diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9f1eb41..5aac826 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -108,7 +108,7 @@ jobs:
       TIGER_TEST_DB_PASS: root
       # The floor we enforce today (report-only warning above it). Bump this as coverage climbs so it
       # can only go UP — the ratchet that gets us to 90% without ever regressing.
-      MIN_COVERAGE: '55'
+      MIN_COVERAGE: '66'
     steps:
       - uses: actions/checkout@v4
 
diff --git a/modules/backup/controllers/IndexController.php b/modules/backup/controllers/IndexController.php
index 8b95a8b..24a308e 100644
--- a/modules/backup/controllers/IndexController.php
+++ b/modules/backup/controllers/IndexController.php
@@ -78,19 +78,19 @@ public function uploadAction()
         $response = $this->getResponse();
         $response->setHeader('Content-Type', 'application/json', true);
 
-        if (($this->getParam('confirm', '')) !== 'RESTORE') { $response->setBody($this->_json(0, 'backup.restore.confirm')); return; }
+        if (($this->getParam('confirm', '')) !== 'RESTORE') { $response->setBody($this->_jsonBody(0, 'backup.restore.confirm')); return; }
         $file = $_FILES['archive'] ?? null;
-        if (!$file || ($file['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) { $response->setBody($this->_json(0, 'backup.upload.failed')); return; }
+        if (!$file || ($file['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) { $response->setBody($this->_jsonBody(0, 'backup.upload.failed')); return; }
 
         $dir = APPLICATION_ROOT . '/var/backup';
         @is_dir($dir) || @mkdir($dir, 0775, true);
         $tmp = $dir . '/upload-' . bin2hex(random_bytes(4)) . '.zip';
-        if (!@move_uploaded_file($file['tmp_name'], $tmp)) { $response->setBody($this->_json(0, 'backup.upload.failed')); return; }
+        if (!@move_uploaded_file($file['tmp_name'], $tmp)) { $response->setBody($this->_jsonBody(0, 'backup.upload.failed')); return; }
 
         // Validate it's a TigerBackup archive before doing anything destructive.
         if (Tiger_Backup_Archive::read($tmp, 'manifest.json') === false) {
             @unlink($tmp);
-            $response->setBody($this->_json(0, 'backup.upload.invalid'));
+            $response->setBody($this->_jsonBody(0, 'backup.upload.invalid'));
             return;
         }
 
@@ -103,9 +103,9 @@ public function uploadAction()
         @unlink($tmp);
 
         if (($res['status'] ?? '') === 'ok') {
-            $response->setBody($this->_json(1, 'backup.restore.done', ['restored' => $res['restored']]));
+            $response->setBody($this->_jsonBody(1, 'backup.restore.done', ['restored' => $res['restored']]));
         } else {
-            $response->setBody($this->_json(0, APPLICATION_ENV !== 'production' ? ('Restore failed: ' . ($res['error'] ?? '')) : 'backup.restore.failed'));
+            $response->setBody($this->_jsonBody(0, APPLICATION_ENV !== 'production' ? ('Restore failed: ' . ($res['error'] ?? '')) : 'backup.restore.failed'));
         }
     }
 
@@ -133,7 +133,7 @@ protected function _settings(): array
     }
 
     /** Minimal JSON envelope for the two non-service actions (message key is translated client-side-agnostic). */
-    protected function _json(int $result, string $messageKey, array $data = []): string
+    protected function _jsonBody(int $result, string $messageKey, array $data = []): string
     {
         $t = Zend_Registry::isRegistered('Zend_Translate') ? Zend_Registry::get('Zend_Translate') : null;
         $msg = $t ? $t->translate($messageKey) : $messageKey;
diff --git a/tests/COVERAGE-PLAN.md b/tests/COVERAGE-PLAN.md
index 9e24a5c..0ba76ad 100644
--- a/tests/COVERAGE-PLAN.md
+++ b/tests/COVERAGE-PLAN.md
@@ -609,6 +609,24 @@ provider/authority/GA/reCAPTCHA live HTTP, ClamAV/Rekognition scanners, AWS-SDK
   mints `MODULES_PATH` etc. → the app-boot test runs `#[RunInSeparateProcess]`. **RECOMMENDED base hygiene (deferred):** reset
   `Org::$_siteOrgId` in `IntegrationTestCase::tearDown`. CI floor `MIN_COVERAGE` 35 → 55.
 
+### Wave 6 — remaining modules + the dispatch harness (LANDED 2026-07-24) → coverage 59.2% → 70.0%
+First landed a **controller dispatch harness** (`tests/Support/ControllerTestCase.php`, PR #66): instantiates a
+controller + dispatches ONE action with view-rendering OFF, so the action BODY runs (branch logic, `_json` body,
+redirect/`_forward`) without the theme/view-script stack — unlocking `core/controllers` (0% before). Then 5 agents:
+core-controllers 0→**87%** (all 6: Api 80, Auth 79, Error 95, Index 87, Page 98, Admin 91), cms 33→**94**, code 41→**90**,
+agent module 6→**66-78**, system 37→**59**, + a module-controller sweep (profile 68, access 84, media/analytics/identity/
+blog/signup/search/schedule controllers 90-100%). ~167 tests; combined suite **1617 green**.
+- **REAL BUG FIXED (a test found it):** `Backup_IndexController::_json(int,string,array):string` was an INCOMPATIBLE
+  override of `Tiger_Controller_Action::_json($data,$status)` → a PHP 8.5 **fatal at class load**, so EVERY `/backup`
+  request 500'd (the backup admin UI was entirely broken). Renamed the helper to `_jsonBody()`; replaced the
+  characterization test with real dispatch coverage.
+- **Harness hardening (3 agents hit it):** folded `redirector->setExit(false)` into `ControllerTestCase` setUp (the
+  redirector `exit`s after headers by default → would kill the PHPUnit process on a controller redirect).
+- CI floor 55 → 66. Ceilings (bounded honestly, not chased): `Updates::_applyOne` would run a real `composer update`/
+  `vendor/` swap on a dev box (covered at guard level only); `is_uploaded_file()` uploads; live-model agent turns;
+  render-only `.phtml` leaves; `pcov` under-reports module `elements()` forms (multi-line-array-literal artifact).
+
+### Next waves (priority order) — the drive to 90%
 ### Next waves (priority order) — the drive to 90%
 - **Wave 6 — the remaining MODULES:** `agent` module (462 @ 5% — needs a provider-adapter stub, but the `Tiger_Agent_*`
   library it builds on is now ~72% so the seams exist), `cms` module (510 @ 33%), `system` remainder (579 @ 37%), `code`
diff --git a/tests/Integration/Access/ControllersTest.php b/tests/Integration/Access/ControllersTest.php
new file mode 100644
index 0000000..15a3963
--- /dev/null
+++ b/tests/Integration/Access/ControllersTest.php
@@ -0,0 +1,104 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Access;
+
+use Access_OrgController;
+use Access_UserController;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\ModuleControllerTestCase;
+use Tiger_Model_Org;
+use Tiger_Model_User;
+
+/**
+ * The two Access admin controllers — Users and Organizations. Each is thin: index renders the
+ * DataTables shell (useDataTables flag), edit renders the identity/org form (create when no id,
+ * prefilled when an id resolves to a row). The harness dispatches each action rendering-off and asserts
+ * the view model — covering both the new-record and the edit-prefill branch.
+ */
+#[CoversClass(Access_UserController::class)]
+#[CoversClass(Access_OrgController::class)]
+final class ControllersTest extends ModuleControllerTestCase
+{
+    #[Test]
+    public function user_index_renders_the_datatables_shell(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Access_UserController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Users', (string) $view->title);
+        $this->assertTrue((bool) $view->useDataTables);
+    }
+
+    #[Test]
+    public function user_edit_renders_a_blank_form_for_a_new_user(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Access_UserController::class, 'edit', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('New User', (string) $view->title);
+        $this->assertInstanceOf(\Access_Form_User::class, $view->form);
+        $this->assertNull($view->user);
+    }
+
+    #[Test]
+    public function user_edit_prefills_the_form_for_an_existing_user(): void
+    {
+        $id = (new Tiger_Model_User())->insert([
+            'email'    => 'edituser@example.test',
+            'username' => 'edituser',
+            'status'   => 'active',
+        ]);
+        $this->loginAs('admin');
+        $this->dispatchAction(Access_UserController::class, 'edit', ['id' => $id], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Edit User', (string) $view->title);
+        $this->assertNotNull($view->user);
+        $this->assertSame('edituser@example.test', $view->form->getValues()['email']);
+    }
+
+    #[Test]
+    public function org_index_renders_the_datatables_shell(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Access_OrgController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Organizations', (string) $view->title);
+        $this->assertTrue((bool) $view->useDataTables);
+    }
+
+    #[Test]
+    public function org_edit_renders_a_blank_form_for_a_new_org(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Access_OrgController::class, 'edit', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('New Organization', (string) $view->title);
+        $this->assertInstanceOf(\Access_Form_Org::class, $view->form);
+        $this->assertNull($view->org);
+    }
+
+    #[Test]
+    public function org_edit_prefills_the_form_for_an_existing_org(): void
+    {
+        $id = (new Tiger_Model_Org())->insert([
+            'name'   => 'Edit Org',
+            'slug'   => 'edit-org-' . substr(md5((string) mt_rand()), 0, 8),
+            'status' => 'active',
+        ]);
+        $this->loginAs('admin');
+        $this->dispatchAction(Access_OrgController::class, 'edit', ['id' => $id], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Edit Organization', (string) $view->title);
+        $this->assertNotNull($view->org);
+        $this->assertSame('Edit Org', $view->form->getValues()['name']);
+    }
+}
diff --git a/tests/Integration/Agent/AdminControllerTest.php b/tests/Integration/Agent/AdminControllerTest.php
new file mode 100644
index 0000000..d179d89
--- /dev/null
+++ b/tests/Integration/Agent/AdminControllerTest.php
@@ -0,0 +1,93 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Agent;
+
+use Agent_AdminController;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\ControllerTestCase;
+use Tiger_Agent_Provider_Factory;
+use Zend_Config;
+use Zend_Registry;
+use Zend_Session;
+use Zend_Translate;
+
+/**
+ * Agent_AdminController — the TigerAgent settings screen shell (Wave 6).
+ *
+ * A thin admin controller: it prefills the settings form from live config and hands the view the
+ * provider roster + the connected/enabled/crypto-ready flags; the actual save is the `/api` call to
+ * Agent_Service_Settings (covered by SettingsServiceTest). We dispatch `indexAction` with rendering
+ * off (ControllerTestCase) and assert the view vars the `.phtml` reads — the branch/assignment logic,
+ * not the markup.
+ */
+#[CoversClass(Agent_AdminController::class)]
+final class AdminControllerTest extends ControllerTestCase
+{
+    private bool $priorUnitTestMode;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        // The admin base controller resolves the FlashMessenger helper (a session); run in ZF session
+        // unit-test mode so no real session is started in CLI.
+        $this->priorUnitTestMode = Zend_Session::$_unitTestEnabled;
+        Zend_Session::$_unitTestEnabled = true;
+        $_SESSION = [];
+
+        // The action titles the page via the registered translator; provide a minimal one.
+        Zend_Registry::set('Zend_Translate', new Zend_Translate([
+            'adapter' => 'array',
+            'content' => ['agent.settings.title' => 'AI Agent'],
+            'locale'  => 'en',
+        ]));
+        Zend_Registry::set('Zend_Config', new Zend_Config([], true));
+    }
+
+    protected function tearDown(): void
+    {
+        $_SESSION = [];
+        Zend_Session::$_unitTestEnabled = $this->priorUnitTestMode;
+        parent::tearDown();
+    }
+
+    #[Test]
+    public function index_prefills_the_form_and_exposes_the_settings_view_model(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Agent_AdminController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+
+        $this->assertStringContainsString('AI Agent', (string) $view->title, 'the title runs through the translator');
+        $this->assertInstanceOf(\Agent_Form_Settings::class, $view->form, 'the settings form is handed to the view');
+
+        // The provider roster the dropdown renders is the live factory options.
+        $this->assertSame(Tiger_Agent_Provider_Factory::options(), $view->providers);
+        $this->assertArrayHasKey('anthropic', (array) $view->providers);
+
+        // Prefill + capability flags the view branches on.
+        $this->assertSame('anthropic', $view->provider, 'defaults to anthropic with no stored provider');
+        $this->assertNotSame('', (string) $view->model, 'a default model is offered');
+        $this->assertIsBool($view->enabled);
+        $this->assertIsBool($view->connected);
+        $this->assertIsBool($view->cryptoReady);
+        $this->assertContains($view->modeMax, ['ask', 'auto', 'yolo']);
+    }
+
+    #[Test]
+    public function index_reflects_stored_provider_and_model_config(): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config([
+            'tiger' => ['agent' => ['provider' => 'openai', 'model' => 'gpt-4o']],
+        ], true));
+        $this->loginAs('admin');
+        $this->dispatchAction(Agent_AdminController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertSame('openai', $view->provider, 'the stored provider is surfaced');
+        $this->assertSame('gpt-4o', $view->model, 'the stored model is surfaced');
+    }
+}
diff --git a/tests/Integration/Agent/AgentServiceTest.php b/tests/Integration/Agent/AgentServiceTest.php
new file mode 100644
index 0000000..b520d2a
--- /dev/null
+++ b/tests/Integration/Agent/AgentServiceTest.php
@@ -0,0 +1,419 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Agent;
+
+use Agent_Model_Attachment;
+use Agent_Service_Agent;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Crypto;
+use Tiger_Model_AgentConversation;
+use Tiger_Model_AgentMessage;
+use Tiger_Model_AgentRun;
+use Zend_Config;
+use Zend_Registry;
+
+/**
+ * A subclass that exposes the protected turn helpers so they can be exercised without the live model
+ * call (which the turn dispatch requires and this harness cannot stub — no seam past Factory::make).
+ * Constructed with an empty message so the base constructor dispatches nothing.
+ */
+final class ExposedAgentService extends Agent_Service_Agent
+{
+    public function ctx(array $p): array { return $this->_context($p); }
+    public function take(array $p): array { return $this->_takeAttachments($p); }
+    public function mime(string $tmp, string $ext): string { return $this->_mime($tmp, $ext); }
+    public function dom($raw): string { return $this->_domFeedback($raw); }
+    public function resolve(string $id) { return $this->_resolveConversation($id); }
+    public function role(): string { return $this->_role(); }
+}
+
+/**
+ * Agent_Service_Agent — the aside's turn-engine `/api` service (Wave 6).
+ *
+ * Covered hermetically: the `_ready` gate (deny-by-default for a role below `manager`; the
+ * unconfigured error when the feature is off / no key), form validation, `approve` end to end (run
+ * lookup + owner scoping, ledger decode + index parsing, the Forge-gated execution loop, status
+ * computation, the assistant-message meta re-sync), `conversations` + `history` (owner-scoped reads,
+ * the rotated-CSRF success envelope), `uploadFile`'s guard, and the turn helpers via a subclass
+ * (`_context` sanitize, `_takeAttachments` owner scoping, `_mime`, `_domFeedback`, `_resolveConversation`).
+ *
+ * BOUNDARY (see WAVE6-FINDINGS-agentmod.md): a SUCCESSFUL turn (`send` / `resume`) runs
+ * Tiger_Agent_Loop → a live provider HTTP call, and the Loop builds its adapter through
+ * Tiger_Agent_Provider_Factory::make() with no injection seam — so the turn itself is not driven here
+ * (mirroring ForgeAclTest, which likewise treats the live dispatch as the boundary). `approve`'s
+ * best-effort follow-up turn is kept off the network by pointing the run at a dangling conversation.
+ */
+#[CoversClass(Agent_Service_Agent::class)]
+final class AgentServiceTest extends IntegrationTestCase
+{
+    use EnsuresAttachmentTable;
+
+    private const CRYPTO_KEY = 'MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->ensureAttachmentTable();
+        Zend_Registry::set('tiger.auth.stateless', true);   // CSRF-immune API path (no session in CLI)
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    public static function tearDownAfterClass(): void
+    {
+        self::dropAttachmentTable();   // never leave the side-loaded table for InstallerLifecycleTest
+        parent::tearDownAfterClass();
+    }
+
+    /** Switch the agent ON + connected (feature flag + an encrypted BYO key crypto can read). */
+    private function enableAgent(): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => ['crypto' => ['key' => self::CRYPTO_KEY]]], true));
+        $enc = Tiger_Crypto::encrypt('sk-test-key');
+        Zend_Registry::set('Zend_Config', new Zend_Config([
+            'tiger' => [
+                'crypto' => ['key' => self::CRYPTO_KEY],
+                'agent'  => ['enabled' => '1', 'api_key_enc' => $enc, 'mode_max' => 'auto'],
+            ],
+        ], true));
+    }
+
+    /** Dispatch the real service and hand back the response object. */
+    private function call(string $action, array $params = []): object
+    {
+        return (new Agent_Service_Agent(['action' => $action] + $params))->getResponse();
+    }
+
+    // ===== the _ready gate ========================================================================
+
+    #[Test]
+    public function a_role_below_manager_is_denied_every_action(): void
+    {
+        $this->enableAgent();
+        foreach (['guest', 'user'] as $role) {
+            $this->loginAs($role);
+            foreach (['send', 'approve', 'resume', 'conversations', 'history', 'uploadFile'] as $action) {
+                $res = $this->call($action);
+                $this->assertSame(0, (int) $res->result, "{$role} denied on {$action}");
+                $this->assertStringContainsString('not_allowed', json_encode($res->messages), "{$role}/{$action} denial");
+            }
+        }
+    }
+
+    #[Test]
+    public function an_allowed_role_is_told_the_agent_is_unconfigured_when_off(): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config([], true));   // feature explicitly OFF (no leaked enable)
+        $this->loginAs('manager');   // may chat, but the feature is off / no key
+        $res = $this->call('conversations');
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('unconfigured', json_encode($res->messages));
+    }
+
+    // ===== send / resume — the validation surface (the turn itself is the live boundary) ==========
+
+    #[Test]
+    public function send_rejects_an_empty_message_with_form_errors(): void
+    {
+        $this->enableAgent();
+        $this->loginAs('manager');
+        $res = $this->call('send', ['message' => '   ']);   // trims to empty → the required validator fires
+        $this->assertSame(0, (int) $res->result);
+        $this->assertNotNull($res->form);
+        $this->assertArrayHasKey('message', (array) $res->form);
+    }
+
+    #[Test]
+    public function resume_requires_a_conversation_id_then_scopes_to_the_owner(): void
+    {
+        $this->enableAgent();
+        $this->loginAs('manager');
+
+        $missing = $this->call('resume');            // no conversation_id → form error
+        $this->assertSame(0, (int) $missing->result);
+        $this->assertArrayHasKey('conversation_id', (array) $missing->form);
+
+        $notMine = $this->call('resume', ['conversation_id' => 'not-a-real-conversation', 'results' => '[]']);
+        $this->assertSame(0, (int) $notMine->result, 'a conversation the caller does not own is refused');
+        $this->assertStringContainsString('run_missing', json_encode($notMine->messages));
+    }
+
+    // ===== conversations + history (owner-scoped reads + rotated-CSRF envelope) ====================
+
+    #[Test]
+    public function conversations_lists_the_callers_threads_newest_first_with_a_fresh_csrf(): void
+    {
+        $this->enableAgent();
+        $this->loginAs('manager');   // user-manager / org-test
+        $conv = new Tiger_Model_AgentConversation();
+        $conv->start('org-test', 'user-manager', 'First thread',  'anthropic', 'claude-sonnet-5');
+        $conv->start('org-test', 'user-manager', '',              'anthropic', 'claude-sonnet-5');   // titleless
+        $conv->start('org-test', 'user-other',   'Someone else',  'anthropic', 'claude-sonnet-5');   // another owner
+
+        $res = $this->call('conversations');
+        $this->assertSame(1, (int) $res->result);
+        $titles = array_column($res->data['conversations'], 'title');
+        $this->assertContains('First thread', $titles);
+        $this->assertContains('New chat', $titles, 'a titleless thread renders as "New chat"');
+        $this->assertNotContains('Someone else', $titles, "another user's thread never appears");
+        $this->assertArrayHasKey('_csrf', $res->data, 'every success rotates a fresh Agent CSRF token');
+    }
+
+    #[Test]
+    public function history_returns_a_transcript_for_an_owned_thread_and_refuses_others(): void
+    {
+        $this->enableAgent();
+        $this->loginAs('manager');
+
+        $conv = new Tiger_Model_AgentConversation();
+        $id   = $conv->start('org-test', 'user-manager', 'Chat', 'anthropic', 'claude-sonnet-5');
+        $msg  = new Tiger_Model_AgentMessage();
+        $msg->append($id, Tiger_Model_AgentMessage::ROLE_USER, 'hello');
+        $msg->append($id, Tiger_Model_AgentMessage::ROLE_ASSISTANT, 'hi there', ['done' => true]);
+
+        $res = $this->call('history', ['conversation_id' => $id]);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame($id, $res->data['conversation_id']);
+        $this->assertCount(2, $res->data['messages']);
+        $this->assertSame('user', $res->data['messages'][0]['role']);
+        $this->assertSame('hi there', $res->data['messages'][1]['content']);
+        $this->assertIsArray($res->data['messages'][1]['meta'], 'the assistant meta decodes back to an array');
+
+        $notMine = $this->call('history', ['conversation_id' => 'nope']);
+        $this->assertSame(0, (int) $notMine->result);
+        $this->assertStringContainsString('run_missing', json_encode($notMine->messages));
+    }
+
+    // ===== uploadFile — the guard (the store seam is the CLI boundary; see findings) ==============
+
+    #[Test]
+    public function uploadFile_fails_cleanly_when_no_file_was_posted(): void
+    {
+        $this->enableAgent();
+        $this->loginAs('manager');
+        // is_uploaded_file() is false for anything not arriving via a real HTTP multipart POST, so the
+        // CLI path always takes the guard — the store seam itself is covered by AttachmentModelTest.
