarryConstraints(): void
+    {
+        $this->plantAppModule('depa', [
+            'module.json'             => json_encode(['slug' => 'depa', 'name' => 'Dep A', 'version' => '1.0.0']),
+            'configs/dependency.ini'  => "[requires]\nmodules[] = \"depb >=1.0.0\"\nmodules[] = \"depc\"\n",
+        ]);
+
+        $this->assertSame(['depb', 'depc'], Tiger_Module_Dependency::requires('depa'));
+
+        $reqs = Tiger_Module_Dependency::requirements('depa');
+        $this->assertSame([
+            ['slug' => 'depb', 'constraint' => '>=1.0.0'],
+            ['slug' => 'depc', 'constraint' => ''],
+        ], $reqs);
+    }
+
+    #[Test]
+    public function aModuleWithNoDependencyIniHasNoRequirements(): void
+    {
+        $this->plantAppModule('lonely', [
+            'module.json' => json_encode(['slug' => 'lonely', 'name' => 'Lonely']),
+        ]);
+        $this->assertSame([], Tiger_Module_Dependency::requires('lonely'));
+        $this->assertSame([], Tiger_Module_Dependency::requirements('lonely'));
+    }
+
+    #[Test]
+    public function anUnknownSlugHasNoRequirements(): void
+    {
+        // No dir at all → _dir() is null → empty, never a fatal.
+        $this->assertSame([], Tiger_Module_Dependency::requirements('nosuchmodule'));
+        $this->assertSame([], Tiger_Module_Dependency::requires('nosuchmodule'));
+    }
+
+    // ---- missing() / missingReport() -------------------------------------------
+
+    #[Test]
+    public function missingReportClassifiesAbsentAndOutOfVersionRequirements(): void
+    {
+        // depa requires depb >=1.0.0 (present but too OLD) and depc (ABSENT).
+        $this->plantAppModule('depa', [
+            'module.json'            => json_encode(['slug' => 'depa', 'name' => 'Dep A', 'version' => '1.0.0']),
+            'configs/dependency.ini' => "[requires]\nmodules[] = \"depb >=1.0.0\"\nmodules[] = \"depc\"\n",
+        ]);
+        $this->plantAppModule('depb', [
+            'module.json' => json_encode(['slug' => 'depb', 'name' => 'Dep B', 'version' => '0.5.0']),
+        ]);
+
+        $report = Tiger_Module_Dependency::missingReport('depa');
+        // Order follows the declared requirements: depb (version), then depc (absent).
+        $this->assertCount(2, $report);
+
+        $this->assertSame('depb', $report[0]['slug']);
+        $this->assertSame('version', $report[0]['reason'], 'present but below the constraint → a version alert');
+        $this->assertSame('>=1.0.0', $report[0]['need']);
+        $this->assertSame('0.5.0', $report[0]['have']);
+
+        $this->assertSame('depc', $report[1]['slug']);
+        $this->assertSame('absent', $report[1]['reason']);
+        $this->assertNull($report[1]['have']);
+
+        // missing() is the flat slug list of the same set.
+        $this->assertSame(['depb', 'depc'], Tiger_Module_Dependency::missing('depa'));
+    }
+
+    #[Test]
+    public function aSatisfiedRequirementDoesNotAppearInTheReport(): void
+    {
+        // depb is present AND new enough → not flagged (only depc absent remains).
+        $this->plantAppModule('depa', [
+            'module.json'            => json_encode(['slug' => 'depa', 'name' => 'Dep A']),
+            'configs/dependency.ini' => "[requires]\nmodules[] = \"depb >=1.0.0\"\nmodules[] = \"depc\"\n",
+        ]);
+        $this->plantAppModule('depb', [
+            'module.json' => json_encode(['slug' => 'depb', 'name' => 'Dep B', 'version' => '2.0.0']),
+        ]);
+
+        $this->assertSame(['depc'], Tiger_Module_Dependency::missing('depa'));
+    }
+
+    #[Test]
+    public function anUnknownInstalledVersionNeverTriggersAVersionAlarm(): void
+    {
+        // depb is present but declares NO version → advisory: an unknown version is not a version alarm.