+        $res = $this->call('uploadFile');
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('agent.file.failed', json_encode($res->messages));
+    }
+
+    // ===== approve — end to end, kept off the network =============================================
+
+    /** Insert a run owned by $userId whose conversation_id is DANGLING (so the best-effort follow-up
+     *  turn short-circuits to null before any provider call), carrying the given action ledger. */
+    private function seedRun(string $userId, array $ledger): string
+    {
+        return (new Tiger_Model_AgentRun())->insert([
+            'conversation_id' => 'dangling-conversation-' . substr(md5($userId . microtime()), 0, 8),
+            'user_id'         => $userId,
+            'status'          => Tiger_Model_AgentRun::STATUS_BLOCKED,
+            'steps'           => 1,
+            'actions'         => json_encode($ledger),
+        ]);
+    }
+
+    #[Test]
+    public function approve_requires_a_run_id_and_a_real_owned_run(): void
+    {
+        $this->enableAgent();
+        $this->loginAs('admin');
+
+        $noId = $this->call('approve');   // form: run_id required
+        $this->assertSame(0, (int) $noId->result);
+        $this->assertArrayHasKey('run_id', (array) $noId->form);
+
+        $missing = $this->call('approve', ['run_id' => 'does-not-exist']);
+        $this->assertSame(0, (int) $missing->result);
+        $this->assertStringContainsString('run_missing', json_encode($missing->messages));
+    }
+
+    #[Test]
+    public function approve_treats_a_run_with_a_non_array_ledger_as_missing(): void
+    {
+        $this->enableAgent();
+        $this->loginAs('admin');
+        $runId = (new Tiger_Model_AgentRun())->insert([
+            'conversation_id' => 'dangling', 'user_id' => 'user-admin',
+            'status' => Tiger_Model_AgentRun::STATUS_BLOCKED, 'steps' => 1, 'actions' => null,
+        ]);
+        $res = $this->call('approve', ['run_id' => $runId, 'all' => '1']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('run_missing', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function approve_with_nothing_targeted_leaves_the_proposal_blocked(): void
+    {
+        $this->enableAgent();
+        $this->loginAs('admin');
+        $ledger = [[
+            'type' => 'file', 'status' => 'proposed', 'summary' => 'Write demo/x.phtml',
+            'action' => ['type' => 'file', 'path' => 'demo/x.phtml', 'contents' => '<h1>x</h1>', 'reason' => 'r'],
+        ]];
+        $runId = $this->seedRun('user-admin', $ledger);
+
+        // A JSON-array index that matches nothing → the proposal is never executed and stays blocked.
+        $res = $this->call('approve', ['run_id' => $runId, 'indexes' => '[9]']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame(Tiger_Model_AgentRun::STATUS_BLOCKED, $res->data['status']);
+        $this->assertSame('proposed', $res->data['actions'][0]['status'], 'the untargeted action is untouched');
+        $this->assertNull($res->data['follow'], 'no follow-up turn when nothing executed');
+    }
+
+    #[Test]
+    public function approve_runs_the_targeted_action_through_the_forge_and_resyncs_the_message(): void
+    {
+        $this->enableAgent();
+        $this->loginAs('admin');   // admin lacks the superadmin `file` tier → the Forge returns 'denied'
+
+        $ledger = [[
+            'type' => 'file', 'status' => 'proposed', 'summary' => 'Write demo/x.phtml',
+            'action' => ['type' => 'file', 'path' => 'demo/x.phtml', 'contents' => '<h1>x</h1>', 'reason' => 'r'],
+        ]];
+        $runId = $this->seedRun('user-admin', $ledger);
+
+        // Mirror the assistant turn's chip meta, so the re-sync (meta.status) has a row to update.
+        $convId = (string) (new Tiger_Model_AgentRun())->ownedById($runId, 'user-admin')->conversation_id;
+        $msg    = new Tiger_Model_AgentMessage();
+        $msgId  = $msg->append($convId, Tiger_Model_AgentMessage::ROLE_ASSISTANT, 'proposing', ['actions' => $ledger, 'status' => 'blocked'], $runId);
+
+        $res = $this->call('approve', ['run_id' => $runId, 'all' => '1']);
+
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('denied', $res->data['actions'][0]['status'], 'the Forge ran the action and gated it by ACL');
+        $this->assertSame(Tiger_Model_AgentRun::STATUS_OK, $res->data['status'], 'a denied (not errored/blocked) action → ok');
+
+        // The run ledger + the mirrored message meta were both rewritten to the executed outcome.
+        $run = (new Tiger_Model_AgentRun())->ownedById($runId, 'user-admin');
+        $this->assertStringContainsString('denied', (string) $run->actions);
+
+        $metaRow = $this->db->fetchOne('SELECT meta FROM agent_message WHERE message_id = ?', [$msgId]);
+        $meta    = json_decode((string) $metaRow, true);
+        $this->assertSame(Tiger_Model_AgentRun::STATUS_OK, $meta['status'], 'the assistant chip meta re-synced to ok');
+    }
+
+    // ===== the turn helpers (exposed subclass, no live model) =====================================
+
+    private function exposed(): ExposedAgentService
+    {
+        $this->enableAgent();
+        return new ExposedAgentService([]);   // empty message → the base constructor dispatches nothing
+    }
+
+    #[Test]
+    public function context_sanitizes_the_path_and_the_declared_editable_targets(): void
+    {
+        $this->loginAs('manager');
+        $svc = $this->exposed();
+
+        $ctx = $svc->ctx(['context' => json_encode(['path' => '/admin/foo', 'targets' => [
+            ['name' => 'ti tle!!', 'label' => 'The Title', 'kind' => 'html'],   // name sanitized, kind kept
+            ['label' => 'no name'],                                             // dropped (no name)
+            ['name' => 'body', 'kind' => 'weird'],                             // unknown kind → text
+        ]])]);
+
+        $this->assertSame('/admin/foo', $ctx['path']);
+        $this->assertCount(2, $ctx['targets']);
+        $this->assertSame('title', $ctx['targets'][0]['name'], 'spaces + punctuation stripped from the target name');
+        $this->assertSame('html', $ctx['targets'][0]['kind']);
+        $this->assertSame('text', $ctx['targets'][1]['kind'], 'an unknown kind falls back to text');
+    }
+
+    #[Test]
+    public function context_rejects_a_non_path_and_accepts_an_array_envelope(): void
+    {
+        $this->loginAs('manager');
+        $svc = $this->exposed();
+        // A path with a query string doesn't match the strict pattern → dropped to ''.
+        $this->assertSame('', $svc->ctx(['context' => ['path' => '/x?y=1']])['path']);
+        $this->assertSame([], $svc->ctx([])['targets'], 'no context → empty targets');
+    }
+
+    #[Test]
+    public function takeAttachments_resolves_only_the_callers_pending_ids(): void
+    {
+        $this->loginAs('manager');
+        $svc = $this->exposed();
+
+        $am   = new Agent_Model_Attachment();
+        $mine = $am->insert(['conversation_id' => null, 'message_id' => null, 'user_id' => 'user-manager',
+            'org_id' => 'org-test', 'disk' => 'local', 'filename' => 'a.txt', 'mime_type' => 'text/plain',
+            'file_size' => 3, 'kind' => 'file', 'storage_key' => 'agent/x/a.txt', 'extract' => 'body text']);
+        $theirs = $am->insert(['conversation_id' => null, 'message_id' => null, 'user_id' => 'user-other',
+            'org_id' => 'org-test', 'disk' => 'local', 'filename' => 'b.txt', 'mime_type' => 'text/plain',
+            'file_size' => 3, 'kind' => 'file']);
+
+        $out = $svc->take(['attachment_ids' => "{$mine}, {$theirs}"]);
+        $this->assertSame([$mine], $out['ids'], 'only my pending row resolves');
+        $this->assertCount(1, $out['loop']);
+        $this->assertSame('a.txt', $out['loop'][0]['filename']);
+        $this->assertSame('body text', $out['loop'][0]['extract']);
+
+        $this->assertSame(['ids' => [], 'loop' => []], $svc->take(['attachment_ids' => '  ']), 'blank → nothing');
+    }
+
+    #[Test]
+    public function mime_detects_from_content_then_falls_back_to_the_extension_map(): void
+    {
+        $this->loginAs('manager');
+        $svc = $this->exposed();
+
+        $tmp = tempnam(sys_get_temp_dir(), 'agmime');
+        file_put_contents($tmp, "plain text content\n");
+        $this->assertSame('text/plain', $svc->mime($tmp, 'txt'), 'finfo detects text/plain');
+        @unlink($tmp);
+
+        // A path finfo can't read + a known extension → the extension map answers.
+        $this->assertSame('application/json', $svc->mime('/no/such/file', 'json'));
+        $this->assertSame('application/octet-stream', $svc->mime('/no/such/file', 'unknownext'));
+    }
+
+    #[Test]
+    public function domFeedback_formats_reads_writes_and_failures(): void
+    {
+        $this->loginAs('manager');
+        $svc = $this->exposed();
+
+        $out = $svc->dom(json_encode([
+            ['target' => 'headline', 'ok' => 1, 'kind' => 'text', 'content' => 'current copy'],
+            ['target' => 'missing',  'ok' => 0, 'error' => 'not on the page'],
+            ['target' => 'body',     'ok' => 1],   // no content key → an editor write
+        ]));
+
+        $this->assertStringContainsString('current content', $out);
+        $this->assertStringContainsString('current copy', $out);
+        $this->assertStringContainsString('FAILED — not on the page', $out);
+        $this->assertStringContainsString('updated in the editor', $out);
+
+        $this->assertStringContainsString('(none)', $svc->dom('not-json'), 'unparseable results degrade gracefully');
+    }
+
+    #[Test]
+    public function resolveConversation_loads_an_owned_thread_else_starts_a_fresh_one(): void
+    {
+        $this->loginAs('manager');
+        $svc = $this->exposed();
+
+        $fresh = $svc->resolve('');
+        $id    = (string) $fresh->conversation_id;
+        $this->assertNotSame('', $id, 'an empty id starts a new thread');
+
+        $again = $svc->resolve($id);
+        $this->assertSame($id, (string) $again->conversation_id, 'an owned id loads the same thread');
+
+        $unowned = $svc->resolve('someone-elses-id');
+        $this->assertNotSame('someone-elses-id', (string) $unowned->conversation_id, 'an un-owned id starts a new thread, never leaks');
+
+        $this->assertSame('manager', $svc->role(), 'the acting role comes from the identity');
+    }
+}
diff --git a/tests/Integration/Agent/AttachmentModelTest.php b/tests/Integration/Agent/AttachmentModelTest.php
new file mode 100644
index 0000000..6509b59
--- /dev/null
+++ b/tests/Integration/Agent/AttachmentModelTest.php
@@ -0,0 +1,156 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Agent;
+
+use Agent_Model_Attachment;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use ZipArchive;
+
+/**
+ * Agent_Model_Attachment — the DB-backed owner-scoping queries + the document text extractors (Wave 6).
+ *
+ * The static classification/extraction helpers (kindFor / accepted / extractText for text+html+cap)
+ * are already covered by tests/Unit/Agent/AttachmentTest — this adds the parts that need a real DB or
+ * a real container file: `pendingForUser` and `linkToMessage` (the owner-scoped, still-pending guards
+ * that stop one user attaching another's upload to a turn), and the DOCX / PDF extraction paths
+ * (`_docxText`, `_pdfText`) exercised against a genuine minimal container.
+ *
+ * The `agent_attachment` table ships as a MODULE migration the harness doesn't scan, so we create it
+ * on a side connection (see EnsuresAttachmentTable).
+ */
+#[CoversClass(Agent_Model_Attachment::class)]
+final class AttachmentModelTest extends IntegrationTestCase
+{
+    use EnsuresAttachmentTable;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->ensureAttachmentTable();
+    }
+
+    public static function tearDownAfterClass(): void
+    {
+        self::dropAttachmentTable();   // never leave the side-loaded table for InstallerLifecycleTest
+        parent::tearDownAfterClass();
+    }
+
+    /** Insert a pending (unlinked) attachment row and return its id. */
+    private function seed(string $userId, string $orgId, array $over = []): string
+    {
+        return (new Agent_Model_Attachment())->insert($over + [
+            'conversation_id' => null,
+            'message_id'      => null,
+            'user_id'         => $userId,
+            'org_id'          => $orgId,
+            'disk'            => 'local',
+            'filename'        => 'notes.txt',
+            'mime_type'       => 'text/plain',
+            'file_size'       => 12,
+            'kind'            => 'file',
+        ]);
+    }
+
+    // ----- pendingForUser (owner scoping + still-pending guard) ------------------------------------
+
+    #[Test]
+    public function pendingForUser_returns_only_the_callers_own_unlinked_rows(): void
+    {
+        $mine    = $this->seed('user-a', 'org-1');
+        $theirs  = $this->seed('user-b', 'org-1');
+        $linked  = $this->seed('user-a', 'org-1');
+        // Mark one of mine as already sent (message_id set) → it must NOT come back.
+        (new Agent_Model_Attachment())->update(['message_id' => 'msg-1'], "attachment_id = '{$linked}'");
+
+        $rows = (new Agent_Model_Attachment())->pendingForUser([$mine, $theirs, $linked], 'user-a');
+        $ids  = array_column($rows, 'attachment_id');
+
+        $this->assertContains($mine, $ids, 'my still-pending row resolves');
+        $this->assertNotContains($theirs, $ids, "another user's row is dropped");
+        $this->assertNotContains($linked, $ids, 'an already-sent (linked) row is dropped');
+    }
+
+    #[Test]
+    public function pendingForUser_with_no_ids_returns_empty_without_a_query(): void
+    {
+        $this->assertSame([], (new Agent_Model_Attachment())->pendingForUser([], 'user-a'));
+        $this->assertSame([], (new Agent_Model_Attachment())->pendingForUser(['', null], 'user-a'));
+    }
+
+    // ----- linkToMessage (owner-scoped, only still-pending) ---------------------------------------
+
+    #[Test]
+    public function linkToMessage_binds_only_owned_pending_rows_and_reports_the_count(): void
+    {
+        $mine   = $this->seed('user-a', 'org-1');
+        $theirs = $this->seed('user-b', 'org-1');
+
+        $n = (new Agent_Model_Attachment())->linkToMessage([$mine, $theirs], 'conv-9', 'msg-9', 'user-a');
+        $this->assertSame(1, $n, 'only my row is linked (the other owner is never touched)');
+
+        $row = $this->db->fetchRow('SELECT conversation_id, message_id FROM agent_attachment WHERE attachment_id = ?', [$mine]);
+        $this->assertSame('conv-9', $row['conversation_id']);
+        $this->assertSame('msg-9', $row['message_id']);
+
+        $other = $this->db->fetchRow('SELECT message_id FROM agent_attachment WHERE attachment_id = ?', [$theirs]);
+        $this->assertNull($other['message_id'], "the other user's row is left pending");
+    }
+
+    #[Test]
+    public function linkToMessage_with_no_ids_is_a_noop(): void
+    {
+        $this->assertSame(0, (new Agent_Model_Attachment())->linkToMessage([], 'c', 'm', 'user-a'));
+    }
+
+    // ----- document extraction (real containers) --------------------------------------------------
+
+    #[Test]
+    public function extractText_pulls_readable_text_from_a_real_docx(): void
+    {
+        if (!class_exists('ZipArchive')) { $this->markTestSkipped('ZipArchive not available'); }
+
+        $tmp = tempnam(sys_get_temp_dir(), 'agtdocx') . '.docx';
+        $zip = new ZipArchive();
+        $zip->open($tmp, ZipArchive::CREATE);
+        $zip->addFromString(
+            'word/document.xml',
+            '<?xml version="1.0"?><w:document xmlns:w="x"><w:body>'
+            . '<w:p><w:r><w:t>Hello</w:t></w:r><w:r><w:t> Tiger</w:t></w:r></w:p>'
+            . '<w:p><w:r><w:t>Second line</w:t></w:r></w:p>'
+            . '</w:body></w:document>'
+        );
+        $zip->close();
+        $bytes = (string) file_get_contents($tmp);
+        @unlink($tmp);
+
+        $out = Agent_Model_Attachment::extractText('brief.docx', 'application/octet-stream', $bytes);
+        $this->assertStringContainsString('Hello Tiger', $out);
+        $this->assertStringContainsString('Second line', $out);
+    }
+
+    #[Test]
+    public function extractText_scans_shown_strings_from_a_minimal_pdf(): void
+    {
+        // A tiny uncompressed PDF content stream with a single Tj text-show operator.
+        $pdf = "%PDF-1.4\n"
+             . "stream\n"
+             . "BT /F1 12 Tf (Hello from a PDF) Tj ET\n"
+             . "endstream\n"
+             . "%%EOF";
+
+        $out = Agent_Model_Attachment::extractText('paper.pdf', 'application/pdf', $pdf);
+        $this->assertIsString($out);
+        $this->assertStringContainsString('Hello from a PDF', $out);
+    }
+
+    #[Test]
+    public function extractText_returns_null_for_a_store_only_binary_type(): void
+    {
+        // An epub is stored for the agent to ACT on, never parsed as text.
+        $this->assertNull(Agent_Model_Attachment::extractText('novel.epub', 'application/epub+zip', 'PK\x03\x04'));
+    }
+}
diff --git a/tests/Integration/Agent/EnsuresAttachmentTable.php b/tests/Integration/Agent/EnsuresAttachmentTable.php
new file mode 100644
index 0000000..3bdbb74
--- /dev/null
+++ b/tests/Integration/Agent/EnsuresAttachmentTable.php
@@ -0,0 +1,89 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Agent;
+
+use Zend_Db;
+
+/**
+ * The `agent_attachment` table ships as a MODULE migration (modules/agent/migrations/…), which the
+ * integration harness's migrator does NOT scan — it only applies core `/migrations` (see
+ * IntegrationTestCase::ensureMigrated + the module-lifecycle-migrations backlog note). So a test that
+ * touches Agent_Model_Attachment must create the table itself.
+ *
+ * We apply the DDL on a SEPARATE, short-lived connection (not the shared, per-test-transactional
+ * adapter) so the auto-committing CREATE never disturbs the outer test transaction. Guarded by a
+ * process-static flag + `IF NOT EXISTS`, so it runs at most once and is idempotent across the suite.
+ * The DDL mirrors modules/agent/migrations/20260724000001_agent_attachments.php verbatim (plus the
+ * IF NOT EXISTS guard).
+ */
+trait EnsuresAttachmentTable
+{
+    private static bool $attachmentTableReady = false;
+
+    protected function ensureAttachmentTable(): void
+    {
+        if (self::$attachmentTableReady) {
+            return;
+        }
+        $sep = Zend_Db::factory('Pdo_Mysql', [
+            'host'     => getenv('TIGER_TEST_DB_HOST') ?: '127.0.0.1',
+            'port'     => (int) (getenv('TIGER_TEST_DB_PORT') ?: 3306),
+            'dbname'   => getenv('TIGER_TEST_DB_NAME'),
+            'username' => getenv('TIGER_TEST_DB_USER') ?: 'root',
+            'password' => getenv('TIGER_TEST_DB_PASS') ?: '',
+            'charset'  => 'utf8mb4',
+        ]);
+        $sep->query(
+            "CREATE TABLE IF NOT EXISTS `agent_attachment` (
+                `attachment_id`   CHAR(36)     NOT NULL,
+                `conversation_id` CHAR(36)         NULL,
+                `message_id`      CHAR(36)         NULL,
+                `user_id`         CHAR(36)     NOT NULL,
+                `org_id`          CHAR(36)     NOT NULL,
+                `disk`            VARCHAR(64)  NOT NULL DEFAULT 'local',
+                `storage_key`     VARCHAR(512)     NULL,
+                `filename`        VARCHAR(255) NOT NULL,
+                `mime_type`       VARCHAR(128)     NULL,
+                `file_size`       BIGINT           NULL,
+                `kind`            VARCHAR(16)  NOT NULL DEFAULT 'file',
+                `extract`         MEDIUMTEXT       NULL,
+                `deleted`         TINYINT(1)   NOT NULL DEFAULT 0,
+                `created_by`      CHAR(36)         NULL,
+                `updated_by`      CHAR(36)         NULL,
+                `created_at`      DATETIME     NOT NULL,
+                `updated_at`      DATETIME         NULL,
+                PRIMARY KEY (`attachment_id`),
+                KEY `ix_agent_attach_msg`  (`conversation_id`, `message_id`),
+                KEY `ix_agent_attach_user` (`user_id`, `message_id`, `deleted`)
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci"
+        );
+        $sep->closeConnection();
+        self::$attachmentTableReady = true;
+    }
+
+    /**
+     * Drop the side-loaded table again so it never persists into other suites — notably
+     * InstallerLifecycleTest, which installs the agent module for real and creates this table itself
+     * (a plain CREATE that would collide with a leftover). The using class calls this from
+     * tearDownAfterClass. Uses a separate connection (the shared adapter's txn is already torn down).
+     */
+    protected static function dropAttachmentTable(): void
+    {
+        if (!self::$attachmentTableReady) {
+            return;
+        }
+        $sep = Zend_Db::factory('Pdo_Mysql', [
+            'host'     => getenv('TIGER_TEST_DB_HOST') ?: '127.0.0.1',
+            'port'     => (int) (getenv('TIGER_TEST_DB_PORT') ?: 3306),
+            'dbname'   => getenv('TIGER_TEST_DB_NAME'),
+            'username' => getenv('TIGER_TEST_DB_USER') ?: 'root',
+            'password' => getenv('TIGER_TEST_DB_PASS') ?: '',
+            'charset'  => 'utf8mb4',
+        ]);
+        $sep->query('DROP TABLE IF EXISTS `agent_attachment`');
+        $sep->closeConnection();
+        self::$attachmentTableReady = false;
+    }
+}
diff --git a/tests/Integration/Agent/SettingsServiceTest.php b/tests/Integration/Agent/SettingsServiceTest.php
new file mode 100644
index 0000000..8bd72a2
--- /dev/null
+++ b/tests/Integration/Agent/SettingsServiceTest.php
@@ -0,0 +1,206 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Agent;
+
+use Agent_Service_Settings;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Agent;
+use Tiger_Crypto;
+use Tiger_Model_Config;
+use Zend_Config;
+use Zend_Registry;
+
+/**
+ * Agent_Service_Settings — the admin `/api` service behind the TigerAgent settings screen (Wave 6).
+ *
+ * Covers the ACL gate (admin+ only — deny-by-default for guest/user), the validate→transaction save
+ * into the eager `config` tier (the on/off switch, provider, model, mode ceiling), the provider +
+ * mode-ceiling fallbacks, the BYO-key convention (a NEW key is encrypted and NEVER stored in plain;
+ * a BLANK field preserves the current secret by writing no key row), the "encryption not configured"
+ * guard, and `models()` (the keyless static fallback + the provider-name sanitize/fallback).
+ *
+ * The service opens its OWN `_transaction()`; the savepoint-aware harness adapter nests it inside the
+ * per-test transaction, so writes roll back cleanly with no manual cleanup. CSRF is flagged stateless
+ * (no session in CLI), exactly as a token API call does.
+ */
+#[CoversClass(Agent_Service_Settings::class)]
+final class SettingsServiceTest extends IntegrationTestCase
+{
+    /** A valid 32-byte base64 crypto key for the tests that need Tiger_Crypto configured. */
+    private const CRYPTO_KEY = 'MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);   // CSRF-immune API path (no session in CLI)
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    /** Put a Zend_Config in the registry (crypto optional) so Tiger_Crypto/Tiger_Agent read it. */
+    private function seedConfig(bool $withCrypto): void
+    {
+        $tiger = [];
+        if ($withCrypto) { $tiger['crypto'] = ['key' => self::CRYPTO_KEY]; }
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => $tiger], true));
+    }
+
+    /** Dispatch the service with an action + payload and hand back the response object. */
+    private function call(string $action, array $params = []): object
+    {
+        return (new Agent_Service_Settings(['action' => $action] + $params))->getResponse();
+    }
+
+    /** Read a single global config value straight from the DB (bypassing the registry cascade). */
+    private function dbConfig(string $key): ?string
+    {
+        $v = $this->db->fetchOne(
+            "SELECT config_value FROM config WHERE scope = 'global' AND scope_id = '' AND config_key = ? AND deleted = 0",
+            [$key]
+        );
+        return $v === false ? null : (string) $v;
+    }
+
+    // ----- ACL gate (deny-by-default) -------------------------------------------------------------
+
+    #[Test]
+    public function guest_and_plain_user_are_denied_both_actions(): void
+    {
+        foreach (['guest', 'user', 'manager'] as $role) {
+            $this->loginAs($role);
+            foreach (['save', 'models'] as $action) {
+                $res = $this->call($action);
+                $this->assertSame(0, (int) $res->result, "{$role} denied on {$action}");
+                $this->assertStringContainsString('not_allowed', json_encode($res->messages), "{$role}/{$action} ACL denial");
+            }
+        }
+    }
+
+    // ----- save (validate -> transaction, config tier) --------------------------------------------
+
+    #[Test]
+    public function save_writes_the_switch_provider_model_and_mode_to_the_config_tier(): void
+    {
+        $this->loginAs('admin');
+        $this->seedConfig(false);
+
+        $res = $this->call('save', [
+            'enabled'  => '1',
+            'provider' => 'openai',
+            'model'    => '  gpt-4o  ',
+            'mode_max' => 'yolo',
+        ]);
+
+        $this->assertSame(1, (int) $res->result, 'admin save succeeds');
+        $this->assertSame('1',      $this->dbConfig(Tiger_Agent::CFG_ENABLED));
+        $this->assertSame('openai', $this->dbConfig(Tiger_Agent::CFG_PROVIDER));
+        $this->assertSame('gpt-4o', $this->dbConfig(Tiger_Agent::CFG_MODEL), 'model is trimmed');
+        $this->assertSame('yolo',   $this->dbConfig(Tiger_Agent::CFG_MODE_MAX));
+        $this->assertArrayHasKey('connected', (array) $res->data);
+    }
+
+    #[Test]
+    public function save_disabled_stores_zero_for_the_switch(): void
+    {
+        $this->loginAs('admin');
+        $this->seedConfig(false);
+        $res = $this->call('save', ['provider' => 'anthropic']);   // no `enabled` key → off
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('0', $this->dbConfig(Tiger_Agent::CFG_ENABLED));
+    }
+
+    #[Test]
+    public function save_falls_back_to_anthropic_for_an_unknown_provider(): void
+    {
+        $this->loginAs('admin');
+        $this->seedConfig(false);
+        $res = $this->call('save', ['provider' => 'no-such-provider', 'enabled' => '1']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('anthropic', $this->dbConfig(Tiger_Agent::CFG_PROVIDER), 'stale/unknown provider → anthropic');
+    }
+
+    #[Test]
+    public function save_falls_back_to_auto_for_an_invalid_mode_ceiling(): void
+    {
+        $this->loginAs('admin');
+        $this->seedConfig(false);
+        $res = $this->call('save', ['provider' => 'anthropic', 'mode_max' => 'ludicrous']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame('auto', $this->dbConfig(Tiger_Agent::CFG_MODE_MAX), 'an unknown mode → auto');
+    }
+
+    // ----- the BYO-key convention -----------------------------------------------------------------
+
+    #[Test]
+    public function a_blank_key_field_writes_no_key_row_preserving_the_stored_secret(): void
+    {
+        $this->loginAs('admin');
+        $this->seedConfig(true);
+        $res = $this->call('save', ['provider' => 'anthropic', 'api_key' => '   ']);   // blank after trim
+        $this->assertSame(1, (int) $res->result);
+        $this->assertNull($this->dbConfig(Tiger_Agent::CFG_KEY_ENC), 'no key row written when the field is blank');
+    }
+
+    #[Test]
+    public function a_new_key_is_encrypted_at_rest_never_stored_in_plaintext(): void
+    {
+        $this->loginAs('admin');
+        $this->seedConfig(true);
+
+        $secret = 'sk-super-secret-byo-key';
+        $res = $this->call('save', ['provider' => 'anthropic', 'api_key' => $secret]);
+        $this->assertSame(1, (int) $res->result);
+
+        $blob = $this->dbConfig(Tiger_Agent::CFG_KEY_ENC);
+        $this->assertNotNull($blob, 'a key row was written');
+        $this->assertStringNotContainsString($secret, $blob, 'the plaintext key never touches the DB');
+        $this->assertSame($secret, Tiger_Crypto::decrypt($blob), 'and it round-trips back through Tiger_Crypto');
+    }
+
+    #[Test]
+    public function saving_a_key_without_encryption_configured_is_a_clean_error(): void
+    {
+        $this->loginAs('admin');
+        $this->seedConfig(false);   // no tiger.crypto.key → Tiger_Crypto::isConfigured() is false
+        $res = $this->call('save', ['provider' => 'anthropic', 'api_key' => 'sk-cannot-store']);
+
+        $this->assertSame(0, (int) $res->result, 'the save refuses to store a key it cannot encrypt');
+        $this->assertNull($this->dbConfig(Tiger_Agent::CFG_KEY_ENC), 'and no key row was written');
+    }
+
+    // ----- models() -------------------------------------------------------------------------------
+
+    #[Test]
+    public function models_returns_the_keyless_static_fallback_for_a_provider(): void
+    {
+        $this->loginAs('admin');
+        $this->seedConfig(false);   // no stored key → apiKey() is '' → the static fallback (no network)
+
+        $res = $this->call('models', ['provider' => 'anthropic']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertFalse($res->data['live'], 'no key → not a live listing');
+        $this->assertNotEmpty($res->data['models']);
+        $this->assertArrayHasKey('id', $res->data['models'][0]);
+        $this->assertArrayHasKey('label', $res->data['models'][0]);
+    }
+
+    #[Test]
+    public function models_sanitizes_and_falls_back_for_an_unknown_provider(): void
+    {
+        $this->loginAs('admin');
+        $this->seedConfig(false);
+        // Digits/junk are stripped and an unknown key falls back to anthropic — never a hard failure.
+        $res = $this->call('models', ['provider' => 'Op3nAI!!']);
+        $this->assertSame(1, (int) $res->result);
+        $this->assertNotEmpty($res->data['models']);
+    }
+}
diff --git a/tests/Integration/Analytics/AdminControllerTest.php b/tests/Integration/Analytics/AdminControllerTest.php
new file mode 100644
index 0000000..c407b3a
--- /dev/null
+++ b/tests/Integration/Analytics/AdminControllerTest.php
@@ -0,0 +1,77 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Analytics;
+
+use Analytics_AdminController;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\ModuleControllerTestCase;
+
+/**
+ * Analytics_AdminController — the Google Analytics settings + OAuth-connect screens. index prefills the
+ * settings form + the connection state; connect/callback/disconnect drive the OAuth handshake (broker or
+ * BYO) and redirect back to /analytics/admin; dashboard renders the reports shell. With nothing
+ * configured the connection is unconfigurable/unconnected, so the guard branches (redirect with a flash)
+ * are what run under the harness.
+ */
+#[CoversClass(Analytics_AdminController::class)]
+final class AdminControllerTest extends ModuleControllerTestCase
+{
+    #[Test]
+    public function index_prefills_the_settings_form_and_connection_state(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Analytics_AdminController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Analytics', (string) $view->title);
+        $this->assertInstanceOf(\Analytics_Form_Settings::class, $view->form);
+        $this->assertFalse($view->enabled);
+        $this->assertIsArray($view->ga);
+        $this->assertFalse((bool) $view->ga['connected']);
+        $this->assertFalse((bool) $view->ga['configurable']);
+        $this->assertStringContainsString('/analytics/admin/callback', (string) $view->ga['redirect_uri']);
+    }
+
+    #[Test]
+    public function connect_redirects_back_with_an_error_when_not_configurable(): void
+    {
+        // No GA4 property id set → not configurable → flash + redirect to the settings screen.
+        $this->loginAs('admin');
+        $this->dispatchAction(Analytics_AdminController::class, 'connect', [], 'GET');
+
+        $this->assertStringContainsString('/analytics/admin', $this->redirectLocation());
+    }
+
+    #[Test]
+    public function callback_broker_mode_flashes_and_redirects_on_a_denied_grant(): void
+    {
+        // Broker mode is the default; an ?error param means the user denied consent → flash + redirect.
+        $this->loginAs('admin');
+        $this->dispatchAction(Analytics_AdminController::class, 'callback', ['error' => 'access_denied'], 'GET');
+
+        $this->assertStringContainsString('/analytics/admin', $this->redirectLocation());
+    }
+
+    #[Test]
+    public function disconnect_forgets_the_connection_and_redirects(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Analytics_AdminController::class, 'disconnect', [], 'GET');
+
+        $this->assertStringContainsString('/analytics/admin', $this->redirectLocation());
+    }
+
+    #[Test]
+    public function dashboard_renders_the_reports_shell(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Analytics_AdminController::class, 'dashboard', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Dashboard', (string) $view->title);
+        $this->assertFalse((bool) $view->connected);
+    }
+}
diff --git a/tests/Integration/Backup/IndexControllerTest.php b/tests/Integration/Backup/IndexControllerTest.php
new file mode 100644
index 0000000..89031a5
--- /dev/null
+++ b/tests/Integration/Backup/IndexControllerTest.php
@@ -0,0 +1,55 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Backup;
+
+use Backup_IndexController;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\ModuleControllerTestCase;
+
+/**
+ * Backup_IndexController — dispatch coverage via the ControllerTestCase harness.
+ *
+ * (Was a characterization of a real bug: the controller redeclared the base `_json()` with an
+ * incompatible signature, a PHP 8.5 fatal-at-class-load that 500'd every /backup request. Fixed by
+ * renaming the helper to `_jsonBody()`; this test now exercises the actual actions.)
+ */
+final class IndexControllerTest extends ModuleControllerTestCase
+{
+    #[Test]
+    public function the_admin_screen_renders_the_backups_list_and_settings(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatchAction(Backup_IndexController::class, 'index');
+        $this->assertSame(200, $res->getHttpResponseCode(), 'the backup admin screen dispatches without error');
+    }
+
+    #[Test]
+    public function a_download_of_an_unknown_backup_id_does_not_stream(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatchAction(Backup_IndexController::class, 'download', ['id' => 'no-such-backup']);
+        // No matching row → the action returns without a file body (a 404-ish empty stream), never a fatal.
+        $this->assertNotSame('', (string) $res->getHttpResponseCode());
+    }
+
+    #[Test]
+    public function a_restore_without_the_typed_confirmation_is_refused(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatchAction(Backup_IndexController::class, 'upload', ['confirm' => ''], 'POST');
+        $json = json_decode($res->getBody(), true);
+        $this->assertSame(0, (int) ($json['result'] ?? -1), 'a restore needs the literal RESTORE confirmation');
+    }
+
+    #[Test]
+    public function a_confirmed_restore_with_no_uploaded_file_reports_upload_failed(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatchAction(Backup_IndexController::class, 'upload', ['confirm' => 'RESTORE'], 'POST');
+        $json = json_decode($res->getBody(), true);
+        $this->assertSame(0, (int) ($json['result'] ?? -1), 'no file → refused');
+        $this->assertStringContainsString('upload', json_encode($json), 'the failure is an upload error');
+    }
+}
diff --git a/tests/Integration/Blog/ControllersTest.php b/tests/Integration/Blog/ControllersTest.php
new file mode 100644
index 0000000..cab77eb
--- /dev/null
+++ b/tests/Integration/Blog/ControllersTest.php
@@ -0,0 +1,125 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Blog;
+
+use Blog_IndexController;
+use Blog_Model_Post;
+use Blog_PostController;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\ModuleControllerTestCase;
+use Tiger_Model_Page;
+use Zend_Controller_Action_Exception;
+
+/**
+ * The two Blog controllers:
+ *   - Index (public) — the blog front-end (listing, single article, category/tag archives, RSS feed).
+ *     Thin: it resolves data from Blog_Model_Post/Taxonomy and hands it to the view; a missing
+ *     article/term 404s.
+ *   - Post (admin)   — the authoring surface: the DataTables list shell + the editor (create/edit).
+ *
+ * The harness dispatches each action rendering-off and asserts the view model / response.
+ */
+#[CoversClass(Blog_IndexController::class)]
+#[CoversClass(Blog_PostController::class)]
+final class ControllersTest extends ModuleControllerTestCase
+{
+    /** Seed a published article row (page-backed). Returns the page_id. */
+    private function seedArticle(array $overrides = []): string
+    {
+        return (new Tiger_Model_Page())->insert(array_merge([
+            'type'         => Blog_Model_Post::TYPE_ARTICLE,
+            'org_id'       => 'org-test',
+            'locale'       => 'en',
+            'title'        => 'Hello World',
+            'slug'         => 'hello-world',
+            'body'         => 'Body copy.',
+            'format'       => Tiger_Model_Page::FORMAT_HTML,
+            'status'       => Blog_Model_Post::STATUS_PUBLISHED,
+            'published_at' => '2026-01-01 00:00:00',
+            'meta'         => json_encode(Blog_Model_Post::META_DEFAULTS),
+        ], $overrides));
+    }
+
+    // ----- public front-end -----------------------------------------------------------------------
+
+    #[Test]
+    public function public_index_lists_articles(): void
+    {
+        $this->dispatchAction(Blog_IndexController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertSame('Blog', (string) $view->title);
+        $this->assertSame('Latest', (string) $view->heading);
+        $this->assertIsArray($view->posts);
+    }
+
+    #[Test]
+    public function public_view_404s_an_unknown_article(): void
+    {
+        $this->expectException(Zend_Controller_Action_Exception::class);
+        $this->dispatchAction(Blog_IndexController::class, 'view', ['slug' => 'no-such-article'], 'GET');
+    }
+
+    #[Test]
+    public function public_category_404s_an_unknown_term(): void
+    {
+        $this->expectException(Zend_Controller_Action_Exception::class);
+        $this->dispatchAction(Blog_IndexController::class, 'category', ['slug' => 'ghost'], 'GET');
+    }
+
+    #[Test]
+    public function public_feed_sets_the_rss_content_type(): void
+    {
+        $res = $this->dispatchAction(Blog_IndexController::class, 'feed', [], 'GET');
+
+        $ct = '';
+        foreach ($res->getHeaders() as $h) {
+            if (strcasecmp($h['name'], 'Content-Type') === 0) { $ct = (string) $h['value']; }
+        }
+        $this->assertStringContainsString('application/rss+xml', $ct);
+        $this->assertIsArray($this->controller()->view->posts);
+    }
+
+    // ----- admin authoring ------------------------------------------------------------------------
+
+    #[Test]
+    public function admin_index_renders_the_datatables_shell(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Blog_PostController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Articles', (string) $view->title);
+        $this->assertTrue((bool) $view->useDataTables);
+    }
+
+    #[Test]
+    public function admin_edit_renders_a_blank_editor_for_a_new_article(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Blog_PostController::class, 'edit', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('New Article', (string) $view->title);
+        $this->assertInstanceOf(\Blog_Form_Post::class, $view->form);
+        $this->assertNull($view->post);
+    }
+
+    #[Test]
+    public function admin_edit_prefills_the_editor_for_an_existing_article(): void
+    {
+        $id = $this->seedArticle(['title' => 'My Draft', 'slug' => 'my-draft']);
+        $this->loginAs('admin');
+        $this->dispatchAction(Blog_PostController::class, 'edit', ['id' => $id], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Edit Article', (string) $view->title);
+        $this->assertNotNull($view->post);
+        // recentForPage() returns a Zend_Db_Table_Rowset (Traversable), not a plain array.
+        $this->assertInstanceOf(\Traversable::class, $view->versions);
+        $this->assertSame('My Draft', $view->form->getValues()['title']);
+    }
+}
diff --git a/tests/Integration/Cms/CmsControllerTest.php b/tests/Integration/Cms/CmsControllerTest.php
new file mode 100644
index 0000000..1f68eb6
--- /dev/null
+++ b/tests/Integration/Cms/CmsControllerTest.php
@@ -0,0 +1,276 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Cms;
+
+use Cms_IndexController;
+use Cms_MenuController;
+use Cms_PageController;
+use Cms_SettingsController;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\ControllerTestCase;
+use Tiger_Model_Page;
+use Zend_Config;
+use Zend_Registry;
+use Zend_Session;
+
+/**
+ * The four CMS admin/public controllers, dispatched through the ControllerTestCase harness with
+ * view-rendering off. These are thin READ+RENDER screens (the client/server rule): each action sets
+ * up view-vars + a form and gets out of the way — every mutation is an /api call, covered by the
+ * service tests. So the assertion is the SHELL: the action dispatches cleanly, sets its `view->title`,
+ * `useDataTables`, form, and the theme-template / version / palette vars the .phtml then draws.
+ *
+ * A fixture theme (a temp dir with a `content/` page + a `components/` block + a manifest) is wired in
+ * via the `Tiger_ThemeDir` registry seam so the page-list's "customize a theme template" branch and the
+ * GrapesJS design canvas's block/menu-preview branches actually run (with no theme, `Tiger_Theme` short-
+ * circuits to empty). Zend_Session unit-test mode is on so the FlashMessenger the base controller wires
+ * in init() has no live session to reach for.
+ */
+#[CoversClass(Cms_PageController::class)]
+#[CoversClass(Cms_MenuController::class)]
+#[CoversClass(Cms_SettingsController::class)]
+#[CoversClass(Cms_IndexController::class)]
+final class CmsControllerTest extends ControllerTestCase
+{
+    private bool $priorUnitTestMode;
+    private string $themeDir;
+    private bool $hadThemeDir = false;
+    private $priorThemeDir = null;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->priorUnitTestMode = Zend_Session::$_unitTestEnabled;
+        Zend_Session::$_unitTestEnabled = true;
+        $_SESSION = [];
+
+        // designAction redirects a missing page via the redirector; keep gotoUrl from exit()-ing so the
+        // Location header is assertable instead of ending the PHP process.
+        \Zend_Controller_Action_HelperBroker::getStaticHelper('redirector')->setExit(false);
+
+        // A throwaway theme on disk, registered as the active theme so Tiger_Theme::pages()/components()/
+        // manifest() return real data — driving the theme-template + builder-block branches.