+        $this->plantAppModule('depa', [
+            'module.json'            => json_encode(['slug' => 'depa', 'name' => 'Dep A']),
+            'configs/dependency.ini' => "[requires]\nmodules[] = \"depb >=9.9.9\"\n",
+        ]);
+        $this->plantAppModule('depb', [
+            'module.json' => json_encode(['slug' => 'depb', 'name' => 'Dep B']),   // no version
+        ]);
+
+        $this->assertSame([], Tiger_Module_Dependency::missing('depa'), 'no version known → no alarm');
+    }
+
+    // ---- dependents() ----------------------------------------------------------
+
+    #[Test]
+    public function dependentsNamesActiveModulesThatRequireTheSlug(): void
+    {
+        // depa and depd both require depb; depe requires something else. dependents(depb) = [depa, depd].
+        $this->plantAppModule('depa', [
+            'module.json'            => json_encode(['slug' => 'depa', 'name' => 'Dep A']),
+            'configs/dependency.ini' => "[requires]\nmodules[] = \"depb\"\n",
+        ]);
+        $this->plantAppModule('depd', [
+            'module.json'            => json_encode(['slug' => 'depd', 'name' => 'Dep D']),
+            'configs/dependency.ini' => "[requires]\nmodules[] = \"depb >=1.0\"\n",
+        ]);
+        $this->plantAppModule('depe', [
+            'module.json'            => json_encode(['slug' => 'depe', 'name' => 'Dep E']),
+            'configs/dependency.ini' => "[requires]\nmodules[] = \"something-else\"\n",
+        ]);
+        $this->plantAppModule('depb', [
+            'module.json' => json_encode(['slug' => 'depb', 'name' => 'Dep B', 'version' => '1.0.0']),
+        ]);
+
+        $dependents = Tiger_Module_Dependency::dependents('depb');
+        sort($dependents);
+        $this->assertSame(['depa', 'depd'], $dependents);
+    }
+
+    #[Test]
+    public function dependentsOfSomethingNobodyNeedsIsEmpty(): void
+    {
+        $this->plantAppModule('solo', [
+            'module.json' => json_encode(['slug' => 'solo', 'name' => 'Solo']),
+        ]);
+        $this->assertSame([], Tiger_Module_Dependency::dependents('solo'));
+    }
+
+    private function rrmdir(string $dir): void
+    {
+        if (!is_dir($dir)) { return; }
+        foreach (scandir($dir) ?: [] as $item) {
+            if ($item === '.' || $item === '..') { continue; }
+            $p = $dir . '/' . $item;
+            (is_dir($p) && !is_link($p)) ? $this->rrmdir($p) : @unlink($p);
+        }
+        @rmdir($dir);
+    }
+}
diff --git a/tests/Unit/Module/GithubTest.php b/tests/Unit/Module/GithubTest.php
new file mode 100644
index 0000000..d4dc81e
--- /dev/null
+++ b/tests/Unit/Module/GithubTest.php
@@ -0,0 +1,117 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Unit\Module;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\UnitTestCase;
+use Tiger_Module_Github;
+
+/**
+ * Tiger_Module_Github — the public-repo cURL reader the installer uses (no git, no token). Two halves:
+ *
+ *   - PURE URL logic: parseRepo() (URL/slug → org+repo, the input an installer trusts to derive a target)
+ *     and tarballUrl() (the codeload URL, with the ref rawurlencoded). parseRepo is a light security edge —
+ *     a garbage or path-traversal-shaped input must parse to null, never a bogus org/repo.
+ *   - The HTTP boundary (_http): exercised through its ERROR path against a dead local endpoint (connection
+ *     refused, no real network), so download()/get() return their documented null/false without hitting
+ *     GitHub. The success + JSON-parse bodies of fetchRaw()/latestRef() are genuine network calls and are
+ *     left to integration/live coverage — pinning them here would mean hammering github.com from a unit run.