+        $this->themeDir = sys_get_temp_dir() . '/w6-cms-theme-' . getmypid();
+        @mkdir($this->themeDir . '/content', 0777, true);
+        @mkdir($this->themeDir . '/components', 0777, true);
+        file_put_contents($this->themeDir . '/theme.json', json_encode([
+            'key' => 'testtheme', 'name' => 'Test Theme', 'canvasCss' => ['/theme/canvas.css'],
+        ]));
+        file_put_contents(
+            $this->themeDir . '/content/welcome.phtml',
+            "<!-- tiger:page title=\"Welcome\" layout=\"page\" -->\n<h1>Welcome</h1>"
+        );
+        file_put_contents(
+            $this->themeDir . '/components/cta.phtml',
+            "<!-- tiger:block label=\"CTA\" category=\"Test\" icon=\"fa-star\" -->\n<div>CTA</div>"
+        );
+
+        $reg = Zend_Registry::getInstance();
+        $this->hadThemeDir = $reg->offsetExists('Tiger_ThemeDir');
+        if ($this->hadThemeDir) { $this->priorThemeDir = Zend_Registry::get('Tiger_ThemeDir'); }
+        Zend_Registry::set('Tiger_ThemeDir', $this->themeDir);
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($this->hadThemeDir) { Zend_Registry::set('Tiger_ThemeDir', $this->priorThemeDir); }
+        elseif ($reg->offsetExists('Tiger_ThemeDir')) { $reg->offsetUnset('Tiger_ThemeDir'); }
+        $this->rmrf($this->themeDir);
+
+        $_SESSION = [];
+        Zend_Session::$_unitTestEnabled = $this->priorUnitTestMode;
+        parent::tearDown();
+    }
+
+    private function rmrf(string $dir): void
+    {
+        if (!is_dir($dir)) { @unlink($dir); return; }
+        foreach (scandir($dir) as $e) {
+            if ($e === '.' || $e === '..') { continue; }
+            $p = $dir . '/' . $e;
+            is_dir($p) && !is_link($p) ? $this->rmrf($p) : @unlink($p);
+        }
+        @rmdir($dir);
+    }
+
+    private function seedPage(array $overrides): string
+    {
+        return (new Tiger_Model_Page())->insert(array_merge([
+            'type'   => Tiger_Model_Page::TYPE_PAGE,
+            'locale' => 'en',
+            'title'  => 'Seed',
+            'body'   => '',
+            'format' => Tiger_Model_Page::FORMAT_HTML,
+            'status' => Tiger_Model_Page::STATUS_DRAFT,
+        ], $overrides));
+    }
+
+    // ----- Cms_PageController -------------------------------------------------------------------
+
+    #[Test]
+    public function page_index_renders_the_content_list_shell_with_theme_templates(): void
+    {
+        $this->loginAs('admin');
+        // A page already claims the theme template's slug → the "already customized" flag branch.
+        $id = $this->seedPage(['title' => 'Welcome', 'slug' => 'welcome', 'page_key' => 'welcome']);
+
+        $res = $this->dispatchAction(Cms_PageController::class, 'index', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+
+        $view = $this->controller()->view;
+        $this->assertSame('Content — Tiger Admin', $view->title);
+        $this->assertTrue($view->useDataTables);
+        $this->assertSame('Test Theme', $view->themeName);
+        $this->assertNotEmpty($view->themeTemplates, 'the active theme templates are surfaced');
+
+        $welcome = null;
+        foreach ($view->themeTemplates as $t) { if ($t['slug'] === 'welcome') { $welcome = $t; } }
+        $this->assertNotNull($welcome, 'the welcome template appears');
+        $this->assertSame($id, $welcome['page_id'], 'the template is flagged customized (a page claims its slug)');
+    }
+
+    #[Test]
+    public function page_edit_with_no_id_renders_a_blank_new_form(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatchAction(Cms_PageController::class, 'edit', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('New', $view->title);
+        $this->assertNull($view->page, 'no page to edit');
+        $this->assertSame([], $view->versions);
+        $this->assertNotNull($view->form);
+    }
+
+    #[Test]
+    public function page_edit_with_an_id_populates_the_form_from_the_row_and_its_meta(): void
+    {
+        $this->loginAs('admin');
+        $meta = json_encode([
+            'seo'          => ['description' => 'A seo blurb'],
+            'head_html'    => '<meta name="x">',
+            'body_scripts' => '<script>1</script>',
+        ]);
+        $id = $this->seedPage(['title' => 'Editable', 'slug' => 'editable', 'page_key' => 'editable', 'meta' => $meta]);
+
+        $res = $this->dispatchAction(Cms_PageController::class, 'edit', ['id' => $id], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Edit', $view->title);
+        $this->assertNotNull($view->page, 'the row loaded');
+        $this->assertSame('Editable', $view->page->title);
+        // _editValues fed the form; the meta.seo.description round-trips into the form value.
+        $this->assertSame('A seo blurb', $view->form->getValue('meta_description'));
+    }
+
+    #[Test]
+    public function page_design_redirects_when_the_page_is_missing(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Cms_PageController::class, 'design', ['id' => 'no-such-page'], 'GET');
+        $this->assertStringContainsString('/cms/page', $this->redirectLocation(), 'a bad id bounces back to the list');
+    }
+
+    #[Test]
+    public function page_design_renders_the_builder_with_theme_blocks_and_the_builder_project(): void
+    {
+        $this->loginAs('admin');
+        $builder = json_encode(['pages' => [['frames' => []]]]);
+        $id = $this->seedPage([
+            'title'  => 'Designed', 'slug' => 'designed', 'page_key' => 'designed',
+            'format' => Tiger_Model_Page::FORMAT_BUILDER,
+            'meta'   => json_encode(['builder' => json_decode($builder, true)]),
+        ]);
+
+        $res = $this->dispatchAction(Cms_PageController::class, 'design', ['id' => $id], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+
+        $view = $this->controller()->view;
+        $this->assertSame('Designed', $view->title);
+        $this->assertNotNull($view->projectData, 'the lossless builder project is passed to the canvas');
+        $this->assertNotEmpty($view->themeBlocks, 'the active theme components seed the block palette');
+        $this->assertSame(['/theme/canvas.css'], $view->canvasCss, 'the manifest canvasCss is loaded into the canvas');
+        $this->assertIsArray($view->menus, 'menus are pre-rendered for the live Menu-component preview');
+    }
+
+    // ----- Cms_MenuController -------------------------------------------------------------------
+
+    #[Test]
+    public function menu_index_renders_the_list_shell(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatchAction(Cms_MenuController::class, 'index', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $view = $this->controller()->view;
+        $this->assertSame('Menus — Tiger Admin', $view->title);
+        $this->assertTrue($view->useDataTables);
+    }
+
+    #[Test]
+    public function menu_edit_new_has_an_empty_tree_and_menu_edit_with_a_key_builds_the_page_palette(): void
+    {
+        $this->loginAs('admin');
+
+        // New menu (no key): empty tree, still renders the form + palette.
+        $this->dispatchAction(Cms_MenuController::class, 'edit', [], 'GET');
+        $newView = $this->controller()->view;
+        $this->assertStringContainsString('New Menu', $newView->title);
+        $this->assertSame([], $newView->tree);
+        $this->assertNotNull($newView->form);
+
+        // Existing menu (a key) + a keyed published page → the "Pages" palette source is populated.
+        $this->seedPage(['title' => 'Palette Page', 'slug' => 'palette', 'page_key' => 'palette', 'status' => Tiger_Model_Page::STATUS_PUBLISHED]);
+        $this->dispatchAction(Cms_MenuController::class, 'edit', ['key' => 'primary'], 'GET');
+        $editView = $this->controller()->view;
+        $this->assertStringContainsString('Edit Menu', $editView->title);
+        $this->assertSame('primary', $editView->menuKey);
+        $keys = array_column($editView->pages, 'page_key');
+        $this->assertContains('palette', $keys, 'a keyed published page is offered in the palette');
+    }
+
+    // ----- Cms_SettingsController ---------------------------------------------------------------
+
+    #[Test]
+    public function settings_index_prefills_the_form_from_the_live_config(): void
+    {
+        $this->loginAs('admin');
+        Zend_Registry::set('Zend_Config', new Zend_Config([
+            'tiger' => ['site' => ['name' => 'Configured Site', 'home_page' => 'home-slug']],
+        ]));
+
+        $res = $this->dispatchAction(Cms_SettingsController::class, 'index', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+
+        $view = $this->controller()->view;
+        $this->assertSame('Settings — Tiger Admin', $view->title);
+        $this->assertSame('Configured Site', $view->form->getValue('site_name'));
+        $this->assertSame('home-slug', $view->form->getValue('home_page'));
+    }
+
+    #[Test]
+    public function settings_index_falls_back_to_the_default_site_name_when_config_is_empty(): void
+    {
+        $this->loginAs('admin');
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => []]));
+
+        $this->dispatchAction(Cms_SettingsController::class, 'index', [], 'GET');
+        $view = $this->controller()->view;
+        $this->assertSame('Tiger', $view->form->getValue('site_name'), 'the built-in default fills in when unset');
+    }
+
+    // ----- Cms_IndexController (public marketing face) ------------------------------------------
+
+    #[Test]
+    public function the_public_cms_landing_dispatches_cleanly(): void
+    {
+        // Guest-allowed marketing page — no model, no forward, just the view. It must dispatch without error.
+        $res = $this->dispatchAction(Cms_IndexController::class, 'index', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+    }
+}
diff --git a/tests/Integration/Cms/FormsTest.php b/tests/Integration/Cms/FormsTest.php
new file mode 100644
index 0000000..02af2b7
--- /dev/null
+++ b/tests/Integration/Cms/FormsTest.php
@@ -0,0 +1,128 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Cms;
+
+use Cms_Form_MenuItem;
+use Cms_Form_Page;
+use Cms_Form_Settings;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Page;
+use Zend_Registry;
+
+/**
+ * The three CMS admin forms — declarative Tiger_Form schemas the services validate before a write.
+ *
+ * These carry their own DEDICATED coverage: PHPUnit attributes a service/controller test's coverage
+ * only to its `#[CoversClass]` targets, so a form CONSTRUCTED inside a service (Cms_Service_*::save)
+ * isn't credited there — the form is its own contract and gets its own test. Each `elements()` runs a
+ * live `Tiger_Model_Page` query to build its page/home-page dropdown, so a published page is seeded to
+ * exercise that option-loading branch. `tiger.auth.stateless` is set so the CSRF-bearing forms (Page,
+ * Settings) build without a session token (MenuItem disables CSRF outright — the reload-free builder).
+ */
+#[CoversClass(Cms_Form_Page::class)]
+#[CoversClass(Cms_Form_MenuItem::class)]
+#[CoversClass(Cms_Form_Settings::class)]
+final class FormsTest extends IntegrationTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+        if ($reg->offsetExists('tiger.auth.stateless')) { $reg->offsetUnset('tiger.auth.stateless'); }
+        parent::tearDown();
+    }
+
+    private function seedPublishedPage(): void
+    {
+        (new Tiger_Model_Page())->insert([
+            'type'   => Tiger_Model_Page::TYPE_PAGE,
+            'locale' => 'en',
+            'title'  => 'Home',
+            'slug'   => 'home',
+            'page_key' => 'home',
+            'body'   => '',
+            'format' => Tiger_Model_Page::FORMAT_HTML,
+            'status' => Tiger_Model_Page::STATUS_PUBLISHED,
+        ]);
+    }
+
+    // ----- Cms_Form_Page ------------------------------------------------------------------------
+
+    #[Test]
+    public function page_form_declares_its_schema_and_requires_only_a_title(): void
+    {
+        $form = new Cms_Form_Page();
+        foreach (['page_id', 'title', 'slug', 'page_key', 'type', 'format', 'status', 'locale', 'body', 'meta_description'] as $name) {
+            $this->assertNotNull($form->getElement($name), "the $name element is declared");
+        }
+        $this->assertTrue($form->getElement('title')->isRequired(), 'title is the one hard-required field');
+        $this->assertFalse($form->getElement('slug')->isRequired(), 'slug is optional (derived when blank)');
+    }
+
+    #[Test]
+    public function page_form_validates_a_minimal_page_and_rejects_a_blank_title(): void
+    {
+        $form = new Cms_Form_Page();
+        $this->assertTrue(
+            $form->isValid(['title' => 'Hello', 'type' => 'page', 'format' => 'html', 'status' => 'draft', 'locale' => 'en']),
+            'a titled page validates'
+        );
+
+        $bad = new Cms_Form_Page();
+        $this->assertFalse($bad->isValid(['title' => '', 'type' => 'page', 'format' => 'html', 'status' => 'draft', 'locale' => 'en']));
+        $this->assertArrayHasKey('title', $bad->getMessages());
+    }
+
+    // ----- Cms_Form_MenuItem --------------------------------------------------------------------
+
+    #[Test]
+    public function menu_item_form_disables_csrf_requires_a_label_and_lists_linkable_pages(): void
+    {
+        $this->seedPublishedPage();   // → the page_key dropdown option-loading branch runs
+        $form = new Cms_Form_MenuItem();
+
+        $this->assertNull($form->getElement('_csrf'), 'the menu builder form carries no CSRF token');
+        $this->assertTrue($form->getElement('label')->isRequired(), 'label is required');
+        foreach (['url', 'icon', 'css_class', 'link_target', 'resource', 'privilege', 'status'] as $name) {
+            $this->assertNotNull($form->getElement($name), "the $name element is declared");
+        }
+        $options = $form->getElement('page_key')->getMultiOptions();
+        $this->assertArrayHasKey('home', $options, 'the seeded published page is offered as a link target');
+    }
+
+    #[Test]
+    public function menu_item_form_rejects_a_blank_label(): void
+    {
+        $form = new Cms_Form_MenuItem();
+        $this->assertFalse($form->isValid(['label' => '']));
+        $this->assertArrayHasKey('label', $form->getMessages());
+    }
+
+    // ----- Cms_Form_Settings --------------------------------------------------------------------
+
+    #[Test]
+    public function settings_form_requires_a_site_name_and_lists_published_pages_as_home_options(): void
+    {
+        $this->seedPublishedPage();
+        $form = new Cms_Form_Settings();
+
+        $this->assertTrue($form->getElement('site_name')->isRequired());
+        $home = $form->getElement('home_page')->getMultiOptions();
+        $this->assertArrayHasKey('', $home, 'the built-in landing is the empty option');
+        $this->assertContains('Home (en)', $home, 'a published page is a home-page choice');
+
+        $this->assertTrue($form->isValid(['site_name' => 'My Site', 'home_page' => '']));
+        $bad = new Cms_Form_Settings();
+        $this->assertFalse($bad->isValid(['site_name' => '', 'home_page' => '']));
+        $this->assertArrayHasKey('site_name', $bad->getMessages());
+    }
+}
diff --git a/tests/Integration/Cms/PageServiceExtraTest.php b/tests/Integration/Cms/PageServiceExtraTest.php
new file mode 100644
index 0000000..c2a0180
--- /dev/null
+++ b/tests/Integration/Cms/PageServiceExtraTest.php
@@ -0,0 +1,203 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Cms;
+
+use Cms_Service_Page;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Page;
+use Zend_Registry;
+
+/**
+ * Cms_Service_Page — the two authoring methods Wave 3 left uncovered: forkTheme (customize a file-based
+ * theme template into an editable DB page that overrides it — the live-override tier) and saveDesign
+ * (persist the GrapesJS builder's HTML+CSS+project, stripping <script> to keep the SAFE builder format).
+ *
+ * forkTheme + saveDesign both defer to Tiger_Model_Page::save() (its own write+version transaction), so —
+ * like the Wave 3 save/restore tests — these commit the harness transaction first (escapeTxn) and lean on
+ * the tearDown scrub. A throwaway theme (a temp dir + a `content/` template) is wired in via the
+ * `Tiger_ThemeDir` seam so forkTheme has a real template to fork.
+ */
+#[CoversClass(Cms_Service_Page::class)]
+final class PageServiceExtraTest extends IntegrationTestCase
+{
+    private string $themeDir;
+    private bool $hadThemeDir = false;
+    private $priorThemeDir = null;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->themeDir = sys_get_temp_dir() . '/w6-cms-forktheme-' . getmypid();
+        @mkdir($this->themeDir . '/content', 0777, true);
+        file_put_contents($this->themeDir . '/theme.json', json_encode(['key' => 'testtheme', 'name' => 'Test Theme']));
+        file_put_contents(
+            $this->themeDir . '/content/about.phtml',
+            "<!-- tiger:page title=\"About Us\" layout=\"page\" -->\n<h1>About</h1>"
+        );
+
+        $reg = Zend_Registry::getInstance();
+        $this->hadThemeDir = $reg->offsetExists('Tiger_ThemeDir');
+        if ($this->hadThemeDir) { $this->priorThemeDir = Zend_Registry::get('Tiger_ThemeDir'); }
+        Zend_Registry::set('Tiger_ThemeDir', $this->themeDir);
+    }
+
+    protected function tearDown(): void
+    {
+        try {
+            $this->db->query('DELETE FROM page_version');
+            $this->db->query('DELETE FROM page_redirect');
+            $this->db->query('DELETE FROM page');
+        } catch (\Throwable $e) {
+            // ignore
+        }
+        $reg = Zend_Registry::getInstance();
+        if ($this->hadThemeDir) { Zend_Registry::set('Tiger_ThemeDir', $this->priorThemeDir); }
+        elseif ($reg->offsetExists('Tiger_ThemeDir')) { $reg->offsetUnset('Tiger_ThemeDir'); }
+        $this->rmrf($this->themeDir);
+        parent::tearDown();
+    }
+
+    private function rmrf(string $dir): void
+    {
+        if (!is_dir($dir)) { @unlink($dir); return; }
+        foreach (scandir($dir) as $e) {
+            if ($e === '.' || $e === '..') { continue; }
+            $p = $dir . '/' . $e;
+            is_dir($p) && !is_link($p) ? $this->rmrf($p) : @unlink($p);
+        }
+        @rmdir($dir);
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Cms_Service_Page(['action' => $action] + $params))->getResponse();
+    }
+
+    private function escapeTxn(): void
+    {
+        $this->db->commit();
+    }
+
+    // ----- forkTheme ----------------------------------------------------------------------------
+
+    #[Test]
+    public function fork_theme_is_denied_to_a_guest(): void
+    {
+        $this->login('anon', 'org-test', 'guest');
+        $res = $this->call('forkTheme', ['slug' => 'about']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages), 'guest denied');
+    }
+
+    #[Test]
+    public function fork_theme_errors_when_the_template_is_unavailable(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('forkTheme', ['slug' => 'no-such-template']);
+        $this->assertSame(0, (int) $res->result, 'an unknown slug is a clean error, not a crash');
+    }
+
+    #[Test]
+    public function fork_theme_creates_an_editable_page_overriding_the_file(): void
+    {
+        $this->loginAs('admin');
+        $this->escapeTxn();
+
+        $res = $this->call('forkTheme', ['slug' => 'about']);
+        $this->assertSame(1, (int) $res->result, 'the template forked into a page');
+        $id = $res->data['page_id'];
+        $this->assertStringContainsString('/cms/page/edit/id/', $res->data['edit_url']);
+
+        $row = (new Tiger_Model_Page())->findById($id);
+        $this->assertSame('about', $row->slug, 'the fork claims the template slug (so it overrides the file)');
+        $this->assertSame('About Us', $row->title, 'title comes from the template hint');
+        $this->assertStringContainsString('About', (string) $row->body);
+        $this->assertSame(Tiger_Model_Page::STATUS_PUBLISHED, $row->status);
+        // Pure-markup body → html (opens in the visual builder); origin tagged in meta.
+        $this->assertSame(Tiger_Model_Page::FORMAT_HTML, $row->format);
+        $meta = json_decode((string) $row->meta, true);
+        $this->assertSame('theme', $meta['source'], 'the origin is recorded for a later revert');
+        $this->assertSame('testtheme', $meta['source_key']);
+    }
+
+    #[Test]
+    public function fork_theme_returns_the_existing_page_when_the_slug_is_already_customized(): void
+    {
+        $this->loginAs('admin');
+        $this->escapeTxn();
+
+        // First fork creates the row; a second fork must find it and return it (idempotent — no duplicate).
+        $first = $this->call('forkTheme', ['slug' => 'about']);
+        $existingId = $first->data['page_id'];
+
+        $second = $this->call('forkTheme', ['slug' => 'about']);
+        $this->assertSame(1, (int) $second->result);
+        $this->assertSame($existingId, $second->data['page_id'], 'the already-customized page is returned, not re-forked');
+        $this->assertStringContainsString('exists', json_encode($second->messages));
+
+        $count = (int) $this->db->fetchOne("SELECT COUNT(*) FROM page WHERE slug = 'about' AND deleted = 0");
+        $this->assertSame(1, $count, 'exactly one page claims the slug');
+    }
+
+    // ----- saveDesign ---------------------------------------------------------------------------
+
+    #[Test]
+    public function save_design_is_denied_to_a_guest(): void
+    {
+        $this->login('anon', 'org-test', 'guest');
+        $res = $this->call('saveDesign', ['page_id' => 'x', 'html' => '<div></div>']);
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('not_allowed', json_encode($res->messages));
+    }
+
+    #[Test]
+    public function save_design_errors_on_a_missing_page_id(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('saveDesign', ['page_id' => '', 'html' => '<div></div>']);
+        $this->assertSame(0, (int) $res->result, 'no page_id is refused up front');
+    }
+
+    #[Test]
+    public function save_design_errors_when_the_page_does_not_exist(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->call('saveDesign', ['page_id' => 'no-such-page', 'html' => '<div></div>']);
+        $this->assertSame(0, (int) $res->result, 'a non-existent row is a clean error');
+    }
+
+    #[Test]
+    public function save_design_stores_the_builder_body_strips_script_and_keeps_the_project(): void
+    {
+        $this->loginAs('admin');
+        $id = (new Tiger_Model_Page())->insert([
+            'type' => Tiger_Model_Page::TYPE_PAGE, 'locale' => 'en', 'title' => 'Canvas',
+            'slug' => 'canvas', 'page_key' => 'canvas', 'body' => '', 'format' => Tiger_Model_Page::FORMAT_HTML,
+            'status' => Tiger_Model_Page::STATUS_DRAFT,
+        ]);
+        $this->escapeTxn();
+
+        $res = $this->call('saveDesign', [
+            'page_id' => $id,
+            'html'    => '<section>Hero</section><script>alert(1)</script>',
+            'css'     => '.hero{color:red}',
+            'project' => json_encode(['pages' => [['name' => 'p']]]),
+        ]);
+        $this->assertSame(1, (int) $res->result);
+
+        $row = (new Tiger_Model_Page())->findById($id);
+        $this->assertSame(Tiger_Model_Page::FORMAT_BUILDER, $row->format, 'the builder format is set');
+        $this->assertStringContainsString('<style>', (string) $row->body, 'the CSS is wrapped in a <style> block');
+        $this->assertStringContainsString('Hero', (string) $row->body);
+        $this->assertStringNotContainsString('<script', (string) $row->body, 'script is stripped — builder is a SAFE format');
+
+        $meta = json_decode((string) $row->meta, true);
+        $this->assertArrayHasKey('builder', $meta, 'the lossless project JSON is preserved in meta.builder');
+        $this->assertSame('p', $meta['builder']['pages'][0]['name']);
+    }
+}
diff --git a/tests/Integration/Code/CodeControllerTest.php b/tests/Integration/Code/CodeControllerTest.php
new file mode 100644
index 0000000..9814dc0
--- /dev/null
+++ b/tests/Integration/Code/CodeControllerTest.php
@@ -0,0 +1,97 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Code;
+
+use Code_IndexController;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\ControllerTestCase;
+use Tiger_Model_Code;
+use Zend_Session;
+
+/**
+ * Code_IndexController — the Code Area admin screens, dispatched through the harness (rendering off).
+ *
+ * The controller is thin READ+RENDER (every mutation is a Code_Service_Code /api call, covered by the
+ * service tests): index is the DataTables shell, edit prefills the CodeMirror editor from the requested
+ * `code` row. So the assertion is the shell — the action dispatches, sets its title + view-vars, and the
+ * editor form is prefilled from the row (with its version history). Zend_Session unit-test mode is on for
+ * the FlashMessenger the base wires in init(). (ACL is the unbypassable Authorization plugin, exercised
+ * elsewhere; the harness dispatches the action directly — the service tests own the superadmin gate.)
+ */
+#[CoversClass(Code_IndexController::class)]
+final class CodeControllerTest extends ControllerTestCase
+{
+    private bool $priorUnitTestMode;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->priorUnitTestMode = Zend_Session::$_unitTestEnabled;
+        Zend_Session::$_unitTestEnabled = true;
+        $_SESSION = [];
+    }
+
+    protected function tearDown(): void
+    {
+        $_SESSION = [];
+        Zend_Session::$_unitTestEnabled = $this->priorUnitTestMode;
+        parent::tearDown();
+    }
+
+    #[Test]
+    public function index_renders_the_code_list_shell(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatchAction(Code_IndexController::class, 'index', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+
+        $view = $this->controller()->view;
+        $this->assertSame('Code — Tiger Admin', $view->title);
+        $this->assertTrue($view->useDataTables);
+    }
+
+    #[Test]
+    public function edit_with_no_id_renders_a_blank_new_snippet_form(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatchAction(Code_IndexController::class, 'edit', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('New', $view->title);
+        $this->assertNull($view->row, 'no row to edit');
+        $this->assertSame([], $view->versions);
+        $this->assertNotNull($view->form);
+    }
+
+    #[Test]
+    public function edit_with_an_id_prefills_the_editor_from_the_row(): void
+    {
+        $this->loginAs('superadmin');
+        $id = (new Tiger_Model_Code())->insert([
+            'org_id'       => '',
+            'name'         => 'Greeter',
+            'description'  => 'a helper',
+            'language'     => Tiger_Model_Code::LANG_PHP,
+            'code'         => "if (!function_exists('w6_greet')) { function w6_greet() {} }",
+            'run_location' => Tiger_Model_Code::LOC_GLOBAL,
+            'priority'     => 100,
+            'active'       => 1,
+            'status'       => Tiger_Model_Code::STATUS_ACTIVE,
+        ]);
+
+        $res = $this->dispatchAction(Code_IndexController::class, 'edit', ['id' => $id], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Edit', $view->title);
+        $this->assertNotNull($view->row, 'the snippet row loaded');
+        $this->assertSame('Greeter', $view->row->name);
+        $this->assertSame('Greeter', $view->form->getValue('name'), 'the editor form is prefilled from the row');
+        $this->assertSame(Tiger_Model_Code::LANG_PHP, $view->form->getValue('language'));
+        $this->assertNotNull($view->versions, 'the version history is passed to the editor');
+    }
+}
diff --git a/tests/Integration/Code/CodeServiceExtraTest.php b/tests/Integration/Code/CodeServiceExtraTest.php
new file mode 100644
index 0000000..6eee6ab
--- /dev/null
+++ b/tests/Integration/Code/CodeServiceExtraTest.php
@@ -0,0 +1,311 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Code;
+
+use Code_Service_Code;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Code_Modules;
+use Tiger_Model_Code;
+use Zend_Registry;
+
+/**
+ * Code_Service_Code — the surface Wave 3 left uncovered: the datatable's MODULE-snippet merge, the local
+ * activate/deactivate happy path, the module-snippet toggle (_toggleModule), the moduleSource "view
+ * source" read, and the restore guard. Together these characterize the two-origin Code Area (local `code`
+ * rows + file-based module snippets) and the compile-and-rebuild rails.
+ *
+ * A throwaway fixture `code` module is planted under the harness app path (APPLICATION_PATH/modules,
+ * removed in tearDown), so module discovery has a real snippet file. The service is superadmin-gated
+ * (authoring server PHP is the top privilege), so every test runs as superadmin. `tiger.auth.stateless`
+ * is flipped for the CSRF-free service dispatch, and any bundle a rebuild wrote is scrubbed in tearDown.
+ */
+#[CoversClass(Code_Service_Code::class)]
+final class CodeServiceExtraTest extends IntegrationTestCase
+{
+    private const SLUG = 'w6codemod';
+
+    private string $moduleDir;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Zend_Registry::set('tiger.auth.stateless', true);
+
+        $this->moduleDir = APPLICATION_PATH . '/modules/' . self::SLUG;
+        $snip = $this->moduleDir . '/snippets';
+        @mkdir($snip, 0777, true);
+        file_put_contents($snip . '/greet.php', <<<'PHP'
+<?php
+// tiger:snippet label="Greeter" category="Strings" scope="global"
+//   description="w6_greet(): a tiny greeter."
+
+if (!function_exists('w6_greet')) {
+    function w6_greet() { return 'hi'; }
+}
+PHP);
+    }
+
+    protected function tearDown(): void
+    {
+        Zend_Registry::set('tiger.auth.stateless', false);
+        $this->rmrf($this->moduleDir);
+        $dir = APPLICATION_ROOT . '/storage/cache/code';
+        foreach (glob($dir . '/global.*.php') ?: [] as $f) { @unlink($f); }
+        foreach (glob($dir . '/inject.global.*.php') ?: [] as $f) { @unlink($f); }
+        foreach (glob(APPLICATION_ROOT . '/public/_code/global.*') ?: [] as $f) { @unlink($f); }
+        parent::tearDown();
+    }
+
+    private function rmrf(string $dir): void
+    {
+        if (!is_dir($dir)) { @unlink($dir); return; }
+        foreach (scandir($dir) as $e) {
+            if ($e === '.' || $e === '..') { continue; }
+            $p = $dir . '/' . $e;
+            is_dir($p) && !is_link($p) ? $this->rmrf($p) : @unlink($p);
+        }
+        @rmdir($dir);
+    }
+
+    private function call(string $action, array $params = []): object
+    {
+        return (new Code_Service_Code(['action' => $action] + $params))->getResponse();
+    }
+
+    private function key(string $file): string
+    {
+        return self::SLUG . '/' . $file;
+    }
+
+    // ----- datatable: the two-origin merge ------------------------------------------------------
+
+    #[Test]
+    public function datatable_merges_local_rows_and_module_snippets(): void
+    {
+        $this->loginAs('superadmin');
+        (new Tiger_Model_Code())->insert([
+            'org_id' => '', 'name' => 'Local Helper', 'language' => Tiger_Model_Code::LANG_PHP,
+            'code' => "if(!function_exists('w6_local')){function w6_local(){}}",
+            'run_location' => Tiger_Model_Code::LOC_GLOBAL, 'active' => 0, 'status' => Tiger_Model_Code::STATUS_DRAFT,
+        ]);
+
+        $data = $this->call('datatable', ['draw' => 3, 'start' => 0, 'length' => 100])->data;
+        $this->assertSame(3, $data['draw']);
+
+        $bySource = ['local' => 0, 'module' => 0];
+        $moduleRow = null;
+        foreach ($data['data'] as $r) {
+            $bySource[$r['source']] = ($bySource[$r['source']] ?? 0) + 1;
+            if ($r['source'] === 'module' && $r['code_id'] === 'module:' . $this->key('greet')) { $moduleRow = $r; }
+        }
+        $this->assertGreaterThanOrEqual(1, $bySource['local'], 'the local `code` row is listed');
+        $this->assertNotNull($moduleRow, 'the discovered module snippet is merged in');
+        $this->assertSame('Greeter', $moduleRow['name']);
+        $this->assertSame(self::SLUG, $moduleRow['module']);
+        $this->assertTrue($moduleRow['can_view'], 'module rows are read-only view-source');
+        $this->assertFalse($moduleRow['can_edit']);
+        $this->assertFalse($moduleRow['active'], 'not active until toggled');
+    }
+
+    #[Test]
+    public function datatable_language_filter_for_css_excludes_php_module_snippets(): void
+    {
+        $this->loginAs('superadmin');
+        // Module snippets are all PHP, so a non-php language filter must drop them.
+        $data = $this->call('datatable', ['draw' => 1, 'start' => 0, 'length' => 100, 'language' => Tiger_Model_Code::LANG_CSS])->data;
+        $sources = array_column($data['data'], 'source');
+        $this->assertNotContains('module', $sources, 'no PHP module snippet appears under a css filter');
+    }
+
+    #[Test]
+    public function datatable_search_filters_module_snippets_by_their_hint_text(): void
+    {
+        $this->loginAs('superadmin');
+        // A search that matches a LOCAL row but NOT the module snippet's hint → the module loop's
+        // no-match `continue` branch runs (the module snippet is excluded).
+        (new Tiger_Model_Code())->insert([
+            'org_id' => '', 'name' => 'Zebra Local', 'language' => Tiger_Model_Code::LANG_PHP,
+            'code' => "if(!function_exists('w6_zebra')){function w6_zebra(){}}",
+            'run_location' => Tiger_Model_Code::LOC_GLOBAL, 'active' => 0, 'status' => Tiger_Model_Code::STATUS_DRAFT,
+        ]);
+
+        $data = $this->call('datatable', ['draw' => 1, 'start' => 0, 'length' => 100, 'search' => 'Zebra'])->data;
+        $sources = array_column($data['data'], 'source');
+        $this->assertNotContains('module', $sources, 'the module snippet is filtered out by a non-matching search');
+
+        // A search that DOES match the module snippet's label surfaces it.
+        $hit = $this->call('datatable', ['draw' => 1, 'start' => 0, 'length' => 100, 'search' => 'Greeter'])->data;
+        $names = array_column($hit['data'], 'name');
+        $this->assertContains('Greeter', $names, 'a matching search surfaces the module snippet');
+    }
+
+    // ----- moduleSource: read live from the file ------------------------------------------------
+
+    #[Test]
+    public function module_source_returns_the_live_file_body(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->call('moduleSource', ['code_id' => 'module:' . $this->key('greet')]);
+
+        $this->assertSame(1, (int) $res->result);
+        $this->assertSame($this->key('greet'), $res->data['key']);
+        $this->assertSame('Greeter', $res->data['name']);
+        $this->assertSame(self::SLUG, $res->data['module']);
+        $this->assertFalse($res->data['active']);
+        $this->assertStringContainsString('function w6_greet', $res->data['source'], 'the raw file source is read live');
+    }
+
+    // ----- local activate/deactivate happy path (setActive is a plain update — no nested txn) ----
+
+    #[Test]
+    public function activate_then_deactivate_a_local_snippet_flips_active_and_rebuilds(): void
+    {
+        $this->loginAs('superadmin');
+        $id = (new Tiger_Model_Code())->insert([
+            'org_id' => '', 'name' => 'Toggle Me', 'language' => Tiger_Model_Code::LANG_PHP,
+            'code' => "if(!function_exists('w6_toggle')){function w6_toggle(){return 1;}}",
+            'run_location' => Tiger_Model_Code::LOC_GLOBAL, 'active' => 0, 'status' => Tiger_Model_Code::STATUS_DRAFT,
+        ]);
+
+        $on = $this->call('activate', ['code_id' => $id]);
+        $this->assertSame(1, (int) $on->result, 'activate succeeds and the bundle rebuilds');
+        $this->assertSame(1, (int) $this->db->fetchOne('SELECT active FROM code WHERE code_id = ?', [$id]));
+
+        $off = $this->call('deactivate', ['code_id' => $id]);
+        $this->assertSame(1, (int) $off->result);
+        $this->assertSame(0, (int) $this->db->fetchOne('SELECT active FROM code WHERE code_id = ?', [$id]));
+    }
+
+    #[Test]
+    public function activating_a_local_snippet_with_a_parse_error_is_refused(): void
+    {
+        $this->loginAs('superadmin');
+        // A row can only reach the DB active-lint via activate; seed broken PHP directly, then try to turn it on.
+        $id = (new Tiger_Model_Code())->insert([
+            'org_id' => '', 'name' => 'Broken', 'language' => Tiger_Model_Code::LANG_PHP,
+            'code' => 'function broken( {', 'run_location' => Tiger_Model_Code::LOC_GLOBAL,
+            'active' => 0, 'status' => Tiger_Model_Code::STATUS_DRAFT,
+        ]);
+
+        $res = $this->call('activate', ['code_id' => $id]);
+        $this->assertSame(0, (int) $res->result, 'a parse error cannot be activated');
+        $this->assertStringContainsString('Cannot activate', json_encode($res->messages));
+    }
+
+    // ----- module-snippet toggle (_toggleModule) ------------------------------------------------
+
+    #[Test]
+    public function toggling_a_module_snippet_flips_the_config_active_set(): void
+    {
+        $this->loginAs('superadmin');
+        $key = $this->key('greet');
+        $this->assertFalse(Tiger_Code_Modules::isActive($key), 'inactive to start');
+
+        $on = $this->call('activate', ['code_id' => 'module:' . $key]);
+        $this->assertSame(1, (int) $on->result, 'the module snippet activates (config flag, not a code row)');
+        $this->assertTrue(Tiger_Code_Modules::isActive($key), 'the config active-set now carries the key');
+
+        $off = $this->call('deactivate', ['code_id' => 'module:' . $key]);
+        $this->assertSame(1, (int) $off->result);
+        $this->assertFalse(Tiger_Code_Modules::isActive($key), 'the key is removed from the active-set');
+    }
+
+    #[Test]
+    public function toggling_an_unknown_module_snippet_is_a_clean_error(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->call('activate', ['code_id' => 'module:' . self::SLUG . '/does-not-exist']);
+        $this->assertSame(0, (int) $res->result, 'a vanished module snippet fails cleanly, no crash');
+        $this->assertStringNotContainsString('not_allowed', json_encode($res->messages), 'it failed on the lookup, not the ACL');
+    }
+
+    // ----- save happy path (the SavepointAdapter nests the model's own write+version txn) --------
+
+    #[Test]
+    public function save_stores_valid_php_lints_it_and_rebuilds_the_bundle(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->call('save', [
+            'name'     => 'Slugify',
+            'language' => Tiger_Model_Code::LANG_PHP,
+            'code'     => "if (!function_exists('w6_slug')) { function w6_slug(\$s) { return strtolower(\$s); } }",
+            'active'   => '1',
+            'priority' => '50',
+        ]);
+        $this->assertSame(1, (int) $res->result, 'valid PHP saves + rebuilds live');
+        $id = $res->data['code_id'];
+
+        $row = (new Tiger_Model_Code())->findById($id);
+        $this->assertSame('Slugify', $row->name);
+        $this->assertSame(Tiger_Model_Code::LANG_PHP, $row->language);
+        $this->assertSame(1, (int) $row->active, 'stored active');
+        $this->assertSame(50, (int) $row->priority);
+        $this->assertNull($row->auto_insert, 'php has no injection location');
+    }
+
+    #[Test]
+    public function save_a_client_css_snippet_sets_the_head_auto_insert_and_skips_the_php_lint(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->call('save', [
+            'name'     => 'Brand CSS',
+            'language' => Tiger_Model_Code::LANG_CSS,
+            'code'     => '.brand{color:red}',
+            'active'   => '1',
+            'priority' => '10',
+        ]);
+        $this->assertSame(1, (int) $res->result, 'a css snippet needs no parse-check');
+        $row = (new Tiger_Model_Code())->findById($res->data['code_id']);
+        $this->assertSame(Tiger_Model_Code::LANG_CSS, $row->language);
+        $this->assertSame(Tiger_Model_Code::AUTO_HEAD, $row->auto_insert, 'css always injects into the head');
+    }
+
+    // ----- restore happy path -------------------------------------------------------------------
+
+    #[Test]
+    public function restore_reverts_a_snippet_to_a_prior_version(): void
+    {
+        $this->loginAs('superadmin');
+        // v1 then v2 through the service (each save snapshots a version).
+        $create = $this->call('save', [
+            'name' => 'Versioned', 'language' => Tiger_Model_Code::LANG_PHP,
+            'code' => "if(!function_exists('w6_v1')){function w6_v1(){return 1;}}",
+            'active' => '0', 'priority' => '100',
+        ]);
+        $id = $create->data['code_id'];
+        $this->call('save', [
+            'code_id' => $id, 'name' => 'Versioned v2', 'language' => Tiger_Model_Code::LANG_PHP,
+            'code' => "if(!function_exists('w6_v1')){function w6_v1(){return 2;}}",
+            'active' => '0', 'priority' => '100',
+        ]);
+
+        $res = $this->call('restore', ['code_id' => $id, 'version' => 1]);
+        $this->assertSame(1, (int) $res->result, 'restore to v1 succeeds');
+
+        $row = (new Tiger_Model_Code())->findById($id);
+        $this->assertSame('Versioned', $row->name, 'the snippet reverted to its v1 name');
+        $this->assertStringContainsString('return 1', (string) $row->code);
+    }
+
+    // ----- restore guard ------------------------------------------------------------------------
+
+    #[Test]
+    public function restore_with_a_bad_version_is_a_clean_error(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->call('restore', ['code_id' => 'whatever', 'version' => 0]);
+        $this->assertSame(0, (int) $res->result, 'version < 1 is refused up front');
+    }
+
+    #[Test]
+    public function restore_with_a_missing_id_is_a_clean_error(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->call('restore', ['code_id' => '', 'version' => 2]);
+        $this->assertSame(0, (int) $res->result);
+    }
+}
diff --git a/tests/Integration/Controller/CoreControllerActionsTest.php b/tests/Integration/Controller/CoreControllerActionsTest.php
new file mode 100644
index 0000000..6d6552a
--- /dev/null
+++ b/tests/Integration/Controller/CoreControllerActionsTest.php
@@ -0,0 +1,503 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Controller;
+
+use AdminController;
+use ApiController;
+use ArrayObject;
+use AuthController;
+use ErrorController;
+use IndexController;
+use PageController;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\ControllerTestCase;
+use Tiger_Model_Page;
+use Tiger_Model_User;
+use Tiger_Model_UserCredential;
+use Zend_Auth;
+use Zend_Auth_Storage_NonPersistent;
+use Zend_Config;
+use Zend_Controller_Action_Exception;
+use Zend_Controller_Plugin_ErrorHandler;
+use Zend_Registry;
+use Zend_Session;
+
+/**
+ * Drives the six default-namespace controllers (`core/controllers/*`) through the dispatch harness,
+ * covering the ACTION branches the reference `CoreControllerDispatchTest` left untouched: every
+ * AuthController action (login GET/redirect, logout, lock arm/unlock, forgot/reset/otp, security,
+ * me, the TOTP endpoints), ApiController's openapi discovery gate, IndexController's home-page +
+ * marketing actions, ErrorController's 404/500/403 classification, PageController's CMS + theme
+ * dispatch, and AdminController's dashboard.