+ */
+#[CoversClass(Tiger_Module_Github::class)]
+final class GithubTest extends UnitTestCase
+{
+    /** A closed local port — a connect here is refused instantly, so no test touches the real network. */
+    private const DEAD = 'http://127.0.0.1:9';
+
+    private string $tmp = '';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->tmp = sys_get_temp_dir() . '/tiger_gh_' . getmypid() . '_' . bin2hex(random_bytes(4));
+        @mkdir($this->tmp, 0775, true);
+    }
+
+    protected function tearDown(): void
+    {
+        $this->rrmdir($this->tmp);
+        parent::tearDown();
+    }
+
+    // ---- parseRepo -------------------------------------------------------------
+
+    #[Test]
+    public function parsesTheManyShapesOfARepoReference(): void
+    {
+        $cases = [
+            'https://github.com/WebTigers/TigerDocs'         => ['WebTigers', 'TigerDocs'],
+            'https://github.com/WebTigers/TigerDocs.git'     => ['WebTigers', 'TigerDocs'],
+            'https://github.com/WebTigers/TigerDocs/tree/main' => ['WebTigers', 'TigerDocs'],
+            'http://github.com/acme/thing#readme'            => ['acme', 'thing'],
+            'git@github.com:WebTigers/tiger-core.git'        => ['WebTigers', 'tiger-core'],
+            'WebTigers/tiger-core'                           => ['WebTigers', 'tiger-core'],
+            '  WebTigers/tiger-core  '                       => ['WebTigers', 'tiger-core'],   // trimmed
+        ];
+        foreach ($cases as $input => [$org, $repo]) {
+            $r = Tiger_Module_Github::parseRepo($input);
+            $this->assertNotNull($r, "should parse: {$input}");
+            $this->assertSame($org, $r['org'], "org of {$input}");
+            $this->assertSame($repo, $r['repo'], "repo of {$input}");
+        }
+    }
+
+    #[Test]
+    public function unrecognizedReferencesParseToNull(): void
+    {
+        foreach (['', 'not a url', 'https://gitlab.com/a/b', 'justonesegment', 'https://example.com/', 'a/b/c/d/e/f'] as $bad) {
+            $this->assertNull(Tiger_Module_Github::parseRepo($bad), 'should not parse: ' . var_export($bad, true));
+        }
+    }
+
+    // ---- tarballUrl ------------------------------------------------------------
+
+    #[Test]
+    public function tarballUrlBuildsCodeloadWithAnEncodedRef(): void
+    {
+        $this->assertSame(
+            'https://github.com/WebTigers/TigerDocs/archive/v1.2.3-beta.tar.gz',
+            Tiger_Module_Github::tarballUrl('WebTigers', 'TigerDocs', 'v1.2.3-beta')
+        );
+        // A ref with a slash (a branch like feature/x) is rawurlencoded so the URL stays well-formed.
+        $this->assertSame(
+            'https://github.com/o/r/archive/feature%2Fx.tar.gz',
+            Tiger_Module_Github::tarballUrl('o', 'r', 'feature/x')
+        );
+    }
+
+    // ---- the HTTP boundary (error path, no real network) -----------------------
+
+    #[Test]
+    public function getReturnsNullWhenTheEndpointIsUnreachable(): void
+    {
+        $this->assertNull(Tiger_Module_Github::get(self::DEAD . '/anything'));
+    }
+
+    #[Test]
+    public function downloadReturnsFalseAndLeavesNoFileWhenTheUrlFails(): void
+    {
+        $dest = $this->tmp . '/out.bin';
+        $this->assertFalse(Tiger_Module_Github::download(self::DEAD . '/pkg.tar.gz', $dest));
+        // The failed-download temp file is cleaned up by _http (no truncated artifact left behind).
+        $this->assertFileDoesNotExist($dest, 'a failed download must not leave a partial file');
+    }
+
+    private function rrmdir(string $dir): void
+    {
+        if (!is_dir($dir)) { return; }
+        foreach (scandir($dir) ?: [] as $item) {
+            if ($item === '.' || $item === '..') { continue; }
+            $p = $dir . '/' . $item;
+            (is_dir($p) && !is_link($p)) ? $this->rrmdir($p) : @unlink($p);
+        }
+        @rmdir($dir);
+    }
+}
diff --git a/tests/Unit/Update/CheckerTest.php b/tests/Unit/Update/CheckerTest.php
new file mode 100644
index 0000000..f97620a
--- /dev/null
+++ b/tests/Unit/Update/CheckerTest.php
@@ -0,0 +1,195 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Unit\Update;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\UnitTestCase;
+use Tiger_Update_Checker;
+use Tiger_Version;
+
+/**
+ * Tiger_Update_Checker — the "what has an update?" diff behind the WordPress-simple Updates screen.
+ *
+ * The remote checks (Packagist for core, GitHub for modules, a repo's CHANGELOG for notes) are file-cached,
+ * so this suite drives the decision logic with NO network by PRE-SEEDING that cache: a primed `core.json`
+ * makes core() decide update-or-not offline, and a primed notes cache makes notes() return without a fetch.
+ * The pure comparators/parsers — _descriptor()'s update flag, _stripV(), _sliceChangelog(), and the
+ * _cached() read-through — are pinned directly through a subclass exposer. The genuine HTTP bodies
+ * (_latestCore, the per-module latestRef loop) are integration/live territory and left uncovered here.