+ *
+ * View rendering stays OFF (the harness covers action LOGIC, not the .phtml). Actions that end in a
+ * `.phtml` render are asserted on their OUTCOME — the response code, the redirect/`_forward`, the
+ * JSON body, or the view vars they set — never the rendered HTML. Session runs in Zend's array-backed
+ * unit-test mode; a real crypto key + pepper are seeded so the password-verifying paths (unlock) run.
+ */
+#[CoversClass(ApiController::class)]
+#[CoversClass(AuthController::class)]
+#[CoversClass(ErrorController::class)]
+#[CoversClass(IndexController::class)]
+#[CoversClass(PageController::class)]
+#[CoversClass(AdminController::class)]
+final class CoreControllerActionsTest extends ControllerTestCase
+{
+    private const KEY    = 'ERERERERERERERERERERERERERERERERERERERERERE=';
+    private const PEPPER = 'cGVwcGVyLUEtMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA=';
+
+    private bool $priorUnitTestMode;
+    private $priorConfig;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->priorUnitTestMode = Zend_Session::$_unitTestEnabled;
+        Zend_Session::$_unitTestEnabled = true;
+        $_SESSION = [];
+
+        $this->priorConfig = Zend_Registry::isRegistered('Zend_Config') ? Zend_Registry::get('Zend_Config') : null;
+        $this->setTigerConfig([]);   // crypto + pepper only (no discovery, no home page)
+
+        // The redirector exits the process by default (redirectAndExit) — fatal under CLI. Disable exit so
+        // a `gotoUrl` just sets the Location header, which the harness reads via redirectLocation().
+        \Zend_Controller_Action_HelperBroker::getStaticHelper('redirector')->setExit(false);
+    }
+
+    protected function tearDown(): void
+    {
+        $_SESSION = [];
+        Zend_Session::$_unitTestEnabled = $this->priorUnitTestMode;
+        if ($this->priorConfig !== null) {
+            Zend_Registry::set('Zend_Config', $this->priorConfig);
+        }
+        parent::tearDown();
+    }
+
+    /** Seed the process-global Zend_Config with crypto secrets + whatever extra `tiger.*` a test needs. */
+    private function setTigerConfig(array $tigerExtra): void
+    {
+        $tiger = ['crypto' => ['key' => self::KEY], 'security' => ['pepper' => self::PEPPER], 'log' => ['writer' => 'null']] + $tigerExtra;
+        Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => $tiger], true));
+        \Tiger_Log::reset();   // rebuild the (cached) logger against this config — a null sink keeps test output clean
+    }
+
+    /** Create an active user with a password credential; returns [user_id, email]. */
+    private function makeUserWithPassword(string $password): array
+    {
+        $email = 'ctl-' . bin2hex(random_bytes(8)) . '@example.test';
+        $uid   = (new Tiger_Model_User())->insert(['email' => $email, 'status' => 'active']);
+        (new Tiger_Model_UserCredential())->setPassword($uid, $password);
+        return [$uid, $email];
+    }
+
+    /** Put a full identity object into Zend_Auth (in-memory storage — no $_SESSION under CLI). */
+    private function writeIdentity(object $identity): void
+    {
+        $auth = Zend_Auth::getInstance();
+        $auth->setStorage(new Zend_Auth_Storage_NonPersistent());
+        $auth->getStorage()->write($identity);
+    }
+
+    /** Insert a published CMS page and return its id. */
+    private function seedPage(array $overrides = []): string
+    {
+        return (new Tiger_Model_Page())->insert($overrides + [
+            'type'   => Tiger_Model_Page::TYPE_PAGE,
+            'slug'   => 'p-' . bin2hex(random_bytes(6)),
+            'locale' => 'en',
+            'title'  => 'Test Page',
+            'body'   => '<p>Hello world.</p>',
+            'format' => Tiger_Model_Page::FORMAT_HTML,
+            'status' => Tiger_Model_Page::STATUS_PUBLISHED,
+        ]);
+    }
+
+    // ===== ApiController ======================================================
+
+    #[Test]
+    public function openapi_action_404s_when_discovery_is_disabled(): void
+    {
+        $res = $this->dispatchAction(ApiController::class, 'openapi', [], 'GET');
+        $this->assertSame(404, $res->getHttpResponseCode(), 'the API surface is not published unless opted in');
+    }
+
+    #[Test]
+    public function openapi_action_emits_the_spec_when_discovery_is_enabled(): void
+    {
+        $this->setTigerConfig(['api' => ['discovery' => '1'], 'site' => ['name' => 'Acme']]);
+        $res  = $this->dispatchAction(ApiController::class, 'openapi', [], 'GET');
+        $json = $this->jsonResponse();
+
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertArrayHasKey('openapi', $json, 'a real OpenAPI 3 document is emitted');
+        $this->assertSame('Acme API', $json['info']['title'] ?? '', 'the site name titles the spec');
+    }
+
+    // ===== IndexController ====================================================
+
+    #[Test]
+    public function index_action_serves_the_builtin_landing_when_no_home_page_is_set(): void
+    {
+        $res = $this->dispatchAction(IndexController::class, 'index', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertSame(\Tiger_Version::VERSION, $this->controller()->view->tigerVersion, 'the landing exposes the platform version');
+        $this->assertNotEmpty($this->controller()->view->servedBy, 'the "served from vendor" proof var is set');
+    }
+
+    #[Test]
+    public function index_action_forwards_to_the_cms_page_when_a_published_home_page_is_configured(): void
+    {
+        $pageId = $this->seedPage();
+        $this->setTigerConfig(['site' => ['home_page' => $pageId]]);
+
+        $this->dispatchAction(IndexController::class, 'index', [], 'GET');
+
+        $fwd = $this->forwardedTo();
+        $this->assertSame('page', $fwd['controller'], 'the home page dispatches through PageController');
+        $this->assertSame('view', $fwd['action']);
+        $this->assertFalse($fwd['dispatched'], 'a _forward re-queues the request for dispatch');
+    }
+
+    #[Test]
+    public function every_marketing_action_dispatches_cleanly(): void
+    {
+        foreach (['vibe', 'agency', 'developers', 'creators', 'hosting', 'features'] as $action) {
+            $res = $this->dispatchAction(IndexController::class, $action, [], 'GET');
+            $this->assertSame(200, $res->getHttpResponseCode(), "the /$action marketing page dispatches without error");
+        }
+    }
+
+    // ===== AuthController =====================================================
+
+    #[Test]
+    public function login_get_renders_the_form_for_a_guest(): void
+    {
+        $res = $this->dispatchAction(AuthController::class, 'login', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertSame('Sign in — Tiger', $this->controller()->view->title);
+        $this->assertNull($this->controller()->view->notice, 'no notice without a reset/out flag');
+    }
+
+    #[Test]
+    public function login_get_shows_the_reset_notice(): void
+    {
+        $this->dispatchAction(AuthController::class, 'login', ['reset' => '1'], 'GET');
+        $this->assertStringContainsString('reset', (string) $this->controller()->view->notice);
+    }
+
+    #[Test]
+    public function login_get_shows_the_signed_out_notice(): void
+    {
+        $this->dispatchAction(AuthController::class, 'login', ['out' => '1'], 'GET');
+        $this->assertStringContainsString('signed out', (string) $this->controller()->view->notice);
+    }
+
+    #[Test]
+    public function login_get_redirects_an_already_authenticated_admin_to_the_back_office(): void
+    {
+        $this->writeIdentity((object) ['user_id' => 'u1', 'org_id' => 'o1', 'role' => 'admin']);
+        $this->dispatchAction(AuthController::class, 'login', [], 'GET');
+        $this->assertStringContainsString('/admin', $this->redirectLocation(), 'an admin lands on /admin');
+    }
+
+    #[Test]
+    public function login_get_redirects_an_already_authenticated_member_home(): void
+    {
+        $this->writeIdentity((object) ['user_id' => 'u1', 'org_id' => 'o1', 'role' => 'user']);
+        $this->dispatchAction(AuthController::class, 'login', [], 'GET');
+        $loc = $this->redirectLocation();
+        $this->assertNotSame('', $loc, 'a signed-in member is redirected off the login form');
+        $this->assertStringNotContainsString('/admin', $loc, 'a non-admin does not land on the back office');
+    }
+
+    #[Test]
+    public function logout_action_renders_the_signed_out_card(): void
+    {
+        $res = $this->dispatchAction(AuthController::class, 'logout', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertSame('Signed out — Tiger', $this->controller()->view->title);
+    }
+
+    #[Test]
+    public function lock_get_bounces_a_guest_to_login(): void
+    {
+        $res = $this->dispatchAction(AuthController::class, 'lock', [], 'GET');
+        $this->assertStringContainsString('/auth/login', $this->redirectLocation(), 'the lock screen requires an identity');
+    }
+
+    #[Test]
+    public function lock_get_arms_the_lock_for_an_authenticated_user(): void
+    {
+        $this->writeIdentity((object) ['user_id' => 'u1', 'org_id' => 'o1', 'role' => 'user']);
+        $res = $this->dispatchAction(AuthController::class, 'lock', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertSame('Locked — Tiger', $this->controller()->view->title);
+    }
+
+    #[Test]
+    public function lock_post_unlocks_with_the_correct_password(): void
+    {
+        [$uid, $email] = $this->makeUserWithPassword('unlock me right 12');
+        $this->writeIdentity((object) ['user_id' => $uid, 'org_id' => '', 'role' => 'user', 'email' => $email]);
+
+        $res  = $this->dispatchAction(AuthController::class, 'lock', ['password' => 'unlock me right 12'], 'POST');
+        $json = $this->jsonResponse();
+
+        $this->assertSame(1, (int) ($json['result'] ?? 0), 'the right password clears the lock');
+        $this->assertArrayHasKey('redirect', $json);
+    }
+
+    #[Test]
+    public function lock_post_refuses_a_wrong_password(): void
+    {
+        [$uid, $email] = $this->makeUserWithPassword('the real one 34');
+        $this->writeIdentity((object) ['user_id' => $uid, 'org_id' => '', 'role' => 'user', 'email' => $email]);
+
+        $res  = $this->dispatchAction(AuthController::class, 'lock', ['password' => 'the WRONG one'], 'POST');
+        $json = $this->jsonResponse();
+
+        $this->assertSame(0, (int) ($json['result'] ?? -1), 'a bad password stays locked');
+        $this->assertSame(401, $res->getHttpResponseCode());
+    }
+
+    #[Test]
+    public function lock_post_send_code_emails_an_unlock_code(): void
+    {
+        [$uid, $email] = $this->makeUserWithPassword('code path pw 567');
+        $this->writeIdentity((object) ['user_id' => $uid, 'org_id' => '', 'role' => 'user', 'email' => $email]);
+
+        $this->dispatchAction(AuthController::class, 'lock', ['send_code' => '1'], 'POST');
+        $this->assertSame(1, (int) ($this->jsonResponse()['result'] ?? 0), 'requesting an unlock code always returns success');
+    }
+
+    #[Test]
+    public function forgot_get_renders_and_post_is_enumeration_safe(): void
+    {
+        $get = $this->dispatchAction(AuthController::class, 'forgot', [], 'GET');
+        $this->assertSame('Reset password — Tiger', $this->controller()->view->title);
+
+        $this->dispatchAction(AuthController::class, 'forgot', ['email' => 'nobody@nowhere.test'], 'POST');
+        $this->assertSame(1, (int) ($this->jsonResponse()['result'] ?? 0), 'a reset request never reveals whether the account exists');
+    }
+
+    #[Test]
+    public function reset_get_wires_the_token_and_post_rejects_a_bad_token(): void
+    {
+        $this->dispatchAction(AuthController::class, 'reset', ['cid' => 'abc', 'code' => 'xyz'], 'GET');
+        $this->assertSame('abc', $this->controller()->view->cid);
+        $this->assertSame('xyz', $this->controller()->view->code);
+
+        $res = $this->dispatchAction(AuthController::class, 'reset', [
+            'cid' => 'no-such', 'code' => 'nope', 'password' => 'a new one here', 'confirm' => 'a new one here',
+        ], 'POST');
+        $this->assertSame(0, (int) ($this->jsonResponse()['result'] ?? -1), 'an invalid reset token fails');
+        $this->assertSame(400, $res->getHttpResponseCode());
+    }
+
+    #[Test]
+    public function otp_get_renders_and_post_requests_a_code(): void
+    {
+        $this->dispatchAction(AuthController::class, 'otp', [], 'GET');
+        $this->assertSame('Sign in with a code — Tiger', $this->controller()->view->title);
+
+        // No `code` in the body → request-a-code step, always a silent success (no enumeration).
+        $this->dispatchAction(AuthController::class, 'otp', ['email' => 'someone@nowhere.test'], 'POST');
+        $this->assertSame(1, (int) ($this->jsonResponse()['result'] ?? 0));
+    }
+
+    #[Test]
+    public function otp_post_with_a_bad_code_is_refused(): void
+    {
+        $res = $this->dispatchAction(AuthController::class, 'otp', [
+            'email' => 'ghost@nowhere.test', 'code' => '000000',
+        ], 'POST');
+        $this->assertSame(0, (int) ($this->jsonResponse()['result'] ?? -1));
+        $this->assertSame(401, $res->getHttpResponseCode());
+    }
+
+    #[Test]
+    public function security_get_bounces_a_guest_and_serves_the_screen_for_a_user(): void
+    {
+        $guest = $this->dispatchAction(AuthController::class, 'security', [], 'GET');
+        $this->assertStringContainsString('/auth/login', $this->redirectLocation(), 'a guest is sent to sign in first');
+
+        $this->writeIdentity((object) ['user_id' => 'u1', 'org_id' => 'o1', 'role' => 'user']);
+        $res = $this->dispatchAction(AuthController::class, 'security', [], 'GET');
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertIsArray($this->controller()->view->twofa, 'the 2FA status is handed to the view');
+    }
+
+    #[Test]
+    public function me_action_reports_the_current_identity(): void
+    {
+        $guest = $this->dispatchAction(AuthController::class, 'me', [], 'GET');
+        $this->assertSame(0, (int) ($this->jsonResponse()['result'] ?? -1), 'a guest has no identity');
+
+        $this->writeIdentity((object) ['user_id' => 'u9', 'org_id' => 'o1', 'role' => 'user']);
+        $this->dispatchAction(AuthController::class, 'me', [], 'GET');
+        $json = $this->jsonResponse();
+        $this->assertSame(1, (int) ($json['result'] ?? 0));
+        $this->assertSame('u9', $json['data']['user_id'] ?? null);
+    }
+
+    #[Test]
+    public function the_totp_management_endpoints_deny_a_guest(): void
+    {
+        foreach (['totpSetup', 'totpActivate', 'totpDisable'] as $action) {
+            $res = $this->dispatchAction(AuthController::class, $action, [], 'POST');
+            $this->assertSame(0, (int) ($this->jsonResponse()['result'] ?? -1), "$action refuses an unauthenticated caller");
+            $this->assertSame(401, $res->getHttpResponseCode());
+        }
+    }
+
+    // ===== ErrorController ====================================================
+
+    #[Test]
+    public function error_action_with_no_handler_falls_back_to_500(): void
+    {
+        $res = $this->dispatchAction(ErrorController::class, 'error', [], 'GET');
+        $this->assertSame(500, $res->getHttpResponseCode());
+        $this->assertSame(500, $this->controller()->view->statusCode);
+    }
+
+    #[Test]
+    public function error_action_classifies_a_no_route_miss_as_404(): void
+    {
+        $handler = new ArrayObject([
+            'type'      => Zend_Controller_Plugin_ErrorHandler::EXCEPTION_NO_ROUTE,
+            'exception' => new \Exception('no route'),
+        ], ArrayObject::ARRAY_AS_PROPS);
+
+        $res = $this->dispatchAction(ErrorController::class, 'error', ['error_handler' => $handler], 'GET');
+        $this->assertSame(404, $res->getHttpResponseCode());
+        $this->assertSame(404, $this->controller()->view->statusCode);
+    }
+
+    #[Test]
+    public function error_action_logs_and_renders_a_500_for_an_unhandled_exception(): void
+    {
+        $handler = new ArrayObject([
+            'type'      => Zend_Controller_Plugin_ErrorHandler::EXCEPTION_OTHER,
+            'exception' => new \RuntimeException('boom'),
+        ], ArrayObject::ARRAY_AS_PROPS);
+
+        $res = $this->dispatchAction(ErrorController::class, 'error', ['error_handler' => $handler], 'GET');
+        $this->assertSame(500, $res->getHttpResponseCode());
+        // Non-production (testing env) attaches the debug bundle for the view.
+        $this->assertIsArray($this->controller()->view->debug ?? null, 'the debug bundle is built outside production');
+        $this->assertSame('RuntimeException', $this->controller()->view->debug['exception']['type']);
+    }
+
+    #[Test]
+    public function forbidden_action_renders_a_403(): void
+    {
+        $res = $this->dispatchAction(ErrorController::class, 'forbidden', [], 'GET');
+        $this->assertSame(403, $res->getHttpResponseCode());
+        $this->assertSame(403, $this->controller()->view->statusCode);
+    }
+
+    // ===== PageController =====================================================
+
+    #[Test]
+    public function page_view_throws_a_404_for_a_missing_page(): void
+    {
+        $this->expectException(Zend_Controller_Action_Exception::class);
+        $this->dispatchAction(PageController::class, 'view', ['cms_page_id' => 'does-not-exist'], 'GET');
+    }
+
+    #[Test]
+    public function page_view_renders_a_published_page_in_the_theme_layout(): void
+    {
+        $pageId = $this->seedPage(['title' => 'About Us', 'body' => '<p>About.</p>']);
+
+        $res = $this->dispatchAction(PageController::class, 'view', ['cms_page_id' => $pageId], 'GET');
+
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertSame('About Us', $this->controller()->view->title, 'the page title is handed to the layout');
+        $this->assertStringContainsString('About.', (string) $this->controller()->view->cmsContent, 'the rendered body is passed to the view');
+    }
+
+    #[Test]
+    public function page_view_renders_a_self_contained_layout_page_into_the_body(): void
+    {
+        // A layout row + a page that references it → PageController emits a self-contained document
+        // (the theme layout is disabled and the HTML is set as the response body).
+        (new Tiger_Model_Page())->insert([
+            'type'     => Tiger_Model_Page::TYPE_LAYOUT,
+            'page_key' => 'full-doc',
+            'locale'   => 'en',
+            'title'    => 'Full Doc Layout',
+            // A phtml layout self-injects the page body via $this->content (renderer context var).
+            'body'     => '<html><head></head><body><?= $this->content ?></body></html>',
+            'format'   => Tiger_Model_Page::FORMAT_PHTML,
+            'status'   => Tiger_Model_Page::STATUS_PUBLISHED,
+        ]);
+        $pageId = $this->seedPage([
+            'title'      => 'Landing',
+            'body'       => '<h1>Landing body</h1>',
+            'layout_key' => 'full-doc',
+            'meta'       => json_encode(['head_html' => '<meta name="x" content="y">', 'body_scripts' => '<script>void 0;</script>']),
+        ]);
+
+        $res  = $this->dispatchAction(PageController::class, 'view', ['cms_page_id' => $pageId], 'GET');
+        $body = $res->getBody();
+
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertStringContainsString('Landing body', $body, 'the layout-wrapped page is emitted as the response body');
+        $this->assertStringContainsString('<meta name="x"', $body, 'the admin-authored head_html is spliced into <head>');
+        $this->assertStringContainsString('void 0;', $body, 'the admin-authored body scripts are spliced before </body>');
+    }
+
+    #[Test]
+    public function theme_content_throws_a_404_when_no_theme_partial_matches(): void
+    {
+        // No active theme is booted in the harness → Tiger_Theme::dir() is '' → always a 404.
+        $this->expectException(Zend_Controller_Action_Exception::class);
+        $this->dispatchAction(PageController::class, 'themeContent', ['theme_content_slug' => 'nope'], 'GET');
+    }
+
+    #[Test]
+    public function theme_content_serves_a_hinted_theme_partial(): void
+    {
+        // Stand up a throwaway theme dir with a hinted content partial, then point Tiger_Theme at it.
+        $themeDir = sys_get_temp_dir() . '/w6-theme-' . bin2hex(random_bytes(4));
+        mkdir($themeDir . '/content', 0777, true);
+        file_put_contents(
+            $themeDir . '/content/hello.phtml',
+            "<!-- tiger:page title=\"Hello There\" skin=\"default\" css=\"demos/x.css\" view=\"view.hello\" -->\n<h1>Theme body</h1>"
+        );
+        Zend_Registry::set('Tiger_ThemeDir', $themeDir);
+
+        try {
+            $res = $this->dispatchAction(PageController::class, 'themeContent', ['theme_content_slug' => 'hello'], 'GET');
+
+            $this->assertSame(200, $res->getHttpResponseCode());
+            $this->assertSame('Hello There', $this->controller()->view->title, 'the hint title drives the page title');
+            $this->assertStringContainsString('Theme body', (string) $this->controller()->view->cmsContent, 'the partial body (hint stripped) is handed to the view');
+            $this->assertStringContainsString('demos/x.css', (string) $this->controller()->view->pageHead, 'the hint css becomes a <link> in the head');
+            $this->assertStringContainsString('view.hello', (string) $this->controller()->view->pageScripts, 'the hint view becomes a <script> tag');
+        } finally {
+            Zend_Registry::set('Tiger_ThemeDir', '');
+            @unlink($themeDir . '/content/hello.phtml');
+            @rmdir($themeDir . '/content');
+            @rmdir($themeDir);
+        }
+    }
+
+    // ===== AdminController ====================================================
+
+    #[Test]
+    public function admin_dashboard_renders_for_an_admin(): void
+    {
+        $this->login('user-admin', 'org-test', 'admin');   // establishes the real ACL too
+        $res = $this->dispatchAction(AdminController::class, 'index', [], 'GET');
+
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertSame('Dashboard — Tiger Admin', $this->controller()->view->title);
+        $this->assertIsArray($this->controller()->view->widgets, 'the dashboard hands an (ACL-filtered) widget list to the view');
+    }
+}
diff --git a/tests/Integration/Identity/AdminControllerTest.php b/tests/Integration/Identity/AdminControllerTest.php
new file mode 100644
index 0000000..50c73d0
--- /dev/null
+++ b/tests/Integration/Identity/AdminControllerTest.php
@@ -0,0 +1,54 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Identity;
+
+use Identity_AdminController;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\ModuleControllerTestCase;
+
+/**
+ * Identity_AdminController — the Site Identity screen (name, tagline, logo, favicon, social links). Thin:
+ * index prefills the form from the live config and passes the two media references (logo/favicon) to the
+ * view. The harness dispatches index (rendering off) and asserts the prefilled view model.
+ */
+#[CoversClass(Identity_AdminController::class)]
+final class AdminControllerTest extends ModuleControllerTestCase
+{
+    #[Test]
+    public function index_prefills_the_identity_form_from_config(): void
+    {
+        $this->tiger([
+            'site' => ['name' => 'Acme Books', 'tagline' => 'We publish', 'logo' => 'media-logo', 'favicon' => 'media-fav'],
+            'seo'  => ['social' => ['twitter' => 'acme', 'github' => 'acme-oss']],
+        ]);
+        $this->loginAs('admin');
+        $this->dispatchAction(Identity_AdminController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Site Identity', (string) $view->title);
+        $this->assertInstanceOf(\Identity_Form_Identity::class, $view->form);
+        $this->assertSame('media-logo', (string) $view->logoId);
+        $this->assertSame('media-fav', (string) $view->faviconId);
+
+        $values = $view->form->getValues();
+        $this->assertSame('Acme Books', $values['site_name']);
+        $this->assertSame('acme', $values['social_twitter']);
+        $this->assertSame('acme-oss', $values['social_github']);
+    }
+
+    #[Test]
+    public function index_defaults_the_site_name_when_config_is_bare(): void
+    {
+        // No tiger.site node → the site_name falls back to 'Tiger'; logo/favicon blank.
+        $this->tiger([]);
+        $this->loginAs('admin');
+        $this->dispatchAction(Identity_AdminController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertSame('Tiger', $view->form->getValues()['site_name']);
+        $this->assertSame('', (string) $view->logoId);
+    }
+}
diff --git a/tests/Integration/Media/ControllersTest.php b/tests/Integration/Media/ControllersTest.php
new file mode 100644
index 0000000..e9086c7
--- /dev/null
+++ b/tests/Integration/Media/ControllersTest.php
@@ -0,0 +1,91 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Media;
+
+use Media_AdminController;
+use Media_CallbackController;
+use Media_FileController;
+use Media_IndexController;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Tiger\Tests\Support\ModuleControllerTestCase;
+use Tiger_Model_Media;
+
+/**
+ * The four Media controllers:
+ *   - Index    — the Media Library shell (uploader + DataTables), computes the client-thumbnail flag.
+ *   - Admin    — the settings screen (obfuscation form prefill).
+ *   - File     — streams PRIVATE objects through an ACL/org guard; the miss + cross-org branches 404/403
+ *                before the byte stream (the stream itself needs a real disk, out of harness scope).
+ *   - Callback — the SNS moderation endpoint; an empty/invalid body is a clean 400 (the signed-payload
+ *                branches need a real request body, out of harness scope).
+ */
+#[CoversClass(Media_IndexController::class)]
+#[CoversClass(Media_AdminController::class)]
+#[CoversClass(Media_FileController::class)]
+#[CoversClass(Media_CallbackController::class)]
+final class ControllersTest extends ModuleControllerTestCase
+{
+    #[Test]
+    public function index_renders_the_library_shell_with_thumbnail_config(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Media_IndexController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Media Library', (string) $view->title);
+        $this->assertTrue((bool) $view->useDataTables);
+        $this->assertSame(200, (int) $view->thumbPx);
+        $this->assertIsBool($view->clientThumb);
+    }
+
+    #[Test]
+    public function admin_settings_prefills_the_obfuscation_form(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Media_AdminController::class, 'settings', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Media Settings', (string) $view->title);
+        $this->assertInstanceOf(\Media_Form_Settings::class, $view->form);
+    }
+
+    #[Test]
+    public function file_serve_404s_for_a_missing_id(): void
+    {
+        $res = $this->dispatchAction(Media_FileController::class, 'serve', ['id' => ''], 'GET');
+        $this->assertSame(404, $res->getHttpResponseCode());
+    }
+
+    #[Test]
+    public function file_serve_403s_a_cross_org_private_object(): void
+    {
+        // A private object owned by org-a; a guest (no org) hits the org-scope guard → 403.
+        $id = (new Tiger_Model_Media())->insert([
+            'org_id'      => 'org-a',
+            'disk'        => 'local',
+            'storage_key' => 'org-a/documents/secret.txt',
+            'visibility'  => Tiger_Model_Media::VISIBILITY_PRIVATE,
+            'kind'        => Tiger_Model_Media::KIND_DOCUMENT,
+            'mime_type'   => 'text/plain',
+            'extension'   => 'txt',
+            'file_size'   => 5,
+            'filename'    => 'secret.txt',
+            'title'       => 'Secret',
+        ]);
+
+        $res = $this->dispatchAction(Media_FileController::class, 'serve', ['id' => $id], 'GET');
+        $this->assertSame(403, $res->getHttpResponseCode());
+    }
+
+    #[Test]
+    public function callback_400s_an_empty_body(): void
+    {
+        // CLI has no php://input body → json_decode('') is null → the "bad request" guard.
+        $res = $this->dispatchAction(Media_CallbackController::class, 'index', [], 'POST');
+        $this->assertSame(400, $res->getHttpResponseCode());
+        $this->assertStringContainsString('bad request', $res->getBody());
+    }
+}
diff --git a/tests/Integration/Profile/ControllersTest.php b/tests/Integration/Profile/ControllersTest.php
new file mode 100644
index 0000000..fec2466
--- /dev/null
+++ b/tests/Integration/Profile/ControllersTest.php
@@ -0,0 +1,92 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Profile;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Profile_IndexController;
+use Profile_OrgController;
+use Tiger\Tests\Support\ModuleControllerTestCase;
+
+/**
+ * The two Profile admin-shell controllers — /profile (the signed-in user's own account) and
+ * /profile/org (the admin's own-org profile). Both are thin: init() sets the admin layout, indexAction
+ * assembles the tabbed shell's view model (forms, contacts/addresses, locales, avatar/logo) from the
+ * signed-in identity's user/org row. The harness dispatches each action with rendering off and asserts
+ * the view model the action built — covering the branch logic without a theme render.
+ */
+#[CoversClass(Profile_IndexController::class)]
+#[CoversClass(Profile_OrgController::class)]
+final class ControllersTest extends ModuleControllerTestCase
+{
+    #[Test]
+    public function user_profile_index_builds_the_tabbed_view_model_for_the_signed_in_user(): void
+    {
+        $this->loginAs('user');
+        $this->dispatchAction(Profile_IndexController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Profile', (string) $view->title);
+        $this->assertTrue((bool) $view->useIntlTel);
+        $this->assertTrue((bool) $view->useAddress);
+
+        $model = $view->model;
+        $this->assertIsArray($model);
+        $this->assertInstanceOf(\Profile_Form_UserProfile::class, $model['form']);
+        $this->assertInstanceOf(\Profile_Form_Password::class, $model['passwordForm']);
+        $this->assertInstanceOf(\Profile_Form_Contact::class, $model['contactForm']);
+        // Locales come from tiger.i18n.locales ('en,es') mapped to display names.
+        $this->assertSame(['en' => 'English', 'es' => 'Español'], $model['locales']);
+        $this->assertSame('US', $model['phoneDefault']);
+        $this->assertIsArray($model['countries']);
+        $this->assertIsArray($model['timezones']);
+    }
+
+    #[Test]
+    public function user_profile_index_falls_back_to_english_when_no_locales_configured(): void
+    {
+        // No tiger.i18n node → the controller defaults the supported set to ['en'].
+        $this->tiger(['profile' => ['phone' => ['default_country' => 'CA']]]);
+        $this->loginAs('user');
+        $this->dispatchAction(Profile_IndexController::class, 'index', [], 'GET');
+
+        $model = $this->controller()->view->model;
+        $this->assertSame(['en' => 'English'], $model['locales']);
+        $this->assertSame('CA', $model['phoneDefault']);
+    }
+
+    #[Test]
+    public function user_profile_index_runs_for_a_guest_with_no_identity(): void
+    {
+        // No login → the empty-userId branch: no user row, blank collections, still a full view model.
+        $this->dispatchAction(Profile_IndexController::class, 'index', [], 'GET');
+
+        $model = $this->controller()->view->model;
+        $this->assertSame('', $model['username']);
+        $this->assertSame('', $model['email']);
+        $this->assertSame([], $model['contacts']);
+        $this->assertSame([], $model['addresses']);
+        $this->assertSame('', $model['displayName']);
+    }
+
+    #[Test]
+    public function org_profile_index_builds_the_org_view_model(): void
+    {
+        $this->loginAs('admin');
+        $this->dispatchAction(Profile_OrgController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Organization', (string) $view->title);
+        $this->assertTrue((bool) $view->useIntlTel);
+
+        $model = $view->model;
+        $this->assertInstanceOf(\Profile_Form_OrgProfile::class, $model['form']);
+        // The org twin drives the shared collection views to the org-scoped services by exact name.
+        $this->assertSame('OrgContact', $model['contactSvc']);
+        $this->assertSame('OrgAddress', $model['addressSvc']);
+        $this->assertSame('US', $model['phoneDefault']);
+        $this->assertIsArray($model['countries']);
+    }
+}
diff --git a/tests/Integration/Schedule/IndexControllerTest.php b/tests/Integration/Schedule/IndexControllerTest.php
new file mode 100644
index 0000000..49f3fa0
--- /dev/null
+++ b/tests/Integration/Schedule/IndexControllerTest.php
@@ -0,0 +1,61 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Schedule;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use ReflectionClass;
+use Schedule_IndexController;
+use Tiger\Tests\Support\ModuleControllerTestCase;
+use Tiger_Schedule;
+
+/**
+ * Schedule_IndexController — the Scheduler admin screen. Thin: it walks the Tiger_Schedule registry and
+ * the latest-run-per-job state into a $jobs view model for the initial render; every mutation is an /api
+ * call. The harness dispatches index rendering-off and asserts the assembled model — with a job seeded
+ * into the registry so the per-job loop body runs.
+ */
+#[CoversClass(Schedule_IndexController::class)]
+final class IndexControllerTest extends ModuleControllerTestCase
+{
+    protected function tearDown(): void
+    {
+        // The registry is process-static — clear the seeded job so it can't leak into other suites.
+        $ref = new ReflectionClass(Tiger_Schedule::class);
+        $ref->getProperty('_jobs')->setValue(null, []);
+        $ref->getProperty('_discovered')->setValue(null, false);
+        parent::tearDown();
+    }
+
+    #[Test]
+    public function index_assembles_the_job_list_from_the_registry(): void
+    {
+        Tiger_Schedule::register([
+            'key'   => 'w6.test.job',
+            'label' => 'W6 Test Job',
+            'every' => 'daily',
+            'at'    => '03:00',
+            'run'   => static function () { return true; },
+        ]);
+
+        $this->loginAs('admin');
+        $this->dispatchAction(Schedule_IndexController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Scheduler', (string) $view->title);
+        $this->assertIsArray($view->jobs);
+        $this->assertNotEmpty($view->jobs);
+        $this->assertIsString($view->cronCommand);
+
+        $keys = array_column($view->jobs, 'key');
+        $this->assertContains('w6.test.job', $keys);
+
+        $job = $view->jobs[array_search('w6.test.job', $keys, true)];
+        $this->assertSame('W6 Test Job', $job['label']);
+        $this->assertArrayHasKey('next_run', $job);
+        $this->assertArrayHasKey('enabled', $job);
+        $this->assertNull($job['last'], 'no run recorded yet');
+    }
+}
diff --git a/tests/Integration/Search/IndexControllerTest.php b/tests/Integration/Search/IndexControllerTest.php
new file mode 100644
index 0000000..09e83d5
--- /dev/null
+++ b/tests/Integration/Search/IndexControllerTest.php
@@ -0,0 +1,52 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Search;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Search_IndexController;
+use Tiger\Tests\Support\ModuleControllerTestCase;
+
+/**
+ * Search_IndexController — the public /search results page (server-rendered so search works without JS
+ * and results are crawlable). An empty term renders the bare page (no query); a term runs Tiger_Search
+ * scoped to the caller's role. The harness dispatches index rendering-off and asserts the view model.
+ */
+#[CoversClass(Search_IndexController::class)]
+final class IndexControllerTest extends ModuleControllerTestCase
+{
+    #[Test]
+    public function index_with_no_term_renders_the_bare_search_page(): void
+    {
+        $this->dispatchAction(Search_IndexController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertSame('', (string) $view->term);
+        $this->assertNull($view->results, 'no query means no results object');
+        $this->assertSame('Search', (string) $view->title);
+    }
+
+    #[Test]
+    public function index_with_a_term_runs_a_query_as_guest(): void
+    {
+        $this->dispatchAction(Search_IndexController::class, 'index', ['q' => 'tiger'], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertSame('tiger', (string) $view->term);
+        $this->assertNotNull($view->results, 'a term produces a results object');
+        $this->assertStringContainsString('tiger', (string) $view->title);
+    }
+
+    #[Test]
+    public function index_uses_the_signed_in_role_for_the_query(): void
+    {
+        // An authenticated caller's role flows into Tiger_Search::query (ACL-scoped results).
+        $this->loginAs('admin');
+        $this->dispatchAction(Search_IndexController::class, 'index', ['q' => 'report'], 'GET');
+
+        $this->assertSame('report', (string) $this->controller()->view->term);
+        $this->assertNotNull($this->controller()->view->results);
+    }
+}
diff --git a/tests/Integration/Signup/IndexControllerTest.php b/tests/Integration/Signup/IndexControllerTest.php
new file mode 100644
index 0000000..32a38d7
--- /dev/null
+++ b/tests/Integration/Signup/IndexControllerTest.php
@@ -0,0 +1,63 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\Signup;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use Signup_IndexController;
+use Tiger\Tests\Support\ModuleControllerTestCase;
+use Tiger_Model_Option;
+use Zend_Controller_Action_Exception;
+
+/**
+ * Signup_IndexController — the public signup screen + the email-verify link handler. init() switches to
+ * the 'auth' layout; index renders the form (or 404s when public signup is disabled, or redirects an
+ * already-authenticated user to /admin); verify consumes the emailed link and reports ok/failure. The
+ * harness dispatches each action rendering-off and asserts the outcome.
+ */
+#[CoversClass(Signup_IndexController::class)]
+final class IndexControllerTest extends ModuleControllerTestCase
+{
+    #[Test]
+    public function index_renders_the_signup_form_for_a_guest(): void
+    {
+        $this->dispatchAction(Signup_IndexController::class, 'index', [], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('Create your account', (string) $view->title);
+        $this->assertInstanceOf(\Signup_Form_Signup::class, $view->form);
+        $this->assertTrue((bool) $view->authWide);
+        // init() switched to the public 'auth' layout.
+        $this->assertSame('auth', $this->controller()->getHelper('layout')->getLayout());
+    }
+
+    #[Test]
+    public function index_redirects_an_authenticated_user_to_admin(): void
+    {
+        $this->loginAs('user');
+        $this->dispatchAction(Signup_IndexController::class, 'index', [], 'GET');
+
+        $this->assertStringContainsString('/admin', $this->redirectLocation());
+    }
+
+    #[Test]
+    public function index_404s_when_public_signup_is_disabled(): void
+    {
+        (new Tiger_Model_Option())->set(Tiger_Model_Option::SCOPE_GLOBAL, '', 'signup.public_disabled', '1');
+
+        $this->expectException(Zend_Controller_Action_Exception::class);
+        $this->dispatchAction(Signup_IndexController::class, 'index', [], 'GET');
+    }
+
+    #[Test]
+    public function verify_reports_failure_for_a_bogus_token(): void
+    {
+        $this->dispatchAction(Signup_IndexController::class, 'verify', ['cid' => 'nope', 'code' => 'bad'], 'GET');
+
+        $view = $this->controller()->view;
+        $this->assertStringContainsString('verification', (string) $view->title);
+        $this->assertFalse((bool) $view->ok);
+    }
+}
diff --git a/tests/Integration/System/ModulesServiceExtraTest.php b/tests/Integration/System/ModulesServiceExtraTest.php
new file mode 100644
index 0000000..11208c6
--- /dev/null
+++ b/tests/Integration/System/ModulesServiceExtraTest.php
@@ -0,0 +1,187 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\System;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use System_Service_Modules;
+use Tiger\Tests\Support\IntegrationTestCase;
+use Tiger_Model_Module;
+
+// System_Service_Modules resolves via the harness module autoloader (tests/bootstrap.php).
+
+/**
+ * System_Service_Modules — the DEEPER branches Wave 4's ModulesServiceTest left uncovered: the actual
+ * activate/deactivate toggle for a real on-disk module (the `module.active` flag write + the
+ * dependency/asset bookkeeping), the registry `search()` read, and the `upload()` error-code guards.
+ * Everything here runs WITHOUT the network: `blog` is a bundled module that ships neither a `migrations/`
+ * nor an `assets/` dir, so its toggle is a pure DB write (rolled back per-test), and the registry index
+ * is seeded into its file cache so `search()` never reaches GitHub.
+ *
+ * The install-from-URL / install-from-upload success paths and the theme-toggle path are NOT reachable
+ * here (they need a live repo, a real multipart upload, or a `type:theme` module on disk) — see
+ * WAVE6-FINDINGS-system.md.
+ */
+#[CoversClass(System_Service_Modules::class)]
+final class ModulesServiceExtraTest extends IntegrationTestCase
+{
+    /** A bundled module with no migrations/ and no assets/ → a side-effect-free toggle target. */
+    private const TARGET = 'blog';
+
+    /** Registry index cache path + its original contents (null = didn't exist) for restore. */
+    private ?string $registryFile = null;
+    private ?string $registryOrig = null;
+
+    protected function tearDown(): void
+    {
+        if ($this->registryFile !== null) {
+            if ($this->registryOrig !== null) { @file_put_contents($this->registryFile, $this->registryOrig); }
+            else { @unlink($this->registryFile); }
+        }
+        parent::tearDown();
+    }
+
+    private function dispatch(array $msg): object
+    {
+        return (new System_Service_Modules($msg))->getResponse();
+    }
+
+    private function messages(object $res): string
+    {
+        return json_encode($res->messages ?? []);
+    }
+
+    // ---- activate / deactivate a real module -----------------------------------------------------
+
+    #[Test]
+    public function a_superadmin_can_activate_a_real_module_flipping_its_flag(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatch(['action' => 'activate', 'slug' => self::TARGET]);
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertStringContainsString('activated', $this->messages($res));
+        $this->assertSame('/system/modules', $res->redirect, 'the manager redirect is returned');
+        $this->assertSame(self::TARGET, $res->data['slug']);
+        $this->assertTrue((bool) $res->data['active']);
+        // The activation branch reports missing required modules (empty for a dependency-free module).
+        $this->assertArrayHasKey('requires_missing', $res->data);
+
+        $row = (new Tiger_Model_Module())->bySlug(self::TARGET);
+        $this->assertNotNull($row, 'the module row was written');
+        $this->assertSame(1, (int) $row->active, 'the flag is active in the DB (rolled back after the test)');
+    }
+
+    #[Test]
+    public function a_superadmin_can_deactivate_a_real_module_and_is_told_its_dependents(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatch(['action' => 'deactivate', 'slug' => self::TARGET]);
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertStringContainsString('deactivated', $this->messages($res));
+        $this->assertFalse((bool) $res->data['active']);
+        // The deactivate branch surfaces which OTHER modules depend on this one (the confirm prompt).