+ */
+#[CoversClass(Tiger_Update_Checker::class)]
+final class CheckerTest extends UnitTestCase
+{
+    /** @var string[] cache files this test wrote (removed in tearDown). */
+    private array $wrote = [];
+
+    protected function tearDown(): void
+    {
+        foreach ($this->wrote as $f) { @unlink($f); }
+        parent::tearDown();
+    }
+
+    private function cacheDir(): string
+    {
+        return UpdateCheckerProbe::cacheDir();
+    }
+
+    /** Prime a remote-check cache entry so the checker resolves it offline. */
+    private function primeCache(string $key, $value): void
+    {
+        $dir = $this->cacheDir();
+        @mkdir($dir, 0775, true);
+        $file = $dir . '/' . preg_replace('/[^a-z0-9._-]/i', '_', $key) . '.json';
+        file_put_contents($file, json_encode(['v' => $value]));
+        $this->wrote[] = $file;
+    }
+
+    // ---- _stripV ---------------------------------------------------------------
+
+    #[Test]
+    public function stripVDropsALeadingVAndTrims(): void
+    {
+        $this->assertSame('1.2.3', UpdateCheckerProbe::stripV('v1.2.3'));
+        $this->assertSame('2', UpdateCheckerProbe::stripV('  V2  '));
+        $this->assertSame('0.41.0-beta', UpdateCheckerProbe::stripV('0.41.0-beta'));
+    }
+
+    // ---- _descriptor : the update flag -----------------------------------------
+
+    #[Test]
+    public function descriptorFlagsAnUpdateOnlyWhenLatestExceedsInstalled(): void
+    {
+        $newer = UpdateCheckerProbe::descriptor('module', 'Widget', 'widget', '1.0.0', '1.4.0', 'installer', 'o/r', 'v1.4.0');
+        $this->assertTrue($newer['update']);
+        $this->assertSame('1.4.0', $newer['latest']);
+        $this->assertSame('1.0.0', $newer['installed']);
+
+        $same = UpdateCheckerProbe::descriptor('module', 'Widget', 'widget', '1.4.0', '1.4.0', 'installer', 'o/r', null);
+        $this->assertFalse($same['update']);
+
+        // A null "latest" (couldn't resolve) is not an update, and latest falls back to the installed version.
+        $unknown = UpdateCheckerProbe::descriptor('core', 'TigerCore', 'tiger-core', '2.0.0', null, 'manual', 'x', null);
+        $this->assertFalse($unknown['update']);
+        $this->assertSame('2.0.0', $unknown['latest']);
+    }
+
+    // ---- _sliceChangelog -------------------------------------------------------
+
+    #[Test]
+    public function sliceChangelogExtractsTheMatchingVersionSection(): void
+    {
+        $md = "# Changelog\n\n## [1.4.0] — 2026-01-01\n- Added a thing\n- Fixed a bug\n\n## [1.3.0] — 2025-12-01\n- Older\n";
+        $section = UpdateCheckerProbe::sliceChangelog($md, '1.4.0');
+        $this->assertSame("- Added a thing\n- Fixed a bug", $section, 'the heading is dropped; content stops at the next ##');
+
+        // A version with no section → null.
+        $this->assertNull(UpdateCheckerProbe::sliceChangelog($md, '9.9.9'));
+
+        // A present-but-empty section → null (nothing to show).
+        $empty = "## [2.0.0]\n\n## [1.0.0]\n- x\n";
+        $this->assertNull(UpdateCheckerProbe::sliceChangelog($empty, '2.0.0'));
+    }
+
+    // ---- _cached : read-through ------------------------------------------------
+
+    #[Test]
+    public function cachedWritesOnMissThenReadsWithoutReRunning(): void
+    {
+        $key = 'w4-cached-' . bin2hex(random_bytes(3));
+        $this->wrote[] = $this->cacheDir() . '/' . $key . '.json';
+
+        $calls = 0;
+        $fn = function () use (&$calls) { $calls++; return 'resolved-value'; };
+
+        $this->assertSame('resolved-value', UpdateCheckerProbe::cached($key, false, $fn));
+        $this->assertSame('resolved-value', UpdateCheckerProbe::cached($key, false, $fn));
+        $this->assertSame(1, $calls, 'the second read is served from the file cache, not re-run');
+    }
+
+    // ---- core() / all() / available() with a primed cache ----------------------
+
+    #[Test]
+    public function coreFlagsAnUpdateWhenPackagistIsNewer(): void
+    {
+        $this->primeCache('core', '99.0.0');   // pretend Packagist has a much newer release
+
+        $core = Tiger_Update_Checker::core();
+        $this->assertIsArray($core);
+        $this->assertSame('core', $core['type']);
+        $this->assertSame('tiger-core', $core['slug']);
+        $this->assertSame('TigerCore', $core['name']);
+        $this->assertSame(UpdateCheckerProbe::stripV(Tiger_Version::VERSION), $core['installed']);
+        $this->assertTrue($core['update']);
+        $this->assertContains($core['method'], ['composer', 'manual']);
+    }
+
+    #[Test]
+    public function coreShowsNoUpdateWhenTheLatestMatchesInstalled(): void
+    {
+        $this->primeCache('core', Tiger_Version::VERSION);
+        $core = Tiger_Update_Checker::core();
+        $this->assertFalse($core['update'], 'installed == latest → nothing to do');
+    }
+
+    #[Test]
+    public function allIncludesCoreAndAvailableFiltersToPendingOnly(): void
+    {
+        // In the unit harness there is no module inventory to diff (bySlugMap fails soft to []), so all()
+        // is just the core descriptor — enough to prove the aggregate + the available() filter.
+        $this->primeCache('core', '99.0.0');
+
+        $all = Tiger_Update_Checker::all();
+        $this->assertNotEmpty($all);
+        $core = array_values(array_filter($all, static fn ($u) => $u['type'] === 'core'));
+        $this->assertCount(1, $core);
+
+        $available = Tiger_Update_Checker::available();
+        $this->assertNotEmpty($available, 'the newer core should surface as available');
+        foreach ($available as $u) {
+            $this->assertTrue($u['update'], 'available() returns only items with a pending update');
+        }
+    }
+
+    #[Test]
+    public function availableIsEmptyWhenNothingIsStale(): void
+    {
+        $this->primeCache('core', Tiger_Version::VERSION);
+        $this->assertSame([], Tiger_Update_Checker::available());
+    }
+
+    // ---- notes() ---------------------------------------------------------------
+
+    #[Test]
+    public function notesReturnsNullWithoutARepositoryOrVersion(): void
+    {
+        $this->assertNull(Tiger_Update_Checker::notes(['slug' => 'x', 'latest' => '1.0.0']), 'no repository → null');
+        $this->assertNull(Tiger_Update_Checker::notes(['slug' => 'x', 'repository' => 'o/r', 'latest' => '']), 'no version → null');
+    }
+
+    #[Test]
+    public function notesServesAPrimedChangelogSectionOffline(): void
+    {
+        $u = ['slug' => 'widget', 'repository' => 'acme/widget', 'latest' => 'v1.4.0', 'ref' => 'v1.4.0'];
+        // notes() cache key: 'notes-<slug>-<strippedVersion>'.
+        $this->primeCache('notes-widget-1.4.0', "- Added a thing\n- Fixed a bug");
+
+        $this->assertSame("- Added a thing\n- Fixed a bug", Tiger_Update_Checker::notes($u));
+    }
+}
+
+/** Test seam: expose Tiger_Update_Checker's protected comparators/parsers + the cache dir. */
+final class UpdateCheckerProbe extends Tiger_Update_Checker
+{
+    public static function stripV($v): string { return self::_stripV($v); }
+    public static function cacheDir(): string { return self::_cacheDir(); }
+    public static function sliceChangelog($md, $version) { return self::_sliceChangelog($md, $version); }
+    public static function cached($key, $refresh, callable $fn) { return self::_cached($key, $refresh, $fn); }
+
+    public static function descriptor($type, $name, $slug, $installed, $latest, $method, $repository, $ref): array
+    {
+        return self::_descriptor($type, $name, $slug, $installed, $latest, $method, $repository, $ref);
+    }
+}
diff --git a/tests/Unit/VendorProvisionTest.php b/tests/Unit/VendorProvisionTest.php
new file mode 100644
index 0000000..ce361f3
--- /dev/null
+++ b/tests/Unit/VendorProvisionTest.php
@@ -0,0 +1,272 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\UnitTestCase;
+use Tiger_Vendor;
+use Tiger_Vendor_Environment;
+
+/**
+ * Tiger_Vendor — the tier-picking provisioner, driven WITHOUT a network. VendorTest already pins the
+ * semver matcher + the SHA-256 gate; this covers the rest of the reachable surface:
+ *
+ *   - ensure()'s tier selection: the no-name guard, a Tier-3 source tarball (generate_autoload), a Tier-2
+ *     declared bundle, the registry-index tier (_resolveFromIndex / _registryIndex / _registryUrl), the
+ *     already-present dedup, and the ONE-VERSION conflict report (the security-relevant "we keep one shared
+ *     copy" rule — a genuine disagreement is reported, never silently double-installed).