+        $this->assertArrayHasKey('dependents', $res->data);
+        $this->assertIsArray($res->data['dependents']);
+
+        $row = (new Tiger_Model_Module())->bySlug(self::TARGET);
+        $this->assertSame(0, (int) $row->active, 'the flag is deactivated in the DB');
+    }
+
+    // ---- registry search (seeded cache, no network) ----------------------------------------------
+
+    #[Test]
+    public function search_returns_the_registry_listing_from_the_seeded_cache(): void
+    {
+        $this->seedRegistryIndex([
+            'modules' => [
+                ['slug' => 'demo-widget', 'name' => 'Demo Widget', 'description' => 'A demo listing',
+                 'repository' => 'https://github.com/WebTigers/DemoWidget', 'type' => 'plugin'],
+                ['slug' => 'other', 'name' => 'Other Thing', 'description' => 'unrelated',
+                 'repository' => 'https://github.com/WebTigers/Other', 'type' => 'plugin'],
+            ],
+        ]);
+
+        $this->loginAs('superadmin');
+        $res = $this->dispatch(['action' => 'search', 'q' => 'demo', 'sort' => 'title']);
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertTrue((bool) $res->data['available'], 'the seeded index reads as available');
+        $this->assertSame('title', $res->data['sort']);
+        $this->assertCount(1, $res->data['results'], 'the query matched exactly the demo listing');
+        $this->assertSame('demo-widget', $res->data['results'][0]['slug']);
+    }
+
+    #[Test]
+    public function a_plain_admin_is_denied_the_registry_search(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatch(['action' => 'search', 'q' => 'anything']);
+
+        $this->assertSame(0, (int) $res->result, 'searching the registry is superadmin+');
+        $this->assertStringContainsString('not_allowed', $this->messages($res));
+    }
+
+    // ---- upload() error-code guards (no real multipart upload) -----------------------------------
+
+    #[Test]
+    public function upload_reports_a_file_that_exceeds_the_server_size_limit(): void
+    {
+        $this->loginAs('superadmin');
+        $_FILES['archive'] = ['name' => 'big.zip', 'tmp_name' => '', 'error' => UPLOAD_ERR_INI_SIZE, 'size' => 0];
+        try {
+            $res = $this->dispatch(['action' => 'upload']);
+        } finally {
+            unset($_FILES['archive']);
+        }
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('larger than the server allows', $this->messages($res));
+    }
+
+    #[Test]
+    public function upload_reports_a_generic_transport_error(): void
+    {
+        $this->loginAs('superadmin');
+        $_FILES['archive'] = ['name' => 'x.zip', 'tmp_name' => '', 'error' => UPLOAD_ERR_PARTIAL, 'size' => 0];
+        try {
+            $res = $this->dispatch(['action' => 'upload']);
+        } finally {
+            unset($_FILES['archive']);
+        }
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('Upload failed', $this->messages($res));
+    }
+
+    #[Test]
+    public function upload_rejects_a_tmp_path_that_was_not_an_http_upload(): void
+    {
+        // error=OK but tmp_name isn't a real uploaded file → the is_uploaded_file guard fires (the
+        // spoofed-path defense) BEFORE any extraction is attempted.
+        $this->loginAs('superadmin');
+        $_FILES['archive'] = ['name' => 'x.zip', 'tmp_name' => '/etc/hosts', 'error' => UPLOAD_ERR_OK, 'size' => 1];
+        try {
+            $res = $this->dispatch(['action' => 'upload']);
+        } finally {
+            unset($_FILES['archive']);
+        }
+
+        $this->assertSame(0, (int) $res->result);
+        $this->assertStringContainsString('Invalid upload', $this->messages($res));
+    }
+
+    // ---- seeding ---------------------------------------------------------------------------------
+
+    private function seedRegistryIndex(array $index): void
+    {
+        $file = rtrim(APPLICATION_ROOT, '/') . '/storage/cache/registry-index.json';
+        $this->registryFile = $file;
+        $this->registryOrig = is_file($file) ? (string) file_get_contents($file) : null;
+        @mkdir(dirname($file), 0775, true);
+        @file_put_contents($file, json_encode($index));
+    }
+}
diff --git a/tests/Integration/System/SystemControllerDispatchTest.php b/tests/Integration/System/SystemControllerDispatchTest.php
new file mode 100644
index 0000000..4c4360a
--- /dev/null
+++ b/tests/Integration/System/SystemControllerDispatchTest.php
@@ -0,0 +1,183 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\System;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use System_AclController;
+use System_LogsController;
+use System_ModulesController;
+use System_SettingsController;
+use System_UpdatesController;
+use Tiger\Tests\Support\ControllerTestCase;
+use Zend_Config;
+use Zend_Registry;
+use Zend_Session;
+
+/**
+ * The System module's five admin-shell controllers (the Modules Manager, System Settings, Logs viewer,
+ * ACL Simulator, and Updates screen). Each is deliberately THIN — it renders the screen and delegates
+ * every mutation + data pull to an `/api` service (ADMIN.md) — so these dispatch tests cover the action
+ * BODIES (view-var assignment, the model/config reads that build the screen) with rendering off, the way
+ * `CoreControllerDispatchTest` does for the default-namespace controllers.
+ *
+ * The controllers were 0% before this test (never instantiated in the service-only Wave 4 suite); the
+ * network-touching helpers (registry availability, the update checker) are made deterministic by seeding
+ * their file caches so no dispatch reaches out to GitHub/Packagist.
+ */
+#[CoversClass(System_AclController::class)]
+#[CoversClass(System_LogsController::class)]
+#[CoversClass(System_ModulesController::class)]
+#[CoversClass(System_SettingsController::class)]
+#[CoversClass(System_UpdatesController::class)]
+final class SystemControllerDispatchTest extends ControllerTestCase
+{
+    private bool $priorUnitTestMode;
+    /** @var array<int,string> cache files this test created (removed in tearDown). */
+    private array $seededCaches = [];
+    private bool $setConfig = false;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // FlashMessenger (armed in Tiger_Controller_Action::init) uses a Zend_Session namespace —
+        // enable ZF1's CLI-safe unit-test session mode exactly as CoreControllerDispatchTest does.
+        $this->priorUnitTestMode = Zend_Session::$_unitTestEnabled;
+        Zend_Session::$_unitTestEnabled = true;
+        $_SESSION = [];
+
+        // System_SettingsController reads Zend_Config unconditionally; register a minimal one (an empty
+        // `tiger` node exercises the "no override → defaults" branch cleanly).
+        if (!Zend_Registry::isRegistered('Zend_Config')) {
+            Zend_Registry::set('Zend_Config', new Zend_Config(['tiger' => []]));
+            $this->setConfig = true;
+        }
+
+        // Make the registry-availability + update-check reads offline-deterministic (else a 30–60s
+        // network timeout, and possibly a live version diff). A low "latest" → no pending update →
+        // the Updates screen never fetches changelog notes.
+        $this->seedCache($this->registryCacheFile(), json_encode(['fetched' => time(), 'modules' => []]));
+        $this->seedCache($this->updateCacheFile('core'), json_encode(['v' => '0.0.1']));
+    }
+
+    protected function tearDown(): void
+    {
+        foreach ($this->seededCaches as $f) { @unlink($f); }
+        if ($this->setConfig) {
+            $reg = Zend_Registry::getInstance();
+            unset($reg['Zend_Config']);
+        }
+        $_SESSION = [];
+        Zend_Session::$_unitTestEnabled = $this->priorUnitTestMode;
+        parent::tearDown();
+    }
+
+    // ---- the thin render actions -----------------------------------------------------------------
+
+    #[Test]
+    public function the_acl_simulator_screen_dispatches_and_sets_its_title(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatchAction(System_AclController::class, 'index');
+
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertStringContainsString('ACL Simulator', (string) $this->controller()->view->title);
+    }
+
+    #[Test]
+    public function the_logs_screen_dispatches_and_sets_its_title(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatchAction(System_LogsController::class, 'index');
+
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertStringContainsString('Logs', (string) $this->controller()->view->title);
+    }
+
+    #[Test]
+    public function the_modules_screen_builds_the_on_disk_module_list(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatchAction(System_ModulesController::class, 'index');
+
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $modules = $this->controller()->view->modules;
+        $this->assertIsArray($modules);
+        $this->assertNotEmpty($modules, 'the disk scan surfaced the bundled modules');
+
+        // Each row carries the manifest + the derived activation/guard fields the view renders.
+        $row = $modules[0];
+        $this->assertArrayHasKey('active', $row);
+        $this->assertArrayHasKey('protected', $row);
+        $this->assertArrayHasKey('source', $row);
+
+        // The PROTECTED core modules must be flagged so the view disables their toggle.
+        $bySlug = [];
+        foreach ($modules as $m) { $bySlug[$m['slug']] = $m; }
+        $this->assertTrue($bySlug['system']['protected'], 'system is a protected module');
+    }
+
+    #[Test]
+    public function the_add_module_screen_exposes_the_registry_state(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatchAction(System_ModulesController::class, 'add');
+
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertNotEmpty((string) $this->controller()->view->registryUrl, 'the registry index URL is exposed');
+        // Seeded cache → available() resolves true without any network call.
+        $this->assertTrue((bool) $this->controller()->view->registryHasData);
+    }
+
+    #[Test]
+    public function the_settings_screen_prefills_the_form_from_live_config(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatchAction(System_SettingsController::class, 'index');
+
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertInstanceOf(\System_Form_Settings::class, $this->controller()->view->form);
+        $this->assertStringContainsString('System Settings', (string) $this->controller()->view->title);
+        // The signup kill-switch (lazy option tier) resolves to a bool for the checkbox.
+        $this->assertIsBool($this->controller()->view->signupDisabled);
+    }
+
+    #[Test]
+    public function the_updates_screen_reports_detection_without_reaching_the_network(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatchAction(System_UpdatesController::class, 'index');
+
+        $this->assertSame(200, $res->getHttpResponseCode());
+        $this->assertIsArray($this->controller()->view->updates, 'the checker result is passed to the view');
+        // Seeded low "latest" → nothing pending → the pending list is empty (and no notes were fetched).
+        $this->assertSame([], $this->controller()->view->pending);
+        $this->assertIsArray($this->controller()->view->history);
+    }
+
+    // ---- cache seeding helpers -------------------------------------------------------------------
+
+    private function seedCache(string $file, string $body): void
+    {
+        if (is_file($file)) { return; }        // never clobber a real cache
+        @mkdir(dirname($file), 0775, true);
+        if (@file_put_contents($file, $body) !== false) {
+            $this->seededCaches[] = $file;
+        }
+    }
+
+    /** Tiger_Module_Registry::_cacheFile() → APPLICATION_ROOT/storage/cache/registry-index.json. */
+    private function registryCacheFile(): string
+    {
+        return rtrim(APPLICATION_ROOT, '/') . '/storage/cache/registry-index.json';
+    }
+
+    /** Tiger_Update_Checker::_cacheDir() → dirname(APPLICATION_PATH)/var/cache/updates/<key>.json. */
+    private function updateCacheFile(string $key): string
+    {
+        return dirname(APPLICATION_PATH) . '/var/cache/updates/' . $key . '.json';
+    }
+}
diff --git a/tests/Integration/System/UpdatesServiceExtraTest.php b/tests/Integration/System/UpdatesServiceExtraTest.php
new file mode 100644
index 0000000..3533a2f
--- /dev/null
+++ b/tests/Integration/System/UpdatesServiceExtraTest.php
@@ -0,0 +1,132 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Integration\System;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use System_Service_Updates;
+use Tiger\Tests\Support\IntegrationTestCase;
+
+// System_Service_Updates resolves via the harness module autoloader (tests/bootstrap.php).
+
+/**
+ * System_Service_Updates — the branches Wave 4's UpdatesServiceTest left uncovered: the `check()`
+ * detection read, and the `apply()` orchestration itself (build the pending index → dispatch each
+ * selected slug → record the run to `update_history`). We drive `apply()` with a slug that ISN'T
+ * pending, which exercises the whole apply body — the "unknown/no-longer-pending" resolution result,
+ * `_recordHistory` (the OUTCOME_FAILED path), and `_wasRolledBack` — WITHOUT running the real
+ * `_applyOne` installer/composer engine (which needs a live release + a writable vendor/). The core
+ * version check is seeded into its file cache so no dispatch reaches Packagist.
+ *
+ * `_applyOne`'s core-update and module-update branches (network + real installer) are characterized
+ * only at the ACL/guard level here — see WAVE6-FINDINGS-system.md.
+ */
+#[CoversClass(System_Service_Updates::class)]
+final class UpdatesServiceExtraTest extends IntegrationTestCase
+{
+    /** Core version-check cache path + original contents for restore. */
+    private string $coreCacheFile = '';
+    private ?string $coreCacheOrig = null;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        // Seed a low "latest" so Tiger_Update_Checker::all() resolves offline with nothing pending.
+        $this->coreCacheFile = dirname(APPLICATION_PATH) . '/var/cache/updates/core.json';
+        $this->coreCacheOrig = is_file($this->coreCacheFile) ? (string) file_get_contents($this->coreCacheFile) : null;
+        @mkdir(dirname($this->coreCacheFile), 0775, true);
+        @file_put_contents($this->coreCacheFile, json_encode(['v' => '0.0.1']));
+    }
+
+    protected function tearDown(): void
+    {
+        if ($this->coreCacheFile !== '') {
+            if ($this->coreCacheOrig !== null) { @file_put_contents($this->coreCacheFile, $this->coreCacheOrig); }
+            else { @unlink($this->coreCacheFile); }
+        }
+        parent::tearDown();
+    }
+
+    private function dispatch(array $msg): object
+    {
+        return (new System_Service_Updates($msg))->getResponse();
+    }
+
+    private function messages(object $res): string
+    {
+        return json_encode($res->messages ?? []);
+    }
+
+    // ---- check() ---------------------------------------------------------------------------------
+
+    #[Test]
+    public function check_returns_the_detection_list_for_a_superadmin(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatch(['action' => 'check']);
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertIsArray($res->data['updates'], 'the checker result is returned');
+        // The seeded core descriptor is present and, with a low latest, is not flagged for update.
+        $core = null;
+        foreach ($res->data['updates'] as $u) { if (($u['slug'] ?? '') === 'tiger-core') { $core = $u; } }
+        $this->assertNotNull($core, 'the platform (tiger-core) is always a checkable item');
+        $this->assertFalse((bool) $core['update'], 'the seeded low latest means no pending core update');
+    }
+
+    #[Test]
+    public function a_plain_admin_is_denied_checking_for_updates(): void
+    {
+        $this->loginAs('admin');
+        $res = $this->dispatch(['action' => 'check']);
+
+        $this->assertSame(0, (int) $res->result, 'checking is superadmin+');
+        $this->assertStringContainsString('not_allowed', $this->messages($res));
+    }
+
+    // ---- apply() orchestration (unknown item → full body, no installer) --------------------------
+
+    #[Test]
+    public function apply_resolves_an_item_that_is_not_pending_and_records_the_run(): void
+    {
+        $this->loginAs('superadmin');
+        $res = $this->dispatch(['action' => 'apply', 'items' => 'no-such-module']);
+
+        // The run "succeeds" as an operation (it dispatched); the item itself failed to resolve.
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertStringContainsString('system.update.done', $this->messages($res));
+
+        $this->assertCount(1, $res->data['results']);
+        $item = $res->data['results'][0];
+        $this->assertSame('no-such-module', $item['slug']);
+        $this->assertFalse((bool) $item['ok'], 'an unknown/no-longer-pending item does not succeed');
+        $this->assertSame('resolve', $item['log'][0]['step'], 'the resolution step is logged');
+    }
+
+    #[Test]
+    public function apply_accepts_a_comma_separated_string_of_items(): void
+    {
+        // `items` may arrive as a CSV string (not just an array) — it's split + trimmed.
+        $this->loginAs('superadmin');
+        $res = $this->dispatch(['action' => 'apply', 'items' => 'ghost-a, ghost-b']);
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $slugs = array_map(static fn ($r) => $r['slug'], $res->data['results']);
+        $this->assertSame(['ghost-a', 'ghost-b'], $slugs, 'both CSV items were dispatched');
+    }
+
+    // ---- history() -------------------------------------------------------------------------------
+
+    #[Test]
+    public function history_defaults_its_limit_and_returns_a_list(): void
+    {
+        // No `limit` param → the default (20) branch; the read is fail-soft and always a success.
+        $this->loginAs('superadmin');
+        $res = $this->dispatch(['action' => 'history']);
+
+        $this->assertSame(1, (int) $res->result, $this->messages($res));
+        $this->assertIsArray($res->data['history']);
+    }
+}
diff --git a/tests/Support/ControllerTestCase.php b/tests/Support/ControllerTestCase.php
index 975fd68..a863b32 100644
--- a/tests/Support/ControllerTestCase.php
+++ b/tests/Support/ControllerTestCase.php
@@ -66,6 +66,11 @@ protected function setUp(): void
         $vr->setView($view);
         $vr->setNoRender(true);                              // cover action logic, not .phtml rendering
 
+        // The redirector helper calls `exit` after sending headers by default — which would end the
+        // PHPUnit process mid-test. Turn that off so an action's `gotoUrl()`/`_redirect()` is assertable
+        // via redirectLocation() instead of killing the run.
+        Zend_Controller_Action_HelperBroker::getStaticHelper('redirector')->setExit(false);
+
         Zend_Layout::startMvc()->setView($view)->disableLayout();
     }
 
diff --git a/tests/Support/ModuleControllerTestCase.php b/tests/Support/ModuleControllerTestCase.php
new file mode 100644
index 0000000..7d108bb
--- /dev/null
+++ b/tests/Support/ModuleControllerTestCase.php
@@ -0,0 +1,112 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+
+namespace Tiger\Tests\Support;
+
+use Zend_Config;
+use Zend_Controller_Action_HelperBroker;
+use Zend_Registry;
+use Zend_Session;
+use Zend_Translate;
+
+/**
+ * ModuleControllerTestCase — a ControllerTestCase specialized for the module admin/index controllers
+ * (Wave 6 sweep). Those controllers extend `Tiger_Controller_Admin_Action`, whose init() wires a
+ * FlashMessenger (needs an array-backed session under CLI) and reads `Zend_Config`/`Zend_Translate`
+ * from the registry — and several actions read config/translate DIRECTLY (unguarded). So this base
+ * turns on the CLI session, and stashes + registers a working `Zend_Config` + `Zend_Translate` for the
+ * duration of a test, restoring the prior registry state in tearDown.
+ *
+ * A test tweaks the config for its case via `setConfig(['tiger' => [...]])` (or the `tiger()` shorthand);
+ * the default config is enough for a bare admin render.
+ *
+ * @internal test infrastructure.
+ */
+abstract class ModuleControllerTestCase extends ControllerTestCase
+{
+    private bool $priorUnitTestMode = false;
+    private bool $hadConfig = false;
+    private $priorConfig = null;
+    private bool $hadTranslate = false;
+    private $priorTranslate = null;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // Array-backed session so the FlashMessenger + Zend_Session_Namespace run under CLI.
+        $this->priorUnitTestMode = Zend_Session::$_unitTestEnabled;
+        Zend_Session::$_unitTestEnabled = true;
+        $_SESSION = [];
+
+        // A controller `_redirect()` otherwise calls exit() (kills the PHPUnit process). Turn it off so
+        // gotoUrl() just sets the Location header — assertable via redirectLocation().
+        Zend_Controller_Action_HelperBroker::getStaticHelper('redirector')->setExit(false);
+
+        $reg = Zend_Registry::getInstance();
+        $this->hadConfig    = $reg->offsetExists('Zend_Config');
+        $this->priorConfig  = $this->hadConfig ? Zend_Registry::get('Zend_Config') : null;
+        $this->hadTranslate = $reg->offsetExists('Zend_Translate');
+        $this->priorTranslate = $this->hadTranslate ? Zend_Registry::get('Zend_Translate') : null;
+
+        $this->tiger([
+            'site'      => ['name' => 'Tiger', 'tagline' => 'Test tagline'],
+            'i18n'      => ['locales' => 'en,es'],
+            'profile'   => ['phone' => ['default_country' => 'US']],
+            'media'     => ['variants' => ['server' => '1', 'thumbnail' => '200']],
+            'analytics' => ['enabled' => '0', 'exclude_signed_in' => '1', 'ga4' => ['measurement_id' => '']],
+            'backup'    => ['components' => 'database,media', 'disk' => 'local'],
+        ]);
+        $this->registerTranslate();
+    }
+
+    protected function tearDown(): void
+    {
+        $reg = Zend_Registry::getInstance();
+
+        if ($this->hadConfig) {
+            Zend_Registry::set('Zend_Config', $this->priorConfig);
+        } elseif ($reg->offsetExists('Zend_Config')) {
+            $reg->offsetUnset('Zend_Config');
+        }
+        if ($this->hadTranslate) {
+            Zend_Registry::set('Zend_Translate', $this->priorTranslate);
+        } elseif ($reg->offsetExists('Zend_Translate')) {
+            $reg->offsetUnset('Zend_Translate');
+        }
+
+        $_SESSION = [];
+        Zend_Session::$_unitTestEnabled = $this->priorUnitTestMode;
+        parent::tearDown();
+    }
+
+    /** Register a `Zend_Config` whose top node is `tiger` (the shape every Tiger controller reads). */
+    protected function tiger(array $tiger): void
+    {
+        $this->setConfig(['tiger' => $tiger]);
+    }
+
+    /** Register an arbitrary `Zend_Config` from an array. */
+    protected function setConfig(array $data): void
+    {
+        Zend_Registry::set('Zend_Config', new Zend_Config($data));
+    }
+
+    /**
+     * Register a `Zend_Translate` array adapter. Untranslated keys fall through to the key itself (the
+     * platform's own behavior), so a controller that translates a title gets a usable string either way.
+     */
+    protected function registerTranslate(): void
+    {
+        $translate = new Zend_Translate([
+            'adapter' => 'array',
+            'content' => [
+                'profile.title'     => 'Profile',
+                'profile.org.title' => 'Organization',
+            ],
+            'locale'  => 'en',
+        ]);
+        Zend_Registry::set('Zend_Translate', $translate);
+    }
+}