+ *   - isInstalled() / installedVersion() (reads a bundle's bundle.json).
+ *   - installAsset() into a module's own assets dir (front-end deps), incl. the idempotent + error branches.
+ *   - registerAutoloaders() wiring a stored lib's autoload.php.
+ *
+ * Downloads use `file://` URLs (cURL serves them locally — see VendorTest), so nothing leaves the box.
+ * Every write lands in the real shared store (APPLICATION_ROOT/vendor-libs); tearDown removes ONLY the
+ * test packages this suite created, never a pre-existing store.
+ */
+#[CoversClass(Tiger_Vendor::class)]
+final class VendorProvisionTest extends UnitTestCase
+{
+    private string $tmp = '';
+    private bool $storePreExisted = false;
+    /** Store slugs this test created (removed in tearDown). */
+    private array $slugs = ['test-lib', 'test-bundle', 'test-idx', 'test-auto'];
+
+    /**
+     * A class-scoped, persistent registry index + its referenced bundle. Tiger_Vendor::_registryIndex()
+     * caches the fetched index in a function-static for the whole PROCESS, so the FIRST test to touch it
+     * fixes the index for the run — it must therefore live in a stable dir that outlives any one test's
+     * tmp (whose file:// url would otherwise dangle after that test's tearDown). Every test points the
+     * resolver here (via the env override in setUp), so no test ever reaches the real network default.
+     */
+    private static string $regDir = '';
+
+    public static function setUpBeforeClass(): void
+    {
+        self::$regDir = sys_get_temp_dir() . '/tiger_vprov_reg_' . getmypid() . '_' . bin2hex(random_bytes(4));
+        @mkdir(self::$regDir, 0775, true);
+        // A persistent bundle for test/idx (version 3.2.0), and an index that lists two versions of it.
+        $tar  = self::$regDir . '/idx.tar';
+        $phar = new \PharData($tar);
+        $phar->addFromString('test-idx/src/Widget.php', "<?php\nnamespace TestVendorLib;\nclass IdxWidget {}\n");
+        $phar->addFromString('test-idx/bundle.json', json_encode(['version' => '3.2.0']));
+        $phar->addFromString('test-idx/autoload.php', "<?php\n");
+        $phar->compress(\Phar::GZ);
+        unset($phar);
+        file_put_contents(self::$regDir . '/bundles.json', json_encode(['bundles' => [
+            'test/idx' => [
+                ['version' => '3.1.0', 'url' => 'file://' . $tar . '.gz'],
+                ['version' => '3.2.0', 'url' => 'file://' . $tar . '.gz'],   // newest satisfying pick
+            ],
+        ]]));
+    }
+
+    public static function tearDownAfterClass(): void
+    {
+        self::rrmdirStatic(self::$regDir);
+    }
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->tmp = sys_get_temp_dir() . '/tiger_vprov_' . getmypid() . '_' . bin2hex(random_bytes(4));
+        @mkdir($this->tmp, 0775, true);
+        $this->storePreExisted = is_dir(Tiger_Vendor_Environment::storeDir());
+        // Aim the registry resolver at the persistent test index — no real network, stable across the run.
+        putenv('TIGER_VENDOR_REGISTRY=file://' . self::$regDir . '/bundles.json');
+    }
+
+    protected function tearDown(): void
+    {
+        putenv('TIGER_VENDOR_REGISTRY');   // clear any registry override we set
+        $store = Tiger_Vendor_Environment::storeDir();
+        if (!$this->storePreExisted && is_dir($store)) {
+            $this->rrmdir($store);
+        } else {
+            foreach ($this->slugs as $slug) { $this->rrmdir($store . '/' . $slug); }
+        }
+        $this->rrmdir($this->tmp);
+        parent::tearDown();
+    }
+
+    // ---- ensure(): guards + tiers ----------------------------------------------
+
+    #[Test]
+    public function ensureWithoutANameFails(): void
+    {
+        $r = Tiger_Vendor::ensure([]);
+        $this->assertFalse($r['ok']);
+        $this->assertSame('none', $r['tier']);
+    }
+
+    #[Test]
+    public function ensureInstallsFromASourceTarballAndGeneratesAnAutoloader(): void
+    {
+        // Tier 3: a raw source tarball (no constraint, no bundle) → install + a generated autoload.php.
+        $tar = $this->makeLibTarGz('test-auto', withComposerJson: true);
+
+        $r = Tiger_Vendor::ensure(['name' => 'test/auto', 'tarball' => 'file://' . $tar]);
+        $this->assertTrue($r['ok'], $r['message'] ?? '');
+        $this->assertSame('tarball', $r['tier']);
+
+        $dir = Tiger_Vendor_Environment::storeDir() . '/test-auto';
+        $this->assertDirectoryExists($dir);
+        $this->assertFileExists($dir . '/autoload.php', 'a raw lib gets a generated autoloader');
+        $this->assertTrue(Tiger_Vendor::isInstalled('test/auto'));
+    }
+
+    #[Test]
+    public function ensureInstallsFromADeclaredBundleThenReusesItAndReportsAConflict(): void
+    {
+        // Tier 2: a declared bundle carrying bundle.json (version 1.0.0).
+        $tar = $this->makeLibTarGz('test-bundle', bundleVersion: '1.0.0');
+
+        $r = Tiger_Vendor::ensure(['name' => 'test/bundle', 'bundle' => 'file://' . $tar, 'constraint' => '^1.0']);
+        $this->assertTrue($r['ok'], $r['message'] ?? '');
+        $this->assertSame('bundle', $r['tier']);
+        $this->assertSame('1.0.0', Tiger_Vendor::installedVersion('test/bundle'));
+
+        // Already present + the constraint still holds → reused (dedup), not re-downloaded.
+        $reuse = Tiger_Vendor::ensure(['name' => 'test/bundle', 'constraint' => '^1.0']);
+        $this->assertTrue($reuse['ok']);
+        $this->assertSame('present', $reuse['tier']);
+
+        // A constraint the installed copy does NOT satisfy → a reported conflict (one-version rule), NOT ok.
+        $conflict = Tiger_Vendor::ensure(['name' => 'test/bundle', 'constraint' => '^2.0']);
+        $this->assertFalse($conflict['ok']);
+        $this->assertSame('conflict', $conflict['tier']);
+        $this->assertStringContainsString('conflict', strtolower($conflict['message']));
+    }
+
+    #[Test]
+    public function ensureResolvesABundleFromTheRegistryIndex(): void
+    {
+        // The persistent test index (setUpBeforeClass) lists test/idx @ 3.1.0 + 3.2.0 → resolve the newest
+        // satisfying version and install it. Covers _resolveFromIndex / _registryIndex / _registryUrl (env).
+        $r = Tiger_Vendor::ensure(['name' => 'test/idx', 'constraint' => '^3.0']);
+        $this->assertTrue($r['ok'], $r['message'] ?? '');
+        $this->assertSame('bundle', $r['tier']);
+        $this->assertStringContainsString('3.2.0', $r['message'], 'it picks the newest satisfying version');
+        $this->assertSame('3.2.0', Tiger_Vendor::installedVersion('test/idx'));
+    }
+
+    #[Test]
+    public function ensureFailsClosedWhenNoTierCanProvide(): void
+    {
+        // No composer, no bundle/tarball, and the registry has nothing for this name → fail closed.
+        $r = Tiger_Vendor::ensure(['name' => 'nobody/here', 'constraint' => '^1.0']);
+        $this->assertFalse($r['ok']);
+        $this->assertSame('none', $r['tier']);
+    }
+
+    // ---- installAsset() : front-end deps into a module dir ---------------------
+
+    #[Test]
+    public function installAssetCopiesIncludedFilesAndIsIdempotent(): void
+    {
+        $tar = $this->makeAssetTarGz();   // contains dist/widget.js + dist/widget.css
+        $moduleDir = $this->tmp . '/mymodule';
+        @mkdir($moduleDir, 0775, true);
+
+        // Concrete include paths (not globs): the idempotency check keys on each include's BASENAME.
+        $asset = ['name' => 'widget', 'tarball' => 'file://' . $tar, 'target' => 'assets/vendor', 'include' => ['dist/widget.js', 'dist/widget.css']];
+        $r = Tiger_Vendor::installAsset($asset, $moduleDir);
+        $this->assertTrue($r['ok'], $r['message'] ?? '');
+        $this->assertFileExists($moduleDir . '/assets/vendor/widget.js');
+        $this->assertFileExists($moduleDir . '/assets/vendor/widget.css');
+
+        // Idempotent: a second call sees the basenames already present and no-ops "Already present".
+        $again = Tiger_Vendor::installAsset($asset, $moduleDir);
+        $this->assertTrue($again['ok']);
+        $this->assertStringContainsString('Already present', $again['message']);
+    }
+
+    #[Test]
+    public function installAssetRejectsAnUnderspecifiedAsset(): void
+    {
+        $r = Tiger_Vendor::installAsset(['name' => 'x'], $this->tmp);   // no url/target/include
+        $this->assertFalse($r['ok']);
+        $this->assertStringContainsString('include', strtolower($r['message']));
+    }
+
+    #[Test]
+    public function installAssetReportsWhenNothingMatchesInclude(): void
+    {
+        $tar = $this->makeAssetTarGz();
+        $moduleDir = $this->tmp . '/mod2';
+        @mkdir($moduleDir, 0775, true);
+        $r = Tiger_Vendor::installAsset(
+            ['name' => 'widget', 'tarball' => 'file://' . $tar, 'target' => 'assets/x', 'include' => ['dist/nope.*']],
+            $moduleDir
+        );
+        $this->assertFalse($r['ok']);
+        $this->assertStringContainsString('No files matched', $r['message']);
+    }
+
+    // ---- registerAutoloaders() -------------------------------------------------
+
+    #[Test]
+    public function registerAutoloadersRequiresEveryStoredLibsAutoloader(): void
+    {
+        // Install a lib whose generated autoload.php maps a PSR-4 prefix; then registerAutoloaders() wires it
+        // and the class resolves.
+        $tar = $this->makeLibTarGz('test-lib', withComposerJson: true, psr4: ['TestVendorLib\\' => 'src/']);
+        Tiger_Vendor::ensure(['name' => 'test/lib', 'tarball' => 'file://' . $tar]);
+
+        Tiger_Vendor::registerAutoloaders();
+        $this->assertTrue(class_exists('TestVendorLib\\Widget'), 'the stored lib autoloader should resolve its class');
+    }
+
+    // ---- helpers ---------------------------------------------------------------
+
+    /**
+     * Build a .tar.gz of a library, wrapped in a single top dir (as GitHub/source tarballs are), and
+     * return its path. Optionally ship a composer.json (for autoload generation) and/or a bundle.json.
+     */
+    private function makeLibTarGz(string $top, bool $withComposerJson = false, ?string $bundleVersion = null, array $psr4 = ['TestVendorLib\\' => 'src/']): string
+    {
+        $base = $this->tmp . '/' . $top . '_' . bin2hex(random_bytes(3)) . '.tar';
+        $phar = new \PharData($base);
+        $phar->addFromString($top . '/src/Widget.php', "<?php\nnamespace TestVendorLib;\nclass Widget {}\n");
+        if ($withComposerJson) {
+            $phar->addFromString($top . '/composer.json', json_encode(['autoload' => ['psr-4' => $psr4]]));
+        }
+        if ($bundleVersion !== null) {
+            $phar->addFromString($top . '/bundle.json', json_encode(['version' => $bundleVersion]));
+            $phar->addFromString($top . '/autoload.php', "<?php\n// shipped bundle autoloader\n");
+        }
+        $phar->compress(\Phar::GZ);
+        unset($phar);
+        return $base . '.gz';
+    }
+
+    /** A .tar.gz of a front-end asset package (dist/widget.js + dist/widget.css), single top dir. */
+    private function makeAssetTarGz(): string
+    {
+        $base = $this->tmp . '/asset_' . bin2hex(random_bytes(3)) . '.tar';
+        $phar = new \PharData($base);
+        $phar->addFromString('pkg/dist/widget.js', "console.log('w');\n");
+        $phar->addFromString('pkg/dist/widget.css', ".w{}\n");
+        $phar->compress(\Phar::GZ);
+        unset($phar);
+        return $base . '.gz';
+    }
+
+    private function rrmdir(string $dir): void
+    {
+        self::rrmdirStatic($dir);
+    }
+
+    private static function rrmdirStatic(string $dir): void
+    {
+        if (!is_dir($dir)) { return; }
+        foreach (scandir($dir) ?: [] as $item) {
+            if ($item === '.' || $item === '..') { continue; }
+            $p = $dir . '/' . $item;
+            (is_dir($p) && !is_link($p)) ? self::rrmdirStatic($p) : @unlink($p);
+        }
+        @rmdir($dir);
+    }
+}